From d7c7b696a47ff40d73951fc476c33fc7a00b98ec Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 02:01:09 +0200 Subject: [PATCH 01/67] docs(specs): add competitor-gap specs from Maintenant analysis MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Specs for the genuine feature gaps surfaced by docs/competitors/maintenant.md, grounded in the current code: - todos/2026-06-20-01 SSL graduated expiry (warning/critical tiers) + whole-chain nearest-expiry & chain reporting - todos/2026-06-20-02 Docker restart-loop (crash-loop) detection - todos/2026-06-20-03 OAuth 2.1 authorization for the MCP endpoint - todos/2026-06-20-04 first-class StatusWarning (degraded-but-up) status — enabler that 01 and 02 depend on - ideas/2026-06-20-config-as-code declarative checks + Docker-label discovery Co-Authored-By: Claude Opus 4.8 --- specs/ideas/2026-06-20-config-as-code.md | 50 +++++ ...sl-graduated-expiry-and-chain-reporting.md | 195 +++++++++++++++++ ...-06-20-02-docker-restart-loop-detection.md | 193 +++++++++++++++++ .../2026-06-20-03-mcp-oauth2-authorization.md | 178 ++++++++++++++++ .../2026-06-20-04-status-warning-degraded.md | 200 ++++++++++++++++++ 5 files changed, 816 insertions(+) create mode 100644 specs/ideas/2026-06-20-config-as-code.md create mode 100644 specs/todos/2026-06-20-01-ssl-graduated-expiry-and-chain-reporting.md create mode 100644 specs/todos/2026-06-20-02-docker-restart-loop-detection.md create mode 100644 specs/todos/2026-06-20-03-mcp-oauth2-authorization.md create mode 100644 specs/todos/2026-06-20-04-status-warning-degraded.md diff --git a/specs/ideas/2026-06-20-config-as-code.md b/specs/ideas/2026-06-20-config-as-code.md new file mode 100644 index 000000000..f5da38d99 --- /dev/null +++ b/specs/ideas/2026-06-20-config-as-code.md @@ -0,0 +1,50 @@ +# Config-as-code (declarative checks) + +> Idea, not ready for implementation. Source: the Maintenant competitor analysis +> ([`../../docs/competitors/maintenant.md`](../../docs/competitors/maintenant.md)) lists +> **Docker-label configuration** — a lightweight config-as-code path — as an advantage SolidPing +> lacks. + +## The gap + +SolidPing can already move check definitions *as data*: + +- **JSON export** of all checks (admin-only) — see the existing idea + [`2026-01-03-conf-exporters.md`](2026-01-03-conf-exporters.md) and the import/export in + `server/internal/handlers/checks/`. +- **Network discovery** (CIDR scanning) in `server/internal/discovery/`. +- Related ideas: [`2025-12-28-importers.md`](2025-12-28-importers.md), + [`2025-12-28-automatic-app-discovery.md`](2025-12-28-automatic-app-discovery.md). + +What's missing is a **declarative, idempotent** path: a user keeps a file (YAML/JSON) describing +the checks they want, applies it repeatedly, and SolidPing reconciles to match — the GitOps +story self-hosters and homelabbers expect. Import today is a one-shot operator action, not a +reconcile. + +## Sketch + +1. **Declarative apply (primary).** `solidping apply checks.yaml` (and/or + `PUT /api/v1/orgs/{org}/checks:apply`): the file lists checks (+ groups, maybe integrations) + under a **managed marker** (a label/namespace). Reconcile = create missing, update changed, + and **delete-by-absence** *only within the managed marker* (never touch hand-created checks). + Dry-run / diff mode before apply. Secrets referenced by env/SSM, not inlined. +2. **Docker-label discovery (secondary, the Maintenant parity bit).** Read labels off running + containers (e.g. `solidping.check=http`, `solidping.url=…`) and auto-create the corresponding + checks. Lower priority than the file-based apply, and overlaps with + [`2025-12-28-automatic-app-discovery.md`](2025-12-28-automatic-app-discovery.md). + +## Open questions + +- Scope of the managed surface: checks only, or also check-groups / integrations / status pages? +- Identity for reconcile: match on `slug` within the managed marker? How are renames handled? +- Multi-tenant: per-org files, or one file with org keys (admin only)? +- How do secrets fit (env interpolation? references to `parameters`?) without landing plaintext + in a committed file — ties into credential encryption (`server/internal/crypto/credentials/`). +- Relationship to the existing JSON export format — is the apply format the same schema, + round-trippable with export? + +## Why it fits SolidPing + +It leans on assets that already exist (import/export, discovery, slugs as stable IDs) and serves +the self-hosted/GitOps audience without chasing Maintenant's deep container observability (which +the analysis recommends *not* pursuing). diff --git a/specs/todos/2026-06-20-01-ssl-graduated-expiry-and-chain-reporting.md b/specs/todos/2026-06-20-01-ssl-graduated-expiry-and-chain-reporting.md new file mode 100644 index 000000000..cf5ceb549 --- /dev/null +++ b/specs/todos/2026-06-20-01-ssl-graduated-expiry-and-chain-reporting.md @@ -0,0 +1,195 @@ +# SSL check — graduated expiry thresholds + whole-chain expiry & reporting + +## Context + +Inspired by the Maintenant competitor analysis ([`docs/competitors/maintenant.md`](../../docs/competitors/maintenant.md)), +whose SSL monitoring fires **graduated** expiry alerts (30 / 14 / 7 / 3 / 1 day) and +advertises full certificate-chain validation. SolidPing's SSL check is thinner today: + +- A **single** `ThresholdDays` (default 30) — [`checkssl/config.go:28`](../../server/internal/checkers/checkssl/config.go). +- `buildResult` flips the status to **`StatusDown` when `daysRemaining <= threshold`**, and + `daysRemaining` is computed **only from the leaf cert** (`PeerCertificates[0]`) — + [`checkssl/checker.go:235-241`](../../server/internal/checkers/checkssl/checker.go). + +Two facts that change the framing: + +1. **Chain *trust* is already validated.** The check dials with + `tls.Client(conn, &tls.Config{ServerName: serverName})` and **no `InsecureSkipVerify`** + ([`checkssl/checker.go:95-99`](../../server/internal/checkers/checkssl/checker.go)), so + `HandshakeContext` performs full RFC-5280 verification against the system root store + (chain building, intermediate trust, hostname match, per-cert validity). An expired, + untrusted, or incomplete chain **already fails the handshake** → `handleConnectError` + → `StatusDown`. So "chain validation" in the trust sense is not missing. What *is* + missing is (a) graduated **warning** before expiry, (b) considering the **whole chain's + nearest expiry** (not just the leaf), and (c) **reporting** the chain to the dashboard. + +2. **There is no "warning" / "degraded" status.** The status enum is + `Up(3) / Down(4) / Timeout(5) / Error(6)` (+ Created/Running) — + [`checkerdef/types.go:13-17`](../../server/internal/checkers/checkerdef/types.go). + This is the single biggest constraint on the design. + +Note: [`checkdomain`](../../server/internal/checkers/checkdomain/checker.go) (WHOIS domain +expiry) has the **identical** single-threshold-binary pattern +([`checkdomain/checker.go:96-98`](../../server/internal/checkers/checkdomain/checker.go)). +The graduated-threshold logic should be written so it can be shared with `checkdomain`. + +## My honest opinion + +You asked for "graduated thresholds + chain validation." Here's what I'd actually build and why. + +**1. The current "Down at 30 days" behaviour is a misfeature.** A perfectly valid certificate +that simply expires in 29 days is reported as a **month-long outage** — it pollutes uptime %, +spawns an incident, and pages people for something that isn't an outage. The right model is: +expiry approaching is a **warning**, and only *near/at* expiry (or an actual handshake failure) +is a hard **Down**. + +**2. But we must not silently regress users who rely on the 30-day page.** So: keep the +existing knob's *meaning* and add a second tier. Map the legacy `thresholdDays` → **`criticalDays`** +(the hard-Down threshold, default stays 30 for back-compat) and introduce **`warningDays`** as a +new, *non-paging* tier (default e.g. 30, or `2 × criticalDays`). Existing rows keep behaving +exactly as today; new behaviour is opt-in via config. + +**3. The warning tier is the new first-class `StatusWarning` (depends on +[`2026-06-20-04`](2026-06-20-04-status-warning-degraded.md)).** Warning = +`StatusWarning` (visible as `Degraded`, counts as up for availability, does not open an incident) +plus the same `certExpiryWarning: true` / `severity: "warning"` / `daysRemaining` output for +detail. Critical = `StatusDown` (pages, as today). Actual expiry / handshake failure = +`StatusDown` (as today). **This spec depends on `2026-06-20-04` landing first** — that spec adds +`StatusWarning`, the availability/incident semantics, and the DB constraint. Until then, the +warning tier degrades gracefully to `StatusUp` + the output flag (no amber state). + +**4. Compute nearest expiry across the whole presented chain, not just the leaf.** An +intermediate that expires before the leaf is a real, common failure that today's leaf-only +`daysRemaining` misses entirely. Iterate every cert and use the **minimum** days-remaining to +drive the threshold decision; report which cert is the soonest to expire. + +Net: same feature you asked for, but the default stops manufacturing fake outages, the warning +tier is a real `Degraded` status (via `2026-06-20-04`), and "chain" means "we check the whole +chain's expiry and report it," because trust is already enforced at handshake. + +## Goals + +- Two-tier expiry config: `warningDays` (`StatusWarning`/Degraded) and `criticalDays` + (paging, `StatusDown`), back-compatible with the existing single `thresholdDays`. +- Expiry decision driven by the **minimum days-remaining across the whole presented chain**, + not just the leaf. +- Output reports the chain: per-cert subject / issuer / notAfter / daysRemaining, the + soonest-expiring cert, chain length, and whether the chain verified completely. +- The graduated-threshold helper is reusable by `checkdomain`. + +## Dependency + +- **[`2026-06-20-04` (first-class `StatusWarning`)](2026-06-20-04-status-warning-degraded.md) + lands first.** It supplies the warning status value, the "warning counts as up / no incident" + semantics, and the DB constraint. This spec returns `StatusWarning` from the warning tier. + +## Out of scope + +- The `StatusWarning` plumbing itself — owned by `2026-06-20-04`. +- Per-threshold *notification* fan-out (e.g. a distinct notification at each of 30/14/7/3/1). + v1 emits one warning flag once the warning tier is crossed; multi-step escalation is the + existing escalation-policy feature's job. +- Pinning / expected-issuer / CT-log / OCSP-revocation checks. +- Retrofitting `checkdomain` in this spec (share the helper here; wire `checkdomain` to it in a + follow-up to keep this change focused). + +## Design + +### Config (`checkssl/config.go`) + +```go +type SSLConfig struct { + Host string `json:"host"` + Port int `json:"port"` + WarningDays int `json:"warningDays"` // new: StatusUp + warning flag + CriticalDays int `json:"criticalDays"` // new: StatusDown (paging) + ThresholdDays int `json:"thresholdDays"` // legacy alias → CriticalDays + Timeout time.Duration `json:"timeout,omitempty"` + ServerName string `json:"serverName"` +} +``` + +Back-compat resolution in `FromMap` / `newExecParams`: +- If `criticalDays` is absent but legacy `thresholdDays` (or snake_case `threshold_days`, + preserved by the existing `readIntKey` dual-key reader) is present → `criticalDays = thresholdDays`. +- Defaults: `criticalDays` = 30 (matches `defaultThresholdDays`), `warningDays` = 30 as well + initially so behaviour is unchanged until a user sets a wider warning window; validate + `warningDays >= criticalDays >= 0`. +- `GetConfig` emits the canonical camelCase keys (and continues to emit `thresholdDays` for + one release for dashboards that still read it — decision below). + +### Execution (`checkssl/checker.go`) + +In `buildResult`, after a successful handshake: +1. Iterate `result.state.PeerCertificates` (leaf + presented intermediates). For each, compute + `daysRemaining`. Track the **minimum** and which cert it belongs to. +2. Also expose chain completeness from `result.state.VerifiedChains` (populated because + verification ran) — e.g. `chainVerified: len(VerifiedChains) > 0`, `chainLength`. +3. Status decision on the **minimum** days-remaining: + - `min <= criticalDays` → `StatusDown` (+ `error`, `severity: "critical"`). + - `criticalDays < min <= warningDays` → `StatusWarning` (visible `Degraded`) + + `certExpiryWarning: true`, `severity: "warning"`. + - else → `StatusUp`. +4. Output additions: `chain` (array of `{subject, issuer, notAfter, daysRemaining}`), + `soonestExpiring` (subject + daysRemaining), `chainLength`, `chainVerified`, + `certExpiryWarning`, `severity`. Keep existing leaf fields (`subject`, `issuer`, `not_after`, + `days_remaining`, `serial_number`, `dns_names`) for back-compat. `metrics.days_remaining` + becomes the **chain minimum** (the meaningful number to graph). + +### Shared helper + +Extract `gradedExpiryStatus(daysRemaining, warningDays, criticalDays) (Status, severity string)` +into a small shared location (e.g. `checkerdef`) so `checkssl` and later `checkdomain` agree on +the tiering rule. Don't duplicate the comparison literal in two checkers. + +## Implementation + +1. **`checkssl/config.go`**: add `WarningDays` / `CriticalDays`, legacy `thresholdDays` aliasing, + validation (`warningDays >= criticalDays >= 0`, both `<=` some sane max), `GetConfig` keys. +2. **`checkerdef`**: add `gradedExpiryStatus` helper + severity constants. +3. **`checkssl/checker.go`**: `newExecParams` reads both tiers; `buildResult` iterates the chain, + computes min days-remaining + chain report, calls the helper, sets status + output/metrics. +4. **Frontend (`web/dash0`)**: SSL check config form exposes `warningDays` + `criticalDays` + (keep a single field mapping to `criticalDays` if simpler, with warning as advanced); the + check-detail result view renders the chain table + an amber "expiring in N days" badge when + `certExpiryWarning`. Confirm against the design reference at + `/dash0/orgs/default/design-reference` and reuse existing primitives. +5. **Docs**: update the SSL section of [`docs/api-specification.md`](../../docs/api-specification.md) + and any SSL feature page under `docs/features/` with the new config keys + output shape. + +## Open questions / decisions for the user + +1. **Default `warningDays`** — keep it equal to `criticalDays` (30) so behaviour is byte-for-byte + unchanged until opted-in (safest), or default to something wider like 30/critical-7 so users + get the better behaviour out of the box (changes default paging)? I lean **safe** (equal), + with a release note nudging users to widen it. +2. **Hard-Down default** — leave `criticalDays` at **30** (preserves today's paging), or drop the + recommended default to **7** so a valid cert isn't a month-long "outage"? I'd keep 30 as the + *default* but document 7 as recommended. +3. **Apply the same tiering to `checkdomain` now or later?** This spec assumes later (shared + helper here, wire-up follow-up). + +## Verification + +- **Unit (table-driven, `testify/require`, `t.Parallel()` per `server/CLAUDE.md`):** + - Leaf far out, intermediate expiring inside `warningDays` → `StatusUp` + `certExpiryWarning`, + `metrics.days_remaining` == intermediate's (proves whole-chain min, not leaf). + - Min days inside `criticalDays` → `StatusDown`, `severity == "critical"`. + - Min days between the tiers → `StatusUp`, `severity == "warning"`. + - Min days beyond both → `StatusUp`, no warning flag. + - Legacy `thresholdDays` only (no `criticalDays`) → behaves exactly as today (Down at 30). + - `warningDays < criticalDays` → validation error. + - Use crafted in-memory cert chains (generate test certs with controlled `NotAfter`). +- **Manual:** point an SSL check at a host with a near-expiry intermediate; confirm warning + badge + chain table render and no false incident is opened. +- `make lint` and `make test` pass; `make test-dash` if the form changes. + +## Files referenced + +- `server/internal/checkers/checkssl/config.go` — two-tier config + legacy alias +- `server/internal/checkers/checkssl/checker.go` — chain iteration, min-expiry, status, output +- `server/internal/checkers/checkerdef/types.go` — `StatusWarning` (added by `2026-06-20-04`), severity helper home +- `server/internal/checkers/checkdomain/checker.go` — same pattern, share helper (follow-up wire-up) +- `web/dash0/src/routes/**` — SSL config form + check-detail chain rendering +- `docs/api-specification.md`, `docs/features/**` — config keys + output shape +- `docs/competitors/maintenant.md` — source of the requirement diff --git a/specs/todos/2026-06-20-02-docker-restart-loop-detection.md b/specs/todos/2026-06-20-02-docker-restart-loop-detection.md new file mode 100644 index 000000000..463d6e064 --- /dev/null +++ b/specs/todos/2026-06-20-02-docker-restart-loop-detection.md @@ -0,0 +1,193 @@ +# Docker check — restart-loop (crash-loop) detection + +## Context + +Inspired by the Maintenant competitor analysis ([`docs/competitors/maintenant.md`](../../docs/competitors/maintenant.md)), +which lists **restart-loop detection** as one of its container-observability strengths. +SolidPing's Docker check today reports container state and health but does **not** flag a +crash-looping container that is *technically running*: + +- `buildResult` reads `info.RestartCount` into `metrics["restartCount"]` + ([`checkdocker/checker.go:156`](../../server/internal/checkers/checkdocker/checker.go)) and + `info.State.StartedAt` into `output["startedAt"]` + ([`checkdocker/checker.go:149`](../../server/internal/checkers/checkdocker/checker.go)). +- Status is `StatusDown` only when the container is **not running** + ([lines 158-167](../../server/internal/checkers/checkdocker/checker.go)) or **unhealthy** + ([lines 169-178](../../server/internal/checkers/checkdocker/checker.go)). A container that + restarts every 20s but is "running" at inspect time reports **`StatusUp`**. + +Two architectural facts that shape this: + +1. **`RestartCount` is cumulative for the container's lifetime**, and a single Docker + `ContainerInspect` is a point-in-time snapshot. One inspect cannot, by itself, tell you the + restart *rate* — only the lifetime total and when the current run started. +2. **Checkers are stateless and run on distributed workers.** `Execute(ctx, config)` receives + only the config ([`checkerdef` interface](../../server/internal/checkers/checkerdef/interface.go)) — + no previous result, no per-check memory. The worker returns a `Result`; history lives + server-side in the `results` table (`metrics.restartCount` is persisted per raw row). +3. **There is no "warning" / "degraded" status** — only `Up/Down/Timeout/Error` + ([`checkerdef/types.go:13-17`](../../server/internal/checkers/checkerdef/types.go)). + +## My honest opinion + +"Detect a restart loop" sounds simple but the architecture forces a real choice, so here it is. + +A restart *loop* is fundamentally a **rate** ("≥ K restarts in the last N minutes"). The clean +way to measure a rate is a delta over time — which we cannot get from one stateless inspect. +There are three viable approaches: + +- **A — checker-local heuristic (no history).** Inside `buildResult`, flag a loop when the + container is `Running` **and** it (re)started very recently (`now - StartedAt <= window`) + **and** `RestartCount >= minRestarts`. Rationale: an *actively* looping container always shows + a freshly-recent `StartedAt` at inspect time, while a long-stable container does not — so the + recency guard is what actually carries the signal, and the count floor stops the first + legitimate restart (a deploy) from tripping it. + - **Pro:** fits the stateless-worker model exactly, zero schema, zero plumbing, flows through + the existing status → incident pipeline for free. + - **Con:** heuristic. A single deploy restart on a container with a high *lifetime* count can + false-positive for **one** interval (it self-clears next check, because `StartedAt` ages out + of the window). A brand-new container looping from birth is caught only once its lifetime + count crosses `minRestarts` (a few cycles of lag). + +- **B — server-side delta over `results` history (accurate).** On Docker-result ingest, compare + the new `restartCount` to the most recent prior Docker result for that check within `window`; + if `delta >= K`, it's a loop. True rate, reuses already-persisted data. + - **Pro:** accurate; no false positive on a single restart. + - **Con:** lives in the generic result-ingest path; status is already decided by the worker, so + raising a loop signal means **either** mutating status post-hoc (awkward, and there's no + warning status) **or** raising an incident independently of status — more plumbing, and it + blurs the "checker decides status" boundary. + +- **C — thread previous state into the job (accurate, in-checker).** Pass the last known + `restartCount` to the worker via the job context so the checker computes the delta locally. + - **Pro:** keeps the decision in the checker, accurate. + - **Con:** new plumbing to carry prior state into `check_jobs`/job config for one check type. + +**My recommendation: ship A as the MVP, scope B as the accurate V2.** A delivers the feature +the competitor has and fits SolidPing's architecture with the least risk. A flapping container +*is* "unhealthy but (intermittently) up" — exactly what the new `StatusWarning`/`Degraded` state +(from [`2026-06-20-04`](2026-06-20-04-status-warning-degraded.md)) is for: it shows amber, counts +as up for availability, and doesn't page or manufacture a false outage. So a *detected loop on a +currently-running container* → `StatusWarning`; a container that's actually not-running/unhealthy +still → `StatusDown` (and pages) as today. The one-interval false positive on a deploy is real +but self-healing, and because warning doesn't page, a stray flag costs nothing. If A's accuracy +proves insufficient, B is the correct upgrade (scoped below). The A-vs-B and Warning-vs-Down calls +are decisions for you (below). + +## Goals + +- A Docker check whose container is *running* but **crash-looping** is detected and surfaced. +- Detection is **configurable and opt-in** (thresholds in check config; disabled by default so + existing Docker checks don't change behaviour). +- The loop is **observable** in the result output (`restartLoop: true`, `restartCount`, + `secondsSinceStart`) so the dashboard can explain *why* the check is degraded. +- No DB migration for the MVP (approach A). + +## Dependency + +- **[`2026-06-20-04` (first-class `StatusWarning`)](2026-06-20-04-status-warning-degraded.md) + lands first** (assuming the recommended Warning outcome). It supplies the `Degraded` status and + its availability/incident semantics. If you choose `StatusDown` for loops instead (open + question 2), this dependency drops and the change is self-contained. + +## Out of scope + +- Approach B/C (true rate via history or threaded state) — the accurate V2, scoped here but not + built. Pick this up if A's heuristic proves too noisy. +- The rest of Maintenant's container observability (live CPU/mem/net/disk, log streaming, image + update detection, Compose grouping) — deliberately **not** pursued; that's a different product + surface (see the Maintenant analysis "takeaways"). + +## Design (Approach A — MVP) + +### Config (`checkdocker/config.go`) + +```go +type DockerConfig struct { + Host string `json:"host,omitempty"` + ContainerName string `json:"containerName,omitempty"` + ContainerID string `json:"containerId,omitempty"` + Timeout time.Duration `json:"timeout,omitempty"` + // Restart-loop detection (opt-in). RestartLoopMinRestarts == 0 → disabled. + RestartLoopMinRestarts int `json:"restartLoopMinRestarts,omitempty"` // e.g. 3 + RestartLoopWindow time.Duration `json:"restartLoopWindow,omitempty"` // e.g. 120s +} +``` + +Defaults: detection **off** unless `restartLoopMinRestarts > 0`. When enabled and +`restartLoopWindow == 0`, default to `120s`. Validate window `<= maxTimeout`-style sane bound and +`minRestarts >= 0`. + +### Execution (`checkdocker/checker.go`) + +In `buildResult`, after the existing not-running / unhealthy checks pass (container is running +and healthy), add: + +```go +if cfg.RestartLoopMinRestarts > 0 && info.State.Running { + started, _ := time.Parse(time.RFC3339Nano, info.State.StartedAt) + sinceStart := time.Since(started) + output["secondsSinceStart"] = sinceStart.Seconds() + if info.RestartCount >= cfg.RestartLoopMinRestarts && sinceStart <= cfg.RestartLoopWindow { + output["restartLoop"] = true + output["error"] = fmt.Sprintf( + "restart loop suspected: %d restarts, last start %s ago", + info.RestartCount, sinceStart.Round(time.Second)) + // StatusWarning (Degraded) per 2026-06-20-04; use StatusDown if you chose to page. + return &checkerdef.Result{Status: checkerdef.StatusWarning, ...} + } +} +``` + +`buildResult` needs access to `cfg` (currently it doesn't receive it) — pass the resolved config +in, or pass the two thresholds. `metrics["restartCount"]` stays as today; add +`output["secondsSinceStart"]` always (cheap, useful) so the dashboard can show flap context even +when not yet over threshold. + +## Implementation + +1. **`checkdocker/config.go`**: add the two fields, `FromMap` parsing (string duration like the + existing `timeout`), `GetConfig`, validation. +2. **`checkdocker/checker.go`**: thread config into `buildResult`; parse `StartedAt`; add the + loop branch + `secondsSinceStart` output. +3. **Frontend (`web/dash0`)**: Docker check config form exposes the two fields (advanced + section); check-detail surfaces `restartLoop` / `restartCount` / `secondsSinceStart`. Verify + against the design reference and reuse existing primitives. +4. **Docs**: update the Docker check section of [`docs/api-specification.md`](../../docs/api-specification.md) + and any container feature page under `docs/features/`. + +## Open questions / decisions for the user + +1. **Approach A (heuristic, this spec) vs B (server-side delta over history)?** A ships fast and + fits the architecture; B is accurate but more invasive and needs an incident-without-status + path. Default in this spec is A. +2. **Loop ⇒ `StatusWarning`/Degraded (visible, no page — recommended, depends on + `2026-06-20-04`) or `StatusDown` (pages)?** Spec assumes Warning: a flapping-but-running + container is "unhealthy but up," and warning shows amber without a false outage. Choose Down if + a crash-loop should page immediately (then this spec has no dependency on `2026-06-20-04`). +3. **Default thresholds** when enabled: `minRestarts = 3`, `window = 120s` — reasonable for + typical backoff loops? Loops with long backoff (minutes) would need a wider window. + +## Verification + +- **Unit (table-driven, `testify/require`, `t.Parallel()`):** drive `buildResult` with synthetic + `container.InspectResponse` values: + - Running, `RestartCount >= min`, `StartedAt` within window → `StatusWarning`, `restartLoop=true`. + - Running, high `RestartCount` but `StartedAt` **older** than window → `StatusUp` (proves the + recency guard; the deploy-with-old-high-count case self-clears). + - Running, recent start but `RestartCount < min` → `StatusUp` (proves the count floor). + - Detection disabled (`minRestarts == 0`) → behaviour byte-for-byte as today. + - Not-running / unhealthy still short-circuit to `StatusDown` before the loop branch. +- **Manual:** run a container with `--restart=always` and a command that exits immediately + (`sh -c 'exit 1'`); point a Docker check at it with detection enabled; confirm it flips to + Degraded (amber) with `restartLoop` and the reason in output, and uptime is unaffected. +- `make lint` / `make test`; `make test-dash` if the form changes. + +## Files referenced + +- `server/internal/checkers/checkdocker/config.go` — restart-loop config fields +- `server/internal/checkers/checkdocker/checker.go` — detection in `buildResult` +- `server/internal/checkers/checkerdef/types.go` — `StatusWarning` returned for loops (added by `2026-06-20-04`) +- `web/dash0/src/routes/**` — Docker config form + check-detail output +- `docs/api-specification.md`, `docs/features/**` — config + output shape +- `docs/competitors/maintenant.md` — source of the requirement diff --git a/specs/todos/2026-06-20-03-mcp-oauth2-authorization.md b/specs/todos/2026-06-20-03-mcp-oauth2-authorization.md new file mode 100644 index 000000000..7b54f9df4 --- /dev/null +++ b/specs/todos/2026-06-20-03-mcp-oauth2-authorization.md @@ -0,0 +1,178 @@ +# OAuth 2.1 authorization for the MCP endpoint + +## Context + +Inspired by the Maintenant competitor analysis ([`docs/competitors/maintenant.md`](../../docs/competitors/maintenant.md)): +both products ship an MCP server (a rare overlap), but Maintenant lists **OAuth2 on the MCP +endpoint** as an advantage. SolidPing's MCP auth today is bearer-token only: + +- MCP is mounted at `POST /api/v1/mcp` under `authMiddleware.RequireAuth` + ([`app/server.go:486-487`](../../server/internal/app/server.go)). +- The handler reads claims from context and requires the **`mcp`** or **`mcp:read`** scope + ([`mcp/handler.go:149-158`](../../server/internal/mcp/handler.go), + [`mcp/scope.go`](../../server/internal/mcp/scope.go)). The token is a normal SolidPing JWT/PAT + whose scopes live in `Claims.Scopes` ([`handlers/auth/service.go:140-145`](../../server/internal/handlers/auth/service.go)). +- Transport is MCP **Streamable HTTP**, protocol `2025-03-26`, session via `Mcp-Session-Id` + ([`mcp/handler.go:39-63`, `241`](../../server/internal/mcp/handler.go)). + +What this means in practice: a user must **manually mint a PAT** with the `mcp` scope and paste +it into their MCP client as a static bearer token. That works, but **no standard MCP client can +self-onboard** — Claude Desktop / claude.ai remote connectors / `mcp-remote` expect the MCP +**OAuth 2.1 authorization flow** (discovery → authorize → token), not a hand-pasted secret. + +**SolidPing is currently an OAuth *client*, not an authorization *server*.** It does social +login *as a client* (Slack/Google/GitHub — [`app/server.go:420-440`](../../server/internal/app/server.go)), +but exposes **no** `/.well-known/oauth-*` endpoints (grep is negative) and issues no +authorization-code grants to third-party apps. So this is net-new authorization-server work. + +### What the MCP authorization spec requires + +Per the MCP authorization spec (rev `2025-03-26`, hardened in `2025-06-18`), the MCP server is an +**OAuth 2.0 Resource Server** and clients drive an **OAuth 2.1** flow: + +1. **Protected Resource Metadata** (RFC 9728) at + `/.well-known/oauth-protected-resource`, listing the `authorization_servers`. +2. On an unauthenticated request, **`401` with `WWW-Authenticate: Bearer + resource_metadata="…/.well-known/oauth-protected-resource"`** so the client can discover (2). +3. **Authorization Server Metadata** (RFC 8414) at `/.well-known/oauth-authorization-server` + (clients also probe `/.well-known/openid-configuration`). +4. **Authorization Code + PKCE** (`S256`) — no implicit grant. +5. **Resource Indicators** (RFC 8707): the `resource` parameter binds the issued token's + **audience** to this MCP server so a token for one resource can't be replayed at another. +6. **Dynamic Client Registration** (RFC 7591) at a `registration_endpoint` — Claude Desktop and + `mcp-remote` have no pre-issued `client_id`, so without DCR they cannot connect at all. + +## My honest opinion + +You asked for "OAuth2 for MCP." Here's the shape I'd commit to. + +**1. Make SolidPing a *minimal embedded* OAuth 2.1 AS for the MCP resource — don't delegate.** +SolidPing is self-hosted-first and must work with **no external IdP**. So the authorization +server should be SolidPing itself: reuse the **existing user login/session** for the +`/authorize` step (+ a consent screen), and reuse the **existing JWT + `Claims.Scopes` +machinery** ([`handlers/auth/service.go`](../../server/internal/handlers/auth/service.go)) to mint +access tokens carrying `mcp` / `mcp:read`. We are not building a general-purpose OAuth provider — +just the slice MCP needs. Delegation to an org's external IdP is a *later* option, not v1. + +**2. OAuth is additive — keep the PAT-bearer path working.** Existing setups that paste an +`mcp`-scoped PAT must keep working unchanged. The MCP handler already accepts any valid +JWT/PAT with the right scope; OAuth just adds a second, self-service way to *obtain* such a token. + +**3. Phase it, because this is genuinely large.** The single most valuable early slice is +**discovery + audience-bound validation** (clients can *see* that OAuth exists and tokens are +correctly scoped to the MCP resource). The authorization endpoints + DCR are the heavier lifts. +A half-built AS is a security liability, so each phase must be complete on its own. + +**4. DCR is not optional if the goal is "Claude Desktop just works."** Targeting those clients +*requires* RFC 7591. If we only want first-party / scripted clients, we can skip DCR and use +pre-registered clients — that's the key scoping decision below. + +**5. This needs a security review.** We'd be turning SolidPing into a token issuer for external +clients: PKCE enforcement, redirect-URI validation (incl. the loopback exception native clients +need), consent, audience binding, short-lived tokens + refresh rotation. Flagged explicitly. + +## Goals + +- Standard MCP clients can connect to `/api/v1/mcp` via the OAuth 2.1 flow with **no + hand-pasted token**. +- The MCP endpoint behaves as a proper OAuth Resource Server: 401 + `WWW-Authenticate` + discovery pointer, audience-bound token validation. +- Tokens issued through the flow carry `mcp` / `mcp:read` (consented) and are audience-bound to + the MCP resource. +- Existing PAT-bearer auth keeps working (back-compat). + +## Out of scope + +- A general-purpose OAuth 2.1 authorization server for arbitrary third-party apps beyond MCP. +- Delegating MCP auth to an org's external IdP (Google/GitHub/OIDC) — a later option. +- Replacing the dashboard's existing JWT/refresh session auth. +- SCIM / enterprise SSO. + +## Design (phased) + +### Phase 1 — Resource Server discovery + audience validation (no new grants) + +- Serve **Protected Resource Metadata** at `/.well-known/oauth-protected-resource` (public, no + auth) advertising `resource` = the MCP URL and `authorization_servers` = SolidPing's issuer. +- In the MCP auth path, when auth is missing/invalid, return **`401` with `WWW-Authenticate: + Bearer resource_metadata="…"`** (today it returns a plain 401 JSON at + [`mcp/handler.go:149-153`](../../server/internal/mcp/handler.go)). This is the discovery hook. +- Extend token validation so MCP access tokens are **audience-checked** against the MCP resource + (RFC 8707). PATs (which have no `aud`) continue to pass via the existing scope check for + back-compat. + +### Phase 2 — Embedded authorization server + +- `/.well-known/oauth-authorization-server` (RFC 8414) advertising `authorization_endpoint`, + `token_endpoint`, `jwks_uri`, supported PKCE methods (`S256`), grant types (`authorization_code`, + `refresh_token`), scopes (`mcp`, `mcp:read`). +- **`/authorize`**: requires a logged-in SolidPing user (reuse existing session/login, redirect + to login with `returnTo` if absent — mirrors the frontend 401 convention); shows a **consent** + screen ("Grant access to MCP — read-only / read-write"); validates `client_id`, + `redirect_uri`, `code_challenge` (PKCE required), `resource`, `scope`; issues an auth code bound + to all of them. +- **`/token`**: exchanges code + `code_verifier` for an access token (existing JWT format, `aud` = + MCP resource, scopes = consented, short TTL) + refresh token (rotating). Reuse the auth + service's signing. +- **`jwks_uri`**: publish the JWT verification key(s) (decision: reuse the existing JWT signing + key vs introduce JWKS). +- Persist clients, auth codes, and refresh grants (new tables; codes single-use + short-lived). + +### Phase 3 — Dynamic Client Registration (RFC 7591) + +- `registration_endpoint` accepting `redirect_uris`, `client_name`, etc.; returns + `client_id` (+ optional secret for confidential clients). Native MCP clients are **public** + clients using PKCE + **loopback** redirects (`http://127.0.0.1:*` / `http://localhost:*`) — the + redirect-URI validator must allow the loopback exception while rejecting everything else. + +## Security considerations + +- **PKCE `S256` mandatory**; reject missing/`plain` challenges. +- **Redirect-URI allow-listing** with the loopback exception for native clients; exact-match for + registered web clients. +- **Audience binding** (RFC 8707) so MCP tokens can't be replayed at other SolidPing surfaces. +- **Consent** on every new client/scope grant; show requested scope clearly. +- **Short-lived access tokens**, **rotating refresh tokens**, revocation on logout/PAT-revoke. +- Single-use, short-TTL authorization codes; bind code → client → redirect → challenge → resource. +- Rate-limit `/authorize`, `/token`, `/register` (existing rate-limit middleware). + +## Open questions / decisions for the user + +1. **Embedded AS (recommended) vs delegate to external IdP?** Spec assumes embedded. +2. **DCR in scope?** Required for Claude Desktop / `mcp-remote` to "just work"; skip it and we're + limited to pre-registered/first-party clients. This is the biggest scoping lever. +3. **Self-hosted only, or SaaS too?** Affects issuer URLs, multi-tenant `client_id` isolation, + and whether DCR is open or admin-gated. +4. **Reuse the existing JWT signing key, or introduce a JWKS keyset** for the resource server? +5. **Which client do we validate against first** — claude.ai remote connector, Claude Desktop, or + the `mcp-remote` bridge? Drives which quirks (loopback, DCR, metadata probes) we must satisfy + on day one. +6. **Per-org issuer vs single issuer** — the MCP handler scopes everything to `claims.OrgSlug`; + decide how the org is selected during `/authorize` (the logged-in user's org). + +## Verification + +- **Discovery:** the two `.well-known` docs validate (e.g. against the MCP Inspector / an OAuth + metadata validator); an unauthenticated MCP request returns 401 with a correct + `WWW-Authenticate: resource_metadata` pointer. +- **End-to-end:** a real MCP client (target chosen in Q5) completes + discover → register (if DCR) → authorize+consent → token → call a tool, with **no pasted + token**; a `mcp:read` consent is refused on a mutating tool + ([`mcp/handler.go:276-280`](../../server/internal/mcp/handler.go)). +- **Security tests (table-driven, `testify/require`, `t.Parallel()`):** missing PKCE rejected; + reused/expired auth code rejected; wrong/blocked `redirect_uri` rejected; token with wrong + `aud` rejected at the MCP endpoint; refresh rotation invalidates the prior refresh token. +- **Back-compat:** an `mcp`-scoped PAT pasted as a bearer token still works. +- `make lint` / `make test`; `make test-dash` for the consent UI. + +## Files referenced + +- `server/internal/app/server.go` — MCP mount (`:486-487`); new `.well-known` + `/authorize` / + `/token` / `/register` routes (public + session-gated) +- `server/internal/mcp/handler.go` — 401 `WWW-Authenticate`, audience validation +- `server/internal/mcp/scope.go` — `mcp` / `mcp:read` scope mapping (reused for consent) +- `server/internal/handlers/auth/service.go` — JWT/claims/scope issuance to reuse for tokens +- `server/internal/middleware/auth.go` — `RequireAuth`, claims extraction +- New: OAuth AS package (metadata, authorize, token, DCR) + tables (clients, auth codes, refresh) +- `docs/api-specification.md` — document the OAuth endpoints + discovery +- `docs/competitors/maintenant.md` — source of the requirement diff --git a/specs/todos/2026-06-20-04-status-warning-degraded.md b/specs/todos/2026-06-20-04-status-warning-degraded.md new file mode 100644 index 000000000..600e3727b --- /dev/null +++ b/specs/todos/2026-06-20-04-status-warning-degraded.md @@ -0,0 +1,200 @@ +# First-class `StatusWarning` (degraded-but-up) check status + +## Context + +The SSL graduated-expiry spec ([`2026-06-20-01`](2026-06-20-01-ssl-graduated-expiry-and-chain-reporting.md)) +and the Docker restart-loop spec ([`2026-06-20-02`](2026-06-20-02-docker-restart-loop-detection.md)) +both need to express **"unhealthy but technically up"** — a cert expiring soon, a container +that's running but flapping. The status enum has no such value today, so both specs originally +worked around it with output flags. **Decision taken: add a first-class warning status now**, so +the degraded state is real in the UI, availability, and incident logic — and the other two specs +build on it instead of faking it. + +There are **three** distinct status concepts in the code; only one needs a new *value*, the other +two need an aligned addition: + +1. **`checkerdef.Status`** (what a checker returns, per execution) — + `Created=1, Running=2, Up=3, Down=4, Timeout=5, Error=6` + ([`checkerdef/types.go:12-18`](../../server/internal/checkers/checkerdef/types.go), + `String()` at `:31-46`, string consts at `:21-28`). **No predicate helpers** (no IsUp/IsDown). +2. **`models.ResultStatus`** (the persisted `results.status`) — mirrors the above + ([`db/models/result.go:12-25`](../../server/internal/db/models/result.go), + `StatusToString()` at `:36-53`). +3. **`models.CheckStatus`** (the *visible* current status on the `checks` row) — + `Created=1, Up=3, Down=4, Validating=5, **Degraded=7**` + ([`db/models/check.go:14-28`](../../server/internal/db/models/check.go), `String()` at `:34-47`). + **`CheckStatusDegraded = 7` already exists** — the visible degraded slot was reserved ahead of + time. This is the big de-risker. + +### What's already in our favour + +- **`checks.status` has no DB CHECK constraint** (`pg 001:326` is just + `smallint not null default 0`; the comment at `pg 001:360` is stale — it predates `Degraded`). + So the visible degraded status needs **no migration**. +- **The frontend already half-handles `"warning"` / `"degraded"`:** + - dash0 status badge already maps `"warning"` to the amber variant + ([`status-badge.tsx:29`](../../web/dash0/src/components/shared/status-badge.tsx)). + - status0 public page already maps `"warning"`/`"degraded"` to colour, badge, and label + ([`status-page-view.tsx:22-67`](../../web/status0/src/components/shared/status-page-view.tsx)). + - `statuspages` backend already serialises `CheckStatusDegraded` + ([`statuspages/service.go:1412-1426`](../../server/internal/handlers/statuspages/service.go)). + +### What's NOT in our favour + +- **`results.status` HAS a CHECK constraint that must be widened** — and it's currently *wrong*: + `check (status in (0, 1, 2, 3, 4, 5))` in **both** dialects + ([`pg 001:440`](../../server/internal/db/postgres/migrations/001_v0_1_0.up.sql), + [`sqlite 001:340`](../../server/internal/db/sqlite/migrations/001_v0_1_0.up.sql)). Note it + **excludes `Error = 6`** even though that's a live enum value — a latent bug to fix in the same + change (see "Migration"). +- **Incidents have no severity/kind** — the table is essentially binary "check went down → open + incident, recovered → resolve" ([`incidents table 001:512-540`](../../server/internal/db/postgres/migrations/001_v0_1_0.up.sql), + fields: `state`, `failure_count`, `paging_suppressed`, `resolution_type` — **no `severity`**). + So "a warning incident vs an outage incident" cannot be expressed without either a new field or + reusing `paging_suppressed`. + +## My honest opinion + +You picked the harder-but-correct option, and it's more tractable than it looks because the +*visible* slot (`CheckStatusDegraded = 7`) and most of the frontend are already there. The work is +really: (a) add the value to the two execution-level enums, (b) widen one DB constraint, (c) make +**two product decisions**, and (d) close the handful of frontend/integration switch gaps the +existing code missed. The two decisions are what actually matter: + +**Decision A — Availability: warning counts as UP (recommended).** A cert expiring in 20 days or a +container that restarted twice is *reachable and serving*. Counting it against uptime would crater +SLAs for non-outages and make "availability" meaningless. So a `StatusWarning` raw result should +increment `successCount` for `availability_pct` +([`job_aggregation.go:747`](../../server/internal/jobs/jobtypes/job_aggregation.go)). Degradation +is surfaced through the *status*, not by lying about uptime. + +**Decision B — Incidents: warning is NEUTRAL in v1 (recommended).** Opening a full incident for a +warning would page people for non-outages (incidents have no severity to soften them). So in v1 a +warning result **neither opens nor resolves** an incident — it only drives the *visible* status to +`Degraded` and the streak. Concretely, the classifier at +[`incidents/service.go:163-168`](../../server/internal/handlers/incidents/service.go) becomes +**three-way**: success (Up) → may resolve; failure (Down/Timeout/Error) → may open; warning → +neither. **Critical ordering caveat:** today the function early-returns `nil` when a result is +neither success nor failure (`:168`); we must make sure the **visible-status update to `Degraded` +still happens** for warning results and isn't skipped by that early return. A warning arriving +during an open outage must **not** resolve it (warning ≠ success). + +**On notifications:** because v1 keeps warning incident-neutral, there is **no automatic +notification** on entering the warning state — degradation is visible in the dashboard/status +page, and you still get paged when it eventually becomes a real `Down` (e.g. the cert actually +expires → handshake fails → Down → incident). If we want "warn me early" alerts, the clean +follow-up is a *non-paging* incident using the existing `paging_suppressed` flag (or a new +`severity`), scoped out below. I'd ship v1 incident-neutral and add warning-notifications as a +deliberate next step rather than smuggling paging semantics in now. + +## Goals + +- Add `StatusWarning = 7` to `checkerdef.Status` and `ResultStatusWarning = 7` to + `models.ResultStatus`, mapping a warning *result* to the already-reserved visible + `CheckStatusDegraded = 7`. +- Widen the `results.status` CHECK constraint to accept `7` (and fix the missing `6`) in both + dialects. +- Availability: warning counts as up (Decision A). +- Incidents: warning is neutral — no open, no resolve — but the visible status becomes `Degraded` + (Decision B), without breaking outage open/resolve for the real failure statuses. +- Close every remaining status switch/map that doesn't yet handle warning (backend + frontend). +- No change to checker behaviour except that checkers *may now return* `StatusWarning`. + +## Out of scope + +- Wiring SSL ([`2026-06-20-01`](2026-06-20-01-ssl-graduated-expiry-and-chain-reporting.md)) and + restart-loop ([`2026-06-20-02`](2026-06-20-02-docker-restart-loop-detection.md)) to actually + *emit* `StatusWarning` — those specs own that; this one just makes the status exist and behave. +- **Warning notifications** (paging-suppressed/“degraded-severity” incidents, or a dedicated + degraded notification path). Deliberate follow-up; v1 is incident-neutral. +- An incident `severity` column. (Mentioned as the cleaner long-term home for warning alerts.) + +## Design + +### Backend enums +- `checkerdef/types.go`: `StatusWarning Status = 7`, `statusStrWarning = "warning"`, add the + `String()` case (`:31-46`). +- `db/models/result.go`: `ResultStatusWarning ResultStatus = 7`, add `StatusToString()` case + (`:36-53`, returns `"WARNING"`). +- Mapping result→visible: wherever a raw result status is turned into the check's visible + `CheckStatus`, map `ResultStatusWarning → CheckStatusDegraded` (the `pickStatus`-style logic + around [`incidents/service.go:317-328`](../../server/internal/handlers/incidents/service.go)). + +### Availability (Decision A) +- [`job_aggregation.go:747`](../../server/internal/jobs/jobtypes/job_aggregation.go): count + `ResultStatusUp` **or** `ResultStatusWarning` toward `successCount`; the downstream + `availability_pct` / rollup math follows automatically. + +### Incidents (Decision B) +- [`incidents/service.go:163-168`](../../server/internal/handlers/incidents/service.go): make the + classification three-way (success / warning-neutral / failure). Mirror at the streak/relapse + sites (`:275-285`). Ensure the **visible status + streak update runs for warning** and is not + short-circuited by the neutral early-return. + +### Integrations +- [`slack/mention_commands.go:428-435`](../../server/internal/integrations/slack/mention_commands.go): + add a `ResultStatusWarning` case (render as a distinct "warning"/"degraded" string, not "up" + or "down"). + +### Frontend gaps (the spots the existing partial support missed) +- status0 [`availability-bar.tsx:10-19`](../../web/status0/src/components/shared/availability-bar.tsx): + add `case "warning"` → amber (mirror the existing `"degraded"` case). +- status0 [`response-time-chart.tsx:33-43`](../../web/status0/src/components/shared/response-time-chart.tsx): + add `"warning"` colour. +- dash0 [`status-dashboard.tsx:46-59`](../../web/dash0/src/components/shared/status-dashboard.tsx): + add `case "warning"` → `"warning"` UI status. +- dash0 [`response-time-chart.tsx`](../../web/dash0/src/components/checks/response-time-chart.tsx): + decide warning = neutral (don't mark as a failure point on the chart). +- Already covered (verify only): dash0 `status-badge.tsx:29`, status0 `status-page-view.tsx:22-67`. + +### Migration +Per the consolidated-per-release convention (`server/CLAUDE.md`), and since only +`001_v0_1_0` exists despite many shipped features (e.g. `integrations`, `status_page_subscriber` +tables live in `001`) — i.e. `v0.1.0` is still being assembled in place — **amend the +`results.status` CHECK constraint in `001_v0_1_0.up.sql` for both dialects**: +`check (status in (0, 1, 2, 3, 4, 5, 6, 7))` — adding `7` (warning) **and** the missing `6` +(error). Confirm with the maintainer whether to amend `001` in place or cut a `002_v0_X_0` +release migration. `checks.status` needs **no** change (no constraint). + +## Open questions / decisions for the user + +1. **Availability** — confirm warning counts as **up** (recommended). The alternative (warning + counts against uptime) makes degraded states tank SLAs. +2. **Incidents** — confirm warning is **neutral** in v1 (recommended). Alternatives: warning + opens a `paging_suppressed` incident (notifies, doesn't page) now, or stays neutral and we add + that later. +3. **Constraint fix** — OK to also add the currently-missing `6` (error) to the `results.status` + constraint while widening it? (Strongly recommended; it looks like a latent bug.) +4. **Migration strategy** — amend `001` in place (matches current practice) or cut `002`? + +## Verification + +- **Unit/integration (table-driven, `testify/require`, `t.Parallel()`, SQLite + Postgres via + testcontainers):** + - A `StatusWarning` raw result **persists** (constraint accepts 7) — and an `Error` result + persists too (regression test for the previously-missing 6). + - Aggregation: a bucket of Up+Warning yields `availability_pct == 100` (Decision A). + - Incident-neutral: a warning result with **no** open incident → no incident created; with an + **open** outage incident → incident stays open (not resolved); the **visible** check status + becomes `Degraded` and the streak updates in both cases. + - A subsequent `Up` after warning resolves nothing-extra and clears `Degraded` → `Up`. + - `Status.String()` / `StatusToString()` round-trip `"warning"` / `"WARNING"`. +- **Frontend (`make test-dash`):** a check/resource in warning renders amber (badge, availability + bar, dashboard, public status page) and is labelled degraded, not down. +- **Manual:** temporarily make a checker return `StatusWarning`; confirm the check shows degraded + in dash0 and on a public status page, uptime stays 100%, and no incident/page fires. +- `make lint` / `make test` / `make test-dash` pass. + +## Files referenced + +- `server/internal/checkers/checkerdef/types.go` — `StatusWarning` value + `String()` +- `server/internal/db/models/result.go` — `ResultStatusWarning` + `StatusToString()` +- `server/internal/db/models/check.go` — `CheckStatusDegraded = 7` (already exists; map to it) +- `server/internal/jobs/jobtypes/job_aggregation.go` — availability counts warning as up (`:747`) +- `server/internal/handlers/incidents/service.go` — three-way classify; visible-status ordering +- `server/internal/handlers/statuspages/service.go` — already serialises Degraded (verify) +- `server/internal/integrations/slack/mention_commands.go` — warning display case (`:428-435`) +- `server/internal/db/{postgres,sqlite}/migrations/001_v0_1_0.up.sql` — widen results.status CHECK +- `web/dash0/src/components/shared/{status-badge,status-dashboard}.tsx`, + `web/status0/src/components/shared/{status-page-view,availability-bar,response-time-chart}.tsx` + — warning rendering gaps From 34539111bf9afe7aa4aa032d1fd4abb957331d7b Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 02:17:36 +0200 Subject: [PATCH 02/67] docs(specs): validate & revise StatusWarning spec against code MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Code-verified every claim in 2026-06-20-04 against the tree and folded in corrections: - checkerdef.Status has no Created (starts Running=2) - new finding: aggregation rollup tie-break (calculateDominantStatus) ranks by raw status number, so Warning=7 would mask outages — add Severity() helper + severity-aware tie-break (Decision D) - frontend wire string is split between "warning" and "degraded"; standardise on "degraded" + one shared statusStyle() util (Decision C); per-file table, plus two previously-missed components (status-timeline, check-summary-cards) - incident classifier early-returns before the visible-status update; warning needs a third path modelled on the display-only CheckStatusValidating - slack statusIntToString currently maps warning to "unknown" Co-Authored-By: Claude Opus 4.8 --- .../2026-06-20-04-status-warning-degraded.md | 338 ++++++++++-------- 1 file changed, 195 insertions(+), 143 deletions(-) diff --git a/specs/todos/2026-06-20-04-status-warning-degraded.md b/specs/todos/2026-06-20-04-status-warning-degraded.md index 600e3727b..f2c2a0100 100644 --- a/specs/todos/2026-06-20-04-status-warning-degraded.md +++ b/specs/todos/2026-06-20-04-status-warning-degraded.md @@ -1,200 +1,252 @@ # First-class `StatusWarning` (degraded-but-up) check status +> **Code-verified 2026-06-20.** Every file:line and design choice below was checked against the +> current tree. Corrections folded in from the validation pass (see **Validation log** at the end); +> the most consequential were: `checkerdef.Status` has **no** `Created`; the aggregation rollup +> tie-break (`calculateDominantStatus`) ranks by raw status number and `Warning=7` would mask +> outages; the frontend wire string is **split** between `"warning"` and `"degraded"`; and the +> incident classifier early-returns *before* the visible-status update. + ## Context The SSL graduated-expiry spec ([`2026-06-20-01`](2026-06-20-01-ssl-graduated-expiry-and-chain-reporting.md)) and the Docker restart-loop spec ([`2026-06-20-02`](2026-06-20-02-docker-restart-loop-detection.md)) both need to express **"unhealthy but technically up"** — a cert expiring soon, a container -that's running but flapping. The status enum has no such value today, so both specs originally -worked around it with output flags. **Decision taken: add a first-class warning status now**, so -the degraded state is real in the UI, availability, and incident logic — and the other two specs -build on it instead of faking it. +that's running but flapping. **Decision taken: add a first-class warning/degraded status now**, so +the state is real in the UI, availability, and incident logic, and the other two specs build on it. -There are **three** distinct status concepts in the code; only one needs a new *value*, the other -two need an aligned addition: +There are **three** distinct status concepts; they do **not** share the same set of values, which +matters: 1. **`checkerdef.Status`** (what a checker returns, per execution) — - `Created=1, Running=2, Up=3, Down=4, Timeout=5, Error=6` + `Running=2, Up=3, Down=4, Timeout=5, Error=6` (**no `Created`** — starts at `Running=2`) ([`checkerdef/types.go:12-18`](../../server/internal/checkers/checkerdef/types.go), - `String()` at `:31-46`, string consts at `:21-28`). **No predicate helpers** (no IsUp/IsDown). -2. **`models.ResultStatus`** (the persisted `results.status`) — mirrors the above + `String()` at `:31-46` → lowercase `"up"`/`"down"`/…, string consts at `:21-28`). + **No predicate/severity helpers** (no `IsUp`/`IsFailure`/`Severity`). +2. **`models.ResultStatus`** (the persisted `results.status`) — + `Created=1, Running=2, Up=3, Down=4, Timeout=5, Error=6` ([`db/models/result.go:12-25`](../../server/internal/db/models/result.go), - `StatusToString()` at `:36-53`). + `StatusToString()` at `:36-53` → UPPERCASE `"UP"`/`"DOWN"`/…). 3. **`models.CheckStatus`** (the *visible* current status on the `checks` row) — `Created=1, Up=3, Down=4, Validating=5, **Degraded=7**` - ([`db/models/check.go:14-28`](../../server/internal/db/models/check.go), `String()` at `:34-47`). - **`CheckStatusDegraded = 7` already exists** — the visible degraded slot was reserved ahead of - time. This is the big de-risker. + ([`db/models/check.go:14-28`](../../server/internal/db/models/check.go), `String()` at `:33-48` + → lowercase, **`Degraded` → `"degraded"`**). + - **`CheckStatusDegraded = 7` already exists** but is commented *"reserved for future use"* + (`check.go:26`) — defined and `String()`-mapped, not yet produced anywhere. The big de-risker. + - **`CheckStatusValidating = 5`** is the precedent to copy: a **display-only** status that + "never triggers notifications, never gates the incident state machine" (`check.go:21-25`). + Our `Degraded` mapping should follow exactly this pattern. ### What's already in our favour -- **`checks.status` has no DB CHECK constraint** (`pg 001:326` is just - `smallint not null default 0`; the comment at `pg 001:360` is stale — it predates `Degraded`). - So the visible degraded status needs **no migration**. -- **The frontend already half-handles `"warning"` / `"degraded"`:** - - dash0 status badge already maps `"warning"` to the amber variant - ([`status-badge.tsx:29`](../../web/dash0/src/components/shared/status-badge.tsx)). - - status0 public page already maps `"warning"`/`"degraded"` to colour, badge, and label - ([`status-page-view.tsx:22-67`](../../web/status0/src/components/shared/status-page-view.tsx)). - - `statuspages` backend already serialises `CheckStatusDegraded` - ([`statuspages/service.go:1412-1426`](../../server/internal/handlers/statuspages/service.go)). +- **`checks.status` has no DB CHECK constraint** (`pg 001:326` is `smallint not null default 0`; + the comment at `pg 001:360` is stale — it predates `Degraded`). The visible degraded status + needs **no migration**, and `CheckStatusValidating=5`/`Degraded=7` already round-trip. +- **Some of the frontend already renders a degraded/amber state** — but inconsistently (below). ### What's NOT in our favour -- **`results.status` HAS a CHECK constraint that must be widened** — and it's currently *wrong*: +- **`results.status` HAS a CHECK constraint to widen — and it's currently wrong.** `check (status in (0, 1, 2, 3, 4, 5))` in **both** dialects ([`pg 001:440`](../../server/internal/db/postgres/migrations/001_v0_1_0.up.sql), - [`sqlite 001:340`](../../server/internal/db/sqlite/migrations/001_v0_1_0.up.sql)). Note it - **excludes `Error = 6`** even though that's a live enum value — a latent bug to fix in the same - change (see "Migration"). -- **Incidents have no severity/kind** — the table is essentially binary "check went down → open - incident, recovered → resolve" ([`incidents table 001:512-540`](../../server/internal/db/postgres/migrations/001_v0_1_0.up.sql), - fields: `state`, `failure_count`, `paging_suppressed`, `resolution_type` — **no `severity`**). - So "a warning incident vs an outage incident" cannot be expressed without either a new field or - reusing `paging_suppressed`. + [`sqlite 001:340`](../../server/internal/db/sqlite/migrations/001_v0_1_0.up.sql)). It **excludes + `Error = 6`** despite that being a live value — a latent bug to fix in the same change. +- **Aggregation severity ranking breaks with `7`.** The rolled-up row status is + `calculateDominantStatus(statusCounts)` — most-frequent wins, **ties broken by higher status + number** (`job_aggregation.go:891`, used at `:347`, written to the row at `:936`). `Warning=7` + is numerically the **highest**, so on a count tie a bucket with both `Down(4)` and `Warning(7)` + rolls up to **Warning**, masking the outage. (`maxStatus` at `:744-745` has the same numeric + assumption but is computed-and-unused for the row status.) Numeric order no longer encodes + severity — needs an explicit severity rank. +- **The frontend wire string is split between `"warning"` and `"degraded"`** for the same state + (see Design → Frontend). There is no single status→style mapping; each component rolls its own. +- **Incidents have no severity/kind** — the table is binary "down → open, recover → resolve" + ([`incidents 001:512-540`](../../server/internal/db/postgres/migrations/001_v0_1_0.up.sql): + `state`, `failure_count`, `paging_suppressed`, `resolution_type` — **no `severity`**). A + "warning incident" can't be expressed without a new field or reusing `paging_suppressed`. ## My honest opinion -You picked the harder-but-correct option, and it's more tractable than it looks because the -*visible* slot (`CheckStatusDegraded = 7`) and most of the frontend are already there. The work is -really: (a) add the value to the two execution-level enums, (b) widen one DB constraint, (c) make -**two product decisions**, and (d) close the handful of frontend/integration switch gaps the -existing code missed. The two decisions are what actually matter: - -**Decision A — Availability: warning counts as UP (recommended).** A cert expiring in 20 days or a -container that restarted twice is *reachable and serving*. Counting it against uptime would crater -SLAs for non-outages and make "availability" meaningless. So a `StatusWarning` raw result should -increment `successCount` for `availability_pct` -([`job_aggregation.go:747`](../../server/internal/jobs/jobtypes/job_aggregation.go)). Degradation -is surfaced through the *status*, not by lying about uptime. - -**Decision B — Incidents: warning is NEUTRAL in v1 (recommended).** Opening a full incident for a -warning would page people for non-outages (incidents have no severity to soften them). So in v1 a -warning result **neither opens nor resolves** an incident — it only drives the *visible* status to -`Degraded` and the streak. Concretely, the classifier at -[`incidents/service.go:163-168`](../../server/internal/handlers/incidents/service.go) becomes -**three-way**: success (Up) → may resolve; failure (Down/Timeout/Error) → may open; warning → -neither. **Critical ordering caveat:** today the function early-returns `nil` when a result is -neither success nor failure (`:168`); we must make sure the **visible-status update to `Degraded` -still happens** for warning results and isn't skipped by that early return. A warning arriving -during an open outage must **not** resolve it (warning ≠ success). - -**On notifications:** because v1 keeps warning incident-neutral, there is **no automatic -notification** on entering the warning state — degradation is visible in the dashboard/status -page, and you still get paged when it eventually becomes a real `Down` (e.g. the cert actually -expires → handshake fails → Down → incident). If we want "warn me early" alerts, the clean -follow-up is a *non-paging* incident using the existing `paging_suppressed` flag (or a new -`severity`), scoped out below. I'd ship v1 incident-neutral and add warning-notifications as a -deliberate next step rather than smuggling paging semantics in now. +You picked the harder-but-correct option, and the *visible* slot (`CheckStatusDegraded`) plus the +`CheckStatusValidating` precedent make it tractable. The work is: (a) add the value to the two +execution-level enums, (b) widen one DB constraint, (c) make **four decisions**, (d) fix the +rollup severity ranking, and (e) unify the frontend status rendering. The decisions: + +**Decision A — Availability: warning counts as UP (recommended).** A cert 20 days out, or a +container that restarted twice, is *reachable and serving*. Counting it against uptime craters +SLAs for non-outages. So a warning raw result increments `successCount` for `availability_pct` +([`job_aggregation.go:747`](../../server/internal/jobs/jobtypes/job_aggregation.go)). + +**Decision B — Incidents: warning is NEUTRAL in v1 (recommended).** Incidents have no severity to +soften, so a warning must **not** open or resolve one — it only drives the visible status to +`Degraded`, exactly like `CheckStatusValidating` is display-only today. **Ordering caveat (real):** +in `ProcessCheckResult` the classifier `isSuccess`/`isFailure` +([`incidents/service.go:163-166`](../../server/internal/handlers/incidents/service.go)) +**early-returns `nil` at `:168-170`** *before* the visible-status update at `:181-194` +(`deriveCheckStatus` → `UpdateCheckStatusAndClocks`). A warning that is neither success nor failure +would hit that early return and **never become visible**. So warning needs a *third* path that +bypasses the early return, sets `Degraded` via `pickStatus` (`:313-328`), is **clock-neutral** in +`deriveIncidentClocks` (`:213-245`, arms neither the failure nor the recovery clock), and defines +the up↔degraded streak edges in `deriveStreakAndChange`/`deriveCheckStatus` (`:272-306`). A warning +arriving during an open outage must **not** resolve it. + +**Decision C — One wire string: `"degraded"` (recommended).** The visible status already +stringifies to `"degraded"` (`check.go:44`) and the public status page speaks `"degraded"`. The +constant can stay named `StatusWarning` (it names the *trigger*), but it should **stringify to +`"degraded"`** at every layer so the whole UI speaks one word — mirroring how `CheckStatusDegraded` +→ `"degraded"` already. (Alternative: name the new constants `*Degraded` for full top-to-bottom +alignment — cleaner, slightly more churn.) Treat any lingering `"warning"` string as a synonym. + +**Decision D — Severity ranking, not numeric order.** Add a small `Severity()`/rank helper (none +exist today) so "which status is worse" is explicit, and fix the dominant-status tie-break so +`Down/Timeout/Error` outrank `Warning`. + +**On notifications:** because v1 is incident-neutral there is **no automatic alert** on entering +warning — it's visible only, and you still get paged when it degrades to a real `Down`. The clean +follow-up for "warn me early" is a `paging_suppressed` incident (the column already exists) or an +incident `severity`; scoped out below. ## Goals - Add `StatusWarning = 7` to `checkerdef.Status` and `ResultStatusWarning = 7` to - `models.ResultStatus`, mapping a warning *result* to the already-reserved visible - `CheckStatusDegraded = 7`. + `models.ResultStatus`, both stringifying to **`"degraded"`**, mapping a warning *result* to the + already-reserved visible `CheckStatusDegraded = 7`. - Widen the `results.status` CHECK constraint to accept `7` (and fix the missing `6`) in both dialects. -- Availability: warning counts as up (Decision A). -- Incidents: warning is neutral — no open, no resolve — but the visible status becomes `Degraded` - (Decision B), without breaking outage open/resolve for the real failure statuses. -- Close every remaining status switch/map that doesn't yet handle warning (backend + frontend). -- No change to checker behaviour except that checkers *may now return* `StatusWarning`. +- Availability: warning counts as up (A). +- Incidents: warning is neutral — no open, no resolve — but visible status becomes `Degraded` (B), + via a third path that survives the success/failure early-return. +- Fix the aggregation rollup so `Warning` never outranks a real failure (D). +- Unify the frontend: one status→style mapping; every status surface renders `degraded` amber (C). +- No checker-behaviour change except that checkers *may now return* `StatusWarning`. ## Out of scope - Wiring SSL ([`2026-06-20-01`](2026-06-20-01-ssl-graduated-expiry-and-chain-reporting.md)) and - restart-loop ([`2026-06-20-02`](2026-06-20-02-docker-restart-loop-detection.md)) to actually - *emit* `StatusWarning` — those specs own that; this one just makes the status exist and behave. -- **Warning notifications** (paging-suppressed/“degraded-severity” incidents, or a dedicated - degraded notification path). Deliberate follow-up; v1 is incident-neutral. -- An incident `severity` column. (Mentioned as the cleaner long-term home for warning alerts.) + restart-loop ([`2026-06-20-02`](2026-06-20-02-docker-restart-loop-detection.md)) to *emit* + `StatusWarning` — those specs own that. +- **Warning notifications** (a `paging_suppressed`/degraded-severity incident, or a dedicated + notification path) and an incident `severity` column — deliberate follow-up; v1 is neutral. ## Design -### Backend enums -- `checkerdef/types.go`: `StatusWarning Status = 7`, `statusStrWarning = "warning"`, add the - `String()` case (`:31-46`). -- `db/models/result.go`: `ResultStatusWarning ResultStatus = 7`, add `StatusToString()` case - (`:36-53`, returns `"WARNING"`). -- Mapping result→visible: wherever a raw result status is turned into the check's visible - `CheckStatus`, map `ResultStatusWarning → CheckStatusDegraded` (the `pickStatus`-style logic - around [`incidents/service.go:317-328`](../../server/internal/handlers/incidents/service.go)). - -### Availability (Decision A) +### Backend enums + wire string (Decision C) +- `checkerdef/types.go`: `StatusWarning Status = 7`; add a `String()` case returning the shared + degraded label. +- `db/models/result.go`: `ResultStatusWarning ResultStatus = 7`; `StatusToString()` case → + `"DEGRADED"` (UPPERCASE, matching that function's convention). +- Map result→visible: `ResultStatusWarning → CheckStatusDegraded` in the visible-status path + (`pickStatus`, [`incidents/service.go:313-328`](../../server/internal/handlers/incidents/service.go)). +- Confirm the lowercase wire string `"degraded"` (not `"warning"`) is what reaches the frontend + for both check-level and result-level status, so the UI has one vocabulary. + +### Severity helper + availability (Decisions A, D) +- Add `func (s Status) Severity() int` (and/or `IsFailure()`) in `checkerdef` so severity is + explicit, with `Down/Timeout/Error` ranked **above** `Warning`. - [`job_aggregation.go:747`](../../server/internal/jobs/jobtypes/job_aggregation.go): count - `ResultStatusUp` **or** `ResultStatusWarning` toward `successCount`; the downstream - `availability_pct` / rollup math follows automatically. + `Up` **or** `Warning` toward `successCount`. +- [`calculateDominantStatus` (`:881-898`)](../../server/internal/jobs/jobtypes/job_aggregation.go): + replace the numeric tie-break (`status > dominantStatus`, `:891`) with the severity rank so a + `Down`/`Warning` count tie resolves to `Down`. (`maxStatus` at `:744-745`/`:807-808` is unused + for the row status — leave or remove, but don't let it reintroduce numeric severity.) ### Incidents (Decision B) -- [`incidents/service.go:163-168`](../../server/internal/handlers/incidents/service.go): make the - classification three-way (success / warning-neutral / failure). Mirror at the streak/relapse - sites (`:275-285`). Ensure the **visible status + streak update runs for warning** and is not - short-circuited by the neutral early-return. +- [`incidents/service.go`](../../server/internal/handlers/incidents/service.go): introduce a third + `isWarning` branch. It must **not** early-return at `:168-170`; instead run the visible-status + update (`deriveCheckStatus`/`UpdateCheckStatusAndClocks`, `:181-194`) with `pickStatus` returning + `CheckStatusDegraded`, keep `deriveIncidentClocks` (`:213-245`) clock-neutral for warning, and + define up↔degraded streak/`statusChangedAt` edges in `deriveStreakAndChange`/`deriveCheckStatus` + (`:272-306`). **Do not** call `routeCheckResultWithIncident` open/resolve logic for warning. + Model the whole thing on the existing display-only `CheckStatusValidating`. ### Integrations -- [`slack/mention_commands.go:428-435`](../../server/internal/integrations/slack/mention_commands.go): - add a `ResultStatusWarning` case (render as a distinct "warning"/"degraded" string, not "up" - or "down"). - -### Frontend gaps (the spots the existing partial support missed) -- status0 [`availability-bar.tsx:10-19`](../../web/status0/src/components/shared/availability-bar.tsx): - add `case "warning"` → amber (mirror the existing `"degraded"` case). -- status0 [`response-time-chart.tsx:33-43`](../../web/status0/src/components/shared/response-time-chart.tsx): - add `"warning"` colour. -- dash0 [`status-dashboard.tsx:46-59`](../../web/dash0/src/components/shared/status-dashboard.tsx): - add `case "warning"` → `"warning"` UI status. -- dash0 [`response-time-chart.tsx`](../../web/dash0/src/components/checks/response-time-chart.tsx): - decide warning = neutral (don't mark as a failure point on the chart). -- Already covered (verify only): dash0 `status-badge.tsx:29`, status0 `status-page-view.tsx:22-67`. +- [`slack/mention_commands.go` `statusIntToString` (~`:422-437`)](../../server/internal/integrations/slack/mention_commands.go): + warning currently falls to `"unknown"` (default). Add a `ResultStatusWarning` case returning a + distinct "degraded" string (add the constant alongside `statusUp`/`statusDown`). + +### Frontend — unify, don't patch (Decision C) +The status→style logic is duplicated across ~7 components with an inconsistent vocabulary. +**Recommended:** introduce one shared `statusStyle(status)` util per app (color, badge variant, +label key) keyed on the canonical `"degraded"` (treating `"warning"` as a synonym), and route +every surface through it. Current state per file (verified): + +| File | Today | Needs | +|---|---|---| +| dash0 `status-badge.tsx:29-34` | handles `"warning"`→validating label; **not** `"degraded"` | handle `"degraded"`; real degraded label | +| dash0 `status-dashboard.tsx:46-59` (`getCheckStatus`) | `"timeout"`→`"warning"`; no `"warning"`/`"degraded"` **input** | map degraded input → amber | +| dash0 `response-time-chart.tsx` (`:420-429`,`:642-645`) | non-neutral → red | treat degraded as neutral, not red | +| dash0 `status-timeline.tsx:44-50` | handles `"warning"`(yellow); **not** `"degraded"` | handle `"degraded"` | +| dash0 `check-summary-cards.tsx:58-62` | `isDown`=down/error/timeout; no degraded | degraded ≠ down | +| status0 `status-page-view.tsx:22-81` | **both** `"warning"`+`"degraded"` ✓ | verify only | +| status0 `availability-bar.tsx:9-20` | handles `"degraded"`; **not** `"warning"` | covered if string is `"degraded"`; add synonym | +| status0 `response-time-chart.tsx:33-44` | neither | add degraded color | ### Migration -Per the consolidated-per-release convention (`server/CLAUDE.md`), and since only -`001_v0_1_0` exists despite many shipped features (e.g. `integrations`, `status_page_subscriber` -tables live in `001`) — i.e. `v0.1.0` is still being assembled in place — **amend the -`results.status` CHECK constraint in `001_v0_1_0.up.sql` for both dialects**: -`check (status in (0, 1, 2, 3, 4, 5, 6, 7))` — adding `7` (warning) **and** the missing `6` -(error). Confirm with the maintainer whether to amend `001` in place or cut a `002_v0_X_0` -release migration. `checks.status` needs **no** change (no constraint). +Per the consolidated-per-release convention (`server/CLAUDE.md`), and since only `001_v0_1_0` +exists despite many shipped features (`integrations`, `status_page_subscriber` tables live in +`001`) — v0.1.0 is still being assembled in place — **amend the `results.status` CHECK constraint +in `001_v0_1_0.up.sql` for both dialects**: `check (status in (0, 1, 2, 3, 4, 5, 6, 7))` — adding +`7` (degraded) **and** the missing `6` (error). Confirm whether to amend `001` in place or cut a +`002_v0_X_0` release migration. `checks.status` needs **no** change (no constraint). ## Open questions / decisions for the user -1. **Availability** — confirm warning counts as **up** (recommended). The alternative (warning - counts against uptime) makes degraded states tank SLAs. -2. **Incidents** — confirm warning is **neutral** in v1 (recommended). Alternatives: warning - opens a `paging_suppressed` incident (notifies, doesn't page) now, or stays neutral and we add - that later. -3. **Constraint fix** — OK to also add the currently-missing `6` (error) to the `results.status` - constraint while widening it? (Strongly recommended; it looks like a latent bug.) -4. **Migration strategy** — amend `001` in place (matches current practice) or cut `002`? +1. **Availability** — warning counts as **up**? (recommended; alternative tanks SLAs.) +2. **Incidents** — warning **neutral** in v1? (recommended; alternative = `paging_suppressed` + incident now, or add `severity`.) +3. **Wire string / naming** — stringify to **`"degraded"`** everywhere (recommended)? And keep the + constant named `StatusWarning`, or rename to `StatusDegraded` for full alignment? +4. **Constraint fix** — also add the missing `6` (error) while widening? (Strongly recommended.) +5. **Migration strategy** — amend `001` in place (matches current practice) or cut `002`? +6. **Frontend** — invest in one shared `statusStyle()` util (recommended) or patch each switch? ## Verification -- **Unit/integration (table-driven, `testify/require`, `t.Parallel()`, SQLite + Postgres via - testcontainers):** - - A `StatusWarning` raw result **persists** (constraint accepts 7) — and an `Error` result - persists too (regression test for the previously-missing 6). - - Aggregation: a bucket of Up+Warning yields `availability_pct == 100` (Decision A). - - Incident-neutral: a warning result with **no** open incident → no incident created; with an - **open** outage incident → incident stays open (not resolved); the **visible** check status - becomes `Degraded` and the streak updates in both cases. - - A subsequent `Up` after warning resolves nothing-extra and clears `Degraded` → `Up`. - - `Status.String()` / `StatusToString()` round-trip `"warning"` / `"WARNING"`. -- **Frontend (`make test-dash`):** a check/resource in warning renders amber (badge, availability - bar, dashboard, public status page) and is labelled degraded, not down. -- **Manual:** temporarily make a checker return `StatusWarning`; confirm the check shows degraded - in dash0 and on a public status page, uptime stays 100%, and no incident/page fires. +- **Unit/integration (table-driven, `testify/require`, `t.Parallel()`, SQLite + Postgres):** + - A `StatusWarning` raw result **persists** (constraint accepts 7); an `Error` result persists + too (regression for the previously-missing 6). + - Aggregation availability: a bucket of `Up`+`Warning` → `availability_pct == 100` (A). + - **Aggregation severity (D):** a bucket with equal counts of `Down` and `Warning` rolls up to + `Down`, not `Warning` (guards the tie-break fix). + - **Incident-neutral (B):** warning with no open incident → none created; with an open outage → + stays open (not resolved); visible status → `Degraded` and streak updates in both cases; a + subsequent `Up` clears `Degraded` → `Up`. + - `Status.String()` / `StatusToString()` emit the canonical `"degraded"` / `"DEGRADED"`. + - `Severity()` ranks `Down/Timeout/Error` above `Warning`. +- **Frontend (`make test-dash`):** a check whose **visible status is `"degraded"`** renders amber + in the dash0 badge, dashboard, timeline, and summary cards (this catches the `status-badge.tsx` + `"degraded"` gap), and on the public status page; never shown as "down". +- **Manual:** temporarily make a checker return `StatusWarning`; confirm degraded amber in dash0 + and the public page, uptime stays 100%, no incident/page fires. - `make lint` / `make test` / `make test-dash` pass. ## Files referenced -- `server/internal/checkers/checkerdef/types.go` — `StatusWarning` value + `String()` +- `server/internal/checkers/checkerdef/types.go` — `StatusWarning` value, `String()`, `Severity()` - `server/internal/db/models/result.go` — `ResultStatusWarning` + `StatusToString()` -- `server/internal/db/models/check.go` — `CheckStatusDegraded = 7` (already exists; map to it) -- `server/internal/jobs/jobtypes/job_aggregation.go` — availability counts warning as up (`:747`) -- `server/internal/handlers/incidents/service.go` — three-way classify; visible-status ordering +- `server/internal/db/models/check.go` — `CheckStatusDegraded=7` (exists; map to it), `Validating` precedent +- `server/internal/jobs/jobtypes/job_aggregation.go` — `successCount` (`:747`), `calculateDominantStatus` tie-break (`:881-898`) +- `server/internal/handlers/incidents/service.go` — three-way classify, early-return ordering, `pickStatus`/`deriveCheckStatus`/`deriveIncidentClocks` - `server/internal/handlers/statuspages/service.go` — already serialises Degraded (verify) -- `server/internal/integrations/slack/mention_commands.go` — warning display case (`:428-435`) -- `server/internal/db/{postgres,sqlite}/migrations/001_v0_1_0.up.sql` — widen results.status CHECK -- `web/dash0/src/components/shared/{status-badge,status-dashboard}.tsx`, - `web/status0/src/components/shared/{status-page-view,availability-bar,response-time-chart}.tsx` - — warning rendering gaps +- `server/internal/integrations/slack/mention_commands.go` — `statusIntToString` degraded case +- `server/internal/db/{postgres,sqlite}/migrations/001_v0_1_0.up.sql` — widen results.status CHECK (add 6 + 7) +- dash0: `status-badge.tsx`, `status-dashboard.tsx`, `status-timeline.tsx`, `check-summary-cards.tsx`, `checks/response-time-chart.tsx` +- status0: `status-page-view.tsx` (done), `availability-bar.tsx`, `response-time-chart.tsx` + +## Validation log (2026-06-20 review) + +Corrections made after verifying against the tree: +- **`checkerdef.Status` has no `Created`** (starts `Running=2`). Earlier draft wrongly listed + `Created=1` for it; that value exists only in `ResultStatus`/`CheckStatus`. +- **`CheckStatusDegraded=7`** confirmed present and `String()`→`"degraded"`, comment "reserved for + future use"; **`CheckStatusValidating=5`** identified as the display-only/incident-neutral + precedent to copy. +- **New required change: aggregation tie-break.** `calculateDominantStatus` ranks ties by numeric + status, so `Warning=7` would mask outages — added Decision D + a `Severity()` helper. +- **Incident ordering** pinned to real functions: the `:168-170` early-return precedes the + visible-status update, so warning needs a third path (was vaguely stated before). +- **Frontend reality:** the `"warning"`/`"degraded"` vocabulary is split across components; the + earlier "`status-badge.tsx` already covered" claim was wrong (it handles `"warning"`, not the + `"degraded"` the backend emits). Added the per-file table, two missed files + (`status-timeline.tsx`, `check-summary-cards.tsx`), and Decision C (one wire string + shared util). +- **Slack** function is `statusIntToString`; warning currently → `"unknown"`. From baf9821e4a62dd77106218056c3790d59588882f Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 02:32:18 +0200 Subject: [PATCH 03/67] =?UTF-8?q?docs(specs):=20apply=20status=20decisions?= =?UTF-8?q?=20=E2=80=94=20two-status=20Warning=20+=20Degraded=20model?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Spec 04 reshaped per user answers to the open questions: - two statuses: Warning (live, value 8, "up but something to report") + Degraded (aggregated, value 7); aggregation promotes raw Warning -> rolled-up Degraded - availability: warning counts as up; incidents: warning neutral - constraint: amend 001 in place, widen results.status to (0..8) incl. the previously-missing 6 (error) - frontend: one shared statusStyle() util mapping both "warning" and "degraded" - record follow-on sub-decisions (values 7/8, rollup promotion rule, role of CheckStatusDegraded) and the five status->string sites found in review Specs 01 (SSL) and 02 (restart-loop) realigned: a live warning shows current status Warning; Degraded appears only in rolled-up history. Co-Authored-By: Claude Opus 4.8 --- ...sl-graduated-expiry-and-chain-reporting.md | 23 +- ...-06-20-02-docker-restart-loop-detection.md | 24 +- .../2026-06-20-04-status-warning-degraded.md | 421 ++++++++---------- 3 files changed, 218 insertions(+), 250 deletions(-) diff --git a/specs/todos/2026-06-20-01-ssl-graduated-expiry-and-chain-reporting.md b/specs/todos/2026-06-20-01-ssl-graduated-expiry-and-chain-reporting.md index cf5ceb549..f36025d9e 100644 --- a/specs/todos/2026-06-20-01-ssl-graduated-expiry-and-chain-reporting.md +++ b/specs/todos/2026-06-20-01-ssl-graduated-expiry-and-chain-reporting.md @@ -51,12 +51,13 @@ exactly as today; new behaviour is opt-in via config. **3. The warning tier is the new first-class `StatusWarning` (depends on [`2026-06-20-04`](2026-06-20-04-status-warning-degraded.md)).** Warning = -`StatusWarning` (visible as `Degraded`, counts as up for availability, does not open an incident) -plus the same `certExpiryWarning: true` / `severity: "warning"` / `daysRemaining` output for -detail. Critical = `StatusDown` (pages, as today). Actual expiry / handshake failure = -`StatusDown` (as today). **This spec depends on `2026-06-20-04` landing first** — that spec adds -`StatusWarning`, the availability/incident semantics, and the DB constraint. Until then, the -warning tier degrades gracefully to `StatusUp` + the output flag (no amber state). +`StatusWarning` — the current check status shows **Warning** (amber); rolled-up periods show +**Degraded**. It counts as up for availability and does not open an incident, plus the same +`certExpiryWarning: true` / `severity: "warning"` / `daysRemaining` output for detail. Critical = +`StatusDown` (pages, as today). Actual expiry / handshake failure = `StatusDown` (as today). +**This spec depends on `2026-06-20-04` landing first** — that spec adds `StatusWarning` (and the +aggregated `Degraded`), the availability/incident semantics, and the DB constraint. Until then, +the warning tier degrades gracefully to `StatusUp` + the output flag (no amber state). **4. Compute nearest expiry across the whole presented chain, not just the leaf.** An intermediate that expires before the leaf is a real, common failure that today's leaf-only @@ -64,12 +65,12 @@ intermediate that expires before the leaf is a real, common failure that today's drive the threshold decision; report which cert is the soonest to expire. Net: same feature you asked for, but the default stops manufacturing fake outages, the warning -tier is a real `Degraded` status (via `2026-06-20-04`), and "chain" means "we check the whole -chain's expiry and report it," because trust is already enforced at handshake. +tier is a real `Warning` status (Degraded in rollups, via `2026-06-20-04`), and "chain" means "we +check the whole chain's expiry and report it," because trust is already enforced at handshake. ## Goals -- Two-tier expiry config: `warningDays` (`StatusWarning`/Degraded) and `criticalDays` +- Two-tier expiry config: `warningDays` (`StatusWarning` — amber, no page) and `criticalDays` (paging, `StatusDown`), back-compatible with the existing single `thresholdDays`. - Expiry decision driven by the **minimum days-remaining across the whole presented chain**, not just the leaf. @@ -127,8 +128,8 @@ In `buildResult`, after a successful handshake: verification ran) — e.g. `chainVerified: len(VerifiedChains) > 0`, `chainLength`. 3. Status decision on the **minimum** days-remaining: - `min <= criticalDays` → `StatusDown` (+ `error`, `severity: "critical"`). - - `criticalDays < min <= warningDays` → `StatusWarning` (visible `Degraded`) + - `certExpiryWarning: true`, `severity: "warning"`. + - `criticalDays < min <= warningDays` → `StatusWarning` (current status **Warning**; + **Degraded** in rollups) + `certExpiryWarning: true`, `severity: "warning"`. - else → `StatusUp`. 4. Output additions: `chain` (array of `{subject, issuer, notAfter, daysRemaining}`), `soonestExpiring` (subject + daysRemaining), `chainLength`, `chainVerified`, diff --git a/specs/todos/2026-06-20-02-docker-restart-loop-detection.md b/specs/todos/2026-06-20-02-docker-restart-loop-detection.md index 463d6e064..85b1b3f7f 100644 --- a/specs/todos/2026-06-20-02-docker-restart-loop-detection.md +++ b/specs/todos/2026-06-20-02-docker-restart-loop-detection.md @@ -65,9 +65,10 @@ There are three viable approaches: **My recommendation: ship A as the MVP, scope B as the accurate V2.** A delivers the feature the competitor has and fits SolidPing's architecture with the least risk. A flapping container -*is* "unhealthy but (intermittently) up" — exactly what the new `StatusWarning`/`Degraded` state -(from [`2026-06-20-04`](2026-06-20-04-status-warning-degraded.md)) is for: it shows amber, counts -as up for availability, and doesn't page or manufacture a false outage. So a *detected loop on a +*is* "unhealthy but (intermittently) up" — exactly what the new `StatusWarning` state +(from [`2026-06-20-04`](2026-06-20-04-status-warning-degraded.md)) is for: current status shows +amber **Warning** (rolled-up periods show **Degraded**), it counts as up for availability, and +doesn't page or manufacture a false outage. So a *detected loop on a currently-running container* → `StatusWarning`; a container that's actually not-running/unhealthy still → `StatusDown` (and pages) as today. The one-interval false positive on a deploy is real but self-healing, and because warning doesn't page, a stray flag costs nothing. If A's accuracy @@ -86,8 +87,9 @@ are decisions for you (below). ## Dependency - **[`2026-06-20-04` (first-class `StatusWarning`)](2026-06-20-04-status-warning-degraded.md) - lands first** (assuming the recommended Warning outcome). It supplies the `Degraded` status and - its availability/incident semantics. If you choose `StatusDown` for loops instead (open + lands first** (assuming the recommended Warning outcome). It supplies the `StatusWarning` value + (current status Warning; aggregated Degraded) and its availability/incident semantics. If you + choose `StatusDown` for loops instead (open question 2), this dependency drops and the change is self-contained. ## Out of scope @@ -133,7 +135,8 @@ if cfg.RestartLoopMinRestarts > 0 && info.State.Running { output["error"] = fmt.Sprintf( "restart loop suspected: %d restarts, last start %s ago", info.RestartCount, sinceStart.Round(time.Second)) - // StatusWarning (Degraded) per 2026-06-20-04; use StatusDown if you chose to page. + // StatusWarning per 2026-06-20-04 (current=Warning, rolls up to Degraded); + // use StatusDown if you chose to page. return &checkerdef.Result{Status: checkerdef.StatusWarning, ...} } } @@ -161,8 +164,8 @@ when not yet over threshold. 1. **Approach A (heuristic, this spec) vs B (server-side delta over history)?** A ships fast and fits the architecture; B is accurate but more invasive and needs an incident-without-status path. Default in this spec is A. -2. **Loop ⇒ `StatusWarning`/Degraded (visible, no page — recommended, depends on - `2026-06-20-04`) or `StatusDown` (pages)?** Spec assumes Warning: a flapping-but-running +2. **Loop ⇒ `StatusWarning` (current Warning, Degraded in rollups; no page — recommended, depends + on `2026-06-20-04`) or `StatusDown` (pages)?** Spec assumes Warning: a flapping-but-running container is "unhealthy but up," and warning shows amber without a false outage. Choose Down if a crash-loop should page immediately (then this spec has no dependency on `2026-06-20-04`). 3. **Default thresholds** when enabled: `minRestarts = 3`, `window = 120s` — reasonable for @@ -179,8 +182,9 @@ when not yet over threshold. - Detection disabled (`minRestarts == 0`) → behaviour byte-for-byte as today. - Not-running / unhealthy still short-circuit to `StatusDown` before the loop branch. - **Manual:** run a container with `--restart=always` and a command that exits immediately - (`sh -c 'exit 1'`); point a Docker check at it with detection enabled; confirm it flips to - Degraded (amber) with `restartLoop` and the reason in output, and uptime is unaffected. + (`sh -c 'exit 1'`); point a Docker check at it with detection enabled; confirm the current + status flips to Warning (amber) with `restartLoop` and the reason in output, uptime is + unaffected, and a rolled-up period shows Degraded. - `make lint` / `make test`; `make test-dash` if the form changes. ## Files referenced diff --git a/specs/todos/2026-06-20-04-status-warning-degraded.md b/specs/todos/2026-06-20-04-status-warning-degraded.md index f2c2a0100..f893e0ba1 100644 --- a/specs/todos/2026-06-20-04-status-warning-degraded.md +++ b/specs/todos/2026-06-20-04-status-warning-degraded.md @@ -1,252 +1,215 @@ -# First-class `StatusWarning` (degraded-but-up) check status +# First-class `Warning` (live) + `Degraded` (aggregated) statuses -> **Code-verified 2026-06-20.** Every file:line and design choice below was checked against the -> current tree. Corrections folded in from the validation pass (see **Validation log** at the end); -> the most consequential were: `checkerdef.Status` has **no** `Created`; the aggregation rollup -> tie-break (`calculateDominantStatus`) ranks by raw status number and `Warning=7` would mask -> outages; the frontend wire string is **split** between `"warning"` and `"degraded"`; and the -> incident classifier early-returns *before* the visible-status update. +> **Code-verified 2026-06-20; user decisions applied.** This is the *two-status* design the user +> chose (open-question 3): **`Warning`** is the live/per-execution state ("up, but something to +> report"), **`Degraded`** is its **aggregated** rollup representation ("over this window there was +> something to report"). All file:line refs below were checked against the tree. See **Decisions** +> and **Validation log** at the end. -## Context +## Concept -The SSL graduated-expiry spec ([`2026-06-20-01`](2026-06-20-01-ssl-graduated-expiry-and-chain-reporting.md)) -and the Docker restart-loop spec ([`2026-06-20-02`](2026-06-20-02-docker-restart-loop-detection.md)) -both need to express **"unhealthy but technically up"** — a cert expiring soon, a container -that's running but flapping. **Decision taken: add a first-class warning/degraded status now**, so -the state is real in the UI, availability, and incident logic, and the other two specs build on it. +Two distinct states, deliberately separated by altitude: -There are **three** distinct status concepts; they do **not** share the same set of values, which -matters: +| | **`Warning`** (value **8**, new) | **`Degraded`** (value **7**, already reserved) | +|---|---|---| +| Meaning | Live: target is up, but there's something to report (cert expiring, container flapping) | Aggregated: a rolled-up period contained warning(s) but no dominating failure | +| Produced by | a checker (`Execute` returns it) | the **aggregation job** only (never a checker) | +| Stored on | **raw** `results` rows; the **current** check status | **aggregated** `results` rows (hour/day/month) | +| Availability | counts as **up** | n/a (aggregated rows store `availability_pct` directly) | +| Incidents | **neutral** (no open/resolve) | never in the incident path (incidents see raw results only) | +| Wire string | `"warning"` | `"degraded"` | +| Colour | amber, label "Warning" | amber, label "Degraded" | + +The bridge between them: **when the aggregation job rolls up a window containing raw `Warning` +results (and no dominating failure), the aggregated row's status is `Degraded`.** That is literally +"degraded when we aggregate." + +## Context — the three status enums -1. **`checkerdef.Status`** (what a checker returns, per execution) — - `Running=2, Up=3, Down=4, Timeout=5, Error=6` (**no `Created`** — starts at `Running=2`) +They do **not** share one value set: + +1. **`checkerdef.Status`** (checker returns, per execution) — + `Running=2, Up=3, Down=4, Timeout=5, Error=6` (**no `Created`**) ([`checkerdef/types.go:12-18`](../../server/internal/checkers/checkerdef/types.go), - `String()` at `:31-46` → lowercase `"up"`/`"down"`/…, string consts at `:21-28`). - **No predicate/severity helpers** (no `IsUp`/`IsFailure`/`Severity`). -2. **`models.ResultStatus`** (the persisted `results.status`) — + `String()` `:31-46` → lowercase, string consts `:21-28`). No predicate/severity helpers. + → **add `StatusWarning = 8`** (checkers never emit `Degraded`). +2. **`models.ResultStatus`** (persisted `results.status`) — `Created=1, Running=2, Up=3, Down=4, Timeout=5, Error=6` ([`db/models/result.go:12-25`](../../server/internal/db/models/result.go), - `StatusToString()` at `:36-53` → UPPERCASE `"UP"`/`"DOWN"`/…). -3. **`models.CheckStatus`** (the *visible* current status on the `checks` row) — + `StatusToString()` `:36-53` → UPPERCASE). → **add `ResultStatusWarning = 8`** (raw rows) **and + `ResultStatusDegraded = 7`** (aggregated rows). +3. **`models.CheckStatus`** (visible current status on `checks`) — `Created=1, Up=3, Down=4, Validating=5, **Degraded=7**` - ([`db/models/check.go:14-28`](../../server/internal/db/models/check.go), `String()` at `:33-48` - → lowercase, **`Degraded` → `"degraded"`**). - - **`CheckStatusDegraded = 7` already exists** but is commented *"reserved for future use"* - (`check.go:26`) — defined and `String()`-mapped, not yet produced anywhere. The big de-risker. - - **`CheckStatusValidating = 5`** is the precedent to copy: a **display-only** status that - "never triggers notifications, never gates the incident state machine" (`check.go:21-25`). - Our `Degraded` mapping should follow exactly this pattern. - -### What's already in our favour - -- **`checks.status` has no DB CHECK constraint** (`pg 001:326` is `smallint not null default 0`; - the comment at `pg 001:360` is stale — it predates `Degraded`). The visible degraded status - needs **no migration**, and `CheckStatusValidating=5`/`Degraded=7` already round-trip. -- **Some of the frontend already renders a degraded/amber state** — but inconsistently (below). - -### What's NOT in our favour - -- **`results.status` HAS a CHECK constraint to widen — and it's currently wrong.** - `check (status in (0, 1, 2, 3, 4, 5))` in **both** dialects + ([`db/models/check.go:14-28`](../../server/internal/db/models/check.go), `String()` `:33-48`, + `Degraded`→`"degraded"`). → **add `CheckStatusWarning = 8`** for the current live status. + `CheckStatusDegraded = 7` already exists (commented "reserved for future use", `check.go:26`) + and is retained for rendering a check's **aggregated/summary** status. + - **`CheckStatusValidating = 5`** is the precedent to copy for `Warning`: a **display-only** + status that "never triggers notifications, never gates the incident state machine" + (`check.go:21-25`). + +### In our favour + +- **`checks.status` has no DB CHECK constraint** (`pg 001:326`); `CheckStatusDegraded=7` already + round-trips and `parseStatusFilter` already accepts `"degraded"` + ([`checks/handler.go:45`](../../server/internal/handlers/checks/handler.go)). Adding + `Warning=8`/`"warning"` to the current status needs **no migration**. +- The public status page already renders both `"warning"` and `"degraded"` amber + ([`status0/status-page-view.tsx:22-81`](../../web/status0/src/components/shared/status-page-view.tsx)). + +### Not in our favour + +- **`results.status` CHECK constraint must widen — and is currently wrong.** + `check (status in (0,1,2,3,4,5))` in both dialects ([`pg 001:440`](../../server/internal/db/postgres/migrations/001_v0_1_0.up.sql), - [`sqlite 001:340`](../../server/internal/db/sqlite/migrations/001_v0_1_0.up.sql)). It **excludes - `Error = 6`** despite that being a live value — a latent bug to fix in the same change. -- **Aggregation severity ranking breaks with `7`.** The rolled-up row status is - `calculateDominantStatus(statusCounts)` — most-frequent wins, **ties broken by higher status - number** (`job_aggregation.go:891`, used at `:347`, written to the row at `:936`). `Warning=7` - is numerically the **highest**, so on a count tie a bucket with both `Down(4)` and `Warning(7)` - rolls up to **Warning**, masking the outage. (`maxStatus` at `:744-745` has the same numeric - assumption but is computed-and-unused for the row status.) Numeric order no longer encodes - severity — needs an explicit severity rank. -- **The frontend wire string is split between `"warning"` and `"degraded"`** for the same state - (see Design → Frontend). There is no single status→style mapping; each component rolls its own. -- **Incidents have no severity/kind** — the table is binary "down → open, recover → resolve" - ([`incidents 001:512-540`](../../server/internal/db/postgres/migrations/001_v0_1_0.up.sql): - `state`, `failure_count`, `paging_suppressed`, `resolution_type` — **no `severity`**). A - "warning incident" can't be expressed without a new field or reusing `paging_suppressed`. - -## My honest opinion - -You picked the harder-but-correct option, and the *visible* slot (`CheckStatusDegraded`) plus the -`CheckStatusValidating` precedent make it tractable. The work is: (a) add the value to the two -execution-level enums, (b) widen one DB constraint, (c) make **four decisions**, (d) fix the -rollup severity ranking, and (e) unify the frontend status rendering. The decisions: - -**Decision A — Availability: warning counts as UP (recommended).** A cert 20 days out, or a -container that restarted twice, is *reachable and serving*. Counting it against uptime craters -SLAs for non-outages. So a warning raw result increments `successCount` for `availability_pct` -([`job_aggregation.go:747`](../../server/internal/jobs/jobtypes/job_aggregation.go)). - -**Decision B — Incidents: warning is NEUTRAL in v1 (recommended).** Incidents have no severity to -soften, so a warning must **not** open or resolve one — it only drives the visible status to -`Degraded`, exactly like `CheckStatusValidating` is display-only today. **Ordering caveat (real):** -in `ProcessCheckResult` the classifier `isSuccess`/`isFailure` -([`incidents/service.go:163-166`](../../server/internal/handlers/incidents/service.go)) -**early-returns `nil` at `:168-170`** *before* the visible-status update at `:181-194` -(`deriveCheckStatus` → `UpdateCheckStatusAndClocks`). A warning that is neither success nor failure -would hit that early return and **never become visible**. So warning needs a *third* path that -bypasses the early return, sets `Degraded` via `pickStatus` (`:313-328`), is **clock-neutral** in -`deriveIncidentClocks` (`:213-245`, arms neither the failure nor the recovery clock), and defines -the up↔degraded streak edges in `deriveStreakAndChange`/`deriveCheckStatus` (`:272-306`). A warning -arriving during an open outage must **not** resolve it. - -**Decision C — One wire string: `"degraded"` (recommended).** The visible status already -stringifies to `"degraded"` (`check.go:44`) and the public status page speaks `"degraded"`. The -constant can stay named `StatusWarning` (it names the *trigger*), but it should **stringify to -`"degraded"`** at every layer so the whole UI speaks one word — mirroring how `CheckStatusDegraded` -→ `"degraded"` already. (Alternative: name the new constants `*Degraded` for full top-to-bottom -alignment — cleaner, slightly more churn.) Treat any lingering `"warning"` string as a synonym. - -**Decision D — Severity ranking, not numeric order.** Add a small `Severity()`/rank helper (none -exist today) so "which status is worse" is explicit, and fix the dominant-status tie-break so -`Down/Timeout/Error` outrank `Warning`. - -**On notifications:** because v1 is incident-neutral there is **no automatic alert** on entering -warning — it's visible only, and you still get paged when it degrades to a real `Down`. The clean -follow-up for "warn me early" is a `paging_suppressed` incident (the column already exists) or an -incident `severity`; scoped out below. - -## Goals - -- Add `StatusWarning = 7` to `checkerdef.Status` and `ResultStatusWarning = 7` to - `models.ResultStatus`, both stringifying to **`"degraded"`**, mapping a warning *result* to the - already-reserved visible `CheckStatusDegraded = 7`. -- Widen the `results.status` CHECK constraint to accept `7` (and fix the missing `6`) in both - dialects. -- Availability: warning counts as up (A). -- Incidents: warning is neutral — no open, no resolve — but visible status becomes `Degraded` (B), - via a third path that survives the success/failure early-return. -- Fix the aggregation rollup so `Warning` never outranks a real failure (D). -- Unify the frontend: one status→style mapping; every status surface renders `degraded` amber (C). -- No checker-behaviour change except that checkers *may now return* `StatusWarning`. - -## Out of scope - -- Wiring SSL ([`2026-06-20-01`](2026-06-20-01-ssl-graduated-expiry-and-chain-reporting.md)) and - restart-loop ([`2026-06-20-02`](2026-06-20-02-docker-restart-loop-detection.md)) to *emit* - `StatusWarning` — those specs own that. -- **Warning notifications** (a `paging_suppressed`/degraded-severity incident, or a dedicated - notification path) and an incident `severity` column — deliberate follow-up; v1 is neutral. + [`sqlite 001:340`](../../server/internal/db/sqlite/migrations/001_v0_1_0.up.sql)) — it **excludes + the live `Error=6`** already, and now needs `7` and `8` too. +- **Aggregation severity ranks by raw status number.** `calculateDominantStatus` picks + most-frequent, **tie-break = higher status number** + ([`job_aggregation.go:891`](../../server/internal/jobs/jobtypes/job_aggregation.go), used `:347`, + written to the row `:936`). Numeric order will not encode severity once `7`/`8` exist — needs an + explicit rank **and** the Warning→Degraded promotion (below). (`maxStatus` `:744-745` is + computed-but-unused for the row status.) +- **Five status→string sites** must learn the new values (validation found more than first listed): + `CheckStatus.String()` (check.go:33), `models.StatusToString()` (result.go:36), + `results/service.go statusIntToString` (`:334`, currently collapses Down/Timeout/Error→`"down"`), + the checks-service LastResult mapper (~`:1828`), and `slack statusIntToString` (`:422`). +- **Incidents have no severity** (`incidents 001:512-540`: `state`, `failure_count`, + `paging_suppressed`, no `severity`) — fine, because `Warning` is neutral and `Degraded` never + reaches the incident path. ## Design -### Backend enums + wire string (Decision C) -- `checkerdef/types.go`: `StatusWarning Status = 7`; add a `String()` case returning the shared - degraded label. -- `db/models/result.go`: `ResultStatusWarning ResultStatus = 7`; `StatusToString()` case → - `"DEGRADED"` (UPPERCASE, matching that function's convention). -- Map result→visible: `ResultStatusWarning → CheckStatusDegraded` in the visible-status path - (`pickStatus`, [`incidents/service.go:313-328`](../../server/internal/handlers/incidents/service.go)). -- Confirm the lowercase wire string `"degraded"` (not `"warning"`) is what reaches the frontend - for both check-level and result-level status, so the UI has one vocabulary. - -### Severity helper + availability (Decisions A, D) -- Add `func (s Status) Severity() int` (and/or `IsFailure()`) in `checkerdef` so severity is - explicit, with `Down/Timeout/Error` ranked **above** `Warning`. +### Enums + wire strings (two strings, both amber) +- `checkerdef/types.go`: `StatusWarning Status = 8`; `String()`→`"warning"`; add `statusStrWarning`. +- `db/models/result.go`: `ResultStatusWarning = 8`, `ResultStatusDegraded = 7`; `StatusToString()` + → `"WARNING"` / `"DEGRADED"`. +- `db/models/check.go`: `CheckStatusWarning = 8`; `String()`→`"warning"`; keep `Degraded`→`"degraded"`. +- Wire-string mappers — add `8→"warning"` everywhere, and `7→"degraded"` where aggregated results + are serialised: + - `results/service.go statusIntToString` (`:334`): `case ResultStatusWarning: "warning"`, + `case ResultStatusDegraded: "degraded"`. (Keep Down/Timeout/Error collapsed to `"down"`.) + - checks-service LastResult mapper (~`:1820-1838`): add `Warning` → `"warning"`. + - `slack/mention_commands.go statusIntToString` (`:422`): add `Warning` → a "warning" string. + - `checks/handler.go parseStatusFilter` (`:30-45`): add `"warning"` alongside the existing + `"degraded"` so both are filterable. +- Map raw `Warning` → current `CheckStatusWarning` in the visible-status path (`pickStatus`, + [`incidents/service.go:313-328`](../../server/internal/handlers/incidents/service.go)). + +### Availability (Decision A — counts as up) - [`job_aggregation.go:747`](../../server/internal/jobs/jobtypes/job_aggregation.go): count - `Up` **or** `Warning` toward `successCount`. -- [`calculateDominantStatus` (`:881-898`)](../../server/internal/jobs/jobtypes/job_aggregation.go): - replace the numeric tie-break (`status > dominantStatus`, `:891`) with the severity rank so a - `Down`/`Warning` count tie resolves to `Down`. (`maxStatus` at `:744-745`/`:807-808` is unused - for the row status — leave or remove, but don't let it reintroduce numeric severity.) - -### Incidents (Decision B) -- [`incidents/service.go`](../../server/internal/handlers/incidents/service.go): introduce a third - `isWarning` branch. It must **not** early-return at `:168-170`; instead run the visible-status - update (`deriveCheckStatus`/`UpdateCheckStatusAndClocks`, `:181-194`) with `pickStatus` returning - `CheckStatusDegraded`, keep `deriveIncidentClocks` (`:213-245`) clock-neutral for warning, and - define up↔degraded streak/`statusChangedAt` edges in `deriveStreakAndChange`/`deriveCheckStatus` - (`:272-306`). **Do not** call `routeCheckResultWithIncident` open/resolve logic for warning. - Model the whole thing on the existing display-only `CheckStatusValidating`. - -### Integrations -- [`slack/mention_commands.go` `statusIntToString` (~`:422-437`)](../../server/internal/integrations/slack/mention_commands.go): - warning currently falls to `"unknown"` (default). Add a `ResultStatusWarning` case returning a - distinct "degraded" string (add the constant alongside `statusUp`/`statusDown`). - -### Frontend — unify, don't patch (Decision C) -The status→style logic is duplicated across ~7 components with an inconsistent vocabulary. -**Recommended:** introduce one shared `statusStyle(status)` util per app (color, badge variant, -label key) keyed on the canonical `"degraded"` (treating `"warning"` as a synonym), and route -every surface through it. Current state per file (verified): - -| File | Today | Needs | -|---|---|---| -| dash0 `status-badge.tsx:29-34` | handles `"warning"`→validating label; **not** `"degraded"` | handle `"degraded"`; real degraded label | -| dash0 `status-dashboard.tsx:46-59` (`getCheckStatus`) | `"timeout"`→`"warning"`; no `"warning"`/`"degraded"` **input** | map degraded input → amber | -| dash0 `response-time-chart.tsx` (`:420-429`,`:642-645`) | non-neutral → red | treat degraded as neutral, not red | -| dash0 `status-timeline.tsx:44-50` | handles `"warning"`(yellow); **not** `"degraded"` | handle `"degraded"` | -| dash0 `check-summary-cards.tsx:58-62` | `isDown`=down/error/timeout; no degraded | degraded ≠ down | -| status0 `status-page-view.tsx:22-81` | **both** `"warning"`+`"degraded"` ✓ | verify only | -| status0 `availability-bar.tsx:9-20` | handles `"degraded"`; **not** `"warning"` | covered if string is `"degraded"`; add synonym | -| status0 `response-time-chart.tsx:33-44` | neither | add degraded color | - -### Migration -Per the consolidated-per-release convention (`server/CLAUDE.md`), and since only `001_v0_1_0` -exists despite many shipped features (`integrations`, `status_page_subscriber` tables live in -`001`) — v0.1.0 is still being assembled in place — **amend the `results.status` CHECK constraint -in `001_v0_1_0.up.sql` for both dialects**: `check (status in (0, 1, 2, 3, 4, 5, 6, 7))` — adding -`7` (degraded) **and** the missing `6` (error). Confirm whether to amend `001` in place or cut a -`002_v0_X_0` release migration. `checks.status` needs **no** change (no constraint). - -## Open questions / decisions for the user - -1. **Availability** — warning counts as **up**? (recommended; alternative tanks SLAs.) -2. **Incidents** — warning **neutral** in v1? (recommended; alternative = `paging_suppressed` - incident now, or add `severity`.) -3. **Wire string / naming** — stringify to **`"degraded"`** everywhere (recommended)? And keep the - constant named `StatusWarning`, or rename to `StatusDegraded` for full alignment? -4. **Constraint fix** — also add the missing `6` (error) while widening? (Strongly recommended.) -5. **Migration strategy** — amend `001` in place (matches current practice) or cut `002`? -6. **Frontend** — invest in one shared `statusStyle()` util (recommended) or patch each switch? + `Up` **or** `Warning` toward `successCount`. An aggregated `Degraded` period can therefore be + `availability_pct == 100`. + +### Aggregation: Warning→Degraded + severity (Decision D) +- Add `func (s Status) Severity() int` in `checkerdef` (failures > Degraded > Up; Warning ranks as + Up for availability but promotes to Degraded in rollups). +- Rework `calculateDominantStatus`/the rollup status selection (`:881-898`) so: + 1. a dominating hard failure (Down/Timeout/Error per existing rules) → that failure status; + 2. else if the window contains **any** raw `Warning` → **`Degraded`** (the promotion); + 3. else `Up`. + Replace the numeric tie-break (`status > dominantStatus`, `:891`) with `Severity()` so a + `Down`/anything tie resolves to the failure, never to `Warning`/`Degraded`. + *(Promotion threshold "any warning" is the proposed default — see Decisions for the knob.)* + +### Incidents (Decision B — Warning neutral; Degraded absent) +- [`incidents/service.go`](../../server/internal/handlers/incidents/service.go): add a third + `isWarning` branch that must **not** early-return at `:168-170`; instead run the visible-status + update (`:181-194`) with `pickStatus` → `CheckStatusWarning`, keep `deriveIncidentClocks` + (`:213-245`) clock-neutral, define the up↔warning streak/`statusChangedAt` edges in + `deriveStreakAndChange`/`deriveCheckStatus` (`:272-306`), and **never** open/resolve an incident. + Model on the display-only `CheckStatusValidating`. `Degraded` is aggregate-only and never reaches + this path (raw results are Up/Down/Timeout/Error/Warning). + +### Frontend — one shared `statusStyle()` (Decision 6 — yes) +Introduce one `statusStyle(status)` util per app returning `{color, badgeVariant, labelKey}`, +handling **both** `"warning"` and `"degraded"` (both amber; labels "Warning" / "Degraded"), and +route every status surface through it. Live surfaces receive `"warning"` (current check status), +historical/aggregated surfaces receive `"degraded"` (aggregated result status). Verified per file: + +| File | Surface | Today | Needs | +|---|---|---|---| +| dash0 `status-badge.tsx:29-34` | live | `"warning"`→**validating** label; no `"degraded"` | proper "Warning" label; handle `"degraded"` for summary | +| dash0 `status-dashboard.tsx:46-59` | live | `"timeout"`→`"warning"`; no `"warning"`/`"degraded"` input | route via util | +| dash0 `status-timeline.tsx:44-50` | historical | `"warning"` yellow; no `"degraded"` | handle `"degraded"` | +| dash0 `check-summary-cards.tsx:58-62` | live | `isDown`=down/error/timeout; neither | warning/degraded ≠ down | +| dash0 `checks/response-time-chart.tsx` (`:420-429`,`:642-645`) | raw points | non-neutral→red | warning/degraded = neutral, not red | +| status0 `status-page-view.tsx:22-81` | both | **both** handled ✓ | route via util (verify) | +| status0 `availability-bar.tsx:9-20` | historical | `"degraded"` ✓; no `"warning"` | covered (gets `"degraded"`); add synonym | +| status0 `response-time-chart.tsx:33-44` | both | neither | add warning + degraded | + +### Migration (Decision 5 — amend in place) +Amend the `results.status` CHECK in **`001_v0_1_0.up.sql`** for **both** dialects: +`check (status in (0, 1, 2, 3, 4, 5, 6, 7, 8))` — adding `6` (the missing error, Decision 4), `7` +(degraded), `8` (warning). Only `001` exists despite shipped features (`integrations`, +`status_page_subscriber` live in `001`), so in-place is consistent. `checks.status` needs no change. + +## Decisions (answered by the user 2026-06-20) + +1. **Availability** → warning counts as **up**. ✅ +2. **Incidents** → warning **neutral** in v1. ✅ +3. **Status model** → **two statuses**: `Warning` (live "something to report") + `Degraded` + (aggregated rollup). ✅ — this design is built around it. +4. **Constraint fix** → also add the missing `6` (error). ✅ +5. **Migration** → **amend `001` in place** (both dialects). ✅ +6. **Frontend** → one shared `statusStyle()` util. ✅ + +### Follow-on sub-decisions (introduced by the two-status model — defaults proposed) + +- **a. Numeric values:** `Degraded = 7` (reuse the reserved slot), `Warning = 8` (new), across all + three enums + the constraint. (Alternative would renumber the shipped `Degraded` — avoided.) +- **b. Rollup promotion rule:** **any** raw `Warning` in a non-failing window → `Degraded` + (proposed). Alternatives: a threshold (≥N warnings or ≥X%), or most-frequent. "Any" matches + "there was something to report in this window" but is the noisiest; easy to make a knob later. +- **c. Role of `CheckStatusDegraded=7` on the live `checks` row:** current status uses `Warning`; + `Degraded` is reserved for rendering a check's **aggregated/summary** status (and stays a valid + filter value). It is not produced by the live pipeline. ## Verification - **Unit/integration (table-driven, `testify/require`, `t.Parallel()`, SQLite + Postgres):** - - A `StatusWarning` raw result **persists** (constraint accepts 7); an `Error` result persists - too (regression for the previously-missing 6). - - Aggregation availability: a bucket of `Up`+`Warning` → `availability_pct == 100` (A). - - **Aggregation severity (D):** a bucket with equal counts of `Down` and `Warning` rolls up to - `Down`, not `Warning` (guards the tie-break fix). - - **Incident-neutral (B):** warning with no open incident → none created; with an open outage → - stays open (not resolved); visible status → `Degraded` and streak updates in both cases; a - subsequent `Up` clears `Degraded` → `Up`. - - `Status.String()` / `StatusToString()` emit the canonical `"degraded"` / `"DEGRADED"`. - - `Severity()` ranks `Down/Timeout/Error` above `Warning`. -- **Frontend (`make test-dash`):** a check whose **visible status is `"degraded"`** renders amber - in the dash0 badge, dashboard, timeline, and summary cards (this catches the `status-badge.tsx` - `"degraded"` gap), and on the public status page; never shown as "down". -- **Manual:** temporarily make a checker return `StatusWarning`; confirm degraded amber in dash0 - and the public page, uptime stays 100%, no incident/page fires. + - A raw `Warning` (8) and an `Error` (6) and an aggregated `Degraded` (7) all **persist** + (constraint accepts 6/7/8 — the 6 case is a regression test). + - Availability: a bucket of `Up`+`Warning` → `availability_pct == 100` (A) **and** the + aggregated row status is **`Degraded`** (promotion rule b). + - Severity (D): a bucket with `Down` + `Warning` rolls up to **`Down`**, never `Degraded`/`Warning`. + - Incident-neutral (B): raw `Warning` with no open incident → none created; during an open + outage → not resolved; current check status → `Warning`, streak updates; a later `Up` clears it. + - Serialisation: `CheckStatus.String()`→`"warning"`/`"degraded"`; `statusIntToString` raw + `Warning`→`"warning"`, aggregated `Degraded`→`"degraded"`; `StatusToString`→`"WARNING"`/`"DEGRADED"`. + - `Severity()` ranks `Down/Timeout/Error` above `Degraded` above `Up`. +- **Frontend (`make test-dash`):** a check whose **current** status is `"warning"` renders amber + "Warning" in the badge/dashboard/summary cards; an **aggregated** `"degraded"` period renders + amber "Degraded" in the timeline/availability bar and on the public status page; neither shows as + "down". +- **Manual:** make a checker return `StatusWarning`; confirm current status amber "Warning", + uptime stays 100%, no incident/page; after an aggregation run the rolled-up period shows + "Degraded". - `make lint` / `make test` / `make test-dash` pass. ## Files referenced -- `server/internal/checkers/checkerdef/types.go` — `StatusWarning` value, `String()`, `Severity()` -- `server/internal/db/models/result.go` — `ResultStatusWarning` + `StatusToString()` -- `server/internal/db/models/check.go` — `CheckStatusDegraded=7` (exists; map to it), `Validating` precedent -- `server/internal/jobs/jobtypes/job_aggregation.go` — `successCount` (`:747`), `calculateDominantStatus` tie-break (`:881-898`) -- `server/internal/handlers/incidents/service.go` — three-way classify, early-return ordering, `pickStatus`/`deriveCheckStatus`/`deriveIncidentClocks` +- `server/internal/checkers/checkerdef/types.go` — `StatusWarning=8`, `String()`, `Severity()` +- `server/internal/db/models/result.go` — `ResultStatusWarning=8`, `ResultStatusDegraded=7`, `StatusToString()` +- `server/internal/db/models/check.go` — `CheckStatusWarning=8`, `Degraded=7` (exists), `Validating` precedent +- `server/internal/jobs/jobtypes/job_aggregation.go` — `successCount` (`:747`), Warning→Degraded promotion + severity tie-break (`:881-898`) +- `server/internal/handlers/incidents/service.go` — third `isWarning` branch, early-return ordering, `pickStatus`/`deriveCheckStatus`/`deriveIncidentClocks` +- `server/internal/handlers/results/service.go` — `statusIntToString` (`:334`) warning+degraded cases +- `server/internal/handlers/checks/service.go` — LastResult mapper (~`:1828`); `handler.go parseStatusFilter` (`:45`) add `"warning"` - `server/internal/handlers/statuspages/service.go` — already serialises Degraded (verify) -- `server/internal/integrations/slack/mention_commands.go` — `statusIntToString` degraded case -- `server/internal/db/{postgres,sqlite}/migrations/001_v0_1_0.up.sql` — widen results.status CHECK (add 6 + 7) -- dash0: `status-badge.tsx`, `status-dashboard.tsx`, `status-timeline.tsx`, `check-summary-cards.tsx`, `checks/response-time-chart.tsx` -- status0: `status-page-view.tsx` (done), `availability-bar.tsx`, `response-time-chart.tsx` - -## Validation log (2026-06-20 review) - -Corrections made after verifying against the tree: -- **`checkerdef.Status` has no `Created`** (starts `Running=2`). Earlier draft wrongly listed - `Created=1` for it; that value exists only in `ResultStatus`/`CheckStatus`. -- **`CheckStatusDegraded=7`** confirmed present and `String()`→`"degraded"`, comment "reserved for - future use"; **`CheckStatusValidating=5`** identified as the display-only/incident-neutral - precedent to copy. -- **New required change: aggregation tie-break.** `calculateDominantStatus` ranks ties by numeric - status, so `Warning=7` would mask outages — added Decision D + a `Severity()` helper. -- **Incident ordering** pinned to real functions: the `:168-170` early-return precedes the - visible-status update, so warning needs a third path (was vaguely stated before). -- **Frontend reality:** the `"warning"`/`"degraded"` vocabulary is split across components; the - earlier "`status-badge.tsx` already covered" claim was wrong (it handles `"warning"`, not the - `"degraded"` the backend emits). Added the per-file table, two missed files - (`status-timeline.tsx`, `check-summary-cards.tsx`), and Decision C (one wire string + shared util). -- **Slack** function is `statusIntToString`; warning currently → `"unknown"`. +- `server/internal/integrations/slack/mention_commands.go` — `statusIntToString` (`:422`) warning case +- `server/internal/db/{postgres,sqlite}/migrations/001_v0_1_0.up.sql` — widen results.status CHECK (6+7+8) +- dash0: `status-badge.tsx`, `status-dashboard.tsx`, `status-timeline.tsx`, `check-summary-cards.tsx`, `checks/response-time-chart.tsx`; status0: `status-page-view.tsx` (done), `availability-bar.tsx`, `response-time-chart.tsx` — route through one `statusStyle()` + +## Validation log + +- **2026-06-20 (answers applied):** adopted the **two-status** model (Decision 3): `Warning` (live, + value 8) + `Degraded` (aggregated, value 7); two wire strings; the aggregation job promotes raw + `Warning`→`Degraded`. Confirmed A (up), B (neutral), constraint+6 (4), amend-001 (5), shared + `statusStyle()` (6). Added sub-decisions a–c. +- **2026-06-20 (code review):** corrected `checkerdef.Status` (no `Created`); confirmed + `CheckStatusDegraded=7` reserved and `CheckStatusValidating=5` as the display-only precedent; + found the rollup tie-break severity bug; pinned the incident early-return ordering; found there + are **five** status→string sites (not two): `CheckStatus.String()`, `StatusToString`, + `results/service.go statusIntToString`, the checks-service LastResult mapper, and Slack — plus + `parseStatusFilter` already accepting `"degraded"`. From 76d1319fd97a58d4121cf472e4e843e4631ae065 Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 02:41:19 +0200 Subject: [PATCH 04/67] docs(specs): apply recommended choices & cross-spec consistency Resolve open questions in the 2026-06-20 todos and align ideas with the new Warning/Degraded status model. - ssl (-01): warningDays defaults to criticalDays (30); criticalDays stays 30 (docs recommend 7); checkdomain tiering is a follow-up. - docker (-02): Approach A heuristic MVP; loop => StatusWarning; minRestarts=3/window=120s; firm dependency on -04. - mcp-oauth (-03): embedded AS + DCR in scope (Phase 3); 4 unrecommended forks kept as explicit open questions with leanings. - ideas: flag stale enum/warn_days in check-interface as superseded; note Warning is incident-neutral in notification-channels & telegram specs. Co-Authored-By: Claude Opus 4.8 --- specs/ideas/2025-12-06-check-interface.md | 10 +++++ .../ideas/2026-03-22-notification-channels.md | 5 +++ .../2026-03-22-telegram-notifications.md | 4 ++ ...sl-graduated-expiry-and-chain-reporting.md | 28 +++++++----- ...-06-20-02-docker-restart-loop-detection.md | 34 +++++++------- .../2026-06-20-03-mcp-oauth2-authorization.md | 45 ++++++++++++++----- 6 files changed, 87 insertions(+), 39 deletions(-) diff --git a/specs/ideas/2025-12-06-check-interface.md b/specs/ideas/2025-12-06-check-interface.md index ccfa9777c..1d014d5f0 100644 --- a/specs/ideas/2025-12-06-check-interface.md +++ b/specs/ideas/2025-12-06-check-interface.md @@ -2,6 +2,16 @@ This document defines the Go interface that all protocol checkers must implement. +> **Historical sketch — superseded by the shipped implementation.** The canonical checker +> interface now lives in `server/internal/checkers/checkerdef/`. The status values below are +> out of date: the real enum is `Running=2, Up=3, Down=4, Timeout=5, Error=6` (not the +> `1/2/3/4` shown here), and the active todo +> [`2026-06-20-04`](../todos/2026-06-20-04-status-warning-degraded.md) adds `Warning=8` (live) +> plus an aggregated `Degraded=7`. The SSL config likewise gained `warningDays` / `criticalDays` +> ([`2026-06-20-01`](../todos/2026-06-20-01-ssl-graduated-expiry-and-chain-reporting.md)), +> replacing the single `warn_days` field in the table below. Treat this file as a record of the +> original design intent, not a description of current code. + ## Core Interface ```go diff --git a/specs/ideas/2026-03-22-notification-channels.md b/specs/ideas/2026-03-22-notification-channels.md index 18f758211..29b98c5f1 100644 --- a/specs/ideas/2026-03-22-notification-channels.md +++ b/specs/ideas/2026-03-22-notification-channels.md @@ -13,6 +13,11 @@ Telegram has its own dedicated spec: `specs/ideas/2026-03-22-telegram-notificati 3. Support all incident event types: `incident.created`, `incident.resolved`, `incident.escalated`, `incident.reopened` 4. Respect group-incident correlation: each connection fires once per group event, not once per member +> **Status-model note** (re [`2026-06-20-04`](../todos/2026-06-20-04-status-warning-degraded.md)): +> the `Warning` status is **incident-neutral** — it opens no incident, so these incident-driven +> channels do not notify on `Warning`/`Degraded`. If notifying on warnings is wanted, that is a +> separate warning-notification path, not part of this spec. + --- ## Microsoft Teams diff --git a/specs/ideas/2026-03-22-telegram-notifications.md b/specs/ideas/2026-03-22-telegram-notifications.md index 02b0cc937..e3a1d591f 100644 --- a/specs/ideas/2026-03-22-telegram-notifications.md +++ b/specs/ideas/2026-03-22-telegram-notifications.md @@ -11,6 +11,10 @@ Add Telegram as a notification channel for incident alerts. Uses the Telegram Bo 3. Rich HTML-formatted messages with status emojis and incident links 4. Simple setup: bot token + chat ID, no complex OAuth +> **Status-model note** (re [`2026-06-20-04`](../todos/2026-06-20-04-status-warning-degraded.md)): +> the `Warning` status is **incident-neutral** — it opens no incident, so this channel does not +> notify on `Warning`/`Degraded`. Notifying on warnings would be a separate path, out of scope here. + --- ## Connection Settings diff --git a/specs/todos/2026-06-20-01-ssl-graduated-expiry-and-chain-reporting.md b/specs/todos/2026-06-20-01-ssl-graduated-expiry-and-chain-reporting.md index f36025d9e..9987cecc0 100644 --- a/specs/todos/2026-06-20-01-ssl-graduated-expiry-and-chain-reporting.md +++ b/specs/todos/2026-06-20-01-ssl-graduated-expiry-and-chain-reporting.md @@ -1,5 +1,9 @@ # SSL check — graduated expiry thresholds + whole-chain expiry & reporting +> **Recommended choices applied 2026-06-20.** All three open questions had a clear +> recommendation; they are resolved in the **Decisions** section below and reflected in the +> config defaults. Depends on [`2026-06-20-04`](2026-06-20-04-status-warning-degraded.md). + ## Context Inspired by the Maintenant competitor analysis ([`docs/competitors/maintenant.md`](../../docs/competitors/maintenant.md)), @@ -46,7 +50,7 @@ is a hard **Down**. **2. But we must not silently regress users who rely on the 30-day page.** So: keep the existing knob's *meaning* and add a second tier. Map the legacy `thresholdDays` → **`criticalDays`** (the hard-Down threshold, default stays 30 for back-compat) and introduce **`warningDays`** as a -new, *non-paging* tier (default e.g. 30, or `2 × criticalDays`). Existing rows keep behaving +new, *non-paging* tier (default 30, equal to `criticalDays` — widen it via config to get earlier warnings). Existing rows keep behaving exactly as today; new behaviour is opt-in via config. **3. The warning tier is the new first-class `StatusWarning` (depends on @@ -158,17 +162,17 @@ the tiering rule. Don't duplicate the comparison literal in two checkers. 5. **Docs**: update the SSL section of [`docs/api-specification.md`](../../docs/api-specification.md) and any SSL feature page under `docs/features/` with the new config keys + output shape. -## Open questions / decisions for the user - -1. **Default `warningDays`** — keep it equal to `criticalDays` (30) so behaviour is byte-for-byte - unchanged until opted-in (safest), or default to something wider like 30/critical-7 so users - get the better behaviour out of the box (changes default paging)? I lean **safe** (equal), - with a release note nudging users to widen it. -2. **Hard-Down default** — leave `criticalDays` at **30** (preserves today's paging), or drop the - recommended default to **7** so a valid cert isn't a month-long "outage"? I'd keep 30 as the - *default* but document 7 as recommended. -3. **Apply the same tiering to `checkdomain` now or later?** This spec assumes later (shared - helper here, wire-up follow-up). +## Decisions (applied 2026-06-20) + +1. **Default `warningDays` = `criticalDays` (30).** Behaviour stays byte-for-byte unchanged until a + user widens the warning window; a release note nudges users to set a wider `warningDays`. (The + safe option, chosen over defaulting to a wider window that would change paging for everyone.) +2. **`criticalDays` default stays 30** (preserves today's paging). The docs / release note + **recommend lowering it to 7** so a valid cert isn't reported as a month-long outage, but the + shipped default does not change paging behaviour on its own. +3. **`checkdomain` tiering is a follow-up.** This spec extracts the shared `gradedExpiryStatus` + helper but wires only `checkssl`; `checkdomain` adopts the helper in a separate change (already + in Out of scope). ## Verification diff --git a/specs/todos/2026-06-20-02-docker-restart-loop-detection.md b/specs/todos/2026-06-20-02-docker-restart-loop-detection.md index 85b1b3f7f..cd17b07cf 100644 --- a/specs/todos/2026-06-20-02-docker-restart-loop-detection.md +++ b/specs/todos/2026-06-20-02-docker-restart-loop-detection.md @@ -1,5 +1,9 @@ # Docker check — restart-loop (crash-loop) detection +> **Recommended choices applied 2026-06-20.** All three open questions had a clear +> recommendation; they are resolved in the **Decisions** section below. Depends on +> [`2026-06-20-04`](2026-06-20-04-status-warning-degraded.md) (firm — see Dependency). + ## Context Inspired by the Maintenant competitor analysis ([`docs/competitors/maintenant.md`](../../docs/competitors/maintenant.md)), @@ -87,10 +91,9 @@ are decisions for you (below). ## Dependency - **[`2026-06-20-04` (first-class `StatusWarning`)](2026-06-20-04-status-warning-degraded.md) - lands first** (assuming the recommended Warning outcome). It supplies the `StatusWarning` value - (current status Warning; aggregated Degraded) and its availability/incident semantics. If you - choose `StatusDown` for loops instead (open - question 2), this dependency drops and the change is self-contained. + lands first.** Decision 2 commits to the Warning outcome, so this dependency is firm: `04` + supplies the `StatusWarning` value (current status Warning; aggregated Degraded) and its + availability/incident semantics. ## Out of scope @@ -159,17 +162,18 @@ when not yet over threshold. 4. **Docs**: update the Docker check section of [`docs/api-specification.md`](../../docs/api-specification.md) and any container feature page under `docs/features/`. -## Open questions / decisions for the user - -1. **Approach A (heuristic, this spec) vs B (server-side delta over history)?** A ships fast and - fits the architecture; B is accurate but more invasive and needs an incident-without-status - path. Default in this spec is A. -2. **Loop ⇒ `StatusWarning` (current Warning, Degraded in rollups; no page — recommended, depends - on `2026-06-20-04`) or `StatusDown` (pages)?** Spec assumes Warning: a flapping-but-running - container is "unhealthy but up," and warning shows amber without a false outage. Choose Down if - a crash-loop should page immediately (then this spec has no dependency on `2026-06-20-04`). -3. **Default thresholds** when enabled: `minRestarts = 3`, `window = 120s` — reasonable for - typical backoff loops? Loops with long backoff (minutes) would need a wider window. +## Decisions (applied 2026-06-20) + +1. **Approach A (checker-local heuristic).** Ships fast, fits the stateless-worker model, needs + zero schema. Approach B (server-side delta over `results` history) is the accurate V2 — scoped + in Out of scope and picked up only if A's heuristic proves too noisy. +2. **A detected loop on a *running* container → `StatusWarning`** (current status amber **Warning**, + **Degraded** in rollups; counts as up; does not page) — depends on `2026-06-20-04`. A genuinely + not-running / unhealthy container still → `StatusDown` and pages, exactly as today. The + one-interval deploy false positive is acceptable precisely because Warning never pages. +3. **Default thresholds when enabled: `minRestarts = 3`, `window = 120s`.** Detection stays opt-in + (off unless `restartLoopMinRestarts > 0`); loops with multi-minute backoff can widen + `restartLoopWindow`. ## Verification diff --git a/specs/todos/2026-06-20-03-mcp-oauth2-authorization.md b/specs/todos/2026-06-20-03-mcp-oauth2-authorization.md index 7b54f9df4..455f303b3 100644 --- a/specs/todos/2026-06-20-03-mcp-oauth2-authorization.md +++ b/specs/todos/2026-06-20-03-mcp-oauth2-authorization.md @@ -1,5 +1,10 @@ # OAuth 2.1 authorization for the MCP endpoint +> **Recommended choices applied 2026-06-20** (embedded AS + DCR in scope — see **Decisions**). +> Four consequential forks had *no* recommendation in the original spec and are deliberately left +> open with a noted leaning — see **Remaining open questions**. This feature still needs the +> flagged security review before build. + ## Context Inspired by the Maintenant competitor analysis ([`docs/competitors/maintenant.md`](../../docs/competitors/maintenant.md)): @@ -136,19 +141,35 @@ need), consent, audience binding, short-lived tokens + refresh rotation. Flagged - Single-use, short-TTL authorization codes; bind code → client → redirect → challenge → resource. - Rate-limit `/authorize`, `/token`, `/register` (existing rate-limit middleware). -## Open questions / decisions for the user - -1. **Embedded AS (recommended) vs delegate to external IdP?** Spec assumes embedded. -2. **DCR in scope?** Required for Claude Desktop / `mcp-remote` to "just work"; skip it and we're - limited to pre-registered/first-party clients. This is the biggest scoping lever. -3. **Self-hosted only, or SaaS too?** Affects issuer URLs, multi-tenant `client_id` isolation, - and whether DCR is open or admin-gated. -4. **Reuse the existing JWT signing key, or introduce a JWKS keyset** for the resource server? +## Decisions (applied 2026-06-20) + +1. **Embedded authorization server, not delegation.** SolidPing is self-hosted-first and must work + with no external IdP, so SolidPing itself is the OAuth 2.1 AS for the MCP resource: reuse the + existing user login/session for `/authorize` and the existing JWT + `Claims.Scopes` machinery to + mint access tokens. Delegating to an org's external IdP stays a later option (Out of scope). +2. **DCR is in scope, delivered as Phase 3.** The goal is that standard MCP clients connect with no + hand-pasted token, which requires RFC 7591 for Claude Desktop / `mcp-remote`. It is the heaviest + lift, so it ships last in the phasing — but it is not dropped. (Without it we would be limited to + pre-registered / first-party clients, which fails the stated goal.) + +## Remaining open questions (no prior recommendation — still a human call) + +These were left genuinely open by the original spec and are **not** resolved here; each needs a +deliberate call before/while building Phase 2–3. A current leaning is noted, but not committed: + +3. **Self-hosted only, or SaaS too?** *Lean:* target **self-hosted, single issuer** for v1 (issuer = + SolidPing's own URL; org taken from the logged-in user's session at `/authorize`, since the MCP + handler already scopes to `claims.OrgSlug`). The design must not *preclude* SaaS multi-tenant + `client_id` isolation and admin-gated DCR, but that is a follow-on, not v1. +4. **Reuse the existing JWT signing key, or introduce a JWKS keyset?** *Lean:* **reuse** the + existing signing key for v1 and publish it at `jwks_uri`; a dedicated keyset is a later hardening + step. 5. **Which client do we validate against first** — claude.ai remote connector, Claude Desktop, or - the `mcp-remote` bridge? Drives which quirks (loopback, DCR, metadata probes) we must satisfy - on day one. -6. **Per-org issuer vs single issuer** — the MCP handler scopes everything to `claims.OrgSlug`; - decide how the org is selected during `/authorize` (the logged-in user's org). + the `mcp-remote` bridge? *Lean:* **Claude Desktop / the claude.ai remote connector** (with + `mcp-remote` for local testing) — they exercise the hardest constraints (DCR, loopback redirects, + metadata probes) the spec must satisfy on day one. +6. **Per-org issuer vs single issuer** — tied to (3); the leaning above is a **single issuer** with + the org selected from the logged-in user's session at `/authorize`. ## Verification From 1c8366b361ffac345b279a15e8511875576046cf Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 02:46:06 +0200 Subject: [PATCH 05/67] chore: start implementing check-detail header actions own row From d63c920a2de6c7c775892d67334e9bf6889d9405 Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 02:47:08 +0200 Subject: [PATCH 06/67] feat: stack check-detail header action toolbar onto its own row --- .../orgs/$org/checks.$checkUid.index.tsx | 4 +- .../src/routes/orgs/$org/design-reference.tsx | 60 +++++++++++++++++++ 2 files changed, 62 insertions(+), 2 deletions(-) diff --git a/web/dash0/src/routes/orgs/$org/checks.$checkUid.index.tsx b/web/dash0/src/routes/orgs/$org/checks.$checkUid.index.tsx index c58dd260c..f37af9751 100644 --- a/web/dash0/src/routes/orgs/$org/checks.$checkUid.index.tsx +++ b/web/dash0/src/routes/orgs/$org/checks.$checkUid.index.tsx @@ -446,7 +446,7 @@ function CheckDetailPage() { return (
-
+
@@ -534,7 +534,7 @@ function CheckDetailPage() { )}
-
+
\n
\n {/* labeled action buttons */}\n
\n
\n \n \n \n \n \n {/* mirror each action; delete = text-destructive */}\n \n \n
\n
`} /> +

Detail & edit pages: stack the action toolbar on its own row (action-dense headers)

+

+ When a detail header carries more than ~three actions{" "} + (e.g. the check detail page: back + Edit, Enable/Disable, Clone, Badges, + Refresh, Delete) the labeled toolbar and a long title fight for the same + row — even on a wide desktop. Instead of shrinking the buttons or hiding + them behind an overflow menu, drop the toolbar onto its own row. Make the + outer wrapper a{" "} + flex flex-col gap-3{" "} + column: the title block (still wrapped in{" "} + min-w-0 flex-1{" "} + so the{" "} + h1{" "} + truncates) takes the first row, then the action cluster — back arrow + leading, as ever — sits on a second row wrapped in{" "} + flex flex-wrap items-center justify-end gap-2. + It is right-aligned and wraps across lines on a narrow phone rather than + overflowing. The per-button responsive behaviour (icon-only below{" "} + lg, + icon + label at{" "} + lg+) is + unchanged — only the wrappers move. +

+ +
+

+ A long page title that would otherwise crowd the toolbar +

+

+ Optional subtitle / status +

+
+
+ + + + + +
+
+ } + importLine={`
\n
\n

{title}

\n {subtitle &&

{subtitle}

}\n
\n
\n \n {/* labeled action buttons — icon-only below lg, icon + label at lg+ */}\n
\n
`} + /> +

Legacy (retired): the From 4792a8390939f0e79e239375dcde93a4aa310f9f Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 02:49:17 +0200 Subject: [PATCH 07/67] feat: assert check-detail toolbar stacks below title in E2E --- web/dash0/e2e/check-detail.spec.ts | 59 ++++++++++++++++++++++++++++++ 1 file changed, 59 insertions(+) diff --git a/web/dash0/e2e/check-detail.spec.ts b/web/dash0/e2e/check-detail.spec.ts index 45aa4ef62..aa1cc62d8 100644 --- a/web/dash0/e2e/check-detail.spec.ts +++ b/web/dash0/e2e/check-detail.spec.ts @@ -180,4 +180,63 @@ test.describe("Check Detail Page", () => { page.getByRole("alertdialog").getByText("Delete Check"), ).toBeVisible(); }); + + test("header stacks the action toolbar on its own row below a long title (no horizontal overflow)", async ({ + authenticatedPage, + }) => { + const page = authenticatedPage; + + // Create a deliberately long-named check — the worst case for header layout. + await page.getByTestId("app-sidebar").getByRole("link", { name: "Checks" }).click(); + await page.waitForURL(/\/checks/); + await page.waitForLoadState("networkidle"); + await page.getByTestId("new-check-button").click(); + await page.waitForURL(/\/checks\/new/); + await page.waitForLoadState("networkidle"); + await expect(page.getByTestId("check-name-input")).toBeVisible(); + + const checkName = `E2E Stacked ${Date.now()} ${"Very Long Check Name ".repeat(4)}`; + await page.getByTestId("check-name-input").fill(checkName); + await page.getByTestId("check-url-input").fill("https://example.com/stacked-test"); + await page.getByTestId("check-submit-button").click(); + + await page.waitForURL(/\/checks\/[0-9a-f]{8}-/, { timeout: 10000 }); + await page.waitForLoadState("networkidle"); + await expect(page.getByRole("heading", { name: checkName })).toBeVisible(); + + // ---- Wide desktop: the title block and the action toolbar are on two + // separate rows, and the page does not overflow horizontally. ---- + await page.setViewportSize({ width: 1280, height: 800 }); + + // All six actions plus the back arrow are present with their labels visible. + const backButton = page.getByRole("button", { name: "Back to checks" }); + await expect(backButton).toBeVisible(); + await expect(page.getByLabel("Edit").getByText("Edit")).toBeVisible(); + await expect(page.getByLabel("Clone").getByText("Clone")).toBeVisible(); + await expect(page.getByLabel("Badges").getByText("Badges")).toBeVisible(); + await expect(page.getByLabel("Refresh").getByText("Refresh")).toBeVisible(); + await expect(page.getByLabel("Delete").getByText("Delete")).toBeVisible(); + // Enable/Disable toggles its label; match either. + await expect( + page.getByRole("button", { name: /Disable|Enable/ }), + ).toBeVisible(); + + // The toolbar sits BELOW the title block: a toolbar button's top edge is + // past the title's bottom edge. + const titleBox = await page + .getByRole("heading", { name: checkName }) + .boundingBox(); + const deleteBox = await page.getByLabel("Delete").boundingBox(); + expect(titleBox).not.toBeNull(); + expect(deleteBox).not.toBeNull(); + expect(deleteBox!.y).toBeGreaterThan(titleBox!.y + titleBox!.height); + + // No horizontal overflow on the wide desktop. + const hasDesktopOverflow = await page.evaluate( + () => + document.documentElement.scrollWidth > + document.documentElement.clientWidth + 1, + ); + expect(hasDesktopOverflow).toBe(false); + }); }); From 1d3629f0a8548337dc020fffd4f3308909d89b34 Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 02:49:24 +0200 Subject: [PATCH 08/67] chore: all checks passing for check-detail header actions own row From 75179ec6ab678aed4934d4458d69e3597883b843 Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 02:51:12 +0200 Subject: [PATCH 09/67] docs: archive completed spec check-detail header actions own row --- .../2026/06}/2026-06-17-01-check-detail-header-actions-own-row.md | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename specs/{todos => done/2026/06}/2026-06-17-01-check-detail-header-actions-own-row.md (100%) diff --git a/specs/todos/2026-06-17-01-check-detail-header-actions-own-row.md b/specs/done/2026/06/2026-06-17-01-check-detail-header-actions-own-row.md similarity index 100% rename from specs/todos/2026-06-17-01-check-detail-header-actions-own-row.md rename to specs/done/2026/06/2026-06-17-01-check-detail-header-actions-own-row.md From 39dc39611b7c73bf61aa49029e79eff1db3207c5 Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 02:51:46 +0200 Subject: [PATCH 10/67] chore: start implementing destructive button tinted shadow hover From 32869c447d0706517abdd39c1508c1c0fce38634 Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 02:52:05 +0200 Subject: [PATCH 11/67] feat: give destructive button tinted red elevation and hover lift --- web/dash0/src/components/ui/button.tsx | 2 +- web/dash0/src/index.css | 4 ++++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/web/dash0/src/components/ui/button.tsx b/web/dash0/src/components/ui/button.tsx index cdc53bcb9..0bb46c595 100644 --- a/web/dash0/src/components/ui/button.tsx +++ b/web/dash0/src/components/ui/button.tsx @@ -12,7 +12,7 @@ const buttonVariants = cva( default: "bg-primary text-primary-foreground shadow-primary hover:bg-primary/90 hover:shadow-primary-hover", destructive: - "bg-destructive text-white shadow-sm hover:bg-destructive/90", + "bg-destructive text-white shadow-destructive hover:bg-destructive/90 hover:shadow-destructive-hover", outline: "border border-input bg-background shadow-sm hover:bg-accent hover:text-accent-foreground", secondary: diff --git a/web/dash0/src/index.css b/web/dash0/src/index.css index 12cf1d330..75ac5fde4 100644 --- a/web/dash0/src/index.css +++ b/web/dash0/src/index.css @@ -52,6 +52,10 @@ 0 4px 8px -4px color-mix(in oklab, var(--primary) 11%, transparent); --shadow-primary-hover: 0 12px 24px -6px color-mix(in oklab, var(--primary) 22%, transparent), 0 6px 12px -6px color-mix(in oklab, var(--primary) 14%, transparent); + --shadow-destructive: 0 8px 16px -4px color-mix(in oklab, var(--destructive) 15%, transparent), + 0 4px 8px -4px color-mix(in oklab, var(--destructive) 11%, transparent); + --shadow-destructive-hover: 0 12px 24px -6px color-mix(in oklab, var(--destructive) 22%, transparent), + 0 6px 12px -6px color-mix(in oklab, var(--destructive) 14%, transparent); --shadow-card: 0 1px 2px 0 color-mix(in oklab, var(--primary) 4%, transparent), 0 6px 16px -6px color-mix(in oklab, var(--primary) 5%, transparent); --shadow-card-hover: 0 2px 4px 0 color-mix(in oklab, var(--primary) 5%, transparent), From 63550e2f1072f1ce84d1b1396f92922ffa809245 Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 02:53:45 +0200 Subject: [PATCH 12/67] feat: assert destructive button shadow changes on hover in E2E --- .../e2e/destructive-button-shadow.spec.ts | 45 +++++++++++++++++++ 1 file changed, 45 insertions(+) create mode 100644 web/dash0/e2e/destructive-button-shadow.spec.ts diff --git a/web/dash0/e2e/destructive-button-shadow.spec.ts b/web/dash0/e2e/destructive-button-shadow.spec.ts new file mode 100644 index 000000000..4d78afc73 --- /dev/null +++ b/web/dash0/e2e/destructive-button-shadow.spec.ts @@ -0,0 +1,45 @@ +import { test, expect } from "./fixtures"; + +/** + * The destructive (delete) button mirrors the save button's tinted elevation: + * a red-tinted drop shadow at rest that grows on hover (shadow-destructive -> + * shadow-destructive-hover, wired in components/ui/button.tsx). This is a + * visual/token change, so we assert the box-shadow is present at rest and + * changes on hover rather than pixel-comparing exact color-mix values, which + * resolve differently per browser. + */ +test.describe("Destructive button tinted elevation", () => { + test("has a box-shadow at rest that changes on hover", async ({ + authenticatedPage, + }) => { + const page = authenticatedPage; + + await page.goto("orgs/test/design-reference"); + await page.waitForLoadState("networkidle"); + + // The "Button variants" row renders the live destructive variant. + const destructive = page + .getByRole("button", { name: "Destructive", exact: true }) + .first(); + await destructive.waitFor({ state: "visible" }); + + const restShadow = await destructive.evaluate( + (el) => getComputedStyle(el).boxShadow, + ); + // At-rest tint is wired (shadow-destructive), not a flat "none". + expect(restShadow).not.toBe("none"); + expect(restShadow.trim()).not.toBe(""); + + await destructive.hover(); + // Allow the box-shadow transition to settle. + await page.waitForTimeout(300); + + const hoverShadow = await destructive.evaluate( + (el) => getComputedStyle(el).boxShadow, + ); + expect(hoverShadow).not.toBe("none"); + + // The hover lift (shadow-destructive-hover) differs from the at-rest shadow. + expect(hoverShadow).not.toBe(restShadow); + }); +}); From 30ce3434a9e3b1764edf77c5f3247ec799ab8f7b Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 02:54:01 +0200 Subject: [PATCH 13/67] chore: all checks passing for destructive button tinted shadow hover From 26303681cf3f6fa59fdacab62e81a6d49a6cb3c0 Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 02:55:29 +0200 Subject: [PATCH 14/67] docs: archive completed spec destructive button tinted shadow hover --- .../06}/2026-06-17-02-destructive-button-tinted-shadow-hover.md | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename specs/{todos => done/2026/06}/2026-06-17-02-destructive-button-tinted-shadow-hover.md (100%) diff --git a/specs/todos/2026-06-17-02-destructive-button-tinted-shadow-hover.md b/specs/done/2026/06/2026-06-17-02-destructive-button-tinted-shadow-hover.md similarity index 100% rename from specs/todos/2026-06-17-02-destructive-button-tinted-shadow-hover.md rename to specs/done/2026/06/2026-06-17-02-destructive-button-tinted-shadow-hover.md From 581ec6309aae3894de81c6d09feeda774f992863 Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 02:56:17 +0200 Subject: [PATCH 15/67] chore: start implementing regenerate favicon pngs from new brand mark From 287a08e8a5a7c8e2117a36ea2df005ac812af96b Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 02:57:40 +0200 Subject: [PATCH 16/67] chore: regenerate favicon PNG set from new brand mark --- res/favicons/apple-touch-icon.png | Bin 8239 -> 12598 bytes res/favicons/favicon-192.png | Bin 8833 -> 13614 bytes res/favicons/favicon-32.png | Bin 1338 -> 1553 bytes res/favicons/favicon-512.png | Bin 23896 -> 39844 bytes web/dash0/public/apple-touch-icon.png | Bin 8239 -> 12598 bytes web/dash0/public/favicon-192.png | Bin 8833 -> 13614 bytes web/dash0/public/favicon-32.png | Bin 1338 -> 1553 bytes web/dash0/public/favicon-512.png | Bin 23896 -> 39844 bytes web/status0/public/apple-touch-icon.png | Bin 8239 -> 12598 bytes web/status0/public/favicon-192.png | Bin 8833 -> 13614 bytes web/status0/public/favicon-32.png | Bin 1338 -> 1553 bytes web/status0/public/favicon-512.png | Bin 23896 -> 39844 bytes 12 files changed, 0 insertions(+), 0 deletions(-) diff --git a/res/favicons/apple-touch-icon.png b/res/favicons/apple-touch-icon.png index fe443caf03c7a6a3502c6743204cfdb5d3a6706d..f84c6f68e8e84825b88f8e866a41588a2b862095 100644 GIT binary patch literal 12598 zcmb8WQ*>or6D}Ovw%M_5+crBLYsa?JamVIP$LiR4@``LpMR9EO!VqWbF92CR7x5uBq*X1^>&+nTKt$8vhDl*O@lJTL9nTvv3pgScu$Nuo3F0rNJrSf}dsl2ft}fKmzUGK!zv?zLJ5x9i zV@i5~y}nN-ceEx?#y1Qzh4`Nh3=wrdHH~41@m(3U2KjJQx^&+PlgVoIK9l4O!wTSU z;>e?1WyL7UA7P8?ld^cr4|3zK>YP-_j^&i*Jj8?k2}!IY75==QGvi7@-Jg)%`Y(Mv zSUbWyzvHm(=_Z|0$ z{6|G&g4|P)JE6%hY^*y@i!e8Y2^A=UU}ARSG)DUdq#72B&lS5KmtP`=DaNwfdkjkOU@eoS9TZ%^qeJUbFgro9jNd?$oPUZtMj90(Yl+}w zUHA+M{nr$}H=v>KuRo;pAyTsMxg~5nt7rImsz9+p5mFx7>;Vh?I>_)%&PbZWGUW&8 z`~0HlhlOCfq4~9l1PAMqC#MNXhlrH+1idD9bfm^kPG#d|fM(R$gG6Ncw2mTpBPXX4 zCjf%Rk<^Nj?XtqVvec& zdGqsU0P$9kX2A2!P-3S+kHJk?W>%05Q^Ad_nro(bHxhqw%HyrOz(tDNg)teU(vY~0 zj!gX6e3uZ0y~*W9ll*^0Ji)yjO-QSbvb%6 z&r8LvjRK-!&lT;DK{nJ33@;>8sJayRyo29rf3?~(mK0g0JqHh^6wt;8N-;y7 z9U>zgQ?0PQSJTjGk%uX*Y^GF;=al~kYn~f2_VY%MVOvYdMj%K7mWA#8tShBt5_=nt za-Wj{zpRPBP2hb3Eu`j$U8DYj?7pGfUxSMj4ddpJy!jtX2t{M1cBD?z zpk{a!h|G{+2(SgSRqoS~T-x*n47bMI7i>NHYxWo;@P=PNzf`+0yWNYfvd%p5dkKa+ z7&S{XM}*-a6$9F)CynNn%PuXGlXlA%I%cK>^2B*O@AP4Q_mCDl#Q&9}@h=;+ioQs!g1*+I^+@K?w(I^h@}6-k*J-2%moBbjuI+aeqZRw6glt4fa1XrcTp>99SMn2 zX(NjIj@KYJ=Ek{Z0Fs8#S(zWSXpzRDZPFLhZd78p>5H!qxG9d>E>FRScNM!|B1iBs zD+PPtpwnlJsMxyR3K)Ao;G;mX6qSzce>t0YN5D!vn2Czp@^-+2uSn_aav%ax=Cq$s>B?zf3{*d3DzLVvS+>M%X={5K zR$+GQb|mwsip`zO;82RIs)@6N(I}N@(MQ3odZe0R4gzl8Oz82R?S0AfK3(}BW!%vL zpDRv|DwMl&`F@G>qJdJ!f#t!GjhCBWFJYGRC@~!mixepsp0;sg>AFZJi!02wB&Zso zP~=Y_LZ(cA`FM&fal|xxeroG9^-PVL!Rsyxs!OfMk~NqF+|W7G#ph1$=R`JnQQ??4 z#yR8AdpWtKyGr#0P9kBlv+H_7Z;8(v?Ui%#Ka&((l3f4tDTw}_!(V}jjSayN7l$>c z0WFcPj=+Ous-G8o7X+_w8kQM+{hQ0UnC9qBaB@&ZEv{X?-y<)sG!~=C4$hDv1}nK_ zWRPUG^vZb75;I1I9YWZ($)H=gjo(}!w)@8)8R6NH$u9oqQz|`-ufsX1+GSUyiXuXR zfchrPkxcbU{Lo7Tuppt2!TF#|Jja!bb3_}Pq9(082+xZxVPNPCB|<5ZrnZ~6Q|h}H z7x;F?SmvZAiaTA>?^HS5ax083jK0#=*epOmCSmt&0M%iB9sB2hy50HoGDDlKiP)Yw zWe6|dF`DGY*ySecOTNX0&2cZ9WAKnjCPw9oP>a=Jb|x)vNAU($Pu{vV`C79k8#P=x z0#_@q-dzAj*nu&lhh;e+lVKo zeMlA;jAlpS9t!zawlO=qp5A29>5x|hNGVxIV5!{p#1Eo47#7*n&oG2 z`2>dDaat<1@jbO}hL+@+Q7Y?x`v`*ZeB54}g&*hY70CFLGzHXR|3u}VY?1dOOn$o> z+)w7}4enD@`hx;1^4(q)Yn!0W`3hAtF3+16LSWK*YzCiTyRpCx*?l+0OONCp&#(3B`{Tt)8ZhvvH*)T3fGu7y1>71uLt{;6Cht&Bf?YOL~;p zMylTgR8<-h{v?1LIk=C{BSDm?>Voa5>U($Ja zc;fqxyHod-S(`h=hW(nwIsCIptk8uaC8_A96*P_}m?HUkVNI~C`+kunPq!ip-gW-A zJJVR{Irp`eOHR@73$=vfzq)pCqc;=dq5V4<$v%E)=dLe%kLmXkea!k-euXR&x7CF= z830Hpsg#vH+bTWMg6BXtcEc`JbAdO3A5MvOX=(QGvZ5r)%&v9|`vAcsY3H6*e@ik7 zZ~7LpZ%&;tpz6z=2(Ho6|Q|zSwB}K;D5GR##&J#lbca_LhF~g&*ht)bM#Z$-DRHqAKDIFezvu zWo+&1F)3`D!J@tppBWV&cMdxlzXe2oPAY5M@6o;iE7wIi#7DrP@Vmkn;HX zB%){5!s_f-wbbxtsksCdYrC8oE0qL((7sJPW8^mGUzF$#Ep)j$_mH!g&7`SE`o%oo zpv68ONTMqbwl=h`A#9TSL`16G{+ge)mM$L;}4Ye6L`$8(}B09ULF zOKa&uHQefary&mo0!70QmaX7mMxnysxa%PvZJoOCU+BhO&{B_Lyysv{YUz^p%8tsp z_8rUYq`C2$KhsH$DOtGPB-;mefp$0s`cG&#SoWSP(=;EiF02AG2hAf0&3^976(#T$ za8Sg0jo1EW2mPR|)%JITZbh=v$T$N808$Ed|)g#5vlPCdY$+c5Zw6$*IHF>~|S%j7#EIwOVtnrA+Y!>DIDmc@_^5f1DD~ zYQe{4=oE$~F|UtjXyQ(FTGK^)+aY8dnH%(KEwkG75*Av>Rmz@UB(r|!)1z##prwC5 zNA*GKzB&mf*={GE1vD-L2BMF^Icas11?a{@C)8@Qf-ATR4V?3l;vu{Oh_#uc{TZn7 zeNI(HxRgMo^%j=0bPs=PAu@L#5?>$3kF?Qm^MEz@@4>zcu>~52{6!$I7M{LG+|`CS z6|oP_P@gbpHqqJmjY8@7tH@igaK#OaNAiHA>&mt-J=jjAd_jw|0oI4@>)70Rz=735 za#XTnAhIAq>|O`!wy-5tnL$4>fkaZdIjb0gPH5U2?E6h&Fe1HyfH3z*ucnZo!%>P3 zcI{MX=(E4-osLMJ=SJ44-=#s`Q)#aH{_Q0H*&*^p_tUpjwr=AaZ^&B5^Ae$D-u=-u zy68{66dXR|rH06iQ6xi+8YIER<*2$J6u^!7!<2DPJn%nucVQD>cY*wGAVG&uiz&~X zJLtaOt8_l2bSQzHq?ajV)upeX;$upo;AX{hkojf%2hwkknF%1om2$jEma&ShSv7zn z!d%A)-Km%pdzrDXc?W^zhuxHu6|56-Um!n3)xx>S3e~8h4;g31fDn6vvdx>=;`B%9 z?Qq`?ym-x&V~`*hzSdtWKuhTumk-|uF|%hKJG$_K_RW$K z0}}ejdQ8#m8Ia0*sk-ZsZD%|lzxo3%y?SZTk4+T^oII5~UhLKlJ!HPt3+lYE+Hj?p zVGO+sSJQPQUUi3x3c8zQdMO2FlVbhY@X00t>0^1j!uW$BmXmr`yB>Bg$cITu21p6V z^5tvvb&^)9M(q;)joJ@Fwr~ z`@!}w3Ga$VHcCo1q*9S$TU?VRt7_dKcFS{6_afG~<(ZU^Z>Df0ej1>HiR7>jj3*S2 zh;y!#7XzsEE|_KoyC-V#KIRmE!i zuPR%^$wYj0(mz60qo977W_2mafMFTQF=34(wvMW;w%%u5!FC)yi`7ENig8o9ZqH#4 z9IQ0qw#-TVO6CrG0qjc(=sa62`}VNQVcPkGbR$*%;HxnuA{{^%!iAYO4;Z{!b7WTF z>zs1mhrPT~Zl#N}C5bI}C?gnt3EDZ_S-kAa!Ch!?0v2wjW%Q7SYAs{3C#}zGD!S{2 zPhR6XUi7`;-Eai6C6GVtYIqsD<3?U<&Q57?tnhNGQHF)?EsTwAy2{EC6+9O2hT(l) z#k&0yU-C*55+$VDAPS=jf^(k0fyh24UtJ|-6@zhr5hY>pHdrklkd8~6Z%_ug-+ z1^O1rh`x{c*H!%dhH9>fQG5EU>lY>zCg)GvL&V}c;fu!k|B^ce=WC}FW_2Bk&LD+n zrFdCwp!YWQo(j}N%^s|b+#`82^d-|SN;1CO zku@QQ_X9??1r$FvCQ=B-ctEk`AK_w#2sPo;WdXB*ByO2G&G8yrxw6u5<6^gm$`fVr zk~buL@t{{{lIBHigmcKUV++x}o%bj5^!0gxuDLu!){u05zE2qNSYOThqA2&2(pMx= z3Jgt&H*}U}#c=f1SSZ@Lx31J2?f&!#&YNmwOYDUV+0(dBq3X)EgDLS!#PVA#5O!-5Hdz=TC2;Xwf zz{@CmiveA-Yu29~PhXuhA~wedI*mQ>6inVL3i26_o=6=6|K zl>9z9nYDP*8V@{5z9)JF{;Z35+;nbI6CN9g#WXIY&#ytyZ3nRFPqCkddx=zOyXh)! zHfn2e-f)i`VDOn`Le-4+M+wD2xiV?Tu~rXBcF6D!`}XP&#Tk(pIOpqq1FJy;s-O<0*;DMHNFhvfVSlaj^Se z?rP%wI}9|}h24gWR=xQ1I9Nv*=(rX0(bFg0bAVbj6WAVGXJ6}lzFStHQyb&`7c*&r zFm|EvWG@1g0n_@j7@%Ddw}pREat>&sI9?Px_3M~Gk<qgOb8v-I4R*7hQAEn*Ra6);RX>D|tO#PYOX`LVr!zOUjOv?=jHr^Tq7S zOBZlFE2+mLNZpvT5$^+&5+lx>U>7e*<8udp=qu-ep~~W>bj1wsx9<8K1?m9#pQ5#J zM1fnc!12s%cm<;2`?wHTQ}yhYsBfGb!^6!e_X`;NpD8> zkx%C&BRd>y4t&)?I}B@9-)_KtdEww zs#-jCkXAw##u~o5icb8B8T`U~Fd6+%j4X7g7slm^k1v&r69OQO)e(8KQP91Mcu=e% z9T`COl0zmLit#+rV*CZik!v6!%y^3Bm*_@a8oQ#P-M(VsF5+WwpV=mbG1HggCbYwa zEQ;m3De%Xwc-e0=-g8qG+?J;ACsyuKJ8Hy%!As_ z7Hr3Y(u(NXnv&n@N|g=`n8cLk{#!;}dewz(v=MoE{J?t56&rhhmip**kSXeQ$Nq1O zRkAkE%st5g?^_{e2!oQY=bZCC2>a!K zQQ)oOB6=TbG?X;z;*J>pespl8-_k4QWvjoySt1|zHaEu*)#8h;EN8m{fBD)Y%h+(j zdzc1wMAl<+`mLcQVO9ft%#q56q<{h(dm|Ndq5eIB1)vN8Py#Kkkj^*56q zlu-vYQ7Vp$qeiQTK`!b?h^xU5Bm!d{1ycIsB54WQqv^+!Nlh3qp}30|wWmjY{owsz zC7_3w@6!CQ?HJBHgIj#|342$_x^5*#3w%==lRt1tbJfg;0ELvEdv8r;Gx!cZd7JV6 z4G(DM=!sUzD*tSfKjtE9C^Xc=AtQ>5?T8fTAf)6Npm?xk?TBQ(qgUFhA2+5i{1;$Z zwtde24OJRnklP}hm|S*bMhc}c(?R7)V?t?%;w58kcjSN`&E#L7k11-N+P`yt?E5Pz zN87O@c{ycY{gx|~>$_UQogJGMi62^k6*)}Sg;C59NgNXEJs$rYYXe)q0`NTaX)$t+Hyy;A}nWS9$CzC#qxsN(3*3LW$z_b@HD#|=$^Sgd>3wS4_yivC z+rzj9X4NEHigqT(lvzSpT)ex;2JA0W_hsdo^km9GlbFy za$62K!O}H-fbabQbrhC6;db@;h72v%N!%3%bf=5cB}v&L8nn{U3AQT^%wvkDI#FkT zlUob;NUC-*MiOAkuXD($QY6qOU6{h;2t$Z-`ws~z^PGwvDA?IHJ*>5n?PD*r=hCO} z)}nIvHnE}5eX1jOqozg=cpNHw%w#q8tw6MQI%MpQ<#zv6mockbPoW@5N}a~lqbN_O zxi#nn4yTuq?L>)KO}rn}>A-M@ds2>ty1Yk7iFJf0e%@MncE6+Y+_#cMhEk##zmmd% z0}))35b2~+)urqb5!dYx1a-IgO<4K>RU0ZnjGCWjOe_(>L|6f z@m~D4=G*dP1AH)DF@EV-STVcp0F6toeu4ji*#Of$f<0t-(n^8EtI!Os&l%j;rD$*L z(e28=J>w!l1EUs=UQs#Mo<{UjBB8ynZSVO#_zo7Xos`rGI%g(Rs5kE9vg#>ktME?> zwD)H4fxeEms#)WQd>>7!HS19CBEs(dd!EnGcSM)Et;+m>e|#hzhq|NfJ=$8L&N>Vc z+~FZ5#lUX`C9Z$Ly?A9bT~5(1teEJ3ozMepf_B4@%{650AQ*?$w(_1u`*@vatd|t% z8~u-wQEbzOu|{HboZSzQ8HgYcPmF$IAr(jsc(9AWPr4Iyf;FN*w`zFUONj!pgmGRi zg+===zJS=GMDsblDTq?^3}?<06j`MgT8x%RE1E%#sAzhho4v_X(MRUx&&%?Yd?zk8 z_>kObuBT)%i+}Lm=BiI}u1Jth0}O7|Fa>hzONwGy1!xg9UnN5wl>}%Pfc_*4gVSg|sMU_2_PGU7pQ>G_}3H(B9qcDCY zjjREN20-xcPyOf@Tai>X+xGqhE{wh@2a_PW$JIWvk$(pXNe7j95_X9g2eDFM+(~bo zqKpyxT)>j~55eo-j)BX-`(PQR;Vb6cyZu?WrwuWSr};`?4lbsMyh}@>4@DTnlq4ud zfbYG|38)M8FX4$kIbGaXLv(MWN`g73Xk<&zChgdy7kPBH%`nYY~1_4(}D^|^rui&o1rV%ctn8AZAyYecPusbkXW4VsO-!uYB8XHj)dxTBw zx{mL~)a3xak0DT`#2$%NN5f!iS*qTu`Eglj?RKlM2o6PfL)5ZOXHXrWE4?8PV|9{t zi?RY>z)`l&&L}mPgAySboIbq1`M{R1{^mcj#mCKD{fAt|j4>|>4=rHOWlg1%Y(_uT zm0OWHlfo(22RY$QFM{(&P1P;lEzZoshlKUDip;C77LO(VtJxhM4BAhvg-R&3oNF2$t?<>RY|r!ogE96z%^kq^l|8;^q2Vy`w6Zo>$fFFwQ} z`>Vff@574i`}`Zut1h(ho+iN|fO$^*tq!BXFWX=XxFMABnQYPDE^IZBM)}O&sHbjr5a6O{TNH3V` zyFEVQ*>LiYlpqsPkfHSg|5{rkz5c_HL|Aqfjt#R)@yan%t|W=wd40KzmWF>xE&-rKO#b<EpQKqvrLLtY0e%Yc;);VbxP<7kt zxKY}0$JVBfZ!WYPk9e#s{vmkXG{6djbIq8GToQF~Fei{<$aB4^#v#cq+bUx&6dhM4 zbD4cZE=`)QBACN1Ff$o&mp`>I@KxrD<{LW@v8NDkXb1j6xpBSko$P18>uQu*_U?30Hb{mum@b;* z&jEOqIa@}dj=x!B#vwl;TU=wrz2SYxmd#uLGs0T@ z)kjGhr{PdJzY~73~CWv!lO2E z`Q-p+*}nUk!SO$ZiQ>6d36yl(EGP7(HbDjv^sz?vX=Yo|cqb#C z$na&!hGysK!42V*B-#e+)S3|oJ{9mqJq*s7E}9F}=R-?7-gaU{yqxXZ zL<7qL>fx=1NhE)1PsMp4m4vA5z0vuVG;%^U>WdT9MQUGr%VLrods(g(SyWa2xHR2DUE+X*POn_YT&y%m;Z3(6XfDgNHBzO1i=mNd|B1^5fTs(EYQDRxw&K(}Yu3MZbx1qtmCN0P;3 z8E)}C{~@h9Q@Dmvz1V&~=B@O;{ceC@_;#Y?ONeHoJDqWm4O~0#m+&0np~BR zxKU1r%1q{QlcydBAFT|!n`-?wF?SO4`%dg{x;g_Qoo(h_-}2nmk3~?J9%)0;pFpv- ze~^r1)#e@U0v`UZ1HO|#=_AQ2Lb zB`AX-Xu)F7J=L5nJbZFxq3R6I&A)3Lkf*_pB(aJlc|iH>D7LGOqhVisSwybQSRK8G zdF}iPmS=p^x)Gp;{M!vv{Bcw^_2l3I10~6e;}UPdaKJM}fsM!d+A&6w>}od2AdAsP zjT-{YWhesi{+445ppo;hY;Z>+piy;stTTu8$kl~!pqI7m+!C~@XEG%pQQT9lumwb( zRGo_zs_!9`s_)b>6+}Cle3cl?t{1{D{&t~~yvJj(s6|jCtBj7t7Y3u#Ghr+1hDEU5 z(Z+uOBI{?;()XlO9Dg!=1LfuvV0lwA3#D1b9ps7zs&_Q?849srQg>MJ*osb;KJLU9 zSLIjx7lz>t}t8>_t&N7qKVsE>g|d31xR9d>gi=}A&AIyHwUIk>*fQ5 zChn}OenjZ?f{c;srVH-&WRG~TdCY(E1F$7m8qg9K>1-SJonL>boS1GIw1we`b<&l} zK;wTgc+RMamZW5qIr6TfYkf+i6CUh(B61tr1gN81t%7THJZOa1|7xRc%TPBXahieJ=O(?jTs)IRx)Z7`vKXNss zB=W9tA_JqVj>fV=5a2$%7@ewfm?oE_3RG{pnc5J??&}{RC@4CDPz{aJ=cS;9Z*%2N zkVf?}Ys}6<%0p_1Y1$kmQKMbyIDd6LuHa~~0PeSkd&~s;5KSBj#v+O!Q(d|PBz;T) zHb@e#?`I`d@Nhmyv2rIUqbEYL(!b$Q)>StWu#o=Qy30HoqZ+lA)qs>YAIq_G=SHHM zYE_a>83yKJHMI+AsA!Ks@BI6Wg0HUv@7^;Oi^?A6vDTJ`2w!lraaxHplE=m2eOa$E z6(>)MY#C)GKi4Sq8Kh6}at^$dfuWNL#PGKco9PV-I&Q6}w>ezx8h^#Y55r7e@OrUL z4++hku>`G#*A@?E(7Up)ukaPetL*;b5U7whx%v~|9dK6JD${_NpwmMjLi+0ubKi6Q zt9rS)R4uU$VIX%gNR^7dPL4s5L)7YVVBOJ{v7BhBO&0w0w^`-HR!d)WXPrde#AgZK zdh{)+%1vPA{Et1@wE}htN&=3;f^Pm_93~3_gL&?NzNK2z5r0I9G30$?Spwzginv2YK-J9eE`+ zV)Gl4#MK&OQhE5pc-WPlPG!oqOGCY-o%?nlqP*NO`E6lQfA(ITO?EqeOt#|fXbe$? z5$jT-z33Xh-#NA6HN5{AbLh@jJgF7J?P7o2+U2veKpbAYM26yz* zeZITz|H9+$AKs|*D@^5aDVKefA|M(70M$z^G^weD?@#IxtKl3<^Og37knTOP*E-;e zYrgX7&A_6Ho)Gnf0@fcbYJDyBYPDAvj{+4v!x6xtB zDmoTf1j&hSdXL0s^pqHqgIi5&3A21ptsN<{(cbL6qT~s`ufivhpr3xCK&&n$@w3T} z4IOPIFL7rmEeF%j;jZ8u?Chw9U$`$j2T|(sylFqJ2*yawX*Xbk4DWx@soJGjvrerf zf9A=dH^4ua=3Ympf@y38BGz5NQeNG_BKf259oZ)nr<%ui1o^!k^Yza47qAj0eL?E@ zqba6h(zui&%jAI;Lg@TX;`~A+jF-qOck~0eTr8ad&(8&7;DMKlc)273Dr8ttIEsgz zyHeO&6BGNo?qO+9ZiP92FA4Ri1DjhpoBU`Wilg#O*q%n(d`mGsM1nWNdSgGiWR(?2 zeObkmbF2f#WRG#ykDkwlkmmS4`XSY^Ca|0~zl6W{81%!#M6fl1pA}X_=Im{DGs(t` zKPy>+0m&~IT~vF$(qu)6R=aD=j zXIXINWgW2?_vZ|=S(1YUwDpeHVWEJ)`MG6M*V|W}qdy0?DuumnzhOVSvLThx?|ytU za~d|n-yiWeND7farqtUJ%E7$K3w@MEQ*jnKdVAv|{v5AW_}bEa6Pd_-@A1PjeCnV; z$0A9pRva8t`Uoh6K|!)D2xse!NK;P5kiaQaTggC!J^kBdgZy=J5P8~o=l^zz{;ti8 zVq5B?Mye%lJwNgs+zER9K=dQ3zGV$Y8ru>)PL>JTo{#D+L8dh~w{0d_ea6z|ROu=y zRk_7kuY-lmmk$<;!+#e6TOZnCNI2=Pu4K};9rI9; zpYC%i&Mqk%hCNXF4(PQ1wc^mM zBWr;%i9Db!6id0jtB+*r!fz(mRFv-T;0l^e#Ame?%M@ghSdl++(hFRk&Njn|sgR@h zjr)b+_x5{Iphvvf4$%)yej8Y^(|u(6!{B&k10{Rm-F4CYimk-k#M^4f#VcVB>rPm{ z=a8#DrOiM0s=H1$AVSkm6DFZ>6#VDM1Wu$GYYR*dgeHCfh-&t~0KIE#Baymeg;@3$ zx&6ynK5{iknftP@{`mh7mhybJj0ZI@lTu9Gwm`#&WPiR}OY literal 8239 zcmaJnWmFtIkc$-8;)}aG6oac6;Iixjslwz#{y6n86b#odZ~aVw=b6!+u1|96u~ zW?o*BH}jIrB$Gs_smNlY0nq>e0H(a0w8k54{4b**y_I4UNIY)@$y8BR8u0pG%Ihpm z0sts~%S%gYxo4eZd$^M=WYlbGE>!AeHhK1wBH@9k*pN(l`akd@%JmV`n!T5UAA*if zC|fvXDDhy+%P}M|qGmv;so_?8a7I3|ks@>HqkQ4cTu$m`8>+M$OVnd8U+{u~vma$E zW9$^Qo8}i5)+=<#G0FaKV4&=CKw!ykCtVTeAh^c_n1oYS|F!iS zb;x8Pk)0-_l3ZI~a|=lRM+!eF{`*&MFph))uAQHrf8*GY!XT~-+-Jp1pu-;?>OBGf zI5;LLE@w|(fR{)R@jw62%|xlET8@!6^TwkaT>}rnKn{Sd^`$g$&x!d?z!=WIfN4By zW8mxXWC6n#GF6V;MemKz@$p}&C2T8qMyWOJBlCs&&J$FxoIEEeq8OaEfPpZcOsjT} zYY!iwWp%J)c`jYTQCK|Aa^NWOfN#~!rQYn;mxqM?_QDsnk}H~@^^syjKZ~(UluUAe zbYkuMxXn}UB?fghLMng*kUQMJCZs83af-3#kXGKor);^DgGa6c2JPfm@H=WW7I=IX|Nhl*=M{sykf!jUkqtA}|>4 zAtjlwRcW#*LB-KViWs(=>M<$8!9>4f7$q6u2f#rJlOmaz$7Bv_V*YI(@`4!_+9H_{J;DoDeP{WsIT-x zMFdxGlJ^omD-}6$Yj7ZZbvaE}1ZOO+^o(08^9d})tqO4PwVB{xVAaC>I3L>|r?0kC z8rEWQY;lKno5T*slA8YHXa&BQA0-mDD={qj;3x9Wj6`_ zD;#v^e3v6lK~Ym|P9K=QxZ*zsUZJ7DRGwSjT$i;}r4;K#=qF7QdSOXWrA;X{;13|G z*|>(tiyX5d5zzl_&rDTK`=TNf-VncoN2U7CyML;@{D!xwI3P7t7)W}kmK@0fUz8k7 z`!%o=!R7jDj)+2rQAgz$KDa^<6^fa^RB|r8~cs9+9xLRXF-{is3Lqz zwBID}^{~XIcE8Te>dM+`im^{zyNfx9j5oz-34>Ij{-+yoo>C^W2jeFDD1Q^eC!|Kw zFbz8@3c7Tv9TeozA2_O=+x0=RB*MeAgHqJLMI)RQwaOj_t2kA3@;sA+@YB>9PjH6$m_#hx{_BZ%u1bv)i9HcX1DLZb_QCQ8HH=B_` z<%DLk&hy9qeH&!g@&_@J8m(v+fT2!FnOc>Z5|NZOF0m%PDKL@H7-@N>`5iI$09A0$ z*`)?VUj}4|sd-pgUW1vJ>TXs&KkX{UdK|#yvyFlf^!5EHzDDd}0P)8uwUw|uS*lyb zWDe#S3W8$Iu(Ar^GoVjxC!$dVT#5GlvkQV9n`)h3D?M!sO!K9r?&?Envg#_UkaF!& zRZhu0w4vmOlUVoUB z1)JK%J;3lDl!+yFY+FrTca15TOqgfLB+;ynf(<4_CM1HNL~}PCTSOiiwhI!`!e0zK z$wFH(AvULIc5Xu>$12Vu4T;Sm#~M6%aD#HiU7LsuN4PQ3s9>I`sSAoXg1*-2ViSg) z6!ET1Zc}|<40@ya1yFCRu*kj#;7WM`d1Uxrj1;5IJ`_h~I5H^6BWt@5i$DgKVN_U) zMZun6Ay+T>tf)2IAKPA)vu?9n{@?XUp^@fB;R%_H4%?|m6`#*O+B`GmsmQK)1?ub0 zZn)UJ@H0$Y=wCbMek_6POiF|XQQkqx820;1C_GV)LP=rR-`$!RXydquHW^V{A5LJX zUl(Fi`AvA~0-IRW$Zicmr?~UZG?s_@>J6%QDVf+G4;xMPH}vE(K&%uWcvF-s<~DeF z-si?{ZXaF!DO*2FurY`^`2i3E>BiS`PUJ?~wUVjM&PPF?5JY%l1yEZ(twOVRBPRZu>N$c=CC9GsiPL?y4KdaoT z1?TORj9p}lp4Eajb}eQfb}N@(Q`)B=3qKI+7|gc;lwWN&9Fb6-yJbgQu46nqI=s-v z;(LTB$<@b&=7)fX;xH^9iA`PUN~HoOt!!Vmja^IXHI{?y^#K9<-tf|YQ;H}+M}xo> z_uuZ9P?|UghL=8(`^`#!LBq{3wRV?_^nJuh@qjLfC|t<$&UdOGdWY68H+$}}Id0SY z*AUU%4azFU`#-TA|0>&`9M5xwH?Qswu!RpGm*cjT5O5tY)qof8 zK)3ki;K+d*7nOPj@kmdnKKjt;edc^OB{<|Ql*JYGz&b_JK;}eTN7qaFUB-fk;mm|Q zbvWNyQ92D&(dlx$A{2Huf8V^CsklIt75G?IqHa&Xk@6=qbywo~7x$&cAv~W?Av+PcK$nlwgdF6s2IVoa%5cj+{H! z`}xoOqR&;0udu3@vZVwE8$lym5}nPHR<56hFE%6MM%+Zxx*O^jVOi`Xa*Jlg;``OH zi`=@cJkbuyY|t}!|J&qnIQ_wWuU>R?YD=fKY3G>9?dpdF8wpq8K1<*BO|lowxVm*W zI%(fq3nMr5G=;I2G)>nB_;?WJuwygzzl%)22mQv$m#34aba~1>9FCBcsVwp8(n>u( z%HZdzjHfXy8dAu_nA^67_5Gw%g?N|$pBm1IDaV(Sv4Icv8U7QC+y}eU0nV!9w$l^P z`B0!}gPz>kAxACve(td$2Bn*kb4mV(mY(B_osoUmf67*QdOn>kn2ISq7}g$gJl_RZ z-?9sbYN4V4`}6jPv1u{oCpP`YpIkk{m;Y1k#gU6=MG%7xE6I}t;dS)#({c1jSjF5Q zJfrqHwB8o9}*z#w* z$$nU$UGP$jlKD_>1dh`E@$x+6q6L{>Mf2>0-hHgU2zHx3HO7UqQ4g1wSAa!%o~cNB z)bCc$mt%_=H1hC`@6wWx0^?&YejX&#=Vv7T%?Wms6TjoU<(wg(FHGEUoKl;}U zx?4w_ye}*F;xl@chccJ^8!Y}Zl}oja$%*@Xx%!UXtCB$M0ErPbO<|qB&~Ff%v9mPo zDwacYUpw2v*H|<5&{;fkN8mPWFK0$BdvwPCT9IfsXC}QxtY036c+hz{in?cloK$_( z{?L&G%{V3?)qNDL(`o)DEFiMQD4}n|DLSFGAq1=zCTgmF2=}OPT~KPBeM*m>flgT! zZC5zsa_B7oAmu_O4Y_6jxjuZ19^rMw@mna$Q_YTh6ZZrkpBI~`XIPlEdnVflBR=|vom+qyF zls1Fn(!2O)6s%Wiu6f?5(aJzQwJnNh`_0e{h>Bg7Xn3jnHofS&|7qm8+!vUJPDs3+ z_Tq1i>63njRYPu2HTOrOhk6_#;^$sF?9P`L<3mj$6>68*yT?~*_}{vp4sfyg*P*yf zA%4YDV5=X81{PH>JYBmMgrcufrq51oX3z3y0eX~N>w-Ye>OaEpmTX+E4!>_5^TUv^ zpCr0GSOa+DNH5zeWQK9t9${v=up#(4-zT{{)g0Na?{Q@FU*F#i^nK-5y6ojGP04_* zeSGzMP3U^e0ma%Xg}tpN`=BKJ+^|s29M$!Z()>l_?;rX_HD)(o`Xt?kjn)+!A{2el zEehtf^Rb8G+>NN$0{?ItD%o8=jzq^oEBX8mOy`zLn$LzsCb`*`R~|&+a|Ls%U+*x> zv4w|I;=sRV>k95f$2*=qfz^WTjRP11kWCev)t8`SW!P2XvZJY5EX~mIm#@m@)aMs< zwvToH&F#x0xFW?ILh7f=>t>q zEMLj*Bfe=H`8)PvusVpDJS@FrB-ni*?LyD;{k;co!yzbClR+(8aDl$Rov|vlOEk&r zqkJA4GZOvj>Yn}h!*K}e1suD)rxE)#`jQS<(s`zV%FDePd!(T=h0 zARD3i@AjLA^9rAI+z>cjSy|8pU7KF6{|g=Gn4~Qt9(GbOGm9CcPUiDZ4qKYBQS_1A zDbk+qzPZP>PyKj&Z7*kktT4Es6=msg6z*{+E{r^7$Gh>vBiW|A6%R8gXO)t4rh4S^ ztoEoPmnVIHZGfy$>`YF6s+A1QoX(0l2{42rDVISkQeunzwm;4_YbYuB$Q3^ENjfQp zm3P1wvg1MPT8Hu$iRho)eVq}9O}FZFqR(M34VGcUp_ zPMbDHRrKM5r_-S0=OG`feA=bOy0lH&7q_s34ql-adpX*WAz&IP<+J1wZ6jI&hWI04 zuShNcL_wXjllQLwxbuSI$||c)wCDF?=U;?6?n`_MA~55W$lsNRs0n@~JjXMJrb_hq zs}@I^&K8(xoU8xUhS9^S0QX`;OmacyhQ)r0gvmL~G1~430-L>GN51^2Nvc-|2F|{h z)Ss)PS#XH|!bi>=mRc-w-U4N3Z7Z8Y|hpupIalW8%B&`Yu3v}`9h-r$n zk+|D6l#4oDNz`Y|BR@vzeK0E?m^NmJ7;zK{5Uo|3));{SOw0M2)4l{~UhUl~rAS_9 z469q#bElu8ynh{=R6kp8KV+UW5vBcB1iRLJ=dmbNBF(ajOkHHM3{Oe8IQ>&Up1>s^ z>2I0>59{BagJBJyMJdgFEIaRa)+00hhCb?nx8i0jHCvri@uRd#I*m?asCw!fz+K#- z7}vnmhfF}73($H&*^cHV&5)SEQ#6I8raVASLx9+Qr-^&&NWVSeDu*`gV%E#^fOUHI zONcc5g-i3e3zLMT>=B;6f3gFH&%!T5F?_DKE8!jKDw>WqXJ^_vk=OX6&GF;nb73e+ zjC-WdW*cS3q8(=;NRuW-YAWp9G0w z)$XC|0(M(#HfS#m@jUDKfnrVk#>A1cI?%qHQml?y6yd*|lb-D5Go{n(c6vPL;_f&i zB{A#SRIqn~>ms_oOvX{5S8+=8N+cEe;HB8D!d=v ziqA{fnZn~}q%|(jJF0M}2rqWc*5$E>wGxUBeo$RIA$E89{mYrYSeHhbVResOSt+86 zYgDy2$JS@y^LSHsQMkufUsfGQTT2j`bgQ&E%aPBw_uC)}TA z{uGLqSS~)=XrI`GPT@p8(J0@MjP=#ggJ`m;6Gj16B!jiybl>&@yM%vjglq}MY9Y&DFH+}rnjl3_kDZ$YY00x~#5g&OwawgF~M#>h@A<{D`q;B1!(of@?ir|t+ z8MKtYKsc)a)l+6FwAqXzs zoNGURu;9DAvLg`ss2@CH;n&9Z=@*7fjnh=}NtMtWiHG{Z#b0q2#E4;Qn9O_ZgB>vS zcb$wbPqb8<3&oPEe38lZrW$usj&b)-dQ4Jxs*bA;l?&w}K-sBkla{@e={8w*qD8Jq zmcN;;%Q#Z^++RpB+7k8$rrwvFZ4(U}crf1`Nu=vh)@03K$gA>wdyd1G0O~c@TjBdC zMt-BZ4f59E#b~2R*;OpPy{_AD$Bq>i@q*3~2EJZ@KXKE`Zljr@hG{sglcI?Wnwsd2 z+#yjb`MYf-q#+U_Nj47h0+rz;Yyz5@nlpbRKZZN_Qo?M-au%6Uz|^gUQ912?vis~u zmypQ3@sYnsBFKH8?a}xAo;UCC%pOhN4H44I6?WpJ!}9s&+lbHe9QtjOQqpYBAlFhAic+<+Ugx!Pz zkzPf3^!}cZ8KqEQ9J*@2%|GYbQ1?$}Fgg(|1BH84R?tc66cHatetueLkq^>LFJczHYK(75e+R>%~qB6nVWAy29D8T0%x&Ow3}~YyUTBt(Jo<%3FcJ_o(QcG&!okmGA|!=s1Z2%IYkrd8Ti- z2dc>5P4|1ST{!GpR*1hx_$tYlM4i`mQ9*C{r-<&`RM ze@_~}7GvWT!PJ5!U0AuaHv001!ju@n&eUzLOTmlm4V7Mxa`-S#{v?!m+h+p;c`jvH zjtvSdXC*^&htdQqbP`a#85BoMWa5}$BJ)9tIg&)7F?8}PWFm1WTE_=Ycgwkayr#<4 z^Lrn-49~)q3E09V+_c=uhEa zhOMuFWtN6ZkC{)4c1%3x)G-T~X*taJd!O?v-oi!NRQ^ycdu9yDE12{-xAwDiZZlsL|x6gW7ExIrWf(?Z$;oSkxVbrk0dKi0;} zv644I$xIqjvZ9{^S^w~982Q>;`KT`zvErMThwx9>=Su&?^sgD(Gj($XsOQ9K@DR)0 z4D4WFMSP}O(Y|UXa#fCzQfp?>U8ui;Hwnjte*$x)EQ7&6q?g^*=tDT@+jqH5mr*;J z5jfhbVcC08N&1q@Xh37-UGsg~Ux0ac{1Bl4fKllsJ!fL5iY%K7i^wl4HHEq_=4H=9 z?I%D^b9O6#e$CV@{|X00i%Kc3RftRvIFUS$Ue;h~nLI9EJ|fshYD5)6YVcaJ?xq}E zPsG>LIbpAfIa>I>RSq!cEe;f=XrExQe&8j!p~q{*I@Zym=4gHMCgu&F@k(eAF`-LW zsygM&n>9F2%pa466)Tr^U3$m@lM_$1A~*75eusQ9jDdLjTA_EfbN4NPJwtRW^h0WRP+b!Bw|6!`49`GQm(5jcLH`2Trk1X{PMw-2R_h!nEUHv#x21 z%%~Q#h+zg8Tgu>(u^O!E*B+Jj?**paQUCEDtEyiFMR_i&6VicPM)Wai7*yEqR7mxnc$%+GV|2|bO>*l&!G#;k zTmuETRh>E(r;WKw5$}h-jI`?#*RmsQsu8MUDJ-+o-&FR>1pYel^YkX$Z3WE65R*qu z^v+tJIbH(JCfFY-EsQX&^w`HXqKGpopD{_&;%HAW@$3XM8>&bz!#z|m4%xl?VXLsp z22O#&I)w#48r_&I)HClpOWmYeWCcX&F`h3K5FXuOeruh&v$FR2kR|u99e`PA$c=%@O$Hb%}GpkXn+WqR=h-kM_JP{po{qkEXB+gY)y0G{F?!j-J^0k?b zV%P&DL5xM1L_9unzWBNC+fP_mbCd{1lk0nNuW;S-ww;?$`JerQlObm5wWJ0Phru?V z%TyIm6tm+~sgv;PspxQ9Sa@6?BR6De7uQ;!z9QNOihNtG=&Xfj?nZ5ta>H!WTNuP2 z3~B%PbJ1VYuyAu4i?IIpekg}SXIHnFK|Cp#D>m

$GHQUhd$YXIYF;9}Y*2RjY)F z!~5r5B(JsH17?h5IreR6d%_xn^uxYNj2(sS^e)wrnGPptqy|vBCw|L}b{(k@QxGe3 zI0m2zo%GL7BKu&hKxLGYm^)Z1y(BE|^dcCTLsgl%qC!9nc~?gU1vRT7NabsT%Lyqz z(9p+ox%ACa+5E*gikk#v?z>H^U7hI&tE9oCn#*rMAkH~yeiX8Ty-1is z4{l?~_u>iOUseXeG}Z7u@wZE%$&9HpITX7Z$p0VAJ^B4%R!H_Y$`^k70RWJfQIW2e HG7kJ7xS;I` diff --git a/res/favicons/favicon-192.png b/res/favicons/favicon-192.png index b0f77ba1e909189c44d197bb5ce9cdef869f073b..8ef202fa29843f1fe242bc90294a3663e5da949b 100644 GIT binary patch literal 13614 zcmb7LQ*>ob(>}3n+ngjbF($?Y6Ppv;wrx!8$xLk9c5-6d#z{{8y!ZdjxAxxM`=VEO zb*-nm&{dI23Q{PDgopqD07XVxT=}!_`R{{={cM%jZQwpTSYtUUalpraPk!g0WB`C1 zAS3==)g${N$35Fb!?PyO+3sh0Y5K+F#t?7_R*e4JkRcT6WN`u+83hG)aIGb6V2>X~ zXv-QtJT#`&cE5Y==`3*b;GSon5&*Yvyf?0I`g-l;KzhCU)z&3 z-xcqX@3c<7Ofs!}CYR-0@&E8sw~ijY5lDsckaz~=aSL5+(|^Y-@KXGI8ZL>~ZXiV| z4`D%mO0}GK&Tzp2fd@!rVDp5(#LjI~_j&2>)~*1PL~_C8LzF3g9Ia?>nvOZ?hi|#F zwurU(i25894in9{Q)QI`7BE~-xK{2@e!7ZR`iP$5cMD}cz{^xHz zVu28R1FM;a$Oc2g^6ZyurdrSX<_KS{w9m~WE=YAd#T?!IELiXkm=Uc$I$&8>MPwnA z2!llG$ON*cxI@i>*ltRqlaVgg5=B)2K1x~Ka_HTeof{DWtv#s8%0c#WJAPt5C%eL|4b|cN@(>wN|M9T~=}IjEEnrnM+S@5{v?>8>cnvs`|&*>aOj1ynHbx65cv9`UxMIb7ci0L|M0+u8%#K8jqL z;R`0hM3q89<0(!*qFoB9sYCS#J&P{n#%lD z?>J7)Yq*1x7Iq0|J4USWqswI5;LqIXMt=Z*4yzVM@dCS!4tv|G^@@A|^)_O!#Bpd| zq_t35`2$KCpHvK>Os*Pr2YTuT+aC9t7P?b*8QtxIR>WK&R!|^Bg?__`czx~3MRDR; z$hT3i0t|8P@^4@ByDSP7#_+inoK`!HQ4m*@4)iHrMsL=@SATxxGa_aQRBH&Obe~GR zWzXbW56&RxvcMB3TGGdDo<|^k)m};mWk^qi_!n0SW1*K>3wLFsU zQn4uq1U%%II8i$2mtr1H{J}XOwBd_6BN~9!o!O}LG6VgUKxhkKP_As=Ts1CQkS9bi zw@;bf7Yif{+x+alaAiFdX;p__X^TmK?nu9eG8S2h+e!q2&YuYa{&ep8x; zANU~mz?B!Gt$N>{g5B`wWw!jJ_x08)gl{o9I|{QC5==Nl0wy#J#P}=;l#j$~G+(0*@W4tiO)2)2ukBLW2HAGty^ShFQ_? z_a4NZG-H&AwMaH2uiV%Xn*v-~!P*hQ84n*Dqm z9!})gABGSB+93j~k%PN_K4rz#*=E;LEAU0@Wcbb?QOrPnZ&-qsl=H#x(h^qf?IR`4 zQAxxL;QDbd4KIix6?W$EOPLoGLaWbI1)53o+A5=f%oln~?N%+j;@;H{r@uVf_=U)w zm1o5ATO5970w75lwz;ZJc6Wf;KYkePrSOga=!vpK90_`c^5?zBuN}M9#d@&d>4IT{`Oat24JzD_og*#eTJOFp|>qF98 zn3wL_xK7I`wZgY(jT&=eRC$Sc*9Ikg77U#x?^iE!NLn*RI@%oi;Xx8Pg&*WENmuiC zx*gfk$>aUU^rG;^cGwz`4gi8k%HT#lnv`8dtxL#&>&;T+$QnHSs?)&a$!$}PmR3mp z0`~GjGfV~=4s;PTyr+ifnh-Yrkg5XrhC+Aj{%p10J_1GgAMEOpBJ?E=wn)oOm1%gZQvver_+=)c_)7uha*w`)ntM#<8AvU6gd%(X4TfxPzA573!0nv`@vo zhXK{xee5%9Ix}l%FGQZ7%hSfEPw%a&|D-Q{cgsE6)nc7ef(Q$P_TIU@a6p~QxW zJ7;hlPs4t??nc)=>Zd5q2Y2l5irDW;W>E>PB}l{ey)N6*34Aa55Ho!EdHPEVv4TTQ z12g#k3njs@85PLZG#Gr3c-;177yX(@rs z5RDw@YR{iHpv?Uq`t=(gfqP=5339DO7|F;37JwS(@XlhP<1XKG`Ld`*6hWh5|HnE) zyuCq#9g7SkY{!)Vk5}3NP_Xj4svdvZJmE<|f?0J3cclCZw+!5FP4NcP`31qWoQ^ci zJx_)2x!_ssW6_!cdcT5oUWyt5O6YlL1?~eI)Ble4wax_jaz(|b&)(zsK@Z}T4Iryl zGe=^jJoUEXpzo%86P|-2X3|m}KYZ00-l-@on0S8*KghLxH5H7KTB54$JvqEm?~eAa zlQ;aE23Q7t!0ZfB7Qqm>DJO%#b5T~u2B#~tvn@79Yv zP%US`iw__F{AdM^lvOLZWErUT(J~S@PY@RE0F7d$S~)e3$>UIdklC6iTuDxEUAOxvum`+ zGO8tV8W`386JtG|syoLY~X>!id2JPlA7!+JEsfU;_I zSR>7bvZ>1DM6on30LL&en5<_-g>R3)KExg}U&j0q&q@r+1u!i&Zj?!5h@h#4jPgyb z=}&B)tK{fjhhBaHZw$^ZA+leIm1M#g2x}IZ$ z2|VR&R-yH`fJ1h}sZ>4qWBDoZgb31bPLk)St(xr#N8|-5U?v^tx$aobXve5y67q*P zm_|yU>WQ?@E{HoK_hqax`W-WUkKEpNaLg=-Cvbeiv8|VRaj$KSkKrkS;4ms3#hJy$ zSj2|a@~pTXr9MX&1W%exnOi2d(%1(-p`o|)PuY2 z6Kw6fD_oS(C8C=dzAkkgQy;#?l5|#$TfW1Hc$##9Nu>qsm6w0xi^~>B4pC%@H8hL( z-fmA9LxMhBeo@L&6I0~ya%q(eNgf;Pq40l0%2My~*4Mb#${br^3+r`UP`s27Y^}%l z(`0ERd;^68ALA4!H8DySj?d5Y8_mDA@tSuuF?E5#ZJ7&%`Owj|vY9YYgJh0vYzbpJ z9w4}%qit0o5?lyU8dU&A8a{b6Y17l}M<-v!Ss0_&?Yv^nz~>$!0%?yJ)O$7ei%b;o z_ol9Qta>}RWjmm>`xWAZVa+8?bA|o+ipm3QphV(Krv-j{!EmCIIsQ8=wc6%;^MGrVc-1LN<`;- z1wroCXkbC;qlKHkCuM_bnE`z7>6vh><_@3H%@q45c+%1>SrPbGj4AtQ{*$!-(9!Jbp|ol*c@;thPFwB_l| zy=Kl7l!B&?o;QW2?}aI~z9*p$X=~m)f74Wh+=9h5p4++k=LWujuBW&pxp^_fv zp!g0GTQuO+4L}Th(|)|ZYt6M6wc$00o&Z&m>eUj@Z@1H(Jxjvv$o%PfH`+SXL;u9- zAW^4YtyrJJ5wOp7l)@SFFCod%5kso0tvAO^6sfIP(r+rUL&ttamw&ek914Q5@u!XK zyqriHZaPblTlx-vm^GveukL>`f8TY}NG%oSaR~MXHa=L^RSSFe(sisz<(aIt3-MbA z$eCB9ZhC+UM*Vj84W8d8MAiOwYABjO8bf!HiKB(qY!oJ`yQ*d!eZu;uuUJ{1K(mC< zp(2}o?cPQn(;DsL(lYs<6Nta9>ppmW$B-ei@anpr4CUZA`IajA=f3*LZ0E2K&{%@+ zwML}bHYsvZdqZFp z6YNB)H8aw<0KdUWcbxeIW#Km6mR!9GuCcW`E!F*C(&3YaHfKER%b0=iX>KpPq;Nyg zf>4Da6NiO7UOa_x-eAjOvWtct&c~eJdfogTcr}j?nhfS?lD7lp)?E}5$>A)hev_|s z?u_6kmAcS;-fy|?{h;S(?X+6z?fzHdywr8xc^r7o zcl)MXr0aeuT8*KFIa_UuggfHNFUsIWEn&>S%kDRU5owv$nERn{j?$S4J4mm}7k)}4 z{(x3=8+yV9^76-Zdoq&$|EbALqd?>lcaJbOU}}D=(oD5Zi+s{Z(k76 zx2d=2f9ZURdaS!50hj;MbE zJWh4CKv4nnK5#d4;-^1e)sk9|(9T=#$F$7+Ml+XKMV((B6v=6uGXEJ;jN{#2+KUq` z4$=2g+XyKLDMER9g;hSH8HSr`%|@ zd&$ca880R16_yvY=bXsf)l<%_Nde`^$ zoi81#r5<)asf^sgcN!kTZSAznnPWgj|M56Q1MdExKM{LZo9rk}AK&INuz0_x#=9y| z5+->x8hzT6ilA>vx7*0`2{=777<8%CTilQ1zo8gEd|uXtDGf0r2W4~R@Ca1^8!w0Q z9$RgdW@*biSL*{)lLlEvb=kyk2iTh{8S9Xd3DcmEj}R>+LRtXk%`cjZ0dbCP?cbu~ zo7TRHH|Q0}duYO6_F8j2@RkB^{j_U~U z?8^WZZ;=v0vvfC}5={gTAq3c|H$aN7t&QT|(jP1esxX))opl$^C2h}N{IWB^rQ3HN@u?#0;0cFUk&js5pXwz(k8E??25>Ka(z zwH6I@Jd-2+Q!#V`p>jjIrH&os@&ZEBefM=U5MFEg<1vDRkW#+}Qdx)GDbHtOTw`4h z`gHt*qT-lCX@AP@w7O12J+-NfcV+u}@lSCrpFT<>RjKLbs5S*W`Me~*K4kOk1MBK<&cyQ2$pukg=RPd#4?H$f$q-0v zROG}BZ^I?>Vox1!v+vOI=#Z&QDe|FznTd>!{WY&qn2Kw4$V(VybGN$eSi(NN>_9&H zK4X(=d)t3EAX$GXJu6PL=)U0TlJo0 z2|o+G#b6>3@Zg!vFB23>(8~fpgH|RM$GFm;q4W0a?#@@%g3;#5l_7dB_%RW{vZI3@ zp8V-oml&)FjdX5*+A9x_FobV5us5YReJU_W_G|k4j?U(m5qj6MEguO#O_b5-n^BVN z-;;R_phT8uSiO*LS*m;9kFIt**}Gd3BM2zxaQoCq)AsUH!V6CDALz%wCfdv3AP&BX z&zp+;%>Dt5Qv0DecipjXJU{kbsx|!f>MSYPEYATDBHkcA6a1$T1&?GzV3{dwdIfdg zR=i57!J_z%J@TK{M zSzKF(fK156DZ3WYWx^4fVp$_EN1^NF$G){fZ|7}z3!0D|ix|6vHL~Xt!-z&+43Af; zzuuN?74I@qQ}lCh=ZAeScUjPoMk!Fx2W_}I*WW6>_1KEx_3>jg623%f?Xh>mUwi|E z9iw ztE>)eM;k=vaXy8B^t|j-PKik7HuSmTY%u`QT*{-Vo*+>t5P8kAdNCEQo;!aPp;1AJ zzq08-byz~MbbZ2FF57IH{&t=_T=j_J^ZVC%m6R-L_yqZ!>-dtFE9siLI-svw2uE+; zv6T3HvJ`IQQeC`+S9rWYrUC7p;a1*!7d-EN{rI}PojP103EGBou`MHFruO@-oGNk)ghb#tqY}PRXuX&zZ z6vK6h7#EHWWTvnrH{4QI5i#*GQ*q(&5vmM+i~VfSbn#m1z%G3ws9(q zDVgL8<=m$J+SsT81f-vO8EAkn>EWbiZn z*gqJsH;U+BM7k_4pA?+7yTR$cA0VPvKTo=|%?|}Hp=$;4#^BblV1pIZrE7czj$lrK zur*=jnAc1JX{2LvXh{L>^`H~NzL}Z6@F}Bv59|UNm)>;irCLVK4xDWiw$_tCtj$6J zH6hC~T=v9X@|Oi*Z$B#owetK7B(0=C)a<;%nU?v?`z6ww)8vGV(G|q4$sWygC<<0; zCG(jJIFJtEE$?ouDblThbJc%jkkaJf7#`0VK9X0Ltdzq^;|o)ciI%`e$yM!Bd$-}< zk&wvROZBa%xor)s6an}pC+7XpNO{fOh-Tgymc`O6Ktv!cXWR%>92(i!!1G7o?R{&h zXxfk2Db(sj`uhq7Q;0Y$RE9orq5|gwz66d!*=a@7&WVTl5CZ}&3W-OTr{+{hZxa=I&^?iO70oo&KKaGUC`8>e7ORlCq zHm*5a9+cNfT5o;1i#O(m|GdR7n>(MlSfcH&yKe4Y(CIOsEx&ukLuA)_wr#TPJh}>F zOjq$Fh)?|L-#q0}#lI>lLWq1J)MH}b9&)LXH`V43qLw%S0v8bk z9mR`qBB$J%RpPPd1Q_|)`*rH_pfLCF^Mmx=Yq^sMvB;xF9aH=6I*fnRaAV-v5K8Nr z+gt<2?liG3#H9n3qNLen8S^OiaBE21m-==gzu%XAb$LG^vh=+xM^|Z*8FTgAdH?9U z?l0-JaugKF;&l&NUWs_$&_U>WiZxw(yP@$9{5n`!NP}(K{|AhFVS7Nb4SsHWN?v!S z2S|~7I9?3}D+KZKPhZ|Z+~)S5K6S*Zk@?~olfEVjW)@zBk|3*~MD3;OeZ)TELRxEF zzma|PTX80NBg_T{Bpe%_4L3s1CWrtUPM$?F#PC`LUpG~Jc=h@`Lbb4vwHcyjZsd-~c$Q7t7| zCY>;BA>x=8V}m;XOqx2)=~(EU>)tS6eJQ8q7YU%)(g)~_ z$hrK)z+=KNu}FFr#~&!z?#`a1NP->kH<(O>5?(qdVBtF(Dx;L=zFv5Txrzfx68~dQ zT zGj8^rXIjtg>ufbRA=cmxe>OQjcXnx9=idJ){rux{dKC3_nIlDX4o7B&G_FY3TyjVN zfDvB=2j$^8?tTr0AGUtJRu;$H1`xOJ+HJa7*3HI?;zd~-b9IzV#=l@`XmI7=6Oi6? zg;zgru0oPg<&IP)&Ztt}7Yq-wHeq%G~{RiL91_u@<@RHp$IosmX?`2LLn}Zinkv zUFSO4X7~P#dBpuj>?{z!>CX+-N^M1EqrGD)UpKwhyg5|>?;E5=-&QVLXfgMaf;n~XCY`}{Yj}0#HWqdyjHpYvP6RAf z_$dj!MDN&?bgWP$DJrIgOu(NSsW%*R(_{DNZ~r*ucBR=d*IxV%l3~Ut4;|`xF-b_E z#VC~BnkY`N%4t3l{K3`0F=GkId1Q1y%a`kkn|5<`kE<9}^Ml!vskS9jg>zjw0rsac zj0KdXCKpGiY1lX`0|^0aL7r#9X{z)*?`x zo2cx%3vP3eF@0{;`3``qbD?ql3xdHu{>j@4K+QGE3Q4B zE^;f&rq(gJ$%^DRc-3rcte|rw?70%rO;Y`53Jn^M-0;-t9o2*x4T~fZ#o3~T%cs0| zoH5In$wdPl2RiGX&zo-m0iw;LwFz2$kxiECFll&7QZG#l%9!wWHC)B(qnW{Q!-|5x z&LO>^wjA+rq0-2k0-t$~4Gr*cZ3lK|RT z4|-;4z0(69Vx0V(ozL8g6Hvzur=Eg2VW*vx(UUopT1n}fj5D)u@=(ip!tuDR zSENcie(*KvDH`k1=s0aFRR9;Ba;R@ES#i*j*y#m1Ej7=bBI)=a4!qtllO~V~TwVi@ z-;HIXuiU#WrwlM|)^)8lUJ|!aQ38VC5|rysfP1xi;fbPcUq~td-e-0xibCL4rKbMp zw7J#YNJEd_6N*%2pj)6WYq047u4;r5Az$F;?&j92@OECb9K*ryL!Cq4e!g027=Q@$ zgZ)dRW0K{%OBfE(H%wHCGD}^?Q(0L0POx!D zEDWJQul*IzPJ0J!2O*J$7^Hq1kFkC?#Qj?W#24Z!6@GVbDq>pT1}c4pAl!8pI8~W( z=`_cn9(5ssh6w=ZWA|YSZTU_7c+FG0^sTK;<5RCBKjG3e8NSirKH>nTsik|3&&FDRhdk;H))C;C)pC`Uv4VaVO?QoA2Sdxh^7tBLWfw*YNMPUkXg zwB~qeVbLMVEs9sy_S~U6WRn8#v6&KQ@wWoR!@Z3AXj8Z96!B-kuPe(SiW2G$KODeg z;CEG;mG_{-=7ISvyg%&PFrVo!0E^Cp+dM@1SB0;i{IFvbds=lJ*kd`Lj!WC$H()-O z`ZxZ>C&0q}7k!(@(`n^CWQ8MqZ`C#D;E1x$?kk7k?g2{$#0NYF4SmD9*P=JkOrvN0 z{wEqvY7x_vB#hk2=m$sHykSIpswQ^L4JroMEHKRlBucAQm&Dp4l^`2OmRLA3sCag6 z4KFV49#COEgU~{%AGs_srWAn4wXW*~rfaprj-XIiLwG9u{W2^CTI(YMW@ctZu&ATk zrBtlOVUyr(bh|n7eTIHJpWdB>w9I)KN!OdD?~%H-Px95zvOuLs$}2Kan8EL=9~8Ytk1 z@S+w?rwoB%zmk}ct}s~1)HH^QxbxG~pRa2qUQ+zHI~-61duG}9)AZC~00NFDHFW<{ zcM*BBY4oga#g`Iw9N(uKwW5ORqRj~>w~h>+ea;U-W&>c>$8$EWoRQLpfF3?}&BRFq z1jL&y-9~D(PBRlN1V8{X%*Wp(x1}C>1x7JBbG$Qdl1U4p$(BwY^DmcRifpIy0Oj*G zH#4^$3zW0_sqp8YXNeF{+*$p6?8hIlBJmma)y~aUV|7>o$JGYUbu*2_Z#w^WlP+2+ zgu&vNl^5soXl$ztH$Y)O6nhYuV7h&USZC`4Mj0e)Erzd5r5WD9@+r@ako8442cFpa zK#iX}GNu-25_WC3rLRv_Zp>a*11}ul%xD$Soip<4VM^$D?O+pr0gqvpZ4ctbxnSLp zcvfT*&_dD3KV#gJJ}|^kE|A0I3~B}^YWCaoIT{kp3?`l5+ZS?}&>Rrs_)SsG?$doJ z47WPo&-xMOb{s=Y7Ge)mnkGlO)ZW##csu;;+bE5l?OM)Go+GF+w;3`o+`B+?f|rNS zNZspwMX<0Hv_<9IOQpI6L^5!e=sV(hZz3XGx2WXAUE11qxM>F@Ag1$jPN(D`?XR+L zL{FxEOq_Zc+WpNy|I<8)T>&Rgd%S$nNc%U-c9CA!>y&WTuZ5BUKuU&gQABM8K2ky4 z-pTzD+qDy-1DF8IH!g5idD`Npe-ce1p<@@dHl{rp88JzM>`Ry|&LgP^EL6kOecee* zvIlsD?n|+xTq?tiwTu!cu4|rf4zM)#xE6k_Y4i%HGQ0i6^<}Q^2b?hT9t(Ovi=#7N z0h~8eBvFsbzWezglV*j`sfBul{_y6+NK!P7K67EY2F9_KSSxAkk-Ns>acPQqL&R+> zNjlHCHUKbi@gbx@tu%{VOdS69xIsUBkfEYb(pi-CezHT8u3j=5qTzz2y{7ZS57b90 zkhc(*T;{N?mzbx&c0E_x_-h3TAo8}X0oH|yAyc3Gw4JfW`Lplq(ygWW2OzG8; zw!6|SEPnshPY6J42Ql8>LG&zqa668t;`koP{Wh(HR;2TMq=9qjjAGn7iNx=XEx#5R zyt-=3v7zlR6`$@vG-1{VvaKA5TZ0xgyf_>FM_x%0khCkZJ9XxDw%!@$pjiP(9$3}+ z#-J*ZYd_@?)mH^2&A{`ZW{v?5yOKz(iTMROmK?YwdJl{p?A_wleA$NM-<;L%Dn8)Y zt-%C1?j3Sb+#RISw$+A9)jpyWp23=D`=Xll{L;AvJYq&NRN?i;eKQ`m6P1o!6pmTc z_?;Cj%D_^XLuE`3|0NSNKBV=y(GJ^e(MhKUIzE**4~O zjY^O?)#g^+YO<<_bcTitd z*FV_qq`E5yvNwm23IO0VWYVn8x$wSkOK2tX60#k|O?_0MnkRQ#fQ?x)zA$9dAn$f2)34%t zvNJl4AF}IyrFl5sQ$C8o1qAH3l6C7ITqvq*_(~hPH5yeNLo>OMpV-8F=e1i{}we+*GXETL^!MxmAe`>si^_$wX3<}VD zx6OB(^>3;lj*pxQ7yww*1|PL~##U`?nZRsIX6>-#d#UZ?RL6|_u9b{N-QVHY};6_&m`%*8H^ zFi2?ir$UK-`V!#7I_LS?3#4H0Go(gv_j!Xr`?6^O>6fn{E+?u|w*vnu4$|i+9S;EwY9u{Yc0|XE3wVW{Pc@?*@>CpG->4m6Q zi@-)7q3E+J8rcim{qw@=gbXRzBILa?*71O1&-9rAMavqVi z(!TTb-|3dG$2@ibM@$arWL{jzyBmFiiC!dw?=x{#(i;i>J8O>FbQ2436uXjAb63G= z?VG*`=H&?kst<)yRk$E~$c8Y-Rg$zU)}Fq={q9npuj5e%t3$>-Hh>Hp&+6}TRTtSX zuSwT(LTTXaM%?TyqUd%TsvF1TNLuB7J;5i|x~y<2t(O&$eek>up}ifT4<@Ebq!>cs zGlk=}+!jOcE}jxaQ~-?Bo||-Aa^F5&(eH$AaZ2N67vp9(l^eDc`|EA812N7EW?^u8 zond$_X{Th@A49_reG{odN&%{YZ4S;{UpXGViJvk;eOyIl@0WPAnWNZUJAz`rz_dJ`vaci)wv~|eEezG`t|4i8N_n6KHW15mcDBWNNX;L-cdeG9Dyb9nj zlFz9A_o@75^hI`8*}Ia5Hn4@&Yg~;?XTpzJBNMVlWN7OB-V)flR`N%i(9c=Vn{p}5 zV{j+s&!5@Pat_Jj&Fh=9&I;E=^uo(EN<}QHzJ;xXmVZhqkZ6 z8Zc)*6#s-p?)q`|8yvR9ZVU`=Dzyzj(j^Q4SCJfNEy_^W_PU((h*h6KTncCBw=|}Y zN?bf^r-;vrn8Y1t;ri9UiH>G?fQaZ zifLzCVP#@|{=_yORZfj5$+Xs;?X(*!w5h`TZK`tqxE}_WFww^Y z&X#6_0;$nw)kmTd-kX^FKf{mMB-!LlpKp)lj;$G~K;_eOwN`az94?o;mr0C)9#ogT<3KZ^uVu!oyW;gh5`DB~#83qMy1C2Zw=lj zm6fe0vB_V&;VfGbe>386tj}=$@n^uy(3Ydia#R{LoNxS{4?chh?EoAT>58|%^S0q)FE4^+`5jg*kE;7xP0#^LXEmVt3w zFcT9uk1LBbmn}UfMSZ7lm1Y%(UhA+ZEFK(nR4!CIBjIK21Uo!qLCw8f(ut3brsNm! z#*GV=1JR8nWoQzr^Ndo*~AjRCf&sqBs>7TR*~q383aF ze46q^R4yJ^XqoZ#)c*Sl3xR~wR!J};}xoNz3Gsc4&MSYY$zyi3Vz7Lbr+^9byc2V zGNQFhtFn_LvsR)3VrQUb44PY2{l=JHhIUu%2pf_e6j!`L*(!SHb9>VwQAAuO$bWs) z^$D>GK@Ec?OQt!??5)9~Rae0^Pe&F{by~WZq3a8a)Tu^63vxffdO=^6YYX3Np42z+ zarx-d^?;`kY%}Rn=Jq1{m)6J&i=6-_z%r(J_H`>lQxAo^@HFuC+M-7#u-B!CM{5B< zACcW;;#uLi&t#)1qM_)O2gXG#=Isrq>fLtHpn5YiudigMC5Cg=Fn7#u#!R-LpyBs_qXz=O4BiaIsXS?JZ4k+%;i9|lP61ra7 zd}@_~S6&EVAR(%jbG?t9lt0=2H=By`!kW&oh7gA`3N1x~NTM12U%L`P&w*S2 zf}O$>P#Y0eklP(F&lj|RANcp)5>!Q^2UZYsq1oV1bL1vje51UOV^$SGM|qr|M@C;nwk;_y%;n(QqpRV~ z^ffIGpq6=&2m?3+F1N zPoIcaguh-t^uKI1Arxny?oUq-LY!M*7b(YPO?I<96oG97keKkHOzojm~$?Vt|IM{!)o6g#Ld@pT@CB-c6<>FM08w&$=XN*{Il+z8ygwnen1 zT~(ksVdCve=GeiOJ5n4GCJMbpeGEvZW&kkxRF{Bp>kASkylr9mJCN4W%um9PK!W_n z?Czs@t0{HD*jXFgv*Y%I9n(1t$&^sOt}K_-Xh727U|{iG#l(5;0gLbS`Zo=6VC7W~-IV zw29<3GE11_EWTRCc9y7CTgc}3=0uhCzbbLWZEz$8}&1g6+cN^A4@3vZs?xX?x z(kZcD3MA;d0dmhxW}W?hJMe)u?Cs^uIgI>t+(~T9^`EluMB(`4Zd`3(gOecqUQ zAW>GLFNFgrbtkt0SyQ~_h5u!qk1ydW$)lY&^>`Zy6!{K4kb-9_+D{M;Lv#HQ8)%ie zt2AT zcMk0XgtFk}vB}!470fE~7uySmxDvPeoY(~;r-JKQ-tZ(U36R*lsW;>AmsTP@X%$HRR*FQsUwR zZ<@X5%$6+2H5enbxqtZJ+{B+)fcE4GRCP2ezPfKh_=EUEass6|H#9i83YX15U($9| z`c^dASZJ#K?XqLbjHVJ^=Z1X{6-VF6+NH0;%~GHkDs}N^DZFQ@09{RPSRHwkC9>+6 zIIS1F0Xy7b$Z`pN-%fU7s>$XJ&KM_KsVU~eL*(PS-se$*Y{~7KQj`)z6=rS}U_I#+ zwCI=8zFBSe_rFYeGFe{i^)PR`%CKpCFI#?b!{?fLP?zM1CuP6#S5^+6k4tlCsX;8h zI<`(PG>A%Xg*hIE6IWot<0Oi#(lhAEdHnMf<4WjhFVCaDo}PDMu?euwDbzW3+-=17 z3|{c24Paq=gz9?z9eUHs84orCQr|T<*hbOT$ zqgcqWsUx*xbt^EL`MsWWwx3(=a*rJW+YSc*;N23Wy9hOWrq4R;#pZ1L>nSqb#p z1W02AmkVK3r7tT@r8;Z)VJ$~#B#tCbzlzNLZJuM5cAQ@3Z6NU!Cx9Mx@;rg2 z=k**&Aj%js*pw@DrsIAo-)gW^EAo1mZ z=8RJ-Yn%^2B00~#luVfi+!VT?&RS@0Wq^Kkr{{Sx?PyTXb3iK{^4sPht}n86qAVRxTdmq~UXS6CRw*xDm=}s=07-`?f*LXSH-Y!UK8lw-d?JGfMDO`C+PRAiD%JkHQ)B|@f3DdICW9; z%f7oYu=?9``OB6ZdrJSVnqjAa^G;r^6{{`T^#dILKKjOJQslA*7f)zgXzVUFjE$7y zb`ptnWV`@K*v9sGunBNH$i)xOvS?wR@yU`pi7{+lczO1+K`rbZ)Axld5a5hZ9V|p^$e+Qc{Xe}VmqYnLp|9{IH4Sf z#hlCrMW+l4YtPc4WwMeJ(k_PblUwF20;c+(VNPchJ5P^eA>uBx1zT`rUSUjnU&r2* zOsf{sGnFa2Ij&jV3_gLl#>374ZwSebd9}*HkD+a4grO7+lTu8=qo*V ziccKs1ca7zXwR&rv6bzFkWQQoh;$LN>q7+R|A9#A|79*(+}$sQ0Vy=YF0ocHGQK%X zNbHWw^b6B%n!+J4dFQ-;`YO|pcS^gDz5CMQj(5FG66v6&IZS?dhVpvirqF3{xWd!F ziF2Ns5tLe6%ZizFKK89*uWgxmllrZ=f6w1&pZ43ntbKHQxu1_-u{AvVu5^PoWvJX0 z8kn~nouVA|3sn`OHt~@u0d#+5(fNv+6M`b%a&x^|hWpR4g54<0!p<4#jLEbRE|;#D zRmaz1oTHH;%D%gqx}vKYFc4m*dxvmO_1K4BYu)5&KuL(6(V0VPOE&h8IH)yRG4}a~ z>;;@d5(Gt$P2ZU^v3Qczs(ooY`0Ljf8v#7q57|aHa~2+gHr6iH>X|d;SfEm0VBZi- zXechVpIi81DMfp(sQ5dD%)2^$4|yz7*k`c&r_R34a2jYCJ8t<2Gqa|8>xqA;cWyzV zuYs!Y-|}p4*4dCLV^aqqU6#d5)8fq4gb(v4Lc(7IP0j)nA2^GMjs&-Res5yl5s>hw zNDN?8!$)vV@R@PEKD`T_l7=CR_^oW2u^dX$$3nn?*=Rt#8*Uz{>ntF|8gT+CM5 zyn-8ct}4SLpm$3&E)3aT39#&EnzJFM1+sY)m%(*mR5pe=(Iw>O_R6RuK?822Q~1_t zWjX431dn&DT|>LsPc2d;TU1IPuX%W)_u2cg%!X-${BY@pR%-qL@w;FJ!)ZNDb(;IJ zwcHzqn7ArDwYjGw_rnL-yWfGQt!I>r-#TzeHL6zIJ@?;9lnnCbp>R2W%dw>G7jPID z--_jEOC-AA*z#~Q8XbG}_&6*dS2L7T2)5iW81-Jeqb-1TK$z9r6FB4EMb%ItuW$|# zTylTH9d*J{Bt<6wi@0k()!$f6865SlyCL&{SAsH!Iu?p4)O8>+^6+OVavsM5S4`yC zouxd#R|-$mbw;DBtZlyafwy`a#XErKZl(I>c?(}@sxP8=?-~A}m8y}Oe$88O-jAjavl z(L7EGE^k0Y}bBa^gZ-3iD<7x9@edFHR357mAOiw-~f~TIl$7B zTSt=M*9H>MJu>qJqzptl-3RK|baCfV`UKpQHo&tquP^a=GxKkXV}IV;EB27eQ~AaO z+m(;~Rs$b?4)~;K>oBVW(Vhn=_oyO#!3yn>*xeJDkA79ctVMbqqf)W2jwDw08ZFtY9K!vW#*&nUS20Q~NSV z(;*OGFz(e-8!htk8R~x? z_=dIMd$kN(uMMO9?e|-9++3w3yB(VvV=ixIT-zF|iwTLagL`v2vG>#qOG;k6Y z>t5gyM&X%`Iv>)0ah_DSD^@%cS{r8Ne5L2<&-V9&uC2XT zMw@GBy%zhz-w7X9l4ARbwPKY4h!NysbIA`1?) zKBZ?jJw7}HwC_cPiqMU8&gs~*l;uZFGx_fc!sI*l9IzB0;r_%QuF$_#c*D$DU_EBNH$JQ}k8HwkKR7LzY#7o?Jf z98t)ty67~Zb>1@aJ$OUy1tTB04e~lveS%0L#ffrb{1M_1aQLykj5wh1eWd-0rACXJ zp|KN3Q?+^WUJ!T!GB{K%_4NmB6iC=ZoEZ$e-y-SH+;kgJuc1U(jeg|z-7khkTYzu?yD-&jlZ*rDG?h!Nz$~Tf+k}L{LQ)k=PD%Tn&0FL`Bx1z&G zfOzdzAtIoP)_#L0_uRI_mpI?E_bxs@?>U2EEWaqS&Z;eC)}#r|_AK#@1c#C$9uR0t zB?WELXx)S7$3#Y3n*!z*6q3JUa`isppDLN>dn|neaHO=8a9yAT>oXoSPZ`Ykch@;3 z83Sc`q#r%2L^#@DrN9IRGh-xs%#=r&5n@3Edwy{G8+%{eTlVh2FHtjU5oz}Uk#I#p z@RE~h@9+*q3hcNGX=GlVSX8)#uF?GA4#4<`Or13m{|9GiO*~1l1=g`8^7}UdIqiM< z@0c+M&(ZzC(=9@tr207Tj~(p5G0G= zgginnvP+|t?6xeoU4V`ezSfUoB;)B2Q4K8fiQTHKK2rIgJ}@^a!HM9SfRQeoV+K2s znD@V!zC5oXUy^Fp0<+xOd38(YpEf7H3@&-G*EvwZfUAei8I6ldqLCWD4|0#Qo)0C& z+U6CRcqRw}#ZB9sSXuNa#;F{;d?-)N4#NEtss*Oh*SllQ-;i!e8gZ#c9d_LEaK*;5 zoK}P5UADI2q+Wer^a8$bnj^e`EZ2~T&F=WgV!lC_Hytm@NBTYRhWJn)$E&JbH8Y~} zQQB`~GEpQPJ*N^43i=E3@byvUT!|(4 zz=4Z)K@=?(YN&jM6uqMtR??mzKEoZ~vqhP_FMRVFN`z@>ZmKoCx#sE05~Uly;fA zaGWYh5|y$_TEId5xim2;p!>hh1p^eLnlqj(jkGXTb_*xC^4~|G%auxeIEA}kSV@{C z8B)=SodLT~Da*&NHxfZIICE{%qH{}xv6gT9vP>$2&QyxG-{rBsx^T_Q&?j*KtXJStV8VbH^cuTb1eA82(U39QmF;M`nOOvC`)V= z$4+|qV+bwN?=E^f9;Zo|ZI(tm)8k#(HA(^0O7WxqcU4cAHme{c^^nrTZ)>&v_+eIq zvL#>Js{QQPK+g|Z>w&ZT4*@z?6XRCBd=$^FGUFcm8xXPb&sZ3=&ipYr#i6LoIEO}{ zcy-xF=9C^GBY}hHw8aD&sxxP%r=J5%$^W2}amZ-?XQG4rxz9X4Mp1_h(2X{?C{Fn1 zIs=7GaqD8Q;_Kxaj*+NP7{F6@bVnP6h&}z9Y zTV<7=tok-l!B*xHpk+gU(y{O0qovj26S3H#H?6h_6No;Ws=3On?+~ErHMi9fT=PYS z*g|o{2kDGvTg^6APp9r&I;jaD4gKSC#UK@>0v0(ub2fJPnZ~IddZ_;x}k$n!N?T*FOAGP|k3x9YDsoy=*Z!an`n*mM6c>f9gCYiD6Z_i}@6&UWEGOVQWe{1xTlk2MVWD#IrwjQ^4^fDb zD6a?ZZdmb7C4gfpYyOnJ=^wz`wim;3%nf6r1P#tW;G1Teybyw#FP4fAdRr~~o zbs=jkiyZ(^zQT#sdfqwF?FBdr1Wc4Mlra0Xh(7T2X*63S-zgQBo%az50)%GKmk|*R z6Y;e}O#i%5^+BbZd2uA`DnjEdZpy+_Fb-40ls*C>|!2a=|!)4Nx*$GACzql~eY z%3+@a4@qRY z{usDLWWV&3(YC{FXA!Y!B%v_hi6&%UtnL$+@AlLYa=%$WL)-UelocWk&vz-MnaUsf>kwRPR)p0rQ$s3*<{lkT-c#?r`|&Un250Q_Hz z6|`-*?gGdj8{qZ_ivQsh3dyjYg-pcphe3U6LPZ5RVyj|>S@lC9*QkKtgk3}7&WOY& zL{o(N`$s;O6m&3xN%4miEA=ZZg3db5^T2>C)lAq-Dn2S#KTPGlHO-drXK{(lA?dco zZ~xLE-CYqVdG|kjlMrC|S10L73ls8y*a&4JlPtv(yNv1E#E%A#P1&3(lh-BwG zJBK{tGFDm%%26&I7Z|JZsszq}NxQ z-Fhi90??01x=uPlduJg`fqy3SCOmRs2*wBlQMTtGn`=<9J%a+qlWd@=*pQ@N_7Jvo zh4J4m|JdL>9UQHzzq&v8RTiPtC~Ihj08uHfu}wPBfg;U*oM1|^aQ|u89`Ua#wu2St zsstAu@=-uc?-BcZep8k%+Vul4Zg-V!y_YC*{k}j*g{_OkRDw9@wwZ(8(?<56(Vu$G zfQB6G&)5r%#vQ|P8)om^q5=EH9EMOz(Y#jKU+%WEM$?hxgYw1x2};8Ufzp%!03z#u zvj745%WY@x;q>K>i3s|iRW5YkipD@hFIF&~dbv(G&93IG8S}IgQCwdc=Nf_31>5JS3MNN+g(j!UlntPmQCw}v6t zziekvrAk&0<^dCU#l3OL`}_DK(U*`WCfI@@3=OA8&s=&Kht>a)Yk(x^)1D)hF{)v@J z&zI36loKk;xRcb02+DDPpoia^F4w3FAIYk1c3rFR=G&n27$n=2wx1PAxv=_`gCBDb z(%0~%pqjf5&3YYYOkq4=1q5=?>tIC^vX7OS(%vm>9nL31PSH=W7f9j=1*?#$l8utNjaYnpCC%*J3700 zb#o0XUc@PU)I4vU?kDT|XCgv;1I=K49c+l?ud5W*Nn6ID7DpMU+^%(uyTO`h_cWO5 z3#ixXghcTG(hUY!k5ZEb#eeVt*`o*75gNgdGS&qrGdiLsq@1{+7KY9~N^%qbrI_m2 k|2LCCggJ2e?*-`_)T~N?R?YKurUalMqxz{*>T}Tl0NHa>`~Uy| diff --git a/res/favicons/favicon-32.png b/res/favicons/favicon-32.png index f46a986b15f7bcdd3fae4fa24cb02da9a4d6c458..e4e63c7468d808e924c1314e0e29b1a25ca69875 100644 GIT binary patch delta 1518 zcmVVqQ=y; zp@?ZAx~Udolx%~9#7`nB4X8C>{IY4R5d>2pExrYTShdgw6pOY?n?j6=MX_1HmP+YM zO1sOx%+Act%zb-~AGVe5`?iho3+LO-^PKbl-E+_X=6T?QxPOGuyEo6#yEo6dlp1nT z!s~y$)L`xt)h_~(if*;6=mB~7o}T|1fOb4>GrM=S5&5#fEgHv8*wcrq;6!T!&gnj*B3{Fc9E0qLz zPnG8_VGpV=%72!-`ezKF>$kKUWu2faK^6nHsW*tqWr!3>*k^^U(TN7a{(dxwz!98m z4lCuIlX)A}*985QY`N>%^V6L1Nb(DUV177QLZgu`ier<=w;+kciJv711N!tV#-y}F>6cP0LXk~5koy=95<&0RxC!(abI;AeC4y?I+VA+ zNbqhSmVfIS>0B2~4FCh;xG*$~_Vl4a`2Nb(SD;}?c3nHw(%|T_Y_6Sumrh zA7J*q21ZGLeig}kZyOPRVi&!S{F=*WwPM>gz<j^4+1(3UG=Sr#}6FnVIF-Z&Rn%D+^s z@s?Y@nCjjGc*epUJ45rbB~<>@O+M9(z2pka(Njdb|Ay6HrmtF}`qysSas@20kfa9| zsDIKuEdVR8IjKwL;|({U>cfd1IQTZw{&5C3{*;uHAU^nSvbV0`#NGoG7c9Wu{B`Vs zGV!Ku#IGJAZwalRSb==%bvsn~luPQ+eqh)DFH*RI1{& z=CyUn!Y8Ni0FdZ@rxg2sv3$Ij;5YjioLj`6SH!9`!0~9j`UaUOCRNN6Uw;k#+g?DQ z+0VegH;LO@!e$Om~66zF!ae3T8T>)q}h34BCUyR zNYfwgf69o|bDE&xO}K^l;1SYmuN$#y@8HO!15q3ig#kg}Gycc#zw#ykgU{_JC4UaSU#C{968H^_i2?9(IpS&!%X4?i8=b+pB2050 zDBpO`8H~;;J2B2sZPaG*63qI^eH{Mg{bb)8CTWkhZMwAxL4<};kbUV9k4a+E4giEs zX1N-pv&5sG96c`ThxC1EqBxl6ROOq<@gfG3?r- z)@_mT;?2#t=?tb?$4+_=XLdcfYbuQyoe9fpHvEuUuz{qF6+%5^=|K3(k@A4Hhf3x!S^l4rtS$rsX`(g88+KCR$#TfN_nQUdLi{L>S6-W-~Qb;hvDrQNs-H}%kBK$k&CVMLHu9iKVE}% UTFBHL761SM07*qoM6N<$g7ifU3;+NC delta 1302 zcmV+x1?l>c47v)CHGc%}NklN}J8%wOGViPRTLX<951u zp3fSPQi?z@GJhHwi(OV#tzS{pK2_6vj8cCznH)^g*qJSZhvMV@!gXvkYt6#i>SKk@ zJcxn-o;M0aDV;VekK5_;xSjO?>QieNG+jq1BIERLmlgo{H7x-Eu$o1fO(uXbFv6zY zY$o6Um`x^F&7xt>K!6bjN~X^;7o*)d*j$G3djBPVJgf602DSp zl*-Cx0gb8P9Tt?nx*o&Z_9M~NKYbk#cpBAoJzlbPo!v68+~7>YF@%qvg{^irq@}eG zW)&g-kvaf?J`#cRv3mgk$=(t4ZuuDQO-tcgw-}xmR-xzV525KK#_@<`B*59EK}FR< zgMV+d*==`JO_7E{`J)#!u0lTD4QXjDoXhLrxTglnpM3~^*@4RUHv<3y+Yf?7;|Od& zgvilffNK{!uBu_d<`~LIps8nPqNAocs9YSVP%aJ_6d1?YsS7A$426$B0PsA*2Rjix z(S`80odAI7iLMD>rQ0|0t!pIM)U)%tr+;I(1946Jol<&N#@zuVheJsG?T2+v8K|lu z+;I++Quy9#%eD-0O*=nz%qR(lJat$$XN z;K-`!451J`-WLjOT<>o`Fe3s0aG-KSYgL}~6wl?;FIG&(t%`CrunSteUZP`<#LE$mpg1rxEt)?DHw+0%1<&et!^CN z9mt6Qkm{7(RB9`+SeA=Cmr=3FNPiNd2a?+NL4K@ZatE9f0RUhCx38pOt5Xo4bqYd7 zHs6S@4@7kB(}v-F?{L7hUF{9&x~rn0#;)_P=bQLt4&LONJQt%R8YSeo!n0QzhxYw7 z)0jD3@m-!(i|jBzXXQ-y0YHM0lW`b%7 diff --git a/res/favicons/favicon-512.png b/res/favicons/favicon-512.png index b590479042d3b584722bb50477c81cc71f27bfc9..4ddb02342199b81846ff05e3c2de64993a9ceac4 100644 GIT binary patch literal 39844 zcmdpcg;$jS6YjeKyL1cEh)4_4%~FC$2}-AQNGK(>ON*p}Akr!*iiC78At5c&9n#&o zd*AQx-1|@5v*)mT4!fV2cV?dFnVA?p9d$BdMq&T}$R22@>H`22{0Ie*gy7qe|KAJn zjqvG1byWcW-z&HAOELhk0}oV{9{Xo*&AiOCd-76pZ%+DjcJg~bPPzl310?FnjYpn{ z@Q1f=O|(nyy3W3T?_|wDTGQc{yxhlB{Yr!+R%u_Gl1_YxL3x@0ZjZWQWBvZ7gKg?; zy=zH*=IZs5FNOTf6Zy(%v+C5<%}$Czi{M?Guf>Pct8%N-fNk8p4u=09|CBk@a@e31E$*KgLUb0k$=v zvqY`-K!DC3ry9^qiLK7tBP)B>ri54TW*{L(0C7GHlQqYJsx^ez64oA4?_ZS7OdG?1<{*~T79z1nQ5QuM^d8^52pm& z(aj_6mm(c<9T33wS(JpE$##1y{+9lmF%_yLK_%MWI}}jaNJ`09f@3(N7aqL~hyNYB zlBmwtRhejiRheG$7F~Q&o>E*vIO`~ym{;+Rd(+B#E~1s;JK29RUl^tNt0HuGVtC;gW)!DPoiN!hbhCeX6CQCD&T zd4`VhKT?2o5y6o7)aaW61%g*|L;(UmJk*}Ce~WZq58x*>{#)l=CwP9r2;5ecjr|lG zJvIkGBIL6P|2-J|@rNpBA}1`D`hXELJ6$x`xmL^3OyX0do9RB zfdKb<9}6A_s>)W&8DqX~N`15{YWwBD%e_U3^Lx5~28OfhVqdG)SP&mSuw=9@I{)t~L~ERW zw;^u%cFQxA%GNRn+KlPO5__-vm@;xrjF7FG~RC9@}6?Ml`LnBylJiGWxBC8U&ie4~=|#d0Ipri}ZV7 z5u_Z1o6J(8h$_?h1=@)9!%QdM2GT%*Vvb>;9G!X4Y<*yWenv|aq(U5IIo+_3_rH}F zz?CTmqXfUdqhzDTvcX=#<+I7XU!msSYF@>TSJ?!DMlYiI&(&d0ZK)4aXeEhTJz#_2 zb<@rYDHluHS6tbU0qk*=qM+5kQ$3r!eed28lWGksHY1Exmp)JnIUV;&#V;nX*f)%o z)OI@xwEH*JF?Vg$Yy1OMN#*&t+|IUy2|9}0Q{tB(er3zF6kdg;|r<*YYBP~tv#9`4&W7sDml}vf}fw+xb(7?OHo z@3krZ=|8(0wt{vC*6R8k`MTo6_AV(k2<2IYCX$DF;>Yd(n1Aj)z8jv^-^$DqZfinj)$^)@ z(z2GhRalO}1PkwYu)t4!WM6h%XGJK_+!6NY5u1P9lW^Qtf#rCfB719&lC}2W(*B3v zbb5?8BQ5w|23T;wmuhW2Ms9$A!~2Y7tq?l7eU z&(As3kzs&xqDu+Lr#|9?m=jn_t$Cd*(Y+Q{@3i@MsNGmnu#O}ntGFC(5pjA8-$_k4 z6RBo#$clpjqh6VtRqoW-Ik-G|b72rw{?NVgU&=FINQfaw4kb7x)kbZSLjBHVCkZgj3hJ_v8~V%0n0ZfZJiL$ySe>Fn_ujww?xS?~2V} zvR}0^tVJRtS1jIJe-SNp{NrO!bEGjobB}VpW`qv#1cG#t(~+LIxnGV7nIr+IIPuru zsYacaemL^yhv;HvXJQC~4-11rd>2bRUe=|iG$!-sdM`U!$Rgv6NkO}IBIvWY9x7jD zc(3s@FkL9*s9-1QK%@K^B+H3!C9*<(>_IMCuxHXAy}xpBd|ukov01z^CPtPQ8nOnH z|61uZko{iOIq2uN6{SNW{P=?$P1#Ew z$oYg};8W_AWijTd;?33kB;@fa)>r}%s$PHNoacS^wZ5-(6omrr%f$@7wx^6*nRsu? zLba2k9IWp)ab`YfYvaa24jA|3`h{4uz1|<=`8Y>~-Tm6s&iA^vm{XScqh46=S$(Ix z@at*IYf(`>onWPe6zcnYk%O<5P-oSOR&=jL=2}t{JtzzdcVWQUPQd4 ze1J-sT}*PnXGPvZwpLD4U47wwW%UR>$hnvo=v1=I1&q6w;6dut!3Z-+x&AM7KXbwC z@S*?NFQ%q2R5Q{1v$c7_z;{W`EzCE=-}UtEG?&bnyUq?C*i#00vYc;u6RxbmnZIWr z`oQCyX!HK5WO>f($&*v>vFXoGF)&;ZvFW#ehyh)U)_Z0p8MVkqy;u#H6Xt$DXnygy z4Ee&2*^t8ueaOm7rFq9jfQi_9(WEBQ~b+X<{(&ri0ILQWrq zdbHg*jWH|EA`UG4vU)Ii1Gf5bfT32k>r#`5$?A}JXeFtbySzKD$dj>76je%w_~rpQGfJt%WF2!4_m z_hhh=t*bZie|fUOFl&P?tbA@q7^U> zgPMx%q6?gb0|Ko{$$baYReXA&M@XeBeW(z0Lk+o2sX6HmI$~!yE3>OEGf)~e2vPy1 zwhUwqb*?0A?RVt#dDl$xU)d+i5cNs;SXxBsM#H7873en#&D8z9z(`dUqYVZALFI2A9iK=9%@wN92i zMTH(R52vse{J{Gn=Se&>kVw4;dvGLg+|f22lk@~c5wnO{zbSUoO>ND2LFl3&U`Qxm zVEE~Ef!W`*o{>g0+xzWww%A)@V!+MKsv6CfY>l?e%rM(ANp@Wua zE0+?*!^mikk>SDZw#5P_*@{m$z7rsT-fgU;TnL1@AqL(^v?C!eKW|gXN-%DaEc|8I zN4zm)Qy#Y{?C0Z<{UCelTSgD8%&?}Ob0@ge$oRbq`=r;4V4r$x@ zBe1SO9g@;w3|)EWwY9dEL_?%U0xNmj+HUx4kC&nNSG$j5B80MOh>@E}B=5|}mX=WW zZ4u){HY7Ek{A=6bKk}paodp~$D;96KM9k z+)nm=%C47MZcRxA0nFR41V~25Z*RGgCk&spC4gwQu^Fl` zcs_Ea{fV}yj7XBxV6`7&U1iA57^yIbkf%EJ#8~7bL)D3nL<{%WmET0SYoq0E9_1Qu zO94)tM@>^tg^P?(uZ{Rx)u2)o?$wRLb$h6+C?3R#9iyQP*_6P@Od2|Y5*lDv^+9p= z*~nF&{g?96I|Yn8)$HPA0dfh0KOuM9-Qu97;Sv6*un@vR#a!mg#0o(s2?BZHDlu}v zl(unK0v1)ts%-f+BH$hSzDo^_g3+oZHv2=Ucvh4FUv3MjB7ho>pLpgJZ2ou5?weki zw8Tyoqx+s>!3|=LzsX^HxSJ(+JwDeSzi<;ysY!w4cX){YhmFOs)(J4=T--aY<_`KVu$t77xpD)(z94Cl$=^b=k2ve$N;E=Q*_Ps^?9!PsIwHX zM;QuN*gLoPtgxqi&VV(&6$C|j4BBo!4$-=RVs6B=u5E_SW&nyi)snIq;qvzg>h<>Q zh%{Un!MF^t5)!+6=5_;twFH`PQ4eT_a_7cwFTNPtBJnqW77xQP4qdv7=1My%eM#dT z?13+cp^75S;+sj$Kd;KZ>uLF*75HHm0celeeAXXCT(EoJUE7obQ%h!)baIrfsgwUE z0^psoMr}Ua7g3^wcPNeD#Y8I|<&4)YctIAFUV8Y=1G)Db9N0)@lfy;jVc^lc|D@@M zvnJLO1XJy#{T1wbZmp}+^4m^s{Rmmpqh@-WxRJX%{nPvw9hRl^AAS3eu{c8c_lBJi z6rIyj-xt2OyL6Pz1oOSQox?1&Tj>Is>7-lAL*+*b!e;9%3D`C5eXpOSk40>>b!wFg z5b?Q~iBn@9kQ_$O4&2NKmXYHEbT}oqsU)%h;UBMI7%osh8E87^&_j0#znomJ^7!S1 zNNhf!J5_EN%gE{~o8dg~NO-A`;90M-QO0mIOKX=Rs;ymNMA@kB*0=-eus^S*fUg+$ zv(=EFny1j3+iPXsA|it0!=k0-CQ@9(;ZG)(oIjAur(^Doch1ZjYl8#;3`5_t{rf71 z542yT5x@0Xljl{)z@n=F1@CVQ(HwR=i`l+Bvd8HXFYY(3LV%3%BRh}M3p@{>S ze?-7A1phH0y<2zyV+5B^O<3R=A9g3+L#OHP zqL>pc@}q9R+v;~2F%DW)K)Ro1hI|`nQU^Tfxt`CO2wQ4XZJuu_tsX^m`~Qa z+VxY!54m*Hh!UuF77R?Kpn^A}vtJ)V9v`2lPXAo+3u9H~p9id2D{VIY*gfqBmz?N* zB@p7tky!(6W!JK8Dxz@{{jTy2_kWw_fF79d7!ILXZhJe%tSyxJ95+&LyOzpLHEpOg9 zF!=!#Xz35ycxmVT$JhF1phK1E+?T~hY4;b|!bf)00qEB`cE;-Zza}Q%gAifg7VF#o@QuE5)U-fo zTxT9P_0_8-Mw)P2?ilTihPkM}_iJkV1m1e54>ZRLCb|)DCx<3`@n>F-f0WGmE4KCq zSz!ka(4{~NmnCp>+C&%%s31Kz3IE`5O}zQjxu1-o1&)@#sUwsJKf3D;=2wcTyf;1} z1{5g**p(K+lH>K9Ak0@Ls5VuQKt845R?qXP?Ue()0z3__?Bwgd)KL@bE6Oh?CiKI% z!H;Xf@_<9yc!7iUDv4+BTg8WNaH%S?&MHvzVcTy8oxyt zDOu|QTHlRWzqFj-s~fpa*}Ng=<&z4@#1v|gD}6`NyUI_C6ax4lpQ(4ALuj|OSoyNT zEd)>|1&U^5j(rrwMdsuHJ3G4%*&ku{Hk&SExT(NwRo`oPd!bSyhZ8eciv9QkK;2}l zkRSsd7s9!-A`N(y=^lEfZ2JXMVJ0e?sKRa}D(Q07a8TGbB@HGMu}d>i@?iV>9gwfp zczONx<)webT8F@be}ubncALFO}6)D0pfRnEbsG6^ZqSRIl8xYCjZ02DPhm8DN`|xc6TR8ScCXAYA9!kVNy=;Ba0dfaz-Jp&?ERUF5Ruswu-ungK&)1sE4=G) z^`Wf2nwD2wLnT~HImt#+c8mrn?cS<)g}^{jXEw4>eG{HO^#EH^&pa_IMum6E;w()uj%7B2lAMqxm^+ zC0Xy1WZ%-gJS`Sd2)8%U&f0>YkVJyCVK-t?58Ly&&WLi#d~b`ffGBs=G;3>RkWZZn zKB=5&+YfrF+h$%iT&fYRheFJkjyH)^IzA3Qz1O8mD#9AR^#J$`^br0eI5XVKm2L#c z&tL41f(TQkfmDNxEL%aRLX-PzhH9O|1ZchysRfX*Owllts60II`W)vYa+7?(eScH- zMEspljaev(nj}x@b^$FZTRpmL`GoI%rou_(9xp$YX(Kf<8W@IZD#&L#f9%X5sYZ|k z01DE&3ZUL;dOG~{BqliBy>=rqZSh*a@+URD1<8A%kW=P<$972VSN&s=1-nCci9Z6$ zCceq#Zw?g_lfAIQp+yww0ly$9KawI$!DN?~3k*Tj# z?weNq4ZSz2tSSYUXO;;G(<9$9r+UnT<^7;nK=e}(Es{o3vOZ?0qGZw7(G9^qX0xd! zTX6N<+%-6Ps4d$%_|e8s@Q3VFph(BnEpfjwU6F)yi{Y;4^UEZ9kGaDC7^n0tB~liluR z#oZa2>?cb2&8f9a3;Rg#x3pKhQtd9uLhwEI${q4jhk0OrkG5sE8uLvawx>TP=tuD* z?tbpCPeEdLZHokv+xc-V%66up@$|aAFW*a%cln|;LsP<=x+%2fjV+Y z1vhIOb4>88sxTpmS~;0=fznQ@b@Mo`EP+dz@F<@g7Ms%TLdVaTI9cfZ8 z8{nvSOm|%tgj@NI&H~XL46giisX#+PT_6$W6eGy?vJo%ojKhV1|1j&j=vpR4rO_~+ z2Nc}^J(t1Og5xHvRfdwRemjU;^jLhK_q23Zoe%>mlj#-Lolc*rtHw_1hX6B^aL1&f z0BOThdCv~M`4o=aFTGV4Zjft<+j_k1E?R(PmAy1=gtGHFAuS&tgw#Z%9-Ir zQa}hIJXgpyTNA|o!d3buQp!Wn^Fq`5A3NoTQ+|E1P!$^N3q&aQ3Giw7T}hiU_n+H) zscEn@EB~wA`+|!2Z=#__#fXqSDbL-L1KrC$;)+@dR9fJQ+rs5tO#W=2wnD_KC!QVM zSPyg3B1^+_@i&y78>N?c{=0?$YY(`TAr7z9zo0qianLgmn;MtbbS%UX@5ffA(8NHo-k- zWHE5IPrWjKt%+-JeAXr0w1Z4?PM;+qSBX7xH>qs}?b!+38h(>`2Un~VP$=vEN{VbvVA0J>>3jF` zosb$P6SC&QeSD55H2#K6B3SiVg?=Y&tR3wcg$kL)cGFwI#gC`GJA(eC0mb!yPP^HF zh~kAKG|m;pD^(X|5$LCqe$r}m?zLKs^IQR}7oBKkfrnbiOaK{0i)9)(J^A1fB7L&+ zk~LA$U-3lonD#kM@~mY}nZr#D2-}(VX^Hm7(>rBbGe!WQc`lb7c=bqXwBe4jh5VDt za2TfG>s3Ej0ubhP;^HS%o@OW%PD`EeTv$drilsS#S(Y^fnH+c;z7?q}8dv!>l(uxA zWfmXu*yfzAf#pM9c#1M_a$7NX4l2Oz?{$F?5nu^jb5FMePbk-2ooSS{-eaHddsXtd z_%Sy7y1s1bjg_^_DM{|r?zBshm6+NJG?0wX44rFa)*sH*XyHpAZw{pQRX7v1qez5H z6o4%X)ZAklD25C7URuJbDQRct@>Hp!xnyhX(1EJnYC2Y4SApnoPh;3LOT@4eXE!{I z`$u{`ThgXS9B`J;8LAE03fLfG4sbwp_000NivztLZxy%9e&6IC8~as6ye~R>_x!q0 znQ)-7l%`hxvX+R}mF2~h2`uO!hqH|^z!Lu)*(r@;xtG z1kJ>~-yV6xzfyKsw*6i@sA8Xqs2}jIeq2Ws3hH}4!o>hTSjZW%ZWeN zs=@{G{CDf5i3mvmf3G^C6jH==axJkhX^yn`9+KA5`!^-=lZ{(;Z7>evar`~Xz<5yf zlQQ23pF}Aq3IoFw`(9pNc?@+#Ln@<=zfZsDy1v6j-8RA|m?>zNS7X3_XlB*Ay(c+- z(P{MkDUr*wWjRSV|H_CjP&G9w&cICd8UD1OW(mIwB~6 z2GVh&@BeQW;N)tRL@QJgM0!b*+)4IY zYg2i0ZC(@gbV^MMh8>I}Mdk0k(d%A|M>!~UI_Ya2gh z3s@)l*!%bK0tX)>@fg~+7-G$ihXIdl^1k)xema`d)6HdjUC3``1>Sae`o{YaC-(z3 zm*H-FhGHuY-LP~flzLu6OP8HW9Ya`k`kddIa43!xOD#pXH(>G|))>5YWI#ziriVyc zkO2(CC33F5G`~tgyfPoGoNO-@w*DIg3*D6 zBw>_!)gzS7iZ`{;BrP^GJ5R}VfoENlF(AMtK^O;+G5V3*!Ov-VG7u~*h%70hU!-o3;BFLenn`qtQ4yaA=jqmorQ6g|B zCzCn~Sw?UkKx#scv<>ULnnS@kjatfy1lxR=4<~`*5uYhL#bM2A9+o0=6@kRyt{#EGw0ZAzS*mYJY z*dmCqBHqYm)nMx0b8C-ZEHa_%@i35eS*uwMau)Wq8#PA<;C2}+06!+a!9A_WlFBPp5X>d+Nk%L zLDkd%LCule{5PX>Uu(m)OdsRZ{N~QCylelJg`8XR(mMn3E+fOU&iI&mJQD)9pR-w9 zNvXeB@uFWzPP(Km#~ub&Zik^CXZV!mz}XL=h`~u2090-7seXzb+kFDlWy>VvSt=SO z1>y`+IT;I^LO8Rw7r8Lyx{#1f@us;u&o5kx@EeY~-Z2)5*U-!C5U6i@LYDUM@a*Lk z_YTg3`K+CVjL!5Vs{)$0wjV6oRl(6PH#_l<3QX?+0M0Ma^hr^mG`mEi&BcOlu{**n z|6~ABm*K2xYB7}~^xUR8X`_(OPqFpr?HWx_MKvAyo14uC&J6OrTFlZBEEI~AS`yao z2OfFb-z(qOTsB347;Rh?uusnVJmnOEnFl~_kam_$ko0aA%gREe6-oW~jh9|=Y(`gw z(*;`R+o%kt>~0aP=7J2Bd}*or-}1XS+PEfG- z;Sat60e`B?Dn5%ELRNo}Eswsb{9cMH)&&dm5EO%aDTQpcVw`@KH$h#r7MNZN=gssH1(OwQj2$%0-NbNWZ` zR9@ZxKG&1k=QBZ#&9Gu!+fF2aT<;h-xjQfpTrWbj5-+`#ZR>S$_=}vK<+*vsUcHZq zw!)BC8tDTXouNGC-jl+hA0U9vq+JL`nD5l$fNMkp{^2(!K?~D+SIWhI8(;M2_OCm^PtN^upt!AKdsM*`{qB z99b_8iv2drLE295?I%z@Hs=c{iU7CkN?T9BCROiSXp^D?Q5(-366rK6(zt}VQ=r62 zQ~ulcR-}4;z3;Epy$+1ltkoK~Ce_Ki%m@(Z`~~0anD&6kFRlQQgJJ zFCj!! zMNbZ_h;e{%_Q=Mg+-21FlgVST8Nu+Zp8}qvyiGoFhboJIH_GX%Y(EJnpLmH0vbzEM zT`^Yl7~6ErdDc3h70=xAB2n&DP(VQ)$#MHszyaHYF9rFtCMGg%obr51sJ%uMzuTce z8bnwS4F$N=8=9R07Xa&ok9P=we{)@yyU?%1Z|Vg+{Yf7Sh~sgVF3HEBis-rfZT*;K zj)HxCpVx!+#U(r_;1Q)>@9N(4NwlZ;Tz3BIuUXYg9h|Dv(Ww=7!ED!gO{6ZxShN(n zulJ9Y;-eNBATX7~g-Pm%pax-19NI*HmOY1&`LuV^V@%-5GlZB35o3nSfKHe`^otSt zk0n0{h$itq0LyH-s>gNW$F4$d+v_ofaJ}9A&C$=apq^NB9< zSTN-6fR6UlP8G#pEvwl|z5&DzWtbV+Y}8s}F+e!wabWa|`o#Q@;yrHYB&wL^k53U3 z!~M_tY$>*?=Z~AWRp?RH%F{U9-EpQyu<5#@x&&I|vpbgevO>4dRkn^+KexMLN;a2v zK98qT>U-lK{EN3=1b1Fq#{6Jj{_@S-)m?q!=^*D<)3X$t%>DR*TXHpLy+rxUajetP zSyODSC9G#uZ<_<9pOz>HVIE1`{}(%c$c;|yBP6*#*?ZHo5Sr~F{WC3m6<&MBhs|NjO#)BV&{0H4WX z9*^OvP_$v*j`N$Jo!4)55794NnoL;`z#$dm__P^|{LT$olaoaX*%4(3Hq%xx(#)qC zrORx*K5%kRL~!eRE6sC_WNz=@Md9~Zy_aTAH`iUh_f3uX2X1>K1=+CabF*>ng|VX2 zJ#)caIv0Cv1j64sjF*P}aTaVU?qj&9;$a$X>tpP5C-I6sx;zmJ;98oH0q%W$<3BaJ z^Z*aT=uQ8))qmp#J(N#qDlWj;y&79~M_G^-nYli9(wvUS!Prjl#3d-5?|FYCJLdfG zwTYZPxu?p3a^>Cr35jRLW9Vk{vGkFJe}7qtAbP;VX2hyN5&LMQQ%)|*!U#?KOC=th z8(ZWp+F&UZ{`w@Nw}AXQ{cb#2XV^DpA8 z=Gx<;UXcLcQR}*PNfSEN$Zjgw7?b&}6jB#n58aWbK06!TA)$vRXe+p2=h3-DxK2m}D+ z5m(@wI4=6&FB5&34K=Re9~2BZ$fMvSrDn=eN zvUq&wokr-BoCXMY@cd~w>w`W`M8eat-C$vS0+%W zj^`e-|8?>n{LTDY>Q?s9l@4MU{+!^e%BS2i3^cToA2UvLLN`|E?L?cuo;LbfltO;J zC;08IzlwI@AFaCZONiDghE0*`h^OxLOMlXO^zKsW&*L%0ha8@ob3cFnw^cDAQ1FlS za9bLLM=3xm+wDFfkVIG2uE#G1`wII<;vS4D7lkUg<1^0pIXkak>`c%HN$ZZ1K^EE{tpVLQ~`f#HvU!f)%GN|5b!V+}x3We{%hsBIYX9>I!EPrThtNn=Y zLDN1R$a_VHCRns8jcGTAPcgn;l=FzgE-Bx}Ou8os%xRkb{!s9 zuR6u+Qbix2kbe$%)D~?HHc0?fY*ZeY^1f~lfDOikr>v}P#eN~5^STv3uN!avTc$Yu zdZhLWRY1g6#qz>V8l2XNg!^6wlRS%QI)0V|F@80j50Q~0XUu}q$rCpW?0a3~5zRc8 z$I}M&!G*9Sd7}2@kuk_JF^eV0Q7H!l4D@oE5F3hU)+1|~FnV1a#|(BdlS<_NHzr=<(WbaP z8hev2`K5s=POpx-Z&t4Sk<)ev4@9QAl>%@a8JO3!my#=cQG96Ow=0lF>qDrY`&zY;y5la}i z)7@^b-!~Fu61U+q{v=0ef1yFE;2BlPpZ^_kBawA%@S9a!_WqHWzJFlJhR#x$}nMz>)v6QPSs+@!=e$zpwLXH0od`_DS z1`Jo)1s|>EP|fH6&A3~FE>H0sm^T^?8*O?OqcQ~<7LHuH`+a?c^9lsniK$(?A1g`W6v-|H@$}0bOQp1 zPJV%tBG54QD_yGfGUH#nK3YORVvSn3sQdQ?Ra)bJx@6ei@I<3ynYn%f|I1Adwd3Zu z+9j~ui5LYVjHozlbq&4+dqHy@TS^g+y_pdqnhc?Ph#3eKV95##Zj%^vT0K?!Iy$X@ zzt4?#_}cGMk( z0c`JSnk87oz8pDZpW1IwD|{72wY#lU@Y}H2odpA1@bMa*z6k1;OKnn2?eHj@Pr3ia z8ohR74eu@3o^(pLwA~J-;Rn&p4mvpC_b$Nm0hb9y{+9^*ffS|NAIjU-|f!O-}DPwj`MLk*pPjmB6{-H zpb*8P;Am^Mo8hAO$li6=Zk7p3oDbx^;T@NB-`>zddF^uO23(dnpDZUH$O2szK_+-^ zr3RcL1p=@abLGz^jTF9De&(#}Gi-=8)gbZ;Ii|4_6q(Aon-O1l7SP;J@U@JbJvht_ zGC>Yb^@D>7-~`z!IF}1kpRTyxft6CQhKh=iJMxje%P`CF=!*&A6_X*m44oTaBEZ{ffHfM1c}^?N1o*UEouzD(|9je#e#n*L;L;Oj zOz=E1lhamjY1s3R$yeo})8ljY!8NfhikUx8lu##SEaTVBct+nm<5ThJZnRWVH=8~x zqNf6KHx;l-1!4VtB6t|mAJR85{-pYv%dgMX<~}9t9$Q8m@GTK-m1b+j>eFuhoLXIt=1|&oImW>eXdy%T_#B z^wd1gDY5BwKPIs|=rkvp{{<1E)3mQ9l<3XNnzgD3_5$?!^FqUUrV2XEM5v?kHoNF= zAOLej>3jcQH=E4InA1^SpQ{9Ybh=eTq7{!-V-9snLYOu4te-nJoI8oYHani>W@Sz7 z`y9+7%1&W9Q7*ZTF+0a^ntXUNa7M&-rrDBH(608MWx=dg6+gh;qH0!M5R}@|(PGT6 z**)&+%z3e3p}`O4Oo0J8J&VJv$RJtz+zuH`(G&DVwXHo#sX`F{T3US=Ys_lLP7}o? z{%R%4mt_4zLgjUf4h|Iw#VQkt+z3Sm2G2&1b4olrXznp%S^#pP)O%mnFQIRYnH|!( zrTPJ8UGuGhVMU-fsJUs$L6qXc0FiWdJcjz7_sgTI9fC69A{n)sg&cp{xR9*~=bUOv zpvUjWl8rdCW?Wrsl#P8grvRRa<>kn2b^2QA;DxXd6an>yQD2R&z`HQ}so3nZ`h~~X z59W)(n-hy^fB1w|OT;#t|G4#fFy}1DPwKrm0 zT`TooN24BM-eeXo#>34GTzAm9SJarVi+ZI2lzR_3QG%=dDdPmC^gkmk4p+E zKRnOco4?y#RV7Pn^tc~+u50>F`>@0j{F$ng-cO5>d;WF-8Ts7#)&spL;=6$PD;P%e zv&(O46i+%zLsE~go)l{WvJ=N*UtOZ3mfq{ckt@+cV`_b*s>&nUQ??VE$EXd#w7*9e zT7~mHQZg|wR)e42gfmZE9CzegiIce^bX~GQTz#bqnB3{x-M4W&S-!nh_y9|l2{8s0 z3~_sEd^CsfY+Rrk=RMjUI_Ps2%w{D>Z!d>9#qnC`KhLC@MpSs@R|l#V&&=+I8mh$3 zWp+bQ;+e9$;dO`2;jH&Z?&HqqypF2w596p^O>^fxI82JaM1PXoRk7ENgHd8uJPEBK zF_&qk(Pw(8Ny1{#3A5JEpM_{6nE=a`-v@ zH5Uh9$KA>PPTBnYls}~*_d*6xBPRHcixQsc!2PCJ2-?XIoTBntuJTxXrLKz;ls<=1 z+KT|+oS>`@e3@D|ehY+tHZ=P@#|7>d1{dc7G{^;E$gXz@9>`_&FSWj$mj85*!6>+z zrw46n^^xAN5cpTKnX+LN7$kd}`+U@B?C6422==%Ayu=E7-fRUa8oiL0t^2nr)o|=e zW}%WMc(ttfFr^#FH9o3k+t&ES7RzL;P%~Sh5#}jz~nBxDE$y?P>Mf@MdgY6K8l;Z zAY-m=EaOH$^Zjo15ahp&TQ-U*LQ4L|d*4rwIlT6{kjE!;yAx`%NCfbZ$T0`&)2VtuS;FzWW?!oq404MVu?QWoa5(CLPNI~!>^w-%Xxso zA^(@A-a2^ihV?hxC+|k#=aS6bCvqP>tm|ub*?Egq8IjlO+sGyyw9cj)w zLS`TnRqhKtA}s*`T6zK4S9d`;ZEN*5`kURYQ@3ZAr^#iv;qaoT=>pnSfMcSfTE~9R z-7rg)C*D5>+5hiERHagFT0(|H9D@{oC>i6 zi)jv2uQvfkWln=q_i4hoa|Sr&!XEc-`wYwiln7{tBZbIa3iSlga-QMH<$&Mtp{EVFbsDh~z0sQmPop>Gm=PH1mDnVsf%=jU5y{r6r!&Jv#L}7Jf zLBZGyMZjawj&T&>5jweJfiQU|v>17chjrkWzK~g{Co>vW|7lSW=c&if`J$>|R0lQ) zOt@75dZ-@+p(m;av#6LnrRq;pVFIWzI_Q06%1xt-=j(qK?xl3NxXw+1_bYq$m5ZD= zFNmoB5W&P^X;L<3p=ZE?O1Omhb6Z7R8(Db|P?R!}wEr05{jb!*ejVG9`q_uKtP1_o z?8iA9w`l>)IuCx6JkQ)AS4ldKY@Y)~=LzT$xag~6v;XyQu;0icneR+L{GpXuO`e2n z5O)kQygX^n_WwPD^MmGZD{PCsrH-)=2Sd*BUG5o=bDS!z-2a;e*rjY~x{NNx9o-pB z4s^kJ1@eV+=HSr&C(p+6JolVbRHR3zn*09X4!e!hL9}lfCPW=x=}*7#p)b(;K5W{l zQpv-+rzN`a?Xx>OHTfq!^Kq&qP+Xmf@m6Jyo%vtPouVy=H&yNf57#cvsMuaGaxBUHa?eH(H7$W8vTdji`ts(kyCdxpgnxs9HR*cw>>JDu(8j)=PG9y`#dNYz|I~x|?X4QS_;NY@PnF4F%hXN3< z7Uw4ObY{eQrz`*HW_*5bO4zgPn$rG@5qIoQ2%Ahg*W8Keykdy)@#c$sq*Z>22R%VX&z;9(T*=%Yhii>ML)s)9{U|M^|Fg(A49+ad+kqNI;u#IWqzo zW3T~fgUFo^s|nQFOjo{gX|5lGrAi(@rTO|Mj$u-j$9Jo5xiJ&<-0vo|pN=pRJ6ayr zA|n$`J}wrpg$8!*OF-=3&%$sy@;je}_)qS@TU6thb{1*`e{qp|P=Imo%bvf22+8P) zh{kH-X5_wSD~QRxcvq))?wt4VX#*bS;2Zt_IKZC%UHoejZ3Hj{8L(x$ceV9>74igM zSh&6!@Lfy)nF->1+?NR4*QiYQS+uwJ@gLu{1ROW+${06%Zmpm#kivZ4JPn5@z;Fa+ z4}S@Llg0{K&jD5*(%ra!FyTUK;9bZ^ z?v`ZU>Hjz>V%fCpUfCZ3Y;@@OFT&H1ja8vP-!Os9g_!9=lJd#6{VR1fO}+0pe15g^ z+f|^P)iLEk5@8Q`6MS5JhWMND3DC#R5r1*aY5XZo@>0B<&=iRfT!}htz=)2&XsZ)N zgF4qk3aC%-Y4s~s@kJxhV-?xwB%%}nyh_6Jjks6*)Or&K@D$lJ_IZJ(#ajCBoB|-# zjCfv4$~2}+V5Tn)HBzKpZhi#-M3MX{UA%lhh5XzKw}|YeHK~qE#5=}c!P;!1Vwf;E zo{)H=4_wg$mEu?Tar`&jiqe&c!fw%cF2$=FFkLE@nhR`wd>Uy0@apF@0h(^w@ZrH* zBCp$RA`Y^C7PHb%!Z0J_x>l7y)BJ0CL%Nk*+kuhs#VxO5kc~`$>CSFr_WmrDYF`}> zd#USfx60`81mg{x?w=>OKT1Zfyd}n!yg&A>r2yxDb$tTHLQB1;7l$K*RV8wcmSz_M*9*>xS8MWvue-U~=ebb22LsyFWaS&`8uw)P+@_2M+_CR*)5_|2_si>X!Y)^-ZSg zlB(~F{3Nd!_PFC}*k%7vpfG1Ri3~j@789jijS*e|#PY$s>?5Wo*7%mY>>Mj2_=7Zw zYTg%2iWq9h@jr`#Ur1vL(|U?}`LggRN;yHs186g?7QIi%NE{p)O5e{gyp7UxwQ=H> zY7|^}HJ?iwn3o0*5boSz1rOAHpdKL`ouG!qk1(U=y!+gku#d=<(3&~yS0E4nlxOkx zKHoyzIVS-4z%^cZx|;@R-FrhG4jiedp5!+tty|g@7}n7UKI72)&Q1|>lmDGz#Zw?_ z!VlNIsOgeg?`*gszhwGTo5>ttB%Crkl#@6pxLN$Yh2WLB2H(H`?m$q>{-Df$_y+~{ zY|r*I@cDF+-5%e&w@PA<5`ZD~Wfdq zx~3mZJTUOLs|vok-thMjrRAK?H`=jG=%d_+;rHI}JUhd;eR1g~XM{on_ta!6_fW!p z7*el6vJy~k5J3WLPtJ?Hc%Ihkd28o#M00Fd5Ci-yc*Z!SIO-z8cRfoFqiKTsA9!CDar`(aRY1kEYK3?p` zVXNDB-&kI5N9UbWnEIiM3gR8n0B`8fXfjZ-fLSbbxUyL%6Z?Itec7vDcQ|@n?zD%Euh3 zkfJ@z77*j`kHnr;1I6fH8r_U!cY^*y(ST3OWX&>UeNa2?@b`PSoJ25TF+c z)qIOes>O$&2OeIH@;};t=r~E7(*1b%vOTk1{B|W{`Er{{^2l-5%xfnH`9hI*fQIW_ zfF4Wu2rzJ0l)auVW8g_<^dTrYFT+s(@Y_(-l0V9siN;qye{HT@6zBmHebu$4_g_B- zTmkT{KjGgPU(LX*Hl$2g`uz8cbiuFQt=r!}QJTA>&;Qq~K9t ztt$5g69Bf?ND)tf9W)?ApSJb#0<$=;6g@DcG)N>N=tMFLzcqyjgXlNm#9}f6_wiDD z^b!+^P2|QNTrr2NYQdM#y^pn(3Q*Pfj%m_ztOdu`7_vOvX&2gVdp&>P>ma3M=fs#>XwnzkR?}+J9}PK z>N0+Pehb$Rox=GBdeq5!6bzwyfAdc^_5ODB*?)K)vpJv1zr7==(%(X z%BfuyOcETR=0ePDG7aD0eEozSm?s71$>tonTNp=i=G2vRKbB_^2apyIA8>*$xiOdn z(3Uc9ye0Z=hc8GYSDzV2$7=eYc1=XP{I>;}*HFB6Q`Sz}Si2J@(rIEqC2*#iu`<$h z6n>1dPd-M1x?;16(17PxYjZUy>NhBSM?n8|HPhPKP~@`bhUGXj2uSX~t@e)t4UZjo zMvX6_OWRAaImt2kmXuj9U^(*4NCb#4_5R}e{&nEJ7+{IyJI%-+cCOGs*c{0kuL;`a zVM5P>_oRJ{gREWOn&b`dS+j9w4dutL3JB-SC6Bny61o`j9l$7Xn*8u;AzUTYT@XNL z3%FnYAbp#Q+SG~pa3M)AaY@^d%wieEbMqU)7{t%rpPu|+qQ#A6KA{zr#g+lX{zyKnDSDK|DZ{$ZW*+H$w?{${p$&`7nhbir=6U`2Xy;kUyU&Z3R}98 zctc8Met%`G>tAW7Cj`stj&O;5?`)btj;jDN$5op6Y40~gPhSIqFuat#Um;p?y~e`U zc#ZKceKq?07K~MGn(31OcL`nCOWC^hQ83y>xf_le$1>Lc6f#W0Ra40J&_2~Pkg?K; zjj0T1-H}<##FoY(x-u21y@Z_o4xr!iIviDS zHQA;^6kdapH@Hi@*DJ3KwRY^6pYI%o(1&yu#J>iarNf4U{}N&C+G)9Ijq| z)FO8hD}2l5AuOw=IKT2Zu}nue7GuI=-pXbZ}+X8@VPjE zLS1SD>0{6rLFpKVt7jAJ&QWuo{3Xdtb!4gfKFR5|QaG9$Z%_e&O_z?l7l2PK#34>} zy!!_B@%}(1vYxjeGuT_ihg(|Li z^*u|tWb<963-s4oNCyt;GYR+%Z^M0!4{sWw54eqibloTm-?vNO_5kj$#6aErwv+hmQqgoPy-}r`lR!~@sR5|1obO^ZXs1uhuKI<5^T#xiVuT7Z3 zkK`?ApCn_GegFWBN@qeILEWYt!^?BQ-RB=uXLngpFyo#EaVP$}G5;OqV)l%0@3^1U zHnvU#ipGC&rP@@TfGRWja{M+)L_G^gL+N4RK_0LgM~}FpW2rfuv1?++2)wg!CUYO1 zXt7gV>xHc;gr0Pvx5A$3=re$;3#jXk|_;#7lQ3Q4_v#%Mh@oE_|;GS+cq5?r6$4FvEjVtc{nbrkR_IDjdXx@c)@^ z%wX(-aQ6q=?%^2-MHTu0xY|{^gbR07exuMg8w%4UkE>4H(#d~3HS4&q>+bpB1ta|> z5kXCpPzRX8iGK57(ji>IYUqFIIxVQRb!v`zu0Bg}jM;?oZV=;;WuV^XpWq zxs@En!&!U>y)J9j&eiuCH*)yX5gKovvP3^qJNd2A9wF{@6UF?d>s%#m8l;k0fv|Mbqe&c5Fj{Dd53*62y%%erS8 zbjp27MJ3OL!UN5}(W2OL-TWufP*p+PL>8jgN9DfVxB0!h%^{Sm?8SK{n0EU2ur{Dw z2GRV^Y(pUCIt9r7sI9=+Lgpw8^63KRM$Hd@iNwCpZz4W}`Yr(zvN(6WkHiq=z*#+v z;!aF$9h$F$K6l~u-pG+yIwBx3Ah+_xn~judiRfl6-8pf$tg7gM8nmpj1!|=N!rJ z{Ij))_mDkJV49Nv_?v|`QLj{ z0gSa+#|e~CPwCtw#qea9MLqE`B&h-GVu4JN%kC^6I}nR*FH(VlVt{SgKG}1&rsve0 z_c6Tv7jA+;{`cI_yM3%rEQ23K5$-83guaCf3&r>^iIG3z17b0JF)5^Epkh5QF5{z# zvFJNK2{G!{C~i$RMjE!Up1yud(Eq_CEbhWnE`(rD?Djok)28OcYXArcoIJ2pI%Th- zQ&G@0)550afcI`zdsf3u=#&{-PoMgftls~udqm)NBH-ky@G*qK@tE!_tC`?XZHxG< zzTtQY^5ri4U(I;Z$5dI~`2xD&pqdi&C1SQX?dZ`Sfax0rv^Q_On*Q893C`YCIpO_% zeVeVjbDb!U=LYzV+WPs=%^aUkH+oNN3kN`QEq6!sj+mmPqE9MKxCUgZh5fcMaiNZ^ zQ2b`CEMHdBVs_a_$UxFZgpsU0h4m!JvofoPnx&Kb9q8`CHqzECDO5joVU5vw(*+;C57eQ) zcG?LQcpW_(w23sz8#FV0(l=wzl6Y3PfW0-a((^sZ&Jm%{DehX=&GQ#=cyWWF7DiyZ zr%|igw?T(>#60J1tk(_w&8zEk)P?;6JuIp*OmNXVA)!px+_1%pi zx}m6q_w8Ty=qsKf4E;4E=UI9?pF}IMZ1&Mb^)o%+;DzQTuri!)bmVG)gNCso-atT@ zJV$trKkhF_acNXwZ;URZ-?dNZstW;#jQ4wFRq*<5)1uuL(M5!5nb=S!A`9Q~mSMQL zyYOgYTSgMK&y1NU>PxkTtv(=(%m0LRw+*4S+;hftX|t#v6vSo%eVU(}glDWuj|`pU zG);7*4^vCT<(wjjQ8Xm+M+!Na<9B?!vO?>_(Xnp;8Kjs2fxsxiG zeJvaj_IcmDjM6zCh5i9F92fibComlks0bDf;BFn_PxSMb`ciYMhz}?7n@rgANMm#z zA&E5h;<(G}9^Fh+cq;wiXmpz9H~Df!2ydq8)a`#)U}0OStK$cAeL8vuiDIia0-4GMbmrT+dUecIY3sgT=jF)4y9t6rQG-!4|UDJo_iM3-+l03tKkcIr5DQ;BK{>sHnL5 z$TQAuYh*PzgJ=1E1Khh1t}Ynp-v{~SOMo@qG z$VCwI(RoHy^lZLc@iZYP(9`pueGDrDsw?|ze*q9wm6hfXYN9Bu;{a@E?qTI@JjR4x zl)Tco__;3*4Y%c&)aN8u z>A+O~>!C;D*(Dd6gH;$6=-ln#mBFBd=aj0>Cjei*v1bLJ$$qHF6L8DRWPA7r z{>qhdEFOM}dsUB1OI|(`f&wC{B=yWmFTPn@j88jM-7aN+m_um-&aN8_-V`&EhuM+K zwla@DU%J(Y-e~wE;l+r?V80BzUTq!0o>E73u?nm8wVq8=*Kox+! z$}#V+%slhQi%lmf>_97#)+emy)FTAjk`scx|jPLH^1THdKk9Va;6R(6Xflb4FtKMG6YC|25jp=2+%mx{Su zpQrN!36!7{)sh=K)-5~{S&f>sB>UGT<#vaP=YLd_SNfvqgbCF~r(i8>befx>Iv>5U zyJa=WnvD)dfYEgk_oe1m^@ZJ6Nb1w}Q19w`*1z$S+b05TMb*{nb#O#XW~zGJhp|Z8 z4AErjKGRoPYiHqeRRi_i_e`jKhMyL#bn}Rr7FT6X@#*>}n`qEt05$8F7(ts1uGF9V zq<_2-^mH%q7&{2IfB6{ymF1TktDvlqz1ys!C!EW^OB=ldM#QU0C=y`Ik{ADz?q?hM z)=i1+P+J0RZ@#~iy7=F%gnV_(@w+T%W^~!PBr%Qm9m+g=sc0#blgQUgYMxmQNS*y|3DDuf$!p zjwNQAus7`N-eb^btH?kmPD{^1Q6}6pOZ+U}*hvfFmZe5zSwb6+*pPTe*}cbvp{ZNC zgb*Tm)c5XC{bkJ7Dj+>-YKiPAg`Cv{gN6FlC|A2E``gsWq^?8yty@E#n_WU>x!NZ5 zsNU(@_-7%lAyycGe4%Oirpwtq{0!j$rcQ|8BNPm?bABZdDfj8fS0*TEC?M+YC11gI zGM(JwDFR&-;~UMGg54>>mE;pSdae&J^~C4}Com|1Y@LV&6%|v`_>~hDq?p)`S&#o7 zC6Izo4ffIajG73+!88hVj)Yi0*Dyo84(?Mc`bRB#HSQTNIs#eLc=is(BwXJ7aJNvS z>7oz>y_pHL9Y1CnAi@if?z{UWSsZ9bF|6++sbV_6_^Q^O=GU`g;u6e4{U&STJ)Ma@ zotNWdfFkmJBCt^hWfV^_*U3FEr&I7w>i`{WLcv4PrmW; zXZ|8$=HLtMMyB@L#WuF0yWiSQu zR%x1eD@c-W@@HQEhT5`9mMKsO)6%MT`l`#p{oomU(ceKo-%)|!BrvEKGF|?wsa9D6 zJEpCEk^@Rl9UL4=f3b*z-k7J)>RJ+?WeY7FzlGeMGY0!@r-bN-FxC1@1l#k%mi^aK zM;OjPv4jQU1@wKeWqHeHvn*tGxQOSWXg%MQiQO2){}E3Apb){INRd%Su0-=XzFG2O zx2*k|6RDchlu{w#V)6iQ5ua{E8JnFyDk{Uz1ePGMOg*e`I8LeM|6>8p|9Ft>P&e%l z{@SDbST!c^8&A#~icnj*#YEnAf&XEJ$|;mc2DlMgt1zDU?P`ccE!g@k!a zT^KjO4rC#WH<$Pgy$n}~BmFChCsfyv_+$8(67;PmStR`dcA(U5in#$Rj(NcRePKzo z5RDPqQ2D1Ga%IxiLO;!5clS&GVr9b@D&b-PJXz**7Mnp_bqN!x4|@Q?rl$4b91$~v z{TFm*)@!56J=QSpJaFcUml=V(3)v7M-tH_iM@=u($D>*-ntScZ-Q?*ba2qK z)N=GT?9q0%`|;s2d~EbBx@`AC6dVzN&Q#O6-GX}3s?-rk$r9QIMV-c>BrCC%d3T&L zO3I{Xf+5WrTeNQ-AyCR!j$1Y$uy2B4iWk@qu0Qp{;h8_4y{vM;vwDRs$uB`sTUSLR z!N#WQ`c_qOd^Z1UrLR#~Yhev}6PMWNfrP>5b3qS?LCv2 zYR6_be_-EfC++8>`FTD@=v7Fwn3b&SgxQ`v=X)#j3c?C7M*i1nC5_pfQ07ABbd)uIINQlFMd!AgOFBEO z_m+Hce%%&1iD=+8k{km9&>q|h_rRi7;Y<+FFtbV8YZ8^9j#Ngp2!V{v-?^vQwdjhb z9{9obRZ@tb!skZb406(;lB!NOP-ZNbD7W0GyOK1ARibaQ_p5%$Y&A569vQy&C?v4W zxm~S_rjhj@8q%=^f4>=()4a%+gvh_eBwmil#VQUg*)<)%Xl@Q6#*)S(gB!&Tlx_Zk zCEgWUtfKGEhLH+XV)dYj>fd9q<<{V{VP!g@%9zR7mv;ZtF(4)7RJC-dhJemOkq$vr zJ3AR68vhT>6a*vFYWvbpFEz@L7k7ly!~>Tt8gf{GHdIxK z^->J66g*!G{)JB0?ewECg!>~>i-dAtj=W^*f&@ejH9x(bn*{$9@wYc+-#sErHKTK! zlOFm~hHOoZ#O^Zdha;wi;$yJ^=hnxtEpw7DWt?ZAR|Ro;?L{bNWUho4*AEPpmG(c| z28(Sl=VVEbQmQFSfI?}F%k+nSsFZA%bR`A&IKBIniYshVN63nZdI!)FN{;*7lswV= z7FXe7Nt-&jX`8E*W{QVKIlFPHnz`~b=za6cOs$IpJoaeqE5j|2^|wtN30tSrEVkEA z+AbeDWk{L1YitJ(9z0QtW$qX6dkBIfznpsgrv@ZzV3jVh;_8DobhR;3L77acqP%@_ zfM$QFq#?NnH{VzE9|5FrFUWsvoF?Ix_9RKO4e_I6cPEZHX0J_flv9qj7UB%E(>Ruf zcmq_$qiGX5=jsmLrkCRo`r^&Eu^n9MW*KaX1_+o4)OIv^8^;3_!F?)#>^g-?C&Oq< zAvKoc!wGP)<{yXo7ta$v=k)N^d9@!zL~%roF4$FkhnsL$gjDrVk-l7>Tlu~|c|wGc zLvP_~fX)~)IlCfutT(8c|81P>Oh83(@x+i8x^?p%EB>51V$!$9%V9L1%xj)EA%=71 zsCAKn8>68H8^Ojg_5;L3cPj-js(` zW@fnYC1{@sk^P1TYwuY{P*b^4kMqF>&ZSAkDsd*|3%+&TbWTx8-8usB_NTSUQCyU& z;%4HTcs>N>5Gk@XW$f!Io7&Uw#8Tia?zQ7@Blz(wawAq@*ey=*$IvGpK=2s7{FeOIm%8$nGwvh6H`R{ zyroCnfn2dJNDwu7Q1t%9eD`m)dwY)_hZN{c6NTVoqpQiK;b6zSx<@H1&pjb#M((Uu zXi4k!7xHV&kEHXF@KQtR2{SyoU1!9pDX@pR4sbgg4xh->8Q33pY0+=VK_K}=NFs5l zrBv`2d`T@=hl@E6+=@&OL;s1n>9T3gCZx3Peh_pwz!Gc2c0NLWB)dc$%}!t5 z-c5YMcHLGhW*hXDye-)qa9H~Ej0t(36sMuGci#;l*Z1|EPWkd|@=Mc>q11|c@iaFY zawf|?jo$ITBO^`KUTyapLb5=c%uM|IcGOcH`ai@w82T0H=Kto)7>bEOyXL=OyuH)_ z{74C}Q{}U)msDNmd(YO`1puLITyS{lDO#@OB7h`BC@a)^<7xSE2X%;HVK&spoXJk= z+(q7IfYj$8 zGKMPZeR)z;m&~QKn&LIe{$9e>U5-wKUcuauJ)VN%DRB;Y@9-demsx9W{?F(c1v)x$ zgP4$?6WVgMofF5ssK;rot`#E|dP6S1H8_HccAK~v!q562*@2u^gqBKK;mev8GQQ72 z+_rY%6H@*^|4bAh4{%~i8%TvCVW#n{v4b|;;kF(5CtRLq%k_l$frM$&!0);Smvo0D zg=(bWJ#$9u>XbD343cI9L?6z^maBnl{-(xvp={4ULV}F`yZvzH_969Px_DcNKQK!H z+5PptDys7B<9?)r!ZoT7IbG*3gfHq)*rF4o8^TMF)$vZ#xZ&FKv_So($$ZSPJkm`w ztgGR#$V$^ZHyxt5Xu7rSu1rp&>t}FUt4yV-iQ1wU%2iGYj&53a2%D?pI4CiR} zB4hT5VE)eZq=(aomB$a?pm&UFunkPje*MzWJ%;y zN!qJJ9Me%+1qA2^umW!41+3$UqyD&AL1D};S;UIC+4CuShCy~obvWAmiex>MZ6Fe45T1CT)F zFqgO8chUqPe32l*Mi1z@n($*DVB7*r6@%hLCYd5#5jh&}Cp~9_Sswbx1S*jTAu{-g z%_-rnf^Q1zvyPx2u$2fHSp7wTBPB&YjMz;TnggD>;_>>@33dQ)0bA#|6p?-EY(se^ z?*z$Af40Sx(5UWn#(>@e{-k2?UoF`;RpYBjI^zkAlndg_KzY9fSATcb2DBd?cofJ{GF}dO??H=4;Ie3j^o)aL($Iq^@{JVH$B_# zH;NM7D@>1n#&D%s-G4S#`DVyMrxiy~2s>iNZ|6;3r{&-%tn?NRRFQSPL&3xEOGiU8 z3eGP@m?cJbxV>;DKP1*;F7(=Niz$81`ddGozLLt!hRM{2e{ zuUu@)m14r~K{Y6iMM*Wf63*lG9+8M#o!q3-dr63ooVTHwp{Iyv8?)_&^ylp!Nh{bN zLcV`H!czoZmFN@qsM>I1UphC>S$&mz;_w|?d@8^RBBQP!6lZVDvlX*&vn7A0sZDic zgTYacTR0S9W;?#%q=of6?8Ma_GU)vud4k7#f40bB@d`9m9&8^IGb<-aEPnkjDKFo~ z*3$xW3c5~gpk>^9vY18j+4UY8?m^`UwKq@mg0WZ}hvIYvtN7(zC1;_Q(p(n->>_f6 zE0GQhYaJc*=KqcJ%=GG?XiMFI4L|zP9({u}!MHqCL{ht4AU!1K75RKUlb1D%?-4OP zi5J~=S$9L2?v45Bs3D%7Mf4hFOPVSSobcOMufYGM(3)m)xgDqE1b4FWcptTFI#JLf z(u`_987OJK^uYP<5HrqoC4vvM+CE`Gfj$ZN5|R?~$&gmG-zQjROwJx;-2tIk5e$P^ z;xgmJG~C_5zQzACa+d)5!FyAr5I%-~^%Bd*HpO8xD=E=9iJpjvx18B-dDN2+w4RK` z+BDs6QfL;W=@4g+?Kj|p2OtU~^#Va;4cvIihU;-M1ru0U2@cEPo2xXT_vv=vqOVd^i#QkbPa@! zzQCFO=JHWpR1#8Xfz)Dey7WC>Dak-(7S^*vJ{)nN$~!dc-xr!Aof?JGiZ^DLh`c?w zVai9nR5Uf6q>-K58(f_l{uKBH;gJo`!pYp5Vl(D1@d+BtaOhSk%Jy6 z?h-dwTFs!RTyFpd0qgRRQ01RZS@~v4=9WR9%-@>Q_9UuZcSlkK804`gj0Orw-Hl|0 z(-e5q!p&@INi`#3tf<}iDzfLE-T$3oQ%7?z3*kA0@$nzBrYBK9E04I*d##*}_3~m$p}CIHH2}N+eFy%ccvEJY2!lDogiqOU}jmc*mEkImd&bpE{5e3X$`*<8tdQ(A3D~ z5M7#G34%Jip8m~aok4e|sMzPfp}Sp(#oU-U6>au$e-8#SA}ilO%S`k2=U>RR%c6JO zu4*_REBSAO4c==B)LzJz|BRSF=$1jc6q26Hmen|yQ47k!vsNJlDw(khNeL?|UOC5B z|xl7`cMl_cuCME=50vHb*DQQF>O8uT_3XT0(vgA?tiskt{|##u4)xN1UJGgs%PC11 zrnaxby^b0^G~V)d-*j72+)oDZhB#QgNOEFGIUY+h{XisItm&C?fF2vLD-UCDv|$dv zMH;F3IMR-==pTh`)*V;1BQ>7bKGe;LK|MOlXzwmO4jI530~2DhvW6b7g@Oda>vq}m zeCRwfVjfJ2a4x!2EqB=bgks(ZBMZuJ_{Seo%9GZFIv8a?*>d}+A9A=~WCspUPayMr zOB%XJ0c+%SkPpq7zq1AVttWw5m zeb>F^;_Yz9XL!tbZ#_48INrN4#&2p2X(L-~elyMs7{-v$R1bCgBcb?=-%vVNavPA1x$L(G%a&h4axuYggq>Z@Hgby(CLb_p=yE}|#P@~&`BrSC3zRv?`CNt( zY>IGnAgZ7;=LspD`S&+SPi=W%BHXgR3P6_EwqB0Bx!o zO3;u|W$JALQ7f*VsL=){DKXf-#GD$6fwamzdxxVy=v(T)mu=(N-wu)B7_x<2@-do64UfKn?KS+mB0`YmF8_cIwMM%6w4o#?OnlUNFeS>x^`; zaog3F``Ab%^=)>bT#yLtO6b2TFj>i!sW}trM1BdP9Htw0nv;yabOZHO%YOjtHx&iE$Y_C<}dM2J?LElf1rc3VEk zFf@}i++@k}kTz+PL8F}1OcWI;!<9yY`}}R6y8)Qy>PEaR$@-w<|DUx9sBNn2q89}E zT;Mp5zYpBFHNTcmdn5ign>PH{mriO~H!*zr`@an2w!Wt~kPpx8GI_-mGPO#3tMz#~ zdqGq}2+|>zzHhX5^+?P5jYNS|WbOS}-75-Q57&!M(a9&7f;c&x${F<+K@*kLvfhyV z#(eoZ1Rmb*1L&WaCqe-A?pAS8<%4QETld5|y#T2PGGkI`k>oyUNP5&kVgT&G;mcJ* z2GtKsVB78$dH7Iu}ZxK zqwu5$SLwYfT&fY?)8>sIc1m!7AK0JZ46=)i0`=(SnjAW^`@-UbzA}1sl$vruA@Y^& z8+LEr`O^%?F`E0Z8U8R8;MwEd29`a$6lq*9w6QV&W|w|W6Tk;msX-XSj7ZBZr6uM! zqZjy!Yx}IW6m}IqilVszNFf8Iev>H@-C0;wN<%$1jx-CY)#-N`+R@47Ki;rR0#Wx^VtfK^ci_n#q>y$+tdAK@iA5Ajsm4m|DYX{6V86 zAAjNS55F$E20D|5)ZIH>baPQ;gMpO1w`=&%ESh7W-#e&N5ER0IN@nDZEBfMoO2w7} z=X=;V$ozyHLnA1@godVn+8yWgA9BK-N1rzPoFE_qGBR3w4#P~HZOF@UFP))7L%Y7O zcJ-qV-$Y_1gQRa9Cq;kWQs_2;-r^c)|2u3=d0bq(p)>ZJU&0H z@yAYC^q%j;^Um^SaN`zz-LPn@4NVmAy3);hXC(0`b%Uh}2FoC)WvIr41O`)RdHih! zLyCF$EQWO?TSOE>R5q`e;3K!;=V0wJHXp1D=d9r0({AfyCb0RGUh-;WB8-MZ5Zb&%IikcI zV?~d_L{RyPjc(1I6K~mFQo}_c5q`r2&A1JSn-cVaZ@Mhr);%LGn9xzqJQ_$PO0RKx z+|?k_Hd8!QP9C=W;i^bo0cGVc)I^4K+8?7UP=%Yl^7D%wH>_g}L{llsvg+v5|dEZc|1L zrzZlfq8ja<>?>21B=NtvcBJ9VbB2BtPeGFd6Pe|O-?mY{hK)`%Gu&>DA-5@h`F2O# zc|Ha)r9SBf^l_yIUy{I$%gvw?F6h<6&%iuJgo4Foh?I*ZfB5(RER1O3YRv?jpg0*+ z?LfSvih`Z|MKovV;d?dOkVZ9Ogd0b!%^SKrYG%YafkpS@B`9h~`xmujR3{z$WtPt! znOmC__ro}hpwI%uqn2n_7{qm{v!kP+3Q|M24zAbC z&72DW<260x6k(F0!G@>wU)pb_sWM?hgMXp1EPzx@V`75NI~io47Li9nlWr!JTSy+7 znFHM1M`SCHoPbC#Baiyr6TY_BqZ!;ne7|mi+4aYW{^@FqUxlXw{@qb29!G;(2Njd6 z5BF1gBRfCG&&13=O3cIm<3V4hY|f~_Q64s|Wb%0UiV^PDzZ(SnRZf8L{TwWVi_uYwyj^)^iOAt69i zU2ge0n)wctW0ep10OX4gKc>d;;X(fq4?_}%)H{U?-uvacIYP0@hJ0f@Q$I{EMaPqT zXXPs!ze10S! zD$uVj)=4vUH0`t)n5(?31r=C&z5vJsqCQAU$-FsOVC7|tIjcGV5tP(WbD*s(z+Y@U zTO*fw05ACRdGt`i+^i6p0#V957PvH-mQWF%^kIw$QRg)=yccXeY?0hcCZE944$G9_ z^*%#!JA+}`*LYmJD&qK>fQ|w`j+T9RTs6*c8Tg-w55eVj%G{$_x=5Q4tq_mizC%|X zX2z8SCh&mj8{||RMQx<}3}n4&B%*8f6(0x%fNJh=e!R(70nTgU*CNA+b<4AE=KPTUyotOUlY zAd`(4^7?E0sNo;0HbIQ5hdV7u6tIEQ`R_p0>Q>smul0>tC+gs@z0TOhCFt<@)Pmis zyV~!{Fw){Y?Jb3pn`Tk7x_9UR)2k-F4%}tKY6m=k@asy*a#GS#7{g`N|?3yBbLj%{Z07xV?UF%gM@BGr_C< z)x9kJ(EL_+iy0mO1==N;7@FdxEn))wDkBj<`M!yN)MRlo@=w~E)l_P2oj2@}S}6~a zZ;t=~Dh_2i>9>$1#jU<~YXf~1q)3P~jf7D{T$7Gw5BQI>y%ANSRuVr(pn&w=IYthf zn4qpBenOwW^4Juy_q{IE1@?1+w;X7@R*z5O zXlQ7BzfKtvUJrCB{Wp~3FCkdDS{q`Yz-fg;v;W_0NKN*70nS;XXY ze1`qAFM2*Q$!Ll^NTRGC+?J*wLBSA<|rW$Xw>~lIwPkPGa4+(pYd@(P@V$FnGVzu}$7HDZkFd_@@7lp5?cAa0)c+Ei3 z3)y>bNZB2c)d)o)2QnpDuDZs6%B|lI&)^6AS=OTX13;edhs;@|vdlEg*R~1>zZUJg z%COqXJLi255gFp*DDy%)^krLC;(@bxQ~Q^G$7Avn8T;I`=F9glNXhc4MTl1(uD==5 zeAN;{p3lX&FTv?`U?Af1Q-Z1oN^3uxnQfTRbQctoW(*?=(P{#-qx1#E=k;{!Y1Q;GSW6LFSKrh0!_clZSB`QGg+MPeoC;nedQXV5lrd= zLV|F3+fPbt$3oD56p|0ewb?S7ClNW=Q+&85%Xo65tVe#0@>5!+wu)a6)$rdMfrNAc zrb-G(KWWrADOk8(!{_ki5a(!|)o4737Q1NLSkd_d_Js7@U=udDRxT>9m&|isW$+`@ zzrUbWoa|@rcd|EUn3`kG^PE_OXa15`v(Kxp-lhsE$fYHm521%G#l+5ywh(}xm=Irv zfd$LAE+F!X^SlpnVTD6TEJ|pFK*YCzd z67Y9*E|LKGwS@+}-+JR6k*o|=V1R1}$fQI17=f`Dgbq&G0_zC}==B&0WMf7y)Jcm} zD-UrVC-|df3VNu4X5WT)Fie>0Pn|j;YjyRlbrOI2Qc^Z9H>1CO3S(D`LbV{;8>w^D zRJaFwHcp7%hiGrbd-%S%*NIm}@?(a9ytzAa7MIUd|JU4gFv9gc?bSC(@Y6dfIw3^w zH4%g$(Sn2!U9h^{MG(D<-lL1?B-lmt7Cm~m?26U<^1t3s@!k(GXU@z#&pBuAoH>%u zy$2(!fr6766>g>D_d0NjH;W!~g*u=iZs2K4b+d+q>SYcer<*iYC`eH*fY?TQEnm-v zCzqP(?d}CKsw~tAPk6Iy%gI6#ykNH7^*2*sqmiJngAJ3O-Wh|+2}#eG5GH*N^&pOP zs1*f*4&K{O8;7bg!IG{yl{QdV)2)c!29d&YN}Li8~>L5-P)xFYJQ+5zfvj4 zFqUoHiT&;>=kK34jx?Ho7BAf4@R~+Yf(T@v3eY@}=s#_*w=Y&DG#X`(gkBQc3NQeK z!NVW!b=~KpGJs3b>$fCI2i?#6z;S>dNhrMR;;88Qfgb$E|De%;wONHb z!n4$aAktFuV8Erp=ZU0MdwT+i@dJ0uc6*hc@rCU)b55+1AX&3jaUKONJqT^o%!GN2 zV464jiT{mep_G%n$!o%tMgq|tOXIT8ojmGAo-0lZM@qXyAO?7t9m(J; z4B>NaXXK-IDNcFs6mI%Hi-xF;aA|~AUw)&vOzl3~C`s=8c%ore7r!D$xI+6jjyVFR z1NVQilt#m|01rwRV=<-*xWdNxy$4w-0n1BhLDc+7mt3Z^+19ta?*qu)Odmu9%ukxp z{WAAun>n)PlAtCxk)S5TLwhlscPBLg0~s9v zLKfSjsS);IrC%*|Nt=xq1OIKMOx1Tartzm~&Oe7b?el`72bNtb}Sx-v9Xa z)XLPmMaGTSV>0odwx(Sv32Nf^JLMI#`wue%LK#myt(rP|1#_^QS|%-CWiR%i>`5P- zIP!JZ1-eE9{63+#^1=s+!s)BU49McG`U1)BO8uww@wkRjp3Emol@z`2tUK^vlt;6a zlJvUhrVr*laVwS;(ACW9C`Dm6%uaBBj9BNtJOLMyVj7F%;~e=AoXZX&t3K&EIIO`^ zup|G~k+1qO)ko*gh;pZHYX#6BlCZq&-QYLj6}faFOE(THw!5c=D|A+$kbpTIbp7Ek z7stjh_0)>qZ2e=e_wp1+5BuV&cAy(X48HPn86co0esmpBb&|Y?n(*u65Hkf+C`rha z47d_o;owP|ZmB0dhwBqqS_ihw;mn8qFsr=hw@B|HT$?l zrgkGOfI(JxfiU0W8y(_rZ3xzX$TKi&yK^P}cP=>KS3_rdFPQsFA6^}?%@)Q-U()?J)pJMS1paE3T^-b#fbk_L!NzR-16iz})j2EBv15;f?9*UBBU_9uJc$4BV#Gq6&kLWGIbR#94%h&KSD$yeaK8Q6^t7um75gurA* zsQj8PNHre8vUr4C^0Nn9>2(6zNVRzX>95zZ$@(`D21t#>#GV8Eq*eY)4>uZ@mV^5f zW}d4?&khRYbjgPO4(ach)-ItnTGFarI2d2d>Pi2vvzK{6E0#Q z8KdE9C$rvtVO&*ELx@F2t(B`Y>_5Vj8k)iunvFh4y-4D;tHi7lsun?fn#JCT^%E#fjDwp$Wdmkq?i zy_`w{#XTa7c!cJ$Pi~{DPVviNlB4>k10)`c%$4|-Q4q&V?>a&U%6E4|HbWT5IqKds zo*{P-8ZRb+40cG`iO!@8U(%mU$`e5{Sx;Eibb~O1{_QzpHSY|R(^S7vg2EASam1zk z=BO7NG;&VSidwFGV-Zxg$+a8)3|dEAu#C*dYv54)QAyj@Ff(uoQe@Xul!0`+zsvc= z10=^GqpuHoLz8ahqHd2BlW|S|BIm-L%~tAJ*Ic1QnzjQ`l_7%TzgOg3a!)71!+GkE zhg;w&ks>LTG9dZz5h)M&ka?1KSV_1L z-lzJwfXgk~ zPJp1oBCZ_bD=FS?)U%RzI~sJGCbj=iI*9SRp4D`Kz2N(O2h`0(3K0wZqC9$7WVigs z)Fr>_lCb*~!7}wD4?;9Yja$1N&nOswK*lzzB1#29fG!mk{*Sf}T@13`U%5R}9naDb zulXAcGv7+Si1CvzEv|>H@b%u|$OknS*i8|O-SYIpK55O2e-INV3lolNLWD@kH6Q+` zM&}tsB=d2X0s_rmQevoZ@bo(8j-30Af{znvupVjh;fb}d;}f@@oGZGoda%`cR@D6| zb*{VP&=X1_4xggFx2i%BI4^OZeYuIPhaF zP05lr(_ZlQh$PyT6b~a`J^fn2f0q=Lzh`fanXWpSr6aZyGMHsfY)_@``*ppp&R;68 z#KY%&KKT6pdW_9pURnWOXwh2lb))O%kx>E%C-?=ljwGLhOj81mTr!}5`C+2&B(CXd zhk4q7fXrBe(>E(U($z$4w4?7HzxiB;<>0MB=x82bf1*gtbS}L&0_uA5@hb0f)b1Q| zYiPJyp6WcLegNwBBmGU8h;wE{GrW?FTCVZj3p~7n<-x@n!k{*k6BXo2Iir3>ICH@{Q+uUq)aPrWQZlKG)~UlX z33=m!U3|au6D<>SGqq@obx)JBm9-l2&TQf$lz50Y%Q5?E^tIW#wQ_=T;cA$CUc^Z$ z*gDgwG@OqtPmzV$z+|+HzED%mkoIHy-F?YB-&%6%zT8(vY6=8W`!kRH6-7aZ+bSl* zKC!#Wh&I^T|cjDKbf2wku7iYhYUM08hWpJjLhwfiH&Z5 zHJ{*r<4Lw2Rh7XvM{MH+-*;!4ffSI+aQO}UK1+C^uV#y)d2BFA-+0;*lStZL-5>rq zKn(K`X_5y*>Xz@$oGNhXEM-7qB-R;2<{EkD+YHenisBeZ>)DmN$xpGzR#DCjX@6Az zeuYFo?DKBZ9M|XDo#jl#;Ib@qBIwHpxX&N;brZH|>I|0}Tpaz~*SL|!2p~=JLC8O* zKQVzYv8*j>oV4HW20@67*HP0u*O_mT^d9Kqk@AHy2LYDR;rQ@td!#y_j&^AsM&0K; z*~L`{qYW7uJjQw;9y(0y_qYFQ?xyc7sk)%BY@NW$?1`8<++>IpxqO{Kb@!8c>7262 zW+iTpzN|$&GlkZd@HinsS>K+kD{O)Od@SMZ(6j}GIld-Ljes-~|n_2r&Lw51%jM!w_ zIO5OtR~m;qyTuowz{_m7VuQu9b z22qBY?tB{vqck};VGIw_7qCo`J}|Bwb+KQ~@Mz?I0MT3{UuybRGkn;j{IIH}!XndO zY1lY=Lo;2-V7<~cc(Gn{+#uRUyV6<3)CHPRo8)Ffd=7@K^q6++))FeVw14lDXBn$TZkLYU*|tD$=yQKa zG}y?^-5yKDuN9ZLTV$8-TTu3TVxpmOzGB;}O&{8H;QYC8R@Y-wc`0l4)MP;a`uZ># z3q6;p9maP|YTLbnAB!otyJ|2rnhTd^^-2$DwkVsg#5~{V9zahzR@SG>9P(#Dw+p5J zrD!TCjdw+8PB%e>Bc#h3?a}IQwRaaQ|1~Z&955pa>qZScPV&cWF4MDr#b?$IvkUGr z2OLx*`lZQ!#PfiDYzzLIIkhm)^mnC954ParYx<z`_09BP_$EU9iPF_X}fh8ce< zuH-nqXqSzUwy)2y_cBdD*%qOzQ(Cd7SR?7!FW3!bLsU8u5nK1O2w-FQwC-l zPER~AN75MMASW(a7@e}({6e$r?%jUmX#2?h8K1=-X`8Wsd8@)*_w>(;gqRln3@+tGRkq0ulOG>d|q^*uaYjdWQi&e3HTB z#%oxWY`{@$%`pB^ZTn6iJgN@6cyp=8?K>-3dr&D6Fi1w=)77Fy+3T$?RA003tYI>~ zRvhC!J?LxGri+S=n=bh@672Qx-L2tGxw)^FoPQsekCC?D}rWaqSK=IW&IA`k*T%mBw*}JrJ$h5%HBBlBN*W;sL=S zuQPo1axtFrwk$bB-$M^uh_s{HV&!nii(C*$96oN2XtSLb6^f8Y+5|3U()fjR6!&xA zyLk)D0xy!|5&v{WU?c$HnDw~bWH{>_XPyCKv0{(C$K2lU9winI8l|-X& zR*j==vK~3S*5T^KxqL8V7mI~8XF=F3Yk`rT7_?%LoDi9ur(=-C85!@)M6KmkBR1aF zB^EzxA&e~2Mgeq?8@DIYspw1dW16W!4ofE!8*e6R!-QM zDj&Z_pjOu#L-!Lnxu3VCNl4v5?;YUPNcgvs3on<6hH)jm&N0Yr@iHO}1cHw?Sbm-6WlS34SuYM2O^K3U7(O%mEJFoa)01}n;VwmMdf%lcl0#K9(UPJU!3AO z3Xp;vukHmuF~ v*3_P)pSm@pl1{HfT`qxMoB!`WOXL-M?No&SST|h!R@vujI;!85Erb3Cpe7XL literal 23896 zcmce8byQScxc35@(n1?i9u2~koh=~j>~X_%qAm2Q;oZV*Jeq#LBW8)m-4d*6H4 zy=#5n{qqCX%vopl?EU2LiMG`y0_q#s;izP4j*o)`EY0{>EawKfz%TVROSn`_mpBl zbl>?zV`rYG*gv*UiXoRZ+Ylalo`T^kAjB|@DM|QFi#UePD25M{-ZC%lOhZpk@7DS7 z`hN87meY=NW24Q2N72FNy?Ywzcbg9jc}0b`qF;vGh9JTJzkm9ce{N3=xY^zCITlCy z1sBs71yG~$iU^mq1gmfKicFp`oN_|w9D;9?%LJ6(ACX9S zK7x778z}!&QD$_tD*x zftvuF;gK`tko~Z^bqitp60#=u%q?@MuUl0vGT^*-;FtTkEA@g8SXv-@RMLnuydKu@ zgkT2!;ag5FbCue(cF5oFbbzX79^wh|Kj*b%R}!yzmM=XZK#~>ioXbIHZQ5;gKgqe< z;tQYK`RlvOvM`ay%m@5*3`JZZZFJ%mh;d%?h7^>er@&xbOUB%OM{3fT{hlxR(RDK_ zlqqGUPe2;&cE zzx0ApP+d3ap2T#=Iq0O3FI`ut6Kq81SN`w5Tw&dG^Vv`qlfsQ!}=w zBmA8HY;zZe<^tM#3r{5f=7o0Ox9r}~EUE_{1?Rs3DPg^Mu!0|7p*YJ9RIRVu*y&;0 z`-6$%dC2?LitAYAu$35r+Wq;k^cKJ9%6uAcMaerQi6*~JWa&v`BneX=bZw5JvE|#Z z_*aDAMOqVY8;McVs7nMcwvzITu;O3*dK>a=Y`WEi*7@S>mHLG7VJitCp6Ti0tqqNv zc|FxJL5vs^AkE}nz8{Lp@(U+g6Ox%G(;p`%aJ=-STRmA#TuU>cHD-t^sfR zFAF+A$3zFESKl96?`(6=1E&~W0k!dMrbTnbz79_>_j8{CW{>0hwIw}kMF4BV+4y4M zWxcLy%BbyQb@kB&p5PMUONR6}Bpxoz^y%uv`$5+}@q91r4N9rF2uGiT)O>U>*qy*4 z$jRSp_U z+jjRIe!W?9`u0VgzOn&*)AMH;)87O+W(|e)xmM6b2O?h%WQ-YIU$wsf+so^`f6!T) zE@oP#IxDoyhiRWNypFiuyn)7Z3W+h~J%|_f4<6WuSVCBXq~$9v%Svzz7x!{F%{F-J ztrrKy)su6LhFkG#52nLnroW1H=OCRJVXT|+V>`DPI(bSfb)vw`Ll3OACo}8qYGArP z49wPKQs|CVl{H!rrxgY`hW`I_GC(>6b6RJsAj%kuxi=Y9bZ( zxQXc{7T;7xVuoD5U_Lr+@sm=v_b|@xH9?Z##k{Oz6;_n+MnjrzK816mM*5?2tP`JI zv=6p?++x`lKSAMy)AD*Y_HGX87h>A)t9?2~hT$WXu;C=~TT(BvjyU`B!Riy3*qjSq$eD11(8 znWYfl7)Xqq;h9@Gbq~k+v%)W0d%c^Ohxr<}r4|yjLswa9sJx7|} z2S-N#4iS0EsPV$Wd+oRG{yN88&8*{1K#A<-w?n4T!@U)!?Lk;MkK%sY#RUXD*_bpL6dV1KM^e7X2) zZ-!q}jsybaBVG9s8%MBw{qh2xX2wP>T-v!E1;(<-Q8B>xCo~RlD*)Jk5^Jne_OIHT zxO)(Na;X-!323z-A`gjTLT>TvF_mA`wF`>Yd`34liOW1}5Kx+ZDauqyq(76-uwc+u zOs=mB^vFXzu_aWQqg@{}ClVQ%nIUmah7;>(EtVdiKEfr@)Xjrrs^EeBNlUro$r?Y4OTK{t0ma6jv$p zGa<4R!QL*lIXEFa3d6SC1OiXq}bM7vhI62va=an4&RYHKU^I@8c zfasS@4cp57f-1!{Bx`!gI|69Xt&fzw+{obWuPX$Cq281e3Dva8Ly z-IUD}WeF#M2;lZd`4y#;!1h&ASl;}v74w=FOw)W#&>!F2B45TshbXs>FRMZfqcxyc zn=rXj&?XvCY z9<~^Kd1Av56fumZn<93GJ)>7kRa;-KB zB8}wAbF?6aE!uFpZ|rk_eV)KvgWf_&{4fFPv*lEdtB)d$nsKG8bZf_e5`NCoLH~&n z9$-_4#isbh+}2uJ#}RpFw|-Gfz0907PIvUMvYYVg6T)^Fiazqu%kQqT z1Us+a>$Gh*>WRNi*#EBfJ`oTYu@>kSwbbrsRqV2lHsU@FcK5asZ4d)C(2bJW zu`qYjo1=?_#rQQR%Sa4m1KGG0CPE?MmsC-&%g#GFky%jixFq5nH2r|7T`nG!?84Z= z4gAPo1fkMgB2==B@vy>p+i8jJVE<{{9_#37G}Jki>ixoBli#vrJqB?D!#h#he|wJ{ zZ8O!q7+ZNPAV<Fbd5E=GdDje^P%#4tPLDv3k5Dvp*o+W*P>;wn##2%W4g_TOaA=nz1>VHfyJB zCGfNVKp=oE7i>gtN=*0`lJr#) zTPpNBphCgP02BBguLg6aagfGH$bEj@j4x+(=V!tEG?pY?sxo^rM)xm^llreX72HS# z;J~)!&&z@ebrBkV3na1e3A7PS15hr&&aUr~{XlxY#rg>gVK1-oF(bn$ig5^Wb_FB1 z)`4ubNOhlmMo{2h^Xm&I!_-z#lZu9CZ8fjNcPx;PZWW#*(J|;8*X!MG?vEROlAZfG zH%@mNsQ{`d0#^W>P~biW~xO^JvJ&k@ZW@9TaU7P#-kuL<{ zkL9_3$`ZRhib5YZNS~k{)4Lu$xE?dO5#75H)4whowSF>!y`&g(#t9)a*;8^1&6aro z`%Y(h8NIT5HBkP2=JQ9*G^D!hq`ILXEgjGG-3j`IvyhLJzeJ$4}? zAP~g&0Dec`g(^u)Hj(#=0AhLiWi)aP6HC&#r?lb&533PE*Ya* zjt&bB?(vyM=6u`)64gULjrt*+;+{>2Uh-zFT8fLJpf!e z@4skW#@|E!Z^Zvg7cNK_!T(BE-amA4g6pe3j6-7rOpZ@8Kympx{)g252cKXK22ueQ zxDQ-tqH;bi`k!2oNmXKjpHcaW{`Y}k5%?hPO(49B8N9!SzxN+f`yaCjpfBU6qJT^e zwg0O;kjYr;|L6FBC;eB4B<-545BvxHE0BNr|91sJz{Cy>Ab3xX(OzfHbSF>R?y-km zA7$ZNRPY$c#O;nbq<(#|Ao`}QktAtQw3#f$|AFgoK@9IsNAWTb`l^->%-OG=lx_&s zC+{u`+dSSW6(G9yGWw-aBK!B!7DB<}<6w-$`FP1vS~}2f*!-pW(AS+*g5xgCn6sNs`z$Hah>{-OPXJej-E$QoK`Y4iqQN%ya#uD08g{t_1qk3&#&bmGJRO877XguFzgUuy7 zc3GfLq0sV3`MK0%urty1Swi&}ER@L@C&MagB`pK*7nXhFhKm5_ho&$loW zJAF*Bjgf5I*mLHNkUa4Sie4Ny`9h}dhuN;FYmgkgh0nK{Zhl>lfIQLT0FpmFd?W=L zty;9124%8s>+}vM0L)xoMA)E62mV7;5P=w;wyoZ$Fnegy5dGPL?2No6=Yyd-C2pi} z_?p$8ufhR*_)nsqL+VPQ@WM_(Kst^dSo*7lky?x2YGT&DFpB*_l?{-fj(pO_5kAo5 z5$%30YWi}2BV47>Jm(z#Op6)~pgTUJd?V6dif{m#<0X*E+~81>?wp|YZOUm_j(V_T zi&DSCtC{?^6V|oM0IriB+L)__6xeSC7)w}FRoCNlI1s%{BYlKTaN`$v_anqI z=9)8}HuY=uhrUE4V$IF`cGEHw#p|hfJmFc^e##V`-3}5m!xNT_Wx?*84NuC5+p4v) zJpmNXz%?@1YJ+g{=*@W%od|m;jcUD~dCR%n8GO)-3YSjj#HltD)V=0|h^9ngS+pWQ zcPlVK*mZ&d+K837K+jY0y)0z?YWTuB3_no(<$GrTDZj}wc0WQ+xR(KI(vb1dQWG5y z)g?bN*fYJi5OYBC>>hYNx9UOaoIT0(LtPp@Jn~k#P6!*2xI$NUm|v2nLLv(jRT}#7 z-284&w%Mk&x&9ndFjUeu7v+;&v{_X!o1&FV4pU6 z_C<5tJIgqG#MPKB9sG<^BWUG07##qVVS(3mLrZVclS+!SZv z#Yk`Hf%SwNHQ6J~1P*LTn1G;YD_qOcNg;XmA$Z&-IiYw;#o)rI|701PpB-g0?ynDJ z(nkX(Y>0c2v_bR6YspUUIu%emWq#Mg$kgp9hOE0~;#N#`H&M`$k+6GH)cAqAI~Oy` zDY}u1Z!h|*aQ){3K-Ehfh0Da>dw1-njYe zhLp8pZ5|}!6-#J|S%|RW{`Iq;O?EpT;#47aO(QooAIa{NNMku{*yr5Nsy#==R^d`E z;y$e1_iWuXfJ53Om{f)6dvGPi1x7z1a*~nKCBij`5rT$L0^#W;#U*qHr{BP==LAvu%^$O!zS!HW zGHGpzb z8q)|e)Fd1^>5^Yg<6p?km*a7o5{kT?BO`)w6(1xTzpy2O(C)BmUzsuZ{J>&`+N3Tz zh+bSp3q_-#3~BTJSjySRd6s#>vCnlt>#_6YSGsrS$&|Ba&Lx<6bmzA$6U%qIpWC@e z?0#Hau>697j#-DbueyavRsu>QDVs&LYsd(*EJM13vJiQchW z0T*U5h;IQ8syRq8ej$6xR^8hnPK3d}?ha_w zO{z3g?cRUz_q_oK#mPu@6OidgK|zI~VEj1f_@NQR_1Q-?63rjUJb5BZK;Pm1 z6ZZTCRyFjL0wb!0J+5P4av|VCbA+YI637ysJek$X0<-qO302kUaO)b{s?82@_ph@6 z7{j#T%@q-~zXI8|5D7u_j@M6GoFbhJ=MDPTSfM4MpU=Q;6ty&B)bot1%!&8JY&}MR z&RcHG5t2qn>Po81GIIqWpJgJorl%GQp}<(~!3M zV*Q0oHRm}-s%Q1Y`*)BWQOJ-I((CSf+D|ReZ-z*m@e?7;DfA^qGc!Rg)!!KFoqX1Z z>2+4(JwIdJ*gDz};y0SGRW_lqLaF5}oT6KHbb{s9Y%C=PgCeVh!eiCeMF9F`ahu1! zv?6HmuBzp2E1#kUFr^M$?b)Z6bRV-}G??{0`@I0GKKv%sV8n}==scHa^?^ZCsba}) zzHL@ub3r~53^(ZXy5ANm)@_P{T$FCN_)FySp63fA7^=6r}_Zd-W4qW6K;Q_^?S2 ze`}?YI2uRYYQ8O7*5Nhji(1j)MNV@;koe}!@{>DA{v({-`y%28$VgA=(2!Im9yicW z`T-5N66Yj6aw~@F=Z!q1`JWLtiVB`XoQU?r@cbsSn%jQi6L zLh0f~%7~Kdbmu{ z^7ez^Eu4=)F%}HtV9qhO!-;LSS#c=2Bj)_bvs=My0P)7N+bJ7Pc&l_$+_t9X`bojN zGAAv-X0yJH2n2)BDOdH69Ctb0!cEi%7q5#t6RGG&oX&&#yp!X1hl5l|pWnKL{usX* zy$d)k#_hzfSZWTOR)y9IVRJ)>fI{E>Ei7dK6&dnzZAmKw$vvPdoM+jbFn9*UUM`o?VHCgaRtq&5eoP9 z#1dN888PZ@XsMce?{cgXUOZ#idriqMO0wuS#wu9%9#pCq;sn21VRGkP57Hi}opIN$ zr1(_+DPgM{MrK3>&vK>FHl^XgTAO5Yn_c?TP6@dZ+QAI*sk2iG>!S<4;!78>Y*DiZ zRo(&ZppqY=);dR0u|4Fz{2uDt&V2C#omijWVpz2I51DQRpLy#Ahl056>E=*CQN?d? z3g$k0Xt&7&0#&KbFij+vvLJkU0?d1{joYqyVmWO2?&p81l4`=6qik!;XwAaXLjwDU zVR=;()k|}ZYU>I21y3;j58OLWE~B6RW8WlQ3zM*9JZiJv2H8m~So{Fpb*Ky`Y;as_ z{vHYg6EOF&fZVjQ^LTld*1h40cYfq9#pPCTv>7msFMJ;HA@wsD;#4L$Pl^)2icRmn z2QNI)-P=V6xw&diQFK#!evE=ZzTc*E+5! z)K>^Q;{s**4+>2u2S5p-uISf3JwKt(3~Dk-m#YJEGgOuD1LOf2P3qtD+P01P%}uB* zk7irdu0KLeFcW-pmAz1SyzPjZPjhvsag)M9JPLQmB87((YeRe5s70~qP| zLBrUH-REnWl}~C)V7W;Yvdh03@WuF9-QeBT%dt5t>7R!69;Mg{KoP&BO`v8!CWAJ1S=#n& z8PMI4KP`G-d16KSP8?R9Jj9oFGL_1i8Zc~;rQ=#&Xh%7<*lCJb@CKYUc_>6kxh@=K zaCVQDLH_7_WmW?*Zl6Zpb{`5 zKBQUqx;eIV2A3`A9wqXv!zPE2?IzIQd(`r&lf_M3_3|vIeV(`RNsoNY>-pC&P*ndZ zK0B&n1{~wl;;qcp<4ToGZ7>0wJEavyet=7dgPuZCr=}aCvSu>}UWte%&vW-`GSry5CV1f75l99##7Eyu?sXcN+!V6 z@&UBGr#nDPAit*_;r*_^WTY=~i<+Qa#ajN25}_b7$3~h^tCN|Xc^)>Qe(~Ya5@=3t z!))ey_7MM|7RUq`%xAP$znN*(9x1O?h*KYL#&YOzVjGT%z~rtkpfDFD;T;Y^>%L3d z`aRw&O-d-n5Kcb05C1#X%GpA$JqRuAF+4>4^5uzF%#+`V(}vzi_`2M*_@M=50Y~-k zT@FG%-G>H#ZdmcG-|_8gyR^77Z#WPM%dTycaz_TWQ$`}gClvf|k{)4wPO8;#G>jD& z$|X+5G|1|E-*^rKXjcmxGFvAY8Op zM%?N)#&sH0m-%HqAeHi+QL5IQF)BU2fcHy_AzhS*dI!urni__jcMFK{x3!^bv=mQ{ z`#f^XRNpz?Ncuxh!kIT6lr1YKev5Yzg3xW-N_N|N(-wDgUCW^kw}E~V9-+h+`2x8? zv|uIew`c@O$F;j$lYQK#QXw9P?wRsJFLI8CIBo0+S)%4!IgL52Sa!sE`CTMGIpB*a zCuIwzBBsgT?fB(>rJpn~Z3E3q-Eo5fC4NBmq{f;Eu4~up*`09zt)ngzndk7Hp+o$Z zx_otex#h#_a~f z81iP)IM_F;^1hO}A|2+vt;=No^OspV!}E(=S>4knj`ud1%?^m&h4Y^*+pB*=7 zDzYX%5sVvyJuNEo&=XfKVtD6WK1K{5hm^ch`Oz>6p++&fVTW{kVAzYI3&b1kc*Mt_ z7HB_S!s021>gcjBaTaS13=dU5d2l$F)njFOKyi}#btpbCf2E)mYCUxu_dFsilFC9# z1jq))W_%-U_4?mRle{jZU}zIM0Yh}9@NEn&85d{v6UREfcHulvz2edvIty{rLr@p% zpgCU8M$tHX^ph5|-G;T5Zg~qcJkb`ltTlopR|WVW z&js3T{(B`%HKy%h7<0{G+428hxUC+v;!*U{ksEdQ2t!Gg9E>Z=0ZXG3iA*G50A?^KJEs~*$WJ3)NqNi#QC zcl+SuZ;+%Aw|k(6R<)2eeOOelXn_o7h@s<8e)}qSFRsi4;Hn5fq8<8L2FOtIOvfhJLV1sA)y?OZMyFms+sd^|_fbSoJ@+XOfvcG12ZwO<|j zdY|szzZg5>Fo2EocD9;os^glkk^Y#)qcw=3M5rbIY|40k-IBMi?(cnq-I%cSp6eSD zT!yD)2Y?l(0B;_+wIf_cnOPyIxNSQzKPGC_-Ckj0rvy%*<&z;|K=AXPH^C`|NKNDo274w7ms zht`uy=N+(O{!=~L3u7u0wDzHoT1{H?PkwreGtBsXJ>B}R7Y$sA9x z!xtyB+C!$Nsf%&V;Hl~Wr{!6I{#sTrVUeHdm&@%@%y*d=A!K=uQ{)iJ+ZN zRKtqhIV-o-w;v5b?7sSDOx_SlN3za|a<1RTUU#&4W?4n0(FW5s_0M1W6|uwGv;REK zD%9epP2b+Iy^C|TrsSS;f1q(}*t&M)zAfM}|6#u*h!c&r%|w2eBA-)4Q3v32Wb$LZ z0HgHm+B>VCF_Ia-VAR4u&y_r z=z~5{ZbkxvMOq=C?Zp2w3{>fd=UO-^`)rPY(4cdM_MKnHrDR}Rf3=2Q6}bWv^d~E*GR5W0AC?2@bcPgvzKlw+2j)ezQu#hR^Qk5YEKzfB#M_gE>a$KiL0Q()} zq1NTGTcH*0<#z_d%}4QJO&=MaT-`PUDEw`_)g6)74NlMAt=?GghdPGV*1NK(nZLXI zS}N4s=>s~#{B&SP2AoMj{1D>429_y_eZq{=Qr3(MyodZM#+M#>L@2aV=XO1inmph!eM(VZ_S6Q1d!VT?ja&-wG z`g~hDCWb(ne-)Af3Li0Ztv_}<;gj#KGdJEI6b%-+)_z-N&ox;1(I+fotS*zNH6Sgw zJK5WocldN$xMFM2RArc{cOt&^37}^~%L~_=O@*m3&b?^=m7X}@cy3+Diu2aPZhncfu zk<3Cvf%3&#*S4k$FB-W5yziXUi*Yhv6FvY=;(2G&7k_j$F<4fGNlYJ0bN2p+G<*PqP99gqoBhqrBPVYWln zZxPK$jqjoG-jCt=oJoUEZq9ZayKAH=vS`JvjiuMQu5y+n`6~8o3%?f{Z6Um)^rn_< zuF{b-?(a!rr>Kz(@n9zAVn3F{(l|ciwv&Z?s5Krg5jRqX;h2Z;Ud-Rn{e^NP<^&8! zHza6NJ^3WkWGE58(xK=Uyn-vkYVKOg<}*uZMV-&(KFQKHepn0`x&J+YQ+{)3E7C#_ zxG)XV0C`&rE(&DrMu+~*xmjQDf!}h?)u>H2%|r#z+O4QV{8plRDNG}5XNqJ;X)~5tMfQ%}cAnO%)&p30arpYMj`me;cMN9k(@IhL zGw)jhr?Td`6Pxa}7dnave2jEnypB!5zrztWcP0Z&l3hLLI8Tme*W~^ZmZ^QxGW5J> zV$`o_1+&5=>lW2U@0smG+hWYp{gwL+%t#aOl`^kAh~0GS*KJ)~{ks18s(gyq>8>PC zlv@Ma(Kj+Lie)gU#3>iaOYHckv?`C~)JGXlR>&$nB;T}*MO@ts=6v~$cE0viE+RL2 zcHXbuzDiLz@5l{b#D0;$gO-9_Xd?DR2KA!`!4oqq_7Po7k>>Ug+FCuaABcYTdY zAChc8JiSH;n}sfpO*iQ&i50&f@tmC%9t>&k`S{y!L+kWK*@uyP3=N<8$IbtY&s?-N zj4h{6!gQf4+~D~ngv?}%$d5J-z8J}^Ze^33C1@q~dvdcQ*|t|=V)kEaC1`PPV9=3|##xn!~?ceLe2AC1B#q{buhv;*AxjcyCVcd%h6Q6&cux$1OUw4(jqW z4Q%d6mqy|zsaTvD2SENpoYQxp)EjjELM*y+*A4o*Yf|S9Td=-Bvlig7yQR=!t6>8n z^FZJ13mGq@nG}R{7++WUuZ~EierzsZhy}027s6v4$2G7 znHDKB{f`+7NI^}7<$Gm)-@kwfTzkbT0@g_cK(t&L4C6%s)8=|qOo{zO2MI6-f^)FV zUTrepM?iCpk02gjQ43=PB=N++eQGC^&uNy8Uljlopt6VXiZOja~9F37{I2}q$z$ug)1W7|cdD#xF|W5EyDnH%ccZE#6>}M5T|5D0+maX_dn%>`vd;jD zqt{t;L`(+Xd&y0~>V%T1?0fF>d@Z5IMJQM_q<9?MGg$VkQt;nR%lB9vvh|xNKj0)o zRGaC{_2&~pAxt2XVvbMUh)M?)01iCiI1~Hv0B+Jr#?X3ZA;k+wkKJ*?qRilS+)~Lf z245bBw1o-31-QR+-rNq4fa))3r`N2gliV+PU{@V9_Fi?T`@;{#aSQ6&L}mgD-+sqZ zrub&Dc%D0RJROqb0hEG|rucka2#9=Isr3dHF*x$L&QxpJWYn(r^F!#=y5#=O)PL!D zz=6f9vv=)+zf|6Ja!EADxcKBos!{j@u1mxgwG$G^Hb6)6z8ovK6Hvni?X?Fd(PQwq znm==$0_)|UQAUQ{(77u!mYYLetb(c@dBL94PTqU(pVL@n0nf}Oi^A)p9zQ2j_TdSHXDpUXakisSes zzR-Y2KZ1$iwsS5wOFd{Nr&#l;-Ds`oo-8&&ZDNVMyOfxMRe_k*>Qg1<4>HtxYE}g^4lDA6^V2K+4 zy`U}}uUq;J!Sv$z#AEBao0jqqQRdS>Th~G8_)z;QNKDL3_IAgVonnu8B2_3G7X*lg z=mU1s9|DUDcMch3)E+5H{axRg6W9NAN_Jgx-cocd-V&BJ1*I*BK%Kfy{yP5KX0I83 z8;mG$_pmI~5=xM*J(7!XONjRv-E-aR`S=BJJ~DMsy;%LZ%8qI`{d${EpTk$I4E6o{ z8pnyN_m?ZHCAgjMMwePbdddu{9u5tN#Y&j&zv#KZ{V8rMq>IBB*Jw~{hVSK4{Avj* z9(ZThJn&wn0sEOMnbPCEj~-v#wm!I|P)AVkczU{rU-c;mZ(0Qd5yZO;_x;Wl^sspt~xvAa=pRYkO|f@8(FUHA=)M!yVZ zEWVHhybW2S6dqiPh+)n7(Dn4ohNmESo@g(xuB z7~dPiW_rrP9k6NpIo)%y`Ad#9xZUNQ(YWz;KhWO%rp1mXy8%75twhBRG=!e@StTj3qzF~2#Q8u$eva;USw2KizZ$>yi;^ zAnt&hx?C5-$j=2{nF_>Ix~t3AvRHph2g2`e_{R9*MkZsHE8h>U5T{fKad79T)7%nk zL8us!%fRv$%-kIAzj^3Ue7Y2$2_E_@j^8d6CsiS;ghVB)K5wa;d?UVUtGwaRv!?F4 zpeqs+PP$Z%s+f=l9-)wV@RRX)uygea1pq()?hq957YQJy&)^iKnlr&`7kGG512@yq zT0`?$6(fuK4_svIvXwe$WmK?@a>=~s!m>q5sme!cCLn->3T;G3J2qeKIAO_eoEOX~ zLkBhpt|LSz@1G&Tf`<}#dk+x40x0ibNEJ$ccelrNva00y$&V5`nnS{Wye4{MJs+`* z=~#^W@lSRe6w87a6st4F_%juU|`e55GSMlXSHzS>46HEQH4hkJn( zirUn_zhjrJ{}wl;EzC6%_@N4a#@K}T!U-99zo|Nj6dc*67blSz2Pwe*o=a~uweQsZ zXU!aZ>WgT_RE~o-VqH{A2^jy0BGIkx(WnAroyNis{qVbvw@{=)+`3lC|H)r)W_~I6 z1q4!5>3m&0sTFl9iU36M=P(J*RAifI{19DH;Zc44bA0j_7uoll5Nz>QA4f#bONYY1 znDC(u@xrTy-W4@sCVRozBZJ!u0*1gEim29t6R#d~pS*YCr$KV#eT}crh+4nm`>F7oxDt;#3fQ5+m6y8A8mubnaWiqO&J+ zi;FCs?n%O(5->4LKso30Sc&*xWeOG~a0@k703s#)Sf>NN4t)ADmCD2-GynS(s6XSF zc?+hllD7NMG)w-LD9m<(VlwwL5{cFiTbj>*S^(VocQyMX+!ylfsyY{RH6NoUjPR*> zzmBIZ)vX7P?0gsu|3SzFNkoAhzss7F3PJhKD@;-7%$*{2a=xz-WS_XwZBQwMlI`~$ z1?>w0MePU?ayRgOOIvF=wz zi_oIwgqK2~OTE<;o36pZA0`oci7&4$iXK?(tEN*o{de<@mrYtP*D)*ZL0 zy5Bc!7u9a)%49n=^kNq9$A2vSdP45Fanugps}bZgA~kHkDPD=AF1Lp*`$(z%aXWM= z@owgDAgYkN0zDIhqS^yOHMvwKhqJ;ckJPJKfuloLvgoD~SA73W2lJWAJFLUII2U>Q zwwYr!ZYFSViQK)KRE2m?|1T#%t{A}-Gh09RhwLwh?W=f7M0CWKo@KxnlqevhEmpmw1yEv9??!YfMg|t9eQQE4d~(YVr>_iIG+*h3BDr1$W~o!%au5>1 z3h@8R2G~S?*Cc%NTdrkHR2ypRvtrQpC~5sRX^;L}KYc8_$dufpW2v95h1sB>k?48E z(cYE6Y2q){NtaaPE%+SV*4!2A=(ufA8K-|A0DV0!;%#jF{NXSr@jSjZQ5>Q8b0@3k zNs>Zk$<&1ETrc8Lm0Ft63tSqG@n)o6s}m?~t7*S=o9bIBC2)LFh^qkPK0nm3MYnTZ zDn>z@#*#n_)hcJTOI(8YzP>TG@97XOd+KPjk6X1`@K_haJT(1Hb4q>jr_uK?0qeU8 zwU{K@2z$uP?R2H zL?aBS(@j8X)1+~$o?DA9d_)8z{7eBSLhVz2y;OhqSmyVe=2qnGG%s-1Jl6x@0-fpQ zXu`-n!&ALNMXusP0H8X5_`d*G${_bI6#%(vhGzFCu$q9#^Dd&EqCHePSZA~oI#^yg?siBOX z*KDO3Ui)q1KjpAWTN%{qij=Ix&BFI>369gw0w5Q^wVrj1vbR_Bq>d?sp&#Twm9NHoWCk{*@@aA8Sxl3YkLt`GhEN7+AjCoCD(yiygVokb z$k+e@f3!^g$2{V6g>qnjX$yXGA3f7-6vgbw(ug>IW$JuEd66jnW12MV)eDhR1IZpJ zw{W^e7Y*Q7tY~%6##--609);*mESlu$Guw70L|n_{{bdFSRwBW3udjQ1AH;ROF5RJ zrm;{j>lnE8gvzo#qz~oe?z&D!cA6A%@-yZAGK=xPlmRxIAJ+?wYjim>j+% zjkP^YJ~3fjS_~-3xaRmZ>Bvqp)4iB~PzV*oSWo%XtvWc3Y?xUSq8KCZ7bc8a?sQk- zBo>9%MypTi$j%)|@zxOZ&FBSw6vU|P&xLn91-Boa@v<-5paEWphDX;%Ou44CA-Xi8 z?-y(lmuz??H%SE$b-|0blzTptmO_jtIuMj@+M-L3ip+*y-~9X?OrPYqjjWZbof~2KQEn}R}=7O*eDsk!8p!1ydH$_ZAYUk6m zdT8LIjpBem7WEtt;n)jndIkqZ=BF1sALM0BUte?ZtlB?f0zTU5tyKhn&0eN_nNzs6 z>HJe#8vXof?3>LA-|p|khz5~a^&>2jZ-JN+NxaxAP(aJ>{rRFRl2*-8N?LHw+sZ&O(gu7sxMK}F@2=^({g@S zcPCzW6-qS<)5z~$_e&K`A^q)@?C#jcHlFdV(hCWuqK_Xm5=dkAe79UclBK>o5YeL* zuJAGmpZ92F4xS;e^S;7@|I^n}^v8{$Ie z>5T#az`R}`4usP12{OtWBN@i7XO#vq9tBBuzvd?QR}~^M3JxxOBk=9_o7c8T)tYT0 z)i*|}$PVC94<^F@)5}%AMfE-Z1q7rUfhBYarCGWJ#3dv|K?KRAyHi<8S`eg{4i^Lj zq&t>ea9NR%loDwKWC`ideLvs-;d`I^$PjBo;0q@g><&J0PT^?)gG^66u|GP_D!^lH~5E3ddhc1h5w+Z5r0+3^#YL z{ay$9WtJ1ju?K;4rWnYB!RVc+M5<2`Ec_h|%yiGyz{9q5!;GBUY4je`F$Y{gnITXI zq~j0H$37kcgBW!p0x;G?F1rNW#oI;B^zFwo7teVcz}2dEy04H4WMRY^G}R#-4?3h( zfaEJvt)Q+Bd*OA`zdBUj=9AmiY`r;VG?Eab4kf73tb_igQgIjYb#?50RR@Emb7$kM zHA8#qtByndj@l1C-nSuyCwDKN>?9Db@okO-{z)7(W>SGM34e0hRq@cA zU&5yNw3ZyLnsi^r&yvkd(Hx|W;hI3ffa2mV-jt4w?)k8PB7mwLw_uUb7KG!mc_|4D z=v4_DAk5wu1o<<|Gh=O`NNaB$Sh|B)y6THi%tT%YF7$KO-|s6eRC!cCfi0=NkUvx< zoRgK9kRk_6>*+I30;!-ZM{t_KD zKDmF_VmKzdb)rC5jG!hCD1TYBtTlqjpJs9B)JcAb-F4$h9f0cxEb71TS=ml+5p}TF zK_wZ2qz?nF@dtL{t0$_GO`WKC;fHR^G4B6htIBpuM999Nh>J8A$WOo00KGr!gp0K6x`(H=tc=-ZS&L}x{ zI-sICYO@i0y>6$v?BT&;(m2=uq3pH}$kkQXdmC+A4A^V!tq(@lIAn_H=z1rz#Y z`i+Z;maF?-L+P?q{B8u93bFBjGi&(0gngT+_q0pJa>w!_AH!^sn$qz~R|6p^#$VB3 zRddskgt*dZACN%*++?Y6Ch?tVLfQKN(>du5u&>BN1d?o(lJdrods;m7hwU=aFBjaM zpGn$XHk92xzUL))D__KS7p=<9svDq6O*fWiXUL>b{M_+8{z|b~M)F7sh=y@7g0j0t zMcV1TKEh#psu;Y!wS%Pe7}o>3=VOxmwcN}a789LKzS;vmIJdy39#VJf?oA~b7IMjm znpW~3s)4AY5~qU{k)}qZJ%=g~ar8H1O72$+xFKu(WQQf$nsed*c>HB3R$W+X+9lL% zrIyFb&Rr_`PE8`&ndl62I^%dqj*U2ffX?F9ihj7@65v+ z<}=6MPMfTcWI^wg-A9@tN{f_(wg@{ zyZJ%;KXHcVUd6NQZ|Kj#Nl%7I-6^Zi+v4se_sEjf^!_2Ex@zpdSz7GWm^I7@V87`K zD!`6pnTj{xC4r{f3AVMp9CLPY88b8|*Q8A$E9X<$V-hegHZ;j(+o6KF3>5!XrKOG1 zArX82;H6-bh2tOR=|jR6M*0*ou}q0+iH)|?kP8g0TAmMhJy$MsX=4e$D>2IDuz0n5 z)wPe$_E@{P421N!N_+HC(N0A&kY2TI&m#*ua&LlVk5vy6cE z)XR0=U5?9|RlS*kjQ1e?*8?c^{`71KsgYi_#}lRViN-32B%2m^(P;f6m9O|$ zMGzHKd7cT6Vh*-ja|SInkBK=kf(n<@Gl8hKJ-3s&s@#HKvDjQ&7mZ3hQW?i@B}797 zh+x@?jh+aR9-V5mv=tW9grNzpd-LjvR5{2I9%GPneGygVaLUr>!hEg>zJ&@dsP??Y z0lqtK_H=|7De|4WAAahdL}P9+kcRp?dB3U0ZvfZs5VT8CX?3MqFly_=-t5y+CS2MV z0n6_H+bUN|E^}J}VXYWq*m#({R%8yMawm%Dni%VvHO9lckXvRM48yik6ZFY;;-UD_ zr9O-?zHojqq&)G&4e{o;3%yLfpM|9Kj}V#}Jbu78iaU3m5pGlZd@11^CCJ?$1-w>RygKA}3ZeyI+rba$Dcd5j7-hRbHzir2&AKR9IV z|4TkH4S47W`$CixIe5lrphZ^$pSlZH*N#XHeN1$vo+6D^2iC-Xqq+EzJw;_OTKNS|=XZ(I)FUT(RCy}qDi zolNaRLDDv}=@5oMzb>TlkezNN$Ml$<8p`6|l(!HRlUs1J?g72Y!A30wt{oZieMV+a z(!Sr;-J4?aFkOjxd}?zxfq)9T$4dQii#*~}L9M@@@|J{Zw4rfJ#v#l97Ku$u_i`!# z5p5<(3y0mZ+B^h)HFS~nb+5%gx!}}bAoG^jGDelY20-juyo}=tyqy{x?|xlOsM6y4 zJ5jE=Dp(lFeP%u0HOdfoieOHoNdo9}=Emc{KJbn)8c;C>-L=yhTQWs5}c z3A0ey#(%d`ITVagv>tup zF8h-e{E#DXO%*!T>np7hze?+OMEJzEmDigSlkx=NLIImqh{miMb!6UaJWaP81B1>u zm`B1Fk7bMl^@>_1Oii}p)GN|6VlOj>%`#HUC7S^CS={I3{Ws0+yY3YZeJKNd=r}p8 z1PatUF-e!3Cym4C|IhOl>9g6wrzQi)eS%?(<_tQOO{}T3m#9U z*USlg!3C96o0L&Mi+A0!R6sOmsO%mtBu>r zg4XTFFO_7qnkn%VoVW#|H-g`&$@a6jsRIL+B2Ct9y{v5UTZ!CIF)yu6K%UT6h ztssOQRNBerL7um?(hO#kaws=@VJCwP47GIGa{27+hS{H9E4K5W9royepD&N%2i7X> z#51|qTVRutn%OhC`+sf4)#M+{{3MN72!beeZ7pnt>b~Tcaw2?lEA`#XQvIHH!Yt8m zHxhV4kurUWXfXqE$ytJfM1pNSvECt(xN*Bn5Mr~*d5stMm^kbO5CPiX$ULbDT*wFf zB2_zTN|=ng)tv~#qdtxEm&SJ-k_PpX`1d8o1#wnuS&#cl{?<}k0I;AZvb{)%Zn#8Y`J zl%2_9SI+l@s2=2Fp((m|T(>BUDGS&*g9em$?E`w$L6Ff*a!`48aOaMt$Fd0Au&6~^ zrhhww`49bv=;c?~Vc&PK6@yFAAQ8rWPEP&^E_Fyhc3aS}@ykWZk3_FM5nm*&$`H%b zq^9ph2E-+axIj)lyYYW&oEPCYUXP2yg-3t-Rgyc!f#yga82a-ZZ;r^7U(YK5H*TBB zNze@&$@K((ifGjvD<N)Ip@~{2)oU(OD(z-NZkBsWt4v{-%yXR!*4i zfVE8`c5AF`kz}ZD2r#%#w(Z~6kc72ogYml^-sgg;hMKx49sv-F?_p2|dLukh)r&gX zF!{D%AF%^9EMwAE1fwZ!im2wYuRSr}UK4H91SF~q{!B8(vcw6puoP-q@RJjsQ-$Fo zP;cv|4t4mR@qPY5BeI*Al0Pb5@=ij0YlqPc;$jQT@~ZLQ85 z&W~BY^sboo2M?21{t3E2Q?M+zW8*6k*)^4_Az4~9ac#e=67LoGNK)(b$1Z}y%aRD7 zv4U0q5t-iAprWggkt>+%^7Wbo!|M+ zWd&ZBfJRO7zuL3l?8x5b&uf1*R#If=S~|&}lu`ejRy>q4=J~+SP4A{e)T`=7O~^xl zc?a}xMXYnBhWbv*5?om4obzKV<)g8@V9>fU0=zrN#Pz0fyfyB{JM~9Sw=XWHXyC16 zn}W<>DD`KE)ttF5#qE(ZCGJ+CtZ|D|J(H2fc?{_(>pK|&+HyOm%qx<~gdd6`qkb&+qrxr`2abMX?P=4WT#u5l@HA8jrJjYPHsR^@Rbt74}UISsC;m zK}ff8CA4OoYT`~}p?IO3F@A*MgCBb@O zB{co)cjTk6n$_=IxNq@6E_0`I4s1%*^gYvs@$xPl?S`u8Kk${8F&&_&^7ZdOJ`05e>UmMIUweP8l z6%b9O(J!sE9mRZrh^uRPXZ_cL3tPl!*n-*xq*^Hr0M4SNXLEWxo#gmEI>EL1KRis|n zteI8^k#9`zQFQNlOu5%oukA8)eeIp}q1*s^nrPar%HRSu>!_Go+SnYrkduc-B+~m+ zfFj=)i87XIQxLn1Hz3dv$kjlvEL?axhe=qy;`Y@D}3V>kwHkPNnpE)py@77Jv ze_6eHzWN>f^4>GyVYI^tHd(+;RC(m|TF%xSAA-ZjUuKhol8JZsO;0t9eTWV+ODrY; zJ~5C6`E7nQSo$#Ip!(z01nL{maa5!)BZ3G|UO9Gz~Tv)lMc6yHm+}8cJJZ@5o2?SBwwQsI(+yAsvgGi$fphVZl z6ED!_Rg;GgXx>sJimV(&%RlBr99y&l z>f2I%z4ERGZMH12{(4Plk4V-X%B3u) z&Ou(U8in4kVYVkK@KV-j>JPpgWgA55-EXItvAn{Pil=|oL(w_0)4xKQS|Zfq3y{H| zddyskx+iy3NnXn1qr&EY3r7dL0M~cRFLkWVWR5dw>7k0GPB*#h zZnN)HXwwrfNbljEO2ef94(FE>Q{KMTEo z)6}=D5GEL|Y&H_mz!LKmQ_?3Jsbwa+`3hT^S1_$7yvL-BP6`*bO=!he)b{jScf(); z8UQ87%(TLRRt(%BY}OU%0^Om)52(bfj<3i@hU{1>*JMOeA*m4SyO0b#4ohh1Q@PMC zrF2v^5F8czA|8ll`NILjJEt*-fckJ@H1-ajV^9T*9{`OM^vYhHj*aX5i@=Q=-7CWX7X5th zkay?3ZgZ7X239DS^u;!;2sA54sx%tk$wLvHmi3qSQ_*6xuCfeP`P`Yz~FT2hU<0Ux( z2T-}owC72jhn$!YDuh{mjJj4VN`-e*Q&J~kxMpyVEu`>_$=g7B9fwhiFY~>5D|0Iv zi|)Xw4uyM|_WjATS$6@mjEDpz0zFZhHv_ QuCalhs6B;MtHR&@4->{}!Tor6D}Ovw%M_5+crBLYsa?JamVIP$LiR4@``LpMR9EO!VqWbF92CR7x5uBq*X1^>&+nTKt$8vhDl*O@lJTL9nTvv3pgScu$Nuo3F0rNJrSf}dsl2ft}fKmzUGK!zv?zLJ5x9i zV@i5~y}nN-ceEx?#y1Qzh4`Nh3=wrdHH~41@m(3U2KjJQx^&+PlgVoIK9l4O!wTSU z;>e?1WyL7UA7P8?ld^cr4|3zK>YP-_j^&i*Jj8?k2}!IY75==QGvi7@-Jg)%`Y(Mv zSUbWyzvHm(=_Z|0$ z{6|G&g4|P)JE6%hY^*y@i!e8Y2^A=UU}ARSG)DUdq#72B&lS5KmtP`=DaNwfdkjkOU@eoS9TZ%^qeJUbFgro9jNd?$oPUZtMj90(Yl+}w zUHA+M{nr$}H=v>KuRo;pAyTsMxg~5nt7rImsz9+p5mFx7>;Vh?I>_)%&PbZWGUW&8 z`~0HlhlOCfq4~9l1PAMqC#MNXhlrH+1idD9bfm^kPG#d|fM(R$gG6Ncw2mTpBPXX4 zCjf%Rk<^Nj?XtqVvec& zdGqsU0P$9kX2A2!P-3S+kHJk?W>%05Q^Ad_nro(bHxhqw%HyrOz(tDNg)teU(vY~0 zj!gX6e3uZ0y~*W9ll*^0Ji)yjO-QSbvb%6 z&r8LvjRK-!&lT;DK{nJ33@;>8sJayRyo29rf3?~(mK0g0JqHh^6wt;8N-;y7 z9U>zgQ?0PQSJTjGk%uX*Y^GF;=al~kYn~f2_VY%MVOvYdMj%K7mWA#8tShBt5_=nt za-Wj{zpRPBP2hb3Eu`j$U8DYj?7pGfUxSMj4ddpJy!jtX2t{M1cBD?z zpk{a!h|G{+2(SgSRqoS~T-x*n47bMI7i>NHYxWo;@P=PNzf`+0yWNYfvd%p5dkKa+ z7&S{XM}*-a6$9F)CynNn%PuXGlXlA%I%cK>^2B*O@AP4Q_mCDl#Q&9}@h=;+ioQs!g1*+I^+@K?w(I^h@}6-k*J-2%moBbjuI+aeqZRw6glt4fa1XrcTp>99SMn2 zX(NjIj@KYJ=Ek{Z0Fs8#S(zWSXpzRDZPFLhZd78p>5H!qxG9d>E>FRScNM!|B1iBs zD+PPtpwnlJsMxyR3K)Ao;G;mX6qSzce>t0YN5D!vn2Czp@^-+2uSn_aav%ax=Cq$s>B?zf3{*d3DzLVvS+>M%X={5K zR$+GQb|mwsip`zO;82RIs)@6N(I}N@(MQ3odZe0R4gzl8Oz82R?S0AfK3(}BW!%vL zpDRv|DwMl&`F@G>qJdJ!f#t!GjhCBWFJYGRC@~!mixepsp0;sg>AFZJi!02wB&Zso zP~=Y_LZ(cA`FM&fal|xxeroG9^-PVL!Rsyxs!OfMk~NqF+|W7G#ph1$=R`JnQQ??4 z#yR8AdpWtKyGr#0P9kBlv+H_7Z;8(v?Ui%#Ka&((l3f4tDTw}_!(V}jjSayN7l$>c z0WFcPj=+Ous-G8o7X+_w8kQM+{hQ0UnC9qBaB@&ZEv{X?-y<)sG!~=C4$hDv1}nK_ zWRPUG^vZb75;I1I9YWZ($)H=gjo(}!w)@8)8R6NH$u9oqQz|`-ufsX1+GSUyiXuXR zfchrPkxcbU{Lo7Tuppt2!TF#|Jja!bb3_}Pq9(082+xZxVPNPCB|<5ZrnZ~6Q|h}H z7x;F?SmvZAiaTA>?^HS5ax083jK0#=*epOmCSmt&0M%iB9sB2hy50HoGDDlKiP)Yw zWe6|dF`DGY*ySecOTNX0&2cZ9WAKnjCPw9oP>a=Jb|x)vNAU($Pu{vV`C79k8#P=x z0#_@q-dzAj*nu&lhh;e+lVKo zeMlA;jAlpS9t!zawlO=qp5A29>5x|hNGVxIV5!{p#1Eo47#7*n&oG2 z`2>dDaat<1@jbO}hL+@+Q7Y?x`v`*ZeB54}g&*hY70CFLGzHXR|3u}VY?1dOOn$o> z+)w7}4enD@`hx;1^4(q)Yn!0W`3hAtF3+16LSWK*YzCiTyRpCx*?l+0OONCp&#(3B`{Tt)8ZhvvH*)T3fGu7y1>71uLt{;6Cht&Bf?YOL~;p zMylTgR8<-h{v?1LIk=C{BSDm?>Voa5>U($Ja zc;fqxyHod-S(`h=hW(nwIsCIptk8uaC8_A96*P_}m?HUkVNI~C`+kunPq!ip-gW-A zJJVR{Irp`eOHR@73$=vfzq)pCqc;=dq5V4<$v%E)=dLe%kLmXkea!k-euXR&x7CF= z830Hpsg#vH+bTWMg6BXtcEc`JbAdO3A5MvOX=(QGvZ5r)%&v9|`vAcsY3H6*e@ik7 zZ~7LpZ%&;tpz6z=2(Ho6|Q|zSwB}K;D5GR##&J#lbca_LhF~g&*ht)bM#Z$-DRHqAKDIFezvu zWo+&1F)3`D!J@tppBWV&cMdxlzXe2oPAY5M@6o;iE7wIi#7DrP@Vmkn;HX zB%){5!s_f-wbbxtsksCdYrC8oE0qL((7sJPW8^mGUzF$#Ep)j$_mH!g&7`SE`o%oo zpv68ONTMqbwl=h`A#9TSL`16G{+ge)mM$L;}4Ye6L`$8(}B09ULF zOKa&uHQefary&mo0!70QmaX7mMxnysxa%PvZJoOCU+BhO&{B_Lyysv{YUz^p%8tsp z_8rUYq`C2$KhsH$DOtGPB-;mefp$0s`cG&#SoWSP(=;EiF02AG2hAf0&3^976(#T$ za8Sg0jo1EW2mPR|)%JITZbh=v$T$N808$Ed|)g#5vlPCdY$+c5Zw6$*IHF>~|S%j7#EIwOVtnrA+Y!>DIDmc@_^5f1DD~ zYQe{4=oE$~F|UtjXyQ(FTGK^)+aY8dnH%(KEwkG75*Av>Rmz@UB(r|!)1z##prwC5 zNA*GKzB&mf*={GE1vD-L2BMF^Icas11?a{@C)8@Qf-ATR4V?3l;vu{Oh_#uc{TZn7 zeNI(HxRgMo^%j=0bPs=PAu@L#5?>$3kF?Qm^MEz@@4>zcu>~52{6!$I7M{LG+|`CS z6|oP_P@gbpHqqJmjY8@7tH@igaK#OaNAiHA>&mt-J=jjAd_jw|0oI4@>)70Rz=735 za#XTnAhIAq>|O`!wy-5tnL$4>fkaZdIjb0gPH5U2?E6h&Fe1HyfH3z*ucnZo!%>P3 zcI{MX=(E4-osLMJ=SJ44-=#s`Q)#aH{_Q0H*&*^p_tUpjwr=AaZ^&B5^Ae$D-u=-u zy68{66dXR|rH06iQ6xi+8YIER<*2$J6u^!7!<2DPJn%nucVQD>cY*wGAVG&uiz&~X zJLtaOt8_l2bSQzHq?ajV)upeX;$upo;AX{hkojf%2hwkknF%1om2$jEma&ShSv7zn z!d%A)-Km%pdzrDXc?W^zhuxHu6|56-Um!n3)xx>S3e~8h4;g31fDn6vvdx>=;`B%9 z?Qq`?ym-x&V~`*hzSdtWKuhTumk-|uF|%hKJG$_K_RW$K z0}}ejdQ8#m8Ia0*sk-ZsZD%|lzxo3%y?SZTk4+T^oII5~UhLKlJ!HPt3+lYE+Hj?p zVGO+sSJQPQUUi3x3c8zQdMO2FlVbhY@X00t>0^1j!uW$BmXmr`yB>Bg$cITu21p6V z^5tvvb&^)9M(q;)joJ@Fwr~ z`@!}w3Ga$VHcCo1q*9S$TU?VRt7_dKcFS{6_afG~<(ZU^Z>Df0ej1>HiR7>jj3*S2 zh;y!#7XzsEE|_KoyC-V#KIRmE!i zuPR%^$wYj0(mz60qo977W_2mafMFTQF=34(wvMW;w%%u5!FC)yi`7ENig8o9ZqH#4 z9IQ0qw#-TVO6CrG0qjc(=sa62`}VNQVcPkGbR$*%;HxnuA{{^%!iAYO4;Z{!b7WTF z>zs1mhrPT~Zl#N}C5bI}C?gnt3EDZ_S-kAa!Ch!?0v2wjW%Q7SYAs{3C#}zGD!S{2 zPhR6XUi7`;-Eai6C6GVtYIqsD<3?U<&Q57?tnhNGQHF)?EsTwAy2{EC6+9O2hT(l) z#k&0yU-C*55+$VDAPS=jf^(k0fyh24UtJ|-6@zhr5hY>pHdrklkd8~6Z%_ug-+ z1^O1rh`x{c*H!%dhH9>fQG5EU>lY>zCg)GvL&V}c;fu!k|B^ce=WC}FW_2Bk&LD+n zrFdCwp!YWQo(j}N%^s|b+#`82^d-|SN;1CO zku@QQ_X9??1r$FvCQ=B-ctEk`AK_w#2sPo;WdXB*ByO2G&G8yrxw6u5<6^gm$`fVr zk~buL@t{{{lIBHigmcKUV++x}o%bj5^!0gxuDLu!){u05zE2qNSYOThqA2&2(pMx= z3Jgt&H*}U}#c=f1SSZ@Lx31J2?f&!#&YNmwOYDUV+0(dBq3X)EgDLS!#PVA#5O!-5Hdz=TC2;Xwf zz{@CmiveA-Yu29~PhXuhA~wedI*mQ>6inVL3i26_o=6=6|K zl>9z9nYDP*8V@{5z9)JF{;Z35+;nbI6CN9g#WXIY&#ytyZ3nRFPqCkddx=zOyXh)! zHfn2e-f)i`VDOn`Le-4+M+wD2xiV?Tu~rXBcF6D!`}XP&#Tk(pIOpqq1FJy;s-O<0*;DMHNFhvfVSlaj^Se z?rP%wI}9|}h24gWR=xQ1I9Nv*=(rX0(bFg0bAVbj6WAVGXJ6}lzFStHQyb&`7c*&r zFm|EvWG@1g0n_@j7@%Ddw}pREat>&sI9?Px_3M~Gk<qgOb8v-I4R*7hQAEn*Ra6);RX>D|tO#PYOX`LVr!zOUjOv?=jHr^Tq7S zOBZlFE2+mLNZpvT5$^+&5+lx>U>7e*<8udp=qu-ep~~W>bj1wsx9<8K1?m9#pQ5#J zM1fnc!12s%cm<;2`?wHTQ}yhYsBfGb!^6!e_X`;NpD8> zkx%C&BRd>y4t&)?I}B@9-)_KtdEww zs#-jCkXAw##u~o5icb8B8T`U~Fd6+%j4X7g7slm^k1v&r69OQO)e(8KQP91Mcu=e% z9T`COl0zmLit#+rV*CZik!v6!%y^3Bm*_@a8oQ#P-M(VsF5+WwpV=mbG1HggCbYwa zEQ;m3De%Xwc-e0=-g8qG+?J;ACsyuKJ8Hy%!As_ z7Hr3Y(u(NXnv&n@N|g=`n8cLk{#!;}dewz(v=MoE{J?t56&rhhmip**kSXeQ$Nq1O zRkAkE%st5g?^_{e2!oQY=bZCC2>a!K zQQ)oOB6=TbG?X;z;*J>pespl8-_k4QWvjoySt1|zHaEu*)#8h;EN8m{fBD)Y%h+(j zdzc1wMAl<+`mLcQVO9ft%#q56q<{h(dm|Ndq5eIB1)vN8Py#Kkkj^*56q zlu-vYQ7Vp$qeiQTK`!b?h^xU5Bm!d{1ycIsB54WQqv^+!Nlh3qp}30|wWmjY{owsz zC7_3w@6!CQ?HJBHgIj#|342$_x^5*#3w%==lRt1tbJfg;0ELvEdv8r;Gx!cZd7JV6 z4G(DM=!sUzD*tSfKjtE9C^Xc=AtQ>5?T8fTAf)6Npm?xk?TBQ(qgUFhA2+5i{1;$Z zwtde24OJRnklP}hm|S*bMhc}c(?R7)V?t?%;w58kcjSN`&E#L7k11-N+P`yt?E5Pz zN87O@c{ycY{gx|~>$_UQogJGMi62^k6*)}Sg;C59NgNXEJs$rYYXe)q0`NTaX)$t+Hyy;A}nWS9$CzC#qxsN(3*3LW$z_b@HD#|=$^Sgd>3wS4_yivC z+rzj9X4NEHigqT(lvzSpT)ex;2JA0W_hsdo^km9GlbFy za$62K!O}H-fbabQbrhC6;db@;h72v%N!%3%bf=5cB}v&L8nn{U3AQT^%wvkDI#FkT zlUob;NUC-*MiOAkuXD($QY6qOU6{h;2t$Z-`ws~z^PGwvDA?IHJ*>5n?PD*r=hCO} z)}nIvHnE}5eX1jOqozg=cpNHw%w#q8tw6MQI%MpQ<#zv6mockbPoW@5N}a~lqbN_O zxi#nn4yTuq?L>)KO}rn}>A-M@ds2>ty1Yk7iFJf0e%@MncE6+Y+_#cMhEk##zmmd% z0}))35b2~+)urqb5!dYx1a-IgO<4K>RU0ZnjGCWjOe_(>L|6f z@m~D4=G*dP1AH)DF@EV-STVcp0F6toeu4ji*#Of$f<0t-(n^8EtI!Os&l%j;rD$*L z(e28=J>w!l1EUs=UQs#Mo<{UjBB8ynZSVO#_zo7Xos`rGI%g(Rs5kE9vg#>ktME?> zwD)H4fxeEms#)WQd>>7!HS19CBEs(dd!EnGcSM)Et;+m>e|#hzhq|NfJ=$8L&N>Vc z+~FZ5#lUX`C9Z$Ly?A9bT~5(1teEJ3ozMepf_B4@%{650AQ*?$w(_1u`*@vatd|t% z8~u-wQEbzOu|{HboZSzQ8HgYcPmF$IAr(jsc(9AWPr4Iyf;FN*w`zFUONj!pgmGRi zg+===zJS=GMDsblDTq?^3}?<06j`MgT8x%RE1E%#sAzhho4v_X(MRUx&&%?Yd?zk8 z_>kObuBT)%i+}Lm=BiI}u1Jth0}O7|Fa>hzONwGy1!xg9UnN5wl>}%Pfc_*4gVSg|sMU_2_PGU7pQ>G_}3H(B9qcDCY zjjREN20-xcPyOf@Tai>X+xGqhE{wh@2a_PW$JIWvk$(pXNe7j95_X9g2eDFM+(~bo zqKpyxT)>j~55eo-j)BX-`(PQR;Vb6cyZu?WrwuWSr};`?4lbsMyh}@>4@DTnlq4ud zfbYG|38)M8FX4$kIbGaXLv(MWN`g73Xk<&zChgdy7kPBH%`nYY~1_4(}D^|^rui&o1rV%ctn8AZAyYecPusbkXW4VsO-!uYB8XHj)dxTBw zx{mL~)a3xak0DT`#2$%NN5f!iS*qTu`Eglj?RKlM2o6PfL)5ZOXHXrWE4?8PV|9{t zi?RY>z)`l&&L}mPgAySboIbq1`M{R1{^mcj#mCKD{fAt|j4>|>4=rHOWlg1%Y(_uT zm0OWHlfo(22RY$QFM{(&P1P;lEzZoshlKUDip;C77LO(VtJxhM4BAhvg-R&3oNF2$t?<>RY|r!ogE96z%^kq^l|8;^q2Vy`w6Zo>$fFFwQ} z`>Vff@574i`}`Zut1h(ho+iN|fO$^*tq!BXFWX=XxFMABnQYPDE^IZBM)}O&sHbjr5a6O{TNH3V` zyFEVQ*>LiYlpqsPkfHSg|5{rkz5c_HL|Aqfjt#R)@yan%t|W=wd40KzmWF>xE&-rKO#b<EpQKqvrLLtY0e%Yc;);VbxP<7kt zxKY}0$JVBfZ!WYPk9e#s{vmkXG{6djbIq8GToQF~Fei{<$aB4^#v#cq+bUx&6dhM4 zbD4cZE=`)QBACN1Ff$o&mp`>I@KxrD<{LW@v8NDkXb1j6xpBSko$P18>uQu*_U?30Hb{mum@b;* z&jEOqIa@}dj=x!B#vwl;TU=wrz2SYxmd#uLGs0T@ z)kjGhr{PdJzY~73~CWv!lO2E z`Q-p+*}nUk!SO$ZiQ>6d36yl(EGP7(HbDjv^sz?vX=Yo|cqb#C z$na&!hGysK!42V*B-#e+)S3|oJ{9mqJq*s7E}9F}=R-?7-gaU{yqxXZ zL<7qL>fx=1NhE)1PsMp4m4vA5z0vuVG;%^U>WdT9MQUGr%VLrods(g(SyWa2xHR2DUE+X*POn_YT&y%m;Z3(6XfDgNHBzO1i=mNd|B1^5fTs(EYQDRxw&K(}Yu3MZbx1qtmCN0P;3 z8E)}C{~@h9Q@Dmvz1V&~=B@O;{ceC@_;#Y?ONeHoJDqWm4O~0#m+&0np~BR zxKU1r%1q{QlcydBAFT|!n`-?wF?SO4`%dg{x;g_Qoo(h_-}2nmk3~?J9%)0;pFpv- ze~^r1)#e@U0v`UZ1HO|#=_AQ2Lb zB`AX-Xu)F7J=L5nJbZFxq3R6I&A)3Lkf*_pB(aJlc|iH>D7LGOqhVisSwybQSRK8G zdF}iPmS=p^x)Gp;{M!vv{Bcw^_2l3I10~6e;}UPdaKJM}fsM!d+A&6w>}od2AdAsP zjT-{YWhesi{+445ppo;hY;Z>+piy;stTTu8$kl~!pqI7m+!C~@XEG%pQQT9lumwb( zRGo_zs_!9`s_)b>6+}Cle3cl?t{1{D{&t~~yvJj(s6|jCtBj7t7Y3u#Ghr+1hDEU5 z(Z+uOBI{?;()XlO9Dg!=1LfuvV0lwA3#D1b9ps7zs&_Q?849srQg>MJ*osb;KJLU9 zSLIjx7lz>t}t8>_t&N7qKVsE>g|d31xR9d>gi=}A&AIyHwUIk>*fQ5 zChn}OenjZ?f{c;srVH-&WRG~TdCY(E1F$7m8qg9K>1-SJonL>boS1GIw1we`b<&l} zK;wTgc+RMamZW5qIr6TfYkf+i6CUh(B61tr1gN81t%7THJZOa1|7xRc%TPBXahieJ=O(?jTs)IRx)Z7`vKXNss zB=W9tA_JqVj>fV=5a2$%7@ewfm?oE_3RG{pnc5J??&}{RC@4CDPz{aJ=cS;9Z*%2N zkVf?}Ys}6<%0p_1Y1$kmQKMbyIDd6LuHa~~0PeSkd&~s;5KSBj#v+O!Q(d|PBz;T) zHb@e#?`I`d@Nhmyv2rIUqbEYL(!b$Q)>StWu#o=Qy30HoqZ+lA)qs>YAIq_G=SHHM zYE_a>83yKJHMI+AsA!Ks@BI6Wg0HUv@7^;Oi^?A6vDTJ`2w!lraaxHplE=m2eOa$E z6(>)MY#C)GKi4Sq8Kh6}at^$dfuWNL#PGKco9PV-I&Q6}w>ezx8h^#Y55r7e@OrUL z4++hku>`G#*A@?E(7Up)ukaPetL*;b5U7whx%v~|9dK6JD${_NpwmMjLi+0ubKi6Q zt9rS)R4uU$VIX%gNR^7dPL4s5L)7YVVBOJ{v7BhBO&0w0w^`-HR!d)WXPrde#AgZK zdh{)+%1vPA{Et1@wE}htN&=3;f^Pm_93~3_gL&?NzNK2z5r0I9G30$?Spwzginv2YK-J9eE`+ zV)Gl4#MK&OQhE5pc-WPlPG!oqOGCY-o%?nlqP*NO`E6lQfA(ITO?EqeOt#|fXbe$? z5$jT-z33Xh-#NA6HN5{AbLh@jJgF7J?P7o2+U2veKpbAYM26yz* zeZITz|H9+$AKs|*D@^5aDVKefA|M(70M$z^G^weD?@#IxtKl3<^Og37knTOP*E-;e zYrgX7&A_6Ho)Gnf0@fcbYJDyBYPDAvj{+4v!x6xtB zDmoTf1j&hSdXL0s^pqHqgIi5&3A21ptsN<{(cbL6qT~s`ufivhpr3xCK&&n$@w3T} z4IOPIFL7rmEeF%j;jZ8u?Chw9U$`$j2T|(sylFqJ2*yawX*Xbk4DWx@soJGjvrerf zf9A=dH^4ua=3Ympf@y38BGz5NQeNG_BKf259oZ)nr<%ui1o^!k^Yza47qAj0eL?E@ zqba6h(zui&%jAI;Lg@TX;`~A+jF-qOck~0eTr8ad&(8&7;DMKlc)273Dr8ttIEsgz zyHeO&6BGNo?qO+9ZiP92FA4Ri1DjhpoBU`Wilg#O*q%n(d`mGsM1nWNdSgGiWR(?2 zeObkmbF2f#WRG#ykDkwlkmmS4`XSY^Ca|0~zl6W{81%!#M6fl1pA}X_=Im{DGs(t` zKPy>+0m&~IT~vF$(qu)6R=aD=j zXIXINWgW2?_vZ|=S(1YUwDpeHVWEJ)`MG6M*V|W}qdy0?DuumnzhOVSvLThx?|ytU za~d|n-yiWeND7farqtUJ%E7$K3w@MEQ*jnKdVAv|{v5AW_}bEa6Pd_-@A1PjeCnV; z$0A9pRva8t`Uoh6K|!)D2xse!NK;P5kiaQaTggC!J^kBdgZy=J5P8~o=l^zz{;ti8 zVq5B?Mye%lJwNgs+zER9K=dQ3zGV$Y8ru>)PL>JTo{#D+L8dh~w{0d_ea6z|ROu=y zRk_7kuY-lmmk$<;!+#e6TOZnCNI2=Pu4K};9rI9; zpYC%i&Mqk%hCNXF4(PQ1wc^mM zBWr;%i9Db!6id0jtB+*r!fz(mRFv-T;0l^e#Ame?%M@ghSdl++(hFRk&Njn|sgR@h zjr)b+_x5{Iphvvf4$%)yej8Y^(|u(6!{B&k10{Rm-F4CYimk-k#M^4f#VcVB>rPm{ z=a8#DrOiM0s=H1$AVSkm6DFZ>6#VDM1Wu$GYYR*dgeHCfh-&t~0KIE#Baymeg;@3$ zx&6ynK5{iknftP@{`mh7mhybJj0ZI@lTu9Gwm`#&WPiR}OY literal 8239 zcmaJnWmFtIkc$-8;)}aG6oac6;Iixjslwz#{y6n86b#odZ~aVw=b6!+u1|96u~ zW?o*BH}jIrB$Gs_smNlY0nq>e0H(a0w8k54{4b**y_I4UNIY)@$y8BR8u0pG%Ihpm z0sts~%S%gYxo4eZd$^M=WYlbGE>!AeHhK1wBH@9k*pN(l`akd@%JmV`n!T5UAA*if zC|fvXDDhy+%P}M|qGmv;so_?8a7I3|ks@>HqkQ4cTu$m`8>+M$OVnd8U+{u~vma$E zW9$^Qo8}i5)+=<#G0FaKV4&=CKw!ykCtVTeAh^c_n1oYS|F!iS zb;x8Pk)0-_l3ZI~a|=lRM+!eF{`*&MFph))uAQHrf8*GY!XT~-+-Jp1pu-;?>OBGf zI5;LLE@w|(fR{)R@jw62%|xlET8@!6^TwkaT>}rnKn{Sd^`$g$&x!d?z!=WIfN4By zW8mxXWC6n#GF6V;MemKz@$p}&C2T8qMyWOJBlCs&&J$FxoIEEeq8OaEfPpZcOsjT} zYY!iwWp%J)c`jYTQCK|Aa^NWOfN#~!rQYn;mxqM?_QDsnk}H~@^^syjKZ~(UluUAe zbYkuMxXn}UB?fghLMng*kUQMJCZs83af-3#kXGKor);^DgGa6c2JPfm@H=WW7I=IX|Nhl*=M{sykf!jUkqtA}|>4 zAtjlwRcW#*LB-KViWs(=>M<$8!9>4f7$q6u2f#rJlOmaz$7Bv_V*YI(@`4!_+9H_{J;DoDeP{WsIT-x zMFdxGlJ^omD-}6$Yj7ZZbvaE}1ZOO+^o(08^9d})tqO4PwVB{xVAaC>I3L>|r?0kC z8rEWQY;lKno5T*slA8YHXa&BQA0-mDD={qj;3x9Wj6`_ zD;#v^e3v6lK~Ym|P9K=QxZ*zsUZJ7DRGwSjT$i;}r4;K#=qF7QdSOXWrA;X{;13|G z*|>(tiyX5d5zzl_&rDTK`=TNf-VncoN2U7CyML;@{D!xwI3P7t7)W}kmK@0fUz8k7 z`!%o=!R7jDj)+2rQAgz$KDa^<6^fa^RB|r8~cs9+9xLRXF-{is3Lqz zwBID}^{~XIcE8Te>dM+`im^{zyNfx9j5oz-34>Ij{-+yoo>C^W2jeFDD1Q^eC!|Kw zFbz8@3c7Tv9TeozA2_O=+x0=RB*MeAgHqJLMI)RQwaOj_t2kA3@;sA+@YB>9PjH6$m_#hx{_BZ%u1bv)i9HcX1DLZb_QCQ8HH=B_` z<%DLk&hy9qeH&!g@&_@J8m(v+fT2!FnOc>Z5|NZOF0m%PDKL@H7-@N>`5iI$09A0$ z*`)?VUj}4|sd-pgUW1vJ>TXs&KkX{UdK|#yvyFlf^!5EHzDDd}0P)8uwUw|uS*lyb zWDe#S3W8$Iu(Ar^GoVjxC!$dVT#5GlvkQV9n`)h3D?M!sO!K9r?&?Envg#_UkaF!& zRZhu0w4vmOlUVoUB z1)JK%J;3lDl!+yFY+FrTca15TOqgfLB+;ynf(<4_CM1HNL~}PCTSOiiwhI!`!e0zK z$wFH(AvULIc5Xu>$12Vu4T;Sm#~M6%aD#HiU7LsuN4PQ3s9>I`sSAoXg1*-2ViSg) z6!ET1Zc}|<40@ya1yFCRu*kj#;7WM`d1Uxrj1;5IJ`_h~I5H^6BWt@5i$DgKVN_U) zMZun6Ay+T>tf)2IAKPA)vu?9n{@?XUp^@fB;R%_H4%?|m6`#*O+B`GmsmQK)1?ub0 zZn)UJ@H0$Y=wCbMek_6POiF|XQQkqx820;1C_GV)LP=rR-`$!RXydquHW^V{A5LJX zUl(Fi`AvA~0-IRW$Zicmr?~UZG?s_@>J6%QDVf+G4;xMPH}vE(K&%uWcvF-s<~DeF z-si?{ZXaF!DO*2FurY`^`2i3E>BiS`PUJ?~wUVjM&PPF?5JY%l1yEZ(twOVRBPRZu>N$c=CC9GsiPL?y4KdaoT z1?TORj9p}lp4Eajb}eQfb}N@(Q`)B=3qKI+7|gc;lwWN&9Fb6-yJbgQu46nqI=s-v z;(LTB$<@b&=7)fX;xH^9iA`PUN~HoOt!!Vmja^IXHI{?y^#K9<-tf|YQ;H}+M}xo> z_uuZ9P?|UghL=8(`^`#!LBq{3wRV?_^nJuh@qjLfC|t<$&UdOGdWY68H+$}}Id0SY z*AUU%4azFU`#-TA|0>&`9M5xwH?Qswu!RpGm*cjT5O5tY)qof8 zK)3ki;K+d*7nOPj@kmdnKKjt;edc^OB{<|Ql*JYGz&b_JK;}eTN7qaFUB-fk;mm|Q zbvWNyQ92D&(dlx$A{2Huf8V^CsklIt75G?IqHa&Xk@6=qbywo~7x$&cAv~W?Av+PcK$nlwgdF6s2IVoa%5cj+{H! z`}xoOqR&;0udu3@vZVwE8$lym5}nPHR<56hFE%6MM%+Zxx*O^jVOi`Xa*Jlg;``OH zi`=@cJkbuyY|t}!|J&qnIQ_wWuU>R?YD=fKY3G>9?dpdF8wpq8K1<*BO|lowxVm*W zI%(fq3nMr5G=;I2G)>nB_;?WJuwygzzl%)22mQv$m#34aba~1>9FCBcsVwp8(n>u( z%HZdzjHfXy8dAu_nA^67_5Gw%g?N|$pBm1IDaV(Sv4Icv8U7QC+y}eU0nV!9w$l^P z`B0!}gPz>kAxACve(td$2Bn*kb4mV(mY(B_osoUmf67*QdOn>kn2ISq7}g$gJl_RZ z-?9sbYN4V4`}6jPv1u{oCpP`YpIkk{m;Y1k#gU6=MG%7xE6I}t;dS)#({c1jSjF5Q zJfrqHwB8o9}*z#w* z$$nU$UGP$jlKD_>1dh`E@$x+6q6L{>Mf2>0-hHgU2zHx3HO7UqQ4g1wSAa!%o~cNB z)bCc$mt%_=H1hC`@6wWx0^?&YejX&#=Vv7T%?Wms6TjoU<(wg(FHGEUoKl;}U zx?4w_ye}*F;xl@chccJ^8!Y}Zl}oja$%*@Xx%!UXtCB$M0ErPbO<|qB&~Ff%v9mPo zDwacYUpw2v*H|<5&{;fkN8mPWFK0$BdvwPCT9IfsXC}QxtY036c+hz{in?cloK$_( z{?L&G%{V3?)qNDL(`o)DEFiMQD4}n|DLSFGAq1=zCTgmF2=}OPT~KPBeM*m>flgT! zZC5zsa_B7oAmu_O4Y_6jxjuZ19^rMw@mna$Q_YTh6ZZrkpBI~`XIPlEdnVflBR=|vom+qyF zls1Fn(!2O)6s%Wiu6f?5(aJzQwJnNh`_0e{h>Bg7Xn3jnHofS&|7qm8+!vUJPDs3+ z_Tq1i>63njRYPu2HTOrOhk6_#;^$sF?9P`L<3mj$6>68*yT?~*_}{vp4sfyg*P*yf zA%4YDV5=X81{PH>JYBmMgrcufrq51oX3z3y0eX~N>w-Ye>OaEpmTX+E4!>_5^TUv^ zpCr0GSOa+DNH5zeWQK9t9${v=up#(4-zT{{)g0Na?{Q@FU*F#i^nK-5y6ojGP04_* zeSGzMP3U^e0ma%Xg}tpN`=BKJ+^|s29M$!Z()>l_?;rX_HD)(o`Xt?kjn)+!A{2el zEehtf^Rb8G+>NN$0{?ItD%o8=jzq^oEBX8mOy`zLn$LzsCb`*`R~|&+a|Ls%U+*x> zv4w|I;=sRV>k95f$2*=qfz^WTjRP11kWCev)t8`SW!P2XvZJY5EX~mIm#@m@)aMs< zwvToH&F#x0xFW?ILh7f=>t>q zEMLj*Bfe=H`8)PvusVpDJS@FrB-ni*?LyD;{k;co!yzbClR+(8aDl$Rov|vlOEk&r zqkJA4GZOvj>Yn}h!*K}e1suD)rxE)#`jQS<(s`zV%FDePd!(T=h0 zARD3i@AjLA^9rAI+z>cjSy|8pU7KF6{|g=Gn4~Qt9(GbOGm9CcPUiDZ4qKYBQS_1A zDbk+qzPZP>PyKj&Z7*kktT4Es6=msg6z*{+E{r^7$Gh>vBiW|A6%R8gXO)t4rh4S^ ztoEoPmnVIHZGfy$>`YF6s+A1QoX(0l2{42rDVISkQeunzwm;4_YbYuB$Q3^ENjfQp zm3P1wvg1MPT8Hu$iRho)eVq}9O}FZFqR(M34VGcUp_ zPMbDHRrKM5r_-S0=OG`feA=bOy0lH&7q_s34ql-adpX*WAz&IP<+J1wZ6jI&hWI04 zuShNcL_wXjllQLwxbuSI$||c)wCDF?=U;?6?n`_MA~55W$lsNRs0n@~JjXMJrb_hq zs}@I^&K8(xoU8xUhS9^S0QX`;OmacyhQ)r0gvmL~G1~430-L>GN51^2Nvc-|2F|{h z)Ss)PS#XH|!bi>=mRc-w-U4N3Z7Z8Y|hpupIalW8%B&`Yu3v}`9h-r$n zk+|D6l#4oDNz`Y|BR@vzeK0E?m^NmJ7;zK{5Uo|3));{SOw0M2)4l{~UhUl~rAS_9 z469q#bElu8ynh{=R6kp8KV+UW5vBcB1iRLJ=dmbNBF(ajOkHHM3{Oe8IQ>&Up1>s^ z>2I0>59{BagJBJyMJdgFEIaRa)+00hhCb?nx8i0jHCvri@uRd#I*m?asCw!fz+K#- z7}vnmhfF}73($H&*^cHV&5)SEQ#6I8raVASLx9+Qr-^&&NWVSeDu*`gV%E#^fOUHI zONcc5g-i3e3zLMT>=B;6f3gFH&%!T5F?_DKE8!jKDw>WqXJ^_vk=OX6&GF;nb73e+ zjC-WdW*cS3q8(=;NRuW-YAWp9G0w z)$XC|0(M(#HfS#m@jUDKfnrVk#>A1cI?%qHQml?y6yd*|lb-D5Go{n(c6vPL;_f&i zB{A#SRIqn~>ms_oOvX{5S8+=8N+cEe;HB8D!d=v ziqA{fnZn~}q%|(jJF0M}2rqWc*5$E>wGxUBeo$RIA$E89{mYrYSeHhbVResOSt+86 zYgDy2$JS@y^LSHsQMkufUsfGQTT2j`bgQ&E%aPBw_uC)}TA z{uGLqSS~)=XrI`GPT@p8(J0@MjP=#ggJ`m;6Gj16B!jiybl>&@yM%vjglq}MY9Y&DFH+}rnjl3_kDZ$YY00x~#5g&OwawgF~M#>h@A<{D`q;B1!(of@?ir|t+ z8MKtYKsc)a)l+6FwAqXzs zoNGURu;9DAvLg`ss2@CH;n&9Z=@*7fjnh=}NtMtWiHG{Z#b0q2#E4;Qn9O_ZgB>vS zcb$wbPqb8<3&oPEe38lZrW$usj&b)-dQ4Jxs*bA;l?&w}K-sBkla{@e={8w*qD8Jq zmcN;;%Q#Z^++RpB+7k8$rrwvFZ4(U}crf1`Nu=vh)@03K$gA>wdyd1G0O~c@TjBdC zMt-BZ4f59E#b~2R*;OpPy{_AD$Bq>i@q*3~2EJZ@KXKE`Zljr@hG{sglcI?Wnwsd2 z+#yjb`MYf-q#+U_Nj47h0+rz;Yyz5@nlpbRKZZN_Qo?M-au%6Uz|^gUQ912?vis~u zmypQ3@sYnsBFKH8?a}xAo;UCC%pOhN4H44I6?WpJ!}9s&+lbHe9QtjOQqpYBAlFhAic+<+Ugx!Pz zkzPf3^!}cZ8KqEQ9J*@2%|GYbQ1?$}Fgg(|1BH84R?tc66cHatetueLkq^>LFJczHYK(75e+R>%~qB6nVWAy29D8T0%x&Ow3}~YyUTBt(Jo<%3FcJ_o(QcG&!okmGA|!=s1Z2%IYkrd8Ti- z2dc>5P4|1ST{!GpR*1hx_$tYlM4i`mQ9*C{r-<&`RM ze@_~}7GvWT!PJ5!U0AuaHv001!ju@n&eUzLOTmlm4V7Mxa`-S#{v?!m+h+p;c`jvH zjtvSdXC*^&htdQqbP`a#85BoMWa5}$BJ)9tIg&)7F?8}PWFm1WTE_=Ycgwkayr#<4 z^Lrn-49~)q3E09V+_c=uhEa zhOMuFWtN6ZkC{)4c1%3x)G-T~X*taJd!O?v-oi!NRQ^ycdu9yDE12{-xAwDiZZlsL|x6gW7ExIrWf(?Z$;oSkxVbrk0dKi0;} zv644I$xIqjvZ9{^S^w~982Q>;`KT`zvErMThwx9>=Su&?^sgD(Gj($XsOQ9K@DR)0 z4D4WFMSP}O(Y|UXa#fCzQfp?>U8ui;Hwnjte*$x)EQ7&6q?g^*=tDT@+jqH5mr*;J z5jfhbVcC08N&1q@Xh37-UGsg~Ux0ac{1Bl4fKllsJ!fL5iY%K7i^wl4HHEq_=4H=9 z?I%D^b9O6#e$CV@{|X00i%Kc3RftRvIFUS$Ue;h~nLI9EJ|fshYD5)6YVcaJ?xq}E zPsG>LIbpAfIa>I>RSq!cEe;f=XrExQe&8j!p~q{*I@Zym=4gHMCgu&F@k(eAF`-LW zsygM&n>9F2%pa466)Tr^U3$m@lM_$1A~*75eusQ9jDdLjTA_EfbN4NPJwtRW^h0WRP+b!Bw|6!`49`GQm(5jcLH`2Trk1X{PMw-2R_h!nEUHv#x21 z%%~Q#h+zg8Tgu>(u^O!E*B+Jj?**paQUCEDtEyiFMR_i&6VicPM)Wai7*yEqR7mxnc$%+GV|2|bO>*l&!G#;k zTmuETRh>E(r;WKw5$}h-jI`?#*RmsQsu8MUDJ-+o-&FR>1pYel^YkX$Z3WE65R*qu z^v+tJIbH(JCfFY-EsQX&^w`HXqKGpopD{_&;%HAW@$3XM8>&bz!#z|m4%xl?VXLsp z22O#&I)w#48r_&I)HClpOWmYeWCcX&F`h3K5FXuOeruh&v$FR2kR|u99e`PA$c=%@O$Hb%}GpkXn+WqR=h-kM_JP{po{qkEXB+gY)y0G{F?!j-J^0k?b zV%P&DL5xM1L_9unzWBNC+fP_mbCd{1lk0nNuW;S-ww;?$`JerQlObm5wWJ0Phru?V z%TyIm6tm+~sgv;PspxQ9Sa@6?BR6De7uQ;!z9QNOihNtG=&Xfj?nZ5ta>H!WTNuP2 z3~B%PbJ1VYuyAu4i?IIpekg}SXIHnFK|Cp#D>m

$GHQUhd$YXIYF;9}Y*2RjY)F z!~5r5B(JsH17?h5IreR6d%_xn^uxYNj2(sS^e)wrnGPptqy|vBCw|L}b{(k@QxGe3 zI0m2zo%GL7BKu&hKxLGYm^)Z1y(BE|^dcCTLsgl%qC!9nc~?gU1vRT7NabsT%Lyqz z(9p+ox%ACa+5E*gikk#v?z>H^U7hI&tE9oCn#*rMAkH~yeiX8Ty-1is z4{l?~_u>iOUseXeG}Z7u@wZE%$&9HpITX7Z$p0VAJ^B4%R!H_Y$`^k70RWJfQIW2e HG7kJ7xS;I` diff --git a/web/dash0/public/favicon-192.png b/web/dash0/public/favicon-192.png index b0f77ba1e909189c44d197bb5ce9cdef869f073b..8ef202fa29843f1fe242bc90294a3663e5da949b 100644 GIT binary patch literal 13614 zcmb7LQ*>ob(>}3n+ngjbF($?Y6Ppv;wrx!8$xLk9c5-6d#z{{8y!ZdjxAxxM`=VEO zb*-nm&{dI23Q{PDgopqD07XVxT=}!_`R{{={cM%jZQwpTSYtUUalpraPk!g0WB`C1 zAS3==)g${N$35Fb!?PyO+3sh0Y5K+F#t?7_R*e4JkRcT6WN`u+83hG)aIGb6V2>X~ zXv-QtJT#`&cE5Y==`3*b;GSon5&*Yvyf?0I`g-l;KzhCU)z&3 z-xcqX@3c<7Ofs!}CYR-0@&E8sw~ijY5lDsckaz~=aSL5+(|^Y-@KXGI8ZL>~ZXiV| z4`D%mO0}GK&Tzp2fd@!rVDp5(#LjI~_j&2>)~*1PL~_C8LzF3g9Ia?>nvOZ?hi|#F zwurU(i25894in9{Q)QI`7BE~-xK{2@e!7ZR`iP$5cMD}cz{^xHz zVu28R1FM;a$Oc2g^6ZyurdrSX<_KS{w9m~WE=YAd#T?!IELiXkm=Uc$I$&8>MPwnA z2!llG$ON*cxI@i>*ltRqlaVgg5=B)2K1x~Ka_HTeof{DWtv#s8%0c#WJAPt5C%eL|4b|cN@(>wN|M9T~=}IjEEnrnM+S@5{v?>8>cnvs`|&*>aOj1ynHbx65cv9`UxMIb7ci0L|M0+u8%#K8jqL z;R`0hM3q89<0(!*qFoB9sYCS#J&P{n#%lD z?>J7)Yq*1x7Iq0|J4USWqswI5;LqIXMt=Z*4yzVM@dCS!4tv|G^@@A|^)_O!#Bpd| zq_t35`2$KCpHvK>Os*Pr2YTuT+aC9t7P?b*8QtxIR>WK&R!|^Bg?__`czx~3MRDR; z$hT3i0t|8P@^4@ByDSP7#_+inoK`!HQ4m*@4)iHrMsL=@SATxxGa_aQRBH&Obe~GR zWzXbW56&RxvcMB3TGGdDo<|^k)m};mWk^qi_!n0SW1*K>3wLFsU zQn4uq1U%%II8i$2mtr1H{J}XOwBd_6BN~9!o!O}LG6VgUKxhkKP_As=Ts1CQkS9bi zw@;bf7Yif{+x+alaAiFdX;p__X^TmK?nu9eG8S2h+e!q2&YuYa{&ep8x; zANU~mz?B!Gt$N>{g5B`wWw!jJ_x08)gl{o9I|{QC5==Nl0wy#J#P}=;l#j$~G+(0*@W4tiO)2)2ukBLW2HAGty^ShFQ_? z_a4NZG-H&AwMaH2uiV%Xn*v-~!P*hQ84n*Dqm z9!})gABGSB+93j~k%PN_K4rz#*=E;LEAU0@Wcbb?QOrPnZ&-qsl=H#x(h^qf?IR`4 zQAxxL;QDbd4KIix6?W$EOPLoGLaWbI1)53o+A5=f%oln~?N%+j;@;H{r@uVf_=U)w zm1o5ATO5970w75lwz;ZJc6Wf;KYkePrSOga=!vpK90_`c^5?zBuN}M9#d@&d>4IT{`Oat24JzD_og*#eTJOFp|>qF98 zn3wL_xK7I`wZgY(jT&=eRC$Sc*9Ikg77U#x?^iE!NLn*RI@%oi;Xx8Pg&*WENmuiC zx*gfk$>aUU^rG;^cGwz`4gi8k%HT#lnv`8dtxL#&>&;T+$QnHSs?)&a$!$}PmR3mp z0`~GjGfV~=4s;PTyr+ifnh-Yrkg5XrhC+Aj{%p10J_1GgAMEOpBJ?E=wn)oOm1%gZQvver_+=)c_)7uha*w`)ntM#<8AvU6gd%(X4TfxPzA573!0nv`@vo zhXK{xee5%9Ix}l%FGQZ7%hSfEPw%a&|D-Q{cgsE6)nc7ef(Q$P_TIU@a6p~QxW zJ7;hlPs4t??nc)=>Zd5q2Y2l5irDW;W>E>PB}l{ey)N6*34Aa55Ho!EdHPEVv4TTQ z12g#k3njs@85PLZG#Gr3c-;177yX(@rs z5RDw@YR{iHpv?Uq`t=(gfqP=5339DO7|F;37JwS(@XlhP<1XKG`Ld`*6hWh5|HnE) zyuCq#9g7SkY{!)Vk5}3NP_Xj4svdvZJmE<|f?0J3cclCZw+!5FP4NcP`31qWoQ^ci zJx_)2x!_ssW6_!cdcT5oUWyt5O6YlL1?~eI)Ble4wax_jaz(|b&)(zsK@Z}T4Iryl zGe=^jJoUEXpzo%86P|-2X3|m}KYZ00-l-@on0S8*KghLxH5H7KTB54$JvqEm?~eAa zlQ;aE23Q7t!0ZfB7Qqm>DJO%#b5T~u2B#~tvn@79Yv zP%US`iw__F{AdM^lvOLZWErUT(J~S@PY@RE0F7d$S~)e3$>UIdklC6iTuDxEUAOxvum`+ zGO8tV8W`386JtG|syoLY~X>!id2JPlA7!+JEsfU;_I zSR>7bvZ>1DM6on30LL&en5<_-g>R3)KExg}U&j0q&q@r+1u!i&Zj?!5h@h#4jPgyb z=}&B)tK{fjhhBaHZw$^ZA+leIm1M#g2x}IZ$ z2|VR&R-yH`fJ1h}sZ>4qWBDoZgb31bPLk)St(xr#N8|-5U?v^tx$aobXve5y67q*P zm_|yU>WQ?@E{HoK_hqax`W-WUkKEpNaLg=-Cvbeiv8|VRaj$KSkKrkS;4ms3#hJy$ zSj2|a@~pTXr9MX&1W%exnOi2d(%1(-p`o|)PuY2 z6Kw6fD_oS(C8C=dzAkkgQy;#?l5|#$TfW1Hc$##9Nu>qsm6w0xi^~>B4pC%@H8hL( z-fmA9LxMhBeo@L&6I0~ya%q(eNgf;Pq40l0%2My~*4Mb#${br^3+r`UP`s27Y^}%l z(`0ERd;^68ALA4!H8DySj?d5Y8_mDA@tSuuF?E5#ZJ7&%`Owj|vY9YYgJh0vYzbpJ z9w4}%qit0o5?lyU8dU&A8a{b6Y17l}M<-v!Ss0_&?Yv^nz~>$!0%?yJ)O$7ei%b;o z_ol9Qta>}RWjmm>`xWAZVa+8?bA|o+ipm3QphV(Krv-j{!EmCIIsQ8=wc6%;^MGrVc-1LN<`;- z1wroCXkbC;qlKHkCuM_bnE`z7>6vh><_@3H%@q45c+%1>SrPbGj4AtQ{*$!-(9!Jbp|ol*c@;thPFwB_l| zy=Kl7l!B&?o;QW2?}aI~z9*p$X=~m)f74Wh+=9h5p4++k=LWujuBW&pxp^_fv zp!g0GTQuO+4L}Th(|)|ZYt6M6wc$00o&Z&m>eUj@Z@1H(Jxjvv$o%PfH`+SXL;u9- zAW^4YtyrJJ5wOp7l)@SFFCod%5kso0tvAO^6sfIP(r+rUL&ttamw&ek914Q5@u!XK zyqriHZaPblTlx-vm^GveukL>`f8TY}NG%oSaR~MXHa=L^RSSFe(sisz<(aIt3-MbA z$eCB9ZhC+UM*Vj84W8d8MAiOwYABjO8bf!HiKB(qY!oJ`yQ*d!eZu;uuUJ{1K(mC< zp(2}o?cPQn(;DsL(lYs<6Nta9>ppmW$B-ei@anpr4CUZA`IajA=f3*LZ0E2K&{%@+ zwML}bHYsvZdqZFp z6YNB)H8aw<0KdUWcbxeIW#Km6mR!9GuCcW`E!F*C(&3YaHfKER%b0=iX>KpPq;Nyg zf>4Da6NiO7UOa_x-eAjOvWtct&c~eJdfogTcr}j?nhfS?lD7lp)?E}5$>A)hev_|s z?u_6kmAcS;-fy|?{h;S(?X+6z?fzHdywr8xc^r7o zcl)MXr0aeuT8*KFIa_UuggfHNFUsIWEn&>S%kDRU5owv$nERn{j?$S4J4mm}7k)}4 z{(x3=8+yV9^76-Zdoq&$|EbALqd?>lcaJbOU}}D=(oD5Zi+s{Z(k76 zx2d=2f9ZURdaS!50hj;MbE zJWh4CKv4nnK5#d4;-^1e)sk9|(9T=#$F$7+Ml+XKMV((B6v=6uGXEJ;jN{#2+KUq` z4$=2g+XyKLDMER9g;hSH8HSr`%|@ zd&$ca880R16_yvY=bXsf)l<%_Nde`^$ zoi81#r5<)asf^sgcN!kTZSAznnPWgj|M56Q1MdExKM{LZo9rk}AK&INuz0_x#=9y| z5+->x8hzT6ilA>vx7*0`2{=777<8%CTilQ1zo8gEd|uXtDGf0r2W4~R@Ca1^8!w0Q z9$RgdW@*biSL*{)lLlEvb=kyk2iTh{8S9Xd3DcmEj}R>+LRtXk%`cjZ0dbCP?cbu~ zo7TRHH|Q0}duYO6_F8j2@RkB^{j_U~U z?8^WZZ;=v0vvfC}5={gTAq3c|H$aN7t&QT|(jP1esxX))opl$^C2h}N{IWB^rQ3HN@u?#0;0cFUk&js5pXwz(k8E??25>Ka(z zwH6I@Jd-2+Q!#V`p>jjIrH&os@&ZEBefM=U5MFEg<1vDRkW#+}Qdx)GDbHtOTw`4h z`gHt*qT-lCX@AP@w7O12J+-NfcV+u}@lSCrpFT<>RjKLbs5S*W`Me~*K4kOk1MBK<&cyQ2$pukg=RPd#4?H$f$q-0v zROG}BZ^I?>Vox1!v+vOI=#Z&QDe|FznTd>!{WY&qn2Kw4$V(VybGN$eSi(NN>_9&H zK4X(=d)t3EAX$GXJu6PL=)U0TlJo0 z2|o+G#b6>3@Zg!vFB23>(8~fpgH|RM$GFm;q4W0a?#@@%g3;#5l_7dB_%RW{vZI3@ zp8V-oml&)FjdX5*+A9x_FobV5us5YReJU_W_G|k4j?U(m5qj6MEguO#O_b5-n^BVN z-;;R_phT8uSiO*LS*m;9kFIt**}Gd3BM2zxaQoCq)AsUH!V6CDALz%wCfdv3AP&BX z&zp+;%>Dt5Qv0DecipjXJU{kbsx|!f>MSYPEYATDBHkcA6a1$T1&?GzV3{dwdIfdg zR=i57!J_z%J@TK{M zSzKF(fK156DZ3WYWx^4fVp$_EN1^NF$G){fZ|7}z3!0D|ix|6vHL~Xt!-z&+43Af; zzuuN?74I@qQ}lCh=ZAeScUjPoMk!Fx2W_}I*WW6>_1KEx_3>jg623%f?Xh>mUwi|E z9iw ztE>)eM;k=vaXy8B^t|j-PKik7HuSmTY%u`QT*{-Vo*+>t5P8kAdNCEQo;!aPp;1AJ zzq08-byz~MbbZ2FF57IH{&t=_T=j_J^ZVC%m6R-L_yqZ!>-dtFE9siLI-svw2uE+; zv6T3HvJ`IQQeC`+S9rWYrUC7p;a1*!7d-EN{rI}PojP103EGBou`MHFruO@-oGNk)ghb#tqY}PRXuX&zZ z6vK6h7#EHWWTvnrH{4QI5i#*GQ*q(&5vmM+i~VfSbn#m1z%G3ws9(q zDVgL8<=m$J+SsT81f-vO8EAkn>EWbiZn z*gqJsH;U+BM7k_4pA?+7yTR$cA0VPvKTo=|%?|}Hp=$;4#^BblV1pIZrE7czj$lrK zur*=jnAc1JX{2LvXh{L>^`H~NzL}Z6@F}Bv59|UNm)>;irCLVK4xDWiw$_tCtj$6J zH6hC~T=v9X@|Oi*Z$B#owetK7B(0=C)a<;%nU?v?`z6ww)8vGV(G|q4$sWygC<<0; zCG(jJIFJtEE$?ouDblThbJc%jkkaJf7#`0VK9X0Ltdzq^;|o)ciI%`e$yM!Bd$-}< zk&wvROZBa%xor)s6an}pC+7XpNO{fOh-Tgymc`O6Ktv!cXWR%>92(i!!1G7o?R{&h zXxfk2Db(sj`uhq7Q;0Y$RE9orq5|gwz66d!*=a@7&WVTl5CZ}&3W-OTr{+{hZxa=I&^?iO70oo&KKaGUC`8>e7ORlCq zHm*5a9+cNfT5o;1i#O(m|GdR7n>(MlSfcH&yKe4Y(CIOsEx&ukLuA)_wr#TPJh}>F zOjq$Fh)?|L-#q0}#lI>lLWq1J)MH}b9&)LXH`V43qLw%S0v8bk z9mR`qBB$J%RpPPd1Q_|)`*rH_pfLCF^Mmx=Yq^sMvB;xF9aH=6I*fnRaAV-v5K8Nr z+gt<2?liG3#H9n3qNLen8S^OiaBE21m-==gzu%XAb$LG^vh=+xM^|Z*8FTgAdH?9U z?l0-JaugKF;&l&NUWs_$&_U>WiZxw(yP@$9{5n`!NP}(K{|AhFVS7Nb4SsHWN?v!S z2S|~7I9?3}D+KZKPhZ|Z+~)S5K6S*Zk@?~olfEVjW)@zBk|3*~MD3;OeZ)TELRxEF zzma|PTX80NBg_T{Bpe%_4L3s1CWrtUPM$?F#PC`LUpG~Jc=h@`Lbb4vwHcyjZsd-~c$Q7t7| zCY>;BA>x=8V}m;XOqx2)=~(EU>)tS6eJQ8q7YU%)(g)~_ z$hrK)z+=KNu}FFr#~&!z?#`a1NP->kH<(O>5?(qdVBtF(Dx;L=zFv5Txrzfx68~dQ zT zGj8^rXIjtg>ufbRA=cmxe>OQjcXnx9=idJ){rux{dKC3_nIlDX4o7B&G_FY3TyjVN zfDvB=2j$^8?tTr0AGUtJRu;$H1`xOJ+HJa7*3HI?;zd~-b9IzV#=l@`XmI7=6Oi6? zg;zgru0oPg<&IP)&Ztt}7Yq-wHeq%G~{RiL91_u@<@RHp$IosmX?`2LLn}Zinkv zUFSO4X7~P#dBpuj>?{z!>CX+-N^M1EqrGD)UpKwhyg5|>?;E5=-&QVLXfgMaf;n~XCY`}{Yj}0#HWqdyjHpYvP6RAf z_$dj!MDN&?bgWP$DJrIgOu(NSsW%*R(_{DNZ~r*ucBR=d*IxV%l3~Ut4;|`xF-b_E z#VC~BnkY`N%4t3l{K3`0F=GkId1Q1y%a`kkn|5<`kE<9}^Ml!vskS9jg>zjw0rsac zj0KdXCKpGiY1lX`0|^0aL7r#9X{z)*?`x zo2cx%3vP3eF@0{;`3``qbD?ql3xdHu{>j@4K+QGE3Q4B zE^;f&rq(gJ$%^DRc-3rcte|rw?70%rO;Y`53Jn^M-0;-t9o2*x4T~fZ#o3~T%cs0| zoH5In$wdPl2RiGX&zo-m0iw;LwFz2$kxiECFll&7QZG#l%9!wWHC)B(qnW{Q!-|5x z&LO>^wjA+rq0-2k0-t$~4Gr*cZ3lK|RT z4|-;4z0(69Vx0V(ozL8g6Hvzur=Eg2VW*vx(UUopT1n}fj5D)u@=(ip!tuDR zSENcie(*KvDH`k1=s0aFRR9;Ba;R@ES#i*j*y#m1Ej7=bBI)=a4!qtllO~V~TwVi@ z-;HIXuiU#WrwlM|)^)8lUJ|!aQ38VC5|rysfP1xi;fbPcUq~td-e-0xibCL4rKbMp zw7J#YNJEd_6N*%2pj)6WYq047u4;r5Az$F;?&j92@OECb9K*ryL!Cq4e!g027=Q@$ zgZ)dRW0K{%OBfE(H%wHCGD}^?Q(0L0POx!D zEDWJQul*IzPJ0J!2O*J$7^Hq1kFkC?#Qj?W#24Z!6@GVbDq>pT1}c4pAl!8pI8~W( z=`_cn9(5ssh6w=ZWA|YSZTU_7c+FG0^sTK;<5RCBKjG3e8NSirKH>nTsik|3&&FDRhdk;H))C;C)pC`Uv4VaVO?QoA2Sdxh^7tBLWfw*YNMPUkXg zwB~qeVbLMVEs9sy_S~U6WRn8#v6&KQ@wWoR!@Z3AXj8Z96!B-kuPe(SiW2G$KODeg z;CEG;mG_{-=7ISvyg%&PFrVo!0E^Cp+dM@1SB0;i{IFvbds=lJ*kd`Lj!WC$H()-O z`ZxZ>C&0q}7k!(@(`n^CWQ8MqZ`C#D;E1x$?kk7k?g2{$#0NYF4SmD9*P=JkOrvN0 z{wEqvY7x_vB#hk2=m$sHykSIpswQ^L4JroMEHKRlBucAQm&Dp4l^`2OmRLA3sCag6 z4KFV49#COEgU~{%AGs_srWAn4wXW*~rfaprj-XIiLwG9u{W2^CTI(YMW@ctZu&ATk zrBtlOVUyr(bh|n7eTIHJpWdB>w9I)KN!OdD?~%H-Px95zvOuLs$}2Kan8EL=9~8Ytk1 z@S+w?rwoB%zmk}ct}s~1)HH^QxbxG~pRa2qUQ+zHI~-61duG}9)AZC~00NFDHFW<{ zcM*BBY4oga#g`Iw9N(uKwW5ORqRj~>w~h>+ea;U-W&>c>$8$EWoRQLpfF3?}&BRFq z1jL&y-9~D(PBRlN1V8{X%*Wp(x1}C>1x7JBbG$Qdl1U4p$(BwY^DmcRifpIy0Oj*G zH#4^$3zW0_sqp8YXNeF{+*$p6?8hIlBJmma)y~aUV|7>o$JGYUbu*2_Z#w^WlP+2+ zgu&vNl^5soXl$ztH$Y)O6nhYuV7h&USZC`4Mj0e)Erzd5r5WD9@+r@ako8442cFpa zK#iX}GNu-25_WC3rLRv_Zp>a*11}ul%xD$Soip<4VM^$D?O+pr0gqvpZ4ctbxnSLp zcvfT*&_dD3KV#gJJ}|^kE|A0I3~B}^YWCaoIT{kp3?`l5+ZS?}&>Rrs_)SsG?$doJ z47WPo&-xMOb{s=Y7Ge)mnkGlO)ZW##csu;;+bE5l?OM)Go+GF+w;3`o+`B+?f|rNS zNZspwMX<0Hv_<9IOQpI6L^5!e=sV(hZz3XGx2WXAUE11qxM>F@Ag1$jPN(D`?XR+L zL{FxEOq_Zc+WpNy|I<8)T>&Rgd%S$nNc%U-c9CA!>y&WTuZ5BUKuU&gQABM8K2ky4 z-pTzD+qDy-1DF8IH!g5idD`Npe-ce1p<@@dHl{rp88JzM>`Ry|&LgP^EL6kOecee* zvIlsD?n|+xTq?tiwTu!cu4|rf4zM)#xE6k_Y4i%HGQ0i6^<}Q^2b?hT9t(Ovi=#7N z0h~8eBvFsbzWezglV*j`sfBul{_y6+NK!P7K67EY2F9_KSSxAkk-Ns>acPQqL&R+> zNjlHCHUKbi@gbx@tu%{VOdS69xIsUBkfEYb(pi-CezHT8u3j=5qTzz2y{7ZS57b90 zkhc(*T;{N?mzbx&c0E_x_-h3TAo8}X0oH|yAyc3Gw4JfW`Lplq(ygWW2OzG8; zw!6|SEPnshPY6J42Ql8>LG&zqa668t;`koP{Wh(HR;2TMq=9qjjAGn7iNx=XEx#5R zyt-=3v7zlR6`$@vG-1{VvaKA5TZ0xgyf_>FM_x%0khCkZJ9XxDw%!@$pjiP(9$3}+ z#-J*ZYd_@?)mH^2&A{`ZW{v?5yOKz(iTMROmK?YwdJl{p?A_wleA$NM-<;L%Dn8)Y zt-%C1?j3Sb+#RISw$+A9)jpyWp23=D`=Xll{L;AvJYq&NRN?i;eKQ`m6P1o!6pmTc z_?;Cj%D_^XLuE`3|0NSNKBV=y(GJ^e(MhKUIzE**4~O zjY^O?)#g^+YO<<_bcTitd z*FV_qq`E5yvNwm23IO0VWYVn8x$wSkOK2tX60#k|O?_0MnkRQ#fQ?x)zA$9dAn$f2)34%t zvNJl4AF}IyrFl5sQ$C8o1qAH3l6C7ITqvq*_(~hPH5yeNLo>OMpV-8F=e1i{}we+*GXETL^!MxmAe`>si^_$wX3<}VD zx6OB(^>3;lj*pxQ7yww*1|PL~##U`?nZRsIX6>-#d#UZ?RL6|_u9b{N-QVHY};6_&m`%*8H^ zFi2?ir$UK-`V!#7I_LS?3#4H0Go(gv_j!Xr`?6^O>6fn{E+?u|w*vnu4$|i+9S;EwY9u{Yc0|XE3wVW{Pc@?*@>CpG->4m6Q zi@-)7q3E+J8rcim{qw@=gbXRzBILa?*71O1&-9rAMavqVi z(!TTb-|3dG$2@ibM@$arWL{jzyBmFiiC!dw?=x{#(i;i>J8O>FbQ2436uXjAb63G= z?VG*`=H&?kst<)yRk$E~$c8Y-Rg$zU)}Fq={q9npuj5e%t3$>-Hh>Hp&+6}TRTtSX zuSwT(LTTXaM%?TyqUd%TsvF1TNLuB7J;5i|x~y<2t(O&$eek>up}ifT4<@Ebq!>cs zGlk=}+!jOcE}jxaQ~-?Bo||-Aa^F5&(eH$AaZ2N67vp9(l^eDc`|EA812N7EW?^u8 zond$_X{Th@A49_reG{odN&%{YZ4S;{UpXGViJvk;eOyIl@0WPAnWNZUJAz`rz_dJ`vaci)wv~|eEezG`t|4i8N_n6KHW15mcDBWNNX;L-cdeG9Dyb9nj zlFz9A_o@75^hI`8*}Ia5Hn4@&Yg~;?XTpzJBNMVlWN7OB-V)flR`N%i(9c=Vn{p}5 zV{j+s&!5@Pat_Jj&Fh=9&I;E=^uo(EN<}QHzJ;xXmVZhqkZ6 z8Zc)*6#s-p?)q`|8yvR9ZVU`=Dzyzj(j^Q4SCJfNEy_^W_PU((h*h6KTncCBw=|}Y zN?bf^r-;vrn8Y1t;ri9UiH>G?fQaZ zifLzCVP#@|{=_yORZfj5$+Xs;?X(*!w5h`TZK`tqxE}_WFww^Y z&X#6_0;$nw)kmTd-kX^FKf{mMB-!LlpKp)lj;$G~K;_eOwN`az94?o;mr0C)9#ogT<3KZ^uVu!oyW;gh5`DB~#83qMy1C2Zw=lj zm6fe0vB_V&;VfGbe>386tj}=$@n^uy(3Ydia#R{LoNxS{4?chh?EoAT>58|%^S0q)FE4^+`5jg*kE;7xP0#^LXEmVt3w zFcT9uk1LBbmn}UfMSZ7lm1Y%(UhA+ZEFK(nR4!CIBjIK21Uo!qLCw8f(ut3brsNm! z#*GV=1JR8nWoQzr^Ndo*~AjRCf&sqBs>7TR*~q383aF ze46q^R4yJ^XqoZ#)c*Sl3xR~wR!J};}xoNz3Gsc4&MSYY$zyi3Vz7Lbr+^9byc2V zGNQFhtFn_LvsR)3VrQUb44PY2{l=JHhIUu%2pf_e6j!`L*(!SHb9>VwQAAuO$bWs) z^$D>GK@Ec?OQt!??5)9~Rae0^Pe&F{by~WZq3a8a)Tu^63vxffdO=^6YYX3Np42z+ zarx-d^?;`kY%}Rn=Jq1{m)6J&i=6-_z%r(J_H`>lQxAo^@HFuC+M-7#u-B!CM{5B< zACcW;;#uLi&t#)1qM_)O2gXG#=Isrq>fLtHpn5YiudigMC5Cg=Fn7#u#!R-LpyBs_qXz=O4BiaIsXS?JZ4k+%;i9|lP61ra7 zd}@_~S6&EVAR(%jbG?t9lt0=2H=By`!kW&oh7gA`3N1x~NTM12U%L`P&w*S2 zf}O$>P#Y0eklP(F&lj|RANcp)5>!Q^2UZYsq1oV1bL1vje51UOV^$SGM|qr|M@C;nwk;_y%;n(QqpRV~ z^ffIGpq6=&2m?3+F1N zPoIcaguh-t^uKI1Arxny?oUq-LY!M*7b(YPO?I<96oG97keKkHOzojm~$?Vt|IM{!)o6g#Ld@pT@CB-c6<>FM08w&$=XN*{Il+z8ygwnen1 zT~(ksVdCve=GeiOJ5n4GCJMbpeGEvZW&kkxRF{Bp>kASkylr9mJCN4W%um9PK!W_n z?Czs@t0{HD*jXFgv*Y%I9n(1t$&^sOt}K_-Xh727U|{iG#l(5;0gLbS`Zo=6VC7W~-IV zw29<3GE11_EWTRCc9y7CTgc}3=0uhCzbbLWZEz$8}&1g6+cN^A4@3vZs?xX?x z(kZcD3MA;d0dmhxW}W?hJMe)u?Cs^uIgI>t+(~T9^`EluMB(`4Zd`3(gOecqUQ zAW>GLFNFgrbtkt0SyQ~_h5u!qk1ydW$)lY&^>`Zy6!{K4kb-9_+D{M;Lv#HQ8)%ie zt2AT zcMk0XgtFk}vB}!470fE~7uySmxDvPeoY(~;r-JKQ-tZ(U36R*lsW;>AmsTP@X%$HRR*FQsUwR zZ<@X5%$6+2H5enbxqtZJ+{B+)fcE4GRCP2ezPfKh_=EUEass6|H#9i83YX15U($9| z`c^dASZJ#K?XqLbjHVJ^=Z1X{6-VF6+NH0;%~GHkDs}N^DZFQ@09{RPSRHwkC9>+6 zIIS1F0Xy7b$Z`pN-%fU7s>$XJ&KM_KsVU~eL*(PS-se$*Y{~7KQj`)z6=rS}U_I#+ zwCI=8zFBSe_rFYeGFe{i^)PR`%CKpCFI#?b!{?fLP?zM1CuP6#S5^+6k4tlCsX;8h zI<`(PG>A%Xg*hIE6IWot<0Oi#(lhAEdHnMf<4WjhFVCaDo}PDMu?euwDbzW3+-=17 z3|{c24Paq=gz9?z9eUHs84orCQr|T<*hbOT$ zqgcqWsUx*xbt^EL`MsWWwx3(=a*rJW+YSc*;N23Wy9hOWrq4R;#pZ1L>nSqb#p z1W02AmkVK3r7tT@r8;Z)VJ$~#B#tCbzlzNLZJuM5cAQ@3Z6NU!Cx9Mx@;rg2 z=k**&Aj%js*pw@DrsIAo-)gW^EAo1mZ z=8RJ-Yn%^2B00~#luVfi+!VT?&RS@0Wq^Kkr{{Sx?PyTXb3iK{^4sPht}n86qAVRxTdmq~UXS6CRw*xDm=}s=07-`?f*LXSH-Y!UK8lw-d?JGfMDO`C+PRAiD%JkHQ)B|@f3DdICW9; z%f7oYu=?9``OB6ZdrJSVnqjAa^G;r^6{{`T^#dILKKjOJQslA*7f)zgXzVUFjE$7y zb`ptnWV`@K*v9sGunBNH$i)xOvS?wR@yU`pi7{+lczO1+K`rbZ)Axld5a5hZ9V|p^$e+Qc{Xe}VmqYnLp|9{IH4Sf z#hlCrMW+l4YtPc4WwMeJ(k_PblUwF20;c+(VNPchJ5P^eA>uBx1zT`rUSUjnU&r2* zOsf{sGnFa2Ij&jV3_gLl#>374ZwSebd9}*HkD+a4grO7+lTu8=qo*V ziccKs1ca7zXwR&rv6bzFkWQQoh;$LN>q7+R|A9#A|79*(+}$sQ0Vy=YF0ocHGQK%X zNbHWw^b6B%n!+J4dFQ-;`YO|pcS^gDz5CMQj(5FG66v6&IZS?dhVpvirqF3{xWd!F ziF2Ns5tLe6%ZizFKK89*uWgxmllrZ=f6w1&pZ43ntbKHQxu1_-u{AvVu5^PoWvJX0 z8kn~nouVA|3sn`OHt~@u0d#+5(fNv+6M`b%a&x^|hWpR4g54<0!p<4#jLEbRE|;#D zRmaz1oTHH;%D%gqx}vKYFc4m*dxvmO_1K4BYu)5&KuL(6(V0VPOE&h8IH)yRG4}a~ z>;;@d5(Gt$P2ZU^v3Qczs(ooY`0Ljf8v#7q57|aHa~2+gHr6iH>X|d;SfEm0VBZi- zXechVpIi81DMfp(sQ5dD%)2^$4|yz7*k`c&r_R34a2jYCJ8t<2Gqa|8>xqA;cWyzV zuYs!Y-|}p4*4dCLV^aqqU6#d5)8fq4gb(v4Lc(7IP0j)nA2^GMjs&-Res5yl5s>hw zNDN?8!$)vV@R@PEKD`T_l7=CR_^oW2u^dX$$3nn?*=Rt#8*Uz{>ntF|8gT+CM5 zyn-8ct}4SLpm$3&E)3aT39#&EnzJFM1+sY)m%(*mR5pe=(Iw>O_R6RuK?822Q~1_t zWjX431dn&DT|>LsPc2d;TU1IPuX%W)_u2cg%!X-${BY@pR%-qL@w;FJ!)ZNDb(;IJ zwcHzqn7ArDwYjGw_rnL-yWfGQt!I>r-#TzeHL6zIJ@?;9lnnCbp>R2W%dw>G7jPID z--_jEOC-AA*z#~Q8XbG}_&6*dS2L7T2)5iW81-Jeqb-1TK$z9r6FB4EMb%ItuW$|# zTylTH9d*J{Bt<6wi@0k()!$f6865SlyCL&{SAsH!Iu?p4)O8>+^6+OVavsM5S4`yC zouxd#R|-$mbw;DBtZlyafwy`a#XErKZl(I>c?(}@sxP8=?-~A}m8y}Oe$88O-jAjavl z(L7EGE^k0Y}bBa^gZ-3iD<7x9@edFHR357mAOiw-~f~TIl$7B zTSt=M*9H>MJu>qJqzptl-3RK|baCfV`UKpQHo&tquP^a=GxKkXV}IV;EB27eQ~AaO z+m(;~Rs$b?4)~;K>oBVW(Vhn=_oyO#!3yn>*xeJDkA79ctVMbqqf)W2jwDw08ZFtY9K!vW#*&nUS20Q~NSV z(;*OGFz(e-8!htk8R~x? z_=dIMd$kN(uMMO9?e|-9++3w3yB(VvV=ixIT-zF|iwTLagL`v2vG>#qOG;k6Y z>t5gyM&X%`Iv>)0ah_DSD^@%cS{r8Ne5L2<&-V9&uC2XT zMw@GBy%zhz-w7X9l4ARbwPKY4h!NysbIA`1?) zKBZ?jJw7}HwC_cPiqMU8&gs~*l;uZFGx_fc!sI*l9IzB0;r_%QuF$_#c*D$DU_EBNH$JQ}k8HwkKR7LzY#7o?Jf z98t)ty67~Zb>1@aJ$OUy1tTB04e~lveS%0L#ffrb{1M_1aQLykj5wh1eWd-0rACXJ zp|KN3Q?+^WUJ!T!GB{K%_4NmB6iC=ZoEZ$e-y-SH+;kgJuc1U(jeg|z-7khkTYzu?yD-&jlZ*rDG?h!Nz$~Tf+k}L{LQ)k=PD%Tn&0FL`Bx1z&G zfOzdzAtIoP)_#L0_uRI_mpI?E_bxs@?>U2EEWaqS&Z;eC)}#r|_AK#@1c#C$9uR0t zB?WELXx)S7$3#Y3n*!z*6q3JUa`isppDLN>dn|neaHO=8a9yAT>oXoSPZ`Ykch@;3 z83Sc`q#r%2L^#@DrN9IRGh-xs%#=r&5n@3Edwy{G8+%{eTlVh2FHtjU5oz}Uk#I#p z@RE~h@9+*q3hcNGX=GlVSX8)#uF?GA4#4<`Or13m{|9GiO*~1l1=g`8^7}UdIqiM< z@0c+M&(ZzC(=9@tr207Tj~(p5G0G= zgginnvP+|t?6xeoU4V`ezSfUoB;)B2Q4K8fiQTHKK2rIgJ}@^a!HM9SfRQeoV+K2s znD@V!zC5oXUy^Fp0<+xOd38(YpEf7H3@&-G*EvwZfUAei8I6ldqLCWD4|0#Qo)0C& z+U6CRcqRw}#ZB9sSXuNa#;F{;d?-)N4#NEtss*Oh*SllQ-;i!e8gZ#c9d_LEaK*;5 zoK}P5UADI2q+Wer^a8$bnj^e`EZ2~T&F=WgV!lC_Hytm@NBTYRhWJn)$E&JbH8Y~} zQQB`~GEpQPJ*N^43i=E3@byvUT!|(4 zz=4Z)K@=?(YN&jM6uqMtR??mzKEoZ~vqhP_FMRVFN`z@>ZmKoCx#sE05~Uly;fA zaGWYh5|y$_TEId5xim2;p!>hh1p^eLnlqj(jkGXTb_*xC^4~|G%auxeIEA}kSV@{C z8B)=SodLT~Da*&NHxfZIICE{%qH{}xv6gT9vP>$2&QyxG-{rBsx^T_Q&?j*KtXJStV8VbH^cuTb1eA82(U39QmF;M`nOOvC`)V= z$4+|qV+bwN?=E^f9;Zo|ZI(tm)8k#(HA(^0O7WxqcU4cAHme{c^^nrTZ)>&v_+eIq zvL#>Js{QQPK+g|Z>w&ZT4*@z?6XRCBd=$^FGUFcm8xXPb&sZ3=&ipYr#i6LoIEO}{ zcy-xF=9C^GBY}hHw8aD&sxxP%r=J5%$^W2}amZ-?XQG4rxz9X4Mp1_h(2X{?C{Fn1 zIs=7GaqD8Q;_Kxaj*+NP7{F6@bVnP6h&}z9Y zTV<7=tok-l!B*xHpk+gU(y{O0qovj26S3H#H?6h_6No;Ws=3On?+~ErHMi9fT=PYS z*g|o{2kDGvTg^6APp9r&I;jaD4gKSC#UK@>0v0(ub2fJPnZ~IddZ_;x}k$n!N?T*FOAGP|k3x9YDsoy=*Z!an`n*mM6c>f9gCYiD6Z_i}@6&UWEGOVQWe{1xTlk2MVWD#IrwjQ^4^fDb zD6a?ZZdmb7C4gfpYyOnJ=^wz`wim;3%nf6r1P#tW;G1Teybyw#FP4fAdRr~~o zbs=jkiyZ(^zQT#sdfqwF?FBdr1Wc4Mlra0Xh(7T2X*63S-zgQBo%az50)%GKmk|*R z6Y;e}O#i%5^+BbZd2uA`DnjEdZpy+_Fb-40ls*C>|!2a=|!)4Nx*$GACzql~eY z%3+@a4@qRY z{usDLWWV&3(YC{FXA!Y!B%v_hi6&%UtnL$+@AlLYa=%$WL)-UelocWk&vz-MnaUsf>kwRPR)p0rQ$s3*<{lkT-c#?r`|&Un250Q_Hz z6|`-*?gGdj8{qZ_ivQsh3dyjYg-pcphe3U6LPZ5RVyj|>S@lC9*QkKtgk3}7&WOY& zL{o(N`$s;O6m&3xN%4miEA=ZZg3db5^T2>C)lAq-Dn2S#KTPGlHO-drXK{(lA?dco zZ~xLE-CYqVdG|kjlMrC|S10L73ls8y*a&4JlPtv(yNv1E#E%A#P1&3(lh-BwG zJBK{tGFDm%%26&I7Z|JZsszq}NxQ z-Fhi90??01x=uPlduJg`fqy3SCOmRs2*wBlQMTtGn`=<9J%a+qlWd@=*pQ@N_7Jvo zh4J4m|JdL>9UQHzzq&v8RTiPtC~Ihj08uHfu}wPBfg;U*oM1|^aQ|u89`Ua#wu2St zsstAu@=-uc?-BcZep8k%+Vul4Zg-V!y_YC*{k}j*g{_OkRDw9@wwZ(8(?<56(Vu$G zfQB6G&)5r%#vQ|P8)om^q5=EH9EMOz(Y#jKU+%WEM$?hxgYw1x2};8Ufzp%!03z#u zvj745%WY@x;q>K>i3s|iRW5YkipD@hFIF&~dbv(G&93IG8S}IgQCwdc=Nf_31>5JS3MNN+g(j!UlntPmQCw}v6t zziekvrAk&0<^dCU#l3OL`}_DK(U*`WCfI@@3=OA8&s=&Kht>a)Yk(x^)1D)hF{)v@J z&zI36loKk;xRcb02+DDPpoia^F4w3FAIYk1c3rFR=G&n27$n=2wx1PAxv=_`gCBDb z(%0~%pqjf5&3YYYOkq4=1q5=?>tIC^vX7OS(%vm>9nL31PSH=W7f9j=1*?#$l8utNjaYnpCC%*J3700 zb#o0XUc@PU)I4vU?kDT|XCgv;1I=K49c+l?ud5W*Nn6ID7DpMU+^%(uyTO`h_cWO5 z3#ixXghcTG(hUY!k5ZEb#eeVt*`o*75gNgdGS&qrGdiLsq@1{+7KY9~N^%qbrI_m2 k|2LCCggJ2e?*-`_)T~N?R?YKurUalMqxz{*>T}Tl0NHa>`~Uy| diff --git a/web/dash0/public/favicon-32.png b/web/dash0/public/favicon-32.png index f46a986b15f7bcdd3fae4fa24cb02da9a4d6c458..e4e63c7468d808e924c1314e0e29b1a25ca69875 100644 GIT binary patch delta 1518 zcmVVqQ=y; zp@?ZAx~Udolx%~9#7`nB4X8C>{IY4R5d>2pExrYTShdgw6pOY?n?j6=MX_1HmP+YM zO1sOx%+Act%zb-~AGVe5`?iho3+LO-^PKbl-E+_X=6T?QxPOGuyEo6#yEo6dlp1nT z!s~y$)L`xt)h_~(if*;6=mB~7o}T|1fOb4>GrM=S5&5#fEgHv8*wcrq;6!T!&gnj*B3{Fc9E0qLz zPnG8_VGpV=%72!-`ezKF>$kKUWu2faK^6nHsW*tqWr!3>*k^^U(TN7a{(dxwz!98m z4lCuIlX)A}*985QY`N>%^V6L1Nb(DUV177QLZgu`ier<=w;+kciJv711N!tV#-y}F>6cP0LXk~5koy=95<&0RxC!(abI;AeC4y?I+VA+ zNbqhSmVfIS>0B2~4FCh;xG*$~_Vl4a`2Nb(SD;}?c3nHw(%|T_Y_6Sumrh zA7J*q21ZGLeig}kZyOPRVi&!S{F=*WwPM>gz<j^4+1(3UG=Sr#}6FnVIF-Z&Rn%D+^s z@s?Y@nCjjGc*epUJ45rbB~<>@O+M9(z2pka(Njdb|Ay6HrmtF}`qysSas@20kfa9| zsDIKuEdVR8IjKwL;|({U>cfd1IQTZw{&5C3{*;uHAU^nSvbV0`#NGoG7c9Wu{B`Vs zGV!Ku#IGJAZwalRSb==%bvsn~luPQ+eqh)DFH*RI1{& z=CyUn!Y8Ni0FdZ@rxg2sv3$Ij;5YjioLj`6SH!9`!0~9j`UaUOCRNN6Uw;k#+g?DQ z+0VegH;LO@!e$Om~66zF!ae3T8T>)q}h34BCUyR zNYfwgf69o|bDE&xO}K^l;1SYmuN$#y@8HO!15q3ig#kg}Gycc#zw#ykgU{_JC4UaSU#C{968H^_i2?9(IpS&!%X4?i8=b+pB2050 zDBpO`8H~;;J2B2sZPaG*63qI^eH{Mg{bb)8CTWkhZMwAxL4<};kbUV9k4a+E4giEs zX1N-pv&5sG96c`ThxC1EqBxl6ROOq<@gfG3?r- z)@_mT;?2#t=?tb?$4+_=XLdcfYbuQyoe9fpHvEuUuz{qF6+%5^=|K3(k@A4Hhf3x!S^l4rtS$rsX`(g88+KCR$#TfN_nQUdLi{L>S6-W-~Qb;hvDrQNs-H}%kBK$k&CVMLHu9iKVE}% UTFBHL761SM07*qoM6N<$g7ifU3;+NC delta 1302 zcmV+x1?l>c47v)CHGc%}NklN}J8%wOGViPRTLX<951u zp3fSPQi?z@GJhHwi(OV#tzS{pK2_6vj8cCznH)^g*qJSZhvMV@!gXvkYt6#i>SKk@ zJcxn-o;M0aDV;VekK5_;xSjO?>QieNG+jq1BIERLmlgo{H7x-Eu$o1fO(uXbFv6zY zY$o6Um`x^F&7xt>K!6bjN~X^;7o*)d*j$G3djBPVJgf602DSp zl*-Cx0gb8P9Tt?nx*o&Z_9M~NKYbk#cpBAoJzlbPo!v68+~7>YF@%qvg{^irq@}eG zW)&g-kvaf?J`#cRv3mgk$=(t4ZuuDQO-tcgw-}xmR-xzV525KK#_@<`B*59EK}FR< zgMV+d*==`JO_7E{`J)#!u0lTD4QXjDoXhLrxTglnpM3~^*@4RUHv<3y+Yf?7;|Od& zgvilffNK{!uBu_d<`~LIps8nPqNAocs9YSVP%aJ_6d1?YsS7A$426$B0PsA*2Rjix z(S`80odAI7iLMD>rQ0|0t!pIM)U)%tr+;I(1946Jol<&N#@zuVheJsG?T2+v8K|lu z+;I++Quy9#%eD-0O*=nz%qR(lJat$$XN z;K-`!451J`-WLjOT<>o`Fe3s0aG-KSYgL}~6wl?;FIG&(t%`CrunSteUZP`<#LE$mpg1rxEt)?DHw+0%1<&et!^CN z9mt6Qkm{7(RB9`+SeA=Cmr=3FNPiNd2a?+NL4K@ZatE9f0RUhCx38pOt5Xo4bqYd7 zHs6S@4@7kB(}v-F?{L7hUF{9&x~rn0#;)_P=bQLt4&LONJQt%R8YSeo!n0QzhxYw7 z)0jD3@m-!(i|jBzXXQ-y0YHM0lW`b%7 diff --git a/web/dash0/public/favicon-512.png b/web/dash0/public/favicon-512.png index b590479042d3b584722bb50477c81cc71f27bfc9..4ddb02342199b81846ff05e3c2de64993a9ceac4 100644 GIT binary patch literal 39844 zcmdpcg;$jS6YjeKyL1cEh)4_4%~FC$2}-AQNGK(>ON*p}Akr!*iiC78At5c&9n#&o zd*AQx-1|@5v*)mT4!fV2cV?dFnVA?p9d$BdMq&T}$R22@>H`22{0Ie*gy7qe|KAJn zjqvG1byWcW-z&HAOELhk0}oV{9{Xo*&AiOCd-76pZ%+DjcJg~bPPzl310?FnjYpn{ z@Q1f=O|(nyy3W3T?_|wDTGQc{yxhlB{Yr!+R%u_Gl1_YxL3x@0ZjZWQWBvZ7gKg?; zy=zH*=IZs5FNOTf6Zy(%v+C5<%}$Czi{M?Guf>Pct8%N-fNk8p4u=09|CBk@a@e31E$*KgLUb0k$=v zvqY`-K!DC3ry9^qiLK7tBP)B>ri54TW*{L(0C7GHlQqYJsx^ez64oA4?_ZS7OdG?1<{*~T79z1nQ5QuM^d8^52pm& z(aj_6mm(c<9T33wS(JpE$##1y{+9lmF%_yLK_%MWI}}jaNJ`09f@3(N7aqL~hyNYB zlBmwtRhejiRheG$7F~Q&o>E*vIO`~ym{;+Rd(+B#E~1s;JK29RUl^tNt0HuGVtC;gW)!DPoiN!hbhCeX6CQCD&T zd4`VhKT?2o5y6o7)aaW61%g*|L;(UmJk*}Ce~WZq58x*>{#)l=CwP9r2;5ecjr|lG zJvIkGBIL6P|2-J|@rNpBA}1`D`hXELJ6$x`xmL^3OyX0do9RB zfdKb<9}6A_s>)W&8DqX~N`15{YWwBD%e_U3^Lx5~28OfhVqdG)SP&mSuw=9@I{)t~L~ERW zw;^u%cFQxA%GNRn+KlPO5__-vm@;xrjF7FG~RC9@}6?Ml`LnBylJiGWxBC8U&ie4~=|#d0Ipri}ZV7 z5u_Z1o6J(8h$_?h1=@)9!%QdM2GT%*Vvb>;9G!X4Y<*yWenv|aq(U5IIo+_3_rH}F zz?CTmqXfUdqhzDTvcX=#<+I7XU!msSYF@>TSJ?!DMlYiI&(&d0ZK)4aXeEhTJz#_2 zb<@rYDHluHS6tbU0qk*=qM+5kQ$3r!eed28lWGksHY1Exmp)JnIUV;&#V;nX*f)%o z)OI@xwEH*JF?Vg$Yy1OMN#*&t+|IUy2|9}0Q{tB(er3zF6kdg;|r<*YYBP~tv#9`4&W7sDml}vf}fw+xb(7?OHo z@3krZ=|8(0wt{vC*6R8k`MTo6_AV(k2<2IYCX$DF;>Yd(n1Aj)z8jv^-^$DqZfinj)$^)@ z(z2GhRalO}1PkwYu)t4!WM6h%XGJK_+!6NY5u1P9lW^Qtf#rCfB719&lC}2W(*B3v zbb5?8BQ5w|23T;wmuhW2Ms9$A!~2Y7tq?l7eU z&(As3kzs&xqDu+Lr#|9?m=jn_t$Cd*(Y+Q{@3i@MsNGmnu#O}ntGFC(5pjA8-$_k4 z6RBo#$clpjqh6VtRqoW-Ik-G|b72rw{?NVgU&=FINQfaw4kb7x)kbZSLjBHVCkZgj3hJ_v8~V%0n0ZfZJiL$ySe>Fn_ujww?xS?~2V} zvR}0^tVJRtS1jIJe-SNp{NrO!bEGjobB}VpW`qv#1cG#t(~+LIxnGV7nIr+IIPuru zsYacaemL^yhv;HvXJQC~4-11rd>2bRUe=|iG$!-sdM`U!$Rgv6NkO}IBIvWY9x7jD zc(3s@FkL9*s9-1QK%@K^B+H3!C9*<(>_IMCuxHXAy}xpBd|ukov01z^CPtPQ8nOnH z|61uZko{iOIq2uN6{SNW{P=?$P1#Ew z$oYg};8W_AWijTd;?33kB;@fa)>r}%s$PHNoacS^wZ5-(6omrr%f$@7wx^6*nRsu? zLba2k9IWp)ab`YfYvaa24jA|3`h{4uz1|<=`8Y>~-Tm6s&iA^vm{XScqh46=S$(Ix z@at*IYf(`>onWPe6zcnYk%O<5P-oSOR&=jL=2}t{JtzzdcVWQUPQd4 ze1J-sT}*PnXGPvZwpLD4U47wwW%UR>$hnvo=v1=I1&q6w;6dut!3Z-+x&AM7KXbwC z@S*?NFQ%q2R5Q{1v$c7_z;{W`EzCE=-}UtEG?&bnyUq?C*i#00vYc;u6RxbmnZIWr z`oQCyX!HK5WO>f($&*v>vFXoGF)&;ZvFW#ehyh)U)_Z0p8MVkqy;u#H6Xt$DXnygy z4Ee&2*^t8ueaOm7rFq9jfQi_9(WEBQ~b+X<{(&ri0ILQWrq zdbHg*jWH|EA`UG4vU)Ii1Gf5bfT32k>r#`5$?A}JXeFtbySzKD$dj>76je%w_~rpQGfJt%WF2!4_m z_hhh=t*bZie|fUOFl&P?tbA@q7^U> zgPMx%q6?gb0|Ko{$$baYReXA&M@XeBeW(z0Lk+o2sX6HmI$~!yE3>OEGf)~e2vPy1 zwhUwqb*?0A?RVt#dDl$xU)d+i5cNs;SXxBsM#H7873en#&D8z9z(`dUqYVZALFI2A9iK=9%@wN92i zMTH(R52vse{J{Gn=Se&>kVw4;dvGLg+|f22lk@~c5wnO{zbSUoO>ND2LFl3&U`Qxm zVEE~Ef!W`*o{>g0+xzWww%A)@V!+MKsv6CfY>l?e%rM(ANp@Wua zE0+?*!^mikk>SDZw#5P_*@{m$z7rsT-fgU;TnL1@AqL(^v?C!eKW|gXN-%DaEc|8I zN4zm)Qy#Y{?C0Z<{UCelTSgD8%&?}Ob0@ge$oRbq`=r;4V4r$x@ zBe1SO9g@;w3|)EWwY9dEL_?%U0xNmj+HUx4kC&nNSG$j5B80MOh>@E}B=5|}mX=WW zZ4u){HY7Ek{A=6bKk}paodp~$D;96KM9k z+)nm=%C47MZcRxA0nFR41V~25Z*RGgCk&spC4gwQu^Fl` zcs_Ea{fV}yj7XBxV6`7&U1iA57^yIbkf%EJ#8~7bL)D3nL<{%WmET0SYoq0E9_1Qu zO94)tM@>^tg^P?(uZ{Rx)u2)o?$wRLb$h6+C?3R#9iyQP*_6P@Od2|Y5*lDv^+9p= z*~nF&{g?96I|Yn8)$HPA0dfh0KOuM9-Qu97;Sv6*un@vR#a!mg#0o(s2?BZHDlu}v zl(unK0v1)ts%-f+BH$hSzDo^_g3+oZHv2=Ucvh4FUv3MjB7ho>pLpgJZ2ou5?weki zw8Tyoqx+s>!3|=LzsX^HxSJ(+JwDeSzi<;ysY!w4cX){YhmFOs)(J4=T--aY<_`KVu$t77xpD)(z94Cl$=^b=k2ve$N;E=Q*_Ps^?9!PsIwHX zM;QuN*gLoPtgxqi&VV(&6$C|j4BBo!4$-=RVs6B=u5E_SW&nyi)snIq;qvzg>h<>Q zh%{Un!MF^t5)!+6=5_;twFH`PQ4eT_a_7cwFTNPtBJnqW77xQP4qdv7=1My%eM#dT z?13+cp^75S;+sj$Kd;KZ>uLF*75HHm0celeeAXXCT(EoJUE7obQ%h!)baIrfsgwUE z0^psoMr}Ua7g3^wcPNeD#Y8I|<&4)YctIAFUV8Y=1G)Db9N0)@lfy;jVc^lc|D@@M zvnJLO1XJy#{T1wbZmp}+^4m^s{Rmmpqh@-WxRJX%{nPvw9hRl^AAS3eu{c8c_lBJi z6rIyj-xt2OyL6Pz1oOSQox?1&Tj>Is>7-lAL*+*b!e;9%3D`C5eXpOSk40>>b!wFg z5b?Q~iBn@9kQ_$O4&2NKmXYHEbT}oqsU)%h;UBMI7%osh8E87^&_j0#znomJ^7!S1 zNNhf!J5_EN%gE{~o8dg~NO-A`;90M-QO0mIOKX=Rs;ymNMA@kB*0=-eus^S*fUg+$ zv(=EFny1j3+iPXsA|it0!=k0-CQ@9(;ZG)(oIjAur(^Doch1ZjYl8#;3`5_t{rf71 z542yT5x@0Xljl{)z@n=F1@CVQ(HwR=i`l+Bvd8HXFYY(3LV%3%BRh}M3p@{>S ze?-7A1phH0y<2zyV+5B^O<3R=A9g3+L#OHP zqL>pc@}q9R+v;~2F%DW)K)Ro1hI|`nQU^Tfxt`CO2wQ4XZJuu_tsX^m`~Qa z+VxY!54m*Hh!UuF77R?Kpn^A}vtJ)V9v`2lPXAo+3u9H~p9id2D{VIY*gfqBmz?N* zB@p7tky!(6W!JK8Dxz@{{jTy2_kWw_fF79d7!ILXZhJe%tSyxJ95+&LyOzpLHEpOg9 zF!=!#Xz35ycxmVT$JhF1phK1E+?T~hY4;b|!bf)00qEB`cE;-Zza}Q%gAifg7VF#o@QuE5)U-fo zTxT9P_0_8-Mw)P2?ilTihPkM}_iJkV1m1e54>ZRLCb|)DCx<3`@n>F-f0WGmE4KCq zSz!ka(4{~NmnCp>+C&%%s31Kz3IE`5O}zQjxu1-o1&)@#sUwsJKf3D;=2wcTyf;1} z1{5g**p(K+lH>K9Ak0@Ls5VuQKt845R?qXP?Ue()0z3__?Bwgd)KL@bE6Oh?CiKI% z!H;Xf@_<9yc!7iUDv4+BTg8WNaH%S?&MHvzVcTy8oxyt zDOu|QTHlRWzqFj-s~fpa*}Ng=<&z4@#1v|gD}6`NyUI_C6ax4lpQ(4ALuj|OSoyNT zEd)>|1&U^5j(rrwMdsuHJ3G4%*&ku{Hk&SExT(NwRo`oPd!bSyhZ8eciv9QkK;2}l zkRSsd7s9!-A`N(y=^lEfZ2JXMVJ0e?sKRa}D(Q07a8TGbB@HGMu}d>i@?iV>9gwfp zczONx<)webT8F@be}ubncALFO}6)D0pfRnEbsG6^ZqSRIl8xYCjZ02DPhm8DN`|xc6TR8ScCXAYA9!kVNy=;Ba0dfaz-Jp&?ERUF5Ruswu-ungK&)1sE4=G) z^`Wf2nwD2wLnT~HImt#+c8mrn?cS<)g}^{jXEw4>eG{HO^#EH^&pa_IMum6E;w()uj%7B2lAMqxm^+ zC0Xy1WZ%-gJS`Sd2)8%U&f0>YkVJyCVK-t?58Ly&&WLi#d~b`ffGBs=G;3>RkWZZn zKB=5&+YfrF+h$%iT&fYRheFJkjyH)^IzA3Qz1O8mD#9AR^#J$`^br0eI5XVKm2L#c z&tL41f(TQkfmDNxEL%aRLX-PzhH9O|1ZchysRfX*Owllts60II`W)vYa+7?(eScH- zMEspljaev(nj}x@b^$FZTRpmL`GoI%rou_(9xp$YX(Kf<8W@IZD#&L#f9%X5sYZ|k z01DE&3ZUL;dOG~{BqliBy>=rqZSh*a@+URD1<8A%kW=P<$972VSN&s=1-nCci9Z6$ zCceq#Zw?g_lfAIQp+yww0ly$9KawI$!DN?~3k*Tj# z?weNq4ZSz2tSSYUXO;;G(<9$9r+UnT<^7;nK=e}(Es{o3vOZ?0qGZw7(G9^qX0xd! zTX6N<+%-6Ps4d$%_|e8s@Q3VFph(BnEpfjwU6F)yi{Y;4^UEZ9kGaDC7^n0tB~liluR z#oZa2>?cb2&8f9a3;Rg#x3pKhQtd9uLhwEI${q4jhk0OrkG5sE8uLvawx>TP=tuD* z?tbpCPeEdLZHokv+xc-V%66up@$|aAFW*a%cln|;LsP<=x+%2fjV+Y z1vhIOb4>88sxTpmS~;0=fznQ@b@Mo`EP+dz@F<@g7Ms%TLdVaTI9cfZ8 z8{nvSOm|%tgj@NI&H~XL46giisX#+PT_6$W6eGy?vJo%ojKhV1|1j&j=vpR4rO_~+ z2Nc}^J(t1Og5xHvRfdwRemjU;^jLhK_q23Zoe%>mlj#-Lolc*rtHw_1hX6B^aL1&f z0BOThdCv~M`4o=aFTGV4Zjft<+j_k1E?R(PmAy1=gtGHFAuS&tgw#Z%9-Ir zQa}hIJXgpyTNA|o!d3buQp!Wn^Fq`5A3NoTQ+|E1P!$^N3q&aQ3Giw7T}hiU_n+H) zscEn@EB~wA`+|!2Z=#__#fXqSDbL-L1KrC$;)+@dR9fJQ+rs5tO#W=2wnD_KC!QVM zSPyg3B1^+_@i&y78>N?c{=0?$YY(`TAr7z9zo0qianLgmn;MtbbS%UX@5ffA(8NHo-k- zWHE5IPrWjKt%+-JeAXr0w1Z4?PM;+qSBX7xH>qs}?b!+38h(>`2Un~VP$=vEN{VbvVA0J>>3jF` zosb$P6SC&QeSD55H2#K6B3SiVg?=Y&tR3wcg$kL)cGFwI#gC`GJA(eC0mb!yPP^HF zh~kAKG|m;pD^(X|5$LCqe$r}m?zLKs^IQR}7oBKkfrnbiOaK{0i)9)(J^A1fB7L&+ zk~LA$U-3lonD#kM@~mY}nZr#D2-}(VX^Hm7(>rBbGe!WQc`lb7c=bqXwBe4jh5VDt za2TfG>s3Ej0ubhP;^HS%o@OW%PD`EeTv$drilsS#S(Y^fnH+c;z7?q}8dv!>l(uxA zWfmXu*yfzAf#pM9c#1M_a$7NX4l2Oz?{$F?5nu^jb5FMePbk-2ooSS{-eaHddsXtd z_%Sy7y1s1bjg_^_DM{|r?zBshm6+NJG?0wX44rFa)*sH*XyHpAZw{pQRX7v1qez5H z6o4%X)ZAklD25C7URuJbDQRct@>Hp!xnyhX(1EJnYC2Y4SApnoPh;3LOT@4eXE!{I z`$u{`ThgXS9B`J;8LAE03fLfG4sbwp_000NivztLZxy%9e&6IC8~as6ye~R>_x!q0 znQ)-7l%`hxvX+R}mF2~h2`uO!hqH|^z!Lu)*(r@;xtG z1kJ>~-yV6xzfyKsw*6i@sA8Xqs2}jIeq2Ws3hH}4!o>hTSjZW%ZWeN zs=@{G{CDf5i3mvmf3G^C6jH==axJkhX^yn`9+KA5`!^-=lZ{(;Z7>evar`~Xz<5yf zlQQ23pF}Aq3IoFw`(9pNc?@+#Ln@<=zfZsDy1v6j-8RA|m?>zNS7X3_XlB*Ay(c+- z(P{MkDUr*wWjRSV|H_CjP&G9w&cICd8UD1OW(mIwB~6 z2GVh&@BeQW;N)tRL@QJgM0!b*+)4IY zYg2i0ZC(@gbV^MMh8>I}Mdk0k(d%A|M>!~UI_Ya2gh z3s@)l*!%bK0tX)>@fg~+7-G$ihXIdl^1k)xema`d)6HdjUC3``1>Sae`o{YaC-(z3 zm*H-FhGHuY-LP~flzLu6OP8HW9Ya`k`kddIa43!xOD#pXH(>G|))>5YWI#ziriVyc zkO2(CC33F5G`~tgyfPoGoNO-@w*DIg3*D6 zBw>_!)gzS7iZ`{;BrP^GJ5R}VfoENlF(AMtK^O;+G5V3*!Ov-VG7u~*h%70hU!-o3;BFLenn`qtQ4yaA=jqmorQ6g|B zCzCn~Sw?UkKx#scv<>ULnnS@kjatfy1lxR=4<~`*5uYhL#bM2A9+o0=6@kRyt{#EGw0ZAzS*mYJY z*dmCqBHqYm)nMx0b8C-ZEHa_%@i35eS*uwMau)Wq8#PA<;C2}+06!+a!9A_WlFBPp5X>d+Nk%L zLDkd%LCule{5PX>Uu(m)OdsRZ{N~QCylelJg`8XR(mMn3E+fOU&iI&mJQD)9pR-w9 zNvXeB@uFWzPP(Km#~ub&Zik^CXZV!mz}XL=h`~u2090-7seXzb+kFDlWy>VvSt=SO z1>y`+IT;I^LO8Rw7r8Lyx{#1f@us;u&o5kx@EeY~-Z2)5*U-!C5U6i@LYDUM@a*Lk z_YTg3`K+CVjL!5Vs{)$0wjV6oRl(6PH#_l<3QX?+0M0Ma^hr^mG`mEi&BcOlu{**n z|6~ABm*K2xYB7}~^xUR8X`_(OPqFpr?HWx_MKvAyo14uC&J6OrTFlZBEEI~AS`yao z2OfFb-z(qOTsB347;Rh?uusnVJmnOEnFl~_kam_$ko0aA%gREe6-oW~jh9|=Y(`gw z(*;`R+o%kt>~0aP=7J2Bd}*or-}1XS+PEfG- z;Sat60e`B?Dn5%ELRNo}Eswsb{9cMH)&&dm5EO%aDTQpcVw`@KH$h#r7MNZN=gssH1(OwQj2$%0-NbNWZ` zR9@ZxKG&1k=QBZ#&9Gu!+fF2aT<;h-xjQfpTrWbj5-+`#ZR>S$_=}vK<+*vsUcHZq zw!)BC8tDTXouNGC-jl+hA0U9vq+JL`nD5l$fNMkp{^2(!K?~D+SIWhI8(;M2_OCm^PtN^upt!AKdsM*`{qB z99b_8iv2drLE295?I%z@Hs=c{iU7CkN?T9BCROiSXp^D?Q5(-366rK6(zt}VQ=r62 zQ~ulcR-}4;z3;Epy$+1ltkoK~Ce_Ki%m@(Z`~~0anD&6kFRlQQgJJ zFCj!! zMNbZ_h;e{%_Q=Mg+-21FlgVST8Nu+Zp8}qvyiGoFhboJIH_GX%Y(EJnpLmH0vbzEM zT`^Yl7~6ErdDc3h70=xAB2n&DP(VQ)$#MHszyaHYF9rFtCMGg%obr51sJ%uMzuTce z8bnwS4F$N=8=9R07Xa&ok9P=we{)@yyU?%1Z|Vg+{Yf7Sh~sgVF3HEBis-rfZT*;K zj)HxCpVx!+#U(r_;1Q)>@9N(4NwlZ;Tz3BIuUXYg9h|Dv(Ww=7!ED!gO{6ZxShN(n zulJ9Y;-eNBATX7~g-Pm%pax-19NI*HmOY1&`LuV^V@%-5GlZB35o3nSfKHe`^otSt zk0n0{h$itq0LyH-s>gNW$F4$d+v_ofaJ}9A&C$=apq^NB9< zSTN-6fR6UlP8G#pEvwl|z5&DzWtbV+Y}8s}F+e!wabWa|`o#Q@;yrHYB&wL^k53U3 z!~M_tY$>*?=Z~AWRp?RH%F{U9-EpQyu<5#@x&&I|vpbgevO>4dRkn^+KexMLN;a2v zK98qT>U-lK{EN3=1b1Fq#{6Jj{_@S-)m?q!=^*D<)3X$t%>DR*TXHpLy+rxUajetP zSyODSC9G#uZ<_<9pOz>HVIE1`{}(%c$c;|yBP6*#*?ZHo5Sr~F{WC3m6<&MBhs|NjO#)BV&{0H4WX z9*^OvP_$v*j`N$Jo!4)55794NnoL;`z#$dm__P^|{LT$olaoaX*%4(3Hq%xx(#)qC zrORx*K5%kRL~!eRE6sC_WNz=@Md9~Zy_aTAH`iUh_f3uX2X1>K1=+CabF*>ng|VX2 zJ#)caIv0Cv1j64sjF*P}aTaVU?qj&9;$a$X>tpP5C-I6sx;zmJ;98oH0q%W$<3BaJ z^Z*aT=uQ8))qmp#J(N#qDlWj;y&79~M_G^-nYli9(wvUS!Prjl#3d-5?|FYCJLdfG zwTYZPxu?p3a^>Cr35jRLW9Vk{vGkFJe}7qtAbP;VX2hyN5&LMQQ%)|*!U#?KOC=th z8(ZWp+F&UZ{`w@Nw}AXQ{cb#2XV^DpA8 z=Gx<;UXcLcQR}*PNfSEN$Zjgw7?b&}6jB#n58aWbK06!TA)$vRXe+p2=h3-DxK2m}D+ z5m(@wI4=6&FB5&34K=Re9~2BZ$fMvSrDn=eN zvUq&wokr-BoCXMY@cd~w>w`W`M8eat-C$vS0+%W zj^`e-|8?>n{LTDY>Q?s9l@4MU{+!^e%BS2i3^cToA2UvLLN`|E?L?cuo;LbfltO;J zC;08IzlwI@AFaCZONiDghE0*`h^OxLOMlXO^zKsW&*L%0ha8@ob3cFnw^cDAQ1FlS za9bLLM=3xm+wDFfkVIG2uE#G1`wII<;vS4D7lkUg<1^0pIXkak>`c%HN$ZZ1K^EE{tpVLQ~`f#HvU!f)%GN|5b!V+}x3We{%hsBIYX9>I!EPrThtNn=Y zLDN1R$a_VHCRns8jcGTAPcgn;l=FzgE-Bx}Ou8os%xRkb{!s9 zuR6u+Qbix2kbe$%)D~?HHc0?fY*ZeY^1f~lfDOikr>v}P#eN~5^STv3uN!avTc$Yu zdZhLWRY1g6#qz>V8l2XNg!^6wlRS%QI)0V|F@80j50Q~0XUu}q$rCpW?0a3~5zRc8 z$I}M&!G*9Sd7}2@kuk_JF^eV0Q7H!l4D@oE5F3hU)+1|~FnV1a#|(BdlS<_NHzr=<(WbaP z8hev2`K5s=POpx-Z&t4Sk<)ev4@9QAl>%@a8JO3!my#=cQG96Ow=0lF>qDrY`&zY;y5la}i z)7@^b-!~Fu61U+q{v=0ef1yFE;2BlPpZ^_kBawA%@S9a!_WqHWzJFlJhR#x$}nMz>)v6QPSs+@!=e$zpwLXH0od`_DS z1`Jo)1s|>EP|fH6&A3~FE>H0sm^T^?8*O?OqcQ~<7LHuH`+a?c^9lsniK$(?A1g`W6v-|H@$}0bOQp1 zPJV%tBG54QD_yGfGUH#nK3YORVvSn3sQdQ?Ra)bJx@6ei@I<3ynYn%f|I1Adwd3Zu z+9j~ui5LYVjHozlbq&4+dqHy@TS^g+y_pdqnhc?Ph#3eKV95##Zj%^vT0K?!Iy$X@ zzt4?#_}cGMk( z0c`JSnk87oz8pDZpW1IwD|{72wY#lU@Y}H2odpA1@bMa*z6k1;OKnn2?eHj@Pr3ia z8ohR74eu@3o^(pLwA~J-;Rn&p4mvpC_b$Nm0hb9y{+9^*ffS|NAIjU-|f!O-}DPwj`MLk*pPjmB6{-H zpb*8P;Am^Mo8hAO$li6=Zk7p3oDbx^;T@NB-`>zddF^uO23(dnpDZUH$O2szK_+-^ zr3RcL1p=@abLGz^jTF9De&(#}Gi-=8)gbZ;Ii|4_6q(Aon-O1l7SP;J@U@JbJvht_ zGC>Yb^@D>7-~`z!IF}1kpRTyxft6CQhKh=iJMxje%P`CF=!*&A6_X*m44oTaBEZ{ffHfM1c}^?N1o*UEouzD(|9je#e#n*L;L;Oj zOz=E1lhamjY1s3R$yeo})8ljY!8NfhikUx8lu##SEaTVBct+nm<5ThJZnRWVH=8~x zqNf6KHx;l-1!4VtB6t|mAJR85{-pYv%dgMX<~}9t9$Q8m@GTK-m1b+j>eFuhoLXIt=1|&oImW>eXdy%T_#B z^wd1gDY5BwKPIs|=rkvp{{<1E)3mQ9l<3XNnzgD3_5$?!^FqUUrV2XEM5v?kHoNF= zAOLej>3jcQH=E4InA1^SpQ{9Ybh=eTq7{!-V-9snLYOu4te-nJoI8oYHani>W@Sz7 z`y9+7%1&W9Q7*ZTF+0a^ntXUNa7M&-rrDBH(608MWx=dg6+gh;qH0!M5R}@|(PGT6 z**)&+%z3e3p}`O4Oo0J8J&VJv$RJtz+zuH`(G&DVwXHo#sX`F{T3US=Ys_lLP7}o? z{%R%4mt_4zLgjUf4h|Iw#VQkt+z3Sm2G2&1b4olrXznp%S^#pP)O%mnFQIRYnH|!( zrTPJ8UGuGhVMU-fsJUs$L6qXc0FiWdJcjz7_sgTI9fC69A{n)sg&cp{xR9*~=bUOv zpvUjWl8rdCW?Wrsl#P8grvRRa<>kn2b^2QA;DxXd6an>yQD2R&z`HQ}so3nZ`h~~X z59W)(n-hy^fB1w|OT;#t|G4#fFy}1DPwKrm0 zT`TooN24BM-eeXo#>34GTzAm9SJarVi+ZI2lzR_3QG%=dDdPmC^gkmk4p+E zKRnOco4?y#RV7Pn^tc~+u50>F`>@0j{F$ng-cO5>d;WF-8Ts7#)&spL;=6$PD;P%e zv&(O46i+%zLsE~go)l{WvJ=N*UtOZ3mfq{ckt@+cV`_b*s>&nUQ??VE$EXd#w7*9e zT7~mHQZg|wR)e42gfmZE9CzegiIce^bX~GQTz#bqnB3{x-M4W&S-!nh_y9|l2{8s0 z3~_sEd^CsfY+Rrk=RMjUI_Ps2%w{D>Z!d>9#qnC`KhLC@MpSs@R|l#V&&=+I8mh$3 zWp+bQ;+e9$;dO`2;jH&Z?&HqqypF2w596p^O>^fxI82JaM1PXoRk7ENgHd8uJPEBK zF_&qk(Pw(8Ny1{#3A5JEpM_{6nE=a`-v@ zH5Uh9$KA>PPTBnYls}~*_d*6xBPRHcixQsc!2PCJ2-?XIoTBntuJTxXrLKz;ls<=1 z+KT|+oS>`@e3@D|ehY+tHZ=P@#|7>d1{dc7G{^;E$gXz@9>`_&FSWj$mj85*!6>+z zrw46n^^xAN5cpTKnX+LN7$kd}`+U@B?C6422==%Ayu=E7-fRUa8oiL0t^2nr)o|=e zW}%WMc(ttfFr^#FH9o3k+t&ES7RzL;P%~Sh5#}jz~nBxDE$y?P>Mf@MdgY6K8l;Z zAY-m=EaOH$^Zjo15ahp&TQ-U*LQ4L|d*4rwIlT6{kjE!;yAx`%NCfbZ$T0`&)2VtuS;FzWW?!oq404MVu?QWoa5(CLPNI~!>^w-%Xxso zA^(@A-a2^ihV?hxC+|k#=aS6bCvqP>tm|ub*?Egq8IjlO+sGyyw9cj)w zLS`TnRqhKtA}s*`T6zK4S9d`;ZEN*5`kURYQ@3ZAr^#iv;qaoT=>pnSfMcSfTE~9R z-7rg)C*D5>+5hiERHagFT0(|H9D@{oC>i6 zi)jv2uQvfkWln=q_i4hoa|Sr&!XEc-`wYwiln7{tBZbIa3iSlga-QMH<$&Mtp{EVFbsDh~z0sQmPop>Gm=PH1mDnVsf%=jU5y{r6r!&Jv#L}7Jf zLBZGyMZjawj&T&>5jweJfiQU|v>17chjrkWzK~g{Co>vW|7lSW=c&if`J$>|R0lQ) zOt@75dZ-@+p(m;av#6LnrRq;pVFIWzI_Q06%1xt-=j(qK?xl3NxXw+1_bYq$m5ZD= zFNmoB5W&P^X;L<3p=ZE?O1Omhb6Z7R8(Db|P?R!}wEr05{jb!*ejVG9`q_uKtP1_o z?8iA9w`l>)IuCx6JkQ)AS4ldKY@Y)~=LzT$xag~6v;XyQu;0icneR+L{GpXuO`e2n z5O)kQygX^n_WwPD^MmGZD{PCsrH-)=2Sd*BUG5o=bDS!z-2a;e*rjY~x{NNx9o-pB z4s^kJ1@eV+=HSr&C(p+6JolVbRHR3zn*09X4!e!hL9}lfCPW=x=}*7#p)b(;K5W{l zQpv-+rzN`a?Xx>OHTfq!^Kq&qP+Xmf@m6Jyo%vtPouVy=H&yNf57#cvsMuaGaxBUHa?eH(H7$W8vTdji`ts(kyCdxpgnxs9HR*cw>>JDu(8j)=PG9y`#dNYz|I~x|?X4QS_;NY@PnF4F%hXN3< z7Uw4ObY{eQrz`*HW_*5bO4zgPn$rG@5qIoQ2%Ahg*W8Keykdy)@#c$sq*Z>22R%VX&z;9(T*=%Yhii>ML)s)9{U|M^|Fg(A49+ad+kqNI;u#IWqzo zW3T~fgUFo^s|nQFOjo{gX|5lGrAi(@rTO|Mj$u-j$9Jo5xiJ&<-0vo|pN=pRJ6ayr zA|n$`J}wrpg$8!*OF-=3&%$sy@;je}_)qS@TU6thb{1*`e{qp|P=Imo%bvf22+8P) zh{kH-X5_wSD~QRxcvq))?wt4VX#*bS;2Zt_IKZC%UHoejZ3Hj{8L(x$ceV9>74igM zSh&6!@Lfy)nF->1+?NR4*QiYQS+uwJ@gLu{1ROW+${06%Zmpm#kivZ4JPn5@z;Fa+ z4}S@Llg0{K&jD5*(%ra!FyTUK;9bZ^ z?v`ZU>Hjz>V%fCpUfCZ3Y;@@OFT&H1ja8vP-!Os9g_!9=lJd#6{VR1fO}+0pe15g^ z+f|^P)iLEk5@8Q`6MS5JhWMND3DC#R5r1*aY5XZo@>0B<&=iRfT!}htz=)2&XsZ)N zgF4qk3aC%-Y4s~s@kJxhV-?xwB%%}nyh_6Jjks6*)Or&K@D$lJ_IZJ(#ajCBoB|-# zjCfv4$~2}+V5Tn)HBzKpZhi#-M3MX{UA%lhh5XzKw}|YeHK~qE#5=}c!P;!1Vwf;E zo{)H=4_wg$mEu?Tar`&jiqe&c!fw%cF2$=FFkLE@nhR`wd>Uy0@apF@0h(^w@ZrH* zBCp$RA`Y^C7PHb%!Z0J_x>l7y)BJ0CL%Nk*+kuhs#VxO5kc~`$>CSFr_WmrDYF`}> zd#USfx60`81mg{x?w=>OKT1Zfyd}n!yg&A>r2yxDb$tTHLQB1;7l$K*RV8wcmSz_M*9*>xS8MWvue-U~=ebb22LsyFWaS&`8uw)P+@_2M+_CR*)5_|2_si>X!Y)^-ZSg zlB(~F{3Nd!_PFC}*k%7vpfG1Ri3~j@789jijS*e|#PY$s>?5Wo*7%mY>>Mj2_=7Zw zYTg%2iWq9h@jr`#Ur1vL(|U?}`LggRN;yHs186g?7QIi%NE{p)O5e{gyp7UxwQ=H> zY7|^}HJ?iwn3o0*5boSz1rOAHpdKL`ouG!qk1(U=y!+gku#d=<(3&~yS0E4nlxOkx zKHoyzIVS-4z%^cZx|;@R-FrhG4jiedp5!+tty|g@7}n7UKI72)&Q1|>lmDGz#Zw?_ z!VlNIsOgeg?`*gszhwGTo5>ttB%Crkl#@6pxLN$Yh2WLB2H(H`?m$q>{-Df$_y+~{ zY|r*I@cDF+-5%e&w@PA<5`ZD~Wfdq zx~3mZJTUOLs|vok-thMjrRAK?H`=jG=%d_+;rHI}JUhd;eR1g~XM{on_ta!6_fW!p z7*el6vJy~k5J3WLPtJ?Hc%Ihkd28o#M00Fd5Ci-yc*Z!SIO-z8cRfoFqiKTsA9!CDar`(aRY1kEYK3?p` zVXNDB-&kI5N9UbWnEIiM3gR8n0B`8fXfjZ-fLSbbxUyL%6Z?Itec7vDcQ|@n?zD%Euh3 zkfJ@z77*j`kHnr;1I6fH8r_U!cY^*y(ST3OWX&>UeNa2?@b`PSoJ25TF+c z)qIOes>O$&2OeIH@;};t=r~E7(*1b%vOTk1{B|W{`Er{{^2l-5%xfnH`9hI*fQIW_ zfF4Wu2rzJ0l)auVW8g_<^dTrYFT+s(@Y_(-l0V9siN;qye{HT@6zBmHebu$4_g_B- zTmkT{KjGgPU(LX*Hl$2g`uz8cbiuFQt=r!}QJTA>&;Qq~K9t ztt$5g69Bf?ND)tf9W)?ApSJb#0<$=;6g@DcG)N>N=tMFLzcqyjgXlNm#9}f6_wiDD z^b!+^P2|QNTrr2NYQdM#y^pn(3Q*Pfj%m_ztOdu`7_vOvX&2gVdp&>P>ma3M=fs#>XwnzkR?}+J9}PK z>N0+Pehb$Rox=GBdeq5!6bzwyfAdc^_5ODB*?)K)vpJv1zr7==(%(X z%BfuyOcETR=0ePDG7aD0eEozSm?s71$>tonTNp=i=G2vRKbB_^2apyIA8>*$xiOdn z(3Uc9ye0Z=hc8GYSDzV2$7=eYc1=XP{I>;}*HFB6Q`Sz}Si2J@(rIEqC2*#iu`<$h z6n>1dPd-M1x?;16(17PxYjZUy>NhBSM?n8|HPhPKP~@`bhUGXj2uSX~t@e)t4UZjo zMvX6_OWRAaImt2kmXuj9U^(*4NCb#4_5R}e{&nEJ7+{IyJI%-+cCOGs*c{0kuL;`a zVM5P>_oRJ{gREWOn&b`dS+j9w4dutL3JB-SC6Bny61o`j9l$7Xn*8u;AzUTYT@XNL z3%FnYAbp#Q+SG~pa3M)AaY@^d%wieEbMqU)7{t%rpPu|+qQ#A6KA{zr#g+lX{zyKnDSDK|DZ{$ZW*+H$w?{${p$&`7nhbir=6U`2Xy;kUyU&Z3R}98 zctc8Met%`G>tAW7Cj`stj&O;5?`)btj;jDN$5op6Y40~gPhSIqFuat#Um;p?y~e`U zc#ZKceKq?07K~MGn(31OcL`nCOWC^hQ83y>xf_le$1>Lc6f#W0Ra40J&_2~Pkg?K; zjj0T1-H}<##FoY(x-u21y@Z_o4xr!iIviDS zHQA;^6kdapH@Hi@*DJ3KwRY^6pYI%o(1&yu#J>iarNf4U{}N&C+G)9Ijq| z)FO8hD}2l5AuOw=IKT2Zu}nue7GuI=-pXbZ}+X8@VPjE zLS1SD>0{6rLFpKVt7jAJ&QWuo{3Xdtb!4gfKFR5|QaG9$Z%_e&O_z?l7l2PK#34>} zy!!_B@%}(1vYxjeGuT_ihg(|Li z^*u|tWb<963-s4oNCyt;GYR+%Z^M0!4{sWw54eqibloTm-?vNO_5kj$#6aErwv+hmQqgoPy-}r`lR!~@sR5|1obO^ZXs1uhuKI<5^T#xiVuT7Z3 zkK`?ApCn_GegFWBN@qeILEWYt!^?BQ-RB=uXLngpFyo#EaVP$}G5;OqV)l%0@3^1U zHnvU#ipGC&rP@@TfGRWja{M+)L_G^gL+N4RK_0LgM~}FpW2rfuv1?++2)wg!CUYO1 zXt7gV>xHc;gr0Pvx5A$3=re$;3#jXk|_;#7lQ3Q4_v#%Mh@oE_|;GS+cq5?r6$4FvEjVtc{nbrkR_IDjdXx@c)@^ z%wX(-aQ6q=?%^2-MHTu0xY|{^gbR07exuMg8w%4UkE>4H(#d~3HS4&q>+bpB1ta|> z5kXCpPzRX8iGK57(ji>IYUqFIIxVQRb!v`zu0Bg}jM;?oZV=;;WuV^XpWq zxs@En!&!U>y)J9j&eiuCH*)yX5gKovvP3^qJNd2A9wF{@6UF?d>s%#m8l;k0fv|Mbqe&c5Fj{Dd53*62y%%erS8 zbjp27MJ3OL!UN5}(W2OL-TWufP*p+PL>8jgN9DfVxB0!h%^{Sm?8SK{n0EU2ur{Dw z2GRV^Y(pUCIt9r7sI9=+Lgpw8^63KRM$Hd@iNwCpZz4W}`Yr(zvN(6WkHiq=z*#+v z;!aF$9h$F$K6l~u-pG+yIwBx3Ah+_xn~judiRfl6-8pf$tg7gM8nmpj1!|=N!rJ z{Ij))_mDkJV49Nv_?v|`QLj{ z0gSa+#|e~CPwCtw#qea9MLqE`B&h-GVu4JN%kC^6I}nR*FH(VlVt{SgKG}1&rsve0 z_c6Tv7jA+;{`cI_yM3%rEQ23K5$-83guaCf3&r>^iIG3z17b0JF)5^Epkh5QF5{z# zvFJNK2{G!{C~i$RMjE!Up1yud(Eq_CEbhWnE`(rD?Djok)28OcYXArcoIJ2pI%Th- zQ&G@0)550afcI`zdsf3u=#&{-PoMgftls~udqm)NBH-ky@G*qK@tE!_tC`?XZHxG< zzTtQY^5ri4U(I;Z$5dI~`2xD&pqdi&C1SQX?dZ`Sfax0rv^Q_On*Q893C`YCIpO_% zeVeVjbDb!U=LYzV+WPs=%^aUkH+oNN3kN`QEq6!sj+mmPqE9MKxCUgZh5fcMaiNZ^ zQ2b`CEMHdBVs_a_$UxFZgpsU0h4m!JvofoPnx&Kb9q8`CHqzECDO5joVU5vw(*+;C57eQ) zcG?LQcpW_(w23sz8#FV0(l=wzl6Y3PfW0-a((^sZ&Jm%{DehX=&GQ#=cyWWF7DiyZ zr%|igw?T(>#60J1tk(_w&8zEk)P?;6JuIp*OmNXVA)!px+_1%pi zx}m6q_w8Ty=qsKf4E;4E=UI9?pF}IMZ1&Mb^)o%+;DzQTuri!)bmVG)gNCso-atT@ zJV$trKkhF_acNXwZ;URZ-?dNZstW;#jQ4wFRq*<5)1uuL(M5!5nb=S!A`9Q~mSMQL zyYOgYTSgMK&y1NU>PxkTtv(=(%m0LRw+*4S+;hftX|t#v6vSo%eVU(}glDWuj|`pU zG);7*4^vCT<(wjjQ8Xm+M+!Na<9B?!vO?>_(Xnp;8Kjs2fxsxiG zeJvaj_IcmDjM6zCh5i9F92fibComlks0bDf;BFn_PxSMb`ciYMhz}?7n@rgANMm#z zA&E5h;<(G}9^Fh+cq;wiXmpz9H~Df!2ydq8)a`#)U}0OStK$cAeL8vuiDIia0-4GMbmrT+dUecIY3sgT=jF)4y9t6rQG-!4|UDJo_iM3-+l03tKkcIr5DQ;BK{>sHnL5 z$TQAuYh*PzgJ=1E1Khh1t}Ynp-v{~SOMo@qG z$VCwI(RoHy^lZLc@iZYP(9`pueGDrDsw?|ze*q9wm6hfXYN9Bu;{a@E?qTI@JjR4x zl)Tco__;3*4Y%c&)aN8u z>A+O~>!C;D*(Dd6gH;$6=-ln#mBFBd=aj0>Cjei*v1bLJ$$qHF6L8DRWPA7r z{>qhdEFOM}dsUB1OI|(`f&wC{B=yWmFTPn@j88jM-7aN+m_um-&aN8_-V`&EhuM+K zwla@DU%J(Y-e~wE;l+r?V80BzUTq!0o>E73u?nm8wVq8=*Kox+! z$}#V+%slhQi%lmf>_97#)+emy)FTAjk`scx|jPLH^1THdKk9Va;6R(6Xflb4FtKMG6YC|25jp=2+%mx{Su zpQrN!36!7{)sh=K)-5~{S&f>sB>UGT<#vaP=YLd_SNfvqgbCF~r(i8>befx>Iv>5U zyJa=WnvD)dfYEgk_oe1m^@ZJ6Nb1w}Q19w`*1z$S+b05TMb*{nb#O#XW~zGJhp|Z8 z4AErjKGRoPYiHqeRRi_i_e`jKhMyL#bn}Rr7FT6X@#*>}n`qEt05$8F7(ts1uGF9V zq<_2-^mH%q7&{2IfB6{ymF1TktDvlqz1ys!C!EW^OB=ldM#QU0C=y`Ik{ADz?q?hM z)=i1+P+J0RZ@#~iy7=F%gnV_(@w+T%W^~!PBr%Qm9m+g=sc0#blgQUgYMxmQNS*y|3DDuf$!p zjwNQAus7`N-eb^btH?kmPD{^1Q6}6pOZ+U}*hvfFmZe5zSwb6+*pPTe*}cbvp{ZNC zgb*Tm)c5XC{bkJ7Dj+>-YKiPAg`Cv{gN6FlC|A2E``gsWq^?8yty@E#n_WU>x!NZ5 zsNU(@_-7%lAyycGe4%Oirpwtq{0!j$rcQ|8BNPm?bABZdDfj8fS0*TEC?M+YC11gI zGM(JwDFR&-;~UMGg54>>mE;pSdae&J^~C4}Com|1Y@LV&6%|v`_>~hDq?p)`S&#o7 zC6Izo4ffIajG73+!88hVj)Yi0*Dyo84(?Mc`bRB#HSQTNIs#eLc=is(BwXJ7aJNvS z>7oz>y_pHL9Y1CnAi@if?z{UWSsZ9bF|6++sbV_6_^Q^O=GU`g;u6e4{U&STJ)Ma@ zotNWdfFkmJBCt^hWfV^_*U3FEr&I7w>i`{WLcv4PrmW; zXZ|8$=HLtMMyB@L#WuF0yWiSQu zR%x1eD@c-W@@HQEhT5`9mMKsO)6%MT`l`#p{oomU(ceKo-%)|!BrvEKGF|?wsa9D6 zJEpCEk^@Rl9UL4=f3b*z-k7J)>RJ+?WeY7FzlGeMGY0!@r-bN-FxC1@1l#k%mi^aK zM;OjPv4jQU1@wKeWqHeHvn*tGxQOSWXg%MQiQO2){}E3Apb){INRd%Su0-=XzFG2O zx2*k|6RDchlu{w#V)6iQ5ua{E8JnFyDk{Uz1ePGMOg*e`I8LeM|6>8p|9Ft>P&e%l z{@SDbST!c^8&A#~icnj*#YEnAf&XEJ$|;mc2DlMgt1zDU?P`ccE!g@k!a zT^KjO4rC#WH<$Pgy$n}~BmFChCsfyv_+$8(67;PmStR`dcA(U5in#$Rj(NcRePKzo z5RDPqQ2D1Ga%IxiLO;!5clS&GVr9b@D&b-PJXz**7Mnp_bqN!x4|@Q?rl$4b91$~v z{TFm*)@!56J=QSpJaFcUml=V(3)v7M-tH_iM@=u($D>*-ntScZ-Q?*ba2qK z)N=GT?9q0%`|;s2d~EbBx@`AC6dVzN&Q#O6-GX}3s?-rk$r9QIMV-c>BrCC%d3T&L zO3I{Xf+5WrTeNQ-AyCR!j$1Y$uy2B4iWk@qu0Qp{;h8_4y{vM;vwDRs$uB`sTUSLR z!N#WQ`c_qOd^Z1UrLR#~Yhev}6PMWNfrP>5b3qS?LCv2 zYR6_be_-EfC++8>`FTD@=v7Fwn3b&SgxQ`v=X)#j3c?C7M*i1nC5_pfQ07ABbd)uIINQlFMd!AgOFBEO z_m+Hce%%&1iD=+8k{km9&>q|h_rRi7;Y<+FFtbV8YZ8^9j#Ngp2!V{v-?^vQwdjhb z9{9obRZ@tb!skZb406(;lB!NOP-ZNbD7W0GyOK1ARibaQ_p5%$Y&A569vQy&C?v4W zxm~S_rjhj@8q%=^f4>=()4a%+gvh_eBwmil#VQUg*)<)%Xl@Q6#*)S(gB!&Tlx_Zk zCEgWUtfKGEhLH+XV)dYj>fd9q<<{V{VP!g@%9zR7mv;ZtF(4)7RJC-dhJemOkq$vr zJ3AR68vhT>6a*vFYWvbpFEz@L7k7ly!~>Tt8gf{GHdIxK z^->J66g*!G{)JB0?ewECg!>~>i-dAtj=W^*f&@ejH9x(bn*{$9@wYc+-#sErHKTK! zlOFm~hHOoZ#O^Zdha;wi;$yJ^=hnxtEpw7DWt?ZAR|Ro;?L{bNWUho4*AEPpmG(c| z28(Sl=VVEbQmQFSfI?}F%k+nSsFZA%bR`A&IKBIniYshVN63nZdI!)FN{;*7lswV= z7FXe7Nt-&jX`8E*W{QVKIlFPHnz`~b=za6cOs$IpJoaeqE5j|2^|wtN30tSrEVkEA z+AbeDWk{L1YitJ(9z0QtW$qX6dkBIfznpsgrv@ZzV3jVh;_8DobhR;3L77acqP%@_ zfM$QFq#?NnH{VzE9|5FrFUWsvoF?Ix_9RKO4e_I6cPEZHX0J_flv9qj7UB%E(>Ruf zcmq_$qiGX5=jsmLrkCRo`r^&Eu^n9MW*KaX1_+o4)OIv^8^;3_!F?)#>^g-?C&Oq< zAvKoc!wGP)<{yXo7ta$v=k)N^d9@!zL~%roF4$FkhnsL$gjDrVk-l7>Tlu~|c|wGc zLvP_~fX)~)IlCfutT(8c|81P>Oh83(@x+i8x^?p%EB>51V$!$9%V9L1%xj)EA%=71 zsCAKn8>68H8^Ojg_5;L3cPj-js(` zW@fnYC1{@sk^P1TYwuY{P*b^4kMqF>&ZSAkDsd*|3%+&TbWTx8-8usB_NTSUQCyU& z;%4HTcs>N>5Gk@XW$f!Io7&Uw#8Tia?zQ7@Blz(wawAq@*ey=*$IvGpK=2s7{FeOIm%8$nGwvh6H`R{ zyroCnfn2dJNDwu7Q1t%9eD`m)dwY)_hZN{c6NTVoqpQiK;b6zSx<@H1&pjb#M((Uu zXi4k!7xHV&kEHXF@KQtR2{SyoU1!9pDX@pR4sbgg4xh->8Q33pY0+=VK_K}=NFs5l zrBv`2d`T@=hl@E6+=@&OL;s1n>9T3gCZx3Peh_pwz!Gc2c0NLWB)dc$%}!t5 z-c5YMcHLGhW*hXDye-)qa9H~Ej0t(36sMuGci#;l*Z1|EPWkd|@=Mc>q11|c@iaFY zawf|?jo$ITBO^`KUTyapLb5=c%uM|IcGOcH`ai@w82T0H=Kto)7>bEOyXL=OyuH)_ z{74C}Q{}U)msDNmd(YO`1puLITyS{lDO#@OB7h`BC@a)^<7xSE2X%;HVK&spoXJk= z+(q7IfYj$8 zGKMPZeR)z;m&~QKn&LIe{$9e>U5-wKUcuauJ)VN%DRB;Y@9-demsx9W{?F(c1v)x$ zgP4$?6WVgMofF5ssK;rot`#E|dP6S1H8_HccAK~v!q562*@2u^gqBKK;mev8GQQ72 z+_rY%6H@*^|4bAh4{%~i8%TvCVW#n{v4b|;;kF(5CtRLq%k_l$frM$&!0);Smvo0D zg=(bWJ#$9u>XbD343cI9L?6z^maBnl{-(xvp={4ULV}F`yZvzH_969Px_DcNKQK!H z+5PptDys7B<9?)r!ZoT7IbG*3gfHq)*rF4o8^TMF)$vZ#xZ&FKv_So($$ZSPJkm`w ztgGR#$V$^ZHyxt5Xu7rSu1rp&>t}FUt4yV-iQ1wU%2iGYj&53a2%D?pI4CiR} zB4hT5VE)eZq=(aomB$a?pm&UFunkPje*MzWJ%;y zN!qJJ9Me%+1qA2^umW!41+3$UqyD&AL1D};S;UIC+4CuShCy~obvWAmiex>MZ6Fe45T1CT)F zFqgO8chUqPe32l*Mi1z@n($*DVB7*r6@%hLCYd5#5jh&}Cp~9_Sswbx1S*jTAu{-g z%_-rnf^Q1zvyPx2u$2fHSp7wTBPB&YjMz;TnggD>;_>>@33dQ)0bA#|6p?-EY(se^ z?*z$Af40Sx(5UWn#(>@e{-k2?UoF`;RpYBjI^zkAlndg_KzY9fSATcb2DBd?cofJ{GF}dO??H=4;Ie3j^o)aL($Iq^@{JVH$B_# zH;NM7D@>1n#&D%s-G4S#`DVyMrxiy~2s>iNZ|6;3r{&-%tn?NRRFQSPL&3xEOGiU8 z3eGP@m?cJbxV>;DKP1*;F7(=Niz$81`ddGozLLt!hRM{2e{ zuUu@)m14r~K{Y6iMM*Wf63*lG9+8M#o!q3-dr63ooVTHwp{Iyv8?)_&^ylp!Nh{bN zLcV`H!czoZmFN@qsM>I1UphC>S$&mz;_w|?d@8^RBBQP!6lZVDvlX*&vn7A0sZDic zgTYacTR0S9W;?#%q=of6?8Ma_GU)vud4k7#f40bB@d`9m9&8^IGb<-aEPnkjDKFo~ z*3$xW3c5~gpk>^9vY18j+4UY8?m^`UwKq@mg0WZ}hvIYvtN7(zC1;_Q(p(n->>_f6 zE0GQhYaJc*=KqcJ%=GG?XiMFI4L|zP9({u}!MHqCL{ht4AU!1K75RKUlb1D%?-4OP zi5J~=S$9L2?v45Bs3D%7Mf4hFOPVSSobcOMufYGM(3)m)xgDqE1b4FWcptTFI#JLf z(u`_987OJK^uYP<5HrqoC4vvM+CE`Gfj$ZN5|R?~$&gmG-zQjROwJx;-2tIk5e$P^ z;xgmJG~C_5zQzACa+d)5!FyAr5I%-~^%Bd*HpO8xD=E=9iJpjvx18B-dDN2+w4RK` z+BDs6QfL;W=@4g+?Kj|p2OtU~^#Va;4cvIihU;-M1ru0U2@cEPo2xXT_vv=vqOVd^i#QkbPa@! zzQCFO=JHWpR1#8Xfz)Dey7WC>Dak-(7S^*vJ{)nN$~!dc-xr!Aof?JGiZ^DLh`c?w zVai9nR5Uf6q>-K58(f_l{uKBH;gJo`!pYp5Vl(D1@d+BtaOhSk%Jy6 z?h-dwTFs!RTyFpd0qgRRQ01RZS@~v4=9WR9%-@>Q_9UuZcSlkK804`gj0Orw-Hl|0 z(-e5q!p&@INi`#3tf<}iDzfLE-T$3oQ%7?z3*kA0@$nzBrYBK9E04I*d##*}_3~m$p}CIHH2}N+eFy%ccvEJY2!lDogiqOU}jmc*mEkImd&bpE{5e3X$`*<8tdQ(A3D~ z5M7#G34%Jip8m~aok4e|sMzPfp}Sp(#oU-U6>au$e-8#SA}ilO%S`k2=U>RR%c6JO zu4*_REBSAO4c==B)LzJz|BRSF=$1jc6q26Hmen|yQ47k!vsNJlDw(khNeL?|UOC5B z|xl7`cMl_cuCME=50vHb*DQQF>O8uT_3XT0(vgA?tiskt{|##u4)xN1UJGgs%PC11 zrnaxby^b0^G~V)d-*j72+)oDZhB#QgNOEFGIUY+h{XisItm&C?fF2vLD-UCDv|$dv zMH;F3IMR-==pTh`)*V;1BQ>7bKGe;LK|MOlXzwmO4jI530~2DhvW6b7g@Oda>vq}m zeCRwfVjfJ2a4x!2EqB=bgks(ZBMZuJ_{Seo%9GZFIv8a?*>d}+A9A=~WCspUPayMr zOB%XJ0c+%SkPpq7zq1AVttWw5m zeb>F^;_Yz9XL!tbZ#_48INrN4#&2p2X(L-~elyMs7{-v$R1bCgBcb?=-%vVNavPA1x$L(G%a&h4axuYggq>Z@Hgby(CLb_p=yE}|#P@~&`BrSC3zRv?`CNt( zY>IGnAgZ7;=LspD`S&+SPi=W%BHXgR3P6_EwqB0Bx!o zO3;u|W$JALQ7f*VsL=){DKXf-#GD$6fwamzdxxVy=v(T)mu=(N-wu)B7_x<2@-do64UfKn?KS+mB0`YmF8_cIwMM%6w4o#?OnlUNFeS>x^`; zaog3F``Ab%^=)>bT#yLtO6b2TFj>i!sW}trM1BdP9Htw0nv;yabOZHO%YOjtHx&iE$Y_C<}dM2J?LElf1rc3VEk zFf@}i++@k}kTz+PL8F}1OcWI;!<9yY`}}R6y8)Qy>PEaR$@-w<|DUx9sBNn2q89}E zT;Mp5zYpBFHNTcmdn5ign>PH{mriO~H!*zr`@an2w!Wt~kPpx8GI_-mGPO#3tMz#~ zdqGq}2+|>zzHhX5^+?P5jYNS|WbOS}-75-Q57&!M(a9&7f;c&x${F<+K@*kLvfhyV z#(eoZ1Rmb*1L&WaCqe-A?pAS8<%4QETld5|y#T2PGGkI`k>oyUNP5&kVgT&G;mcJ* z2GtKsVB78$dH7Iu}ZxK zqwu5$SLwYfT&fY?)8>sIc1m!7AK0JZ46=)i0`=(SnjAW^`@-UbzA}1sl$vruA@Y^& z8+LEr`O^%?F`E0Z8U8R8;MwEd29`a$6lq*9w6QV&W|w|W6Tk;msX-XSj7ZBZr6uM! zqZjy!Yx}IW6m}IqilVszNFf8Iev>H@-C0;wN<%$1jx-CY)#-N`+R@47Ki;rR0#Wx^VtfK^ci_n#q>y$+tdAK@iA5Ajsm4m|DYX{6V86 zAAjNS55F$E20D|5)ZIH>baPQ;gMpO1w`=&%ESh7W-#e&N5ER0IN@nDZEBfMoO2w7} z=X=;V$ozyHLnA1@godVn+8yWgA9BK-N1rzPoFE_qGBR3w4#P~HZOF@UFP))7L%Y7O zcJ-qV-$Y_1gQRa9Cq;kWQs_2;-r^c)|2u3=d0bq(p)>ZJU&0H z@yAYC^q%j;^Um^SaN`zz-LPn@4NVmAy3);hXC(0`b%Uh}2FoC)WvIr41O`)RdHih! zLyCF$EQWO?TSOE>R5q`e;3K!;=V0wJHXp1D=d9r0({AfyCb0RGUh-;WB8-MZ5Zb&%IikcI zV?~d_L{RyPjc(1I6K~mFQo}_c5q`r2&A1JSn-cVaZ@Mhr);%LGn9xzqJQ_$PO0RKx z+|?k_Hd8!QP9C=W;i^bo0cGVc)I^4K+8?7UP=%Yl^7D%wH>_g}L{llsvg+v5|dEZc|1L zrzZlfq8ja<>?>21B=NtvcBJ9VbB2BtPeGFd6Pe|O-?mY{hK)`%Gu&>DA-5@h`F2O# zc|Ha)r9SBf^l_yIUy{I$%gvw?F6h<6&%iuJgo4Foh?I*ZfB5(RER1O3YRv?jpg0*+ z?LfSvih`Z|MKovV;d?dOkVZ9Ogd0b!%^SKrYG%YafkpS@B`9h~`xmujR3{z$WtPt! znOmC__ro}hpwI%uqn2n_7{qm{v!kP+3Q|M24zAbC z&72DW<260x6k(F0!G@>wU)pb_sWM?hgMXp1EPzx@V`75NI~io47Li9nlWr!JTSy+7 znFHM1M`SCHoPbC#Baiyr6TY_BqZ!;ne7|mi+4aYW{^@FqUxlXw{@qb29!G;(2Njd6 z5BF1gBRfCG&&13=O3cIm<3V4hY|f~_Q64s|Wb%0UiV^PDzZ(SnRZf8L{TwWVi_uYwyj^)^iOAt69i zU2ge0n)wctW0ep10OX4gKc>d;;X(fq4?_}%)H{U?-uvacIYP0@hJ0f@Q$I{EMaPqT zXXPs!ze10S! zD$uVj)=4vUH0`t)n5(?31r=C&z5vJsqCQAU$-FsOVC7|tIjcGV5tP(WbD*s(z+Y@U zTO*fw05ACRdGt`i+^i6p0#V957PvH-mQWF%^kIw$QRg)=yccXeY?0hcCZE944$G9_ z^*%#!JA+}`*LYmJD&qK>fQ|w`j+T9RTs6*c8Tg-w55eVj%G{$_x=5Q4tq_mizC%|X zX2z8SCh&mj8{||RMQx<}3}n4&B%*8f6(0x%fNJh=e!R(70nTgU*CNA+b<4AE=KPTUyotOUlY zAd`(4^7?E0sNo;0HbIQ5hdV7u6tIEQ`R_p0>Q>smul0>tC+gs@z0TOhCFt<@)Pmis zyV~!{Fw){Y?Jb3pn`Tk7x_9UR)2k-F4%}tKY6m=k@asy*a#GS#7{g`N|?3yBbLj%{Z07xV?UF%gM@BGr_C< z)x9kJ(EL_+iy0mO1==N;7@FdxEn))wDkBj<`M!yN)MRlo@=w~E)l_P2oj2@}S}6~a zZ;t=~Dh_2i>9>$1#jU<~YXf~1q)3P~jf7D{T$7Gw5BQI>y%ANSRuVr(pn&w=IYthf zn4qpBenOwW^4Juy_q{IE1@?1+w;X7@R*z5O zXlQ7BzfKtvUJrCB{Wp~3FCkdDS{q`Yz-fg;v;W_0NKN*70nS;XXY ze1`qAFM2*Q$!Ll^NTRGC+?J*wLBSA<|rW$Xw>~lIwPkPGa4+(pYd@(P@V$FnGVzu}$7HDZkFd_@@7lp5?cAa0)c+Ei3 z3)y>bNZB2c)d)o)2QnpDuDZs6%B|lI&)^6AS=OTX13;edhs;@|vdlEg*R~1>zZUJg z%COqXJLi255gFp*DDy%)^krLC;(@bxQ~Q^G$7Avn8T;I`=F9glNXhc4MTl1(uD==5 zeAN;{p3lX&FTv?`U?Af1Q-Z1oN^3uxnQfTRbQctoW(*?=(P{#-qx1#E=k;{!Y1Q;GSW6LFSKrh0!_clZSB`QGg+MPeoC;nedQXV5lrd= zLV|F3+fPbt$3oD56p|0ewb?S7ClNW=Q+&85%Xo65tVe#0@>5!+wu)a6)$rdMfrNAc zrb-G(KWWrADOk8(!{_ki5a(!|)o4737Q1NLSkd_d_Js7@U=udDRxT>9m&|isW$+`@ zzrUbWoa|@rcd|EUn3`kG^PE_OXa15`v(Kxp-lhsE$fYHm521%G#l+5ywh(}xm=Irv zfd$LAE+F!X^SlpnVTD6TEJ|pFK*YCzd z67Y9*E|LKGwS@+}-+JR6k*o|=V1R1}$fQI17=f`Dgbq&G0_zC}==B&0WMf7y)Jcm} zD-UrVC-|df3VNu4X5WT)Fie>0Pn|j;YjyRlbrOI2Qc^Z9H>1CO3S(D`LbV{;8>w^D zRJaFwHcp7%hiGrbd-%S%*NIm}@?(a9ytzAa7MIUd|JU4gFv9gc?bSC(@Y6dfIw3^w zH4%g$(Sn2!U9h^{MG(D<-lL1?B-lmt7Cm~m?26U<^1t3s@!k(GXU@z#&pBuAoH>%u zy$2(!fr6766>g>D_d0NjH;W!~g*u=iZs2K4b+d+q>SYcer<*iYC`eH*fY?TQEnm-v zCzqP(?d}CKsw~tAPk6Iy%gI6#ykNH7^*2*sqmiJngAJ3O-Wh|+2}#eG5GH*N^&pOP zs1*f*4&K{O8;7bg!IG{yl{QdV)2)c!29d&YN}Li8~>L5-P)xFYJQ+5zfvj4 zFqUoHiT&;>=kK34jx?Ho7BAf4@R~+Yf(T@v3eY@}=s#_*w=Y&DG#X`(gkBQc3NQeK z!NVW!b=~KpGJs3b>$fCI2i?#6z;S>dNhrMR;;88Qfgb$E|De%;wONHb z!n4$aAktFuV8Erp=ZU0MdwT+i@dJ0uc6*hc@rCU)b55+1AX&3jaUKONJqT^o%!GN2 zV464jiT{mep_G%n$!o%tMgq|tOXIT8ojmGAo-0lZM@qXyAO?7t9m(J; z4B>NaXXK-IDNcFs6mI%Hi-xF;aA|~AUw)&vOzl3~C`s=8c%ore7r!D$xI+6jjyVFR z1NVQilt#m|01rwRV=<-*xWdNxy$4w-0n1BhLDc+7mt3Z^+19ta?*qu)Odmu9%ukxp z{WAAun>n)PlAtCxk)S5TLwhlscPBLg0~s9v zLKfSjsS);IrC%*|Nt=xq1OIKMOx1Tartzm~&Oe7b?el`72bNtb}Sx-v9Xa z)XLPmMaGTSV>0odwx(Sv32Nf^JLMI#`wue%LK#myt(rP|1#_^QS|%-CWiR%i>`5P- zIP!JZ1-eE9{63+#^1=s+!s)BU49McG`U1)BO8uww@wkRjp3Emol@z`2tUK^vlt;6a zlJvUhrVr*laVwS;(ACW9C`Dm6%uaBBj9BNtJOLMyVj7F%;~e=AoXZX&t3K&EIIO`^ zup|G~k+1qO)ko*gh;pZHYX#6BlCZq&-QYLj6}faFOE(THw!5c=D|A+$kbpTIbp7Ek z7stjh_0)>qZ2e=e_wp1+5BuV&cAy(X48HPn86co0esmpBb&|Y?n(*u65Hkf+C`rha z47d_o;owP|ZmB0dhwBqqS_ihw;mn8qFsr=hw@B|HT$?l zrgkGOfI(JxfiU0W8y(_rZ3xzX$TKi&yK^P}cP=>KS3_rdFPQsFA6^}?%@)Q-U()?J)pJMS1paE3T^-b#fbk_L!NzR-16iz})j2EBv15;f?9*UBBU_9uJc$4BV#Gq6&kLWGIbR#94%h&KSD$yeaK8Q6^t7um75gurA* zsQj8PNHre8vUr4C^0Nn9>2(6zNVRzX>95zZ$@(`D21t#>#GV8Eq*eY)4>uZ@mV^5f zW}d4?&khRYbjgPO4(ach)-ItnTGFarI2d2d>Pi2vvzK{6E0#Q z8KdE9C$rvtVO&*ELx@F2t(B`Y>_5Vj8k)iunvFh4y-4D;tHi7lsun?fn#JCT^%E#fjDwp$Wdmkq?i zy_`w{#XTa7c!cJ$Pi~{DPVviNlB4>k10)`c%$4|-Q4q&V?>a&U%6E4|HbWT5IqKds zo*{P-8ZRb+40cG`iO!@8U(%mU$`e5{Sx;Eibb~O1{_QzpHSY|R(^S7vg2EASam1zk z=BO7NG;&VSidwFGV-Zxg$+a8)3|dEAu#C*dYv54)QAyj@Ff(uoQe@Xul!0`+zsvc= z10=^GqpuHoLz8ahqHd2BlW|S|BIm-L%~tAJ*Ic1QnzjQ`l_7%TzgOg3a!)71!+GkE zhg;w&ks>LTG9dZz5h)M&ka?1KSV_1L z-lzJwfXgk~ zPJp1oBCZ_bD=FS?)U%RzI~sJGCbj=iI*9SRp4D`Kz2N(O2h`0(3K0wZqC9$7WVigs z)Fr>_lCb*~!7}wD4?;9Yja$1N&nOswK*lzzB1#29fG!mk{*Sf}T@13`U%5R}9naDb zulXAcGv7+Si1CvzEv|>H@b%u|$OknS*i8|O-SYIpK55O2e-INV3lolNLWD@kH6Q+` zM&}tsB=d2X0s_rmQevoZ@bo(8j-30Af{znvupVjh;fb}d;}f@@oGZGoda%`cR@D6| zb*{VP&=X1_4xggFx2i%BI4^OZeYuIPhaF zP05lr(_ZlQh$PyT6b~a`J^fn2f0q=Lzh`fanXWpSr6aZyGMHsfY)_@``*ppp&R;68 z#KY%&KKT6pdW_9pURnWOXwh2lb))O%kx>E%C-?=ljwGLhOj81mTr!}5`C+2&B(CXd zhk4q7fXrBe(>E(U($z$4w4?7HzxiB;<>0MB=x82bf1*gtbS}L&0_uA5@hb0f)b1Q| zYiPJyp6WcLegNwBBmGU8h;wE{GrW?FTCVZj3p~7n<-x@n!k{*k6BXo2Iir3>ICH@{Q+uUq)aPrWQZlKG)~UlX z33=m!U3|au6D<>SGqq@obx)JBm9-l2&TQf$lz50Y%Q5?E^tIW#wQ_=T;cA$CUc^Z$ z*gDgwG@OqtPmzV$z+|+HzED%mkoIHy-F?YB-&%6%zT8(vY6=8W`!kRH6-7aZ+bSl* zKC!#Wh&I^T|cjDKbf2wku7iYhYUM08hWpJjLhwfiH&Z5 zHJ{*r<4Lw2Rh7XvM{MH+-*;!4ffSI+aQO}UK1+C^uV#y)d2BFA-+0;*lStZL-5>rq zKn(K`X_5y*>Xz@$oGNhXEM-7qB-R;2<{EkD+YHenisBeZ>)DmN$xpGzR#DCjX@6Az zeuYFo?DKBZ9M|XDo#jl#;Ib@qBIwHpxX&N;brZH|>I|0}Tpaz~*SL|!2p~=JLC8O* zKQVzYv8*j>oV4HW20@67*HP0u*O_mT^d9Kqk@AHy2LYDR;rQ@td!#y_j&^AsM&0K; z*~L`{qYW7uJjQw;9y(0y_qYFQ?xyc7sk)%BY@NW$?1`8<++>IpxqO{Kb@!8c>7262 zW+iTpzN|$&GlkZd@HinsS>K+kD{O)Od@SMZ(6j}GIld-Ljes-~|n_2r&Lw51%jM!w_ zIO5OtR~m;qyTuowz{_m7VuQu9b z22qBY?tB{vqck};VGIw_7qCo`J}|Bwb+KQ~@Mz?I0MT3{UuybRGkn;j{IIH}!XndO zY1lY=Lo;2-V7<~cc(Gn{+#uRUyV6<3)CHPRo8)Ffd=7@K^q6++))FeVw14lDXBn$TZkLYU*|tD$=yQKa zG}y?^-5yKDuN9ZLTV$8-TTu3TVxpmOzGB;}O&{8H;QYC8R@Y-wc`0l4)MP;a`uZ># z3q6;p9maP|YTLbnAB!otyJ|2rnhTd^^-2$DwkVsg#5~{V9zahzR@SG>9P(#Dw+p5J zrD!TCjdw+8PB%e>Bc#h3?a}IQwRaaQ|1~Z&955pa>qZScPV&cWF4MDr#b?$IvkUGr z2OLx*`lZQ!#PfiDYzzLIIkhm)^mnC954ParYx<z`_09BP_$EU9iPF_X}fh8ce< zuH-nqXqSzUwy)2y_cBdD*%qOzQ(Cd7SR?7!FW3!bLsU8u5nK1O2w-FQwC-l zPER~AN75MMASW(a7@e}({6e$r?%jUmX#2?h8K1=-X`8Wsd8@)*_w>(;gqRln3@+tGRkq0ulOG>d|q^*uaYjdWQi&e3HTB z#%oxWY`{@$%`pB^ZTn6iJgN@6cyp=8?K>-3dr&D6Fi1w=)77Fy+3T$?RA003tYI>~ zRvhC!J?LxGri+S=n=bh@672Qx-L2tGxw)^FoPQsekCC?D}rWaqSK=IW&IA`k*T%mBw*}JrJ$h5%HBBlBN*W;sL=S zuQPo1axtFrwk$bB-$M^uh_s{HV&!nii(C*$96oN2XtSLb6^f8Y+5|3U()fjR6!&xA zyLk)D0xy!|5&v{WU?c$HnDw~bWH{>_XPyCKv0{(C$K2lU9winI8l|-X& zR*j==vK~3S*5T^KxqL8V7mI~8XF=F3Yk`rT7_?%LoDi9ur(=-C85!@)M6KmkBR1aF zB^EzxA&e~2Mgeq?8@DIYspw1dW16W!4ofE!8*e6R!-QM zDj&Z_pjOu#L-!Lnxu3VCNl4v5?;YUPNcgvs3on<6hH)jm&N0Yr@iHO}1cHw?Sbm-6WlS34SuYM2O^K3U7(O%mEJFoa)01}n;VwmMdf%lcl0#K9(UPJU!3AO z3Xp;vukHmuF~ v*3_P)pSm@pl1{HfT`qxMoB!`WOXL-M?No&SST|h!R@vujI;!85Erb3Cpe7XL literal 23896 zcmce8byQScxc35@(n1?i9u2~koh=~j>~X_%qAm2Q;oZV*Jeq#LBW8)m-4d*6H4 zy=#5n{qqCX%vopl?EU2LiMG`y0_q#s;izP4j*o)`EY0{>EawKfz%TVROSn`_mpBl zbl>?zV`rYG*gv*UiXoRZ+Ylalo`T^kAjB|@DM|QFi#UePD25M{-ZC%lOhZpk@7DS7 z`hN87meY=NW24Q2N72FNy?Ywzcbg9jc}0b`qF;vGh9JTJzkm9ce{N3=xY^zCITlCy z1sBs71yG~$iU^mq1gmfKicFp`oN_|w9D;9?%LJ6(ACX9S zK7x778z}!&QD$_tD*x zftvuF;gK`tko~Z^bqitp60#=u%q?@MuUl0vGT^*-;FtTkEA@g8SXv-@RMLnuydKu@ zgkT2!;ag5FbCue(cF5oFbbzX79^wh|Kj*b%R}!yzmM=XZK#~>ioXbIHZQ5;gKgqe< z;tQYK`RlvOvM`ay%m@5*3`JZZZFJ%mh;d%?h7^>er@&xbOUB%OM{3fT{hlxR(RDK_ zlqqGUPe2;&cE zzx0ApP+d3ap2T#=Iq0O3FI`ut6Kq81SN`w5Tw&dG^Vv`qlfsQ!}=w zBmA8HY;zZe<^tM#3r{5f=7o0Ox9r}~EUE_{1?Rs3DPg^Mu!0|7p*YJ9RIRVu*y&;0 z`-6$%dC2?LitAYAu$35r+Wq;k^cKJ9%6uAcMaerQi6*~JWa&v`BneX=bZw5JvE|#Z z_*aDAMOqVY8;McVs7nMcwvzITu;O3*dK>a=Y`WEi*7@S>mHLG7VJitCp6Ti0tqqNv zc|FxJL5vs^AkE}nz8{Lp@(U+g6Ox%G(;p`%aJ=-STRmA#TuU>cHD-t^sfR zFAF+A$3zFESKl96?`(6=1E&~W0k!dMrbTnbz79_>_j8{CW{>0hwIw}kMF4BV+4y4M zWxcLy%BbyQb@kB&p5PMUONR6}Bpxoz^y%uv`$5+}@q91r4N9rF2uGiT)O>U>*qy*4 z$jRSp_U z+jjRIe!W?9`u0VgzOn&*)AMH;)87O+W(|e)xmM6b2O?h%WQ-YIU$wsf+so^`f6!T) zE@oP#IxDoyhiRWNypFiuyn)7Z3W+h~J%|_f4<6WuSVCBXq~$9v%Svzz7x!{F%{F-J ztrrKy)su6LhFkG#52nLnroW1H=OCRJVXT|+V>`DPI(bSfb)vw`Ll3OACo}8qYGArP z49wPKQs|CVl{H!rrxgY`hW`I_GC(>6b6RJsAj%kuxi=Y9bZ( zxQXc{7T;7xVuoD5U_Lr+@sm=v_b|@xH9?Z##k{Oz6;_n+MnjrzK816mM*5?2tP`JI zv=6p?++x`lKSAMy)AD*Y_HGX87h>A)t9?2~hT$WXu;C=~TT(BvjyU`B!Riy3*qjSq$eD11(8 znWYfl7)Xqq;h9@Gbq~k+v%)W0d%c^Ohxr<}r4|yjLswa9sJx7|} z2S-N#4iS0EsPV$Wd+oRG{yN88&8*{1K#A<-w?n4T!@U)!?Lk;MkK%sY#RUXD*_bpL6dV1KM^e7X2) zZ-!q}jsybaBVG9s8%MBw{qh2xX2wP>T-v!E1;(<-Q8B>xCo~RlD*)Jk5^Jne_OIHT zxO)(Na;X-!323z-A`gjTLT>TvF_mA`wF`>Yd`34liOW1}5Kx+ZDauqyq(76-uwc+u zOs=mB^vFXzu_aWQqg@{}ClVQ%nIUmah7;>(EtVdiKEfr@)Xjrrs^EeBNlUro$r?Y4OTK{t0ma6jv$p zGa<4R!QL*lIXEFa3d6SC1OiXq}bM7vhI62va=an4&RYHKU^I@8c zfasS@4cp57f-1!{Bx`!gI|69Xt&fzw+{obWuPX$Cq281e3Dva8Ly z-IUD}WeF#M2;lZd`4y#;!1h&ASl;}v74w=FOw)W#&>!F2B45TshbXs>FRMZfqcxyc zn=rXj&?XvCY z9<~^Kd1Av56fumZn<93GJ)>7kRa;-KB zB8}wAbF?6aE!uFpZ|rk_eV)KvgWf_&{4fFPv*lEdtB)d$nsKG8bZf_e5`NCoLH~&n z9$-_4#isbh+}2uJ#}RpFw|-Gfz0907PIvUMvYYVg6T)^Fiazqu%kQqT z1Us+a>$Gh*>WRNi*#EBfJ`oTYu@>kSwbbrsRqV2lHsU@FcK5asZ4d)C(2bJW zu`qYjo1=?_#rQQR%Sa4m1KGG0CPE?MmsC-&%g#GFky%jixFq5nH2r|7T`nG!?84Z= z4gAPo1fkMgB2==B@vy>p+i8jJVE<{{9_#37G}Jki>ixoBli#vrJqB?D!#h#he|wJ{ zZ8O!q7+ZNPAV<Fbd5E=GdDje^P%#4tPLDv3k5Dvp*o+W*P>;wn##2%W4g_TOaA=nz1>VHfyJB zCGfNVKp=oE7i>gtN=*0`lJr#) zTPpNBphCgP02BBguLg6aagfGH$bEj@j4x+(=V!tEG?pY?sxo^rM)xm^llreX72HS# z;J~)!&&z@ebrBkV3na1e3A7PS15hr&&aUr~{XlxY#rg>gVK1-oF(bn$ig5^Wb_FB1 z)`4ubNOhlmMo{2h^Xm&I!_-z#lZu9CZ8fjNcPx;PZWW#*(J|;8*X!MG?vEROlAZfG zH%@mNsQ{`d0#^W>P~biW~xO^JvJ&k@ZW@9TaU7P#-kuL<{ zkL9_3$`ZRhib5YZNS~k{)4Lu$xE?dO5#75H)4whowSF>!y`&g(#t9)a*;8^1&6aro z`%Y(h8NIT5HBkP2=JQ9*G^D!hq`ILXEgjGG-3j`IvyhLJzeJ$4}? zAP~g&0Dec`g(^u)Hj(#=0AhLiWi)aP6HC&#r?lb&533PE*Ya* zjt&bB?(vyM=6u`)64gULjrt*+;+{>2Uh-zFT8fLJpf!e z@4skW#@|E!Z^Zvg7cNK_!T(BE-amA4g6pe3j6-7rOpZ@8Kympx{)g252cKXK22ueQ zxDQ-tqH;bi`k!2oNmXKjpHcaW{`Y}k5%?hPO(49B8N9!SzxN+f`yaCjpfBU6qJT^e zwg0O;kjYr;|L6FBC;eB4B<-545BvxHE0BNr|91sJz{Cy>Ab3xX(OzfHbSF>R?y-km zA7$ZNRPY$c#O;nbq<(#|Ao`}QktAtQw3#f$|AFgoK@9IsNAWTb`l^->%-OG=lx_&s zC+{u`+dSSW6(G9yGWw-aBK!B!7DB<}<6w-$`FP1vS~}2f*!-pW(AS+*g5xgCn6sNs`z$Hah>{-OPXJej-E$QoK`Y4iqQN%ya#uD08g{t_1qk3&#&bmGJRO877XguFzgUuy7 zc3GfLq0sV3`MK0%urty1Swi&}ER@L@C&MagB`pK*7nXhFhKm5_ho&$loW zJAF*Bjgf5I*mLHNkUa4Sie4Ny`9h}dhuN;FYmgkgh0nK{Zhl>lfIQLT0FpmFd?W=L zty;9124%8s>+}vM0L)xoMA)E62mV7;5P=w;wyoZ$Fnegy5dGPL?2No6=Yyd-C2pi} z_?p$8ufhR*_)nsqL+VPQ@WM_(Kst^dSo*7lky?x2YGT&DFpB*_l?{-fj(pO_5kAo5 z5$%30YWi}2BV47>Jm(z#Op6)~pgTUJd?V6dif{m#<0X*E+~81>?wp|YZOUm_j(V_T zi&DSCtC{?^6V|oM0IriB+L)__6xeSC7)w}FRoCNlI1s%{BYlKTaN`$v_anqI z=9)8}HuY=uhrUE4V$IF`cGEHw#p|hfJmFc^e##V`-3}5m!xNT_Wx?*84NuC5+p4v) zJpmNXz%?@1YJ+g{=*@W%od|m;jcUD~dCR%n8GO)-3YSjj#HltD)V=0|h^9ngS+pWQ zcPlVK*mZ&d+K837K+jY0y)0z?YWTuB3_no(<$GrTDZj}wc0WQ+xR(KI(vb1dQWG5y z)g?bN*fYJi5OYBC>>hYNx9UOaoIT0(LtPp@Jn~k#P6!*2xI$NUm|v2nLLv(jRT}#7 z-284&w%Mk&x&9ndFjUeu7v+;&v{_X!o1&FV4pU6 z_C<5tJIgqG#MPKB9sG<^BWUG07##qVVS(3mLrZVclS+!SZv z#Yk`Hf%SwNHQ6J~1P*LTn1G;YD_qOcNg;XmA$Z&-IiYw;#o)rI|701PpB-g0?ynDJ z(nkX(Y>0c2v_bR6YspUUIu%emWq#Mg$kgp9hOE0~;#N#`H&M`$k+6GH)cAqAI~Oy` zDY}u1Z!h|*aQ){3K-Ehfh0Da>dw1-njYe zhLp8pZ5|}!6-#J|S%|RW{`Iq;O?EpT;#47aO(QooAIa{NNMku{*yr5Nsy#==R^d`E z;y$e1_iWuXfJ53Om{f)6dvGPi1x7z1a*~nKCBij`5rT$L0^#W;#U*qHr{BP==LAvu%^$O!zS!HW zGHGpzb z8q)|e)Fd1^>5^Yg<6p?km*a7o5{kT?BO`)w6(1xTzpy2O(C)BmUzsuZ{J>&`+N3Tz zh+bSp3q_-#3~BTJSjySRd6s#>vCnlt>#_6YSGsrS$&|Ba&Lx<6bmzA$6U%qIpWC@e z?0#Hau>697j#-DbueyavRsu>QDVs&LYsd(*EJM13vJiQchW z0T*U5h;IQ8syRq8ej$6xR^8hnPK3d}?ha_w zO{z3g?cRUz_q_oK#mPu@6OidgK|zI~VEj1f_@NQR_1Q-?63rjUJb5BZK;Pm1 z6ZZTCRyFjL0wb!0J+5P4av|VCbA+YI637ysJek$X0<-qO302kUaO)b{s?82@_ph@6 z7{j#T%@q-~zXI8|5D7u_j@M6GoFbhJ=MDPTSfM4MpU=Q;6ty&B)bot1%!&8JY&}MR z&RcHG5t2qn>Po81GIIqWpJgJorl%GQp}<(~!3M zV*Q0oHRm}-s%Q1Y`*)BWQOJ-I((CSf+D|ReZ-z*m@e?7;DfA^qGc!Rg)!!KFoqX1Z z>2+4(JwIdJ*gDz};y0SGRW_lqLaF5}oT6KHbb{s9Y%C=PgCeVh!eiCeMF9F`ahu1! zv?6HmuBzp2E1#kUFr^M$?b)Z6bRV-}G??{0`@I0GKKv%sV8n}==scHa^?^ZCsba}) zzHL@ub3r~53^(ZXy5ANm)@_P{T$FCN_)FySp63fA7^=6r}_Zd-W4qW6K;Q_^?S2 ze`}?YI2uRYYQ8O7*5Nhji(1j)MNV@;koe}!@{>DA{v({-`y%28$VgA=(2!Im9yicW z`T-5N66Yj6aw~@F=Z!q1`JWLtiVB`XoQU?r@cbsSn%jQi6L zLh0f~%7~Kdbmu{ z^7ez^Eu4=)F%}HtV9qhO!-;LSS#c=2Bj)_bvs=My0P)7N+bJ7Pc&l_$+_t9X`bojN zGAAv-X0yJH2n2)BDOdH69Ctb0!cEi%7q5#t6RGG&oX&&#yp!X1hl5l|pWnKL{usX* zy$d)k#_hzfSZWTOR)y9IVRJ)>fI{E>Ei7dK6&dnzZAmKw$vvPdoM+jbFn9*UUM`o?VHCgaRtq&5eoP9 z#1dN888PZ@XsMce?{cgXUOZ#idriqMO0wuS#wu9%9#pCq;sn21VRGkP57Hi}opIN$ zr1(_+DPgM{MrK3>&vK>FHl^XgTAO5Yn_c?TP6@dZ+QAI*sk2iG>!S<4;!78>Y*DiZ zRo(&ZppqY=);dR0u|4Fz{2uDt&V2C#omijWVpz2I51DQRpLy#Ahl056>E=*CQN?d? z3g$k0Xt&7&0#&KbFij+vvLJkU0?d1{joYqyVmWO2?&p81l4`=6qik!;XwAaXLjwDU zVR=;()k|}ZYU>I21y3;j58OLWE~B6RW8WlQ3zM*9JZiJv2H8m~So{Fpb*Ky`Y;as_ z{vHYg6EOF&fZVjQ^LTld*1h40cYfq9#pPCTv>7msFMJ;HA@wsD;#4L$Pl^)2icRmn z2QNI)-P=V6xw&diQFK#!evE=ZzTc*E+5! z)K>^Q;{s**4+>2u2S5p-uISf3JwKt(3~Dk-m#YJEGgOuD1LOf2P3qtD+P01P%}uB* zk7irdu0KLeFcW-pmAz1SyzPjZPjhvsag)M9JPLQmB87((YeRe5s70~qP| zLBrUH-REnWl}~C)V7W;Yvdh03@WuF9-QeBT%dt5t>7R!69;Mg{KoP&BO`v8!CWAJ1S=#n& z8PMI4KP`G-d16KSP8?R9Jj9oFGL_1i8Zc~;rQ=#&Xh%7<*lCJb@CKYUc_>6kxh@=K zaCVQDLH_7_WmW?*Zl6Zpb{`5 zKBQUqx;eIV2A3`A9wqXv!zPE2?IzIQd(`r&lf_M3_3|vIeV(`RNsoNY>-pC&P*ndZ zK0B&n1{~wl;;qcp<4ToGZ7>0wJEavyet=7dgPuZCr=}aCvSu>}UWte%&vW-`GSry5CV1f75l99##7Eyu?sXcN+!V6 z@&UBGr#nDPAit*_;r*_^WTY=~i<+Qa#ajN25}_b7$3~h^tCN|Xc^)>Qe(~Ya5@=3t z!))ey_7MM|7RUq`%xAP$znN*(9x1O?h*KYL#&YOzVjGT%z~rtkpfDFD;T;Y^>%L3d z`aRw&O-d-n5Kcb05C1#X%GpA$JqRuAF+4>4^5uzF%#+`V(}vzi_`2M*_@M=50Y~-k zT@FG%-G>H#ZdmcG-|_8gyR^77Z#WPM%dTycaz_TWQ$`}gClvf|k{)4wPO8;#G>jD& z$|X+5G|1|E-*^rKXjcmxGFvAY8Op zM%?N)#&sH0m-%HqAeHi+QL5IQF)BU2fcHy_AzhS*dI!urni__jcMFK{x3!^bv=mQ{ z`#f^XRNpz?Ncuxh!kIT6lr1YKev5Yzg3xW-N_N|N(-wDgUCW^kw}E~V9-+h+`2x8? zv|uIew`c@O$F;j$lYQK#QXw9P?wRsJFLI8CIBo0+S)%4!IgL52Sa!sE`CTMGIpB*a zCuIwzBBsgT?fB(>rJpn~Z3E3q-Eo5fC4NBmq{f;Eu4~up*`09zt)ngzndk7Hp+o$Z zx_otex#h#_a~f z81iP)IM_F;^1hO}A|2+vt;=No^OspV!}E(=S>4knj`ud1%?^m&h4Y^*+pB*=7 zDzYX%5sVvyJuNEo&=XfKVtD6WK1K{5hm^ch`Oz>6p++&fVTW{kVAzYI3&b1kc*Mt_ z7HB_S!s021>gcjBaTaS13=dU5d2l$F)njFOKyi}#btpbCf2E)mYCUxu_dFsilFC9# z1jq))W_%-U_4?mRle{jZU}zIM0Yh}9@NEn&85d{v6UREfcHulvz2edvIty{rLr@p% zpgCU8M$tHX^ph5|-G;T5Zg~qcJkb`ltTlopR|WVW z&js3T{(B`%HKy%h7<0{G+428hxUC+v;!*U{ksEdQ2t!Gg9E>Z=0ZXG3iA*G50A?^KJEs~*$WJ3)NqNi#QC zcl+SuZ;+%Aw|k(6R<)2eeOOelXn_o7h@s<8e)}qSFRsi4;Hn5fq8<8L2FOtIOvfhJLV1sA)y?OZMyFms+sd^|_fbSoJ@+XOfvcG12ZwO<|j zdY|szzZg5>Fo2EocD9;os^glkk^Y#)qcw=3M5rbIY|40k-IBMi?(cnq-I%cSp6eSD zT!yD)2Y?l(0B;_+wIf_cnOPyIxNSQzKPGC_-Ckj0rvy%*<&z;|K=AXPH^C`|NKNDo274w7ms zht`uy=N+(O{!=~L3u7u0wDzHoT1{H?PkwreGtBsXJ>B}R7Y$sA9x z!xtyB+C!$Nsf%&V;Hl~Wr{!6I{#sTrVUeHdm&@%@%y*d=A!K=uQ{)iJ+ZN zRKtqhIV-o-w;v5b?7sSDOx_SlN3za|a<1RTUU#&4W?4n0(FW5s_0M1W6|uwGv;REK zD%9epP2b+Iy^C|TrsSS;f1q(}*t&M)zAfM}|6#u*h!c&r%|w2eBA-)4Q3v32Wb$LZ z0HgHm+B>VCF_Ia-VAR4u&y_r z=z~5{ZbkxvMOq=C?Zp2w3{>fd=UO-^`)rPY(4cdM_MKnHrDR}Rf3=2Q6}bWv^d~E*GR5W0AC?2@bcPgvzKlw+2j)ezQu#hR^Qk5YEKzfB#M_gE>a$KiL0Q()} zq1NTGTcH*0<#z_d%}4QJO&=MaT-`PUDEw`_)g6)74NlMAt=?GghdPGV*1NK(nZLXI zS}N4s=>s~#{B&SP2AoMj{1D>429_y_eZq{=Qr3(MyodZM#+M#>L@2aV=XO1inmph!eM(VZ_S6Q1d!VT?ja&-wG z`g~hDCWb(ne-)Af3Li0Ztv_}<;gj#KGdJEI6b%-+)_z-N&ox;1(I+fotS*zNH6Sgw zJK5WocldN$xMFM2RArc{cOt&^37}^~%L~_=O@*m3&b?^=m7X}@cy3+Diu2aPZhncfu zk<3Cvf%3&#*S4k$FB-W5yziXUi*Yhv6FvY=;(2G&7k_j$F<4fGNlYJ0bN2p+G<*PqP99gqoBhqrBPVYWln zZxPK$jqjoG-jCt=oJoUEZq9ZayKAH=vS`JvjiuMQu5y+n`6~8o3%?f{Z6Um)^rn_< zuF{b-?(a!rr>Kz(@n9zAVn3F{(l|ciwv&Z?s5Krg5jRqX;h2Z;Ud-Rn{e^NP<^&8! zHza6NJ^3WkWGE58(xK=Uyn-vkYVKOg<}*uZMV-&(KFQKHepn0`x&J+YQ+{)3E7C#_ zxG)XV0C`&rE(&DrMu+~*xmjQDf!}h?)u>H2%|r#z+O4QV{8plRDNG}5XNqJ;X)~5tMfQ%}cAnO%)&p30arpYMj`me;cMN9k(@IhL zGw)jhr?Td`6Pxa}7dnave2jEnypB!5zrztWcP0Z&l3hLLI8Tme*W~^ZmZ^QxGW5J> zV$`o_1+&5=>lW2U@0smG+hWYp{gwL+%t#aOl`^kAh~0GS*KJ)~{ks18s(gyq>8>PC zlv@Ma(Kj+Lie)gU#3>iaOYHckv?`C~)JGXlR>&$nB;T}*MO@ts=6v~$cE0viE+RL2 zcHXbuzDiLz@5l{b#D0;$gO-9_Xd?DR2KA!`!4oqq_7Po7k>>Ug+FCuaABcYTdY zAChc8JiSH;n}sfpO*iQ&i50&f@tmC%9t>&k`S{y!L+kWK*@uyP3=N<8$IbtY&s?-N zj4h{6!gQf4+~D~ngv?}%$d5J-z8J}^Ze^33C1@q~dvdcQ*|t|=V)kEaC1`PPV9=3|##xn!~?ceLe2AC1B#q{buhv;*AxjcyCVcd%h6Q6&cux$1OUw4(jqW z4Q%d6mqy|zsaTvD2SENpoYQxp)EjjELM*y+*A4o*Yf|S9Td=-Bvlig7yQR=!t6>8n z^FZJ13mGq@nG}R{7++WUuZ~EierzsZhy}027s6v4$2G7 znHDKB{f`+7NI^}7<$Gm)-@kwfTzkbT0@g_cK(t&L4C6%s)8=|qOo{zO2MI6-f^)FV zUTrepM?iCpk02gjQ43=PB=N++eQGC^&uNy8Uljlopt6VXiZOja~9F37{I2}q$z$ug)1W7|cdD#xF|W5EyDnH%ccZE#6>}M5T|5D0+maX_dn%>`vd;jD zqt{t;L`(+Xd&y0~>V%T1?0fF>d@Z5IMJQM_q<9?MGg$VkQt;nR%lB9vvh|xNKj0)o zRGaC{_2&~pAxt2XVvbMUh)M?)01iCiI1~Hv0B+Jr#?X3ZA;k+wkKJ*?qRilS+)~Lf z245bBw1o-31-QR+-rNq4fa))3r`N2gliV+PU{@V9_Fi?T`@;{#aSQ6&L}mgD-+sqZ zrub&Dc%D0RJROqb0hEG|rucka2#9=Isr3dHF*x$L&QxpJWYn(r^F!#=y5#=O)PL!D zz=6f9vv=)+zf|6Ja!EADxcKBos!{j@u1mxgwG$G^Hb6)6z8ovK6Hvni?X?Fd(PQwq znm==$0_)|UQAUQ{(77u!mYYLetb(c@dBL94PTqU(pVL@n0nf}Oi^A)p9zQ2j_TdSHXDpUXakisSes zzR-Y2KZ1$iwsS5wOFd{Nr&#l;-Ds`oo-8&&ZDNVMyOfxMRe_k*>Qg1<4>HtxYE}g^4lDA6^V2K+4 zy`U}}uUq;J!Sv$z#AEBao0jqqQRdS>Th~G8_)z;QNKDL3_IAgVonnu8B2_3G7X*lg z=mU1s9|DUDcMch3)E+5H{axRg6W9NAN_Jgx-cocd-V&BJ1*I*BK%Kfy{yP5KX0I83 z8;mG$_pmI~5=xM*J(7!XONjRv-E-aR`S=BJJ~DMsy;%LZ%8qI`{d${EpTk$I4E6o{ z8pnyN_m?ZHCAgjMMwePbdddu{9u5tN#Y&j&zv#KZ{V8rMq>IBB*Jw~{hVSK4{Avj* z9(ZThJn&wn0sEOMnbPCEj~-v#wm!I|P)AVkczU{rU-c;mZ(0Qd5yZO;_x;Wl^sspt~xvAa=pRYkO|f@8(FUHA=)M!yVZ zEWVHhybW2S6dqiPh+)n7(Dn4ohNmESo@g(xuB z7~dPiW_rrP9k6NpIo)%y`Ad#9xZUNQ(YWz;KhWO%rp1mXy8%75twhBRG=!e@StTj3qzF~2#Q8u$eva;USw2KizZ$>yi;^ zAnt&hx?C5-$j=2{nF_>Ix~t3AvRHph2g2`e_{R9*MkZsHE8h>U5T{fKad79T)7%nk zL8us!%fRv$%-kIAzj^3Ue7Y2$2_E_@j^8d6CsiS;ghVB)K5wa;d?UVUtGwaRv!?F4 zpeqs+PP$Z%s+f=l9-)wV@RRX)uygea1pq()?hq957YQJy&)^iKnlr&`7kGG512@yq zT0`?$6(fuK4_svIvXwe$WmK?@a>=~s!m>q5sme!cCLn->3T;G3J2qeKIAO_eoEOX~ zLkBhpt|LSz@1G&Tf`<}#dk+x40x0ibNEJ$ccelrNva00y$&V5`nnS{Wye4{MJs+`* z=~#^W@lSRe6w87a6st4F_%juU|`e55GSMlXSHzS>46HEQH4hkJn( zirUn_zhjrJ{}wl;EzC6%_@N4a#@K}T!U-99zo|Nj6dc*67blSz2Pwe*o=a~uweQsZ zXU!aZ>WgT_RE~o-VqH{A2^jy0BGIkx(WnAroyNis{qVbvw@{=)+`3lC|H)r)W_~I6 z1q4!5>3m&0sTFl9iU36M=P(J*RAifI{19DH;Zc44bA0j_7uoll5Nz>QA4f#bONYY1 znDC(u@xrTy-W4@sCVRozBZJ!u0*1gEim29t6R#d~pS*YCr$KV#eT}crh+4nm`>F7oxDt;#3fQ5+m6y8A8mubnaWiqO&J+ zi;FCs?n%O(5->4LKso30Sc&*xWeOG~a0@k703s#)Sf>NN4t)ADmCD2-GynS(s6XSF zc?+hllD7NMG)w-LD9m<(VlwwL5{cFiTbj>*S^(VocQyMX+!ylfsyY{RH6NoUjPR*> zzmBIZ)vX7P?0gsu|3SzFNkoAhzss7F3PJhKD@;-7%$*{2a=xz-WS_XwZBQwMlI`~$ z1?>w0MePU?ayRgOOIvF=wz zi_oIwgqK2~OTE<;o36pZA0`oci7&4$iXK?(tEN*o{de<@mrYtP*D)*ZL0 zy5Bc!7u9a)%49n=^kNq9$A2vSdP45Fanugps}bZgA~kHkDPD=AF1Lp*`$(z%aXWM= z@owgDAgYkN0zDIhqS^yOHMvwKhqJ;ckJPJKfuloLvgoD~SA73W2lJWAJFLUII2U>Q zwwYr!ZYFSViQK)KRE2m?|1T#%t{A}-Gh09RhwLwh?W=f7M0CWKo@KxnlqevhEmpmw1yEv9??!YfMg|t9eQQE4d~(YVr>_iIG+*h3BDr1$W~o!%au5>1 z3h@8R2G~S?*Cc%NTdrkHR2ypRvtrQpC~5sRX^;L}KYc8_$dufpW2v95h1sB>k?48E z(cYE6Y2q){NtaaPE%+SV*4!2A=(ufA8K-|A0DV0!;%#jF{NXSr@jSjZQ5>Q8b0@3k zNs>Zk$<&1ETrc8Lm0Ft63tSqG@n)o6s}m?~t7*S=o9bIBC2)LFh^qkPK0nm3MYnTZ zDn>z@#*#n_)hcJTOI(8YzP>TG@97XOd+KPjk6X1`@K_haJT(1Hb4q>jr_uK?0qeU8 zwU{K@2z$uP?R2H zL?aBS(@j8X)1+~$o?DA9d_)8z{7eBSLhVz2y;OhqSmyVe=2qnGG%s-1Jl6x@0-fpQ zXu`-n!&ALNMXusP0H8X5_`d*G${_bI6#%(vhGzFCu$q9#^Dd&EqCHePSZA~oI#^yg?siBOX z*KDO3Ui)q1KjpAWTN%{qij=Ix&BFI>369gw0w5Q^wVrj1vbR_Bq>d?sp&#Twm9NHoWCk{*@@aA8Sxl3YkLt`GhEN7+AjCoCD(yiygVokb z$k+e@f3!^g$2{V6g>qnjX$yXGA3f7-6vgbw(ug>IW$JuEd66jnW12MV)eDhR1IZpJ zw{W^e7Y*Q7tY~%6##--609);*mESlu$Guw70L|n_{{bdFSRwBW3udjQ1AH;ROF5RJ zrm;{j>lnE8gvzo#qz~oe?z&D!cA6A%@-yZAGK=xPlmRxIAJ+?wYjim>j+% zjkP^YJ~3fjS_~-3xaRmZ>Bvqp)4iB~PzV*oSWo%XtvWc3Y?xUSq8KCZ7bc8a?sQk- zBo>9%MypTi$j%)|@zxOZ&FBSw6vU|P&xLn91-Boa@v<-5paEWphDX;%Ou44CA-Xi8 z?-y(lmuz??H%SE$b-|0blzTptmO_jtIuMj@+M-L3ip+*y-~9X?OrPYqjjWZbof~2KQEn}R}=7O*eDsk!8p!1ydH$_ZAYUk6m zdT8LIjpBem7WEtt;n)jndIkqZ=BF1sALM0BUte?ZtlB?f0zTU5tyKhn&0eN_nNzs6 z>HJe#8vXof?3>LA-|p|khz5~a^&>2jZ-JN+NxaxAP(aJ>{rRFRl2*-8N?LHw+sZ&O(gu7sxMK}F@2=^({g@S zcPCzW6-qS<)5z~$_e&K`A^q)@?C#jcHlFdV(hCWuqK_Xm5=dkAe79UclBK>o5YeL* zuJAGmpZ92F4xS;e^S;7@|I^n}^v8{$Ie z>5T#az`R}`4usP12{OtWBN@i7XO#vq9tBBuzvd?QR}~^M3JxxOBk=9_o7c8T)tYT0 z)i*|}$PVC94<^F@)5}%AMfE-Z1q7rUfhBYarCGWJ#3dv|K?KRAyHi<8S`eg{4i^Lj zq&t>ea9NR%loDwKWC`ideLvs-;d`I^$PjBo;0q@g><&J0PT^?)gG^66u|GP_D!^lH~5E3ddhc1h5w+Z5r0+3^#YL z{ay$9WtJ1ju?K;4rWnYB!RVc+M5<2`Ec_h|%yiGyz{9q5!;GBUY4je`F$Y{gnITXI zq~j0H$37kcgBW!p0x;G?F1rNW#oI;B^zFwo7teVcz}2dEy04H4WMRY^G}R#-4?3h( zfaEJvt)Q+Bd*OA`zdBUj=9AmiY`r;VG?Eab4kf73tb_igQgIjYb#?50RR@Emb7$kM zHA8#qtByndj@l1C-nSuyCwDKN>?9Db@okO-{z)7(W>SGM34e0hRq@cA zU&5yNw3ZyLnsi^r&yvkd(Hx|W;hI3ffa2mV-jt4w?)k8PB7mwLw_uUb7KG!mc_|4D z=v4_DAk5wu1o<<|Gh=O`NNaB$Sh|B)y6THi%tT%YF7$KO-|s6eRC!cCfi0=NkUvx< zoRgK9kRk_6>*+I30;!-ZM{t_KD zKDmF_VmKzdb)rC5jG!hCD1TYBtTlqjpJs9B)JcAb-F4$h9f0cxEb71TS=ml+5p}TF zK_wZ2qz?nF@dtL{t0$_GO`WKC;fHR^G4B6htIBpuM999Nh>J8A$WOo00KGr!gp0K6x`(H=tc=-ZS&L}x{ zI-sICYO@i0y>6$v?BT&;(m2=uq3pH}$kkQXdmC+A4A^V!tq(@lIAn_H=z1rz#Y z`i+Z;maF?-L+P?q{B8u93bFBjGi&(0gngT+_q0pJa>w!_AH!^sn$qz~R|6p^#$VB3 zRddskgt*dZACN%*++?Y6Ch?tVLfQKN(>du5u&>BN1d?o(lJdrods;m7hwU=aFBjaM zpGn$XHk92xzUL))D__KS7p=<9svDq6O*fWiXUL>b{M_+8{z|b~M)F7sh=y@7g0j0t zMcV1TKEh#psu;Y!wS%Pe7}o>3=VOxmwcN}a789LKzS;vmIJdy39#VJf?oA~b7IMjm znpW~3s)4AY5~qU{k)}qZJ%=g~ar8H1O72$+xFKu(WQQf$nsed*c>HB3R$W+X+9lL% zrIyFb&Rr_`PE8`&ndl62I^%dqj*U2ffX?F9ihj7@65v+ z<}=6MPMfTcWI^wg-A9@tN{f_(wg@{ zyZJ%;KXHcVUd6NQZ|Kj#Nl%7I-6^Zi+v4se_sEjf^!_2Ex@zpdSz7GWm^I7@V87`K zD!`6pnTj{xC4r{f3AVMp9CLPY88b8|*Q8A$E9X<$V-hegHZ;j(+o6KF3>5!XrKOG1 zArX82;H6-bh2tOR=|jR6M*0*ou}q0+iH)|?kP8g0TAmMhJy$MsX=4e$D>2IDuz0n5 z)wPe$_E@{P421N!N_+HC(N0A&kY2TI&m#*ua&LlVk5vy6cE z)XR0=U5?9|RlS*kjQ1e?*8?c^{`71KsgYi_#}lRViN-32B%2m^(P;f6m9O|$ zMGzHKd7cT6Vh*-ja|SInkBK=kf(n<@Gl8hKJ-3s&s@#HKvDjQ&7mZ3hQW?i@B}797 zh+x@?jh+aR9-V5mv=tW9grNzpd-LjvR5{2I9%GPneGygVaLUr>!hEg>zJ&@dsP??Y z0lqtK_H=|7De|4WAAahdL}P9+kcRp?dB3U0ZvfZs5VT8CX?3MqFly_=-t5y+CS2MV z0n6_H+bUN|E^}J}VXYWq*m#({R%8yMawm%Dni%VvHO9lckXvRM48yik6ZFY;;-UD_ zr9O-?zHojqq&)G&4e{o;3%yLfpM|9Kj}V#}Jbu78iaU3m5pGlZd@11^CCJ?$1-w>RygKA}3ZeyI+rba$Dcd5j7-hRbHzir2&AKR9IV z|4TkH4S47W`$CixIe5lrphZ^$pSlZH*N#XHeN1$vo+6D^2iC-Xqq+EzJw;_OTKNS|=XZ(I)FUT(RCy}qDi zolNaRLDDv}=@5oMzb>TlkezNN$Ml$<8p`6|l(!HRlUs1J?g72Y!A30wt{oZieMV+a z(!Sr;-J4?aFkOjxd}?zxfq)9T$4dQii#*~}L9M@@@|J{Zw4rfJ#v#l97Ku$u_i`!# z5p5<(3y0mZ+B^h)HFS~nb+5%gx!}}bAoG^jGDelY20-juyo}=tyqy{x?|xlOsM6y4 zJ5jE=Dp(lFeP%u0HOdfoieOHoNdo9}=Emc{KJbn)8c;C>-L=yhTQWs5}c z3A0ey#(%d`ITVagv>tup zF8h-e{E#DXO%*!T>np7hze?+OMEJzEmDigSlkx=NLIImqh{miMb!6UaJWaP81B1>u zm`B1Fk7bMl^@>_1Oii}p)GN|6VlOj>%`#HUC7S^CS={I3{Ws0+yY3YZeJKNd=r}p8 z1PatUF-e!3Cym4C|IhOl>9g6wrzQi)eS%?(<_tQOO{}T3m#9U z*USlg!3C96o0L&Mi+A0!R6sOmsO%mtBu>r zg4XTFFO_7qnkn%VoVW#|H-g`&$@a6jsRIL+B2Ct9y{v5UTZ!CIF)yu6K%UT6h ztssOQRNBerL7um?(hO#kaws=@VJCwP47GIGa{27+hS{H9E4K5W9royepD&N%2i7X> z#51|qTVRutn%OhC`+sf4)#M+{{3MN72!beeZ7pnt>b~Tcaw2?lEA`#XQvIHH!Yt8m zHxhV4kurUWXfXqE$ytJfM1pNSvECt(xN*Bn5Mr~*d5stMm^kbO5CPiX$ULbDT*wFf zB2_zTN|=ng)tv~#qdtxEm&SJ-k_PpX`1d8o1#wnuS&#cl{?<}k0I;AZvb{)%Zn#8Y`J zl%2_9SI+l@s2=2Fp((m|T(>BUDGS&*g9em$?E`w$L6Ff*a!`48aOaMt$Fd0Au&6~^ zrhhww`49bv=;c?~Vc&PK6@yFAAQ8rWPEP&^E_Fyhc3aS}@ykWZk3_FM5nm*&$`H%b zq^9ph2E-+axIj)lyYYW&oEPCYUXP2yg-3t-Rgyc!f#yga82a-ZZ;r^7U(YK5H*TBB zNze@&$@K((ifGjvD<N)Ip@~{2)oU(OD(z-NZkBsWt4v{-%yXR!*4i zfVE8`c5AF`kz}ZD2r#%#w(Z~6kc72ogYml^-sgg;hMKx49sv-F?_p2|dLukh)r&gX zF!{D%AF%^9EMwAE1fwZ!im2wYuRSr}UK4H91SF~q{!B8(vcw6puoP-q@RJjsQ-$Fo zP;cv|4t4mR@qPY5BeI*Al0Pb5@=ij0YlqPc;$jQT@~ZLQ85 z&W~BY^sboo2M?21{t3E2Q?M+zW8*6k*)^4_Az4~9ac#e=67LoGNK)(b$1Z}y%aRD7 zv4U0q5t-iAprWggkt>+%^7Wbo!|M+ zWd&ZBfJRO7zuL3l?8x5b&uf1*R#If=S~|&}lu`ejRy>q4=J~+SP4A{e)T`=7O~^xl zc?a}xMXYnBhWbv*5?om4obzKV<)g8@V9>fU0=zrN#Pz0fyfyB{JM~9Sw=XWHXyC16 zn}W<>DD`KE)ttF5#qE(ZCGJ+CtZ|D|J(H2fc?{_(>pK|&+HyOm%qx<~gdd6`qkb&+qrxr`2abMX?P=4WT#u5l@HA8jrJjYPHsR^@Rbt74}UISsC;m zK}ff8CA4OoYT`~}p?IO3F@A*MgCBb@O zB{co)cjTk6n$_=IxNq@6E_0`I4s1%*^gYvs@$xPl?S`u8Kk${8F&&_&^7ZdOJ`05e>UmMIUweP8l z6%b9O(J!sE9mRZrh^uRPXZ_cL3tPl!*n-*xq*^Hr0M4SNXLEWxo#gmEI>EL1KRis|n zteI8^k#9`zQFQNlOu5%oukA8)eeIp}q1*s^nrPar%HRSu>!_Go+SnYrkduc-B+~m+ zfFj=)i87XIQxLn1Hz3dv$kjlvEL?axhe=qy;`Y@D}3V>kwHkPNnpE)py@77Jv ze_6eHzWN>f^4>GyVYI^tHd(+;RC(m|TF%xSAA-ZjUuKhol8JZsO;0t9eTWV+ODrY; zJ~5C6`E7nQSo$#Ip!(z01nL{maa5!)BZ3G|UO9Gz~Tv)lMc6yHm+}8cJJZ@5o2?SBwwQsI(+yAsvgGi$fphVZl z6ED!_Rg;GgXx>sJimV(&%RlBr99y&l z>f2I%z4ERGZMH12{(4Plk4V-X%B3u) z&Ou(U8in4kVYVkK@KV-j>JPpgWgA55-EXItvAn{Pil=|oL(w_0)4xKQS|Zfq3y{H| zddyskx+iy3NnXn1qr&EY3r7dL0M~cRFLkWVWR5dw>7k0GPB*#h zZnN)HXwwrfNbljEO2ef94(FE>Q{KMTEo z)6}=D5GEL|Y&H_mz!LKmQ_?3Jsbwa+`3hT^S1_$7yvL-BP6`*bO=!he)b{jScf(); z8UQ87%(TLRRt(%BY}OU%0^Om)52(bfj<3i@hU{1>*JMOeA*m4SyO0b#4ohh1Q@PMC zrF2v^5F8czA|8ll`NILjJEt*-fckJ@H1-ajV^9T*9{`OM^vYhHj*aX5i@=Q=-7CWX7X5th zkay?3ZgZ7X239DS^u;!;2sA54sx%tk$wLvHmi3qSQ_*6xuCfeP`P`Yz~FT2hU<0Ux( z2T-}owC72jhn$!YDuh{mjJj4VN`-e*Q&J~kxMpyVEu`>_$=g7B9fwhiFY~>5D|0Iv zi|)Xw4uyM|_WjATS$6@mjEDpz0zFZhHv_ QuCalhs6B;MtHR&@4->{}!Tor6D}Ovw%M_5+crBLYsa?JamVIP$LiR4@``LpMR9EO!VqWbF92CR7x5uBq*X1^>&+nTKt$8vhDl*O@lJTL9nTvv3pgScu$Nuo3F0rNJrSf}dsl2ft}fKmzUGK!zv?zLJ5x9i zV@i5~y}nN-ceEx?#y1Qzh4`Nh3=wrdHH~41@m(3U2KjJQx^&+PlgVoIK9l4O!wTSU z;>e?1WyL7UA7P8?ld^cr4|3zK>YP-_j^&i*Jj8?k2}!IY75==QGvi7@-Jg)%`Y(Mv zSUbWyzvHm(=_Z|0$ z{6|G&g4|P)JE6%hY^*y@i!e8Y2^A=UU}ARSG)DUdq#72B&lS5KmtP`=DaNwfdkjkOU@eoS9TZ%^qeJUbFgro9jNd?$oPUZtMj90(Yl+}w zUHA+M{nr$}H=v>KuRo;pAyTsMxg~5nt7rImsz9+p5mFx7>;Vh?I>_)%&PbZWGUW&8 z`~0HlhlOCfq4~9l1PAMqC#MNXhlrH+1idD9bfm^kPG#d|fM(R$gG6Ncw2mTpBPXX4 zCjf%Rk<^Nj?XtqVvec& zdGqsU0P$9kX2A2!P-3S+kHJk?W>%05Q^Ad_nro(bHxhqw%HyrOz(tDNg)teU(vY~0 zj!gX6e3uZ0y~*W9ll*^0Ji)yjO-QSbvb%6 z&r8LvjRK-!&lT;DK{nJ33@;>8sJayRyo29rf3?~(mK0g0JqHh^6wt;8N-;y7 z9U>zgQ?0PQSJTjGk%uX*Y^GF;=al~kYn~f2_VY%MVOvYdMj%K7mWA#8tShBt5_=nt za-Wj{zpRPBP2hb3Eu`j$U8DYj?7pGfUxSMj4ddpJy!jtX2t{M1cBD?z zpk{a!h|G{+2(SgSRqoS~T-x*n47bMI7i>NHYxWo;@P=PNzf`+0yWNYfvd%p5dkKa+ z7&S{XM}*-a6$9F)CynNn%PuXGlXlA%I%cK>^2B*O@AP4Q_mCDl#Q&9}@h=;+ioQs!g1*+I^+@K?w(I^h@}6-k*J-2%moBbjuI+aeqZRw6glt4fa1XrcTp>99SMn2 zX(NjIj@KYJ=Ek{Z0Fs8#S(zWSXpzRDZPFLhZd78p>5H!qxG9d>E>FRScNM!|B1iBs zD+PPtpwnlJsMxyR3K)Ao;G;mX6qSzce>t0YN5D!vn2Czp@^-+2uSn_aav%ax=Cq$s>B?zf3{*d3DzLVvS+>M%X={5K zR$+GQb|mwsip`zO;82RIs)@6N(I}N@(MQ3odZe0R4gzl8Oz82R?S0AfK3(}BW!%vL zpDRv|DwMl&`F@G>qJdJ!f#t!GjhCBWFJYGRC@~!mixepsp0;sg>AFZJi!02wB&Zso zP~=Y_LZ(cA`FM&fal|xxeroG9^-PVL!Rsyxs!OfMk~NqF+|W7G#ph1$=R`JnQQ??4 z#yR8AdpWtKyGr#0P9kBlv+H_7Z;8(v?Ui%#Ka&((l3f4tDTw}_!(V}jjSayN7l$>c z0WFcPj=+Ous-G8o7X+_w8kQM+{hQ0UnC9qBaB@&ZEv{X?-y<)sG!~=C4$hDv1}nK_ zWRPUG^vZb75;I1I9YWZ($)H=gjo(}!w)@8)8R6NH$u9oqQz|`-ufsX1+GSUyiXuXR zfchrPkxcbU{Lo7Tuppt2!TF#|Jja!bb3_}Pq9(082+xZxVPNPCB|<5ZrnZ~6Q|h}H z7x;F?SmvZAiaTA>?^HS5ax083jK0#=*epOmCSmt&0M%iB9sB2hy50HoGDDlKiP)Yw zWe6|dF`DGY*ySecOTNX0&2cZ9WAKnjCPw9oP>a=Jb|x)vNAU($Pu{vV`C79k8#P=x z0#_@q-dzAj*nu&lhh;e+lVKo zeMlA;jAlpS9t!zawlO=qp5A29>5x|hNGVxIV5!{p#1Eo47#7*n&oG2 z`2>dDaat<1@jbO}hL+@+Q7Y?x`v`*ZeB54}g&*hY70CFLGzHXR|3u}VY?1dOOn$o> z+)w7}4enD@`hx;1^4(q)Yn!0W`3hAtF3+16LSWK*YzCiTyRpCx*?l+0OONCp&#(3B`{Tt)8ZhvvH*)T3fGu7y1>71uLt{;6Cht&Bf?YOL~;p zMylTgR8<-h{v?1LIk=C{BSDm?>Voa5>U($Ja zc;fqxyHod-S(`h=hW(nwIsCIptk8uaC8_A96*P_}m?HUkVNI~C`+kunPq!ip-gW-A zJJVR{Irp`eOHR@73$=vfzq)pCqc;=dq5V4<$v%E)=dLe%kLmXkea!k-euXR&x7CF= z830Hpsg#vH+bTWMg6BXtcEc`JbAdO3A5MvOX=(QGvZ5r)%&v9|`vAcsY3H6*e@ik7 zZ~7LpZ%&;tpz6z=2(Ho6|Q|zSwB}K;D5GR##&J#lbca_LhF~g&*ht)bM#Z$-DRHqAKDIFezvu zWo+&1F)3`D!J@tppBWV&cMdxlzXe2oPAY5M@6o;iE7wIi#7DrP@Vmkn;HX zB%){5!s_f-wbbxtsksCdYrC8oE0qL((7sJPW8^mGUzF$#Ep)j$_mH!g&7`SE`o%oo zpv68ONTMqbwl=h`A#9TSL`16G{+ge)mM$L;}4Ye6L`$8(}B09ULF zOKa&uHQefary&mo0!70QmaX7mMxnysxa%PvZJoOCU+BhO&{B_Lyysv{YUz^p%8tsp z_8rUYq`C2$KhsH$DOtGPB-;mefp$0s`cG&#SoWSP(=;EiF02AG2hAf0&3^976(#T$ za8Sg0jo1EW2mPR|)%JITZbh=v$T$N808$Ed|)g#5vlPCdY$+c5Zw6$*IHF>~|S%j7#EIwOVtnrA+Y!>DIDmc@_^5f1DD~ zYQe{4=oE$~F|UtjXyQ(FTGK^)+aY8dnH%(KEwkG75*Av>Rmz@UB(r|!)1z##prwC5 zNA*GKzB&mf*={GE1vD-L2BMF^Icas11?a{@C)8@Qf-ATR4V?3l;vu{Oh_#uc{TZn7 zeNI(HxRgMo^%j=0bPs=PAu@L#5?>$3kF?Qm^MEz@@4>zcu>~52{6!$I7M{LG+|`CS z6|oP_P@gbpHqqJmjY8@7tH@igaK#OaNAiHA>&mt-J=jjAd_jw|0oI4@>)70Rz=735 za#XTnAhIAq>|O`!wy-5tnL$4>fkaZdIjb0gPH5U2?E6h&Fe1HyfH3z*ucnZo!%>P3 zcI{MX=(E4-osLMJ=SJ44-=#s`Q)#aH{_Q0H*&*^p_tUpjwr=AaZ^&B5^Ae$D-u=-u zy68{66dXR|rH06iQ6xi+8YIER<*2$J6u^!7!<2DPJn%nucVQD>cY*wGAVG&uiz&~X zJLtaOt8_l2bSQzHq?ajV)upeX;$upo;AX{hkojf%2hwkknF%1om2$jEma&ShSv7zn z!d%A)-Km%pdzrDXc?W^zhuxHu6|56-Um!n3)xx>S3e~8h4;g31fDn6vvdx>=;`B%9 z?Qq`?ym-x&V~`*hzSdtWKuhTumk-|uF|%hKJG$_K_RW$K z0}}ejdQ8#m8Ia0*sk-ZsZD%|lzxo3%y?SZTk4+T^oII5~UhLKlJ!HPt3+lYE+Hj?p zVGO+sSJQPQUUi3x3c8zQdMO2FlVbhY@X00t>0^1j!uW$BmXmr`yB>Bg$cITu21p6V z^5tvvb&^)9M(q;)joJ@Fwr~ z`@!}w3Ga$VHcCo1q*9S$TU?VRt7_dKcFS{6_afG~<(ZU^Z>Df0ej1>HiR7>jj3*S2 zh;y!#7XzsEE|_KoyC-V#KIRmE!i zuPR%^$wYj0(mz60qo977W_2mafMFTQF=34(wvMW;w%%u5!FC)yi`7ENig8o9ZqH#4 z9IQ0qw#-TVO6CrG0qjc(=sa62`}VNQVcPkGbR$*%;HxnuA{{^%!iAYO4;Z{!b7WTF z>zs1mhrPT~Zl#N}C5bI}C?gnt3EDZ_S-kAa!Ch!?0v2wjW%Q7SYAs{3C#}zGD!S{2 zPhR6XUi7`;-Eai6C6GVtYIqsD<3?U<&Q57?tnhNGQHF)?EsTwAy2{EC6+9O2hT(l) z#k&0yU-C*55+$VDAPS=jf^(k0fyh24UtJ|-6@zhr5hY>pHdrklkd8~6Z%_ug-+ z1^O1rh`x{c*H!%dhH9>fQG5EU>lY>zCg)GvL&V}c;fu!k|B^ce=WC}FW_2Bk&LD+n zrFdCwp!YWQo(j}N%^s|b+#`82^d-|SN;1CO zku@QQ_X9??1r$FvCQ=B-ctEk`AK_w#2sPo;WdXB*ByO2G&G8yrxw6u5<6^gm$`fVr zk~buL@t{{{lIBHigmcKUV++x}o%bj5^!0gxuDLu!){u05zE2qNSYOThqA2&2(pMx= z3Jgt&H*}U}#c=f1SSZ@Lx31J2?f&!#&YNmwOYDUV+0(dBq3X)EgDLS!#PVA#5O!-5Hdz=TC2;Xwf zz{@CmiveA-Yu29~PhXuhA~wedI*mQ>6inVL3i26_o=6=6|K zl>9z9nYDP*8V@{5z9)JF{;Z35+;nbI6CN9g#WXIY&#ytyZ3nRFPqCkddx=zOyXh)! zHfn2e-f)i`VDOn`Le-4+M+wD2xiV?Tu~rXBcF6D!`}XP&#Tk(pIOpqq1FJy;s-O<0*;DMHNFhvfVSlaj^Se z?rP%wI}9|}h24gWR=xQ1I9Nv*=(rX0(bFg0bAVbj6WAVGXJ6}lzFStHQyb&`7c*&r zFm|EvWG@1g0n_@j7@%Ddw}pREat>&sI9?Px_3M~Gk<qgOb8v-I4R*7hQAEn*Ra6);RX>D|tO#PYOX`LVr!zOUjOv?=jHr^Tq7S zOBZlFE2+mLNZpvT5$^+&5+lx>U>7e*<8udp=qu-ep~~W>bj1wsx9<8K1?m9#pQ5#J zM1fnc!12s%cm<;2`?wHTQ}yhYsBfGb!^6!e_X`;NpD8> zkx%C&BRd>y4t&)?I}B@9-)_KtdEww zs#-jCkXAw##u~o5icb8B8T`U~Fd6+%j4X7g7slm^k1v&r69OQO)e(8KQP91Mcu=e% z9T`COl0zmLit#+rV*CZik!v6!%y^3Bm*_@a8oQ#P-M(VsF5+WwpV=mbG1HggCbYwa zEQ;m3De%Xwc-e0=-g8qG+?J;ACsyuKJ8Hy%!As_ z7Hr3Y(u(NXnv&n@N|g=`n8cLk{#!;}dewz(v=MoE{J?t56&rhhmip**kSXeQ$Nq1O zRkAkE%st5g?^_{e2!oQY=bZCC2>a!K zQQ)oOB6=TbG?X;z;*J>pespl8-_k4QWvjoySt1|zHaEu*)#8h;EN8m{fBD)Y%h+(j zdzc1wMAl<+`mLcQVO9ft%#q56q<{h(dm|Ndq5eIB1)vN8Py#Kkkj^*56q zlu-vYQ7Vp$qeiQTK`!b?h^xU5Bm!d{1ycIsB54WQqv^+!Nlh3qp}30|wWmjY{owsz zC7_3w@6!CQ?HJBHgIj#|342$_x^5*#3w%==lRt1tbJfg;0ELvEdv8r;Gx!cZd7JV6 z4G(DM=!sUzD*tSfKjtE9C^Xc=AtQ>5?T8fTAf)6Npm?xk?TBQ(qgUFhA2+5i{1;$Z zwtde24OJRnklP}hm|S*bMhc}c(?R7)V?t?%;w58kcjSN`&E#L7k11-N+P`yt?E5Pz zN87O@c{ycY{gx|~>$_UQogJGMi62^k6*)}Sg;C59NgNXEJs$rYYXe)q0`NTaX)$t+Hyy;A}nWS9$CzC#qxsN(3*3LW$z_b@HD#|=$^Sgd>3wS4_yivC z+rzj9X4NEHigqT(lvzSpT)ex;2JA0W_hsdo^km9GlbFy za$62K!O}H-fbabQbrhC6;db@;h72v%N!%3%bf=5cB}v&L8nn{U3AQT^%wvkDI#FkT zlUob;NUC-*MiOAkuXD($QY6qOU6{h;2t$Z-`ws~z^PGwvDA?IHJ*>5n?PD*r=hCO} z)}nIvHnE}5eX1jOqozg=cpNHw%w#q8tw6MQI%MpQ<#zv6mockbPoW@5N}a~lqbN_O zxi#nn4yTuq?L>)KO}rn}>A-M@ds2>ty1Yk7iFJf0e%@MncE6+Y+_#cMhEk##zmmd% z0}))35b2~+)urqb5!dYx1a-IgO<4K>RU0ZnjGCWjOe_(>L|6f z@m~D4=G*dP1AH)DF@EV-STVcp0F6toeu4ji*#Of$f<0t-(n^8EtI!Os&l%j;rD$*L z(e28=J>w!l1EUs=UQs#Mo<{UjBB8ynZSVO#_zo7Xos`rGI%g(Rs5kE9vg#>ktME?> zwD)H4fxeEms#)WQd>>7!HS19CBEs(dd!EnGcSM)Et;+m>e|#hzhq|NfJ=$8L&N>Vc z+~FZ5#lUX`C9Z$Ly?A9bT~5(1teEJ3ozMepf_B4@%{650AQ*?$w(_1u`*@vatd|t% z8~u-wQEbzOu|{HboZSzQ8HgYcPmF$IAr(jsc(9AWPr4Iyf;FN*w`zFUONj!pgmGRi zg+===zJS=GMDsblDTq?^3}?<06j`MgT8x%RE1E%#sAzhho4v_X(MRUx&&%?Yd?zk8 z_>kObuBT)%i+}Lm=BiI}u1Jth0}O7|Fa>hzONwGy1!xg9UnN5wl>}%Pfc_*4gVSg|sMU_2_PGU7pQ>G_}3H(B9qcDCY zjjREN20-xcPyOf@Tai>X+xGqhE{wh@2a_PW$JIWvk$(pXNe7j95_X9g2eDFM+(~bo zqKpyxT)>j~55eo-j)BX-`(PQR;Vb6cyZu?WrwuWSr};`?4lbsMyh}@>4@DTnlq4ud zfbYG|38)M8FX4$kIbGaXLv(MWN`g73Xk<&zChgdy7kPBH%`nYY~1_4(}D^|^rui&o1rV%ctn8AZAyYecPusbkXW4VsO-!uYB8XHj)dxTBw zx{mL~)a3xak0DT`#2$%NN5f!iS*qTu`Eglj?RKlM2o6PfL)5ZOXHXrWE4?8PV|9{t zi?RY>z)`l&&L}mPgAySboIbq1`M{R1{^mcj#mCKD{fAt|j4>|>4=rHOWlg1%Y(_uT zm0OWHlfo(22RY$QFM{(&P1P;lEzZoshlKUDip;C77LO(VtJxhM4BAhvg-R&3oNF2$t?<>RY|r!ogE96z%^kq^l|8;^q2Vy`w6Zo>$fFFwQ} z`>Vff@574i`}`Zut1h(ho+iN|fO$^*tq!BXFWX=XxFMABnQYPDE^IZBM)}O&sHbjr5a6O{TNH3V` zyFEVQ*>LiYlpqsPkfHSg|5{rkz5c_HL|Aqfjt#R)@yan%t|W=wd40KzmWF>xE&-rKO#b<EpQKqvrLLtY0e%Yc;);VbxP<7kt zxKY}0$JVBfZ!WYPk9e#s{vmkXG{6djbIq8GToQF~Fei{<$aB4^#v#cq+bUx&6dhM4 zbD4cZE=`)QBACN1Ff$o&mp`>I@KxrD<{LW@v8NDkXb1j6xpBSko$P18>uQu*_U?30Hb{mum@b;* z&jEOqIa@}dj=x!B#vwl;TU=wrz2SYxmd#uLGs0T@ z)kjGhr{PdJzY~73~CWv!lO2E z`Q-p+*}nUk!SO$ZiQ>6d36yl(EGP7(HbDjv^sz?vX=Yo|cqb#C z$na&!hGysK!42V*B-#e+)S3|oJ{9mqJq*s7E}9F}=R-?7-gaU{yqxXZ zL<7qL>fx=1NhE)1PsMp4m4vA5z0vuVG;%^U>WdT9MQUGr%VLrods(g(SyWa2xHR2DUE+X*POn_YT&y%m;Z3(6XfDgNHBzO1i=mNd|B1^5fTs(EYQDRxw&K(}Yu3MZbx1qtmCN0P;3 z8E)}C{~@h9Q@Dmvz1V&~=B@O;{ceC@_;#Y?ONeHoJDqWm4O~0#m+&0np~BR zxKU1r%1q{QlcydBAFT|!n`-?wF?SO4`%dg{x;g_Qoo(h_-}2nmk3~?J9%)0;pFpv- ze~^r1)#e@U0v`UZ1HO|#=_AQ2Lb zB`AX-Xu)F7J=L5nJbZFxq3R6I&A)3Lkf*_pB(aJlc|iH>D7LGOqhVisSwybQSRK8G zdF}iPmS=p^x)Gp;{M!vv{Bcw^_2l3I10~6e;}UPdaKJM}fsM!d+A&6w>}od2AdAsP zjT-{YWhesi{+445ppo;hY;Z>+piy;stTTu8$kl~!pqI7m+!C~@XEG%pQQT9lumwb( zRGo_zs_!9`s_)b>6+}Cle3cl?t{1{D{&t~~yvJj(s6|jCtBj7t7Y3u#Ghr+1hDEU5 z(Z+uOBI{?;()XlO9Dg!=1LfuvV0lwA3#D1b9ps7zs&_Q?849srQg>MJ*osb;KJLU9 zSLIjx7lz>t}t8>_t&N7qKVsE>g|d31xR9d>gi=}A&AIyHwUIk>*fQ5 zChn}OenjZ?f{c;srVH-&WRG~TdCY(E1F$7m8qg9K>1-SJonL>boS1GIw1we`b<&l} zK;wTgc+RMamZW5qIr6TfYkf+i6CUh(B61tr1gN81t%7THJZOa1|7xRc%TPBXahieJ=O(?jTs)IRx)Z7`vKXNss zB=W9tA_JqVj>fV=5a2$%7@ewfm?oE_3RG{pnc5J??&}{RC@4CDPz{aJ=cS;9Z*%2N zkVf?}Ys}6<%0p_1Y1$kmQKMbyIDd6LuHa~~0PeSkd&~s;5KSBj#v+O!Q(d|PBz;T) zHb@e#?`I`d@Nhmyv2rIUqbEYL(!b$Q)>StWu#o=Qy30HoqZ+lA)qs>YAIq_G=SHHM zYE_a>83yKJHMI+AsA!Ks@BI6Wg0HUv@7^;Oi^?A6vDTJ`2w!lraaxHplE=m2eOa$E z6(>)MY#C)GKi4Sq8Kh6}at^$dfuWNL#PGKco9PV-I&Q6}w>ezx8h^#Y55r7e@OrUL z4++hku>`G#*A@?E(7Up)ukaPetL*;b5U7whx%v~|9dK6JD${_NpwmMjLi+0ubKi6Q zt9rS)R4uU$VIX%gNR^7dPL4s5L)7YVVBOJ{v7BhBO&0w0w^`-HR!d)WXPrde#AgZK zdh{)+%1vPA{Et1@wE}htN&=3;f^Pm_93~3_gL&?NzNK2z5r0I9G30$?Spwzginv2YK-J9eE`+ zV)Gl4#MK&OQhE5pc-WPlPG!oqOGCY-o%?nlqP*NO`E6lQfA(ITO?EqeOt#|fXbe$? z5$jT-z33Xh-#NA6HN5{AbLh@jJgF7J?P7o2+U2veKpbAYM26yz* zeZITz|H9+$AKs|*D@^5aDVKefA|M(70M$z^G^weD?@#IxtKl3<^Og37knTOP*E-;e zYrgX7&A_6Ho)Gnf0@fcbYJDyBYPDAvj{+4v!x6xtB zDmoTf1j&hSdXL0s^pqHqgIi5&3A21ptsN<{(cbL6qT~s`ufivhpr3xCK&&n$@w3T} z4IOPIFL7rmEeF%j;jZ8u?Chw9U$`$j2T|(sylFqJ2*yawX*Xbk4DWx@soJGjvrerf zf9A=dH^4ua=3Ympf@y38BGz5NQeNG_BKf259oZ)nr<%ui1o^!k^Yza47qAj0eL?E@ zqba6h(zui&%jAI;Lg@TX;`~A+jF-qOck~0eTr8ad&(8&7;DMKlc)273Dr8ttIEsgz zyHeO&6BGNo?qO+9ZiP92FA4Ri1DjhpoBU`Wilg#O*q%n(d`mGsM1nWNdSgGiWR(?2 zeObkmbF2f#WRG#ykDkwlkmmS4`XSY^Ca|0~zl6W{81%!#M6fl1pA}X_=Im{DGs(t` zKPy>+0m&~IT~vF$(qu)6R=aD=j zXIXINWgW2?_vZ|=S(1YUwDpeHVWEJ)`MG6M*V|W}qdy0?DuumnzhOVSvLThx?|ytU za~d|n-yiWeND7farqtUJ%E7$K3w@MEQ*jnKdVAv|{v5AW_}bEa6Pd_-@A1PjeCnV; z$0A9pRva8t`Uoh6K|!)D2xse!NK;P5kiaQaTggC!J^kBdgZy=J5P8~o=l^zz{;ti8 zVq5B?Mye%lJwNgs+zER9K=dQ3zGV$Y8ru>)PL>JTo{#D+L8dh~w{0d_ea6z|ROu=y zRk_7kuY-lmmk$<;!+#e6TOZnCNI2=Pu4K};9rI9; zpYC%i&Mqk%hCNXF4(PQ1wc^mM zBWr;%i9Db!6id0jtB+*r!fz(mRFv-T;0l^e#Ame?%M@ghSdl++(hFRk&Njn|sgR@h zjr)b+_x5{Iphvvf4$%)yej8Y^(|u(6!{B&k10{Rm-F4CYimk-k#M^4f#VcVB>rPm{ z=a8#DrOiM0s=H1$AVSkm6DFZ>6#VDM1Wu$GYYR*dgeHCfh-&t~0KIE#Baymeg;@3$ zx&6ynK5{iknftP@{`mh7mhybJj0ZI@lTu9Gwm`#&WPiR}OY literal 8239 zcmaJnWmFtIkc$-8;)}aG6oac6;Iixjslwz#{y6n86b#odZ~aVw=b6!+u1|96u~ zW?o*BH}jIrB$Gs_smNlY0nq>e0H(a0w8k54{4b**y_I4UNIY)@$y8BR8u0pG%Ihpm z0sts~%S%gYxo4eZd$^M=WYlbGE>!AeHhK1wBH@9k*pN(l`akd@%JmV`n!T5UAA*if zC|fvXDDhy+%P}M|qGmv;so_?8a7I3|ks@>HqkQ4cTu$m`8>+M$OVnd8U+{u~vma$E zW9$^Qo8}i5)+=<#G0FaKV4&=CKw!ykCtVTeAh^c_n1oYS|F!iS zb;x8Pk)0-_l3ZI~a|=lRM+!eF{`*&MFph))uAQHrf8*GY!XT~-+-Jp1pu-;?>OBGf zI5;LLE@w|(fR{)R@jw62%|xlET8@!6^TwkaT>}rnKn{Sd^`$g$&x!d?z!=WIfN4By zW8mxXWC6n#GF6V;MemKz@$p}&C2T8qMyWOJBlCs&&J$FxoIEEeq8OaEfPpZcOsjT} zYY!iwWp%J)c`jYTQCK|Aa^NWOfN#~!rQYn;mxqM?_QDsnk}H~@^^syjKZ~(UluUAe zbYkuMxXn}UB?fghLMng*kUQMJCZs83af-3#kXGKor);^DgGa6c2JPfm@H=WW7I=IX|Nhl*=M{sykf!jUkqtA}|>4 zAtjlwRcW#*LB-KViWs(=>M<$8!9>4f7$q6u2f#rJlOmaz$7Bv_V*YI(@`4!_+9H_{J;DoDeP{WsIT-x zMFdxGlJ^omD-}6$Yj7ZZbvaE}1ZOO+^o(08^9d})tqO4PwVB{xVAaC>I3L>|r?0kC z8rEWQY;lKno5T*slA8YHXa&BQA0-mDD={qj;3x9Wj6`_ zD;#v^e3v6lK~Ym|P9K=QxZ*zsUZJ7DRGwSjT$i;}r4;K#=qF7QdSOXWrA;X{;13|G z*|>(tiyX5d5zzl_&rDTK`=TNf-VncoN2U7CyML;@{D!xwI3P7t7)W}kmK@0fUz8k7 z`!%o=!R7jDj)+2rQAgz$KDa^<6^fa^RB|r8~cs9+9xLRXF-{is3Lqz zwBID}^{~XIcE8Te>dM+`im^{zyNfx9j5oz-34>Ij{-+yoo>C^W2jeFDD1Q^eC!|Kw zFbz8@3c7Tv9TeozA2_O=+x0=RB*MeAgHqJLMI)RQwaOj_t2kA3@;sA+@YB>9PjH6$m_#hx{_BZ%u1bv)i9HcX1DLZb_QCQ8HH=B_` z<%DLk&hy9qeH&!g@&_@J8m(v+fT2!FnOc>Z5|NZOF0m%PDKL@H7-@N>`5iI$09A0$ z*`)?VUj}4|sd-pgUW1vJ>TXs&KkX{UdK|#yvyFlf^!5EHzDDd}0P)8uwUw|uS*lyb zWDe#S3W8$Iu(Ar^GoVjxC!$dVT#5GlvkQV9n`)h3D?M!sO!K9r?&?Envg#_UkaF!& zRZhu0w4vmOlUVoUB z1)JK%J;3lDl!+yFY+FrTca15TOqgfLB+;ynf(<4_CM1HNL~}PCTSOiiwhI!`!e0zK z$wFH(AvULIc5Xu>$12Vu4T;Sm#~M6%aD#HiU7LsuN4PQ3s9>I`sSAoXg1*-2ViSg) z6!ET1Zc}|<40@ya1yFCRu*kj#;7WM`d1Uxrj1;5IJ`_h~I5H^6BWt@5i$DgKVN_U) zMZun6Ay+T>tf)2IAKPA)vu?9n{@?XUp^@fB;R%_H4%?|m6`#*O+B`GmsmQK)1?ub0 zZn)UJ@H0$Y=wCbMek_6POiF|XQQkqx820;1C_GV)LP=rR-`$!RXydquHW^V{A5LJX zUl(Fi`AvA~0-IRW$Zicmr?~UZG?s_@>J6%QDVf+G4;xMPH}vE(K&%uWcvF-s<~DeF z-si?{ZXaF!DO*2FurY`^`2i3E>BiS`PUJ?~wUVjM&PPF?5JY%l1yEZ(twOVRBPRZu>N$c=CC9GsiPL?y4KdaoT z1?TORj9p}lp4Eajb}eQfb}N@(Q`)B=3qKI+7|gc;lwWN&9Fb6-yJbgQu46nqI=s-v z;(LTB$<@b&=7)fX;xH^9iA`PUN~HoOt!!Vmja^IXHI{?y^#K9<-tf|YQ;H}+M}xo> z_uuZ9P?|UghL=8(`^`#!LBq{3wRV?_^nJuh@qjLfC|t<$&UdOGdWY68H+$}}Id0SY z*AUU%4azFU`#-TA|0>&`9M5xwH?Qswu!RpGm*cjT5O5tY)qof8 zK)3ki;K+d*7nOPj@kmdnKKjt;edc^OB{<|Ql*JYGz&b_JK;}eTN7qaFUB-fk;mm|Q zbvWNyQ92D&(dlx$A{2Huf8V^CsklIt75G?IqHa&Xk@6=qbywo~7x$&cAv~W?Av+PcK$nlwgdF6s2IVoa%5cj+{H! z`}xoOqR&;0udu3@vZVwE8$lym5}nPHR<56hFE%6MM%+Zxx*O^jVOi`Xa*Jlg;``OH zi`=@cJkbuyY|t}!|J&qnIQ_wWuU>R?YD=fKY3G>9?dpdF8wpq8K1<*BO|lowxVm*W zI%(fq3nMr5G=;I2G)>nB_;?WJuwygzzl%)22mQv$m#34aba~1>9FCBcsVwp8(n>u( z%HZdzjHfXy8dAu_nA^67_5Gw%g?N|$pBm1IDaV(Sv4Icv8U7QC+y}eU0nV!9w$l^P z`B0!}gPz>kAxACve(td$2Bn*kb4mV(mY(B_osoUmf67*QdOn>kn2ISq7}g$gJl_RZ z-?9sbYN4V4`}6jPv1u{oCpP`YpIkk{m;Y1k#gU6=MG%7xE6I}t;dS)#({c1jSjF5Q zJfrqHwB8o9}*z#w* z$$nU$UGP$jlKD_>1dh`E@$x+6q6L{>Mf2>0-hHgU2zHx3HO7UqQ4g1wSAa!%o~cNB z)bCc$mt%_=H1hC`@6wWx0^?&YejX&#=Vv7T%?Wms6TjoU<(wg(FHGEUoKl;}U zx?4w_ye}*F;xl@chccJ^8!Y}Zl}oja$%*@Xx%!UXtCB$M0ErPbO<|qB&~Ff%v9mPo zDwacYUpw2v*H|<5&{;fkN8mPWFK0$BdvwPCT9IfsXC}QxtY036c+hz{in?cloK$_( z{?L&G%{V3?)qNDL(`o)DEFiMQD4}n|DLSFGAq1=zCTgmF2=}OPT~KPBeM*m>flgT! zZC5zsa_B7oAmu_O4Y_6jxjuZ19^rMw@mna$Q_YTh6ZZrkpBI~`XIPlEdnVflBR=|vom+qyF zls1Fn(!2O)6s%Wiu6f?5(aJzQwJnNh`_0e{h>Bg7Xn3jnHofS&|7qm8+!vUJPDs3+ z_Tq1i>63njRYPu2HTOrOhk6_#;^$sF?9P`L<3mj$6>68*yT?~*_}{vp4sfyg*P*yf zA%4YDV5=X81{PH>JYBmMgrcufrq51oX3z3y0eX~N>w-Ye>OaEpmTX+E4!>_5^TUv^ zpCr0GSOa+DNH5zeWQK9t9${v=up#(4-zT{{)g0Na?{Q@FU*F#i^nK-5y6ojGP04_* zeSGzMP3U^e0ma%Xg}tpN`=BKJ+^|s29M$!Z()>l_?;rX_HD)(o`Xt?kjn)+!A{2el zEehtf^Rb8G+>NN$0{?ItD%o8=jzq^oEBX8mOy`zLn$LzsCb`*`R~|&+a|Ls%U+*x> zv4w|I;=sRV>k95f$2*=qfz^WTjRP11kWCev)t8`SW!P2XvZJY5EX~mIm#@m@)aMs< zwvToH&F#x0xFW?ILh7f=>t>q zEMLj*Bfe=H`8)PvusVpDJS@FrB-ni*?LyD;{k;co!yzbClR+(8aDl$Rov|vlOEk&r zqkJA4GZOvj>Yn}h!*K}e1suD)rxE)#`jQS<(s`zV%FDePd!(T=h0 zARD3i@AjLA^9rAI+z>cjSy|8pU7KF6{|g=Gn4~Qt9(GbOGm9CcPUiDZ4qKYBQS_1A zDbk+qzPZP>PyKj&Z7*kktT4Es6=msg6z*{+E{r^7$Gh>vBiW|A6%R8gXO)t4rh4S^ ztoEoPmnVIHZGfy$>`YF6s+A1QoX(0l2{42rDVISkQeunzwm;4_YbYuB$Q3^ENjfQp zm3P1wvg1MPT8Hu$iRho)eVq}9O}FZFqR(M34VGcUp_ zPMbDHRrKM5r_-S0=OG`feA=bOy0lH&7q_s34ql-adpX*WAz&IP<+J1wZ6jI&hWI04 zuShNcL_wXjllQLwxbuSI$||c)wCDF?=U;?6?n`_MA~55W$lsNRs0n@~JjXMJrb_hq zs}@I^&K8(xoU8xUhS9^S0QX`;OmacyhQ)r0gvmL~G1~430-L>GN51^2Nvc-|2F|{h z)Ss)PS#XH|!bi>=mRc-w-U4N3Z7Z8Y|hpupIalW8%B&`Yu3v}`9h-r$n zk+|D6l#4oDNz`Y|BR@vzeK0E?m^NmJ7;zK{5Uo|3));{SOw0M2)4l{~UhUl~rAS_9 z469q#bElu8ynh{=R6kp8KV+UW5vBcB1iRLJ=dmbNBF(ajOkHHM3{Oe8IQ>&Up1>s^ z>2I0>59{BagJBJyMJdgFEIaRa)+00hhCb?nx8i0jHCvri@uRd#I*m?asCw!fz+K#- z7}vnmhfF}73($H&*^cHV&5)SEQ#6I8raVASLx9+Qr-^&&NWVSeDu*`gV%E#^fOUHI zONcc5g-i3e3zLMT>=B;6f3gFH&%!T5F?_DKE8!jKDw>WqXJ^_vk=OX6&GF;nb73e+ zjC-WdW*cS3q8(=;NRuW-YAWp9G0w z)$XC|0(M(#HfS#m@jUDKfnrVk#>A1cI?%qHQml?y6yd*|lb-D5Go{n(c6vPL;_f&i zB{A#SRIqn~>ms_oOvX{5S8+=8N+cEe;HB8D!d=v ziqA{fnZn~}q%|(jJF0M}2rqWc*5$E>wGxUBeo$RIA$E89{mYrYSeHhbVResOSt+86 zYgDy2$JS@y^LSHsQMkufUsfGQTT2j`bgQ&E%aPBw_uC)}TA z{uGLqSS~)=XrI`GPT@p8(J0@MjP=#ggJ`m;6Gj16B!jiybl>&@yM%vjglq}MY9Y&DFH+}rnjl3_kDZ$YY00x~#5g&OwawgF~M#>h@A<{D`q;B1!(of@?ir|t+ z8MKtYKsc)a)l+6FwAqXzs zoNGURu;9DAvLg`ss2@CH;n&9Z=@*7fjnh=}NtMtWiHG{Z#b0q2#E4;Qn9O_ZgB>vS zcb$wbPqb8<3&oPEe38lZrW$usj&b)-dQ4Jxs*bA;l?&w}K-sBkla{@e={8w*qD8Jq zmcN;;%Q#Z^++RpB+7k8$rrwvFZ4(U}crf1`Nu=vh)@03K$gA>wdyd1G0O~c@TjBdC zMt-BZ4f59E#b~2R*;OpPy{_AD$Bq>i@q*3~2EJZ@KXKE`Zljr@hG{sglcI?Wnwsd2 z+#yjb`MYf-q#+U_Nj47h0+rz;Yyz5@nlpbRKZZN_Qo?M-au%6Uz|^gUQ912?vis~u zmypQ3@sYnsBFKH8?a}xAo;UCC%pOhN4H44I6?WpJ!}9s&+lbHe9QtjOQqpYBAlFhAic+<+Ugx!Pz zkzPf3^!}cZ8KqEQ9J*@2%|GYbQ1?$}Fgg(|1BH84R?tc66cHatetueLkq^>LFJczHYK(75e+R>%~qB6nVWAy29D8T0%x&Ow3}~YyUTBt(Jo<%3FcJ_o(QcG&!okmGA|!=s1Z2%IYkrd8Ti- z2dc>5P4|1ST{!GpR*1hx_$tYlM4i`mQ9*C{r-<&`RM ze@_~}7GvWT!PJ5!U0AuaHv001!ju@n&eUzLOTmlm4V7Mxa`-S#{v?!m+h+p;c`jvH zjtvSdXC*^&htdQqbP`a#85BoMWa5}$BJ)9tIg&)7F?8}PWFm1WTE_=Ycgwkayr#<4 z^Lrn-49~)q3E09V+_c=uhEa zhOMuFWtN6ZkC{)4c1%3x)G-T~X*taJd!O?v-oi!NRQ^ycdu9yDE12{-xAwDiZZlsL|x6gW7ExIrWf(?Z$;oSkxVbrk0dKi0;} zv644I$xIqjvZ9{^S^w~982Q>;`KT`zvErMThwx9>=Su&?^sgD(Gj($XsOQ9K@DR)0 z4D4WFMSP}O(Y|UXa#fCzQfp?>U8ui;Hwnjte*$x)EQ7&6q?g^*=tDT@+jqH5mr*;J z5jfhbVcC08N&1q@Xh37-UGsg~Ux0ac{1Bl4fKllsJ!fL5iY%K7i^wl4HHEq_=4H=9 z?I%D^b9O6#e$CV@{|X00i%Kc3RftRvIFUS$Ue;h~nLI9EJ|fshYD5)6YVcaJ?xq}E zPsG>LIbpAfIa>I>RSq!cEe;f=XrExQe&8j!p~q{*I@Zym=4gHMCgu&F@k(eAF`-LW zsygM&n>9F2%pa466)Tr^U3$m@lM_$1A~*75eusQ9jDdLjTA_EfbN4NPJwtRW^h0WRP+b!Bw|6!`49`GQm(5jcLH`2Trk1X{PMw-2R_h!nEUHv#x21 z%%~Q#h+zg8Tgu>(u^O!E*B+Jj?**paQUCEDtEyiFMR_i&6VicPM)Wai7*yEqR7mxnc$%+GV|2|bO>*l&!G#;k zTmuETRh>E(r;WKw5$}h-jI`?#*RmsQsu8MUDJ-+o-&FR>1pYel^YkX$Z3WE65R*qu z^v+tJIbH(JCfFY-EsQX&^w`HXqKGpopD{_&;%HAW@$3XM8>&bz!#z|m4%xl?VXLsp z22O#&I)w#48r_&I)HClpOWmYeWCcX&F`h3K5FXuOeruh&v$FR2kR|u99e`PA$c=%@O$Hb%}GpkXn+WqR=h-kM_JP{po{qkEXB+gY)y0G{F?!j-J^0k?b zV%P&DL5xM1L_9unzWBNC+fP_mbCd{1lk0nNuW;S-ww;?$`JerQlObm5wWJ0Phru?V z%TyIm6tm+~sgv;PspxQ9Sa@6?BR6De7uQ;!z9QNOihNtG=&Xfj?nZ5ta>H!WTNuP2 z3~B%PbJ1VYuyAu4i?IIpekg}SXIHnFK|Cp#D>m

$GHQUhd$YXIYF;9}Y*2RjY)F z!~5r5B(JsH17?h5IreR6d%_xn^uxYNj2(sS^e)wrnGPptqy|vBCw|L}b{(k@QxGe3 zI0m2zo%GL7BKu&hKxLGYm^)Z1y(BE|^dcCTLsgl%qC!9nc~?gU1vRT7NabsT%Lyqz z(9p+ox%ACa+5E*gikk#v?z>H^U7hI&tE9oCn#*rMAkH~yeiX8Ty-1is z4{l?~_u>iOUseXeG}Z7u@wZE%$&9HpITX7Z$p0VAJ^B4%R!H_Y$`^k70RWJfQIW2e HG7kJ7xS;I` diff --git a/web/status0/public/favicon-192.png b/web/status0/public/favicon-192.png index b0f77ba1e909189c44d197bb5ce9cdef869f073b..8ef202fa29843f1fe242bc90294a3663e5da949b 100644 GIT binary patch literal 13614 zcmb7LQ*>ob(>}3n+ngjbF($?Y6Ppv;wrx!8$xLk9c5-6d#z{{8y!ZdjxAxxM`=VEO zb*-nm&{dI23Q{PDgopqD07XVxT=}!_`R{{={cM%jZQwpTSYtUUalpraPk!g0WB`C1 zAS3==)g${N$35Fb!?PyO+3sh0Y5K+F#t?7_R*e4JkRcT6WN`u+83hG)aIGb6V2>X~ zXv-QtJT#`&cE5Y==`3*b;GSon5&*Yvyf?0I`g-l;KzhCU)z&3 z-xcqX@3c<7Ofs!}CYR-0@&E8sw~ijY5lDsckaz~=aSL5+(|^Y-@KXGI8ZL>~ZXiV| z4`D%mO0}GK&Tzp2fd@!rVDp5(#LjI~_j&2>)~*1PL~_C8LzF3g9Ia?>nvOZ?hi|#F zwurU(i25894in9{Q)QI`7BE~-xK{2@e!7ZR`iP$5cMD}cz{^xHz zVu28R1FM;a$Oc2g^6ZyurdrSX<_KS{w9m~WE=YAd#T?!IELiXkm=Uc$I$&8>MPwnA z2!llG$ON*cxI@i>*ltRqlaVgg5=B)2K1x~Ka_HTeof{DWtv#s8%0c#WJAPt5C%eL|4b|cN@(>wN|M9T~=}IjEEnrnM+S@5{v?>8>cnvs`|&*>aOj1ynHbx65cv9`UxMIb7ci0L|M0+u8%#K8jqL z;R`0hM3q89<0(!*qFoB9sYCS#J&P{n#%lD z?>J7)Yq*1x7Iq0|J4USWqswI5;LqIXMt=Z*4yzVM@dCS!4tv|G^@@A|^)_O!#Bpd| zq_t35`2$KCpHvK>Os*Pr2YTuT+aC9t7P?b*8QtxIR>WK&R!|^Bg?__`czx~3MRDR; z$hT3i0t|8P@^4@ByDSP7#_+inoK`!HQ4m*@4)iHrMsL=@SATxxGa_aQRBH&Obe~GR zWzXbW56&RxvcMB3TGGdDo<|^k)m};mWk^qi_!n0SW1*K>3wLFsU zQn4uq1U%%II8i$2mtr1H{J}XOwBd_6BN~9!o!O}LG6VgUKxhkKP_As=Ts1CQkS9bi zw@;bf7Yif{+x+alaAiFdX;p__X^TmK?nu9eG8S2h+e!q2&YuYa{&ep8x; zANU~mz?B!Gt$N>{g5B`wWw!jJ_x08)gl{o9I|{QC5==Nl0wy#J#P}=;l#j$~G+(0*@W4tiO)2)2ukBLW2HAGty^ShFQ_? z_a4NZG-H&AwMaH2uiV%Xn*v-~!P*hQ84n*Dqm z9!})gABGSB+93j~k%PN_K4rz#*=E;LEAU0@Wcbb?QOrPnZ&-qsl=H#x(h^qf?IR`4 zQAxxL;QDbd4KIix6?W$EOPLoGLaWbI1)53o+A5=f%oln~?N%+j;@;H{r@uVf_=U)w zm1o5ATO5970w75lwz;ZJc6Wf;KYkePrSOga=!vpK90_`c^5?zBuN}M9#d@&d>4IT{`Oat24JzD_og*#eTJOFp|>qF98 zn3wL_xK7I`wZgY(jT&=eRC$Sc*9Ikg77U#x?^iE!NLn*RI@%oi;Xx8Pg&*WENmuiC zx*gfk$>aUU^rG;^cGwz`4gi8k%HT#lnv`8dtxL#&>&;T+$QnHSs?)&a$!$}PmR3mp z0`~GjGfV~=4s;PTyr+ifnh-Yrkg5XrhC+Aj{%p10J_1GgAMEOpBJ?E=wn)oOm1%gZQvver_+=)c_)7uha*w`)ntM#<8AvU6gd%(X4TfxPzA573!0nv`@vo zhXK{xee5%9Ix}l%FGQZ7%hSfEPw%a&|D-Q{cgsE6)nc7ef(Q$P_TIU@a6p~QxW zJ7;hlPs4t??nc)=>Zd5q2Y2l5irDW;W>E>PB}l{ey)N6*34Aa55Ho!EdHPEVv4TTQ z12g#k3njs@85PLZG#Gr3c-;177yX(@rs z5RDw@YR{iHpv?Uq`t=(gfqP=5339DO7|F;37JwS(@XlhP<1XKG`Ld`*6hWh5|HnE) zyuCq#9g7SkY{!)Vk5}3NP_Xj4svdvZJmE<|f?0J3cclCZw+!5FP4NcP`31qWoQ^ci zJx_)2x!_ssW6_!cdcT5oUWyt5O6YlL1?~eI)Ble4wax_jaz(|b&)(zsK@Z}T4Iryl zGe=^jJoUEXpzo%86P|-2X3|m}KYZ00-l-@on0S8*KghLxH5H7KTB54$JvqEm?~eAa zlQ;aE23Q7t!0ZfB7Qqm>DJO%#b5T~u2B#~tvn@79Yv zP%US`iw__F{AdM^lvOLZWErUT(J~S@PY@RE0F7d$S~)e3$>UIdklC6iTuDxEUAOxvum`+ zGO8tV8W`386JtG|syoLY~X>!id2JPlA7!+JEsfU;_I zSR>7bvZ>1DM6on30LL&en5<_-g>R3)KExg}U&j0q&q@r+1u!i&Zj?!5h@h#4jPgyb z=}&B)tK{fjhhBaHZw$^ZA+leIm1M#g2x}IZ$ z2|VR&R-yH`fJ1h}sZ>4qWBDoZgb31bPLk)St(xr#N8|-5U?v^tx$aobXve5y67q*P zm_|yU>WQ?@E{HoK_hqax`W-WUkKEpNaLg=-Cvbeiv8|VRaj$KSkKrkS;4ms3#hJy$ zSj2|a@~pTXr9MX&1W%exnOi2d(%1(-p`o|)PuY2 z6Kw6fD_oS(C8C=dzAkkgQy;#?l5|#$TfW1Hc$##9Nu>qsm6w0xi^~>B4pC%@H8hL( z-fmA9LxMhBeo@L&6I0~ya%q(eNgf;Pq40l0%2My~*4Mb#${br^3+r`UP`s27Y^}%l z(`0ERd;^68ALA4!H8DySj?d5Y8_mDA@tSuuF?E5#ZJ7&%`Owj|vY9YYgJh0vYzbpJ z9w4}%qit0o5?lyU8dU&A8a{b6Y17l}M<-v!Ss0_&?Yv^nz~>$!0%?yJ)O$7ei%b;o z_ol9Qta>}RWjmm>`xWAZVa+8?bA|o+ipm3QphV(Krv-j{!EmCIIsQ8=wc6%;^MGrVc-1LN<`;- z1wroCXkbC;qlKHkCuM_bnE`z7>6vh><_@3H%@q45c+%1>SrPbGj4AtQ{*$!-(9!Jbp|ol*c@;thPFwB_l| zy=Kl7l!B&?o;QW2?}aI~z9*p$X=~m)f74Wh+=9h5p4++k=LWujuBW&pxp^_fv zp!g0GTQuO+4L}Th(|)|ZYt6M6wc$00o&Z&m>eUj@Z@1H(Jxjvv$o%PfH`+SXL;u9- zAW^4YtyrJJ5wOp7l)@SFFCod%5kso0tvAO^6sfIP(r+rUL&ttamw&ek914Q5@u!XK zyqriHZaPblTlx-vm^GveukL>`f8TY}NG%oSaR~MXHa=L^RSSFe(sisz<(aIt3-MbA z$eCB9ZhC+UM*Vj84W8d8MAiOwYABjO8bf!HiKB(qY!oJ`yQ*d!eZu;uuUJ{1K(mC< zp(2}o?cPQn(;DsL(lYs<6Nta9>ppmW$B-ei@anpr4CUZA`IajA=f3*LZ0E2K&{%@+ zwML}bHYsvZdqZFp z6YNB)H8aw<0KdUWcbxeIW#Km6mR!9GuCcW`E!F*C(&3YaHfKER%b0=iX>KpPq;Nyg zf>4Da6NiO7UOa_x-eAjOvWtct&c~eJdfogTcr}j?nhfS?lD7lp)?E}5$>A)hev_|s z?u_6kmAcS;-fy|?{h;S(?X+6z?fzHdywr8xc^r7o zcl)MXr0aeuT8*KFIa_UuggfHNFUsIWEn&>S%kDRU5owv$nERn{j?$S4J4mm}7k)}4 z{(x3=8+yV9^76-Zdoq&$|EbALqd?>lcaJbOU}}D=(oD5Zi+s{Z(k76 zx2d=2f9ZURdaS!50hj;MbE zJWh4CKv4nnK5#d4;-^1e)sk9|(9T=#$F$7+Ml+XKMV((B6v=6uGXEJ;jN{#2+KUq` z4$=2g+XyKLDMER9g;hSH8HSr`%|@ zd&$ca880R16_yvY=bXsf)l<%_Nde`^$ zoi81#r5<)asf^sgcN!kTZSAznnPWgj|M56Q1MdExKM{LZo9rk}AK&INuz0_x#=9y| z5+->x8hzT6ilA>vx7*0`2{=777<8%CTilQ1zo8gEd|uXtDGf0r2W4~R@Ca1^8!w0Q z9$RgdW@*biSL*{)lLlEvb=kyk2iTh{8S9Xd3DcmEj}R>+LRtXk%`cjZ0dbCP?cbu~ zo7TRHH|Q0}duYO6_F8j2@RkB^{j_U~U z?8^WZZ;=v0vvfC}5={gTAq3c|H$aN7t&QT|(jP1esxX))opl$^C2h}N{IWB^rQ3HN@u?#0;0cFUk&js5pXwz(k8E??25>Ka(z zwH6I@Jd-2+Q!#V`p>jjIrH&os@&ZEBefM=U5MFEg<1vDRkW#+}Qdx)GDbHtOTw`4h z`gHt*qT-lCX@AP@w7O12J+-NfcV+u}@lSCrpFT<>RjKLbs5S*W`Me~*K4kOk1MBK<&cyQ2$pukg=RPd#4?H$f$q-0v zROG}BZ^I?>Vox1!v+vOI=#Z&QDe|FznTd>!{WY&qn2Kw4$V(VybGN$eSi(NN>_9&H zK4X(=d)t3EAX$GXJu6PL=)U0TlJo0 z2|o+G#b6>3@Zg!vFB23>(8~fpgH|RM$GFm;q4W0a?#@@%g3;#5l_7dB_%RW{vZI3@ zp8V-oml&)FjdX5*+A9x_FobV5us5YReJU_W_G|k4j?U(m5qj6MEguO#O_b5-n^BVN z-;;R_phT8uSiO*LS*m;9kFIt**}Gd3BM2zxaQoCq)AsUH!V6CDALz%wCfdv3AP&BX z&zp+;%>Dt5Qv0DecipjXJU{kbsx|!f>MSYPEYATDBHkcA6a1$T1&?GzV3{dwdIfdg zR=i57!J_z%J@TK{M zSzKF(fK156DZ3WYWx^4fVp$_EN1^NF$G){fZ|7}z3!0D|ix|6vHL~Xt!-z&+43Af; zzuuN?74I@qQ}lCh=ZAeScUjPoMk!Fx2W_}I*WW6>_1KEx_3>jg623%f?Xh>mUwi|E z9iw ztE>)eM;k=vaXy8B^t|j-PKik7HuSmTY%u`QT*{-Vo*+>t5P8kAdNCEQo;!aPp;1AJ zzq08-byz~MbbZ2FF57IH{&t=_T=j_J^ZVC%m6R-L_yqZ!>-dtFE9siLI-svw2uE+; zv6T3HvJ`IQQeC`+S9rWYrUC7p;a1*!7d-EN{rI}PojP103EGBou`MHFruO@-oGNk)ghb#tqY}PRXuX&zZ z6vK6h7#EHWWTvnrH{4QI5i#*GQ*q(&5vmM+i~VfSbn#m1z%G3ws9(q zDVgL8<=m$J+SsT81f-vO8EAkn>EWbiZn z*gqJsH;U+BM7k_4pA?+7yTR$cA0VPvKTo=|%?|}Hp=$;4#^BblV1pIZrE7czj$lrK zur*=jnAc1JX{2LvXh{L>^`H~NzL}Z6@F}Bv59|UNm)>;irCLVK4xDWiw$_tCtj$6J zH6hC~T=v9X@|Oi*Z$B#owetK7B(0=C)a<;%nU?v?`z6ww)8vGV(G|q4$sWygC<<0; zCG(jJIFJtEE$?ouDblThbJc%jkkaJf7#`0VK9X0Ltdzq^;|o)ciI%`e$yM!Bd$-}< zk&wvROZBa%xor)s6an}pC+7XpNO{fOh-Tgymc`O6Ktv!cXWR%>92(i!!1G7o?R{&h zXxfk2Db(sj`uhq7Q;0Y$RE9orq5|gwz66d!*=a@7&WVTl5CZ}&3W-OTr{+{hZxa=I&^?iO70oo&KKaGUC`8>e7ORlCq zHm*5a9+cNfT5o;1i#O(m|GdR7n>(MlSfcH&yKe4Y(CIOsEx&ukLuA)_wr#TPJh}>F zOjq$Fh)?|L-#q0}#lI>lLWq1J)MH}b9&)LXH`V43qLw%S0v8bk z9mR`qBB$J%RpPPd1Q_|)`*rH_pfLCF^Mmx=Yq^sMvB;xF9aH=6I*fnRaAV-v5K8Nr z+gt<2?liG3#H9n3qNLen8S^OiaBE21m-==gzu%XAb$LG^vh=+xM^|Z*8FTgAdH?9U z?l0-JaugKF;&l&NUWs_$&_U>WiZxw(yP@$9{5n`!NP}(K{|AhFVS7Nb4SsHWN?v!S z2S|~7I9?3}D+KZKPhZ|Z+~)S5K6S*Zk@?~olfEVjW)@zBk|3*~MD3;OeZ)TELRxEF zzma|PTX80NBg_T{Bpe%_4L3s1CWrtUPM$?F#PC`LUpG~Jc=h@`Lbb4vwHcyjZsd-~c$Q7t7| zCY>;BA>x=8V}m;XOqx2)=~(EU>)tS6eJQ8q7YU%)(g)~_ z$hrK)z+=KNu}FFr#~&!z?#`a1NP->kH<(O>5?(qdVBtF(Dx;L=zFv5Txrzfx68~dQ zT zGj8^rXIjtg>ufbRA=cmxe>OQjcXnx9=idJ){rux{dKC3_nIlDX4o7B&G_FY3TyjVN zfDvB=2j$^8?tTr0AGUtJRu;$H1`xOJ+HJa7*3HI?;zd~-b9IzV#=l@`XmI7=6Oi6? zg;zgru0oPg<&IP)&Ztt}7Yq-wHeq%G~{RiL91_u@<@RHp$IosmX?`2LLn}Zinkv zUFSO4X7~P#dBpuj>?{z!>CX+-N^M1EqrGD)UpKwhyg5|>?;E5=-&QVLXfgMaf;n~XCY`}{Yj}0#HWqdyjHpYvP6RAf z_$dj!MDN&?bgWP$DJrIgOu(NSsW%*R(_{DNZ~r*ucBR=d*IxV%l3~Ut4;|`xF-b_E z#VC~BnkY`N%4t3l{K3`0F=GkId1Q1y%a`kkn|5<`kE<9}^Ml!vskS9jg>zjw0rsac zj0KdXCKpGiY1lX`0|^0aL7r#9X{z)*?`x zo2cx%3vP3eF@0{;`3``qbD?ql3xdHu{>j@4K+QGE3Q4B zE^;f&rq(gJ$%^DRc-3rcte|rw?70%rO;Y`53Jn^M-0;-t9o2*x4T~fZ#o3~T%cs0| zoH5In$wdPl2RiGX&zo-m0iw;LwFz2$kxiECFll&7QZG#l%9!wWHC)B(qnW{Q!-|5x z&LO>^wjA+rq0-2k0-t$~4Gr*cZ3lK|RT z4|-;4z0(69Vx0V(ozL8g6Hvzur=Eg2VW*vx(UUopT1n}fj5D)u@=(ip!tuDR zSENcie(*KvDH`k1=s0aFRR9;Ba;R@ES#i*j*y#m1Ej7=bBI)=a4!qtllO~V~TwVi@ z-;HIXuiU#WrwlM|)^)8lUJ|!aQ38VC5|rysfP1xi;fbPcUq~td-e-0xibCL4rKbMp zw7J#YNJEd_6N*%2pj)6WYq047u4;r5Az$F;?&j92@OECb9K*ryL!Cq4e!g027=Q@$ zgZ)dRW0K{%OBfE(H%wHCGD}^?Q(0L0POx!D zEDWJQul*IzPJ0J!2O*J$7^Hq1kFkC?#Qj?W#24Z!6@GVbDq>pT1}c4pAl!8pI8~W( z=`_cn9(5ssh6w=ZWA|YSZTU_7c+FG0^sTK;<5RCBKjG3e8NSirKH>nTsik|3&&FDRhdk;H))C;C)pC`Uv4VaVO?QoA2Sdxh^7tBLWfw*YNMPUkXg zwB~qeVbLMVEs9sy_S~U6WRn8#v6&KQ@wWoR!@Z3AXj8Z96!B-kuPe(SiW2G$KODeg z;CEG;mG_{-=7ISvyg%&PFrVo!0E^Cp+dM@1SB0;i{IFvbds=lJ*kd`Lj!WC$H()-O z`ZxZ>C&0q}7k!(@(`n^CWQ8MqZ`C#D;E1x$?kk7k?g2{$#0NYF4SmD9*P=JkOrvN0 z{wEqvY7x_vB#hk2=m$sHykSIpswQ^L4JroMEHKRlBucAQm&Dp4l^`2OmRLA3sCag6 z4KFV49#COEgU~{%AGs_srWAn4wXW*~rfaprj-XIiLwG9u{W2^CTI(YMW@ctZu&ATk zrBtlOVUyr(bh|n7eTIHJpWdB>w9I)KN!OdD?~%H-Px95zvOuLs$}2Kan8EL=9~8Ytk1 z@S+w?rwoB%zmk}ct}s~1)HH^QxbxG~pRa2qUQ+zHI~-61duG}9)AZC~00NFDHFW<{ zcM*BBY4oga#g`Iw9N(uKwW5ORqRj~>w~h>+ea;U-W&>c>$8$EWoRQLpfF3?}&BRFq z1jL&y-9~D(PBRlN1V8{X%*Wp(x1}C>1x7JBbG$Qdl1U4p$(BwY^DmcRifpIy0Oj*G zH#4^$3zW0_sqp8YXNeF{+*$p6?8hIlBJmma)y~aUV|7>o$JGYUbu*2_Z#w^WlP+2+ zgu&vNl^5soXl$ztH$Y)O6nhYuV7h&USZC`4Mj0e)Erzd5r5WD9@+r@ako8442cFpa zK#iX}GNu-25_WC3rLRv_Zp>a*11}ul%xD$Soip<4VM^$D?O+pr0gqvpZ4ctbxnSLp zcvfT*&_dD3KV#gJJ}|^kE|A0I3~B}^YWCaoIT{kp3?`l5+ZS?}&>Rrs_)SsG?$doJ z47WPo&-xMOb{s=Y7Ge)mnkGlO)ZW##csu;;+bE5l?OM)Go+GF+w;3`o+`B+?f|rNS zNZspwMX<0Hv_<9IOQpI6L^5!e=sV(hZz3XGx2WXAUE11qxM>F@Ag1$jPN(D`?XR+L zL{FxEOq_Zc+WpNy|I<8)T>&Rgd%S$nNc%U-c9CA!>y&WTuZ5BUKuU&gQABM8K2ky4 z-pTzD+qDy-1DF8IH!g5idD`Npe-ce1p<@@dHl{rp88JzM>`Ry|&LgP^EL6kOecee* zvIlsD?n|+xTq?tiwTu!cu4|rf4zM)#xE6k_Y4i%HGQ0i6^<}Q^2b?hT9t(Ovi=#7N z0h~8eBvFsbzWezglV*j`sfBul{_y6+NK!P7K67EY2F9_KSSxAkk-Ns>acPQqL&R+> zNjlHCHUKbi@gbx@tu%{VOdS69xIsUBkfEYb(pi-CezHT8u3j=5qTzz2y{7ZS57b90 zkhc(*T;{N?mzbx&c0E_x_-h3TAo8}X0oH|yAyc3Gw4JfW`Lplq(ygWW2OzG8; zw!6|SEPnshPY6J42Ql8>LG&zqa668t;`koP{Wh(HR;2TMq=9qjjAGn7iNx=XEx#5R zyt-=3v7zlR6`$@vG-1{VvaKA5TZ0xgyf_>FM_x%0khCkZJ9XxDw%!@$pjiP(9$3}+ z#-J*ZYd_@?)mH^2&A{`ZW{v?5yOKz(iTMROmK?YwdJl{p?A_wleA$NM-<;L%Dn8)Y zt-%C1?j3Sb+#RISw$+A9)jpyWp23=D`=Xll{L;AvJYq&NRN?i;eKQ`m6P1o!6pmTc z_?;Cj%D_^XLuE`3|0NSNKBV=y(GJ^e(MhKUIzE**4~O zjY^O?)#g^+YO<<_bcTitd z*FV_qq`E5yvNwm23IO0VWYVn8x$wSkOK2tX60#k|O?_0MnkRQ#fQ?x)zA$9dAn$f2)34%t zvNJl4AF}IyrFl5sQ$C8o1qAH3l6C7ITqvq*_(~hPH5yeNLo>OMpV-8F=e1i{}we+*GXETL^!MxmAe`>si^_$wX3<}VD zx6OB(^>3;lj*pxQ7yww*1|PL~##U`?nZRsIX6>-#d#UZ?RL6|_u9b{N-QVHY};6_&m`%*8H^ zFi2?ir$UK-`V!#7I_LS?3#4H0Go(gv_j!Xr`?6^O>6fn{E+?u|w*vnu4$|i+9S;EwY9u{Yc0|XE3wVW{Pc@?*@>CpG->4m6Q zi@-)7q3E+J8rcim{qw@=gbXRzBILa?*71O1&-9rAMavqVi z(!TTb-|3dG$2@ibM@$arWL{jzyBmFiiC!dw?=x{#(i;i>J8O>FbQ2436uXjAb63G= z?VG*`=H&?kst<)yRk$E~$c8Y-Rg$zU)}Fq={q9npuj5e%t3$>-Hh>Hp&+6}TRTtSX zuSwT(LTTXaM%?TyqUd%TsvF1TNLuB7J;5i|x~y<2t(O&$eek>up}ifT4<@Ebq!>cs zGlk=}+!jOcE}jxaQ~-?Bo||-Aa^F5&(eH$AaZ2N67vp9(l^eDc`|EA812N7EW?^u8 zond$_X{Th@A49_reG{odN&%{YZ4S;{UpXGViJvk;eOyIl@0WPAnWNZUJAz`rz_dJ`vaci)wv~|eEezG`t|4i8N_n6KHW15mcDBWNNX;L-cdeG9Dyb9nj zlFz9A_o@75^hI`8*}Ia5Hn4@&Yg~;?XTpzJBNMVlWN7OB-V)flR`N%i(9c=Vn{p}5 zV{j+s&!5@Pat_Jj&Fh=9&I;E=^uo(EN<}QHzJ;xXmVZhqkZ6 z8Zc)*6#s-p?)q`|8yvR9ZVU`=Dzyzj(j^Q4SCJfNEy_^W_PU((h*h6KTncCBw=|}Y zN?bf^r-;vrn8Y1t;ri9UiH>G?fQaZ zifLzCVP#@|{=_yORZfj5$+Xs;?X(*!w5h`TZK`tqxE}_WFww^Y z&X#6_0;$nw)kmTd-kX^FKf{mMB-!LlpKp)lj;$G~K;_eOwN`az94?o;mr0C)9#ogT<3KZ^uVu!oyW;gh5`DB~#83qMy1C2Zw=lj zm6fe0vB_V&;VfGbe>386tj}=$@n^uy(3Ydia#R{LoNxS{4?chh?EoAT>58|%^S0q)FE4^+`5jg*kE;7xP0#^LXEmVt3w zFcT9uk1LBbmn}UfMSZ7lm1Y%(UhA+ZEFK(nR4!CIBjIK21Uo!qLCw8f(ut3brsNm! z#*GV=1JR8nWoQzr^Ndo*~AjRCf&sqBs>7TR*~q383aF ze46q^R4yJ^XqoZ#)c*Sl3xR~wR!J};}xoNz3Gsc4&MSYY$zyi3Vz7Lbr+^9byc2V zGNQFhtFn_LvsR)3VrQUb44PY2{l=JHhIUu%2pf_e6j!`L*(!SHb9>VwQAAuO$bWs) z^$D>GK@Ec?OQt!??5)9~Rae0^Pe&F{by~WZq3a8a)Tu^63vxffdO=^6YYX3Np42z+ zarx-d^?;`kY%}Rn=Jq1{m)6J&i=6-_z%r(J_H`>lQxAo^@HFuC+M-7#u-B!CM{5B< zACcW;;#uLi&t#)1qM_)O2gXG#=Isrq>fLtHpn5YiudigMC5Cg=Fn7#u#!R-LpyBs_qXz=O4BiaIsXS?JZ4k+%;i9|lP61ra7 zd}@_~S6&EVAR(%jbG?t9lt0=2H=By`!kW&oh7gA`3N1x~NTM12U%L`P&w*S2 zf}O$>P#Y0eklP(F&lj|RANcp)5>!Q^2UZYsq1oV1bL1vje51UOV^$SGM|qr|M@C;nwk;_y%;n(QqpRV~ z^ffIGpq6=&2m?3+F1N zPoIcaguh-t^uKI1Arxny?oUq-LY!M*7b(YPO?I<96oG97keKkHOzojm~$?Vt|IM{!)o6g#Ld@pT@CB-c6<>FM08w&$=XN*{Il+z8ygwnen1 zT~(ksVdCve=GeiOJ5n4GCJMbpeGEvZW&kkxRF{Bp>kASkylr9mJCN4W%um9PK!W_n z?Czs@t0{HD*jXFgv*Y%I9n(1t$&^sOt}K_-Xh727U|{iG#l(5;0gLbS`Zo=6VC7W~-IV zw29<3GE11_EWTRCc9y7CTgc}3=0uhCzbbLWZEz$8}&1g6+cN^A4@3vZs?xX?x z(kZcD3MA;d0dmhxW}W?hJMe)u?Cs^uIgI>t+(~T9^`EluMB(`4Zd`3(gOecqUQ zAW>GLFNFgrbtkt0SyQ~_h5u!qk1ydW$)lY&^>`Zy6!{K4kb-9_+D{M;Lv#HQ8)%ie zt2AT zcMk0XgtFk}vB}!470fE~7uySmxDvPeoY(~;r-JKQ-tZ(U36R*lsW;>AmsTP@X%$HRR*FQsUwR zZ<@X5%$6+2H5enbxqtZJ+{B+)fcE4GRCP2ezPfKh_=EUEass6|H#9i83YX15U($9| z`c^dASZJ#K?XqLbjHVJ^=Z1X{6-VF6+NH0;%~GHkDs}N^DZFQ@09{RPSRHwkC9>+6 zIIS1F0Xy7b$Z`pN-%fU7s>$XJ&KM_KsVU~eL*(PS-se$*Y{~7KQj`)z6=rS}U_I#+ zwCI=8zFBSe_rFYeGFe{i^)PR`%CKpCFI#?b!{?fLP?zM1CuP6#S5^+6k4tlCsX;8h zI<`(PG>A%Xg*hIE6IWot<0Oi#(lhAEdHnMf<4WjhFVCaDo}PDMu?euwDbzW3+-=17 z3|{c24Paq=gz9?z9eUHs84orCQr|T<*hbOT$ zqgcqWsUx*xbt^EL`MsWWwx3(=a*rJW+YSc*;N23Wy9hOWrq4R;#pZ1L>nSqb#p z1W02AmkVK3r7tT@r8;Z)VJ$~#B#tCbzlzNLZJuM5cAQ@3Z6NU!Cx9Mx@;rg2 z=k**&Aj%js*pw@DrsIAo-)gW^EAo1mZ z=8RJ-Yn%^2B00~#luVfi+!VT?&RS@0Wq^Kkr{{Sx?PyTXb3iK{^4sPht}n86qAVRxTdmq~UXS6CRw*xDm=}s=07-`?f*LXSH-Y!UK8lw-d?JGfMDO`C+PRAiD%JkHQ)B|@f3DdICW9; z%f7oYu=?9``OB6ZdrJSVnqjAa^G;r^6{{`T^#dILKKjOJQslA*7f)zgXzVUFjE$7y zb`ptnWV`@K*v9sGunBNH$i)xOvS?wR@yU`pi7{+lczO1+K`rbZ)Axld5a5hZ9V|p^$e+Qc{Xe}VmqYnLp|9{IH4Sf z#hlCrMW+l4YtPc4WwMeJ(k_PblUwF20;c+(VNPchJ5P^eA>uBx1zT`rUSUjnU&r2* zOsf{sGnFa2Ij&jV3_gLl#>374ZwSebd9}*HkD+a4grO7+lTu8=qo*V ziccKs1ca7zXwR&rv6bzFkWQQoh;$LN>q7+R|A9#A|79*(+}$sQ0Vy=YF0ocHGQK%X zNbHWw^b6B%n!+J4dFQ-;`YO|pcS^gDz5CMQj(5FG66v6&IZS?dhVpvirqF3{xWd!F ziF2Ns5tLe6%ZizFKK89*uWgxmllrZ=f6w1&pZ43ntbKHQxu1_-u{AvVu5^PoWvJX0 z8kn~nouVA|3sn`OHt~@u0d#+5(fNv+6M`b%a&x^|hWpR4g54<0!p<4#jLEbRE|;#D zRmaz1oTHH;%D%gqx}vKYFc4m*dxvmO_1K4BYu)5&KuL(6(V0VPOE&h8IH)yRG4}a~ z>;;@d5(Gt$P2ZU^v3Qczs(ooY`0Ljf8v#7q57|aHa~2+gHr6iH>X|d;SfEm0VBZi- zXechVpIi81DMfp(sQ5dD%)2^$4|yz7*k`c&r_R34a2jYCJ8t<2Gqa|8>xqA;cWyzV zuYs!Y-|}p4*4dCLV^aqqU6#d5)8fq4gb(v4Lc(7IP0j)nA2^GMjs&-Res5yl5s>hw zNDN?8!$)vV@R@PEKD`T_l7=CR_^oW2u^dX$$3nn?*=Rt#8*Uz{>ntF|8gT+CM5 zyn-8ct}4SLpm$3&E)3aT39#&EnzJFM1+sY)m%(*mR5pe=(Iw>O_R6RuK?822Q~1_t zWjX431dn&DT|>LsPc2d;TU1IPuX%W)_u2cg%!X-${BY@pR%-qL@w;FJ!)ZNDb(;IJ zwcHzqn7ArDwYjGw_rnL-yWfGQt!I>r-#TzeHL6zIJ@?;9lnnCbp>R2W%dw>G7jPID z--_jEOC-AA*z#~Q8XbG}_&6*dS2L7T2)5iW81-Jeqb-1TK$z9r6FB4EMb%ItuW$|# zTylTH9d*J{Bt<6wi@0k()!$f6865SlyCL&{SAsH!Iu?p4)O8>+^6+OVavsM5S4`yC zouxd#R|-$mbw;DBtZlyafwy`a#XErKZl(I>c?(}@sxP8=?-~A}m8y}Oe$88O-jAjavl z(L7EGE^k0Y}bBa^gZ-3iD<7x9@edFHR357mAOiw-~f~TIl$7B zTSt=M*9H>MJu>qJqzptl-3RK|baCfV`UKpQHo&tquP^a=GxKkXV}IV;EB27eQ~AaO z+m(;~Rs$b?4)~;K>oBVW(Vhn=_oyO#!3yn>*xeJDkA79ctVMbqqf)W2jwDw08ZFtY9K!vW#*&nUS20Q~NSV z(;*OGFz(e-8!htk8R~x? z_=dIMd$kN(uMMO9?e|-9++3w3yB(VvV=ixIT-zF|iwTLagL`v2vG>#qOG;k6Y z>t5gyM&X%`Iv>)0ah_DSD^@%cS{r8Ne5L2<&-V9&uC2XT zMw@GBy%zhz-w7X9l4ARbwPKY4h!NysbIA`1?) zKBZ?jJw7}HwC_cPiqMU8&gs~*l;uZFGx_fc!sI*l9IzB0;r_%QuF$_#c*D$DU_EBNH$JQ}k8HwkKR7LzY#7o?Jf z98t)ty67~Zb>1@aJ$OUy1tTB04e~lveS%0L#ffrb{1M_1aQLykj5wh1eWd-0rACXJ zp|KN3Q?+^WUJ!T!GB{K%_4NmB6iC=ZoEZ$e-y-SH+;kgJuc1U(jeg|z-7khkTYzu?yD-&jlZ*rDG?h!Nz$~Tf+k}L{LQ)k=PD%Tn&0FL`Bx1z&G zfOzdzAtIoP)_#L0_uRI_mpI?E_bxs@?>U2EEWaqS&Z;eC)}#r|_AK#@1c#C$9uR0t zB?WELXx)S7$3#Y3n*!z*6q3JUa`isppDLN>dn|neaHO=8a9yAT>oXoSPZ`Ykch@;3 z83Sc`q#r%2L^#@DrN9IRGh-xs%#=r&5n@3Edwy{G8+%{eTlVh2FHtjU5oz}Uk#I#p z@RE~h@9+*q3hcNGX=GlVSX8)#uF?GA4#4<`Or13m{|9GiO*~1l1=g`8^7}UdIqiM< z@0c+M&(ZzC(=9@tr207Tj~(p5G0G= zgginnvP+|t?6xeoU4V`ezSfUoB;)B2Q4K8fiQTHKK2rIgJ}@^a!HM9SfRQeoV+K2s znD@V!zC5oXUy^Fp0<+xOd38(YpEf7H3@&-G*EvwZfUAei8I6ldqLCWD4|0#Qo)0C& z+U6CRcqRw}#ZB9sSXuNa#;F{;d?-)N4#NEtss*Oh*SllQ-;i!e8gZ#c9d_LEaK*;5 zoK}P5UADI2q+Wer^a8$bnj^e`EZ2~T&F=WgV!lC_Hytm@NBTYRhWJn)$E&JbH8Y~} zQQB`~GEpQPJ*N^43i=E3@byvUT!|(4 zz=4Z)K@=?(YN&jM6uqMtR??mzKEoZ~vqhP_FMRVFN`z@>ZmKoCx#sE05~Uly;fA zaGWYh5|y$_TEId5xim2;p!>hh1p^eLnlqj(jkGXTb_*xC^4~|G%auxeIEA}kSV@{C z8B)=SodLT~Da*&NHxfZIICE{%qH{}xv6gT9vP>$2&QyxG-{rBsx^T_Q&?j*KtXJStV8VbH^cuTb1eA82(U39QmF;M`nOOvC`)V= z$4+|qV+bwN?=E^f9;Zo|ZI(tm)8k#(HA(^0O7WxqcU4cAHme{c^^nrTZ)>&v_+eIq zvL#>Js{QQPK+g|Z>w&ZT4*@z?6XRCBd=$^FGUFcm8xXPb&sZ3=&ipYr#i6LoIEO}{ zcy-xF=9C^GBY}hHw8aD&sxxP%r=J5%$^W2}amZ-?XQG4rxz9X4Mp1_h(2X{?C{Fn1 zIs=7GaqD8Q;_Kxaj*+NP7{F6@bVnP6h&}z9Y zTV<7=tok-l!B*xHpk+gU(y{O0qovj26S3H#H?6h_6No;Ws=3On?+~ErHMi9fT=PYS z*g|o{2kDGvTg^6APp9r&I;jaD4gKSC#UK@>0v0(ub2fJPnZ~IddZ_;x}k$n!N?T*FOAGP|k3x9YDsoy=*Z!an`n*mM6c>f9gCYiD6Z_i}@6&UWEGOVQWe{1xTlk2MVWD#IrwjQ^4^fDb zD6a?ZZdmb7C4gfpYyOnJ=^wz`wim;3%nf6r1P#tW;G1Teybyw#FP4fAdRr~~o zbs=jkiyZ(^zQT#sdfqwF?FBdr1Wc4Mlra0Xh(7T2X*63S-zgQBo%az50)%GKmk|*R z6Y;e}O#i%5^+BbZd2uA`DnjEdZpy+_Fb-40ls*C>|!2a=|!)4Nx*$GACzql~eY z%3+@a4@qRY z{usDLWWV&3(YC{FXA!Y!B%v_hi6&%UtnL$+@AlLYa=%$WL)-UelocWk&vz-MnaUsf>kwRPR)p0rQ$s3*<{lkT-c#?r`|&Un250Q_Hz z6|`-*?gGdj8{qZ_ivQsh3dyjYg-pcphe3U6LPZ5RVyj|>S@lC9*QkKtgk3}7&WOY& zL{o(N`$s;O6m&3xN%4miEA=ZZg3db5^T2>C)lAq-Dn2S#KTPGlHO-drXK{(lA?dco zZ~xLE-CYqVdG|kjlMrC|S10L73ls8y*a&4JlPtv(yNv1E#E%A#P1&3(lh-BwG zJBK{tGFDm%%26&I7Z|JZsszq}NxQ z-Fhi90??01x=uPlduJg`fqy3SCOmRs2*wBlQMTtGn`=<9J%a+qlWd@=*pQ@N_7Jvo zh4J4m|JdL>9UQHzzq&v8RTiPtC~Ihj08uHfu}wPBfg;U*oM1|^aQ|u89`Ua#wu2St zsstAu@=-uc?-BcZep8k%+Vul4Zg-V!y_YC*{k}j*g{_OkRDw9@wwZ(8(?<56(Vu$G zfQB6G&)5r%#vQ|P8)om^q5=EH9EMOz(Y#jKU+%WEM$?hxgYw1x2};8Ufzp%!03z#u zvj745%WY@x;q>K>i3s|iRW5YkipD@hFIF&~dbv(G&93IG8S}IgQCwdc=Nf_31>5JS3MNN+g(j!UlntPmQCw}v6t zziekvrAk&0<^dCU#l3OL`}_DK(U*`WCfI@@3=OA8&s=&Kht>a)Yk(x^)1D)hF{)v@J z&zI36loKk;xRcb02+DDPpoia^F4w3FAIYk1c3rFR=G&n27$n=2wx1PAxv=_`gCBDb z(%0~%pqjf5&3YYYOkq4=1q5=?>tIC^vX7OS(%vm>9nL31PSH=W7f9j=1*?#$l8utNjaYnpCC%*J3700 zb#o0XUc@PU)I4vU?kDT|XCgv;1I=K49c+l?ud5W*Nn6ID7DpMU+^%(uyTO`h_cWO5 z3#ixXghcTG(hUY!k5ZEb#eeVt*`o*75gNgdGS&qrGdiLsq@1{+7KY9~N^%qbrI_m2 k|2LCCggJ2e?*-`_)T~N?R?YKurUalMqxz{*>T}Tl0NHa>`~Uy| diff --git a/web/status0/public/favicon-32.png b/web/status0/public/favicon-32.png index f46a986b15f7bcdd3fae4fa24cb02da9a4d6c458..e4e63c7468d808e924c1314e0e29b1a25ca69875 100644 GIT binary patch delta 1518 zcmVVqQ=y; zp@?ZAx~Udolx%~9#7`nB4X8C>{IY4R5d>2pExrYTShdgw6pOY?n?j6=MX_1HmP+YM zO1sOx%+Act%zb-~AGVe5`?iho3+LO-^PKbl-E+_X=6T?QxPOGuyEo6#yEo6dlp1nT z!s~y$)L`xt)h_~(if*;6=mB~7o}T|1fOb4>GrM=S5&5#fEgHv8*wcrq;6!T!&gnj*B3{Fc9E0qLz zPnG8_VGpV=%72!-`ezKF>$kKUWu2faK^6nHsW*tqWr!3>*k^^U(TN7a{(dxwz!98m z4lCuIlX)A}*985QY`N>%^V6L1Nb(DUV177QLZgu`ier<=w;+kciJv711N!tV#-y}F>6cP0LXk~5koy=95<&0RxC!(abI;AeC4y?I+VA+ zNbqhSmVfIS>0B2~4FCh;xG*$~_Vl4a`2Nb(SD;}?c3nHw(%|T_Y_6Sumrh zA7J*q21ZGLeig}kZyOPRVi&!S{F=*WwPM>gz<j^4+1(3UG=Sr#}6FnVIF-Z&Rn%D+^s z@s?Y@nCjjGc*epUJ45rbB~<>@O+M9(z2pka(Njdb|Ay6HrmtF}`qysSas@20kfa9| zsDIKuEdVR8IjKwL;|({U>cfd1IQTZw{&5C3{*;uHAU^nSvbV0`#NGoG7c9Wu{B`Vs zGV!Ku#IGJAZwalRSb==%bvsn~luPQ+eqh)DFH*RI1{& z=CyUn!Y8Ni0FdZ@rxg2sv3$Ij;5YjioLj`6SH!9`!0~9j`UaUOCRNN6Uw;k#+g?DQ z+0VegH;LO@!e$Om~66zF!ae3T8T>)q}h34BCUyR zNYfwgf69o|bDE&xO}K^l;1SYmuN$#y@8HO!15q3ig#kg}Gycc#zw#ykgU{_JC4UaSU#C{968H^_i2?9(IpS&!%X4?i8=b+pB2050 zDBpO`8H~;;J2B2sZPaG*63qI^eH{Mg{bb)8CTWkhZMwAxL4<};kbUV9k4a+E4giEs zX1N-pv&5sG96c`ThxC1EqBxl6ROOq<@gfG3?r- z)@_mT;?2#t=?tb?$4+_=XLdcfYbuQyoe9fpHvEuUuz{qF6+%5^=|K3(k@A4Hhf3x!S^l4rtS$rsX`(g88+KCR$#TfN_nQUdLi{L>S6-W-~Qb;hvDrQNs-H}%kBK$k&CVMLHu9iKVE}% UTFBHL761SM07*qoM6N<$g7ifU3;+NC delta 1302 zcmV+x1?l>c47v)CHGc%}NklN}J8%wOGViPRTLX<951u zp3fSPQi?z@GJhHwi(OV#tzS{pK2_6vj8cCznH)^g*qJSZhvMV@!gXvkYt6#i>SKk@ zJcxn-o;M0aDV;VekK5_;xSjO?>QieNG+jq1BIERLmlgo{H7x-Eu$o1fO(uXbFv6zY zY$o6Um`x^F&7xt>K!6bjN~X^;7o*)d*j$G3djBPVJgf602DSp zl*-Cx0gb8P9Tt?nx*o&Z_9M~NKYbk#cpBAoJzlbPo!v68+~7>YF@%qvg{^irq@}eG zW)&g-kvaf?J`#cRv3mgk$=(t4ZuuDQO-tcgw-}xmR-xzV525KK#_@<`B*59EK}FR< zgMV+d*==`JO_7E{`J)#!u0lTD4QXjDoXhLrxTglnpM3~^*@4RUHv<3y+Yf?7;|Od& zgvilffNK{!uBu_d<`~LIps8nPqNAocs9YSVP%aJ_6d1?YsS7A$426$B0PsA*2Rjix z(S`80odAI7iLMD>rQ0|0t!pIM)U)%tr+;I(1946Jol<&N#@zuVheJsG?T2+v8K|lu z+;I++Quy9#%eD-0O*=nz%qR(lJat$$XN z;K-`!451J`-WLjOT<>o`Fe3s0aG-KSYgL}~6wl?;FIG&(t%`CrunSteUZP`<#LE$mpg1rxEt)?DHw+0%1<&et!^CN z9mt6Qkm{7(RB9`+SeA=Cmr=3FNPiNd2a?+NL4K@ZatE9f0RUhCx38pOt5Xo4bqYd7 zHs6S@4@7kB(}v-F?{L7hUF{9&x~rn0#;)_P=bQLt4&LONJQt%R8YSeo!n0QzhxYw7 z)0jD3@m-!(i|jBzXXQ-y0YHM0lW`b%7 diff --git a/web/status0/public/favicon-512.png b/web/status0/public/favicon-512.png index b590479042d3b584722bb50477c81cc71f27bfc9..4ddb02342199b81846ff05e3c2de64993a9ceac4 100644 GIT binary patch literal 39844 zcmdpcg;$jS6YjeKyL1cEh)4_4%~FC$2}-AQNGK(>ON*p}Akr!*iiC78At5c&9n#&o zd*AQx-1|@5v*)mT4!fV2cV?dFnVA?p9d$BdMq&T}$R22@>H`22{0Ie*gy7qe|KAJn zjqvG1byWcW-z&HAOELhk0}oV{9{Xo*&AiOCd-76pZ%+DjcJg~bPPzl310?FnjYpn{ z@Q1f=O|(nyy3W3T?_|wDTGQc{yxhlB{Yr!+R%u_Gl1_YxL3x@0ZjZWQWBvZ7gKg?; zy=zH*=IZs5FNOTf6Zy(%v+C5<%}$Czi{M?Guf>Pct8%N-fNk8p4u=09|CBk@a@e31E$*KgLUb0k$=v zvqY`-K!DC3ry9^qiLK7tBP)B>ri54TW*{L(0C7GHlQqYJsx^ez64oA4?_ZS7OdG?1<{*~T79z1nQ5QuM^d8^52pm& z(aj_6mm(c<9T33wS(JpE$##1y{+9lmF%_yLK_%MWI}}jaNJ`09f@3(N7aqL~hyNYB zlBmwtRhejiRheG$7F~Q&o>E*vIO`~ym{;+Rd(+B#E~1s;JK29RUl^tNt0HuGVtC;gW)!DPoiN!hbhCeX6CQCD&T zd4`VhKT?2o5y6o7)aaW61%g*|L;(UmJk*}Ce~WZq58x*>{#)l=CwP9r2;5ecjr|lG zJvIkGBIL6P|2-J|@rNpBA}1`D`hXELJ6$x`xmL^3OyX0do9RB zfdKb<9}6A_s>)W&8DqX~N`15{YWwBD%e_U3^Lx5~28OfhVqdG)SP&mSuw=9@I{)t~L~ERW zw;^u%cFQxA%GNRn+KlPO5__-vm@;xrjF7FG~RC9@}6?Ml`LnBylJiGWxBC8U&ie4~=|#d0Ipri}ZV7 z5u_Z1o6J(8h$_?h1=@)9!%QdM2GT%*Vvb>;9G!X4Y<*yWenv|aq(U5IIo+_3_rH}F zz?CTmqXfUdqhzDTvcX=#<+I7XU!msSYF@>TSJ?!DMlYiI&(&d0ZK)4aXeEhTJz#_2 zb<@rYDHluHS6tbU0qk*=qM+5kQ$3r!eed28lWGksHY1Exmp)JnIUV;&#V;nX*f)%o z)OI@xwEH*JF?Vg$Yy1OMN#*&t+|IUy2|9}0Q{tB(er3zF6kdg;|r<*YYBP~tv#9`4&W7sDml}vf}fw+xb(7?OHo z@3krZ=|8(0wt{vC*6R8k`MTo6_AV(k2<2IYCX$DF;>Yd(n1Aj)z8jv^-^$DqZfinj)$^)@ z(z2GhRalO}1PkwYu)t4!WM6h%XGJK_+!6NY5u1P9lW^Qtf#rCfB719&lC}2W(*B3v zbb5?8BQ5w|23T;wmuhW2Ms9$A!~2Y7tq?l7eU z&(As3kzs&xqDu+Lr#|9?m=jn_t$Cd*(Y+Q{@3i@MsNGmnu#O}ntGFC(5pjA8-$_k4 z6RBo#$clpjqh6VtRqoW-Ik-G|b72rw{?NVgU&=FINQfaw4kb7x)kbZSLjBHVCkZgj3hJ_v8~V%0n0ZfZJiL$ySe>Fn_ujww?xS?~2V} zvR}0^tVJRtS1jIJe-SNp{NrO!bEGjobB}VpW`qv#1cG#t(~+LIxnGV7nIr+IIPuru zsYacaemL^yhv;HvXJQC~4-11rd>2bRUe=|iG$!-sdM`U!$Rgv6NkO}IBIvWY9x7jD zc(3s@FkL9*s9-1QK%@K^B+H3!C9*<(>_IMCuxHXAy}xpBd|ukov01z^CPtPQ8nOnH z|61uZko{iOIq2uN6{SNW{P=?$P1#Ew z$oYg};8W_AWijTd;?33kB;@fa)>r}%s$PHNoacS^wZ5-(6omrr%f$@7wx^6*nRsu? zLba2k9IWp)ab`YfYvaa24jA|3`h{4uz1|<=`8Y>~-Tm6s&iA^vm{XScqh46=S$(Ix z@at*IYf(`>onWPe6zcnYk%O<5P-oSOR&=jL=2}t{JtzzdcVWQUPQd4 ze1J-sT}*PnXGPvZwpLD4U47wwW%UR>$hnvo=v1=I1&q6w;6dut!3Z-+x&AM7KXbwC z@S*?NFQ%q2R5Q{1v$c7_z;{W`EzCE=-}UtEG?&bnyUq?C*i#00vYc;u6RxbmnZIWr z`oQCyX!HK5WO>f($&*v>vFXoGF)&;ZvFW#ehyh)U)_Z0p8MVkqy;u#H6Xt$DXnygy z4Ee&2*^t8ueaOm7rFq9jfQi_9(WEBQ~b+X<{(&ri0ILQWrq zdbHg*jWH|EA`UG4vU)Ii1Gf5bfT32k>r#`5$?A}JXeFtbySzKD$dj>76je%w_~rpQGfJt%WF2!4_m z_hhh=t*bZie|fUOFl&P?tbA@q7^U> zgPMx%q6?gb0|Ko{$$baYReXA&M@XeBeW(z0Lk+o2sX6HmI$~!yE3>OEGf)~e2vPy1 zwhUwqb*?0A?RVt#dDl$xU)d+i5cNs;SXxBsM#H7873en#&D8z9z(`dUqYVZALFI2A9iK=9%@wN92i zMTH(R52vse{J{Gn=Se&>kVw4;dvGLg+|f22lk@~c5wnO{zbSUoO>ND2LFl3&U`Qxm zVEE~Ef!W`*o{>g0+xzWww%A)@V!+MKsv6CfY>l?e%rM(ANp@Wua zE0+?*!^mikk>SDZw#5P_*@{m$z7rsT-fgU;TnL1@AqL(^v?C!eKW|gXN-%DaEc|8I zN4zm)Qy#Y{?C0Z<{UCelTSgD8%&?}Ob0@ge$oRbq`=r;4V4r$x@ zBe1SO9g@;w3|)EWwY9dEL_?%U0xNmj+HUx4kC&nNSG$j5B80MOh>@E}B=5|}mX=WW zZ4u){HY7Ek{A=6bKk}paodp~$D;96KM9k z+)nm=%C47MZcRxA0nFR41V~25Z*RGgCk&spC4gwQu^Fl` zcs_Ea{fV}yj7XBxV6`7&U1iA57^yIbkf%EJ#8~7bL)D3nL<{%WmET0SYoq0E9_1Qu zO94)tM@>^tg^P?(uZ{Rx)u2)o?$wRLb$h6+C?3R#9iyQP*_6P@Od2|Y5*lDv^+9p= z*~nF&{g?96I|Yn8)$HPA0dfh0KOuM9-Qu97;Sv6*un@vR#a!mg#0o(s2?BZHDlu}v zl(unK0v1)ts%-f+BH$hSzDo^_g3+oZHv2=Ucvh4FUv3MjB7ho>pLpgJZ2ou5?weki zw8Tyoqx+s>!3|=LzsX^HxSJ(+JwDeSzi<;ysY!w4cX){YhmFOs)(J4=T--aY<_`KVu$t77xpD)(z94Cl$=^b=k2ve$N;E=Q*_Ps^?9!PsIwHX zM;QuN*gLoPtgxqi&VV(&6$C|j4BBo!4$-=RVs6B=u5E_SW&nyi)snIq;qvzg>h<>Q zh%{Un!MF^t5)!+6=5_;twFH`PQ4eT_a_7cwFTNPtBJnqW77xQP4qdv7=1My%eM#dT z?13+cp^75S;+sj$Kd;KZ>uLF*75HHm0celeeAXXCT(EoJUE7obQ%h!)baIrfsgwUE z0^psoMr}Ua7g3^wcPNeD#Y8I|<&4)YctIAFUV8Y=1G)Db9N0)@lfy;jVc^lc|D@@M zvnJLO1XJy#{T1wbZmp}+^4m^s{Rmmpqh@-WxRJX%{nPvw9hRl^AAS3eu{c8c_lBJi z6rIyj-xt2OyL6Pz1oOSQox?1&Tj>Is>7-lAL*+*b!e;9%3D`C5eXpOSk40>>b!wFg z5b?Q~iBn@9kQ_$O4&2NKmXYHEbT}oqsU)%h;UBMI7%osh8E87^&_j0#znomJ^7!S1 zNNhf!J5_EN%gE{~o8dg~NO-A`;90M-QO0mIOKX=Rs;ymNMA@kB*0=-eus^S*fUg+$ zv(=EFny1j3+iPXsA|it0!=k0-CQ@9(;ZG)(oIjAur(^Doch1ZjYl8#;3`5_t{rf71 z542yT5x@0Xljl{)z@n=F1@CVQ(HwR=i`l+Bvd8HXFYY(3LV%3%BRh}M3p@{>S ze?-7A1phH0y<2zyV+5B^O<3R=A9g3+L#OHP zqL>pc@}q9R+v;~2F%DW)K)Ro1hI|`nQU^Tfxt`CO2wQ4XZJuu_tsX^m`~Qa z+VxY!54m*Hh!UuF77R?Kpn^A}vtJ)V9v`2lPXAo+3u9H~p9id2D{VIY*gfqBmz?N* zB@p7tky!(6W!JK8Dxz@{{jTy2_kWw_fF79d7!ILXZhJe%tSyxJ95+&LyOzpLHEpOg9 zF!=!#Xz35ycxmVT$JhF1phK1E+?T~hY4;b|!bf)00qEB`cE;-Zza}Q%gAifg7VF#o@QuE5)U-fo zTxT9P_0_8-Mw)P2?ilTihPkM}_iJkV1m1e54>ZRLCb|)DCx<3`@n>F-f0WGmE4KCq zSz!ka(4{~NmnCp>+C&%%s31Kz3IE`5O}zQjxu1-o1&)@#sUwsJKf3D;=2wcTyf;1} z1{5g**p(K+lH>K9Ak0@Ls5VuQKt845R?qXP?Ue()0z3__?Bwgd)KL@bE6Oh?CiKI% z!H;Xf@_<9yc!7iUDv4+BTg8WNaH%S?&MHvzVcTy8oxyt zDOu|QTHlRWzqFj-s~fpa*}Ng=<&z4@#1v|gD}6`NyUI_C6ax4lpQ(4ALuj|OSoyNT zEd)>|1&U^5j(rrwMdsuHJ3G4%*&ku{Hk&SExT(NwRo`oPd!bSyhZ8eciv9QkK;2}l zkRSsd7s9!-A`N(y=^lEfZ2JXMVJ0e?sKRa}D(Q07a8TGbB@HGMu}d>i@?iV>9gwfp zczONx<)webT8F@be}ubncALFO}6)D0pfRnEbsG6^ZqSRIl8xYCjZ02DPhm8DN`|xc6TR8ScCXAYA9!kVNy=;Ba0dfaz-Jp&?ERUF5Ruswu-ungK&)1sE4=G) z^`Wf2nwD2wLnT~HImt#+c8mrn?cS<)g}^{jXEw4>eG{HO^#EH^&pa_IMum6E;w()uj%7B2lAMqxm^+ zC0Xy1WZ%-gJS`Sd2)8%U&f0>YkVJyCVK-t?58Ly&&WLi#d~b`ffGBs=G;3>RkWZZn zKB=5&+YfrF+h$%iT&fYRheFJkjyH)^IzA3Qz1O8mD#9AR^#J$`^br0eI5XVKm2L#c z&tL41f(TQkfmDNxEL%aRLX-PzhH9O|1ZchysRfX*Owllts60II`W)vYa+7?(eScH- zMEspljaev(nj}x@b^$FZTRpmL`GoI%rou_(9xp$YX(Kf<8W@IZD#&L#f9%X5sYZ|k z01DE&3ZUL;dOG~{BqliBy>=rqZSh*a@+URD1<8A%kW=P<$972VSN&s=1-nCci9Z6$ zCceq#Zw?g_lfAIQp+yww0ly$9KawI$!DN?~3k*Tj# z?weNq4ZSz2tSSYUXO;;G(<9$9r+UnT<^7;nK=e}(Es{o3vOZ?0qGZw7(G9^qX0xd! zTX6N<+%-6Ps4d$%_|e8s@Q3VFph(BnEpfjwU6F)yi{Y;4^UEZ9kGaDC7^n0tB~liluR z#oZa2>?cb2&8f9a3;Rg#x3pKhQtd9uLhwEI${q4jhk0OrkG5sE8uLvawx>TP=tuD* z?tbpCPeEdLZHokv+xc-V%66up@$|aAFW*a%cln|;LsP<=x+%2fjV+Y z1vhIOb4>88sxTpmS~;0=fznQ@b@Mo`EP+dz@F<@g7Ms%TLdVaTI9cfZ8 z8{nvSOm|%tgj@NI&H~XL46giisX#+PT_6$W6eGy?vJo%ojKhV1|1j&j=vpR4rO_~+ z2Nc}^J(t1Og5xHvRfdwRemjU;^jLhK_q23Zoe%>mlj#-Lolc*rtHw_1hX6B^aL1&f z0BOThdCv~M`4o=aFTGV4Zjft<+j_k1E?R(PmAy1=gtGHFAuS&tgw#Z%9-Ir zQa}hIJXgpyTNA|o!d3buQp!Wn^Fq`5A3NoTQ+|E1P!$^N3q&aQ3Giw7T}hiU_n+H) zscEn@EB~wA`+|!2Z=#__#fXqSDbL-L1KrC$;)+@dR9fJQ+rs5tO#W=2wnD_KC!QVM zSPyg3B1^+_@i&y78>N?c{=0?$YY(`TAr7z9zo0qianLgmn;MtbbS%UX@5ffA(8NHo-k- zWHE5IPrWjKt%+-JeAXr0w1Z4?PM;+qSBX7xH>qs}?b!+38h(>`2Un~VP$=vEN{VbvVA0J>>3jF` zosb$P6SC&QeSD55H2#K6B3SiVg?=Y&tR3wcg$kL)cGFwI#gC`GJA(eC0mb!yPP^HF zh~kAKG|m;pD^(X|5$LCqe$r}m?zLKs^IQR}7oBKkfrnbiOaK{0i)9)(J^A1fB7L&+ zk~LA$U-3lonD#kM@~mY}nZr#D2-}(VX^Hm7(>rBbGe!WQc`lb7c=bqXwBe4jh5VDt za2TfG>s3Ej0ubhP;^HS%o@OW%PD`EeTv$drilsS#S(Y^fnH+c;z7?q}8dv!>l(uxA zWfmXu*yfzAf#pM9c#1M_a$7NX4l2Oz?{$F?5nu^jb5FMePbk-2ooSS{-eaHddsXtd z_%Sy7y1s1bjg_^_DM{|r?zBshm6+NJG?0wX44rFa)*sH*XyHpAZw{pQRX7v1qez5H z6o4%X)ZAklD25C7URuJbDQRct@>Hp!xnyhX(1EJnYC2Y4SApnoPh;3LOT@4eXE!{I z`$u{`ThgXS9B`J;8LAE03fLfG4sbwp_000NivztLZxy%9e&6IC8~as6ye~R>_x!q0 znQ)-7l%`hxvX+R}mF2~h2`uO!hqH|^z!Lu)*(r@;xtG z1kJ>~-yV6xzfyKsw*6i@sA8Xqs2}jIeq2Ws3hH}4!o>hTSjZW%ZWeN zs=@{G{CDf5i3mvmf3G^C6jH==axJkhX^yn`9+KA5`!^-=lZ{(;Z7>evar`~Xz<5yf zlQQ23pF}Aq3IoFw`(9pNc?@+#Ln@<=zfZsDy1v6j-8RA|m?>zNS7X3_XlB*Ay(c+- z(P{MkDUr*wWjRSV|H_CjP&G9w&cICd8UD1OW(mIwB~6 z2GVh&@BeQW;N)tRL@QJgM0!b*+)4IY zYg2i0ZC(@gbV^MMh8>I}Mdk0k(d%A|M>!~UI_Ya2gh z3s@)l*!%bK0tX)>@fg~+7-G$ihXIdl^1k)xema`d)6HdjUC3``1>Sae`o{YaC-(z3 zm*H-FhGHuY-LP~flzLu6OP8HW9Ya`k`kddIa43!xOD#pXH(>G|))>5YWI#ziriVyc zkO2(CC33F5G`~tgyfPoGoNO-@w*DIg3*D6 zBw>_!)gzS7iZ`{;BrP^GJ5R}VfoENlF(AMtK^O;+G5V3*!Ov-VG7u~*h%70hU!-o3;BFLenn`qtQ4yaA=jqmorQ6g|B zCzCn~Sw?UkKx#scv<>ULnnS@kjatfy1lxR=4<~`*5uYhL#bM2A9+o0=6@kRyt{#EGw0ZAzS*mYJY z*dmCqBHqYm)nMx0b8C-ZEHa_%@i35eS*uwMau)Wq8#PA<;C2}+06!+a!9A_WlFBPp5X>d+Nk%L zLDkd%LCule{5PX>Uu(m)OdsRZ{N~QCylelJg`8XR(mMn3E+fOU&iI&mJQD)9pR-w9 zNvXeB@uFWzPP(Km#~ub&Zik^CXZV!mz}XL=h`~u2090-7seXzb+kFDlWy>VvSt=SO z1>y`+IT;I^LO8Rw7r8Lyx{#1f@us;u&o5kx@EeY~-Z2)5*U-!C5U6i@LYDUM@a*Lk z_YTg3`K+CVjL!5Vs{)$0wjV6oRl(6PH#_l<3QX?+0M0Ma^hr^mG`mEi&BcOlu{**n z|6~ABm*K2xYB7}~^xUR8X`_(OPqFpr?HWx_MKvAyo14uC&J6OrTFlZBEEI~AS`yao z2OfFb-z(qOTsB347;Rh?uusnVJmnOEnFl~_kam_$ko0aA%gREe6-oW~jh9|=Y(`gw z(*;`R+o%kt>~0aP=7J2Bd}*or-}1XS+PEfG- z;Sat60e`B?Dn5%ELRNo}Eswsb{9cMH)&&dm5EO%aDTQpcVw`@KH$h#r7MNZN=gssH1(OwQj2$%0-NbNWZ` zR9@ZxKG&1k=QBZ#&9Gu!+fF2aT<;h-xjQfpTrWbj5-+`#ZR>S$_=}vK<+*vsUcHZq zw!)BC8tDTXouNGC-jl+hA0U9vq+JL`nD5l$fNMkp{^2(!K?~D+SIWhI8(;M2_OCm^PtN^upt!AKdsM*`{qB z99b_8iv2drLE295?I%z@Hs=c{iU7CkN?T9BCROiSXp^D?Q5(-366rK6(zt}VQ=r62 zQ~ulcR-}4;z3;Epy$+1ltkoK~Ce_Ki%m@(Z`~~0anD&6kFRlQQgJJ zFCj!! zMNbZ_h;e{%_Q=Mg+-21FlgVST8Nu+Zp8}qvyiGoFhboJIH_GX%Y(EJnpLmH0vbzEM zT`^Yl7~6ErdDc3h70=xAB2n&DP(VQ)$#MHszyaHYF9rFtCMGg%obr51sJ%uMzuTce z8bnwS4F$N=8=9R07Xa&ok9P=we{)@yyU?%1Z|Vg+{Yf7Sh~sgVF3HEBis-rfZT*;K zj)HxCpVx!+#U(r_;1Q)>@9N(4NwlZ;Tz3BIuUXYg9h|Dv(Ww=7!ED!gO{6ZxShN(n zulJ9Y;-eNBATX7~g-Pm%pax-19NI*HmOY1&`LuV^V@%-5GlZB35o3nSfKHe`^otSt zk0n0{h$itq0LyH-s>gNW$F4$d+v_ofaJ}9A&C$=apq^NB9< zSTN-6fR6UlP8G#pEvwl|z5&DzWtbV+Y}8s}F+e!wabWa|`o#Q@;yrHYB&wL^k53U3 z!~M_tY$>*?=Z~AWRp?RH%F{U9-EpQyu<5#@x&&I|vpbgevO>4dRkn^+KexMLN;a2v zK98qT>U-lK{EN3=1b1Fq#{6Jj{_@S-)m?q!=^*D<)3X$t%>DR*TXHpLy+rxUajetP zSyODSC9G#uZ<_<9pOz>HVIE1`{}(%c$c;|yBP6*#*?ZHo5Sr~F{WC3m6<&MBhs|NjO#)BV&{0H4WX z9*^OvP_$v*j`N$Jo!4)55794NnoL;`z#$dm__P^|{LT$olaoaX*%4(3Hq%xx(#)qC zrORx*K5%kRL~!eRE6sC_WNz=@Md9~Zy_aTAH`iUh_f3uX2X1>K1=+CabF*>ng|VX2 zJ#)caIv0Cv1j64sjF*P}aTaVU?qj&9;$a$X>tpP5C-I6sx;zmJ;98oH0q%W$<3BaJ z^Z*aT=uQ8))qmp#J(N#qDlWj;y&79~M_G^-nYli9(wvUS!Prjl#3d-5?|FYCJLdfG zwTYZPxu?p3a^>Cr35jRLW9Vk{vGkFJe}7qtAbP;VX2hyN5&LMQQ%)|*!U#?KOC=th z8(ZWp+F&UZ{`w@Nw}AXQ{cb#2XV^DpA8 z=Gx<;UXcLcQR}*PNfSEN$Zjgw7?b&}6jB#n58aWbK06!TA)$vRXe+p2=h3-DxK2m}D+ z5m(@wI4=6&FB5&34K=Re9~2BZ$fMvSrDn=eN zvUq&wokr-BoCXMY@cd~w>w`W`M8eat-C$vS0+%W zj^`e-|8?>n{LTDY>Q?s9l@4MU{+!^e%BS2i3^cToA2UvLLN`|E?L?cuo;LbfltO;J zC;08IzlwI@AFaCZONiDghE0*`h^OxLOMlXO^zKsW&*L%0ha8@ob3cFnw^cDAQ1FlS za9bLLM=3xm+wDFfkVIG2uE#G1`wII<;vS4D7lkUg<1^0pIXkak>`c%HN$ZZ1K^EE{tpVLQ~`f#HvU!f)%GN|5b!V+}x3We{%hsBIYX9>I!EPrThtNn=Y zLDN1R$a_VHCRns8jcGTAPcgn;l=FzgE-Bx}Ou8os%xRkb{!s9 zuR6u+Qbix2kbe$%)D~?HHc0?fY*ZeY^1f~lfDOikr>v}P#eN~5^STv3uN!avTc$Yu zdZhLWRY1g6#qz>V8l2XNg!^6wlRS%QI)0V|F@80j50Q~0XUu}q$rCpW?0a3~5zRc8 z$I}M&!G*9Sd7}2@kuk_JF^eV0Q7H!l4D@oE5F3hU)+1|~FnV1a#|(BdlS<_NHzr=<(WbaP z8hev2`K5s=POpx-Z&t4Sk<)ev4@9QAl>%@a8JO3!my#=cQG96Ow=0lF>qDrY`&zY;y5la}i z)7@^b-!~Fu61U+q{v=0ef1yFE;2BlPpZ^_kBawA%@S9a!_WqHWzJFlJhR#x$}nMz>)v6QPSs+@!=e$zpwLXH0od`_DS z1`Jo)1s|>EP|fH6&A3~FE>H0sm^T^?8*O?OqcQ~<7LHuH`+a?c^9lsniK$(?A1g`W6v-|H@$}0bOQp1 zPJV%tBG54QD_yGfGUH#nK3YORVvSn3sQdQ?Ra)bJx@6ei@I<3ynYn%f|I1Adwd3Zu z+9j~ui5LYVjHozlbq&4+dqHy@TS^g+y_pdqnhc?Ph#3eKV95##Zj%^vT0K?!Iy$X@ zzt4?#_}cGMk( z0c`JSnk87oz8pDZpW1IwD|{72wY#lU@Y}H2odpA1@bMa*z6k1;OKnn2?eHj@Pr3ia z8ohR74eu@3o^(pLwA~J-;Rn&p4mvpC_b$Nm0hb9y{+9^*ffS|NAIjU-|f!O-}DPwj`MLk*pPjmB6{-H zpb*8P;Am^Mo8hAO$li6=Zk7p3oDbx^;T@NB-`>zddF^uO23(dnpDZUH$O2szK_+-^ zr3RcL1p=@abLGz^jTF9De&(#}Gi-=8)gbZ;Ii|4_6q(Aon-O1l7SP;J@U@JbJvht_ zGC>Yb^@D>7-~`z!IF}1kpRTyxft6CQhKh=iJMxje%P`CF=!*&A6_X*m44oTaBEZ{ffHfM1c}^?N1o*UEouzD(|9je#e#n*L;L;Oj zOz=E1lhamjY1s3R$yeo})8ljY!8NfhikUx8lu##SEaTVBct+nm<5ThJZnRWVH=8~x zqNf6KHx;l-1!4VtB6t|mAJR85{-pYv%dgMX<~}9t9$Q8m@GTK-m1b+j>eFuhoLXIt=1|&oImW>eXdy%T_#B z^wd1gDY5BwKPIs|=rkvp{{<1E)3mQ9l<3XNnzgD3_5$?!^FqUUrV2XEM5v?kHoNF= zAOLej>3jcQH=E4InA1^SpQ{9Ybh=eTq7{!-V-9snLYOu4te-nJoI8oYHani>W@Sz7 z`y9+7%1&W9Q7*ZTF+0a^ntXUNa7M&-rrDBH(608MWx=dg6+gh;qH0!M5R}@|(PGT6 z**)&+%z3e3p}`O4Oo0J8J&VJv$RJtz+zuH`(G&DVwXHo#sX`F{T3US=Ys_lLP7}o? z{%R%4mt_4zLgjUf4h|Iw#VQkt+z3Sm2G2&1b4olrXznp%S^#pP)O%mnFQIRYnH|!( zrTPJ8UGuGhVMU-fsJUs$L6qXc0FiWdJcjz7_sgTI9fC69A{n)sg&cp{xR9*~=bUOv zpvUjWl8rdCW?Wrsl#P8grvRRa<>kn2b^2QA;DxXd6an>yQD2R&z`HQ}so3nZ`h~~X z59W)(n-hy^fB1w|OT;#t|G4#fFy}1DPwKrm0 zT`TooN24BM-eeXo#>34GTzAm9SJarVi+ZI2lzR_3QG%=dDdPmC^gkmk4p+E zKRnOco4?y#RV7Pn^tc~+u50>F`>@0j{F$ng-cO5>d;WF-8Ts7#)&spL;=6$PD;P%e zv&(O46i+%zLsE~go)l{WvJ=N*UtOZ3mfq{ckt@+cV`_b*s>&nUQ??VE$EXd#w7*9e zT7~mHQZg|wR)e42gfmZE9CzegiIce^bX~GQTz#bqnB3{x-M4W&S-!nh_y9|l2{8s0 z3~_sEd^CsfY+Rrk=RMjUI_Ps2%w{D>Z!d>9#qnC`KhLC@MpSs@R|l#V&&=+I8mh$3 zWp+bQ;+e9$;dO`2;jH&Z?&HqqypF2w596p^O>^fxI82JaM1PXoRk7ENgHd8uJPEBK zF_&qk(Pw(8Ny1{#3A5JEpM_{6nE=a`-v@ zH5Uh9$KA>PPTBnYls}~*_d*6xBPRHcixQsc!2PCJ2-?XIoTBntuJTxXrLKz;ls<=1 z+KT|+oS>`@e3@D|ehY+tHZ=P@#|7>d1{dc7G{^;E$gXz@9>`_&FSWj$mj85*!6>+z zrw46n^^xAN5cpTKnX+LN7$kd}`+U@B?C6422==%Ayu=E7-fRUa8oiL0t^2nr)o|=e zW}%WMc(ttfFr^#FH9o3k+t&ES7RzL;P%~Sh5#}jz~nBxDE$y?P>Mf@MdgY6K8l;Z zAY-m=EaOH$^Zjo15ahp&TQ-U*LQ4L|d*4rwIlT6{kjE!;yAx`%NCfbZ$T0`&)2VtuS;FzWW?!oq404MVu?QWoa5(CLPNI~!>^w-%Xxso zA^(@A-a2^ihV?hxC+|k#=aS6bCvqP>tm|ub*?Egq8IjlO+sGyyw9cj)w zLS`TnRqhKtA}s*`T6zK4S9d`;ZEN*5`kURYQ@3ZAr^#iv;qaoT=>pnSfMcSfTE~9R z-7rg)C*D5>+5hiERHagFT0(|H9D@{oC>i6 zi)jv2uQvfkWln=q_i4hoa|Sr&!XEc-`wYwiln7{tBZbIa3iSlga-QMH<$&Mtp{EVFbsDh~z0sQmPop>Gm=PH1mDnVsf%=jU5y{r6r!&Jv#L}7Jf zLBZGyMZjawj&T&>5jweJfiQU|v>17chjrkWzK~g{Co>vW|7lSW=c&if`J$>|R0lQ) zOt@75dZ-@+p(m;av#6LnrRq;pVFIWzI_Q06%1xt-=j(qK?xl3NxXw+1_bYq$m5ZD= zFNmoB5W&P^X;L<3p=ZE?O1Omhb6Z7R8(Db|P?R!}wEr05{jb!*ejVG9`q_uKtP1_o z?8iA9w`l>)IuCx6JkQ)AS4ldKY@Y)~=LzT$xag~6v;XyQu;0icneR+L{GpXuO`e2n z5O)kQygX^n_WwPD^MmGZD{PCsrH-)=2Sd*BUG5o=bDS!z-2a;e*rjY~x{NNx9o-pB z4s^kJ1@eV+=HSr&C(p+6JolVbRHR3zn*09X4!e!hL9}lfCPW=x=}*7#p)b(;K5W{l zQpv-+rzN`a?Xx>OHTfq!^Kq&qP+Xmf@m6Jyo%vtPouVy=H&yNf57#cvsMuaGaxBUHa?eH(H7$W8vTdji`ts(kyCdxpgnxs9HR*cw>>JDu(8j)=PG9y`#dNYz|I~x|?X4QS_;NY@PnF4F%hXN3< z7Uw4ObY{eQrz`*HW_*5bO4zgPn$rG@5qIoQ2%Ahg*W8Keykdy)@#c$sq*Z>22R%VX&z;9(T*=%Yhii>ML)s)9{U|M^|Fg(A49+ad+kqNI;u#IWqzo zW3T~fgUFo^s|nQFOjo{gX|5lGrAi(@rTO|Mj$u-j$9Jo5xiJ&<-0vo|pN=pRJ6ayr zA|n$`J}wrpg$8!*OF-=3&%$sy@;je}_)qS@TU6thb{1*`e{qp|P=Imo%bvf22+8P) zh{kH-X5_wSD~QRxcvq))?wt4VX#*bS;2Zt_IKZC%UHoejZ3Hj{8L(x$ceV9>74igM zSh&6!@Lfy)nF->1+?NR4*QiYQS+uwJ@gLu{1ROW+${06%Zmpm#kivZ4JPn5@z;Fa+ z4}S@Llg0{K&jD5*(%ra!FyTUK;9bZ^ z?v`ZU>Hjz>V%fCpUfCZ3Y;@@OFT&H1ja8vP-!Os9g_!9=lJd#6{VR1fO}+0pe15g^ z+f|^P)iLEk5@8Q`6MS5JhWMND3DC#R5r1*aY5XZo@>0B<&=iRfT!}htz=)2&XsZ)N zgF4qk3aC%-Y4s~s@kJxhV-?xwB%%}nyh_6Jjks6*)Or&K@D$lJ_IZJ(#ajCBoB|-# zjCfv4$~2}+V5Tn)HBzKpZhi#-M3MX{UA%lhh5XzKw}|YeHK~qE#5=}c!P;!1Vwf;E zo{)H=4_wg$mEu?Tar`&jiqe&c!fw%cF2$=FFkLE@nhR`wd>Uy0@apF@0h(^w@ZrH* zBCp$RA`Y^C7PHb%!Z0J_x>l7y)BJ0CL%Nk*+kuhs#VxO5kc~`$>CSFr_WmrDYF`}> zd#USfx60`81mg{x?w=>OKT1Zfyd}n!yg&A>r2yxDb$tTHLQB1;7l$K*RV8wcmSz_M*9*>xS8MWvue-U~=ebb22LsyFWaS&`8uw)P+@_2M+_CR*)5_|2_si>X!Y)^-ZSg zlB(~F{3Nd!_PFC}*k%7vpfG1Ri3~j@789jijS*e|#PY$s>?5Wo*7%mY>>Mj2_=7Zw zYTg%2iWq9h@jr`#Ur1vL(|U?}`LggRN;yHs186g?7QIi%NE{p)O5e{gyp7UxwQ=H> zY7|^}HJ?iwn3o0*5boSz1rOAHpdKL`ouG!qk1(U=y!+gku#d=<(3&~yS0E4nlxOkx zKHoyzIVS-4z%^cZx|;@R-FrhG4jiedp5!+tty|g@7}n7UKI72)&Q1|>lmDGz#Zw?_ z!VlNIsOgeg?`*gszhwGTo5>ttB%Crkl#@6pxLN$Yh2WLB2H(H`?m$q>{-Df$_y+~{ zY|r*I@cDF+-5%e&w@PA<5`ZD~Wfdq zx~3mZJTUOLs|vok-thMjrRAK?H`=jG=%d_+;rHI}JUhd;eR1g~XM{on_ta!6_fW!p z7*el6vJy~k5J3WLPtJ?Hc%Ihkd28o#M00Fd5Ci-yc*Z!SIO-z8cRfoFqiKTsA9!CDar`(aRY1kEYK3?p` zVXNDB-&kI5N9UbWnEIiM3gR8n0B`8fXfjZ-fLSbbxUyL%6Z?Itec7vDcQ|@n?zD%Euh3 zkfJ@z77*j`kHnr;1I6fH8r_U!cY^*y(ST3OWX&>UeNa2?@b`PSoJ25TF+c z)qIOes>O$&2OeIH@;};t=r~E7(*1b%vOTk1{B|W{`Er{{^2l-5%xfnH`9hI*fQIW_ zfF4Wu2rzJ0l)auVW8g_<^dTrYFT+s(@Y_(-l0V9siN;qye{HT@6zBmHebu$4_g_B- zTmkT{KjGgPU(LX*Hl$2g`uz8cbiuFQt=r!}QJTA>&;Qq~K9t ztt$5g69Bf?ND)tf9W)?ApSJb#0<$=;6g@DcG)N>N=tMFLzcqyjgXlNm#9}f6_wiDD z^b!+^P2|QNTrr2NYQdM#y^pn(3Q*Pfj%m_ztOdu`7_vOvX&2gVdp&>P>ma3M=fs#>XwnzkR?}+J9}PK z>N0+Pehb$Rox=GBdeq5!6bzwyfAdc^_5ODB*?)K)vpJv1zr7==(%(X z%BfuyOcETR=0ePDG7aD0eEozSm?s71$>tonTNp=i=G2vRKbB_^2apyIA8>*$xiOdn z(3Uc9ye0Z=hc8GYSDzV2$7=eYc1=XP{I>;}*HFB6Q`Sz}Si2J@(rIEqC2*#iu`<$h z6n>1dPd-M1x?;16(17PxYjZUy>NhBSM?n8|HPhPKP~@`bhUGXj2uSX~t@e)t4UZjo zMvX6_OWRAaImt2kmXuj9U^(*4NCb#4_5R}e{&nEJ7+{IyJI%-+cCOGs*c{0kuL;`a zVM5P>_oRJ{gREWOn&b`dS+j9w4dutL3JB-SC6Bny61o`j9l$7Xn*8u;AzUTYT@XNL z3%FnYAbp#Q+SG~pa3M)AaY@^d%wieEbMqU)7{t%rpPu|+qQ#A6KA{zr#g+lX{zyKnDSDK|DZ{$ZW*+H$w?{${p$&`7nhbir=6U`2Xy;kUyU&Z3R}98 zctc8Met%`G>tAW7Cj`stj&O;5?`)btj;jDN$5op6Y40~gPhSIqFuat#Um;p?y~e`U zc#ZKceKq?07K~MGn(31OcL`nCOWC^hQ83y>xf_le$1>Lc6f#W0Ra40J&_2~Pkg?K; zjj0T1-H}<##FoY(x-u21y@Z_o4xr!iIviDS zHQA;^6kdapH@Hi@*DJ3KwRY^6pYI%o(1&yu#J>iarNf4U{}N&C+G)9Ijq| z)FO8hD}2l5AuOw=IKT2Zu}nue7GuI=-pXbZ}+X8@VPjE zLS1SD>0{6rLFpKVt7jAJ&QWuo{3Xdtb!4gfKFR5|QaG9$Z%_e&O_z?l7l2PK#34>} zy!!_B@%}(1vYxjeGuT_ihg(|Li z^*u|tWb<963-s4oNCyt;GYR+%Z^M0!4{sWw54eqibloTm-?vNO_5kj$#6aErwv+hmQqgoPy-}r`lR!~@sR5|1obO^ZXs1uhuKI<5^T#xiVuT7Z3 zkK`?ApCn_GegFWBN@qeILEWYt!^?BQ-RB=uXLngpFyo#EaVP$}G5;OqV)l%0@3^1U zHnvU#ipGC&rP@@TfGRWja{M+)L_G^gL+N4RK_0LgM~}FpW2rfuv1?++2)wg!CUYO1 zXt7gV>xHc;gr0Pvx5A$3=re$;3#jXk|_;#7lQ3Q4_v#%Mh@oE_|;GS+cq5?r6$4FvEjVtc{nbrkR_IDjdXx@c)@^ z%wX(-aQ6q=?%^2-MHTu0xY|{^gbR07exuMg8w%4UkE>4H(#d~3HS4&q>+bpB1ta|> z5kXCpPzRX8iGK57(ji>IYUqFIIxVQRb!v`zu0Bg}jM;?oZV=;;WuV^XpWq zxs@En!&!U>y)J9j&eiuCH*)yX5gKovvP3^qJNd2A9wF{@6UF?d>s%#m8l;k0fv|Mbqe&c5Fj{Dd53*62y%%erS8 zbjp27MJ3OL!UN5}(W2OL-TWufP*p+PL>8jgN9DfVxB0!h%^{Sm?8SK{n0EU2ur{Dw z2GRV^Y(pUCIt9r7sI9=+Lgpw8^63KRM$Hd@iNwCpZz4W}`Yr(zvN(6WkHiq=z*#+v z;!aF$9h$F$K6l~u-pG+yIwBx3Ah+_xn~judiRfl6-8pf$tg7gM8nmpj1!|=N!rJ z{Ij))_mDkJV49Nv_?v|`QLj{ z0gSa+#|e~CPwCtw#qea9MLqE`B&h-GVu4JN%kC^6I}nR*FH(VlVt{SgKG}1&rsve0 z_c6Tv7jA+;{`cI_yM3%rEQ23K5$-83guaCf3&r>^iIG3z17b0JF)5^Epkh5QF5{z# zvFJNK2{G!{C~i$RMjE!Up1yud(Eq_CEbhWnE`(rD?Djok)28OcYXArcoIJ2pI%Th- zQ&G@0)550afcI`zdsf3u=#&{-PoMgftls~udqm)NBH-ky@G*qK@tE!_tC`?XZHxG< zzTtQY^5ri4U(I;Z$5dI~`2xD&pqdi&C1SQX?dZ`Sfax0rv^Q_On*Q893C`YCIpO_% zeVeVjbDb!U=LYzV+WPs=%^aUkH+oNN3kN`QEq6!sj+mmPqE9MKxCUgZh5fcMaiNZ^ zQ2b`CEMHdBVs_a_$UxFZgpsU0h4m!JvofoPnx&Kb9q8`CHqzECDO5joVU5vw(*+;C57eQ) zcG?LQcpW_(w23sz8#FV0(l=wzl6Y3PfW0-a((^sZ&Jm%{DehX=&GQ#=cyWWF7DiyZ zr%|igw?T(>#60J1tk(_w&8zEk)P?;6JuIp*OmNXVA)!px+_1%pi zx}m6q_w8Ty=qsKf4E;4E=UI9?pF}IMZ1&Mb^)o%+;DzQTuri!)bmVG)gNCso-atT@ zJV$trKkhF_acNXwZ;URZ-?dNZstW;#jQ4wFRq*<5)1uuL(M5!5nb=S!A`9Q~mSMQL zyYOgYTSgMK&y1NU>PxkTtv(=(%m0LRw+*4S+;hftX|t#v6vSo%eVU(}glDWuj|`pU zG);7*4^vCT<(wjjQ8Xm+M+!Na<9B?!vO?>_(Xnp;8Kjs2fxsxiG zeJvaj_IcmDjM6zCh5i9F92fibComlks0bDf;BFn_PxSMb`ciYMhz}?7n@rgANMm#z zA&E5h;<(G}9^Fh+cq;wiXmpz9H~Df!2ydq8)a`#)U}0OStK$cAeL8vuiDIia0-4GMbmrT+dUecIY3sgT=jF)4y9t6rQG-!4|UDJo_iM3-+l03tKkcIr5DQ;BK{>sHnL5 z$TQAuYh*PzgJ=1E1Khh1t}Ynp-v{~SOMo@qG z$VCwI(RoHy^lZLc@iZYP(9`pueGDrDsw?|ze*q9wm6hfXYN9Bu;{a@E?qTI@JjR4x zl)Tco__;3*4Y%c&)aN8u z>A+O~>!C;D*(Dd6gH;$6=-ln#mBFBd=aj0>Cjei*v1bLJ$$qHF6L8DRWPA7r z{>qhdEFOM}dsUB1OI|(`f&wC{B=yWmFTPn@j88jM-7aN+m_um-&aN8_-V`&EhuM+K zwla@DU%J(Y-e~wE;l+r?V80BzUTq!0o>E73u?nm8wVq8=*Kox+! z$}#V+%slhQi%lmf>_97#)+emy)FTAjk`scx|jPLH^1THdKk9Va;6R(6Xflb4FtKMG6YC|25jp=2+%mx{Su zpQrN!36!7{)sh=K)-5~{S&f>sB>UGT<#vaP=YLd_SNfvqgbCF~r(i8>befx>Iv>5U zyJa=WnvD)dfYEgk_oe1m^@ZJ6Nb1w}Q19w`*1z$S+b05TMb*{nb#O#XW~zGJhp|Z8 z4AErjKGRoPYiHqeRRi_i_e`jKhMyL#bn}Rr7FT6X@#*>}n`qEt05$8F7(ts1uGF9V zq<_2-^mH%q7&{2IfB6{ymF1TktDvlqz1ys!C!EW^OB=ldM#QU0C=y`Ik{ADz?q?hM z)=i1+P+J0RZ@#~iy7=F%gnV_(@w+T%W^~!PBr%Qm9m+g=sc0#blgQUgYMxmQNS*y|3DDuf$!p zjwNQAus7`N-eb^btH?kmPD{^1Q6}6pOZ+U}*hvfFmZe5zSwb6+*pPTe*}cbvp{ZNC zgb*Tm)c5XC{bkJ7Dj+>-YKiPAg`Cv{gN6FlC|A2E``gsWq^?8yty@E#n_WU>x!NZ5 zsNU(@_-7%lAyycGe4%Oirpwtq{0!j$rcQ|8BNPm?bABZdDfj8fS0*TEC?M+YC11gI zGM(JwDFR&-;~UMGg54>>mE;pSdae&J^~C4}Com|1Y@LV&6%|v`_>~hDq?p)`S&#o7 zC6Izo4ffIajG73+!88hVj)Yi0*Dyo84(?Mc`bRB#HSQTNIs#eLc=is(BwXJ7aJNvS z>7oz>y_pHL9Y1CnAi@if?z{UWSsZ9bF|6++sbV_6_^Q^O=GU`g;u6e4{U&STJ)Ma@ zotNWdfFkmJBCt^hWfV^_*U3FEr&I7w>i`{WLcv4PrmW; zXZ|8$=HLtMMyB@L#WuF0yWiSQu zR%x1eD@c-W@@HQEhT5`9mMKsO)6%MT`l`#p{oomU(ceKo-%)|!BrvEKGF|?wsa9D6 zJEpCEk^@Rl9UL4=f3b*z-k7J)>RJ+?WeY7FzlGeMGY0!@r-bN-FxC1@1l#k%mi^aK zM;OjPv4jQU1@wKeWqHeHvn*tGxQOSWXg%MQiQO2){}E3Apb){INRd%Su0-=XzFG2O zx2*k|6RDchlu{w#V)6iQ5ua{E8JnFyDk{Uz1ePGMOg*e`I8LeM|6>8p|9Ft>P&e%l z{@SDbST!c^8&A#~icnj*#YEnAf&XEJ$|;mc2DlMgt1zDU?P`ccE!g@k!a zT^KjO4rC#WH<$Pgy$n}~BmFChCsfyv_+$8(67;PmStR`dcA(U5in#$Rj(NcRePKzo z5RDPqQ2D1Ga%IxiLO;!5clS&GVr9b@D&b-PJXz**7Mnp_bqN!x4|@Q?rl$4b91$~v z{TFm*)@!56J=QSpJaFcUml=V(3)v7M-tH_iM@=u($D>*-ntScZ-Q?*ba2qK z)N=GT?9q0%`|;s2d~EbBx@`AC6dVzN&Q#O6-GX}3s?-rk$r9QIMV-c>BrCC%d3T&L zO3I{Xf+5WrTeNQ-AyCR!j$1Y$uy2B4iWk@qu0Qp{;h8_4y{vM;vwDRs$uB`sTUSLR z!N#WQ`c_qOd^Z1UrLR#~Yhev}6PMWNfrP>5b3qS?LCv2 zYR6_be_-EfC++8>`FTD@=v7Fwn3b&SgxQ`v=X)#j3c?C7M*i1nC5_pfQ07ABbd)uIINQlFMd!AgOFBEO z_m+Hce%%&1iD=+8k{km9&>q|h_rRi7;Y<+FFtbV8YZ8^9j#Ngp2!V{v-?^vQwdjhb z9{9obRZ@tb!skZb406(;lB!NOP-ZNbD7W0GyOK1ARibaQ_p5%$Y&A569vQy&C?v4W zxm~S_rjhj@8q%=^f4>=()4a%+gvh_eBwmil#VQUg*)<)%Xl@Q6#*)S(gB!&Tlx_Zk zCEgWUtfKGEhLH+XV)dYj>fd9q<<{V{VP!g@%9zR7mv;ZtF(4)7RJC-dhJemOkq$vr zJ3AR68vhT>6a*vFYWvbpFEz@L7k7ly!~>Tt8gf{GHdIxK z^->J66g*!G{)JB0?ewECg!>~>i-dAtj=W^*f&@ejH9x(bn*{$9@wYc+-#sErHKTK! zlOFm~hHOoZ#O^Zdha;wi;$yJ^=hnxtEpw7DWt?ZAR|Ro;?L{bNWUho4*AEPpmG(c| z28(Sl=VVEbQmQFSfI?}F%k+nSsFZA%bR`A&IKBIniYshVN63nZdI!)FN{;*7lswV= z7FXe7Nt-&jX`8E*W{QVKIlFPHnz`~b=za6cOs$IpJoaeqE5j|2^|wtN30tSrEVkEA z+AbeDWk{L1YitJ(9z0QtW$qX6dkBIfznpsgrv@ZzV3jVh;_8DobhR;3L77acqP%@_ zfM$QFq#?NnH{VzE9|5FrFUWsvoF?Ix_9RKO4e_I6cPEZHX0J_flv9qj7UB%E(>Ruf zcmq_$qiGX5=jsmLrkCRo`r^&Eu^n9MW*KaX1_+o4)OIv^8^;3_!F?)#>^g-?C&Oq< zAvKoc!wGP)<{yXo7ta$v=k)N^d9@!zL~%roF4$FkhnsL$gjDrVk-l7>Tlu~|c|wGc zLvP_~fX)~)IlCfutT(8c|81P>Oh83(@x+i8x^?p%EB>51V$!$9%V9L1%xj)EA%=71 zsCAKn8>68H8^Ojg_5;L3cPj-js(` zW@fnYC1{@sk^P1TYwuY{P*b^4kMqF>&ZSAkDsd*|3%+&TbWTx8-8usB_NTSUQCyU& z;%4HTcs>N>5Gk@XW$f!Io7&Uw#8Tia?zQ7@Blz(wawAq@*ey=*$IvGpK=2s7{FeOIm%8$nGwvh6H`R{ zyroCnfn2dJNDwu7Q1t%9eD`m)dwY)_hZN{c6NTVoqpQiK;b6zSx<@H1&pjb#M((Uu zXi4k!7xHV&kEHXF@KQtR2{SyoU1!9pDX@pR4sbgg4xh->8Q33pY0+=VK_K}=NFs5l zrBv`2d`T@=hl@E6+=@&OL;s1n>9T3gCZx3Peh_pwz!Gc2c0NLWB)dc$%}!t5 z-c5YMcHLGhW*hXDye-)qa9H~Ej0t(36sMuGci#;l*Z1|EPWkd|@=Mc>q11|c@iaFY zawf|?jo$ITBO^`KUTyapLb5=c%uM|IcGOcH`ai@w82T0H=Kto)7>bEOyXL=OyuH)_ z{74C}Q{}U)msDNmd(YO`1puLITyS{lDO#@OB7h`BC@a)^<7xSE2X%;HVK&spoXJk= z+(q7IfYj$8 zGKMPZeR)z;m&~QKn&LIe{$9e>U5-wKUcuauJ)VN%DRB;Y@9-demsx9W{?F(c1v)x$ zgP4$?6WVgMofF5ssK;rot`#E|dP6S1H8_HccAK~v!q562*@2u^gqBKK;mev8GQQ72 z+_rY%6H@*^|4bAh4{%~i8%TvCVW#n{v4b|;;kF(5CtRLq%k_l$frM$&!0);Smvo0D zg=(bWJ#$9u>XbD343cI9L?6z^maBnl{-(xvp={4ULV}F`yZvzH_969Px_DcNKQK!H z+5PptDys7B<9?)r!ZoT7IbG*3gfHq)*rF4o8^TMF)$vZ#xZ&FKv_So($$ZSPJkm`w ztgGR#$V$^ZHyxt5Xu7rSu1rp&>t}FUt4yV-iQ1wU%2iGYj&53a2%D?pI4CiR} zB4hT5VE)eZq=(aomB$a?pm&UFunkPje*MzWJ%;y zN!qJJ9Me%+1qA2^umW!41+3$UqyD&AL1D};S;UIC+4CuShCy~obvWAmiex>MZ6Fe45T1CT)F zFqgO8chUqPe32l*Mi1z@n($*DVB7*r6@%hLCYd5#5jh&}Cp~9_Sswbx1S*jTAu{-g z%_-rnf^Q1zvyPx2u$2fHSp7wTBPB&YjMz;TnggD>;_>>@33dQ)0bA#|6p?-EY(se^ z?*z$Af40Sx(5UWn#(>@e{-k2?UoF`;RpYBjI^zkAlndg_KzY9fSATcb2DBd?cofJ{GF}dO??H=4;Ie3j^o)aL($Iq^@{JVH$B_# zH;NM7D@>1n#&D%s-G4S#`DVyMrxiy~2s>iNZ|6;3r{&-%tn?NRRFQSPL&3xEOGiU8 z3eGP@m?cJbxV>;DKP1*;F7(=Niz$81`ddGozLLt!hRM{2e{ zuUu@)m14r~K{Y6iMM*Wf63*lG9+8M#o!q3-dr63ooVTHwp{Iyv8?)_&^ylp!Nh{bN zLcV`H!czoZmFN@qsM>I1UphC>S$&mz;_w|?d@8^RBBQP!6lZVDvlX*&vn7A0sZDic zgTYacTR0S9W;?#%q=of6?8Ma_GU)vud4k7#f40bB@d`9m9&8^IGb<-aEPnkjDKFo~ z*3$xW3c5~gpk>^9vY18j+4UY8?m^`UwKq@mg0WZ}hvIYvtN7(zC1;_Q(p(n->>_f6 zE0GQhYaJc*=KqcJ%=GG?XiMFI4L|zP9({u}!MHqCL{ht4AU!1K75RKUlb1D%?-4OP zi5J~=S$9L2?v45Bs3D%7Mf4hFOPVSSobcOMufYGM(3)m)xgDqE1b4FWcptTFI#JLf z(u`_987OJK^uYP<5HrqoC4vvM+CE`Gfj$ZN5|R?~$&gmG-zQjROwJx;-2tIk5e$P^ z;xgmJG~C_5zQzACa+d)5!FyAr5I%-~^%Bd*HpO8xD=E=9iJpjvx18B-dDN2+w4RK` z+BDs6QfL;W=@4g+?Kj|p2OtU~^#Va;4cvIihU;-M1ru0U2@cEPo2xXT_vv=vqOVd^i#QkbPa@! zzQCFO=JHWpR1#8Xfz)Dey7WC>Dak-(7S^*vJ{)nN$~!dc-xr!Aof?JGiZ^DLh`c?w zVai9nR5Uf6q>-K58(f_l{uKBH;gJo`!pYp5Vl(D1@d+BtaOhSk%Jy6 z?h-dwTFs!RTyFpd0qgRRQ01RZS@~v4=9WR9%-@>Q_9UuZcSlkK804`gj0Orw-Hl|0 z(-e5q!p&@INi`#3tf<}iDzfLE-T$3oQ%7?z3*kA0@$nzBrYBK9E04I*d##*}_3~m$p}CIHH2}N+eFy%ccvEJY2!lDogiqOU}jmc*mEkImd&bpE{5e3X$`*<8tdQ(A3D~ z5M7#G34%Jip8m~aok4e|sMzPfp}Sp(#oU-U6>au$e-8#SA}ilO%S`k2=U>RR%c6JO zu4*_REBSAO4c==B)LzJz|BRSF=$1jc6q26Hmen|yQ47k!vsNJlDw(khNeL?|UOC5B z|xl7`cMl_cuCME=50vHb*DQQF>O8uT_3XT0(vgA?tiskt{|##u4)xN1UJGgs%PC11 zrnaxby^b0^G~V)d-*j72+)oDZhB#QgNOEFGIUY+h{XisItm&C?fF2vLD-UCDv|$dv zMH;F3IMR-==pTh`)*V;1BQ>7bKGe;LK|MOlXzwmO4jI530~2DhvW6b7g@Oda>vq}m zeCRwfVjfJ2a4x!2EqB=bgks(ZBMZuJ_{Seo%9GZFIv8a?*>d}+A9A=~WCspUPayMr zOB%XJ0c+%SkPpq7zq1AVttWw5m zeb>F^;_Yz9XL!tbZ#_48INrN4#&2p2X(L-~elyMs7{-v$R1bCgBcb?=-%vVNavPA1x$L(G%a&h4axuYggq>Z@Hgby(CLb_p=yE}|#P@~&`BrSC3zRv?`CNt( zY>IGnAgZ7;=LspD`S&+SPi=W%BHXgR3P6_EwqB0Bx!o zO3;u|W$JALQ7f*VsL=){DKXf-#GD$6fwamzdxxVy=v(T)mu=(N-wu)B7_x<2@-do64UfKn?KS+mB0`YmF8_cIwMM%6w4o#?OnlUNFeS>x^`; zaog3F``Ab%^=)>bT#yLtO6b2TFj>i!sW}trM1BdP9Htw0nv;yabOZHO%YOjtHx&iE$Y_C<}dM2J?LElf1rc3VEk zFf@}i++@k}kTz+PL8F}1OcWI;!<9yY`}}R6y8)Qy>PEaR$@-w<|DUx9sBNn2q89}E zT;Mp5zYpBFHNTcmdn5ign>PH{mriO~H!*zr`@an2w!Wt~kPpx8GI_-mGPO#3tMz#~ zdqGq}2+|>zzHhX5^+?P5jYNS|WbOS}-75-Q57&!M(a9&7f;c&x${F<+K@*kLvfhyV z#(eoZ1Rmb*1L&WaCqe-A?pAS8<%4QETld5|y#T2PGGkI`k>oyUNP5&kVgT&G;mcJ* z2GtKsVB78$dH7Iu}ZxK zqwu5$SLwYfT&fY?)8>sIc1m!7AK0JZ46=)i0`=(SnjAW^`@-UbzA}1sl$vruA@Y^& z8+LEr`O^%?F`E0Z8U8R8;MwEd29`a$6lq*9w6QV&W|w|W6Tk;msX-XSj7ZBZr6uM! zqZjy!Yx}IW6m}IqilVszNFf8Iev>H@-C0;wN<%$1jx-CY)#-N`+R@47Ki;rR0#Wx^VtfK^ci_n#q>y$+tdAK@iA5Ajsm4m|DYX{6V86 zAAjNS55F$E20D|5)ZIH>baPQ;gMpO1w`=&%ESh7W-#e&N5ER0IN@nDZEBfMoO2w7} z=X=;V$ozyHLnA1@godVn+8yWgA9BK-N1rzPoFE_qGBR3w4#P~HZOF@UFP))7L%Y7O zcJ-qV-$Y_1gQRa9Cq;kWQs_2;-r^c)|2u3=d0bq(p)>ZJU&0H z@yAYC^q%j;^Um^SaN`zz-LPn@4NVmAy3);hXC(0`b%Uh}2FoC)WvIr41O`)RdHih! zLyCF$EQWO?TSOE>R5q`e;3K!;=V0wJHXp1D=d9r0({AfyCb0RGUh-;WB8-MZ5Zb&%IikcI zV?~d_L{RyPjc(1I6K~mFQo}_c5q`r2&A1JSn-cVaZ@Mhr);%LGn9xzqJQ_$PO0RKx z+|?k_Hd8!QP9C=W;i^bo0cGVc)I^4K+8?7UP=%Yl^7D%wH>_g}L{llsvg+v5|dEZc|1L zrzZlfq8ja<>?>21B=NtvcBJ9VbB2BtPeGFd6Pe|O-?mY{hK)`%Gu&>DA-5@h`F2O# zc|Ha)r9SBf^l_yIUy{I$%gvw?F6h<6&%iuJgo4Foh?I*ZfB5(RER1O3YRv?jpg0*+ z?LfSvih`Z|MKovV;d?dOkVZ9Ogd0b!%^SKrYG%YafkpS@B`9h~`xmujR3{z$WtPt! znOmC__ro}hpwI%uqn2n_7{qm{v!kP+3Q|M24zAbC z&72DW<260x6k(F0!G@>wU)pb_sWM?hgMXp1EPzx@V`75NI~io47Li9nlWr!JTSy+7 znFHM1M`SCHoPbC#Baiyr6TY_BqZ!;ne7|mi+4aYW{^@FqUxlXw{@qb29!G;(2Njd6 z5BF1gBRfCG&&13=O3cIm<3V4hY|f~_Q64s|Wb%0UiV^PDzZ(SnRZf8L{TwWVi_uYwyj^)^iOAt69i zU2ge0n)wctW0ep10OX4gKc>d;;X(fq4?_}%)H{U?-uvacIYP0@hJ0f@Q$I{EMaPqT zXXPs!ze10S! zD$uVj)=4vUH0`t)n5(?31r=C&z5vJsqCQAU$-FsOVC7|tIjcGV5tP(WbD*s(z+Y@U zTO*fw05ACRdGt`i+^i6p0#V957PvH-mQWF%^kIw$QRg)=yccXeY?0hcCZE944$G9_ z^*%#!JA+}`*LYmJD&qK>fQ|w`j+T9RTs6*c8Tg-w55eVj%G{$_x=5Q4tq_mizC%|X zX2z8SCh&mj8{||RMQx<}3}n4&B%*8f6(0x%fNJh=e!R(70nTgU*CNA+b<4AE=KPTUyotOUlY zAd`(4^7?E0sNo;0HbIQ5hdV7u6tIEQ`R_p0>Q>smul0>tC+gs@z0TOhCFt<@)Pmis zyV~!{Fw){Y?Jb3pn`Tk7x_9UR)2k-F4%}tKY6m=k@asy*a#GS#7{g`N|?3yBbLj%{Z07xV?UF%gM@BGr_C< z)x9kJ(EL_+iy0mO1==N;7@FdxEn))wDkBj<`M!yN)MRlo@=w~E)l_P2oj2@}S}6~a zZ;t=~Dh_2i>9>$1#jU<~YXf~1q)3P~jf7D{T$7Gw5BQI>y%ANSRuVr(pn&w=IYthf zn4qpBenOwW^4Juy_q{IE1@?1+w;X7@R*z5O zXlQ7BzfKtvUJrCB{Wp~3FCkdDS{q`Yz-fg;v;W_0NKN*70nS;XXY ze1`qAFM2*Q$!Ll^NTRGC+?J*wLBSA<|rW$Xw>~lIwPkPGa4+(pYd@(P@V$FnGVzu}$7HDZkFd_@@7lp5?cAa0)c+Ei3 z3)y>bNZB2c)d)o)2QnpDuDZs6%B|lI&)^6AS=OTX13;edhs;@|vdlEg*R~1>zZUJg z%COqXJLi255gFp*DDy%)^krLC;(@bxQ~Q^G$7Avn8T;I`=F9glNXhc4MTl1(uD==5 zeAN;{p3lX&FTv?`U?Af1Q-Z1oN^3uxnQfTRbQctoW(*?=(P{#-qx1#E=k;{!Y1Q;GSW6LFSKrh0!_clZSB`QGg+MPeoC;nedQXV5lrd= zLV|F3+fPbt$3oD56p|0ewb?S7ClNW=Q+&85%Xo65tVe#0@>5!+wu)a6)$rdMfrNAc zrb-G(KWWrADOk8(!{_ki5a(!|)o4737Q1NLSkd_d_Js7@U=udDRxT>9m&|isW$+`@ zzrUbWoa|@rcd|EUn3`kG^PE_OXa15`v(Kxp-lhsE$fYHm521%G#l+5ywh(}xm=Irv zfd$LAE+F!X^SlpnVTD6TEJ|pFK*YCzd z67Y9*E|LKGwS@+}-+JR6k*o|=V1R1}$fQI17=f`Dgbq&G0_zC}==B&0WMf7y)Jcm} zD-UrVC-|df3VNu4X5WT)Fie>0Pn|j;YjyRlbrOI2Qc^Z9H>1CO3S(D`LbV{;8>w^D zRJaFwHcp7%hiGrbd-%S%*NIm}@?(a9ytzAa7MIUd|JU4gFv9gc?bSC(@Y6dfIw3^w zH4%g$(Sn2!U9h^{MG(D<-lL1?B-lmt7Cm~m?26U<^1t3s@!k(GXU@z#&pBuAoH>%u zy$2(!fr6766>g>D_d0NjH;W!~g*u=iZs2K4b+d+q>SYcer<*iYC`eH*fY?TQEnm-v zCzqP(?d}CKsw~tAPk6Iy%gI6#ykNH7^*2*sqmiJngAJ3O-Wh|+2}#eG5GH*N^&pOP zs1*f*4&K{O8;7bg!IG{yl{QdV)2)c!29d&YN}Li8~>L5-P)xFYJQ+5zfvj4 zFqUoHiT&;>=kK34jx?Ho7BAf4@R~+Yf(T@v3eY@}=s#_*w=Y&DG#X`(gkBQc3NQeK z!NVW!b=~KpGJs3b>$fCI2i?#6z;S>dNhrMR;;88Qfgb$E|De%;wONHb z!n4$aAktFuV8Erp=ZU0MdwT+i@dJ0uc6*hc@rCU)b55+1AX&3jaUKONJqT^o%!GN2 zV464jiT{mep_G%n$!o%tMgq|tOXIT8ojmGAo-0lZM@qXyAO?7t9m(J; z4B>NaXXK-IDNcFs6mI%Hi-xF;aA|~AUw)&vOzl3~C`s=8c%ore7r!D$xI+6jjyVFR z1NVQilt#m|01rwRV=<-*xWdNxy$4w-0n1BhLDc+7mt3Z^+19ta?*qu)Odmu9%ukxp z{WAAun>n)PlAtCxk)S5TLwhlscPBLg0~s9v zLKfSjsS);IrC%*|Nt=xq1OIKMOx1Tartzm~&Oe7b?el`72bNtb}Sx-v9Xa z)XLPmMaGTSV>0odwx(Sv32Nf^JLMI#`wue%LK#myt(rP|1#_^QS|%-CWiR%i>`5P- zIP!JZ1-eE9{63+#^1=s+!s)BU49McG`U1)BO8uww@wkRjp3Emol@z`2tUK^vlt;6a zlJvUhrVr*laVwS;(ACW9C`Dm6%uaBBj9BNtJOLMyVj7F%;~e=AoXZX&t3K&EIIO`^ zup|G~k+1qO)ko*gh;pZHYX#6BlCZq&-QYLj6}faFOE(THw!5c=D|A+$kbpTIbp7Ek z7stjh_0)>qZ2e=e_wp1+5BuV&cAy(X48HPn86co0esmpBb&|Y?n(*u65Hkf+C`rha z47d_o;owP|ZmB0dhwBqqS_ihw;mn8qFsr=hw@B|HT$?l zrgkGOfI(JxfiU0W8y(_rZ3xzX$TKi&yK^P}cP=>KS3_rdFPQsFA6^}?%@)Q-U()?J)pJMS1paE3T^-b#fbk_L!NzR-16iz})j2EBv15;f?9*UBBU_9uJc$4BV#Gq6&kLWGIbR#94%h&KSD$yeaK8Q6^t7um75gurA* zsQj8PNHre8vUr4C^0Nn9>2(6zNVRzX>95zZ$@(`D21t#>#GV8Eq*eY)4>uZ@mV^5f zW}d4?&khRYbjgPO4(ach)-ItnTGFarI2d2d>Pi2vvzK{6E0#Q z8KdE9C$rvtVO&*ELx@F2t(B`Y>_5Vj8k)iunvFh4y-4D;tHi7lsun?fn#JCT^%E#fjDwp$Wdmkq?i zy_`w{#XTa7c!cJ$Pi~{DPVviNlB4>k10)`c%$4|-Q4q&V?>a&U%6E4|HbWT5IqKds zo*{P-8ZRb+40cG`iO!@8U(%mU$`e5{Sx;Eibb~O1{_QzpHSY|R(^S7vg2EASam1zk z=BO7NG;&VSidwFGV-Zxg$+a8)3|dEAu#C*dYv54)QAyj@Ff(uoQe@Xul!0`+zsvc= z10=^GqpuHoLz8ahqHd2BlW|S|BIm-L%~tAJ*Ic1QnzjQ`l_7%TzgOg3a!)71!+GkE zhg;w&ks>LTG9dZz5h)M&ka?1KSV_1L z-lzJwfXgk~ zPJp1oBCZ_bD=FS?)U%RzI~sJGCbj=iI*9SRp4D`Kz2N(O2h`0(3K0wZqC9$7WVigs z)Fr>_lCb*~!7}wD4?;9Yja$1N&nOswK*lzzB1#29fG!mk{*Sf}T@13`U%5R}9naDb zulXAcGv7+Si1CvzEv|>H@b%u|$OknS*i8|O-SYIpK55O2e-INV3lolNLWD@kH6Q+` zM&}tsB=d2X0s_rmQevoZ@bo(8j-30Af{znvupVjh;fb}d;}f@@oGZGoda%`cR@D6| zb*{VP&=X1_4xggFx2i%BI4^OZeYuIPhaF zP05lr(_ZlQh$PyT6b~a`J^fn2f0q=Lzh`fanXWpSr6aZyGMHsfY)_@``*ppp&R;68 z#KY%&KKT6pdW_9pURnWOXwh2lb))O%kx>E%C-?=ljwGLhOj81mTr!}5`C+2&B(CXd zhk4q7fXrBe(>E(U($z$4w4?7HzxiB;<>0MB=x82bf1*gtbS}L&0_uA5@hb0f)b1Q| zYiPJyp6WcLegNwBBmGU8h;wE{GrW?FTCVZj3p~7n<-x@n!k{*k6BXo2Iir3>ICH@{Q+uUq)aPrWQZlKG)~UlX z33=m!U3|au6D<>SGqq@obx)JBm9-l2&TQf$lz50Y%Q5?E^tIW#wQ_=T;cA$CUc^Z$ z*gDgwG@OqtPmzV$z+|+HzED%mkoIHy-F?YB-&%6%zT8(vY6=8W`!kRH6-7aZ+bSl* zKC!#Wh&I^T|cjDKbf2wku7iYhYUM08hWpJjLhwfiH&Z5 zHJ{*r<4Lw2Rh7XvM{MH+-*;!4ffSI+aQO}UK1+C^uV#y)d2BFA-+0;*lStZL-5>rq zKn(K`X_5y*>Xz@$oGNhXEM-7qB-R;2<{EkD+YHenisBeZ>)DmN$xpGzR#DCjX@6Az zeuYFo?DKBZ9M|XDo#jl#;Ib@qBIwHpxX&N;brZH|>I|0}Tpaz~*SL|!2p~=JLC8O* zKQVzYv8*j>oV4HW20@67*HP0u*O_mT^d9Kqk@AHy2LYDR;rQ@td!#y_j&^AsM&0K; z*~L`{qYW7uJjQw;9y(0y_qYFQ?xyc7sk)%BY@NW$?1`8<++>IpxqO{Kb@!8c>7262 zW+iTpzN|$&GlkZd@HinsS>K+kD{O)Od@SMZ(6j}GIld-Ljes-~|n_2r&Lw51%jM!w_ zIO5OtR~m;qyTuowz{_m7VuQu9b z22qBY?tB{vqck};VGIw_7qCo`J}|Bwb+KQ~@Mz?I0MT3{UuybRGkn;j{IIH}!XndO zY1lY=Lo;2-V7<~cc(Gn{+#uRUyV6<3)CHPRo8)Ffd=7@K^q6++))FeVw14lDXBn$TZkLYU*|tD$=yQKa zG}y?^-5yKDuN9ZLTV$8-TTu3TVxpmOzGB;}O&{8H;QYC8R@Y-wc`0l4)MP;a`uZ># z3q6;p9maP|YTLbnAB!otyJ|2rnhTd^^-2$DwkVsg#5~{V9zahzR@SG>9P(#Dw+p5J zrD!TCjdw+8PB%e>Bc#h3?a}IQwRaaQ|1~Z&955pa>qZScPV&cWF4MDr#b?$IvkUGr z2OLx*`lZQ!#PfiDYzzLIIkhm)^mnC954ParYx<z`_09BP_$EU9iPF_X}fh8ce< zuH-nqXqSzUwy)2y_cBdD*%qOzQ(Cd7SR?7!FW3!bLsU8u5nK1O2w-FQwC-l zPER~AN75MMASW(a7@e}({6e$r?%jUmX#2?h8K1=-X`8Wsd8@)*_w>(;gqRln3@+tGRkq0ulOG>d|q^*uaYjdWQi&e3HTB z#%oxWY`{@$%`pB^ZTn6iJgN@6cyp=8?K>-3dr&D6Fi1w=)77Fy+3T$?RA003tYI>~ zRvhC!J?LxGri+S=n=bh@672Qx-L2tGxw)^FoPQsekCC?D}rWaqSK=IW&IA`k*T%mBw*}JrJ$h5%HBBlBN*W;sL=S zuQPo1axtFrwk$bB-$M^uh_s{HV&!nii(C*$96oN2XtSLb6^f8Y+5|3U()fjR6!&xA zyLk)D0xy!|5&v{WU?c$HnDw~bWH{>_XPyCKv0{(C$K2lU9winI8l|-X& zR*j==vK~3S*5T^KxqL8V7mI~8XF=F3Yk`rT7_?%LoDi9ur(=-C85!@)M6KmkBR1aF zB^EzxA&e~2Mgeq?8@DIYspw1dW16W!4ofE!8*e6R!-QM zDj&Z_pjOu#L-!Lnxu3VCNl4v5?;YUPNcgvs3on<6hH)jm&N0Yr@iHO}1cHw?Sbm-6WlS34SuYM2O^K3U7(O%mEJFoa)01}n;VwmMdf%lcl0#K9(UPJU!3AO z3Xp;vukHmuF~ v*3_P)pSm@pl1{HfT`qxMoB!`WOXL-M?No&SST|h!R@vujI;!85Erb3Cpe7XL literal 23896 zcmce8byQScxc35@(n1?i9u2~koh=~j>~X_%qAm2Q;oZV*Jeq#LBW8)m-4d*6H4 zy=#5n{qqCX%vopl?EU2LiMG`y0_q#s;izP4j*o)`EY0{>EawKfz%TVROSn`_mpBl zbl>?zV`rYG*gv*UiXoRZ+Ylalo`T^kAjB|@DM|QFi#UePD25M{-ZC%lOhZpk@7DS7 z`hN87meY=NW24Q2N72FNy?Ywzcbg9jc}0b`qF;vGh9JTJzkm9ce{N3=xY^zCITlCy z1sBs71yG~$iU^mq1gmfKicFp`oN_|w9D;9?%LJ6(ACX9S zK7x778z}!&QD$_tD*x zftvuF;gK`tko~Z^bqitp60#=u%q?@MuUl0vGT^*-;FtTkEA@g8SXv-@RMLnuydKu@ zgkT2!;ag5FbCue(cF5oFbbzX79^wh|Kj*b%R}!yzmM=XZK#~>ioXbIHZQ5;gKgqe< z;tQYK`RlvOvM`ay%m@5*3`JZZZFJ%mh;d%?h7^>er@&xbOUB%OM{3fT{hlxR(RDK_ zlqqGUPe2;&cE zzx0ApP+d3ap2T#=Iq0O3FI`ut6Kq81SN`w5Tw&dG^Vv`qlfsQ!}=w zBmA8HY;zZe<^tM#3r{5f=7o0Ox9r}~EUE_{1?Rs3DPg^Mu!0|7p*YJ9RIRVu*y&;0 z`-6$%dC2?LitAYAu$35r+Wq;k^cKJ9%6uAcMaerQi6*~JWa&v`BneX=bZw5JvE|#Z z_*aDAMOqVY8;McVs7nMcwvzITu;O3*dK>a=Y`WEi*7@S>mHLG7VJitCp6Ti0tqqNv zc|FxJL5vs^AkE}nz8{Lp@(U+g6Ox%G(;p`%aJ=-STRmA#TuU>cHD-t^sfR zFAF+A$3zFESKl96?`(6=1E&~W0k!dMrbTnbz79_>_j8{CW{>0hwIw}kMF4BV+4y4M zWxcLy%BbyQb@kB&p5PMUONR6}Bpxoz^y%uv`$5+}@q91r4N9rF2uGiT)O>U>*qy*4 z$jRSp_U z+jjRIe!W?9`u0VgzOn&*)AMH;)87O+W(|e)xmM6b2O?h%WQ-YIU$wsf+so^`f6!T) zE@oP#IxDoyhiRWNypFiuyn)7Z3W+h~J%|_f4<6WuSVCBXq~$9v%Svzz7x!{F%{F-J ztrrKy)su6LhFkG#52nLnroW1H=OCRJVXT|+V>`DPI(bSfb)vw`Ll3OACo}8qYGArP z49wPKQs|CVl{H!rrxgY`hW`I_GC(>6b6RJsAj%kuxi=Y9bZ( zxQXc{7T;7xVuoD5U_Lr+@sm=v_b|@xH9?Z##k{Oz6;_n+MnjrzK816mM*5?2tP`JI zv=6p?++x`lKSAMy)AD*Y_HGX87h>A)t9?2~hT$WXu;C=~TT(BvjyU`B!Riy3*qjSq$eD11(8 znWYfl7)Xqq;h9@Gbq~k+v%)W0d%c^Ohxr<}r4|yjLswa9sJx7|} z2S-N#4iS0EsPV$Wd+oRG{yN88&8*{1K#A<-w?n4T!@U)!?Lk;MkK%sY#RUXD*_bpL6dV1KM^e7X2) zZ-!q}jsybaBVG9s8%MBw{qh2xX2wP>T-v!E1;(<-Q8B>xCo~RlD*)Jk5^Jne_OIHT zxO)(Na;X-!323z-A`gjTLT>TvF_mA`wF`>Yd`34liOW1}5Kx+ZDauqyq(76-uwc+u zOs=mB^vFXzu_aWQqg@{}ClVQ%nIUmah7;>(EtVdiKEfr@)Xjrrs^EeBNlUro$r?Y4OTK{t0ma6jv$p zGa<4R!QL*lIXEFa3d6SC1OiXq}bM7vhI62va=an4&RYHKU^I@8c zfasS@4cp57f-1!{Bx`!gI|69Xt&fzw+{obWuPX$Cq281e3Dva8Ly z-IUD}WeF#M2;lZd`4y#;!1h&ASl;}v74w=FOw)W#&>!F2B45TshbXs>FRMZfqcxyc zn=rXj&?XvCY z9<~^Kd1Av56fumZn<93GJ)>7kRa;-KB zB8}wAbF?6aE!uFpZ|rk_eV)KvgWf_&{4fFPv*lEdtB)d$nsKG8bZf_e5`NCoLH~&n z9$-_4#isbh+}2uJ#}RpFw|-Gfz0907PIvUMvYYVg6T)^Fiazqu%kQqT z1Us+a>$Gh*>WRNi*#EBfJ`oTYu@>kSwbbrsRqV2lHsU@FcK5asZ4d)C(2bJW zu`qYjo1=?_#rQQR%Sa4m1KGG0CPE?MmsC-&%g#GFky%jixFq5nH2r|7T`nG!?84Z= z4gAPo1fkMgB2==B@vy>p+i8jJVE<{{9_#37G}Jki>ixoBli#vrJqB?D!#h#he|wJ{ zZ8O!q7+ZNPAV<Fbd5E=GdDje^P%#4tPLDv3k5Dvp*o+W*P>;wn##2%W4g_TOaA=nz1>VHfyJB zCGfNVKp=oE7i>gtN=*0`lJr#) zTPpNBphCgP02BBguLg6aagfGH$bEj@j4x+(=V!tEG?pY?sxo^rM)xm^llreX72HS# z;J~)!&&z@ebrBkV3na1e3A7PS15hr&&aUr~{XlxY#rg>gVK1-oF(bn$ig5^Wb_FB1 z)`4ubNOhlmMo{2h^Xm&I!_-z#lZu9CZ8fjNcPx;PZWW#*(J|;8*X!MG?vEROlAZfG zH%@mNsQ{`d0#^W>P~biW~xO^JvJ&k@ZW@9TaU7P#-kuL<{ zkL9_3$`ZRhib5YZNS~k{)4Lu$xE?dO5#75H)4whowSF>!y`&g(#t9)a*;8^1&6aro z`%Y(h8NIT5HBkP2=JQ9*G^D!hq`ILXEgjGG-3j`IvyhLJzeJ$4}? zAP~g&0Dec`g(^u)Hj(#=0AhLiWi)aP6HC&#r?lb&533PE*Ya* zjt&bB?(vyM=6u`)64gULjrt*+;+{>2Uh-zFT8fLJpf!e z@4skW#@|E!Z^Zvg7cNK_!T(BE-amA4g6pe3j6-7rOpZ@8Kympx{)g252cKXK22ueQ zxDQ-tqH;bi`k!2oNmXKjpHcaW{`Y}k5%?hPO(49B8N9!SzxN+f`yaCjpfBU6qJT^e zwg0O;kjYr;|L6FBC;eB4B<-545BvxHE0BNr|91sJz{Cy>Ab3xX(OzfHbSF>R?y-km zA7$ZNRPY$c#O;nbq<(#|Ao`}QktAtQw3#f$|AFgoK@9IsNAWTb`l^->%-OG=lx_&s zC+{u`+dSSW6(G9yGWw-aBK!B!7DB<}<6w-$`FP1vS~}2f*!-pW(AS+*g5xgCn6sNs`z$Hah>{-OPXJej-E$QoK`Y4iqQN%ya#uD08g{t_1qk3&#&bmGJRO877XguFzgUuy7 zc3GfLq0sV3`MK0%urty1Swi&}ER@L@C&MagB`pK*7nXhFhKm5_ho&$loW zJAF*Bjgf5I*mLHNkUa4Sie4Ny`9h}dhuN;FYmgkgh0nK{Zhl>lfIQLT0FpmFd?W=L zty;9124%8s>+}vM0L)xoMA)E62mV7;5P=w;wyoZ$Fnegy5dGPL?2No6=Yyd-C2pi} z_?p$8ufhR*_)nsqL+VPQ@WM_(Kst^dSo*7lky?x2YGT&DFpB*_l?{-fj(pO_5kAo5 z5$%30YWi}2BV47>Jm(z#Op6)~pgTUJd?V6dif{m#<0X*E+~81>?wp|YZOUm_j(V_T zi&DSCtC{?^6V|oM0IriB+L)__6xeSC7)w}FRoCNlI1s%{BYlKTaN`$v_anqI z=9)8}HuY=uhrUE4V$IF`cGEHw#p|hfJmFc^e##V`-3}5m!xNT_Wx?*84NuC5+p4v) zJpmNXz%?@1YJ+g{=*@W%od|m;jcUD~dCR%n8GO)-3YSjj#HltD)V=0|h^9ngS+pWQ zcPlVK*mZ&d+K837K+jY0y)0z?YWTuB3_no(<$GrTDZj}wc0WQ+xR(KI(vb1dQWG5y z)g?bN*fYJi5OYBC>>hYNx9UOaoIT0(LtPp@Jn~k#P6!*2xI$NUm|v2nLLv(jRT}#7 z-284&w%Mk&x&9ndFjUeu7v+;&v{_X!o1&FV4pU6 z_C<5tJIgqG#MPKB9sG<^BWUG07##qVVS(3mLrZVclS+!SZv z#Yk`Hf%SwNHQ6J~1P*LTn1G;YD_qOcNg;XmA$Z&-IiYw;#o)rI|701PpB-g0?ynDJ z(nkX(Y>0c2v_bR6YspUUIu%emWq#Mg$kgp9hOE0~;#N#`H&M`$k+6GH)cAqAI~Oy` zDY}u1Z!h|*aQ){3K-Ehfh0Da>dw1-njYe zhLp8pZ5|}!6-#J|S%|RW{`Iq;O?EpT;#47aO(QooAIa{NNMku{*yr5Nsy#==R^d`E z;y$e1_iWuXfJ53Om{f)6dvGPi1x7z1a*~nKCBij`5rT$L0^#W;#U*qHr{BP==LAvu%^$O!zS!HW zGHGpzb z8q)|e)Fd1^>5^Yg<6p?km*a7o5{kT?BO`)w6(1xTzpy2O(C)BmUzsuZ{J>&`+N3Tz zh+bSp3q_-#3~BTJSjySRd6s#>vCnlt>#_6YSGsrS$&|Ba&Lx<6bmzA$6U%qIpWC@e z?0#Hau>697j#-DbueyavRsu>QDVs&LYsd(*EJM13vJiQchW z0T*U5h;IQ8syRq8ej$6xR^8hnPK3d}?ha_w zO{z3g?cRUz_q_oK#mPu@6OidgK|zI~VEj1f_@NQR_1Q-?63rjUJb5BZK;Pm1 z6ZZTCRyFjL0wb!0J+5P4av|VCbA+YI637ysJek$X0<-qO302kUaO)b{s?82@_ph@6 z7{j#T%@q-~zXI8|5D7u_j@M6GoFbhJ=MDPTSfM4MpU=Q;6ty&B)bot1%!&8JY&}MR z&RcHG5t2qn>Po81GIIqWpJgJorl%GQp}<(~!3M zV*Q0oHRm}-s%Q1Y`*)BWQOJ-I((CSf+D|ReZ-z*m@e?7;DfA^qGc!Rg)!!KFoqX1Z z>2+4(JwIdJ*gDz};y0SGRW_lqLaF5}oT6KHbb{s9Y%C=PgCeVh!eiCeMF9F`ahu1! zv?6HmuBzp2E1#kUFr^M$?b)Z6bRV-}G??{0`@I0GKKv%sV8n}==scHa^?^ZCsba}) zzHL@ub3r~53^(ZXy5ANm)@_P{T$FCN_)FySp63fA7^=6r}_Zd-W4qW6K;Q_^?S2 ze`}?YI2uRYYQ8O7*5Nhji(1j)MNV@;koe}!@{>DA{v({-`y%28$VgA=(2!Im9yicW z`T-5N66Yj6aw~@F=Z!q1`JWLtiVB`XoQU?r@cbsSn%jQi6L zLh0f~%7~Kdbmu{ z^7ez^Eu4=)F%}HtV9qhO!-;LSS#c=2Bj)_bvs=My0P)7N+bJ7Pc&l_$+_t9X`bojN zGAAv-X0yJH2n2)BDOdH69Ctb0!cEi%7q5#t6RGG&oX&&#yp!X1hl5l|pWnKL{usX* zy$d)k#_hzfSZWTOR)y9IVRJ)>fI{E>Ei7dK6&dnzZAmKw$vvPdoM+jbFn9*UUM`o?VHCgaRtq&5eoP9 z#1dN888PZ@XsMce?{cgXUOZ#idriqMO0wuS#wu9%9#pCq;sn21VRGkP57Hi}opIN$ zr1(_+DPgM{MrK3>&vK>FHl^XgTAO5Yn_c?TP6@dZ+QAI*sk2iG>!S<4;!78>Y*DiZ zRo(&ZppqY=);dR0u|4Fz{2uDt&V2C#omijWVpz2I51DQRpLy#Ahl056>E=*CQN?d? z3g$k0Xt&7&0#&KbFij+vvLJkU0?d1{joYqyVmWO2?&p81l4`=6qik!;XwAaXLjwDU zVR=;()k|}ZYU>I21y3;j58OLWE~B6RW8WlQ3zM*9JZiJv2H8m~So{Fpb*Ky`Y;as_ z{vHYg6EOF&fZVjQ^LTld*1h40cYfq9#pPCTv>7msFMJ;HA@wsD;#4L$Pl^)2icRmn z2QNI)-P=V6xw&diQFK#!evE=ZzTc*E+5! z)K>^Q;{s**4+>2u2S5p-uISf3JwKt(3~Dk-m#YJEGgOuD1LOf2P3qtD+P01P%}uB* zk7irdu0KLeFcW-pmAz1SyzPjZPjhvsag)M9JPLQmB87((YeRe5s70~qP| zLBrUH-REnWl}~C)V7W;Yvdh03@WuF9-QeBT%dt5t>7R!69;Mg{KoP&BO`v8!CWAJ1S=#n& z8PMI4KP`G-d16KSP8?R9Jj9oFGL_1i8Zc~;rQ=#&Xh%7<*lCJb@CKYUc_>6kxh@=K zaCVQDLH_7_WmW?*Zl6Zpb{`5 zKBQUqx;eIV2A3`A9wqXv!zPE2?IzIQd(`r&lf_M3_3|vIeV(`RNsoNY>-pC&P*ndZ zK0B&n1{~wl;;qcp<4ToGZ7>0wJEavyet=7dgPuZCr=}aCvSu>}UWte%&vW-`GSry5CV1f75l99##7Eyu?sXcN+!V6 z@&UBGr#nDPAit*_;r*_^WTY=~i<+Qa#ajN25}_b7$3~h^tCN|Xc^)>Qe(~Ya5@=3t z!))ey_7MM|7RUq`%xAP$znN*(9x1O?h*KYL#&YOzVjGT%z~rtkpfDFD;T;Y^>%L3d z`aRw&O-d-n5Kcb05C1#X%GpA$JqRuAF+4>4^5uzF%#+`V(}vzi_`2M*_@M=50Y~-k zT@FG%-G>H#ZdmcG-|_8gyR^77Z#WPM%dTycaz_TWQ$`}gClvf|k{)4wPO8;#G>jD& z$|X+5G|1|E-*^rKXjcmxGFvAY8Op zM%?N)#&sH0m-%HqAeHi+QL5IQF)BU2fcHy_AzhS*dI!urni__jcMFK{x3!^bv=mQ{ z`#f^XRNpz?Ncuxh!kIT6lr1YKev5Yzg3xW-N_N|N(-wDgUCW^kw}E~V9-+h+`2x8? zv|uIew`c@O$F;j$lYQK#QXw9P?wRsJFLI8CIBo0+S)%4!IgL52Sa!sE`CTMGIpB*a zCuIwzBBsgT?fB(>rJpn~Z3E3q-Eo5fC4NBmq{f;Eu4~up*`09zt)ngzndk7Hp+o$Z zx_otex#h#_a~f z81iP)IM_F;^1hO}A|2+vt;=No^OspV!}E(=S>4knj`ud1%?^m&h4Y^*+pB*=7 zDzYX%5sVvyJuNEo&=XfKVtD6WK1K{5hm^ch`Oz>6p++&fVTW{kVAzYI3&b1kc*Mt_ z7HB_S!s021>gcjBaTaS13=dU5d2l$F)njFOKyi}#btpbCf2E)mYCUxu_dFsilFC9# z1jq))W_%-U_4?mRle{jZU}zIM0Yh}9@NEn&85d{v6UREfcHulvz2edvIty{rLr@p% zpgCU8M$tHX^ph5|-G;T5Zg~qcJkb`ltTlopR|WVW z&js3T{(B`%HKy%h7<0{G+428hxUC+v;!*U{ksEdQ2t!Gg9E>Z=0ZXG3iA*G50A?^KJEs~*$WJ3)NqNi#QC zcl+SuZ;+%Aw|k(6R<)2eeOOelXn_o7h@s<8e)}qSFRsi4;Hn5fq8<8L2FOtIOvfhJLV1sA)y?OZMyFms+sd^|_fbSoJ@+XOfvcG12ZwO<|j zdY|szzZg5>Fo2EocD9;os^glkk^Y#)qcw=3M5rbIY|40k-IBMi?(cnq-I%cSp6eSD zT!yD)2Y?l(0B;_+wIf_cnOPyIxNSQzKPGC_-Ckj0rvy%*<&z;|K=AXPH^C`|NKNDo274w7ms zht`uy=N+(O{!=~L3u7u0wDzHoT1{H?PkwreGtBsXJ>B}R7Y$sA9x z!xtyB+C!$Nsf%&V;Hl~Wr{!6I{#sTrVUeHdm&@%@%y*d=A!K=uQ{)iJ+ZN zRKtqhIV-o-w;v5b?7sSDOx_SlN3za|a<1RTUU#&4W?4n0(FW5s_0M1W6|uwGv;REK zD%9epP2b+Iy^C|TrsSS;f1q(}*t&M)zAfM}|6#u*h!c&r%|w2eBA-)4Q3v32Wb$LZ z0HgHm+B>VCF_Ia-VAR4u&y_r z=z~5{ZbkxvMOq=C?Zp2w3{>fd=UO-^`)rPY(4cdM_MKnHrDR}Rf3=2Q6}bWv^d~E*GR5W0AC?2@bcPgvzKlw+2j)ezQu#hR^Qk5YEKzfB#M_gE>a$KiL0Q()} zq1NTGTcH*0<#z_d%}4QJO&=MaT-`PUDEw`_)g6)74NlMAt=?GghdPGV*1NK(nZLXI zS}N4s=>s~#{B&SP2AoMj{1D>429_y_eZq{=Qr3(MyodZM#+M#>L@2aV=XO1inmph!eM(VZ_S6Q1d!VT?ja&-wG z`g~hDCWb(ne-)Af3Li0Ztv_}<;gj#KGdJEI6b%-+)_z-N&ox;1(I+fotS*zNH6Sgw zJK5WocldN$xMFM2RArc{cOt&^37}^~%L~_=O@*m3&b?^=m7X}@cy3+Diu2aPZhncfu zk<3Cvf%3&#*S4k$FB-W5yziXUi*Yhv6FvY=;(2G&7k_j$F<4fGNlYJ0bN2p+G<*PqP99gqoBhqrBPVYWln zZxPK$jqjoG-jCt=oJoUEZq9ZayKAH=vS`JvjiuMQu5y+n`6~8o3%?f{Z6Um)^rn_< zuF{b-?(a!rr>Kz(@n9zAVn3F{(l|ciwv&Z?s5Krg5jRqX;h2Z;Ud-Rn{e^NP<^&8! zHza6NJ^3WkWGE58(xK=Uyn-vkYVKOg<}*uZMV-&(KFQKHepn0`x&J+YQ+{)3E7C#_ zxG)XV0C`&rE(&DrMu+~*xmjQDf!}h?)u>H2%|r#z+O4QV{8plRDNG}5XNqJ;X)~5tMfQ%}cAnO%)&p30arpYMj`me;cMN9k(@IhL zGw)jhr?Td`6Pxa}7dnave2jEnypB!5zrztWcP0Z&l3hLLI8Tme*W~^ZmZ^QxGW5J> zV$`o_1+&5=>lW2U@0smG+hWYp{gwL+%t#aOl`^kAh~0GS*KJ)~{ks18s(gyq>8>PC zlv@Ma(Kj+Lie)gU#3>iaOYHckv?`C~)JGXlR>&$nB;T}*MO@ts=6v~$cE0viE+RL2 zcHXbuzDiLz@5l{b#D0;$gO-9_Xd?DR2KA!`!4oqq_7Po7k>>Ug+FCuaABcYTdY zAChc8JiSH;n}sfpO*iQ&i50&f@tmC%9t>&k`S{y!L+kWK*@uyP3=N<8$IbtY&s?-N zj4h{6!gQf4+~D~ngv?}%$d5J-z8J}^Ze^33C1@q~dvdcQ*|t|=V)kEaC1`PPV9=3|##xn!~?ceLe2AC1B#q{buhv;*AxjcyCVcd%h6Q6&cux$1OUw4(jqW z4Q%d6mqy|zsaTvD2SENpoYQxp)EjjELM*y+*A4o*Yf|S9Td=-Bvlig7yQR=!t6>8n z^FZJ13mGq@nG}R{7++WUuZ~EierzsZhy}027s6v4$2G7 znHDKB{f`+7NI^}7<$Gm)-@kwfTzkbT0@g_cK(t&L4C6%s)8=|qOo{zO2MI6-f^)FV zUTrepM?iCpk02gjQ43=PB=N++eQGC^&uNy8Uljlopt6VXiZOja~9F37{I2}q$z$ug)1W7|cdD#xF|W5EyDnH%ccZE#6>}M5T|5D0+maX_dn%>`vd;jD zqt{t;L`(+Xd&y0~>V%T1?0fF>d@Z5IMJQM_q<9?MGg$VkQt;nR%lB9vvh|xNKj0)o zRGaC{_2&~pAxt2XVvbMUh)M?)01iCiI1~Hv0B+Jr#?X3ZA;k+wkKJ*?qRilS+)~Lf z245bBw1o-31-QR+-rNq4fa))3r`N2gliV+PU{@V9_Fi?T`@;{#aSQ6&L}mgD-+sqZ zrub&Dc%D0RJROqb0hEG|rucka2#9=Isr3dHF*x$L&QxpJWYn(r^F!#=y5#=O)PL!D zz=6f9vv=)+zf|6Ja!EADxcKBos!{j@u1mxgwG$G^Hb6)6z8ovK6Hvni?X?Fd(PQwq znm==$0_)|UQAUQ{(77u!mYYLetb(c@dBL94PTqU(pVL@n0nf}Oi^A)p9zQ2j_TdSHXDpUXakisSes zzR-Y2KZ1$iwsS5wOFd{Nr&#l;-Ds`oo-8&&ZDNVMyOfxMRe_k*>Qg1<4>HtxYE}g^4lDA6^V2K+4 zy`U}}uUq;J!Sv$z#AEBao0jqqQRdS>Th~G8_)z;QNKDL3_IAgVonnu8B2_3G7X*lg z=mU1s9|DUDcMch3)E+5H{axRg6W9NAN_Jgx-cocd-V&BJ1*I*BK%Kfy{yP5KX0I83 z8;mG$_pmI~5=xM*J(7!XONjRv-E-aR`S=BJJ~DMsy;%LZ%8qI`{d${EpTk$I4E6o{ z8pnyN_m?ZHCAgjMMwePbdddu{9u5tN#Y&j&zv#KZ{V8rMq>IBB*Jw~{hVSK4{Avj* z9(ZThJn&wn0sEOMnbPCEj~-v#wm!I|P)AVkczU{rU-c;mZ(0Qd5yZO;_x;Wl^sspt~xvAa=pRYkO|f@8(FUHA=)M!yVZ zEWVHhybW2S6dqiPh+)n7(Dn4ohNmESo@g(xuB z7~dPiW_rrP9k6NpIo)%y`Ad#9xZUNQ(YWz;KhWO%rp1mXy8%75twhBRG=!e@StTj3qzF~2#Q8u$eva;USw2KizZ$>yi;^ zAnt&hx?C5-$j=2{nF_>Ix~t3AvRHph2g2`e_{R9*MkZsHE8h>U5T{fKad79T)7%nk zL8us!%fRv$%-kIAzj^3Ue7Y2$2_E_@j^8d6CsiS;ghVB)K5wa;d?UVUtGwaRv!?F4 zpeqs+PP$Z%s+f=l9-)wV@RRX)uygea1pq()?hq957YQJy&)^iKnlr&`7kGG512@yq zT0`?$6(fuK4_svIvXwe$WmK?@a>=~s!m>q5sme!cCLn->3T;G3J2qeKIAO_eoEOX~ zLkBhpt|LSz@1G&Tf`<}#dk+x40x0ibNEJ$ccelrNva00y$&V5`nnS{Wye4{MJs+`* z=~#^W@lSRe6w87a6st4F_%juU|`e55GSMlXSHzS>46HEQH4hkJn( zirUn_zhjrJ{}wl;EzC6%_@N4a#@K}T!U-99zo|Nj6dc*67blSz2Pwe*o=a~uweQsZ zXU!aZ>WgT_RE~o-VqH{A2^jy0BGIkx(WnAroyNis{qVbvw@{=)+`3lC|H)r)W_~I6 z1q4!5>3m&0sTFl9iU36M=P(J*RAifI{19DH;Zc44bA0j_7uoll5Nz>QA4f#bONYY1 znDC(u@xrTy-W4@sCVRozBZJ!u0*1gEim29t6R#d~pS*YCr$KV#eT}crh+4nm`>F7oxDt;#3fQ5+m6y8A8mubnaWiqO&J+ zi;FCs?n%O(5->4LKso30Sc&*xWeOG~a0@k703s#)Sf>NN4t)ADmCD2-GynS(s6XSF zc?+hllD7NMG)w-LD9m<(VlwwL5{cFiTbj>*S^(VocQyMX+!ylfsyY{RH6NoUjPR*> zzmBIZ)vX7P?0gsu|3SzFNkoAhzss7F3PJhKD@;-7%$*{2a=xz-WS_XwZBQwMlI`~$ z1?>w0MePU?ayRgOOIvF=wz zi_oIwgqK2~OTE<;o36pZA0`oci7&4$iXK?(tEN*o{de<@mrYtP*D)*ZL0 zy5Bc!7u9a)%49n=^kNq9$A2vSdP45Fanugps}bZgA~kHkDPD=AF1Lp*`$(z%aXWM= z@owgDAgYkN0zDIhqS^yOHMvwKhqJ;ckJPJKfuloLvgoD~SA73W2lJWAJFLUII2U>Q zwwYr!ZYFSViQK)KRE2m?|1T#%t{A}-Gh09RhwLwh?W=f7M0CWKo@KxnlqevhEmpmw1yEv9??!YfMg|t9eQQE4d~(YVr>_iIG+*h3BDr1$W~o!%au5>1 z3h@8R2G~S?*Cc%NTdrkHR2ypRvtrQpC~5sRX^;L}KYc8_$dufpW2v95h1sB>k?48E z(cYE6Y2q){NtaaPE%+SV*4!2A=(ufA8K-|A0DV0!;%#jF{NXSr@jSjZQ5>Q8b0@3k zNs>Zk$<&1ETrc8Lm0Ft63tSqG@n)o6s}m?~t7*S=o9bIBC2)LFh^qkPK0nm3MYnTZ zDn>z@#*#n_)hcJTOI(8YzP>TG@97XOd+KPjk6X1`@K_haJT(1Hb4q>jr_uK?0qeU8 zwU{K@2z$uP?R2H zL?aBS(@j8X)1+~$o?DA9d_)8z{7eBSLhVz2y;OhqSmyVe=2qnGG%s-1Jl6x@0-fpQ zXu`-n!&ALNMXusP0H8X5_`d*G${_bI6#%(vhGzFCu$q9#^Dd&EqCHePSZA~oI#^yg?siBOX z*KDO3Ui)q1KjpAWTN%{qij=Ix&BFI>369gw0w5Q^wVrj1vbR_Bq>d?sp&#Twm9NHoWCk{*@@aA8Sxl3YkLt`GhEN7+AjCoCD(yiygVokb z$k+e@f3!^g$2{V6g>qnjX$yXGA3f7-6vgbw(ug>IW$JuEd66jnW12MV)eDhR1IZpJ zw{W^e7Y*Q7tY~%6##--609);*mESlu$Guw70L|n_{{bdFSRwBW3udjQ1AH;ROF5RJ zrm;{j>lnE8gvzo#qz~oe?z&D!cA6A%@-yZAGK=xPlmRxIAJ+?wYjim>j+% zjkP^YJ~3fjS_~-3xaRmZ>Bvqp)4iB~PzV*oSWo%XtvWc3Y?xUSq8KCZ7bc8a?sQk- zBo>9%MypTi$j%)|@zxOZ&FBSw6vU|P&xLn91-Boa@v<-5paEWphDX;%Ou44CA-Xi8 z?-y(lmuz??H%SE$b-|0blzTptmO_jtIuMj@+M-L3ip+*y-~9X?OrPYqjjWZbof~2KQEn}R}=7O*eDsk!8p!1ydH$_ZAYUk6m zdT8LIjpBem7WEtt;n)jndIkqZ=BF1sALM0BUte?ZtlB?f0zTU5tyKhn&0eN_nNzs6 z>HJe#8vXof?3>LA-|p|khz5~a^&>2jZ-JN+NxaxAP(aJ>{rRFRl2*-8N?LHw+sZ&O(gu7sxMK}F@2=^({g@S zcPCzW6-qS<)5z~$_e&K`A^q)@?C#jcHlFdV(hCWuqK_Xm5=dkAe79UclBK>o5YeL* zuJAGmpZ92F4xS;e^S;7@|I^n}^v8{$Ie z>5T#az`R}`4usP12{OtWBN@i7XO#vq9tBBuzvd?QR}~^M3JxxOBk=9_o7c8T)tYT0 z)i*|}$PVC94<^F@)5}%AMfE-Z1q7rUfhBYarCGWJ#3dv|K?KRAyHi<8S`eg{4i^Lj zq&t>ea9NR%loDwKWC`ideLvs-;d`I^$PjBo;0q@g><&J0PT^?)gG^66u|GP_D!^lH~5E3ddhc1h5w+Z5r0+3^#YL z{ay$9WtJ1ju?K;4rWnYB!RVc+M5<2`Ec_h|%yiGyz{9q5!;GBUY4je`F$Y{gnITXI zq~j0H$37kcgBW!p0x;G?F1rNW#oI;B^zFwo7teVcz}2dEy04H4WMRY^G}R#-4?3h( zfaEJvt)Q+Bd*OA`zdBUj=9AmiY`r;VG?Eab4kf73tb_igQgIjYb#?50RR@Emb7$kM zHA8#qtByndj@l1C-nSuyCwDKN>?9Db@okO-{z)7(W>SGM34e0hRq@cA zU&5yNw3ZyLnsi^r&yvkd(Hx|W;hI3ffa2mV-jt4w?)k8PB7mwLw_uUb7KG!mc_|4D z=v4_DAk5wu1o<<|Gh=O`NNaB$Sh|B)y6THi%tT%YF7$KO-|s6eRC!cCfi0=NkUvx< zoRgK9kRk_6>*+I30;!-ZM{t_KD zKDmF_VmKzdb)rC5jG!hCD1TYBtTlqjpJs9B)JcAb-F4$h9f0cxEb71TS=ml+5p}TF zK_wZ2qz?nF@dtL{t0$_GO`WKC;fHR^G4B6htIBpuM999Nh>J8A$WOo00KGr!gp0K6x`(H=tc=-ZS&L}x{ zI-sICYO@i0y>6$v?BT&;(m2=uq3pH}$kkQXdmC+A4A^V!tq(@lIAn_H=z1rz#Y z`i+Z;maF?-L+P?q{B8u93bFBjGi&(0gngT+_q0pJa>w!_AH!^sn$qz~R|6p^#$VB3 zRddskgt*dZACN%*++?Y6Ch?tVLfQKN(>du5u&>BN1d?o(lJdrods;m7hwU=aFBjaM zpGn$XHk92xzUL))D__KS7p=<9svDq6O*fWiXUL>b{M_+8{z|b~M)F7sh=y@7g0j0t zMcV1TKEh#psu;Y!wS%Pe7}o>3=VOxmwcN}a789LKzS;vmIJdy39#VJf?oA~b7IMjm znpW~3s)4AY5~qU{k)}qZJ%=g~ar8H1O72$+xFKu(WQQf$nsed*c>HB3R$W+X+9lL% zrIyFb&Rr_`PE8`&ndl62I^%dqj*U2ffX?F9ihj7@65v+ z<}=6MPMfTcWI^wg-A9@tN{f_(wg@{ zyZJ%;KXHcVUd6NQZ|Kj#Nl%7I-6^Zi+v4se_sEjf^!_2Ex@zpdSz7GWm^I7@V87`K zD!`6pnTj{xC4r{f3AVMp9CLPY88b8|*Q8A$E9X<$V-hegHZ;j(+o6KF3>5!XrKOG1 zArX82;H6-bh2tOR=|jR6M*0*ou}q0+iH)|?kP8g0TAmMhJy$MsX=4e$D>2IDuz0n5 z)wPe$_E@{P421N!N_+HC(N0A&kY2TI&m#*ua&LlVk5vy6cE z)XR0=U5?9|RlS*kjQ1e?*8?c^{`71KsgYi_#}lRViN-32B%2m^(P;f6m9O|$ zMGzHKd7cT6Vh*-ja|SInkBK=kf(n<@Gl8hKJ-3s&s@#HKvDjQ&7mZ3hQW?i@B}797 zh+x@?jh+aR9-V5mv=tW9grNzpd-LjvR5{2I9%GPneGygVaLUr>!hEg>zJ&@dsP??Y z0lqtK_H=|7De|4WAAahdL}P9+kcRp?dB3U0ZvfZs5VT8CX?3MqFly_=-t5y+CS2MV z0n6_H+bUN|E^}J}VXYWq*m#({R%8yMawm%Dni%VvHO9lckXvRM48yik6ZFY;;-UD_ zr9O-?zHojqq&)G&4e{o;3%yLfpM|9Kj}V#}Jbu78iaU3m5pGlZd@11^CCJ?$1-w>RygKA}3ZeyI+rba$Dcd5j7-hRbHzir2&AKR9IV z|4TkH4S47W`$CixIe5lrphZ^$pSlZH*N#XHeN1$vo+6D^2iC-Xqq+EzJw;_OTKNS|=XZ(I)FUT(RCy}qDi zolNaRLDDv}=@5oMzb>TlkezNN$Ml$<8p`6|l(!HRlUs1J?g72Y!A30wt{oZieMV+a z(!Sr;-J4?aFkOjxd}?zxfq)9T$4dQii#*~}L9M@@@|J{Zw4rfJ#v#l97Ku$u_i`!# z5p5<(3y0mZ+B^h)HFS~nb+5%gx!}}bAoG^jGDelY20-juyo}=tyqy{x?|xlOsM6y4 zJ5jE=Dp(lFeP%u0HOdfoieOHoNdo9}=Emc{KJbn)8c;C>-L=yhTQWs5}c z3A0ey#(%d`ITVagv>tup zF8h-e{E#DXO%*!T>np7hze?+OMEJzEmDigSlkx=NLIImqh{miMb!6UaJWaP81B1>u zm`B1Fk7bMl^@>_1Oii}p)GN|6VlOj>%`#HUC7S^CS={I3{Ws0+yY3YZeJKNd=r}p8 z1PatUF-e!3Cym4C|IhOl>9g6wrzQi)eS%?(<_tQOO{}T3m#9U z*USlg!3C96o0L&Mi+A0!R6sOmsO%mtBu>r zg4XTFFO_7qnkn%VoVW#|H-g`&$@a6jsRIL+B2Ct9y{v5UTZ!CIF)yu6K%UT6h ztssOQRNBerL7um?(hO#kaws=@VJCwP47GIGa{27+hS{H9E4K5W9royepD&N%2i7X> z#51|qTVRutn%OhC`+sf4)#M+{{3MN72!beeZ7pnt>b~Tcaw2?lEA`#XQvIHH!Yt8m zHxhV4kurUWXfXqE$ytJfM1pNSvECt(xN*Bn5Mr~*d5stMm^kbO5CPiX$ULbDT*wFf zB2_zTN|=ng)tv~#qdtxEm&SJ-k_PpX`1d8o1#wnuS&#cl{?<}k0I;AZvb{)%Zn#8Y`J zl%2_9SI+l@s2=2Fp((m|T(>BUDGS&*g9em$?E`w$L6Ff*a!`48aOaMt$Fd0Au&6~^ zrhhww`49bv=;c?~Vc&PK6@yFAAQ8rWPEP&^E_Fyhc3aS}@ykWZk3_FM5nm*&$`H%b zq^9ph2E-+axIj)lyYYW&oEPCYUXP2yg-3t-Rgyc!f#yga82a-ZZ;r^7U(YK5H*TBB zNze@&$@K((ifGjvD<N)Ip@~{2)oU(OD(z-NZkBsWt4v{-%yXR!*4i zfVE8`c5AF`kz}ZD2r#%#w(Z~6kc72ogYml^-sgg;hMKx49sv-F?_p2|dLukh)r&gX zF!{D%AF%^9EMwAE1fwZ!im2wYuRSr}UK4H91SF~q{!B8(vcw6puoP-q@RJjsQ-$Fo zP;cv|4t4mR@qPY5BeI*Al0Pb5@=ij0YlqPc;$jQT@~ZLQ85 z&W~BY^sboo2M?21{t3E2Q?M+zW8*6k*)^4_Az4~9ac#e=67LoGNK)(b$1Z}y%aRD7 zv4U0q5t-iAprWggkt>+%^7Wbo!|M+ zWd&ZBfJRO7zuL3l?8x5b&uf1*R#If=S~|&}lu`ejRy>q4=J~+SP4A{e)T`=7O~^xl zc?a}xMXYnBhWbv*5?om4obzKV<)g8@V9>fU0=zrN#Pz0fyfyB{JM~9Sw=XWHXyC16 zn}W<>DD`KE)ttF5#qE(ZCGJ+CtZ|D|J(H2fc?{_(>pK|&+HyOm%qx<~gdd6`qkb&+qrxr`2abMX?P=4WT#u5l@HA8jrJjYPHsR^@Rbt74}UISsC;m zK}ff8CA4OoYT`~}p?IO3F@A*MgCBb@O zB{co)cjTk6n$_=IxNq@6E_0`I4s1%*^gYvs@$xPl?S`u8Kk${8F&&_&^7ZdOJ`05e>UmMIUweP8l z6%b9O(J!sE9mRZrh^uRPXZ_cL3tPl!*n-*xq*^Hr0M4SNXLEWxo#gmEI>EL1KRis|n zteI8^k#9`zQFQNlOu5%oukA8)eeIp}q1*s^nrPar%HRSu>!_Go+SnYrkduc-B+~m+ zfFj=)i87XIQxLn1Hz3dv$kjlvEL?axhe=qy;`Y@D}3V>kwHkPNnpE)py@77Jv ze_6eHzWN>f^4>GyVYI^tHd(+;RC(m|TF%xSAA-ZjUuKhol8JZsO;0t9eTWV+ODrY; zJ~5C6`E7nQSo$#Ip!(z01nL{maa5!)BZ3G|UO9Gz~Tv)lMc6yHm+}8cJJZ@5o2?SBwwQsI(+yAsvgGi$fphVZl z6ED!_Rg;GgXx>sJimV(&%RlBr99y&l z>f2I%z4ERGZMH12{(4Plk4V-X%B3u) z&Ou(U8in4kVYVkK@KV-j>JPpgWgA55-EXItvAn{Pil=|oL(w_0)4xKQS|Zfq3y{H| zddyskx+iy3NnXn1qr&EY3r7dL0M~cRFLkWVWR5dw>7k0GPB*#h zZnN)HXwwrfNbljEO2ef94(FE>Q{KMTEo z)6}=D5GEL|Y&H_mz!LKmQ_?3Jsbwa+`3hT^S1_$7yvL-BP6`*bO=!he)b{jScf(); z8UQ87%(TLRRt(%BY}OU%0^Om)52(bfj<3i@hU{1>*JMOeA*m4SyO0b#4ohh1Q@PMC zrF2v^5F8czA|8ll`NILjJEt*-fckJ@H1-ajV^9T*9{`OM^vYhHj*aX5i@=Q=-7CWX7X5th zkay?3ZgZ7X239DS^u;!;2sA54sx%tk$wLvHmi3qSQ_*6xuCfeP`P`Yz~FT2hU<0Ux( z2T-}owC72jhn$!YDuh{mjJj4VN`-e*Q&J~kxMpyVEu`>_$=g7B9fwhiFY~>5D|0Iv zi|)Xw4uyM|_WjATS$6@mjEDpz0zFZhHv_ QuCalhs6B;MtHR&@4->{}!T Date: Sat, 20 Jun 2026 02:58:24 +0200 Subject: [PATCH 17/67] chore: all checks passing for regenerate favicon pngs from new brand mark From 1670f57ea905d01dd4393473195fc3bb3aca1bbd Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 03:00:19 +0200 Subject: [PATCH 18/67] docs: archive completed spec regenerate favicon pngs from new brand mark --- .../2026-06-17-03-regenerate-favicon-pngs-from-new-brand-mark.md | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename specs/{todos => done/2026/06}/2026-06-17-03-regenerate-favicon-pngs-from-new-brand-mark.md (100%) diff --git a/specs/todos/2026-06-17-03-regenerate-favicon-pngs-from-new-brand-mark.md b/specs/done/2026/06/2026-06-17-03-regenerate-favicon-pngs-from-new-brand-mark.md similarity index 100% rename from specs/todos/2026-06-17-03-regenerate-favicon-pngs-from-new-brand-mark.md rename to specs/done/2026/06/2026-06-17-03-regenerate-favicon-pngs-from-new-brand-mark.md From 95209a0f54992a958e992a150729146284dd8759 Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 03:02:46 +0200 Subject: [PATCH 19/67] chore: start implementing status warning degraded From 01068f493b7a3aedf5cf5048e2c3e31a4880fbbe Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 03:03:08 +0200 Subject: [PATCH 20/67] docs: add implementation plan for status warning degraded --- .../2026-06-20-04-status-warning-degraded.md | 36 +++++++++++++++++++ 1 file changed, 36 insertions(+) diff --git a/specs/todos/2026-06-20-04-status-warning-degraded.md b/specs/todos/2026-06-20-04-status-warning-degraded.md index f893e0ba1..5fdf0093f 100644 --- a/specs/todos/2026-06-20-04-status-warning-degraded.md +++ b/specs/todos/2026-06-20-04-status-warning-degraded.md @@ -213,3 +213,39 @@ Amend the `results.status` CHECK in **`001_v0_1_0.up.sql`** for **both** dialect are **five** status→string sites (not two): `CheckStatus.String()`, `StatusToString`, `results/service.go statusIntToString`, the checks-service LastResult mapper, and Slack — plus `parseStatusFilter` already accepting `"degraded"`. + +## Implementation Plan + +Ordered, granular steps (each is its own commit after `make fmt`): + +1. **Enums + `String()` + `Severity()`** — + - `checkerdef/types.go`: add `StatusWarning Status = 8`, `statusStrWarning = "warning"`, + `String()` case, and `func (s Status) Severity() int` (Down/Timeout/Error highest, then + Degraded(=7, never emitted by a checker but ranked), then Up; Warning ranks at Up level for + availability — promotion to Degraded is handled in aggregation, not here). + - `db/models/result.go`: add `ResultStatusWarning = 8`, `ResultStatusDegraded = 7`; + `StatusToString()` → `"WARNING"` / `"DEGRADED"`. + - `db/models/check.go`: add `CheckStatusWarning = 8`; `String()` → `"warning"`; keep + `CheckStatusDegraded = 7` → `"degraded"`. +2. **Wire-string mappers (all five + statuspages + filter)** — teach the new values to: + `results/service.go statusIntToString` (warning→"warning", degraded→"degraded", keep + Down/Timeout/Error→"down"); checks-service `convertResultToLastResultResponse` (warning→"warning"); + `slack statusIntToString` (warning→"warning"); `statuspages/service.go` check-status mapper + (CheckStatusWarning→"warning"); `checks/handler.go parseStatusFilter` accepts `"warning"`. +3. **Migration constraint** — widen `results.status` CHECK to `status in (0,1,2,3,4,5,6,7,8)` in both + `001_v0_1_0.up.sql` dialects (adds the missing 6=error plus 7=degraded, 8=warning). +4. **Availability** — `job_aggregation.go processRawResult`: count `Up` **or** `Warning` toward + `successCount`. +5. **Aggregation Warning→Degraded promotion + severity tie-break** — rework the rollup status + selection: (1) dominating hard failure wins (severity tie-break via `Severity()`), (2) else any + raw `Warning` in the window → `Degraded`, (3) else `Up`. +6. **Incidents neutral Warning branch** — `incidents/service.go`: add `isWarning`; do not early-return; + run the visible-status update with `pickStatus` → `CheckStatusWarning`; keep clocks neutral; define + up↔warning streak/`statusChangedAt` edges; never open/resolve an incident (model on Validating). +7. **Frontend shared `statusStyle()`** — add one util per app (`dash0/src/lib/status-style.ts`, + `status0/src/lib/status-style.ts`) handling both `"warning"` and `"degraded"` (amber) and route the + listed dash0 + status0 surfaces through it; add `warning`/`degraded` i18n labels. Update the design + reference if a primitive is added. +8. **Tests** — table-driven (testify/require, `t.Parallel()`, SQLite + Postgres): persistence of + 6/7/8; availability Up+Warning→100% & promoted row status Degraded; severity Down+Warning→Down; + incident-neutral Warning; serialisation strings; `Severity()` ranking. From 55a2fcf1f56fd07e527f820a5537794c704c0a97 Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 03:04:03 +0200 Subject: [PATCH 21/67] feat: add Warning(8) and Degraded(7) status enums + Severity() ranking --- server/internal/checkers/checkerdef/types.go | 39 ++++++++++++++++++++ server/internal/db/models/check.go | 11 +++++- server/internal/db/models/result.go | 11 ++++++ 3 files changed, 60 insertions(+), 1 deletion(-) diff --git a/server/internal/checkers/checkerdef/types.go b/server/internal/checkers/checkerdef/types.go index 199540f42..077efe5bc 100644 --- a/server/internal/checkers/checkerdef/types.go +++ b/server/internal/checkers/checkerdef/types.go @@ -15,6 +15,17 @@ const ( StatusDown Status = 4 // Check failed (target unreachable or unhealthy) StatusTimeout Status = 5 // Check timed out StatusError Status = 6 // Internal error during check execution + // StatusDegraded is the aggregated rollup status: a window contained + // warning(s) but no dominating failure. It is produced ONLY by the + // aggregation job, never returned by a checker's Execute. It is declared + // here so Severity() can rank the value the rollup writes. + StatusDegraded Status = 7 + // StatusWarning indicates the target is up but there is something to + // report (e.g. a certificate nearing expiry, a flapping container). It + // counts as up for availability and is neutral for incidents; the + // aggregation job promotes any window containing a raw Warning to the + // aggregated Degraded status. Checkers never emit Degraded directly. + StatusWarning Status = 8 ) // Status string labels. @@ -24,6 +35,7 @@ const ( statusStrDown = "down" statusStrTimeout = "timeout" statusStrError = "error" + statusStrWarning = "warning" statusStrUnknown = "unknown" ) @@ -40,11 +52,38 @@ func (s Status) String() string { return statusStrTimeout case StatusError: return statusStrError + case StatusWarning: + return statusStrWarning default: return statusStrUnknown } } +// Severity ranks statuses so the aggregation job can resolve a dominant +// status by gravity rather than by raw numeric value (the numbers do not +// encode severity once Degraded=7 / Warning=8 exist). Higher = more severe. +// +// Hard failures (Down/Timeout/Error) outrank everything; the aggregated +// Degraded status (7, produced only by rollups) sits below failures but +// above Up; Warning ranks at Up level for availability (it counts as up), +// while its promotion to Degraded in a rollup is handled separately in the +// aggregation job, not here. Created/Running are lifecycle markers and rank +// lowest. +func (s Status) Severity() int { + switch s { + case StatusDown, StatusTimeout, StatusError: + return 4 + case StatusDegraded: + return 3 + case StatusUp, StatusWarning: + return 2 + case StatusRunning: + return 1 + default: + return 0 + } +} + // Result represents the outcome of executing a check. type Result struct { Status Status // The check status diff --git a/server/internal/db/models/check.go b/server/internal/db/models/check.go index b696cdd87..272c8ca3d 100644 --- a/server/internal/db/models/check.go +++ b/server/internal/db/models/check.go @@ -23,8 +23,15 @@ const ( // configured ConfirmationPeriod hasn't elapsed yet. Display-only: // never triggers notifications, never gates the incident state machine. CheckStatusValidating CheckStatus = 5 - // CheckStatusDegraded indicates the check is experiencing issues (reserved for future use). + // CheckStatusDegraded is the aggregated/summary status: a rolled-up window + // contained warning(s) but no dominating failure. Not produced by the live + // pipeline (which uses CheckStatusWarning); retained for rendering a + // check's aggregated/summary status and as a valid ?status= filter value. CheckStatusDegraded CheckStatus = 7 + // CheckStatusWarning is the live current status: the target is up but + // there is something to report. Display-only like CheckStatusValidating — + // never triggers notifications, never gates the incident state machine. + CheckStatusWarning CheckStatus = 8 ) // String returns the lowercase wire name for a CheckStatus, used by the @@ -42,6 +49,8 @@ func (s CheckStatus) String() string { return "validating" case CheckStatusDegraded: return "degraded" + case CheckStatusWarning: + return "warning" default: return "unknown" } diff --git a/server/internal/db/models/result.go b/server/internal/db/models/result.go index ee08286f4..c557f1bfd 100644 --- a/server/internal/db/models/result.go +++ b/server/internal/db/models/result.go @@ -22,6 +22,13 @@ const ( ResultStatusTimeout ResultStatus = 5 // ResultStatusError indicates the check encountered an error. ResultStatusError ResultStatus = 6 + // ResultStatusDegraded is the aggregated rollup status: a window contained + // warning(s) but no dominating failure. Stored only on aggregated rows + // (period_type = hour/day/month) by the aggregation job, never on raw rows. + ResultStatusDegraded ResultStatus = 7 + // ResultStatusWarning indicates the target is up but there is something to + // report. Stored on raw rows; counts as up for availability. + ResultStatusWarning ResultStatus = 8 ) // PeriodType values for the Result.PeriodType column. @@ -47,6 +54,10 @@ func StatusToString(status int) string { return "TIMEOUT" case int(ResultStatusError): return "ERROR" + case int(ResultStatusDegraded): + return "DEGRADED" + case int(ResultStatusWarning): + return "WARNING" default: return "UNKNOWN" } From dcb9eae34d056cee01f8f58251853488227d9362 Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 03:05:09 +0200 Subject: [PATCH 22/67] feat: teach status->string mappers and status filter the warning/degraded values --- server/internal/handlers/checks/handler.go | 4 +++- server/internal/handlers/checks/service.go | 4 ++++ server/internal/handlers/results/service.go | 16 ++++++++++++---- server/internal/handlers/statuspages/service.go | 5 +++++ .../integrations/slack/mention_commands.go | 7 +++++-- 5 files changed, 29 insertions(+), 7 deletions(-) diff --git a/server/internal/handlers/checks/handler.go b/server/internal/handlers/checks/handler.go index cb4c56ba7..55fae65f7 100644 --- a/server/internal/handlers/checks/handler.go +++ b/server/internal/handlers/checks/handler.go @@ -26,7 +26,7 @@ import ( var errInvalidStatus = errors.New("invalid status filter token") // parseStatusFilter accepts a comma-separated list of status tokens -// (up/down/created/degraded) and returns the matching CheckStatus values. +// (up/down/created/degraded/warning) and returns the matching CheckStatus values. func parseStatusFilter(s string) ([]models.CheckStatus, error) { parts := strings.Split(s, ",") out := make([]models.CheckStatus, 0, len(parts)) @@ -44,6 +44,8 @@ func parseStatusFilter(s string) ([]models.CheckStatus, error) { out = append(out, models.CheckStatusDown) case "degraded": out = append(out, models.CheckStatusDegraded) + case "warning": + out = append(out, models.CheckStatusWarning) default: return nil, fmt.Errorf("%w: %s", errInvalidStatus, token) } diff --git a/server/internal/handlers/checks/service.go b/server/internal/handlers/checks/service.go index daf4b0f0d..7b86d11ed 100644 --- a/server/internal/handlers/checks/service.go +++ b/server/internal/handlers/checks/service.go @@ -1827,6 +1827,10 @@ func (s *Service) convertResultToLastResultResponse(result *models.Result) *Last switch *result.Status { case int(models.ResultStatusUp): statusStr = "up" + case int(models.ResultStatusWarning): + statusStr = "warning" + case int(models.ResultStatusDegraded): + statusStr = "degraded" case int(models.ResultStatusDown): statusStr = "down" case int(models.ResultStatusTimeout): diff --git a/server/internal/handlers/results/service.go b/server/internal/handlers/results/service.go index 21ff62bf7..5b94358bc 100644 --- a/server/internal/handlers/results/service.go +++ b/server/internal/handlers/results/service.go @@ -28,10 +28,12 @@ var ( // Result status string labels. const ( - statusStrCreated = "created" - statusStrRunning = "running" - statusStrDown = "down" - statusStrUnknown = "unknown" + statusStrCreated = "created" + statusStrRunning = "running" + statusStrDown = "down" + statusStrWarning = "warning" + statusStrDegraded = "degraded" + statusStrUnknown = "unknown" ) // Service provides business logic for results. @@ -343,6 +345,12 @@ func (s *Service) statusIntToString(status *int) string { return statusStrRunning case int(models.ResultStatusUp): return "up" + case int(models.ResultStatusWarning): + // Raw "up, but something to report" — counts as up, rendered amber. + return statusStrWarning + case int(models.ResultStatusDegraded): + // Aggregated rollup status (hour/day/month rows). + return statusStrDegraded case int(models.ResultStatusDown), int(models.ResultStatusTimeout), int(models.ResultStatusError): return statusStrDown default: diff --git a/server/internal/handlers/statuspages/service.go b/server/internal/handlers/statuspages/service.go index d041e1b2e..ddaa79d32 100644 --- a/server/internal/handlers/statuspages/service.go +++ b/server/internal/handlers/statuspages/service.go @@ -1421,6 +1421,11 @@ func (s *Service) getCheckInfo(ctx context.Context, orgUID, checkUID string) (*R // should still read "up" until the failure is confirmed and an // incident opens. statusStr = "up" + case models.CheckStatusWarning: + // Live "up, but something to report" — surfaced amber on the public + // page (counts as up for availability, but is not hidden like + // validating: the operator deliberately flagged something). + statusStr = "warning" case models.CheckStatusDegraded: statusStr = "degraded" } diff --git a/server/internal/integrations/slack/mention_commands.go b/server/internal/integrations/slack/mention_commands.go index 1915b2bbe..0af7582cc 100644 --- a/server/internal/integrations/slack/mention_commands.go +++ b/server/internal/integrations/slack/mention_commands.go @@ -13,8 +13,9 @@ import ( ) const ( - statusDown = "down" - statusUp = "up" + statusDown = "down" + statusUp = "up" + statusWarning = "warning" ) // Slack mention command names. @@ -428,6 +429,8 @@ func statusIntToString(status *int) string { switch *status { case int(models.ResultStatusUp): return statusUp + case int(models.ResultStatusWarning): + return statusWarning case int(models.ResultStatusDown), int(models.ResultStatusTimeout), int(models.ResultStatusError): return statusDown default: From 3642ef55475904638d0ae9d48c4549fdfb58ac88 Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 03:05:20 +0200 Subject: [PATCH 23/67] feat: widen results.status CHECK to allow 6(error)/7(degraded)/8(warning) --- server/internal/db/postgres/migrations/001_v0_1_0.up.sql | 2 +- server/internal/db/sqlite/migrations/001_v0_1_0.up.sql | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/server/internal/db/postgres/migrations/001_v0_1_0.up.sql b/server/internal/db/postgres/migrations/001_v0_1_0.up.sql index a78a8e81a..928ba3807 100644 --- a/server/internal/db/postgres/migrations/001_v0_1_0.up.sql +++ b/server/internal/db/postgres/migrations/001_v0_1_0.up.sql @@ -437,7 +437,7 @@ create table results ( period_end timestamptz, region text, worker_uid uuid references workers(uid) on delete set null, - status smallint check (status in (0, 1, 2, 3, 4, 5)), + status smallint check (status in (0, 1, 2, 3, 4, 5, 6, 7, 8)), -- 6=error, 7=degraded (aggregated), 8=warning duration real, metrics jsonb, output jsonb, diff --git a/server/internal/db/sqlite/migrations/001_v0_1_0.up.sql b/server/internal/db/sqlite/migrations/001_v0_1_0.up.sql index fefe33bd3..c8e1d2f6c 100644 --- a/server/internal/db/sqlite/migrations/001_v0_1_0.up.sql +++ b/server/internal/db/sqlite/migrations/001_v0_1_0.up.sql @@ -337,7 +337,7 @@ create table results ( -- Raw result fields (period_type = 'raw') worker_uid text references workers(uid) on delete set null, -- Worker that executed this check (raw only) - status integer check (status in (0, 1, 2, 3, 4, 5)), -- 0=initial, 1=up, 2=down, 3=timeout, 4=error, 5=running + status integer check (status in (0, 1, 2, 3, 4, 5, 6, 7, 8)), -- 1=created, 2=running, 3=up, 4=down, 5=timeout, 6=error, 7=degraded (aggregated), 8=warning duration real, -- Total check duration in milliseconds (raw only) metrics text, -- Numerical metrics: ttfb, dnsTime, tlsHandshake, etc. (raw only) output text, -- Diagnostic output: error messages, HTTP status, headers (raw only) From ccd651564d8c9de91e4b14d87e81146ce0be55af Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 03:06:19 +0200 Subject: [PATCH 24/67] feat: count Warning as up and promote non-failing windows with warnings to Degraded --- .../internal/jobs/jobtypes/job_aggregation.go | 45 +++++++++++++++++-- 1 file changed, 41 insertions(+), 4 deletions(-) diff --git a/server/internal/jobs/jobtypes/job_aggregation.go b/server/internal/jobs/jobtypes/job_aggregation.go index 2d3220cc8..13dd1ba87 100644 --- a/server/internal/jobs/jobtypes/job_aggregation.go +++ b/server/internal/jobs/jobtypes/job_aggregation.go @@ -11,6 +11,7 @@ import ( "github.com/google/uuid" + "github.com/fclairamb/solidping/server/internal/checkers/checkerdef" "github.com/fclairamb/solidping/server/internal/db/models" "github.com/fclairamb/solidping/server/internal/jobs/jobdef" "github.com/fclairamb/solidping/server/internal/jobs/jobsvc" @@ -744,7 +745,12 @@ func processRawResult( if *result.Status > *maxStatus { *maxStatus = *result.Status } - if *result.Status == int(models.ResultStatusUp) { + // Warning counts as up for availability (Decision A): the target is + // up, there is just something to report. The window's promotion to + // the aggregated Degraded status is handled by the dominant-status + // selection, not here, so availability can be 100% on a Degraded row. + if *result.Status == int(models.ResultStatusUp) || + *result.Status == int(models.ResultStatusWarning) { *successCount++ } } @@ -877,7 +883,18 @@ func initializeAggregationState(results []*models.Result) *aggregationState { return state } -// calculateDominantStatus calculates the most frequent status, with ties broken by higher status number. +// calculateDominantStatus selects the status to persist on the aggregated row. +// +// 1. A dominating hard failure (Down/Timeout/Error, by most-frequent with a +// Severity() tie-break) wins outright — a tie between a failure and +// anything else resolves to the failure, never to Warning/Degraded. +// 2. Otherwise, if the window contained anything "to report" — a raw Warning +// (raw rollups) or an already-promoted Degraded child (hour→day→month +// rollups) — the row is promoted to the aggregated Degraded status +// ("there was something to report in this window") — Decision D, +// promotion rule "any warning". +// 3. Otherwise the dominant non-failing status (Up, or a lifecycle marker +// when that is all there was). func calculateDominantStatus(statusCounts map[int]int) int { if len(statusCounts) == 0 { return 0 @@ -885,15 +902,35 @@ func calculateDominantStatus(statusCounts map[int]int) int { dominantStatus := 0 maxCount := 0 + hasSomethingToReport := false for status, count := range statusCounts { - // If this status has more occurrences, or same occurrences but higher status number, it wins - if count > maxCount || (count == maxCount && status > dominantStatus) { + if status == int(checkerdef.StatusWarning) || status == int(checkerdef.StatusDegraded) { + hasSomethingToReport = true + } + + // Most occurrences wins; ties broken by gravity (Severity()), not by + // raw numeric value — numbers no longer encode severity once + // Degraded=7 / Warning=8 exist. + if count > maxCount || + (count == maxCount && checkerdef.Status(status).Severity() > checkerdef.Status(dominantStatus).Severity()) { dominantStatus = status maxCount = count } } + // A dominating hard failure always wins — including a tie that resolved to + // the failure above (Severity ranks failures highest). + if checkerdef.Status(dominantStatus).Severity() >= checkerdef.StatusDown.Severity() { + return dominantStatus + } + + // Non-failing window containing a raw Warning or a Degraded child → + // promote/carry the aggregated Degraded status. + if hasSomethingToReport { + return int(checkerdef.StatusDegraded) + } + return dominantStatus } From 427dfe4096d3e3d803101992b56c46e3597f1db1 Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 03:07:36 +0200 Subject: [PATCH 25/67] feat: add incident-neutral Warning branch (visible status, up<->warning streak, no open/resolve) --- server/internal/handlers/incidents/service.go | 50 +++++++++++++++---- 1 file changed, 39 insertions(+), 11 deletions(-) diff --git a/server/internal/handlers/incidents/service.go b/server/internal/handlers/incidents/service.go index bd9693f99..b9bea9168 100644 --- a/server/internal/handlers/incidents/service.go +++ b/server/internal/handlers/incidents/service.go @@ -159,13 +159,18 @@ func (s *Service) ProcessCheckResult(ctx context.Context, check *models.Check, r resultStatus := models.ResultStatus(*result.Status) - // Determine if this is a success or failure + // Determine if this is a success, failure, or warning. isSuccess := resultStatus == models.ResultStatusUp isFailure := resultStatus == models.ResultStatusDown || resultStatus == models.ResultStatusTimeout || resultStatus == models.ResultStatusError + // Warning is "up, but something to report": display-only and incident- + // neutral (modelled on CheckStatusValidating). It updates the visible + // status and the up<->warning streak edges, but never arms the incident + // clocks and never opens/resolves an incident. + isWarning := resultStatus == models.ResultStatusWarning - if !isSuccess && !isFailure { + if !isSuccess && !isFailure && !isWarning { return nil // Skip initial or unknown statuses } @@ -179,10 +184,16 @@ func (s *Service) ProcessCheckResult(ctx context.Context, check *models.Check, r now := s.clock.Now() newStatus, newStreak, statusChangedAt := deriveCheckStatus( - check, isSuccess, isFailure, activeIncident, now, + check, isSuccess, isFailure, isWarning, activeIncident, now, ) - clocks := deriveIncidentClocks(check, isSuccess, isFailure, activeIncident, now) + // Warning is clock-neutral: it never arms or clears the confirmation / + // recovery clocks, so a pre-incident failure streak or an open incident's + // recovery window survives a warning untouched. + clocks := models.IncidentClockUpdate{} + if !isWarning { + clocks = deriveIncidentClocks(check, isSuccess, isFailure, activeIncident, now) + } // Update check status and incident clocks in one atomic UPDATE. Writing // both together means a mid-write crash can no longer leave status updated @@ -201,6 +212,12 @@ func (s *Service) ProcessCheckResult(ctx context.Context, check *models.Check, r } applyClocks(check, clocks, now) + // Warning never enters the incident state machine: the visible status and + // streak have been written above; there is nothing to open or resolve. + if isWarning { + return nil + } + return s.routeCheckResultWithIncident(ctx, check, result, isFailure, activeIncident) } @@ -270,17 +287,18 @@ func applyClocks(check *models.Check, clocks models.IncidentClockUpdate, _ time. // failure lifecycle: streak keeps growing across the boundary and // statusChangedAt is not bumped. Only the up<->failing edge bumps it. func deriveCheckStatus( - check *models.Check, isSuccess, isFailure bool, activeIncident *models.Incident, now time.Time, + check *models.Check, isSuccess, isFailure, isWarning bool, activeIncident *models.Incident, now time.Time, ) (models.CheckStatus, int, *time.Time) { prevWasFailure := check.Status == models.CheckStatusDown || check.Status == models.CheckStatusValidating - newStreak, statusChangedAt := deriveStreakAndChange(check, isSuccess, isFailure, prevWasFailure, now) + newStreak, statusChangedAt := deriveStreakAndChange(check, isSuccess, isFailure, isWarning, prevWasFailure, now) - newStatus := pickStatus(check, isSuccess, isFailure, activeIncident, newStreak, now) + newStatus := pickStatus(check, isSuccess, isFailure, isWarning, activeIncident, newStreak, now) // validating <-> down do not bump statusChangedAt: both are sub-states - // of "the check is failing right now". + // of "the check is failing right now". Warning is not a failure sub-state, + // so any edge into or out of warning bumps statusChangedAt normally. newIsFailure := newStatus == models.CheckStatusDown || newStatus == models.CheckStatusValidating if statusChangedAt == nil && check.Status != newStatus && @@ -292,11 +310,15 @@ func deriveCheckStatus( } // deriveStreakAndChange computes the next streak count and whether -// statusChangedAt should bump for the up<->failing edge. +// statusChangedAt should bump for the up<->failing (and up<->warning) edge. +// A continuing same-state run (up->up, warning->warning, or failing->failing) +// grows the streak; any other transition resets it to 1 and bumps the change +// timestamp. func deriveStreakAndChange( - check *models.Check, isSuccess, isFailure, prevWasFailure bool, now time.Time, + check *models.Check, isSuccess, isFailure, isWarning, prevWasFailure bool, now time.Time, ) (int, *time.Time) { if (isSuccess && check.Status == models.CheckStatusUp) || + (isWarning && check.Status == models.CheckStatusWarning) || (isFailure && prevWasFailure) { return check.StatusStreak + 1, nil } @@ -311,12 +333,18 @@ func deriveStreakAndChange( // ProcessCheckResult), which makes the "open immediately" // (ConfirmationPeriodSeconds == 0) path flip straight to down. func pickStatus( - check *models.Check, isSuccess, isFailure bool, activeIncident *models.Incident, + check *models.Check, isSuccess, isFailure, isWarning bool, activeIncident *models.Incident, newStreak int, now time.Time, ) models.CheckStatus { if isSuccess { return models.CheckStatusUp } + // Warning reflects the latest live signal regardless of incident state: it + // counts as up and never resolves an incident, but the visible status + // shows what the checker just reported ("up, but something to report"). + if isWarning { + return models.CheckStatusWarning + } if activeIncident != nil { return models.CheckStatusDown } From 3871276c06e4f842170bc3b583de0a9a02dd5d5d Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 03:12:31 +0200 Subject: [PATCH 26/67] feat: add shared statusStyle() util and route dash0+status0 surfaces through it --- .../components/checks/check-summary-cards.tsx | 8 +- .../components/checks/response-time-chart.tsx | 12 +- .../src/components/shared/status-badge.tsx | 40 +++---- .../components/shared/status-dashboard.tsx | 18 ++- .../src/components/shared/status-timeline.tsx | 21 +--- web/dash0/src/lib/status-style.ts | 106 ++++++++++++++++++ web/dash0/src/locales/de/checks.json | 7 +- web/dash0/src/locales/en/checks.json | 7 +- web/dash0/src/locales/es/checks.json | 7 +- web/dash0/src/locales/fr/checks.json | 7 +- .../src/routes/orgs/$org/design-reference.tsx | 11 +- .../components/shared/availability-bar.tsx | 15 +-- .../components/shared/response-time-chart.tsx | 4 + .../components/shared/status-page-view.tsx | 43 +------ web/status0/src/lib/status-style.ts | 81 +++++++++++++ web/status0/src/locales/de/status.json | 1 + web/status0/src/locales/en/status.json | 1 + web/status0/src/locales/es/status.json | 1 + web/status0/src/locales/fr/status.json | 1 + 19 files changed, 274 insertions(+), 117 deletions(-) create mode 100644 web/dash0/src/lib/status-style.ts create mode 100644 web/status0/src/lib/status-style.ts diff --git a/web/dash0/src/components/checks/check-summary-cards.tsx b/web/dash0/src/components/checks/check-summary-cards.tsx index e527d0102..a59c7708b 100644 --- a/web/dash0/src/components/checks/check-summary-cards.tsx +++ b/web/dash0/src/components/checks/check-summary-cards.tsx @@ -3,6 +3,7 @@ import { useTranslation } from "react-i18next"; import { AlertTriangle, ArrowUp, ArrowDown, Clock } from "lucide-react"; import { Card, CardContent } from "@/components/ui/card"; import type { Check } from "@/api/hooks"; +import { statusStyle } from "@/lib/status-style"; interface CheckSummaryCardsProps { check: Check; @@ -56,10 +57,9 @@ export function CheckSummaryCards({ const { t } = useTranslation("checks"); const summaryStatus = check.status ?? check.lastResult?.status; const isUp = summaryStatus === "up"; - const isDown = - summaryStatus === "down" || - summaryStatus === "error" || - summaryStatus === "timeout"; + // warning/degraded count as up (not down) — route the down decision through + // the shared util so only hard failures show the red "currently down" card. + const isDown = statusStyle(summaryStatus).isDown; return (

diff --git a/web/dash0/src/components/checks/response-time-chart.tsx b/web/dash0/src/components/checks/response-time-chart.tsx index 81cca45e9..89a55b875 100644 --- a/web/dash0/src/components/checks/response-time-chart.tsx +++ b/web/dash0/src/components/checks/response-time-chart.tsx @@ -18,6 +18,7 @@ import { Button } from "@/components/ui/button"; import { Skeleton } from "@/components/ui/skeleton"; import { Switch } from "@/components/ui/switch"; import { PinnedResultBox } from "@/components/checks/pinned-result-box"; +import { statusStyle } from "@/lib/status-style"; type TimeRange = "hour" | "day" | "week" | "month"; @@ -414,17 +415,20 @@ export function ResponseTimeChart({ const COLOR_DOWN = "hsl(0, 72%, 51%)"; const gradientStops = useMemo(() => { + // Non-failing statuses (up, created, running, and the warning/degraded + // "up, but something to report" states) render neutral green — only hard + // failures (down/error/timeout/unknown) tint the line red. + const isNeutralStatus = (status: string) => !statusStyle(status).isDown; const realPoints = chartData.filter((p) => p.durationMs != null); if (realPoints.length < 2) { const color = - realPoints.length === 1 && realPoints[0].status !== "up" && realPoints[0].status !== "created" && realPoints[0].status !== "running" + realPoints.length === 1 && !isNeutralStatus(realPoints[0].status) ? COLOR_DOWN : COLOR_UP; return [{ offset: 0, color }, { offset: 1, color }]; } const n = realPoints.length; const stops: { offset: number; color: string }[] = []; - const isNeutralStatus = (status: string) => status === "up" || status === "created" || status === "running"; const colorFor = (status: string) => isNeutralStatus(status) ? COLOR_UP : COLOR_DOWN; @@ -639,8 +643,8 @@ export function ResponseTimeChart({ // it doesn't trigger a re-render. dotPositions.current[uid] = { cx, cy }; const fill = - payload.status === "down" || - payload.status === "unknown" + payload.status === "unknown" || + statusStyle(payload.status).isDown ? COLOR_DOWN : COLOR_UP; const isSelected = selectedUid === uid; diff --git a/web/dash0/src/components/shared/status-badge.tsx b/web/dash0/src/components/shared/status-badge.tsx index 4c56fa88c..1b8abe428 100644 --- a/web/dash0/src/components/shared/status-badge.tsx +++ b/web/dash0/src/components/shared/status-badge.tsx @@ -1,10 +1,9 @@ import { useTranslation } from "react-i18next"; import { Badge } from "@/components/ui/badge"; - -type Status = "up" | "down" | "error" | "validating" | "created" | string; +import { statusStyle } from "@/lib/status-style"; interface StatusBadgeProps { - status: Status | undefined | null; + status: string | undefined | null; className?: string; } @@ -12,31 +11,18 @@ export function StatusBadge({ status, className }: StatusBadgeProps) { const { t } = useTranslation("checks"); if (!status) return null; - if (status === "up") { - return ( - - {t("status.up", "up")} - - ); - } - if (status === "down" || status === "error") { - return ( - - {t("status.down", status)} - - ); - } - if (status === "validating" || status === "warning") { - return ( - - {t("status.validating", status)} - - ); - } - // created, unknown, or any future value + const style = statusStyle(status); + + // created/unknown keep their raw token as the label (secondary badge); + // every known status reads its localized label from status.*. + const label = + style.badgeVariant === "secondary" + ? status + : t(style.labelKey, style.defaultLabel); + return ( - - {status} + + {label} ); } diff --git a/web/dash0/src/components/shared/status-dashboard.tsx b/web/dash0/src/components/shared/status-dashboard.tsx index 39c77d075..9194e6515 100644 --- a/web/dash0/src/components/shared/status-dashboard.tsx +++ b/web/dash0/src/components/shared/status-dashboard.tsx @@ -13,6 +13,7 @@ import { } from "lucide-react"; import { StatusTimeline } from "./status-timeline"; import { cn } from "@/lib/utils"; +import { statusStyle } from "@/lib/status-style"; interface LastResult { uid: string; @@ -45,17 +46,12 @@ async function fetchChecks(org: string): Promise { function getCheckStatus(check: Check): "ok" | "warning" | "error" | "unknown" { if (!check.lastResult) return "unknown"; - switch (check.lastResult.status) { - case "up": - return "ok"; - case "down": - case "error": - return "error"; - case "timeout": - return "warning"; - default: - return "unknown"; - } + const raw = check.lastResult.status; + if (raw === "up") return "ok"; + if (raw === "warning" || raw === "degraded") return "warning"; + // Hard failures (down/error/timeout) go to the error bucket via the shared util. + if (statusStyle(raw).isDown) return "error"; + return "unknown"; } function StatusIcon({ diff --git a/web/dash0/src/components/shared/status-timeline.tsx b/web/dash0/src/components/shared/status-timeline.tsx index 1425fcdd9..ed4ac0f6f 100644 --- a/web/dash0/src/components/shared/status-timeline.tsx +++ b/web/dash0/src/components/shared/status-timeline.tsx @@ -6,6 +6,7 @@ import { TooltipTrigger, } from "@/components/ui/tooltip"; import { cn } from "@/lib/utils"; +import { statusStyle } from "@/lib/status-style"; interface Result { uid: string; @@ -40,23 +41,9 @@ function StatusBar({ timestamp: string; latency?: number; }) { - const bgClass = - status === "ok" || status === "up" - ? "bg-green-500" - : status === "warning" - ? "bg-yellow-500" - : status === "error" || status === "down" - ? "bg-red-500" - : "bg-gray-300"; - - const dotClass = - status === "ok" || status === "up" - ? "bg-green-400" - : status === "warning" - ? "bg-yellow-400" - : status === "error" || status === "down" - ? "bg-red-400" - : "bg-gray-400"; + const style = statusStyle(status); + const bgClass = style.color; + const dotClass = style.dotColor; const date = new Date(timestamp); const timeStr = date.toLocaleTimeString([], { diff --git a/web/dash0/src/lib/status-style.ts b/web/dash0/src/lib/status-style.ts new file mode 100644 index 000000000..d9af684ac --- /dev/null +++ b/web/dash0/src/lib/status-style.ts @@ -0,0 +1,106 @@ +// Single source of truth for how a check / result status is rendered in the +// dash0 operator UI. Every status surface (badges, dashboards, timelines, +// summary cards, charts) routes through statusStyle() so the warning/degraded +// amber treatment — and every other status colour — stays consistent. +// +// Two distinct amber states are handled here: +// - "warning" — the live current status ("up, but something to report"). +// - "degraded" — the aggregated rollup status (a window had warning(s) but +// no dominating failure). +// Both render amber; they differ only in label ("Warning" vs "Degraded"). + +export type BadgeVariant = + | "success" + | "warning" + | "destructive" + | "secondary"; + +export interface StatusStyle { + // Tailwind background class for solid swatches (timeline bars, status dots). + color: string; + // Lighter background class for hover dots / secondary indicators. + dotColor: string; + // Recharts / inline SVG fill colour (hex/hsl), neutral when not down. + chartColor: string; + // Badge variant from components/ui/badge.tsx. + badgeVariant: BadgeVariant; + // i18n key under the "checks" namespace status.* (e.g. status.warning). + labelKey: string; + // English fallback label. + defaultLabel: string; + // True when this status should read as a hard failure (down/error/timeout). + isDown: boolean; +} + +const NEUTRAL_CHART = "transparent"; +const DOWN_CHART = "#ef4444"; // red-500 +const WARNING_CHART = "#facc15"; // yellow-400 + +export function statusStyle(status: string | undefined | null): StatusStyle { + switch (status) { + case "up": + case "ok": + return { + color: "bg-green-500", + dotColor: "bg-green-400", + chartColor: NEUTRAL_CHART, + badgeVariant: "success", + labelKey: "status.up", + defaultLabel: "Up", + isDown: false, + }; + case "warning": + return { + color: "bg-yellow-500", + dotColor: "bg-yellow-400", + chartColor: WARNING_CHART, + badgeVariant: "warning", + labelKey: "status.warning", + defaultLabel: "Warning", + isDown: false, + }; + case "degraded": + return { + color: "bg-yellow-500", + dotColor: "bg-yellow-400", + chartColor: WARNING_CHART, + badgeVariant: "warning", + labelKey: "status.degraded", + defaultLabel: "Degraded", + isDown: false, + }; + case "validating": + return { + color: "bg-yellow-500", + dotColor: "bg-yellow-400", + chartColor: WARNING_CHART, + badgeVariant: "warning", + labelKey: "status.validating", + defaultLabel: "Validating", + isDown: false, + }; + case "down": + case "error": + case "timeout": + return { + color: "bg-red-500", + dotColor: "bg-red-400", + chartColor: DOWN_CHART, + badgeVariant: "destructive", + labelKey: "status.down", + defaultLabel: "Down", + isDown: true, + }; + default: + // created, unknown, or any future value. + return { + color: "bg-gray-300", + dotColor: "bg-gray-400", + chartColor: NEUTRAL_CHART, + badgeVariant: "secondary", + labelKey: "status.unknown", + defaultLabel: status ?? "Unknown", + isDown: false, + }; + } +} diff --git a/web/dash0/src/locales/de/checks.json b/web/dash0/src/locales/de/checks.json index a37176df9..bd28c7b5a 100644 --- a/web/dash0/src/locales/de/checks.json +++ b/web/dash0/src/locales/de/checks.json @@ -15,7 +15,12 @@ "internal": "Intern", "ungroupedChecks": "Nicht gruppierte Prüfungen", "status": { - "validating": "Wird geprüft" + "validating": "Wird geprüft", + "up": "Aktiv", + "down": "Ausfall", + "warning": "Warnung", + "degraded": "Beeinträchtigt", + "unknown": "Unbekannt" }, "table": { "name": "Name", diff --git a/web/dash0/src/locales/en/checks.json b/web/dash0/src/locales/en/checks.json index e73777de7..6e5f9bdd5 100644 --- a/web/dash0/src/locales/en/checks.json +++ b/web/dash0/src/locales/en/checks.json @@ -15,7 +15,12 @@ "internal": "Internal", "ungroupedChecks": "Ungrouped Checks", "status": { - "validating": "Validating" + "validating": "Validating", + "up": "Up", + "down": "Down", + "warning": "Warning", + "degraded": "Degraded", + "unknown": "Unknown" }, "table": { "name": "Name", diff --git a/web/dash0/src/locales/es/checks.json b/web/dash0/src/locales/es/checks.json index 0880ef11a..37a23ed3c 100644 --- a/web/dash0/src/locales/es/checks.json +++ b/web/dash0/src/locales/es/checks.json @@ -15,7 +15,12 @@ "internal": "Interna", "ungroupedChecks": "Comprobaciones sin grupo", "status": { - "validating": "Validando" + "validating": "Validando", + "up": "Activo", + "down": "Caído", + "warning": "Advertencia", + "degraded": "Degradado", + "unknown": "Desconocido" }, "table": { "name": "Nombre", diff --git a/web/dash0/src/locales/fr/checks.json b/web/dash0/src/locales/fr/checks.json index 04048a834..15a001c2e 100644 --- a/web/dash0/src/locales/fr/checks.json +++ b/web/dash0/src/locales/fr/checks.json @@ -15,7 +15,12 @@ "internal": "Interne", "ungroupedChecks": "Contrôles non groupés", "status": { - "validating": "En validation" + "validating": "En validation", + "up": "Opérationnel", + "down": "En panne", + "warning": "Avertissement", + "degraded": "Dégradé", + "unknown": "Inconnu" }, "table": { "name": "Nom", diff --git a/web/dash0/src/routes/orgs/$org/design-reference.tsx b/web/dash0/src/routes/orgs/$org/design-reference.tsx index 3b55e169b..956f32a13 100644 --- a/web/dash0/src/routes/orgs/$org/design-reference.tsx +++ b/web/dash0/src/routes/orgs/$org/design-reference.tsx @@ -1066,12 +1066,21 @@ function NameSlugExample() { ); } -type MockRow = { id: string; name: string; status: "up" | "down" | "warning"; latency: string }; +type MockRow = { + id: string; + name: string; + status: "up" | "down" | "warning" | "degraded"; + latency: string; +}; const MOCK_ROWS: MockRow[] = [ { id: "1", name: "api.example.com", status: "up", latency: "120 ms" }, { id: "2", name: "checkout-prod", status: "up", latency: "85 ms" }, + // "warning" is the live amber status ("up, but something to report"); + // "degraded" is its aggregated rollup counterpart — both render amber and + // route through the shared statusStyle() util. { id: "3", name: "billing-staging", status: "warning", latency: "950 ms" }, + { id: "6", name: "cdn-edge (24h)", status: "degraded", latency: "210 ms" }, { id: "4", name: "auth.example.com", status: "down", latency: "—" }, { id: "5", name: "static.example.com", status: "up", latency: "42 ms" }, ]; diff --git a/web/status0/src/components/shared/availability-bar.tsx b/web/status0/src/components/shared/availability-bar.tsx index b1c424c1a..5ed9f4669 100644 --- a/web/status0/src/components/shared/availability-bar.tsx +++ b/web/status0/src/components/shared/availability-bar.tsx @@ -5,18 +5,13 @@ import { TooltipTrigger, } from "@/components/ui/tooltip"; import type { DailyAvailabilityPoint } from "@/api/hooks"; +import { statusStyle } from "@/lib/status-style"; function getBarColor(status: string) { - switch (status) { - case "up": - return "bg-green-500"; - case "degraded": - return "bg-yellow-500"; - case "down": - return "bg-red-500"; - default: - return "bg-gray-300"; - } + // noData keeps its distinct light-gray bar; every other status (including + // the amber warning/degraded pair) routes through the shared util. + if (status === "noData" || status === "unknown") return "bg-gray-300"; + return statusStyle(status).color; } interface AvailabilityBarProps { diff --git a/web/status0/src/components/shared/response-time-chart.tsx b/web/status0/src/components/shared/response-time-chart.tsx index 52546e3b6..fed8aad74 100644 --- a/web/status0/src/components/shared/response-time-chart.tsx +++ b/web/status0/src/components/shared/response-time-chart.tsx @@ -38,6 +38,10 @@ function statusColor(status?: string) { return "#facc15"; case "error": return "#f97316"; + case "warning": + case "degraded": + // "up, but something to report" / aggregated rollup — amber, neutral. + return "#facc15"; default: return "transparent"; } diff --git a/web/status0/src/components/shared/status-page-view.tsx b/web/status0/src/components/shared/status-page-view.tsx index c4329cb7e..e0186b43d 100644 --- a/web/status0/src/components/shared/status-page-view.tsx +++ b/web/status0/src/components/shared/status-page-view.tsx @@ -18,53 +18,18 @@ import { ResponseTimeChart } from "./response-time-chart"; import { LanguageSwitcher } from "./language-switcher"; import { StatusUpdatesTimeline } from "./status-updates-timeline"; import { SubscribeWidget } from "./subscribe-widget"; +import { statusStyle } from "@/lib/status-style"; function getStatusColor(status: string) { - switch (status) { - case "ok": - case "up": - return "bg-green-500"; - case "error": - case "down": - return "bg-red-500"; - case "warning": - case "degraded": - return "bg-yellow-500"; - default: - return "bg-gray-400"; - } + return statusStyle(status).color; } function getStatusBadgeVariant(status: string) { - switch (status) { - case "ok": - case "up": - return "success" as const; - case "error": - case "down": - return "destructive" as const; - case "warning": - case "degraded": - return "warning" as const; - default: - return "secondary" as const; - } + return statusStyle(status).badgeVariant; } function getStatusLabelKey(status: string) { - switch (status) { - case "ok": - case "up": - return "operational"; - case "error": - case "down": - return "outage"; - case "warning": - case "degraded": - return "degraded"; - default: - return "unknown"; - } + return statusStyle(status).labelKey; } function getOverallStatus(sections: StatusPageSection[]): string { diff --git a/web/status0/src/lib/status-style.ts b/web/status0/src/lib/status-style.ts new file mode 100644 index 000000000..393be1c7c --- /dev/null +++ b/web/status0/src/lib/status-style.ts @@ -0,0 +1,81 @@ +// Single source of truth for how a check / availability status is rendered on +// the public status page (status0). Every status surface — the status hero, +// resource dots and badges, the availability bars, and the response-time +// chart — routes through statusStyle() so the warning/degraded amber +// treatment stays consistent. +// +// Two distinct amber states: +// - "warning" — the live current status ("up, but something to report"). +// - "degraded" — the aggregated rollup status (a window had warning(s) but +// no dominating failure). +// Both render amber; they differ only in their label. + +export type BadgeVariant = + | "success" + | "warning" + | "destructive" + | "secondary"; + +export interface StatusStyle { + // Tailwind background class for solid swatches (dots, availability bars). + color: string; + // recharts / inline SVG fill colour (hex), neutral when not down. + chartColor: string; + // Badge variant from components/ui/badge.tsx. + badgeVariant: BadgeVariant; + // i18n label key (top-level status.json key, e.g. "degraded"). + labelKey: string; + // True when this status reads as a hard failure (down / error). + isDown: boolean; +} + +const NEUTRAL_CHART = "transparent"; +const DOWN_CHART = "#ef4444"; // red-500 +const WARNING_CHART = "#facc15"; // yellow-400 + +export function statusStyle(status: string | undefined | null): StatusStyle { + switch (status) { + case "ok": + case "up": + return { + color: "bg-green-500", + chartColor: NEUTRAL_CHART, + badgeVariant: "success", + labelKey: "operational", + isDown: false, + }; + case "warning": + return { + color: "bg-yellow-500", + chartColor: WARNING_CHART, + badgeVariant: "warning", + labelKey: "warning", + isDown: false, + }; + case "degraded": + return { + color: "bg-yellow-500", + chartColor: WARNING_CHART, + badgeVariant: "warning", + labelKey: "degraded", + isDown: false, + }; + case "error": + case "down": + return { + color: "bg-red-500", + chartColor: DOWN_CHART, + badgeVariant: "destructive", + labelKey: "outage", + isDown: true, + }; + default: + return { + color: "bg-gray-400", + chartColor: NEUTRAL_CHART, + badgeVariant: "secondary", + labelKey: "unknown", + isDown: false, + }; + } +} diff --git a/web/status0/src/locales/de/status.json b/web/status0/src/locales/de/status.json index 36e9acfd0..d563bbcac 100644 --- a/web/status0/src/locales/de/status.json +++ b/web/status0/src/locales/de/status.json @@ -2,6 +2,7 @@ "operational": "Betriebsbereit", "outage": "Ausfall", "degraded": "Beeinträchtigt", + "warning": "Warnung", "unknown": "Unbekannt", "allSystemsOperational": "Alle Systeme betriebsbereit", "someSystemsDegraded": "Einige Systeme beeinträchtigt", diff --git a/web/status0/src/locales/en/status.json b/web/status0/src/locales/en/status.json index f044d4927..b00c6f58d 100644 --- a/web/status0/src/locales/en/status.json +++ b/web/status0/src/locales/en/status.json @@ -2,6 +2,7 @@ "operational": "Operational", "outage": "Outage", "degraded": "Degraded", + "warning": "Warning", "unknown": "Unknown", "allSystemsOperational": "All Systems Operational", "someSystemsDegraded": "Some Systems Degraded", diff --git a/web/status0/src/locales/es/status.json b/web/status0/src/locales/es/status.json index 8c81467e4..41c52b251 100644 --- a/web/status0/src/locales/es/status.json +++ b/web/status0/src/locales/es/status.json @@ -2,6 +2,7 @@ "operational": "Operativo", "outage": "Caída", "degraded": "Degradado", + "warning": "Advertencia", "unknown": "Desconocido", "allSystemsOperational": "Todos los sistemas operativos", "someSystemsDegraded": "Algunos sistemas degradados", diff --git a/web/status0/src/locales/fr/status.json b/web/status0/src/locales/fr/status.json index 7e6220df4..7068ae3e1 100644 --- a/web/status0/src/locales/fr/status.json +++ b/web/status0/src/locales/fr/status.json @@ -2,6 +2,7 @@ "operational": "Opérationnel", "outage": "Panne", "degraded": "Dégradé", + "warning": "Avertissement", "unknown": "Inconnu", "allSystemsOperational": "Tous les systèmes sont opérationnels", "someSystemsDegraded": "Certains systèmes sont dégradés", From b324876394a769ed09c2b1ce5baa118f0f7ac29f Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 03:17:15 +0200 Subject: [PATCH 27/67] feat: add tests for warning/degraded enums, aggregation promotion, severity, incident-neutral, persistence --- .../checkers/checkerdef/status_test.go | 60 +++++++ server/internal/db/models/status_test.go | 76 +++++++++ server/internal/db/service_test.go | 41 +++++ .../handlers/incidents/warning_test.go | 106 ++++++++++++ .../jobtypes/job_aggregation_warning_test.go | 152 ++++++++++++++++++ 5 files changed, 435 insertions(+) create mode 100644 server/internal/checkers/checkerdef/status_test.go create mode 100644 server/internal/db/models/status_test.go create mode 100644 server/internal/handlers/incidents/warning_test.go create mode 100644 server/internal/jobs/jobtypes/job_aggregation_warning_test.go diff --git a/server/internal/checkers/checkerdef/status_test.go b/server/internal/checkers/checkerdef/status_test.go new file mode 100644 index 000000000..e2edc81f3 --- /dev/null +++ b/server/internal/checkers/checkerdef/status_test.go @@ -0,0 +1,60 @@ +package checkerdef_test + +import ( + "testing" + + "github.com/stretchr/testify/require" + + "github.com/fclairamb/solidping/server/internal/checkers/checkerdef" +) + +// TestStatusString pins the wire strings, including the new "warning". +func TestStatusString(t *testing.T) { + t.Parallel() + + tests := []struct { + status checkerdef.Status + want string + }{ + {checkerdef.StatusRunning, "running"}, + {checkerdef.StatusUp, "up"}, + {checkerdef.StatusDown, "down"}, + {checkerdef.StatusTimeout, "timeout"}, + {checkerdef.StatusError, "error"}, + {checkerdef.StatusWarning, "warning"}, + {checkerdef.Status(99), "unknown"}, + } + + for _, tc := range tests { + t.Run(tc.want, func(t *testing.T) { + t.Parallel() + require.Equal(t, tc.want, tc.status.String()) + }) + } +} + +// TestStatusSeverity pins the gravity ordering the aggregation job relies on: +// failures > Degraded > Up, with Warning ranked at Up level. +func TestStatusSeverity(t *testing.T) { + t.Parallel() + r := require.New(t) + + r.Greater(checkerdef.StatusDown.Severity(), checkerdef.StatusDegraded.Severity()) + r.Greater(checkerdef.StatusTimeout.Severity(), checkerdef.StatusDegraded.Severity()) + r.Greater(checkerdef.StatusError.Severity(), checkerdef.StatusDegraded.Severity()) + r.Greater(checkerdef.StatusDegraded.Severity(), checkerdef.StatusUp.Severity()) + r.Equal(checkerdef.StatusUp.Severity(), checkerdef.StatusWarning.Severity()) + + // All hard failures share the top rank. + r.Equal(checkerdef.StatusDown.Severity(), checkerdef.StatusTimeout.Severity()) + r.Equal(checkerdef.StatusDown.Severity(), checkerdef.StatusError.Severity()) +} + +// TestStatusEnumValues pins the numeric values two downstream specs depend on. +func TestStatusEnumValues(t *testing.T) { + t.Parallel() + r := require.New(t) + + r.Equal(checkerdef.Status(7), checkerdef.StatusDegraded) + r.Equal(checkerdef.Status(8), checkerdef.StatusWarning) +} diff --git a/server/internal/db/models/status_test.go b/server/internal/db/models/status_test.go new file mode 100644 index 000000000..fcfaad056 --- /dev/null +++ b/server/internal/db/models/status_test.go @@ -0,0 +1,76 @@ +package models_test + +import ( + "testing" + + "github.com/stretchr/testify/require" + + "github.com/fclairamb/solidping/server/internal/db/models" +) + +// TestStatusToString pins the UPPERCASE result-status serialisation, including +// the new WARNING (raw) and DEGRADED (aggregated) values. +func TestStatusToString(t *testing.T) { + t.Parallel() + + tests := []struct { + status models.ResultStatus + want string + }{ + {models.ResultStatusCreated, "CREATED"}, + {models.ResultStatusRunning, "RUNNING"}, + {models.ResultStatusUp, "UP"}, + {models.ResultStatusDown, "DOWN"}, + {models.ResultStatusTimeout, "TIMEOUT"}, + {models.ResultStatusError, "ERROR"}, + {models.ResultStatusDegraded, "DEGRADED"}, + {models.ResultStatusWarning, "WARNING"}, + } + + for _, tc := range tests { + t.Run(tc.want, func(t *testing.T) { + t.Parallel() + require.Equal(t, tc.want, models.StatusToString(int(tc.status))) + }) + } + + require.Equal(t, "UNKNOWN", models.StatusToString(99)) +} + +// TestCheckStatusString pins the lowercase current-status wire names, including +// the new "warning" (live) and the retained "degraded" (summary). +func TestCheckStatusString(t *testing.T) { + t.Parallel() + + tests := []struct { + status models.CheckStatus + want string + }{ + {models.CheckStatusCreated, "created"}, + {models.CheckStatusUp, "up"}, + {models.CheckStatusDown, "down"}, + {models.CheckStatusValidating, "validating"}, + {models.CheckStatusDegraded, "degraded"}, + {models.CheckStatusWarning, "warning"}, + {models.CheckStatus(99), "unknown"}, + } + + for _, tc := range tests { + t.Run(tc.want, func(t *testing.T) { + t.Parallel() + require.Equal(t, tc.want, tc.status.String()) + }) + } +} + +// TestStatusEnumValues pins the numeric values shared with checkerdef and the +// DB constraint (two downstream specs depend on Warning=8). +func TestStatusEnumValues(t *testing.T) { + t.Parallel() + r := require.New(t) + + r.Equal(models.ResultStatus(7), models.ResultStatusDegraded) + r.Equal(models.ResultStatus(8), models.ResultStatusWarning) + r.Equal(models.CheckStatus(7), models.CheckStatusDegraded) + r.Equal(models.CheckStatus(8), models.CheckStatusWarning) +} diff --git a/server/internal/db/service_test.go b/server/internal/db/service_test.go index 29289b01f..c6356adf2 100644 --- a/server/internal/db/service_test.go +++ b/server/internal/db/service_test.go @@ -49,6 +49,10 @@ func testService(t *testing.T, svc db.Service) { testResultsWithCheckAndOrg(ctx, t, svc) }) + t.Run("ResultStatusConstraint6_7_8", func(t *testing.T) { + testResultStatusConstraint(ctx, t, svc) + }) + t.Run("JSONMapHandling", func(t *testing.T) { testJSONMapHandling(ctx, t, svc) }) @@ -959,6 +963,43 @@ func testResultsWithCheckAndOrg(ctx context.Context, t *testing.T, svc db.Servic }) } +// testResultStatusConstraint is the cross-engine regression guard for the +// widened results.status CHECK constraint (status in 0..8). It pins that the +// new live Error(6) and Warning(8) raw rows and the aggregated Degraded(7) row +// all persist and round-trip on both Postgres and SQLite — the 6 case is a +// regression for the previously-too-narrow constraint (0..5). +func testResultStatusConstraint(ctx context.Context, t *testing.T, svc db.Service) { + t.Helper() + + org := models.NewOrganization("status-constraint-org", "") + require.NoError(t, svc.CreateOrganization(ctx, org)) + + check := models.NewCheck(org.UID, "status-constraint-check", "http") + require.NoError(t, svc.CreateCheck(ctx, check)) + + tests := []struct { + name string + status models.ResultStatus + }{ + {"Error6", models.ResultStatusError}, + {"Degraded7", models.ResultStatusDegraded}, + {"Warning8", models.ResultStatusWarning}, + } + + for _, tc := range tests { + t.Run(tc.name, func(t *testing.T) { + result := models.NewResult(org.UID, check.UID, tc.status, 0.1) + require.NoError(t, svc.CreateResult(ctx, result), + "status %d must satisfy the widened results.status CHECK", int(tc.status)) + + retrieved, err := svc.GetResult(ctx, result.UID) + require.NoError(t, err) + require.NotNil(t, retrieved.Status) + require.Equal(t, int(tc.status), *retrieved.Status) + }) + } +} + func testJSONMapHandling(ctx context.Context, t *testing.T, svc db.Service) { t.Helper() diff --git a/server/internal/handlers/incidents/warning_test.go b/server/internal/handlers/incidents/warning_test.go new file mode 100644 index 000000000..da23d9567 --- /dev/null +++ b/server/internal/handlers/incidents/warning_test.go @@ -0,0 +1,106 @@ +package incidents_test + +import ( + "testing" + "time" + + "github.com/stretchr/testify/require" + + "github.com/fclairamb/solidping/server/internal/db/models" +) + +// TestProcessCheckResultWarningIsIncidentNeutral pins the headline behaviour +// of the live Warning status (Decision B): a raw Warning with no open incident +// updates the visible status to Warning but never opens an incident and never +// arms the confirmation clock — it is display-only, modelled on Validating. +func TestProcessCheckResultWarningIsIncidentNeutral(t *testing.T) { + t.Parallel() + r := require.New(t) + s := newValidatingSetup(t, 0) // confirmation=0 would open immediately for a failure + + s.submit(t, models.ResultStatusWarning) + + c := s.reload(t) + r.Equal(models.CheckStatusWarning, c.Status, + "a raw warning must set the visible status to warning") + r.Nil(c.FirstFailureAt, + "warning is clock-neutral: first_failure_at must not be armed") + r.False(s.hasActiveIncident(t), + "warning must never open an incident, even with confirmation=0") +} + +// TestProcessCheckResultWarningDuringOutageDoesNotResolve verifies that a +// Warning arriving while an incident is open neither resolves the incident nor +// clears the recovery path: the incident stays active, and the visible status +// reflects the latest signal (Warning). +func TestProcessCheckResultWarningDuringOutageDoesNotResolve(t *testing.T) { + t.Parallel() + r := require.New(t) + s := newValidatingSetup(t, 0) // open immediately on first failure + + s.submit(t, models.ResultStatusDown) + r.Equal(models.CheckStatusDown, s.reload(t).Status) + r.True(s.hasActiveIncident(t), "first failure opens the incident") + + s.submit(t, models.ResultStatusWarning) + c := s.reload(t) + r.Equal(models.CheckStatusWarning, c.Status, + "warning reflects the latest live signal even during an open incident") + r.True(s.hasActiveIncident(t), + "warning must not resolve an open incident") +} + +// TestProcessCheckResultWarningThenUpClears confirms a later Up clears the +// neutral warning state and the streak behaves across up<->warning edges. +func TestProcessCheckResultWarningThenUpClears(t *testing.T) { + t.Parallel() + r := require.New(t) + s := newValidatingSetup(t, 60) + + // Two consecutive warnings: streak grows, status stays warning. + s.submit(t, models.ResultStatusWarning) + first := s.reload(t) + r.Equal(models.CheckStatusWarning, first.Status) + r.Equal(1, first.StatusStreak, "first warning resets streak to 1") + + s.submit(t, models.ResultStatusWarning) + second := s.reload(t) + r.Equal(models.CheckStatusWarning, second.Status) + r.Equal(2, second.StatusStreak, "consecutive warnings grow the streak") + + // Up clears it: status flips, streak resets, no incident anywhere. + s.submit(t, models.ResultStatusUp) + c := s.reload(t) + r.Equal(models.CheckStatusUp, c.Status, "a later up clears the warning state") + r.Equal(1, c.StatusStreak, "up<->warning edge resets the streak") + r.False(s.hasActiveIncident(t), + "a warning->up sequence must never have opened an incident") +} + +// TestProcessCheckResultWarningStatusChangedAtBumpsOnEdge verifies the +// up<->warning edge bumps status_changed_at (warning is not a failure +// sub-state like validating<->down). The check starts Up, so the up->warning +// transition is the first real status change and must set status_changed_at. +func TestProcessCheckResultWarningStatusChangedAtBumpsOnEdge(t *testing.T) { + t.Parallel() + r := require.New(t) + s := newValidatingSetup(t, 60) // check is created with status Up + + before := time.Now() + s.submit(t, models.ResultStatusWarning) + + c := s.reload(t) + r.Equal(models.CheckStatusWarning, c.Status) + r.NotNil(c.StatusChangedAt, + "the up->warning edge must set status_changed_at") + r.False(c.StatusChangedAt.Before(before), + "status_changed_at must be stamped at (or after) the transition time") + + // A subsequent warning does NOT bump it (continuing same state). + changedAt := *c.StatusChangedAt + s.submit(t, models.ResultStatusWarning) + c2 := s.reload(t) + r.NotNil(c2.StatusChangedAt) + r.True(c2.StatusChangedAt.Equal(changedAt), + "a continuing warning must not re-bump status_changed_at") +} diff --git a/server/internal/jobs/jobtypes/job_aggregation_warning_test.go b/server/internal/jobs/jobtypes/job_aggregation_warning_test.go new file mode 100644 index 000000000..e9027ff2e --- /dev/null +++ b/server/internal/jobs/jobtypes/job_aggregation_warning_test.go @@ -0,0 +1,152 @@ +package jobtypes + +import ( + "testing" + "time" + + "github.com/stretchr/testify/require" + + "github.com/fclairamb/solidping/server/internal/checkers/checkerdef" + "github.com/fclairamb/solidping/server/internal/db/models" +) + +// rawResultWithStatus builds a minimal raw result fixture carrying the given +// status and a fixed duration, ordered by the supplied offset. +func rawResultWithStatus(status models.ResultStatus, offset time.Duration, periodStart time.Time) *models.Result { + s := int(status) + d := float32(100.0) + region := testRegion + worker := testWorkerUID + + return &models.Result{ + UID: "r-" + offset.String(), + OrganizationUID: testOrgUID, + CheckUID: testCheckUID, + Region: ®ion, + WorkerUID: &worker, + Status: &s, + Duration: &d, + PeriodStart: periodStart.Add(offset), + Output: models.JSONMap{"msg": "x"}, + } +} + +// TestAggregateAvailabilityUpAndWarningIsHundredPctDegraded pins Decision A + +// the promotion rule b: a window of Up + Warning yields availability_pct == 100 +// (Warning counts as up) AND the aggregated row status is Degraded (the window +// contained a warning, no dominating failure). +func TestAggregateAvailabilityUpAndWarningIsHundredPctDegraded(t *testing.T) { + t.Parallel() + r := require.New(t) + + periodStart := time.Date(2025, 12, 19, 12, 0, 0, 0, time.UTC) + periodEnd := periodStart.Add(time.Hour) + + results := []*models.Result{ + rawResultWithStatus(models.ResultStatusUp, 1*time.Minute, periodStart), + rawResultWithStatus(models.ResultStatusUp, 2*time.Minute, periodStart), + rawResultWithStatus(models.ResultStatusWarning, 3*time.Minute, periodStart), + } + + agg := aggregateResults(results, models.PeriodTypeHour, periodStart, periodEnd) + + r.NotNil(agg.AvailabilityPct) + r.InDelta(100.0, *agg.AvailabilityPct, 0.001, + "Up + Warning must yield 100%% availability (warning counts as up)") + r.NotNil(agg.SuccessfulChecks) + r.Equal(3, *agg.SuccessfulChecks, "all three count as successful") + r.NotNil(agg.Status) + r.Equal(int(models.ResultStatusDegraded), *agg.Status, + "a non-failing window containing a warning must roll up to Degraded") +} + +// TestAggregateSeverityDownAndWarningRollsUpToDown pins Decision D: a window +// with a dominating Down + a Warning rolls up to Down, never Degraded/Warning. +func TestAggregateSeverityDownAndWarningRollsUpToDown(t *testing.T) { + t.Parallel() + r := require.New(t) + + periodStart := time.Date(2025, 12, 19, 12, 0, 0, 0, time.UTC) + periodEnd := periodStart.Add(time.Hour) + + results := []*models.Result{ + rawResultWithStatus(models.ResultStatusDown, 1*time.Minute, periodStart), + rawResultWithStatus(models.ResultStatusDown, 2*time.Minute, periodStart), + rawResultWithStatus(models.ResultStatusWarning, 3*time.Minute, periodStart), + } + + agg := aggregateResults(results, models.PeriodTypeHour, periodStart, periodEnd) + + r.NotNil(agg.Status) + r.Equal(int(models.ResultStatusDown), *agg.Status, + "a dominating failure must win over a warning") +} + +// TestAggregateSeverityTieDownVsWarningResolvesToDown pins the tie-break: an +// equal-count Down vs Warning window resolves to Down via Severity(), never to +// the higher numeric Warning value. +func TestAggregateSeverityTieDownVsWarningResolvesToDown(t *testing.T) { + t.Parallel() + r := require.New(t) + + periodStart := time.Date(2025, 12, 19, 12, 0, 0, 0, time.UTC) + periodEnd := periodStart.Add(time.Hour) + + // 1 Down, 1 Warning: a numeric tie-break would pick Warning(8) > Down(4); + // Severity() must resolve the tie to the failure. + results := []*models.Result{ + rawResultWithStatus(models.ResultStatusDown, 1*time.Minute, periodStart), + rawResultWithStatus(models.ResultStatusWarning, 2*time.Minute, periodStart), + } + + agg := aggregateResults(results, models.PeriodTypeHour, periodStart, periodEnd) + + r.NotNil(agg.Status) + r.Equal(int(models.ResultStatusDown), *agg.Status, + "a Down/Warning tie must resolve to Down, never to Warning") +} + +// TestCalculateDominantStatusPromotesWarning unit-tests the rollup selector +// directly across the key cases. +func TestCalculateDominantStatusPromotesWarning(t *testing.T) { + t.Parallel() + + up := int(checkerdef.StatusUp) + down := int(checkerdef.StatusDown) + warning := int(checkerdef.StatusWarning) + degraded := int(checkerdef.StatusDegraded) + + tests := []struct { + name string + counts map[int]int + want int + }{ + {"all up", map[int]int{up: 5}, up}, + {"up plus warning promotes to degraded", map[int]int{up: 5, warning: 1}, degraded}, + {"only warning promotes to degraded", map[int]int{warning: 3}, degraded}, + {"dominating down wins", map[int]int{down: 4, warning: 2}, down}, + {"down vs warning tie resolves to down", map[int]int{down: 1, warning: 1}, down}, + {"degraded child carries to degraded", map[int]int{up: 10, degraded: 1}, degraded}, + } + + for _, tc := range tests { + t.Run(tc.name, func(t *testing.T) { + t.Parallel() + require.Equal(t, tc.want, calculateDominantStatus(tc.counts)) + }) + } +} + +// TestStatusSeverityRanking pins the gravity ordering used by the rollup. +func TestStatusSeverityRanking(t *testing.T) { + t.Parallel() + r := require.New(t) + + // Failures outrank Degraded outranks Up; Warning ranks at Up level. + r.Greater(checkerdef.StatusDown.Severity(), checkerdef.StatusDegraded.Severity()) + r.Greater(checkerdef.StatusTimeout.Severity(), checkerdef.StatusDegraded.Severity()) + r.Greater(checkerdef.StatusError.Severity(), checkerdef.StatusDegraded.Severity()) + r.Greater(checkerdef.StatusDegraded.Severity(), checkerdef.StatusUp.Severity()) + r.Equal(checkerdef.StatusUp.Severity(), checkerdef.StatusWarning.Severity(), + "warning ranks at up level (it counts as up for availability)") +} From 3070cc30a0ec6a1151a2904e549d1072a51ef5ae Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 03:27:03 +0200 Subject: [PATCH 28/67] fix: resolve lint findings (exhaustive String case, misspellings, testifylint order) and test org slug length --- .../internal/checkers/checkerdef/status_test.go | 4 ++-- server/internal/checkers/checkerdef/types.go | 17 ++++++++++------- server/internal/db/models/status_test.go | 10 +++++----- server/internal/db/service_test.go | 4 ++-- server/internal/handlers/incidents/service.go | 2 +- .../internal/handlers/incidents/warning_test.go | 4 ++-- 6 files changed, 22 insertions(+), 19 deletions(-) diff --git a/server/internal/checkers/checkerdef/status_test.go b/server/internal/checkers/checkerdef/status_test.go index e2edc81f3..5259d6726 100644 --- a/server/internal/checkers/checkerdef/status_test.go +++ b/server/internal/checkers/checkerdef/status_test.go @@ -55,6 +55,6 @@ func TestStatusEnumValues(t *testing.T) { t.Parallel() r := require.New(t) - r.Equal(checkerdef.Status(7), checkerdef.StatusDegraded) - r.Equal(checkerdef.Status(8), checkerdef.StatusWarning) + r.Equal(checkerdef.StatusDegraded, checkerdef.Status(7)) + r.Equal(checkerdef.StatusWarning, checkerdef.Status(8)) } diff --git a/server/internal/checkers/checkerdef/types.go b/server/internal/checkers/checkerdef/types.go index 077efe5bc..5a31a6e93 100644 --- a/server/internal/checkers/checkerdef/types.go +++ b/server/internal/checkers/checkerdef/types.go @@ -30,13 +30,14 @@ const ( // Status string labels. const ( - statusStrRunning = "running" - statusStrUp = "up" - statusStrDown = "down" - statusStrTimeout = "timeout" - statusStrError = "error" - statusStrWarning = "warning" - statusStrUnknown = "unknown" + statusStrRunning = "running" + statusStrUp = "up" + statusStrDown = "down" + statusStrTimeout = "timeout" + statusStrError = "error" + statusStrWarning = "warning" + statusStrDegraded = "degraded" + statusStrUnknown = "unknown" ) // String returns the string representation of the status. @@ -54,6 +55,8 @@ func (s Status) String() string { return statusStrError case StatusWarning: return statusStrWarning + case StatusDegraded: + return statusStrDegraded default: return statusStrUnknown } diff --git a/server/internal/db/models/status_test.go b/server/internal/db/models/status_test.go index fcfaad056..038cc31f8 100644 --- a/server/internal/db/models/status_test.go +++ b/server/internal/db/models/status_test.go @@ -8,7 +8,7 @@ import ( "github.com/fclairamb/solidping/server/internal/db/models" ) -// TestStatusToString pins the UPPERCASE result-status serialisation, including +// TestStatusToString pins the UPPERCASE result-status serialization, including // the new WARNING (raw) and DEGRADED (aggregated) values. func TestStatusToString(t *testing.T) { t.Parallel() @@ -69,8 +69,8 @@ func TestStatusEnumValues(t *testing.T) { t.Parallel() r := require.New(t) - r.Equal(models.ResultStatus(7), models.ResultStatusDegraded) - r.Equal(models.ResultStatus(8), models.ResultStatusWarning) - r.Equal(models.CheckStatus(7), models.CheckStatusDegraded) - r.Equal(models.CheckStatus(8), models.CheckStatusWarning) + r.Equal(models.ResultStatusDegraded, models.ResultStatus(7)) + r.Equal(models.ResultStatusWarning, models.ResultStatus(8)) + r.Equal(models.CheckStatusDegraded, models.CheckStatus(7)) + r.Equal(models.CheckStatusWarning, models.CheckStatus(8)) } diff --git a/server/internal/db/service_test.go b/server/internal/db/service_test.go index c6356adf2..db33bedb6 100644 --- a/server/internal/db/service_test.go +++ b/server/internal/db/service_test.go @@ -971,10 +971,10 @@ func testResultsWithCheckAndOrg(ctx context.Context, t *testing.T, svc db.Servic func testResultStatusConstraint(ctx context.Context, t *testing.T, svc db.Service) { t.Helper() - org := models.NewOrganization("status-constraint-org", "") + org := models.NewOrganization("status-cstr-org", "") require.NoError(t, svc.CreateOrganization(ctx, org)) - check := models.NewCheck(org.UID, "status-constraint-check", "http") + check := models.NewCheck(org.UID, "status-cstr-check", "http") require.NoError(t, svc.CreateCheck(ctx, check)) tests := []struct { diff --git a/server/internal/handlers/incidents/service.go b/server/internal/handlers/incidents/service.go index b9bea9168..20901d91f 100644 --- a/server/internal/handlers/incidents/service.go +++ b/server/internal/handlers/incidents/service.go @@ -165,7 +165,7 @@ func (s *Service) ProcessCheckResult(ctx context.Context, check *models.Check, r resultStatus == models.ResultStatusTimeout || resultStatus == models.ResultStatusError // Warning is "up, but something to report": display-only and incident- - // neutral (modelled on CheckStatusValidating). It updates the visible + // neutral (modeled on CheckStatusValidating). It updates the visible // status and the up<->warning streak edges, but never arms the incident // clocks and never opens/resolves an incident. isWarning := resultStatus == models.ResultStatusWarning diff --git a/server/internal/handlers/incidents/warning_test.go b/server/internal/handlers/incidents/warning_test.go index da23d9567..ff28d3f71 100644 --- a/server/internal/handlers/incidents/warning_test.go +++ b/server/internal/handlers/incidents/warning_test.go @@ -9,10 +9,10 @@ import ( "github.com/fclairamb/solidping/server/internal/db/models" ) -// TestProcessCheckResultWarningIsIncidentNeutral pins the headline behaviour +// TestProcessCheckResultWarningIsIncidentNeutral pins the headline behavior // of the live Warning status (Decision B): a raw Warning with no open incident // updates the visible status to Warning but never opens an incident and never -// arms the confirmation clock — it is display-only, modelled on Validating. +// arms the confirmation clock — it is display-only, modeled on Validating. func TestProcessCheckResultWarningIsIncidentNeutral(t *testing.T) { t.Parallel() r := require.New(t) From 0b348af1417e3a7be26a72724a8bf6538115c459 Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 03:27:56 +0200 Subject: [PATCH 29/67] chore: all checks passing for status warning degraded From ed2fcc90b5eeac48576ac58b268d9d979b1811f5 Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 03:31:11 +0200 Subject: [PATCH 30/67] docs: archive completed spec status warning degraded --- .../2026/06}/2026-06-20-04-status-warning-degraded.md | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename specs/{todos => done/2026/06}/2026-06-20-04-status-warning-degraded.md (100%) diff --git a/specs/todos/2026-06-20-04-status-warning-degraded.md b/specs/done/2026/06/2026-06-20-04-status-warning-degraded.md similarity index 100% rename from specs/todos/2026-06-20-04-status-warning-degraded.md rename to specs/done/2026/06/2026-06-20-04-status-warning-degraded.md From f6daf9e78e813846dea33796e51519858f6bf52a Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 03:32:06 +0200 Subject: [PATCH 31/67] chore: start implementing ssl graduated expiry and chain reporting From 9583d2e5c893a62dcf1a42fc1980312465cae081 Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 03:33:32 +0200 Subject: [PATCH 32/67] docs: add implementation plan for ssl graduated expiry and chain reporting --- ...sl-graduated-expiry-and-chain-reporting.md | 33 +++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/specs/todos/2026-06-20-01-ssl-graduated-expiry-and-chain-reporting.md b/specs/todos/2026-06-20-01-ssl-graduated-expiry-and-chain-reporting.md index 9987cecc0..08170921d 100644 --- a/specs/todos/2026-06-20-01-ssl-graduated-expiry-and-chain-reporting.md +++ b/specs/todos/2026-06-20-01-ssl-graduated-expiry-and-chain-reporting.md @@ -189,6 +189,39 @@ the tiering rule. Don't duplicate the comparison literal in two checkers. badge + chain table render and no false incident is opened. - `make lint` and `make test` pass; `make test-dash` if the form changes. +## Implementation Plan + +1. **Config (`checkssl/config.go`).** Add `WarningDays` + `CriticalDays`; keep legacy + `ThresholdDays`. In `FromMap`, read `criticalDays`/`warningDays` (camelCase) and keep + reading legacy `thresholdDays`/`threshold_days` via the existing `readIntKey` dual-key + reader. Resolution: if `criticalDays` absent but legacy threshold present → `criticalDays = + thresholdDays`. Defaults applied at exec time: `criticalDays=30`, `warningDays=30` (EQUAL — + decision 1, behaviour unchanged). Validate `warningDays >= criticalDays >= 0` and both `<=` + a sane max (`maxThresholdDays = 3650`). `GetConfig` emits canonical `warningDays` / + `criticalDays`, and continues to emit `thresholdDays` for back-compat dashboards. +2. **Shared helper (`checkerdef`).** Add `gradedExpiryStatus(daysRemaining, warningDays, + criticalDays) (Status, severity string)` + severity string constants + (`SeverityCritical="critical"`, `SeverityWarning="warning"`, `SeverityNone=""`) in a new + `checkerdef/expiry.go`. Tiering: `min<=critical → StatusDown,"critical"`; + `critical 0` and `chainLength`. Call + `gradedExpiryStatus(min, warningDays, criticalDays)`. Output additions: `chain[]` + (`{subject, issuer, notAfter, daysRemaining}`), `soonestExpiring`, `chainLength`, + `chainVerified`, `certExpiryWarning` (when severity=="warning"), `severity`; keep existing + leaf fields. `metrics.days_remaining` = chain minimum. +4. **Frontend (`web/dash0`).** SSL form: add `criticalDays` (rename the existing field) + + `warningDays` (advanced) inputs, alias-reading `thresholdDays` for back-compat on load. + Check-detail (`checks.$checkUid.index.tsx` last-result output): render an SSL chain table + and an amber "expiring in N days" badge when `certExpiryWarning`, reusing the Table + primitive, Badge, and `statusStyle()` from spec 04. +5. **Docs.** Update `docs/conventions/checker-config.md` SSL section + `docs/api-specification.md` + with the new config keys and output shape. +6. **Tests.** Table-driven, in-memory cert chains with controlled `NotAfter` (helper to mint a + chain). Cases per the Verification section. + ## Files referenced - `server/internal/checkers/checkssl/config.go` — two-tier config + legacy alias From 2deaf00ecdcd613a35f8709bd3d652d374c59e5a Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 03:34:10 +0200 Subject: [PATCH 33/67] feat: add shared gradedExpiryStatus helper and severity constants in checkerdef --- server/internal/checkers/checkerdef/expiry.go | 39 ++++++++ .../checkers/checkerdef/expiry_test.go | 88 +++++++++++++++++++ 2 files changed, 127 insertions(+) create mode 100644 server/internal/checkers/checkerdef/expiry.go create mode 100644 server/internal/checkers/checkerdef/expiry_test.go diff --git a/server/internal/checkers/checkerdef/expiry.go b/server/internal/checkers/checkerdef/expiry.go new file mode 100644 index 000000000..24b709322 --- /dev/null +++ b/server/internal/checkers/checkerdef/expiry.go @@ -0,0 +1,39 @@ +package checkerdef + +// Expiry severity labels emitted in check output. They let the dashboard render +// a consistent badge regardless of which checker produced the result. +const ( + // SeverityNone means the target is not near expiry (StatusUp). + SeverityNone = "" + // SeverityWarning means expiry is approaching the warning window + // (StatusWarning — amber, counts as up, no incident). + SeverityWarning = "warning" + // SeverityCritical means expiry is at/inside the critical window + // (StatusDown — pages, as a hard failure). + SeverityCritical = "critical" +) + +// GradedExpiryStatus maps a days-remaining value onto a two-tier expiry policy, +// returning the Status to report and a severity label for output. It is the +// single source of truth for the tiering rule shared by expiry-aware checkers +// (checkssl today; checkdomain in a follow-up) so the comparison literal is not +// duplicated across checkers. +// +// Tiering (callers pass the MINIMUM days-remaining across whatever they +// monitor, e.g. the whole certificate chain): +// - daysRemaining <= criticalDays → StatusDown, SeverityCritical +// - criticalDays < daysRemaining <= warningDays → StatusWarning, SeverityWarning +// - otherwise → StatusUp, SeverityNone +// +// Callers are expected to validate warningDays >= criticalDays >= 0; when that +// holds the warning band is non-empty only when warningDays > criticalDays. +func GradedExpiryStatus(daysRemaining, warningDays, criticalDays int) (Status, string) { + switch { + case daysRemaining <= criticalDays: + return StatusDown, SeverityCritical + case daysRemaining <= warningDays: + return StatusWarning, SeverityWarning + default: + return StatusUp, SeverityNone + } +} diff --git a/server/internal/checkers/checkerdef/expiry_test.go b/server/internal/checkers/checkerdef/expiry_test.go new file mode 100644 index 000000000..9de2ee3e5 --- /dev/null +++ b/server/internal/checkers/checkerdef/expiry_test.go @@ -0,0 +1,88 @@ +package checkerdef + +import ( + "testing" + + "github.com/stretchr/testify/require" +) + +func TestGradedExpiryStatus(t *testing.T) { + t.Parallel() + + tests := []struct { + name string + days int + warning int + critical int + wantStatus Status + wantSeverity string + }{ + { + name: "inside critical → down/critical", + days: 5, + warning: 30, + critical: 7, + wantStatus: StatusDown, + wantSeverity: SeverityCritical, + }, + { + name: "exactly critical → down/critical", + days: 7, + warning: 30, + critical: 7, + wantStatus: StatusDown, + wantSeverity: SeverityCritical, + }, + { + name: "between tiers → warning/warning", + days: 20, + warning: 30, + critical: 7, + wantStatus: StatusWarning, + wantSeverity: SeverityWarning, + }, + { + name: "exactly warning → warning/warning", + days: 30, + warning: 30, + critical: 7, + wantStatus: StatusWarning, + wantSeverity: SeverityWarning, + }, + { + name: "beyond both → up/none", + days: 90, + warning: 30, + critical: 7, + wantStatus: StatusUp, + wantSeverity: SeverityNone, + }, + { + name: "equal tiers (default) → no warning band, down at threshold", + days: 30, + warning: 30, + critical: 30, + wantStatus: StatusDown, + wantSeverity: SeverityCritical, + }, + { + name: "equal tiers (default) → up above threshold", + days: 31, + warning: 30, + critical: 30, + wantStatus: StatusUp, + wantSeverity: SeverityNone, + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + t.Parallel() + + r := require.New(t) + status, severity := GradedExpiryStatus(tt.days, tt.warning, tt.critical) + r.Equal(tt.wantStatus, status) + r.Equal(tt.wantSeverity, severity) + }) + } +} From 2b743a04149ac5e16c0d76ade281198010528d19 Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 03:36:12 +0200 Subject: [PATCH 34/67] feat: two-tier ssl expiry config with legacy alias and whole-chain min expiry --- server/internal/checkers/checkssl/checker.go | 103 ++++++++++++--- server/internal/checkers/checkssl/config.go | 124 ++++++++++++++++++- 2 files changed, 201 insertions(+), 26 deletions(-) diff --git a/server/internal/checkers/checkssl/checker.go b/server/internal/checkers/checkssl/checker.go index 7b3ab3eed..ac705236d 100644 --- a/server/internal/checkers/checkssl/checker.go +++ b/server/internal/checkers/checkssl/checker.go @@ -117,8 +117,14 @@ func durationMs(d time.Duration) float64 { return float64(d.Microseconds()) / microsecondsPerMilli } +func certDaysRemaining(cert *x509.Certificate) int { + return int(time.Until(cert.NotAfter).Hours() / 24) +} + +// buildCertOutput writes the leaf-certificate fields (kept for back-compat) and +// returns the leaf's days-remaining. func buildCertOutput(cert *x509.Certificate, output map[string]any) int { - daysRemaining := int(time.Until(cert.NotAfter).Hours() / 24) + daysRemaining := certDaysRemaining(cert) output["subject"] = cert.Subject.CommonName output["issuer"] = cert.Issuer.CommonName @@ -131,31 +137,75 @@ func buildCertOutput(cert *x509.Certificate, output map[string]any) int { return daysRemaining } +// chainCertReport is one entry in the reported certificate chain. +type chainCertReport struct { + Subject string `json:"subject"` + Issuer string `json:"issuer"` + NotAfter string `json:"notAfter"` + DaysRemaining int `json:"daysRemaining"` +} + +// chainExpiry summarises the whole presented chain: its per-cert report plus the +// soonest-expiring cert (the minimum days-remaining drives the status decision). +type chainExpiry struct { + chain []chainCertReport + minDays int + soonestCert *x509.Certificate +} + +// analyzeChain iterates the presented certificates (leaf + intermediates), +// building the per-cert report and tracking the minimum days-remaining across +// the whole chain — an intermediate that expires before the leaf is a real, +// common failure that leaf-only inspection misses. +func analyzeChain(certs []*x509.Certificate) chainExpiry { + report := make([]chainCertReport, 0, len(certs)) + result := chainExpiry{minDays: certDaysRemaining(certs[0]), soonestCert: certs[0]} + + for _, cert := range certs { + days := certDaysRemaining(cert) + report = append(report, chainCertReport{ + Subject: cert.Subject.CommonName, + Issuer: cert.Issuer.CommonName, + NotAfter: cert.NotAfter.Format(time.RFC3339), + DaysRemaining: days, + }) + + if days < result.minDays { + result.minDays = days + result.soonestCert = cert + } + } + + result.chain = report + + return result +} + type execParams struct { - port int - threshold int - timeout time.Duration - serverName string - host string + port int + warningDays int + criticalDays int + timeout time.Duration + serverName string + host string } func newExecParams(cfg *SSLConfig) execParams { + warning, critical := cfg.effectiveThresholds() + params := execParams{ - port: cfg.Port, - threshold: cfg.ThresholdDays, - timeout: cfg.Timeout, - serverName: cfg.ServerName, - host: cfg.Host, + port: cfg.Port, + warningDays: warning, + criticalDays: critical, + timeout: cfg.Timeout, + serverName: cfg.ServerName, + host: cfg.Host, } if params.port == 0 { params.port = defaultPort } - if params.threshold <= 0 { - params.threshold = defaultThresholdDays - } - if params.timeout == 0 { params.timeout = defaultTimeout } @@ -232,12 +282,25 @@ func (c *SSLChecker) buildResult( } } - daysRemaining := buildCertOutput(result.state.PeerCertificates[0], output) - metrics["days_remaining"] = daysRemaining + // Leaf fields (back-compat). days_remaining metric becomes the chain minimum below. + buildCertOutput(result.state.PeerCertificates[0], output) + + expiry := analyzeChain(result.state.PeerCertificates) + metrics["days_remaining"] = expiry.minDays + + status, severity := checkerdef.GradedExpiryStatus(expiry.minDays, params.warningDays, params.criticalDays) + + output["chain"] = expiry.chain + output["chainLength"] = len(result.state.PeerCertificates) + output["chainVerified"] = len(result.state.VerifiedChains) > 0 + output["soonestExpiring"] = map[string]any{ + "subject": expiry.soonestCert.Subject.CommonName, + "daysRemaining": expiry.minDays, + } + output["severity"] = severity - status := checkerdef.StatusUp - if daysRemaining <= params.threshold { - status = checkerdef.StatusDown + if severity == checkerdef.SeverityWarning { + output["certExpiryWarning"] = true } return &checkerdef.Result{ diff --git a/server/internal/checkers/checkssl/config.go b/server/internal/checkers/checkssl/config.go index 15de0cf6a..3808e60be 100644 --- a/server/internal/checkers/checkssl/config.go +++ b/server/internal/checkers/checkssl/config.go @@ -11,12 +11,22 @@ var errHostRequired = errors.New("host is required") const ( defaultPort = 443 - defaultThresholdDays = 30 + defaultCriticalDays = 30 + defaultWarningDays = 30 + defaultThresholdDays = defaultCriticalDays + maxThresholdDays = 3650 // 10 years — generous sanity cap defaultTimeout = 10 * time.Second maxTimeout = 60 * time.Second ) // SSLConfig defines the configuration for SSL certificate checks. +// +// Expiry is graduated across two tiers driven by the MINIMUM days-remaining +// across the whole presented certificate chain: +// - <= CriticalDays → StatusDown (paging, as before) +// - <= WarningDays → StatusWarning (amber, counts as up, no incident) +// +// The legacy single ThresholdDays maps to CriticalDays for back-compat. type SSLConfig struct { // Host is the target hostname to connect to. Host string `json:"host"` @@ -24,7 +34,17 @@ type SSLConfig struct { // Port is the TCP port to connect to (default: 443). Port int `json:"port"` - // ThresholdDays is the number of days before expiration to mark as down (default: 30). + // WarningDays is the days-before-expiration threshold that marks the check + // as Warning (amber, non-paging). Defaults to 30, equal to CriticalDays so + // behaviour is unchanged until widened. + WarningDays int `json:"warningDays"` + + // CriticalDays is the days-before-expiration threshold that marks the check + // as Down (paging). Defaults to 30. The legacy thresholdDays aliases here. + CriticalDays int `json:"criticalDays"` + + // ThresholdDays is the legacy single threshold, kept as an alias of + // CriticalDays for back-compat with existing rows and dashboards. ThresholdDays int `json:"thresholdDays"` // Timeout is the maximum time for connection + handshake (default: 10s). @@ -52,6 +72,21 @@ func (c *SSLConfig) FromMap(configMap map[string]any) error { c.ThresholdDays = threshold } + if warning, ok := readIntKey(configMap, "warningDays", "warning_days"); ok { + c.WarningDays = warning + } + + if critical, ok := readIntKey(configMap, "criticalDays", "critical_days"); ok { + c.CriticalDays = critical + } + + // Legacy alias: when criticalDays is absent but the legacy thresholdDays is + // present, the threshold drives the (paging) critical tier so existing rows + // keep behaving exactly as before. + if c.CriticalDays == 0 && c.ThresholdDays != 0 { + c.CriticalDays = c.ThresholdDays + } + if timeout, ok := configMap["timeout"].(string); ok { duration, err := time.ParseDuration(timeout) if err != nil { @@ -104,8 +139,22 @@ func (c *SSLConfig) GetConfig() map[string]any { config["port"] = c.Port } - if c.ThresholdDays != 0 { - config["thresholdDays"] = c.ThresholdDays + // Canonical critical tier — derive from the legacy threshold when only that + // was set, so GetConfig always emits the new key. + critical := c.CriticalDays + if critical == 0 { + critical = c.ThresholdDays + } + + if critical != 0 { + config["criticalDays"] = critical + // Keep emitting the legacy key for one release so dashboards that still + // read thresholdDays keep working. + config["thresholdDays"] = critical + } + + if c.WarningDays != 0 { + config["warningDays"] = c.WarningDays } if c.Timeout != 0 { @@ -129,8 +178,8 @@ func (c *SSLConfig) Validate() error { return checkerdef.NewConfigError("port", "must be between 1 and 65535") } - if c.ThresholdDays < 0 { - return checkerdef.NewConfigError("threshold_days", "must be >= 0") + if err := c.validateThresholds(); err != nil { + return err } if c.Timeout != 0 && (c.Timeout <= 0 || c.Timeout > maxTimeout) { @@ -139,3 +188,66 @@ func (c *SSLConfig) Validate() error { return nil } + +// validateThresholds enforces warningDays >= criticalDays >= 0 and a sane upper +// bound. It validates the EXPLICIT values (after the legacy alias) so that an +// explicit warningDays < criticalDays is rejected; unset tiers (0) are skipped +// because their defaults are applied at execution time. +func (c *SSLConfig) validateThresholds() error { + // criticalRaw is the explicit critical tier after applying the legacy alias. + criticalRaw := c.CriticalDays + if criticalRaw == 0 { + criticalRaw = c.ThresholdDays + } + + if criticalRaw < 0 { + return checkerdef.NewConfigError("criticalDays", "must be >= 0") + } + + if c.WarningDays < 0 { + return checkerdef.NewConfigError("warningDays", "must be >= 0") + } + + if criticalRaw > maxThresholdDays { + return checkerdef.NewConfigErrorf("criticalDays", "must be <= %d", maxThresholdDays) + } + + if c.WarningDays > maxThresholdDays { + return checkerdef.NewConfigErrorf("warningDays", "must be <= %d", maxThresholdDays) + } + + // Only enforce the ordering when both tiers are explicitly set; a default + // (0) warning is clamped up to critical at execution time, never below it. + if c.WarningDays != 0 && criticalRaw != 0 && c.WarningDays < criticalRaw { + return checkerdef.NewConfigErrorf( + "warningDays", "must be >= criticalDays (%d), got %d", criticalRaw, c.WarningDays, + ) + } + + return nil +} + +// effectiveThresholds resolves the warning/critical days that will actually be +// used, applying the legacy alias and per-tier defaults. Used by execution. +func (c *SSLConfig) effectiveThresholds() (warning, critical int) { + critical = c.CriticalDays + if critical == 0 { + critical = c.ThresholdDays + } + + if critical <= 0 { + critical = defaultCriticalDays + } + + warning = c.WarningDays + if warning <= 0 { + warning = defaultWarningDays + } + + // Default warning never weakens an explicitly-widened critical tier. + if warning < critical { + warning = critical + } + + return warning, critical +} From 034c393d25adc3cbd85db63f3068f4d65862d8f0 Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 03:37:18 +0200 Subject: [PATCH 35/67] feat: add table-driven chain-expiry tier tests with crafted cert chains --- .../internal/checkers/checkssl/chain_test.go | 252 ++++++++++++++++++ 1 file changed, 252 insertions(+) create mode 100644 server/internal/checkers/checkssl/chain_test.go diff --git a/server/internal/checkers/checkssl/chain_test.go b/server/internal/checkers/checkssl/chain_test.go new file mode 100644 index 000000000..54a13925b --- /dev/null +++ b/server/internal/checkers/checkssl/chain_test.go @@ -0,0 +1,252 @@ +package checkssl + +import ( + "crypto/rand" + "crypto/rsa" + "crypto/tls" + "crypto/x509" + "crypto/x509/pkix" + "math/big" + "net" + "testing" + "time" + + "github.com/stretchr/testify/require" + + "github.com/fclairamb/solidping/server/internal/checkers/checkerdef" +) + +// makeCert mints a self-contained certificate whose NotAfter is `days` from now. +// The certificate is not chained to a real CA — these tests drive buildResult +// directly with a fabricated ConnectionState, so trust is irrelevant. +func makeCert(t *testing.T, commonName string, days int) *x509.Certificate { + t.Helper() + + key, err := rsa.GenerateKey(rand.Reader, 2048) + require.NoError(t, err) + + tmpl := &x509.Certificate{ + SerialNumber: big.NewInt(time.Now().UnixNano()), + Subject: pkix.Name{CommonName: commonName}, + Issuer: pkix.Name{CommonName: "Test Issuer"}, + NotBefore: time.Now().Add(-24 * time.Hour), + // Add a 12h buffer so the truncating days-remaining computation + // (time.Until/24h, floored) lands on exactly `days` despite the small + // elapsed time between minting and evaluation. + NotAfter: time.Now().Add(time.Duration(days)*24*time.Hour + 12*time.Hour), + DNSNames: []string{commonName}, + } + + der, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, &key.PublicKey, key) + require.NoError(t, err) + + cert, err := x509.ParseCertificate(der) + require.NoError(t, err) + + return cert +} + +// buildResultFromChain runs the production buildResult against a fabricated +// handshake state carrying the given chain. +func buildResultFromChain( + chain []*x509.Certificate, verified bool, params execParams, +) *checkerdef.Result { + state := tls.ConnectionState{ + Version: tls.VersionTLS13, + PeerCertificates: chain, + } + if verified { + state.VerifiedChains = [][]*x509.Certificate{chain} + } + + conn := &tlsConnResult{ + connectionTime: 5 * time.Millisecond, + handshakeTime: 5 * time.Millisecond, + state: state, + } + + checker := &SSLChecker{} + + return checker.buildResult(conn, net.IPv4(127, 0, 0, 1), params, time.Now()) +} + +func TestBuildResult_ChainExpiryTiers(t *testing.T) { + t.Parallel() + + // Tiers used for the explicit two-tier cases: warning 30, critical 7. + twoTier := execParams{port: 443, warningDays: 30, criticalDays: 7, host: "example.com"} + + tests := []struct { + name string + chain []*x509.Certificate + params execParams + wantStatus checkerdef.Status + wantSeverity string + wantWarningFlag bool + wantMinDays int + wantChainLength int + wantChainVerified bool + }{ + { + // Leaf far out (200d) but intermediate inside warning window (20d) + // drives the minimum — proves whole-chain min, not leaf. + name: "intermediate inside warning drives min → warning", + chain: []*x509.Certificate{ + makeCert(t, "leaf.example.com", 200), + makeCert(t, "Intermediate CA", 20), + }, + params: twoTier, + wantStatus: checkerdef.StatusWarning, + wantSeverity: checkerdef.SeverityWarning, + wantWarningFlag: true, + wantMinDays: 20, + wantChainLength: 2, + wantChainVerified: true, + }, + { + name: "min inside critical → down/critical", + chain: []*x509.Certificate{ + makeCert(t, "leaf.example.com", 200), + makeCert(t, "Intermediate CA", 5), + }, + params: twoTier, + wantStatus: checkerdef.StatusDown, + wantSeverity: checkerdef.SeverityCritical, + wantWarningFlag: false, + wantMinDays: 5, + wantChainLength: 2, + }, + { + name: "min between tiers → warning/warning", + chain: []*x509.Certificate{ + makeCert(t, "leaf.example.com", 25), + }, + params: twoTier, + wantStatus: checkerdef.StatusWarning, + wantSeverity: checkerdef.SeverityWarning, + wantWarningFlag: true, + wantMinDays: 25, + wantChainLength: 1, + }, + { + name: "min beyond both → up, no flag", + chain: []*x509.Certificate{ + makeCert(t, "leaf.example.com", 200), + makeCert(t, "Intermediate CA", 100), + }, + params: twoTier, + wantStatus: checkerdef.StatusUp, + wantSeverity: checkerdef.SeverityNone, + wantWarningFlag: false, + wantMinDays: 100, + wantChainLength: 2, + }, + { + // Legacy thresholdDays only (30), resolved to critical=warning=30 + // via effectiveThresholds → behaves exactly as today: Down at 30. + name: "legacy threshold behaves as today (down at 30)", + chain: []*x509.Certificate{ + makeCert(t, "leaf.example.com", 20), + }, + params: newExecParams(&SSLConfig{ + Host: "example.com", + ThresholdDays: 30, + }), + wantStatus: checkerdef.StatusDown, + wantSeverity: checkerdef.SeverityCritical, + wantWarningFlag: false, + wantMinDays: 20, + wantChainLength: 1, + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + t.Parallel() + + r := require.New(t) + res := buildResultFromChain(tt.chain, true, tt.params) + + r.Equal(tt.wantStatus, res.Status) + r.Equal(tt.wantSeverity, res.Output["severity"]) + r.Equal(tt.wantMinDays, res.Metrics["days_remaining"]) + r.Equal(tt.wantChainLength, res.Output["chainLength"]) + + if tt.wantWarningFlag { + r.Equal(true, res.Output["certExpiryWarning"]) + } else { + r.NotContains(res.Output, "certExpiryWarning") + } + + chain, ok := res.Output["chain"].([]chainCertReport) + r.True(ok, "chain output should be a []chainCertReport") + r.Len(chain, tt.wantChainLength) + + soonest, ok := res.Output["soonestExpiring"].(map[string]any) + r.True(ok, "soonestExpiring should be present") + r.Equal(tt.wantMinDays, soonest["daysRemaining"]) + }) + } +} + +func TestBuildResult_ChainVerifiedFlag(t *testing.T) { + t.Parallel() + + r := require.New(t) + chain := []*x509.Certificate{makeCert(t, "leaf.example.com", 200)} + params := execParams{port: 443, warningDays: 30, criticalDays: 7, host: "example.com"} + + verified := buildResultFromChain(chain, true, params) + r.Equal(true, verified.Output["chainVerified"]) + + unverified := buildResultFromChain(chain, false, params) + r.Equal(false, unverified.Output["chainVerified"]) +} + +func TestSSLConfig_LegacyAlias(t *testing.T) { + t.Parallel() + + r := require.New(t) + + cfg := &SSLConfig{} + r.NoError(cfg.FromMap(map[string]any{ + "host": "example.com", + "thresholdDays": float64(14), + })) + r.NoError(cfg.Validate()) + + // Legacy threshold maps onto the critical tier. + r.Equal(14, cfg.CriticalDays) + + warning, critical := cfg.effectiveThresholds() + r.Equal(14, critical) + r.Equal(30, warning) // default warning, clamped up to >= critical +} + +func TestSSLConfig_Validate_WarningBelowCritical(t *testing.T) { + t.Parallel() + + r := require.New(t) + + cfg := &SSLConfig{ + Host: "example.com", + WarningDays: 7, + CriticalDays: 30, + } + err := cfg.Validate() + r.Error(err) + r.Contains(err.Error(), "warningDays") +} + +func TestSSLConfig_Validate_TwoTierValid(t *testing.T) { + t.Parallel() + + r := require.New(t) + + cfg := &SSLConfig{ + Host: "example.com", + WarningDays: 30, + CriticalDays: 7, + } + r.NoError(cfg.Validate()) +} From 56fb390a9c6e21a1eb0d479a7adc8bf0c02b4f8c Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 03:39:46 +0200 Subject: [PATCH 36/67] feat: ssl two-tier expiry form fields and chain-table check-detail card --- .../src/components/checks/ssl-chain-card.tsx | 144 ++++++++++++++++++ .../src/components/shared/check-form.tsx | 35 +++-- .../orgs/$org/checks.$checkUid.index.tsx | 15 +- 3 files changed, 180 insertions(+), 14 deletions(-) create mode 100644 web/dash0/src/components/checks/ssl-chain-card.tsx diff --git a/web/dash0/src/components/checks/ssl-chain-card.tsx b/web/dash0/src/components/checks/ssl-chain-card.tsx new file mode 100644 index 000000000..b0c4bf2c2 --- /dev/null +++ b/web/dash0/src/components/checks/ssl-chain-card.tsx @@ -0,0 +1,144 @@ +import { useTranslation } from "react-i18next"; +import { ShieldAlert, ShieldCheck } from "lucide-react"; +import { Badge } from "@/components/ui/badge"; +import { + Card, + CardContent, + CardDescription, + CardHeader, + CardTitle, +} from "@/components/ui/card"; +import { + Table, + TableBody, + TableCell, + TableHead, + TableHeader, + TableRow, +} from "@/components/ui/table"; + +// One entry of the reported certificate chain (mirrors the backend output shape +// from checkssl: output.chain[]). +interface ChainCert { + subject?: string; + issuer?: string; + notAfter?: string; + daysRemaining?: number; +} + +type Output = Record; + +function asChain(output: Output | undefined): ChainCert[] | null { + const raw = output?.chain; + if (!Array.isArray(raw)) return null; + return raw as ChainCert[]; +} + +function formatDate(iso?: string): string { + if (!iso) return "-"; + const d = new Date(iso); + return Number.isNaN(d.getTime()) ? iso : d.toLocaleDateString(); +} + +// SslChainCard renders the SSL certificate chain reported by an SSL check's last +// result: a per-cert table plus an amber "expiring in N days" badge when the +// backend flagged certExpiryWarning. Only renders when the output carries a +// chain, so it is safe to mount unconditionally for SSL checks. +export function SslChainCard({ output }: { output: Output | undefined }) { + const { t } = useTranslation(["checks", "common"]); + const chain = asChain(output); + + if (!chain || chain.length === 0) return null; + + const warning = output?.certExpiryWarning === true; + const critical = output?.severity === "critical"; + const chainVerified = output?.chainVerified === true; + + // The soonest-expiring days-remaining drives the badge label. + const soonest = output?.soonestExpiring as + | { daysRemaining?: number; subject?: string } + | undefined; + const minDays = + typeof soonest?.daysRemaining === "number" + ? soonest.daysRemaining + : Math.min( + ...chain.map((c) => + typeof c.daysRemaining === "number" ? c.daysRemaining : Infinity, + ), + ); + + return ( + + +
+ {t("checks:ssl.chainTitle", "Certificate chain")} + {chainVerified ? ( + + + {t("checks:ssl.chainVerified", "Verified")} + + ) : ( + + + {t("checks:ssl.chainUnverified", "Unverified")} + + )} + {warning && ( + + + {t("checks:ssl.expiringInDays", "Expiring in {{count}} days", { + count: minDays, + })} + + )} + {critical && ( + + + {t("checks:ssl.expiredInDays", "Expires in {{count}} days", { + count: minDays, + })} + + )} +
+ + {t( + "checks:ssl.chainDescription", + "Every presented certificate. The status is driven by the soonest to expire.", + )} + + + + + + + {t("checks:ssl.subject", "Subject")} + {t("checks:ssl.issuer", "Issuer")} + {t("checks:ssl.notAfter", "Expires")} + + {t("checks:ssl.daysRemaining", "Days left")} + + + + + {chain.map((cert, i) => { + const isSoonest = cert.daysRemaining === minDays; + return ( + + {cert.subject || "-"} + {cert.issuer || "-"} + {formatDate(cert.notAfter)} + + {typeof cert.daysRemaining === "number" ? cert.daysRemaining : "-"} + + + ); + })} + +
+ + + ); +} diff --git a/web/dash0/src/components/shared/check-form.tsx b/web/dash0/src/components/shared/check-form.tsx index cae1f0b64..375d47c25 100644 --- a/web/dash0/src/components/shared/check-form.tsx +++ b/web/dash0/src/components/shared/check-form.tsx @@ -471,10 +471,17 @@ export function CheckForm({ // currently seen by a paired Freebox so the user can pre-fill an ICMP // check without typing an IP. const [discoverOpen, setDiscoverOpen] = useState(false); - const [thresholdDays, setThresholdDays] = useState( - getConfigField(initialData?.config, "thresholdDays") || + // SSL expiry tiers. criticalDays (paging, StatusDown) reads the legacy + // thresholdDays for back-compat; warningDays (amber, non-paging) is new. + const [criticalDays, setCriticalDays] = useState( + getConfigField(initialData?.config, "criticalDays") || + getConfigField(initialData?.config, "thresholdDays") || getConfigField(initialData?.config, "threshold_days"), ); + const [warningDays, setWarningDays] = useState( + getConfigField(initialData?.config, "warningDays") || + getConfigField(initialData?.config, "warning_days"), + ); const [serverName, setServerName] = useState( getConfigField(initialData?.config, "serverName") || getConfigField(initialData?.config, "server_name"), @@ -621,7 +628,8 @@ export function CheckForm({ if (host) cfg.host = host; if (port) cfg.port = parseInt(port, 10); if (serverName) cfg.serverName = serverName; - if (thresholdDays) cfg.thresholdDays = parseInt(thresholdDays, 10); + if (criticalDays) cfg.criticalDays = parseInt(criticalDays, 10); + if (warningDays) cfg.warningDays = parseInt(warningDays, 10); break; case "tcp": case "udp": @@ -786,7 +794,7 @@ export function CheckForm({ startTLS, tlsVerify, ehloDomain, expectGreeting, checkAuth, database, query, script, serviceName, tls, brokers, topic, produceTest, minPlayers, maxPlayersField, edition, vhost, queue, oid, community, expectedValue, snmpOperator, containerName, containerId, - waitSelector, keyword, wsSend, wsExpect, serverName, thresholdDays, + waitSelector, keyword, wsSend, wsExpect, serverName, criticalDays, warningDays, freeboxConnectionUid, freeboxLinkType, freeboxMinSyncRate, freeboxMinSnrDb, freeboxMaxAttnDb, freeboxMaxCrcErrors, freeboxMinRxMw, freeboxMaxRxMw, dnsblTarget, dnsblBlocklists, dnsblNameserver, @@ -837,7 +845,8 @@ export function CheckForm({ config.host = host; if (port) config.port = parseInt(port, 10); if (serverName) config.serverName = serverName; - if (thresholdDays) config.thresholdDays = parseInt(thresholdDays, 10); + if (criticalDays) config.criticalDays = parseInt(criticalDays, 10); + if (warningDays) config.warningDays = parseInt(warningDays, 10); break; case "tcp": case "udp": @@ -1219,14 +1228,20 @@ export function CheckForm({ {getFieldError(fieldErrors, "host") && (

{getFieldError(fieldErrors, "host")}

)} {getFieldError(fieldErrors, "port") && (

{getFieldError(fieldErrors, "port")}

)}
+
+ + setServerName(e.target.value)} data-testid="check-server-name-input" /> +
-
- - setServerName(e.target.value)} data-testid="check-server-name-input" /> +
+ + setCriticalDays(e.target.value)} data-testid="check-critical-days-input" /> +

Down (pages) at or below this.

- - setThresholdDays(e.target.value)} data-testid="check-threshold-days-input" /> + + setWarningDays(e.target.value)} data-testid="check-warning-days-input" /> +

Amber warning (no page) at or below this. Must be ≥ Critical.

diff --git a/web/dash0/src/routes/orgs/$org/checks.$checkUid.index.tsx b/web/dash0/src/routes/orgs/$org/checks.$checkUid.index.tsx index f37af9751..4696403b2 100644 --- a/web/dash0/src/routes/orgs/$org/checks.$checkUid.index.tsx +++ b/web/dash0/src/routes/orgs/$org/checks.$checkUid.index.tsx @@ -58,6 +58,7 @@ import { import { StatusBadge } from "@/components/shared/status-badge"; import { QueryErrorView } from "@/components/shared/error-views"; import { CheckSummaryCards } from "@/components/checks/check-summary-cards"; +import { SslChainCard } from "@/components/checks/ssl-chain-card"; import { ResponseTimeChart } from "@/components/checks/response-time-chart"; import { AvailabilityTable } from "@/components/checks/availability-table"; import { DependenciesCard } from "@/components/checks/dependencies-card"; @@ -871,8 +872,11 @@ function CheckDetailPage() { {t("checks:detail.outputLabel")}
- {Object.entries(check.lastResult.output).map( - ([key, value]) => ( + {Object.entries(check.lastResult.output) + // The SSL chain + soonest-expiring details get a + // dedicated table below; don't repeat them as raw JSON. + .filter(([key]) => key !== "chain" && key !== "soonestExpiring") + .map(([key, value]) => (
{key}: @@ -883,8 +887,7 @@ function CheckDetailPage() { : JSON.stringify(value)}
- ) - )} + ))}
)} @@ -896,6 +899,10 @@ function CheckDetailPage() {
+ {check.type === "ssl" && ( + | undefined} /> + )} + From 0313da77c261e25e006457692382c20865b616da Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 03:39:49 +0200 Subject: [PATCH 37/67] docs: document ssl graduated expiry tiers and whole-chain output shape --- docs/conventions/checker-config.md | 35 +++++++++++++++++++++++++++++- 1 file changed, 34 insertions(+), 1 deletion(-) diff --git a/docs/conventions/checker-config.md b/docs/conventions/checker-config.md index 736f0172d..1cf043dfd 100644 --- a/docs/conventions/checker-config.md +++ b/docs/conventions/checker-config.md @@ -137,12 +137,45 @@ Either `url` or `host` is required. Default period: 5 minutes. |-------|------|----------|---------|-------------| | `host` | string | R | | Target hostname | | `port` | int | O | 443 | Target port. Validation: 1-65535 | -| `threshold_days` | int | O | 30 | Days before expiration to mark as down. Must be >= 0 | +| `criticalDays` | int | O | 30 | Days before expiration to mark **Down** (paging). Must be `0..3650` | +| `warningDays` | int | O | 30 | Days before expiration to mark **Warning** (amber, non-paging). Must be `>= criticalDays`, `0..3650` | +| `thresholdDays` | int | O | 30 | **Legacy alias** for `criticalDays`. Read for back-compat; `criticalDays` wins when both are set | | `timeout` | duration | O | 10s | Connection + handshake timeout (max: 60s) | | `server_name` | string | O | same as host | Override SNI server name | Min period: 1 hour. Default period: 6 hours. +**Graduated expiry & whole-chain reporting.** Expiry is evaluated against the +**minimum days-remaining across the whole presented certificate chain** (leaf + +intermediates), not just the leaf — an intermediate that expires first now drives +the status. Two tiers: + +- `min <= criticalDays` → **Down** (`severity: "critical"`), pages, as before. +- `criticalDays < min <= warningDays` → **Warning** (`severity: "warning"`, + `certExpiryWarning: true`) — amber, counts as up, opens no incident; rollups + show **Degraded**. +- else → **Up**. + +Defaults keep `warningDays == criticalDays == 30`, so behaviour is **unchanged** +until you widen `warningDays`. A handshake failure / actual expiry is **Down** as +before (trust is enforced at handshake). Recommended: lower `criticalDays` (e.g. +to 7) and widen `warningDays` (e.g. 30) so a valid-but-soon-expiring cert is a +warning, not a month-long fake outage. + +Output (in `result.output`): + +| Key | Description | +|-----|-------------| +| `chain` | Array of `{subject, issuer, notAfter, daysRemaining}`, one per presented cert | +| `soonestExpiring` | `{subject, daysRemaining}` for the cert driving the status | +| `chainLength` | Number of presented certificates | +| `chainVerified` | `true` when the handshake produced a verified chain | +| `certExpiryWarning` | `true` only in the warning tier | +| `severity` | `"critical"`, `"warning"`, or `""` | +| `subject`, `issuer`, `not_after`, `days_remaining`, `serial_number`, `dns_names` | Leaf-certificate fields (kept for back-compat) | + +`metrics.days_remaining` is the **chain minimum** (the meaningful number to graph). + --- ### `domain` -- Domain name expiration From fc4b6a4b9efb6c523294038827ee7b5b57198042 Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 03:42:19 +0200 Subject: [PATCH 38/67] chore: all checks passing for ssl graduated expiry and chain reporting --- server/internal/checkers/checkssl/checker.go | 2 +- server/internal/checkers/checkssl/config.go | 9 +++++---- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/server/internal/checkers/checkssl/checker.go b/server/internal/checkers/checkssl/checker.go index ac705236d..2aa3db39b 100644 --- a/server/internal/checkers/checkssl/checker.go +++ b/server/internal/checkers/checkssl/checker.go @@ -145,7 +145,7 @@ type chainCertReport struct { DaysRemaining int `json:"daysRemaining"` } -// chainExpiry summarises the whole presented chain: its per-cert report plus the +// chainExpiry summarizes the whole presented chain: its per-cert report plus the // soonest-expiring cert (the minimum days-remaining drives the status decision). type chainExpiry struct { chain []chainCertReport diff --git a/server/internal/checkers/checkssl/config.go b/server/internal/checkers/checkssl/config.go index 3808e60be..031251744 100644 --- a/server/internal/checkers/checkssl/config.go +++ b/server/internal/checkers/checkssl/config.go @@ -36,7 +36,7 @@ type SSLConfig struct { // WarningDays is the days-before-expiration threshold that marks the check // as Warning (amber, non-paging). Defaults to 30, equal to CriticalDays so - // behaviour is unchanged until widened. + // behavior is unchanged until widened. WarningDays int `json:"warningDays"` // CriticalDays is the days-before-expiration threshold that marks the check @@ -229,8 +229,9 @@ func (c *SSLConfig) validateThresholds() error { // effectiveThresholds resolves the warning/critical days that will actually be // used, applying the legacy alias and per-tier defaults. Used by execution. -func (c *SSLConfig) effectiveThresholds() (warning, critical int) { - critical = c.CriticalDays +// Returns (warning, critical). +func (c *SSLConfig) effectiveThresholds() (int, int) { + critical := c.CriticalDays if critical == 0 { critical = c.ThresholdDays } @@ -239,7 +240,7 @@ func (c *SSLConfig) effectiveThresholds() (warning, critical int) { critical = defaultCriticalDays } - warning = c.WarningDays + warning := c.WarningDays if warning <= 0 { warning = defaultWarningDays } From 6b2da651889b1256699a7a0a458e357c895a6e76 Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 03:44:59 +0200 Subject: [PATCH 39/67] docs: archive completed spec ssl graduated expiry and chain reporting --- .../06}/2026-06-20-01-ssl-graduated-expiry-and-chain-reporting.md | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename specs/{todos => done/2026/06}/2026-06-20-01-ssl-graduated-expiry-and-chain-reporting.md (100%) diff --git a/specs/todos/2026-06-20-01-ssl-graduated-expiry-and-chain-reporting.md b/specs/done/2026/06/2026-06-20-01-ssl-graduated-expiry-and-chain-reporting.md similarity index 100% rename from specs/todos/2026-06-20-01-ssl-graduated-expiry-and-chain-reporting.md rename to specs/done/2026/06/2026-06-20-01-ssl-graduated-expiry-and-chain-reporting.md From 282ee091a3646cfdba5173fc15dc1400b808abf6 Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 03:46:52 +0200 Subject: [PATCH 40/67] chore: start implementing docker restart loop detection From 2c704126a10cb8ea95fbec41a90bcccc32e94ada Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 03:47:10 +0200 Subject: [PATCH 41/67] docs: add implementation plan for docker restart loop detection --- ...-06-20-02-docker-restart-loop-detection.md | 47 +++++++++++++++++++ 1 file changed, 47 insertions(+) diff --git a/specs/todos/2026-06-20-02-docker-restart-loop-detection.md b/specs/todos/2026-06-20-02-docker-restart-loop-detection.md index cd17b07cf..155e9d07c 100644 --- a/specs/todos/2026-06-20-02-docker-restart-loop-detection.md +++ b/specs/todos/2026-06-20-02-docker-restart-loop-detection.md @@ -199,3 +199,50 @@ when not yet over threshold. - `web/dash0/src/routes/**` — Docker config form + check-detail output - `docs/api-specification.md`, `docs/features/**` — config + output shape - `docs/competitors/maintenant.md` — source of the requirement + +## Implementation Plan + +Implementing **Approach A** (Decision 1 — checker-local heuristic, no DB +migration, no history/threading). `StatusWarning = 8` already exists on the +integration branch (Decision 2 — live amber Warning, rolls up to Degraded, +counts as up, does not page). + +1. **Config (`checkdocker/config.go`).** + - Add `RestartLoopMinRestarts int` (json `restartLoopMinRestarts`) and + `RestartLoopWindow time.Duration` (json `restartLoopWindow`). + - `FromMap`: parse `restartLoopMinRestarts` (JSON number → int) and + `restartLoopWindow` as a duration **string** (mirrors `timeout`). + - `GetConfig`: emit both when non-zero (window as `.String()`). + - `Validate`: `minRestarts >= 0`; window must be `> 0` and `<=` a sane + bound when set. Detection stays OFF unless `minRestarts > 0`. + - Add a `resolveRestartLoopWindow()` helper: default `120s` when enabled + and window unset. + +2. **Checker (`checkdocker/checker.go`).** + - Thread the resolved config into `buildResult` (it currently takes none). + - After the existing not-running / unhealthy short-circuits (both still + return `StatusDown`), add the loop branch: when + `RestartLoopMinRestarts > 0 && info.State.Running`, parse + `info.State.StartedAt` (`time.RFC3339Nano`), set + `output["secondsSinceStart"]` **always**, and when + `info.RestartCount >= minRestarts && sinceStart <= window` set + `output["restartLoop"]=true`, an explanatory `output["error"]`, and + return `checkerdef.StatusWarning`. `metrics["restartCount"]` unchanged. + +3. **Frontend (`web/dash0`).** + - Config form: add an advanced "restart-loop detection" section to the + `docker` case with the two fields (number + duration), wired through the + existing config-state plumbing. + - Check detail: a `DockerRestartLoopCard` (mirrors `SslChainCard`) surfaces + `restartLoop` / `restartCount` / `secondsSinceStart`, amber badge via the + shared `statusStyle()` warning treatment. Mounted for `type === "docker"`. + +4. **Docs.** Update the Docker section of + `docs/conventions/checker-config.md` with the two config fields and the + new output shape (`restartLoop`, `secondsSinceStart`). + +5. **Tests (`checkdocker/checker_test.go`, table-driven, `testify/require`, + `t.Parallel()`).** Drive `buildResult` with synthetic + `container.InspectResponse`: loop → Warning; old high count → Up; recent + but below floor → Up; disabled → byte-for-byte today; not-running / + unhealthy short-circuit to Down before the loop branch. From 1b864c834c5d0376abc12c6f2dcd1e23b5bf8fba Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 03:47:53 +0200 Subject: [PATCH 42/67] feat: add restart-loop detection config fields to docker checker --- .../internal/checkers/checkdocker/config.go | 82 +++++++++++++++++++ 1 file changed, 82 insertions(+) diff --git a/server/internal/checkers/checkdocker/config.go b/server/internal/checkers/checkdocker/config.go index 899bb7669..898ca4458 100644 --- a/server/internal/checkers/checkdocker/config.go +++ b/server/internal/checkers/checkdocker/config.go @@ -11,6 +11,14 @@ const ( defaultHost = "unix:///var/run/docker.sock" defaultTimeout = 10 * time.Second maxTimeout = 60 * time.Second + + // defaultRestartLoopWindow is the recency window applied when restart-loop + // detection is enabled (RestartLoopMinRestarts > 0) but no window is set. + defaultRestartLoopWindow = 120 * time.Second + // maxRestartLoopWindow bounds the configurable recency window. A loop is a + // rate signal; an unbounded window would let a single restart far in the + // past trip the heuristic, defeating the recency guard. + maxRestartLoopWindow = 24 * time.Hour ) // DockerConfig holds the configuration for Docker container health checks. @@ -19,6 +27,12 @@ type DockerConfig struct { ContainerName string `json:"containerName,omitempty"` ContainerID string `json:"containerId,omitempty"` Timeout time.Duration `json:"timeout,omitempty"` + // Restart-loop detection (opt-in). RestartLoopMinRestarts == 0 → disabled. + // When enabled, a running container whose lifetime RestartCount is at least + // RestartLoopMinRestarts and that (re)started within RestartLoopWindow is + // flagged as a suspected crash-loop and reported as StatusWarning. + RestartLoopMinRestarts int `json:"restartLoopMinRestarts,omitempty"` + RestartLoopWindow time.Duration `json:"restartLoopWindow,omitempty"` } // FromMap populates the configuration from a map. @@ -52,6 +66,39 @@ func (c *DockerConfig) FromMap(configMap map[string]any) error { return checkerdef.NewConfigError("timeout", "must be a string") } + if err := c.parseRestartLoop(configMap); err != nil { + return err + } + + return nil +} + +// parseRestartLoop reads the opt-in restart-loop detection fields. JSON numbers +// decode to float64 through a map[string]any, so minRestarts accepts the int and +// float64 shapes; the window is a duration string like timeout. +func (c *DockerConfig) parseRestartLoop(configMap map[string]any) error { + if raw := configMap["restartLoopMinRestarts"]; raw != nil { + switch v := raw.(type) { + case float64: + c.RestartLoopMinRestarts = int(v) + case int: + c.RestartLoopMinRestarts = v + default: + return checkerdef.NewConfigError("restartLoopMinRestarts", "must be a number") + } + } + + if window, ok := configMap["restartLoopWindow"].(string); ok { + duration, err := time.ParseDuration(window) + if err != nil { + return checkerdef.NewConfigError("restartLoopWindow", "must be a valid duration string") + } + + c.RestartLoopWindow = duration + } else if configMap["restartLoopWindow"] != nil { + return checkerdef.NewConfigError("restartLoopWindow", "must be a string") + } + return nil } @@ -75,6 +122,14 @@ func (c *DockerConfig) GetConfig() map[string]any { cfg["timeout"] = c.Timeout.String() } + if c.RestartLoopMinRestarts != 0 { + cfg["restartLoopMinRestarts"] = c.RestartLoopMinRestarts + } + + if c.RestartLoopWindow != 0 { + cfg["restartLoopWindow"] = c.RestartLoopWindow.String() + } + return cfg } @@ -95,9 +150,36 @@ func (c *DockerConfig) Validate() error { ) } + if c.RestartLoopMinRestarts < 0 { + return checkerdef.NewConfigErrorf( + "restartLoopMinRestarts", "must be >= 0, got %d", c.RestartLoopMinRestarts, + ) + } + + if c.RestartLoopWindow != 0 && (c.RestartLoopWindow <= 0 || c.RestartLoopWindow > maxRestartLoopWindow) { + return checkerdef.NewConfigErrorf( + "restartLoopWindow", "must be > 0 and <= 24h, got %s", c.RestartLoopWindow.String(), + ) + } + return nil } +// restartLoopEnabled reports whether opt-in restart-loop detection is active. +func (c *DockerConfig) restartLoopEnabled() bool { + return c.RestartLoopMinRestarts > 0 +} + +// resolveRestartLoopWindow returns the recency window to apply, defaulting to +// 120s when detection is enabled but no window was configured. +func (c *DockerConfig) resolveRestartLoopWindow() time.Duration { + if c.RestartLoopWindow != 0 { + return c.RestartLoopWindow + } + + return defaultRestartLoopWindow +} + func (c *DockerConfig) resolveHost() string { if c.Host != "" { return c.Host From 096ea58ae6c282704ebcecc5b662b4f52756a7a8 Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 03:48:26 +0200 Subject: [PATCH 43/67] feat: detect docker restart loop in buildResult and return StatusWarning --- .../internal/checkers/checkdocker/checker.go | 62 ++++++++++++++++++- 1 file changed, 61 insertions(+), 1 deletion(-) diff --git a/server/internal/checkers/checkdocker/checker.go b/server/internal/checkers/checkdocker/checker.go index c4c36baab..789edcdbc 100644 --- a/server/internal/checkers/checkdocker/checker.go +++ b/server/internal/checkers/checkdocker/checker.go @@ -3,6 +3,7 @@ package checkdocker import ( "context" + "fmt" "strings" "time" @@ -103,7 +104,7 @@ func (c *DockerChecker) Execute( metrics["inspect_time_ms"] = durationMs(time.Since(start)) - return buildResult(info, start, metrics, output), nil + return buildResult(cfg, info, start, metrics, output), nil } func createClient(cfg *DockerConfig) (*client.Client, error) { @@ -137,6 +138,7 @@ func handleInspectError( } func buildResult( + cfg *DockerConfig, info container.InspectResponse, start time.Time, metrics map[string]any, @@ -177,6 +179,64 @@ func buildResult( } } + // Restart-loop heuristic (Approach A): a container that is running at + // inspect time but (re)started very recently with a high lifetime restart + // count is a likely crash-loop. Detected on a running container → Warning + // (counts as up, does not page). secondsSinceStart is always emitted when + // detection is enabled so the dashboard can show flap context even below + // threshold. + if cfg.restartLoopEnabled() && info.State.Running { + return detectRestartLoop(cfg, info, start, metrics, output) + } + + return &checkerdef.Result{ + Status: checkerdef.StatusUp, + Duration: time.Since(start), + Metrics: metrics, + Output: output, + } +} + +func detectRestartLoop( + cfg *DockerConfig, + info container.InspectResponse, + start time.Time, + metrics map[string]any, + output map[string]any, +) *checkerdef.Result { + window := cfg.resolveRestartLoopWindow() + + started, err := time.Parse(time.RFC3339Nano, info.State.StartedAt) + if err != nil { + // StartedAt unparseable: cannot apply the recency guard, so the loop + // signal can't be trusted. Fall back to Up rather than risk a false + // Warning. + return &checkerdef.Result{ + Status: checkerdef.StatusUp, + Duration: time.Since(start), + Metrics: metrics, + Output: output, + } + } + + sinceStart := time.Since(started) + output["secondsSinceStart"] = sinceStart.Seconds() + + if info.RestartCount >= cfg.RestartLoopMinRestarts && sinceStart <= window { + output["restartLoop"] = true + output["error"] = fmt.Sprintf( + "restart loop suspected: %d restarts, last start %s ago", + info.RestartCount, sinceStart.Round(time.Second), + ) + + return &checkerdef.Result{ + Status: checkerdef.StatusWarning, + Duration: time.Since(start), + Metrics: metrics, + Output: output, + } + } + return &checkerdef.Result{ Status: checkerdef.StatusUp, Duration: time.Since(start), From 2dd97aeeb41c2022dd4e5e945db2b948a51c5ffa Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 03:49:28 +0200 Subject: [PATCH 44/67] feat: add table-driven tests for docker restart loop detection --- .../checkers/checkdocker/checker_test.go | 187 ++++++++++++++++++ .../checkers/checkdocker/config_test.go | 143 ++++++++++++++ 2 files changed, 330 insertions(+) create mode 100644 server/internal/checkers/checkdocker/checker_test.go create mode 100644 server/internal/checkers/checkdocker/config_test.go diff --git a/server/internal/checkers/checkdocker/checker_test.go b/server/internal/checkers/checkdocker/checker_test.go new file mode 100644 index 000000000..26b92b410 --- /dev/null +++ b/server/internal/checkers/checkdocker/checker_test.go @@ -0,0 +1,187 @@ +package checkdocker + +import ( + "testing" + "time" + + "github.com/docker/docker/api/types/container" + "github.com/stretchr/testify/require" + + "github.com/fclairamb/solidping/server/internal/checkers/checkerdef" +) + +// inspectOpts configures a synthetic container.InspectResponse for buildResult. +type inspectOpts struct { + running bool + state string + restartCount int + startedAt string + healthStatus string // "" → no Health block +} + +func makeInspect(o inspectOpts) container.InspectResponse { + state := &container.State{ + Status: container.ContainerState(o.state), + Running: o.running, + StartedAt: o.startedAt, + } + + if o.healthStatus != "" { + state.Health = &container.Health{Status: o.healthStatus} + } + + return container.InspectResponse{ + ContainerJSONBase: &container.ContainerJSONBase{ + ID: "abc123", + Name: "/test-container", + State: state, + RestartCount: o.restartCount, + }, + Config: &container.Config{Image: "test:latest"}, + } +} + +func TestBuildResult_RestartLoopDetection(t *testing.T) { + t.Parallel() + + now := time.Now().UTC() + recentStart := now.Add(-30 * time.Second).Format(time.RFC3339Nano) + oldStart := now.Add(-10 * time.Minute).Format(time.RFC3339Nano) + + tests := []struct { + name string + cfg *DockerConfig + inspect inspectOpts + wantStatus checkerdef.Status + wantRestartLoop bool // expect output["restartLoop"] == true + wantSecondsKey bool // expect output["secondsSinceStart"] present + }{ + { + name: "loop: running, count >= min, started within window → Warning", + cfg: &DockerConfig{RestartLoopMinRestarts: 3, RestartLoopWindow: 120 * time.Second}, + inspect: inspectOpts{ + running: true, state: "running", restartCount: 5, startedAt: recentStart, + }, + wantStatus: checkerdef.StatusWarning, + wantRestartLoop: true, + wantSecondsKey: true, + }, + { + name: "recency guard: high count but started older than window → Up", + cfg: &DockerConfig{RestartLoopMinRestarts: 3, RestartLoopWindow: 120 * time.Second}, + inspect: inspectOpts{ + running: true, state: "running", restartCount: 99, startedAt: oldStart, + }, + wantStatus: checkerdef.StatusUp, + wantRestartLoop: false, + wantSecondsKey: true, + }, + { + name: "count floor: recent start but count < min → Up", + cfg: &DockerConfig{RestartLoopMinRestarts: 3, RestartLoopWindow: 120 * time.Second}, + inspect: inspectOpts{ + running: true, state: "running", restartCount: 1, startedAt: recentStart, + }, + wantStatus: checkerdef.StatusUp, + wantRestartLoop: false, + wantSecondsKey: true, + }, + { + name: "default window applied when enabled and window unset", + cfg: &DockerConfig{RestartLoopMinRestarts: 3}, + inspect: inspectOpts{ + running: true, state: "running", restartCount: 5, startedAt: recentStart, + }, + wantStatus: checkerdef.StatusWarning, + wantRestartLoop: true, + wantSecondsKey: true, + }, + { + name: "disabled (minRestarts == 0): no detection, no secondsSinceStart → Up", + cfg: &DockerConfig{}, + inspect: inspectOpts{ + running: true, state: "running", restartCount: 99, startedAt: recentStart, + }, + wantStatus: checkerdef.StatusUp, + wantRestartLoop: false, + wantSecondsKey: false, + }, + { + name: "not running short-circuits to Down before loop branch", + cfg: &DockerConfig{RestartLoopMinRestarts: 3, RestartLoopWindow: 120 * time.Second}, + inspect: inspectOpts{ + running: false, state: "exited", restartCount: 99, startedAt: recentStart, + }, + wantStatus: checkerdef.StatusDown, + wantRestartLoop: false, + wantSecondsKey: false, + }, + { + name: "unhealthy short-circuits to Down before loop branch", + cfg: &DockerConfig{RestartLoopMinRestarts: 3, RestartLoopWindow: 120 * time.Second}, + inspect: inspectOpts{ + running: true, state: "running", restartCount: 99, startedAt: recentStart, + healthStatus: "unhealthy", + }, + wantStatus: checkerdef.StatusDown, + wantRestartLoop: false, + wantSecondsKey: false, + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + t.Parallel() + r := require.New(t) + + info := makeInspect(tt.inspect) + metrics := map[string]any{} + output := map[string]any{} + + res := buildResult(tt.cfg, info, time.Now(), metrics, output) + + r.NotNil(res) + r.Equal(tt.wantStatus, res.Status) + + // restartCount metric is always emitted, unchanged from today. + r.Equal(tt.inspect.restartCount, res.Metrics["restartCount"]) + + if tt.wantRestartLoop { + r.Equal(true, res.Output["restartLoop"]) + r.Contains(res.Output, checkerdef.OutputKeyError) + } else { + r.NotContains(res.Output, "restartLoop") + } + + if tt.wantSecondsKey { + r.Contains(res.Output, "secondsSinceStart") + r.IsType(float64(0), res.Output["secondsSinceStart"]) + } else { + r.NotContains(res.Output, "secondsSinceStart") + } + }) + } +} + +// TestBuildResult_DisabledByteForByte asserts that with detection disabled the +// output/metrics maps are exactly what they were before this feature: no +// restartLoop, no secondsSinceStart, status Up for a healthy running container. +func TestBuildResult_DisabledByteForByte(t *testing.T) { + t.Parallel() + r := require.New(t) + + info := makeInspect(inspectOpts{ + running: true, state: "running", restartCount: 42, + startedAt: time.Now().Format(time.RFC3339Nano), + }) + output := map[string]any{} + + res := buildResult(&DockerConfig{}, info, time.Now(), map[string]any{}, output) + + r.Equal(checkerdef.StatusUp, res.Status) + r.NotContains(res.Output, "restartLoop") + r.NotContains(res.Output, "secondsSinceStart") + r.NotContains(res.Output, checkerdef.OutputKeyError) + r.Equal("/test-container", res.Output["containerName"]) + r.Equal(42, res.Metrics["restartCount"]) +} diff --git a/server/internal/checkers/checkdocker/config_test.go b/server/internal/checkers/checkdocker/config_test.go new file mode 100644 index 000000000..8dd7d3bf3 --- /dev/null +++ b/server/internal/checkers/checkdocker/config_test.go @@ -0,0 +1,143 @@ +package checkdocker + +import ( + "testing" + "time" + + "github.com/stretchr/testify/require" +) + +func TestDockerConfig_FromMap_RestartLoop(t *testing.T) { + t.Parallel() + + tests := []struct { + name string + in map[string]any + wantMin int + wantWindow time.Duration + wantErr bool + errContains string + }{ + { + name: "parses min restarts (float64 from JSON) and window string", + in: map[string]any{"containerName": "c", "restartLoopMinRestarts": float64(3), "restartLoopWindow": "90s"}, + wantMin: 3, + wantWindow: 90 * time.Second, + }, + { + name: "accepts int min restarts", + in: map[string]any{"containerName": "c", "restartLoopMinRestarts": 5}, + wantMin: 5, + }, + { + name: "rejects non-number min restarts", + in: map[string]any{"containerName": "c", "restartLoopMinRestarts": "three"}, + wantErr: true, + errContains: "restartLoopMinRestarts", + }, + { + name: "rejects non-string window", + in: map[string]any{"containerName": "c", "restartLoopWindow": 120}, + wantErr: true, + errContains: "restartLoopWindow", + }, + { + name: "rejects invalid window duration", + in: map[string]any{"containerName": "c", "restartLoopWindow": "notaduration"}, + wantErr: true, + errContains: "restartLoopWindow", + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + t.Parallel() + r := require.New(t) + + cfg := &DockerConfig{} + err := cfg.FromMap(tt.in) + + if tt.wantErr { + r.Error(err) + r.Contains(err.Error(), tt.errContains) + return + } + + r.NoError(err) + r.Equal(tt.wantMin, cfg.RestartLoopMinRestarts) + r.Equal(tt.wantWindow, cfg.RestartLoopWindow) + }) + } +} + +func TestDockerConfig_Validate_RestartLoop(t *testing.T) { + t.Parallel() + + tests := []struct { + name string + cfg *DockerConfig + wantErr bool + }{ + { + name: "valid enabled config", + cfg: &DockerConfig{ContainerName: "c", RestartLoopMinRestarts: 3, RestartLoopWindow: 120 * time.Second}, + }, + { + name: "disabled is valid (zero values)", + cfg: &DockerConfig{ContainerName: "c"}, + }, + { + name: "negative min restarts is invalid", + cfg: &DockerConfig{ContainerName: "c", RestartLoopMinRestarts: -1}, + wantErr: true, + }, + { + name: "window over bound is invalid", + cfg: &DockerConfig{ContainerName: "c", RestartLoopWindow: 48 * time.Hour}, + wantErr: true, + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + t.Parallel() + r := require.New(t) + + err := tt.cfg.Validate() + if tt.wantErr { + r.Error(err) + } else { + r.NoError(err) + } + }) + } +} + +func TestDockerConfig_GetConfig_RestartLoopRoundTrip(t *testing.T) { + t.Parallel() + r := require.New(t) + + original := &DockerConfig{ + ContainerName: "c", + RestartLoopMinRestarts: 4, + RestartLoopWindow: 90 * time.Second, + } + + got := original.GetConfig() + r.Equal(4, got["restartLoopMinRestarts"]) + r.Equal("1m30s", got["restartLoopWindow"]) + + // Round-trip: GetConfig() output must parse back into an equivalent config. + parsed := &DockerConfig{} + r.NoError(parsed.FromMap(got)) + r.Equal(original.RestartLoopMinRestarts, parsed.RestartLoopMinRestarts) + r.Equal(original.RestartLoopWindow, parsed.RestartLoopWindow) +} + +func TestDockerConfig_ResolveRestartLoopWindow(t *testing.T) { + t.Parallel() + r := require.New(t) + + r.Equal(defaultRestartLoopWindow, (&DockerConfig{RestartLoopMinRestarts: 3}).resolveRestartLoopWindow()) + r.Equal(90*time.Second, (&DockerConfig{RestartLoopMinRestarts: 3, RestartLoopWindow: 90 * time.Second}).resolveRestartLoopWindow()) +} From d8b8c0f4a31dce0f868675afed609dc589990b16 Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 03:52:05 +0200 Subject: [PATCH 45/67] feat: docker restart-loop form fields and check-detail restart-activity card --- .../checks/docker-restart-loop-card.tsx | 87 +++++++++++++++++++ .../src/components/shared/check-form.tsx | 53 +++++++++++ .../orgs/$org/checks.$checkUid.index.tsx | 5 ++ 3 files changed, 145 insertions(+) create mode 100644 web/dash0/src/components/checks/docker-restart-loop-card.tsx diff --git a/web/dash0/src/components/checks/docker-restart-loop-card.tsx b/web/dash0/src/components/checks/docker-restart-loop-card.tsx new file mode 100644 index 000000000..3ad5ede29 --- /dev/null +++ b/web/dash0/src/components/checks/docker-restart-loop-card.tsx @@ -0,0 +1,87 @@ +import { useTranslation } from "react-i18next"; +import { Activity, AlertTriangle } from "lucide-react"; +import { Badge } from "@/components/ui/badge"; +import { + Card, + CardContent, + CardDescription, + CardHeader, + CardTitle, +} from "@/components/ui/card"; + +type Output = Record; + +function asNumber(value: unknown): number | undefined { + return typeof value === "number" && Number.isFinite(value) ? value : undefined; +} + +function formatSeconds(seconds: number): string { + if (seconds < 60) return `${Math.round(seconds)}s`; + const m = Math.floor(seconds / 60); + const s = Math.round(seconds % 60); + return s > 0 ? `${m}m ${s}s` : `${m}m`; +} + +// DockerRestartLoopCard surfaces the restart-loop heuristic of a Docker check's +// last result: the lifetime restart count, time since the current run started, +// and an amber "restart loop" badge when the backend flagged restartLoop. Only +// renders when the output carries restart-loop context (restartCount or +// secondsSinceStart), so it is safe to mount unconditionally for Docker checks. +export function DockerRestartLoopCard({ output }: { output: Output | undefined }) { + const { t } = useTranslation(["checks", "common"]); + + const restartCount = asNumber(output?.restartCount); + const secondsSinceStart = asNumber(output?.secondsSinceStart); + const looping = output?.restartLoop === true; + + // Nothing useful to show unless detection ran (secondsSinceStart) or we at + // least have a restart count to report. + if (restartCount === undefined && secondsSinceStart === undefined) return null; + + return ( + + +
+ {t("checks:docker.restartLoopTitle", "Restart activity")} + {looping ? ( + + + {t("checks:docker.restartLoopDetected", "Restart loop suspected")} + + ) : ( + + + {t("checks:docker.restartLoopStable", "Stable")} + + )} +
+ + {t( + "checks:docker.restartLoopDescription", + "A running container that restarts repeatedly within the recency window is flagged as a suspected crash-loop (Warning).", + )} + + + +
+
+
+ {t("checks:docker.restartCount", "Restart count")} +
+
+ {restartCount !== undefined ? restartCount : "-"} +
+
+
+
+ {t("checks:docker.secondsSinceStart", "Since last start")} +
+
+ {secondsSinceStart !== undefined ? formatSeconds(secondsSinceStart) : "-"} +
+
+
+ + + ); +} diff --git a/web/dash0/src/components/shared/check-form.tsx b/web/dash0/src/components/shared/check-form.tsx index 375d47c25..028df4861 100644 --- a/web/dash0/src/components/shared/check-form.tsx +++ b/web/dash0/src/components/shared/check-form.tsx @@ -156,6 +156,19 @@ function getConfigField( return String(value); } +// durationStringToSeconds converts a simple Go duration string ("120s", "2m") +// into whole seconds for a numeric input. Returns "" when empty/unparseable so +// the input stays blank rather than showing 0. +function durationStringToSeconds(raw: string): string { + if (!raw) return ""; + const match = raw.match(/^(\d+(?:\.\d+)?)(s|m|h)$/); + if (!match) return ""; + const value = parseFloat(match[1]); + const unit = match[2]; + const seconds = unit === "h" ? value * 3600 : unit === "m" ? value * 60 : value; + return String(Math.round(seconds)); +} + // splitBlocklists turns the DNSBL blocklists textarea (comma/newline separated) // into a trimmed, de-duplicated array, dropping empty entries. function splitBlocklists(raw: string): string[] { @@ -407,6 +420,14 @@ export function CheckForm({ const [produceTest, setProduceTest] = useState(getConfigField(initialData?.config, "produceTest") === "true"); const [containerName, setContainerName] = useState(getConfigField(initialData?.config, "containerName")); const [containerId, setContainerId] = useState(getConfigField(initialData?.config, "containerId")); + const [restartLoopMinRestarts, setRestartLoopMinRestarts] = useState( + getConfigField(initialData?.config, "restartLoopMinRestarts"), + ); + // Window is a Go duration string in config ("120s"); the input edits whole seconds. + const [restartLoopWindowSeconds, setRestartLoopWindowSeconds] = useState( + durationStringToSeconds(getConfigField(initialData?.config, "restartLoopWindow")), + ); + const [dockerRestartLoopOpen, setDockerRestartLoopOpen] = useState(false); const [oid, setOid] = useState(getConfigField(initialData?.config, "oid")); const [community, setCommunity] = useState(getConfigField(initialData?.config, "community")); const [waitSelector, setWaitSelector] = useState(getConfigField(initialData?.config, "waitSelector")); @@ -579,6 +600,8 @@ export function CheckForm({ setProduceTest(getConfigField(cfg, "produceTest") === "true"); setContainerName(getConfigField(cfg, "containerName")); setContainerId(getConfigField(cfg, "containerId")); + setRestartLoopMinRestarts(getConfigField(cfg, "restartLoopMinRestarts")); + setRestartLoopWindowSeconds(durationStringToSeconds(getConfigField(cfg, "restartLoopWindow"))); setOid(getConfigField(cfg, "oid")); setCommunity(getConfigField(cfg, "community")); setWaitSelector(getConfigField(cfg, "waitSelector")); @@ -752,6 +775,8 @@ export function CheckForm({ if (containerName) cfg.containerName = containerName; if (containerId) cfg.containerId = containerId; if (host) cfg.host = host; + if (restartLoopMinRestarts) cfg.restartLoopMinRestarts = parseInt(restartLoopMinRestarts, 10); + if (restartLoopWindowSeconds) cfg.restartLoopWindow = `${parseInt(restartLoopWindowSeconds, 10)}s`; break; case "browser": if (url) cfg.url = url; @@ -794,6 +819,7 @@ export function CheckForm({ startTLS, tlsVerify, ehloDomain, expectGreeting, checkAuth, database, query, script, serviceName, tls, brokers, topic, produceTest, minPlayers, maxPlayersField, edition, vhost, queue, oid, community, expectedValue, snmpOperator, containerName, containerId, + restartLoopMinRestarts, restartLoopWindowSeconds, waitSelector, keyword, wsSend, wsExpect, serverName, criticalDays, warningDays, freeboxConnectionUid, freeboxLinkType, freeboxMinSyncRate, freeboxMinSnrDb, freeboxMaxAttnDb, freeboxMaxCrcErrors, freeboxMinRxMw, freeboxMaxRxMw, @@ -986,6 +1012,8 @@ export function CheckForm({ if (containerName) config.containerName = containerName; if (containerId) config.containerId = containerId; if (host) config.host = host; + if (restartLoopMinRestarts) config.restartLoopMinRestarts = parseInt(restartLoopMinRestarts, 10); + if (restartLoopWindowSeconds) config.restartLoopWindow = `${parseInt(restartLoopWindowSeconds, 10)}s`; break; case "browser": if (!url) { setError("URL is required"); return; } @@ -1677,6 +1705,31 @@ export function CheckForm({ setHost(e.target.value)} data-testid="check-host-input" />

Default: unix:///var/run/docker.sock. Use tcp://host:port for remote Docker daemons.

+
+ + {dockerRestartLoopOpen && ( +
+

+ Flag a running container as crash-looping when it has restarted at least N + times and (re)started within the recency window. Leave Min Restarts empty + (or 0) to disable. A detected loop reports a Warning (amber) — it counts as + up and does not page. +

+
+ + setRestartLoopMinRestarts(e.target.value)} data-testid="check-restart-loop-min-input" /> +
+
+ + setRestartLoopWindowSeconds(e.target.value)} data-testid="check-restart-loop-window-input" /> +
+
+ )} +
); case "browser": diff --git a/web/dash0/src/routes/orgs/$org/checks.$checkUid.index.tsx b/web/dash0/src/routes/orgs/$org/checks.$checkUid.index.tsx index 4696403b2..1bee9d85e 100644 --- a/web/dash0/src/routes/orgs/$org/checks.$checkUid.index.tsx +++ b/web/dash0/src/routes/orgs/$org/checks.$checkUid.index.tsx @@ -59,6 +59,7 @@ import { StatusBadge } from "@/components/shared/status-badge"; import { QueryErrorView } from "@/components/shared/error-views"; import { CheckSummaryCards } from "@/components/checks/check-summary-cards"; import { SslChainCard } from "@/components/checks/ssl-chain-card"; +import { DockerRestartLoopCard } from "@/components/checks/docker-restart-loop-card"; import { ResponseTimeChart } from "@/components/checks/response-time-chart"; import { AvailabilityTable } from "@/components/checks/availability-table"; import { DependenciesCard } from "@/components/checks/dependencies-card"; @@ -903,6 +904,10 @@ function CheckDetailPage() { | undefined} /> )} + {check.type === "docker" && ( + | undefined} /> + )} + From c71b1b0d1e2798db3f14640d3f432ca40002b3f5 Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 03:52:23 +0200 Subject: [PATCH 46/67] docs: document docker restart-loop config fields and output shape --- docs/conventions/checker-config.md | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/docs/conventions/checker-config.md b/docs/conventions/checker-config.md index 1cf043dfd..798d69b16 100644 --- a/docs/conventions/checker-config.md +++ b/docs/conventions/checker-config.md @@ -458,9 +458,30 @@ Min period: 6 hours. Default period: 24 hours. | `containerName` | string | O* | | Container name. *At least one of `containerName`/`containerId` required | | `containerId` | string | O* | | Container ID. *At least one of `containerName`/`containerId` required | | `timeout` | duration | O | 10s | Check timeout (max: 60s) | +| `restartLoopMinRestarts` | int | O | `0` (disabled) | Opt-in restart-loop detection. When `> 0`, a *running* container whose lifetime restart count is at least this many **and** that (re)started within `restartLoopWindow` is flagged as a suspected crash-loop | +| `restartLoopWindow` | duration | O | 120s (when enabled) | Recency window for restart-loop detection. Only applied when `restartLoopMinRestarts > 0`. Max: 24h | Requires Docker socket access. +**Restart-loop detection (opt-in heuristic).** A container that is *running* at +inspect time but crash-looping (restarting every few seconds) would otherwise +report `up`. When `restartLoopMinRestarts > 0`, the checker flags it: an actively +looping container always shows a freshly-recent `startedAt`, so the recency +window (`restartLoopWindow`) carries the signal while the count floor +(`restartLoopMinRestarts`) keeps a single deploy restart from tripping it. A +detected loop returns the **`warning`** status (counts as up, rolls up to +`degraded`, does not page); a genuinely not-running/unhealthy container still +returns `down` and pages. Not-running and unhealthy short-circuits are evaluated +*before* the loop branch. Additional output keys when detection is enabled: + +| Output key | Type | Meaning | +|------------|------|---------| +| `secondsSinceStart` | number | Seconds since the current run started (always emitted when detection is enabled, even below threshold) | +| `restartLoop` | bool | `true` only when a loop is suspected (status `warning`) | + +`metrics.restartCount` is always emitted (lifetime restart count), independent of +detection. + --- ## Specialized From d63c13db1b6e2fc76db3d5e347467719ec917291 Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 03:54:27 +0200 Subject: [PATCH 47/67] chore: all checks passing for docker restart loop detection --- server/internal/checkers/checkdocker/checker_test.go | 4 ++-- server/internal/checkers/checkdocker/config_test.go | 7 +++++-- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/server/internal/checkers/checkdocker/checker_test.go b/server/internal/checkers/checkdocker/checker_test.go index 26b92b410..1a73f1de7 100644 --- a/server/internal/checkers/checkdocker/checker_test.go +++ b/server/internal/checkers/checkdocker/checker_test.go @@ -13,7 +13,7 @@ import ( // inspectOpts configures a synthetic container.InspectResponse for buildResult. type inspectOpts struct { running bool - state string + state container.ContainerState restartCount int startedAt string healthStatus string // "" → no Health block @@ -21,7 +21,7 @@ type inspectOpts struct { func makeInspect(o inspectOpts) container.InspectResponse { state := &container.State{ - Status: container.ContainerState(o.state), + Status: o.state, Running: o.running, StartedAt: o.startedAt, } diff --git a/server/internal/checkers/checkdocker/config_test.go b/server/internal/checkers/checkdocker/config_test.go index 8dd7d3bf3..8c2bd0182 100644 --- a/server/internal/checkers/checkdocker/config_test.go +++ b/server/internal/checkers/checkdocker/config_test.go @@ -138,6 +138,9 @@ func TestDockerConfig_ResolveRestartLoopWindow(t *testing.T) { t.Parallel() r := require.New(t) - r.Equal(defaultRestartLoopWindow, (&DockerConfig{RestartLoopMinRestarts: 3}).resolveRestartLoopWindow()) - r.Equal(90*time.Second, (&DockerConfig{RestartLoopMinRestarts: 3, RestartLoopWindow: 90 * time.Second}).resolveRestartLoopWindow()) + enabledNoWindow := &DockerConfig{RestartLoopMinRestarts: 3} + r.Equal(defaultRestartLoopWindow, enabledNoWindow.resolveRestartLoopWindow()) + + withWindow := &DockerConfig{RestartLoopMinRestarts: 3, RestartLoopWindow: 90 * time.Second} + r.Equal(90*time.Second, withWindow.resolveRestartLoopWindow()) } From ed23f8e1eafc652c441011b69ddbfa3501432996 Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 03:57:24 +0200 Subject: [PATCH 48/67] docs: archive completed spec docker restart loop detection --- .../2026/06}/2026-06-20-02-docker-restart-loop-detection.md | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename specs/{todos => done/2026/06}/2026-06-20-02-docker-restart-loop-detection.md (100%) diff --git a/specs/todos/2026-06-20-02-docker-restart-loop-detection.md b/specs/done/2026/06/2026-06-20-02-docker-restart-loop-detection.md similarity index 100% rename from specs/todos/2026-06-20-02-docker-restart-loop-detection.md rename to specs/done/2026/06/2026-06-20-02-docker-restart-loop-detection.md From 1858b3029f73bf0b1866a86fde7937c7036fd413 Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 03:58:47 +0200 Subject: [PATCH 49/67] chore: start implementing mcp oauth2 authorization From 151fae377bb392c02117aa3b62b8620668df11fa Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 04:00:58 +0200 Subject: [PATCH 50/67] docs: add implementation plan for mcp oauth2 authorization --- .../2026-06-20-03-mcp-oauth2-authorization.md | 66 +++++++++++++++++++ 1 file changed, 66 insertions(+) diff --git a/specs/todos/2026-06-20-03-mcp-oauth2-authorization.md b/specs/todos/2026-06-20-03-mcp-oauth2-authorization.md index 455f303b3..c50c2dc6f 100644 --- a/specs/todos/2026-06-20-03-mcp-oauth2-authorization.md +++ b/specs/todos/2026-06-20-03-mcp-oauth2-authorization.md @@ -197,3 +197,69 @@ deliberate call before/while building Phase 2–3. A current leaning is noted, b - New: OAuth AS package (metadata, authorize, token, DCR) + tables (clients, auth codes, refresh) - `docs/api-specification.md` — document the OAuth endpoints + discovery - `docs/competitors/maintenant.md` — source of the requirement + +## Implementation Plan + +Decomposed by the three phases. Issuer = `cfg.Server.BaseURL` (single issuer, v1). +MCP resource = `/api/v1/mcp`. Reuses the existing HS256 JWT signing key +(`cfg.Auth.JWTSecret`) for access tokens and publishes it at `jwks_uri` (symmetric +key → published as an `oct` JWK; see note in Phase 2). Org is taken from the +logged-in user's session at `/authorize`. + +### Phase 1 — Resource Server discovery + audience validation +1. New package `internal/oauth` with metadata builders (issuer, resource, endpoints). +2. Root-level public handler `GET /.well-known/oauth-protected-resource` (RFC 9728) + advertising `resource` = MCP URL, `authorization_servers` = [issuer]. +3. MCP handler: on missing/invalid auth return `401` + + `WWW-Authenticate: Bearer resource_metadata="/.well-known/oauth-protected-resource"`. + This requires routing the MCP endpoint through an OAuth-aware auth wrapper that + sets the header on 401 (the generic `RequireAuth` 401 stays JSON for other routes). +4. Audience check: access tokens that carry an `aud` claim must include the MCP + resource; PATs (no `aud`) keep passing via the existing scope check (back-compat). + Add `Audience` to `auth.Claims` (jwt `aud`) and an MCP-side audience guard. +5. Tests: well-known doc well-formed; 401 + WWW-Authenticate pointer; aud accept/reject; + PAT back-compat. + +### Phase 2 — Embedded authorization server +1. Migration `002_*.up/.down.sql` (BOTH dialects): `oauth_clients`, `oauth_auth_codes`, + `oauth_refresh_tokens`. Codes single-use + short-lived; refresh tokens rotating. +2. Models (`oauth_client.go`, `oauth_auth_code.go`, `oauth_refresh_token.go`) + repo + methods on both `postgres` and `sqlite` Services + `db.Service` interface entries. +3. `GET /.well-known/oauth-authorization-server` (RFC 8414) + alias + `GET /.well-known/openid-configuration`: authorization_endpoint, token_endpoint, + registration_endpoint, jwks_uri, `code_challenge_methods_supported=["S256"]`, + `grant_types_supported=["authorization_code","refresh_token"]`, + `scopes_supported=["mcp","mcp:read"]`, `token_endpoint_auth_methods_supported=["none"]`. +4. `GET /jwks_uri` (`/.well-known/jwks.json`): publish the JWT verification key. +5. `GET/POST /api/v1/oauth/authorize`: session-gated (reuse JWT/cookie; redirect to + dash0 login with returnTo when absent). Validate `client_id`, `redirect_uri` + (allow-list + loopback exception), `response_type=code`, PKCE `code_challenge` + (required) + `code_challenge_method=S256` (reject missing/plain), `resource`, + `scope ⊆ {mcp,mcp:read}`. Renders a consent screen (dash0 route). On approve, + mint single-use auth code bound to client→redirect→challenge→resource→scope→user/org. +6. `POST /api/v1/oauth/token`: `grant_type=authorization_code` (code + code_verifier, + PKCE S256 verify, single-use, redirect/client/resource match) and + `grant_type=refresh_token` (rotating: old refresh invalidated, new issued). + Issues HS256 JWT access token with `aud`=resource, scopes=consented, short TTL. +7. Consent UI: dash0 route `/orgs/$org/oauth/consent` built from design-reference + primitives; honors 401→login?returnTo. +8. Revocation: logout + PAT-revoke clears related refresh grants. +9. Rate-limit: authorize/token/register sit under `/api/v1/` so the existing per-IP + limiter covers them. + +### Phase 3 — Dynamic Client Registration (RFC 7591) +1. `POST /api/v1/oauth/register` (public): accept `redirect_uris`, `client_name`, + `grant_types`, `response_types`, `token_endpoint_auth_method`. Native/public + clients (PKCE + loopback) get no secret; confidential clients get a secret. + Redirect-URI validator: loopback exception (`http://127.0.0.1:*`, `http://localhost:*`, + `http://[::1]:*`) else exact-match https (or http loopback). Returns `client_id` + (+ `client_secret` for confidential), echoes metadata. +2. Tests: loopback accepted, non-loopback http rejected, public client gets no secret. + +### Security (throughout) +PKCE S256 mandatory; redirect-URI allow-list + loopback; audience binding; consent per +new grant; short-lived access tokens; rotating refresh + revocation on logout/PAT-revoke; +single-use short-TTL codes bound to client/redirect/challenge/resource; rate limiting. + +### Docs +Document discovery + `/authorize` `/token` `/register` in `docs/api-specification.md`. From 8ef5bb2d6d100f841fae42c1da7f7110d1e9cd46 Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 04:15:26 +0200 Subject: [PATCH 51/67] feat: mcp oauth2 authorization server core (phases 1-3 backend) Embedded OAuth 2.1 AS for the MCP resource: discovery docs (RFC 9728/8414), authorize/token/register endpoints, PKCE S256, audience binding (RFC 8707), single-use codes, rotating refresh tokens, DCR (RFC 7591) with loopback redirect exception, and revocation on logout/PAT-revoke. Reuses the existing HS256 JWT signing key and user session. Co-Authored-By: Claude Opus 4.8 --- server/internal/app/server.go | 19 +- server/internal/db/models/oauth.go | 99 +++++ .../migrations/002_mcp_oauth.down.sql | 4 + .../postgres/migrations/002_mcp_oauth.up.sql | 64 ++++ server/internal/db/postgres/oauth.go | 132 +++++++ server/internal/db/service.go | 11 + .../sqlite/migrations/002_mcp_oauth.down.sql | 4 + .../db/sqlite/migrations/002_mcp_oauth.up.sql | 54 +++ server/internal/db/sqlite/oauth.go | 132 +++++++ server/internal/handlers/auth/service.go | 45 +++ server/internal/middleware/auth.go | 58 +++ server/internal/oauth/audience.go | 32 ++ server/internal/oauth/authorize.go | 292 ++++++++++++++ server/internal/oauth/client.go | 116 ++++++ server/internal/oauth/errors.go | 63 +++ server/internal/oauth/handler.go | 60 +++ server/internal/oauth/jwks.go | 33 ++ server/internal/oauth/metadata.go | 151 ++++++++ server/internal/oauth/pkce.go | 40 ++ server/internal/oauth/register.go | 111 ++++++ server/internal/oauth/service.go | 358 ++++++++++++++++++ server/internal/oauth/token.go | 115 ++++++ 22 files changed, 1992 insertions(+), 1 deletion(-) create mode 100644 server/internal/db/models/oauth.go create mode 100644 server/internal/db/postgres/migrations/002_mcp_oauth.down.sql create mode 100644 server/internal/db/postgres/migrations/002_mcp_oauth.up.sql create mode 100644 server/internal/db/postgres/oauth.go create mode 100644 server/internal/db/sqlite/migrations/002_mcp_oauth.down.sql create mode 100644 server/internal/db/sqlite/migrations/002_mcp_oauth.up.sql create mode 100644 server/internal/db/sqlite/oauth.go create mode 100644 server/internal/oauth/audience.go create mode 100644 server/internal/oauth/authorize.go create mode 100644 server/internal/oauth/client.go create mode 100644 server/internal/oauth/errors.go create mode 100644 server/internal/oauth/handler.go create mode 100644 server/internal/oauth/jwks.go create mode 100644 server/internal/oauth/metadata.go create mode 100644 server/internal/oauth/pkce.go create mode 100644 server/internal/oauth/register.go create mode 100644 server/internal/oauth/service.go create mode 100644 server/internal/oauth/token.go diff --git a/server/internal/app/server.go b/server/internal/app/server.go index 26ff40ed9..96c843549 100644 --- a/server/internal/app/server.go +++ b/server/internal/app/server.go @@ -86,6 +86,7 @@ import ( "github.com/fclairamb/solidping/server/internal/mcp" "github.com/fclairamb/solidping/server/internal/middleware" "github.com/fclairamb/solidping/server/internal/notifier" + "github.com/fclairamb/solidping/server/internal/oauth" "github.com/fclairamb/solidping/server/internal/profiler" "github.com/fclairamb/solidping/server/internal/prommetrics" "github.com/fclairamb/solidping/server/internal/regions" @@ -483,9 +484,25 @@ func (s *Server) SetupRoutes(ctx context.Context) { s.dbService, s.services.EventNotifier, s.jobSvc, checkTypesService, s.services.Credentials, s.services.Entitlements, ) - mcpGroup := api.NewGroup("/mcp").Use(authMiddleware.RequireAuth) + mcpGroup := api.NewGroup("/mcp").Use(authMiddleware.RequireMCPAuth) mcpGroup.POST("", s.mcpHandler.Handle) + // OAuth 2.1 authorization server for the MCP resource (spec + // 2026-06-20-03). Discovery docs are served at the site root where MCP + // clients expect them; the flow endpoints live under /api/v1/oauth so the + // existing per-IP rate limiter (limitedPrefix = /api/v1/) covers them. + oauthService := oauth.NewService(s.dbService, s.authService, s.config) + oauthHandler := oauth.NewHandler(oauthService, s.config) + mainGroup.GET(oauth.PathProtectedResourceMetadata, oauthHandler.ProtectedResourceMetadata) + mainGroup.GET(oauth.PathAuthorizationServerMetadata, oauthHandler.AuthorizationServerMetadata) + mainGroup.GET(oauth.PathOpenIDConfiguration, oauthHandler.AuthorizationServerMetadata) + mainGroup.GET(oauth.PathJWKS, oauthHandler.JWKS) + oauthGroup := api.NewGroup("/oauth") + oauthGroup.GET("/authorize", oauthHandler.Authorize) + oauthGroup.POST("/authorize", oauthHandler.ApproveAuthorize) + oauthGroup.POST("/token", oauthHandler.Token) + oauthGroup.POST("/register", oauthHandler.Register) + // Job routes (auth required for org-scoped routes) jobHandler := jobs.NewHandler(s.jobSvc) orgJobsGroup := api.NewGroup("/orgs/:org/jobs").Use(authMiddleware.RequireAuth, authMiddleware.RequireOrgAccess) diff --git a/server/internal/db/models/oauth.go b/server/internal/db/models/oauth.go new file mode 100644 index 000000000..cfbbff1d3 --- /dev/null +++ b/server/internal/db/models/oauth.go @@ -0,0 +1,99 @@ +package models + +import ( + "time" + + "github.com/google/uuid" +) + +// OAuthClient is a registered OAuth 2.1 client for the MCP authorization +// server. Native MCP clients (Claude Desktop, mcp-remote) register dynamically +// (RFC 7591) as public clients (no secret) using PKCE + loopback redirects; +// confidential clients store a hashed secret. Redirect URIs are stored as a +// JSON array and validated on every /authorize. +type OAuthClient struct { + UID string `bun:"uid,pk,type:varchar(36)"` + ClientID string `bun:"client_id,notnull"` + SecretHash *string `bun:"secret_hash"` + ClientName string `bun:"client_name"` + RedirectURIs []string `bun:"redirect_uris,type:jsonb,nullzero"` + GrantTypes []string `bun:"grant_types,type:jsonb,nullzero"` + Scopes []string `bun:"scopes,type:jsonb,nullzero"` + IsPublic bool `bun:"is_public,notnull,default:true"` + CreatedAt time.Time `bun:"created_at,notnull,default:current_timestamp"` + UpdatedAt time.Time `bun:"updated_at,notnull,default:current_timestamp"` +} + +// NewOAuthClient builds a new client row with a generated UID. +func NewOAuthClient(clientID string) *OAuthClient { + now := time.Now() + + return &OAuthClient{ + UID: uuid.New().String(), + ClientID: clientID, + IsPublic: true, + CreatedAt: now, + UpdatedAt: now, + } +} + +// OAuthAuthCode is a single-use, short-lived authorization code bound to the +// client, redirect URI, PKCE challenge, resource, scope, and the user/org that +// consented. Redemption is gated by ConsumedAt (set on first use) so a replay +// is detectable and rejected. +type OAuthAuthCode struct { + UID string `bun:"uid,pk,type:varchar(36)"` + Code string `bun:"code,notnull"` + ClientID string `bun:"client_id,notnull"` + UserUID string `bun:"user_uid,notnull"` + OrganizationUID string `bun:"organization_uid,notnull"` + RedirectURI string `bun:"redirect_uri,notnull"` + Scope string `bun:"scope,notnull"` + Resource string `bun:"resource,notnull"` + CodeChallenge string `bun:"code_challenge,notnull"` + CodeChallengeMethod string `bun:"code_challenge_method,notnull"` + ExpiresAt time.Time `bun:"expires_at,notnull"` + ConsumedAt *time.Time `bun:"consumed_at"` + CreatedAt time.Time `bun:"created_at,notnull,default:current_timestamp"` +} + +// NewOAuthAuthCode builds a new auth-code row with a generated UID. +func NewOAuthAuthCode(code, clientID, userUID, orgUID string) *OAuthAuthCode { + return &OAuthAuthCode{ + UID: uuid.New().String(), + Code: code, + ClientID: clientID, + UserUID: userUID, + OrganizationUID: orgUID, + CreatedAt: time.Now(), + } +} + +// OAuthRefreshToken is a rotating refresh grant issued by the token endpoint. +// On each refresh the prior row is marked RevokedAt and a fresh one is issued, +// so a stolen-and-reused refresh token is detectable. Tokens are also revoked +// on logout / PAT-revoke. +type OAuthRefreshToken struct { + UID string `bun:"uid,pk,type:varchar(36)"` + Token string `bun:"token,notnull"` + ClientID string `bun:"client_id,notnull"` + UserUID string `bun:"user_uid,notnull"` + OrganizationUID string `bun:"organization_uid,notnull"` + Scope string `bun:"scope,notnull"` + Resource string `bun:"resource,notnull"` + ExpiresAt time.Time `bun:"expires_at,notnull"` + RevokedAt *time.Time `bun:"revoked_at"` + CreatedAt time.Time `bun:"created_at,notnull,default:current_timestamp"` +} + +// NewOAuthRefreshToken builds a new refresh-token row with a generated UID. +func NewOAuthRefreshToken(token, clientID, userUID, orgUID string) *OAuthRefreshToken { + return &OAuthRefreshToken{ + UID: uuid.New().String(), + Token: token, + ClientID: clientID, + UserUID: userUID, + OrganizationUID: orgUID, + CreatedAt: time.Now(), + } +} diff --git a/server/internal/db/postgres/migrations/002_mcp_oauth.down.sql b/server/internal/db/postgres/migrations/002_mcp_oauth.down.sql new file mode 100644 index 000000000..1bf532142 --- /dev/null +++ b/server/internal/db/postgres/migrations/002_mcp_oauth.down.sql @@ -0,0 +1,4 @@ +-- Rollback for the MCP OAuth 2.1 authorization server tables. +drop table if exists oauth_refresh_tokens; +drop table if exists oauth_auth_codes; +drop table if exists oauth_clients; diff --git a/server/internal/db/postgres/migrations/002_mcp_oauth.up.sql b/server/internal/db/postgres/migrations/002_mcp_oauth.up.sql new file mode 100644 index 000000000..21901e746 --- /dev/null +++ b/server/internal/db/postgres/migrations/002_mcp_oauth.up.sql @@ -0,0 +1,64 @@ +-- solidping — MCP OAuth 2.1 authorization server (spec 2026-06-20-03) +-- New tables for the embedded authorization server fronting the MCP resource: +-- registered clients, single-use authorization codes, and rotating refresh +-- grants. Does not amend the 001 baseline. + +create table oauth_clients ( + uid uuid primary key default gen_random_uuid(), + client_id text not null, + secret_hash text, + client_name text, + redirect_uris jsonb, + grant_types jsonb, + scopes jsonb, + is_public boolean not null default true, + created_at timestamptz not null default now(), + updated_at timestamptz not null default now() +); + +create unique index oauth_clients_client_id_idx on oauth_clients (client_id); + +comment on table oauth_clients is 'OAuth 2.1 clients registered for the MCP resource (RFC 7591 dynamic registration or first-party).'; +comment on column oauth_clients.secret_hash is 'Hashed client secret for confidential clients; NULL for public (native/loopback) clients.'; +comment on column oauth_clients.is_public is 'True for public clients (PKCE + loopback redirects, no secret).'; + +create table oauth_auth_codes ( + uid uuid primary key default gen_random_uuid(), + code text not null, + client_id text not null, + user_uid uuid not null references users(uid) on delete cascade, + organization_uid uuid not null references organizations(uid) on delete cascade, + redirect_uri text not null, + scope text not null, + resource text not null, + code_challenge text not null, + code_challenge_method text not null, + expires_at timestamptz not null, + consumed_at timestamptz, + created_at timestamptz not null default now() +); + +create unique index oauth_auth_codes_code_idx on oauth_auth_codes (code); +create index oauth_auth_codes_expires_idx on oauth_auth_codes (expires_at); + +comment on table oauth_auth_codes is 'Single-use, short-lived authorization codes bound to client/redirect/PKCE-challenge/resource/scope/user.'; +comment on column oauth_auth_codes.consumed_at is 'Set on first redemption; a non-NULL value means the code was already used and a replay must be rejected.'; + +create table oauth_refresh_tokens ( + uid uuid primary key default gen_random_uuid(), + token text not null, + client_id text not null, + user_uid uuid not null references users(uid) on delete cascade, + organization_uid uuid not null references organizations(uid) on delete cascade, + scope text not null, + resource text not null, + expires_at timestamptz not null, + revoked_at timestamptz, + created_at timestamptz not null default now() +); + +create unique index oauth_refresh_tokens_token_idx on oauth_refresh_tokens (token); +create index oauth_refresh_tokens_user_idx on oauth_refresh_tokens (user_uid) where revoked_at is null; + +comment on table oauth_refresh_tokens is 'Rotating OAuth refresh grants for the MCP resource; revoked on rotation, logout, or PAT revoke.'; +comment on column oauth_refresh_tokens.revoked_at is 'Set when the token is rotated out or revoked; a non-NULL value rejects further use.'; diff --git a/server/internal/db/postgres/oauth.go b/server/internal/db/postgres/oauth.go new file mode 100644 index 000000000..3aa3b814f --- /dev/null +++ b/server/internal/db/postgres/oauth.go @@ -0,0 +1,132 @@ +package postgres + +import ( + "context" + "fmt" + "time" + + "github.com/fclairamb/solidping/server/internal/db/models" +) + +// CreateOAuthClient inserts a new registered OAuth client. +func (s *Service) CreateOAuthClient(ctx context.Context, client *models.OAuthClient) error { + if _, err := s.db.NewInsert().Model(client).Exec(ctx); err != nil { + return fmt.Errorf("create oauth client: %w", err) + } + + return nil +} + +// GetOAuthClientByClientID looks up a client by its public client_id. +func (s *Service) GetOAuthClientByClientID(ctx context.Context, clientID string) (*models.OAuthClient, error) { + client := new(models.OAuthClient) + + err := s.db.NewSelect().Model(client).Where("client_id = ?", clientID).Scan(ctx) + if err != nil { + return nil, fmt.Errorf("get oauth client: %w", err) + } + + return client, nil +} + +// CreateOAuthAuthCode inserts a new single-use authorization code. +func (s *Service) CreateOAuthAuthCode(ctx context.Context, code *models.OAuthAuthCode) error { + if _, err := s.db.NewInsert().Model(code).Exec(ctx); err != nil { + return fmt.Errorf("create oauth auth code: %w", err) + } + + return nil +} + +// GetOAuthAuthCode fetches an authorization code by its value. +func (s *Service) GetOAuthAuthCode(ctx context.Context, code string) (*models.OAuthAuthCode, error) { + row := new(models.OAuthAuthCode) + + err := s.db.NewSelect().Model(row).Where("code = ?", code).Scan(ctx) + if err != nil { + return nil, fmt.Errorf("get oauth auth code: %w", err) + } + + return row, nil +} + +// ConsumeOAuthAuthCode atomically marks a code consumed only if it has not been +// consumed yet, returning whether this call won the race. This single-statement +// compare-and-set is the replay guard: a reused code updates zero rows. +func (s *Service) ConsumeOAuthAuthCode(ctx context.Context, code string, now time.Time) (bool, error) { + res, err := s.db.NewUpdate(). + Model((*models.OAuthAuthCode)(nil)). + Set("consumed_at = ?", now). + Where("code = ?", code). + Where("consumed_at IS NULL"). + Exec(ctx) + if err != nil { + return false, fmt.Errorf("consume oauth auth code: %w", err) + } + + affected, err := res.RowsAffected() + if err != nil { + return false, fmt.Errorf("consume oauth auth code rows: %w", err) + } + + return affected == 1, nil +} + +// CreateOAuthRefreshToken inserts a new refresh grant. +func (s *Service) CreateOAuthRefreshToken(ctx context.Context, token *models.OAuthRefreshToken) error { + if _, err := s.db.NewInsert().Model(token).Exec(ctx); err != nil { + return fmt.Errorf("create oauth refresh token: %w", err) + } + + return nil +} + +// GetOAuthRefreshToken fetches a refresh grant by its value. +func (s *Service) GetOAuthRefreshToken(ctx context.Context, token string) (*models.OAuthRefreshToken, error) { + row := new(models.OAuthRefreshToken) + + err := s.db.NewSelect().Model(row).Where("token = ?", token).Scan(ctx) + if err != nil { + return nil, fmt.Errorf("get oauth refresh token: %w", err) + } + + return row, nil +} + +// RevokeOAuthRefreshToken marks a single refresh grant revoked only if still +// active, returning whether this call performed the revocation. Used for +// rotation: the caller issues a replacement only when it won this race. +func (s *Service) RevokeOAuthRefreshToken(ctx context.Context, token string, now time.Time) (bool, error) { + res, err := s.db.NewUpdate(). + Model((*models.OAuthRefreshToken)(nil)). + Set("revoked_at = ?", now). + Where("token = ?", token). + Where("revoked_at IS NULL"). + Exec(ctx) + if err != nil { + return false, fmt.Errorf("revoke oauth refresh token: %w", err) + } + + affected, err := res.RowsAffected() + if err != nil { + return false, fmt.Errorf("revoke oauth refresh token rows: %w", err) + } + + return affected == 1, nil +} + +// RevokeOAuthRefreshTokensForUser revokes all active refresh grants for a user. +// Called on logout / PAT revoke so OAuth-issued sessions are torn down too. +func (s *Service) RevokeOAuthRefreshTokensForUser(ctx context.Context, userUID string, now time.Time) error { + _, err := s.db.NewUpdate(). + Model((*models.OAuthRefreshToken)(nil)). + Set("revoked_at = ?", now). + Where("user_uid = ?", userUID). + Where("revoked_at IS NULL"). + Exec(ctx) + if err != nil { + return fmt.Errorf("revoke oauth refresh tokens for user: %w", err) + } + + return nil +} diff --git a/server/internal/db/service.go b/server/internal/db/service.go index b7dda164a..ec4c2224b 100644 --- a/server/internal/db/service.go +++ b/server/internal/db/service.go @@ -101,6 +101,17 @@ type Service interface { UpdateUserToken(ctx context.Context, uid string, update models.UserTokenUpdate) error DeleteUserToken(ctx context.Context, uid string) error + // OAuth (MCP authorization server) operations + CreateOAuthClient(ctx context.Context, client *models.OAuthClient) error + GetOAuthClientByClientID(ctx context.Context, clientID string) (*models.OAuthClient, error) + CreateOAuthAuthCode(ctx context.Context, code *models.OAuthAuthCode) error + GetOAuthAuthCode(ctx context.Context, code string) (*models.OAuthAuthCode, error) + ConsumeOAuthAuthCode(ctx context.Context, code string, now time.Time) (bool, error) + CreateOAuthRefreshToken(ctx context.Context, token *models.OAuthRefreshToken) error + GetOAuthRefreshToken(ctx context.Context, token string) (*models.OAuthRefreshToken, error) + RevokeOAuthRefreshToken(ctx context.Context, token string, now time.Time) (bool, error) + RevokeOAuthRefreshTokensForUser(ctx context.Context, userUID string, now time.Time) error + // UserPasskey operations CreateUserPasskey(ctx context.Context, passkey *models.UserPasskey) error GetUserPasskey(ctx context.Context, uid string) (*models.UserPasskey, error) diff --git a/server/internal/db/sqlite/migrations/002_mcp_oauth.down.sql b/server/internal/db/sqlite/migrations/002_mcp_oauth.down.sql new file mode 100644 index 000000000..fa16418e8 --- /dev/null +++ b/server/internal/db/sqlite/migrations/002_mcp_oauth.down.sql @@ -0,0 +1,4 @@ +-- Rollback for the MCP OAuth 2.1 authorization server tables (SQLite). +drop table if exists oauth_refresh_tokens; +drop table if exists oauth_auth_codes; +drop table if exists oauth_clients; diff --git a/server/internal/db/sqlite/migrations/002_mcp_oauth.up.sql b/server/internal/db/sqlite/migrations/002_mcp_oauth.up.sql new file mode 100644 index 000000000..d6c30c1a2 --- /dev/null +++ b/server/internal/db/sqlite/migrations/002_mcp_oauth.up.sql @@ -0,0 +1,54 @@ +-- solidping — MCP OAuth 2.1 authorization server (spec 2026-06-20-03) +-- SQLite mirror of the PostgreSQL 002 migration. New tables for the embedded +-- authorization server fronting the MCP resource: registered clients, +-- single-use authorization codes, and rotating refresh grants. + +create table oauth_clients ( + uid text primary key, + client_id text not null, + secret_hash text, + client_name text, + redirect_uris text, + grant_types text, + scopes text, + is_public integer not null default 1, + created_at text not null default (datetime('now')), + updated_at text not null default (datetime('now')) +); + +create unique index oauth_clients_client_id_idx on oauth_clients (client_id); + +create table oauth_auth_codes ( + uid text primary key, + code text not null, + client_id text not null, + user_uid text not null references users(uid) on delete cascade, + organization_uid text not null references organizations(uid) on delete cascade, + redirect_uri text not null, + scope text not null, + resource text not null, + code_challenge text not null, + code_challenge_method text not null, + expires_at text not null, + consumed_at text, + created_at text not null default (datetime('now')) +); + +create unique index oauth_auth_codes_code_idx on oauth_auth_codes (code); +create index oauth_auth_codes_expires_idx on oauth_auth_codes (expires_at); + +create table oauth_refresh_tokens ( + uid text primary key, + token text not null, + client_id text not null, + user_uid text not null references users(uid) on delete cascade, + organization_uid text not null references organizations(uid) on delete cascade, + scope text not null, + resource text not null, + expires_at text not null, + revoked_at text, + created_at text not null default (datetime('now')) +); + +create unique index oauth_refresh_tokens_token_idx on oauth_refresh_tokens (token); +create index oauth_refresh_tokens_user_idx on oauth_refresh_tokens (user_uid) where revoked_at is null; diff --git a/server/internal/db/sqlite/oauth.go b/server/internal/db/sqlite/oauth.go new file mode 100644 index 000000000..df794419b --- /dev/null +++ b/server/internal/db/sqlite/oauth.go @@ -0,0 +1,132 @@ +package sqlite + +import ( + "context" + "fmt" + "time" + + "github.com/fclairamb/solidping/server/internal/db/models" +) + +// CreateOAuthClient inserts a new registered OAuth client. +func (s *Service) CreateOAuthClient(ctx context.Context, client *models.OAuthClient) error { + if _, err := s.db.NewInsert().Model(client).Exec(ctx); err != nil { + return fmt.Errorf("create oauth client: %w", err) + } + + return nil +} + +// GetOAuthClientByClientID looks up a client by its public client_id. +func (s *Service) GetOAuthClientByClientID(ctx context.Context, clientID string) (*models.OAuthClient, error) { + client := new(models.OAuthClient) + + err := s.db.NewSelect().Model(client).Where("client_id = ?", clientID).Scan(ctx) + if err != nil { + return nil, fmt.Errorf("get oauth client: %w", err) + } + + return client, nil +} + +// CreateOAuthAuthCode inserts a new single-use authorization code. +func (s *Service) CreateOAuthAuthCode(ctx context.Context, code *models.OAuthAuthCode) error { + if _, err := s.db.NewInsert().Model(code).Exec(ctx); err != nil { + return fmt.Errorf("create oauth auth code: %w", err) + } + + return nil +} + +// GetOAuthAuthCode fetches an authorization code by its value. +func (s *Service) GetOAuthAuthCode(ctx context.Context, code string) (*models.OAuthAuthCode, error) { + row := new(models.OAuthAuthCode) + + err := s.db.NewSelect().Model(row).Where("code = ?", code).Scan(ctx) + if err != nil { + return nil, fmt.Errorf("get oauth auth code: %w", err) + } + + return row, nil +} + +// ConsumeOAuthAuthCode atomically marks a code consumed only if it has not been +// consumed yet, returning whether this call won the race. This single-statement +// compare-and-set is the replay guard: a reused code updates zero rows. +func (s *Service) ConsumeOAuthAuthCode(ctx context.Context, code string, now time.Time) (bool, error) { + res, err := s.db.NewUpdate(). + Model((*models.OAuthAuthCode)(nil)). + Set("consumed_at = ?", now). + Where("code = ?", code). + Where("consumed_at IS NULL"). + Exec(ctx) + if err != nil { + return false, fmt.Errorf("consume oauth auth code: %w", err) + } + + affected, err := res.RowsAffected() + if err != nil { + return false, fmt.Errorf("consume oauth auth code rows: %w", err) + } + + return affected == 1, nil +} + +// CreateOAuthRefreshToken inserts a new refresh grant. +func (s *Service) CreateOAuthRefreshToken(ctx context.Context, token *models.OAuthRefreshToken) error { + if _, err := s.db.NewInsert().Model(token).Exec(ctx); err != nil { + return fmt.Errorf("create oauth refresh token: %w", err) + } + + return nil +} + +// GetOAuthRefreshToken fetches a refresh grant by its value. +func (s *Service) GetOAuthRefreshToken(ctx context.Context, token string) (*models.OAuthRefreshToken, error) { + row := new(models.OAuthRefreshToken) + + err := s.db.NewSelect().Model(row).Where("token = ?", token).Scan(ctx) + if err != nil { + return nil, fmt.Errorf("get oauth refresh token: %w", err) + } + + return row, nil +} + +// RevokeOAuthRefreshToken marks a single refresh grant revoked only if still +// active, returning whether this call performed the revocation. Used for +// rotation: the caller issues a replacement only when it won this race. +func (s *Service) RevokeOAuthRefreshToken(ctx context.Context, token string, now time.Time) (bool, error) { + res, err := s.db.NewUpdate(). + Model((*models.OAuthRefreshToken)(nil)). + Set("revoked_at = ?", now). + Where("token = ?", token). + Where("revoked_at IS NULL"). + Exec(ctx) + if err != nil { + return false, fmt.Errorf("revoke oauth refresh token: %w", err) + } + + affected, err := res.RowsAffected() + if err != nil { + return false, fmt.Errorf("revoke oauth refresh token rows: %w", err) + } + + return affected == 1, nil +} + +// RevokeOAuthRefreshTokensForUser revokes all active refresh grants for a user. +// Called on logout / PAT revoke so OAuth-issued sessions are torn down too. +func (s *Service) RevokeOAuthRefreshTokensForUser(ctx context.Context, userUID string, now time.Time) error { + _, err := s.db.NewUpdate(). + Model((*models.OAuthRefreshToken)(nil)). + Set("revoked_at = ?", now). + Where("user_uid = ?", userUID). + Where("revoked_at IS NULL"). + Exec(ctx) + if err != nil { + return fmt.Errorf("revoke oauth refresh tokens for user: %w", err) + } + + return nil +} diff --git a/server/internal/handlers/auth/service.go b/server/internal/handlers/auth/service.go index 593961645..65f376c65 100644 --- a/server/internal/handlers/auth/service.go +++ b/server/internal/handlers/auth/service.go @@ -809,6 +809,12 @@ func (s *Service) LogoutUser(ctx context.Context, userUID string) (*LogoutRespon deleted++ } + // Tear down any OAuth-issued MCP refresh grants for this user too, so a + // full logout also invalidates connectors authorized via the OAuth flow. + if revokeErr := s.db.RevokeOAuthRefreshTokensForUser(ctx, userUID, time.Now()); revokeErr != nil { + slog.ErrorContext(ctx, "Failed to revoke OAuth refresh tokens on logout", "error", revokeErr, "userUID", userUID) + } + return &LogoutResponse{ Success: true, TokensDeleted: deleted, @@ -1326,6 +1332,12 @@ func (s *Service) RevokeToken(ctx context.Context, userUID, tokenUID string) err s.cacheMux.Lock() delete(s.patCache, token.Token) s.cacheMux.Unlock() + + // A PAT revoke should also tear down OAuth-issued MCP refresh grants for + // the user, matching the spec's "revocation on logout/PAT-revoke". + if revokeErr := s.db.RevokeOAuthRefreshTokensForUser(ctx, userUID, time.Now()); revokeErr != nil { + slog.ErrorContext(ctx, "Failed to revoke OAuth refresh tokens on PAT revoke", "error", revokeErr, "userUID", userUID) + } } return s.db.DeleteUserToken(ctx, tokenUID) @@ -1503,6 +1515,39 @@ func (s *Service) generateAccessToken(userUID, orgSlug, role string) (string, er return token.SignedString([]byte(s.cfg.JWTSecret)) } +// GenerateMCPAccessToken mints a short-lived, audience-bound JWT access token +// for the embedded OAuth 2.1 authorization server (MCP resource). It reuses the +// existing HS256 signing key so the token is validated by the same code path as +// session JWTs and PATs, but adds: +// - aud = the MCP resource (RFC 8707 audience binding), so the token cannot be +// replayed at other SolidPing surfaces, and +// - the consented scopes (mcp / mcp:read), which the MCP handler enforces. +// +// ttl is supplied by the caller so the OAuth service controls the access-token +// lifetime independently of the dashboard's session expiry. +func (s *Service) GenerateMCPAccessToken( + userUID, orgSlug string, scopes []string, audience string, ttl time.Duration, +) (string, error) { + now := time.Now() + claims := &Claims{ + UserUID: userUID, + OrgSlug: orgSlug, + Scopes: scopes, + RegisteredClaims: jwt.RegisteredClaims{ + ExpiresAt: jwt.NewNumericDate(now.Add(ttl)), + IssuedAt: jwt.NewNumericDate(now), + NotBefore: jwt.NewNumericDate(now), + Issuer: jwtIssuer, + Audience: jwt.ClaimStrings{audience}, + ID: uuid.New().String(), + }, + } + + token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims) + + return token.SignedString([]byte(s.cfg.JWTSecret)) +} + const refreshTokenSize = 32 func (s *Service) generateRefreshToken() (string, error) { diff --git a/server/internal/middleware/auth.go b/server/internal/middleware/auth.go index cec85e814..97169b71e 100644 --- a/server/internal/middleware/auth.go +++ b/server/internal/middleware/auth.go @@ -15,6 +15,7 @@ import ( "github.com/fclairamb/solidping/server/internal/db/models" "github.com/fclairamb/solidping/server/internal/handlers/auth" "github.com/fclairamb/solidping/server/internal/handlers/base" + "github.com/fclairamb/solidping/server/internal/oauth" ) // Use context keys from base package to avoid import cycles. @@ -30,6 +31,7 @@ type AuthMiddleware struct { base.HandlerBase authService *auth.Service dbService db.Service + cfg *config.Config } // NewAuthMiddleware creates a new authentication middleware. @@ -38,6 +40,7 @@ func NewAuthMiddleware(authService *auth.Service, dbService db.Service, cfg *con HandlerBase: base.NewHandlerBase(cfg), authService: authService, dbService: dbService, + cfg: cfg, } } @@ -80,6 +83,61 @@ func (m *AuthMiddleware) RequireAuth(next bunrouter.HandlerFunc) bunrouter.Handl } } +// RequireMCPAuth is RequireAuth specialized for the MCP resource server. It +// behaves like RequireAuth for valid credentials but, on any authentication +// failure, emits the OAuth 2.1 discovery hook required by the MCP authorization +// spec: HTTP 401 with a `WWW-Authenticate: Bearer resource_metadata="…"` header +// pointing at the protected-resource metadata, so a standard MCP client can +// discover the authorization server and start the OAuth flow. +// +// It also enforces RFC 8707 audience binding: an access token carrying an `aud` +// claim is accepted only if that audience includes the MCP resource. Tokens with +// no audience (PATs, legacy session JWTs) pass the audience gate for +// back-compat — the MCP handler's scope check still governs them. +func (m *AuthMiddleware) RequireMCPAuth(next bunrouter.HandlerFunc) bunrouter.HandlerFunc { + return func(writer http.ResponseWriter, req bunrouter.Request) error { + md := oauth.NewMetadata(m.cfg.Server.BaseURL) + + token := extractToken(req.Request) + if token == "" { + return m.writeMCPChallenge(writer, md, base.ErrorCodeNoToken, "Authorization token is required") + } + + claims, err := m.authService.ValidateToken(req.Context(), token) + if err != nil { + return m.writeMCPChallenge(writer, md, base.ErrorCodeInvalidToken, "Invalid or expired token") + } + + // Audience binding (RFC 8707): reject a token minted for another resource. + if !oauth.TokenHasResourceAudience(claims, md.ResourceURL()) { + return m.writeMCPChallenge(writer, md, base.ErrorCodeInvalidToken, + "Token audience does not include the MCP resource") + } + + user, err := m.dbService.GetUser(req.Context(), claims.UserUID) + if err != nil { + return m.writeMCPChallenge(writer, md, base.ErrorCodeUserNotFound, "User not found") + } + + ctx := req.Context() + ctx = context.WithValue(ctx, base.ContextKeyClaims, claims) + ctx = context.WithValue(ctx, base.ContextKeyUser, user) + + return next(writer, req.WithContext(ctx)) + } +} + +// writeMCPChallenge writes a 401 carrying the RFC 9728 resource_metadata pointer +// so MCP clients can discover the authorization server. +func (m *AuthMiddleware) writeMCPChallenge( + writer http.ResponseWriter, md oauth.Metadata, code base.ErrorCode, message string, +) error { + writer.Header().Set("WWW-Authenticate", + `Bearer resource_metadata="`+md.ProtectedResourceMetadataURL()+`"`) + + return m.WriteError(writer, http.StatusUnauthorized, code, message) +} + // RequireOrgAccess is a middleware that verifies the user has access to the organization. // Must be used after RequireAuth. func (m *AuthMiddleware) RequireOrgAccess(next bunrouter.HandlerFunc) bunrouter.HandlerFunc { diff --git a/server/internal/oauth/audience.go b/server/internal/oauth/audience.go new file mode 100644 index 000000000..b261031e4 --- /dev/null +++ b/server/internal/oauth/audience.go @@ -0,0 +1,32 @@ +package oauth + +import "github.com/fclairamb/solidping/server/internal/handlers/auth" + +// TokenHasResourceAudience reports whether the credential is allowed to act on +// the given resource based on its audience binding (RFC 8707). +// +// Back-compat is the whole point of the empty-audience case: PATs and legacy +// session JWTs carry no `aud` claim and must keep working — they pass the +// audience gate and are governed solely by the existing scope check. An OAuth +// access token, by contrast, is minted with `aud` = the MCP resource, so it is +// accepted here only when its audience list contains that exact resource. This +// stops a token issued for one resource from being replayed at another. +func TokenHasResourceAudience(claims *auth.Claims, resource string) bool { + if claims == nil { + return false + } + + aud := claims.RegisteredClaims.Audience + if len(aud) == 0 { + // No audience binding → PAT / legacy session token → back-compat path. + return true + } + + for _, a := range aud { + if a == resource { + return true + } + } + + return false +} diff --git a/server/internal/oauth/authorize.go b/server/internal/oauth/authorize.go new file mode 100644 index 000000000..1a594bc53 --- /dev/null +++ b/server/internal/oauth/authorize.go @@ -0,0 +1,292 @@ +package oauth + +import ( + "net/http" + "net/url" + "strings" + + "github.com/uptrace/bunrouter" + + "github.com/fclairamb/solidping/server/internal/handlers/auth" + "github.com/fclairamb/solidping/server/internal/handlers/base" +) + +// authRequest is a validated /authorize request, populated only after every +// parameter has passed its check. The handler builds it once on GET and again on +// the approve POST so the consent UI cannot smuggle altered parameters past +// validation. +type authRequest struct { + ClientID string + RedirectURI string + ResponseType string + Scope string + State string + Resource string + CodeChallenge string + CodeChallengeMethod string +} + +// parseAuthRequest reads the OAuth authorization parameters from the query +// string (GET) or form body (POST). +func parseAuthRequest(req *http.Request) authRequest { + get := req.URL.Query().Get + if req.Method == http.MethodPost { + _ = req.ParseForm() + get = req.Form.Get + } + + return authRequest{ + ClientID: get("client_id"), + RedirectURI: get("redirect_uri"), + ResponseType: get("response_type"), + Scope: get("scope"), + State: get("state"), + Resource: get("resource"), + CodeChallenge: get("code_challenge"), + CodeChallengeMethod: get("code_challenge_method"), + } +} + +// validateAuthRequest applies every authorization-request check in spec order. +// Errors that occur before a trusted redirect_uri is established are returned as +// render errors (shown to the user) so we never redirect to an unvalidated URI; +// once client + redirect_uri are trusted, later errors redirect back to the +// client per RFC 6749 §4.1.2.1. +func (h *Handler) validateAuthRequest(req bunrouter.Request, ar authRequest) (*authRequest, *authError) { + md := h.metadata() + + if ar.ClientID == "" { + return nil, newRenderError(ErrInvalidRequest, "client_id is required") + } + + client, err := h.svc.GetClient(req.Context(), ar.ClientID) + if err != nil { + return nil, newRenderError(ErrInvalidClient, "unknown client_id") + } + + // redirect_uri must match a registered URI exactly (loopback ignores port). + if ar.RedirectURI == "" || !RedirectURIAllowed(ar.RedirectURI, client.RedirectURIs) { + return nil, newRenderError(ErrInvalidRedirectURI, "redirect_uri is not registered for this client") + } + + // From here on a trusted redirect target exists → report errors by redirect. + if ar.ResponseType != "code" { + return nil, newRedirectError(ErrUnsupportedResponseType, + "only response_type=code is supported", ar.RedirectURI, ar.State) + } + + // PKCE is mandatory and S256-only (OAuth 2.1 forbids plain). + if ar.CodeChallenge == "" { + return nil, newRedirectError(ErrInvalidRequest, "code_challenge is required (PKCE)", + ar.RedirectURI, ar.State) + } + + if ar.CodeChallengeMethod == "" { + ar.CodeChallengeMethod = CodeChallengeMethodS256 + } + + if ar.CodeChallengeMethod != CodeChallengeMethodS256 { + return nil, newRedirectError(ErrInvalidRequest, + "code_challenge_method must be S256", ar.RedirectURI, ar.State) + } + + if !validCodeChallenge(ar.CodeChallenge) { + return nil, newRedirectError(ErrInvalidRequest, "malformed code_challenge", + ar.RedirectURI, ar.State) + } + + // scope defaults to full mcp; explicit scopes must be recognized. + if ar.Scope == "" { + ar.Scope = ScopeMCP + } + + if !ScopesValid(ParseScopes(ar.Scope)) { + return nil, newRedirectError(ErrInvalidScope, "unsupported scope requested", + ar.RedirectURI, ar.State) + } + + // resource (RFC 8707) must match the MCP resource when supplied; default it. + if ar.Resource == "" { + ar.Resource = md.ResourceURL() + } + + if ar.Resource != md.ResourceURL() { + return nil, newRedirectError(ErrInvalidRequest, + "resource does not match the MCP resource", ar.RedirectURI, ar.State) + } + + return &ar, nil +} + +// session extracts and validates the logged-in user from the request's +// access_token cookie (set by the dashboard login) or bearer header. Returns the +// claims when a valid session exists. +func (h *Handler) session(req bunrouter.Request) (*auth.Claims, bool) { + token := extractSessionToken(req.Request) + if token == "" { + return nil, false + } + + claims, err := h.svc.authSvc.ValidateToken(req.Context(), token) + if err != nil { + return nil, false + } + + return claims, true +} + +// Authorize is the GET authorization endpoint. It validates the request, then +// either redirects to the dashboard login (no session) or to the dashboard +// consent screen (valid session). The actual code is minted by ApproveAuthorize +// once the user consents. +func (h *Handler) Authorize(w http.ResponseWriter, req bunrouter.Request) error { + raw := parseAuthRequest(req.Request) + + ar, authErr := h.validateAuthRequest(req, raw) + if authErr != nil { + return h.handleAuthError(w, req, authErr) + } + + claims, ok := h.session(req) + if !ok { + // No session → bounce through the dashboard login, returning here after. + h.redirectToLogin(w, req) + + return nil + } + + // Valid session → hand off to the consent SPA route, which will POST back to + // approve. Pass the already-validated parameters through. + h.redirectToConsent(w, claims.OrgSlug, ar) + + return nil +} + +// ApproveAuthorize is the POST authorization endpoint hit when the user approves +// the consent screen. It re-validates the request, requires a session, mints a +// single-use code bound to the grant, and redirects to the client's redirect_uri +// with code + state. +func (h *Handler) ApproveAuthorize(w http.ResponseWriter, req bunrouter.Request) error { + raw := parseAuthRequest(req.Request) + + ar, authErr := h.validateAuthRequest(req, raw) + if authErr != nil { + return h.handleAuthError(w, req, authErr) + } + + claims, ok := h.session(req) + if !ok { + return h.WriteError(w, http.StatusUnauthorized, base.ErrorCodeUnauthorized, + "A logged-in session is required to authorize") + } + + org, err := h.svc.db.GetOrganizationBySlug(req.Context(), claims.OrgSlug) + if err != nil { + return h.WriteInternalError(w, err) + } + + code, err := h.svc.IssueAuthCode(req.Context(), AuthCodeGrant{ + ClientID: ar.ClientID, + UserUID: claims.UserUID, + OrgUID: org.UID, + OrgSlug: claims.OrgSlug, + RedirectURI: ar.RedirectURI, + Scope: ar.Scope, + Resource: ar.Resource, + CodeChallenge: ar.CodeChallenge, + CodeChallengeMethod: ar.CodeChallengeMethod, + }) + if err != nil { + return h.WriteInternalError(w, err) + } + + dest := appendQuery(ar.RedirectURI, map[string]string{"code": code, "state": ar.State}) + http.Redirect(w, req.Request, dest, http.StatusFound) + + return nil +} + +// handleAuthError reports a validation error either by redirecting back to the +// client (safe target established) or by rendering an error to the user. +func (h *Handler) handleAuthError(w http.ResponseWriter, req bunrouter.Request, e *authError) error { + if e.Redirect && e.RedirectURI != "" { + dest := appendQuery(e.RedirectURI, map[string]string{ + "error": e.Code, + "error_description": e.Description, + "state": e.State, + }) + http.Redirect(w, req.Request, dest, http.StatusFound) + + return nil + } + + return h.WriteError(w, http.StatusBadRequest, base.ErrorCodeValidationError, e.Error()) +} + +// redirectToLogin bounces an unauthenticated /authorize request through the +// dashboard login, encoding the full original request as returnTo so the browser +// lands back here (now carrying the session cookie) after logging in. +func (h *Handler) redirectToLogin(w http.ResponseWriter, req bunrouter.Request) { + returnTo := h.metadata().Issuer + req.URL.RequestURI() + loginURL := "/dash0/login?returnTo=" + url.QueryEscape(returnTo) + http.Redirect(w, req.Request, loginURL, http.StatusFound) +} + +// redirectToConsent sends the browser to the dashboard consent SPA route with +// the validated authorization parameters so the user can approve or deny. +func (h *Handler) redirectToConsent(w http.ResponseWriter, orgSlug string, ar *authRequest) { + q := url.Values{} + q.Set("client_id", ar.ClientID) + q.Set("redirect_uri", ar.RedirectURI) + q.Set("response_type", ar.ResponseType) + q.Set("scope", ar.Scope) + q.Set("state", ar.State) + q.Set("resource", ar.Resource) + q.Set("code_challenge", ar.CodeChallenge) + q.Set("code_challenge_method", ar.CodeChallengeMethod) + + consentURL := "/dash0/orgs/" + url.PathEscape(orgSlug) + "/oauth/consent?" + q.Encode() + w.Header().Set("Location", consentURL) + w.WriteHeader(http.StatusFound) +} + +// extractSessionToken pulls the session token from the access_token cookie or a +// bearer Authorization header (mirrors middleware.extractToken without importing +// the middleware package, to avoid an import cycle). +func extractSessionToken(req *http.Request) string { + if authHeader := req.Header.Get("Authorization"); authHeader != "" { + parts := strings.SplitN(authHeader, " ", 2) + if len(parts) == 2 && strings.EqualFold(parts[0], "bearer") { + return parts[1] + } + + return "" + } + + if cookie, err := req.Cookie("access_token"); err == nil { + return cookie.Value + } + + return "" +} + +// appendQuery appends the given non-empty params to a URL's query string, +// preserving any existing query. +func appendQuery(rawURL string, params map[string]string) string { + u, err := url.Parse(rawURL) + if err != nil { + return rawURL + } + + q := u.Query() + + for k, v := range params { + if v != "" { + q.Set(k, v) + } + } + + u.RawQuery = q.Encode() + + return u.String() +} diff --git a/server/internal/oauth/client.go b/server/internal/oauth/client.go new file mode 100644 index 000000000..2ac81c8e4 --- /dev/null +++ b/server/internal/oauth/client.go @@ -0,0 +1,116 @@ +package oauth + +import ( + "net" + "net/url" + "strings" +) + +// IsLoopbackRedirectURI reports whether a redirect URI is a permitted native +// loopback redirect (RFC 8252 §7.3): an http URL whose host is the IPv4 or IPv6 +// loopback address or the literal "localhost", on any port. Native MCP clients +// (Claude Desktop, mcp-remote) spin up an ephemeral loopback listener and cannot +// pre-register an exact port, so the port is intentionally not matched. +// +// Everything else over http is rejected — plaintext http to a non-loopback host +// would leak the authorization code in transit. +func IsLoopbackRedirectURI(redirectURI string) bool { + u, err := url.Parse(redirectURI) + if err != nil { + return false + } + + if u.Scheme != "http" { + return false + } + + host := u.Hostname() + if host == "localhost" { + return true + } + + ip := net.ParseIP(host) + + return ip != nil && ip.IsLoopback() +} + +// IsValidRedirectURI reports whether a redirect URI is acceptable to register or +// to use at /authorize when no exact allow-list match is required: +// - loopback http (native clients), or +// - https with a host (registered web clients). +// +// A bare http non-loopback URI, a missing host, or a fragment (forbidden by +// RFC 6749 §3.1.2) is rejected. +func IsValidRedirectURI(redirectURI string) bool { + u, err := url.Parse(redirectURI) + if err != nil || u.Host == "" || u.Fragment != "" { + return false + } + + if IsLoopbackRedirectURI(redirectURI) { + return true + } + + return u.Scheme == "https" +} + +// RedirectURIAllowed reports whether requestedURI is permitted for a client whose +// registered redirect URIs are registered. Registered web URIs require an exact +// string match (no substring / prefix matching — that is a classic open-redirect +// bug). Loopback URIs match a registered loopback entry ignoring only the port, +// since the native client's port is ephemeral. +func RedirectURIAllowed(requestedURI string, registered []string) bool { + if requestedURI == "" { + return false + } + + for _, reg := range registered { + if reg == requestedURI { + return true + } + + // Loopback: match host+path, ignore the ephemeral port. + if IsLoopbackRedirectURI(reg) && IsLoopbackRedirectURI(requestedURI) && + loopbackHostPathEqual(reg, requestedURI) { + return true + } + } + + return false +} + +// loopbackHostPathEqual compares two loopback redirect URIs ignoring the port. +func loopbackHostPathEqual(a, b string) bool { + ua, err := url.Parse(a) + if err != nil { + return false + } + + ub, err := url.Parse(b) + if err != nil { + return false + } + + return ua.Hostname() == ub.Hostname() && ua.Path == ub.Path +} + +// ScopesValid reports whether every requested scope is a recognized MCP scope. +// An empty request defaults to the full "mcp" scope at the call site, so this +// only validates explicitly-requested scopes. +func ScopesValid(scopes []string) bool { + for _, s := range scopes { + if s != ScopeMCP && s != ScopeMCPRead { + return false + } + } + + return true +} + +// ParseScopes splits a space-delimited scope string (RFC 6749 §3.3) into a slice, +// dropping empty entries. +func ParseScopes(scope string) []string { + fields := strings.Fields(scope) + + return fields +} diff --git a/server/internal/oauth/errors.go b/server/internal/oauth/errors.go new file mode 100644 index 000000000..c2a3f878f --- /dev/null +++ b/server/internal/oauth/errors.go @@ -0,0 +1,63 @@ +package oauth + +// OAuth 2.0 error codes (RFC 6749 §4.1.2.1 / §5.2, RFC 7591 §3.2.2). These are +// the wire values returned in the `error` field of a token/registration error +// response or appended to a redirect URI on an authorization error. +const ( + ErrInvalidRequest = "invalid_request" + ErrInvalidClient = "invalid_client" + ErrInvalidGrant = "invalid_grant" + ErrUnauthorizedClient = "unauthorized_client" + ErrUnsupportedGrantType = "unsupported_grant_type" + ErrUnsupportedResponseType = "unsupported_response_type" + ErrInvalidScope = "invalid_scope" + ErrAccessDenied = "access_denied" + ErrServerError = "server_error" + ErrInvalidRedirectURI = "invalid_redirect_uri" + ErrInvalidClientMetadata = "invalid_client_metadata" +) + +// errorBody is the RFC 6749 §5.2 / RFC 7591 §3.2.2 error JSON shape. +type errorBody struct { + Error string `json:"error"` + ErrorDescription string `json:"error_description,omitempty"` +} + +// authError is a structured authorization-time error. It distinguishes errors +// that must be reported by redirecting back to the client (a valid client + +// redirect_uri were established) from errors that must NOT redirect (the client +// or redirect_uri itself is untrusted) — redirecting an unvalidated URI would be +// an open redirector. +type authError struct { + Code string + Description string + Redirect bool // true → report via redirect; false → render an error page + RedirectURI string // populated when Redirect is true + State string // echoed back on redirect +} + +func (e *authError) Error() string { + if e.Description != "" { + return e.Code + ": " + e.Description + } + + return e.Code +} + +// newRenderError builds an authorization error that must be shown to the user +// (no safe redirect target). +func newRenderError(code, description string) *authError { + return &authError{Code: code, Description: description, Redirect: false} +} + +// newRedirectError builds an authorization error reported back to the client by +// redirecting to its validated redirect_uri. +func newRedirectError(code, description, redirectURI, state string) *authError { + return &authError{ + Code: code, + Description: description, + Redirect: true, + RedirectURI: redirectURI, + State: state, + } +} diff --git a/server/internal/oauth/handler.go b/server/internal/oauth/handler.go new file mode 100644 index 000000000..c297c212c --- /dev/null +++ b/server/internal/oauth/handler.go @@ -0,0 +1,60 @@ +package oauth + +import ( + "net/http" + + "github.com/uptrace/bunrouter" + + "github.com/fclairamb/solidping/server/internal/config" + "github.com/fclairamb/solidping/server/internal/handlers/base" +) + +// Handler exposes the OAuth 2.1 authorization-server HTTP surface: discovery +// documents, the authorization and token endpoints, and dynamic client +// registration. It is constructed once and mounted by the app server. +type Handler struct { + base.HandlerBase + svc *Service + cfg *config.Config +} + +// NewHandler builds the OAuth handler. +func NewHandler(svc *Service, cfg *config.Config) *Handler { + return &Handler{ + HandlerBase: base.NewHandlerBase(cfg), + svc: svc, + cfg: cfg, + } +} + +// metadata resolves the issuer-derived URLs from the current config. Reading it +// per request keeps a runtime base-URL override (system-parameters overlay) +// authoritative. +func (h *Handler) metadata() Metadata { + return NewMetadata(h.cfg.Server.BaseURL) +} + +// writeNoStoreJSON writes a JSON body with caching disabled. OAuth metadata and +// token responses must not be cached by intermediaries (RFC 6749 §5.1). +func (h *Handler) writeNoStoreJSON(w http.ResponseWriter, status int, data any) error { + w.Header().Set("Cache-Control", "no-store") + w.Header().Set("Pragma", "no-cache") + + return h.WriteJSON(w, status, data) +} + +// ProtectedResourceMetadata serves the RFC 9728 document. Public, no auth. +func (h *Handler) ProtectedResourceMetadata(w http.ResponseWriter, _ bunrouter.Request) error { + return h.WriteJSON(w, http.StatusOK, h.metadata().BuildProtectedResourceMetadata()) +} + +// AuthorizationServerMetadata serves the RFC 8414 document (and its OIDC alias). +// Public, no auth. +func (h *Handler) AuthorizationServerMetadata(w http.ResponseWriter, _ bunrouter.Request) error { + return h.WriteJSON(w, http.StatusOK, h.metadata().BuildAuthorizationServerMetadata()) +} + +// JWKS serves the (empty, symmetric-key) JSON Web Key Set. Public, no auth. +func (h *Handler) JWKS(w http.ResponseWriter, _ bunrouter.Request) error { + return h.WriteJSON(w, http.StatusOK, BuildJWKS()) +} diff --git a/server/internal/oauth/jwks.go b/server/internal/oauth/jwks.go new file mode 100644 index 000000000..cb8ebd175 --- /dev/null +++ b/server/internal/oauth/jwks.go @@ -0,0 +1,33 @@ +package oauth + +// JWKS publication. +// +// SECURITY NOTE — v1 reuses the existing HS256 (symmetric) JWT signing key. +// For a symmetric key, the verification key *is* the signing secret, so it must +// NEVER be published: anyone holding it could forge tokens. RFC 8414 still +// requires a jwks_uri, so we advertise the endpoint and serve a well-formed but +// empty key set. MCP clients do not need to verify tokens locally — the MCP +// resource server (SolidPing itself) validates every access token against the +// secret it holds. Migrating to an asymmetric keyset (RS256/ES256) and +// publishing the public half here is the documented follow-on hardening step +// (spec "Remaining open questions" #4). + +// JWK is a single JSON Web Key (RFC 7517). Only the public-safe fields are +// modeled; we never emit symmetric key material. +type JWK struct { + KeyType string `json:"kty"` + Use string `json:"use,omitempty"` + Algorithm string `json:"alg,omitempty"` + KeyID string `json:"kid,omitempty"` +} + +// JWKS is a JSON Web Key Set (RFC 7517). +type JWKS struct { + Keys []JWK `json:"keys"` +} + +// BuildJWKS returns the published key set. With the symmetric v1 key this is an +// empty set by design (see the security note above) — never the HMAC secret. +func BuildJWKS() JWKS { + return JWKS{Keys: []JWK{}} +} diff --git a/server/internal/oauth/metadata.go b/server/internal/oauth/metadata.go new file mode 100644 index 000000000..34f146c1c --- /dev/null +++ b/server/internal/oauth/metadata.go @@ -0,0 +1,151 @@ +// Package oauth implements the minimal embedded OAuth 2.1 authorization +// server that fronts the MCP resource. SolidPing is both the resource server +// (the MCP endpoint) and the authorization server for that resource: it serves +// the RFC 9728 / RFC 8414 discovery documents, drives the authorization-code + +// PKCE flow against the existing user session, mints audience-bound JWT access +// tokens via the existing auth-service signing key, and supports RFC 7591 +// dynamic client registration for native clients (Claude Desktop / mcp-remote). +// +// Scope of v1: a single issuer (cfg.Server.BaseURL); the org is taken from the +// logged-in user's session at /authorize. Tokens reuse the existing HS256 JWT +// machinery — only the discovery, consent, code/token, and DCR surfaces are new. +package oauth + +import "strings" + +// MCP scope values understood by the authorization server. These mirror the +// scopes the MCP handler consumes (internal/mcp/scope.go) — "mcp" grants full +// tool access, "mcp:read" restricts to non-mutating tools. +const ( + ScopeMCP = "mcp" + ScopeMCPRead = "mcp:read" +) + +// Discovery document paths (all public, served at the site root rather than +// under /api/v1 so standard MCP clients find them where the specs require). +const ( + // PathProtectedResourceMetadata is the RFC 9728 protected-resource metadata. + PathProtectedResourceMetadata = "/.well-known/oauth-protected-resource" + // PathAuthorizationServerMetadata is the RFC 8414 AS metadata. + PathAuthorizationServerMetadata = "/.well-known/oauth-authorization-server" + // PathOpenIDConfiguration is the OIDC discovery alias many clients probe. + PathOpenIDConfiguration = "/.well-known/openid-configuration" + // PathJWKS publishes the token verification key(s). + PathJWKS = "/.well-known/jwks.json" + + // PathAuthorize is the authorization endpoint (session-gated). + PathAuthorize = "/api/v1/oauth/authorize" + // PathToken is the token endpoint. + PathToken = "/api/v1/oauth/token" + // PathRegister is the RFC 7591 dynamic client registration endpoint. + PathRegister = "/api/v1/oauth/register" + + // PathMCP is the protected MCP resource. + PathMCP = "/api/v1/mcp" +) + +// Metadata centralizes the issuer-derived URLs every handler needs. It is built +// once per request from cfg.Server.BaseURL so a runtime base-URL override (via +// the system-parameters overlay) is always reflected. +type Metadata struct { + // Issuer is the OAuth issuer identifier — SolidPing's own base URL. + Issuer string +} + +// NewMetadata builds a Metadata from the resolved public base URL. A trailing +// slash on baseURL is trimmed so concatenated paths never double up. +func NewMetadata(baseURL string) Metadata { + return Metadata{Issuer: strings.TrimRight(baseURL, "/")} +} + +// ResourceURL returns the canonical MCP resource identifier used as the token +// audience and advertised in the protected-resource metadata. +func (m Metadata) ResourceURL() string { + return m.Issuer + PathMCP +} + +// AuthorizationEndpoint returns the absolute /authorize URL. +func (m Metadata) AuthorizationEndpoint() string { + return m.Issuer + PathAuthorize +} + +// TokenEndpoint returns the absolute /token URL. +func (m Metadata) TokenEndpoint() string { + return m.Issuer + PathToken +} + +// RegistrationEndpoint returns the absolute /register URL. +func (m Metadata) RegistrationEndpoint() string { + return m.Issuer + PathRegister +} + +// JWKSURI returns the absolute jwks_uri. +func (m Metadata) JWKSURI() string { + return m.Issuer + PathJWKS +} + +// ProtectedResourceMetadataURL returns the absolute RFC 9728 metadata URL, +// the value advertised in the WWW-Authenticate resource_metadata pointer. +func (m Metadata) ProtectedResourceMetadataURL() string { + return m.Issuer + PathProtectedResourceMetadata +} + +// ProtectedResourceMetadata is the RFC 9728 document served at +// /.well-known/oauth-protected-resource. It tells a client which authorization +// server(s) issue tokens for this resource and which scopes it understands. +type ProtectedResourceMetadata struct { + Resource string `json:"resource"` + AuthorizationServers []string `json:"authorization_servers"` + ScopesSupported []string `json:"scopes_supported"` + BearerMethods []string `json:"bearer_methods_supported"` +} + +// BuildProtectedResourceMetadata assembles the RFC 9728 document. +func (m Metadata) BuildProtectedResourceMetadata() ProtectedResourceMetadata { + return ProtectedResourceMetadata{ + Resource: m.ResourceURL(), + AuthorizationServers: []string{m.Issuer}, + ScopesSupported: []string{ScopeMCP, ScopeMCPRead}, + BearerMethods: []string{"header"}, + } +} + +// AuthorizationServerMetadata is the RFC 8414 document served at +// /.well-known/oauth-authorization-server (and aliased at +// /.well-known/openid-configuration). +type AuthorizationServerMetadata struct { + Issuer string `json:"issuer"` + AuthorizationEndpoint string `json:"authorization_endpoint"` + TokenEndpoint string `json:"token_endpoint"` + RegistrationEndpoint string `json:"registration_endpoint"` + JWKSURI string `json:"jwks_uri"` + ScopesSupported []string `json:"scopes_supported"` + ResponseTypesSupported []string `json:"response_types_supported"` + GrantTypesSupported []string `json:"grant_types_supported"` + CodeChallengeMethodsSupported []string `json:"code_challenge_methods_supported"` + TokenEndpointAuthMethodsSupported []string `json:"token_endpoint_auth_methods_supported"` +} + +// BuildAuthorizationServerMetadata assembles the RFC 8414 document. PKCE is +// S256-only and the implicit grant is deliberately absent (OAuth 2.1). +func (m Metadata) BuildAuthorizationServerMetadata() AuthorizationServerMetadata { + return AuthorizationServerMetadata{ + Issuer: m.Issuer, + AuthorizationEndpoint: m.AuthorizationEndpoint(), + TokenEndpoint: m.TokenEndpoint(), + RegistrationEndpoint: m.RegistrationEndpoint(), + JWKSURI: m.JWKSURI(), + ScopesSupported: []string{ScopeMCP, ScopeMCPRead}, + ResponseTypesSupported: []string{"code"}, + GrantTypesSupported: []string{GrantAuthorizationCode, GrantRefreshToken}, + CodeChallengeMethodsSupported: []string{CodeChallengeMethodS256}, + TokenEndpointAuthMethodsSupported: []string{"none", "client_secret_post"}, + } +} + +// Grant types and PKCE method constants shared across the package. +const ( + GrantAuthorizationCode = "authorization_code" + GrantRefreshToken = "refresh_token" + CodeChallengeMethodS256 = "S256" +) diff --git a/server/internal/oauth/pkce.go b/server/internal/oauth/pkce.go new file mode 100644 index 000000000..9f859ade8 --- /dev/null +++ b/server/internal/oauth/pkce.go @@ -0,0 +1,40 @@ +package oauth + +import ( + "crypto/sha256" + "crypto/subtle" + "encoding/base64" +) + +// VerifyPKCE checks an RFC 7636 code_verifier against a stored S256 +// code_challenge. Only the S256 method is supported (OAuth 2.1 forbids the +// `plain` method); callers must reject any other method before reaching here. +// +// The verifier is hashed with SHA-256 and base64url-encoded (no padding); the +// result is compared to the stored challenge in constant time so a timing +// side-channel cannot be used to forge a matching verifier. +func VerifyPKCE(codeVerifier, codeChallenge string) bool { + if codeVerifier == "" || codeChallenge == "" { + return false + } + + sum := sha256.Sum256([]byte(codeVerifier)) + computed := base64.RawURLEncoding.EncodeToString(sum[:]) + + return subtle.ConstantTimeCompare([]byte(computed), []byte(codeChallenge)) == 1 +} + +// PKCE verifier length bounds from RFC 7636 §4.1: 43–128 characters. +const ( + pkceVerifierMinLen = 43 + pkceVerifierMaxLen = 128 +) + +// validCodeChallenge reports whether a code_challenge is plausibly a base64url +// S256 challenge (length within the RFC bounds for the encoded 32-byte hash). +func validCodeChallenge(challenge string) bool { + // A SHA-256 digest base64url-encoded without padding is 43 chars; we allow + // the full verifier range as a permissive upper bound rather than rejecting + // a well-formed challenge on a strict equality check. + return len(challenge) >= pkceVerifierMinLen && len(challenge) <= pkceVerifierMaxLen +} diff --git a/server/internal/oauth/register.go b/server/internal/oauth/register.go new file mode 100644 index 000000000..5b406a97b --- /dev/null +++ b/server/internal/oauth/register.go @@ -0,0 +1,111 @@ +package oauth + +import ( + "encoding/json" + "net/http" + + "github.com/uptrace/bunrouter" +) + +// registrationRequest is the RFC 7591 §2 client-metadata request body. Only the +// fields the MCP flow needs are modeled; unknown fields are ignored. +type registrationRequest struct { + RedirectURIs []string `json:"redirect_uris"` + ClientName string `json:"client_name"` + GrantTypes []string `json:"grant_types"` + ResponseTypes []string `json:"response_types"` + Scope string `json:"scope"` + TokenEndpointAuthMethod string `json:"token_endpoint_auth_method"` +} + +// registrationResponse is the RFC 7591 §3.2.1 success response. client_secret is +// present only for confidential clients. +type registrationResponse struct { + ClientID string `json:"client_id"` + ClientSecret string `json:"client_secret,omitempty"` + ClientName string `json:"client_name,omitempty"` + RedirectURIs []string `json:"redirect_uris"` + GrantTypes []string `json:"grant_types"` + ResponseTypes []string `json:"response_types"` + Scope string `json:"scope,omitempty"` + TokenEndpointAuthMethod string `json:"token_endpoint_auth_method"` +} + +// Register is the RFC 7591 dynamic client registration endpoint. Native MCP +// clients register as public clients (token_endpoint_auth_method=none) with PKCE +// and loopback redirect URIs; a client that asks for a secret-based auth method +// is treated as confidential and gets a generated secret. All redirect URIs are +// validated (loopback http or https only) before persistence so the issuer can +// never be turned into an open redirector. +func (h *Handler) Register(w http.ResponseWriter, req bunrouter.Request) error { + var body registrationRequest + if err := json.NewDecoder(req.Body).Decode(&body); err != nil { + return h.writeRegisterError(w, ErrInvalidClientMetadata, "malformed registration body") + } + + if len(body.RedirectURIs) == 0 { + return h.writeRegisterError(w, ErrInvalidRedirectURI, "at least one redirect_uri is required") + } + + for _, uri := range body.RedirectURIs { + if !IsValidRedirectURI(uri) { + return h.writeRegisterError(w, ErrInvalidRedirectURI, + "redirect_uri must be https or an http loopback address: "+uri) + } + } + + grantTypes := body.GrantTypes + if len(grantTypes) == 0 { + grantTypes = []string{GrantAuthorizationCode, GrantRefreshToken} + } + + responseTypes := body.ResponseTypes + if len(responseTypes) == 0 { + responseTypes = []string{"code"} + } + + scopes := ParseScopes(body.Scope) + if len(scopes) == 0 { + scopes = []string{ScopeMCP} + } + + if !ScopesValid(scopes) { + return h.writeRegisterError(w, ErrInvalidClientMetadata, "unsupported scope requested") + } + + // Confidential only when the client explicitly opts into a secret-based auth + // method. Default (and "none") is a public client — the MCP native case. + isPublic := body.TokenEndpointAuthMethod == "" || body.TokenEndpointAuthMethod == "none" + + client, secret, err := h.svc.RegisterClient( + req.Context(), body.ClientName, body.RedirectURIs, grantTypes, scopes, isPublic, + ) + if err != nil { + return h.WriteInternalError(w, err) + } + + authMethod := "none" + if !isPublic { + authMethod = "client_secret_post" + } + + resp := registrationResponse{ + ClientID: client.ClientID, + ClientSecret: secret, + ClientName: client.ClientName, + RedirectURIs: client.RedirectURIs, + GrantTypes: grantTypes, + ResponseTypes: responseTypes, + Scope: body.Scope, + TokenEndpointAuthMethod: authMethod, + } + + return h.writeNoStoreJSON(w, http.StatusCreated, resp) +} + +// writeRegisterError writes an RFC 7591 §3.2.2 registration error response. +func (h *Handler) writeRegisterError(w http.ResponseWriter, code, description string) error { + w.Header().Set("Cache-Control", "no-store") + + return h.WriteJSON(w, http.StatusBadRequest, errorBody{Error: code, ErrorDescription: description}) +} diff --git a/server/internal/oauth/service.go b/server/internal/oauth/service.go new file mode 100644 index 000000000..2d33570c8 --- /dev/null +++ b/server/internal/oauth/service.go @@ -0,0 +1,358 @@ +package oauth + +import ( + "context" + "crypto/rand" + "encoding/base64" + "errors" + "fmt" + "time" + + "github.com/google/uuid" + + "github.com/fclairamb/solidping/server/internal/config" + "github.com/fclairamb/solidping/server/internal/db" + "github.com/fclairamb/solidping/server/internal/db/models" + "github.com/fclairamb/solidping/server/internal/handlers/auth" + "github.com/fclairamb/solidping/server/internal/utils/clock" + "github.com/fclairamb/solidping/server/internal/utils/passwords" +) + +// Token lifetimes and grant constants for the embedded authorization server. +const ( + // authCodeTTL is how long an issued authorization code stays redeemable. + // Codes are single-use and very short-lived (OAuth 2.1 recommends ≤ 60s). + authCodeTTL = 60 * time.Second + // accessTokenTTL is the lifetime of an OAuth-issued MCP access token. + // Short by design — clients refresh with the rotating refresh token. + accessTokenTTL = 30 * time.Minute + // refreshTokenTTL is the lifetime of a refresh grant. + refreshTokenTTL = 30 * 24 * time.Hour + + // tokenEntropyBytes is the size of the random secret backing codes, refresh + // tokens, and generated client IDs/secrets before base64url encoding. + tokenEntropyBytes = 32 +) + +// Sentinel errors returned by the service for the token/authorize flows. The +// handler maps these to the appropriate OAuth error response. +var ( + // ErrClientNotFound means no registered client matches the client_id. + ErrClientNotFound = errors.New("oauth: client not found") + // ErrInvalidGrantErr means the auth code or refresh token is missing, + // expired, already used, revoked, or fails a binding check. + ErrInvalidGrantErr = errors.New("oauth: invalid grant") + // ErrPKCEFailed means the supplied code_verifier does not match the stored + // code_challenge. + ErrPKCEFailed = errors.New("oauth: pkce verification failed") +) + +// Service holds the business logic for the embedded OAuth 2.1 authorization +// server: client validation, authorization-code issuance/redemption, and token +// minting (delegated to the auth service for JWT signing). +type Service struct { + db db.Service + authSvc *auth.Service + cfg *config.Config + clock clock.Clock +} + +// NewService builds the OAuth service. authSvc is reused for JWT signing and +// refresh-token semantics so OAuth-issued credentials are indistinguishable +// from session credentials downstream. +func NewService(dbService db.Service, authSvc *auth.Service, cfg *config.Config) *Service { + return &Service{ + db: dbService, + authSvc: authSvc, + cfg: cfg, + clock: clock.Real{}, + } +} + +// metadata returns the issuer-derived URLs from the current config. +func (s *Service) metadata() Metadata { + return NewMetadata(s.cfg.Server.BaseURL) +} + +// randomToken returns a base64url-encoded, unpadded random secret. +func randomToken() (string, error) { + buf := make([]byte, tokenEntropyBytes) + if _, err := rand.Read(buf); err != nil { + return "", fmt.Errorf("generate random token: %w", err) + } + + return base64.RawURLEncoding.EncodeToString(buf), nil +} + +// GetClient looks up a registered client by its client_id. +func (s *Service) GetClient(ctx context.Context, clientID string) (*models.OAuthClient, error) { + client, err := s.db.GetOAuthClientByClientID(ctx, clientID) + if err != nil { + return nil, ErrClientNotFound + } + + return client, nil +} + +// AuthCodeGrant captures everything an authorization code binds together. The +// token endpoint replays these bindings (client, redirect, PKCE, resource) to +// stop a stolen code from being redeemed under different parameters. +type AuthCodeGrant struct { + ClientID string + UserUID string + OrgUID string + OrgSlug string + RedirectURI string + Scope string + Resource string + CodeChallenge string + CodeChallengeMethod string +} + +// IssueAuthCode mints a single-use, short-lived authorization code bound to the +// grant. The returned code is the opaque value handed back to the client via the +// redirect. +func (s *Service) IssueAuthCode(ctx context.Context, grant AuthCodeGrant) (string, error) { + code, err := randomToken() + if err != nil { + return "", err + } + + now := s.clock.Now() + row := &models.OAuthAuthCode{ + UID: uuid.New().String(), + Code: code, + ClientID: grant.ClientID, + UserUID: grant.UserUID, + OrganizationUID: grant.OrgUID, + RedirectURI: grant.RedirectURI, + Scope: grant.Scope, + Resource: grant.Resource, + CodeChallenge: grant.CodeChallenge, + CodeChallengeMethod: grant.CodeChallengeMethod, + ExpiresAt: now.Add(authCodeTTL), + CreatedAt: now, + } + + if err := s.db.CreateOAuthAuthCode(ctx, row); err != nil { + return "", fmt.Errorf("persist auth code: %w", err) + } + + return code, nil +} + +// TokenResult is the successful output of a token-endpoint exchange. +type TokenResult struct { + AccessToken string + RefreshToken string + Scope string + ExpiresIn int +} + +// ExchangeAuthCode redeems an authorization code for an access + refresh token. +// It enforces, in order: the code exists, is unexpired, and is consumed exactly +// once (atomic compare-and-set); the redirect_uri and client_id match the +// binding; and the PKCE code_verifier matches the stored S256 challenge. Any +// failure returns ErrInvalidGrantErr / ErrPKCEFailed without minting a token. +func (s *Service) ExchangeAuthCode( + ctx context.Context, code, clientID, redirectURI, codeVerifier string, +) (*TokenResult, error) { + row, err := s.db.GetOAuthAuthCode(ctx, code) + if err != nil { + return nil, ErrInvalidGrantErr + } + + now := s.clock.Now() + if now.After(row.ExpiresAt) { + return nil, ErrInvalidGrantErr + } + + if row.ClientID != clientID || row.RedirectURI != redirectURI { + return nil, ErrInvalidGrantErr + } + + if !VerifyPKCE(codeVerifier, row.CodeChallenge) { + return nil, ErrPKCEFailed + } + + // Atomic single-use guard: a replay updates zero rows and is rejected. + won, err := s.db.ConsumeOAuthAuthCode(ctx, code, now) + if err != nil { + return nil, fmt.Errorf("consume auth code: %w", err) + } + + if !won { + return nil, ErrInvalidGrantErr + } + + orgSlug, err := s.orgSlug(ctx, row.OrganizationUID) + if err != nil { + return nil, err + } + + return s.mintTokens(ctx, mintInput{ + clientID: row.ClientID, + userUID: row.UserUID, + orgUID: row.OrganizationUID, + orgSlug: orgSlug, + scope: row.Scope, + resource: row.Resource, + }) +} + +// ExchangeRefreshToken rotates a refresh grant: it validates the presented token +// is active and unexpired, atomically revokes it, and issues a fresh access + +// refresh pair. Because revocation is an atomic compare-and-set, a concurrent or +// replayed use of the same refresh token loses the race and is rejected — the +// rotation invalidates the prior token. +func (s *Service) ExchangeRefreshToken( + ctx context.Context, refreshToken, clientID string, +) (*TokenResult, error) { + row, err := s.db.GetOAuthRefreshToken(ctx, refreshToken) + if err != nil { + return nil, ErrInvalidGrantErr + } + + now := s.clock.Now() + if row.RevokedAt != nil || now.After(row.ExpiresAt) { + return nil, ErrInvalidGrantErr + } + + if clientID != "" && row.ClientID != clientID { + return nil, ErrInvalidGrantErr + } + + won, err := s.db.RevokeOAuthRefreshToken(ctx, refreshToken, now) + if err != nil { + return nil, fmt.Errorf("rotate refresh token: %w", err) + } + + if !won { + // Lost the race → already rotated/revoked → reject. + return nil, ErrInvalidGrantErr + } + + orgSlug, err := s.orgSlug(ctx, row.OrganizationUID) + if err != nil { + return nil, err + } + + return s.mintTokens(ctx, mintInput{ + clientID: row.ClientID, + userUID: row.UserUID, + orgUID: row.OrganizationUID, + orgSlug: orgSlug, + scope: row.Scope, + resource: row.Resource, + }) +} + +// mintInput carries the parameters needed to mint a token pair. +type mintInput struct { + clientID string + userUID string + orgUID string + orgSlug string + scope string + resource string +} + +// mintTokens issues an audience-bound JWT access token (via the auth service's +// signing key) and a persisted rotating refresh token. +func (s *Service) mintTokens(ctx context.Context, in mintInput) (*TokenResult, error) { + scopes := ParseScopes(in.scope) + + accessToken, err := s.authSvc.GenerateMCPAccessToken( + in.userUID, in.orgSlug, scopes, in.resource, accessTokenTTL, + ) + if err != nil { + return nil, fmt.Errorf("mint access token: %w", err) + } + + refreshValue, err := randomToken() + if err != nil { + return nil, err + } + + now := s.clock.Now() + refreshRow := &models.OAuthRefreshToken{ + UID: uuid.New().String(), + Token: refreshValue, + ClientID: in.clientID, + UserUID: in.userUID, + OrganizationUID: in.orgUID, + Scope: in.scope, + Resource: in.resource, + ExpiresAt: now.Add(refreshTokenTTL), + CreatedAt: now, + } + + if err := s.db.CreateOAuthRefreshToken(ctx, refreshRow); err != nil { + return nil, fmt.Errorf("persist refresh token: %w", err) + } + + return &TokenResult{ + AccessToken: accessToken, + RefreshToken: refreshValue, + Scope: in.scope, + ExpiresIn: int(accessTokenTTL.Seconds()), + }, nil +} + +// orgSlug resolves an organization UID to its slug for the access-token claims. +func (s *Service) orgSlug(ctx context.Context, orgUID string) (string, error) { + org, err := s.db.GetOrganization(ctx, orgUID) + if err != nil { + return "", fmt.Errorf("resolve org slug: %w", err) + } + + return org.Slug, nil +} + +// RegisterClient creates a new OAuth client (RFC 7591). Public clients (native / +// loopback, PKCE) get no secret; confidential clients get a generated secret +// returned once in the registration response. The caller has already validated +// the redirect URIs. +func (s *Service) RegisterClient( + ctx context.Context, name string, redirectURIs, grantTypes, scopes []string, isPublic bool, +) (*models.OAuthClient, string, error) { + clientID, err := randomToken() + if err != nil { + return nil, "", err + } + + now := s.clock.Now() + client := &models.OAuthClient{ + UID: uuid.New().String(), + ClientID: clientID, + ClientName: name, + RedirectURIs: redirectURIs, + GrantTypes: grantTypes, + Scopes: scopes, + IsPublic: isPublic, + CreatedAt: now, + UpdatedAt: now, + } + + var plainSecret string + + if !isPublic { + plainSecret, err = randomToken() + if err != nil { + return nil, "", err + } + + hash, hashErr := passwords.Hash(plainSecret) + if hashErr != nil { + return nil, "", fmt.Errorf("hash client secret: %w", hashErr) + } + + client.SecretHash = &hash + } + + if err := s.db.CreateOAuthClient(ctx, client); err != nil { + return nil, "", fmt.Errorf("persist client: %w", err) + } + + return client, plainSecret, nil +} diff --git a/server/internal/oauth/token.go b/server/internal/oauth/token.go new file mode 100644 index 000000000..efd0c058c --- /dev/null +++ b/server/internal/oauth/token.go @@ -0,0 +1,115 @@ +package oauth + +import ( + "errors" + "net/http" + + "github.com/uptrace/bunrouter" +) + +// tokenResponse is the RFC 6749 §5.1 successful token response. The MCP access +// token is a SolidPing JWT (audience-bound to the MCP resource); the refresh +// token is an opaque rotating secret. +type tokenResponse struct { + AccessToken string `json:"access_token"` + TokenType string `json:"token_type"` + ExpiresIn int `json:"expires_in"` + RefreshToken string `json:"refresh_token,omitempty"` + Scope string `json:"scope,omitempty"` +} + +// Token is the OAuth token endpoint. It supports the authorization_code grant +// (with PKCE verification) and the refresh_token grant (with rotation). Errors +// are returned as RFC 6749 §5.2 JSON bodies with the appropriate status. +func (h *Handler) Token(w http.ResponseWriter, req bunrouter.Request) error { + if err := req.ParseForm(); err != nil { + return h.writeTokenError(w, http.StatusBadRequest, ErrInvalidRequest, "malformed form body") + } + + grantType := req.Form.Get("grant_type") + switch grantType { + case GrantAuthorizationCode: + return h.tokenAuthorizationCode(w, req) + case GrantRefreshToken: + return h.tokenRefresh(w, req) + default: + return h.writeTokenError(w, http.StatusBadRequest, ErrUnsupportedGrantType, + "grant_type must be authorization_code or refresh_token") + } +} + +// tokenAuthorizationCode handles grant_type=authorization_code. +func (h *Handler) tokenAuthorizationCode(w http.ResponseWriter, req bunrouter.Request) error { + code := req.Form.Get("code") + clientID := req.Form.Get("client_id") + redirectURI := req.Form.Get("redirect_uri") + codeVerifier := req.Form.Get("code_verifier") + + if code == "" || clientID == "" || redirectURI == "" { + return h.writeTokenError(w, http.StatusBadRequest, ErrInvalidRequest, + "code, client_id, and redirect_uri are required") + } + + if codeVerifier == "" { + return h.writeTokenError(w, http.StatusBadRequest, ErrInvalidRequest, + "code_verifier is required (PKCE)") + } + + result, err := h.svc.ExchangeAuthCode(req.Context(), code, clientID, redirectURI, codeVerifier) + if err != nil { + return h.tokenGrantError(w, err) + } + + return h.writeTokenSuccess(w, result) +} + +// tokenRefresh handles grant_type=refresh_token (rotating refresh). +func (h *Handler) tokenRefresh(w http.ResponseWriter, req bunrouter.Request) error { + refreshToken := req.Form.Get("refresh_token") + clientID := req.Form.Get("client_id") + + if refreshToken == "" { + return h.writeTokenError(w, http.StatusBadRequest, ErrInvalidRequest, + "refresh_token is required") + } + + result, err := h.svc.ExchangeRefreshToken(req.Context(), refreshToken, clientID) + if err != nil { + return h.tokenGrantError(w, err) + } + + return h.writeTokenSuccess(w, result) +} + +// tokenGrantError maps a service-layer grant error to the correct OAuth error. +func (h *Handler) tokenGrantError(w http.ResponseWriter, err error) error { + switch { + case errors.Is(err, ErrInvalidGrantErr), errors.Is(err, ErrPKCEFailed): + return h.writeTokenError(w, http.StatusBadRequest, ErrInvalidGrant, + "invalid, expired, or already-used grant") + case errors.Is(err, ErrClientNotFound): + return h.writeTokenError(w, http.StatusUnauthorized, ErrInvalidClient, "unknown client") + default: + return h.writeTokenError(w, http.StatusInternalServerError, ErrServerError, + "could not issue token") + } +} + +// writeTokenSuccess writes the RFC 6749 §5.1 success body with no-store caching. +func (h *Handler) writeTokenSuccess(w http.ResponseWriter, r *TokenResult) error { + return h.writeNoStoreJSON(w, http.StatusOK, tokenResponse{ + AccessToken: r.AccessToken, + TokenType: "Bearer", + ExpiresIn: r.ExpiresIn, + RefreshToken: r.RefreshToken, + Scope: r.Scope, + }) +} + +// writeTokenError writes an RFC 6749 §5.2 error body with no-store caching. +func (h *Handler) writeTokenError(w http.ResponseWriter, status int, code, description string) error { + w.Header().Set("Cache-Control", "no-store") + w.Header().Set("Pragma", "no-cache") + + return h.WriteJSON(w, status, errorBody{Error: code, ErrorDescription: description}) +} From 85fe2e0938d08c168e03f1c1778c62dfb97bdb65 Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 04:17:46 +0200 Subject: [PATCH 52/67] feat: mcp oauth2 consent screen + deny handling dash0 route /orgs/$org/oauth/consent renders the requested scope (read-only vs read-write) and posts approve/deny back to /api/v1/oauth/authorize via a native form so the access_token cookie rides along. Server handles deny with access_denied. Built from design-reference primitives (Card/Button/Alert); auth enforced by the parent org layout (401 -> login?returnTo). Co-Authored-By: Claude Opus 4.8 --- server/internal/oauth/authorize.go | 7 + web/dash0/src/routeTree.gen.ts | 21 +++ .../src/routes/orgs/$org/oauth.consent.tsx | 158 ++++++++++++++++++ 3 files changed, 186 insertions(+) create mode 100644 web/dash0/src/routes/orgs/$org/oauth.consent.tsx diff --git a/server/internal/oauth/authorize.go b/server/internal/oauth/authorize.go index 1a594bc53..93a527238 100644 --- a/server/internal/oauth/authorize.go +++ b/server/internal/oauth/authorize.go @@ -180,6 +180,13 @@ func (h *Handler) ApproveAuthorize(w http.ResponseWriter, req bunrouter.Request) "A logged-in session is required to authorize") } + // The user denied consent → return to the client with access_denied rather + // than minting a code (RFC 6749 §4.1.2.1). + if req.Form.Get("decision") == "deny" { + return h.handleAuthError(w, req, newRedirectError(ErrAccessDenied, + "the user denied the authorization request", ar.RedirectURI, ar.State)) + } + org, err := h.svc.db.GetOrganizationBySlug(req.Context(), claims.OrgSlug) if err != nil { return h.WriteInternalError(w, err) diff --git a/web/dash0/src/routeTree.gen.ts b/web/dash0/src/routeTree.gen.ts index 9a37b559c..9a454623c 100644 --- a/web/dash0/src/routeTree.gen.ts +++ b/web/dash0/src/routeTree.gen.ts @@ -74,6 +74,7 @@ import { Route as OrgsOrgOrganizationMembersRouteImport } from './routes/orgs/$o import { Route as OrgsOrgOrganizationInvitationsRouteImport } from './routes/orgs/$org/organization.invitations' import { Route as OrgsOrgOnCallNewRouteImport } from './routes/orgs/$org/on-call.new' import { Route as OrgsOrgOnCallSlugRouteImport } from './routes/orgs/$org/on-call.$slug' +import { Route as OrgsOrgOauthConsentRouteImport } from './routes/orgs/$org/oauth.consent' import { Route as OrgsOrgNotificationsNotificationUidRouteImport } from './routes/orgs/$org/notifications.$notificationUid' import { Route as OrgsOrgMeNotificationsRouteImport } from './routes/orgs/$org/me.notifications' import { Route as OrgsOrgJobsJobUidRouteImport } from './routes/orgs/$org/jobs.$jobUid' @@ -443,6 +444,11 @@ const OrgsOrgOnCallSlugRoute = OrgsOrgOnCallSlugRouteImport.update({ path: '/$slug', getParentRoute: () => OrgsOrgOnCallRoute, } as any) +const OrgsOrgOauthConsentRoute = OrgsOrgOauthConsentRouteImport.update({ + id: '/oauth/consent', + path: '/oauth/consent', + getParentRoute: () => OrgsOrgRoute, +} as any) const OrgsOrgNotificationsNotificationUidRoute = OrgsOrgNotificationsNotificationUidRouteImport.update({ id: '/notifications/$notificationUid', @@ -646,6 +652,7 @@ export interface FileRoutesByFullPath { '/orgs/$org/jobs/$jobUid': typeof OrgsOrgJobsJobUidRoute '/orgs/$org/me/notifications': typeof OrgsOrgMeNotificationsRoute '/orgs/$org/notifications/$notificationUid': typeof OrgsOrgNotificationsNotificationUidRoute + '/orgs/$org/oauth/consent': typeof OrgsOrgOauthConsentRoute '/orgs/$org/on-call/$slug': typeof OrgsOrgOnCallSlugRouteWithChildren '/orgs/$org/on-call/new': typeof OrgsOrgOnCallNewRoute '/orgs/$org/organization/invitations': typeof OrgsOrgOrganizationInvitationsRoute @@ -725,6 +732,7 @@ export interface FileRoutesByTo { '/orgs/$org/jobs/$jobUid': typeof OrgsOrgJobsJobUidRoute '/orgs/$org/me/notifications': typeof OrgsOrgMeNotificationsRoute '/orgs/$org/notifications/$notificationUid': typeof OrgsOrgNotificationsNotificationUidRoute + '/orgs/$org/oauth/consent': typeof OrgsOrgOauthConsentRoute '/orgs/$org/on-call/new': typeof OrgsOrgOnCallNewRoute '/orgs/$org/organization/invitations': typeof OrgsOrgOrganizationInvitationsRoute '/orgs/$org/organization/members': typeof OrgsOrgOrganizationMembersRoute @@ -819,6 +827,7 @@ export interface FileRoutesById { '/orgs/$org/jobs/$jobUid': typeof OrgsOrgJobsJobUidRoute '/orgs/$org/me/notifications': typeof OrgsOrgMeNotificationsRoute '/orgs/$org/notifications/$notificationUid': typeof OrgsOrgNotificationsNotificationUidRoute + '/orgs/$org/oauth/consent': typeof OrgsOrgOauthConsentRoute '/orgs/$org/on-call/$slug': typeof OrgsOrgOnCallSlugRouteWithChildren '/orgs/$org/on-call/new': typeof OrgsOrgOnCallNewRoute '/orgs/$org/organization/invitations': typeof OrgsOrgOrganizationInvitationsRoute @@ -916,6 +925,7 @@ export interface FileRouteTypes { | '/orgs/$org/jobs/$jobUid' | '/orgs/$org/me/notifications' | '/orgs/$org/notifications/$notificationUid' + | '/orgs/$org/oauth/consent' | '/orgs/$org/on-call/$slug' | '/orgs/$org/on-call/new' | '/orgs/$org/organization/invitations' @@ -995,6 +1005,7 @@ export interface FileRouteTypes { | '/orgs/$org/jobs/$jobUid' | '/orgs/$org/me/notifications' | '/orgs/$org/notifications/$notificationUid' + | '/orgs/$org/oauth/consent' | '/orgs/$org/on-call/new' | '/orgs/$org/organization/invitations' | '/orgs/$org/organization/members' @@ -1088,6 +1099,7 @@ export interface FileRouteTypes { | '/orgs/$org/jobs/$jobUid' | '/orgs/$org/me/notifications' | '/orgs/$org/notifications/$notificationUid' + | '/orgs/$org/oauth/consent' | '/orgs/$org/on-call/$slug' | '/orgs/$org/on-call/new' | '/orgs/$org/organization/invitations' @@ -1607,6 +1619,13 @@ declare module '@tanstack/react-router' { preLoaderRoute: typeof OrgsOrgOnCallSlugRouteImport parentRoute: typeof OrgsOrgOnCallRoute } + '/orgs/$org/oauth/consent': { + id: '/orgs/$org/oauth/consent' + path: '/oauth/consent' + fullPath: '/orgs/$org/oauth/consent' + preLoaderRoute: typeof OrgsOrgOauthConsentRouteImport + parentRoute: typeof OrgsOrgRoute + } '/orgs/$org/notifications/$notificationUid': { id: '/orgs/$org/notifications/$notificationUid' path: '/notifications/$notificationUid' @@ -2153,6 +2172,7 @@ interface OrgsOrgRouteChildren { OrgsOrgTestRoute: typeof OrgsOrgTestRouteWithChildren OrgsOrgIndexRoute: typeof OrgsOrgIndexRoute OrgsOrgNotificationsNotificationUidRoute: typeof OrgsOrgNotificationsNotificationUidRoute + OrgsOrgOauthConsentRoute: typeof OrgsOrgOauthConsentRoute OrgsOrgDependenciesIndexRoute: typeof OrgsOrgDependenciesIndexRoute } @@ -2179,6 +2199,7 @@ const OrgsOrgRouteChildren: OrgsOrgRouteChildren = { OrgsOrgIndexRoute: OrgsOrgIndexRoute, OrgsOrgNotificationsNotificationUidRoute: OrgsOrgNotificationsNotificationUidRoute, + OrgsOrgOauthConsentRoute: OrgsOrgOauthConsentRoute, OrgsOrgDependenciesIndexRoute: OrgsOrgDependenciesIndexRoute, } diff --git a/web/dash0/src/routes/orgs/$org/oauth.consent.tsx b/web/dash0/src/routes/orgs/$org/oauth.consent.tsx new file mode 100644 index 000000000..b0391d9d3 --- /dev/null +++ b/web/dash0/src/routes/orgs/$org/oauth.consent.tsx @@ -0,0 +1,158 @@ +import { createFileRoute } from "@tanstack/react-router"; +import { + Card, + CardContent, + CardDescription, + CardHeader, + CardTitle, +} from "@/components/ui/card"; +import { Button } from "@/components/ui/button"; +import { Alert, AlertDescription, AlertTitle } from "@/components/ui/alert"; +import { ShieldCheck, Eye, Pencil, AlertCircle } from "lucide-react"; + +// Consent screen for the embedded MCP OAuth 2.1 authorization server +// (spec 2026-06-20-03). The server-side /authorize endpoint validates every +// parameter and redirects a logged-in user here with the validated values in the +// query string. The user reviews the requested scope and either approves — +// submitting a native POST form to /api/v1/oauth/authorize, which mints the +// single-use code and redirects back to the client — or denies, returning to the +// client's redirect_uri with an access_denied error. +// +// The form is a native browser submit (not an apiFetch) so the access_token +// cookie rides along and the browser follows the server's 302 to the client. +// Auth is enforced by the parent /orgs/$org layout, which redirects to login +// with returnTo when there is no session (frontend 401 convention). + +interface ConsentSearch { + client_id?: string; + redirect_uri?: string; + response_type?: string; + scope?: string; + state?: string; + resource?: string; + code_challenge?: string; + code_challenge_method?: string; +} + +function str(v: unknown): string | undefined { + return typeof v === "string" ? v : undefined; +} + +export const Route = createFileRoute("/orgs/$org/oauth/consent")({ + validateSearch: (search: Record): ConsentSearch => ({ + client_id: str(search.client_id), + redirect_uri: str(search.redirect_uri), + response_type: str(search.response_type), + scope: str(search.scope), + state: str(search.state), + resource: str(search.resource), + code_challenge: str(search.code_challenge), + code_challenge_method: str(search.code_challenge_method), + }), + component: ConsentPage, +}); + +const AUTHORIZE_ENDPOINT = "/api/v1/oauth/authorize"; + +function ConsentPage() { + const search = Route.useSearch(); + const { org } = Route.useParams(); + + const scope = search.scope ?? "mcp"; + const isReadOnly = scope.split(/\s+/).every((s) => s === "mcp:read"); + const clientName = search.client_id ?? "an application"; + + // Missing required params means the user landed here without going through the + // validated /authorize endpoint — refuse rather than render a misleading form. + const missingRequired = + !search.client_id || + !search.redirect_uri || + !search.code_challenge || + !search.resource; + + if (missingRequired) { + return ( +
+ + + Invalid authorization request + + This consent request is missing required parameters. Start the + connection again from your MCP client. + + +
+ ); + } + + // Hidden fields mirror the validated query params straight back to the server, + // which re-validates them — the consent UI cannot alter the grant. + const hidden: Array<[string, string | undefined]> = [ + ["client_id", search.client_id], + ["redirect_uri", search.redirect_uri], + ["response_type", search.response_type ?? "code"], + ["scope", scope], + ["state", search.state], + ["resource", search.resource], + ["code_challenge", search.code_challenge], + ["code_challenge_method", search.code_challenge_method ?? "S256"], + ]; + + return ( +
+ + +
+ + Authorize MCP access +
+ + {clientName} is requesting access + to your SolidPing organization {org}{" "} + over the Model Context Protocol. + + + + + {isReadOnly ? ( + + ) : ( + + )} + + {isReadOnly ? "Read-only access" : "Read-write access"} + + + {isReadOnly + ? "This connection can read your monitoring data but cannot create, update, or delete anything." + : "This connection can read your monitoring data and create, update, or delete resources via MCP tools."} + + + +
+ {/* Deny: POST with deny=1 so the server redirects back with access_denied. */} +
+ {hidden.map(([name, value]) => ( + + ))} + + +
+ {/* Approve: POST mints the auth code and redirects to the client. */} +
+ {hidden.map(([name, value]) => ( + + ))} + + +
+
+ + +
+ ); +} From 19a8798c6fe80bc7ec7f3a6fcc233d3072ee05fb Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 04:18:22 +0200 Subject: [PATCH 53/67] docs: document mcp oauth2 discovery and flow endpoints Co-Authored-By: Claude Opus 4.8 --- docs/api-specification.md | 68 ++++++++++++++++++++++++++++++++++++++- 1 file changed, 67 insertions(+), 1 deletion(-) diff --git a/docs/api-specification.md b/docs/api-specification.md index 1f69016b8..b7667d398 100644 --- a/docs/api-specification.md +++ b/docs/api-specification.md @@ -811,7 +811,73 @@ Slack interactive component handler. Auth: Slack signature verification ## MCP (Model Context Protocol) ### POST /api/v1/mcp -MCP endpoint for AI tool integrations. Auth: required (PAT token, org derived from token) +MCP endpoint for AI tool integrations. Auth: required — either a `mcp`/`mcp:read`-scoped +PAT pasted as a bearer token (back-compat) or an OAuth-issued access token (see OAuth below). +Org is derived from the token. On missing/invalid auth this endpoint returns **401** with a +`WWW-Authenticate: Bearer resource_metadata="/.well-known/oauth-protected-resource"` +header so standard MCP clients can discover the authorization server and start the OAuth flow. +OAuth-issued tokens are audience-bound (RFC 8707) to the MCP resource and rejected here if their +`aud` does not include `/api/v1/mcp`. + +--- + +## OAuth 2.1 (MCP authorization server) + +SolidPing is an embedded OAuth 2.1 authorization server for the MCP resource (spec +2026-06-20-03). Standard MCP clients (Claude Desktop, claude.ai remote connector, `mcp-remote`) +self-onboard via discovery → register → authorize+consent → token, with no hand-pasted token. +Issuer = the SolidPing base URL; the resource is `/api/v1/mcp`. Access tokens reuse the +existing HS256 JWT format; refresh tokens rotate. PKCE (`S256`) is mandatory. + +### GET /.well-known/oauth-protected-resource +RFC 9728 protected-resource metadata. Public, no auth. Advertises `resource` (the MCP URL), +`authorization_servers` (the issuer), `scopes_supported` (`mcp`, `mcp:read`), and +`bearer_methods_supported`. + +### GET /.well-known/oauth-authorization-server +RFC 8414 authorization-server metadata. Public, no auth. Advertises `authorization_endpoint`, +`token_endpoint`, `registration_endpoint`, `jwks_uri`, +`code_challenge_methods_supported=["S256"]`, `grant_types_supported=["authorization_code", +"refresh_token"]`, `response_types_supported=["code"]`, and `scopes_supported=["mcp","mcp:read"]`. + +### GET /.well-known/openid-configuration +Alias of the authorization-server metadata (many clients probe this path). Public, no auth. + +### GET /.well-known/jwks.json +JWKS endpoint (`jwks_uri`). Public, no auth. The v1 signing key is symmetric (HS256), so the +secret is never published — this serves a well-formed but empty key set. The MCP resource server +validates tokens itself; clients do not verify locally. Asymmetric keys are a documented follow-on. + +### POST /api/v1/oauth/register +RFC 7591 dynamic client registration. Public. Accepts `redirect_uris` (required), `client_name`, +`grant_types`, `response_types`, `scope`, `token_endpoint_auth_method`. Native clients are public +(PKCE + loopback redirects `http://127.0.0.1:*` / `http://localhost:*` / `http://[::1]:*`) and get +no secret; a client requesting a secret-based auth method is confidential and gets a `client_secret` +returned once. Redirect URIs must be https or http-loopback. Returns `client_id` (+ `client_secret` +for confidential clients). + +### GET /api/v1/oauth/authorize +Authorization endpoint. Requires a logged-in dashboard session (the `access_token` cookie); if +absent, redirects to `/dash0/login?returnTo=…` and back. Validates `client_id`, `redirect_uri` +(exact match against the registered set, loopback ignores the port), `response_type=code`, PKCE +`code_challenge` + `code_challenge_method=S256` (both required; `plain` and missing are rejected), +`scope ⊆ {mcp, mcp:read}`, and `resource` (must equal the MCP resource). On success redirects to the +dashboard consent screen (`/dash0/orgs/:org/oauth/consent`). + +### POST /api/v1/oauth/authorize +Consent decision. Re-validates the request, requires a session, and reads `decision` (`approve` / +`deny`). On approve, mints a single-use, short-TTL authorization code bound to +client→redirect→PKCE-challenge→resource→scope→user/org and redirects to the client's `redirect_uri` +with `code` + `state`. On deny, redirects with `error=access_denied`. + +### POST /api/v1/oauth/token +Token endpoint (form-encoded). `grant_type=authorization_code` exchanges `code` + `code_verifier` +(+ matching `client_id`, `redirect_uri`) for an access token and a refresh token; the PKCE verifier +is checked against the stored S256 challenge and the code is consumed single-use. +`grant_type=refresh_token` rotates the refresh token (the presented one is revoked atomically and a +new pair issued). Access tokens are JWTs with `aud` = the MCP resource and the consented scopes, +short-lived; refresh tokens are revoked on logout and PAT revoke. Errors use the RFC 6749 §5.2 JSON +shape (`{ "error": "...", "error_description": "..." }`). --- From a9fbaf7e2a7523c72b8837ca11f09b476d44979f Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 04:34:23 +0200 Subject: [PATCH 54/67] test: mcp oauth2 flow, discovery, pkce, audience, repos (sqlite+postgres) Table-driven tests (testify/require, t.Parallel): well-formed discovery docs; unauthenticated MCP request -> 401 with WWW-Authenticate resource_metadata pointer; missing/plain PKCE rejected; reused/expired auth code rejected; wrong/blocked redirect_uri rejected and loopback accepted; wrong aud rejected at the MCP gate; refresh rotation invalidates the prior token; mcp:read scope flows to claims; DCR public-vs-confidential. Cross-engine OAuth-repo parity (testOAuthRepos) runs under both SQLite and embedded Postgres. Also: lint fixes (RFC snake_case nolint, sentinel error renames, var naming, hugeParam pointers) and mock db.Service stubs for the new OAuth methods. Co-Authored-By: Claude Opus 4.8 --- server/internal/db/models/oauth.go | 9 +- server/internal/db/oauth_test.go | 129 ++++++++++ server/internal/db/service_test.go | 4 + server/internal/middleware/auth.go | 16 +- server/internal/middleware/mcpauth_test.go | 136 +++++++++++ server/internal/notifications/slack_test.go | 36 +++ server/internal/oauth/audience.go | 2 +- server/internal/oauth/authorize.go | 162 +++++++------ server/internal/oauth/client.go | 20 +- server/internal/oauth/client_test.go | 99 ++++++++ server/internal/oauth/errors.go | 6 +- server/internal/oauth/handler_test.go | 156 ++++++++++++ server/internal/oauth/metadata.go | 19 +- server/internal/oauth/metadata_test.go | 105 +++++++++ server/internal/oauth/pkce_test.go | 65 +++++ server/internal/oauth/register.go | 32 +-- server/internal/oauth/service.go | 70 +++--- server/internal/oauth/service_test.go | 248 ++++++++++++++++++++ server/internal/oauth/token.go | 62 ++--- 19 files changed, 1191 insertions(+), 185 deletions(-) create mode 100644 server/internal/db/oauth_test.go create mode 100644 server/internal/middleware/mcpauth_test.go create mode 100644 server/internal/oauth/client_test.go create mode 100644 server/internal/oauth/handler_test.go create mode 100644 server/internal/oauth/metadata_test.go create mode 100644 server/internal/oauth/pkce_test.go create mode 100644 server/internal/oauth/service_test.go diff --git a/server/internal/db/models/oauth.go b/server/internal/db/models/oauth.go index cfbbff1d3..02f397532 100644 --- a/server/internal/db/models/oauth.go +++ b/server/internal/db/models/oauth.go @@ -4,6 +4,7 @@ import ( "time" "github.com/google/uuid" + "github.com/uptrace/bun" ) // OAuthClient is a registered OAuth 2.1 client for the MCP authorization @@ -12,6 +13,8 @@ import ( // confidential clients store a hashed secret. Redirect URIs are stored as a // JSON array and validated on every /authorize. type OAuthClient struct { + bun.BaseModel `bun:"table:oauth_clients,alias:oauth_client"` + UID string `bun:"uid,pk,type:varchar(36)"` ClientID string `bun:"client_id,notnull"` SecretHash *string `bun:"secret_hash"` @@ -19,7 +22,7 @@ type OAuthClient struct { RedirectURIs []string `bun:"redirect_uris,type:jsonb,nullzero"` GrantTypes []string `bun:"grant_types,type:jsonb,nullzero"` Scopes []string `bun:"scopes,type:jsonb,nullzero"` - IsPublic bool `bun:"is_public,notnull,default:true"` + IsPublic bool `bun:"is_public,notnull"` CreatedAt time.Time `bun:"created_at,notnull,default:current_timestamp"` UpdatedAt time.Time `bun:"updated_at,notnull,default:current_timestamp"` } @@ -42,6 +45,8 @@ func NewOAuthClient(clientID string) *OAuthClient { // consented. Redemption is gated by ConsumedAt (set on first use) so a replay // is detectable and rejected. type OAuthAuthCode struct { + bun.BaseModel `bun:"table:oauth_auth_codes,alias:oauth_auth_code"` + UID string `bun:"uid,pk,type:varchar(36)"` Code string `bun:"code,notnull"` ClientID string `bun:"client_id,notnull"` @@ -74,6 +79,8 @@ func NewOAuthAuthCode(code, clientID, userUID, orgUID string) *OAuthAuthCode { // so a stolen-and-reused refresh token is detectable. Tokens are also revoked // on logout / PAT-revoke. type OAuthRefreshToken struct { + bun.BaseModel `bun:"table:oauth_refresh_tokens,alias:oauth_refresh_token"` + UID string `bun:"uid,pk,type:varchar(36)"` Token string `bun:"token,notnull"` ClientID string `bun:"client_id,notnull"` diff --git a/server/internal/db/oauth_test.go b/server/internal/db/oauth_test.go new file mode 100644 index 000000000..7baf96eeb --- /dev/null +++ b/server/internal/db/oauth_test.go @@ -0,0 +1,129 @@ +package db_test + +import ( + "context" + "testing" + "time" + + "github.com/google/uuid" + "github.com/stretchr/testify/require" + + "github.com/fclairamb/solidping/server/internal/db" + "github.com/fclairamb/solidping/server/internal/db/models" +) + +// testOAuthRepos is the cross-engine (Postgres + SQLite) parity guard for the +// MCP OAuth tables: client persistence, single-use authorization codes, and +// rotating refresh tokens (spec 2026-06-20-03). It runs under the shared +// testService harness so both dialects exercise the same assertions. +func testOAuthRepos(ctx context.Context, t *testing.T, svc db.Service) { + t.Helper() + + r := require.New(t) + + org := models.NewOrganization("oauth-repos-org", "") + r.NoError(svc.CreateOrganization(ctx, org)) + + user := models.NewUser("oauth-repos@example.com") + r.NoError(svc.CreateUser(ctx, user)) + + now := time.Now() + + // --- Client round-trip --- + secret := "hashed-secret" + client := &models.OAuthClient{ + UID: uuid.New().String(), + ClientID: "client-" + uuid.New().String(), + SecretHash: &secret, + ClientName: "Test MCP Client", + RedirectURIs: []string{"http://127.0.0.1:1234/callback"}, + GrantTypes: []string{"authorization_code", "refresh_token"}, + Scopes: []string{"mcp"}, + IsPublic: false, + CreatedAt: now, + UpdatedAt: now, + } + r.NoError(svc.CreateOAuthClient(ctx, client)) + + gotClient, err := svc.GetOAuthClientByClientID(ctx, client.ClientID) + r.NoError(err) + r.Equal(client.ClientID, gotClient.ClientID) + r.Equal([]string{"http://127.0.0.1:1234/callback"}, gotClient.RedirectURIs) + r.NotNil(gotClient.SecretHash) + r.False(gotClient.IsPublic) + + _, err = svc.GetOAuthClientByClientID(ctx, "does-not-exist") + r.Error(err, "missing client must error") + + // --- Authorization code: single-use compare-and-set --- + code := &models.OAuthAuthCode{ + UID: uuid.New().String(), + Code: "code-" + uuid.New().String(), + ClientID: client.ClientID, + UserUID: user.UID, + OrganizationUID: org.UID, + RedirectURI: "http://127.0.0.1:1234/callback", + Scope: "mcp", + Resource: "https://example.com/api/v1/mcp", + CodeChallenge: "challenge", + CodeChallengeMethod: "S256", + ExpiresAt: now.Add(time.Minute), + CreatedAt: now, + } + r.NoError(svc.CreateOAuthAuthCode(ctx, code)) + + gotCode, err := svc.GetOAuthAuthCode(ctx, code.Code) + r.NoError(err) + r.Equal(code.Resource, gotCode.Resource) + r.Nil(gotCode.ConsumedAt, "fresh code is not consumed") + + won, err := svc.ConsumeOAuthAuthCode(ctx, code.Code, now) + r.NoError(err) + r.True(won, "first consume wins") + + wonAgain, err := svc.ConsumeOAuthAuthCode(ctx, code.Code, now) + r.NoError(err) + r.False(wonAgain, "replay of a consumed code loses the race (single-use)") + + // --- Refresh token: rotation + user-wide revocation --- + refresh := &models.OAuthRefreshToken{ + UID: uuid.New().String(), + Token: "refresh-" + uuid.New().String(), + ClientID: client.ClientID, + UserUID: user.UID, + OrganizationUID: org.UID, + Scope: "mcp", + Resource: "https://example.com/api/v1/mcp", + ExpiresAt: now.Add(time.Hour), + CreatedAt: now, + } + r.NoError(svc.CreateOAuthRefreshToken(ctx, refresh)) + + revoked, err := svc.RevokeOAuthRefreshToken(ctx, refresh.Token, now) + r.NoError(err) + r.True(revoked, "first revoke wins") + + revokedAgain, err := svc.RevokeOAuthRefreshToken(ctx, refresh.Token, now) + r.NoError(err) + r.False(revokedAgain, "rotating an already-revoked token loses the race") + + // A second active token, then a user-wide revoke (logout / PAT revoke). + refresh2 := &models.OAuthRefreshToken{ + UID: uuid.New().String(), + Token: "refresh2-" + uuid.New().String(), + ClientID: client.ClientID, + UserUID: user.UID, + OrganizationUID: org.UID, + Scope: "mcp", + Resource: "https://example.com/api/v1/mcp", + ExpiresAt: now.Add(time.Hour), + CreatedAt: now, + } + r.NoError(svc.CreateOAuthRefreshToken(ctx, refresh2)) + + r.NoError(svc.RevokeOAuthRefreshTokensForUser(ctx, user.UID, now)) + + got2, err := svc.GetOAuthRefreshToken(ctx, refresh2.Token) + r.NoError(err) + r.NotNil(got2.RevokedAt, "user-wide revoke marks the active token revoked") +} diff --git a/server/internal/db/service_test.go b/server/internal/db/service_test.go index db33bedb6..89dc33d55 100644 --- a/server/internal/db/service_test.go +++ b/server/internal/db/service_test.go @@ -92,6 +92,10 @@ func testService(t *testing.T, svc db.Service) { t.Run("UpdateCheckStatusAndClocksTriState", func(t *testing.T) { testUpdateCheckStatusAndClocksTriState(ctx, t, svc) }) + + t.Run("OAuthRepos", func(t *testing.T) { + testOAuthRepos(ctx, t, svc) + }) } // testUpdateCheckStatusAndClocksTriState is the cross-engine parity guard for diff --git a/server/internal/middleware/auth.go b/server/internal/middleware/auth.go index 97169b71e..1c5f4f4f1 100644 --- a/server/internal/middleware/auth.go +++ b/server/internal/middleware/auth.go @@ -96,27 +96,27 @@ func (m *AuthMiddleware) RequireAuth(next bunrouter.HandlerFunc) bunrouter.Handl // back-compat — the MCP handler's scope check still governs them. func (m *AuthMiddleware) RequireMCPAuth(next bunrouter.HandlerFunc) bunrouter.HandlerFunc { return func(writer http.ResponseWriter, req bunrouter.Request) error { - md := oauth.NewMetadata(m.cfg.Server.BaseURL) + meta := oauth.NewMetadata(m.cfg.Server.BaseURL) token := extractToken(req.Request) if token == "" { - return m.writeMCPChallenge(writer, md, base.ErrorCodeNoToken, "Authorization token is required") + return m.writeMCPChallenge(writer, meta, base.ErrorCodeNoToken, "Authorization token is required") } claims, err := m.authService.ValidateToken(req.Context(), token) if err != nil { - return m.writeMCPChallenge(writer, md, base.ErrorCodeInvalidToken, "Invalid or expired token") + return m.writeMCPChallenge(writer, meta, base.ErrorCodeInvalidToken, "Invalid or expired token") } // Audience binding (RFC 8707): reject a token minted for another resource. - if !oauth.TokenHasResourceAudience(claims, md.ResourceURL()) { - return m.writeMCPChallenge(writer, md, base.ErrorCodeInvalidToken, + if !oauth.TokenHasResourceAudience(claims, meta.ResourceURL()) { + return m.writeMCPChallenge(writer, meta, base.ErrorCodeInvalidToken, "Token audience does not include the MCP resource") } user, err := m.dbService.GetUser(req.Context(), claims.UserUID) if err != nil { - return m.writeMCPChallenge(writer, md, base.ErrorCodeUserNotFound, "User not found") + return m.writeMCPChallenge(writer, meta, base.ErrorCodeUserNotFound, "User not found") } ctx := req.Context() @@ -130,10 +130,10 @@ func (m *AuthMiddleware) RequireMCPAuth(next bunrouter.HandlerFunc) bunrouter.Ha // writeMCPChallenge writes a 401 carrying the RFC 9728 resource_metadata pointer // so MCP clients can discover the authorization server. func (m *AuthMiddleware) writeMCPChallenge( - writer http.ResponseWriter, md oauth.Metadata, code base.ErrorCode, message string, + writer http.ResponseWriter, meta oauth.Metadata, code base.ErrorCode, message string, ) error { writer.Header().Set("WWW-Authenticate", - `Bearer resource_metadata="`+md.ProtectedResourceMetadataURL()+`"`) + `Bearer resource_metadata="`+meta.ProtectedResourceMetadataURL()+`"`) return m.WriteError(writer, http.StatusUnauthorized, code, message) } diff --git a/server/internal/middleware/mcpauth_test.go b/server/internal/middleware/mcpauth_test.go new file mode 100644 index 000000000..e6a014880 --- /dev/null +++ b/server/internal/middleware/mcpauth_test.go @@ -0,0 +1,136 @@ +package middleware_test + +import ( + "context" + "net/http" + "net/http/httptest" + "strings" + "testing" + "time" + + "github.com/stretchr/testify/require" + "github.com/uptrace/bunrouter" + + "github.com/fclairamb/solidping/server/internal/config" + "github.com/fclairamb/solidping/server/internal/db/models" + "github.com/fclairamb/solidping/server/internal/db/sqlite" + "github.com/fclairamb/solidping/server/internal/handlers/auth" + "github.com/fclairamb/solidping/server/internal/middleware" +) + +const mcpTestIssuer = "https://solidping.test" + +// setupMCPAuth builds an AuthMiddleware backed by in-memory SQLite plus a real +// auth.Service, and seeds an org + user so a minted access token resolves to a +// real user inside RequireMCPAuth. +func setupMCPAuth(t *testing.T) (*middleware.AuthMiddleware, *auth.Service, *models.User, context.Context) { + t.Helper() + + ctx := t.Context() + + dbService, err := sqlite.New(ctx, sqlite.Config{InMemory: true}) + require.NoError(t, err) + require.NoError(t, dbService.Initialize(ctx)) + + t.Cleanup(func() { _ = dbService.Close() }) + + cfg := &config.Config{ + Server: config.ServerConfig{BaseURL: mcpTestIssuer}, + Auth: config.AuthConfig{ + JWTSecret: "test-jwt-secret", + AccessTokenExpiry: time.Hour, + RefreshTokenExpiry: 7 * 24 * time.Hour, + }, + } + + authSvc := auth.NewService(dbService, cfg.Auth, cfg, nil, nil) + mw := middleware.NewAuthMiddleware(authSvc, dbService, cfg) + + org := models.NewOrganization("mcp-auth-org", "") + require.NoError(t, dbService.CreateOrganization(ctx, org)) + + user := models.NewUser("mcp-auth@example.com") + require.NoError(t, dbService.CreateUser(ctx, user)) + + return mw, authSvc, user, ctx +} + +func mcpRequest(ctx context.Context, token string) (bunrouter.Request, *httptest.ResponseRecorder) { + r := httptest.NewRequestWithContext(ctx, http.MethodPost, "/api/v1/mcp", http.NoBody) + if token != "" { + r.Header.Set("Authorization", "Bearer "+token) + } + + return bunrouter.NewRequest(r), httptest.NewRecorder() +} + +func okMCPHandler(called *bool) bunrouter.HandlerFunc { + return func(w http.ResponseWriter, _ bunrouter.Request) error { + *called = true + w.WriteHeader(http.StatusOK) + + return nil + } +} + +func TestRequireMCPAuthNoTokenChallenge(t *testing.T) { + t.Parallel() + + mw, _, _, ctx := setupMCPAuth(t) + + var called bool + req, rec := mcpRequest(ctx, "") + err := mw.RequireMCPAuth(okMCPHandler(&called))(rec, req) + require.NoError(t, err) + + require.False(t, called, "handler must not run without auth") + require.Equal(t, http.StatusUnauthorized, rec.Code) + + challenge := rec.Header().Get("WWW-Authenticate") + require.True(t, strings.HasPrefix(challenge, "Bearer "), "must be a Bearer challenge") + require.Contains(t, challenge, + `resource_metadata="`+mcpTestIssuer+`/.well-known/oauth-protected-resource"`, + "challenge must point at the protected-resource metadata") +} + +func TestRequireMCPAuthValidAudienceBoundToken(t *testing.T) { + t.Parallel() + + mw, authSvc, user, ctx := setupMCPAuth(t) + + resource := mcpTestIssuer + "/api/v1/mcp" + token, err := authSvc.GenerateMCPAccessToken( + user.UID, "mcp-auth-org", []string{"mcp"}, resource, time.Hour, + ) + require.NoError(t, err) + + var called bool + req, rec := mcpRequest(ctx, token) + err = mw.RequireMCPAuth(okMCPHandler(&called))(rec, req) + require.NoError(t, err) + + require.True(t, called, "audience-bound token must pass") + require.Equal(t, http.StatusOK, rec.Code) +} + +func TestRequireMCPAuthWrongAudienceRejected(t *testing.T) { + t.Parallel() + + mw, authSvc, user, ctx := setupMCPAuth(t) + + // Token minted for a DIFFERENT resource → must be rejected at the MCP gate. + token, err := authSvc.GenerateMCPAccessToken( + user.UID, "mcp-auth-org", []string{"mcp"}, + "https://other.example.com/api/v1/mcp", time.Hour, + ) + require.NoError(t, err) + + var called bool + req, rec := mcpRequest(ctx, token) + err = mw.RequireMCPAuth(okMCPHandler(&called))(rec, req) + require.NoError(t, err) + + require.False(t, called, "wrong-audience token must not reach the handler") + require.Equal(t, http.StatusUnauthorized, rec.Code) + require.Contains(t, rec.Header().Get("WWW-Authenticate"), "resource_metadata=") +} diff --git a/server/internal/notifications/slack_test.go b/server/internal/notifications/slack_test.go index 5da2c38a8..30d65e096 100644 --- a/server/internal/notifications/slack_test.go +++ b/server/internal/notifications/slack_test.go @@ -637,6 +637,42 @@ func (m *mockDBService) DeleteUserToken(_ context.Context, _ string) error { panic("not implemented") } +func (m *mockDBService) CreateOAuthClient(_ context.Context, _ *models.OAuthClient) error { + panic("not implemented") +} + +func (m *mockDBService) GetOAuthClientByClientID(_ context.Context, _ string) (*models.OAuthClient, error) { + panic("not implemented") +} + +func (m *mockDBService) CreateOAuthAuthCode(_ context.Context, _ *models.OAuthAuthCode) error { + panic("not implemented") +} + +func (m *mockDBService) GetOAuthAuthCode(_ context.Context, _ string) (*models.OAuthAuthCode, error) { + panic("not implemented") +} + +func (m *mockDBService) ConsumeOAuthAuthCode(_ context.Context, _ string, _ time.Time) (bool, error) { + panic("not implemented") +} + +func (m *mockDBService) CreateOAuthRefreshToken(_ context.Context, _ *models.OAuthRefreshToken) error { + panic("not implemented") +} + +func (m *mockDBService) GetOAuthRefreshToken(_ context.Context, _ string) (*models.OAuthRefreshToken, error) { + panic("not implemented") +} + +func (m *mockDBService) RevokeOAuthRefreshToken(_ context.Context, _ string, _ time.Time) (bool, error) { + panic("not implemented") +} + +func (m *mockDBService) RevokeOAuthRefreshTokensForUser(_ context.Context, _ string, _ time.Time) error { + panic("not implemented") +} + func (m *mockDBService) CreateUserPasskey(_ context.Context, _ *models.UserPasskey) error { panic("not implemented") } diff --git a/server/internal/oauth/audience.go b/server/internal/oauth/audience.go index b261031e4..9fa81d7bc 100644 --- a/server/internal/oauth/audience.go +++ b/server/internal/oauth/audience.go @@ -16,7 +16,7 @@ func TokenHasResourceAudience(claims *auth.Claims, resource string) bool { return false } - aud := claims.RegisteredClaims.Audience + aud := claims.Audience if len(aud) == 0 { // No audience binding → PAT / legacy session token → back-compat path. return true diff --git a/server/internal/oauth/authorize.go b/server/internal/oauth/authorize.go index 93a527238..56d37c126 100644 --- a/server/internal/oauth/authorize.go +++ b/server/internal/oauth/authorize.go @@ -28,14 +28,14 @@ type authRequest struct { // parseAuthRequest reads the OAuth authorization parameters from the query // string (GET) or form body (POST). -func parseAuthRequest(req *http.Request) authRequest { +func parseAuthRequest(req *http.Request) *authRequest { get := req.URL.Query().Get if req.Method == http.MethodPost { _ = req.ParseForm() get = req.Form.Get } - return authRequest{ + return &authRequest{ ClientID: get("client_id"), RedirectURI: get("redirect_uri"), ResponseType: get("response_type"), @@ -52,70 +52,70 @@ func parseAuthRequest(req *http.Request) authRequest { // render errors (shown to the user) so we never redirect to an unvalidated URI; // once client + redirect_uri are trusted, later errors redirect back to the // client per RFC 6749 §4.1.2.1. -func (h *Handler) validateAuthRequest(req bunrouter.Request, ar authRequest) (*authRequest, *authError) { - md := h.metadata() +func (h *Handler) validateAuthRequest(req bunrouter.Request, authReq *authRequest) (*authRequest, *authError) { + meta := h.metadata() - if ar.ClientID == "" { + if authReq.ClientID == "" { return nil, newRenderError(ErrInvalidRequest, "client_id is required") } - client, err := h.svc.GetClient(req.Context(), ar.ClientID) + client, err := h.svc.GetClient(req.Context(), authReq.ClientID) if err != nil { return nil, newRenderError(ErrInvalidClient, "unknown client_id") } // redirect_uri must match a registered URI exactly (loopback ignores port). - if ar.RedirectURI == "" || !RedirectURIAllowed(ar.RedirectURI, client.RedirectURIs) { + if authReq.RedirectURI == "" || !RedirectURIAllowed(authReq.RedirectURI, client.RedirectURIs) { return nil, newRenderError(ErrInvalidRedirectURI, "redirect_uri is not registered for this client") } // From here on a trusted redirect target exists → report errors by redirect. - if ar.ResponseType != "code" { + if authReq.ResponseType != ResponseTypeCode { return nil, newRedirectError(ErrUnsupportedResponseType, - "only response_type=code is supported", ar.RedirectURI, ar.State) + "only response_type=code is supported", authReq.RedirectURI, authReq.State) } // PKCE is mandatory and S256-only (OAuth 2.1 forbids plain). - if ar.CodeChallenge == "" { + if authReq.CodeChallenge == "" { return nil, newRedirectError(ErrInvalidRequest, "code_challenge is required (PKCE)", - ar.RedirectURI, ar.State) + authReq.RedirectURI, authReq.State) } - if ar.CodeChallengeMethod == "" { - ar.CodeChallengeMethod = CodeChallengeMethodS256 + if authReq.CodeChallengeMethod == "" { + authReq.CodeChallengeMethod = CodeChallengeMethodS256 } - if ar.CodeChallengeMethod != CodeChallengeMethodS256 { + if authReq.CodeChallengeMethod != CodeChallengeMethodS256 { return nil, newRedirectError(ErrInvalidRequest, - "code_challenge_method must be S256", ar.RedirectURI, ar.State) + "code_challenge_method must be S256", authReq.RedirectURI, authReq.State) } - if !validCodeChallenge(ar.CodeChallenge) { + if !validCodeChallenge(authReq.CodeChallenge) { return nil, newRedirectError(ErrInvalidRequest, "malformed code_challenge", - ar.RedirectURI, ar.State) + authReq.RedirectURI, authReq.State) } // scope defaults to full mcp; explicit scopes must be recognized. - if ar.Scope == "" { - ar.Scope = ScopeMCP + if authReq.Scope == "" { + authReq.Scope = ScopeMCP } - if !ScopesValid(ParseScopes(ar.Scope)) { + if !ScopesValid(ParseScopes(authReq.Scope)) { return nil, newRedirectError(ErrInvalidScope, "unsupported scope requested", - ar.RedirectURI, ar.State) + authReq.RedirectURI, authReq.State) } // resource (RFC 8707) must match the MCP resource when supplied; default it. - if ar.Resource == "" { - ar.Resource = md.ResourceURL() + if authReq.Resource == "" { + authReq.Resource = meta.ResourceURL() } - if ar.Resource != md.ResourceURL() { + if authReq.Resource != meta.ResourceURL() { return nil, newRedirectError(ErrInvalidRequest, - "resource does not match the MCP resource", ar.RedirectURI, ar.State) + "resource does not match the MCP resource", authReq.RedirectURI, authReq.State) } - return &ar, nil + return authReq, nil } // session extracts and validates the logged-in user from the request's @@ -139,25 +139,23 @@ func (h *Handler) session(req bunrouter.Request) (*auth.Claims, bool) { // either redirects to the dashboard login (no session) or to the dashboard // consent screen (valid session). The actual code is minted by ApproveAuthorize // once the user consents. -func (h *Handler) Authorize(w http.ResponseWriter, req bunrouter.Request) error { - raw := parseAuthRequest(req.Request) - - ar, authErr := h.validateAuthRequest(req, raw) +func (h *Handler) Authorize(writer http.ResponseWriter, req bunrouter.Request) error { + authReq, authErr := h.validateAuthRequest(req, parseAuthRequest(req.Request)) if authErr != nil { - return h.handleAuthError(w, req, authErr) + return h.handleAuthError(writer, req, authErr) } claims, ok := h.session(req) if !ok { // No session → bounce through the dashboard login, returning here after. - h.redirectToLogin(w, req) + h.redirectToLogin(writer, req) return nil } // Valid session → hand off to the consent SPA route, which will POST back to // approve. Pass the already-validated parameters through. - h.redirectToConsent(w, claims.OrgSlug, ar) + h.redirectToConsent(writer, claims.OrgSlug, authReq) return nil } @@ -166,95 +164,93 @@ func (h *Handler) Authorize(w http.ResponseWriter, req bunrouter.Request) error // the consent screen. It re-validates the request, requires a session, mints a // single-use code bound to the grant, and redirects to the client's redirect_uri // with code + state. -func (h *Handler) ApproveAuthorize(w http.ResponseWriter, req bunrouter.Request) error { - raw := parseAuthRequest(req.Request) - - ar, authErr := h.validateAuthRequest(req, raw) +func (h *Handler) ApproveAuthorize(writer http.ResponseWriter, req bunrouter.Request) error { + authReq, authErr := h.validateAuthRequest(req, parseAuthRequest(req.Request)) if authErr != nil { - return h.handleAuthError(w, req, authErr) + return h.handleAuthError(writer, req, authErr) } claims, ok := h.session(req) if !ok { - return h.WriteError(w, http.StatusUnauthorized, base.ErrorCodeUnauthorized, + return h.WriteError(writer, http.StatusUnauthorized, base.ErrorCodeUnauthorized, "A logged-in session is required to authorize") } // The user denied consent → return to the client with access_denied rather // than minting a code (RFC 6749 §4.1.2.1). if req.Form.Get("decision") == "deny" { - return h.handleAuthError(w, req, newRedirectError(ErrAccessDenied, - "the user denied the authorization request", ar.RedirectURI, ar.State)) + return h.handleAuthError(writer, req, newRedirectError(ErrAccessDenied, + "the user denied the authorization request", authReq.RedirectURI, authReq.State)) } org, err := h.svc.db.GetOrganizationBySlug(req.Context(), claims.OrgSlug) if err != nil { - return h.WriteInternalError(w, err) + return h.WriteInternalError(writer, err) } - code, err := h.svc.IssueAuthCode(req.Context(), AuthCodeGrant{ - ClientID: ar.ClientID, + code, err := h.svc.IssueAuthCode(req.Context(), &AuthCodeGrant{ + ClientID: authReq.ClientID, UserUID: claims.UserUID, OrgUID: org.UID, OrgSlug: claims.OrgSlug, - RedirectURI: ar.RedirectURI, - Scope: ar.Scope, - Resource: ar.Resource, - CodeChallenge: ar.CodeChallenge, - CodeChallengeMethod: ar.CodeChallengeMethod, + RedirectURI: authReq.RedirectURI, + Scope: authReq.Scope, + Resource: authReq.Resource, + CodeChallenge: authReq.CodeChallenge, + CodeChallengeMethod: authReq.CodeChallengeMethod, }) if err != nil { - return h.WriteInternalError(w, err) + return h.WriteInternalError(writer, err) } - dest := appendQuery(ar.RedirectURI, map[string]string{"code": code, "state": ar.State}) - http.Redirect(w, req.Request, dest, http.StatusFound) + dest := appendQuery(authReq.RedirectURI, map[string]string{"code": code, "state": authReq.State}) + http.Redirect(writer, req.Request, dest, http.StatusFound) return nil } // handleAuthError reports a validation error either by redirecting back to the // client (safe target established) or by rendering an error to the user. -func (h *Handler) handleAuthError(w http.ResponseWriter, req bunrouter.Request, e *authError) error { - if e.Redirect && e.RedirectURI != "" { - dest := appendQuery(e.RedirectURI, map[string]string{ - "error": e.Code, - "error_description": e.Description, - "state": e.State, +func (h *Handler) handleAuthError(writer http.ResponseWriter, req bunrouter.Request, authErr *authError) error { + if authErr.Redirect && authErr.RedirectURI != "" { + dest := appendQuery(authErr.RedirectURI, map[string]string{ + "error": authErr.Code, + "error_description": authErr.Description, + "state": authErr.State, }) - http.Redirect(w, req.Request, dest, http.StatusFound) + http.Redirect(writer, req.Request, dest, http.StatusFound) return nil } - return h.WriteError(w, http.StatusBadRequest, base.ErrorCodeValidationError, e.Error()) + return h.WriteError(writer, http.StatusBadRequest, base.ErrorCodeValidationError, authErr.Error()) } // redirectToLogin bounces an unauthenticated /authorize request through the // dashboard login, encoding the full original request as returnTo so the browser // lands back here (now carrying the session cookie) after logging in. -func (h *Handler) redirectToLogin(w http.ResponseWriter, req bunrouter.Request) { +func (h *Handler) redirectToLogin(writer http.ResponseWriter, req bunrouter.Request) { returnTo := h.metadata().Issuer + req.URL.RequestURI() loginURL := "/dash0/login?returnTo=" + url.QueryEscape(returnTo) - http.Redirect(w, req.Request, loginURL, http.StatusFound) + http.Redirect(writer, req.Request, loginURL, http.StatusFound) } // redirectToConsent sends the browser to the dashboard consent SPA route with // the validated authorization parameters so the user can approve or deny. -func (h *Handler) redirectToConsent(w http.ResponseWriter, orgSlug string, ar *authRequest) { - q := url.Values{} - q.Set("client_id", ar.ClientID) - q.Set("redirect_uri", ar.RedirectURI) - q.Set("response_type", ar.ResponseType) - q.Set("scope", ar.Scope) - q.Set("state", ar.State) - q.Set("resource", ar.Resource) - q.Set("code_challenge", ar.CodeChallenge) - q.Set("code_challenge_method", ar.CodeChallengeMethod) - - consentURL := "/dash0/orgs/" + url.PathEscape(orgSlug) + "/oauth/consent?" + q.Encode() - w.Header().Set("Location", consentURL) - w.WriteHeader(http.StatusFound) +func (h *Handler) redirectToConsent(writer http.ResponseWriter, orgSlug string, authReq *authRequest) { + query := url.Values{} + query.Set("client_id", authReq.ClientID) + query.Set("redirect_uri", authReq.RedirectURI) + query.Set("response_type", authReq.ResponseType) + query.Set("scope", authReq.Scope) + query.Set("state", authReq.State) + query.Set("resource", authReq.Resource) + query.Set("code_challenge", authReq.CodeChallenge) + query.Set("code_challenge_method", authReq.CodeChallengeMethod) + + consentURL := "/dash0/orgs/" + url.PathEscape(orgSlug) + "/oauth/consent?" + query.Encode() + writer.Header().Set("Location", consentURL) + writer.WriteHeader(http.StatusFound) } // extractSessionToken pulls the session token from the access_token cookie or a @@ -280,20 +276,20 @@ func extractSessionToken(req *http.Request) string { // appendQuery appends the given non-empty params to a URL's query string, // preserving any existing query. func appendQuery(rawURL string, params map[string]string) string { - u, err := url.Parse(rawURL) + parsed, err := url.Parse(rawURL) if err != nil { return rawURL } - q := u.Query() + query := parsed.Query() - for k, v := range params { - if v != "" { - q.Set(k, v) + for key, value := range params { + if value != "" { + query.Set(key, value) } } - u.RawQuery = q.Encode() + parsed.RawQuery = query.Encode() - return u.String() + return parsed.String() } diff --git a/server/internal/oauth/client.go b/server/internal/oauth/client.go index 2ac81c8e4..dc63a8c9c 100644 --- a/server/internal/oauth/client.go +++ b/server/internal/oauth/client.go @@ -15,16 +15,16 @@ import ( // Everything else over http is rejected — plaintext http to a non-loopback host // would leak the authorization code in transit. func IsLoopbackRedirectURI(redirectURI string) bool { - u, err := url.Parse(redirectURI) + parsed, err := url.Parse(redirectURI) if err != nil { return false } - if u.Scheme != "http" { + if parsed.Scheme != "http" { return false } - host := u.Hostname() + host := parsed.Hostname() if host == "localhost" { return true } @@ -42,8 +42,8 @@ func IsLoopbackRedirectURI(redirectURI string) bool { // A bare http non-loopback URI, a missing host, or a fragment (forbidden by // RFC 6749 §3.1.2) is rejected. func IsValidRedirectURI(redirectURI string) bool { - u, err := url.Parse(redirectURI) - if err != nil || u.Host == "" || u.Fragment != "" { + parsed, err := url.Parse(redirectURI) + if err != nil || parsed.Host == "" || parsed.Fragment != "" { return false } @@ -51,7 +51,7 @@ func IsValidRedirectURI(redirectURI string) bool { return true } - return u.Scheme == "https" + return parsed.Scheme == "https" } // RedirectURIAllowed reports whether requestedURI is permitted for a client whose @@ -80,18 +80,18 @@ func RedirectURIAllowed(requestedURI string, registered []string) bool { } // loopbackHostPathEqual compares two loopback redirect URIs ignoring the port. -func loopbackHostPathEqual(a, b string) bool { - ua, err := url.Parse(a) +func loopbackHostPathEqual(first, second string) bool { + firstURL, err := url.Parse(first) if err != nil { return false } - ub, err := url.Parse(b) + secondURL, err := url.Parse(second) if err != nil { return false } - return ua.Hostname() == ub.Hostname() && ua.Path == ub.Path + return firstURL.Hostname() == secondURL.Hostname() && firstURL.Path == secondURL.Path } // ScopesValid reports whether every requested scope is a recognized MCP scope. diff --git a/server/internal/oauth/client_test.go b/server/internal/oauth/client_test.go new file mode 100644 index 000000000..48595a50f --- /dev/null +++ b/server/internal/oauth/client_test.go @@ -0,0 +1,99 @@ +package oauth + +import ( + "testing" + + "github.com/stretchr/testify/require" +) + +func TestIsLoopbackRedirectURI(t *testing.T) { + t.Parallel() + + tests := []struct { + name string + uri string + want bool + }{ + {"ipv4 loopback any port", "http://127.0.0.1:5173/callback", true}, + {"localhost", "http://localhost:1410/cb", true}, + {"ipv6 loopback", "http://[::1]:8080/cb", true}, + {"https loopback is not the loopback http exception", "https://127.0.0.1/cb", false}, + {"non-loopback http", "http://example.com/cb", false}, + {"public https", "https://app.example.com/cb", false}, + {"garbage", "::::", false}, + } + + for _, tc := range tests { + t.Run(tc.name, func(t *testing.T) { + t.Parallel() + + require.Equal(t, tc.want, IsLoopbackRedirectURI(tc.uri)) + }) + } +} + +func TestIsValidRedirectURI(t *testing.T) { + t.Parallel() + + tests := []struct { + name string + uri string + want bool + }{ + {"https web", "https://app.example.com/callback", true}, + {"loopback http", "http://127.0.0.1:9000/cb", true}, + {"plain http non-loopback rejected", "http://evil.example.com/cb", false}, + {"fragment rejected", "https://app.example.com/cb#frag", false}, + {"no host rejected", "https:///cb", false}, + {"empty rejected", "", false}, + } + + for _, tc := range tests { + t.Run(tc.name, func(t *testing.T) { + t.Parallel() + + require.Equal(t, tc.want, IsValidRedirectURI(tc.uri)) + }) + } +} + +func TestRedirectURIAllowed(t *testing.T) { + t.Parallel() + + registered := []string{ + "https://app.example.com/callback", + "http://127.0.0.1:1234/cb", + } + + tests := []struct { + name string + requested string + want bool + }{ + {"exact https match", "https://app.example.com/callback", true}, + {"https path mismatch rejected", "https://app.example.com/other", false}, + {"https host mismatch rejected", "https://evil.example.com/callback", false}, + {"loopback different port accepted", "http://127.0.0.1:55555/cb", true}, + {"loopback different path rejected", "http://127.0.0.1:55555/evil", false}, + {"empty rejected", "", false}, + } + + for _, tc := range tests { + t.Run(tc.name, func(t *testing.T) { + t.Parallel() + + require.Equal(t, tc.want, RedirectURIAllowed(tc.requested, registered)) + }) + } +} + +func TestScopesValid(t *testing.T) { + t.Parallel() + + require.True(t, ScopesValid([]string{"mcp"})) + require.True(t, ScopesValid([]string{"mcp:read"})) + require.True(t, ScopesValid([]string{"mcp", "mcp:read"})) + require.True(t, ScopesValid(nil)) + require.False(t, ScopesValid([]string{"admin"})) + require.False(t, ScopesValid([]string{"mcp", "write"})) +} diff --git a/server/internal/oauth/errors.go b/server/internal/oauth/errors.go index c2a3f878f..6ed9b32dc 100644 --- a/server/internal/oauth/errors.go +++ b/server/internal/oauth/errors.go @@ -17,7 +17,11 @@ const ( ErrInvalidClientMetadata = "invalid_client_metadata" ) -// errorBody is the RFC 6749 §5.2 / RFC 7591 §3.2.2 error JSON shape. +// errorBody is the RFC 6749 §5.2 / RFC 7591 §3.2.2 error JSON shape. The wire +// field names are snake_case as mandated by the OAuth specs, not the project's +// camelCase convention. +// +//nolint:tagliatelle // RFC 6749/7591 wire format requires snake_case field names. type errorBody struct { Error string `json:"error"` ErrorDescription string `json:"error_description,omitempty"` diff --git a/server/internal/oauth/handler_test.go b/server/internal/oauth/handler_test.go new file mode 100644 index 000000000..cab8f1118 --- /dev/null +++ b/server/internal/oauth/handler_test.go @@ -0,0 +1,156 @@ +package oauth + +import ( + "context" + "encoding/json" + "net/http" + "net/http/httptest" + "strings" + "testing" + "time" + + "github.com/stretchr/testify/require" + "github.com/uptrace/bunrouter" + + "github.com/fclairamb/solidping/server/internal/config" + "github.com/fclairamb/solidping/server/internal/db/sqlite" + "github.com/fclairamb/solidping/server/internal/handlers/auth" +) + +func setupOAuthHandler(t *testing.T) *Handler { + t.Helper() + + ctx := t.Context() + + dbService, err := sqlite.New(ctx, sqlite.Config{InMemory: true}) + require.NoError(t, err) + require.NoError(t, dbService.Initialize(ctx)) + + t.Cleanup(func() { _ = dbService.Close() }) + + cfg := &config.Config{ + Server: config.ServerConfig{BaseURL: oauthTestIssuer}, + Auth: config.AuthConfig{ + JWTSecret: "test-jwt-secret", + AccessTokenExpiry: time.Hour, + RefreshTokenExpiry: 7 * 24 * time.Hour, + }, + } + + authSvc := auth.NewService(dbService, cfg.Auth, cfg, nil, nil) + svc := NewService(dbService, authSvc, cfg) + + return NewHandler(svc, cfg) +} + +func doGET(t *testing.T, h func(http.ResponseWriter, bunrouter.Request) error, path string) *httptest.ResponseRecorder { + t.Helper() + + r := httptest.NewRequestWithContext(context.Background(), http.MethodGet, path, http.NoBody) + rec := httptest.NewRecorder() + require.NoError(t, h(rec, bunrouter.NewRequest(r))) + + return rec +} + +func TestProtectedResourceMetadataHTTP(t *testing.T) { + t.Parallel() + + h := setupOAuthHandler(t) + rec := doGET(t, h.ProtectedResourceMetadata, PathProtectedResourceMetadata) + + require.Equal(t, http.StatusOK, rec.Code) + + var doc ProtectedResourceMetadata + require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &doc)) + require.Equal(t, oauthTestIssuer+"/api/v1/mcp", doc.Resource) + require.Equal(t, []string{oauthTestIssuer}, doc.AuthorizationServers) +} + +func TestAuthorizationServerMetadataHTTP(t *testing.T) { + t.Parallel() + + h := setupOAuthHandler(t) + rec := doGET(t, h.AuthorizationServerMetadata, PathAuthorizationServerMetadata) + + require.Equal(t, http.StatusOK, rec.Code) + + var doc AuthorizationServerMetadata + require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &doc)) + require.Equal(t, oauthTestIssuer, doc.Issuer) + require.Equal(t, []string{CodeChallengeMethodS256}, doc.CodeChallengeMethodsSupported) + require.NotEmpty(t, doc.RegistrationEndpoint) +} + +func TestRegisterEndpointLoopbackPublicClient(t *testing.T) { + t.Parallel() + + h := setupOAuthHandler(t) + + body := `{"redirect_uris":["http://127.0.0.1:1234/cb"],"client_name":"Native","token_endpoint_auth_method":"none"}` + r := httptest.NewRequestWithContext(context.Background(), http.MethodPost, PathRegister, strings.NewReader(body)) + rec := httptest.NewRecorder() + require.NoError(t, h.Register(rec, bunrouter.NewRequest(r))) + + require.Equal(t, http.StatusCreated, rec.Code) + + var resp registrationResponse + require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &resp)) + require.NotEmpty(t, resp.ClientID) + require.Empty(t, resp.ClientSecret, "public client must not get a secret") + require.Equal(t, "none", resp.TokenEndpointAuthMethod) +} + +func TestRegisterEndpointRejectsNonLoopbackHTTP(t *testing.T) { + t.Parallel() + + h := setupOAuthHandler(t) + + body := `{"redirect_uris":["http://evil.example.com/cb"]}` + r := httptest.NewRequestWithContext(context.Background(), http.MethodPost, PathRegister, strings.NewReader(body)) + rec := httptest.NewRecorder() + require.NoError(t, h.Register(rec, bunrouter.NewRequest(r))) + + require.Equal(t, http.StatusBadRequest, rec.Code) + + var body2 errorBody + require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &body2)) + require.Equal(t, ErrInvalidRedirectURI, body2.Error) +} + +func TestTokenEndpointUnsupportedGrant(t *testing.T) { + t.Parallel() + + h := setupOAuthHandler(t) + + r := httptest.NewRequestWithContext(context.Background(), http.MethodPost, PathToken, + strings.NewReader("grant_type=password")) + r.Header.Set("Content-Type", "application/x-www-form-urlencoded") + rec := httptest.NewRecorder() + require.NoError(t, h.Token(rec, bunrouter.NewRequest(r))) + + require.Equal(t, http.StatusBadRequest, rec.Code) + + var body errorBody + require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &body)) + require.Equal(t, ErrUnsupportedGrantType, body.Error) +} + +func TestTokenEndpointAuthCodeRequiresPKCE(t *testing.T) { + t.Parallel() + + h := setupOAuthHandler(t) + + form := "grant_type=authorization_code&code=x&client_id=c&redirect_uri=http://127.0.0.1/cb" + r := httptest.NewRequestWithContext(context.Background(), http.MethodPost, PathToken, strings.NewReader(form)) + r.Header.Set("Content-Type", "application/x-www-form-urlencoded") + rec := httptest.NewRecorder() + require.NoError(t, h.Token(rec, bunrouter.NewRequest(r))) + + require.Equal(t, http.StatusBadRequest, rec.Code) + + var body errorBody + require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &body)) + require.Equal(t, ErrInvalidRequest, body.Error) + require.Contains(t, body.ErrorDescription, "code_verifier") +} diff --git a/server/internal/oauth/metadata.go b/server/internal/oauth/metadata.go index 34f146c1c..4acc9ba64 100644 --- a/server/internal/oauth/metadata.go +++ b/server/internal/oauth/metadata.go @@ -93,6 +93,8 @@ func (m Metadata) ProtectedResourceMetadataURL() string { // ProtectedResourceMetadata is the RFC 9728 document served at // /.well-known/oauth-protected-resource. It tells a client which authorization // server(s) issue tokens for this resource and which scopes it understands. +// +//nolint:tagliatelle // RFC 9728 wire format requires snake_case field names. type ProtectedResourceMetadata struct { Resource string `json:"resource"` AuthorizationServers []string `json:"authorization_servers"` @@ -113,6 +115,8 @@ func (m Metadata) BuildProtectedResourceMetadata() ProtectedResourceMetadata { // AuthorizationServerMetadata is the RFC 8414 document served at // /.well-known/oauth-authorization-server (and aliased at // /.well-known/openid-configuration). +// +//nolint:tagliatelle // RFC 8414 wire format requires snake_case field names. type AuthorizationServerMetadata struct { Issuer string `json:"issuer"` AuthorizationEndpoint string `json:"authorization_endpoint"` @@ -136,16 +140,25 @@ func (m Metadata) BuildAuthorizationServerMetadata() AuthorizationServerMetadata RegistrationEndpoint: m.RegistrationEndpoint(), JWKSURI: m.JWKSURI(), ScopesSupported: []string{ScopeMCP, ScopeMCPRead}, - ResponseTypesSupported: []string{"code"}, + ResponseTypesSupported: []string{ResponseTypeCode}, GrantTypesSupported: []string{GrantAuthorizationCode, GrantRefreshToken}, CodeChallengeMethodsSupported: []string{CodeChallengeMethodS256}, - TokenEndpointAuthMethodsSupported: []string{"none", "client_secret_post"}, + TokenEndpointAuthMethodsSupported: []string{AuthMethodNone, AuthMethodSecretPost}, } } -// Grant types and PKCE method constants shared across the package. +// Grant types, response types, PKCE method, and token-endpoint auth-method +// constants shared across the package. These are OAuth wire values. const ( GrantAuthorizationCode = "authorization_code" GrantRefreshToken = "refresh_token" CodeChallengeMethodS256 = "S256" + + // ResponseTypeCode is the only supported response_type (OAuth 2.1). + ResponseTypeCode = "code" + // AuthMethodNone marks a public client (no client secret). + AuthMethodNone = "none" + // AuthMethodSecretPost marks a confidential client authenticating with a + // secret in the token-request body. + AuthMethodSecretPost = "client_secret_post" ) diff --git a/server/internal/oauth/metadata_test.go b/server/internal/oauth/metadata_test.go new file mode 100644 index 000000000..b4f734789 --- /dev/null +++ b/server/internal/oauth/metadata_test.go @@ -0,0 +1,105 @@ +package oauth + +import ( + "testing" + + "github.com/stretchr/testify/require" + + "github.com/fclairamb/solidping/server/internal/handlers/auth" +) + +const testIssuer = "https://solidping.example.com" + +func TestProtectedResourceMetadataWellFormed(t *testing.T) { + t.Parallel() + + md := NewMetadata(testIssuer + "/") // trailing slash must be trimmed + doc := md.BuildProtectedResourceMetadata() + + require.Equal(t, testIssuer+"/api/v1/mcp", doc.Resource) + require.Equal(t, []string{testIssuer}, doc.AuthorizationServers) + require.Contains(t, doc.ScopesSupported, ScopeMCP) + require.Contains(t, doc.ScopesSupported, ScopeMCPRead) + require.NotEmpty(t, doc.BearerMethods) +} + +func TestAuthorizationServerMetadataWellFormed(t *testing.T) { + t.Parallel() + + md := NewMetadata(testIssuer) + doc := md.BuildAuthorizationServerMetadata() + + require.Equal(t, testIssuer, doc.Issuer) + require.Equal(t, testIssuer+"/api/v1/oauth/authorize", doc.AuthorizationEndpoint) + require.Equal(t, testIssuer+"/api/v1/oauth/token", doc.TokenEndpoint) + require.Equal(t, testIssuer+"/api/v1/oauth/register", doc.RegistrationEndpoint) + require.Equal(t, testIssuer+"/.well-known/jwks.json", doc.JWKSURI) + + // OAuth 2.1 hard requirements: S256-only PKCE, code grant, no implicit. + require.Equal(t, []string{CodeChallengeMethodS256}, doc.CodeChallengeMethodsSupported) + require.Equal(t, []string{"code"}, doc.ResponseTypesSupported) + require.Contains(t, doc.GrantTypesSupported, GrantAuthorizationCode) + require.Contains(t, doc.GrantTypesSupported, GrantRefreshToken) + require.Contains(t, doc.ScopesSupported, ScopeMCP) +} + +func TestProtectedResourceMetadataURL(t *testing.T) { + t.Parallel() + + md := NewMetadata(testIssuer) + require.Equal(t, testIssuer+"/.well-known/oauth-protected-resource", md.ProtectedResourceMetadataURL()) +} + +func TestBuildJWKSNeverLeaksSymmetricKey(t *testing.T) { + t.Parallel() + + // The v1 symmetric key must never be published; the set is empty by design. + require.Empty(t, BuildJWKS().Keys) +} + +func TestTokenHasResourceAudience(t *testing.T) { + t.Parallel() + + resource := testIssuer + "/api/v1/mcp" + + tests := []struct { + name string + claims *auth.Claims + want bool + }{ + { + name: "no audience passes (PAT/legacy back-compat)", + claims: &auth.Claims{}, + want: true, + }, + { + name: "matching audience passes", + claims: func() *auth.Claims { + c := &auth.Claims{} + c.Audience = []string{resource} + + return c + }(), + want: true, + }, + { + name: "wrong audience rejected", + claims: func() *auth.Claims { + c := &auth.Claims{} + c.Audience = []string{"https://other.example.com/api/v1/mcp"} + + return c + }(), + want: false, + }, + {"nil claims rejected", nil, false}, + } + + for _, tc := range tests { + t.Run(tc.name, func(t *testing.T) { + t.Parallel() + + require.Equal(t, tc.want, TokenHasResourceAudience(tc.claims, resource)) + }) + } +} diff --git a/server/internal/oauth/pkce_test.go b/server/internal/oauth/pkce_test.go new file mode 100644 index 000000000..f6a528773 --- /dev/null +++ b/server/internal/oauth/pkce_test.go @@ -0,0 +1,65 @@ +package oauth + +import ( + "crypto/sha256" + "encoding/base64" + "testing" + + "github.com/stretchr/testify/require" +) + +func challengeFor(verifier string) string { + sum := sha256.Sum256([]byte(verifier)) + + return base64.RawURLEncoding.EncodeToString(sum[:]) +} + +func TestVerifyPKCE(t *testing.T) { + t.Parallel() + + const verifier = "abcdefghijklmnopqrstuvwxyz1234567890ABCDEFG" // 43 chars + good := challengeFor(verifier) + + tests := []struct { + name string + verifier string + challenge string + want bool + }{ + {"matching S256", verifier, good, true}, + {"wrong verifier", "not-the-right-verifier-value-padding-1234567", good, false}, + {"empty verifier", "", good, false}, + {"empty challenge", verifier, "", false}, + {"both empty", "", "", false}, + } + + for _, tc := range tests { + t.Run(tc.name, func(t *testing.T) { + t.Parallel() + + require.Equal(t, tc.want, VerifyPKCE(tc.verifier, tc.challenge)) + }) + } +} + +func TestValidCodeChallenge(t *testing.T) { + t.Parallel() + + tests := []struct { + name string + challenge string + want bool + }{ + {"43-char base64url", challengeFor("verifier"), true}, + {"too short", "short", false}, + {"empty", "", false}, + } + + for _, tc := range tests { + t.Run(tc.name, func(t *testing.T) { + t.Parallel() + + require.Equal(t, tc.want, validCodeChallenge(tc.challenge)) + }) + } +} diff --git a/server/internal/oauth/register.go b/server/internal/oauth/register.go index 5b406a97b..fbbf10efb 100644 --- a/server/internal/oauth/register.go +++ b/server/internal/oauth/register.go @@ -9,6 +9,8 @@ import ( // registrationRequest is the RFC 7591 §2 client-metadata request body. Only the // fields the MCP flow needs are modeled; unknown fields are ignored. +// +//nolint:tagliatelle // RFC 7591 wire format requires snake_case field names. type registrationRequest struct { RedirectURIs []string `json:"redirect_uris"` ClientName string `json:"client_name"` @@ -20,6 +22,8 @@ type registrationRequest struct { // registrationResponse is the RFC 7591 §3.2.1 success response. client_secret is // present only for confidential clients. +// +//nolint:tagliatelle // RFC 7591 wire format requires snake_case field names. type registrationResponse struct { ClientID string `json:"client_id"` ClientSecret string `json:"client_secret,omitempty"` @@ -37,19 +41,19 @@ type registrationResponse struct { // is treated as confidential and gets a generated secret. All redirect URIs are // validated (loopback http or https only) before persistence so the issuer can // never be turned into an open redirector. -func (h *Handler) Register(w http.ResponseWriter, req bunrouter.Request) error { +func (h *Handler) Register(writer http.ResponseWriter, req bunrouter.Request) error { var body registrationRequest if err := json.NewDecoder(req.Body).Decode(&body); err != nil { - return h.writeRegisterError(w, ErrInvalidClientMetadata, "malformed registration body") + return h.writeRegisterError(writer, ErrInvalidClientMetadata, "malformed registration body") } if len(body.RedirectURIs) == 0 { - return h.writeRegisterError(w, ErrInvalidRedirectURI, "at least one redirect_uri is required") + return h.writeRegisterError(writer, ErrInvalidRedirectURI, "at least one redirect_uri is required") } for _, uri := range body.RedirectURIs { if !IsValidRedirectURI(uri) { - return h.writeRegisterError(w, ErrInvalidRedirectURI, + return h.writeRegisterError(writer, ErrInvalidRedirectURI, "redirect_uri must be https or an http loopback address: "+uri) } } @@ -61,7 +65,7 @@ func (h *Handler) Register(w http.ResponseWriter, req bunrouter.Request) error { responseTypes := body.ResponseTypes if len(responseTypes) == 0 { - responseTypes = []string{"code"} + responseTypes = []string{ResponseTypeCode} } scopes := ParseScopes(body.Scope) @@ -70,23 +74,23 @@ func (h *Handler) Register(w http.ResponseWriter, req bunrouter.Request) error { } if !ScopesValid(scopes) { - return h.writeRegisterError(w, ErrInvalidClientMetadata, "unsupported scope requested") + return h.writeRegisterError(writer, ErrInvalidClientMetadata, "unsupported scope requested") } // Confidential only when the client explicitly opts into a secret-based auth // method. Default (and "none") is a public client — the MCP native case. - isPublic := body.TokenEndpointAuthMethod == "" || body.TokenEndpointAuthMethod == "none" + isPublic := body.TokenEndpointAuthMethod == "" || body.TokenEndpointAuthMethod == AuthMethodNone client, secret, err := h.svc.RegisterClient( req.Context(), body.ClientName, body.RedirectURIs, grantTypes, scopes, isPublic, ) if err != nil { - return h.WriteInternalError(w, err) + return h.WriteInternalError(writer, err) } - authMethod := "none" + authMethod := AuthMethodNone if !isPublic { - authMethod = "client_secret_post" + authMethod = AuthMethodSecretPost } resp := registrationResponse{ @@ -100,12 +104,12 @@ func (h *Handler) Register(w http.ResponseWriter, req bunrouter.Request) error { TokenEndpointAuthMethod: authMethod, } - return h.writeNoStoreJSON(w, http.StatusCreated, resp) + return h.writeNoStoreJSON(writer, http.StatusCreated, resp) } // writeRegisterError writes an RFC 7591 §3.2.2 registration error response. -func (h *Handler) writeRegisterError(w http.ResponseWriter, code, description string) error { - w.Header().Set("Cache-Control", "no-store") +func (h *Handler) writeRegisterError(writer http.ResponseWriter, code, description string) error { + writer.Header().Set("Cache-Control", "no-store") - return h.WriteJSON(w, http.StatusBadRequest, errorBody{Error: code, ErrorDescription: description}) + return h.WriteJSON(writer, http.StatusBadRequest, errorBody{Error: code, ErrorDescription: description}) } diff --git a/server/internal/oauth/service.go b/server/internal/oauth/service.go index 2d33570c8..ee02839e5 100644 --- a/server/internal/oauth/service.go +++ b/server/internal/oauth/service.go @@ -35,16 +35,17 @@ const ( ) // Sentinel errors returned by the service for the token/authorize flows. The -// handler maps these to the appropriate OAuth error response. +// handler maps these to the appropriate OAuth error response. They are +// package-internal — callers outside the package interact via the HTTP surface. var ( - // ErrClientNotFound means no registered client matches the client_id. - ErrClientNotFound = errors.New("oauth: client not found") - // ErrInvalidGrantErr means the auth code or refresh token is missing, - // expired, already used, revoked, or fails a binding check. - ErrInvalidGrantErr = errors.New("oauth: invalid grant") - // ErrPKCEFailed means the supplied code_verifier does not match the stored + // errClientNotFound means no registered client matches the client_id. + errClientNotFound = errors.New("oauth: client not found") + // errInvalidGrant means the auth code or refresh token is missing, expired, + // already used, revoked, or fails a binding check. + errInvalidGrant = errors.New("oauth: invalid grant") + // errPKCEFailed means the supplied code_verifier does not match the stored // code_challenge. - ErrPKCEFailed = errors.New("oauth: pkce verification failed") + errPKCEFailed = errors.New("oauth: pkce verification failed") ) // Service holds the business logic for the embedded OAuth 2.1 authorization @@ -69,9 +70,10 @@ func NewService(dbService db.Service, authSvc *auth.Service, cfg *config.Config) } } -// metadata returns the issuer-derived URLs from the current config. -func (s *Service) metadata() Metadata { - return NewMetadata(s.cfg.Server.BaseURL) +// SetClock overrides the service clock. It exists so tests can drive +// authorization-code and refresh-token expiry deterministically. +func (s *Service) SetClock(c clock.Clock) { + s.clock = c } // randomToken returns a base64url-encoded, unpadded random secret. @@ -88,7 +90,7 @@ func randomToken() (string, error) { func (s *Service) GetClient(ctx context.Context, clientID string) (*models.OAuthClient, error) { client, err := s.db.GetOAuthClientByClientID(ctx, clientID) if err != nil { - return nil, ErrClientNotFound + return nil, errClientNotFound } return client, nil @@ -112,7 +114,7 @@ type AuthCodeGrant struct { // IssueAuthCode mints a single-use, short-lived authorization code bound to the // grant. The returned code is the opaque value handed back to the client via the // redirect. -func (s *Service) IssueAuthCode(ctx context.Context, grant AuthCodeGrant) (string, error) { +func (s *Service) IssueAuthCode(ctx context.Context, grant *AuthCodeGrant) (string, error) { code, err := randomToken() if err != nil { return "", err @@ -153,26 +155,26 @@ type TokenResult struct { // It enforces, in order: the code exists, is unexpired, and is consumed exactly // once (atomic compare-and-set); the redirect_uri and client_id match the // binding; and the PKCE code_verifier matches the stored S256 challenge. Any -// failure returns ErrInvalidGrantErr / ErrPKCEFailed without minting a token. +// failure returns errInvalidGrant / errPKCEFailed without minting a token. func (s *Service) ExchangeAuthCode( ctx context.Context, code, clientID, redirectURI, codeVerifier string, ) (*TokenResult, error) { row, err := s.db.GetOAuthAuthCode(ctx, code) if err != nil { - return nil, ErrInvalidGrantErr + return nil, errInvalidGrant } now := s.clock.Now() if now.After(row.ExpiresAt) { - return nil, ErrInvalidGrantErr + return nil, errInvalidGrant } if row.ClientID != clientID || row.RedirectURI != redirectURI { - return nil, ErrInvalidGrantErr + return nil, errInvalidGrant } if !VerifyPKCE(codeVerifier, row.CodeChallenge) { - return nil, ErrPKCEFailed + return nil, errPKCEFailed } // Atomic single-use guard: a replay updates zero rows and is rejected. @@ -182,7 +184,7 @@ func (s *Service) ExchangeAuthCode( } if !won { - return nil, ErrInvalidGrantErr + return nil, errInvalidGrant } orgSlug, err := s.orgSlug(ctx, row.OrganizationUID) @@ -190,7 +192,7 @@ func (s *Service) ExchangeAuthCode( return nil, err } - return s.mintTokens(ctx, mintInput{ + return s.mintTokens(ctx, &mintInput{ clientID: row.ClientID, userUID: row.UserUID, orgUID: row.OrganizationUID, @@ -210,16 +212,16 @@ func (s *Service) ExchangeRefreshToken( ) (*TokenResult, error) { row, err := s.db.GetOAuthRefreshToken(ctx, refreshToken) if err != nil { - return nil, ErrInvalidGrantErr + return nil, errInvalidGrant } now := s.clock.Now() if row.RevokedAt != nil || now.After(row.ExpiresAt) { - return nil, ErrInvalidGrantErr + return nil, errInvalidGrant } if clientID != "" && row.ClientID != clientID { - return nil, ErrInvalidGrantErr + return nil, errInvalidGrant } won, err := s.db.RevokeOAuthRefreshToken(ctx, refreshToken, now) @@ -229,7 +231,7 @@ func (s *Service) ExchangeRefreshToken( if !won { // Lost the race → already rotated/revoked → reject. - return nil, ErrInvalidGrantErr + return nil, errInvalidGrant } orgSlug, err := s.orgSlug(ctx, row.OrganizationUID) @@ -237,7 +239,7 @@ func (s *Service) ExchangeRefreshToken( return nil, err } - return s.mintTokens(ctx, mintInput{ + return s.mintTokens(ctx, &mintInput{ clientID: row.ClientID, userUID: row.UserUID, orgUID: row.OrganizationUID, @@ -259,11 +261,11 @@ type mintInput struct { // mintTokens issues an audience-bound JWT access token (via the auth service's // signing key) and a persisted rotating refresh token. -func (s *Service) mintTokens(ctx context.Context, in mintInput) (*TokenResult, error) { - scopes := ParseScopes(in.scope) +func (s *Service) mintTokens(ctx context.Context, input *mintInput) (*TokenResult, error) { + scopes := ParseScopes(input.scope) accessToken, err := s.authSvc.GenerateMCPAccessToken( - in.userUID, in.orgSlug, scopes, in.resource, accessTokenTTL, + input.userUID, input.orgSlug, scopes, input.resource, accessTokenTTL, ) if err != nil { return nil, fmt.Errorf("mint access token: %w", err) @@ -278,11 +280,11 @@ func (s *Service) mintTokens(ctx context.Context, in mintInput) (*TokenResult, e refreshRow := &models.OAuthRefreshToken{ UID: uuid.New().String(), Token: refreshValue, - ClientID: in.clientID, - UserUID: in.userUID, - OrganizationUID: in.orgUID, - Scope: in.scope, - Resource: in.resource, + ClientID: input.clientID, + UserUID: input.userUID, + OrganizationUID: input.orgUID, + Scope: input.scope, + Resource: input.resource, ExpiresAt: now.Add(refreshTokenTTL), CreatedAt: now, } @@ -294,7 +296,7 @@ func (s *Service) mintTokens(ctx context.Context, in mintInput) (*TokenResult, e return &TokenResult{ AccessToken: accessToken, RefreshToken: refreshValue, - Scope: in.scope, + Scope: input.scope, ExpiresIn: int(accessTokenTTL.Seconds()), }, nil } diff --git a/server/internal/oauth/service_test.go b/server/internal/oauth/service_test.go new file mode 100644 index 000000000..7f4055bf8 --- /dev/null +++ b/server/internal/oauth/service_test.go @@ -0,0 +1,248 @@ +package oauth + +import ( + "context" + "testing" + "time" + + "github.com/stretchr/testify/require" + + "github.com/fclairamb/solidping/server/internal/config" + "github.com/fclairamb/solidping/server/internal/db" + "github.com/fclairamb/solidping/server/internal/db/models" + "github.com/fclairamb/solidping/server/internal/db/sqlite" + "github.com/fclairamb/solidping/server/internal/handlers/auth" + "github.com/fclairamb/solidping/server/internal/utils/clock" +) + +const oauthTestIssuer = "https://solidping.test" + +// oauthFixture bundles everything the service-level tests need: the OAuth and +// auth services plus a seeded org, user, and registered public client. +type oauthFixture struct { + svc *Service + authSvc *auth.Service + db db.Service + org *models.Organization + user *models.User + client *models.OAuthClient + //nolint:containedctx // test fixture convenience; carries the per-test context. + ctx context.Context +} + +// setupOAuthService builds an OAuth Service backed by in-memory SQLite and a +// real auth.Service (for JWT minting/validation), plus a seeded org + user and a +// registered public client with a loopback redirect. This is the SQLite path of +// the new-tables coverage; the db package's testOAuthRepos covers Postgres too. +func setupOAuthService(t *testing.T) oauthFixture { + t.Helper() + + ctx := t.Context() + + dbService, err := sqlite.New(ctx, sqlite.Config{InMemory: true}) + require.NoError(t, err) + require.NoError(t, dbService.Initialize(ctx)) + + t.Cleanup(func() { _ = dbService.Close() }) + + fullCfg := &config.Config{ + Server: config.ServerConfig{BaseURL: oauthTestIssuer}, + Auth: config.AuthConfig{ + JWTSecret: "test-jwt-secret", + AccessTokenExpiry: time.Hour, + RefreshTokenExpiry: 7 * 24 * time.Hour, + }, + } + + authSvc := auth.NewService(dbService, fullCfg.Auth, fullCfg, nil, nil) + oauthSvc := NewService(dbService, authSvc, fullCfg) + + org := models.NewOrganization("oauth-svc-org", "") + require.NoError(t, dbService.CreateOrganization(ctx, org)) + + user := models.NewUser("oauth-svc@example.com") + require.NoError(t, dbService.CreateUser(ctx, user)) + + client, _, err := oauthSvc.RegisterClient( + ctx, "Test Client", + []string{"http://127.0.0.1:1234/cb"}, + []string{GrantAuthorizationCode, GrantRefreshToken}, + []string{ScopeMCP}, true, + ) + require.NoError(t, err) + + return oauthFixture{ + svc: oauthSvc, authSvc: authSvc, db: dbService, + org: org, user: user, client: client, ctx: ctx, + } +} + +// grant builds a standard auth-code grant for the seeded fixtures. +func (f oauthFixture) grant(challenge, scope string) *AuthCodeGrant { + return &AuthCodeGrant{ + ClientID: f.client.ClientID, + UserUID: f.user.UID, + OrgUID: f.org.UID, + OrgSlug: f.org.Slug, + RedirectURI: "http://127.0.0.1:1234/cb", + Scope: scope, + Resource: oauthTestIssuer + "/api/v1/mcp", + CodeChallenge: challenge, + CodeChallengeMethod: CodeChallengeMethodS256, + } +} + +const ( + testVerifier = "abcdefghijklmnopqrstuvwxyz1234567890ABCDEFG" + testRedirectURI = "http://127.0.0.1:1234/cb" +) + +func TestExchangeAuthCodeHappyPath(t *testing.T) { + t.Parallel() + + f := setupOAuthService(t) + + code, err := f.svc.IssueAuthCode(f.ctx, f.grant(challengeFor(testVerifier), ScopeMCP)) + require.NoError(t, err) + + res, err := f.svc.ExchangeAuthCode(f.ctx, code, f.client.ClientID, testRedirectURI, testVerifier) + require.NoError(t, err) + require.NotEmpty(t, res.AccessToken) + require.NotEmpty(t, res.RefreshToken) + + // The minted access token must validate and carry the MCP audience + scope, + // so it is accepted at the MCP resource (audience binding works end to end). + claims, err := f.authSvc.ValidateToken(f.ctx, res.AccessToken) + require.NoError(t, err) + require.Contains(t, claims.Scopes, ScopeMCP) + require.True(t, TokenHasResourceAudience(claims, oauthTestIssuer+"/api/v1/mcp")) + require.Equal(t, f.org.Slug, claims.OrgSlug) +} + +func TestExchangeAuthCodeReadOnlyScope(t *testing.T) { + t.Parallel() + + f := setupOAuthService(t) + + // A consent for the read-only scope must produce a token carrying mcp:read + // (and not the broader mcp), which the MCP handler uses to refuse mutations. + code, err := f.svc.IssueAuthCode(f.ctx, f.grant(challengeFor(testVerifier), ScopeMCPRead)) + require.NoError(t, err) + + res, err := f.svc.ExchangeAuthCode(f.ctx, code, f.client.ClientID, testRedirectURI, testVerifier) + require.NoError(t, err) + + claims, err := f.authSvc.ValidateToken(f.ctx, res.AccessToken) + require.NoError(t, err) + require.Contains(t, claims.Scopes, ScopeMCPRead) + require.NotContains(t, claims.Scopes, ScopeMCP) +} + +func TestExchangeAuthCodeRejectsReplay(t *testing.T) { + t.Parallel() + + f := setupOAuthService(t) + + code, err := f.svc.IssueAuthCode(f.ctx, f.grant(challengeFor(testVerifier), ScopeMCP)) + require.NoError(t, err) + + _, err = f.svc.ExchangeAuthCode(f.ctx, code, f.client.ClientID, testRedirectURI, testVerifier) + require.NoError(t, err) + + // Second redemption of the same code must fail (single-use). + _, err = f.svc.ExchangeAuthCode(f.ctx, code, f.client.ClientID, testRedirectURI, testVerifier) + require.ErrorIs(t, err, errInvalidGrant) +} + +func TestExchangeAuthCodeRejectsBadPKCE(t *testing.T) { + t.Parallel() + + f := setupOAuthService(t) + + code, err := f.svc.IssueAuthCode(f.ctx, f.grant(challengeFor(testVerifier), ScopeMCP)) + require.NoError(t, err) + + _, err = f.svc.ExchangeAuthCode(f.ctx, code, f.client.ClientID, testRedirectURI, + "wrong-verifier-padding-to-min-length-1234567") + require.ErrorIs(t, err, errPKCEFailed) +} + +func TestExchangeAuthCodeRejectsWrongRedirect(t *testing.T) { + t.Parallel() + + f := setupOAuthService(t) + + code, err := f.svc.IssueAuthCode(f.ctx, f.grant(challengeFor(testVerifier), ScopeMCP)) + require.NoError(t, err) + + _, err = f.svc.ExchangeAuthCode(f.ctx, code, f.client.ClientID, "http://127.0.0.1:9999/evil", testVerifier) + require.ErrorIs(t, err, errInvalidGrant) +} + +func TestExchangeAuthCodeRejectsExpired(t *testing.T) { + t.Parallel() + + f := setupOAuthService(t) + + fake := clock.NewFake(time.Now()) + f.svc.SetClock(fake) + + code, err := f.svc.IssueAuthCode(f.ctx, f.grant(challengeFor(testVerifier), ScopeMCP)) + require.NoError(t, err) + + // Advance past the short auth-code TTL. + fake.Advance(2 * time.Minute) + + _, err = f.svc.ExchangeAuthCode(f.ctx, code, f.client.ClientID, testRedirectURI, testVerifier) + require.ErrorIs(t, err, errInvalidGrant) +} + +func TestRefreshTokenRotationInvalidatesPrior(t *testing.T) { + t.Parallel() + + f := setupOAuthService(t) + + code, err := f.svc.IssueAuthCode(f.ctx, f.grant(challengeFor(testVerifier), ScopeMCP)) + require.NoError(t, err) + + first, err := f.svc.ExchangeAuthCode(f.ctx, code, f.client.ClientID, testRedirectURI, testVerifier) + require.NoError(t, err) + + // Rotate once: a fresh pair is issued. + rotated, err := f.svc.ExchangeRefreshToken(f.ctx, first.RefreshToken, f.client.ClientID) + require.NoError(t, err) + require.NotEmpty(t, rotated.RefreshToken) + require.NotEqual(t, first.RefreshToken, rotated.RefreshToken) + + // The prior refresh token is now invalid. + _, err = f.svc.ExchangeRefreshToken(f.ctx, first.RefreshToken, f.client.ClientID) + require.ErrorIs(t, err, errInvalidGrant) + + // The new one still works. + _, err = f.svc.ExchangeRefreshToken(f.ctx, rotated.RefreshToken, f.client.ClientID) + require.NoError(t, err) +} + +func TestRegisterClientPublicVsConfidential(t *testing.T) { + t.Parallel() + + f := setupOAuthService(t) + + pub, pubSecret, err := f.svc.RegisterClient( + f.ctx, "Public", []string{"http://127.0.0.1:1/cb"}, + []string{GrantAuthorizationCode}, []string{ScopeMCP}, true, + ) + require.NoError(t, err) + require.Empty(t, pubSecret, "public client gets no secret") + require.Nil(t, pub.SecretHash) + require.True(t, pub.IsPublic) + + conf, confSecret, err := f.svc.RegisterClient( + f.ctx, "Confidential", []string{"https://app.example.com/cb"}, + []string{GrantAuthorizationCode}, []string{ScopeMCP}, false, + ) + require.NoError(t, err) + require.NotEmpty(t, confSecret, "confidential client gets a secret") + require.NotNil(t, conf.SecretHash) + require.False(t, conf.IsPublic) +} diff --git a/server/internal/oauth/token.go b/server/internal/oauth/token.go index efd0c058c..6dfc1f019 100644 --- a/server/internal/oauth/token.go +++ b/server/internal/oauth/token.go @@ -10,6 +10,8 @@ import ( // tokenResponse is the RFC 6749 §5.1 successful token response. The MCP access // token is a SolidPing JWT (audience-bound to the MCP resource); the refresh // token is an opaque rotating secret. +// +//nolint:tagliatelle // RFC 6749 wire format requires snake_case field names. type tokenResponse struct { AccessToken string `json:"access_token"` TokenType string `json:"token_type"` @@ -21,95 +23,95 @@ type tokenResponse struct { // Token is the OAuth token endpoint. It supports the authorization_code grant // (with PKCE verification) and the refresh_token grant (with rotation). Errors // are returned as RFC 6749 §5.2 JSON bodies with the appropriate status. -func (h *Handler) Token(w http.ResponseWriter, req bunrouter.Request) error { +func (h *Handler) Token(writer http.ResponseWriter, req bunrouter.Request) error { if err := req.ParseForm(); err != nil { - return h.writeTokenError(w, http.StatusBadRequest, ErrInvalidRequest, "malformed form body") + return h.writeTokenError(writer, http.StatusBadRequest, ErrInvalidRequest, "malformed form body") } grantType := req.Form.Get("grant_type") switch grantType { case GrantAuthorizationCode: - return h.tokenAuthorizationCode(w, req) + return h.tokenAuthorizationCode(writer, req) case GrantRefreshToken: - return h.tokenRefresh(w, req) + return h.tokenRefresh(writer, req) default: - return h.writeTokenError(w, http.StatusBadRequest, ErrUnsupportedGrantType, + return h.writeTokenError(writer, http.StatusBadRequest, ErrUnsupportedGrantType, "grant_type must be authorization_code or refresh_token") } } // tokenAuthorizationCode handles grant_type=authorization_code. -func (h *Handler) tokenAuthorizationCode(w http.ResponseWriter, req bunrouter.Request) error { +func (h *Handler) tokenAuthorizationCode(writer http.ResponseWriter, req bunrouter.Request) error { code := req.Form.Get("code") clientID := req.Form.Get("client_id") redirectURI := req.Form.Get("redirect_uri") codeVerifier := req.Form.Get("code_verifier") if code == "" || clientID == "" || redirectURI == "" { - return h.writeTokenError(w, http.StatusBadRequest, ErrInvalidRequest, + return h.writeTokenError(writer, http.StatusBadRequest, ErrInvalidRequest, "code, client_id, and redirect_uri are required") } if codeVerifier == "" { - return h.writeTokenError(w, http.StatusBadRequest, ErrInvalidRequest, + return h.writeTokenError(writer, http.StatusBadRequest, ErrInvalidRequest, "code_verifier is required (PKCE)") } result, err := h.svc.ExchangeAuthCode(req.Context(), code, clientID, redirectURI, codeVerifier) if err != nil { - return h.tokenGrantError(w, err) + return h.tokenGrantError(writer, err) } - return h.writeTokenSuccess(w, result) + return h.writeTokenSuccess(writer, result) } // tokenRefresh handles grant_type=refresh_token (rotating refresh). -func (h *Handler) tokenRefresh(w http.ResponseWriter, req bunrouter.Request) error { +func (h *Handler) tokenRefresh(writer http.ResponseWriter, req bunrouter.Request) error { refreshToken := req.Form.Get("refresh_token") clientID := req.Form.Get("client_id") if refreshToken == "" { - return h.writeTokenError(w, http.StatusBadRequest, ErrInvalidRequest, + return h.writeTokenError(writer, http.StatusBadRequest, ErrInvalidRequest, "refresh_token is required") } result, err := h.svc.ExchangeRefreshToken(req.Context(), refreshToken, clientID) if err != nil { - return h.tokenGrantError(w, err) + return h.tokenGrantError(writer, err) } - return h.writeTokenSuccess(w, result) + return h.writeTokenSuccess(writer, result) } // tokenGrantError maps a service-layer grant error to the correct OAuth error. -func (h *Handler) tokenGrantError(w http.ResponseWriter, err error) error { +func (h *Handler) tokenGrantError(writer http.ResponseWriter, err error) error { switch { - case errors.Is(err, ErrInvalidGrantErr), errors.Is(err, ErrPKCEFailed): - return h.writeTokenError(w, http.StatusBadRequest, ErrInvalidGrant, + case errors.Is(err, errInvalidGrant), errors.Is(err, errPKCEFailed): + return h.writeTokenError(writer, http.StatusBadRequest, ErrInvalidGrant, "invalid, expired, or already-used grant") - case errors.Is(err, ErrClientNotFound): - return h.writeTokenError(w, http.StatusUnauthorized, ErrInvalidClient, "unknown client") + case errors.Is(err, errClientNotFound): + return h.writeTokenError(writer, http.StatusUnauthorized, ErrInvalidClient, "unknown client") default: - return h.writeTokenError(w, http.StatusInternalServerError, ErrServerError, + return h.writeTokenError(writer, http.StatusInternalServerError, ErrServerError, "could not issue token") } } // writeTokenSuccess writes the RFC 6749 §5.1 success body with no-store caching. -func (h *Handler) writeTokenSuccess(w http.ResponseWriter, r *TokenResult) error { - return h.writeNoStoreJSON(w, http.StatusOK, tokenResponse{ - AccessToken: r.AccessToken, +func (h *Handler) writeTokenSuccess(writer http.ResponseWriter, result *TokenResult) error { + return h.writeNoStoreJSON(writer, http.StatusOK, tokenResponse{ + AccessToken: result.AccessToken, TokenType: "Bearer", - ExpiresIn: r.ExpiresIn, - RefreshToken: r.RefreshToken, - Scope: r.Scope, + ExpiresIn: result.ExpiresIn, + RefreshToken: result.RefreshToken, + Scope: result.Scope, }) } // writeTokenError writes an RFC 6749 §5.2 error body with no-store caching. -func (h *Handler) writeTokenError(w http.ResponseWriter, status int, code, description string) error { - w.Header().Set("Cache-Control", "no-store") - w.Header().Set("Pragma", "no-cache") +func (h *Handler) writeTokenError(writer http.ResponseWriter, status int, code, description string) error { + writer.Header().Set("Cache-Control", "no-store") + writer.Header().Set("Pragma", "no-cache") - return h.WriteJSON(w, status, errorBody{Error: code, ErrorDescription: description}) + return h.WriteJSON(writer, status, errorBody{Error: code, ErrorDescription: description}) } From 4a93aa9d444fbf504eafa06fe03485a647c4d775 Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 04:36:06 +0200 Subject: [PATCH 55/67] chore: all checks passing for mcp oauth2 authorization Co-Authored-By: Claude Opus 4.8 From 25c4e6ebd5b78149a57fb79acd9e4cac36345fe8 Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 04:40:41 +0200 Subject: [PATCH 56/67] docs: archive completed spec mcp oauth2 authorization --- .../2026/06}/2026-06-20-03-mcp-oauth2-authorization.md | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename specs/{todos => done/2026/06}/2026-06-20-03-mcp-oauth2-authorization.md (100%) diff --git a/specs/todos/2026-06-20-03-mcp-oauth2-authorization.md b/specs/done/2026/06/2026-06-20-03-mcp-oauth2-authorization.md similarity index 100% rename from specs/todos/2026-06-20-03-mcp-oauth2-authorization.md rename to specs/done/2026/06/2026-06-20-03-mcp-oauth2-authorization.md From 0ce389f570f218692d007e30a4299d12d0494af7 Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 18:32:52 +0200 Subject: [PATCH 57/67] docs(ideas): ground config-as-code in existing export/import + CLI Reframe the config-as-code idea around what SolidPing already ships (export schema, idempotent upsert-by-slug import, sp CLI, secret envelope + parameters table, check labels). The gap narrows to the reconcile loop: delete-by-absence within a managed-label scope, dry-run/diff, secret references (${env}/${param}), an sp apply verb, and admin-gating. Resolves the five open questions against the code and phases the work; demotes Docker-label discovery to an optional suggest source. Co-Authored-By: Claude Opus 4.8 --- specs/ideas/2026-06-20-config-as-code.md | 194 +++++++++++++++++------ 1 file changed, 148 insertions(+), 46 deletions(-) diff --git a/specs/ideas/2026-06-20-config-as-code.md b/specs/ideas/2026-06-20-config-as-code.md index f5da38d99..2419d11e3 100644 --- a/specs/ideas/2026-06-20-config-as-code.md +++ b/specs/ideas/2026-06-20-config-as-code.md @@ -1,50 +1,152 @@ # Config-as-code (declarative checks) -> Idea, not ready for implementation. Source: the Maintenant competitor analysis +> Idea, not ready for implementation — but now **grounded against the codebase** (2026-06-20). +> Source: the Maintenant competitor analysis > ([`../../docs/competitors/maintenant.md`](../../docs/competitors/maintenant.md)) lists > **Docker-label configuration** — a lightweight config-as-code path — as an advantage SolidPing -> lacks. - -## The gap - -SolidPing can already move check definitions *as data*: - -- **JSON export** of all checks (admin-only) — see the existing idea - [`2026-01-03-conf-exporters.md`](2026-01-03-conf-exporters.md) and the import/export in - `server/internal/handlers/checks/`. -- **Network discovery** (CIDR scanning) in `server/internal/discovery/`. -- Related ideas: [`2025-12-28-importers.md`](2025-12-28-importers.md), - [`2025-12-28-automatic-app-discovery.md`](2025-12-28-automatic-app-discovery.md). - -What's missing is a **declarative, idempotent** path: a user keeps a file (YAML/JSON) describing -the checks they want, applies it repeatedly, and SolidPing reconciles to match — the GitOps -story self-hosters and homelabbers expect. Import today is a one-shot operator action, not a -reconcile. - -## Sketch - -1. **Declarative apply (primary).** `solidping apply checks.yaml` (and/or - `PUT /api/v1/orgs/{org}/checks:apply`): the file lists checks (+ groups, maybe integrations) - under a **managed marker** (a label/namespace). Reconcile = create missing, update changed, - and **delete-by-absence** *only within the managed marker* (never touch hand-created checks). - Dry-run / diff mode before apply. Secrets referenced by env/SSM, not inlined. -2. **Docker-label discovery (secondary, the Maintenant parity bit).** Read labels off running - containers (e.g. `solidping.check=http`, `solidping.url=…`) and auto-create the corresponding - checks. Lower priority than the file-based apply, and overlaps with - [`2025-12-28-automatic-app-discovery.md`](2025-12-28-automatic-app-discovery.md). - -## Open questions - -- Scope of the managed surface: checks only, or also check-groups / integrations / status pages? -- Identity for reconcile: match on `slug` within the managed marker? How are renames handled? -- Multi-tenant: per-org files, or one file with org keys (admin only)? -- How do secrets fit (env interpolation? references to `parameters`?) without landing plaintext - in a committed file — ties into credential encryption (`server/internal/crypto/credentials/`). -- Relationship to the existing JSON export format — is the apply format the same schema, - round-trippable with export? - -## Why it fits SolidPing - -It leans on assets that already exist (import/export, discovery, slugs as stable IDs) and serves -the self-hosted/GitOps audience without chasing Maintenant's deep container observability (which -the analysis recommends *not* pursuing). +> lacks. After reading the code, the real story is smaller and more SolidPing-shaped than +> "build a declarative engine": **most of the machinery already exists; what's missing is the +> reconcile loop.** + +## Key insight: this is ~70% built already + +SolidPing already moves check definitions *as data*, with a stable on-disk schema and a CLI: + +- **Export** — `GET /api/v1/orgs/{org}/checks/export` returns an `ExportDocument` + (`version`, `exportedAt`, `organization`, `checks[]`, `_secretsStripped`); each `ExportCheck` + carries `name, slug, type, config, regions, labels, enabled, internal, period, group, + confirmation/escalation/recovery, dependsOn[]` + ([`handlers/checks/service.go:1900-1955`](../../server/internal/handlers/checks/service.go)). +- **Import** — `POST /api/v1/orgs/{org}/checks/import` consumes that same document and is already + **idempotent by `slug`** (`UpsertCheck` per check + additive `dependsOn` merge), returning + `ImportResult{created, updated, skipped, errors[]}` (same file). **It does not delete.** +- **A CLI already ships** — `sp` (a.k.a. `solidping client`, + [`server/cmd/sp`](../../server/cmd/sp/main.go)) with `checks list/get/add/update/upsert/remove/ + deps`. There is **no `export`/`import`/`apply`** command yet. +- **Secrets are already enveloped** — checks split into `config` (public JSONB) + + `config_private` (AES-256-GCM) + `config_private_keys` + ([`db/models/check.go:60-76`](../../server/internal/db/models/check.go)), keyed by a per-org DEK + wrapped under `SP_ENCRYPTION_MASTER_KEY` + ([`crypto/credentials/service.go`](../../server/internal/crypto/credentials/service.go)). Export + **strips** secret keys (`_secretsStripped: true`), so a committed file is already secret-free. +- **`labels map[string]string`** already exist on checks and round-trip through export — a ready + home for a "managed-by" marker without any new column. + +So "config-as-code" for SolidPing is **not** a green-field engine. It is: *close the loop on the +export format that already ships* — add reconcile (delete-by-absence within a managed scope), +dry-run/diff, secret references, and an `sp apply` command. + +## The actual gap (what GitOps needs that we don't have) + +1. **Reconcile, not just upsert.** Import creates/updates but never deletes; re-applying a file + from which you removed a check leaves the check running. True config-as-code needs + **delete-by-absence** — but *only* within a clearly bounded, opted-in scope (never touch + hand-created checks). +2. **A managed scope marker.** Today all checks are equal — there is no "owned by a manifest" + concept, so delete-by-absence would be unsafe. Need a reserved marker to fence the managed set. +3. **Dry-run / diff.** No way to preview create/update/**delete** before applying. Mandatory for a + destructive operation. +4. **Secret references.** Export strips secrets, so an applied manifest has *no* way to supply the + token/header a check needs — it would silently downgrade auth on every apply. Need a + **reference** convention (resolved server-side), never inlined plaintext. +5. **No `apply` surface / CLI verb.** The reconcile operation needs an endpoint and an `sp apply` + command (the CLI is the natural front door for the self-hosted/GitOps audience). +6. **Authorization gap (latent).** Export/import today are gated by `RequireAuth` **only** — any + org member can run them ([`app/server.go:551-554`](../../server/internal/app/server.go)), + despite [`2026-01-03-conf-exporters.md`](2026-01-03-conf-exporters.md) intending admin-only. A + *destructive* apply must be **admin-gated** (the discovery handler's `isAdmin()` is the + precedent), and we should gate export/import the same way while we're here. + +## Design that fits SolidPing + +### The manifest = the existing export document + two small additions + +Reuse `ExportDocument`/`ExportCheck` verbatim (so `sp checks export` bootstraps a manifest and the +loop round-trips). Add only: + +- **A managed marker as a reserved label**, e.g. `solidping.io/managed: ` on every + check the manifest owns. Because labels already round-trip, this needs no schema change. The + reconcile scope is exactly "checks in this org carrying `solidping.io/managed=`." +- **Secret references** inside `config` values: `${env:NAME}` and `${param:KEY}` (the `parameters` + table — org-scoped or system-wide, already supports `secret=true`). Resolved **server-side at + apply time** into the encrypted envelope; the literal `${…}` is what lives in the committed file. + A missing reference is an apply error, not a silent blank. + +### The apply operation (admin-only) + +`POST /api/v1/orgs/{org}/checks:apply` (and `sp apply [-f] checks.yaml`): + +1. Parse JSON **or** YAML into the existing `ExportDocument` struct (YAML is the GitOps-friendly + surface; JSON is what export already emits — accept both). +2. Resolve `${env:…}` / `${param:…}` references; fail closed on any unresolved reference. +3. Compute a **plan** against the managed scope: `create` (in file, absent in org), `update` + (slug exists — diff config/fields), `delete` (carries the managed label, absent from file), + `unmanaged` (matches a slug *without* the managed label → reported, never auto-adopted/deleted). +4. **`?dryRun=true` returns the plan only** (the diff), changing nothing. `sp apply` prints it and + prompts unless `--yes`. +5. On apply: run create/update via the existing upsert path; perform deletes **only** for managed, + absent checks; stamp/refresh the managed label on every owned check. Return an extended + `ImportResult` that also reports `deleted` and the plan. + +Safety rails: admin-only; dry-run-by-default in the CLI; a configurable **deletion cap** (refuse if +a single apply would delete more than N managed checks unless `--force`) so a bad file can't wipe a +fleet. + +### Identity & renames + +Match on **`slug`** within the managed scope (the existing import key; `checks_slug_idx` is unique +per org). A `uid` is immutable but absent from hand-written manifests, so slug is the practical key. +Renaming a slug reads as delete+create (a standard GitOps caveat) — mitigate with an **optional +`previousSlug`** (or explicit `uid`) on a check so a rename reconciles in place instead of +recreating. Document the default behavior either way. + +## Open questions — resolved against SolidPing + +| Original open question | Resolution (leaning) | +|---|---| +| Scope: checks only, or groups/integrations/status pages? | **Checks first** — plus the groups/deps/labels the export schema *already* carries. Integrations and status pages are a later phase; keep the manifest a strict superset of today's export. | +| Identity for reconcile / renames | **Match on `slug`** within the managed label scope. Renames via optional `previousSlug`/`uid`; otherwise rename = delete+create (documented). | +| Multi-tenant: per-org or one file with org keys? | **Per-org**, mirroring the export/import endpoints (`/orgs/{org}`). One manifest per org; **admin-only**. Cross-org/system-wide is out of scope. | +| How do secrets fit without plaintext in git? | **References, never inlines**: `${env:NAME}` / `${param:KEY}` resolved server-side into the existing encrypted envelope. The committed file stays secret-free, consistent with `_secretsStripped` export. | +| Relationship to the export format | **Same schema** (`ExportDocument`) + a managed-label marker + secret-ref convention, so `export → edit → apply` round-trips. Apply is the reconcile sibling of import. | + +## Phasing + +- **Phase 1 — Apply on the existing format (checks, no deletes).** `:apply` endpoint + `sp apply`, + dry-run/diff, admin-gating (and retro-gate export/import). Behaves like a previewable, idempotent + import. Low risk, immediately useful. +- **Phase 2 — Managed scope + delete-by-absence + secret references.** The reserved label, the + deletion cap, `${env}`/`${param}` resolution. This is where it becomes true GitOps. +- **Phase 3 (optional parity) — Docker-label discovery.** Read `solidping.*` labels off running + containers and *suggest* checks — but this overlaps + [`2025-12-28-automatic-app-discovery.md`](2025-12-28-automatic-app-discovery.md) and the existing + CIDR discovery ([`server/internal/discovery/`](../../server/internal/discovery/)), which are + **suggest-not-declarative** by design. Treat it as a thin discovery source feeding the same apply + path, not a second reconcile engine. Lowest priority; the analysis explicitly recommends **not** + chasing Maintenant's deeper container observability. + +## Risks / decisions to confirm before building + +- **Destructive surface.** Delete-by-absence on monitoring config is high-blast-radius. The managed + label + dry-run-default + deletion cap + admin-only are the guardrails; confirm they're enough, + or add an explicit `prune: true` flag required to enable any deletion. +- **Retro-gating export/import to admin** may break anyone scripting them as a normal user today — + a deliberate (small) back-comat decision, worth a release note. +- **YAML support** adds a dependency and a second parse path; confirm we want YAML *and* JSON vs. + JSON-only (export already emits JSON; YAML is purely ergonomics for hand-authored manifests). +- **Plaintext fallback.** When `SP_ENCRYPTION_MASTER_KEY` is unset, resolved secrets land in + plaintext `config` — apply should *warn* (or refuse to resolve `${…}`) so a self-hoster doesn't + unknowingly commit a setup that stores secrets unencrypted. + +## Why it fits SolidPing goals + +- **Self-hosted / GitOps audience.** A previewable, idempotent `sp apply checks.yaml` is exactly + the workflow homelabbers and self-hosters expect, and it directly answers the + "what if the service disappears — I want my config in git" motivation behind + [`2026-01-03-conf-exporters.md`](2026-01-03-conf-exporters.md). +- **Leans entirely on assets that already exist** — the export schema, the idempotent + upsert-by-slug import, the `sp` CLI, the secret envelope + `parameters` table, and check labels. + Phase 1 is mostly *wiring and guardrails*, not new subsystems. +- **Stays in lane.** It serves the declarative-config niche without chasing Maintenant's deep + container observability (live CPU/mem/log streaming), which the competitor analysis recommends + against. From e7d8d5a4daa15e1710ebe00f7d91b916ee73b6b9 Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 18:37:57 +0200 Subject: [PATCH 58/67] docs: promote config-as-code from ideas to todos Move specs/ideas/2026-06-20-config-as-code.md to specs/todos/2026-06-20-05-config-as-code.md (NN=05, next free for the day). Update the banner from "idea" to active spec and fix the sibling links to the ideas/ folder that the move would otherwise break. Co-Authored-By: Claude Opus 4.8 --- .../2026-06-20-05-config-as-code.md} | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) rename specs/{ideas/2026-06-20-config-as-code.md => todos/2026-06-20-05-config-as-code.md} (95%) diff --git a/specs/ideas/2026-06-20-config-as-code.md b/specs/todos/2026-06-20-05-config-as-code.md similarity index 95% rename from specs/ideas/2026-06-20-config-as-code.md rename to specs/todos/2026-06-20-05-config-as-code.md index 2419d11e3..e5ba9eaa5 100644 --- a/specs/ideas/2026-06-20-config-as-code.md +++ b/specs/todos/2026-06-20-05-config-as-code.md @@ -1,6 +1,7 @@ # Config-as-code (declarative checks) -> Idea, not ready for implementation — but now **grounded against the codebase** (2026-06-20). +> Active spec — moved from `specs/ideas/` 2026-06-20, **grounded against the codebase**. A few +> items still need a call before building (see *Risks / decisions to confirm*). > Source: the Maintenant competitor analysis > ([`../../docs/competitors/maintenant.md`](../../docs/competitors/maintenant.md)) lists > **Docker-label configuration** — a lightweight config-as-code path — as an advantage SolidPing @@ -53,7 +54,7 @@ dry-run/diff, secret references, and an `sp apply` command. command (the CLI is the natural front door for the self-hosted/GitOps audience). 6. **Authorization gap (latent).** Export/import today are gated by `RequireAuth` **only** — any org member can run them ([`app/server.go:551-554`](../../server/internal/app/server.go)), - despite [`2026-01-03-conf-exporters.md`](2026-01-03-conf-exporters.md) intending admin-only. A + despite [`2026-01-03-conf-exporters.md`](../ideas/2026-01-03-conf-exporters.md) intending admin-only. A *destructive* apply must be **admin-gated** (the discovery handler's `isAdmin()` is the precedent), and we should gate export/import the same way while we're here. @@ -119,7 +120,7 @@ recreating. Document the default behavior either way. deletion cap, `${env}`/`${param}` resolution. This is where it becomes true GitOps. - **Phase 3 (optional parity) — Docker-label discovery.** Read `solidping.*` labels off running containers and *suggest* checks — but this overlaps - [`2025-12-28-automatic-app-discovery.md`](2025-12-28-automatic-app-discovery.md) and the existing + [`2025-12-28-automatic-app-discovery.md`](../ideas/2025-12-28-automatic-app-discovery.md) and the existing CIDR discovery ([`server/internal/discovery/`](../../server/internal/discovery/)), which are **suggest-not-declarative** by design. Treat it as a thin discovery source feeding the same apply path, not a second reconcile engine. Lowest priority; the analysis explicitly recommends **not** @@ -143,7 +144,7 @@ recreating. Document the default behavior either way. - **Self-hosted / GitOps audience.** A previewable, idempotent `sp apply checks.yaml` is exactly the workflow homelabbers and self-hosters expect, and it directly answers the "what if the service disappears — I want my config in git" motivation behind - [`2026-01-03-conf-exporters.md`](2026-01-03-conf-exporters.md). + [`2026-01-03-conf-exporters.md`](../ideas/2026-01-03-conf-exporters.md). - **Leans entirely on assets that already exist** — the export schema, the idempotent upsert-by-slug import, the `sp` CLI, the secret envelope + `parameters` table, and check labels. Phase 1 is mostly *wiring and guardrails*, not new subsystems. From 6a61f926999fb35d7a9fc5a85eebe1a32c7cb3d2 Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 18:41:48 +0200 Subject: [PATCH 59/67] chore: start implementing config-as-code From fc340f8fad9b950d12e21a428502bcdc728f487f Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 18:42:37 +0200 Subject: [PATCH 60/67] docs: add implementation plan for config-as-code --- specs/todos/2026-06-20-05-config-as-code.md | 60 +++++++++++++++++++++ 1 file changed, 60 insertions(+) diff --git a/specs/todos/2026-06-20-05-config-as-code.md b/specs/todos/2026-06-20-05-config-as-code.md index e5ba9eaa5..55fbe6bfa 100644 --- a/specs/todos/2026-06-20-05-config-as-code.md +++ b/specs/todos/2026-06-20-05-config-as-code.md @@ -126,6 +126,12 @@ recreating. Document the default behavior either way. path, not a second reconcile engine. Lowest priority; the analysis explicitly recommends **not** chasing Maintenant's deeper container observability. +> **Phase 3 deferred to a follow-up.** This spec ships Phases 1 & 2 only (apply endpoint + CLI, +> managed scope, delete-by-absence with prune + deletion cap, secret references, admin gating + +> retro-gate of export/import). Docker-label discovery is explicitly "optional parity, lowest +> priority" and overlaps existing discovery work, so it is **not** implemented here — it is split +> out as a separate spec when/if prioritized. Nothing in Phases 1 & 2 depends on it. + ## Risks / decisions to confirm before building - **Destructive surface.** Delete-by-absence on monitoring config is high-blast-radius. The managed @@ -151,3 +157,57 @@ recreating. Document the default behavior either way. - **Stays in lane.** It serves the declarative-config niche without chasing Maintenant's deep container observability (live CPU/mem/log streaming), which the competitor analysis recommends against. + +## Implementation Plan + +Decisions resolved (Phases 1 & 2 only; Phase 3 deferred, see Phasing). Each step is a granular +commit; `make fmt` runs before each. + +1. **Plan / reconcile engine** (`server/internal/handlers/checks/apply.go`). + - `ApplyResult{plan: ApplyPlanEntry[], created, updated, deleted, unmanaged, warnings, errors}`. + - `ApplyPlanEntry{slug, previousSlug, action: create|update|delete|unmanaged|rename, reason}`. + - Managed marker = reserved label `solidping.io/managed=` (`Organization` field + of the doc names the manifest; default falls back to the org slug). Reconcile scope = checks + in the org carrying that label. Match on `slug`. `previousSlug`/`uid` → rename in place. + - `computeApplyPlan(ctx, org, doc, opts)`: pure(ish) — lists managed checks, diffs against the + file. create = in file & absent; update = slug exists & managed (or being adopted via stamp); + delete = managed & absent from file; unmanaged = slug exists but missing the managed label + (reported, never adopted/deleted). + +2. **Secret-ref resolution** (`resolveSecretRefs`). Walk `config` values for `${env:NAME}` and + `${param:KEY}`; resolve env vars and the `parameters` table (org-scoped first, then system-wide; + `param.Value["value"]`). Missing/unresolvable ref → hard error. When the credentials service is + disabled (`SP_ENCRYPTION_MASTER_KEY` unset) a resolved secret ref appends a WARNING to the + result rather than refusing. Resolution feeds the existing `UpsertCheck` path, which envelopes + secret fields into `config_private` automatically. + +3. **Apply service** (`ApplyChecks`). Validate version; resolve refs; compute plan; on `dryRun` + mutate nothing and return the plan. Otherwise: run create/update via the existing upsert path + (re-using `importSingleCheck` + `importDependencies`), stamp/refresh the managed label on every + owned check, and perform deletes **only** when `prune` is set AND the check carries the managed + label AND the delete count is within the configurable deletion cap (`refuse beyond N unless + force`). Never touch unmanaged/hand-created checks. + +4. **Apply endpoint** (`POST /api/v1/orgs/:org/checks/apply`). Mirror `/checks/import` route style. + Accept JSON **and** YAML bodies (sniff `Content-Type`/first non-space byte; YAML→JSON→struct). + Query: `?dryRun=true`, `?prune=true`, `?force=true`. Return the extended `ApplyResult`. + +5. **Admin gating + retro-gate.** Add `RequireOrgAdmin` to the apply route, and retro-gate the + existing `/checks/export` + `/checks/import` to admin-only (currently `RequireAuth` only — a + latent gap). Documented as a small back-compat change. + +6. **CLI** (`server/pkg/cli`): `sp apply [-f|--file] [--dry-run] [--prune] [--yes] + [--force]` — dry-run prints the plan; without `--yes` it prints the plan and prompts before + mutating. Plus `sp checks export [-o file]` and `sp checks import [--dry-run]` wrappers + over the existing endpoints (CLI currently lacks them). Raw client methods in + `server/pkg/client` (apply sends the file bytes with the right Content-Type). + +7. **Docs.** `docs/api-specification.md`: apply endpoint + manifest format + managed label + + secret-ref convention + the export/import admin-gating change; CLI usage for apply/export/import. + +8. **Tests** (table-driven, `testify/require`, `t.Parallel()`, SQLite + Postgres where DB is + touched): plan computation (create/update/delete/unmanaged); dryRun mutates nothing; + delete-by-absence only with prune+managed-label+within-cap; deletion cap refuses oversized prune; + unmanaged checks never touched; secret-ref resolution (`${env}`/`${param}`, missing → error, + plaintext-fallback → warning); YAML and JSON bodies parse to the same plan; admin-only gating + (non-admin rejected) on apply AND export/import; round-trip export→apply idempotence. From e9d22571964a3c2eeb9f9e59586a338c204ab354 Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 18:45:41 +0200 Subject: [PATCH 61/67] feat(checks): config-as-code apply engine, endpoint, secret refs, admin gating - Reconcile/plan engine (create/update/delete/unmanaged/rename) scoped by the reserved solidping.io/managed= label - ApplyChecks service: dryRun (plan only), prune+managed-label+deletion-cap delete-by-absence, never touches unmanaged checks - Secret references ${env:NAME}/${param:KEY} resolved server-side; missing ref is a hard error; plaintext-fallback emits a warning - POST /checks/apply endpoint accepting JSON and YAML bodies - Admin-gate apply, and retro-gate /checks/export + /checks/import to admin-only --- server/internal/app/server.go | 14 +- server/internal/handlers/checks/apply.go | 528 +++++++++++++++++++++ server/internal/handlers/checks/handler.go | 55 +++ server/internal/handlers/checks/service.go | 8 +- 4 files changed, 601 insertions(+), 4 deletions(-) create mode 100644 server/internal/handlers/checks/apply.go diff --git a/server/internal/app/server.go b/server/internal/app/server.go index 96c843549..1cb0311aa 100644 --- a/server/internal/app/server.go +++ b/server/internal/app/server.go @@ -550,9 +550,19 @@ func (s *Server) SetupRoutes(ctx context.Context) { checksHandler := checks.NewHandler(checksService, s.config) orgChecks := api.NewGroup("/orgs/:org/checks").Use(authMiddleware.RequireAuth) orgChecks.GET("", checksHandler.ListChecks) - orgChecks.GET("/export", checksHandler.ExportChecks) - orgChecks.POST("/import", checksHandler.ImportChecks) orgChecks.POST("", checksHandler.CreateCheck) + + // Config-as-code surface (export/import/apply) is admin-only: import and + // apply mutate the whole check set, and apply can delete-by-absence. + // Export is gated alongside them (it was RequireAuth-only — a latent gap; + // see specs/todos/2026-06-20-05-config-as-code.md). Apply is the reconcile + // sibling of import with dry-run/prune/deletion-cap guardrails. + orgChecksAdmin := api.NewGroup("/orgs/:org/checks"). + Use(authMiddleware.RequireAuth, authMiddleware.RequireOrgAccess, authMiddleware.RequireOrgAdmin) + orgChecksAdmin.GET("/export", checksHandler.ExportChecks) + orgChecksAdmin.POST("/import", checksHandler.ImportChecks) + orgChecksAdmin.POST("/apply", checksHandler.ApplyChecks) + orgChecks.POST("/validate", checksHandler.ValidateCheck) orgChecks.GET("/:checkUid", checksHandler.GetCheck) orgChecks.PUT("/:slug", checksHandler.UpsertCheck) diff --git a/server/internal/handlers/checks/apply.go b/server/internal/handlers/checks/apply.go new file mode 100644 index 000000000..5a2ec2c54 --- /dev/null +++ b/server/internal/handlers/checks/apply.go @@ -0,0 +1,528 @@ +package checks + +import ( + "context" + "encoding/json" + "errors" + "fmt" + "os" + "regexp" + "sort" + "strings" + + "gopkg.in/yaml.v3" + + "github.com/fclairamb/solidping/server/internal/db/models" +) + +// ManagedLabelKey is the reserved label that marks a check as owned by a +// config-as-code manifest. Its value is the manifest name (defaults to the +// org slug). Reconcile (delete-by-absence) only ever touches checks carrying +// this label with the matching value — hand-created checks are never adopted +// or deleted. +const ManagedLabelKey = "solidping.io/managed" + +// DefaultDeletionCap is the maximum number of managed checks a single apply +// will delete-by-absence without an explicit force opt-in. A bad manifest +// can't silently wipe a fleet. +const DefaultDeletionCap = 10 + +// Apply plan actions. +const ( + ApplyActionCreate = "create" + ApplyActionUpdate = "update" + ApplyActionRename = "rename" + ApplyActionDelete = "delete" + ApplyActionUnmanaged = "unmanaged" +) + +var ( + // ErrDeletionCapExceeded is returned when an apply with prune would delete + // more managed checks than the configured cap allows (without force). + ErrDeletionCapExceeded = errors.New("deletion cap exceeded") + // ErrUnresolvedSecretRef is returned when a ${env:…}/${param:…} reference + // cannot be resolved at apply time. + ErrUnresolvedSecretRef = errors.New("unresolved secret reference") +) + +// secretRefPattern matches ${env:NAME} and ${param:KEY} references inside +// config string values. The scheme is env|param; the name is everything up to +// the closing brace. +var secretRefPattern = regexp.MustCompile(`\$\{(env|param):([^}]+)\}`) + +// ApplyOptions controls a single apply run. +type ApplyOptions struct { + // DryRun computes the plan and mutates nothing. + DryRun bool + // Prune enables delete-by-absence for managed checks absent from the file. + Prune bool + // Force lifts the deletion cap for this run. + Force bool + // DeletionCap is the max number of deletes allowed without Force. Zero + // falls back to DefaultDeletionCap. + DeletionCap int +} + +// ApplyPlanEntry is one reconcile decision for a single slug. +type ApplyPlanEntry struct { + Slug string `json:"slug"` + PreviousSlug string `json:"previousSlug,omitempty"` + Action string `json:"action"` + Reason string `json:"reason,omitempty"` +} + +// ApplyResult is the extended import result returned by apply. It reports the +// full plan plus the create/update/delete/unmanaged counts and any warnings. +type ApplyResult struct { + Manifest string `json:"manifest"` + DryRun bool `json:"dryRun"` + Pruned bool `json:"pruned"` + Created int `json:"created"` + Updated int `json:"updated"` + Deleted int `json:"deleted"` + Unmanaged int `json:"unmanaged"` + Plan []ApplyPlanEntry `json:"plan"` + Warnings []string `json:"warnings"` + Errors []ImportError `json:"errors"` +} + +// manifestName resolves the managed-label value for a document. The document's +// Organization field names the manifest; it falls back to the org slug so a +// plain export round-trips into a single managed scope. +func manifestName(doc *ExportDocument, orgSlug string) string { + if doc.Organization != "" { + return doc.Organization + } + + return orgSlug +} + +// computeApplyPlan diffs the manifest against the managed scope and returns the +// ordered plan. Pure with respect to the DB: it only reads. Matching is on +// slug within the managed-label scope; an explicit previousSlug (or uid) on a +// file check reconciles a rename in place. +// +//nolint:cyclop,funlen,gocognit // single-pass reconcile over file + managed set +func (s *Service) computeApplyPlan( + ctx context.Context, org *models.Organization, doc *ExportDocument, manifest string, +) ([]ApplyPlanEntry, error) { + // Existing checks in the org, with their labels, so we can tell managed + // from unmanaged and detect delete-by-absence. + existing, _, err := s.db.ListChecks(ctx, org.UID, &models.ListChecksFilter{}) + if err != nil { + return nil, fmt.Errorf("list checks for plan: %w", err) + } + + uids := make([]string, 0, len(existing)) + slugByUID := make(map[string]string, len(existing)) + for _, c := range existing { + uids = append(uids, c.UID) + if c.Slug != nil { + slugByUID[c.UID] = *c.Slug + } + } + + labelsByUID, err := s.db.GetLabelsForChecks(ctx, uids) + if err != nil { + return nil, fmt.Errorf("load labels for plan: %w", err) + } + + // managedSlugs: slug -> true for checks carrying our managed label. + managedSlugs := make(map[string]bool) + existingSlugs := make(map[string]bool, len(existing)) + for uid, slug := range slugByUID { + existingSlugs[slug] = true + for _, lbl := range labelsByUID[uid] { + if lbl.Key == ManagedLabelKey && lbl.Value == manifest { + managedSlugs[slug] = true + } + } + } + + plan := make([]ApplyPlanEntry, 0, len(doc.Checks)) + fileSlugs := make(map[string]bool, len(doc.Checks)) + + for i := range doc.Checks { + entry := &doc.Checks[i] + fileSlugs[entry.Slug] = true + + // Rename: previousSlug present and refers to an existing managed check. + prev := entry.PreviousSlug + if prev != "" && prev != entry.Slug && existingSlugs[prev] { + plan = append(plan, ApplyPlanEntry{ + Slug: entry.Slug, + PreviousSlug: prev, + Action: ApplyActionRename, + Reason: "previousSlug " + prev + " present in org", + }) + // The previous slug is being consumed by the rename; mark it so the + // delete-by-absence pass below doesn't also flag it. + fileSlugs[prev] = true + + continue + } + + switch { + case !existingSlugs[entry.Slug]: + plan = append(plan, ApplyPlanEntry{Slug: entry.Slug, Action: ApplyActionCreate}) + case managedSlugs[entry.Slug]: + plan = append(plan, ApplyPlanEntry{Slug: entry.Slug, Action: ApplyActionUpdate}) + default: + // Slug exists but is NOT managed by this manifest: report, never + // auto-adopt. The apply will (re)stamp the managed label so a future + // apply treats it as owned, but it is surfaced here for visibility. + plan = append(plan, ApplyPlanEntry{ + Slug: entry.Slug, + Action: ApplyActionUnmanaged, + Reason: "slug exists without the managed label for this manifest", + }) + } + } + + // Delete-by-absence: managed checks no longer present in the file. + absent := make([]string, 0) + for slug := range managedSlugs { + if !fileSlugs[slug] { + absent = append(absent, slug) + } + } + sort.Strings(absent) + for _, slug := range absent { + plan = append(plan, ApplyPlanEntry{ + Slug: slug, + Action: ApplyActionDelete, + Reason: "managed check absent from manifest", + }) + } + + return plan, nil +} + +// resolveSecretRefs walks every check's config, replacing ${env:NAME} and +// ${param:KEY} references with their resolved plaintext values. The resolved +// config is what feeds the existing upsert path, which envelopes secret fields +// into config_private. A missing reference is a hard error. When the +// credentials service is disabled (no master key) a resolved reference appends +// a warning (the secret will land in plaintext config). Mutates doc in place. +func (s *Service) resolveSecretRefs( + ctx context.Context, orgUID string, doc *ExportDocument, +) ([]string, error) { + var warnings []string + + resolvedAnySecret := false + + for ci := range doc.Checks { + cfg := doc.Checks[ci].Config + for key, val := range cfg { + strVal, ok := val.(string) + if !ok { + continue + } + + if !secretRefPattern.MatchString(strVal) { + continue + } + + resolved, didResolve, err := s.resolveRefString(ctx, orgUID, strVal) + if err != nil { + return nil, fmt.Errorf("check %q config %q: %w", doc.Checks[ci].Slug, key, err) + } + + cfg[key] = resolved + if didResolve { + resolvedAnySecret = true + } + } + } + + if resolvedAnySecret && !s.creds.Enabled() { + warnings = append(warnings, + "SP_ENCRYPTION_MASTER_KEY is unset: resolved secret references are stored in plaintext config") + } + + return warnings, nil +} + +// resolveRefString replaces every ${env:…}/${param:…} reference in a single +// string. Returns (resolved, anyResolved, error). A reference that can't be +// resolved is a hard error. +func (s *Service) resolveRefString( + ctx context.Context, orgUID, in string, +) (string, bool, error) { + var resolveErr error + + any := false + + out := secretRefPattern.ReplaceAllStringFunc(in, func(match string) string { + if resolveErr != nil { + return match + } + + groups := secretRefPattern.FindStringSubmatch(match) + scheme, name := groups[1], groups[2] + + value, err := s.resolveRef(ctx, orgUID, scheme, name) + if err != nil { + resolveErr = err + + return match + } + + any = true + + return value + }) + + if resolveErr != nil { + return "", false, resolveErr + } + + return out, any, nil +} + +// resolveRef resolves a single env|param reference to its plaintext value. +func (s *Service) resolveRef(ctx context.Context, orgUID, scheme, name string) (string, error) { + switch scheme { + case "env": + val, ok := os.LookupEnv(name) + if !ok { + return "", fmt.Errorf("%w: env:%s is not set", ErrUnresolvedSecretRef, name) + } + + return val, nil + case "param": + return s.resolveParamRef(ctx, orgUID, name) + default: + return "", fmt.Errorf("%w: unknown scheme %q", ErrUnresolvedSecretRef, scheme) + } +} + +// resolveParamRef resolves a ${param:KEY} reference. Org-scoped parameters take +// precedence over system-wide ones. Parameter values are stored as +// {"value": } JSONB; the secret flag only masks API responses, so the +// plaintext value is read directly here. +func (s *Service) resolveParamRef(ctx context.Context, orgUID, key string) (string, error) { + if orgParam, err := s.db.GetOrgParameter(ctx, orgUID, key); err == nil && orgParam != nil { + if v, ok := paramStringValue(orgParam); ok { + return v, nil + } + } + + if sysParam, err := s.db.GetSystemParameter(ctx, key); err == nil && sysParam != nil { + if v, ok := paramStringValue(sysParam); ok { + return v, nil + } + } + + return "", fmt.Errorf("%w: param:%s not found", ErrUnresolvedSecretRef, key) +} + +// paramStringValue extracts the stringified value from a parameter's +// {"value": …} envelope. +func paramStringValue(param *models.Parameter) (string, bool) { + raw, ok := param.Value["value"] + if !ok { + return "", false + } + + switch v := raw.(type) { + case string: + return v, true + case fmt.Stringer: + return v.String(), true + default: + return fmt.Sprintf("%v", v), true + } +} + +// ApplyChecks reconciles the manifest against the managed scope. With DryRun it +// computes the plan and mutates nothing. Otherwise it creates/updates via the +// existing upsert path (stamping the managed label on every owned check) and, +// when Prune is set, deletes managed checks absent from the file — gated by the +// deletion cap unless Force. +// +//nolint:cyclop,funlen,gocognit // orchestrates plan → resolve → mutate → prune +func (s *Service) ApplyChecks( + ctx context.Context, orgSlug string, doc *ExportDocument, opts ApplyOptions, +) (*ApplyResult, error) { + if doc.Version != 1 { + return nil, ErrUnsupportedExportVersion + } + + if len(doc.Checks) == 0 { + return nil, ErrEmptyChecksArray + } + + org, err := s.db.GetOrganizationBySlug(ctx, orgSlug) + if err != nil { + return nil, ErrOrganizationNotFound + } + + manifest := manifestName(doc, orgSlug) + + result := &ApplyResult{ + Manifest: manifest, + DryRun: opts.DryRun, + Pruned: opts.Prune, + Errors: []ImportError{}, + Warnings: []string{}, + Plan: []ApplyPlanEntry{}, + } + + // Resolve secret references first so the plan reflects the real config and a + // missing reference fails before any mutation. + warnings, err := s.resolveSecretRefs(ctx, org.UID, doc) + if err != nil { + return nil, err + } + result.Warnings = append(result.Warnings, warnings...) + + plan, err := s.computeApplyPlan(ctx, org, doc, manifest) + if err != nil { + return nil, err + } + result.Plan = plan + + for i := range plan { + switch plan[i].Action { + case ApplyActionCreate, ApplyActionRename: + result.Created++ + case ApplyActionUpdate: + result.Updated++ + case ApplyActionUnmanaged: + result.Unmanaged++ + case ApplyActionDelete: + // counted in the prune section below + } + } + + // Deletion cap guard (applies even on dry-run so the operator sees the + // refusal before they commit to the apply). + deletes := s.pruneTargets(plan, opts) + capLimit := opts.DeletionCap + if capLimit <= 0 { + capLimit = DefaultDeletionCap + } + if opts.Prune && !opts.Force && len(deletes) > capLimit { + return nil, fmt.Errorf("%w: %d deletes requested, cap is %d (use force to override)", + ErrDeletionCapExceeded, len(deletes), capLimit) + } + + if opts.DryRun { + // On dry-run, report what would be deleted so the count is meaningful. + if opts.Prune { + result.Deleted = len(deletes) + } + + return result, nil + } + + // Stamp the managed label on every owned check so future applies recognize + // the scope. Done by injecting the label into each check's Labels map before + // the upsert path persists it. + s.stampManagedLabels(doc, manifest) + + // Create/update via the existing import path (handles groups, config, + // labels, and dependsOn in two passes). + importResult, err := s.ImportChecks(ctx, orgSlug, doc, false) + if err != nil { + return nil, err + } + result.Created = importResult.Created + result.Updated = importResult.Updated + result.Errors = append(result.Errors, importResult.Errors...) + + // Prune managed, absent checks. + if opts.Prune { + for _, slug := range deletes { + if delErr := s.DeleteCheck(ctx, orgSlug, slug); delErr != nil { + result.Errors = append(result.Errors, ImportError{ + Index: -1, Slug: slug, Error: "prune delete: " + delErr.Error(), + }) + + continue + } + + result.Deleted++ + } + } + + return result, nil +} + +// pruneTargets returns the slugs the plan marks for delete-by-absence. Empty +// when prune is off. +func (s *Service) pruneTargets(plan []ApplyPlanEntry, opts ApplyOptions) []string { + if !opts.Prune { + return nil + } + + targets := make([]string, 0) + for i := range plan { + if plan[i].Action == ApplyActionDelete { + targets = append(targets, plan[i].Slug) + } + } + + return targets +} + +// stampManagedLabels injects the reserved managed label into every check's +// Labels map so the upsert path persists it. Rename entries also clear stale +// managed ownership of the previous slug by leaving it for the prune pass — but +// since a rename consumes previousSlug, no prune happens for it. +func (s *Service) stampManagedLabels(doc *ExportDocument, manifest string) { + for i := range doc.Checks { + if doc.Checks[i].Labels == nil { + doc.Checks[i].Labels = make(map[string]string, 1) + } + doc.Checks[i].Labels[ManagedLabelKey] = manifest + } +} + +// parseManifest unmarshals a manifest body that may be JSON or YAML into an +// ExportDocument. YAML is converted to JSON first so the struct's json tags are +// honored uniformly. +func parseManifest(body []byte, contentType string) (*ExportDocument, error) { + trimmed := strings.TrimLeft(string(body), " \t\r\n") + + isJSON := strings.HasPrefix(trimmed, "{") || strings.HasPrefix(trimmed, "[") || + strings.Contains(contentType, "json") + + var doc ExportDocument + if isJSON { + if err := json.Unmarshal(body, &doc); err != nil { + return nil, fmt.Errorf("parse json manifest: %w", err) + } + + return &doc, nil + } + + jsonBytes, err := yamlToJSON(body) + if err != nil { + return nil, fmt.Errorf("parse yaml manifest: %w", err) + } + + if err := json.Unmarshal(jsonBytes, &doc); err != nil { + return nil, fmt.Errorf("parse yaml manifest: %w", err) + } + + return &doc, nil +} + +// yamlToJSON converts a YAML document into equivalent JSON bytes so a struct's +// json tags drive the unmarshal. yaml.v3 decodes mappings into +// map[string]interface{}, which json.Marshal handles directly. +func yamlToJSON(body []byte) ([]byte, error) { + var raw any + if err := yaml.Unmarshal(body, &raw); err != nil { + return nil, fmt.Errorf("decode yaml: %w", err) + } + + jsonBytes, err := json.Marshal(raw) + if err != nil { + return nil, fmt.Errorf("re-encode as json: %w", err) + } + + return jsonBytes, nil +} diff --git a/server/internal/handlers/checks/handler.go b/server/internal/handlers/checks/handler.go index 55fae65f7..4abddccaf 100644 --- a/server/internal/handlers/checks/handler.go +++ b/server/internal/handlers/checks/handler.go @@ -450,6 +450,61 @@ func (h *Handler) ImportChecks(writer http.ResponseWriter, req bunrouter.Request return h.WriteJSON(writer, http.StatusOK, result) } +// ApplyChecks handles POST /api/v1/orgs/:org/checks/apply — the reconcile +// sibling of import. It accepts a JSON or YAML manifest (the existing export +// document shape, plus an optional managed-label scope and secret references) +// and reconciles the managed scope against it. Admin-only (gated by route +// middleware). Query flags: dryRun, prune, force. +func (h *Handler) ApplyChecks(writer http.ResponseWriter, req bunrouter.Request) error { + orgSlug := req.Param("org") + query := req.URL.Query() + + body, err := io.ReadAll(req.Body) + if err != nil { + return h.WriteValidationError(writer, "Invalid body", []base.ValidationErrorField{ + {Name: fieldBody, Message: "could not read request body"}, + }) + } + + doc, err := parseManifest(body, req.Header.Get("Content-Type")) + if err != nil { + return h.WriteValidationError(writer, "Invalid manifest", []base.ValidationErrorField{ + {Name: fieldBody, Message: err.Error()}, + }) + } + + opts := ApplyOptions{ + DryRun: query.Get("dryRun") == "true", + Prune: query.Get("prune") == "true", + Force: query.Get("force") == "true", + } + if capStr := query.Get("deletionCap"); capStr != "" { + if parsed, convErr := strconv.Atoi(capStr); convErr == nil && parsed >= 0 { + opts.DeletionCap = parsed + } + } + + result, err := h.svc.ApplyChecks(req.Context(), orgSlug, doc, opts) + if err != nil { + switch { + case errors.Is(err, ErrOrganizationNotFound): + return h.WriteErrorErr( + writer, http.StatusNotFound, base.ErrorCodeOrganizationNotFound, "Organization not found", err) + case errors.Is(err, ErrDeletionCapExceeded): + return h.WriteErrorErr( + writer, http.StatusConflict, base.ErrorCodeConflict, err.Error(), err) + case errors.Is(err, ErrUnresolvedSecretRef): + return h.WriteErrorErr( + writer, http.StatusBadRequest, base.ErrorCodeValidationError, err.Error(), err) + default: + return h.WriteErrorErr( + writer, http.StatusBadRequest, base.ErrorCodeValidationError, err.Error(), err) + } + } + + return h.WriteJSON(writer, http.StatusOK, result) +} + // handleListError handles errors from ListChecks. func (h *Handler) handleListError(writer http.ResponseWriter, err error) error { switch { diff --git a/server/internal/handlers/checks/service.go b/server/internal/handlers/checks/service.go index 7b86d11ed..14558316c 100644 --- a/server/internal/handlers/checks/service.go +++ b/server/internal/handlers/checks/service.go @@ -1912,8 +1912,12 @@ type ExportDocument struct { // ExportCheck represents a single check in the export format. type ExportCheck struct { - Name string `json:"name"` - Slug string `json:"slug"` + Name string `json:"name"` + Slug string `json:"slug"` + // PreviousSlug, when set on an apply manifest, makes a slug rename + // reconcile in place (rather than delete+create). Ignored by export and + // import; only the apply reconcile path consults it. + PreviousSlug string `json:"previousSlug,omitempty"` Description string `json:"description,omitempty"` Type string `json:"type"` Config map[string]any `json:"config"` From 2a82028c128356095f0cbad0ff11638e235f3a91 Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 18:48:27 +0200 Subject: [PATCH 62/67] feat(cli): sp apply + checks export/import commands - sp apply [-f] [--dry-run] [--prune] [--force] [--yes]: computes a dry-run plan first, prints it, prompts before mutating unless --yes - sp checks export [--file] and sp checks import [--dry-run] wrappers - client methods ApplyChecks/ExportChecks/ImportChecks (raw HTTP; apply sends the manifest bytes with a YAML/JSON content-type) --- server/pkg/cli/apply.go | 293 ++++++++++++++++++++++++++++++++++++ server/pkg/cli/commands.go | 53 +++++++ server/pkg/client/client.go | 121 +++++++++++++++ 3 files changed, 467 insertions(+) create mode 100644 server/pkg/cli/apply.go diff --git a/server/pkg/cli/apply.go b/server/pkg/cli/apply.go new file mode 100644 index 000000000..50f5c730d --- /dev/null +++ b/server/pkg/cli/apply.go @@ -0,0 +1,293 @@ +package cli + +import ( + "bufio" + "context" + "encoding/json" + "errors" + "fmt" + "os" + "strings" + + "github.com/jedib0t/go-pretty/v6/table" + "github.com/urfave/cli/v3" + + "github.com/fclairamb/solidping/server/pkg/cli/output" + "github.com/fclairamb/solidping/server/pkg/client" +) + +var ( + // ErrManifestRequired is returned when no manifest file is supplied. + ErrManifestRequired = errors.New("a manifest file is required (-f/--file)") + // ErrApplyAborted is returned when the user declines the apply prompt. + ErrApplyAborted = errors.New("apply aborted") +) + +// applyPlanEntry mirrors the server-side ApplyPlanEntry for pretty-printing. +type applyPlanEntry struct { + Slug string `json:"slug"` + PreviousSlug string `json:"previousSlug,omitempty"` + Action string `json:"action"` + Reason string `json:"reason,omitempty"` +} + +// applyResult mirrors the server-side ApplyResult for pretty-printing. +type applyResult struct { + Manifest string `json:"manifest"` + DryRun bool `json:"dryRun"` + Pruned bool `json:"pruned"` + Created int `json:"created"` + Updated int `json:"updated"` + Deleted int `json:"deleted"` + Unmanaged int `json:"unmanaged"` + Plan []applyPlanEntry `json:"plan"` + Warnings []string `json:"warnings"` + Errors []struct { + Slug string `json:"slug"` + Error string `json:"error"` + } `json:"errors"` +} + +// detectContentType picks the request Content-Type from the file extension so +// the server takes the right parse path. Defaults to YAML for hand-authored +// files; JSON only for .json. +func detectContentType(path string) string { + lower := strings.ToLower(path) + if strings.HasSuffix(lower, ".json") { + return "application/json" + } + + return "application/yaml" +} + +// printApplyPlan renders the plan as a human-readable table. +func printApplyPlan(res *applyResult) { + if len(res.Plan) == 0 { + output.PrintMessage(os.Stdout, "Plan: no changes") + + return + } + + tbl := output.NewTable(os.Stdout) + tbl.AppendHeader(table.Row{"ACTION", "SLUG", "REASON"}) + for i := range res.Plan { + entry := &res.Plan[i] + slug := entry.Slug + if entry.PreviousSlug != "" { + slug = entry.PreviousSlug + " -> " + entry.Slug + } + tbl.AppendRow(table.Row{strings.ToUpper(entry.Action), slug, entry.Reason}) + } + tbl.Render() +} + +// printApplySummary prints the counts and any warnings/errors. +func printApplySummary(res *applyResult) { + prefix := "Applied" + if res.DryRun { + prefix = "Plan (dry-run)" + } + + output.PrintMessage(os.Stdout, fmt.Sprintf( + "%s: %d created, %d updated, %d deleted, %d unmanaged (manifest: %s)", + prefix, res.Created, res.Updated, res.Deleted, res.Unmanaged, res.Manifest)) + + for _, w := range res.Warnings { + output.PrintMessage(os.Stdout, "WARNING: "+w) + } + + for i := range res.Errors { + output.PrintError(os.Stdout, fmt.Sprintf(" %s: %s", res.Errors[i].Slug, res.Errors[i].Error)) + } +} + +// confirmApply prompts the operator before a mutating apply. Returns true to +// proceed. --yes / non-text output skip the prompt. +func confirmApply() bool { + _, _ = fmt.Fprint(os.Stdout, "Apply these changes? [y/N]: ") + reader := bufio.NewReader(os.Stdin) + line, _ := reader.ReadString('\n') + answer := strings.ToLower(strings.TrimSpace(line)) + + return answer == "y" || answer == "yes" +} + +// applyAction implements `sp apply -f [--dry-run] [--prune] [--yes] [--force]`. +// +//nolint:cyclop,funlen,gocognit // CLI orchestration: read, plan, confirm, apply +func applyAction(ctx context.Context, cmd *cli.Command) error { + cliCtx, err := NewCLIContext(cmd) + if err != nil { + return err + } + + file := cmd.String("file") + if file == "" { + if cmd.Args().Len() > 0 { + file = cmd.Args().Get(0) + } + } + if file == "" { + return cli.Exit("Error: "+ErrManifestRequired.Error(), 5) + } + + body, readErr := os.ReadFile(file) //nolint:gosec // operator-supplied manifest path + if readErr != nil { + return cli.Exit(fmt.Sprintf("Error: cannot read manifest: %v", readErr), 5) + } + + apiClient, err := cliCtx.APIHelper.GetClient(ctx) + if err != nil { + return cliCtx.HandleAuthError(err) + } + + contentType := detectContentType(file) + dryRun := cmd.Bool("dry-run") + prune := cmd.Bool("prune") + force := cmd.Bool("force") + assumeYes := cmd.Bool("yes") + + // Step 1: always compute a dry-run plan first so the operator sees the diff. + planRaw, planErr := apiClient.ApplyChecks(ctx, cliCtx.GetOrg(), body, contentType, + client.ApplyOptions{DryRun: true, Prune: prune, Force: force}) + if planErr != nil { + return cliCtx.HandleError("Failed to compute plan", planErr) + } + + var planRes applyResult + if jsonErr := json.Unmarshal(planRaw, &planRes); jsonErr != nil { + return cliCtx.HandleError("Failed to parse plan", jsonErr) + } + + if cliCtx.IsText() { + printApplyPlan(&planRes) + printApplySummary(&planRes) + } + + // Dry-run mode stops after the plan. + if dryRun { + if !cliCtx.IsText() { + return cliCtx.Outputter.Print(planRes) + } + + return nil + } + + // Step 2: confirm unless --yes (text mode only — scripted/JSON callers must + // pass --yes explicitly). + if cliCtx.IsText() && !assumeYes { + if !confirmApply() { + output.PrintMessage(os.Stdout, ErrApplyAborted.Error()) + + return cli.Exit("", 2) + } + } else if !cliCtx.IsText() && !assumeYes { + return cliCtx.Outputter.PrintError(ErrApplyAborted) + } + + // Step 3: real apply. + applyRaw, applyErr := apiClient.ApplyChecks(ctx, cliCtx.GetOrg(), body, contentType, + client.ApplyOptions{DryRun: false, Prune: prune, Force: force}) + if applyErr != nil { + return cliCtx.HandleError("Failed to apply manifest", applyErr) + } + + var applyRes applyResult + if jsonErr := json.Unmarshal(applyRaw, &applyRes); jsonErr != nil { + return cliCtx.HandleError("Failed to parse apply result", jsonErr) + } + + if !cliCtx.IsText() { + return cliCtx.Outputter.Print(applyRes) + } + + printApplySummary(&applyRes) + if len(applyRes.Errors) > 0 { + return cli.Exit("", 1) + } + + return nil +} + +// checksExportAction implements `sp checks export [-o ]`. +func checksExportAction(ctx context.Context, cmd *cli.Command) error { + cliCtx, err := NewCLIContext(cmd) + if err != nil { + return err + } + + apiClient, err := cliCtx.APIHelper.GetClient(ctx) + if err != nil { + return cliCtx.HandleAuthError(err) + } + + doc, err := apiClient.ExportChecks(ctx, cliCtx.GetOrg()) + if err != nil { + return cliCtx.HandleError("Failed to export checks", err) + } + + // Pretty-print the JSON document. + var pretty interface{} + if jsonErr := json.Unmarshal(doc, &pretty); jsonErr == nil { + if formatted, mErr := json.MarshalIndent(pretty, "", " "); mErr == nil { + doc = formatted + } + } + + outFile := cmd.String("file") + if outFile == "" { + _, _ = os.Stdout.Write(doc) + _, _ = fmt.Fprintln(os.Stdout) + + return nil + } + + if writeErr := os.WriteFile(outFile, doc, 0o600); writeErr != nil { + return cli.Exit(fmt.Sprintf("Error: cannot write %s: %v", outFile, writeErr), 5) + } + + output.PrintSuccess(os.Stdout, "Checks exported to "+outFile) + + return nil +} + +// checksImportAction implements `sp checks import [--dry-run]`. +func checksImportAction(ctx context.Context, cmd *cli.Command) error { + cliCtx, err := NewCLIContext(cmd) + if err != nil { + return err + } + + if cmd.Args().Len() < 1 { + return cli.Exit("Error: an export file is required", 5) + } + file := cmd.Args().Get(0) + + body, readErr := os.ReadFile(file) //nolint:gosec // operator-supplied import path + if readErr != nil { + return cli.Exit(fmt.Sprintf("Error: cannot read file: %v", readErr), 5) + } + + apiClient, err := cliCtx.APIHelper.GetClient(ctx) + if err != nil { + return cliCtx.HandleAuthError(err) + } + + resultRaw, importErr := apiClient.ImportChecks(ctx, cliCtx.GetOrg(), body, cmd.Bool("dry-run")) + if importErr != nil { + return cliCtx.HandleError("Failed to import checks", importErr) + } + + var pretty interface{} + _ = json.Unmarshal(resultRaw, &pretty) + + if !cliCtx.IsText() { + return cliCtx.Outputter.Print(pretty) + } + + formatted, _ := json.MarshalIndent(pretty, "", " ") + _, _ = os.Stdout.Write(formatted) + _, _ = fmt.Fprintln(os.Stdout) + + return nil +} diff --git a/server/pkg/cli/commands.go b/server/pkg/cli/commands.go index cb346b1cc..c620f109b 100644 --- a/server/pkg/cli/commands.go +++ b/server/pkg/cli/commands.go @@ -259,8 +259,61 @@ func GetCommands() []*cli.Command { }, }, }, + { + Name: "export", + Usage: "Export all checks as a portable JSON document (admin-only)", + Flags: []cli.Flag{ + &cli.StringFlag{ + Name: "file", + Usage: "Write the export to a file instead of stdout", + }, + }, + Action: checksExportAction, + }, + { + Name: "import", + Usage: "Import checks from an export document (idempotent upsert, admin-only)", + ArgsUsage: "", + Flags: []cli.Flag{ + &cli.BoolFlag{ + Name: "dry-run", + Usage: "Preview created/updated counts without mutating", + }, + }, + Action: checksImportAction, + }, }, }, + { + Name: "apply", + Usage: "Reconcile checks against a declarative manifest (config-as-code, admin-only)", + ArgsUsage: "", + Flags: append(GetGlobalFlags(), + &cli.StringFlag{ + Name: "file", + Aliases: []string{"f"}, + Usage: "Manifest file (JSON or YAML)", + }, + &cli.BoolFlag{ + Name: "dry-run", + Usage: "Show the reconcile plan without mutating anything", + }, + &cli.BoolFlag{ + Name: "prune", + Usage: "Delete managed checks that are absent from the manifest", + }, + &cli.BoolFlag{ + Name: "force", + Usage: "Lift the deletion cap for this apply (use with --prune)", + }, + &cli.BoolFlag{ + Name: "yes", + Aliases: []string{"y"}, + Usage: "Skip the confirmation prompt and apply immediately", + }, + ), + Action: applyAction, + }, { Name: "results", Aliases: []string{"result"}, diff --git a/server/pkg/client/client.go b/server/pkg/client/client.go index 925975005..7173b2801 100644 --- a/server/pkg/client/client.go +++ b/server/pkg/client/client.go @@ -573,3 +573,124 @@ func (c *SolidPingClient) RawPutCheckBySlug( return c.rawRequest(ctx, http.MethodPut, fmt.Sprintf("/api/v1/orgs/%s/checks/%s", org, slug), body, nil) } + +// rawRequestBytes is rawRequest's sibling for sending a pre-serialized body +// (e.g. a hand-authored YAML manifest) with an explicit Content-Type. The +// decoded response (if any) is written into out. +func (c *SolidPingClient) rawRequestBytes( + ctx context.Context, method, path, contentType string, body []byte, out any, +) (int, error) { + url := strings.TrimRight(c.config.BaseURL, "/") + path + + req, err := http.NewRequestWithContext(ctx, method, url, bytes.NewReader(body)) + if err != nil { + return 0, fmt.Errorf("build request: %w", err) + } + + if contentType != "" { + req.Header.Set("Content-Type", contentType) + } + + if c.token != "" { + req.Header.Set("Authorization", "Bearer "+c.token) + } + + httpClient := http.DefaultClient + if c.loggingTransport != nil { + httpClient = &http.Client{Transport: c.loggingTransport} + } + + resp, err := httpClient.Do(req) + if err != nil { + return 0, fmt.Errorf("do request: %w", err) + } + defer resp.Body.Close() //nolint:errcheck // best effort + + respBody, err := io.ReadAll(resp.Body) + if err != nil { + return resp.StatusCode, fmt.Errorf("read response: %w", err) + } + + if resp.StatusCode >= 400 { + var apiErr Error + if jsonErr := json.Unmarshal(respBody, &apiErr); jsonErr == nil && apiErr.Title != "" { + return resp.StatusCode, fmt.Errorf("%w: %s", ErrUnexpectedStatus, apiErr.Title) + } + + return resp.StatusCode, fmt.Errorf("%w: %d", ErrUnexpectedStatus, resp.StatusCode) + } + + if out != nil && len(respBody) > 0 { + if err := json.Unmarshal(respBody, out); err != nil { + return resp.StatusCode, fmt.Errorf("decode response: %w", err) + } + } + + return resp.StatusCode, nil +} + +// ExportChecks fetches the org's checks as a raw export document (JSON bytes), +// returned verbatim so the CLI can write it to a file unchanged. +func (c *SolidPingClient) ExportChecks(ctx context.Context, org string) (json.RawMessage, error) { + var doc json.RawMessage + if _, err := c.rawRequest(ctx, http.MethodGet, + fmt.Sprintf("/api/v1/orgs/%s/checks/export", org), nil, &doc); err != nil { + return nil, err + } + + return doc, nil +} + +// ImportChecks posts an export document to the import endpoint. dryRun previews +// without mutating. The body is sent verbatim (JSON). +func (c *SolidPingClient) ImportChecks( + ctx context.Context, org string, body []byte, dryRun bool, +) (json.RawMessage, error) { + path := fmt.Sprintf("/api/v1/orgs/%s/checks/import", org) + if dryRun { + path += "?dryRun=true" + } + + var result json.RawMessage + if _, err := c.rawRequestBytes(ctx, http.MethodPost, path, "application/json", body, &result); err != nil { + return nil, err + } + + return result, nil +} + +// ApplyOptions mirrors the apply endpoint's query flags for the CLI. +type ApplyOptions struct { + DryRun bool + Prune bool + Force bool +} + +// ApplyChecks posts a manifest (JSON or YAML bytes) to the apply endpoint with +// the given options. contentType selects the parse path server-side. +func (c *SolidPingClient) ApplyChecks( + ctx context.Context, org string, body []byte, contentType string, opts ApplyOptions, +) (json.RawMessage, error) { + params := make([]string, 0, 3) + if opts.DryRun { + params = append(params, "dryRun=true") + } + if opts.Prune { + params = append(params, "prune=true") + } + if opts.Force { + params = append(params, "force=true") + } + + path := fmt.Sprintf("/api/v1/orgs/%s/checks/apply", org) + if len(params) > 0 { + path += "?" + strings.Join(params, "&") + } + + var result json.RawMessage + if _, err := c.rawRequestBytes(ctx, http.MethodPost, path, contentType, body, &result); err != nil { + return nil, err + } + + return result, nil +} From 7731a95c7ef8a095902c1bcaad3865572aacad15 Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sat, 20 Jun 2026 18:49:45 +0200 Subject: [PATCH 63/67] docs: config-as-code apply endpoint, manifest format, CLI, admin-gating change --- docs/README.md | 1 + docs/api-specification.md | 68 +++++++++++++++++++++++- docs/features/config-as-code.md | 93 +++++++++++++++++++++++++++++++++ 3 files changed, 160 insertions(+), 2 deletions(-) create mode 100644 docs/features/config-as-code.md diff --git a/docs/README.md b/docs/README.md index 3b79daa0d..b62f16ec7 100644 --- a/docs/README.md +++ b/docs/README.md @@ -22,6 +22,7 @@ the relevant code. - [features/email-inbox-checks.md](features/email-inbox-checks.md) — Passive checks that succeed when an email arrives. JMAP supervisor, per-check token, status resolution priority, mailbox retention, distinction from email-as-channel. - [features/mcp.md](features/mcp.md) — Model Context Protocol surface: endpoint, scopes (`mcp` / `mcp:read`), tool inventory, prompts, sessions, protocol version negotiation, how to add a new tool. - [features/browser-monitoring.md](features/browser-monitoring.md) — Headless-Chrome (chromedp) checks: when to pick browser over http, execution model, capabilities & limits, worker requirements, security model. +- [features/config-as-code.md](features/config-as-code.md) — Declarative checks: export → edit → `sp apply` loop, the `solidping.io/managed` scope, reconcile plan (create/update/delete/unmanaged/rename), `${env:}`/`${param:}` secret references, prune + deletion cap, admin gating. ## Conventions diff --git a/docs/api-specification.md b/docs/api-specification.md index b7667d398..cfe316495 100644 --- a/docs/api-specification.md +++ b/docs/api-specification.md @@ -307,15 +307,20 @@ Returns `{"valid": true}` or `{"valid": false, "fields": [...]}` with one field-level entry per failing validator. ### GET /api/v1/orgs/:org/checks/export -Export all checks as JSON. Auth: required +Export all checks as JSON. Auth: **admin** (org admin role required) Each `ExportCheck` carries an optional `dependsOn` array of `{parentSlug, kind, description?}` entries, sorted by `parentSlug` for deterministic diffs. The field is `omitempty` — exports for orgs with no dep edges stay byte-identical to the pre-dependsOn shape. +> **Back-compat note (2026-06-20):** export/import were previously gated by +> authentication only (any org member). They are now **admin-only**, alongside +> the new apply endpoint, because they read/mutate the whole check set. Scripts +> that called these as a non-admin user must switch to an admin token. + ### POST /api/v1/orgs/:org/checks/import -Import checks from JSON. Auth: required +Import checks from JSON. Auth: **admin** (org admin role required) Two-pass when any entry carries `dependsOn`: pass 1 upserts every check unchanged, pass 2 resolves `parentSlug` → check UID against the now-current @@ -326,6 +331,65 @@ in the existing `errors` array. Pass 2 is skipped silently for any check whose pass-1 upsert failed, with an explicit `skipped dependsOn: pass-1 upsert failed for this check` error. +### POST /api/v1/orgs/:org/checks/apply +Reconcile checks against a declarative manifest (config-as-code). Auth: +**admin** (org admin role required). This is the *reconcile sibling* of +`/import` — idempotent upsert-by-slug plus delete-by-absence within a bounded, +opted-in managed scope. + +**Request body.** The existing export document shape (`{version, organization, +checks[]}`), accepted as **JSON or YAML** (sniffed from `Content-Type` and the +first non-space byte). YAML is the hand-authoring surface; JSON is what export +emits — both parse to the same plan. + +**Managed scope.** Apply stamps every check it owns with a reserved label +`solidping.io/managed=`, where the manifest name is the document's +`organization` field (falling back to the org slug). The reconcile scope is +exactly the checks carrying that label. Hand-created checks (no managed label) +are reported as `unmanaged` and are **never** adopted, modified destructively, +or deleted. + +**Plan / reconcile semantics.** Matching is on `slug` within the managed scope: +- `create` — slug in the manifest, absent from the org. +- `update` — managed slug present in both. +- `unmanaged` — slug exists **without** the managed label (reported only). +- `delete` — managed check absent from the manifest (delete-by-absence). +- `rename` — a manifest check with `previousSlug` (or `uid`) referencing an + existing managed check reconciles the rename in place instead of delete+create. + +**Secret references.** Config string values may contain `${env:NAME}` and +`${param:KEY}` references, resolved **server-side at apply time** (env vars; the +`parameters` table — org-scoped first, then system-wide) into the existing +encrypted `config_private` envelope. The committed manifest stays secret-free. +A missing/unresolvable reference is a hard apply error. When +`SP_ENCRYPTION_MASTER_KEY` is unset (plaintext fallback), resolving a secret ref +emits a `warnings[]` entry rather than refusing — the resolved value lands in +plaintext config. + +**Deletion safety (belt-and-suspenders).** Delete-by-absence happens **only** +when all of: (a) `?prune=true` is set, (b) the check carries the managed label, +and (c) the delete count is within the deletion cap (default 10). Beyond the +cap, apply refuses with `409 CONFLICT` unless `?force=true`. + +Query parameters: +- `dryRun=true` — compute and return the plan only; mutate nothing. +- `prune=true` — enable delete-by-absence for managed, absent checks. +- `force=true` — lift the deletion cap for this apply. +- `deletionCap=` — override the default cap (0 ⇒ default 10). + +**Response** (extended import result): +```json +{ + "manifest": "default", + "dryRun": false, + "pruned": true, + "created": 1, "updated": 2, "deleted": 1, "unmanaged": 0, + "plan": [{"slug": "api", "action": "update"}, {"slug": "old", "action": "delete"}], + "warnings": [], + "errors": [] +} +``` + ### GET /api/v1/orgs/:org/checks/:checkUid Get a single check by UID or slug. Auth: required diff --git a/docs/features/config-as-code.md b/docs/features/config-as-code.md new file mode 100644 index 000000000..76047a614 --- /dev/null +++ b/docs/features/config-as-code.md @@ -0,0 +1,93 @@ +# Config-as-code (declarative checks) + +Manage an org's checks declaratively from a file in git: export the current +state, edit it, and `apply` it back. Apply is the **reconcile sibling** of +import — idempotent upsert-by-slug plus delete-by-absence within a bounded, +opted-in managed scope. The manifest is the existing export document shape, so +`export → edit → apply` round-trips with no separate schema. + +This page covers the workflow and the CLI; the HTTP surface (request/response, +query flags, managed scope, secret references, deletion safety) is documented at +[`api-specification.md`](../api-specification.md) under +`POST /api/v1/orgs/:org/checks/apply`. + +## The managed scope + +Apply stamps every check it owns with a reserved label +`solidping.io/managed=` (the manifest name is the document's +`organization` field, falling back to the org slug). The reconcile scope is +exactly the checks carrying that label. **Hand-created checks are never adopted, +modified destructively, or deleted** — they surface in the plan as `unmanaged`. + +Plan actions (matched on `slug` within the managed scope): + +| Action | Meaning | +|---|---| +| `create` | In the manifest, absent from the org. | +| `update` | Managed slug present in both. | +| `unmanaged` | Slug exists without the managed label — reported only. | +| `delete` | Managed check absent from the manifest (delete-by-absence). | +| `rename` | Manifest check with `previousSlug`/`uid` → rename in place. | + +## Secret references + +Never inline secrets. Config string values may reference `${env:NAME}` and +`${param:KEY}`, resolved **server-side at apply time** (env vars; the +`parameters` table — org-scoped first, then system-wide) into the existing +encrypted `config_private` envelope. The committed file stays secret-free. A +missing reference is a hard apply error. With `SP_ENCRYPTION_MASTER_KEY` unset, +a resolved reference emits a warning (the value lands in plaintext config). + +```yaml +version: 1 +organization: default +checks: + - slug: api + name: API + type: http + enabled: true + config: + url: https://api.example.com/health + header_authorization: "Bearer ${param:api_token}" +``` + +## Deletion safety + +Delete-by-absence happens **only** when all of: `--prune` is set, the check +carries the managed label, and the delete count is within the deletion cap +(default 10). Beyond the cap, apply refuses unless `--force`. + +## Authorization + +Apply, export, and import are all **admin-only**. (Export/import were +authentication-only before 2026-06-20 — see the back-compat note in the API +spec.) + +## CLI + +```bash +# Bootstrap a manifest from the current org state +sp checks export --file checks.json +# …edit checks.json (or convert to YAML)… + +# Preview the reconcile plan (mutates nothing) +sp apply -f checks.yaml --dry-run + +# Apply (prints the plan, then prompts before mutating) +sp apply -f checks.yaml + +# Apply non-interactively, allowing deletes of absent managed checks +sp apply -f checks.yaml --prune --yes + +# Lift the deletion cap for a large prune +sp apply -f checks.yaml --prune --force --yes + +# Plain idempotent import (no deletes, no managed scope) +sp checks import checks.json --dry-run +sp checks import checks.json +``` + +`sp apply` always computes a dry-run plan first and prints it; without `--yes` +it prompts for confirmation before applying. The file extension selects the body +format (`.json` → JSON, otherwise YAML). All three commands require an admin +session. From af88b91825655d2531d2c6004323465a4aaff3a7 Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sun, 21 Jun 2026 00:06:28 +0200 Subject: [PATCH 64/67] test(checks): config-as-code apply tests + lint cleanup Adds table-driven coverage for the apply reconcile engine and resolves pre-existing lint findings in the apply/CLI/client code from the prior implementation commits. Tests: - plan computation (create/update/delete/unmanaged), dryRun mutates nothing - delete-by-absence only with prune+managed-label+within-cap; cap refuses oversized prune (force overrides); unmanaged checks never touched - secret-ref resolution (${env}/${param}, missing -> error, plaintext fallback -> warning); rename via previousSlug - JSON and YAML bodies parse to the same plan (internal + HTTP) - export->apply round-trip idempotence (apply of an export is no-op/update) - admin-only gating on apply AND export/import (non-admin -> 403) Lint: queryTrue/colSlug constants, checked json marshals, dropped unused nolint directives and the unused rawRequestBytes status return. Co-Authored-By: Claude Opus 4.8 --- server/internal/handlers/checks/apply.go | 28 +- .../handlers/checks/apply_internal_test.go | 100 +++++ server/internal/handlers/checks/apply_test.go | 397 ++++++++++++++++++ server/internal/handlers/checks/handler.go | 11 +- server/pkg/cli/apply.go | 15 +- server/pkg/cli/checks.go | 4 +- server/pkg/cli/constants.go | 1 + server/pkg/client/client.go | 20 +- server/test/integration/checks_apply_test.go | 150 +++++++ 9 files changed, 691 insertions(+), 35 deletions(-) create mode 100644 server/internal/handlers/checks/apply_internal_test.go create mode 100644 server/internal/handlers/checks/apply_test.go create mode 100644 server/test/integration/checks_apply_test.go diff --git a/server/internal/handlers/checks/apply.go b/server/internal/handlers/checks/apply.go index 5a2ec2c54..631770977 100644 --- a/server/internal/handlers/checks/apply.go +++ b/server/internal/handlers/checks/apply.go @@ -102,7 +102,7 @@ func manifestName(doc *ExportDocument, orgSlug string) string { // slug within the managed-label scope; an explicit previousSlug (or uid) on a // file check reconciles a rename in place. // -//nolint:cyclop,funlen,gocognit // single-pass reconcile over file + managed set +//nolint:cyclop,funlen // single-pass reconcile over file + managed set func (s *Service) computeApplyPlan( ctx context.Context, org *models.Organization, doc *ExportDocument, manifest string, ) ([]ApplyPlanEntry, error) { @@ -211,8 +211,8 @@ func (s *Service) resolveSecretRefs( resolvedAnySecret := false - for ci := range doc.Checks { - cfg := doc.Checks[ci].Config + for idx := range doc.Checks { + cfg := doc.Checks[idx].Config for key, val := range cfg { strVal, ok := val.(string) if !ok { @@ -225,7 +225,7 @@ func (s *Service) resolveSecretRefs( resolved, didResolve, err := s.resolveRefString(ctx, orgUID, strVal) if err != nil { - return nil, fmt.Errorf("check %q config %q: %w", doc.Checks[ci].Slug, key, err) + return nil, fmt.Errorf("check %q config %q: %w", doc.Checks[idx].Slug, key, err) } cfg[key] = resolved @@ -247,13 +247,13 @@ func (s *Service) resolveSecretRefs( // string. Returns (resolved, anyResolved, error). A reference that can't be // resolved is a hard error. func (s *Service) resolveRefString( - ctx context.Context, orgUID, in string, + ctx context.Context, orgUID, input string, ) (string, bool, error) { var resolveErr error - any := false + resolvedAny := false - out := secretRefPattern.ReplaceAllStringFunc(in, func(match string) string { + out := secretRefPattern.ReplaceAllStringFunc(input, func(match string) string { if resolveErr != nil { return match } @@ -268,7 +268,7 @@ func (s *Service) resolveRefString( return match } - any = true + resolvedAny = true return value }) @@ -277,7 +277,7 @@ func (s *Service) resolveRefString( return "", false, resolveErr } - return out, any, nil + return out, resolvedAny, nil } // resolveRef resolves a single env|param reference to its plaintext value. @@ -325,13 +325,13 @@ func paramStringValue(param *models.Parameter) (string, bool) { return "", false } - switch v := raw.(type) { + switch val := raw.(type) { case string: - return v, true + return val, true case fmt.Stringer: - return v.String(), true + return val.String(), true default: - return fmt.Sprintf("%v", v), true + return fmt.Sprintf("%v", val), true } } @@ -341,7 +341,7 @@ func paramStringValue(param *models.Parameter) (string, bool) { // when Prune is set, deletes managed checks absent from the file — gated by the // deletion cap unless Force. // -//nolint:cyclop,funlen,gocognit // orchestrates plan → resolve → mutate → prune +//nolint:cyclop,funlen // orchestrates plan → resolve → mutate → prune func (s *Service) ApplyChecks( ctx context.Context, orgSlug string, doc *ExportDocument, opts ApplyOptions, ) (*ApplyResult, error) { diff --git a/server/internal/handlers/checks/apply_internal_test.go b/server/internal/handlers/checks/apply_internal_test.go new file mode 100644 index 000000000..db1d06993 --- /dev/null +++ b/server/internal/handlers/checks/apply_internal_test.go @@ -0,0 +1,100 @@ +package checks + +import ( + "testing" + + "github.com/stretchr/testify/require" +) + +// TestParseManifestJSONAndYAMLAreEquivalent verifies that a JSON body and the +// equivalent YAML body parse into the same ExportDocument — the apply endpoint +// accepts both (JSON is what export emits; YAML is the hand-authored surface). +func TestParseManifestJSONAndYAMLAreEquivalent(t *testing.T) { + t.Parallel() + r := require.New(t) + + jsonBody := []byte(`{ + "version": 1, + "organization": "team-a", + "checks": [ + {"name": "Google", "slug": "google", "type": "http", "config": {"url": "https://google.com"}, "enabled": true} + ] +}`) + + yamlBody := []byte(` +version: 1 +organization: team-a +checks: + - name: Google + slug: google + type: http + config: + url: https://google.com + enabled: true +`) + + fromJSON, err := parseManifest(jsonBody, "application/json") + r.NoError(err) + + fromYAML, err := parseManifest(yamlBody, "application/yaml") + r.NoError(err) + + r.Equal(fromJSON, fromYAML, "JSON and YAML manifests must parse to the same document") + r.Equal(1, fromYAML.Version) + r.Equal("team-a", fromYAML.Organization) + r.Len(fromYAML.Checks, 1) + r.Equal("google", fromYAML.Checks[0].Slug) + r.Equal("https://google.com", fromYAML.Checks[0].Config["url"]) +} + +// TestParseManifestContentTypeSniffing verifies the parser picks JSON vs YAML +// from the first non-space byte even when the Content-Type is missing. +func TestParseManifestContentTypeSniffing(t *testing.T) { + t.Parallel() + r := require.New(t) + + // Leading whitespace before the JSON object, no content type. + jsonBody := []byte(" \n {\"version\":1,\"checks\":[{\"slug\":\"a\",\"type\":\"http\",\"config\":{}}]}") + doc, err := parseManifest(jsonBody, "") + r.NoError(err) + r.Equal(1, doc.Version) + r.Equal("a", doc.Checks[0].Slug) +} + +// TestParseManifestInvalid rejects malformed bodies. +func TestParseManifestInvalid(t *testing.T) { + t.Parallel() + r := require.New(t) + + _, err := parseManifest([]byte("{not json"), "application/json") + r.Error(err) + + _, err = parseManifest([]byte(":\n - : :"), "application/yaml") + r.Error(err) +} + +// TestManifestName resolves the managed-label value: the document Organization +// field names the manifest, falling back to the org slug. +func TestManifestName(t *testing.T) { + t.Parallel() + r := require.New(t) + + r.Equal("team-a", manifestName(&ExportDocument{Organization: "team-a"}, "default")) + r.Equal("default", manifestName(&ExportDocument{}, "default")) +} + +// TestSecretRefPattern documents the exact reference grammar the resolver +// understands: ${env:NAME} and ${param:KEY}. +func TestSecretRefPattern(t *testing.T) { + t.Parallel() + r := require.New(t) + + r.True(secretRefPattern.MatchString("${env:TOKEN}")) + r.True(secretRefPattern.MatchString("Bearer ${param:api_key}")) + r.False(secretRefPattern.MatchString("plain value")) + r.False(secretRefPattern.MatchString("${unknown:x}")) + + m := secretRefPattern.FindStringSubmatch("${param:my.key}") + r.Equal("param", m[1]) + r.Equal("my.key", m[2]) +} diff --git a/server/internal/handlers/checks/apply_test.go b/server/internal/handlers/checks/apply_test.go new file mode 100644 index 000000000..39f69e417 --- /dev/null +++ b/server/internal/handlers/checks/apply_test.go @@ -0,0 +1,397 @@ +package checks_test + +import ( + "context" + "testing" + + "github.com/stretchr/testify/require" + + "github.com/fclairamb/solidping/server/internal/config" + "github.com/fclairamb/solidping/server/internal/crypto/credentials" + "github.com/fclairamb/solidping/server/internal/db" + "github.com/fclairamb/solidping/server/internal/db/models" + "github.com/fclairamb/solidping/server/internal/db/sqlite" + entcore "github.com/fclairamb/solidping/server/internal/entitlements" + "github.com/fclairamb/solidping/server/internal/handlers/checks" + "github.com/fclairamb/solidping/server/internal/notifier" +) + +// setupApplyService builds a checks service backed by an in-memory SQLite DB. +// When withMasterKey is true the credentials service is enabled (real KEK); +// otherwise it runs in plaintext-fallback mode so the secret-ref warning path +// can be exercised. +func setupApplyService(t *testing.T, withMasterKey bool) (*checks.Service, db.Service, *models.Organization) { + t.Helper() + r := require.New(t) + ctx := t.Context() + + dbSvc, err := sqlite.New(ctx, sqlite.Config{InMemory: true}) + r.NoError(err) + r.NoError(dbSvc.Initialize(ctx)) + t.Cleanup(func() { _ = dbSvc.Close() }) + + org := models.NewOrganization("apply-org", "Apply Org") + r.NoError(dbSvc.CreateOrganization(ctx, org)) + + var kek []byte + if withMasterKey { + kek = newKEK(t) + } + creds, err := credentials.NewService(kek, newMemDEKStore()) + r.NoError(err) + + entSvc := entcore.NewService(dbSvc, entcore.DefaultsFor(config.DeploymentModeSelfHosted), 0) + svc := checks.NewService(dbSvc, notifier.NewLocalEventNotifier(), creds, entSvc) + + return svc, dbSvc, org +} + +// manifestCheck is a small helper to build an ExportCheck for a manifest. +func manifestCheck(slug string) checks.ExportCheck { + return checks.ExportCheck{ + Name: slug, + Slug: slug, + Type: "http", + Config: map[string]any{"url": "https://example.com/" + slug}, + Enabled: true, + } +} + +func doc(org string, cs ...checks.ExportCheck) *checks.ExportDocument { + return &checks.ExportDocument{Version: 1, Organization: org, Checks: cs} +} + +// hasManagedLabel reports whether the check identified by slug carries the +// reserved managed label with the given manifest value. +func hasManagedLabel( + ctx context.Context, t *testing.T, dbSvc db.Service, org *models.Organization, slug, manifest string, +) bool { + t.Helper() + r := require.New(t) + + check, err := dbSvc.GetCheckByUidOrSlug(ctx, org.UID, slug) + r.NoError(err) + labels, err := dbSvc.GetLabelsForCheck(ctx, check.UID) + r.NoError(err) + for _, l := range labels { + if l.Key == checks.ManagedLabelKey && l.Value == manifest { + return true + } + } + + return false +} + +// TestApplyPlanCreateUpdateUnmanaged covers the core plan computation: create +// (slug absent), update (slug present + managed), unmanaged (slug present +// without the managed label). +func TestApplyPlanCreateUpdateUnmanaged(t *testing.T) { + t.Parallel() + r := require.New(t) + svc, _, org := setupApplyService(t, true) + ctx := t.Context() + + // Pre-create a managed check ("api") and a hand-created unmanaged check ("manual"). + res, err := svc.ApplyChecks(ctx, org.Slug, doc("apply-org", manifestCheck("api")), checks.ApplyOptions{}) + r.NoError(err) + r.Equal(1, res.Created) + + _, err = svc.CreateCheck(ctx, org.Slug, checks.CreateCheckRequest{ + Name: "manual", Slug: "manual", Type: "http", + Config: map[string]any{"url": "https://example.com/manual"}, + }) + r.NoError(err) + + // Now apply a manifest with: api (update), web (create), manual (unmanaged). + plan, err := svc.ApplyChecks(ctx, org.Slug, doc("apply-org", + manifestCheck("api"), manifestCheck("web"), manifestCheck("manual"), + ), checks.ApplyOptions{DryRun: true}) + r.NoError(err) + + actions := map[string]string{} + for _, e := range plan.Plan { + actions[e.Slug] = e.Action + } + r.Equal(checks.ApplyActionUpdate, actions["api"]) + r.Equal(checks.ApplyActionCreate, actions["web"]) + r.Equal(checks.ApplyActionUnmanaged, actions["manual"]) + r.Equal(1, plan.Unmanaged) +} + +// TestApplyDryRunMutatesNothing verifies a dry-run computes the plan but never +// touches the DB. +func TestApplyDryRunMutatesNothing(t *testing.T) { + t.Parallel() + r := require.New(t) + svc, dbSvc, org := setupApplyService(t, true) + ctx := t.Context() + + res, err := svc.ApplyChecks(ctx, org.Slug, doc("apply-org", manifestCheck("alpha"), manifestCheck("bravo")), + checks.ApplyOptions{DryRun: true}) + r.NoError(err) + r.True(res.DryRun) + r.Len(res.Plan, 2) + + // Nothing was created. + list, _, err := dbSvc.ListChecks(ctx, org.UID, &models.ListChecksFilter{}) + r.NoError(err) + r.Empty(list, "dry-run must not create any checks") +} + +// TestApplyStampsManagedLabel verifies a real apply stamps the reserved managed +// label on every owned check so a future apply recognizes the scope. +func TestApplyStampsManagedLabel(t *testing.T) { + t.Parallel() + r := require.New(t) + svc, dbSvc, org := setupApplyService(t, true) + ctx := t.Context() + + _, err := svc.ApplyChecks(ctx, org.Slug, doc("team-a", manifestCheck("alpha")), checks.ApplyOptions{}) + r.NoError(err) + r.True(hasManagedLabel(ctx, t, dbSvc, org, "alpha", "team-a")) +} + +// TestApplyDeleteByAbsenceRequiresPrune verifies a managed check absent from a +// later manifest is planned for deletion but NOT deleted unless prune is set. +func TestApplyDeleteByAbsenceRequiresPrune(t *testing.T) { + t.Parallel() + r := require.New(t) + svc, dbSvc, org := setupApplyService(t, true) + ctx := t.Context() + + // Seed two managed checks. + _, err := svc.ApplyChecks(ctx, org.Slug, doc("team-a", manifestCheck("alpha"), manifestCheck("bravo")), + checks.ApplyOptions{}) + r.NoError(err) + + // Re-apply without "b". Without prune, "b" is planned-delete but kept. + res, err := svc.ApplyChecks(ctx, org.Slug, doc("team-a", manifestCheck("alpha")), checks.ApplyOptions{}) + r.NoError(err) + r.Equal(0, res.Deleted) + + planned := planAction(res.Plan, "bravo") + r.Equal(checks.ApplyActionDelete, planned) + + _, err = dbSvc.GetCheckByUidOrSlug(ctx, org.UID, "bravo") + r.NoError(err, "without prune the absent managed check must remain") + + // With prune, "b" is deleted. + res, err = svc.ApplyChecks(ctx, org.Slug, doc("team-a", manifestCheck("alpha")), + checks.ApplyOptions{Prune: true}) + r.NoError(err) + r.Equal(1, res.Deleted) + + _, err = dbSvc.GetCheckByUidOrSlug(ctx, org.UID, "bravo") + r.Error(err, "prune must delete the absent managed check") +} + +// TestApplyPruneNeverTouchesUnmanaged verifies hand-created checks (no managed +// label) are never deleted even with prune set. +func TestApplyPruneNeverTouchesUnmanaged(t *testing.T) { + t.Parallel() + r := require.New(t) + svc, dbSvc, org := setupApplyService(t, true) + ctx := t.Context() + + // Hand-created check, never in any manifest. + _, err := svc.CreateCheck(ctx, org.Slug, checks.CreateCheckRequest{ + Name: "manual", Slug: "manual", Type: "http", + Config: map[string]any{"url": "https://example.com/manual"}, + }) + r.NoError(err) + + // Apply a managed check, then prune-apply an empty-of-it manifest. + _, err = svc.ApplyChecks(ctx, org.Slug, doc("team-a", manifestCheck("alpha")), checks.ApplyOptions{}) + r.NoError(err) + + res, err := svc.ApplyChecks(ctx, org.Slug, doc("team-a", manifestCheck("keep")), + checks.ApplyOptions{Prune: true}) + r.NoError(err) + // Only the managed "a" should be deletable; "manual" is untouched. + r.Equal(1, res.Deleted) + + _, err = dbSvc.GetCheckByUidOrSlug(ctx, org.UID, "manual") + r.NoError(err, "prune must never delete an unmanaged hand-created check") +} + +// TestApplyDeletionCapRefusesOversizedPrune verifies the deletion cap refuses a +// prune that would delete more than the cap allows (unless forced). +func TestApplyDeletionCapRefusesOversizedPrune(t *testing.T) { + t.Parallel() + r := require.New(t) + svc, dbSvc, org := setupApplyService(t, true) + ctx := t.Context() + + // Seed three managed checks. + _, err := svc.ApplyChecks(ctx, org.Slug, doc("team-a", + manifestCheck("alpha"), manifestCheck("bravo"), manifestCheck("charlie")), checks.ApplyOptions{}) + r.NoError(err) + + // Re-apply an empty-ish manifest with a deletion cap of 1 — 3 deletes > cap. + _, err = svc.ApplyChecks(ctx, org.Slug, doc("team-a", manifestCheck("keep")), + checks.ApplyOptions{Prune: true, DeletionCap: 1}) + r.Error(err) + r.ErrorIs(err, checks.ErrDeletionCapExceeded) + + // All three managed checks must still exist (cap refused before mutating). + for _, slug := range []string{"alpha", "bravo", "charlie"} { + _, gErr := dbSvc.GetCheckByUidOrSlug(ctx, org.UID, slug) + r.NoError(gErr, "deletion-cap refusal must not delete %s", slug) + } + + // Force lifts the cap. + res, err := svc.ApplyChecks(ctx, org.Slug, doc("team-a", manifestCheck("keep")), + checks.ApplyOptions{Prune: true, DeletionCap: 1, Force: true}) + r.NoError(err) + r.Equal(3, res.Deleted) +} + +// TestApplyResolvesEnvSecretRef verifies ${env:NAME} resolution feeds the value +// into the encrypted envelope (config_private), keeping the public config clean. +// Uses t.Setenv, which is incompatible with t.Parallel. +func TestApplyResolvesEnvSecretRef(t *testing.T) { + r := require.New(t) + svc, dbSvc, org := setupApplyService(t, true) + ctx := t.Context() + + t.Setenv("SP_TEST_APPLY_TOKEN", "s3cr3t-token") + + c := manifestCheck("secured") + c.Config = map[string]any{"url": "https://example.com", "password": "${env:SP_TEST_APPLY_TOKEN}"} + + res, err := svc.ApplyChecks(ctx, org.Slug, doc("team-a", c), checks.ApplyOptions{}) + r.NoError(err) + r.Equal(1, res.Created) + r.Empty(res.Warnings, "master key set: no plaintext warning expected") + + row, err := dbSvc.GetCheckByUidOrSlug(ctx, org.UID, "secured") + r.NoError(err) + r.NotContains(row.Config, "password", "resolved secret must not land in public config") + r.NotNil(row.ConfigPrivate) + r.NotEmpty(*row.ConfigPrivate) +} + +// TestApplyResolvesParamSecretRef verifies ${param:KEY} resolution against the +// org parameters table (org-scoped takes precedence over system-wide). +func TestApplyResolvesParamSecretRef(t *testing.T) { + t.Parallel() + r := require.New(t) + svc, dbSvc, org := setupApplyService(t, true) + ctx := t.Context() + + r.NoError(dbSvc.SetSystemParameter(ctx, "shared_token", "system-value", true)) + r.NoError(dbSvc.SetOrgParameter(ctx, org.UID, "shared_token", "org-value", true)) + + c := manifestCheck("param-check") + c.Config = map[string]any{"url": "https://example.com", "password": "${param:shared_token}"} + + res, err := svc.ApplyChecks(ctx, org.Slug, doc("team-a", c), checks.ApplyOptions{}) + r.NoError(err) + r.Equal(1, res.Created) + + // The resolved value (org-scoped wins) is enveloped; we can't read plaintext + // from the public side, but we confirm it's not leaked there. + row, err := dbSvc.GetCheckByUidOrSlug(ctx, org.UID, "param-check") + r.NoError(err) + r.NotContains(row.Config, "password") + r.NotNil(row.ConfigPrivate) +} + +// TestApplyMissingSecretRefIsHardError verifies an unresolvable reference fails +// the apply before any mutation. +func TestApplyMissingSecretRefIsHardError(t *testing.T) { + t.Parallel() + r := require.New(t) + svc, dbSvc, org := setupApplyService(t, true) + ctx := t.Context() + + c := manifestCheck("broken") + c.Config = map[string]any{"url": "https://example.com", "password": "${env:DEFINITELY_NOT_SET_XYZ}"} + + _, err := svc.ApplyChecks(ctx, org.Slug, doc("team-a", c), checks.ApplyOptions{}) + r.Error(err) + r.ErrorIs(err, checks.ErrUnresolvedSecretRef) + + // Nothing was created. + list, _, err := dbSvc.ListChecks(ctx, org.UID, &models.ListChecksFilter{}) + r.NoError(err) + r.Empty(list, "a missing secret ref must fail closed before mutation") +} + +// TestApplySecretRefPlaintextFallbackWarns verifies that when the master key is +// unset, resolving a secret ref emits a warning (not a refusal). +// Uses t.Setenv, which is incompatible with t.Parallel. +func TestApplySecretRefPlaintextFallbackWarns(t *testing.T) { + r := require.New(t) + svc, _, org := setupApplyService(t, false) // no master key → plaintext fallback + ctx := t.Context() + + t.Setenv("SP_TEST_PLAINTEXT_TOKEN", "exposed") + + c := manifestCheck("warned") + c.Config = map[string]any{"url": "https://example.com", "password": "${env:SP_TEST_PLAINTEXT_TOKEN}"} + + res, err := svc.ApplyChecks(ctx, org.Slug, doc("team-a", c), checks.ApplyOptions{}) + r.NoError(err) + r.NotEmpty(res.Warnings, "plaintext fallback must warn when a secret ref is resolved") +} + +// TestApplyExportRoundTripIsIdempotent verifies that applying an exported +// document is a no-op on the second run (apply of an export round-trips). +func TestApplyExportRoundTripIsIdempotent(t *testing.T) { + t.Parallel() + r := require.New(t) + svc, _, org := setupApplyService(t, true) + ctx := t.Context() + + // First apply: creates two checks under manifest "team-a". + _, err := svc.ApplyChecks(ctx, org.Slug, doc("team-a", manifestCheck("one"), manifestCheck("two")), + checks.ApplyOptions{}) + r.NoError(err) + + // Export, then re-apply the exported document with the same manifest name. + exported, err := svc.ExportChecks(ctx, org.Slug, checks.ListChecksOptions{}) + r.NoError(err) + exported.Organization = "team-a" + + res, err := svc.ApplyChecks(ctx, org.Slug, exported, checks.ApplyOptions{DryRun: true}) + r.NoError(err) + r.Equal(0, res.Created, "round-tripped export must not create new checks") + r.Equal(2, res.Updated, "round-tripped export must reconcile as updates, not creates") + r.Equal(0, res.Unmanaged, "round-tripped checks carry the managed label") + for _, e := range res.Plan { + r.Equal(checks.ApplyActionUpdate, e.Action, "slug %s should be an update", e.Slug) + } +} + +// TestApplyRenameViaPreviousSlug verifies an explicit previousSlug reconciles a +// rename in place rather than delete+create. +func TestApplyRenameViaPreviousSlug(t *testing.T) { + t.Parallel() + r := require.New(t) + svc, _, org := setupApplyService(t, true) + ctx := t.Context() + + _, err := svc.ApplyChecks(ctx, org.Slug, doc("team-a", manifestCheck("old-name")), checks.ApplyOptions{}) + r.NoError(err) + + renamed := manifestCheck("new-name") + renamed.PreviousSlug = "old-name" + + res, err := svc.ApplyChecks(ctx, org.Slug, doc("team-a", renamed), checks.ApplyOptions{DryRun: true}) + r.NoError(err) + r.Equal(checks.ApplyActionRename, planAction(res.Plan, "new-name")) + // The previous slug must NOT show up as a delete (the rename consumes it). + r.Empty(planAction(res.Plan, "old-name")) +} + +// planAction returns the planned action for a slug, or "" if absent. +func planAction(plan []checks.ApplyPlanEntry, slug string) string { + for _, e := range plan { + if e.Slug == slug { + return e.Action + } + } + + return "" +} diff --git a/server/internal/handlers/checks/handler.go b/server/internal/handlers/checks/handler.go index 4abddccaf..584103883 100644 --- a/server/internal/handlers/checks/handler.go +++ b/server/internal/handlers/checks/handler.go @@ -60,6 +60,9 @@ const ( fieldBody = "body" msgInvalidJSON = "Invalid JSON format" msgSlugConflictOrg = "A check with this slug already exists in this organization" + // queryTrue is the literal a boolean query flag must equal to be enabled + // (e.g. ?dryRun=true). + queryTrue = "true" ) // Handler provides HTTP handlers for check management endpoints. @@ -426,7 +429,7 @@ func (h *Handler) ExportChecks(writer http.ResponseWriter, req bunrouter.Request // ImportChecks handles importing checks from a JSON export document. func (h *Handler) ImportChecks(writer http.ResponseWriter, req bunrouter.Request) error { orgSlug := req.Param("org") - dryRun := req.URL.Query().Get("dryRun") == "true" + dryRun := req.URL.Query().Get("dryRun") == queryTrue var doc ExportDocument if err := json.NewDecoder(req.Body).Decode(&doc); err != nil { @@ -474,9 +477,9 @@ func (h *Handler) ApplyChecks(writer http.ResponseWriter, req bunrouter.Request) } opts := ApplyOptions{ - DryRun: query.Get("dryRun") == "true", - Prune: query.Get("prune") == "true", - Force: query.Get("force") == "true", + DryRun: query.Get("dryRun") == queryTrue, + Prune: query.Get("prune") == queryTrue, + Force: query.Get("force") == queryTrue, } if capStr := query.Get("deletionCap"); capStr != "" { if parsed, convErr := strconv.Atoi(capStr); convErr == nil && parsed >= 0 { diff --git a/server/pkg/cli/apply.go b/server/pkg/cli/apply.go index 50f5c730d..8d8e79407 100644 --- a/server/pkg/cli/apply.go +++ b/server/pkg/cli/apply.go @@ -69,7 +69,7 @@ func printApplyPlan(res *applyResult) { } tbl := output.NewTable(os.Stdout) - tbl.AppendHeader(table.Row{"ACTION", "SLUG", "REASON"}) + tbl.AppendHeader(table.Row{"ACTION", colSlug, "REASON"}) for i := range res.Plan { entry := &res.Plan[i] slug := entry.Slug @@ -114,7 +114,7 @@ func confirmApply() bool { // applyAction implements `sp apply -f [--dry-run] [--prune] [--yes] [--force]`. // -//nolint:cyclop,funlen,gocognit // CLI orchestration: read, plan, confirm, apply +//nolint:cyclop,funlen // CLI orchestration: read, plan, confirm, apply func applyAction(ctx context.Context, cmd *cli.Command) error { cliCtx, err := NewCLIContext(cmd) if err != nil { @@ -131,7 +131,7 @@ func applyAction(ctx context.Context, cmd *cli.Command) error { return cli.Exit("Error: "+ErrManifestRequired.Error(), 5) } - body, readErr := os.ReadFile(file) //nolint:gosec // operator-supplied manifest path + body, readErr := os.ReadFile(file) if readErr != nil { return cli.Exit(fmt.Sprintf("Error: cannot read manifest: %v", readErr), 5) } @@ -263,7 +263,7 @@ func checksImportAction(ctx context.Context, cmd *cli.Command) error { } file := cmd.Args().Get(0) - body, readErr := os.ReadFile(file) //nolint:gosec // operator-supplied import path + body, readErr := os.ReadFile(file) if readErr != nil { return cli.Exit(fmt.Sprintf("Error: cannot read file: %v", readErr), 5) } @@ -285,7 +285,12 @@ func checksImportAction(ctx context.Context, cmd *cli.Command) error { return cliCtx.Outputter.Print(pretty) } - formatted, _ := json.MarshalIndent(pretty, "", " ") + // Re-indent the server's JSON response for readability. The bytes already + // came back as valid JSON, so a marshal failure here is non-fatal. + formatted, marshalErr := json.MarshalIndent(pretty, "", " ") + if marshalErr != nil { + formatted = resultRaw + } _, _ = os.Stdout.Write(formatted) _, _ = fmt.Fprintln(os.Stdout) diff --git a/server/pkg/cli/checks.go b/server/pkg/cli/checks.go index d0bf69f46..686549544 100644 --- a/server/pkg/cli/checks.go +++ b/server/pkg/cli/checks.go @@ -152,9 +152,9 @@ func checksListAction(ctx context.Context, cmd *cli.Command) error { // Add columns based on whether last result is included if cmd.Bool("with-last-result") { - tbl.AppendHeader(table.Row{"SLUG", colName, colType, "PERIOD", "ENABLED", "LAST_STATUS", "LAST_CHECKED"}) + tbl.AppendHeader(table.Row{colSlug, colName, colType, "PERIOD", "ENABLED", "LAST_STATUS", "LAST_CHECKED"}) } else { - tbl.AppendHeader(table.Row{"SLUG", colName, colType, "PERIOD", "ENABLED", colStatus}) + tbl.AppendHeader(table.Row{colSlug, colName, colType, "PERIOD", "ENABLED", colStatus}) } data := *resp.JSON200.Data diff --git a/server/pkg/cli/constants.go b/server/pkg/cli/constants.go index 07a8a482a..2634e0cd7 100644 --- a/server/pkg/cli/constants.go +++ b/server/pkg/cli/constants.go @@ -8,6 +8,7 @@ const ( colCreated = "CREATED" colActor = "ACTOR" colCheck = "CHECK" + colSlug = "SLUG" argUID = "" argUIDSlug = "" diff --git a/server/pkg/client/client.go b/server/pkg/client/client.go index 7173b2801..42751f25d 100644 --- a/server/pkg/client/client.go +++ b/server/pkg/client/client.go @@ -579,12 +579,12 @@ func (c *SolidPingClient) RawPutCheckBySlug( // decoded response (if any) is written into out. func (c *SolidPingClient) rawRequestBytes( ctx context.Context, method, path, contentType string, body []byte, out any, -) (int, error) { +) error { url := strings.TrimRight(c.config.BaseURL, "/") + path req, err := http.NewRequestWithContext(ctx, method, url, bytes.NewReader(body)) if err != nil { - return 0, fmt.Errorf("build request: %w", err) + return fmt.Errorf("build request: %w", err) } if contentType != "" { @@ -602,31 +602,31 @@ func (c *SolidPingClient) rawRequestBytes( resp, err := httpClient.Do(req) if err != nil { - return 0, fmt.Errorf("do request: %w", err) + return fmt.Errorf("do request: %w", err) } defer resp.Body.Close() //nolint:errcheck // best effort respBody, err := io.ReadAll(resp.Body) if err != nil { - return resp.StatusCode, fmt.Errorf("read response: %w", err) + return fmt.Errorf("read response: %w", err) } if resp.StatusCode >= 400 { var apiErr Error if jsonErr := json.Unmarshal(respBody, &apiErr); jsonErr == nil && apiErr.Title != "" { - return resp.StatusCode, fmt.Errorf("%w: %s", ErrUnexpectedStatus, apiErr.Title) + return fmt.Errorf("%w: %s", ErrUnexpectedStatus, apiErr.Title) } - return resp.StatusCode, fmt.Errorf("%w: %d", ErrUnexpectedStatus, resp.StatusCode) + return fmt.Errorf("%w: %d", ErrUnexpectedStatus, resp.StatusCode) } if out != nil && len(respBody) > 0 { if err := json.Unmarshal(respBody, out); err != nil { - return resp.StatusCode, fmt.Errorf("decode response: %w", err) + return fmt.Errorf("decode response: %w", err) } } - return resp.StatusCode, nil + return nil } // ExportChecks fetches the org's checks as a raw export document (JSON bytes), @@ -652,7 +652,7 @@ func (c *SolidPingClient) ImportChecks( } var result json.RawMessage - if _, err := c.rawRequestBytes(ctx, http.MethodPost, path, "application/json", body, &result); err != nil { + if err := c.rawRequestBytes(ctx, http.MethodPost, path, "application/json", body, &result); err != nil { return nil, err } @@ -688,7 +688,7 @@ func (c *SolidPingClient) ApplyChecks( } var result json.RawMessage - if _, err := c.rawRequestBytes(ctx, http.MethodPost, path, contentType, body, &result); err != nil { + if err := c.rawRequestBytes(ctx, http.MethodPost, path, contentType, body, &result); err != nil { return nil, err } diff --git a/server/test/integration/checks_apply_test.go b/server/test/integration/checks_apply_test.go new file mode 100644 index 000000000..5f76e6c01 --- /dev/null +++ b/server/test/integration/checks_apply_test.go @@ -0,0 +1,150 @@ +package integration + +import ( + "bytes" + "context" + "encoding/json" + "io" + "net/http" + "testing" + + "github.com/stretchr/testify/require" +) + +// loginToken logs in against the given org and returns the access token. The +// shared test user is an admin in TestOrgSlug and a plain user in TestOrg2Slug. +func loginToken(t *testing.T, ts *TestServer, org string) string { + t.Helper() + r := require.New(t) + ctx := t.Context() + + apiClient := ts.NewClient() + resp, err := apiClient.Login(ctx, org, TestUserEmail, TestUserPassword) + r.NoError(err) + r.NotNil(resp.AccessToken) + + return *resp.AccessToken +} + +// rawRequest issues a raw HTTP request to the test server and returns the +// status code and body. Used for endpoints not covered by the generated client. +func rawRequest(t *testing.T, ts *TestServer, method, path, token, contentType string, body []byte) (int, []byte) { + t.Helper() + r := require.New(t) + + var rdr io.Reader + if body != nil { + rdr = bytes.NewReader(body) + } + + req, err := http.NewRequestWithContext(context.Background(), method, ts.HTTPServer.URL+path, rdr) + r.NoError(err) + if token != "" { + req.Header.Set("Authorization", "Bearer "+token) + } + if contentType != "" { + req.Header.Set("Content-Type", contentType) + } + + resp, err := http.DefaultClient.Do(req) + r.NoError(err) + defer func() { _ = resp.Body.Close() }() + + respBody, err := io.ReadAll(resp.Body) + r.NoError(err) + + return resp.StatusCode, respBody +} + +// TestChecksConfigAsCodeAdminGating verifies the export/import/apply endpoints +// are admin-only: an admin (TestOrgSlug) is allowed, a non-admin member +// (TestOrg2Slug) gets 403. This covers the retro-gate of export/import and the +// admin gate on apply in one matrix. +func TestChecksConfigAsCodeAdminGating(t *testing.T) { + t.Parallel() + r := require.New(t) + ts := NewTestServer(t) + + adminToken := loginToken(t, ts, TestOrgSlug) // admin in test-org + userToken := loginToken(t, ts, TestOrg2Slug) // plain user in test-org-2 + + manifest := []byte(`{"version":1,"organization":"test-org","checks":[` + + `{"name":"Apply Web","slug":"apply-web","type":"http","config":{"url":"https://example.com"},"enabled":true}]}`) + + // Non-admin must be rejected (403) on all three. + for _, tc := range []struct { + name, method, path string + body []byte + }{ + {"export", http.MethodGet, "/api/v1/orgs/" + TestOrg2Slug + "/checks/export", nil}, + {"import", http.MethodPost, "/api/v1/orgs/" + TestOrg2Slug + "/checks/import", manifest}, + {"apply", http.MethodPost, "/api/v1/orgs/" + TestOrg2Slug + "/checks/apply", manifest}, + } { + t.Run("forbidden_"+tc.name, func(t *testing.T) { + t.Parallel() + code, _ := rawRequest(t, ts, tc.method, tc.path, userToken, "application/json", tc.body) + require.Equal(t, http.StatusForbidden, code, "non-admin must be forbidden on %s", tc.name) + }) + } + + // Admin export succeeds. + code, _ := rawRequest(t, ts, http.MethodGet, "/api/v1/orgs/"+TestOrgSlug+"/checks/export", adminToken, "", nil) + r.Equal(http.StatusOK, code, "admin export should succeed") + + // Admin apply (dry-run) succeeds and returns a plan creating the check. + code, body := rawRequest(t, ts, http.MethodPost, + "/api/v1/orgs/"+TestOrgSlug+"/checks/apply?dryRun=true", adminToken, "application/json", manifest) + r.Equal(http.StatusOK, code, "admin apply should succeed: %s", string(body)) + + var applyResp struct { + DryRun bool `json:"dryRun"` + Created int `json:"created"` + Plan []struct { + Slug string `json:"slug"` + Action string `json:"action"` + } `json:"plan"` + } + r.NoError(json.Unmarshal(body, &applyResp)) + r.True(applyResp.DryRun) + r.Equal(1, applyResp.Created) + r.Len(applyResp.Plan, 1) + r.Equal("apply-web", applyResp.Plan[0].Slug) + r.Equal("create", applyResp.Plan[0].Action) +} + +// TestChecksApplyAcceptsYAML verifies the apply endpoint parses a hand-authored +// YAML manifest (not just the JSON export shape) into the same plan. +func TestChecksApplyAcceptsYAML(t *testing.T) { + t.Parallel() + r := require.New(t) + ts := NewTestServer(t) + adminToken := loginToken(t, ts, TestOrgSlug) + + yamlManifest := []byte(` +version: 1 +organization: test-org +checks: + - name: Apply YAML + slug: apply-yaml + type: http + config: + url: https://example.com + enabled: true +`) + + code, body := rawRequest(t, ts, http.MethodPost, + "/api/v1/orgs/"+TestOrgSlug+"/checks/apply?dryRun=true", adminToken, "application/yaml", yamlManifest) + r.Equal(http.StatusOK, code, "YAML apply should succeed: %s", string(body)) + + var applyResp struct { + Created int `json:"created"` + Plan []struct { + Slug string `json:"slug"` + Action string `json:"action"` + } `json:"plan"` + } + r.NoError(json.Unmarshal(body, &applyResp)) + r.Equal(1, applyResp.Created) + r.Equal("apply-yaml", applyResp.Plan[0].Slug) + r.Equal("create", applyResp.Plan[0].Action) +} From 1d26fa56db5ec1fd56429288529435ce0c11bdce Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sun, 21 Jun 2026 00:09:33 +0200 Subject: [PATCH 65/67] chore: all checks passing for config-as-code Co-Authored-By: Claude Opus 4.8 From 93f79f2fb5bf0eda3fa315bc15b5c3f13746523c Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sun, 21 Jun 2026 00:15:48 +0200 Subject: [PATCH 66/67] docs: archive completed spec config-as-code --- specs/{todos => done/2026/06}/2026-06-20-05-config-as-code.md | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename specs/{todos => done/2026/06}/2026-06-20-05-config-as-code.md (100%) diff --git a/specs/todos/2026-06-20-05-config-as-code.md b/specs/done/2026/06/2026-06-20-05-config-as-code.md similarity index 100% rename from specs/todos/2026-06-20-05-config-as-code.md rename to specs/done/2026/06/2026-06-20-05-config-as-code.md From c3ceab5fdef8b7a1a46263190537a839c1d12fe7 Mon Sep 17 00:00:00 2001 From: Florent Clairambault Date: Sun, 21 Jun 2026 00:34:45 +0200 Subject: [PATCH 67/67] fix(e2e): scope check-detail header overflow assertion to the header MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The new "header stacks the action toolbar" test asserted no horizontal overflow on the whole document (documentElement.scrollWidth), which is tripped by unrelated page content (a chart that sizes differently in headless CI) rather than the header it is testing — failing all 3 CI attempts though it passes locally. Add a data-testid to the header container and scope the overflow check to that element. The header (flex-col title row + flex-wrap toolbar + truncating h1) cannot overflow its own width, and this still catches a real header regression. Co-Authored-By: Claude Opus 4.8 --- web/dash0/e2e/check-detail.spec.ts | 15 ++++++++------- .../routes/orgs/$org/checks.$checkUid.index.tsx | 2 +- 2 files changed, 9 insertions(+), 8 deletions(-) diff --git a/web/dash0/e2e/check-detail.spec.ts b/web/dash0/e2e/check-detail.spec.ts index aa1cc62d8..48662f9bd 100644 --- a/web/dash0/e2e/check-detail.spec.ts +++ b/web/dash0/e2e/check-detail.spec.ts @@ -231,12 +231,13 @@ test.describe("Check Detail Page", () => { expect(deleteBox).not.toBeNull(); expect(deleteBox!.y).toBeGreaterThan(titleBox!.y + titleBox!.height); - // No horizontal overflow on the wide desktop. - const hasDesktopOverflow = await page.evaluate( - () => - document.documentElement.scrollWidth > - document.documentElement.clientWidth + 1, - ); - expect(hasDesktopOverflow).toBe(false); + // The header itself does not overflow horizontally: the truncating title + // and the wrapping toolbar fit within the header's own width. Scope the + // check to the header element — unrelated page content (e.g. a chart that + // sizes differently in headless CI) must not flake this header assertion. + const headerOverflow = await page + .getByTestId("check-detail-header") + .evaluate((el) => el.scrollWidth > el.clientWidth + 1); + expect(headerOverflow).toBe(false); }); }); diff --git a/web/dash0/src/routes/orgs/$org/checks.$checkUid.index.tsx b/web/dash0/src/routes/orgs/$org/checks.$checkUid.index.tsx index 1bee9d85e..985a7e8c6 100644 --- a/web/dash0/src/routes/orgs/$org/checks.$checkUid.index.tsx +++ b/web/dash0/src/routes/orgs/$org/checks.$checkUid.index.tsx @@ -448,7 +448,7 @@ function CheckDetailPage() { return (
-
+