From e99cc690ceb3802d31853b5bf9afae423854162c Mon Sep 17 00:00:00 2001 From: Jordan Coeyman Date: Fri, 19 Jun 2026 10:55:48 -0400 Subject: [PATCH 1/7] Build fixed Up capabilities and CLI --- README.md | 200 ++++--- cli/up.ts | 163 ++++++ docs/0.0.1-source-brief.md | 93 +++ docs/reference/schedules.md | 31 - docs/reference/site-secrets.md | 24 - examples/DYNAMIC.md | 21 - examples/dynamic-site/_worker.js | 36 -- examples/lunch-vote/app.js | 82 +++ examples/lunch-vote/index.html | 47 ++ examples/lunch-vote/style.css | 115 ++++ package.json | 4 + receipts/2026-06-19-alchemy-v2-decision.md | 38 ++ scripts/setup.ts | 24 +- skills/up/SKILL.md | 39 ++ skills/up/client.d.ts | 52 ++ src/capabilities.ts | 230 ++++++++ src/core-backend.ts | 525 +++++------------ src/core.ts | 50 +- src/index.ts | 2 +- src/kit-worker.ts | 2 +- src/registry.ts | 395 ++----------- src/secrets.ts | 59 -- src/site-database.ts | 70 +++ src/site-realtime.ts | 70 +++ src/site-secrets.ts | 128 ----- src/site.svelte | 368 +----------- tests/ssr.test.ts | 3 +- tests/up.test.ts | 622 +++------------------ wrangler.jsonc | 62 +- wrangler.local.jsonc | 53 +- wrangler.production.jsonc | 72 ++- wrangler.staged.jsonc | 62 +- wrangler.test.jsonc | 49 +- 33 files changed, 1643 insertions(+), 2148 deletions(-) create mode 100644 cli/up.ts create mode 100644 docs/0.0.1-source-brief.md delete mode 100644 docs/reference/schedules.md delete mode 100644 docs/reference/site-secrets.md delete mode 100644 examples/DYNAMIC.md delete mode 100644 examples/dynamic-site/_worker.js create mode 100644 examples/lunch-vote/app.js create mode 100644 examples/lunch-vote/index.html create mode 100644 examples/lunch-vote/style.css create mode 100644 receipts/2026-06-19-alchemy-v2-decision.md create mode 100644 skills/up/SKILL.md create mode 100644 skills/up/client.d.ts create mode 100644 src/capabilities.ts delete mode 100644 src/secrets.ts create mode 100644 src/site-realtime.ts delete mode 100644 src/site-secrets.ts diff --git a/README.md b/README.md index 78e38e6..8b40697 100644 --- a/README.md +++ b/README.md @@ -1,139 +1,161 @@ # Up [![Deploy to Cloudflare](https://deploy.workers.cloudflare.com/button)](https://deploy.workers.cloudflare.com/?url=https://github.com/acoyfellow/up) -[![MIT License](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE) +[![MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE) -**Publish your company’s private web from your Cloudflare account.** +**Publish a folder to a company-private URL.** -Up turns folders of HTML, CSS, JavaScript, and assets into company-private URLs. An organization connects Cloudflare once; employees and coding agents can then share small sites without creating infrastructure or configuring authentication for every artifact. +An organization installs Up once in its Cloudflare account. Employees and coding agents can then publish small internal apps without creating a repository, deployment pipeline, database, credentials, or authentication flow for each app. ```text -folder → immutable private upload → Access-authenticated URL +folder + name → verified upload → atomic activation → company-private URL ``` -**Version:** `0.0.1` · **Dogfood:** +Dogfood: · Version: `0.0.1` -## Deploy +## Publish -Up uses Cloudflare OAuth. You approve a scoped consent screen; no API token or Access audience is created or copied by hand. +Browser: -```sh -export UP_OAUTH_CLIENT_ID= -bun run oauth:connect +```text +Open Up → choose folder → choose name → publish +``` -export CLOUDFLARE_ACCOUNT_ID= -export UP_CONTROL_HOST=up.example.com -export UP_PARENT_ZONE=example.com -export UP_ALLOWED_DOMAIN=example.com -bun run setup +CLI: + +```sh +bunx github:acoyfellow/up init +bunx github:acoyfellow/up deploy ./dist lunch-vote ``` -`bun run setup` creates an isolated child zone when requested, delegates only the control hostname, creates private R2 and the Access application, reads back its generated AUD, injects it into a gitignored deploy config, and deploys the Worker. `workers.dev` and Preview URLs remain disabled. +```text +Authenticated · 3 files ready +Uploading 3/3 style.css +Published -Open `https://up.example.com/app`, choose a folder containing `index.html`, and publish. Sites appear at `.up.example.com` behind the same company Access boundary. +https://lunch-vote.up.example.com +Access: your organization +``` -The portable deployment fails closed until Access is configured. **Do not make the Worker public to finish setup.** +Both clients use the same manifest, upload, and activation API. A copied URL does not grant access; Up verifies a company session before returning content. -## What publishing does +## Fixed browser API -1. The browser hashes every file locally and declares a bounded manifest. -2. Up creates a pending immutable deployment in its Durable Object. -3. Each uploaded R2 object must match the declared path, size, and SHA-256 digest. -4. Activation verifies every object, then atomically swaps the active deployment pointer. -5. Site requests enforce explicit visibility: public, company session, or restricted reader rules. +Every site can import one same-origin module: -Visitors see either the prior complete deployment or the new complete deployment—never a partial upload. +```js +import { up } from '/_up/client.js'; -## Security invariant +const viewer = await up.identity.current(); -> A URL never grants private authority, and a deployment is not done until an isolated probe proves its declared visibility. +const votes = up.db.collection('votes'); +await votes.create({ choice: 'Tacos', voter: viewer.email }); -- Control routes validate the Access signature, issuer, audience, and email. -- Company/restricted sites require an HMAC-signed session minted by the Access-protected broker. -- Public serving requires explicit registry state; absence of identity never implies public. -- Missing Access or session configuration fails closed for non-public sites. -- R2 has no public object URLs. -- Production disables `workers.dev` and Preview URLs. -- Site creators and configured administrators can mutate a site. -- Cross-site control mutations are rejected using exact-origin and Fetch Metadata checks. -- Browser code runs on sibling hostnames. Optional backend code receives only explicitly enabled, site-scoped capability stubs. -- Site names, deployment IDs, hashes, and object keys grant no authority. +await up.files.put('menu.txt', new Blob(['Tacos · Pizza · Salad'])); -Read [SECURITY.md](SECURITY.md) before attaching a real company hostname. +const result = await up.ai.chat([ + { role: 'user', content: 'Summarize today’s vote' } +]); -## Repository map +const room = up.realtime.channel('votes'); +room.on('vote', renderVote); +room.send('vote', { choice: 'Tacos' }); +``` + +Browser code receives no Cloudflare credentials or resource identifiers. -| Path | Purpose | +| API | Cloudflare mechanism | |---|---| -| `src/routes/` | SvelteKit SSR pages, server loads, metadata, and authenticated publisher route | -| `src/core-backend.ts` | Access validation, control APIs, deployment authority, and wildcard site serving | -| `src/site.svelte` | Shared product and publisher interface, initialized from SvelteKit server data | -| `tests/` | Real Workers runtime, Durable Object, and R2 integration tests | -| `fixtures/` | Static site used by the end-to-end verification path | -| `docs/` | Diátaxis documentation | -| `wrangler.jsonc` | Portable Deploy to Cloudflare resources; fail-closed defaults | -| `wrangler.production.jsonc` | Dogfood route shape; placeholders must be replaced before deploy | +| `up.identity` | Access-backed Up session | +| `up.db` | site-named SQLite Durable Object | +| `up.files` | site-prefixed private R2 objects | +| `up.ai` | Workers AI with a fixed model and limits | +| `up.realtime` | site-and-channel Durable Object WebSockets | -## Documentation +## Complete example -- [Tutorial](docs/tutorial/index.md) — install and publish a first site -- [How-to guides](docs/how-to/index.md) — operate and recover an installation -- [Reference](docs/reference/index.md) — exact routes, limits, and configuration -- [Explanation](docs/explanation/index.md) — architecture and trust boundaries +[`examples/lunch-vote`](examples/lunch-vote) is plain HTML, CSS, and JavaScript. Two authenticated browsers can vote, see realtime updates, upload a menu, and ask Workers AI for a summary. It has no `_worker.js`, credentials, framework, or infrastructure configuration. -The product front door is public at ; the dogfood publisher and control APIs remain behind Cloudflare Access. +Demo video: **coming in this release** -## Local verification +## Install for a company -There is intentionally no local authentication bypass. +Up uses Cloudflare OAuth. The current operator path is: ```sh -bun install -bun run build -bun run typecheck -bun run test -bun run dry-run +export UP_OAUTH_CLIENT_ID= +bun run oauth:connect + +export CLOUDFLARE_ACCOUNT_ID= +export UP_CONTROL_HOST=up.example.com +export UP_PARENT_ZONE=example.com +export UP_ALLOWED_DOMAIN=example.com +bun run setup ``` -The test suite executes the real Worker, SQLite-backed Durable Objects, R2, session broker, capability stores, scheduler, and Dynamic Worker boundary under Cloudflare’s Workers Vitest pool. It proves visibility rules, digest enforcement, atomic activation, runtime limits, database isolation, encrypted secret metadata, schedule quotas/retries, public serving, and anonymous denial. +The installer creates customer-owned resources: -For a stable manual publish fixture, choose [`examples/baseline-site`](examples/BASELINE.md). It exercises nested CSS, JavaScript, SVG, a text asset, and the authenticated identity endpoint without external dependencies. +```text +Cloudflare Access + ↓ +Up Worker + SvelteKit assets + ├── private R2 + ├── Registry Durable Object + ├── Database Durable Object namespace + ├── Realtime Durable Object namespace + └── Workers AI +``` -For the browser pass: +The Worker, Access application, DNS, R2, and Durable Objects remain visible in the customer account. `workers.dev` and preview URLs stay disabled. -```sh -bun run dev -bun run test:e2e -``` +Alchemy v2 was tested and omitted from this revision because it cannot yet express Workers AI and Access without custom provider code. See [`receipts/2026-06-19-alchemy-v2-decision.md`](receipts/2026-06-19-alchemy-v2-decision.md). -The local browser pass audits SvelteKit SSR with JavaScript enabled and disabled, validates SEO/PWA metadata, and confirms protected endpoints fail closed. The authenticated publish flow is verified only against an actual Access-protected deployment. +## Trust boundary -## Production done gate +- Every new site is company-private. +- The site hostname selects scope only after Up verifies identity. +- Site A cannot address Site B’s database, files, or realtime room. +- Browser code never receives AI or storage credentials. +- Deployment files stay pending until every path, size, and SHA-256 digest passes verification. +- Activation changes one pointer, so visitors receive a complete old or complete new deployment. +- Anonymous probes receive Access before uploaded bytes. -A release is done only after all of these are recorded: +Read [SECURITY.md](SECURITY.md) for the exact contracts. -- local build, typecheck, runtime tests, dry run, browser test, SEO/PWA audit; -- deployment watched to success; -- public docs and every canonical link checked; -- authenticated folder publish succeeds; -- returned site renders HTML and assets; -- `/__up/me` returns the authenticated Access identity; -- a clean isolated browser is challenged by Access and never receives uploaded bytes; -- update and atomic activation are verified; -- deployment receipt records git SHA, route exposure, bindings, and the checks above. +## Repository map -## Status +```text +src/core-backend.ts deploy protocol and site request routing +src/capabilities.ts fixed browser API and site scoping +src/site-database.ts document collections +src/site-realtime.ts authenticated channel WebSockets +src/auth.ts Access JWT verification +cli/up.ts init and deploy +skills/up/ agent instructions and client types +examples/lunch-vote/ complete framework-free proof +tests/up.test.ts runtime, capability, and isolation proof +wrangler.jsonc installation graph +``` + +The source contract is captured in [`docs/0.0.1-source-brief.md`](docs/0.0.1-source-brief.md). -Up `0.0.1` is static and company-private by default, with explicit progressive capabilities: +## Verify -- **Visibility:** company, restricted email/domain/IdP-group readers, or confirmed public access -- **Backend:** an optional root `_worker.js` executes `/api/*` in a network-isolated Dynamic Worker -- **Secrets:** encrypted, write-only bearer capabilities restricted to exact outbound hosts -- **Data:** an isolated per-site SQLite Durable Object, enabled and deleted by the owner -- **Schedules:** bounded UTC jobs with daily quotas, retries, pause/disable behavior, and audit receipts +```sh +bun install +bun run check +bun run test:e2e +``` + +The suite uses the real Workers runtime, SQLite Durable Objects, R2, WebSockets, SvelteKit SSR, and Access/session logic. It does not use application mocks. + +## Documentation -Dynamic code never runs in the Up control isolate and never receives the registry, deployment authority, private R2 bucket, encryption keys, or another site's bindings. +- [Tutorial](docs/tutorial/index.md) +- [How-to guides](docs/how-to/index.md) +- [Reference](docs/reference/index.md) +- [Explanation](docs/explanation/index.md) ## License -MIT © Jordan Coeyman. +MIT © Jordan Coeyman diff --git a/cli/up.ts b/cli/up.ts new file mode 100644 index 0000000..cb87e61 --- /dev/null +++ b/cli/up.ts @@ -0,0 +1,163 @@ +#!/usr/bin/env bun +import { execFileSync } from 'node:child_process'; +import { createHash } from 'node:crypto'; +import { mkdir, readdir, readFile, stat, writeFile } from 'node:fs/promises'; +import { join, relative, resolve } from 'node:path'; + +const DEFAULT_ORIGIN = 'https://up.ax.cloudflare.dev'; +const command = process.argv[2]; +const args = process.argv.slice(3); + +function usage(): never { + console.error(`up 0.0.1 + +up init [directory] +up deploy [--origin https://up.example.com] +`); + process.exit(1); +} + +function option(name: string): string | undefined { + const index = args.indexOf(name); + return index >= 0 ? args[index + 1] : undefined; +} + +function accessToken(origin: string): string { + if (process.env.UP_ACCESS_TOKEN) return process.env.UP_ACCESS_TOKEN; + return execFileSync('cloudflared', ['access', 'token', '-app', origin], { + encoding: 'utf8', + stdio: ['ignore', 'pipe', 'inherit'], + }).trim(); +} + +async function files(root: string): Promise { + const output: string[] = []; + async function visit(directory: string): Promise { + for (const entry of await readdir(directory, { withFileTypes: true })) { + if (entry.name.startsWith('.') || entry.name === 'node_modules') continue; + const path = join(directory, entry.name); + if (entry.isDirectory()) await visit(path); + else if (entry.isFile()) output.push(path); + } + } + await visit(root); + return output.sort(); +} + +const mime = (path: string) => + path.endsWith('.html') + ? 'text/html; charset=utf-8' + : path.endsWith('.css') + ? 'text/css; charset=utf-8' + : path.endsWith('.js') + ? 'text/javascript; charset=utf-8' + : path.endsWith('.json') + ? 'application/json; charset=utf-8' + : path.endsWith('.svg') + ? 'image/svg+xml' + : path.endsWith('.png') + ? 'image/png' + : path.endsWith('.jpg') || path.endsWith('.jpeg') + ? 'image/jpeg' + : 'application/octet-stream'; + +async function init(): Promise { + const target = resolve(args[0] || '.'); + const directory = join(target, '.up'); + await mkdir(directory, { recursive: true }); + const source = resolve(import.meta.dir, '..', 'skills', 'up', 'SKILL.md'); + const types = resolve(import.meta.dir, '..', 'skills', 'up', 'client.d.ts'); + await Promise.all([ + writeFile(join(directory, 'SKILL.md'), await readFile(source)), + writeFile(join(directory, 'client.d.ts'), await readFile(types)), + ]); + console.log(`Initialized ${relative(process.cwd(), directory) || '.up'} + +Ask your agent to read .up/SKILL.md, build into ./dist, then run: + up deploy ./dist `); +} + +async function deploy(): Promise { + const root = resolve(args[0] || ''); + const name = args[1]; + const origin = option('--origin') || process.env.UP_ORIGIN || DEFAULT_ORIGIN; + if (!name || !/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(name)) usage(); + if (!(await stat(root).catch(() => null))?.isDirectory()) + throw new Error(`Folder not found: ${root}`); + const paths = await files(root); + if (!paths.some((path) => relative(root, path) === 'index.html')) + throw new Error('index.html is required'); + const token = accessToken(origin); + const authHeaders = { 'cf-access-token': token }; + const prepared = await Promise.all( + paths.map(async (path) => { + const bytes = await readFile(path); + return { + path, + bytes, + relative: relative(root, path).replaceAll('\\', '/'), + sha256: createHash('sha256').update(bytes).digest('hex'), + }; + }), + ); + const manifest = prepared.map((file) => ({ + path: file.relative, + size: file.bytes.byteLength, + contentType: mime(file.relative), + sha256: file.sha256, + })); + console.log(`Authenticated · ${prepared.length} files ready`); + const create = await fetch(`${origin}/api/sites/${encodeURIComponent(name)}/deployments`, { + method: 'POST', + headers: { + ...authHeaders, + origin, + 'sec-fetch-site': 'same-origin', + 'content-type': 'application/json', + }, + body: JSON.stringify({ manifest, access: { visibility: 'company', readers: [] } }), + }); + const created = (await create.json()) as { deployment?: { id: string }; error?: string }; + if (!create.ok || !created.deployment) + throw new Error(created.error || 'Unable to create deployment'); + for (let index = 0; index < prepared.length; index++) { + const file = prepared[index]; + if (!file) continue; + process.stdout.write( + `\rUploading ${index + 1}/${prepared.length} ${file.relative} `, + ); + const response = await fetch( + `${origin}/api/deployments/${created.deployment.id}/assets?path=${encodeURIComponent(file.relative)}`, + { + method: 'PUT', + headers: { + ...authHeaders, + origin, + 'sec-fetch-site': 'same-origin', + 'content-type': mime(file.relative), + }, + body: file.bytes, + }, + ); + if (!response.ok) + throw new Error(((await response.json()) as { error?: string }).error || 'Upload failed'); + } + const activate = await fetch(`${origin}/api/deployments/${created.deployment.id}/activate`, { + method: 'POST', + headers: { ...authHeaders, origin, 'sec-fetch-site': 'same-origin' }, + }); + const activated = (await activate.json()) as { siteUrl?: string; error?: string }; + if (!activate.ok) throw new Error(activated.error || 'Activation failed'); + console.log( + `\nPublished\n\n${activated.siteUrl || `${name}.${new URL(origin).hostname}`}\nAccess: your organization`, + ); +} + +try { + if (command === 'init') await init(); + else if (command === 'deploy') await deploy(); + else usage(); +} catch (error) { + console.error(`\n${error instanceof Error ? error.message : String(error)}`); + process.exit(1); +} diff --git a/docs/0.0.1-source-brief.md b/docs/0.0.1-source-brief.md new file mode 100644 index 0000000..52655fe --- /dev/null +++ b/docs/0.0.1-source-brief.md @@ -0,0 +1,93 @@ +# Up 0.0.1 source brief + +## Source + +Shopify Quick proved one useful mechanism: a company-wide identity boundary can turn a folder into a shareable internal app without creating infrastructure for each site. + +Up remixes that mechanism for Cloudflare customers. Each organization owns one Up installation and all of its Cloudflare resources. + +## Utility + +An employee or coding agent publishes a static folder to a company-private subdomain. The site's browser code can use five fixed, same-origin capabilities without credentials or infrastructure configuration: + +```js +import { up } from '/_up/client.js'; + +await up.identity.current(); +await up.db.collection('votes').create({ choice: 'Tacos' }); +await up.files.put('menu.txt', file); +await up.ai.chat([{ role: 'user', content: 'Summarize the votes' }]); +up.realtime.channel('votes'); +``` + +## Default path + +```text +folder + name → verified upload → atomic activation → company-private URL +``` + +Browser and CLI call the same deployment API. New sites are readable by the whole company. The default flow has no visibility, database, secret, runtime, or schedule choices. + +## Fixed capability contract + +| Capability | Cloudflare mechanism | Boundary | +|---|---|---| +| `up.identity` | Access-backed Up session | Current verified employee | +| `up.db` | Site-named SQLite Durable Object | One site; document collections only | +| `up.files` | Site-prefixed private R2 keys | One site; bounded objects and listing | +| `up.ai` | Workers AI binding | Fixed model policy and bounded requests | +| `up.realtime` | Site-and-channel Durable Object | Authenticated WebSockets scoped to one site | + +A URL is not authority. The site hostname selects scope only after Up verifies the company session. + +## Installation graph + +```text +Cloudflare Access + ↓ +Up Worker + SvelteKit assets + ├── private R2: deployments and site files + ├── Registry Durable Object + ├── Database Durable Object namespace + ├── Realtime Durable Object namespace + └── Workers AI +``` + +Alchemy v2 may express this graph if a disposable proof shows that it removes code and keeps local/deploy behavior clear. Otherwise Up uses a small Wrangler configuration. Alchemy is optional; the graph is not. + +## Repository map target + +```text +README.md seven-minute explanation +alchemy.run.ts|wrangler complete installation graph +src/core-backend.ts deploy and site request dispatch +src/capabilities/ fixed browser APIs +src/site-database.ts document collection storage +src/site-realtime.ts channel WebSockets +cli/up.ts init and deploy +examples/lunch-vote/ framework-free complete proof + tests/ deployment, capability, and isolation proof +``` + +## Explicit exclusions + +0.0.1 does not expose public sites, per-reader ACLs, custom backends, user-managed secrets, cron jobs, raw SQL, capability plugins, arbitrary AI providers, Git integration, or custom per-site infrastructure. + +Existing code for those features is disposable and should be deleted when the fixed capabilities replace it. + +## Public artifact + +`examples/lunch-vote` is understandable before clicking. Two employees can vote in separate browsers, see realtime updates, upload a menu, and request an AI summary. It contains only HTML, CSS, and browser JavaScript. + +## Review gate + +Stop for revision when all of these are true: + +- browser folder publishing and `up deploy` return the same company-private URL shape; +- `up init` writes the inspectable agent skill and client types; +- lunch-vote uses all five fixed APIs without `_worker.js` or credentials; +- two authenticated sessions exchange realtime updates; +- an anonymous browser receives Access before content; +- Site A cannot read Site B data, files, or channels; +- the repository README, infrastructure graph, client API, request router, and isolation test are understandable in seven minutes; +- a short raw demo video is committed to GitHub and linked from the README. diff --git a/docs/reference/schedules.md b/docs/reference/schedules.md deleted file mode 100644 index 91e3dff..0000000 --- a/docs/reference/schedules.md +++ /dev/null @@ -1,31 +0,0 @@ -# Scheduled jobs - -Up runs a single trusted scheduler every minute. Site schedules are registry records; they do not create arbitrary account-level cron triggers. - -A schedule targets an `/api/*` route handled by the active deployment's isolated `_worker.js`: - -```json -{ - "path": "/api/jobs/hourly", - "cron": "0 * * * *", - "maxRunsPerDay": 24, - "retryLimit": 3 -} -``` - -Supported expressions are minute intervals (`*/15 * * * *`), hourly minutes (`0 * * * *`), and daily UTC times (`30 9 * * *`). - -## Safety model - -- only owners and Up administrators can manage schedules -- schedules require a published site -- states are `enabled`, `paused`, and `disabled` -- the registry atomically leases due work for five minutes -- each attempt counts against the UTC daily quota -- failures retry with exponential backoff, capped at one hour -- exhausted retries advance to the next cron occurrence -- paused, disabled, over-quota, or unpublished sites do not execute -- each create, update, delete, success, failure, and quota skip creates a bounded audit record -- audit records contain path, cron, state, attempt, and HTTP status—never code, secret values, response bodies, or stack traces - -The scheduled request includes `x-up-schedule` plus a JSON body containing the schedule ID, scheduled time, and attempt number. It runs under the same Dynamic Worker CPU, subrequest, network, database, and secret-capability restrictions as an interactive backend request. diff --git a/docs/reference/site-secrets.md b/docs/reference/site-secrets.md deleted file mode 100644 index 46cea42..0000000 --- a/docs/reference/site-secrets.md +++ /dev/null @@ -1,24 +0,0 @@ -# Site secrets - -Up stores per-site secrets as AES-256-GCM ciphertext in a dedicated `SiteSecrets` Durable Object. The encryption key is generated by `bun run setup`, stored locally with mode `600`, and uploaded as a Worker secret. It is never written to Wrangler vars, R2, the registry, deployment manifests, receipts, or git. - -Only site owners and Up administrators can create, list, or delete secret capabilities. List responses contain names, allowed hosts, and update times—never ciphertext or plaintext. - -Dynamic code receives a site-specific `UP_SECRETS` stub. It cannot read a secret. Instead, it asks the stub to make an allowlisted HTTPS request: - -```js -const response = await env.UP_SECRETS.fetch( - 'https://secrets.internal/use/API_TOKEN', - { - method: 'POST', - headers: { 'content-type': 'application/json' }, - body: JSON.stringify({ - url: 'https://api.example.com/jobs', - method: 'POST', - body: JSON.stringify({ action: 'run' }), - }), - }, -); -``` - -The secret is injected as a bearer credential by the trusted Durable Object. Dynamic code cannot override authorization, cookies, host, or Access headers. Outbound hosts are exact allowlist entries. Only bounded text/JSON responses are returned, and direct occurrences of the secret are redacted. diff --git a/examples/DYNAMIC.md b/examples/DYNAMIC.md deleted file mode 100644 index 0a3f5a6..0000000 --- a/examples/DYNAMIC.md +++ /dev/null @@ -1,21 +0,0 @@ -# Dynamic baseline - -`examples/dynamic-site` is the deterministic production fixture for Up's optional server runtime. - -It contains: - -- `index.html` — static shell -- `_worker.js` — isolated `/api/receipt` backend - -Publish it with database access enabled. Interactive and scheduled requests append receipt rows to the site's isolated SQLite Durable Object. The response proves the Dynamic Worker runtime and database binding without using secrets or outbound network access. - -Expected API receipt: - -```json -{ - "runtime": "dynamic-worker", - "outbound": "blocked-by-default", - "database": [{ "kind": "interactive", "created_at": "..." }], - "scheduled": false -} -``` diff --git a/examples/dynamic-site/_worker.js b/examples/dynamic-site/_worker.js deleted file mode 100644 index 67d2674..0000000 --- a/examples/dynamic-site/_worker.js +++ /dev/null @@ -1,36 +0,0 @@ -async function database(env, sql, params = []) { - if (!env.UP_DB) return { error: 'database-disabled' }; - const response = await env.UP_DB.fetch('https://database.internal/query', { - method: 'POST', - headers: { 'content-type': 'application/json' }, - body: JSON.stringify({ sql, params }), - }); - return response.json(); -} - -export default { - async fetch(request, env) { - const url = new URL(request.url); - if (url.pathname === '/api/receipt') { - await database( - env, - 'CREATE TABLE IF NOT EXISTS receipts(id INTEGER PRIMARY KEY, kind TEXT, created_at TEXT)', - ); - await database(env, 'INSERT INTO receipts(kind,created_at) VALUES (?,?)', [ - request.headers.get('x-up-schedule') ? 'scheduled' : 'interactive', - new Date().toISOString(), - ]); - const result = await database( - env, - 'SELECT kind,created_at FROM receipts ORDER BY id DESC LIMIT 10', - ); - return Response.json({ - runtime: 'dynamic-worker', - outbound: 'blocked-by-default', - database: result.rows || [], - scheduled: Boolean(request.headers.get('x-up-schedule')), - }); - } - return Response.json({ error: 'not found' }, { status: 404 }); - }, -}; diff --git a/examples/lunch-vote/app.js b/examples/lunch-vote/app.js new file mode 100644 index 0000000..bd8fa75 --- /dev/null +++ b/examples/lunch-vote/app.js @@ -0,0 +1,82 @@ +import { up } from '/_up/client.js'; + +const viewer = document.querySelector('#viewer'); +const activity = document.querySelector('#activity'); +const liveStatus = document.querySelector('#live-status'); +const summary = document.querySelector('#summary'); +const menuLink = document.querySelector('#menu-link'); +const votes = up.db.collection('votes'); +const room = up.realtime.channel('votes'); +let currentUser; + +function note(text) { + const item = document.createElement('li'); + item.textContent = text; + activity.prepend(item); + while (activity.children.length > 6) activity.lastElementChild?.remove(); +} + +async function refresh() { + const { documents } = await votes.list(); + const counts = new Map(); + for (const vote of documents) counts.set(vote.choice, (counts.get(vote.choice) || 0) + 1); + for (const button of document.querySelectorAll('[data-choice]')) { + button.querySelector('span').textContent = String(counts.get(button.dataset.choice) || 0); + } + return documents; +} + +async function vote(choice) { + const created = await votes.create({ + choice, + voter: currentUser.email, + votedAt: new Date().toISOString(), + }); + note(`${currentUser.email} voted for ${choice}`); + room.send('vote', created); + await refresh(); +} + +room.on('open', () => { + liveStatus.textContent = 'Connected · updates appear in every open browser'; +}); +room.on('vote', async (message) => { + if (message.sender !== currentUser?.email) + note(`${message.sender} voted for ${message.data.choice}`); + await refresh(); +}); +room.on('presence', (message) => { + if (message.event === 'join') note(`${message.email} joined`); +}); +room.connect(); + +for (const button of document.querySelectorAll('[data-choice]')) { + button.addEventListener('click', () => vote(button.dataset.choice)); +} + +document.querySelector('#menu').addEventListener('change', async (event) => { + const file = event.target.files?.[0]; + if (!file) return; + const stored = await up.files.put(`menus/${file.name}`, file); + menuLink.href = stored.url; + menuLink.textContent = `Open ${file.name} ↗`; + menuLink.hidden = false; + note(`${currentUser.email} shared ${file.name}`); + room.send('file', { name: file.name }); +}); + +document.querySelector('#summarize').addEventListener('click', async () => { + const documents = await refresh(); + summary.textContent = 'Asking Workers AI…'; + const result = await up.ai.chat([ + { + role: 'user', + content: `Summarize this lunch vote in one short sentence: ${JSON.stringify(documents)}`, + }, + ]); + summary.textContent = result.response || result.result?.response || JSON.stringify(result); +}); + +currentUser = await up.identity.current(); +viewer.textContent = `Signed in as ${currentUser.email}`; +await refresh(); diff --git a/examples/lunch-vote/index.html b/examples/lunch-vote/index.html new file mode 100644 index 0000000..62a02d1 --- /dev/null +++ b/examples/lunch-vote/index.html @@ -0,0 +1,47 @@ + + + + + + Lunch Vote · Up + + + +
+
+

UP 0.0.1 PROOF

+

Where should we eat?

+

Checking company identity…

+
+ +
+ + + +
+ +
+
+

Live room

+

Connecting…

+
+
    +
    + +
    + + +
    + +
    +

    Summary

    +

    Vote to create a summary.

    + +
    +
    + + + diff --git a/examples/lunch-vote/style.css b/examples/lunch-vote/style.css new file mode 100644 index 0000000..dbf402b --- /dev/null +++ b/examples/lunch-vote/style.css @@ -0,0 +1,115 @@ +:root { + color-scheme: light; + font-family: Inter, ui-sans-serif, system-ui, sans-serif; + color: #17212b; + background: #f7f9fb; +} +* { + box-sizing: border-box; +} +body { + margin: 0; +} +main { + width: min(100% - 32px, 760px); + margin: 0 auto; + padding: 64px 0 96px; +} +header { + padding-bottom: 32px; + border-bottom: 1px solid #dce2e7; +} +.eyebrow { + color: #f6821f; + font: + 600 0.7rem ui-monospace, + monospace; + letter-spacing: 0.1em; +} +h1 { + margin: 12px 0; + font-size: clamp(2.5rem, 8vw, 5rem); + line-height: 0.95; + letter-spacing: -0.05em; +} +h2 { + margin: 0; + font-size: 1rem; +} +p { + color: #5e6d79; + line-height: 1.6; +} +.choices { + display: grid; + grid-template-columns: repeat(3, 1fr); + gap: 10px; + margin: 32px 0; +} +button, +.upload { + display: flex; + min-height: 52px; + align-items: center; + justify-content: space-between; + padding: 0 16px; + border: 1px solid #b9c3cb; + border-radius: 8px; + background: white; + color: inherit; + font: 700 0.86rem inherit; + cursor: pointer; +} +button:hover { + border-color: #f6821f; +} +button span { + color: #f6821f; + font-family: ui-monospace, monospace; +} +.panel, +.result { + padding: 22px; + border: 1px solid #dce2e7; + border-radius: 10px; + background: white; +} +.panel { + display: grid; + grid-template-columns: 0.8fr 1.2fr; + gap: 24px; +} +ul { + margin: 0; + padding: 0; + list-style: none; +} +li { + padding: 8px 0; + border-bottom: 1px solid #edf0f2; + color: #5e6d79; + font-size: 0.78rem; +} +.tools { + display: grid; + grid-template-columns: 1fr 1fr; + gap: 10px; + margin: 20px 0; +} +.upload input { + max-width: 180px; + font-size: 0.7rem; +} +.result a { + color: #2678a4; +} +@media (max-width: 600px) { + main { + padding-top: 36px; + } + .choices, + .tools, + .panel { + grid-template-columns: 1fr; + } +} diff --git a/package.json b/package.json index e439e8f..9adc368 100644 --- a/package.json +++ b/package.json @@ -3,8 +3,12 @@ "version": "0.0.1", "private": true, "type": "module", + "bin": { + "up": "./cli/up.ts" + }, "description": "Publish your company's private web from your Cloudflare account.", "scripts": { + "up": "bun run cli/up.ts", "build": "svelte-kit sync && vite build", "build:kit": "bun run build", "dev": "bun run build && wrangler dev --local --port 8798 -c wrangler.local.jsonc", diff --git a/receipts/2026-06-19-alchemy-v2-decision.md b/receipts/2026-06-19-alchemy-v2-decision.md new file mode 100644 index 0000000..fbdfb48 --- /dev/null +++ b/receipts/2026-06-19-alchemy-v2-decision.md @@ -0,0 +1,38 @@ +# Alchemy v2 decision — 2026-06-19 + +## Question + +Can Alchemy v2 simplify Up's customer-owned installation graph enough to improve the seven-minute repository? + +## Proof + +A disposable source-only spike used the local Effect-based Alchemy v2 package (`2.0.0-beta.25`), not Alchemy 0.x. It type-checked a declarative Worker with static assets, R2, and a SQLite Durable Object while disabling `workers.dev` and previews. + +No Cloudflare resource was created or modified. + +## Result: ditch for this revision + +Alchemy v2 does not currently provide two resources required by Up's fixed 0.0.1 graph: + +- a Workers AI binding in the Worker's accepted resource union; +- Cloudflare Access application and policy resources. + +Adding both through Up-specific custom providers would increase the source surface and duplicate Cloudflare API lifecycle code. That fails the reason to adopt Alchemy. + +Up therefore keeps one small Wrangler installation graph for this revision. The installer may use Cloudflare OAuth, but Alchemy is not in the runtime or deploy path. + +## Revisit condition + +Reconsider v2 when it natively expresses: + +```text +Worker + assets +R2 +SQLite Durable Objects +Workers AI +custom domain and wildcard route +Cloudflare Access application and policy +no workers.dev or previews +``` + +At that point, adoption must delete provisioning code rather than wrap it. diff --git a/scripts/setup.ts b/scripts/setup.ts index 0ef9486..e6b1c74 100644 --- a/scripts/setup.ts +++ b/scripts/setup.ts @@ -55,16 +55,6 @@ const compatDate = setting('COMPAT_DATE') || '2026-06-12'; const adminEmails = setting('ADMIN_EMAILS') || allowEmail || ''; const token = await resolveToken(); const cf = cfFactory(token); -const secretsKeyFile = setting('SECRETS_KEY_FILE') || '.up-secrets-key'; -let secretsKey = setting('SECRETS_KEY'); -if (!secretsKey) { - try { - secretsKey = (await readFile(secretsKeyFile, 'utf8')).trim(); - } catch { - secretsKey = randomBytes(32).toString('base64url'); - await writeFile(secretsKeyFile, `${secretsKey}\n`, { mode: 0o600 }); - } -} const sessionSecretFile = setting('SESSION_SECRET_FILE') || '.up-session-secret'; let sessionSecret = setting('SESSION_SECRET'); if (!sessionSecret) { @@ -142,18 +132,12 @@ const config = { bindings: [ { name: 'REGISTRY', class_name: 'UpRegistry' }, { name: 'SITE_DATABASE', class_name: 'SiteDatabase' }, - { name: 'SITE_SECRETS', class_name: 'SiteSecrets' }, + { name: 'SITE_REALTIME', class_name: 'SiteRealtime' }, ], }, - migrations: [ - { tag: 'v1', new_sqlite_classes: ['UpRegistry'] }, - { tag: 'v2', new_sqlite_classes: ['SiteDatabase'] }, - { tag: 'v3', new_sqlite_classes: ['SiteSecrets'] }, - { tag: 'v4' }, - ], + migrations: [{ tag: 'v1', new_sqlite_classes: ['UpRegistry', 'SiteDatabase', 'SiteRealtime'] }], + ai: { binding: 'AI' }, r2_buckets: [{ binding: 'ASSETS', bucket_name: bucket }], - worker_loaders: [{ binding: 'LOADER' }], - triggers: { crons: ['* * * * *'] }, }; await writeFile( configOut, @@ -187,8 +171,6 @@ async function putSecret(name: string, value: string) { } console.log('Uploading private site-session signing secret…'); await putSecret('SESSION_SECRET', sessionSecret); -console.log('Uploading private secret-encryption key…'); -await putSecret('SECRETS_KEY', secretsKey); console.log(`\nDone. https://${controlHost} is live behind Cloudflare Access.`); console.log('The Access AUD and private runtime secrets were wired automatically.'); diff --git a/skills/up/SKILL.md b/skills/up/SKILL.md new file mode 100644 index 0000000..1c1c128 --- /dev/null +++ b/skills/up/SKILL.md @@ -0,0 +1,39 @@ +# Up + +Use Up when the user asks for a small company-private website, prototype, dashboard, poll, presentation, or internal tool. + +## Build contract + +1. Build framework-free output into `./dist` unless the project already has a build system. +2. Include `dist/index.html`. +3. Keep each file under 10 MiB and the folder under 50 MiB. +4. Do not put credentials in browser code. +5. Use the fixed Up browser module for stateful features: + +```js +import { up } from '/_up/client.js'; +``` + +Available capabilities: + +```js +await up.identity.current(); +const records = up.db.collection('records'); +await records.create({ title: 'Hello' }); +await up.files.put('file.txt', new Blob(['hello'])); +await up.ai.chat([{ role: 'user', content: 'Summarize this' }]); +const room = up.realtime.channel('main'); +room.on('update', console.log); +room.send('update', { ok: true }); +``` + +6. Test the local static files before publishing. +7. Publish only after the user approves the folder and site name: + +```sh +up deploy ./dist +``` + +8. Return the company-private URL printed by Up. + +Do not ask the user about R2, Durable Objects, Access, bindings, databases, secrets, schedules, or Workers. Those belong to the company installation. diff --git a/skills/up/client.d.ts b/skills/up/client.d.ts new file mode 100644 index 0000000..ae5e007 --- /dev/null +++ b/skills/up/client.d.ts @@ -0,0 +1,52 @@ +export interface UpIdentity { + email: string; + groups: string[]; + role: 'member' | 'admin'; +} + +export interface UpDocument { + id: string; + [key: string]: unknown; +} + +export interface UpCollection> { + create(data: T): Promise; + get(id: string): Promise; + list(options?: { + limit?: number; + offset?: number; + }): Promise<{ documents: Array }>; + update(id: string, data: T): Promise; + delete(id: string): Promise<{ deleted: true; id: string }>; +} + +export interface UpChannel { + connect(): WebSocket; + on( + type: string, + listener: (message: { type: string; data?: unknown; sender?: string }) => void, + ): () => void; + send(type: string, data: unknown): void; + close(): void; +} + +export declare const up: { + identity: { current(): Promise }; + db: { collection>(name: string): UpCollection }; + files: { + put(name: string, file: Blob): Promise<{ name: string; size: number; url: string }>; + get(name: string): Promise; + list(): Promise<{ + files: Array<{ name: string; size: number; uploadedAt: string; contentType: string }>; + }>; + delete(name: string): Promise<{ deleted: true; name: string }>; + }; + ai: { + chat( + messages: Array<{ role: 'user' | 'assistant' | 'system'; content: string }>, + ): Promise<{ response?: string }>; + }; + realtime: { channel(name: string): UpChannel }; +}; + +export default up; diff --git a/src/capabilities.ts b/src/capabilities.ts new file mode 100644 index 0000000..8a0de28 --- /dev/null +++ b/src/capabilities.ts @@ -0,0 +1,230 @@ +import type { Identity, SiteRecord } from './core'; +import type { Env } from './core-backend'; + +const secure = { + 'cache-control': 'private, no-store', + 'referrer-policy': 'no-referrer', + 'x-content-type-options': 'nosniff', +}; +const json = (value: unknown, status = 200) => Response.json(value, { status, headers: secure }); +const collectionPattern = /^[a-z][a-z0-9_-]{0,47}$/; +const channelPattern = /^[a-z0-9][a-z0-9_-]{0,47}$/; +const MAX_FILE_BYTES = 10 * 1024 * 1024; +const MAX_AI_INPUT = 20_000; + +function siteFilePath(pathname: string): string | null { + let value: string; + try { + value = decodeURIComponent(pathname).replace(/^\/+/, ''); + } catch { + return null; + } + if (!value || value.length > 240 || value.includes('..') || /[\\\0]/.test(value)) return null; + return value + .split('/') + .map((part) => part.trim()) + .filter(Boolean) + .join('/'); +} + +function fileKey(site: string, path: string): string { + return `site-files/${site}/${path}`; +} + +function clientModule(): string { + return `const request=async(path,init={})=>{const response=await fetch('/_up/'+path,{...init,headers:{...init.headers,'accept':'application/json'}});if(!response.ok){let body={};try{body=await response.json()}catch{}throw new Error(body.error||('Up request failed: '+response.status))}const type=response.headers.get('content-type')||'';return type.includes('application/json')?response.json():response}; +const collection=(name)=>({ + create:(data)=>request('db/'+encodeURIComponent(name),{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify(data)}), + get:(id)=>request('db/'+encodeURIComponent(name)+'/'+encodeURIComponent(id)), + list:(options={})=>request('db/'+encodeURIComponent(name)+'?'+new URLSearchParams({limit:String(options.limit||100),offset:String(options.offset||0)})), + update:(id,data)=>request('db/'+encodeURIComponent(name)+'/'+encodeURIComponent(id),{method:'PUT',headers:{'content-type':'application/json'},body:JSON.stringify(data)}), + delete:(id)=>request('db/'+encodeURIComponent(name)+'/'+encodeURIComponent(id),{method:'DELETE'}) +}); +const channel=(name)=>{let socket,listeners=new Map();const emit=(type,value)=>{for(const fn of listeners.get(type)||[])fn(value)};return{ + connect(){if(socket&&socket.readyState<=1)return socket;const protocol=location.protocol==='https:'?'wss:':'ws:';socket=new WebSocket(protocol+'//'+location.host+'/_up/realtime/'+encodeURIComponent(name));socket.onmessage=(event)=>{try{const message=JSON.parse(event.data);emit(message.type,message)}catch{emit('message',event.data)}};socket.onopen=()=>emit('open',{});socket.onclose=()=>emit('close',{});return socket}, + on(type,fn){const set=listeners.get(type)||new Set();set.add(fn);listeners.set(type,set);return()=>set.delete(fn)}, + send(type,data){const ws=this.connect();const payload=JSON.stringify({type,data});if(ws.readyState===WebSocket.OPEN)ws.send(payload);else ws.addEventListener('open',()=>ws.send(payload),{once:true})}, + close(){socket?.close()} +}}; +export const up={ + identity:{current:()=>request('identity')}, + db:{collection}, + files:{ + put:async(name,file)=>{const response=await fetch('/_up/files/'+encodeURIComponent(name),{method:'PUT',headers:{'content-type':file.type||'application/octet-stream'},body:file});if(!response.ok)throw new Error((await response.json().catch(()=>({}))).error||'Upload failed');return response.json()}, + get:(name)=>fetch('/_up/files/'+encodeURIComponent(name)).then(response=>{if(!response.ok)throw new Error('File not found');return response}), + list:()=>request('files'), + delete:(name)=>request('files/'+encodeURIComponent(name),{method:'DELETE'}) + }, + ai:{chat:(messages)=>request('ai/chat',{method:'POST',headers:{'content-type':'application/json'},body:JSON.stringify({messages})})}, + realtime:{channel} +}; +export default up; +`; +} + +async function databaseRequest( + request: Request, + env: Env, + site: SiteRecord, + pathname: string, +): Promise { + if (!env.SITE_DATABASE) return json({ error: 'Database is not configured' }, 503); + const match = pathname.match(/^db\/([^/]+)(?:\/([^/]+))?$/); + if (!match || !collectionPattern.test(match[1] || '')) + return json({ error: 'Invalid collection' }, 400); + const collection = match[1] as string; + const id = match[2] ? decodeURIComponent(match[2]) : undefined; + if (id && !/^[a-zA-Z0-9_-]{1,64}$/.test(id)) return json({ error: 'Invalid document id' }, 400); + const target = new URL( + `https://database.internal/collections/${encodeURIComponent(collection)}${id ? `/${encodeURIComponent(id)}` : ''}`, + ); + target.search = new URL(request.url).search; + const stub = env.SITE_DATABASE.get(env.SITE_DATABASE.idFromName(site.name)); + return stub.fetch(new Request(target, request)); +} + +async function filesRequest( + request: Request, + env: Env, + site: SiteRecord, + pathname: string, +): Promise { + if (pathname === 'files' && request.method === 'GET') { + const prefix = fileKey(site.name, ''); + const listed = await env.ASSETS.list({ prefix, limit: 1000 }); + return json({ + files: listed.objects.map((object) => ({ + name: object.key.slice(prefix.length), + size: object.size, + uploadedAt: object.uploaded.toISOString(), + contentType: object.httpMetadata?.contentType || 'application/octet-stream', + })), + }); + } + const path = siteFilePath(pathname.replace(/^files\/?/, '')); + if (!path) return json({ error: 'Invalid file name' }, 400); + const key = fileKey(site.name, path); + if (request.method === 'PUT') { + const length = Number(request.headers.get('content-length') || '0'); + if (length > MAX_FILE_BYTES) return json({ error: 'File exceeds 10 MiB' }, 413); + const bytes = await request.arrayBuffer(); + if (bytes.byteLength > MAX_FILE_BYTES) return json({ error: 'File exceeds 10 MiB' }, 413); + await env.ASSETS.put(key, bytes, { + httpMetadata: { + contentType: request.headers.get('content-type') || 'application/octet-stream', + }, + }); + return json( + { name: path, size: bytes.byteLength, url: `/_up/files/${encodeURIComponent(path)}` }, + 201, + ); + } + if (request.method === 'GET') { + const object = await env.ASSETS.get(key); + if (!object) return json({ error: 'File not found' }, 404); + const headers = new Headers(secure); + object.writeHttpMetadata(headers); + headers.set('etag', object.httpEtag); + return new Response(object.body, { headers }); + } + if (request.method === 'DELETE') { + await env.ASSETS.delete(key); + return json({ deleted: true, name: path }); + } + return json({ error: 'Method not allowed' }, 405); +} + +async function aiRequest(request: Request, env: Env): Promise { + if (!env.AI) return json({ error: 'AI is not configured' }, 503); + const input = await request.json<{ messages?: unknown }>().catch(() => null); + if ( + !input || + !Array.isArray(input.messages) || + input.messages.length < 1 || + input.messages.length > 24 + ) + return json({ error: 'Messages must contain 1-24 entries' }, 400); + const messages = input.messages.map((item) => { + if (!item || typeof item !== 'object') throw new Error('Invalid message'); + const value = item as Record; + if ( + !['user', 'assistant', 'system'].includes(String(value.role)) || + typeof value.content !== 'string' + ) + throw new Error('Invalid message'); + return { role: String(value.role), content: value.content.slice(0, 8000) }; + }); + if (JSON.stringify(messages).length > MAX_AI_INPUT) + return json({ error: 'AI input is too large' }, 413); + try { + const result = await env.AI.run( + '@cf/meta/llama-3.1-8b-instruct-fast' as keyof AiModels, + { + messages, + max_tokens: 512, + } as never, + ); + return json(result); + } catch { + return json({ error: 'AI request failed' }, 502); + } +} + +async function realtimeRequest( + request: Request, + env: Env, + site: SiteRecord, + identity: Identity, + pathname: string, +): Promise { + if (!env.SITE_REALTIME) return json({ error: 'Realtime is not configured' }, 503); + const channel = decodeURIComponent(pathname.slice('realtime/'.length)); + if (!channelPattern.test(channel)) return json({ error: 'Invalid channel' }, 400); + if (request.headers.get('upgrade')?.toLowerCase() !== 'websocket') + return json({ error: 'WebSocket upgrade required' }, 426); + const stub = env.SITE_REALTIME.get(env.SITE_REALTIME.idFromName(`${site.name}:${channel}`)); + const headers = new Headers(request.headers); + headers.set('x-up-email', identity.email); + headers.set('x-up-site', site.name); + headers.set('x-up-channel', channel); + return stub.fetch(new Request('https://realtime.internal/connect', { headers })); +} + +export async function handleCapabilityRequest( + request: Request, + env: Env, + site: SiteRecord, + identity: Identity, +): Promise { + const url = new URL(request.url); + if (!url.pathname.startsWith('/_up/')) return null; + if (['POST', 'PUT', 'PATCH', 'DELETE'].includes(request.method)) { + const origin = request.headers.get('origin'); + const fetchSite = request.headers.get('sec-fetch-site'); + if (origin !== url.origin || (fetchSite && fetchSite !== 'same-origin')) + return json({ error: 'Same-origin request required' }, 403); + } + if (request.headers.get('upgrade')?.toLowerCase() === 'websocket') { + const origin = request.headers.get('origin'); + if (origin && origin !== url.origin) + return json({ error: 'Same-origin request required' }, 403); + } + const pathname = url.pathname.slice('/_up/'.length); + if (pathname === 'client.js' && request.method === 'GET') + return new Response(clientModule(), { + headers: { + 'content-type': 'application/javascript; charset=utf-8', + 'cache-control': 'public, max-age=3600', + 'x-content-type-options': 'nosniff', + }, + }); + if (pathname === 'identity' && request.method === 'GET') + return json({ email: identity.email, groups: identity.groups || [], role: identity.role }); + if (pathname.startsWith('db/')) return databaseRequest(request, env, site, pathname); + if (pathname === 'files' || pathname.startsWith('files/')) + return filesRequest(request, env, site, pathname); + if (pathname === 'ai/chat' && request.method === 'POST') return aiRequest(request, env); + if (pathname.startsWith('realtime/')) + return realtimeRequest(request, env, site, identity, pathname); + return json({ error: 'Capability not found' }, 404); +} diff --git a/src/core-backend.ts b/src/core-backend.ts index 20b4e91..0172fc6 100644 --- a/src/core-backend.ts +++ b/src/core-backend.ts @@ -1,5 +1,6 @@ import { Hono } from 'hono'; import { type AccessConfiguration, configurationError, verifyAccessIdentity } from './auth'; +import { handleCapabilityRequest } from './capabilities'; import { type AssetManifestEntry, cleanAssetPath, @@ -8,16 +9,10 @@ import { type Identity, mayRead, mayWrite, - normalizeSchedule, - normalizeSiteAccess, - type ScheduleRecord, - type SiteAccess, type SiteRecord, - sha256, validateManifest, } from './core'; import type { UpRegistry } from './registry'; -import { cleanAllowedHosts, cleanSecretName, encryptSecret } from './secrets'; import { cookieValue, createSession, @@ -26,7 +21,8 @@ import { verifySession, } from './session'; import type { SiteDatabase } from './site-database'; -import type { SiteSecrets } from './site-secrets'; +import type { SiteRealtime } from './site-realtime'; + export interface Env extends AccessConfiguration { ASSETS: R2Bucket; REGISTRY: DurableObjectNamespace; @@ -35,12 +31,14 @@ export interface Env extends AccessConfiguration { MAX_SITE_BYTES?: string; MAX_FILE_BYTES?: string; MAX_FILES?: string; - LOADER?: WorkerLoader; SESSION_SECRET?: string; SITE_DATABASE?: DurableObjectNamespace; - SITE_SECRETS?: DurableObjectNamespace; - SECRETS_KEY?: string; + SITE_REALTIME?: DurableObjectNamespace; + /** Legacy binding retained only for safe migration of the existing Worker. */ + SITE_SECRETS?: DurableObjectNamespace; + AI?: Ai; } + const secure = { 'cache-control': 'no-store', 'referrer-policy': 'no-referrer', @@ -49,18 +47,10 @@ const secure = { 'permissions-policy': 'camera=(), microphone=(), geolocation=(), payment=(), usb=()', }; const json = (value: unknown, status = 200) => Response.json(value, { status, headers: secure }); -function limits(env: Env) { - const n = (v: string | undefined, d: number) => { - const p = Number(v); - return Number.isSafeInteger(p) && p > 0 ? p : d; - }; - return { - maxSiteBytes: n(env.MAX_SITE_BYTES, 52428800), - maxFileBytes: n(env.MAX_FILE_BYTES, 10485760), - maxFiles: n(env.MAX_FILES, 500), - }; -} const registry = (env: Env) => env.REGISTRY.get(env.REGISTRY.idFromName('registry')); +const assetKey = (deployment: DeploymentRecord, path: string) => + `deployments/${deployment.siteName}/${deployment.id}/${path}`; + class RegistryError extends Error { constructor( message: string, @@ -69,6 +59,7 @@ class RegistryError extends Error { super(message); } } + async function reg(env: Env, path: string, init?: RequestInit): Promise { const response = await registry(env).fetch(`https://registry.internal${path}`, init); const body = await response.json(); @@ -76,86 +67,44 @@ async function reg(env: Env, path: string, init?: RequestInit): Promise { throw new RegistryError(body.error || 'Registry request failed', response.status); return body; } -const key = (d: DeploymentRecord, path: string) => `deployments/${d.siteName}/${d.id}/${path}`; -const DYNAMIC_ENTRY = '_worker.js'; -const MAX_DYNAMIC_CODE_BYTES = 1024 * 1024; -export async function runDynamicSiteRequest( - request: Request, - env: Env, - deployment: DeploymentRecord, - site: SiteRecord, -): Promise { - const entry = deployment.manifest.find((asset) => asset.path === DYNAMIC_ENTRY); - if (!entry || !new URL(request.url).pathname.startsWith('/api/')) return null; - if (!env.LOADER) return json({ error: 'Dynamic runtime is not configured' }, 503); - if (entry.size > MAX_DYNAMIC_CODE_BYTES) - return json({ error: 'Dynamic worker is too large' }, 400); - try { - const worker = env.LOADER.get(`${deployment.id}:${entry.sha256}`, async () => { - const object = await env.ASSETS.get(key(deployment, DYNAMIC_ENTRY)); - if (!object) throw new Error('Dynamic worker code is missing'); - return { - compatibilityDate: '2026-06-16', - compatibilityFlags: ['nodejs_compat'], - mainModule: DYNAMIC_ENTRY, - modules: { [DYNAMIC_ENTRY]: await object.text() }, - env: { - ...(site.databaseEnabled && env.SITE_DATABASE - ? { - UP_DB: env.SITE_DATABASE.get(env.SITE_DATABASE.idFromName(site.name)), - } - : {}), - ...(env.SITE_SECRETS && env.SECRETS_KEY - ? { - UP_SECRETS: env.SITE_SECRETS.get(env.SITE_SECRETS.idFromName(site.name)), - } - : {}), - }, - globalOutbound: null, - limits: { cpuMs: 50, subRequests: 5 }, - } satisfies WorkerLoaderWorkerCode; - }); - const dynamic = await worker - .getEntrypoint(undefined, { limits: { cpuMs: 50, subRequests: 5 } }) - .fetch(request); - const headers = new Headers(dynamic.headers); - // Untrusted site code cannot set parent-domain cookies or weaken framing. - headers.delete('set-cookie'); - headers.set('x-content-type-options', 'nosniff'); - headers.set('content-security-policy', "frame-ancestors 'none'"); - headers.set('cache-control', 'private, no-store'); - return new Response(dynamic.body, { status: dynamic.status, headers }); - } catch { - return json({ error: 'Dynamic request failed' }, 502); - } +function limits(env: Env) { + const number = (value: string | undefined, fallback: number) => { + const parsed = Number(value); + return Number.isSafeInteger(parsed) && parsed > 0 ? parsed : fallback; + }; + return { + maxSiteBytes: number(env.MAX_SITE_BYTES, 50 * 1024 * 1024), + maxFileBytes: number(env.MAX_FILE_BYTES, 10 * 1024 * 1024), + maxFiles: number(env.MAX_FILES, 500), + }; } + function sameOrigin(request: Request): Response | null { - const originHeader = request.headers.get('origin'); + const origin = request.headers.get('origin'); const fetchSite = request.headers.get('sec-fetch-site'); - return originHeader !== new URL(request.url).origin || (fetchSite && fetchSite !== 'same-origin') + return origin !== new URL(request.url).origin || (fetchSite && fetchSite !== 'same-origin') ? json({ error: 'Same-origin request required' }, 403) : null; } -async function api(request: Request, env: Env, identity: Identity): Promise { + +async function controlApi(request: Request, env: Env, identity: Identity): Promise { const url = new URL(request.url); if (request.method === 'GET' && url.pathname === '/api/me') return json(identity); if (request.method === 'GET' && url.pathname === '/api/sites') { const result = await reg<{ sites: SiteRecord[] }>(env, '/sites'); - return json({ - sites: result.sites.filter((site) => mayRead(site, identity)), - siteDomain: env.SITE_DOMAIN || null, - }); + return json({ sites: result.sites, siteDomain: env.SITE_DOMAIN || null }); } if (['POST', 'PUT', 'PATCH', 'DELETE'].includes(request.method)) { const denied = sameOrigin(request); if (denied) return denied; } + const create = url.pathname.match(/^\/api\/sites\/([^/]+)\/deployments$/); if (request.method === 'POST' && create) { const siteName = cleanSiteName(create[1] || ''); if (!siteName) return json({ error: 'Invalid site name' }, 400); - const body = await request.json<{ manifest?: unknown; access?: unknown }>().catch(() => null); + const body = await request.json<{ manifest?: unknown }>().catch(() => null); if (!body) return json({ error: 'Invalid JSON body' }, 400); let manifest: AssetManifestEntry[]; try { @@ -163,225 +112,49 @@ async function api(request: Request, env: Env, identity: Identity): Promise(env, '/deployments', { method: 'POST', headers: { 'content-type': 'application/json' }, - body: JSON.stringify({ id, siteName, owner: identity.email, manifest, access }), + body: JSON.stringify({ + id: crypto.randomUUID(), + siteName, + owner: identity.email, + manifest, + access: { visibility: 'company', readers: [] }, + }), }); return json( { ...result, siteUrl: env.SITE_DOMAIN ? `https://${siteName}.${env.SITE_DOMAIN}` : null }, 201, ); } - const accessRoute = url.pathname.match(/^\/api\/sites\/([^/]+)\/access$/); - if (request.method === 'PATCH' && accessRoute) { - const siteName = cleanSiteName(accessRoute[1] || ''); - if (!siteName) return json({ error: 'Invalid site name' }, 400); - const { site } = await reg<{ site: SiteRecord }>(env, `/sites/${siteName}`); - if (!mayWrite(site.owner, identity)) return json({ error: 'Not found' }, 404); - const body = await request.json<{ access?: unknown }>().catch(() => null); - if (!body) return json({ error: 'Invalid JSON body' }, 400); - let access: SiteAccess; - try { - access = normalizeSiteAccess(body.access); - } catch (error) { - return json({ error: error instanceof Error ? error.message : 'Invalid site access' }, 400); - } - const result = await reg<{ site: SiteRecord }>(env, `/sites/${siteName}/access`, { - method: 'PATCH', - headers: { 'content-type': 'application/json' }, - body: JSON.stringify({ access }), - }); - return json(result); - } - const databaseRoute = url.pathname.match(/^\/api\/sites\/([^/]+)\/database$/); - if (request.method === 'PATCH' && databaseRoute) { - const siteName = cleanSiteName(databaseRoute[1] || ''); - if (!siteName) return json({ error: 'Invalid site name' }, 400); - const { site } = await reg<{ site: SiteRecord }>(env, `/sites/${siteName}`); - if (!mayWrite(site.owner, identity)) return json({ error: 'Not found' }, 404); - const body = await request.json<{ enabled?: unknown }>().catch(() => null); - if (!body || typeof body.enabled !== 'boolean') - return json({ error: 'Invalid database state' }, 400); - const result = await reg<{ site: SiteRecord }>(env, `/sites/${siteName}/database`, { - method: 'PATCH', - headers: { 'content-type': 'application/json' }, - body: JSON.stringify({ enabled: body.enabled }), - }); - if (!body.enabled && env.SITE_DATABASE) { - const stub = env.SITE_DATABASE.get(env.SITE_DATABASE.idFromName(siteName)); - await stub.fetch('https://database.internal/', { method: 'DELETE' }); - } - return json(result); - } - const schedulesRoute = url.pathname.match(/^\/api\/sites\/([^/]+)\/schedules$/); - if (schedulesRoute && ['GET', 'POST'].includes(request.method)) { - const siteName = cleanSiteName(schedulesRoute[1] || ''); - if (!siteName) return json({ error: 'Invalid site name' }, 400); - const { site } = await reg<{ site: SiteRecord }>(env, `/sites/${siteName}`); - if (!mayWrite(site.owner, identity)) return json({ error: 'Not found' }, 404); - if (request.method === 'GET') - return json(await reg<{ schedules: ScheduleRecord[] }>(env, `/sites/${siteName}/schedules`)); - if (!site.activeDeploymentId) - return json({ error: 'Publish the site before scheduling it' }, 409); - if (!site.runtimeEnabled) - return json({ error: 'Schedules require an active _worker.js runtime' }, 409); - const body = await request.json().catch(() => null); - let normalized: ReturnType; - try { - normalized = normalizeSchedule(body); - } catch (error) { - return json({ error: error instanceof Error ? error.message : 'Invalid schedule' }, 400); - } - const now = new Date().toISOString(); - const schedule: ScheduleRecord = { - id: crypto.randomUUID(), - siteName, - ...normalized, - attempts: 0, - createdAt: now, - updatedAt: now, - createdBy: identity.email, - }; - return json( - await reg<{ schedule: ScheduleRecord }>(env, `/sites/${siteName}/schedules`, { - method: 'POST', - headers: { 'content-type': 'application/json' }, - body: JSON.stringify(schedule), - }), - 201, - ); - } - const scheduleRoute = url.pathname.match(/^\/api\/sites\/([^/]+)\/schedules\/([^/]+)$/); - if (scheduleRoute && ['PATCH', 'DELETE'].includes(request.method)) { - const siteName = cleanSiteName(scheduleRoute[1] || ''); - if (!siteName) return json({ error: 'Invalid site name' }, 400); - const { site } = await reg<{ site: SiteRecord }>(env, `/sites/${siteName}`); - if (!mayWrite(site.owner, identity)) return json({ error: 'Not found' }, 404); - const list = await reg<{ schedules: ScheduleRecord[] }>(env, `/sites/${siteName}/schedules`); - const existing = list.schedules.find((item) => item.id === scheduleRoute[2]); - if (!existing) return json({ error: 'Not found' }, 404); - if (request.method === 'DELETE') - return json( - await reg(env, `/sites/${siteName}/schedules/${existing.id}`, { - method: 'DELETE', - headers: { 'content-type': 'application/json' }, - body: JSON.stringify({ actor: identity.email }), - }), - ); - const body = await request.json>().catch(() => null); - if (!body) return json({ error: 'Invalid JSON body' }, 400); - let normalized: ReturnType; - try { - normalized = normalizeSchedule({ - path: body.path ?? existing.path, - cron: body.cron ?? existing.cron, - status: body.status ?? existing.status, - maxRunsPerDay: body.maxRunsPerDay ?? existing.maxRunsPerDay, - retryLimit: body.retryLimit ?? existing.retryLimit, - }); - } catch (error) { - return json({ error: error instanceof Error ? error.message : 'Invalid schedule' }, 400); - } - return json( - await reg<{ schedule: ScheduleRecord }>(env, `/sites/${siteName}/schedules/${existing.id}`, { - method: 'PATCH', - headers: { 'content-type': 'application/json' }, - body: JSON.stringify({ - ...existing, - ...normalized, - updatedAt: new Date().toISOString(), - actor: identity.email, - }), - }), - ); - } - const auditRoute = url.pathname.match(/^\/api\/sites\/([^/]+)\/audit$/); - if (request.method === 'GET' && auditRoute) { - const siteName = cleanSiteName(auditRoute[1] || ''); - if (!siteName) return json({ error: 'Invalid site name' }, 400); - const { site } = await reg<{ site: SiteRecord }>(env, `/sites/${siteName}`); - if (!mayWrite(site.owner, identity)) return json({ error: 'Not found' }, 404); - return json(await reg(env, `/sites/${siteName}/audit`)); - } - const secretList = url.pathname.match(/^\/api\/sites\/([^/]+)\/secrets$/); - if (request.method === 'GET' && secretList) { - const siteName = cleanSiteName(secretList[1] || ''); - if (!siteName) return json({ error: 'Invalid site name' }, 400); - const { site } = await reg<{ site: SiteRecord }>(env, `/sites/${siteName}`); - if (!mayWrite(site.owner, identity)) return json({ error: 'Not found' }, 404); - if (!env.SITE_SECRETS || !env.SECRETS_KEY) - return json({ error: 'Secret storage is not configured' }, 503); - const stub = env.SITE_SECRETS.get(env.SITE_SECRETS.idFromName(siteName)); - const response = await stub.fetch('https://secrets.internal/secrets', { - headers: { 'x-up-manage': env.SECRETS_KEY }, - }); - return new Response(response.body, { status: response.status, headers: secure }); - } - const secretRoute = url.pathname.match(/^\/api\/sites\/([^/]+)\/secrets\/([^/]+)$/); - if (secretRoute && ['PUT', 'DELETE'].includes(request.method)) { - const siteName = cleanSiteName(secretRoute[1] || ''); - const name = cleanSecretName(secretRoute[2] || ''); - if (!siteName || !name) return json({ error: 'Invalid site or secret name' }, 400); - const { site } = await reg<{ site: SiteRecord }>(env, `/sites/${siteName}`); - if (!mayWrite(site.owner, identity)) return json({ error: 'Not found' }, 404); - if (!env.SITE_SECRETS || !env.SECRETS_KEY) - return json({ error: 'Secret storage is not configured' }, 503); - const stub = env.SITE_SECRETS.get(env.SITE_SECRETS.idFromName(siteName)); - if (request.method === 'DELETE') { - const response = await stub.fetch(`https://secrets.internal/secrets/${name}`, { - method: 'DELETE', - headers: { 'x-up-manage': env.SECRETS_KEY }, - }); - return new Response(response.body, { status: response.status, headers: secure }); - } - const body = await request - .json<{ value?: unknown; allowedHosts?: unknown }>() - .catch(() => null); - if (!body || typeof body.value !== 'string' || !body.value || body.value.length > 65_536) - return json({ error: 'Secret values must contain 1-65536 characters' }, 400); - let allowedHosts: string[]; - try { - allowedHosts = cleanAllowedHosts(body.allowedHosts); - } catch (error) { - return json({ error: error instanceof Error ? error.message : 'Invalid allowed hosts' }, 400); - } - const encrypted = await encryptSecret(body.value, env.SECRETS_KEY); - const response = await stub.fetch(`https://secrets.internal/secrets/${name}`, { - method: 'PUT', - headers: { 'content-type': 'application/json', 'x-up-manage': env.SECRETS_KEY }, - body: JSON.stringify({ ...encrypted, allowedHosts }), - }); - return new Response(response.body, { status: response.status, headers: secure }); - } - const asset = url.pathname.match(/^\/api\/deployments\/([^/]+)\/assets$/); - if (request.method === 'PUT' && asset) { - const path = cleanAssetPath(url.searchParams.get('path') || ''); - if (!path) return json({ error: 'Invalid asset path' }, 400); + + const upload = url.pathname.match(/^\/api\/deployments\/([^/]+)\/assets$/); + if (request.method === 'PUT' && upload) { const { deployment } = await reg<{ deployment: DeploymentRecord }>( env, - `/deployments/${asset[1]}`, + `/deployments/${upload[1]}`, ); if (!mayWrite(deployment.owner, identity)) return json({ error: 'Not found' }, 404); if (deployment.status !== 'pending') return json({ error: 'Deployment is not pending' }, 409); - const expected = deployment.manifest.find((x) => x.path === path); - if (!expected) return json({ error: 'Asset is not in the manifest' }, 400); + const path = cleanAssetPath(url.searchParams.get('path') || ''); + const expected = path ? deployment.manifest.find((entry) => entry.path === path) : undefined; + if (!path || !expected) return json({ error: 'Asset is not in the manifest' }, 400); const bytes = await request.arrayBuffer(); - if (bytes.byteLength !== expected.size || (await sha256(bytes)) !== expected.sha256) - return json({ error: 'Asset does not match its manifest' }, 400); - await env.ASSETS.put(key(deployment, path), bytes, { + if (bytes.byteLength !== expected.size) + return json({ error: 'Asset size does not match manifest' }, 400); + const digest = [...new Uint8Array(await crypto.subtle.digest('SHA-256', bytes))] + .map((byte) => byte.toString(16).padStart(2, '0')) + .join(''); + if (digest !== expected.sha256) + return json({ error: 'Asset digest does not match manifest' }, 400); + await env.ASSETS.put(assetKey(deployment, path), bytes, { httpMetadata: { contentType: expected.contentType }, customMetadata: { sha256: expected.sha256, owner: identity.email }, }); - return json({ ok: true, path }); + return json({ stored: true, path }); } + const activate = url.pathname.match(/^\/api\/deployments\/([^/]+)\/activate$/); if (request.method === 'POST' && activate) { const { deployment } = await reg<{ deployment: DeploymentRecord }>( @@ -393,9 +166,14 @@ async function api(request: Request, env: Env, identity: Identity): Promise env.ASSETS.head(key(deployment, x.path))), + deployment.manifest.map((entry) => env.ASSETS.head(assetKey(deployment, entry.path))), ); - if (heads.some((h, i) => !h || h.customMetadata?.sha256 !== deployment.manifest[i]?.sha256)) + if ( + heads.some( + (head, index) => + !head || head.customMetadata?.sha256 !== deployment.manifest[index]?.sha256, + ) + ) return json({ error: 'All manifest assets must be uploaded before activation' }, 409); const result = await reg<{ deployment: DeploymentRecord }>( env, @@ -407,50 +185,50 @@ async function api(request: Request, env: Env, identity: Identity): Promise { const url = new URL(request.url); const clean = cleanSiteName(name); - if (!clean) return new Response('Not found', { status: 404 }); + if (!clean) return new Response('Not found', { status: 404, headers: secure }); let site: SiteRecord; try { site = knownSite || (await reg<{ site: SiteRecord }>(env, `/sites/${clean}`)).site; } catch (error) { if (error instanceof RegistryError && error.status === 404) - return new Response('Not found', { status: 404 }); + return new Response('Not found', { status: 404, headers: secure }); throw error; } - if (!mayRead(site, identity)) return new Response('Not found', { status: 404 }); - if (url.pathname === '/__up/me') - return json({ email: identity?.email || null, visibility: site.access.visibility }); - if (!site.activeDeploymentId) return new Response('Not found', { status: 404 }); + if (!mayRead(site, identity)) return new Response('Not found', { status: 404, headers: secure }); + if (url.pathname === '/__up/me') return json({ email: identity.email, visibility: 'company' }); + if (url.pathname.startsWith('/_up/')) { + const capability = await handleCapabilityRequest(request, env, site, identity); + if (capability) return capability; + } + if (!site.activeDeploymentId) return new Response('Not found', { status: 404, headers: secure }); const { deployment } = await reg<{ deployment: DeploymentRecord }>( env, `/deployments/${site.activeDeploymentId}`, ); - const dynamic = await runDynamicSiteRequest(request, env, deployment, site); - if (dynamic) return dynamic; - const requested = cleanAssetPath(url.pathname === '/' ? 'index.html' : url.pathname); - if (!requested) return new Response('Not found', { status: 404 }); - let object = await env.ASSETS.get(key(deployment, requested)); - if (!object && !requested.includes('.')) - object = await env.ASSETS.get(key(deployment, `${requested}/index.html`)); + const path = cleanAssetPath(url.pathname === '/' ? 'index.html' : url.pathname); + if (!path) return new Response('Not found', { status: 404, headers: secure }); + let object = await env.ASSETS.get(assetKey(deployment, path)); + if (!object && !path.includes('.')) + object = await env.ASSETS.get(assetKey(deployment, `${path}/index.html`)); if (!object && request.headers.get('accept')?.includes('text/html')) - object = await env.ASSETS.get(key(deployment, 'index.html')); - if (!object) return new Response('Not found', { status: 404 }); + object = await env.ASSETS.get(assetKey(deployment, 'index.html')); + if (!object) return new Response('Not found', { status: 404, headers: secure }); const headers = new Headers(); object.writeHttpMetadata(headers); headers.set('etag', object.httpEtag); - // Site URLs are stable across atomic deployment swaps. Every asset must - // revalidate so a newly activated deployment cannot be masked by an old - // immutable browser entry. Protected content must never be marked public. headers.set('cache-control', 'private, no-cache'); headers.set('x-content-type-options', 'nosniff'); headers.set('referrer-policy', 'strict-origin-when-cross-origin'); @@ -458,15 +236,17 @@ async function serveSite( headers.set('content-security-policy', "frame-ancestors 'none'"); return new Response(object.body, { headers }); } + export function isCoreRequest(request: Request, env: Env): boolean { const url = new URL(request.url); const domain = env.SITE_DOMAIN?.toLowerCase(); const controlHost = env.CONTROL_HOST?.toLowerCase(); const host = url.hostname.toLowerCase(); - const siteHostname = Boolean( - domain && host !== domain && host !== controlHost && host.endsWith(`.${domain}`), + return ( + Boolean(domain && host !== domain && host !== controlHost && host.endsWith(`.${domain}`)) || + url.pathname.startsWith('/api/') || + url.pathname === '/app/__session' ); - return siteHostname || url.pathname.startsWith('/api/') || url.pathname === '/app/__session'; } export async function handleAuthenticatedRequest(request: Request, env: Env, identity: Identity) { @@ -475,149 +255,104 @@ export async function handleAuthenticatedRequest(request: Request, env: Env, ide const host = url.hostname.toLowerCase(); if (domain && host !== domain && host.endsWith(`.${domain}`)) return serveSite(request, env, identity, host.slice(0, -(domain.length + 1))); - if (url.pathname.startsWith('/api/')) return api(request, env, identity); + if (url.pathname.startsWith('/api/')) return controlApi(request, env, identity); return new Response('Not found', { status: 404, headers: secure }); } + const app = new Hono<{ Bindings: Env }>(); -// Site hostnames are untrusted content origins. Public is an explicit registry -// state; every other site still requires a verified company identity. -app.use('*', async (c, next) => { - const domain = c.env.SITE_DOMAIN?.toLowerCase(); - const host = new URL(c.req.url).hostname.toLowerCase(); - const controlHost = c.env.CONTROL_HOST?.toLowerCase(); + +app.use('*', async (context, next) => { + const domain = context.env.SITE_DOMAIN?.toLowerCase(); + const url = new URL(context.req.url); + const host = url.hostname.toLowerCase(); + const controlHost = context.env.CONTROL_HOST?.toLowerCase(); if (!domain || host === domain || host === controlHost || !host.endsWith(`.${domain}`)) return next(); const name = cleanSiteName(host.slice(0, -(domain.length + 1))); if (!name) return new Response('Not found', { status: 404, headers: secure }); let site: SiteRecord; try { - ({ site } = await reg<{ site: SiteRecord }>(c.env, `/sites/${name}`)); + site = (await reg<{ site: SiteRecord }>(context.env, `/sites/${name}`)).site; } catch (error) { if (error instanceof RegistryError && error.status === 404) return new Response('Not found', { status: 404, headers: secure }); throw error; } - if (site.access.visibility === 'public') - return serveSite(c.req.raw, c.env, undefined, name, site); - const error = configurationError(c.env); - if (error) return json({ error }, 503); + const configError = configurationError(context.env); + if (configError) return json({ error: configError }, 503); let identity: Identity | null = null; try { - identity = await verifyAccessIdentity(c.req.raw, c.env); + identity = await verifyAccessIdentity(context.req.raw, context.env); } catch { - if (c.env.SESSION_SECRET) - identity = await verifySession(cookieValue(c.req.raw, 'up_session'), c.env.SESSION_SECRET); + if (context.env.SESSION_SECRET) + identity = await verifySession( + cookieValue(context.req.raw, 'up_session'), + context.env.SESSION_SECRET, + ); } if (!identity) { - if (!c.env.SESSION_SECRET || !c.env.CONTROL_HOST) + if (!context.env.SESSION_SECRET || !context.env.CONTROL_HOST) return json({ error: 'Private site sessions are not configured' }, 503); - const broker = new URL('/app/__session', `https://${c.env.CONTROL_HOST}`); - broker.searchParams.set('return', c.req.url); + const broker = new URL('/app/__session', `https://${context.env.CONTROL_HOST}`); + broker.searchParams.set('return', context.req.url); return new Response(null, { status: 302, headers: { ...secure, location: broker.toString() } }); } - return serveSite(c.req.raw, c.env, identity, name, site); + return serveSite(context.req.raw, context.env, identity, name, site); }); -app.get('/app/__session', async (c) => { - const error = configurationError(c.env); - if (error) return json({ error }, 503); - if (!c.env.SESSION_SECRET || !c.env.SITE_DOMAIN) + +app.get('/app/__session', async (context) => { + const configError = configurationError(context.env); + if (configError) return json({ error: configError }, 503); + if (!context.env.SESSION_SECRET || !context.env.SITE_DOMAIN) return json({ error: 'Private site sessions are not configured' }, 503); let identity: Identity; try { - identity = await verifyAccessIdentity(c.req.raw, c.env); + identity = await verifyAccessIdentity(context.req.raw, context.env); } catch { return json({ error: 'Authentication required' }, 403); } - const target = validReturnUrl(c.req.query('return') || null, c.env.SITE_DOMAIN); + const target = validReturnUrl(context.req.query('return') || null, context.env.SITE_DOMAIN); if (!target) return json({ error: 'Invalid return URL' }, 400); - const value = await createSession(identity, c.env.SESSION_SECRET); + const value = await createSession(identity, context.env.SESSION_SECRET); return new Response(null, { status: 302, headers: { ...secure, location: target.toString(), - 'set-cookie': sessionCookie(value, c.env.SITE_DOMAIN), + 'set-cookie': sessionCookie(value, context.env.SITE_DOMAIN), }, }); }); -app.get('/api/health', (c) => - c.json({ edge: 'ok', accessConfigured: configurationError(c.env) === null }), + +app.get('/api/health', (context) => + context.json({ edge: 'ok', accessConfigured: configurationError(context.env) === null }), ); -app.all('/api/*', async (c) => { - const error = configurationError(c.env); - if (error) return json({ error }, 503); + +app.all('/api/*', async (context) => { + const configError = configurationError(context.env); + if (configError) return json({ error: configError }, 503); let identity: Identity; try { - identity = await verifyAccessIdentity(c.req.raw, c.env); + identity = await verifyAccessIdentity(context.req.raw, context.env); } catch { return json({ error: 'Authentication required' }, 403); } try { - return await handleAuthenticatedRequest(c.req.raw, c.env, identity); + return await handleAuthenticatedRequest(context.req.raw, context.env, identity); } catch (error) { if (error instanceof RegistryError) return json({ error: error.message }, error.status); return json({ error: 'Request failed' }, 500); } }); + app.notFound(() => new Response('Not found', { status: 404, headers: secure })); -export async function runDueSchedules(env: Env, now = new Date()): Promise { - const leased = await reg<{ schedules: ScheduleRecord[] }>(env, '/schedules/lease', { - method: 'POST', - headers: { 'content-type': 'application/json' }, - body: JSON.stringify({ now: now.toISOString(), limit: 50 }), - }); - let completed = 0; - for (const schedule of leased.schedules) { - let status = 503; - try { - const { site } = await reg<{ site: SiteRecord }>(env, `/sites/${schedule.siteName}`); - if (site.activeDeploymentId && schedule.status === 'enabled') { - const { deployment } = await reg<{ deployment: DeploymentRecord }>( - env, - `/deployments/${site.activeDeploymentId}`, - ); - const request = new Request( - `https://${schedule.siteName}.${env.SITE_DOMAIN || 'invalid'}${schedule.path}`, - { - method: 'POST', - headers: { - 'content-type': 'application/json', - 'x-up-schedule': schedule.id, - }, - body: JSON.stringify({ - scheduleId: schedule.id, - scheduledAt: now.toISOString(), - attempt: schedule.attempts, - }), - }, - ); - const response = await runDynamicSiteRequest(request, env, deployment, site); - status = response?.status || 503; - } - } catch { - status = 502; - } - await reg(env, `/schedules/${schedule.id}/result`, { - method: 'POST', - headers: { 'content-type': 'application/json' }, - body: JSON.stringify({ - now: now.toISOString(), - success: status >= 200 && status < 300, - status, - }), - }); - completed++; - } - return completed; +export async function runDueSchedules(_env?: Env, _now?: Date): Promise { + return 0; } -const worker = { - fetch(request: Request, env: Env, ctx: ExecutionContext) { - return app.fetch(request, env, ctx); - }, - scheduled(controller: ScheduledController, env: Env, ctx: ExecutionContext) { - ctx.waitUntil(runDueSchedules(env, new Date(controller.scheduledTime))); +export default { + fetch(request: Request, env: Env, context: ExecutionContext) { + return app.fetch(request, env, context); }, }; -export default worker; diff --git a/src/core.ts b/src/core.ts index 286cc08..81af85e 100644 --- a/src/core.ts +++ b/src/core.ts @@ -196,48 +196,12 @@ export async function sha256(bytes: ArrayBuffer): Promise { const digest = await crypto.subtle.digest('SHA-256', bytes); return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, '0')).join(''); } -export function normalizeSiteAccess(input: unknown): SiteAccess { - if (input === undefined || input === null) return { visibility: 'company', readers: [] }; - if (!input || typeof input !== 'object') throw new Error('Invalid site access'); - const value = input as Record; - if (!['company', 'restricted', 'public'].includes(String(value.visibility))) - throw new Error('Visibility must be company, restricted, or public'); - if (!Array.isArray(value.readers) || value.readers.length > 100) - throw new Error('Readers must contain at most 100 rules'); - const seen = new Set(); - const readers = value.readers.map((item): ReaderRule => { - if (!item || typeof item !== 'object') throw new Error('Invalid reader rule'); - const rule = item as Record; - const type = String(rule.type) as ReaderRule['type']; - const raw = typeof rule.value === 'string' ? rule.value.trim().toLowerCase() : ''; - if (!['email', 'domain', 'group'].includes(type) || !raw || raw.length > 254) - throw new Error('Invalid reader rule'); - if (type === 'email' && !/^[^@\s]+@[^@\s]+$/.test(raw)) throw new Error('Invalid reader email'); - const value = type === 'domain' ? raw.replace(/^@/, '') : raw; - const key = `${type}:${value}`; - if (seen.has(key)) throw new Error('Reader rules must be unique'); - seen.add(key); - return { type, value }; - }); - const visibility = value.visibility as SiteVisibility; - if (visibility === 'restricted' && readers.length === 0) - throw new Error('Restricted sites require at least one reader'); - return { visibility, readers: visibility === 'restricted' ? readers : [] }; -} -export function mayRead(site: SiteRecord, identity?: Identity): boolean { - if (site.access.visibility === 'public') return true; - if (!identity) return false; - if (identity.role === 'admin' || site.owner === identity.email) return true; - if (site.access.visibility === 'company') return true; - const email = identity.email.toLowerCase(); - const domain = email.split('@')[1] || ''; - const groups = new Set((identity.groups || []).map((group) => group.toLowerCase())); - return site.access.readers.some((rule) => { - if (rule.type === 'email') return rule.value === email; - if (rule.type === 'domain') return rule.value === domain; - return groups.has(rule.value); - }); +export function normalizeSiteAccess(_input: unknown): SiteAccess { + return { visibility: 'company', readers: [] }; +} +export function mayRead(_site: SiteRecord, identity?: Identity): boolean { + return Boolean(identity); } -export function mayWrite(owner: string, identity: Identity): boolean { - return identity.role === 'admin' || owner === identity.email; +export function mayWrite(_owner: string, identity: Identity): boolean { + return Boolean(identity.email); } diff --git a/src/index.ts b/src/index.ts index a7999a0..3029333 100644 --- a/src/index.ts +++ b/src/index.ts @@ -4,4 +4,4 @@ export * from './core-backend'; export { default } from './core-backend'; export { UpRegistry } from './registry'; export { SiteDatabase } from './site-database'; -export { SiteSecrets } from './site-secrets'; +export { SiteRealtime } from './site-realtime'; diff --git a/src/kit-worker.ts b/src/kit-worker.ts index fb97c68..b346b4a 100644 --- a/src/kit-worker.ts +++ b/src/kit-worker.ts @@ -4,7 +4,7 @@ import coreWorker, { type Env, isCoreRequest, runDueSchedules } from './core-bac export { UpRegistry } from './registry'; export { SiteDatabase } from './site-database'; -export { SiteSecrets } from './site-secrets'; +export { SiteRealtime } from './site-realtime'; export default { fetch(request: Request, env: Env, context: ExecutionContext) { diff --git a/src/registry.ts b/src/registry.ts index bd93fbd..a6b73cf 100644 --- a/src/registry.ts +++ b/src/registry.ts @@ -1,58 +1,25 @@ import { DurableObject } from 'cloudflare:workers'; -import { - type AssetManifestEntry, - type DeploymentRecord, - nextScheduleTime, - normalizeSiteAccess, - type ScheduleRecord, - type SiteAccess, - type SiteRecord, -} from './core'; +import type { AssetManifestEntry, DeploymentRecord, SiteRecord } from './core'; interface RegistryEnv extends Cloudflare.Env {} +type Row = Record; const json = (value: unknown, status = 200) => Response.json(value, { status }); -function site(row: Record): SiteRecord { - const active = - typeof row.active_deployment_id === 'string' ? row.active_deployment_id : undefined; - let access: SiteAccess = { visibility: 'company', readers: [] }; - try { - access = normalizeSiteAccess({ - visibility: String(row.visibility || 'company'), - readers: JSON.parse(String(row.readers_json || '[]')), - }); - } catch { - // Existing rows created before the access schema are company-private. - } + +function site(row: Row): SiteRecord { + const active = row.active_deployment_id ? String(row.active_deployment_id) : undefined; return { name: String(row.name), owner: String(row.owner), createdAt: String(row.created_at), updatedAt: String(row.updated_at), ...(active ? { activeDeploymentId: active } : {}), - access, - databaseEnabled: Number(row.database_enabled || 0) === 1, - runtimeEnabled: Number(row.runtime_enabled || 0) === 1, - }; -} -function schedule(row: Record): ScheduleRecord { - return { - id: String(row.id), - siteName: String(row.site_name), - path: String(row.path), - cron: String(row.cron), - status: String(row.status) as ScheduleRecord['status'], - maxRunsPerDay: Number(row.max_runs_per_day), - retryLimit: Number(row.retry_limit), - attempts: Number(row.attempts || 0), - nextRunAt: String(row.next_run_at), - ...(row.last_run_at ? { lastRunAt: String(row.last_run_at) } : {}), - ...(row.last_status ? { lastStatus: String(row.last_status) as 'success' | 'failed' } : {}), - createdAt: String(row.created_at), - updatedAt: String(row.updated_at), - createdBy: String(row.created_by), + access: { visibility: 'company', readers: [] }, + databaseEnabled: true, + runtimeEnabled: false, }; } -function deployment(row: Record): DeploymentRecord { + +function deployment(row: Row): DeploymentRecord { return { id: String(row.id), siteName: String(row.site_name), @@ -62,172 +29,59 @@ function deployment(row: Record): DeploymentRecord { manifest: JSON.parse(String(row.manifest_json)) as AssetManifestEntry[], }; } + export class UpRegistry extends DurableObject { constructor(state: DurableObjectState, env: RegistryEnv) { super(state, env); this.ctx.storage.sql.exec( - `CREATE TABLE IF NOT EXISTS sites(name TEXT PRIMARY KEY,owner TEXT NOT NULL,created_at TEXT NOT NULL,updated_at TEXT NOT NULL,active_deployment_id TEXT,visibility TEXT NOT NULL DEFAULT 'company',readers_json TEXT NOT NULL DEFAULT '[]',database_enabled INTEGER NOT NULL DEFAULT 0,runtime_enabled INTEGER NOT NULL DEFAULT 0);CREATE TABLE IF NOT EXISTS deployments(id TEXT PRIMARY KEY,site_name TEXT NOT NULL,owner TEXT NOT NULL,status TEXT NOT NULL CHECK(status IN ('pending','active','superseded')),created_at TEXT NOT NULL,manifest_json TEXT NOT NULL);CREATE INDEX IF NOT EXISTS deployments_site_created ON deployments(site_name,created_at DESC);CREATE TABLE IF NOT EXISTS schedules(id TEXT PRIMARY KEY,site_name TEXT NOT NULL,path TEXT NOT NULL,cron TEXT NOT NULL,status TEXT NOT NULL,max_runs_per_day INTEGER NOT NULL,retry_limit INTEGER NOT NULL,attempts INTEGER NOT NULL DEFAULT 0,next_run_at TEXT NOT NULL,lease_until TEXT,last_run_at TEXT,last_status TEXT,created_at TEXT NOT NULL,updated_at TEXT NOT NULL,created_by TEXT NOT NULL);CREATE INDEX IF NOT EXISTS schedules_site ON schedules(site_name,created_at DESC);CREATE TABLE IF NOT EXISTS schedule_usage(schedule_id TEXT NOT NULL,usage_date TEXT NOT NULL,run_count INTEGER NOT NULL DEFAULT 0,PRIMARY KEY(schedule_id,usage_date));CREATE TABLE IF NOT EXISTS audit_log(id TEXT PRIMARY KEY,site_name TEXT NOT NULL,actor TEXT NOT NULL,action TEXT NOT NULL,target_id TEXT,occurred_at TEXT NOT NULL,details_json TEXT NOT NULL DEFAULT '{}');CREATE INDEX IF NOT EXISTS audit_site_time ON audit_log(site_name,occurred_at DESC);`, - ); - const columns = new Set( - [...this.ctx.storage.sql.exec('PRAGMA table_info(sites)')].map((row) => String(row.name)), + `CREATE TABLE IF NOT EXISTS sites(name TEXT PRIMARY KEY,owner TEXT NOT NULL,created_at TEXT NOT NULL,updated_at TEXT NOT NULL,active_deployment_id TEXT,visibility TEXT NOT NULL DEFAULT 'company',readers_json TEXT NOT NULL DEFAULT '[]',database_enabled INTEGER NOT NULL DEFAULT 1,runtime_enabled INTEGER NOT NULL DEFAULT 0); + CREATE TABLE IF NOT EXISTS deployments(id TEXT PRIMARY KEY,site_name TEXT NOT NULL,owner TEXT NOT NULL,status TEXT NOT NULL CHECK(status IN ('pending','active','superseded')),created_at TEXT NOT NULL,manifest_json TEXT NOT NULL); + CREATE INDEX IF NOT EXISTS deployments_site_created ON deployments(site_name,created_at DESC);`, ); - if (!columns.has('visibility')) - this.ctx.storage.sql.exec( - "ALTER TABLE sites ADD COLUMN visibility TEXT NOT NULL DEFAULT 'company'", - ); - if (!columns.has('readers_json')) - this.ctx.storage.sql.exec( - "ALTER TABLE sites ADD COLUMN readers_json TEXT NOT NULL DEFAULT '[]'", - ); - if (!columns.has('database_enabled')) - this.ctx.storage.sql.exec( - 'ALTER TABLE sites ADD COLUMN database_enabled INTEGER NOT NULL DEFAULT 0', - ); - if (!columns.has('runtime_enabled')) - this.ctx.storage.sql.exec( - 'ALTER TABLE sites ADD COLUMN runtime_enabled INTEGER NOT NULL DEFAULT 0', - ); } + async fetch(request: Request): Promise { const url = new URL(request.url); - if (request.method === 'POST' && url.pathname === '/schedules/lease') { - const input = await request.json<{ now: string; limit?: number }>(); - const now = new Date(input.now); - if (Number.isNaN(now.valueOf())) return json({ error: 'Invalid lease time' }, 400); - const limit = Math.min(Math.max(Number(input.limit) || 25, 1), 100); - const date = now.toISOString().slice(0, 10); - const due = [ - ...this.ctx.storage.sql.exec( - "SELECT * FROM schedules WHERE status='enabled' AND next_run_at<=? AND (lease_until IS NULL OR lease_until<=?) ORDER BY next_run_at LIMIT ?", - now.toISOString(), - now.toISOString(), - limit, - ), - ]; - const leased: ScheduleRecord[] = []; - for (const row of due) { - const item = schedule(row); - const usage = [ - ...this.ctx.storage.sql.exec( - 'SELECT run_count FROM schedule_usage WHERE schedule_id=? AND usage_date=?', - item.id, - date, - ), - ][0]; - if (Number(usage?.run_count || 0) >= item.maxRunsPerDay) { - this.ctx.storage.sql.exec( - 'UPDATE schedules SET next_run_at=?,lease_until=NULL,attempts=0,updated_at=? WHERE id=?', - nextScheduleTime(item.cron, now).toISOString(), - now.toISOString(), - item.id, - ); - this.ctx.storage.sql.exec( - 'INSERT INTO audit_log(id,site_name,actor,action,target_id,occurred_at,details_json) VALUES (?,?,?,?,?,?,?)', - crypto.randomUUID(), - item.siteName, - 'scheduler', - 'schedule.quota_skipped', - item.id, - now.toISOString(), - JSON.stringify({ maxRunsPerDay: item.maxRunsPerDay }), - ); - continue; - } - this.ctx.storage.sql.exec( - 'INSERT INTO schedule_usage(schedule_id,usage_date,run_count) VALUES (?,?,1) ON CONFLICT(schedule_id,usage_date) DO UPDATE SET run_count=run_count+1', - item.id, - date, - ); - const attempts = item.attempts + 1; - const leaseUntil = new Date(now.getTime() + 5 * 60_000).toISOString(); - this.ctx.storage.sql.exec( - 'UPDATE schedules SET attempts=?,lease_until=?,updated_at=? WHERE id=?', - attempts, - leaseUntil, - now.toISOString(), - item.id, - ); - leased.push({ ...item, attempts, updatedAt: now.toISOString() }); - } - return json({ schedules: leased }); - } - const resultPath = url.pathname.match(/^\/schedules\/([^/]+)\/result$/); - if (request.method === 'POST' && resultPath) { - const input = await request.json<{ now: string; success: boolean; status?: number }>(); - const now = new Date(input.now); - const row = [ - ...this.ctx.storage.sql.exec('SELECT * FROM schedules WHERE id=?', resultPath[1]), - ][0]; - if (!row || Number.isNaN(now.valueOf())) return json({ error: 'Not found' }, 404); - const item = schedule(row); - let attempts = 0; - let nextRunAt: Date; - if (input.success || item.attempts > item.retryLimit) { - nextRunAt = nextScheduleTime(item.cron, now); - } else { - attempts = item.attempts; - const delay = Math.min(2 ** Math.max(attempts - 1, 0) * 60_000, 60 * 60_000); - nextRunAt = new Date(now.getTime() + delay); - } - this.ctx.storage.sql.exec( - 'UPDATE schedules SET attempts=?,next_run_at=?,lease_until=NULL,last_run_at=?,last_status=?,updated_at=? WHERE id=?', - attempts, - nextRunAt.toISOString(), - now.toISOString(), - input.success ? 'success' : 'failed', - now.toISOString(), - item.id, - ); - this.ctx.storage.sql.exec( - 'INSERT INTO audit_log(id,site_name,actor,action,target_id,occurred_at,details_json) VALUES (?,?,?,?,?,?,?)', - crypto.randomUUID(), - item.siteName, - 'scheduler', - input.success ? 'schedule.run_succeeded' : 'schedule.run_failed', - item.id, - now.toISOString(), - JSON.stringify({ attempt: item.attempts, status: input.status || null }), - ); - const updated = [ - ...this.ctx.storage.sql.exec('SELECT * FROM schedules WHERE id=?', item.id), - ][0]; - return json({ schedule: schedule(updated as Record) }); - } if (request.method === 'GET' && url.pathname === '/sites') return json({ sites: [...this.ctx.storage.sql.exec('SELECT * FROM sites ORDER BY updated_at DESC')].map( site, ), }); - const sp = url.pathname.match(/^\/sites\/([^/]+)$/); - if (request.method === 'GET' && sp) { - const row = [...this.ctx.storage.sql.exec('SELECT * FROM sites WHERE name = ?', sp[1])][0]; + + const sitePath = url.pathname.match(/^\/sites\/([^/]+)$/); + if (request.method === 'GET' && sitePath) { + const row = [ + ...this.ctx.storage.sql.exec('SELECT * FROM sites WHERE name=?', sitePath[1]), + ][0]; return row ? json({ site: site(row) }) : json({ error: 'Not found' }, 404); } + if (request.method === 'POST' && url.pathname === '/deployments') { const input = await request.json<{ id: string; siteName: string; owner: string; manifest: AssetManifestEntry[]; - access?: SiteAccess; }>(); const now = new Date().toISOString(); const current = [ - ...this.ctx.storage.sql.exec('SELECT * FROM sites WHERE name = ?', input.siteName), + ...this.ctx.storage.sql.exec('SELECT * FROM sites WHERE name=?', input.siteName), ][0]; - if (current && String(current.owner) !== input.owner) - return json({ error: 'Not found' }, 404); if (!current) { - const access = normalizeSiteAccess(input.access); this.ctx.storage.sql.exec( - 'INSERT INTO sites(name,owner,created_at,updated_at,visibility,readers_json) VALUES (?,?,?,?,?,?)', + `INSERT INTO sites(name,owner,created_at,updated_at,visibility,readers_json,database_enabled,runtime_enabled) + VALUES (?,?,?,?, 'company','[]',1,0)`, input.siteName, input.owner, now, now, - access.visibility, - JSON.stringify(access.readers), + ); + } else { + this.ctx.storage.sql.exec( + 'UPDATE sites SET updated_at=? WHERE name=?', + now, + input.siteName, ); } this.ctx.storage.sql.exec( @@ -253,189 +107,24 @@ export class UpRegistry extends DurableObject { 201, ); } - const accessPath = url.pathname.match(/^\/sites\/([^/]+)\/access$/); - if (request.method === 'PATCH' && accessPath) { - const input = await request.json<{ access?: unknown }>(); - let access: SiteAccess; - try { - access = normalizeSiteAccess(input.access); - } catch (error) { - return json({ error: error instanceof Error ? error.message : 'Invalid site access' }, 400); - } - const now = new Date().toISOString(); - const result = this.ctx.storage.sql.exec( - 'UPDATE sites SET visibility=?,readers_json=?,updated_at=? WHERE name=?', - access.visibility, - JSON.stringify(access.readers), - now, - accessPath[1], - ); - return result.rowsWritten - ? json({ - site: site( - [ - ...this.ctx.storage.sql.exec('SELECT * FROM sites WHERE name=?', accessPath[1]), - ][0] as Record, - ), - }) - : json({ error: 'Not found' }, 404); - } - const schedulesPath = url.pathname.match(/^\/sites\/([^/]+)\/schedules$/); - if (request.method === 'GET' && schedulesPath) - return json({ - schedules: [ - ...this.ctx.storage.sql.exec( - 'SELECT * FROM schedules WHERE site_name=? ORDER BY created_at DESC', - schedulesPath[1], - ), - ].map(schedule), - }); - if (request.method === 'POST' && schedulesPath) { - const input = await request.json(); - const exists = [ - ...this.ctx.storage.sql.exec('SELECT name FROM sites WHERE name=?', schedulesPath[1]), - ][0]; - if (!exists) return json({ error: 'Not found' }, 404); - this.ctx.storage.sql.exec( - 'INSERT INTO schedules(id,site_name,path,cron,status,max_runs_per_day,retry_limit,attempts,next_run_at,created_at,updated_at,created_by) VALUES (?,?,?,?,?,?,?,?,?,?,?,?)', - input.id, - schedulesPath[1], - input.path, - input.cron, - input.status, - input.maxRunsPerDay, - input.retryLimit, - input.attempts, - input.nextRunAt, - input.createdAt, - input.updatedAt, - input.createdBy, - ); - this.ctx.storage.sql.exec( - 'INSERT INTO audit_log(id,site_name,actor,action,target_id,occurred_at,details_json) VALUES (?,?,?,?,?,?,?)', - crypto.randomUUID(), - schedulesPath[1], - input.createdBy, - 'schedule.created', - input.id, - input.createdAt, - JSON.stringify({ path: input.path, cron: input.cron, status: input.status }), - ); - return json({ schedule: input }, 201); - } - const schedulePath = url.pathname.match(/^\/sites\/([^/]+)\/schedules\/([^/]+)$/); - if (request.method === 'PATCH' && schedulePath) { - const input = await request.json(); - const existing = [ - ...this.ctx.storage.sql.exec( - 'SELECT * FROM schedules WHERE site_name=? AND id=?', - schedulePath[1], - schedulePath[2], - ), - ][0]; - if (!existing) return json({ error: 'Not found' }, 404); - this.ctx.storage.sql.exec( - 'UPDATE schedules SET path=?,cron=?,status=?,max_runs_per_day=?,retry_limit=?,next_run_at=?,updated_at=? WHERE id=?', - input.path, - input.cron, - input.status, - input.maxRunsPerDay, - input.retryLimit, - input.nextRunAt, - input.updatedAt, - input.id, - ); - this.ctx.storage.sql.exec( - 'INSERT INTO audit_log(id,site_name,actor,action,target_id,occurred_at,details_json) VALUES (?,?,?,?,?,?,?)', - crypto.randomUUID(), - schedulePath[1], - input.actor, - 'schedule.updated', - input.id, - input.updatedAt, - JSON.stringify({ path: input.path, cron: input.cron, status: input.status }), - ); - const row = [...this.ctx.storage.sql.exec('SELECT * FROM schedules WHERE id=?', input.id)][0]; - return json({ schedule: schedule(row as Record) }); - } - if (request.method === 'DELETE' && schedulePath) { - const input = await request.json<{ actor: string }>(); - const existing = [ - ...this.ctx.storage.sql.exec( - 'SELECT * FROM schedules WHERE site_name=? AND id=?', - schedulePath[1], - schedulePath[2], - ), - ][0]; - if (!existing) return json({ error: 'Not found' }, 404); - this.ctx.storage.sql.exec('DELETE FROM schedules WHERE id=?', schedulePath[2]); - const now = new Date().toISOString(); - this.ctx.storage.sql.exec( - 'INSERT INTO audit_log(id,site_name,actor,action,target_id,occurred_at,details_json) VALUES (?,?,?,?,?,?,?)', - crypto.randomUUID(), - schedulePath[1], - input.actor, - 'schedule.deleted', - schedulePath[2], - now, - '{}', - ); - return json({ ok: true }); - } - const auditPath = url.pathname.match(/^\/sites\/([^/]+)\/audit$/); - if (request.method === 'GET' && auditPath) - return json({ - audit: [ - ...this.ctx.storage.sql.exec( - 'SELECT * FROM audit_log WHERE site_name=? ORDER BY occurred_at DESC LIMIT 200', - auditPath[1], - ), - ].map((row) => ({ - id: String(row.id), - actor: String(row.actor), - action: String(row.action), - targetId: row.target_id ? String(row.target_id) : undefined, - occurredAt: String(row.occurred_at), - details: JSON.parse(String(row.details_json)), - })), - }); - const databasePath = url.pathname.match(/^\/sites\/([^/]+)\/database$/); - if (request.method === 'PATCH' && databasePath) { - const input = await request.json<{ enabled?: unknown }>(); - if (typeof input.enabled !== 'boolean') return json({ error: 'Invalid database state' }, 400); - const now = new Date().toISOString(); - const result = this.ctx.storage.sql.exec( - 'UPDATE sites SET database_enabled=?,updated_at=? WHERE name=?', - input.enabled ? 1 : 0, - now, - databasePath[1], - ); - return result.rowsWritten - ? json({ - site: site( - [ - ...this.ctx.storage.sql.exec('SELECT * FROM sites WHERE name=?', databasePath[1]), - ][0] as Record, - ), - }) - : json({ error: 'Not found' }, 404); - } - const dp = url.pathname.match(/^\/deployments\/([^/]+)$/); - if (request.method === 'GET' && dp) { + + const deploymentPath = url.pathname.match(/^\/deployments\/([^/]+)$/); + if (request.method === 'GET' && deploymentPath) { const row = [ - ...this.ctx.storage.sql.exec('SELECT * FROM deployments WHERE id = ?', dp[1]), + ...this.ctx.storage.sql.exec('SELECT * FROM deployments WHERE id=?', deploymentPath[1]), ][0]; return row ? json({ deployment: deployment(row) }) : json({ error: 'Not found' }, 404); } - const ap = url.pathname.match(/^\/deployments\/([^/]+)\/activate$/); - if (request.method === 'POST' && ap) { + + const activate = url.pathname.match(/^\/deployments\/([^/]+)\/activate$/); + if (request.method === 'POST' && activate) { const row = [ - ...this.ctx.storage.sql.exec('SELECT * FROM deployments WHERE id = ?', ap[1]), + ...this.ctx.storage.sql.exec('SELECT * FROM deployments WHERE id=?', activate[1]), ][0]; if (!row) return json({ error: 'Not found' }, 404); const item = deployment(row); if (item.status === 'active') return json({ deployment: item }); - if (item.status !== 'pending') return json({ error: 'Deployment is not pending' }, 409); + if (item.status !== 'pending') return json({ error: 'Deployment cannot be activated' }, 409); const now = new Date().toISOString(); this.ctx.storage.sql.exec( "UPDATE deployments SET status='superseded' WHERE site_name=? AND status='active'", @@ -443,14 +132,14 @@ export class UpRegistry extends DurableObject { ); this.ctx.storage.sql.exec("UPDATE deployments SET status='active' WHERE id=?", item.id); this.ctx.storage.sql.exec( - 'UPDATE sites SET active_deployment_id=?,runtime_enabled=?,updated_at=? WHERE name=?', + "UPDATE sites SET active_deployment_id=?,updated_at=?,visibility='company',readers_json='[]',database_enabled=1,runtime_enabled=0 WHERE name=?", item.id, - item.manifest.some((asset) => asset.path === '_worker.js') ? 1 : 0, now, item.siteName, ); return json({ deployment: { ...item, status: 'active' } }); } + return json({ error: 'Not found' }, 404); } } diff --git a/src/secrets.ts b/src/secrets.ts deleted file mode 100644 index 02c14ca..0000000 --- a/src/secrets.ts +++ /dev/null @@ -1,59 +0,0 @@ -const encoder = new TextEncoder(); -const decoder = new TextDecoder(); -const base64Url = (bytes: Uint8Array) => - btoa(String.fromCharCode(...bytes)) - .replaceAll('+', '-') - .replaceAll('/', '_') - .replaceAll('=', ''); -function decodeBase64Url(value: string): Uint8Array { - const normalized = value.replaceAll('-', '+').replaceAll('_', '/'); - const raw = atob(normalized.padEnd(Math.ceil(normalized.length / 4) * 4, '=')); - const bytes = new Uint8Array(new ArrayBuffer(raw.length)); - for (let index = 0; index < raw.length; index++) bytes[index] = raw.charCodeAt(index); - return bytes; -} -async function key(value: string): Promise { - const bytes = decodeBase64Url(value); - if (bytes.byteLength !== 32) throw new Error('SECRETS_KEY must be 32 bytes of base64url'); - return crypto.subtle.importKey('raw', bytes, 'AES-GCM', false, ['encrypt', 'decrypt']); -} -export interface EncryptedSecret { - ciphertext: string; - iv: string; -} -export async function encryptSecret(value: string, secretKey: string): Promise { - const iv = crypto.getRandomValues(new Uint8Array(12)); - const ciphertext = await crypto.subtle.encrypt( - { name: 'AES-GCM', iv }, - await key(secretKey), - encoder.encode(value), - ); - return { ciphertext: base64Url(new Uint8Array(ciphertext)), iv: base64Url(iv) }; -} -export async function decryptSecret( - encrypted: EncryptedSecret, - secretKey: string, -): Promise { - const plaintext = await crypto.subtle.decrypt( - { name: 'AES-GCM', iv: decodeBase64Url(encrypted.iv) }, - await key(secretKey), - decodeBase64Url(encrypted.ciphertext), - ); - return decoder.decode(plaintext); -} -export function cleanSecretName(value: string): string | null { - const name = value.trim().toUpperCase(); - return /^[A-Z][A-Z0-9_]{0,63}$/.test(name) ? name : null; -} -export function cleanAllowedHosts(input: unknown): string[] { - if (!Array.isArray(input) || input.length === 0 || input.length > 20) - throw new Error('Secrets require 1-20 allowed hosts'); - const hosts = input.map((value) => { - if (typeof value !== 'string') throw new Error('Invalid allowed host'); - const host = value.trim().toLowerCase(); - if (!/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/.test(host)) - throw new Error('Invalid allowed host'); - return host; - }); - return [...new Set(hosts)]; -} diff --git a/src/site-database.ts b/src/site-database.ts index cc4d2d1..3ad503c 100644 --- a/src/site-database.ts +++ b/src/site-database.ts @@ -4,6 +4,10 @@ interface DatabaseEnv extends Cloudflare.Env {} const json = (value: unknown, status = 200) => Response.json(value, { status }); const forbidden = /\b(ATTACH|DETACH|PRAGMA|VACUUM)\b/i; +const collectionPattern = /^[a-z][a-z0-9_-]{0,47}$/; +const idPattern = /^[a-zA-Z0-9_-]{1,64}$/; +const MAX_DOCUMENT_BYTES = 64 * 1024; + export class SiteDatabase extends DurableObject { async fetch(request: Request): Promise { const url = new URL(request.url); @@ -12,6 +16,8 @@ export class SiteDatabase extends DurableObject { await this.ctx.storage.deleteAll(); return json({ ok: true }); } + const collection = url.pathname.match(/^\/collections\/([^/]+)(?:\/([^/]+))?$/); + if (collection) return this.collectionRequest(request, url, collection[1] || '', collection[2]); if (request.method !== 'POST' || url.pathname !== '/query') return json({ error: 'Not found' }, 404); const input = await request.json<{ sql?: unknown; params?: unknown }>().catch(() => null); @@ -44,4 +50,68 @@ export class SiteDatabase extends DurableObject { return json({ error: 'Database query failed' }, 400); } } + + private async collectionRequest( + request: Request, + url: URL, + collection: string, + rawId?: string, + ): Promise { + if (!collectionPattern.test(collection)) return json({ error: 'Invalid collection' }, 400); + const id = rawId ? decodeURIComponent(rawId) : undefined; + if (id && !idPattern.test(id)) return json({ error: 'Invalid document id' }, 400); + this.ctx.storage.sql.exec( + 'CREATE TABLE IF NOT EXISTS up_documents(collection TEXT NOT NULL,id TEXT NOT NULL,data TEXT NOT NULL,created_at TEXT NOT NULL,updated_at TEXT NOT NULL,PRIMARY KEY(collection,id));CREATE INDEX IF NOT EXISTS up_documents_collection_updated ON up_documents(collection,updated_at DESC);', + ); + if (request.method === 'GET' && id) { + const row = [ + ...this.ctx.storage.sql.exec<{ data: string }>( + 'SELECT data FROM up_documents WHERE collection=? AND id=?', + collection, + id, + ), + ][0]; + return row + ? json({ id, ...JSON.parse(row.data) }) + : json({ error: 'Document not found' }, 404); + } + if (request.method === 'GET') { + const limit = Math.min(100, Math.max(1, Number(url.searchParams.get('limit') || 100))); + const offset = Math.min(10_000, Math.max(0, Number(url.searchParams.get('offset') || 0))); + const rows = [ + ...this.ctx.storage.sql.exec<{ id: string; data: string }>( + 'SELECT id,data FROM up_documents WHERE collection=? ORDER BY updated_at DESC LIMIT ? OFFSET ?', + collection, + limit, + offset, + ), + ].map((row) => ({ id: row.id, ...JSON.parse(row.data) })); + return json({ documents: rows, limit, offset }); + } + if (request.method === 'DELETE' && id) { + this.ctx.storage.sql.exec( + 'DELETE FROM up_documents WHERE collection=? AND id=?', + collection, + id, + ); + return json({ deleted: true, id }); + } + if (!['POST', 'PUT'].includes(request.method) || (request.method === 'PUT' && !id)) + return json({ error: 'Method not allowed' }, 405); + const data = await request.json>().catch(() => null); + if (!data || Array.isArray(data)) return json({ error: 'Document must be an object' }, 400); + const encoded = JSON.stringify(data); + if (encoded.length > MAX_DOCUMENT_BYTES) return json({ error: 'Document exceeds 64 KiB' }, 413); + const documentId = id || crypto.randomUUID(); + const now = new Date().toISOString(); + this.ctx.storage.sql.exec( + 'INSERT INTO up_documents(collection,id,data,created_at,updated_at) VALUES (?,?,?,?,?) ON CONFLICT(collection,id) DO UPDATE SET data=excluded.data,updated_at=excluded.updated_at', + collection, + documentId, + encoded, + now, + now, + ); + return json({ id: documentId, ...data }, request.method === 'POST' ? 201 : 200); + } } diff --git a/src/site-realtime.ts b/src/site-realtime.ts new file mode 100644 index 0000000..a99be86 --- /dev/null +++ b/src/site-realtime.ts @@ -0,0 +1,70 @@ +import { DurableObject } from 'cloudflare:workers'; + +interface RealtimeEnv extends Cloudflare.Env {} + +export class SiteRealtime extends DurableObject { + async fetch(request: Request): Promise { + if (new URL(request.url).pathname !== '/connect') + return new Response('Not found', { status: 404 }); + if (request.headers.get('upgrade')?.toLowerCase() !== 'websocket') + return Response.json({ error: 'WebSocket upgrade required' }, { status: 426 }); + const email = request.headers.get('x-up-email'); + const site = request.headers.get('x-up-site'); + const channel = request.headers.get('x-up-channel'); + if (!email || !site || !channel) + return Response.json({ error: 'Identity required' }, { status: 403 }); + + const pair = new WebSocketPair(); + const client = pair[0]; + const server = pair[1]; + this.ctx.acceptWebSocket(server, [email]); + server.serializeAttachment({ email, site, channel }); + this.broadcast({ type: 'presence', event: 'join', email }, server); + return new Response(null, { status: 101, webSocket: client }); + } + + async webSocketMessage(socket: WebSocket, raw: string | ArrayBuffer): Promise { + const attachment = socket.deserializeAttachment() as + | { email: string; site: string; channel: string } + | undefined; + if (!attachment) return socket.close(1008, 'Missing identity'); + const text = typeof raw === 'string' ? raw : new TextDecoder().decode(raw); + if (text.length > 16_384) return socket.close(1009, 'Message too large'); + let input: unknown; + try { + input = JSON.parse(text); + } catch { + return socket.send(JSON.stringify({ type: 'error', error: 'Invalid JSON' })); + } + if (!input || typeof input !== 'object') return; + const value = input as Record; + if (typeof value.type !== 'string' || !/^[a-z][a-z0-9_-]{0,47}$/.test(value.type)) + return socket.send(JSON.stringify({ type: 'error', error: 'Invalid event type' })); + const encoded = JSON.stringify({ + type: value.type, + data: value.data ?? null, + sender: attachment.email, + }); + if (encoded.length > 16_384) return socket.close(1009, 'Message too large'); + this.broadcast(JSON.parse(encoded)); + } + + async webSocketClose(socket: WebSocket): Promise { + const attachment = socket.deserializeAttachment() as { email?: string } | undefined; + if (attachment?.email) + this.broadcast({ type: 'presence', event: 'leave', email: attachment.email }, socket); + } + + private broadcast(value: unknown, except?: WebSocket): void { + const encoded = JSON.stringify(value); + for (const socket of this.ctx.getWebSockets()) { + if (socket !== except) { + try { + socket.send(encoded); + } catch { + // The runtime will deliver webSocketClose and remove dead sockets. + } + } + } + } +} diff --git a/src/site-secrets.ts b/src/site-secrets.ts deleted file mode 100644 index 44954c5..0000000 --- a/src/site-secrets.ts +++ /dev/null @@ -1,128 +0,0 @@ -import { DurableObject } from 'cloudflare:workers'; -import { cleanSecretName, decryptSecret, type EncryptedSecret } from './secrets'; - -interface SecretsEnv extends Cloudflare.Env { - SECRETS_KEY?: string; -} -interface StoredSecret extends EncryptedSecret { - allowedHosts: string[]; - updatedAt: string; -} -const json = (value: unknown, status = 200) => Response.json(value, { status }); - -export class SiteSecrets extends DurableObject { - #managed(request: Request): boolean { - return Boolean( - this.env.SECRETS_KEY && request.headers.get('x-up-manage') === this.env.SECRETS_KEY, - ); - } - async fetch(request: Request): Promise { - const url = new URL(request.url); - if (!this.env.SECRETS_KEY) return json({ error: 'Secret storage is not configured' }, 503); - if (request.method === 'GET' && url.pathname === '/secrets') { - if (!this.#managed(request)) return json({ error: 'Not found' }, 404); - const values = await this.ctx.storage.list({ prefix: 'secret:' }); - return json({ - secrets: [...values].map(([key, value]) => ({ - name: key.slice('secret:'.length), - allowedHosts: value.allowedHosts, - updatedAt: value.updatedAt, - })), - }); - } - const secretPath = url.pathname.match(/^\/secrets\/([^/]+)$/); - if (secretPath) { - if (!this.#managed(request)) return json({ error: 'Not found' }, 404); - const name = cleanSecretName(secretPath[1] || ''); - if (!name) return json({ error: 'Invalid secret name' }, 400); - if (request.method === 'DELETE') { - await this.ctx.storage.delete(`secret:${name}`); - return json({ ok: true }); - } - if (request.method === 'PUT') { - const input = await request.json().catch(() => null); - if ( - !input || - typeof input.ciphertext !== 'string' || - typeof input.iv !== 'string' || - !Array.isArray(input.allowedHosts) - ) - return json({ error: 'Invalid encrypted secret' }, 400); - await this.ctx.storage.put(`secret:${name}`, { - ciphertext: input.ciphertext, - iv: input.iv, - allowedHosts: input.allowedHosts, - updatedAt: new Date().toISOString(), - } satisfies StoredSecret); - return json({ ok: true, name }, 201); - } - } - const usePath = url.pathname.match(/^\/use\/([^/]+)$/); - if (request.method === 'POST' && usePath) { - const name = cleanSecretName(usePath[1] || ''); - if (!name) return json({ error: 'Not found' }, 404); - const stored = await this.ctx.storage.get(`secret:${name}`); - if (!stored) return json({ error: 'Not found' }, 404); - const input = await request - .json<{ - url?: unknown; - method?: unknown; - headers?: unknown; - body?: unknown; - }>() - .catch(() => null); - if (!input || typeof input.url !== 'string') return json({ error: 'Invalid request' }, 400); - let target: URL; - try { - target = new URL(input.url); - } catch { - return json({ error: 'Invalid request URL' }, 400); - } - if ( - target.protocol !== 'https:' || - !stored.allowedHosts.includes(target.hostname.toLowerCase()) - ) - return json({ error: 'Host is not allowed' }, 403); - const method = typeof input.method === 'string' ? input.method.toUpperCase() : 'GET'; - if (!['GET', 'POST', 'PUT', 'PATCH', 'DELETE'].includes(method)) - return json({ error: 'Method is not allowed' }, 400); - const headers = new Headers(); - if (input.headers && typeof input.headers === 'object') { - for (const [key, value] of Object.entries(input.headers as Record)) { - const lower = key.toLowerCase(); - if ( - typeof value === 'string' && - value.length <= 1000 && - !['authorization', 'cookie', 'host', 'cf-access-token'].includes(lower) - ) - headers.set(key, value); - } - } - const secret = await decryptSecret(stored, this.env.SECRETS_KEY); - headers.set('authorization', `Bearer ${secret}`); - const body = - typeof input.body === 'string' && input.body.length <= 1024 * 1024 ? input.body : undefined; - try { - const response = await fetch(target, { - method, - headers, - ...(body !== undefined ? { body } : {}), - redirect: 'manual', - }); - const type = response.headers.get('content-type') || 'text/plain'; - if (!/^(text\/|application\/(?:json|[^;]+\+json))/.test(type)) - return json({ error: 'Secret-backed requests require a text response' }, 502); - const text = await response.text(); - if (text.length > 1024 * 1024) - return json({ error: 'Secret-backed response is too large' }, 502); - return new Response(text.replaceAll(secret, '[REDACTED]'), { - status: response.status, - headers: { 'content-type': type, 'cache-control': 'private, no-store' }, - }); - } catch { - return json({ error: 'Secret-backed request failed' }, 502); - } - } - return json({ error: 'Not found' }, 404); - } -} diff --git a/src/site.svelte b/src/site.svelte index 7fd6860..1b0e93d 100644 --- a/src/site.svelte +++ b/src/site.svelte @@ -3,28 +3,11 @@ import UpLogo from './lib/UpLogo.svelte'; import UpMark from './lib/UpMark.svelte'; - type Visibility = 'company' | 'restricted' | 'public'; - type ReaderRule = { type: 'email' | 'domain' | 'group'; value: string }; type Site = { name: string; owner: string; updatedAt?: string; activeDeploymentId?: string; - access?: { visibility: Visibility; readers: ReaderRule[] }; - databaseEnabled?: boolean; - runtimeEnabled?: boolean; - }; - - type SecretSummary = { name: string; allowedHosts: string[]; updatedAt: string }; - type ScheduleSummary = { - id: string; - path: string; - cron: string; - status: 'enabled' | 'paused' | 'disabled'; - maxRunsPerDay: number; - retryLimit: number; - nextRunAt: string; - lastStatus?: 'success' | 'failed'; }; type PreparedFile = { @@ -71,24 +54,9 @@ let siteDomain = $state(untrack(() => initialSiteDomain)); let dragging = $state(false); let copied = $state(false); - let visibility = $state('company'); - let readersText = $state(''); - let publicConfirmed = $state(false); - let databaseRequested = $state(false); - let view = $state<'empty' | 'selected' | 'publishing' | 'success' | 'list' | 'manage'>( + let view = $state<'empty' | 'selected' | 'publishing' | 'success' | 'list'>( untrack(() => initialSites.length) ? 'list' : 'empty', ); - let managedSite = $state(null); - let managedSecrets = $state([]); - let managedSchedules = $state([]); - let managedVisibility = $state('company'); - let managedReaders = $state(''); - let secretName = $state(''); - let secretValue = $state(''); - let secretHosts = $state(''); - let schedulePath = $state('/api/jobs/run'); - let scheduleCron = $state('0 * * * *'); - let manageStatus = $state(''); let input = $state(); let siteNameInput = $state(); @@ -131,149 +99,6 @@ } } - async function openManagement(site: Site) { - managedSite = site; - managedVisibility = site.access?.visibility || 'company'; - managedReaders = (site.access?.readers || []) - .map((rule) => (rule.type === 'group' ? `group:${rule.value}` : rule.type === 'domain' ? `@${rule.value}` : rule.value)) - .join(', '); - manageStatus = ''; - view = 'manage'; - await loadManagement(); - } - - async function loadManagement() { - if (!managedSite) return; - const name = encodeURIComponent(managedSite.name); - const [secretsResponse, schedulesResponse, sitesResponse] = await Promise.all([ - fetch(`/api/sites/${name}/secrets`), - fetch(`/api/sites/${name}/schedules`), - fetch('/api/sites'), - ]); - if (secretsResponse.ok) - managedSecrets = (await responseJson<{ secrets: SecretSummary[] }>(secretsResponse)).secrets; - if (schedulesResponse.ok) - managedSchedules = (await responseJson<{ schedules: ScheduleSummary[] }>(schedulesResponse)).schedules; - if (sitesResponse.ok) { - const data = await responseJson(sitesResponse); - sites = data.sites; - managedSite = sites.find((site) => site.name === managedSite?.name) || managedSite; - } - } - - async function saveManagedAccess() { - if (!managedSite) return; - const readers = parseReaders(managedReaders); - if (managedVisibility === 'restricted' && !readers.length) { - manageStatus = 'Restricted sites require at least one reader.'; - return; - } - const response = await fetch(`/api/sites/${encodeURIComponent(managedSite.name)}/access`, { - method: 'PATCH', - headers: { 'content-type': 'application/json' }, - body: JSON.stringify({ - access: { - visibility: managedVisibility, - readers: managedVisibility === 'restricted' ? readers : [], - }, - }), - }); - const data = await responseJson(response); - manageStatus = response.ok ? 'Visibility saved.' : data.error || 'Unable to save visibility.'; - if (response.ok) await loadManagement(); - } - - async function toggleManagedDatabase() { - if (!managedSite) return; - const enabled = !managedSite.databaseEnabled; - const response = await fetch(`/api/sites/${encodeURIComponent(managedSite.name)}/database`, { - method: 'PATCH', - headers: { 'content-type': 'application/json' }, - body: JSON.stringify({ enabled }), - }); - const data = await responseJson(response); - manageStatus = response.ok - ? enabled - ? 'Database enabled.' - : 'Database deleted.' - : data.error || 'Unable to update database.'; - if (response.ok) await loadManagement(); - } - - async function saveSecret() { - if (!managedSite || !secretName || !secretValue || !secretHosts) return; - const response = await fetch( - `/api/sites/${encodeURIComponent(managedSite.name)}/secrets/${encodeURIComponent(secretName)}`, - { - method: 'PUT', - headers: { 'content-type': 'application/json' }, - body: JSON.stringify({ - value: secretValue, - allowedHosts: secretHosts.split(/[\n,]/).map((host) => host.trim()).filter(Boolean), - }), - }, - ); - const data = await responseJson(response); - manageStatus = response.ok ? 'Secret capability saved.' : data.error || 'Unable to save secret.'; - if (response.ok) { - secretName = ''; - secretValue = ''; - secretHosts = ''; - await loadManagement(); - } - } - - async function deleteSecret(name: string) { - if (!managedSite) return; - const response = await fetch( - `/api/sites/${encodeURIComponent(managedSite.name)}/secrets/${encodeURIComponent(name)}`, - { method: 'DELETE' }, - ); - manageStatus = response.ok ? 'Secret capability deleted.' : 'Unable to delete secret.'; - if (response.ok) await loadManagement(); - } - - async function addSchedule() { - if (!managedSite) return; - const response = await fetch(`/api/sites/${encodeURIComponent(managedSite.name)}/schedules`, { - method: 'POST', - headers: { 'content-type': 'application/json' }, - body: JSON.stringify({ - path: schedulePath, - cron: scheduleCron, - maxRunsPerDay: 24, - retryLimit: 3, - }), - }); - const data = await responseJson(response); - manageStatus = response.ok ? 'Schedule created.' : data.error || 'Unable to create schedule.'; - if (response.ok) await loadManagement(); - } - - async function updateSchedule(item: ScheduleSummary, status: ScheduleSummary['status']) { - if (!managedSite) return; - const response = await fetch( - `/api/sites/${encodeURIComponent(managedSite.name)}/schedules/${item.id}`, - { - method: 'PATCH', - headers: { 'content-type': 'application/json' }, - body: JSON.stringify({ status }), - }, - ); - manageStatus = response.ok ? `Schedule ${status}.` : 'Unable to update schedule.'; - if (response.ok) await loadManagement(); - } - - async function deleteSchedule(id: string) { - if (!managedSite) return; - const response = await fetch( - `/api/sites/${encodeURIComponent(managedSite.name)}/schedules/${id}`, - { method: 'DELETE' }, - ); - manageStatus = response.ok ? 'Schedule deleted.' : 'Unable to delete schedule.'; - if (response.ok) await loadManagement(); - } - function chooseFolder() { input?.click(); } @@ -340,43 +165,12 @@ publishing = false; publishedUrl = ''; copied = false; - visibility = 'company'; - readersText = ''; - publicConfirmed = false; - databaseRequested = false; if (input) input.value = ''; view = isProduct && sites.length ? 'list' : 'empty'; } const totalBytes = $derived(files.reduce((sum, file) => sum + file.size, 0)); const hasIndex = $derived(prepared.some((asset) => asset.path === 'index.html')); - const hasWorker = $derived(prepared.some((asset) => asset.path === '_worker.js')); - const readers = $derived(parseReaders(readersText)); - const accessReady = $derived( - visibility === 'company' || - (visibility === 'restricted' && readers.length > 0) || - (visibility === 'public' && publicConfirmed), - ); - - function parseReaders(value: string): ReaderRule[] { - const seen = new Set(); - const rules: ReaderRule[] = []; - for (const raw of value.split(/[\n,]/)) { - const token = raw.trim().toLowerCase(); - if (!token) continue; - const rule: ReaderRule = token.startsWith('group:') - ? { type: 'group', value: token.slice(6).trim() } - : token.includes('@') && !token.startsWith('@') - ? { type: 'email', value: token } - : { type: 'domain', value: token.replace(/^@/, '') }; - const key = `${rule.type}:${rule.value}`; - if (rule.value && !seen.has(key)) { - seen.add(key); - rules.push(rule); - } - } - return rules; - } function formatBytes(bytes: number): string { if (bytes < 1024) return `${bytes} B`; @@ -385,8 +179,7 @@ } async function publish() { - if (!isProduct || !siteName || !prepared.length || !hasIndex || !accessReady || publishing) - return; + if (!isProduct || !siteName || !prepared.length || !hasIndex || publishing) return; publishing = true; view = 'publishing'; progress = 5; @@ -403,7 +196,7 @@ headers: { 'content-type': 'application/json' }, body: JSON.stringify({ manifest, - access: { visibility, readers: visibility === 'restricted' ? readers : [] }, + access: { visibility: 'company', readers: [] }, }), }); const creation = await responseJson(created); @@ -434,15 +227,6 @@ const result = await responseJson(activated); if (!activated.ok) throw new Error(result.error || 'Activation failed'); publishedUrl = result.siteUrl || ''; - if (databaseRequested && hasWorker) { - const database = await fetch(`/api/sites/${encodeURIComponent(siteName)}/database`, { - method: 'PATCH', - headers: { 'content-type': 'application/json' }, - body: JSON.stringify({ enabled: true }), - }); - if (!database.ok) - throw new Error((await responseJson(database)).error || 'Database setup failed'); - } progress = 100; status = 'Published'; view = 'success'; @@ -522,12 +306,12 @@
    -
    01

    Choose a folder

    HTML, CSS, JavaScript, and assets. No framework or build system required.

    -
    02

    Choose visibility

    Company by default; restrict to readers and groups, or explicitly publish to everyone.

    -
    03

    Run backend code

    A root _worker.js handles /api/* in a network-isolated Dynamic Worker.

    -
    04

    Bind secrets

    Encrypted write-only capabilities inject credentials only for allowlisted HTTPS hosts.

    -
    05

    Store data

    Enable an isolated SQLite Durable Object that no other site can address.

    -
    06

    Schedule jobs

    Bounded UTC jobs include quotas, retries, pause/disable behavior, and audit receipts.

    +
    01

    Publish a folder

    HTML, CSS, JavaScript, and assets. No framework or build system required.

    +
    02

    Know the viewer

    up.identity returns the employee identity already verified by Access.

    +
    03

    Store records

    up.db provides site-scoped document collections backed by SQLite.

    +
    04

    Share files

    up.files stores bounded site files in private R2 without credentials.

    +
    05

    Call AI

    up.ai uses the installation’s fixed Workers AI policy.

    +
    06

    Update live

    up.realtime connects authenticated browsers through site-scoped rooms.

    07

    Publish atomically

    Every digest is verified before a deployment becomes visible. Partial updates never leak.

    08

    Stay in control

    The Worker, Durable Objects, R2, DNS, and Access app remain in your account.

    @@ -599,53 +383,11 @@ {#each sites as site}
    -
    {site.owner}{site.access?.visibility || 'company'} · {site.activeDeploymentId ? 'Published' : 'Pending'}
    +
    {site.owner}Company · {site.activeDeploymentId ? 'Published' : 'Pending'}
    {/each} - {:else if view === 'manage' && managedSite} -
    - -

    Site settings

    -

    {managedSite.name}

    - {managedSite.name}.{siteDomain} ↗ - {#if manageStatus}

    {manageStatus}

    {/if} - -
    -
    01

    Visibility

    Company is the default. Public is always explicit.

    -
    - - - -
    - {#if managedVisibility === 'restricted'}{/if} - -
    - -
    -
    02

    Server runtime

    {managedSite.runtimeEnabled ? '_worker.js active' : 'Static only'}

    - {#if managedSite.runtimeEnabled} -
    SQLite database{managedSite.databaseEnabled ? 'Enabled · disabling permanently deletes its data.' : 'Disabled'}
    - {:else}

    Publish a root _worker.js to unlock backend capabilities.

    {/if} -
    - -
    -
    03

    Secret capabilities

    Write-only bearer credentials with exact host allowlists.

    - {#if managedSite.runtimeEnabled} -
    -
    {#each managedSecrets as secret}
    {secret.name}{secret.allowedHosts.join(', ')}
    {:else}

    No secret capabilities.

    {/each}
    - {:else}

    Secrets require an active server runtime.

    {/if} -
    - -
    -
    04

    Schedules

    UTC · 24 runs/day · 3 retries by default.

    - {#if managedSite.runtimeEnabled} -
    -
    {#each managedSchedules as schedule}
    {schedule.path}{schedule.cron} · {schedule.status} · next {new Date(schedule.nextRunAt).toLocaleString()}
    {#if schedule.status === 'enabled'}{:else}{/if}
    {:else}

    No schedules.

    {/each}
    - {:else}

    Schedules require an active server runtime.

    {/if} -
    -
    {:else if view === 'selected'}
    @@ -661,29 +403,11 @@
    .{siteDomain}
    Lowercase letters, numbers, and hyphens. This becomes your private company URL. -
    - Visibility and server capabilities -
    - Who can open this site? - - - -
    - {#if visibility === 'restricted'} - - {:else if visibility === 'public'} - - {/if} -
    -
    Server runtime{hasWorker ? '_worker.js detected — /api/* will run in an isolated Dynamic Worker.' : 'Add _worker.js to enable an isolated backend.'}
    - {#if hasWorker}{/if} -
    -
    -

    {visibility === 'public' ? 'Explicitly public' : visibility === 'restricted' ? `${readers.length} reader rule${readers.length === 1 ? '' : 's'}` : 'Private to your organization'}

    +

    Anyone authenticated by your organization can open this site.

    {#if isProduct} - + {:else} Deploy Up {/if} @@ -736,14 +460,14 @@

    3. Verify before use

    Publish a folder while authenticated. Open the resulting URL in a clean browser. It must reach Access before any uploaded bytes. workers.dev and Preview URLs stay disabled.

    Prefer to fork and self-host the source? Deploy to Cloudflare ↗

    {:else if section === 'how-to'} -

    Operate Up

    Keep each capability explicit and the trust boundary intact.

    Update a site

    Publish the same site name. Up activates the replacement only after every asset passes verification.

    Change visibility

    Open Manage beside a site. Choose company, restricted readers, or public. Public is never inferred and always requires explicit confirmation during first publish.

    Add a backend

    Build static files into ./dist.
-Add ./dist/_worker.js for /api/* routes.
-Keep secrets out of browser code.
-Publish the folder through Up.

    After publishing, Manage can enable SQLite, write secret capabilities, and create bounded schedules.

    Respond to exposure

    Set the site to company/restricted or disable its schedules first. Never expose the control Worker, private R2 bucket, or runtime keys.

    +

    Operate Up

    Publish the same folder from the browser, CLI, or an agent.

    Update a site

    Publish the same name. Up activates the replacement only after every new asset passes verification.

    Initialize an agent

    up init
+# Ask the agent to read .up/SKILL.md
+# Build into ./dist
+up deploy ./dist team-tool

    Use fixed capabilities

    Import /_up/client.js. Identity, document collections, files, AI, and realtime are available without credentials or per-site infrastructure.

    Respond to exposure

    Disable the wildcard route or Access application first. Never enable workers.dev as a workaround.

    {:else if section === 'reference'} -

    Reference

    Exact contracts for version 0.0.1.

    GET /appAuthenticated publisher
    GET /api/sitesList readable sites
    POST /api/sites/:name/deploymentsCreate deployment + visibility
    PATCH /api/sites/:name/accessCompany, restricted, or public
    PATCH /api/sites/:name/databaseEnable/delete isolated SQLite
    GET|PUT|DELETE /api/sites/:name/secretsWrite-only secret capabilities
    GET|POST|PATCH|DELETE /api/sites/:name/schedulesBounded scheduled jobs
    GET /api/sites/:name/auditCapability and run receipts
    PUT /api/deployments/:id/assetsVerify and store asset
    POST /api/deployments/:id/activateAtomic activation

    Limits

    • 500 files; 10 MiB per file; 50 MiB total
    • index.html required
    • _worker.js maximum 1 MiB
    • Dynamic request: 50 ms CPU, 5 subrequests, network blocked by default
    • 100 reader rules; 20 secret hosts; 1,000 database rows per response
    • 1,440 scheduled attempts/day maximum; 10 retries maximum
    +

    Reference

    Exact contracts for version 0.0.1.

    GET /appAuthenticated publisher
    GET /api/sitesList company sites
    POST /api/sites/:name/deploymentsCreate a pending company deployment
    PUT /api/deployments/:id/assetsVerify and store one asset
    POST /api/deployments/:id/activateAtomically activate a deployment
    GET /_up/identityCurrent verified employee
    /_up/db/*Site document collections
    /_up/files/*Site file storage
    POST /_up/ai/chatBounded Workers AI request
    GET /_up/realtime/:channelAuthenticated WebSocket channel

    Limits

    • 500 deployment files; 10 MiB each; 50 MiB total
    • index.html required
    • 64 KiB per database document; 100 documents per page
    • 10 MiB per site file; 1,000 listed files
    • 24 AI messages; 20,000 input characters; 512 output tokens
    • 16 KiB per realtime message
    {:else if section === 'explanation'} -

    A URL does not grant access.

    Up checks identity before serving a company or restricted site. Anonymous access begins only after an owner explicitly changes that site to public.

    Private sites require identity

    Company visibility accepts identities from the installation’s Access policy. Restricted visibility also checks the site’s email, domain, and group rules. Missing identity returns no uploaded content.

    Uploaded code runs elsewhere

    Browser code runs on sibling hostnames instead of the control origin. An optional _worker.js runs in a separate Dynamic Worker without the registry, deployment authority, R2 bucket, encryption keys, or unrestricted network access.

    Capabilities belong to one site

    Database and secret bindings address one site. Secret values are never returned. Scheduled jobs use leases, daily quotas, bounded retries, and audit receipts.

    A deployment appears all at once

    Files remain pending in private R2 until every manifest digest passes verification. Activation then changes one deployment pointer, so visitors receive either the previous complete version or the next one.

    +

    A URL does not grant access.

    Up verifies a company session before returning a site or any of its capabilities.

    One company boundary

    Cloudflare Access authenticates employees. Up converts that identity into a scoped sibling-domain session. Missing identity returns no uploaded content.

    The hostname selects one site

    Database collections, uploaded files, AI requests, and realtime channels are resolved from the current site hostname. Browser code cannot supply another site’s resource ID.

    Credentials stay on the server

    The browser receives a fixed same-origin API. R2, Durable Object, and Workers AI credentials never enter site code.

    A deployment appears all at once

    Files remain pending in private R2 until every manifest digest passes verification. Activation changes one pointer, so visitors receive either the previous complete version or the next one.

    {:else if section === 'offline'}

    You are offline.

    The documentation shell is cached. Publishing still requires the network and Access.

    {:else} @@ -921,7 +645,7 @@ Publish the folder through Up.

    After publishing, Manage can enabl .empty-state::before { position: absolute; inset: 18px; border: 1px solid transparent; content: ""; pointer-events: none; transition: border-color .15s ease, background .15s ease; } .empty-state.dragging::before { border-color: var(--orange); background: #f6821f0a; } .empty-copy { position: relative; z-index: 1; align-self: center; padding: 48px 0 52px 32px; } - .empty-state h1, .selected-view h1, .publishing-view h1, .success-view h1, .view-heading h1, .manage-view h1 { margin: 0; font-weight: 640; line-height: 1.04; letter-spacing: -.03em; } + .empty-state h1, .selected-view h1, .publishing-view h1, .success-view h1, .view-heading h1 { margin: 0; font-weight: 640; line-height: 1.04; letter-spacing: -.03em; } .empty-state h1 { font-size: clamp(2.6rem, 5vw, 3.7rem); line-height: 1.0; } .empty-copy > p:not(.state-label) { max-width: 390px; margin: 24px 0 32px; color: var(--muted); font-size: .98rem; line-height: 1.64; } .empty-copy small { display: flex; align-items: center; gap: 8px; margin-top: 18px; color: var(--quiet); font-size: .69rem; } @@ -929,10 +653,10 @@ Publish the folder through Up.

    After publishing, Manage can enabl .choose { min-width: 184px; justify-content: space-between; gap: 32px; } .brand-stroke { position:relative; align-self:stretch; min-height:480px; margin-right:-24px; overflow:hidden; pointer-events:none; } .brand-stroke img { position:absolute; inset:0; width:140%; height:100%; object-fit:cover; object-position:72% 58%; } - .selected-view, .publishing-view, .success-view, .list-view, .manage-view { width: min(100%, 820px); margin-inline: auto; } + .selected-view, .publishing-view, .success-view, .list-view { width: min(100%, 820px); margin-inline: auto; } .selected-view, .publishing-view, .success-view { padding-left: 28px; border-left: 2px solid var(--orange); } .back { min-height: 36px; margin: 0 0 44px; padding: 0; border: 0; background: none; color: var(--muted); font: 500 .68rem var(--mono); cursor: pointer; } - .selected-view h1, .publishing-view h1, .success-view h1, .view-heading h1, .manage-view h1 { font-size: clamp(1.85rem, 3.4vw, 2.6rem); } + .selected-view h1, .publishing-view h1, .success-view h1, .view-heading h1 { font-size: clamp(1.85rem, 3.4vw, 2.6rem); } .view-heading { display: flex; align-items: flex-end; justify-content: space-between; gap: 24px; margin-bottom: 38px; } .file-summary { display: grid; grid-template-columns: repeat(3, 1fr); margin: 40px 0; border-block: 1px solid var(--line); } .file-summary div { display: flex; min-height: 80px; flex-direction: column; justify-content: space-between; padding: 14px 16px; border-right: 1px solid var(--line); } @@ -950,22 +674,6 @@ Publish the folder through Up.

    After publishing, Manage can enabl .address > small { color: var(--quiet); font-size: .66rem; line-height: 1.45; } .privacy { display: flex; width: max-content; align-items: center; gap: 8px; margin: 16px 0 38px; padding: 7px 10px; border: 1px solid #dce8df; border-radius: 999px; background: #f8fcf9; color: #496052; font-size: .7rem; } .footer-actions { display: flex; justify-content: flex-end; gap: 8px; padding-top: 18px; border-top: 1px solid var(--line); } - .publish-options { margin-top: 22px; border-block: 1px solid var(--line); background: #fbfbf8; } - .publish-options summary { display: flex; min-height: 46px; align-items: center; justify-content: space-between; padding: 0 13px; cursor: pointer; font-size: .72rem; font-weight: 650; list-style: none; } - .publish-options summary::-webkit-details-marker { display: none; } - .publish-options[open] summary span { transform: rotate(45deg); } - .publish-options fieldset { display: grid; margin: 0; padding: 0 13px 13px; border: 0; } - .publish-options legend { padding: 14px 0 8px; color: var(--quiet); font: 500 .61rem var(--mono); text-transform: uppercase; } - .publish-options fieldset label { display: grid; grid-template-columns: 22px 1fr; padding: 10px 0; border-top: 1px solid var(--line); cursor: pointer; } - .publish-options input, .manage-choice input { accent-color: var(--orange); } - .publish-options fieldset b, .runtime-option b { display: block; font-size: .72rem; } - .publish-options fieldset small, .reader-input small, .runtime-option small { display: block; margin-top: 3px; color: var(--quiet); font-size: .64rem; line-height: 1.45; } - .reader-input { display: grid; gap: 7px; padding: 0 13px 14px; font-size: .68rem; } - .reader-input textarea, .manage-textarea { width: 100%; resize: vertical; padding: 10px; border: 1px solid var(--line-strong); border-radius: 4px; background: #fff; font: 400 .71rem/1.5 var(--mono); } - .public-confirm { display: grid; grid-template-columns: 22px 1fr; margin: 0 13px 14px; padding: 11px; border: 1px solid #efb49b; background: #fff8f5; color: #71351f; font-size: .68rem; line-height: 1.45; } - .runtime-option { display: flex; align-items: center; justify-content: space-between; gap: 20px; padding: 13px; border-top: 1px solid var(--line); } - .runtime-option > div { max-width: 480px; } - .runtime-option > label { display: flex; align-items: center; gap: 7px; font-size: .67rem; } .steps { margin: 40px 0 30px; border-top: 1px solid var(--line); } .steps div { position: relative; display: flex; justify-content: space-between; padding: 13px 0 13px 25px; border-bottom: 1px solid var(--line); font-size: .76rem; } .steps div::before { position: absolute; top: 50%; left: 1px; width: 7px; height: 7px; border: 2px solid var(--line-strong); border-radius: 50%; background: #fff; content: ""; transform: translateY(-50%); } @@ -977,7 +685,7 @@ Publish the folder through Up.

    After publishing, Manage can enabl .state-label.success { color: var(--green); } .success-view { position: relative; } .success-view::after { position: absolute; top: -15px; right: 0; width: 116px; height: 8px; background: linear-gradient(90deg, var(--navy) 0 32%, var(--cyan) 32% 52%, var(--orange) 52%); content: ""; transform: skewX(-26deg); } - .published-url, .managed-url { display: block; margin: 24px 0 28px; color: var(--blue); font: 500 .82rem var(--mono); text-decoration: none; word-break: break-all; } + .published-url { display: block; margin: 24px 0 28px; color: var(--blue); font: 500 .82rem var(--mono); text-decoration: none; word-break: break-all; } .success-actions { display: flex; align-items: center; gap: 22px; } .receipt { margin: 48px 0 30px; border-top: 1px solid var(--line); } .receipt div { display: flex; justify-content: space-between; padding: 13px 0; border-bottom: 1px solid var(--line); } @@ -991,28 +699,6 @@ Publish the folder through Up.

    After publishing, Manage can enabl .site-list code, .site-list span, .site-list small { color: var(--muted); font-size: .66rem; } .site-list a { width: max-content; max-width: 100%; color: var(--muted); text-decoration: none; } .site-list a:hover { text-decoration: underline; text-underline-offset: 3px; } - .manage-link { justify-self: end; padding: 0; border: 0; background: none; color: var(--blue); font-size: .67rem; cursor: pointer; } - - /* Management */ - .manage-status { margin: 0 0 18px; padding: 10px 12px; border-left: 2px solid var(--orange); background: #fff8f4; color: #60351e; font-size: .71rem; } - .manage-section { padding: 28px 0; border-top: 1px solid var(--line); } - .manage-heading { display: flex; align-items: flex-start; justify-content: space-between; gap: 28px; margin-bottom: 20px; } - .manage-heading > div { display: flex; align-items: baseline; gap: 13px; } - .manage-heading span { color: var(--orange); font: 500 .59rem var(--mono); } - .manage-heading h2 { margin: 0; font-size: .98rem; } - .manage-heading > p { max-width: 330px; margin: 0; color: var(--quiet); font-size: .67rem; line-height: 1.5; text-align: right; } - .manage-choice { display: flex; gap: 18px; margin-bottom: 14px; font-size: .71rem; } - .manage-choice label { display: flex; align-items: center; gap: 6px; } - .manage-textarea { margin-bottom: 11px; } - .capability-row, .capability-list article { display: flex; align-items: center; justify-content: space-between; gap: 20px; padding: 13px 0; border-top: 1px solid var(--line); } - .capability-row small, .capability-list small { display: block; margin-top: 4px; color: var(--quiet); font-size: .64rem; } - .danger { color: var(--red); } - .manage-form { display: grid; grid-template-columns: minmax(0, 1fr) 150px auto; gap: 8px; margin-bottom: 16px; } - .manage-form.three { grid-template-columns: repeat(3, minmax(0, 1fr)) auto; } - .manage-form input { min-width: 0; height: 38px; padding: 0 10px; border: 1px solid var(--line-strong); border-radius: 4px; font: 400 .67rem var(--mono); } - .capability-list { border-bottom: 1px solid var(--line); } - .inline-actions { display: flex; gap: 12px; } - .manage-empty { margin: 0; color: var(--quiet); font-size: .71rem; } @media (max-width: 900px) { .home-hero { min-height:0; align-items:flex-end; padding-top:460px; padding-bottom:56px; } @@ -1037,7 +723,6 @@ Publish the folder through Up.

    After publishing, Manage can enabl .empty-copy { padding: 58px 28px 0; } .brand-stroke { min-height:310px; margin:-6px -30px -8px 12%; } .brand-stroke img { width:155%; object-position:72% 62%; } - .manage-form, .manage-form.three { grid-template-columns: 1fr 1fr; } } @media (max-width: 600px) { @@ -1074,23 +759,16 @@ Publish the folder through Up.

    After publishing, Manage can enabl .brand-stroke { min-height:260px; margin:0 -34px 0 2%; } .brand-stroke img { width:180%; object-position:72% 64%; } .selected-view, .publishing-view, .success-view { padding-left: 18px; } - .selected-view h1, .publishing-view h1, .success-view h1, .view-heading h1, .manage-view h1 { font-size: 2.7rem; } + .selected-view h1, .publishing-view h1, .success-view h1, .view-heading h1 { font-size: 2.7rem; } .file-summary { grid-template-columns: 1fr; } .file-summary div, .file-summary div:first-child { min-height: 56px; flex-direction: row; align-items: center; padding: 12px 0; border-right: 0; border-bottom: 1px solid var(--line); } .file-summary div:last-child { border-bottom: 0; } .address > div { display: grid; } .address em { padding: 0 14px 11px; } - .runtime-option, .manage-heading, .capability-row, .capability-list article { align-items: flex-start; flex-direction: column; } .footer-actions { display: grid; grid-template-columns: 1fr 1.35fr; } .footer-actions > * { width: 100%; } .site-list article { grid-template-columns: 1fr; } .site-list article > div:last-child { justify-items: start; text-align: left; } - .manage-link { justify-self: start; } - .manage-heading > p { text-align: left; } - .manage-choice { align-items: flex-start; flex-direction: column; } - .manage-form, .manage-form.three { grid-template-columns: 1fr; } - .manage-form button { width: 100%; } - .inline-actions { flex-wrap: wrap; } footer nav a:first-child { display: none; } } diff --git a/tests/ssr.test.ts b/tests/ssr.test.ts index 61900f9..ed0a1de 100644 --- a/tests/ssr.test.ts +++ b/tests/ssr.test.ts @@ -37,7 +37,6 @@ describe('SvelteKit publisher SSR', () => { name: 'quarterly-report', owner: 'employee@example.com', activeDeploymentId: 'deployment-id', - access: { visibility: 'company', readers: [] }, }, ], productLoaded: true, @@ -46,7 +45,7 @@ describe('SvelteKit publisher SSR', () => { expect(result.body).toContain('employee@example.com'); expect(result.body).toContain('quarterly-report.up.example.com'); - expect(result.body).toContain('company · Published'); + expect(result.body).toContain('Company · Published'); expect(result.body).not.toContain('Publish a site.'); }); }); diff --git a/tests/up.test.ts b/tests/up.test.ts index 0b89ee1..32496c6 100644 --- a/tests/up.test.ts +++ b/tests/up.test.ts @@ -5,24 +5,13 @@ import { cleanAssetPath, cleanSiteName, type Identity, - nextScheduleTime, - normalizeSchedule, - normalizeSiteAccess, sha256, validateManifest, } from '../src/core'; -import app, { - type Env, - handleAuthenticatedRequest, - isCoreRequest, - runDueSchedules, -} from '../src/core-backend'; -import { cleanAllowedHosts, cleanSecretName, decryptSecret, encryptSecret } from '../src/secrets'; +import app, { type Env, handleAuthenticatedRequest, isCoreRequest } from '../src/core-backend'; import { createSession, sessionCookie, validReturnUrl, verifySession } from '../src/session'; const owner: Identity = { email: 'owner@example.com', role: 'member' }; -const stranger: Identity = { email: 'stranger@example.com', role: 'member' }; -const admin: Identity = { email: 'admin@example.com', role: 'admin' }; const bindings = env as unknown as Env; function control(path: string, init: RequestInit = {}) { @@ -137,63 +126,6 @@ describe('input boundaries', () => { }), ).toThrow('SHA-256'); }); - it('validates explicit visibility and reader rules', () => { - expect(normalizeSiteAccess(undefined)).toEqual({ visibility: 'company', readers: [] }); - expect( - normalizeSiteAccess({ - visibility: 'restricted', - readers: [ - { type: 'email', value: 'READER@EXAMPLE.COM' }, - { type: 'domain', value: '@partner.example' }, - { type: 'group', value: 'Engineering' }, - ], - }), - ).toEqual({ - visibility: 'restricted', - readers: [ - { type: 'email', value: 'reader@example.com' }, - { type: 'domain', value: 'partner.example' }, - { type: 'group', value: 'engineering' }, - ], - }); - expect(() => normalizeSiteAccess({ visibility: 'restricted', readers: [] })).toThrow( - 'at least one reader', - ); - expect(() => - normalizeSiteAccess({ - visibility: 'restricted', - readers: [ - { type: 'email', value: 'same@example.com' }, - { type: 'email', value: 'same@example.com' }, - ], - }), - ).toThrow('unique'); - }); - it('validates bounded schedules and computes the next UTC run', () => { - expect( - normalizeSchedule( - { path: '/api/jobs/daily', cron: '15 9 * * *', maxRunsPerDay: 2, retryLimit: 4 }, - new Date('2026-06-16T09:15:00Z'), - ), - ).toMatchObject({ - path: '/api/jobs/daily', - cron: '15 9 * * *', - status: 'enabled', - maxRunsPerDay: 2, - retryLimit: 4, - nextRunAt: '2026-06-17T09:15:00.000Z', - }); - expect(nextScheduleTime('*/15 * * * *', new Date('2026-06-16T09:16:00Z')).toISOString()).toBe( - '2026-06-16T09:30:00.000Z', - ); - expect(() => normalizeSchedule({ path: '/', cron: '* * * * *' })).toThrow('/api/'); - expect(() => normalizeSchedule({ path: '/api/run', cron: '* * * * MON' })).toThrow( - 'minute/hour', - ); - expect(() => - normalizeSchedule({ path: '/api/run', cron: '* * * * *', maxRunsPerDay: 2000 }), - ).toThrow('1-1440'); - }); it('rejects cross-site mutation requests', async () => { const response = await handleAuthenticatedRequest( new Request('https://control.example.com/api/sites/test/deployments', { @@ -287,495 +219,97 @@ describe('real Durable Object and R2 deployment flow', () => { expect(noJwt.status).toBe(302); expect(noJwt.headers.get('location')).toContain('/app/__session'); }); - it('serves explicit public sites anonymously without exposing private sites', async () => { - const published = await createDeployment(undefined, { visibility: 'public', readers: [] }); - await upload(published.id, published.html); - await upload(published.id, published.css); - await handleAuthenticatedRequest( - control(`/api/deployments/${published.id}/activate`, { method: 'POST' }), - bindings, - owner, - ); - const page = await SELF.fetch(`https://${published.site}.up.example.com/`); - expect(page.status).toBe(200); - expect(await page.text()).toContain('private receipt'); - const viewer = await SELF.fetch(`https://${published.site}.up.example.com/__up/me`); - expect(await viewer.json()).toEqual({ email: null, visibility: 'public' }); - - const company = await createDeployment(); - await upload(company.id, company.html); - await upload(company.id, company.css); - await handleAuthenticatedRequest( - control(`/api/deployments/${company.id}/activate`, { method: 'POST' }), - bindings, - owner, - ); - const anonymousCompany = await SELF.fetch(`https://${company.site}.up.example.com/`, { - redirect: 'manual', - }); - expect({ status: anonymousCompany.status, body: await anonymousCompany.text() }).toEqual({ - status: 302, - body: '', - }); - const session = await createSession( - owner, - 'test-session-secret-that-is-at-least-32-characters', - ); - const authenticated = await SELF.fetch(`https://${company.site}.up.example.com/`, { - headers: { cookie: `up_session=${session}` }, - }); - expect(authenticated.status).toBe(200); - }); - it('enforces restricted email, domain, and group readers while concealing sites', async () => { - const restricted = await createDeployment(undefined, { - visibility: 'restricted', - readers: [ - { type: 'email', value: stranger.email }, - { type: 'domain', value: 'partner.example' }, - { type: 'group', value: 'engineering' }, - ], - }); - await upload(restricted.id, restricted.html); - await upload(restricted.id, restricted.css); - await handleAuthenticatedRequest( - control(`/api/deployments/${restricted.id}/activate`, { method: 'POST' }), - bindings, - owner, - ); - for (const identity of [ - stranger, - { email: 'person@partner.example', role: 'member' as const }, - { email: 'group-user@example.com', role: 'member' as const, groups: ['Engineering'] }, - ]) { - const page = await handleAuthenticatedRequest( - new Request(`https://${restricted.site}.up.example.com/`), + it('provides fixed credential-free site capabilities with site isolation', async () => { + const first = await createDeployment(); + const second = await createDeployment(); + for (const deployment of [first, second]) { + await upload(deployment.id, deployment.html); + await upload(deployment.id, deployment.css); + await handleAuthenticatedRequest( + control(`/api/deployments/${deployment.id}/activate`, { method: 'POST' }), bindings, - identity, + owner, ); - expect(page.status).toBe(200); } - const denied = await handleAuthenticatedRequest( - new Request(`https://${restricted.site}.up.example.com/`), - bindings, - { email: 'denied@example.com', role: 'member' }, - ); - expect(denied.status).toBe(404); - }); - it('loads optional backend code only for site API routes with hard isolation limits', async () => { - const code = `export default { fetch() { return new Response('dynamic'); } };`; - const created = await createDeployment(undefined, undefined, code); - await handleAuthenticatedRequest( - control(`/api/sites/${created.site}/database`, { - method: 'PATCH', - headers: { 'content-type': 'application/json' }, - body: JSON.stringify({ enabled: true }), - }), - bindings, - owner, - ); - await upload(created.id, created.html); - await upload(created.id, created.css); - if (!created.worker) throw new Error('worker fixture missing'); - await upload(created.id, created.worker); - await handleAuthenticatedRequest( - control(`/api/deployments/${created.id}/activate`, { method: 'POST' }), - bindings, - owner, - ); - let loads = 0; - let loaded: WorkerLoaderWorkerCode | undefined; - const loader = { - get(_id: string, getCode: () => Promise) { - return { - getEntrypoint(_name?: string, options?: WorkerStubEntrypointOptions) { - return { - async fetch() { - loads++; - loaded = await getCode(); - expect(options?.limits).toEqual({ cpuMs: 50, subRequests: 5 }); - return new Response('dynamic response', { - status: 201, - headers: { 'set-cookie': 'escape=blocked; Domain=.example.com' }, - }); - }, - }; - }, - }; - }, - } as unknown as WorkerLoader; - const runtimeBindings = Object.assign({}, bindings, { LOADER: loader }); - const staticPage = await handleAuthenticatedRequest( - new Request(`https://${created.site}.up.example.com/`), - runtimeBindings, - owner, - ); - expect(staticPage.status).toBe(200); - expect(loads).toBe(0); - const dynamic = await handleAuthenticatedRequest( - new Request(`https://${created.site}.up.example.com/api/hello`), - runtimeBindings, - owner, - ); - expect(dynamic.status).toBe(201); - expect(await dynamic.text()).toBe('dynamic response'); - expect(dynamic.headers.get('set-cookie')).toBeNull(); - expect(dynamic.headers.get('cache-control')).toBe('private, no-store'); - expect(loaded?.modules['_worker.js']).toBe(code); - expect(loaded?.globalOutbound).toBeNull(); - expect(loaded?.env.UP_DB).toBeTruthy(); - expect(loaded?.env.UP_SECRETS).toBeTruthy(); - expect(loaded?.limits).toEqual({ cpuMs: 50, subRequests: 5 }); - }); - it('returns a generic failure without leaking dynamic code errors', async () => { - const code = `throw new Error('TOP SECRET STACK');`; - const created = await createDeployment(undefined, undefined, code); - await upload(created.id, created.html); - await upload(created.id, created.css); - if (!created.worker) throw new Error('worker fixture missing'); - await upload(created.id, created.worker); - await handleAuthenticatedRequest( - control(`/api/deployments/${created.id}/activate`, { method: 'POST' }), - bindings, - owner, - ); - const loader = { - get() { - throw new Error('TOP SECRET STACK'); - }, - } as unknown as WorkerLoader; - const response = await handleAuthenticatedRequest( - new Request(`https://${created.site}.up.example.com/api/fail`), - Object.assign({}, bindings, { LOADER: loader }), - owner, - ); - expect(response.status).toBe(502); - expect(await response.json()).toEqual({ error: 'Dynamic request failed' }); - }); - it('lets only owners and admins change site visibility', async () => { - const created = await createDeployment(); - const body = JSON.stringify({ - access: { visibility: 'restricted', readers: [{ type: 'email', value: stranger.email }] }, - }); - const strangerResponse = await handleAuthenticatedRequest( - control(`/api/sites/${created.site}/access`, { - method: 'PATCH', - headers: { 'content-type': 'application/json' }, - body, - }), - bindings, - stranger, - ); - expect(strangerResponse.status).toBe(404); - const updated = await handleAuthenticatedRequest( - control(`/api/sites/${created.site}/access`, { - method: 'PATCH', - headers: { 'content-type': 'application/json' }, - body, - }), - bindings, - owner, - ); - expect(updated.status).toBe(200); - expect((await updated.json<{ site: { access: unknown } }>()).site.access).toEqual({ - visibility: 'restricted', - readers: [{ type: 'email', value: stranger.email }], - }); - }); - it('provisions and destroys an isolated per-site SQLite database', async () => { - const created = await createDeployment(); - const strangerResponse = await handleAuthenticatedRequest( - control(`/api/sites/${created.site}/database`, { - method: 'PATCH', - headers: { 'content-type': 'application/json' }, - body: JSON.stringify({ enabled: true }), - }), - bindings, - stranger, - ); - expect(strangerResponse.status).toBe(404); - const enabled = await handleAuthenticatedRequest( - control(`/api/sites/${created.site}/database`, { - method: 'PATCH', - headers: { 'content-type': 'application/json' }, - body: JSON.stringify({ enabled: true }), - }), - bindings, - owner, - ); - expect( - (await enabled.json<{ site: { databaseEnabled: boolean } }>()).site.databaseEnabled, - ).toBe(true); - const database = bindings.SITE_DATABASE?.get(bindings.SITE_DATABASE.idFromName(created.site)); - if (!database) throw new Error('SITE_DATABASE binding missing'); - const query = async (sql: string, params: unknown[] = []) => - database.fetch('https://database.internal/query', { - method: 'POST', - headers: { 'content-type': 'application/json' }, - body: JSON.stringify({ sql, params }), - }); - expect((await query('CREATE TABLE notes(id INTEGER PRIMARY KEY, body TEXT)')).status).toBe(200); - expect((await query('INSERT INTO notes(body) VALUES (?)', ['private'])).status).toBe(200); - const selected = await query('SELECT body FROM notes'); - expect(await selected.json()).toMatchObject({ rows: [{ body: 'private' }] }); - expect((await query("ATTACH DATABASE 'other' AS other")).status).toBe(400); - expect((await query('SELECT 1; SELECT 2')).status).toBe(400); - const disabled = await handleAuthenticatedRequest( - control(`/api/sites/${created.site}/database`, { - method: 'PATCH', - headers: { 'content-type': 'application/json' }, - body: JSON.stringify({ enabled: false }), - }), - bindings, - owner, - ); - expect( - (await disabled.json<{ site: { databaseEnabled: boolean } }>()).site.databaseEnabled, - ).toBe(false); - expect((await query('SELECT body FROM notes')).status).toBe(400); - }); - it('creates, pauses, disables, audits, and deletes bounded schedules', async () => { - const created = await createDeployment( - undefined, - undefined, - `export default { fetch() { return new Response(null, { status: 204 }); } };`, - ); - await upload(created.id, created.html); - await upload(created.id, created.css); - if (!created.worker) throw new Error('worker fixture missing'); - await upload(created.id, created.worker); - await handleAuthenticatedRequest( - control(`/api/deployments/${created.id}/activate`, { method: 'POST' }), - bindings, - owner, - ); - const payload = JSON.stringify({ - path: '/api/jobs/hourly', - cron: '0 * * * *', - maxRunsPerDay: 12, - retryLimit: 2, + const capability = (site: string, path: string, init: RequestInit = {}) => { + const origin = `https://${site}.up.example.com`; + const headers = new Headers(init.headers); + headers.set('origin', origin); + headers.set('sec-fetch-site', 'same-origin'); + return handleAuthenticatedRequest( + new Request(`${origin}/_up/${path}`, { ...init, headers }), + bindings, + owner, + ); + }; + + const client = await capability(first.site, 'client.js'); + expect(client.status).toBe(200); + expect(await client.text()).toContain('export const up='); + + const identity = await capability(first.site, 'identity'); + expect(await identity.json()).toEqual({ email: owner.email, groups: [], role: 'member' }); + + const created = await capability(first.site, 'db/votes', { + method: 'POST', + headers: { 'content-type': 'application/json' }, + body: JSON.stringify({ choice: 'Tacos' }), }); - const denied = await handleAuthenticatedRequest( - control(`/api/sites/${created.site}/schedules`, { - method: 'POST', - headers: { 'content-type': 'application/json' }, - body: payload, - }), - bindings, - stranger, - ); - expect(denied.status).toBe(404); - const added = await handleAuthenticatedRequest( - control(`/api/sites/${created.site}/schedules`, { - method: 'POST', - headers: { 'content-type': 'application/json' }, - body: payload, - }), - bindings, - owner, - ); - expect(added.status).toBe(201); - const item = await added.json<{ schedule: { id: string; status: string } }>(); - expect(item.schedule.status).toBe('enabled'); - const paused = await handleAuthenticatedRequest( - control(`/api/sites/${created.site}/schedules/${item.schedule.id}`, { - method: 'PATCH', - headers: { 'content-type': 'application/json' }, - body: JSON.stringify({ status: 'paused' }), - }), - bindings, - owner, - ); - expect((await paused.json<{ schedule: { status: string } }>()).schedule.status).toBe('paused'); - const disabled = await handleAuthenticatedRequest( - control(`/api/sites/${created.site}/schedules/${item.schedule.id}`, { - method: 'PATCH', - headers: { 'content-type': 'application/json' }, - body: JSON.stringify({ status: 'disabled' }), - }), - bindings, - owner, - ); - expect((await disabled.json<{ schedule: { status: string } }>()).schedule.status).toBe( - 'disabled', - ); - const audit = await handleAuthenticatedRequest( - control(`/api/sites/${created.site}/audit`), - bindings, - owner, - ); - const auditBody = await audit.text(); - expect(auditBody).toContain('schedule.created'); - expect(auditBody).toContain('schedule.updated'); - expect(auditBody).not.toContain('secret'); - const removed = await handleAuthenticatedRequest( - control(`/api/sites/${created.site}/schedules/${item.schedule.id}`, { - method: 'DELETE', - }), - bindings, - owner, - ); - expect(removed.status).toBe(200); - const listed = await handleAuthenticatedRequest( - control(`/api/sites/${created.site}/schedules`), - bindings, - owner, - ); - expect(await listed.json()).toEqual({ schedules: [] }); - }); - it('leases due schedules atomically, retries failures, enforces quotas, and audits runs', async () => { - const code = `export default { fetch() { return new Response('scheduled'); } };`; - const created = await createDeployment(undefined, undefined, code); - await upload(created.id, created.html); - await upload(created.id, created.css); - if (!created.worker) throw new Error('worker fixture missing'); - await upload(created.id, created.worker); - await handleAuthenticatedRequest( - control(`/api/deployments/${created.id}/activate`, { method: 'POST' }), - bindings, - owner, - ); - const added = await handleAuthenticatedRequest( - control(`/api/sites/${created.site}/schedules`, { - method: 'POST', - headers: { 'content-type': 'application/json' }, - body: JSON.stringify({ - path: '/api/jobs/run', - cron: '* * * * *', - maxRunsPerDay: 2, - retryLimit: 2, - }), - }), - bindings, - owner, - ); - const schedule = await added.json<{ schedule: { nextRunAt: string } }>(); - let invocations = 0; - const loader = { - get(_id: string, getCode: () => Promise) { - return { - getEntrypoint() { - return { - async fetch() { - await getCode(); - invocations++; - return new Response(null, { status: invocations === 1 ? 500 : 204 }); - }, - }; - }, - }; - }, - } as unknown as WorkerLoader; - const runtimeBindings = Object.assign({}, bindings, { LOADER: loader }); - const firstRun = new Date(schedule.schedule.nextRunAt); - expect(await runDueSchedules(runtimeBindings, firstRun)).toBe(1); - const afterFailure = await handleAuthenticatedRequest( - control(`/api/sites/${created.site}/schedules`), - bindings, - owner, - ); - const failed = await afterFailure.json<{ - schedules: Array<{ nextRunAt: string; lastStatus: string; attempts: number }>; - }>(); - expect(failed.schedules[0]).toMatchObject({ lastStatus: 'failed', attempts: 1 }); - expect( - await runDueSchedules(runtimeBindings, new Date(failed.schedules[0]?.nextRunAt || '')), - ).toBe(1); - const afterSuccess = await handleAuthenticatedRequest( - control(`/api/sites/${created.site}/schedules`), - bindings, - owner, - ); - const succeeded = await afterSuccess.json<{ - schedules: Array<{ nextRunAt: string; lastStatus: string; attempts: number }>; - }>(); - expect(succeeded.schedules[0]).toMatchObject({ lastStatus: 'success', attempts: 0 }); - expect( - await runDueSchedules(runtimeBindings, new Date(succeeded.schedules[0]?.nextRunAt || '')), - ).toBe(0); - expect(invocations).toBe(2); - const audit = await handleAuthenticatedRequest( - control(`/api/sites/${created.site}/audit`), - bindings, - owner, - ); - const auditText = await audit.text(); - expect(auditText).toContain('schedule.run_failed'); - expect(auditText).toContain('schedule.run_succeeded'); - expect(auditText).toContain('schedule.quota_skipped'); - expect(auditText).not.toContain(code); - }); - it('encrypts per-site secret capabilities and never returns plaintext', async () => { - const key = 'dGVzdC10ZXN0LXNlY3JldHMta2V5LTMyLWJ5dGVzISE'; - const encrypted = await encryptSecret('super-secret-value', key); - expect(JSON.stringify(encrypted)).not.toContain('super-secret-value'); - expect(await decryptSecret(encrypted, key)).toBe('super-secret-value'); - expect(cleanSecretName('api_token')).toBe('API_TOKEN'); - expect(cleanAllowedHosts(['API.EXAMPLE.COM', 'api.example.com'])).toEqual(['api.example.com']); + expect(created.status).toBe(201); + const document = await created.json<{ id: string; choice: string }>(); + expect(document.choice).toBe('Tacos'); + const list = await capability(first.site, 'db/votes'); + expect((await list.json<{ documents: unknown[] }>()).documents).toContainEqual(document); + const isolatedList = await capability(second.site, 'db/votes'); + expect((await isolatedList.json<{ documents: unknown[] }>()).documents).toEqual([]); - const created = await createDeployment(); - const payload = JSON.stringify({ - value: 'super-secret-value', - allowedHosts: ['api.example.com'], + const stored = await capability(first.site, 'files/menu.txt', { + method: 'PUT', + headers: { 'content-type': 'text/plain' }, + body: 'tacos', }); - const denied = await handleAuthenticatedRequest( - control(`/api/sites/${created.site}/secrets/API_TOKEN`, { - method: 'PUT', - headers: { 'content-type': 'application/json' }, - body: payload, - }), - bindings, - stranger, - ); - expect(denied.status).toBe(404); - const stored = await handleAuthenticatedRequest( - control(`/api/sites/${created.site}/secrets/API_TOKEN`, { - method: 'PUT', - headers: { 'content-type': 'application/json' }, - body: payload, - }), - bindings, - owner, - ); expect(stored.status).toBe(201); - expect(await stored.text()).not.toContain('super-secret-value'); - const listed = await handleAuthenticatedRequest( - control(`/api/sites/${created.site}/secrets`), - bindings, - owner, + expect(await (await capability(first.site, 'files/menu.txt')).text()).toBe('tacos'); + expect((await capability(second.site, 'files/menu.txt')).status).toBe(404); + const files = await capability(first.site, 'files'); + expect((await files.json<{ files: Array<{ name: string }> }>()).files).toContainEqual( + expect.objectContaining({ name: 'menu.txt' }), ); - const listing = await listed.text(); - expect(listing).toContain('API_TOKEN'); - expect(listing).toContain('api.example.com'); - expect(listing).not.toContain('super-secret-value'); - const secrets = bindings.SITE_SECRETS?.get(bindings.SITE_SECRETS.idFromName(created.site)); - if (!secrets) throw new Error('SITE_SECRETS binding missing'); - expect((await secrets.fetch('https://secrets.internal/secrets')).status).toBe(404); - const disallowed = await secrets.fetch('https://secrets.internal/use/API_TOKEN', { + const ai = await capability(first.site, 'ai/chat', { method: 'POST', headers: { 'content-type': 'application/json' }, - body: JSON.stringify({ url: 'https://evil.example/collect' }), + body: JSON.stringify({ messages: [{ role: 'user', content: 'hello' }] }), }); - expect(disallowed.status).toBe(403); + expect(ai.status).toBe(503); - const removed = await handleAuthenticatedRequest( - control(`/api/sites/${created.site}/secrets/API_TOKEN`, { method: 'DELETE' }), - bindings, - owner, - ); - expect(removed.status).toBe(200); - const empty = await handleAuthenticatedRequest( - control(`/api/sites/${created.site}/secrets`), - bindings, - owner, - ); - expect(await empty.json()).toEqual({ secrets: [] }); - }); - it('conceals deployment writes from strangers but allows an administrator', async () => { - const first = await createDeployment(); - expect((await upload(first.id, first.html, stranger)).status).toBe(404); - expect((await upload(first.id, first.html, admin)).status).toBe(200); + const connect = async () => { + const response = await capability(first.site, 'realtime/votes', { + headers: { upgrade: 'websocket' }, + }); + expect(response.status).toBe(101); + const socket = response.webSocket; + if (!socket) throw new Error('Realtime WebSocket missing'); + socket.accept(); + return socket; + }; + const sender = await connect(); + const receiver = await connect(); + const received = new Promise>((resolve) => { + receiver.addEventListener('message', (event) => { + const message = JSON.parse(String(event.data)) as Record; + if (message.type === 'vote') resolve(message); + }); + }); + sender.send(JSON.stringify({ type: 'vote', data: { choice: 'Tacos' } })); + await expect(received).resolves.toMatchObject({ + type: 'vote', + data: { choice: 'Tacos' }, + sender: owner.email, + }); + sender.close(); + receiver.close(); }); it('atomically supersedes a previous complete deployment', async () => { const first = await createDeployment(); diff --git a/wrangler.jsonc b/wrangler.jsonc index 0168f3f..a294759 100644 --- a/wrangler.jsonc +++ b/wrangler.jsonc @@ -6,8 +6,12 @@ "compatibility_flags": ["nodejs_compat"], "workers_dev": false, "preview_urls": false, - "observability": { "enabled": true }, - "build": { "command": "bun run build" }, + "observability": { + "enabled": true + }, + "build": { + "command": "bun run build" + }, "assets": { "binding": "STATIC_ASSETS", "directory": ".svelte-kit/cloudflare", @@ -25,18 +29,52 @@ }, "durable_objects": { "bindings": [ - { "name": "REGISTRY", "class_name": "UpRegistry" }, - { "name": "SITE_DATABASE", "class_name": "SiteDatabase" }, - { "name": "SITE_SECRETS", "class_name": "SiteSecrets" } + { + "name": "REGISTRY", + "class_name": "UpRegistry" + }, + { + "name": "SITE_DATABASE", + "class_name": "SiteDatabase" + }, + { + "name": "SITE_REALTIME", + "class_name": "SiteRealtime" + } ] }, "migrations": [ - { "tag": "v1", "new_sqlite_classes": ["UpRegistry"] }, - { "tag": "v2", "new_sqlite_classes": ["SiteDatabase"] }, - { "tag": "v3", "new_sqlite_classes": ["SiteSecrets"] }, - { "tag": "v4" } + { + "tag": "v1", + "new_sqlite_classes": ["UpRegistry"] + }, + { + "tag": "v2", + "new_sqlite_classes": ["SiteDatabase"] + }, + { + "tag": "v3", + "new_sqlite_classes": ["SiteSecrets"] + }, + { + "tag": "v4" + }, + { + "tag": "v5", + "new_sqlite_classes": ["SiteRealtime"] + }, + { + "tag": "v6", + "deleted_classes": ["SiteSecrets"] + } ], - "r2_buckets": [{ "binding": "ASSETS", "bucket_name": "up-assets" }], - "worker_loaders": [{ "binding": "LOADER" }], - "triggers": { "crons": ["* * * * *"] } + "ai": { + "binding": "AI" + }, + "r2_buckets": [ + { + "binding": "ASSETS", + "bucket_name": "up-assets" + } + ] } diff --git a/wrangler.local.jsonc b/wrangler.local.jsonc index df7945e..e1bdaf9 100644 --- a/wrangler.local.jsonc +++ b/wrangler.local.jsonc @@ -23,17 +23,52 @@ }, "durable_objects": { "bindings": [ - { "name": "REGISTRY", "class_name": "UpRegistry" }, - { "name": "SITE_DATABASE", "class_name": "SiteDatabase" }, - { "name": "SITE_SECRETS", "class_name": "SiteSecrets" } + { + "name": "REGISTRY", + "class_name": "UpRegistry" + }, + { + "name": "SITE_DATABASE", + "class_name": "SiteDatabase" + }, + { + "name": "SITE_REALTIME", + "class_name": "SiteRealtime" + } ] }, "migrations": [ - { "tag": "v1", "new_sqlite_classes": ["UpRegistry"] }, - { "tag": "v2", "new_sqlite_classes": ["SiteDatabase"] }, - { "tag": "v3", "new_sqlite_classes": ["SiteSecrets"] }, - { "tag": "v4" } + { + "tag": "v1", + "new_sqlite_classes": ["UpRegistry"] + }, + { + "tag": "v2", + "new_sqlite_classes": ["SiteDatabase"] + }, + { + "tag": "v3", + "new_sqlite_classes": ["SiteSecrets"] + }, + { + "tag": "v4" + }, + { + "tag": "v5", + "new_sqlite_classes": ["SiteRealtime"] + }, + { + "tag": "v6", + "deleted_classes": ["SiteSecrets"] + } ], - "r2_buckets": [{ "binding": "ASSETS", "bucket_name": "up-local-assets" }], - "worker_loaders": [{ "binding": "LOADER" }] + "ai": { + "binding": "AI" + }, + "r2_buckets": [ + { + "binding": "ASSETS", + "bucket_name": "up-local-assets" + } + ] } diff --git a/wrangler.production.jsonc b/wrangler.production.jsonc index 7c133c8..85f7fd8 100644 --- a/wrangler.production.jsonc +++ b/wrangler.production.jsonc @@ -6,16 +6,26 @@ "compatibility_flags": ["nodejs_compat"], "workers_dev": false, "preview_urls": false, - "observability": { "enabled": true }, - "build": { "command": "bun run build" }, + "observability": { + "enabled": true + }, + "build": { + "command": "bun run build" + }, "assets": { "binding": "STATIC_ASSETS", "directory": ".svelte-kit/cloudflare", "run_worker_first": true }, "routes": [ - { "pattern": "up.example.com", "custom_domain": true }, - { "pattern": "*.up.example.com/*", "zone_name": "up.example.com" } + { + "pattern": "up.example.com", + "custom_domain": true + }, + { + "pattern": "*.up.example.com/*", + "zone_name": "up.example.com" + } ], "vars": { "TEAM_DOMAIN": "https://REPLACE.cloudflareaccess.com", @@ -29,18 +39,52 @@ }, "durable_objects": { "bindings": [ - { "name": "REGISTRY", "class_name": "UpRegistry" }, - { "name": "SITE_DATABASE", "class_name": "SiteDatabase" }, - { "name": "SITE_SECRETS", "class_name": "SiteSecrets" } + { + "name": "REGISTRY", + "class_name": "UpRegistry" + }, + { + "name": "SITE_DATABASE", + "class_name": "SiteDatabase" + }, + { + "name": "SITE_REALTIME", + "class_name": "SiteRealtime" + } ] }, "migrations": [ - { "tag": "v1", "new_sqlite_classes": ["UpRegistry"] }, - { "tag": "v2", "new_sqlite_classes": ["SiteDatabase"] }, - { "tag": "v3", "new_sqlite_classes": ["SiteSecrets"] }, - { "tag": "v4" } + { + "tag": "v1", + "new_sqlite_classes": ["UpRegistry"] + }, + { + "tag": "v2", + "new_sqlite_classes": ["SiteDatabase"] + }, + { + "tag": "v3", + "new_sqlite_classes": ["SiteSecrets"] + }, + { + "tag": "v4" + }, + { + "tag": "v5", + "new_sqlite_classes": ["SiteRealtime"] + }, + { + "tag": "v6", + "deleted_classes": ["SiteSecrets"] + } ], - "r2_buckets": [{ "binding": "ASSETS", "bucket_name": "up-assets" }], - "worker_loaders": [{ "binding": "LOADER" }], - "triggers": { "crons": ["* * * * *"] } + "ai": { + "binding": "AI" + }, + "r2_buckets": [ + { + "binding": "ASSETS", + "bucket_name": "up-assets" + } + ] } diff --git a/wrangler.staged.jsonc b/wrangler.staged.jsonc index 017053c..66bc87a 100644 --- a/wrangler.staged.jsonc +++ b/wrangler.staged.jsonc @@ -6,8 +6,12 @@ "compatibility_flags": ["nodejs_compat"], "workers_dev": false, "preview_urls": false, - "observability": { "enabled": true }, - "build": { "command": "bun run build" }, + "observability": { + "enabled": true + }, + "build": { + "command": "bun run build" + }, "assets": { "binding": "STATIC_ASSETS", "directory": ".svelte-kit/cloudflare", @@ -25,18 +29,52 @@ }, "durable_objects": { "bindings": [ - { "name": "REGISTRY", "class_name": "UpRegistry" }, - { "name": "SITE_DATABASE", "class_name": "SiteDatabase" }, - { "name": "SITE_SECRETS", "class_name": "SiteSecrets" } + { + "name": "REGISTRY", + "class_name": "UpRegistry" + }, + { + "name": "SITE_DATABASE", + "class_name": "SiteDatabase" + }, + { + "name": "SITE_REALTIME", + "class_name": "SiteRealtime" + } ] }, "migrations": [ - { "tag": "v1", "new_sqlite_classes": ["UpRegistry"] }, - { "tag": "v2", "new_sqlite_classes": ["SiteDatabase"] }, - { "tag": "v3", "new_sqlite_classes": ["SiteSecrets"] }, - { "tag": "v4" } + { + "tag": "v1", + "new_sqlite_classes": ["UpRegistry"] + }, + { + "tag": "v2", + "new_sqlite_classes": ["SiteDatabase"] + }, + { + "tag": "v3", + "new_sqlite_classes": ["SiteSecrets"] + }, + { + "tag": "v4" + }, + { + "tag": "v5", + "new_sqlite_classes": ["SiteRealtime"] + }, + { + "tag": "v6", + "deleted_classes": ["SiteSecrets"] + } ], - "r2_buckets": [{ "binding": "ASSETS", "bucket_name": "up-assets" }], - "worker_loaders": [{ "binding": "LOADER" }], - "triggers": { "crons": ["* * * * *"] } + "ai": { + "binding": "AI" + }, + "r2_buckets": [ + { + "binding": "ASSETS", + "bucket_name": "up-assets" + } + ] } diff --git a/wrangler.test.jsonc b/wrangler.test.jsonc index d52a852..b47ffaa 100644 --- a/wrangler.test.jsonc +++ b/wrangler.test.jsonc @@ -18,16 +18,49 @@ }, "durable_objects": { "bindings": [ - { "name": "REGISTRY", "class_name": "UpRegistry" }, - { "name": "SITE_DATABASE", "class_name": "SiteDatabase" }, - { "name": "SITE_SECRETS", "class_name": "SiteSecrets" } + { + "name": "REGISTRY", + "class_name": "UpRegistry" + }, + { + "name": "SITE_DATABASE", + "class_name": "SiteDatabase" + }, + { + "name": "SITE_REALTIME", + "class_name": "SiteRealtime" + } ] }, "migrations": [ - { "tag": "v1", "new_sqlite_classes": ["UpRegistry"] }, - { "tag": "v2", "new_sqlite_classes": ["SiteDatabase"] }, - { "tag": "v3", "new_sqlite_classes": ["SiteSecrets"] }, - { "tag": "v4" } + { + "tag": "v1", + "new_sqlite_classes": ["UpRegistry"] + }, + { + "tag": "v2", + "new_sqlite_classes": ["SiteDatabase"] + }, + { + "tag": "v3", + "new_sqlite_classes": ["SiteSecrets"] + }, + { + "tag": "v4" + }, + { + "tag": "v5", + "new_sqlite_classes": ["SiteRealtime"] + }, + { + "tag": "v6", + "deleted_classes": ["SiteSecrets"] + } ], - "r2_buckets": [{ "binding": "ASSETS", "bucket_name": "up-test-assets" }] + "r2_buckets": [ + { + "binding": "ASSETS", + "bucket_name": "up-test-assets" + } + ] } From e0262c738f182b8b63c4bbcfac73c09a3f679dee Mon Sep 17 00:00:00 2001 From: Jordan Coeyman Date: Fri, 19 Jun 2026 11:50:39 -0400 Subject: [PATCH 2/7] Add browser-mediated CLI authentication --- cli/up.ts | 75 ++++++++++++++++++++++++------ src/core-backend.ts | 70 +++++++++++++++++++++++++++- src/session.ts | 111 ++++++++++++++++++++++++++++++++++++++------ tests/up.test.ts | 29 +++++++++++- 4 files changed, 256 insertions(+), 29 deletions(-) diff --git a/cli/up.ts b/cli/up.ts index cb87e61..a967013 100644 --- a/cli/up.ts +++ b/cli/up.ts @@ -1,7 +1,8 @@ #!/usr/bin/env bun -import { execFileSync } from 'node:child_process'; -import { createHash } from 'node:crypto'; +import { spawn } from 'node:child_process'; +import { createHash, randomBytes } from 'node:crypto'; import { mkdir, readdir, readFile, stat, writeFile } from 'node:fs/promises'; +import http from 'node:http'; import { join, relative, resolve } from 'node:path'; const DEFAULT_ORIGIN = 'https://up.ax.cloudflare.dev'; @@ -22,12 +23,60 @@ function option(name: string): string | undefined { return index >= 0 ? args[index + 1] : undefined; } -function accessToken(origin: string): string { - if (process.env.UP_ACCESS_TOKEN) return process.env.UP_ACCESS_TOKEN; - return execFileSync('cloudflared', ['access', 'token', '-app', origin], { - encoding: 'utf8', - stdio: ['ignore', 'pipe', 'inherit'], - }).trim(); +async function cliToken(origin: string): Promise { + if (process.env.UP_CLI_TOKEN) return process.env.UP_CLI_TOKEN; + const verifier = randomBytes(48).toString('base64url'); + const digest = createHash('sha256').update(verifier).digest('base64url'); + const state = randomBytes(24).toString('base64url'); + const authorization = await new Promise<{ code: string; state: string }>((resolve, reject) => { + const server = http.createServer((request, response) => { + const url = new URL(request.url || '/', `http://${request.headers.host}`); + const code = url.searchParams.get('code'); + const returnedState = url.searchParams.get('state'); + if (!code || !returnedState) { + response.writeHead(400, { 'content-type': 'text/plain' }); + response.end('Up CLI authentication failed.'); + return; + } + response.writeHead(200, { 'content-type': 'text/html; charset=utf-8' }); + response.end( + 'Up CLI connected

    Up CLI connected.

    You can close this window.

    ', + ); + server.close(); + resolve({ code, state: returnedState }); + }); + server.on('error', reject); + server.listen(0, '127.0.0.1', () => { + const address = server.address(); + if (!address || typeof address === 'string') + return reject(new Error('Unable to open callback')); + const redirect = `http://127.0.0.1:${address.port}/callback`; + const url = new URL('/app/cli-auth', origin); + url.searchParams.set('redirect_uri', redirect); + url.searchParams.set('state', state); + url.searchParams.set('challenge', digest); + console.log(`Opening Up in your browser…\n${url}`); + const child = spawn('open', [url.toString()], { detached: true, stdio: 'ignore' }); + child.unref(); + }); + setTimeout( + () => { + server.close(); + reject(new Error('CLI authentication timed out')); + }, + 5 * 60 * 1000, + ).unref(); + }); + if (authorization.state !== state) throw new Error('CLI authentication state mismatch'); + const response = await fetch(`${origin}/cli/exchange`, { + method: 'POST', + headers: { 'content-type': 'application/json' }, + body: JSON.stringify({ code: authorization.code, verifier }), + }); + const body = (await response.json()) as { token?: string; error?: string }; + if (!response.ok || !body.token) + throw new Error(body.error || 'Unable to exchange CLI authorization'); + return body.token; } async function files(root: string): Promise { @@ -87,8 +136,8 @@ async function deploy(): Promise { const paths = await files(root); if (!paths.some((path) => relative(root, path) === 'index.html')) throw new Error('index.html is required'); - const token = accessToken(origin); - const authHeaders = { 'cf-access-token': token }; + const token = await cliToken(origin); + const authHeaders = { authorization: `Bearer ${token}` }; const prepared = await Promise.all( paths.map(async (path) => { const bytes = await readFile(path); @@ -107,7 +156,7 @@ async function deploy(): Promise { sha256: file.sha256, })); console.log(`Authenticated · ${prepared.length} files ready`); - const create = await fetch(`${origin}/api/sites/${encodeURIComponent(name)}/deployments`, { + const create = await fetch(`${origin}/cli/sites/${encodeURIComponent(name)}/deployments`, { method: 'POST', headers: { ...authHeaders, @@ -127,7 +176,7 @@ async function deploy(): Promise { `\rUploading ${index + 1}/${prepared.length} ${file.relative} `, ); const response = await fetch( - `${origin}/api/deployments/${created.deployment.id}/assets?path=${encodeURIComponent(file.relative)}`, + `${origin}/cli/deployments/${created.deployment.id}/assets?path=${encodeURIComponent(file.relative)}`, { method: 'PUT', headers: { @@ -142,7 +191,7 @@ async function deploy(): Promise { if (!response.ok) throw new Error(((await response.json()) as { error?: string }).error || 'Upload failed'); } - const activate = await fetch(`${origin}/api/deployments/${created.deployment.id}/activate`, { + const activate = await fetch(`${origin}/cli/deployments/${created.deployment.id}/activate`, { method: 'POST', headers: { ...authHeaders, origin, 'sec-fetch-site': 'same-origin' }, }); diff --git a/src/core-backend.ts b/src/core-backend.ts index 0172fc6..cf21aa3 100644 --- a/src/core-backend.ts +++ b/src/core-backend.ts @@ -15,9 +15,13 @@ import { import type { UpRegistry } from './registry'; import { cookieValue, + createCliAuthorization, createSession, + exchangeCliAuthorization, sessionCookie, + validCliRedirect, validReturnUrl, + verifyCliSession, verifySession, } from './session'; import type { SiteDatabase } from './site-database'; @@ -245,7 +249,9 @@ export function isCoreRequest(request: Request, env: Env): boolean { return ( Boolean(domain && host !== domain && host !== controlHost && host.endsWith(`.${domain}`)) || url.pathname.startsWith('/api/') || - url.pathname === '/app/__session' + url.pathname.startsWith('/cli/') || + url.pathname === '/app/__session' || + url.pathname === '/app/cli-auth' ); } @@ -324,6 +330,68 @@ app.get('/app/__session', async (context) => { }); }); +app.get('/app/cli-auth', async (context) => { + const configError = configurationError(context.env); + if (configError) return json({ error: configError }, 503); + if (!context.env.SESSION_SECRET) + return json({ error: 'CLI authentication is not configured' }, 503); + let identity: Identity; + try { + identity = await verifyAccessIdentity(context.req.raw, context.env); + } catch { + return json({ error: 'Authentication required' }, 403); + } + const redirect = validCliRedirect(context.req.query('redirect_uri') || null); + const state = context.req.query('state') || ''; + const challenge = context.req.query('challenge') || ''; + if (!redirect || !/^[A-Za-z0-9_-]{24,128}$/.test(state) || !/^[A-Za-z0-9_-]{43}$/.test(challenge)) + return json({ error: 'Invalid CLI authentication request' }, 400); + const code = await createCliAuthorization(identity, challenge, context.env.SESSION_SECRET); + redirect.searchParams.set('code', code); + redirect.searchParams.set('state', state); + return new Response(null, { status: 302, headers: { ...secure, location: redirect.toString() } }); +}); + +app.post('/cli/exchange', async (context) => { + if (!context.env.SESSION_SECRET) + return json({ error: 'CLI authentication is not configured' }, 503); + const input = await context.req.json<{ code?: unknown; verifier?: unknown }>().catch(() => null); + if (!input || typeof input.code !== 'string' || typeof input.verifier !== 'string') + return json({ error: 'Invalid exchange request' }, 400); + const token = await exchangeCliAuthorization( + input.code, + input.verifier, + context.env.SESSION_SECRET, + ); + return token + ? json({ token, expiresIn: 900 }) + : json({ error: 'Invalid authorization code' }, 403); +}); + +app.all('/cli/*', async (context) => { + if (!context.env.SESSION_SECRET) + return json({ error: 'CLI authentication is not configured' }, 503); + const bearer = context.req.header('authorization')?.match(/^Bearer (.+)$/)?.[1]; + const identity = await verifyCliSession(bearer, context.env.SESSION_SECRET); + if (!identity) return json({ error: 'CLI authentication required' }, 401); + const url = new URL(context.req.url); + url.pathname = `/api/${url.pathname.slice('/cli/'.length)}`; + const headers = new Headers(context.req.raw.headers); + headers.set('origin', url.origin); + headers.set('sec-fetch-site', 'same-origin'); + headers.delete('authorization'); + try { + return await controlApi( + new Request(url, { method: context.req.method, headers, body: context.req.raw.body }), + context.env, + identity, + ); + } catch (error) { + if (error instanceof RegistryError) return json({ error: error.message }, error.status); + return json({ error: 'Request failed' }, 500); + } +}); + app.get('/api/health', (context) => context.json({ edge: 'ok', accessConfigured: configurationError(context.env) === null }), ); diff --git a/src/session.ts b/src/session.ts index ea0df2c..51ecdc6 100644 --- a/src/session.ts +++ b/src/session.ts @@ -5,6 +5,8 @@ interface SessionPayload { role: Identity['role']; groups: string[]; exp: number; + kind?: 'site' | 'cli-auth' | 'cli-session'; + challenge?: string; } const encoder = new TextEncoder(); @@ -28,28 +30,36 @@ async function key(secret: string) { ['sign', 'verify'], ); } -export async function createSession( - identity: Identity, - secret: string, - lifetimeSeconds = 8 * 60 * 60, -): Promise { +async function signPayload(payload: SessionPayload, secret: string): Promise { if (secret.length < 32) throw new Error('SESSION_SECRET must be at least 32 characters'); - const payload: SessionPayload = { - email: identity.email.toLowerCase(), - role: identity.role, - groups: (identity.groups || []).map((group) => group.toLowerCase()), - exp: Math.floor(Date.now() / 1000) + lifetimeSeconds, - }; const body = base64Url(encoder.encode(JSON.stringify(payload))); const signature = new Uint8Array( await crypto.subtle.sign('HMAC', await key(secret), encoder.encode(body)), ); return `${body}.${base64Url(signature)}`; } -export async function verifySession( + +export async function createSession( + identity: Identity, + secret: string, + lifetimeSeconds = 8 * 60 * 60, +): Promise { + return signPayload( + { + email: identity.email.toLowerCase(), + role: identity.role, + groups: (identity.groups || []).map((group) => group.toLowerCase()), + exp: Math.floor(Date.now() / 1000) + lifetimeSeconds, + kind: 'site', + }, + secret, + ); +} + +async function verifyPayload( value: string | undefined, secret: string, -): Promise { +): Promise { if (!value || secret.length < 32) return null; const [body, signature, extra] = value.split('.'); if (!body || !signature || extra) return null; @@ -71,11 +81,84 @@ export async function verifySession( payload.exp <= Math.floor(Date.now() / 1000) ) return null; - return { email: payload.email, role: payload.role, groups: payload.groups }; + return payload; } catch { return null; } } + +export async function verifySession( + value: string | undefined, + secret: string, +): Promise { + const payload = await verifyPayload(value, secret); + if (!payload || (payload.kind && payload.kind !== 'site')) return null; + return { email: payload.email, role: payload.role, groups: payload.groups }; +} + +export async function createCliAuthorization( + identity: Identity, + challenge: string, + secret: string, + lifetimeSeconds = 2 * 60, +): Promise { + if (!/^[A-Za-z0-9_-]{43}$/.test(challenge)) throw new Error('Invalid PKCE challenge'); + return signPayload( + { + email: identity.email.toLowerCase(), + role: identity.role, + groups: (identity.groups || []).map((group) => group.toLowerCase()), + exp: Math.floor(Date.now() / 1000) + lifetimeSeconds, + kind: 'cli-auth', + challenge, + }, + secret, + ); +} + +export async function exchangeCliAuthorization( + authorization: string | undefined, + verifier: string, + secret: string, +): Promise { + const payload = await verifyPayload(authorization, secret); + if (!payload || payload.kind !== 'cli-auth' || !payload.challenge || verifier.length < 43) + return null; + const digest = new Uint8Array(await crypto.subtle.digest('SHA-256', encoder.encode(verifier))); + if (base64Url(digest) !== payload.challenge) return null; + return signPayload( + { + email: payload.email, + role: payload.role, + groups: payload.groups, + exp: Math.floor(Date.now() / 1000) + 15 * 60, + kind: 'cli-session', + }, + secret, + ); +} + +export async function verifyCliSession( + value: string | undefined, + secret: string, +): Promise { + const payload = await verifyPayload(value, secret); + if (!payload || payload.kind !== 'cli-session') return null; + return { email: payload.email, role: payload.role, groups: payload.groups }; +} + +export function validCliRedirect(value: string | null): URL | null { + if (!value) return null; + try { + const url = new URL(value); + return url.protocol === 'http:' && ['127.0.0.1', 'localhost'].includes(url.hostname) && url.port + ? url + : null; + } catch { + return null; + } +} + export function cookieValue(request: Request, name: string): string | undefined { const cookie = request.headers.get('cookie'); if (!cookie) return undefined; diff --git a/tests/up.test.ts b/tests/up.test.ts index 32496c6..018a37b 100644 --- a/tests/up.test.ts +++ b/tests/up.test.ts @@ -9,7 +9,16 @@ import { validateManifest, } from '../src/core'; import app, { type Env, handleAuthenticatedRequest, isCoreRequest } from '../src/core-backend'; -import { createSession, sessionCookie, validReturnUrl, verifySession } from '../src/session'; +import { + createCliAuthorization, + createSession, + exchangeCliAuthorization, + sessionCookie, + validCliRedirect, + validReturnUrl, + verifyCliSession, + verifySession, +} from '../src/session'; const owner: Identity = { email: 'owner@example.com', role: 'member' }; const bindings = env as unknown as Env; @@ -156,6 +165,24 @@ describe('Access-backed site sessions', () => { expect(await verifySession(`${token}x`, secret)).toBeNull(); expect(await verifySession(await createSession(owner, secret, -1), secret)).toBeNull(); }); + it('exchanges a short-lived PKCE authorization for a deploy-only CLI session', async () => { + const verifier = 'v'.repeat(48); + const digest = new Uint8Array( + await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier)), + ); + const challenge = btoa(String.fromCharCode(...digest)) + .replaceAll('+', '-') + .replaceAll('/', '_') + .replaceAll('=', ''); + const code = await createCliAuthorization(owner, challenge, secret); + expect(await verifyCliSession(code, secret)).toBeNull(); + expect(await exchangeCliAuthorization(code, 'wrong-verifier'.repeat(4), secret)).toBeNull(); + const token = await exchangeCliAuthorization(code, verifier, secret); + expect(await verifyCliSession(token || undefined, secret)).toEqual({ ...owner, groups: [] }); + expect(validCliRedirect('http://127.0.0.1:49152/callback')?.pathname).toBe('/callback'); + expect(validCliRedirect('https://evil.example/callback')).toBeNull(); + }); + it('scopes cookies and return URLs to sibling site hosts', async () => { const token = await createSession(owner, secret); expect(sessionCookie(token, 'up.example.com')).toContain( From 68107129c19991619b26edc020b960c5e2fd976f Mon Sep 17 00:00:00 2001 From: Jordan Coeyman Date: Fri, 19 Jun 2026 12:54:56 -0400 Subject: [PATCH 3/7] Add temporary review and capability demo --- README.md | 2 +- bun.lock | 439 ++++----------------- demo/up-0.0.1.mp4 | Bin 0 -> 103837 bytes docs/how-to/record-a-demo.md | 49 +-- package.json | 4 +- receipts/2026-06-19-quick-parity-review.md | 66 ++++ scripts/record-publish-video.ts | 131 +++--- scripts/video-login.sh | 17 - src/session.ts | 5 +- 9 files changed, 220 insertions(+), 493 deletions(-) create mode 100644 demo/up-0.0.1.mp4 create mode 100644 receipts/2026-06-19-quick-parity-review.md delete mode 100755 scripts/video-login.sh diff --git a/README.md b/README.md index 8b40697..4c1f67d 100644 --- a/README.md +++ b/README.md @@ -76,7 +76,7 @@ Browser code receives no Cloudflare credentials or resource identifiers. [`examples/lunch-vote`](examples/lunch-vote) is plain HTML, CSS, and JavaScript. Two authenticated browsers can vote, see realtime updates, upload a menu, and ask Workers AI for a summary. It has no `_worker.js`, credentials, framework, or infrastructure configuration. -Demo video: **coming in this release** +Demo video: [watch the 0.0.1 capability proof](demo/up-0.0.1.mp4) ## Install for a company diff --git a/bun.lock b/bun.lock index 8265761..c4ea5c6 100644 --- a/bun.lock +++ b/bun.lock @@ -21,10 +21,9 @@ "playwright": "^1.60.0", "svelte-check": "^4.3.4", "typescript": "^6.0.3", - "unsurf": "0.4.0", "vite": "^7.3.0", "vitest": "^4.1.2", - "wrangler": "^4.100.0", + "wrangler": "4.103.0", }, }, }, @@ -47,34 +46,26 @@ "@biomejs/cli-win32-x64": ["@biomejs/cli-win32-x64@2.5.0", "", { "os": "win32", "cpu": "x64" }, "sha512-VT/lF+GId+67j8aDfLkxdxNoVApsPSTbyAtB3jJq0IWTrY77WXfbPfpngxq0bA6JCEv/7k8C9qWjDRKRznDlyw=="], - "@cloudflare/ai": ["@cloudflare/ai@1.2.2", "", {}, "sha512-dT4gUPKWUERoTHHrbUrhJBIP8P9k6qybw5fK4bnqSAyTL9AvU98D7z6SOT/BwvmOhYA8hzBGNRbQsXyvxniGyA=="], - "@cloudflare/kv-asset-handler": ["@cloudflare/kv-asset-handler@0.5.0", "", {}, "sha512-jxQYkj8dSIzc0cD6cMMNdOc1UVjqSqu8BZdor5s8cGjW2I8BjODt/kWPVdY+u9zj3ms75Q5qaZgnxUad83+eAg=="], - "@cloudflare/puppeteer": ["@cloudflare/puppeteer@1.1.0", "", { "dependencies": { "@puppeteer/browsers": "2.2.4", "debug": "^4.3.5", "devtools-protocol": "0.0.1299070", "ws": "^8.18.0" } }, "sha512-lN10En49avRDQvz8Gpv/WiIoGvjjDiP6P+v2y9bA6rfPT5WHfnlg2O6MwjHc1POm8A9LXf1sMdgrsdW8xWapOw=="], - "@cloudflare/unenv-preset": ["@cloudflare/unenv-preset@2.16.1", "", { "peerDependencies": { "unenv": "2.0.0-rc.24", "workerd": ">1.20260305.0 <2.0.0-0" }, "optionalPeers": ["workerd"] }, "sha512-ECxObrMfyTl5bhQf/lZCXwo5G6xX9IAUo+nDMKK4SZ8m4Jvvxp52vilxyySSWh2YTZz8+HQ07qGH/2rEom1vDw=="], "@cloudflare/vitest-pool-workers": ["@cloudflare/vitest-pool-workers@0.14.9", "", { "dependencies": { "cjs-module-lexer": "^1.2.3", "esbuild": "0.27.3", "miniflare": "4.20260421.0", "wrangler": "4.84.1", "zod": "^3.25.76" }, "peerDependencies": { "@vitest/runner": "^4.1.0", "@vitest/snapshot": "^4.1.0", "vitest": "^4.1.0" } }, "sha512-XLJTOd+3A3BB6vPzD7gi1LTVKFSVge9HhGWXnLouPzySphMLbg+6xXELykFxZKyqP1AEjT2tc28AkBjM9GteFQ=="], - "@cloudflare/workerd-darwin-64": ["@cloudflare/workerd-darwin-64@1.20260611.1", "", { "os": "darwin", "cpu": "x64" }, "sha512-iJICldmi4sBGgi7IrQles8cStOGXM/Tmv95C4OODVs6VIbMsJPqThUM5h3uYVQNULuJ8I/aVvnJ3Eh/wZCKwuA=="], + "@cloudflare/workerd-darwin-64": ["@cloudflare/workerd-darwin-64@1.20260617.1", "", { "os": "darwin", "cpu": "x64" }, "sha512-jWwmgEVVWbsHNrLSNXzwjJaH90VzRxq1cWkQFUidxyeUPnMxemeNE8I9qFAfrpzGgE11e9sKDcE3ettJW08swQ=="], - "@cloudflare/workerd-darwin-arm64": ["@cloudflare/workerd-darwin-arm64@1.20260611.1", "", { "os": "darwin", "cpu": "arm64" }, "sha512-yBbVXvbZyltR3I7NJdC4C4ItkItjZSiabcA/3HzEWOUQjLVKFqRh4so6ToHr70VCYh8VGeR8EDZL23igLhXqFQ=="], + "@cloudflare/workerd-darwin-arm64": ["@cloudflare/workerd-darwin-arm64@1.20260617.1", "", { "os": "darwin", "cpu": "arm64" }, "sha512-LHH7b565g9znfCUOkwbec6FG2rmRbsgCy6aJiU9KN662mNheWl5sw/iKleiFSiljPKQQP3HkjnC/NSkdgi/aSA=="], - "@cloudflare/workerd-linux-64": ["@cloudflare/workerd-linux-64@1.20260611.1", "", { "os": "linux", "cpu": "x64" }, "sha512-PfNjpxOlaIgZFYuhD7+neEEewCN2Ud993wEEN0fmbtSOax1AK53LGqmXUDvFhnbkHxJLFAxYCSNISW8QbzaAIg=="], + "@cloudflare/workerd-linux-64": ["@cloudflare/workerd-linux-64@1.20260617.1", "", { "os": "linux", "cpu": "x64" }, "sha512-FMnaAKXe4Cfd8TQurCVd9fs2XQVBFRCsP+Id/SRdUv89MlwYu9zXfoyx6BxM+brPTIUK38SHbo8iaxiwzLi9JQ=="], - "@cloudflare/workerd-linux-arm64": ["@cloudflare/workerd-linux-arm64@1.20260611.1", "", { "os": "linux", "cpu": "arm64" }, "sha512-GEp4XbuIKjlF8pakqXcUDJfKiJosD/Q7S83J0d+r+z9XIlYGfF3ntm08e2aiF5TFTwp3fnG4yMoPUAKNhNJpvQ=="], + "@cloudflare/workerd-linux-arm64": ["@cloudflare/workerd-linux-arm64@1.20260617.1", "", { "os": "linux", "cpu": "arm64" }, "sha512-MRoifFYcqbxxIIQy7PqO5tFY/qPFSnjXzakWl0sO93l+HLyG35jRAgOi6jfqa4kBxc7gKKtH861DcewjxUfkjA=="], - "@cloudflare/workerd-windows-64": ["@cloudflare/workerd-windows-64@1.20260611.1", "", { "os": "win32", "cpu": "x64" }, "sha512-S6JkS0kEbcCKs19RGqEPhjCRbP8GBkQwqYLp2fhBJtD/KTlwqLzOJ9E6PQ7gQKgWHtxy1NBG3oXarlNFRNU/dw=="], + "@cloudflare/workerd-windows-64": ["@cloudflare/workerd-windows-64@1.20260617.1", "", { "os": "win32", "cpu": "x64" }, "sha512-rgBV9wQrv0OSKgCTTbhFUFY3sLGNANZ88aqaLvtmEn2gmbFVb1J4PDGochVUdB7NSEp4D/ghHva6/8SZmbONpw=="], "@cloudflare/workers-types": ["@cloudflare/workers-types@4.20260612.1", "", {}, "sha512-PMQI7XP/wrMhxyjseUHoHj6XFqkHaf4utWQ/hhefVY8oMK2LJ730oeQ7H/nZSVMexZe39DzsdOx7sf1PqMr7+Q=="], "@cspotcode/source-map-support": ["@cspotcode/source-map-support@0.8.1", "", { "dependencies": { "@jridgewell/trace-mapping": "0.3.9" } }, "sha512-IchNf6dN4tHoMFIn/7OE8LWZ19Y6q/67Bmf6vnGREv8RSbBVb9LPJxEcnwrcwX6ixSvaiGoomAUvu4YSxXrVgw=="], - "@effect/platform": ["@effect/platform@0.94.5", "", { "dependencies": { "find-my-way-ts": "^0.1.6", "msgpackr": "^1.11.4", "multipasta": "^0.2.7" }, "peerDependencies": { "effect": "^3.19.17" } }, "sha512-z05APUiDDPbodhTkH/RJqOLoCU11bU2IZLfcwLFrld03+ob1VeqRnELQlmueLIYm6NZifHAtjl32V+GRt34y4A=="], - - "@effect/schema": ["@effect/schema@0.75.5", "", { "dependencies": { "fast-check": "^3.21.0" }, "peerDependencies": { "effect": "^3.9.2" } }, "sha512-TQInulTVCuF+9EIbJpyLP6dvxbQJMphrnRqgexm/Ze39rSjfhJuufF7XvU3SxTgg3HnL7B/kpORTJbHhlE6thw=="], - "@emnapi/core": ["@emnapi/core@1.10.0", "", { "dependencies": { "@emnapi/wasi-threads": "1.2.1", "tslib": "^2.4.0" } }, "sha512-yq6OkJ4p82CAfPl0u9mQebQHKPJkY7WrIuk205cTYnYe+k2Z8YBh11FrbRG/H6ihirqcacOgl2BIO8oyMQLeXw=="], "@emnapi/runtime": ["@emnapi/runtime@1.11.0", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-55coeOFKHv1ywEcUXJtWU5f+Jr/W5tZDvZig8DLKSwUN1JpROQ4rk/SNOQiFWmaR/VKF4zuFyW1B8JduOSv6Pg=="], @@ -133,8 +124,6 @@ "@esbuild/win32-x64": ["@esbuild/win32-x64@0.27.3", "", { "os": "win32", "cpu": "x64" }, "sha512-4uJGhsxuptu3OcpVAzli+/gWusVGwZZHTlS63hh++ehExkVT8SgiEf7/uC/PclrPPkLhZqGgCTjd0VWLo6xMqA=="], - "@hono/node-server": ["@hono/node-server@1.19.14", "", { "peerDependencies": { "hono": "^4" } }, "sha512-GwtvgtXxnWsucXvbQXkRgqksiH2Qed37H9xHZocE5sA3N8O8O8/8FA3uclQXxXVzc9XBZuEOMK7+r02FmSpHtw=="], - "@img/colour": ["@img/colour@1.1.0", "", {}, "sha512-Td76q7j57o/tLVdgS746cYARfSyxk8iEfRxewL9h4OMzYhbW4TAcppl0mT4eyqXddh6L/jwoM75mo7ixa/pCeQ=="], "@img/sharp-darwin-arm64": ["@img/sharp-darwin-arm64@0.34.5", "", { "optionalDependencies": { "@img/sharp-libvips-darwin-arm64": "1.2.4" }, "os": "darwin", "cpu": "arm64" }, "sha512-imtQ3WMJXbMY4fxb/Ndp6HBTNVtWCUI0WdobyheGf5+ad6xX8VIDO8u2xE4qc/fr08CKG/7dDseFtn6M6g/r3w=="], @@ -195,20 +184,6 @@ "@jridgewell/trace-mapping": ["@jridgewell/trace-mapping@0.3.31", "", { "dependencies": { "@jridgewell/resolve-uri": "^3.1.0", "@jridgewell/sourcemap-codec": "^1.4.14" } }, "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw=="], - "@modelcontextprotocol/sdk": ["@modelcontextprotocol/sdk@1.29.0", "", { "dependencies": { "@hono/node-server": "^1.19.9", "ajv": "^8.17.1", "ajv-formats": "^3.0.1", "content-type": "^1.0.5", "cors": "^2.8.5", "cross-spawn": "^7.0.5", "eventsource": "^3.0.2", "eventsource-parser": "^3.0.0", "express": "^5.2.1", "express-rate-limit": "^8.2.1", "hono": "^4.11.4", "jose": "^6.1.3", "json-schema-typed": "^8.0.2", "pkce-challenge": "^5.0.0", "raw-body": "^3.0.0", "zod": "^3.25 || ^4.0", "zod-to-json-schema": "^3.25.1" }, "peerDependencies": { "@cfworker/json-schema": "^4.1.1" }, "optionalPeers": ["@cfworker/json-schema"] }, "sha512-zo37mZA9hJWpULgkRpowewez1y6ML5GsXJPY8FI0tBBCd77HEvza4jDqRKOXgHNn867PVGCyTdzqpz0izu5ZjQ=="], - - "@msgpackr-extract/msgpackr-extract-darwin-arm64": ["@msgpackr-extract/msgpackr-extract-darwin-arm64@3.0.4", "", { "os": "darwin", "cpu": "arm64" }, "sha512-LCkGo6JDfaBhgST7UpPWgNgLINpcpabaHfyz5OBx75nUYxBsaEPxjnyNjWpeb/xBup/682QnBfRBy2/LvPutZQ=="], - - "@msgpackr-extract/msgpackr-extract-darwin-x64": ["@msgpackr-extract/msgpackr-extract-darwin-x64@3.0.4", "", { "os": "darwin", "cpu": "x64" }, "sha512-zExlW9zUJKZH/tOtVMttwjKa4Xm/3KcNjnE3dPN92uCktwavMxpgCA3MoJK/DOnTWsQgo224OaST27/mPNAf+w=="], - - "@msgpackr-extract/msgpackr-extract-linux-arm": ["@msgpackr-extract/msgpackr-extract-linux-arm@3.0.4", "", { "os": "linux", "cpu": "arm" }, "sha512-Tg3yX65f5GbtXLkrYEHE5oibZG9epyYWas7FogTTEJeDEF9JlXJzKgXaNhT3UXlTOeA+AfZpYZYZ0uPj7Cfquw=="], - - "@msgpackr-extract/msgpackr-extract-linux-arm64": ["@msgpackr-extract/msgpackr-extract-linux-arm64@3.0.4", "", { "os": "linux", "cpu": "arm64" }, "sha512-dgX0P/9wGPJeHFBG+ZmhgE6bmtMt7NP5CRBGyyktpopdk/mW4POnrpQsSLtKI1dwpc+pPLuXHDh6vvskyQE/sw=="], - - "@msgpackr-extract/msgpackr-extract-linux-x64": ["@msgpackr-extract/msgpackr-extract-linux-x64@3.0.4", "", { "os": "linux", "cpu": "x64" }, "sha512-8TNXMEjJc3QEy7R/x1INhgiU+XakDAFUzBhaz7+Rbrs8NH5UQeHQxxmzsSBJGyV6I1jW79undiQm8tOI+D+8FQ=="], - - "@msgpackr-extract/msgpackr-extract-win32-x64": ["@msgpackr-extract/msgpackr-extract-win32-x64@3.0.4", "", { "os": "win32", "cpu": "x64" }, "sha512-CmCXPQrkbwExx3j946/PtHWHbYJiCRBRDl4BlkRQcJB/YOwQxJRTpoo7aTsortjgoJ1x7opzTSxn7C+ASSLVjQ=="], - "@napi-rs/wasm-runtime": ["@napi-rs/wasm-runtime@1.1.5", "", { "dependencies": { "@tybys/wasm-util": "^0.10.2" }, "peerDependencies": { "@emnapi/core": "^1.7.1", "@emnapi/runtime": "^1.7.1" } }, "sha512-AWPoBRJ9tsnVhor4sjO7rkni+7p+2IAEFj6cx06UgP10jkQHqay/36uRV/bFkgrh18D9vb4cr8Q0Pthskgzy+Q=="], "@oxc-project/types": ["@oxc-project/types@0.133.0", "", {}, "sha512-KzkdCd6Uxqnf6l3HOw1xfatAlUURA0g14cvBYFyJ5SaNOQbOUvBr9PKArcPcrNIeRsBdgcUzOGrhKveVpvOIGA=="], @@ -221,8 +196,6 @@ "@poppinss/exception": ["@poppinss/exception@1.2.3", "", {}, "sha512-dCED+QRChTVatE9ibtoaxc+WkdzOSjYTKi/+uacHWIsfodVfpsueo3+DKpgU5Px8qXjgmXkSvhXvSCz3fnP9lw=="], - "@puppeteer/browsers": ["@puppeteer/browsers@2.2.4", "", { "dependencies": { "debug": "^4.3.5", "extract-zip": "^2.0.1", "progress": "^2.0.3", "proxy-agent": "^6.4.0", "semver": "^7.6.2", "tar-fs": "^3.0.6", "unbzip2-stream": "^1.4.3", "yargs": "^17.7.2" }, "bin": { "browsers": "lib/cjs/main-cli.js" } }, "sha512-BdG2qiI1dn89OTUUsx2GZSpUzW+DRffR1wlMJyKxVHYrhnKoELSDxDd+2XImUkuWPEKk76H5FcM/gPFrEK1Tfw=="], - "@rolldown/binding-android-arm64": ["@rolldown/binding-android-arm64@1.0.3", "", { "os": "android", "cpu": "arm64" }, "sha512-454rs7jHngixp/NMxd5srYD57OnzSlZ/eFTETjORQHLwJG1lRtmNOJcBerZlfu4GjKqeq8aCCIQrMdHyhI51Hw=="], "@rolldown/binding-darwin-arm64": ["@rolldown/binding-darwin-arm64@1.0.3", "", { "os": "darwin", "cpu": "arm64" }, "sha512-PcAhP+ynjURNyy8SKGl5DQP94aGuB/7JrXJb/t7P+hanXvQVMWzUvRRhBAcg/lNRadBhoUPqSoP4xw5tR/KBEA=="], @@ -323,8 +296,6 @@ "@sveltejs/vite-plugin-svelte-inspector": ["@sveltejs/vite-plugin-svelte-inspector@5.0.2", "", { "dependencies": { "obug": "^2.1.0" }, "peerDependencies": { "@sveltejs/vite-plugin-svelte": "^6.0.0-next.0", "svelte": "^5.0.0", "vite": "^6.3.0 || ^7.0.0" } }, "sha512-TZzRTcEtZffICSAoZGkPSl6Etsj2torOVrx6Uw0KpXxrec9Gg6jFWQ60Q3+LmNGfZSxHRCZL7vXVZIWmuV50Ig=="], - "@tootallnate/quickjs-emscripten": ["@tootallnate/quickjs-emscripten@0.23.0", "", {}, "sha512-C5Mc6rdnsaJDjO3UpGW/CQTHtCKaYlScZTly4JIu97Jxo/odCiH0ITnDXSJPTOrEKk/ycSZ0AOgTmkDtkOsvIA=="], - "@tybys/wasm-util": ["@tybys/wasm-util@0.10.2", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-RoBvJ2X0wuKlWFIjrwffGw1IqZHKQqzIchKaadZZfnNpsAYp2mM0h36JtPCjNDAHGgYez/15uMBpfGwchhiMgg=="], "@types/bun": ["@types/bun@1.3.14", "", { "dependencies": { "bun-types": "1.3.14" } }, "sha512-h1hFqFVcvAvD9j9K7ZW7vd82aSA+rTdznZa+5bwvCwqSB1jmmfLcbIWhOLx1/+boy/xmjgCs/OMUL8hRJSmnPw=="], @@ -341,8 +312,6 @@ "@types/trusted-types": ["@types/trusted-types@2.0.7", "", {}, "sha512-ScaPdn1dQczgbl0QFTeTOmVHFULt394XJgOQNoyVhZ6r2vLnMLJfBPd53SB52T/3G36VI1/g2MZaX0cwDuXsfw=="], - "@types/yauzl": ["@types/yauzl@2.10.3", "", { "dependencies": { "@types/node": "*" } }, "sha512-oJoftv0LSuaDZE3Le4DbKX+KS9G36NzOeSap90UIK0yMA/NhKJhqlSGtNDORNRaIbQfzjXDrQa0ytJ6mNRGz/Q=="], - "@vitest/expect": ["@vitest/expect@4.1.8", "", { "dependencies": { "@standard-schema/spec": "^1.1.0", "@types/chai": "^5.2.2", "@vitest/spy": "4.1.8", "@vitest/utils": "4.1.8", "chai": "^6.2.2", "tinyrainbow": "^3.1.0" } }, "sha512-h3nDO677RDLEGlBxyQ5CW8RlMThSKSRLUePLOx09gNIWRL40edgA1GCZSZgf1W55MFAG6/Sw14KeaAnqv0NKdQ=="], "@vitest/mocker": ["@vitest/mocker@4.1.8", "", { "dependencies": { "@vitest/spy": "4.1.8", "estree-walker": "^3.0.3", "magic-string": "^0.30.21" }, "peerDependencies": { "msw": "^2.4.9", "vite": "^6.0.0 || ^7.0.0 || ^8.0.0" }, "optionalPeers": ["msw", "vite"] }, "sha512-LEiN/xe4OSIbKe9HQIp5OC24agGD9J5CnmMgsLohVVoOPWL9a2sBoR6VBx43jQZb7Kr1l4RCuyCJzcAa0+dojw=="], @@ -357,238 +326,60 @@ "@vitest/utils": ["@vitest/utils@4.1.8", "", { "dependencies": { "@vitest/pretty-format": "4.1.8", "convert-source-map": "^2.0.0", "tinyrainbow": "^3.1.0" } }, "sha512-uOJamYALNhfJ6iolExyQM40yIQwDqYnkKtQ5VCiSe17E33H0aQ/u+1GlRuz4LZBk6Mm3sg90G9hEbmEt37C1Zg=="], - "accepts": ["accepts@2.0.0", "", { "dependencies": { "mime-types": "^3.0.0", "negotiator": "^1.0.0" } }, "sha512-5cvg6CtKwfgdmVqY1WIiXKc3Q1bkRqGLi+2W/6ao+6Y7gu/RCwRuAhGEzh5B4KlszSuTLgZYuqFqo5bImjNKng=="], - "acorn": ["acorn@8.17.0", "", { "bin": { "acorn": "bin/acorn" } }, "sha512-xRQbDb9BnwDafYNn6Vwl839DYVjqXYb1XVGtWAZ1kcDc6iwAL4hg3B1dZlRiuENFeO2H53gFG3in621AdERVAg=="], - "agent-base": ["agent-base@7.1.4", "", {}, "sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ=="], - - "ajv": ["ajv@8.20.0", "", { "dependencies": { "fast-deep-equal": "^3.1.3", "fast-uri": "^3.0.1", "json-schema-traverse": "^1.0.0", "require-from-string": "^2.0.2" } }, "sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA=="], - - "ajv-formats": ["ajv-formats@3.0.1", "", { "dependencies": { "ajv": "^8.0.0" } }, "sha512-8iUql50EUR+uUcdRQ3HDqa6EVyo3docL8g5WJ3FNcWmu62IbkGUue/pEyLBW8VGKKucTPgqeks4fIU1DA4yowQ=="], - - "ansi-regex": ["ansi-regex@5.0.1", "", {}, "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ=="], - - "ansi-styles": ["ansi-styles@4.3.0", "", { "dependencies": { "color-convert": "^2.0.1" } }, "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg=="], - "aria-query": ["aria-query@5.3.1", "", {}, "sha512-Z/ZeOgVl7bcSYZ/u/rh0fOpvEpq//LZmdbkXyc7syVzjPAhfOa9ebsdTSjEBDU4vs5nC98Kfduj1uFo0qyET3g=="], "assertion-error": ["assertion-error@2.0.1", "", {}, "sha512-Izi8RQcffqCeNVgFigKli1ssklIbpHnCYc6AknXGYoB6grJqyeby7jv12JUQgmTAnIDnbck1uxksT4dzN3PWBA=="], - "ast-types": ["ast-types@0.13.4", "", { "dependencies": { "tslib": "^2.0.1" } }, "sha512-x1FCFnFifvYDDzTaLII71vG5uvDwgtmDTEVWAxrgeiR8VjMONcCXJx7E+USjDtHlwFmt9MysbqgF9b9Vjr6w+w=="], - "axobject-query": ["axobject-query@4.1.0", "", {}, "sha512-qIj0G9wZbMGNLjLmg1PT6v2mE9AH2zlnADJD/2tC6E00hgmhUOfEB6greHPAfLRSufHqROIUTkw6E+M3lH0PTQ=="], - "b4a": ["b4a@1.8.1", "", { "peerDependencies": { "react-native-b4a": "*" }, "optionalPeers": ["react-native-b4a"] }, "sha512-aiqre1Nr0B/6DgE2N5vwTc+2/oQZ4Wh1t4NznYY4E00y8LCt6NqdRv81so00oo27D8MVKTpUa/MwUUtBLXCoDw=="], - - "bare-events": ["bare-events@2.9.1", "", { "peerDependencies": { "bare-abort-controller": "*" }, "optionalPeers": ["bare-abort-controller"] }, "sha512-Z0oHEHAFDZkffN8Qc39zNZjQlMDkPJRyyyZieU1VH7u8c5S+qHZ2S8ixdKIAxEjfHO7FJxXmJWgteOghVanIsg=="], - - "bare-fs": ["bare-fs@4.7.2", "", { "dependencies": { "bare-events": "^2.5.4", "bare-path": "^3.0.0", "bare-stream": "^2.6.4", "bare-url": "^2.2.2", "fast-fifo": "^1.3.2" }, "peerDependencies": { "bare-buffer": "*" }, "optionalPeers": ["bare-buffer"] }, "sha512-aTvMFUWkBmjzKtEQMDGGDNF8bkfpD5N1b/FCwt7A3wrU4t1o/e/85Wzkluh6JlODCjqVESYCkQCdTXqZ9G7VFg=="], - - "bare-os": ["bare-os@3.9.1", "", {}, "sha512-6M5XjcnsygQNPMCMPXSK379xrJFiZ/AEMNBmFEmQW8d/789VQATvriyi5r0HYTL9TkQ26rn3kgdTG3aisbrXkQ=="], - - "bare-path": ["bare-path@3.0.1", "", { "dependencies": { "bare-os": "^3.0.1" } }, "sha512-ghj2DSK/2e99a1anTVPCV4m4YIYtrbXhfM7V3D7XZLOTsybnYyaJloymGqssQc8l/or0UoDyRtNQkmkEF/ysgQ=="], - - "bare-stream": ["bare-stream@2.13.3", "", { "dependencies": { "b4a": "^1.8.1", "streamx": "^2.25.0", "teex": "^1.0.1" }, "peerDependencies": { "bare-abort-controller": "*", "bare-buffer": "*", "bare-events": "*" }, "optionalPeers": ["bare-abort-controller", "bare-buffer", "bare-events"] }, "sha512-Kc+brLqvEqGkjyfiwJmImAOqLZL7OsoLKuavx+hJjgVV3nLTOjloJyPMFxjUPerGGHrNH0fLU06jjykMLWrERQ=="], - - "bare-url": ["bare-url@2.4.5", "", { "dependencies": { "bare-path": "^3.0.0" } }, "sha512-K+y9xF1tN+CdPu4qWwr0QiK1Al07eFPGYK5M2pDXcmHdMdgC/tT/bpmMe1hrmRHaidKLkXrC+cRNYf3XVDUhSQ=="], - - "base64-js": ["base64-js@1.5.1", "", {}, "sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA=="], - - "basic-ftp": ["basic-ftp@5.3.1", "", {}, "sha512-bopVNp6ugyA150DDuZfPFdt1KZ5a94ZDiwX4hMgZDzF+GttD80lEy8kj98kbyhLXnPvhtIo93mdnLIjpCAeeOw=="], - "blake3-wasm": ["blake3-wasm@2.1.5", "", {}, "sha512-F1+K8EbfOZE49dtoPtmxUQrpXaBIl3ICvasLh+nJta0xkz+9kF/7uet9fLnwKqhDrmj6g+6K3Tw9yQPUg2ka5g=="], - "body-parser": ["body-parser@2.2.2", "", { "dependencies": { "bytes": "^3.1.2", "content-type": "^1.0.5", "debug": "^4.4.3", "http-errors": "^2.0.0", "iconv-lite": "^0.7.0", "on-finished": "^2.4.1", "qs": "^6.14.1", "raw-body": "^3.0.1", "type-is": "^2.0.1" } }, "sha512-oP5VkATKlNwcgvxi0vM0p/D3n2C3EReYVX+DNYs5TjZFn/oQt2j+4sVJtSMr18pdRr8wjTcBl6LoV+FUwzPmNA=="], - - "buffer": ["buffer@5.7.1", "", { "dependencies": { "base64-js": "^1.3.1", "ieee754": "^1.1.13" } }, "sha512-EHcyIPBQ4BSGlvjB16k5KgAJ27CIsHY/2JBmCRReo48y9rQ3MaUzWX3KVlBa4U7MyX02HdVj0K7C3WaB3ju7FQ=="], - - "buffer-crc32": ["buffer-crc32@0.2.13", "", {}, "sha512-VO9Ht/+p3SN7SKWqcrgEzjGbRSJYTx+Q1pTQC0wrWqHx0vpJraQ6GtHx8tvcg1rlK1byhU5gccxgOgj7B0TDkQ=="], - "bun-types": ["bun-types@1.3.14", "", { "dependencies": { "@types/node": "*" } }, "sha512-4N0ig0fEomHt5R0KCFWjovxow98rIoRwKolrYdCcknNwMekCXRnWEUvgu5soYV8QXtVsrUD8B95MBOZGPvr6KQ=="], - "bytes": ["bytes@3.1.2", "", {}, "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg=="], - - "call-bind-apply-helpers": ["call-bind-apply-helpers@1.0.2", "", { "dependencies": { "es-errors": "^1.3.0", "function-bind": "^1.1.2" } }, "sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ=="], - - "call-bound": ["call-bound@1.0.4", "", { "dependencies": { "call-bind-apply-helpers": "^1.0.2", "get-intrinsic": "^1.3.0" } }, "sha512-+ys997U96po4Kx/ABpBCqhA9EuxJaQWDQg7295H4hBphv3IZg0boBKuwYpt4YXp6MZ5AmZQnU/tyMTlRpaSejg=="], - "chai": ["chai@6.2.2", "", {}, "sha512-NUPRluOfOiTKBKvWPtSD4PhFvWCqOi0BGStNWs57X9js7XGTprSmFoz5F0tWhR4WPjNeR9jXqdC7/UpSJTnlRg=="], "chokidar": ["chokidar@4.0.3", "", { "dependencies": { "readdirp": "^4.0.1" } }, "sha512-Qgzu8kfBvo+cA4962jnP1KkS6Dop5NS6g7R5LFYJr4b8Ub94PPQXUksCw9PvXoeXPRRddRNC5C1JQUR2SMGtnA=="], "cjs-module-lexer": ["cjs-module-lexer@1.4.3", "", {}, "sha512-9z8TZaGM1pfswYeXrUpzPrkx8UnWYdhJclsiYMm6x/w5+nN+8Tf/LnAgfLGQCm59qAOxU8WwHEq2vNwF6i4j+Q=="], - "cliui": ["cliui@8.0.1", "", { "dependencies": { "string-width": "^4.2.0", "strip-ansi": "^6.0.1", "wrap-ansi": "^7.0.0" } }, "sha512-BSeNnyus75C4//NQ9gQt1/csTXyo/8Sb+afLAkzAptFuMsod9HFokGNudZpi/oQV73hnVK+sR+5PVRMd+Dr7YQ=="], - "clsx": ["clsx@2.1.1", "", {}, "sha512-eYm0QWBtUrBWZWG0d386OGAw16Z995PiOVo2B7bjWSbHedGl5e0ZWaq65kOGgUSNesEIDkB9ISbTg/JK9dhCZA=="], - "color-convert": ["color-convert@2.0.1", "", { "dependencies": { "color-name": "~1.1.4" } }, "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ=="], - - "color-name": ["color-name@1.1.4", "", {}, "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA=="], - - "content-disposition": ["content-disposition@1.1.0", "", {}, "sha512-5jRCH9Z/+DRP7rkvY83B+yGIGX96OYdJmzngqnw2SBSxqCFPd0w2km3s5iawpGX8krnwSGmF0FW5Nhr0Hfai3g=="], - - "content-type": ["content-type@1.0.5", "", {}, "sha512-nTjqfcBFEipKdXCv4YDQWCfmcLZKm81ldF0pAopTvyrFGVbcR6P/VAAd5G7N+0tTr8QqiU0tFadD6FK4NtJwOA=="], - "convert-source-map": ["convert-source-map@2.0.0", "", {}, "sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg=="], "cookie": ["cookie@0.6.0", "", {}, "sha512-U71cyTamuh1CRNCfpGY6to28lxvNwPG4Guz/EVjgf3Jmzv0vlDp1atT9eS5dDjMYHucpHbWns6Lwf3BKz6svdw=="], - "cookie-signature": ["cookie-signature@1.2.2", "", {}, "sha512-D76uU73ulSXrD1UXF4KE2TMxVVwhsnCgfAyTg9k8P6KGZjlXKrOLe4dJQKI3Bxi5wjesZoFXJWElNWBjPZMbhg=="], - - "cors": ["cors@2.8.6", "", { "dependencies": { "object-assign": "^4", "vary": "^1" } }, "sha512-tJtZBBHA6vjIAaF6EnIaq6laBBP9aq/Y3ouVJjEfoHbRBcHBAHYcMh/w8LDrk2PvIMMq8gmopa5D4V8RmbrxGw=="], - - "cross-spawn": ["cross-spawn@7.0.6", "", { "dependencies": { "path-key": "^3.1.0", "shebang-command": "^2.0.0", "which": "^2.0.1" } }, "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA=="], - - "data-uri-to-buffer": ["data-uri-to-buffer@6.0.2", "", {}, "sha512-7hvf7/GW8e86rW0ptuwS3OcBGDjIi6SZva7hCyWC0yYry2cOPmLIjXAUHI6DK2HsnwJd9ifmt57i8eV2n4YNpw=="], - - "debug": ["debug@4.4.3", "", { "dependencies": { "ms": "^2.1.3" } }, "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA=="], - "deepmerge": ["deepmerge@4.3.1", "", {}, "sha512-3sUqbMEc77XqpdNO7FRyRog+eW3ph+GYCbj+rK+uYyRMuwsVy0rMiVtPn+QJlKFvWP/1PYpapqYn0Me2knFn+A=="], - "degenerator": ["degenerator@5.0.1", "", { "dependencies": { "ast-types": "^0.13.4", "escodegen": "^2.1.0", "esprima": "^4.0.1" } }, "sha512-TllpMR/t0M5sqCXfj85i4XaAzxmS5tVA16dqvdkMwGmzI+dXLXnw3J+3Vdv7VKw+ThlTMboK6i9rnZ6Nntj5CQ=="], - - "depd": ["depd@2.0.0", "", {}, "sha512-g7nH6P6dyDioJogAAGprGpCtVImJhpPk/roCzdb3fIh61/s/nPsfR6onyMwkCAR/OlC3yBC0lESvUoQEAssIrw=="], - "detect-libc": ["detect-libc@2.1.2", "", {}, "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ=="], "devalue": ["devalue@5.8.1", "", {}, "sha512-4CXDYRBGqN+57wVJkuXBYmpAVUSg3L6JAQa/DFqm238G73E1wuyc/JhGQJzN7vUf/CMphYau2zXbfWzDR5aTEw=="], - "devtools-protocol": ["devtools-protocol@0.0.1299070", "", {}, "sha512-+qtL3eX50qsJ7c+qVyagqi7AWMoQCBGNfoyJZMwm/NSXVqLYbuitrWEEIzxfUmTNy7//Xe8yhMmQ+elj3uAqSg=="], - - "drizzle-orm": ["drizzle-orm@0.45.2", "", { "peerDependencies": { "@aws-sdk/client-rds-data": ">=3", "@cloudflare/workers-types": ">=4", "@electric-sql/pglite": ">=0.2.0", "@libsql/client": ">=0.10.0", "@libsql/client-wasm": ">=0.10.0", "@neondatabase/serverless": ">=0.10.0", "@op-engineering/op-sqlite": ">=2", "@opentelemetry/api": "^1.4.1", "@planetscale/database": ">=1.13", "@prisma/client": "*", "@tidbcloud/serverless": "*", "@types/better-sqlite3": "*", "@types/pg": "*", "@types/sql.js": "*", "@upstash/redis": ">=1.34.7", "@vercel/postgres": ">=0.8.0", "@xata.io/client": "*", "better-sqlite3": ">=7", "bun-types": "*", "expo-sqlite": ">=14.0.0", "gel": ">=2", "knex": "*", "kysely": "*", "mysql2": ">=2", "pg": ">=8", "postgres": ">=3", "sql.js": ">=1", "sqlite3": ">=5" }, "optionalPeers": ["@aws-sdk/client-rds-data", "@cloudflare/workers-types", "@electric-sql/pglite", "@libsql/client", "@libsql/client-wasm", "@neondatabase/serverless", "@op-engineering/op-sqlite", "@opentelemetry/api", "@planetscale/database", "@prisma/client", "@tidbcloud/serverless", "@types/better-sqlite3", "@types/pg", "@types/sql.js", "@upstash/redis", "@vercel/postgres", "@xata.io/client", "better-sqlite3", "bun-types", "expo-sqlite", "gel", "knex", "kysely", "mysql2", "pg", "postgres", "sql.js", "sqlite3"] }, "sha512-kY0BSaTNYWnoDMVoyY8uxmyHjpJW1geOmBMdSSicKo9CIIWkSxMIj2rkeSR51b8KAPB7m+qysjuHme5nKP+E5Q=="], - - "dunder-proto": ["dunder-proto@1.0.1", "", { "dependencies": { "call-bind-apply-helpers": "^1.0.1", "es-errors": "^1.3.0", "gopd": "^1.2.0" } }, "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A=="], - - "ee-first": ["ee-first@1.1.1", "", {}, "sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow=="], - - "effect": ["effect@3.21.3", "", { "dependencies": { "@standard-schema/spec": "^1.0.0", "fast-check": "^3.23.1" } }, "sha512-RqwU7WnJ6CqYhyjpOVJA5vh1Sgkn6eVECO6mnD0EjlbWcC2M3LJaPglXXr13Rdo/Y+B+wTEPzGRYFNL2xKxNeQ=="], - - "emoji-regex": ["emoji-regex@8.0.0", "", {}, "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A=="], - - "encodeurl": ["encodeurl@2.0.0", "", {}, "sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg=="], - - "end-of-stream": ["end-of-stream@1.4.5", "", { "dependencies": { "once": "^1.4.0" } }, "sha512-ooEGc6HP26xXq/N+GCGOT0JKCLDGrq2bQUZrQ7gyrJiZANJ/8YDTxTpQBXGMn+WbIQXNVpyWymm7KYVICQnyOg=="], - "error-stack-parser-es": ["error-stack-parser-es@1.0.5", "", {}, "sha512-5qucVt2XcuGMcEGgWI7i+yZpmpByQ8J1lHhcL7PwqCwu9FPP3VUXzT4ltHe5i2z9dePwEHcDVOAfSnHsOlCXRA=="], - "es-define-property": ["es-define-property@1.0.1", "", {}, "sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g=="], - - "es-errors": ["es-errors@1.3.0", "", {}, "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw=="], - "es-module-lexer": ["es-module-lexer@2.1.0", "", {}, "sha512-n27zTYMjYu1aj4MjCWzSP7G9r75utsaoc8m61weK+W8JMBGGQybd43GstCXZ3WNmSFtGT9wi59qQTW6mhTR5LQ=="], - "es-object-atoms": ["es-object-atoms@1.1.2", "", { "dependencies": { "es-errors": "^1.3.0" } }, "sha512-HWcBoN6NileqtSydK2FqHbS/LoDd2pqrnQHLyJzBj4kOp/ky2MWMN694xOfkK8/SnUsW2DH7EfyVlydKCsm1Zw=="], - "esbuild": ["esbuild@0.27.3", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.27.3", "@esbuild/android-arm": "0.27.3", "@esbuild/android-arm64": "0.27.3", "@esbuild/android-x64": "0.27.3", "@esbuild/darwin-arm64": "0.27.3", "@esbuild/darwin-x64": "0.27.3", "@esbuild/freebsd-arm64": "0.27.3", "@esbuild/freebsd-x64": "0.27.3", "@esbuild/linux-arm": "0.27.3", "@esbuild/linux-arm64": "0.27.3", "@esbuild/linux-ia32": "0.27.3", "@esbuild/linux-loong64": "0.27.3", "@esbuild/linux-mips64el": "0.27.3", "@esbuild/linux-ppc64": "0.27.3", "@esbuild/linux-riscv64": "0.27.3", "@esbuild/linux-s390x": "0.27.3", "@esbuild/linux-x64": "0.27.3", "@esbuild/netbsd-arm64": "0.27.3", "@esbuild/netbsd-x64": "0.27.3", "@esbuild/openbsd-arm64": "0.27.3", "@esbuild/openbsd-x64": "0.27.3", "@esbuild/openharmony-arm64": "0.27.3", "@esbuild/sunos-x64": "0.27.3", "@esbuild/win32-arm64": "0.27.3", "@esbuild/win32-ia32": "0.27.3", "@esbuild/win32-x64": "0.27.3" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-8VwMnyGCONIs6cWue2IdpHxHnAjzxnw2Zr7MkVxB2vjmQ2ivqGFb4LEG3SMnv0Gb2F/G/2yA8zUaiL1gywDCCg=="], - "escalade": ["escalade@3.2.0", "", {}, "sha512-WUj2qlxaQtO4g6Pq5c29GTcWGDyd8itL8zTlipgECz3JesAiiOKotd8JU6otB3PACgG6xkJUyVhboMS+bje/jA=="], - - "escape-html": ["escape-html@1.0.3", "", {}, "sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow=="], - - "escodegen": ["escodegen@2.1.0", "", { "dependencies": { "esprima": "^4.0.1", "estraverse": "^5.2.0", "esutils": "^2.0.2" }, "optionalDependencies": { "source-map": "~0.6.1" }, "bin": { "esgenerate": "bin/esgenerate.js", "escodegen": "bin/escodegen.js" } }, "sha512-2NlIDTwUWJN0mRPQOdtQBzbUHvdGY2P1VXSyU83Q3xKxM7WHX2Ql8dKq782Q9TgQUNOLEzEYu9bzLNj1q88I5w=="], - "esm-env": ["esm-env@1.2.2", "", {}, "sha512-Epxrv+Nr/CaL4ZcFGPJIYLWFom+YeV1DqMLHJoEd9SYRxNbaFruBwfEX/kkHUJf55j2+TUbmDcmuilbP1TmXHA=="], - "esprima": ["esprima@4.0.1", "", { "bin": { "esparse": "./bin/esparse.js", "esvalidate": "./bin/esvalidate.js" } }, "sha512-eGuFFw7Upda+g4p+QHvnW0RyTX/SVeJBDM/gCtMARO0cLuT2HcEKnTPvhjV6aGeqrCB/sbNop0Kszm0jsaWU4A=="], - "esrap": ["esrap@2.2.11", "", { "dependencies": { "@jridgewell/sourcemap-codec": "^1.4.15" }, "peerDependencies": { "@typescript-eslint/types": "^8.2.0" }, "optionalPeers": ["@typescript-eslint/types"] }, "sha512-gPdx+I+BjYEinNMQaBXFjbaJVyoPMU4ZODg5mE+M4DqVG9VusAVHHjcBX+zqyITlI0DIARwDMMzZwAWj36dRoQ=="], - "estraverse": ["estraverse@5.3.0", "", {}, "sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA=="], - "estree-walker": ["estree-walker@3.0.3", "", { "dependencies": { "@types/estree": "^1.0.0" } }, "sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g=="], - "esutils": ["esutils@2.0.3", "", {}, "sha512-kVscqXk4OCp68SZ0dkgEKVi6/8ij300KBWTJq32P/dYeWTSwK41WyTxalN1eRmA5Z9UU/LX9D7FWSmV9SAYx6g=="], - - "etag": ["etag@1.8.1", "", {}, "sha512-aIL5Fx7mawVa300al2BnEE4iNvo1qETxLrPI/o05L7z6go7fCw1J6EQmbK4FmJ2AS7kgVF/KEZWufBfdClMcPg=="], - - "events-universal": ["events-universal@1.0.1", "", { "dependencies": { "bare-events": "^2.7.0" } }, "sha512-LUd5euvbMLpwOF8m6ivPCbhQeSiYVNb8Vs0fQ8QjXo0JTkEHpz8pxdQf0gStltaPpw0Cca8b39KxvK9cfKRiAw=="], - - "eventsource": ["eventsource@3.0.7", "", { "dependencies": { "eventsource-parser": "^3.0.1" } }, "sha512-CRT1WTyuQoD771GW56XEZFQ/ZoSfWid1alKGDYMmkt2yl8UXrVR4pspqWNEcqKvVIzg6PAltWjxcSSPrboA4iA=="], - - "eventsource-parser": ["eventsource-parser@3.1.0", "", {}, "sha512-kJezFj9YFAMLeORyi7aCLxLbD5/qWMQnoMVlVPyHIll7lgRJCc3JVln9Vgl9nwQi0YkMnhdGTMNn7CkRRAptMg=="], - "expect-type": ["expect-type@1.3.0", "", {}, "sha512-knvyeauYhqjOYvQ66MznSMs83wmHrCycNEN6Ao+2AeYEfxUIkuiVxdEa1qlGEPK+We3n0THiDciYSsCcgW/DoA=="], - "express": ["express@5.2.1", "", { "dependencies": { "accepts": "^2.0.0", "body-parser": "^2.2.1", "content-disposition": "^1.0.0", "content-type": "^1.0.5", "cookie": "^0.7.1", "cookie-signature": "^1.2.1", "debug": "^4.4.0", "depd": "^2.0.0", "encodeurl": "^2.0.0", "escape-html": "^1.0.3", "etag": "^1.8.1", "finalhandler": "^2.1.0", "fresh": "^2.0.0", "http-errors": "^2.0.0", "merge-descriptors": "^2.0.0", "mime-types": "^3.0.0", "on-finished": "^2.4.1", "once": "^1.4.0", "parseurl": "^1.3.3", "proxy-addr": "^2.0.7", "qs": "^6.14.0", "range-parser": "^1.2.1", "router": "^2.2.0", "send": "^1.1.0", "serve-static": "^2.2.0", "statuses": "^2.0.1", "type-is": "^2.0.1", "vary": "^1.1.2" } }, "sha512-hIS4idWWai69NezIdRt2xFVofaF4j+6INOpJlVOLDO8zXGpUVEVzIYk12UUi2JzjEzWL3IOAxcTubgz9Po0yXw=="], - - "express-rate-limit": ["express-rate-limit@8.5.2", "", { "dependencies": { "ip-address": "^10.2.0" }, "peerDependencies": { "express": ">= 4.11" } }, "sha512-5Kb34ipNX694DH48vN9irak1Qx30nb0PLYHXfJgw4YEjiC3ZEmZJhwOp+VfiCYwFzvFTdB9QkArYS5kXa2cx2A=="], - - "extract-zip": ["extract-zip@2.0.1", "", { "dependencies": { "debug": "^4.1.1", "get-stream": "^5.1.0", "yauzl": "^2.10.0" }, "optionalDependencies": { "@types/yauzl": "^2.9.1" }, "bin": { "extract-zip": "cli.js" } }, "sha512-GDhU9ntwuKyGXdZBUgTIe+vXnWj0fppUEtMDL0+idd5Sta8TGpHssn/eusA9mrPr9qNDym6SxAYZjNvCn/9RBg=="], - - "fast-check": ["fast-check@3.23.2", "", { "dependencies": { "pure-rand": "^6.1.0" } }, "sha512-h5+1OzzfCC3Ef7VbtKdcv7zsstUQwUDlYpUTvjeUsJAssPgLn7QzbboPtL5ro04Mq0rPOsMzl7q5hIbRs2wD1A=="], - - "fast-deep-equal": ["fast-deep-equal@3.1.3", "", {}, "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q=="], - - "fast-fifo": ["fast-fifo@1.3.2", "", {}, "sha512-/d9sfos4yxzpwkDkuN7k2SqFKtYNmCTzgfEpz82x34IM9/zc8KGxQoXg1liNC/izpRM/MBdt44Nmx41ZWqk+FQ=="], - - "fast-uri": ["fast-uri@3.1.2", "", {}, "sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ=="], - - "fd-slicer": ["fd-slicer@1.1.0", "", { "dependencies": { "pend": "~1.2.0" } }, "sha512-cE1qsB/VwyQozZ+q1dGxR8LBYNZeofhEdUNGSMbQD3Gw2lAzX9Zb3uIU6Ebc/Fmyjo9AWWfnn0AUCHqtevs/8g=="], - "fdir": ["fdir@6.5.0", "", { "peerDependencies": { "picomatch": "^3 || ^4" }, "optionalPeers": ["picomatch"] }, "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg=="], - "finalhandler": ["finalhandler@2.1.1", "", { "dependencies": { "debug": "^4.4.0", "encodeurl": "^2.0.0", "escape-html": "^1.0.3", "on-finished": "^2.4.1", "parseurl": "^1.3.3", "statuses": "^2.0.1" } }, "sha512-S8KoZgRZN+a5rNwqTxlZZePjT/4cnm0ROV70LedRHZ0p8u9fRID0hJUZQpkKLzro8LfmC8sx23bY6tVNxv8pQA=="], - - "find-my-way-ts": ["find-my-way-ts@0.1.6", "", {}, "sha512-a85L9ZoXtNAey3Y6Z+eBWW658kO/MwR7zIafkIUPUMf3isZG0NCs2pjW2wtjxAKuJPxMAsHUIP4ZPGv0o5gyTA=="], - - "forwarded": ["forwarded@0.2.0", "", {}, "sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow=="], - - "fresh": ["fresh@2.0.0", "", {}, "sha512-Rx/WycZ60HOaqLKAi6cHRKKI7zxWbJ31MhntmtwMoaTeF7XFH9hhBp8vITaMidfljRQ6eYWCKkaTK+ykVJHP2A=="], - "fsevents": ["fsevents@2.3.2", "", { "os": "darwin" }, "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA=="], - "function-bind": ["function-bind@1.1.2", "", {}, "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA=="], - - "get-caller-file": ["get-caller-file@2.0.5", "", {}, "sha512-DyFP3BM/3YHTQOCUL/w0OZHR0lpKeGrxotcHWcqNEdnltqFwXVfhEBQ94eIo34AfQpo0rGki4cyIiftY06h2Fg=="], - - "get-intrinsic": ["get-intrinsic@1.3.0", "", { "dependencies": { "call-bind-apply-helpers": "^1.0.2", "es-define-property": "^1.0.1", "es-errors": "^1.3.0", "es-object-atoms": "^1.1.1", "function-bind": "^1.1.2", "get-proto": "^1.0.1", "gopd": "^1.2.0", "has-symbols": "^1.1.0", "hasown": "^2.0.2", "math-intrinsics": "^1.1.0" } }, "sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ=="], - - "get-proto": ["get-proto@1.0.1", "", { "dependencies": { "dunder-proto": "^1.0.1", "es-object-atoms": "^1.0.0" } }, "sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g=="], - - "get-stream": ["get-stream@5.2.0", "", { "dependencies": { "pump": "^3.0.0" } }, "sha512-nBF+F1rAZVCu/p7rjzgA+Yb4lfYXrpl7a6VmJrU8wF9I1CKvP/QwPNZHnOlwbTkY6dvtFIzFMSyQXbLoTQPRpA=="], - - "get-uri": ["get-uri@6.0.5", "", { "dependencies": { "basic-ftp": "^5.0.2", "data-uri-to-buffer": "^6.0.2", "debug": "^4.3.4" } }, "sha512-b1O07XYq8eRuVzBNgJLstU6FYc1tS6wnMtF1I1D9lE8LxZSOGZ7LhxN54yPP6mGw5f2CkXY2BQUL9Fx41qvcIg=="], - - "gopd": ["gopd@1.2.0", "", {}, "sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg=="], - - "has-symbols": ["has-symbols@1.1.0", "", {}, "sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ=="], - - "hasown": ["hasown@2.0.4", "", { "dependencies": { "function-bind": "^1.1.2" } }, "sha512-T2UbfbBEF32wiepXIsMlTW9+dDYC6wMh/t/vYA4tuOMKqWz/n3vr1NFSxQiyP+zk2mXsoMA/i/7qV6LKut1t1A=="], - "hono": ["hono@4.12.25", "", {}, "sha512-2NFaIyNVgJmBs/ecmtGzlmluTFs5cHEWGTdu0t1HBwYzoGXOL5nUQBRMXsXWla5i4KkG//QMzVP88m1+I3fdAQ=="], - "http-errors": ["http-errors@2.0.1", "", { "dependencies": { "depd": "~2.0.0", "inherits": "~2.0.4", "setprototypeof": "~1.2.0", "statuses": "~2.0.2", "toidentifier": "~1.0.1" } }, "sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ=="], - - "http-proxy-agent": ["http-proxy-agent@7.0.2", "", { "dependencies": { "agent-base": "^7.1.0", "debug": "^4.3.4" } }, "sha512-T1gkAiYYDWYx3V5Bmyu7HcfcvL7mUrTWiM6yOfa3PIphViJ/gFPbvidQ+veqSOHci/PxBcDabeUNCzpOODJZig=="], - - "https-proxy-agent": ["https-proxy-agent@7.0.6", "", { "dependencies": { "agent-base": "^7.1.2", "debug": "4" } }, "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw=="], - - "iconv-lite": ["iconv-lite@0.7.2", "", { "dependencies": { "safer-buffer": ">= 2.1.2 < 3.0.0" } }, "sha512-im9DjEDQ55s9fL4EYzOAv0yMqmMBSZp6G0VvFyTMPKWxiSBHUj9NW/qqLmXUwXrrM7AvqSlTCfvqRb0cM8yYqw=="], - - "ieee754": ["ieee754@1.2.1", "", {}, "sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA=="], - - "inherits": ["inherits@2.0.4", "", {}, "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ=="], - - "ip-address": ["ip-address@10.2.0", "", {}, "sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA=="], - - "ipaddr.js": ["ipaddr.js@1.9.1", "", {}, "sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g=="], - - "is-fullwidth-code-point": ["is-fullwidth-code-point@3.0.0", "", {}, "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg=="], - - "is-promise": ["is-promise@4.0.0", "", {}, "sha512-hvpoI6korhJMnej285dSg6nu1+e6uxs7zG3BYAm5byqDsgJNWwxzM6z6iZiAgQR4TJ30JmBTOwqZUw3WlyH3AQ=="], - "is-reference": ["is-reference@3.0.3", "", { "dependencies": { "@types/estree": "^1.0.6" } }, "sha512-ixkJoqQvAP88E6wLydLGGqCJsrFUnqoH6HnaczB8XmDH1oaWU+xxdptvikTgaEhtZ53Ky6YXiBuUI2WXLMCwjw=="], - "isexe": ["isexe@2.0.0", "", {}, "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw=="], - "jose": ["jose@6.2.3", "", {}, "sha512-YYVDInQKFJfR/xa3ojUTl8c2KoTwiL1R5Wg9YCydwH0x0B9grbzlg5HC7mMjCtUJjbQ/YnGEZIhI5tCgfTb4Hw=="], - "json-schema-traverse": ["json-schema-traverse@1.0.0", "", {}, "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug=="], - - "json-schema-typed": ["json-schema-typed@8.0.2", "", {}, "sha512-fQhoXdcvc3V28x7C7BMs4P5+kNlgUURe2jmUT1T//oBRMDrqy1QPelJimwZGo7Hg9VPV3EQV5Bnq4hbFy2vetA=="], - "kleur": ["kleur@4.1.5", "", {}, "sha512-o+NO+8WrRiQEE4/7nwRJhN1HWpVmJm511pBHUxPLtp0BUISzlBplORYSmTclCnJvQq2tKu/sgl3xVpkc7ZWuQQ=="], "lightningcss": ["lightningcss@1.32.0", "", { "dependencies": { "detect-libc": "^2.0.3" }, "optionalDependencies": { "lightningcss-android-arm64": "1.32.0", "lightningcss-darwin-arm64": "1.32.0", "lightningcss-darwin-x64": "1.32.0", "lightningcss-freebsd-x64": "1.32.0", "lightningcss-linux-arm-gnueabihf": "1.32.0", "lightningcss-linux-arm64-gnu": "1.32.0", "lightningcss-linux-arm64-musl": "1.32.0", "lightningcss-linux-x64-gnu": "1.32.0", "lightningcss-linux-x64-musl": "1.32.0", "lightningcss-win32-arm64-msvc": "1.32.0", "lightningcss-win32-x64-msvc": "1.32.0" } }, "sha512-NXYBzinNrblfraPGyrbPoD19C1h9lfI/1mzgWYvXUTe414Gz/X1FD2XBZSZM7rRTrMA8JL3OtAaGifrIKhQ5yQ=="], @@ -617,180 +408,64 @@ "locate-character": ["locate-character@3.0.0", "", {}, "sha512-SW13ws7BjaeJ6p7Q6CO2nchbYEc3X3J6WrmTTDto7yMPqVSZTUyY5Tjbid+Ab8gLnATtygYtiDIJGQRRn2ZOiA=="], - "lru-cache": ["lru-cache@7.18.3", "", {}, "sha512-jumlc0BIUrS3qJGgIkWZsyfAM7NCWiBcCDhnd+3NNM5KbBmLTgHVfWBcg6W+rLUsIpzpERPsvwUP7CckAQSOoA=="], - "magic-string": ["magic-string@0.30.21", "", { "dependencies": { "@jridgewell/sourcemap-codec": "^1.5.5" } }, "sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ=="], - "math-intrinsics": ["math-intrinsics@1.1.0", "", {}, "sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g=="], - - "media-typer": ["media-typer@1.1.0", "", {}, "sha512-aisnrDP4GNe06UcKFnV5bfMNPBUw4jsLGaWwWfnH3v02GnBuXX2MCVn5RbrWo0j3pczUilYblq7fQ7Nw2t5XKw=="], - - "merge-descriptors": ["merge-descriptors@2.0.0", "", {}, "sha512-Snk314V5ayFLhp3fkUREub6WtjBfPdCPY1Ln8/8munuLuiYhsABgBVWsozAG+MWMbVEvcdcpbi9R7ww22l9Q3g=="], - - "mime-db": ["mime-db@1.54.0", "", {}, "sha512-aU5EJuIN2WDemCcAp2vFBfp/m4EAhWJnUNSSw0ixs7/kXbd6Pg64EmwJkNdFhB8aWt1sH2CTXrLxo/iAGV3oPQ=="], - - "mime-types": ["mime-types@3.0.2", "", { "dependencies": { "mime-db": "^1.54.0" } }, "sha512-Lbgzdk0h4juoQ9fCKXW4by0UJqj+nOOrI9MJ1sSj4nI8aI2eo1qmvQEie4VD1glsS250n15LsWsYtCugiStS5A=="], - "miniflare": ["miniflare@4.20260421.0", "", { "dependencies": { "@cspotcode/source-map-support": "0.8.1", "sharp": "^0.34.5", "undici": "7.24.8", "workerd": "1.20260421.1", "ws": "8.18.0", "youch": "4.1.0-beta.10" }, "bin": { "miniflare": "bootstrap.js" } }, "sha512-7ZkNQ7brgQ2hh5ha9iQCDUjxBkLvuiG2VdDns9esRL8O8lXg+MoP6E0dO1rtp+ZY2I+vV1tPWr6td5IojkewLw=="], "mri": ["mri@1.2.0", "", {}, "sha512-tzzskb3bG8LvYGFF/mDTpq3jpI6Q9wc3LEmBaghu+DdCssd1FakN7Bc0hVNmEyGq1bq3RgfkCb3cmQLpNPOroA=="], "mrmime": ["mrmime@2.0.1", "", {}, "sha512-Y3wQdFg2Va6etvQ5I82yUhGdsKrcYox6p7FfL1LbK2J4V01F9TGlepTIhnK24t7koZibmg82KGglhA1XK5IsLQ=="], - "ms": ["ms@2.1.3", "", {}, "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA=="], - - "msgpackr": ["msgpackr@1.12.1", "", { "optionalDependencies": { "msgpackr-extract": "^3.0.2" } }, "sha512-4EUH9tQHnMmEgzW/MdAP0KIfa1T9AF+htl0ffe2n5vb2EKn9y2co8ccpgWko6S52Jy1PQZKwRnx5/KkYjtd9MQ=="], - - "msgpackr-extract": ["msgpackr-extract@3.0.4", "", { "dependencies": { "node-gyp-build-optional-packages": "5.2.2" }, "optionalDependencies": { "@msgpackr-extract/msgpackr-extract-darwin-arm64": "3.0.4", "@msgpackr-extract/msgpackr-extract-darwin-x64": "3.0.4", "@msgpackr-extract/msgpackr-extract-linux-arm": "3.0.4", "@msgpackr-extract/msgpackr-extract-linux-arm64": "3.0.4", "@msgpackr-extract/msgpackr-extract-linux-x64": "3.0.4", "@msgpackr-extract/msgpackr-extract-win32-x64": "3.0.4" }, "bin": { "download-msgpackr-prebuilds": "bin/download-prebuilds.js" } }, "sha512-4kmO/MdyUIkLIvTPr8VHLil4AtoKIoniWPIEk5+CDy0xnWC84azhSFmuJ7PxZdsYtiP5kEeQsORAVIeMgxT+Hw=="], - - "multipasta": ["multipasta@0.2.7", "", {}, "sha512-KPA58d68KgGil15oDqXjkUBEBYc00XvbPj5/X+dyzeo/lWm9Nc25pQRlf1D+gv4OpK7NM0J1odrbu9JNNGvynA=="], - "nanoid": ["nanoid@3.3.12", "", { "bin": { "nanoid": "bin/nanoid.cjs" } }, "sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ=="], - "negotiator": ["negotiator@1.0.0", "", {}, "sha512-8Ofs/AUQh8MaEcrlq5xOX0CQ9ypTF5dl78mjlMNfOK08fzpgTHQRQPBxcPlEtIw0yRpws+Zo/3r+5WRby7u3Gg=="], - - "netmask": ["netmask@2.1.1", "", {}, "sha512-eonl3sLUha+S1GzTPxychyhnUzKyeQkZ7jLjKrBagJgPla13F+uQ71HgpFefyHgqrjEbCPkDArxYsjY8/+gLKA=="], - - "node-gyp-build-optional-packages": ["node-gyp-build-optional-packages@5.2.2", "", { "dependencies": { "detect-libc": "^2.0.1" }, "bin": { "node-gyp-build-optional-packages": "bin.js", "node-gyp-build-optional-packages-optional": "optional.js", "node-gyp-build-optional-packages-test": "build-test.js" } }, "sha512-s+w+rBWnpTMwSFbaE0UXsRlg7hU4FjekKU4eyAih5T8nJuNZT1nNsskXpxmeqSK9UzkBl6UgRlnKc8hz8IEqOw=="], - - "object-assign": ["object-assign@4.1.1", "", {}, "sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg=="], - - "object-inspect": ["object-inspect@1.13.4", "", {}, "sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew=="], - "obug": ["obug@2.1.3", "", {}, "sha512-9miFgM2OFba7hB+pRgvtV84pYTBaoTHohvmIgiRt6dRIzbwEOIaNaP+dIlGs2fNFoB0SeISs0Jz5WFVRid6Xyg=="], - "on-finished": ["on-finished@2.4.1", "", { "dependencies": { "ee-first": "1.1.1" } }, "sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg=="], - - "once": ["once@1.4.0", "", { "dependencies": { "wrappy": "1" } }, "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w=="], - - "pac-proxy-agent": ["pac-proxy-agent@7.2.0", "", { "dependencies": { "@tootallnate/quickjs-emscripten": "^0.23.0", "agent-base": "^7.1.2", "debug": "^4.3.4", "get-uri": "^6.0.1", "http-proxy-agent": "^7.0.0", "https-proxy-agent": "^7.0.6", "pac-resolver": "^7.0.1", "socks-proxy-agent": "^8.0.5" } }, "sha512-TEB8ESquiLMc0lV8vcd5Ql/JAKAoyzHFXaStwjkzpOpC5Yv+pIzLfHvjTSdf3vpa2bMiUQrg9i6276yn8666aA=="], - - "pac-resolver": ["pac-resolver@7.0.1", "", { "dependencies": { "degenerator": "^5.0.0", "netmask": "^2.0.2" } }, "sha512-5NPgf87AT2STgwa2ntRMr45jTKrYBGkVU36yT0ig/n/GMAa3oPqhZfIQ2kMEimReg0+t9kZViDVZ83qfVUlckg=="], - - "parseurl": ["parseurl@1.3.3", "", {}, "sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ=="], - - "path-key": ["path-key@3.1.1", "", {}, "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q=="], - "path-to-regexp": ["path-to-regexp@6.3.0", "", {}, "sha512-Yhpw4T9C6hPpgPeA28us07OJeqZ5EzQTkbfwuhsUg0c237RomFoETJgmp2sa3F/41gfLE6G5cqcYwznmeEeOlQ=="], "pathe": ["pathe@2.0.3", "", {}, "sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w=="], - "pend": ["pend@1.2.0", "", {}, "sha512-F3asv42UuXchdzt+xXqfW1OGlVBe+mxa2mqI0pg5yAHZPvFmY3Y6drSf/GQ1A86WgWEN9Kzh/WrgKa6iGcHXLg=="], - "picocolors": ["picocolors@1.1.1", "", {}, "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA=="], "picomatch": ["picomatch@4.0.4", "", {}, "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A=="], - "pkce-challenge": ["pkce-challenge@5.0.1", "", {}, "sha512-wQ0b/W4Fr01qtpHlqSqspcj3EhBvimsdh0KlHhH8HRZnMsEa0ea2fTULOXOS9ccQr3om+GcGRk4e+isrZWV8qQ=="], - "playwright": ["playwright@1.60.0", "", { "dependencies": { "playwright-core": "1.60.0" }, "optionalDependencies": { "fsevents": "2.3.2" }, "bin": { "playwright": "cli.js" } }, "sha512-hheHdokM8cdqCb0lcE3s+zT4t4W+vvjpGxsZlDnikarzx8tSzMebh3UiFtgqwFwnTnjYQcsyMF8ei2mCO/tpeA=="], "playwright-core": ["playwright-core@1.60.0", "", { "bin": { "playwright-core": "cli.js" } }, "sha512-9bW6zvX/m0lEbgTKJ6YppOKx8H3VOPBMOCFh2irXFOT4BbHgrx5hPjwJYLT40Lu+4qtD36qKc/Hn56StUW57IA=="], "postcss": ["postcss@8.5.15", "", { "dependencies": { "nanoid": "^3.3.12", "picocolors": "^1.1.1", "source-map-js": "^1.2.1" } }, "sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A=="], - "progress": ["progress@2.0.3", "", {}, "sha512-7PiHtLll5LdnKIMw100I+8xJXR5gW2QwWYkT6iJva0bXitZKa/XMrSbdmg3r2Xnaidz9Qumd0VPaMrZlF9V9sA=="], - - "proxy-addr": ["proxy-addr@2.0.7", "", { "dependencies": { "forwarded": "0.2.0", "ipaddr.js": "1.9.1" } }, "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg=="], - - "proxy-agent": ["proxy-agent@6.5.0", "", { "dependencies": { "agent-base": "^7.1.2", "debug": "^4.3.4", "http-proxy-agent": "^7.0.1", "https-proxy-agent": "^7.0.6", "lru-cache": "^7.14.1", "pac-proxy-agent": "^7.1.0", "proxy-from-env": "^1.1.0", "socks-proxy-agent": "^8.0.5" } }, "sha512-TmatMXdr2KlRiA2CyDu8GqR8EjahTG3aY3nXjdzFyoZbmB8hrBsTyMezhULIXKnC0jpfjlmiZ3+EaCzoInSu/A=="], - - "proxy-from-env": ["proxy-from-env@1.1.0", "", {}, "sha512-D+zkORCbA9f1tdWRK0RaCR3GPv50cMxcrz4X8k5LTSUD1Dkw47mKJEZQNunItRTkWwgtaUSo1RVFRIG9ZXiFYg=="], - - "pump": ["pump@3.0.4", "", { "dependencies": { "end-of-stream": "^1.1.0", "once": "^1.3.1" } }, "sha512-VS7sjc6KR7e1ukRFhQSY5LM2uBWAUPiOPa/A3mkKmiMwSmRFUITt0xuj+/lesgnCv+dPIEYlkzrcyXgquIHMcA=="], - - "pure-rand": ["pure-rand@6.1.0", "", {}, "sha512-bVWawvoZoBYpp6yIoQtQXHZjmz35RSVHnUOTefl8Vcjr8snTPY1wnpSPMWekcFwbxI6gtmT7rSYPFvz71ldiOA=="], - - "qs": ["qs@6.15.2", "", { "dependencies": { "side-channel": "^1.1.0" } }, "sha512-Rzq0KEyX/w/tEybncDgdkZrJgVUsUMk3xjh3t5bv3S1HTAtg+uOYt72+ZfwiQwKdysThkTBdL/rTi6HDmX9Ddw=="], - - "range-parser": ["range-parser@1.2.1", "", {}, "sha512-Hrgsx+orqoygnmhFbKaHE6c296J+HTAQXoxEF6gNupROmmGJRoyzfG3ccAveqCBrwr/2yxQ5BVd/GTl5agOwSg=="], - - "raw-body": ["raw-body@3.0.2", "", { "dependencies": { "bytes": "~3.1.2", "http-errors": "~2.0.1", "iconv-lite": "~0.7.0", "unpipe": "~1.0.0" } }, "sha512-K5zQjDllxWkf7Z5xJdV0/B0WTNqx6vxG70zJE4N0kBs4LovmEYWJzQGxC9bS9RAKu3bgM40lrd5zoLJ12MQ5BA=="], - "readdirp": ["readdirp@4.1.2", "", {}, "sha512-GDhwkLfywWL2s6vEjyhri+eXmfH6j1L7JE27WhqLeYzoh/A3DBaYGEj2H/HFZCn/kMfim73FXxEJTw06WtxQwg=="], "regexparam": ["regexparam@3.0.0", "", {}, "sha512-RSYAtP31mvYLkAHrOlh25pCNQ5hWnT106VukGaaFfuJrZFkGRX5GhUAdPqpSDXxOhA2c4akmRuplv1mRqnBn6Q=="], - "require-directory": ["require-directory@2.1.1", "", {}, "sha512-fGxEI7+wsG9xrvdjsrlmL22OMTTiHRwAMroiEeMgq8gzoLC/PQr7RsRDSTLUg/bZAZtF+TVIkHc6/4RIKrui+Q=="], - - "require-from-string": ["require-from-string@2.0.2", "", {}, "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw=="], - "rolldown": ["rolldown@1.0.3", "", { "dependencies": { "@oxc-project/types": "=0.133.0", "@rolldown/pluginutils": "^1.0.0" }, "optionalDependencies": { "@rolldown/binding-android-arm64": "1.0.3", "@rolldown/binding-darwin-arm64": "1.0.3", "@rolldown/binding-darwin-x64": "1.0.3", "@rolldown/binding-freebsd-x64": "1.0.3", "@rolldown/binding-linux-arm-gnueabihf": "1.0.3", "@rolldown/binding-linux-arm64-gnu": "1.0.3", "@rolldown/binding-linux-arm64-musl": "1.0.3", "@rolldown/binding-linux-ppc64-gnu": "1.0.3", "@rolldown/binding-linux-s390x-gnu": "1.0.3", "@rolldown/binding-linux-x64-gnu": "1.0.3", "@rolldown/binding-linux-x64-musl": "1.0.3", "@rolldown/binding-openharmony-arm64": "1.0.3", "@rolldown/binding-wasm32-wasi": "1.0.3", "@rolldown/binding-win32-arm64-msvc": "1.0.3", "@rolldown/binding-win32-x64-msvc": "1.0.3" }, "bin": { "rolldown": "./bin/cli.mjs" } }, "sha512-i00lAJ2ks1BYr7rjNjKC7BcqAS7nVfiT3QX1SI5aY+AFHblCmaUf9OE9dbdzDvW6dJxbi2ZCZiy9v3CcwOiX3g=="], "rollup": ["rollup@4.62.0", "", { "dependencies": { "@types/estree": "1.0.9" }, "optionalDependencies": { "@rollup/rollup-android-arm-eabi": "4.62.0", "@rollup/rollup-android-arm64": "4.62.0", "@rollup/rollup-darwin-arm64": "4.62.0", "@rollup/rollup-darwin-x64": "4.62.0", "@rollup/rollup-freebsd-arm64": "4.62.0", "@rollup/rollup-freebsd-x64": "4.62.0", "@rollup/rollup-linux-arm-gnueabihf": "4.62.0", "@rollup/rollup-linux-arm-musleabihf": "4.62.0", "@rollup/rollup-linux-arm64-gnu": "4.62.0", "@rollup/rollup-linux-arm64-musl": "4.62.0", "@rollup/rollup-linux-loong64-gnu": "4.62.0", "@rollup/rollup-linux-loong64-musl": "4.62.0", "@rollup/rollup-linux-ppc64-gnu": "4.62.0", "@rollup/rollup-linux-ppc64-musl": "4.62.0", "@rollup/rollup-linux-riscv64-gnu": "4.62.0", "@rollup/rollup-linux-riscv64-musl": "4.62.0", "@rollup/rollup-linux-s390x-gnu": "4.62.0", "@rollup/rollup-linux-x64-gnu": "4.62.0", "@rollup/rollup-linux-x64-musl": "4.62.0", "@rollup/rollup-openbsd-x64": "4.62.0", "@rollup/rollup-openharmony-arm64": "4.62.0", "@rollup/rollup-win32-arm64-msvc": "4.62.0", "@rollup/rollup-win32-ia32-msvc": "4.62.0", "@rollup/rollup-win32-x64-gnu": "4.62.0", "@rollup/rollup-win32-x64-msvc": "4.62.0", "fsevents": "~2.3.2" }, "bin": { "rollup": "dist/bin/rollup" } }, "sha512-nc72Wgq62I7rtDV4izT5/aaS0zxy3kttkinf9586ApknY3jZO9NYsmtc24fUckA0X7Q2v+ML4a15pdUlV5V/jA=="], - "router": ["router@2.2.0", "", { "dependencies": { "debug": "^4.4.0", "depd": "^2.0.0", "is-promise": "^4.0.0", "parseurl": "^1.3.3", "path-to-regexp": "^8.0.0" } }, "sha512-nLTrUKm2UyiL7rlhapu/Zl45FwNgkZGaCpZbIHajDYgwlJCOzLSk+cIPAnsEqV955GjILJnKbdQC1nVPz+gAYQ=="], - "sade": ["sade@1.8.1", "", { "dependencies": { "mri": "^1.1.0" } }, "sha512-xal3CZX1Xlo/k4ApwCFrHVACi9fBqJ7V+mwhBsuf/1IOKbBy098Fex+Wa/5QMubw09pSZ/u8EY8PWgevJsXp1A=="], - "safer-buffer": ["safer-buffer@2.1.2", "", {}, "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg=="], - "semver": ["semver@7.8.4", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-rUCObTnP32Q08R2uuIrt7r9PlEonuTmtuXYcW6s5kjdlj3xbnwe+21yXptAUYcMAABLkYYTtnmzb3w3EDZfueA=="], - "send": ["send@1.2.1", "", { "dependencies": { "debug": "^4.4.3", "encodeurl": "^2.0.0", "escape-html": "^1.0.3", "etag": "^1.8.1", "fresh": "^2.0.0", "http-errors": "^2.0.1", "mime-types": "^3.0.2", "ms": "^2.1.3", "on-finished": "^2.4.1", "range-parser": "^1.2.1", "statuses": "^2.0.2" } }, "sha512-1gnZf7DFcoIcajTjTwjwuDjzuz4PPcY2StKPlsGAQ1+YH20IRVrBaXSWmdjowTJ6u8Rc01PoYOGHXfP1mYcZNQ=="], - - "serve-static": ["serve-static@2.2.1", "", { "dependencies": { "encodeurl": "^2.0.0", "escape-html": "^1.0.3", "parseurl": "^1.3.3", "send": "^1.2.0" } }, "sha512-xRXBn0pPqQTVQiC8wyQrKs2MOlX24zQ0POGaj0kultvoOCstBQM5yvOhAVSUwOMjQtTvsPWoNCHfPGwaaQJhTw=="], - "set-cookie-parser": ["set-cookie-parser@3.1.0", "", {}, "sha512-kjnC1DXBHcxaOaOXBHBeRtltsDG2nUiUni+jP92M9gYdW12rsmx92UsfpH7o5tDRs7I1ZZPSQJQGv3UaRfCiuw=="], - "setprototypeof": ["setprototypeof@1.2.0", "", {}, "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw=="], - "sharp": ["sharp@0.34.5", "", { "dependencies": { "@img/colour": "^1.0.0", "detect-libc": "^2.1.2", "semver": "^7.7.3" }, "optionalDependencies": { "@img/sharp-darwin-arm64": "0.34.5", "@img/sharp-darwin-x64": "0.34.5", "@img/sharp-libvips-darwin-arm64": "1.2.4", "@img/sharp-libvips-darwin-x64": "1.2.4", "@img/sharp-libvips-linux-arm": "1.2.4", "@img/sharp-libvips-linux-arm64": "1.2.4", "@img/sharp-libvips-linux-ppc64": "1.2.4", "@img/sharp-libvips-linux-riscv64": "1.2.4", "@img/sharp-libvips-linux-s390x": "1.2.4", "@img/sharp-libvips-linux-x64": "1.2.4", "@img/sharp-libvips-linuxmusl-arm64": "1.2.4", "@img/sharp-libvips-linuxmusl-x64": "1.2.4", "@img/sharp-linux-arm": "0.34.5", "@img/sharp-linux-arm64": "0.34.5", "@img/sharp-linux-ppc64": "0.34.5", "@img/sharp-linux-riscv64": "0.34.5", "@img/sharp-linux-s390x": "0.34.5", "@img/sharp-linux-x64": "0.34.5", "@img/sharp-linuxmusl-arm64": "0.34.5", "@img/sharp-linuxmusl-x64": "0.34.5", "@img/sharp-wasm32": "0.34.5", "@img/sharp-win32-arm64": "0.34.5", "@img/sharp-win32-ia32": "0.34.5", "@img/sharp-win32-x64": "0.34.5" } }, "sha512-Ou9I5Ft9WNcCbXrU9cMgPBcCK8LiwLqcbywW3t4oDV37n1pzpuNLsYiAV8eODnjbtQlSDwZ2cUEeQz4E54Hltg=="], - "shebang-command": ["shebang-command@2.0.0", "", { "dependencies": { "shebang-regex": "^3.0.0" } }, "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA=="], - - "shebang-regex": ["shebang-regex@3.0.0", "", {}, "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A=="], - - "side-channel": ["side-channel@1.1.1", "", { "dependencies": { "es-errors": "^1.3.0", "object-inspect": "^1.13.4", "side-channel-list": "^1.0.1", "side-channel-map": "^1.0.1", "side-channel-weakmap": "^1.0.2" } }, "sha512-6x6dK6zJdpTzF4sQeNYxwtvBzf6Eg4GtlesS94HOvTudUeyK2WXAaIfmDgsyslYrRBeFIlsi54AYsFGUuhmvrQ=="], - - "side-channel-list": ["side-channel-list@1.0.1", "", { "dependencies": { "es-errors": "^1.3.0", "object-inspect": "^1.13.4" } }, "sha512-mjn/0bi/oUURjc5Xl7IaWi/OJJJumuoJFQJfDDyO46+hBWsfaVM65TBHq2eoZBhzl9EchxOijpkbRC8SVBQU0w=="], - - "side-channel-map": ["side-channel-map@1.0.1", "", { "dependencies": { "call-bound": "^1.0.2", "es-errors": "^1.3.0", "get-intrinsic": "^1.2.5", "object-inspect": "^1.13.3" } }, "sha512-VCjCNfgMsby3tTdo02nbjtM/ewra6jPHmpThenkTYh8pG9ucZ/1P8So4u4FGBek/BjpOVsDCMoLA/iuBKIFXRA=="], - - "side-channel-weakmap": ["side-channel-weakmap@1.0.2", "", { "dependencies": { "call-bound": "^1.0.2", "es-errors": "^1.3.0", "get-intrinsic": "^1.2.5", "object-inspect": "^1.13.3", "side-channel-map": "^1.0.1" } }, "sha512-WPS/HvHQTYnHisLo9McqBHOJk2FkHO/tlpvldyrnem4aeQp4hai3gythswg6p01oSoTl58rcpiFAjF2br2Ak2A=="], - "siginfo": ["siginfo@2.0.0", "", {}, "sha512-ybx0WO1/8bSBLEWXZvEd7gMW3Sn3JFlW3TvX1nREbDLRNQNaeNN8WK0meBwPdAaOI7TtRRRJn/Es1zhrrCHu7g=="], "sirv": ["sirv@3.0.2", "", { "dependencies": { "@polka/url": "^1.0.0-next.24", "mrmime": "^2.0.0", "totalist": "^3.0.0" } }, "sha512-2wcC/oGxHis/BoHkkPwldgiPSYcpZK3JU28WoMVv55yHJgcZ8rlXvuG9iZggz+sU1d4bRgIGASwyWqjxu3FM0g=="], - "smart-buffer": ["smart-buffer@4.2.0", "", {}, "sha512-94hK0Hh8rPqQl2xXc3HsaBoOXKV20MToPkcXvwbISWLEs+64sBq5kFgn2kJDHb1Pry9yrP0dxrCI9RRci7RXKg=="], - - "socks": ["socks@2.8.9", "", { "dependencies": { "ip-address": "^10.1.1", "smart-buffer": "^4.2.0" } }, "sha512-LJhUYUvItdQ0LkJTmPeaEObWXAqFyfmP85x0tch/ez9cahmhlBBLbIqDFnvBnUJGagb0JbIQrkBs1wJ+yRYpEw=="], - - "socks-proxy-agent": ["socks-proxy-agent@8.0.5", "", { "dependencies": { "agent-base": "^7.1.2", "debug": "^4.3.4", "socks": "^2.8.3" } }, "sha512-HehCEsotFqbPW9sJ8WVYB6UbmIMv7kUUORIF2Nncq4VQvBfNBLibW9YZR5dlYCSUhwcD628pRllm7n+E+YTzJw=="], - - "source-map": ["source-map@0.6.1", "", {}, "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g=="], - "source-map-js": ["source-map-js@1.2.1", "", {}, "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA=="], "stackback": ["stackback@0.0.2", "", {}, "sha512-1XMJE5fQo1jGH6Y/7ebnwPOBEkIEnT4QF32d5R1+VXdXveM0IBMJt8zfaxX1P3QhVwrYe+576+jkANtSS2mBbw=="], - "statuses": ["statuses@2.0.2", "", {}, "sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw=="], - "std-env": ["std-env@4.1.0", "", {}, "sha512-Rq7ybcX2RuC55r9oaPVEW7/xu3tj8u4GeBYHBWCychFtzMIr86A7e3PPEBPT37sHStKX3+TiX/Fr/ACmJLVlLQ=="], - "streamx": ["streamx@2.28.0", "", { "dependencies": { "events-universal": "^1.0.0", "fast-fifo": "^1.3.2", "text-decoder": "^1.1.0" } }, "sha512-1Yowhzjf0ivGMrTIkY9hav5TxobO9qIVqUE41fiCGMGgc3CLlf4MY+9AHmZqBWgDTue0fY9zWjYFVyf6Diuobw=="], - - "string-width": ["string-width@4.2.3", "", { "dependencies": { "emoji-regex": "^8.0.0", "is-fullwidth-code-point": "^3.0.0", "strip-ansi": "^6.0.1" } }, "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g=="], - - "strip-ansi": ["strip-ansi@6.0.1", "", { "dependencies": { "ansi-regex": "^5.0.1" } }, "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A=="], - "supports-color": ["supports-color@10.2.2", "", {}, "sha512-SS+jx45GF1QjgEXQx4NJZV9ImqmO2NPz5FNsIHrsDjh2YsHnawpan7SNQ1o8NuhrbHZy9AZhIoCUiCeaW/C80g=="], "svelte": ["svelte@5.56.3", "", { "dependencies": { "@jridgewell/remapping": "^2.3.4", "@jridgewell/sourcemap-codec": "^1.5.0", "@sveltejs/acorn-typescript": "^1.0.10", "@types/estree": "^1.0.5", "@types/trusted-types": "^2.0.7", "acorn": "^8.12.1", "aria-query": "5.3.1", "axobject-query": "^4.1.0", "clsx": "^2.1.1", "devalue": "^5.8.1", "esm-env": "^1.2.1", "esrap": "^2.2.11", "is-reference": "^3.0.3", "locate-character": "^3.0.0", "magic-string": "^0.30.11", "zimmerframe": "^1.1.2" } }, "sha512-w7JvrM5IFl5cmfbY0TLik9o7mjRUJmRMhOR51tBPu708Gr/MjbGs7VnJnr/B0CaXeI4vtnOh7RKxDr0cwhMdDA=="], "svelte-check": ["svelte-check@4.6.0", "", { "dependencies": { "@jridgewell/trace-mapping": "^0.3.25", "@sveltejs/load-config": "0.1.1", "chokidar": "^4.0.1", "fdir": "^6.2.0", "picocolors": "^1.0.0", "sade": "^1.7.4" }, "peerDependencies": { "svelte": "^4.0.0 || ^5.0.0-next.0", "typescript": ">=5.0.0" }, "bin": { "svelte-check": "bin/svelte-check" } }, "sha512-KhVnDFDSid57mmZtHz8gfW8AAGylOZ0vPnOIzVmAL+urzwK8sBYXRss953gD8T0OdgAQ11mdWhE6uadmtOz8TQ=="], - "tar-fs": ["tar-fs@3.1.2", "", { "dependencies": { "pump": "^3.0.0", "tar-stream": "^3.1.5" }, "optionalDependencies": { "bare-fs": "^4.0.1", "bare-path": "^3.0.0" } }, "sha512-QGxxTxxyleAdyM3kpFs14ymbYmNFrfY+pHj7Z8FgtbZ7w2//VAgLMac7sT6nRpIHjppXO2AwwEOg0bPFVRcmXw=="], - - "tar-stream": ["tar-stream@3.2.0", "", { "dependencies": { "b4a": "^1.6.4", "bare-fs": "^4.5.5", "fast-fifo": "^1.2.0", "streamx": "^2.15.0" } }, "sha512-ojzvCvVaNp6aOTFmG7jaRD0meowIAuPc3cMMhSgKiVWws1GyHbGd/xvnyuRKcKlMpt3qvxx6r0hreCNITP9hIg=="], - - "teex": ["teex@1.0.1", "", { "dependencies": { "streamx": "^2.12.5" } }, "sha512-eYE6iEI62Ni1H8oIa7KlDU6uQBtqr4Eajni3wX7rpfXD8ysFx8z0+dri+KWEPWpBsxXfxu58x/0jvTVT1ekOSg=="], - - "text-decoder": ["text-decoder@1.2.7", "", { "dependencies": { "b4a": "^1.6.4" } }, "sha512-vlLytXkeP4xvEq2otHeJfSQIRyWxo/oZGEbXrtEEF9Hnmrdly59sUbzZ/QgyWuLYHctCHxFF4tRQZNQ9k60ExQ=="], - - "through": ["through@2.3.8", "", {}, "sha512-w89qg7PI8wAdvX60bMDP+bFoD5Dvhm9oLheFp5O4a2QF0cSBGsBX4qZmadPMvVqlLJBBci+WqGGOAPvcDeNSVg=="], - "tinybench": ["tinybench@2.9.0", "", {}, "sha512-0+DUvqWMValLmha6lr4kD8iAMK1HzV0/aKnCtWb9v9641TnP/MFb7Pc2bxoxQjTXAErryXVgUOfv2YqNllqGeg=="], "tinyexec": ["tinyexec@1.2.4", "", {}, "sha512-SHf/r48b7vOrjve9PxJo3MN5v5yuyjHvdUcrQffT3WXMUfnGmHDVbC4k3sHJaJTgZCwpUplIaAo5ANtMyp3YHg=="], @@ -799,60 +474,34 @@ "tinyrainbow": ["tinyrainbow@3.1.0", "", {}, "sha512-Bf+ILmBgretUrdJxzXM0SgXLZ3XfiaUuOj/IKQHuTXip+05Xn+uyEYdVg0kYDipTBcLrCVyUzAPz7QmArb0mmw=="], - "toidentifier": ["toidentifier@1.0.1", "", {}, "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA=="], - "totalist": ["totalist@3.0.1", "", {}, "sha512-sf4i37nQ2LBx4m3wB74y+ubopq6W/dIzXg0FDGjsYnZHVa1Da8FH853wlL2gtUhg+xJXjfk3kUZS3BRoQeoQBQ=="], "tslib": ["tslib@2.8.1", "", {}, "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w=="], - "type-is": ["type-is@2.1.0", "", { "dependencies": { "content-type": "^2.0.0", "media-typer": "^1.1.0", "mime-types": "^3.0.0" } }, "sha512-faYHw0anBbc/kWF3zFTEnxSFOAGUX9GFbOBthvDdLsIlEoWOFOtS0zgCiQYwIskL9iGXZL3kAXD8OoZ4GmMATA=="], - "typescript": ["typescript@6.0.3", "", { "bin": { "tsc": "bin/tsc", "tsserver": "bin/tsserver" } }, "sha512-y2TvuxSZPDyQakkFRPZHKFm+KKVqIisdg9/CZwm9ftvKXLP8NRWj38/ODjNbr43SsoXqNuAisEf1GdCxqWcdBw=="], - "unbzip2-stream": ["unbzip2-stream@1.4.3", "", { "dependencies": { "buffer": "^5.2.1", "through": "^2.3.8" } }, "sha512-mlExGW4w71ebDJviH16lQLtZS32VKqsSfk80GCfUlwT/4/hNRFsoscrF/c++9xinkMzECL1uL9DDwXqFWkruPg=="], - "undici": ["undici@7.24.8", "", {}, "sha512-6KQ/+QxK49Z/p3HO6E5ZCZWNnCasyZLa5ExaVYyvPxUwKtbCPMKELJOqh7EqOle0t9cH/7d2TaaTRRa6Nhs4YQ=="], "undici-types": ["undici-types@7.24.6", "", {}, "sha512-WRNW+sJgj5OBN4/0JpHFqtqzhpbnV0GuB+OozA9gCL7a993SmU+1JBZCzLNxYsbMfIeDL+lTsphD5jN5N+n0zg=="], "unenv": ["unenv@2.0.0-rc.24", "", { "dependencies": { "pathe": "^2.0.3" } }, "sha512-i7qRCmY42zmCwnYlh9H2SvLEypEFGye5iRmEMKjcGi7zk9UquigRjFtTLz0TYqr0ZGLZhaMHl/foy1bZR+Cwlw=="], - "unpipe": ["unpipe@1.0.0", "", {}, "sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ=="], - - "unsurf": ["unsurf@0.4.0", "", { "dependencies": { "@acoyfellow/proof-spec": "file:./vendor/proof-spec", "@cloudflare/ai": "^1.2.2", "@cloudflare/puppeteer": "^1.0.6", "@effect/platform": "^0.94.5", "@effect/schema": "^0.75.5", "@modelcontextprotocol/sdk": "^1.26.0", "drizzle-orm": "^0.45.1", "effect": "^3.19.17" }, "bin": { "unsurf": "dist/cli.js", "unsurf-daemon": "examples/webmcp-daemon/daemon.ts" } }, "sha512-hS3QTZVaYT9T5lVRi/Rw1KxUQBWXUj73ehgjFXbZzZa/wayQMbeOTU6UyGvb57/Xr15UXH0Pd2mw6MZz/05z4Q=="], - - "vary": ["vary@1.1.2", "", {}, "sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg=="], - "vite": ["vite@7.3.5", "", { "dependencies": { "esbuild": "^0.27.0", "fdir": "^6.5.0", "picomatch": "^4.0.3", "postcss": "^8.5.6", "rollup": "^4.43.0", "tinyglobby": "^0.2.15" }, "optionalDependencies": { "fsevents": "~2.3.3" }, "peerDependencies": { "@types/node": "^20.19.0 || >=22.12.0", "jiti": ">=1.21.0", "less": "^4.0.0", "lightningcss": "^1.21.0", "sass": "^1.70.0", "sass-embedded": "^1.70.0", "stylus": ">=0.54.8", "sugarss": "^5.0.0", "terser": "^5.16.0", "tsx": "^4.8.1", "yaml": "^2.4.2" }, "optionalPeers": ["@types/node", "jiti", "less", "lightningcss", "sass", "sass-embedded", "stylus", "sugarss", "terser", "tsx", "yaml"], "bin": { "vite": "bin/vite.js" } }, "sha512-KuOaNhcnGFN2zIPGA7wRmzF+lJA1sea7rHq17aiJ++9lzY1WWG6Jpwqwe1KNbRVPIqHmr8GLYx7jbrQcN/7/ww=="], "vitefu": ["vitefu@1.1.3", "", { "peerDependencies": { "vite": "^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0" }, "optionalPeers": ["vite"] }, "sha512-ub4okH7Z5KLjb6hDyjqrGXqWtWvoYdU3IGm/NorpgHncKoLTCfRIbvlhBm7r0YstIaQRYlp4yEbFqDcKSzXSSg=="], "vitest": ["vitest@4.1.8", "", { "dependencies": { "@vitest/expect": "4.1.8", "@vitest/mocker": "4.1.8", "@vitest/pretty-format": "4.1.8", "@vitest/runner": "4.1.8", "@vitest/snapshot": "4.1.8", "@vitest/spy": "4.1.8", "@vitest/utils": "4.1.8", "es-module-lexer": "^2.0.0", "expect-type": "^1.3.0", "magic-string": "^0.30.21", "obug": "^2.1.1", "pathe": "^2.0.3", "picomatch": "^4.0.3", "std-env": "^4.0.0-rc.1", "tinybench": "^2.9.0", "tinyexec": "^1.0.2", "tinyglobby": "^0.2.15", "tinyrainbow": "^3.1.0", "vite": "^6.0.0 || ^7.0.0 || ^8.0.0", "why-is-node-running": "^2.3.0" }, "peerDependencies": { "@edge-runtime/vm": "*", "@opentelemetry/api": "^1.9.0", "@types/node": "^20.0.0 || ^22.0.0 || >=24.0.0", "@vitest/browser-playwright": "4.1.8", "@vitest/browser-preview": "4.1.8", "@vitest/browser-webdriverio": "4.1.8", "@vitest/coverage-istanbul": "4.1.8", "@vitest/coverage-v8": "4.1.8", "@vitest/ui": "4.1.8", "happy-dom": "*", "jsdom": "*" }, "optionalPeers": ["@edge-runtime/vm", "@opentelemetry/api", "@types/node", "@vitest/browser-playwright", "@vitest/browser-preview", "@vitest/browser-webdriverio", "@vitest/coverage-istanbul", "@vitest/coverage-v8", "@vitest/ui", "happy-dom", "jsdom"], "bin": { "vitest": "vitest.mjs" } }, "sha512-flY6ScbCIt9HThs+C5HS7jvGOB560DJtk/Z15IQROTA6zEy49Nh8T/dofWTQL+n3vswqn87sbJNiuqw1SDp5Ig=="], - "which": ["which@2.0.2", "", { "dependencies": { "isexe": "^2.0.0" }, "bin": { "node-which": "./bin/node-which" } }, "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA=="], - "why-is-node-running": ["why-is-node-running@2.3.0", "", { "dependencies": { "siginfo": "^2.0.0", "stackback": "0.0.2" }, "bin": { "why-is-node-running": "cli.js" } }, "sha512-hUrmaWBdVDcxvYqnyh09zunKzROWjbZTiNy8dBEjkS7ehEDQibXJ7XvlmtbwuTclUiIyN+CyXQD4Vmko8fNm8w=="], - "workerd": ["workerd@1.20260611.1", "", { "optionalDependencies": { "@cloudflare/workerd-darwin-64": "1.20260611.1", "@cloudflare/workerd-darwin-arm64": "1.20260611.1", "@cloudflare/workerd-linux-64": "1.20260611.1", "@cloudflare/workerd-linux-arm64": "1.20260611.1", "@cloudflare/workerd-windows-64": "1.20260611.1" }, "bin": { "workerd": "bin/workerd" } }, "sha512-CS/640T7pIJ2HYX6x2DwKFGbcSckAWN3tgcdq+ptB6SaqjWUhlzIgA/YhPuwIU+/NnMnGpqOFX/hC18Oyge63w=="], + "workerd": ["workerd@1.20260617.1", "", { "optionalDependencies": { "@cloudflare/workerd-darwin-64": "1.20260617.1", "@cloudflare/workerd-darwin-arm64": "1.20260617.1", "@cloudflare/workerd-linux-64": "1.20260617.1", "@cloudflare/workerd-linux-arm64": "1.20260617.1", "@cloudflare/workerd-windows-64": "1.20260617.1" }, "bin": { "workerd": "bin/workerd" } }, "sha512-Re5pl6pdowt3ZmWUzGlOuB7jbRIIPetgKalmo4cYmucQnVhpo7/3e4MfpekbhLi2EhZZz5EY9NWRu8zFzuEZew=="], "worktop": ["worktop@0.8.0-next.18", "", { "dependencies": { "mrmime": "^2.0.0", "regexparam": "^3.0.0" } }, "sha512-+TvsA6VAVoMC3XDKR5MoC/qlLqDixEfOBysDEKnPIPou/NvoPWCAuXHXMsswwlvmEuvX56lQjvELLyLuzTKvRw=="], - "wrangler": ["wrangler@4.100.0", "", { "dependencies": { "@cloudflare/kv-asset-handler": "0.5.0", "@cloudflare/unenv-preset": "2.16.1", "blake3-wasm": "2.1.5", "esbuild": "0.27.3", "miniflare": "4.20260611.0", "path-to-regexp": "6.3.0", "unenv": "2.0.0-rc.24", "workerd": "1.20260611.1" }, "optionalDependencies": { "fsevents": "2.3.3" }, "peerDependencies": { "@cloudflare/workers-types": "^4.20260611.1" }, "optionalPeers": ["@cloudflare/workers-types"], "bin": { "cf-wrangler": "bin/cf-wrangler.js", "wrangler": "bin/wrangler.js", "wrangler2": "bin/wrangler.js" } }, "sha512-dSQO7DO+mD6XDzkVWIWBoGLO3yw+lacWSc/KhFvd7pgfpth+kX98qb5SGRHZN8ACCDhhfwzDLXwB6qHsIHhfBg=="], - - "wrap-ansi": ["wrap-ansi@7.0.0", "", { "dependencies": { "ansi-styles": "^4.0.0", "string-width": "^4.1.0", "strip-ansi": "^6.0.0" } }, "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q=="], - - "wrappy": ["wrappy@1.0.2", "", {}, "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ=="], + "wrangler": ["wrangler@4.103.0", "", { "dependencies": { "@cloudflare/kv-asset-handler": "0.5.0", "@cloudflare/unenv-preset": "2.16.1", "blake3-wasm": "2.1.5", "esbuild": "0.28.1", "miniflare": "4.20260617.1", "path-to-regexp": "6.3.0", "unenv": "2.0.0-rc.24", "workerd": "1.20260617.1" }, "optionalDependencies": { "fsevents": "2.3.3" }, "peerDependencies": { "@cloudflare/workers-types": "^4.20260617.1" }, "optionalPeers": ["@cloudflare/workers-types"], "bin": { "cf-wrangler": "bin/cf-wrangler.js", "wrangler": "bin/wrangler.js", "wrangler2": "bin/wrangler.js" } }, "sha512-3Lv1P5t2xcSEkSTKtG+Lz+3JFryuU7YPLkaCUj7gNe+CJsjZJLtUwqsh1x595QBxkIbCE0GAvDx2DCJUU4+oqw=="], "ws": ["ws@8.18.0", "", { "peerDependencies": { "bufferutil": "^4.0.1", "utf-8-validate": ">=5.0.2" }, "optionalPeers": ["bufferutil", "utf-8-validate"] }, "sha512-8VbfWfHLbbwu3+N6OKsOMpBdT4kXPDDB9cJk2bJ6mh9ucxdlnNvH1e+roYkKmN9Nxw2yjz7VzeO9oOz2zJ04Pw=="], - "y18n": ["y18n@5.0.8", "", {}, "sha512-0pfFzegeDWJHJIAmTLRP2DwHjdF5s7jo9tuztdQxAhINCdvS+3nGINqPd00AphqJR/0LhANUS6/+7SCb98YOfA=="], - - "yargs": ["yargs@17.7.2", "", { "dependencies": { "cliui": "^8.0.1", "escalade": "^3.1.1", "get-caller-file": "^2.0.5", "require-directory": "^2.1.1", "string-width": "^4.2.3", "y18n": "^5.0.5", "yargs-parser": "^21.1.1" } }, "sha512-7dSzzRQ++CKnNI/krKnYRV7JKKPUXMEh61soaHKg9mrWEhzFWhFnxPxGl+69cD1Ou63C13NUPCnmIcrvqCuM6w=="], - - "yargs-parser": ["yargs-parser@21.1.1", "", {}, "sha512-tVpsJW7DdjecAiFpbIB1e3qxIQsE6NoPc5/eTdrbbIC4h0LVsWhnoa3g+m2HclBIujHzsxZ4VJVA+GUuc2/LBw=="], - - "yauzl": ["yauzl@2.10.0", "", { "dependencies": { "buffer-crc32": "~0.2.3", "fd-slicer": "~1.1.0" } }, "sha512-p4a9I6X6nu6IhoGmBqAcbJy1mlC4j27vEPZX9F4L4/vZT3Lyq1VkFHw/V/PUcB9Buo+DG3iHkT0x3Qya58zc3g=="], - "youch": ["youch@4.1.0-beta.10", "", { "dependencies": { "@poppinss/colors": "^4.1.5", "@poppinss/dumper": "^0.6.4", "@speed-highlight/core": "^1.2.7", "cookie": "^1.0.2", "youch-core": "^0.3.3" } }, "sha512-rLfVLB4FgQneDr0dv1oddCVZmKjcJ6yX6mS4pU82Mq/Dt9a3cLZQ62pDBL4AUO+uVrCvtWz3ZFUL2HFAFJ/BXQ=="], "youch-core": ["youch-core@0.3.3", "", { "dependencies": { "@poppinss/exception": "^1.2.2", "error-stack-parser-es": "^1.0.5" } }, "sha512-ho7XuGjLaJ2hWHoK8yFnsUGy2Y5uDpqSTq1FkHLK4/oqKtyUU1AFbOOxY4IpC9f0fTLjwYbslUz0Po5BpD1wrA=="], @@ -861,35 +510,25 @@ "zod": ["zod@3.25.76", "", {}, "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ=="], - "zod-to-json-schema": ["zod-to-json-schema@3.25.2", "", { "peerDependencies": { "zod": "^3.25.28 || ^4" } }, "sha512-O/PgfnpT1xKSDeQYSCfRI5Gy3hPf91mKVDuYLUHZJMiDFptvP41MSnWofm8dnCm0256ZNfZIM7DSzuSMAFnjHA=="], - - "@cloudflare/puppeteer/ws": ["ws@8.20.1", "", { "peerDependencies": { "bufferutil": "^4.0.1", "utf-8-validate": ">=5.0.2" }, "optionalPeers": ["bufferutil", "utf-8-validate"] }, "sha512-It4dO0K5v//JtTXuPkfEOaI3uUN87iYPnqo/ZzqCoG3g8uhA66QUMs/SrM0YK7/NAu+r4LMh/9dq2A7k+rHs+w=="], - "@cloudflare/vitest-pool-workers/wrangler": ["wrangler@4.84.1", "", { "dependencies": { "@cloudflare/kv-asset-handler": "0.4.2", "@cloudflare/unenv-preset": "2.16.0", "blake3-wasm": "2.1.5", "esbuild": "0.27.3", "miniflare": "4.20260421.0", "path-to-regexp": "6.3.0", "unenv": "2.0.0-rc.24", "workerd": "1.20260421.1" }, "optionalDependencies": { "fsevents": "~2.3.2" }, "peerDependencies": { "@cloudflare/workers-types": "^4.20260421.1" }, "optionalPeers": ["@cloudflare/workers-types"], "bin": { "wrangler": "bin/wrangler.js", "wrangler2": "bin/wrangler.js" } }, "sha512-Xe1S/Bik7pNdtdJ+asHsEZC2dX9k3WxYn2BbxFtOrrLVxN/LKi750zsrjX41jSAk00M/O1l7jzyQV4sQqw8ftg=="], "@cspotcode/source-map-support/@jridgewell/trace-mapping": ["@jridgewell/trace-mapping@0.3.9", "", { "dependencies": { "@jridgewell/resolve-uri": "^3.0.3", "@jridgewell/sourcemap-codec": "^1.4.10" } }, "sha512-3Belt6tdc8bPgAtbcmdtNJlirVoTmEb5e2gC94PnkwEW9jI6CAHUeoG85tjWP5WquqfavoMtMwiG4P926ZKKuQ=="], "@rolldown/binding-wasm32-wasi/@emnapi/runtime": ["@emnapi/runtime@1.10.0", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-ewvYlk86xUoGI0zQRNq/mC+16R1QeDlKQy21Ki3oSYXNgLb45GV1P6A0M+/s6nyCuNDqe5VpaY84BzXGwVbwFA=="], - "express/cookie": ["cookie@0.7.2", "", {}, "sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w=="], - "miniflare/workerd": ["workerd@1.20260421.1", "", { "optionalDependencies": { "@cloudflare/workerd-darwin-64": "1.20260421.1", "@cloudflare/workerd-darwin-arm64": "1.20260421.1", "@cloudflare/workerd-linux-64": "1.20260421.1", "@cloudflare/workerd-linux-arm64": "1.20260421.1", "@cloudflare/workerd-windows-64": "1.20260421.1" }, "bin": { "workerd": "bin/workerd" } }, "sha512-zTYD+xFR4d7TUCxsyl7FTPth9a8CDgk8pM7xUWbJxo0SGUx+2e5C7Q5LrramBZwmuAErtzXmOjlQ15PtkPAhZA=="], "rollup/fsevents": ["fsevents@2.3.3", "", { "os": "darwin" }, "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw=="], - "router/path-to-regexp": ["path-to-regexp@8.4.2", "", {}, "sha512-qRcuIdP69NPm4qbACK+aDogI5CBDMi1jKe0ry5rSQJz8JVLsC7jV8XpiJjGRLLol3N+R5ihGYcrPLTno6pAdBA=="], - - "type-is/content-type": ["content-type@2.0.0", "", {}, "sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ=="], - - "unsurf/@acoyfellow/proof-spec": ["@acoyfellow/proof-spec@file:./vendor/proof-spec", {}], - "vite/fsevents": ["fsevents@2.3.3", "", { "os": "darwin" }, "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw=="], "vitest/vite": ["vite@8.0.16", "", { "dependencies": { "lightningcss": "^1.32.0", "picomatch": "^4.0.4", "postcss": "^8.5.15", "rolldown": "1.0.3", "tinyglobby": "^0.2.17" }, "optionalDependencies": { "fsevents": "~2.3.3" }, "peerDependencies": { "@types/node": "^20.19.0 || >=22.12.0", "@vitejs/devtools": "^0.1.18", "esbuild": "^0.27.0 || ^0.28.0", "jiti": ">=1.21.0", "less": "^4.0.0", "sass": "^1.70.0", "sass-embedded": "^1.70.0", "stylus": ">=0.54.8", "sugarss": "^5.0.0", "terser": "^5.16.0", "tsx": "^4.8.1", "yaml": "^2.4.2" }, "optionalPeers": ["@types/node", "@vitejs/devtools", "esbuild", "jiti", "less", "sass", "sass-embedded", "stylus", "sugarss", "terser", "tsx", "yaml"], "bin": { "vite": "bin/vite.js" } }, "sha512-h9bXPmJichP5fLmVQo3PyaGSDE2n3aPuomeAlVRm0JLmt4rY6zmPKd59HYI4LNW8oTK7tlTsuC7l/m7awx9Jcw=="], + "wrangler/esbuild": ["esbuild@0.28.1", "", { "optionalDependencies": { "@esbuild/aix-ppc64": "0.28.1", "@esbuild/android-arm": "0.28.1", "@esbuild/android-arm64": "0.28.1", "@esbuild/android-x64": "0.28.1", "@esbuild/darwin-arm64": "0.28.1", "@esbuild/darwin-x64": "0.28.1", "@esbuild/freebsd-arm64": "0.28.1", "@esbuild/freebsd-x64": "0.28.1", "@esbuild/linux-arm": "0.28.1", "@esbuild/linux-arm64": "0.28.1", "@esbuild/linux-ia32": "0.28.1", "@esbuild/linux-loong64": "0.28.1", "@esbuild/linux-mips64el": "0.28.1", "@esbuild/linux-ppc64": "0.28.1", "@esbuild/linux-riscv64": "0.28.1", "@esbuild/linux-s390x": "0.28.1", "@esbuild/linux-x64": "0.28.1", "@esbuild/netbsd-arm64": "0.28.1", "@esbuild/netbsd-x64": "0.28.1", "@esbuild/openbsd-arm64": "0.28.1", "@esbuild/openbsd-x64": "0.28.1", "@esbuild/openharmony-arm64": "0.28.1", "@esbuild/sunos-x64": "0.28.1", "@esbuild/win32-arm64": "0.28.1", "@esbuild/win32-ia32": "0.28.1", "@esbuild/win32-x64": "0.28.1" }, "bin": { "esbuild": "bin/esbuild" } }, "sha512-HrJrvZv5ayxBzPfwphOoNzkzOIIlifzk0KJrGK2c8R4+LKpMtpYLQeUdjnwjWv/LZlkH2laZk+4w78pi99D4Vw=="], + "wrangler/fsevents": ["fsevents@2.3.3", "", { "os": "darwin" }, "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw=="], - "wrangler/miniflare": ["miniflare@4.20260611.0", "", { "dependencies": { "@cspotcode/source-map-support": "0.8.1", "sharp": "0.34.5", "undici": "7.24.8", "workerd": "1.20260611.1", "ws": "8.20.1", "youch": "4.1.0-beta.10" }, "bin": { "miniflare": "bootstrap.js" } }, "sha512-i+JwEo8vN96naz1WL3ntFgFyRluBDYL408zwhHKvR2jefJ464KsZ/gCmJAQ5k+oaWeb5Ug+s7yne5AyiAEswjg=="], + "wrangler/miniflare": ["miniflare@4.20260617.1", "", { "dependencies": { "@cspotcode/source-map-support": "0.8.1", "sharp": "0.34.5", "undici": "7.28.0", "workerd": "1.20260617.1", "ws": "8.21.0", "youch": "4.1.0-beta.10" }, "bin": { "miniflare": "bootstrap.js" } }, "sha512-Go3/gzStm99QHptsSgU+q1S+xDfLoRgwjJNY80kaTVi0ENhTyqKq+sc4xZiWBSbM7uUcJwmzm8+QFKtcYLJ9nw=="], "youch/cookie": ["cookie@1.1.1", "", {}, "sha512-ei8Aos7ja0weRpFzJnEA9UHJ/7XQmqglbRwnf2ATjcB9Wq874VKH9kfjjirM6UhU2/E5fFYadylyhFldcqSidQ=="], @@ -913,7 +552,61 @@ "vitest/vite/fsevents": ["fsevents@2.3.3", "", { "os": "darwin" }, "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw=="], - "wrangler/miniflare/ws": ["ws@8.20.1", "", { "peerDependencies": { "bufferutil": "^4.0.1", "utf-8-validate": ">=5.0.2" }, "optionalPeers": ["bufferutil", "utf-8-validate"] }, "sha512-It4dO0K5v//JtTXuPkfEOaI3uUN87iYPnqo/ZzqCoG3g8uhA66QUMs/SrM0YK7/NAu+r4LMh/9dq2A7k+rHs+w=="], + "wrangler/esbuild/@esbuild/aix-ppc64": ["@esbuild/aix-ppc64@0.28.1", "", { "os": "aix", "cpu": "ppc64" }, "sha512-Svl7tq8k/08+p6CXPpRjQ1fKX+1odH/BQbb48fV6fj3CWHhsoIOoY87w1oHXm0qEpkIK3ZfVgp0hed3XBXzXMQ=="], + + "wrangler/esbuild/@esbuild/android-arm": ["@esbuild/android-arm@0.28.1", "", { "os": "android", "cpu": "arm" }, "sha512-0k2F129Xdio1TdJfzJ8sy1Q47vUD2NnwdhiAf7drUN1EBTfPf4hsFCtmMgu/6m8JSzsBrlmVjudMBQqOfG8usQ=="], + + "wrangler/esbuild/@esbuild/android-arm64": ["@esbuild/android-arm64@0.28.1", "", { "os": "android", "cpu": "arm64" }, "sha512-34EGEbCIAgosYz6goLcopX6Mo7NyGv9tfwEM2/7Ce2VcVRk568iSvniGWcUXIy7wEDR1wzolcxcriFVrWYcwBg=="], + + "wrangler/esbuild/@esbuild/android-x64": ["@esbuild/android-x64@0.28.1", "", { "os": "android", "cpu": "x64" }, "sha512-dbwY7ltSMDWsRatcRpCnES4F+im88OCUgGZjy52shC7GqHRE/cYlxNbB4Z4UpJswpcc4Qxd2oE/ufM0p61IKng=="], + + "wrangler/esbuild/@esbuild/darwin-arm64": ["@esbuild/darwin-arm64@0.28.1", "", { "os": "darwin", "cpu": "arm64" }, "sha512-TZbWkQY7kvTAXbXUT7uVACR5cMHsDiSz9z7ZKAX/RTq/WJEk3QyRr0wZpNhBDX+/0CtdqUIJlOiodQcta6tY3Q=="], + + "wrangler/esbuild/@esbuild/darwin-x64": ["@esbuild/darwin-x64@0.28.1", "", { "os": "darwin", "cpu": "x64" }, "sha512-zfdzgK9ACBNZLI/CyHTOx81SyNbM6YXn7rxSgX97VjyiPl9W1i4Ka4fgKECEoFCKGpvBj5qArWIGgQjOwkgskQ=="], + + "wrangler/esbuild/@esbuild/freebsd-arm64": ["@esbuild/freebsd-arm64@0.28.1", "", { "os": "freebsd", "cpu": "arm64" }, "sha512-wG2EA8ENdEI0qhkSZMjfqrdY+ziCYCPMmtZjjIwOmXFjmyzEHn+UUxk5of+SYsjtfs3VpnlC7QLzSI5hY/rOAw=="], + + "wrangler/esbuild/@esbuild/freebsd-x64": ["@esbuild/freebsd-x64@0.28.1", "", { "os": "freebsd", "cpu": "x64" }, "sha512-i7dZ9vQgnvSCzi/rYCXNgtF/U+eKZNJBzu3eTQbRgHnM7tNSizLOkRFAl3qzVc/Op/u5YkHHa4pf/3DOYHthLQ=="], + + "wrangler/esbuild/@esbuild/linux-arm": ["@esbuild/linux-arm@0.28.1", "", { "os": "linux", "cpu": "arm" }, "sha512-qVXBOHQS+d5Y722GwJzJUtOLlX7km3CraOaGormF1pDtPd2C/l1SHRPgjLunLGe51Sh5YYWKMFDyV4SxgMQYTQ=="], + + "wrangler/esbuild/@esbuild/linux-arm64": ["@esbuild/linux-arm64@0.28.1", "", { "os": "linux", "cpu": "arm64" }, "sha512-yHs+0uc8+nvEAfAfxrWQKK5peSNzBc4PegcMO0EJ2hT71uA7vB8Ihg2e77R2P7SG5uYjPbHlLLmve4LLLRCf0g=="], + + "wrangler/esbuild/@esbuild/linux-ia32": ["@esbuild/linux-ia32@0.28.1", "", { "os": "linux", "cpu": "ia32" }, "sha512-d1z4ZuP0ajrfz/FhGT4vv278rX8KnPPJx8i5+AtK7TYbx9Le9F1hyzurZpkEyjkGa9dUGhQow4C1NmeGvqxN2w=="], + + "wrangler/esbuild/@esbuild/linux-loong64": ["@esbuild/linux-loong64@0.28.1", "", { "os": "linux", "cpu": "none" }, "sha512-M5sRjUVZrkm1OAPR3dlOYzNmN+loZKGVi1VUQGrwuqLcbR6qeAz+famMhjASeH3YVKvZz+zT1jlh/keC3Rj/lg=="], + + "wrangler/esbuild/@esbuild/linux-mips64el": ["@esbuild/linux-mips64el@0.28.1", "", { "os": "linux", "cpu": "none" }, "sha512-mRObBZeHh2OxcBFPWE/FjylkRgZdYuiTR3vaTozquCGOH14iP9oN4x4Ge81CoIDYQrXmIxpFumJBu5MtZpnQJQ=="], + + "wrangler/esbuild/@esbuild/linux-ppc64": ["@esbuild/linux-ppc64@0.28.1", "", { "os": "linux", "cpu": "ppc64" }, "sha512-slScBsMAb3GFDcdrCgLwZtPYRoH2H/youv10QiZyRjmsP48fznoveWytSgCI/R0ZcUgpc0ZhIUEx6LHts8yrfQ=="], + + "wrangler/esbuild/@esbuild/linux-riscv64": ["@esbuild/linux-riscv64@0.28.1", "", { "os": "linux", "cpu": "none" }, "sha512-kw0owk1o0GFETUJyW0jc0G4Yzs0BHZn0JDZ8JRT088vjJYX777BAs1fDGxAC+q831qOs2DTC96mNsG2opdfyyQ=="], + + "wrangler/esbuild/@esbuild/linux-s390x": ["@esbuild/linux-s390x@0.28.1", "", { "os": "linux", "cpu": "s390x" }, "sha512-/lAIjX8aYFRByhh6L5rYtPEDRqa9de/4V/juOXcta5frjvzXO4/sqEtyytse0g3zZFuWu5cDN0MkLz2qRDD2Ag=="], + + "wrangler/esbuild/@esbuild/linux-x64": ["@esbuild/linux-x64@0.28.1", "", { "os": "linux", "cpu": "x64" }, "sha512-u/anNYF2mmVOEDwLtnQ1wOr3EZ9sTNGLWrsYGYwHWzGA3Si84IOkHXlbWTD1NB+9/1lcnweYKO54uhxZydNzfA=="], + + "wrangler/esbuild/@esbuild/netbsd-arm64": ["@esbuild/netbsd-arm64@0.28.1", "", { "os": "none", "cpu": "arm64" }, "sha512-oks0DYbLwWMmaakTsCb+zL4E+aHRVLom9IJZOAthMQEPiQmydXHkziYEsGYRx0uNV/IjEKGAV941JzH02pflqw=="], + + "wrangler/esbuild/@esbuild/netbsd-x64": ["@esbuild/netbsd-x64@0.28.1", "", { "os": "none", "cpu": "x64" }, "sha512-aeL6lAnN89Hz43Mlh1G8ARasbuoYvSITDEx0tHh5b7jJnHcssqgjy9Yx430GDpmCa6OyrKoS0aNRjKundRizGg=="], + + "wrangler/esbuild/@esbuild/openbsd-arm64": ["@esbuild/openbsd-arm64@0.28.1", "", { "os": "openbsd", "cpu": "arm64" }, "sha512-MEFJe5C3R8pwXdZ5Y21oo6m7ePiS0d9pWucn99O/wvyJZChoIQKrQDxKrGeW8F5+T0okTHesAmDeiHDTIq0V/Q=="], + + "wrangler/esbuild/@esbuild/openbsd-x64": ["@esbuild/openbsd-x64@0.28.1", "", { "os": "openbsd", "cpu": "x64" }, "sha512-i/ZLIOafE0Z8cI/XANJAixoJL/uRAoS2xOA3rb0xN+KK0K177cMAsQYkzHtBrtMXAKuAc7HGgcWiZ/sRC1Nxgw=="], + + "wrangler/esbuild/@esbuild/openharmony-arm64": ["@esbuild/openharmony-arm64@0.28.1", "", { "os": "none", "cpu": "arm64" }, "sha512-ge+Z7EXFNt2BO1oAMsVpiQ8EwndV9i1xXerAeTIK7AtPs3bKFXQM7nlRxDSIUIMeueR1CNXxqztLzdNeReKBJg=="], + + "wrangler/esbuild/@esbuild/sunos-x64": ["@esbuild/sunos-x64@0.28.1", "", { "os": "sunos", "cpu": "x64" }, "sha512-BEjgtECkL3vY+SaSQ6nzVfiALUeFxpawyp8Jmf5PtYhf1Ug40N1h/hxlhts+f1FvSvarEigdxS3BlSMI2PJLcQ=="], + + "wrangler/esbuild/@esbuild/win32-arm64": ["@esbuild/win32-arm64@0.28.1", "", { "os": "win32", "cpu": "arm64" }, "sha512-lCv9eK/H6ZJWbE7bh2nw54CZ9M2nupBxJcTsdk/QQnWkdSjKGuxmmH8/GWrlT1eMmZfn4dGcCjRte397WqfQXA=="], + + "wrangler/esbuild/@esbuild/win32-ia32": ["@esbuild/win32-ia32@0.28.1", "", { "os": "win32", "cpu": "ia32" }, "sha512-zvb/mB2bSCoJOpoCBgYKKpX6YM6mJBlBUVUtVj41DlZJVEB6/0CKlRYxP5wWl1C1ILiCoAU5wZZ4q1P3qeS6Eg=="], + + "wrangler/esbuild/@esbuild/win32-x64": ["@esbuild/win32-x64@0.28.1", "", { "os": "win32", "cpu": "x64" }, "sha512-bm4Mowrv+GXMlpWX++EcXw/iLyd1o3+bJkC2DkWXYVvgZCqD/bSj9ctZeAMC3cIxgjRVR2Dufaiu4YPxr5gW1A=="], + + "wrangler/miniflare/undici": ["undici@7.28.0", "", {}, "sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA=="], + + "wrangler/miniflare/ws": ["ws@8.21.0", "", { "peerDependencies": { "bufferutil": "^4.0.1", "utf-8-validate": ">=5.0.2" }, "optionalPeers": ["bufferutil", "utf-8-validate"] }, "sha512-Vsp28b7DRcimFQvrqu2Wek3z1iYxDCWqHYB8Qsnk/S4RfaCQzPGPyBNuVjJV3cd6UiKtUtp6sNM77gWvzcCH+g=="], "@cloudflare/vitest-pool-workers/wrangler/workerd/@cloudflare/workerd-darwin-64": ["@cloudflare/workerd-darwin-64@1.20260421.1", "", { "os": "darwin", "cpu": "x64" }, "sha512-DLU5ZTZ1VHeZZnj0PuVJEMHKGisfLe2XShyImP5P/PPj/m/t7CLEJmPiI7FMxvT7ynArkckJl7m+Z5x7u4Kkdw=="], diff --git a/demo/up-0.0.1.mp4 b/demo/up-0.0.1.mp4 new file mode 100644 index 0000000000000000000000000000000000000000..3545f82e86b78fbee8996014b7dce2d2d24bc1a9 GIT binary patch literal 103837 zcmeFX1#n%v(k{4-G21aSbIi=l%*@Qp%#Ja!V~UxXnISPdW~P{#DQ0{2KIfkI?)>$p zrv93$S8uAWYJaP{rS6v0lGa|*S^xlm*uu@*$=cP?9smFbfG7|w#vZ23_D*cf007ok zdq+nP003ZT?_p&Ir2m#64gmnJPyiSJ^!uOb|0V#l|BEd2KQ;eX95?`g+3x0IYzr*Z zbF=-cPKbX~{FgUiz5g}+mwNtJ^@2}4mq4!lWk_yr=H?3I@XhU9-TvhY=mF#x@?UMn zWU)81HU^dv+nfE@zViV95M}`N{=Y2gt<3CP{^bMUVQpsq4-cXmK-p2s*ul)s9HfJ> zZg1^i0c6lU?EiB5@69GR`@0O^%*7m}14^KB1a}uZ;=g%}ELS%ZJ0L&e>gM{-fPi$` zK!XOPp!DxP|H=TL0(M&p$btY$U>I^heGV1|7A^*6CMIG#YZEUP4z|Aw|GHwozXPct zP)iid3_$e01t7Hq(#qwaM%ay>7kC8tkEJkHsK7V?Cl2u9MaX2z1_pq(I`XO?u6=!Y z0C_=iGIn(W1dXl%f*u2bGP;SI%fF&M`w64~OxUh&e~ko)2R0n69yAmG&UXck5Ga8% zK%II901&^L{ttby+Q0LGBlcH0+`s5QGDrm3{pAlx|5N^VJpL1(zvBR!9{-si|5+dZ zxj+294*qk0{5uZ+xj+6L2jKO8-~AD|2>*%uf9B!easMYC|69l5KhH`3c~1P-y8qAo z`+FV!XZ`&hhku@vU_b!@3V+G?z>TQsUlIE2zv7=g9Ed`%0n2>;RR$!Wy`9Ppkm3Uc zbs!{xpa((#2u>g|`4hRk)$p4!%$oAju|DR+9pdJ?xwExlv@u2$t(Fbnt|7y=a zGHB1r0|d>#bj*O19|*>O$?ibP`!6131KR6y1M!dl%zw%MvPZZD%0)nc;wB124iNvu z10;j|ssRDw|B+SyO$Np1f2Yjy|56{Qub}q-(_WE(lZAo21`wJ+NB{wnLx9i*LJSCy zu09YToquF6AP+hKkpTi&j+Y0d{y>BR0h%ZAK*#|B8YgxjTz~+@12hI8fa;M30#wch z1S=4rdO*7W$e_0VBZK1k@8$oe%b*y5+7Ftup#JxCf6EkzL6T7go zu&@xDu(ES7u^R&mq!@q-jPgq2lJsoE!WyDLO*3;-V1cNklee9@g&Q#o6B8>v3lj@F zFw@G-&54JR(bLnD0d%_UXlLxe;OJt>2&#p_%FW&msN?A5X6@+U%0p~wY+`K6&rA$F z!RBWtHZwP|b2PQ(XXatzVInqmFt+n{HRosYV&!4-VrFI~wm0XuGWQ~ObvFTWT*OYU z-au2})zHO^pP7LPXau|v+gp2?n;C*UG6O9PU5p(p&H0%*h)u0r9PNz_fu_vFZZ76_ zcGj-^EW})1TxOkheAi_QJ%_*v!}o)D06u6Ki8vP$kwb=D?1z5__6kTUxo90LvVm%pD9Z9i4!s ze`h)YO>ND+fxh`!*qQ#t8Uo)r07YU~Q*#G%Q+GFhHYQLrU5r67buo9f0-C#+8vc*& z@&hehO!-Y+EQsxaC-&x`ZUF^;7B&VZVrNii_?Z|ufUFb9@n6)~i=TrVnBnSX?!?bV zZ0!UbCE$zz4kEBFV`tz501YP~2mnyxGyfb0;Cz4EV0l1aOw&{PQ#`?o7t^Le6JU#c zWW}V70(zbB_m8IdajtMRyB@L^m;nwA2sM3!J|6z0@F5|7+q(*yV~WRV4SxnHUX~7< znmni4c|icp2$8~yl%Zkyppn_2HHL$W0HxjDR7)Rf=l1dkzhGz$#kF)e(w6SvlI$BE z7;A86B;|$bvzLSVo436NZ1eJC68Yz1#Z>9FAH*Sfx0A8g0Yt8v9C7*be>Qs75>}!J zz6X~3@1=}9Z+Jj#AKY$!FR7XP#g&G^ABdzg$fFHsklIy^x}m&7M7bU-`bA!M4m>6Q zD_A&h<0ne_M-hnF>+j=Lil4fZzkLbJQ-|Z0`xe`eFXwe0TE=un(&``z zry}{JJ-2QU+eGMawPmc?G3?DXW2orx*-$;&7E?X?P+`t9#Pli6#E%elu73kLiP*3e zMtexc7oL1>lzm$McQIi?lJ^E|yOMmG1XtkxZIZzj$FIwV`!l=pf)$cQ+OpcnhY2 zdoN2Lr+U&gUr;$+kNfdMMTWIM-;eXIfEi|~If%fnh$Gtu1~ZXyt}wlmn?!J$dlVb2 zX39@$I$UxO;vY7XR~M)!vFA{ovAj$pO`a-cn$ix%8~A^9qN)Yr5%Ft z4M)hcAZCb4;p`}-E}$Zm4N;sI&}Sxl`>}>H`X`DhI&vn<*RbDWX;2%+3-fx>vYN3Nxe<6`y<0a2xswxG>q>k z8$XNTuHa;A9lbnh39Cc_x>Ym9&t?xkzKE#J0*PNv#OGU?E;V#3ympJ{^3kuZni3N- zl7g@YQ0AHWon5NAah@VbNSwh?v`w#Mf-~47?6xx*6=?*S^_jG0U4nbY=S5@#^{c`g z<^hHG>M$gbaw%O^N8EUdUzQe6LrfOrpN*-GyfA2~9>qm$bHe17Ji-$C{KNobvLAAK zNg{+XItjeMpy=$C+4p-t*B>{Onb(V`u_!2iK4z`pSkNLWI4fK6gBeE-m%&^_^||}q zy_Fn+gnbqZ-E)vOB9~d4X4_moWeio#o;Tw?3ihI)9ziinzYmr-qJwe&+FT=t?AH)$ z9c=#&AKG#mQL4a}YVed2oYNY0?c)H0EGg*0aK5y>jm>Z&Cf$Y7`t56Mfh_+sOAHc7O0sE^r9%=*0KdflrFbCRPEQdJuM6__5dWFsPZXu@SyElyG+_m3Sj zLM_1vA{1MpX4H62Q8I|6+G|otPk2@C_`hkWA4z8N-DwK&i3sjZW@DgJs$96?3}t#h zqbAGSs<33U+f+Qe?9mA3XLU8n3N%C?Otx3{NQLJ*oet7F_bDgD?-_)%VMzQyFxvaW z=eFK@=DZPh(tAnydN%#Dzk=(5)!z3oTGZ9T>{Afr9U`4o7ryvD!HQ({6~9sR3w(W{ z-BCLRmwHt6V4;byTH5-$=8aGIre(zHq{nBan74sBdx;DUjyy&69O-n&&Qm&vh8O*PbrEN1Q#a9{(vv8DkONbmx)pK8q4JGi5DLnpYwWs zA?k}|s@^|@`ex$=!mW$dqu=dPczAZKuYbaneq!qC|%y08FKg)=`O$<1b} zi@XOo&q(iWUc0CHCAmB&Bzjt$P|LZbH7E@sRGB?O)S)wo-v7408?-QBzdpbusmiPvHiL9;U_e;{cVIKxeW^~BK@`f9h@`rjc%xVFk-5JDFVSqW zc}I4wOyIg{Wpq%1>g0L~r1z9-{P@mWCw^uzP>HO;xjgH|9EWeUS(f597IwV_zEB5cb``h7OfW ziP|5}bnItjt84MA=zJ%I86pgQ!z-Q*1 zV)Fgk#n}MHR4ugVgV1+YVeeOZq?qW^ZdmA5gLmtFF6u{Dy6&G;wXc{@gzOrG!-h%d z5gup)w_*W1S>haDz3~PG#Omxac)itIX5oQ10IC^;bj=2stoqxnh6JI>**}pJo-)ja zuj*EVL#?ocWA_b5o4T^Y34Hj2zy7FWQ_%m(DopP{r{OzB=urFuBR^Fx;c@K?@$s@vrmP&@tNFpj!FsG+ zFV=#)cG`camRC}f@t(`JrJ*~y|1*D@JhOc-aw7y9duT<@&8yk(m;RKu>eqyZ@-zam>9guqAEa4#<+wa{Ta~s1YS4)9cPo}J<1*+#=vzZKJ(&Mm3#U0?{=;T6CkcB7W7h_gEIhx~|J@u`eT4qp z5T9%m+I~Z$l95>!g?ntSmw!TO>86pB3Av zng5Yk?#5nMv+#a<=qQyRx+PPwl32%ZD$6)=@h0`WK4y>`V&t5w&Vca-PGqd{73;&^~IIKHUb6eIV6zQq4`$c|gMYK7m^2Zsw3%oDa@ljN2 zV%?vwG*3bs=sMyFVWfszx}8*&=7W4pJv1zKcCGTth7-nua!AQ2lHgphV=aLk{uLdv$5>;FFq4 zEyl<0Q&dLZs)o38+>H8m!ms$J19in45U}`A(35byH7k6<%cY#1|K8(-QJ?VP@h0d< zj`SP->fZb|Z)V96io=V%Y$^J#@#Og9UUV~J*G9nXP4ioi0M={Y?_5gX05^1UTMI6E zG9%xg(X>1=36ruWueH@?)l(jko0bV%Ba9CXZ45yH7*ML{dZbEg;a%Zl(IZl|dBG%f ztcvxdF`W=lN^fE#RP+LG1JvqqRXoIDs0s_23`X_gJ}HpM9brnI!_ozjGp%-Gdwt0Q zEJ2C4&<;5pRcTWBmw#Dk(+^i92&3ATqk8)cREN;>O|G4R<=XCQ2$Sy$GatKMme^Nj za1gs^cg$*{%PWghj9-%n!n0r*pTA>eGYM6{$LXt7)Ish3WIhv!*{Bb#?pR(=xN$x) zHHfmG`jqz>Ej+*9;totVAI2+8$jtDyGnM4~#G!&~ami-u>8t(q}}1V>!T zi+pZl$6G6=)izd&;^LuLUspxCTJdGOZG<2~?)53IrmC>*y)>6cb#=IoWk;8-E~m43 zr2DY?f!nLO{(zO{2#qT0-FZVIUEB09pXJ#tdX1u6YvY;Er+mViZBLSUUh#9=4y!!D zT!p_tlzq{l1u5t5k|1T)DWeZ28Goxo}9xYtl0It(|iCJdKIiSoL3hq9iQ$q!z7-`s3h| zddJgJpowq8`fab?c1hyX+?}vUJe*B-Y0?T4!Xv@Wc-m2b`D9Yh<}p;&W@Fz3GW(5X#>n|>8wRfO*DdI%z zyL{^5DzI5;v|!lHQ05}_lk`mBV|Ucj*&qp4OB6f7%Ux($u8mo;q#eR_j<|BHJbvnS z#DAoiKmLI59{&+$qB7Wf5K$=Yl_pU0qW!w*!_VR0o>RCK7pQUisSm z8>6DE2$y0h<&V0eg8xnFk)#vTDwv*u1h;Q+FPX@!8RT*V@8bK-hx`MbojFFicB9x( zB5QTgn4f(Lb*#{6MGIWx=ir50{y}nBGR}&t9_lv74Qns89}g70gj3^Pp>bUVP4q53jH0EKgpM<8E=|JT zUsR+;CIk3ss#s*`SxzoOWTJ9~eVrf(svF18PP7l7I1`#IJ}!+9%JVORC;Lr`lE@RAn+4{pC*2$ z%T$%;ZpajY)99uskV)`NT`DSv(S0>1DzUtC90fd3$|Nw8DcO_F2h5VF@$@8{%k>aSn*^#)cdDKC75s~**CP8Xj0 zmT5LH;r&?)8ocl)EPq^jV$d&v@3ZA})X3F`0N@{jrfp>%&uj`2^BbjD!>I0ds#9&C4d1TSb*I zmz7~}`^%p_l5%0n9X;r(WijummcbN=5%9T8!ccw}&N=n*Z!8X51EeGSsM0p~uA>(G zR{h$XGACfVImLqSKZQa_7Dx|?6h;#Ij$l!T6^oCTt!h+6C;>@{_$VXPJ{;1Y`6^R5 zlEbRqmbujZnfn%6LuQI-Hv{nG8-oGFc+<7GDJ6XNTb~xrNyUGXK3s2V6Z02!b1%80 zs|8WgjjenhrZ8uItozy;3m4pheH2elgrUi`dXDm4IEagO;P3z9*J5pLl0}mWG7OftvVKcKRvH#Dxt^ju zD#pPr{A{~>X9`Blk`c#Z9ZSHNiF9SYF@g3WH{vKW!9Jq5+)uOdcl3+-x~WzUlXu$6 z{u2UBf2R&s&(jViP5}t4uGH)gm1A0=NUvP0-?ZKd#$!uWDAX00d$ebCaZ@CcOj1=O z&V~gFlsh2;tR)YvCNX~I;#PStHt_BOxlrAd3_j4J>}?Cl=JRr8C(+uOKa+xSSl$8i%lx(TxRLYN zB>+%CGO+F26y(*|h_hCd#Sz0uY*YU=?rX}DxL-7Z&CRF^tz`d39l)jhY$W;zD|nPl zY~>tUhY#S|c?{e1r`jW$U-HZo*80`nC|N~DH@pb%Hw2RsQ<|X{mzmq!z3>_3TD~4m zMyVb~`_rg>c3VqvIVx+q1vfRnUv;(6gk#6gxQ;U?fdMZ?2MNbyJ?)qdSNQ4a)-T4< zJrP>fYI+Y9Q$J3$8a@*JR&;7ohtI8z*t7n^=({2ay*FW9t5Ha@n;hBIX;{0}>Bwwc zn<3Ae*0qJ*aoK6lqRFc& z0;-O5DdOJ1O=}r3M%}+5K;OCbuQnGf;M3>c{n^6dG2poOtq8RbOA|JiJP{oZxFFSN zcA$>vZ2fiA9l)==9V>KTM8j~68zXXaMsO!p|5h+w-w`a2`Hr)rRi zhp!nH_N6vL^9=)g7c-qKV^^uHdAmUZ=FN*eTzk#S$&18jUazfxt`1&sT69S8dKJP= z@-&asjU1xeNG&tOqDKTzZa6)!hDnqBqmAKvS7T~VHL1?vlU3h>NK-IGGl#Uk8RoYh z7|z9A8cws(!Qy9l@+_;UGc|}TeK%L`3c)U!^Xc{WZQ2D}1MSbTv98fH9 zbGj?>cV_+29_DNmRF91{8ED3hPCpR+Gm%iC#m78_$;qz6W#@hBjl@IWm(qWXTZ(-r zIA3)x=Jl`mDH!oct&=?B~}JsucsVw~j`=`RUSp^c(N#)gFOHl{Gv z9%qGsbB!DIeWojab|^CzhRIXSX#Iuh6EMYu5?1qc%QA%;)Zm!4_*7be655LX`(DQ(9tW zIrb0L{60iFkUBpO3*tOd*6>N3P1}{so22z2pPETa6p`Emmhlxnr<|@V7HJ}K5MBfGk54=NyqN%8E%3vv&Dg#XG<|?oevwN7|M)X2sHR(vfXza(`iMD)Olz&JJx5BE2 zTT?KtHq#y*Kcns;jW4R^gcXINSvW7wvnkeM$Lz|oZ%$K1fIlDH;ab@qpbztcSzzhn zJb`l$9Ddk>D(m#`X8F-aj^^t4gAJJjfZ4;pl zuN%BYYVX|#BZQXF)Y79Lsa~IrQ{URP_dTdOijynA5sQm1_v20BCh}7%bc$ue9q#9q zH}B-%a#A!;6pB_2P1$u6bKJ*+W!0 zahQ+*Z1&HKz5KKHPS=pMRY*s4#FkRjG8WZn!OmMf@M$ggBemJ$K9a~+m6}Qxx>Qsa zZEhBSV@OPane6n*+KP{Cfj#%{bu|OXk6)5HiMFgWi4Lw?5FKtr5ljd5u&>Fl0`X0C zf&};Sjepaop$)8miJu%(UFdG>ONvXi<9|I4r(L#Aax|U!9P1JByM8@|e|P6;uY7g7 z^t{)!FpNA`%3fDt(0mU=yYbv8b9Fhn=eljLx}w*@#0otH^<%(ady6hwjIho#%>FoMBs~B-g7d z$@X-+y-1e^&BaFpenYIvitFWl=ryFulkn1w)0r{C0atdjyY;V@-f)L0mxI8_^cpAZ zvoto;rQIR9N512tTGMYHA|q8zU$MDc`o`gQvzur^Ni+9kULV>s_#}kFIUqbMqP9Vx z&Lk0ETRe)dKomeH5>scbs&IVQo;6{&4jYp9>383+jxU+7%)`tSTF}Y3tL=yl&q5l% zT`E!R0zb8i;RIIWrkq6lX_u(HksS4mfHGXX zfKC#jyccKO(1?ZdB7>#`qxRly@Wm04uekY0Uo)uwq?C5M9ZSX|t5~r5W-+FXBs#nD ziK#M=JYOx>b817D+4bgS!D(M7Dz4rVsYCdE@mXb_;jmBViq)Vh_IqqGQAv+%0sXg+ zn(O|!U~a~Vs(<1*>>P#oVQMeV^f!0D zX|Y_yl&V0Ii6~;`AIgH4f%P*70T_FF<&i5`$E)*>?jFOE3e#@D*WfkuF3#p&q-bQd zChw#62P;^w)y$@umEgSMn3&?K}ouig!R(u1p7vwBkpVpJnMM_hRCbTe{0 zQVY%+ca5)dIMa=hhmXB%+OVhy*)?1ZL$qt8tHXG0eK0c-v$no}^4hx&+&8R3ZhF%p z5x?EFd#xn7J(b8@1&IZg4=3mI8`5P{1eDw#Hv?X~jmwIJ?htnbk^FT#lW$=VnMDMw zM>}(d2w}-2k3Z>M9STt39d1kIr3~wDoG46NELI1f9a}};W?|zY&L}40m+B){ck(M~ zly9byX}LB`3nF-v=s2co!aG~OKQ!P6p4b5}F*kyVGDYF5)Av@jyuh)O*4v4$%#u9u zuY*JC4ArXJ%n8>YMASF23rEFv`CRrQi3ZtlA`z*%!r$gXYvq796j zR1`<17nzz$uDbc=KHkA0aZkGWc$GSe0G(2)>NoFZxEUW>OSwTJS1*4B6z&B#j$_Q9^2evB(lIr4q^LvphcZTtO1owINv*iXs%y;ETz@lbNe|%)?1-~UOngReK07OQT8LxrzgIF6( zC5dv=z%O$kz;evKe?NiCDv8m@=tX`0P>T-y9I@Wv{RI(F+7_l6Y1lPuD+$JEMppFR zBGh--M*m?5&73)aDW@-Fo%}26JS70qWZFn03*)`okpNJ#4J9jpe)D>u@ks;8j??lr z2jwWr_`I#Wr3V7Bx!@6^khbdK{F#X5`<4>udkAg=a!Dbvp=KIXbgY)V2{dxDR7SmI zBJ0aN>J;h3qJ?`>92)v__zdbcJot~`(-PbB=)RDQpCkHvhv(ayS*-y1G#7>n2~oY1 zxekTdYg=38Yk~>>RM>MKN>eAbUlwT0R|4TAt}G+iOv3m+-9ZoK{E+&is5}*&M-sR+0Df*u+umMxtL#-emZRK>o#J9jwamU-qF~fMLcB49`ipy>h+Z1 zqY1*pf@iy=42O`Ln_^^eldJwj&h-_)a@4j+y|?$lz(YI~tl98l4Lo8UfGv1#)Pgj} zjGz;RX!o(4AbSzQ1;crYqznQ;&vktJ{e&^|@aH|KQ?LkCQEbg7h(_BecqH%Ve#h0i zm>_)|^MO(S5H?-mXPHKQ5`%8z4e&}n@LdH($$Q4nI+M1oP!QQ<^Fs5#1RvxGAhIuq zRiR8{zBwI~OQ)0pDE6IqXw`x`;*X`4|5!9;2&MW zV6wB*v4kszcz4LE^`|>_SrM2?P=jyi5hn{?_+uN|8k|b+wu?IJbKjk zL$qo6NZSup8wuM~x)TWdJMl+Z#6oE{O&+jzP@Tj8uo=m*cd!k;$8_<}WHs-0&;(Q4 zW!jmC%9|u)aY~GLQ3WrhyjS8Jv#k#31rbBFE=TTc0Pxl6hTu@f&MyOBzaCr35hGZU zpc=4CXj$cnBw9{O@aNN(s)$3swS=ST z4a`v;@Z9NE`^&rb!$ic)l(3hsq9>Z6?$7wzLRiw$l^0mt75!2KD=+$`cSh^L_hi?Ue-*&KfW$HyK~ZSuDL-i$` zTCz6&7pKZYt#_=lhB-$NRZ|{I^oINkQDyD#Td+#(orzw6F4A}PRkCu4F($>&T?3x! zJ{+UXKBmYPG=yUp$FIz zwcWtF5!;6A*Q`^2OP4=??FE=;Vj>F3T%~>veCA^mEf)2G9S`A8p?tr*NI}HcapfJ@ z`f;hh;a)L{-lAY$3W1!}8yb;M4K*+>fkYFr5-e$b(g~$1&qcGshn>Vx@-Pf)r558= zOR2FRdzTk!Aq2_^@#m#|q-TN^%-;%SZE)tR1*RY4Q8xz`>pl%USqHYbug%8i={>M% z1aTptwxT;Dd_i}b3dZibV}Tee3w@G3Zs*~_w9vZ}!}$!Dm%Z(zj8!1oLytzLK_>SOCRDyVMB}D zrQKDYbW1JB=Y3R*GiR8F>X(UY?O0YlebNuAA^Tb``=*rZov1_$em^0rMO0H(@-DQk zU6(TFQaMnsq)U!OuWe4@&w*cLr)nu+Eh+1E=;ly9$`=h(G_;Ok-sJrV{>0T!x8AGq z8?O~VWhu?`L>2Z^Nx~M)PlDf*D{kUYDtj1{Hiw98ws%;VdGiFa z0)zb*kdXXzZv7^h%`7N(#MHys@*@TB^yyABY+PT;EDqYyDLP>Q9^DH2L#I0;jTKDK z_b@E(wxVv^$!63PxSN2bL7L9gem074vO^lnaYil-!+1-j0PSBGVgV*PZC(C^jaEmj zbOKJ)keD*+L@WWrdE+*6pn(RP=hzdd{mJ^JKcF&Vby1N(Q&o2z_jg=7zX0%iL16jr zHaxPx7`nLiNZ>rEkD~p#w<@NfeRHVb>9V;4i#>k;DkU416Ew zVk=>rPr|x$*{VfVMC?U_n6}9=3^ZdItnPh50MoLej5~@%F>J1oCW2E!T8IdO;V8A- zSzD-w_!Hnrq!b?nV6k!|h+nb^Y13LS`!0w)fJKF%;GmEgx$9@7;e3J;{OdFaZ+vmXv0 z;_7~wD(!XX^%@iHR4vW7>zs8c{OpWIL(Tqv-tZOeDVR|9AZT;CWFjMfRK0;TIc`}; zr9mbDb;Z(Z-nA5d1}6JF)9%a4M@2apB7$G%cu2*Qs?s6C#jvF@=~>0kZxDHWoNfI~ zTB@6#I}rG2=t>EL8O0&F%~)+0DNh7GV6iwvz=%j2R! z54{cRDvrzib|g&Y$&hg@Pn(yhw~#@?ReC4Y%d14~w9T=P&fQzTl2}9We}PPGV6c9%s>kg}RO4l1dRC1z5sq z_v0FVM;?MaR31VqpQ&CBl4fzQuBWPfrZfk$@LPmEn@PdPi1UA}A2jxi)JMsxljea9jn=^~O5`lB-Qa?YLM*RsNdqaz#QZuy5?_qt&Y7O7W zAD?x|5}pQA40QMN@4}G?DC)n`^6p>|3$=_smojfI_ZYmtf9kbMXsUKT?bs|rYlC^$ z5!}eAXhYDPORO1QT4Eu+@IcxEE1S>uhLm{lY=2HxLn(uLIEjp%gZ=fVJyrDFYqI^z z&H!PQM(?Ng!1Jf00P7(4gD0FWk(I1^)cOibB zfctev{|7!>tluLb!Y8A%K`FC0b~Xq4PoQ;??dY>HOH#4KJu>z_@miN3U1Et_hzgqB zd}V$YvwU`V}2BE2J7Wc~v&b*xv<0suOvllcMxgQoH z6MUiFTd=DMBV`NOWbYwUHF)E`2!mz5@}T$QB|5}r--Wlz0tN`0m~T|I=hVq664KfZ z(Bq-JAN-q58{QP=kdyZdud&TbH|tC%@uuj%ia=5e_;r~D?oiuPaQ?v^Nq%HHCu9;Y zS*IS}RqosHJdtp5I41~6Hg_QTAXmJ{*G{Nb2!jR-@vEL%{||zjV|zVL>?j}#_DwPi z3}?9VwEek7>vT6*YqHe(f>_YY5M68N#$?(tou8eG7X7{Be5S3?_i>5Q+6+53aaQRU z@9O&3pBRl436?AjDNr7=JVQMn*XPLNQc|#7SVjt?qxtF0p+ffwrCLjb+^6!#XmI1= zp*BhxmTiX7j?eJoCloas&Xt2sVxUbXd*9sd2(s-8-(XX|#eToGWgxhh9e>Kz@%z$l zNPvcGj2S(U`*0{5xrmLf53j&>VdZ46J1?+0!0T{uBWJiI7M>z8nC6JQQrg0b+iu!f z_VYWF>P}Os8r#fBO*V`(zPOWZu4I_X3f&ruct*DWAXLURGp{pTOj(X(s62Rl)sLtC zVBaZuex?@B``{I#J_QbgV3?gzSfXi?He1xU?XaIsz6VT^nDGsBB+ug8voUiIocxGr zGiFc~-=~h;sN<>MehX$Cd~17&bMEuTBpq-{I;X+n2^F=4I))jVwKDlemd|KH`k`q( z)+8(Yd+Nqm-3}Hzi69Lo%i%>cJOzeEjNQhMpdm-g#`NZ;OrxTv47zh4CIk6-j3+f0 z-cUx($ryLh9*rDjz0l;vb%NYS22ZU!qJBam%&kC+=KQ$brh}3C3(hy_*rnkJM&q5vDj}IpM~34i^pG*@d&gg12({37 zyc1rU>DW*8m-3hdaajpqw09ovS*_p?634MG^j<2aEBVvxPI`JH$f)EV6Lsmo45$00Cm;6nyK zRgpW}c+?oVdc&`ke{rhzKncqfRE`^HmyE5queC(!%Ju=&Or$WZvOWQ>ohtknbn-gL zuZtSgT#e;hhJeh4BM96kw0|~Ko?2^RCHyr@n{5?tk;SonC6Q2xGL7( znQ)XdF616w9B$I!ipOj}EqPIYa4@d14nN*Z{{3s~YuJ<9^s%hFX#%W+r z&R1LlhG(cWD_ofCU+Ustgqa`i-6EL71Vaun^PfMR1|IYO5!QaYOW-^nxMU}l&nJQ}$-4)Ism~UUH|D#fqbKby@ zN;oprT6?`h!gzTk#dRqE2acKtYPDrp=htbvIV|ur(SxftI^rbe zKF_JXP{~`<(-5r%wU@cE3(~Cw^!N3-GdFi?ZSyDO-g&touT0iM7MQuP2YueH3!FV= zHhY{v+&rj(dmkA+g|LCvK2aoN6HpT2M!@s=B;Sn zsFMNWmhpyS=L2qGcAWw0`TEd{m_hK58t@0;Px|`l_QtPP*}w7<*p#7oQ8K0SxZcXG zMW&X&)KU&96^6rczPQ49B3o|!bjhmvuo>U}yb7@Z;Tw_j(SR7ap1Z_GMKr%{B`YJN z2R~S=7G+6`htuvI(jPosw?;ZT0Ne-V{tvt6ZAYb2cub5~<8@$l_{--E3P-+v*7Up) zi=C+m0aa7a(0E01$H7*@dzd-3q-^yLb?5w91)*GXuU0RswLgm+&(dsD;t18=&@*@GTNHNl2j@pzzb1+e9ABpnTsAhYhRD#75S50X#s@^@Q`dI30a%udXpzpwux~fDw+E%U0hEJ3V52`dd<1c>lZ9Jizg%QiO2c2?CPwIETEY2jz8L6U9)o-rs+ zCfcFlk*iX%xikpjAr6B26|l!%_*f0-(|fFD&b+oqRwONP=%26GXYR{KRrk{CMr@3? z6UT{h5@8h8J#u_oSs;gv?AEe=*kG1%lVOPDdExLW&P6Z?v6|r78tfA_B^24isnLEZ zb}-j-X-tn0?Tz$hJ>e^R>9b{dBRhxn(7tVA`f$(pWM#4;G8>g^8&CD49FF0~M2rG+eC2Q&C!E|26&OMf zWq(`I@6QvBAy{T88~5xN>8IsoFe?s@F^+AEfm*7vtm36U4dN&U!&-wX_gCJ#gS!U2 zKGjXJS8NG$1Q2-caJs2>nA{u19CE8ONa|mPxUxBPCXz5Ig5yNxqTsMu8^{VXYjr{d z=&E0Z#@1)fcc*@;tMoM7f=A_qjnvkWg>Gq}!YX~xgrI{VXG(BYfZc}HDZux3g!h&O zpOYci_&l;a+YAq$A1IryCT_0UIV z>9_Z$31iSLgWdMz`gCB}0^??I!ETZ_43fLsU_($wijGSNOG=7>dI3XtGYw z=|fSfz0Ml$@OEYxfO{nZ4n6giqA+wr| zC~?QGquE9&wZE{@Fw41vrF`UQLdP;XhR_HTw!fFJ?n^o7bS2FFbhh*u_x5a3`oyV~ zs>Y%ztNiPl*D?5p}b7OhCJK2)+@-HJ6@xFGE4uWb>T^E zCU1aI(S7hiQ7v+{VOl00%uB3bRo{#EbxW{tD!yKr_QXbP)1}QDBU@_7XZR{7D%Ukb zXhD)sj&V>WX#X4X{07Astk{(*+E}s+rEp_6@~Qd^Cw!}Ng&kMB+SwwfYqJz(Ri8F* zwph`kRT>KJn%uzNvWE^yV{7|+fymp%s!Df*p>;oAk&fbCqr1I>AA{2(L%YRS&l*>j z)?klt1Qc;-J*RgDDB{VVauLBy;2a(OJJjWLp;N|N^-G>g`0w|e;EX-rADtTSc%_(l zzf$qK5_}Wwj64Q7O}2+W)vsCV%NEkP$3q8u`<-Oxi3`Km*{o+GQoY;VvxeB~LB<%1 z<;-lhU@tG=x3l#VWfQ3qO>8O)Cbm(e4>n2J^xu6|-&-+o-mXU6r@g2|OEXd9A?Pv=z~vvTlp{RkIb9)cFg|1IOlU_6^Tfy(7j zZ+>S-*Cz@`wzcuC7U{D8r2G3j6COnQ$akiqW8^#J@NHe6=#nk!+A}m1<9Ijv+fe<7 z!!wcarG4B272DPHdtPl^1F#|%Hk#K6;d-0ebD!y>w20zRYqZswI7m@7W2No%r&nY* zVH1^AI2%ZAj`Kblgc3Xw#2ufN<+RHL`%?~UyAa`0;jcd6R=73N-(*5~j&ZTnUDp)g zRr#m}UiC-BoUz3{O1q{1FZSLts;;G38(p{)+}$O(YmngX7Tn!~1a}Ay!7aFJaCZn! zaF^ij4&P$$_uPBV`L<-g=lr-o?igzfV9{Oksi(WEYF72^IV?h9GyDOP_jKn$Ae(UV zYXbQBQ(8Rnb>AUPC2*7bscV2o#txs3Z<_9%D{{WM++*7k&he`o_rb|)|pwf>`e{qXqU}%On|;SBxhjD zT4#9j%^)~ME6gof;aMrBXBZ{On#jZRZ>NWR0&&w)x@3FT_}@&I^^qvsc@vXFN0bVg$>pD|1iK zmt&Iv?<2X}u;^xJq-89;k13R3s}xx^s7|;jkKF$;h<{SDdeUIz(=G?=X{j@0Ww_E9 zjF3XyW#}n;i_b*>zxAgzI&pzUGaKUv_Wqd>vnx6x8{7bICBi9#Kz!tJ6D4#)Ya!r6 zIc?r6ccQwf7y0y-livXRXkVY>48!zl%Sqq6kmC}TAUVez=t!9HGt9%X**FTQH`Uy`yaN1FRfB;E2Ll1uy3Gp_GPo1rCwM zTAzbJwDE&!b;WvO65f4s``+f|2v%M9Le^Gd3KM&7d6X?I)Q)E@N8`YF&C0V?IPKZI z-7yi_yX$?eTbwOj<2-_4WwBy!oh`m78ymuPldd}Y4Um`iRZN&$`HMgu=T$9S>BeK8 zRXfc}^iD9l1atui)#Je$+=39O=$mGjjGx!CR0<+|J|a*^QeA7as&xHvwEz?e^HPs8 zvE=io1s}y4=N8~@GJ(*fG~z?7yEi@V!gzM&kTMov4i#I@a1pqH(Cmu6Ya6Bu4q9|) z8kHX&fCu4#0gUR=Mg*4<=(w?m6E$9hh-$6gh0bqO#Po?gyRo@Zm@J>aoj9TlLGdX? zh)`jcURmtxqQ7`LG-zAbaw9Zj9$)Wa6=nE&uNR~Oc4DiR06qPrj6!3*`V(eo;9+`7 zdW|?l>7z@uc<_v}uKa>%bHy~B?HErhVj0#r1Cf#Fiv&JLO$Y|#MPMXTwQd@IWY40; zFtl6@q_;p&>yH(I<~u||g8l)8`(8WcshEuF>Cbm*cHGpg;CoVZXI+T;{*lK1 z;$-Y$-$Q^rr&7Pe#aX#XrpB$I&_W#7ZDJ&dMz?C%Y7E2?G)1Psh zpbH9>3O|%b%f9F-h2{UUe@G744YbkLFBYb{YQn;PKO_hv2-Rz#o!LF!qXJ=+f77EA zGlW8tl*hh#`ZnA92hD23EezIFDi)h3hpFgeUWLeKG)=b636kw&AEt*2N=&VQfrH|U zbT^0nx(c3o*xiAus*w8pr`w+37YBVUxCn8T2WM#<6c>@tVMM%{^%ZF;XfNXD{svU~ zp7~ML*>e+==aLIQ_{?p_!j(>7@pAwWs2#=SdqytX8oVopbP~&XuLF(00eW6G=2F%d%tsvzCHOUL?Siv= zoG*)BU>;ZdM4Uw6&4&u(%j(4ey#oBV?~1;r=k}-NdKGmpmddt+-G_t*Ixb>w>r_nwmW3Bh=;%-ct_ltXPNc*!k^7soDikGfxZ@o;CCgN3k zT-)HM$Q|oYllx&ph-;U|p1vZ2j4mAS!*kIuhMUBllIq|MX@+k2!JHEmSh1FFm_9b} zL~xx)1h?rUHNIuzT0b6zW^YiT<7hY~b_Kd}xwYS~|AF-}eCA75yRdNxAw}bU1*@!~ z^!MK3yfnQROWm5RHrMD&Q!E*NJRbhSWjbG~0Mb;e>wX~+XMW5$-b%Uh40WPf2QmOr zlO)l&04;aQWYt0y46%*H3&z^Rj=$-`O1@l}s~qgY3@ZDxZV64BPyNVHchmF%Pv!`-3&7$a3tT05>f)srn-( zW-+yOc7&D{##ddqbBsezWLvq+hhHdX4i{p;cAk63NVk zK4vl(+L;y96NZUH!@1bV2QN!;H}CCE+ckz6%hXz!*3@wm6v@%tY7$+S%c6%oxT!h~ z-v#iP&1zV_y~#~NJM~6`5-_@rGG8;Mf%_&;Fs_uzBdgl;co1Sbe(8d~D5J^9lTn5S z1hQ32Sqr0mUrMXeO@6TpTlc0Z^Ku!QpO)U4FyX`>7S09r}NMSt48?Z zjXg+nRli&|HtoneIUerye03y*o#1x!s;UGts#F=6{bKMhUjw7T$Ir7u z?k_tver|65Wz~Hto{oZ41tSy7kM*W{k)AP(SYJsU3KKlCZt+6igt7^w?9wDGC2Ka)nT%2N1L&4|igjVmMo-px?H z2+c_2&XKCcB2L(0s*$Z5Pg@#Q?A%a}{+a1!$&; zUTRJVDdB*K7b%6Ia`85}Q^gNvYR@90phrVAY85Jv=hb%(AfE^*i-dRs zMZEYTMo^T0FicYXWcxDWZEkkY&vNDK_v1W+H@bxtnYX}2g_jdIVl`2O8CZCQ6ccj% z2G^}OyF1{@qU=}THlca)g{@dq~Q;NWhnCE}VkXp%l)FKA=O zbLVL9$S?y@qlyFf&)PoUst6DeQqu4kY7|IetXnk(!A3KoNXPQa&AtO56U?yphDonu zUG_}S(>@%UuBtB($E6vZ`g-<^yDmX}QO0YDK)%Sn;7ZtEZ;DTc(*pn?Hel7jYxF2P z6`5H-O~&lsqG%9=?3Q~$KESPxvM{dcDlp$z65hu3KST}%W>xy9P6Uh*WnMv{9#gWU zB7t_t=CaMGDr*w9C<}Cl+07=}ipRBMa#RI>Q`g;lls#uB&q#??)~yZ*^WYjlsz%kn z0;hio{ziTp9sQ!R0JTZl524t;dyprvjBjiP*VTu5S_XOJe@?OM*J=MzmI2Fmj;2(s zNq*QUN+b!-5YmY52je1WG2u7$(~c(U9jPa{EvbgVi5Q3ckE9o$^708E%jCgl6&o%! zw8fIy26XbYR-ZxY52h^pUNEfP=U@EGYnTt zYv^-cpkFDb<#->!P_)kFVANMg@3Eq+0Y9WVCgRK8y@SgEZ=5c*VbD8wz%jEDN8?^mnw9f8Fg3r+-vYMO0yyp${w_KKr=(VF! z!#SzIYQb^-6|HfYncNQN2#JG_tLx8PllpkA;t!ae0AtpU?xW~0FcrLeH@OtehasHI zaHFcDyv3&$O9B7@%-#1c2;ZwSs}KIGRWtUM4_rh}qE)1{DdzABqJ*U*zLvd@$A;U? zV&F;h396Hzh)`~o6ahNnB2bL(N5G&!bNXiA0x#uY05Z)cD-2+Xoh36!Ok;k31SXll zoM}w<1N;dIYXw;or3;G7P7hpr3-6-8D4 zfnD&@l#EiNi78GOWZ(U?+iiD1vbbCZ{igf4A?S61tC=<7yv=9o#m1@2Ar{zJ2O9|{ zv=>#fo=Dk5@(Zu;YJ?i6`n8QvYRnb}|Qt@uB zXq0R%{S{SR-If`Z2fa$y)~RL*_y)>3Y%9XCiyiR@)zoD^1Oc&aR_WNc3sUgbJ7nf} z)97j5{*n=%Rm)eH!@9XK;X`Vf3PEm3I6Q?5hAsB7nr#wnG=2wI>}2NhkCb^+w4#n_ zvP(!bFjJtR#{378@D5xkXDqt#!=Om$3T$$7SO^|Ph4L8~Hs%rx^Ukj0cO*GWBjuC4 zXJk}vURr3FG&!g*DZIRVe5;sj<_OfPw@J0O0)zoh=$VR^DPO>XmLj9s<_xl>_n`+W z+)Kw+uDY7r$$7DQ*lEXxE_~f98Pngauy7+=%FQ1qKQw&k73RVx?5GJ-$85TR7q5OXgr+k*?^6UD5+4)k(%L z-_IDd`PdITj&t2wMno;hQke;HMRqTyP?VkD`t74Mh`Ye zQ9dtj&R&4m9n+42?I3Y|M?HpCe^>Q_-{E_Hw#GkHj1_0J*q5NfzOU|54$31uf@rWW z7>0{ymX2ZY(QBuT3(U>9=X#v(v?6znqunFZ3D)*Os-xg(f7TW3AltCraUZMDUUT{| zbCR}f6a#ah{UB6`sWKP8-#4A`&FtM`ws(5*cC?=1hn0%~W(hi{L4M;rq@8m{Z3P>O zRyzUKz@h*%zjERZ|nnI1m(%A7qsakvkyl4i%baXnjHD=Lg@0xFxfX3|GHI4|DfKA{Lp z7pM^s2t)9%wPz?gHajwXNk%>p&)d?nt~t(DFbZ;*iMFOB z%zl4SD{?Bv;K+Wx^@$0|eQLUwnZoe_55f(E#y<9g4Lw27@%{P5@XTe^cRPq{0ZT-( zkM~)PBED!Iaw@B>oqQYQ!?AtgA6~o$VB_Q04>Tu_gDHjk7d#uimp{9Z!$bxbwY&0s z9K$=@_A7q8rr;~8j~aM9Yx^k@biwCW;3gcX#gtD(qqr==JRD;wW{(-{_FS!l)^kQT5$j z4q!K3cAB}cs3St~oEw0N@J7U)LVNa8U;vRO4?=e8BL|cBpo5y3-+4JbGII&o)h)>2 z@$4BQ-${%8bUgFGajNWDYMiPfrw|oZ0)-Z7K`$JCmYeWoQr)9hS08Udg;QVBzm~dl z@=^H>c*S8o27#%g>4KzvKed4}amZ<%&RS*#Lv7TL-FxhuY2)R zq;UM60L`3*_?fTk-4ib3OXEhWYY=`AI*Uq1*u5L{3aY;ltLk)+BD3RU4jCC;y4sym z&$Mp@OE>-Et^Ah6OH!3z51}<)Io5C`wQ?oVd3@u0{tl1864xD+Tce>I-O1G>LXu1+ z3Oy@JPQ&UhezPGp-D2;c>g7%gv4&IMI^6Sn!E{y92Q0toj=N@Plnhy(xh%%mHcQS4 z-UTmY?qp}C_cH={q_bxTplv(*KHSI%fzAe`9x1@>*`ew2CzBfV*Vw?anP z_Hl`eVZnuMz%k8|KjmW@56f^*&^>3LD;2q~5en3fqXKi8$rjS_)dp~C& z0nl-bPi9&zG@Oc$?E+Un0z@Zbh;b}S`g3`rjFgh%Fblu3+P1nLZ4BBz6v1eHc&=6O ztiQF7%x~)RappYJDa7IYB7NW(A!g*Lv~x&>$$)el7PYutylJN=>n2_ladL*|7NT&N z&g~oCUhOTl{V=gsmo6+j{#rx_dx{ukg}^t4 z3hQ#v;h7dj8Qeh1+qUmW1s?#L()ygpQMr_fR5ru<0VD`&)k*>#z_YLS6$&EX*<1MQ zf(wAo-}r6wrA%|XufJKp03eE}x6B{ePdtK6r$doM%}%@lLA+2s2lrIuDa0U$Hl77^ zX|`Q1;czg{yuND*001ZmW(aWxdIKQJ(i63=3fnXVC-yh7KB?(T!buM@cR?IVS$EtJ z0RRM)2=#7bL2(@@9f(<@UnhO``7n9_M^xDYsPSt63?CNEk#5LK-~q$yK%v4Q8Tzb3 z-T=tcnS0pfrt8*X!^Xb++YC#0044)Oe+i(s14C^z+=`b00y22 zK;b8p1sqCH8=x3!kPJf$pqT#{Sx~sa{;XzqkM5fLqmI{a!I_9&f7JN`8*>Y$m`M~0 znk7p^+rGRGH3&bollbeuL6+c-xG@H0X*@}dGKhd3aYLTO!aFXH#-XZwfai+~0(-Lv zW(3hIFjl;_cVcjM1;CC?QMv5@T!+TC@_a*sgBNV{r6&CKzW|-%3M)k)0Lbe_i9s^* zsF5;%`~J5XSQ@)0@c;e=n0{?U3X)M^^WW6)ccyfCZ3oh%6$KOt>;s?@Oetl9rYmAj z0tcRT2~^Yoh<(S2ilj{CjSYrrEcC^qv5aq^JEPDzx8In3i}59 z1r&HS01-&W-hV;+U&Vv!0NVh;9{d{E(_aBA^BdSq#D52DCf#3w)%^`@Cc`g*O=bNR zu)i~#srYY!wf`%yzcZWZ_-kNYe+BHnm`(U+U_buOTCMqinzW#>?PC6pxsK6~z|0*4 z2+S=2O!)U^^?!r+b>&bArndYF-hYw1VDyitEh$Lm-QVDSJ&GOJ?BUn&uKfz$-}%iT z_-A;3=Qo4zm+)r1`vts`Kq(xoJzN0=&S1r)+}(5R-xZD1a9IPjn)@8tXu>d~Jy> z|JyKR82*A2MH%FgjVC#QN4;M*9VFRTE3uPPylE*|Fh)-TD81C zf&X8p{4ZH*&Ofu%pcX*Tj0fXDv>>T!$%E@E2;y&P;pb92Uh#vy9&8VEG~a&#|63s+ zaQZX7*KW$4z-~YV_WnkJ-`Bt|S#LYRl)tpzKW@&lFxX(+tDM!T{M%ZjS0#?r)6^yS zhd=H3?_}ev@czgz4-{c)t#<0mRr}5YzM@C}UiT;+T**s*|G$i)dKMMyd1rn~WV&cmz1xdgWx>@wx% zZLOXHU%&99l@Q*s5Fc!~@4QVMD&jEn5e0RR0#YK=VaEYX?dl@wxcYFgDA$i0s*)F@XqpV zfUzPtn&BoEJ%ZV-w@^IdkI<@#J&dTMwNhU{86#}av|_!Fbo3{gS^86hx@W4bLWdpi~cW3F!hi9AJBLSu?0-~05Bg*UcjvmO~p(L zbzVkcgLBoc=aE}vSyI~$;jXFC+HF7YCn!l`*2)>smk&=RWp>woqsXRqQ&JH?ltLCm zE{k^~K!UK&q_0A?G(eRvRe;sVJ#-8kOc&-#gH;~BB@a7ADhb}2?{-II?=*M0UiyCN z0|4l~S~)hsU-Gw_{V-+#wcguYU_UU>SYStTkUw>~n2*uPzmv;o=KJ-G>-~2pc6V;YPg`%zXL#HlAh|C=?51MrOn}@!pF|JwO zi1!`tFGK(U7iSk=OZcWYNp_Kr>2S%@cSYyp?>E4$ap{FXv}J754G3mqf~$B&Dqb#_ zQ|C;**`XBG@P3lIlib7v%As(Se~8}-;YRC{QN?HB2%w6PoAR+$sh*im)lhs6D%xXs zA3KitVi4Cor4~NMnz#$#qL!AEmFk2W4#4z-KBlMVB=QV`WVyd;M0svK2Z(AgWe-69oO z1rl9RZkA3eAzeF(G^10?1u@4D2x8+MW~XK-Pv?8P`W}kgLJ7_0Cg)T## z^CZyn(*N1qj9)l^(=NqMHAAa&XYMC2aJjgDvM|vJrOH-)HSU0UKFS`w{86+W0-jn^ zOw$HV#B~DX}9v}K0+v(BaS$|nr!YeSbrI-lZ6A~}{R zGzTRH4pHuNgM<nK!WGXu&v_f0&0hGX#Ajx5 znx7sK(`QxZV8z%z0~L;;Zs!0ShhPFRTjc|Cl9^^5U5fLDz@5UFw8S@x|DAltngL`@ExU%gPTPRIqbnj$WibO%mYBn zP_AdsVef-bunxC|P}w`g>#9un3Rl?*YcpO)-F!*PlLCrKwgS>M5vmuIZ@!=!5y@!2 z!=N&SP1-H??nngg*`veSq~w)Ma~+^2(-H z`x+nqwN9~Q3+q|^z;G8I#lZS~5xW@{Wt;&Ln~zjsqaG7#!(xxSTPSol|5s+C`;+gO zHj6qYRbZV_qnoGvP-;~=aXPRdG3I#S!o;fK+)XWgjJ!iKDxlI^l1?9$am0#;G*>yp z&4c8u0$2xz*ecnddifT7QH^cUBE3D9uH*Snu<(Co075!k+P>yyqL&RxH!l}z!JITY zO_GLM@AuVS`O|NqRb0BY;?wa^*M>}L2V1o^Cvdl8UK)!@__CTnr#m2D0fX#YUU<6#ZH*E133+(%{ph$8+8i$N>{p zWgY<>{7SNhN4%PvquiG%6zDf5hk|q&`!W{DH)O(9Yy=G#U+4PQXO2Lbixq#;NF`Fp zQ_yFKYe9&niB!{m*0glIjsR7BoBQ4sZ>B{>i5K55kn&w;2RKD38%?9`}91I-fD zb2;zHn>8&tEO+IUD);VMK+adyw}7#{rLq)?z`#gUx9AgM6RBOKNj<~+PFUC*+iqL( zj}Z9|veqXY=oj;@}JL^{sr|9PoW;6#OjCJ9+Jmbm&cfcHg$nZKMpj4u`3- zO}958V7s15s!AwIbk>Kw&3$Obf&Jd%rY~||%q8>d(su@GSX6DdxuGggh3BwD;rfMdEfv{sn?0`A@}jaX zkQ2dy#}H}w(eXJgS%Nge=4C}+Iw2JeQmRT`Fs zm*7OP+-RRub8SR2Z@--VIp{g3;Yozq6E)hglD@B=HI7!7M16NxcENMZGSBM7^v-zR zdomBlU7UqYF24qzSM!q6x+KwQcjf-wPx5TOyzI{!%J4aA-aM-7gqUPf8Hh@t45lH$ z1bYn!NtsY7J45`+w8MpmnR$Ls%IQ0D7wSHxZ}VTnI6$wDe)N}F(Ad^#?G>^pzJWd# zh!>Dtvk>QFSlY@GC;L%y(iwX$#MA&#*y15G4bErEFZ3O2IAWlLz66WVGfz(UJp;#* z?V@QzRWT|TJ>3(vFoxU*q8b?(XryjmET_?UxwXGvw1?|E$xsZpZ1f#Ds#k(`8$RJD zBDwYHd$I1m)6XCN@ldhB(XY@$SM(jREu#GlBl#x*doHPN;Zb|-^}F$Nw7SEUnaFb{ z(9ZrK3b|p0>RZhP0SIt>JMOi9JlycW?W2MmHho~>CdY(r${&I5b7`e;?+0#l3a2RkB!t~>|JfTk^9H)r-uzzfGLP6k5ZKYo>fPQpV zpyXWwLMXf~UCgvEoRG{`yyAPe_=IH<+wN){-IeL0lCs!D#&B32DHG4p3azN-8ANHO z{BYs>^z(L#6Js9^Uw5d$8CXJW{0zrjR_6d^2ZuJgi4Ff4C-Q><#HRi6==xni zrS}XX)Qf#ry`qC9oMksj{)joO>l4HWit^3cMz&xp8BTG=1o}C%g7WZKjGyhbJw+8i zOM;a);At#I*{3BPCjl++d{(oKsWd64PEDIzw{Dz%wtAL6jYwF;r#ok%gVT|G>h5+V zBe6H%7tynO4nvoK7^`4N3oCD zKS$aro}Nv91c?b-mIX90UVKh&eYCMkM#UXB^;g7J^kZ{d{E zBYahjonIs$0Y|qzhr@@~wbGR=CY9O)YR*YcRdlUczpYbzZ(A3)#JAlSdA0X^5(xTG zxh#1xZJ{a^bQrqdzx7vA2qE|w9aMiE8Iw4D1VM>HEcZ8<%AKP=9jy%W*n2tfNEqeM zj(7E6jy270NJ@ACUPM9WuwrjxmqHr60%(yHR1tJo>jIw$hhwZnymjEdhBw0{C|CaA zJ>H6FPqoSZTApuXsw95m)y%cW5>T{tr6qB**G}afEF#PE(;%LGf)_2dY1!Eruc6jd zsqrQLM*=N;I2T9QEVngv$KkS;90W0I{ATBIBl4e%!^;(i9lomHquW_Au52kserG4k{UdqvHPCAsCAYw`ChP>f^n?_ z@>!WTJ140qA!Ay$&;|g-*w$)v3;_i=U>c$@gndMr6794Hd_nZHqkAZw($H|3(!3%w zohsd+!5n7VL75`KX3c<+rxY`MB5wmgQvLSu#SiVuJHB#GYAxN#n4#*fME@b)BykhD>8u8ze;XG zInJFH0$8-w!3To$ySCBI0?RvAkEDlI@HsG*)it}vb1&b}o8uGpvw}5xuTk?j;}Ra} zQ%!$1=)h(whvF>jMlQBAF^spgbfXq{qr47;2dw%1eGU}@-CY)Xkrpc&05vrbGA+FxouraE z=>Y%?2y9n$OA`T5lIKT4cxOmZkw7tlLWTc0#oGJH+w~bz2+Hk7(h8WxwaCIF~p{720AF~cP^WU}j<8$)m0gk}6t07Mhyh6(Sy13;ygEQy354`ThB5`U7q z{WTtZe;4tGHNJnq1F%H(%k@7X34fos{l_HyaXR+ z{Bb??ACd5H#wovf%HNm6Ul(EjgM{C0!aoZdW`4yx{7F^z*GTx?Cj5`Xg@3Z|1~?P` zzIywQXTtvnLIwK2sR(1a$jQHTLozV zPyuBFg#N5p{C}-5j`&DbDuAG#x3kUWvdFt@agb{;SpeY8DNqXEpHz~6nKQ3HsWJZ+ zhl4fOjfGLK|h7~IL@VQ<%wW|&FP!L zAU2xc(wb8gYR_Z^os&-Tmcw*(dh250#|dZ@bh9{)2!P7e25AT(+~;*nWIBKm@f85c_q!U)sdtpCBl7bE_5IYD(lG|xO4FFLCC|KaXXKDUphv8o^>%;lUbl!`;+)>GM|qS<|S*wsSS6(tf7MZzeRU0tYr8g&VQ7jV4Q707xDvAyByD zKg^;09uD~~g(5O+Pabs6@c}0Mq|O@z05GNZ4kVx}0O?n!3MB52_o@9?;@;;mc}!O0 zoB+Tl;0c*+U!|1w?*agVuQGtd{e1=n89I3{Ud3922vE>b!H*eR2mmAew*Rj^;ZA>* zKmig5Y3+G;Y`qegRqJ9oFkqV>%97XT`|jZ#l$RI{ZDDW4N&b4m& z1WtgtRxk{*H`I)(7!P{*mP8j(86aJD5Rr6J@I)0tivxmRJ(TF5ZKeCK9HTCVYg&TC zeFBKCecW8iR7VbcAC9&5rWoDfb^ZLdcOJ;}-=}E)ifP>RzY4p6sVeGoCdC<|liHFkqdx*(!YW*R!%hWd0 zD4E#3aIm)_;og>y#f*{MZSTdlWyR6U32ZW7!Pn78RG3|;)IpXvLLd7ZRK%fUJR0_# zI}}G7OZmzn%WMX;rAx}Sns#2cX)G|{j&3Bi4B$5uKd9?`K&Oe7>Sh&qU!)YW5K6Mv z;Lcn#dvEhG-%5Tp7o*{T2#)6_C@XaZB5r1f`bW6rcePq}Q*iG}5Lyczy%1kSrg(P*4rJd(7I9GXat)-vf%XmUbm=PZ zo;z|d2p|1!#+r7htS#xPnHQ9bynmHhn_Mj9LI6OtaoSWy2WN{$+Ygs8H-GE72|QSc zn5Uw{{q2wTdiaWW^d~86qN#TgpHn1i3g0x&vC|d&By0G=%My8|<9EN}j$sqq8rSh- zUGcyfidm<1Zscm_WNy^51~27k-R*vCR3bBi6*g<@w8oDsF@;;gyMliK(voMDCumAD zq=di;n?e|2L|Oa`e_25Lska-((WLbG%NNV|fIjf*Q7G-Ajg5w&c)xOmHsqI_$8X7H z;Q7#kYbC6b0mhJA6ZR zda2DfMEY2TDH&01%}?*j;W_6Dx}Yo-Uor&Z2r8d&4@rW*H4~59Cn2p%ADzTS2jGL0=#N=s*g7^ZJ5H>~36Umj}h z*_#J|)DV5&T>_h#D{*3pkuFu$1eUQy_A^WyjFasKRQk9mOMrW``t+Mw{tqUBFwvI{ zWkX_rg=72Wvu{ga2{$AboEofT+u8B5cgehfy*NcaHo7AjaT{UVv@zEvF4WA3z}y{u zf7XV@z}m@omsKtv#9y%vHKDk;8ykk3hg|1a&`sBncOc@Nwp#@Rr#kp6^#?$?NUrn3 z9G7m-czYR^b4#+@yFD-9F=|nu@}-+&iCWhNUW9eQeL5%%K{{p?0a$kkPLa zdKp2{3B=)2yq6_mT|NQy6I%@Jq>geVU(LdLs;+yC;e}>-#~ZX}q$9)WnyOuwkowAP zC9kD(H-$UQqd^yj>s@yB#n#erX$LcmVSZ`Je?}w$aEB)|30^fbg}qQ7B69dLW(5&a z5v7=?NPcvPw(N2vYVcQoN-ozIGl+BxfzQY8=}Amp(P`4nfm?daaiG!2k_KaE&O?lz ziCr-D?wHGAA>wZyF;VZ{8oTj@xQ3}}R({v7`LgNnQm<5?ek0@UmCO4;lU6O-1ILan zoeAxlakzEqht z1EfAG7J}V&43gSfT8EJn-ia+PEcZ6_cRP3~a`sfdA|r4MPi}c=Cd_7>gM=r< z#HQTCZBs>Uu}Btr{>%A1?3YpmPz(xWJgbuX-yB$vBiYt0YL$1{kHstU`ZgeH2%a7s zhzstm7!9zLi~F|tn&yyT=`c&CVYBd`&`?`Q^J7)3j}Y3svkP%kMlndTR`HRlQSdH5 zz8tAbh;Y>82n_OcO*KT}an>bm^*Xo-Xtctbb%#CakVnLG*`%22?HC!u=OlymWRulV zN}n&z;j=&OcV`fXbcv^7Zb%yz;H(N&xI=dngFp*Cz`r=`_st@;eE;0rKm?{3O-0O( zLIwdgoI(Dy*fYMn5b3`(WIi|{TP1(bkK?9LUvd8qYCKC#NP1h-xdn?!5mf>t>|V%i zU+l;`%-!dkclkU|k?(hd;WgPAMID1xxdI9`TgMC+@)^^g%TG}ySbpd`JjiGGqHN5e zw4pqPgncrd1U4&ma)xWwdxYHHRYJC9@OyKiCP>p3E9fs*Q5wB^*@DQ!iMoAl{)d;0 zNE<{0J>VeR**Q64puH|3A2<2P5K{NhKP`&DGkB=BW2O}F=Aqk`UndEcmR^qI;e1V_ zF>a1xYMA@juC?RqX3^&x6)&A&Q$uCc8nY;4O ztLt=`MNqn%2o{&l2U7Bj_nvcNL-VA7H@)pWSCO^v%xO+MiEjc3G!Ij5+H+jkGf*V!2#uCidHYaW>dIPDD`wi`D(QuqcD4KB{^RJd*i* z??b5FweEQCkWOAIWecjMuWhKB7iV=7Z2T_uLe zUGXdR7we!BDg^yxVKVPZEDmLsJdqD4+EC-Hh1vs{*R(cP$Qn(#vmZ%vdirKo#v9k& zFEfsCe3k4n6zsEuwHSgd%r%BSv3VjvN}p7gJ@^-h9dRdr9A0At`%vlk^@gB`?grTx z+*wL7QhSIff9T}Xx~q*ZyllQx!p2+nmBFn<{GL$B56{4N-)hxIdB8@wCetmNx+kX& zOQ>}Uzuzn7;Zdf}=$>sII zurX*oR=O9HB>R5t_m3i=v{rtBox_tGSFIn50i*&elvsWbajouS(Ykw zQIi=_DC1nPo2IfRf5Y#cW0);-c0*_?aE7`LviMXwm5(q1ua1*Nq1z%|I)?w92i~hE z(F*yRLi#(FG;BC3es^iDt_ply?Ie%xL3Vuxv40ZuExf{zHw?&+R^yW^kh~&Zq2mWD zdbxKHtFa-$mlx4dFPyAL+|l8zQ_Z=S3!}Sx?jDLv&Iu)uws4wW`a~0b~Gc_&o0`1BUBqqQ!P6L(}quj z2W3)ZQXDa36fB#{mEbYpZC+I(Zw2=53!gnzB}9b8oi?)Z7G$^;OqhL{$PckM)R0aM zvr2ceFqQNy!kYqM7L(^DS*O;mBK_-=ka5cr17jFZk2x?C2-b+GQqK}t*v`Fh>eucP zKUptIEfBsgv!R>|R8Bkyb&;&CfN<%p5NhlX;l{gIL}zG`8{Rq9IHgBwB=?1kfiJZ? z{8W{@Zo#0%Q?J=0=>CF&j-h;V#H(A*dfczpy01kqGkd zKI7rtacj0v%_uzRb0k{Z-@|ejNscbN3CNMCk8XFm*3|s(86*ws4bln+V)4mB&rrlr3=6Amy0DYal=h3Y%={b(uY(=(_n%b5vKH zpOK$_w7rd*!_H_S?ZPvOwkFBl@Ga)}l-=@+XBN3Ot%AnV;MIo4^BbY}K^lk{A)Cb? z(>x{b;5E57?>cZ8J0(1}@9fp@u}DuR2Xxz6j9LJUzxy$7Q*$wR6B|#KN>OIpeIN zmMie2$miw`-|n5Bc3Q$)of%c|jIJjK7UC&d&)8$8B093~M-r{q(FC*#q!ts*RsQA; zDp)Gxr8f2yi+v9bgw$p*4i7?1n!;;r@l8+63L=yG(k)BS8C?=0+BUkpzU%irytzFd zRX39K4mjt!V;0Vtr!&}6*pz$pU~mvGn`(Du8x)6N19*WQ05EYZh;qS)uFo9fdmg;? z>;#qQVguE@eSSv8%9eR$$PbFFb2|W@cz3z6pld2Br;ztaemE=NoUmx8P}JZ(abEAV z0XWj<9!NA^yv9CTed$-_n2AJEm3R}>J7qjH8)fb*h&GZQF7Tm>aD2$PQ{Nm7ACAzlJnmvH)8h(Rd;pn3G>IoJ zNuG@5S7BVT7?ulWeyfdqC*jQm~w-O>qru&caRYdGlS! zgrWKI2ZBbPtg!`eHYl66ijynS-o*gT85Yd7ebzmwlu77Jc^i)?Q)hj(s{V{L?QvMW}(Bfj5DnytA z_!di)xTn(X*h;!>@+IHl~ zs z;03)jtQeko_N6%WLFs`aPZQZ>n2S}c_D;n%H2Bwj3cXu>(3Fhk~T)_-9Gs|_8LZu4YH~!LDWZ-?ey+F>S1HfQqi(V z57E|InmFIsC%h6gG<;f{i_PC_A@#E2zvJQwMfpGMy;X2s$(F9W#7q`g3>M2`W(JE{ z7Ff*8%*@P;7Be%G#mp>=nOQojuHAjR_bFGq_kB7M9igWc%3SlGBWI4BE5Gq)Ph^3G zaQSW;jMCnQhX6|J?Kdf;~A8jy&{o8N+CM(;z4ddXDD$$8Ka)UxJzk0L3d-WuKEZC zh%Dc+i}&NK+3OObgQbZ=sheFZTFARuSngdJD(NmG;LNGJOFIx6vQK)L>5Yn*;AZE2 zWo)Cvr_$DvQyJ2q(6oSZ7Z&rH#WmIe4Nj`j5x#7@i6 z-Ilfu^Y3-`B-3-`yjH!2@skKI9`Lg^nKlxd?YO$^?&>W>SPJNBz!F4#fIV9~+$R|{ zn=$rR^+wN13k8F`JP_)x592PxG@#DBLQty#>9A#(D7Q^d2Wx!bdRU8g3Jm|?zG4jQ zh)MmXGVnv3E8;ccvPPXVlVqfaTDT}awK1_N^W%rwU3!(F<9;m#R9DjsjGw$5?c!Vh zy9ibaU{Ikw>{hLPL2Tp0C(&7S^ObyGd+D_8h}69c-Il`L^1EFw93=q_^g2p?mGi#i z9{9cC_QjXG3ex7{`BoMkXQs&daE4Y6T_|&1uapb)k=SN-J*g*=7#QUA6;IHF35|IT zpTcK?<-8qB?~@C>a~KZksv|%r)>lDh<3Z3sEkrjc8m;ZJkui z-OPjdr@GO6R49?t1HKZPpnO(#1;Qb`^ixDF6tm0?;ejYCAClv zs}-bbCD3S*lCT*K+~VYT$Pa}|$Qh2LibZ3+Cf-?$z*q<5W?{2v9u||v z0wM0(#T=_qi0>1B0_P5!k4Ld=nbnSFyD$sh>RTl}zfX3QHIIX`GQr4?i6{(NaSy|i zhkV$G9{vX@g^iIN-b4CzyK$@G?`sA_>??SpLz!|68sCbVmf2~DA8S2lKaH;MX)Y(z zwM>D?*Gxq(T00=sC*GerHjI7@RR6}VY@rsS(FwZ>25w+0=MuGOvF8)m^Wl>nTVi-* zDp@y9045!@4(ruV4Cbxoq+3`S;_SA^@eOqix20vOx1u$f@GEo(CeUaby4=aJaw@qu z185JtZi^Q&wMhL^=8>2+RgRe#A}tm7Hfw5B5#mt{IXh*y2-XE%ySHyNL1$#51ZXu< z1Q}Ypk(B7kF^F2C)W-S@abOD5z1P6G7ZLXTU7$9EvD;nIaUn3P{E2k(3P3~j&&a(DGFfPTLJ~)$hXOhD$u*O%Fa9BiyS`=N~JSb3-QP$I@!%lTcTX zO7^+vZ)eB&@On0u-1CBo3GqEks;P32o`G!V#h1un5R_7Yo|CWFWIk|*;Y=g{bT_g8 zTB4om3#sIp>vr303P^iHLBMO=nXon*w~M!9-#Q!jtEx0{s7atgP&$=FT6a>GKO;S8 zrD>dO->RibcgU?V5U>legAr*d0t*UvH->t5^kpz2rrpvKJLt_AaLF;m0@WQ+f}KVo zA=vG+l%SNmLKz(0@V{9zvS~@A4)w#`S)t+mdhY5J)s<;AmD=?z{1D3xf<3c0vb0uy zwh29xDknROVMNT1cmH;$_k||kfC^Zi9&Gn0*4X0HWDf56bf<);3AUhP!@Zha+C2gC zH9DH)IF4e>2CD&B7g95`zjnQ+e=2YzbDAYxm1oDNHw}Gt1uMZ$(oB4tQ0LY8bh;*e z^$xJsg;+=GrvZdj9Z43csUI-Kym(+Vz`aNb@KyffDF=s2X-;{SfN0!EegH)&B1?4i6o!ppm>DC7xD^h}27*V9!DW(0V&q1|vWsf^n zIz)apR^Dy=+d>~=uY0qx%8AXe#v`>Y=$z&J2Hj6FG^SqOv{OF9k6=2KN3r!$dN*Q% zWw&9jwOEFlhwKO#0%ZK;no*HAK%i|BkB2~do%}TH2n6J9QKKRf5>wnSN+gDztL3Symj{%_jg42kcTzyS2umKqKV3buLR z444H)QSbIu0CNxt0Q|j*In(>4D8Dxg`8(qJj{=Cy(QGePXv$HE{-hqmt3liOzODln z1;r~#W{O+sxl7^e(aI+u19C@V@NnBRxUo+fPoT_9gH@N(`>8Wep3gC1yXLA^{@_%e z7q^zSO`@K6vlpvFV*_qn?E;M2a-sp+B(|8U#32Ciy!Wg5@_S6Tuj{SBBfH$v`(Oky z0-rE}?*+&Yw=7tJ*E)K=&};y1|JXfd{WYE?*~W`dz2nE}1prujMFkSgcp=CH>j5QW z`qu%#YTw(^0sXZD)IZ-$06@mOx(WdJaQ@!N;_pZ-5OLW3LC|Q_mG`=aGiH^;?LK!< zyxU7B1qb4`8!kyySYE9OA<%Da^h^$tJ4DyJ`IG^)6F_FqqwDo{a0#G^p>4qWJL`ZB zu{80KONb``XxaNW{wDoBZkNZ*uC*G6JvDYxu^^@e$vOdmE&pu#m*AGe95*L!!2;cE`&WMe&<(Jy zP=&WAkQD$9KODsiK(hJXl>hI5E$GOWyBGklD^DoK&68P9La#>cgjFP{h;Mej3om4) zFRvUvAjj*y7op$dz~|q0rJW|lW;@?)?GS0TugXg90qdP0F-cN9000fadq?j>=U1Q> zyAbjA$x;sI`)CE{g@YJ)m=Xgv0AOZoynkT!-Xnna7lhVd4V}36-%RM<+tBpj~4Ba_2-S-%5Y z|GlhVvDJSqi}z1ie@XTHH?n?RY4wj#{eRK=4I?Zt)W4PWOHTT)W&Ihg-^=8GB%eQK zkUyjK`-M~7|5B3u_o?I0LHJAZ`LAXD8Li*XssBmVZHn z%YQBFAJO{jtoKjru78i#AM^eHq`2u_*6)zWzmWBhX#Fai{k5!rMC&iBmwxqZ{X^Do zmn;20l)v65_`mga{Pzj|eQV>7wEW+@HvTtL#{cH6KUN!mK3jhc$o^^&{%_v;$13Ch znY_jDcdwuSk&c1u@-#QX-R2%(zs(_gy+39=|36X~I&|nCh2QkQ`+E52@|TR4D(k(~ z`|AEL3wHi~ME=6g@!!^kf36Py(~{$Vli0t%*Z*@xwB!s zoD;xOdsg^OqKr%y_VgN`Q74Sg4ZdUmUztB*f5izN6-fW$r?aL;L}LF0t_Pdep=j;a zZsWfAeZ84A=g$&vY&!3GqL5T@6BMFi)0)a1yk}u0-{zJ9jF)N@MTvFfD=a|xCU;f{ zC9-4+4jqdrXAgHxSnRCjY$`H>We-C_o1YUJet2p{x0A|3zfS~mFxsMySRJJI2b$NS zsZ`uuqk522K4%eb#4zybAX<7UW@dQL>SfUZglSn+27XttzH+0mP20WK=8w$zh8dJ@ zgjr^WAjTr!cO^w9L=cSXSnlcAF7O5;KUwhG$8m8SLS^#zwIVqEkvJ@esyQ{ge(T62=yY&^mh;KH}8kXIwC0>vxwjymFK z(%NBjckH{25)OaUw`D)0No^ST^wCs z^Vs2zQI1c@cUY<$9}m)-Y3o!(>t;%2fwrt&;9q@Gzm0&k-ALf7s~{-up+pPA2Ytwv zPbpqP`tpkAJ$04WfvvUW4~YU_erPpcY%-X3+P4NWSzsEnhC@-FbxNj=*&{8+AYx(r zLyCMZ?###w*#WFyHhjaIvcbb*$bPx0;riKjzh>|NTHt1v@FAB3Et%Aml9oA4n?gi{ zI=RrhjJ4P`{zJ}BxAW$+#5B*nUD^`)b`xFuCBaz$^S8A$9`cr(8_h%(0&e54#bkle z&z8$Z&uPBkd1;1XdKY>o)DlNSl@xa$yXpa_J{*D$@9!8cW+QM7vxkEFiRW{r zT@^S4snRkC7wW>~2g=^2oPraAUc})>2L^2MpbQ4+Q+!6Ch%|V!bBG)lozsdDOb*{3 zq`}O>GT}eZ4E6ka@dgze-K&z`C3(d#;T_}BW{exSitk%RV_Ht7 zS-As#K|aqAwE0eUsk7{wwdssck(99QurK4UeMXV@2$J6~_}GZpFACvjdV*a({c0Sn#+WUJLAjNizV!K#!%Zo!th^4d*xgtG86brZ_!~V zAp}e8x=E{l#x@-|EY9D4&F|v+8 zDoc#jjLX3h7ErcQo(+ChSC9BA)F&I?r%3^L8{E?gtXEQ2=PX?7<`u9{HYb6xR}g}Q z<7my$0WW>dB^=FfxxJk%XNi#Pyq(=9=@>W(2orrmuFu&IGO`Wy{iLO*4|y1^b{UXR z@?i0^kXaAj`=dX_El}OoF{l*2w*dJ_Kf!*`WVJ)(j`s!E8iL(Ml)cOu1dSs8{Pz`i z*xUhHZ`IDQIzjp&0c(WT^WOfj_L#aWjP=t5;2ceXtIFsn%)tx4LQNMO(V8KV+hk+s zz7H^{&{oI$B_^`%6a}F*y)IHr2cS6NCYCcg0>gpFa3YrBuQgd+qVYLS>03ec=}%u6 zF`*@47km|E1U0*j7u$MvH^CU43`k}`mJ#R>diA$z2>3V|UUb-UjB|=pdPsbg_Ad9b zcU{h0fib;2XZUYkIUZ%C84zb5&3RuJrv-%a!gne{IfS}Z506rr`9&=YnX0;3L$f7r zE49}YvxV3NwHdCsJ1z=#%q_ySB<7(Ww*tN@T45h*0qoE#S*lvQv`%A&a0R!L;Bjor z89_g~@!bpDsv|UvMc}_K)rRpQgMxl|YNMcmZ!i|qr&U`f&NjtuuEFpS5K2Godn*ok zv3EUnMju2$&wiB-Z=`?gYI3F)4q~3TO#S*0l137X$CQYt{q1|qkLoPJnKB*Whi{&N zGnJ64XifPhi32u*``#$>O2H}gnLmLzgvYRok7(1D=q8ZJ>AFYet<;k0Y)oRr(5(c0 zJGt->Z++X_Yvu#>vElf#e)8!h9$tY?KsW(zF&!lLMev767;%UfeQ0lfQ1_Paey*aW zi`;Qhg_XJJB~=)+IEZ$5wbC2FW-XZ7UowKC7hy%Vw)<3Z> zxD>ny$&9xrtvlzZh{g;yR%B1)v|689qNrq;%0N24Hzs?e^I-!&>WR}siRrGC8k+3j zUJXPxvBP5c*vX(J*N&J=l?u{^M|LGLfBW7y##SU!Z9TR{s`2QQ&36<28UEwp*V`fH z<|Ju#Hk5TLWDS=#Nmt)&#DmKEMPh#0dEhD`a@?7;kUWz0SemQdfX{|sv(*+;2T+Y3 zL(^4Oig#s>U-86rA0tCPm|^O?;6bFqOqq%VA>3u|1fpzeF&Q9<5J_e{=c#_W?XDcE z4&v{R&?#kF+`Y0+OtiHb6A@Hvs~B=;Lsf;fZdsvV-rN&&_oX$m9zb9%q=_4y;^_$# zg5G@cY{}foy-k<4MZkkeMd$BODtbcC^AWE&F+aBzzC~P^Z;90H-1I=)caDo``zRY^ zVno^2;(f&m>W1Z0jJ!ehTvqyGz@V#E8#2{aob+nL<;^gcR;n3CaCj8#9A$jMJd{i)EYJl0AZ0Z@C{&9RTxIjf?Rr}M zr@EEClx3Q%sVpsoU7@XQn`{c~UB)n1BO-a_Og;ATT)xyF3m8kJ{O1^WTSK2FVzRJXIQX;`uFl zkzPZzYgglf2ZfvKi9w_ltY+vpvC*6Po3m7gBx-8SNN^e*IoI}?%J5^yiUB#L6|ape znw-grPr@r8jQ6WjYY%K?YCnG%m4;tLX>lCY#8VD{oJ_NrnRzl@AY=851N)sAS%x7! z)z8?OemY1@{OJ$uf|$r-;S5jc6I6E=srjsU;N&MbH{pHWur`q`i)qMi?y-88#!@ta zt?D^9{_zfC^+CKB{&}p1k4 z!1qktQ?RZ87I*#a+=4R=UJ2XU21S1+>Dn`WCJ+SGq;ogH+=WKUm`Cejx`ST8H3GI` zt4&v%n1i_;gT3Mv?bbTjI2xVRu? z1%`Fbs`Qi^7{#LXD2`cB89Vu(B*pXfE$;%o50-dM*&KfOY``k01rOdC@8Et%9b0jR zuM}w@{3=5+Iw~KYhddC5|H+I-QK5NOBGM5DFM+mQiMWhq#W3;Qvb5>&1@7bUz;Riu zsJLq*r1f#%u1rdGOU6jL`WNaX;xYUmRiodfR#?mgTttC@5&NO%d-a_slQI)A3r{b3 z)xlmCD~63D54w{^FN0j)(6y=w&=ksgpm;F{r zS^y|<8u^^?3vm!wGox8EVf}voY-R&!;DcHq5ieqW3H}lJRADGL<|I22I!rPgZ9IIx z>`r)Flm|;inSC+7(7=5fFQtXS8}%_LaKRw7&JL&z9lT^n%&{v!MJ1LNzbS;~#VuRc zyI^>&1hc{|a6u>$kyeLkGq?R2O_|09Y9|fg{S|UN-}|`kapCeM4hTN`PE*qG|+ zhKP%@bppJ1Xp*L3hJ-Yu{y2aeWgV<5!ra_Y-`R275JL#btb)L0t|x(Iz^YR@fB%Bx z)7!T2asUaG(neL8iS2ie`0WE?m?D!IZx?x1WMp8QNCKf-jsTU4op9{ngY38nHYN~V z{DD9QWL&el>r190@G@+B1ZDQJPk2~+t#(-gvdcT^+J;P&-bG`c0lJg)d@`C@vPSE%7gDDujDTw3!`h|o}eC8Wjy*q0aP67 zg63(#Km`*M_UndU3&@&Ce3Jz$kUq>Fm zC0+yT9FX=u;}tH!7qwx@l0!erMw&Ghk{{;2KIPY|Zo4YboMAcw#0|OxNFc}HL_hCI zzd7#Ahc|M3#%@y81dcK!c*ZqFwCfe}whn)H?cnZh-ohh4~~S4sqxC zA+K{kD19Y!T)$?-db#b&DuU9|7-4{*ESDuHI+zQ74moR^_f1jfppVi)0Az>nL|vI= znTJCw@!6EVXm-jOz4;aT3rd5aWQ57h(n0=xxp{GWr6F9+1c(ZT8{p+2vHBtt_Jp4OgImf_L*<-cfPQEH#&!9ssIiU5U&Jm5RAKb?K?-qLa{AIlCv$g-q2a zI1`&Q)0jUm6c+(@3K`go(NcS~jNj1CY|ma(+fPmAN9+>s7wERcNbHkJEo3uO(Ccr{ zbHYN1hd4tk6QT_$o#z+G6BsMcgzNVaqg_-@RpOc)ioI>z)ffEoVl&17~`76AC>Op9>}Xeff-H=FCT*4SQxK6o@+RH+3<wrBihMk+$NNk+%4xO6s#C1VCpEO!$PO3Ey7w6g&RmVdxWNwbR!=b>-M`53^e}46 zx(QB~frk0Uh9zw-BQ`nLGNzV5L;IepKrBY`)o8jdX>Z5|1Ab8LihUr<$9TMm#4Q;+ zH8vPq)bqZ;WO!XMGyc1d_0JivNYMez7re9b^#l4O4+47kg^DzYyN6_Dq%X}}`075_ zWh@&KPzV7b@(wfv#U_tfQBeXsUireEim%g&wrjH^{L-#7>R$ZHha+>N?W=B_51i(( za*uiN8y@hVn@CA=~8dh@4CoOma?*tuM+cW|6|clNPg<4SXToID6arc%yco@=ay$ z3xXW1!OU1Q&nhl#$Ou6-R4slyu$$LqMmZI)Zx5?n!MKeKjs7Rr$sQmzGrj$8Hkee+ zjlMmjLZ1Wj4F*U!KBUNwB_E2S&~gI}5ZMbbEz7|&xt^*5R(k0xI$k7LP%LZhwJ!?$ zn|(i*?Zv@owWvNncp@BsFlpzYd0~6-RYf2+Y&$vtZA zMF0)6|4F_GL?4h5BTJ&flK8$^ogs|k5nq&Y`+wjwWB5n7`|2%oy^m zmf)VcXDBF(9jDLWJCrgAU+Z7bakMKn3E(fhGt3Z#5+F|QmefPk%x6)HiS$JH-73jv zEL56nO@)%>h7nDTpM)HEARZo|@(VxLr@1()D-hbBrI}9x$?;`Qtc^Rz7!)3Qcis+M z*t7Q^c2fJF=Wy`Z(z=wk%s)~2nqp<3RTtE)$7cH?U<7M*g0stK+g(<% z^d)-WUzsV+LskVs4W3LcqoOg~48;`v2|dX#BYD2&p>fHGMtm>9ZaO!nb?-6Rt&l3LEng8TZMJv1z+ zUKOqoQm9kF_5vD*4Dw(iE5xqoZ((!we#VHL$vyNL77*&`xRJh@mx|Zh#05-PAcKfz zcJQo$rBJ~~PlfjdX`4B3^5=m{($Q6Q4s6Jl>m9eIFJO55<|}}Z(e9T{7(0~^yyC>I zP=or`GU;iIihbBb3~x(vF)qjXME(6d&$*Xujzue}qTYu^c#exzWJH=J_?1h)Og6ie zIVmbp-$NyerOza>7N&KyGwc>XWynrWdVW@X7=j4khjtrx^40^pO_RYG2M~wRj>GlE zP=L1v=RK0vEqFXWLflmJIS%%VFZg#hA1!dQBEvuqI?OiIt`t!CJMa>XJ_K}>Tosyd zw2fGQO^-8fi}?8+Px7Ij4a!JPr7X`7?UYs_M7t<0n2i!95Yi<1(RTC)!WN326>D3Q z-U^h?XKy)Pvhpg2S-rqgjQlV4_qDvH-5O{d6N#JabsAWuK^Shrgr^cF%bGw86$6iL z?a~h86%A#nd32xeoT|KRiKa+yIvV+N^QnP>R$}Bf97dpNNYpS=e5_H@1vH}osKUzR z%tOWc>QX;cBmE*A7p)4K2)gavenRn6SD|a#vrhw&%eQFAivjaJtu%&|dzCA_vI)|Dp^r!3@#MM#L-8pt69{`P1Y(%A+wHd(A~_eEW-@29DO z?#6#V35~jxVN8Ifak%7w5e`E1_HsyHkc;!*c!}~v6!Y+`uEKfP>fKMYjF&xq%x13H zl>A13f~}!Vp?DckyXLfYLhlIpfS|@fjwxI)xkxXwhotl)(%-B}0|coxQHByQ^{H8s z8u&gPm#?jfn7iLsnCJW6xhkwY_fF00B0f6}N|?d+O&cviD(@b3FIv--b`ks!qS z`@v*<*j)}gH-7gS11}@I*7s>ZMO-0@L~degwE4_AM)3Xx;{PK$vJb^$!Vb03oh@#4Lq%x}Px&_BdqDvAJ+ zPmO}fIfZoa67GDg)5;%_B&ztI!H_TUwkJAz_b$E;ihwylvc2~y^shpeau4Y!AjJ-M z{6PRj>-UaWe(mx0e}hvWT5-3Wo|&@%2i||)kl!XQ|Ko<7zc>8liKYJu7J%qvnE@_G zasWyhig#p}{Ruxz0rUqhBlxdkn12cv@9zFnH}kK3*ZxxX#&wn#pxWzC*}qL>{ukNr zjMZ;rnS#Gp>G6LPasQXh{{fu&9^OA?{u$lhCp7;_=I>*g?=pYK-~M-G{>s$;zm4Ya z!!G|U^S80hcbWeh@$#RdY4twznExm6=08XCw+YVwkom{tMZuTa^pBH~N#9;J|I-r+ z0zg=_a_#*0PwKq@fKV9yARhoI&+D%JJ<5`mp>?7vUBO<6czqEZ3yToLM6M^`KmH$c zhw_ytxhXR($C(now``USl*}%_ceIZ^)u=c;?8Cyfjj)Gh=f0d>_bd>Y>j=Zp9|fItKW(N&c13vld(hv zU2%44PCYc3z24FZg-Azjj-^npFTjwz)L3oiE;;QYVr=|U zJfnyLsk#;v877#f8l60)y*WlPPuS;#Aj-6guInux$DmiMdKe+|+qF!MKGDw}atX zvWe44KBHCOl?~reGIV$6Q%J9uutyz8?jx<2n~Xf}ShsR2R8PI|cW1-8B6b*no>9Sa zK! zQ7gidLSKU=hb9gX7gc8fd}7a;`cPHSo5lm-%Tyt{FZM~p5LhmB{ZNFB!X?>Z+up)9FLg1)i zZ?-5GALiX?u0+4a>08Y+G^UQYCU5B1Xy~~>lyQ?G5$C9Gf3vRb_tnA_n!1}fL$(FM zx;c~hm;_Ch!ne}28VgZ9Ykvja5V_CY#=u_E7e~s3%JwP6LxU`u#x8)gWl`ZHh&K^) z!ECfq|DitP2+JT>)8Y?Ob{dz3EN@D@*pJ+W;qq%Q7DRKjRLuPLTMNR)+gW|$Ash5B zEU7JSl8`H44X19P>KOAus~U3nUW3fN%V}Jh#Q_DLR-qF)P|gU^SD;z;SU~$ATb7eg zWJRS8=l4sKArxyD&r)Zy!%K_(z~7H@N@QR&Cpnqp4aH?NI_Jm88+E;WCWA>y?CKYO zbielZKWu1PVmQ83N6jL83URAjxYb%A0Lgh#0tD0Z;jAnh7z#aEWMg<=(*#}J+j z7za>Hq(A2fHY-$b)m{ijEJt>XMpi8+;)0?Ao3J{zT8%)2AiGZ$QpIAs)Onc<*KFdZ z&~o>bH-f6yHB4JNrMbEDcnJ)EW76d{R#H}RmLlzBuvt!Gl#vFqhJgck!@k8j8&i*X z=#|wW8aSBcW~e!h_WaTD=HfVbSkm0xnJ8<3y_M zYG|yooBRCfxtO%+ZTH+#D1|q(1d6O>Y;?R_y5c%*6R|>Qm|sJlN7GD5&-MmYrQ@8! zAr?=-p;BX1H0)s96zN$umT{~}@5qASIr;>QwO#W`LAldJf!XXvK(OgSG&QAHVAmpR ziAY1Fy(p&`ifP!&xQalI+DJJV8#9%@2QlR5UAq7b4h*QmzF=^P-byNhw^%U?KafdG zEHav9RTX5OA?T5X%?^K1@T0oR3iA%VB3~{O8DA`0aaEUWNx@pK5L)~X=yF$|gLj`B!D z4rUt{xII>Hm6$#MY;kYAwidS|rGe7Scr)+AOB)N9*Q#q^ot>D@Mai8vXknud756da zz}3(?+5TtyH`5)QEzEaL&qQfIdU#T|jA{8PXx8u8yrU$>%VanBPIgj^1KDUAWsbjb z75OhAW%*-!?vT^myfL%-A=tp)%BP9CbdgXrI`z_-f%b(D?Yy77B1J zRd*4<%}qy1DV2XD$rxvXrD9}YMGOT8{g{i>Lp9sGiw(L}`IOuEfn*Ll9+MDaU`yo7 zF!C|`X(v22Y!4-V)Vsgq2?y)akf-s_XH~!xNy(mqA5;M>pOOpD5(1!hH`6r=g`g@t z+}D5L0grUdq?Nb^>myUAz05bk+tX9Q{M8W|;?FV%&75NZ;~&qko@AH;P8wiTK#TdA zL;U3~TWDF3q9@W_R6BQ5F;F5OTLd{`a6EWVe$M;=+cChSI=EFh#52Ok`Qku^WyMjH z5@BN)-B)K7)7f}x&K^GqqzL9OQovsd>6J|RnwLUClxz!9tw*gZTe&NpKasZ*&dS-pvwy36{a16PbSCQ?gN>)udI{c>LqujewX3b?bo z#H=cOZvUu-MA^Bdlqa1jN%%85oIELA7Cv0N*39&>bv-Isu0%*`s0>^0gN*(&|f7_9*|ud3N5* zMJ|r&7E+1Ibuj@2ZUa#Mgt%{-l^+n0iW~bHdP=FFRYMyZs9NIpOp?q8Cf%#9OI~Wj z?fcb5Y2m!XKg+i7xVp!EdKB@yb+MT8P19_(lOX3gc!}G4daVQ+&2CMzu`d2T`c2kF zyDY!jL*Wt)Xc1fM@5&m;L<~-O}0)^iHZq;P<7# zc@!Ng8UA5{+{lMckF4J6M7b243xwNt zc*mMJVB(3i+>)9)*agbW%=t=AAU#BDrx0$!B_9EspSx&;%Ce4)LQgt!#1#v~l$&2h zgR*>Y{!~MkFh&&_iIH(8HW=M{iZu$Igbb^N4<-f%e)0h&!8G^Io;2bB>|i%Qy?te&?9hJOIsqmRmVJqkSn~E zX06oQ)Tv^?+6UcH?V7mA*e@5s<9j?FeNfaJUT<`0UBDt5d)*gC(qwz)UQfk^9^y)8 zuhdl6jViC^^xz0HFoAKI$wc~j1zJRYQH$wV{cAW2&!W|OoF8BuWf3O9<6u7wl$*pA zD>ao|E*wU(I3Rj#AC*d^y&cB``+E)Hf4g#j11T?;++{f`?h1Q`fN|uqDmr(AqTEqV zR*sd^dqt8;h&vntBKG)pLmk0;#2S78;$dG31y*+6+j@N0P*Iy$$vAi_T*Ekm)lj*r z&W8T<>Fhu}@3h8}_Z;*d8t=AwK-AsLBGK5ymfte{#0rhzei({63DQb8gWJ*q9Y3RU_Nmwh$MT{PEX2ON1=L> z1l+VmM~A4Y-b*H9J<73<{hGI#^vzxk6FbpifT4Gb;OwP7q_S4XT``u1KuHzBcKN#_ zD4>{D7A~Mt{-MxHu*Dz%7WOPxbdM@OQv#a4p7@DmI$1jzWS;gn&9{yhY{sKrg!2-+ zjjsH>F?Ar-o(bbYENj4xgO(OzFLDnI8Y8~@~3$FUgNnSsli7oV+ zBbY?mhUVwm%gFqRKAjP87Ko5(6ollp>KbU!HjI-PCaq#g5|?_VK_IoEAFBbJ5@jL~ zN>`D(LQU-DgR1w|gLR{gl}*3(6(XZ8=w@?t$h)hQ7WhU=Nn+K!0j5sXNPDm5&^#Ro zLs|6bZ?B0G6qzC0A>y)B0(E6-us}Z1GzX;@`s*hMxgG+Cf&=G#W@`w`jF`NTZ6~uilyz`i#V=^nYIeU!3b*A5T|qzP{WOR%b}Xmvr)uj z89AXnK`;!qSDKW-JJ8MXvcj)zKz`O}S>@+7n7W!#f9;dNgCMvi+0p z%LN*5597SoZ+heeG;G4a@{>iA&7cihLS>`1ofgvGoGrq~4ljbg}q{SdbHd-?l}`V$#t00q1iqbJ$$@ z`q68>{+vw0S!YlNyz-)yAYNf?3Xlu+`|X}&_kDCHzxVl(;V0vuWx!-dGJQ=H8VEp7Zec!UyjS|8DC zXZk2F-jasR`pxmZ`i=6_QY?5T31$;*$BOWGIdf$5t{@EbSi*eBPI>@~FwZKFRseU+ z8L^!8nf+&a7z@!DuFYh5i%4c9LC>c%&-pAL7ku50dlV>SO#cAzkRlAsZc6%GN~LSK zc-zu*lWiT(!NVSwRBF>zKL=01!E?SCsL?r z^6^uZsvO+69tzntQYoC;;D_BaF{!}h*Yte1TYT|P&=Vw)U^NH`gRAqjC!@e1+?7el zHEOqXljvTK81l&(eS5lr0KE>8s81x{Ys$rz!_ODti_xcf_DPP$Jk)bNyG%~v0NlvfWpZ{aYi;vei) zm`@b9%3s`|&bBlbHEPX^T}XF|@}u#eV)6I3nziA>DpHI~@jH8IQAjOuJXcYJ0s{+D zmzqWbxX`2kK&qQDF1lukW>7tL9vWt6t>+l6Nt9sjZXr?9+u0V=N_giTJFjIfF6Uk% zy|wNnWJKP$W#;0Y+kSY$ErD{3o~wp_1{Z=CY=xsEE>L|#U$Y{w-VR9A;sd7e>FPsw zU3aDW#VFT9Yc}YYPrb3Mvn5`QC^p6HMyVlvzL2AA z*7!&J;fw)GwFL3=zHyv^=>hO% zNR>qldZcY}JN?ZpQ+M8v`Ku@?TbdkPaB>s17cI8mwo+csPGIjHcC?&5myE~8wk))t z*0F^zp1=7FEQ~-h+~~%$_&K~@!Kc2}Tc8c&HIYKgq%r%clhS*x2Mkj$8dA=@1{U9( z;nDu+k>`fd3yV&`3j2BJ%*$Xk$a6ZyO-Jc>StA&QVJE&(Bme}D6j>@;^gLnLvhsOb z3VY-(zBvk~1w^B=S5A=P(Xk;B1P)27%dRv6rcYe;kiUDi(MP78w3H- z_VlZCfg1u$N$-uAoEW=ITB;yj)_U_ISaa z4tbI*2yAJucg#vfU|^7$<&l7`T7YN^Qhf$Z+SB38 zksw{(WY0mde?g@C35{sv(0CC|6` zTKwI}y*Ey3F$DWN5*>hBZMs|CA4gyX0!@?ybBt)w=2%K7kK7Q82p3m!YPzCYeavJiE(sB^EOqiJPd$*8OvaB>(CrbG}|@lqz?ZFw@^zQ71LEr)*YP_RUYc4k_o{`dnx-?%24g(OW zYHF+yP7BSN@yqcP6#}n%2j_l=KkzwJKPR%TLqM{|WU?2-CrS}ZkX!yAB0lDgrZuiS z??*TZ<3{kjH3fF~OiQ9$NVq<*esIJ}-ey_x3IdP#9964WwVUd;3DG9i8|}KCEgLs? zVVt05^0Ly@Wy{B+J+*AB)j8H%_3C#nE3lg%a0P#<>D6HZG} z$-sa}W=s086l$w6EKCyua@Dg=Zs=Y@ybp_jPCZ)15#&Rdh^RfULE_4mJ6W%iOQ>qz z!^}F_#T2MS6D`Ir&FVu7-#TXs_NV6F+6FwaBQp zL5oeRF|bY@?Cn6%%SG;HOwqnb#C&taqQC{eTrLjvYW-r$pVD<4p@YwXg?4AHIDBj; z;b6jM&jEHLzYWQ%e~85d5v1?EQlz;U%N~1cQhLP!n+O==P(C5IFv$_Z>l-{uSp*A* zK83Z)*rCWcvF0hvS29}|zG!Kw+df^39xT7S2fCm3zSFB#@xzusnS~SM6yCwDm<*c5 zWKL#85h-$K0uI_M(0`L`xChEh-LL+hHNe(0JZES4Fhd1{FDSr?Q2uR(y;u0%!#u4) z$pkNJlYmxZ8Fa43iDN&ZrNlsMc%j>1ixjn=oMNZwdkh$5Hnpw}TV8lnfc?Ho&t8pL z2(n*x^-pD|^te6Nh4)QcTz0e4^Xs{8ciYth;?H{qEY#>E&?@&3k(-CRZ_*!B?l}l` zD^gL!9i-^VRB$G?(^Y7C_J5#xl9>3j z58ibILk3^}9{^TBslUD@oYhhg0Yiw{tS-&c5GP$Zmb&6I6mAKjoj-0rndQKE(mGvE znzJHqaq57KsZFk9pb&Bmg0*o4mx)CCh9%5`0qz89;4nj?_@kjk^Q~gnK zy5by`YM4jc_JKjYV6U%}>mvCimlD4EcKl5T7?H-^`era#JKmn+1_Bd~N0V9g{{S%) zqf?u9sUZqeCDK?oKSd>K*=<3!mLIXs(2D_GcwafyzE`TU$>E|fJQfXi)Q#lE2PNqi z7T+%jgPj7`+nMWS*hvo`r72Zd3F}5T3`adpna~^U^eP#dH{qm+a&!&s;^%AP?J#(m zGr|o#cL+ev{mU}S+%xPV56w!xnHF)HP_agac;I`k>Fgkqz&zMUg}^{}`@dyBYOJ7s zYsoEMg?m#K<1wTXUotwyL3z{Z{5k%JA)=NiAJ%6B!~Q z^D?~SEpW9Z*m^9B`>3t^v*LsVEorl!NV{|b{0|PmF*nfYzduB*lDqqeGWt4p-_;-| zmoa@_o9!?H?Ru(Eij1Fg8*FV8?sa-K;|Snw$4^G)C^19C8ww@q7JRA8(*x=DHjZb@ z>2nrS;-s4X2ag&|^LjC@j~TNOW|DdJvYErUN)HsmeBPC?(f&;@cSTZr?{gFkliSMa z{UfR{J}v#n9yInO*P9#6*eSe1qZH<^vHvWh-D5vHp z3vFt|2Qy=}$s58UWy;o~dh4t<&=`OKNE&G36_p1prS1(DJvVSsr1=z?k;#S_^= z0+RB`wA72Gr45m=W3T`PU^CA)!zgxIcs?}R$fbilxiXTw7YA@VxgP|ZE%-$*?*S}> zm5hFOQk8{pkB+;Tf7gjLyqm%)9wbIfnz8l801g@`a*h{OMe?tc_p_+I9PCtiGU#RC z{k*>ARZxwA&eKEaOx`4g>1!Q=XMkYHG&5PM{ycUgaob$5PEY}`tEmNX&<`@$*2+?7 zvCHp?jfCXTAORb3dq>N`4nIBKCUoU4+AccG}?a7=`H}mJ~k)&OTJq!!As!>R~DQMci5d?W@qtVZjc$DtN7-_vX@mK&`3D<1g3|D-bF~G?PyZ17S zQ8s@%;-{w{hf(?227a5qgzl%?G6_)_e;8SjqKr=ZLbZBSz27x_nF<6Q)-IXjFSsaU z4A@DBWy{bKyAWkv019nuMGPyw(#_JPA?O6H>}LHdX5&LU_^y_wD!`fY^j;-s7;!`mQ&rHHn{o-_ zc3>rj2j#`~3=xNL3qnEm>sj2x>a#Uf&qSbNxpEIbyrU;&Ka}Vq$<^76Fx=G$0QF8X zpf1ao1b7^YmTtg0Eg$Pj@PKWNrUa$fEu`mWt3=rV20R$C{2Cqj5RlAyco*jWTd~|q zn1JPgR!@5!t)M=Hx0lZlh3=v@^v;rztPCm8{+Gt6B3{Hf^sV z#?698?)LJU`$5hg29W{6v;DV$QL{<%WhCP8Ehp`w6kG|G%Th*Z8F>vdi&>I*Xc&teYrezRf?eekesTL9lc*J84o`ig zg!;D342|9&x-@5y@4qK&Y*!VpD_eVEN$kcNo41KYDrL>zcfU5jxQC!}gUYd;;H;z%v!=6+ zCYV0`eANxnfBZwu!S8X&l8CRcvp@@a zkKe-szb!*#h*ZyCgG^Y?g6Q90Z&RjrLDB+z)7 zAM?>AKwr9V##z|@)ZTT4ZYMeQao3#n^%Hbk4^d;WgTGZ#_TiF<3HQ;@F4!zvt_(Y=goTpgrjKYk1Ro8*+5~qrTi1(CcakD?2BxNPu>6=u^35N#mGK zT48MC%$3B2%D;BWSW(1H8xtjOQvQ2Aoof{ZA0RkBQZ#3p>l#)<6JadCt@psXNu3Ol z*6X?UR0$ZzKV2RD(>Rr121!PxasMkJO} z5k>?1tVjd44N1&S($#cdGaFUrRCDoxU0VAp9c3xsG=@H9{+8rs~VDMz>thGY>38 zYniHr1*$D8&1*zv+kCl7KsxjjyuO3@5srjpaAQ^P<5Tgk4gwiTGbI^Q!KV3p1c&w} zB(yE0nlM*bi8oi@of9qRSk|<8Q?ZN=#&=bK3kn)J)$?*ymq_eCJ*su_UZyq+q++tS z{??e11C;;5C#NLLDwbH<^X7WgmRs}W(E`RZ z=j#^`?~f#*&0W|Ew9yY~`O$h}aE*ljQ0RfDqC4l03Qs=MAWF5b@#3z1kMLjM>6-|< z$eUz?2>+9Ey;&LCyInhuun_699*1g$#{iCw3G?tg{gLa&dPk2@aE@hn5(spPiW)F256`5>VCDodOcN) zUEbm{CB};-Rkx`r>KIkZhkRo>-l-FYha~5&5a-%&WqeoMs^g4^8GAl2)eZUS>Xffr zWUXEoHCB)dv>;oN%MBdPOc^aBeG7-K4MUqbG-H)d!ue(YYfX3Un=wVHLo$=!ZA+5K zCgpp2>eJCr9)uU{0(jqSRjZ7Qq&!@ux3Y;+B>?X`RBya2+|>{i(`>y!ub z0ElO3{p9v3D}>oLIx6ZcoSK>CUaRcP03PVMuewy81hBt7B9C0-tX)$$2bTM&Jv?k= zZ3?cTNaa-5H97UnuduXTe?iRT%L@Zd$=z;vn#+>fa)j%goX{Z+AYK_}9953H^2o~T z(SzsE-1&OuvFozU_2ey!S2JmoTg^?P><1=SJjzPe?o**47!_g)mVlWUD?`N|dq*y! zJ62Dd+0q_E!){@p-PrO+v|x8VWY(oC!kRPkYU0)fMs~!;PS7GIs2>o`a$|+J%W-J) zHNt^g{{L5awj^kN_f5BB*EE(RyOrGE&spTen!T{>b6;|EwTi_x(5_^#0e|-w{{zyv zx=yY#x~ya2>y4r6|2FYsZAV+yi>4>HL*Jp4QvE65*j_#$Bl_mG%y0~!*ynNiiMSFQ zB6;F3S}?K!TZEI1cJ_;)@Z;uZ2T#Tkyx4kIPEJ6A2pi`PS|i?9g$R15{J3KBjTes8 zP^;5qd3zN|^S?eoeWP&HZ!RqWd>;^R)#xw{y~&woTs?hU&b{EpBhJaG8MC{6b>vwV zCpQWR;x^51*ctnAEN}Ev0T~2|*n$*|=+#*G{cy;l>$l!LhZ<$0|4+EvM)zr^0uz`fatzrUskX$cC|*$BsnsX zH}YJe#0tokZMPY2$ac~I?~y~Jq9Ym=&{2kCaq zLJz(_+1b`Cw5@fAZ#`#chO(K4BD^A1Z{2Q6E!}9{JoM z*^Q-KL*zDN#fsS4Xac+*(~_iP`=s12)4U3d@Y81mqx-^h&=8|&n0^7)PdRf3b+cA^ z%|^Pth?I=7nynegK({pz&3!7OMJiaQ=8Iq7t*7O?a{vNSRE}ww1@8bXxo27}@VS{2 zDQ`1buK|b%bsId24Gk_I!!VV>VD>hKqE1sjYj*D^mO}KjyKYN;0m>>=&Hi;NK0izC zC=vEO;36!X(C2B}@8p2^`mF8asw^ALnS+lBNq)A0T?AUFX~FnKiSN^=UU!yxf>-1nIw2>o z@VsY7X!{}X{qWDLkwps>ijFvjF)wA7cHRrNxmFus!-ml75FM}J`J*=m&S+Hz|&s4ElBV8Lzu# zUnrsovQ6hdJOCz6Oz){K(*OVi000oiqwBM_Irdc2xB(Y*_OFEo9CJPd-b~_ia1?Z9 zWRc5VkNU1XYYDF|MY3$y5{exLiFJ3;YwdOeGujfzfXWRyc?;-nrgO2YL@4!)3e}?L zI{@K%ExcE8*X#8RwU6Kg$xi^0E!I`3{#KuLxnoC0ER(sohzK7b`k+TlZslhOo0|9FFQ zKmGCPN}SyJC8Y=$JoJ%}teL}z#V0%w@Jcz4FUhrT=jBoi!S8Zi%j*J)8vD@7ye4V6n!n(CsCUL5swZJS`$|Odat)Ej+rElFwDmS24KI zE7cNKTKuhoz=|sOKxa(iH#{bfT62Ws%$GOcv@1t3btz4#78YUsLL(e>_-=P9?_lKv zu;}%dW=0Zu5Hthgn9~yMQ+}Q!6=6E+k`^eP-C1Mym6G8`&pgqvfEQ|mN`<39TL@)KX1B=p4DhwCc470L%PFGf$ z1qHHO3a?wums0zfMadto5zh8Ogr-U@MpkCpiGqCNaB++OmLky~-{#}+qi0ov2jhk< zi>G-V5D20!AQQZu3}VWTJnfb#k+lDpD73FzV)C=-APmn!P-Ls ztl(1!*%f@iOm{irb^=Smc~bOj>T<2$hhlE>H$^YOh-3T!A^r2moj7-|!~ zkZV>(c?U`UaZJ!=7}+|d0d^AfmnRsdG+#2fZ?;n$oj*v?=M75EW9CPNEqklDx$%HQvuRR$q<%b~7RllJNR!U@#R z+gwGkg?@>Pe71}StAV~c^((V92NTp@Z!Jl0b+-5mP~o*=z4&Xtqp6IP4Maz*HZ?9~?OSz*9^4sK2_+Pt6xZ=UU@RoaK>$;O`qW!@>a zR$z&92-ZzWr9~?*x#;u7n3Pc#luSlEPY%!~=tL7_Z~VqqdSD_0llf0;xYr-rNgE1+ z@{+rltegr98{|GFV^ z$uq%%6@}Pq%5new0K_oQYU`q}jphrw;%!OZ4m4B8;D`{`zXF-Qe)bi_Q6A?6k)3XG zGYQpVx+fsywaeUp(U*ozG#Nb0hr1P6Bd|IMSmzVgNJR(B4D-r&^Vxt7+(*cRsVO!3 zTy1E3d?}$76n;BzW+H$AHBShA|5;rl7-g<`)eThJ>$IM3r+RD^)VI>ad7HIr*6F=s ziD7G8HS#=T&{_QnE{n2<9rYe?egFUi00@;l!6s@VXE`8l|IOQ+xfBRvTPv;px1Xno-knPUb z{J9N0SR-^uRPc7L^QVrUYq1EsZ-R0=Na84prTY^6!3@hSsQ0Qinsiw8JG#uNwo>L%wi52~l&bz2gc7D2Y1DZ|in{kD zI0m}<(9nc3iO%f(0@*DuAIHMfS*;j|1HFfdU--4=WlXMt?#Q|QM8wK+0a+4y>Y{*@T<=dBYk%rCEv^pZD?4*+OgNa}c7sZgZLH(WNWW?8Yf&`0 zDnIf(h%9phL;WxL-J|Z!w@t3*pf!lwd{dc{m9e36f2TvjK!DuO#yvU2q`A z8&D8*(@`?(r)2WY&g(4K3rvk6PI5NlZj%I7n`yx7XFl#v_i(*?o*twR1ZN&}1IeSiZ;L{br-UOeC_8ZF|QIZ6xcl zoEPfdGL@h}@*Q_*2txV1)?jyiVe5mK{EddZv!kBbx-WX`=+`p4EwOjkVUTBnVlG*y zSQo>kcr_?!y_;mq`TWZx04QMk&I(AOb+y zJSFBvRqf(GUlhOZISmO5W--Ckdiwexwn|+W#U_u0B$ne`J=Auwt*w{ygRCKn$=l`6 z^uwL)%LA#IGY4_9My$8e++Nwt96_uGUb$9Z#pkt3;vpOvq<8*r?dxYIVQmvEs`bIg zDyT`Fg6s$Ep3F@Qg~4h+5#OM+{Fc9_PYGN|V}#8D>wDbb-Kt&Z-m{LR#69VDduVJU zcsoi!lsVZ5IXN!lLg)2XU4CZpRl4WPQ$&a?000DIPEsmcqFwhU3;+)DQ`?AO%_jK^ zrR#aA_^5|0%a!oJ2?jC?k7TIK8{M7%y5GLwd8I_n;*C$WQaPR3fQ64|G3CKfI>cmh z&u_F*Ra-54_yu!uWDnIX{l0t6Uw3iwVeR$UTi5A6zSThAq9DHwvJouOSfgo%Xlnk3 zksrq4H8SSHY^)uE6VkSV1=x+l|NpLBbQ-Wpk_ent2%}Wa-b3&YAwZ7|DpV7#GzvFb zN4~#nyp$z*z(~hh2+ToeB54vXh`Xg)&21qiiUG;ZY1oPefKTR6lu?GFA@}+tfJ3U& zzJlL>b-JQV8c+Atg#gFLvLz7L8$J;m4jm)uzDtNaK4BM9C~1iCt18#w2HCnTKN$>x zacFi77dl{w^v8oMj*!bbyG0dEuavC|8GjpWaUTXdssa2vC%o^CnEV=C(gNcQ#ppNM z7S)OF}|OO!(ERU5D#Ioj!e#_N%lkt1Bg9;U zwxsDOx%L8Z(3!Tu&7Ax{EUKMOaTN;rGJlbWcLvb{gCo5^RJ*~MtWFRBa#1!Ebnq*% zw_+X(2KEl&#ql511D>kD2WPdSsPXFQQ{nyirdc=rzbI=oK~T|t9741+SK$~;+KQ{b zZI|IA!9Tlc%S`ZtxdNj_szURaj01280|As7o}V4WMJNJSJZ@kS5X6}{w}5v zP>=d!igT$iN#+nU4l_rGp{?H^X3qy>u|9~a6CXIYc=lq22Uu5TRL45bcbm}TJdb9Q z-0U*AbOZ>zq^+*YN2WV?H%R#tJ9nEDmy#o0=*Jse2oko`*3bKCt$f%FC-^EfLvcty z7*p$E`!)Hj`J9mT)v*86Y|m%`}ANg5jR5XHA`Agi8 zQ?X={sWM;z*dG3eNu&xodv&Zkx;s6<|9tl56joXirc1n2@iM$fpb@ZK4yZBcRy5i2 zFgSl7fW^tTzu_!nYRkRUA?i#-2`nhk2a*SBH|vp^(D z9;-H?Xb)oH_C!wf8FGU-&uln#NjA!%N|h9<7@>jRntD#>Ila!1eU~P9VRQT3VFB~hWIdC- z^R`2^Pl^1wH~$=IlPM!tc%#v3az99(EKm6WGlkT|-;yYzIO&B+keHS$#G*ez6>q(!6;XdN{y4PXB^$QOJXum4TGG1`$wBG%{brsulP$KKWW8HxMi zu(>fef#ec&m~5yC;t*D2B9j^KWnqY*oj54+E4_R#Esc?}Ntqzo)%D2-q#R+l#qEK~ z1_789 zzDS$ka|d=PSv+e*$$lrS?lRW!#PG2DT5d!`CUa78l$FFM*CnR!>J!!aOwR)PfXTx9 z1vAq?Z?vQ2#=QS2HXb1Y^(T(ix|&UPdu(PIM&e@XAal72{aqaE$Qv=^Dl52n?igUE zPM{S*qrM$I)q;8V;8Q}Vq*+*m(FY$7PDqJ0>@Gc4n+mX_4?yc%oaM+$#xlntVhco; z)0g^!)H21D7UM4?Q6M#Dnj*+)X9TI{Fd*riik=79HfY*OrtBF%?AVC6H!)6wNf3_Q zUfdn^uvL@*g1a{gjQRKpb^odB=ha6bzBnfH;C7Qdt0FIy*cHD2u*v?PBbnw_??1=> z%EqC^Lm{qVpUQubk{Kce9dzS>C9A^*$6aVx?;^u+#Q3p`*bicrx;%WxzTxVv6C1+T z?REG7m>-z`z9JgD?naq)$q>(@&~j!J>28E1HHB%f#(sibbTC!PiZ~^l2i(uD#!ON^ z>vLU}*+H2E#lM%2ll#ZLj})D8a`%1j9nV*>agx9@!}@tx5@d*>XJ#3Wd@zO%-1RIK zy~=zO&_RYwj(JJ)XaT-;dEh0iPfA&-y>1@-$%{6|$y6KU{LQ`D8Vm%euRx68m%*HN z7p#`4Dqdi70yWP`rGd@0{|9EqBSxJ-@BaTaa4}IaWiS-58U67~n^?`Ix%rtaF4lb! zt-`oCW+f`@a&A__$O_3s0>9Tr^0Ot~)^q@-m>PI~`v3p_Z}je{;F32WTb~{I`E8>D3 z^srfR4xlNRIWq#J$c{gKDL?j(b0D=6X$NxoRFWBFM2qM%lVTx%CvTk_uL1Hul;dWC{|aOeOgUl)hq8&QA0_nG@_^E$6ffwVIBjINyb>Dt1% zC5qON;3r?B(B zsQI}@X_27(7v`}d*@!&_i%NbMgrE;Y?SnR3h?WB&R1n-ow8p|=#uAgX&5lx*lnU}1 z7d@>yF2HXGu_66>A?}Rq0z_h|E`4oU7pqdT*`qCf7$#KuAw~M!m_#mB1moIO0V*H4 zX(R$*I<10n%lj~Fkt4W^bB}lANgChj0Cd&}(VWeYAkkQ0&@oHPYnftCWo81Nb*=TD z^zjshHnsPFPVzTt$i9S5wl^^fHo4!K$5~?3-ze`37X_kWBY?nmV*^^5(Y*tstd#rg z?zNm3E4R!sMcG??e_U+~9TLS%hI>AlwQhS#Co8q*8*hSsPdWLl7Pp=ab?8^4vP;JaErsM$)G1=3%w&?m2CWdUzmNf#0D`q_mBvL`ie0OmT1d#D^~jPW^@)Ax57)Fv z((NGg{{veO>wGW}Xio!s^77Xvr?H!0yw=YU%+pPT>>&pl4u&s3G(WGXBLyEXg$3aU1w5g}5HX`Gtp?;Uy*? zi3G#gfOZf@-D5!i*`cZ~qr75aI(;s{g9l=uC$VnZn*4P5qVG>8CVYs{xNy&yn6peX zLoV(K>0L3xx&acF2P$KVdyw+AUsJGFjmzODx}?cuqoQrZ4=R$j10h|sbx@5D zHI9El@jgmi&~vYdnm?RUZfKCC(@#q^(03OI7?(^55tEGoZprFi5TXfEenmMJ7D}vt zKb*2+hr#RPpIU6-#`&wjF1H){&&LKeP47+^L&?7P3<_s~1R)z6{5z$q4vNMW=P0(x z`l|QV`~FdeUeHMt1wlAmP;W`3Y+rV>kboVh91JGs_fKk>L)EUg2u+&BTAe~nZVK32 zY$70p;mdc7`yJX_m(kz-nhwOR*do(0UUDhi@#Pc(YCCGE5%N^jgNd|{c2Bk`?IjMC zlV*g>Ar=}wyVg4i%AWvCJgn<5k$3}0R2_z`o^q|NuKpJ4p?*0)o(_PH*cM8ay}wi2 z9QKui@CDyt{RWpMq%v}xM?2y)arykBJCRSL$J9I^bTm&(0HJ^6cIB@8+HvUu57(^&9;h34mQ-G>7bA^VA}NqYKMAkwn3Uj?B!{C zb2?t05P5sD@gaIG;o0lz_BP&QHN5OV1AMKKHT6QumXl>4qLgDkL|HsvuXh+U z8hx3$91Oa~us;62nA%Tk#Itx?+|iG<9W|Rd8}}Ltwq{p91)gnc)mVEnl1}vEIg~Gp zh2QK;tjCOS1?&I%)h*o&S}&?$lNKI`H*3RA(FtJGERTv8YSftYQvc_aGMbOo?--!> ziYpso36GrLU+RZ+BhPV*JE=avzBduWWlwTl_4@NnqDC{1H$Ho-;Y z6GNFN`)7`A00G@g)n-!R2B!B;5p4HH#ti`w6ktMd8e{*>5ys*_KG0dzY9 zg$5QKY}3Ch+dlAT2VAo9YZ!J1bm%P_%M-82J~og6TO!;ud}dokVp zLmv!-V?Kb(>&3-S-G&qOHQysSVk z=wTLUw;Hf=;{uPvK2^V6>B3z|fq3SD$R@$5WR+;WCa6u>cT`WDB%VEZ_+PB*i17ls zBCgAUCfx+(8}+-l5HcNorwVdAI**rS1rvKfAp$dR2oyVG+8X9_j@Y2zO3QPLOIKBy z#_-xYY42Fzl5@2>Suc1{IFhX2r=+@XIROZDt!l{M>F|j?oOR=ctzr5=4Io6-A|qeE z@O47H-I>h3&fTSw^P&(#cu9&|bN?JWk`r_S`v@@=MCQcj4@^G_2K9NIr|2;GNp-zg zPzejq{nw(A&v=6GXGHt?7(j~^L1=?vSHJ6blwt#OWuSk4b^d{*8IY(y*7ltaz8U!c zJ`u34?Ui93Zwv5NVvfLngZglKV=-sB@?3b@jC(=%r{PG8Sb?x3;~!=@suQDxC~VabIQ0)MN~d&vTu6;c!5 zIHQBBDgpG+oItMHdTPM$3MQn?#26Iv7bZS+VBQx4e7+y2!gX5K{?~(qVEADkZPq*Tw>(kbXRZf^3q9CkJQ7xRP~?s8 zsZ2#w4eD3kgbg*(XDs7ZaJJG9ze^AUm|0WBF-Qu_TPd3+;5Em1v>?!HmB@Rr-c#@~ zIo#!$7iLOg#Z7}$0`^nqU_w8AqWEY$g`JSU3%Q8^L~VBwq%tFnxE1A&@u$vXbF{wmXPCA3cH77?>2+IpwmkpTe2(w;RGlBy(d#f>ZvWebK) z%D&L`0Bk!A5YjB??ih8G*Q@e9PQJ}lJ7Fu@b(y+e|JU3Hy8O4}9p;bN8t^l8&1}(6 zM_Q9JuKInucBFAn=wC}6Tp|FvXs&IsRoHyizcG>+7`pR8ao62im+jIndUfZ|WZgL} z)wNo$Pn^)oE>5P_d!M@~Mdcjvq>$K4OmYC%gqi{7Od@FQN#+d1v&-~OsDJ;v{vjn> zX6yP7BRc(P?|x|h7OjQ25G+uhYOksL!xb52PlYb)+Gd$S&PJc&L`SUm$SCM>c*Wnx z+rWr?ID@Q8a98fcsX=p*fW3VG`OoyCJ80^~kNl3wCaWy2%QmC4b*?+IK7weYfs=>E zIFLPu481{4`;&BfF1-}=u)U&-tZm_`U2BNCo$EaG+KK)vQk;QtQ$mSyIdCWCAO1~~ z%+mHRnL2fn%?G7zyH|s;#`zuH0k>%-gP7V7$;-f*WLsPWsRyNYU~k!E9iWZ!jAM2l zfS5{EUGQnyFKJxkM>6qd9})HN(3stbR>^vtBZv9A)F7?%e0jo?A7-W|h)dWZ1@$ct zZ%r)IzSbsFms|2pD?{AWO6mOLG8SB+p3x10t%V&(S6=jZW9oKt$z1U3LQ5fczR?=( zFHl8Tv1eGz%2x7qq1|(UVe_U&VqdbMHoh~$JDnqa$pHf!iFMi@i!&W^oiSQ~2EthIyjrbfM$0aBkoB^Rv;7!?+KL zMeDxTN7po|VbSvx`9=3_s+3E`JqDDPL_KdhoN2t(mhS)~8w6&YqJNU2K4qNM0K(!r zlaac>-^_?`#oi{YO)W&kgm8Loq?CJ^G~LAD%RiEIw``l#7KKjI>FC}KNhUf^N=LwsbXbaimRF>@^q_EvaRdMA6y#Mf zMiR~M|8xLBp)A*#`*;8xKl_F6eE`a6RUGplMtVNaCkkUHf&#&F%X+&m5NuVa`o4|D zIjD>ALA#-{pRcl9*tPMyQg7?}d!P~2U;=4cp_3;D9w9xPwIsh#oGt0~w{p^f9xT40E87GlX9rob{Q-O~BBN}Rp0R;+I zj{4+!!+EERO#;f;e*V7e||WI7%Lua2K%Nw zU=jh4qf4Go^-Hfb({ZZ^b=$mT^Q#>N0$DKAVt-O0=yS9X3WD*5#ZYTa^m;aSn_ebP z!Z&UqwZ9nt33$z#K0a3%=aZs!Br^CK21s(c$6;IJNRCpmlLX8aNJa9Ir86J&@aFTF zpc>^2!^Ep-`5onm(JjMSv!0VG^i!uW0mF0rAi0##g%1+>Nf%i>pc?tcH-hE1VCfCW zQwXz|dvx-3uyAn>;2chv;QoC-LM7FPjtn>!v!ruJBOBad=UZqqonFu9#5T&-w;2K_ z*{H6(1!YCzK7SApNUS_{>^PGV37{k2%$=F9Z#imBs^iGi?Iy%f?mJQca$0$|hJ2r<<@U2wFF<#f2YR z&)eFO`7q@nut4tboSRARr@}$_iiDroqAYnYMLW;5t%A?ycCj(Uuog!~L`+IXeG~bs zxT=)32?>I>&-7Q7gu9T+`Pusu&S1_?|MAttqA_lTb)?NbP^|?0VWvBQ_aSF2fYtUF ziu7R=UB%XGB~j>kuV}W6{Xsg5_?#a+urZFq9SdrnN-%*43u_!6Vsn^?30-x>^!CXJ zdOW2r_dSmZ%$A4E6a;(Jcj0yW5Tz<31LP&A<7KqA;6K-v{7|05;f2Gb2)BpM*wf^K zHeJ*^yqI@9Tg%LZZyVDZU2t)G{ti&AGoDq6+Wm+T_CKU(Pm4!E0OFu5;7PNH_`-MSba({QOFE1(krTDjner!u`wj@|QeY_vux4 zD2xc{)WL3i^hQ1TNn7)L)@?vU&uu9q!7Wul_?d5e&ddoP{`bN!fvfX*Mt9jHVvTt^dFC=@tR z6ka~-BSwAv%TT*FiK(#;%^$#gf85R@BZAXW$Px~DRMNG3&tecV%I{{0vF z5t1=+Q6W2-jsO7A&thiV&*S0}QPb5G%ZHQTo6Z-fbG5_Z?5n&k&nAPc5md-WvQq#Y z2U5hci?s##N5GsADZ&19vBFthZ)vAIs1Ia)j>_mZbr$2?e0c{I?WpG>h@1Q&`9yRB z^+q#;csg%8Zm#Z;GJ7SKHk?0egmFvlX2{*Wo%6S%X=et7HCtu`B_{y+xu!5*vdP## zce(67Zko&gTOen0)K*|iY&v#WU#+NH;rx)DYT_JMTert;%PF+WvJO)6--Pk{Z`*$W zc_j@t-r=SZUgt7!Q|Ow}$PfTkf0Cj4w|vuYrS=0}P7ucayG9~KD9T$l9vZu4LcHgI{aW-^)XnV}xg z`@afc`qt8MLWrqpH3lp5#suNN?xaX zec}?*u;6g}f`tR78D7zb;7R$ff!c$Z46Hg>scvYT2741Eu9NUFh zVUh<3mZ{QRwp(4lyb1IqE5iv=|g$2~y#4AyP)imM7qbqXE_E&vttk0JYP{>K~Au30LwmQO8ywvJY$$l{Hum# zmFSuGIDbfJpdH?K-o^IsXImDZ5A$1}=;&WQK$b}0F66UX7)~`^eZTBQe1n>%*%xcc zOgcX@gB*7s|BvL(%BVzhgq0Elj>B+!kBTftBZ`pe6JKd9B~#;x!eE$G&pSMpx;!54&F|>CNWy$}$$5(4t>d?oOEKYT~0<$uA+`Bc{uS zaf}?r@PDS%w_{8}&h#p49*C@{wT{$)s8>b92oYGE9hU{&eO4S>_-P|a&~)3$@~fQ& z8tH~rle)oxEy6kDk+-%VGXu2`DUPt#G8_Ysta5fiZghn_dm*PZbgl!jz(d!~=2n+i zczrZtzqZuBVK)rMa&NtAH*-879^Yyvm0ox3VN-qF6A_7!2Ip#Zq@@XAJu5&4Z2Zn` z`=zxd&#v`)000931QbyBBl3zq;Na&i-D(i>BKNV-Y1)>$=W&TLiy19vA2abF_66pe0~1U!pZC(-*w`6OrQ8nRXf&JplCSK~i+&i&qhErA5C8xJ00}O5 z{(d@<%%Y$b!sR>qj4gpvr*gu>$E)c7QbR7i{XyMc8X@Gq-Fu*}&bT6Sxs2=)68_aN zi6qA7axQD=LAJTBe^ruDJC~R3C3vbzY$dRixS>}&f+YfkkMgG=YIHX67AKJ~XET=x zR;px-Nr_m)AG{o2b3epf_TT0YYr&kuqmWVs0#j0Aj1eL{N8t_7k3ri+OEyS)*9dw$ zIv)06;G~6i0I%c5O)WJGbOG>9lu5n%Fp0Ha^f@u+;epqfK)Yp^b|p8nIXm}eQb-R{ z&^eqK$+E|FCySNw+nYEvv`7}dW0Ijc2_qEv6cpenO%fyCc7t>cX)-(??73GHA$N=u zRpuMo9Co9=l}fr4sHf~2P2Fb?^c<76XqwV7h`D#fZ4jk=6Pr&Yg}Y2f{0L}Ag4Y(O zSrwvvi;5ymSxiGVLH1&noKq_puk1785{QV`Zd4|>L{5*o8lwQ+!}r?GlETSy9}47E z{!38*sjNVPhBRY-myIZ&i<^0j>R;Kc5}=7Fa#4oa1;Jmg&xs@SBWbnZS4^Q4vKHR0 zjO9?l^KO8dEkaf^I$%Q34O5k)lKUun{14?=O~(r$dSw?UwlISmNKMbEBiLhS)xtNv zTNds-bNb$~k=E^2Ry{QmuPjtr-y04|X3gjNvde9rVdkXwFIszwgzNWPx-LWIh0gZ8odx7<010eU;s@A&g9>i2pvxTsvBFzsoGV814tz(BfeG`Rn-T($rKn4XG7jEfaY$11N z*v>!l@Z)+-Yxxb(oN6I)A%Q-c2Q08AUk%&&zV_J#8i@=Ap&eyFX_alDUuW-2q9qh* zyh&#%fvNLk!*|E^QDN7A7)G)F5KGJF_yx;c80?32xQnr~7L9K=+}S)`&Uenx<0oTJlxAxYmTlS1Cqu@o zfnz35og>BuIDD?SXv1qUYtZ*0JvxN;E)4PFA6_!$RWNdcc!>Py-y0(2DHF;VkGwhYL9+t!r&47z6qqDO|Oz5qiEn5C_Ag& zP!>lS9Btn{WvP?i;f*4--0<1EAuM zwPTT$?P|~i(0u_|$}Rej=&<*i+S5eHq@*HOa3u%zu0yht=P8*NQ+ZL8p&7-U7>HS{ zd#`@x;Q0$h#|3=K*bc^{KOkSa|fq79@B2@CYq- z?^W|22AAbi=`he(Im42$M8n+Ofaz#&Y+v{%4@p$QB`)84p)TmP&hm2In%&7;bBmiz zLR$D+w#7t_1ckz;gRNjn;7@}lkc6MXK$ZmRiL*P{n_?MANzW&aNia*BOq=8i)W4k3 zpEWex=l2&UYdX#%cPl~{?eg7(b?5lQBUSS8lFCNL#1Bi%``ctarGzWGT+p=`3x3!l!e4 zXFjO1H^ke1T9tN#KLH(3?^-rjpJEsCqg{d=4Nk#?wP#EHTAa#}{Dl(31cQTL&iNJ z#I*{;RK??iSB^*bP~3!NwJIDay*9nAEYDyaOu8EU7p$hf1vQ6<(F^dMcgc>oQ9VbW zbwBb7e*1{i8Hkr(!YTE1e%=qMYUB2RBWUu$a-6*Et`|ck2c(!=8(4^4Jk7UbW#Xii z0Jykl$m9IU(RG@zYz}N2Hcq88do;ZR0!_|y$Vjyjn4?z7oMJlGv>xgyZl}dCGtgi? zCyok|PdS4;NWYjEf>q71M~a!7c>C5K; z<_p$IprzEaFp`9YL{NK4X6jrvG`jruuLlwDk)-u;p4x+@=f%ywQql32iPJ|`Bd}4H zoNp#T#biiZY;XP?=fzi3LeI>Y>+sD^ms`=GYk1^mp8TRP1?B`n<_cwqDO_ z2E6`JdS$;a?ESheoLRK{)e|Y|0#f} z&q5nHcoU0#=31_A)+n`?63SNnUCW9#{0wfMKHkGTGy@nAR2`8XlQE5LvY%Y=^Q1#c ztrBAyK=C~u79?t?e!Je3DwkA7u0ip8Fs8;=r47oVL=f*H8gR=atE>5To8G{MxORD) zE=%3mGo@9=#E zs8a-eelU^SzE9E}Tkb67VMXWoX4+Y7kzix=&4#h{7U0%|-adjZc4LuabKGR(yHuxB zMzKKj{?Je&$?-z$ip70siBvV%iy@>v=lh0qu{gLB*=$QFan%(P%MG5~@eaHaC~|QF z=vAd!^ERE(9TggD>1_eX`6p6sfn9d3*#W?5oURbMgO?(>L@r{LW`mh0+Z=zjH>CgKOJsbk<710^|cx_45m!*lysrvF?K zRCYhPwFXxS^Du!6*6LS|@*H09;L7Z}+PWJQ!lhO8wuLSOQ67&MKdUc}D3_Bo3+>Tq zw15XJ(X}$p=^UPt@nYltljEkVrK>iW8oOyQxNuts5$CmIK9s$UnyW=@Od5Y!C5i`b zNz^?^wwY%jwKQVdI$Ir$tZK@_tKh-|i;MmO1~{e8_6wLo+*0~EG0lYLC1RtVXC4G= z@?<)VybRTPpM(H$uZ7D(cvmMJT(>Y($|tBtc^EdKwUQ{tyr1PJUykc!f zaW`skdt82US%LmwT?9a7uU6NMVz%OL6#}jaLi^z!O7hrEJw_L1hGiV1Q(55_2Nyqe za^#BnW0b!aQx`Y_`I~aPP0czFdBCQ-UuQ)5m*O5iIp@WShxc5kRBr`@u-n>qRUxDgqI@tjgr*x`pwS`1-jl3tUdWS+x-XH9IfrQWMS-dY1e zij-*LXfVS@Bac{D9aY#!PZ~tu`-l$@vHbVsoZfIs9tm+txi3+$o>&gpj5vFikqsc;7PXK&wZDfil%0YzWhj1WC%44g$VtJ8D` zfStajEgS7Q#LfND_&bduF3yYdHsAq!io4>i2$hil+o-Bm6?N)s5q)2F(l&L)?zdqG zR2mp>Xj;8o6)|1^4$rBRNqW2%iayrX;Z;F7oe?;H2cS@o@s0Hg>LEEEw5A8ps#XFr!-ZW zPa2+$z7|ixtS{$bIN`)2&zdgp9kFuvY$IegE`d%@c#XnCiba@RX5OibqQ~()S3Z)e zHD_XJ%U7n%ho9+aH9mp8 zxTs4MK>~nQyhBnb2}4|P}%h^{S!myt`XOdpz)U}1Y>6Ih-a!SvozpE ztsuNwmu6es3OVvhHYRS@HFaewYk6+NgLa3tfs_L_0F>A(!pZ>L*C)S4gsS@aQ^`r@ z;Q~(Rz2rwG<;q)l0g3dol2b3$`qL6Gu-gKAeu|GRlIvh^F$f3%>5JUA>u|KTJX3;t+g-YS$+7xKTptJgo9;G??0{l)IT*}jw%rVG z=$f}+&o2?p4(11uY%_YjL`u_YcfGC-@VAMuW|~PACRuuL?FZ^eigGBD**UTcLPNV> zr*tnOdb>XIoL%+@eN=HQ*9kdNc~$?sP@Sz8mA?*M0Akb96H#YM_i#M4rzgnKllQd^ zO7uf?imzh{C^1@-mURy0!)4GZ?)eK4ZpUD&a>uN2PFk z0ml-b4>e1BdJANV*9kDVsJPAQa2kdQvH9d*Ac@CZ>-Cs#1#10)p?|oVE z)iR}<6M9I9fG?n1wqP>jpIQ?8ATHqz+N$*^VIOkxw#{?ORe)DF)Ysl>NK2#ZR#D58 z)2Uw5k~oAAdJFSc!W*dk;6TXbgawP@{y`2E>7K9GK;92y2iECN$&CbLT%{DMZJ~rJf z%cUcWT^=cIo;iFj|_qU1&{Bt5fm?|ZCYdgGir3R5nI1WciK@!!InbIJ( zHN=h&96Uer;Jkxi74ceI7lBVP5@3|UFFvUdLY#yzdWR|IVa2}JNuAykve#*#LQ7ai zr|B-A{qjnE;sq<=UA}H4E>ofw`h%u_$laDHeId557{1)v1~3wESdLKaT)zSW&{;2o zgb^-7ZTbcPixtQJAoV)v$8`TFfW>kTqmMn7MC_x=nM~t0rBl5wz7Ks$9D7s4SI)CN zAk!E0ZMp{%^1j2W-uFlM7jLc*na92u>IcrTmT-tkteq~UjyZVFJ9qE#Bh7tLECgPh z4|CddQD3x*PR&;Mmdln)z{TzA+da54}x#B5t@qQj04Hsbjk~ zZMNRlDonekNY*^CCD>75&}4+#g%ju5RtZ24EQi~`?CJe*3yJxh;pYD z9Wi-#IOZ5RvxYX;AMJ)YJFof>2YyWV#mt7$1US#~t!1lVw%VfC(1c5^FtHioryR0Q zrP&V$4p-}xqLVD9Ki|Z~py(eFb)E7Rj@t8UydS&ffb+ozB5|5uiUG$bgX~XzE|tcA zoW|)r%;loHH;A7D$~>%USw#C( zN~Cu&fehQ!+SqWTwm~+Z<+NdOXf8& zxKsuF<0;8K%J~LB1;WS)i`?j z7N!-#*atDwP`&OCEe;QLpMDzT2`5}oCn;Df`7}I8W-_yE8kkS*n7(Ajx$VYA;WuNZ zzMx#-{*q=zB>p9MH6`^9c@lr%18Rk5C{f){oL9og`id z-x5#5cJ0`{=CSK|@E5A2$-TgN$bid6AH=#FN+PbdgXzSR74hB-Dgr48=O5q3HhODI ze0fm3yP}4v4%E{XKH?6qecwrRy<~dr4&5!76#&a<`V^aOO#K;0z4%BH4lZBR-D zTl}#)Ntt-x!vZIKUUYKY1Zl6VIUvX+=(r#~PurafZB z&cdOMYNB1DpaBnk75(8z_OdME^sq%E@h9dLr5@4ee=X(%Q>gbjD~1bMGej7ZAk(q_F5 zT4{nGHtjje%-9$th)!>jVp>2*KkUeomJl8btD^BkoXAmXPsIb=kvXI{YEo%5CLgNu zsTftUI*0NRUSJmSk1{-wfD8z(_g__bFOnvxmgX@+C^VTo=CWuw1^bvblEp(mmdod3 z2FD3?PW893@ zWl$da08^B%_D&S6t{!)|3b*({NNtR4sS(Bf#q!d;#n%NXx6XPNG!zeo&V+HjhAUkv zc9_(geIws@Uci->S(9zk&+9OYw)}TAS=*MP*mhkjiU`!HDt^#fNivpmw%>Q*vZbIK zjWV%WTGII|En(T&jSUw_VyP7S`U1QtVEA~IXn4p>^Ir9AZ97xoJmej8uWr@aMfcL^ zPlVS3Xsufz=vFYhr!}>%wIQ8A$9#nowBE4rJ?9SIuP_ zV$smtcjEzX=gb9Y2ET1P(gLx2@;l{VM}?O5&A2H&ZgbjgA@ti~Xey-o5i3Y36&@cB z#C`D4<*{AQqUTS0IyX#Ni#LQrc-QI`l5+5m6xq`epc9(Q&MkRuDM2!G^HmM2^e~xw z(RCUdvTeJc^!y_9v6Uw+tEPpfR~F8hsiurYL(-eKSZx`^i64n^#KP^l#&4GSaWV|N*ad21 z`oLvuRD3%t_Nl!1w21v&dtX`g+M+QeN#mUeJ=F%lSy%Wi#uBuu$h&u**himr3l??~ zX?tLr@iDlUj{JngnRUO~bUm6X4X^1efCpNO4Xnee2xG@c2iT2YlYqmX%VNO3r| z^0dLt1Q(}98=?7#2EaAwWZ9^agGT&%293I_$gx}IM_0DOorMlOo`g^3V;>=Gh&>0w zse+Fu_4cH)92y}(87X~Nmd4|H&Nj8OSq)P0_vBHevm z4^qe-v+}vw5#>4ErX3XApTc_>;)@kJZLQn8S0q}fk|PxLvhQ-8E3qq0$h*8Ya}TP4 ztRtVd&k=}W+P@?0e(>Z;vo7Y193SpUswOUC%(Z|8x$>ysH$E4CagJl?TYF$?;Nv_R zD;gm{vDb&5CDa;INELx^V@2h_Vy7+QXTC46ElAaco;tkvKFqL2zoLjvDAnF$#}uL4 z`X#4t`xxzN|4}whl#IR+lK{`B-oMfRve-d9mZJ!~1H1;i!|1L6Ey$5XbE>cX>SD#L ziLEfqV7W~Qgpa*W!6)3|yX#X=M{WHV2?7Ly&39k}=aY*(G=T znDK1;o}1Eg9|{_yibMl)+3#MdE0tFnnZZ!HUpFM$KpFbdJSI}RIXtT?%`H44M?sI4 zQCz0p*7yzz@3)LE>)SqL1?#XbB#2Z>Z7L_U1u4YNa2fB^v;-FeIdIzyE$L=czptS+ zELJ4);zh1{!HjEs?;_!}i_-rPo{3lL<#4?wHveoPTG5!xnSp)~_dS+)kd*x_6aCu@ zSA~0l0(wm@guD9bAv_fhi8wraj~Rgicrw*X_jr__8IR`W2dBlB@$DT2bT(sGgIwK;u#tUPYmUI)%LjU= zeAZlQf1KdLzL%55{cwz&ED0W%Fp!p2_Yu<+(y>X^R(6$|s`2}jk*7ae-%SC_NIq^V{;$ePVhd{!_~2uVTQS&}9~O z_Aca?q0#U+kcRhd)`Fg^Pwbk9!QzqQkuIE>H~O7RP;)9HMtWT0#eN04Oln)eIpYTK zl}<^wgAU_%r{w4X8c_xg+=F0GLll#%G;tB7RLOQ~!NB^MZk&y9HU%NvgK2!kb8@4k zNA)P)uN>hz>RMlLyn->&j~q(i9oN{YykE9PJH66-7=0wx4$WBdF$85EAddK~J;pb> zM-L8o==tIpa`5XF7fm<6p5W+f3ur&oe$&1qMYg)v4&y_2BQ^Mz_l?ZLt=q8T$yZLW zf!oZ;I;w+4jr2R!X3qE>`wd5$BUOLQP3RP|#~A7-fYhrvsoJwrW86aI_&9&yew*K3v}+RQ?elgmvS{pcT$d4`o7QtG${r1S2)ydN3`AdH4`j(vU;=$(S(dJmL;*f z)}jsinIFyx)bbq++)s#=9iOwG@)$Lb<~D#6JRwR7B+grnu&}|@>(-=+Vut`g6apOV zU#%o{iInmO`UVw7uQXiE6ZV3`#%WKv5${&X2wFDFAWph=5Z@&v-ep~;v#d$=`Mn%{ z`dG-}*lR8@BrAjryuHk+`@9*giy5Y7S6(X2mk~dFN^U8OqEffLXyrI&DT)ah5$?^e z4+L0J66RKVO<|v&q5RCT&}g=p>vIJa#1hpYj)BFrm>}y!mzN2&iiCUcMCyE1l|YQG zj~GYgP@aHtwV)2?@qsRM3%;9gk(fw9JP!I*+avsdS+Y8&H+zR(xgEwpW>`dmy8XhF z)8w81pc1t?;hZE=VQ#dl3d0jllUgRel})rP416wU_XrXh>;<8uv`m<8Nm7@C-c|nc zp>GhtCg{Z;2yq|JJ#EB6mZGbdz{_Vg^>3fx zrp1jRCmLFry4F6gXMRtlHX7#q<~7elaJ4I*s{D>Mc7Q@1$8cYD*E-Zq_!H(e9 zRlI0ztKj=ECPhq@J3hhPG#Xq&5QJE$7xA{vLn)opusC`K;!-b|uTZ!2FM?cu^3x;@4oc_g2#PlN#iCk>%y#89tha@l?f%WR;(5 zNzR9CR>S(4mWJtT1?tE>2sqB91)RLN!60c3T_R-%O`~WG=}EWvdZ0-|8S-1Qj0?f;tZDQPagRegc9)LKg>vHZ;pj(XbqNTdeON#h_CjFo#+K8_ znk?2YnLe2AR5xv4Vt1OD$G+?7V@s_#_UCsL3@#UB9Fu?E;T7qaphyjq*)_-oh>ApZ zcseb#-Dbf>H@Qv6wrV~{PL*p)4`tjQ~Sbw>!KNEf+t44$& zYyOZjv$yO&PL1Qz7|W&w37%eskET2ayFbMJK@cMf#t2Lh1sscdibKZ>v2TH8IsNfR zL#8u4gCn)I2m)MrYSkZr%O+9Hrij+Az)1s~M>(CV`bF^grAH`iK#bBTy1ZL2dX zpG}?SI`Uz$(#GQaCWWp?;!-`%P-Q@pXWw?HFc$1+Z-&;~T&@L6e3U=d;K=;q-~Jff zvNVDd@=gGi z7k@CfwnzcwJPHM`C!Whp8%+m~p{v)^UFu}81lWZLU;K*gtR}xXSp!#I7RSvfwUy36 zSA1#>ya&P+xKfWg(Nvjlc8liW6kh~lh3V{mQGq7h&g3HbSkU!MedPV788c6@Q2t~8>oQJ~{UJD>-blHLk+ja^+hH1fO?pRay!fnZz> zV~zsJgkn@7%q7d3!}~8J@$-+jsTsm@PHY*nz33L>$d*{bWaeSKMZg+GW$>x@IEZ#( z&}Z#2l;xBL-I?>pudNq*6L!`OjE4V=uaLYWit}K7Bbvk^fso$Ni)r58zXbEKp>$L?0kLiGtAl*Pz9Q9l_1&0b{ z48lPa8A0o3%P~XP#+sd`L9EEtnj>~24y$p%Da3QYTr`h5-7+-p4D&77J06Rc5MYiSO0l(6(rGt+-!Fkdoz2eS?h$g`jYtCBm zJ1ogTBH)V}3S4;c%D~Uo8+zV-w|@De^?CS8QGKl?Nk*>XZHZ_ncH|A0Z?tGS zH4k(OHS>*Oqk8U^I=tZ=YIV&;pAa}LkP?{_d^zy|}c6K9e*;jDj9G}a!#2nOTst+4_) z(ir+mmZcF|!-BLM?s)+pwc=FG%Fb%q`q2>rtOFE3^pUG%(o2@*d?yWnY?gyzBQ;4F z>hswV0#kAtg%T3xq=*FC@Azh+*;L9djjMj!iqke4?7sjV%=(0w$N@Wa4%;cIW*_J6 z<}bm$i=#8-t0u8N6%H4pLtC&itrj~cp|kREqR2NHPb6R~{SqDY<)u=0B_E}{GQ`R| zQSAGjC_%u7$_%a>gAff@9L5kPpfeILU}|jd4pUa<4g^ULL0kX42#NrHdzz-QSs}+` zgLRf~pO9voq(st<%XPqQ&(N&Exu>pRZY3`K3TmMzJD%%TkQ3cT35ACxOP{x`_o!5? z?Fd}B+soeqIVIYDaU5;1SP%qNunWYeqKr!xuSBvO!d$dFXH^K3c2u}nsSF28*QjL* zFlepIrdauFDyGHv0q{yg*hLkDMqVDriOl|6N#f_us6mtbT;$P8oQVn@a2#)MOXH!g z5a^RH0nK`ysJ*?RHZ}X0qcsw{;1PsIh8OHFP9QBj6qZ@ktDd1|%wScTUvzCNimFP1 zI8=8xmT-wsKp3TrQGh@FfOcM2Sg)4@+UoF?k=SL4n8+hu%y40mFw_&{AdtSI?uenZ`%dR##Yg}4RuNO8 z{6XnXy-NXe$IS7V+3;RGA}AK&M_@Cokgt#eedi+keGCPjh#^ucW!CDYtCVbV!+ZHP zI@wz*$dn92(mL%1HjM~~)RF-L-pH~^JYP+o)`_w^7Lj-+s6~+OsU?WJH-({jx?ftlGWpFF#&NGTp{*XM6_X_#Z%Lv z6%Sn~+iUiL6noGDw^Z^Td`+PIs&jp_*cURL-lafrtMpsh`K~2vh_98PEx}Tis2K7 zSutrYLed-0s(VgwFy(p^3a$kW*o$%cpQ%;3@Zk)N6KNLK^u0JvHR;W~J5W#6246Qp z>)1VwyKiwhsP9R`R8ZO5v!=1-Y2F!5BdHe zhIYRyv*TR9HJU$Sra**`SU(Pho7O8KP7?bbZgF_RLf>^P&@PoIepRid-KnHIBIF+- z*AjV3yijTOwfufH+))ck0Qj;K86z3w9+4k-+;~>~9pr&nsFyr6uDRJAVK!OJJJilMPflN(qmMFb}czM*4Ve5WZnEcOAnPQy8~?-MeFVsSl>k z-(w9*-e)lve`n?ek&#Us0TxMExHULlP7ZTTxjXNo_WV_F4pR4DBQI!m!$(d54Wv`B;nZfn<&!JTDOvOVXyWK_nz^GJ2=qwjb>0 zdiGr%phwl~i)17kzRlAJ{BP_k^UT$j`%@7IB9cP3fa=*kNiLyHG0h$2m3^h&hqBh3wUzMJvp&i_z$r z&`$R_z(%ByoGn&3|(!1~Od%iKEP zeSf=pSm%*K>)Yh~7+HA-!IFg7ncy^&K(SttV|vpSOMQU`c_-gXp{+o{=^U{BStZ~! z_`{EnaW~pc)F8=U>nSp?E;Q_e~FL_!)Xo6neIe{0~)D9+G6LWJcHl(j^60!u#g3S&GFdqJHDV}^GQ9Na5(#j&lT!W_IMJxer0?l1^nWs zoi|ftsBmRQoMus$93X8?qp(#m)iSn8$738aj^(K?j^x|B_8yS-ZPn`&?D%J&v=1#% zBN3vj)sL@MmQ~~yU9{pmQXXNKrc5AN>zMA0h6&3@O9cA%;xZcRmW9 zUkzVRHkpi#=NKfe)@ED-kEvNx4z zGZ z`(n+STc$+azBsBw6s+Nou;y6Y%-k7h;VyfeflK?>mVNILi(wjUd=4_8MF!6*b0kOFzrj*cGqWir`9c(;+8 z;u`G2sylLZ6+|2{*B%o%v!) zq}|bc;&N3YyVo5Vivp6sd6-5iwVmNt0i7;goCwuD2{sT0nMeLL!?3keSVH zq)WgF7~G6EH|VkVKl_L-^1`E{?M4ZzKDP_K(mp%?yn$8@@q(L`QCTZ;Oxu|B_Q+T{ zC#FO=JFW7xBhg_%ak~5};YH0Vwb)5acLUJ%PkEwQYVL;H%8&TZ#*)aAyE@UChAQ< z>cCO120ydmcPAnfXWMDn<#zYJc$Oh$i6~!Bg^Yh?Q$ae~-oyfQ)zHTR9PMe$29Cl9`Ake7>@O2>don`)YQngQuc`s7AxpWDtms=Vu>_|qTNymUukwchD8Jh+Z%+ca9gt9$D0AAkLz;f9wbkUFz z{zPfuQ@ltz1Jr9R>kr~Ope~?mON$4L)yOqhn*C1mC;wMB@Q5}g*(;Gb_ZK&mO$>CI$$#j=o)_6xmiIpH~Q6;Kyz9r>88l4byDJtJVk6&aZ z5si?8#k#S3ybV@%O2($OJ(F+x#RRvsJ!F)0wHHk>0rrA-!qq5#BQcEkoozV5X9d@I zbFGb#(l2c;Yy68Q{$MTONP*gd6l>PmDyL{St`2&I2PI7K=3+g>m4nvdL6TEk$)NB) z*!*6_+apa=I6YDDp~z+r(dqK@;g(#f;$^8=Q2e0&R;(1?4Jo}J zZwAWxe%zWrJv6Pm8u|;OO(O6%Ci>N?!Dl>P_W=|1fjj`v&=hD4@z<#R9@-5mAu^Z7 zp05I<^y~FcDm3-p0q26xOIo^diZAmTq3%ptJgb4u8c&W*6951)qc6Mj-ic-1Y9uSt zvI^Z{^iKpBO8@{6ER;cNBjWdxg9w20&IBo}U9^<~*q%?^Eu0g5{x(}4QD)Jd4V=^U z349iZK@TbX)yZ7U+#kuVqf=vvGr!PKa^%#NmB>GTjr8}>f2(%DF_WvX0Jx5CJ?MaP44sAFdidOTE8NIq z0uVg4Hvr&PN-GZoEqRcYl4U;;K)-;R004dgZyiX0a*VCsI=mhI+ee}CnlCG{-5&tJ zDX#BEa(HXTD3oC#RVHMSE(>Y@`cs#`HU9afb;~p8DzNV7K^pWNyS@;hn72MuLOG#! zij1}Y&=z_!r*JOHw^=BZSm`gzo(GK-0jz}n%28~InEMZHK>!L7&K2v^NpHu1C>aod zRNtDB0_Bw2{hzq?oHtJLXFt2zrEGVr{`_-vLK#(TkaXqDX`mecls6doue@)aM7rNP zPz&XZm?Vkn(7gTw!XLOb8Jit}7jMTwq>KO{%5SaTR6G1V+T-7(z4#^Vf2sSEw&yRj zx$wV7tMnJzT)N+)&1LvK+Dz78(*AdCbCv!St>f>}zW+^H_g~Wf6Kzxe6m8S*(YE|1 zZTl~2|B1Fse~R}0_h=vgH(J5B6N^qLbK{q^|6SW0{NJPfW0djz7Hy8e|3>?VCy@S< z_P=YJBmAdm4S$c;_yzoh*~ZM)xoj5h}h{Zq96@!S9L>hO=+{>N|sxbo)y z$8Ud*vfTgp?SK6CKYsg1HU6La_Aj3BpZYfU{|)smAyDo;)&DVze48`<*9TbtZQPOq z<^KDMThia2LJ|Vy@cjx^?=PtTMyLH#sD{5n{i~`u|Gu*JPoWn73iS_F|9u(4pF%zS z73v?V{`(B}_fUTZ2yerR?pLUPRrTMP9{ed($6ulT;Q;@>Qua@wHvJ0q4^{ttzWS$7 z|KqFwB=!7fiNWuw`ZM2ny9E6I(N`&dna%#~Y7HU#CehDW_D>1=FSFD)%3ox%f2WlD z3uP|+?@|7%-IP-3S6S@eDgUZvuF{{P{FfQ&8|5!D*uPW$p=HXSqWqV6=o{rPve&;; z{-Nd4pQ8Mi+2e_8TzLv|7CUP|L6RY<@F`{FE<1KYu@#@2^atX@iRAg3(@}X`z6Ec3#Z^ekp1oF ze*1#!@K?(JOMXculCPt5M0ok2P3^nmH#+7bih VHvf~G4?pj10ss?ItKCxF{||qSJ0t)A literal 0 HcmV?d00001 diff --git a/docs/how-to/record-a-demo.md b/docs/how-to/record-a-demo.md index aa2c912..b4b9576 100644 --- a/docs/how-to/record-a-demo.md +++ b/docs/how-to/record-a-demo.md @@ -1,53 +1,32 @@ -# Record an authenticated publish demo +# Record the capability demo -The video workflow uses a dedicated Chrome profile. It never imports cookies from a normal browser and never records credentials. - -## 1. Prepare the real installation - -The control plane must be deployed at `https://app.up.ax.cloudflare.dev`, protected by Cloudflare Access, and the invited test user must have permission to publish. - -## 2. Authenticate the isolated profile - -```sh -bun run video:login -``` - -Complete Cloudflare login in the opened window. This ceremony is intentionally outside the recording. - -## 3. Record the baseline flow +The checked-in demo is assembled from real screenshots captured through cmux while it drives the authenticated Up site. No browser credentials are imported, and no login screen is recorded. ```sh bun run video:record ``` -The script records: +The script: -1. authenticated Up shell; -2. upload of `examples/baseline-site`; -3. deterministic site name `baseline-video`; -4. real manifest upload and activation; -5. published receipt. +1. opens `lunch-vote.up.ax.cloudflare.dev` in a cmux browser surface; +2. records an authenticated vote; +3. stores a menu through `up.files`; +4. requests a summary through `up.ai`; +5. verifies the browser reported no errors; +6. encodes the timed frames with ffmpeg. Output: ```text -artifacts/video/up-publish.webm +demo/up-0.0.1.mp4 ``` -Override values when needed: +Override the site or output when needed: ```sh -UP_VIDEO_SITE=baseline-take-2 \ -UP_VIDEO_OUTPUT=artifacts/video/take-2.webm \ +UP_VIDEO_SITE_URL=https://another-site.up.example.com/ \ +UP_VIDEO_OUTPUT=demo/another.mp4 \ bun run video:record ``` -## 4. Convert to MP4 - -```sh -ffmpeg -i artifacts/video/up-publish.webm \ - -c:v libx264 -pix_fmt yuv420p \ - artifacts/video/up-publish.mp4 -``` - -The output directory is gitignored. Review the video locally before sharing it. +cmux’s WKWebView does not currently expose native screencast capture. The script therefore samples real browser frames rather than simulating the UI or using a second browser automation profile. diff --git a/package.json b/package.json index 9adc368..ba739b5 100644 --- a/package.json +++ b/package.json @@ -28,7 +28,6 @@ "access:provision": "bun run scripts/provision-access.ts", "test:production": "node scripts/production-e2e.mjs", "test:dynamic-production": "node scripts/dynamic-production-e2e.mjs", - "video:login": "bash scripts/video-login.sh", "video:record": "bun run scripts/record-publish-video.ts", "deploy:docs": "bun run check && wrangler deploy -c wrangler.docs.jsonc", "deploy:app": "bun run check && wrangler deploy -c wrangler.production.jsonc", @@ -51,10 +50,9 @@ "playwright": "^1.60.0", "svelte-check": "^4.3.4", "typescript": "^6.0.3", - "unsurf": "0.4.0", "vite": "^7.3.0", "vitest": "^4.1.2", - "wrangler": "^4.100.0" + "wrangler": "4.103.0" }, "engines": { "bun": ">=1.3.0", diff --git a/receipts/2026-06-19-quick-parity-review.md b/receipts/2026-06-19-quick-parity-review.md new file mode 100644 index 0000000..27cc974 --- /dev/null +++ b/receipts/2026-06-19-quick-parity-review.md @@ -0,0 +1,66 @@ +# Up 0.0.1 Quick-parity review receipt — 2026-06-19 + +## Product slice + +The review branch adds the fixed company-site capabilities identified from Shopify Quick: + +- `up.identity` +- `up.db` +- `up.files` +- `up.ai` +- `up.realtime` + +It also adds: + +- `up init` agent bootstrap; +- `up deploy` CLI using the same manifest/upload/activation protocol as the browser; +- browser-mediated PKCE CLI authentication through the existing employee Access application; +- framework-free `examples/lunch-vote` using all five capabilities; +- removal of public/restricted visibility, Dynamic Worker, secret-management, schedule, and management UI surfaces. + +## Alchemy v2 + +A source-only disposable spike used Alchemy v2 `2.0.0-beta.25`. It could type-check a Worker, assets, R2, and SQLite Durable Object graph, but not Workers AI or Access without custom providers. Alchemy was omitted because it increased the seven-minute source surface. See `2026-06-19-alchemy-v2-decision.md`. + +## Temporary Deployment + +Current Cloudflare Temporary Accounts were reviewed from the June 19 changelog and official claim-deployments documentation. + +Temporary Accounts support Workers, Static Assets, KV, D1, Hyperdrive, Queues, and certificates. They do not currently support Durable Objects, R2, Workers AI, Access, custom domains, or wildcard routes. + +A real unauthenticated temporary account was created with an isolated `HOME` and Wrangler `4.103.0`. No permanent Cloudflare credentials were used or changed. + +Temporary deployment: + +- Worker: `up-quick-parity-review` +- Version: `7c80cc6f-14aa-44b0-96c1-4b1535d8b356` +- Public SvelteKit SSR and Static Assets passed hydration and overflow checks. +- `/reference` exposed the fixed capability contracts. +- `/app` failed closed with `503 Cloudflare Access is not configured`, as expected for unsupported Access. +- The sensitive claim URL was not committed or shared. +- The temporary account expires automatically after 60 minutes. + +This temporary deployment does not claim to validate unsupported capability bindings. + +## Full capability evidence + +The full runtime was verified with the Workers Vitest pool and an employee-protected AX installation before the temporary-deployment-only freeze: + +- site-isolated document collections; +- site-isolated files; +- Workers AI response; +- two authenticated WebSocket clients receiving the same vote; +- anonymous Access challenge before content; +- CLI PKCE broker without Access writes, Cloudflare API tokens, cookie import, or a second Access application. + +The live proof site was `https://lunch-vote.up.ax.cloudflare.dev`. + +## Safety correction + +An attempted OAuth consent screen requesting `access.write` was canceled before authorization. No OAuth credential was created and Access remained unchanged. The CLI now uses a short-lived Up-issued deploy token after browser authentication through `/app/cli-auth`. + +After the user required Temporary Deployments, the recurring loop was replaced and no further production deployment was allowed. Promotion of the review branch requires explicit approval. + +## Video + +`demo/up-0.0.1.mp4` is a 14-second H.264 proof assembled from real cmux browser frames. It shows identity, voting/database state, file storage, AI summary, and the authenticated site. cmux WKWebView native screencast is unsupported, so timed real frames are encoded with ffmpeg. diff --git a/scripts/record-publish-video.ts b/scripts/record-publish-video.ts index 0d9afaa..09ad2b9 100644 --- a/scripts/record-publish-video.ts +++ b/scripts/record-publish-video.ts @@ -1,73 +1,82 @@ import { execFile } from 'node:child_process'; -import { mkdir } from 'node:fs/promises'; +import { mkdir, rm, writeFile } from 'node:fs/promises'; import { resolve } from 'node:path'; import { promisify } from 'node:util'; -import { openLocalBrowser } from 'unsurf/skills/record'; const exec = promisify(execFile); -const origin = process.env.UP_CONTROL_ORIGIN || 'https://up.ax.cloudflare.dev'; -const profile = process.env.UP_VIDEO_PROFILE || `${process.env.HOME}/.up-video-profile`; -const session = process.env.UP_VIDEO_SESSION || 'up-video'; -const folder = resolve(process.env.UP_VIDEO_FOLDER || 'examples/baseline-site'); -const siteName = process.env.UP_VIDEO_SITE || 'baseline-video'; -const output = process.env.UP_VIDEO_OUTPUT || 'artifacts/video/up-publish.webm'; +const origin = process.env.UP_VIDEO_SITE_URL || 'https://lunch-vote.up.ax.cloudflare.dev/'; +const output = resolve(process.env.UP_VIDEO_OUTPUT || 'demo/up-0.0.1.mp4'); +const scenes = resolve('.tmp-up-video-scenes'); +await rm(scenes, { recursive: true, force: true }); +await mkdir(scenes, { recursive: true }); -await mkdir(output.split('/').slice(0, -1).join('/'), { recursive: true }); - -async function command(...args: string[]): Promise { - const result = await exec('agent-browser', ['--session', session, ...args], { - env: { - ...process.env, - AGENT_BROWSER_PROFILE: profile, - AGENT_BROWSER_HEADED: process.env.UP_VIDEO_HEADED || 'false', - }, - }); - return result.stdout; +async function cmux(...args: string[]): Promise { + const result = await exec('cmux', ['browser', ...args]); + return result.stdout.trim(); } -const browser = await openLocalBrowser({ - session, - env: { - AGENT_BROWSER_PROFILE: profile, - AGENT_BROWSER_HEADED: process.env.UP_VIDEO_HEADED || 'false', - }, -}); - -let recording = false; -try { - await browser.goto(`${origin}/app`); - await browser.wait(1_000); - - const currentUrl = await command('get', 'url'); - if (!currentUrl.trim().startsWith(origin)) { - throw new Error( - `Recording profile is not authenticated. Run bun run video:login first. Current URL: ${currentUrl.trim()}`, - ); - } +const opened = await cmux('open', origin, '--focus', 'false'); +const surface = opened.match(/surface=(surface:\d+)/)?.[1]; +if (!surface) throw new Error(`Unable to open cmux browser: ${opened}`); +await new Promise((resolveWait) => setTimeout(resolveWait, 5_000)); +if ((await cmux(surface, 'get', 'url')) !== origin) + throw new Error('cmux browser did not reach the authenticated Up site'); - await browser.startRecording(output); - recording = true; - await browser.wait(800); - - // A webkitdirectory input only accepts a directory path, and the bound - // Svelte handler listens for a real change event, so dispatch one. - await command('upload', 'input[type="file"]', folder); - await command( - 'eval', - 'document.querySelector(\'input[type="file"]\').dispatchEvent(new Event("change",{bubbles:true}))', - ); - await browser.wait({ selector: '.selected-view', timeoutMs: 15_000 }); - await browser.wait(1_400); - await browser.fill('input[aria-label="Site name"]', siteName); - await browser.wait(700); - - await browser.click('.selected-view button.primary'); - await browser.wait({ selector: '.publishing-view', timeoutMs: 10_000 }); - await browser.wait({ selector: '.success-view', timeoutMs: 120_000 }); - await browser.wait(2_500); -} finally { - if (recording) await browser.stopRecording(); - await browser.close(); +async function shot(name: string): Promise { + const path = `${scenes}/${name}.png`; + await cmux(surface, 'screenshot', '--out', path); + return path; } +const images: string[] = []; +images.push(await shot('01-initial')); +await cmux(surface, 'click', '--selector', '[data-choice="Salad"]'); +await new Promise((resolveWait) => setTimeout(resolveWait, 1_500)); +images.push(await shot('02-voted')); +await cmux( + surface, + 'eval', + '--script', + `(async()=>{const response=await fetch('/_up/files/menus%2Fdemo-menu.txt',{method:'PUT',headers:{'content-type':'text/plain'},body:'Tacos, Pizza, Salad'});const saved=await response.json();const link=document.querySelector('#menu-link');link.href=saved.url;link.textContent='Open demo-menu.txt ↗';link.hidden=false;const item=document.createElement('li');item.textContent='Shared demo-menu.txt through up.files';document.querySelector('#activity').prepend(item);return JSON.stringify(saved)})()`, +); +await new Promise((resolveWait) => setTimeout(resolveWait, 900)); +images.push(await shot('03-file')); +await cmux(surface, 'click', '--selector', '#summarize'); +await new Promise((resolveWait) => setTimeout(resolveWait, 10_000)); +images.push(await shot('04-ai')); +const errors = await cmux(surface, 'errors', 'list'); +if (!errors.includes('No browser errors')) throw new Error(errors); + +const durations = [2.2, 2.5, 2.8, 3.5]; +const concat = images.flatMap((image, index) => [ + `file '${image.replaceAll("'", "'\\''")}'`, + `duration ${durations[index]}`, +]); +concat.push(`file '${images.at(-1)?.replaceAll("'", "'\\''")}'`); +const manifest = `${scenes}/frames.txt`; +await writeFile(manifest, `${concat.join('\n')}\n`); +await exec('ffmpeg', [ + '-hide_banner', + '-loglevel', + 'error', + '-y', + '-f', + 'concat', + '-safe', + '0', + '-i', + manifest, + '-vf', + 'scale=720:-2:flags=lanczos,fps=30,format=yuv420p', + '-c:v', + 'libx264', + '-preset', + 'slow', + '-crf', + '24', + '-movflags', + '+faststart', + output, +]); +await rm(scenes, { recursive: true, force: true }); console.log(`Wrote ${output}`); diff --git a/scripts/video-login.sh b/scripts/video-login.sh deleted file mode 100755 index 140f498..0000000 --- a/scripts/video-login.sh +++ /dev/null @@ -1,17 +0,0 @@ -#!/usr/bin/env bash -set -euo pipefail - -origin="${UP_CONTROL_ORIGIN:-https://up.ax.cloudflare.dev}" -profile="${UP_VIDEO_PROFILE:-$HOME/.up-video-profile}" -session="${UP_VIDEO_SESSION:-up-video}" - -printf 'Opening isolated Up recording profile.\n' -printf 'Profile: %s\n' "$profile" -printf 'URL: %s/app\n' "$origin" - -AGENT_BROWSER_PROFILE="$profile" \ -AGENT_BROWSER_HEADED=1 \ - agent-browser --session "$session" open "$origin/app" - -printf '\nComplete Cloudflare login in that window. Keep it open when finished.\n' -printf 'Then run: bun run video:record\n' diff --git a/src/session.ts b/src/session.ts index 51ecdc6..911dcb6 100644 --- a/src/session.ts +++ b/src/session.ts @@ -122,8 +122,7 @@ export async function exchangeCliAuthorization( secret: string, ): Promise { const payload = await verifyPayload(authorization, secret); - if (!payload || payload.kind !== 'cli-auth' || !payload.challenge || verifier.length < 43) - return null; + if (payload?.kind !== 'cli-auth' || !payload.challenge || verifier.length < 43) return null; const digest = new Uint8Array(await crypto.subtle.digest('SHA-256', encoder.encode(verifier))); if (base64Url(digest) !== payload.challenge) return null; return signPayload( @@ -143,7 +142,7 @@ export async function verifyCliSession( secret: string, ): Promise { const payload = await verifyPayload(value, secret); - if (!payload || payload.kind !== 'cli-session') return null; + if (payload?.kind !== 'cli-session') return null; return { email: payload.email, role: payload.role, groups: payload.groups }; } From 327fdf9e88a943ced0389860dc6b94c8500bc1b2 Mon Sep 17 00:00:00 2001 From: Jordan Coeyman Date: Fri, 19 Jun 2026 13:41:56 -0400 Subject: [PATCH 4/7] Remove capability demo video --- README.md | 2 - demo/up-0.0.1.mp4 | Bin 103837 -> 0 bytes docs/0.0.1-source-brief.md | 1 - docs/how-to/record-a-demo.md | 32 -------- package.json | 1 - receipts/2026-06-19-quick-parity-review.md | 4 - scripts/record-publish-video.ts | 82 --------------------- 7 files changed, 122 deletions(-) delete mode 100644 demo/up-0.0.1.mp4 delete mode 100644 docs/how-to/record-a-demo.md delete mode 100644 scripts/record-publish-video.ts diff --git a/README.md b/README.md index 4c1f67d..2690fe4 100644 --- a/README.md +++ b/README.md @@ -76,8 +76,6 @@ Browser code receives no Cloudflare credentials or resource identifiers. [`examples/lunch-vote`](examples/lunch-vote) is plain HTML, CSS, and JavaScript. Two authenticated browsers can vote, see realtime updates, upload a menu, and ask Workers AI for a summary. It has no `_worker.js`, credentials, framework, or infrastructure configuration. -Demo video: [watch the 0.0.1 capability proof](demo/up-0.0.1.mp4) - ## Install for a company Up uses Cloudflare OAuth. The current operator path is: diff --git a/demo/up-0.0.1.mp4 b/demo/up-0.0.1.mp4 deleted file mode 100644 index 3545f82e86b78fbee8996014b7dce2d2d24bc1a9..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 103837 zcmeFX1#n%v(k{4-G21aSbIi=l%*@Qp%#Ja!V~UxXnISPdW~P{#DQ0{2KIfkI?)>$p zrv93$S8uAWYJaP{rS6v0lGa|*S^xlm*uu@*$=cP?9smFbfG7|w#vZ23_D*cf007ok zdq+nP003ZT?_p&Ir2m#64gmnJPyiSJ^!uOb|0V#l|BEd2KQ;eX95?`g+3x0IYzr*Z zbF=-cPKbX~{FgUiz5g}+mwNtJ^@2}4mq4!lWk_yr=H?3I@XhU9-TvhY=mF#x@?UMn zWU)81HU^dv+nfE@zViV95M}`N{=Y2gt<3CP{^bMUVQpsq4-cXmK-p2s*ul)s9HfJ> zZg1^i0c6lU?EiB5@69GR`@0O^%*7m}14^KB1a}uZ;=g%}ELS%ZJ0L&e>gM{-fPi$` zK!XOPp!DxP|H=TL0(M&p$btY$U>I^heGV1|7A^*6CMIG#YZEUP4z|Aw|GHwozXPct zP)iid3_$e01t7Hq(#qwaM%ay>7kC8tkEJkHsK7V?Cl2u9MaX2z1_pq(I`XO?u6=!Y z0C_=iGIn(W1dXl%f*u2bGP;SI%fF&M`w64~OxUh&e~ko)2R0n69yAmG&UXck5Ga8% zK%II901&^L{ttby+Q0LGBlcH0+`s5QGDrm3{pAlx|5N^VJpL1(zvBR!9{-si|5+dZ zxj+294*qk0{5uZ+xj+6L2jKO8-~AD|2>*%uf9B!easMYC|69l5KhH`3c~1P-y8qAo z`+FV!XZ`&hhku@vU_b!@3V+G?z>TQsUlIE2zv7=g9Ed`%0n2>;RR$!Wy`9Ppkm3Uc zbs!{xpa((#2u>g|`4hRk)$p4!%$oAju|DR+9pdJ?xwExlv@u2$t(Fbnt|7y=a zGHB1r0|d>#bj*O19|*>O$?ibP`!6131KR6y1M!dl%zw%MvPZZD%0)nc;wB124iNvu z10;j|ssRDw|B+SyO$Np1f2Yjy|56{Qub}q-(_WE(lZAo21`wJ+NB{wnLx9i*LJSCy zu09YToquF6AP+hKkpTi&j+Y0d{y>BR0h%ZAK*#|B8YgxjTz~+@12hI8fa;M30#wch z1S=4rdO*7W$e_0VBZK1k@8$oe%b*y5+7Ftup#JxCf6EkzL6T7go zu&@xDu(ES7u^R&mq!@q-jPgq2lJsoE!WyDLO*3;-V1cNklee9@g&Q#o6B8>v3lj@F zFw@G-&54JR(bLnD0d%_UXlLxe;OJt>2&#p_%FW&msN?A5X6@+U%0p~wY+`K6&rA$F z!RBWtHZwP|b2PQ(XXatzVInqmFt+n{HRosYV&!4-VrFI~wm0XuGWQ~ObvFTWT*OYU z-au2})zHO^pP7LPXau|v+gp2?n;C*UG6O9PU5p(p&H0%*h)u0r9PNz_fu_vFZZ76_ zcGj-^EW})1TxOkheAi_QJ%_*v!}o)D06u6Ki8vP$kwb=D?1z5__6kTUxo90LvVm%pD9Z9i4!s ze`h)YO>ND+fxh`!*qQ#t8Uo)r07YU~Q*#G%Q+GFhHYQLrU5r67buo9f0-C#+8vc*& z@&hehO!-Y+EQsxaC-&x`ZUF^;7B&VZVrNii_?Z|ufUFb9@n6)~i=TrVnBnSX?!?bV zZ0!UbCE$zz4kEBFV`tz501YP~2mnyxGyfb0;Cz4EV0l1aOw&{PQ#`?o7t^Le6JU#c zWW}V70(zbB_m8IdajtMRyB@L^m;nwA2sM3!J|6z0@F5|7+q(*yV~WRV4SxnHUX~7< znmni4c|icp2$8~yl%Zkyppn_2HHL$W0HxjDR7)Rf=l1dkzhGz$#kF)e(w6SvlI$BE z7;A86B;|$bvzLSVo436NZ1eJC68Yz1#Z>9FAH*Sfx0A8g0Yt8v9C7*be>Qs75>}!J zz6X~3@1=}9Z+Jj#AKY$!FR7XP#g&G^ABdzg$fFHsklIy^x}m&7M7bU-`bA!M4m>6Q zD_A&h<0ne_M-hnF>+j=Lil4fZzkLbJQ-|Z0`xe`eFXwe0TE=un(&``z zry}{JJ-2QU+eGMawPmc?G3?DXW2orx*-$;&7E?X?P+`t9#Pli6#E%elu73kLiP*3e zMtexc7oL1>lzm$McQIi?lJ^E|yOMmG1XtkxZIZzj$FIwV`!l=pf)$cQ+OpcnhY2 zdoN2Lr+U&gUr;$+kNfdMMTWIM-;eXIfEi|~If%fnh$Gtu1~ZXyt}wlmn?!J$dlVb2 zX39@$I$UxO;vY7XR~M)!vFA{ovAj$pO`a-cn$ix%8~A^9qN)Yr5%Ft z4M)hcAZCb4;p`}-E}$Zm4N;sI&}Sxl`>}>H`X`DhI&vn<*RbDWX;2%+3-fx>vYN3Nxe<6`y<0a2xswxG>q>k z8$XNTuHa;A9lbnh39Cc_x>Ym9&t?xkzKE#J0*PNv#OGU?E;V#3ympJ{^3kuZni3N- zl7g@YQ0AHWon5NAah@VbNSwh?v`w#Mf-~47?6xx*6=?*S^_jG0U4nbY=S5@#^{c`g z<^hHG>M$gbaw%O^N8EUdUzQe6LrfOrpN*-GyfA2~9>qm$bHe17Ji-$C{KNobvLAAK zNg{+XItjeMpy=$C+4p-t*B>{Onb(V`u_!2iK4z`pSkNLWI4fK6gBeE-m%&^_^||}q zy_Fn+gnbqZ-E)vOB9~d4X4_moWeio#o;Tw?3ihI)9ziinzYmr-qJwe&+FT=t?AH)$ z9c=#&AKG#mQL4a}YVed2oYNY0?c)H0EGg*0aK5y>jm>Z&Cf$Y7`t56Mfh_+sOAHc7O0sE^r9%=*0KdflrFbCRPEQdJuM6__5dWFsPZXu@SyElyG+_m3Sj zLM_1vA{1MpX4H62Q8I|6+G|otPk2@C_`hkWA4z8N-DwK&i3sjZW@DgJs$96?3}t#h zqbAGSs<33U+f+Qe?9mA3XLU8n3N%C?Otx3{NQLJ*oet7F_bDgD?-_)%VMzQyFxvaW z=eFK@=DZPh(tAnydN%#Dzk=(5)!z3oTGZ9T>{Afr9U`4o7ryvD!HQ({6~9sR3w(W{ z-BCLRmwHt6V4;byTH5-$=8aGIre(zHq{nBan74sBdx;DUjyy&69O-n&&Qm&vh8O*PbrEN1Q#a9{(vv8DkONbmx)pK8q4JGi5DLnpYwWs zA?k}|s@^|@`ex$=!mW$dqu=dPczAZKuYbaneq!qC|%y08FKg)=`O$<1b} zi@XOo&q(iWUc0CHCAmB&Bzjt$P|LZbH7E@sRGB?O)S)wo-v7408?-QBzdpbusmiPvHiL9;U_e;{cVIKxeW^~BK@`f9h@`rjc%xVFk-5JDFVSqW zc}I4wOyIg{Wpq%1>g0L~r1z9-{P@mWCw^uzP>HO;xjgH|9EWeUS(f597IwV_zEB5cb``h7OfW ziP|5}bnItjt84MA=zJ%I86pgQ!z-Q*1 zV)Fgk#n}MHR4ugVgV1+YVeeOZq?qW^ZdmA5gLmtFF6u{Dy6&G;wXc{@gzOrG!-h%d z5gup)w_*W1S>haDz3~PG#Omxac)itIX5oQ10IC^;bj=2stoqxnh6JI>**}pJo-)ja zuj*EVL#?ocWA_b5o4T^Y34Hj2zy7FWQ_%m(DopP{r{OzB=urFuBR^Fx;c@K?@$s@vrmP&@tNFpj!FsG+ zFV=#)cG`camRC}f@t(`JrJ*~y|1*D@JhOc-aw7y9duT<@&8yk(m;RKu>eqyZ@-zam>9guqAEa4#<+wa{Ta~s1YS4)9cPo}J<1*+#=vzZKJ(&Mm3#U0?{=;T6CkcB7W7h_gEIhx~|J@u`eT4qp z5T9%m+I~Z$l95>!g?ntSmw!TO>86pB3Av zng5Yk?#5nMv+#a<=qQyRx+PPwl32%ZD$6)=@h0`WK4y>`V&t5w&Vca-PGqd{73;&^~IIKHUb6eIV6zQq4`$c|gMYK7m^2Zsw3%oDa@ljN2 zV%?vwG*3bs=sMyFVWfszx}8*&=7W4pJv1zKcCGTth7-nua!AQ2lHgphV=aLk{uLdv$5>;FFq4 zEyl<0Q&dLZs)o38+>H8m!ms$J19in45U}`A(35byH7k6<%cY#1|K8(-QJ?VP@h0d< zj`SP->fZb|Z)V96io=V%Y$^J#@#Og9UUV~J*G9nXP4ioi0M={Y?_5gX05^1UTMI6E zG9%xg(X>1=36ruWueH@?)l(jko0bV%Ba9CXZ45yH7*ML{dZbEg;a%Zl(IZl|dBG%f ztcvxdF`W=lN^fE#RP+LG1JvqqRXoIDs0s_23`X_gJ}HpM9brnI!_ozjGp%-Gdwt0Q zEJ2C4&<;5pRcTWBmw#Dk(+^i92&3ATqk8)cREN;>O|G4R<=XCQ2$Sy$GatKMme^Nj za1gs^cg$*{%PWghj9-%n!n0r*pTA>eGYM6{$LXt7)Ish3WIhv!*{Bb#?pR(=xN$x) zHHfmG`jqz>Ej+*9;totVAI2+8$jtDyGnM4~#G!&~ami-u>8t(q}}1V>!T zi+pZl$6G6=)izd&;^LuLUspxCTJdGOZG<2~?)53IrmC>*y)>6cb#=IoWk;8-E~m43 zr2DY?f!nLO{(zO{2#qT0-FZVIUEB09pXJ#tdX1u6YvY;Er+mViZBLSUUh#9=4y!!D zT!p_tlzq{l1u5t5k|1T)DWeZ28Goxo}9xYtl0It(|iCJdKIiSoL3hq9iQ$q!z7-`s3h| zddJgJpowq8`fab?c1hyX+?}vUJe*B-Y0?T4!Xv@Wc-m2b`D9Yh<}p;&W@Fz3GW(5X#>n|>8wRfO*DdI%z zyL{^5DzI5;v|!lHQ05}_lk`mBV|Ucj*&qp4OB6f7%Ux($u8mo;q#eR_j<|BHJbvnS z#DAoiKmLI59{&+$qB7Wf5K$=Yl_pU0qW!w*!_VR0o>RCK7pQUisSm z8>6DE2$y0h<&V0eg8xnFk)#vTDwv*u1h;Q+FPX@!8RT*V@8bK-hx`MbojFFicB9x( zB5QTgn4f(Lb*#{6MGIWx=ir50{y}nBGR}&t9_lv74Qns89}g70gj3^Pp>bUVP4q53jH0EKgpM<8E=|JT zUsR+;CIk3ss#s*`SxzoOWTJ9~eVrf(svF18PP7l7I1`#IJ}!+9%JVORC;Lr`lE@RAn+4{pC*2$ z%T$%;ZpajY)99uskV)`NT`DSv(S0>1DzUtC90fd3$|Nw8DcO_F2h5VF@$@8{%k>aSn*^#)cdDKC75s~**CP8Xj0 zmT5LH;r&?)8ocl)EPq^jV$d&v@3ZA})X3F`0N@{jrfp>%&uj`2^BbjD!>I0ds#9&C4d1TSb*I zmz7~}`^%p_l5%0n9X;r(WijummcbN=5%9T8!ccw}&N=n*Z!8X51EeGSsM0p~uA>(G zR{h$XGACfVImLqSKZQa_7Dx|?6h;#Ij$l!T6^oCTt!h+6C;>@{_$VXPJ{;1Y`6^R5 zlEbRqmbujZnfn%6LuQI-Hv{nG8-oGFc+<7GDJ6XNTb~xrNyUGXK3s2V6Z02!b1%80 zs|8WgjjenhrZ8uItozy;3m4pheH2elgrUi`dXDm4IEagO;P3z9*J5pLl0}mWG7OftvVKcKRvH#Dxt^ju zD#pPr{A{~>X9`Blk`c#Z9ZSHNiF9SYF@g3WH{vKW!9Jq5+)uOdcl3+-x~WzUlXu$6 z{u2UBf2R&s&(jViP5}t4uGH)gm1A0=NUvP0-?ZKd#$!uWDAX00d$ebCaZ@CcOj1=O z&V~gFlsh2;tR)YvCNX~I;#PStHt_BOxlrAd3_j4J>}?Cl=JRr8C(+uOKa+xSSl$8i%lx(TxRLYN zB>+%CGO+F26y(*|h_hCd#Sz0uY*YU=?rX}DxL-7Z&CRF^tz`d39l)jhY$W;zD|nPl zY~>tUhY#S|c?{e1r`jW$U-HZo*80`nC|N~DH@pb%Hw2RsQ<|X{mzmq!z3>_3TD~4m zMyVb~`_rg>c3VqvIVx+q1vfRnUv;(6gk#6gxQ;U?fdMZ?2MNbyJ?)qdSNQ4a)-T4< zJrP>fYI+Y9Q$J3$8a@*JR&;7ohtI8z*t7n^=({2ay*FW9t5Ha@n;hBIX;{0}>Bwwc zn<3Ae*0qJ*aoK6lqRFc& z0;-O5DdOJ1O=}r3M%}+5K;OCbuQnGf;M3>c{n^6dG2poOtq8RbOA|JiJP{oZxFFSN zcA$>vZ2fiA9l)==9V>KTM8j~68zXXaMsO!p|5h+w-w`a2`Hr)rRi zhp!nH_N6vL^9=)g7c-qKV^^uHdAmUZ=FN*eTzk#S$&18jUazfxt`1&sT69S8dKJP= z@-&asjU1xeNG&tOqDKTzZa6)!hDnqBqmAKvS7T~VHL1?vlU3h>NK-IGGl#Uk8RoYh z7|z9A8cws(!Qy9l@+_;UGc|}TeK%L`3c)U!^Xc{WZQ2D}1MSbTv98fH9 zbGj?>cV_+29_DNmRF91{8ED3hPCpR+Gm%iC#m78_$;qz6W#@hBjl@IWm(qWXTZ(-r zIA3)x=Jl`mDH!oct&=?B~}JsucsVw~j`=`RUSp^c(N#)gFOHl{Gv z9%qGsbB!DIeWojab|^CzhRIXSX#Iuh6EMYu5?1qc%QA%;)Zm!4_*7be655LX`(DQ(9tW zIrb0L{60iFkUBpO3*tOd*6>N3P1}{so22z2pPETa6p`Emmhlxnr<|@V7HJ}K5MBfGk54=NyqN%8E%3vv&Dg#XG<|?oevwN7|M)X2sHR(vfXza(`iMD)Olz&JJx5BE2 zTT?KtHq#y*Kcns;jW4R^gcXINSvW7wvnkeM$Lz|oZ%$K1fIlDH;ab@qpbztcSzzhn zJb`l$9Ddk>D(m#`X8F-aj^^t4gAJJjfZ4;pl zuN%BYYVX|#BZQXF)Y79Lsa~IrQ{URP_dTdOijynA5sQm1_v20BCh}7%bc$ue9q#9q zH}B-%a#A!;6pB_2P1$u6bKJ*+W!0 zahQ+*Z1&HKz5KKHPS=pMRY*s4#FkRjG8WZn!OmMf@M$ggBemJ$K9a~+m6}Qxx>Qsa zZEhBSV@OPane6n*+KP{Cfj#%{bu|OXk6)5HiMFgWi4Lw?5FKtr5ljd5u&>Fl0`X0C zf&};Sjepaop$)8miJu%(UFdG>ONvXi<9|I4r(L#Aax|U!9P1JByM8@|e|P6;uY7g7 z^t{)!FpNA`%3fDt(0mU=yYbv8b9Fhn=eljLx}w*@#0otH^<%(ady6hwjIho#%>FoMBs~B-g7d z$@X-+y-1e^&BaFpenYIvitFWl=ryFulkn1w)0r{C0atdjyY;V@-f)L0mxI8_^cpAZ zvoto;rQIR9N512tTGMYHA|q8zU$MDc`o`gQvzur^Ni+9kULV>s_#}kFIUqbMqP9Vx z&Lk0ETRe)dKomeH5>scbs&IVQo;6{&4jYp9>383+jxU+7%)`tSTF}Y3tL=yl&q5l% zT`E!R0zb8i;RIIWrkq6lX_u(HksS4mfHGXX zfKC#jyccKO(1?ZdB7>#`qxRly@Wm04uekY0Uo)uwq?C5M9ZSX|t5~r5W-+FXBs#nD ziK#M=JYOx>b817D+4bgS!D(M7Dz4rVsYCdE@mXb_;jmBViq)Vh_IqqGQAv+%0sXg+ zn(O|!U~a~Vs(<1*>>P#oVQMeV^f!0D zX|Y_yl&V0Ii6~;`AIgH4f%P*70T_FF<&i5`$E)*>?jFOE3e#@D*WfkuF3#p&q-bQd zChw#62P;^w)y$@umEgSMn3&?K}ouig!R(u1p7vwBkpVpJnMM_hRCbTe{0 zQVY%+ca5)dIMa=hhmXB%+OVhy*)?1ZL$qt8tHXG0eK0c-v$no}^4hx&+&8R3ZhF%p z5x?EFd#xn7J(b8@1&IZg4=3mI8`5P{1eDw#Hv?X~jmwIJ?htnbk^FT#lW$=VnMDMw zM>}(d2w}-2k3Z>M9STt39d1kIr3~wDoG46NELI1f9a}};W?|zY&L}40m+B){ck(M~ zly9byX}LB`3nF-v=s2co!aG~OKQ!P6p4b5}F*kyVGDYF5)Av@jyuh)O*4v4$%#u9u zuY*JC4ArXJ%n8>YMASF23rEFv`CRrQi3ZtlA`z*%!r$gXYvq796j zR1`<17nzz$uDbc=KHkA0aZkGWc$GSe0G(2)>NoFZxEUW>OSwTJS1*4B6z&B#j$_Q9^2evB(lIr4q^LvphcZTtO1owINv*iXs%y;ETz@lbNe|%)?1-~UOngReK07OQT8LxrzgIF6( zC5dv=z%O$kz;evKe?NiCDv8m@=tX`0P>T-y9I@Wv{RI(F+7_l6Y1lPuD+$JEMppFR zBGh--M*m?5&73)aDW@-Fo%}26JS70qWZFn03*)`okpNJ#4J9jpe)D>u@ks;8j??lr z2jwWr_`I#Wr3V7Bx!@6^khbdK{F#X5`<4>udkAg=a!Dbvp=KIXbgY)V2{dxDR7SmI zBJ0aN>J;h3qJ?`>92)v__zdbcJot~`(-PbB=)RDQpCkHvhv(ayS*-y1G#7>n2~oY1 zxekTdYg=38Yk~>>RM>MKN>eAbUlwT0R|4TAt}G+iOv3m+-9ZoK{E+&is5}*&M-sR+0Df*u+umMxtL#-emZRK>o#J9jwamU-qF~fMLcB49`ipy>h+Z1 zqY1*pf@iy=42O`Ln_^^eldJwj&h-_)a@4j+y|?$lz(YI~tl98l4Lo8UfGv1#)Pgj} zjGz;RX!o(4AbSzQ1;crYqznQ;&vktJ{e&^|@aH|KQ?LkCQEbg7h(_BecqH%Ve#h0i zm>_)|^MO(S5H?-mXPHKQ5`%8z4e&}n@LdH($$Q4nI+M1oP!QQ<^Fs5#1RvxGAhIuq zRiR8{zBwI~OQ)0pDE6IqXw`x`;*X`4|5!9;2&MW zV6wB*v4kszcz4LE^`|>_SrM2?P=jyi5hn{?_+uN|8k|b+wu?IJbKjk zL$qo6NZSup8wuM~x)TWdJMl+Z#6oE{O&+jzP@Tj8uo=m*cd!k;$8_<}WHs-0&;(Q4 zW!jmC%9|u)aY~GLQ3WrhyjS8Jv#k#31rbBFE=TTc0Pxl6hTu@f&MyOBzaCr35hGZU zpc=4CXj$cnBw9{O@aNN(s)$3swS=ST z4a`v;@Z9NE`^&rb!$ic)l(3hsq9>Z6?$7wzLRiw$l^0mt75!2KD=+$`cSh^L_hi?Ue-*&KfW$HyK~ZSuDL-i$` zTCz6&7pKZYt#_=lhB-$NRZ|{I^oINkQDyD#Td+#(orzw6F4A}PRkCu4F($>&T?3x! zJ{+UXKBmYPG=yUp$FIz zwcWtF5!;6A*Q`^2OP4=??FE=;Vj>F3T%~>veCA^mEf)2G9S`A8p?tr*NI}HcapfJ@ z`f;hh;a)L{-lAY$3W1!}8yb;M4K*+>fkYFr5-e$b(g~$1&qcGshn>Vx@-Pf)r558= zOR2FRdzTk!Aq2_^@#m#|q-TN^%-;%SZE)tR1*RY4Q8xz`>pl%USqHYbug%8i={>M% z1aTptwxT;Dd_i}b3dZibV}Tee3w@G3Zs*~_w9vZ}!}$!Dm%Z(zj8!1oLytzLK_>SOCRDyVMB}D zrQKDYbW1JB=Y3R*GiR8F>X(UY?O0YlebNuAA^Tb``=*rZov1_$em^0rMO0H(@-DQk zU6(TFQaMnsq)U!OuWe4@&w*cLr)nu+Eh+1E=;ly9$`=h(G_;Ok-sJrV{>0T!x8AGq z8?O~VWhu?`L>2Z^Nx~M)PlDf*D{kUYDtj1{Hiw98ws%;VdGiFa z0)zb*kdXXzZv7^h%`7N(#MHys@*@TB^yyABY+PT;EDqYyDLP>Q9^DH2L#I0;jTKDK z_b@E(wxVv^$!63PxSN2bL7L9gem074vO^lnaYil-!+1-j0PSBGVgV*PZC(C^jaEmj zbOKJ)keD*+L@WWrdE+*6pn(RP=hzdd{mJ^JKcF&Vby1N(Q&o2z_jg=7zX0%iL16jr zHaxPx7`nLiNZ>rEkD~p#w<@NfeRHVb>9V;4i#>k;DkU416Ew zVk=>rPr|x$*{VfVMC?U_n6}9=3^ZdItnPh50MoLej5~@%F>J1oCW2E!T8IdO;V8A- zSzD-w_!Hnrq!b?nV6k!|h+nb^Y13LS`!0w)fJKF%;GmEgx$9@7;e3J;{OdFaZ+vmXv0 z;_7~wD(!XX^%@iHR4vW7>zs8c{OpWIL(Tqv-tZOeDVR|9AZT;CWFjMfRK0;TIc`}; zr9mbDb;Z(Z-nA5d1}6JF)9%a4M@2apB7$G%cu2*Qs?s6C#jvF@=~>0kZxDHWoNfI~ zTB@6#I}rG2=t>EL8O0&F%~)+0DNh7GV6iwvz=%j2R! z54{cRDvrzib|g&Y$&hg@Pn(yhw~#@?ReC4Y%d14~w9T=P&fQzTl2}9We}PPGV6c9%s>kg}RO4l1dRC1z5sq z_v0FVM;?MaR31VqpQ&CBl4fzQuBWPfrZfk$@LPmEn@PdPi1UA}A2jxi)JMsxljea9jn=^~O5`lB-Qa?YLM*RsNdqaz#QZuy5?_qt&Y7O7W zAD?x|5}pQA40QMN@4}G?DC)n`^6p>|3$=_smojfI_ZYmtf9kbMXsUKT?bs|rYlC^$ z5!}eAXhYDPORO1QT4Eu+@IcxEE1S>uhLm{lY=2HxLn(uLIEjp%gZ=fVJyrDFYqI^z z&H!PQM(?Ng!1Jf00P7(4gD0FWk(I1^)cOibB zfctev{|7!>tluLb!Y8A%K`FC0b~Xq4PoQ;??dY>HOH#4KJu>z_@miN3U1Et_hzgqB zd}V$YvwU`V}2BE2J7Wc~v&b*xv<0suOvllcMxgQoH z6MUiFTd=DMBV`NOWbYwUHF)E`2!mz5@}T$QB|5}r--Wlz0tN`0m~T|I=hVq664KfZ z(Bq-JAN-q58{QP=kdyZdud&TbH|tC%@uuj%ia=5e_;r~D?oiuPaQ?v^Nq%HHCu9;Y zS*IS}RqosHJdtp5I41~6Hg_QTAXmJ{*G{Nb2!jR-@vEL%{||zjV|zVL>?j}#_DwPi z3}?9VwEek7>vT6*YqHe(f>_YY5M68N#$?(tou8eG7X7{Be5S3?_i>5Q+6+53aaQRU z@9O&3pBRl436?AjDNr7=JVQMn*XPLNQc|#7SVjt?qxtF0p+ffwrCLjb+^6!#XmI1= zp*BhxmTiX7j?eJoCloas&Xt2sVxUbXd*9sd2(s-8-(XX|#eToGWgxhh9e>Kz@%z$l zNPvcGj2S(U`*0{5xrmLf53j&>VdZ46J1?+0!0T{uBWJiI7M>z8nC6JQQrg0b+iu!f z_VYWF>P}Os8r#fBO*V`(zPOWZu4I_X3f&ruct*DWAXLURGp{pTOj(X(s62Rl)sLtC zVBaZuex?@B``{I#J_QbgV3?gzSfXi?He1xU?XaIsz6VT^nDGsBB+ug8voUiIocxGr zGiFc~-=~h;sN<>MehX$Cd~17&bMEuTBpq-{I;X+n2^F=4I))jVwKDlemd|KH`k`q( z)+8(Yd+Nqm-3}Hzi69Lo%i%>cJOzeEjNQhMpdm-g#`NZ;OrxTv47zh4CIk6-j3+f0 z-cUx($ryLh9*rDjz0l;vb%NYS22ZU!qJBam%&kC+=KQ$brh}3C3(hy_*rnkJM&q5vDj}IpM~34i^pG*@d&gg12({37 zyc1rU>DW*8m-3hdaajpqw09ovS*_p?634MG^j<2aEBVvxPI`JH$f)EV6Lsmo45$00Cm;6nyK zRgpW}c+?oVdc&`ke{rhzKncqfRE`^HmyE5queC(!%Ju=&Or$WZvOWQ>ohtknbn-gL zuZtSgT#e;hhJeh4BM96kw0|~Ko?2^RCHyr@n{5?tk;SonC6Q2xGL7( znQ)XdF616w9B$I!ipOj}EqPIYa4@d14nN*Z{{3s~YuJ<9^s%hFX#%W+r z&R1LlhG(cWD_ofCU+Ustgqa`i-6EL71Vaun^PfMR1|IYO5!QaYOW-^nxMU}l&nJQ}$-4)Ism~UUH|D#fqbKby@ zN;oprT6?`h!gzTk#dRqE2acKtYPDrp=htbvIV|ur(SxftI^rbe zKF_JXP{~`<(-5r%wU@cE3(~Cw^!N3-GdFi?ZSyDO-g&touT0iM7MQuP2YueH3!FV= zHhY{v+&rj(dmkA+g|LCvK2aoN6HpT2M!@s=B;Sn zsFMNWmhpyS=L2qGcAWw0`TEd{m_hK58t@0;Px|`l_QtPP*}w7<*p#7oQ8K0SxZcXG zMW&X&)KU&96^6rczPQ49B3o|!bjhmvuo>U}yb7@Z;Tw_j(SR7ap1Z_GMKr%{B`YJN z2R~S=7G+6`htuvI(jPosw?;ZT0Ne-V{tvt6ZAYb2cub5~<8@$l_{--E3P-+v*7Up) zi=C+m0aa7a(0E01$H7*@dzd-3q-^yLb?5w91)*GXuU0RswLgm+&(dsD;t18=&@*@GTNHNl2j@pzzb1+e9ABpnTsAhYhRD#75S50X#s@^@Q`dI30a%udXpzpwux~fDw+E%U0hEJ3V52`dd<1c>lZ9Jizg%QiO2c2?CPwIETEY2jz8L6U9)o-rs+ zCfcFlk*iX%xikpjAr6B26|l!%_*f0-(|fFD&b+oqRwONP=%26GXYR{KRrk{CMr@3? z6UT{h5@8h8J#u_oSs;gv?AEe=*kG1%lVOPDdExLW&P6Z?v6|r78tfA_B^24isnLEZ zb}-j-X-tn0?Tz$hJ>e^R>9b{dBRhxn(7tVA`f$(pWM#4;G8>g^8&CD49FF0~M2rG+eC2Q&C!E|26&OMf zWq(`I@6QvBAy{T88~5xN>8IsoFe?s@F^+AEfm*7vtm36U4dN&U!&-wX_gCJ#gS!U2 zKGjXJS8NG$1Q2-caJs2>nA{u19CE8ONa|mPxUxBPCXz5Ig5yNxqTsMu8^{VXYjr{d z=&E0Z#@1)fcc*@;tMoM7f=A_qjnvkWg>Gq}!YX~xgrI{VXG(BYfZc}HDZux3g!h&O zpOYci_&l;a+YAq$A1IryCT_0UIV z>9_Z$31iSLgWdMz`gCB}0^??I!ETZ_43fLsU_($wijGSNOG=7>dI3XtGYw z=|fSfz0Ml$@OEYxfO{nZ4n6giqA+wr| zC~?QGquE9&wZE{@Fw41vrF`UQLdP;XhR_HTw!fFJ?n^o7bS2FFbhh*u_x5a3`oyV~ zs>Y%ztNiPl*D?5p}b7OhCJK2)+@-HJ6@xFGE4uWb>T^E zCU1aI(S7hiQ7v+{VOl00%uB3bRo{#EbxW{tD!yKr_QXbP)1}QDBU@_7XZR{7D%Ukb zXhD)sj&V>WX#X4X{07Astk{(*+E}s+rEp_6@~Qd^Cw!}Ng&kMB+SwwfYqJz(Ri8F* zwph`kRT>KJn%uzNvWE^yV{7|+fymp%s!Df*p>;oAk&fbCqr1I>AA{2(L%YRS&l*>j z)?klt1Qc;-J*RgDDB{VVauLBy;2a(OJJjWLp;N|N^-G>g`0w|e;EX-rADtTSc%_(l zzf$qK5_}Wwj64Q7O}2+W)vsCV%NEkP$3q8u`<-Oxi3`Km*{o+GQoY;VvxeB~LB<%1 z<;-lhU@tG=x3l#VWfQ3qO>8O)Cbm(e4>n2J^xu6|-&-+o-mXU6r@g2|OEXd9A?Pv=z~vvTlp{RkIb9)cFg|1IOlU_6^Tfy(7j zZ+>S-*Cz@`wzcuC7U{D8r2G3j6COnQ$akiqW8^#J@NHe6=#nk!+A}m1<9Ijv+fe<7 z!!wcarG4B272DPHdtPl^1F#|%Hk#K6;d-0ebD!y>w20zRYqZswI7m@7W2No%r&nY* zVH1^AI2%ZAj`Kblgc3Xw#2ufN<+RHL`%?~UyAa`0;jcd6R=73N-(*5~j&ZTnUDp)g zRr#m}UiC-BoUz3{O1q{1FZSLts;;G38(p{)+}$O(YmngX7Tn!~1a}Ay!7aFJaCZn! zaF^ij4&P$$_uPBV`L<-g=lr-o?igzfV9{Oksi(WEYF72^IV?h9GyDOP_jKn$Ae(UV zYXbQBQ(8Rnb>AUPC2*7bscV2o#txs3Z<_9%D{{WM++*7k&he`o_rb|)|pwf>`e{qXqU}%On|;SBxhjD zT4#9j%^)~ME6gof;aMrBXBZ{On#jZRZ>NWR0&&w)x@3FT_}@&I^^qvsc@vXFN0bVg$>pD|1iK zmt&Iv?<2X}u;^xJq-89;k13R3s}xx^s7|;jkKF$;h<{SDdeUIz(=G?=X{j@0Ww_E9 zjF3XyW#}n;i_b*>zxAgzI&pzUGaKUv_Wqd>vnx6x8{7bICBi9#Kz!tJ6D4#)Ya!r6 zIc?r6ccQwf7y0y-livXRXkVY>48!zl%Sqq6kmC}TAUVez=t!9HGt9%X**FTQH`Uy`yaN1FRfB;E2Ll1uy3Gp_GPo1rCwM zTAzbJwDE&!b;WvO65f4s``+f|2v%M9Le^Gd3KM&7d6X?I)Q)E@N8`YF&C0V?IPKZI z-7yi_yX$?eTbwOj<2-_4WwBy!oh`m78ymuPldd}Y4Um`iRZN&$`HMgu=T$9S>BeK8 zRXfc}^iD9l1atui)#Je$+=39O=$mGjjGx!CR0<+|J|a*^QeA7as&xHvwEz?e^HPs8 zvE=io1s}y4=N8~@GJ(*fG~z?7yEi@V!gzM&kTMov4i#I@a1pqH(Cmu6Ya6Bu4q9|) z8kHX&fCu4#0gUR=Mg*4<=(w?m6E$9hh-$6gh0bqO#Po?gyRo@Zm@J>aoj9TlLGdX? zh)`jcURmtxqQ7`LG-zAbaw9Zj9$)Wa6=nE&uNR~Oc4DiR06qPrj6!3*`V(eo;9+`7 zdW|?l>7z@uc<_v}uKa>%bHy~B?HErhVj0#r1Cf#Fiv&JLO$Y|#MPMXTwQd@IWY40; zFtl6@q_;p&>yH(I<~u||g8l)8`(8WcshEuF>Cbm*cHGpg;CoVZXI+T;{*lK1 z;$-Y$-$Q^rr&7Pe#aX#XrpB$I&_W#7ZDJ&dMz?C%Y7E2?G)1Psh zpbH9>3O|%b%f9F-h2{UUe@G744YbkLFBYb{YQn;PKO_hv2-Rz#o!LF!qXJ=+f77EA zGlW8tl*hh#`ZnA92hD23EezIFDi)h3hpFgeUWLeKG)=b636kw&AEt*2N=&VQfrH|U zbT^0nx(c3o*xiAus*w8pr`w+37YBVUxCn8T2WM#<6c>@tVMM%{^%ZF;XfNXD{svU~ zp7~ML*>e+==aLIQ_{?p_!j(>7@pAwWs2#=SdqytX8oVopbP~&XuLF(00eW6G=2F%d%tsvzCHOUL?Siv= zoG*)BU>;ZdM4Uw6&4&u(%j(4ey#oBV?~1;r=k}-NdKGmpmddt+-G_t*Ixb>w>r_nwmW3Bh=;%-ct_ltXPNc*!k^7soDikGfxZ@o;CCgN3k zT-)HM$Q|oYllx&ph-;U|p1vZ2j4mAS!*kIuhMUBllIq|MX@+k2!JHEmSh1FFm_9b} zL~xx)1h?rUHNIuzT0b6zW^YiT<7hY~b_Kd}xwYS~|AF-}eCA75yRdNxAw}bU1*@!~ z^!MK3yfnQROWm5RHrMD&Q!E*NJRbhSWjbG~0Mb;e>wX~+XMW5$-b%Uh40WPf2QmOr zlO)l&04;aQWYt0y46%*H3&z^Rj=$-`O1@l}s~qgY3@ZDxZV64BPyNVHchmF%Pv!`-3&7$a3tT05>f)srn-( zW-+yOc7&D{##ddqbBsezWLvq+hhHdX4i{p;cAk63NVk zK4vl(+L;y96NZUH!@1bV2QN!;H}CCE+ckz6%hXz!*3@wm6v@%tY7$+S%c6%oxT!h~ z-v#iP&1zV_y~#~NJM~6`5-_@rGG8;Mf%_&;Fs_uzBdgl;co1Sbe(8d~D5J^9lTn5S z1hQ32Sqr0mUrMXeO@6TpTlc0Z^Ku!QpO)U4FyX`>7S09r}NMSt48?Z zjXg+nRli&|HtoneIUerye03y*o#1x!s;UGts#F=6{bKMhUjw7T$Ir7u z?k_tver|65Wz~Hto{oZ41tSy7kM*W{k)AP(SYJsU3KKlCZt+6igt7^w?9wDGC2Ka)nT%2N1L&4|igjVmMo-px?H z2+c_2&XKCcB2L(0s*$Z5Pg@#Q?A%a}{+a1!$&; zUTRJVDdB*K7b%6Ia`85}Q^gNvYR@90phrVAY85Jv=hb%(AfE^*i-dRs zMZEYTMo^T0FicYXWcxDWZEkkY&vNDK_v1W+H@bxtnYX}2g_jdIVl`2O8CZCQ6ccj% z2G^}OyF1{@qU=}THlca)g{@dq~Q;NWhnCE}VkXp%l)FKA=O zbLVL9$S?y@qlyFf&)PoUst6DeQqu4kY7|IetXnk(!A3KoNXPQa&AtO56U?yphDonu zUG_}S(>@%UuBtB($E6vZ`g-<^yDmX}QO0YDK)%Sn;7ZtEZ;DTc(*pn?Hel7jYxF2P z6`5H-O~&lsqG%9=?3Q~$KESPxvM{dcDlp$z65hu3KST}%W>xy9P6Uh*WnMv{9#gWU zB7t_t=CaMGDr*w9C<}Cl+07=}ipRBMa#RI>Q`g;lls#uB&q#??)~yZ*^WYjlsz%kn z0;hio{ziTp9sQ!R0JTZl524t;dyprvjBjiP*VTu5S_XOJe@?OM*J=MzmI2Fmj;2(s zNq*QUN+b!-5YmY52je1WG2u7$(~c(U9jPa{EvbgVi5Q3ckE9o$^708E%jCgl6&o%! zw8fIy26XbYR-ZxY52h^pUNEfP=U@EGYnTt zYv^-cpkFDb<#->!P_)kFVANMg@3Eq+0Y9WVCgRK8y@SgEZ=5c*VbD8wz%jEDN8?^mnw9f8Fg3r+-vYMO0yyp${w_KKr=(VF! z!#SzIYQb^-6|HfYncNQN2#JG_tLx8PllpkA;t!ae0AtpU?xW~0FcrLeH@OtehasHI zaHFcDyv3&$O9B7@%-#1c2;ZwSs}KIGRWtUM4_rh}qE)1{DdzABqJ*U*zLvd@$A;U? zV&F;h396Hzh)`~o6ahNnB2bL(N5G&!bNXiA0x#uY05Z)cD-2+Xoh36!Ok;k31SXll zoM}w<1N;dIYXw;or3;G7P7hpr3-6-8D4 zfnD&@l#EiNi78GOWZ(U?+iiD1vbbCZ{igf4A?S61tC=<7yv=9o#m1@2Ar{zJ2O9|{ zv=>#fo=Dk5@(Zu;YJ?i6`n8QvYRnb}|Qt@uB zXq0R%{S{SR-If`Z2fa$y)~RL*_y)>3Y%9XCiyiR@)zoD^1Oc&aR_WNc3sUgbJ7nf} z)97j5{*n=%Rm)eH!@9XK;X`Vf3PEm3I6Q?5hAsB7nr#wnG=2wI>}2NhkCb^+w4#n_ zvP(!bFjJtR#{378@D5xkXDqt#!=Om$3T$$7SO^|Ph4L8~Hs%rx^Ukj0cO*GWBjuC4 zXJk}vURr3FG&!g*DZIRVe5;sj<_OfPw@J0O0)zoh=$VR^DPO>XmLj9s<_xl>_n`+W z+)Kw+uDY7r$$7DQ*lEXxE_~f98Pngauy7+=%FQ1qKQw&k73RVx?5GJ-$85TR7q5OXgr+k*?^6UD5+4)k(%L z-_IDd`PdITj&t2wMno;hQke;HMRqTyP?VkD`t74Mh`Ye zQ9dtj&R&4m9n+42?I3Y|M?HpCe^>Q_-{E_Hw#GkHj1_0J*q5NfzOU|54$31uf@rWW z7>0{ymX2ZY(QBuT3(U>9=X#v(v?6znqunFZ3D)*Os-xg(f7TW3AltCraUZMDUUT{| zbCR}f6a#ah{UB6`sWKP8-#4A`&FtM`ws(5*cC?=1hn0%~W(hi{L4M;rq@8m{Z3P>O zRyzUKz@h*%zjERZ|nnI1m(%A7qsakvkyl4i%baXnjHD=Lg@0xFxfX3|GHI4|DfKA{Lp z7pM^s2t)9%wPz?gHajwXNk%>p&)d?nt~t(DFbZ;*iMFOB z%zl4SD{?Bv;K+Wx^@$0|eQLUwnZoe_55f(E#y<9g4Lw27@%{P5@XTe^cRPq{0ZT-( zkM~)PBED!Iaw@B>oqQYQ!?AtgA6~o$VB_Q04>Tu_gDHjk7d#uimp{9Z!$bxbwY&0s z9K$=@_A7q8rr;~8j~aM9Yx^k@biwCW;3gcX#gtD(qqr==JRD;wW{(-{_FS!l)^kQT5$j z4q!K3cAB}cs3St~oEw0N@J7U)LVNa8U;vRO4?=e8BL|cBpo5y3-+4JbGII&o)h)>2 z@$4BQ-${%8bUgFGajNWDYMiPfrw|oZ0)-Z7K`$JCmYeWoQr)9hS08Udg;QVBzm~dl z@=^H>c*S8o27#%g>4KzvKed4}amZ<%&RS*#Lv7TL-FxhuY2)R zq;UM60L`3*_?fTk-4ib3OXEhWYY=`AI*Uq1*u5L{3aY;ltLk)+BD3RU4jCC;y4sym z&$Mp@OE>-Et^Ah6OH!3z51}<)Io5C`wQ?oVd3@u0{tl1864xD+Tce>I-O1G>LXu1+ z3Oy@JPQ&UhezPGp-D2;c>g7%gv4&IMI^6Sn!E{y92Q0toj=N@Plnhy(xh%%mHcQS4 z-UTmY?qp}C_cH={q_bxTplv(*KHSI%fzAe`9x1@>*`ew2CzBfV*Vw?anP z_Hl`eVZnuMz%k8|KjmW@56f^*&^>3LD;2q~5en3fqXKi8$rjS_)dp~C& z0nl-bPi9&zG@Oc$?E+Un0z@Zbh;b}S`g3`rjFgh%Fblu3+P1nLZ4BBz6v1eHc&=6O ztiQF7%x~)RappYJDa7IYB7NW(A!g*Lv~x&>$$)el7PYutylJN=>n2_ladL*|7NT&N z&g~oCUhOTl{V=gsmo6+j{#rx_dx{ukg}^t4 z3hQ#v;h7dj8Qeh1+qUmW1s?#L()ygpQMr_fR5ru<0VD`&)k*>#z_YLS6$&EX*<1MQ zf(wAo-}r6wrA%|XufJKp03eE}x6B{ePdtK6r$doM%}%@lLA+2s2lrIuDa0U$Hl77^ zX|`Q1;czg{yuND*001ZmW(aWxdIKQJ(i63=3fnXVC-yh7KB?(T!buM@cR?IVS$EtJ z0RRM)2=#7bL2(@@9f(<@UnhO``7n9_M^xDYsPSt63?CNEk#5LK-~q$yK%v4Q8Tzb3 z-T=tcnS0pfrt8*X!^Xb++YC#0044)Oe+i(s14C^z+=`b00y22 zK;b8p1sqCH8=x3!kPJf$pqT#{Sx~sa{;XzqkM5fLqmI{a!I_9&f7JN`8*>Y$m`M~0 znk7p^+rGRGH3&bollbeuL6+c-xG@H0X*@}dGKhd3aYLTO!aFXH#-XZwfai+~0(-Lv zW(3hIFjl;_cVcjM1;CC?QMv5@T!+TC@_a*sgBNV{r6&CKzW|-%3M)k)0Lbe_i9s^* zsF5;%`~J5XSQ@)0@c;e=n0{?U3X)M^^WW6)ccyfCZ3oh%6$KOt>;s?@Oetl9rYmAj z0tcRT2~^Yoh<(S2ilj{CjSYrrEcC^qv5aq^JEPDzx8In3i}59 z1r&HS01-&W-hV;+U&Vv!0NVh;9{d{E(_aBA^BdSq#D52DCf#3w)%^`@Cc`g*O=bNR zu)i~#srYY!wf`%yzcZWZ_-kNYe+BHnm`(U+U_buOTCMqinzW#>?PC6pxsK6~z|0*4 z2+S=2O!)U^^?!r+b>&bArndYF-hYw1VDyitEh$Lm-QVDSJ&GOJ?BUn&uKfz$-}%iT z_-A;3=Qo4zm+)r1`vts`Kq(xoJzN0=&S1r)+}(5R-xZD1a9IPjn)@8tXu>d~Jy> z|JyKR82*A2MH%FgjVC#QN4;M*9VFRTE3uPPylE*|Fh)-TD81C zf&X8p{4ZH*&Ofu%pcX*Tj0fXDv>>T!$%E@E2;y&P;pb92Uh#vy9&8VEG~a&#|63s+ zaQZX7*KW$4z-~YV_WnkJ-`Bt|S#LYRl)tpzKW@&lFxX(+tDM!T{M%ZjS0#?r)6^yS zhd=H3?_}ev@czgz4-{c)t#<0mRr}5YzM@C}UiT;+T**s*|G$i)dKMMyd1rn~WV&cmz1xdgWx>@wx% zZLOXHU%&99l@Q*s5Fc!~@4QVMD&jEn5e0RR0#YK=VaEYX?dl@wxcYFgDA$i0s*)F@XqpV zfUzPtn&BoEJ%ZV-w@^IdkI<@#J&dTMwNhU{86#}av|_!Fbo3{gS^86hx@W4bLWdpi~cW3F!hi9AJBLSu?0-~05Bg*UcjvmO~p(L zbzVkcgLBoc=aE}vSyI~$;jXFC+HF7YCn!l`*2)>smk&=RWp>woqsXRqQ&JH?ltLCm zE{k^~K!UK&q_0A?G(eRvRe;sVJ#-8kOc&-#gH;~BB@a7ADhb}2?{-II?=*M0UiyCN z0|4l~S~)hsU-Gw_{V-+#wcguYU_UU>SYStTkUw>~n2*uPzmv;o=KJ-G>-~2pc6V;YPg`%zXL#HlAh|C=?51MrOn}@!pF|JwO zi1!`tFGK(U7iSk=OZcWYNp_Kr>2S%@cSYyp?>E4$ap{FXv}J754G3mqf~$B&Dqb#_ zQ|C;**`XBG@P3lIlib7v%As(Se~8}-;YRC{QN?HB2%w6PoAR+$sh*im)lhs6D%xXs zA3KitVi4Cor4~NMnz#$#qL!AEmFk2W4#4z-KBlMVB=QV`WVyd;M0svK2Z(AgWe-69oO z1rl9RZkA3eAzeF(G^10?1u@4D2x8+MW~XK-Pv?8P`W}kgLJ7_0Cg)T## z^CZyn(*N1qj9)l^(=NqMHAAa&XYMC2aJjgDvM|vJrOH-)HSU0UKFS`w{86+W0-jn^ zOw$HV#B~DX}9v}K0+v(BaS$|nr!YeSbrI-lZ6A~}{R zGzTRH4pHuNgM<nK!WGXu&v_f0&0hGX#Ajx5 znx7sK(`QxZV8z%z0~L;;Zs!0ShhPFRTjc|Cl9^^5U5fLDz@5UFw8S@x|DAltngL`@ExU%gPTPRIqbnj$WibO%mYBn zP_AdsVef-bunxC|P}w`g>#9un3Rl?*YcpO)-F!*PlLCrKwgS>M5vmuIZ@!=!5y@!2 z!=N&SP1-H??nngg*`veSq~w)Ma~+^2(-H z`x+nqwN9~Q3+q|^z;G8I#lZS~5xW@{Wt;&Ln~zjsqaG7#!(xxSTPSol|5s+C`;+gO zHj6qYRbZV_qnoGvP-;~=aXPRdG3I#S!o;fK+)XWgjJ!iKDxlI^l1?9$am0#;G*>yp z&4c8u0$2xz*ecnddifT7QH^cUBE3D9uH*Snu<(Co075!k+P>yyqL&RxH!l}z!JITY zO_GLM@AuVS`O|NqRb0BY;?wa^*M>}L2V1o^Cvdl8UK)!@__CTnr#m2D0fX#YUU<6#ZH*E133+(%{ph$8+8i$N>{p zWgY<>{7SNhN4%PvquiG%6zDf5hk|q&`!W{DH)O(9Yy=G#U+4PQXO2Lbixq#;NF`Fp zQ_yFKYe9&niB!{m*0glIjsR7BoBQ4sZ>B{>i5K55kn&w;2RKD38%?9`}91I-fD zb2;zHn>8&tEO+IUD);VMK+adyw}7#{rLq)?z`#gUx9AgM6RBOKNj<~+PFUC*+iqL( zj}Z9|veqXY=oj;@}JL^{sr|9PoW;6#OjCJ9+Jmbm&cfcHg$nZKMpj4u`3- zO}958V7s15s!AwIbk>Kw&3$Obf&Jd%rY~||%q8>d(su@GSX6DdxuGggh3BwD;rfMdEfv{sn?0`A@}jaX zkQ2dy#}H}w(eXJgS%Nge=4C}+Iw2JeQmRT`Fs zm*7OP+-RRub8SR2Z@--VIp{g3;Yozq6E)hglD@B=HI7!7M16NxcENMZGSBM7^v-zR zdomBlU7UqYF24qzSM!q6x+KwQcjf-wPx5TOyzI{!%J4aA-aM-7gqUPf8Hh@t45lH$ z1bYn!NtsY7J45`+w8MpmnR$Ls%IQ0D7wSHxZ}VTnI6$wDe)N}F(Ad^#?G>^pzJWd# zh!>Dtvk>QFSlY@GC;L%y(iwX$#MA&#*y15G4bErEFZ3O2IAWlLz66WVGfz(UJp;#* z?V@QzRWT|TJ>3(vFoxU*q8b?(XryjmET_?UxwXGvw1?|E$xsZpZ1f#Ds#k(`8$RJD zBDwYHd$I1m)6XCN@ldhB(XY@$SM(jREu#GlBl#x*doHPN;Zb|-^}F$Nw7SEUnaFb{ z(9ZrK3b|p0>RZhP0SIt>JMOi9JlycW?W2MmHho~>CdY(r${&I5b7`e;?+0#l3a2RkB!t~>|JfTk^9H)r-uzzfGLP6k5ZKYo>fPQpV zpyXWwLMXf~UCgvEoRG{`yyAPe_=IH<+wN){-IeL0lCs!D#&B32DHG4p3azN-8ANHO z{BYs>^z(L#6Js9^Uw5d$8CXJW{0zrjR_6d^2ZuJgi4Ff4C-Q><#HRi6==xni zrS}XX)Qf#ry`qC9oMksj{)joO>l4HWit^3cMz&xp8BTG=1o}C%g7WZKjGyhbJw+8i zOM;a);At#I*{3BPCjl++d{(oKsWd64PEDIzw{Dz%wtAL6jYwF;r#ok%gVT|G>h5+V zBe6H%7tynO4nvoK7^`4N3oCD zKS$aro}Nv91c?b-mIX90UVKh&eYCMkM#UXB^;g7J^kZ{d{E zBYahjonIs$0Y|qzhr@@~wbGR=CY9O)YR*YcRdlUczpYbzZ(A3)#JAlSdA0X^5(xTG zxh#1xZJ{a^bQrqdzx7vA2qE|w9aMiE8Iw4D1VM>HEcZ8<%AKP=9jy%W*n2tfNEqeM zj(7E6jy270NJ@ACUPM9WuwrjxmqHr60%(yHR1tJo>jIw$hhwZnymjEdhBw0{C|CaA zJ>H6FPqoSZTApuXsw95m)y%cW5>T{tr6qB**G}afEF#PE(;%LGf)_2dY1!Eruc6jd zsqrQLM*=N;I2T9QEVngv$KkS;90W0I{ATBIBl4e%!^;(i9lomHquW_Au52kserG4k{UdqvHPCAsCAYw`ChP>f^n?_ z@>!WTJ140qA!Ay$&;|g-*w$)v3;_i=U>c$@gndMr6794Hd_nZHqkAZw($H|3(!3%w zohsd+!5n7VL75`KX3c<+rxY`MB5wmgQvLSu#SiVuJHB#GYAxN#n4#*fME@b)BykhD>8u8ze;XG zInJFH0$8-w!3To$ySCBI0?RvAkEDlI@HsG*)it}vb1&b}o8uGpvw}5xuTk?j;}Ra} zQ%!$1=)h(whvF>jMlQBAF^spgbfXq{qr47;2dw%1eGU}@-CY)Xkrpc&05vrbGA+FxouraE z=>Y%?2y9n$OA`T5lIKT4cxOmZkw7tlLWTc0#oGJH+w~bz2+Hk7(h8WxwaCIF~p{720AF~cP^WU}j<8$)m0gk}6t07Mhyh6(Sy13;ygEQy354`ThB5`U7q z{WTtZe;4tGHNJnq1F%H(%k@7X34fos{l_HyaXR+ z{Bb??ACd5H#wovf%HNm6Ul(EjgM{C0!aoZdW`4yx{7F^z*GTx?Cj5`Xg@3Z|1~?P` zzIywQXTtvnLIwK2sR(1a$jQHTLozV zPyuBFg#N5p{C}-5j`&DbDuAG#x3kUWvdFt@agb{;SpeY8DNqXEpHz~6nKQ3HsWJZ+ zhl4fOjfGLK|h7~IL@VQ<%wW|&FP!L zAU2xc(wb8gYR_Z^os&-Tmcw*(dh250#|dZ@bh9{)2!P7e25AT(+~;*nWIBKm@f85c_q!U)sdtpCBl7bE_5IYD(lG|xO4FFLCC|KaXXKDUphv8o^>%;lUbl!`;+)>GM|qS<|S*wsSS6(tf7MZzeRU0tYr8g&VQ7jV4Q707xDvAyByD zKg^;09uD~~g(5O+Pabs6@c}0Mq|O@z05GNZ4kVx}0O?n!3MB52_o@9?;@;;mc}!O0 zoB+Tl;0c*+U!|1w?*agVuQGtd{e1=n89I3{Ud3922vE>b!H*eR2mmAew*Rj^;ZA>* zKmig5Y3+G;Y`qegRqJ9oFkqV>%97XT`|jZ#l$RI{ZDDW4N&b4m& z1WtgtRxk{*H`I)(7!P{*mP8j(86aJD5Rr6J@I)0tivxmRJ(TF5ZKeCK9HTCVYg&TC zeFBKCecW8iR7VbcAC9&5rWoDfb^ZLdcOJ;}-=}E)ifP>RzY4p6sVeGoCdC<|liHFkqdx*(!YW*R!%hWd0 zD4E#3aIm)_;og>y#f*{MZSTdlWyR6U32ZW7!Pn78RG3|;)IpXvLLd7ZRK%fUJR0_# zI}}G7OZmzn%WMX;rAx}Sns#2cX)G|{j&3Bi4B$5uKd9?`K&Oe7>Sh&qU!)YW5K6Mv z;Lcn#dvEhG-%5Tp7o*{T2#)6_C@XaZB5r1f`bW6rcePq}Q*iG}5Lyczy%1kSrg(P*4rJd(7I9GXat)-vf%XmUbm=PZ zo;z|d2p|1!#+r7htS#xPnHQ9bynmHhn_Mj9LI6OtaoSWy2WN{$+Ygs8H-GE72|QSc zn5Uw{{q2wTdiaWW^d~86qN#TgpHn1i3g0x&vC|d&By0G=%My8|<9EN}j$sqq8rSh- zUGcyfidm<1Zscm_WNy^51~27k-R*vCR3bBi6*g<@w8oDsF@;;gyMliK(voMDCumAD zq=di;n?e|2L|Oa`e_25Lska-((WLbG%NNV|fIjf*Q7G-Ajg5w&c)xOmHsqI_$8X7H z;Q7#kYbC6b0mhJA6ZR zda2DfMEY2TDH&01%}?*j;W_6Dx}Yo-Uor&Z2r8d&4@rW*H4~59Cn2p%ADzTS2jGL0=#N=s*g7^ZJ5H>~36Umj}h z*_#J|)DV5&T>_h#D{*3pkuFu$1eUQy_A^WyjFasKRQk9mOMrW``t+Mw{tqUBFwvI{ zWkX_rg=72Wvu{ga2{$AboEofT+u8B5cgehfy*NcaHo7AjaT{UVv@zEvF4WA3z}y{u zf7XV@z}m@omsKtv#9y%vHKDk;8ykk3hg|1a&`sBncOc@Nwp#@Rr#kp6^#?$?NUrn3 z9G7m-czYR^b4#+@yFD-9F=|nu@}-+&iCWhNUW9eQeL5%%K{{p?0a$kkPLa zdKp2{3B=)2yq6_mT|NQy6I%@Jq>geVU(LdLs;+yC;e}>-#~ZX}q$9)WnyOuwkowAP zC9kD(H-$UQqd^yj>s@yB#n#erX$LcmVSZ`Je?}w$aEB)|30^fbg}qQ7B69dLW(5&a z5v7=?NPcvPw(N2vYVcQoN-ozIGl+BxfzQY8=}Amp(P`4nfm?daaiG!2k_KaE&O?lz ziCr-D?wHGAA>wZyF;VZ{8oTj@xQ3}}R({v7`LgNnQm<5?ek0@UmCO4;lU6O-1ILan zoeAxlakzEqht z1EfAG7J}V&43gSfT8EJn-ia+PEcZ6_cRP3~a`sfdA|r4MPi}c=Cd_7>gM=r< z#HQTCZBs>Uu}Btr{>%A1?3YpmPz(xWJgbuX-yB$vBiYt0YL$1{kHstU`ZgeH2%a7s zhzstm7!9zLi~F|tn&yyT=`c&CVYBd`&`?`Q^J7)3j}Y3svkP%kMlndTR`HRlQSdH5 zz8tAbh;Y>82n_OcO*KT}an>bm^*Xo-Xtctbb%#CakVnLG*`%22?HC!u=OlymWRulV zN}n&z;j=&OcV`fXbcv^7Zb%yz;H(N&xI=dngFp*Cz`r=`_st@;eE;0rKm?{3O-0O( zLIwdgoI(Dy*fYMn5b3`(WIi|{TP1(bkK?9LUvd8qYCKC#NP1h-xdn?!5mf>t>|V%i zU+l;`%-!dkclkU|k?(hd;WgPAMID1xxdI9`TgMC+@)^^g%TG}ySbpd`JjiGGqHN5e zw4pqPgncrd1U4&ma)xWwdxYHHRYJC9@OyKiCP>p3E9fs*Q5wB^*@DQ!iMoAl{)d;0 zNE<{0J>VeR**Q64puH|3A2<2P5K{NhKP`&DGkB=BW2O}F=Aqk`UndEcmR^qI;e1V_ zF>a1xYMA@juC?RqX3^&x6)&A&Q$uCc8nY;4O ztLt=`MNqn%2o{&l2U7Bj_nvcNL-VA7H@)pWSCO^v%xO+MiEjc3G!Ij5+H+jkGf*V!2#uCidHYaW>dIPDD`wi`D(QuqcD4KB{^RJd*i* z??b5FweEQCkWOAIWecjMuWhKB7iV=7Z2T_uLe zUGXdR7we!BDg^yxVKVPZEDmLsJdqD4+EC-Hh1vs{*R(cP$Qn(#vmZ%vdirKo#v9k& zFEfsCe3k4n6zsEuwHSgd%r%BSv3VjvN}p7gJ@^-h9dRdr9A0At`%vlk^@gB`?grTx z+*wL7QhSIff9T}Xx~q*ZyllQx!p2+nmBFn<{GL$B56{4N-)hxIdB8@wCetmNx+kX& zOQ>}Uzuzn7;Zdf}=$>sII zurX*oR=O9HB>R5t_m3i=v{rtBox_tGSFIn50i*&elvsWbajouS(Ykw zQIi=_DC1nPo2IfRf5Y#cW0);-c0*_?aE7`LviMXwm5(q1ua1*Nq1z%|I)?w92i~hE z(F*yRLi#(FG;BC3es^iDt_ply?Ie%xL3Vuxv40ZuExf{zHw?&+R^yW^kh~&Zq2mWD zdbxKHtFa-$mlx4dFPyAL+|l8zQ_Z=S3!}Sx?jDLv&Iu)uws4wW`a~0b~Gc_&o0`1BUBqqQ!P6L(}quj z2W3)ZQXDa36fB#{mEbYpZC+I(Zw2=53!gnzB}9b8oi?)Z7G$^;OqhL{$PckM)R0aM zvr2ceFqQNy!kYqM7L(^DS*O;mBK_-=ka5cr17jFZk2x?C2-b+GQqK}t*v`Fh>eucP zKUptIEfBsgv!R>|R8Bkyb&;&CfN<%p5NhlX;l{gIL}zG`8{Rq9IHgBwB=?1kfiJZ? z{8W{@Zo#0%Q?J=0=>CF&j-h;V#H(A*dfczpy01kqGkd zKI7rtacj0v%_uzRb0k{Z-@|ejNscbN3CNMCk8XFm*3|s(86*ws4bln+V)4mB&rrlr3=6Amy0DYal=h3Y%={b(uY(=(_n%b5vKH zpOK$_w7rd*!_H_S?ZPvOwkFBl@Ga)}l-=@+XBN3Ot%AnV;MIo4^BbY}K^lk{A)Cb? z(>x{b;5E57?>cZ8J0(1}@9fp@u}DuR2Xxz6j9LJUzxy$7Q*$wR6B|#KN>OIpeIN zmMie2$miw`-|n5Bc3Q$)of%c|jIJjK7UC&d&)8$8B093~M-r{q(FC*#q!ts*RsQA; zDp)Gxr8f2yi+v9bgw$p*4i7?1n!;;r@l8+63L=yG(k)BS8C?=0+BUkpzU%irytzFd zRX39K4mjt!V;0Vtr!&}6*pz$pU~mvGn`(Du8x)6N19*WQ05EYZh;qS)uFo9fdmg;? z>;#qQVguE@eSSv8%9eR$$PbFFb2|W@cz3z6pld2Br;ztaemE=NoUmx8P}JZ(abEAV z0XWj<9!NA^yv9CTed$-_n2AJEm3R}>J7qjH8)fb*h&GZQF7Tm>aD2$PQ{Nm7ACAzlJnmvH)8h(Rd;pn3G>IoJ zNuG@5S7BVT7?ulWeyfdqC*jQm~w-O>qru&caRYdGlS! zgrWKI2ZBbPtg!`eHYl66ijynS-o*gT85Yd7ebzmwlu77Jc^i)?Q)hj(s{V{L?QvMW}(Bfj5DnytA z_!di)xTn(X*h;!>@+IHl~ zs z;03)jtQeko_N6%WLFs`aPZQZ>n2S}c_D;n%H2Bwj3cXu>(3Fhk~T)_-9Gs|_8LZu4YH~!LDWZ-?ey+F>S1HfQqi(V z57E|InmFIsC%h6gG<;f{i_PC_A@#E2zvJQwMfpGMy;X2s$(F9W#7q`g3>M2`W(JE{ z7Ff*8%*@P;7Be%G#mp>=nOQojuHAjR_bFGq_kB7M9igWc%3SlGBWI4BE5Gq)Ph^3G zaQSW;jMCnQhX6|J?Kdf;~A8jy&{o8N+CM(;z4ddXDD$$8Ka)UxJzk0L3d-WuKEZC zh%Dc+i}&NK+3OObgQbZ=sheFZTFARuSngdJD(NmG;LNGJOFIx6vQK)L>5Yn*;AZE2 zWo)Cvr_$DvQyJ2q(6oSZ7Z&rH#WmIe4Nj`j5x#7@i6 z-Ilfu^Y3-`B-3-`yjH!2@skKI9`Lg^nKlxd?YO$^?&>W>SPJNBz!F4#fIV9~+$R|{ zn=$rR^+wN13k8F`JP_)x592PxG@#DBLQty#>9A#(D7Q^d2Wx!bdRU8g3Jm|?zG4jQ zh)MmXGVnv3E8;ccvPPXVlVqfaTDT}awK1_N^W%rwU3!(F<9;m#R9DjsjGw$5?c!Vh zy9ibaU{Ikw>{hLPL2Tp0C(&7S^ObyGd+D_8h}69c-Il`L^1EFw93=q_^g2p?mGi#i z9{9cC_QjXG3ex7{`BoMkXQs&daE4Y6T_|&1uapb)k=SN-J*g*=7#QUA6;IHF35|IT zpTcK?<-8qB?~@C>a~KZksv|%r)>lDh<3Z3sEkrjc8m;ZJkui z-OPjdr@GO6R49?t1HKZPpnO(#1;Qb`^ixDF6tm0?;ejYCAClv zs}-bbCD3S*lCT*K+~VYT$Pa}|$Qh2LibZ3+Cf-?$z*q<5W?{2v9u||v z0wM0(#T=_qi0>1B0_P5!k4Ld=nbnSFyD$sh>RTl}zfX3QHIIX`GQr4?i6{(NaSy|i zhkV$G9{vX@g^iIN-b4CzyK$@G?`sA_>??SpLz!|68sCbVmf2~DA8S2lKaH;MX)Y(z zwM>D?*Gxq(T00=sC*GerHjI7@RR6}VY@rsS(FwZ>25w+0=MuGOvF8)m^Wl>nTVi-* zDp@y9045!@4(ruV4Cbxoq+3`S;_SA^@eOqix20vOx1u$f@GEo(CeUaby4=aJaw@qu z185JtZi^Q&wMhL^=8>2+RgRe#A}tm7Hfw5B5#mt{IXh*y2-XE%ySHyNL1$#51ZXu< z1Q}Ypk(B7kF^F2C)W-S@abOD5z1P6G7ZLXTU7$9EvD;nIaUn3P{E2k(3P3~j&&a(DGFfPTLJ~)$hXOhD$u*O%Fa9BiyS`=N~JSb3-QP$I@!%lTcTX zO7^+vZ)eB&@On0u-1CBo3GqEks;P32o`G!V#h1un5R_7Yo|CWFWIk|*;Y=g{bT_g8 zTB4om3#sIp>vr303P^iHLBMO=nXon*w~M!9-#Q!jtEx0{s7atgP&$=FT6a>GKO;S8 zrD>dO->RibcgU?V5U>legAr*d0t*UvH->t5^kpz2rrpvKJLt_AaLF;m0@WQ+f}KVo zA=vG+l%SNmLKz(0@V{9zvS~@A4)w#`S)t+mdhY5J)s<;AmD=?z{1D3xf<3c0vb0uy zwh29xDknROVMNT1cmH;$_k||kfC^Zi9&Gn0*4X0HWDf56bf<);3AUhP!@Zha+C2gC zH9DH)IF4e>2CD&B7g95`zjnQ+e=2YzbDAYxm1oDNHw}Gt1uMZ$(oB4tQ0LY8bh;*e z^$xJsg;+=GrvZdj9Z43csUI-Kym(+Vz`aNb@KyffDF=s2X-;{SfN0!EegH)&B1?4i6o!ppm>DC7xD^h}27*V9!DW(0V&q1|vWsf^n zIz)apR^Dy=+d>~=uY0qx%8AXe#v`>Y=$z&J2Hj6FG^SqOv{OF9k6=2KN3r!$dN*Q% zWw&9jwOEFlhwKO#0%ZK;no*HAK%i|BkB2~do%}TH2n6J9QKKRf5>wnSN+gDztL3Symj{%_jg42kcTzyS2umKqKV3buLR z444H)QSbIu0CNxt0Q|j*In(>4D8Dxg`8(qJj{=Cy(QGePXv$HE{-hqmt3liOzODln z1;r~#W{O+sxl7^e(aI+u19C@V@NnBRxUo+fPoT_9gH@N(`>8Wep3gC1yXLA^{@_%e z7q^zSO`@K6vlpvFV*_qn?E;M2a-sp+B(|8U#32Ciy!Wg5@_S6Tuj{SBBfH$v`(Oky z0-rE}?*+&Yw=7tJ*E)K=&};y1|JXfd{WYE?*~W`dz2nE}1prujMFkSgcp=CH>j5QW z`qu%#YTw(^0sXZD)IZ-$06@mOx(WdJaQ@!N;_pZ-5OLW3LC|Q_mG`=aGiH^;?LK!< zyxU7B1qb4`8!kyySYE9OA<%Da^h^$tJ4DyJ`IG^)6F_FqqwDo{a0#G^p>4qWJL`ZB zu{80KONb``XxaNW{wDoBZkNZ*uC*G6JvDYxu^^@e$vOdmE&pu#m*AGe95*L!!2;cE`&WMe&<(Jy zP=&WAkQD$9KODsiK(hJXl>hI5E$GOWyBGklD^DoK&68P9La#>cgjFP{h;Mej3om4) zFRvUvAjj*y7op$dz~|q0rJW|lW;@?)?GS0TugXg90qdP0F-cN9000fadq?j>=U1Q> zyAbjA$x;sI`)CE{g@YJ)m=Xgv0AOZoynkT!-Xnna7lhVd4V}36-%RM<+tBpj~4Ba_2-S-%5Y z|GlhVvDJSqi}z1ie@XTHH?n?RY4wj#{eRK=4I?Zt)W4PWOHTT)W&Ihg-^=8GB%eQK zkUyjK`-M~7|5B3u_o?I0LHJAZ`LAXD8Li*XssBmVZHn z%YQBFAJO{jtoKjru78i#AM^eHq`2u_*6)zWzmWBhX#Fai{k5!rMC&iBmwxqZ{X^Do zmn;20l)v65_`mga{Pzj|eQV>7wEW+@HvTtL#{cH6KUN!mK3jhc$o^^&{%_v;$13Ch znY_jDcdwuSk&c1u@-#QX-R2%(zs(_gy+39=|36X~I&|nCh2QkQ`+E52@|TR4D(k(~ z`|AEL3wHi~ME=6g@!!^kf36Py(~{$Vli0t%*Z*@xwB!s zoD;xOdsg^OqKr%y_VgN`Q74Sg4ZdUmUztB*f5izN6-fW$r?aL;L}LF0t_Pdep=j;a zZsWfAeZ84A=g$&vY&!3GqL5T@6BMFi)0)a1yk}u0-{zJ9jF)N@MTvFfD=a|xCU;f{ zC9-4+4jqdrXAgHxSnRCjY$`H>We-C_o1YUJet2p{x0A|3zfS~mFxsMySRJJI2b$NS zsZ`uuqk522K4%eb#4zybAX<7UW@dQL>SfUZglSn+27XttzH+0mP20WK=8w$zh8dJ@ zgjr^WAjTr!cO^w9L=cSXSnlcAF7O5;KUwhG$8m8SLS^#zwIVqEkvJ@esyQ{ge(T62=yY&^mh;KH}8kXIwC0>vxwjymFK z(%NBjckH{25)OaUw`D)0No^ST^wCs z^Vs2zQI1c@cUY<$9}m)-Y3o!(>t;%2fwrt&;9q@Gzm0&k-ALf7s~{-up+pPA2Ytwv zPbpqP`tpkAJ$04WfvvUW4~YU_erPpcY%-X3+P4NWSzsEnhC@-FbxNj=*&{8+AYx(r zLyCMZ?###w*#WFyHhjaIvcbb*$bPx0;riKjzh>|NTHt1v@FAB3Et%Aml9oA4n?gi{ zI=RrhjJ4P`{zJ}BxAW$+#5B*nUD^`)b`xFuCBaz$^S8A$9`cr(8_h%(0&e54#bkle z&z8$Z&uPBkd1;1XdKY>o)DlNSl@xa$yXpa_J{*D$@9!8cW+QM7vxkEFiRW{r zT@^S4snRkC7wW>~2g=^2oPraAUc})>2L^2MpbQ4+Q+!6Ch%|V!bBG)lozsdDOb*{3 zq`}O>GT}eZ4E6ka@dgze-K&z`C3(d#;T_}BW{exSitk%RV_Ht7 zS-As#K|aqAwE0eUsk7{wwdssck(99QurK4UeMXV@2$J6~_}GZpFACvjdV*a({c0Sn#+WUJLAjNizV!K#!%Zo!th^4d*xgtG86brZ_!~V zAp}e8x=E{l#x@-|EY9D4&F|v+8 zDoc#jjLX3h7ErcQo(+ChSC9BA)F&I?r%3^L8{E?gtXEQ2=PX?7<`u9{HYb6xR}g}Q z<7my$0WW>dB^=FfxxJk%XNi#Pyq(=9=@>W(2orrmuFu&IGO`Wy{iLO*4|y1^b{UXR z@?i0^kXaAj`=dX_El}OoF{l*2w*dJ_Kf!*`WVJ)(j`s!E8iL(Ml)cOu1dSs8{Pz`i z*xUhHZ`IDQIzjp&0c(WT^WOfj_L#aWjP=t5;2ceXtIFsn%)tx4LQNMO(V8KV+hk+s zz7H^{&{oI$B_^`%6a}F*y)IHr2cS6NCYCcg0>gpFa3YrBuQgd+qVYLS>03ec=}%u6 zF`*@47km|E1U0*j7u$MvH^CU43`k}`mJ#R>diA$z2>3V|UUb-UjB|=pdPsbg_Ad9b zcU{h0fib;2XZUYkIUZ%C84zb5&3RuJrv-%a!gne{IfS}Z506rr`9&=YnX0;3L$f7r zE49}YvxV3NwHdCsJ1z=#%q_ySB<7(Ww*tN@T45h*0qoE#S*lvQv`%A&a0R!L;Bjor z89_g~@!bpDsv|UvMc}_K)rRpQgMxl|YNMcmZ!i|qr&U`f&NjtuuEFpS5K2Godn*ok zv3EUnMju2$&wiB-Z=`?gYI3F)4q~3TO#S*0l137X$CQYt{q1|qkLoPJnKB*Whi{&N zGnJ64XifPhi32u*``#$>O2H}gnLmLzgvYRok7(1D=q8ZJ>AFYet<;k0Y)oRr(5(c0 zJGt->Z++X_Yvu#>vElf#e)8!h9$tY?KsW(zF&!lLMev767;%UfeQ0lfQ1_Paey*aW zi`;Qhg_XJJB~=)+IEZ$5wbC2FW-XZ7UowKC7hy%Vw)<3Z> zxD>ny$&9xrtvlzZh{g;yR%B1)v|689qNrq;%0N24Hzs?e^I-!&>WR}siRrGC8k+3j zUJXPxvBP5c*vX(J*N&J=l?u{^M|LGLfBW7y##SU!Z9TR{s`2QQ&36<28UEwp*V`fH z<|Ju#Hk5TLWDS=#Nmt)&#DmKEMPh#0dEhD`a@?7;kUWz0SemQdfX{|sv(*+;2T+Y3 zL(^4Oig#s>U-86rA0tCPm|^O?;6bFqOqq%VA>3u|1fpzeF&Q9<5J_e{=c#_W?XDcE z4&v{R&?#kF+`Y0+OtiHb6A@Hvs~B=;Lsf;fZdsvV-rN&&_oX$m9zb9%q=_4y;^_$# zg5G@cY{}foy-k<4MZkkeMd$BODtbcC^AWE&F+aBzzC~P^Z;90H-1I=)caDo``zRY^ zVno^2;(f&m>W1Z0jJ!ehTvqyGz@V#E8#2{aob+nL<;^gcR;n3CaCj8#9A$jMJd{i)EYJl0AZ0Z@C{&9RTxIjf?Rr}M zr@EEClx3Q%sVpsoU7@XQn`{c~UB)n1BO-a_Og;ATT)xyF3m8kJ{O1^WTSK2FVzRJXIQX;`uFl zkzPZzYgglf2ZfvKi9w_ltY+vpvC*6Po3m7gBx-8SNN^e*IoI}?%J5^yiUB#L6|ape znw-grPr@r8jQ6WjYY%K?YCnG%m4;tLX>lCY#8VD{oJ_NrnRzl@AY=851N)sAS%x7! z)z8?OemY1@{OJ$uf|$r-;S5jc6I6E=srjsU;N&MbH{pHWur`q`i)qMi?y-88#!@ta zt?D^9{_zfC^+CKB{&}p1k4 z!1qktQ?RZ87I*#a+=4R=UJ2XU21S1+>Dn`WCJ+SGq;ogH+=WKUm`Cejx`ST8H3GI` zt4&v%n1i_;gT3Mv?bbTjI2xVRu? z1%`Fbs`Qi^7{#LXD2`cB89Vu(B*pXfE$;%o50-dM*&KfOY``k01rOdC@8Et%9b0jR zuM}w@{3=5+Iw~KYhddC5|H+I-QK5NOBGM5DFM+mQiMWhq#W3;Qvb5>&1@7bUz;Riu zsJLq*r1f#%u1rdGOU6jL`WNaX;xYUmRiodfR#?mgTttC@5&NO%d-a_slQI)A3r{b3 z)xlmCD~63D54w{^FN0j)(6y=w&=ksgpm;F{r zS^y|<8u^^?3vm!wGox8EVf}voY-R&!;DcHq5ieqW3H}lJRADGL<|I22I!rPgZ9IIx z>`r)Flm|;inSC+7(7=5fFQtXS8}%_LaKRw7&JL&z9lT^n%&{v!MJ1LNzbS;~#VuRc zyI^>&1hc{|a6u>$kyeLkGq?R2O_|09Y9|fg{S|UN-}|`kapCeM4hTN`PE*qG|+ zhKP%@bppJ1Xp*L3hJ-Yu{y2aeWgV<5!ra_Y-`R275JL#btb)L0t|x(Iz^YR@fB%Bx z)7!T2asUaG(neL8iS2ie`0WE?m?D!IZx?x1WMp8QNCKf-jsTU4op9{ngY38nHYN~V z{DD9QWL&el>r190@G@+B1ZDQJPk2~+t#(-gvdcT^+J;P&-bG`c0lJg)d@`C@vPSE%7gDDujDTw3!`h|o}eC8Wjy*q0aP67 zg63(#Km`*M_UndU3&@&Ce3Jz$kUq>Fm zC0+yT9FX=u;}tH!7qwx@l0!erMw&Ghk{{;2KIPY|Zo4YboMAcw#0|OxNFc}HL_hCI zzd7#Ahc|M3#%@y81dcK!c*ZqFwCfe}whn)H?cnZh-ohh4~~S4sqxC zA+K{kD19Y!T)$?-db#b&DuU9|7-4{*ESDuHI+zQ74moR^_f1jfppVi)0Az>nL|vI= znTJCw@!6EVXm-jOz4;aT3rd5aWQ57h(n0=xxp{GWr6F9+1c(ZT8{p+2vHBtt_Jp4OgImf_L*<-cfPQEH#&!9ssIiU5U&Jm5RAKb?K?-qLa{AIlCv$g-q2a zI1`&Q)0jUm6c+(@3K`go(NcS~jNj1CY|ma(+fPmAN9+>s7wERcNbHkJEo3uO(Ccr{ zbHYN1hd4tk6QT_$o#z+G6BsMcgzNVaqg_-@RpOc)ioI>z)ffEoVl&17~`76AC>Op9>}Xeff-H=FCT*4SQxK6o@+RH+3<wrBihMk+$NNk+%4xO6s#C1VCpEO!$PO3Ey7w6g&RmVdxWNwbR!=b>-M`53^e}46 zx(QB~frk0Uh9zw-BQ`nLGNzV5L;IepKrBY`)o8jdX>Z5|1Ab8LihUr<$9TMm#4Q;+ zH8vPq)bqZ;WO!XMGyc1d_0JivNYMez7re9b^#l4O4+47kg^DzYyN6_Dq%X}}`075_ zWh@&KPzV7b@(wfv#U_tfQBeXsUireEim%g&wrjH^{L-#7>R$ZHha+>N?W=B_51i(( za*uiN8y@hVn@CA=~8dh@4CoOma?*tuM+cW|6|clNPg<4SXToID6arc%yco@=ay$ z3xXW1!OU1Q&nhl#$Ou6-R4slyu$$LqMmZI)Zx5?n!MKeKjs7Rr$sQmzGrj$8Hkee+ zjlMmjLZ1Wj4F*U!KBUNwB_E2S&~gI}5ZMbbEz7|&xt^*5R(k0xI$k7LP%LZhwJ!?$ zn|(i*?Zv@owWvNncp@BsFlpzYd0~6-RYf2+Y&$vtZA zMF0)6|4F_GL?4h5BTJ&flK8$^ogs|k5nq&Y`+wjwWB5n7`|2%oy^m zmf)VcXDBF(9jDLWJCrgAU+Z7bakMKn3E(fhGt3Z#5+F|QmefPk%x6)HiS$JH-73jv zEL56nO@)%>h7nDTpM)HEARZo|@(VxLr@1()D-hbBrI}9x$?;`Qtc^Rz7!)3Qcis+M z*t7Q^c2fJF=Wy`Z(z=wk%s)~2nqp<3RTtE)$7cH?U<7M*g0stK+g(<% z^d)-WUzsV+LskVs4W3LcqoOg~48;`v2|dX#BYD2&p>fHGMtm>9ZaO!nb?-6Rt&l3LEng8TZMJv1z+ zUKOqoQm9kF_5vD*4Dw(iE5xqoZ((!we#VHL$vyNL77*&`xRJh@mx|Zh#05-PAcKfz zcJQo$rBJ~~PlfjdX`4B3^5=m{($Q6Q4s6Jl>m9eIFJO55<|}}Z(e9T{7(0~^yyC>I zP=or`GU;iIihbBb3~x(vF)qjXME(6d&$*Xujzue}qTYu^c#exzWJH=J_?1h)Og6ie zIVmbp-$NyerOza>7N&KyGwc>XWynrWdVW@X7=j4khjtrx^40^pO_RYG2M~wRj>GlE zP=L1v=RK0vEqFXWLflmJIS%%VFZg#hA1!dQBEvuqI?OiIt`t!CJMa>XJ_K}>Tosyd zw2fGQO^-8fi}?8+Px7Ij4a!JPr7X`7?UYs_M7t<0n2i!95Yi<1(RTC)!WN326>D3Q z-U^h?XKy)Pvhpg2S-rqgjQlV4_qDvH-5O{d6N#JabsAWuK^Shrgr^cF%bGw86$6iL z?a~h86%A#nd32xeoT|KRiKa+yIvV+N^QnP>R$}Bf97dpNNYpS=e5_H@1vH}osKUzR z%tOWc>QX;cBmE*A7p)4K2)gavenRn6SD|a#vrhw&%eQFAivjaJtu%&|dzCA_vI)|Dp^r!3@#MM#L-8pt69{`P1Y(%A+wHd(A~_eEW-@29DO z?#6#V35~jxVN8Ifak%7w5e`E1_HsyHkc;!*c!}~v6!Y+`uEKfP>fKMYjF&xq%x13H zl>A13f~}!Vp?DckyXLfYLhlIpfS|@fjwxI)xkxXwhotl)(%-B}0|coxQHByQ^{H8s z8u&gPm#?jfn7iLsnCJW6xhkwY_fF00B0f6}N|?d+O&cviD(@b3FIv--b`ks!qS z`@v*<*j)}gH-7gS11}@I*7s>ZMO-0@L~degwE4_AM)3Xx;{PK$vJb^$!Vb03oh@#4Lq%x}Px&_BdqDvAJ+ zPmO}fIfZoa67GDg)5;%_B&ztI!H_TUwkJAz_b$E;ihwylvc2~y^shpeau4Y!AjJ-M z{6PRj>-UaWe(mx0e}hvWT5-3Wo|&@%2i||)kl!XQ|Ko<7zc>8liKYJu7J%qvnE@_G zasWyhig#p}{Ruxz0rUqhBlxdkn12cv@9zFnH}kK3*ZxxX#&wn#pxWzC*}qL>{ukNr zjMZ;rnS#Gp>G6LPasQXh{{fu&9^OA?{u$lhCp7;_=I>*g?=pYK-~M-G{>s$;zm4Ya z!!G|U^S80hcbWeh@$#RdY4twznExm6=08XCw+YVwkom{tMZuTa^pBH~N#9;J|I-r+ z0zg=_a_#*0PwKq@fKV9yARhoI&+D%JJ<5`mp>?7vUBO<6czqEZ3yToLM6M^`KmH$c zhw_ytxhXR($C(now``USl*}%_ceIZ^)u=c;?8Cyfjj)Gh=f0d>_bd>Y>j=Zp9|fItKW(N&c13vld(hv zU2%44PCYc3z24FZg-Azjj-^npFTjwz)L3oiE;;QYVr=|U zJfnyLsk#;v877#f8l60)y*WlPPuS;#Aj-6guInux$DmiMdKe+|+qF!MKGDw}atX zvWe44KBHCOl?~reGIV$6Q%J9uutyz8?jx<2n~Xf}ShsR2R8PI|cW1-8B6b*no>9Sa zK! zQ7gidLSKU=hb9gX7gc8fd}7a;`cPHSo5lm-%Tyt{FZM~p5LhmB{ZNFB!X?>Z+up)9FLg1)i zZ?-5GALiX?u0+4a>08Y+G^UQYCU5B1Xy~~>lyQ?G5$C9Gf3vRb_tnA_n!1}fL$(FM zx;c~hm;_Ch!ne}28VgZ9Ykvja5V_CY#=u_E7e~s3%JwP6LxU`u#x8)gWl`ZHh&K^) z!ECfq|DitP2+JT>)8Y?Ob{dz3EN@D@*pJ+W;qq%Q7DRKjRLuPLTMNR)+gW|$Ash5B zEU7JSl8`H44X19P>KOAus~U3nUW3fN%V}Jh#Q_DLR-qF)P|gU^SD;z;SU~$ATb7eg zWJRS8=l4sKArxyD&r)Zy!%K_(z~7H@N@QR&Cpnqp4aH?NI_Jm88+E;WCWA>y?CKYO zbielZKWu1PVmQ83N6jL83URAjxYb%A0Lgh#0tD0Z;jAnh7z#aEWMg<=(*#}J+j z7za>Hq(A2fHY-$b)m{ijEJt>XMpi8+;)0?Ao3J{zT8%)2AiGZ$QpIAs)Onc<*KFdZ z&~o>bH-f6yHB4JNrMbEDcnJ)EW76d{R#H}RmLlzBuvt!Gl#vFqhJgck!@k8j8&i*X z=#|wW8aSBcW~e!h_WaTD=HfVbSkm0xnJ8<3y_M zYG|yooBRCfxtO%+ZTH+#D1|q(1d6O>Y;?R_y5c%*6R|>Qm|sJlN7GD5&-MmYrQ@8! zAr?=-p;BX1H0)s96zN$umT{~}@5qASIr;>QwO#W`LAldJf!XXvK(OgSG&QAHVAmpR ziAY1Fy(p&`ifP!&xQalI+DJJV8#9%@2QlR5UAq7b4h*QmzF=^P-byNhw^%U?KafdG zEHav9RTX5OA?T5X%?^K1@T0oR3iA%VB3~{O8DA`0aaEUWNx@pK5L)~X=yF$|gLj`B!D z4rUt{xII>Hm6$#MY;kYAwidS|rGe7Scr)+AOB)N9*Q#q^ot>D@Mai8vXknud756da zz}3(?+5TtyH`5)QEzEaL&qQfIdU#T|jA{8PXx8u8yrU$>%VanBPIgj^1KDUAWsbjb z75OhAW%*-!?vT^myfL%-A=tp)%BP9CbdgXrI`z_-f%b(D?Yy77B1J zRd*4<%}qy1DV2XD$rxvXrD9}YMGOT8{g{i>Lp9sGiw(L}`IOuEfn*Ll9+MDaU`yo7 zF!C|`X(v22Y!4-V)Vsgq2?y)akf-s_XH~!xNy(mqA5;M>pOOpD5(1!hH`6r=g`g@t z+}D5L0grUdq?Nb^>myUAz05bk+tX9Q{M8W|;?FV%&75NZ;~&qko@AH;P8wiTK#TdA zL;U3~TWDF3q9@W_R6BQ5F;F5OTLd{`a6EWVe$M;=+cChSI=EFh#52Ok`Qku^WyMjH z5@BN)-B)K7)7f}x&K^GqqzL9OQovsd>6J|RnwLUClxz!9tw*gZTe&NpKasZ*&dS-pvwy36{a16PbSCQ?gN>)udI{c>LqujewX3b?bo z#H=cOZvUu-MA^Bdlqa1jN%%85oIELA7Cv0N*39&>bv-Isu0%*`s0>^0gN*(&|f7_9*|ud3N5* zMJ|r&7E+1Ibuj@2ZUa#Mgt%{-l^+n0iW~bHdP=FFRYMyZs9NIpOp?q8Cf%#9OI~Wj z?fcb5Y2m!XKg+i7xVp!EdKB@yb+MT8P19_(lOX3gc!}G4daVQ+&2CMzu`d2T`c2kF zyDY!jL*Wt)Xc1fM@5&m;L<~-O}0)^iHZq;P<7# zc@!Ng8UA5{+{lMckF4J6M7b243xwNt zc*mMJVB(3i+>)9)*agbW%=t=AAU#BDrx0$!B_9EspSx&;%Ce4)LQgt!#1#v~l$&2h zgR*>Y{!~MkFh&&_iIH(8HW=M{iZu$Igbb^N4<-f%e)0h&!8G^Io;2bB>|i%Qy?te&?9hJOIsqmRmVJqkSn~E zX06oQ)Tv^?+6UcH?V7mA*e@5s<9j?FeNfaJUT<`0UBDt5d)*gC(qwz)UQfk^9^y)8 zuhdl6jViC^^xz0HFoAKI$wc~j1zJRYQH$wV{cAW2&!W|OoF8BuWf3O9<6u7wl$*pA zD>ao|E*wU(I3Rj#AC*d^y&cB``+E)Hf4g#j11T?;++{f`?h1Q`fN|uqDmr(AqTEqV zR*sd^dqt8;h&vntBKG)pLmk0;#2S78;$dG31y*+6+j@N0P*Iy$$vAi_T*Ekm)lj*r z&W8T<>Fhu}@3h8}_Z;*d8t=AwK-AsLBGK5ymfte{#0rhzei({63DQb8gWJ*q9Y3RU_Nmwh$MT{PEX2ON1=L> z1l+VmM~A4Y-b*H9J<73<{hGI#^vzxk6FbpifT4Gb;OwP7q_S4XT``u1KuHzBcKN#_ zD4>{D7A~Mt{-MxHu*Dz%7WOPxbdM@OQv#a4p7@DmI$1jzWS;gn&9{yhY{sKrg!2-+ zjjsH>F?Ar-o(bbYENj4xgO(OzFLDnI8Y8~@~3$FUgNnSsli7oV+ zBbY?mhUVwm%gFqRKAjP87Ko5(6ollp>KbU!HjI-PCaq#g5|?_VK_IoEAFBbJ5@jL~ zN>`D(LQU-DgR1w|gLR{gl}*3(6(XZ8=w@?t$h)hQ7WhU=Nn+K!0j5sXNPDm5&^#Ro zLs|6bZ?B0G6qzC0A>y)B0(E6-us}Z1GzX;@`s*hMxgG+Cf&=G#W@`w`jF`NTZ6~uilyz`i#V=^nYIeU!3b*A5T|qzP{WOR%b}Xmvr)uj z89AXnK`;!qSDKW-JJ8MXvcj)zKz`O}S>@+7n7W!#f9;dNgCMvi+0p z%LN*5597SoZ+heeG;G4a@{>iA&7cihLS>`1ofgvGoGrq~4ljbg}q{SdbHd-?l}`V$#t00q1iqbJ$$@ z`q68>{+vw0S!YlNyz-)yAYNf?3Xlu+`|X}&_kDCHzxVl(;V0vuWx!-dGJQ=H8VEp7Zec!UyjS|8DC zXZk2F-jasR`pxmZ`i=6_QY?5T31$;*$BOWGIdf$5t{@EbSi*eBPI>@~FwZKFRseU+ z8L^!8nf+&a7z@!DuFYh5i%4c9LC>c%&-pAL7ku50dlV>SO#cAzkRlAsZc6%GN~LSK zc-zu*lWiT(!NVSwRBF>zKL=01!E?SCsL?r z^6^uZsvO+69tzntQYoC;;D_BaF{!}h*Yte1TYT|P&=Vw)U^NH`gRAqjC!@e1+?7el zHEOqXljvTK81l&(eS5lr0KE>8s81x{Ys$rz!_ODti_xcf_DPP$Jk)bNyG%~v0NlvfWpZ{aYi;vei) zm`@b9%3s`|&bBlbHEPX^T}XF|@}u#eV)6I3nziA>DpHI~@jH8IQAjOuJXcYJ0s{+D zmzqWbxX`2kK&qQDF1lukW>7tL9vWt6t>+l6Nt9sjZXr?9+u0V=N_giTJFjIfF6Uk% zy|wNnWJKP$W#;0Y+kSY$ErD{3o~wp_1{Z=CY=xsEE>L|#U$Y{w-VR9A;sd7e>FPsw zU3aDW#VFT9Yc}YYPrb3Mvn5`QC^p6HMyVlvzL2AA z*7!&J;fw)GwFL3=zHyv^=>hO% zNR>qldZcY}JN?ZpQ+M8v`Ku@?TbdkPaB>s17cI8mwo+csPGIjHcC?&5myE~8wk))t z*0F^zp1=7FEQ~-h+~~%$_&K~@!Kc2}Tc8c&HIYKgq%r%clhS*x2Mkj$8dA=@1{U9( z;nDu+k>`fd3yV&`3j2BJ%*$Xk$a6ZyO-Jc>StA&QVJE&(Bme}D6j>@;^gLnLvhsOb z3VY-(zBvk~1w^B=S5A=P(Xk;B1P)27%dRv6rcYe;kiUDi(MP78w3H- z_VlZCfg1u$N$-uAoEW=ITB;yj)_U_ISaa z4tbI*2yAJucg#vfU|^7$<&l7`T7YN^Qhf$Z+SB38 zksw{(WY0mde?g@C35{sv(0CC|6` zTKwI}y*Ey3F$DWN5*>hBZMs|CA4gyX0!@?ybBt)w=2%K7kK7Q82p3m!YPzCYeavJiE(sB^EOqiJPd$*8OvaB>(CrbG}|@lqz?ZFw@^zQ71LEr)*YP_RUYc4k_o{`dnx-?%24g(OW zYHF+yP7BSN@yqcP6#}n%2j_l=KkzwJKPR%TLqM{|WU?2-CrS}ZkX!yAB0lDgrZuiS z??*TZ<3{kjH3fF~OiQ9$NVq<*esIJ}-ey_x3IdP#9964WwVUd;3DG9i8|}KCEgLs? zVVt05^0Ly@Wy{B+J+*AB)j8H%_3C#nE3lg%a0P#<>D6HZG} z$-sa}W=s086l$w6EKCyua@Dg=Zs=Y@ybp_jPCZ)15#&Rdh^RfULE_4mJ6W%iOQ>qz z!^}F_#T2MS6D`Ir&FVu7-#TXs_NV6F+6FwaBQp zL5oeRF|bY@?Cn6%%SG;HOwqnb#C&taqQC{eTrLjvYW-r$pVD<4p@YwXg?4AHIDBj; z;b6jM&jEHLzYWQ%e~85d5v1?EQlz;U%N~1cQhLP!n+O==P(C5IFv$_Z>l-{uSp*A* zK83Z)*rCWcvF0hvS29}|zG!Kw+df^39xT7S2fCm3zSFB#@xzusnS~SM6yCwDm<*c5 zWKL#85h-$K0uI_M(0`L`xChEh-LL+hHNe(0JZES4Fhd1{FDSr?Q2uR(y;u0%!#u4) z$pkNJlYmxZ8Fa43iDN&ZrNlsMc%j>1ixjn=oMNZwdkh$5Hnpw}TV8lnfc?Ho&t8pL z2(n*x^-pD|^te6Nh4)QcTz0e4^Xs{8ciYth;?H{qEY#>E&?@&3k(-CRZ_*!B?l}l` zD^gL!9i-^VRB$G?(^Y7C_J5#xl9>3j z58ibILk3^}9{^TBslUD@oYhhg0Yiw{tS-&c5GP$Zmb&6I6mAKjoj-0rndQKE(mGvE znzJHqaq57KsZFk9pb&Bmg0*o4mx)CCh9%5`0qz89;4nj?_@kjk^Q~gnK zy5by`YM4jc_JKjYV6U%}>mvCimlD4EcKl5T7?H-^`era#JKmn+1_Bd~N0V9g{{S%) zqf?u9sUZqeCDK?oKSd>K*=<3!mLIXs(2D_GcwafyzE`TU$>E|fJQfXi)Q#lE2PNqi z7T+%jgPj7`+nMWS*hvo`r72Zd3F}5T3`adpna~^U^eP#dH{qm+a&!&s;^%AP?J#(m zGr|o#cL+ev{mU}S+%xPV56w!xnHF)HP_agac;I`k>Fgkqz&zMUg}^{}`@dyBYOJ7s zYsoEMg?m#K<1wTXUotwyL3z{Z{5k%JA)=NiAJ%6B!~Q z^D?~SEpW9Z*m^9B`>3t^v*LsVEorl!NV{|b{0|PmF*nfYzduB*lDqqeGWt4p-_;-| zmoa@_o9!?H?Ru(Eij1Fg8*FV8?sa-K;|Snw$4^G)C^19C8ww@q7JRA8(*x=DHjZb@ z>2nrS;-s4X2ag&|^LjC@j~TNOW|DdJvYErUN)HsmeBPC?(f&;@cSTZr?{gFkliSMa z{UfR{J}v#n9yInO*P9#6*eSe1qZH<^vHvWh-D5vHp z3vFt|2Qy=}$s58UWy;o~dh4t<&=`OKNE&G36_p1prS1(DJvVSsr1=z?k;#S_^= z0+RB`wA72Gr45m=W3T`PU^CA)!zgxIcs?}R$fbilxiXTw7YA@VxgP|ZE%-$*?*S}> zm5hFOQk8{pkB+;Tf7gjLyqm%)9wbIfnz8l801g@`a*h{OMe?tc_p_+I9PCtiGU#RC z{k*>ARZxwA&eKEaOx`4g>1!Q=XMkYHG&5PM{ycUgaob$5PEY}`tEmNX&<`@$*2+?7 zvCHp?jfCXTAORb3dq>N`4nIBKCUoU4+AccG}?a7=`H}mJ~k)&OTJq!!As!>R~DQMci5d?W@qtVZjc$DtN7-_vX@mK&`3D<1g3|D-bF~G?PyZ17S zQ8s@%;-{w{hf(?227a5qgzl%?G6_)_e;8SjqKr=ZLbZBSz27x_nF<6Q)-IXjFSsaU z4A@DBWy{bKyAWkv019nuMGPyw(#_JPA?O6H>}LHdX5&LU_^y_wD!`fY^j;-s7;!`mQ&rHHn{o-_ zc3>rj2j#`~3=xNL3qnEm>sj2x>a#Uf&qSbNxpEIbyrU;&Ka}Vq$<^76Fx=G$0QF8X zpf1ao1b7^YmTtg0Eg$Pj@PKWNrUa$fEu`mWt3=rV20R$C{2Cqj5RlAyco*jWTd~|q zn1JPgR!@5!t)M=Hx0lZlh3=v@^v;rztPCm8{+Gt6B3{Hf^sV z#?698?)LJU`$5hg29W{6v;DV$QL{<%WhCP8Ehp`w6kG|G%Th*Z8F>vdi&>I*Xc&teYrezRf?eekesTL9lc*J84o`ig zg!;D342|9&x-@5y@4qK&Y*!VpD_eVEN$kcNo41KYDrL>zcfU5jxQC!}gUYd;;H;z%v!=6+ zCYV0`eANxnfBZwu!S8X&l8CRcvp@@a zkKe-szb!*#h*ZyCgG^Y?g6Q90Z&RjrLDB+z)7 zAM?>AKwr9V##z|@)ZTT4ZYMeQao3#n^%Hbk4^d;WgTGZ#_TiF<3HQ;@F4!zvt_(Y=goTpgrjKYk1Ro8*+5~qrTi1(CcakD?2BxNPu>6=u^35N#mGK zT48MC%$3B2%D;BWSW(1H8xtjOQvQ2Aoof{ZA0RkBQZ#3p>l#)<6JadCt@psXNu3Ol z*6X?UR0$ZzKV2RD(>Rr121!PxasMkJO} z5k>?1tVjd44N1&S($#cdGaFUrRCDoxU0VAp9c3xsG=@H9{+8rs~VDMz>thGY>38 zYniHr1*$D8&1*zv+kCl7KsxjjyuO3@5srjpaAQ^P<5Tgk4gwiTGbI^Q!KV3p1c&w} zB(yE0nlM*bi8oi@of9qRSk|<8Q?ZN=#&=bK3kn)J)$?*ymq_eCJ*su_UZyq+q++tS z{??e11C;;5C#NLLDwbH<^X7WgmRs}W(E`RZ z=j#^`?~f#*&0W|Ew9yY~`O$h}aE*ljQ0RfDqC4l03Qs=MAWF5b@#3z1kMLjM>6-|< z$eUz?2>+9Ey;&LCyInhuun_699*1g$#{iCw3G?tg{gLa&dPk2@aE@hn5(spPiW)F256`5>VCDodOcN) zUEbm{CB};-Rkx`r>KIkZhkRo>-l-FYha~5&5a-%&WqeoMs^g4^8GAl2)eZUS>Xffr zWUXEoHCB)dv>;oN%MBdPOc^aBeG7-K4MUqbG-H)d!ue(YYfX3Un=wVHLo$=!ZA+5K zCgpp2>eJCr9)uU{0(jqSRjZ7Qq&!@ux3Y;+B>?X`RBya2+|>{i(`>y!ub z0ElO3{p9v3D}>oLIx6ZcoSK>CUaRcP03PVMuewy81hBt7B9C0-tX)$$2bTM&Jv?k= zZ3?cTNaa-5H97UnuduXTe?iRT%L@Zd$=z;vn#+>fa)j%goX{Z+AYK_}9953H^2o~T z(SzsE-1&OuvFozU_2ey!S2JmoTg^?P><1=SJjzPe?o**47!_g)mVlWUD?`N|dq*y! zJ62Dd+0q_E!){@p-PrO+v|x8VWY(oC!kRPkYU0)fMs~!;PS7GIs2>o`a$|+J%W-J) zHNt^g{{L5awj^kN_f5BB*EE(RyOrGE&spTen!T{>b6;|EwTi_x(5_^#0e|-w{{zyv zx=yY#x~ya2>y4r6|2FYsZAV+yi>4>HL*Jp4QvE65*j_#$Bl_mG%y0~!*ynNiiMSFQ zB6;F3S}?K!TZEI1cJ_;)@Z;uZ2T#Tkyx4kIPEJ6A2pi`PS|i?9g$R15{J3KBjTes8 zP^;5qd3zN|^S?eoeWP&HZ!RqWd>;^R)#xw{y~&woTs?hU&b{EpBhJaG8MC{6b>vwV zCpQWR;x^51*ctnAEN}Ev0T~2|*n$*|=+#*G{cy;l>$l!LhZ<$0|4+EvM)zr^0uz`fatzrUskX$cC|*$BsnsX zH}YJe#0tokZMPY2$ac~I?~y~Jq9Ym=&{2kCaq zLJz(_+1b`Cw5@fAZ#`#chO(K4BD^A1Z{2Q6E!}9{JoM z*^Q-KL*zDN#fsS4Xac+*(~_iP`=s12)4U3d@Y81mqx-^h&=8|&n0^7)PdRf3b+cA^ z%|^Pth?I=7nynegK({pz&3!7OMJiaQ=8Iq7t*7O?a{vNSRE}ww1@8bXxo27}@VS{2 zDQ`1buK|b%bsId24Gk_I!!VV>VD>hKqE1sjYj*D^mO}KjyKYN;0m>>=&Hi;NK0izC zC=vEO;36!X(C2B}@8p2^`mF8asw^ALnS+lBNq)A0T?AUFX~FnKiSN^=UU!yxf>-1nIw2>o z@VsY7X!{}X{qWDLkwps>ijFvjF)wA7cHRrNxmFus!-ml75FM}J`J*=m&S+Hz|&s4ElBV8Lzu# zUnrsovQ6hdJOCz6Oz){K(*OVi000oiqwBM_Irdc2xB(Y*_OFEo9CJPd-b~_ia1?Z9 zWRc5VkNU1XYYDF|MY3$y5{exLiFJ3;YwdOeGujfzfXWRyc?;-nrgO2YL@4!)3e}?L zI{@K%ExcE8*X#8RwU6Kg$xi^0E!I`3{#KuLxnoC0ER(sohzK7b`k+TlZslhOo0|9FFQ zKmGCPN}SyJC8Y=$JoJ%}teL}z#V0%w@Jcz4FUhrT=jBoi!S8Zi%j*J)8vD@7ye4V6n!n(CsCUL5swZJS`$|Odat)Ej+rElFwDmS24KI zE7cNKTKuhoz=|sOKxa(iH#{bfT62Ws%$GOcv@1t3btz4#78YUsLL(e>_-=P9?_lKv zu;}%dW=0Zu5Hthgn9~yMQ+}Q!6=6E+k`^eP-C1Mym6G8`&pgqvfEQ|mN`<39TL@)KX1B=p4DhwCc470L%PFGf$ z1qHHO3a?wums0zfMadto5zh8Ogr-U@MpkCpiGqCNaB++OmLky~-{#}+qi0ov2jhk< zi>G-V5D20!AQQZu3}VWTJnfb#k+lDpD73FzV)C=-APmn!P-Ls ztl(1!*%f@iOm{irb^=Smc~bOj>T<2$hhlE>H$^YOh-3T!A^r2moj7-|!~ zkZV>(c?U`UaZJ!=7}+|d0d^AfmnRsdG+#2fZ?;n$oj*v?=M75EW9CPNEqklDx$%HQvuRR$q<%b~7RllJNR!U@#R z+gwGkg?@>Pe71}StAV~c^((V92NTp@Z!Jl0b+-5mP~o*=z4&Xtqp6IP4Maz*HZ?9~?OSz*9^4sK2_+Pt6xZ=UU@RoaK>$;O`qW!@>a zR$z&92-ZzWr9~?*x#;u7n3Pc#luSlEPY%!~=tL7_Z~VqqdSD_0llf0;xYr-rNgE1+ z@{+rltegr98{|GFV^ z$uq%%6@}Pq%5new0K_oQYU`q}jphrw;%!OZ4m4B8;D`{`zXF-Qe)bi_Q6A?6k)3XG zGYQpVx+fsywaeUp(U*ozG#Nb0hr1P6Bd|IMSmzVgNJR(B4D-r&^Vxt7+(*cRsVO!3 zTy1E3d?}$76n;BzW+H$AHBShA|5;rl7-g<`)eThJ>$IM3r+RD^)VI>ad7HIr*6F=s ziD7G8HS#=T&{_QnE{n2<9rYe?egFUi00@;l!6s@VXE`8l|IOQ+xfBRvTPv;px1Xno-knPUb z{J9N0SR-^uRPc7L^QVrUYq1EsZ-R0=Na84prTY^6!3@hSsQ0Qinsiw8JG#uNwo>L%wi52~l&bz2gc7D2Y1DZ|in{kD zI0m}<(9nc3iO%f(0@*DuAIHMfS*;j|1HFfdU--4=WlXMt?#Q|QM8wK+0a+4y>Y{*@T<=dBYk%rCEv^pZD?4*+OgNa}c7sZgZLH(WNWW?8Yf&`0 zDnIf(h%9phL;WxL-J|Z!w@t3*pf!lwd{dc{m9e36f2TvjK!DuO#yvU2q`A z8&D8*(@`?(r)2WY&g(4K3rvk6PI5NlZj%I7n`yx7XFl#v_i(*?o*twR1ZN&}1IeSiZ;L{br-UOeC_8ZF|QIZ6xcl zoEPfdGL@h}@*Q_*2txV1)?jyiVe5mK{EddZv!kBbx-WX`=+`p4EwOjkVUTBnVlG*y zSQo>kcr_?!y_;mq`TWZx04QMk&I(AOb+y zJSFBvRqf(GUlhOZISmO5W--Ckdiwexwn|+W#U_u0B$ne`J=Auwt*w{ygRCKn$=l`6 z^uwL)%LA#IGY4_9My$8e++Nwt96_uGUb$9Z#pkt3;vpOvq<8*r?dxYIVQmvEs`bIg zDyT`Fg6s$Ep3F@Qg~4h+5#OM+{Fc9_PYGN|V}#8D>wDbb-Kt&Z-m{LR#69VDduVJU zcsoi!lsVZ5IXN!lLg)2XU4CZpRl4WPQ$&a?000DIPEsmcqFwhU3;+)DQ`?AO%_jK^ zrR#aA_^5|0%a!oJ2?jC?k7TIK8{M7%y5GLwd8I_n;*C$WQaPR3fQ64|G3CKfI>cmh z&u_F*Ra-54_yu!uWDnIX{l0t6Uw3iwVeR$UTi5A6zSThAq9DHwvJouOSfgo%Xlnk3 zksrq4H8SSHY^)uE6VkSV1=x+l|NpLBbQ-Wpk_ent2%}Wa-b3&YAwZ7|DpV7#GzvFb zN4~#nyp$z*z(~hh2+ToeB54vXh`Xg)&21qiiUG;ZY1oPefKTR6lu?GFA@}+tfJ3U& zzJlL>b-JQV8c+Atg#gFLvLz7L8$J;m4jm)uzDtNaK4BM9C~1iCt18#w2HCnTKN$>x zacFi77dl{w^v8oMj*!bbyG0dEuavC|8GjpWaUTXdssa2vC%o^CnEV=C(gNcQ#ppNM z7S)OF}|OO!(ERU5D#Ioj!e#_N%lkt1Bg9;U zwxsDOx%L8Z(3!Tu&7Ax{EUKMOaTN;rGJlbWcLvb{gCo5^RJ*~MtWFRBa#1!Ebnq*% zw_+X(2KEl&#ql511D>kD2WPdSsPXFQQ{nyirdc=rzbI=oK~T|t9741+SK$~;+KQ{b zZI|IA!9Tlc%S`ZtxdNj_szURaj01280|As7o}V4WMJNJSJZ@kS5X6}{w}5v zP>=d!igT$iN#+nU4l_rGp{?H^X3qy>u|9~a6CXIYc=lq22Uu5TRL45bcbm}TJdb9Q z-0U*AbOZ>zq^+*YN2WV?H%R#tJ9nEDmy#o0=*Jse2oko`*3bKCt$f%FC-^EfLvcty z7*p$E`!)Hj`J9mT)v*86Y|m%`}ANg5jR5XHA`Agi8 zQ?X={sWM;z*dG3eNu&xodv&Zkx;s6<|9tl56joXirc1n2@iM$fpb@ZK4yZBcRy5i2 zFgSl7fW^tTzu_!nYRkRUA?i#-2`nhk2a*SBH|vp^(D z9;-H?Xb)oH_C!wf8FGU-&uln#NjA!%N|h9<7@>jRntD#>Ila!1eU~P9VRQT3VFB~hWIdC- z^R`2^Pl^1wH~$=IlPM!tc%#v3az99(EKm6WGlkT|-;yYzIO&B+keHS$#G*ez6>q(!6;XdN{y4PXB^$QOJXum4TGG1`$wBG%{brsulP$KKWW8HxMi zu(>fef#ec&m~5yC;t*D2B9j^KWnqY*oj54+E4_R#Esc?}Ntqzo)%D2-q#R+l#qEK~ z1_789 zzDS$ka|d=PSv+e*$$lrS?lRW!#PG2DT5d!`CUa78l$FFM*CnR!>J!!aOwR)PfXTx9 z1vAq?Z?vQ2#=QS2HXb1Y^(T(ix|&UPdu(PIM&e@XAal72{aqaE$Qv=^Dl52n?igUE zPM{S*qrM$I)q;8V;8Q}Vq*+*m(FY$7PDqJ0>@Gc4n+mX_4?yc%oaM+$#xlntVhco; z)0g^!)H21D7UM4?Q6M#Dnj*+)X9TI{Fd*riik=79HfY*OrtBF%?AVC6H!)6wNf3_Q zUfdn^uvL@*g1a{gjQRKpb^odB=ha6bzBnfH;C7Qdt0FIy*cHD2u*v?PBbnw_??1=> z%EqC^Lm{qVpUQubk{Kce9dzS>C9A^*$6aVx?;^u+#Q3p`*bicrx;%WxzTxVv6C1+T z?REG7m>-z`z9JgD?naq)$q>(@&~j!J>28E1HHB%f#(sibbTC!PiZ~^l2i(uD#!ON^ z>vLU}*+H2E#lM%2ll#ZLj})D8a`%1j9nV*>agx9@!}@tx5@d*>XJ#3Wd@zO%-1RIK zy~=zO&_RYwj(JJ)XaT-;dEh0iPfA&-y>1@-$%{6|$y6KU{LQ`D8Vm%euRx68m%*HN z7p#`4Dqdi70yWP`rGd@0{|9EqBSxJ-@BaTaa4}IaWiS-58U67~n^?`Ix%rtaF4lb! zt-`oCW+f`@a&A__$O_3s0>9Tr^0Ot~)^q@-m>PI~`v3p_Z}je{;F32WTb~{I`E8>D3 z^srfR4xlNRIWq#J$c{gKDL?j(b0D=6X$NxoRFWBFM2qM%lVTx%CvTk_uL1Hul;dWC{|aOeOgUl)hq8&QA0_nG@_^E$6ffwVIBjINyb>Dt1% zC5qON;3r?B(B zsQI}@X_27(7v`}d*@!&_i%NbMgrE;Y?SnR3h?WB&R1n-ow8p|=#uAgX&5lx*lnU}1 z7d@>yF2HXGu_66>A?}Rq0z_h|E`4oU7pqdT*`qCf7$#KuAw~M!m_#mB1moIO0V*H4 zX(R$*I<10n%lj~Fkt4W^bB}lANgChj0Cd&}(VWeYAkkQ0&@oHPYnftCWo81Nb*=TD z^zjshHnsPFPVzTt$i9S5wl^^fHo4!K$5~?3-ze`37X_kWBY?nmV*^^5(Y*tstd#rg z?zNm3E4R!sMcG??e_U+~9TLS%hI>AlwQhS#Co8q*8*hSsPdWLl7Pp=ab?8^4vP;JaErsM$)G1=3%w&?m2CWdUzmNf#0D`q_mBvL`ie0OmT1d#D^~jPW^@)Ax57)Fv z((NGg{{veO>wGW}Xio!s^77Xvr?H!0yw=YU%+pPT>>&pl4u&s3G(WGXBLyEXg$3aU1w5g}5HX`Gtp?;Uy*? zi3G#gfOZf@-D5!i*`cZ~qr75aI(;s{g9l=uC$VnZn*4P5qVG>8CVYs{xNy&yn6peX zLoV(K>0L3xx&acF2P$KVdyw+AUsJGFjmzODx}?cuqoQrZ4=R$j10h|sbx@5D zHI9El@jgmi&~vYdnm?RUZfKCC(@#q^(03OI7?(^55tEGoZprFi5TXfEenmMJ7D}vt zKb*2+hr#RPpIU6-#`&wjF1H){&&LKeP47+^L&?7P3<_s~1R)z6{5z$q4vNMW=P0(x z`l|QV`~FdeUeHMt1wlAmP;W`3Y+rV>kboVh91JGs_fKk>L)EUg2u+&BTAe~nZVK32 zY$70p;mdc7`yJX_m(kz-nhwOR*do(0UUDhi@#Pc(YCCGE5%N^jgNd|{c2Bk`?IjMC zlV*g>Ar=}wyVg4i%AWvCJgn<5k$3}0R2_z`o^q|NuKpJ4p?*0)o(_PH*cM8ay}wi2 z9QKui@CDyt{RWpMq%v}xM?2y)arykBJCRSL$J9I^bTm&(0HJ^6cIB@8+HvUu57(^&9;h34mQ-G>7bA^VA}NqYKMAkwn3Uj?B!{C zb2?t05P5sD@gaIG;o0lz_BP&QHN5OV1AMKKHT6QumXl>4qLgDkL|HsvuXh+U z8hx3$91Oa~us;62nA%Tk#Itx?+|iG<9W|Rd8}}Ltwq{p91)gnc)mVEnl1}vEIg~Gp zh2QK;tjCOS1?&I%)h*o&S}&?$lNKI`H*3RA(FtJGERTv8YSftYQvc_aGMbOo?--!> ziYpso36GrLU+RZ+BhPV*JE=avzBduWWlwTl_4@NnqDC{1H$Ho-;Y z6GNFN`)7`A00G@g)n-!R2B!B;5p4HH#ti`w6ktMd8e{*>5ys*_KG0dzY9 zg$5QKY}3Ch+dlAT2VAo9YZ!J1bm%P_%M-82J~og6TO!;ud}dokVp zLmv!-V?Kb(>&3-S-G&qOHQysSVk z=wTLUw;Hf=;{uPvK2^V6>B3z|fq3SD$R@$5WR+;WCa6u>cT`WDB%VEZ_+PB*i17ls zBCgAUCfx+(8}+-l5HcNorwVdAI**rS1rvKfAp$dR2oyVG+8X9_j@Y2zO3QPLOIKBy z#_-xYY42Fzl5@2>Suc1{IFhX2r=+@XIROZDt!l{M>F|j?oOR=ctzr5=4Io6-A|qeE z@O47H-I>h3&fTSw^P&(#cu9&|bN?JWk`r_S`v@@=MCQcj4@^G_2K9NIr|2;GNp-zg zPzejq{nw(A&v=6GXGHt?7(j~^L1=?vSHJ6blwt#OWuSk4b^d{*8IY(y*7ltaz8U!c zJ`u34?Ui93Zwv5NVvfLngZglKV=-sB@?3b@jC(=%r{PG8Sb?x3;~!=@suQDxC~VabIQ0)MN~d&vTu6;c!5 zIHQBBDgpG+oItMHdTPM$3MQn?#26Iv7bZS+VBQx4e7+y2!gX5K{?~(qVEADkZPq*Tw>(kbXRZf^3q9CkJQ7xRP~?s8 zsZ2#w4eD3kgbg*(XDs7ZaJJG9ze^AUm|0WBF-Qu_TPd3+;5Em1v>?!HmB@Rr-c#@~ zIo#!$7iLOg#Z7}$0`^nqU_w8AqWEY$g`JSU3%Q8^L~VBwq%tFnxE1A&@u$vXbF{wmXPCA3cH77?>2+IpwmkpTe2(w;RGlBy(d#f>ZvWebK) z%D&L`0Bk!A5YjB??ih8G*Q@e9PQJ}lJ7Fu@b(y+e|JU3Hy8O4}9p;bN8t^l8&1}(6 zM_Q9JuKInucBFAn=wC}6Tp|FvXs&IsRoHyizcG>+7`pR8ao62im+jIndUfZ|WZgL} z)wNo$Pn^)oE>5P_d!M@~Mdcjvq>$K4OmYC%gqi{7Od@FQN#+d1v&-~OsDJ;v{vjn> zX6yP7BRc(P?|x|h7OjQ25G+uhYOksL!xb52PlYb)+Gd$S&PJc&L`SUm$SCM>c*Wnx z+rWr?ID@Q8a98fcsX=p*fW3VG`OoyCJ80^~kNl3wCaWy2%QmC4b*?+IK7weYfs=>E zIFLPu481{4`;&BfF1-}=u)U&-tZm_`U2BNCo$EaG+KK)vQk;QtQ$mSyIdCWCAO1~~ z%+mHRnL2fn%?G7zyH|s;#`zuH0k>%-gP7V7$;-f*WLsPWsRyNYU~k!E9iWZ!jAM2l zfS5{EUGQnyFKJxkM>6qd9})HN(3stbR>^vtBZv9A)F7?%e0jo?A7-W|h)dWZ1@$ct zZ%r)IzSbsFms|2pD?{AWO6mOLG8SB+p3x10t%V&(S6=jZW9oKt$z1U3LQ5fczR?=( zFHl8Tv1eGz%2x7qq1|(UVe_U&VqdbMHoh~$JDnqa$pHf!iFMi@i!&W^oiSQ~2EthIyjrbfM$0aBkoB^Rv;7!?+KL zMeDxTN7po|VbSvx`9=3_s+3E`JqDDPL_KdhoN2t(mhS)~8w6&YqJNU2K4qNM0K(!r zlaac>-^_?`#oi{YO)W&kgm8Loq?CJ^G~LAD%RiEIw``l#7KKjI>FC}KNhUf^N=LwsbXbaimRF>@^q_EvaRdMA6y#Mf zMiR~M|8xLBp)A*#`*;8xKl_F6eE`a6RUGplMtVNaCkkUHf&#&F%X+&m5NuVa`o4|D zIjD>ALA#-{pRcl9*tPMyQg7?}d!P~2U;=4cp_3;D9w9xPwIsh#oGt0~w{p^f9xT40E87GlX9rob{Q-O~BBN}Rp0R;+I zj{4+!!+EERO#;f;e*V7e||WI7%Lua2K%Nw zU=jh4qf4Go^-Hfb({ZZ^b=$mT^Q#>N0$DKAVt-O0=yS9X3WD*5#ZYTa^m;aSn_ebP z!Z&UqwZ9nt33$z#K0a3%=aZs!Br^CK21s(c$6;IJNRCpmlLX8aNJa9Ir86J&@aFTF zpc>^2!^Ep-`5onm(JjMSv!0VG^i!uW0mF0rAi0##g%1+>Nf%i>pc?tcH-hE1VCfCW zQwXz|dvx-3uyAn>;2chv;QoC-LM7FPjtn>!v!ruJBOBad=UZqqonFu9#5T&-w;2K_ z*{H6(1!YCzK7SApNUS_{>^PGV37{k2%$=F9Z#imBs^iGi?Iy%f?mJQca$0$|hJ2r<<@U2wFF<#f2YR z&)eFO`7q@nut4tboSRARr@}$_iiDroqAYnYMLW;5t%A?ycCj(Uuog!~L`+IXeG~bs zxT=)32?>I>&-7Q7gu9T+`Pusu&S1_?|MAttqA_lTb)?NbP^|?0VWvBQ_aSF2fYtUF ziu7R=UB%XGB~j>kuV}W6{Xsg5_?#a+urZFq9SdrnN-%*43u_!6Vsn^?30-x>^!CXJ zdOW2r_dSmZ%$A4E6a;(Jcj0yW5Tz<31LP&A<7KqA;6K-v{7|05;f2Gb2)BpM*wf^K zHeJ*^yqI@9Tg%LZZyVDZU2t)G{ti&AGoDq6+Wm+T_CKU(Pm4!E0OFu5;7PNH_`-MSba({QOFE1(krTDjner!u`wj@|QeY_vux4 zD2xc{)WL3i^hQ1TNn7)L)@?vU&uu9q!7Wul_?d5e&ddoP{`bN!fvfX*Mt9jHVvTt^dFC=@tR z6ka~-BSwAv%TT*FiK(#;%^$#gf85R@BZAXW$Px~DRMNG3&tecV%I{{0vF z5t1=+Q6W2-jsO7A&thiV&*S0}QPb5G%ZHQTo6Z-fbG5_Z?5n&k&nAPc5md-WvQq#Y z2U5hci?s##N5GsADZ&19vBFthZ)vAIs1Ia)j>_mZbr$2?e0c{I?WpG>h@1Q&`9yRB z^+q#;csg%8Zm#Z;GJ7SKHk?0egmFvlX2{*Wo%6S%X=et7HCtu`B_{y+xu!5*vdP## zce(67Zko&gTOen0)K*|iY&v#WU#+NH;rx)DYT_JMTert;%PF+WvJO)6--Pk{Z`*$W zc_j@t-r=SZUgt7!Q|Ow}$PfTkf0Cj4w|vuYrS=0}P7ucayG9~KD9T$l9vZu4LcHgI{aW-^)XnV}xg z`@afc`qt8MLWrqpH3lp5#suNN?xaX zec}?*u;6g}f`tR78D7zb;7R$ff!c$Z46Hg>scvYT2741Eu9NUFh zVUh<3mZ{QRwp(4lyb1IqE5iv=|g$2~y#4AyP)imM7qbqXE_E&vttk0JYP{>K~Au30LwmQO8ywvJY$$l{Hum# zmFSuGIDbfJpdH?K-o^IsXImDZ5A$1}=;&WQK$b}0F66UX7)~`^eZTBQe1n>%*%xcc zOgcX@gB*7s|BvL(%BVzhgq0Elj>B+!kBTftBZ`pe6JKd9B~#;x!eE$G&pSMpx;!54&F|>CNWy$}$$5(4t>d?oOEKYT~0<$uA+`Bc{uS zaf}?r@PDS%w_{8}&h#p49*C@{wT{$)s8>b92oYGE9hU{&eO4S>_-P|a&~)3$@~fQ& z8tH~rle)oxEy6kDk+-%VGXu2`DUPt#G8_Ysta5fiZghn_dm*PZbgl!jz(d!~=2n+i zczrZtzqZuBVK)rMa&NtAH*-879^Yyvm0ox3VN-qF6A_7!2Ip#Zq@@XAJu5&4Z2Zn` z`=zxd&#v`)000931QbyBBl3zq;Na&i-D(i>BKNV-Y1)>$=W&TLiy19vA2abF_66pe0~1U!pZC(-*w`6OrQ8nRXf&JplCSK~i+&i&qhErA5C8xJ00}O5 z{(d@<%%Y$b!sR>qj4gpvr*gu>$E)c7QbR7i{XyMc8X@Gq-Fu*}&bT6Sxs2=)68_aN zi6qA7axQD=LAJTBe^ruDJC~R3C3vbzY$dRixS>}&f+YfkkMgG=YIHX67AKJ~XET=x zR;px-Nr_m)AG{o2b3epf_TT0YYr&kuqmWVs0#j0Aj1eL{N8t_7k3ri+OEyS)*9dw$ zIv)06;G~6i0I%c5O)WJGbOG>9lu5n%Fp0Ha^f@u+;epqfK)Yp^b|p8nIXm}eQb-R{ z&^eqK$+E|FCySNw+nYEvv`7}dW0Ijc2_qEv6cpenO%fyCc7t>cX)-(??73GHA$N=u zRpuMo9Co9=l}fr4sHf~2P2Fb?^c<76XqwV7h`D#fZ4jk=6Pr&Yg}Y2f{0L}Ag4Y(O zSrwvvi;5ymSxiGVLH1&noKq_puk1785{QV`Zd4|>L{5*o8lwQ+!}r?GlETSy9}47E z{!38*sjNVPhBRY-myIZ&i<^0j>R;Kc5}=7Fa#4oa1;Jmg&xs@SBWbnZS4^Q4vKHR0 zjO9?l^KO8dEkaf^I$%Q34O5k)lKUun{14?=O~(r$dSw?UwlISmNKMbEBiLhS)xtNv zTNds-bNb$~k=E^2Ry{QmuPjtr-y04|X3gjNvde9rVdkXwFIszwgzNWPx-LWIh0gZ8odx7<010eU;s@A&g9>i2pvxTsvBFzsoGV814tz(BfeG`Rn-T($rKn4XG7jEfaY$11N z*v>!l@Z)+-Yxxb(oN6I)A%Q-c2Q08AUk%&&zV_J#8i@=Ap&eyFX_alDUuW-2q9qh* zyh&#%fvNLk!*|E^QDN7A7)G)F5KGJF_yx;c80?32xQnr~7L9K=+}S)`&Uenx<0oTJlxAxYmTlS1Cqu@o zfnz35og>BuIDD?SXv1qUYtZ*0JvxN;E)4PFA6_!$RWNdcc!>Py-y0(2DHF;VkGwhYL9+t!r&47z6qqDO|Oz5qiEn5C_Ag& zP!>lS9Btn{WvP?i;f*4--0<1EAuM zwPTT$?P|~i(0u_|$}Rej=&<*i+S5eHq@*HOa3u%zu0yht=P8*NQ+ZL8p&7-U7>HS{ zd#`@x;Q0$h#|3=K*bc^{KOkSa|fq79@B2@CYq- z?^W|22AAbi=`he(Im42$M8n+Ofaz#&Y+v{%4@p$QB`)84p)TmP&hm2In%&7;bBmiz zLR$D+w#7t_1ckz;gRNjn;7@}lkc6MXK$ZmRiL*P{n_?MANzW&aNia*BOq=8i)W4k3 zpEWex=l2&UYdX#%cPl~{?eg7(b?5lQBUSS8lFCNL#1Bi%``ctarGzWGT+p=`3x3!l!e4 zXFjO1H^ke1T9tN#KLH(3?^-rjpJEsCqg{d=4Nk#?wP#EHTAa#}{Dl(31cQTL&iNJ z#I*{;RK??iSB^*bP~3!NwJIDay*9nAEYDyaOu8EU7p$hf1vQ6<(F^dMcgc>oQ9VbW zbwBb7e*1{i8Hkr(!YTE1e%=qMYUB2RBWUu$a-6*Et`|ck2c(!=8(4^4Jk7UbW#Xii z0Jykl$m9IU(RG@zYz}N2Hcq88do;ZR0!_|y$Vjyjn4?z7oMJlGv>xgyZl}dCGtgi? zCyok|PdS4;NWYjEf>q71M~a!7c>C5K; z<_p$IprzEaFp`9YL{NK4X6jrvG`jruuLlwDk)-u;p4x+@=f%ywQql32iPJ|`Bd}4H zoNp#T#biiZY;XP?=fzi3LeI>Y>+sD^ms`=GYk1^mp8TRP1?B`n<_cwqDO_ z2E6`JdS$;a?ESheoLRK{)e|Y|0#f} z&q5nHcoU0#=31_A)+n`?63SNnUCW9#{0wfMKHkGTGy@nAR2`8XlQE5LvY%Y=^Q1#c ztrBAyK=C~u79?t?e!Je3DwkA7u0ip8Fs8;=r47oVL=f*H8gR=atE>5To8G{MxORD) zE=%3mGo@9=#E zs8a-eelU^SzE9E}Tkb67VMXWoX4+Y7kzix=&4#h{7U0%|-adjZc4LuabKGR(yHuxB zMzKKj{?Je&$?-z$ip70siBvV%iy@>v=lh0qu{gLB*=$QFan%(P%MG5~@eaHaC~|QF z=vAd!^ERE(9TggD>1_eX`6p6sfn9d3*#W?5oURbMgO?(>L@r{LW`mh0+Z=zjH>CgKOJsbk<710^|cx_45m!*lysrvF?K zRCYhPwFXxS^Du!6*6LS|@*H09;L7Z}+PWJQ!lhO8wuLSOQ67&MKdUc}D3_Bo3+>Tq zw15XJ(X}$p=^UPt@nYltljEkVrK>iW8oOyQxNuts5$CmIK9s$UnyW=@Od5Y!C5i`b zNz^?^wwY%jwKQVdI$Ir$tZK@_tKh-|i;MmO1~{e8_6wLo+*0~EG0lYLC1RtVXC4G= z@?<)VybRTPpM(H$uZ7D(cvmMJT(>Y($|tBtc^EdKwUQ{tyr1PJUykc!f zaW`skdt82US%LmwT?9a7uU6NMVz%OL6#}jaLi^z!O7hrEJw_L1hGiV1Q(55_2Nyqe za^#BnW0b!aQx`Y_`I~aPP0czFdBCQ-UuQ)5m*O5iIp@WShxc5kRBr`@u-n>qRUxDgqI@tjgr*x`pwS`1-jl3tUdWS+x-XH9IfrQWMS-dY1e zij-*LXfVS@Bac{D9aY#!PZ~tu`-l$@vHbVsoZfIs9tm+txi3+$o>&gpj5vFikqsc;7PXK&wZDfil%0YzWhj1WC%44g$VtJ8D` zfStajEgS7Q#LfND_&bduF3yYdHsAq!io4>i2$hil+o-Bm6?N)s5q)2F(l&L)?zdqG zR2mp>Xj;8o6)|1^4$rBRNqW2%iayrX;Z;F7oe?;H2cS@o@s0Hg>LEEEw5A8ps#XFr!-ZW zPa2+$z7|ixtS{$bIN`)2&zdgp9kFuvY$IegE`d%@c#XnCiba@RX5OibqQ~()S3Z)e zHD_XJ%U7n%ho9+aH9mp8 zxTs4MK>~nQyhBnb2}4|P}%h^{S!myt`XOdpz)U}1Y>6Ih-a!SvozpE ztsuNwmu6es3OVvhHYRS@HFaewYk6+NgLa3tfs_L_0F>A(!pZ>L*C)S4gsS@aQ^`r@ z;Q~(Rz2rwG<;q)l0g3dol2b3$`qL6Gu-gKAeu|GRlIvh^F$f3%>5JUA>u|KTJX3;t+g-YS$+7xKTptJgo9;G??0{l)IT*}jw%rVG z=$f}+&o2?p4(11uY%_YjL`u_YcfGC-@VAMuW|~PACRuuL?FZ^eigGBD**UTcLPNV> zr*tnOdb>XIoL%+@eN=HQ*9kdNc~$?sP@Sz8mA?*M0Akb96H#YM_i#M4rzgnKllQd^ zO7uf?imzh{C^1@-mURy0!)4GZ?)eK4ZpUD&a>uN2PFk z0ml-b4>e1BdJANV*9kDVsJPAQa2kdQvH9d*Ac@CZ>-Cs#1#10)p?|oVE z)iR}<6M9I9fG?n1wqP>jpIQ?8ATHqz+N$*^VIOkxw#{?ORe)DF)Ysl>NK2#ZR#D58 z)2Uw5k~oAAdJFSc!W*dk;6TXbgawP@{y`2E>7K9GK;92y2iECN$&CbLT%{DMZJ~rJf z%cUcWT^=cIo;iFj|_qU1&{Bt5fm?|ZCYdgGir3R5nI1WciK@!!InbIJ( zHN=h&96Uer;Jkxi74ceI7lBVP5@3|UFFvUdLY#yzdWR|IVa2}JNuAykve#*#LQ7ai zr|B-A{qjnE;sq<=UA}H4E>ofw`h%u_$laDHeId557{1)v1~3wESdLKaT)zSW&{;2o zgb^-7ZTbcPixtQJAoV)v$8`TFfW>kTqmMn7MC_x=nM~t0rBl5wz7Ks$9D7s4SI)CN zAk!E0ZMp{%^1j2W-uFlM7jLc*na92u>IcrTmT-tkteq~UjyZVFJ9qE#Bh7tLECgPh z4|CddQD3x*PR&;Mmdln)z{TzA+da54}x#B5t@qQj04Hsbjk~ zZMNRlDonekNY*^CCD>75&}4+#g%ju5RtZ24EQi~`?CJe*3yJxh;pYD z9Wi-#IOZ5RvxYX;AMJ)YJFof>2YyWV#mt7$1US#~t!1lVw%VfC(1c5^FtHioryR0Q zrP&V$4p-}xqLVD9Ki|Z~py(eFb)E7Rj@t8UydS&ffb+ozB5|5uiUG$bgX~XzE|tcA zoW|)r%;loHH;A7D$~>%USw#C( zN~Cu&fehQ!+SqWTwm~+Z<+NdOXf8& zxKsuF<0;8K%J~LB1;WS)i`?j z7N!-#*atDwP`&OCEe;QLpMDzT2`5}oCn;Df`7}I8W-_yE8kkS*n7(Ajx$VYA;WuNZ zzMx#-{*q=zB>p9MH6`^9c@lr%18Rk5C{f){oL9og`id z-x5#5cJ0`{=CSK|@E5A2$-TgN$bid6AH=#FN+PbdgXzSR74hB-Dgr48=O5q3HhODI ze0fm3yP}4v4%E{XKH?6qecwrRy<~dr4&5!76#&a<`V^aOO#K;0z4%BH4lZBR-D zTl}#)Ntt-x!vZIKUUYKY1Zl6VIUvX+=(r#~PurafZB z&cdOMYNB1DpaBnk75(8z_OdME^sq%E@h9dLr5@4ee=X(%Q>gbjD~1bMGej7ZAk(q_F5 zT4{nGHtjje%-9$th)!>jVp>2*KkUeomJl8btD^BkoXAmXPsIb=kvXI{YEo%5CLgNu zsTftUI*0NRUSJmSk1{-wfD8z(_g__bFOnvxmgX@+C^VTo=CWuw1^bvblEp(mmdod3 z2FD3?PW893@ zWl$da08^B%_D&S6t{!)|3b*({NNtR4sS(Bf#q!d;#n%NXx6XPNG!zeo&V+HjhAUkv zc9_(geIws@Uci->S(9zk&+9OYw)}TAS=*MP*mhkjiU`!HDt^#fNivpmw%>Q*vZbIK zjWV%WTGII|En(T&jSUw_VyP7S`U1QtVEA~IXn4p>^Ir9AZ97xoJmej8uWr@aMfcL^ zPlVS3Xsufz=vFYhr!}>%wIQ8A$9#nowBE4rJ?9SIuP_ zV$smtcjEzX=gb9Y2ET1P(gLx2@;l{VM}?O5&A2H&ZgbjgA@ti~Xey-o5i3Y36&@cB z#C`D4<*{AQqUTS0IyX#Ni#LQrc-QI`l5+5m6xq`epc9(Q&MkRuDM2!G^HmM2^e~xw z(RCUdvTeJc^!y_9v6Uw+tEPpfR~F8hsiurYL(-eKSZx`^i64n^#KP^l#&4GSaWV|N*ad21 z`oLvuRD3%t_Nl!1w21v&dtX`g+M+QeN#mUeJ=F%lSy%Wi#uBuu$h&u**himr3l??~ zX?tLr@iDlUj{JngnRUO~bUm6X4X^1efCpNO4Xnee2xG@c2iT2YlYqmX%VNO3r| z^0dLt1Q(}98=?7#2EaAwWZ9^agGT&%293I_$gx}IM_0DOorMlOo`g^3V;>=Gh&>0w zse+Fu_4cH)92y}(87X~Nmd4|H&Nj8OSq)P0_vBHevm z4^qe-v+}vw5#>4ErX3XApTc_>;)@kJZLQn8S0q}fk|PxLvhQ-8E3qq0$h*8Ya}TP4 ztRtVd&k=}W+P@?0e(>Z;vo7Y193SpUswOUC%(Z|8x$>ysH$E4CagJl?TYF$?;Nv_R zD;gm{vDb&5CDa;INELx^V@2h_Vy7+QXTC46ElAaco;tkvKFqL2zoLjvDAnF$#}uL4 z`X#4t`xxzN|4}whl#IR+lK{`B-oMfRve-d9mZJ!~1H1;i!|1L6Ey$5XbE>cX>SD#L ziLEfqV7W~Qgpa*W!6)3|yX#X=M{WHV2?7Ly&39k}=aY*(G=T znDK1;o}1Eg9|{_yibMl)+3#MdE0tFnnZZ!HUpFM$KpFbdJSI}RIXtT?%`H44M?sI4 zQCz0p*7yzz@3)LE>)SqL1?#XbB#2Z>Z7L_U1u4YNa2fB^v;-FeIdIzyE$L=czptS+ zELJ4);zh1{!HjEs?;_!}i_-rPo{3lL<#4?wHveoPTG5!xnSp)~_dS+)kd*x_6aCu@ zSA~0l0(wm@guD9bAv_fhi8wraj~Rgicrw*X_jr__8IR`W2dBlB@$DT2bT(sGgIwK;u#tUPYmUI)%LjU= zeAZlQf1KdLzL%55{cwz&ED0W%Fp!p2_Yu<+(y>X^R(6$|s`2}jk*7ae-%SC_NIq^V{;$ePVhd{!_~2uVTQS&}9~O z_Aca?q0#U+kcRhd)`Fg^Pwbk9!QzqQkuIE>H~O7RP;)9HMtWT0#eN04Oln)eIpYTK zl}<^wgAU_%r{w4X8c_xg+=F0GLll#%G;tB7RLOQ~!NB^MZk&y9HU%NvgK2!kb8@4k zNA)P)uN>hz>RMlLyn->&j~q(i9oN{YykE9PJH66-7=0wx4$WBdF$85EAddK~J;pb> zM-L8o==tIpa`5XF7fm<6p5W+f3ur&oe$&1qMYg)v4&y_2BQ^Mz_l?ZLt=q8T$yZLW zf!oZ;I;w+4jr2R!X3qE>`wd5$BUOLQP3RP|#~A7-fYhrvsoJwrW86aI_&9&yew*K3v}+RQ?elgmvS{pcT$d4`o7QtG${r1S2)ydN3`AdH4`j(vU;=$(S(dJmL;*f z)}jsinIFyx)bbq++)s#=9iOwG@)$Lb<~D#6JRwR7B+grnu&}|@>(-=+Vut`g6apOV zU#%o{iInmO`UVw7uQXiE6ZV3`#%WKv5${&X2wFDFAWph=5Z@&v-ep~;v#d$=`Mn%{ z`dG-}*lR8@BrAjryuHk+`@9*giy5Y7S6(X2mk~dFN^U8OqEffLXyrI&DT)ah5$?^e z4+L0J66RKVO<|v&q5RCT&}g=p>vIJa#1hpYj)BFrm>}y!mzN2&iiCUcMCyE1l|YQG zj~GYgP@aHtwV)2?@qsRM3%;9gk(fw9JP!I*+avsdS+Y8&H+zR(xgEwpW>`dmy8XhF z)8w81pc1t?;hZE=VQ#dl3d0jllUgRel})rP416wU_XrXh>;<8uv`m<8Nm7@C-c|nc zp>GhtCg{Z;2yq|JJ#EB6mZGbdz{_Vg^>3fx zrp1jRCmLFry4F6gXMRtlHX7#q<~7elaJ4I*s{D>Mc7Q@1$8cYD*E-Zq_!H(e9 zRlI0ztKj=ECPhq@J3hhPG#Xq&5QJE$7xA{vLn)opusC`K;!-b|uTZ!2FM?cu^3x;@4oc_g2#PlN#iCk>%y#89tha@l?f%WR;(5 zNzR9CR>S(4mWJtT1?tE>2sqB91)RLN!60c3T_R-%O`~WG=}EWvdZ0-|8S-1Qj0?f;tZDQPagRegc9)LKg>vHZ;pj(XbqNTdeON#h_CjFo#+K8_ znk?2YnLe2AR5xv4Vt1OD$G+?7V@s_#_UCsL3@#UB9Fu?E;T7qaphyjq*)_-oh>ApZ zcseb#-Dbf>H@Qv6wrV~{PL*p)4`tjQ~Sbw>!KNEf+t44$& zYyOZjv$yO&PL1Qz7|W&w37%eskET2ayFbMJK@cMf#t2Lh1sscdibKZ>v2TH8IsNfR zL#8u4gCn)I2m)MrYSkZr%O+9Hrij+Az)1s~M>(CV`bF^grAH`iK#bBTy1ZL2dX zpG}?SI`Uz$(#GQaCWWp?;!-`%P-Q@pXWw?HFc$1+Z-&;~T&@L6e3U=d;K=;q-~Jff zvNVDd@=gGi z7k@CfwnzcwJPHM`C!Whp8%+m~p{v)^UFu}81lWZLU;K*gtR}xXSp!#I7RSvfwUy36 zSA1#>ya&P+xKfWg(Nvjlc8liW6kh~lh3V{mQGq7h&g3HbSkU!MedPV788c6@Q2t~8>oQJ~{UJD>-blHLk+ja^+hH1fO?pRay!fnZz> zV~zsJgkn@7%q7d3!}~8J@$-+jsTsm@PHY*nz33L>$d*{bWaeSKMZg+GW$>x@IEZ#( z&}Z#2l;xBL-I?>pudNq*6L!`OjE4V=uaLYWit}K7Bbvk^fso$Ni)r58zXbEKp>$L?0kLiGtAl*Pz9Q9l_1&0b{ z48lPa8A0o3%P~XP#+sd`L9EEtnj>~24y$p%Da3QYTr`h5-7+-p4D&77J06Rc5MYiSO0l(6(rGt+-!Fkdoz2eS?h$g`jYtCBm zJ1ogTBH)V}3S4;c%D~Uo8+zV-w|@De^?CS8QGKl?Nk*>XZHZ_ncH|A0Z?tGS zH4k(OHS>*Oqk8U^I=tZ=YIV&;pAa}LkP?{_d^zy|}c6K9e*;jDj9G}a!#2nOTst+4_) z(ir+mmZcF|!-BLM?s)+pwc=FG%Fb%q`q2>rtOFE3^pUG%(o2@*d?yWnY?gyzBQ;4F z>hswV0#kAtg%T3xq=*FC@Azh+*;L9djjMj!iqke4?7sjV%=(0w$N@Wa4%;cIW*_J6 z<}bm$i=#8-t0u8N6%H4pLtC&itrj~cp|kREqR2NHPb6R~{SqDY<)u=0B_E}{GQ`R| zQSAGjC_%u7$_%a>gAff@9L5kPpfeILU}|jd4pUa<4g^ULL0kX42#NrHdzz-QSs}+` zgLRf~pO9voq(st<%XPqQ&(N&Exu>pRZY3`K3TmMzJD%%TkQ3cT35ACxOP{x`_o!5? z?Fd}B+soeqIVIYDaU5;1SP%qNunWYeqKr!xuSBvO!d$dFXH^K3c2u}nsSF28*QjL* zFlepIrdauFDyGHv0q{yg*hLkDMqVDriOl|6N#f_us6mtbT;$P8oQVn@a2#)MOXH!g z5a^RH0nK`ysJ*?RHZ}X0qcsw{;1PsIh8OHFP9QBj6qZ@ktDd1|%wScTUvzCNimFP1 zI8=8xmT-wsKp3TrQGh@FfOcM2Sg)4@+UoF?k=SL4n8+hu%y40mFw_&{AdtSI?uenZ`%dR##Yg}4RuNO8 z{6XnXy-NXe$IS7V+3;RGA}AK&M_@Cokgt#eedi+keGCPjh#^ucW!CDYtCVbV!+ZHP zI@wz*$dn92(mL%1HjM~~)RF-L-pH~^JYP+o)`_w^7Lj-+s6~+OsU?WJH-({jx?ftlGWpFF#&NGTp{*XM6_X_#Z%Lv z6%Sn~+iUiL6noGDw^Z^Td`+PIs&jp_*cURL-lafrtMpsh`K~2vh_98PEx}Tis2K7 zSutrYLed-0s(VgwFy(p^3a$kW*o$%cpQ%;3@Zk)N6KNLK^u0JvHR;W~J5W#6246Qp z>)1VwyKiwhsP9R`R8ZO5v!=1-Y2F!5BdHe zhIYRyv*TR9HJU$Sra**`SU(Pho7O8KP7?bbZgF_RLf>^P&@PoIepRid-KnHIBIF+- z*AjV3yijTOwfufH+))ck0Qj;K86z3w9+4k-+;~>~9pr&nsFyr6uDRJAVK!OJJJilMPflN(qmMFb}czM*4Ve5WZnEcOAnPQy8~?-MeFVsSl>k z-(w9*-e)lve`n?ek&#Us0TxMExHULlP7ZTTxjXNo_WV_F4pR4DBQI!m!$(d54Wv`B;nZfn<&!JTDOvOVXyWK_nz^GJ2=qwjb>0 zdiGr%phwl~i)17kzRlAJ{BP_k^UT$j`%@7IB9cP3fa=*kNiLyHG0h$2m3^h&hqBh3wUzMJvp&i_z$r z&`$R_z(%ByoGn&3|(!1~Od%iKEP zeSf=pSm%*K>)Yh~7+HA-!IFg7ncy^&K(SttV|vpSOMQU`c_-gXp{+o{=^U{BStZ~! z_`{EnaW~pc)F8=U>nSp?E;Q_e~FL_!)Xo6neIe{0~)D9+G6LWJcHl(j^60!u#g3S&GFdqJHDV}^GQ9Na5(#j&lT!W_IMJxer0?l1^nWs zoi|ftsBmRQoMus$93X8?qp(#m)iSn8$738aj^(K?j^x|B_8yS-ZPn`&?D%J&v=1#% zBN3vj)sL@MmQ~~yU9{pmQXXNKrc5AN>zMA0h6&3@O9cA%;xZcRmW9 zUkzVRHkpi#=NKfe)@ED-kEvNx4z zGZ z`(n+STc$+azBsBw6s+Nou;y6Y%-k7h;VyfeflK?>mVNILi(wjUd=4_8MF!6*b0kOFzrj*cGqWir`9c(;+8 z;u`G2sylLZ6+|2{*B%o%v!) zq}|bc;&N3YyVo5Vivp6sd6-5iwVmNt0i7;goCwuD2{sT0nMeLL!?3keSVH zq)WgF7~G6EH|VkVKl_L-^1`E{?M4ZzKDP_K(mp%?yn$8@@q(L`QCTZ;Oxu|B_Q+T{ zC#FO=JFW7xBhg_%ak~5};YH0Vwb)5acLUJ%PkEwQYVL;H%8&TZ#*)aAyE@UChAQ< z>cCO120ydmcPAnfXWMDn<#zYJc$Oh$i6~!Bg^Yh?Q$ae~-oyfQ)zHTR9PMe$29Cl9`Ake7>@O2>don`)YQngQuc`s7AxpWDtms=Vu>_|qTNymUukwchD8Jh+Z%+ca9gt9$D0AAkLz;f9wbkUFz z{zPfuQ@ltz1Jr9R>kr~Ope~?mON$4L)yOqhn*C1mC;wMB@Q5}g*(;Gb_ZK&mO$>CI$$#j=o)_6xmiIpH~Q6;Kyz9r>88l4byDJtJVk6&aZ z5si?8#k#S3ybV@%O2($OJ(F+x#RRvsJ!F)0wHHk>0rrA-!qq5#BQcEkoozV5X9d@I zbFGb#(l2c;Yy68Q{$MTONP*gd6l>PmDyL{St`2&I2PI7K=3+g>m4nvdL6TEk$)NB) z*!*6_+apa=I6YDDp~z+r(dqK@;g(#f;$^8=Q2e0&R;(1?4Jo}J zZwAWxe%zWrJv6Pm8u|;OO(O6%Ci>N?!Dl>P_W=|1fjj`v&=hD4@z<#R9@-5mAu^Z7 zp05I<^y~FcDm3-p0q26xOIo^diZAmTq3%ptJgb4u8c&W*6951)qc6Mj-ic-1Y9uSt zvI^Z{^iKpBO8@{6ER;cNBjWdxg9w20&IBo}U9^<~*q%?^Eu0g5{x(}4QD)Jd4V=^U z349iZK@TbX)yZ7U+#kuVqf=vvGr!PKa^%#NmB>GTjr8}>f2(%DF_WvX0Jx5CJ?MaP44sAFdidOTE8NIq z0uVg4Hvr&PN-GZoEqRcYl4U;;K)-;R004dgZyiX0a*VCsI=mhI+ee}CnlCG{-5&tJ zDX#BEa(HXTD3oC#RVHMSE(>Y@`cs#`HU9afb;~p8DzNV7K^pWNyS@;hn72MuLOG#! zij1}Y&=z_!r*JOHw^=BZSm`gzo(GK-0jz}n%28~InEMZHK>!L7&K2v^NpHu1C>aod zRNtDB0_Bw2{hzq?oHtJLXFt2zrEGVr{`_-vLK#(TkaXqDX`mecls6doue@)aM7rNP zPz&XZm?Vkn(7gTw!XLOb8Jit}7jMTwq>KO{%5SaTR6G1V+T-7(z4#^Vf2sSEw&yRj zx$wV7tMnJzT)N+)&1LvK+Dz78(*AdCbCv!St>f>}zW+^H_g~Wf6Kzxe6m8S*(YE|1 zZTl~2|B1Fse~R}0_h=vgH(J5B6N^qLbK{q^|6SW0{NJPfW0djz7Hy8e|3>?VCy@S< z_P=YJBmAdm4S$c;_yzoh*~ZM)xoj5h}h{Zq96@!S9L>hO=+{>N|sxbo)y z$8Ud*vfTgp?SK6CKYsg1HU6La_Aj3BpZYfU{|)smAyDo;)&DVze48`<*9TbtZQPOq z<^KDMThia2LJ|Vy@cjx^?=PtTMyLH#sD{5n{i~`u|Gu*JPoWn73iS_F|9u(4pF%zS z73v?V{`(B}_fUTZ2yerR?pLUPRrTMP9{ed($6ulT;Q;@>Qua@wHvJ0q4^{ttzWS$7 z|KqFwB=!7fiNWuw`ZM2ny9E6I(N`&dna%#~Y7HU#CehDW_D>1=FSFD)%3ox%f2WlD z3uP|+?@|7%-IP-3S6S@eDgUZvuF{{P{FfQ&8|5!D*uPW$p=HXSqWqV6=o{rPve&;; z{-Nd4pQ8Mi+2e_8TzLv|7CUP|L6RY<@F`{FE<1KYu@#@2^atX@iRAg3(@}X`z6Ec3#Z^ekp1oF ze*1#!@K?(JOMXculCPt5M0ok2P3^nmH#+7bih VHvf~G4?pj10ss?ItKCxF{||qSJ0t)A diff --git a/docs/0.0.1-source-brief.md b/docs/0.0.1-source-brief.md index 52655fe..d50b366 100644 --- a/docs/0.0.1-source-brief.md +++ b/docs/0.0.1-source-brief.md @@ -90,4 +90,3 @@ Stop for revision when all of these are true: - an anonymous browser receives Access before content; - Site A cannot read Site B data, files, or channels; - the repository README, infrastructure graph, client API, request router, and isolation test are understandable in seven minutes; -- a short raw demo video is committed to GitHub and linked from the README. diff --git a/docs/how-to/record-a-demo.md b/docs/how-to/record-a-demo.md deleted file mode 100644 index b4b9576..0000000 --- a/docs/how-to/record-a-demo.md +++ /dev/null @@ -1,32 +0,0 @@ -# Record the capability demo - -The checked-in demo is assembled from real screenshots captured through cmux while it drives the authenticated Up site. No browser credentials are imported, and no login screen is recorded. - -```sh -bun run video:record -``` - -The script: - -1. opens `lunch-vote.up.ax.cloudflare.dev` in a cmux browser surface; -2. records an authenticated vote; -3. stores a menu through `up.files`; -4. requests a summary through `up.ai`; -5. verifies the browser reported no errors; -6. encodes the timed frames with ffmpeg. - -Output: - -```text -demo/up-0.0.1.mp4 -``` - -Override the site or output when needed: - -```sh -UP_VIDEO_SITE_URL=https://another-site.up.example.com/ \ -UP_VIDEO_OUTPUT=demo/another.mp4 \ -bun run video:record -``` - -cmux’s WKWebView does not currently expose native screencast capture. The script therefore samples real browser frames rather than simulating the UI or using a second browser automation profile. diff --git a/package.json b/package.json index ba739b5..0b813cc 100644 --- a/package.json +++ b/package.json @@ -28,7 +28,6 @@ "access:provision": "bun run scripts/provision-access.ts", "test:production": "node scripts/production-e2e.mjs", "test:dynamic-production": "node scripts/dynamic-production-e2e.mjs", - "video:record": "bun run scripts/record-publish-video.ts", "deploy:docs": "bun run check && wrangler deploy -c wrangler.docs.jsonc", "deploy:app": "bun run check && wrangler deploy -c wrangler.production.jsonc", "deploy:up:safe": "bun run check && bun run release:access:check && wrangler deploy -c wrangler.up.jsonc" diff --git a/receipts/2026-06-19-quick-parity-review.md b/receipts/2026-06-19-quick-parity-review.md index 27cc974..3d18ad2 100644 --- a/receipts/2026-06-19-quick-parity-review.md +++ b/receipts/2026-06-19-quick-parity-review.md @@ -60,7 +60,3 @@ The live proof site was `https://lunch-vote.up.ax.cloudflare.dev`. An attempted OAuth consent screen requesting `access.write` was canceled before authorization. No OAuth credential was created and Access remained unchanged. The CLI now uses a short-lived Up-issued deploy token after browser authentication through `/app/cli-auth`. After the user required Temporary Deployments, the recurring loop was replaced and no further production deployment was allowed. Promotion of the review branch requires explicit approval. - -## Video - -`demo/up-0.0.1.mp4` is a 14-second H.264 proof assembled from real cmux browser frames. It shows identity, voting/database state, file storage, AI summary, and the authenticated site. cmux WKWebView native screencast is unsupported, so timed real frames are encoded with ffmpeg. diff --git a/scripts/record-publish-video.ts b/scripts/record-publish-video.ts deleted file mode 100644 index 09ad2b9..0000000 --- a/scripts/record-publish-video.ts +++ /dev/null @@ -1,82 +0,0 @@ -import { execFile } from 'node:child_process'; -import { mkdir, rm, writeFile } from 'node:fs/promises'; -import { resolve } from 'node:path'; -import { promisify } from 'node:util'; - -const exec = promisify(execFile); -const origin = process.env.UP_VIDEO_SITE_URL || 'https://lunch-vote.up.ax.cloudflare.dev/'; -const output = resolve(process.env.UP_VIDEO_OUTPUT || 'demo/up-0.0.1.mp4'); -const scenes = resolve('.tmp-up-video-scenes'); -await rm(scenes, { recursive: true, force: true }); -await mkdir(scenes, { recursive: true }); - -async function cmux(...args: string[]): Promise { - const result = await exec('cmux', ['browser', ...args]); - return result.stdout.trim(); -} - -const opened = await cmux('open', origin, '--focus', 'false'); -const surface = opened.match(/surface=(surface:\d+)/)?.[1]; -if (!surface) throw new Error(`Unable to open cmux browser: ${opened}`); -await new Promise((resolveWait) => setTimeout(resolveWait, 5_000)); -if ((await cmux(surface, 'get', 'url')) !== origin) - throw new Error('cmux browser did not reach the authenticated Up site'); - -async function shot(name: string): Promise { - const path = `${scenes}/${name}.png`; - await cmux(surface, 'screenshot', '--out', path); - return path; -} - -const images: string[] = []; -images.push(await shot('01-initial')); -await cmux(surface, 'click', '--selector', '[data-choice="Salad"]'); -await new Promise((resolveWait) => setTimeout(resolveWait, 1_500)); -images.push(await shot('02-voted')); -await cmux( - surface, - 'eval', - '--script', - `(async()=>{const response=await fetch('/_up/files/menus%2Fdemo-menu.txt',{method:'PUT',headers:{'content-type':'text/plain'},body:'Tacos, Pizza, Salad'});const saved=await response.json();const link=document.querySelector('#menu-link');link.href=saved.url;link.textContent='Open demo-menu.txt ↗';link.hidden=false;const item=document.createElement('li');item.textContent='Shared demo-menu.txt through up.files';document.querySelector('#activity').prepend(item);return JSON.stringify(saved)})()`, -); -await new Promise((resolveWait) => setTimeout(resolveWait, 900)); -images.push(await shot('03-file')); -await cmux(surface, 'click', '--selector', '#summarize'); -await new Promise((resolveWait) => setTimeout(resolveWait, 10_000)); -images.push(await shot('04-ai')); -const errors = await cmux(surface, 'errors', 'list'); -if (!errors.includes('No browser errors')) throw new Error(errors); - -const durations = [2.2, 2.5, 2.8, 3.5]; -const concat = images.flatMap((image, index) => [ - `file '${image.replaceAll("'", "'\\''")}'`, - `duration ${durations[index]}`, -]); -concat.push(`file '${images.at(-1)?.replaceAll("'", "'\\''")}'`); -const manifest = `${scenes}/frames.txt`; -await writeFile(manifest, `${concat.join('\n')}\n`); -await exec('ffmpeg', [ - '-hide_banner', - '-loglevel', - 'error', - '-y', - '-f', - 'concat', - '-safe', - '0', - '-i', - manifest, - '-vf', - 'scale=720:-2:flags=lanczos,fps=30,format=yuv420p', - '-c:v', - 'libx264', - '-preset', - 'slow', - '-crf', - '24', - '-movflags', - '+faststart', - output, -]); -await rm(scenes, { recursive: true, force: true }); -console.log(`Wrote ${output}`); From c114855a44ac34d3361be4db71199a71a4485146 Mon Sep 17 00:00:00 2001 From: Jordan Coeyman Date: Fri, 19 Jun 2026 13:54:28 -0400 Subject: [PATCH 5/7] Add linked demo showcase --- README.md | 8 +++-- public/demos/lunch-vote.jpg | Bin 0 -> 54248 bytes src/site.svelte | 58 ++++++++++++++++++++++++++++++++---- 3 files changed, 59 insertions(+), 7 deletions(-) create mode 100644 public/demos/lunch-vote.jpg diff --git a/README.md b/README.md index 2690fe4..a3d5bb1 100644 --- a/README.md +++ b/README.md @@ -72,9 +72,13 @@ Browser code receives no Cloudflare credentials or resource identifiers. | `up.ai` | Workers AI with a fixed model and limits | | `up.realtime` | site-and-channel Durable Object WebSockets | -## Complete example +## Showcase -[`examples/lunch-vote`](examples/lunch-vote) is plain HTML, CSS, and JavaScript. Two authenticated browsers can vote, see realtime updates, upload a menu, and ask Workers AI for a summary. It has no `_worker.js`, credentials, framework, or infrastructure configuration. +[![Lunch Vote running on Up](public/demos/lunch-vote.jpg)](https://lunch-vote.up.ax.cloudflare.dev) + +**[Lunch Vote ↗](https://lunch-vote.up.ax.cloudflare.dev)** is a live, employee-protected app using all five fixed APIs. Its [`three-file source`](examples/lunch-vote) is plain HTML, CSS, and JavaScript with no `_worker.js`, credentials, framework, or infrastructure configuration. + +The AX live demo requires a Cloudflare employee identity. Other installations keep their demos behind their own organization’s Access policy. ## Install for a company diff --git a/public/demos/lunch-vote.jpg b/public/demos/lunch-vote.jpg new file mode 100644 index 0000000000000000000000000000000000000000..b3ae3af8654ff334228b7abea0b81fb5e0a2c151 GIT binary patch literal 54248 zcmeFYXIN8P*DjoGZ^%Z7NYgDKNDweI4Rvp6(uE|15IrUZ)X62-&h~O=?UO>y%)Z=^3syhk0rqm9|BHC0cwCt7cN}9aPiVV%jL_L zuUxspI{xE_RjysT_CG5Bs9j^b&c?>ZI$mdIXTNcSg98Wz^6=a_Z3NV?9)ITSZ@;k` z`Jd(7g|ingoj=1m_dm-2JP!bz`R(laa~FOG{C4)t*)x|foxOVH{MmD7SrVQ(d+t03 z=Zy<@!O)9;amDt;8NDDF3wrhS!d^-POTC{6VdOudZAxTr$`-#;vz04@U-EgK@qsA( zjk`Yc-Yq+IjWrII7{8slz-r;#Z|D9Y5a2hCGvKo?Zrpu&?k^)R!SkHb^-s76pU@YK zg?frHC33P;r(Xdam(FCK`+WAd8-O!60B3IiP8on}EP2jwoaF$h0w(|H`Qv{H|L@wr zHSli@{96P6*1*3t@NW(L?=*0RO|F+W&m{*Xtl8W8z(dQq$wasbUI|*Ya`jZY0$K_L zp~g5{hM9|Ul9~`tOswXQ@%uH8KT6U+R@7D0(eRK)S4UbH0wGhuEjMHs8E{*QSUSBN zl25Hpf9xKzb7B+*g??}Z@)xgcd-yA+@TKqt*uUvIx#bvbsqU_?v2_aY-mdw`jcuJc zmhnSf?q(kuiD(m?;rZqsklQyLduRx(y>diL<6qUJhDUcawdEz|6hLSn)|N(uv5!#h zw^S8?>VA>wOn0R{54GOzZOc?8%!-Gb-p1yNeJ6)1XRp{$%cc@C$Z%Z=`6vM0CDW}uf_F~r6%@)GzL=#n#amm& z=cAaLgwO#A3PHIc?Oz9Tap{_abJF;92SG`Fq=#=-Q_a<|qLG0xQFf^|##*_fpYOg+ zMusFhsqa=yQot!-mt93gzH1K5d1$4{qkjsxy?l|J>??PNsAxnnkvg05iXt}cA743k zxM{Z-3|Z8fhv|(;Gm6HBXBuAS=5{KLxa$0>tkRw@a*apkhTO6Q|xfbFA$L)%BIG`>u~icNVS`a?@3p8}ei{nqJ@9#Zq*7-VVpoW1Ma0ZTEbC9%b9Osvk^`tWGD0l%{ST$A6O zzk^0kLg>+7N=s=Unz4PRFui8#V6cxrd#-K$u!ilN*n<*u^mt`J>~*ADdhp+m&(3WGv8<}G z8^t!3BR!GaoZ&bv86wF1q4JTBrRTNrZq%(*-;51f_`v~Ide^_fU>*i+LnR+nA+tHmDpvf5`|-hMqx!fNL3&SBeM3H=ra%>Q-Swzo{#roBM#OFu)_1c;p!=+n z=UDr-+y?=fu?{vxQEIElDEdSZx728N0z3Dmc1g1W2W7nj)0fLJ{OUBMP&rgWy%5X5 zqdXmWivxe8g2DqvEl#+WA7g$TZ_aN9btnlWO?2~@G)vQYn<*RV$sHDWXnH9B*b^ibt?XG$4oqeIABX5NR@7}p8_WDoJg?7Gb~wr3`i8g?0GEhc{@9eJ0&LYAg&?=>Fcb9`{kbyxTj`j z@B_c+{&MST=W)Xez+PyR(hcQdk6sdqi57jGaNfXntb6+opGQ*+Yu;rf;?40iy{#x4 z6_3o8jh&tHI_)(yBdOcb!w;pDQ`O%w))CyPgj6-$klDy>Vup`Lq@&Ua97D;D(^X%r zxs^L72ZF}@Y#vUGF~%EiZF_MTacotH=1<2+I54P@7ndjg zYp^MsP-?FwK8xYzLLpNKi1sO_vK05Wex0b_4w^ABJeC?zO!woRr_bLmO2CGq+K(;j zkE7Pdk82)DcRvuB1}83ZN-4G-%V3%r$IE{56+1JM$Pz}|K6h=ZLd`b@k@UT z2;7+O#f4$g_VekBoHVn1Y4*QBs6m-GHuc1hBSUbpGvIwm2GpbwVQD zF}Jcr!Li-E^?9rN?^zNqIS=$zsywzswHNm$^G^YB>9^>S%ojY{(H(2y-$<(t(rHEq z?%hdvK8Sn3<9X_#k%bYJ1MI(bL|r@uNIhyjestt2(-!oR57Lk|6^4O~4fW-OIndQB8Fts9V%+M?f9Obc^ zCh({x`j?=MpP$SaYs{uYiNO{rd_TgpO0?*Flec%2J6&jzhoF31@P#MRjM44~nD%SZ z?d&rjW;h?80{UbI6(#&vS6|>wZPWc{K5jHiCq~syD;RqJ|1UKEdo`KFMWN``Xdf`L zA6*<|PD)7_wi8k={L?U?AunXf{xR~#Kn?ZjM*K~Bd&Y=57%leYciFTf>WiVrRg4*5)Tq1 z{rtK+HY&iWn8}H5o+17UnZ%EkNx1;Pof{2YD?JZf36&X(SfkFS$K2;N^q`4{LKqJZ zzuT4_;BLMMW}DFc%3ha12@7lz3-VW_o7zLUqdN2riap;0ZjBmVHPLvQsgbaUi*k98 z@_BnVaJ0fhnuAZ#zYBBg1t;xj4jj`x#M~T5rH!{n31YfzJ@(X@s_%|f1>QHdISEDH zBWMm+~%vV!T^*tR16Ny13s3 zg?RUERI8m=7LXGu2p4>ZxNgBa7F>BZm03FD>c4wvVS)845&=ga_mL^PadoqZ)zwvZ zlhl0!__n(qXOHoKxTUg^jJW^JrwpcHHuQCiBgB2LR+Ru&tX9Ov@f!HsexM(|Ls%Ax zhT4e8SNO?K`$WkkMw|kSXZM1@t-OtM;2x5*iMWwz{!}*fn$o)wh}%>;XPBvNJSXsR zhx&{)Fk8%Y)iKN~9b(VZI4P^wjMxlhSVyBw`%y-`{dyc657pJ@)Ynw?!lP^iSp_7h zpsv*@S1R+NgH<{^y3LaIzlzB(`ILOI^BM)4 zB;>aQBj!~q^N+W7XfRLuB3*Y)Dqh-W5`!Z5hKmn;GO#*PHqYy2WG)zkiK;pv44?+fT;zzrFc~z|;SzBNBXN(HWWtKH&*t4=W zdVCHQ?HpcG>UXb%JI6JdMy7}!KRCW?x+EjP%fjyekf%_&apGw3!p4)h&IcY{1~ikZ z6^;G!_75C9|n%?U$O#ELMG}=rZyIE_S&bZJu^?DrL#@pQo!<|L2~)i^OBd+F_63Za~~?+(utP2e~(}#ruuirex_NXWDBI3 zTY+wDHkp{>{-Pn=%&Q!}aHY?qd=4Xp?<=Se7YdW_9sBmx7b4myjd;`YnF7*WRN1?P ze{JixfA&?;>@R1OZ>eJj&7|al!4fW<_y;QGcH+m^evmGt=hTG%QN)SEU%M-gqynCK5a?7Vf1oAD!p+6y> z<6n&+R!4i)*!!n|)+aDq&MS2FF8G6XMA5&>d|oD&3!^Jgban7)X5d<_JS3RnBDSe} zG{N3NKMY3;TzK}M8~#uKcym9j8hcpq`R8Q(jf+^Re8FFOT{cK+&o4!Nr(n>}1DgHB$zp^k}a z%DYrO79|L2XbR2RK#cN8q==Xcpe*G#N4+DbfIUm8vG+`ca-W2!J%p?Wf7JiYk_p_k zjpMOOeGt8>=MP4~p?AQWh@-*GjT^_EUoR?GC%ENnK@^n9Xj14Icl#q+f%W$ILDxy_ z{#|XBF@$|XmxeOjGBc=yY94mL%kmX!T+sySX-uC^6+-li$CwdB@MxEc1%KeIh9HO1`qb=WCjz5nP+?T45CPC^ovJUIW{)M+2= znzh-u{oMg~_Yo!KNTja~J?6me(b)IdkwME#J*!+3#yejQ@7Q>6Els4sPGYq2$Jb3r zwe|)OW&Hd>C93!3Z|*PYz)jlLuGsMLKvW z>dJhge(y9XXs}4hF4l^wy(5s=o#Ku`h^!%eF$&RuKiCu=K$tcN&oEtJ5EBC`s@%BJ{M<9lU za^Hc`e&uk*y8&-UaAiPaY0xk{7;c-OqZjctRs)~qr|6{taashshezbX-@srR8cjg3 z#=6E2XyWJpW(WSCZ~IN3Y0$S*OCP^AxD=ZdT@XWu%TN{BK~04!vExb)^21E+^voW3 zL@!PcQO)Z<>C;W5y-_&r1oMjwid>nr2zz#Z^7&H$QLthw!{(h)hwI5-l4jf~#4qht zr07yP)tVdvxS_3pfEeygYo)d?7Z#Q3k+X~P7P_rR@?DyaC7)p2&BbqOQa)b<+de_> z`*hJ5E7877E`I$_KTg0PEPNFe!*y(b|0u&UWQ5V)q@xIP%lA>z?M%?$%W7yL4WO~Q z^~D)zyQPAg5-}qY@;N0XNy&9vJB+F##5-w`5V5);qWPE-n_VZk_$KAG=Jl#!Y{e)R z>{JNv-|f|GMH~)8L3+Uyo1$K${R>rFkpjWA_Q*U^uV(HpT%W!g70~759!QaOkjO?D zw}G6O?2tU?r1iFs6BCQ9zrRHg#S=!be7*#M?9E2j48N2Y2=+W7RWIDDT*@)PTafdE z-SoDlC8g4xMFLOyix5SN(97TdEZe|1AEHohTub9dC7(d{2Ch|hoyZ{E9F@Exg?wp_ z5vNpWJ@WpYuFHEe)-`yfl-DfBy&aXtlVWQ!y;V2Hy{X7PDfbcmCbUv&&i78OxC--f zBKF~q{X%=6#+gPueim01Kk``{VJ7RnwKiZC(rhx}q~@XDemst($zw5m_}N(Vch&6T$;G(~_jf3U<&^C+ zFe3)Y@@m{oZIN*Et#t=fB1K~krpKL_t~n;2M3ji|I0bm#K&e-nnHJEo3rj%$h*`V? zNwLN`{}-RC@5p{EUmBYR-}ttS*=y@}+=4dr0B_O{M?uPHN1A|PDIdy)u|OPTWO*0p z*<}-@mxMM7P}?bodWc7D=-~6gmJ||i8)P;&?`6v#GujgaSIy>rXZ!>uOkGo7FGGO#m`3#ff)W2ut8J=6;zavtYDsu^C^MR zUL-%IdgsNNSPWE75v%#Zve7d~##6g1hT{_+qQC}7?4-$c^L&pX7d~4z;O|u>zTaZ2 zavli*hY#BNqk%zlZ_AL`r9*u~-xAvmm_h!Vs%iwv35lZm7iY8tveo-0W23=iB$+1B zFFWaM@}$ZE-I}0(c8`iN>LM)e>APQ=IPWV8$+6pz8j9CqEeT&%(G(E*8;MliAKpAj zYkNOY&DSo_=k%-Jq$Vf;JQ+Z#rDiD-X8)R@0xsOG zBsL+bPy_m*yaFZ3_W~X4W;<{TSD2HdabziLx@yb$8j*9tE!K^AiZd5+E0;W~?P=VV z9&m}z&c_LFqqEqoLF&yd+ZxBYazSDEob0^9r1wxY3H4sdYd8_eufRRILJhbm!EH_# zB`P)a#bQOiQ{~b@LC`+#^^o0jv;@+fdZa$$U8ISB( zS-HUtUHvSAwr){))>N|^(-9SVXsRmwwv+a!_+&(btVfvXSYZ%at^>=TDuF?U&sqz9 zQi}ADwoLoWGqb8s3!z~Ige&Do-iv6ND@u6@O(Va`Rp77qtcWoy_7hQs&Q=&~>9ire zT&RAInyJ0bDLv4iqNH3=?MQEReT6dmxplZ2*V>m74RJnU50A6MTUv6hvoNHAP4l0C zD~~`amh!E`URfcyrNx`+X-DgVk6@)Ds&ATqM6Y280k8jw4~SHyY}eJ+FVFMS2H+75 zT2G^6O+w)CR(>mbHR3(fv1Q+CQ5ciHOGD1n;9VG^7Xs4$1&(+N)0B~X)A58azV!Gj zj6D8*`Muo7S5!GEY(m>?bd>szU{TrNA*2{_Odc$+64m8GWp932!Ck2C=?Kga|2&yp znXeR`6poM)l=%Dy^JFP?i*Jul7jbnzw^_l1pZu?DL=4lOcxulOaPWI?2eI z%b88d37_sK>|7;plM=U<&eW_(GkC$cI_^6-K8X;ri`DjSIWOmI>9d6l* z`;lHsgw1oH!m~SisvM@8fP4ClneAV#ut4+=NKFju?$DFB;X2%q4c?@uDE3UfU)0ZvB>&H1R&{ zSZ(9j%U;1ZdZQ>SS|Amw+`}l`2JT7nY<>~Tuokz-(S|GMHT)UZQoebwe7t@8m&s54 zV!j_mB>3i>V92Yt7aHC4^%Y{?n~ov`ysKyrJjYhBllnqcKE`bnX;YBB<`` zF112YaoR(v43m`@fVM|*v)kcn)t>5dy;tsOqtk_e=5xv<7GL@ek0JoMTe3DJYFd5S z-Z{JR>Ff8p`FQmgKV(haW;XC69vfeFn?vaNIXFbVDWr0FJP2{syDQ9TC@|z)0eui> zvIfEbfLXhEK=hymO;wh(g=J9Ho2;C?JQH&4B|D;d3bB1OSy z606)OHBBz~Avy6ZoU@GevsMo26f)cWX38nRnGCskw4Hs}Te_-lAX`v|w0EW>^v@=K zR@;6IWdNL)(ybO2=acUggDi>SGXuRDdfpHVJP&e@S7rX>uElQuDZs}InQD@5SFzf? zF`ye-{oQ=jDevV#T$Y$P$rcTU1AWAeW#K>8WlsU3*69|iyN9YijRvy$z3`5f!JA!H zb&$N!DWlNjeEu&Xm}jSeZyBcmIb#RjTTWwC=>hU@PqdKBqI2=AK;pN>klA-1pVvT5 zAu7}{5@H=z?h*ie3|wtfw{ttrr5WX~K)Ol{&5+LLoJW@2RE9>%HIqbX{Z5D(q9HFT z-QK`y#=wJH@j`AyTgBmuZ!a>pa_DJMvZK4ZN|sS>f0*o?EhpN4jk3*gbCE;6Q^=&h zGPLpvkzhP&|F(FBHb7*@3@E|hXYx)uRABWV8VV9S;^!+)0hL#>2sfr2UiNHO;r&?1 zM6)9X^(8rFMNU>;m#Pj~8+E_Y5C$pkg{deh8LdQ{=Pw%v0A1#ENz2t{PK;5wzJ5uj zjGnac=P$B`XX78a$E$GBlUgGYNd}f9oqrdOM8=6bBWGb+8cHBibTW4idzkvM7=DMw z@oXMOi?n12Ix|&&R&S>ri_Ro)gZ4;8Y5KqU&PHxd3@o#dpX7Qg_xu;~2=v5q&i+$; zG#x5nsd?R|3FWp!lb0L?)^8b`G#`Y0-JuKFwhs=8Tao6fx#0Sb0}Rujt*E-WW=|0L zNSb{L8N&0OIY%fXB}#9hp>y#~&4Q#1?`NUMFEdX8YOHpuBgc8~PZ)?hN?Y1~9(6OU z;F6Pj)~7<~-{z5u*pSz#w?#3I^-+F`K)r`YoCx$;uXdW{%2IW14(?O_^up}|zhi0s zIWaSe$Vg=Hne%Me@*1+St6NX`kOi|aF0;h37Ba#s1Gdb@;cXN6`C@v*qL>#JcbW&S zT#Oh=y=m7_$K%q%5)BIuDgz)eRWm9ntE-U3EG)C#IS?>B9g2#8%K3k-^{ zP;ktv@Zv!zU7BU1X8Fnvpd6-&;!V=tC#_k{#lCWVvD9U24|4J~C84;>Nn3$S=yY5= zLenr$KH>ODDJOZSUwZn8AmE8}-SIL`JN= zvMEKg0QCx#voiM*J1(BO3nHhJ=0R&Dnit$Ui=vU6B>B1oJ#v0yQOzx^)p$f4B=nY_ zYDAJTKj?lsBiwWVJ&3i!Qj>p0)M;?YfuMY{xkRcgw*-hn4(XhG1c$gN!iBO_pW zd$(Mk_6uV=m_h48XPWmL0O6J`5nUwAqR9@!zdgyvuKn2Mir@W(GA zf?*zKQ*q>uC+jgN1LK+%Ziy6SXTsVuEr|(-Y1|%?V4RUFk4XNpXOcOH?0!RW!fX+&0etD>Khhdl~2Of_Mq79EFrVJ1P;78(vO>3f>w!(qGFSiN?fGd(HRIyjnUpI*Yt z;F&apo~3FDaR>TmpMh~JXm96@QLP^fq1Pj9(l9!*&Q3OEN+Lp)3l5-VpBmppvL&l8| z%p7c26Uw0WbbDhE*X9*7p+!W}oC-p8n>TVAvm{6};sCpN%BdQSn@KP8fZUf#wP-UP)qx=p$j zCjo5m#>aq6&iV982bZ6b`%1Wf-vMjdEE<{0R98#hhm8hCXIFQs8A=}~sDbEQZet^J zF$2MB$5IwtF#;{)i(j6s|3kA8LCit=lieoQtUMZxlotnSH8iL-p>+mP4ELR5BD%wI zOm%fQ9Hy?W2Z#G}a6BUA6JCvW#Q(#ftNv-w7C-h~Zr6HaIJdY0LkxDlk+{;ufq}(F z{Ns8k{#ok_%AKKUmuKDRZL}ol+VBo5YYjjPPq+#a4*Hdq-_*K{cgT?P4@)lmL@w`F zNiIouF`Gf&;p)KLp8Pa6aU~@ou}gzRQ5BCwQ;Xfab$+@TKPY5*jtT2N;C+*O)@F5O zo%$Q8A3ZAJ4APIn%%rXDhst;O3oKV)$5$f1&QX~9ZJ5MFZ>0XGzLbDAVZN*PuHO4Q zz9L83QIIZU+Y?)$#|^c_E1UxUBKz)C&9t#)I!JzyKS)mEV{?^@$_~@EVAH*G2EzSB zQAd@{RpSTX&^Sqk2H(j7ggtT*s@3_=a zUay&?FIHK1(F|x|$*X&|WUgCN5;U)cqY!H=%kXB)ClyK6(L9 zgagfIS#iz(NGx!Jxa2Pl_hcaA*jRZWf02LoVQ0v?b1@0B{YMg0u5Pacl0QFtCM}HD z{7Ua%)i=y1&h&PZOWn1jLE7VSeL(<@gE>Ke)h>jM%k>+`eB8)^lX5bx|QF4cC09PfLhACTu=G`7ULs(Q&A z-dib0=EN?{7zI5&52CfRLN?+DhD~G72(^$iWz1)ml11(Z5hE-HuaRx=NSP8C5IHY8 z7*i~7+@n+2C)g*vabohx1Yx^8kURXwq4g)IsW>xPzN>HNcCTfgQI#1GiH}gF5ivpy zEzxK}?A3WGd3-!y8ae0hS{&*N>G&w4>*KE}rZNm+->X%?{;1-Y$WQ+1!tKW~34 zOnA{z()6a_z!UX8%XOu55H(Q#gB2Ykn_VL_ZItCI4muEmhnnUfGkk%2h_$qBKeAFrG3-q&duc~{2# zAH-&KQ%icYF|tbIp!Q}LBcSB|G$C(c(>#2>tI)E`#3tH7k>F*;e>GR|X+-h+eH03a zZ4?#TN~M}S9P@V7`|Gu443lo>EM}9-xboQS>TH_WPYXVyLPEDo6=Wd4+L}}tcye>u zFMidWz-ZlP(#F*LvD${&tY@~x&d8E@#^TBc*U2pAY3zK0H4w$kAz8-%IycBG{@70H!UzQJwFkV~8LV8D@ z1N7P8%uTw>oMsAPSzW&+IfbUg8PF84>D9X%vjS15f>a$k7r^+8ob$^E>>>ATm`_RL z&pIOZXtq}Ns7lW%JtKp^x>N88HKER3B54A0n2_$Pi#hQ;oEMvfW&%U{_zSIj!<4+{ z0rHM_cm2MvsO7=iiC)5m;9yY4H{Z<-ze#^=LRJ7dK!5BYY~}z2e91$6&FR+ z^8M<*l}m_47gFxxpRK)`&6M~NOMKaK^fg$&r)H@Tr%GX`MtZ=*?bP|Af@t_bfre%V z=H?j@H(YoQD=H_I;P;nXx%qIVH*L~LDqg`(-Np9c7kxpzrdHYH6yWM`#OKzZeyb`& zFVyEseWg=sRB|epus6&6WwcSnCF|n0=0EYda;tqLkO|GaStgB^=%CmHRJ!i3o$c~G zwk15ZWmizNCxXWiUUW;1is4x-Etu%TmCns%|GL9K`*>qKLXf^Lu^FSlgA2_>SZ@h$ zf{cO8Uy^gQJ;w1oRhK{f;!7|2VR|2_-1U7JG&;2K5+ zogwlzWA6j~#?z~o$1UI1aY;DPc*OJRP~Bz#;!yb8R-p%{MsyimvST z!)GRa3NRCc*$666EN$@tTJZv;4c|LQTGCUx9yBF%KgGQGL-mUoyTX3DyryCr3Gb3i z1#759-)FhFwp1g;ps`}}l?dBox*&g=CI4v7VvDQ~b=yaF$ibMETB<9cs^0&ex;hY# zivs{=z*AfmnnQ{}S^px-{8>)1Jng;Nao? z$YjFekp`j5G?r+VIHWlz?&BbNE3@XRd?Py2Wz4t|HM(;u1Ox8(>SVy{<6RByJK_;h<)=f)f#Vb55&cugb$JWE%V~DjTgnO@ke6W5C{7>N+mo`YrF9c4Z+<`KCswHAX`~ z&jaTm?UX)%njz%vD3iYp$qi>@>>GYQOQh+K`1?YgMRKy;lXb#J;CfyB}+_b-lU6mG5Gx%q00BCQbG9|a z<03UsEbm~f^S-BftLe*K4*vZCZghcDAqxBhO#RC5$jD-Q?iO6RbA z`Act@Dsl0oWL2x)2y`dwQHn|xm4Ybo!i6Cn7A#j5c?>CPcxywqKvwtU7kJpG#Cf(72a?o~?jetsa*MBLCNhHX6V_Md@xAksmKvlClKiId z=jMWt+X(Ptzj$gg#G(uo@%5+W2=~ZNQ2X)yH_SzvQ$cWv9PIbI|CmiJHU|@a>2%Ys zYt$(_hinxb5|W(kGrju%$s`pYq>8Ov{+9mzY$PRg8dw)>xQn>@aqq3iB=mTIZq$LT zNec;ZW#xe{9}itOs8cEr{k0SFGb&9u?Ot&KM}b7@ztTdGe@PbTkbT%gbFn9zoOu&n zU$LtN-S8;h*?~ZF`uem*_}6>;s7B;jv)e;hbAM#Um(aMwOI;qt9Fqndcfm(lbhAU) z;kg=F99hhpb%m`dgYo969Buo&)u}DX`L7XZn%^29AE7eo zX45mWXR|gbeOdWl5;Qd7+!J)NfjRk>yMk2Vwh`|noR#mT-xBd7JmuwUO%n6<3o%KS zOJ3$#0$LK8gFSGH)=9QISlUvrw~OXBSA1)Zi^R{^TMF6@E)7qF7Y0kHS;kzr%1Q8I zbkevzA2yu_WQ5+9Qri%Hf~5n0u2KBXXIQxVE=v=?;AV#Q(~3r0c*&F zck+db7Q$I@z$WMXd;*{06Ndj!^D!Q;tmvg$>H59gQ^5Bqg>POxoivwq+WpGov~u5U zcs*4zmN0?b8{kcwen=Wc3Ah(!7P$N<8+h1>3-uF(gtBPfsgKd;=c2D@!5Nf9;jom42bhQ%R4M^oLw@@ zuXR7akz$(=DI{iLOL?1Y#&1}mc26G(Wg;iLdDH zhi({Bxq#rcb60nEdT~c{$ZQG7Fg^H?6W5@jWACvclsY8!*wq#Eea~YBF^AUWxac?aX zW)Gdp-?7OUCJqa{yD^p+619)4Z5SHWbs2_;=KihTJE!&M$mf}R#Cr*M_HkL=X5n@| ztwy~f+9whK5(SO`kyxeZ3h5Wz8kE0hN+_oBkKin}H_WRBrFBrQZbYFtof4gQq^ze~ zR$LBOjvfPzz;dH@SQYZvSTMJ^*CvSbLvKnHm@z^)aQ*qHY`S2-auG}4NoB1B;}~kS zsv6ZdFeO;inAU;GXTsg{Kpd*vLfk1K^Zr!$bgL>zop zWM6zFU=dc(u4$k7@uiLC)a)Y%G0+^jb`Tt6Zg%5}d~2?*gGpvq8b|2m@Vr4Oc~FhW z->yYA&xgL`{}`ficHj&!i#p9WR$Q9{U4M!?H<|qlV0%quOUYvBr;Bpl>B1x1g1=c#7-K#jYRGd zo*-2g?Yt{2uc7{hN;kiH&B#Qbmn=*n`atDczYUuXXb_G3T;Q7iHjq7O@VA6@Q(83$d9L#O?tu{)s*-9^dK{ z1MD4rjf`LhD;kCRu;c#>tzSI_glg=bk?HR=P0Syoo%m|8c%R(k#fy@mX@pZi1FO#i z)jYp9s7dHiQTKj4tGV)wFm!m6e3Vf9>lARr@SuI#FAh!KQQiATYSX+zt3rF0lV*(f zEdYQG(YAYEPEncP7mG}SQ^5{~&nAoX4VWg>;sfc{R|jJf?pqUiE)yp9-qmh?{gsQ} z*9?U$&T{--U^9S^Xful^*{06Zx-rBqG>O&)M?es7k>oG%fC23tKD3q8&7XlZb4FFm zADFnee8SNvqH;7`Hl7`2yRZ7i?L%d+=6fS5!=91`yz3EZYgj0L3b1E|^N82;Gct0@ zdmFU1IseFg8NqJ^euy%kJgHf#0af?6CSzPR3a6ICni%EM(asCWCHf*)jSwIa?^T0q zo@0ZeKbpr|yK%oBICPBiaOnTHo%8?d#`7o-7KguFI6>ee8Q>N(41yS;%~Z~|6@`%4 zmOQ+MmdO3Qy!`1%+Oy$-s5IVb+W`jFd_<~3F)-({zL^Z)zOv53fD*1rPwAbpEau+% zfw?BEF2cv5PxI#5Imir~ESPS$C~SgMB)nZ5a* ztfj{QCGY-&xaQW`bc9jDjumcbsEKCDC|@#Bs1o4d4Ij+86doR)dMV;-#IovBF1aBI zlbAAJ1D*H^9*F@CnBXRphR!}_*ODS+Pyh0;XN+3>B`8=0(MC6!DKMs<`KxY13f z$Nwa#>Hn`hpi8V266=m-)gY7Lwi};!UaUX@rMG(iEEdY%=RE3o{fp6E^~bE?rZjsU zN@d}VeSSQdt|q{D?S?FB)jU*ssrE4IFprtLDM|iSWmrYT=O~m)uz1>s5B?mnV1IHL zR=?8tz=gKrCfljL{*o-UC8w+P2P>;q;BUNU=J3Ar@J`X$gZVB-=p1KuDhg^DHB`W6d8_ZuTPWB_MYiKXNtg{x_7 z0(LRExIp(fPT{`TUE#tQW63M|LdZ&t?2tUU&_1>*eM$|~05v%Fs=EfQH=kqCc6vsg zR$NeNsFyC8rM5${lh@9tfYNtU_f7Ctg*U$TSA92u!UP4Coy}XP(3`Zp`R1LB19ALq z5QetzA(Z_jAYpP=r7iStM(FbNp1y6_QMHzw?1!Bz+B5N*4MJ=#9(#Rln3m-W@L_*(rbY-TK5yzMX(l{o)Qt`mbek4mPn!uaTnHGT?na2_&I zno637j1F|co8X8vxL>|%0=MSYk9Vew1$m(O3!f5!^u=hnw=##*xB^IUdZG7`_`2o{ zp1-+xR@6Q#wj|TZAx7_E@m4=B|47@eUW8ElbY#hPnz;tqo-Ua0J@9k@uaG?MOee6{ zxrD5)`?Hph%HTujt{?H7Fjgr&#NRZ8wLSF|kT<)z`K@91$og3CpRhKcx9U58Q#A18 z$9*KDS^_P&5X9LB37~>k2>Dx?sdax9?>`-JbaUwHH~!XdUI_#_E0r`yMwzl^%qEPg z#hEodeI2xGQ^SYuq2eA|2Np?}gHup(7v)+i#gUO;SQ_~B{m;eQ2CjS(!6Uksuz0N9 zX88kLgm6wo?}IgnDU;yYgq&3mIbOo68Munx2Oe@5i6EU3YR~dYdm#)jw8-TLQj;0# z`t3CH*|C~7^^Qi8%@9yKB3Co??hf?$Lf z)qi&@2vogiNimz4BrT4mQ`n|ZeANO=B>T1*UJ$2@ThC6YNUBMj&w`3fyv1#*CN-HA z7C;$+;cz4e2V?+&zI!KuTf_UuyBEXGz9H#iX*PI9OZt{}{P_Cx;!Ba1_!J_5AGedS zw>p3ITkz#JKJ)TlB^9?!uC%|!k$_Y9z$zY|mHJ*#u;?GohUYdphaxkoJTcxY4TR&! zDiJ$atP#1-SS9RJr%guA{X*MKo4%<}99-GU+z&qZw!0})4q5xr4@`ugnf%$&@xtbL zv;OV-$9jfv{xL6gy=U{CpwtlV_G?ieEAW42+1@_X7`TTPBtI{V;34lAI~A+%&=Lcl zQHM50N@PEi7iYGtHSahf)+Tb;z%u_bGmcpEeICS6i1dMN5sj*N7H7SU zn^$itN50B^R}4je5;^osKK7x|ItEL0TE}G)yGb2>LL32GtUZ78QxEXrJmn5QnFi&7EDp>(+J6g{uCltE*CH&&}HPKmR0T@78oR?Q;q{GQ7&nP(pDi>85&z zO|Zh9IeCdXhd!5mi3$s-j^5HGW)7y356YRkux@4NyCX$t(?dO|YAwwIQTTt@<>e;F zJO7dXNJG}p8?CwZkJL!ksH<7X4i~uGVmYDkB`tl7qPKJOI1SO*ZNGkS1d0I9wqT%*s9D4&+EDB~oWH1f7R9(_SBcwTM4w zwmcA_ayil_om-PK-@EIK7Nu6E4zw(!+s}WnX!Ox(0R=aXZ};?7t&oLCcu;*5*=Y(!y4|v?OfW(k?VLOZ$6j1 z0T)6jO)ytJOHKMDzs=nOSNu-?_S>ByiP#lu_XGiNqO=C?gwy;Ni{2S@xPG8}_e^K& zJy&lSc$L5srsNo&TbyRX?CLw?b1glB+ z6w*x;pMM_=vHF>xp9Jh05^ybW5q?11aT<$YO7q0GUq`KIy4{OeSFeA?m7E&v)%E8 zH4m;rc`=00Ad!2vH37PMlbG+jnW4xpM#@KOAU(EsUYs|Bl zd`a3*sp)L@qc=XyZUIA!$J#dJZw6GmSdj@A9eJ%~e5=g`rki&^+)y`)X8y7y{XnZz&tEEMzB9N%qXY9o%|8!)^< zTJ|91hS^a{w5lL|^l@{|d~*QAY{4qF&6)1B8$fpPX9e$c40?z6Hv2Ks9X;khD$hu7k-tWg-7Otp25^iuhmj*nHA?{wSle|8NYeeLcKP&a9Ew-A{* zAzJrk5ckX9E{E{_2J5V{BUA}rKy8ae23>fz25|3T0%?v%7I$@FP$O!mWWtA1s8wIPaF z3}hs1YD`ycYBaKpMpIRy>{*8whvEb6Hq<>mBy*l#vXX>*Chh!oDyO*$)PMKOa8^<% zxr$m` zkF1{wuTm~x<5A`_JZPKqzztKXTC$1H5SqSkNSYkqz~aaBhhP6qNCi?m;YQRr3dDQUH(mg(q07s zh?i(;PU4Vn3+S2cLxBYH9zDJ!vh!hO`o+~XWy8x&6%``mIb)~T9;0ZN;RI(d0&e-X zWGB7&o`@<0l7fC7bG>FsdX=RLT&zw+!)^_eZQD9$#yl@@Nh=X+FNZxOD(=?5;EWCN zy87#@q66eBf1}Q}-v(hT{@ZoaT6%HOu!y21k$zk0lr-t#>Iu3FwTbxXBjE5dbdN8~ zRF%17U7Q!f%SqoA;pH|E#FCN0i8Vpjd?ngM0{jC%xg!~7zIwdB82PC>t_?0pFw}b^vd+R9Wk~cY4a+mXKUs!Lxdt{PR zpohTOo6hdO$_rjiY8%n6TY0g8kXB^&RkeypT+Z_|^mDuQTjT2ksf8V;ax9^s+CuPE zt}n;RoVASc?EzCXBIebzsZHo!Dyznu=#CLl6L*!pODUO%6~s^+R!)&yT*zr51!M~g zv+lKX7Y1(MZPg*U@hunR?O|>; z@xL58a;>Q3rI0-gP2@OkXv<*}K`;kN2!*-FHg8h) z*847qq-Fj?))P^kwJFr`2py-Q$+dnds&LfCLULbURg%1=Z%Wka#u3CUJ3!5-YVb$u zI@A{uAWA^_W;#Mp^IBSlt3k^0<+33Vchs`RSjL&+1hnpGY!b&*zKZ4FxXHKI_81qUgl1PK6D(KMFi7R?)V(!H=@@nhABxwyzKk0_TH@p0xfJGzBJ z-~4K{uqk3LdyJ|5wpDZ6_EL-$1g2GtfSN!J4(vnC565q_jd^KIkH|9}E4-2yPm6}# zwR0VM+KrTR853l`UPlTsYoTwTLpy!1tNs3e=f(Mt{NF{&d|z!1Qcfzam~eBmFUmvH zwU6vTuJF^3ZX`SVa$;I+6CV%Lq0Q~S3!O^%cK-G$+*gKQYritg6HfX@mi6P)d^PpP zmlHBG@g?rZJHrEp`YyovdE3?N++#Pdm;;5Q`b-`XZ`qDy35YNpwJ%zCEL2BZFTz)j&_Vb4DH zx2;w>rulrj?1HzB zB9Su=&G3WPA~Ldcu@uI-3mq8hrpS_YTt9@C0^|%=W9<|>quH4vboBN}w5ZW`(D3qzx zRM!Y#R#9V5%5c2X=Y}mxRIxUOaS8h?k7QPD`dWW+x9;8Fk`Qhl-~@UgH~WxairfXh zqCEfJbl?Ew?ofi?SB9V;?QgSR=Izz^sPv4+sX@)LGyOmn13W;M>IKasy(u4chKv#7 zzir5aiVu6-8Z4M2@>Um?R_2wIHGAg-v~}-TnCu;MxE2I|W$15F2FVLwpsFawk&Qg# zLdN(sHd8t6aSisKd6SC;ZrD{Sq|aKRg4M)G=Vdv`Up!>{>fDBwC1J6gvV#OqrDezg zu@I9oa-VN-^OgsWP|D>99pJ7gH+l|qA!a}ajlQ)%zo2x)lHW{cE)VODuM9%Jxv!T@ zZf>DUXWv+WNCHX5Ut840RwC)SSNG%`)ml6_BK-kMbtxXoQ(u<6@Ql9m)_;UVD9D=jE{VuFB~@pW(g>e5?{%@ z26v$6(D`7jvzG4&w88FJ8SQUZSh}X+hwXSX7L=%p)e59!ij35y!pybV(LC4*ld>U6 zD-5c2N)U*+Gt|-3*EuX@5I{cuvTK!}`)CpbYJaUYe5f-b>~@SbulkY+^?Q-S(`Q1_ zeo*n_R0(|*q~@C$q(M!oSop$RXLJ=Au2VbuVR3p0RsOf$+r+_g*3l;Mg z6>He(NT*moPo+8evsGQG-bIfvH%^WHy4~_Jqv0AwGyN1fMP~1r$c)-r#|s@szn*Gs zXdj+k{>s2>wi(x;1P^V(0!&HkXJvOoL>wavI9-?G(C9=l^OXhrl0d>fy&{NSjO8Hb zZ!f4tSr+9<0ec{;tI_MPss+6**czeHwtdy2KE%RB1FM_Cs;8K)m+l9SW9sHv&*8Va3-Dvkb4BE;OUuyS$PFKzp)L@+Js*Oz26@F~HK1iuT( z)uN~n3XL*_?ecq=S=?N*EZ5mH$nX1l?zk6|qAS`*X<~Ti^k=&`9L%no&Ksiusf!I~ z?}f0(?%qX0{%x6EOLuo64AV*)Rgm{&O;??CS<$At+!I^^lntaHcEN@f+H%EvY$z6e zgCyT6Ep!cz5Uz1Qve(Urg&EetIL3smH&fEP9)o-5{5%`k0&_B+K#pI@r#;JWgwU*jSk`zxn(Sq34bxguTzpz*j%SGh*9eITMdujDAs||ks2mSL) z-vo+TQjA0jZ!)F7hx=7#Uv<#vKG9~(Ik?VppUfC%4=aM&YEZaU|El&gsD`68?{-S( zRqKbmi3LPcXkPMQQV*A!sj$7jR-3$OISe|t7ndN-x$=jBztz7zyOd?Y3{|k*SY>@_ zmZc?OoO&}9(z=rG?vta*XE*7^_IuH8zi7{b*M{ zl#nCwTJa$ye7SY&tsNbsmOaQpPB^V2#x14dX<{Azwd&gYY@Y%HzrpvE0fEYvk0SGF z^$HZQic!9j7Ffy!Z-rXO$47ULG%E9CV8|#fLKx#f`Q&iJ8i;)2pn00~O&Xv@i$?Tg z)BOSt$5V@En+$J{oTiX3EJDf@ST1}0MP6j@t0#z~-Ae{He%$4PHcm0eyAcXbo)UfB zC2hi1zcQRLVtIM-Mg7&Z76aMj}wf@g;<%p)qoHuYlM2byE5 z3(#cTlaBdVmtyC=@qwbtsn_WGyDHyx88Q31J7%_|j{URIped*eMIqD!24SD@-_%T- z+(uTNb#_kFm^F0W``B8AFnHoj(*miGq4!EJS1c?Wp#@7+=otdJq;bu7eKx)>cTep# z=yWDPW6$qPYq!sG05^IPzPSBIt2!W50$dcN*Xk%Pv$I=(=5XyRd~B3C>U}@#cdnm2 z6*;TGgIyM7eY>5yJj=V+2|~N0TLXOg8Y!~JJnWXj>#Q@2t+t{D^V@}-P&&tZnnHgw zeX{^(D}@-ev^AZz>EFM;bsbit6HV;Gw?%ZwFw+Boj!qj!jVkyN~(B_VCIg(>fw(FhH?JDRpXKKLB8 z5mk}iB`MTPj|Si$=OkS+lhV*=fjk1Ur&V&Z7&x?0+SxPX$GOkM#nq3QT?2XdxErOM z53-PTSs7A$5&9e5E^emMbqoqA{2_mHW;CF{irMFVcc@<_|H?PpL9{lm^-G0RbSZE> zAk1WTpJ;YA-5buv9GKdK9Exqz`ki5E+9XJ+)=C3~I-M+f?EXHa{Vd9cII{L979bIeN4RXd0R#*-ZUh1SHQ>fJ zB|DnUgFSVI*hDNNBh`ck3N;{PI^ghwlbIai^Ls;KrrYyxYTHe$GmcTzm7&57s;}Qi zi`X`PVFf#x5k0fd+5aQ6JuMD)(+7i8!#_#G|{A{g`{nOio=G)Sl!r`FfRqpV$at+lme3!fsd zNYeVyYuyMqwxdz5hsffYtWD%#h86~HdBLEd$ym+)tf@t% z=G18N2n{brqTJpcDb*x}^qT^CcJ0ldjRd0xje!ZVodpEYz<{&pA1#wZZW|G=sNhL_ zA|WNfka2!3XBOS`geNAF0?FikbjQDb9#OubKe;M8{BZOXttn^s>$185uBefhO9^Dd z=di;9)T>HwvssHShc-JFIwpEhUUy_0vxWHj=?tsu_k)u3X3?o@l@Cv8Qr>78#&9>KcRjTHzdM&<41=Uny)%4d0Ak%k!T`Hx9f+-#* zdY@I-{-FD%dSS3ed5((npFE#V$WOhH8GLu3@6*ru^y43>h3J5&F~TDFOuEd4qw_MP&TX^Q$$?4GJ}h58?rlm6=+rw%wXC)$Or%-XJywX0<k7ZJJ*0& zyXl@`O1H?_R+R$CYJ~Tc=!==_E#PpBOaUpJ`Y@u)izGNB&;JGP#jeEplKS3{CMH~% z-;-sI-3wFkYy_|1qX6|xaBq_mmSD#uH_xtyg8Ekp%15XO7$Hm3c11uS*id{LxJ^x4 zyPj=f-03lcu)1Gq`JjMkiFfc&o&sqY`{w5bOWl@!Jkkh*-)j(zNaB_uL?2rP9J4$Y zdCdO<$7Bb8m(<1!!i}V3pY`l=`IQ1k6d6UFOJrkLa!Yfw~i- zg?TLNaB-)YB^7jKVbs}@9#;1_oz3SZarTx&TE(-Q8dEjDceFmJIy&@{HLh@8+wi$! zsIye41PJX~aDrbKgAy$P3ay&%t4kGs}~>XQ&s#;l?-ZMa4y} zR|oq?j5D}S-05b@_8dLDW4|C>pw!ZJd-#hW+0yWycYjs=#?DMprMbsmzpj4{L9>&j zgW>;aVB5*`!!uM(ouds8_~CD#S3P%SG3A3YT~7>66~Th=MW|7rtEN`r<Edzk!^G~#3IrjDoS`*Vknpj|au8jrv*>Qn_$8OQ>#>-iSPF046~&!A|oyN8Wg#aq$-T zy=AIH+7Rk&p;d6*mTBeMB7wTP$xBB_l2X{bofv*G%X4+9Z83qlYitv0?Sgm6Md>E+ zTAr|ugW-wFXRLcY#pup2M&cv##*R*T#?=Fix86b8i1K^gTTXjB-ki4ERC<`XU^1dy zdq1o~(y=#j`p{)n==~}_kprTi3Xgd+)m{~1=3_k}0+QmE?GAISZrxD%BAAA%dT58! zwDK8{F4WIkB&&Pbtd&<}NW`K_^Et%_SfkN?@dGq*%b3WJhsNif1)_3Y_v7@UO7+r~ z-2`-*c}Rt`ns(B1KM%IBJifvr$eHr)V@p}GR#E(7f`0iesK-r14gcbl$u6znTx-D` zL`er}4F1mO?4CdW^>(peCTe2Du&opqW(Rv_**tQWS-}M=a1Qzr;`VWXlyoe(zC;Iy z)`(C%)EqnNmM6W$TE=7|r1e8wMAJ&;vUDul?w3-y3qt~D*V$R8gKMr1@1kE?OHKu4 zvLHS8A708S=~w8wy|>%#v@`thp7-bdlhL)9lo4+nnSdMg-f!- zOsiE(Uynd#vbYAjgK6<_q}CXFV|)mhP(LY;VImwkrmU)E+;MyP1mkxgSr}aX3Y9iH zyg3jlGTa#Y^J1C}$QL3*c1d3JXJ@`hX>#?D!_S;`ggn3`eRj%ZF0~F}d-JT-v0-cqLZ|uZ={rvkeA&SJMr%nuZ6+;6 zrL^^qTX1#*bGJ$S+#}QK(h9?JEyx{B+2`*;t~o_82ho_lOfC>RC(z8-Tc8;DqRbCR zwhgYt0tV!J)->w}!Yii7_i}LVME()GoKh|OH)Q(+_Ol;n#Vd}ihcXP=!XO@gabdUT zv5dMSGETD_GLDMO@apm$g0F0PG}`Jm4`m1pRFV-0D$ZHaE-s3j(FL1{3`UBy*ISFB zMEa`)LUaWQ(JT436*={ZCurrVeUExQ7h)eXVMOhf8Lu9Wyax$bG+?^|m|$8Zbl6@S z6Cxa0Z{hq+LpX@Vp`KdG;g_swjVLjnSToMPGBaL3jYavlAO~w>Ln}GNGqG2pJMHar z_Wsq{06}m)prE`8KI1dSZ7=MbBs|Z=8z_@=FOKUN=y`F&_(o5^KxsDdskUN9tJA0Btxcpx);to5ELWqNOT)AT#23POl*|WVOd;>l4;hV{v)-I(s)K465RU}c)1M7xE55)M4;K%4YQ7{8@mc3w`)z7Zd% zfed+gMQKjoEgxSs*k9x`l`m`bUHfEQ zO)7g09#qP*9A2|8uQTu9YgK-HUX^6Jx!iQEu#B}bXr0MJk|`zFwI4nP5DNF5B;eN9 zxvCUvCq4@^I!hc&1L_=>;*;n7^Q4E&EExeBq^tsA2moXyS7f;xIMi3jhAftmXA=Xu zPiY*f-qBin@*~V-L=9o!Ob<}bRxQkb(TjskK3i9~HLa;fZ4jd=0X`@drhbeoA&j_< zhiHC)MJDF+$_Uhmt%rK~LNal?hPvxZDxy-i8-pvG!pcpW%!DiYMg~;bs&ek*@NuFs zaoi&TDrb6cGm(=ZW8h?c=^}Vw@Lq`hgI73zm7(agHrJ$kLJ0{qja&9GT)m0{Tf1bX z+a)%TxcFpvZmxI_|SzM!XWD1swD~YOxqr##hp}_S3oF z|H(Uz|DNF(PevSE$gnUu#Z??&=vL@%qKgH~QS-7b;6c3F&EIjI)rb@$`4O#Jakw;<@so3n34oEXf{7nA_cV~`ioU$mrxlA1ey4Q zD94$QLqQwdGKR4!1igDWL5*2yg=vhKQVfz)sQCQI$4;B>RAa8@=-ZCwVwu9rI&C_O z2-g-r@`b0*$4Bu4#kDyvCJ%#KJ^JQM+$Rk^;w)xFbjk--5L!!%)Xiv)6LSh2m;E@h z{IlWGNDQZ?x7)kovVlp!#vZcTwBwF=el!P3i`uK9smp9hz}IZU3SYV#+FqBjTYC&U z%4+{@Qk>U{XD^ve+TdnloO{uvs%&H60pwCp*AL+2HpB4#^wz_@Cn`jn-iZy_GRQsd zJP$3^8=q=qboT^umTJzlA;}ALB#z*M?(UKVW+v!Z#|a6wv5IW-8lyL4xu9&pobJNtA=ZztZ@5EX%85h&q2NyozW!IA{B#Pno=2s|FNe z6Q-G!Rj{m!^v&1B3x@ho2$K|DV4I~lth46x{RP#Zyz+r`h`~=Jx!@2PXx?Sal<=#) zE8V8#D-n$H`c|u7>`@2C^q9E4fLO88m~&xyeaUvUnWW?0LESVGRJ-`LETu|*;$MCP z7?1IJ6}7Cb%5zv+Xjd}stu3s=I0S{Zu%9&m2PXbuc%~)(Muy_uF2Gole6ED29Ti5c zFWV#TxeO3ZkNxHrRDFXAHewf11+}>S@HlaqF)Ym_{ed6g*b0l=gP9@va!m-^w5Imp zf*C7&@qEyNsrw?6KY<%QMvgkCF*+TmfgxV>qZ}qw`#)$}ovlAl_UJY&!LS)VjOYk9 zyW>?N{~Y10u*u`kYyn(kC<=472kPJd-$!kB5B21wQH2DtexZz<$NzK zoZ~&2A$-i(o4CP|;ChAo^^m^5cw=1{821JoM9CmGYt|vt!%E>R*hIsNB5MWQBQ4)1 z{=&D3H%V_5A)_9edSG6a^&XOZhhcTMED426I?+*#vAaG-d~8ht3V-GMSncbzoyu%C zc`7+s;0><2l{K%s) z7xlvX&}S#5pSm0g>EH=Z-tn|j^sN4^>7I}$3gC};^IG}doN2+&CFF}eO(-dmB6mli zT&ocfXlQz4H25480@FA1!Q%?BiWU-|az{S8#n?ej0YVSApq`AxUW?A!qtsyGbqLd>NIiYn0aF>D=(SuMwnB%Eean`j0)M^E z6;qL=_V|&QgkH=lX|Plg61>{f9#YT?k#MlTI+E>HHZaa_{>556r4+ws;v{Z%f&Xo6 z|M2Y08Ms+z@VUQ)`yLvMiMx4FgmD3ch=Na)%I3YmZ{S&t-mQEhya-7r-y4Y=*aYmh7Zw zR~vnda|30v8cUL!I29&rZe}~KkXY*RLUd*ISbay+V>10YE>Ng##KQGkJ=xSH+|ooDNI!8%#vJlaw$e?s>Ees3s@U5vZaol z=v|mM6uP}^A7)vT+7!OgZi)KFJVHK@X2O`hA*}jh03;_W zef*`Lv1u2}!GhZezeQJFC$0*=kHv1dn|`|$p+ zk`k4$;^Mkd-e)qPm2i*6+YJ(-1|ZODvgk+9;B#Sj0nz^+J^B49-zo5&0^cd{-#~#M zViZ*`D8~)`ucd9!>j6y6@hzUa&?K~(cTHJW@#;sP zJ?>GM9>klVMH|cpo)7NrH_}jnhiUDznIumF=ovRuCU|R zKm@jT@EZeGLzsC+J|>VCU?+LjovtlU&pcUyWl@41_Um9VX8YhkkP7n;zPoY){HjVxOTTPcjO(^Pjfuxi zHz7>Ao|woRJYsS$QP@E3Hq%X zr#-H7b`=relTynKVZ`fsvgu6ydC<26lZ@|!ey8bomij-hDBQoSC^fF7I-pxZ#|IR> z-%X<`qju~dE}=7H2tC;W>GOREv~d7Xp`=n0gL z+$~@D-a}?lZu}|jnyOz?zVeG=^a}Cfiz+HxEsz@Y*$aV1G->=}lf(y<2w>q(8Gk-Z zlX!quUwCg+YE(Mu_n7y_Ee_d#;!fwP^H+wekGsyyyz1Mhmo+qtePy_zzNO{vs_x*b z?wV=8l4-wc!teu^*K)G%VtQy_bVOEP#JeNx6_enswkp*&zwP@k|B0`|@WV2_Gf3pZ zc9x&9o!*?+>BZA8xT7*uVnm*RdQk$sy&{L~{mO`w{I3iLCZ}kDsYcl6$%Z41!$Xln zdHx6|wbOw+kAMB=z0ePgb9*ZzUl|rCYERG~=Js%>ht87=a;hiHTQtSsBTt+9u{U&N zy}v(hjW?tXoEo0}x26sBSxhb#bzyVcYzn_>4e@wtz|NKSQcK_Btn%)gwmcUyx~q<5 z&1;USHO!ACImG>1I+RlL3p$?y(e-veEKDSS4l$pLwtO}ispzb`WL9$tjJ5+Rz$Usq z=@^X7VoDKoOg&#Q^u!>cY#gvc+QN}*2KDs~@0J14?t_~N6naqYJm^M@WLMfSIj`x= zw7px=wnl^70TSktAbZy+amZ{Ty$CGX{P|%7wr4i5p8dA z_HG}bT?bZrq;rGtT&ku=-8jA4n}7|*Y7fBt+86aa#AUC*aqzLx5s3B@iyzL~{J6Dc`7<5^ykL~FSr{gz)#xUJNURAXO3$Etkrb~i;s5Va|#~5mVuz7sx z66@d7_1}N~!|aBHKVDzuuBqBu zq*PY^Vep`GK%#8vbbW6z9{kh53BNS|=l%ViQFKpF_mYUpAsyPRVIu0qq~q2ZRq)cc z_js)S<%#-&$jM6cSB4L)bP%`f&$)84*`>1C<-H|)LTmgc&l!HEH|$WQH)YEHEPL&L zo$(cxtcLK-Q#X|hAD?AlIG;qh)^YjWv{3YBoR*avPg@BckSxP!kKT2T4o4OY@cLEj zwTxeCk?X4ExRt*!y{o}~RCV>1nIr{sePnXRrZdW*b+W@OpH3aNPdtbF)5s*`_BxYgZlUZU=$H%Vbr1&8F<}Ikkli0o*p1{PJm@k&$ zZi_yE>%0Z^wgNRoNvP;5=QT!G3-5$o3`P>xYwv8SMdf6i9nl$`L>*hcI45T(P>oNx zEgl3e^-x`!3oNc2vZQfz{tPk(Yr+o;D)L9gMZYp|8XCpOl(EyR-Ze~D=YVC*mXrjU zN>&1IWw90IEK}#0zE)RqVvBJSGKx@e!9IE?&%gX*$u*EKN6qK~GcVPQh1(kRl_9Dy zgRuIaW`>;;OY2;EYT%29Kzc@kuN^05aA#<6h!$S_`zSG{x~h7(ZeV4b)J=%ol7+FE zK&gZ7n9;)$${L`6xitejsL|9C)DslWr+j3K^L$X(kh1$OKF)XTXL>)8qFem}f;D`p zsVS{nk1Df#!*GchKrZ(*-xi78`*Bxv!Y)V$9=0FE}JCC zWnmR9%aap(o>+@xnE4G=HLcPGKy1E1oQ5xF{4lVr*al_bIzZSo5v`~uEUZxo)hYC} zac(H3q~ngw_$V*qDjMwI?xUn=AI?FsdWVuaCugtwA&*{{@N2oP=ODLane}B9V_T0~ zVJIc=;$ufSxbyA!{4&wwcTRL-|XSf~6$CKj*noKa3*L?qSR7zg2r;6ToO8>o6RLhS_KNC!I z(pM>QQ0)1Y7*?pYI6;oe#&*e_Hl>RWk$%(o>$e5^A3ykDJ6u%Pd~<{;R&*A#)n(jT z*W)RPP~Wzy8E$$Qs*c~-S}uFBv1QcD;o<3+DipEaY0v#EwxNV_ zIyqZpnTHxp!?o0mj_E)mp3BV4dEvUhZYuoFa09MJ;h!-$dJ*|&<&z$KB(t~Q%kbt; zU;0DT&~a<_j*Fyix9e91;Yj~P|CISW4%&s^>FvC)Ty!f++F*LMdrOzqM5zGffn4n? zz?O1OW)T1%NN8|P6%434V4qi##Li?=k>Mb|nc6Ou+*39TEDvLL^}4060^RHx>Bpya zo0k%#QU&{fO>68BJA`<#ldwG<02J_>Xu#z~&r*w5g``}M;T|gs*qJVtL!NFT)-myd zpl3QqTZ@3e;)%9=fT(Rxec49|V`-h)e6>QS;?xP)+pJGM`5uNE<)6S6QS5$*3u1g@ zcD|-?;dEO;u;a*6B1-3nr^!|=RxU)*8Sa3| z40@Tl+Jj3fhYXLpd@9)nPR%C^DKYb}x7zgYExmJ-HL>2Z1|~Z=6e#I#Dk#pm z`ZgBsuL?{WHefj;y)siXZ!ge{zJ13(OJV(Dv*JJ`ZgkkJ?H1OH9UGL|=NS3Icw~i@e|*c^&8w>H~@osFMuNeSxa4I5~P}ZVXOf9TF~c z-0FTcF6x0P_uFHS$r&tlE}~)dg@D?EARua~8`q*m#o;D>G@EOKU1v%w zonOYiQ>xY#6?1a54)(LS(TmI67%U~eh%>b#!OWyc?NQwT)`sHO$mUatUr*eoWw!8x`wv_tepV5=3Yev(hDzB1qk@{7&v zUVPcw=c6rYqYsmVZZFtA=}DRN=#JPV#FFQy>g4m)v}ptLtt~+>N~p>S>W7}oT=+fX zziu9a=)l^u4O^)A8U^}jkzX0=0cz_X3J>q7_cQYk>ztM*U*fuDRRyR&O8v^BWisp}?dZtx91{b>L-tP9SC-X?2}wtQW9yf~%8?4A7$rq;52o~PjD#-` za>jbYl<*;BzOW=I96RE>&NMuCCoBx+c*#t>c^9IlWWMB4$N4L+s4#)eN*0|C)SaQ4 z@wV3&3N#~PPmsk3Mba%fR2!!UR3 zfo~b;AC##FAKBTdl|$fNui52f-YkVhd;6EZ@A4}jF?YtIg%Bmdj<>n8oA+Q1v54T> z6?Z!-WyDt3SPCmvjH@`ec*o&oB-gmylw>M`h?eNM*q?AB>orr^X2*B%EkY zPX0D3JY!pB7ZfZ8E-{yWy}<D~>y$H^>@{03L@pE=H4%meK)D{;Z{wYqp>6P$Ynu>+SZasz)XzMygtI@KT^;w4!Z zJsRuVB;lJm9dex0z-N=av8R@O#kX~Q65X>hlis9)d@Dy4|Cn)1rSB68yC1nlRc8q| zLCZTwM_aXCJAJ5zoHbjUntNlcW_!`AV{8IlcQBgP#N+cefV!1uw%BvR521aMSMiwY zm>ff|yx8fIm=8>>?m1Oy82Uv2rXSgw*1#vb@2Krk{Fd=s1!2AS>}UG;PSaD1%cO1H zXD|KvyE#1ms-B)MmWNwSQ)A-A^AZxG(Ywj+~>g!9t%g^fCU6mB?Ry z$=7w9Y{0V@ipt`QGkb8TmrXm9qh9np@$Z(X>w(5Pb@hRDXQ{LNK6cl@dtdPun7&*M z+h!&N$Gva;_FtmkpKtzOCdt!9t1^V^E6+W27oEV4%!J|j!_FFXe1t}b6MbW>^!C?3 z-^d`?V^AEd&oV3qzBL?;QdDKHeAICWNqf$q)m>GvAse@|im5u`vOW_!_EqYv;L_y7YNH+7039}-yUV}FXZU=eDR+d8{Q~v5nDwKYM_WwZ*3Hij zkG|jfolO5>mWZuWvxU8jIzNJ4f@u>7y+y{1*Gocgl?7GwXn;k#q zK7((6zx6wr{wpkD6ECr;4bvIPHM{<{85++zYi7Tue%U=R=)yh2pRB(L=LcDtWi&Xv ztt>>yYZ&pBVNY{ebF$$6k1}c>dS(tS)Lnf!h#MN(H-!Gf3+lUg{;rDtD;iszd}WGW zz8$llLDn?3Q{>7*>U@)s=QzYBepC+0`b?Hin3&w#IZ$DizmfJ2X2$o+?-ck~3jFjD z#tgJ>4=qXGG*b@YssbruAWzK3-u(XjS>=*vF`=za1zc0R_DJ-WiIja+I^DApt@YV1 zM2sCcX;ANUtdSd1qM96&wkd3TJ6r%5bi>9fO%xT+F$*e){zve)j+U%lr7b=!n{;-XS*iv2d8We{18V z#4z<={~=F=wc$A?mzuK{DT)6VnpWm6zzRah%{L?cL1cy~468h)9v>#s5e`D5H2L}xR{a^ZPhUm+8Ze;>F0umJ0;4(VTvUt6?;h+o~4(227CJ4hK>e&WmtkX zJdfFQL5%CCN`M_S)_6$*PF8Hbu0A>wk$}yrZQ8c+OH4RFKzn)nF@jJ9ry7r2LDtr; zrSHN@+PI9Rp23$Opi-^D0486yPLk;?F626IVqG6HJ+R(bH)jHJX(K9EDRX>?W}GjR zA<&(+5;$zFp3wCkR~jd>$vN^4iz?YC=3s@~(INi16B0!sN!Mj;VeD)>8OiXL5MZZx zae>C5Zp!U2J`HZ&h_N{1bZ^=o(rkt}!^84Ue9>Q(SD9x-ji)6bwS5=P#`4Ht_?RiF z;y5#`rZibDCL|Y?Gd!A-WJ~Cf`Op>WX?^I+5>9p&u&-eTD~1Wn;2Tolt?Gyuo?HPQ zFRinpqG(PN+)r8;$?~RPs5bPuRKY4zI6xwVYYW`Iu@+Y_YeT~;8W*ABCR6k!N%u`< z-145k?<}@wG0I2V$^ZynaNI}aC(1?QFw2+Y?rqKC#Nw{GiVYCWzvBG}sM>^_!uW?* zPLjsR+%DqwfX2!%Q6kD#x#(E4T&^Cy;T-XDATzq{sXmxl;cEK6)Oq!Bd_}ffKm#4J zv2wMO(G&`;54!CbTzVZ!bGRjM<+tivIZHB>JiJ)n=$^URRl%)~BA4}SSJX})#YI)yP;SE0|M+TgV*#v_UQvLFM1!jigBklhM>#7LmGQHN5pJs;PMi>5vyID;mh^1p~%~p z{Ob5dghjn{;t&o7FumXz$qGBqxkYm~uZ*86lP5qhKV0<$u`ilyklO3(Yq?J4CiR-C zmdfAjBljjLU<`=8^!U6fE*4{C4h)_Ui1c%nAYO%f_6xx*@MJ~Y)(7_<<9ju zqK9Oh1OPwRIz5X{r#|#k_d=GHS3Wx(Czel;dVTFsm|g>Qt}h=9B}15d!>zIfCkeGb zXH==OyJwBBU+;sHxq-Tde)JZ)mZ@Fq5)Req?FZcm-|Cmp* z|4J{_V9&$ASi>W6TzR89*G*OKdgjjoUCmP`eaT3fcMaCs?-Caa5&hYik<|;LyoS_t{Fx?=!Fg%n&Q)=J8vfVvU@yBYki=T zQ!q{IXl=~v!2p!>+vFUT4D$q zWX6ago4bCZO%*GNj=yV_G1I_e*w++qEz9Q_nii$Uxup1~)%2CHblv(KBwBAevu~7G zP;F)m<|!Mfc0LK>X4$sSs@?3zp=tqmRGeOsylTc++KQ*&30FRVAY}eYAayV#!Ls^Q zXza{Jb9YW2y-!{2BuC5L_5W-V)}JNq|E#N9P@vo*UB@ylK$~rO76WIQLc3k?K z`Sjlzx^irh7O?)eM|JElsAs4vERoNx_@lqKTF#;b5< z=Oyrh)`EhzO@6^(@22o$)%=ci_aa}uL0_98H*8IxB|b8zF!JRBS}~{Jx3{)T|G_JA zAr+ztGZfIhL>g=pc^a9s^{sVVEhDr73!>aXl#H{l@59}$%d6cC0JaiPCyYcC!pyEp zGz-;6T2w`Fvbc8T+w)49L2PU#Hb>iOavDGecP!Ko|+XM^3+(A;Rb^#;@Y zX*cZ&b&&@Hlo@qAS0CrrJKCW;0Kn5yMp#QLE?9HbVFv~^k9pvvL0sBw+SMv-lg?0I zuiYo&ZUbwGs!9qk4p-g;0ZZ}>pC-32CpegAjpT-zNe}Ekh`yNJ#r@gyS$rE{Prs2A zVCJlzEJt-FRl#rRp`Ovkc<+smV#qTB+iS?0$Gq*)k1nS>cBu+nUyM`f8+I&3+hyqb zx2+Y=5JCd;xT#d9xdY^=gb7bmP2#1iq*(AbvJ+HQkK!~SnDeS;Uz_r$r?NV zFlCNqw6r1zfI;D_4p$aJT?Y37BhM=e;~cfZ&rygSTbx16;c z4DDjQVm>3ABxrVC`RSR#=sNlPwW~;YxWaUq%=)r=3M@}U+R-w`5#i!YDD(*38Asgj zOOWU%X~=Buy~@~zTyehg{E3m-T9J|fkhs>jZs{dknKD?NDWp+=PfR~RYn}dI&7D_R z6Ih$a-6@Wsj4~l2O-HH(a10RXx+=YzMkom?ks5kPfS~Y=tOEprp@b6JM^6F-Q350s zMM@M1ND?}TfB_Of0civ1EW0=R%+)^6w{x+V=jMIR#VPMO@BjV(^v%J7grbzFkC=C_ za-Z(>1x9kv1Vqg;4yT4Sn9W(#zowwD?R5xz=rfy~C0Dy-`$rPOsrwLV zB80ond_?)W_U+bcJE&MY8Nem}w&RQS6j}ICTcUe%T86B18W?Qh>pS&e^m?Be%b5oi zsPk>y;Sml|_7NtTx@Hvho-mAknl)p6F5TpfAjhP7o>^4Lt_n{tsPVd*v!;>}ob;WM}D;!F-(yjL}1V?L2FIA%M2p%OlVzt5*9g3oac z`5S#pw(rH+n?3BMRO@FGa+|tudsM5W_r|wfWSp#Ca&H~-3pQor=9PzXVTQKmv`<3* zJKyIO_==62S-Rw*9uNo;W`lkIVfMFk^M#!(elMO-&4`Y@yUTq(W&|F@W)_9vkskDR zW8f78_~?qi6o~(-zbnl{XKMD;CheAglzF$yHnGNrX>J?XY>9zHf<9HjG+&PJPj(xtbLzxpynbo|EPn#*<~02n@k?H z7J@%^P8P7i$i;UByP-GbpB!zML>u$+tXjvWi?@oUh^+yjfSH+K~fzx!ox0q_xXgg`EapD(>f-PQH9atg4`Yv9>w-0UZ>*np9SWnuSPYHxe0 zHwLrxj-0QN(zhKYgrfZqX-0v)8u8NQXfpi+47bq%%5S@7$~Y2xI$HUC9)6nY6Mi7G zO<>k{OyfYGFXUwF(QL)hkqz{pu0dSaABKi(s;E)R8j{j3r@>K1*#qlAW|Rk4IVLMw zqYeMg3w@i!?0QY6rx%V5;y<-Y9pQ2XZy;w$V6j?3e$E$}LCgKGjCHe;c&R~Co@u=D zer#kut@*kr@s3ln4N@i85CWDA8wO`kvwjF5dFNGq*;D*lxAN>j?Yk`l#MRhLSOfnW z>P=>S@*uu6@S`7toRqp@vMfG)z9Qyp4j+bz*BW@YkjNW>WW`oU?}pwhtp=Z9OQa4E z9=<*NdT*G%ip0FbEE##^i@|cs3lJ4=->K-aSSU<owC^9^Z*H?`3I4c&~1! zkIuYr-MeD)i;5|7w%N~|wL)uvLoWF`14xuQT1jGGbG=$TY@DtkSj`)?uAs<#~fgI zfk$jrO*OOGlezQwnd`JD*vj)~hL3BUV=aXj(#XTXy>!w(d_E_JgN8R zI;GhWe1zArpKS4;w~y+V1DK?!iXi8@G5elrmBj4Xmc`cEaPe8m5_&>38t{~CQD&N2 zIB7Fc0JpFLA_0uML7z|^@+>qt>C^Z8kEZ|$g^!0ssRzwA#)lF0h&DyR{T;%TRY(r$ z;4!JUFMpw$3`&HYqpf1pC+* zVOmLcm;XM}p3F0ih62&Fwu7{g_K+&oA~Xrv&1;sj>Tu;xUs?l9e-wD$r4~KwzvVdb z6De6)$bCSnu!clw>UAX+erQQfrl!oVE*Su1@o4#Sub`p_vcYnVS0&Vmy3OHQx{9wa zZ4sOGAcmGENX&}6c2hn(&Il4E9v)ISWL&P9x<_5Y>N>>yimSoZ6#tI0&0fD6r5^0| zE)8WN4~$?>JzccC7{iN9N>x!_@7*65tozmVkFu)#b?Yq0@#5t&BtJbvkuj>nW?hy_ zezeY*@*$NmKrjRdbXl65VMfxHNyV=5-E*?GJpAeyrH?!$M82?HUjKM23`_uNemT_Z z4C4}w75AG0n^%hmd=UN0n`1Y-b3Ivs_)6=V+zalqVQ6{cf@T@X)C%vjWi^H}=|IO# z8IR>onKdDIrYJx{tcVbK1>rX+RxcTXkX*plD7*r;&1zsr8+0n?nwpP#7;R*$cjz z+X(4@kma`~%xq5%i`CIQ!pyK68(7M%lSgj1pyJW@)ex+5o8TJ9v|M{pl(ah%33u{Uj(scU;xtMH;Lm~M`xBNliBQEk>P=nL^JpKFxy z^J5QW$J*QgI$^Ao<@8-_ps)#d16eoP^0tNIS|2^}x!lV|G5FB0au$WUR3cId6BdpHtR+qWjm)LFq+PUR+!bUz+6Dv^>bFDb+UKC37l+uR{Oa`352 zqoOP}o7COWyE=u>u8+onM9Ary#J9I13i2a;!O+vU|JIhkzvid^`sgnGYyT$wfcZba zpe2_3asRmT*NFf9N+92PZ?j+JTp<~Mo2u}S|B`-w+clZ;%`9Cl2)0Gy1i(n{&HI@~ z`C+pO&7scUTf(P}6ht{%x-r?6cA7IIH{Om?XPlRs^|pBhKx?Kbqt*(ol9&*MSCxmo zkO_&)OdqmOXVJG?74$vy)}bTyF3nE-i?jluod&XJd6l38Mah^O-%UbGKiTJT?d-LF z%oL{xoVX2ZCDSHgF5-A|R`Q)8PnU+8SxqbeGat%0z`q`@aSTsXFV zjOR|cSN`KElMP+X*#)#4wHWulG9Ft8A$p>$Ypkz&Wtr!J_XUpWJ+13bduPAJ7Y8hN z&jD2s&N5eh zNcAV%jH4esPMQ!g(s#PKkm)~CF#^F{|*}S}a!~!dXmUYx&|($NiVMBe<3a zP=|1LM@Q>sDND=lL5dEPR_BR){v_wODV2_<)cdjG4>S^2{n9qqftrU+JZ%zl*-x3n z>nWa^*o zYyhrDvc4>iHO1ZvA!s0o65{h)PsvCW(t>HZojV#7?DT1qp?WvyoB6O_(w#q#oxtY} zU1F9Ta=@_OW%^v|ta}EyCNae$sp|Hb>sK7ZJHhX{C8q=SkKJsY;;)3%l%f2^XF3dt z=fp^-!LHXW+J=_G?j!rtyubvF`XGkxithvB@|@2#7dt!jGY92>1U2h*2s$Yh1qzd& z|8%m0hOd=yOd*5(DMo4YD&=@nC*nMs#sl)lcgz0UPohbHs;~G*V%%|yaJ$;-YrTh=0wsM>s|K|Z)9`c zvoATB-2bH#004x4&8eIULhY`}p<*)ycO~v>_@7C0E@Y6tCboSVBqExFFw*(loHBkA z_cD$`bDh!@PF$o;*{C!KHyu=)=G2M`d*AFiry8->oKJ=Cyuag+-%H|sxj3kHNetXs zuAaQ=)uckHc`oD_FXabDvQ_Fzo)D{aD1egFo-bQ~CULIW)&~7oSlX>-(Hyt4BjNTQ z0Rd-$rL@PAFV2q{Nn&_GR81>a`6L}Ztbo2FSDxdiSmL4Q926VwngMs%A$$wv@tBWc z?p~wo%gL`7)rwXvcjSM1@uNZKrNgCp<2p2_r%|~5#)2(m3Dc8n9|B=bdZ(QglvIu4 zn99JgxoJ0En#YRZ3D|)5&~%*wI?%gY*E}+P8A5kDHPScqMNiWN49WY%C0<5H&567s z-nzm8(DUtm&@=;p!L?ClFd>ckNk*;_CoQ}!Y%2YI=urFVOy!~W(q@i+Lte^@0O#m| z5fUr~=|7p$6I@mG3?v;*t0|=f{F8zj!A&j=Fws!daWU>pyFB2D<;eDbm<;$B$YV5y znR)%Mf`j+V1jDoH+Kv<25}?PMe095*Tl-A!X1N`D>~Ax6E=VX!PVfGJmQQxOZ zh70V9h*p&sWGPti0=B_eA&3Q^%lhbo%^b$X6U!=IkbbH z6da6{a`70)P;z_P}Nlj z>ZdL?dcGV#aKcb0_eqW3wk&ub^+KJYExkHU>c#8WMUjz3UZJYDDgCVITZw<*T)Iqz zfTt9W2EZ5aaNwdNB3sQ(!NS|4;)QRB^Ru9B#jCm!>19ot<1A9`emcI(_?}Uijdrc$o>zD`VlU#NNtQ@$35)7_|zReG3NDydw;4J&(zqRmOe6@`8lj$ZhsL6i%P%?h^)g%LU^5(xB5 zgHt{`$KV_-35OO=DPWrVom_P8SKv$8u9iJE;O8&LAdq{l@+MH^b^q4MRbs!6*QB(Y zczdqSlRijPKG!Z;0%`qbEKf*OxoBWu+F#`L07B^nD_R`8`>%HP{528!n@9h*qUYZ{ Png8eE{`V5VpA-KHZsO_k literal 0 HcmV?d00001 diff --git a/src/site.svelte b/src/site.svelte index 1b0e93d..c756efd 100644 --- a/src/site.svelte +++ b/src/site.svelte @@ -256,6 +256,7 @@