From 9c1a1a860594c2053d00c9a290bf8aee553d4372 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Mon, 3 Nov 2025 13:49:49 +0200 Subject: [PATCH 001/313] Promote prod to 1.3.8 (#745) --- deploy/Pulumi.gcpProd.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/deploy/Pulumi.gcpProd.yaml b/deploy/Pulumi.gcpProd.yaml index ba9aadd..3f883fa 100644 --- a/deploy/Pulumi.gcpProd.yaml +++ b/deploy/Pulumi.gcpProd.yaml @@ -1,7 +1,7 @@ config: mcp-registry:environment: prod mcp-registry:provider: gcp - mcp-registry:imageTag: 1.3.7 # Set specific image tag for production (change this to deploy different versions) + mcp-registry:imageTag: 1.3.8 # Set specific image tag for production (change this to deploy different versions) gcp:project: mcp-registry-prod mcp-registry:githubClientId: Iv23liUydBbI7Z2Q9bOZ mcp-registry:githubClientSecret: From 5e565ed19f8ebce5ff1d56134e053ecdd36ddde6 Mon Sep 17 00:00:00 2001 From: Seey <125434337+Seey215@users.noreply.github.com> Date: Wed, 5 Nov 2025 16:15:21 +0800 Subject: [PATCH 002/313] docs(community): update project link and name to ToolSDK MCP Registry (#747) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Updated the project entry from **Awesome MCP Registry** to **ToolSDK MCP Registry**, reflecting the new GitHub repository name and official project name. > We’re honored that our Sub Registry project has been included in the official MCP Registry. To better reflect its purpose and maintain a more professional naming convention, we’re updating the entry name from **Awesome MCP Registry** to **ToolSDK MCP Registry**. This change replaces the earlier, more generic name “Awesome” with a clearer and more representative title for the project. > > *Based on GitHub’s renaming mechanism, the old link remains valid and will automatically redirect to the new repository.* ## Motivation and Context The project repository has been renamed and migrated from [`toolsdk-ai/awesome-mcp-registry`](https://github.com/toolsdk-ai/awesome-mcp-registry) → [`toolsdk-ai/toolsdk-mcp-registry`](https://github.com/toolsdk-ai/toolsdk-mcp-registry). This update ensures that the community registry points to the **correct and active repository**, while maintaining the same project description and context. The **ToolSDK MCP Registry** continues to extend the MCP Registry with **API-based MCP execution**, **private deployment**, and **secure sandbox isolation**. --- ## How Has This Been Tested? Verified that the new link is accessible and points to the correct repository. All descriptions and formatting remain consistent with other community entries. --- ## Breaking Changes No breaking changes — documentation update only. --- ## Types of changes * [x] Documentation update --- ## Checklist * [x] I have verified the new link and repository name * [x] I have followed the repository’s documentation style * [x] The update aligns with MCP community contribution guidelines --- ## Additional context This change reflects a **repository rename** for clarity and branding consistency. The project functionality and scope remain the same. --- docs/community-projects.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/community-projects.md b/docs/community-projects.md index 122c410..d833b3b 100644 --- a/docs/community-projects.md +++ b/docs/community-projects.md @@ -15,7 +15,7 @@ The following is a list of notable community-driven projects in the ecosystem re - [OtherVibes/mcp-publish-action](https://github.com/OtherVibes/mcp-publish-action) - GitHub Action for publishing MCP servers to the official registry - [TeamSpark AI Server Registry](https://teamsparkai.github.io/ToolCatalog/registry)🔎 - Browse and discover servers from the official MCP Registry ([source code](https://github.com/TeamSparkAI/ToolCatalog)). - [go-mcp-registry](https://github.com/leefowlercu/go-mcp-registry) - Go SDK for the MCP Registry API -- [Awesome MCP Registry](https://github.com/toolsdk-ai/awesome-mcp-registry) - Extends the MCP Registry with **API-based MCP execution, private deployment**, and **secure sandbox isolation**. +- [ToolSDK MCP Registry](https://github.com/toolsdk-ai/toolsdk-mcp-registry) - Extends the MCP Registry with **API-based MCP execution, private deployment**, and **secure sandbox isolation**. - **Add your project here!** 🔎 = Browse the official MCP Registry in your browser! From 4564cb3f0afecf74940c3b314fb6d2434904b9f4 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 6 Nov 2025 14:09:32 +0200 Subject: [PATCH 003/313] build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.205.0 to 3.206.0 in /deploy (#752) Bumps [github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from 3.205.0 to 3.206.0.
Release notes

Sourced from github.com/pulumi/pulumi/sdk/v3's releases.

v3.206.0

3.206.0 (2025-11-05)

Features

  • [protobuf] Pass a preview flag to invokes so they can tell if they're being called during a preview #20827

  • [cli/about] Include PULUMI_* environment variables in the pulumi about output #20855

  • [auto/go] Get event log over gRPC instead of trying to read it from a text file #20822

  • [auto/nodejs] Get event log over gRPC instead of trying to read it from a text file #20824

  • [auto/python] Get event log over gRPC instead of trying to read it from a text file #20833

  • [cli/engine] Add environment variable to add --refresh to preview,update,destroy #20797

  • [sdk/nodejs] Add PULUMI_NODEJS_SKIP_COMPONENT_INPUTS environment variable to skip the new feature of sending component inputs to the engine for diffing and state storage #20842

Bug Fixes

  • [engine] Fix duplicate resource snapshot integrity issue, when running pulumi up --refresh --run-program and when a resource PendingReplacement exists in the snapshot #20812

  • [engine] Support floating point NaN and Inf values in resource state #20843

Miscellaneous

  • [sdk/go] Use Language.Link to link Go packages #20811
Changelog

Sourced from github.com/pulumi/pulumi/sdk/v3's changelog.

3.206.0 (2025-11-05)

Features

  • [protobuf] Pass a preview flag to invokes so they can tell if they're being called during a preview #20827

  • [cli/about] Include PULUMI_* environment variables in the pulumi about output #20855

  • [auto/go] Get event log over gRPC instead of trying to read it from a text file #20822

  • [auto/nodejs] Get event log over gRPC instead of trying to read it from a text file #20824

  • [auto/python] Get event log over gRPC instead of trying to read it from a text file #20833

  • [cli/engine] Add environment variable to add --refresh to preview,update,destroy #20797

  • [sdk/nodejs] Add PULUMI_NODEJS_SKIP_COMPONENT_INPUTS environment variable to skip the new feature of sending component inputs to the engine for diffing and state storage #20842

Bug Fixes

  • [engine] Fix duplicate resource snapshot integrity issue, when running pulumi up --refresh --run-program and when a resource PendingReplacement exists in the snapshot #20812

  • [engine] Support floating point NaN and Inf values in resource state #20843

Miscellaneous

  • [sdk/go] Use Language.Link to link Go packages #20811
Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/pulumi/pulumi/sdk/v3&package-manager=go_modules&previous-version=3.205.0&new-version=3.206.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- deploy/go.mod | 2 +- deploy/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index 5e5391f..d18b7f9 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -5,7 +5,7 @@ go 1.24.6 require ( github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.23.0 - github.com/pulumi/pulumi/sdk/v3 v3.205.0 + github.com/pulumi/pulumi/sdk/v3 v3.206.0 gopkg.in/yaml.v2 v2.4.0 ) diff --git a/deploy/go.sum b/deploy/go.sum index e9ba311..f76df2e 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -160,8 +160,8 @@ github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 h1:w6OnO3d4j5yVf2vpm8OzXFC/xHOEGqt+9 github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1/go.mod h1:UyZyv7hz4knpFx6/Sh+SkZe6hT6sJHtDvw9A0TbvEsk= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.23.0 h1:TZ/XhzF+3/jRiGsjlJHCWhXcU5E5tbXU8O0DKnPmFic= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.23.0/go.mod h1:jOdpeNeRvY4iN+W8aDP5+HyqrM7hXsxa9paPsmjQFfY= -github.com/pulumi/pulumi/sdk/v3 v3.205.0 h1:Cuev0D3nBUqnFnFzWsO6M5XtOdGCe7lpgSds80yROyQ= -github.com/pulumi/pulumi/sdk/v3 v3.205.0/go.mod h1:aV0+c5xpSYccWKmOjTZS9liYCqh7+peu3cQgSXu7CJw= +github.com/pulumi/pulumi/sdk/v3 v3.206.0 h1:DvEn8GiYwSCraOv+RkGHYFOvA2m7Y3peWAdgmuYknUY= +github.com/pulumi/pulumi/sdk/v3 v3.206.0/go.mod h1:UsBMdaUQ+WoKoQtF2PYbQIbo8ZRJuAo1axkyit9IQVE= github.com/rivo/uniseg v0.1.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc= github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc= github.com/rivo/uniseg v0.4.4 h1:8TfxU8dW6PdqD27gjM8MVNuicgxIjxpm4K7x4jp8sis= From 92bab48788bd7345f564a51377c48f3f76c03b58 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sun, 9 Nov 2025 22:43:08 +0000 Subject: [PATCH 004/313] build(deps): bump github.com/pulumi/pulumi-kubernetes/sdk/v4 from 4.23.0 to 4.24.0 in /deploy (#755) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [github.com/pulumi/pulumi-kubernetes/sdk/v4](https://github.com/pulumi/pulumi-kubernetes) from 4.23.0 to 4.24.0.
Release notes

Sourced from github.com/pulumi/pulumi-kubernetes/sdk/v4's releases.

v4.24.0

Added

Changed

  • The pulumi.com/waitFor annotation now uses an RFC9535-compliant JSONPath parser. This makes it possible to wait for more complex scenarios.

    For example:

    • To wait for a Pod's status.phase to be "Running" or "Succeeded":

      pulumi.com/waitFor: "jsonpath={.status[?@ == 'Running' || @ == 'Succeeded' ]}"

    • To wait for for an object to have a "Failed" or "Complete" condition with a "True" value:

      pulumi.com/waitFor: "jsonpath={.conditions[?(@.type=='Failed'||@.type=='Complete')].status}=True

    (Tools like jsonpath.com are very helpful for ensuring your JSONPath expression works as expected.)

    Importantly, please note that kubectl wait --for=jsonpath=... supports only a subset of RFC9535. This means some complex waitFor annotations will not be reproducible with kubectl.

    Existing expressions should continue to work normally with one notable exception: a selector like .items[] now requires an explicit wildcard, i.e. .items[*].

    As a reminder, the pulumi.com/waitFor annotation is experimental and subject to change. Similarly, RFC9535 is still only proposed and may also change in the future.

  • enableConfigMapMutable and enableSecretMutable are now stable. (pulumi/pulumi-kubernetes#3886)

Fixed

... (truncated)

Changelog

Sourced from github.com/pulumi/pulumi-kubernetes/sdk/v4's changelog.

CHANGELOG

Unreleased

Added

Changed

  • The pulumi.com/waitFor annotation now uses an RFC9535-compliant JSONPath parser. This makes it possible to wait for more complex scenarios.

    For example:

    • To wait for a Pod's status.phase to be "Running" or "Succeeded":

      pulumi.com/waitFor: "jsonpath={.status[?@ == 'Running' || @ == 'Succeeded' ]}"

    • To wait for for an object to have a "Failed" or "Complete" condition with a "True" value:

      pulumi.com/waitFor: "jsonpath={.conditions[?(@.type=='Failed'||@.type=='Complete')].status}=True

    (Tools like jsonpath.com are very helpful for ensuring your JSONPath expression works as expected.)

    Importantly, please note that kubectl wait --for=jsonpath=... supports only a subset of RFC9535. This means some complex waitFor annotations will not be reproducible with kubectl.

    Existing expressions should continue to work normally with one notable exception: a selector like .items[] now requires an explicit wildcard, i.e. .items[*].

    As a reminder, the pulumi.com/waitFor annotation is experimental and subject to change. Similarly, RFC9535 is still only proposed and may also change in the future.

  • enableConfigMapMutable and enableSecretMutable are now stable. (pulumi/pulumi-kubernetes#3886)

Fixed

  • Helm resources all now use the correct registry/config.json file for credentials. For backward-compatibility registry.json is preferred if it exists. (pulumi/pulumi-kubernetes#3606)

... (truncated)

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/pulumi/pulumi-kubernetes/sdk/v4&package-manager=go_modules&previous-version=4.23.0&new-version=4.24.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- deploy/go.mod | 10 +++++----- deploy/go.sum | 22 +++++++++++----------- 2 files changed, 16 insertions(+), 16 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index d18b7f9..5e6bd35 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -1,10 +1,10 @@ module github.com/modelcontextprotocol/registry/deploy/infra -go 1.24.6 +go 1.24.7 require ( github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 - github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.23.0 + github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.24.0 github.com/pulumi/pulumi/sdk/v3 v3.206.0 gopkg.in/yaml.v2 v2.4.0 ) @@ -65,11 +65,11 @@ require ( github.com/rivo/uniseg v0.4.4 // indirect github.com/rogpeppe/go-internal v1.14.1 // indirect github.com/santhosh-tekuri/jsonschema/v5 v5.0.0 // indirect - github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 // indirect + github.com/sergi/go-diff v1.4.0 // indirect github.com/skeema/knownhosts v1.3.1 // indirect github.com/spf13/cast v1.4.1 // indirect - github.com/spf13/cobra v1.8.0 // indirect - github.com/spf13/pflag v1.0.5 // indirect + github.com/spf13/cobra v1.10.1 // indirect + github.com/spf13/pflag v1.0.9 // indirect github.com/stretchr/objx v0.2.0 // indirect github.com/texttheater/golang-levenshtein v1.0.1 // indirect github.com/uber/jaeger-client-go v2.30.0+incompatible // indirect diff --git a/deploy/go.sum b/deploy/go.sum index f76df2e..7fd193a 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -39,7 +39,7 @@ github.com/cloudflare/circl v1.6.1 h1:zqIqSPIndyBh1bjLVVDHMPpVKqp8Su/V+6MeDzzQBQ github.com/cloudflare/circl v1.6.1/go.mod h1:uddAzsPgqdMAYatqJ0lsjX1oECcQLIlRpzZh3pJrofs= github.com/containerd/console v1.0.4-0.20230313162750-1ae8d489ac81 h1:q2hJAaP1k2wIvVRd/hEHD7lacgqrCPS+k8g1MndzfWY= github.com/containerd/console v1.0.4-0.20230313162750-1ae8d489ac81/go.mod h1:YynlIjWYF8myEu6sdkwKIvGQq+cOckRm6So2avqoYAk= -github.com/cpuguy83/go-md2man/v2 v2.0.3/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o= +github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g= github.com/cyphar/filepath-securejoin v0.4.1 h1:JyxxyPEaktOD+GAnqIqTf9A8tHyAG22rowi7HkoSU1s= github.com/cyphar/filepath-securejoin v0.4.1/go.mod h1:Sdj7gXlvMcPZsbhwhQ33GguGLDGQL7h7bg04C/+u9jI= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= @@ -142,8 +142,8 @@ github.com/opentracing/opentracing-go v1.2.0 h1:uEJPy/1a5RIPAJ0Ov+OIO8OxWu77jEv+ github.com/opentracing/opentracing-go v1.2.0/go.mod h1:GxEUsuufX4nBwe+T+Wl9TAgYrxe9dPLANfrWvHYVTgc= github.com/pgavlin/fx v0.1.6 h1:r9jEg69DhNoCd3Xh0+5mIbdbS3PqWrVWujkY76MFRTU= github.com/pgavlin/fx v0.1.6/go.mod h1:KWZJ6fqBBSh8GxHYqwYCf3rYE7Gp2p0N8tJp8xv9u9M= -github.com/pgavlin/fx/v2 v2.0.3 h1:ZBVklTFjxcWvBVPE+ti5qwnmTIQ0Gq6nuj3J5RKDtKk= -github.com/pgavlin/fx/v2 v2.0.3/go.mod h1:Cvnwqq0BopdHUJ7CU50h1XPeKrF4ZwdFj1nJLXbAjCE= +github.com/pgavlin/fx/v2 v2.0.10 h1:ggyQ6pB+lEQEbEae48Wh/X221eLOamMD7i01ISe88u4= +github.com/pgavlin/fx/v2 v2.0.10/go.mod h1:M/nF/ooAOy+NUBooYYXl2REARzJ/giPJxfMs8fINfKc= github.com/pjbgf/sha1cd v0.3.2 h1:a9wb0bp1oC2TGwStyn0Umc/IGKQnEgF0vVaZ8QF8eo4= github.com/pjbgf/sha1cd v0.3.2/go.mod h1:zQWigSxVmsHEZow5qaLtPYxpcKMMQpa09ixqBxuCS6A= github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4= @@ -158,8 +158,8 @@ github.com/pulumi/esc v0.17.0 h1:oaVOIyFTENlYDuqc3pW75lQT9jb2cd6ie/4/Twxn66w= github.com/pulumi/esc v0.17.0/go.mod h1:XnSxlt5NkmuAj304l/gK4pRErFbtqq6XpfX1tYT9Jbc= github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 h1:w6OnO3d4j5yVf2vpm8OzXFC/xHOEGqt+9FjWCUBCq6U= github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1/go.mod h1:UyZyv7hz4knpFx6/Sh+SkZe6hT6sJHtDvw9A0TbvEsk= -github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.23.0 h1:TZ/XhzF+3/jRiGsjlJHCWhXcU5E5tbXU8O0DKnPmFic= -github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.23.0/go.mod h1:jOdpeNeRvY4iN+W8aDP5+HyqrM7hXsxa9paPsmjQFfY= +github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.24.0 h1:dlDJvsugKow8tCaD0yJngc7PXdv8WT2YwPEUmj48tF4= +github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.24.0/go.mod h1:8HDO923pZUokTAEMgS7XepoUIDCazm2WAwX6s4HUDtc= github.com/pulumi/pulumi/sdk/v3 v3.206.0 h1:DvEn8GiYwSCraOv+RkGHYFOvA2m7Y3peWAdgmuYknUY= github.com/pulumi/pulumi/sdk/v3 v3.206.0/go.mod h1:UsBMdaUQ+WoKoQtF2PYbQIbo8ZRJuAo1axkyit9IQVE= github.com/rivo/uniseg v0.1.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc= @@ -171,17 +171,17 @@ github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM= github.com/santhosh-tekuri/jsonschema/v5 v5.0.0 h1:TToq11gyfNlrMFZiYujSekIsPd9AmsA2Bj/iv+s4JHE= github.com/santhosh-tekuri/jsonschema/v5 v5.0.0/go.mod h1:FKdcjfQW6rpZSnxxUvEA5H/cDPdvJ/SZJQLWWXWGrZ0= -github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 h1:n661drycOFuPLCN3Uc8sB6B/s6Z4t2xvBgU1htSHuq8= -github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4= +github.com/sergi/go-diff v1.4.0 h1:n/SP9D5ad1fORl+llWyN+D6qoUETXNZARKjyY2/KVCw= +github.com/sergi/go-diff v1.4.0/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4= github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0= github.com/skeema/knownhosts v1.3.1 h1:X2osQ+RAjK76shCbvhHHHVl3ZlgDm8apHEHFqRjnBY8= github.com/skeema/knownhosts v1.3.1/go.mod h1:r7KTdC8l4uxWRyK2TpQZ/1o5HaSzh06ePQNxPwTcfiY= github.com/spf13/cast v1.4.1 h1:s0hze+J0196ZfEMTs80N7UlFt0BDuQ7Q+JDnHiMWKdA= github.com/spf13/cast v1.4.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE= -github.com/spf13/cobra v1.8.0 h1:7aJaZx1B85qltLMc546zn58BxxfZdR/W22ej9CFoEf0= -github.com/spf13/cobra v1.8.0/go.mod h1:WXLWApfZ71AjXPya3WOlMsY9yMs7YeiHhFVlvLyhcho= -github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA= -github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= +github.com/spf13/cobra v1.10.1 h1:lJeBwCfmrnXthfAupyUTzJ/J4Nc1RsHC/mSRU2dll/s= +github.com/spf13/cobra v1.10.1/go.mod h1:7SmJGaTHFVBY0jW4NXGluQoLvhqFQM+6XSKD+P4XaB0= +github.com/spf13/pflag v1.0.9 h1:9exaQaMOCwffKiiiYk6/BndUBv+iRViNW+4lEMi0PvY= +github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= github.com/stretchr/objx v0.2.0 h1:Hbg2NidpLE8veEBkEZTL3CvlkUIVzuU9jDplZO54c48= github.com/stretchr/objx v0.2.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE= From ba5648cc3e6e419b156459105e9892ba2898260c Mon Sep 17 00:00:00 2001 From: Michael Vorburger Date: Mon, 10 Nov 2025 12:36:58 +0000 Subject: [PATCH 005/313] docs: Split community projects into sections, and add Java client (#758) ## Motivation and Context I found the current raw assorted list of community project a bit overwhelming and confusing at first. So I gave some thought to it, and realized that at first I primarily wanted to see what there is to browse the registry - so that should probably go first? (The current magnifying glass icon, which was even missing on one of the links, wasn't obvious enough, for me.) Also I was looking for a Java client, and realized there already Go and TS clients in this list - let's group those. The Other section in the middle is for everything else (for now, it can always further evolve, later). ## How Has This Been Tested? N/A, as documentation only. ## Breaking Changes Nope, it's documentation only. ## Types of changes - [ ] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [X] Documentation update ## Checklist - [X] I have read the [MCP Documentation](https://modelcontextprotocol.io) - [X] My code follows the repository's style guidelines - [X] New and existing tests pass locally - [X] I have added appropriate error handling - [X] I have added or updated documentation as needed --- docs/community-projects.md | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-) diff --git a/docs/community-projects.md b/docs/community-projects.md index d833b3b..d925f50 100644 --- a/docs/community-projects.md +++ b/docs/community-projects.md @@ -4,21 +4,30 @@ The following is a list of notable community-driven projects in the ecosystem re ## Featured Projects +### Browsers 🔎 + +Browse the official MCP Registry in your browser! + - [MCP Bench](https://mcpbench.ai/)🔎 - Explore the MCP registry with richer filters, community stars, and LLM-generated classification tags. +- [MCP Registry Database](https://lite.datasette.io/?url=https%3A%2F%2Fraw.githubusercontent.com%2Frosmur%2Fofficial-mcp-registry-database%2Fmain%2Fofficial_mcp_registry.db#/official_mcp_registry/servers)🔎 - A minimal, web browsable, live database of the official MCP Registry [source code](https://github.com/rosmur/official-mcp-registry-database). +- [TeamSpark AI Server Registry](https://teamsparkai.github.io/ToolCatalog/registry)🔎 - Browse and discover servers from the official MCP Registry ([source code](https://github.com/TeamSparkAI/ToolCatalog)). + +### MCP Registry Clients + +- [REST API](guides/consuming/use-rest-api.md) - HTTP API +- [go-mcp-registry](https://github.com/leefowlercu/go-mcp-registry) - Go SDK +- [mcp-registry-spec-sdk](https://www.npmjs.com/package/mcp-registry-spec-sdk) - TypeScript client for the MCP Registry +- [LangChain4j MCP Registry Java client](https://docs.langchain4j.dev/tutorials/mcp/#mcp-registry-client) - Java API + +### Other + - [MCP Registry Cheat Sheet](https://github.com/subbyte/mcp-registry-cheatsheet) - MCP Registry Cheat Sheet for MCP server developers, client developers, and registry admin -- [MCP Registry Database](https://lite.datasette.io/?url=https%3A%2F%2Fraw.githubusercontent.com%2Frosmur%2Fofficial-mcp-registry-database%2Fmain%2Fofficial_mcp_registry.db#/official_mcp_registry/servers) - A minimal, web browsable, live database of the official MCP Registry [source code](https://github.com/rosmur/official-mcp-registry-database). - [MCP Registry Remote MCP Server](https://github.com/jaw9c/mcp-registry-mcp) - Open Remote MCP server for the Registry at `https://registry-mcp.remote-mcp.com` - [MCP Server for MCP Registry](https://github.com/formulahendry/mcp-server-mcp-registry) - MCP Server to discover and search for available MCP servers in the registry - [mcp-insights](https://github.com/joelverhagen/mcp-insights/) - Analytics and insights for the MCP Registry - [mcp-registry-cli](https://pypi.org/project/mcp-registry-cli/) - CLI tool to navigate the MCP registry servers -- [mcp-registry-spec-sdk](https://www.npmjs.com/package/mcp-registry-spec-sdk) - TypeScript client for the MCP Registry - [OtherVibes/mcp-publish-action](https://github.com/OtherVibes/mcp-publish-action) - GitHub Action for publishing MCP servers to the official registry -- [TeamSpark AI Server Registry](https://teamsparkai.github.io/ToolCatalog/registry)🔎 - Browse and discover servers from the official MCP Registry ([source code](https://github.com/TeamSparkAI/ToolCatalog)). -- [go-mcp-registry](https://github.com/leefowlercu/go-mcp-registry) - Go SDK for the MCP Registry API - [ToolSDK MCP Registry](https://github.com/toolsdk-ai/toolsdk-mcp-registry) - Extends the MCP Registry with **API-based MCP execution, private deployment**, and **secure sandbox isolation**. -- **Add your project here!** - -🔎 = Browse the official MCP Registry in your browser! ## Adding Your Project From 8cf317af6831c4baabc26f950181622804a68d23 Mon Sep 17 00:00:00 2001 From: adam jones Date: Mon, 10 Nov 2025 12:37:36 +0000 Subject: [PATCH 006/313] Add simple web UI for browsing the registry (#757) ## Summary Adds a clean, minimal web interface at `/` for browsing MCP servers in the registry. Built as a single self-contained HTML file embedded in the Go binary. ## Features - Responsive grid layout (1/2/3 columns based on screen size) - Search servers by name - Filter to show only latest versions (default on) - "Recently Updated" section for servers updated in the last hour - Expandable cards with full server metadata and JSON viewer - Debug modal to switch between production/staging/local/custom API endpoints - Full URL parameter support and browser history navigation ## Implementation - Single HTML file (~400 lines) with Tailwind CSS via CDN - Zero build dependencies - Embedded using `//go:embed` - Served directly from router at root path - Uses stable v0.1 API endpoints Fixes #99 --- AI disclosure: this is 99% vibed with Claude. It's intended as a v0 to get something up and working, and then maybe at a later date we can replace it with something more real. --- internal/api/handlers/v0/ui.go | 13 + internal/api/handlers/v0/ui_index.html | 519 +++++++++++++++++++++++++ internal/api/router/router.go | 11 +- 3 files changed, 540 insertions(+), 3 deletions(-) create mode 100644 internal/api/handlers/v0/ui.go create mode 100644 internal/api/handlers/v0/ui_index.html diff --git a/internal/api/handlers/v0/ui.go b/internal/api/handlers/v0/ui.go new file mode 100644 index 0000000..32aadd4 --- /dev/null +++ b/internal/api/handlers/v0/ui.go @@ -0,0 +1,13 @@ +package v0 + +import ( + _ "embed" +) + +//go:embed ui_index.html +var embedUI string + +// GetUIHTML returns the embedded HTML for the UI +func GetUIHTML() string { + return embedUI +} diff --git a/internal/api/handlers/v0/ui_index.html b/internal/api/handlers/v0/ui_index.html new file mode 100644 index 0000000..ba04a4b --- /dev/null +++ b/internal/api/handlers/v0/ui_index.html @@ -0,0 +1,519 @@ + + + + + + Official MCP Registry + + + + +
+ +
+

Official MCP Registry

+

Discover Model Context Protocol servers

+
+ GitHub + Docs + API Reference +
+
+ + + + + +
+
+ + +
+ +
+ + +
+ Loading servers... +
+ + + + + + +
+ + +
+
+
+
+ Built in the open by MCP contributors +
+ +
+
+
+ + + + + + + diff --git a/internal/api/router/router.go b/internal/api/router/router.go index 73283a0..d951e60 100644 --- a/internal/api/router/router.go +++ b/internal/api/router/router.go @@ -184,14 +184,19 @@ func NewHumaAPI(cfg *config.Config, registry service.RegistryService, mux *http. // Add /metrics for Prometheus metrics using promhttp mux.Handle("/metrics", metrics.PrometheusHandler()) - // Add redirect from / to docs and 404 handler for all other routes + // Add UI and 404 handler for all other routes mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) { if r.URL.Path == "/" { - http.Redirect(w, r, "https://github.com/modelcontextprotocol/registry/tree/main/docs", http.StatusTemporaryRedirect) + // Serve UI at root + w.Header().Set("Content-Type", "text/html; charset=utf-8") + _, err := w.Write([]byte(v0.GetUIHTML())) + if err != nil { + http.Error(w, "Failed to write response", http.StatusInternalServerError) + } return } - // Handle 404 for all other routes + // Handle 404 for all non-matched routes handle404(w, r) }) From cf8e7b8b9853afb922c286cbec23fd4cec10a539 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 12 Nov 2025 12:21:59 +0200 Subject: [PATCH 007/313] build(deps): bump golang.org/x/mod from 0.29.0 to 0.30.0 (#762) Bumps [golang.org/x/mod](https://github.com/golang/mod) from 0.29.0 to 0.30.0.
Commits
  • 7416265 go.mod: update golang.org/x dependencies
  • 5517a71 all: fix some comments
  • b6cdd1a modfile: use reflect.TypeFor instead of reflect.TypeOf
  • See full diff in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=golang.org/x/mod&package-manager=go_modules&previous-version=0.29.0&new-version=0.30.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index e006dca..4376906 100644 --- a/go.mod +++ b/go.mod @@ -22,7 +22,7 @@ require ( go.opentelemetry.io/otel/metric v1.38.0 go.opentelemetry.io/otel/sdk v1.38.0 go.opentelemetry.io/otel/sdk/metric v1.38.0 - golang.org/x/mod v0.29.0 + golang.org/x/mod v0.30.0 gopkg.in/yaml.v3 v3.0.1 ) diff --git a/go.sum b/go.sum index 2b16544..7c35b83 100644 --- a/go.sum +++ b/go.sum @@ -159,8 +159,8 @@ go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI= go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU= golang.org/x/crypto v0.42.0 h1:chiH31gIWm57EkTXpwnqf8qeuMUi0yekh6mT2AvFlqI= golang.org/x/crypto v0.42.0/go.mod h1:4+rDnOTJhQCx2q7/j6rAN5XDw8kPjeaXEUR2eL94ix8= -golang.org/x/mod v0.29.0 h1:HV8lRxZC4l2cr3Zq1LvtOsi/ThTgWnUk/y64QSs8GwA= -golang.org/x/mod v0.29.0/go.mod h1:NyhrlYXJ2H4eJiRy/WDBO6HMqZQ6q9nk4JzS3NuCK+w= +golang.org/x/mod v0.30.0 h1:fDEXFVZ/fmCKProc/yAXXUijritrDzahmwwefnjoPFk= +golang.org/x/mod v0.30.0/go.mod h1:lAsf5O2EvJeSFMiBxXDki7sCgAxEUcZHXoXMKT4GJKc= golang.org/x/net v0.44.0 h1:evd8IRDyfNBMBTTY5XRF1vaZlD+EmWx6x8PkhR04H/I= golang.org/x/net v0.44.0/go.mod h1:ECOoLqd5U3Lhyeyo/QDCEVQ4sNgYsqvCZ722XogGieY= golang.org/x/oauth2 v0.31.0 h1:8Fq0yVZLh4j4YA47vHKFTa9Ew5XIrCP8LC6UeNZnLxo= From b66dc77cfe40b8c47a38e2669165bcf51d305b4f Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 12 Nov 2025 12:22:17 +0200 Subject: [PATCH 008/313] build(deps): bump golangci/golangci-lint-action from 8.0.0 to 9.0.0 in the actions group (#761) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps the actions group with 1 update: [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action). Updates `golangci/golangci-lint-action` from 8.0.0 to 9.0.0
Release notes

Sourced from golangci/golangci-lint-action's releases.

v9.0.0

In the scope of this release, we change Nodejs runtime from node20 to node24 (https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/).

What's Changed

Changes

Full Changelog: https://github.com/golangci/golangci-lint-action/compare/v8.0.0...v9.0.0

Commits
  • 0a35821 docs: update readme
  • 043b1b8 feat: support Module Plugin System (#1306)
  • a66d26a feat: add install-only option (#1305)
  • 7fe1b22 build(deps): bump the dependencies group with 2 updates (#1303)
  • 14973f1 build(deps-dev): bump the dev-dependencies group with 2 updates (#1299)
  • 8c2d575 build(deps): bump @​types/node from 24.8.1 to 24.9.1 in the dependencies group...
  • b002b6e build(deps): bump actions/setup-node from 5 to 6 (#1296)
  • c13f4ed build(deps): bump @​types/node from 24.7.2 to 24.8.1 in the dependencies group...
  • b68d21b docs: improve readme
  • 06188a2 build(deps): bump github/codeql-action from 3 to 4 (#1293)
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=golangci/golangci-lint-action&package-manager=github_actions&previous-version=8.0.0&new-version=9.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 99d7b65..b566087 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -25,7 +25,7 @@ jobs: cache: true - name: Run lint - uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 + uses: golangci/golangci-lint-action@0a35821d5c230e903fcfe077583637dea1b27b47 with: version: v2.4.0 From e726cfe11a878b57ba20db1a580aed2e805f3221 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 12 Nov 2025 12:22:33 +0200 Subject: [PATCH 009/313] build(deps): bump github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.13.0 to 1.13.1 (#760) Bumps [github.com/Azure/azure-sdk-for-go/sdk/azidentity](https://github.com/Azure/azure-sdk-for-go) from 1.13.0 to 1.13.1.
Release notes

Sourced from github.com/Azure/azure-sdk-for-go/sdk/azidentity's releases.

sdk/azidentity/v1.13.1

1.13.1 (2025-11-10)

Bugs Fixed

  • AzureCLICredential quoted arguments incorrectly on Windows
Commits
  • 6bb9b03 azidentity v1.13.1 (#25574)
  • e18dbd7 Increment package version after release of azidentity (#25367)
  • 4f0facc Prepare azidentity v1.13.0 for release (#25352)
  • 2d8c98b Selecting ManagedIdentityCredential disables DefaultAzureCredential's IMDS pr...
  • 67dd4fc Increment package version after release of azidentity (#25263)
  • 1a74bc8 Prepare azidentity v1.12.0 for release (#25231)
  • 839a355 Test IMDS managed identity with a remote VM (#25237)
  • c352be3 Sync eng/common directory with azure-sdk-tools for PR 11931 (#25243)
  • c994eca gofmt (#25234)
  • 9c95d95 [Release] sdk/resourcemanager/computefleet/armcomputefleet/2.0.0-beta.1 gener...
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/Azure/azure-sdk-for-go/sdk/azidentity&package-manager=go_modules&previous-version=1.13.0&new-version=1.13.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 6 +++--- go.sum | 12 ++++++------ 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/go.mod b/go.mod index 4376906..4d83d23 100644 --- a/go.mod +++ b/go.mod @@ -4,7 +4,7 @@ go 1.24.9 require ( cloud.google.com/go/kms v1.23.2 - github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.0 + github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.4.0 github.com/caarlos0/env/v11 v11.3.1 github.com/coreos/go-oidc/v3 v3.16.0 @@ -33,10 +33,10 @@ require ( cloud.google.com/go/compute/metadata v0.8.0 // indirect cloud.google.com/go/iam v1.5.2 // indirect cloud.google.com/go/longrunning v0.6.7 // indirect - github.com/Azure/azure-sdk-for-go/sdk/azcore v1.19.1 // indirect + github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0 // indirect github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 // indirect github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0 // indirect - github.com/AzureAD/microsoft-authentication-library-for-go v1.5.0 // indirect + github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0 // indirect github.com/beorn7/perks v1.0.1 // indirect github.com/cespare/xxhash/v2 v2.3.0 // indirect github.com/containerd/stargz-snapshotter/estargz v0.16.3 // indirect diff --git a/go.sum b/go.sum index 7c35b83..40ba8e0 100644 --- a/go.sum +++ b/go.sum @@ -12,10 +12,10 @@ cloud.google.com/go/kms v1.23.2 h1:4IYDQL5hG4L+HzJBhzejUySoUOheh3Lk5YT4PCyyW6k= cloud.google.com/go/kms v1.23.2/go.mod h1:rZ5kK0I7Kn9W4erhYVoIRPtpizjunlrfU4fUkumUp8g= cloud.google.com/go/longrunning v0.6.7 h1:IGtfDWHhQCgCjwQjV9iiLnUta9LBCo8R9QmAFsS/PrE= cloud.google.com/go/longrunning v0.6.7/go.mod h1:EAFV3IZAKmM56TyiE6VAP3VoTzhZzySwI/YI1s/nRsY= -github.com/Azure/azure-sdk-for-go/sdk/azcore v1.19.1 h1:5YTBM8QDVIBN3sxBil89WfdAAqDZbyJTgh688DSxX5w= -github.com/Azure/azure-sdk-for-go/sdk/azcore v1.19.1/go.mod h1:YD5h/ldMsG0XiIw7PdyNhLxaM317eFh5yNLccNfGdyw= -github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.0 h1:KpMC6LFL7mqpExyMC9jVOYRiVhLmamjeZfRsUpB7l4s= -github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.0/go.mod h1:J7MUC/wtRpfGVbQ5sIItY5/FuVWmvzlY21WAOfQnq/I= +github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0 h1:JXg2dwJUmPB9JmtVmdEB16APJ7jurfbY5jnfXpJoRMc= +github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0/go.mod h1:YD5h/ldMsG0XiIw7PdyNhLxaM317eFh5yNLccNfGdyw= +github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 h1:Hk5QBxZQC1jb2Fwj6mpzme37xbCDdNTxU7O9eb5+LB4= +github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1/go.mod h1:IYus9qsFobWIc2YVwe/WPjcnyCkPKtnHAqUYeebc8z0= github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.2 h1:yz1bePFlP5Vws5+8ez6T3HWXPmwOK7Yvq8QxDBD3SKY= github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.2/go.mod h1:Pa9ZNPuoNu/GztvBSKk9J1cDJW6vk/n0zLtV4mgd8N8= github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 h1:9iefClla7iYpfYWdzPCRDozdmndjTm8DXdpCzPajMgA= @@ -26,8 +26,8 @@ github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0 h1:nCYfg github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0/go.mod h1:ucUjca2JtSZboY8IoUqyQyuuXvwbMBVwFOm0vdQPNhA= github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1 h1:WJTmL004Abzc5wDB5VtZG2PJk5ndYDgVacGqfirKxjM= github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1/go.mod h1:tCcJZ0uHAmvjsVYzEFivsRTN00oz5BEsRgQHu5JZ9WE= -github.com/AzureAD/microsoft-authentication-library-for-go v1.5.0 h1:XkkQbfMyuH2jTSjQjSoihryI8GINRcs4xp8lNawg0FI= -github.com/AzureAD/microsoft-authentication-library-for-go v1.5.0/go.mod h1:HKpQxkWaGLJ+D/5H8QRpyQXA1eKjxkFlOMwck5+33Jk= +github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0 h1:XRzhVemXdgvJqCH0sFfrBUTnUJSBrBf7++ypk+twtRs= +github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0/go.mod h1:HKpQxkWaGLJ+D/5H8QRpyQXA1eKjxkFlOMwck5+33Jk= github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM= github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw= github.com/caarlos0/env/v11 v11.3.1 h1:cArPWC15hWmEt+gWk7YBi7lEXTXCvpaSdCiZE2X5mCA= From 9a492cb8450dd96bb38ee520ece1f2d12352de3e Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 13 Nov 2025 17:19:37 +0000 Subject: [PATCH 010/313] build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.206.0 to 3.207.0 in /deploy (#766) Bumps [github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from 3.206.0 to 3.207.0.
Release notes

Sourced from github.com/pulumi/pulumi/sdk/v3's releases.

v3.207.0

3.207.0 (2025-11-12)

Features

  • [cli] Log gRPC requests before invoking them in gRPC debug interceptor #20817

  • [engine] Add ReplaceWith resource option to allow one resource's replace operations to trigger another's #20693

  • [sdkgen/python] Allow all PEP440 version specifiers to be used

Bug Fixes

  • [cli/import] Return errors when an import fails #20904

  • [engine] Fix parenting of resources in some cases in refresh --run-program #20894

  • [engine] Fix StackReference secrets performance #20908

  • [programgen] Do not panic when re-writing type-invalid PCL #20770

  • [sdk/go] Fix import path in instructions when linking a package in Go #20888

  • [sdk/nodejs] Fix closure serialization on Node.js v25.2.0 #20913

  • [sdk/{nodejs,python}] Avoid cancellations due to do slow processing of requests

  • [sdk/python] Avoid cancellations due to do slow processing of requests in the callbacks server #20917

Miscellaneous

  • [engine] Stop sending ConfigPropertyMap as part of RunRequest #20887
Changelog

Sourced from github.com/pulumi/pulumi/sdk/v3's changelog.

3.207.0 (2025-11-12)

Features

  • [cli] Log gRPC requests before invoking them in gRPC debug interceptor #20817

  • [engine] Add ReplaceWith resource option to allow one resource's replace operations to trigger another's #20693

  • [sdkgen/python] Allow all PEP440 version specifiers to be used

Bug Fixes

  • [cli/import] Return errors when an import fails #20904

  • [engine] Fix parenting of resources in some cases in refresh --run-program #20894

  • [engine] Fix StackReference secrets performance #20908

  • [programgen] Do not panic when re-writing type-invalid PCL #20770

  • [sdk/go] Fix import path in instructions when linking a package in Go #20888

  • [sdk/nodejs] Fix closure serialization on Node.js v25.2.0 #20913

  • [sdk/{nodejs,python}] Avoid cancellations due to do slow processing of requests

  • [sdk/python] Avoid cancellations due to do slow processing of requests in the callbacks server #20917

Miscellaneous

  • [engine] Stop sending ConfigPropertyMap as part of RunRequest #20887
Commits
  • 5e3a500 upgrade language providers to latest versions (#20918)
  • ff9df44 Avoid cancellations due to do slow processing of requests (#20920)
  • a332525 schema: allow any pep440 constraint for specifying pulumi version in python (...
  • ff1b5f6 Disambiguate registry and non-registry templates in pulumi new select (#20701)
  • 5137a3f import: actually return errors if we have them (#20904)
  • b4002be Avoid cancellations due to do slow processing of requests in the callbacks se...
  • 9c779ed Fix StackReference secrets performance (#20908)
  • 4fedb1c Fix closure serialization on Node.js v25.2.0 (#20913)
  • 32235a1 Add ReplaceWith resource option (#20693)
  • 4201af6 Log deleteProvider calls (#20906)
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/pulumi/pulumi/sdk/v3&package-manager=go_modules&previous-version=3.206.0&new-version=3.207.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- deploy/go.mod | 2 +- deploy/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index 5e6bd35..438a412 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -5,7 +5,7 @@ go 1.24.7 require ( github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.24.0 - github.com/pulumi/pulumi/sdk/v3 v3.206.0 + github.com/pulumi/pulumi/sdk/v3 v3.207.0 gopkg.in/yaml.v2 v2.4.0 ) diff --git a/deploy/go.sum b/deploy/go.sum index 7fd193a..bdc21b1 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -160,8 +160,8 @@ github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 h1:w6OnO3d4j5yVf2vpm8OzXFC/xHOEGqt+9 github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1/go.mod h1:UyZyv7hz4knpFx6/Sh+SkZe6hT6sJHtDvw9A0TbvEsk= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.24.0 h1:dlDJvsugKow8tCaD0yJngc7PXdv8WT2YwPEUmj48tF4= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.24.0/go.mod h1:8HDO923pZUokTAEMgS7XepoUIDCazm2WAwX6s4HUDtc= -github.com/pulumi/pulumi/sdk/v3 v3.206.0 h1:DvEn8GiYwSCraOv+RkGHYFOvA2m7Y3peWAdgmuYknUY= -github.com/pulumi/pulumi/sdk/v3 v3.206.0/go.mod h1:UsBMdaUQ+WoKoQtF2PYbQIbo8ZRJuAo1axkyit9IQVE= +github.com/pulumi/pulumi/sdk/v3 v3.207.0 h1:D6EpTYN65Cmt/Qx50GzDgpK9g3TXS3Tq6mnsx7C7Li8= +github.com/pulumi/pulumi/sdk/v3 v3.207.0/go.mod h1:UsBMdaUQ+WoKoQtF2PYbQIbo8ZRJuAo1axkyit9IQVE= github.com/rivo/uniseg v0.1.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc= github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc= github.com/rivo/uniseg v0.4.4 h1:8TfxU8dW6PdqD27gjM8MVNuicgxIjxpm4K7x4jp8sis= From 2ee0219aeefddb5a8bd386881197a5e447360069 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 13 Nov 2025 17:26:17 +0000 Subject: [PATCH 011/313] build(deps): bump pulumi/actions from 6.6.0 to 6.6.1 in the actions group (#765) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps the actions group with 1 update: [pulumi/actions](https://github.com/pulumi/actions). Updates `pulumi/actions` from 6.6.0 to 6.6.1
Release notes

Sourced from pulumi/actions's releases.

v6.6.1

What's Changed

Full Changelog: https://github.com/pulumi/actions/compare/v6...v6.6.1

Changelog

Sourced from pulumi/actions's changelog.

CHANGELOG

HEAD (Unreleased)

(none)

6.6.1 (2025-11-12)

  • chore: Update pulumi/pulumi dependency (#1394)

6.6.0 (2025-09-29)

  • feat: Strip ansi control characters from GitHub step Summary and PR comment (#1312)

6.4.0 (2025-07-16)

  • feat: Add run-program flag support for refresh, destroy, preview, and up/update commands (#1376)

6.3.0 (2025-05-08)

  • feat: support --exclude and --exclude-dependents flags (#1363)

  • feat: verbosity and debug inputs to enable debug options (#1046)

  • fix: update "user agent" string to pulumi/actions@v6 (#1357)

6.2.0 (2025-03-05)

  • feat: support continue on error flag (--continue-on-error) (#1357)

6.1.0 (2025-02-27)

  • feat: Add clickable View Live link to PR comments (#1355)

6.0.1 (2025-01-13)

  • fix: Make pulumi login respect configuration in Pulumi.yaml (#1299)

  • fix: Log stderr from commands

... (truncated)

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=pulumi/actions&package-manager=github_actions&previous-version=6.6.0&new-version=6.6.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/cancel-pulumi-lock.yml | 2 +- .github/workflows/deploy-production.yml | 2 +- .github/workflows/deploy-staging.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/cancel-pulumi-lock.yml b/.github/workflows/cancel-pulumi-lock.yml index 4a447a3..f68635d 100644 --- a/.github/workflows/cancel-pulumi-lock.yml +++ b/.github/workflows/cancel-pulumi-lock.yml @@ -27,7 +27,7 @@ jobs: uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 - name: Setup Pulumi - uses: pulumi/actions@d7ceb0215da5a14ec84f50b703365ddf0194a9c8 + uses: pulumi/actions@8582a9e8cc630786854029b4e09281acd6794b58 with: pulumi-version: ${{ env.PULUMI_VERSION }} diff --git a/.github/workflows/deploy-production.yml b/.github/workflows/deploy-production.yml index 32103ce..1b68af8 100644 --- a/.github/workflows/deploy-production.yml +++ b/.github/workflows/deploy-production.yml @@ -32,7 +32,7 @@ jobs: cache: true - name: Setup Pulumi - uses: pulumi/actions@d7ceb0215da5a14ec84f50b703365ddf0194a9c8 + uses: pulumi/actions@8582a9e8cc630786854029b4e09281acd6794b58 with: pulumi-version: ${{ env.PULUMI_VERSION }} diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml index 524e951..927d2d8 100644 --- a/.github/workflows/deploy-staging.yml +++ b/.github/workflows/deploy-staging.yml @@ -79,7 +79,7 @@ jobs: cache: true - name: Setup Pulumi - uses: pulumi/actions@d7ceb0215da5a14ec84f50b703365ddf0194a9c8 + uses: pulumi/actions@8582a9e8cc630786854029b4e09281acd6794b58 with: pulumi-version: ${{ env.PULUMI_VERSION }} From d9c2e506a98f7ab03fe602c3dd6c932d1b1f963b Mon Sep 17 00:00:00 2001 From: adam jones Date: Thu, 13 Nov 2025 18:21:22 +0000 Subject: [PATCH 012/313] docs: Add releases administration guide (#764) Add comprehensive documentation for the release process including version bumping, changelog generation, and deployment steps. --- docs/guides/administration/releases.md | 28 ++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) create mode 100644 docs/guides/administration/releases.md diff --git a/docs/guides/administration/releases.md b/docs/guides/administration/releases.md new file mode 100644 index 0000000..7f3af2e --- /dev/null +++ b/docs/guides/administration/releases.md @@ -0,0 +1,28 @@ +# Releases + +## Creating a Release + +1. Create a new release on [GitHub](https://github.com/modelcontextprotocol/registry/releases) with a semver tag (e.g., `v1.3.9`) +2. This triggers the [release workflow](.github/workflows/release.yml) which: + - Builds `registry` and `mcp-publisher` binaries for all platforms using GoReleaser + - Signs artifacts with cosign + - Generates SBOMs + - Builds and pushes container images to `ghcr.io/modelcontextprotocol/registry` + +## Deploying to Production + +1. Update `deploy/Pulumi.gcpProd.yaml` (e.g., through a PR or by pushing directly to main): + ```yaml + mcp-registry:imageTag: 1.3.9 + ``` +2. The [deploy-production workflow](.github/workflows/deploy-production.yml) automatically deploys + +## Staging + +Staging auto-deploys from `main` via [deploy-staging.yml](.github/workflows/deploy-staging.yml). It always runs the latest `main` branch code. + +## Rollback + +To rollback production, update `deploy/Pulumi.gcpProd.yaml` to the previous version and push. + +**Note:** Rollbacks may not work as expected if the release included database migrations, since migrations are not automatically reversed. From 45bf43f9d1ef45bf2af4f3f44bbb1b523a1a404b Mon Sep 17 00:00:00 2001 From: Joel Verhagen Date: Mon, 17 Nov 2025 06:32:59 -0500 Subject: [PATCH 013/313] Remove namespace match validation for websiteUrl and remote URL (#769) ## Motivation and Context Resolve https://github.com/modelcontextprotocol/registry/issues/768 and https://github.com/modelcontextprotocol/registry/issues/494. Require HTTPS for remote URLs. Currently all remote URLs on the MCP Registry are HTTPS. Also fix a test bug when running on Windows (bad temp path). ## How Has This Been Tested? Unit tests. Published a server.json locally with a website URL not matching the server name. ## Breaking Changes ## Types of changes - [ ] Bug fix (non-breaking change which fixes an issue) - [x] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] Documentation update ## Checklist - [x] I have read the [MCP Documentation](https://modelcontextprotocol.io) - [x] My code follows the repository's style guidelines - [x] New and existing tests pass locally - [x] I have added appropriate error handling - [ ] ~I have added or updated documentation as needed~ N/A ## Additional context --- .../server-json/generic-server-json.md | 2 +- internal/importer/importer_test.go | 3 +- internal/validators/utils.go | 4 + internal/validators/validators.go | 107 ------------------ internal/validators/validators_test.go | 32 ++++-- 5 files changed, 30 insertions(+), 118 deletions(-) diff --git a/docs/reference/server-json/generic-server-json.md b/docs/reference/server-json/generic-server-json.md index 5e64bbd..c30120e 100644 --- a/docs/reference/server-json/generic-server-json.md +++ b/docs/reference/server-json/generic-server-json.md @@ -280,7 +280,7 @@ This will essentially instruct the MCP client to execute `dnx Knapcode.SampleMcp "remotes": [ { "type": "streamable-http", - "url": "http://mcp-fs.anonymous.modelcontextprotocol.io/http" + "url": "https://mcp-fs.anonymous.modelcontextprotocol.io/http" } ], "_meta": { diff --git a/internal/importer/importer_test.go b/internal/importer/importer_test.go index 8337e93..db0cc2a 100644 --- a/internal/importer/importer_test.go +++ b/internal/importer/importer_test.go @@ -6,6 +6,7 @@ import ( "net/http" "net/http/httptest" "os" + "path/filepath" "testing" "github.com/modelcontextprotocol/registry/internal/config" @@ -20,7 +21,7 @@ import ( func TestImportService_LocalFile(t *testing.T) { // Create a temporary seed file - tempFile := "/tmp/test_import_seed.json" + tempFile := filepath.Join(os.TempDir(), "test_import_seed.json") seedData := []*apiv0.ServerJSON{ { Schema: model.CurrentSchemaURL, diff --git a/internal/validators/utils.go b/internal/validators/utils.go index 69f2615..9a6b4cf 100644 --- a/internal/validators/utils.go +++ b/internal/validators/utils.go @@ -144,6 +144,10 @@ func IsValidRemoteURL(rawURL string) bool { return false } + if u.Scheme != "https" { + return false + } + return true } diff --git a/internal/validators/validators.go b/internal/validators/validators.go index ffdb4a8..3c9789d 100644 --- a/internal/validators/validators.go +++ b/internal/validators/validators.go @@ -6,7 +6,6 @@ import ( "fmt" "net/url" "regexp" - "slices" "strings" "github.com/modelcontextprotocol/registry/internal/config" @@ -108,16 +107,6 @@ func ValidateServerJSON(serverJSON *apiv0.ServerJSON) error { } } - // Validate reverse-DNS namespace matching for remote URLs - if err := validateRemoteNamespaceMatch(*serverJSON); err != nil { - return err - } - - // Validate reverse-DNS namespace matching for website URL - if err := validateWebsiteURLNamespaceMatch(*serverJSON); err != nil { - return err - } - return nil } @@ -509,99 +498,3 @@ func parseServerName(serverJSON apiv0.ServerJSON) (string, error) { return name, nil } - -// validateRemoteNamespaceMatch validates that remote URLs match the reverse-DNS namespace -func validateRemoteNamespaceMatch(serverJSON apiv0.ServerJSON) error { - namespace := serverJSON.Name - - for _, remote := range serverJSON.Remotes { - if err := validateRemoteURLMatchesNamespace(remote.URL, namespace); err != nil { - return fmt.Errorf("remote URL %s does not match namespace %s: %w", remote.URL, namespace, err) - } - } - - return nil -} - -// validateWebsiteURLNamespaceMatch validates that website URL matches the reverse-DNS namespace -func validateWebsiteURLNamespaceMatch(serverJSON apiv0.ServerJSON) error { - // Skip validation if website URL is not provided - if serverJSON.WebsiteURL == "" { - return nil - } - - namespace := serverJSON.Name - if err := validateRemoteURLMatchesNamespace(serverJSON.WebsiteURL, namespace); err != nil { - return fmt.Errorf("websiteUrl %s does not match namespace %s: %w", serverJSON.WebsiteURL, namespace, err) - } - - return nil -} - -// validateRemoteURLMatchesNamespace checks if a remote URL's hostname matches the publisher domain from the namespace -func validateRemoteURLMatchesNamespace(remoteURL, namespace string) error { - // Parse the URL to extract the hostname - parsedURL, err := url.Parse(remoteURL) - if err != nil { - return fmt.Errorf("invalid URL format: %w", err) - } - - hostname := parsedURL.Hostname() - if hostname == "" { - return fmt.Errorf("URL must have a valid hostname") - } - - // Skip validation for localhost and local development URLs - if hostname == "localhost" || strings.HasSuffix(hostname, ".localhost") || hostname == "127.0.0.1" { - return nil - } - - // Extract publisher domain from reverse-DNS namespace - publisherDomain := extractPublisherDomainFromNamespace(namespace) - if publisherDomain == "" { - return fmt.Errorf("invalid namespace format: cannot extract domain from %s", namespace) - } - - // Check if the remote URL hostname matches the publisher domain or is a subdomain - if !isValidHostForDomain(hostname, publisherDomain) { - return fmt.Errorf("remote URL host %s does not match publisher domain %s", hostname, publisherDomain) - } - - return nil -} - -// extractPublisherDomainFromNamespace converts reverse-DNS namespace to normal domain format -// e.g., "com.example" -> "example.com" -func extractPublisherDomainFromNamespace(namespace string) string { - // Extract the namespace part before the first slash - namespacePart := namespace - if slashIdx := strings.Index(namespace, "/"); slashIdx != -1 { - namespacePart = namespace[:slashIdx] - } - - // Split into parts and reverse them to get normal domain format - parts := strings.Split(namespacePart, ".") - if len(parts) < 2 { - return "" - } - - // Reverse the parts to convert from reverse-DNS to normal domain - slices.Reverse(parts) - - return strings.Join(parts, ".") -} - -// isValidHostForDomain checks if a hostname is the domain or a subdomain of the publisher domain -func isValidHostForDomain(hostname, publisherDomain string) bool { - // Exact match - if hostname == publisherDomain { - return true - } - - // Subdomain match - hostname should end with "." + publisherDomain - if strings.HasSuffix(hostname, "."+publisherDomain) { - return true - } - - return false -} diff --git a/internal/validators/validators_test.go b/internal/validators/validators_test.go index 1b08c9b..e5d3909 100644 --- a/internal/validators/validators_test.go +++ b/internal/validators/validators_test.go @@ -454,6 +454,21 @@ func TestValidate(t *testing.T) { }, expectedError: "websiteUrl must use https scheme: ftp://example.com/docs", }, + { + name: "server with invalid websiteUrl - required HTTPS", + serverDetail: apiv0.ServerJSON{ + Schema: model.CurrentSchemaURL, + Name: "com.example/test-server", + Description: "A test server", + Repository: &model.Repository{ + URL: "https://github.com/owner/repo", + Source: "github", + }, + Version: "1.0.0", + WebsiteURL: "http://example.com/docs", + }, + expectedError: "websiteUrl must use https scheme: http://example.com/docs", + }, { name: "server with malformed websiteUrl", serverDetail: apiv0.ServerJSON{ @@ -512,7 +527,7 @@ func TestValidate(t *testing.T) { Version: "1.0.0", WebsiteURL: "https://different.com/docs", }, - expectedError: "websiteUrl https://different.com/docs does not match namespace com.example/test-server", + expectedError: "", }, { name: "package with spaces in name", @@ -797,7 +812,7 @@ func TestValidate_RemoteNamespaceMatch(t *testing.T) { expectError: false, }, { - name: "invalid - wrong domain", + name: "valid - different domain", serverDetail: apiv0.ServerJSON{ Schema: model.CurrentSchemaURL, Name: "com.example/test-server", @@ -808,23 +823,22 @@ func TestValidate_RemoteNamespaceMatch(t *testing.T) { }, }, }, - expectError: true, - errorMsg: "remote URL host google.com does not match publisher domain example.com", + expectError: false, }, { - name: "invalid - different domain entirely", + name: "invalid - not HTTPS", serverDetail: apiv0.ServerJSON{ Schema: model.CurrentSchemaURL, Name: "com.microsoft/server", Remotes: []model.Transport{ { Type: "streamable-http", - URL: "https://api.github.com/endpoint", + URL: "http://api.github.com/endpoint", }, }, }, expectError: true, - errorMsg: "remote URL host api.github.com does not match publisher domain microsoft.com", + errorMsg: "invalid remote URL: http://api.github.com/endpoint", }, { name: "invalid URL format", @@ -880,12 +894,12 @@ func TestValidate_RemoteNamespaceMatch(t *testing.T) { }, { Type: "streamable-http", - URL: "https://google.com/websocket", + URL: "http://example.com/sse", }, }, }, expectError: true, - errorMsg: "remote URL host google.com does not match publisher domain example.com", + errorMsg: "invalid remote URL: http://example.com/sse", }, } From e7de7541c765b22df53959b7e013fd65624915f6 Mon Sep 17 00:00:00 2001 From: adam jones Date: Mon, 17 Nov 2025 13:59:19 +0000 Subject: [PATCH 014/313] improve: Add hint about making GitHub org membership public in error messages (#772) When users try to publish to a GitHub organization but don't have permission, the error message now includes a helpful hint suggesting they may need to make their organization membership public in GitHub settings. This addresses the issue where users couldn't understand why they were unable to publish servers from organization repositories, even when they were members of the organization. Fixes #398 Generated with [Claude Code](https://claude.ai/code) --------- Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com> Co-authored-by: adam jones --- internal/api/handlers/v0/publish.go | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/internal/api/handlers/v0/publish.go b/internal/api/handlers/v0/publish.go index 2bdb198..7631ae3 100644 --- a/internal/api/handlers/v0/publish.go +++ b/internal/api/handlers/v0/publish.go @@ -84,5 +84,10 @@ func buildPermissionErrorMessage(attemptedResource string, permissions []auth.Pe } errorMsg += ". Attempting to publish: " + attemptedResource + // Add helpful hint for GitHub organization publishing issues + if strings.HasPrefix(attemptedResource, "io.github.") { + errorMsg += ". If you're trying to publish to a GitHub organization, you may need to make your organization membership public in your GitHub settings: https://docs.github.com/en/account-and-profile/how-tos/organization-membership/publicizing-or-hiding-organization-membership" + } + return errorMsg } From 7b3f01ab2268fa3a9d485cb62ba29c41271e5d91 Mon Sep 17 00:00:00 2001 From: adam jones Date: Mon, 17 Nov 2025 13:59:24 +0000 Subject: [PATCH 015/313] docs: Update API changelog for v1.3.9 release (#774) Updates the API changelog to reflect the v1.3.9 release date (2025-11-17). This moves the 'Unreleased' section to a dated section as part of the v1.3.9 release process. --- docs/reference/api/CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/reference/api/CHANGELOG.md b/docs/reference/api/CHANGELOG.md index 39c8eb2..018b9f3 100644 --- a/docs/reference/api/CHANGELOG.md +++ b/docs/reference/api/CHANGELOG.md @@ -2,7 +2,7 @@ Changes to the REST API endpoints and responses. -## Unreleased +## 2025-11-17 ### Added From 71fd7d0683353bff0ffe37cf4ce0ca5194db54b0 Mon Sep 17 00:00:00 2001 From: adam jones Date: Mon, 17 Nov 2025 13:59:30 +0000 Subject: [PATCH 016/313] Update Claude Code GitHub Action from beta to v1 (#773) Updates the Claude Code GitHub Action to use the stable v1 GA release instead of the beta version. ## Changes - Updates action version from `@beta` to `@v1` - Migrates `allowed_tools` to `claude_args: --allowedTools` - Migrates `custom_instructions` to `claude_args: --system-prompt` - Retains `additional_permissions` and `assignee_trigger` (both still supported in v1) ## Behavior The action continues to work the same way: - Triggers on `@claude` mentions in comments, reviews, and issues - Triggers when assigned to an issue as "claude" - Allows Claude to run Bash commands - Allows Claude to read CI results on PRs - Applies custom instructions for posting concise summaries --- .github/workflows/claude.yml | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index 29c3a6c..eeac0f1 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -32,7 +32,7 @@ jobs: - name: Run Claude Code id: claude - uses: anthropics/claude-code-action@beta + uses: anthropics/claude-code-action@v1 with: anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} @@ -42,10 +42,7 @@ jobs: # Trigger when assigned to an issue assignee_trigger: "claude" - - # Allow Claude to run bash - # This should be safe given the repo is already public - allowed_tools: "Bash" - - custom_instructions: | - If posting a comment to GitHub, give a concise summary of the comment at the top and put all the details in a
block. + + claude_args: | + --allowedTools Bash + --system-prompt "If posting a comment to GitHub, give a concise summary of the comment at the top and put all the details in a
block." From da835059b31d36ae8944a94499d94d959ab08910 Mon Sep 17 00:00:00 2001 From: adam jones Date: Mon, 17 Nov 2025 13:59:36 +0000 Subject: [PATCH 017/313] Promote prod to v1.3.9 (#775) Deploys v1.3.9 to production. ## Changes in v1.3.9 - New web UI for browsing the registry (#757) - Fixed namespace match validation for websiteUrl and remote URL (#769) - Added releases administration guide (#764) - Updated community projects documentation - Multiple dependency updates Release notes: https://github.com/modelcontextprotocol/registry/releases/tag/v1.3.9 The [deploy-production workflow](https://github.com/modelcontextprotocol/registry/actions/workflows/deploy-production.yml) will automatically deploy once this PR is merged. --- deploy/Pulumi.gcpProd.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/deploy/Pulumi.gcpProd.yaml b/deploy/Pulumi.gcpProd.yaml index 3f883fa..1341e55 100644 --- a/deploy/Pulumi.gcpProd.yaml +++ b/deploy/Pulumi.gcpProd.yaml @@ -1,7 +1,7 @@ config: mcp-registry:environment: prod mcp-registry:provider: gcp - mcp-registry:imageTag: 1.3.8 # Set specific image tag for production (change this to deploy different versions) + mcp-registry:imageTag: 1.3.9 # Set specific image tag for production (change this to deploy different versions) gcp:project: mcp-registry-prod mcp-registry:githubClientId: Iv23liUydBbI7Z2Q9bOZ mcp-registry:githubClientSecret: From 32b37e71f820e34a78b77debf7020f0a09222f22 Mon Sep 17 00:00:00 2001 From: adam jones Date: Mon, 17 Nov 2025 19:11:07 +0000 Subject: [PATCH 018/313] Add registry authorization specification (#756) Add a standardized OAuth 2.1-based authentication specification for MCP sub-registries, aligned with the MCP Authorization Specification. This enables: - Private registry entries with access control - Permission-based server visibility - Client code reuse (clients can use their existing MCP auth implementation) The spec is intended for downstream sub-registries. The official registry remains public for reading. Fixes #751 --------- Co-authored-by: Claude --- docs/reference/README.md | 1 + docs/reference/api/generic-registry-api.md | 5 ++-- docs/reference/api/registry-authorization.md | 26 ++++++++++++++++++++ 3 files changed, 30 insertions(+), 2 deletions(-) create mode 100644 docs/reference/api/registry-authorization.md diff --git a/docs/reference/README.md b/docs/reference/README.md index d69ae2c..73f3518 100644 --- a/docs/reference/README.md +++ b/docs/reference/README.md @@ -5,6 +5,7 @@ Technical specifications and quick lookups for the MCP Registry. ## API Reference - [Generic Registry API](./api/generic-registry-api.md) +- [Registry Authorization](./api/registry-authorization.md) - [Official Registry API](./api/official-registry-api.md) ## server.json Reference diff --git a/docs/reference/api/generic-registry-api.md b/docs/reference/api/generic-registry-api.md index 86cffa6..a36b149 100644 --- a/docs/reference/api/generic-registry-api.md +++ b/docs/reference/api/generic-registry-api.md @@ -4,6 +4,7 @@ A standardized RESTful HTTP API for MCP registries to provide consistent endpoin Also see: - For guidance consuming the API, see the [consuming guide](../../guides/consuming/use-rest-api.md). +- For authentication and authorization, see the [registry authorization specification](./registry-authorization.md). ## Browse the Complete API Specification @@ -22,8 +23,8 @@ The official registry has some more endpoints and restrictions on top of this. S Server names and version strings should be URL-encoded in paths. ### Authentication -- **Read operations**: No authentication required -- **Write operations**: Registry-specific authentication (if supported) + +No authentication required by default. Subregistries may optionally require authentication following the [registry authorization specification](./registry-authorization.md). ### Content Type All requests and responses use `application/json` diff --git a/docs/reference/api/registry-authorization.md b/docs/reference/api/registry-authorization.md new file mode 100644 index 0000000..20d522a --- /dev/null +++ b/docs/reference/api/registry-authorization.md @@ -0,0 +1,26 @@ +# Registry Authorization + +MCP registries wishing to implement authentication SHOULD follow the [MCP Authorization Specification](https://modelcontextprotocol.io/specification/draft/basic/authorization). + +## How it works + +The registry acts as an OAuth 2.1 Resource Server, identical to how MCP servers work. This means: + +- **MCP clients** can reuse their existing MCP authorization implementation without any changes +- **Registries** validate access tokens the same way MCP servers do +- **Users** get a consistent login experience across MCP servers and registries + +## Registry-Specific Scopes + +Registries MAY use these scopes: + +- `mcp-registry:read` - List and read server metadata +- `mcp-registry:write` - Publish, update, and delete servers + +These are recommendations - registries may use any set of scopes they deem sensible. + +Note that scopes only control what *types* of operations a user can perform. Registries should still apply user-level authorization to control which specific resources a user can access. For example, a user with `mcp-registry:write` might only be able to publish servers to namespaces they own, and may not have permissions to edit servers if the registry treats servers as immutable. + +## Official Registry Authentication + +The official modelcontextprotocol.io registry remains public for reading. For publishing servers, it uses a custom JWT-based authentication system for legacy reasons - see [its API spec](official-registry-api.md#authentication). This may change in future to align with the MCP Authorization Specification. From 2ca4ae99778eca3e922525a101a202a6a3669d90 Mon Sep 17 00:00:00 2001 From: Joel Verhagen Date: Tue, 18 Nov 2025 02:58:10 -0500 Subject: [PATCH 019/313] Add support for ACR (Azure Container Registry) and MCR (Microsoft Container Registry) (#754) ## Motivation and Context Microsoft uses `mcr.microsoft.com` to host our public containers. These are syndicated to Docker Hub but image references use `mcr.microsoft.com` which is not currently supported by the Official MCP Registry. See https://github.com/modelcontextprotocol/registry/issues/753. Microsoft teams want to use MCR-based images for Microsoft MCP servers. I believe we should be adding ACR support as well, so that our customers using Azure Container Registry can use the MCP Registry as well. In short, MCR is used for Microsoft managed containers. ACR is a solution for Azure customers to host their own containers. ## How Has This Been Tested? Unit tests. Manual test: local push of a server.json with `mcr.microsoft.com/azure-sdk/azure-mcp:2.0.0-beta.1` and `azurearcjumpstart.azurecr.io/hello-arc:latest` in it. The error is now about missing annotation not unsupported OCI registry. ## Breaking Changes No. ## Types of changes - [ ] Bug fix (non-breaking change which fixes an issue) - [x] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] Documentation update ## Checklist - [x] I have read the [MCP Documentation](https://modelcontextprotocol.io) - [x] My code follows the repository's style guidelines - [x] New and existing tests pass locally - [x] I have added appropriate error handling - [x] I have added or updated documentation as needed ## Additional context --- docs/guides/publishing/publish-server.md | 2 ++ docs/reference/faq.md | 3 +++ .../server-json/official-registry-requirements.md | 2 ++ internal/validators/registries/oci.go | 9 +++++++++ internal/validators/registries/oci_test.go | 12 ++++++++++++ 5 files changed, 28 insertions(+) diff --git a/docs/guides/publishing/publish-server.md b/docs/guides/publishing/publish-server.md index 80eefed..ea0ebab 100644 --- a/docs/guides/publishing/publish-server.md +++ b/docs/guides/publishing/publish-server.md @@ -317,6 +317,8 @@ The official MCP registry supports: - Docker Hub (`docker.io`) - GitHub Container Registry (`ghcr.io`) - Google Artifact Registry (any `*.pkg.dev` domain) +- Azure Container Registry (`*.azurecr.io`) +- Microsoft Container Registry (`mcr.microsoft.com`)
diff --git a/docs/reference/faq.md b/docs/reference/faq.md index 5474a49..034ccb1 100644 --- a/docs/reference/faq.md +++ b/docs/reference/faq.md @@ -62,6 +62,9 @@ This applies to both locally-run and remote servers. - NuGet.org (.NET packages) - GitHub Container Registry (GHCR) - Docker Hub +- Google Artifact Registry (`*.pkg.dev` domains) +- Azure Container Registry (`*.azurecr.io` domains) +- Microsoft Container Registry (MCR) More can be added as the community desires; feel free to open an issue if you are interested in building support for another registry. diff --git a/docs/reference/server-json/official-registry-requirements.md b/docs/reference/server-json/official-registry-requirements.md index f33ed8c..6ab2325 100644 --- a/docs/reference/server-json/official-registry-requirements.md +++ b/docs/reference/server-json/official-registry-requirements.md @@ -42,6 +42,8 @@ Only trusted public registries are supported. Private registries and alternative - Docker Hub (`docker.io`) - GitHub Container Registry (`ghcr.io`) - Google Artifact Registry (`*.pkg.dev`) + - Azure Container Registry (`*.azurecr.io`) + - Microsoft Container Registry (`mcr.microsoft.com`) - **MCPB**: `https://github.com` releases and `https://gitlab.com` releases only ## `_meta` Namespace Restrictions diff --git a/internal/validators/registries/oci.go b/internal/validators/registries/oci.go index 211e578..6932d7f 100644 --- a/internal/validators/registries/oci.go +++ b/internal/validators/registries/oci.go @@ -33,7 +33,10 @@ var allowedOCIRegistries = map[string]bool{ "index.docker.io": true, // Docker Hub index // GitHub Container Registry "ghcr.io": true, + // Microsoft Container Registry + "mcr.microsoft.com": true, // Google Artifact Registry (*.pkg.dev pattern handled in isAllowedRegistry) + // Azure Container Registry (*.azurecr.io pattern handled in isAllowedRegistry) } // ValidateOCI validates that an OCI image contains the correct MCP server name annotation. @@ -47,6 +50,7 @@ var allowedOCIRegistries = map[string]bool{ // - Docker Hub (docker.io) // - GitHub Container Registry (ghcr.io) // - Google Artifact Registry (*.pkg.dev) +// - Microsoft Container Registry (mcr.microsoft.com) func ValidateOCI(ctx context.Context, pkg model.Package, serverName string) error { if pkg.Identifier == "" { return ErrMissingIdentifierForOCI @@ -149,5 +153,10 @@ func isAllowedRegistry(registry string) bool { return true } + // Azure Container Registry: *.azurecr.io + if strings.HasSuffix(registry, ".azurecr.io") { + return true + } + return false } diff --git a/internal/validators/registries/oci_test.go b/internal/validators/registries/oci_test.go index 3b02fd2..64e319d 100644 --- a/internal/validators/registries/oci_test.go +++ b/internal/validators/registries/oci_test.go @@ -51,6 +51,18 @@ func TestValidateOCI_RegistryAllowlist(t *testing.T) { expectError: true, errorMsg: "missing required annotation", }, + { + name: "MCR should be allowed", + identifier: "mcr.microsoft.com/dotnet/aspire-dashboard:9.5.0", + expectError: true, + errorMsg: "missing required annotation", + }, + { + name: "ACR should be allowed", + identifier: "azurearcjumpstart.azurecr.io/hello-arc:latest", + expectError: true, + errorMsg: "missing required annotation", + }, // Disallowed registries { From 467a7fd89798fd8b247f490a0af5431d465b58cd Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 18 Nov 2025 09:58:34 +0200 Subject: [PATCH 020/313] build(deps): bump the actions group with 2 updates (#779) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps the actions group with 2 updates: [actions/checkout](https://github.com/actions/checkout) and [anchore/sbom-action](https://github.com/anchore/sbom-action). Updates `actions/checkout` from 5.0.0 to 5.0.1
Release notes

Sourced from actions/checkout's releases.

v5.0.1

What's Changed

Full Changelog: https://github.com/actions/checkout/compare/v5...v5.0.1

Commits

Updates `anchore/sbom-action` from 0.20.9 to 0.20.10
Release notes

Sourced from anchore/sbom-action's releases.

v0.20.10

Changes in v0.20.10

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/cancel-pulumi-lock.yml | 2 +- .github/workflows/ci.yml | 4 ++-- .github/workflows/claude.yml | 2 +- .github/workflows/deploy-production.yml | 2 +- .github/workflows/deploy-staging.yml | 4 ++-- .github/workflows/release.yml | 6 +++--- 6 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/workflows/cancel-pulumi-lock.yml b/.github/workflows/cancel-pulumi-lock.yml index f68635d..4f5753e 100644 --- a/.github/workflows/cancel-pulumi-lock.yml +++ b/.github/workflows/cancel-pulumi-lock.yml @@ -24,7 +24,7 @@ jobs: environment: ${{ inputs.environment }} steps: - name: Checkout code - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd - name: Setup Pulumi uses: pulumi/actions@8582a9e8cc630786854029b4e09281acd6794b58 diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b566087..fc733be 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -16,7 +16,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd - name: Set up Go uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 @@ -48,7 +48,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd - name: Set up Go uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index eeac0f1..e00af77 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -26,7 +26,7 @@ jobs: actions: read steps: - name: Checkout repository - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd with: fetch-depth: 1 diff --git a/.github/workflows/deploy-production.yml b/.github/workflows/deploy-production.yml index 1b68af8..1be796c 100644 --- a/.github/workflows/deploy-production.yml +++ b/.github/workflows/deploy-production.yml @@ -23,7 +23,7 @@ jobs: cancel-in-progress: false steps: - name: Checkout code - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd - name: Setup Go uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml index 927d2d8..309ce09 100644 --- a/.github/workflows/deploy-staging.yml +++ b/.github/workflows/deploy-staging.yml @@ -22,7 +22,7 @@ jobs: packages: write steps: - name: Checkout repository - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd - name: Set up Go uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 @@ -70,7 +70,7 @@ jobs: cancel-in-progress: false steps: - name: Checkout code - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd - name: Setup Go uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index fca9ec2..0ec1cce 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -14,7 +14,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd with: fetch-depth: 0 @@ -30,7 +30,7 @@ jobs: cosign-release: "v2.6.1" - name: Install Syft - uses: anchore/sbom-action/download-syft@v0.20.9 + uses: anchore/sbom-action/download-syft@v0.20.10 - name: Run GoReleaser uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a @@ -47,7 +47,7 @@ jobs: needs: goreleaser steps: - name: Checkout - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 + uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd - name: Set up Go uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 From 3d3337942b2be642c0eda6cf201ab3c5b74bb26d Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Tue, 18 Nov 2025 14:33:55 +0200 Subject: [PATCH 021/313] Update prod to 1.3.10 (#780) ## Motivation and Context The following PR promotes prod to 1.3.10 ## How Has This Been Tested? ## Breaking Changes ## Types of changes - [ ] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] Documentation update ## Checklist - [ ] I have read the [MCP Documentation](https://modelcontextprotocol.io) - [ ] My code follows the repository's style guidelines - [ ] New and existing tests pass locally - [ ] I have added appropriate error handling - [ ] I have added or updated documentation as needed ## Additional context --- deploy/Pulumi.gcpProd.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/deploy/Pulumi.gcpProd.yaml b/deploy/Pulumi.gcpProd.yaml index 1341e55..bcdfedf 100644 --- a/deploy/Pulumi.gcpProd.yaml +++ b/deploy/Pulumi.gcpProd.yaml @@ -1,7 +1,7 @@ config: mcp-registry:environment: prod mcp-registry:provider: gcp - mcp-registry:imageTag: 1.3.9 # Set specific image tag for production (change this to deploy different versions) + mcp-registry:imageTag: 1.3.10 # Set specific image tag for production (change this to deploy different versions) gcp:project: mcp-registry-prod mcp-registry:githubClientId: Iv23liUydBbI7Z2Q9bOZ mcp-registry:githubClientSecret: From 43d41a242e2bfb068d79a373c816287976a6daea Mon Sep 17 00:00:00 2001 From: Jonathan Hefner Date: Tue, 18 Nov 2025 11:22:31 -0600 Subject: [PATCH 022/313] Prepare docs for modelcontextprotocol.io (#728) This PR reorganizes and extends the existing documentation in preparation for publishing on https://modelcontextprotocol.io/. The current plan is for docs to remain in this repo, and be synced to the `modelcontextprotocol/modelcontextprotocol` whenever necessary (e.g., accompanying a release of the registry). I have included a script in https://github.com/modelcontextprotocol/modelcontextprotocol/pull/1725 (`bin/pull-registry-docs.sh`) that can be run manually to perform the sync. If we later decide to permanently move the docs to the `modelcontextprotocol/modelcontextprotocol` repo, that also works. This PR puts all https://modelcontextprotocol.io/ docs into `docs/modelcontextprotocol-io/`. Docs outside that subdirectory, such as `docs/administration/admin-operations.md`, are intended to be accessible solely via this repo. One major exception is the `docs/reference/server-json/` subdirectory, which will depend on the resolution of https://github.com/modelcontextprotocol/modelcontextprotocol/issues/1649. However, I think we could address that in a follow-up PR. --------- Co-authored-by: Adam Jones Co-authored-by: Claude --- .gitignore | 2 +- .../administration/admin-operations.md | 0 .../contributing/add-package-registry.md | 0 docs/{guides => }/contributing/releasing.md | 16 +- .../design-principles.md | 0 ...it-2025-05-registry-goals-presentation.pdf | 0 ...t-2025-10-registry-status-presentation.pdf | Bin .../ecosystem-diagram.excalidraw.svg | 0 .../ecosystem-vision.md | 0 docs/{explanations => design}/roadmap.md | 0 .../tech-architecture.md | 0 docs/explanations/README.md | 10 - docs/explanations/namespacing.md | 45 -- docs/explanations/versioning.md | 231 -------- docs/guides/README.md | 21 - .../administration/moderation-guidelines.md | 60 -- docs/guides/administration/releases.md | 28 - docs/guides/consuming/use-rest-api.md | 112 ---- docs/guides/publishing/github-actions.md | 152 ----- docs/guides/publishing/publish-server.md | 525 ------------------ docs/modelcontextprotocol-io/about.mdx | 89 +++ .../authentication.mdx | 290 ++++++++++ .../ecosystem-diagram.excalidraw.svg | 4 + docs/modelcontextprotocol-io/faq.mdx | 39 ++ .../github-actions.mdx | 223 ++++++++ .../moderation-policy.mdx | 58 ++ .../modelcontextprotocol-io/package-types.mdx | 201 +++++++ docs/modelcontextprotocol-io/quickstart.mdx | 289 ++++++++++ .../registry-aggregators.mdx | 106 ++++ .../remote-servers.mdx | 108 ++++ .../terms-of-service.mdx} | 7 +- docs/modelcontextprotocol-io/versioning.mdx | 167 ++++++ docs/reference/api/generic-registry-api.md | 1 - docs/reference/faq.md | 200 ------- .../official-registry-requirements.md | 5 - tools/validate-examples/main.go | 14 +- 36 files changed, 1606 insertions(+), 1397 deletions(-) rename docs/{guides => }/administration/admin-operations.md (100%) rename docs/{guides => }/contributing/add-package-registry.md (100%) rename docs/{guides => }/contributing/releasing.md (77%) rename docs/{explanations => design}/design-principles.md (100%) rename docs/{explanations => design}/dev-summit-2025-05-registry-goals-presentation.pdf (100%) rename docs/{explanations => design}/dev-summit-2025-10-registry-status-presentation.pdf (100%) rename docs/{explanations => design}/ecosystem-diagram.excalidraw.svg (100%) rename docs/{explanations => design}/ecosystem-vision.md (100%) rename docs/{explanations => design}/roadmap.md (100%) rename docs/{explanations => design}/tech-architecture.md (100%) delete mode 100644 docs/explanations/README.md delete mode 100644 docs/explanations/namespacing.md delete mode 100644 docs/explanations/versioning.md delete mode 100644 docs/guides/README.md delete mode 100644 docs/guides/administration/moderation-guidelines.md delete mode 100644 docs/guides/administration/releases.md delete mode 100644 docs/guides/consuming/use-rest-api.md delete mode 100644 docs/guides/publishing/github-actions.md delete mode 100644 docs/guides/publishing/publish-server.md create mode 100644 docs/modelcontextprotocol-io/about.mdx create mode 100644 docs/modelcontextprotocol-io/authentication.mdx create mode 100644 docs/modelcontextprotocol-io/ecosystem-diagram.excalidraw.svg create mode 100644 docs/modelcontextprotocol-io/faq.mdx create mode 100644 docs/modelcontextprotocol-io/github-actions.mdx create mode 100644 docs/modelcontextprotocol-io/moderation-policy.mdx create mode 100644 docs/modelcontextprotocol-io/package-types.mdx create mode 100644 docs/modelcontextprotocol-io/quickstart.mdx create mode 100644 docs/modelcontextprotocol-io/registry-aggregators.mdx create mode 100644 docs/modelcontextprotocol-io/remote-servers.mdx rename docs/{terms.md => modelcontextprotocol-io/terms-of-service.mdx} (98%) create mode 100644 docs/modelcontextprotocol-io/versioning.mdx delete mode 100644 docs/reference/faq.md diff --git a/.gitignore b/.gitignore index 8d3145a..b2f3118 100644 --- a/.gitignore +++ b/.gitignore @@ -12,4 +12,4 @@ validate-schemas coverage.out coverage.html deploy/infra/infra -registry \ No newline at end of file +./registry diff --git a/docs/guides/administration/admin-operations.md b/docs/administration/admin-operations.md similarity index 100% rename from docs/guides/administration/admin-operations.md rename to docs/administration/admin-operations.md diff --git a/docs/guides/contributing/add-package-registry.md b/docs/contributing/add-package-registry.md similarity index 100% rename from docs/guides/contributing/add-package-registry.md rename to docs/contributing/add-package-registry.md diff --git a/docs/guides/contributing/releasing.md b/docs/contributing/releasing.md similarity index 77% rename from docs/guides/contributing/releasing.md rename to docs/contributing/releasing.md index f0f5b03..bbf9345 100644 --- a/docs/guides/contributing/releasing.md +++ b/docs/contributing/releasing.md @@ -21,14 +21,26 @@ The release workflow will automatically: - `ghcr.io/modelcontextprotocol/registry:X.Y.Z` - Specific release version (note: no 'v' prefix) - Binaries can be downloaded from the GitHub release page -**Note:** Releases do not automatically deploy to production. To deploy a release to production: +## Deploying to Production + +Releases do not automatically deploy to production. To deploy a release: 1. Update `mcp-registry:imageTag` in `deploy/Pulumi.gcpProd.yaml` to the desired version (e.g., `1.2.3` - note: no 'v' prefix) -2. Commit and push the change to the `main` branch +2. Commit and push the change to the `main` branch (either through a PR or by pushing directly to main) 3. The [deploy-production.yml](../../../.github/workflows/deploy-production.yml) workflow will automatically trigger and deploy the specified version See the [deployment documentation](../../../deploy/README.md) for more details. +## Staging + +Staging auto-deploys from `main` via [deploy-staging.yml](../../../.github/workflows/deploy-staging.yml). It always runs the latest `main` branch code. + +## Rollback + +To rollback production, update `deploy/Pulumi.gcpProd.yaml` to the previous version and push. + +**Note:** Rollbacks may not work as expected if the release included database migrations, since migrations are not automatically reversed. + ## Docker Image Tags The registry publishes different Docker image tags for different use cases: diff --git a/docs/explanations/design-principles.md b/docs/design/design-principles.md similarity index 100% rename from docs/explanations/design-principles.md rename to docs/design/design-principles.md diff --git a/docs/explanations/dev-summit-2025-05-registry-goals-presentation.pdf b/docs/design/dev-summit-2025-05-registry-goals-presentation.pdf similarity index 100% rename from docs/explanations/dev-summit-2025-05-registry-goals-presentation.pdf rename to docs/design/dev-summit-2025-05-registry-goals-presentation.pdf diff --git a/docs/explanations/dev-summit-2025-10-registry-status-presentation.pdf b/docs/design/dev-summit-2025-10-registry-status-presentation.pdf similarity index 100% rename from docs/explanations/dev-summit-2025-10-registry-status-presentation.pdf rename to docs/design/dev-summit-2025-10-registry-status-presentation.pdf diff --git a/docs/explanations/ecosystem-diagram.excalidraw.svg b/docs/design/ecosystem-diagram.excalidraw.svg similarity index 100% rename from docs/explanations/ecosystem-diagram.excalidraw.svg rename to docs/design/ecosystem-diagram.excalidraw.svg diff --git a/docs/explanations/ecosystem-vision.md b/docs/design/ecosystem-vision.md similarity index 100% rename from docs/explanations/ecosystem-vision.md rename to docs/design/ecosystem-vision.md diff --git a/docs/explanations/roadmap.md b/docs/design/roadmap.md similarity index 100% rename from docs/explanations/roadmap.md rename to docs/design/roadmap.md diff --git a/docs/explanations/tech-architecture.md b/docs/design/tech-architecture.md similarity index 100% rename from docs/explanations/tech-architecture.md rename to docs/design/tech-architecture.md diff --git a/docs/explanations/README.md b/docs/explanations/README.md deleted file mode 100644 index 7d97439..0000000 --- a/docs/explanations/README.md +++ /dev/null @@ -1,10 +0,0 @@ -# Explanations - -Understanding-oriented documentation that clarifies and illuminates the MCP Registry. - -- [Design principles](design-principles.md) -- [Ecosystem vision](ecosystem-vision.md) -- [Roadmap](roadmap.md) -- [Tech architecture](tech-architecture.md) -- [Namespacing](namespacing.md) -- [Versioning](versioning.md) diff --git a/docs/explanations/namespacing.md b/docs/explanations/namespacing.md deleted file mode 100644 index a470d32..0000000 --- a/docs/explanations/namespacing.md +++ /dev/null @@ -1,45 +0,0 @@ -# Namespacing and Security - -Namespacing prevents name squatting, makes impersonation and typo squatting much harder, and provides attribution through domain-based identity. - -For practical steps on how to authenticate for different namespaces, see the [publishing guide](../guides/publishing/publish-server.md#authenticate). - -## Namespace Format - -All server names follow reverse-DNS format. Examples: -- `io.github.alice/weather-server` - GitHub user `alice` -- `com.acme/internal-tool` - Company domain `acme.com` -- `org.nonprofit.research/data-analyzer` - Subdomain `research.nonprofit.org` - -## Security Model - -### Ownership Verification - -Publishing to a namespace requires proving you control the corresponding identity: - -**GitHub namespaces** (`io.github.*`): -- OAuth login to GitHub account/organization -- OIDC tokens in GitHub Actions workflows - -**Domain namespaces** (`com.company.*`): -- DNS verification: TXT record at `company.com` -- HTTP verification: File at `https://company.com/.well-known/mcp-registry-auth` - -## Namespace Scoping - -Different authentication methods grant different namespace access: - -**GitHub OAuth/OIDC**: -- `io.github.username/*` (for personal accounts) -- `io.github.orgname/*` (for organizations) - -**DNS verification**: -- `com.domain/*` and `com.domain.*/*` (domain + all subdomains) - -**HTTP verification**: -- `com.domain/*` only (exact domain, no subdomains) - -## Limitations - -**Domain ownership changes**: If someone loses/sells a domain, they lose publishing rights. Similarly if someone gains a domain, they gain publishing rights. -**Package validation**: Registry validates namespace ownership, but actual packages may still be malicious etc. diff --git a/docs/explanations/versioning.md b/docs/explanations/versioning.md deleted file mode 100644 index be92f05..0000000 --- a/docs/explanations/versioning.md +++ /dev/null @@ -1,231 +0,0 @@ -# Server Versioning Guide - -This document describes the versioning approach for MCP servers published to the registry. - -## Overview - -The MCP Registry supports flexible versioning while encouraging semantic versioning best practices. The registry attempts to parse versions as semantic versions for ordering and comparison, but falls back gracefully for non-semantic versions. - -## Version Requirements - -1. **Version String**: `version` MUST be a string up to 255 characters -2. **Uniqueness**: Each version for a given server name must be unique -3. **Immutability**: Once published, version metadata cannot be changed - -## Best Practices - -### 1. Use Semantic Versioning -Server authors SHOULD use [semantic versions](https://semver.org/) following the `MAJOR.MINOR.PATCH` format: - -```json -{ - "version": "1.2.3" -} -``` - -### 2. Align with Package Versions -Server authors SHOULD use versions aligned with their underlying packages to reduce confusion: - -```json -{ - "version": "1.2.3", - "packages": [{ - "registry_name": "npm", - "name": "@myorg/my-server", - "version": "1.2.3" - }] -} -``` - -### 3. Multiple Registry Versions -If server authors expect to have multiple registry versions for the same package version, they SHOULD follow the semantic version spec using the prerelease label: - -```json -{ - "version": "1.2.3-1", - "packages": [{ - "registry_name": "npm", - "name": "@myorg/my-server", - "version": "1.2.3" - }] -} -``` - -**Note**: According to semantic versioning, `1.2.3-1` is considered lower than `1.2.3`, so if you expect to need a `1.2.3-1`, you should publish that before `1.2.3`. - -## Version Ordering and "Latest" Determination - -### For Semantic Versions -The registry attempts to parse versions as semantic versions. If successful, it uses semantic version comparison rules to determine: -- Version ordering in lists -- Which version is marked as `isLatest` - -### For Non-Semantic Versions -If version parsing as semantic version fails: -- The registry will always mark the version as latest (overriding any previous version) -- Clients should fall back to using publish timestamp for ordering - -**Important Note**: This behavior means that for servers with mixed semantic and non-semantic versions, the `isLatest` flag may not align with the total ordering. A non-semantic version published after semantic versions will be marked as latest, even if semantic versions are considered "higher" in the ordering. - -## Implementation Details - -### Registry Behavior -1. **Validation**: Versions are validated for uniqueness within a server name -2. **Parsing**: The registry attempts to parse each version as semantic version -3. **Comparison**: Uses semantic version rules when possible, falls back to timestamp -4. **Latest Flag**: The `isLatest` field is set based on the comparison results - -### Client Recommendations -Registry clients SHOULD: -1. Attempt to interpret versions as semantic versions when possible -2. Use the following ordering rules: - - If one version is marked as isLatest: it is later - - If both versions are valid semver: use semver comparison - - If neither are valid semver: use publish timestamp - - If one is semver and one is not: semver version is considered higher - -## Examples - -### Valid Semantic Versions -```javascript -"1.0.0" // Basic semantic version -"2.1.3-alpha" // Prerelease version -"1.0.0-beta.1" // Prerelease with numeric suffix -"3.0.0-rc.2" // Release candidate -``` - -### Non-Semantic Versions (Allowed) -```javascript -"v1.0" // Version with prefix -"2021.03.15" // Date-based versioning -``` - -### Not Allowed: Version Ranges -The registry requires specific versions for both the top-level `version` and any `packages[].version`. Version ranges or wildcard versions are rejected during publish, including but not limited to: - -```javascript -"^1.2.3" -"~1.2.3" -">=1.2.3" -"<=1.2.3" -">1.2.3" -"<1.2.3" -"1.x" -"1.2.*" -"1 - 2" -"1.2 || 1.3" -``` - -### Alignment Examples -```json -{ - "version": "1.2.3-1", - "packages": [{ - "registry_name": "npm", - "name": "@myorg/k8s-server", - "version": "1.2.3" - }] -} -``` - -## Migration Path - -Existing servers with non-semantic versions will continue to work without changes. However, to benefit from proper version ordering, server maintainers are encouraged to: - -1. Adopt semantic versioning for new releases -2. Consider the ordering implications when transitioning from non-semantic to semantic versions -3. Use prerelease labels for registry-specific versioning needs - -## Common Scenarios - -### Standard Releases -**Package and server versions aligned**: -```json -{ - "version": "1.2.3", - "packages": [ - { - "registryType": "npm", - "identifier": "@myorg/server", - "version": "1.2.3" - } - ] -} -``` - -### Registry-Only Updates -**Server metadata changes without package updates**: -```json -{ - "version": "1.2.3-1", - "packages": [ - { - "registryType": "npm", - "identifier": "@myorg/server", - "version": "1.2.3" - } - ] -} -``` - -Note: `1.2.3-1` is considered lower than `1.2.3` in semver ordering. Publish prerelease versions first. - -### Remote Server Versioning -**Remote servers without package dependencies**: -```json -{ - "version": "2.1.0", - "remotes": [ - { - "transport_type": "sse", - "url": "https://api.myservice.com/mcp/v2.1" - } - ] -} -``` - -Version strategy options: -- **API versioning**: Match your service API version -- **Semantic versioning**: Standard semver for feature changes -- **Date-based**: `2024.03.15` for regular releases - -### Multi-Package Versioning -**Different package versions**: -```json -{ - "version": "1.3.0", - "packages": [ - { - "registryType": "npm", - "identifier": "@myorg/server", - "version": "1.3.0" - }, - { - "registryType": "oci", - "identifier": "myorg/server", - "version": "1.2.5" - } - ] -} -``` - -Use server version to indicate the overall release. - -## Decision Guide - -**Which version strategy should I use?** - -``` -Do you have underlying packages? -├─ Yes: Align with package version -│ ├─ Same package version → Use package version -│ └─ Different package versions → Use highest + indicate relationship -└─ No (remote server): Choose versioning scheme - ├─ API versioning → Match service API version - ├─ Feature-based → Use semantic versioning - └─ Regular releases → Consider date-based versioning -``` - -## Future Considerations - -This versioning approach is designed to be compatible with potential future changes to the MCP specification's `Implementation.version` field. Any SHOULD requirements introduced here may be proposed as updates to the specification through the SEP (Specification Enhancement Proposal) process. \ No newline at end of file diff --git a/docs/guides/README.md b/docs/guides/README.md deleted file mode 100644 index a3ad40c..0000000 --- a/docs/guides/README.md +++ /dev/null @@ -1,21 +0,0 @@ -# How-To Guides - -Problem-oriented guides for specific tasks with the MCP Registry. - -## Publishing Servers - -- [Publish a server](publishing/publish-server.md) -- [GitHub Actions](publishing/github-actions.md) - -## Consuming Registry Data - -- [Use the REST API](consuming/use-rest-api.md) - -## Contributing - -- [Add package registry](contributing/add-package-registry.md) - -## Administration - -- [Admin operations](administration/admin-operations.md) -- [Moderation guidelines](administration/moderation-guidelines.md) \ No newline at end of file diff --git a/docs/guides/administration/moderation-guidelines.md b/docs/guides/administration/moderation-guidelines.md deleted file mode 100644 index 1c20814..0000000 --- a/docs/guides/administration/moderation-guidelines.md +++ /dev/null @@ -1,60 +0,0 @@ -# Moderation Guidelines - -Guidelines for server publishers on the Official MCP Registry. - -## TL;DR - -We're quite permissive! We only remove illegal content, malware, spam and completely broken servers. - -We don't make guarantees about our moderation, and subregistries should take our data "as is", assuming minimal to no moderation. - -## Scope - -These guidelines apply to the **Official MCP Registry** at `registry.modelcontextprotocol.io`. - -Subregistries may have their own moderation policies. If you have questions about content on a specific subregistry, please contact them directly. - -## Disclaimer - -We have limited active moderation capabilities, and this is a community supported projects. We largely rely on upstream package registries (like NPM, PyPi, and Docker) or downstream subregistries (like the GitHub MCP Registry) to do more in-depth moderation. - -This means there may be content in the registry that should be removed under these guidelines, which we haven't yet removed. You should treat registry data accordingly. - -## What We Remove - -We'll remove servers that contain: - -- Illegal content, which includes obscene content, copyright violations, and hacking tools -- Malware, regardless of intentions -- Spam, especially mass-created servers that disrupt the registry. Examples: - - The same server being submitted multiple times under different names. - - The server doesn't do anything but provide a fixed response with some marketing copy. - - The server description is stuffed with marketing copy, and its implementation is unrelated to its name or description. -- Non-functioning servers - -## What We Don't Remove - -Generally, we believe in keeping the registry open and pushing moderation to subregistries. We therefore **won't** remove servers that are: - -- Low quality or buggy servers -- Servers with security vulnerabilities -- Do the same thing as other servers -- Provide or contain adult content - -## How Removal Works - -When we remove a server: - -- It's set to "deleted" status but remains accessible via the API -- This allows subregistries to remove it from their indexes -- In extreme cases, we may overwrite or erase details of a server, e.g. where the metadata itself is unlawful - -## Appeals - -Think we made a mistake? Open an issue on our [GitHub repository](https://github.com/modelcontextprotocol/registry) with: -- The ID and name of your server -- Why you believe it doesn't meet the criteria for removal above - -## Changes to this policy - -We're still learning how to best run the MCP registry! As such, we might end up changing this policy in the future. diff --git a/docs/guides/administration/releases.md b/docs/guides/administration/releases.md deleted file mode 100644 index 7f3af2e..0000000 --- a/docs/guides/administration/releases.md +++ /dev/null @@ -1,28 +0,0 @@ -# Releases - -## Creating a Release - -1. Create a new release on [GitHub](https://github.com/modelcontextprotocol/registry/releases) with a semver tag (e.g., `v1.3.9`) -2. This triggers the [release workflow](.github/workflows/release.yml) which: - - Builds `registry` and `mcp-publisher` binaries for all platforms using GoReleaser - - Signs artifacts with cosign - - Generates SBOMs - - Builds and pushes container images to `ghcr.io/modelcontextprotocol/registry` - -## Deploying to Production - -1. Update `deploy/Pulumi.gcpProd.yaml` (e.g., through a PR or by pushing directly to main): - ```yaml - mcp-registry:imageTag: 1.3.9 - ``` -2. The [deploy-production workflow](.github/workflows/deploy-production.yml) automatically deploys - -## Staging - -Staging auto-deploys from `main` via [deploy-staging.yml](.github/workflows/deploy-staging.yml). It always runs the latest `main` branch code. - -## Rollback - -To rollback production, update `deploy/Pulumi.gcpProd.yaml` to the previous version and push. - -**Note:** Rollbacks may not work as expected if the release included database migrations, since migrations are not automatically reversed. diff --git a/docs/guides/consuming/use-rest-api.md b/docs/guides/consuming/use-rest-api.md deleted file mode 100644 index 1198808..0000000 --- a/docs/guides/consuming/use-rest-api.md +++ /dev/null @@ -1,112 +0,0 @@ -# Consuming Registry Data via REST API - -Integration patterns and best practices for building applications that consume MCP registry data. - -## Key details - -**Base URL**: `https://registry.modelcontextprotocol.io` - -**Authentication**: Not required for read-only access - -**API Versions**: -- `/v0/` - Development version with latest features (may receive breaking changes) -- `/v0.1/` - Stable version (only backward-compatible changes) - -**Recommendation**: Use `/v0.1/` for production applications requiring API stability. Both versions currently have identical functionality. -We may add breaking changes _only_ to `/v0/` in the future, and we reserve the possibility of deprecating `/v0/` entirely. - -**Core endpoints:** -- **`GET /v0.1/servers`** - List all servers with pagination -- **`GET /v0.1/servers/{serverName}/versions`** - List all versions of a server -- **`GET /v0.1/servers/{serverName}/versions/{version}`** - Get specific version of server. Use the special version `latest` to get the latest version. - -Server names and version strings should be URL-encoded in paths. - -See the [interactive API documentation](https://registry.modelcontextprotocol.io/docs) for complete request/response schemas. - -**Disclaimer**: The official registry provides no uptime or data durability guarantees. You should design your applications to handle service downtime via caching. - -## Building a subregistry -**Create enhanced registries** - ETL official registry data and add your own metadata like ratings, security scans, or compatibility info. - -For now we recommend scraping the `GET /v0/servers` endpoint on some regular basis. In the future we might provide a filter for updatedAt ([#291](https://github.com/modelcontextprotocol/registry/issues/291)) to get only recently changed servers. - -### Pagination Example - -The API uses cursor-based pagination. Here's how to fetch all servers: - -```bash -# Initial request -curl "https://registry.modelcontextprotocol.io/v0/servers?limit=100" -``` - -```json -{ - "servers": [...], - "metadata": { - "count": 100, - "nextCursor": "com.example/my-server:1.0.0" - } -} -``` - -```bash -# Next page using cursor -curl "https://registry.modelcontextprotocol.io/v0/servers?limit=100&cursor=com.example%2Fmy-server%3A1.0.0" -``` - -**Important**: Always URL-encode cursor values when using them in query parameters. - -Servers are generally immutable, except for the `status` field which can be updated to `deleted` (among other states). For these packages, we recommend you also update the status field to `deleted` or remove the package from your registry quickly. This is because this status generally indicates it has violated our permissive [moderation guidelines](../administration/moderation-guidelines.md), suggesting it is illegal, malware or spam. - -### Filtering & Enhancement - -The official registry has a [permissive moderation policy](../administration/moderation-guidelines.md), so you may want to implement your own filtering on top of registry data. - -You can also add custom metadata to servers using the `_meta` field. For example, user ratings, download counts, or security scan results. If you do this, we recommend you put this under a key that is namespaced to your organization, for example: - -```json -{ - "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", - "name": "io.github.yourname/weather-server", - "description": "MCP server for weather data access", - "status": "active", - "version": "1.0.0", - "packages": [ - { - "registryType": "npm", - "identifier": "weather-mcp-server", - "version": "1.0.0" - } - ], - "_meta": { - "com.example.subregistry/custom": { - "user_rating": 4.5, - "download_count": 12345, - "security_scan": { - "last_scanned": "2024-06-01T12:00:00Z", - "vulnerabilities_found": 0 - } - } - } -} -``` - -### Providing an API - -We recommend that your subregistry provides an API meeting the registry API specification, so it's easy for clients to switch between registries. See the [registry API documentation](../../reference/api/) for details. - -## MCP Client Integration -**Convert registry data to client configuration** - Fetch servers and transform package information into your MCP client's config format. - -We highly recommend using a subregistry rather than fetching data from the official registry directly. You might want to make this configurable so that users of your client can choose their preferred registry, for example we expect that some enterprise users may have their own registry. - -Your client should gracefully handle registries that meet the minimum spec, i.e. avoid hard dependencies on `_meta` fields. - -### Filtering - -You likely should filter out servers that are not `active` in the `status` field. - -### Running servers - -You can use the `packages` or `remotes` field to determine how to run a server. More details of these fields are in the [server.json documentation](../../reference/server-json/generic-server-json.md). diff --git a/docs/guides/publishing/github-actions.md b/docs/guides/publishing/github-actions.md deleted file mode 100644 index 61889a9..0000000 --- a/docs/guides/publishing/github-actions.md +++ /dev/null @@ -1,152 +0,0 @@ -# Automate Publishing with GitHub Actions - -Set up automated MCP server publishing using GitHub Actions. - -## What You'll Learn - -By the end of this tutorial, you'll have: - -- A GitHub Actions workflow that automatically publishes your server -- Understanding of GitHub OIDC authentication -- Knowledge of best practices for automated publishing -- Working examples for Node.js, Python, and Docker projects - -## Prerequisites - -- Understand general publishing requirements like package verification (see the [publishing guide](publish-server.md)) -- GitHub repository with your MCP server code - -## GitHub Actions Setup - -### Step 1: Create Workflow File - -Create `.github/workflows/publish-mcp.yml`. Here's an example for NPM-based packages, but the MCP registry publishing steps are the same for all package types: - -```yaml -name: Publish to MCP Registry - -on: - push: - tags: ["v*"] # Triggers on version tags like v1.0.0 - -jobs: - publish: - runs-on: ubuntu-latest - permissions: - id-token: write # Required for OIDC authentication - contents: read - - steps: - - name: Checkout code - uses: actions/checkout@v5 - - - name: Setup Node.js # Adjust for your language - uses: actions/setup-node@v5 - with: - node-version: "lts/*" - - - name: Install dependencies - run: npm ci - - - name: Run tests - run: npm run test --if-present - - - name: Build package - run: npm run build --if-present - - - name: Publish to npm - run: npm publish - env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} - - - name: Install MCP Publisher - run: | - curl -L "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_$(uname -s | tr '[:upper:]' '[:lower:]')_$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/').tar.gz" | tar xz mcp-publisher - - - name: Login to MCP Registry - run: ./mcp-publisher login github-oidc - - - name: Publish to MCP Registry - run: ./mcp-publisher publish -``` - -### Step 2: Configure Secrets - -You don't need any secrets for publishing to the MCP Registry using GitHub OIDC. - -However you might need to add secrets for your package registry. For example the workflow above needs a `NPM_TOKEN` (which you can add in Settings → Secrets and variables → Actions). - -### Step 3: Tag and Release - -Create a version tag to trigger the workflow: - -```bash -git tag v1.0.0 -git push origin v1.0.0 -``` - -The workflow runs tests, builds your package, publishes to npm, and publishes to the MCP Registry. - -## Authentication Methods - -### GitHub Actions OIDC (Recommended) - -```yaml -- name: Login to MCP Registry - run: mcp-publisher login github-oidc -``` - -### GitHub Personal Access Token - -You can authenticate using a GitHub Personal Access Token in two ways: - -**Option 1: Using the --token flag** - -```yaml -- name: Login to MCP Registry - run: mcp-publisher login github --token ${{ secrets.MCP_GITHUB_TOKEN }} -``` - -**Option 2: Using environment variable** - -```yaml -- name: Login to MCP Registry - run: mcp-publisher login github - env: - MCP_GITHUB_TOKEN: ${{ secrets.MCP_GITHUB_TOKEN }} -``` - -**Note:** You must create a custom secret `MCP_GITHUB_TOKEN` with a GitHub Personal Access Token that has `read:org` and `read:user` scopes. The automatic `GITHUB_TOKEN` provided by GitHub Actions does not have these permissions and cannot be used. - -### DNS Authentication - -For custom domain namespaces (`com.yourcompany/*`): - -```yaml -- name: Login to MCP Registry - run: | - echo "${{ secrets.MCP_PRIVATE_KEY }}" > key.pem - mcp-publisher login dns --domain yourcompany.com --private-key-file key.pem -``` - -Add your Ed25519 private key as `MCP_PRIVATE_KEY` secret. - -## Examples - -See these real-world examples of automated publishing workflows: -- [NPM, Docker and MCPB](https://github.com/domdomegg/airtable-mcp-server) -- [NuGet](https://github.com/domdomegg/time-mcp-nuget) -- [PyPI](https://github.com/domdomegg/time-mcp-pypi) - -## Tips - -You can keep your package version and server.json version in sync automatically with something like: -```yaml -- run: | - VERSION=${GITHUB_REF#refs/tags/v} - jq --arg v "$VERSION" '.version = $v' server.json > tmp && mv tmp server.json -``` - -## Troubleshooting -- **"Authentication failed"**: Ensure `id-token: write` permission is set for OIDC, or check secrets -- **"Package validation failed"**: Verify your package published to your registry (NPM, PyPi etc.) successfully first, and that you have done the necessary validation steps in the [Publishing Tutorial](publish-server.md) diff --git a/docs/guides/publishing/publish-server.md b/docs/guides/publishing/publish-server.md deleted file mode 100644 index ea0ebab..0000000 --- a/docs/guides/publishing/publish-server.md +++ /dev/null @@ -1,525 +0,0 @@ -# Publish Your MCP Server - -Complete guide to publishing an MCP server to the registry. - -> [!TIP] -> Using an agentic AI coding assistant? Just use this prompt: -> ``` -> Read https://raw.githubusercontent.com/modelcontextprotocol/registry/refs/heads/main/docs/guides/publishing/publish-server.md and https://raw.githubusercontent.com/modelcontextprotocol/registry/refs/heads/main/docs/guides/publishing/github-actions.md. Evaluate the best way to publish this server to the registry (prefer automated CI flows over manual flows where possible), and implement that. If possible, validate the server.json against the $schema before telling the user you are done, using a proper json schema library or tool available on the user's machine. If you get stuck, guide the user through the parts of the publishing process they need to do (e.g. logging into the publisher CLI if doing manual pubishing). -> ``` - -## What You'll Learn - -By the end of this tutorial, you'll have: -- Created a server.json file for your MCP server -- Authenticated with the registry -- Successfully published your server -- Verified your server appears in the registry - -## Prerequisites - -- An MCP server you've already built ([follow this guide if you don't have one already](https://modelcontextprotocol.io/quickstart/server)) -- Your server must be publicly accessible (closed source servers are welcome, but private/internal servers are not supported) - -## Deployment Options - -You can make your MCP server available in multiple ways: - -- **📦 Package deployment**: Published to registries (npm, PyPI, NuGet, Docker Hub, etc.) and run locally by clients -- **🌐 Remote deployment**: Hosted as a web service that clients connect to directly -- **🔄 Hybrid deployment**: Offer both package and remote options for maximum flexibility - -Learn more about [MCP server architecture](https://modelcontextprotocol.io/docs/learn/architecture) in the official docs. - -## Step 1: Install the Publisher CLI - -
-🍺 macOS/Linux/WSL: With Homebrew (recommended) - -Requires [Homebrew](https://brew.sh): - -```bash -brew install mcp-publisher -``` - -
- -
-⬇️ macOS/Linux/WSL: Pre-built binaries - -```bash -curl -L "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_$(uname -s | tr '[:upper:]' '[:lower:]')_$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/').tar.gz" | tar xz mcp-publisher && sudo mv mcp-publisher /usr/local/bin/ -``` - -
- -
-🏗️ macOS/Linux/WSL: From source - -Requires Git, Make and Go 1.24+: - -```bash -# Clone the registry repository -git clone https://github.com/modelcontextprotocol/registry -cd registry -make publisher - -# The binary will be at bin/mcp-publisher -export PATH=$PATH:$(pwd)/bin -``` - -
- -
-🪟 Windows PowerShell: Pre-built binaries - -```powershell -$arch = if ([System.Runtime.InteropServices.RuntimeInformation]::ProcessArchitecture -eq "Arm64") { "arm64" } else { "amd64" }; Invoke-WebRequest -Uri "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_windows_$arch.tar.gz" -OutFile "mcp-publisher.tar.gz"; tar xf mcp-publisher.tar.gz mcp-publisher.exe; rm mcp-publisher.tar.gz -# Move mcp-publisher.exe to a directory in your PATH -``` - -
- -## Step 2: Initialize Your server.json - -Navigate to your server's directory and create a template: - -```bash -cd /path/to/your/mcp-server -mcp-publisher init -``` - -This creates a `server.json` with auto-detected values. You'll see something like: - -```json -{ - "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", - "name": "io.github.yourname/weather-data-mcp", - "title": "Weather Data", - "description": "Access real-time weather data and forecasts", - "version": "1.0.0", - "packages": [ - { - "registryType": "npm", - "identifier": "@yourname/weather-data-mcp", - "version": "1.0.0", - "transport": { - "type": "stdio" - } - } - ] -} -``` - -## Step 3: Configure Your Server Details - -Edit the generated `server.json`: - -### Choose Your Namespace - -The `name` field determines authentication requirements: - -- **`io.github.yourname/*`** - Requires GitHub authentication -- **`com.yourcompany/*`** - Requires DNS or HTTP domain verification - -### Configure Deployment Methods - -Configure your server to support packages, remotes, or both: - -#### Package Deployment - -Add package validation metadata to prove ownership of your packages. - - -
-📦 NPM Packages - -### Requirements -Add an `mcpName` field to your `package.json`: - -```json -{ - "name": "your-npm-package", - "version": "1.0.0", - "mcpName": "io.github.username/server-name" -} -``` - -### How It Works -- Registry fetches `https://registry.npmjs.org/your-npm-package` -- Checks that `mcpName` field matches your server name -- Fails if field is missing or doesn't match - -### Example server.json -```json -{ - "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", - "name": "io.github.username/slack-integration-mcp", - "title": "Slack Integration", - "description": "Send messages and manage Slack workspaces", - "version": "1.0.0", - "packages": [ - { - "registryType": "npm", - "identifier": "@username/slack-integration-mcp", - "version": "1.0.0", - "transport": { - "type": "stdio" - } - } - ] -} -``` - -The official MCP registry currently only supports the NPM public registry (`https://registry.npmjs.org`). - -
- -
-🐍 PyPI Packages - -### Requirements -Include your server name in your package README file using this format: - -**MCP name format**: `mcp-name: io.github.username/server-name` - -Add it to your README.md file (which becomes the package description on PyPI). This can be in a comment if you want to hide it from display elsewhere. - -### How It Works -- Registry fetches `https://pypi.org/pypi/your-package/json` -- Passes if `mcp-name: server-name` is in the README content - -### Example server.json -```json -{ - "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", - "name": "io.github.username/database-query-mcp", - "title": "Database Query", - "description": "Execute SQL queries and manage database connections", - "version": "1.0.0", - "packages": [ - { - "registryType": "pypi", - "identifier": "database-query-mcp", - "version": "1.0.0", - "transport": { - "type": "stdio" - } - } - ] -} -``` - -The official MCP registry currently only supports the official PyPI registry (`https://pypi.org`). - -
- -
-📋 NuGet Packages - -### Requirements -Include your server name in your package's README using this format: - -**MCP name format**: `mcp-name: io.github.username/server-name` - -Add a README file to your NuGet package that includes the server name. This can be in a comment if you want to hide it from display elsewhere. - -### How It Works -- Registry fetches README from `https://api.nuget.org/v3-flatcontainer/{id}/{version}/readme` -- Passes if `mcp-name: server-name` is found in the README content - -### Example server.json -```json -{ - "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", - "name": "io.github.username/azure-devops-mcp", - "title": "Azure DevOps", - "description": "Manage Azure DevOps work items and pipelines", - "version": "1.0.0", - "packages": [ - { - "registryType": "nuget", - "identifier": "Username.AzureDevOpsMcp", - "version": "1.0.0", - "transport": { - "type": "stdio" - } - } - ] -} -``` - -The official MCP registry currently only supports the official NuGet registry (`https://api.nuget.org`). - -
- -
-🐳 Docker/OCI Images - -### Requirements -Add an annotation to your Docker image: - -```dockerfile -LABEL io.modelcontextprotocol.server.name="io.github.username/server-name" -``` - -### How It Works -- Registry authenticates with container registries using token-based authentication: - - **Docker Hub**: Uses `auth.docker.io` token service - - **GitHub Container Registry**: Uses `ghcr.io` token service -- Fetches image manifest using Docker Registry v2 API -- Checks that `io.modelcontextprotocol.server.name` annotation matches your server name -- Fails if annotation is missing or doesn't match - -### Example server.json (Docker Hub) -```json -{ - "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", - "name": "io.github.username/kubernetes-manager-mcp", - "title": "Kubernetes Manager", - "description": "Deploy and manage Kubernetes resources", - "version": "1.0.0", - "packages": [ - { - "registryType": "oci", - "identifier": "docker.io/yourusername/kubernetes-manager-mcp:1.0.0", - "transport": { - "type": "stdio" - } - } - ] -} -``` - -### Example server.json (GitHub Container Registry) -```json -{ - "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", - "name": "io.github.username/git-operations-mcp", - "title": "Git Operations", - "description": "Advanced Git repository management and operations", - "version": "1.0.0", - "packages": [ - { - "registryType": "oci", - "identifier": "ghcr.io/username/git-operations-mcp:1.0.0", - "transport": { - "type": "stdio" - } - } - ] -} -``` - -The identifier format is `registry/namespace/repository:tag` (e.g., `docker.io/user/app:1.0.0` or `ghcr.io/user/app:1.0.0`). The version can also be specified as a digest. - -The official MCP registry supports: -- Docker Hub (`docker.io`) -- GitHub Container Registry (`ghcr.io`) -- Google Artifact Registry (any `*.pkg.dev` domain) -- Azure Container Registry (`*.azurecr.io`) -- Microsoft Container Registry (`mcr.microsoft.com`) - -
- -
-📁 MCPB Packages - -### Requirements -**MCP reference** - MCPB package URLs must contain "mcp" somewhere within them, to ensure the correct artifact has been uploaded. This may be with the `.mcpb` extension or in the name of your repository. - -**File integrity** - MCPB packages must include a SHA-256 hash for file integrity verification. This is required at publish time and MCP clients will validate this hash before installation. - -### How to Generate File Hashes -Calculate the SHA-256 hash of your MCPB file: - -```bash -openssl dgst -sha256 server.mcpb -``` - -### Example server.json -```json -{ - "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", - "name": "io.github.username/image-processor-mcp", - "title": "Image Processor", - "description": "Process and transform images with various filters", - "version": "1.0.0", - "packages": [ - { - "registryType": "mcpb", - "identifier": "https://github.com/username/image-processor-mcp/releases/download/v1.0.0/image-processor.mcpb", - "fileSha256": "fe333e598595000ae021bd27117db32ec69af6987f507ba7a63c90638ff633ce", - "transport": { - "type": "stdio" - } - } - ] -} -``` - -### File Hash Validation -- **Authors** are responsible for generating correct SHA-256 hashes when creating server.json -- **MCP clients** validate the hash before installing packages to ensure file integrity -- **The official registry** stores hashes but does not validate them -- **Subregistries** may choose to implement their own validation. This enables them to perform security scanning on MCPB files, and ensure clients get the same security scanned content. - -The official MCP registry currently only supports artifacts hosted on GitHub or GitLab releases. - -
- -#### Remote Deployment - -Add the `remotes` field to your `server.json` (can coexist with `packages`): - -
-🌐 Remote Server Configuration - -### Requirements - -- **Service endpoint**: Your MCP server must be accessible at the specified URL -- **Transport protocol**: Choose from `streamable-http` (recommended) or `sse` (deprecated) -- **URL validation**: For domain namespaces only (see URL requirements below) - -### Example server.json - -```json -{ - "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", - "name": "com.yourcompany/acme-analytics", - "title": "ACME Analytics", - "description": "Real-time business intelligence and reporting platform", - "version": "2.0.0", - "remotes": [ - { - "type": "streamable-http", - "url": "https://mcp.yourcompany.com/mcp" - } - ] -} -``` - -### Multiple Transport Options - -You can offer multiple connection methods: - -```json -{ - "remotes": [ - { - "type": "streamable-http", - "url": "https://mcp.yourcompany.com/mcp" - }, - { - "type": "sse", - "url": "https://mcp.yourcompany.com/sse" - } - ] -} -``` - -### URL Validation Requirements - -- For `com.yourcompany/*` namespaces: URLs must be on `yourcompany.com` or its subdomains -- For `io.github.username/*` namespaces: No URL restrictions (but you must authenticate via GitHub) - -### Authentication Headers (Optional) - -Configure headers that clients should send when connecting: - -```json -{ - "remotes": [ - { - "type": "streamable-http", - "url": "https://mcp.yourcompany.com/mcp", - "headers": [ - { - "name": "X-API-Key", - "description": "API key for authentication", - "isRequired": true, - "isSecret": true - } - ] - } - ] -} -``` - -
- -## Step 4: Authenticate - -Choose your authentication method based on your namespace: - -### GitHub Authentication (for io.github.* namespaces) - -```bash -mcp-publisher login github -``` - -This opens your browser for OAuth authentication. - -### DNS Authentication (for custom domains) - -```bash -# Generate keypair -openssl genpkey -algorithm Ed25519 -out key.pem - -# Get public key for DNS record -echo "yourcompany.com. IN TXT \"v=MCPv1; k=ed25519; p=$(openssl pkey -in key.pem -pubout -outform DER | tail -c 32 | base64)\"" - -# Add the TXT record to your DNS, then login -mcp-publisher login dns --domain yourcompany.com --private-key $(openssl pkey -in key.pem -noout -text | grep -A3 "priv:" | tail -n +2 | tr -d ' :\n') -``` - -The ECDSA P-384 algorithm is also supported, along with HTTP-based authentication. See the [publisher CLI commands reference](../../reference/cli/commands.md) for more details. - -## Step 5: Publish Your Server - -With authentication complete, publish your server: - -```bash -mcp-publisher publish -``` - -You'll see output like: -``` -✓ Successfully published -``` - -## Step 6: Verify Publication - -Check that your server appears in the registry by searching for it: - -```bash -curl "https://registry.modelcontextprotocol.io/v0/servers?search=io.github.yourname/weather-server" -``` - -You should see your server metadata returned in the JSON response. - -## Troubleshooting - -**"Package validation failed"** - Ensure your package includes the required validation metadata (mcpName field, README mention, or Docker label). - -**"Authentication failed"** - Verify you've correctly set up DNS records or are logged into the right GitHub account. - -**"Namespace not authorized"** - Your authentication method doesn't match your chosen namespace format. - -## Examples - -See these real-world examples of published servers: -- [NPM, Docker and MCPB example](https://github.com/domdomegg/airtable-mcp-server) -- [NuGet example](https://github.com/domdomegg/time-mcp-nuget) -- [PyPI example](https://github.com/domdomegg/time-mcp-pypi) - -## Next Steps - -- **Update your server**: Publish new versions with updated server.json files -- **Set up CI/CD**: Automate publishing with [GitHub Actions](github-actions.md) -- **Learn more**: Understand [server.json format](../../reference/server-json/generic-server-json.md) in depth -- **More examples**: See [remote server configurations](../../reference/server-json/generic-server-json.md#remote-server-example) and [hybrid deployments](../../reference/server-json/generic-server-json.md#server-with-remote-and-package-options) in the schema documentation - -## What You've Accomplished - -You've successfully published your first MCP server to the registry! Your server is now discoverable by MCP clients and can be installed by users worldwide. diff --git a/docs/modelcontextprotocol-io/about.mdx b/docs/modelcontextprotocol-io/about.mdx new file mode 100644 index 0000000..d93adf1 --- /dev/null +++ b/docs/modelcontextprotocol-io/about.mdx @@ -0,0 +1,89 @@ +--- +title: The MCP Registry +sidebarTitle: About +--- + +The MCP Registry is the official centralized metadata repository for publicly accessible MCP servers, backed by major trusted contributors to the MCP ecosystem such as Anthropic, GitHub, PulseMCP, and Microsoft. + +The MCP Registry provides: + +- A single place for server creators to publish metadata about their servers +- Namespace management through DNS verification +- A REST API for MCP clients and aggregators to discover available servers +- Standardized installation and configuration information + +Server metadata is stored in a standardized [`server.json` format](https://github.com/modelcontextprotocol/registry/blob/main/docs/reference/server-json/server.schema.json), which contains: + +- The server's unique name (e.g., `io.github.user/server-name`) +- Where to locate the server (e.g., npm package name, remote server URL) +- Execution instructions (e.g., command-line args, env vars) +- Other discovery data (e.g., description, server capabilities) + +## The MCP Registry Ecosystem + +The MCP Registry is part of an ecosystem that looks something like: + +![The MCP Registry ecosystem](./ecosystem-diagram.excalidraw.svg) + +### Relationship with Package Registries + +Package registries — such as npm, PyPI, and Docker Hub — host packages with code and binaries. + +The MCP Registry hosts metadata that points to those packages. + +For example, a `weather-mcp` package could be hosted on npm, and metadata in the MCP Registry could map the "weather v1.2.0" server to `npm:weather-mcp`. + +The [Package Types guide](./package-types.mdx) lists the supported package types and registries. More package registries may be supported in the future based on community demand. If you are interested in building support for a package registry, please [open an issue](https://github.com/modelcontextprotocol/registry). + +### Relationship with Server Developers + +The MCP Registry supports both open-source and closed-source servers. Server developers can publish their server's metadata to the registry as long as the server's installation method is publicly available (e.g., an npm package or a Docker image on a public registry) _or_ the server itself is publicly accessible (e.g., a remote server that is not restricted to private networks). + +The MCP Registry **does not** support private servers. Private servers are those that are only accessible to a narrow set of users. For example, servers published on a private network (like `mcp.acme-corp.internal`) or on private package registries (e.g. `npx -y @acme/mcp --registry https://artifactory.acme-corp.internal/npm`). If you want to publish private servers, we recommend that you host your own private MCP registry and add them there. + +### Relationship with Downstream Aggregators + +The MCP Registry is intended to be consumed primarily by downstream aggregators, such as MCP server marketplaces. + +The metadata hosted by the MCP Registry is deliberately unopinionated. Downstream aggregators can provide curation or additional metadata such as community ratings. + +We expect that downstream aggregators will use the MCP Registry API to pull new metadata on a regular but infrequent basis (for example, once per hour). See the [MCP Registry Aggregators guide](./registry-aggregators.mdx) for more information. + +### Relationship with Other MCP Registries + +In addition to a public REST API, the MCP Registry defines an [OpenAPI spec](https://github.com/modelcontextprotocol/registry/blob/main/docs/reference/api/openapi.yaml) that other MCP registries can implement in order to provide a standardized interface for MCP host applications. + +We expect that many downstream aggregators will implement this interface. Private MCP registries can implement it as well to benefit from existing host application support. + +Note that the official MCP Registry codebase is **not** designed for self-hosting, and the registry maintainers cannot provide support for this use case. If you choose to fork it, you would need to maintain and operate it independently. + +### Relationship with MCP Host Applications + +The MCP Registry is not intended to be directly consumed by host applications. Instead, host applications should consume other MCP registries, such as downstream marketplaces, via a REST API conforming to the official MCP Registry's OpenAPI spec. + +## Trust and Security + +### Verifying Server Authenticity + +The MCP Registry uses namespace authentication to ensure that servers come from their claimed sources. Server names follow a reverse DNS format (like `io.github.username/server` or `com.example/server`) that ties them to verified GitHub accounts or domains. + +This namespace system ensures that only the legitimate owner of a GitHub account or domain can publish servers under that namespace, providing trust and accountability in the ecosystem. For details on authentication methods, see the [Authentication guide](./authentication.mdx). + +### Security Scanning + +The MCP Registry delegates security scanning to: + +- **Underlying package registries** — npm, PyPI, Docker Hub, and other package registries perform their own security scanning and vulnerability detection. +- **Downstream aggregators** — MCP Registry aggregators and marketplaces can implement additional security checks, ratings, or curation. + +The MCP Registry focuses on namespace authentication and metadata hosting, while relying on the broader ecosystem for security scanning of actual server code. + +### Spam Prevention + +The MCP Registry uses multiple mechanisms to prevent spam: + +- **Namespace authentication requirements** — Publishers must verify ownership of their namespace through GitHub, DNS, or HTTP challenges, preventing arbitrary spam submissions. +- **Character limits and validation** — Free-form fields have strict character limits and regex validation to prevent abuse. +- **Manual takedown** — The registry maintainers can manually remove spam or malicious servers. See the [Moderation Policy](./moderation-policy.mdx) for details on what content is removed. + +Future spam prevention measures under consideration include stricter rate limiting, AI-based spam detection, and community reporting capabilities. diff --git a/docs/modelcontextprotocol-io/authentication.mdx b/docs/modelcontextprotocol-io/authentication.mdx new file mode 100644 index 0000000..cadae54 --- /dev/null +++ b/docs/modelcontextprotocol-io/authentication.mdx @@ -0,0 +1,290 @@ +--- +title: How to Authenticate When Publishing to the Official MCP Registry +sidebarTitle: Authentication +--- + +You must authenticate before publishing to the official MCP Registry. The MCP Registry supports different authentication methods. Which authentication method you choose determines the namespace of your server's name. + +If you choose GitHub-based authentication, your server's name in `server.json` **MUST** be of the form `io.github.username/*` (or `io.github.orgname/*`). For example, `io.github.alice/weather-server`. + +If you choose domain-based authentication, your server's name in `server.json` **MUST** be of the form `com.example.*/*`, where `com.example` is the reverse-DNS form of your domain name. For example, `io.modelcontextprotocol/everything`. + +| Authentication | Name Format | Example Name | +| -------------- | ----------------------------------------------- | ------------------------------------ | +| GitHub-based | `io.github.username/*` or `io.github.orgname/*` | `io.github.alice/weather-server` | +| domain-based | `com.example.*/*` | `io.modelcontextprotocol/everything` | + +## GitHub Authentication + +GitHub authentication uses an OAuth flow initiated by the `mcp-publisher` CLI tool. + +To perform GitHub authentication, navigate to your server project directory and run: + +```bash +mcp-publisher login github +``` + +You should see output like: + +```text Output +Logging in with github... + +To authenticate, please: +1. Go to: https://github.com/login/device +2. Enter code: ABCD-1234 +3. Authorize this application +Waiting for authorization... +``` + +Visit the link, follow the prompts, and enter the authorization code that was printed in the terminal (e.g., `ABCD-1234` in the above output). Once complete, go back to the terminal, and you should see output like: + +```text Output +Successfully authenticated! +✓ Successfully logged in +``` + +## DNS Authentication + +DNS authentication is a domain-based authentication method that relies on a DNS TXT record. + +To perform DNS authentication using the `mcp-publisher` CLI tool, run the following commands in your server project directory to generate a TXT record based on a public/private key pair: + + + +```bash Ed25519 +MY_DOMAIN="example.com" + +# Generate public/private key pair using Ed25519 +openssl genpkey -algorithm Ed25519 -out key.pem + +# Generate TXT record +PUBLIC_KEY="$(openssl pkey -in key.pem -pubout -outform DER | tail -c 32 | base64)" +echo "${MY_DOMAIN}. IN TXT \"v=MCPv1; k=ed25519; p=${PUBLIC_KEY}\"" +``` + +```bash ECDSA P-384 +MY_DOMAIN="example.com" + +# Generate public/private key pair using ECDSA P-384 +openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:secp384r1 -out key.pem + +# Generate TXT record +PUBLIC_KEY="$(openssl ec -in key.pem -text -noout -conv_form compressed | grep -A4 "pub:" | tail -n +2 | tr -d ' :\n' | xxd -r -p | base64)" +echo "${MY_DOMAIN}. IN TXT \"v=MCPv1; k=ecdsap384; p=${PUBLIC_KEY}\"" +``` + +```bash Google KMS +MY_DOMAIN="example.com" +MY_PROJECT="myproject" +MY_KEYRING="mykeyring" +MY_KEY_NAME="mykey" + +# Log in using gcloud CLI (https://cloud.google.com/sdk/docs/install) +gcloud auth login + +# Set default project +gcloud config set project "${MY_PROJECT}" + +# Create a keyring in your project +gcloud kms keyrings create "${MY_KEYRING}" --location global + +# Create an Ed25519 signing key +gcloud kms keys create "${MY_KEY_NAME}" --default-algorithm=ec-sign-ed25519 --purpose=asymmetric-signing --keyring="${MY_KEYRING}" --location=global + +# Enable Application Default Credentials (ADC) so the publisher tool can sign +gcloud auth application-default login + +# Attempt login to show the public key +mcp-publisher login dns google-kms --domain="${MY_DOMAIN}" --resource="projects/${MY_PROJECT}/locations/global/keyRings/${MY_KEYRING}/cryptoKeys/${MY_KEY_NAME}/cryptoKeyVersions/1" + +# Copy the "Expected proof record": +# ${MY_DOMAIN}. IN TXT "v=MCPv1; k=ed25519; p=${PUBLIC_KEY}" +``` + +```bash Azure Key Vault +MY_DOMAIN="example.com" +MY_SUBSCRIPTION="subscription name or ID" +MY_RESOURCE_GROUP="MyResourceGroup" +MY_KEY_VAULT="MyKeyVault" +MY_KEY_NAME="MyKey" + +# Log in using Azure CLI (https://learn.microsoft.com/en-us/cli/azure/install-azure-cli) +az login + +# Set default subscription +az account set --subscription "${MY_SUBSCRIPTION}" + +# Create a resource group +az group create --location westus --resource-group "${MY_RESOURCE_GROUP}" + +# Create a key vault +az keyvault create --name "${MY_KEY_VAULT}" --location westus --resource-group "${MY_RESOURCE_GROUP}" + +# Create an ECDSA P-384 signing key +az keyvault key create --name "${MY_KEY_NAME}" --vault-name "${MY_KEY_VAULT}" --curve P-384 + +# Attempt login to show the public key +mcp-publisher login dns azure-key-vault --domain="${MY_DOMAIN}" --vault "${MY_KEY_VAULT}" --key "${MY_KEY_NAME}" + +# Copy the "Expected proof record": +# ${MY_DOMAIN}. IN TXT "v=MCPv1; k=ecdsap384; p=${PUBLIC_KEY}" +``` + + + +Then add the TXT record using your DNS provider's control panel. It may take several minutes for the TXT record to propagate. After the TXT record has propagated, log in using the `mcp-publisher login` command: + + + +```bash Ed25519 +MY_DOMAIN="example.com" + +PRIVATE_KEY="$(openssl pkey -in key.pem -noout -text | grep -A3 "priv:" | tail -n +2 | tr -d ' :\n')" +mcp-publisher login dns --domain "${MY_DOMAIN}" --private-key "${PRIVATE_KEY}" +``` + +```bash ECDSA P-384 +MY_DOMAIN="example.com" + +PRIVATE_KEY="$(openssl ec -in key.pem -noout -text | grep -A4 "priv:" | tail -n +2 | tr -d ' :\n')" +mcp-publisher login dns --domain "${MY_DOMAIN}" --private-key "${PRIVATE_KEY}" +``` + +```bash Google KMS +MY_DOMAIN="example.com" +MY_PROJECT="myproject" +MY_KEYRING="mykeyring" +MY_KEY_NAME="mykey" + +mcp-publisher login dns google-kms --domain="${MY_DOMAIN}" --resource="projects/${MY_PROJECT}/locations/global/keyRings/${MY_KEYRING}/cryptoKeys/${MY_KEY_NAME}/cryptoKeyVersions/1" +``` + +```bash Azure Key Vault +MY_DOMAIN="example.com" +MY_KEY_VAULT="MyKeyVault" +MY_KEY_NAME="MyKey" + +mcp-publisher login dns azure-key-vault --domain="${MY_DOMAIN}" --vault "${MY_KEY_VAULT}" --key "${MY_KEY_NAME}" +``` + + + +## HTTP Authentication + +HTTP authentication is a domain-based authentication method that relies on a `/.well-known/mcp-registry-auth` file hosted on your domain. For example, `https://example.com/.well-known/mcp-registry-auth`. + +To perform HTTP authentication using the `mcp-publisher` CLI tool, run the following commands in your server project directory to generate an `mcp-registry-auth` file based on a public/private key pair: + + + +```bash Ed25519 +# Generate public/private key pair using Ed25519 +openssl genpkey -algorithm Ed25519 -out key.pem + +# Generate mcp-registry-auth file +PUBLIC_KEY="$(openssl pkey -in key.pem -pubout -outform DER | tail -c 32 | base64)" +echo "v=MCPv1; k=ed25519; p=${PUBLIC_KEY}" > mcp-registry-auth +``` + +```bash ECDSA P-384 +# Generate public/private key pair using ECDSA P-384 +openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:secp384r1 -out key.pem + +# Generate mcp-registry-auth file +PUBLIC_KEY="$(openssl ec -in key.pem -text -noout -conv_form compressed | grep -A4 "pub:" | tail -n +2 | tr -d ' :\n' | xxd -r -p | base64)" +echo "v=MCPv1; k=ecdsap384; p=${PUBLIC_KEY}" > mcp-registry-auth +``` + +```bash Google KMS +MY_DOMAIN="example.com" +MY_PROJECT="myproject" +MY_KEYRING="mykeyring" +MY_KEY_NAME="mykey" + +# Log in using gcloud CLI (https://cloud.google.com/sdk/docs/install) +gcloud auth login + +# Set default project +gcloud config set project "${MY_PROJECT}" + +# Create a keyring in your project +gcloud kms keyrings create "${MY_KEYRING}" --location global + +# Create an Ed25519 signing key +gcloud kms keys create "${MY_KEY_NAME}" --default-algorithm=ec-sign-ed25519 --purpose=asymmetric-signing --keyring="${MY_KEYRING}" --location=global + +# Enable Application Default Credentials (ADC) so the publisher tool can sign +gcloud auth application-default login + +# Attempt login to show the public key +mcp-publisher login http google-kms --domain="${MY_DOMAIN}" --resource="projects/${MY_PROJECT}/locations/global/keyRings/${MY_KEYRING}/cryptoKeys/${MY_KEY_NAME}/cryptoKeyVersions/1" + +# Copy the "Expected proof record" to `./mcp-registry-auth`: +# v=MCPv1; k=ed25519; p=${PUBLIC_KEY} +``` + +```bash Azure Key Vault +MY_DOMAIN="example.com" +MY_SUBSCRIPTION="subscription name or ID" +MY_RESOURCE_GROUP="MyResourceGroup" +MY_KEY_VAULT="MyKeyVault" +MY_KEY_NAME="MyKey" + +# Log in using Azure CLI (https://learn.microsoft.com/en-us/cli/azure/install-azure-cli) +az login + +# Set default subscription +az account set --subscription "${MY_SUBSCRIPTION}" + +# Create a resource group +az group create --location westus --resource-group "${MY_RESOURCE_GROUP}" + +# Create a key vault +az keyvault create --name "${MY_KEY_VAULT}" --location westus --resource-group "${MY_RESOURCE_GROUP}" + +# Create an ECDSA P-384 signing key +az keyvault key create --name "${MY_KEY_NAME}" --vault-name "${MY_KEY_VAULT}" --curve P-384 + +# Attempt login to show the public key +mcp-publisher login http azure-key-vault --domain="${MY_DOMAIN}" --vault "${MY_KEY_VAULT}" --key "${MY_KEY_NAME}" + +# Copy the "Expected proof record" to `./mcp-registry-auth`: +# v=MCPv1; k=ecdsap384; p=${PUBLIC_KEY} +``` + + + +Then host the `mcp-registry-auth` file at `/.well-known/mcp-registry-auth` on your domain. After the file is hosted, log in using the `mcp-publisher login` command: + + + +```bash Ed25519 +MY_DOMAIN="example.com" +PRIVATE_KEY="$(openssl pkey -in key.pem -noout -text | grep -A3 "priv:" | tail -n +2 | tr -d ' :\n')" +mcp-publisher login http --domain "${MY_DOMAIN}" --private-key "${PRIVATE_KEY}" +``` + +```bash ECDSA P-384 +MY_DOMAIN="example.com" +PRIVATE_KEY="$(openssl ec -in key.pem -noout -text | grep -A4 "priv:" | tail -n +2 | tr -d ' :\n')" +mcp-publisher login http --domain "${MY_DOMAIN}" --private-key "${PRIVATE_KEY}" +``` + +```bash Google KMS +MY_DOMAIN="example.com" +MY_PROJECT="myproject" +MY_KEYRING="mykeyring" +MY_KEY_NAME="mykey" + +mcp-publisher login http google-kms --domain="${MY_DOMAIN}" --resource="projects/${MY_PROJECT}/locations/global/keyRings/${MY_KEYRING}/cryptoKeys/${MY_KEY_NAME}/cryptoKeyVersions/1" +``` + +```bash Azure Key Vault +MY_DOMAIN="example.com" +MY_KEY_VAULT="MyKeyVault" +MY_KEY_NAME="MyKey" + +mcp-publisher login http azure-key-vault --domain="${MY_DOMAIN}" --vault "${MY_KEY_VAULT}" --key "${MY_KEY_NAME}" +``` + + diff --git a/docs/modelcontextprotocol-io/ecosystem-diagram.excalidraw.svg b/docs/modelcontextprotocol-io/ecosystem-diagram.excalidraw.svg new file mode 100644 index 0000000..e91ff49 --- /dev/null +++ b/docs/modelcontextprotocol-io/ecosystem-diagram.excalidraw.svg @@ -0,0 +1,4 @@ + + +eyJ2ZXJzaW9uIjoiMSIsImVuY29kaW5nIjoiYnN0cmluZyIsImNvbXByZXNzZWQiOnRydWUsImVuY29kZWQiOiJ4nOy9W5LiSrcm+H5Gkbbrpds4XHSSu8svp59cXFx1MDAxMuJ+XHUwMDExd+hTtk1cYiHuXHUwMDAyXHUwMDA0XGIoO2Y1gX6onkA9dvdcdTAwMTh6Nj2CXHUwMDFhQi8nc2dcdTAwMTBcdTAwMTFcdTAwMTA7cmdEZvx/bf5LZoJcdTAwMTAuaX3f+tby5cv/y798+vTb7rRcdTAwMGV++7dPv1x1MDAwNUffW0xHWy/57V/V+4dgXHUwMDFiT6NcdTAwMTV8hC7/jqP91r9cdTAwMWM52e3W8b9lMlx1MDAwZt9I+9Hyy7eCRbBcZla7XHUwMDE4jvvf4d+fPv2Xy//DJ9OR+u6qKlCzUTWPXHUwMDFkN5I5RtCuZY4vX71cdTAwMWP0x2C2gb/zVuFcInj46KhGXCKQkaZcdTAwMDbhmGqCYf7tw1x1MDAxM3z4mWAtjTTOkcBCXHUwMDE3hFx1MDAxYd8+Tqaj3UR932BpRFxmjWLCXHUwMDE503Xy7YhJMFxyJzs4RDdEmlODXHUwMDBioiFN6JTRb8d8XHUwMDE50L990r69XHUwMDEz77bRPLCiRbRVo/5PgYZ1rD+Meej583BcdTAwMWLtV6OHY8ZjX/ji4ZjxdLFo7k6XM8NNhlx1MDAxYvrbk/N3v46ePHn/3rfgXHUwMDA3w8kqiNVD0L+9XHUwMDFirT1/ulM3StdcdTAwMWWuQI1uXVx1MDAxOF2e139+XHUwMDE409ZbXHUwMDA2XHUwMDA19cBW+8Xi29vT1ShQj+G3oe49+rnV6OvPPTo8XHUwMDBlXHUwMDAydVxuQrnBXHUwMDA0x1x1MDAwZo/jwbSo9vTNarS6WFx1MDAxOdFcdTAwMTmluoFcdTAwMWW+NY1tsK7d5Zxjb1x1MDAxMVx1MDAwN1x1MDAwZrdZjSB7ZXlcdTAwMGZXsl+PvC9f0ZlBXHUwMDExXFw6J1xm42+fL6ar+dNxL1wif/7wK5d3/+NfXHUwMDFmXHUwMDFi81x1MDAwYnb6cHGYibtXh3RKmEb1W/d2+NsrrvlcdTAwMGKceK/pdVdi4YR7OeCnWlx1MDAwM3OyvGNbXHUwMDEzz5/st8E969LfwbqeI+ZcdTAwMWKKXHShXHUwMDE4XHUwMDE5XHUwMDFhYjp9XG5jxNNcXDdcZo6x0OAv9MnAvlx1MDAwYm67rbeK195cdTAwMTYs4+G4azqghqZcdTAwMGJcclx1MDAwYlx1MDAwM/CuP1x1MDAxONtcdTAwMTVcdTAwMWawNEOU61x1MDAxY3NgXHJKnpq3YIxrRDf4X8PUXfQ8M+qvXHUwMDFmPFjhI0vcXHUwMDA1x4crvLKQ6lwiKo3lJlx1MDAxYWxcZt6WeFx1MDAxMvinjfnbt+P+419vn/bLlz9cdTAwMDch06xOpz+e1KNTa780+rP241/54/e97TZKXnteVGH2Z3M++f2oW+uQ1vflwKRvcN7WyEOlz3UrV/s8jUZWdfx5nFx1MDAxY9/gvEN0XHUwMDE2JGfp9Y5zilx1MDAxYuViUyvlXHUwMDA3b3BeXFxcdTAwMGW0Vr657tOgujpcdTAwMTiOXHUwMDFkXG6t+brzfv3bXHUwMDBiTKdzgelcdTAwMDN4fpDpXHUwMDFl2dc1yVH89N0/SE5HXGJhTXD94YgrlvNfz3K3bfjDs1x1MDAxY9PSmDLgOHhcdTAwMTQ6Y49ZXHUwMDBlXHSaXHUwMDA2rcKAfzSGgVx1MDAxMp9697ejOVx1MDAxMDFprjFcdTAwMTBNRMdcdTAwMTdcdTAwMTZ7TnPoStR84TVcdTAwMDTyyNCJuFx1MDAxMknvRGx/ZsPGd9jww6ii1a45PV/skD561/GW04V6XHUwMDA2XHUwMDBm571cdTAwMTg33MbaeDz1p97iU8Wqf2pcdTAwMDThXHUwMDE0XHUwMDFlxem3R4fJxTRUdv+bXHUwMDBmw1x1MDAwZraPILGbgiD+dsAw2u2iK2fsw29701WwLbzGdUfbaThdeYvW64bm7XdRI4i/XFzwbrtcdTAwMGau71mQ/+bN0sj4XHUwMDAxQYPRPawzXHUwMDFkMYNp5EquPUB99Hqoryt+5I9InWvRvthOgqZTWVx1MDAxND861LEhcJpcIlAsgGVcblx1MDAxMvNcdNZcdNbhY9BcdTAwMGVUMEFccsbvY11cdTAwMGbUf36xpNFcdIKxXHUwMDFhVPxcIk3zVSRUnbgtu1x1MDAxM16vVGfNSdXUNvvdbed4we8/qab5XHUwMDAxjfBLNM1cdTAwMGZosD/XNPBcdTAwMDIgvb+m4U/f/YPnqFx1MDAwMVx1MDAxMCbGXHUwMDE1wq94Lng9z71s3Fx1MDAxZpXnqCbSRFxiTWe6yrA8VTQ8XHJcdTAwMWZxxFxyQeFcYsKeXGbsXHJZXHUwMDBlXHUwMDAySGA4rlOdYlx1MDAwM4uHOPtcdTAwMDVBXHUwMDAz16dzylx1MDAxZsTAz5cz322+PyZn2mCa28VpulxuP8FTnnth8Gn7RTlMg/idZM2fOPCnsuaVQ/wp8oaIu/JcdTAwMDZcdTAwMDS8oVGmXVnaXHUwMDE17sevx31nn6OrXZ5cdTAwMTi9aCxcdTAwMTe/d3dGglx1MDAxNlx1MDAxZlx1MDAxZPeIIZ5GXHUwMDFh1lx1MDAxMIFcdTAwMTeEXHUwMDEzT4Cv07SKXHUwMDE0mM5ATmj0XHUwMDFkcf9KdWNwiD01XHUwMDE4KOBccl/lj75cdTAwMTKBwSjjguBfKm/MYJEzO+Zoka2F06g06O7D3Fx1MDAxZD/5XHUwMDEx5E1cdTAwMTEl8bglo1x1MDAxYdFCR4aTfVBvLt/gvLLS/t2rls6rUfR57uZX7dLsyN/gvEk1XHUwMDExXqHTLIeemysmZr/qlt5C3vyAzPtzefNzUjaA1PthnGboXHUwMDE0POotmlx1MDAwYl9Pcy9cdTAwMWL3h6U5StKXbI2hMd0wjCc8x3FaYMxcZt1cdTAwMDD60LSrWYS35jnQKWlNNzhcdTAwMTU6XHUwMDAxxXCD5W7kayDsNDSB+INcdTAwMTP7p1x1MDAxNzhytZtso/XU/1x1MDAxOVx0mz9x3U+VzZ+N7VdLXHUwMDFhTFx1MDAxMFx1MDAwMU/KbkJ98nqoXHUwMDEze75I9lx1MDAwYr09W01qcWLnXHUwMDE2m0Lno0NcdTAwMWRrmKR1XHUwMDAzQ0TDXHUwMDAwZZg8mNxXSYPSXHUwMDE461xiIziCYKa/XHUwMDFm1t9G02BdwzqM9y/O7L6NpGlLXHUwMDExckpcdTAwMWJccltj2Xjbn1xy+5/7XHUwMDFmV9LUjKS3O3W3/fPYT0TQXFz1XHUwMDA2efJrMytcdTAwMWZFXCJcdTAwMTj63VlcdTAwMWSEXHQ2KL1cdTAwMWRcdE1fz1x1MDAxYi9cdTAwMWLLh+Vccq6lOSOgXHUwMDAxdM5ccvQ008tEXHUwMDFhnLCmI1x1MDAxZDhcdTAwMDVr7P7c9Vx1MDAwZktcdTAwMDTQKlxiyFx1MDAwYlx1MDAwMlOBkE5cdTAwMWWu51x1MDAwNY2AMVx1MDAxMZhcdTAwMWLvz1x1MDAxMlx1MDAxZkdcIuSmu/x++DP0wZ84wqf64MWB/Vx1MDAxNHFgiLtpTp1cIsRcYoTIN+dzZq9HOdtNt1x1MDAxNTTPlYLPuOFokbCzePvhUVx1MDAwZdooreZqXGbMsKHxZ5lOnaRcdOBcXMlcdTAwMDfMkPj10zl/kvDAXHUwMDFjwzmI8e5TuS+5xdiZ1Ki1XHUwMDFiyO4xa1wi1lx1MDAxN1VzNPu46qDb5ZbZa4h8RcqjXGIqi+H+9+Tvmo9L1d5VscJTdaBxQlxygrSbNVx1MDAxZvPXXHUwMDEzx8vW8mGJg1x1MDAwMVx1MDAxNlxyQ0fUYKBcdTAwMTWMXHUwMDA3uH7JIOhpeEBcXFx1MDAwN21AXHUwMDE5iPX3I1x1MDAwZZ2ztMBcdTAwMDYnhFx1MDAwMfA1IW6Uuj7XXHUwMDA3XHUwMDAyXHUwMDA0hVDVr//z6IPK1N9GcTTe/VxmifAn3vCpRPizsf1cdTAwMTSVoGvG3TJW3Vx1MDAwMKhcdTAwMWKGhm5cdTAwMDZcdTAwMDOL16NcdTAwMWTvx1xyvbKr13bjijdcdTAwMTjb9c2Ujz482jVccqUxZ1x1MDAxY+hOMKo9ziEgmiYgXHUwMDBlXHUwMDAw6Vx1MDAxYUeYiatMzMdUXHRMZ1x1MDAxYf3Vs1wiLVx1MDAxNNudqndCXHUwMDBihvTzYVmdSSo+rkh4r1mR90pNxPZh8Tu3aktr315cdTAwMTfMzrDm0+FcdTAwMWKc11+ua7Qw/NxrzOdmVZrxZ9Y5vYVYMl1z0Vxmw8KyXkqmk+FkYJSDNzjvWc+FpmduybZh9U+thuU3p+wtUj/NPVx1MDAxYlxyk/7Kj0pl1GiYcrHtvJW4+znFL7rO7+Z+hGEwxjG+uWxh+Xq6f1x1MDAxOeVcdTAwMWaW7nU9rUhcdTAwMTJpXHUwMDA2ucqPXb6NRVx1MDAxYcQ3oSBcdTAwMDBcckRcYn6/xFx1MDAwZsI8LVx1MDAwNDwkXHUwMDE1mWo6oTeqeckzZWfojGhcdTAwMTjhX1nM+5OVXVZptfV2XHUwMDFhXHUwMDA3n6xou04/XHUwMDEyUf+++l+8T8Pp7tNiOlx1MDAwZj5cdTAwMTWdbVx1MDAxNH6SIObGnr+Ltqf/9Z1cdTAwMDTgn+icp1x1MDAwMvCNLuHn6ERG7kaFXHUwMDEwmGKE+LWSvFwijtXricPpXHKamPdrsWz2spN5c573pvyjXHUwMDEzXHUwMDA34lx1MDAwMvRcdTAwMTlcIlxiwivMjVx1MDAwN1x1MDAxZHiRiVx1MDAxMFx1MDAxM1xuiLqAVjVKMb+qoP6gMpGoXHUwMDE5XHUwMDAwLH5pLmlgYVxcXHUwMDFjuHjaavFt0aafVyXtTnLmb5n4cWTie1x1MDAxNfv8gPz8c9mFKcb0XHUwMDAxtO8lu5h4tkD2IVx1MDAxYk+EWlwihG9WXHUwMDFkR6+nz5dh81HpUzCRxrqqVyA60OeTbDzRSdqgwGpqYS8lhL9cdTAwMWaBXG6SRkyH56BhXHUwMDAzc/Boz/nzeU6NXHUwMDExgyNcdTAwMWSRX1l3jHWOvist/GPKy1p4+5GSLKPgnXTUn+iApzrq5oB+jirCV/b9XHUwMDE01jrBgmqY3Fxmp9avh/WZdZfbYbDV5sM55vR3p9TMXHUwMDE3Pjqssc5YXHUwMDFhXHUwMDFiyFx1MDAxMFx1MDAwNlx1MDAxN4hcdTAwMWGPUa1kXHUwMDExJoaOXHUwMDE5XHUwMDAyXHUwMDAyRvo7xlNvooqoyuZz8WtV0YZcdTAwMWN439DOu1x1MDAxZVx1MDAxYmy6/WGJSXP/tyr66Kro3WZcdTAwMWH/evLsXHUwMDE1quh7XcpfU0XYuFujXHUwMDAwYFx1MDAxNDBcYqbdXGYqN6+nz5dh81HpXHUwMDEzMVAjgjGNMU5cYnoqinBcdTAwMWFIXHUwMDE1XHUwMDFiXGazR0mXt2ZPitPMXHUwMDEwglKq61x1MDAxY+ziVUvLdY6pgCf3S0uVf7Im6jTfU1x1MDAwZv2JXHUwMDAyeKqHnlxy5idpIaY/fftbZlx1MDAxOTRcdTAwMDBcdTAwMTGU36w32r5cdTAwMWXLu8K8fmqivSnX+5rfknZ72st9eCxcdTAwMTOlL1x1MDAxOGNcdTAwMDJCXHUwMDE4XePG4+Sy0kKazqghQCWBSHk/NL9RuVx1MDAxMTUo1oWB3lx1MDAxZN4veb98fv37mmy2+7qRXHUwMDFmXGbrg3yWx9rfYuiji6FcdTAwMWaYmfswooXguzxHXHRTeeCbXHUwMDExX/x6mnvZuD8qzVx1MDAxOVRP64Rcbl0jmsGu01l/aFx1MDAxNkNwzkBcdTAwMWHoQD7vVy9haGlDXHUwMDA3glx1MDAxMlx1MDAxYaE6Ml5XO62KKOHBkvdntY8jWqz9No6276RZ/sRVP8vhPFx1MDAxOcvPkSzXxvE0/uBKYJPbLW92r8cyyXvl0iCmXHRcdTAwMGJLm+22XHUwMDFkXHUwMDE4h9L5o2NcdTAwMTlRVVx1MDAwMy1AsHCMXHUwMDFll1x1MDAxNn9L38DbiILdalxc++jLp3SBhWBcdTAwMTT92lxuae1ztbe1eak+33T6dYZcbmxTzv0tWT66ZHmvpebvWkz0k6RcdTAwMTDVXyhcdTAwMTWnXGKB078thvavJ9CXYfNRXHSUaVwiXHLqg+qYclxyQr/HMd8lgVx1MDAwM1RcdTAwMDVqXHRhjb9jT1xyytJcdTAwMDSphslcdTAwMTRcdTAwMDJQfF3++ZJcdTAwMThcIkjnQLb/881qpb3pO+mhP9FcdTAwMDG357RcdTAwMWVccuetJNHdvlj8LpiFavik3WlcdTAwMWORvFx1MDAxZcs5XHUwMDE5JlvWq1x1MDAwZkJa4c2dqM4my1x1MDAwZl9cYo6IwFxuRIzrXHUwMDE4XHUwMDE512sxv7T/I0ZatTkmXG7qumDvXHUwMDE32FxilDY0ZKg1abpcdTAwMGX/92DbXHUwMDBmWlxiiFx1MDAwNUbC1PPSOVx1MDAxMfx59z9uqDluXCL+4VeJXG49rTGMmVq/TyCsZI9cdTAwMGV6XHUwMDAx6v/jv/+3//v/+6//x//47//n/3tcdTAwMDfsi2C8e1x1MDAwMeq7aH1cdTAwMGbnj67hKahv/vB7w5qS+1x1MDAwYjxcdTAwMThRs7B3gpzj63Ht2HvXPzRjXHUwMDE2zrtcdTAwMDHTfk+mu2X+w+PaYJeEhVx1MDAwMVhCmvG8rSdPczAuylx1MDAwNSCO4XcsPHlcdTAwMGJcXFx1MDAxYlxiwiP2XHUwMDEzSoDfKVx1MDAxNvlzTfvdq1x1MDAxZt+YNP6v//aLSOPGXHUwMDBmvzdpXHUwMDE4xt3EiE4po1x1MDAwNN1pknl6PWmU6dg+XHUwMDE1pq619Vx1MDAwYuFwVHTMXHUwMDFkn3980sAozTlcdTAwMTdcdTAwMDZIZE75k91ccjBncMupgP9QpIFcdTAwMWN4v9TIm7CGSsVijZBfqvR/uVx1MDAxYfh/fpVcdTAwMWF4/sPvXHJshO63jDIgUNWZuInr8+txLeareJzP5+etYz9Y8FLf77D1h8c14STNMFx1MDAwNSSBNCbscbz+XHUwMDE5MZrWKUT1XHUwMDEwXHUwMDBigGSi7yfydXbZXHUwMDFmhavuXHUwMDE0XHUwMDFj/rjagOGliN1AXHUwMDFh01x1MDAxMPmfaVx1MDAwNZBaLdNcZrZgxZ/s4Fx1MDAxMCyiNdjzz4Xwn1xm4a3A/EUr3UDzdZfmJ2g2OEaUavqt9Fx1MDAxYtJej+aXJd1HRTNV1afK76kyJEDTXHUwMDEzOGNcdTAwMDNidmFcdTAwMTBVlMLIO0p7XHUwMDEw5WlGXHUwMDA1XHUwMDAxZKhccsmul4l/Q7OW1lx1MDAxMYyVc1x1MDAwNlxu3oCjr+aXvyXkOFxcNNbZXHUwMDFiXHUwMDA07Vx1MDAwZrL9XHUwMDBm+0Jf3/mPh8v83k082LVlv1x1MDAxNvXxztvuTDDL6Sp8PLCv+8xcdTAwMTVeXHUwMDExXFxeeMLfx5dcdTAwMWJJXGbONTB8uIucwV+Nq6NCb61cdTAwMDaN01x1MDAxMO1RQ1VcdTAwMTZiwY1cdTAwMDdvdzHmYzCqR9PV7utcdTAwMTU8uzHBavTnXHUwMDAzfnnvj0dcdTAwMDPWwEZBoHHEgb9hWOLZgMGONdCauqFcdTAwMTaXXHT6oMtfNd6FXHUwMDE376xouZzudo+PfPxcdTAwMTCkXCKYSeA9M1x1MDAxY7je68+eMtFanfFxVPjwt09cdTAwMGagvPzj29//87/ePPo+Vi5ff46Sh1x1MDAxM/7Lk1x1MDAxM8PzXHUwMDE4RsmPzm7cXymtVkOCr8P8VkJcdTAwMTTpr2dXq2lNcLY658Ptbm7tcUvrNiZcdTAwMWaeXVx1MDAxOVIuS+NqT1x1MDAxNITR0/aaRONpQtRyZFx1MDAwM2KOK1x1MDAxNL69WDJwXHUwMDFhXHUwMDBinTOKlP7B+lxyen2+WlrX1Fx1MDAwNn1cdTAwMTCc/cOnQF8vlpr7IZDAZYVxfFx1MDAxMSzxv6920afD1PtklVx1MDAwYp8yn2S9cEc7/enMx19VT983pndcdTAwMTdThL6wwlx1MDAxOXPMyO1idIRej/eX+4t/XHUwMDE33t9jv9B7rVx1MDAxMdRcdTAwMTRcdTAwMDdcdTAwMTFqkoNcdTAwMGLBnvbLo3qaa1x1MDAxONypWsPH2Fx1MDAwYlx1MDAwNayC6T76XHUwMDAxuFMjrTaAVeSLXHJqkFx1MDAxYtUgmKa/LFx1MDAxNFx1MDAxNFTnmv7wwL5FSlx1MDAwNqdwoqti5Vx1MDAwZiOlQLCL71qL+r1S6tXK5LNcdTAwMDaPXHUwMDE0XHUwMDAxeV9cdTAwMTavQ1iM8NVRX5SJSCNuMFx1MDAwNPdcdTAwMTP+XHUwMDA0hUquz/M2SurlptyPx8soVc3QQPNcdTAwMWJcdTAwMThM5Ln042nD0MEoXHUwMDE4Uk2hr7z7P52S+nxcdTAwMWYo6vVcdTAwMTRcIm+ko+5cdTAwMTIrvr9cdTAwMGYwwpQjwtCtXHQohF/Pqy83Zf6wvEpBvmDOXHUwMDE4SHzteo/ZL7xqiLSu63B/dE3o6Lr27a2JlVx1MDAwMtxcdTAwMDHLWCWtL30qbsmotNqwmVx1MDAxYlTX1EKFq0f2XHUwMDA3s6o0NFxczlx1MDAxNef+zazfjr5cblKBqIgmXGZcdTAwMTXTqZZCz2NU1TNEXHUwMDA1QlxcqLBQo+j6PG/DrC+3M340XqyCalx1MDAxMMtcYqsqXCLyfLwqNWqAMetYyVx1MDAwMKb984aod3GiXs9cdTAwMTHy3sRKnu+6/i39RznTrtNcdTAwMWLXxEpeT6wv97P9sMRq0DTEp1x1MDAwNkhcdTAwMDFccrD2TLBqaVx1MDAwM8JSqnpsgbm+MEf3g7yKdSNccpjBoKFcdTAwMTAjuqHf6NOKeVr1eVeNXHUwMDAyXHUwMDA0uGp0NZo/OjdqXHUwMDFjXHUwMDAy1r9cdTAwMDXry7Sq+JIpgVx1MDAwN9SJyHXy6Fx1MDAwZlrVlE0gTSeCU8RcdTAwMDSi1+d5XHUwMDFiWn25XHUwMDA17KPxMlx1MDAwZaz55Ynr+JF4/pb405naqpVcdTAwMWKg4ij5Pifwj8Sq91Fy+fQpPt6bVXX9/lx1MDAwMi+dXHUwMDE48DRcYr2ZXHUwMDA3MF5Pqy9cdTAwMTfXf1BaXHUwMDA112akMVxcPYawgTxaTnHhVeOyZ1x1MDAwNfCCrpLanLxfXCJcdTAwMDBBfMMwVu35VcueW3lcdTAwMDA1YYtV6bWaXHUwMDBiYkK/KrH+o1x1MDAxMFLNsVxu/VxyXHUwMDFh4r41rWJcdTAwMDHk9J60+uq4XHUwMDFh9Fx1MDAwZdAqcCpcdTAwMDT5oO+uUr3feIqo3aZ1lSNSW7byR1NcdTAwMThvxKov91V8NFxc48KWXHUwMDA0TJBcXFfdX41W7fSp9nhhl7jr+0b7j8SqOiFpwFx1MDAxOYXHorI0XHUwMDAwguuvI4g8VZcrXHUwMDAx8kfDqvzxz853XHUwMDE3c+r1XGZt707S+P5cdTAwMWVGXHUwMDA2QlxiPPzNtuWIvp6kX16p9EFJ+tJ4Sa3f0FxypS509CSroFbHMp3Ak1dcdTAwMGaSvLT05Fx1MDAwN0lcdTAwMWF+XHRcdTAwMTE1x652j4VcdTAwMWY0bohfhlXPXaohQCQysPGMpdVcdTAwMTDhXHUwMDA0XHUwMDFmk6W163afb8/Sr47RP0OQrrxcdTAwMTkoXHUwMDE3uMtAw+i5nFx1MDAwNDJgaksrXHUwMDA0Y4dQXXuHee9X07RcdTAwMWHvXHUwMDA1oVx1MDAwNihxoVx1MDAwMVKfz3vjtKprVFx1MDAwNqojTfxcdTAwMTPz9Of7OFGvZ1xieSNmvVv5i+53cdGwrrI8t2iVvZ5W/YZTO2rnZa6XrdX84qKd64bZjz7nXHIukqV1jYBk1Fx1MDAwNNP44za/n8FW06CLiYroXHUwMDE4p/gp379lg3CaXHUwMDA2W1x1MDAwML+uNuZAV1x0nlx1MDAxN2a8OVU9pIz3r/L9Zpw/e2/lnzydbns779NcdTAwMWHOXHUwMDFljD5N1aR1vFx1MDAxZj7sbP+v/76Ktp98b/VpXHUwMDE4fNrHcMxoqlx1MDAxYVx1MDAxMSz+8s4zf3WK/cfH+e7Lk/DdgmSkY4HubUiA+OtcdTAwMTnnSIWny1x1MDAxZZpcdTAwMTi4XHUwMDFhlnuF/GbcXHUwMDFhf3jGwaDRQVHDXHUwMDFmIOP408a4n7FgaUwpUFx1MDAwMECbP1xucN+YcjhNXHUwMDEzJlx1MDAwNFBcYtBcdTAwMWO63lfwxYYqmkFVOcAv3bP2n4lzXHUwMDFhwTiAXHUwMDA35Fx1MDAwN/eKnN+NRW798lvxwnTphTebsyB2v1x1MDAxY0fFs4JcdTAwMTm3iUG+nlx1MDAxOFx1MDAxMlx1MDAxZTc90v5sXHUwMDE3QWLapbVXXHUwMDFmjORHJ1x1MDAwNsTVTiUg5iFcdTAwMDAx1Lr+J1x1MDAxMZ4ujDRcdTAwMDH0YUNXvVx1MDAwN67TdE+Y4Sbqv3tcdTAwMWRcdTAwMTJLQ+RhgEhcdTAwMTdIu71e4f4hf5DFJVwiNXTtXHUwMDFmc1x1MDAxOVx1MDAxMlx1MDAwNFx1MDAxM7tLYPNb7Fx1MDAxZILHXHUwMDBi2r+M9rdcdTAwMTHwuPDpSFx1MDAxMz7zhzRgXHUwMDFlh/B7PCRjQ1x1MDAxYo/90VhoXHUwMDAx4sOrcDtcdTAwMDbkXHUwMDA2j/jtal71j9rXh8vxt9H6Olx1MDAxY/puvOn0rvBX9TLEuN2+XHUwMDExma+HW26sR79v4knxXFyaT+PGjlxyPPfDr1xmwjriaYOKy9y3wTTyZC2BrtyjpmqkQGUzXGLD76a931x1MDAwNG5cXM10wTBcZk3DXHUwMDA0osJcdTAwMWKp7/uHfKuBU4VSmPN/WrhcdTAwMTHDI5yIMTY0gYAnQVx1MDAxZVxygV1Ggns+UGLA6FgnaEh+XHUwMDFk3Fx1MDAxML+re3VBXHRcdTAwMTaE3167Y71cdTAwMWVvjjeuNJu4OFx0jvVjdXZGXHUwMDFivfDhl+VjgrQ02C7ihGqI6E+Ky3VwJqAsuWouxLmhsXf3bjqAW9XsfLGlm97tziFcdTAwMGb15ipQ135pb8F3hVx1MDAxYid+wKlhMFx1MDAxYVx1MDAxOD5cdTAwMTnTITeM0UhcZvHYXHUwMDE4+yhcYiimYuiP2LvD7W5vXHUwMDFi/MI+XHJUJ4Tc3qdcdTAwMDHZr0fbvr/JJYV2/vz5c65dKM0+jyu68eHRhihKI6yp8kOm5vieoi1NwIVcdTAwMDBcdTAwMWJB/EdcdTAwMTF+x53vdKyKzDHIQ2BuzG74ted5LaRcdTAwMTFcbjQv3r/V+DfbfNvOc89cZv1XXHUwMDA3malP9e30XHUwMDAwQ1DpomBcdTAwMGJB4L+vvi7O+NlR56uG8u6rQthcdTAwMGLFIDpXUy2Y3cyIZ1/PXHUwMDFjL1x1MDAxYtBHZVx1MDAwZVxm5ICEaj1B0KNKw0uLUD1tXHUwMDE4attkXHUwMDEwoVx1MDAwNmaUvl9G3DDSXFwn4GJ0XCIuXHUwMDBiXHUwMDAznzNcdTAwMDcoeI1rhGk609RE2fX6/S9MQlx1MDAwNEPgwd5iSdibXHUwMDE32THM2HvOM77suD49mrdDnGGBXHUwMDExUk+WXHUwMDEw40bx8vX3fnr5hyo/4lx1MDAwNsKUXHUwMDAwb1x1MDAxMnxrWlx1MDAxMd7VqFx1MDAwNiGtXHUwMDA2+DW+c1x1MDAxZfRcdTAwMWZrYvFcdTAwMWUw1Os5JFx1MDAxZc73zCt9z8Ti3YiHiPubveiUQHjGblYrO98hwbLDc9OanHOH6i4vOVx1MDAxZTmH4sfvL0iZllZcdTAwMWIqKGQxwlx1MDAxZUswjHladVxcolQte+bXXHUwMDFksN4j3tGJrmqjXHUwMDE5XHUwMDAwnHF4kVx1MDAxYsl+rKVVV1Oi6VhwVZT5LOBcdTAwMTFIZVx1MDAxZegvTef99f6hr0nnXHUwMDA1fFxisOJDnY5cdTAwMDOOxyPMRKBcdTAwMWIgRD1cdTAwMWbhoY515lx1MDAwN961/P/Z+YXrnaOfd/DimiD8dlx1MDAxNWvu9XCbJpNDVatFxVJ+u/SqnfZ5M1x1MDAwZj463PBlXZVq/qeKKtRmXHUwMDA0j/GmYXByqlx1MDAxMVx1MDAxMFNGfn+fgrdJL2hppipcdTAwMTHVQlx1MDAxZoRccnajROr+Id/SXHUwMDBiWEVB2vvvTver0GboXHUwMDA2+ChcdTAwMWZjT2hcdTAwMWXnXHUwMDFhNlx1MDAwMqzxkVx1MDAwMFx1MDAwZfKw8FRjWl31XHUwMDA2/IXJc+1BSNzoxCM4xuQm2vKvR9uxVWtcdTAwMTj9jcgl1Wg2O1x1MDAxNZsyu3A/OtqQwFwirWlqXHUwMDE3XHUwMDAxtYZB15+BTVx1MDAxNWpcbjVVjIlxv1XE2zg3xtJcdTAwMDZcdTAwMDG3RFxycF5gMjeKZ4RI80v3PlxiarhaTPxcdTAwMTRuXHUwMDAyTFx1MDAxMVx1MDAwYiHeoFwi8a+nXHUwMDFjfmBL5H996bxcdTAwMWarKf33cFx1MDAwNFx1MDAwNOLGXHUwMDEwj4dcdTAwMDRrXHUwMDFlNVx1MDAwMjGmVFx1MDAwZpghsMpcdTAwMTRcdTAwMTNDeEx4I1x1MDAxZI9/XHUwMDFkR1x1MDAxOFdZmKf7XHUwMDA2IVxiP0E03ZxgK7yeXCL82GSDeaO8NOJcdTAwMWQ+TFx1MDAxMp/uzoePTlx1MDAxMcCMXCItVPDNXHJQucaTZSVcdTAwMThcdTAwMDNoNVDHampcclx1MDAxOdetKt+HI3hcdTAwMWGCJUQwUiV2+NZcdTAwMDRcdTAwMWIhaUHUlohcdTAwMWFoQFx1MDAxZOHnXHUwMDE5f0zUiolf247vXeGmIVx1MDAxYWhD6o19QXRcdTAwMWZcdTAwMDfE50PERlx1MDAxZTK8kdBQIFx1MDAxOOVcdTAwMDFQ5S/L+Iu7XHR/sCDGiYFvZu2Kr1x1MDAwN1vP352d+cLx4zXZssNcdTAwMTitI+vjq18qeJqpMFx1MDAxM4ORQPj2XGJrn3XCVJ04V7WiXHUwMDAycSHuYe3H0/06XHUwMDAyXHUwMDEwYVx1MDAwZYNcdTAwMDB1p3Iyz3F2o6qMXG5cZsNcIu9fVfaRUvJLb3X6tIy2wad0Ov3z0/B3fv7de1Czu5Jap+DRde32Tnuo9HpcZmv9fs6sr0ZN81TPyd9cdTAwMGKzsNTpfHhcZjNipHWh9t9Sy9h1/LhcIlx1MDAwNXyP6kGtXHUwMDAzuFx1MDAxMdE/XHUwMDFhgplcdTAwMDZcdTAwMTjCXGL/Slx1MDAwMGNcZp77520t8zpcdTAwMDC/U4vad4fvXHUwMDBi66jRXcGLyWV7b3pcdTAwMTO/5dfjV1bav3vV0nk1ij7P3fyqXZpcdTAwMWT5X8PvT11HjdNcdTAwMWPCSFxu+owyXHI92XlcdTAwMDI+NdRaXHUwMDEyXHUwMDFkM4icXHKIju9j+Ic7qtG0qlx1MDAwNFx1MDAwM8VrIOO64ugh24uEXCJcdTAwMWLQ50zTkYbQszV6XHUwMDEwTmtcdTAwMDI0xUdcXKPHxPvOnX3HSmpEhS4gfoG7bTByRZef/picMtLwxNX+sTBoSvB79P1xeoMm5v1aLJu97GTenOe9Kb8zXlx1MDAwNONkukYoqFx1MDAxZE7ErcY/mCCDYcFcZsKQTv95O6rpyEgjXS3sglx1MDAxOFx1MDAxNaJRg15/XHUwMDFkqUW1VFx1MDAxM0JjhFx1MDAwM7WRPz3dPdip13PAPZzuX56c9m1cdTAwMTZTM3S/063apE4tXHUwMDE0vpmaqHxHqf2L2yh+ZKa+tJdcdTAwMTWcYLVu+lx1MDAxOVMrnoYnSYFpOHlhW4BcdTAwMWYkaqGnwfJcdTAwMTDXVT9cdTAwMDbdIDeKXHUwMDFjMGJqgT7IQjBQoolcdTAwMWJV9oSwN9m3/e1pmlx08Z49xL+nkaSOQbjAiHTVRMJcdTAwMTD4+VpqI22ATcAhXHUwMDFh0YCs0TvUPLy8XeDjXHUwMDAxq0bmYICqm4kw1LBvXHUwMDEwtcBqdlx1MDAxMi5cYuJ6zL9vwP9IRP35LlDU61x1MDAxOUTem1nJ/e1W1IZdXHUwMDEwpOk3ibX6emLtdrll9lx1MDAxYVwiX5HyKILKYrj/PfnoxFxuMSpWy6kxV07T0MhTYtXTwKmUXHUwMDFiqp2/YeD361KhU5LmmKqN6Vx1MDAxOTawcaveXHUwMDAxXHUwMDFjMlx1MDAwN2NRhGCoVojPXG5cdTAwMWXAMWDw52+xvvrNqdUwrtfJvT21vrrlmapcdTAwMWVcdTAwMDNcdTAwMGVSezOBXHUwMDBlVlx1MDAwYumft+dcdTAwMDFm1dSmXHUwMDFkVE3BMyr49XnehlnPrLvcXHUwMDBlg602XHUwMDFmzsHGfndKzXzh3nhVu1x1MDAxYkKEXHUwMDAxelxmXHUwMDFj/I3elygtQCfruuqlXHUwMDBiol5cdTAwMTjf11TuXHUwMDFmilrvQkW9noPk3bmV3K8n03Si6fSquu+aXFxr3zGh9uI860clV9AvaV2tXGZcdTAwMTeEq2VcdTAwMTmP84Pgc9JcdTAwMDbYM1x1MDAwMcvVOHvPXHUwMDE2QDDWNFx1MDAwM1xiwYggctJ0/YZs5SRccpFcdTAwMTNcdTAwMDBIZURcZmI8k61cdTAwMWOQp6tcdTAwMDKKXHUwMDBmSK6UXFz3Q3l7cv2eljpcdTAwMDRcdTAwMDRcdTAwMGbwXHUwMDE13EGkutA+b4DOVGWfusfEoHCgfn3Ez04vqPFSjcN/VSc2XHJcdTAwMDZ8K72AuCriXHUwMDA1dyA0gf55XHUwMDFiYH6+j1x1MDAxM/V6hpD3Zlbjal7laVx1MDAwZiB06fR3u1K3/npifbnQ5ONcdTAwMTKr2iRcdTAwMTBcdLBWQ0NXcyuX73ORpmpeXHUwMDE5Pieqnun9+l+q/cuQastNqapcdTAwMWJmt/pcbnO1P6iKrLEmiE6fp1x1MDAwM1xmiG1cclxiYz/gkodcdTAwMWYqXXhrXqVqXHUwMDBmXGaqU9VxXHUwMDAyXS1Mu1x1MDAxMq1cdTAwMTRRtaVcdTAwMDRRm1dp30lUb55cdTAwMGVgylx1MDAwNIlqXHUwMDBlpYFcdTAwMWPlz9PMXCKtq21SqVx1MDAwMf5fXHTX79u441x1MDAxZopY71x1MDAwM0W9nkHk3YlcdTAwMTXdrUq57J5cdTAwMDNa7WY6wH09sWLTNVx1MDAxN80wLCzrpWQ6XHUwMDE5Tlx1MDAwNkb5L1al/FRi5WlVXHUwMDA3xiB4QGCYj9NcdTAwMDFKserKoonaakYpgvdTrIyk1Vx1MDAwZUFgKYQz+PNWf1x1MDAwNSNccpSANMpcdIQ6XHUwMDFjP1//QFxyYFx1MDAwMmx8yK6VXHUwMDA2vtqh4VdSq9ouQfX8NkBcdTAwMDJcdTAwMDJAr8ojr1x1MDAxNKuOQPrrmtrSR1x1MDAxOO/RW/jV6Vx1MDAwMNU3XHUwMDE1wVCwZnBD6I+o5FuPTVx1MDAwNG5L5atAxYnvXHUwMDE12P9IxHpcdTAwMWYm6vVcZiDvzavXy8Wf8KpcdTAwMWFcdTAwMWJcdTAwMDIxdlOwNl7Pq2c9XHUwMDE3mp65JduG1T+1XHUwMDFhlt+cso/Pq1jF+qpx92XDXHUwMDE5/UkmgPM0U2t3qWqlgdFcdTAwMGJrdH+QVlx009Vu9UxcXKYprna0uWJVVZvPVLdcdTAwMTZVdn/djuFcdTAwMGZWRZqaXHUwMDE2XHUwMDA3gfVcdTAwMDFZ9cNcYlYtrTZjY4qnQLNqjzeM/daxXdeUTcD/1Pac7zB9tSvM66cm2ptyva/5LWm3p73cneFcdTAwMTJMQPhQwlxmwVx0eb5kXHUwMDE3hkvAcsH5XHUwMDEztSus8c8rV++iRL2e4eONSPXuelx1MDAwNSzudz5cdTAwMDAhXHUwMDBiavVOZ87md6jV4qx/ruFOdTjtXHJ3vVqwX4xmXHUwMDFmvv5SUztdqLVcdTAwMDGqu4F23bXuUlx1MDAwMMjTXHUwMDFhXGJcdTAwMDBNXHUwMDE1biGu3c2uvtF6XZbWNEZ1sFx1MDAxYkNcdTAwMTWE3siwUjhEaCBeqIr3XHL9eWFcdTAwMDD4cKzxN2HWj9mgXGJYQ1x1MDAwZvyAkCHTx8GQjUG58Fx1MDAxMaU+9YcjTVx1MDAxYnlcdTAwMDFcdTAwMWR5ni/efbnCXVx0g+73wYVo3SCGrt3e0KD1erS1Rlx1MDAxZSp9rlu52udpNLKq48/j5Pjh0aaiP8x19DXJQp9US4JVpzVcdTAwMGVBhFx1MDAwZVx1MDAwN1xutVHWfVx1MDAxNfODXHUwMDE1z1x1MDAxMHim4eewYFTtgX1rrlh1ttc0tfOCXHUwMDEwaleUq1x1MDAxMPBcdTAwMWLYkNqFiuhcdTAwMWZwPkPnXHUwMDAyv6uM+Z5ccmh1XG5BXHUwMDE0xIeKXHUwMDE4MGfG8/CQp1x1MDAxMSeMMESJar+mfd/c6yMh8/hcdTAwMWH/gTTDXZtUr8/PzfHdVVx1MDAwM7lfS1xiPlNn1/uDXtFY+/U0tt3tV7Nx1lx1MDAxZFvjvlvsu7Xiaul9eFx1MDAxYaO6SHPVeZMheFx1MDAxNlxcPGkjXG5xjYqodVx1MDAxZFx1MDAxYzVXa4/fVTYwnlx1MDAxNlx1MDAxMPZcdTAwMDF4sFx1MDAwMYyJbyzdwGpKilx1MDAxYUioUcHonlx1MDAxMVx1MDAxOdJcZuBmRNmvXFzk+K6qwaBcdTAwMTTB3Vx1MDAxMSOBdDSE/9PHXHUwMDA01ILPR2RM/Fx1MDAxMchcYsZ9Qn/hmuKrXHKsniWUNVxuqk+73eSj83q0XHRrds6NSWC5k/KmOvJcdTAwMWLGXHUwMDE0W1x1MDAxZlx1MDAxZm2MpkF9q1JcdTAwMTVKrlx1MDAwMpkvklx1MDAwMfQ7XHUwMDA0vqp2XHUwMDFkSJPg9+3xoZIsulC5bYE5IObWXHUwMDFloFwiLdR2ZTpcdTAwMDeLXHUwMDAzy36+az2C8FjJ9HfvOvDLXHUwMDE0Ojh66vk+XHUwMDE5elx1MDAwMVx1MDAwZSjXfCb0kSr9XHUwMDBiNMPQ/JHwfD403l+h38dcdTAwMWG/O3ljqM2MXHUwMDEwMW5irft6rC2mM940Jlx1MDAxZG1/qp14O/ycP242XHUwMDFmXHUwMDFla1xmXHUwMDEztS2kaqtBmUBPlzNhIdJEVyVZalx1MDAwM4lcdTAwMTfWXHUwMDE0v01HXHUwMDFknsZqV0eqcK2Tm5tVXHUwMDE4qrBcdTAwMDRcdTAwMDE1aiBG2PVs07etzFxyhFXT83/agHjojbVcdTAwMTGmvjZcdTAwMGXGXHUwMDAxoyOqXHIpXHUwMDE50uFQXHUwMDFm+2JMPTak49GIXHUwMDA171x1MDAwZTe138xcdTAwMTe7ulx1MDAwMbnrpa3PxOSlh/nNRfz91yNu3phE0ambb5qNQ3eaXHUwMDFkaNvOoHxcdTAwMDdxT5Dzy1x1MDAxNqVcYrV542XBXHUwMDFkeDiiPdn+XHUwMDAxQqHLNJRak8s0YryQ1Vx1MDAwZjQ1QfDXsVx1MDAwNv5TbV2mqWVRar3EXHLPplOUVmskgFx1MDAxOGBAVDxcdTAwMGaHsaYhNcv3XHUwMDA221v/ZaipNVx1MDAxY0x8XHUwMDA31P66Sb+wb6WqXHUwMDFhUqr8pk1cdTAwMGa+Q7FcdTAwMDXrIEni4nJoWlGp8/tytZT3tjv6ODbN01x1MDAxNOJcdTAwMTDDXHUwMDAwJ0GudzP6atR6XHUwMDFhPlNTXHUwMDFi4EBcdTAwMDTW3tOowZupnWxcdTAwMTFR5d/kRmikU9XdXHUwMDE2VFx04YQwer2F1bdcblx1MDAwMFxuQTnXruYlf4FVU+1qO953tWpC7k7AXHUwMDAyXHUwMDAzcSyQuDlV4L3eqisj3etcdTAwMWVZT1x1MDAwYn/v0mItXHUwMDFjm7nDvamCj2PVelqo8JpcdTAwMGLjejviXHUwMDA3pjaI0FxmNfsqtFx1MDAxN1ok/7BNU5xGXGZpXHUwMDE4XHUwMDAyXCLGXHUwMDE5Mm5Utag1qcDSXHUwMDFjxkLV3krP431cdTAwMDNjXHUwMDEwS1czXGa/wKTVjVwiP2rSX/v3zJ1ezZjlZotcbnE+e8Hvn9fousn57Xjgy1x1MDAwNJCmg1dDhtqiXHUwMDE0VMiTcqXPRNfTICFVUbOaJlx1MDAwM4p4LlMh4kNcdTAwMDKePjCIopDbnejuXHUwMDFj8tza/qKS/k9jUHvXs1x1MDAxZa9H0XvEXHUwMDE332VPVywy+e3PrezbXHUwMDFhWENXzZCf0dXFwO9PeFx1MDAwMospXHUwMDBivK57vstX32XQiFwi/D1cdTAwMDb9PVwiXHUwMDFmhDz8XGL1iSpYXHUwMDFhMoZYwHVt6FFcdTAwMWN42pjBJ8ijlLxhl9p/+frpb9563YRcdTAwMDGqc32B3W+HaZCYN01QvVQjwVx1MDAwYkwvw3+Y23j9xllcdTAwMGaTXHUwMDBlvy2ny6B1XHLfzHpcdTAwMTVeeZrLzfn+XHUwMDFkueDRee1G+fJl+Ou/fTv1/zb04lx1MDAwMOh72jFrjUQr5cJIwqvabE+y7VBKU/1LutKSffjTzOSbe/vyVq/abGhcdTAwMDW5jYlPXSlcdTAwMGLSLDayTjtwWIx7S35Y1IxUPV9vnVvRyimtNLI81Lpu1O5v5m53XHUwMDE5ykGusK5k11x1MDAwYnlq2Fx1MDAwNb3UnLqD0rwynbdcdTAwMGL2fD4prtvzWeFQba/P22p4bGZcdTAwMDLcXHLGPsHiYKRcdTAwMDS2XHUwMDBlwlx1MDAwM386yLBVpkK3XHUwMDA2W3V3Y71cdTAwMTfvcD1z8Fx1MDAwNK6PMlx0P5iNhuvKrOM4cFx1MDAxNW673c5KXHUwMDEz3ot6eztT7aQmZnNcdTAwMTOGslAqlSwpwyiKXG7SsqbTUNp9WZfus/fVsaZpJbJhhvOT3rg658PvNGK5XG6f/eblc1x1MDAxOc7gJk6T08CLbv1uKDV5Jlx1MDAwZr91/bl04cSy1Vx1MDAxZmR37Vx1MDAxYtfkJtKTXHUwMDAz7clYLp9b8JdcdTAwMDKSslx1MDAxOMfT9ub6Wv44v7raXG59fq2lknr62SH8XHUwMDBmoUah8+xa4fyxzIe5zvNrdeBqw4KshtJcdTAwMWFcdTAwMGVcdTAwMGLzm/dcdTAwMTJJO7Gt59dcbm+5bkXm3IJZ3c3dm/dyKE1iTm49X7dQyEm7UJHLLi3cvJcwKC6Tp9d6+TybLUszm7Na5U72xr2UZi6xgpvP3W1b6sRW2S4uNtNcdTAwMWL30pK2a9dvP/eCXHQnlmZ1Mm+CWT0/vy3NyFxc3XrubiErpTKr5elUvGnPXHUwMDEzdbXnW889gq/Ki1lcclx1MDAwN9lJ58a9bCYykINbz1x1MDAxZK5WhlKZ1S6eurfu5fZiVreeO4BIJnIgQ2VW8ta97FxczOrWc1dm1ZeVMLFcdTAwMDbDKLx5L7+a1Vxyu1x1MDAwMrOKZdbtXHUwMDE3K1x1MDAwMKKbXHUwMDE4XHUwMDFkylwiufncTTAruNpCXFxZdje37iXYuqykbj53uNAvIMo1wKxu3Euw9TA3uvHcTVx1MDAxObpcdTAwMTd7tYblwqK0uXEvc+pqazd5XGZo+YtZ7eZN51x1MDAxNkbLXG5Ei1tcdTAwMWNcdFdrKVx1MDAxYZRLdCrevJe7ryC6cS+yWbDXuXUxq5v3sqvMqn9cdTAwMGJDYFZmKE+2LC7205v3cvbVrP7m5r+5+W9u/pub/+bmv7n5b27+m5v/5ua/uflvbv643Lx32zXZ6Vx1MDAxN1x1MDAwM986Llx1MDAwNmHBLVx1MDAwZeUo2KyzZl3uXHUwMDE3Z1xyXHUwMDA1stjbl1x1MDAwNsfQKU5qJL+bNHPhXHUwMDA1L3mFl3xpm+tcdTAwMDAnXHUwMDE3y9Lzy/O2XHUwMDE1XHUwMDFkXHUwMDA3pIjleFmvJUFvmJ1PVjTSd4uuqzvuJpb4tEq2x0pcdTAwMTPs1ZxcdTAwMWFwXG47zKFcdTAwMTm1XHUwMDE2buzb08TjPWPZiSrhgJsnPKiG9m66yO07ptvoyjwplZ1iWFx1MDAxZVx1MDAwNIVSRk6I0zme2OhkNlqFYlx1MDAxNziyXHUwMDE4xH6jWyj3ZIbkhmEyzFx1MDAwZbZl0lxme+6Wef7m5Lc1NJHExpNljnb6XHKvbY1cdTAwMTN7KYepbdXOtNpzeFgu4NycRcf1XHUwMDEyyXW7PJQpv5tf1taTUb5QRyexT4jRWa9lP9/u2Fx1MDAxYpHY0T7biUPs5lxcXHUwMDE2tpL2XHUwMDFjnkEvalx1MDAwMeDdXHUwMDFj7ZrwbMJ6lCuHrtZue7JcdTAwMTlcdTAwMGX3ctF3tqV4la9cdTAwMTb6h9iaJFx1MDAxMa/IXHRLNVx1MDAxNp1xMlxmzONcIlx1MDAxOEVcdTAwMDE8q4p9sXdcdTAwMWKd7VanXHUwMDBi3LbZ1yaHjMF4LKvTnTvdcylC0d7S3tI5h1x1MDAwNWSNM5VccnF7NeuY5Fx1MDAwMzunT1PAW1qpJvPCJEfbg5NcdTAwMWO4W5PnfsuNndKkmuRy5lwiJ4qyNo2tzjmuxIXcaFveZ/vEXHUwMDFh0TlrMHBA/WxcYpi1cjvnsNzMbSFcdTAwMGb+wFx1MDAxZVx1MDAwYtaso/VyXHSm1vDlIPFiZJTP1iCpXHUwMDBmi+7hUMx2XG5Ss3tyS1x1MDAwZY3+xffmXHUwMDEzoJz62oXrtqx5Ulx1MDAxOMrAL1x1MDAxNnx49Fx1MDAxYt9Cx6bXpctq+2Ru+3Zrsl7Sritcbv3sOFx1MDAwNCtbeDQqlVx1MDAxY+uobG46XHUwMDFi53XT7UdcdTAwMTWrXHUwMDE3Nv16JSdas6mTXGZEXHUwMDEwXHUwMDA2s0ky7lx1MDAxZk/bYUkmZWQuiZV3XHUwMDE2s3JcdTAwMTFMZmxW+1XEjM6GSrnSlL+O2qLat2K369cnY1bXxs1D52BcbqItcq2qf5SWmVSZfSq25sfTKcnV5IlcZvywPN+Cr1x1MDAxOSns0l2Yj3UrNPuOXHUwMDFkjvRhqeJ6y4lH7E5Y25fq69JcdTAwMTTt11mLbk5uVWbcc6e90oNcXDwyg6S5Rcm2XHUwMDAzNndcYnu8P+riTT3bnlpLd3JILVx1MDAxMLIz9e7Q6My0JPSRbCU8XHUwMDFliNqum5JcdTAwMTbJLfQ1miB5XHUwMDFjXHUwMDE13MRuVSpSc6pmWXHAslxmQOibXHUwMDAzLbPIgb/rt5A5JLlcdTAwMDaY4bSQVFfST4LmXHUwMDA2zWsuMrekVreb1XZsns6JtbeJXGZGXHUwMDA3XG5211aCoy9L1TjbdnJcdTAwMDBcdTAwMTirXHUwMDFjllxc3O6786NZLSRJ3a2I41x1MDAxZrh0fXNcdTAwMDFPpdkj5kFm81x1MDAxN1x1MDAxZp4zXHUwMDE0yS9cdTAwMGL7gOlcdTAwMWRcdTAwMTk2W4lVk6VDJrPpN6b9xNmzcZWf4uKxukPUXHUwMDE0uIlcdTAwMDcslWKTVnVcdTAwMWLmzF0/f6h2rHyxOVxyk2JcYr7GqlgjY+F0J1x1MDAwNfBm4ZlcZjfxwO3LmW+fkmpmpsNAXHUwMDFhfVx1MDAxOFxiaIMuXGZcdTAwMDRcdTAwMTjVw1/8/2BcbsSOLORvjbp0u023vN1Vx9rUXHUwMDE4y8yZV1xcc0Dq47xXmFx1MDAwZXbnnVtcdTAwMWPLteFccnv9pVx1MDAxZZXlUFx1MDAxYtuynmm7s3xX8aah/HjRxSOtXHJDKffN2XSx7pfi4qAlXHJirybett9fVcqpnJhcdTAwMGWX+VmR5Hqjnp+M225J8XLf7sNtMZdRasBcdTAwMTQvuHvT6mcrXHUwMDA2PJsohIdosvXR8ca7XifbXHUwMDE5aoa96Wmjbjk1XHSmR1x1MDAwN55tSfmoUmG2a4eRVtzbuNc4XGa1kr2oySShlcGqXFzdXHUwMDFiJXNxtMcoI0NiXHUwMDBiW1x1MDAwMolYsVwikXNhW62elqGsm/u+xVx1MDAxN/Cb5MtvUtPxhoe5nt3goptrnyNcdTAwMGKVe+Z+eizCb54sXHUwMDAx7ktcdTAwMWXjQLY9Z2xccnSi74dV66RNTiBcdTAwMTAysklyKdNcItZqV+xVapWoUljCaKRwwj9+2jr3XHUwMDBm1apcdTAwMTW5vcB0XHUwMDEyb1x1MDAxNTqyXHUwMDEzNVLylHjNg9PN+lx1MDAxZLmLraJcdTAwMWU0pu2lVi5L28+Vy2ZnM1TcVVYgzYtW4Vx1MDAxNLluoGx/3rC2vVxcVlx1MDAxNjOm3s9cdTAwMGXDY2Pb7naz5bDuXHUwMDE3a/WmpZv53qbaJLLqhrv+XHUwMDAxfN/ZmUkztiqnXHUwMDFlOOJ91snXSS9cdTAwMTOGmjVcdTAwMDZ6yOnVznLQIMdcdTAwMDJxqlx1MDAxM9Er7NlwMjVcdTAwMWJJNmMtauDtNmCDXHToc7uyXHUwMDA0SVx1MDAwM9fRqpmzfk0/d5zdibr19Za5a7mfXHUwMDFj4F5kU6bTd8rhmG+r3fx6lltmZ4DerFx1MDAxNlxcnn85sjJcdTAwMGLL266bh7ZcdTAwMDY+s2YndS7MU1KuS99Y79vmtnRiiVx1MDAxM5jFY2ekJ+3QOiT55aiPjbrW3qBF1GnnbKR4Z7DMrGrHbqFUllx1MDAxZN/ZZpONZkwq5iCp9Selba/QXHUwMDBlXHUwMDBiXHUwMDA3XHUwMDFhXGbK43Kr3d+QVmdpMlJqJnpnT+C+Vpqg0ZLCiYzLWUt5XGbz3C9tT6bcJMWMNPr54XKpu7V4U17ZY623oH491+m1rGZS6cn5qdJcdTAwMTmWtFLJNpnSIDFcdTAwMWKfV+46m9UmLW2T2Zub9i670Vx1MDAxM5poXHUwMDBiX5pJvzQtlVtcdTAwMWVO6nuppzrBsT6bmFxyUszYU1x1MDAwZUKkVCqbrjqPXHUwMDA1XHUwMDBmyFx1MDAwNO1dMVx1MDAwYsSqTvK2XHUwMDBiNqdN63J+rpYj36xuWcP0d8PhuFleXHUwMDBlUoa1KeR7tSjpXHUwMDE3UnLU2Z/UdYH2XHUwMDFjN2aVLE+1QT91+qN6s1wirK6tLzOD2Fx1MDAwNdabkfFcdTAwMDY1t+fmOelcdTAwMDRWcTlcdTAwMDJ85k5mVVx1MDAxZZNSYNfjxjLuKU01XHUwMDFkXHUwMDAwb5hcdTAwMTP3wFx1MDAwZaCXXFyz3M+21iMrbEpwcebQLK06lTguXHUwMDFjys1hOZNrVOZ7o7m0TNa36qbHxlx1MDAxYcRcdTAwMWZ9M1J+c1x1MDAxOVx1MDAwNo2y41iSXHUwMDEzc0U3psxcdTAwMTaymp1cdTAwMDfKqPZD0Vkvx1Gezfp9sz6dZdrgv7s1u5w4XHUwMDE1W0eZNcSOie1cdTAwMDJcdTAwMDVWq5JP1TWN+nI8XSeZlLVcIkViXHUwMDA0PH+wq1x1MDAwMep4fjuwRZKLz8dZoMn5XCK0XHUwMDAz81T6wsdrxVx1MDAwMYFcclx1MDAxYTVnTuR+2Ytsf8+yvVx1MDAxNEuAS1ZyXHUwMDE0m8VkgKp612dEcbyb58ecITKLYrtujr1Ke3PUS1x1MDAxYlueJXBg5eyf8z7o4nloj1Os31x1MDAwMlx1MDAwN++UR/pmLbOrXHUwMDEwZWr1bVknJWF1XHUwMDEya2imejxXibicyy23XHUwMDE2e1x1MDAxYaBDpTe6jCtfvIzLXCJqXFymXFzOXTT1XHUwMDE34Fx1MDAwNKOkNMrJs2Uv4Lnl3Fx1MDAwNqK1QXlVlJPtNNtZOlwiXHUwMDA0P9huPopxmv1N26ROdXNcdTAwMWVcdTAwMWOiZY9cbllIXG41iY7zwineJCgnna6eS+jCN3Pnvp9H3XUkLf9cYuFGXHUwMDA0z6K+6JqNqNc1PeJsJz2CO0BVhXJ2XHUwMDE39mrZcFxumlx1MDAwZXRykbT6maNd6kG0V9pKfVSIlIbeXHUwMDFkR1/yXHUwMDE1XHUwMDEw93r9Zs00XHUwMDBic2FcdKdcdTAwMTDGxLblqbxcdTAwMWavM4O8bGVcblmxiazD6ZBYedlbPY7fK6ZmTjKi2uCrXsN0SHFlplx1MDAxNrnSLiYzqZO8Pt2c54VF1tFmNrhqvTXO0bq1tEfKRvZ9XHUwMDEzQ4x5Un6lXHUwMDEy5athqzZcdTAwMDeRbo6TqY9nKDVsxjunNmmQWk/6LZyrXHUwMDE4LkiwRSyNZDNzIT6wrcyXmKCitNnSlzSJW26pVJf1sLWnp1x1MDAwMINDXHUwMDFjr6M2xFx1MDAwNct5n5SwzM6wUyGJOo9v2cfRJS54iP26XHUwMDEwXHUwMDEzVOZlhllcdTAwMWR8LZlbmVOQ2NhKXG5cdTAwMTI0aV7O43ytzt3TXCKpalx1MDAwZdtv99JcdDv7bORduDJblrVEclx1MDAwYu6Ln1x1MDAwZsxdks2fSiWlX+fzXCItxK1isj4pXHUwMDFiaybFgy1Wy8KgXHUwMDExgZ1XSfWQzVx1MDAwNo9ySCCDmpV6ZjvhVXtRLEi3l+p25YzIYuNyT4Cx+dd7MjqOSXFoacqH5eRVLmldgcBo41x1MDAxN/uauj9cdTAwMWLf3CS7Vlx1MDAxZn5/lpw2bJLaZ1x1MDAwM3JcXJRCf57thVxy7k6iS87IXHUwMDFhh1x1MDAxZIijTcVNZSxRXFyYz9Xzglx1MDAxM4z3fLXz2sPcOLWcuVluiSOvSnxcdTAwMDQzyVx1MDAwMl7MuVxc8Oxqmqs+ymlcdTAwMWQq5Vr9XFzn1JZJ2EPmjp55cWxYYXdcdHGPxmvr9UFEvdLMPIctt8LNvNRb1cwmJVx1MDAxNN66Zlx1MDAxOcy93Fx1MDAxZe3gqlx1MDAwN9NMoi+ZRIPdMoOH401bXHUwMDE2wu4ul4CmNFF0MMeRXHUwMDFi2K3k0FwiVq5cclbtTvnGiG2e9Vx1MDAxZcefXHUwMDEwXHUwMDFm0IGT8UBkxauCMmRcdTAwMGJ0VW6cW062mYJjzeGmOlx1MDAwN1nbVTN7T7T7lb51OE7EJFih3DDTqp4gtncqiis9NKfldtfuypjn6zO8XHUwMDFkZXY5s1tcdTAwMDCKWsdZuptvuFx1MDAxNsdWPYn84zbn0EusMOjA7Vx1MDAxZKlcdTAwMTjFnDKW6ZTOcsKdVbjvqbFYmmmCcre0Ze/s2iC1zWGY9c1ZaFdcdTAwMWRO+yR/XHUwMDBlu+NaykEpXHUwMDE3YtLlpJTIkd1cdTAwMWUtNlx1MDAxNVx0brJZXHUwMDAxfl0xrVxumtqEXHUwMDAwwlxu3TaSMSnm7NFifaxcdTAwMTM4UWe8snL63NT2p2anb429TVx1MDAwZeJcdTAwMGKV07OzuFx1MDAxN287SCkkLJepjspvXHKAXHUwMDE2nW11K3apSpKYy2MqgHtkh1x1MDAxNa1Wbbh7XHUwMDE59qu8abFlXHUwMDBlbKZdXHUwMDAyOVx1MDAxZlVcZlFpxk4znMeVyTa1009rs6Pnw34/W1x1MDAwNVx1MDAxNeltwqB5XFxmkjJcdTAwMDSPhGTsVjVcdTAwMDJcdTAwMWayioDzRueGXHUwMDFm0fY6qkAsc/FcdTAwMDFcdNArglx1MDAwMC1cdTAwMThcdTAwMWZcdTAwMGWZw7pcdTAwMGbi+uiTdW+/XHUwMDE32/55bFx1MDAxY1x1MDAwZcDFpXDsdsJ6oyMt7vjhOrZ6ycZIyjlcdTAwMTWvXHUwMDA0IfiAapNVkbd05dKs1ueZupuXzUTpbepOwtwy19iueWdcdTAwMWRYXHUwMDA3dzIvXHUwMDAwOYVb7lx1MDAxZDPmXGaA78gyXHUwMDA0XCKiXHUwMDBiXHUwMDFhy+mrvFphajDd27lmqV89wvXR0FdcdTAwMTjxSFYojExUZ/yh0Vxie3FpXfHNdexbwXTpNk92tbyYXHUwMDBm9tawJ+NBxy2AQXRcdTAwMTOpl2M82Fxm5DDKYtnNVFx1MDAwZv3ZXHUwMDExXHUwMDA0u0+ssfRAXHUwMDE3XHUwMDBm8yA0jCGu1azhYDDSdnBcdTAwMGZYYiNbn+JiM3Z7scy59XBWyIIu6Y8z5kgnJ06m3GyFJX0+zZ2bXHUwMDFiiK/lUXN3eLspgzlWuiC9cjnZXHUwMDE4TkaNyCRwq22dXHUwMDE1uoOSYzYhNJCGXHUwMDE27alcdTAwMTOVqlx1MDAxMJr7K3/L2rG3jTPNU3iITfPYXHUwMDE5L1x1MDAxNj3bXHUwMDFhJnJvV/p2Z7hccstcdTAwMTN1LVx1MDAxM5tbMnQ7NXnoV3Oz3WKjS5yU8Iz0zcy2fEgq/XLJsHKyyqaVipWk9NSG52tsa+zi9jI66jqQUCtcdTAwMDInabdjVyyBv4ths2vmiO00p2zThViivJWMl1nOY01cdTAwMWWH5bzccFx1MDAxOGxzazZqJFx1MDAwYr/kQVx1MDAxNFx1MDAxY1dcdTAwMGK7XHUwMDBlyVx1MDAxMaU9yZ6Khe/DmEzSXHUwMDE159O2c4Lgs9iTm5jZtlVcdTAwMWWOmiHFXt077HJ6rbTbXHUwMDFiM4lIXHUwMDE2YtRcdMSo3a955XJjsVnJpiWrXHUwMDE5bV/PdFx1MDAxNkFcdTAwMTbiV+pgXGLpzV5AxCaphFx1MDAxNk563Vl4XGbZaO5cZsNa1z9OwtHS77VLQO7AP3r35EybXHUwMDEzt5FcdTAwMDNlV0ymJbYsSHBcdTAwMDD1cMOrXHUwMDBlXHUwMDFidNbHRt9cdTAwMWOH8ria5fSNWSybXHUwMDAzXHUwMDFkzejOdFXe1lZ521lcdTAwMWWhZthemlx1MDAxNVxiXHUwMDFh1iNcdTAwMWLGeLLqR6Mqz8mBVbNVNMmGblCbhPmgjspHfXGsXHUwMDE06vqkYGujUzZ+nEtV4jWXlzOXZfg5ieZOJ6ym7GRrxf16cSv9XHUwMDExyuBmqt7ZtnRn0oFg2uzlpVYobzfJXHUwMDE04jM3P1e2szh3dLD3bJFJ36+VmNPrXHUwMDA0ZkHd45ySXHUwMDE0dmG49tf+XHUwMDE5h1x1MDAxNHW7/ronwSdcdTAwMTNejL9oxkhNrmTdwSbeVctcdTAwMTOZWmZcdTAwMDTd5WfjqNjqllx0oFx1MDAxZijMYsVDXHUwMDE0lVx1MDAxYmZcdCxcdTAwMDGIJs53u4tzuNjlJCnzTk/MXHUwMDFkp2OFXHUwMDFiNedRKvtlXGLHkGxcdTAwMDZm75hcdTAwMWGW9iyWpaOZZfFqs1x1MDAxNy49Nbct75zk9rJwLlx1MDAxZPq90KmG7VRBaYmtXHUwMDBi8KqFbIz0mrrHtnKvcIPCqJ1tg5Cp+ebhRE/LaJfNZuHfOe44kXC3drfWXG7Mc1Kv53bbqFxcoqCblVx1MDAwZc52+71204zdiGRyqThjkaCTM3tcdTAwMTlUXHUwMDE4jmrj86KHrJExnCfn3qmeuL65n5iPcvtB1lx1MDAxMXttmWF8diiA+Fq7nZSVS1x1MDAwNrv5oufpx3DcXHUwMDFklUd5Yu9GXHK82LNq1Wg2TuslOGCrpm5rreFWvb4l3Ok8w72DXFx4m+KpfW43rYpb3zjnYLXrXHUwMDBmXHUwMDAxSaX8WFx1MDAxZY3RwGr3ps11wlHYJ9XUTC6mWG5UWGtG436wK7OtrIBcdTAwMGaKptX+ISnOsvMpXHUwMDFl1lx1MDAwZlxczPKTKlvHqeW2SPq4O1isdKvkXHUwMDFhMjdcdTAwMGbCom9ZMzdS9zVpI70oe8vsOVx1MDAxYyGn0FDpuqlcdTAwMTKdlbGFXHUwMDBmzWkzsdd+V1M6mC75KOjlo6abj6bPz9HJgbYycbUhMphcdTAwMWZcdTAwMWJKg0HwTsdcdTAwMGVIXHUwMDA1XHUwMDAz7sZo325KMViVmVx1MDAxM+7PcEey2lx1MDAxZWdKeIArVb1cdTAwMGZR5jJcdTAwMDI9fXBXcMppVZvLUsdSes90R1x1MDAxMGDPlb3kWThig9mwNzW9mS/LU5rM5ocsuOozL1x1MDAwZvum41x1MDAxZNxiXGb0YHvYXHS27aktdlx1MDAxOa3Vz7XXStcyXHRMNVxianU3bnlcdTAwMTBoNLj0yo3OvDxqXHUwMDE313ZcXOgk0jdcdTAwMTezkb6eunJVaVx1MDAwMVx1MDAwNpLqOTPetq2dnMSmIVx1MDAwMm+Vn0Ogelx1MDAwZYH7O0l3g3A5sfZJLm90sEXlNsnXpK9yWFx1MDAxMciGXFxi7pg37pRsOVF6b9FIVFx1MDAwZdJJiilcdTAwMTmA2W7iWa7oRJe8k8V2/XGir+Tg0FvR/kDFSi1FUJVj9iR8XHUwMDEwXHUwMDEzJ3OCXHUwMDFimWFcdTAwMWK021x1MDAxMNcr1YLeTDqWVUsqeVx1MDAxM03bUVx1MDAxY1x1MDAwM7rBy6P1sZOs1lx1MDAxNXtcdTAwMWPWOvmWQVxuXHUwMDEwvjZcdTAwMDBHl2d17CB9vVx1MDAwZuHOVvJcci1IxmF7XHUwMDAzXq5cdTAwMGb3aFxi95y2klJcbv5cdTAwMWMtXHUwMDE2QJ1cdTAwMTJg1uuuvHxcdTAwMWb0/dfhiPxp527bZcNOLVx1MDAxOWl2S71Up6K7YU9aNCmPbSfQzcBvq2tqLfRZXHUwMDEx7o3sRTUnN6koruxcdTAwMWZ3m1qgXHUwMDFl2cDPOlx1MDAwNojA3saxp2hvdNDxvG5V6N6EXHUwMDFiWsvbW1x1MDAxN2d1VpOlIWC8VtS1c1x1MDAwN+JcdTAwMTFT2Ufd5OBcYrtJaSWnXCLanLpR28tcdTAwMGXDXHUwMDE5N5tJjSdkXHUwMDExQ1x1MDAwMFx1MDAwMZDNLrJup+lt/Il1nOJkqILAjD9cdTAwMWGdSnvMWlx1MDAxMoKU8nLDXFwycVx1MDAwYkU1R1o1l120PcuQZTxMy+WhNMNcdTAwMDGCMW+i5FjeZFvwr7JcdTAwMTeMKqc5XHUwMDA0XHUwMDE4f8Tg4Pcqc9MvXHUwMDE0XHUwMDE1h+9S7S4u27JcdTAwMTdbLEdZXZs0lFxiZolcdTAwMTPtnFxcoVxud1xuXHUwMDA05DRaLo+VtdM1M31cdTAwMDfvnI0/as7dplx1MDAwZrqh1Fx1MDAxYe12wy54/XxnuVx1MDAxN83arlx1MDAxNcmceUzy4+FG1pp0kieVsaSH7rx/6letRZLfypaPuib49oYsqXi2lENcYvjM2YG4K9uT1PRYXHJcdTAwMDd98GlNvtl0rW1cdTAwMGVcdTAwMTTKKrYmJFx1MDAxMdaxXHUwMDFh9Vx1MDAwMnuQ5Jc7XHUwMDA3LVx1MDAwNNjJXtmJaCB0mIbWOrGHXHJr1a1N2v19RY7D/Lwmj2dS3nmdQ1xckVRswFx1MDAxN9VccqdsLja8M1gkxYbSiY3qYk3RcVx1MDAwMGFQqlx1MDAxY6T2u2F7M69cdTAwMTHZzIP2slbuglhVUibzWavWUXnEeiOGR2qGklpma9jMclx035qsUsC8XHRoXk2CVpNcdTAwMDezXHUwMDE5Wdw8JNvugjaO4LiTMrbchkpTOonyezZuxWell5OaU1+FbWcyXSXdXHUwMDFhyDPtPFx1MDAwMlx1MDAxZtpcdTAwMDG7jNeNQ6vtRIrTospJW0BcdTAwMWNfXHKLMzbc9XZWfUbWeIi0+XZqNVx1MDAxMpuZzcPQOtRKNXvWt+vT3GGdgdikuCqllFx1MDAwZqq0ubz87NlLOktTktxo0rUhjs2VXHUwMDFhXHUwMDEwyHrEqdvM7Vx1MDAwZVx1MDAwZdqsXHKhcJPshzsndSZ6cTmqnd2pby/PnZbd7kZzmSh8Ja2h76/jpppPaIvdutLOOqOwWbM7XHUwMDFiNlxi/EbN7JD2gLmNRS/MJ0UsKzt9dq6JlstVjj5QfopcdTAwMDRokGvGaoKE+aWvWrhcdTAwMDBcdTAwMDHUPq7tw1Jrq4Hf92XP01x1MDAwZaVxMWoh6ZM9IKGcnV7XRqBcdTAwMTLojlx1MDAwM/KwXHUwMDFllyyrXHUwMDA13tk69s9cdTAwMDNv2DqZYneIi3G+lCr2T6Dlg9p5N1x1MDAxZHWn8EPlS4FExWOZSifKglb07Z4xUJrIy9qhh8rLYnN6mjpRTmSCXVxc7lx1MDAxY1x1MDAxYSOTXGZlw9d6Xt4pjaxQXYM5XHUwMDFid+bzQmFcdTAwMDU3xaHwXHUwMDE1vVx1MDAxOY5cdTAwMDFzZlx1MDAxZahcdTAwMGJsXHUwMDEyp6aW04oqsWVcIlJqp8jwVEzKu1x1MDAwM+1XOoq3UUk7c19CdFx1MDAwZoFTIc5Xt6ZmdqJWXHUwMDAwtN3L7ZyuL/pm2zi3XHUwMDBmu36mWYkzu/FcdTAwMWVTfbGf7fuZ6c6KR17kWsqXmFx1MDAxZWqvwFx1MDAxOJpJXHUwMDBlm/11obTr9LNcdTAwMTDP+8B33Ug7lsuW11x1MDAxYcZY71x1MDAwNufVYWPtRTTe28fyfuYsM3A1x0ZcIkF25MfVValSzshJv3DeWKJ5cKNcdTAwMDL4WfPg63auayiXXHUwMDFiQIB92Hhay5b7pNxcdTAwMTmW5iXb2arcc7jjXHUwMDE5sJB1LJ3Ej3NGuTO1rKSYl96p0PZcIuyY1dJcZoVks1uDJmt0XG4zg/JKbnvUN1hql6KG4+7IXHUwMDEzvI+tYlJcdTAwMWY2st5cdTAwMTGov++MZ7FnXHUwMDFlZvnGfn/e1lx1MDAwYlYmyfumdeyOlyqeaCTeYVx1MDAxY526mqV392u4XHUwMDE2T11LVFx1MDAxZdeNQqVYq4N5XHUwMDE0XHUwMDA2w+F8ai6SympSOvvRqlx1MDAwMrG2XHUwMDExL5t74jfa4EGGUaVjhu7Frjyt6/W93tLskbqdWGFcdTAwMDGCh+ElN4VOrEHDqFxcXHUwMDA3XHUwMDExvc1YXnkyqvetTDjPT1x1MDAxNl2WtZJjLZEti9db9Vx1MDAxOajEjGmSwVx1MDAwZSdcdTAwMTA6WJWkupWCXHUwMDE321x1MDAxZc1cdTAwMTnmqLg6eHu56Fx1MDAxNVx1MDAwZYP62ZX7ZVx1MDAwNVxcn9K8WmVok4I7U/OzVnm9nMlD5uxwpzxRdVx1MDAwNVxyqeC+nk24yls0UTlcdTAwMTjKjFU7RIVBg2TXpt3Pllx1MDAxN3DDXfBX8Eja9XFqWdSsbFJcdTAwMTjLXHUwMDBl2UySQmlimqDHrZ48kHa02IBh5JNKzcxNklxcN1x1MDAwMqY8Tldyt8k6ZVxiM+WXccjiejFcclxu2bzcXHUwMDAyTEnQy2YtsyZcdTAwMGJM1pbr/CVcdTAwMDfaS0qBdMZu+zxcdTAwMDPsWqXGJMzG9kE3v4xcdTAwMDV8VLuWXHSWxTmMpXQwR+TwZSzFQi+zXHUwMDFhXHUwMDE0nJbjrHdDUl3J/XDeq/RcZlx1MDAxMraQ6fLK1iqZ8ujCc7G2Qd6ptvpwXHUwMDA3ckOrm7vULLCwPcIzhEl7u4zK52nXrVx1MDAxZqoju5VwXcXxrk2soeWpPJeVbNuXydAqXHUwMDE1lVbFmcdcdTAwMTJcdTAwMDJdUVSat+D2mv2zwJa+NFx1MDAxYYHfRKYgXHUwMDAxZeFx0Vx0i3XZJtZuo+Z2V2pcdTAwMWO1re+walx1MDAxM+50XHUwMDE41MyFr2o2gJNwYp/zIFH8vTg7gZYkzul0XFzrY5JrhcVBXHUwMDAxXHUwMDA2a32dS016sV5cYlx1MDAwMY+TMfOlMFQs1rOs5XmMh0XR3s025dZcdGhcdTAwMTNk1mxuQXBpzn17l9iFmsy4XHUwMDFjtNlKcU/tMHYgeFWLYGTeMC3pgs7CSSdwipHsXHUwMDFmXHUwMDBlXTVcdTAwMGJQPKXC47pcdTAwMWVcdTAwMGXjXCKr5kUhqCRcdTAwMWSl++yvsXt/Pii1VFx1MDAxZUlcdTAwMGaHLZVKtXhi1cw8XHUwMDE59bIleVxi212KWO0gXHUwMDA3w1x1MDAwM8QmR6c4yYKZhaO+b1x1MDAwNrM+iLKMNOemXGJQMWdNm+ao71x1MDAxY5qlnKrBkCypoo5WMvNhu1x1MDAwNnF7t38+2mBcdTAwMTmDpFgzp7TTcFx1MDAwYjmqfLBebo9cdTAwMDebupxUrGNiXHUwMDFk5pf6jmG0gqdT0XJ1d8etJu7bXHUwMDAzXHUwMDE1y6dCI66rOECbnZui4GdP4E9Kk4LSbI3BblJcbiEyrVx1MDAxYnpcdTAwMTUwn+l8WYNTgKBxOlqv463Xkys1XHLQidHCT8gpTKa+OW7M+SnVXHUwMDE1uuNYYV5Nw9Z78WQwjypcdTAwMTAvZbHVzoPfjiomXHUwMDA3jFx1MDAwZdB+NUCLL/aer5nnL/ZebIG+zeVLtKZyWaqSKSqCjZlcdTAwMTVcdTAwMDdcdTAwMWNLSp6POeVr2zVzL5exXFzQ/VTlQb3GLNz55qnuwzkk3JlOYq7zKcbWX/CratraXHUwMDE1P7UstFx1MDAxNWbq5ol23CTrXFyeXHUwMDAxxFx0LaTyXGL5XHUwMDEwhES8y7j9s65OXHUwMDAy1NezilWp5rdcdTAwMDM1v01FnI1hIG7KtpPmbH6pLWy6jVx1MDAxNKjQ6rqW6Vx1MDAwNNOVO9FAU1x1MDAwYt9cdTAwMTapaLa0s+0l2PaxRn3mWV+uSeXnXG6GqMhcdTAwMThwY2Vk2bds4KW6ctqOayFcdTAwMTC5p1JVzpLSWFx1MDAwZVjv8qx7Jlx1MDAwZVup+iTMp7oqT2xOM8pueZAyc81cdTAwMTBcdTAwMTjJ3JBcXGh8qZdqXHUwMDE3esD/m6K06u5m3stcdTAwMTitLDfL4UDFLcW84Zzhm6pWRMUrdsvPXHUwMDE0O1x1MDAxMNO6Sn9Y3V6vnbOJ3MS2XHUwMDA3vFx1MDAwMNpOWKXWMCMqSZLrMSvXr5he31Xx73pcdTAwMTap+byUcjVEcLuiS8BhYo+z8Ze5azOyJonJWkFVP8ybJoWxwJvgToEvZ3NASZBarSpm/7RcdTAwMGaTSlx1MDAwMWhNxrgy6ZVcdTAwMWPTXCKF+khkMpmYQ1x1MDAxOKNyo1Gl11x1MDAwNM1ogEe2IVx1MDAwNrHoxFHJs11wzFwirFT9ibNGXHSEc/5rPk/kXHUwMDA3u2nKNbepUXJIwvqgvGtcdTAwMTdcdTAwMWOnNin2zUOoXHUwMDE3jWmu7ZnFumWwOdVcZm06cbN9c5I4y6Pd1eTui6boNVx1MDAxN+O1JlPhuNnLYDd/iYHhMfVcdTAwMTRheaO64N1UK3LWcDtKK7tb1TNwoUF/ys1teCrPs7ys5jwlVvfIz9TP2N1qhYGVSlx1MDAxOWIp8+FazeVoxy7ZsNjuO71ws1+mklx1MDAxMahBU6qx0EY2Klx1MDAwMCuQUWHp9LJcdTAwMTU1L9FThYEn8K9cdTAwMDdZXk9SNj6u99ZG3cOsdHBYj+sj229ccne1cOhbQ1x1MDAxYZ2rw+qmWZPFxPa9TTxqgu20le24XdQ7tfqRL8/JJlx1MDAxY27jqes4lfDAs3Fod8U5lzNT9Fx1MDAxNG7LsuqbtMnkMGmfXHUwMDAwWPW6VepVctWNmsdS8iCQxXZcdTAwMTcwXHIxVM5IidLp4E5ju5vkIL7IVUZcdTAwMWSlebvHZqPZX2re+qtGtoadcK+Vw85X31rfL53DVs52qJ7IjJ7fNPRNIOVi7pRhsKftxkq8SnFYXHUwMDFkiEbmUPGyneFcdTAwMTDnzF7fmk03mU1cYv5LzUXZJGuRY51cdTAwMTRcdTAwMGZcdTAwMTbhTXw4wftawYTfXHUwMDFjXHUwMDEyq2ZvzOXmOLGjrFx1MDAxM3b3ZmrYmfeNQdXaQjhi5qrCO9FJkMiOncmvXHUwMDE3k2VS3MqdOMTn5lbVeSVhIS8zcbu3qy/QZEBqzMygU8fruW2L4sG4qi0ydt1pXHUwMDAyXHUwMDE3W8o3WctcdTAwMTJbyPJZaUW8XHUwMDFhNFx1MDAxYqpcdTAwMDavNjGV3dab0iNrnl3AOEaNabg+lc5J2ZGp2Wa+XHUwMDAwX+5cdTAwMDChyI50XHUwMDExhbhCzmN8wKBcdTAwMGY7fXeiavessEhyu7BaZdNlu29cdTAwMGXKcj9CM7QmO1xia1x1MDAwN+aYXHUwMDEwdb17ouY7XCLTXGbIUs1cdTAwMDVcdTAwMTWoI4N+XqPFQ1uMXHUwMDA3TVXrkppcdTAwMTRIXHUwMDFlT5aX+dbETuTebDWnU7fbtEf2YFx1MDAxZUyD01wilDBcdTAwMWPwLVx1MDAwZYS7OVx1MDAxN/xFZpJcdTAwMTNG0Fx1MDAxMWVccpdcdTAwMTPgYuXbWm7FN3vhXHUwMDFha041q/SGW+GFYaOHZnY/mbqtpl119Wjbxa5dorasq7xYPozgUrakbmXiXHUwMDFk3a/nclx1MDAxZfZrctxUtVx1MDAwMnhgjthk6a/3TJYzXFxrzofJflx1MDAxMsriQo1lkXeQ415yg3KdXHUwMDFij4PpXHUwMDEyYlxi4KpM4nfh1kapjDyG8TaulKPtuugk4bpcdTAwMWZIODzJXHUwMDFkStuc652moarM5qZcdTAwMWK1QfeMN0B+XHTf7Ki7LXmmrFx1MDAxNLK7zMhAsYnrvZRhnNfjwux45JNcdTAwMTaXXFxNxLr9jFVcdTAwMWOMXHUwMDFiKu9vLlZcdTAwMWQ9XHUwMDFi/v98vce2s1qyNPpANFx1MDAwMOGbXHUwMDEzj/BC2Fx1MDAxZVx1MDAxZUk44cXT38n66tQ5f+c2do29Ry1cdJikiciMTFx0XHUwMDE5hH4y+Vx1MDAxN/s0XHUwMDE4v5Eusn4lltSurTw/WNufkPHYptFS51xupIZcdTAwMDA99H+J767Y0MWSNbHQh1pWxVtLunRZP+F19UVWUf49c1x1MDAxN1x1MDAxN4/jftV+N/6ewlx1MDAwM8pcdTAwMDK5STRzXHUwMDE3PVx1MDAwM0CW/HhqxlXPXHUwMDEw7Z18+LHw/H1LXHUwMDFhnjr3T9sp1K/PXHUwMDFlXHUwMDEyjIy/1XupadBcdTAwMGKfXGLrjjg2qXeHjyG5f4fL0sruJVx1MDAwMjXrU04y+l7L75ovTSTOI5nk+VDTUP1k1kX5ibVtzkUnf9v9sfLjZdJccquLRlx1MDAwNUF6UYipXHUwMDExrHxcXMPsrY2PXHUwMDE1h1x1MDAxY/+vJ0KxXHUwMDFlXtRPcM+AUpopjD9Z4NRcdTAwMDJcdTAwMGLO2+u0vq/hccV4mHOQXGL7IONXXHUwMDA2n0v/d5/yYFi/T1x1MDAwNaik9tTzt1ZcXLO/IVwinruZLNBcdTAwMTnxxlxySkH9vdj7sMpcdTAwMThaO8zcg34no6VccidcdFDXXHUwMDE5U+lR6ClcdTAwMDPuuUjn+UrkXHUwMDE3Z9dcdTAwMWPQ56JYl5s6XHUwMDFiMEe8uj10cqw75pxf3lx1MDAxZNUmPp6V4MBL/01/XHUwMDA27P6DOEDslsVcdTAwMTP0xorF7MXO42H+60tB3s3v7oB7k1x1MDAwMcmzsVx1MDAwMqspkl+X1cJ1XitahNHn0lx1MDAwNVx1MDAwMz6555fmlJyVXHUwMDA14sslcjX5XHUwMDEwIEbL5fPHpMxcdTAwMDTj0Y1j0u43kErxJUctslx1MDAxZYPgX6a/MGmK40LqNlx1MDAxYlqI4o9cXObn3/X3upnFcVx1MDAwZsZ2MFxmT91cdTAwMWalON5cdTAwMWbJ751cdTAwMDH41+/a0XK+WXBUYNn5escmIzbuvsxcIrXH4Sy+ZJhTiKvPZrJJcegrQT3Bi+SfXHUwMDFkPWlxN/h/PFq73bvEXHUwMDE03Fx1MDAwM8bJp4ipzyfa1f7Kv9PB9uXz0ihR9ZWqeexGxCmxpq3Ls1x1MDAwMrcnK2iY9HHyb11cdTAwMTTkXY9AuV76e1x1MDAxMb1iJfLO8aG+32MrerBcIooqqMleiXNcdTAwMDVRyU9cdTAwMDdFSFx1MDAxZFm1psDs2S39XHUwMDBlr1x1MDAxN90+SFFcdTAwMDXJ0++SXHUwMDBmXHQ5c1x1MDAwZlwijFY2deuiyVx1MDAwMVx1MDAxMFKvlldcZtlcdTAwMWavyWqru7rLXFyjT5lcdTAwMGKfcZRcdTAwMTIrXHUwMDAyXHUwMDA0bZ9cdTAwMDJW2ChccknQ8pLwXHUwMDE3XHUwMDA3NsxAXHUwMDAwR6B0olx1MDAwNLaA7Fx1MDAwMmajqFlffOXh6lx1MDAxOVx1MDAxOJFR57mnkjGgyWHW/6Gi8IKmaOODXHUwMDAyQ5dcdTAwMGVRyKUz7a9cdTAwMWWIKS+d+3FcXFx1MDAxYrREVKzO+Vx1MDAwNY506bKjXHUwMDE3pIl2KUMz/N6w2lx1MDAwNLddgHioV+7QYTZcdTAwMWWjtWco4sJ2XHSL7TrCkLeeXHUwMDAwaas11nOHv/iv1YpcboJcdTAwMTRT4tvnM0BQ9alcbrSf31xc0Ci9e694Lt3MMzz9Toiv822mdkva21abXHUwMDBlSi9YZuJmvc58ZpNcdTAwMDLxkMpcdTAwMWRtSVlcXLtcdTAwMTLPqH46JGucXHUwMDAxXHUwMDA3XHSIsr1K89LU/eFwnlNcdTAwMDeI8yG4XHUwMDFjZmPO//T1XHUwMDEwT9Mpgl+ayulcdTAwMDSEf3y7P+HmsSu2eVpcbi6Gj11gxFdT+XhYp1x1MDAxNyeQg+3NfqynXHKQ4Za/y3P77GJmXHUwMDE3vK/d72JcdTAwMDf0XHUwMDA3XHUwMDA15H9aIKlcdTAwMTL8f3xcXL7/6Uj1XHUwMDEwOHT3hrH+lFx1MDAxOcCbaiFq1z1lYMlccu3fPZm+0O9hXHUwMDE5XHUwMDExMjK+Y7Z+5KJ6LOWti1lcdTAwMTjXi1x1MDAxYX6qnZxRb4VLhVxu9KmSR1x1MDAxMH9JmeP5aTzGL1x1MDAwZTRNxlx1MDAxMFx1MDAxNNFh+OHTKfM3XHUwMDAw+Vwie04p+kSlqk5ZyT3++lx1MDAwYleMs5M1XHUwMDA1rvxcdTAwMTnEqkbd/LJbXHUwMDFmPD3NXHUwMDA0mGRB3J2RXHUwMDEyUW8zXHUwMDE2/ONJ0G5gWEXGS1x1MDAwN5T/1ThcdTAwMDDhcMiya1x1MDAxZfhQXHUwMDE3t74oklx1MDAwYvGfZCdpqXzowmJtdcZcdTAwMTNwVk90X19SXHUwMDE026SO/6udKtFTUFx1MDAwN3chXHUwMDExxHFcdTAwMGJOZGEg6ln5rJmrjkLISu2x4pMlY4JcdTAwMDM6XG7SmDp5iJO0/+fal1iNfzfQsvxLV1x1MDAwNcCIrlef7lx1MDAxNos/q4hoPovF53dAn08zX03eWM9Pp1x1MDAxZTgppum2y7V86W3bXHUwMDAylZVDISXrtX+CYVx1MDAxZX40TCx8hMTnsr7T9lx1MDAxM55cYv/aXHUwMDFkwrprTlx1MDAxMlx1MDAxZtWgYrp1YlxcoqtvkVxyzFtcdTAwMTOT+lx1MDAwNj7Hdz05XHLmP+pcdTAwMTKSMrM7Y8bG76Qyom64sC1bPKNtkLNHX1x1MDAwN3fkcFx1MDAxMtJcdTAwMTJcZvHbQVvm6fdTmmdI+rI56Egq2IcvK73rXHUwMDAzk6fltsvU65KDi3ZcdTAwMDNizdhASTpcdTAwMTEvejv6ZiGXhtGmJV5MfFD1QNyfXHUwMDFjfi5yLGKpXHUwMDA0/nQtIVx1MDAxZpKEnpAq9VRCTVx1MDAwNFxiKVx1MDAxNnJwXHUwMDA3dfGBfivEfbJt/lx1MDAwYtxHW0Zp18FcXCRwNZhfjrtwQ0h8xVxiym3evvnNQbdcdTAwMWJcdTAwMWZI8YT3pY3k3/+jIyp2Red7d5D+aaGBXWY7ts1itLNcdTAwMTXQweq6noVcdTAwMWFRRyNcdTAwMWK7l3z58+Of/G6aMl4t8+NoLtjcdiY4PMm7+4a5v89uu1x1MDAwMl3S5If9q1x1MDAxMSSXNrczuoTBLy3xny78p99h0uZcdIBujlxceefOuCfEjTpvKfPLSpa19eFN1U8v8pdRsVx1MDAwNbEkx15cdTAwMDGQ1qIvnSUkVlx1MDAwMdPVOFN2+8yr+z8uK9qut+pcdTAwMGIz2e53l9BtgUCqzoLTXGKnXHUwMDFjXHUwMDAz+nhLvPTZ/vNx2+Cn/+j9fNCtJozn2qhdXHUwMDFhXHUwMDEz4bJP0ZCR767uf7p6nb5cdTAwMDNcdTAwMWXaTWh2/fMwXGIrXHUwMDA3XHUwMDBmpYjPXHUwMDExaEQxmF1AuPFcdTAwMDDK5kGqXHUwMDAxaobzXHUwMDAzw8WnXHUwMDE37Loh9M5cdTAwMWbnNf+kzSxqXHUwMDA0XHUwMDEwXl3aOUrsNT2ztlx1MDAwMkSiflx1MDAwN/NsPlx1MDAwNmVV3/ZcdTAwMTFjRbBefZK2+TLVrlx1MDAwMpi07K1cdTAwMTeUw+QhxNpgMOI3+vVcdTAwMDKa/pQhS5tFbIp+7VV8geSn/6UyvFdcdLtBWEya3Fx1MDAxM9KSmLU1kz5Gr/ZZPmS/MH6ygk08z7vPXGZmXHUwMDAySe29MWP9263Bxa1cdTAwMDX54jRvMv7T26hcXDNQXHUwMDFkeqruMFx1MDAwNzaAUHaOWH3AYFx1MDAwNLR69OFcclxuXHUwMDBiY4Z6M8KBVW/qV/HqJodPXHUwMDFix1x1MDAxN3e0+aCGIMjwflx1MDAxZi55eC+YxNDkXHUwMDFi32VPYEZb11RcdTAwMTVcdTAwMDKjZbBccixDk4BIbSeov208KS3vxLL4+uKdvUqS1JxcdTAwMWVnsNLr0vhcXDVWoZ8mJZNgLMasX1x1MDAxOLZ8V1fPpryjZnrUyHi9dzXs/GpEdk19lnds80Ohg8Td6j5cdTAwMGJxbp61tTSvu27JV1x1MDAwN1Av/TizR6VKdJZcdTAwMGKJpPhcdTAwMWaNlz9cdTAwMTi6J+z6XehcdTAwMTKPS2LhXHUwMDA2k2i5m4SIWea35LlcdTAwMWRcdTAwMTDKnE6o31xu8+GTcl+QRrydzuPv+3m3YafHvCOud3Hc68bB23gp2eev5saUt1FGIEup9Vx1MDAxM4ZKn8g7gbdcdTAwMWN3Q0NcdTAwMDOlb5+0XHUwMDAyXHUwMDE0eb5cdTAwMWZcdTAwMTXNzn6n9eBOStG5uvC7U75xX6wowke+7p12+fWBOpuWNXLYXGJXLU3ilkGKfVx00kO5b+XBSMr7X9/WwUxvIXNbMZVcdC1b4XNEf/MvfEpm2bixqq9cdTAwMWLSXHUwMDEzxDEoP1x1MDAwZk2IdsNcdTAwMWLk/arDxa9r1k5DNLCYz2vI6Zs76DhU7fdcdTAwMTbPrPVYX5tcdTAwMTIlKFg3kvyB31HZnc1bu7F1m8JUmin4+/q5U+dcZomAXHUwMDAwOd01YFSI+WSt2q+RXHUwMDFmL+RfT1x0aeTEfZRC6TrNg9FcdTAwMGKB2I3wvYfbuLOLOUHgXFyyxEfMqLBcdTAwMGU/+ijalLmCXHUwMDFk8n5cdTAwMDHJdFn47vdKRf7p+ebDXCJFXHUwMDAyXHUwMDEwvWmQMDSnl798RHjuPzk/XG6tuuGWy5Vh189cdTAwMDO8hV0k1Vx1MDAwNJ1cdTAwMDJcXC55fVdR1Vx0XFyKt4yoz+hYY8Cx7yNcdTAwMGLwmshcdTAwMWNcdTAwMWZiaqNuWdEjXHUwMDFl3Jy9kKNT5sGUXd45a7soK3Oln0D+gPRth61rsVx1MDAwMl1t4W9XiPNt7EeBbeljM9nphjxjyJOiXSjvslx1MDAwNLHXwGrT2jLWuySPXr/iXHUwMDFkV6e2hKWXbjiE8a7WXHUwMDBisY59yHko7c1mP//Lb3XOgo4lXHUwMDFiXHUwMDFhUFx1MDAwNUBcdTAwMTTJzs5q+Vxye5vzVVx1MDAxZIZcdTAwMDCl7lqdkJJcXFx1MDAxNytIskFPqD+fJ8FcdTAwMWRcIonPf7WwMKfoo9LHdLXuTm9BXHUwMDBi0pFcZpNcdTAwMDQ6qVBcdTAwMWN4MVx1MDAxM0UoVmCiSDVcdTAwMGKwkH5cdTAwMDdcdTAwMWHEXHUwMDE4wid8WJd+XHUwMDBlXs7bffzSzjngXHUwMDBlU1I/k+9a34JL3/tzQ0hiheeQXHUwMDBiXHUwMDAy75JcdTAwMTLXWPfa3Vx1MDAwNedAuaZcbm07z5DYyiXEZKljXHUwMDEzlz9tr3nhW97kce/7zXn/b1ZE+flcdTAwMTI8gZteSe6XbnZcdTAwMWVcXDU8My/gmSdcdTAwMWXYUU738lwiv594N8VsXHUwMDBmU0u5im43XHUwMDA0fiSpNZ0rXG5fXHUwMDA0++s9XHUwMDAzos4rWS9cbv2AzFx1MDAxMlLAYzC2T/6vh9VP7Fx1MDAwZttMsdv5voVAWtYgYnunXHUwMDE5yeHqypG8ylx1MDAxZKpcdTAwMDZzUP4sYVTml+DS58ZmXHUwMDA1XHTjUNFvpVx1MDAxY66ZJvhcdTAwMDek+lx1MDAxOGVZrPv6bz42gM+15Fx1MDAxMkO0XFxo8YFW1yxcdTAwMWbVeoUpak6QXHUwMDA2+KfNdT9/dTh5g1x1MDAxOP9ePUxcdN5cdTAwMDTqLilzUjxcZsn9q7v/d85X5CG5fXLI+6uiMOr/uMrybaHdpaJH7qS8VWf1aJCB4SxcYlLM8aqJy4Sgqf+0zZDwXGb/rpnNxmh92u9cdTAwMGXQXHUwMDE2Plx1MDAxMV9RyS7OwOEl/Vx0g2PR8WhcdTAwMGX5vuaIXHUwMDE5s2XRXHUwMDE4XHUwMDAzlHvsjHMt1aqMYfTF6no/jLz5pf2ZPKSbPJzUKfiyYTAl/jSZnaD941x1MDAwNc1EjUemXHUwMDAxXHUwMDAyXVx1MDAwZjpuibkhydz3VJT6bVI8qd5EXHUwMDEyn+bh3ejmr4jvt3KvWyaAZt+Q2cU11Vx1MDAxOKZOXGbNXHUwMDE0v1qnb1x1MDAwYonPNXvQXHUwMDBl4vOAjPhG1+HYi+9cdTAwMDb1aS7TpFx1MDAxYvpsOFx1MDAxNmFcdTAwMThvQ6oxmPNcdTAwMDDZrz5ESFO3XHUwMDExVdXXIV3zh3dQRtRQxsi3dSWah4SxOo1cdTAwMGXMj0s0dOnL1KVzulx1MDAxMNpfdtOf0P7Ix3NcdTAwMTVUXCIxW6y391x1MDAxY8c3ptbRe1DsJFx1MDAxOYf/6lxuXHRcIlx1MDAwNVx1MDAxM09u859WpacmpftMtcBcbid1XHSvK/aawazTXHUwMDAw2sju5+ha3n9Ct+tcdTAwMDQvXHUwMDFkkNNcdTAwMWG390j/NuI3vZShNPWNp8js0jI+f6JrXGYwXHUwMDBiY3dSXHUwMDBmgHFxszL1rJKqr1q0qGbTU/w9d3nlrVuoZ1x1MDAwNTz4qXTQwaB/7G72aLmpSSeTZIZcblx1MDAxOUg/XCLllr9cdTAwMWVmLHDJayDCd03+XHUwMDEx16xE1Vx1MDAwZfnX+0D/dLm85iNcIsJzcvVMSbl9XHUwMDA00jWhNDK40DPngmhcdTAwMWZcdTAwMDdpWrdcdTAwMTaee4BcdTAwMTiQqF0xXHKmY/P/6NZv5eskXHUwMDFlhPe/s/nGKZx7hVx1MDAxOO5H6Fxc71x1MDAwNl6kJjszkjulwtRcdOLkQsq0kqMpTpGb3UIu0dJcdTAwMDS9rNZ4rj5cdTAwMTVES0JccrQzllx1MDAxM7Xtm/p/5+dcdTAwMTVcdTAwMWWp8+u3oLtKJz/wkbxcdTAwMTXg2XdrqV9CZvGH9FnZenGYPKxcdTAwMTI211Xit6c/XHUwMDFlilwizFXOJVx1MDAxOcRkpTJcdTAwMTNcdTAwMTF0wvxHvVx1MDAxOFx1MDAwN0BcXLtAtlFEklx1MDAwNPhth6dcdTAwMGXfW1x1MDAwNd9bvybNXHUwMDBmulx1MDAxZFD5+qyjVe6XgNS+XHUwMDAyzbS+ocEoblqvNvzhnesjhHWjOHP6wyrLh//uXCLHWkJNLMMzaCBcdTAwMWWHOYrUfuKlOeXsXHUwMDE3xrkzfvE5XHUwMDE5XHUwMDFiSluOQYbsNPtRXHUwMDFiyLfjadMz43hcYuQ8zuecTVwiUKy5+EpflUO5oso8t1upp/zjca1xxOizQbprXFz6oa3CQue4x1x0ZGnZ2V74pM4lkqCqgVJKbTWUJ53iXHUwMDEz/aW+V99E6usj7y9cdTAwMTFYbuqVXHUwMDAxKVx1MDAwMmPdbvawbJA/7jtv6MaicFdvXHUwMDE1XHUwMDEyW60xZ+0uIFx1MDAxY4VAOou0LqD53MVKtl9xO8qeXHUwMDFkb1xud1witDCEuGC+Wic3hkxcdTAwMDNcYjXfjn9ccjBMgPpcdTAwMWJg+LjhpVx1MDAwZi2rcql8ozZZXHUwMDEx+lxmgDHzqv0+Kq3GbYUt8MipgpoqnfimRpnM1Fx1MDAwNodcdTAwMTX3zVx1MDAwNuiNRvxcdTAwMWFcdTAwMTKzRFCAnjS13lJ0XG59ZZBcdTAwMGZcIlx0o+/BvPU3//7Tm/2yU4yxu+38ttm9LdP9XHUwMDEwa4NQOsuhdyF4R1x1MDAxNtLejouQvv56PtMkgGe+XHQkUFwij7AoiHNXQX4xd2/bxVx1MDAxZMZcIp6WaJhcdTAwMDNZmU2B/fo7XHUwMDAzK1x1MDAxNo1890o336v3nt7OXHUwMDEyLFvr8anbfe7Y7WNcdTAwMTJMtMjM8jpcdTAwMWXxKoE0ulx1MDAwZkqnXHUwMDBl40d26sylkHNuJ8ZcdTAwMWEuvb6/fZyuxVx1MDAxZEBGLFVAllxyM/BdforzrcC9XHUwMDBloSRW1mroy1xu0YVefVx1MDAwNthcdFx1MDAxMVx0c3ttcjBcdTAwMDGyv0Y84llA94XDYFxcpnnlOlx1MDAwM6ukdTvxPe/uJFx1MDAwZV58TZhG76igM7WjsI/AR1x1MDAxM3FFilx1MDAwMZK2ctT44plK6NVjpG7vXHUwMDE1XHUwMDBiqDh4XHUwMDA3an1xo1x1MDAxOD+rMTS1XGZ8P0rAl9cs4vVcdTAwMWWzeV5KXHUwMDExnlx1MDAwM/BvqCvuf9jlyVx1MDAwMm9XUOaE3mRbnPRpXHUwMDFjXHLlIa9AeIdklejS3ihosjpSKVi7QIjsWicwl8NcdTAwMTjsSVxiz7Za/Vf3UvksmyHp9lx1MDAwMlx1MDAxNcLI0Mc8Xlx1MDAwNIZaNFxcXbC7WzBxY+2ZRynmxkeatkFsXZFcdTAwMTDU1fv0semybCHued3Y5tLKSPOwYtBQYMj8Lnv4+VxydVx1MDAwZVx1MDAwNLeZeVJPrup/XHUwMDBmLEKT+i4yLVx1MDAxYn2ti0yoXZ7sUz6aMFx1MDAxNl+9pvV98cyXi9a4leNcdTAwMWVcdTAwMGL9a2SteF01u873IVux4dJtXHUwMDA22bDck0eibVx1MDAxMFx1MDAxNYLfrypcdTAwMWaEeFx1MDAxY1x1MDAxZSm1r2Vf7s/9N+PbdPXArpI/Q1x1MDAwYvhs37L6UN04Llx1MDAxMM5cYlx1MDAxMqYj6adT9+y2pOKkX1x1MDAxM1x1MDAxYfBcdTAwMDCUPuNVaTBKccHSSo5pXHUwMDA041VcdTAwMTnGqLJcdTAwMTWf3ciOblx1MDAxYf/1WYlTXG6ZjLnXWMUwXHUwMDAxsnhPXHUwMDE2cjieVc96/vlhXmNy2ihXf8p4jo3qxdJZm7hhrE1cdTAwMWG7T8Ruvlx1MDAxYTcsun6S1U1/e4R0TDdo94pccljSqkRjdmb9f3pcYo9001x1MDAwNWg3PlujlV519Z9t/FdcdTAwMDNewKRx6Vh2W0bVXHUwMDAxQrFvLoaIr1x1MDAxMbJjTrHicMfTMCHmijyRO6pYnF9vd8BcdTAwMDR6RrzWyeOzXHUwMDA1d0LGXlx1MDAwNEqzJNL9hnetNVfOaqyme1GHXHUwMDEzi2jtSleP47lntsA+XHKVXHUwMDEx1G3DSlx1MDAxYleXu2oq5lx1MDAwMNlcdTAwMDWv7vfp+72D935cdTAwMWaX+Vx1MDAxMf1cdTAwMTeLYy/xmm90XHUwMDA19l/LXHUwMDAyvI7zXHUwMDExU9Ln3aPhVJPxMHwgytZNXHUwMDFimmdxO1x1MDAwM1x1MDAwMdVcdTAwMWWBXHUwMDA2Jp9cdTAwMDO5VShcdTAwMTlcdTAwMDXS187lW9OGkiqDj0MhXHUwMDAxdlxm6ce6NJn7nb/98LOHpFx1MDAwNrH7bY00h4RcdTAwMDC+kyCiJsmLq54gXG7c+oPxkE7Mkzn7t0yCsX1Xt1x1MDAxN97RwSP3S4Hai1nFI+nLz5eGla+zzV1cdTAwMWT46SfhsYhxvMW10yn30pZcdFx1MDAwMHj+g1x1MDAwZlx1MDAwNCbZZqFcdTAwMThcdTAwMTDWJd6C609oUlx1MDAxNTxFSPxcdTAwMGZcdTAwMWFvI6R/WiB+O9rw1iXZnFx1MDAwM2+g2dV2fzv5wb+aXHUwMDExOICacV/L2/9nRjbGtCuefuLbvGj7XHUwMDA2TORrXHUwMDE51Vx1MDAxZOuHIDd/gH1HQez2M2h2fLo/raXX+TeROmaE36lnl1x1MDAxMlx1MDAxM5DROv1cdTAwMWNIVJrr/jtl+lx1MDAxYXSNgfxcIj8pN7g3sco2XHUwMDAztblhOLzhXHUwMDBi8cCD1T46S1xy39HNwYK25OSqy83gvWfAXHUwMDFlZVx1MDAwNfnJO8t+dVxiX/KvZZvDytCrhWaUzrb/JunS/cLvd1x1MDAwNOnB81x1MDAxYYXu31j3tSNcdTAwMTjf+SVhSyi06uEplOVt0NCoXHUwMDFi14rB6X03RoBAg/nzp2rXQt3eYjN5xLzOdyS45pOGy2a6Jrxmtma8neJcblx1MDAxOM7knI9MYWCOi7xcXJ9cblx1MDAxZX9cdFx1MDAxNS5lpFx1MDAxZVu6XHUwMDFkvFd8XHUwMDE5i+Nwt2+SbphIXHUwMDE3aOZcIouJ7aRkZLZcdTAwMDFoTd1cdTAwMDb7s1x1MDAwNdeMtKTfq2tcdTAwMDHM5TNn4ja/yNczXHUwMDEwslx1MDAwZUb7+DJcdTAwMDQtdKdcdTAwMWaDXHUwMDA10Fx1MDAwNuvkY6CqhIlcdTAwMGVPmFx1MDAwNDJddTl/+PvvkFRcdTAwMTlav/NcdTAwMGZS2tVHV/lW5P4nXHUwMDBl1sqHrSGWQ1x1MDAwYo3uPSO4XHUwMDE5SXCKmCrJRlx1MDAxZIVcbiFS2S6WVimyz1xmhzFcdTAwMWHLrbYn+Fx1MDAxYdtXyuYzt4yX38d5XFzj+Pix4sqePpek+8LU+1dcdTAwMWNcdTAwMDOi0e6UXHUwMDE382g9SHKXLXdRct5cdTAwMGWzbah6UMLQOp9Us+b9Plx1MDAxM7X1fPZPdVx1MDAxNJvPn4auXHUwMDE0jZ3KIGT1IXF3n7eCXHUwMDEwsIS22stcdTAwMGX/NMFpdKJcdTAwMGarTrxcdTAwMGb0fdH9vVxiO9mVLNnAMYL7nXRUsNBcdTAwMGZ3kKBZXHUwMDEwhVx1MDAxM1x1MDAwNVx1MDAxZHdcdTAwMTAvxV/FXHUwMDE1vHNBP1x1MDAwN1x1MDAxM9Ocx/fiXHUwMDAwckLg09e7UjxcdTAwMTJow4WMeFtsu1CPRGdmSdFsZcJbfGCM4thiI/n70ywxQGFcdTAwMTeaq49WroVBsVZcdTAwMWElq4As+GC4dnm55JdKMfJcdNKcXHUwMDBm89fL9UIgkvc7dPFViVx1MDAxZVx1MDAxZVx1MDAxOT+9fSo9empcdTAwMDKYf5D3cXNpUVx1MDAxNJVqLFx1MDAwN3ZBQMdsXHUwMDE0RKnLnEB2xfsk4OrXVacgJlx1MDAwZoix0C1ngeUum1S+QD5vtfxi2Ta3gqHcqGJ9xIPqlFx1MDAxMHjOxoS0v9x9lGK078+pXHLDXHUwMDBmJNusYFxi9PmWekm+9HFcdTAwMDWCZFx1MDAxM7crrmNlqpGAkVpVolx1MDAxYV5NyVqbXmle54deweGo0Ncn6f6IS1x1MDAwNlx1MDAwYkPI8tfX5p61h7ZcdTAwMTFcdTAwMWJcdTAwMDf1NVNGu8qa5MLT7ck4RUYm8+JPLIroueu2XHUwMDFiedFcdTAwMWWGIKLDnJKOQ1wiq3Gx1fSvXHUwMDBl+IJcZn7vXHUwMDFmN/7dNNBs5Xr5n7qM3YGWNEnvdc0mfv1rL4f/6dPiU99cdTAwMWSeoeL8o0bCK9jvmyDwr61cdTAwMTTfr3HPhvnr0jzHh4CT4dvbI1rqXHUwMDFiLiaKXHUwMDE3V1x1MDAwNq9eJeW+XHUwMDBl2KFA3Edr1dulMzWziUFGipdIOVx1MDAxYd1+kaWANHpwczF61OR02TUnncDNO76oy1x1MDAwZsrKP3dcdTAwMDRV+rhOrT99pZGDc1x1MDAxYsdEMiejtJ87mKczv2Hy/Vx1MDAxNVxcOTzMVGpcdTAwMWNcdTAwMDZZdaiILWPsI0/0bLT5zrKK01x1MDAxOPFcdTAwMWHL3DzAmy6MN8xLb5BhPi1tNcmK4f/qOL1ccvUwg9BTXHUwMDFifK+WXHUwMDFhPyReuUCoW1x1MDAxYohY/NlaXHSK3aGTeMnd4oPVMICc/tUtNEpwILmWmb9cdTAwMWR8WNGom2yLw+jCaL+ojb55kD9INb/iQ17P2cZ4wCVl/cVcdTAwMTaJcVx1MDAxMr+Milx1MDAxZYvzXHUwMDBivyi5zmpm8MGUhVx1MDAwMKYo2j2pb1x1MDAwMOBcdTAwMDXGXHUwMDFj+Vx1MDAwNVx1MDAwM4FkXGLZ9OKVY5k6XGattql52v7f2nH6+NPFjlx1MDAwZqH2d4FcdTAwMGV/LUjsJWKg59xenGfPWceKj2rGP5mTLsa4lz9i3K85geD0hZNcdTAwMTBh2FxymNi7n9fuLVMqXHUwMDAwgdPBLkBcdTAwMWPXXHUwMDA2bVwiaotcdTAwMTCeXHUwMDE5mvhjn6nhtF8zdNJK9N9cdTAwMDZ/52H9dKX8zojALF5cdTAwMDTyfZ1cdTAwMWI1XHUwMDE2YTV91/kpjq81xVx1MDAxYzPZ/u1MyZCcoSHewUh+Yyb63XppcvHqheW3x4RgqN5v+z1S7KPVRJf9h0V5jTQ+RVx1MDAxZJNxYFx1MDAwM1wi1rtcdTAwMTOXW0ogdbTY8M0o1HxHg/J+XHUwMDA0kJMk+3WdXHUwMDFm3XyZ0Vx1MDAxNMpdkP5cdTAwMWJv2u1cdTAwMWTx3ymeOFO6rfvRQu4wW2SM99G9qK9xYGpbzn36Ys9adOl06tz+qVj29f6o+dl3v9lDRGUvP1x1MDAxMdVJY1x1MDAwNmC0N7p1XHUwMDFhQVx1MDAxMH5cYvJcdTAwMTaB8FrG1Hk/bJLsXHUwMDFi+s10XHUwMDFhXHUwMDFlsYHeMi5cdTAwMTG9wVxiXHUwMDE4PGhcdTAwMGadvE9cdTAwMGbFXyBCx3xF/9Mu8Nl4u5+/apdt8HpcXHuwXHUwMDFjUMR33JzD2V5/iKv22zD6wK6hmVqq6P3ta7HuXHUwMDE1jLZ+iCPpMbb6VacuVlx1MDAwMaNujnvdMz/h3P3Neoj8JnB2iL60XGYgZSrqp0c51oSbNuhiS1x1MDAxZZpg2aRYrd5r8kVcclVLX6T3N1xmxcu3strxsf88Q5K95pHd2Pm/75HfXHUwMDExmYUwm//KPVuiifGj8diIpKa4er1cbvO4/VhyY8FUI85prJJWw2uPaFx1MDAxY/L0XHUwMDE0QZSr2eB3bMwwcFdcdTAwMGaM5ns/N32Zq8UyJI5AJi/5qr5XyeN1p9vTRERzd4KsbGk+23nnXHUwMDA3v1x1MDAxMYtNXGKmS7z6yfGZJFnU8Vx1MDAxYilcdTAwMTJtS1x1MDAwNDLMfZegyX3T1uN4VTVroMfNL2Ik7UH7M337XHUwMDEzWnSVoVxuZFx1MDAxM+BY4ut7r51FfzNkmiSpXG5IU8NRQ336XHUwMDFiXG5guP/T375cdTAwMDRtZlx1MDAwZiHnJ+uJn9mmbPHMXHUwMDE1x1lcdFwiXHUwMDE2RG7JLaN+7Fx1MDAwMvagjy533M5hZ1bK6j6FOVx1MDAxMUbKNFx1MDAxN1wi88s1JVxif1df8Wfev5ikXHTwfmbG/S7U07h2NPmo5rza6Fx1MDAwNv+nXHUwMDFh+YYqhOp97rPtun844fdNT4PT/WKHvuEjXHUwMDFh+lx1MDAwMJYju22yYakvOStcdOjW8KfFJmpcdTAwMWVcdTAwMWSQJsajV8ffYz6rzcAwypqG1PPq/6pcdTAwMDT//dLfzkDdab9cdTAwMGLYXHUwMDFmXHUwMDA3MGF270Its77Xalx1MDAwZWmJx2TFr57JW1x1MDAwNGO2qV1FvzB1WFx1MDAwN4zfLnsrvyY0aIUnYH5cdTAwMTK+6Jj3koRtT4Zi87GglWBbXHUwMDFlXHUwMDE1xidfXG4s8EJcdTAwMDAnte6sIICBTl2CmVx1MDAxNZwvYlx1MDAwMMjmo5Wt6flcdTAwMTSamX1dmlx1MDAxOIFeeGF/s4L8ev/b02bWz1xmRVx1MDAwYvP07jRBV1+b0VxuvbD+6ql8LKBccvKeRUVcdTAwMTQ611m4a/VcdTAwMDGbXFy5z5/qO8t/XeeRuGnIRml+jbVcdTAwMDDHl9Lxe+1cdTAwMTZcdTAwMTLlR1Bgs19cdTAwMGLOXoagpLXAcbH0jSml5WPRWlx1MDAxODD3WLuz8jhLdO+MUmvvc1x1MDAxNa/sXHUwMDAwYqNcdTAwMTNcdTAwMTiP/kj9rqj2/86YhslaP2zRoWZuuaFcdTAwMThis1x1MDAwMtY8xolgw2ss9lx1MDAxOUh/Z63crnlcdTAwMWFw0nlsXCKM+IixveCb5kSxJUCfkuqP5atcdTAwMThvyIVcdTAwMDU5IVx1MDAxOHtZXHUwMDEzxI2d7lx1MDAwZpzoI5eJqJFmiMCpK4/lPrkxYKCrn4+J/NpJ3My3cVx1MDAwNlx0XHUwMDExXHUwMDE0hjVwydr6kTQ1XFxhlTW8plx1MDAwMVx1MDAxOZBJ/NtcdTAwMDdTYKBp+ejqLVwizKjPMuRuT2Zkva9FJ+04rljEVE9cdTAwMGL90EdcdTAwMTiPM1x1MDAxZlXFJFl6wN5cIle26szuStqoXHUwMDEyTJiPZ7yzqj9TzzNcdTAwMGLNi8Puclx1MDAxZkd97EDgJqvnqnJbXHUwMDFiXnOEpMzWck+y6vug0TJAnI+rJ7ylo8yJ2rK17qzrhiBlxr7Tf5VxelP2ql1jnHI1VMEj9lx1MDAwYvpDXHRFXHI63q6yXHUwMDFmOX948tlWlEDpwbV0qlx1MDAwMp+NUktPxnqaRchJwuuFaz3OjdVcdTAwMTimWvpJhFx1MDAxNVx1MDAxMSxIu+uuwENcdTAwMWWOYSl8l3en+PB40qlcIvdLYHBcdTAwMDKEXHUwMDA3nUZyalxy0lKBpq/vljAqontVk7JcdTAwMTfTPjj2vLHHOv1cIuMrRVx1MDAxMFxiijiD+UPn7Vx1MDAxYVx1MDAwMVx1MDAwMClmSqDSXHUwMDEwJ95B4ePM50h6yFx1MDAwYq/dXHUwMDFiw7dcdTAwMTHEY+f483fEpTerXHUwMDFm+/nirbVCb6ShrT0jOviPglx1MDAwZUfI7Vx1MDAwZfrHb0vLydQvnX/X+3KN5Vx1MDAxMWJug+dlqPogXHUwMDA0ZJ2jXHUwMDE5yC560Fx0WbEwfybaSfa3XHUwMDBis7j3YZnD1Ia3pFS8s+OfZJrp81x1MDAxMPDdXHUwMDFjrWXcXHUwMDFlz8G7gSdp/5C6af/su+gtd1x0i7dwYTot3T0kjXmBXHUwMDE08fH+XHUwMDBmb5RcdTAwMWbvcfN0XCI04jFWpzpa8fC+44GnXn2j7/JVkvulXHUwMDEzglxij0q+40+6f/+AsnZj4lx1MDAwZkNcXHNcdTAwMDCkLsX137xcbmtpgXyq+lx1MDAwM5RDsiFDdGtJx6z6497vM1tcdTAwMTIwj1x1MDAxMFx1MDAxMM9ccjlPXHUwMDE3clx1MDAxYdVcdTAwMTN2L4XCI/C70lx1MDAxNTz4cL/Y8NVRja+dZThDidQ9Vt/rLiFcdTAwMDZl/d1vmk7c63Tk7N3P7SyOxqNcdTAwMTigjVx1MDAwNohcdTAwMTVcdTAwMGVmUlwiXHUwMDAxsv7p4675XHUwMDA1SG9eleuezTVcdTAwMDOhnn5dhOW7+D81RjJDXHTXyKN9kM26+3yrOEq0qciXhlx1MDAwMWfOi7dcdTAwMWLlKXP2ZfnbblZKNyjG8sv2tFx1MDAxNKnpXHUwMDExtE7g31G197erYCVHWfw2zitcdTAwMTey4ulcdTAwMWJcdTAwMTMwWE1NP6eH7u6Y41x1MDAxOJZFe0fmXGZcYt5idXDEN+P6mlx1MDAxOFx1MDAxYzXY9p1dKik1UmT+XHUwMDFi3KCuhVx1MDAxOL4gTKe9XHUwMDE3Pl9cdTAwMTA4uFx1MDAxNzNQLL7jfVx1MDAwMl9ZMXXDlWCcXeBcdI+oXHUwMDBmOq6otlx1MDAwYvA6WI2D0Vx1MDAwNoB61FRAd4mWOVx1MDAxYt5cdTAwMWHGSVx1MDAwZmtwZ4hcdTAwMGIkfI7RQL6WXHUwMDE4RP0tvDdcdTAwMTdx55Y4K1x1MDAxMElcdTAwMGK3244lXGJcdTAwMWLX5ju6a+73s6HfzXRGm+bFXHUwMDEzOkdv6eBcdTAwMTTLXHT7s0djMijHp0Azn5NcdPOSWKpTwVxi3v5hMVdccse0KVx1MDAxMvpcdTAwMWbm0Nds8vYhx1H8x236pZFcYnVNPmu7lL7vxplTdNhWjszu11xcplx1MDAwZq5cdTAwMWWh4FxmISsqXVx1MDAxNc9pdur8+3yD22A9vuTFVUfimE5EzupcdTAwMDDh81x1MDAxMb7Az1xmgv3xzeJPrncolj0relx1MDAxYjf884dDR73A4D/439wsJqSAXHUwMDEyO1x1MDAxMNXj59Lmu3bOozv9N5NcdTAwMTVcbv92u722XHUwMDFlITSDXHUwMDAxe95F84Mk81x1MDAwMLGDwVvRJXYj2nieXHUwMDA1SMSVd3hP0ypIyoSecuFBXHUwMDE4QKD9XHUwMDBmoONcdTAwMGb8+ukjq6+lpo+TbUZmufqkSjxR6PJcdTAwMTPON2swxc44L1x1MDAxNaibfF9fOPJ2Rc3EhKu+3WIg/d59JSU+I1x1MDAwNr9/i/mpXHUwMDBl/8+8iFwiXHUwMDEzI6Kk9Ktxu+s8rPF2qD9vt23eo1x1MDAwM1fTbUhrXCLmQLHHR/5x8HxcdTAwMWGWp2rm+PHvR1x1MDAxYpI6UWg3sZKNhFx1MDAxNn5s++Gnjzi561hiNHbol05oubecXHUwMDFm2qK4XHUwMDBi/8Odn15ET89Cpreqjm60XHUwMDFkg1Hrl+s5JYef7LP1Y7bI4Z3anpqL5dXwQnhy++nRi0vJ+YCm9uQzu0BcIo9cdTAwMTX4eGphhpqbj0FPfU/WJepPrHKN7/BcdTAwMWNS45NcdTAwMDVcIiS4dmSKLve3I0o56s/BvFx1MDAxNf/Lr/v6iWPeXHUwMDAwXHUwMDE58nhcZnL6b1ZLe1JvqWGVqU7Fz19ubjjJIVx1MDAxN65/NSzH2Fx1MDAxMDsu0mNcdTAwMTKRbFx1MDAwN1x1MDAxMXgs3Us5X69dyUD3kIxcdTAwMDVJX9e82uOAQFwi9/3w2lfsXG7O44ZcdMQulT6+eNRim+59hI5innjxiH6GzefIYvzIPYWZZCqPs9ZIYVJgajHnf7tl0bI5stJxjvpI5arh8VtDXHUwMDE3+iaHXHUwMDEwa/wtl1VQJ5wpUi357D/xLIJcdTAwMTDeIV54nIiPpGQ69nfU3Gxcbkz9zKVpQT3kKP7mJdCbYn1NgFxu6ZlVXHUwMDA18emoa7bKvmar0mKG1K52XHUwMDExwfn1Klx1MDAwNGfS9PohKLOnY/tS0Fxm5e+/mVx0e00vwb7ff7RcdTAwMTmajCiK3TaWK/Ku1eied1x1MDAwNXP7z9665HvtXG5BOVxyzG7lf0ZcdTAwMWVG5NJcdTAwMWRcdTAwMTe3wtsj4Fx1MDAxZdGnQXqa+3r4WyalStfx4Xv0MFxm9oXGVkT/mpWsIelcdTAwMWSGTFx1MDAxM6uRlpiaYKzQfzOL1fCrk3FC2fGcwcY/oUtBJKP0tXx2goKaJWhZ0H+VXHUwMDBiY0rb+qZ+LzezkLPb+fb4MdXPrTXGRl70x3hcdTAwMWHG325zoI58XG65hu1Mnp+wt8bWpFtPXFxdv3VYdOcmc8uDxk77rN2ZXHUwMDE0VbFW8KZBrr1q4PbeOD7s7uRoeca/WZbeXHUwMDE4XHUwMDEyiFNcdTAwMTRnsJdRRrvhpLdnos/xqPPFXHUwMDFkQzbze6aEvNgkh3wmx8WH+Vx1MDAxY79fSa0j1oy/5lu5XHUwMDA3tWvzTjKNj/f0hYGLdWl26pNtfz068Fx1MDAxM82gLVxuWlTBl55szPZcdTAwMTRDXHUwMDA15yyeO/eTXCIzXHUwMDE3c2Iv2WzgqVx1MDAwZdV2XiXtUf08i31/R5mZ1ybQYZrkOdF9XHUwMDFhe/BcdTAwMTOiM66Lkko1jIn+dlx1MDAxN9pcdTAwMDHbh1x1MDAxMGKfSItt4cqbQupNXFyIuINxkXStklx1MDAwM1wi4r1LLy2SyTfkp9Nj9rLkk1tQXHUwMDFjdV7/29PskuJb3fWj/THQxo6MXHUwMDE0jfnmXHUwMDEwfTY7dMpDjiox9SNQXHSEMFx1MDAxN+3RyD9+h4hwLdBcdTAwMDeMk1x1MDAwNVDe2WjcZiqxXHUwMDFkhTD1zl9Oy8Df1PfA2ShcdTAwMTCzsSSbv19cdTAwMTg75bVcdTAwMGVZ4X0shPRlqklcdTAwMTNQTTuIlLjRXHUwMDA38eZCnIWPauVJ9MyKXHUwMDE1YpaWTS6Retsr9jZPRJ2FL1xyf6N/w3Ta6Vx1MDAxMGPQXFzTXHUwMDFiXHUwMDFh8mpdgeT7oyw9XCKh88KKKoVcdTAwMTSxXHLF/+pC4lxcXHUwMDEw91S0oqdZ6HFu8j0t8O5YNURtY0GYN5LMXFx7KVnwNn2aXHUwMDFmSKE4xlx1MDAwZaRnvrD69uCQY82YSUeGmVx1MDAwMcWrQd9PK9dcdTAwMDHkJHZYQEziquV2Tm7Bt+9+m7xcdTAwMTB3S/5fTS7UL+ygS8xav2xcdTAwMWUhiqevsLL6XHUwMDE1tMvmseZJXHUwMDEzT1x1MDAwN0LqXHUwMDEz458xMEZcdTAwMDb5XHUwMDExt1x1MDAxNt5F6Flo5nSOwqCadWlwPlx1MDAwNolw9Y+/dHnX3i9cdTAwMDOaoLOaadMmtV//9W/N3O3gXHUwMDEzNLe/Xav1i+dcdTAwMWOM3m5378CTSvxcdTAwMWXhtW9cdTAwMDdCadAtPySPLTwsjGsn5fP+Jo9tXHJcbjtuQDfaT7W+alx1MDAxYvzjOuZH1lx1MDAxNpl48Xtx0r/3y1x1MDAxNrDIMs7WbVx0uYM0tabLo1rY1248//ZcdTAwMGXJuTKNvf1cIm5cdTAwMTZYTDdUToy71+2IQmxIw9BcdTAwMGVChEqsX/KBuVx1MDAxOIkhn7Rqo/9cIlx1MDAwNVx1MDAwM1n6hmRTcm5cdTAwMWTNgC/xYynVXHUwMDFiX9O5OqSQ1Y7X3D4rr1x1MDAwMk1cdTAwMDV19Vx1MDAxMZTTnIGxgYV0l34wjF/0t89ifCSn6obe385FVlwioVx1MDAxN0hFw6j7l0zcXHUwMDE1olx1MDAwZlx1MDAwNFxyIJCSltxcdTAwMWPZz1HPiPJJ6Vi8dr2QJrhBXHUwMDFjOU51k4ve/qvlw8qzWniga1JcdTAwMWGvzOKeZuZcdTAwMDKzKEulQyvuMTto2zSrXHUwMDEwJuWa8+razkSEJ9S7UZ/lj9lv8UtcdTAwMGVcdFx1MDAxM/rZjUlua1x1MDAxNYQ7LpNDzZrB+rL7p3Y8vu/QfHqSXHSo82Pmyoloj/JcdTAwMDZcdTAwMWX878ZcdTAwMTYpZ648yaZpXHUwMDFkQ4S9gVx1MDAwZqmvi3z2XHUwMDAwWUk5siqOY1BcdTAwMTOoJkGFktaDZTaHwz8jrYZcdFx1MDAxMVx1MDAwN9jhKNhrXHUwMDFk321eP7DiLVx1MDAxMvn5WF7Uf/RMO8tQNMvT+4/hXHUwMDE5YVx1MDAwZVcwxrLfiHt2fiWiVmeF49KkfWjXLo2aVadcdTAwMGX5qDNMfqzAPVDLUN9cdTAwMTNcdTAwMTKYvzp2JVU+S3Z9hmFS2/XR4qNFXHUwMDE3Knhyw7/aXHUwMDFkqJ/Jgj73gOpM41x1MDAwM17ztfqZgWHaeYP7xnO0b2Z0Q+7d5069Pv1cdTAwMGbCudX1S3DsYU7Kb51cdTAwMDDN328mcIJcdTAwMTdL79oq/chcdTAwMTJwt+7ZLHow5WNQqDbcroGLZlx1MDAwYrvkXHUwMDE2izJTWyGgyVx1MDAxOOHxTiU5sHbr5+2amImaXFx53F/UJ+fL04s7NVxm7lxiQKl3sPzKJVx1MDAxOT1cdTAwMDXlMMHR31x1MDAwMfjiXHUwMDEzXHUwMDAz7uNv241jpGXBO8xY3mpKXHUwMDBiuZ/DXHUwMDE19fNz4U+rUlx1MDAwN5tBy+XaVUpC6p5mVz1JrVx1MDAxN9pqaru9P9qrXHUwMDA1XHUwMDBmMVJcIlx1MDAwNDhcIp5CebpoXHUwMDEwdbz0b3ZtnH9V/1SQoZpcdTAwMWarjULOXGJuXHUwMDAw3Vx1MDAwZctcdTAwMWM4vtBRgPRcdTAwMTX4sTLSXHUwMDE4sbI15H814F/o6m2h1sW/+qpwLKi7XHUwMDAyL1Yx6sLNXHUwMDFmm1xcvazi0Df+rEznXHUwMDA2v4nPiGiWuceA/ry/XYJcdPOuXHUwMDA2bVx1MDAxNlx1MDAxY/dcdTAwMDMjPug905x9XHUwMDFiZDtvXlxcgLhq+oRpKM9dn0BSXHUwMDE4g88r9fNRVFx1MDAxYmKyLlFMkJLtTsWI4Vx1MDAwN+Mr6n7hT1x1MDAxNM3DJ+Ssvlx1MDAwN6xOxbk3Kpljzn9AN4tcdTAwMDRlKf9bXHUwMDBmXHUwMDFlXHUwMDE5d+X3WM7/3S/PUFx1MDAwYjtcdTAwMGVr/+vu7i9zS8BATEYzfzVcdTAwMDMlq8uQ03+1mlx1MDAxNa+YLiuzhTlLNDZ0dEenYF/csjxeU2M9Ly3xqcJkXHUwMDE4+Sk65shLvJGUrq+yP0A7XGbQ8vvSb7/mliCiZn2+x+szyH3Nscti5E9ljSEmXHUwMDEx+vdk4iZOa3+6XHUwMDAw3iNSs0dPz60k/Kz/7esgU9cyymirXHUwMDBmTW0zY1x1MDAxMqVP86R8Nlx05rFcdTAwMTPOY7/2XHUwMDFl58/rXHUwMDFkw89trfN0wX96f+o+/7f39yjxheA5XsbhXHUwMDE5tFdtraWP41x1MDAwZVx1MDAxOT1Mklx1MDAwZrGGXHUwMDFmr46Os+rcRqB7ibbqpD1Dz8ntb78yTMRcdTAwMTbvYpDrsKZH822Vz1duXHUwMDE4J8i8XHUwMDE4ol+15Fx1MDAxOas0P6F9cnPtx7WTx5WoXCKmq6Y60Vx1MDAxYuRCZaPtQtXmq3ajecxuw1v/MKYkhy74/zebw6fivOGZ7XrXaKdcdTAwMDd5gHepy+3141/bz/jhVeC9gmiZrVM8wm8wctPBjcpOQ1x1MDAxMW/7VYRcdTAwMDA3XHUwMDBlXHUwMDE5l2tHyNmoZ/6jXHUwMDFm481dRa5cdTAwMWGym/l/vpfbI2/mPlx1MDAwNbpcdTAwMTbJT1xiob+8ts9vJfN4hsFDJlx1MDAxM0ZcclwiXHUwMDAx4n3IseefXHUwMDE5ZjOR8Fx1MDAwNmk6YptcdTAwMTXAnIDKyFhgu89rh5SYpawmV1hPXHUwMDEw7NdpZPep6YnQ/XhcdTAwMDSepvyWXHUwMDBmmbzZNXNcdTAwMWJmXGJcbnDI2EZ27deV6+KHwFRdXHUwMDA27aH4dGlcXOp/estcdTAwMTZcdTAwMWRcdTAwMTP7VWyEVUO8a6xVyegwXHUwMDEwsXqVv46anVi7erBcdTAwMDZXNUcwfFHRgTFs+v686eu/L716kPnx+1vs6mq2Ta1cdTAwMTFzMuFtXHUwMDA07rOvcHTyTvwr/7rcjVo3q5Szd86wVbD5XHUwMDFm8fwxXHUwMDFj5flcXLzok1x1MDAxOF9lPifVTf+rN1x1MDAwMWmiws3rzXNcbiVdhcTHmU+YXHUwMDEzRlx1MDAwMFx1MDAwNlao3l5ccm1cdTAwMTj/t8so3T3XMrFcdTAwMDeiXHUwMDAz7ofVaZiPc9kzN55ePGWHXHUwMDFmXHUwMDE2Z9nNqKCRm6u4x/hcdTAwMTOw2/XaW4rANPE+cE7nx3fswr9k5uXfzuvJfPz19n9YZeNcdTAwMThv7Ev2XHUwMDFl9a2LV7Dkgr7LxOmFXHUwMDFhQ+M2KVx1MDAxM0ChJ+M3PK6Vc3YuUVx1MDAwNlx1MDAxZvTGXHJE7Lo68UKL1LVf9ubsYftDXf7DUyyXRISRMVR5fvBhxbZJ0lx1MDAxOTDnllx1MDAxNZuR+FN3YVx1MDAwMm1E4TooXHUwMDE3089cdTAwMDU6nLuOXptrfkR8n6tUWK6/fz/TudOFpYnYuF69nlJcdTAwMDdcdTAwMTgmTbVWakP6j96uu6ry07i9XHUwMDE0NUXAm4vTiUCnL12gXHUwMDBlXHUwMDE1V/C0b1xc8F0m8lx1MDAwN97nvpLHwbXxwjHKXHUwMDEz0zh+QyGWQ7bQVFfssfNcdTAwMTHCeyhcdTAwMDRnTYreSp66XHUwMDE1xV6Kb1lqUOrZXHUwMDFjPejIYjNcdTAwMDV+XHUwMDA3qtVcIi2fxDAyoPs6asbaJlpccp/D2alk9eGjd3/lU1x1MDAwZlx1MDAwM5JcdTAwMDOq2DRC8Vhd6Fx1MDAxZsz5NJlcdTAwMWJ3azySQN7r+1x1MDAxNaWGiUB7XHUwMDEwyPnaPztcZjagj/rOjfdcdTAwMTgmTVx1MDAwM0a/saP6522dKZGv38fwNGFMXHUwMDEwqpeDV+JtslKT2YmcXHUwMDExrSPlbuV9M2g7XHUwMDAzZi7lTzx4S1x1MDAwMbirgEZCSN5N0Mxiz7IxwYlcdTAwMDf0O91cdTAwMTHl8lx1MDAxNiS5b/PRblx1MDAxOSDav9D1dev6jYVUfUCzXHUwMDExw1x1MDAxN6k471AuWnJ/56pI1Deksu1QmVwityDl5W+OSKrvPZBXPzRrfK9f7HKfNzaRdjyYXHUwMDA2mOZuLOPcVvudhUuuuPLG2Dn13WrvkzBcdTAwMTZcdTAwMDNcdTAwMTOuoVl416WZVDL+lvPdXHUwMDFlbEtcdTAwMWKuSlxmbaqzX1x1MDAxOdmMkCTgXGLNR427n0F622pcdTAwMTn78jn8Vqc6WKUnpWs2dYtcdTAwMWa+7PA/8rbKaFBcdTAwMWXyXHUwMDE36z7Jj2Bcbq1cclx1MDAwYrQsi5JIq1x1MDAwNCCORFPBe1Dq6lx1MDAwNlxukmqipJhcdTAwMDPk2lx1MDAxYr9lRo7qeiPHgHmxn1x1MDAxNuJcYvpvN7my9lxuZMtYSTphQIUunbnd5/ab0Vub3IPJXHUwMDA0tVs66PhcctVJbf96jeU1glx1MDAwMph8d4nk85/fUpA76lx1MDAwMY+71JFq9ZffwnQh5HA3jlx0PkHYk1x1MDAwNEZcdTAwMDBcdTAwMTebV7r9NpBfXHUwMDFh8I2wevBcZuR+1mdccjOhvUN7y/bmWqDywFx1MDAxZFLZgIToQZb7MryAXHUwMDEy8lx1MDAwMoOnwdXXpmck+t6aiSyNvo2Ert4hr33W6vRumVx1MDAxZkZK2+NT7uh3XHUwMDE3emQvXHQ0XHUwMDEz/mc361x1MDAwZtLL4Vxillxyfie28otDzFFy4/qrJcOUZ7tcbl9cbqjvdOVcdTAwMTOCeFx1MDAwMOG924ia3r1cdTAwMTd1VJqDs95kydiwP/448KVDMGdhQXwtm3/upeFcdTAwMTeNfjni5VqGyjHyLd9cdTAwMTJMzlxcXHUwMDAxm6nq/TWfTYVY7puJOpGU8JhcbualMqFcdTAwMDFcdTAwMGLs8yHBtPtlpaiJXHUwMDBl6OvvV7WDUIhKXHUwMDA1Pn6oXFw/gzH99c2G/+hcdTAwMTBcdTAwMDRHXHKkhDa2rYzxKUtCU1x1MDAxYpV+f7DXOPvQS0mtXHUwMDEyQMy9XHUwMDAzu9J5fjvxqLyFKlxiM+/9+Nys9IaqjIV9f+SQg9dcdTAwMWWwKlx1MDAxZelDc8V5McQ7MtBytM1jx+Z/XHUwMDE1zHtcdTAwMDYpoOKl0a1cdTAwMTBI03twXGb/sGWXi5RSmpk9Mn87wsgxWFx1MDAwZdf/21/P8f3IXHL3aW3d91XzVJZeM1x1MDAxM++QIzFVrFx1MDAwNP89ayHNeUvpn285WGrhXHUwMDA3rFx1MDAxNLU87V5cdTAwMDG6wM+lcFx1MDAxY+svxt9JO+Lz/+LNtb3baflcdTAwMWRY3rzg7Ck/TVx1MDAxY2O10UDCTPBU0HxkbGt195dycT3Pdj/5tGm9TLyBiFNiatvP+bF52DIzXFz7f4NOuJd/ZqbwXHUwMDAyqWJcdTAwMDe/b3xcdTAwMTh/Lj74aH9IKXg72dU099N1/c7fSWd6cE7OmKxPMFx1MDAwNpCwPi+441xif13MmNrVon5GXHUwMDA35IcwXHUwMDA22LyarTrV/NtcdTAwMWSlM6s48MHKzO2E39U6+Vxci73iV5Ju/YPXJMqpNC2/5rtKXHUwMDFj4EhJbFx1MDAxMLfEZTuD92OxbTT54JOKZf5cdTAwMTRf+1x1MDAxZL2sxt5cdTAwMDGZ82JnV1x1MDAxMMK2K4qbzuYuxlx1MDAxZEFVOtO7neOOPFB8potUdWioXHUwMDE2WVxc5zuh+1x1MDAwNN5F0KWK8ZaMWlxuVTZcdTAwMTeYpVOAglx1MDAxNs2j+5LztVx1MDAxN2lHXHUwMDE0fVpcdTAwMDNeqp/uUIadXG78LEeWPsrguXB98iDQVoCk/fFiqlWDzFx1MDAxOWxItT1XXHUwMDA3pW+5/H4jpVx1MDAxN/yo8l7izC3HqN9rlfBB4r9aKyiJhtl3s4tcdTAwMDefXHUwMDFjPN39NP7P0DvN+3xEw/D5z7dcdTAwMWJcbkiqufNX3IyMI550lTPUuc1cdIL2t5zrUcJBV3VGU5ogZlwiQFxiNCpcYiYgaMHzXFx/8HK9XHS9bFx0ki953JzkSNJkxceP7ui3XHUwMDA0d+j1qUJcXFJKmlx1MDAwMy3ujMuzXHUwMDBicD+GnFFAguZ41tZNoeJ70FpJrTvgw2iGUD3pgKupQnanYsN6ckhE2a2j941ON5thXHUwMDEy1lpExqBbXHUwMDA2oDdcbs9w6n2YKLNcdTAwMTCddTsp7oR5eJzKic1H0nDm16XTtUpcbrHOiNHlmTi/gfJcblGPbGZcXNxcdTAwMDNPKHdDvSffvChcdTAwMTd/XHUwMDA1Q2yyX52phql+vFx1MDAxNEU0f1O3f0lR0YPtmstLXHUwMDEwrsC5LzdWnYNhX1pUvuy3Tt637cNcdTAwMDVysM13oGfk91x1MDAxZCRcdTAwMDBcIi7A32G48aGJVVx1MDAxNDCcXHUwMDAwXHUwMDA2Vsjr+VwiXHUwMDE2yZpcdTAwMWLF+nntnH/aaWg2OM7XiqtcdTAwMWSDtaJYhstH81e7XHUwMDBmP7+cZz1m/ZGSnL5e7rXfa1c/d5yoRraObD7U6WXIha/r3fiMjtNejabAqENcdTAwMTZwX/rMh2n2XHUwMDEwu1x1MDAxZu7YXHUwMDE5XHUwMDE1fOTa9rWeXHUwMDBlXGZcdTAwMDWC0Of2e+xmSYvd9Vx1MDAxMFx1MDAxMFx1MDAwMnVHXHUwMDEy5H5ok1x1MDAwNGAh/H+qdoND7D/OQO3Q4sucRrcmdLeL1+hMVZo5fe+/XHUwMDBlXHUwMDEwgXZ84X3jYVx1MDAwZSY78P56fs5zLlwi+lZWz5ubmVx1MDAxYrlcdTAwMGb6eS2zRUFZPVx1MDAxZfF7XHUwMDE2l9qPgPdcdTAwMTnGj1TXTa0qKVx1MDAxMyB913AtXHJzkpW+UUjjXHUwMDBlw0O2XHUwMDEy+ZHN22dcbvRcdTAwMWLFQ6TMs+LqUoZcdTAwMTNqKm7opFx1MDAxOKeQq2yMZueHO1wiyFx1MDAwN7qnXHUwMDAwM4hn25lYs7Jfd1x1MDAxMFxm1ixe6mtIXHUwMDA3wFx1MDAwMZL73CF1vfO6pqTRJM7p7Y59m3W2r99cdTAwMTbdIVOZY9OL6lx1MDAxYrtpJtl8m4i0XGJr+VlcZi6vSOuzg2Rx+yFbMLh8P9JWP+ZLeyU7RzC161x0XHUwMDA0LXRBXHRfiv/S1Fx1MDAwMp1vpd9DLMRBhmOC7v5ieDJC7nVAIP1+h26Ouu4gXHUwMDFkfHlcdTAwMGbGe1x1MDAwZb4kR23ffDQ1XHUwMDAy4LOQYPg5WO5kaigoYt7CZalcdTAwMWXYu9NRXHUwMDE0zJI+XHUwMDA2ml3qXHUwMDFlXHUwMDAyxaUwp4wlVyPbXmH+maP9mzaldFxibUHAnsVcIj+sXHUwMDE4aVxcYbr9kP6J1691ZVx1MDAxZpp88DG1XHUwMDEx341rVNnh3ju0PZ7kN/Fm5swpg6CT4jdPVMziXGZbvetcYlx1MDAwZZ7iLoZ0s8l2mt1SXCK7SUWLX7/NJ0VAqjRIOyTwnYV214hcdTAwMGVcdTAwMDX0XHUwMDEzL+pcYigqiMmJivq3MLv7bkZWpbWoiubCiVu1MMhPtFg4YVxudWOSeN+Suycuf1x1MDAxZEnz31xcT/MoxMgy+WtcdTAwMDf4b1x1MDAxYSpTUn9cbqZb2S7nQ0wqgVx1MDAxN4otiXmHbpwjI2FvenuSJ3yhw9Vws3JCkU338D/X3pDBJL5aXHUwMDExirWD0y9l08qrt/L+dX2vL1x1MDAwYkQ/q5ojhKOnxrdcdTAwMDKfS1x1MDAxZoU+kFTe6mjmk8xDv2U9zPdI2CvWYp7sfi1hXHUwMDA25c1E6sdcdTAwMWIpjm73XHUwMDA1XHK+okk6se1cdTAwMTXiu8On8WNcdTAwMDXBLkeCmnrMTakjXHUwMDA1MjhcdTAwMWSx9JhcIr4pWE14kWNXhcjp/Eu0IJw0INiwmVx1MDAwMeDQWsmnTIC8oYGwPtDUVshddTlDsP3Q7eGgqPA6RM1OVEa/QWz0kZ1cdTAwMDVA61+mfVx1MDAwYor1TfNbLFx1MDAxMHhQ3uQon2fDQn9EPkefmoR+Kmey66RcdJM7Ovzwzlx1MDAxZGLQObu+pn5nX1tLhfmC69VcdTAwMWIxwEJOrmFIVT3NYNpcdTAwMDXa91PpXHUwMDAz/Vx1MDAxNqx509RcdTAwMWU1rCbFXHUwMDAx0TFuXHUwMDE50W9vav5cdTAwMWImXHUwMDFkx8bY7T4lmnLkwzs4XHUwMDEzXFx1f8nzIFxmjnRcdTAwMTdcdTAwMTilmlx1MDAxOVGCNI7Za7yuvClcdTAwMTZcdTAwMGLvXHUwMDAz+j9cdTAwMDEppjlB2PSDPM1cdTAwMGXVXHL7cLSJvWEkvn4zw/E4QPTK+8Z1XHUwMDFjy55WZqYvk1x1MDAxZnfNVPxhaTlcdTAwMDHZ+UN4Lk/M94TgWtWKSCZuiHuUStqrS57u5jxcdTAwMWWa/lx1MDAwMOJW3TLnXHUwMDFi7HW4ZUBoduzQe1VH2Vx1MDAxN16hh1x1MDAwNy9cdTAwMDX/7l6JMTWg45t+pIRcdTAwMWFOXHUwMDEy2Vx1MDAxMCnOWoeD4r5cdTAwMDAvoN746T//n+zU66wqQVx1MDAxYixYsFx1MDAxYkeGON9dXGZcbv75sNGrd+xcdTAwMTjVQJNnJb/PNyffIzfHo9ZcdTAwMTe248dF3v3SPjSuPFx1MDAwYsyulLcleU0wxqrAUMGHXHUwMDBiIa5cbvmElDc9krng0OvsI8WTQFTcwmTcXl+22N3k8dqjIFKyXFzHLlx1MDAwNL1bioi3pdnvi9Cd48JYSz5NXHUwMDEwpN5RtcZE9O7TwuR+cmt7mKZcdTAwMTCE+OQkXHUwMDBmL/Z+QCnRldiqUlx1MDAxMV1xq59cdTAwMWY5nqcj8UVWNHnx/6PqOrZexZX1XHUwMDAzMcBEw1DkXHUwMDFjXHUwMDFjSDMyxiZj0tNf4d29+9xJr3XW6fYvpNJcdTAwMTekUlXpuby8Km3/XHUwMDE50yyefFx1MDAxYrDhiHfc68LMjHCUR9xcYl+F8kBNs57l4SymTVx1MDAwMrDSgfjo10XLu2q62KtcXFx1MDAwMLP63one0qWrlr35Rb5VXGZccrTWjjGWlpY0JogrUFx1MDAwYrzpXHUwMDE0rtqpXHUwMDE1bc76/8I4XHUwMDFi1y9nhGCZo8zmLU//8uNnXzLEgFx1MDAxYrlUyiPg2bOuz8LltKi85Fx1MDAwYjtcXEOdxLeWXHUwMDExvFUkRixcdTAwMDHrOLkvXHJJXHUwMDEwVZ555EOH/WptlrX9cL2rUJlNXHUwMDAx2pNDaX/9PzU3d/beXHUwMDEzvUtKTl9eX5BcZlxm1FAoxmBcdTAwMDBcIlx1MDAxMVx1MDAxZV/Fhf9cdTAwMTXq48maSi/SL3tcdTAwMGWMgsu5XHUwMDBi5S9cdTAwMDXTv1rEdnZMW/Mhvq+t2NlIyObe7XuKYLNfSj7Q61x1MDAxNUUvkKHOuCpcdTAwMTXm0lOQ7u9PKYM4ZYRvnne9l2xDXHRtpVp4rS5cdTAwMDHUXHKCwm3MZjc+63nz7OFcdTAwMDZcdTAwMDdcbnQwNVKSz8awYG9cdTAwMTDwLN5nzSaEXHUwMDE2XHKQ4Vx1MDAxNdH5uyk9XHUwMDEz4SHlnttBXGZdZGuM2eW+VimZXHUwMDE5N81JsffmfVx1MDAwYjX9bIiDxmdPU9HZXHUwMDFlolx1MDAxM8E1u4RHb+trgm4uXHUwMDA3flqqWMOvPFx1MDAxZJGjXHUwMDE2g6uTY6lcdTAwMTk8t4pXPVdPXFxaSnZ6K1x1MDAxY+R3XG7u7yvwkGnEye4qtVx1MDAxMPLMorTD+Fx1MDAwMJFQj+09eVx1MDAxMluSlc2aj1lVe3G0XHUwMDFhV1x1MDAxMEaBl1x1MDAxOC3Lx6tcdTAwMTaAh1jAjVx1MDAwZoH2I0JKWHrqj4Z7gfhO5MvU6sb1PcJcdTAwMWbmsrufpttcdTAwMWGBrV9cdTAwMWVPf0SCMaxpdVx1MDAxNFx1MDAwMvCduM+WTaH8yXZ05XwhgZhcdTAwMTNPd51cdTAwMGJJIdOHMXjOpuFwXHUwMDE5+UShXHUwMDE5XHUwMDFkqlSVI1x1MDAwNFwiY0v2Pz0oNVx1MDAwNzOgN1x1MDAwN6z4mauhgFcq2HyWXHUwMDEx8VlcdTAwMGZwLiVbJGPudmZxrKvq0587y9i+XHL5T+yJXHUwMDA1yrpcdTAwMTCFe1x1MDAxN51cdIrCMo2bXHUwMDAw7mNav7ZZ/ICLqmRNxvR5kPDQumaBd31K7I6tOytcdTAwMTaXXHUwMDA1jbLdkJXrXHUwMDAzTKRMXGJjz7+QOSZcdTAwMTXCelx1MDAxY3aBKZ5LYs+PaJpcdTAwMDDDhzw0htcwdDNbnjlZXHUwMDFjRqz7XHUwMDEyK2Sd40LGSTBmeVx1MDAxZdnDmlx1MDAxMlx1MDAxN9mpw5RcdTAwMGbcKT15xlx1MDAwMqd++jBcdTAwMDJbrn/0U1x1MDAwMFxuuOW8s4ZxkPZcIsRcdTAwMWLUPdw+qOTpvPIw3EiJ0/t6XHUwMDE1oetPOlu/VnSlkrjcTpmPkdFcdTAwMWPIXHUwMDFmJzpMZtEyNWwnoV1cdTAwMGZovqPnk+WXXHUwMDE1fKWvw7hcdTAwMTe2UMVTgof0ll5WXHUwMDE2XHUwMDFkXHUwMDFi7NZcdTAwMDFa4Fx1MDAxZjfEQ2WhNFHfT5BnXHUwMDA2NcCIsmH28J1F1dazZsSDtFx1MDAxNuAkJ7gr4JJcblx1MDAwZnG4LpflqV3h/3p6aOTN++aClWevXHUwMDE22JCSqlxmk3ub5pfVLEGQk2SIUPc2YFwi6TxcdTAwMWEzTa5cdTAwMWWmj1FcdTAwMWWOXHUwMDEzV6xze567mVx1MDAxY++smlx1MDAwZmomKnnMXHUwMDE31fw8kzhkXHUwMDEz+kNKXHUwMDEyIK5uXHUwMDE2b8xcdTAwMDadnGdgg2N/v7bVMWohoMiYojQ9XHUwMDE0b+PgTGFcdTAwMGJ+byCggLVW37e3Z5Ijzlx1MDAwNr1cdTAwMDKnUrpiOlx1MDAxZnrTyFx1MDAwMjVF4uaM+vxcdTAwMTnsLVax46E8SKlcdTAwMGV6S7n9qVlcdTAwMWRfeU8nXFyGXHUwMDFjzOt9TLq6zFx1MDAxOJ4nXHUwMDA1Mpo24XyXXTdY036PONvOmDnfQ1x1MDAwM2VJcFZSUpQ0t1xcrb5cdTAwMTetXHUwMDEzQ965XHUwMDBlTTng3ll71GIzUZlcdTAwMTE14fBcIoa+XHUwMDFkxkVcdTAwMDI56YKLjLs3q1x1MDAwMTGzXHUwMDE0zPfzxW+rnoB5M5TUaWhOIdVRYoPdS5LpyTN8zeX8meaqXitk3VpAc1x1MDAwZVx1MDAxYVCvZEVSSOpdh4XvXHR81uxcdTAwMWRgfjNcIlBRXGJcdTAwMTlzOWtqQVLhsiNlrfZcdTAwMDNxf4jzllx1MDAwMVx1MDAwNsT04858Te5cdTAwMTW6JSOi9pWPXHI5jX51r8eJfZRcdTAwMWM+XHUwMDBl7KQjlEtcdTAwMWGzXHUwMDFk5KyLY0LNj6uY2zipXHUwMDEx31x1MDAxY3ygnJb/vC97YseoQX2tXHUwMDA1wpUqL1x1MDAwZm+ViY+Yc1x1MDAxNSRcdTAwMWRuo6NUwYPjfZz1cFx1MDAxYZlSSSUsUM2NcCRgdMf89jRLarI7ksSVMS3cXHUwMDA3en7RXHUwMDE22Vx1MDAwNpn3uVx1MDAxN9BegmS5SOxVldxcdTAwMWFuR8G7rdah73UgNlx1MDAxN4ApT2dcdTAwMDEr+dVpuG5RfdYyXkrlmqXZJsRcdTAwMDWwgdpcdTAwMDKXSajLw3n6nH5avjqOXHUwMDE5bJqeJ8DEXGJvXFzOuqS28Fnl6b5cdTAwMTFcdTAwMDL1a05cIt938Ya/xWBhQ0SwldTdb8aFZ7LhpbFesvRea1T/cIQugXsnXcHManLKY8P262WN+SxFrWePmJeVYsTnXHKI8NdcdTAwMGYjRY1cdTAwMWPUpGtcdTAwMWI+QYP4e7vzyFDw2C1cdKas/WDnXbrT9lJcdTAwMTS0UUOIPfgyYvuR9OlcdTAwMWJFlVx01y9Lg3f80T6vXHUwMDE1rp/BjpKwXHUwMDBiXHUwMDFkXHUwMDFkfVdcdTAwMWOYsSinVq+Uz9TqXHUwMDAwZexSUb4/XG6BcCjVN1VcdTAwMDNF0iHKwORcdTAwMWNcdTAwMTj5cFx1MDAwN64r99iz+Dr++m9cdTAwMTBX43W+I5VcdTAwMTDvW91cdTAwMTc9XHUwMDBirZKjyy9DXlx1MDAxZFx1MDAwNnhHjKJXltpcYtHyqFxmXHUwMDFjWrXubZ/lXHUwMDE49ZpcdTAwMGJcdTAwMTkhyVx0QOZcdTAwMWTTotD3R5NcdTAwMDO1bFx1MDAwMaThXHUwMDE4XHUwMDFhvNxcdTAwMTa25E40dlx0fdiZZyX2X1x1MDAxZWXA0Nh1UWCeUixpRFx1MDAwNUjHyu0yiq30eNVyPGBcdTAwMTgkgjwheXGtXHUwMDE4+VpcdTAwMDecnV2HXHUwMDEy6mi2lG1cdTAwMDWjNLRFPZyTQYKazU1eK3OegXZf71fnIytcdTAwMGKj4nyGR8lcdTAwMTaXvq9cdTAwMTeg7+n5Wm3ue+LnNVx1MDAxMVx1MDAxNapphlxiLFmHjlx1MDAwYkk8tIeFTCaXXHUwMDFiy9f9guzhmEd0l1VcdTAwMDSO11YmKtk96P1D9Fx1MDAxNS1cdTAwMWO14qigz5Occ220Q5Fn2rJy9ndnkiVHyay3Usp461x1MDAwZr5eMzjrfIxuXHUwMDE58H3oVp1Ur0RcdTAwMWWG3MtUqvYypSviXc83S1x1MDAxN95CbrSIgnqnO+wlXHUwMDBmnlP2XGZ/al/s06Be5Vx1MDAwZczhsm2VU6ntt1xupCZptVHjnn1McytIXHUwMDAz4Ydovtr3vm3joP9A4VoyZv5cZkIjMi7L2fthvUJt1N1qXHUwMDFj/UaQ5r/p0F9ccq+vXHUwMDE1XHUwMDBlXHUwMDE4W64kzGOehTJyz25Jy6NqwVx1MDAxY09cdTAwMGaEXHUwMDEzVtxcdTAwMWWG+Vx1MDAwYr5cXK5cdTAwMWFt5idcdTAwMTj1yVx033ND4nk2WSptZELU8Vx1MDAxMtr63VlPXHTQ8OwlZ+7DPsZhmVapXHUwMDEwr5c7dLVhlXIpyVvThNmFOTy/XHUwMDAystq5cVj7+77pKshccuinUVx1MDAwNZy5/NDTPS/pxy625at8kyfuXHUwMDE1KVxcQTjGyqhM3Vx1MDAwMVx1MDAxOcmQjyA3Ov59nrK878f+tDmrfDBcYk1atyyDXHUwMDA0XHQ+3aq8sJ34eT3qfC/NV8vBJFx1MDAxNlx1MDAwZa7bV9Jzi1xcwJvCXHUwMDFiaDtcblxmXHInUYRcdTAwMTN7XHUwMDE0RTqdNW5P/m7FRf20vffT6U9cdTAwMDa0jj7mLEOrXHUwMDA1UHYotkv58aemIJX6XGaHqliYoFx1MDAwZo9zrnNcZvGqpYdcdTAwMWVcdTAwMTd1XHUwMDA10mlcblx1MDAxNaDLX+0mXHUwMDAxt1x1MDAxN1x1MDAwZvchIPeq5Eh95pWy1lNcXJKwOnfVXCJpoTZO6k+bP9Dl+PWj+VxcszcpXHUwMDE3k7NcdTAwMWWV3tb2XGJcdTAwMWQw2XxcdTAwMDKXJkxcdTAwMTe3osVWjLCaXHUwMDE0qFx0lrWdpCBcdTAwMGWljIdcdTAwMTa632lcZtolbGalpG0pP0JbYcy6X69cdTAwMTlsKUShtYqUXobgTd1cdTAwMGVcdTAwMWMzXHUwMDBlOdXLolwiXHUwMDE4USuv9+bLnodcdTAwMWNVQHKjIH357NqWWv0zLkJcIudcdTAwMTH9WvlcdTAwMTW6RV05XHUwMDEyXHUwMDFkYEjYnnfyy4FHVuyEl1x1MDAxNe4jP8t2e/J8NVx1MDAwMSwpWpKklSqAgtSFSMUlXHUwMDEwo7IyRPi0sMxjYlSR/FwirLJahPHalsuOXHUwMDE5pG1AX8WhXHUwMDFmzcfxO2WcZpSxaees1FFhuS/5z+asS7mb21x1MDAwZWW11FdeyEtHblx1MDAwMelrfS98MFx1MDAxNEBcdTAwMDbaXHUwMDAyY8tcdTAwMTK3c66D9XlWiflcdTAwMTePNoB+iu/Lnv688WhccpxZeqMu09RcdTAwMTn3ddzfJZxcdTAwMGXTV6hcbnl7kt1cdTAwMGZcdTAwMDZcdTAwMThPXjlcdTAwMTbz29WBfoVcdTAwMWZ8e6Xygs6obumnXHUwMDE3ZFx1MDAwNFx1MDAxNHxSwfpfL/hClyh8XHUwMDBiRFVCXHUwMDE08bGGIYnpXHUwMDFhymMpTfaw7+P+PMryQllcdTAwMDe+KVx1MDAwZj21ylxi50S2XHUwMDBmd+HMwU1AMoGNf7VuN53tXHUwMDFhcuyrUYae8Jdf73RcInJObMK6XHUwMDE42UUxW9nRfejLtiR8lHRbf9zvkCRfySws9qx2cMzcVMZcZlGyy9eIVN5wO2bi3mvuXHUwMDBmXHUwMDA2fW2eoDW1TVx1MDAxNTbsMlx1MDAxZMLZhsd0wlxy+Y6nR02w8uM/sVx1MDAwNvS51Vx1MDAwZl7xwT55P1hnXHUwMDEz741+lPFwI/X+vFxikzmdKEY/q6qyXGKW/MY8t9TRv+d4XHUwMDExllvsXHUwMDE40otcdTAwMTZxObZ94zW7sHpVPJCabaMoh+FcdTAwMTP49icrXHUwMDFkuPA4PqWOeTWEtzyYIbTNjIRXXHUwMDFh6T9MhbR5XFxqzYzLw9tLVOqIrlx1MDAxZUtcdTAwMDfJTrujXHUwMDE1m1x1MDAwNam2o/t2taMmiu/BMS57tN7ihGqikE/ciuGy116HXlxu/SjFyWp45iM91q6/aFx1MDAxYUBcdTAwMTW3R1x1MDAxYlxmh99cdTAwMDFcdTAwMTGGPPpcdTAwMGIw5Vx1MDAxNuGt7/Osr9NcdTAwMTUrUsN/ooJvwv2DviCUvKkrJVFzzq+SzbHX+1q/p27id64/XFxcdTAwMGIrMq1cdTAwMTd5XHUwMDAz1IpoqXGUn+9yT1x1MDAxNIjPS6vNXHUwMDAzVjH/6n5cdTAwMGKFPcQ2XHUwMDAzhJLJbkIwYmTZl+tVS1xiXHUwMDFhx4VcdTAwMTXwk/BcIpVEMCioXHUwMDFjtsdZ27QoenO1Xlx1MDAwMuTF/CXGbLWqPeddQ9RZyKp3uUD4sqePZc0ouzklhFx0MijD7TamYLl9iGLBwjG0RVxmXG7UXHUwMDA3rtunhMUkUkFcdTAwMTPvWrCdXHUwMDA19e18eVx1MDAwMVx1MDAxNaraXHUwMDEzyffNllx1MDAxN/325ZSOVGpcdTAwMDEuUvSemlx1MDAwN+PKq31rvlx1MDAxZbY5iGBcdTAwMTKaurdcdTAwMTBENs5sXHUwMDFl77QgjCi+XGIr36xK8YT6cDv35Fx1MDAxMtl/dLpcdTAwMTFcdTAwMWVcdTAwMTeZPT3Og/W+XFyw9z37kpOncta1Nl7CZWGCa/l6XHUwMDEwbejUXHUwMDE1z8KvtTIzf51VXHUwMDEyXHUwMDAxtaoxJsnfbHFrhvvUXHUwMDFkxIv8qqYxJsvAZVx0XGKOI+069mWPKar3Xfy9QrGrVaJ+ZY+ETZl+7NSv5CFD1N5KcEeoz+NcdTAwMDJyvOnDdVx1MDAxNC3UVGrlu0d0u2ou/1j11ztHfmdMXHUwMDFhXHUwMDE05XPih/SZ43NcdTAwMTFcdTAwMThFuMsgTVx1MDAxY/e46CenP22+MVwieS9o3l9cdTAwMDLkXHUwMDEzXHUwMDE5yPXJSsbZ9j2B5ptcdTAwMTjIu5DFnv85XHUwMDFl/e1cdTAwMTb6X8FwXHUwMDFkiFx1MDAwNFx1MDAxN5uby1x1MDAxYlx1MDAwZUTqXHUwMDFiXHUwMDFmSvD0QV7mqZBg9/Zx7kc5+OKoXHUwMDE3bShf5sIjgfFcdTAwMGL3LFx1MDAxMy4xSrP0m//qJC+7M/OFQnLHzf2Y0Gf1ktZs52UkOHtcdTAwMTdEQFx1MDAwMDbDSS+2Tv+Jf55cZoU7R8gyz81kaZVAJZLoti9cdTAwMDLZLXV7nqd8VomVx8tcctpcdTAwMDVcdTAwMWKT0sojjVxiOti27J5nn97SN1x1MDAxMspiML40QilcdTAwMDDgPH6rR13gXHUwMDFkV9hZSs5voGGcs+R/MndcdTAwMWTlm9kqKV8oTKmzr/TZs0IlxfPAXHUwMDE5IIb5+p2p8UXJN4L0maPj1yOgq1x1MDAxZPWN+H39XHUwMDBmJ3qf99XhUXMprJHzfjXpoYc1VOvapNR6OXtcdTAwMTWmnLFOXFxcdTAwMTKk+1v6VLHaN09cdTAwMTOgu2fJz7PPXlx1MDAxN1+R74FGlDCTXYo4pn/2kT77nTzeXCLZXHUwMDEzMeNT8+/cXHUwMDEzLlxiotyS17WxwVx1MDAwMmlDzu9cdTAwMTY9Pz5nzVxiw8BptJ+WXHUwMDE1XHUwMDE1LzxwuD/94M9+KrJcdTAwMGJcdTAwMGXM8Zmw9yqJO8/Dma1cdTAwMTT3XiWL4+aequBcdTAwMTZf8Fx1MDAwN5Ql8zA94z5cdTAwMDFcdTAwMWamN/DL4b1cdTAwMDH3+1x1MDAxZFX68MbK5brE/75H5Fx1MDAwZuw1J4GJfH7fXG7iR4H5cXq+pdfuh8dmLfKBXHUwMDAw0d+J2I8nuI76WTtcdTAwMWH+/4hddGySbOz2Rye9WLZcdMAjXHUwMDFiwzPGZFx1MDAxOGNFirHs54HxXHUwMDFm5cxcdTAwMGK0g8lr0nBcdTAwMWNuoTDv3Zgklvf7rt/8iGJbgtRhXCKqhZz4XHUwMDA1+lmmn75OTd6f99/QrqW8stI71Fx1MDAxMJGa/959qlx1MDAwMHGZurXlqubqy+I9/3yjKiOcSXIz877erqB7vMDfM7zPmaemYiZcZjlcdTAwMDL/XHUwMDE1qpeLaHv2LdhmTEzL8KzN/ftGXHUwMDBizpLTXHUwMDAzwUr2p1x1MDAwZdckqFx1MDAxOXTTyvlcdTAwMTH66XqRqEqG+vKZXGaSLZ9YaC5hP81Qu0hcdTAwMWRFR0P/b1xmQjFZMUpftnDczKbC/85W3Vx1MDAxMGyixf20MbvGSFvrIL6m9al9lTT9eu3bYSxoXHUwMDFhqo9w9lj49UdcbuB3QPxhgiVe0NgvQ1nRzjqmujLH2lx1MDAxNVOAM32abIhG//1cdTAwMWLPl1ZkhyZ46UXVysN6/lx1MDAxM4fA9Vx1MDAxYVEpXHUwMDE5Rlx1MDAxN6Nxye5cXFx1MDAxNPqIcF+7fT3LuJw8y1x1MDAxM0JcdTAwMWPMJSSsJqbn83ybXHUwMDBmMmag/1l7XHUwMDFlgOqtteCaOrTFPHSPKcOUSGlcdTAwMTd5XHUwMDA2ZOT1PLVcdTAwMWFcdTAwMTBv8DhcdTAwMGbRoMdd0JFbdL6Lj1x1MDAxMPzu/zu/UKOuNVx1MDAxMmqlMfFcdTAwMGVO1WaWuUB6bblXXFyj2C4+KyQ0fuCuq5j8zrSz6c/b9cbRvUdEdGKkXHUwMDA3c+b/iVx1MDAxZlDeSUkob1nbRNDL3vtVdXj92ZvEXHUwMDE1h1x1MDAxYXB0XGaoy7V50sTEXHUwMDE13lx1MDAwYvJRbFxm1OjlsrvrP/PrdT5cdTAwMDKe7sqePVx1MDAxNco9MVx1MDAwM2N0+5Sf7iP43Vs83Vx1MDAxNsPzT9NvXHUwMDE4hWWnbryqcFx1MDAxYqJcdTAwMTVcdTAwMTFcbtJKUzcukCbu3706VTfScPibIZjH4KmSM1uMjS7lb0y7KqL1g1x1MDAxZdLP8ppe+Pq6zcC+s3TKXt5iksv4XHL/d5407kE6XHUwMDA2l/17f3RbQTHSv/OUUFx1MDAxNa6CYnnbw7Sts596KO5d+75ejZHbXHUwMDFlV/FP75vf71x1MDAxOOzvns+YgITGSTWLisZcdFx1MDAwMuBcdTAwMTlFKvdOey/ag+Gq0mnn3b1EuCuoXHUwMDE5YeJZyMlLP9fRv7Hcnlp0LLVcdTAwMWIhme81XHUwMDAzXHUwMDAzI1x1MDAwN1x1MDAxZkpcdTAwMTm8JOouXHUwMDFj81k+fo2Kllx1MDAxM1wicDBcdTAwMWOTkFx1MDAxOGHDnUswl838d55cdTAwMWbd/SylcGOBV3lv62veoGdcdOZcXEA+S7WEXHUwMDFkhbq3XHUwMDBm7p8x7NiIIztdsKLsi9d55e+ems/yXHUwMDE4ddlcdTAwMTHPh69cdTAwMTBcdTAwMDZcdTAwMThSgF9zpp+mftJcdTAwMWZAuaSoVTSZoZw1z1x1MDAwNTU+ICbjkcPhxfv7kJqzN/yvXHUwMDA2P2D4djVzXFy0UnelglAuysqW/Vxi9yPeXqVFwFx1MDAxZoG41b9cdTAwMWWsJpuQj1x1MDAwNWhtXHUwMDAzQyz8s1x1MDAwZs6+PYZcdTAwMDTOe1x1MDAxNOn66sgr3KE0XHI3Ja98rynlXHUwMDA14XeSJJuP3sY5jutOk/1qXHUwMDFlzDw9TUxcdTAwMDO/vX2WLc9S3kAmimNM545w5ZX+VIn/amCUXHUwMDE5iFx1MDAxMkNccuRHXHUwMDFmqPNRI2Fb92ruMvs4xPJcdTAwMWY8l3MuIPXR6s3kijTUsZrOtnPWM3M+8bq2mlx1MDAwZaPe5lx1MDAxMPk4anBcdTAwMWNDXHUwMDFkfuSVo5KEXHUwMDEwUNSIhat1+3dcdTAwMGZppKQgyTK3RlSLRpPS7a65+VZcdTAwMWbvgFx1MDAwMd5JNuv6xvBcdTAwMWREgnbrjvvLpsPyMHa8so/nv9jL5Vx1MDAxY2JcYlxy5URp1phh/rw99kdmXG6yuaQ0+XK+jvheQS6ffVx1MDAwNs2qXHUwMDE0qUhVXHUwMDAzskhJhHnWavKX68xKVNU/98Wt+Eb6j4y4YFx1MDAxNVx1MDAxNqCTT7Q566HJYFx1MDAxMSNcclx1MDAwZjn4Y+XpXHUwMDEzy8slhIxXpVwiidDRS/tcdTAwMWIvjduJqpOw07RcdTAwMWGYOXjQPz1cZvpNOFx1MDAwZmvheFx1MDAwZdGM40tcdTAwMDZv+1teTnyYrsRGXHUwMDFijGAuRiRcdTAwMWP/zc9ccjpmoE+UIFxiynh/4/3VXHUwMDA3/NlH+Fx1MDAxNl+r5/Ot9CzGvrrXhVx1MDAxNNvYNct6xW0yQIzSWt5nXHUwMDBmp39jplx1MDAxM1x1MDAwNVx1MDAxOdSToOFx2tKNp6GAXCKB8ul9QubcVvxzXHUwMDE2w1x1MDAxOHvbuEPWgV22XHUwMDEyllx1MDAwMOutXCKT8PY39p6qXHUwMDAyRyNCcVx1MDAxYfUv29VcdTAwMWTwoNLH2Df+UIHCjqiMlilhj+bfetteJEyJXHUwMDFh7o7p/qtJ3PNg3/G5XHUwMDE3OapS9jBEXHUwMDA32sfz/lx1MDAxNFx03jFcdTAwMTVJr85tiTeuXHUwMDFmXHUwMDBmYo0hRtFcdTAwMDI6QuSzjVx1MDAwMrXMXHL85Sa3u59FYVx1MDAxNppjXHUwMDFlXHUwMDBmXHUwMDBmhfHMIUhcXPTV2zdGoKVKUlm3e7acMTxcdTAwMTZL4l5FWmFgXGb/q0lcdTAwMTSe00nZa9MwlOXrp81pxrtpXHUwMDAycC7MRclcdTAwMTHsRmeLXHUwMDEyUVjzkTBpR1x1MDAxN9JZLDTzt0946rWiLjhcdTAwMWH8s9aVO0yctT5cdTAwMDeZaoj498Zxni5/7qRFYFx1MDAwMu+Ael5AstmUXVx1MDAwNcXF4ENwuHL5rpLsXf6Mp4Oa9VjBVep3dMjTlpHq0oUxXHUwMDE3Pc93SmWcOlx1MDAwZlx1MDAxML+GRuEmgPpXz1wiJVx1MDAwYrlcdTAwMTD/jVx1MDAwMfqI4fxb5EZ8JTaPXHUwMDFkummj8+BPOHDKrKLqXpSPsFxiXHUwMDFi8YNBh9ZcdTAwMTlsli5VUaCR/K9OXHUwMDBi+ZLnVlVcdTAwMTH0Z0gzXHUwMDE1f/b/a/d1N8N3xVx1MDAxZqU56UU2u4orXHUwMDFlx+p9+VxiXHKfxFSq/8aG6fI/LyhDr1x1MDAwNvzXWlx066/e7yZcXFx1MDAxY0etITVcdTAwMDVLd8ujsF1xULTJh7gkXHUwMDAyil+DXHUwMDA38ar14Z84NXk4XHUwMDE40i5cdTAwMTRccrBepaNnY2v2zFx1MDAwM1x1MDAwYiNcdTAwMDHOye+NjcKkqYpFnyZcdTAwMTQ6jZ3xlOAklFx1MDAwMDL2/GdtRVx1MDAwZYJsnNsloK/6XHUwMDFiLd1cXNiOXCIgytrbVbclXHUwMDFi6E9cdTAwMWZ+Ylx1MDAwZVx1MDAxN5BcdI7XXHUwMDFl2Xor2JWbvT/xxXPg7JOq8KBh++P+XHUwMDEwTUZcdTAwMWZcdTAwMWKNnlx0Wng768omqkA+iGBcdLU8XG5aXHUwMDE3XHUwMDA316V4XHUwMDE3pLJkN9R//V2TclxyVSmwXHUwMDEyn00nXHUwMDAx872RXHUwMDAwXHUwMDAzu1x1MDAxMHOArN+rII/iXoY4l+7D+M2yPXG5y0Egb7Aj9O3IX/9iXHTYcjXBl1x1MDAwMDhcdTAwMTCwhG5cdTAwMWWPL/c9k0NcdCqnTZrZ3vWG5y/KuiW5x1x1MDAxMIhw7Vx1MDAxM+RWI/NakzVcdTAwMGX/zvvyVyPoXHUwMDE1r9ou2Fx1MDAwNFx1MDAwNmrB5CyUyeNxM21cdTAwMTgmlUL3j3fRTJo4sdKuZaToulx1MDAwN6G4t6Qob1x1MDAxZutcdTAwMWb+XHUwMDAwrzIoXHUwMDFmrrHeVvH0efdcdTAwMWMoezn+am1BXHUwMDFmZqvHZVme9DM5vS9xzJmCxINgjJ1kUd0/+kD1+PRRo/jEedjtOdF+I3ml9rW085nSLYhcYrJW3EJJ/qlcdTAwMWZcdTAwMTRYou8y5Hid19vnXHUwMDFmXHUwMDFlg+vEn30/XHUwMDAxPZ19gFx1MDAxZq9i5b5cdTAwMDLUwlx1MDAxMVx1MDAxMblcdTAwMDGi33jh0lwi5S0465hcbn1cdTAwMWQjXHUwMDBlIyelneGSSan/jkP3+NIl2PhLP6A8aVMkSD+EXHUwMDEy4Fx1MDAxYZXncmbGX0FmeLZcbl9LKKDuhVpcdTAwMTROTNE5tyZM/INFcG6BXHUwMDEyis7LXHUwMDE2weuiXHUwMDE3oCFcdTAwMTNyXHUwMDE5v1Br39flXHUwMDFmPy9cXCwytErnIYu5olx1MDAxZPFMXHUwMDEx82zpuvlPrEBtYJ/9eU6F30DwTMdJnlx1MDAwZVxi5WHWZ1x1MDAxN8v1vur5XHUwMDFl0MHp/ve2TPBZdPSWVZvw56Xr9n88hM5cdTAwMDHKNVx1MDAwMuvDMKMg0WwgQI+VXHUwMDE071x0zDe0eFx1MDAxNNf40k5TZ2pcdTAwMTko5GS/R47InuMyXHUwMDFmoEMk1Fnvl0fDzlx1MDAxY/hcdTAwMDdnb1x1MDAwZvLDXGLIKkov6E9eK6cgt3GWXHUwMDFlUVx1MDAxZT9cdTAwMTDh6ypcdTAwMWLOvMs3qVx1MDAxNvebwVx1MDAxOYYzy6TS9utWcX+x+nYnf7WsLNJMzjfaXHUwMDA2Nz+zPLnvXHUwMDAwsdHWf4WP35liZbxAffl+2MDD/nKyVlx1MDAxNSEoSklcdTAwMTWfsaSU+5WGkeVZXHUwMDFmqjfO5mqvnDEg1/TlXHJcdTAwMGbf0FJit388NMSuoju71F+k58BJ5a2+syPpY4TZc3l4f5msq1Cgqc+8XHUwMDBi4f7FaHTQMSiFxoH+y+HTupzE6K2p/6Jv4L5cdTAwMWFb/P2OQD3l+mMwW1OHXHUwMDFlXHUwMDFhmsqbduaGqCo2jva49JZcdTAwMTF9x//iq+bzVSGENdcz+nOePSerlttUXHUwMDE4XHUwMDExw1x1MDAxZMxnneNcdTAwMGKZoKOxXHUwMDA06u+ZM53Tllx1MDAwNZWTWuFfff+W//pfXHUwMDFmaIFls0uwLiSCVW1cdTAwMGVjeN+y8FjZZr9cdTAwMTR7rb0l6DuePJ7l21x1MDAxOS/NqSExa7qp7oUolrdcdTAwMWNRXHUwMDFl5v3HoWno41x1MDAxY0lm+X44nsxR7nLRN3JcdTAwMDFcdTAwMTCJgfhcdTAwMTFd78ZIXHSU0m/0gH+9kZbyc+Z+fehPwJgqdYZhb7y39iuUr/q+jsNcdTAwMDD+nTtx/aZA2Fx1MDAwNnL4MpBrKS663lx1MDAwZi0lby8giSVcdTAwMTRR9FiLTN4l7TtcdTAwMDFyg6NcdTAwMTCJiqbxs8/zXHUwMDFmz3j2W1x1MDAwMq/zLfhjenx231Q3aFx1MDAxZm4ph9aK/O33clx1MDAxZFNcdTAwMTCtQvJcYr5cdTAwMWKWrktcYuRcdTAwMWE9xtJIXHUwMDA1ukyKLz5cdTAwMGWvv+O5rFxyIyj1nGlwXHJcXO3gq1VzpFx0aj/VXHUwMDE4XHUwMDA1lE60J/lcdTAwMTBcYlx1MDAwM9llXGZNLoiiVFx1MDAxY8J86e4/futMI1x1MDAwMH1KOFwiwpiBUGD8h+5W9VwioVVBtq9cdTAwMTL6poh0XHUwMDEyziGryjN8iNRcdTAwMTYxL1PQXHUwMDExcWmjXHUwMDEwv7Hs+Vx1MDAxNy9CJea4VS9cdTAwMWHiXHUwMDEyeZhQcp28XHUwMDAwalx1MDAxObsnhLRbKX85gYxcdTAwMTk19O7YqYGya0ZKtn7NNFx1MDAwZrP+21c3yKd8feRLosyOfn/Rr9VgxKy0beltc1x1MDAxYtBcdTAwMWTuoJ+2XHUwMDE4Yjs7gVjJx2WtJlwip+/jXHUwMDEw/51cdTAwMWJ+dF+peDm+XHUwMDAxhpF273uteePukMvvpJy8cvnM3XmUxbclXHUwMDA0duhjXHUwMDFjcmaeXHKMXHUwMDEx2MK6oFx1MDAxMVxinu+//OJXXHUwMDE5yVx1MDAxNzyNfTJsjTqJKDtmwkNcdTAwMTBfmC+jolxyXHUwMDFm8ldQs7YyNPxZ3Fx1MDAwMp+X90qCYE7yVN+b8q/fXHUwMDFmLlx1MDAxMMRcZiZQxKxaZfz6XHUwMDE5j7KaXHUwMDAwxYZmaONcdTAwMTlv3toxuFxcX4/Hqv5+py1lh1witEIoYKS1+r/fduKqoHPXUHA0bMkqf3pcIiBe/Vx1MDAxMJd8wmrBXGJtRiuGpH3kZ31cdTAwMWKLXFw9pcyYScM/gfj8+10waFx1MDAwN0ZTmiVcdTAwMWKcx1xyml1/euBcdTAwMDZBpU7yxbtcdTAwMDEnJlJcImsnqI6vY4/8XHQqMZ6BXHUwMDA1WF98ou7jX1x1MDAxZFx1MDAwZcd0h9yEvbdvcFxyKKJInPc72pioXHUwMDEzvYq0wHWzXHUwMDFlTy+JkZRnonZcdTAwMDRcdTAwMTGmKF5cdTAwMDXklT9cdTAwMTKkjlf1aaPUlF2q/2KpXHUwMDEzbFx1MDAwZYp3JatcdTAwMTLLXHUwMDE1npAmiHAgI35MoHKEsZRrxS2i0fz9KmFcdTAwMTTgXHUwMDAwXHUwMDBm0lX7vum3rOE3LHP/noflpGicYyBXdFx1MDAxMC7PWHTO/KlZN0aZKVx1MDAxZq9cdMuZI4VA+utV5/D1nTpcdTAwMTCLnYpcdTAwMGY9/1235aJtylx1MDAxNyNRXCJWyuGiXHUwMDA1wE915N87XHUwMDBlSFx1MDAwM3VZXHUwMDFiuSSEQlx1MDAwNGRcdTAwMWJcdTAwMWNd1vhQXFxJXHUwMDFl95fTobR4JVStsJtcdTAwMDFnxfRwYJFcdTAwMTTGXHUwMDFiXHUwMDEzTU1QXHUwMDFiXG6FcE9cdTAwMTKIPFx1MDAxYkhAwk3+yPLadWz+8+pnLZ3urJG+JFNxXHUwMDFjy8M/O5OGoUNdvUCXT//tKypX5NFcdTAwMTfgXHUwMDFjjSaeXGb2ym9cdTAwMTRSXHUwMDFisVx1MDAxYvif8y/vfNlVxEwkK1tcdTAwMDdcdTAwMWFGaWv50lxya1x1MDAwYq1DXHUwMDE4JOo3lSTfv/n3XHUwMDFhziv9KFx1MDAwNlx1MDAxMUpGWvkv9kqgf/hcdTAwMWFqZ+ue7UexXGKhdDDQXHUwMDA1XHUwMDFlIHwx0lhGrt33mblDpWRuXHUwMDA0dpCKUT5mK7t+nvp/3lxy/vg8gVxivz/q8G1CNZusXHUwMDAyLj/VXHUwMDEyi/hlfeKcR2r9ZDLr5bxcdTAwMDG84ITZkbLzUPLe+9899XlrioUyoyNqvu+9zeFpbFwiXHUwMDAzyCFcdTAwMDVnvqN0Zl2Ihlx1MDAwZUQrxddcdTAwMDRkxkzLo5D9wcz/cPCteb/zXHUwMDA3rqgo79NEXHUwMDBm882b7raahbBot6y6zm+jXHUwMDA1/dRcdTAwMTK439y9XHUwMDBl4MIueJ/DUlx1MDAwNFx1MDAxZXrTXHUwMDA3TjTS37X6uj1jak26TFx08z6sXHUwMDExdN5cdTAwMGL+9NZM3C/v9ib8/lTYx9pGlTzcV3Ilja/ZSoFBXHUwMDExjDmwf+NcdTAwMTe4/pkucps40i0w7lxu9Yq8XHUwMDFhOJj+51x1MDAwZXKFNpHvLstJ+4U+kSlcdTAwMTPcXHUwMDE4g5HeXHUwMDE40eDu/2CGXHUwMDEz8v4qQVKlXGZx3zRSWID2en5cdTAwMTL9KvHFKvomVpW2szTQyzAx8TrElFeoZVx1MDAxMifW/5/x6KLw+lwiUVuL5KJi/M2A4Pyw9eFcdTAwMTmZ+OGrclbebONIrvUmX8BcdTAwMDMkiJ9zXHUwMDFjXHUwMDFjy+v/jYVcdTAwMTP5YsNZb5qrUvQmb5M0u9zXl3xcdTAwMTmcqYWwk5TksHSQfVx1MDAxM2Bbgo1uS8EvjvfX64o7jFx1MDAxMKBIUkM3cTak/LXUs0/Tz73wdEq74WbS0KqPZuM8xFhcdTAwMTJd5FJtgjpA6GhcdTAwMWb+i5/pXHS3Mz9doVx1MDAxYSCXcKZIl0hcdTAwMTI6Q/3E5qMxUcFcckbm9lx1MDAxMrXn25hUeVVqICxMcjDN8ZfTdY4pi4lcdTAwMGJ2XHUwMDFhXHUwMDE1+EW92/x1NcOI8s1hPfOObD7M8Vx1MDAwZcLDXHUwMDBlLfG2re2rzfvwr5bSJUjlzpfTNi8r07bVXHUwMDE2ziR1nNL8J1JuXHUwMDE2yTm8tnqBl75FXHUwMDFjmFx1MDAxMPTdICzG7eE8/zsnlfjqvLFcdTAwMDTul1x1MDAwYm5eVjH1WyO4KOT0PX1iRmPWr59cdTAwMTdcdTAwMTdcdTAwMDZ6+JTfXHUwMDFkglxmc1FeXHUwMDBixVx1MDAwN+CIXCJ0aNL/3d+CaJVJbpmlPspqXHUwMDAw7jbXJoZ2a1x1MDAwZvlMLofBy18r5m35mKe5Vml7glI+plx1MDAxOT1cdTAwMWXO2bf8v3tcdTAwMTZzdaClu8Ep0Gr20GX3iJYgXHUwMDBlXHUwMDE4tro8zDBcdTAwMDM8dyQo8ejLXHUwMDBiXHUwMDE32L62WqX8XHUwMDE0toVHc1xyg0idtF1cYv7OXHUwMDEzjLVVQfjRunnTmL6lo6GQ7ordmFcpXHUwMDBmZ+3TXHUwMDE3n5NcdTAwMDaNR93tg/mkXHUwMDEwWlx1MDAxZmJ7X8ErI5m/c1xyvUTlXHUwMDFhS3wl1fw5SJk373YnteCSNz5Le1Lxas9mXGJcdTAwMGa82+azdplcdTAwMWNcdTAwMTTyPVx1MDAxNWyiPv6X7yR3ZPLCfVI6M45cdTAwMTZ+v6y/PDhp1Ym7YSNcdTAwMDO/bFx1MDAwZtJygHs964pcdL2TgCHVW1x1MDAwMd2jXHUwMDBmQ6x/9aCsXHQgRVx0OXvz1+aZ9lx1MDAxYlq97zcyMXMwKSAma5PA+FCgUo+Urlx1MDAwMlqiuFx1MDAxNDb/o98mYedgsCWGXHJcdTAwMTUtyuhcdTAwMGaeW1x1MDAxMzwzXHUwMDFluvBcdTAwMTmyn5anvFx1MDAwYnVlIKhOq7iyyFXWUfSFXHUwMDA1zOaamvA/fqbz71x1MDAwMJmEhl3y8No5RHzgbZPIRIiO+ncwgVx1MDAwNT4pXHUwMDE3r1x1MDAxY4ohXHUwMDBm+Ve7eIR2toxTysRff/dcdTAwMTNcdTAwMWOTK+z7tViS5abEkvoqPuPeXHUwMDFmrpfdSfG8z7ddc1x1MDAxNVx1MDAxOOnsl5dcdTAwMDDCyFx1MDAwNIIvr/nwv/Gn6qTAgVx1MDAwNG6CszK+oahhaH2nccyf0J9rqkWqpCxcbqHWXHUwMDEyK1xmh1AzXGbFubbohfyrXHUwMDFmID4knG1giY96Lin6XFyuYu9cdTAwMGI7pFx1MDAwZjx4NtBbXHUwMDA1NVPQRMPH4dg7XHUwMDFmXHUwMDE0RFxm+NptXHUwMDA2XHUwMDE38Vx1MDAwNWGx+fdcdTAwMWP2XHUwMDE3x8afPu5Euc08vmqFXHUwMDFlzDdcdTAwMGZzyvgpkqOVXHTgcZFBXHUwMDFiXHUwMDAyo97GXFxYXHUwMDFkXHUwMDE0+X9xe8D/iCvgpoHa9nk/c7mz5d9xnF7AeHkvgFxisiqIndqSIznI4H94f1xySYVcdTAwMDDG1+jevFx1MDAwMSZGIOb6lb/ozyqtvLBK9udcdTAwMWJcdTAwMTXneiTt2m5qgcZAI/83Vvl5XHUwMDBi1V+tJVx1MDAwZVHJlTf+1En53LUs6t88Q/iXtoZhaihcdTAwMTfHdo7z9cf/rIVhwK1cdTAwMDWVf3yT5OpGSlWJbX/vbUn4XHUwMDBmqHxjjW49OIFcdTAwMDKakGKIcpmg1ut/a1x1MDAwMeeQqlx1MDAxMlJcdTAwMTn56iyGritcXEGK0zx+szv0o59JQY9cdTAwMGacuN5cdTAwMTFbYFx1MDAxNVx1MDAwNdiny7jLXHUwMDE0J9VZc1H/W1x1MDAwN+h/m7Mvs5/1f3I2XHUwMDE4cJ2TP3Nhqby3aiNYpGHVO6ddXHUwMDA1XHUwMDEymp6FV3aarlx1MDAxN46svP80YSGKxHxh7uOi/PWvv8d/1l//elx1MDAwNXxqLsRnvdZ3buJRdlx1MDAxMc8mKcpcdTAwMTR7/v+urcZcdTAwMDUkiZdQayP3W6tsTXn7XG7MY8RcdTAwMWIqerKKj4/tL3++fVx1MDAxNlx1MDAxNlQh1pnKklxun5VhXHUwMDBlfGvd/4lXXHRqj5AnempMv5HXm1C+8OmzST7aZ1fddVx1MDAxNWqNRYz75U3eXCJcdTAwMTJcdTAwMDc2tPCq2KdcdTAwMTL2+G9cdTAwMGa74WDy1HGzn/KKX6xpXHUwMDE5bjhcdTAwMThJdUPc6oupncI2L1x1MDAxNlx1MDAxMWi6I/rv028n4feWNENZbKD/xsv5PopHa/zP+yjNgNrA9SXGO3P+z9qcXmGuq9UlQFx1MDAxMFXye1x1MDAxNy2qMnT6v3hzNyjdUN7sblFcdTAwMWIkXHUwMDE3dYFcdTAwMDK3uCM3wVx1MDAxYlx1MDAxZetcdITQXGYs8n2eXHUwMDFmKVxiK0F8jN53aZ/j/+z/g3dWzj9cdTAwMTPQXHUwMDE1IN94hD17XHUwMDEzXHUwMDAw41J9K1x1MDAwMJ1V9ZRIaa8l6Vx1MDAwMFxib7vCypOQM1x1MDAxNJs1U+y/czRcdTAwMTFqbj7kYKj9OVx1MDAxN6zLNCfYf99cdTAwMWVpXHUwMDFl/Pjp64ou2IHNtMz9P444daVcdLX4XHUwMDBlzkKc0L8mp1btrznW2FN3PlrcSSHAhupcdTAwMTGvZlktbCbo242ko2Ra/8PBi25cdTAwMDAnVJbZeOX3/bPC+M9cdTAwMDXQvSWjfH5cdTAwMDVrXHJSNfTvVHb+XHUwMDA2VyPp++vbjeb+ry7wV+FcdTAwMGKcdNZxfz2g8bylUt3YUZ8jruqANzku5KHpw1x1MDAwYlx1MDAwMzdeUIg4r83h+M93wJiA/uS87+ahxVx1MDAxOGhcdTAwMGLc19+7mlx1MDAxYkPW+P2Fz9Rx4lNcdTAwMDDdg3CbM+WJg7P2Ojtn11x1MDAxNvt7fi1yXHUwMDAzhHlcIllvpId05fhBvLMj3YZ5Z0s/3Dj1rJSNQZPRWZZzXGK5XHUwMDA14e+byJTgc3q6/c/eXHUwMDBiRe2sXHUwMDE4mslcdTAwMDDznzRcbueVXHUwMDBmkJLgYitQXHUwMDFk7k5qQKfHvdqsLlx1MDAwNpKy1JdUUPAxjvDZ+0+DeneeXVx1MDAwNUS+XHUwMDBlqk5cdTAwMTX1U2CIgOQmmcQkb+6U9de792mBfZ3LXHUwMDA0XHUwMDAwUnog19dR681/mFhuKVx0TUzj2sul0GkpK4NcXMJcdDXE/C7l8NXOxlx1MDAwMdpg7lxyzLyt3kY0j+3/6lc1hf7gtnapXHTszS2KoUbBQO2yLazWdWz5muFcdTAwMWQjaVx1MDAxNaEzXHUwMDAyzFx1MDAxNEhcdTAwMDVcdTAwMDE6tVx1MDAxNCiLMCZ2XHUwMDExsHvnXjeHtVx1MDAxZN7xy/OZyXnX7YTgU36+9GbG6vlcdTAwMWXZtpVGq7D5nqwqnG/U9YlcdTAwMTRgvLPPSI76w3R5PFx1MDAwNGTsslcsl2AjbVx1MDAxMbP8fbCK8CuqjLvFlqj88Vpf0E5cXMJMXHUwMDFmuTDD2Tx7cF6UIFak7E6swOaO33u99slcdTAwMWJraI+xMvhVXHUwMDA3dS4ykv7V7plEXHUwMDAxXHUwMDFiqmvb5c/9ZFLOk1FTJFx1MDAxMvn+q3bLs8e19c42QVx1MDAxMlx1MDAxNdfYMnR3bp1cdTAwMTPTQ1x1MDAxZOrL5H6V6lKvXHUwMDA0wmdcdTAwMTRcdTAwMWOnsCX51lx1MDAxN9mmbcNmk1JeXHUwMDEzXHUwMDA3ivTJqFx1MDAxYl5cdP2pXHUwMDFh2FxcXHUwMDEyWkX6PnzGhf5UamtcXL2/1pdEyoGlmCDoZ8P8hpuvKldAp8489rcweV6ArK8rbStL3/pcdTAwMWYyXHUwMDAwXHLJs1x1MDAxM1OLXHUwMDFh90dcdTAwMGZAXHUwMDFhllpe1kF1UVEleVxuXHUwMDBlW3NX0XyGUGxdj1x1MDAwMbdzZCDXNrctjXiLhfVwQcuRNC1N5Fx1MDAxN1Gh6bpaxmt6PM+7JVx1MDAxOJaxcTG+1ePsTddAPJDl8Vx1MDAwMJAgXHUwMDE1IaH0M1x1MDAwN7BT+6pcdTAwMTR+4yrXXWKJdyuP76Q0ZP6Ih1x1MDAwMXtcdTAwMDJoXHUwMDFkJDi1eGVcdTAwMTDGc09RimZQx8gpaOI/n1ZfOEBaNzM97Jl061x0XFw3xLaDdNb0yoJcdTAwMTJqblx1MDAxYzXDWWR+XFyEXFzOkDhqbmd8p1x1MDAxMFx1MDAxYZRQXHUwMDFjXHUwMDBi3v9ml5ty1rahXGL3uVx1MDAxZoIgXHUwMDExfMeiXHUwMDAyYaupzlx1MDAxZIyZ2qVcdTAwMDU36lvU2TeDgXJO+aJZUZSnxlx1MDAwMurJJrtcdTAwMGLB7z7PXHUwMDBmnzb4kLhcbiWO8ebJtUz5x0a0nMneSHHjvKtvXHTAUVx1MDAxNit9YFbpd9JcXNXrXHUwMDExIX9+n7GqPmOvo6RBXHUwMDAwN1xiXHUwMDAwv5YkMNM7cXqBOL1cdTAwMTLM5XyXcOcvkOv42i7oXHUwMDE2g5y4bFx1MDAxZNfi+lx1MDAxMFxy89Uo7lx1MDAxMOlpNurBimhQPIIreifq+uvcLM4mjUJ8XHUwMDA2v7MjaCuk6CtTuV9cdTAwMGJ4KPXyV6/cWUyPPaa4P7nGZs7f/uZcdTAwMWH/8Fx1MDAwYtJvTYntXSTgeoGVllx1MDAwNEK4jfv7Wm5cZlx1MDAwN9GBfX+ot6bHXHUwMDEwXHUwMDEzW8hccs73XHUwMDEy7nxZrXrPJaScaO/fu0jt7MZqWJ7n71vhvlx1MDAxOF54MVx1MDAxMFxu+nClIUZzWODyU7ONLnvzOqUhUumoTP7P/VNZJj54oXUwrFwiK4nlzFx1MDAxOKhFszPyXHUwMDE2XHUwMDA2lcbSWnTQ7Ftx4ZdcdTAwMWF0I3Gd8nZcdTAwMTY+JDb+SlfoZKNGwUvOl3yGWNimMNjllsOyyEsmyCVcdTAwMWaeWrWWRy/dtKL72T94ZUayMlx1MDAxZon6LKNUXHUwMDE4d/LjXHUwMDE35uQ13Kg69KxY7oaBXGJcYjJFXHUwMDEyOofvjbZLj/KGXHUwMDBibUCZm3Hyy3n2XHUwMDAwlSShxzfIXHUwMDFhxlb1uySUzuRcdTAwMWFDLlx1MDAwMlJcdTAwMTjlfEHo4/KFhPW9XHUwMDE3ePPkdVxctCZgnU1cdTAwMTDu01x1MDAwN1x1MDAxOCb0cuH9XHUwMDBiqtVshj+8+dRR7rvKRpWVSZOk7Vx1MDAxYuJgbFx1MDAxYnd2Nlx1MDAxOVxu6ixcdTAwMDeqXHUwMDAzwz7Yhy6h5TjZo1uVoj2dPL4tjFx1MDAxMyRcdTAwMTRKmmNcdTAwMTdqnaVf4KTgYmRit3O8jeiUusw50e3RubyQfzhrOVx1MDAxY8nteJzjVruI/T93hsrvzX9q3v1cXIWm/biVZlKNN1x1MDAwN+t16FxyXHUwMDE1UPzNXTnvL1xmgjNIXGbrm7w3hVx0tOfT8vpqXHUwMDBldHm6XHUwMDFjr1x1MDAwNN/kQ1x1MDAxZd8wzPmX+3yZUJCubFx1MDAwZnnCPTF7sGWD91x1MDAxOfDBkjLvJJLyXHUwMDEwJrrrTaxMP67R3G8q+NszLZUm6Fx1MDAwZXBeREmUPb+isGTUoVx1MDAxMVx1MDAwM67kwyZcdTAwMGVZkTdcdTAwMWZcdTAwMDKxX7xgXHUwMDEyXHUwMDFmu4tPYNN5OVxi493O4tucXG79XHUwMDExMOq1Z7HqXHUwMDE1t3/ucIpV4flmhn/rLZ3vSvm+yudcdTAwMDS9XFxcdTAwMDGVXG5cdTAwMTa9L9mrnp65wLglYZ7PrXpcdTAwMDD3XG5Kk3xSN2qbyCpcdTAwMDH8/FwirFxcqlx1MDAxY997NFx1MDAxNL87hV9cdTAwMWWrbIYh2KQzPy9z+e+qXHUwMDE2d45cdTAwMTDZeLojcKMzejfM8+tcdTAwMGKdwJ73jjZeO7vljfzNdcCMhYqBYnNcdTAwMWNa8CyNTUhDnjTRf3SVeXupSUOuXHUwMDE5lC/BXHUwMDFixvyH+uaxj/hZN7896Fx1MDAwMGpcdTAwMDb+UlonXHUwMDE5Uz5wbqaewdxcdTAwMTFHUJ1H6qFemYJcXJ84g62aI6SYKKVcdTAwMDHkXsmuXFxIJ3fWedvk1lxmSSdfwUO+4L+czNtLhuDXXHUwMDFk6TEnclx1MDAxZe/l+mFcdTAwMDTKdXZCR6BMXHQuZlx1MDAwZuOv3FrbULr2YZDv31x1MDAxZPil13Fp/WFcdTAwMWPl1lwisZqQlKaxf0L52TAgmCtOXHUwMDExnadKcOCJdCO9t8G9neB2QFcsol7zXHUwMDE24frZU9I81s06m2++OMT1kcuxNdKAWsznd1x1MDAxZSdrXHUwMDE1v1hcdTAwMGasi0UvelAhv6w3XHUwMDFm5Fx1MDAxYTHfTqxcdTAwMTNdlrU+R4Bcblx0XHUwMDFjfHj27oYoesWX70Tnz7G2xVPjXHUwMDE4WCdcdTAwMTL6eDlcdTAwMWVcdTAwMDKqlneIjpt308NmXGJ/uZfNpIDLI5vQjs9cdTAwMGVcdTAwMDY5eo7bXHUwMDFim8JcdTAwMTOPuSyM2Jadq/ZvXHSUVItKXHUwMDBi5aOPqqyRTFx1MDAxM2JoXHUwMDEyXHUwMDEw/FE/XHUwMDFmUN15KsRNtFx1MDAwYtGqXHUwMDEwgHL56dMw7FJcdTAwMDHy9lx1MDAwNoyJTibO1ttcdTAwMDab21x1MDAwZvXUPvfjvIp/aLesvL6f6sbta1x1MDAwMzL/KshcIneWMCjN6DVfRHFnZVKqyz313jH9516RXHUwMDAy6lx1MDAxNeyZWfSfQFx1MDAxN3jvfN/Q48bRtW9RXHUwMDAxSTdmsnTmQVx1MDAxOcq4XHUwMDE29tuCsMUzjy5cdTAwMTJWn1x1MDAxNtU6kNpcdTAwMDbN7tIsQI6mzyTjnNNJlWI1X0iHM0c3vSzD0L9el8ssqib4w1x1MDAwNSrkglBcXPpwd81cdTAwMDG741xm2IR8/9KhmDZcdTAwMTfpVqpcdTAwMTDaSLqSMvSrm//k/7o2c7Ej9lIpvz7e4EV3NTjr3HVcdTAwMTMxTWxCWIe2t2xVof1cZj7WXG5StC5cdTAwMWVYu2xcdTAwMTVQXHUwMDE34JFcdTAwMDT58PNcdTAwMTGSXHUwMDFl35951Vx1MDAxMClacUJ8RFx1MDAxNGdsPIJ3QKo2Jp2f495ewlswXHUwMDAxyrmq5oFcdTAwMGLUrnf0qqBBXHUwMDBiZMyZh+80TOpcdTAwMDNArFx1MDAxOFZZ8356/dmJZE0oLE2/vWmZPIQ3jlx1MDAxNFx1MDAxZOfvXHUwMDA1anbTedhcXLWKkKGYz85UXHUwMDE2KSy8j1paXFy8QzhWXHUwMDFlXHUwMDEx2I1F7lx1MDAxZV2V0NMxLqrWi7WonfHby98nXFykMFxynjRcdTAwMWR9XHUwMDA2aHFZ2bnKRsv21HnO7Vx1MDAxYYfOcv8/V/ig1eSjQ99VQn/xYpn+eVvTnbqrwqgtn7jZ9ctcdTAwMTGfWC9pZ72lx+OaR0zbLdDY3MuovE4585aI11x1MDAxN0xcdTAwMTNcXFJ/XS5cdTAwMWT08ElcYpZKJqvXbGDsXHUwMDAwbZ9soCU9z9HCbXnqXCKg7dbrbuV/9P/HbVx1MDAxOJ6o4ujhJVx0JPdl5V65NVx1MDAxN8j6WTAgnjmEjDeWz5eeclx1MDAwZXfW2eBzarpQXzqLXHUwMDFky6e1R1xiknqhva/mXHUwMDBmXHUwMDFll3qk+OEk0ljE9fbTL1wilGahvHjYi9CKtGaEulxcUcic31x1MDAxZXBPUs6qqkui2KsuwFx1MDAwNNh6XHUwMDE22HcyMzG6yZUhXHSmuWORVND4oDa1zWbu4Tbi1Vx1MDAwM2rI6fk7//y6RvtZumQjXGZtYFxihmdcYsfeWDcpnn77VkuqzrNcdTAwMDaiXG6G3SC3SC3wmfFcdTAwMWU/4J5cdTAwMTOiVVxmPyr0QpOrtcCans1cdTAwMTXXft5/PGtcbrDkilx1MDAxY8ZXPe/w/ZVOqFR9I+FThl8naCVcdTAwMTk+gjzpfqncI/6+JI9a41x1MDAwMrzwsU5QQThcdTAwMTc6tlg29IFXMDKqNFxmo+ee80HqIT+vKZRcZl+tu0DsXHUwMDFjXHUwMDE4IZi1f7BcdTAwMTO4k8SwlNf3j1VPrFx1MDAwN0PY8bfFOVsx4lx1MDAwYpeKx2NcdTAwMGZcdTAwMTZ9kzy6dPVcdTAwMDePbjirfXPngiGD9+fMsdxcZpJ3hM71vLeZvH91XHIw6tJD8UVKPs+IM1eVdvBcct0mWq5z//myN3fQb+HlbVx1MDAwMbVAP4FcdTAwMTZcYnfHmVfDUd5h7/3O70ZTc04teNZcblx1MDAxMyS+O5Nm6rJD7OLav3VDKsqPXHLFWTYt7L45cI7o8oHYS10zRHEzMiX73F1cdTAwMWMgXHUwMDAyh0dKerlccn1cdTAwMWFyZkm9sT9ne+PTXHUwMDE4XHUwMDA1geZcdTAwMWFcdTAwMDLDX/K0bNDEXHUwMDFkT5QltlKjoKfpXHUwMDE2cExAm2+3sU3OPpg+syRFJ67ud3CVkjFcdTAwMTjNmqNHtKld0p+Z7Vx1MDAxZT2d92FcdTAwMDbHlF7Kc/uBWibrhnLMnVx0cEYr3Fx1MDAwZf5LlcBAxa6qSi13lkHxbqr0XHUwMDA0i+K3vCpjUXFcdTAwMDdcdTAwMGWXbfrn62V5dt/53OqaXHUwMDAynCb09M3Ldj5BKZ8tq9BcYuG+07PM03R9NX5on/1cdTAwMDc+lH+jPz5cdTAwMWU7Z0+Rhd0qdLT4j1x1MDAwNXiba8Nk2DXn2Vx1MDAwMLxMXHUwMDEw057uaNtcXKJcdTAwMTGLzrNcdTAwMGVZI/ihxkMnebOHkb/ajk5cdTAwMWVW8m5i6Srx8UrlQ/cuZuPdPcFQXHUwMDA2Kfe4IFguLeNnXHUwMDA24GVLKONcdTAwMGWvTzZccnh76tpcYixOuFx1MDAwNFx1MDAwYvrPOe55XHUwMDA2K4bHXHUwMDEyVc+zj1x1MDAxMdSOjiNvUFx1MDAwMkV9SXOyXHUwMDFjxu7lcmr2XHUwMDBmXHUwMDAzslKNXHUwMDA0XGbSzVx1MDAxZHpdh1WUyXPyjmbIaoKbtar/OVx1MDAxZqrTX/0kr7BcdTAwMTamwi9PSJRl5jCTXHUwMDE1c+lcdTAwMDeSQfN5XGYxaV3pNnZCiWC523U0wDlcdTAwMTdcYpT2jFf7UG9CXHUwMDE2XFzkXHUwMDFjXHUwMDE3JqKkqVx1MDAxN9DkP/fFJmdxIVx02CqSS5c8+S5cdTAwMDSB9lHPOphWI7PY7ctOJkghPyWgZya6sEx8Y0EtptRcdTAwMThgXHUwMDFmn5DOM47VKvlszVx1MDAxMVx1MDAwN02idqjhv6uffIPgm5aPKVx1MDAwZj2XnqdcdTAwMTP/ti5cdTAwMWWc04knLu8sskbs/N2N56X+giWtddb8UsD85Fx1MDAxOZJcdTAwMTg3zsrIofydbdWu8Gi6i7J0T24oI1x1MDAwNlxmh2edeUh9XHUwMDFmfyNcdTAwMDJXQFx1MDAxNlx1MDAxZlx1MDAxOIH5cs1wL43hI6V9XHUwMDEzgCfZXHUwMDFj2jqDbXVcdTAwMWZS2uaQksOv3dnzyP2ddfBlVK2tXHUwMDEzLDLcVlfNYPn0scw1mp+5klx1MDAwMvS41HueLIanXHL+XfzyUoBAXHUwMDE2XHUwMDBmskdcdTAwMDOmsVx1MDAxZinomnn3VKqj6ptaRnjs38xWSNT99TtbXGZiKSxlNPNcdTAwMDAqMX80jVxydSad2uTSe3zqJlpN3c+acziZXHUwMDAxy1xc6rhIprpfXHUwMDEz4MjX11x1MDAxM9/Fw65UdySXr1hdh1x1MDAwZdNj7qxVUJd6/lx1MDAxNmwhhljxyydOvjSxb7dbx/tcXLPagXVhdlwibj6st8lnjaSlXHUwMDBmxlx1MDAwM/H2xFx1MDAxNVL+qI380kCEgbR23d/nW/XfWU1cdTAwMTiWKYeW+8XsNm7QRaXEXHUwMDE4tXudPZSecM9cdTAwMDGPSu+j0fjxXHUwMDAxXHUwMDFjqN/lszhIotJQr4CFc0J1n/r31uyrclx1MDAxNs8wv1x1MDAxN6v7na1ywGhBoVx1MDAxNFDJS89yXCJcdTAwMDWBx1KFXHUwMDE4x1x1MDAxNYKHvrlcdTAwMDFcdTAwMDKjSJdcdTAwMDCqXHUwMDFkbHMjZHmfn3V5XHUwMDAxXHUwMDE1ilhz4OeYZpx9iWb/M1x1MDAxYdGf/PtcdTAwMTj+OU5cdTAwMTjwXHUwMDFlUt/s5eC28lx1MDAxOX2kQnmuceGY71x1MDAwYoorXv/AXCL+6borXGKoOjRNM5VXwVx1MDAwNjOeY9k9PFwiVWxcdTAwMDGT2t8nNz5/eciqhlx1MDAwMnbVbjzao56rXHUwMDFhXHUwMDAxiEiQPddsQ+NcdTAwMGVOx8xcZvrpp0OnXGZeXHUwMDFmNJOg5CCXqCOtUmZcdTAwMDQmmLRfXHUwMDFkoJM31MF26KdNOd1Pu7kgeLH+sVx1MDAxZPFcdTAwMGU56S2FXHUwMDEwXHUwMDE2XHUwMDFkI8xWdmIkuVx1MDAxMkgurrVvhM5XXGJcdTAwMTDQM9TMee6GXHUwMDFkl6mZwS+/nrJdO9xjVVwiL819cb2sS38xzMVlUcnsbPXu9UVDrDibRaSdmvKGO4pcdTAwMDdVv6jL+qdcdTAwMTafUCRtdNlX/jZSbFxiXoB9MzdcdTAwMTP80bEv4pG6XHUwMDBmbSP/YM5salx1MDAwNNjJWWmYNFx1MDAwYnpjSVx1MDAwN+5cdTAwMGXtN9eHQlLh3TAxfqhQXFyueu9DNE2jcG72NZrAI+fr9fqhtP07f2rEYl6kXHUwMDEwU6RWK1x1MDAxZPBcdTAwMTFcdTAwMDFfV1x1MDAxYXTzo/z5KFmVrjd20b5u9ZHAjbRcdTAwMGJJVc5+yzZHhP1cdTAwMTT8eqT3bvCKmHRcdTAwMTNcdTAwMWPesTPhjVx1MDAwMV7F0KtEo1xmXHUwMDAzf4M/+/m+vYtoduEv5zhVRaxcZmemzVx1MDAxMpBcdTAwMWRNwbypbztT17tw7Vx1MDAxYvM8kCOVQlx1MDAwMSDzKp4o9SvcK+tyz1x1MDAxNUmxXHUwMDA2oK3SxjvRL1x1MDAxZmQpx0lcdTAwMWNcdTAwMGbdJJdnme3Fn7OXe3lnXHUwMDAwjkX3XHUwMDAxXHUwMDBmcP1MMVeubLXVWVxiQ5KwXHUwMDAyJl46eVx1MDAxMp92nFx1MDAwN3egVsqUolx1MDAxNkjddKhcdTAwMDC5LFxyi232MFju6zx7L31SzErZpvf4XHT5ovRCgtNcdM89y5z9yVx1MDAwYjvvXHUwMDAz3qeHlG13Z1x1MDAwZfrJpdx97dFcXFx1MDAwM9VFIzhEJYiZ+uN3h1x1MDAwYvSHRigoq4JcXCZq76B2cEq9XHUwMDAxXHUwMDE2aTO0nvH31YB70yWFRGxcdTAwMWZRXHUwMDFlPnKwrK1BUWlTglE46I5RqoIgXG4hXGLEXHUwMDFhb71sTV7iU3X+eTOAc7L+vdfRo56ncaeeO6TokNE/v3NHs/RcdTAwMTFe3rLo2zdBWP3u/oGz91x1MDAwN1x1MDAwMcNcdTAwMWVcdTAwMDBmjFx1MDAxYVx1MDAxZNFJRFxmt+yTcshqSr+zrz85aincdPtcIuN5jYpT6SybXCL+k6ON8p+HT+nfaT/fYUeOaeDEg1ZTyJlcdTAwMDVcdTAwMDedqsgoIVx1MDAwNj3zjF633eY9zLtN3W9v8Fx1MDAwNJjZPphl/J6kZ1x1MDAxZK3eXHUwMDE1XHUwMDBlZNnON+RcdTAwMDHmXHUwMDEzyfV842gqVJ52XHUwMDA1/iFcIonzSVx1MDAxN+GGNYqYvID4jlx1MDAxYXF5sPhiXFzjRVx1MDAxOPrloLFcdTAwMTD6aFpcbqqGYYrDv0JcdTAwMTZO7jrnn09cZs/DuPPtrFwiQGi9/Pt2dlx1MDAxNSNWmITlu4pusT9EZZ3O9m3VJFhrWOVcXK2fXHUwMDFhsH/qkDku3lx1MDAwZTWuXHUwMDE3L7hH/GJLptmYrHBcdOGYalX8yfJZbKlcdTAwMWFS+bBRxrVQ9Fx1MDAxNbeWeVx1MDAxM/yFydFcdTAwMGVcdTAwMDBcdTAwMThcdTAwMDb3543zdHohOyyB8+yUns/F9DDgjfo7X7iWvs1cdTAwMDXJ7Fxm603fPFx1MDAxMlwitIMo7+6iJaBJiaT7Xlx1MDAwM6zRv1x1MDAxZFx1MDAwM1Iwsn30XHUwMDA1XHUwMDEwlqYw1Fx1MDAxOKu08FjAb0p+meC/L4HFYjGCpCCBhH/yXHUwMDAyfH6Melx1MDAwM5dcdTAwMWZPwVe+54UmdmWDfMhslau+9MrZXHUwMDFju1wi7N1exiBcdTAwMTe04/Z/7L3J0qvI0i04r6e49k8pM/pGt0ZBXHUwMDBmolx1MDAwN9FoRt9cdTAwMGLRI8rq3Vx1MDAwYn1777zn/CdcdTAwMDc1uKOy3IPMzyRcdTAwMTGA4+G+XHUwMDE24b7i48VqhVx1MDAxN5v3XHUwMDA0VknN8uslOuvuXHUwMDBmMupcdTAwMTA3XHUwMDA09ceLjH5rgNXsys2FeHEodG3HQZZGcaow41xuXHUwMDE0j+xxXHUwMDE3XHUwMDE3qN+FsYlcIlx1MDAxZUbzuJ7GXHUwMDEwPEq1XHUwMDAwOZ1UyLvgr8/ZhFx1MDAwZVx1MDAxZEaWJvFeLjDE+nG3IF8/+Vxu/Mu1IYA3cqVcdTAwMWE4XHUwMDE1WXm2XHUwMDBmr2KuvGKQaPdVcrGnVC6qXG6FZTouQcp5XHUwMDFmmsLuXHUwMDE3XHUwMDEyRlx1MDAwMVxywckkJvleXfNWjFmTIPNcdTAwMTNPzu9azYqabK7hW99yjLSwP5q3dDmm5HnNjrrKoqPlkt3Ncdq35Vx1MDAxZFx1MDAwM5JFhNe8uzm3QpTG2730LpS4azWM/9VcdTAwMGb4+nmH8q3hR7VcdTAwMGU0M3hfXHUwMDE4LbJeXHUwMDBi99qfq1x1MDAwMNEuPcZXXHUwMDFlcKnroUTs9czuKTjohvzpJbzOLn17XHSH/WdtareYi4udRMWBKzzY9lx1MDAwNPdcdTAwMDZcbqPUxamDXTVjXHUwMDE12XL09zqoXHUwMDA1tFx1MDAwM33vVnZ/ec5ulTFcdTAwMDOC0Hm+p/sgXHUwMDFhpWWO3Vx1MDAwNH7WzpXLW8VI0Mo0uLFWPqpcdTAwMGbVXHUwMDA0n30u8W0wXHUwMDBlXCLe2pHgXHUwMDE5upZcdTAwMDIlv1x1MDAxMqn7NMzwXHUwMDAyzJltlFsmfzdcdTAwMTbNonrbXHUwMDFlK5Bt8Elvv+tfKKEoXHUwMDA1k1x1MDAxN+HIxuLhwU07m4fBRX7eh6nIVFx1MDAwMydcdTAwMDfyoddcdTAwMGbYmFx1MDAwN/Xdy9JIjZJP+Vx1MDAxM5dcdTAwMWExr1x1MDAxNOVcdTAwMWXj29g3XHUwMDE3Zv/VX6bV71/xkHaZJVx1MDAxOVxck7uTXHUwMDEzXHUwMDFlx2erz5y1mLMmdGR6vFx1MDAxM3w6kVx1MDAwM6XEqbvZl1xyhjbM9NAhU3xmNGjNllx1MDAwN6FcdTAwMTRcdTAwMDCPJPlcXIau+Nyl32u6XHUwMDFi6H1cdTAwMDTGl2pa7GS7slx1MDAxZrtLXHUwMDA17c1cdTAwMWFRXHUwMDFld1x1MDAwNUW6zYzru8ZFeOl/hYJYmHLvh3ahf29Pclxm8Z2jXHUwMDAz4Kvfk3N/1WSGqcpcdTAwMDY0uthcdTAwMTdCKdiD/NEs7tFcdJwn966u812YRJGNVHSeqVx1MDAwMbTlXHUwMDE15p9Bj4krWZFklm4v8veaLyVcIuWrZFPe+Kw35NBcdTAwMDfwi79Ba52PlJjHyL5dgFmnXCLMuPAoglx1MDAxYtcjkj1cdTAwMWZYPK6j+PxupFWkSz1gV8KrlF9rtu4uNKWGnZzitVTFXHUwMDEyZlxiYmxcdTAwMThQdqBcdTAwMDWcM4OgePh2Tlx1MDAwNUd6ecAyXHUwMDAyvmJn6E2vhVXf9tSkms9cYn6vXHUwMDAxk5VJXFyAbMm/PMrk3e+zyeBYK1x1MDAxNVxuofbSS8iQXG4rrFx1MDAwYvrAXHUwMDAyQ8pryJBtxCztXHUwMDFjxjpcdMnrsFx1MDAxZqxcdTAwMWKpKFx1MDAxYY2Gl4u4Kch/16mQnLpcdTAwMWKJ6lhmXHUwMDFmfS68IIM4NTYh0Sg0+fFrPIqQoH9cXFNm5+m7ws7SdrrvZ3O/8NpcdTAwMDdCLYJ1ylxupjlcdP1V+1x1MDAxZLFcdTAwMTSbX5zNXHUwMDEykunijSGoblO4wFx1MDAxOMVcdTAwMTGcXHUwMDE06/F3s22a6vug3Fx1MDAxNlx1MDAxN1x1MDAwMyGh6O/yXCLvV8xzU1x1MDAwM3o4SY2BdlauXHUwMDFiIWznTz3yLkRlVfLA1Et/+GK44Ls+P+5i+N7pXHUwMDE2Wr47JH72fsTX5Vtrvaz9ybEogLh1QFx1MDAwNGnMzdaQteWrXHUwMDFioIejTHa/tKZ+cMeFZ5st9Sc/XFyyXHUwMDFiLG6VTbxNpm14ZiiTXHUwMDE0nMf74TixNzA8tVv9W2i3217sSmTeXHUwMDFln2Rdr2tVvzuQ2/ivfoUybkV6ZaZgzDGG0VTWJd/4uN6aizuqRHHWr/aKXHUwMDExvIk+vrohd1x1MDAxOVx1MDAxNGtfv6XPhW3dlFxy95Dq3VxmRcSu0lx1MDAwNtJ4PMf6V9+HxyF2gWepKb996uZq+V34aonNz5vxXHUwMDA2NWrJj+KC3mxPkOdg2m/9/uSRMY9cdTAwMWZ8XHUwMDA0XsZcdTAwMDaDXHKH78OE6uXjwtyNNnVvIyet9lx1MDAxN8Z9I9pcdTAwMDZcdTAwMTRitsyBXHUwMDFkv4nQMlx1MDAwNtq1psQnKISoZ3k725uBq+jrolx1MDAxZCFRXHUwMDEwslxmnJtcdJ73z/WE+1RjXHUwMDFlbrL24KUrh1xm6a/0XHUwMDFjp/jnfU77VUda2Vx1MDAwZlx1MDAxMVx1MDAxNNS7X6+Ja1x1MDAxMdJcdTAwMDQmJlx1MDAwMb/1XHUwMDEypzTecoVh31x1MDAwYvXV4Saux1x1MDAwN1Blfo1cdTAwMDObqoVDKOqDovI91dFcdTAwMGZbXHUwMDEwQFx1MDAwMyxcdTAwMTRihPr8qb15P67M9iR+46fCXHUwMDFlXHUwMDE5ia+Rc3d1y6vZZVx1MDAxN2k+JkaOeatcdTAwMDRcdTAwMGJcdTAwMWLUzjc6XHUwMDFlMsmd9pXbQ76xjXRcdTAwMWLUQMdcdTAwMWZcdTAwMDebR2Gt5/utYpXfvW3Rd/9cdTAwMTXmSWI/vEAro8DIqlJEbf+w+Cu/+olcdTAwMWNs1SNp9GqMJod4SyWHS1x1MDAwMIdXxJz6ZIzApmtcdJBcdTAwMDWbjay/6m+vfDCV3lx1MDAxYVxiMfVsWnCF/YdRUe+b/6M1soH3+kdrRLZVtSq5Nlx1MDAwNtqMTOhOnjX6XHUwMDE4OJPlyIGV8lx1MDAwNVx1MDAxNfV5/z2PXHUwMDE3LvlAUP5cbrjbkpzvxyO4P1x1MDAwMW+Y9+E7Xyb7gs1eXHUwMDE5XHUwMDA2yEI2X/113baRo+ml7rrsQbrSXHUwMDA3O/mbhijXcdpcdTAwMTPAhtdy6u+etmjwUpG0U39cdLKvPPXnoCBa1YveL/WQSzRNP8dYuFx1MDAwMjCloGSPZZOXXHUwMDAxpSl85oHPPbZh6MRqjT2URSNcdTAwMTdsWJKEOX565YdcdTAwMGbnpVx1MDAwYnHLh/6lt52zxYVcdTAwMTfzmWZcdTAwMTldd00wRelcdTAwMWZ9plx1MDAxMbFcdTAwMDB20iU+MVx1MDAwZeyLfSw9z1x1MDAxN1x1MDAxMFx1MDAwYq3YUqtcYj7Vd/2aYvHnXHUwMDA1cVk0+75cdTAwMGbro1+98SxR/u5hML7q3qlRPT+8XHUwMDFkXHUwMDA0SlxiXHUwMDE0xrhjlfGege7t29FcZszttqh5SnH1IVx1MDAxM4JsXHUwMDE4SP5cdTAwMWFj9yeHPS5Xb24gWPFQVCdiXHUwMDEx+Fv41zMrsvm3to1ZPlx1MDAxOewsVL9cZrZcdTAwMTiR+vNbY+R7dOR0XHUwMDE3jkxB9KdcdTAwMWVUhr5r/uJP/vmIaVn1jahziMUmg11rNz/COPRHp9nbs1xcyP7SarG0cUGhXHUwMDFjw2xAyFkjab5ZKt8tXHUwMDAxw+/eO8K8/+7/e7NWJFtcdTAwMTW1rn5cdTAwMTZEQsJ5Jfxh1zqJxFx1MDAwNFx1MDAxMD86XHUwMDEz2FxizYvqsJaVXHUwMDE23nnqReI9wEVcdTAwMTjXzGqK09oqsOpqXGLymfV3XGJf+/y3doG9plx1MDAxY7mD+JpcdTAwMTlcdTAwMTW1XHUwMDFmkpL7gcxTaXpnOqCoXHUwMDA0qLnf7/BcdTAwMWTudDGthNvgZPt6umLFMOvQ/Fx061x1MDAxYui/e6a/Z1x1MDAwYorJ1+9cdTAwMWWkVoNcdTAwMDFDLtt5o+yCfPeXp7NcdTAwMTeDm0z72Fx1MDAxNW19Okd7gFx1MDAwZvtTXvYtXGIzUiS9oK0ljZzBXHUwMDBlPFx1MDAwZmNJxsZQ4X9F1IX0taXN77qu4CMmzY1i5bhLNFx1MDAwM9FdSZ1YlLlZvk5kQWeFX4iSRaqR6ydPIMCHruSCUV9sWlxyoNlcdTAwMWaQITtcdTAwMGLFLFx1MDAxMnFcdTAwMDWcfX36klxmXHUwMDFiaq17v2teXHUwMDA3+8PmtPPmm+vH32Cxmk9cdTAwMDerM+yr63Jxsvm7Nuglj1x1MDAwMHtcdTAwMTdAIdfilFGmW9nFuGBccn874K52XHUwMDE5f1x1MDAxMFRWuchuw7PQk1x1MDAxYX/Xs0k22PFcdTAwMGLVP8fndKEgr65cdIeYssRiUU5Tc7v6ado/i1MtiFuDe3o0XkA+h9tcdTAwMTLL30lcdTAwMTZ91zfqXHUwMDFhXHUwMDEy4TvzcSsjXHUwMDFkv+9cdTAwMTYv0oWrTVM8jl9cdTAwMTjjU3HK9rmQplx1MDAxZm1cboqdssKC4i7Y4ecgvlx1MDAxOLi8M2jy2Nzs4srf3EvtIPSQXHUwMDE5iS/8+8WiyJ7gZvnoL5otzXogoHhN/e5ZIcEmUlx1MDAxN1wiuLtZpnNHTlx1MDAwMLEpoohcdTAwMTNpTL1cdTAwMDBcdTAwMTBcdTAwMWNcdTAwMTf8Rp/J4ervmb3AbJzrXHUwMDAxkqW4XHUwMDBitIakeH/OyFx1MDAwMVu/70SvdCnPXHUwMDFjrdKnhPx13ZLi0MrGXHUwMDA2ZODN7z6YXHUwMDFhXHUwMDAwP8diflHklVR061x1MDAwM7H0riQkXHUwMDE5uJh96NH9WZWajlx1MDAwMEm1vf2cmWtcdTAwMGVzhFx1MDAwMINyjXFcdTAwMTiGp2Epj+5cdTAwMGbOxktD4mh8VJKVj1n+dC1kJePgJl840yk1iF1cXNckVqDtnFx0PFx1MDAwNOF1pOR3XHUwMDE5qt6HhvbB8K1BXqyclsOfXHUwMDFhmK9uXHUwMDAyxCdVND3H9issUThcdTAwMTjhQ0ZUjVx1MDAxYafIpVNyq15dQKebj5g9TVx1MDAxMEbRc7i/MVx1MDAwNExGz5jro67gm2FDXHUwMDA0+tjfM1x1MDAxN1x1MDAxZctXksj7qfHjSlm55raYstmnfD09fVx0TZ7c2VmbXHUwMDE4XHUwMDE5YS6c/aJO6vD9PD/vSHIn+O9cXO9pd//uXHUwMDE3MWGvfIdp141cZnIrVY/bdiXQmcryrTF/tj+9VK+WZSR5yfOgT9JY4PhSnzNT/3iv+VSU51x1MDAwNa9r+/KgMrJuKkBOXHUwMDBmiNVhWPtWXGbw8oNcdTAwMDXr2yiPOrUpXHUwMDBi+GPjzzVX6MtcdTAwMTd/as6kwVk5eO/88b6kpPmzXHUwMDA3XHUwMDFj6E70Ia3yhFA38q2K9+dcdTAwMWLw+1x1MDAxZDLL1vaOsHRaXHUwMDAxLlx1MDAxM8E36+JMOKn73afy3Vx1MDAxY2G63e8+9rMuKu6abEifOseFx8+EZLiz1DL/XHUwMDExU+KNy8/HJof1W+g576ZcdTAwMDNTXHUwMDBiSa2IeHV/1et3v1xyXHUwMDBiXHUwMDFjikFcdTAwMTBE/IvPfEFcdTAwMDdCiDgqXHUwMDA2XHUwMDFmtIhcdTAwMDbGvLJhak5cdTAwMDBcdTAwMTA8LVx1MDAwYlx1MDAxZVsl1DJcdTAwMWFX7p6tiaO1z2MrnyaoWspGYttcdTAwMDLf3idKfq/SrlhsQydHe+WGX2smdqdzy4VcdFx1MDAxOL2gtiv+Z5zupbWX4b/jiFx1MDAxMFCfPGgxVFxcRvm7XHUwMDE2XHUwMDFmSlx1MDAxYlwiwNhBtPB3NSTKjS6646v7XVs8WG8wXCJcdTAwMGU+aepKX7/ygshVu8dbXHUwMDE1xLVcItnj96c9pjx1XHUwMDE033dVr/hKqlx1MDAxMy3eXHUwMDE3M5P8Zzxh0/162IT6uOaizFx1MDAxMzhdj68lXHUwMDBm9otVkVx1MDAxNsNj3aRnv+vM64uj8DDfXHUwMDExk4JcdTAwMTFPRSxMdL/wcfiEyFx1MDAxNzi2rn++n/zDKYf6ZqhYXHUwMDBi6IvP6ixoP0xVXFzYXGaYMy9CcTZWf2pN7dCUaORu9ILyrfNhr7lcdTAwMDTNNZYhllx1MDAwNmb4eH9cdTAwMWVLTU/plcYtcFx1MDAxMig/Iy1cdTAwMWaxXr9lz6SBzeFNNTaYuVx1MDAxN25FT7DetZ/1xfFx4VErlZqLLF5A70cvXHUwMDFmVIy5cExcdTAwMTNcdTAwMWEw+Orp8zU53ZqFXHUwMDE5YP+rO81cdTAwMDFcYlx1MDAxNlIv0l7yXG4wgH5bXHUwMDAy1HnJXHUwMDEw37owYlamKYrDXHUwMDE1s/5Ln+hXw1x1MDAwM96llZXIPFx1MDAwNVhcdTAwMWa+n6CQrIm6bXdsstKZQF4uflx1MDAxYU+Ton35XHTp11xcvYBlPif75+i/i7XevNCnXGJbzPR9XHUwMDExoyH5Rmyd5kIr2fzux8F+cV4nK7s+JPlcdTAwMWY9Um6eQt/Sw9po3ZBpf3SzQ1x1MDAwZUggfYJdeuTEaYNoa4pnbMnDM8Zf21xyZrPBzllzz45ZW6Nf/VU7XHUwMDA3hO9cdTAwMWVcdTAwMDNWVN21+7fWrcnhXHUwMDAxddsmtJTSrefQw5VGQT/+V091kEyB4COuKFx1MDAwZlHxT21Rymf9yHvK6Z8r8jtcdTAwMDd8NfVUYlxmwVi3QYZ861x1MDAxMjjlRlx1MDAxN9s07D+anTxeNfV1f1x1MDAxZFDPXHUwMDBi81xiptw9XHLzXHUwMDFip++sXFw4/lx1MDAxN/fOxIVoh3cngV+16lx1MDAxN5/L+eTDvGTPWGTuh7NcdTAwMGZyWzNeLqKYTEF2k/Jd0+o6y1x1MDAxOL1b9s9dOC5cdTAwMTLBXHUwMDFjtHZhMOF9XCJcdTAwMTRd0rBcdTAwMDSVWduLz1x1MDAxM2ugPURf1at/tuUvO2/f/ogqZe+w+9WumoRvX4dcdTAwMTbfqSl83MBcdTAwMTVURojAXHUwMDFi/yZxxkP76lqZVvE56tyE8mO7SF2Zgulexsi32obWnjiFIcivXl2XvWLI4rZbXFwos1x1MDAwZon0qd9Ko2bw/JD1x7eeiXR2T6cy9opPRaFcYoVccu+vpOSJnF5Y3M4uumlurtyNwrOP37/9Qt5VXHUwMDBi8LTtYGzj1+tuXHUwMDE2vFx1MDAxMY8rzrA2Z+382vW/alx1MDAxNFSWL+A584AlILuAmU9cdTAwMGZhXHUwMDE5mS+FU/k2m4BcIkRFdyji6kdjI7xcdTAwMGJ02c1sQzSw6lx1MDAxYZDBsVx1MDAxMSG9uudAj3H2RjiGykfFXHUwMDEyLy6wXHUwMDBi6mEsp9VcXLz0wkTLoYd53dhVylllMnMwVNY9/1x1MDAxN7fwczDbXHUwMDFig2PXXFzSvmv5VSlDPzl4rLhv/5BcdTAwMWZcdTAwMWMnjYSSXGL3Vn+32Vx1MDAxObz3PrXgfIGIvrrQ91nP7+G++PavXpf7IFx1MDAxOIVcdTAwMTjO/jX3XGZcclx1MDAwNzohNe9cdE7vR0DUKU/3lNR7N+dnP1x1MDAxNPR6to1BMGms71xmjFxihFx1MDAxYVx1MDAxYVx1MDAwNi3I6mWEt+NHj5pdXHUwMDExuWlcdTAwMGXh1v7pbYrAt3eMS1x1MDAxYVnK35/rvr79xcZiZ1xu0l1cYjDkefv2OJRcdTAwMWZtXHUwMDAz3bpcdTAwMTFVTn6kXHUwMDFkXHUwMDFj8LemRFx1MDAwYlx1MDAwNS7pXHUwMDE5sKTaXHUwMDBiNLOmpL/7XHUwMDE21O9eSFx1MDAxN19iMlx1MDAwNj2sXHUwMDA3XHUwMDA1jPKBJS/mXHSNXHUwMDA0JoaCybYpsMpcIvRcdTAwMWbcXHUwMDE1wNlcdTAwMTBcdTAwMDTtbFx1MDAwMfKcuIiTjVx1MDAwZUe9z1M/7lx1MDAwZj9cdTAwMTCnUkl5df7TXHUwMDBmwXP9LqHyvrObkSdcdTAwMTfWTsBcdTAwMDS0LV4p8s1AVG2k07d+iSN4XvSFck6vtJ4yq1x1MDAxNJgre+V7SGH6a0AutMtcdTAwMTl0cUGfXHUwMDBmP3Sdkv89XHUwMDA3lTJk+Fx1MDAwMHMw9DkjL1x1MDAwNojlXHUwMDBmR8Q42tBgK7lybryCVVvU6qulq1x1MDAxMabFK8+LZ8hcdTAwMTZcdTAwMTXWXHUwMDBiiZKHqeBUKNCozvzp7+tcdTAwMDXnR8++Rc/ym3/vXHUwMDFheDFcbvFEYfbz3SPVXHUwMDA0XHUwMDE3n3J+7a00aSExN34+XHUwMDE0m1x1MDAxNUHtXHUwMDBiSNpcdTAwMWXuO/iuP3CESJBcdTAwMTlD7bqfsbwp/dZcdTAwMTUqWVPdelx1MDAxNjLgXG65gLxcdTAwMTC0XHUwMDE0XHUwMDBl1pSVsOD5iurHXHUwMDFk0y8zZMX9XHUwMDAzv7pd2vr4SuQ6O0HigXA/71x1MDAwMqySY1x1MDAxNPC/NFx1MDAxMiXOvrBNxlxmUGz7z+GRtCquWeRcdTAwMThcXNktVX/r61hBjP3R17nIizfzKFx1MDAxM8JcdHNd849mXGb2XHUwMDA0XHUwMDE1cj84w5KhfX+Nf+ZI1KVCUX7WXGJ1Pr/1lf3yXG6nim1dd3rNm6V0Uraig7/6bEqC97qeXHUwMDAw31xyXHUwMDAzPF5cdTAwMTHNSiP45FwiXHUwMDFhsiEz9qf55Vx1MDAxN6z+LSPj8a9mNjJ+913DP1x1MDAxMHyePst83ua39+3o+LmLJlxyV1x1MDAxY03Yyogxy69+22Us5VaGie3eJml+6TfhVa2YXHUwMDFiRJv9K1x1MDAwNrGlYiXXQ4WjVmdcdTAwMWFOzEuvzlwi/lxi2m+ly+DWXFxWy7dcIohGqtnZ/adn3Mj5kcJcdTAwMTnu29eWXHUwMDEybOjGPqgu3Fx1MDAwZaBcZpH0m/37PVx1MDAwNy8q5aZ9iKL47nxcdTAwMGLG5d58dzCVXHUwMDEy8lx1MDAxZD8gx15mXHUwMDBlsWda+O5cdTAwMDfzvij8yVx1MDAwZq303fvn0dzpW7dz+J6saoT86Vx1MDAxN1o453ThuzdcdTAwMWYutpDet77X2Fx1MDAxYih+zTcm+7XXXHUwMDAy0L+i2Vkp7XTVvPJh4JD9nVxuPWzWz2WpoITH9Jc3rSr6LdL67lxycqt/6W3+8uev1mtcdPeraZGUXyTUJ1x1MDAwMFx1MDAxN/gnViiC5E2yXHRcdPtZw+/RXHUwMDBiTGXO9/0pnSvFpzJcdTAwMTOHXHUwMDE28batv/VcdDUlMvpJtD9cdTAwMWHrf9Y41Z93b781XHUwMDE1nlHz0/9JXuNcdTAwMTWEturvqpSwc11IXHUwMDE3VJDBznzAb/B5rJVNaFx1MDAxOYDlxLT3P/qnkYiWxYquMfddL0qvXHUwMDFjT1x1MDAxNfbZfXsvc1x1MDAxZbpcYlxy9kejezdujK9Tif2XpufjX/tH719dU1/j1e5fNFf+tUfsu3/Uv1x1MDAxZPNXf9JjXHUwMDE0vjrDutBcdTAwMDeU8m/H/Fx1MDAxOce4plx1MDAxZHv82zF/9eF+9+uzQZAkSvtvx/xcdTAwMTnnu1x1MDAwN5nc/bfr/c2bwFfHgvXnuX6M//16v+P87OuG/Mf1/tadusiT6O6fZzz89+v9NVx1MDAwZVx1MDAwMuj9b2z1S4PrMlx1MDAxNs+q3Vr/na2+/alcdTAwMWJI/85Wl7H4r6aW2GNcdTAwMWb172z13W+GYcm/sdX3XZny85hcdTAwMTJN6f7qV/vXc0tfYy1/Y6uvbt/wNdZj1vtg/Fx1MDAxYltd41x1MDAxOF855v+01TXO9ZguY9m7+0z+VU/nX86NXVRa/jtbXcZcdTAwMDJfXHUwMDFkX/a5zLX9N7Yqp5/H9He2umIk99VTuujaR3XH/7RVXX2NRf+drf7x6X98+lx1MDAxZp/+x6f/8el/fPpcdTAwMWaf/sen//Hpf3z6XHUwMDFmn/7/v09D2lxyo9VcdTAwMTJ8/9l+XHUwMDAzo6VTXHTPI1x1MDAxN+rrmVx1MDAwMfBLwPxnXHUwMDEzXHUwMDE0IKnRovz1XHUwMDE599f3KeCf4G8+l0BJXHUwMDAxO23rf1x1MDAxYuv6/nGIlWpfJ/xcdTAwMTiqI4iP73csXHUwMDAxjH859vc4XHUwMDFjW0aAj0TuU4N/XHUwMDFi++fvXHUwMDFkiCXY//PziONLwNZcdTAwMGaNU/77NX0rv1x1MDAwMPaf1/q//Vx1MDAxZf+5p3/u6Z97+t95T9d/uHvgnVx1MDAxY6J/XHUwMDA27CdgXHSd6LXuavdcdTAwMWP3X//n//E/fv79Vzrl8ZJn//U//1x1MDAwN0qTXHUwMDA0gdEkiiBcdTAwMTT11/ddPC9Ovkx1vv3nr35+9P/8+u1/XHUwMDExZEwwxK3ASeSG4TfkhtJcdIpQ2Y2JU4TGcpoqUFx1MDAwMkuIa5D/+8/ofd3n3uedX5/9V93HZVx1MDAwZb9f5f+6uPp7xv/vXHUwMDAz/3VcXFx1MDAxNi/xw9G+XHUwMDA3f//8n39ccv1/JfGcU8T/Wfus6ezIXSqHr2VcZvdRXHTfwFxu7Fx1MDAxZkNdiSy6/s+m6Vj1P7ZcdTAwMGJcctdBXHUwMDE0MM1ESl2/UVx1MDAwMPtcdTAwMTOLc5FeXvYrzZbwcdRcZlx1MDAxNFGqWkKd1o7Qg21ccuHj2J3zsJ/W+/F5pu+Hy4569VBcdTAwMWV84Cp1Z8d+XHUwMDE09aIrPVx1MDAxZlx1MDAxNWO82e9cdTAwMTYjLlx1MDAwNIdwkt3wjbnReEre3i/aXG7NYLtcdTAwMTUzvOX5cHtCXHUwMDEwOtG4lVx1MDAxNckzv/7EXHUwMDFm/tpcZqDRxVKgXHUwMDFiLepeXHUwMDFiL9uibFx1MDAwYlx1MDAwNLDKMi1toSGAZzdcZlx1MDAwNXeU7Vx1MDAxMzPDXHUwMDFmL2K7Y+3hXHUwMDE2J73l1raGXHUwMDEwv1x1MDAxYnBz3phcdTAwMWWWMe1tzl3o4u9+q+iblcJQKVx1MDAxN6m4VazEvWi8j3wyQLCl2UQ3PHZcdTAwMGV+PjxcdTAwMGJcdTAwMTLBq+LaXHUwMDFl7mTngE15k87p87m855pDnlxy+j2YJiR5a0G32a1cdTAwMWKsulXw2lwiOvDjXHUwMDE2MlG0P4o6ectCXHUwMDFiutO4jPbIvKzhmlx1MDAxM/LjoNmVK3LnJleqhFRxeFM8lUPz5cbqNH17XCKv3j3fT6RcdTAwMWK9Uy1cdTAwMTD0gTIy8Yw829qyk11zXHUwMDE2Rz3XWe5Bm7owXHUwMDA2KUd/llx1MDAwN6mZrezUKohcdTAwMGIlsVx04b1cdTAwMDOsXHUwMDE06brgMFxm8dznJuOPXHUwMDE1fcRcdTAwMTRcdTAwMTGglWN2L4e57OKtTlx1MDAxNKW3UlVETJ5cdTAwMWMvT2bI4GHMY+FPMFx1MDAxMcOuXHUwMDEzwqlcdTAwMWNtqkL9ZyxDssh0J1x1MDAwNeqQvbydTqjubeK1QeNccrZ/IJjoWkbrd91cdTAwMWHQ8MxcdTAwMDa2c+6MLcYyMu9PIFlcdTAwMTVJyVx1MDAxYsVouVx1MDAxNTjxXHUwMDE4XHRidbfa0n7OajP4pc6qXHUwMDA0P1x1MDAxMjyqIPXcJu72jrJAY7xlUmTu/db1WnK4lFx1MDAxNCNcdTAwMTe4OWhcdTAwMDdWXHJcdTAwMWFUtzNmpdzApTtcdTAwMWHKJqZcdTAwMDG2XHUwMDA2d5bb6dZGucp+c0VWtIhcdTAwMDVcdTAwMDF1k0+fs6Uvy2JcdTAwMDX99tnPZd9bO+VAcFx1MDAxZMhM7WjxMWgz61x1MDAxY0DFNk+1SNHh69jdLDpcdTAwMTjE/MYs2/Zkd1x1MDAxYnE5KZJbZqtcdTAwMTGv5YR2999cdTAwMWHSTpm6dni18K5cdTAwMDXMWaTttkHb5z1SktpQrnPMZrXn8kCYSYZj8lxyalx1MDAxNOhcdTAwMTHW8m4jPV2xWJLAweh7j4TYnV0l2OmwXHUwMDBiOPBcdTAwMWXHLdtOZ+WS1q6g62JcdTAwMTM6bF4sx1x1MDAxZW8rvrVcdTAwMWRcdTAwMTG/t4Nh6FxylXc5YFx1MDAwMVx1MDAxNS7iquBcdTAwMTBcdTAwMThcdTAwMTiMXT7AvaZ/UlQ9XHUwMDE0ZDrMNlx1MDAwM1tcdTAwMTnHwbYwXlx1MDAwN+WtvivmOThcdTAwMWE43orZXG4us73nZud7Xk5ccodcdTAwMTZNiZ1D+0Kpz0mBRbGgqltcdTAwMTLg2Vx1MDAxOXE0683iPbSeXHUwMDFknJWfVbJLXHUwMDBlYW4+K0A3PkonXHUwMDE58XfcwUBcZqqDLdrcXHUwMDBltk1cdTAwMTe0yKiQXHUwMDBi8klDpkrtTYZN01x1MDAwNq1wvkNkfPGAO/tcdTAwMTPvpoLLOcN2fFxcRuGWgnDCy5BdLFtcdTAwMTWGSYFcdTAwMWFG6j5BXHUwMDFiq7GpxYlcdTAwMTKuUYmCgrB8WnWaw1x1MDAxM1XFXHUwMDBmXGZGbypcdTAwMDBcXO5cdTAwMTFbXFy80l1+wlx1MDAxZWfsiVx1MDAwZjqsfjJupSoou03CLqfKh/7M0ZS88Vx1MDAwNH1OPDpwUqpcdTAwMDYgrFx1MDAxZj7X1FxcstBcdTAwMDRzVyClOnFcdTAwMWK57pxcdTAwMTWVxpZcdJ5cdTAwMWaWrJ3GXHUwMDFhNUO8tLmIqWAnXG7jXHUwMDE0lfGWzHN1V5CKu2lcdTAwMDHaMOrEWiCAlFx1MDAxMcbhznwk6UhcdTAwMTJccnOHXGKX5jY0fMaqzda3/fWIRFk6XHUwMDFkeZBKIXjZLaKT6Yy6XG4r6CTtXHSfXG5cckM5hzFzXHUwMDA35XVcdTAwMTk1NrNPKVFcdTAwMTAgV3P36vg2XHUwMDBidSFtrXKsyypDxLVp8fM4XHUwMDE0NmG9XHUwMDAy5jwvk7/fXHUwMDA34HkvdFagNTRcdTAwMTWPjdrt3dK74vFwc1x1MDAxOL2O4dcryzaMpKohXHUwMDAzZ1x1MDAwZntcdTAwMTZ2QSuGh4RcdTAwMWVoQaXHzaBcdTAwMTeGXHUwMDAw624nLNQ8JkNUXylH8MBq/ZyEyG5h6aV5uSogOc5cdTAwMTmzNlfnidxcdTAwMWb3NWZu5sowU7a7sVx1MDAxZPD4nd9cdTAwMDJPao3urUzgydtEgFx1MDAxOMtiamnpUs7AIc/YfXyY90dcdTAwMDV8XHUwMDBlTedccnc+7FbLXHUwMDAwM4jmjSSdU7JbY7d5ymhKXHUwMDExXG5C39pcdTAwMTdPm4Ilue8v0JSdL1H3fSlx0MmXXHUwMDE1OVxyfD4mzJGOXHUwMDE5hPcmXG7Byj7EqI0tXpTHnD5rXHUwMDAyqXc2qlx1MDAwZaK36GWC5WtcZtNcdTAwMTNLYiWzXHUwMDEyklFzV1x1MDAxNqXldkSKXa/HjrNcckbqPVx1MDAwMONi7/h90Vx1MDAwNO1YXHUwMDFkXG40rEQ5N95RSTx7XFxcdTAwMTZjjdVrIUJqn8kybkYxcZJcdTAwMGL2K1mapifZsVx1MDAxNkzx/Nylu3uW7Vx1MDAwYkJPboRcdTAwMWbrbVx1MDAxZk5H4b1cdTAwMTJhzCBaklx1MDAxM4Ej0Vx1MDAxNlI170UpjIVcdTAwMTWylUx5gOqG5sgr6UKHXHUwMDA301vLUfzJb1x1MDAxZSnvl//TxHlHR4zEmujyXHUwMDAxQrSycV1OXHUwMDFmbK4qXHUwMDBmXHUwMDE3ooPJXHUwMDA0wTXQp8Ld0K/oha0xXHUwMDBmXHSV+uGSbCFduZiERud2XHUwMDAxrs4zsKi6XHRi3LF5vJtcdTAwMWSO/XglWZZcdTAwMDTY9OZcbvbW2fJcdTAwMWYnlTDO5IGiJoS03lCHXHUwMDAxzl05wftcdTAwMTPclo33Rfc2lzt3wYuQuU9jRGpJolpX8Jvwj5vcXHUwMDFmb2vRglpVXHUwMDEzn1x1MDAxY5KysW84ZN/UdCBcdTAwMGJkd23YesiPe5KKzYO4h31cdPK72dZuuraJ4KnzloeOoDiuxK2TXHUwMDFiqI1+T5ylO7qPMHFcdTAwMDHVdyizUYU9oMJroGO3lHDVaEFcdTAwMTB9tCPlVTV+3LTtcfaPtlx1MDAwNFx1MDAwNKbon7ilQFlb1YGlIZC99yzVZOraPDLAnSMpXCLOwojqeoNicHpFXCJFunVcdTAwMDd3xVjm+bqT2Nu8rbgtVu6BueKAi4q7c+RCY21gm7nU8zGjXVd4XHUwMDAx9I1cblx1MDAwMlx1MDAxN26y4bsl48BR8FtGXHUwMDA07Z0hNus6cGCKVMXYzz19v4j5ntS44kxcdTAwMDfeOctcdTAwMGJ/muNcdTAwMTBcdTAwMWZl0d7cpC5cdTAwMTj+bVwiuHvYz+2k4S8wwF6yXCKGkHWGXHUwMDFhs6yJXHUwMDFk8W/r+eX5UKhcdTAwMTY5KTfsimKbNKXP++qF+lMlouymxHfS5Vx1MDAxZVx1MDAxNVx1MDAwZvBUOY5cdTAwMDOWXHUwMDEyMpNeXHUwMDAxVuqWorViPHO2Tr/7eGvIK671oc3eJ/FDl6Tbk7Dee+8taYjEMzdHy7ZcdTAwMTfZhUtcYrNcdTAwMWWkXHUwMDA1xN1FR2bK31x1MDAxY1x1MDAwN16+YfifXHUwMDExZ7YogVx1MDAwZjKE5leKTPbN0Fx0JVx1MDAxYkqaa7GQhsKsTjmUyazPjFx0R0dxz/eAZ6WwJtrkVkxccl6H8EhmKlIjzletfdY/fVx1MDAwZuPmKeiKz1x1MDAxNZzbzVx1MDAxMa7wpUklXHUwMDA3fWDc6W6W8IRZxqhcdTAwMTeZeWUqdO97o2P9h6auIVxuTZVcdTAwMGXH93pLt7TbPFbm7qqY6OnpucZcdTAwMDE/2t6aJVx1MDAxZVxcXHUwMDE5RS+dU5256CmNq0x36IWBduyczDm+h1wipoSLivU49nyiKZLX2iS0XHUwMDE3Yyri7lxc2ee3JFx1MDAxZkjOo2hG7JlieVx1MDAxObxPg/GHXHUwMDBme1x1MDAwNlx1MDAwN9dccrG1udlzSVx1MDAxYotqJOtK8vR3wzJzcq2388HDII6oZlHhKd1ccoRcIpe65JS3pFfPqe1fwts+ZoZ+LcrtXvH2XHUwMDFlXG7TnL963UXaXHUwMDA3cD5cdTAwMDRcXFx1MDAxMDxcZlk05lx1MDAwNVx1MDAxNlxcVVx1MDAwNX5cIlx1MDAwNs04b8aLyFx1MDAwYrkmhcM/9HNI8OiGsUQzSlx1MDAxYnNlTfjRO9Ozkp5cdTAwMTdcdTAwMGV/XGb08CmHXFzhZ9yhTMvvu5KPo1x1MDAwMUjGPpemP1x1MDAxZUzA0D5OXHUwMDFkXHUwMDFmmr0gXkBZ8zSVcCpcdTAwMWFZXHUwMDE4XFzQT1wiw1x1MDAwMmbBgo7hsaZcdTAwMTauN4yN581272W/ZTsvwbV3k9bvkU66lUWIplxmaFx1MDAxOYOuTEB4rMBcdTAwMTO0wniJ+1xuklxmXHUwMDFliko5Zp5cdTAwMGLLXHUwMDEzISiOhe7tfiCPOHrO7qDvvFV3hiNvXkGuLMM5TC7Mr1x1MDAxMvFkqn3hM+Q8JSiJumXV7sIraDfL1fRcdTAwMDJMT1x1MDAwN0U/Q1RyjrlmwYfgbIUwo0RH+06nXlvRSZKE1ljjIZ+uXHUwMDBmXGL39Tr6wizVMMcpPquQXHUwMDE3zD1LO2qHrFx1MDAxOXBcbinYQHBcdTAwMGXX1m5inkxcdTAwMTPb57G3K2P3OrfYuHOsi6U5xVr8XHUwMDAzUV/Cfc3WTcKs88aq77ljfJj52Dc4TpXXXHUwMDE2XHUwMDE40TvpP838/orea7fqqeGZLJJIoi9cdTAwMDKOTe7OXHUwMDE3XHUwMDFk7Fx1MDAxMlr3zuZcdTAwMGIxec9OWs+Wc1x1MDAxY5F4zFwiXHUwMDFmIaHm4mG2eqK+ilx1MDAxYZnZNbhcdTAwMDfHitDPt1wis4SKPISIXHUwMDBibdiNPE7jRFxmjrHU98v7kFx1MDAxM/7nXHUwMDAxblx1MDAwM/5cZl6L4Ee3ZFPgjUI/uIquwlx1MDAxZa/jRS+d6tNjprtcdTAwMTL6yixcdTAwMWIxaNNcdTAwMThanG93JXta3uPG1zrzuJ4yZdpqJzx4vZpvMsdEp5s67T1evt3rqnJ/XHTE+yFCXHUwMDE00Yr1lsmK9OEs9lx1MDAwNkfux8B9xEpF1lXnXHUwMDBik4bRWFx1MDAwMbCmiHX3XHUwMDBm/nZkn8ZQvVZcdTAwMGVcdTAwMGL+iG6KNvntXHUwMDFh8ftcdTAwMDWsu1KiNCDuViTII1x1MDAxOb/fpjGZ3ktMfeRyYDCD2Vx1MDAxZTRcdTAwMTHG3iV1MULOxmumLuhcdTAwMDSciXJBQ4KKkiBoWD5WXYSkNbIvd/6lXHUwMDE2TbtcdTAwMDTOdY0qXHUwMDE41Svw2FxcjWZlsVx1MDAwNO6uJHOQxUGtaeGziDFcdTAwMGLo3ZyMXeFdvFNRnvdOelR3RFx1MDAwN9Tddl5cdTAwMTjtPKzm1lwioYznhfmVozbJNs0gNbjcgmPTz9NcdTAwMWZcIoBcdTAwMThK84kyMThfayg2XGJcdTAwMWXiK1tK0Dvq0DkoW+EjvT/CPrklXHUwMDEwYJbbLiRAMI305M5Tp7lcdTAwMWFcdTAwMWXkh5Ar8+eVPIfCJD/neneDlFxi1Yi96efbNKnFaGHilkdjd29p0vLbZpbDXGJsx1x1MDAxZK1ok75cdTAwMWTQ43n74ON6XHUwMDE3XHUwMDAw6/pcdTAwMTNzyi2duKMq7oQlhj7zXHUwMDAwvitTUGxTrFx1MDAxYd5Yy3m1rJfGg6/YXHUwMDFjJj6V/i7trPqwe7//VPJcYtXWXu9Ar7hB8pszoPOkmGtW53l+71wig3LHiaPHQC/yfoOGkJPv0YL27ipcdTAwMWJKyZrXXHUwMDFjvp2o7Cz9+TJU8jHEl/NPyJPVXHUwMDFi8YZcYueFvvHObOHXLnpk5rxcdTAwMDRcdTAwMWJQ+XW62yxBLSb1REOX2JxiL1bsPvBkXHUwMDFilebPXHUwMDFjIJAgcsp72LSaTnHnU9idXHUwMDBiNV+IOWJcdTAwMDfuc+eusHs002CPW1x1MDAxNHOGea/edlx1MDAwYlxmv0CwYmm7p+9BpcstmJ+zbNk4cKpcdTAwMGZUd1xcsMhcdTAwMDBcdTAwMDa3qZeNQ+JLf0eEhIPOzihTXHUwMDA11Vx1MDAwZV/gjWyoOSdcdTAwMTBAdFx1MDAxZHT7XFyOVuvAubCjY5RhXHUwMDBmZ8nIQcZNjpCy5VxudFwiwNN8v3be5myxb+nwmJvCSztBU1x1MDAwNiSCjOt6XHUwMDA3ruQ4g6hcdTAwMGJjXHUwMDBlXHUwMDE13MLJUE/0a3xodsEh6DBaXHUwMDE1MNTczVx1MDAwMJvlINpXnVOZYLdcdTAwMWbtXGLPIWlcdTAwMDOMV2n3Lbo6XHJJzG1XytfbLPWdvndcdTAwMTbOsVx1MDAwNL190jfeMlx1MDAxN4+fsXurgJeKvFKFfXhLbNBcdTAwMWNZzFx1MDAwYqHc6JvHikRfe1x1MDAxZlx1MDAxNlx1MDAxZFAx1ZSs/VxcMfK9IVxcXHUwMDAwOjW7z/wm8Lam28yL2eqZY9s3ny09mbApXHUwMDBlXHUwMDA2LHJcdTAwMDCbReHJ8tyzflx1MDAxN59efZrrjYKJl72zmc1cdTAwMTOiyVx1MDAxOSX2bNRN3lx1MDAwM+BcdTAwMWZcdTAwMTNsllx1MDAxYlx1MDAxZC7mR+yUtW+/8/vN8pFRM+3LXHUwMDEw/ciBXHUwMDAyO9oomPyYoEJWauGsVz9Ogb5cdTAwMGJoXHUwMDE1u6F+pOyzlCdpSMU6/LRMVUQ4XHUwMDFmgCS6S3AvS1x1MDAxMtzMuoXAWFgmuIV8N1x1MDAxY2tcdTAwMDWdVfPkXHUwMDFkYNxcdTAwMWNcdTAwMTg2VDjlRcUgXHUwMDEzfrL5XHUwMDExXHUwMDBmXHUwMDFlOXT0TJZ1a8+su06sKnFcdTAwMWbE5EmcbflAZmxhyibp4o5QnPnk7TZcdTAwMGJgvlihrVp6Lr+fXFx65Vx1MDAwZVx0ip6iXHUwMDA1rFx1MDAwNE6o2tbcMtQktu/E84qP8oNTQbFDb71FbFJWlqLlsqZcdTAwMDBcdPhsr2N8ilpgXHUwMDExp32La+S4XHUwMDA3NPKgQa1cdTAwMGL1vaRRXHUwMDBmpD2BYoZcdTAwMWWpXHUwMDA0MCpcdTAwMWP+ZE41i1xueuHvIHrEr5RWWt5cdTAwMDT3+TwnpFPCXHUwMDE1Q8BcdTAwMDdcdTAwMTShXHUwMDExIFx1MDAxY1x1MDAxZVx1MDAxZopuitVWW++FJVx1MDAwMOZal30w4pE9n9m8JzpklSZxyiBOwjtxMlx1MDAxZi6a3Fx1MDAxMzcvm7lsgo7XySSs96+RZauHy1x1MDAxZFx1MDAwNC3unojtg7JcdTAwMWGU5MWerPGWSstCxc0wWv49p49cdTAwMGWWXHUwMDE4XHUwMDA0aOZcdTAwMDbLrvdGXHUwMDAzXHUwMDFjv3jUi1M8QXkyqlx1MDAxNDnF03HV5aFfpFx1MDAxMdI5nf+0j+xcdTAwMTHAQ0/0XHUwMDE14lx1MDAwMdyknVxcsMLw8a6vrGVDlsxKwLdlu2BcdTAwMWXn2WQxXHJkXHUwMDFj83bOZZJIirZYXG5n6WalkZCCQ3Eubpy6c/99XHUwMDFmY65cdTAwMDe8dZPhNoMrdEmzNyXxXHUwMDA29/7pIzFcdTAwMWSDI95JuqAx7ltjfJG+XHUwMDAw8dxcdTAwMTftS6zC7keD6Eav3Vx1MDAwNtmQbCVOlFx1MDAxYrhu2i1fXHUwMDE56pNeOKpcdTAwMGYrgF1cdTAwMDDOkvuqQNeTXHUwMDBiVODoX1++vCey0l5cdTAwMGUz0SfPcFxiq1x1MDAxZFx1MDAxMHCavm1pk1x1MDAwNvvZa0n2TG/n7coqXHUwMDFjyfLM+yZEffcoy3sudeKrMJayK4jPqy8/XHUwMDE0XdM4XHUwMDBmxFx1MDAxZdE/XHUwMDE362slQec0XHUwMDFivvNcdTAwMWG6ndb9KOdcdTAwMTf7XHUwMDBlklxyKKa3MpUtXHUwMDE0dff2I2vYQMldIVx1MDAxNIJN4WlA4yyv/n5cdTAwMWVVn1FcYlx1MDAwMLXt4TFcdTAwMGaypMuYOlJcYkGv1FdcdTAwMWTi/H5FLdgpcPyO+3H5XHRJ9V2WNv+oXHUwMDFlXHUwMDAzXHUwMDFm0lxucL+bXHTXg5HoXHUwMDAyfosoWoagfkbTtKpcdTAwMDRcdTAwMDDGN1VnwWTh7mu0jLjIcJSoZzVvcfuD0V+Apq2u0XiDpSj66/SGhd5Sa3dy6/M6p0HsX6XAKnffkGp0XCKHXHUwMDE2nlxuPypgXGbN31x1MDAxM1aAXHUwMDFhWPJ7ktZPglwi71pOeUPIy/hirfJ8sdvTpbjrXHSg9kIrfS2Wn5KS+o9lXHUwMDFitqIkMrXHn3REZUZlXHUwMDE1rkVbRVx1MDAwNZ/5geqPXHUwMDA1OppsW3fuTjGnZt9cdTAwMDfapNJlXHUwMDE42rfPqMDfX3HWtkecLug9XHUwMDA0yKpNbyeT9/uAYNbD3lWmw5PsK6tPMnWlXHUwMDA2WNg03vx5XHUwMDAy20bx2rFtXHUwMDFlXHUwMDAypbi362tl38hL31x1MDAxN1x1MDAxMlv2tIxcdEdhma6P+1x1MDAxOYtcdTAwMTFcdTAwMWLo2VtcdTAwMGLGXHUwMDE4joG8ZuPCO1xynp1cbkdcdTAwMWVzVsNcdTAwMTBcdTAwMDdEINnu5VJcdTAwMWQ6ZlbBSTO90tguuMJ4ftZTm6etfpYlcJ5cdTAwMTfdf1x1MDAxOcvSWqFcdTAwMDT7dDZvXGbXz0ogosq2XHUwMDEz3KxOXHUwMDE5KcaNOSRcdTAwMDE7XHUwMDE1tHnM7FxiLYN/uYQ/P3RKTejKurhcdTAwMGKW4FxyXG5XXHUwMDFj5/Cl5lBcdTAwMDWCXHUwMDA2+TJyXHUwMDFhXHUwMDExgaJ23q/EQ1Vuu+1cdTAwMTdcdTAwMWR1u5hcdTAwMTKhXTmFpCyjRCZcdTAwMTSmXHUwMDA0nGu0XozFXG5zXHUwMDFmalx1MDAwMM9QTUC3PWHFXGK3QGKVNmtyXHUwMDFmb+fvVjZHQVx1MDAxYlx1MDAxMThF9zRcdTAwMGVcYtnY95My74ZhOlxiXHUwMDA3KXF7RjtcdTAwMDZcdTAwMDTBrlx1MDAwNDm9cOYqXHUwMDE4lY9sKzVOR7+lXHUwMDE5XHUwMDBmhDTix1x1MDAxN5qa3HU6dptcYlxmkHn2ssOktD/OcrFcdTAwMTcpKd8lXHUwMDBimVx1MDAwZe57y+Jcclx1MDAxY3fwxJpcdTAwMGJHzpWCrajGeHtTb5C97iSfVv1cdTAwMDV9jVlp1f6uPbhcdTAwMGZAe8RyJSC7dpZcdTAwMTgyTfFG0rNpfFtu2UJsIJhcdTAwMTNcdTAwMTkvXHRcdTAwMWLc88jU0Vx1MDAxNvX3XHUwMDE0lSZcdTAwMGIrMvqguI5xX/xcdTAwMTnWPZm7pXI7n0dYr8SD3FFcYqlcdTAwMTkrKMe0XHUwMDBiXHUwMDE20U+uXHUwMDA0W6pcdTAwMTfdXHUwMDA2I1x1MDAxMpd1ouXqs1x1MDAxY2/oXHUwMDBiXSHarZU3pap98Fx1MDAwMYtcdTAwMGIgs1xyOvye6kZcdTAwMWUoNnu+wtmC17VBXHUwMDA0tETULFx1MDAwM+wsXHLa3K9cdTAwMTanc6NhlUpcdTAwMDFcdTAwMThlblx1MDAwNp0uRuO+PWRaXHUwMDFiYYXFXHUwMDAxVuucKdJuuu94NaXwvINv/FpYndhfbyx+4vQp2EIqKFx1MDAwZetqToXZpaI0vHI6otKk/L3tuFZqXHUwMDEweMxcdTAwMTft4dFcdTAwMTZsLlx1MDAxMv/gPVlCz1x1MDAwZlx1MDAxY1x1MDAxZG5cdTAwMDBhOOBx3N6v9CdUUlR1XHUwMDA0+YJcdTAwMTmlXHUwMDA0XHUwMDBmI71cdTAwMWShOlx1MDAxMa3Wl4gmw1x1MDAwNkqYV0zcWFx1MDAxMdjFiitOXHUwMDE4Ma+eNjOdfm2d5+xcdTAwMGWIKlx1MDAxNjnjT6LuXHUwMDFmXHUwMDE0XHUwMDFmLFx1MDAxMoJcdTAwMTnO9WFccmewp7xpOn7yXHUwMDEwb5vTkLBccpZcdTAwMTKfrWFcdTAwMWKpWCtIJ3UsXHUwMDFjIO5No2zegmNvwcO2XHUwMDA0/lx1MDAxYUvbnzHNiFxmXHUwMDFjQsNbvGlK2SjzgjiWt5hAXlx1MDAxNGxBPyOlbVx1MDAxMOEjT1xmfttXmOWKtiqtRl9h41x1MDAxY2lHtsw1XHUwMDA1XHUwMDFkObA9+8T6Mlx1MDAwNe49XHUwMDE1pFx0udy/O4iw0Fx1MDAwMcM9dYjSXHUwMDA3YqFcdTAwMTD+mFhdnlnAMlx1MDAxNm4tiFDQXHUwMDE313gwW1VcdTAwMDS1snyEhOWr/cJ+t4+3PVx1MDAxNjOV9K4xUl7FO+uIkFVvXHUwMDE1p6nJskTKlMNVXHUwMDFlW65cdTAwMTBOab1ZNeL75GJg3cn9wlx1MDAxNu1daZrrWUlDvbNcdTAwMTVTrv3JI/vCM5g8+Y1WilFX5lx0dqbXM8ew7XVcdTAwMDY3iZ/7YOdKXHUwMDBmbl+vWnBzJszCcWPSXHUwMDEwWm3nyvnArVxuT1x1MDAxNKuDoISl2VgsUy5cdTAwMTdC2pRcdTAwMWW9znhffmD2RcwrnO+1ttm1lZd98k6YejFcdTAwMWTW77v/XHUwMDAwhLH3sDBUs4ZcdTAwMDNf42R4NaZcdTAwMWMsTYtcdTAwMTCnkCeKfdNDiMZa9KHOQH+zyUBez8pWbrU4+Vx1MDAxNVx1MDAxM8Dtc7GaN3P2O8nPoFx1MDAwNa+qw8yZXHUwMDE5uerujCS/WjLqvFx1MDAwZdSAXHJAiJiLvyH5TqAkXHUwMDEzjyS3clx1MDAxZaeAiHDneDzvVrlcdTAwMTFcdTAwMTn70Gf3bC5T2PsmlttmvSzjfuJcdTAwMTaFhf5wsp5cXDDQ6bAlXG5cdTAwMGJxaFx1MDAxNuu24G1cdTAwMTM/bupcZlx1MDAxOemUIE3JjcTzYCpUvZ9Onk6peKWA2ohcdTAwMTBQ34ti9Fx1MDAxN7i9eeZcdFwilzJmXb14XHUwMDEz+HyQab9cXM7rXHUwMDFjXUpjUDisXCJ5MSQ9JFx1MDAwMNpdwS9cXCVEys16VW9cdTAwMDJcdTAwMTHgz8dcdTAwMDXSleuyXHUwMDBi269nOlJFQ8BMzV2eQpjf3+GV8/Gn+MJe/W3zXHUwMDE5oo3l+vV2PCSXaOiuyuzS3LbBe66GbTBFUVx1MDAwMeJeNn3SPNR6a1x1MDAxNcJ4VbaOqTMsnIVcdTAwMWRor1x1MDAwN6NSY5m2MkjkUuXzy+DoXHUwMDAz6V6+XHUwMDFiXFzTmDzl/JNcdTAwMTUyXHUwMDFmpGZsROKSV1x1MDAxMWfFm1x1MDAwMa+wyzFWZDWsdGyPJ4/FhGxBt8nd2ZRHXHUwMDBlRDBs9COapYpcXICRTP2ksVx1MDAxYcZactdWeXUm1JysXHUwMDEwODVWXHUwMDBmLsxcdTAwMTHN5kNJJrb/vEiVi7lGXG7Xl2aTcctcdTAwMTGJSyhcdTAwMTLaXHUwMDEyRuVoL+yCXHQ0PqKTm4zD/cq38pU44v02XGY86ytcdTAwMTd3gXpcYufHJitcdTAwMDJirPBcdTAwMTaS5/52QliK0ZGmxshcdTAwMTleXHUwMDA2OG2O6FxiUL7njNdcdTAwMTm2MTbeXHUwMDFivIB5Qkj3Xlx1MDAwM1tum9yH+qCPXHUwMDE1wrGr0nx04c1cdTAwMDPrWtYlTDrIeLetM8Iq7XU/w5v+XHUwMDA200lcdTAwMDaGQVx1MDAxNmOWZ2JKXqnh80yxhLmnXG7IgEDdep7CI/61q0WjMlx1MDAxMstKJFx1MDAxOW1gbVx1MDAwNS1tilx1MDAwNoupxLZSwX1uxn0sXHUwMDA3kHCWq4iLRG2n6fpcdTAwMTfSa6parnSU153lRGJyZKy3M+ewVPSk/3zh7ZlBXHUwMDA3jI9cXMmmLDLVwdwmgPTEhPY5sSZC416oXHUwMDA24npYUFx1MDAxZExiPVx1MDAxOLNWLU2/Ia/BIaVacZ+PaiHw+ZpDylIjhY1xsndcdTAwMTKs7JJ4RFx1MDAwMFxuTWZCx5ChdIDtfpRcIiT7OnushHLRlmFNKdrUK1x1MDAxMl5k9s4mjTZcdTAwMTFVXHUwMDAywcVy+Fx1MDAxYutbXHUwMDE4/1x1MDAwMMuI+4TMXHTwRsA8u+LsU1x1MDAxYWQ2v9KLUPLDmGdC3pb8XHUwMDAyXHUwMDEzbjnAy1x1MDAxZOo3dW5e/kJDrUNcdTAwMDaMxoTdXHUwMDAypMPxXGKnXHUwMDE1w1PfXHUwMDEzY9jOPeefXHUwMDFkhZzUentcdTAwMDVcdTAwMTfnj5+hhFm8/EkwXHUwMDAyfdo1yFFj5Vx1MDAxZVx1MDAwNDOhO1x1MDAxMFx0R1x1MDAwZo/sfOWPXHUwMDFhn6t4XHUwMDBm00Z4ckdvPbhn062HI1x1MDAxMVx1MDAwZbHD0Vx1MDAwNWqHxJNF7YZcImJaXHUwMDE3j7yNPsLXrfXtJj9D6m1T+XXvpcjWXHUwMDE3dMxcdTAwMWO/WWHNI55cdTAwMGJTf1x1MDAwNlxcpemXRouZq94z8SQziMe3W3vUXHUwMDA1rsyv+UN7JI9AVp0kyUGTazVcdTAwMWNccnG8Z/ZoXHUwMDAzXHUwMDEzRvB9dXfu0Z4qTy3+IT4zgVx1MDAxN1x1MDAwM/02sa9ccjf9/lx1MDAwMlxiXHUwMDE11cZPOTuuU9ZcZjEs1/FcdTAwMWWALzT/dH3VkzryLN64/Fx1MDAxYarDzXtsXHUwMDFjhFwis925Ri74M0ufXHUwMDAwXHUwMDE1XHUwMDAwqkbxXHSlh/s0MN/HTiq/SVq2v4cjIIDuXGZcdTAwMWVIWstcdTAwMGZ8OUyCtOi7kEJSXHUwMDBi0mVoUqHZPUqM25r8QrDC/WJJXHUwMDEwfpR0N/ZcdTAwMDOpXHUwMDA16ceYO23jjlVMREluhsHMP1rHdfzz5Fx0doviluL99H4l+dWlO6hjQtK62zYkVImDo/TYNK/3nm4pdzPLUTViffiIhkH3/tNnMFx1MDAwNyFcZsIkSk+LmpHqzsdcdTAwMDVhXHUwMDAygkPgZXPRcebKXG7yPoKQW1x1MDAwYr+MPv5cdTAwMWEnXHUwMDEzWGAk/Vx05PftKb1cdTAwMGX5JfuP3sbaRmRcdTAwMDaUn32tV7KS/1x1MDAxOIXd0uq0rXMg67NkNWhzYVx1MDAxOF6uWGl5j4hcdTAwMGVoUNqrZVx1MDAwMmTyg5WQT+5uzyOuXG43+uLowZ2OXHUwMDE3XHUwMDFmS6tUXHUwMDBlXHUwMDE0+v02n0hXRFx1MDAwN4Ha1KKMYaPbt93n/Eo6x4s3rUm9vVPGv00h3l20I2nd+jW/ttHjb09XXFxvS1m8ObRcdTAwMWNcbnyjqG5cXIjQUT1cZkKPjVxmb6tcdTAwMTJcdTAwMTVi/H6HXHUwMDBmtbRcdTAwMTZcdTAwMTiR7/ZRXG5cdTAwMDdzz+by1q37kqdcdTAwMWLyIIv5Q1x1MDAxZK7fSVjR5iU9XHUwMDBibNOh5c7Rqu2YqPWkKlx1MDAwNYhh4YzOyVx1MDAxMTarXHUwMDA02VIlL02Yy0e7venN1OhcdTAwMTfU71x1MDAxMIfVa4a/XGJcbvuE495yXHUwMDAz/1x1MDAxYZrR/GBjfDN0mynojqvSQtxcdTAwMTHbT1qU4rA5Ie8mrFx1MDAwNO2CO0V+2GtcdTAwMDOhXHUwMDExTu/iy3tff9L3nlP43Ya07IExWnP5UVx08v6D+V7BysohyyrOaZZyT15cdTAwMTdcdTAwMTE0zLOgtTubh7RcXFx1MDAxZYxa0M4n9Fx1MDAxY1x1MDAwMZxFXHUwMDBm3nJcdTAwMTHEaPFej07hXHUwMDA07oE7ZFx1MDAxYlx1MDAxMO+sen7m5rPBXGJ8ccbicvNZmUO8XHSyN4o+nlwinJBcbuBcdTAwMDAq2e9cdTAwMGao+GTxXFx5w9x09PWGXHUwMDFk/CxcXDlY1EJIwajOX5rKg1ST8lx1MDAxNFx1MDAxMlx1MDAxMmBtSW25a4NkkuPXtpdcdTAwMTlEjmvt2vdSrrUwMP3lwUTaNXpbq41isomgO+yInc/Ky1x1MDAwN+tj1iiZ5lx1MDAxY+XNhFx1MDAxMHXQXHUwMDBiXVx1MDAwZdZoILzmJP/I4Zgkpv5cdTAwMTOBcVx1MDAxYve3lqJEh1x1MDAxZvbQkDitXHUwMDExZJiln7B43F0piNLH/aJcdTAwMTYkd5PutUKYn1wiwtJ+ON8n9Vx1MDAxNk24IMtcdTAwMGZYu1IhdTxeOttLXHUwMDBlXHUwMDBig9It5jp5X4SN5ez7w1x1MDAxNW1K5YxcdTAwMDJOOz5+8cbyUmdZwVx1MDAwNLdcdTAwMTJhXHUwMDA0epu6bZZaRUreIKFQhMvl01x1MDAxY1x1MDAxZsGT4Su2M0VDWoPo5U3TjXyzxDNq70iEqKHUo1x1MDAxZj1szJJVY1x1MDAwM++dnVx1MDAxM+9cdTAwMWW1SSdcdTAwMTO8hlx1MDAwMcSAZDXnrOPMilx1MDAwNK9eoiGwxbxvWjabXHUwMDEwtDzz8J6IwfPRUVxmL5qz7kiUS2vcV/lcdTAwMDHBQypcboQ3o71cdTAwMGXjMET+Ys7iK1xuulx1MDAxYfaNKd6ibdlcdTAwMWK0yyflruPy8ULh4UPhxJSMknXkjzHKTTNoS3ZcdTAwMTfnVPWDY+rnlHfSXHUwMDFkxpFcdTAwMDVtJGQ8WF9tMlxu6cFcdTAwMDPS348mrzSU4LbJlCYmnEmUl3B8QD7hcIUzr1Y2pHaD/lx1MDAxYU96I59cdTAwMDVY8TyOcuUm5HFcdTAwMWKAvquYXHUwMDExleUkTVx1MDAxMFwi3KSpRo06nm7o5t9eclHhwvyJXHRcdTAwMWSMir6jdFx1MDAxNGBi9YjQbWt2rD7Kjpur+1x1MDAxMcyMXt6Y9n1U3V24O6z3XGIq/iSsYnjCXk5cdTAwMGKIXHUwMDAxIVxiPNVv+8PsKFZ8MlGIu7s4fj6PmOpeXHUwMDEydtmIU/yAyMsp5pJlIHw7w1xcVWrQW6b4V1xmea2bfFx1MDAwNFx1MDAwZVx1MDAwZbVcbtwv6nDfqzEnP21/XGZL9lCviCxcdTAwMDC/sIKnXHUwMDEx4E1yQCdQXHUwMDAzaebVdfFcdTAwMWFcdTAwMDVcdTAwMGbJkYeKXlx1MDAxYtxcYno05WVhYoZcdTAwMTNGW1xmMILbU64qMklccuWjOfaLXHUwMDAyxsQri03XTli+V1x1MDAwM1OB1ZqBy65HNvSAnXx/LPc+XG6dwYWWzlx1MDAxOO5MR6hcdTAwMWNcdTAwMGJcdTAwMTaqf1x1MDAwNfSxa01UUGf17kNcdTAwMDdcdTAwMDDg5a9jsJ1cdTAwMTn+TFx1MDAxMFx1MDAwNNNHjDHrXHUwMDFhXHUwMDEycNDaKbhcdTAwMTNcdTAwMDKa1oHdtVxuNG5GvnJcdTAwMTeWTlx1MDAwM2yakzhRXGZ+N/HmxoVcdTAwMDP7qpyQ0dE3j3LzWFx1MDAxMsDbTXRoXHUwMDAzyOvV1/TdI/TQ/EywOVxiwYBbXHUwMDFjwHstaiQotmCqW9lVKeeVwCVIa/aYnivyZGJqQlx1MDAwNVx1MDAxYYPVdXFw7GLGwek//KKpPp1rNlx1MDAxOJiHzFx1MDAwNIqHXHUwMDBmXHUwMDAz+bhcdTAwMTXHnXZl17BlXHUwMDFiiNHtytG65t65quZJ0PQjrUYyaPVcdTAwMWVcXLkjXFy0elpcdTAwMWFBniH2eqZ6aizW0oC+zehatlx1MDAwNlHLvM5PXHUwMDBmKdJLYVx1MDAxN1uvXVx1MDAwZiyeWlx1MDAxYnDsfu9pXFxcXNiyK0LQi3npc1MnvvYkqHxejcCNwJtt026nUvIgtlxmROLWVTVcdTAwMDXCkFx1MDAwMybL89vrzvD2x1x1MDAwNmFD0OSidOvlXHUwMDEz1Fx1MDAwZVx1MDAwNuZcdTAwMDBcdTAwMDemPlx1MDAwZmdcdTAwMTVcZvktXHUwMDA34rJrqKf/v+y9x7KDyrom+EBcZvBcdTAwMDKGeCO8h1x1MDAxOd5cdO95+mbtU11cdTAwMTXndkVX3eiadMSdLEVoSanM33wmUaLXXHUwMDA0cWyLWEVcdTAwMWNqYWy0vzdbglx1MDAwNP14y7dTZd8zlG7oepHbjFeyzVx1MDAwM1x1MDAwM5LuhJfiabbfXHUwMDAwhIXlopqXJ4p/oV5Y7Osry19KdmdN+G/WJLqnt4Ze2d+O5JGNqVx1MDAwM1x1MDAxZV63qTVCXFyo+4BGcUrT/dedeKZcdTAwMWbbsPl6PfKN8tG6ebo9ontGXlejXHUwMDFhXG5cdTAwMWRry6vJXHUwMDExX7ZcZlx1MDAxNl1AnOa0M+D2XHUwMDA0km8+q1x1MDAxOGtnXHUwMDA26m00XHUwMDFkXHUwMDE3JeeMtzNcdFx1MDAxYlx1MDAwMlx1MDAxNEFcdTAwMWJcdTAwMDRM5qL0KpZcdTAwMWNeXCJN3cZcdTAwMDGWts9CapSU2fnM59A7w2/ljeXZXHUwMDAyXGJD6LHOXHUwMDBmVkWebNBcdTAwMGWfPuPQvVx1MDAwYpHBYlwiWEyIhezjXGJGNYFcdTAwMTjB/O9WruVcdTAwMDFIc6krKz+dI8VtXHUwMDFj5lqiiVx1MDAwM7BscOz6Sod0JFx1MDAwN9HbRUpcZlx1MDAxNkNcdTAwMDW2ZKx2dPqeXCJpxteFXHUwMDA19UH1yVx1MDAwYpfc84tVecSzT6q2evtbXHTlpbKVfJ/Yx/T1XHUwMDE2XHUwMDE0dU1cblx1MDAwM2QsyZ7gwvA08a5I5qY7Zs29euDPaWQu8JbQh/862CVO+aP/fYWL/lx1MDAxMWWvXHUwMDA1Yoh9hb5TiP0jXHUwMDFhxKvUXHUwMDEyOowpOeLUsy8z8vbznlx1MDAxNvvJv0+noqFs6qpv+KK3WHjJIFx1MDAwMMLHXHUwMDA0jM3lnFx1MDAxMKpo3dlcdTAwMWFcdTAwMDNfvDFcdTAwMDE2X5j79zPYsLvIOYGH6EPeXHUwMDE2ztJhMlx1MDAxYVVcdTAwMTiwXHUwMDExe23IZowp/GM+MUzXXHIsQFxi80BjU0VcdTAwMTksv1x1MDAwZdtT/GuxZfrbYjx1XVuacjqVZlx1MDAwN8OzXHUwMDA0PD5cdTAwMGLdVEzwqI45Uctd8GKZ+jKtXHUwMDE0fFx1MDAxOK+b1beHei38mFx1MDAxYc3f2iu+wVxiO+dKXHUwMDEz6Vx1MDAwN0dIjl2FT1JcdTAwMWMycinhcSVcdTAwMTZGouHb31x1MDAwNEJnqETmgC6iR4iIrVxckZRcdTAwMWM1LZbaeCa6nyet4nNcZpdcdTAwMTe7zlY4Wlx1MDAxNlxiXHUwMDA1rob8Pi5Zi6HBZ/+WhVx1MDAwMzhcdTAwMDRTQ+xIroRmQ1wiKlxiVfNcdTAwMWFHnlx1MDAxZlx1MDAwNdRXfXtKdvKho9OSn6/KXHUwMDFiqkfuul9gzXqSTctRwlt39G0ulFx1MDAwMDVcdTAwMDJFTFXN01x1MDAxY2WTtLWfXHUwMDE2map/vzRcdTAwMTHYQpDIv2ZlSnbtPlRcdTAwMDWUXHUwMDA2VUJlbojWyEAyXHUwMDAwXHSlX1M9kd5cdTAwMDKT5cZtcfP4hGXTuE3yUdvslW7mof7EVNvW9uBR5IppOZLdtJl4fusx52amX+qo049Z0IDAYOWUq/mwclx1MDAwYm2X9lx1MDAwNFwi2Vbp2YR4zDiXJEWM4WZcdTAwMTGVXHUwMDA3Z0Qu9vlcdTAwMGbf5JbBhFx1MDAwMzy+OP1R1UK2TZqVioY1u/VjTFx1MDAxNVREtXt/k8wzILXq6MUrXHUwMDBigM9cZr6s7Vx1MDAxZYde31I2w6QgzTxxafY+L1x1MDAwNFwif/DWYq2sJdP+XHUwMDE2f0zHU7ks53pGZU5cbjeQkqVcdTAwMTSGkWtnm8XDYV/Nptd6Zy/dSVt4YKvEXHUwMDAz55MhXHUwMDE5W2jkNJuinEJyKVx1MDAxZUJNXHUwMDFkXHUwMDE5XCLLh2Duv5a7blx1MDAwZWqsKuFohJa1R+8h0Cz646OofKpcbvXQQFbs/Fx1MDAwN2FQNqYkmzKOp0u46yiZXHUwMDExXHUwMDAz5ni4wFhSuyM4XHUwMDEyXHUwMDEwfHNanmA55LmSSc6gu+UsNpBs/Uoj34FcdTAwMWXuXGJbo9k5XHUwMDA0XHUwMDE1XHUwMDE4gd3Ejp1okJcoXHUwMDAyXHUwMDE1jHLSd1x1MDAwNZlw5Vsl1eHx4U05WDQ+aFx1MDAwNNb2XHUwMDFiby1FxI885lx1MDAxNjxRIdyka7d2KOelXHUwMDAx+1x1MDAwNd74zTP/TTtAXHUwMDE5a3rFfoGumlx1MDAxN4ZKyIh3XHUwMDFlSOxfT3JrT8uJs3l9h1x1MDAxNS2PIFx1MDAxYjL6Wi9YtYmBfquF7F5Dm4vazrxtKmjlNbKVnuqaT2WlV39/XHUwMDE2U0xY5nZcdTAwMWW5XHUwMDE0zGsq/ZfKg/JcdTAwMTIkr9iwUVx1MDAxNlx1MDAxOGRcdTAwMTWitURFZORcdTAwMWRePzJEO9lv81B1LbPG1YNutVx1MDAwYl9cdTAwMTByr2qVVVx1MDAxMHAqZUCW13kxXHUwMDE0ZjnWtFx1MDAxZcwvNF+t8mCv4041l3z7mZ5cdTAwMWb70FKf51x1MDAwM3qrxjBQXGZOa/pcdTAwMWKP+3BwXHUwMDA3QHBBI5FaRqdJvP400efvXHUwMDAyTEZrXHUwMDE39HOPmeVcdTAwMWOz+rf/uYBEaK1cdTAwMTP8KFKD1P/MWVx1MDAxN1x1MDAwNKHw//VZl39e9W9nXUgsK8hcdTAwMGaOXHUwMDEzn1x1MDAwMs+w8pOSOJ7nVIqWeJkhRfFBPy/M5cR/+qzL//bA/1x1MDAwN866XHUwMDE4L4XRXFz9r7MuNLBSyud/dtaFper/ftalX4ElLDy/3jKcwolsXHUwMDEyXHUwMDA05tssXHUwMDE0k0CIJ9aJp0lcdTAwMDCdfXiunX23kyfJao2f0IxcdTAwMGVdbqcstc+xmo3s09eFII5YSVNcdTAwMDNcdTAwMWJcbickvFx1MDAwYjVcdTAwMTT1yXZcYsCrWUOo+1x1MDAwNOClXHUwMDAwclxupWL1QYKdXHUwMDAy0PZa8cC5wlx1MDAxOUCvmpQtkY4qy3O43jQjqyZcdTAwMWSLVoBopauM5zuJOen4lmhGvfOTZquzq7CCZlxymmRcdTAwMTTDPWjaXHUwMDEyeYhjT8s/pUpcdTAwMDHYOCcgQa40XHUwMDA1XV1VyCDdN1x1MDAxY7rjIDRGffBTflxyLO9RXHUwMDE4Mm5cdTAwMWVRSKzLjNdcIudZqT9cdTAwMWJ3XHRcdTAwMWFjPvsnjYr0wXi81+g2RFx1MDAwZvZcdTAwMTdw6Fx1MDAwZuQgXHUwMDE2bIGDhItdXFyQVVxcXHUwMDA364HkUlR6XHUwMDEzXHUwMDA0YCShXG7tWYF9XHUwMDA3XHUwMDA0sFximCNEl7g8VMJ94+VcdTAwMDembDxcdTAwMTAvtKWGXHUwMDFlr9guVyjbwlTPQshcdTAwMDFfti116ZhcdTAwMDH8wVx1MDAxZdOqsjJIXHUwMDExUN56XHUwMDE4JuJvIb5mXHUwMDEyXHUwMDE1wSFFKVwiXHUwMDAxXHUwMDBmnW5Zd81cdTAwMTkudVdcdTAwMWZ9XHUwMDE5Tf54jJdYmcLGcVdHSf9cdTAwMTlE0Ybo3zc6T0VcdTAwMGZn2Y1Efv07tlx1MDAwMpnsM7LSwpesnNdpeyv191x1MDAxOX44/kqzXHUwMDE4XHUwMDA17yjhp2K6685nlbvRNcf1PiyPMLYqkvv9XG7WjqCvzy1VvVx1MDAxNIkk9VbDhitOaUHqLz9q8Pyp2ybHwvmLX3lBtM5T8Vx1MDAwNVC0zqvsMuP6KPLzm1NeZ13/k31j2mqK0et1OfiOu8Je/u/RVr6dmCQ669GLzNXpLU2JXHUwMDA3XHUwMDFjgWWEXHUwMDE5zs70ZYO2iVx1MDAwZsx3KVx1MDAxYlxmIHM636XkXGLM+SF9pzfYO1x1MDAxZjlcIi88P1kzNWxcXDw1gIsor4puWG/FS5kpg9GqyDa8byh2KuOFXlx1MDAxZM1ccj5cdTAwMDSsXHJVm1x1MDAxY1nQV5d6xZXfkD0kkXbqXHUwMDBieG/IupCWqS1511J/3aPDXHUwMDE1wd5rilRcdTAwMWNcInTFOlJcdTAwMDKy04tcYjswm1uHiGyioKTXYrc1JVx1MDAxOa426mCjZXpLVoaE+baOUM/pbK2CnT9cdTAwMGIjf2jnp72xXHUwMDE3W5SfOo5ccpRPvt1CXHUwMDFkk1xmXHUwMDA3N2bNXHUwMDFi9/a3ll/83Fx1MDAxOdSMKP1cdTAwMDF5PJ6nx1v5JXFEUM5CUq5cdTAwMTFuLe1MNSrRXGZl5E05XHUwMDA2b863tatHXHUwMDEz/uL6syfu/CmwXHUwMDFjiNP+XHUwMDFh4C6nXHUwMDE1p9e0v3w0b5prlSdccoTizvVD159LeskoXG6wdy3OiuNFYXlql5dNtsJcdTAwMWW+vPFaXHUwMDE1t+yM9MNbXHUwMDA0g5rj/Cpy6VxyVPnOXHUwMDFmS5C3psYzXHUwMDFm2OaNazPC9ej8Pp3KeoOHn/e35nFXXHUwMDE0mTdcdTAwMWZcZpvS1a8twrR4X5PTXHUwMDE2XHUwMDE1t39BVLPCzpQgW1x1MDAxN1NOhNtcdTAwMDAvI/jOOfzGXHUwMDBi4af9lnSSjfKKQE/v7Vx1MDAwN679Iebf/PU0+qd2nvptXGba9pPqVFx1MDAxYypcdTAwMTDqbzhnYyxYTTa2Lv/mo6r1ynOuQ11cdTAwMGZcdTAwMWFSjFMr1lx1MDAxYVNqhDnMaOaXwvFcdTAwMDZIZ/EwxYaU8YxcdTAwMGZcXL9F56NcbjdcdTAwMDCMbJw5gX9cdTAwMTnlXHLaTUh/81x1MDAwZqb1n9qZzqnTaWXerIifkpl9m1x1MDAwMi48rcHemmOm9i9cdTAwMWZcdTAwMTZyfv96XHUwMDAxXHS7lFx1MDAxZlwi0Vx1MDAxNC2Kr94gXHUwMDBlo8f6h/J9abDWlo3ktnpcdTAwMGXj5PzrU6KrXHUwMDFmkP9J8pdcIt/6J+hcdTAwMTPLW+hv/lx1MDAxZVwi/9VcdTAwMGWEeTdb87AzaY61+nbm/OZFXHUwMDE17eitOVx1MDAxYbqmN1x1MDAxZlhcdTAwMTlcdPzbXHUwMDBihPnozVx1MDAxYjSplYvGyqpcdTAwMDWFv8xcdTAwMTfpfjrAVb2PXHUwMDAwXHUwMDAy+l+9/P+hl/NYOuti71tcdTAwMTTotSh9WkmAfORcdTAwMTnAV7rr41x1MDAxMq+5RN3BeTz3uSFcdTAwMDCVclx1MDAxOVhcZobxXHUwMDEz3aJcYlGT+PpcdTAwMDO6XGKSXG5cdTAwMDNXXHUwMDEybnc8XHUwMDEzQrGgxdD2XHUwMDE3yplcdTAwMDRAXHUwMDFij1x0onYq+Vxm3viDWNhvRlx1MDAxOYJq++dTfn5Dt2DtXHSWa7u/1IFcdTAwMDSNYFx1MDAxN0Wr5UhcdTAwMDdcdTAwMDCUtVx1MDAxMVx1MDAxZoNOaftbXHUwMDFjWzA15kF8d1x1MDAxMkWvO33iji2rsPd5XHUwMDE3aNnsTN2MYNxL38tNNUw8d2iWySCIZjNcbj7SK2Ms5c03/9MmfKG7XHUwMDFhW/bjhzujZWnyV42lK3y13TnouXpTYWXRjt83SmtcdTAwMTTJq+XZioCfJ5G0+0JyMFwij2O4TTUlXedwcE1cdTAwMDePvcFcdTAwMTRcdTAwMTDVR2rMUVx1MDAwNTL5NUdcdTAwMDHSXHUwMDEwXHUwMDA1sLRcYvbZ1D+u9i9cdTAwMDCIw3eNm79cdTAwMTahsGLcr1x1MDAxY05iXHUwMDAz9Fx1MDAxZNxcZlS40Fx1MDAxNKDPPaxccmDbwKRcdTAwMTVxM05W3GNcYpCIpZR6XHUwMDEzS4GbfU+YXHUwMDEzplx1MDAwYvyqkbJcdTAwMTCZO1wiYZJ8rVvP4Jj2Mzmz+yBWprflXCKtQ7xcdTAwMTXgXHUwMDA3N0+spcqVXG43XHUwMDE0XHUwMDFmNvL2Mn9re0hhTtGEgPqtVY7K9+B9XHUwMDE0qalucOF9fkZOqI2uXHUwMDBlxb+O7aXvtGPeZKPRw7HmW9O46rCMPG+26DLWrzW+8WZlMlx1MDAwNIu91HG0nmdn/fZcXD2rlsDGYZKJNmNVRVx1MDAxNzV/PfdcdTAwMTI9e1x1MDAwNT2r7Xw7Vt9cYqpGX041/+05OW6ROupcXN7I86pSIJiTJF5lRVx1MDAxOf9cdTAwMDYvRs9cdTAwMTYsXHQvRlvsiFSjK7Ddf83pv+b0X3P6rzn9/2NOXHUwMDBlkykpdPVcdTAwMDU0XHUwMDFkRqqtXG6Shsv9rFRSXHUwMDA0+WDfIFqWalx1MDAwNa7QXGaHaVx0XHUwMDFh4qNxk1l8wueioE8kXHKtkz5Nqz1MulDhTGggfj9cdTAwMTRB5Kr+tLJcYjBcZp6pxW03z7arZr5mYVx1MDAxYlxu01x1MDAwNqNcdTAwMGazotCvXG5cdTAwMDbUfXm4xvHLPCd4XHUwMDExXHUwMDE1ullcclx1MDAwYlxmXHUwMDFj94OYvFx1MDAwMLJjy3czZEdcdTAwMTX+51ONtDR3aLUs/quIVXXFp1wiXHUwMDFiRolcdTAwMTRhptBdNXqWVuPda3SLMjN3crdeL6xcdTAwMDRjdSl/L1x1MDAxNDNcdTAwMDQoc8VqSYFcdTAwMTQnLS99Tlx1MDAxN7r/zD5cdIZ+SOx/uU/yz6v+bZ8kL8j0XHUwMDAzY2Rcbn/KgkTLXHUwMDFjJahcdTAwMDLGKVx1MDAxMkkyXHUwMDA0TWFcdTAwMTQmslwigfH/9D7J//bA/1x1MDAwN/ZJXHUwMDE2+f3Dev/tniBcdTAwMDdP/t3M6//1niBrXHUwMDE4/qpQXGJhcy+NiYfu9Fx1MDAxNFx1MDAxOCuw7ITTprXqZFaobWFcdTAwMTJ0YdJrXHUwMDBmji8rZrfuivl5VDdX/3koz3RcdTAwMWVQa7FcIsHKR1x1MDAxZVx1MDAxYnLsjdueXHUwMDEwO/OFsFVcdTAwMTVcdTAwMTFx9qJcZvtP9HNd7UmJ7ihiM6MgUDCKgsDRXHUwMDA3jYuYoCiY4DpFW4DP0/7ukt89l1x1MDAwZlx1MDAwNJDWz5jVMb5cdTAwMTIyXHUwMDE543y+oFx1MDAwM/lVcL9icPsrRs3rsVx1MDAwNCGOXHUwMDFii1x1MDAxMytRoLUvXHUwMDFkeTQ2MpfH8pz4mntZrFmLIYxtOVx1MDAxOJKm5pG3zlerge9svSCrSZH7eu5/eG/ENCOLxc03sIjsg1xmJyCTKHRcdTAwMTZcdTAwMDP28cGm4MBNdjN/1lx1MDAxYVc1b5Yu4O25gm9X3b/z773/Nlx1MDAxN9jwqrxSkFx1MDAwNMOJdH1l68pUZlx1MDAxZvOAfXra3pw1XGaU3+9JXHUwMDE0hFxcKr2sdiHPnU9rYkWmTneMzDNNXHUwMDAy5fPVYq+X/zW3/zF+0suVcfGLfDzcXHUwMDA2mc6JmvIui+BcXHCyXGa+iCFcdTAwMWMhSjihOppLucmPQ8O32cRkwioyW25F9EVxXHUwMDFhXHUwMDFhZMXm2L8hjS+dXHUwMDA1dNTRl2Z4caP8a/3o2cvAWeSCm8rmXHUwMDEz2TVcdTAwMDGIdnGqL0SFrY3iUdFcdTAwMGJDmvGPXHUwMDA34l/rf8Tw/57noVF0KttrTqSUyrPkV3c73jzvwXlNiW2LtFHsqVx1MDAxMbE216C/ZrWNvKZXSlx1MDAwZfNx/HLG5PzHuY1MJZ9cdTAwMWVD1uIl4TtJr/wuhzQrvy71xuVcZlxy0JbbP8JZcrVcdTAwMWLAe1OgOlmQToFcdTAwMThLYctcdTAwMDB08DdcdTAwMTG96Ilk2Xn/rHe82vq3z+hpj354Z91hlDZoXHUwMDA2XHUwMDBiXG756dChaUm5XHUwMDA1NH10j1dcXPt0PkHoXHUwMDA391x1MDAwM9tsbPh4mlxyfLCvcFxi1Vx1MDAwYpJa8pf885+hm5GHxZcoOlx1MDAwM51v8/ToXHUwMDE0K/LxK2NfNChccr6NQpFcdTAwMDSGklxioVx1MDAxZYGInv3Yfok43X9Y8zuQ/OiWePMpT1wi2XPWIL98bUlcdTAwMDAuqYKcookhXCKitDLhXHUwMDA3vFEwVfpcdTAwMWLbLYfbW4L/MJ9KXHUwMDEyTn3ULj6V1b3DQFHLupX69o7T2JSKR0tLbTXGfuIlLSvZXHT3kKEkyFx1MDAxZOvDXHUwMDA1XG7Ffr2Mt/7Pxlx1MDAxNP41ZrM2XHUwMDFmo1VcdTAwMGZZYz/enihcdTAwMTjwQOPqmY4mzrSu5l3ZXHUwMDE5tPSE8FXzKPTGXHUwMDE1/Xx+R8/6ZPLv631zMlUjt9rfXHUwMDFizVx1MDAwNy3qONlhVTBcdTAwMDd+XHUwMDE5ZjNKIJpsLmbPcbJ8h1wiRlx1MDAxNlhcdTAwMWZcdTAwMWZuV1xiKuLv+f+sw1aUq7D7XCIjXGIttNRcYj+ha+SViIRFXHUwMDBi1Fx1MDAwMVx1MDAxN9hccotkXHUwMDFkysFm3TTmyaJcImV79NlmXGaayzF4ua/+cpxcdTAwMDXrIdKNjnB9aTrjaIaQe5Xrj8F94vQntVx1MDAxZt9cdTAwMTBE/Fu9n1x1MDAwZmIxJFx1MDAwNdTPlTB6kjB1XHUwMDE2cj5cdTAwMTZ1m1x1MDAxNZv7xX4z98D1kOWzY9fauFx1MDAxZELk01xmuTDTq5pcYvzxqJ0gX3zDJUZASMY40M1Jkb5cdTAwMDWI9MVcZsXZ/uLEyydcdTAwMDMhzytEqrxlayCTOEJs6jDA48daWPun5O/6+bOxf1U/p1vntdXpfUl5VbVk6Vx1MDAxYyhcblx1MDAxMFwixFx0/tDsmbL/Wl7QYDSmXHUwMDBlPTB1mHSvWFx1MDAxZMzgMJGDUUvArd3MmZ49LSzI0lx1MDAwZlFzS+Zj/MBcYlZ1ytLM3Yh7l1x1MDAwZfrXjZ/T4IBcdTAwMWaE0lKNTn+vS4xkOkpehVx1MDAwMFx1MDAwYif7fVx1MDAxYpejJaZdUN6CgndcdTAwMGUxUcM+XHUwMDEx/4NcdTAwMWa4kVRBrENcdTAwMGZhivKIXHUwMDFhdFadw1SsQJDFXHUwMDE3Mmxas1x1MDAxY2/pXlx1MDAxMPfG7bKmz7khpiZDjLxvcVh80Sgqv1x1MDAxOVx1MDAxY4I3wH1cdTAwMWZbXHUwMDE00NjlyKaVRiooPZzIcWhZalNQ+bejSjNcdTAwMTGPecjinZHpw2du7mMo0DHUiM/xIyrR2lwiXb/Lzf5+j1a+eM0pa8euXHUwMDBmTKg06KVBUrJYryF4z1x1MDAwMzFZrVxmsj63jad4klx1MDAwNlx1MDAxYZI+NFxiXHUwMDA3W8NcdTAwMTalx1+nhFx1MDAxMljiW0h9qsyX+uNGi8+CXHUwMDAyMCF65X5yzdvQ0SNcdTAwMDRUf5qKdKqS+cNcdTAwMGVRiVx1MDAxMI6nZoPjJalcdTAwMWNcdTAwMTXh5JqMaIeXfCXwh2NcdTAwMDCD0L+YXHUwMDBmXHTzYHVE9j5NXHUwMDFjoFhcdTAwMDO02+8oXHUwMDAzxG6O/a17U29cdJalkE3puVMnnlx1MDAxYepAp3hDXHUwMDA1ulx1MDAwM0bCySstR4s080ZlYD9cIv2DivjUKFx1MDAwM9BQpYPll/lTRTz9XUM9XHUwMDAy7qvd264maIBGvOiVyFMmh5VTvVx1MDAwMFB9XHUwMDFkmfRuglx1MDAwM1x1MDAxM2IxW6rAsCyfXGLxylJDrDsrje46XGKDQrpsXHUwMDEzsM1TQ248VypdjZy/XHUwMDE2NeFcdTAwMTdcdTAwMWTnXz5cdTAwMDK9/czfvy9/XHUwMDE52KggyzdQ3uaSjZ8njlx1MDAxN8+v9Vx1MDAxN1P3Z0lBhmFBz1lcdTAwMTlcdTAwMTUnXTLWXHUwMDEzXHUwMDEyR4HPglx1MDAwNrSAfTbkVe955aiAXHUwMDAxppBZukbxNUFp8Kjt88n7eMlWjahcZp5cbra0uag14L7UXHUwMDFlXGbpU+TlSt7qkX7ta2SnXHUwMDBmiTx8/itcdTAwMWGTjmn9XG7ERc5GKWM+LJBBp6FBPrnOYH5cdTAwMTkpc3uSQyVuKfZ6u1x1MDAxNK8m81x1MDAwN6piXHUwMDFmusPBk7/uX/6+zd//WatcdTAwMGVfMjNNR9SfXHJZNVVZNz3wofucv8zieVx1MDAwNfpBn9pow6R2XHSpXGbux6p+gtVWqUjLXHUwMDE32ofiVmR0O0d2XHUwMDAwYcYg/tggjD9cYlx1MDAxYUt1hWJnVzaAWlx1MDAwZYZcdLbXXHUwMDFjhMS5na25zrJ5fmnpc/12IFx1MDAxZHKx+/jP81x1MDAxNlx1MDAwMHBT604v+7FoUNoo5lx1MDAxOTZcdTAwMDX9NEp7No/IUDtpnyVEgyp+i1x1MDAwNbb8vMlssFDNomvYZ2JcdTAwMTlcdTAwMTBDk6Cbj/aN/lx1MDAxOFx1MDAwMJssYniDtlx1MDAwMKP+Ia4lXHRcdTAwMGLsi+shXHJwTCXy8dek6bKVm5LBXHUwMDE4XHUwMDE5Ie3HXFyaXHUwMDE0XHUwMDAzXSpcci/H+5i8vzbfuVx1MDAxOIytJtlGzeVcdTAwMTe3KIhcdTAwMThY9EV1elxyXHUwMDAyUWP0XHUwMDE4vu9AmPx69lx1MDAwN2lcdTAwMTFcdTAwMTQjXHUwMDFiQHZvX1xmOmRQXHUwMDFlXFxpRtSmXHUwMDAyXHUwMDE1rHPrQ1x1MDAwM+gkWDaa5b53XHUwMDAxUUXY1PDJnTGe/kDmpEvxs5BZwU59X8bVXHUwMDAzcC+JgWEnblx1MDAxN5bh0lx1MDAxZTqzXHUwMDA3Ml1uveX46kouXHUwMDEzOVaDlcxCwrBcdTAwMTXtctC07Vx1MDAxYb7EJUna3F7+XCI7az81R6pcdTAwMGWEZtb5p6taoNewcJL775iNNCdcdTAwMTG17rz82qO64OtcdTAwMDVcdTAwMTFcdTAwMWPxXHUwMDExqkZkv1PriILD6CfZflx1MDAwMag81Vx1MDAxNVxmuuvvi2oljOg/nFx1MDAxNvvfNK5ljO2WZ0PyRq7K36gl7mU1+zfO8KnwnDcm41hbMOhzXCKtx1x1MDAxY8FcdTAwMTfW/Vx1MDAxY4Jablx1MDAwMvOqaOSPZ32asWLIXGY9JEKu7HtWXHUwMDFhp1ggtFx1MDAxZCmAJ8nPXHUwMDE06pH+8KmwJl32+6xbXHUwMDA3XGbOSiqRmSwjgaS3UeHIKNumbSXEXHUwMDA3q7H7XG5cdTAwMWagJSyD4oqLsZTqR1x1MDAxN8Caf/GzsZzsa+32XHUwMDFiR8Rh3TN8RaCBY0tj8tVg4vzFXHUwMDAyN+HjU/psfFhrdSxcdTAwMGafXHUwMDAwuYg9oyhcdTAwMDJcdTAwMTQjxlx1MDAwZYR/NClcdTAwMTdx/C10anbY9Jft8N4mRbmhOsaDcrFM1VPlV0hxrYGhXk7Csr7Jfs4hmJDLQ8/V8v5dPHXO5uBcdTAwMTjNU0xcdTAwMTNcdTAwMTJOd5JifeWJ2nFcZp9DioNcdTAwMWVcdTAwMTZcdTAwMDKiXHUwMDFhK1x1MDAwZWTgXHUwMDFijJP3qq6WpzVcdTAwMDTZ8L1cdTAwMGbfsUiYWGaY56RxYe7tV6/+2VX+pK3Xmi+WP4jJ9LBcdTAwMTdMh3GY91xcXHUwMDFlueJcdTAwMTRx2OhyXG77o0RcdTAwMWE/tEdcdTAwMDdJ+/eC+Fx1MDAxYke6Yr9lzFx1MDAxNmonf9bQr0m/KNrvXHUwMDFh5WFcdTAwMDGZJ0t7v1x1MDAxOIlcdTAwMDNcbmWVLZXKvk2CceBcdTAwMDFRKMepg2FcdTAwMDGIPIX6hVx1MDAxYXaiYrbqKytcdTAwMGV2XHUwMDBlPnKT6+481lqPKFwi8NtcdTAwMDNcdTAwMTlMWzUu+EnSXn3V0C/U2S9cIvqwzV2PqcYkn/HEtsNYOmFcdTAwMTaLpbMpN1x1MDAxZl79slx1MDAxOI6v+FCzLFx1MDAwYvFVwX5zlTjhlHvgLbB3i2Sow/m+dmU1JN3G3volvDLlLVx1MDAwNomp7bBfXGbXXHUwMDFh9SfPXFxcdTAwMWG8pZ6EtVONI96I/CtV72iXZNbpXHUwMDBiv9EqxqJcdTAwMGI7pTn774foXHUwMDEyXHUwMDE4alx1MDAwMoa0L2BcdTAwMTn1SlxcoVx1MDAwNcmwT3dz7Vx1MDAxOdn7ONrGLfeDqWb70lx1MDAwMyjNKj9Ln+1mLM5Ye1x1MDAxNVVSmdVO50KlzMtcdTAwMTJn272N1Tc0xP3x2FFcdTAwMDWw0NhmJPHYyO/iXCLq/btcdTAwMDPRXGYtXzy5NeLJ7zxccsmIlzLDwFx1MDAwNVx1MDAwNVO2rS82UrUuI4fKPrA4rFx1MDAxN1xuLf9iVtPvcVx1MDAxZfrhXHUwMDE1nXSIXHUwMDFjiuCeZWBcdTAwMWHJ53Zg7by4XHUwMDAwY52k3kLMqCj5XHUwMDE4X1iaPS28OVx1MDAxMpRT+jSha1F+N/rkM1x1MDAwNOuuvaI6x1xcKfJcdTAwMTG+QnqQr2paNZx/6GPIvmprXHUwMDE4fGlcdOXeg1x1MDAxMCuvXHUwMDE3V1x1MDAwYkhz856COHXkv061Kqs/qTupp1mFvONlXHUwMDE53rWWLVxmYZrms1xyKSNUZq/Q/6os9pl614jpXGLlcCQ4rIom6iqesXFzmNNcdTAwMDdcdTAwMTN5sLnJs35eOJmGXHUwMDEwYWZFXHUwMDE5+VM+UnJqrCyNf75ccjCNXHUwMDFhM19Nvkf2aflcdTAwMWPYXGa4clxm0udcXDF0KnRD6zgueYGsXHUwMDEyIN+2YXecJSNYXG7vRlx1MDAxZOlDLKhcclx1MDAwNW9ruFx1MDAxYj1xXHUwMDFhrdNXI+FcdTAwMGJXXHUwMDE1ZlM1+1x1MDAxNqDDbtBygm7zW/GpZjts3lx1MDAwMvH+XHUwMDFh3bu33ej1Rtj6ilx1MDAwZnk3WSNrzu5zj03AptuGTPqLnFeYvpWgKKJcdTAwMTPGnEFkM1xy0oHi6oEsf2Q1XGJNnuxcdTAwMGJcdTAwMWKOqf2gM7s9XHUwMDExuVx1MDAxN1x1MDAxM1x1MDAwN1xyXHUwMDA1bmSjxUX/ubbTvNWO74+dXHUwMDFiL21cdTAwMDRcdTAwMWJcdTAwMGL545lcclx1MDAwNTfnKnKGyjeZcFGLkCGzyHS9sztp8JOr8OFcdTAwMWKX7ZHFPN2XPLS6uWZcdTAwMDSE1Fx1MDAxNJfcNJpa8T7oJX6/41x1MDAwNNq9Ym5Ke1x1MDAwMih4jevPgk5Dgvxu3Sw7O2dHQS1+q5d3nEE9afKlKZB/4k9Wcv42wVDAPD9cdTAwMDKHXHUwMDE4XHUwMDE0+lwiXHUwMDA1RdRL5rglXHUwMDE00LlcdTAwMGLpXHUwMDE2yEjD3pqPMJ03SJJInp3F3mfyU44qXoTyTI/pJWHy+Fx1MDAxMoJcdTAwMTGp12kxgbQgo03OyielXHUwMDEwQjvOZJhKQ7hcdTAwMWYw5epuJdqt2TjGVs5TbnaVfrV1g6B403dcdTAwMTLivtxcdTAwMWHSxVx1MDAwYniFr9lcdTAwMWH1cFx1MDAxYlx1MDAwNYVlXHUwMDA2XHUwMDA0cV1nypz0bTwlfKtZmWvBrjVfXHUwMDFlz+dUj8jgXHUwMDFj2WhcdTAwMTK/XHUwMDFhqKPlXHUwMDE4+FxuOqsv8uSt7LdKp+rkbDgro8pXYVRcdFxcqfxMXHUwMDE06//sWlx1MDAwMuNI09vG4Fx1MDAxZYvuKTZqpKnOglg81Ur5XHUwMDE41KIpmngzXHUwMDExRPBcdTAwMWKy6DmaXHUwMDEyk4+uXFyQ0ra6XHUwMDE57VW+zLiEn2TPiWx7kDZdY7CBQCp5hk6dk51cdTAwMThcZuS6k6AoXHUwMDE1YJ3ixp3PJnFcdTAwMGIuo5lccjO0Sb7ffjb57OP68fSlXHUwMDA2XHUwMDBi0tt4N3o40cZCtslXmr01XHUwMDE34FFaTEFcdTAwMWL8ru+tzaVcdTAwMWVcdTAwMDWvmm++XHUwMDFjX71cbmE2XHSuLU31j2NzXHSfM/nvnLfmqHTiIPg5XHUwMDAyXHUwMDFj8Fx1MDAxYdVcdTAwMGaJ979KZX+9eDZf9tF98Fx1MDAwNPP5UahcdTAwMWThbpG4gCN6SoREXHUwMDEyaiS0qZemXHUwMDAwT4GSXG60XHUwMDFmK+l3XHUwMDFkXHUwMDE3kq6ivV7eS5zE4+snRdp869RcdTAwMDbcznXz9NdcdTAwMWNIw003+VU4qFxm++piJapSQE+PRttkx9Tda1x1MDAwZanemtxcdTAwMTa7dow/XHUwMDFl9uSOcV7omVx1MDAwM4jQrlDFyII2bzFNXHUwMDBiKoLS31x1MDAxOMWvbjRcdTAwMWHUXHUwMDFlzHK1XHUwMDBm/SAglONxlFx1MDAxYVx1MDAxYoo2hkJjWvZHzlx1MDAxY0L4Ra5cdTAwMTgm7Ic295U2m3dcdTAwMTHnptrmMrSl7NnlfVxcj4hZLq/kLfEsc1x1MDAxNb+SuVx1MDAwNJnGnZAhmS5NObhX1X78OpFcdTAwMGJ5QNR0KvaXLPNrzV+O8VxmXHKLkVuaVb7suTRfXG5Da1x1MDAwMViu199+TqnmMrCo0F2sXHUwMDA3379cXGjHm4v3lexZn1x0VUV12nKXwTFcdTAwMWbLQ+tgpFx1MDAxMFx1MDAxY9VRXHUwMDFhk1x1MDAxOSxRaqzeXHUwMDEzXHUwMDEyXG5cdTAwMGaAlsbnSM2atFx1MDAxZbDsLdKHlqm94uqw4FjCjUol4e9OSc/KXHUwMDFhM1x0+7hdglx1MDAxOWPynFxiu4nvIHfiuuJcdTAwMDNCmiF+NTstQbBcdTAwMDJcdTAwMDdCjUcv9z9cbjhcIsLoQ0eSXHUwMDFjrFx1MDAxM7t9jU6Pd3ergvijNmek/7fHoZ6XzC/qvCpZuDZhXHUwMDAyMN9cdTAwMWKb6ZA0LNVbo+HTXHUwMDE5LFx1MDAwZq+BXHUwMDEwkFqzZVx1MDAwZkXQmyGCozU64vjm4lx1MDAwMYD5r1x1MDAwNlx1MDAwMdiTP6r3PdNcdTAwMGJadmZcdTAwMTLSjUj3yL1e67aavfZYr6LJMN/CXHUwMDA2QGNcdTAwMWVcdEmLa1xypSfJXHKnhDLlzSz94VxiNauAhJH+bk/MQp9Luj5cdTAwMWPz2JB9IERCWHajXHUwMDA1XHUwMDBi/r31uHEkZP/blyneP93E+MG5k1x1MDAxZIva11RYUzk8gVx1MDAwN1x1MDAxZSSI0L1CXHUwMDA3NMn7i0ZcdTAwMDJpkZjESXivXHUwMDA3XHUwMDFiXHUwMDEw4mPVy1x1MDAwMjAqxfPlXHUwMDEylLrwfFx1MDAxM3VPzZWq1Mb8XXxcZkl48dl/rzpsVZVcdTAwMDfTJDPUpaHwJuxmpGg+R4u3JEfTtUHwVuWGSFx1MDAxYbl7a2eDWaHcXHUwMDE3oT/q6+6ut1wiX68gXG5SP8n2+jPOOdVCXHUwMDFh/m/z/lx1MDAxMupf8WAvPTXbjK/FlTXOjNh2x5lcbl1GtKvtQXl/UPAp+4GyVlxuTSlubMqVPYhrQVhuI5ZksdCYt2fqW7A1NlRcdPDEXHThznWUPjn5ILmBno5Gy8ZcdTAwMWJcdTAwMTWtuVit/lx1MDAxOWqTXHUwMDFi21x049WlvXojX2RWUsdYt7ky2YbNm6X1XHUwMDFjVkKJXCLsbermu8+3/9bJdUiC58szU/T6f5+/aYpAXHUwMDFkXFyoXHKuPm02Pmt8ITF/NTdqXG7shrLfkVx1MDAxY2OYnECnz79cdTAwMDDxU1x1MDAxMmBvj8ih2zTcZlx1MDAwZn39WXMt4bq36+2fXHUwMDA2XHJcdTAwMWK4NJMx/3I6rLJL5jm7OJdccp5cdTAwMDQzyGRcdTAwMWN3XHUwMDAysWGbZfTSSkBJv2jh2k9cdTAwMDP7iy2NXHTvkpnyV0ed2/5EnylVXHUwMDE0+7LSUjv+b7xqi9PtxqKHOKhcdTAwMWWBRM3SOtJcdTAwMWaQZbC6g1x1MDAxYv9cdGq57Vx1MDAxNZd2VKhcdTAwMDFfK9/GQVx1MDAxOX/7vL0hXHUwMDFkRc9xlUlBPMzeTLL4zsPFxapgjFScXHUwMDAybm6hoE9cdTAwMDF+kC6r2sNcdTAwMDFcIjVS4eHqXHUwMDFhk/2SkstR37+TdkU0wY09JvVcdTAwMTBcdTAwMDEySVx1MDAxYb3pX0UyJJ7VwGvLqaSb6riCMfzILZat4Z+tQo9brluVPn/xV2/8nZ+ZOVxuaPzLL98p0bRcdTAwMGbaXHUwMDA2ZP1cdTAwMDVcdTAwMTTikzycvm+m3j71nu4h+rHkl9zEQ0JcdTAwMWY7RkFyX5IhgECGYVx1MDAwZTJcdTAwMTjBX1xyMaDqwT7VUOKaOuujp7/LPFslvzqjJdRyaPJcdTAwMTf781x1MDAxNZ7QXHUwMDBiioF+9jAxzGR7b8yP+1xcIUQhXHUwMDEwWZ+wNW9+1lThi+HhiEAmXHUwMDA0VvPikLvHIfeVbvvzmz22jIK2fHG6zFx1MDAxM45cdTAwMDDOXGb9XHUwMDE0x1K85NZOjtVGU1xcJ2vUXHUwMDBio+a8XHUwMDE4lPRcdTAwMDdj6CRShaD8I1x1MDAxZoVcdTAwMTBcdTAwMTgxkE9cdTAwMTmyXUBcdOeUT0Mz1F1cXPhcdTAwMDBZLoYpiM3yXHUwMDAw2rOJRzm/XHUwMDAxqJKDeFxyjdErXHUwMDE2Y9JacLWhWlmT6ndN7Fx1MDAxM5hx0+Avca26+/okkDFzW3zppZQuSvNQcMvVQTCVq3WG9OxOwibf3uFpfkD9dTuXqVbAepbK2mpcblx1MDAwZUr28pvOKSFtuLc3WNcpSNJEfvrq6mRcdTAwMTAq1qrnXHUwMDEzJ9pS33i4lZu2XHUwMDE19NFcdTAwMDSOXHUwMDA1U+mC02ZD7kd6SzIyfFx1MDAwZYM+jPTYuudhwH1cdTAwMTG2SdZpXHUwMDE3Lfq3zk3zcSFcXMK/lUSi2vraMD3129fH5chLxytNXHUwMDE4snB9SJ1cdTAwMGY/jf5GQ0spwCOlQudCm1x1MDAxYYp0VTvnzFx1MDAxMYQozlKYy1x1MDAwMqThXHUwMDE26Fx1MDAxZT5xYeA14Fx1MDAxOc6Qx9/eXGZwSFf0edUyXHUwMDAzIL8v3FicYDVcdTAwMTb/i43jQavqXHUwMDE3XHUwMDBixVx1MDAwZlXgXHLBe0vw1MNLkFHdh4Oj0zTe42M5Xr8/7y2YZlx1MDAxMVkx5mbpTvhqfSaqrYxcIie6XGZcdTAwMTB8nKfVV+dPX5e1zFxmNiqpssaFwfBcdTAwMTVCyGHCXHUwMDAyiPZcdPs0j4B4eUU2YlNcdTAwMWQoddo1hJp0LVTBMDcnR5Mgqlx1MDAxYa8rNzScXHUwMDFirWTD5vvVQ672/T3C+dfnytfy/fVcdTAwMDWtXHUwMDFl6Vx1MDAxY6Wzs/tcdTAwMTgoKfCVRVS7hF6gwqEpgTiNhqc01ZiPrfqR+NbDfC/sXHUwMDE4rKyS+1x0r3onpJvUz9dcdTAwMGKzTK5iXHUwMDE1V4lbXHUwMDE2hnqSr6aYrlx1MDAwND9i9NJcdTAwMWRcdTAwMDM7XHUwMDE5czt36/D66Fx1MDAxMCMvXtriOHR3YFx1MDAxNrb9U6rNXGZcdTAwMTmZ9biw8LKGrqeEeT2/X/C58H0r7/VcdTAwMTeb8DO1p0djM7PZP8taXCKAOKfJXHUwMDFhYlx1MDAxZvjBr1x1MDAxMX6moOIggDWH9qlYQOhcdTAwMWL4+bRBZVxif/tcdTAwMDH3KZ2CXHUwMDA0ylx0PLZQnadCXHUwMDFkXHUwMDFmQbfL8XZcdTAwMWP26lJJL7uhQlx1MDAxOFx1MDAwMoTlSVk6hpfvXHUwMDFhx8nDXHUwMDE58FRwfIDHq1xuaa76kGo+YJ+DIZ5P2JeKijqUoXF6VXL6W7SYVk9UXGKb5fc19unVmK3c+0g8hjjKjtjT1Fx1MDAwMbyFYlcpSDy5I33+cy2FO89RLl5hwDSJw1x1MDAxNLe8Zj8k01x1MDAxMHziVkazc5lcXPDdcbiTiDOPqZ+F+ixcdTAwMTlGvUlcdTAwMDXCXHUwMDEwel2OXHUwMDBmblx1MDAwNXZPX1x1MDAxY1peb5LeYsx/UjFhSkdcdTAwMDH4flx1MDAwM7LPYlx1MDAxZlx1MDAxM5pcdTAwMTNcdTAwMTZIy1xmUTBPueJDdE1cZo/0hHiun98wIX33XHUwMDE1+8RfXHUwMDA3fm8mqLO2YGxHU99cdTAwMTD1U//0y1x1MDAwM/Tz2Vx1MDAwNqzBolx1MDAwNM6asra3XHUwMDFm9EXl+SMsmLMuXuRN5PJ3eSms3/JcdTAwMTJdP3LII+Z3qPFcXLk5mnFxkCuWNHK4OKH8yb1WRPXLP0VlNFx1MDAxMFx1MDAxNChcdTAwMTfsVlx1MDAxNJLdeM0wQcbc8VN7wXJcdTAwMGLiXG5AXHUwMDA3Xaj9ViqKrFPTtarGXHUwMDA1l3FcdTAwMWWE6Vx1MDAwM5k8QYU3XHUwMDBiWjhcdTAwMGVcdTAwMTWdgHpcdTAwMDF9/Fxm2ik5SKS4+rvAL89ZXHUwMDE276p8XHUwMDBlmcFcdTAwMTW/rWCuTOpcdTAwMTipd7nDmdHmp/HpPT/XXcN8KnnHmnF+UZje14F/rr/xf1dcdTAwMWV/8eblyCBcdTAwMDLLLbtrUvHohMJopLNcbv89XHUwMDE3j4eARsRgoLRbfXlGYFNk5Fx1MDAwZYZywF7np5Q0aZlw5oypyTjOXHUwMDA3O2nM36Xl81l3XGKRtzSJyV/aXHUwMDFmXHUwMDE4JVx1MDAxNSVY+CzG5YV6uOTXsl6B9lx0nzrWWZxrpjDe0/5cdTAwMDFcdTAwMGJIoS08jdlcdTAwMTCyz/b1XHUwMDBiXHUwMDE3lon9y951xZe0zlx1MDAwMW3UKknT2WSubzvocrOuXHUwMDA0L5HMcVx1MDAxZOxRz8xawvKphFx1MDAxYTlgs/5G39R3LpmZerGBXaLetF2aPWhRSj+K4v7tR5CRe85cdTAwMGbjViRrputcdTAwMGZGXHUwMDE3+jtcdTAwMTJru8KL56/yb1x1MDAxNPNcdTAwMTen/c1cdTAwMDdcdTAwMDKgpZOSzlizln9tKlCfY+nLfFs6aMVcdTAwMDAgb1xcmuLPjc4sPHhcdTAwMDaReTpcdTAwMDTPX7bOeubR77WlNdCfeECS9U3qXHUwMDAz3Lk9XHJQk5fRX4VcdTAwMTis58/TXvn7r3ykfvXmI81s8Z6hsFx1MDAxYbRHqSXHrq9QtzirstLoXHUwMDE3wm1L81OoXHUwMDFmujZLyceWilx1MDAxZkl6nM3Tx4NcZumqXHUwMDAwV0lFWrtzn1x1MDAxN79OyjCLIUMzrqok+HCvXHUwMDA04rxcdTAwMWGjiW23VFx1MDAxNazhwVmQfk51t3GtXGYy9M/yWPyrYYmW8XfTSKZcdTAwMGaxXHUwMDE0XHUwMDBmLfr5+uEp/lx1MDAwNTf4M1fhlue3nXeLzPSCXHUwMDBl/HOdwmjF+M8jhcHfXCK2LPZveckuXjy1Ns7akyHsiV/4XHUwMDFjlppIRFx1MDAwMmvbgVx1MDAxY7A65XGPljxffzZcdTAwMDa061xyKI5KXHUwMDE2cuyiSmfoloyL6Vx1MDAwMoUq/HF7lnG/5su0Pqi1XHUwMDEzo6fCXHUwMDE1c4tcdTAwMWJLvF9kXHUwMDFhXHJzx6XZMedthlbcXHUwMDAz7V93Q+5r3PRgLdO+fqJu5YTIXHUwMDEyuUGueUrgtllTjFx1MDAwNmNxVIbQr96FjVx1MDAxMGzV3lx1MDAwZaHc2vw+i8Noplx1MDAxZluwKITijTn+RaVUyO7rX1PS5WlNXHUwMDE1q1x1MDAwNELJKyP/XGbnYlN9a1wiOLVcXNCh0Vx1MDAwNk3TXHUwMDExlTRLXHUwMDAxl1x1MDAxMVx1MDAwMlmYnFx1MDAwNqEhjSvXuIhLycxnmkvTRV9z68BUXHUwMDFlrrckxUZcdTAwMDJ5/ad//ZpQyWMzoOanLlxmLMT2r3j73YgoXHUwMDAx5oziVEecs7ZcdTAwMDGOXubrefxcXEVfP51OssG9mryNv0bNjT1cdTAwMDDj8lxuksv5XHUwMDFiedmyTaeFh+dcbij4QU5MiNpcXOKTLXRZJVqrT0lcdTAwMWSSXVM7XHR0pG9QpndcdTAwMDUz/EqSOPltzFau/atcdTAwMTe2jq+ry/vz+003N1qK+lRcdTAwMTEh71x1MDAwN66/LutcdTAwMGUxoTVa4N43fuB7lSyrXHUwMDEyMFx1MDAxMeO3bYeo1SG+bXNfxf3dMKd5XHUwMDFklGWlrXzv4TeSnDl0JEDzs9JcdTAwMWb7aU915Ks9XHUwMDFlx79QtDE0u5Qk+DJcdTAwMTE1I26E6D1RQDpdPdOPpFx1MDAxNTFcdTAwMWQ7jJLriddp6C/muK1djMJcdTAwMTS0gVx1MDAxOVx1MDAxYynER1xukG655243sbkubV2Pz4nedX2Hr+wpLVx1MDAwN3liPe86XHUwMDFhZsbbs0uxrSlUPMsz0N1jJ8DCpXOvXHUwMDAwtYn4XHUwMDFjRrlLMVx1MDAxZFKimehcdTAwMTlcdTAwMTjfM1p6u1x1MDAxY/OhXHUwMDFjKlx0/+ROdqZcdTAwMDA+/21cdTAwMDOJ+bAstp/dQvokXHUwMDA1JIyx8shcdTAwMGVbiOGFd1x1MDAxOVx1MDAwMIDI+M9k6t6u2Fx1MDAxOZX16dcnQ2lE4cZvrUensi9LmGalRCBjXHUwMDEySVPc2ai7mOVcdTAwMWZ4ZEx9LVx1MDAxZvBcYpZ47YuG9dHyXHKeJIlvXHUwMDE3NlwiJFjCWmFrMSuezuPUjohcdTAwMTCMX1xmvSbTgsiZe3M0XHUwMDE3VGP18OxcdTAwMWIyYbWadJCubrGyXGaV6CtcdTAwMTAj11x1MDAwNtm/U1x1MDAwNZe0NU2DqLRcdTAwMDd8TWinTSRmTUI28mfYd+LZsiRURIdI821aXFw/QDlcIqSS2NSmXHUwMDE0U1x1MDAxOUmzVyeG00T10+FAu4SfXr0yh9+YXHUwMDE4lJyCwLZcdTAwMGKyv9tQyLnRxzZyOe6m+pXKhVx1MDAwNeu+zHXOXHUwMDFjgklNZlx1MDAwM6zSPp/7UIdXXHUwMDAyQfG4gPxcdTAwMTmgvSto0eNpUbtcdTAwMTbDgNv51vj+J/MufdKqLVx1MDAwZfMyZFx1MDAwME7SokiiRbrDz0Xc+13+XGIkXdA6XaTCRj1YMj3bMqWVa76if6qpy4dRmWxffkHdiTH8SeRj93uyKevSnSyMdMZvPEK/XG6epS/eg0dzwdlw6M3z7GXISH5ITFx1MDAxZiQjibbOcqyQmdyhLH+1fZAp2zl290F8QZ/DZXZjPq+rplHLJrIn2Y+roFx1MDAxOPVnr/GLXHUwMDE0XG7kcO+77pCLT79LYLTzLZ15xX6+iUGtkEoyUKTWYcPxrG0mjFR0b7nJ91RcYjJcdTAwMWJcdTAwMDTL6zfRyJBcdTAwMDGy+j6LnHluXHUwMDE5/aJgyFxm69ZesF7Evqcq4aXvZHRcdTAwMWQ8tXJudDL8Ol6tcJxHI+WM1KhbfFx1MDAwMspe11xm2vBcdTAwMWHrnlx1MDAxNSXfTG+nxdijXHUwMDExbSn6pPekcIqR3HkjtKnyR1x1MDAxMUY7SqHPw+bQLSc2UpG2izdygZ8ysSfZ8uY9xyB083XmZibxM7xz5DzaZF1IMUdalr/gXHUwMDFiWPOtp3wke4/Dmu+08O7aqM7MrunNMnvIifKvyUQkO+PffVx1MDAwMaX/SEtmMt48ePXad/WlTNKgtVWXr1xiNVxiI9Hd/UmLymRYcFx1MDAxOFJcbm9hXHUwMDA1WPlk5ZxBXHUwMDAwy8U0PaZGXYO+N2z3hN65WkjWy+P2XHUwMDEymFx1MDAwMPO5aHkmwfZziPisXHUwMDExXHUwMDEzSeGtXHUwMDFhtY/kxNsjXCJ2bZW+tVx1MDAxNCBcdTAwMDVZRfNcdTAwMTWJvHuKmlnrXGKAXHUwMDEzgV7/mfZcdTAwMGJcdTAwMTXGSqpPXHUwMDFhMXt5XHUwMDE11y2cVXLg6zWOVPy3+8hdj8PvtZF+KFNS3Fx1MDAxZtmsXGJeXHUwMDFl5D/Pb3Cu5llKxbG2t9vHXHUwMDE0aZP8XHUwMDAw0DoxeLzduLDRZ5u+XYzQKq3LLa7VOlx1MDAxOaOR3ci9nFx1MDAxOUny2ir8daDQ9j2xZt9uXHUwMDA09fVcdTAwMWbmdFx1MDAxOWBdXHUwMDFh04jLXHUwMDA3nFx1MDAwN/Grla83Rci6d1x1MDAxYehcdTAwMTVbt8FiXHUwMDE3Kn3iRFVlh6d+K21cbieSNlx1MDAxMDlcdTAwMWVfZtugdOevVlx0XHUwMDFmXHUwMDBlYlx0+lx1MDAxN6DJXHUwMDA1XHUwMDA23+9Eno51gTpKXHUwMDBlt06o2islSCdgP2cm3Vx1MDAxN6RzUfeLfODiIXGtxfPvu1x1MDAxYnuXcWrselwiuX5cdTAwMDfhWlx1MDAxYuBAacvsljKEqdEux6iBO8b+zXmcXHUwMDAyXHUwMDEw9XJcdTAwMWRcdTAwMTTmR3QkSK2oOuZBMfEqw+hcdTAwMTcgdURvkNg8XHUwMDE2Y4xP8ke9XHUwMDE1zf9zT5DQ5Cj/MGrTllx1MDAxOCYhcGzAi5dfxvSk6EBGXHUwMDE0XHUwMDExbms+l6dtf1x1MDAwML9O8lx1MDAxM+d0XHUwMDBih9RA11DvsrjVNlx1MDAwN82Wp5FcdTAwMDdcdTAwMDVcdTAwMDS5X2W+RyP/cvGNhC/5+7mTwS7a5zxMeKqY6VeIOfJcdTAwMWKLKvugXHUwMDBisH80KFwiXHUwMDE50tBcdTAwMTlQK81cdTAwMWFcdTAwMWPplVx1MDAxZNZClF9cdFx0XHUwMDEx0X7Itlx1MDAwMIqkrHtcdTAwMDOTNyHNJlx1MDAxMTzsXHUwMDBmaVhCuNb7PeNjijy22k3bM6m5cH7Cv1x1MDAxZlx1MDAxY2FcdTAwMWSTXHUwMDFhkGskoczSK1x1MDAxYsjpsIHrXHUwMDFhtV69xy/WXHSsXGKZQqCuUo91XHUwMDE0zqvvgGfgcNnpvcWp25XKsSG9Pf6gPeb7XHUwMDBi5WSbkPni6Z1cdTAwMTQrXHKdc+pFkb/vPHRKXHUwMDAwMtovpjPxblx1MDAwZoR62dSCo2JG6T7pPGRcdTAwMWUukuy1pD6ix+ZcdTAwMWVneoVMT+a1nUeQXHUwMDA3rlx1MDAwZVx1MDAxNlx1MDAwNvLOJ6/Cr1x1MDAxY+e0UT5cdTAwMTOvdjdJXHUwMDFkarTc0Ts7/DbE/lpcdTAwMDc3kFx1MDAwMaWr7jxJW6pcdTAwMDEhfDxKVtFQ/lx1MDAxOLZcdTAwMTV95SSsWty+XHTfu3E8s8qa1LduKTNwuDRFXHUwMDExXHUwMDE2aaRN7JLHdZAjuTDZXGJcbsxcZuNv31x1MDAwNY1cdTAwMDN5VtVOg7+GJaV4SOBcdTAwMDKciYPQn7qd7lhJm9UhXHUwMDFmuHn9Ko5cdTAwMTZIieZ9XHUwMDFksSg+NKUq1La7bF692eTfW1KLXHUwMDAxTTLche6sblx1MDAxNM3nl/Un/TDcK0l3JPrMTemQdpfn417Ba8BcdTAwMTBXMFx1MDAwN1Psxdrx4CzkU5Q2olxulVx1MDAxMZDg0nuvjTe5crSIgGVrXHUwMDAy8ypjsnPjilwifdRcdTAwMDEyXFw6ZOzwf6NUXHUwMDE1kGhz61x1MDAwYoevkuI01mlJO7i7gm7nQ/dcdTAwMGLyXHUwMDE0d3LdYch0XHUwMDAzSYuTsDG26NeYVK26PMC4XHUwMDFlRPM64XU0p8PCQ3yzrOxcdTAwMDBBXHUwMDBi81x0+rtlqozB6lmRvMdzl8n8XCKDq8BcdTAwMWNDxLzv51x1MDAxOGFcdTAwMTi+aM6m5LhrZLzXXCLP1/b7YGrzbLY1xNWoXnaKgIdJmqJJTSD9yzuZXHUwMDFjJPZcdTAwMDE+QztcdTAwMDdamOhcdTAwMDK8XHUwMDFmenMsUqa1jcmY8jCqr0HVWZPcfy9cdTAwMTZg0jtDXHUwMDBmvbCXrFx1MDAxMYyWqc7hh1x1MDAxNG5uXCJJZ8aPs5zGu4BF5U7NpVx1MDAwZTO+fSrh0ZZSI9SQ8ttcdTAwMWOd4lx1MDAxMHKZmdZCslnWfb/uUzvafJXSXG6q8Vx1MDAwNKFHzO3B63xRw1FpVVx1MDAxNk+8XHUwMDBi+Vx1MDAxNsrzlFxcfauAUfZcdTAwMTKBXHUwMDA0aaDbwUZcdTAwMGJcblxyhIhcdTAwMTaWXHUwMDA05q9m6bDSO+mrRFx0iVx1MDAxMYY64Tw1LqdAz2FcdTAwMWH1YoEuVd7oQjnQXCLBJWC+gteUOtRXRsWnkk+fcaU/jFx1MDAxNVx1MDAxN1dIMYzgNy7qwjzWn20vk4Z41ljbdDywiaxzWCrJ0yr4K01cdTAwMDZtN1x1MDAxM4XhqW3BJYM5e1PJpFxuiyRmXHUwMDFk8nJl5+Wyv++Kilx1MDAxZlx1MDAxYpS/O7/y7i05mMRcdTAwMTWfS2WYS7BRbbXDw9HitC/pilM/N1x1MDAwM39cdTAwMTFbqCqH/vO+X8s5eU78Rlx1MDAwYv6Oaq/2q3/ETZB0XHUwMDE49Fxm34Fcbqc1i6hcdTAwMTgqJ0eZWcnZVy6kwUd6ezk1tFx1MDAxZlx1MDAwM8haO+q4Z36gkkpEKPnx8YtcdTAwMDGIPFx1MDAxMFZcYrj+YvTmb1x1MDAwZnfVokzZXHUwMDBiX4dcdTAwMDUpSMFTXHUwMDE1TKr3aEZWy73hhfvfR0lcIrJcdTAwMDaqW3x8XHUwMDA1+duruex2pTFcdTAwMTmjd25tan1q/GhXSb/RU2SakbaJXYOQReNcdTAwMDRcdTAwMGVxjFx1MDAwMo9ou4xcdTAwMWHdwc+B59dcdTAwMDK6n4R6+Vx0lau3XHUwMDAxd1xifumBXHUwMDEx/nqET4HoXHL2Se2JS14rulx1MDAwZS3p0lx1MDAxN/riXHUwMDFijG9IdJ/Tt/+sXHUwMDE4XHUwMDE2mN82Ql6tW7BcZjb+gFx1MDAwMfDmn7dGxpi46cEqXFwkYlx1MDAxY/Kq4vTPXHUwMDAwRdtuJPr3fPjNyFx1MDAxZLjz7zDSwOJU3z5cdTAwMGZpTbZW36z7Nc6kTzYzXHUwMDFmmlZXXHUwMDA3avBcdTAwMGKFYobmqOWxg9f1SJ34grVcdTAwMTi1rjVDYlx1MDAxYn3yRsJbXHUwMDA0wC5cdTAwMWVcdTAwMGZcXHHLUlx1MDAxYfSaWChcdTAwMDJEVokj8ODtXHUwMDE34K6wXHUwMDEzy7Flonzbx5zESL3SKW7AdDfx0+sxXG6iX1x1MDAwMT6tPq9cdTAwMTYzatrGT7XaJvVCXHUwMDBi3lx1MDAwZrL+hFx1MDAwYpFfRXh0Xr906VrHPc9cdTAwMGV4zSxcdTAwMWPajFx1MDAwM74rJSWarz+S04SpP2LmOujZllx1MDAxYmjNXHUwMDE5jN1+3nfxKW3szDrYXFzVxjJMXFzUrNqYQqT2dMPqPnBLK7NcdTAwMGXGXHUwMDE0XHUwMDBmQjOOdX5cdTAwMWPHx05cdTAwMDVcdTAwMGIsIeq/fnbs7XpNtOlwgORcdOQj+9TrXCKYY5DiXHUwMDFmkYnh7H/ZSt1nrLzrii82P4mzW1WzXHUwMDE1N5Bau3uKXHUwMDE0v9Xbe3uC7NpiXHUwMDFimmH5XT3W24Y80DxL5O9ARKb0SyufmzZj3sh/XGaES5SPwzrhsq+DViWhXHUwMDEzjS9mNuW2w7vA96fUcUKCXGI8L63p9PaGuFMkx5tE5FfX0/7KXHUwMDBm1/xcYnTKq1KnX7fuhnlcdTAwMDGedZ3J+1x1MDAwMYgualx1MDAxNfRcdTAwMTDje9q3saJQv9byQbjB01x1MDAxZCxBZrlf4CpuT1x1MDAxYj5cdTAwMWLJJSZOYo1cIt7Oyn1Jo8aqMqL2XHUwMDFmSjnflJJlxFx1MDAwZlx1MDAxNHXqXSSWXHUwMDFmXlx1MDAxZUJcIkqHYNKCkyRLd8/+L7rOY9tRYEuiXHUwMDFmxFx1MDAwMO+GeFx1MDAxMN6bXHUwMDE53lxuhDdf39x6bUY9rbpLQnAyYkeSeVJcdTAwMTXoabv+1j34v6f2r918ke+FzV5uXGJPSkhO+qa1PHnrPcwpJXGxW+o5PTI5Tlxip/RcdCjeteDEt7+//Kxw9DYx3N7fQGJcdTAwMDZJ21x1MDAxZSzD9LDGXHUwMDBmdVx1MDAxYr6l7lx035DaMl5kcv5cdTAwMDfhlnVcdTAwMDd1XCJTNFWIXHUwMDEwWHtcdTAwMTI2XHUwMDBmXHRcdTAwMDB75Diy4GFy4a+hjPnyLMrsXGL3IIJrXHUwMDFlXHUwMDE2O/vMaaj0XHUwMDA2LHBi+6FcdTAwMWLkji6d62BhW7FfT1vtd1xu1o1Id0bn8cg5MoLCMLG6wpdcdTAwMDF3UpFcdKg1PqfsVpd8wZ56w0i8Rdwlzv42/HXH/u89IzqtXHUwMDFmfny3XHUwMDFlNN2K/FWY6lRr9ppT/6RX66BSXHUwMDBm3ZKp1Xjdclx1MDAxN6F8xbhqXHUwMDA0mkOzYqR6XHUwMDAxNpo7LGtrclbCQvjh6+NxVTGBXHUwMDFiVbply4IvS1jxjTR9/4Am94vDXHUwMDE2vcdv4fp0OnRHc1WTYYPrT1x1MDAxOTFcdTAwMWFcdTAwMTRBXHUwMDA1MN0uLZbVYT7837EmXG6mXHUwMDAyUE1qPfKGpZtvu1C8nGO3XHUwMDFhnIF5XHUwMDEzkVx1MDAxNCvAXHUwMDAzOKFU9lx1MDAxZMAoUr7BXHUwMDBmf/FcIqIrP2EwXHTcXHUwMDAzsFrL+zNLXZZt/teBXGau6Fx1MDAwN1x1MDAxOVx1MDAwMCqVXHUwMDEx826RobSzXHUwMDFitZZsvo4hxahcdTAwMTlcZlx1MDAxYil+2uqYZHlmXHUwMDA3NNDGyEPRXHUwMDE10rUusD6fMvZcdTAwMDfsg8Jccv5CXHUwMDE4etlwwFS4L4o1UVx1MDAwNt9EuGwrXHUwMDE0bCigbExcdTAwMDdcdTAwMDXCXCLDJoHBdjjWZlx1MDAxNsCGack7PpfzgFx1MDAwMX01c2roYEWyXHJcdTAwMWJdXHUwMDAx7+MzytJ521x1MDAwZuIn/FrznJl7n/lcdTAwMDFcYihPpOnHqWva39fKniPEp7Pc7iuCjW9cdFx0R/Q96V7jxKZCOlxiSM+Vjlx1MDAxZKt5hvx+evBcdTAwMTlF1d8wjv1AL+xyf/PC1d9cdTAwMDKY7eDUrVx1MDAwZrd/49pOXCJggpOM71np02xcYrVHwFx1MDAxMcEpXHUwMDAxLlx1MDAxMLzG3zuZ92kl4Fk6wlx0+Vxc6lxi5mff7NtcXDkywlBcZsZcdTAwMWWMLtiIXHUwMDEyvZxcIqvmXGb2scnYTUtyxvlcdTAwMTPImiE4llx1MDAxN1GZsf1cdTAwMTPr8oPho9U92jL7+rpCNOFcdTAwMDXT21x1MDAwZk9cdTAwMWW6e8HVRVlcIjbT9vmx1l+Tav6Lj99tytZmpVVOyCqelKBXJFx1MDAxYvX6fpfJa1x1MDAxYb3djVx1MDAxNJHT4ZD1VHVotZFdjnORJzPdTX+WgGrQXHUwMDE3+5AjgSuMKncxMs+U+c3p10tcdTAwMTPDJcnvlaWEV3n4V01cdTAwMTDt5HfxpVJgSYbdySVcdTAwMWGvRrU8yFx1MDAxOFx1MDAwZVx1MDAwND8lld+g/jJH+Yh8OEkgdNqchyxWdUhLTI2/lzlcdTAwMDJjYam/XHUwMDAzXHUwMDA2XHUwMDFhqXuM/Er51m5cdTAwMDLkNWNLWVXBwtBQkeqEyW7JVilcdTAwMDcrN1x1MDAxZTxVuvux2MtMlPPdgVx1MDAxNUgjJFHxb1x1MDAwNOF1YtNBhH11gEDi1S9cdTAwMWM/r39cXO5cdTAwMTBcdTAwMGUtkMpcdTAwMDAtXHUwMDAzd5FCklOPaIylJztcdTAwMWJwai+4vME5mPpTSizIdoLwvnnu+0BuLs6/RWRl+tKyXHUwMDE36pY+XHUwMDBiz+ZLT1ZcdTAwMWZ/kT2V9txbTujbpuVcdTAwMDBMtlLm01VcdTAwMDDR1/SpXHUwMDA3XG4zj3hRl+JcdTAwMTlOXHUwMDE0VFx1MDAwM17CXHUwMDEyXHUwMDAzou77QXpSXHUwMDAyj9DR/fiXvMOTJtCofX+jstF80PWPXHUwMDA1XHUwMDFhzftcZl9x4N4g+jmpXGJaZ9Q7QoGPx1x1MDAxY6XYi+WKpHVcdTAwMDRJnDhGI+SLXHUwMDAzeIE9lJJdOItJlewxXHUwMDA1pZjXJGUzTFx1MDAxMiYvXHUwMDFkmlx1MDAxM7/rWlJcYlx1MDAxNmYq5XSsXFz4yFxirZyDkWltK1x1MDAwMJNUYFx1MDAxZifkM8BMy1/bYkffkvhcdTAwMWWWhGBErT3qd9/EO9lcdTAwMWJcdTAwMDFs5VBcXChhUluCu742c9J/71DqimvMgzLRQ6bvfiHAo8tcdTAwMThcZq6exa46/PbAXHUwMDFkiOvgXGZd1yqh8Vx1MDAwN0vI9Fx1MDAxYuWhl9NeieOVSJc4fDPMV1x1MDAxM9nehlx1MDAxOT+OXHUwMDFkLuh514Bcck4jt4SOXHUwMDFiXHUwMDBlcixcdTAwMWFB3Fx1MDAwN4SIu3qHRYKixIS1Zm1tO7qbRGqT5ahUrz7AXG5cdTAwMDB34ldcdTAwMTPi2F7iXHUwMDBlY1iGvlx1MDAxZKa8Tlx1MDAxOcGVS1x1MDAxM1x1MDAxN6qcLm5onLc0i29cdTAwMTCd/Lx+Suj1bFs1ca7Yw1x1MDAwZs28UOd2p+PbKKIlZCExjIxcdTAwMTHSXHUwMDE0XHUwMDAwXHUwMDFjJ1VYzo7eIOtcdTAwMTgsS3lIWe3f+pCBkqfg6/FZO9bjXHUwMDA33Ew11MAw9rdcZm5+PCHf1ptcdTAwMDe75v1po1x1MDAwN4uYfCoofVx0tVCRxZZAmsXpXHUwMDAz5TJMjFx1MDAxOOprryhcdTAwMWN5P1xiUXdyXHUwMDAyYYJcdTAwMTFdXHUwMDExXHUwMDA10Vxc8aRHdIOIMVk2tpzaJkfq/KRa9tNSmWO/RIo5z8hFfV70XHUwMDE30alcdTAwMTk1fFxydqZ2ZktcdTAwMTipRrxcZvK147iIR1x1MDAxOdM3zVx1MDAwYlx1MDAxMVptXHUwMDFiejT6Tu5jlVx1MDAwN1x1MDAwZk/jXHI5VtybiNk9SptcdTAwMDQwXHUwMDAzesjwmVBcdOtcdC4vS0eneJ5cdTAwMTeXM1x1MDAwMM9tosqbc1xmjFx1MDAxZTxcdTAwMTDT3LpS//0gpz9cdTAwMDH5cmRgtHSxXHUwMDFidDeEj3BXUoHUrFx1MDAwNyFimNY+MuOLIelSie7uuluf9mCPJ2dnkMKz2Fuh+0h+a+qhvcHjvczAPoolTaR1f1xi+cmKhXrje/X6aljzk71+1VxmkGsutl/twNby8tv7i2S1aOumZr/BXG73c2GjdyRH2XiUXHUwMDE2IHdcdTAwMTLArlQzf/BcdTAwMDak8HBcdTAwMTNz4Mpeuz6zJvEuylx1MDAxM02Stf+mXHUwMDExt5CVgaWL0+Yof+BOgZhVPSG2niet5E5cXFx1MDAxNq9cdTAwMTX74O/Jt1x1MDAxYoaXIPrBctFHJj0hss1S2k5svrSO5tGvTY33ilx1MDAwN+ksQ9X1WcLXO1Cyzlx1MDAwM+mN/FxmyFx1MDAxYt+Y+998w+/lXHUwMDE3pXpcdTAwMTW0i1x1MDAxZu+eJ+ZnmbZRV4jos05cdTAwMTTFLsBlvzH2/naGXHUwMDFh8nDFuomgafq3bo9u5nVNZZKGXHUwMDE3d0xuVEPdOHfG6DCZXHUwMDFkVORRNlx1MDAxY9qASFwidiV27D+30D01nNG7KXCMy++52KUqMb5cdTAwMWPxu9mWsDJ1bTZXevNw51x1MDAwNMMzkq2BXHUwMDFj5n3muLdTRXUg7WpUMCx+dd1cdTAwMWRg0PvKSEx2XHUwMDE2z9xP51x1MDAxMyWILiRcdTAwMDdcZujX0lxu6C01m1VmszSYgK18f1x1MDAxMZm/XHUwMDFkt8X5SkGzPapMLzFcdTAwMGKykyvXVstcdTAwMTPRNSZ6qF132aVCfnVqUlxiiVx1MDAwMfZcdTAwMGakXG5cdTAwMTVqvzXrJaU+W39zMMp7e+LH7+NG3yRKr1x1MDAxOEhcdTAwMWZ42p0pw4gt1ul+aqqQ11x1MDAxOMaEb/7UgJrmhWJWgkdl41x1MDAwMzy0Ldjg9kXRTeWoTimr2POOXHUwMDBlbzFcdTAwMWS44nVcbte0fENZXHUwMDExfMFdbeH70ehy7LLTXHUwMDA24d/8ffyp94VJK2+VQF+f8O9VXHJdgNW8XHUwMDExTlx1MDAxOTNcdTAwMDXqc/qc14tGJkNQvM0omMSYfX7abFxuZIDIiSSuXHUwMDAx9fvswDe/OTx4f7h73TCfkqRanp3pYzKXaEk1TKqtXHUwMDBmidHyfCUjVLXXl1AtKbjk78TltCVcdTAwMTXl9Fx1MDAxOZpcdTAwMGJ2Z5Csn+swXU6lv/y3XHUwMDAy2HJcdTAwMWOjwj447YlcdTAwMDZcdTAwMTnGjGW4XHUwMDA3ijTkW1x1MDAxZcL8JVx1MDAxNTCXgldJ33tyqOH1PH0kSEq+IHcv4fKORO5cdTAwMWNcIp6bJIShenpNk6yHXGJO7/6tVcyAlftqXHUwMDEyJnpcdTAwMWT7RqxYmLo9ybL1lY+gT9xcZon7MrvT7yo83mQ3zDN862/0xepE6KXBdFx1MDAxNNedLFx1MDAxMHmThJdR6N1cdTAwMDGsf7o2q7LC/qmMw6tcdTAwMDbOXHUwMDEzilisXHUwMDE1iLHbkFx1MDAxMFx1MDAxOFx1MDAxNlxipMjoQ8ZrxZzNWMuVXtaRWIly66dk+Vxmg1NK2EBsW1GhZzRz1VLeXHUwMDBlXHUwMDFjmaMzb6vG2va9cvKJPlL+3l19fZur0Uws8eih5q9cdN17Q8HWy3ZcdTAwMDK0uStLqa+BLv56dfhcdTAwMTDph0ZcdTAwMDDFJcp4XHUwMDE5X6CmTSQuKVx0ILtcdTAwMWZKjZqS1n7DnqxcdTAwMTJ9UdVcdTAwMDPI4Vx1MDAxYlx1MDAxNq3v2uXKS1x1MDAwYkjjM1x1MDAwMFx1MDAxYoI8c5rUXHUwMDAya79CqcDqJ8ZcdTAwMDWYo9ZzJVx1MDAxZqV4SagloGxaR6y9RjWx9pQg9ylAu1x1MDAxMFx1MDAxMXvXccTz3Elro075/fZOwFx1MDAxZdNMfK3npyH7WaXts2e++p5siEJ3N3o4TZBAXpq9XHUwMDEzKim1QIRC61n21ThHOXq8IepcdTAwMTZcdTAwMTPd0v1cdTAwMTDqm++STbBNSGD4ScmE6s5BPlx1MDAwNN5wtb+9TYT2XHUwMDAzmK95XHUwMDA2XHUwMDFkulxmJdQ1wK9u6VLRLqu5IVx1MDAwZvJb5Vx1MDAwMsxfjIdx+1x1MDAxYtx1nFx1MDAxYbOVLa7r9NM3iGsjK1RGxEt9M7hfteLthVx1MDAxMlC23zk+QlqS9vktRNNcdTAwMTX0U35ZYWcrfJrfMbdcdTAwMWOsND7p8DVcdTAwMTGBOlxu3Vx1MDAxNFwiVeNYRyg7ppaZlIdcdTAwMWG8c7ZIXHUwMDFhu1x1MDAxZr+lXGZcYiW83lx1MDAxNJQo8MJcdTAwMDJcdTAwMTm1RHFYXHUwMDA32oSGclx1MDAxNluwclx1MDAxZNVcdTAwMDU2XGJcdTAwMDdcdTAwMDCmvKGTXHUwMDEwtlxmOJhiu5pFOKJcYtxuIEVcdTAwMTdcdTAwMDOG/IOurexa7lx1MDAxYrzXNcdUXHUwMDAw2q27XFyVUjbqXVx1MDAwZoZcdTAwMDEh8cNcdTAwMGUrXHUwMDBmXHSbQLKRnPtcbuxiTTv2lydieV5dTLjDqUVrPKa/ekbsV1A6//a65THwzLplXHSmXHUwMDA3lrm/RI0uxFx1MDAxYUwln6zpueLf/Eekr6NESk7Q2VRbXHUwMDFh7usjfcCM95XtXHJBXGa85DNdXHUwMDA0hq6vpyu0b01qK95oYuRzwz7Sw6SidShcdDFAIJzQy1x03IfRWcqLoVuedjaxXHUwMDFiXGJd7+/ikixQXHUwMDE5uMx1rmFcIi94u4Ds+6uf4H13a+VcdTAwMWM3SVx1MDAwNqmIvGeKrjmeUIlyXHUwMDFj6ttcdTAwMDBcZuffvso3/Hl3QH2QTIr7XCK3T4+Dyou5XHUwMDEy/khSrYxu7Uax1ulfxq/eulx1MDAxZVx1MDAwMVxusFwiJEg+9pjV8yvbbGr/elirXHUwMDE4weFPjzneXHUwMDEyIVxuhOdYjJ+MVWbBcTsyhPawXHUwMDA3XHUwMDE5NYcr1u9vxEHzi0HPy3y5I8uTJ1wirlx1MDAxNLVx7jVcdTAwMDQ+fzhCnj19V25egbrp8MiyXHUwMDFh7zpHXCItWL/RUc4qXHUwMDEx669WLFx1MDAxNfLKMehvjpwkoWS31c/ZXHUwMDA2XHUwMDA001vY+qBcdTAwMGZcdTAwMDfhcY1pzlxyWG/JaVx1MDAxM9HQK3fdfr5cbjzzxlx1MDAxOE9wLI6ajfKtjlx0Rzj4c3NcdTAwMDSchcU31/GwnNLpiGYz8XrtnDBwWOjGkCmuVvqNOXM+llx1MDAxY5qFs2lcdTAwMWIxZmcop+ry85TAjSxROiFcdTAwMDPqZ4GnXHUwMDAzSWVE3Xt3JFxioz/B41x1MDAwYsdxjtKVXHUwMDEwXHUwMDEzf3EgWihcdTAwMTBBqp9cdTAwMTc1XG7ftk7r3mZGxY4vvlxcXHUwMDE21+8mmP7quVx1MDAxNFx1MDAxNutOXu1qXehNn0tKhjIhqJdcdTAwMWO0+1x1MDAxNT/65ODT31x1MDAxY97sgN6io6zs1GS2Ve2kX2NHuG+tW1m2/Vx1MDAwNEuSszpTWFx1MDAwMYSXRIMxP6/IkFSFVTqtWK5cdTAwMDXdyV0j2SWrfl3h1IFcdTAwMDJqgJ2YXHUwMDA25MRJneyhRSm+oYUwX1x1MDAxNrxqu8BcdTAwMTA7s0bbUSgmrnWmXHUwMDEyT6C0XFzF0bjJXGJAxeloXHUwMDE3d1x1MDAwNP3N+qaQla7s6zRZXHUwMDAy7lx1MDAxOO00xvWNilx1MDAwMt/hw1x1MDAwNc8r4Fx1MDAxN19/csqyq2lWpnyyhE20smKlL//Y84z7tDhcdTAwMWa8tf20ti3N3WTTXaVcdTAwMTmSWLylXHUwMDBiMEYrcda+h6yrr42sqdB714HqNOlcdTAwMDKu4Vx1MDAwNKr9vkk+Rc/Te1x1MDAxY1OmyIhcXPRLlFx1MDAxOJKxJ6eiqr1mXHUwMDFhTzPAskXnRVxcgK1FtNP1asPzWJC+1TBcdTAwMDVcInpcdTAwMWRvcGPJ9c93bdohXHLDQTOEWnngMvpFuXer0tXMYoS6bJVOZnZcdTAwMWWJk/f5zCfI7nqfXGKwV97aauVcZl7wrancv1x1MDAxYdb9QLylhSD6R1xu9Yi9JSN/OidPrlxuqISgXHUwMDAyXHUwMDBi4fZNiUdcdTAwMGWD3q1cdTAwMDXGY0WupdqkXm9aYF/t0Fx1MDAxZvxmfIB8weZcdTAwMGJcdTAwMWFcdTAwMTbRJUR47IzCXHUwMDFmN8d2U8cot1x1MDAwMHFcdTAwMDB966ipgt30NGQ1bMiyXHUwMDBlo4Ao5anZ8tRhd/xV1yrF6Fx1MDAwZiA5kpppXHUwMDExfmIkvSDUjOrMs+W9q2P6UFxyJeda8HZcdTAwMGJJaPN5MNr3XHUwMDFjfH+wsjI681x1MDAwNjMhZb6isf5cdTAwMTIykeFcdTAwMGJJdXptTOO8N/FcdTAwMTJ5OWG+2Fx1MDAwMCBkocHg0MamtH3sLoPkYeQhmZBakdLO2nbGUMvInl5cdTAwMDBV3VxyXHUwMDE0cfUoO+/uk5jcoYRcIk69+Vx1MDAxYWcs7NOHWCarTvbyjFsosD1AasjI/OflqM5cZvNI6VW/fFLq+ej5l5Dp3+JcdTAwMWPmVuExXHUwMDE3MTBFTykwZ92yPXX/XHUwMDFhpHTWXGLj2z9q/bxQp57vKFx1MDAwMny1/1354jhfSEajbTGPZVx1MDAxNbSt4tKqcdRcdTAwMWLcXHUwMDEzXzY/7CXo8URRPP+BXHUwMDE1kUZQZVx1MDAxOf2/Z1x1MDAxZe7mrczbXHUwMDBm+Vx1MDAxMVx1MDAxZtYgR1xynOGlNPyvQWvaT3295lx1MDAwNcxeoVx1MDAwNSXBT6hcdTAwMTNcdTAwMWXS26A56HBj71x0cPl75863XHUwMDE2aztiZ3H3XHUwMDBiR3GG7LfmRkk2oHswXHUwMDFlyG5T5c+8rVx1MDAwNNp06mvLUmpcdTAwMWNcdTAwMGXgt1x1MDAxYcEhJv+5XHUwMDE4+DK1XHUwMDFlLFx1MDAxOCHvpvpI6+mzvV9cdTAwMTI6JkLkeIxT0iRQzilhXG5ivnfJVbtCxU6lerFXxT9B8VX2uSFcdTAwMWRRv5LwXHLwKkTDceZsvMFgNcOgLOVcdTAwMTTzsil5wXHBXHUwMDAwWnpcIt7mTFTNp8vVXHUwMDEwJIxcdTAwMTL5/LXWMHa6wzJRcmnQ9Vx1MDAxNYSWhFx1MDAwM6KdipneXHUwMDBmXHUwMDAyYvrvfWOTf6KCW3mMyWt9kasgu+C2+lx1MDAxMGnUgsSN7Fx1MDAwNI1VuM91q1tcYlx1MDAwNeN8Vqna42C1M7hcdTAwMTY4JVx1MDAxNylcdTAwMDdcdTAwMWPi05TNclx1MDAxMFx1MDAxYncj8CUunMvdMc1cdTAwMTRKMeFcdTAwMDVdYFx1MDAxOItuU5J8jFx1MDAwNcBgI1xyQ17pVsf0Uy9uKmdi6JploJs2fXnlXGJpNMRcXC3h+iRAfv7OXHUwMDE5lcHaN1x1MDAxZKlcIjJcdTAwMDJBXzyG/jNcdTAwMWbyU/dS8lJ3bsazJSrxXG4stDKV8pxIXHUwMDA2i/uBvVNcdTAwMDJcdTAwMWaswkU1M4wq0ofsXHUwMDE00FZ/e2CFYnbEgHhddfF3tvm2fZHR8Fx1MDAxZqGZZVhcdD+dztyEaDNVXHUwMDE0iCTts0Ir26TSyJTsSFx1MDAxMrHs4d++/Hr1M7Q9XHUwMDEwe4mXkmRMhOuQ80NIgpaUis6pQb6Rv9FcdTAwMDBIM9XMg4I37adRXFyuXHUwMDA0bn6AnKvXOZNQ+aNXZnGcXHUwMDA074HWsLrlXHUwMDE3z/I3kziqwlx1MDAxN/fDuNJcdTAwMWLR3TakLVx1MDAxY5vFJq7JLr1cdTAwMWGCv1Vh2SjUrONcdTAwMTaY4G2nSqH1UdxZS0ZYlGUvfChz4pbMaPdQfjTtXHUwMDE4oOrKS3aSrfK1XHJcdTAwMWLe9ZZcdTAwMWRAKKaHqCA/L2hWPEY9Vt3+2ZWw2CGx0dmDQZYmzbp9XHUwMDE2iFLIO85rNFx1MDAxY1U5KFxcPFx1MDAxN/aW9NffXHUwMDAxzqNdK7qPazG0WqpcdTAwMWGmXHUwMDAxXG4ortueY1x1MDAxOctsXHUwMDFhTmaGyupehbCSzCXt4rRcbveRzNBcdI+FbaPReJncXHIl/sfS5Vx1MDAxNCrjXHJcdTAwMGZcdTAwMWQo2+BAYmWqUKvMS05WXGLQV9ZcXJCQplxuSoVcdTAwMThE4v3wnCWcaX+My8/PSlxcgURcciNftPeasCTruOqI1sS1t1hzXHUwMDAxMLuESiFqqrP3XHUwMDFh+YEhovm723/Ca3NZ0z5iWllmjePX4lwie5mRXHUwMDE3XHUwMDFhLVwiJ6RcbvdlkuRLf9HHXHUwMDFj5JbrXHUwMDA2w/NcdTAwMWSQyTTS8qDLq4BcdTAwMDDm06pIXHUwMDFkXHUwMDAyMtv3ZqHshvDCgepcdTAwMDdcdTAwMGZyYTnkWKJObONy1Y/nf6dcdTAwMWOTq3ko1U1cdEMvMTxtXGbW9lxi91BcdTAwMDeo2EnGhFxulSz7XHUwMDExXHUwMDFiaJtcdTAwMTUu+1xuiGeInPUjn6LtritqPFx1MDAwZf0qn9ruK8tOu1NcdTAwMDS8X7ZlU7Va0+yfnt2yiPlg4t/atHfsQGbNXHUwMDFlJC9cdTAwMDM6nXSsR/9cdTAwMTCUXHUwMDA2eWy6o+O2XHUwMDFiXHT9LXXykFxu3yyOxbTKdqXaZmxcdTAwMTiJVobf+f/6NVW6mWHBjX0/jChC/Ud8IPlMTmz9W1ebOrFcYlx1MDAxNd84t2O+sJiLzbue41x1MDAxYrklPuCqdEw3TVuS5z4mQNLGXHUwMDFlW+cko8ZE3lhnNVx1MDAwN0knp/5AzZnphGeWuDkrxVx1MDAwYkJ80ThcdTAwMWOqokmLaZOYgJc/NPxAXHUwMDEwvFx1MDAxONCvVv9yLFx1MDAxNt6gXHUwMDExrrGX7Wpccv+4g9HqYlx1MDAxMC+vd0BbcbL7XHUwMDFiYq0nYEwjgpJcdTAwMWOvm6stXHUwMDFkJOBMm1DJXHLykEUtXHUwMDE47JC7f1dFXHUwMDAwoYXl89V9Slx1MDAxYlx1MDAxZfeJud3pKTitXHUwMDE4YEqAXHUwMDFmXHUwMDBiWYhfuFZcdTAwMTCn+srZVKpPQf2xo1CdYWSYXi2TXHUwMDAxI3vfYVx1MDAxOcxcdTAwMTSwR7RcdTAwMThcdTAwMTHp5C9XXHUwMDAxO+vzmGKUbfc3XHUwMDAxXHUwMDFhu5NL0P1cXNMzIaNcdTAwMGKU4lx0YUbgREAzIVhy0f3AIVx1MDAxZp9ccvOhj79SzpqPQlxiZknPl8KykrDUXHUwMDEwJkQ6KuZp3lx0f+/FV0uayUuSpEQ2J762wG6U8Gc0lI3ReGKnlXMzTL9nUfDAXHSMXHUwMDEzR1x1MDAwZpbgi+ChlYE8ilwik0LYYYlcdTAwMDDUNO3VkDOxXHUwMDFj3WlcIodcdTAwMWZkP1Pcd5P8llx1MDAxMzTRMWE6dCZ/UY6LXHUwMDFmRIk/XHUwMDExU3ZcdTAwMTg8XteSVlxmOVx1MDAxMXooyuTyKy7n81xu31x1MDAwYoqLU8DH9lx1MDAxNFCFSYxMXG4tXGb0Ru+ghlxy2uJT4i9eUow6LDyTtil2MjrfKVx1MDAxYo4qPT7M5/qWk6YoYfFmS/stKcFCRCRUWmZBW6I7SmZ1QFx1MDAxZL9GbWVt7SrCcnPtMWnB7dd+JHcgXHJJL/ugpNtHdPVGLZNcdTAwMTePcVx1MDAxYWXK+vtcdTAwMWPCfqGywFBpXHUwMDBmsYr3+brkXG4gMqO/XHUwMDFm/zlcdTAwMWJcIsx61uK7gP9LdJlNUF+E9E3mOFx1MDAwYsF7+u5HXHUwMDE4qdhcdTAwMDSHbCz7+dFcdTAwMGZXmS6LeVx1MDAxY1x1MDAwNfr2lV9cdTAwMWWGkstjcypx9PNhRGVajjizqqTCMZtzjFx1MDAwYlx1MDAxNlx1MDAxZsvUISEw9i7zXHUwMDAwRT/NkMOZaf/tXHUwMDFmlu7YXHUwMDA1XHUwMDA0WIBcdTAwMDIse9Mke9GTRd82QVx1MDAxNLfgasVruYMnIS+vXHS4eLGA2LnFrDh6hDll+IMjIM9cdTAwMDfZa662e2xcdTAwMTDNXHUwMDEybcrK6TZVVJywXnFcdTAwMGVi/Vx1MDAxNE0qqVx1MDAxNlCnMHZEXHUwMDE44L5loPc4asaYt4aSe1x1MDAxMVf8XHUwMDFkv27hfTr5+mw7oiU571x0kYiGWb1cdTAwMWPtTVxuXHUwMDE4Lz/5XHUwMDE5Xdvlg6uWKy9AmDLIUcR0nFX0q0xZU1x1MDAxNvJf77BJSJqU+1x1MDAxMFx0XHUwMDE1RmBd9Hips/jTt6iWw1x1MDAwN1hvPJl4z2pDm9+EkNLXNFv5wafXT5pcdTAwMDVapVx1MDAxZIN8jt7792RVrkvR409vXHUwMDA2KTIk0KupZLTsg0nsRnk/KDT18KmLI09uwFxiflV5XHJcdTAwMTa8ip9P6NKrhVx1MDAwMJ1zslJEWMvnxFx1MDAxOL5cdTAwMWLfXHUwMDA0On5UoVxcPKp8tUP7a0XBj/vn08PN/HtRWmPrUlx1MDAwM5dcdTAwMTWS8Zktwdwxb1x1MDAxN8JoZH+Z6aFYW1x1MDAxZGFTXHUwMDE563NLKKzYXHUwMDAzTqZxcJRcZvDN2NVpXHSkXHUwMDA3XHUwMDFi3CZr75V7W1x1MDAwM6Qo0JtcXPE16X5lVlOxlm/N9eYyXCJgYcYgxTA8NYJ9KVFcdTAwMGbzt2/wd1xmwZtcdTAwMDMoXHUwMDFiMohccshxhe8qvG2D7zWlTfRcImJcdTAwMDLFjrjJtbZkXHUwMDA1/aYr5KN/oMeDi5Ot0fzHbV8lc1xuXG6CP1878z5GVVx1MDAxMarQJVx0io1hoTLjlaVs/kZcdTAwMTgtXHRUj86hXHUwMDA1UetGOmN60si7kWx/clfAgjU2p/ufmztiiGZDwFnG9+zR4+n+8cNVXHUwMDFh7HH96kH4hb+4XHUwMDBieyA6pKBE4ez9f5fEr+dSQ42Cz1x1MDAxNps9l2g/mHCZlrvnXHUwMDFmXHUwMDBm9jhyxfuFKYX+XHUwMDAx9Jb8XFxlKHaFP79JXG5ETDGAbnVJXHUwMDEwhdCqXHJINVx1MDAwMIz0rFx1MDAwMDLOXHUwMDAy6zJ5UL6EoeXLI4XkXHUwMDAybs2ANKCDXHUwMDFiq+i0NUDHoH/mS1x1MDAxNn6B+iP/1nfMdqWNaFx1MDAxY33h5FxyXHUwMDFiXHUwMDAwqZb5XHUwMDFjXHUwMDBls2SzecTDV7rk61x1MDAwNuuSWfntXHUwMDFiXHUwMDE3XHUwMDBiXHUwMDE0hy6AgZiMiztcdTAwMTJcdTAwMGY4psLVS6JSieuq4/OL0ilmXHUwMDE4jmFcXN9hXHUwMDAz6Un0Q1D9fFx1MDAxZd6spU6FgLriy07qPbO+XHUwMDA3XHUwMDFkXHUwMDEyQsqgYVxcjI3/7aFcdTAwMTXmKUz18MyQXHUwMDE10y6wNzVcdTAwMTj1WC7Ant/6XHUwMDEz1NDrXGJ8io6CvnHm1HS2XHUwMDE2RtVjL1x1MDAxM5BIzUVPp1x1MDAxONNwfpUw8VxmWaHU44hxzZGNjKKi3LWOPZPin1wiXVx0W5rEX6+mxWqpnbDopOZfg+vVNiODvlx1MDAwNYFU7TxJZSaxTHHX1p2B7U5cdTAwMWI+7tFcdTAwMTff2F/MxEqahuaDXGbBTtB94FNHavlcdTAwMWGVn0qenVx1MDAwMe50iYmRXHUwMDBlUXaBgvOpllxuMtqsQ/gqh1x1MDAxM/DQ60uwJetUXHUwMDAyiN6SXGbploOny0Tnm2BVcCWAjYzs7JsyN+w8sVx1MDAxYXy37uqjv75gyHc+aVx1MDAwNM9cdTAwMDZHnZ50sWbUV92eQei/Rv5FKvL2gsBzVlx1MDAwNblcdDybllxmXHRfxibniJYoXG6nhHKs1kpcdTAwMWEtV1x1MDAwMvbqgGQ0OP1Jv4I+TGddsbn328IrqnpcdTAwMTL9oZZoxK6VWnJcboFcdTAwMWJVkX641a6fUVBgnlx1MDAxZdde8PY9Ma6ko6yUXnhcZvV8+1x1MDAxMfhs8W3ffVx1MDAxM+2v11xcXHUwMDFmMlx1MDAxZLqISsqyuOzo5d+JiulhJVrlXHUwMDE1XHUwMDE1XFxfO4tcbqWP/8tXjtjAT7jC8FxmMKc1dNGPLDG/5lBUjPI2/Y3x/WbqtlBcdTAwMTXG2Itz+9tcdTAwMTNcYi3MXFzPTSM9Pq9cdTAwMDCGfOtccvDex1x1MDAwYoAxI+3aSmbQXHUwMDBiXHUwMDE4SYSyT+JcdTAwMGL6XHUwMDAw0yRkuTKAaIBQSm9e6a5cdL3W2zhcdTAwMThEu7pKcVx1MDAwNH31XvRUV0BcdTAwMWYnpDK4IfOc4+eLn7uv+Jq+vmw7W1x1MDAxML+qvnMsIKNgxlx1MDAwYlZeslx1MDAxNFx1MDAxMuqP3+srtlx1MDAwMvXK8Es65Ve8/CNcbiOvR1BQbmXC2lx1MDAwNtNWgDGnXHUwMDAyq7Wu0npjUZEk1ohcdTAwMTIjTsSG/cw5x7KmV5aq9XpcdTAwMWJcdTAwMTB6zJuxaO6S+kLJs9vOX09/jbiSaj1zrXBAXHUwMDBmXHUwMDFk4dJ9aOBFXHUwMDFjnrCMZy+5xUVNfuulfFx1MDAxNlx1MDAwYiuwXZCEmZ7YM1NcdTAwMDEohJluJVgtkOHV7Fx1MDAxZIl5h6K4SNZyXGKmWL9YcPNccmJigDPEQmgo/qg0XHUwMDFkuf7CMU3ez1x1MDAwM0UrrpSxXHUwMDFmfV+RsFVcdTAwMDeB7ItPUFx1MDAxY5M7vrRbiseTm/hm9Ip9Nnhwq0BcdTAwMGVg2SxcdTAwMTD0ma0+8oS2nt1cdTAwMDbH11x1MDAxY8Cn3cZcdTAwMDCKsIxpyFx1MDAxZXZcYlamW5cgr2eT4Wjb4dpcdTAwMTGTJShBpVCJs+zAmkBKyKh8JGaAXHUwMDFhXHUwMDA0XHUwMDEzwLX4bVx1MDAxOJ/mXHUwMDFjgouVRsFmXFwtPEzRV6n+sF4selx1MDAwZd6VoU//foufXFxzXHUwMDEwxf5cdTAwMWEjRpds5kiTNVx1MDAxZaOC+o4jV1otOcxcdTAwMWL170pcdTAwMWKJtjzWRr9f6kX6+Fx1MDAwNZFWoiXUqdH4X+1EXHUwMDFmwVx1MDAxMnyJg5xzQCBSzIHkZlx1MDAxYl6c4pdcdTAwMWQ2XCLFpEl50HzgPn7ae9DwYpFcdTAwMDBTvFx1MDAwNdsh+axZM2KRMl5AyFx1MDAxZaVcdTAwMDO5qHKS5adHlWKlN/OyMXD9PW26pm08XHUwMDA0fp+cQb9cdTAwMDO55lf8Mj9kpTOUXZaVXe/e+68/XGZcdTAwMWZQOnLGPmKMKtO7Je6mXHUwMDE1MLOFtOFCLruJXHUwMDAzXCLQ1DRb1XNjXHUwMDBmK0mE0WIuX/0zsYKftyOnr95777WrXeiWXHUwMDFj72f4KJROX3my3L9jnvc58G6XdVx1MDAwZVx1MDAwNkib4cxcdTAwMGXYjVFqlv9vjeoteND06vdI/Fx1MDAwNlx1MDAxY4yenfklYbFlrdX9TXBcdTAwMTOnu1b6fv7f3Dd3/j9z31x1MDAxN1x1MDAwMIhcdTAwMTaA5XFcdTAwMDX4etGhl+7jlMxcdTAwMTg46Fx1MDAxMH+91T365Sy16ctLI7HDfVx1MDAxZlx1MDAxN2F/fpIxPy3bXHUwMDExXHUwMDEz+4wg48lqNb5cdTAwMDKl7Vx03mP7TFQn2+SbXHUwMDE3f1x1MDAwZndcdTAwMTBfRoc3XHUwMDExXHUwMDEwa+tj5o1VfHeGj3D4glxc+Fx1MDAwMG6xvZNcdTAwMWLxUEtcdTAwMDL3h8fJXHUwMDAxWlx1MDAxNlx1MDAxNv5Ur1+YaVTLbGt4Z49Ic0+J14DQqFx1MDAwM9Yvh+xCN1xm4dcjgqfxXHUwMDAytXHRX8pcdTAwMDOKcNnMmvePvElcdTAwMWJcdTAwMTG9SZRcdTAwMTKeXHUwMDA3bOD4W8ff/W/NYW+pjkwjWla0S+BcdTAwMTKY3aqh8FecuzHCRE1cdTAwMTRcdTAwMWVcdTAwMDU5UI0gpFx1MDAwM63JXHUwMDFigFv161x1MDAxOD665oycK8Od0yn83Vx1MDAwZlmX5MlwVFIp2+Szir88XGJcdTAwMDM04pG/o1x1MDAxObdWdaox/3Tda1Tnj7Fhdqp7xX3DZZBQXHUwMDBiXGZ9alx1MDAwM1u0wf/iQaRJ26RcdTAwMDZkXHUwMDEx+bDlXZv5/eR+uGRR+qlcdTAwMDFcdTAwMTixkSyMciS/oLri+vX5MSBUbFx1MDAwMqCjoWNHVVx1MDAxMo3CVidcZtjZ3LLn1/D1P7ix+ebTfZ34RGjQgo3lXHUwMDBi5Vx1MDAwNGrAgl6c+fxJiLVcdTAwMTDV1f9cXFwi/XuCXG60SOXBXHUwMDBiSLaIS2+jw45dwzLjcVshgFbEL/KlXHUwMDAzL7iP6mdcdTAwMTlPx0POJTa/u7ux5vqaMemJdoBYofDXpIRXplx1MDAwNZk7/3iO4cXY70d0qF9w/Vx03X/68PFcIlx1MDAxMtRxY64hhNKqYFx1MDAxZJC7WNlcdTAwMDeQXHUwMDEy40X6vPlbcPBcdTAwMTMjQVGV7G9+361xXHJKReWFloamWpVnoK5w7FZcdTAwMDBcIsJcdTAwMWVoodDwbacpjffsi1FcdTAwMTBpKlx1MDAwMIv7UHGKdk7BvdnSRJKSrkOHQVpcdTAwMDZcdTAwMGJ1XHUwMDAyX77VSIahqtlcdTAwMWPaoNtcdTAwMDBBVtFcdTAwMDUtgZx2rHjpXHUwMDE3zlxik1RAZmXmJf24QK6K3rjeS1x1MDAxMpEh7mtFXCJIWZrkgdh0MZZrOPzgTEbX4GlahKpzXHUwMDE2zrZcdTAwMTVOvyWN4Vx1MDAxMV3uybBcdTAwMTbLUtLCKPVcdTAwMGJBSujY1HZdrlxiPD48dWog4Z15XG6mqnEsXFzT0J2R7Hnh3dJcdTAwMWMpu/aLIyM/xqtukUhcdTAwMWJcdTAwMTYoXHUwMDE31/JcdTAwMDAvJ+sjlFu321aBXHUwMDAykFx1MDAxYzKzWpwr5tCGXHUwMDBlgm/NQ7vtq84/7Fx1MDAxMXJz4GhHj4j/XvP4YvFtXHUwMDA2XGL5gj9MX4fUXHUwMDE3XHUwMDA3SNI1bstcXLpSauOwePGvr+HGsHiZ+o+JJaz9ZtePseiLczZJMFmlo2rdSTssWeLTcT1cZkAlXHUwMDEws7SNXHUwMDExlFx1MDAxM/D9eVx1MDAwMY/FrJjBn1atYfj3XFzxXCI+QVx1MDAxMcp4i8B6PlPljFx1MDAwYoOvh6MlbkHsNM9cdTAwMWPQVVByXHUwMDE4v6Ff6lx1MDAxYv6mOP5cdTAwMDDFm1x1MDAxN9vUXHUwMDA3Y3Qtzeav75ZGs5fahKxOXFyaVLwxWCnAu9ZtlHpl6kbHT1LM/G7aW1xmbUHeVIxcdTAwMWXDL99sXHUwMDAxMXR5rnuEXHUwMDFmhK6iRDlbvpcluFQ3XHUwMDE3t8aBy+dcdTAwMTZcdTAwMTAq/ds3iEFIp72Mar5cdTAwMDFs+byFnfiWXHUwMDAwLkWrcdVoPZOUb3dxxoxcdTAwMWbvoNaSPKRcdTAwMTFWy/rkhk29w5RPLnxC0oCEg4NO5XRcIqFyXHUwMDBiKJlBLWIvICVM+qvblLxYusPRmaX9XHUwMDEw5MKgKlxiQjLf/qeXyzyD7V97sqcpl+0nL+NPxzmnXHUwMDE25mNTbLOE8WmKuk+QXHUwMDA1UPXVa1x1MDAwZlx1MDAxYraSaktm85hnXHUwMDFmXHUwMDAy/IRwh+JdUi06XHUwMDFi+uh2KdH6kqDkXHUwMDFi7aqk23VcbtOLUd+6eT+w4NpcdTAwMTnVXCJ7nT+0zSVcdTAwMDJcdTAwMTeOcao6+PaNZm+WJJhZKVx1MDAwMOZWZ7HoXHUwMDEw3zKNPFx1MDAwM77QNK1CdnVcYkZGWvh1nj6kXlx1MDAwZZx5wUHa3Fx1MDAxNZb3XHUwMDFiv8PnXHLskbQ5P7X/ccHmKlx1MDAwYr2O6txLtLpcdTAwMTZVmCRcdTAwMWVdXFyWqJ3SWTiwla8xzP9WXHUwMDEwPbI3KWtvNibXLzQqy6di6+7+hFx1MDAwZVx1MDAxNug7d6Uy0nNcdTAwMTBtklx1MDAwNvwtxFx1MDAxN1XXUlx1MDAxMFx1MDAxOZDZ8XwmkO1W81x1MDAxMUGxVKmIM/xiQiFvyzK0XHUwMDBm/COiI0u6zjNCMTadYkBcdTAwMTO6xlx1MDAwNVok4lx1MDAxMajpWOuOm00ppkz3bIB1XHUwMDFm2V9cdTAwMGb0+4NzdMdcdTAwMDI38lx1MDAwMvO8+N5JQmqXPLJdZlx1MDAxYbF/V3XRnVwiwyBcdTAwMDB2eEDM62lNX1x1MDAwMqmmv1x1MDAxNTY/XHUwMDE2c4BdkyDwkvt/71s7ZvVcdTAwMWFcdTAwMWU034E4/ZJH7VtTQeFcdTAwMWXufFOA9tdZn1xib1x1MDAxM4Bqw/+s081360G79OpB5VxcJlx1MDAwNvmtjFXjXHUwMDA0fHN6K1x1MDAxMHBWVTdVelx1MDAwMVx0t39zzoKQ0c6N0Y8p9lDL9ENcIu/3N9dcdTAwMTUsTdKaQC+zkEVcIrqcTT2NwoZgy+aR34cyQ6Y5w37fKUk/XHUwMDE4tFx1MDAxOHSSllx1MDAxYXZcdTAwMWFnYFTfnIblLUJhXHUwMDE5KjxnMFx1MDAwYoJcZiX8r3qhetCzidRcdTAwMDdKqqVtuTy+pZBAXHUwMDAxTeZcZp+B6t4xXHUwMDAxIS0qXHUwMDE5rDfsoVx1MDAxYVx1MDAwMFdcdTAwMTCAr/+9uaFmLr66audS11m+KvjN51k4trrMs7s9ZJFP5fc1k5ft/0RcYuvd0HqzL1x1MDAwM/PgTbWNiFx1MDAxYp9yrtLi0FI01Vx1MDAwN15cdTAwMWHh97s/kiOOStpoVDRrxcT7olx1MDAwNjRSXHUwMDA0W03G6JFcdTAwMWHtzJhcZpFZg/bpXHUwMDFjd/yUrlxujFxiXHUwMDEyVS3l+ZdcdTAwMWGaRlx1MDAxMziMY1UvPtyPKOxgY9sviVvt3TtcbnJcdTAwMTNjYL5JmGFccoGy9Wm5yncsd1x1MDAxNINcdTAwMTlEebsmoeLQUbakin5cIqO15k4njkahZTRcdTAwMDQ1kUTbT5x1WZhyRKfq2Sc+y+V5S0okmEIposk/XHUwMDA1hmqwz4KcOphccr52nVx1MDAwNG1Jsoq3vlx1MDAxY+xVqO5GW7blW1x1MDAxM2Bw2SC6XFw6XHUwMDA0XHUwMDE3hTkn2FOUyj7fWVSGXHUwMDExXHTOXHUwMDE2SKb9yWFR0Ohh+nHw/WDacLpCl+bgzoWNkzlcdTAwMGJdRJ/XVLrBdKmDcfCO0L84XHUwMDFm0IXNXVuX6/zXwKr9r1x1MDAwN2D7XHUwMDEz7yMxXHUwMDFlO5dcdTAwMDV/XeZ9e1x1MDAxNGlGXHUwMDBlrYHwm1NYwszLTtbLXHUwMDFmXFyxn2dkSv9vXWNQMjjvXHUwMDAz+yiWWTCavjFGkPBBXFz9+lwiJ8VeViFcboVIslYtMVx1MDAxYcLWXHUwMDEy5Z6due2+XHUwMDE2wKBdUsO1YctqaLq8QOBcdTAwMWNl5IEnWUG89d/x3/dx46+v0lxmfbrjr9LFJ03uPbP21/c63NcvxdvqXHUwMDFhpDu9fdblXHUwMDFk/es3qlx1MDAwNG159Fxmilx1MDAwND6Db9fmq1SHgt9cdTAwMDcq6WfZXHUwMDFkY98qzlx1MDAwN8hAYFx1MDAwNCEkflx1MDAwMS1Q0qtDu+v/PnpcdTAwMTlFXHUwMDFko7OoNzU8kVx1MDAwN7tcdTAwMTNFclxu4HbwI5Hh0JZO5snB1Fx0XHUwMDFlXHUwMDBiK0PG1PWEiZxcdTAwMDL0/Fx1MDAwN3hjl0iHLUWGZXPgvXxU/ftDgOlcdTAwMDf+NOk/e6uFfoo44Djjv/3wXHUwMDE4q6jQXHKVP6hcctsry/byPnzxs7ljXGZcdTAwMWJcdTAwMWV0Z96vXHL47IQ65vuVjyBcdTAwMWRitiVmMetLVzZTYLrMmI9cdTAwMTK2S3nwXG5Lp//fPl3uS1bMt/uhWpy0yn1cdTAwMTE+cmRcdTAwMWVcdH7/TjWoXCL9di6Fl0jUXHUwMDFjZK5rRCr/plx1MDAwMCWXh9WhyTZCyrfshlx1MDAxMFxmuHo1MmpcbrOU/m7AcJ1cdTAwMDFcdTAwMTeHs3WLqmX535b2tcqEXHUwMDEykcxY9Jugdq2U6NdI87BDqvFcdTAwMTepYklQXHUwMDA37sqG4UOoR/dnT2kkw/B+QTjZXy/HJVxykpF9eWljt+6OXHUwMDBiruFQelWEVXeNy6mSheG6gUkk5aU+XHUwMDA0oCG7YoqbLuZhcVx1MDAxMlxmloOTf03qrpZcdTAwMDbM28zrPVR9mVx1MDAxY0ZMvaq/TEN7LURcdTAwMWYjNbmrpFPnZlBcdTAwMWS2kOV1JPvljZbZ478+Ki2Cu7y5eL3M9oBcdTAwMTFcdTAwMDfESVhcdTAwMWNBkaD3uS7Xt9mzjWgmV75K1tZcdTAwMDVdrJhqtsa43Yzc1JRZdZ08mj3EXHUwMDFhPMFcdTAwMTFcdTAwMTE0fuaH8NZWydhs6OJ4pn+/231cdTAwMDGvxkdYN7uyUMHfvFx1MDAxNdVr5/jGqlfymWyMLCRiNrvFQV+OTC9Me7FP6aZxdOlQq15cdTAwMTFcdTAwMDLKZ1xcsMjRviqFvFxiXGbXRZ2V9HFgfLeUcpy6QKfXbXhD3CS/pIhAPCPQXHUwMDA3s2t/p1xc/Tv3oFx1MDAwZnm02b6epPhni+82n73SVU2lonzk14Sv3aZw+Fx1MDAwM/d/+z9cZptVS7vuplx1MDAxZEy3blx1MDAwNVx1MDAwM8FcdEZcciq5Q0CO7SGugZT+9rtcdTAwMWa9gy32ydJcdTAwMTWOfTR/X+YrvK9cYvtKRdJcdTAwMWQ5f8O4Qof9g8pdjSNcdTAwMDbcVcrHXGJcdTAwMWST5d7PbU1ay36/tKs+wLLm5lxylFx1MDAxOH5uf2vOXHUwMDBiPVxmwuX+XHUwMDAwKCkyWZwzKulcXJlcdTAwMWKixGKZJW2ZXHUwMDE0eY/L5K0zUEFF5ptcdTAwMThKMyebXHUwMDFlbvy3fFbHz6OkacF8/Vxy3lxmQKp5XHUwMDFmlVx1MDAxZd3UkXhXj2bmeKE35L2qrsdcdTAwMDZPV53rXc+t/Vxud9XEZ3ecUFxiYeKGO1x1MDAwN9yyXFx6L+O+en9AkeQg5dVcdTAwMWY+8oHidlrS1H4+wftM9WtcdTAwMDbaz26DhVx1MDAwYlRaW56g61x1MDAxNv6QUzmnziajJoK/UFRmPGKvWLlvflx1MDAxNeD4XHUwMDA3eFx1MDAxNlEzXGbIaUgsaqxwaXtzXHUwMDBm40xcZlx1MDAwMcdityzbZC7Xssc1/3oj2rpbufpcdTAwMDe8MiV/kSpcdTAwMWQmJ+LTzNE1V2zNXHUwMDE2b1Qt+nJcdTAwMWZic+CkgOx211x0RI6keM7ppeu01WOt8ONMhKtcdTAwMDVE4lOS1sj0TWZcdTAwMDX/moI0fZu0+IWt7ao2YDjRrtZUTzHsiDdhvpV9N9ogWaBkKN5iXHUwMDEwXHUwMDAx4+tF/edcdTAwMGJ0XHUwMDAwNzef3G4sO1x1MDAxNj5V5Fx1MDAwZV2PkZKimD91/Fx1MDAxMMqOXHUwMDFkqjYtXHUwMDE4xopfZlYzXHUwMDFl8u/Xr7TW1DLYXHUwMDBlXpnhOP7ioobaXHT5XFyrj/l3vImmMdxfc0r0IKNcdTAwMDFGnznTaZPvqVEvjGgr0ZVwi1xixfO1yollhlV6L3A6K3LyuJDf1cXITz+5k3ckc1x1MDAwZbV1XHUwMDA2P3h1XHUwMDFkXFz9ipSjpYeCrtpLr7vO9j6zzfeXcHhxfuYkeuu3yCr0iFNFdHxD6ss+R8loM1x1MDAxN7BcdTAwMTRJYNZCJ/uwjjzVv8tQv9LMPjCamyNcdTAwMTX3acB7MMPagj/Z3zCXc1QqXG59YXxH7kfMu+2VWi7uh3D054A9qVx1MDAxOJCFtzkyXGLPXHUwMDA1oVqPXHUwMDAyRy5Kolxy5tBZwzljf5pX+KBcdTAwMGVav6IyzTtcdTAwMDY3bz58XHUwMDAx4b22ZLH/zlxyMyGzrVx1MDAxM2dcdTAwMDbTXHUwMDA2LMackpEpr15Ny4Yx+NvmXHUwMDFhMTtcdTAwMDOYXHUwMDA36mel8WqssFx1MDAxMpjjczvt0JBcdTAwMWP1XHJcdTAwMTFcdFx1MDAxZPhcdTAwMDVQXHUwMDAyzFZqoo/7bt1cdTAwMTaQXHUwMDAx+lx1MDAwM4hcdTAwMTTVupuRVlpcdTAwMWFcdTAwMTnFN9pcIkSVjpD0XHLhUfZSoVRyWudTv8JGkFx1MDAxOYqRccXBRahcdTAwMWPon/9gXHUwMDE1JclfY1xuOVx1MDAxM7JrhFx1MDAwNp1il8P+5mj/sbiD2qCiXHUwMDAwtlx1MDAxZO0zXHK+iYzulFx1MDAxZlI/xq3dIfm7PVx1MDAwYrLnKkBcdTAwMTOOXHUwMDEyT25tXHUwMDBiO8U+hpVM6FlAdOmAzsI95lx1MDAxNJNMzvKZXHUwMDAz4V91cKZcdTAwMTk7fj80v54luoRrdVx1MDAwZtuPzk/VrsPo+MKZrnCEcFx1MDAwMpeMsUzxxKf9hNOb8mX4UlNlJC/qd5E8Ybhb8Vx1MDAxYmP0ue6yJFx1MDAwZWOLXHUwMDE0iN7wRi7wXHUwMDA3Yk/+bLBcdTAwMTZcdTAwMWLAaSeG3uSvXG6Vrykte+lcdTAwMTjIVzSBI12DXHUwMDE0XHUwMDE0KKFcdTAwMTj38uG+3Kr6XCKFTUhcZnRcdTAwMTNDbPapMvpcdTAwMDV5jJ5cdTAwMDaCzWpiuK9l0D2PV6/zT/1cXIRcYuzlK7W/ff96bW5HgfktlElcdTAwMDCBXHUwMDAxrsL9wmvqXHUwMDA3m97y7CpcdTAwMDFr+1x1MDAxY1x1MDAxYzpGIfRsXr1tXHSr3Pnrp7Mn+1DWaVx1MDAwM6rnTJosejNcdTAwMTWpXHUwMDEwUe6c7cV8ZMTBPJQp2Vx1MDAwYirLbG9cdTAwMGJcdTAwMDdcdTAwMTBkS1wiXHUwMDFimlx1MDAxYcDF+vHbgXY/4OSHI+Ziv05FQv/pXHUwMDAxgLtJtX6afcl3zb7em655pujPl8tTaWj4kff53vsg9a3dkMSyguWlXHUwMDFh3UbIcFx1MDAwZWPz5kq5pFm47ohg4o52XHUwMDA1o8GkvI+xZGwnUkolezNMPT5lXHUwMDAyXG5cdTAwMDJcdTAwMTns+je6lVx1MDAxNtqhkHlto6njkv+atDebhUO1R1x1MDAwYphrnsm9+CmJalx1MDAxN12DXnpcdTAwMTCJTbTa38D+NVScaXR3XHUwMDA33UrfvbmiyfCHXGbu9dZcdTAwMDZZ9DZcdTAwMTZcdTAwMTRBXHS9LjMtvEGdaYymboq/nHs5alx1MDAwN1x1MDAxMpcowqPRSVx1MDAwNr2RXHUwMDFisESZ8rc/8igrPS35eldcdTAwMTdo6n+AYMiaI7sweVx1MDAxNYBkWNrFP7KbUKKiXHUwMDEzXHUwMDA2hoVof9BdRVRcdTAwMDdeWWxCOyud3nFX71x1MDAwZfyFXHUwMDAyXHUwMDFin1x1MDAxN1x1MDAxOLXkrU3b9IFcdTAwMGVTXHUwMDA25uDNw4p1UL+wWs3AmUv2dFBCpVjftrTxNrvpm1x1MDAxMvRY9Vx1MDAxOcQxbFx1MDAwMGhmbX1zPFx1MDAwZjzal+glQ9vwXHUwMDE1mYhh91xi7pzVXVx1MDAwMjA+zFqJNJGbj4SmtzfyP4J7d75cdTAwMDJcdTAwMDHlKFx1MDAxOFqiudtjwUqRI+WzXCIoqUBcbuNe2Fxihlx1MDAxMf1hxVx1MDAxMj824OVevFx1MDAxYiAxdvNWZlFcdTAwMTRtNFZcXMFHJbKV0J9cZjVu6iWFTv1ltXBzwMZU8lx1MDAxYcS10lx1MDAxNPm1PZM48fWodmr6SYbRrYWKX0xcdTAwMWZNRdZJpVx1MDAwNlvlXHUwMDBm6s8pfSA/zGf48ddmkFx1MDAwM0FUo1x1MDAxMJnaTKk8XHUwMDA2THFkX1xmWDThKtzJXHUwMDE5lVgxR1dcdTAwMDM1lNQ9bFxucHj5dGtbvn8rpsQnJp5LL1x1MDAxNVx1MDAxZoD5p0XnXHUwMDBm8cmZplhpXHUwMDFlxiNcItehsIZcZsAoXHUwMDE1rK9cdTAwMTmLVVx1MDAxY2+wflx1MDAxN01bsOPeXifLv+pLWYhxbdOv8ulRXGJcdTAwMDMmheNcIqVfc7XQptQlhFxuipLNZFqWLtA44LzQ9Xlsd61gYbI4/C/9kGlYlWhiXtz7XGbZMVx1MDAxM1x1MDAxY8iFtqhrXHUwMDBmd0ZcdTAwMTb6LcJAsFx1MDAwNLnDXHUwMDE4XCLsflx1MDAwZlKfb9n4aa84603MJTpP4Vx1MDAxNlx1MDAxYqjW78dSi8xnh82NlVlcYmsh80dZWa0ww7bnQ1x1MDAxOWNPmnM/njiA2a9cdTAwMWV/SEeKkiFi8Vx1MDAxZKd/rFx1MDAxZDdcdTAwMThuXHUwMDFj3I06oldsOmqgoX2EJlx1MDAxYjKUJrtcdTAwMDZcdTAwMDClJ1toXHUwMDBmTtBxn9JcdTAwMWFfXHUwMDEzzeBGXHUwMDAxv2VgUWHCeZrllVx1MDAxYlx1MDAwZqxrXHUwMDFkwS1IXHUwMDFh/PWhhbBvXHUwMDA2o4Xfz/AvXHUwMDExr1ZAxJ85Mo8sRGhcdTAwMGbs6UpcdTAwMWReXHUwMDEzoPZcbrpLJWah9mBTiWInXHUwMDA39L5B3SFKbOHhXFwlL5n1XG7DnznDO3GRJ/QkXHUwMDFlXHUwMDBmUHJd/ipqzjCMbVCjUNPSXHUwMDEzmXn30ZZwuIRDsIujqFfAy1x1MDAxNtH3MOFkVyXWXCJGYlx1MDAxZUaN2fRFXHUwMDA3RNPXTvuQXHUwMDAzO/I9X1ummKhO+8Fqplx1MDAwNVx1MDAxY8hDL1x1MDAxY5z1ZEHo2J9SXHUwMDFhZYHlstX1271cdJrbrODVmEOhx+BcdTAwMWRqLIOmXHUwMDE2XHUwMDBlPWphRYW/QiMtXHUwMDE3PcpcdTAwMTjvnzFJMVx1MDAwMqNeZcSN5mdcYlx1MDAxYnOKjFxmY9Uz06KeXHUwMDFjNyk/vGq3r+fHYoBRanhcdTAwMDXVPY9cdTAwMWNcdTAwMTBcdTAwMTiR1lx1MDAxNP1suYFCRc03WVx1MDAwMVx1MDAwMy1cdTAwMDJcdTAwMWKHJHxQgfHAO/uQUF44RDdGRWHJTMgsjJR1Zlx1MDAxZKZpXHUwMDE4t4BcdTAwMWGNgEM7VE9cdTAwMWGzPCxK8XtcdTAwMWSlo0ZUgiax1nVUXHUwMDFhRLLdr1x1MDAwNFxcXHUwMDFjXHUwMDExkFrpLVx1MDAxOCNvqdFfXHUwMDBmXlx0XHUwMDE5TpGDaPWwjFBOJlx1MDAxMMPxfcR3r+dplVLKK1wiMpy5O1vXXHUwMDBl57D+WKq1R4mOdFwi2+FUlp810YpoXHUwMDFimZks9v5UXHSb9exh9uTnJWHwi1xc2dficeooVjHz5ThxRrOWJ7nHhoZcdTAwMDSbXHUwMDEwOuNNN52F2Vxuh/vjMm48sD6hMr9VTkaPmy1qx8RcZsA/nTVhIMOjdWmHXHUwMDAwWzj78j3o4FLx2ZjNj5E3MpZCu/HRbFx1MDAxMZLewJ+EN1xmeLdGJP1cdTAwMTYt7TT3SE6EXHUwMDFi7TCz6Fx1MDAwZlwi+zGGZIxwcFx1MDAwZmX1bJRMLqqZSv1cdTAwMDOK1Xj5oeJcZiZFXHUwMDAybHNE1n59UMaxxo2PasiHXHUwMDFmXHUwMDBmst3wdzyH+mZcdTAwMTGCiftcdTAwMGK9UFx1MDAxYcNMh4FcboRccuxcdTAwMWbqvVx1MDAxN/F7J1x1MDAwMWJcdTAwMTn+1uVva1wi5Vx1MDAxZePISj51fSlcXJFIzI9cdTAwMTJcblx1MDAwMXqUvlx1MDAxY2goRVx1MDAwNWRvk15cIlhiMmSDnynj3IbMXHTqfI1cdTAwMDHqZ37ra72P2zfgmPRalHShsaIstL5cdTAwMDFcdTAwMWbHye9cdTAwMWVcdTAwMDVjo0ux3JZcZvryRrV0xurXP9/s8Fx1MDAxN/RcdTAwMDKSXHUwMDAyX9x2MI1Ks88sb95voVxil4TkWlxuXHUwMDEylihcXEri3Fx1MDAxZsBcdTAwMTDg4HQ3KfH4XHUwMDE5VP/F2Hs0OcwsW2J7/VxuxdtiXCLg3Si0gCVcdTAwMDDCe2BcdTAwMDdvXGJPeIX+u8Dvap5m3u2FsOlmN0xWVWaec7KKhfeWMT6I4DDoddeuXHUwMDAxUYTjbW+C+kykXHUwMDAyjJZcdTAwMWYyXHUwMDFkPFCuOFx0L5OYIDjEQtX+SyqsXHUwMDBiXHRcdTAwMWO/+d9cdTAwMDHnXHUwMDFl5rtYWypeqH3ZRZ5sh36RutqYTDCFn1x1MDAwZVx1MDAxNNbezyize1x1MDAxZH5rLun3zFisXHUwMDFmRVxigLVxjlwiW+lcdTAwMTZcdTAwMWY47lx1MDAxYyCznLpiXGJlW1R4ufxcdTAwMTRcdTAwMGInV5jDu5RiPUiFaFx1MDAwMHH8OM1uiK2PfVx1MDAwYrLXKfksQ1VagajAXHUwMDBlqFVcdTAwMWaNZC/tXG6bonOFMWlcdTAwMDLQUXqwf1x1MDAwZkZkMmO7K74/uZRcdTAwMTNdXHKNh5tcdTAwMDDOw9tDXHUwMDFmVUGcXHUwMDAyY6puklx1MDAwNYtcdTAwMWRCM36bmYqQPL+9SIIlXHUwMDAzuiu4XHUwMDA3pVxyM6ufbP9xsJGNo9M1pYBfWEBskD1fOblIvVrC53Gn7S3E8EfD+NaWXHUwMDA0cLuc7VGQhVx1MDAxMNVj/zy3ZVx006faYU3XkqTaXa31V+Ou21x1MDAxYa9rwPNcclPC12xcdTAwMWWXXHUwMDFiNKDIXHUwMDAwJshacbAxWzV9dFx1MDAxOLWAKeZGuFFnXHUwMDBlXHUwMDBm7epcdTAwMTHVj99cdTAwMTie331j/1x1MDAwYjNcdTAwMWLNiDxXn8lG7Fx1MDAxZDy5XCJcZq7kj0ekjFx1MDAwMHqEq29cYl451Fx1MDAwMWLnXHUwMDE3ptagTqyqwtx9dINrXHUwMDE1/SuVQLyxMFJcdTAwMDPUN+JcdTAwMGIziJYxeFdq2M33UPpMhVlVnYVvklxuOy5VclF9kuDvJZSAxlx1MDAxY+Xr4W7BOyNTUKX6R1x0u0FuXCLhXHUwMDAxIFx1MDAxY4aWS8K9MVaWa5bCM1xifzBeMb6OSG72OVVjXHUwMDExpiXOyZxcdTAwMDdVNDpIuGjEXHUwMDBmr0ZcdTAwMDHNm+96JVx1MDAwM/CbjEWVfVBbJl1aJIX6Y41fJL3W7+hcIm4h5fW1PJr7rIHJbluZM/3je1XgMkmt7zt8XG7j5Gp7zoZ09mKb1MI+xJcnl63tXzDf6ilcdTAwMWRcdTAwMDZcdTAwMTBcdTAwMWF9XHUwMDE4Z1pcdTAwMWNbqj3nkfWLSFx1MDAxMeMhv6z2Ulx1MDAxOHNRiPptXsSjXHUwMDFiK6WFcEWsWFx1MDAxZjdqLu7YOXa+M5TYfCUhXHUwMDFiXHUwMDAzVZBccrDusM04LNlCwVx1MDAwYpxcdTAwMDTbpc7zsFZcdTAwMGKA0bJcdTAwMGVotFx1MDAxNnSq3Sb635Xls9loXHUwMDFmkrEgwFx1MDAxYfGTTJJ7dixqp/2+hI4xbVx1MDAwMXazhmuEkD1h2Vx1MDAxNDd418GMai+NeX+kMG1cZlx1MDAxN1x1MDAxZrpcdTAwMDLLlzdcdTAwMWaXXHUwMDAxXHUwMDE1yJvuXHUwMDBij0s2MmlcdTAwMGVcdTAwMTHxJEL03fjA1zEoS75JU/E9fTC1JyZcdTAwMDSxtHpcdTAwMTLqssq5TOL+7TYjnlx1MDAxYpKruNuP7G+/xZFcdTAwMWPYXHUwMDE4dOnE35h1XHUwMDAw8Fx1MDAwNCpZW1k6Nmeod7Xg53GXYGhcdTAwMDaivHZzXFxcdTAwMTCMV81qu1s+vERfYEBC9kSAz8dcdTAwMTL3QmiCfFx1MDAwYlmf3OKo4jneXHUwMDE3nIcv6rjsvFx1MDAxZlxuzGbrS016o+bNh0CozVx1MDAxMapA7VxyXHUwMDFmUEjh+NJQXHUwMDBm8XhcdTAwMWZN0FM7SVx1MDAxMWytqoSVT5v4j41cdTAwMWRcdTAwMTRB3ef2LePm8bM0g9yYZ+ClXCL4Lii+QaU3y1x1MDAxMnqF8e3UXtrb3JF9hmJheVTL3OV6UbBcdTAwMTVcdTAwMDImUlx1MDAxZPFpssGQ7lx1MDAxNJeAnvBvnzDO4oDemWxcdTAwMDL1xrvOZS5cdTAwMDaPh8648lx1MDAxMk9d761O4nne8fVcdTAwMTVYO5vbsH7bplx1MDAxY/WGL578w1x1MDAwNy28MoSJXHUwMDA16lx1MDAwNLX3J3hHW1V/QrhcdTAwMDbwjeC/v29cdTAwMTc5QIC9e1xc3lx1MDAwM1x1MDAxNCBcdTAwMTDqncZcXP0uXHUwMDAylYZLgetu1sG/xezZPnhcdTAwMDFcdTAwMGbH4Fx1MDAxZkZbgNanSpqw7O87VqSYS7w7XTf4ri1cdTAwMTZo6NOcs9xINJvqYZXLMa3aOOCFXHUwMDE3MFQ5XHUwMDA3o/ObUYaZXHUwMDAzqjdR6FolOPe9XHUwMDFifDpcdTAwMGZQfoJjJq8xc8p6wX10rDxcdTAwMTnBJVx1MDAxNkKfgjxNsl1cdTAwMTTUcfbEQENe4v6xoZj4fMzbOzSN9zzfQFx1MDAxMGc0XHUwMDE281x03E1pUv1cdTAwMGJcdTAwMDRHXHUwMDFksb64ibYpXGZY1lcj7ECfgpeV5vryk/FugXzKrPxS0mGtb2mrfquE2/ZC7khYxfVcZlx1MDAxNFxm3Vx1MDAxZYBcdTAwMTRWXHUwMDFiJ1x1MDAwMNVSXHUwMDEzcFx1MDAwNFCJkce3XHUwMDA2uabuJlx1MDAxZvFb5DwxP73pzXg6d5OrPelJXCJPXHUwMDA2pnIvWOhyrlxu5mDprixcdTAwMDN13Fx1MDAxZS27XHUwMDAwWFx1MDAxZZQuRFx1MDAwZXPY6lxu9ZI1nD35apq20eF4PLe+dllfUi5VLju44o1cdTAwMTmEVjn3Llx1MDAxM0VcdTAwMDeyld1RZDGt7/WgjI5cIlxmWbhcXF16UopUS1dif0KtS/NcdTAwMWb3dpKPh9ZcdTAwMGVqTEhcdTAwMWbhhJe9pVx1MDAxZDg98Vx1MDAwNbx7XHUwMDAz31x1MDAxNfcgZ+H1oVx1MDAxOVx1MDAxZc9UOUbt71x1MDAwMFx1MDAwZT1OIWRaNlWzXGKetGhC5PpcdTAwMTd8y/s8/zC7Jzq3TcBuOIoq95xDbDjqXHKpRJerhJSU+FuwT1x1MDAwYlx1MDAxZsrg3ZlLdGP0iMnq2PHiu1x1MDAwMp74RUguZmKV5F/2XHUwMDFhfr+Q4kBZmeleokTz19l0XHUwMDFklFawXHUwMDAwo7R61+96x4VpMaQ3JbhcdFx1MDAwNKDrXHStQoGHw8iP8OdcZpeV2PPYXHS/l5ZqI6xGiDmnmm1cdTAwMDfZmFx1MDAxM+HjUU15mFx1MDAxNUd94UojQFV4aD7D0r5iXHUwMDBiokdi7V0jwNtcdMvAkmJojlxid69YO1x1MDAxNNE2XHUwMDA2z1hcdTAwMWX6XHUwMDAyP1x1MDAwM0zj8jmiycI82Gp5P3yWt0bFR3tcdTAwMDBcdTAwMGIjLXixrCONXHUwMDFiqbPYo1x1MDAwNdDMbzbhhietR8jwwdvXXHUwMDE0tFx1MDAwMIR2J9ZcdTAwMWSDx2RcdTAwMTPibVx1MDAxYyYzX6x2p7PXYtjYiaJmXHUwMDFjYMlDXHUwMDEyXrdtXGKwRHLOTOctlP7mXG5Pko9cdTAwMTQ5pIPAwy9t0kZ7PkryUXjdntWc/JaYjHelKyfa+/XiyopjTJymRakhsqGRK/6i2jqKsoiep5zxK6VhfXBcXG3X0aziMVx1MDAxYop4/E7bWZVeXHUwMDAyj8b8dCtXWJ+UdeqkPahXKSxEq1mHZa6hXHUwMDBiS2+/SZBzrlx1MDAwZq6EmndvVjFDwrnvJ3Oe434/fmCB4r7NrpsoXHUwMDE4rjNV6CHdN1x1MDAwM9/beOtcdTAwMWZcdTAwMTVEM1XPLbOH+8iYzqBcdTAwMDBcdTAwMDJM/lx1MDAwMIdcdTAwMWMnmZdcdTAwMTdcIlx1MDAxYXWvmTD8ppdcdTAwMTfAw1x1MDAwNPP6XHUwMDA2XHUwMDBlXozssPnntG8kYlxmX+D9XHUwMDBldnZcdTAwMTW+otlcYslGP0KZd1x1MDAxN8BcdTAwMThx2HhcdTAwMTgmXG5RtDpcdTAwMTfaV22NRHjoaiNxebJAtjtcdTAwMDHEuiTrXG41rFxiXHSaNLqPf8OulL9cIvHFk1x1MDAwN2WKXHUwMDA0XHUwMDFkqln7efl3XHUwMDE4T6HWkP6AXHUwMDEwXHUwMDExn8VcdTAwMWPRVW3AYPZiXHUwMDA29FHaTt9tXHUwMDEz1atcdTAwMDRKXHUwMDAwJOLO6ut78MetjyFOXHUwMDBiibx3/H1umFmQ8Fx1MDAxZI7VhYeEXGYpWn/nXrgwg2U/o/oli1x1MDAxM5BcdTAwMWZGfVH7SHxbjH1L9+99hK9uXHUwMDA2svKzK1x1MDAxZLa0P/0uMaa4v7+031x1MDAwM1x1MDAxY/GtwVfUjsI5N9pr6lxu0rNcdTAwMWGDXHUwMDExbFx1MDAwMVpNKIfErmbEiitk3NBcdTAwMWRqylx1MDAwZVN8TZxQo3yFkoNLWFJWct/5QrlIUpmovj3j8W/e4d8lYlNcdTAwMDDGXHUwMDFjT7PyIJy2IZKE1GqPboVKXHUwMDFid3XsXXxiydmBj/Baltt9+XuQx6fVcHc7XHUwMDFkwYn+XGbTRNdgQvkyulx1MDAwMYrzXHUwMDBmoEfwxTdANFx1MDAwMYV9XHUwMDFk33lMP/6Dj31HW4u0p8pcdTAwMDc2PJzgXCJcdTAwMWVjufc599x34YCvxFRVcV/7IYQt0tpg2+v065RM37JcdTAwMDbGYFxcv8KTxIXBmFhk29mM0NbubiZcdTAwMDJhyqpm0iw5XHUwMDExeU2dw0bC/Xf3MvlcdFx01Iq7pW+LrGneXHUwMDBiQljmMuZ6Osfk5sW+0Vx1MDAxZHedwoaX/HslryiZmzEoyVx1MDAxZVx1MDAxN+wwTqfrOpUzXt/VXHUwMDBiT8os4j71tziOMSusmFx1MDAwML6qiepkeFxc2WHzx/vbNpqQvTiSY1x1MDAxOFxcQkeWMaAwhJhcdTAwMWLv83jAT/jy6brwxkRccuZcdTAwMGaOXHJCRvhcdTAwMGVcdTAwMTF5mP++XHUwMDFiK3BCaVx1MDAwZZXvfIvWlztcdTAwMTmtdlx1MDAxNq9YxOy2lIqPOIE3nar77UqLXHUwMDBijFx1MDAwM3N9kzzjSSjcO+NcdTAwMTlW8jc2pCv2k1x1MDAxMlx1MDAxZkE/s3edrkNBlFIgXHUwMDE0iXhosr9UJPfNXGZcdTAwMGV1I1x1MDAxYqzuk+97/uT0xXxRWFIsYWwuyHRKXHUwMDAwMChcdTAwMThud3Fe6LhvX26/nmDOW1x1MDAxZkmps0ctKblcdTAwMGZcdTAwMGUslVxiXHUwMDE2JVx1MDAxZG9cdTAwMWRyv7tcbn0vUzbfOkPfS2FcdDfou2JkWJg47sXAf0Rw+rLY69V45VFcbrOKJexNXHUwMDBlz+BcdFmRx/SOcN5vXHUwMDA3cG2VNZVcdTAwMDYkMD/OqFx1MDAwMVhawFfkybVahWk0Pk5vXHUwMDEwQ7ac9rhAKrpcdTAwMTReRsZDZJExb1x1MDAxN1x1MDAxN6DHXHUwMDE1s2xV3+T4seNTg1IyTWqzXFxja79cZqKu5NyUuLs7PqJD+oaTJnRcdTAwMWGgw1xijVNcdTAwMTfZMjrywovUciNuPiWhYVx1MDAxMzhcdPeXyzvdhe6jZk36ZjJcdTAwMDWPyFx1MDAwNVwiOJUzOWXE2Y+dRY3MjvUhiIIhyD37LYGuvipUPvD93vJcdTAwMTiiN+jh4Oxv51JvI32IYUmH6UjuknpcdTAwMDFcdTAwMTZYi8f5TlpcdTAwMDJcdTAwMWFEklx1MDAxOeL1mjNcdTAwMDYpcurcbpu3me9cdTAwMWbruVdcdTAwMTTt3Wc5sIdiXHUwMDAyQ1x1MDAwMOmg9r3o0WXMyGK2iD/0Lz7Fw/2KPiN/8Vx1MDAwNcM9XHUwMDAyc9/4kjfH88FcdTAwMWboplx1MDAxNKagtpL86Xer9TaVt1x1MDAxZW91gGqD3CddT0FTllxyyVe8iqLfiikqXZ7T+4N+ptPa/W83aayTqp9Uc6J6XHUwMDAwhUQ9XHUwMDFlLmnDTZHTnbq/7i14NSr68dWvcri6XHUwMDAyKENcdNtx1lx1MDAxYVxm/sBcbtPy1LZcdTAwMTX6+4NcdTAwMWHOvKlcdTAwMGbePlx1MDAxYez3xZvkXHUwMDEwdfltdcfDLEHO3idcdTAwMWJcdTAwMWaX4lIsbVx1MDAxZdtcdTAwMTnqIFx1MDAxYuJcdTAwMDHkYZNzN9NcdTAwMWVcdTAwMWSB6z81k8lzcrn6XHUwMDE47CXzTciMscOQo1x1MDAxZdCrk1x1MDAxZOIgpYi+XGI8I79cdTAwMThLY6qIrTCWlbmPQDSz5Vx1MDAwNrPdZemaIGBaMZXkp3JcbpIrY2ie8HlP48t9XGKfIP1/XHUwMDE3M1x1MDAwN3c53HFcdTAwMWTFVVx1MDAxNlC51q/0SVx1MDAwNcebu+hcdFx04fuk9fizazPzr+dcdTAwMWNcdTAwMWNb/eezm/FcdTAwMTFAbzZ9XHUwMDA0XHUwMDBiXCJa2PdbsDNcbp5ztTDnN/rXzf/H6b+9XHUwMDFiXHUwMDFkJmaFo0JwkpZcdTAwMWKxmFx1MDAwZn2fXHUwMDE2feioXFxnL7pNzn87X2GlXHUwMDE0r4w7dm5cdTAwMDCw75enXHUwMDFlXHUwMDA24zGvqDJJXHUwMDBmmobUocJcdTAwMDD5n6/J/t9GcY50cFh58e8nv6NxcLJH46hcdTAwMWHxqz9G2YLU4/1v7alcdTAwMTK2fq6timNcXP0g8ONHR3VGh8bSRMpdLHpxXHUwMDE39Hr7X/v+4JhD+K2gVFKbeD3BflQyid9cdTAwMTPlcJz8iI1OXHUwMDFjfDBcdTAwMDd7zZX/y3XPs5U6//WJcZJyvlhcdTAwMDWHWSBcdTAwMGI9XHUwMDE0XHUwMDBm71x0IYQuXGJcdTAwMGZJmlx1MDAxZXKtNcj/bNt/tldjZIThXHUwMDEwazCP3FxiV1x1MDAxNdfroWplVUFcdTAwMDDZfuWnVK3wSFx1MDAxNFxidrdcdTAwMTj8X9r62Fx1MDAwMLH084FDvIG0XHUwMDE4PkLxXHUwMDE3/WI+XHUwMDAwh1Wgc4ZPj+VcdTAwMDWaXCKTuaRq8Vx1MDAxMv7TX9jq9S9cdTAwMWbiOeMwKV7jT7dIirSRqFx1MDAxZlx1MDAwNWWcR6zYb5yLZPn//I//9r/97/9cdTAwMWP/kS1Fslx1MDAxNvl//Pf/XHUwMDFkJnFcZkNIXHUwMDFhhWlcdTAwMWP9z/93yXe1i3Vpiv3fz/rnpP/7X+f+XHUwMDA3XHUwMDBl41x1MDAxMEVlKJrQUEJRXHUwMDEwilx1MDAxN1x1MDAwZi3KaVxuwlx1MDAxMpROIFx1MDAxY6VhXHUwMDFhJYjnJv/X/7h73/SFe03F87f/aPqkKsBpqP4/45rfXHUwMDEz///f+D+vy5M18Wz1d/Hv1//+n7f+P9LkW1x1MDAxMNh/a3zWsFx1MDAwZuj9qsZf1+iOV1x1MDAwYl718PTk9zF4XGJt9PzkxtFw5X86L9RcdTAwMWRcdTAwMWKSmeWLZYTFMDLD/sPnXHUwMDBikfyiVp9JryBcdTAwMDdBqfSg0vy4P5Ksv0XB2k7ru1dcdTAwMWJOvGE8zv08z2E0h/1cdTAwMTDcJuK7zYosc0ylo0opO0IoXGJcdTAwMThfS/xcdTAwMDerOYVjRkFcdTAwMTiUQZs6cupcdTAwMGJinkiQIIZJXHUwMDFhnk9zslx1MDAxNOREXHUwMDAye+uBOKA/qE3T7r1PxDiAXHUwMDA1PJRzIPCW8Fx1MDAxY79cdIbneJr1XHUwMDFjz4f/+W9cdTAwMWMrV0+iWGzlc1TV03TuOZ5/ys/xe0tEVXn8l5uDsyZ0quWK9qNTdzmXdG7Asyb+7vWuTsZSXHUwMDFmubFcdTAwMWX1+P3nmv/1PizDV+q0ea++0j/CJVxiT7A87bffNi1cdTAwMTmfmjam0uqn8+C10Xqu1ViMO1mmXHUwMDA1My2TsD/tvz5ZJVpNumuMcNFcdTAwMDOPu91cdTAwMWRNJkK2oJJ0jqtcdTAwMTa++fmwOt9cXKhcdTAwMTWp1ZrdLDdYXHUwMDE2wZKdk1DGLpNcZlx1MDAwZs9EVCFrtoHibr9e6T59wKlag4lqdG3c/mX/u1x1MDAxM1x1MDAxY45RR+iOIeGPfuSqkPE1fWLew1x1MDAwMtVDan+uyZpYXHUwMDE0rFdh2OSsNCnVXHUwMDA17bHHbXo2QC8lcVx1MDAwNjSS1+VcdTAwMTZccuRcYtA+M1dcYjufPp9Ndmk/U4rYx1x1MDAxNuWJI3BIkci92tXk6kRcdTAwMTRcdTAwMTbOIDpvJkx2Q/lcbi3UXHUwMDA0sm5XwajMYTDNh3i9O1x1MDAwMDk/NLR1cPO63jzQu4N/wK5d50uXeaD3XGao5Tos01SbffzpXHUwMDBmM4ewvl5/mfVkcVx1MDAwN+qH21x1MDAxZYqNI87bKrKyq1x1MDAwMVx1MDAxNJkxNDxtXHUwMDFkTUnmo5Oku7wqzOr8S1x1MDAxOITRQdZdzMEp9YxBb0XriGDmbFx1MDAwMVx1MDAxYky4YL7rsnPZ1PbX5lxyNVxuO3LhSGyPUll2YOFR8lNGXHUwMDAziVx1MDAxMjVN9eT66S1AMkNgXHUwMDBiSO1zhVxcXHUwMDEy6np/aqtcdTAwMWLALVx1MDAxYv3MXHUwMDFlzUPgXGLznVxu6Cz8z/76P3zPelx1MDAwYuJtrqBAv5NWz8pEulxyydyO48aJWKGXXHUwMDEyvUD6IVx1MDAxY2hJXG5lXHUwMDA0Ws6Ieahccqnb9Gjs5M1cdTAwMWbmVfqik5dcdTAwMTJXiYv09XUnmz1cdTAwMTJKTNhsiFx1MDAwNlx1MDAxNmukOI1zRzqpXHUwMDA2byONo+1cdTAwMDJ2YMjqnUNcdTAwMWRru9FcdTAwMTDN++u9kHjrIPTyRD/S0cn+8cNwXCJcdTAwMDBLXHUwMDFmtjjQry/+jpH8/drldeJ/Y0HVTys0jG897e8xemJcdTAwMTb8cGh5biPunyApraX5hL95n8ZefHJcdM1SXHUwMDA1pSM3nrFcdTAwMDGOXHUwMDFkXHUwMDEyLZHGrGnMXHUwMDEyk0F2XHUwMDFlx7NcdTAwMTd5a1iqvjqJlJErtd6KycFvXHUwMDAzkafY6VJFXCK45FxyXHUwMDAzXHUwMDEyuu42ojyeXHUwMDE1nGq5PrZcdTAwMTKkmKVcdTAwMDJF0dRgJ1xurMMjbtRF0ZP3+bH/sZWJwMSOzH/PM792cGMpS55cdTAwMDV+X0TbmT1ouu+M9EqXQG+sXHUwMDAw8kUmXCKVXHUwMDA2IVx1MDAxNVx1MDAwNY5CIYXKKXpcdTAwMTXwxVx1MDAwNlx0yOib4Fx1MDAxNIvn0u46pOZcdTAwMDXY15BQdnzTXydcdTAwMGKU2q5xLO/o8rlLToZcdTAwMDBFT8M21Y+jXHUwMDAyQEIjU5JcdTAwMTFcdTAwMWZHSoBcdTAwMTWcSapcYlwi4Vx1MDAxZv9cdTAwMTA8+cu8XHR5Tlx1MDAxNLd5M3/4kOU7rFx1MDAxZjeaNuxcdTAwMTlNtYhL76CR0mRBeCRcYm9W697VlL2CXHUwMDE3Slx1MDAwYq3xXHUwMDA0/LXI1GNdXHUwMDBlXHUwMDFj+vCF/dmcWTEhzYdcdTAwMDO4blv1XHUwMDFmv4RcdTAwMDSqnD45eOMxTk6oKsHHlHZcIkgrw1x1MDAwZbbtZmFu+DGkjohoX2nYJ0ytN3swU0gwRHwwi/O3rz/Uq38oKHOtz01JXHUwMDAyuFx1MDAxZpPNTz7g5NXCIOGtXFxYyNlcdTAwMThgXG5cdTAwMTaD9cdEPHJoave45O9cZotrf/Rtmb+At4+vM9y0vabaTdo+jFx1MDAxM1xy6Vx1MDAwN63Mgeef2FhcdTAwMTZ4dvW+elLKXHUwMDE3TVx1MDAxZUdG8JApfsH4foLxzatJu4z8XHUwMDFm9j151GZ9uc66tlx1MDAwNFwiXHUwMDA03I1cdTAwMDHDlFx1MDAxNlx1MDAwNSGQjqJcIseGUFx1MDAxZD1cdTAwMTHdrrqjXYr25ICc1kJoh4f9rtC5uc+tRTi+ZiS0lNu461xmXXZccll4eKBcdH0wnds081wilMR9XHUwMDFlo4fgdFx1MDAwZdE+4MYpXHUwMDBlyjBcIlRklLl72lx1MDAxZvmbrWaZfbAvK1x1MDAxNqk8dIpcdTAwMDZI3DZLICOxNqU8nJXfT65TXHUwMDAzNVx1MDAxZFx1MDAxNuXrkLZRr25fRHJryelS0lrAWLSHJ1VS6HBJ8tOx+Fxyncid8qSZYE3ghVxcmiPNXHUwMDAzPafWe75nVz4hj1x1MDAxMEudYD/yr480XHLjXHUwMDFlpGpN5pVJ1Vx1MDAxZngtv+RHZ9E70ylcdTAwMDcqpyyIYtue60VZXGb7/CR5XHUwMDE39EmggVx1MDAxNKvWnFwiZ4IwXHUwMDA155U+9tC80pTG05WSXHUwMDE1YCiVXHUwMDAwXHUwMDAyv1xiXHUwMDE1pfjaXHUwMDAyI00svlxynVxuXHUwMDEx4Fxi3kevWNzeUGZDru9cdTAwMDQ0XHSf5jrjaYaYd9b6pTx3wVTfXHTxwFx1MDAxMaBcdTAwMTNcdTAwMWV+XHJaQdhcdTAwMWXHiU7069/ag1wi1PP+vX/fXHUwMDE1XnlcdTAwMTJLPaI6o8X09Vx1MDAwMVx1MDAwMWqmP9fimMBcdTAwMDTnmlx1MDAxZGJR+zlDeHjzg1XtU2FcdTAwMWSmKdDofVxuOI6FXHUwMDFmXHUwMDA1wuRhXHUwMDA3kJeCm7b+9tavciVIXHUwMDFhdetJ2Veqirl93ZKQr8gpvlx1MDAxMYLjR1x1MDAxMNFcdTAwMWRcIphcdTAwMTShnHlCYOMny8HCXHUwMDE1XHUwMDAwXHUwMDA1RS2pR1x1MDAwMVpbXHUwMDAwhFqi+YvGn1x1MDAxZXRcdTAwMTKdfVP4TD5cdTAwMWH9+IfvcFx1MDAxY5vsg+05jNF//sb85Yk4qWWwqExDvr0pkCCxb1x1MDAwMeAoXHUwMDE5cVx1MDAwYoxccsXHj9f14dz6RqM5Mq+kLlx1MDAwMcNMKLlcdTAwMTCKXHUwMDA0sLvkiVmD1Vx1MDAxY1x1MDAxZqVcdTAwMTCuK11Tonc+pSYkXHUwMDA14E5cdTAwMTfRq/U2ZFbymv1ccqqch1x1MDAxNFx1MDAxY7+58cGZdyDOxD5PLWVyVjpcdTAwMGZd0Dq+K545XiBjXHUwMDFmYL7CYKcx7EB1nlwiwNAkkUgyL6dl70hNWVwihOPQiSH252dcXF3+eFx1MDAxYjVBafHbV+G/8jaRT5lcdTAwMWStKewz6DV5LnhOn+HAUy6AqsZqLUTuXHUwMDAy++hYYS7NdFx1MDAxOKPcRJuhdJpcdTAwMWUo1Fx1MDAxYcKKy+tcdTAwMGKuctpVXHUwMDBi+FpcdTAwMDLDXHUwMDE261x1MDAwNSNcdTAwMDPxLoRcdTAwMTmnmC/fxmBPxt5LWNL26agyhTXkVSSuUl1uoMB0oVxuUS+1VZBfSMnWJe6RXHUwMDAxIDGKz8zft39+d1x1MDAwYiZz1PlcdTAwMTaSXHUwMDAyeFx1MDAxMKqSsKx3XHUwMDAwLt+fg1wieVx1MDAwZX8xS060kPRcdTAwMWIzroEtJlx1MDAwNHOugsVcIuf/XHUwMDFkm55cdTAwMWPGWVx1MDAxY0NsXHUwMDA1ij5irlx1MDAwMNS92L0txEtKJ1xuuE+nVCeXPHVcdTAwMTBEhdchmUFP0i6zi9+dXHUwMDFlguJcdTAwMDKCM9X5dz68X1xmXHUwMDAwfdxki1x1MDAwNXT0X9yTLPk8PC2icMcu97X++lpcdTAwMTNE2CdR29PAq93qyzlcdTAwMTYsc1NcdTAwMTEtc/SUxfdbYI1b2NN7XHUwMDAyfvmS3Ea6XHUwMDE0lm531r2U91x1MDAwNXuB/riRiphcdMq/OOlcdTAwMWM8+XZcdTAwMWLloSWw9t85fO1cclx1MDAxZVx1MDAwYlx1MDAwMvxN5kYhl+DgJVx1MDAxOamt4PUts2xpXHUwMDBihOz3XHUwMDEz8zHwKlx1MDAwMCXYNDVcdTAwMDa1nojD/lx1MDAxNc7pYVx1MDAwNFt62ShladZcdTAwMTOBXHUwMDAx6bX5WX1cdTAwMGUgkoB411x1MDAwMFx1MDAwMGtrOFx1MDAxYSeIVfGSdbZmtWM1SFx1MDAxNkN0aFx1MDAxYqbdXHUwMDEzVegtJXdwWobzt/72nXSV/7Gky6VtPK/Mfzhccv9hma1JelR+tX9pXHUwMDEwOeKUTkCiJMpcdTAwMDAzLPfeTDqURsJ138yCXtG94WgpRYBaXHUwMDE21qZWu1x1MDAxN6JIXZub+jg2dVx1MDAwNfDXJfj1e2srkvqKjlx1MDAwNMHM7lx1MDAxZGRcdTAwMTZe6b6RoOfiVYVsNFi8RLFcdTAwMDOi41wiMZ6MPu9QW9dOxYD9XHUwMDAyTiBcdTAwMGaXXHUwMDAweLiFviCiXWwuRTCXn2pcdTAwMDNpd1jvY3UudD8/ipR/sFDiYtKVx/+Kg0+TXHUwMDE0xtO4dbpzjVtsrUClPSHbXHUwMDE0R2JyXHUwMDE4JjSCaSxuXGZo/nonzfumZnjbaGpsXGaaLFx1MDAwZWlXXHUwMDA3zKk+93VJatGrXHUwMDBm71xubFVcdTAwMWFjP05DXHUwMDA3klx1MDAxY1pcdTAwMTb7lufNSyAgZJlcdTAwMWExjlOSRFx1MDAxZXkr6OOjuS+l1rGCKJlSN1e6pqjcV1x1MDAxNuj/sus5y4ai/9r3/7KdOcxKqa9cYp3IXHUwMDFihCE53sNQjdFcdTAwMWEmzfV1Z+Qm41b6/iYoXHUwMDEwXHUwMDAzZvedPKxkMaeYNlx1MDAwYklOSu9fq5mI7PSlsOBcdTAwMWRcdTAwMTXZm8Hcz8FRXHUwMDA0L1xcXHUwMDE1UVx1MDAwM1CxrFx1MDAwZf1GqHlcdTAwMTJcYrh9cua+m3ZcdTAwMDVcdTAwMWZcdTAwMDZ6r1xiSbLl8qnP3u2MZVxmjfxcdTAwMTCPvkch+6dfm5qt2NBcdTAwMTZd1sjtv/gyL7NcdTAwMWUqtzw3lIX54iVcdTAwMDSJy9Xu3OxcdTAwMTlKWKPQs5RWz4m974LHStFKilx1MDAxZVx1MDAxNtBcdTAwMDB76ffClV2pz+b9TimbXHUwMDE1ZTBP1a9cdTAwMDbqR++e60CyXHUwMDFm+1xmPNyq20R/9fRYI/77ZNdXrtxkvDrwvm2b+mo3f1B/X7/6XCLvxFx1MDAwNGDlrlx1MDAwM8RcdTAwMGa17Fx1MDAxZmxcdTAwMTdcdTAwMWVcdTAwMGXgWkLMR+xfWl1+qOrszmy2XHUwMDAxMU3ex8Oaavz2N9D3fUSB965987057WrULCFpKOFRID1wY2v/LaXo24dLVaWqXHUwMDE5Rbm6vPGC+VLUxHO7XHUwMDE1p6nlL1x1MDAwZrFccro1lfOAypJqw0J9xlx1MDAxZsVcdTAwMDVT6b7r+E19v4s3IIVcdTAwMDTU0HbJv1JI641cdTAwMWVcdTAwMGLt9O1hmXXEf2GjXFyFnCypyPCiTdRcZthcdTAwMDUnQfBFgi9afVx1MDAxOO1cdTAwMTSISLPeyTKaanbxXG7tytDgN2ZENVx1MDAxZVK8zd00PnLv5rDELOCb6prVfHjpXGKMiW3lb2xZU3hcdLN8XHUwMDEzRTJ9XHUwMDE4UPDo51hrPs1iXG4ufnwq6Fx1MDAxZp3x9CVHiHNcdTAwMTRnifzvvsxa/OPLgHRcdTAwMGIljlx1MDAwMCWwpjv5rorCVKWTV0VhQ9y017VcdTAwMTRcdTAwMDNVSJ3a9PUtWWJOs1x07Dk+oaEwXj9XWUTtN6PqOlx1MDAxYTtfdTzcazRkclx1MDAwN+5wXHUwMDFlmrE8IVx1MDAxOI5I6pPuNyBFUInClOxcdTAwMWN/hi5cdTAwMWX/Qj2+UtTLLVxiXHUwMDFhVbHo3fO/2ovAeJUrXHUwMDAxlbxe3Fx1MDAxZbN/YpRcdTAwMTGJx87j2Fx1MDAxYqSIhd9yXHUwMDE0PpNi6ztcdTAwMWHoo1Y0m1uGq2+BdeFcdTAwMDJnJ1x1MDAxMSfJXHUwMDAy5Po0XHUwMDEz8kdcIi9KusO5NVx1MDAwNFwiZyXCN9/MUTpcdPzkXHUwMDBielx0fqCWzpOaTyS2rVx1MDAwNF5cdTAwMWFpirb9sHddXHUwMDE5kJ/la8CMXFxiUMhgv1x1MDAxYY3Ax1xczTJcdTAwMWSAelx1MDAxMP+n386Cy9Tfu+w4XHUwMDEwJOFcdTAwMTVHb/HjoSR6c0aAXHJ1NN0gh0PcVtr4JNy4SZRJKlteXHUwMDAxOMWYvqZHWybfY2pcdTAwMTnzTbuJN1x1MDAxMu35mq1CLIeQ3lx1MDAxZja+nXFcdTAwMTE6XHUwMDBl4ExcdTAwMDa5uaZcdTAwMTEn2svD31x1MDAxYWwrbkZcdTAwMWbQM9x5Jsw751x1MDAwZkUn/tmXr0M4ptD8XHUwMDAwJYWz6JmjKE4vXHUwMDE4jVx1MDAxY5Rzgl5cdTAwMDdcdTAwMTnpwub1O1xix/bEQ3P2Q/OAkjj5XHUwMDE2XHUwMDFlbvJCnzNcdTAwMTV70vAqXFyR+Vx1MDAwZUB1sWPFR/T+TszuOKnY742syeVcdTAwMWPa1XVvXsqFTztgUICLmsvaOJL6xtXPIVx1MDAwZo6O6JF8KtWTq9iEfVx1MDAwZrC/4OlcdTAwMTTZx1x1MDAxZjpK9lWWe91gUFx1MDAwMkVHVmBOJb5YUlx1MDAxMOaaw9chmPe3XHUwMDE0iKnjZuZuXHUwMDA1U3JFSt9hI6E24Y6xPW+OXsMwOmhirXdcYtbHws7Q5T2aYZrCbVx1MDAwZXebXHUwMDAwkYLnPlx1MDAwM5KbMFx1MDAwZSbBSsM0lIY3jHWFu+EzdT5OPqvyoPvpgXp3KHhMlf5qMeo9XHUwMDE57N81xpZR+z2NlIFEiFx1MDAxNkQrXHUwMDE5xKZcdTAwMTDeRzKHTts+UO3tPcS5QNaMf/hmq4vORN0ra1x1MDAwMO9cdTAwMTCoTz3R3ExcdTAwMWKd3ECTkrCA6qjvbNrz9O1NaURcdTAwMTdyRyuJMdFlhqBp6YZmm1x1MDAxMGQ8qNd1y5mvjK6R2W9MO1x1MDAxZjeQpeufet5cdTAwMDTgI5f9pVN99eaObFxy6Fx1MDAxNHyIXZSXm3tcdTAwMWW7XHUwMDEw2bGnXGJcdTAwMDGlally8aqm8Oyx+vTdLUiEQN94vacubFx1MDAwNVx1MDAxMVClUP+cgyQ5huElyXspXHUwMDFkXHUwMDFmar5vXHUwMDBmXzl2us7zkfJOoUA0XHUwMDE1Y2G41Fx1MDAxMEm+b1x1MDAxMSyeNFFcdTAwMDGbv8/bLFMnXFzvXHUwMDEyhv8mgpxfLbTDr0y4/qhRPFx1MDAxZFVJvZmWmEDCJHLtZbCg4JST2LI0rVrLST/IiqxcdTAwMTkpVJSu+H1cdTAwMWLBXtfsnlTLXHUwMDAw5aOpXHUwMDFiLf05cH6lwolcdTAwMTRcdTAwMGK+Rbfg3e2D2OZ68pLcsVxm4jGgmtejvYdYXGLQMCc9YFxy11x1MDAxNKBcZuXeXHUwMDAwgsxcdTAwMDT9ylEt71x1MDAxZuZcYtWnXHUwMDBmNCr3fXKwXT0+8ZozP0v+qFmwVjK+2C5cdTAwMDOl0FShPqM3ZFx1MDAwZlx1MDAxZd0q2UGzuVx1MDAwN1x1MDAxYlx1MDAxZCWf8u+v6bzIXHUwMDA3yzTMMytQ81x1MDAwN0pcdTAwMGVcdTAwMWZwXHUwMDE465NAJakxJL9xmlx1MDAxNI1cdFxmXl/D2pRRXHUwMDBlu1x1MDAwZleS6nJ/7e5cdTAwMDVcdTAwMTaIyrctqmAwRyc9m7+mhlx1MDAxMKxcdTAwMDFZPIHDedviWK/aPYRbsTn84NLxR22FgeReZvBW9MxcdTAwMWR4KFx1MDAxM4JcdTAwMTbobuexs61u0Mx0sO/b8VxyXHUwMDA0jLQ8kViGY7fm6OxsL52j3/ugslx1MDAwNrhq9Vx1MDAxNFr1XHUwMDFjTbg7V3EnO3BcdPB9quOU4SnnSo1QUFS2gfZQXHUwMDEzjj2V4Fx1MDAwZrVcdTAwMDOmkVx1MDAwMfT7Q9hGziDUxbNcdTAwMDLLTfHIx+XRrPi5VeRftXbDXHUwMDFhoJpcdTAwMDLu+N7JXHUwMDEyWKhcdTAwMTnNUP35JY4+4fvlXHUwMDE1VtdWlPqJ1qeXXlx1MDAwMifl8XGvruQwR9ayOvNym8FuXCL3XHUwMDBiPMo8VsFw91x0rn5cdTAwMTVAIJB3+J1cdTAwMDHCxCSxipvTXHUwMDFl1/DuXG6a2Fx1MDAxZUyOgFJDpyH4hsuUhOE26WG/1kCcO/l43v9wh05cdTAwMTCSPfWNYzSA62+O2YyM0pfQdJI4XHUwMDFh7HxHIeQ3ee1grapcdTAwMDJEqFqzuixy1je6ky+ug4lcYrvy12Big4lSyvCIXHUwMDExvW7jx59Ax5Lf0vdrXHUwMDE1nJJcYlx1MDAwNU4nb1jJXHUwMDFmnXPiY1Hyr+R+UvE6cCuzXHUwMDFioZK9uptLuov60Vx1MDAxN/Wnib9T9TJG4Vx1MDAwZk3M1kwvYajEUyySylwiXHUwMDA1XHUwMDE0KG3G+fKA6KP58W1cdTAwMTU5hVIlgVx1MDAxZrxHi5W+XHUwMDE1X1xioUFaoVx1MDAxOaGJUPyHXG5cdTAwMTNeXHUwMDFj8qqqcfiolmabrSyn0uq94fVFPjyp6atu7O9cdTAwMTRcdTAwMWFcdTAwMTI+f5HJvpAokX43ZDBcdTAwMDc6LVx1MDAxNXjx6KtMNfZcdTAwMTKLtkdu4/jHruNndzWZjvxXfVDx1NqQ7snMKSBrsZpcdTAwMDROWX+FhbyOg811qHy3alf3wZfxoZemZJ/toPZcdTAwMGZsX4HjaI1cdTAwMDef0MySaO0wXHUwMDFmyrxu84gjj1NA68W1aus/angqXHUwMDFmqp+A600jKDzoNIzTNXImcLxkM0jV/fuS8UVhXHUwMDE5WTyFjfVcdTAwMGL8rlxmXHUwMDA3+jedV1x0rMhNjWWE0lxcZFx1MDAwMFxi4GKRXCLiQyFj3s57gJxBfJA+i8OwubKJ9+ulXHUwMDA1+5bemtpAXHUwMDFl5rJ1Ll9cdTAwMTj5+EAsT2chhTmPjq5eRIEt5M2rVpFcYnM2XGJzUlx1MDAxN1x1MDAwNpNcdTAwMDHGiETtXHKCwN4vWFxc1Vx1MDAwZbmjZay6y1x1MDAxNsNcdTAwMDGF+s+vPFx1MDAxOP76NVx1MDAwYqRhYv6YXHUwMDFmq71ReOOUuVxyX92mgd/Ov7uaXHUwMDA0ia0snKY0+1tfI4wkr6am7q4mXCLkMCXt6XrSVlC8jFbtc1GYg34rhaBfq95cdTAwMWNcdTAwMThcdTAwMTU7a0g0+ZskyF7NYXO5e7TMP/Fcbubf8qWoVMfeUrxcdTAwMTPQy1x1MDAwMLRmP6Q5VX+xw1eyXHUwMDAwXHUwMDE5XHUwMDA2czf/by3+f8Xh2W1cdTAwMThtwIBkXHUwMDAz37d62VxyfJS5XHUwMDE0655qxMvi5U+AX69A4eRcdTAwMDViWFps3+nsvj7LS5dLKHUodIiyot9nVmA6XHUwMDEwMYFR/36BWrt8WVx1MDAxMazxdFx1MDAxZjlcdTAwMWbY71xmqcu3k/dN4b/HLl/JsMXgfiOkXHUwMDA1pZtcdTAwMTlcdTAwMWLEjdakvlx1MDAwMlxm/oVcdTAwMGJcdTAwMDKNLmpcdTAwMTPK96xZr1x1MDAwN1xcXHUwMDA1NoSH21x1MDAwZY5/n6uscvlcdTAwMWb/lVNcdTAwMDDAzz2NtaUzVrx+U5meq4l/XHUwMDFmnjIyX89cdTAwMWNz+lx1MDAxNWiJOafO65RcZtOfjjRT+vthd9msZflXSU8pXFyUh+FJRjKknPameVx1MDAwMNZ89v17jaBjK6RBxkjaNeRkXCKBRoE7Uj4o+lx0oMJv6iM6XHUwMDBlx6/+qbFs1n44XHUwMDEzQr687I9509arRzaW7Vx1MDAxMch6kLjxXHUwMDEyTF70XHUwMDE3WD5cdTAwMGV52mco6rdOLyThilLRe0+2olx1MDAwN0C5KPh78yzql1x1MDAwM3CSMLt+dkovVZJcdTAwMWO8XGJrgVx1MDAwMYpcdTAwMWODXHUwMDExr2ckMntcdTAwMTeIoyOQrixcdTAwMGJfXHUwMDFhrr1H81x1MDAxNsBpo4fir2xcdTAwMDaEjF449lx1MDAwZlx1MDAxZeSjOJo3d6+UVvyp7UXHrZi+dGM460vuNoBcdTAwMTjRn+f3I45cdTAwMDK9muJPKFx1MDAxMHxQelx1MDAwZlx1MDAxYucnWrcuXHL6bOuMdzfq4qCi5T7djow1XHUwMDA1tjTvXHUwMDAwK/Y5N2QnhdC7mFx1MDAwNaqzU1xcqKZcblx1MDAwM1La2y0/zvVIKVlcdTAwMWWK6Fx1MDAwNVx1MDAwZVx1MDAxNPZcdTAwMDB0qJpkUMLm4NYobq49y1x1MDAxMCH/yTdcdTAwMWZG/tHzXHUwMDBm95Jlvqc+f81js9VXYMFHyzmDnFx1MDAxMCtcblwiNImSd3n1uVRiWNsgvXlsRJv2qWozWGhEXHUwMDEx9vgt2u/liFx1MDAxZnfT1tTjXHUwMDAwXHUwMDAwSX5B4MG7mIpraK9cbtytXHUwMDFiaaT5XHUwMDE12inWaE41nJXxXHUwMDEz0uBG6DtcdHdTRKokMseA7yf4m5zah06GlCrroJuxx4/fMIxcdTAwMDbBf82nV1x1MDAxYbswvaBUUz+EN1x1MDAwYlP4XHUwMDA2Zm9cdTAwMTig1sFs3l9OyDaqhFx1MDAxMzsjq/NE/c5cdTAwMWLG9tqWYeakXHUwMDBien+/1yDyXHUwMDE1aFx1MDAxZZ+wZ2FcdTAwMDGJXHUwMDE1+dHB7/fYyLu9Zawk6IzTmFx0XHUwMDFjKMmKKpVQfm5cItyXXHUwMDA1W1x1MDAxM1x078CkWNeYJ7I8LiahJ53ynzVcdTAwMDJaXHUwMDFkP7ZcdTAwMTLxLVx1MDAxYn/OOYpvNjPCXHUwMDFigFxiMlGpkG7XiUpI3YCerFx1MDAxMSFFwr/q3FTpjLI/RqFs8r1cdTAwMDXPQOVKeCDM2Vx1MDAwNrDV8PeVU9LodHjBti0uTOx5fMpGYdWi5lCFr71cdTAwMTPiXHUwMDFk+ngphfra7lx1MDAwMqDEVj2O3SDEXHUwMDEzXHUwMDAytulcdTAwMTNcdTAwMDZ1YLMl17uRNT9cdTAwMDPPbFUySM6f9cKHRFWhIeBcdTAwMDSVhVIqLZjeqVx1MDAwNlx1MDAxYX9NmPTP+8hcdTAwMTPzXHUwMDExN2xUXHUwMDA3XHUwMDFhXHUwMDE0XUbShlx0w2yb0+mXXHUwMDFj2Vb/tYFcdTAwMGV9/FVcdTAwMTZupcNcdTAwMWLxgkRx175gIGO8gZ+qWspHIJVVg3Titlx1MDAwN/XqXHUwMDAwIDJt3qOVXHUwMDBlZEfQ6Vx1MDAxNe1cdTAwMGXfSmhcdTAwMWR2UVx1MDAxNFmKXG7fQ8J82Ie/PbHGXHUwMDEx2lboYWP8eyyytiFzXHUwMDE3+dBcdTAwMDXw97px2oLKTUWWpMg1Mdnv1Vx1MDAxYkq2h+wvmchcdTAwMWKGXHUwMDE2YChcdTAwMTijZsw7ZJKa4YAjcTZ368opI0KdzmYsXCKjsDbUKYqkpzGmNpPhsFx1MDAxMW2o5Lu3g05gk1HJXGZ/TzqGeVstN0nMXHUwMDExcPQpeNnBXHUwMDAyeiMpQVx1MDAxYveAUToxxVX7qlx1MDAxZuOj88l3LEHKXHUwMDBl9Efeq71pZHFcdTAwMTe539zeuvud7mFcZkslUk8haGxcdTAwMTXsffG+z/ddxvW0ka9QXHUwMDE1UC/qf+8rQkL7i8iapIFPKsHZbDH5WFUn32lcdTAwMWP7I+uGISa91LI881x1MDAwNVx1MDAxN/CcUsxcbiD645LrOMKzxIq5aC5cdTAwMWWBoqH0XHUwMDAwLaKj6vRaXHUwMDEzdHNcdTAwMTTo8nGAcytNNVx1MDAxOVx1MDAwZWo8U+B2/jGHta5/nPu/Yo17iMdcIqdcdTAwMWZcdTAwMTIn7iYn2p2QXuRcdTAwMWSgueFcdTAwMTPgTOxAen84RPL5XlxuXVx1MDAxMy0w6zXOh+b21Fx1MDAwMYPwo1x1MDAxNolcdTAwMDX0L4bih3ey9V/QRlx1MDAxZIfl5elRYVx1MDAxZrbbzVx1MDAxMfMhaShcdTAwMTj+k3XdaC+xvb6xXHUwMDBm7Fxmd7p+M9JfKXpcdTAwMDeHN0dQVpFgO1x1MDAxMidpKbZ1b1x1MDAwMJxkLq/lV1x1MDAwZjdcIo7V2c78iFx1MDAxMH/8VSdiOObaSlx1MDAwMqRxtMtcdTAwMWW0Q1s4JFx1MDAxN3KqsKXr6d5fXHUwMDE0w8NYmm9+edApvqaMq1x1MDAwYmHkO1x1MDAxMGTmIDtcdTAwMTlMlj3728CNWmZcdTAwMTdtguDaudjKhP11jlx1MDAxYZtawrjAzFx1MDAxNlx1MDAwNoZhes6vrlx1MDAwM6eJT1x1MDAwMCWyPHLr3rB1JrOhy05aXHUwMDE0cX3mXj9cdTAwMWZcdTAwMTEg8eD/wqDVcayiXHUwMDA2vlxueKeTXHUwMDBijkVmpvfxIeh2ajZcIjFIq3r8XHUwMDBmi4PqXHUwMDEx9p+oxFx1MDAwZoZcYoBef3NbXFxcdTAwMWb49zbEu15cdTAwMTf3cqjJoXptPY/lQ6Trg5075fKct5LKQ1x1MDAxNFx1MDAxYlx1MDAwNtpwzVx0kDdcbuWUnScwXHJcdTAwMDElXHUwMDAw8jBcZs3tXHJGg3G9t6TUUvGVjLh9XHUwMDFm5Md689ov11xc/clcdTAwMTHV8df6KIulTjJcdTAwMDKZzthej4J+ZWT/Ie9inSEuo1x1MDAwNZpr91x1MDAxNtXlLjSjNajY/O36J6dF4j0zba1ELb2UXqZcZpNnXHLCopovjLBcdTAwMThcdTAwMWHHJqmmS8u17HSF7b7HwN/3jpa3N1wisjslXHUwMDAwnYd7+sFcdTAwMWXUyoC8g4/hJsjo095Op35PXHR8a4CFxe0lXm5lWS/lyzClXHUwMDFigXyV/FWz1SqX+1TcXHUwMDFkU1x1MDAwMLKiKMzjXHUwMDA1XHUwMDAwmIWOnm5cblx1MDAwNe84fF1cdTAwMTClfzS1V3pxeKFQ+nl7JoWjv3F4ksjHUdWR2XBg6GTLyjtma4BauLIsYbLs++jeWlx1MDAwM/hLzm50tVx0iINcdTAwMTY8XFyRTVxyXHUwMDFj4qGbdlpSet1cdTAwMTVwSmFRWsDR4/3bnVhmn1LFMeNQ9ON/78fOXHUwMDEwnrZ/acn/oss6kWSeR7C3Qq6S2U4oXHJAXHUwMDE5uG0qMT9wv1x1MDAwM8WXstE6l9ynu8k2vSgtO0uWRDBN0JLQQDRpXHUwMDE4XHUwMDBmVV1cdTAwMDegfOOY5L65sFx1MDAwMXxcdTAwMTktU/mxX1awdjw5u2y/I7JbJvBO3tA3XHUwMDBl+sGK3lx1MDAwMrJKOM7paH7TXHUwMDA0XHUwMDA0dytcdTAwMGaTZLYoNz5ppYf/Xu54t1x1MDAwNrxlUvRyOMHFLH9zyoFx/lxcIyOPtSCn5uemqJhcXOBPXHTQ39BHISpbTzDiVCdiXHUwMDFhslx1MDAxNnk+UMVcdTAwMTAzXHUwMDAy/EM5S3bTjciBpFx0m/5cdTAwMTZJUjSlSV5/g0ft13NLVGBeXHUwMDAy9oGOI55tderiLuH4ulx1MDAwMJzEMnJ6XHUwMDAxO2Hkeo9UfquCXHUwMDFmeu5ZgJODOiCoZkswJVlcdTAwMDHtJrFcdTAwMGbLZ8vNLvPi70LQrIq2XCLz8335N2/neKHW/FX3XHUwMDEzqi366N1SmFTI475cdFx1MDAwNqd942ROnqqkXHJeYlx1MDAwZm2EXHRcct2cfFXv3XKa8GUnjcxIi4xcYpk6cto5XHUwMDE1XHUwMDEw1PQr+HpGsi9fiICEXHUwMDBl81g7QLXF3ktIXHUwMDEwe1x1MDAwNOC7I1x1MDAxOSnPJd43zrKPp4pcdTAwMTh9m0va03iiXHI4Wlx1MDAxNjlcctmJ8HpcdTAwMDCBXHUwMDAwIzRcdTAwMTHpX5rcrUdIXHUwMDFhg2442lx1MDAxZlqUP1nvivC8oHFqla75XHUwMDAzhnqbXCKDw1x1MDAwNUpcdTAwMWNL085fW+4pl9ZNlWtcdTAwMTGhRkxcdTAwMTVDYNs0eDcosjpHl6lcbmZeqdKCPjhcdTAwMWJ3Mj9cdTAwMWFGR9E9c7Byylj88SHI2KXtzvdgXHUwMDE1XHUwMDAxXHUwMDAwXHUwMDAwjUczVde3cJZ4KVx1MDAwM55J34QqXHUwMDFk2lVzipP+1lpsXHUwMDE5JIPeXHUwMDFm61x1MDAxMthmsdhHW4Eg3uMmXHUwMDA0NmWJfdYmXprL2zLXnIvry9SliFvNr4WM0Fx0lm/n82r5kChcdTAwMTFmMCptdXe6XHUwMDE10++4vF60xOMoL27Jh39Yx1x1MDAwN+hee1x1MDAwN8JcdTAwMDV9pPaWXHUwMDFjQXtzXHUwMDFkKcpcdTAwMWXjXHUwMDFiyXHmqpEtXHUwMDFlXHUwMDE5J1Guglx1MDAxOKq/XHUwMDEx0S0zVJJcdTAwMDYjLYYhXHUwMDE3qcCwpfKYRq+c3uPx+M5j+5NXOVmXhb/qWIjVYPKkYPDTfnPxXHUwMDFmRWKlsVFcdTAwMDZzPsHMKjZTnI33jKBiKnNb18JcdTAwMDOWd5Sg0XazgZ9M3HxccqOYvjU/1OfJazVrnyRvXHUwMDFk9b2RvFQgYG5cIi/W71x0enkyXHUwMDBlZKJhTCcwiFx1MDAwZWJfQGZoOlaqo8lcdTAwMDc4K1x1MDAxMNJcdTAwMDXE/s1cdTAwMTfIXCL3ZpZ8W1x1MDAxZXj991x1MDAxYcvBcqz2rlx04PBMUFvdu4x9y6fNinZDgFDg8tHQXHI/XFyZXHUwMDFlyCxcdTAwMTTHTnwvnfJBZFx1MDAxY1x1MDAwM7JcdTAwMDOdOSZcdTAwMWZcYrRcZtiTXHTeXHUwMDExbyAz+OFcdTAwMWX7OyriJ+pbnzhcdTAwMTWhzlx1MDAxMlx1MDAxNlx1MDAwMVx1MDAwZmLVMlx1MDAxZayWXHUwMDFi71x0iJa238LcpC6dfKRcItzskYjCW5RvxYNcdTAwMTJ1lsqufcaQXHUwMDFlfIpcbvthMOM9WPPXnI14XG5Mq6bfgyjpXHUwMDAwXHKR+VZrXHUwMDBiTMe1I1C+y5BZ/Wh+T1x1MDAwZaXAkJo47X0l8lx1MDAxYtOu6lx1MDAwMGXTxFx1MDAwYihSw+F2pyZ19i392mdaVvioXHUwMDEzulx1MDAwYtD38rI0mVwih9e1ZdGQzPWvxiXMuV1cZlx0XHUwMDAwXGYtiVxm256oMIpZarxyc0G+XHUwMDE2LNOli3Aj2rI4Nv3ZrvdcdTAwMDLAY3/EKoNzeIuuRWxmOp/VKHCOcGl4XCJRwkvcwZ/RKL9UqnlZYa7N0/+RkqGGr5pfplhcXP9GkiPJqT02ej3XskqQSodVXHUwMDA2/J40eZRcZnr/TnB5IeyTNlJ3QtbBXSY0NdEzfuhcdTAwMWGO0Fx1MDAwNEikXHUwMDFk9VVnMPpsOEpk8lx1MDAxM9iFR7SgpVbJ08OuXHUwMDEzMtVfa1S9N687r6FM0q7Uk9L8XHUwMDBln62Fz+QqSFx1MDAwNuhYhLIzwLm4mb2LpC1cdTAwMWVcdTAwMTSnjpG761wiwTtcdTAwMWSUXHUwMDBi0L+ndrFH0KZcdTAwMTNcdTAwMDWAxbl4JFx1MDAwN45CyypcImn8UT++M8c51pZ5ylx1MDAwMlFdq8kl5VwiMoTtSllQ3tInkNAmr8PH+IJjSFx0n0TeP8ms1lx1MDAwNVx1MDAxOGy7Y+dVXHUwMDFme7TRcFx1MDAwZvWE1f/O91x1MDAxYk3VmdKcaGxcXHdsXHUwMDBl+zA/inPBviFNWVx1MDAxN1x1MDAxNzgvSu8h4XqZd3hcdTAwMTFccpP3XHUwMDFjat59XHUwMDA2z1xcwqjrQz5cdTAwMDetrPlrhqJWwLFcdTAwMDXdleinsealfumaZkN5oU3Bstq6+Fx1MDAwNvDcKyVccqNLSJKW3lpJvSUuxf1cYlx1MDAxOVx1MDAwMKRcdTAwMDK/NLz/VVx1MDAxOKIwOdGRfrkyz452hP69bpB8+mo/0i9cdTAwMGaBJVxmvoyNVlNcdTAwMWHjTUe9VVx1MDAxN0tN+d4/kreK5m+/N6DRcIy0SOSkpcFcdTAwMTNzOb1elV5ei4lkRMJcdTAwMTgh/NJAP0zglyGTZkGT5JHCMeODolrlXHRAXGLck8Ta91xca49cbs/Rxe9cdTAwMDC3WFuHXHUwMDAwlIXsulxmVT9zXHUwMDBlMNp7XHUwMDFi/skzzL/WUkbsQ6n+8pmX849cdTAwMTZcdTAwMGaAOC9N7lXdXHUwMDAwfEjgdpaFKpOEfHUnXHUwMDEywSz2Kj+ZhSaaYNg9XHUwMDA3kbdcdTAwMTmGj/H8k8NY1Vx1MDAxYrC2llZdwVx1MDAwYol/+LU88lx1MDAwNlxyzDNq6FDxMK3xa1x1MDAwN7ltiiTQxvDS1b9cdTAwMTWQXHUwMDA2iqPhfk9cdTAwMDWssKvZV9foWkJcdTAwMDBW11x1MDAxNlT40Xjb8WCpOpiCXHT/tb5K5uK6/JZlXHRcdTAwMTTmM8o8WkZ4XGbrM0RcdTAwMWSuj1x1MDAxOPUk2Fx1MDAxYVx1MDAxNOfg1c5CI031qodcdTAwMTJcIlVkOVwiXHUwMDA3TzDHMjA5/c4oXHUwMDFmYlxcXHUwMDBi8I9uXHJX7VdTKlPhXHUwMDBi3+/OSEd391FzUXuITFxiVUQtcN9dRZFvZe9UXHUwMDE4a8ziVn31+lb2+0dcIkPr9F9cdTAwMWb3Lz5cZjHvreFcdTAwMWNcdTAwMDPUej2lN4jE152k0VRcdTAwMTfMOVwiSVxmXHUwMDE5XVx1MDAwN0pcdTAwMTNqJFxumaXji+HRkVxuqI5XQP1WNc5YXHUwMDE3OKRgMrFcdTAwMTGBw1x1MDAxMf/bXFy/vmOSYFx1MDAwNcl3T1x1MDAxYVx1MDAxM1x1MDAwMJRcdTAwMWRcdTAwMTmacUkpblx1MDAwNzmD7lF3yCDalPzqXHUwMDAzy7uQ7ub1bzpJd+hcbl2KxKRetUneXHUwMDAwmO6oicZKSu1cdTAwMWLoO191ZZNcdTAwMWViJqCOzlx1MDAwN++KSLP494Uw95qWkFx1MDAxZkE8XHUwMDAxz1x1MDAxZjFjzPKsq0Y34inxodxh2lx1MDAwMUt9XHUwMDEzKYydXHUwMDE11pdcdTAwMDa7NVx1MDAwN55cdTAwMDC4IHvLYVPa6fCdUFx1MDAwML/DcyRChSiJuDvM5rxU1itoflx1MDAxY0rpNFaH/1jzzctvllx1MDAwYtC4RVA4XHUwMDA3xt/29dSNXCJ7/iBcdJEvqGe8cdq9vVT7WH31OVx1MDAxNJtcdTAwMDHqWvOJV33q/aCP51x1MDAwM+xFL2aF9a2X8+ZYS1aYhvC/eGZcdTAwMGJcdJxcdTAwMTEh+FxmyFx1MDAxMvlcdTAwMWNBTtumoSV0p1x1MDAxYlxisFN//OZFvF/9ftxV5y/Mtlx1MDAxNIyb03lcdTAwMDVne1x1MDAwZsFcdTAwMWVevmZRdKG1fzNbIWKRXHUwMDAw7+I6XHUwMDE1hseJtzUjXHUwMDBmLXVcdCS+OIZfzFx1MDAwNCf5plx1MDAxMaxuy+TOXGKDXHUwMDE5Ypvyt25JdVx1MDAxMFx1MDAxY1x1MDAxN7pcdTAwMWTpiq9h258kc65ysWbri5JwoUSDk+v1a1x1MDAxNEeJKvs6vIAqZv+ad+Q/716XXHUwMDEzLF2SbVx1MDAwNyjqk9NcdTAwMWFNX0uP7+Lw8J8v/vBbXHUwMDBmhT5FmJOWR2Xst1xuMFx1MDAwMFx1MDAxYT5gzbPc8OhcdTAwMDFcdTAwMWRcdTAwMThcdTAwMWb6KLygh1x1MDAwNT2Rbu2qzFx1MDAxOVx1MDAxM63OVGJA/ijttbq+1dzIXHJWJjFcIqfJtCxcdTAwMDBEV71cdTAwMWRIkVdS+1x1MDAxZpt8+N1IJVx1MDAxYj/Gac5cYlx1MDAxY/GW3eyQ/1rzkbHaTcI8T6BmXHUwMDBlklNcdTAwMWKaL6RcdTAwMWOAplg+7PdzrFxuuL1uw504Zdrw4Vx1MDAxNMybTUd8ZCyyftCaISV9cUyhfJ62M2QwyGAsh3dcIkhwo0OjZ/Y6rjd+mm1fmqRLl0NHzE7wY9FB0dpcIpTgLbxR7LY3VOTiz9vfXG5SbMmTXHUwMDA2173Iw5xaXHUwMDEwMkeV76892LgzY1x1MDAxY1x1MDAxNL85av2dZlD0R3skjZnTXCJcdTAwMDN5m4Qxr1x1MDAwMEPshslcdTAwMTN8R+FOxLC8csFcYrmX+ujtYMSSwo6aWv3EXHUwMDE2wMtcbtVQ0S3wxOusi/zhXHUwMDE3gJ6D98e3xC24+Vx1MDAwNY9cdTAwMTl11Hz80sNcdTAwMDCDXHUwMDE3fERhZdtztXF6+vFxfeVp+LKK/f1CXGK3o1x1MDAxM1S5YEdCRz1cdTAwMDDy0oOj/4eu91iSXHUwMDE12aJcdTAwMDU/iFx1MDAwMVpccoGAQGtcdTAwMTXM0Fwi0CqAr29cIuv2s36Zpydlp8wyXHUwMDEzcPe99lpbuSZcZvzxrb9pjqf1+dY1/LY7ZqhfkpJjMoObSGORYP+8slx1MDAxNdlNOUrzhfPSiUpOVMvpXFwyXG71XHUwMDAzeVx1MDAxNqVcdNvQnat7WzGBod1FP9okxJabvYAjXHUwMDAyVfSZJWL7TK1K4y+FYK89fbxM8KRrXHUwMDEz8yFvjtZK6T1bIWnwXHUwMDFj6UxsKbDIi1wibJfev/+oKrsusWiGojLJ61tcdTAwMDO5eXJZYGNZ/ytG/lZp5vkgTdB00Vx1MDAxMY1TakCFy91cdTAwMTBQ0vxcdTAwMWHtWLhcdTAwMTOz5iWvuZeJvFx1MDAwNWjPsXqKPtPemutcdTAwMDFcdTAwMGae8bjl2bMu2Uy31dKEXHUwMDE1peIkutRbXHUwMDAzI1x1MDAxNN1cdTAwMWJcdTAwMGKP2pB1XHUwMDBl0SvfXHUwMDAwnFKTvMXj/VxuozcmXHUwMDEyNFx1MDAxN65PJ3tcZtp/fL9g1NH844dZXHUwMDBis+RqzvyxXHUwMDA3m+71at19XHUwMDBlllx1MDAwNen7Op303J95wdRugsIoqH6W11x1MDAxMLSKKdFcdTAwMWarXHUwMDEx7Vx1MDAwMNox4InPw009Y/xcdTAwMDLelcjh71vAeDmsf4bXQcNCXHUwMDE4xdJHu/V5z3pZmYzvKHmejc77en3Ezo6gXHUwMDFijuEkmVx1MDAwMCOO79K8jVx1MDAwNFx1MDAxNiGZc0SWqo0r/uL4hCmr97fWXHUwMDA1r+R/1JIxL/XDu9heuiZ4XHUwMDE1XHSYXHUwMDAwVLSq2Fx1MDAwMpFNdWvzYJ1cdTAwMGUw/nxcIuH5RihA5IPvnbxcdTAwMWbvuHlcdTAwMDOQNVx1MDAwZuVB9mdcdTAwMWWqmsAyLNp6XVDUjEqP7pvzXHUwMDAyOWlcIu1ccmXxseemXHUwMDE5I2S859fpXHUwMDAwYWSQr3dw3Vx1MDAxNi6/rW2sd7XiyeuJSa1C3f7Yxa9cdTAwMTKirc/v/MP3lnNG649cdTAwMDVcdTAwMDAmXHUwMDE4zW+i/oKe9Vx1MDAxYXTdMlwivNDB02xHvYJE9/LwbCZF/uXocVx1MDAxYjBcdTAwMDL9eKgqt/NcXMypKVx0WvFcZjDtm+FMmDMwrEpkXHUwMDE0XHUwMDBmh9lcXFtcdTAwMGJcdNdcdTAwMWEhSSVcdTAwMDZgt6D0XHUwMDE3NFx1MDAxNjzy+OZGqnKxLFH3/1GLJbXCUKrqWvUkuPjPLr+l6Vx1MDAwZWT3Nolqm1x1MDAxZYKL1Vx1MDAxMlwixjjYqPOU4Vx1MDAxNTJ468dmm2FQye7pMaZcdTAwMDEhhuxWz8JsSo9fOEJQ77X57CX0+NZcdTAwMDGs7SwtXHUwMDFijFFcdTAwMTc9Z0B6xTk5XHUwMDE0O1x1MDAxMGr0XHUwMDE2hHtkUZ/5RLosP60stCnPKeHSk4bnTnPdg/pHPGNktYP0XHUwMDA0Pf9cXOB0XHUwMDBlOUDPRXdGmYrjOLHY51x1MDAxNTds5F0+l8vjXmD7S2eeUFx1MDAxN9n1bVeNK1xm0+f5XHUwMDEy7p9GWa1oZYKDXHUwMDFmzaHWwZL7W4NcdTAwMDIhXHUwMDE5niedwqiaVFlcdTAwMDHN6kiEiSxT8G1cIoNVuLmPPlx1MDAwN5xcdTAwMWLE4ea33Fx1MDAxY51YxFl/7eoqldHiXCJcZsx8XHUwMDEwXGKpfadcdTAwMGZqXHUwMDFmXHUwMDE1bFxmYNTR0F7qXrBcdTAwMWScXHUwMDA0dvN7ddpGXHUwMDFi3mRTl3wtk1x1MDAxNEI5jiCcpV7HsWZcdTAwMTOuTshNjVx1MDAxM1hgTZuZwfqSI3uAxFx0XHUwMDAwiZRcdTAwMTRvwFx1MDAxObdbIyaxXHUwMDFiXHUwMDEyhqIjXHUwMDFmy4aLbXvF6ZJGXHLx0k3z1Fx1MDAxYmBcdTAwMTJeT0uK2LQsNXw7WOxcdTAwMWZ1Y3LDXHUwMDFmpdQjWbpcdTAwMWJcdTAwMTiKoFx1MDAxMVx1MDAwNPpytK+vKTQtXG5cdTAwMTfhkffNWmpcIp25XHUwMDE1uJlESaVoc/Bm5/B0Pn58sJnxQI4m21x1MDAwYvXR7lxykKKhKG4vqvUhrlx1MDAxN6czplx1MDAxZCOv+7ikPrUm3XZxxVx1MDAwMfuvuiqX4d1dcmHPLHC0mNSu3ci93utcdTAwMThcdTAwMTYqcTQrM3jbXHUwMDFlINV6XHUwMDBiX7fN2URcdTAwMDMk2o0g5yVyRJdfyrmVNdqDUFx1MDAxZkGMXHUwMDAzXHUwMDExXHUwMDE0XHUwMDFmQFx1MDAwM6LCw2C86OdB4y/C2FxigljCXHUwMDEwXHUwMDBm0t3pXHUwMDFhflx1MDAxZd5oNFx1MDAwNFxuIL3DXVx1MDAwZpfaY75xwdK5XajyJy6osE+2mFx1MDAxZjjdXb3zLozbz61cdTAwMTOJ7ViPmMIzXGJu///Zd/ve5/O7z3qpXHUwMDBl73TcK67/xHiGtaZUVc5cdTAwMDRaXHUwMDE2m1xyJ7VGLryo6VtcdTAwMTTqWVxcXHUwMDFkP5jJtShEgb69K3o9YVx1MDAxY5AkMSp2hOzc/cb7kovViFcq4stcdTAwMGKnka7Zofxj1420Mlx1MDAwNVmdJ9+7XHUwMDA0XGLO2VVcYjm6gPI6oFiiR6BbKP7ieJtU6T6CMaZlt/D9zd8+rrTOXHUwMDBlaFx1MDAxOXxIXHUwMDFmXFzS7W56qVx1MDAwZVx1MDAxNt/v/ZbA6k1e9tilW29cdM7QNOnYu/l00nE97VZcZsLGlVWWXG55L4Kv/c1cdTAwMWI/MG63wMzYXHUwMDA3+ri6YuvS7jDkfc9kzOzlNqWjvE20Vq2lXHUwMDFktHJ2LnC6QVx1MDAxZmnSQXpcdTAwMWOLPPu6PeItSapYfKcv5Fx1MDAxNDlPXHUwMDFmXrn76VxmKkFcdTAwMTMjXFyQbyxPXCLPslxy4GS6jSOfk7VIVHpxtz3xe1x1MDAxY0H2dowy4v1BsPOV+vi+cu9cdCpcblx1MDAxNmBTWytLXHUwMDE2Q/M3of2jxqC11OZcdTAwMDQ8XYWrXHUwMDEzJva29Hy6QEnR9lx1MDAxYqJXpSndbWfO7z2BT7JLXGZcdTAwMWVnQttH91JTXHUwMDA2hYFv0Li98UZgTSap91ZeOZKITUlqdtbSZFx1MDAwNlx1MDAxNmdj4NI6svjrlG63qbiLV725XHUwMDFit3zNXHUwMDAzIf5PX1x1MDAxZDewzPMqa/Ag51691VxmQVx1MDAxMpxAea74iqXFPTd/zI8nsHJKazP9XHUwMDA1P1x1MDAxN7xexvv7PIah2KdcdTAwMWKez+nNXHUwMDFmV1x1MDAxM1x1MDAxNFfinuU8OH21XHUwMDBlXHUwMDEy8Fxit/inVmRcZo6k9r29aItcdTAwMWS9xlx1MDAwML1cdTAwMDRcdTAwMTBcdTAwMDY0VVx1MDAxZF3/vDZnw+fQXHJ1kX/bXHUwMDE37TvUN15xeFTF/CNecb6lMrw5PFx1MDAwMVqkSTpjMdPJ/lwikClcdTAwMWRcdTAwMTFmgto1XHUwMDFh9ledq63NhrHFZW9nXHUwMDBib8fFQyy/u2L0XHUwMDE4TIZDWsd8oOfRKnrNU/5cdTAwMWPTe0RcdTAwMTdnoVwidKKbOdF3WZjwXVx1MDAwZam3T6k44uRcdTAwMDCjsqlcXHVcdTAwMTSLr29cdTAwMWXRjv/Qd8yrxlg8RFou2sFcdTAwMTK6XSitXHUwMDEwMkujS0ZGhvckNVx1MDAxOJ5cdTAwMTKMc8XZslwi51x1MDAxMlxmzcfmgV9cdTAwMDLrmVx1MDAwZoJcdTAwMGJ9XHUwMDE2wo+ZXHUwMDE4umyUW0qNPMTORJfKXHUwMDFjVFxuqY4kWvHMkVx1MDAwNTonXHJcdTAwMTCAqGlcdTAwMGV8a91cdFx1MDAxMX1cdTAwMDNV7oI2jM1cdTAwMGVCgqtWsap0i1x1MDAxMvaqnX/UuFx1MDAxONassZx0k51cdTAwMDPb6eHbblx1MDAxYXlcdTAwMDLaXHUwMDEx66LTXFydwlx1MDAxN95cdTAwMWIjp2VqJaXafNRvaTA3e6F9UOy6XHUwMDAyvJdlXGagSO56XHUwMDFlWYW4NUxpNvNCNLFsskA83Pm0gpiDXHJt7Fx1MDAxZKy3XHUwMDEy6FAvtDlcdTAwMTI5wGhcdTAwMGbOW1hu5pVcdTAwMDPJ9uxw5T1evqhcdTAwMTnxY1x1MDAxZMryhrFcXGi915+arTJcdTAwMWXCp1hZ8O071WI8aNJ9XFz07X5cdTAwMWTZcKU9eKH1/Z9cdTAwMDMyxFxyMfIkkobHJp9cdTAwMGUj7sZ9ZDWp4p5cdTAwMTDdQDZcdTAwMWXP34JjlFx1MDAwNn14XHUwMDA3XHUwMDFiTXBgXHUwMDE1p1FnQchcdTAwMTGYbIsodebs9c9cdTAwMTk59IdtXHUwMDAwz38gN8T/M0972PxcdTAwMDdcdTAwMGJN7KVcXC/6yNM+a/bMXHUwMDA1/TBAXHUwMDAwhMcmnu1cdTAwMWaBd/MlKWNcdLsmOqO3nLIrq0/Ie8HKNKDFfFx1MDAxYVdTXGbxcjhcdTAwMTFcdTAwMWXY0JKgj6FcdTAwMTCMWuiiXHUwMDEzMt5ccqJcdTAwMTIvjfHZsob7kUY4c/FcdTAwMDNcdTAwMDRcdTAwMTXE94BcZlx1MDAwMVEm9ijzxnCaq0ozjFx1MDAwZvu/2Vx1MDAxMzBWfVx1MDAwM32/cFx1MDAxY+d6S7yIorjFYVhcdTAwMDCAXHUwMDAzwqtYUN25Z1x1MDAwMlx1MDAxMiVSILyAXHUwMDExXHUwMDFkXeJpY5XAXHUwMDA3QGPxkC5cdTAwMDTmoTM42iep3+hcdTAwMWPS/NRcdTAwMTVP6FNcdTAwMDFcdTAwMWWoc7+DcqLFulx1MDAxN71CoVveqWlcdTAwMTdHJjFHLqBV+MLJjv215adcdTAwMDc9w3/kac72YkzBtXqwpyFcIkd2kHd1gKbXPGywcfIhOcJcdTAwMTO4K2k8bc83pFx1MDAxNPbAXHUwMDEx5udcdTAwMTGrxplnLPXtWb9cdTAwMDRKJHRcdTAwMTLjglJcdTAwMDZ5ZomcXVx1MDAxNHxcdTAwMTGG9rB2oFx1MDAxYqpXnPCobN3Jspn9rXNvgsz76OCT8/G82n7uapbZocdcdTAwMTBLOvH4/KtcdTAwMGVcdTAwMTMpw0dLnUJhojBxXFzP/lvBv+Xre1xudVx1MDAxYVxuZI6w5E1OR5XroZjZmppduaYtXG7LlJxP+UhL11x1MDAwZpRSj9kzSldcdTAwMWR5XHT+iFx1MDAxNlx1MDAxNKh2XHUwMDA3POQheCbXkG6hYyT6XHUwMDEyuOJnilGJ8qHIO0c4TN2POigjnlb/6EtcdTAwMTX4hpmV5HrsjaLCZJilai/0KUK6o334h1x1MDAxOV9CoYJs8LOnXHUwMDA25t97XG4/b1x1MDAwZVx1MDAwNWOxUT9uxc5cdTAwMTJcdTAwMTDTzFwinNJd/oaYJFtOXHUwMDAycKOh+vR5xeZcdTAwMTi3hXjFvIRcdTAwMGaf5YpcdTAwMDJcdTAwMGaIdEDZ5O9ccro+yGDdjOfUjiu4cNxqXHUwMDAy8cPq9atKQlx1MDAxMrGZYf3GwpReMGzqb52A8OZeWafHoVx1MDAwZeTBhVx1MDAxYVx1MDAxN1xy5lx1MDAwMJCLMVx1MDAxZGpuYVx1MDAwNa1cbtvlQnVDWUW1aFx1MDAwNEvltlx1MDAxZcT0N+LlLsKnfJ1IeKjWpmR93lx1MDAxN3ljRIh1U9dkQ1x1MDAwMCnq41x0vWeEVGBccuJcdTAwMWRcdTAwMDN90UhBYoWdoipcYj5e6410dSHzKPFcbvTVa0SM+s5cdTAwMDG50SNL/9FXgDuANW1LqotcdTAwMTeAXHUwMDAzIII2Qv+KZfwgxPp4XHUwMDFmmPdy/OvsLGtKuCBiL6NccvjeMZf33IpPi9D4LY6PQUpdfFhLXHJ7qVx1MDAwM1x1MDAxNVhKrseaXHUwMDA1jFx1MDAwN1JMXHSFwyiVI1x1MDAxNXAx62RcdTAwMDdOXlxczDxQPZ1ccq9CXHUwMDEw1kcsXHUwMDFj0IAnU4AwqFx1MDAwM9NcdTAwMTfQgpHY4mhcYuo1fFx1MDAxM4m9Ib23i4NcdTAwMDQj8z6UXHUwMDA2+YNcdTAwMWVM1vrONmH+NTfj5F7W3Fx1MDAwM1x1MDAwYpDRs7jfIFx1MDAwMEEwcFx1MDAxMuSIzZXwrWvUUUnztfTMri5TXHUwMDE21eDD10h8WFwiMGk3PCqVeaBv5MGLkNw/8s7Dte7mS4X9SsrcmJ2BXU41hqVcdTAwMWFpn9q82MOtf8XrXHUwMDE26WJ7wlPQh5edyJXtZ+f6xE87dPNcdTAwMTnG/TGNyrqOvnBcdTAwMDFcdTAwMDXV+PzjX7nR+aiHqVx1MDAxYs8rOmnqlixvXCJP1OKRfezIjlx1MDAxND9/L9U+unWoWaFE+C8nk4CDY2RotCTsXHUwMDAzfox5+nSlXHUwMDAyyn7lXHUwMDExZo8xSFx1MDAwZlxmQt+qiv9CXFxZfZJRuPdcdTAwMTB2YyuZYD5ZXGIh2lx1MDAxMikpN/js0SpnQUWFtpd+g/p9tK/EVJF/5PlRxnZuz1xye1FcboCKXHUwMDAxJpl52Zy3eFFcXDxcdTAwMTT/ik9k373tVVx1MDAwMDY0lSVp03WLleZcdTAwMDCl8WuxbJHxI+aBXGao9Uk5MUrygbHFsElTllx1MDAwZVx1MDAxNEuo41x1MDAwZlxcKLXf1luuooa/J1wi2Vx1MDAwMMiCwVxuXHUwMDAxXHUwMDBlxTZ3YtCyq/nGX1x1MDAwMnl97bC71y7T+CG2yr+1jM+aLaPZXFxQXHUwMDEyXHUwMDFjST1H1lx1MDAxZdFcdTAwMDBcdTAwMWYr7ddMXHUwMDE3nvNwyF14XHUwMDE0KLj5/+ddx/td3/noR8TCuje/XHUwMDAyyFDnrVqTWVx1MDAwNphcdTAwMDWGe6dcdTAwMWNcIr9P+9BcdCDJUHNu95jaaopcdTAwMDK0mYS6tX5EMPiGpL7I52dlfF1cdTAwMTbDuG7I/Cvua6rhXGbRIXu7PWJcdTAwMGLIbo8oj+47Kozbx1xi6rZsfUiqXHUwMDE5fVZAblGrMqH1ZCx5XGJcdTAwMDf+/lx1MDAwN8BajLTz+oq0+lJa7jXE/d6d3kKSJEjAt76dwdVccoaCwz9Pzf6keFx1MDAwNHpf3lx1MDAxNF7w5+TLP/VwpfjhXbPMTlq+XmZLgWQyd2aKgqqcnLbTX3QoYFx1MDAxN16h9biTiHivZPR6pFx1MDAxZLbDeahlL6h5XHUwMDA09dtPb8hxz8Xlk3h7ZbBcdTAwMDRcdTAwMDZcdTAwMDJURLJcdTAwMDE/XHUwMDExvjqiW+OazKOKwSC78vf4sdXRQ5ju2zdGP87Fo/BxP/KhpfQzgEvYVC0q34Nw6/vdKE5cdTAwMDFvmK56n1ufelaZYcJcdTAwMDFoXHUwMDE5T47om/tXfV8s3dxoT8bqXCKpoJNvfCTGjUDagZpHW46VJFx1MDAxZFwibPdiXHUwMDFkXHUwMDFik8lcclhcdTAwMDDxKOLmg3yWXHLCrW1cdTAwMWVjXHUwMDAyWFx1MDAxMEfo555jOPPiLFZ0bH597r7+movpMI8rWrc4QXtqWlxickdpYrOqKZI1fPE+OJxZ2HNccr95nmzL87dj/Pa9K4eXcVx1MDAwZpM0Z1x1MDAwM9EzvMZG2Fx0ZF1ccq5cdTAwMDf1ezldZ1x1MDAwMFx1MDAxYn+RNVx0yFxc2JeY3iWD1P/cZ5Ohmz2tR1x1MDAwMre/gyxurnC7/iNcXHVbpalcdTAwMThU8zbd8vqEu1x1MDAwMMzrRpfNT+RN+vPxWMXvoVx1MDAxNDXxJf7pQ+ZcdTAwMDZmXHUwMDEwPnjxM5dju4qnXHRcdTAwMDZOXHUwMDA10/DhsuVbeXpcXFx1MDAxNYp5+iZcdTAwMDRcbqD3cEpjPOYopDEzlUqdW2Yqg5bFIN1/vJfUgOjGSFx1MDAwN/9yPXZGr3tz1Vx1MDAxZVx1MDAxZaZgW9HiXHUwMDFhV3990Fx1MDAwN2Vvm1x1MDAxM15EPDPr6jRBXHUwMDFi3oqsKP03P43Fd92ALX/xzl+/RVhqdUuEXHUwMDAy3UloI2jKSelcdTAwMWRJ9H6cpdXFM1x1MDAwMZCvKVx1MDAxYdqzUVx1MDAwZsPDjlujt5OI0Sdj5yvbO1x1MDAwMquzlWQx69lcdTAwMGJveHn3XHUwMDE1XG4kIFx1MDAxMn2n8nFcXNDYpVx1MDAwM9Ri4E+2uVx1MDAxOfQjWbdph69p3WNcdTAwMWYkpo8/Rlx1MDAxN1x1MDAwZlx1MDAwNtT14OY3y0FRYVqQbd1cdTAwMTQqfEh/6704LimVfu1cdTAwMWbNXHUwMDA0PmiA6lx1MDAwMJJAKJuI3kPTLVxcifLbhj9H5FxmJc2UXGLWuvXhsC43NUUv57bhm4xcYlx1MDAxOXPz1X7LXHUwMDEzwrRcdTAwMTT+PoPVNSDbqupbUJW9s4BP/yD3XHUwMDAwReGAglx1MDAxMXD3aYTMR6WvXHUwMDFi6lx1MDAxMa1cXFx1MDAxZtnI9L7PnzpcdTAwMTD4KNj/6IdsuNjKRTbUTDNnb+k9zTNcdTAwMWTQoYfWhsdcdTAwMDfb7s0wXHUwMDE3dlx1MDAwMZtcdTAwMTMhu72o5oZD17p1N1x1MDAxZVx1MDAwNsnSeFx1MDAwZv9et5t6RItcdTAwMTCs3tChY1xmrMC2XHUwMDA1XHUwMDA2d+JTmGTTXHUwMDEwXHUwMDFjseBcdTAwMDGGXHUwMDBlXHUwMDA2l1x1MDAxY9dcdTAwMDTlXHUwMDFhZX/rgPswdtiH+Vvbqkg8u6h9ieI0eaP0e+lCoq/7W2GLstK2z1x1MDAwNktQ8nKw7NPJXHUwMDEz7dqPcvjUxMO4pidfXbKQcjZ74ctcdTAwMTiq8eZlaeNejtm1/ZW8OKP9YF38XGZcdTAwMTlcdTAwMThQXyNb9djNLdREM/o3XCK7ZVx1MDAxZH6apda4XHUwMDE361x1MDAxZOOj10Sl8yOnXHUwMDFheme//LVOSXi9PVx1MDAxNVx1MDAwMCgh/Km6K27Lrrm6q+heL1x1MDAwZt8vxdheKeQ9/qvd1e7jx/7V08MmMXKnXHUwMDE5UrJcZjvZXHUwMDEw61x1MDAxNb0pXHUwMDFmnIg1qzZA2D3WpVx1MDAxM8teXHUwMDE2y49t+HzXXCJrVy0mXHSQXHUwMDEyV6ExMj6sMX0oXHUwMDE58TdRzlx1MDAxNlx1MDAxMD1pXHUwMDA3K0oup7koU/mXXHUwMDE48omciekyt+3l6Fx1MDAxN1x1MDAwNmZZIVx1MDAxNiZ3bqhcdTAwMWOttVx1MDAxZNrb2Fx1MDAwNnCG92BJXHUwMDE408y+tX/0wSlMoXcoeE1cdTAwMGIyY0eGXthGelwisGLRySFveLDDdFx1MDAwMnCx23r59lx1MDAxNlx1MDAxYeH6oGY/hunDfVx1MDAwNMirXHUwMDFmJ7eVtt9cdTAwMDDJzYDKlNw3xN7YV9lcdTAwMGXkazFUI8Cc9n1cdTAwMTD5ooddRaeLx5FcdTAwMTSfqMhYbGi1U7PT2bODXHUwMDBm38R5fOCKpiNcXPxQU0FcdTAwMWT4P7lcdTAwMWHmY1x1MDAwZlwiQIl9MKtcdTAwMTPhUlxieYtApfSBXHUwMDEwrXHzkozG5ualXGJcdTAwMWVGXHUwMDFj4NA2n3HTs1YlQNLAfMf2XHUwMDAzXHUwMDAzKbXMYXUvqrqZ5zLai9c5hHHFUFx1MDAxMWpcdTAwMWWcI+pcZpbAXlx1MDAxN1x0XHLcNN/51qL0PnUqXHUwMDEw8Xi0xcu8XHUwMDE1tfaPXHUwMDE5jGWNsVxy0aHGZjhOXHUwMDExRlx1MDAwNriW+sen0KI9SWy4zUltXHUwMDFkXHUwMDE0SMMpo3Hd3quBqcmHXGY+lEdg2XiDd3XDfqxxXGL3tzU9SnZ+XHUwMDE5n1x1MDAxYvBbhJpWgaTDjHLBZSfPdd72LcZcdTAwMWKy8EFcdTAwMDcjxYKrJrNxYVx1MDAwNcGp7FGfluTTVFx1MDAwNeOhcf6dl6A7dSn0XHUwMDE1yYIgRa19XCLfJEBR6FxynovZSTzAn8RcdTAwMDQgZsyEi3Dpt1PP2HCBXHUwMDA1g2s4tXQti07pqJxeXHUwMDEwST9cdTAwMTlcdTAwMDFRVaTWNu/2pmbpeTWsqIaH1CPwyXp/XHUwMDBmxFxmhTHtXHUwMDFit03yPHziXFyjV0TW2a7TXHUwMDFh8fhGVkP0rFx1MDAxMGSUnlx1MDAwYlx1MDAwMkH6R45j+/ZnglKyh2BCiK+cxsnEXGLdzXxfc/iGuERcdTAwMDd9f9lcdTAwMDKfZGVm/GxcdTAwMWVcdTAwMDRpXHUwMDEyXHUwMDBiQT1cdTAwMTM6PqpYXHUwMDFhg4k2y9/2/ab5jVx1MDAxOKv3XmW156JjVVx1MDAwMJCqLjc20VxyfVJy35bx24Nwt5tcYmGoS4Woz8BcdTAwMWH+6D5V+9F9JYnD2Ou9ajSAqiqOwlxiP1x0jTb3XHUwMDEwNISelzCh+zzjy+OrXHUwMDBmXHUwMDBmXHQ+lFxcknfbrVx1MDAwNT1lJcWq19kqiEJPI1x0wDi+8yRSXHUwMDExOFx1MDAxOVx1MDAxNmuGk/QhM2W3SqmRcVx1MDAwMUFgPGR4hFx1MDAwNlrqnzOnldtLJ93OXHUwMDA1WVhcdTAwMDFBcIez5DrwOFD3+0VaoVxc+Vx1MDAxONaRgVx1MDAxYW76VXLEw2Fhwy+L2SyWIFxmzkRcdTAwMTdcZo/EOlx1MDAxMF++uVx1MDAwNsmS45yQaPvytXfMoISBRtvWXHUwMDAz662PNeJeJlx1MDAwZjFlL7eAtu2S7tjIcorgScxkidsgqWuQPzNHWYZaXHUwMDA03cpccrDf91x1MDAwM20yXHUwMDFh42JwXHK62HhWXsjei8p9Z9jarK9gvdT6XlbrdF9uqZm7fig5XHUwMDBmqlx1MDAxY1x1MDAxOVx1MDAxYilRp1x0PShcdTAwMWSnh1xu6/a2JzW3OVx1MDAxMIlcdTAwMWRcbiPF1O5XK+JcdTAwMTI0lN5aTWhJRUv7z1RGOM0xXHUwMDFhqkql4isx01KMcdzLnlx1MDAxYdVzfFx1MDAwM2Snplx1MDAwYuGvXHUwMDA3llx1MDAwMpu+k+WaePVcdTAwMDZcdTAwMDRQUW6N0iFcdTAwMTZHaFOiodPf+DdzLoVcdTAwMTiD+UKAXHUwMDAwXHUwMDAyXHUwMDEymOGzOaxrpHCfj1x1MDAwMZp7WHPFWqSuPIxPZcM5JrVvmdFcdTAwMGa+xWbfQDX5U4eIXHUwMDAz6zssXHUwMDBiyYOUXHUwMDE3Yp9cdTAwMGalbvs4KStC72h8N5BcYkBBt9jy3V9urHNR2b1cdFx1MDAxNeTzQF/vppZF5fypy1x1MDAxOH04T1f607ez8o9cdMb5XHUwMDA3gYMmXHUwMDE431876D1BJ5k04DM6XHUwMDFj4fdcZlx1MDAwZqHmS1x1MDAxNmdcdTAwMTi3eNXtsLpd1cBs9Vx1MDAwMJ9cdTAwMGZSerFMVFxubvfWOJts4Zswz1RcdTAwMDKTXCKC44RcdTAwMWPNXGJBZ6ZPv9N42FaxN8qwteXhs1HA7fHUWZOxZvtb2y+P39l3oVxcM+J3Pv71TvTuXHUwMDAylsKGWURcdTAwMTGuY1rKgsFlm69YXHQ/kftcZrj3XHUwMDE54JT7xVx1MDAxND0tgPNxk5uIVe2BwpTJzjpETjHecd09j8fmypBQr1x1MDAxMVx1MDAxMlx1MDAxMJJcYmxtdFx1MDAxOcSPlVxc0XMzSezMXHUwMDE45lx1MDAwMVx1MDAwM/T4jzk3WiV8XHUwMDE0V/tkwoXPXHUwMDE1aYLNpaBcdJBcdTAwMTRcdTAwMWI4Wa0xyEGmLLntwIu/d1x1MDAwMM8/XHUwMDFhhTP1SV5klv1mXHUwMDAwhftcdGDEMpI4MO1MSjMhiYnhQ2dNX1x1MDAwZZTkOEBcdTAwMTU0YeBRkao1RSO3y4lcclx1MDAwNq1cdTAwMTRcdL1kouW570xa78T/kSs46pdcdTAwMDXPXHUwMDBiXHUwMDA1yGaRXHUwMDE4XHUwMDE3jZnZ905vnHRNJbPUi3xcdTAwMDQ2xVx1MDAwM3pSiVx1MDAxY6ZcdTAwMGJvqlx1MDAxOajPm+ehp2ZcdTAwMGVMSpM6XHUwMDAz6ZRFo37lMuT4XGY/zCurIaXiXHUwMDA16MX1iVx1MDAxN6i+Q6gqXGLt4ossMmR2kWpYWzBBV8dWLmmdPDxmIFx1MDAxYm9T6VxuqVx1MDAwN+6dnfUkSutcdTAwMWa1o1x1MDAxZFx1MDAxYpj77oKdaLSaLVx1MDAxNj0+4zieiXBsvGmmVnvG/nTfhjmeXHUwMDFisLApr8ZcdTAwMDVPk3691DEoOGv+XHUwMDAwl7joXHUwMDBm7lx1MDAwNqstubn281x1MDAwMcFcYrXyfV1cdTAwMWaCp7/P0EZVolx1MDAwMeh3fyF0XHUwMDA2mlpLJcCK4Fx1MDAxNqWblz7kz+LFXHUwMDBiSfytXHUwMDAzXHUwMDEyXHUwMDE0Nb3+zlx1MDAxYpbU8VuLXHUwMDEyXiBZu2Y/uEdcIlx1MDAwNviej90lQqfcZXaRQEJwbK/53fq0aEilXHUwMDBmaV2kXGJcdTAwMTbTp89UyG4uvKFLXHUwMDAzsTDXNYdcdTAwMWSuXG5cdTAwMTJjbfY+qItGIyqtVpiM1/t7RMCYhfl8iUlIqOfTub1mXHUwMDFh+lMmPF+AwqjTbSP5XHUwMDFmXHUwMDFisXhIrVx1MDAxONqvXHUwMDE3XHUwMDE0OFx1MDAxYpF4gcCl6GJMc/GRmGZnhFctyYtd3zjSfGJcdTAwMWZcdTAwMDZ4+1F/XHLk0X2vhP721lRcZjXrypYx9Dp1nJzb6EHipGGqwZotxohSeWGi8rU0ZofHPWHYfVmpXGKKTiC8sPrDN1x1MDAxN0P704fGjbZ0m1x1MDAwN6ldONrvsOZcdTAwMDMxXHRmiFjHgTOUw9lhWrdAR1RWuGiT/8OSSin0oLo+lVdB91fauVx1MDAxNLnblFxmKtZ7Qlx1MDAwMX/HuiC3vZKSgFx1MDAxNllGe27Mc73ppSr+/W3JjXur/Fx1MDAxM/urOcmaezBcdTAwMDcxXG4oknCW9/dcdTAwMGJNomVqunVcbuSxkIJXU7I48LA+6s6n8ulsJ9vchqw2x3e+jf15riXKVctcdTAwMTlcdTAwMDTLNrTcU15vmpzv807Xud9nXHUwMDE5jlx1MDAwMLMpw7emfjv6vM+La1x1MDAxOel8oPw/6ne/c4mXazlV1Vx1MDAwMFx1MDAxNG68VV9cXFx1MDAxNPmEXkVKOJtacStcdTAwMTdRV/DOXrc2iUXDh/NcdTAwMWLTXHUwMDAy5pn5SvrMnkIhdaXOWO7Jr4+Y/7zTXHQhuJzpfOd5XHUwMDAwuS+a4lx0kIVZnChBXHUwMDFiXHUwMDFjoergcSGAblDXkrGfjyVccup7+Ee92yFcXI/9Ss9cdTAwMDKTWTwmiWuNzd1aeVmO4tZOzDPP3bG2mWeE70kvb1J6/67OXGLQum1cdTAwMDZ5XHUwMDFhjKW8hZWxWUlOXueAy5JcdTAwMTnWSdZRmVx1MDAwMUxASFx1MDAwZlx1MDAwMfi4XHUwMDAwWiN4XHUwMDEwXHUwMDBivOlN+lx1MDAwMNpLXHUwMDE4t9FV21x1MDAxNb/nK3ybXHUwMDBiSrOiSPxcdTAwMTJvotLPXHJYUPPMkXY7JnhO7lBxgLjASTfIOWQv11JqfV9HRu/XMckv7y9KucpfOKM4eXc8+6FGwHhXk2tcdFx1MDAwMjBJ8Fx1MDAwM1xctNo9XHUwMDAzR/zUSU89l5ojLZVcdTAwMTVcdTAwMTjhUztR9TfOaTK2XHUwMDE2W7CLwq1u7IZNXSNRXHUwMDFlgFx1MDAwNFx1MDAxZrmEO6V9XHUwMDE1NytWbszauCVxrKaqXHUwMDFisipW3uBSNpP5R/yAsed9Qn/iXHUwMDBi2+F+ZqpVQVBcdTAwMTI+XGYpXHIsk1nVXHUwMDAwZUNIusvk11x1MDAxNJFyznGrZVx1MDAwMO6XbSeF9lx1MDAxM7xVaIhcdTAwMDb/7ZKQT1LTx+ieilmKlyt4iq//I8ZAWlwiiFx1MDAxNYZcIieb1l/kdlx1MDAxYTBb8Fx1MDAwNFx1MDAxOPLUgmQxe1x1MDAwM26SzSSLW5Kdblx0rfJhoilcdTAwMWYmXHUwMDFifPSiPFx1MDAwN5mzV35/XHS033Lyxi1rXHUwMDFmKIb5Qjf3iFx1MDAwYmVqj0RefJe28ya7fao6u1x1MDAxZlx1MDAxMJy7Xm5cdTAwMDBcIlxik414XHUwMDBmmdN1muZcdTAwMWZcIjix74c4pH9r/vq30smPqMVAXHUwMDAzSSlcdTAwMWOf1jA/jK54XHUwMDBmjlx1MDAxOWFcdTAwMDNCXmz0Wlx1MDAxNp7jtWY9gvV5RsxjzpRcdTAwMDKqSrwra9Cyblx1MDAxZsZmXCK9XHUwMDFkzDyEXHUwMDFjXHUwMDBl0V9se3244DvEfFxu07xcdTAwMGVrp6XJ69LXgrymz1xmz21N2DtcdTAwMDFuXHUwMDBlS7h5XX1aiVx1MDAxMktcdTAwMGZTvnlk5Vx1MDAxZnnk0fYkXHUwMDFm5rMsXHUwMDE1YFxyXHUwMDA2UnDhXHUwMDA1sDfNXHUwMDFkWlPkyGx5tLtcdTAwMTPqbt4wv6ft/VOrbmTQSUpcdTAwMWaGWd/8TVx1MDAxN+vWVc3XVCeKiJDdz1x1MDAxZK1FXHUwMDAyPlx1MDAxMHROKm2tyc1xk/vU0kFgMIWtd4SP94V828gldlxy/JsvXHUwMDBiXFzEbKKC47qxXHUwMDAxxFx1MDAxMJ1ptsVOM1x1MDAxNb2uzaLNn8hSaPhslju1N7STXHUwMDFlXHUwMDAyMpS2mDZRxERoXHUwMDE4pTD75fFqqbCsQJSinttb2dfkq9pcdTAwMTOUvj3xZWwnnqK7ydf1l09cdTAwMGU+5J6Lpm1cdTAwMWHvceF5+rp5/K7vecRsqvhcdTAwMTepXHUwMDAz6Xpr7feHzlthz4GtOnufnl3vxmIjXHUwMDA3rKpKOXy1XHUwMDExbDuxW7Monjk8YTFcdTAwMWFR7qdPK7tcIuH2KVI58Y/7kapcdTAwMTHGzmTn/IxObUr25LzhXHUwMDAwgCcq0KYpbW5cdTAwMTG3jT1cdTAwMTB25ctfrP8w7v1cdTAwMGaMqznMrSiQLHbwVdBcdTAwMWJcdTAwMGWirLLvYadsT6xcZqZscuz4XHUwMDE2Rz5eLbWcJq5tI4Rxk61ilY7JuuHFJvcnYi0sa0ohZESCXG6yQlx1MDAxZGj4m3D2XHTNRFx1MDAxMjTNUFx1MDAwN+Fbw4GxXHUwMDAw41dcdTAwMWW9P0DS71ZXSSDNn1x0/WhD7X3rvfZiPdq2fsWn08HVXGZcdTAwMDC/ZLok9nxcdTAwMDO8SyzTXCLD1Vx1MDAxNHVcdTAwMGZcdTAwMDbFy2XuP8un+/hAgdNuStzO5D7zuH5cdTAwMDZcdTAwMGJjiUxosWSdxz+zMVx1MDAxOYWFe7xcZqLblVxmJrZ7glximm8wzPCTvsJrO1xiOn9cdTAwMWLnozAuXHUwMDE0vaRLuv/OXHUwMDAz4G9cdTAwMGV3Pv+Vm7jBXHUwMDFhX+BcdTAwMWUymzUmsbxHxSXyhN6BjkWGakC5rUBcdF+FOrLua/xkmlJ0nMKpaylcdTAwMTPBI/SlLH4wO/m2PqU8qHpxM5b7w1x1MDAxNUHIXHUwMDFl3eFVs5eOjjvCg1x1MDAxOOxTbiRyfi1FXHUwMDE4st1x3VxmXHUwMDAyZ6jO6fWXT/KXXHUwMDA2XHUwMDAy3Vxuv1x1MDAxOFx1MDAxZrk8XG5kblx1MDAxZv1/x1xipZKbMim28iPxQXjHxkdzO4ns+l/txH7znad4XHUwMDE4dShcIsvxOsWlwoXCkl5Y71xcM/uwUV6uenxcdTAwMWZcdTAwMWZSLIFe37ui+lx1MDAxZFXo9Fx1MDAwZS+F5lx1MDAwNDBX/6yGs0FcdTAwMWaxpqdcdTAwMDfwouThmbnMNZN2iuVfm2JcdTAwMTl+/fZTMG3hu5FSwqBOrlx1MDAwMIFtW3jLlFxmRkVQIDZcdTAwMTf3Zsr2I81UXHKrMN9cdTAwMDFGdKXzp1+pXHUwMDFkytD070M3XHUwMDAxKWXgppVTlFc4qFx1MDAxZEtJOnLVXGZcdTAwMTgn/PqZXHUwMDAx9Val4Vx1MDAxYkuohjydjls/KtEnf5exe/9zeWxKdfu1XHUwMDE3/+HKvGI+VWi3NUTAYy2ZYLFQY+I7KFksRVx1MDAxMzZEXHUwMDAwi1x1MDAwZix8vY9+mrlcdTAwMDdcdTAwMTczc6Kpg/o7viY78Lfv9Fx1MDAwMuchXHUwMDAz9uU+SP1U5Si5XHUwMDEzXG657ciahy9TXHUwMDAyhqepXHUwMDA3RylAnVx1MDAwZXbQTDnzi0FAe4K4flx1MDAxY/LXUmE5acX2XHUwMDA2XHUwMDE5XHUwMDFmXHUwMDAx0mJ8Qt5cdTAwMTZTOt9cdTAwMWLcb3+YfTmgxO8rXHUwMDFhroipnnOSqNfU0zl5k/DJUPeAzXjk9t/3S1x1MDAwZfLc1fyfuEJg1S9jXHUwMDAwgVlcdTAwMDTxXHUwMDFiZYNcdTAwMTWlb1x1MDAxMDCDJlx1MDAwMqytLcvzPdNIXHUwMDA3R5mqXHUwMDEwxiioXHUwMDFmdq1wyVs+kXAxLJRr6ul6nrqEQnRcdTAwMGI4VtzY/81s5er7tN3n0sY5gqtRd3GmN46HIdk1ZILPXHSCJ/S6tHGQfpSbi1x1MDAxNWVcYlxmfmxptvPmvzO7msftaf7E3LD/1rTRXG5cdTAwMDB0jWJLXHUwMDFjekNcdTAwMTJ3jeAsxINuv7IkrjnbxfZiwliaiaxvvIY5q8KcwolcdTAwMTGyVb+pZCUwg8Bw+P42kf1cIupbSK+LXHUwMDE1j89ChL+zJlx1MDAxYZBA8Fx1MDAxN3mhq7U2oN+7h1xyPFx1MDAwMdlcdTAwMWFcdTAwMTGo14fq/os9XHUwMDEyM/vfecxv7uWg4mSDJEmZpLk/4DGD9Vxyor1508d38lx1MDAxODR4Ob75eFx1MDAxNrVFZUDsOlx1MDAwNCD2w3YxljqiXHUwMDE2UMPznXxru0OPnV3S7Vx1MDAxNSVjXHUwMDBmUWlnXHUwMDAynpNCc1x1MDAxNVx1MDAwMlx1MDAxZvb7hFh9u6U+XHUwMDFk8084T6ydXvJcdTAwMWEjbJlpjoWWodffuaNM88A/73vZXnLxUyve1XmW2ljTdFx1MDAwZkczn+cl43rEME8o5UhI+S6bLKT9f7O07SfP305aj+tEuzdcdTAwMTJ+vlx1MDAwN1x1MDAwMDaTfFxyQlW/0FdcdTAwMTie2Vx1MDAwNJtp34SsIPuSVt94XHUwMDBiX5zc/Mkz+pLamZkjdy7SezRAIzaOkmBBquFivO3lXHUwMDAwr0l9eqjTvJLbrTxgtfdK59tcdTAwMTT59s/h/cM3PSuAgjxcXFhEwpth1HlcdTAwMDVoX7Apolx1MDAwN1x1MDAwNW7g1oUnOFx1MDAxN0Zvj5tz4CuVXGJcdTAwMDXysW5oJUvtr45cdTAwMTVzduGJXHUwMDA2fOmqOWl937MrJma6kC5doZFZ+jrE+3dcXEvQXHUwMDFl+fBB+Vfa/PTVPpu1/mDLYiOtz39cdTAwMWOuXGLCeSm2YHZnsPPCU4qTbZSzh1xizlN1XHUwMDEy3U05OIW9hEBcdTAwMDf/5t6976xcZqXSwLxhdpBcdTAwMTbAhN9cdTAwMDdcdTAwMDfJ9HdccmhPabz9zlx1MDAxOYBaWZe3KctcdTAwMDO/XHUwMDAyXGIqcF9IXHUwMDFmXHUwMDA3ZryAp1xmTbhvwi1cdTAwMTFcXLe3fSB03pHmMlx1MDAxYmGmnp94XHUwMDAwpE5cdTAwMDTE7kH5vlxy3Is5vdrPsUrY794qT35855VcdTAwMDJXvbo0nlx1MDAwNXtvXG7PvDaW5zD1uPnA3G9cdTAwMTbrp1bbJVGxy1x1MDAwNEZ61j/6vbj1e1x1MDAxMrekO8jGXHUwMDFlXFxovO/Ajlwi3C3m3UKhJlx1MDAwYqCVU5G+epRYfVx1MDAwZfvD2ZiWmXrU3aeSO4hiQ25cboW0SiFQ80l+WFxcRP2Nh04mtFeWfshAVnSWT1x1MDAxOJc80nXdiHWRWEf/JKPmffz0ykhcdTAwMDbzXHUwMDE4ae6J1W1cdTAwMTLynbOAXHUwMDFi2Vx1MDAwN7ckva5cdTAwMDGP2og4jLVSXHUwMDAyVtuqI1x1MDAxNKM2pIbGWkhcdTAwMTnyftuOwm9cdTAwMTVcYmjgglx1MDAxNLHXUCc5KUiDwavCLGq/jFx1MDAxNfONXHTHoo7yby48cliSb+43iCWHd09cdTAwMDFZXHUwMDBiJctRJiNCXHUwMDE0d+CQXHUwMDE0SGRBzbo5XHUwMDBmYLRVJb39jlx1MDAwMIDO8PT+3lx1MDAwYsN8a1xm0jNFXHUwMDEzunpcdTAwMDJ55sGhT6dg/XGAxVRw91x1MDAxOVx1MDAwN9/wwNdW3Sf+3L6zXHUwMDE5J8+CXHUwMDFlgzVGwUm0Vj24OWomflx1MDAxZO76fqsjKlx1MDAwZsbQZpWW4ONccj855mpcdTAwMDNccrR/9UopbMCa421E4YuGXGK1yMWlXHUwMDAz93q3KZd0Mj7IX7rYrtH3XHUwMDAw8l8yL1x1MDAxN8Lslf23R3Rl5DiHZv7+ISd7ktneXyZDXHUwMDE3wChcdTAwMTaHXG7S+TxtXHUwMDE1XHUwMDE3s2qOtlx1MDAxZv13XYVSamWB+zafXHUwMDAzIFx1MDAxYVx1MDAxYT5FXHUwMDEwx2tcdTAwMTfRM4z1cytcXKfR/eabJ/zvsVGokVD142uOkiF5VaqRUFvM57gjaFx1MDAwZqpxuOxAVHjWZ1an5lx1MDAwNTGhI6tcdTAwMWbYqH7Pq+m8nVfx0UDCaqDyXHUwMDFkuLWL1UKhXHUwMDAxTZT5s8efn7j/bTjDMn9gwr5cdTAwMTWkbDtcdTAwMWbdXHUwMDEx19m6gnBCdnUqwderKL7tgrlCS62ESF9ywb13llwihL+1ZGR5e0g0XHUwMDA1yJWkr1okm1dDprd0lKib71F9jC7fWrRcdTAwMWZ71/ZtnezHV7uLpcxcdTAwMDLi8d4o3Mi07tpcdTAwMTCQgIuUIC+yl2xxLHD2XHUwMDA0cfpAPnV5YEjOn7/rKLiIe91cXJ96gvuOuFx1MDAxYo3SyZ7Exlx1MDAxOatcdTAwMTjYyIJnt3BcdTAwMWJcdTAwMTDQSVuYWbjWS8gyl6RPlNVa8Tv8NlG2VFx1MDAxYqQ9pKVi0YGF1lxu7406+1xuXHUwMDFjXHLR3eRVXCKDiuaUXGapTEzv9uRttpO6VEikXHUwMDE3i+e9XGI3605cdTAwMTbHze7HXHUwMDFmJLdekHhnSY7Se4Mz/1x1MDAwMenZ7LVcdTAwMDd8eqSqyqVp4oPvWLytM1x1MDAwMubY9u/4g3KzyvRcIqVd61x1MDAxMTNcdTAwMDNbXHUwMDE0ObaCZJ6ojebQkepcdTAwMDe3XulQrbPkKyZLxje3kIpvlaBcdTAwMWKF+1xiPX5mhFSRxD7WIJtyRYf2JFx1MDAxOVx1MDAxN+RqXHUwMDBiUFx1MDAxNZaCXHUwMDE4SZNfz6/23X7XVvDMeltezlx1MDAwM51swijRw5D7mEeeJu3oNa49L8XguoxcdTAwMDH8nUF5I+bnc1x1MDAwYsVcdTAwMWIj6Fx1MDAwNFbwL0ZoXHUwMDE2XHUwMDE3zM5+RPBw+OAtXHUwMDA1XHUwMDFm20GRQFx1MDAwMzaccsWyY96a6N7pr6Z8ypf7J8apv6WHblx1MDAwYol5VVhLQy5cdTAwMGVcdTAwMWZV76AxKqTUeWtbIZ065Fx1MDAxZM+O9mMvsMRttbD533udPmYpXHUwMDExXHUwMDFh62bLKdNUpVx1MDAxYUdiXHUwMDAw8FVAq4Y2WqbEJm7rN1x1MDAwMbng33Mz2bJgfMfFYlx1MDAxNLWpxXCoo0hcdTAwMTPwTVx1MDAxMIh1M5XaXCLVNGH9iudYXHUwMDA2qNNu2D4pZmdVY/bBR4+jXHUwMDEzKN4hcZaZzk9cdTAwMTZPOzXa+/LKjovQTTZPXHUwMDA3XHUwMDFkOn9rolx1MDAxZsTbXHUwMDE0XHUwMDFke7Zk8GSCkfEpm3bO1L73+80080dmXHUwMDFmXCJ9Jkvcrlx1MDAwN3ZcdTAwMTRIaIb7XHUwMDAzz1xi2XXBhZvHRtTO335WYTR2XHUwMDAxJfzNXHUwMDA36muNLo/ANPDGOcFcdTAwMDG3XHUwMDFh8F/SdFDqYOJnzKu5XHUwMDEzUFx1MDAxMplcdTAwMTdcdTAwMWWq2dlAfLiPXGJxumHHN1x1MDAwMTZcXHVmPt9cdTAwMTjGh1wiv5dZzF57XHUwMDBickPVgVx1MDAwNNFcciRen6lpZyBcdTAwMTFgNmdcdTAwMDNAyFxmT2arXHUwMDFjRdSMP+/E5iylocGTpHFgxvVcdTAwMDRE36BcdTAwMWPpyf25/qKG5yyKVC5+8EB2y1x1MDAwMpVcdTAwMTSAb7/XXHUwMDBlw8mL+6G2XHUwMDFiXWzDh2FqL+A49zN7rH5LXHUwMDE0PNbeoFx1MDAwZdLANctOm2tlyZGHK2rE7+c/XHUwMDFmN/8xruel3Fx1MDAxZXXjclx1MDAxZEeIWTTNa9TeeGnV5/zZsVx1MDAxObU3XHUwMDFlVVx1MDAwM1x1MDAxZdeYXHUwMDA3UkbwS3tcdTAwMDCq9HprjFx1MDAxOb3UXHUwMDA20X7unHAqT7LNvT5cdTAwMGZnL7LQmS87o8xWXHUwMDE4/fI+vcCp7DeFy6jf+tmqIeZ1y29cdTAwMWHb3ldO01x1MDAwNNFB9OWuP31cdTAwMTLQNVO0byB15ZVfMNRLXHUwMDFmXrkqsIRiXHS9S7xto8Rvn8O8KVx1MDAwMW7tMUdcdTAwMWayefmZ8cyP2nRC+dxcdTAwMWS7ZDNZqOM/MYVEsjlt3XSRPHSElkVcdTAwMTOQb6W+blx1MDAxZjxstnW+MUdZ4Fx1MDAwMGL+cze3llxui09v5YzlPp2Tsyi94z10v70rSVx1MDAxN7ou9CTQd7dcdTAwMWOXJSafkb7b/8Ru2YUpdOAgrq+b6UFTfpOUa6LbXHUwMDA0k4+DXHUwMDEx9XyhXHUwMDFlQlx1MDAxMVx1MDAxMSv2rV38cezSXHUwMDA0Nvb7Jy/UYkxA3kvbXHUwMDAzyq0mTbfCp1x1MDAxZNxm5TUhvPztmz3//cyyeIROYFx1MDAxNCBJu3uSZ3mPWku/TYaC40iztjo2rCGpXCI/vuZ+6I0gZOpItz+uOMaGJV6oXHUwMDAxmK7PXHUwMDE31cFcIjDmgECbwqR131x1MDAxOLfgY8TjO8Px/7uu9lx1MDAxMD6FXHUwMDA2T1x1MDAwNFx1MDAxOFx1MDAwMslcdTAwMDLKtpRLnGKyuSMw21wiqzz+p1x1MDAxYYpcdTAwMTFgeL28h1V+540vvDTwfoLs6b7tLIijWVx1MDAwZVwiuHpEt01/9XrXt6ZW/davmlx1MDAxNWr5cV3y1dRcdTAwMGZiXHUwMDA195tcdTAwMDOCXHUwMDEzOlx1MDAxMYe8XCIv1zx8q1jJ13+LXHUwMDE5P0SySJovQfTug4O0WY3QXHUwMDEwieDkK91fPVxiXHUwMDBieTGNXHUwMDBmW/uYyEulXHUwMDA2LmDmSVarmP9cdTAwMWSDb5gtod2ielx1MDAxMlx1MDAwNauC6LzhbY6CUFx1MDAxM1kx61x1MDAwM8rBxlxyXHUwMDFl4qlvv82bXHUwMDFiUf1cdTAwMWJcdTAwMTbOn1pwrT9irTrf0mW/6aqDXHUwMDAyPGrYXHUwMDE5oyNcdTAwMTXQktim09juSugqnFx1MDAwN7VcdTAwMWQorzdiXHUwMDA3YbhacKQ1nLhcdTAwMTCJYM0oWmrXuey3RfoooZ/7K5+SwtIu7DwgMJyubUOLvPhcdTAwMTS4XHRUV5A8QKZcdTAwMDFZJlx1MDAwNpNcdTAwMGZcdTAwMGY9v5dl4MLvXHUwMDE4/lLxXHUwMDEycaEqXHUwMDE06rVcdTAwMDeCdITnqN6E4Fx1MDAwNng3XCI+XHUwMDAwWu7WoFxmn6CMY1x1MDAxYX9cdTAwMTiXXHUwMDE3voxU2u5dbEJ54SHdJ6Dr/v/brUVcdTAwMWZxlUlbS1x1MDAxZlx1MDAwYpqYjdC0QJ4/X2dlJlwi0nlcdTAwMWOh8kra/O6vqLVcdTAwMTX63sd0kPTiyFwiuGdNXHUwMDA0kzSKP1x1MDAxMyNQXHUwMDE1U4fR3dBo4OPRxYHLyaehz7rHa3VcdTAwMTGffPhjK4qaS823cPTb4zJYucSHrircXFxwPkZy3cGQvlWTwuNcdTAwMTXdbFx1MDAxZcZcdTAwMDF/uNGt61xuR7zOQu98XHUwMDFjJFx1MDAxNnqrk2JcdTAwMDVcdTAwMTNmcF6VkzQt/J4x77b9vZJTXHUwMDA2KSurnPSXcIbrz51Glbdccox5aZQ6p+2tXHUwMDFkXHUwMDBiXHUwMDFm3JOsx19oclQjx0NsXGJwPkv/mk0wPXnWu1x1MDAxMWC+wEq6TFrFz0PRxVx1MDAxY+jj42B12y2RXHUwMDA01lx1MDAxYuu2T1FcdTAwMWU/MaQ7zDw/yVx1MDAxZeDr+51cdTAwMGY2sfoyRyHSaLMlXHUwMDBmz1x1MDAwMjx501xmPOAlfkdcbn59XHUwMDBmhbul8Scn3ppMpZ35bsBugvJcdTAwMDBNrcluJsFcdTAwMDDdPFx1MDAxOZviXHUwMDBi0HAl9kD9PjZM4uKiVX7n5Fx1MDAxMzlGXd+8XGZtLXyxMbfIQ8xcdTAwMTmscFxu7opOXqlB1XHlKVx1MDAxYc+PXHUwMDAwXZ2V/slrbNry33zwIPRxgjpcdTAwMWKSkFc0TJHyZddrYFx1MDAwZeC1S9eDsLr/8d+iOjbje1x1MDAwNZ31/MjxatBk4etcdTAwMDTSUSSJW/Rcbl7DXHUwMDE0XHUwMDFlamqzXGZM3cf7LO1fulwiYHwzMVxc8VrP1URzXHUwMDBiRaeKXGLqbEY+hPM4zqVt+LNZyv+jLd5cdTAwMDFcdTAwMTVmb+tcdTAwMWL7OIWVXHUwMDAz6MUzjDV0nyhcdTAwMDVcdTAwMDOHjVx1MDAwM/F7W25cclx1MDAwYnpvzouG982m6uPxu1x1MDAwN5r5oKXa7a9cdTAwMTXHXHUwMDE0XHUwMDA2xIDTv49gXHUwMDFl+dRcXNt4giBYOSxoiFx1MDAwNKNTMv+h71ZHe2HF37unWkFnXHUwMDAxTFx1MDAwZiMxXHUwMDA1qduCyGJHjZ1cdTAwMWaP78zHVFx1MDAxZDDhd5+4YbVvcS6GvcCvXHUwMDEwLWJcdTAwMGKLVVxcxlx1MDAxYayhQboj+avE63lcdTAwMDYxklx1MDAwMqI+uipYY7/10LF4Wlx1MDAxYTWNmFx1MDAxNbE+91A+XHUwMDA0T3E3XHUwMDFl+GS1fyqB2az+PDnvbfGytPFi68lcdTAwMGaRYbFBeidfgVxcXHUwMDFkZ1x1MDAxMlx1MDAwMfiUkVx1MDAxM1x07ujY6fj2cZJcdTAwMTHJkbzPL5LOt6Dd4NVccotgi+ek367Qb95YwUVfpjxcdTAwMDXCbVx1MDAwZj+Lrlx1MDAxNG08vYrvPlx1MDAxZqXCzqDKcirdXHUwMDFkVdhcdTAwMDQj8aKmZCzW+0efXHUwMDFltTaW/vs8j9xKif0lzye9Zq8oVWxkLbPaXHUwMDAwXHUwMDFico/OXHUwMDExKKv/6VWhoIrPi/lvXHUwMDE2YzmEXHUwMDFmVY39PaVcdTAwMTZVhMBcdTAwMTfuXHUwMDFiiVx00+uHYFLH3kfhYuCEe8WS9/t+XHUwMDA2nttZTVx1MDAxMVx1MDAxZq956ZWOoJTvdUhdNULTzSa7dcWEYJeLUVxi+jis3LFcYkDIrVZfIIRPxSlF0n5MXHUwMDE1lmxllVu/7m5XnN3wXcNpg1x1MDAwNlCOJDExIITxXHUwMDE2UZ/uXHUwMDExXHUwMDA12MxcdFxcszQoWG9YXHUwMDEw3DtcdTAwMDDg07TbptjmUzHrZaj/qyUpXHUwMDBiSlx1MDAxYtRP9a5UnYLfaDGjINYzmea/hVx1MDAwYqJe3u9agDKUPEhYZ/YhT75cdTAwMTh207NF8ZvEinWazVx1MDAxMflqSqLNbdptalxykZ6IwmtnvGrbsJW1IFx1MDAxZFZVXG7kg2FcdTAwMDWmo470/LkzVml5pnxzymnQXHUwMDFkX4BA0WFk7JrX5fmPazR6MElzPag3sVx1MDAxMn/zlSdTf7FB7JP+YpBcdTAwMDShUkCStlAk3OXDmirkLYmbT1ViXGbCa8RM+15ORb+aaWPhhzeaXG5KhrQ908Pr4Ydkvlx0XHUwMDE5l5kwsPYmztBxbugxwoRLquBcdTAwMDBcdNOqNeVcdTAwMWVULVx1MDAwNI58OzB8XHUwMDE0yLxNXHUwMDAwxSXWoo9cdTAwMGZVcsvxP1x1MDAxYZMxmfezLLuJxGJcdTAwMWHcprk7XHUwMDFiaK/J4SdO+lx1MDAwMFx1MDAxY0r4XbP8lMKUXHUwMDBmeeDWXHUwMDFiMFx1MDAwMsCpiWbRWlx1MDAwNOvrvJY53k3kYZ5b8Zp93Xq9LFx1MDAwYlGc8Odb+Fx1MDAwZrP7SsHo41tupeBHI1xiOWsxqknt501cdTAwMTDWXHJcXIXNvXkk5Vx1MDAxMd6X+G3tKb7RV/WL9+E/OVBcdTAwMDI1t1x1MDAxZL3qiyBcdNxcXE84o6xbwqvQPJKodtNcdTAwMDedqdjH69CQn/38L76Idlwi4v1weptphitmslx1MDAxNezoKjOCXjXXLvVcdTAwMDRmn6rquVCcwrhawvzqJedYmNm+24h+S216e0OeZjbsXHUwMDFkXHUwMDE5te1cdTAwMGIhbritNGBcdTAwMTTBXHTIXHUwMDFlLMc9b8HgXHUwMDBiMG9ccj+0sKM+4H/nSJV5nTV3389cdTAwMDM0JGUwz7ZcdTAwMTDdNnfPXHUwMDE1LLHMgKxHdeVcdTAwMTlcdTAwMTnRyjjwf/GJ9898XHUwMDE0KE9Tc1x1MDAwN9RAR3LKmafjPXbBp3S2dtWv0lxupPV/31x1MDAwZvzz+2+uyJdpWW6gmGVcdTAwMDCepFx1MDAxYo6Y8Fx1MDAxNerfelTpXHUwMDFkXHUwMDA17KT8qrWdWNMl+Vx1MDAwMtqfpvtcYkjAfZKmSCtshbhcdTAwMGY5XHUwMDEyj+p7bVx1MDAxNjuvoFFZ30fjy//ft1vlmzJcdTAwMTDKJFx1MDAwZfyIXHUwMDEwN0NGXG5LXCJwPr98nzWu5eF4v2JoUP2dXHUwMDAzh/PRi1x1MDAwMMG3fS850k9x1Pq5/Ka1XHUwMDE0XHKKLlx1MDAxZEdxg0mc5yRBvzr6ZnLuf36PS66G/I9Xv0v7Zki9vO0+mKN7vCy72DtYjTlFnG9cdTAwMDPHhI7DjjHy6y5H6zGIRvnoPlxyOIuC3lx1MDAwMmfus+VcdNaGxEtcYkK8X1ilwq9Fklx1MDAxMlYusVxcwG/pKjGsbPOC52HnVMPc6+tcdTAwMDeRzlx1MDAwNTz79TMjr30zpeUwXHUwMDE5XHUwMDEwXGIqgZBcdTAwMThaYfrt4a5PNFx1MDAwNpat39u/lvHve1Pe71x1MDAxMDKEXHUwMDBikLl4SWkg1XYqLyjig8vawMy7e+uTW0LZatiTXHUwMDEy5jJyXHUwMDA33Vx1MDAwZse514/uqu+HZ9F/+Vx1MDAwMZ47y52a9Vx1MDAxZMDHtVfn44Th5V5+XHItXHUwMDFm1utXXHUwMDFl3fuJrdGlzJOySs9ccnStg2k2ZP5s1VY5b/rfvtM3OVfqO1x1MDAxMKXhfu5cdTAwMDJ9/v+e61xmfetsS7/a1G6a7TXQXHUwMDFkJ6H8w5G0XzGZ2i85rVx1MDAwNvdBXHUwMDE0b/a5g1x1MDAwMK7hW6A2PX/NI8CzXGYwXCKT59BEdFx1MDAxYtvHiTZtXHUwMDFhVqv7co5cdTAwMWJnwJb/wVx1MDAxOUdRXHUwMDE4anScd6LWVERcdTAwMTW+u9M4n/GyevVcdTAwMDSN+X71fqdcdTAwMDE7ar9y4KctSf6FmVxiWJBPwDL75uyLrHf21Idpe3FBK1x1MDAxNlx1MDAxOIxcdTAwMDduMJVKXHUwMDBmnnRi2KyO/zG1++Fi8F9Njs0sg4snjS6eOFx1MDAxMa18hKCnyzwmu4Tq5lcuW1p57jukjoipbFx1MDAxNezPXHRET2PrXHUwMDAyMpBcYtc/lcg2c+VcdTAwMThz2ZJ+sLX9f7H1NrL1PlxuQ/1cdTAwMTNcdTAwMDO2XUvq99pJm/ZcdTAwMDRoXFxmXHUwMDFlwZaA1IL6XHUwMDE2Ulx1MDAwNVx1MDAxNpddr+dcdTAwMWL+VXsr8+JcdTAwMDNcdTAwMGVcdTAwMDcu2l9kprjVm6pOsNj7XHUwMDAwW+uc0CDOsDnJdn5w7Vx1MDAxNCdzkqr/iKw+tvdS/+RcdTAwMTdcdTAwMWPleLzbeFZmsWl9XFyfXHUwMDEzcDZUy7XqW28/XHUwMDA37Nc8VOnnTj5y4F36Q1x1MDAwMOYussOzXHUwMDE3xk5cIlx1MDAxM3WzJ07QrE5rKo3pUJeb1LdcXP3IXdnEbfj901OxWVxuy8qJXHUwMDBmb1x1MDAxY01cdTAwMTWiv1x1MDAwMZ+RO5J3XVx1MDAwMq9HT0fLTWA3S1fPX9rk63s08ZNcdTAwMDOFU5OXQ9HZk57mtjJTtU8rZFx1MDAxYdV0tspqgd5BQ9SS9yO0XHUwMDFmcVTg9n9cdTAwMWGzhqxaz3LVXHLAXHUwMDFk1NUr043+pFx1MDAxY7MriVx1MDAxYmdcZlp5OPmvfsTzjTMq+rBcdTAwMTFkf9swXGKOXHUwMDA3XHKGulx0LeR1c8xK81x1MDAxZFYh3PTmXHUwMDBlXHKvsj/wjVx1MDAwZvC/MFSRhbLkXCJcdTAwMGI5iFx1MDAxMVx1MDAwN8F9bldcdTAwMTRsQINMUpXhjPW2JeCXLXFlUqYkKnTTRVx1MDAwMHFGe61cdTAwMGJgSG2yYlwih5+tO1x1MDAwNeVcdTAwMDVp9X9rXHUwMDFk/3OtT0tWXG5RXHUwMDE04vCNgsCrj1xiXHUwMDA0lM6tfF/na2Wh/5t7XHUwMDE1klx1MDAwYilbktlTb7ckXHKc+4SARlx1MDAxONzkxSfjdaeAulx1MDAwNaVkPlx1MDAxY1jhb9jU5WRcdTAwMDCG/zmqXHUwMDFiJkPA+4lrydI6aC6qalRcdTAwMWUk+1x1MDAxYt40M1x1MDAxNuFcdTAwMTGotmxcIjj86V3IR5d/x/+ewcRhO01jXHUwMDE5yPg+TVx1MDAwNt2eXHUwMDE57cKoh6r+P5R9x5ajTFx1MDAxM+VcdTAwMDOxwLslVngjIdxcdTAwMGUrgVx1MDAxMN4//YCquqerp/9z5lv1plx1MDAxYVJkRsS9XHUwMDExN1wi4WxBs3jZIUJ1XHUwMDAwkFx1MDAxNbmA1fn/8e6p4VerVqVcdOortE6pJU9cdTAwMTXreruVI1x1MDAxMpfPkm9cdTAwMTloJn/aMFx1MDAxM5iytFx1MDAwNIG+pdNuk1I+z5rF01x1MDAxOOb1lO4jiFRRXHUwMDE0Z9xcdTAwMDIvNe/H7+aUwlx1MDAxNVx1MDAxMWF5fG/xQaY+tmHKoivilEqbm9yWwFx1MDAxNrzKcqKT8vh9dV6wra3/3XMg25xIgUNcdTAwMDdcXI5oV0tcdTAwMTlYXHUwMDEzXHUwMDEw4WqL6WxrbGE3+/BVN+7+8VVRUF3Tpy5/lblm01x1MDAxYb5i/MYmSp1cdTAwMDP2cdAvXHUwMDA39qIgp4p14O7M7DmbIN+O9/51j6JyjWRrwfAsnzLP0eVcdTAwMWGUXHUwMDEwr2ezfWpLXHUwMDExkmvYXHUwMDEz7ip57zOXUo8/zWJS9EV07pskuzylamraW1vr7yc/ISmO12NujtT7ILXZXHUwMDBiqOOenvV8XHUwMDE3UeA4Pm9ijslcdTAwMWX35j5ZbKtNrpvPvvb8XHSsvpbGKCxTdPaKvnpwXHUwMDAybpvz3U2ILaPBuM9FP4Cpc1x1MDAxZVj8iJTnX3jq3t85jJqrvd2JzU/hS43X8X1cdTAwMDShzFx1MDAxYpcqXHUwMDAy7oRJ71x1MDAwN+4sXHUwMDFl4cPBXHUwMDBlpiljp2WQK5tI7ddcdTAwMWRcIrJ9l6WtI1BcdTAwMDKIKTyhX1x1MDAxNUuf/U/QxYZk5+/ZuC+Zz/xBj9MkXHUwMDFh+o1MXHUwMDEydZTmKFwi9tvNoe52O46wfET9d0e8VoVcblZcdTAwMTdKmLNcdTAwMGa9nyZcdTAwMDMtPr76yoq3Ry+IXGKFj/Pc79hQiySBXCJcdTAwMGYkkMviOVb/j1x1MDAxZYDZcmNv+7VMu4NcdTAwMDNcIu1cYlBB41ThQ62uPL28XHUwMDE4k2Wuqmw6R7xxmk9NkImbxeSgXHUwMDBm338xiqpp4raRuyiBOIFNwVx1MDAxNmK4xfCIvVBcdTAwMTf8L1x1MDAxYmjyRaLrl1x1MDAwNHJYlOmewVx1MDAxMViU16tcdTAwMDDBbqgpz1x1MDAwMVxi1Zh6Q5RcdTAwMDZtkJ0gcpKg989ZJGJcdTAwMTIg2POdvH2Ei1x1MDAxYu5OmUEoK1x1MDAxMi39PPZcdTAwMTChXFzB4137/W9cdTAwMWTi5bCeXHUwMDE2nUXaedzy1IqtWVx1MDAxZvusr+rWl8SsvjVcdTAwMDdNU4ZNkFx1MDAxZrhcdTAwMWVcdTAwMTC4+ThcdMZjm4Tn19xlkSVcdTAwMWVcdOs8XHUwMDFj+FaNOFxuXHUwMDA0leHAK64tXCJEXHUwMDA0XHUwMDE5o/81N+PF2Kzk8D0tXHUwMDE0uELD6Fx1MDAxMV5bkYiaqm4q51x1MDAxNYJcdTAwMDWYXFxv15It3s9yl6t1N1x1MDAwZZdyLNGlrtWNSz5cdTAwMThcdTAwMWO279xcdTAwMGVcdTAwMWKuTO/EXG5cdTAwMWPQYNqyXCJKd4x63O2/c/rpXZRYaVWgLcD4haBcdTAwMDYmhq8xmFx1MDAwNmHXXHUwMDE3yGVcdTAwMDdERGJcdTAwMTe5kivmz/dV1Fu0S/3X/VxmzSwqkzKnXG5cdTAwMTnouZP3SZIuVNVcdTAwMTY5tP2cP3zeOVx1MDAwM5RcYneOuFxc9X2Lc7BcdTAwMDZcdTAwMWZHMMdcYi9Xhnl8TzvV1/qVwIr3euCJ57qn9seHuZlb36JzT1x1MDAwNO6uYVx1MDAwMtbHPntbplx1MDAxOZhcdTAwMDOUU7lQ+Lu/9Ni5XHUwMDBmqZq0hqOjg9a/XHUwMDAzL4A1q6ztpIBzL45cdTAwMDHrkXDh7fHjrIR+eYW4jyjrITJcdTAwMDdcdTAwMGWQL2lEVcBo3qJcdTAwMDeYVFx1MDAwZlx1MDAwZVx1MDAxM80s/VuvSrGJtmSJxe/09krSvDxYQzDWNqri+kFNr3E8c0CT71JcdTAwMGYp8UUyXG5JMuBcdTAwMGaPYF1cIkiV8dxcdTAwMTdbqFx1MDAxZlx1MDAwNZBcdTAwMTj8XHUwMDFhprORZ6jw2OTr33rsk6clWT5HXuxSND1LSTHcXHUwMDBmcjevV/0mso20ic2f57Hc5lx1MDAxYW+kM/9lcFx1MDAxNjP06OPNXHUwMDA1XHUwMDEzeK1cdTAwMTVcdTAwMTRxTl1qXHUwMDFkvaK/dFx1MDAxY1x1MDAwMmdcdTAwMTY2cp2pMnmTuFx1MDAxNVD0+1x1MDAwMs7vXGKaOPKZLPKlLMLuh+8yXHUwMDAz4lx1MDAxM9+41ltEJYPM8/JKXHUwMDEwXHUwMDEwXHUwMDE36tlcdTAwMWJPxdaTXHUwMDFm2EGtYEaD4uuxRTRNcztduaTEz1pcdTAwMGZPxCt+TjKnIG1m2SBhy6uyXHUwMDA0K7ykn7qSqE6K0SnnXHUwMDFlr1x1MDAxY/5QXHUwMDFksEmUnUhBnOaL6Vx1MDAxMdBZZf+tlSguXHUwMDBmXHUwMDFiiFx1MDAxOTOLOpn2a5qk+kiFY2ddPatIXHUwMDBi/PJ8XHUwMDE52CVcdTAwMTBcdTAwMDAz6Dbz09eSvD7Ys3NcdTAwMDfuJpvFQmaBJY64wIjIOmCc+UNcdTAwMGYk3pqHhFmNbtQ5boX5XrVcdTAwMDeugd9IN2xByW9TotY2pZBorFx1MDAxN76kw9dPXHUwMDBlr1x1MDAwNlx1MDAxObVcdTAwMDS+7sKej8OsuFx1MDAwNrG919zbOY8hS6jsIfunv728OD+T9mufg3Qku+RcdTAwMDZkXbVq7kGkXG5RXHUwMDE5JvxcdTAwMDJB0Y0mXHUwMDE5Kc1trHmA10RcdTAwMDSgbqb73p3f23PvfdrSs1x1MDAxZKKY3fM+XFzcVbeDNjD0hpB4a1x1MDAwNS4zXHUwMDE1x1pdSPp5vjnWutE5/rj0fl7WXHUwMDA00Vx1MDAxZnGE9NdFuVx1MDAxZVuXp5jvXHUwMDFhz9dNoFH+rvmqglx1MDAxY/7+4Jun1lx1MDAxOa+QT+Cwrze1Y++BWI23dc5xIdjbm6GPf/lcXOJgd+ScXGZcdTAwMDGVvp8ruVx1MDAxN0ht7Fx1MDAwMeRoVzH3wlx1MDAxMOA4QWJcdTAwMWUvr+Bfa9m/iE8tg7nmPm+nn/+vTsy9XHUwMDExXHUwMDAz8jZu4OF/yGKo+iPW/dD2XHUwMDFlXHUwMDBlONXLYaPL1V6SNKNgOr5D41x1MDAxNeubcdE9XHUwMDBmIe40WV6n18FcdTAwMTRv+UV3U+ncMMl7RfflM1x1MDAwZkbuXHUwMDAyRr3yfUdcclx1MDAwN79cdTAwMTV1YpH+6pWVpWJZXHUwMDAyXHUwMDFlSFTggtysOm+ZKzQ7y01h/eM4PVx1MDAxNowjXHUwMDBl7vNnbEzFtabPXHUwMDE5kCzftFx1MDAwMX9jYse3XHUwMDE5Pr3tdHbem/ZnLe9tT5g8aUpcdTAwMGVAXHUwMDAw0lZcdTAwMGJ438A5v/fywVx1MDAwYjday3GIeSin6fxcdTAwMTHrX4/JiD+xXqVcdTAwMDWYKVx1MDAwMKeZr1x1MDAwYp+aO5497Z/PN+25XHUwMDExXHUwMDEzXHUwMDEyj1x1MDAxM4CMwlx1MDAxNFxy4zG8T55+d8lMpMb3XHUwMDBlpJtU+lx1MDAxMfyY2DdrlW91KE/eRlx1MDAwZd5cdTAwMGIv7p9nZFx1MDAwZlx1MDAwN+KmJ+FcdTAwMWY8qUVSmbBfP/NcdTAwMGVV80AtXHUwMDAzp7YpR7ypXHUwMDFkaGkop+jiJKpcdTAwMGKpK1x1MDAxNVx1MDAxZY7pXvDv1Sg++SY3sLd7XHUwMDEyVIXIWy1FwL9zwN1IIXkljlxiiFx1MDAwMJa16FFCXHUwMDFm7jWHIYOcxj6BKIro4JknqCNKLXFyK3apSkWS3CaPgPr5cXBcXFx1MDAwNlx1MDAxMsJvf1Ey8bHsXHUwMDExO+tkpWE35V/1TI+ZLshcdTAwMDVcdTAwMWbNLIuW1lG2aVx1MDAwNCNTVFx1MDAxMnjNzqJtXHUwMDAyXHUwMDBmxlx1MDAwNUObWeAugVx1MDAxMdVJpzVcdTAwMWZa61x1MDAwMj1cdTAwMWFcdTAwMWVcdTAwMDc9dmRSXHKG03+8nMOPmHVVXpvhJ7dcdTAwMTJcdTAwMGL+IeJBME3uTulzPm+YUmclXHUwMDAwu+Rrg6dcdTAwMDNxVrSV4Idza794u1P/k7erV+O8lzG+XHUwMDE5av7T1jpX5fc7XHUwMDA2d5T1tlx1MDAxY69Jx8PDQWP4KkLjKlx1MDAxZthGdJpa7cpYuCtcdTAwMGZhQf7JWaFz9pSCIEJ0XHUwMDA3f+zt8940ulXrjNdb9TyF8ftZkzCHh1xyP1xcUTqP47ijXHUwMDE45e5XaflkuDfBXHUwMDA07jU7qOKnfqaAqj58MFx1MDAxMVx1MDAxZpz3Q0HlraR/4Fx1MDAxN/WxPHL2+di0wnwnYNbqIMmb9c2dXHUwMDFjochKXHUwMDFkqTl86WJe8WP0JN3M27z79yv3/E7e8aD6yce9X87JrVx1MDAxMay8SYv9U8s48qT5SDdcYkJ4UqaQeVx1MDAxZoIpea3QXHUwMDE4v1xuwOrIVVx1MDAwN1xcmlx1MDAxNVx1MDAxYfXYuzfjKOq/8lx1MDAxN85NeVx1MDAxZPwqXHUwMDBlrq3zU88h3s6mwj1cdTAwMDOyLbxsWDBnXHUwMDAzz4dcdTAwMDCV43yV4Vx1MDAwN2+IM+xcdTAwMDJlom6wXHUwMDA2q10/5J3Vu3/mXkfmdfjpdLyaL+vn3eN3eeK0XCL2+0RzXHUwMDA3KK/recU7P9eK3Vx1MDAxNX1Sflx1MDAwNn29jVx1MDAwZsqsXG5nkT+/w/yPv0O9JrK74zOtXHUwMDFh/brfdDPnlXJsxWBzYzJcdTAwMThvwDwkZ4z8nFPBufyyXHUwMDA3LmJccvxJf1x1MDAxZf+IbeVAXHUwMDFkXHUwMDA3SXJa/s+cmcCpn14gzLTquHXis61cdTAwMTLsYSMyXHUwMDA3x1xindtUz8nGnu06n7VL0X9du2Pzq3NX8Y0mOnNGXG5cdTAwMTD0l9yin5PX32hTebLXbFx1MDAxY1xm/mF3PnfmqZZcIlx1MDAxNP/Jc6NTg1xi7VFBM8mPXHUwMDE5XHUwMDFkoS1cdTAwMTO5XHUwMDExg8yUNVx1MDAxMYbfkVx1MDAwM8z4NGvrsJOUXCKlt67l+XHH21x1MDAxN0r45DnHe/SfbEEozlx1MDAxOUFYLIJHVHl1XHUwMDAz4Fx1MDAxOepIJ1pcdTAwMWNqgLJcdTAwMTV2XHUwMDE09In9/OSwnbfxz1x1MDAxYzbysOXG0JFmtqVcdTAwMWaYg7tz2XswpDtPevROXCLtzbLwWGtjOKtcZlx1MDAxY7FJaby++sv7QlxuyvMrv1T9M7+ktMLGMc44ydCT+lH/XHUwMDEwmbKh+NpcdTAwMDavT3xP6bmP6DTTOqx6ajF0f/nZTtSBzLf2uHCnL3rB+n/9PtiZx5BKMJP8utH83NdgXHUwMDFhmi9cdTAwMWU5P1x1MDAxNe2Tx1hcdTAwMDQhe95kgVHjja1cXJH45Uhrqtk++lx1MDAwYts4e7y1w5Fa8I95+DeNY/i2pvk8Ofag7JswoSGjW0Bx8sJ8VuV6NSmlvNGKLF+ZgnXS9vnP/IxxzjXnXHUwMDFko9Mg9s9eaI57ftWnLmSO5CV4ufi7vrtcdTAwMWFN+7E++G6J1Sn/bNP3S/ycn8f/yM9foHNuUHuBpZ/3UCosc87qXHUwMDFjgFx1MDAxNVx1MDAwM5R4el1cdTAwMTNcbit9N7+7g7rRRXjVXHUwMDAyXHUwMDEx7/Sz/PBZv9tW/2397JMp29c+TFiM4ftcXKOho1x1MDAwMXjabDJuz3FcXFxch8ulnpaDsp1n9PJ+/rczejhcdTAwMGUsOTZcdTAwMDDfY3rWJTLnXHUwMDE4qjZz0Vx1MDAxNU9M/GCiW4tcdTAwMWa+9nQ/UdRe0+vh27+MV7eOMHn6geicPS2QcWHI+Vx1MDAwZo5cdTAwMWPY8nlveDVmXHUwMDAwqCDilFx1MDAxY3i3nvdEXHUwMDEzXHUwMDAzINzsITLD8JZ8Pds3XHUwMDFl97LkJn9wbSu1Y+zqbFFujlx1MDAwMeanoZv37maxI6r2okpcdTAwMDFgSpojXHUwMDEwXHUwMDFk4Vx1MDAwZvIrPab12aN5i4Y6vCtAWlJjIXGhyELhZIBcdTAwMDFcdTAwMTTxWmttuS9cdTAwMWSQbS6c2bBcdTAwMTOle+rsyd31776RXHUwMDEwXHUwMDEzaFxyQflcdTAwMTagy4gk0Fx1MDAwMPBwTM1VXHUwMDAyTMV0dpOAXHUwMDA2hFx1MDAwZo5+XHUwMDA0XHUwMDFjdFXCXHUwMDA31ClcdTAwMDHjyVx1MDAwMYO8eeb+rf1cdTAwMGK6hTmOiy78xLWXXHUwMDFi59tcdTAwMTMo8nxbrqDbmvnsSlx1MDAxYunKxzH3n1x09b48rmZ14prpPeqeLVx1MDAxOdxUQn7GQ9yxvleBXHUwMDFmrlx1MDAwMIWEyKF/5sxeV4hcdTAwMTH3SVxyXHUwMDE3ivNcdTAwMGY88oa7XHUwMDAy8D95gc7go0Srn8xS7LfV/+j9ppJLn/CwuJdcdN7K8dTFXHUwMDE1z+Ccfd5gUb7/eHZ3v6pybFx1MDAwNaRcdTAwMTlcdTAwMTZcYoFcdTAwMWJcdTAwMTn9cnCFyjZcdTAwMGWJ0DxeNVx1MDAxYtIyYTiCwW9tidl6vtHCXHUwMDFjI4vQqd1vXHUwMDExPSHs+1x1MDAwZoyM2J3Ar9Odj5NcdTAwMTRvV1xmgVx1MDAxMcBD3bvsL6a7k7umRJvkXHUwMDA0UVUs7C9NfChcIvvIXHUwMDA2J09Wzzl0TVx1MDAxM8V78WdcdTAwMWWouLtcdTAwMDWbXHUwMDAwzjpcdTAwMDDNXHUwMDEwXHUwMDFiXHUwMDEy8Fxiu47KMFx1MDAxZZPCI5pWc1x1MDAxNNZcZsJcdTAwMWHy9OlVP4lkXHUwMDFl9bWFPVx1MDAwZvfEnf1Swr5ixo/cOXfOQ9vkVsvDoU/6MK1GXHUwMDFjdlCQV5w2XHUwMDFjM6rbOFx1MDAwNdSy9Np40OfOklx1MDAwZsxcdTAwMTPQfoXey4m1hLMv8PZ8VsCPWfesXHUwMDFkNOKCYKhVS+Q5LSAm9clik7E/wv+Q3liVinlWeFBCS1xm9986TaHDkelVn/j3fvxms7nw1/ZnbWGrXlx1MDAwZl75VVx1MDAxM1x1MDAxZoCRmksg76s3PIe9mt2DXHUwMDAzXHUwMDE2m1x1MDAwMVx1MDAxNcX3XHT7rTnV5TloO+uMNeLBc5zZaqAy+Vx1MDAxMWuExyRgubVIIDg0SmykaC3HcLfO/TP0ceeGXHUwMDAy6XmPIXDGqs9qTVx1MDAwMt2wSf3CKGdfN4+6Ie//7Fx1MDAwN2JcdTAwMWVVUzak41Mk81x1MDAwMlx1MDAwMVx1MDAxOFx1MDAwNzpUQjssruBQO4g5dHktJvv6zOr+ODVcdTAwMWZcdTAwMTe1UmE+s1x1MDAxYedcdTAwMTM3ZIR1if7mwqxmY/GBMc1IgiByXHUwMDFiZ7Lro7bN7lHicEzRS+u7KVhbeFxiv1x1MDAwNFE3/9Iln5lwZmGcQ2Fj+orxf2mfmjvrXHUwMDAzlyVPaKOKpjVzifJcdTAwMTLeXHUwMDE0023ezd7S7MlcdTAwMDXBXHUwMDFi/v1Z+ZTEk1D5zIm5XHUwMDEy6vEv6lx1MDAwZbjfJH/dZaM984HagkDdkZSsXHUwMDFka3xcdTAwMDXprFTv1t/OzrguQjHg239cXH/3wlxmyWRcYp9cdTAwMGaoXHUwMDFlXHUwMDAwLb61XHUwMDE38/6TXHUwMDA3MU/fKobUasBcdTAwMDQ8YFx1MDAwN21cdTAwMGageY+6XHUwMDAz61xi0CDsKlx1MDAwZYQyU9x9mfk2sf5VrVD98YnqeecvK1WRnPw1k/B53iWQXHUwMDFkoEghKL/kwbWJwuq2XHUwMDAwiJ8k2ipp61x1MDAxObRcdTAwMWVX+fElqmOyTp0s6pOv1XrxeIZfJFf2+vd+2fJcdTAwMDIkT1xmXHUwMDAzwV7Kl4tvbCpcdTAwMWVcdTAwMGZqRPZcdTAwMTTJssrxNGaDv78rQ0Ni8sQ/uVx0x1PP+ziy61+5Pu529nC6XHUwMDAwtCf+bVx1MDAwMTGwxs2xT5+OtFx1MDAwN6OsjGqvXHUwMDA2x9eaoeaXL0BcdTAwMDPKv4j3XHUwMDBmZ83PmGZcdTAwMTKxRNA/5lx1MDAwMndHXGbXpd0kLYSvXHUwMDAzi3bweTS2JdZcdTAwMDKyL+wyjitHoFxmS6Geya/fP4HAdFx1MDAxN1x1MDAwZj9l6/fzm/qkwTvJj7ggwlx1MDAxY/CQuKlfXHUwMDEw35JAlFx1MDAwMzGddaRl7ypcdTAwMTS/SHxiXHUwMDBiOXq8XHUwMDFlO92R9ttcdTAwMTdoKiZeXp/7WyFFP2fa7sxf+lx1MDAxOOPws6fMyYrpxZ7nWVx1MDAxY7fyMa7L4O1IfolcdTAwMGbIwFwizOO72+7iol4qPz55XHUwMDFl0TxcXEGH/9RU8ky73FxitySsKZdmXHUwMDA1XHUwMDA1sMx8jXU7W2p7cu3FZfXW+a0xLLfZcbtPT1x1MDAxMmFRQFx1MDAwMdhxblxiKPK5cO2nXHUwMDBmwGJkRSuS91x1MDAwMUB1N2KIkIm8XHUwMDE2S1x1MDAxYZdvtrhoMe9cdTAwMDUy8763gqQzkm/ATd06gVxyzIWrWtrb2KZcdTAwMGUjXFx0vqpcdTAwMTWN5KM0vpGBuGL0qLGxXHUwMDA30pZzIFx1MDAwZq/fPdihQFx1MDAxZfaBdyVcdTAwMTamSlhcdTAwMTK5ZVx1MDAxZVx1MDAwMYZU36vJvNvqXHUwMDE3Jn2d9yGpLP7XTCzlIVx1MDAxMzJcdTAwMWKSXHUwMDAwNSxcdTAwMDRJgbFrkFx1MDAxOeTfTEZcZsZcdTAwMTdRXeLrs3m9wqvQdFx1MDAwMatgz+5cdTAwMTk4on9djq/Lwk/4TOZ99Fx1MDAwZud9S1dixaPsx/PZh1wi6lpNZVbazaLvXGZzlVx1MDAxNJlC1chcdTAwMWFrkGUwyVe/t74pSbK7h189/Vx1MDAwMIzfrfKrxot5x1x1MDAxZU0xXCJ111x1MDAxZvc4XHUwMDE1jG1cdTAwMTWLfX3DXHUwMDBiVKKAOE902VHy5i+cQjm6xEBCcOF+PFcyq2+t8WesOpRcdTAwMThcdTAwMTb+s2avXHUwMDAyOyRRk59cdTAwMWFoXHUwMDA0ZPld94lcdTAwMTevJM8j0L4m81xmUOztR37rXHUwMDFjq3Llh1x1MDAwZufOn8JhX5jvXHUwMDE27Vx1MDAwZo34TY5cdTAwMGU+8KbLK4nT4cOVXHUwMDEwjDLhpzfgVmDPRVJql7Kyn5CA/ZGnfz8md/n0aFx1MDAxNWdcZlfRXHUwMDFlI5zlz7yTwjxf182jcDq7pNE4oPU43+GecENcdTAwMTHOK42vk823uLnL7vKfuWzWJORcdTAwMDNcYp+/W1x1MDAxNrEz1mDo5SU+ftiuwFx1MDAwNVfSetNcdTAwMDTZXHUwMDE5pMZcdTAwMTJcdTAwMDRy3d17nylcdTAwMTPfUm7jWMW1vVxcmpFpIf6PXHUwMDFjNrv3X31ernbERz+VeFx1MDAwN/gjzy+LqshcdTAwMTQo6pYzab4kYzlcIm9qzPHz2YaOXG6cMVxcSTBcdTAwMTFol+hHLUEgjfZcdTAwMWVKXzUqTD5j7rVB/Z/2drVcdTAwMTdFOyf00HKU0Kmw989qTnu4iXxJTJV739aocMbXgvVcdTAwMTSzvJjTZ1x1MDAwM/lurdbA+Jwt8+BcdTAwMDQyZ9q4QPyobept0vDGw6282vLZbsXCXHUwMDE4JcKIKOBVf1x0a8WROz7q1ImRp7++XHUwMDA3+zWL+X9+XHUwMDBmweCfXHT+XHUwMDA0XHUwMDEwNdXn3Vx0Mn1zobGxXHUwMDBi1UCxx9O/SidcdTAwMGbh/1pzf6z5kX6eY53SVT5cdTAwMTV3OCuWXHUwMDFmecn3wVx1MDAxMXn27Vx1MDAwZshB2lx1MDAwMPiNsspcYlx1MDAxMt617Vxcv1xipft7j4M4dHDMYFx1MDAwMJZg/sxccjNpfsOdL11i8TxxXHUwMDAz98hcXO3H/aHPholcdTAwMTHCTJ9cdTAwMTDWOuyNjEOSJFx1MDAxZeg8TdlcdTAwMDVcdTAwMDFcdTAwMTCZXHUwMDA0rEnYk+XGukwt1Gwp+Vx1MDAwN1x1MDAwNj37XrpcdTAwMDJDzUY/sW1w3jn4xtqr9KeP51x1MDAxOPacuTnr/lUkVn+mXHUwMDEx4YmP3Vx1MDAxMcdcdTAwMWblXFyqw+ypXHUwMDExc85VK9JcdTAwMWb2rebT6+BcdTAwMDZcdTAwMWbnK3/wg1wivv/CXHUwMDBmXHUwMDA19zDQXHUwMDFjgdtxXHUwMDAxn+GIkVx1MDAxODmS8HtzSmXSXGL5mlx1MDAxN8lDv5RH3IOcM9fMl2/i0zvOklx1MDAwNkHjXHUwMDFm3bjC3E78WzHLXHUwMDBi/VGT5u0vXt6U+1xivVx1MDAxMdMlSyD1NVx1MDAwYrmFvFxuXHUwMDE0LFx1MDAwM+g7dfhi90f9tFx1MDAwNfutQfVPLJo+nDapVp36a92f3KCZW/NQXHUwMDA35izxaNzD1Oa1m65sXHUwMDFhXHUwMDAxrMvJ27u/7Obwo3n9pVO+n/m0+YZcdTAwMTX5T6x6ZWyVXuhcdTAwMTGeXHUwMDFkXHUwMDFla1x1MDAxMNNcZry7xEOtVISyVlx1MDAxNNNDMFx1MDAxNOp99iygy7VwmrXsm484gYhBM3a/+kBcdTAwMTTxzOXMXHUwMDBmXHUwMDA2qpc/+0s3NlqLzVxcSJTsXHUwMDFmXHUwMDE5dcFkXHUwMDAwv5XJdClcYlx1MDAwYj1idVxcJl12mW/A8Pj57KHDpaw5c+LFcObq9vAnXHUwMDE2uqnF4VNBeEZ47Fx1MDAwZY3WQfE0k0zlXGJcdTAwMWEvkpy5+/JK70pn2CYlXHUwMDA2L+Jwq4T5id9zur/hr3lR6pU5OT4rXHUwMDFiXHUwMDA3YviDXHUwMDFiUY9cdTAwMTNcdTAwMGbgc64noFbNa79cdTAwMDAzx0SKKo7zREjQY3ng5981f625KXDJ/F6z9lnz+nPNyrnmXHUwMDEyVt9JmI9QXHUwMDFlv7uhXHUwMDBmoaHvYIG4L4TPSsY501C8JXaCKMMnp/K6XGJ6JV1cdTAwMWPBa3DYqOD5XHUwMDEyXHUwMDE5qYdvw0DMQIk4OVxmTiQ5gDOc1SrQ81x1MDAwZUKlb5iGS0rzaTlMuGk93N+lpGlLMzJcdTAwMTd9+ODdjjj9e/+vR/h/XFxIaHJcdTAwMDXUPlM6f+DiRWB+x25iRmYwXHUwMDA1kXVcYpyVVSxNXHUwMDE4wKfCL1nEXp65Xugmw1x0gVx1MDAxMr724DtcdTAwMTcnQbdcdTAwMTnJXHUwMDBlfHPqu8Kb+6XvymyFajbwLJg/XHUwMDE4oVx1MDAxMmzXXHUwMDE2IP1cdTAwMTXr8J8zTp/3TmbMt4+GWUxd3Vx1MDAxNMCTupumvIqDorJWSe5h2ZjkI3pVXHUwMDEwJ1xixlPYiILgvstcdTAwMTFOXHUwMDE25OFZjjhcdTAwMTNcXNeTq1x1MDAxZt/Xpv7Mb6mPu4ZZVlx1MDAxMNeoZ03zle1Jt/VXqVx1MDAxMuFcdTAwMDRoSY1PmYZlheWTf1x1MDAwNd0wfUr6/1/+8pRvN/6SxSM9opE5XzpcdTAwMDSlXHSo2EqlQNzqPqaOeaBzpofuhz/g3vR1+C+5s5vinbnF/Y3DXHUwMDBiXHUwMDE1XHUwMDExXHUwMDFh/KTA+6557tB/9MldcXnrSynIX+VcdTAwMDG8/Kc++n+tnYE//lx1MDAwYoLm7FKA4s1E6/Dde+Tlipiq9mSoXHUwMDA0/7o/k/jSeCFUqXbaXXl8XHUwMDE1gSz8Kn7FjPiMXHUwMDE5yCu6g8WfeZeXzelWXd5oXHUwMDFjNGaNtPzZJVBD3k5NkidQ/MtdoKFcdTAwMTbkZyyfej1JUf+pmTPk92Em6fi8VNZcdTAwMWazME4922FD67NCXHUwMDE3nFx1MDAwMWJ9mnM1rt7uukrKvnpYPV7Ys3dcXPnOq79cdTAwMTPkv+RFXHUwMDE1MWbE5yXF1SeL7zR9rWa3XHUwMDEwp9fs1sJm28VtXHUwMDA29DNvfNbqPlx0QN0x/0tt4yU8WMlhpGnyw1x1MDAwNFx1MDAwN7DmbdlAmypcdTAwMTmpz2U3+tZVXHUwMDA3XHUwMDE0VJEjx+ba61du2tCz/1L/OT9RXHUwMDAx8Fx1MDAwYkLgK1xm31BcdTAwMDCSYbOqVk3WXHUwMDAys179M/c6mZfX4Vx1MDAwN/SncJrW++39lzrZXHRcdTAwMWSxRL+EyVx1MDAxMWBcdTAwMDGoXCJoKo15rZtoLfKYLUdyXHUwMDFkv99cZiVYheD+2WRWXHUwMDAx/od2/X3e/260xyZjf3J1RbCfvtVcdTAwMDApqJdcdTAwMDSJwi1cdTAwMGW/cTajctlUyKB8mVx1MDAwNzd0dCyARFnYhODwqO1cdTAwMDTB6n/xXHUwMDBmjMy4qTCzQu1rtEvQcYlcdTAwMDNhL07QXHUwMDBiTr3MU760Qie5UT9cdTAwMWHaqIWi//B8kUc+NWPItCYvXHUwMDFj4mlcdTAwMDM+ySyUzvSqyivjU6//5Fe+7Dhq4f/0fFx1MDAwZWHmjn3Ufcz74KKnmblhaErCp2Yn3DfPpu6JpuKknFx1MDAxYc/uYp/3o33qTP9DT/8/7KFSXHUwMDBmd2HCXHUwMDE3OJV8KXzkXHUwMDEzRfP28So+cVx1MDAxNIDTuG3KNsmRo+dJmjhVWLgw1aN/6dfZinl1SiZDgLM+LSQ+ztSf+lxmZVx1MDAxMaYqXHUwMDAwTChcdTAwMDdx5fkgeVx1MDAxMu2GKFJPs/M/o97gIzKcPahcdTAwMDV7O99cdTAwMTPTZ1n0n+85/Kx6XHUwMDFk7emDP3/PXHUwMDFiXHUwMDBiXHUwMDFmXGaR05E0XGJcYkb6XHUwMDFlXHUwMDA0kHXv3tuxwn0zLK+aYd/4lXmKXFyg6MCluvvH52LPu2y3fCu1rzOzfWFCqEH/vKNNb1x1MDAwZlKRW0BcdTAwMDUs1N2Yfbfe49ms3HqiVX4qr+K11kX4skf39rRP/9sm8P9lXHUwMDEzJ3HVm0tl/mlcdTAwMTNKJXdMbswleMdfLTyUMU9cdTAwMDJjPlxcpFx1MDAxN7F07lbF8WJcdTAwMTiAuLxcdTAwMDPI3j/1wS9tP/o/NFx1MDAwMvqpXHUwMDExXGJtQ03/yEGeXHUwMDFh1FNvXd23XHUwMDAwY/ZcdTAwMThcdTAwMGI08lxydJ7EzWHJ0WrKlcY2JduF46KDs1x1MDAxMF97XHUwMDFlpcZ/2Vx1MDAwYmZbjr1cYlx1MDAxObqal6ZcdTAwMWPmKaEgUfRcdTAwMDFcYtXScqmaNlx1MDAwMZJPL6FGK9/69eFTX+z7lD5cdTAwMDLVcuZPNKuFXHSkqq1eQn13cjvcjcmhu6GpSTsjviNIcoNAnp5tL80j4Lmz9vb+XHUwMDAzJ+UjXFymZS5cdTAwMTJf9sRy5Vx1MDAxOc9K5Xn/U1x1MDAxN3NcdTAwMTBcIkbeNKAxoHesXHUwMDA0IG1t0lx1MDAxY4RVhrUjsKlcdTAwMWVYYp9cdTAwMTY9SKa42a4wmJaTTzyTsZskXHUwMDAxnXlcdTAwMTU4XHUwMDE4J4hPrs5ALHdt3Vx1MDAwZjbvoeuZ8yiv3fyjbik+00bjtyxOlFx1MDAwMFj5vYZekbitXHL9RPzBUW35XGYuJTR/MFHxXHUwMDEy7rF7vVx1MDAxZFBMg285etfc1+G/hf3Lfzev++m/cY2/Rn/0XHUwMDEwNOry6ZfQJ3JJ0lxi3VugvbxnqbjA5Fx1MDAxMZbjuHVcXN1cdTAwMTCCI1x1MDAwNlx1MDAwZp/4ML2Bf8aH4js+XHUwMDA0/E9b1m0ua9zdf1x1MDAxMTTmsT2gPSRX4WNbsEW5XHIzIUE+d1x1MDAxMFdcdTAwMDdV//RGPNV/6kzuXzqTjYnu5J81mMOCuNhJkDmPUVx1MDAxNJ7v7US4vj7Yw21Hco58Mlx1MDAxMtOdeipRPuPC+Li4/8GWheYlXFxcYlL3NPW2JdCoXHUwMDBmaTVcdTAwMDLePcDignn0NTRAjLJcXD74XGI68Vx1MDAxMcr8XHUwMDBmfPS5oG17XHUwMDFji/9cdTAwMTNcdTAwMWbN0Fx1MDAxMMhvXHUwMDE5fCb6lN9EXHUwMDBlbjhcdTAwMDDuV1rTL/WdXHUwMDE1XHUwMDA0h0T1nTzOXGJ/PM/+9FFkwvdcdTAwMWV/St/a8fE//OP4+MxcdTAwMDGg7/ytTv7M61x1MDAwMJ/8i8HDLlxmXHUwMDEy2HhFUFx1MDAxMpdnZZnHzlx1MDAwNHvIaPkzXHUwMDBmdDlcYvjHdoNR/2e/0f+wXevmfNXVXHUwMDA3hED3g1W/gYnVNSw+fI+xWph4045FvE8/iklEr1xyKv43bqm+cMtgmy/z/+JcdTAwMTbe5peznlx1MDAwMGxgWz73XHUwMDA2nCcjQ9GbXtXLpKo4SGL+9f7p4VVcdTAwMWXqpyZcdTAwMWQ10L9j2f2sI1x1MDAxZrGM+1x1MDAxMctWbrU9q6LQzczHlFStXHUwMDAzSJfG6ptjXHUwMDFmpIXxXHUwMDBl1fa8s1x04F6f3lx1MDAwNjNw/6n5UM982n2PXHUwMDFl6Z+aXHUwMDBm+fmZWz6bUOUgXGKcWKWXwJ2n0WuoWZIwjFCwQ6L7pc/51jSQ+v/QP533YFx1MDAxN8fGlumfviF4anIhPIFcdTAwMDV6oyTskO9cdTAwMWJo8VlcdTAwMTOPuDLAz+Qq3dv9e17X+1x1MDAxYtet/8VuZSZiXHUwMDEz099cdTAwMDfWmpFcdTAwMWWFXHUwMDEzmFx1MDAwNuBcdTAwMGLQgdH60nusueaPhNlw97TBfPmlLVx1MDAxOf9Zt9/OXHUwMDFjh6gjjfRn3Z5vmnOWzVx1MDAwM8SphLKiXHUwMDExhp5L6lJYY6z6e6H6t9VpS8LYXHUwMDBl4W2n7ma/sf/UJV2/tT0y2zrDn/MpTk3tXHUwMDE1sqnksKdcdTAwMWGVxCGf9TQnLlG0W4dB6tc2XHUwMDA2rc+dXHUwMDAyym391tDB/yk+utgnl65spWrNUt1cdTAwMTK1RfrcXHUwMDFlVf2zUFx1MDAwNqXoREgj+pfy0fgy7TdWMf4nJvqXjVx1MDAxZJCTUHwr8NtcIkfBqPJ6aFx1MDAxMkaXWr56XHUwMDAySty3nu3jfl3OepX6zVx1MDAxMf7dn/zb1qQ5lHL0MoBm3lx1MDAxN0rCpD5cdTAwMWWOt8fel53uPKrr71x1MDAxOXfcg19cdTAwMTRiXHUwMDA20lx1MDAwNynbyjs+yFx0XGJcdTAwMGZJXHUwMDAwXHUwMDExdnRNi8zvkIWnM1x1MDAxY+K/8t5fXHUwMDAyoJZLL/D9/tvNXHUwMDFlJPT0XHUwMDAz8kFCmYPMVlxm0ttSjlx1MDAxY++3ynHEXGL/nWt7OZDBXHUwMDFlZ2hcdTAwMWVH70FGXHUwMDFikFx1MDAwZU1hV1x1MDAxZe+aXGLImqhRbIHSxlx1MDAwNG+4J+FoxYetcv/jLCmLSEsrS8WD9rLjO5lf6EuEovwr01x1MDAxYZR2PXqnVZo22+6Dqzj560yt2+1Xz6FItDPZi+pryrOeXHUwMDFm1Fx1MDAxZUDq1etdqFx1MDAxOVbcv2Jg4myoK2aTO+mV8N1cdTAwMTN5nL7grF+3N2qYXHUwMDA28Fx1MDAxNd5YSuhLWCo7yIuuQ41cdTAwMDDIXHUwMDAyxXrCXHUwMDFiy2NcYqHZSu4hPpbDe1DX6+1tl5u9K2HXSIVbsO01XHUwMDE12Fx1MDAxOKvyekqHh1x1MDAwZSpwtCiKbqF1TqPHnvl6XCL1yeDn7U5im1x1MDAwNcO+q4mkXHUwMDBi0vLdumYhxFx1MDAxM0/Se7/T/FwiXHUwMDEyvzmyJlx1MDAwYsvM4riWWVx1MDAxMv1cdTAwMDZcdTAwMTDiXHUwMDFhksnkS4iNl10qmOdd1uqeQWLz2e9BMexcXE4/XHUwMDFhXHUwMDE5emvk8sph9OiUXHUwMDBlXHRcdTAwMGZaXHUwMDA2aVx1MDAwYlxymjVBe3F7nzOk1WjcQFx1MDAwMfRt5S6q7cv7geFcdTAwMTNcbsv2R8fQndhVeZmOsFx1MDAxZojpMvvTm1wijrDJXfXE2NNcdTAwMGVGeFx1MDAxOVIpXHUwMDAzndGmz9WQVFx1MDAxZeZKV1xukGIylWvinaCRxyphctE0+bP1RSdcdTAwMWVcdTAwMDZcdTAwMDMt5K424apcdTAwMTdLZ1x1MDAxZIZ0XHUwMDFiQmlcdTAwMDWL64jl4Fx1MDAxZMyynMdMXHUwMDAwzJ0splHSoaYxRuFujMHGXHUwMDE4LKK2gUZOXHUwMDExbN1cXMb4ZWPVbXrYSDhDzKWOXHUwMDE1LM/BrfQndEsymahcdTAwMWKHjGeunyS1Zlx1MDAxZFiSzVx1MDAxN6fnIKpcdTAwMDJxl/XJbcTSy1x1MDAwMVx1MDAxNKLw2Vwil8W30cB6XHUwMDE5tm9HUC26y5uaXHUwMDBlJEpsfb3X8tV9pWhcdTAwMWbw2cG77VtcZrxcIoc6fYt6+lx1MDAxNjexQjh8LVKFV1x1MDAxMbZcdTAwMWLSvCfYRUeQ7k4j6Fx1MDAwNaLj10xcdTAwMTLbXHUwMDA2X1x1MDAwN+nh0Pf3NKhLLFx1MDAwM5owgYC9gz4g9eQ8cjRpXHUwMDFiONegXHUwMDEyjVx1MDAxZStE7urFU0Knerpp1Vxyscmv9pvLer944X03XHJcdTAwMWV4XHUwMDA3XHUwMDAw0IrnqvLnrGpcdTAwMWKrqoP4UTP5rdGaVMDVrLl/9e6wXHUwMDAxXHUwMDA31NlY7/BcdTAwMDN7Zlx1MDAxY3W16qx2tXm7mVx1MDAxZEjJvfbtS7lrcFCaJaJV8qtmRnDCXHUwMDA3h2pf8aZ7Xc94s7uMXHUwMDA3XHUwMDE3t1koO8tCiZeO7JiBw7wygT5mZ1KBQFx1MDAwNlx1MDAxZs8xOjahOc/FxPdcdTAwMGLpbqJk5fzz0ZJWNzK3K1x1MDAxZlx1MDAwNDd+XGZffuJYj7UnlrmgkYpcdTAwMDNCoqe2XHUwMDAwXHUwMDA2JVx1MDAwMIBAZVx1MDAxOfOoXHUwMDE4rJWIiVeI71xy91tcdTAwMGZxWLJcdTAwMWNbb1x1MDAxZrYkM5+tXFx6Nqr4PmdcdTAwMDKC6aXeXHUwMDA1XHUwMDA2Liz9kzum7J81jVxcMtP386Pzf52cXFxBQD1796taTNJAU1x1MDAxNLDMWfnI0rhcdTAwMDGjJF58XFzDgr6WTVxuqIv7O9VwXG5N3T3zeeEyl2IklmB28eJsXFyQZ1xyXHTP9dJGVOWjs1x1MDAwNtHY4ZdI9PhcdTAwMTQ4XG7fY1FcbiBT7VxiRYZfz98zvmz71OEsaEhTV76PodqpMsPIJlxyzV2JYK9ItZ36IL7iklty0dNEslx1MDAwZpzhO5VcdTAwMWZa0OXDNVx1MDAxZe2ZYyON91x1MDAxMr1Ycn9bpKdMlnV3K/RcdTAwMDIo5MHRoYItXHUwMDEwv3NcdTAwMDdcdTAwMTBcdTAwMWZ7yOomMcFo2LVYWlx1MDAwNVhcdTAwMDUzmzfSR91cdTAwMDOb4vhNmlx1MDAxYSpcciVIt1hcYjhcdTAwMTRFly173p6ZOV+zXHUwMDA3XHUwMDBl7qKlXHUwMDEy0m1aNay1yOpma1ZcdTAwMWVcdTAwMTWKXHUwMDA2llx1MDAwZiZ8ed4pY2poXHUwMDA2+ZFzZ4jYTVx1MDAxMvCD0a/6ib2c2FFbYOs8+KpPXHUwMDEzXHUwMDE1w1xyJtWdsvVBJtdrotC6zrk3XHUwMDE2eVx1MDAwYjT6XHUwMDFjnVxuXHUwMDAyW2uEbFx08ruef43DusZSdV+RRMiRXHUwMDA3mWRcdTAwMDRYXHUwMDFhJTvvObpjO+X5g5BCZkBcdTAwMTXxXf/q8eYztp8n0YlAXHUwMDAwjN6at7eTK1x1MDAxY1642OpcdTAwMDScxuQ9zORnfc5cdTAwMDFcctg/ethY+m1s37NPXG7q5Fx1MDAwM1RcdTAwMTPaLNWJ7Vx1MDAxMk9cdLBcdTAwMWU+TXQ02FKt1zVcIqptlW6e1/rArmxcIuT3JuU/vTFcdTAwMTey7onVY0agrkRcdTAwMTE55tDIXHUwMDFhIDhcclx1MDAxMltjXHUwMDE1RWXHymWno/KX/+deQmpcdTAwMTVcdTAwMDO4+HxLXHUwMDEx5Kxd2jBoXHUwMDFhXHUwMDA3q1x1MDAwMKvm8fymdlwiSyRnXHUwMDFl815QP3rhuphcdTAwMTKI2+c5i3hqX82rzq9cYvFcdTAwMWMoXar7w/4mNJ+RgKKv9Yi/X+829J/wQFwiXHUwMDA07rfjONBiXHUwMDE43DK+d9PNnETvNqSHW1hoXHUwMDBipUtkWsf5XHUwMDA1glRLQsHQJNnsQGxcdTAwMGbpv3QvXHUwMDE1U8Fgx8JcdTAwMTBcdTAwMWMvMdJ28b5gOSfuWCje8DjJXFyouDy85fBLUse+XHLKW8Xv/jDzPXNcdPG5g7CST42Cg5e6XHUwMDFmeaN2YDtcdTAwMTnHM6xcZtOk7Gerj6BIQ4lcdTAwMGKPk1ew1KLFXG6SZiWwTFx1MDAxOetcdTAwMGJSgvKwpzliXHUwMDEx5OVGuYv7MOpgwVx1MDAxZO67T0Noyru10aZ+ad+1dtlRa+xvmUyVyEpKXG4lvq7tlX9oZ22jXHUwMDEwftSI/U12ZeNTj1x1MDAxN7Kz1r+hY5FKMOU+iGRcdTAwMTLqd3Gc5FxyyOO5XHUwMDAwcOMpxVRiq1x1MDAxNpTG6m1cbplHRSlcdTAwMWXpJeE6XFyBIO/p3bbmKVwiXHUwMDEwXHUwMDA3NyFkeFx1MDAxNuR8u+/9V47/qipcdTAwMWQ/c+hcdTAwMWVcdTAwMDb9XGajXHUwMDE2XHUwMDEwpj3gXHUwMDEzezFcXHiCVLyBVT4z8eyLw/1Z+2Qk0tBcdTAwMWWf4dBcdTAwMDLzmV1cXFHCo1dcdTAwMDVFpayaQlx0oCd9kXFoJ1x1MDAxZidcdTAwMDTz2oe6XHUwMDBiloit+Ugy0elcdTAwMDWer9ZcdTAwMDVjxVx1MDAwN53KcVx1MDAwNlx1MDAxMMTTXHUwMDE3yqlS2Vx1MDAxMuHlt+bg6nA4gqKI4Vx1MDAxMCQwZK5cdI9cdTAwMTk2b2CmqTh0hZ968PG989X80SeFXHUwMDBlcO9/4lLxsk+dablLgzfGXFyemUCWkognOm1Us0I6e8C+7cWrnlx1MDAwMWJHn1x1MDAxNH43PczWpLy2/Fx1MDAxNlx1MDAwMYBNXHUwMDBi15v0KiB8q1xyXHUwMDEz2prvOVx1MDAwM5hz1i26XHUwMDBlXHUwMDA04nYy58Bcbrehn1XhgpF2jPJcdTAwMTZcXDtcdTAwMDMkf3RHpVCv5bc+RoSRalmMz8wooTk1Wak9bXJLK7NYQqHhXHUwMDEzr1pC6/6meTThlU7iXHUwMDE4gO5JvFx1MDAxMFxyx1x1MDAxN1TVzNOUXHUwMDAwTy1368BZ6na6fTt9a1dcdTAwMDXoe6h8d1x1MDAxYnH9XTs4vHopl6+RrDaySnz3XHUwMDAwu4k5qSD3rFxuXHUwMDE3TNpipucokz4+QEl/1J9cdTAwMTNSKL5wz3q4IThrYDqY43kk98y9Q6EuXHUwMDEyKWFRbzRDZLKKXHUwMDFkf1x1MDAwMN6yKl4yz/D5Pttvz1xiaEJcdTAwMDRcdTAwMDPazLBKkOA1p9Ivt7f1W0ueM1Zf6HMmtVTux7yZKreRXHUwMDEwX/Wduz+lXHUwMDExTj734qiucv3TP3Ju6qA3b/n0XbtnPoZqX9dn6Fv4XHUwMDBl0LO37Vx1MDAxMLRcdTAwMWX4nepvRdbn0lx1MDAxMe6ejDtcdTAwMDKObFa1oklqXHUwMDA20PSOtFx1MDAwNJBX8Zp6u1wi2JeDvH9hvOKq2TtW2zNcclKBl1x1MDAxYma34sglsDojulx1MDAxY1x1MDAxNu9cdTAwMDGReue7O/7Zf7u5/+wv7CjVfG2f3Fx1MDAxZeeerjt7XHUwMDExgm21ILmLxEZcdTAwMDb43kpcdTAwMTJcdTAwMWVS1+e2oGVjv/I7d4RK50zf7PhSILhIXHUwMDAwtMdcdTAwMDbDplx01ZNcdTAwMTRe2ve9e6pcYlx1MDAxY/GEw4Fmk+aWOlx1MDAwMoGfdv19VSHsnVx1MDAwYs9cdTAwMTlworj66DA0WvvxvXg6t13bWj71XHUwMDA18+SOzD5cdTAwMTDAXHUwMDBieYHPXFxcdTAwMDZcdTAwMTIqkTtcdTAwMDN9c6Kh0oFvXHUwMDAwkzbIaltBunMz2fheoveuXCJWWqtcdTAwMWZYrr9Tcqe3XHUwMDEyXGZfnem/+0X/rucnXHUwMDA3teLxgaFcdTAwMGZ4soPWXHUwMDFkmeBcdTAwMGJsNFx1MDAwZsy7eVx1MDAwNW1BXHUwMDAy+/V+9qdcdTAwMWSgrLil6Udjoyv5XHUwMDAzJsq8teNcdTAwMTU6rF6LpMkq/JUqPJ/E4/d7kIrM2lx1MDAwNv1cdTAwMDKU0HW9YXi3Llxit4ZV3eKoR4/7WK5RXHUwMDFm3lx1MDAwZjucx9vXffcsQ9hcdTAwMWWR11x1MDAwMN7uMPaM86zTp1d/XHUwMDEz7CtcbshFieS3nUpcdTAwMGVcdTAwMGZw5uMt2YxcdTAwMDXTjLuPrlmf53cnil/1w9fZXaSFNEo73OhbXHUwMDE1XGLR7GuLhjRuL2+x0Ifjg1x1MDAxNZK9VblmjOvQ6C9cblxme5i0wXxcdTAwMGXvXnxrxvx58T3QX1x1MDAwMuFX3uHGMv2Tolx1MDAwNMml3/Fh3CNiqZpcdTAwMDK1+1x1MDAxMWniXlrNZeav18fxeWX4Z189XHUwMDEwXHUwMDEwXHUwMDE4t3z1TtqNfdgt4IvRtGjoi7i9tzUg/Fx1MDAxYmiqtrLp8aNcIlxyKqClus0j1lx1MDAwZuCJub5cdTAwMGVcdTAwMWVVb6BcdTAwMWHAhrVcdTAwMWRcdTAwMDCmOrHDPU8g4yZ99cSz1jmL7HEwiZaGkFmK5pim69khwUTx3X3fXHUwMDE2XHUwMDEzXHUwMDA0XHUwMDAy9Fx1MDAwZdSt+/GFj+ivXHUwMDFl0pGbVPqrpryeWp6VeONk36hYbmFqhCWpflx1MDAxZPW3Zm+p5nWDUbslN1wiXHUwMDA0Nit2XHUwMDFiJ5VtpL2K0zOAXHUwMDFkxFx1MDAxMY2maTf2Ne5FXHUwMDBlfFx1MDAwNCBJ9/JcdTAwMWNnXHUwMDFl/CtHlzKdQC9QWeLUps+AaFx1MDAwM1x1MDAxMaKJXHUwMDFi1i9LTMqvm3Tv9vza7+xXrlxclM0wXHUwMDA22l/96Fx1MDAxMffdj1x1MDAxZZ46+1TV8/7N3TjXvGwzUaPckNIp4OZcdTAwMWNmI6SvWNBcdTAwMDBx5sWTlLh0XHUwMDE51FxugYBO3ijJIGmq3Vx1MDAxNPyVc8Zs4OR70X/lVjch5WJcdTAwMTNcdTAwMWSO9TVbN6NcdTAwMWGKbq/Zj1eTm2LavT2WXHUwMDE3kpvfXHUwMDFhYfeZ/Vx1MDAxMcOUpq9eXHUwMDFmvv163OVGXHUwMDE4dqDx3J1cdTAwMDbwhNFxWt9CqC8hRlx1MDAxM1x1MDAxMimIO5I0uc65lnd+1YL7YE5oh7lcdTAwMTKK9Vt+f9FZXHUwMDBlXHUwMDFk+7dcdTAwMDaU3NxcdTAwMDeCU75t98KPzCRcdTAwMWOfR3e051x1MDAxMsdcdTAwMTIoXGIwyb/eqLDnpVglYPCl2ywh9SdOTaavuF9xK3tcdTAwMTg+2Ihw7Eu1v+K9lkexWVx1MDAwNVk1YX2RXHUwMDE1XHUwMDFhx3U5OMKofVFizL9Z7kOh5+eMzMbsK1s8krq/xuBF5UFZZ3jukU4x/9g/fFJ/nXzSXHUwMDA2J1x1MDAxMzrIMfWoJWB/5TqXdX5cXFTmc54ut1x1MDAxNnPps4+Bk9VzXHUwMDA2wIWEykJiJzDByLIwVCukulx1MDAwMcP3nqhN1yU94O6hMdCDXGLoVjRcdTAwMDCiqUa6fp9cdTAwMTFXN4mzulx1MDAxY71cdTAwMWH0kCA2XHUwMDFm4qTg8WPL5lx1MDAxZFxi+vdEcyRWXCLmo2P07/7wkblcYlxmXG5EO0dGaSv4OOVcdTAwMTZhMrVQYpjVtXNcdTAwMDGidIpcdJ1a9knLXHSzQTarYVg5mdiD7lOUXHUwMDAyaI3Pe9ScNMdTtLJcdTAwMTGyXHUwMDBiRVhf/fYhc1x1MDAwZaU64Fx1MDAxZM4uXHQp7WJq3Pb4Ju7TZWt3dWT7Y1x0i4g9WsyEKP2gKlE5ilx1MDAxZlx1MDAwZVxyVdlcdTAwMTfH5m31gD+oQ++NN4gvdEe3XHUwMDEyfTUsaFVaL3pY4cj+PklcdTAwMDCYwUR7l1VliGhm6fJ+QUkrXG7xlarrbVx1MDAwYi7SWi5cdTAwMGUxltbbpOvMwF3/a0Zd8XLffJUnXHUwMDE2i69QmaEkKnVVfi9g8zpTXHUwMDE5VEzFr3Ncclx1MDAxZlx1MDAxMIxCIPLE3jTf11x1MDAxMnP/ysn90t47clx1MDAwZoM1s1x1MDAwNNarUfTsZTXVXHUwMDA11FbPsVx1MDAxOKFNPaF+ql1cdTAwMTNH7yhcInLiXcd42ez+jIFYO6rmnu+//SpcdTAwMGZyklxycJBS1XO/7NbWkzT0UKdMXHUwMDBlc0NcIkBybavg5FbjXHUwMDE5oGGa21g7jVx1MDAxM9VBzC4tT47sMlx1MDAwN4eRnpLTXHUwMDAzXG5sXnZcdTAwMDXPKMpcdTAwMDE2XCJlSEXJZnFcdTAwMThcdTAwMGLWNal9hp330nCJo1wiL6Lq9phEVtVcdTAwMWT1Lc7vjy3nXCKJvOJr9NF23Fx1MDAxYlx1MDAxZrJcdTAwMTJcdTAwMDOLdcnoXHUwMDBmNNs6VU1fs76JsFvjW+olJEehyyXLzj+c1T7xNVx1MDAwZuNwXHUwMDFlMnRcdTAwMGZtnUB97IFp2Fx1MDAwM8hilTZnV71cdTAwMWQlfGn7vj2I+zhcZm7Niiy9cl57w5p5k/xZPqg9gGGUle7rRmfvXHJXQVxyUdSStaLko59XXHUwMDFmXHUwMDAzXHUwMDEzQlx1MDAxYlxiXHUwMDAyUCg3MKi0fPyeXHUwMDA2f8dcdTAwMTVJXHUwMDFjXFxcdTAwMDMlO591U++mQZ9cdTAwMWGVWTi/+2hcdTAwMTRqkl3io8+i1eNcdTAwMWbfpqZcdTAwMDMpXHUwMDA108XEMczqW5ZCXHUwMDEwv8igdjjirTVf51K/4ZV2bzhcdTAwMWaqYUGbui5cdTAwMTdcclx1MDAwMFx1MDAxNGLnXHKTYCTiqFx1MDAxYpWrv6JcdTAwMWXVTclccvtdX1albVx1MDAwYlx1MDAwN1lo0Z5MXHUwMDAwuo3hXHUwMDE1yLWyej7vU35cdTAwMGIprdHZ5vE6caXwXGKfM1x1MDAxNEBcYlx1MDAxNoxcdTAwMGL5oseCXHUwMDE2NWwr4YG5S1x1MDAxZcpDSd2v+uODW8AzN1x1MDAwMGx4nLE6flx1MDAxY/v+SsNkQTq1ckRIhpSG/elfc4fiXHJ7022WP4y3M99rfcP5XHUwMDE1XSlcdTAwMGZXUGzr04c9TnbwZqVn/+VcdTAwMTOjI7ZbRfrE51WaRlx1MDAwMogw545KbDihnlx1MDAxYsbPhriu1Kdn4XFwlk8u/lxmRk1iv4fF3777vFx1MDAwZVx1MDAwYj3gXFw7XHUwMDBihG1fJVx1MDAxMn9wwkaEXHUwMDA02WpoXHUwMDFiMS9umTLgXHUwMDFkxn5cdTAwMDd6nsTKWDrfly0nyT2eY1x1MDAxY8aJud4hmuyL6rlcdTAwMTOMKyS/4uWV9W051mtkXHUwMDA1iLdvXHTX2KKqJqKv3EZT1VuCnt89XHUwMDBiNXQ7683YW1x1MDAxN1xybnpcdTAwMDCoPVKe/In3+cnzXHJcIlx1MDAxNs+7XFzs45RcdTAwMTF5brjwplx1MDAwNamKSWOBROuD6OF2ivHbLWNcdTAwMGU8jnfuniCg8c7T7PJcdTAwMDJcciBcdTAwMDNcdTAwMTBjzVaXbtd5Rz1cdTAwMDLXj0j03VNcdTAwMGZw7NWzJnqDtNhcdTAwMGLC3Lp3kGFibYH7em5Jr/b8zIPSMruWv3qZfbOO41++a73x8Vx1MDAwMEhDSk1dXHUwMDFmSH3JNc8vcl9/wftquianhfFcdTAwMTEn/Szb/KeLWXNcdTAwMTE+Yb+/+Fx1MDAxM7lixFxioleVSPxcdTAwMGKMyaLz+F038G5cdTAwMWNcdTAwMTXT5cNbTXB6a1x1MDAwM71iN+pcdTAwMWVqjVji+2Vlv2pt98fDJIuQuUPqQbvmOGr4r1x1MDAxZSvyvFx1MDAwNGzyhGfOkyNIRv5cdTAwMTEh6sK16GsuXHUwMDFjsVx1MDAxODSk0MKPRUHeo4yl8sqFWVx1MDAwNmbvnDyiT66RXHUwMDFlXFxcdTAwMWU85ZXsz9a4f9ez7U+fXHUwMDFl1Ws132GhWStvgNSiV3LA4mNcdTAwMTdcdTAwMTXngbZf3KG7fXqe2CjfQ7fIPOyck5SavuN+ajFHcI+d0GRdb5rJg43D1ZxcdTAwMWPxoY1cYs1/Li+2etxefX9wN6Fr0ti9XHLeXplcdTAwMTbqcMfXoq39mVxcwYxV8uRK0fhwM+LuU6d3XHUwMDE1nJlE1C/kKTc7hb2+Np9cdTAwMWWC52uoO4fal1wiqtX3Mn9yikBcdTAwMDU98GpcXMaJfXBcdTAwMThcdTAwMGXUpJl8z25ITn5HXFyM9KzB0smcV8qlJNs0XHUwMDAx875cYqWHc0mhOb55Litfbo5cdTAwMWWb7IRcdTAwMTdcdTAwMDD5Jvc3XGLidypXpWhcdTAwMWJ4XG5jv/mAYlx1MDAxZmCHtLN0XCJcdTAwMWNcdTAwMGLZzXJe88pcdTAwMDPNYkI2qn/fwuVKnzWy/OxcdTAwMTE1MS58XGam++JRinYv9Fmfk7mWYSTo8JBQV1x1MDAxZIfdajb67jNDSlx1MDAxZOyRYW73K+uqblx1MDAxOebwlYbaOIDjweG4XHUwMDAysMphmtGbfz9cZjpcdTAwMDTcYKFcIq19oXlccu9kV2lcdTAwMWHuVTd4Ulx1MDAxMyywzVx1MDAxMSlcdTAwMWTgyz/UXHUwMDBmXHUwMDA3ylx1MDAwM1x1MDAwYlx1MDAxMOHz3o9cdTAwMWJu+nnjfHJcdTAwMDKHy1x1MDAwZspcdTAwMGVUbT355q6DPXz6XHUwMDA2h8WVSCVxxa+ei/XMO/crvOFhoN5hIFXMcU56XHUwMDEzMvq+IPjsSlx1MDAxYYe3XFxX3Xbu3Utgw4PzXHRdh6dApS2Q7NUpuO+Hh9RcdTAwMTLIsaqwnJ+VwVxcn8lnfSnTQrktvzNcdTAwMDB37vvUPSvqJUVcYotcYnitKqjpj3r/wUrcXCJcdTAwMDQ9WVx1MDAxOVWrXG6TlNRw56LCXHUwMDA0qZa3MOddr1x1MDAxYZL433yS4Kgjxj3gjcD0mlx1MDAwMIHDvW2LXHUwMDE3+jdxcoRqnlddUNuZiF7Me3Kh+sHiapuWKuC9XHUwMDFi+ji6rXQ7/o9cIlx1MDAxNjl4TYqa9d9cdTAwMTOfQaj9XHUwMDE1SzJcdTAwMDUk0Nw0XHUwMDE1fZ5SKJ9GXFzYYp9cYsrh7GmqdFD/1ChcdClj31x1MDAxN1x1MDAwMD1icMiQfY5vS/1917h08lx1MDAwNJxcdTAwMTQm67Laq+L24ERfPFx1MDAwZtwhwoOPKFBKyPXYsFx1MDAwNa+gZM66I9Yhe5ykK5tP0azBoFx1MDAwZk6z1lx1MDAwZT339FCRhcjWTDz2W19cYjxcdTAwMTJll2tcZsp8VEPy6kxcdTAwMTR7z3OQyELkWfp8XHUwMDAwQ1x1MDAxNElcdTAwMDfPt43XiZtQ3ob6Rnyxflx1MDAxY/uqXHLzn16aXHUwMDFix4CzI4s7XHUwMDA2mMDlasdcdTAwMWGPz7mctVx1MDAxNG7WXHUwMDA3kIuLIVD7e0fdKFx1MDAxNFx1MDAxM1x1MDAxYZRUuyc8h097zDZcdTAwMWQhMkWlQCxcdTAwMDWHzZPM223+8oHyQzAwNJb8w4GCOHaZJOu2zrMzZr5cdTAwMDVLsTyTz4etSy9YON3vV+8mt7PoLerfJfE4P9rZJyni8DlcXKze8mxQpSFcdTAwMWQ3XHUwMDFlqp5oYz3SeSymZcFUXCLsMSV7XHUwMDFhwcHlSe6IQjSJPHKUXHUwMDAyo7yue7B9Z1xuPlx1MDAxZLREu1x1MDAwYqTJfPVa21x1MDAxNqU8XHUwMDBmfCVjXHUwMDAwmFZOfyB7sL9cdTAwMTj4XHUwMDFlYFuoMIfVqOpHg3twqZX50mdcdTAwMDQ2N2rG5EH+kEfie+pIaqKc/ZV+z0+37LNcdTAwMGVO31V/pejuXHUwMDE2X6navFKI9+zcXFxIXHUwMDEyY9VcdTAwMTQsYXnfmSjxMaieZEWPIK6HWU9BpCTLkpv57Fx1MDAxNt+mXHUwMDA01khgflf213OZ7WWjZaZbVnwh3Vx0QbPDXHRdLMOdlHfuXtTYSS5cdTAwMDdcdTAwMDfGjOXUkrHMLlxiZVx1MDAwNjF1YoONLWvM+EiMKkJRUGuDrEiGw1ZU8E1x/j05585cdTAwMWYx+0CIRzTi+Vx1MDAxNUCe6avf9PxcdTAwMDV2lb/adXM4TvxcdTAwMGW/zFx1MDAwNPVwLaheOof2d4lX8ilcdTAwMWZXXHUwMDAwlXCa8MaJ7FH4VosgXHUwMDAxl1x1MDAwN1x1MDAxYVx1MDAwNPyXPYrbl95D4GpcdTAwMWZcYvhHTGPmwX3HeTiATuNpkTIpXHUwMDE1czAyazrVbb/mgupcdTAwMWJcblx1MDAxZt96s7uHm7HxOEHNjlAxXHUwMDE091x1MDAwYjFQXHTdWbyrxkRHyJzliNjF4lx1MDAxOF8xXHUwMDEz8XetiU1cdTAwMDGlXHUwMDE4lC1Pxm5cdTAwMWXM9+Ug/lSqeMSlpOitSuyxOTDAXVHHsTRwcIVJcvScXHUwMDA01DPg+MXKXHUwMDAx34U4QejbV25MWXlcdTAwMDBKXHUwMDFimu5cIv4xgDPl8fZBqHhKw9khgy8gLjqfWcwsK8pmwCDdqa91yfGqok+0K2HVyMeh1WD6XHUwMDAy9GXrq3RaSilcdTAwMDJMUdhlyFrSdFx1MDAwZSdcblx1MDAwMdPeaJCp5djFq7o9/GKSSVx1MDAxN527KZsmpcjVekUpXHUwMDE06CRxJj2pXHUwMDFj1zhcdTAwMTdAUFxyhIN8Z/iTK/gvTG1cdTAwMWPxKreBXHUwMDBleFx1MDAwMM/sqm2pacJPpHZYh2gjXeSTuOCegJ37ZavOTdf62Wsw1ljNXGJcdTAwMTmco1x1MDAwMM/QI1CbXHUwMDBl1qFPzLFFXHUwMDA3Wlx0fvn09jTmXHUwMDA0LE5NtFRcIiEoOTqjXHUwMDA3Wdxg0lx1MDAwYqRcXPgpKj5zh4SP3CX5zD/WnqourS3dSlxmi9x6/s3A1Th5pvLSoiqltYJKrKlcdTAwMWTmLb3mbcireu7PXHUwMDEx5zvwK7eeifRQmlx1MDAxN15ZXHUwMDFmXHKLyuYs18BcdTAwMDdWXCJcdTAwMDB1P1x1MDAxOG9UhlpyxHWNUFx1MDAxMos7eEKYdkauXHUwMDFjhpY+XHUwMDBmQkRcYn7ojq5N+Fx1MDAxZLZ4O4JkeVx1MDAxMlx1MDAxMpRcdTAwMDVS5ThdXHUwMDFm1ddcXNJKJfltni5cdTAwMDFBXHUwMDAx0Dii/XX0XHUwMDE2lCFQNGONOH2Zl8eXf1x1MDAxNLCP9tu+iF9cdTAwMWE/Wuhp+IZyYjr2era0XHUwMDBmMVZcdTAwMDVq3FZf26iWXHUwMDAy/cK3wPnWYY9cdTAwMWFScI+DYqPL34N1eTWntq7+mtFVQlxyxFTsyPQodERv3VWGIfVcZmikky2kMI6d5XlcXLtKgqOHKmrOu3uOXYj3LVrr2WxcdTAwMTE1TVx1MDAwN2lO9lx1MDAwMehcdTAwMDU30lx1MDAxM5Zf9aNHY1LxMlNvfkdHtKuNhczwXHUwMDFi30WVUUzgk8jfXFzPMtI5hPKwzy9MbP3SJ0kuxfRcdTAwMDfWRFBhREHAepc5LVo12YOO92xcdTAwMTHwXHUwMDA1+uTZT2WOrWtvX7kml1Fd8cXNoOpD8zLNolx1MDAwZZCuJVx1MDAxYnJcdTAwMTk/XHUwMDEz4vWWzDR0bvxi+Ze9L1x1MDAwZVx1MDAwN1xuhtZcdTAwMGXvXHQ9cOGI+fFcdTAwMTEpgVx1MDAwYqsv33NAWJF5XHUwMDFlrqnG1Fx1MDAwNCfYdVx1MDAwNTJcdTAwMTTtqSetaV1272NgzFT+asuYjn/dsVx1MDAwYihcdTAwMWZte3j9pTEk2HNcdTAwMTZcdTAwMDRcdTAwMDNSRnYrL2OYOve5XHUwMDFiKTCTXHUwMDE1ijI7yYpXVD7l0Nn01Vx1MDAwN3J8s7vwYlMjUZW+6rFcdTAwMWJ6u9fZpWB6XHUwMDAxelOFl4j3R19f1DR4NZLzkPhcdTAwMTJpWKlcdTAwMDBrK+tlvO5L2EHrqX8+uUhccj5cdTAwMWErvVx1MDAxM9hnXGaS61xupzWN05BcdTAwMGal6e6KXHUwMDA1golBOiV1Z0dQXHUwMDEynjq0T11cdTAwMDJ+fM1cdTAwMTKLfmnp6P3CuC2ZIXCVXFyBXHUwMDFkXHUwMDA3yeb/kPXdyo7zwJpcdTAwMGbEgN6F9N6JXplEb0Tvn34pnfnv3dpcck4wVVNcdTAwMTJcdTAwMDQ0PtNoNNZMlj+4q19cdTAwMTZ9T1nf3D/AXf0j/smlwuda1mTT96m3iLZt7fomYih4brdcdTAwMWNcdTAwMWZu3ORUly1U/SbVa4x94jPn8Xa1XHUwMDA22i1cdTAwMTNCjFdUdVRcdTAwMDKkj2sy1mK7vfrfXW+L2Wpwf8ZUzo9cdTAwMWJxVJ8r2Xy4xOpFNEksqf6r32//6rOs4F99XHUwMDE2n1wiO/uqnNFcdTAwMGZcdTAwMTV8wd9QS6xo51xyakSi61x1MDAxOZqfl7w+rG9cclx1MDAxN3x+9L86Xa5cdTAwMTBcbr3fhzvs3ees8lx1MDAwMJa9e1xiLqG5XHUwMDFkUf5cdKJ61d8+48O5idPzRcKjRySk8IH6mH2Ndb9cXHdMgTOgTVx1MDAxY3hcdTAwMDPxP+7e9lx1MDAwMDqtS5VLXHUwMDBiSVx1MDAxOIpcdTAwMDBcdTAwMTBp66NcdTAwMThNnCpcdTAwMDeONVx1MDAwNcrf/Vx1MDAwN+Cvzlx1MDAxNrb+p9e0XHUwMDBlKf297G7bVk/3nN5JsMGP2e7OXHUwMDAzXHUwMDA0KIRcdTAwMTRcdTAwMWVk5lx1MDAxNexiLMnwq9m6g1CxIDblJEhCQVx1MDAwM1x1MDAwN7yYOIBwKFx1MDAwM7JSvNI419y9ONxcdTAwMTL8jX062kO9d5xcdTAwMDNEJE/n67mhh+nouGaBMCm0j5Ois0fzkynRi91RkIMxXHUwMDEy70lcdTAwMTR8kVx1MDAxYVtcdTAwMDLRu0J0zKeBVYtcbqj962f80PTjt1x1MDAwZoZW/O+u1ixBdk83Yajj8VxyTPZcdTAwMWKm5lfaUttPS3pYPbI7spK3/jOHbvpX96gp6lxy1vqEUWlbL7ifR3a2L6a3KJLeXHUwMDFlb+VUI75cdTAwMTWZXHUwMDFhXG58VsW4dZA/akdcdTAwMWNcdTAwMWIwslx1MDAxOFx1MDAwNYBcdTAwMWVcdTAwMDWqObCrcZKHUfvzQFx1MDAwNvNinVx05aM5o+Fb/8JG7s/Q9OiXXHUwMDA1h0LsjfDWL38wN87vLlx1MDAxYupcdP/dd+r3t+NuLiebXHUwMDBiojJFeIJH7j1fXHUwMDExiS9pbkuvZTniPHR+9YjW569cdTAwMWVRKKrGjPlQicxs295cdTAwMDK56bTh0HpDWrhr8Fx1MDAxYX6oxlxy6o9cdTAwMTnjs6YyPdwrtdeK5jZf4CDwXGKM/dapXHUwMDFmdVx1MDAxNUz/V1x1MDAwNzM+nP6tz1x1MDAwN1x1MDAxZIv80+4kg3hocFx1MDAwMeagNVx1MDAwNsHxX7+G5vFcdTAwMWI7+H+P3XOyXHTsXHUwMDFj9Zxj0oc2Tc3Wbq1ynt+6XHUwMDAwm/dbl/8/8y4x+rhcdTAwMTdrJ9kozI/1K7+lhMmOSrKvietxT1x1MDAwYvIpzirc49ahq1Rcclx1MDAwMYheSz3FT1x1MDAxMd7n71x1MDAxM781WFx1MDAxZjOKj6LpV39j551cdTAwMGLTXHUwMDFkekcztc5cclx1MDAwYsGPXHUwMDE1XaPgXHJUYf2xwE+xYZExlkNpff0u/q+fm6H8uzdcIlx1MDAwZinzdra+PI5xfmSWXHJcIpgu4U/sQzUuXHUwMDA1MGJcdTAwMDFyZt3cc4BAL2X+yzlqN61FTlx1MDAxOYONJ6P1eqlcdTAwMTWgoy7kXHUwMDFk/sRdZbI3XHUwMDFmYcz75y6kTrXlzSzUk3FWNFxmRFx1MDAwM0JcdTAwMTFaXHUwMDBlRk+QXGZJX3rd8oa4/blcdTAwMTl8ay6KonEhTr7AITfsWsMheny/pU/1TK8jgZxbV06y1Cx/dWWucu+T+L+1gI+DYTGha9dQa1+fYLswOIxIsKJwO8/fiJPtXHUwMDAyZFx1MDAxZijz16L5Kt7O/e/eXHUwMDFjXHUwMDE4XCLP827oIMDbXXNtY1xmcZEjNNTomWtcdTAwMDaeP3wlXHUwMDE3gFx1MDAxM35h79DYUlx1MDAxMcWP4HY58IU7XHUwMDEzr9+8X9JvR9p+Z5amUkCsXHUwMDBmXHUwMDA0MIhhTbQorS1exFbV5UY8/4ujvvH+xZH639izfSzoZ/x2h3N+eyFcZopcdTAwMTFNPoX8ZFx1MDAxN1x1MDAxYpygKESI2Z6+Jup5de//7i947veeNm/e1sfcRL+OsNf8ge/gO5CHashcdTAwMTB2KIyqkUi6Wj5cdHO6mOfAXHUwMDE0grbp6fhthuFRl09cdTAwMWJliYfZsc7vzlDd8FHu21xidqtScq+ShPJ0jZR52UuUXHUwMDBlN656cvwvb4RcdTAwMDL0o7P48/xXt31cdTAwMGKOhdXE9ztJmExcdTAwMDdT8Z3u8WZHI1x1MDAwMOvoXHUwMDAzMubF3KvvfTTk7z6awFxuQkkwOnTmt1x1MDAxM7pcdTAwMWVLS5ncpZr5WFx1MDAwMWhPgsYnKZiPqCXzJ2ZcXNxdp2wo0yC3jzemP1x1MDAwM/zKjJxCKcSM9YA7+Y6pfo9cdTAwMWQwjFBtiSlcdTAwMWNX1/ctXG5cdTAwMThjpomErJKvxVx1MDAwNnQ9T1xmhmeqv1x1MDAxZT+W8rdcdTAwMGX4ZfxffVYn3UuSg1xmqFx1MDAxMUJoXHUwMDAwXHUwMDE4XHUwMDA3arvg7axcdTAwMDFDw+30rXD/XHUwMDBmJ7tcZlBzecu861x1MDAwNzSKXHUwMDE0QTmkyteDZZktPcOHpCaM6TDtYd3/XHUwMDE35HZcdTAwMTfQ6WY8wKBpclRIw1x1MDAxNN7kKyfVcru9XHUwMDAwzX1cdTAwMWbq+cphVWSwN17CXGZWTy9r3WD6XHRPuUCCvJAsu9s9Qe9cdTAwMGaTamiEeIPcJfPvrVx1MDAxOfZVo3h57lx1MDAxMFx1MDAxOUPLtNNgQ3tNd9JAnr1QzPVJmldipVGFj+CIkMrF2u8sb/Q9V+qZKCq8Ne2g26TORp7qsPuS3Sa5NJzWTYTC/KtRS3E5XHUwMDExhfCkTG3BbXy/6G1bo9d4KkpcdTAwMTKimlx1MDAwZp3849sjRJJcdTAwMThW9lQymTdIf1x1MDAxZN9cdTAwMWFcdTAwMWFHQq49XHJcdTAwMWLbvqSWPFx1MDAxM+xfrZH7TUCnbSdcdTAwMTjaP313h1x1MDAwN1x1MDAxMqpR9bowXFwmcdJFu5PLwXBcdTAwMTFtXHUwMDEybm7eNlx1MDAwZi811N/7XHUwMDA1XHUwMDEwXHUwMDEzO3xOVPlcdTAwMTS/MrG2sjxdiXZO8lwi4Vx1MDAxZe9NXHUwMDFmiM2+SJ1cdTAwMWJj6PIvXCKuxmJcdTAwMDFcdTAwMWNnREesXHJQXGLcjJOgXHUwMDBmLym2LNOoPCiteOm389+9dr2UXHUwMDAxSO5QjUFcZkDS7Vx1MDAxNJV4XHUwMDE1WmGx5bLwiFDeUSjjr1x1MDAxN9OjXHUwMDEy/+6QJtffXHUwMDFk88mK2fCWnstSPMJcdTAwMTm8atzZ2oXMs6g8tVV/J6FcZje/+7718Hff96EoKofcXHUwMDE0cVx1MDAxNMAm8TFcdTAwMTJ2VGS1S/bSldYn7M8tVG9s5Yikv+GsLV5UY1ElgrQ9mKhcdTAwMDBI0F7CXSD59MBcdTAwMWNVfZorvrlcdTAwMTdJXHUwMDEzi3qToFdifdZcYu/hXHUwMDFiX5+Rblx1MDAwZa9xnGkh0btqwIKUxb5cdTAwMGV3/HdXXHUwMDBi/+nUNv0wXHUwMDFhgqJMLaSPc9JzXHUwMDAwyTaUbVx1MDAwMM9cdTAwMWOAOOjItehIpFhotK8xg1lr2lx1MDAxZlx1MDAxZsYvP15A995Ya24pl85+V9Nb39DbwJ5v2TpmLLSp6KuiWY2JXHUwMDEw70mvSPdAwovCSVqfXHUwMDEw9kxz1dVxrDA0XHUwMDAwmD/1v947Z1x1MDAwM1x1MDAxNbxcbshdN+WAXHUwMDE1m8vQTFfuv13uPVWwTkHvKXn0XHUwMDEz8ttcdTAwMWKT8NdzMvlebUeEffAjh8kqpt2S1yREcLKrYEeirqeDS9q7ua9533eaptb4e1x1MDAwZk5cdTAwMTFcdTAwMTnh9qjgM33Inn7HMWnkmatHONXefuNd4bdcXFRcXPvCn0XTcdpcclx1MDAwNz3lXHUwMDA31EH0mT40Nn7RtX2psL9tJHVhY9RsXHUwMDA0X3dcXFx1MDAxNClcdTAwMWNcdTAwMDAh3p+m+6Cis0RBXHUwMDEw0YCKb+nnOo/HZ1xcQ6JZXHUwMDE1z/Z+vUuYXHUwMDAydZRcdTAwMDOlsV+/hITzRUiQi8pcctdnmF7EXHUwMDAyRzee51G3eEmGXHUwMDA19lwiJ+CesKlNvZP9e67JM7f8U5noUeK59TRA+r3VXHUwMDFloH8+veT2q4ZcdTAwMDPmY+i41r05XGLzLVW0l6dsXHUwMDAzzLo9XGKKNDZvopFQ2XtcYqpQro20XHUwMDEypVx1MDAxZsW3sm9cdTAwMTVuzWFcdTAwMWT8XHUwMDAyYlx1MDAxMkCgT9SNxKStx1x1MDAxOVx1MDAwNFx1MDAxM6FcdTAwMWJKhVx1MDAxYf/1Vlx1MDAwZvX09qBcdTAwMTny86Di/rxNcpbMRnSi0VIvXHUwMDA3uac0QEEmTid4xK48ze4ytFZU7P75j1Z06+7Wq1dcdTAwMWQqxfOCz7k7jou+qfrVLO8yer+HXHUwMDA3VHXceTBrv7P2LeVh1Fx1MDAxN/CsqyPxg9pcdTAwMGbvW1x0nUeRc1GuXHUwMDA3xd/+QEXjqOk9foSLskxcdTAwMGUvZHiszeCTwun2jyFIheTfO5SD2P/dL9yAeMStwjxcIoRS+97JX905XjUqfl9cdTAwMDNGk//pvUVslG2yIKlHwlx1MDAxOVxm4ZXpMlx1MDAxY2xod1x1MDAwN1xmXHUwMDE4iiVcdTAwMTXY+lx1MDAxMNQwKsPQlFxu11x1MDAwYsUn/tFcdTAwMTNRoeU2pL0vefurd9+gtlx1MDAxN1xcSt2geFx1MDAwM1x1MDAxNVwilWdto7CPjYaP2kRL7fOZl8RTXHSRykhcdTAwMTOOo48pvnCl6G/VX1x1MDAxZctcdTAwMDSJvJrrddHE5NBQwONcdTAwMTHSoC0waCk0To9B39zyXFy8MHA0XHUwMDFicF2tV2zbi457n7XhkkRL1m9v2Nd5XGb67/1cdTAwMDdWL1JM2KRcdTAwMTlcdTAwMGaSK1x1MDAxOLyVXHRWXHUwMDE5+ajvtrKHflx1MDAwZqNcdTAwMTMx20i8v0K8SDOyR/5eL1xiXHUwMDFm9sff+i+M5LxcdTAwMWSgR6pmXHUwMDEzPdnu1kd661x1MDAwNFp6Nlx1MDAxZjqI11x1MDAxOW1eR1x1MDAxMddYXHIxXHQrvjBmZKf5qfYvtFx1MDAxNa/pQm90s5N2z1x1MDAwYlx1MDAwNVx1MDAxNWmCUbafr+ex1meqXFyFLvW8wWfAutRo5TOqOCRGv430/s7htKYp8NnB8HVwpYafvKNcdTAwMTHj5WPhZihT2ztpgFx1MDAwMOVBZORVjHR2NnWfXHSQ+/7tRpw7+Jp/vLg1Tq7xM1x1MDAwMLj1XHUwMDFhydWHmuZEXHUwMDE1LyBE3Hp+MtA+XHRBmSo2SyeeZb1cdTAwMTD/3YlZvtZcdTAwMGX6XHUwMDAyNShcdTAwMWUkNlx1MDAxY2VG4r55R41cdTAwMTadXHUwMDFhXFzJqIyzxHyBoJZD9PZuJ0r2l2fx1uarSFx1MDAxZfT0zP7rl9jw1b9+Yot+XHUwMDEz3uJcdTAwMWVcZta2Rlx1MDAwYi3X7oKR1r1yzVwiaMq3L2HeyCZZTk6tLffGNKH6d59OczxNU5i1NL5PuD6TerogJWyTZKyU/kpkKKW6nCPFp8UkrWs6qKrz37NHVFx1MDAwNlx1MDAwMHsya7pcdLpzUMRcdTAwMTNcdTAwMWInMXdMZf/1NnDIQlx1MDAxM1x1MDAwMey5dVfnollcdTAwMTgjXHUwMDAxmTaFLVxcWWUz1q1LtlVKSopGfr+lXHUwMDE29JK90LK9UrfRe8Z67OyLRCY7XHUwMDA3ctMuPvecNXpTR9eRgizz1j9cdTAwMDfwucWjQtLAqHI/4aVQ3POhMlx1MDAwNFxiwTbfzbCAtuGR223/etlJcNq6NCe2KX3vqFx1MDAxMmzCbm4oN2tfpuNrpStwna8sRbb3OJl53IxmPmnNrWu9Svz2i2iTPNv6XHUwMDEw/ZCybemBnq+jJVx1MDAxMVx1MDAxOIi41EBcYsi/N1x1MDAxYVx1MDAxYc74u1x1MDAwZlx1MDAxMfk99+L88f43XCJcdTAwMDey5WzdO8HtZkjXXFybiUfSTYx1a62kwpOwvzf24Fc+XHUwMDEzsyknUvZWQbOnl02ftfncXCLxtFx1MDAxMVx1MDAxM1x1MDAxMVNvnXXVSqZlsWDzhz1Y+nviJXzvpnthl8PzXHUwMDExatvxTSm8qFwif++sY1xcnFeJXHUwMDFk8W6LaXS+cX1A0lCIXG4nymc+tNc/TeZILMNKf/3B9NtBLbf3eWSn8fTCJVx1MDAxMySazk5cdTAwMWKP6YtW43dcdTAwMTkmt3s+Q+mWT9bv/aVGstzmr6a/XHUwMDE3WH5k9IzCMrNrXCIru6iSXGJKXCIsQ4NcdTAwMTdT4XE701eYeyWEXHUwMDA131x1MDAxYYRcdTAwMDRcdTAwMDfBJ5k0sG03XHUwMDE4XGJEc1x1MDAxNsqMsYvD7n57WKpcdTAwMWGHwim7JVx1MDAxZIRjtpeSb8TqXHUwMDFlPlx1MDAwNEtcdTAwMTebO4bHXHUwMDE2f7me/7lcdTAwMTeRNFav+j/POleaLrb7NFNcdTAwMDRcdTAwMTZcdFx1MDAxZdSWq3iEXvu9b9nSQFxmccpcclx1MDAwMOVtWFx1MDAwNKNntpKiZFQ+WZms2/SWiaCGkTw3PrVcdTAwMGXnoXxnxJZcdTAwMTm+ncOk8Pn53GZbv2TTPklcdTAwMTDG1qVdx6FkVFxiM29M5FWWwXx0Zdwk1+U5syHj1VwiUM/fwkhcdTAwMWG5XHUwMDAz+1x1MDAwMSd74970d/9HhCtcdTAwMDapWltcdTAwMTdnXHUwMDE41HhpXHUwMDBiN1x1MDAxYofG21x1MDAwMqX+8S06JX5xXCJcdTAwMDVEaTLN91xcMYm//aV1hHNz4KRWXHUwMDE3KTcqhCPNXHUwMDFlrZB/PC5cdTAwMWHjLXrum+/5pOQ3jNhN5Vx1MDAxM1x1MDAwNoOgXHUwMDAwI/cyOlxcJVx1MDAwMGqib1x1MDAxZrdM0S2SRIv/9lB8hLFcdTAwMTXQO2TeVpAkXHUwMDEyXHUwMDAwtYNn4FdcdTAwMGZ9laCe5If99+azJlv/izdcZreIt+acXHUwMDFm8DuZ2lxiV6K3N6jgXHUwMDA26jY2XHUwMDBl3Vx1MDAxNjHze1x1MDAxNDD8uHWHer7gv/5cdTAwMDKCXHUwMDEy8NWXt8f8ob2HXHUwMDAxrD5eK85dZ3zUNsyb5EBYl93Vg3vVjEgtXGJpXHUwMDFkxZlfU32BOlx1MDAxYYHIM9WwWX9cdTAwMTndZ09cdTAwMDNcYlx1MDAxOL79jc52YdAr73NK/Pgwht/2XHUwMDFlqcu5XHUwMDAxZHDunE8smiFcdTAwMGUu9DV2fVxif2oj/uBcdTAwMTUsV1fC+1x1MDAxZiWn4pk+pne/XHUwMDFm6yWUt3VWobhQVs0qRkOkUVxmITmur6pcdTAwMWIlMUZT1lNTNIDQzlx0M2ZcdTAwMDRMgyxcdTAwMDc7jcji5ysjXHUwMDAyO1xyPDhAQ7DFbka7tG7LTXCzLjig82eEXCJcdTAwMWZU4bxNXCK01ERcdTAwMDeZqW7XWZi3XHUwMDFjZ2hTYi/jYVx1MDAxNdBcdN1EfoeFPpXSllx1MDAxZjNEcsRcdTAwMTIuRtSHN1LQjEozXtNwqsBw4EPp+4Kjo+hcdTAwMDTwXHUwMDEx9lx1MDAxONnPkMHQjFx1MDAxNoVQWyCf/SzcOo9g2UfCXHUwMDEyRaZWPTLJmJRQXHUwMDE0OW9I8IDx2sXIXlWqrFx1MDAxMe6PXHUwMDA0XG6/IzYrz4f81kawT3B+sbK0g3Vdl0n3YD+Oo2JcdTAwMDLTvlxm5oojaVx1MDAxN1/Ek7TO/lx1MDAxOURx3j1LQFx1MDAxZlx1MDAxMODZNa3SmYQ0MFxcilx1MDAxM5ky4PdgnyzzYlxcTVx1MDAxNVg00vZm6q5JKErYXHUwMDE29Vx1MDAwNej8rJqB8vl8Sa7L3C5cdTAwMWZcdTAwMWJL31xy3l5bbe+gXHUwMDA3mm6hKOBcdTAwMTZg1lx1MDAxYlLYXHUwMDAyYnb1XHUwMDFl74OzapItQqNZgk7uYNxFv+9Ua/h0T6CDO2tTrkn5bbzLfFti/O+4mV1+lZFcIurCpsBTXHUwMDFjkLd4kjFcIphh0lxueHRa2pRcdTAwMTX29npcdTAwMDVcdTAwMTLDXHUwMDBmxvp+XHUwMDFhv/HbhaspXHUwMDAyS2KbtVx1MDAwMnBQ7lx1MDAxNVx1MDAxYe1cckozRIOoNKxXQ2RcdTAwMDMv18BxlqGcpocx3/Hb2PLp90VcdTAwMTG0odfTXHUwMDE2aMdcdTAwMTM6tFx1MDAxYVx1MDAwNjntwvarKVx1MDAxOFx1MDAxNVx1MDAxNzZmRajYeCm3wk3eb+iWTjaUnou4XHUwMDE0UZ03XHUwMDFj/eia5LfmT18oYlx1MDAxObpcdTAwMTWr8Vx1MDAxMFx0XHUwMDBlXHUwMDA2uKNUT1x1MDAwNlxmZate0frzMJ11itFj8zCR0HXs4k1FqDg2ZFx1MDAwNSWMeUSuVFS+mkSld1xcfpFcdTAwMDT/PJqszNNQkKr5vJd4XHUwMDE4XHUwMDE5XHUwMDE4V2uIZ1x1MDAxZnP+5lx1MDAxZlx1MDAxNz+hkv1GUbLx3u9cdTAwMDaz/qazUVjATCZW3mZjXHUwMDA2cVxii9w72P2CUOBHllLObTFfSiG4ilwiuuqD2+Py3Nek0CChx1x1MDAwYp1cdTAwMTMms/qgXHUwMDFkXHSo/LVP8Hxq58PSvZTQP71cdTAwMDZpXHUwMDExYYRp8v29lOs7d4ynjMrfP2NB9neRozesXHUwMDAxXGbweHV+sb2xty1UX1x1MDAwZVNcdTAwMWRlc7i+1V7eXHUwMDEyK1x1MDAwMHDzRo2oXGKQ+ruCjm/RYFx1MDAwN+hzh0Pd6O1cdTAwMDbY2Ip1SYRq8uuD3jo+uj75bXXU51Q2XGZzx1x1MDAxN4OxjFx1MDAxYdaMgdzmilxyXHUwMDFiXHTnXHUwMDE2LexHXHUwMDE0fuRcdTAwMTHCXHUwMDEw9nHaTqBcdTAwMDZq4lx1MDAxNFx1MDAwMtEx1HN6Kr84XHUwMDAxi1x1MDAwNyeMXHUwMDFjzY2vK1x1MDAwMjGNXWlCPJQ8301cdTAwMTXzOY7HZXzAhq5pWIizqlA2NVx1MDAxN1x1MDAxYfFcdTAwMWLrQru7fVx1MDAwZoF2XHUwMDFkY1x1MDAwMcgzxOM0pjD5i1x1MDAxM5VXlFx1MDAxOHsvXHUwMDAz34Et5W14Q/lXt2SUad5eu8hjI6/KQ/9hyicwXHUwMDE1iVx1MDAxN61cdTAwMWJThFx1MDAxYlO2Z/zui/F8L6ZPg/hVU1a4XHUwMDFjQ4XKWo1TY8eIaJjvc2x/9zfnqCXH3joqfmnPXHUwMDFkyE9cdTAwMTeYrTx9mSMhwVxcUFx1MDAxNPxcdTAwMWRcdTAwMDWP81vUI8z3oERlxYTB532zupzMVj+pJSsg2pJwqrS+l/l6+XLvMXWN45pcdTAwMTTKq8OJkNmbTOGuJ/DS3KtGYW5MXHUwMDA0Nea8h/1ccq5e3lVW22NcdTAwMTbZV+NcdTAwMGVcdTAwMTl/bbvkXHUwMDE0XFw+nEyqNVx1MDAwZVx1MDAwMjsm47NJwKVhJoPd8Vx1MDAxMj5cdTAwMWXQPfHVw3FcdTAwMGKHXHUwMDEzR4am8o9cdTAwMDF4oIiTOCDiw2jvsp5cdTAwMTa8ePO6XHUwMDFi1q5ROi5cItDMYlx1MDAwNYfPT4rr+VB+YlFUf1qSVGLxXHUwMDEz3HbYQsLrfbpcZtP4XHUwMDFkxFx1MDAxMWTy2mNcdTAwMDCj5zs+m8vyvMb+bL24eaxcdTAwMGaKz/PBfuPQUq3/nXuuSJPZZPFnW+FcdTAwMWW8dkNcdTAwMDXU4IGNV2e0N1ZcdTAwMTSo1HNGdjKByER9QUTm+v1cYmEuJUVgWGRZXHUwMDFizHTlvFx1MDAxN7Z6Krzai/hYXGaxwlTuXHUwMDFkd1x1MDAwM7bIa6y4o0NIf1x1MDAwNlx1MDAwZuqDXFzmXHUwMDE4IEO8eiNyhiNUP1x1MDAxOYJA85NcIn5Ke+N/MFx1MDAxZSiaXHRMiOVcdTAwMWV4SN7iJX1D5lx1MDAwNLqcwlrUu1x1MDAxYSD1+oczqm9cdTAwMTSx/cNcdTAwMTleXHUwMDE3XHUwMDE40tcwcT3U6sRjnNhcdTAwMWGynt2xRFaGXHUwMDE2N218qk9mmfneYdOiaVuXu9e7XHUwMDE2OkFlXHUwMDE4MkAwtVx1MDAwNiFcdTAwMGLYz7i+xfj+5qFcdTAwMDJ49HaRUGDA0lDHfFx1MDAwNO6jxlkvXHUwMDE15Fx1MDAwND6jS+hsW6bzk9zMyZ3ccS9cdTAwMGKdxe+9lTtcdTAwMTXE3c7sgFCC5JDeW/JcdTAwMTGeRlxy4Z9AK+X0XHUwMDBlJ8b3u6tfvN3qpjj4pU52pnO0XCJqXHUwMDExnZNcdTAwMDfLeXvQXHUwMDAx4ThNh85z11x1MDAxZZnmK7xFwbZcdTAwMDBB38kvvozMciafleF2XHUwMDE2JMjq3WY6ofW9Q86Vod4mSKn2iOBWXHUwMDFjxrJe3vaytndhOeV+niX053j7tFx1MDAxZKWlXHUwMDE43JFQprIpe1BdhMrtO9xcdTAwMWO//b1K9mRuYfdXJEza3KGeQ+TfXHUwMDFl//65N8VKjJhZzOUgty1Etima6kRYmEmMN1x1MDAxZGxksUXORbiQXHUwMDE3ITBdlnWVlv1xs1RcYlxc6Vx1MDAxNlsydf6R05y+UJmLvV7Ym/em0pkkRtNDXHUwMDAx8lx1MDAxOPVQNJ48oXZwo2WvSFx1MDAxNKJr+43jXHUwMDA3cNPP4o9cdTAwMDRUXHTmh+BcZpXnXFz2mlx1MDAwMVCWwVxiyDDLgmjOxVxm/aSfqVxud7itck8s3Vx1MDAxYodRXHUwMDFhn1V+XHUwMDFjmz+bS9J241x1MDAxOOpmT1xcS1x1MDAxY/D0capcdTAwMGb+LbZkcMG4dNOtibR4/vgoRdA3ZCRcdTAwMTju7/c7XHUwMDFlo4icyWZcdTAwMTeQqi70rJZcdTAwMGLKXHUwMDFlvm3y64VHxmUkLuZWt+9NhdlSQy/wRfmAXHUwMDFl81x1MDAxNX6yLC1cdTAwMTUg0qUsf1x0dVdnxGPXS8HmV8lh3/WELmyXy/pxw1hzM+iigE8guKx7lK3z1VxinlZcdTAwMGK3j/tQslx1MDAxOYBcdTAwMWaeeb05I/lIybJcdTAwMWNYcKpuL6lv+UOm5nHQlW7QeVF/1uN0j0OGXGbWWrHnYFP3PGjtjY42k45kJsNcdTAwMDNRpjtpSLZiR1lwSuNcdTAwMWGJXHUwMDBl4UL2o3G48qE6XHSLiGcjnFBa7e5cZuFcdHyMQIRcdTAwMTKwR9OtaZqJJiSZh6mH2jLAXHUwMDA3XHUwMDE54pdhoaR8c1x1MDAwNFx1MDAwMIgxipnPI1x1MDAwNP1+XHUwMDFmcbLuxIjwXG7lO4aHgtw6attcdTAwMGXkmeBcdTAwMDUl4bdcdTAwMGK7SHBE+tv8TkAgraCVhZ28XHUwMDE5UUkgvXJuXHUwMDE58GEkXHUwMDA0+dSV9sMxZZBcdTAwMTWGYpFuKYT06L5Na1x1MDAxNIZVXHUwMDFmgujL/OfkOlx1MDAwMMxL3KdjsOSYhFx1MDAwM5bg9Y+nnFx1MDAwZsZcdTAwMDHS+zm/4o/Gbl1iPywvxXEqenZcdTAwMTkvm/Ct3XDBr1D0UVNcdTAwMDNsgMUhgd1cdTAwMDL7IWjns+LolYJnkFx1MDAxNUlcdTAwMDUoud+4vv+Ex3z7VDu+lpO+2N7mxdetfZi9XHUwMDE5+0f/lnHGji4+1E9yVo/Xe/NcZp1cdHpcdTAwMWJZ01x1MDAxOPrce7oqJMY7XHUwMDA1jaPlXHUwMDFlj7ZcYsJbvrC8dtactVx1MDAxZdVcdTAwMTL7xS/EJ+x0hrJoRnxcdTAwMTOVXHUwMDFkklxciHUm98qg27tcIrw64DCjqVxumfk05JGNPE6eQP6i84uMxnTD3mmltlx1MDAxMsn7MbZLvKH+6YjvQ1KHXHUwMDEw89RcbvBqZ/DFzFx1MDAwNFx1MDAxM8tcdTAwMDS7nnaBtm0oxGY47UOkXYqdlVx1MDAxMbRT2K9cdTAwMGKuP+G/dWB3LblxXHUwMDE0XHUwMDE16lx03C6wPlx1MDAxN+RVjMmLbUO+TS7BPbxW6XlHIVx1MDAxOPjBaqNUXHTeXHUwMDAyt8lOYn3dUKCdabjOw1x1MDAxNb+CuctcdTAwMThC72q8wL28b79OIFx1MDAwM6eMrFPASrJcdTAwMDElXHUwMDFk+UuFxPdcdTAwMDGwUbhs9kfHRVx1MDAxMVx1MDAwYvc+YpeB+5v7e1x1MDAxZVx1MDAwM3dcdTAwMTbPdyyPaTi1xVwixqlcdTAwMTHyn3xcdTAwMTnB1+uBdmtcdTAwMTkxlFx1MDAwNlnhK0ueJlM5TuQoXHUwMDAwK1VbXHUwMDA0rJu37WNeXHUwMDBmXHUwMDFmLVx1MDAxZF52ce9cdTAwMTF3XrKrlMxcdTAwMWKHasatXFyfw1x0XHUwMDE32G5cdTAwMTP/1Fx1MDAwZlx1MDAwMIhD9Vx1MDAwNIsoelx1MDAxZUdcdTAwMWJcdTAwMDFl/+yPrImZgbmV4HiBcl3DI1VcdTAwMDCJXHUwMDFk0fRCTDktfrSLeN9SXHUwMDE1u1x1MDAwNShzeyBcdTAwMTZkiriaWbDe5v3JM3hY3Fx1MDAxNoB0g1nzXuqQTbBcdTAwMTWnJZJAeaLb21U8vP9vXHJEjqFLrH/QVEHlNJCc1GvZdtfZXHUwMDE4XHUwMDE4+ShNJVu3Qf5cdTAwMWVVK1BsfO6w5DZcdTAwMWLNru9puYrIsEuGVOKSQclbq1HJt15rIYr9gLtJgCtcdTAwMWLBn1x1MDAwYlx1MDAxMytcdTAwMDRCz8q7NZLxXHUwMDFiNztUTOHU81x1MDAwMZk5XuxcdTAwMTJ7Ppn1/GBn+VxmzcSTgkeG3caIXHUwMDE24Pr1+bTH8Fx1MDAwNFx1MDAxZpnD+L3eaP9+9/i9/vWyXHUwMDAwllqf0TFaOPVcdTAwMTlcdTAwMWJ/OSBDXHUwMDFh1YGnXHUwMDFhQaA4biTrapzY4GbS9/B5XHUwMDE52SfGtUHuZkCB7Fx1MDAxMXZii1x1MDAwNKJC8kZa7VxyR0nFW1x1MDAwNeGJXHUwMDA3Yu9ccrRwXHSWkLGUoum65LzlxuPJXHUwMDFiyU/H9MWniNlNQpGncVx1MDAxNEnFcIvf8pw4veDgjV5UWSdcdTAwMTYqWmqZXHUwMDEz1ueedd65REyNRI3lXHUwMDBiYfR+OkRkXHUwMDFjxjHYsKYwbTvGfSQxwul06D1cZlx1MDAwZrhQ7ZZcdFx1MDAxZirUNTujppxdWFXTaJ/rvYdvmDJdr1OS9TOQeO61WzerolPc3Pdi8nvJs1x1MDAwNszAXHUwMDFjV2NgxkWtQ96KXFxtgppcdTAwMThQQ/2mT2NcdTAwMWGOydbtXHUwMDE3M1x1MDAxY258YyZixIG7XHUwMDFjyMbEiCwr+Vx0vIB2bFx0+ENcdTAwMDVSXTpC0yB8rHBcdTAwMGLXXGZ1ZbBf71x1MDAxNZeyovjsllx1MDAxM1x1MDAwNUVcdTAwMTPdIOmTh+LsXHUwMDE52nAyWY9dLpVe3XUtdSWhVVx1MDAwMz5+o1x1MDAwN8hHqlx1MDAxNFx1MDAxYZ+eeH26b0+BT/MwzDhcdTAwMTbWal7tyVxikzu8plx1MDAxMifDTz+13G1WsIfh75/IjX/fmbGGXHUwMDEyKjb8hf/ExriFsduwup3YW4QhOlpcdTAwMGI8tfepXHUwMDBmrvchk11cdTAwMDb7PWfRWPZEh6/XdarisXOLmNKZOfEgtoGAOdavW1x1MDAwM1x1MDAwZaZfukNS8fNTuPf1PjNcdTAwMGbI3YlcIlx1MDAxYqvdRC/sYU3WjIHcii3R89VPS5hIKZjw0s52KiacysrRyjvK8/ZcdTAwMWSAZU6vZLBcdTAwMTJIqWC+1o6EXGbbx1x1MDAxZlx1MDAxNv/0hOBwTEp9gPqHm9tccum4f3vH0Tzn2zv2mXGSqVx1MDAxMEtcdTAwMWGfr2RHt37MrFiV2f4v38AxgiPx3Kcuxi3JXHUwMDFlpD6UOFx1MDAxM0ZEXHUwMDAy9/PAfmOLfbBcbo1cdTAwMDXS41x1MDAxObQqjcDJ/IFcdTAwMDR666KL0016XHUwMDE2XHUwMDA1K1x1MDAxY9TbyjNcdTAwMTnIpiRIj2NvrTI7vigktCFRXHUwMDEzXHUwMDBmxu8ws/Pi+d+YVemH9ZxBfvzbnrCNQVcpo51ltPuDgr3qXHUwMDBl1rXnXHUwMDAz0FVcdTAwMDTGSz9+XHUwMDFlTNUyXHUwMDEyYVfOXHUwMDFm1vZCL944WW9YrmNrXHUwMDA0Mlx1MDAwMfS2nNZaztZcdTAwMDFFqrm8xvjq/vBm4lNx2Vx1MDAxNvbYVo/AvVqdpcUxbjPXXHUwMDEwSVkjPzqp2Fx1MDAxZkosMUpmJ7JcdTAwMDIl5oLSXHUwMDE3qFx1MDAxY7dKhTZF8DXBfjOrYT7dmPnDSYHxXGb2XHUwMDA2y5g/v3HzbUQ/5TPtXCJi4IxHmsc2idiKN997flmuvblWhplcdTAwMWMwKlx1MDAwZvOnXVfBI1x1MDAwNIuhqzF+9PurvFVRiD1cdTAwMTZcdTAwMTmg+Fx1MDAxNVK398i+k43545RMcSBOg5IqXHUwMDFjy0o7sMxcdTAwMTSx6famXHUwMDFmXHUwMDFjpJ9cdTAwMDJqnFx1MDAxYbQtXHUwMDA2uprzVo9rUjqeVip89PlsjY5mR15cdTAwMDd4u1hcdTAwMTD5nlx1MDAxZFFcdTAwMDV11U6MZv/qOKfyKr5AIPWHmZ+9dtzRL0pcdTAwMGVunrH5XHUwMDAyU/3x4Vx1MDAxMVZC7W5cdTAwMDH63rFyuVx1MDAwZf/pZ7lcdTAwMTCAkis2JzeMg6R5j8TLaCsscbSGrUiicug/t1bspVx1MDAxZmZO/ahzc3viTGRstoE/s9p8J1x1MDAxZC/enH9wWaHhx0NcdTAwMDI/8Ua9VtWAg5qMaJbrXHUwMDEwfrdXXHUwMDFlWzPO+HqaJ/PzNTHHcFx1MDAwMCF/TvxisVx1MDAxYlxcXkyQZjdcdTAwMWPoppxsokaDwNHretlb8byCnDsj8G2M5U+NYc0v9lx1MDAwNPaWWu2ye6qE0SWlQ8FcdTAwMDAyyqOho9ssSl9cdTAwMWWrmUZhT1x1MDAxZufdtn3Bc5us9pjSxFx1MDAxYXWMtr2Qp843LCDfXCK+ZPV9XHUwMDFiJlx1MDAxMF1QVKx34N1cdTAwMDfjO90tp1Q5dZ+v8/1PXHUwMDE3fPNAVc+xnHV0WvvVzG9U87np0i2E9Vx1MDAxY1x1MDAwNO138YkjRlxykynbsHmMm0BkveNbo345Kv5cdTAwMWaO0lx1MDAxNVx1MDAwNTKJla5cdTAwMTJqKUBcdTAwMDSxoediuuz2XHUwMDA06raOXGJnV1u3YaOyYVTfXHUwMDBiXHUwMDA01XyCq87TddHJXHUwMDE4ZrdvJHrd4lx1MDAxOICYJ1xuXCKRVn8kz7ExXHUwMDAxXHUwMDFhXCLbofJcdTAwMDSgVulCydVcXCTo6SRt9sG1iV9QymV+9P7Fy8J1XHUwMDFjSkJcblx1MDAxZDVuXHUwMDFiamhcdTAwMTA33nSv7o/XOk5e8/RBmkjjV7HQXHUwMDE0V6O7+vWM7XHZyv7NcUk7JzmPXofGgWpsz1xiulxyjO1Fz4hGUHNG/mlYx2FcdTAwMWRF0yurooZRo2Wf1mRcdTAwMTK6ybtLcmCLmVv0i3eEQzfFqq8gvUFcdTAwMTLJXHUwMDE1XCJcdTAwMDbpOb25fWqX61x1MDAxOe7CNrKWsdCMXHUwMDFm9cI8g/sp/Mb/+T04INO31NY7Qy7IOzyY7lGy7lx1MDAxMVx1MDAwN691J0xajucoXHUwMDE54NLH3PTe40TLsFDsln31p/FcdTAwMTjljs5iy6YuwkhcXJZxXHUwMDEwrdVcdTAwMTncbvvHbVx1MDAxMPx82K0jXHUwMDFmQ9l8fy/DcbVcXLyd5Vx1MDAxNWQwYsxhZ5pcdTAwMDBcdTAwMDJWOrTBw5bALv1ajV9ezlY67FZcYrxeXHUwMDA1XHUwMDAztZNzgfBT8zrh+Fx1MDAwNdE8zNZcdTAwMTXQZsnq2Ogrc50/3G946oZROa5R8beH30dWyG5cdTAwMWRcdJPC9VOwtNtmeJl1YL2wbEpcdTAwMGU3+JnEZ8vgkCcw/3zk8/tzbr150Y9NxVC2yKztkZlhsM/UI3qp0D+O0Fx1MDAxYzHlXVigI6ZBW+iA8Vx1MDAwMaRSYXlfXHUwMDAw2S5+fe97rC7cU1hLp1x1MDAxMSPxdIBcdTAwMDT6YLZVgMvk9Ofkze9xXqVcdTAwMWQvmL9Y+qZcdTAwMTAqo1BcdTAwMDSFlJI1XHUwMDAyYoPt5i//RvOTiZF+isRcdTAwMDGQWFxuwE3LcEOExE5cdTAwMWZd54dbJJd9r+RcdTAwMWZcdTAwMGbovZDd2Mo8llx1MDAxMUtSfIYliubUVzvuLUxCSfbTRixcdTAwMWIw7ShcdTAwMDRjkahcdTAwMTb6aetsZk+M3FZUXHJcdTAwMGbQ4qRo4Gait1x1MDAxYVx1MDAwMnS/p7L8lCn3NndzY7uF18j5XHUwMDE1olx1MDAxOTWU0lx1MDAwMlx1MDAxMIRhvp+GUpzE489zdcJcckr33t47WVx1MDAwND9JgYeJXGKJyuuhXHUwMDA0OrFE7UCI7CubMVx1MDAwZlx1MDAxZFHMxT7zzIZlvvJV/E8zM70yM2SETlZcdTAwMTdZ5KdOXHUwMDAwxMe+vc/2PH4/koJcdTAwMWTO31xcMYWspi73WVx1MDAwZYtcdKm0Mlxm2LzUXHUwMDE2iOdk1JqC36Hm8Vx1MDAxNGxcdTAwMDbQTlNcbowqj1Bu+Vx1MDAxYyVlqcqi+aU+UpQ4XHUwMDFhjdiJfYiwTfPD1CfLXHUwMDE4zOOsZlx1MDAxZVx1MDAxODaxnVx1MDAxNpDVV1Zz2aVyQYR+LVJF5fV+bMG8ZsIme7jsYzzCxVx1MDAxN//jQ46FmFx0XHUwMDEyXGJlzeyHXHUwMDE3WDSiPdV12lxiwURcdTAwMWTR+sf3rFx1MDAxMLCEcSTtI1x1MDAwYlx1MDAxY0Tb8s8gJVmuXG6T3D5cdTAwMTfA24FlIUG0+s4npK5sYPdgnELZXHUwMDAx7p1cdTAwMDc/WVx1MDAxYiz15XJbXHUwMDA12clPXGZcdTAwMTmPT79a/4KoeDNcbotcdTAwMDJv3FjyKLZ85izV9Vx1MDAxMahcdTAwMGJcdTAwMThcdTAwMTXnUMJAXHUwMDEyx1x1MDAxY33uanq1TsFcdTAwMTCRTiDed+1cbpniolx1MDAxYo7AyO1cdTAwMTN7rGmA91ZcdTAwMTBcdTAwMGLP91x1MDAxYtIgXHUwMDFk0HPF+H1FWTrMsryT2kE2xcdxXGZX9SdwLcIsXHUwMDBlXHUwMDA0KFeOZJaq5TmyoFx1MDAxMOLzreXXtc90vVx1MDAwMKD5XHUwMDEwUZ0nOPeOJoKIbObsZFx1MDAwNu8nviQt57/4KVx1MDAxYZ5Z0FxuuGz/NcmAUzQsp5q+XHUwMDFj3N9cdTAwMTnDdtRtjFx1MDAxM1wimP92xUfBYa9Xc2/Kr47ob5m7hYxcXFx1MDAwNy1nxyAoQdB7mfGZNujucEwrUuLv+lx1MDAxZUzRm7tPxsG6wqFcdTAwMDLaKF0h1FVPXHUwMDE0jp1qnFxi/lx1MDAxY6CP1mHWRpssXHUwMDEx3IBSp9/b9+Xp8b3aUfNmUkdxIcZcdTAwMTM3bY8h5MaRv7lcdTAwMWZfXHUwMDA1XHUwMDA3fs9G1VxieFx1MDAxMXz0Km+wTJTHQVx1MDAxNtG0Y4uIZVhcdTAwMGIoXHUwMDE0SO5DKlx1MDAxYk7p3OOXbs3E/uVcdTAwMWUxJWWtXCJHQalG5WJVwlx1MDAxZb2x5vm2wflcdTAwMDDu6ZzvvcvQzDzAisR9e/sqm25T9Fx1MDAxNj+f+GlcXK9cdTAwMTl5ytNKJLeI8eDXg6OZrHFuvSoq9l50/IRSXHUwMDEyha8o2clTXG5cdTAwMTBcdTAwMTZxXGKNXHUwMDE350PJpr71xIziP765VUVcboaAp0eWV4hDuJe6mECYfKFAYdrnVWttuYnR2/D7e1x1MDAwNFx1MDAxZtL6l0fEONTxeuckblxyXHUwMDA3UkC0Q7Be7br+zk/lVoDfPKmm2ru0/fhcdTAwMTipw3dUKvpU9yeQnelJXHUwMDE3kbWNao9lpdBU+lx1MDAwNb7zXHQstyeZb5cow+HtdddTT4dL98P3/Fx1MDAxY/Yytc1XUv3Lw91cXLRcdTAwMWRegVxuN+60LLk4evRWapEq0Fx1MDAwYkBcdTAwMTfZasY5P81jI6ZcdTAwMTbCXHUwMDFjy8ZKqfi2QISHU/2tn7H/5v9cclx1MDAxZqR6jFxiyHSuV6jKR+xcbu2Hr5rCOHLkJtI6S/BjTuCXbYf+sm326sq16S5uPDDAWt4jeaFcdTAwMDTRXHUwMDAxK50nU76iKzig78BEQuzNeN76Nlx1MDAwYoP5XHUwMDE4tSlcYuloXGJQ9lx1MDAxZnY2917XXHKHdDtma922Yl4mfIzRXHUwMDA0o1x1MDAxZF2dSbRRMUKiSsnLgsBajYuZXHUwMDAy9Mu7Z1x1MDAwZrm//a9M1lTygFx1MDAwZZpcdTAwMTVcdTAwMTBcdTAwMTjFJIhdS9bUKCdjlV9e6cOKzlmEfitGfCPXXHUwMDBi9dxe8jSdqn6CfUVehcaD5HaDSKB0jU1yRz5NQ0Rf9FavfFjHYeFP/Ws92a1a1H16XGZvcr9J6ffZpUBcdTAwMTc38/QsQrrOR1FwI5v0Ls47UNgm+YOUeVx1MDAxNmJhQlx1MDAxZfvu90xCsdE/ISX331x1MDAxY3eRgt2HUy9kZ1x1MDAxNVxilndcdOonZj9L7/Hjd+2bS3olrWO1/Yd4J2A5tbaswjT9ZIJ30nvcp3nV91x1MDAwN/Gx/D5garH2IUdWpzLDXZqUXHJpPd5LXHUwMDA2pkhr73K44289b2tacTR/x47San26+ixcdTAwMDDk3LVKPEU6XHUwMDE49o5cbpBcdTAwMTJGhbHzXHUwMDFippjkL9+nwsyws/S+7DmGLXl2PCy3kZSKP1xyo/3zdFx1MDAwMtOzuq+RLufMJy69KZMzXHUwMDA1/JR1XHUwMDEyoo3j1vu9y3VCLDfGbSpcdTAwMDBcdTAwMTFcdTAwMDTthcsteVJcdGuA+7BFIMZOreAyq97vi3SfXCJ2/JdcdTAwMWI5ipeiQlwidlx1MDAxNEigL7pcdTAwMDOUY7rKMVx1MDAxMNBcdTAwMDRdXHUwMDE5vtW0XHUwMDA1Jlx1MDAxMkLVXHUwMDE2XHUwMDE08YepXG5rMfn0WeKs3NY45NSGa2RsxH3h35lccswswC1k+0mIzXLbUDagtrj2oNT0XCL0w8Ta+3g+IGqeP5ZAU+iHXHUwMDAyV2D83lRf3mGPM1x1MDAxZtjUR2dh2OAxeFn1XHUwMDFlXCKz+UjFP61xKyT/1rgwcFx1MDAxZFx1MDAwMa+w81vvkqjzdnWEbz9cdTAwMDFcdTAwMDRcdTAwMTJu3lonq5UhdqwvObb3lHiFTDRDbpWDj+lvmNRBJ+Tq40/kMLvyYsXX6qiBg4U08DI7PIA7me5cdTAwMDB8VKMwXHRcXHZqNvBcdTAwMDbA10Zu8vWCbn8vo/SQLVx1MDAwMIw2MlPoLqxV4CMsVVx1MDAwMVBWulx1MDAxOKzuYf15k97elfJcdTAwMWJcdTAwMTPeI1x1MDAxZLnXMlbwfpDQo4OeIfp81Fx1MDAxN/nuet2LNciUdc6Dvjq4T3ctZbZHO9HUXHIgwEcj/Fxu8Id1XHIzjfrWXHUwMDAxxFx1MDAwZmWX12BcdTAwMWVVLWxatCFcdTAwMDNcZtlqhD1cdTAwMDHMuoxcdTAwMWNcdTAwMDArkVOJj3PaxZTOOSg3MoGxNYmqo3lQjEai7MwlQHqcXHUwMDBmXHUwMDE4LWpcdTAwMTJhe+71KP/Tjtv+4Fx1MDAwNIJcdFpr46bJXHUwMDE1NDxcdTAwMWJUXHUwMDAwo0RcdTAwMDNMQeH1eVx0M2jtXHQ1p/f3eZjOOJNcdTAwMTOx8V+s8j7XOTokvqitnHXwm9NcdPt3z+83ppuCoplcdTAwMTlbcOFo9zdcdTAwMDOBaVxuTWRcdTAwMGbKdIm+h8/WPp9cdTAwMGJz7P2HUZ7cmPN0J1x1MDAwMmv7mHH09eng4nSdQuiQV01elnTPfEE1yfTTWd+H4Fx1MDAxZd9cdTAwMWGWNFRcdTAwMTdvv9ErfFx1MDAxNVx0s3VAdWU4eVx1MDAxZIgsxlRvUWaaLFr0kE1cdTAwMDXvXHUwMDA1TWBl41x1MDAwNKGqeHyTX2p6i92WXHUwMDA0XHUwMDAxoedullx1MDAwN++P/2xcdTAwMWSbiPGZsVT1Lpy65Vx1MDAwMlx1MDAwNvLgZUJFeP6Wta3kM5TRj6rXm5qJvKSh3VxcoFuyZVjD11x1MDAwM1FLU0pJnppcdTAwMDLPk1xcgnczgecjvVjpxNz1W3dxb+5BKMq4kJ9cIjfpT3F5O+JcdTAwMTYh5yZhOOBcdTAwMGVSOMzrQ6Zx32Ctrcf7/otcdTAwMWJ6+/iwJIeRXHUwMDEx3HBcbkgwTFx1MDAxNGJTYX/PKtpGzVx1MDAxOEJcdTAwMGJcdTAwMWU+XHUwMDEyxVx1MDAxYVx1MDAwMTg0fqBcdTAwMTG4OFx1MDAxMPpUeVxy4Vx0+Up6XFzXVKWQt1wiqkBcdTAwMDfFXG66XFzQXHUwMDEymWKqXHRq6t3Un7mcNlVEXHJlmoqa+Fd3c1x1MDAwYlx1MDAwMOFkgoVcdTAwMDdnWHVhXHUwMDBiJD7ddI2JdeBa2b715jFcIoHAeENIvLTrr1ZEKtw9gOSYLZ9cdTAwMGZcdTAwMDEqTudP3uz60JaX2/TdOMhcdTAwMDew36pcdTAwMTVBKJqFq1toz5aAXHUwMDE2iY84XFy0Rtf+MIHiXHUwMDA1XHUwMDAyRP2CTGBX4pePutSk11T9N0ZcdTAwMGWc7Tv0/iVMXHUwMDFkplx1MDAxN1x1MDAxNIghk3u1XHUwMDFhM/DqXHUwMDAzNlx1MDAwZlx1MDAxMDG6XHUwMDE4gJeQbs9cdTAwMWXnKN6ocFFjZJafO9X51YhcdTAwMDCc7FxyTFxucaU7cb+6kfvjXGJBZbSXr3dNXHUwMDE0+JK0XHUwMDAwaMm+luE4XHUwMDEw3axcdTAwMDDg5PrXpHKKsLDat1x1MDAxM6Bn2Ui5QYK1XHUwMDE1XHUwMDFmk36EzjwxZlx1MDAxOVolSb25My5mgVx1MDAxY/702Vx1MDAxYTC9xLBIL556IMCD0M5AxFVcdTAwMTmN5uCAlDcgXHUwMDBmXHUwMDE4mVKawMs6kkOfLzCYjppqXHUwMDFmXHUwMDA2rqGKTsKA3f9pLDn55c/7UX/Nw/hGj/yajs8727RPeZk8wmTOiIRcdTAwMDUnu0jJtlx1MDAxND2q9Vx1MDAwN5jSXHUwMDEzkCAuKJE4Uy9cdTAwMTgpqlx0XHUwMDE0JXSWblx1MDAwYrUm7f6ng+5ccn17QJdLWoRcdTAwMTa80KXnXHUwMDA1o5/kXHUwMDExyl7tw0hWpy2hR8RUOSpcdTAwMDTKqlT/zrrG9I7I3p+pXHUwMDFkO40/LypjWPN8+VXWh2t4ldmrXHUwMDFi4lx1MDAxM1RIhbfOoWZcdTAwMTTTcpRYsPAgej7PM+uk4bh6cUxOYWbislxi0raYXHUwMDFlXHUwMDFmXHRH0lx1MDAxOGdRSNgv+bd/mG/tXHUwMDEyVOi7+Hpf2Fx1MDAxMlx1MDAwNym/9O2TbM2opqxzfU8tW8xcdTAwMDY147wqXHUwMDEwzT3jqmky6i9cdTAwMDbXkis4XGJb2T8u2JmEXHUwMDFkgotpX+poafttXHUwMDBlmsLMLaon+Vx1MDAwZvJcdTAwMGWfWtnRuGpHXHUwMDEwRtn8Vfksr+aZcp6kaFkrd7WrkTPeu3Hm0aisyYyeM1coI3g9XHUwMDE2ki1Yk0vOf+frXHUwMDBipFx1MDAwMveAfWpkk+p8SOZZoW17aOsrSYVIkueoXHUwMDAzOGrhXHUwMDE2/rhOof6F9Y2ryLlcdTAwMTZcdTAwMTEx8yyflLruXHUwMDBixoHdcSvsv/pcdTAwMWRmXGZcbsSt1txP6YRcdTAwMTdcdTAwMWZEmHU6hlx1MDAxOYc09YlReMOcsvpcdTAwMDUvN2tcdTAwMDW5Zlx1MDAwZrdcblxcZ6JMVMVcdTAwMWFMXHUwMDA3vFxinWGrS2M/+1xu6I87XHUwMDBl5MIhnuJ/uSmeXHUwMDExayZcdTAwMThR9Mt3wVx1MDAxMsNcdTAwMTkwwkecVl3b2TiC12uvc8GyXHUwMDFlMm36MWflO/ZknM/3POpBmFx1MDAxYefA+f59k3dLkm5cdTAwMTVV3bSM8pu763p+sibuxiyUdfNOqGWgfTZcdTAwMDBg2LbjlFx1MDAwMpGZI4TYXHUwMDAyQbEkybOG3KFcdTAwMWZS2Fxu2Fx1MDAxZlx1MDAxYn/QPbI8bE71IKGhhI9lK1x1MDAxNlvO6/RcdTAwMTT+cUJcdTAwMDWU2jMh1PxJSv1gjlx1MDAwMFx1MDAxONHhbFx1MDAxNVx1MDAxM9pNSVboRDj01fFkvt6JeN6Kwvn+1qaSXHUwMDFkzWdzYLlFjFnpTOepg/piv7EmKrf86SDvLLXAwXmMMOAnXHUwMDE5ZVlS6eGm3WRiWttcdTAwMWLoNWk1z07SsPNqK/dkWEVpeH5pzOhYYInox1x1MDAxY2OblcApeN1cZur+/tZCXdIwd6pcdTAwMTBi8cNRXGbA0MN/WLmxumIkS1x1MDAwYitcdTAwMDNn1tzY66/FfvqoraDbM5PtvqtmXHUwMDE49KFcdTAwMDe4cSlcdTAwMWJcdTAwMTRgqr9Px1wiLMX5n5qOwlRcdTAwMWRmc2qn51pcdTAwMTJcdTAwMDFYkVx1MDAwMYlWo02cXZNcdTAwMTD7YV3FXHUwMDFhLPrU+UdcdTAwMTjCTy+DN0V6PjFcXN+ia4uBXZdfif9Yhmg68rZcdTAwMTX8WrGu50uqgVx0dKdcdTAwMWTSMUGlSKxY4lZBKIGF91x1MDAxYpsztXP/clx0xpg6KsUtjOYziPzsK1x1MDAxNO7T2yW3UmyEQknSppZN8L1cdTAwMGXkQPNcbvZXL6jHesOBZmkz8tkyx6WZqdp/60k1Vnf6l/lcdIfXLlx1MDAwMfmDbnD1UttbysfrXHUwMDFi8Z3SXHUwMDA2ZUhcdJDAzM/45Vx1MDAxYe9cdTAwMTKgj1x1MDAxYbZQPF5cdTAwMTSEa5TmZS+PXHUwMDBlZL8x7/euhVO3NPvbn05SuOe991xiz/PVUFAwqvl2WVOPTLLVXHUwMDEy/4xPLN3GIUqUtaaOXHUwMDAxXG4gLnyH+1P6njFcdTAwMDc/7ea0XHUwMDEzvtuam7DKXHUwMDA2XHUwMDExWXDVfUr99JGhMUIrYfOoub1cXLzJ7lx1MDAxOaCqXHUwMDA1JFx0pyDblFxmXHUwMDEwrvI2UO9cbiN6zKc71lxcVz4o6W6zkc3wY1x1MDAwMlx1MDAxZGJ/64i0tMD3yTqXu0Y83c9HTjYwJpfmTJXHTyvff1x1MDAwZld3XFzsplx1MDAxONVtN9JcYlIv6lZcdTAwMDRMXHUwMDEz5lx1MDAxNepLQHdTXHUwMDFiPXDhNHrem1x1MDAxOZVgLPF6lV8o1Fx1MDAxNXe8ZbOOr9dT7NEupkuTiXBHXHUwMDE5x716/VvPrJBItVx1MDAwZlx1MDAxOPxhTu9l3H3qpPIuOG6zqK/TXHUwMDFkZFx1MDAwNKX4jpCaczinWWqzZIPnW1x1MDAwM8GwQ0hdxJV3qEb1aW6RXHUwMDE3bVx1MDAwMrhaxalBr1x1MDAxOMPr/+plZebWklx1MDAxYVRUmFwiXHUwMDE4I2dnTm3zdlx1MDAxN3InjddkVu6+ZVx1MDAxYr1071XZ8jao/p6L8H86joUggrHnnPL416fdXHUwMDE1KW+i1zxfIXa+vnmtoHgkMCalM3c+XHUwMDExTok8j6KtXGacictcdTAwMDZmUPlcdTAwMDR9M4+T/T6ypH7XpFx1MDAwMeROXHUwMDA2XHUwMDEz0jBcdTAwMTVa2EUz38U6hCuqRVx1MDAxNlgvdonDJM83bEXs6f9cdTAwMTPRdv9p2FdcdTAwMTG5ZeSYXHUwMDAztyiDXGY721VTylx1MDAxNZCgnM90uyBYfzN6epbN/s0l4d/XgJdcdTAwMWJ3tldmSd3q149cdTAwMTV03WZ6gVnOj3puv3vly/eWo2asj/mtY5bwhVx1MDAxZlxmaqGyeXvUXHUwMDE3Km018Vx1MDAwNJzLPFx1MDAxOCttXHUwMDBmtPUuqlx1MDAxY+z0Qq/Wqb2IXHSe3Fx1MDAxYsebtIFcdTAwMTBcdPfbZTrsyyBUZXswXHUwMDEzXHUwMDBiWn/5b7X1XHUwMDFhdqCCjpNGrzlcdTAwMTA6IVxyLE6PkVHNtWiz8OxcdTAwMTk2bT9tXHUwMDA3fWvdXHUwMDA24Vx1MDAwM3Etk4OR3FGOulxciFx1MDAwMcxQrTjQOLlKKj6h+pffd4rH97ztXcC3XHUwMDFkLT7EumY7dnlH9Yz04Hri8Vxu2FO61DDjp1xckDDDx9TGVFx1MDAwMW6rondcZlxi5qFcdTAwMDeJZ23bwu1cYjZcdTAwMTfFJbRcdTAwMWIutEo7mlx1MDAwMlx1MDAwMHy7XG5dLm/cYVwi0tmN/85DcSFgRtZcdTAwMTHfodKary18x5d8XHUwMDEx8nymU/FIRZyJUcq9PWM84MxcdTAwMGbjW/a8g198XHUwMDA115FTSTyvRvsoJCcnVF03XHUwMDE54+vR4oTRtTRkWt1Y4eUjq5ebXHUwMDEw1Fx0XHUwMDEwZmZ4IapcdTAwMTiZrEgwIy23qppNKpK6Ps3qU9xkhUBcdTAwMDZmXHUwMDE58ICWI5Vbw4VXN1/+yJD/aFx1MDAwZXW/hFxi6kTrP719/17Qv2VcbqKm/atrPZS/2fRbl2XANjyZS0T5XHUwMDFiQLV7IWq8bty0+S0uVoxeWIv6nlx1MDAwMqnrYow/cERcXHvI0sVcdTAwMDVcZqmT/y+36zLqq1TfrtDFMMmnYaR+KFxucIZRhNOTTvlcdTAwMDJzXHUwMDEyXHLehnPcU3qgsE2O8lx1MDAwMsG3V4CiXHUwMDFhLo2J6vplXHUwMDAw8Fx1MDAxY6363NXjZaVCuy1Lr6Jzw8e/nMgut4yhuOuyPF1wXHLIQVdVxFx1MDAwZcYuZsyCTX0jrHOm/eJ+jvLm+cX9kdV7teFBcnBzjMhrsslTsZxDXHUwMDAwYmUzzKHq1qaKXHUwMDE1XHUwMDBi3/q7VeBcdTAwMDND7WLKlL0zbbs6XHTeXHUwMDE1fLtcdTAwMTmfNChgukPSa1x1MDAwMZzL5Vx1MDAxY1x1MDAxOeBcdTAwMTVcdTAwMDSy4DlcIkScO+5cdTAwMTO6QLZ4YfdGbmPdmlx1MDAxYbJxcI95TlB9XZH0XHUwMDE0XHUwMDExfcgvkIfUv5iwWFV5KJXkkeZcdTAwMThcdTAwMDJcdL/fn/aGPGm+wDhNgou8NInivutggYDRfddB+a5D5+Tk9mnAuuzgV0nPpr1cdTAwMTN34PWPh/fttnz7XGaNhbjphr9+XHUwMDFlT6Q13pThpsd1j2KCSOE43snwsNpt1Vx1MDAwZWtRs4RRI5JcdTAwMDNcdTAwMDBwIbv3aKLYKz11XHUwMDE35Fx1MDAxYUHQk7Jx3Fx1MDAxY61cdTAwMDea7v1cdTAwMDVMPZP7d1x1MDAxNmRcdTAwMTfqln3EXGZ3PrzCTVEzdHRxxEdcdTAwMDS4XHUwMDAxkFx1MDAxOWz9XHUwMDFhXHUwMDFhLlx1MDAxNXbvQabqd+E+XHUwMDAyh8pcdTAwMGJHPOg3rlx1MDAwMa96XacuXHUwMDExd1FxdfAj3lx1MDAxYSRcdTAwMTT7L8fgPlN8OSsojoCaQ3lqisW2XHJouk3spcaJ+kQpWttY0aPyXHLOT1x1MDAwYlx1MDAwNe7PXGZWsKHjZbDVzH3vhVx1MDAxMOX8sItcdTAwMWZcdTAwMTftcVx1MDAwYlP591uyXGJPXHUwMDE0blx1MDAxZKRErTL/4+VnccejmXFcdTAwMGLHvcnnlj7fWVZZaVx1MDAwN9tWNiZHWFx1MDAwNFx1MDAxZuyef9OSXHUwMDA1/0//ubbDJmzYbya3JrS1P/l06sMzeEW3pjuomXt+hc85jEyxzlxm/G3R8O5t+ZDR6KpcdTAwMTDyXHUwMDFkiiQpvYbTi1x1MDAxZdr7XHUwMDA00lx1MDAxYby3XHUwMDEwvZGLXHUwMDBmvl5pnHZEkFx0wLYxpuN4JoJ4mVxu3uthlLfoh7mLXHUwMDBi8Ylt/sZcdTAwMTI/rJuFvEVx6EUgaDA71I+8jd6zeVx1MDAwMukzJqyytlx1MDAxY0EkxOpT+8T3XGbFN5Xv+ZurozhJmfnVd9T6eGur5PI0RmWfaVx1MDAxMFx1MDAxM6b4+qu+UFx1MDAxOFx1MDAxN+YsqPSR9unmIW9uoNfQo49egMxcdTAwMDe+e1xu2P5GXHUwMDFi+/SoNyjdv1x1MDAwMSPgXHUwMDFl0fda52eRXHUwMDEz/1x1MDAwZlnfseS20jT7QFjAuyW8JVxmXHTLXHUwMDFkvPeOwNP/4MzofHHjLlx1MDAxNCGFJFx1MDAwZVx1MDAxYujOyqzKqoaeaEI9j87HQvUhSnSR6cRWXHUwMDE2cJuugvLDJUa3ZZiI4Lizm61delx1MDAwMZSgXHUwMDBml1xcb2xyXHUwMDA29DW1o0zIXHUwMDA3devljmHuOMP+5KBboXa5XSyPsEt4g1x1MDAwM9JcdTAwMTIhXHUwMDA3frfzmuZIzvqXcFJG1pZoW1NcXLd6XHRjXHUwMDA0NjxOZJ1cdTAwMWPA3dYmXHUwMDA3Jlx1MDAwNrdcYitq5oV8ol1+XHUwMDFmbyGQMbxEyeNcdTAwMDahcOJcdTAwMWXbnFtcdTAwMTFAPuBPp1xc6juyZPJYTj+9sfWJtPeDubLnx/zrS2BcdTAwMGbFj5uZm5U4XbfUo6nHoPqWsfBcdTAwMTmgnpWOlvZbZeLRLuoz//1+Slx1MDAwN0mQYzf04mySXHUwMDBiJHm5oGtSty+SOSWYeEh/mFpcdTAwMTU+84I4XHUwMDA2al2nXHTF51x1MDAxZVhG7ZGAgn+nYtzMT7C9J4DQooxRRmB1XHUwMDFj7JDCSzBcdTAwMGJcbqGCXHUwMDFl+lx1MDAwMHFhxc3HL2cmclx1MDAxNrSPeGV3XHUwMDEwmoA4eI74XHUwMDEzeTeyvWxP8a9enlx1MDAxNLbLXHUwMDEw7tI8q0SxonXH3MDK+lx1MDAxY0lcdTAwMTPsk59N0j5HXHUwMDE2KVx1MDAxOVx1MDAxNlx1MDAxZGmDwb/YulSObWM8om9cdTAwMDVobbpcdTAwMGU8VtFBLFx1MDAxZLh2dt7O3kC8t9JZ9p/v7cHMQ1tiu1x1MDAxNi3rXHUwMDE0tZPB5lSGX59cdTAwMGaF6Y/PXHJcdTAwMDHYufWfpOTCwIDwrrejXHUwMDEwyCH641x1MDAxYZ/+6yVb922lNfdJ2r3TrCmpmHBcdTAwMWSeW/D++XyePVj25WJAjXiM6s1E11x1MDAxYVx1MDAxZkRcdTAwMTVcdTAwMDGcKFuQ4+FcdTAwMGZcdTAwMTfWw8VmVahcdTAwMGX49vXXtTzHyoVcdTAwMDbVq+1cZi9cdTAwMTBcdTAwMGbZd1x1MDAwM76KYYqLd2g3O6P88vDY/nrZ2PVcdTAwMDVPXj2j1Vx1MDAxMFx1MDAwMLDzoVEu5JDrXHUwMDBlXHUwMDFl4KDZz+vmUVx1MDAxNpI9MeScNSpNo8BBeNt81d2bQHqQqDyRYCtcdTAwMDVi71x1MDAxZlx1MDAwMHafXHUwMDAx/snZf1SA5TZXaabBU8IxXCJxfaiXTN+25qO/XGYoaopE7VitYCRYq7a/flx1MDAxMrFcdTAwMTCWOyZcdTAwMDdL4D9cdTAwMWNcdTAwMDOsOXBfjnKt7ZGjmm72mb60uF/vcoMxvj56c5VIeWFcdTAwMDXd2XcjS1F5iWZ5gFv40XI6pJ1SvUZcdTAwMTNcdTAwMTWTXG6YXHUwMDBmbEHAuUPOz8ifiVx1MDAwN8BcdTAwMTGdv41A7kLjh13jZVxi+kF/iP3zjK9cZq5ZcFRcdTAwMDBcdTAwMTZTPtDcv379gVx1MDAwMtNcZk2oakikVrc4wOhUVsnC6IlcdTAwMTNM6ETypVOsdER2xFt5mXrz+HJtRVx1MDAwYlx1MDAwNaB8XHUwMDE1T+xcdTAwMWNcdTAwMGVDsCws7uJcdTAwMTTgXHRDmlx1MDAxZlP0gTroV1fyXHUwMDAyO5+eXGb7vFx1MDAxZXclXHUwMDA1wTh2xbWvXCJ4XHUwMDA2Td776yOJOCeY0CvLc/DebrS5uSZs7NDLZlVOtdRTJ1x1MDAxMmWOXHUwMDEw6Vx1MDAwZar+W9eK5mw5nPT+q0V91IgpSmWbpbdeXHQ0NYh4lnOF31uLQFwidNVRwGBcblx1MDAxOGtW03tgf7VcdTAwMTgk3JHx4GjwvXdcdTAwMGYnXHUwMDA32GBf8yONpFx1MDAxMlbiJlY89/GDfVxmRDKpZ1x1MDAxZbq4dOxcdTAwMWNonyA1X1x0kuaSLKlwqPBBeT7aO6iAeyZS/n6NN6Ov0Pz+mPGlNSjwQMGTazn2vLC0L6PG6DhnI1xybVfpwTZNXHUwMDAzXHUwMDA0vaM21Fx1MDAxZs0jhELJXHUwMDE4gX9cdTAwMGIx27/CXHUwMDEwxyMzo4ZZPTF9Nc5cdTAwMDNcdTAwMTDioFx1MDAxNrV3/kxGm0n392Urn1x1MDAxYlx1MDAwYlx1MDAwMqWHlIQhXHUwMDFkWM2zm/+i/FJLue3pSz8rNq9x8EFxf96Qb819mUS3VV1cdTAwMWVcdTAwMGJosFpvXHKaZlx1MDAxOadnXHUwMDE5XHUwMDEyOlx1MDAwMfxIIe05NE4nTlx1MDAwMJlKxJ50z4IgpFVRVzjLzrpcdTAwMTFVi6xcdTAwMWViiF52XHUwMDE2MdhcdTAwMWPg1I9cdTAwMWJO7vWvYbfoSeqy/jzESnOLXHUwMDExgZvV1zRcdTAwMDdxgFx1MDAxY7RxXHUwMDEwOFx1MDAxNDDQXG73SFxuXGZPspxcdTAwMWaBYtiz/XBcdTAwMDc/eLlfKHWYe0VcdTAwMTA/XHUwMDEyN36C+Fx1MDAxYfOUguSookvzi2jEvN1qyX9cdTAwMTnDjdVfXFxvcb1cdTAwMWVGtl3RXHUwMDE3zY5d378hYlxu8Ndl7rM0eDW7uGJcdTAwMDdcdTAwMTijXHUwMDA2XHUwMDA0dC9cdTAwMDUkvlx1MDAxM59HRS5cdTAwMWHcidD9XHUwMDAxjbOfW0Z90s/jwffw9T54ajJejUGx3z0+5Vx1MDAxZqZTXHUwMDBmjztTg9nul/TLq/hC0YFcdTAwMWX3X0tcdTAwMTf0cIaTPlx1MDAxNdeH/cjfj814iFxcsLqQXHUwMDA2SX6aXHUwMDE3b+uLSy9bpzmDj1x1MDAwMkx6KlxiSoFcdNk37kg/SERcdTAwMTWKp0hcYmXXND/5dle15SD1+bgtbY9P305yhlx1MDAxZInfXHUwMDBmLlxmeVxyq7Tl5F9tQpE3vl2HNbI9idWwXHUwMDE3k6+0JupIhlqypGkk2Z5cdTAwMDZcdTAwMDNDdWawe1N7Sm3dgVx1MDAwZvngU/3jMflcdTAwMWGM7VwiiFd1nrZcdTAwMTdGkexx9VwiRoChxZh1/1wikYDNs0t7dFx1MDAxNFx1MDAwZpX2/5czN2170FGjVVxiXHUwMDEyfPHLvlDJKM4waMtxXCKz4leANVx1MDAwMudyXFzdMs2kTZ00ZGYudvS6mcFwR4j3djmXvTxcdTAwMTWiXHUwMDE3r2+4ouvAnj4riY9gWPb4KdFLqFWCTYg00pPC46E3tW2kLflg7Kc5ISOOLChcblrES+JcdTAwMTl8UHN1XHUwMDE00YdV2dFb+Nl/QFx1MDAxNVx1MDAxN0dcdTAwMDOrXHUwMDFlg6Mjb1xygZXfXHUwMDFhXHUwMDE4eGfeplx1MDAwN3h5weGTLVx1MDAxOFx1MDAxNZLE5/jn39SUN3cx7Vx1MDAwMIZcblx1MDAxNYa+nDRtO1x1MDAwNPJia9OQaFbE6YONX6f7g53YjZ1smnpcdTAwMTM7VGSEzlx1MDAxZTbIc3mTRplEXHUwMDFmM/mS6mucm8NcdFx1MDAwMVxuU+q2XHUwMDE5kZuVdFx1MDAwZb/MwS096diuXHUwMDA0XHUwMDA1csNopIVcIif4U5xkh7tF/1x1MDAxNmhcdTAwMDa/lsm89Vx1MDAxNHiRJ79cdTAwMGZW5Wc/Of+Cb1g2c4lCWnQze9ZroJdcdTAwMTn/IaD4VvNcdTAwMWXxXHUwMDExbi7GqVx1MDAxOHPr2qJLleqvRnbjZ8LMIdxPXHUwMDEzu4NMjICb6yD65/MwP1x1MDAwMm5ltY5cdTAwMWTadf76t31Wt3m00bxG1Xyv3a0gjj+mk2hpfikv0Fx1MDAwZeRoqNwhS/NtJFfW6rFcclFnWC42XHUwMDExXsKnQOgvv9dcdTAwMDCs22g8z+wzlE12XHUwMDFlK2hJXG5Ski9lXHUwMDE1ilx1MDAxZnzdJl/Km16fSp6bvWny1lx1MDAwZqypMVx1MDAwNVDGozuH1dKtlm1T1Wfs4ev8b/v3L1aK1Pc6acjYXHUwMDEwWupcdTAwMDNcdTAwMTmprYPKwst9e4VcdTAwMTi8gENusj/ubShcIjyO3OdN253ifeKceFxcXHUwMDAwTfXhOmmm7jRcdTAwMWG7gp9uZtonTVx1MDAwM4uzLy6V1bvbskg75oZoh8Cn81e8nKeOiratkN1TXHUwMDAwulO56FcmUMLNm0oq4M7cOFx1MDAwMFH5rS1UTiHrhalGg1TMXHUwMDFmLFqCzVx1MDAwN4CsXHUwMDFjfVQthMbAyOJcdTAwMGVeimRz315cdTAwMDO2uX7qZarJxYUm3DhcdTAwMGV9yFxcurjxXHUwMDAzXHUwMDEwXHUwMDFmdfEtivbEXHUwMDE35vIoXHUwMDE5WFPWV5n9ry/JvmVnUjFTXHRV87i930lcdTAwMDK+MVxc+U6IU+uAPMtcdTAwMTHGnaBcdTAwMTTK54c+92BbXHUwMDA0kGZcdTAwMTDY+PrWKlqpXHUwMDAyu19e8NZcYjpEXHUwMDBiJMngLl5cdTAwMWPm+3SAXHUwMDEyfZp2SrOL/cF/+8/5Q5lYu4w9hljdXGagzXK4anLoXHUwMDFmXHUwMDE4s1x1MDAxYWTpV43PMP3r85JcdTAwMWbZz3OomTbkSiZCjVxmT7NEJFx1MDAwMYPHXHUwMDEygImfru3WNNLaIPjCjT1jsH+1XHUwMDA2l6kwp5hUbl3P+TnjhHyz6WLZdty1ilx1MDAxOFfHWz5cdTAwMWRQmO6dRc8zkJSdU3koXHUwMDFmyUJcdTAwMWRcdTAwMTN7jCTSRyBURnDFN1x1MDAwZsBlqGRcdTAwMDFTXHUwMDFlSfL66UtTfrxcdTAwMWZF2nju6viWXHUwMDA2IXstSFx0kVHfXHUwMDFlinQtT+VwKsNogt+69vJfXdu6VTtcdTAwMTnP6Jz771x1MDAxN1x1MDAwNkrUg87YKE+LN09cdTAwMWPvQ/7n+fNuPFxi7MF4naFkk+RcdTAwMDdV/Vx1MDAxMfGzrK7g3chcdTAwMTnY10xh9ChcdTAwMGbd5aK5wNzc1H7B93ndIH1cYlotd9BHsIdcdPuSo5dBQVJnXHUwMDBiU7pcdTAwMTW7XHUwMDEyXGaCdahH9Fx1MDAwNFx1MDAxNVx1MDAwYkmFoJGLXHUwMDAzXHTg5scv9rb1UVx1MDAxY8hb17DD/S3fveNcZl5cdTAwMDcncFqGnza4UZNDNPZ+XHUwMDE3z0uY6W+9VOMoLi/cQc90yMiox2GuV1x1MDAwMEirYdLPZYuV6dH/6Vxmx1x1MDAxNW+k3zw78umIhp/Tp2tlLEbarVx1MDAxYVWO6In4+d5YwybLrNdwYuJVXHUwMDAwzcCRklHzgcR7I1x0/WCV1k3L313NXHUwMDFm4lx1MDAxMyhd36arxJW3XHUwMDEwwpCEXHUwMDAx1Vx1MDAxOJE7XHUwMDFkXHUwMDEy3iZcdTAwMDA+xpHladNcdTAwMTWeZl1mq2D/etWaMTDghVx1MDAxYppoy3dawFx1MDAwMfxcdTAwMDNdXG6wbJ5Eq6qnl/iz4IjA4Vxy87uPXHUwMDAwlldcXIyR+LnFVPA6XHUwMDFhIbU3XHUwMDA031x1MDAxMdW9UetcdTAwMDayftS+eYX9llHBI1x1MDAxNYdVO5HWmOeXj8ppXHUwMDA2UJqCS88jlYDT03F0a6Jk7j9cdTAwMGa5zydcdTAwMDNWalx1MDAxYScqYvZcdTAwMDDuna1GXHUwMDAzXFzL0GFI690sWFQ8u6WHXHUwMDEwlL1M43FgKeOSIXlcdTAwMTE1UfbWcFx1MDAxYy9YXHUwMDBlxyXfns9BP5SMg9CbW2oroL7X/NUtQV1eY47hwVx1MDAxYtdDTXk2XHUwMDBia06aOnjLb26WYyzGm1x1MDAxZGomXHJrO7VcdTAwMTnhc+tcIqQ4W9H7rFx1MDAxZohcclx1MDAxMDWbvOyvlXAoLCbyXHUwMDEyjlx1MDAxM0U45dw1v8pcdFadJ05pg4LsZ1x1MDAxMHVcdTAwMGZcdTAwMGWVkCNL11x1MDAxMbzgJ2h4XHUwMDA1XHUwMDA095japiQovVNX920kpV3TXj/cOtvucjHvRd9cdTAwMGLrxvSU5/HGr+zvz1x1MDAxOZlIQE08OrRKno1cdTAwMTVd9n5cdTAwMGW4oCT6jtw/L1x1MDAwMFxu8fkp9GZ844Oqvp2fXHUwMDE5XHUwMDA3LcOx92JcdTAwMDY5btFcdTAwMDSUUe1myyRcdTAwMDZcdTAwMTA86ccsJO9cdTAwMWbgdaHTXCJcYrxcIvx5lvJvrkOD7z2rsrN30ic+0qQq4ikoXHUwMDEzb++ER9pcdTAwMDXBXHUwMDA0lGbowF4g6NdTNJbnQVx1MDAxY0KBXHUwMDE12ZxFRHtHZUvS+UL2fXFf5o9GMKLsRzJR2znpZ/TY7H18WVx1MDAxMZWL0OMgbFqZV+nr21xiXHUwMDE466C/Z3y6Q1xueVwiz1ViLFx1MDAwNFx1MDAwYtFcdTAwMWXvmO1t9u9G61x1MDAwMPGatpC28ls3Yvhjzprhq6U3llx1MDAxOeyfs2ZcdTAwMDFcdTAwMTg2gVx1MDAxOLpcdTAwMDBd6G1xqSH6XHUwMDAwXHUwMDFhXHUwMDAwVFx1MDAxZFx1MDAwMamczlx1MDAwZknXVGaQTTRbdvaJlyhcdTAwMWP2JtQt5Fx1MDAxZFDdkKYlXHUwMDFkeOe9paKk3oO0Xyd+4ekkatpcdTAwMDOQXZHjQf5KXCLaSUhcdTAwMTC7Ryfjf9dcdTAwMTUsJoiZRKhcdTAwMWNvynasQYZW6nvV+IHI7Pij525cYlx1MDAxNi07QEQ1UuqAeufBXHUwMDA29XSBVs28feyCiDMxu1x1MDAwZqL4rZcqOCduXHUwMDA1/4N5gd26XHUwMDFhw+xcdTAwMWVcIli7Iz7yXHUwMDFhwKT1iVx1MDAxY2PYruRDm2CBOv+0x1BgzM1bgE5+LUXK6zJY9IZcdTAwMDOFXHUwMDE0xjXmZ1k/d5A6jMOBgX015lx1MDAxZdOccTw1XHUwMDFjXCLbo+uDZ/JcdTAwMDHWMVaUglxuq9XicdGHQThlRE61cYeCcIVcdTAwMDeXzN7tbJ6Y3J7DQMaZZIS+vP1iXHUwMDEzOf/JITAhi1x1MDAwNipvi6Hu5+DHkNNcdTAwMGW7IVx1MDAwZfS9OOsowTaB56E8hKF5fWOZu9xq419vXHUwMDEyJ3BcZtzQMrDJ6Vx1MDAxMYnwXHUwMDA3UEnipPk43rZSet/MXHUwMDEw+/ytU2dyiNDfdqtcdTAwMTU56890l2/T5mKknFFcdTAwMDDQXHUwMDExPVx1MDAwMFx1MDAwN6BFPzN9XGbqIYJcdTAwMGLC6Hui+WTE6q0mW1x1MDAxZaJiI8CLg2TFXHUwMDE5XHUwMDA0zEnXpWTL9c1ey3mVxVx1MDAwM1x1MDAxMsFTUnfFYkvo1L/cQXiZXHUwMDA1NO5cdTAwMDfXyt64jbO68Vx1MDAwNFxuXHUwMDAzTvK+Y/Op+Vo8Ozfn51xmNvl9b+7LuFx0XHUwMDA0lz5yJ3IjYd9cdTAwMGIlt1x1MDAwMJsg2XVPfIOLTD/OR/5HX91a3JWZVMR9flx1MDAxNp41hOXb0e2S2YDJrrE64XdjlbLZiaE0PZvz3oPS6t8kw01cdTAwMDbledL2y1x1MDAxNKK4XZmXXHUwMDA20dyyLOVIXHUwMDAwwFxmnycpq1x1MDAxN10klFxm9mFHXHUwMDE1lCQ7ylx1MDAwZs49XHUwMDE1jduBg3Df9jaDXHUwMDA1XHUwMDAyh1x1MDAwNvvMrKCvkWzqe1+fWo3UsYJLwMHmXHUwMDE5QYNcdTAwMWXiMbLub0uPgjP3Z0AlZGVcdTAwMDd4lt6H4EhcZiHE3o1LitVGnfrwXHUwMDE0XvuV8q9fwivMrVx1MDAwYsVccnlKbuxVXHUwMDE4XHUwMDBl4Vx1MDAxMFx1MDAwMLRcbkO+XHUwMDAypJvgYHW8aj9lXz/fVoJPKGiTL2hcXIx0duqHeWGQmFl4d7yJzlhcXEGFXHUwMDE0L1x1MDAxMJ/71EEvXHUwMDE2fJFcdTAwMGa7h1x1MDAxMFC5eFhTnMPRXHUwMDEyRPqkOEuhXHUwMDFjxlx1MDAxNd9+XHUwMDE27Fx1MDAwNjhQivy0deeETFxiXHUwMDEw5ypqXHUwMDBiylx1MDAxOYdiKFx0Oy5cdTAwMWbD+ctJ8PeIf1x1MDAxYejrh0yZ4mZtxlx1MDAxZSfPXHUwMDBm8omAXHUwMDBmXHSCadlB8S2oX+Y84yPy6zNtbvaMdrbyXHUwMDFhplx0i/nMR9s82qOb9FrGiaw6/pBcdTAwMWSAVKFbuS2KjCMkc3mBlVxcxGPsOW6bie5sXHUwMDAwvPXtbo/8JJRUV+uv54L3Mlri11x1MDAwMeNcdTAwMThPWS0nXHUwMDAywlGaNdhZyvKf9qpcdTAwMTLa1Ibe5bu8mEo6a9hea8s1MVx1MDAwMqG0mVsmjF3Vnz+eKF6RXHUwMDE4divMZP30YvjOKcZcdTAwMDDp87zcOC+SWZnNmJb18sTqP/1cdTAwMTlcbjB7uCc2sfCKhMAj9q16p6Kmj1vi5XpcdTAwMWMslPc3zFxiulx1MDAwNLJcdTAwMWRcdTAwMDSuXHUwMDBiW/j6Pe3S1kPl21x1MDAxZblUbp1cdTAwMGZcdTAwMDaEKO+DrPfmo4/styRcdTAwMTbbzWJiYGewt1xuZSzFXHUwMDFmXHUwMDEy6/ik11o8m7e9XHUwMDFj/L3MXHUwMDFmXHJcXLEhy0aui1x0c2jTwCdAP4VjTs/XXHUwMDFkXHUwMDAyXHUwMDAwenRuXG6reDM5OCn19Vx1MDAxYl7pXHUwMDFmR4SZSlBcdTAwMDV+fuiIXGY+zFx1MDAxZGWtXHUwMDFjSFx1MDAxZVx0LKFcdTAwMTjXnVxihpW3XHUwMDAwbKyfc5rZXHKmXHUwMDBmpv7YXvTGdEBePZa//lx1MDAxNPOVbq3HZy1hkGBw7MktXHUwMDAyXHUwMDE3OLjWieKIN2lcdTAwMTFe9sjgxKQ/PF7zLnjTR6StW4ojXHUwMDA1XnXtmKE6/KNcdTAwMGZcdTAwMDbFwuCHbkqANblXQFx1MDAxZMmAmLti4szG7988wdBYTFx1MDAxOSjtyFx1MDAwNM9piybvg5Fss+x++5C6jyirh1x1MDAwNam3nlx1MDAxMzWOXHUwMDFmhTb+9esyQvFkRMKEKppcdTAwMTNcdTAwMDJcdTAwMTJcdTAwMGJzcPM2WIJcIs7vSMHgdlx1MDAwYnz89fFpXG6HyWZbXnyogyTx7Vx1MDAxZvJcZvPQXHUwMDA3z0d0t1lcdTAwMWXOXHRlJlCIXHUwMDAw/aDekdbnrK2913JNm5XVQcuu1T413oPsQTpcdTAwMWUlg13YWlwiZm9LjFx1MDAxY0f5XHUwMDE4PPJcYlx1MDAxYVx1MDAxZHp8+aUjoyBf1Vx1MDAwN1ay1K0pvvMoma81Q26P1fMuzIqWXFziXHUwMDFml7xS1uOCXHUwMDEzPDvP4Vx1MDAxYvpApvzG9OTKmuPbXHUwMDAzO31HWlxyvFx1MDAwYsyAvsx4vtdcdTAwMTZcYoDuXHUwMDAxxfuQm0rjjqYjlZpcdTAwMGZsbJH/8lx1MDAwNtF279g5tHPkvJBcdTAwMWQzcFB+r1G+gi/pXHUwMDE2oi9lt9qnmYGQXHUwMDFiXHUwMDEzU1Zufti/jDbOTTywrpvILFjHqoOGyJBcblx1MDAxN5JWgY2yXHUwMDAx/eh4XHUwMDEzz5plv15XXHUwMDEzXXlOgTN+Ku9iWVx1MDAxZOBcdTAwMDbH7MuHXHUwMDExVrZ1J4XueHD/XGJvWnNcIn3ENT0pyeV6LFW3XHUwMDEwQVx1MDAwNEzwXeP2/PXEKdIgVFx1MDAxNctcdTAwMTA4R0t4Xb/htMZh2npcdTAwMDJcdTAwMDE50FxclnLsyr1cblx1MDAwMGq81U2Z/E/7WoWhrOZT80tcdTAwMDOuvqNcdTAwMTPDXvdxbalBnYvAUoVcdTAwMTBVQkFcdTAwMDJcdTAwMTmXfexU2s9cbu2yYe/EUcpcdTAwMTnT4FbX70etXHUwMDBieq9ALDozZl1th61vmVxiSFx1MDAxZv/oUMC3qdKyLNV8Kz84w1R5kUfNor+6XHUwMDE3XFyoMIp5NZVIL/7byNlahS1Vx/jr81x1MDAxYVNeXHR/fV6srTJitFAzxM3IJLRcdTAwMTZAnfNiSFxu1HVr4jM9/Xrk8jaqoWOf3DcpXHUwMDE5M8WAZ1x1MDAxNUhcdTAwMTDqeWO+N0O0hdbvj1BHO1JyZTB+71x1MDAwNvE8M482yod9/O1cdTAwMWRI7+2vT2pLuYB/XGK3/3pcdTAwMTVnjHmJmiAvpVx1MDAxNim981x1MDAwNsW2XHUwMDFjvvn/xq1cdTAwMWJFPWNfXGY0WFxuLFx1MDAwM6DJhVe7d0dcdTAwMWJwit9ClOI8jql7ypRs4ZtbXHUwMDFib1x1MDAxNKpcdTAwMThccn1cdTAwMTJhXG7EYN5oIfB9SUhcdTAwMWbWnfntsVxi6IdcdTAwMTDPrljmtXJjlia7XHUwMDFjN1x1MDAxMbXLe8I5QXEwx11wXHTEll/b24NcXN9cdTAwMDT3PJesa80kPK9Idd4qqjxcdTAwMWFcdTAwMDT+KFPslV1gXsebXHUwMDA03jNEfOKjfZ5SpU9bXHTEXHUwMDFlTjmg06vC16M1MM3UXHUwMDBlqoZMRvnpg7mjd1x1MDAxMVx1MDAwM7VcYlx1MDAwZlJMXHUwMDBiZ7BcdTAwMWb42rlcdTAwMWHG+c5cdTAwMTSE2L5cdTAwMDD/1T++t7L5XHUwMDA1vVx1MDAwN/hEQy91+Vx1MDAxMHnBwuhm80Z676k5XHUwMDAwfFx1MDAwMPeGcWT+zdaIWPHo2Xh/rVx1MDAxZO+dVdo7zZVlVGRIdnLFJObCKfJcdTAwMDD441SSLMl0KZ74wZ+cMDjWXHUwMDE5WFx1MDAxYkRcdTAwMDaM0bBP3DeCZ76/ieuRTTN+b2iUzjtcctIuaVx1MDAxZHWvYUfNnPpcdTAwMDL/8We4j0NcYs4yIEjvUaZ9mehvmNBUgsxrL47He2lVPVwiXFzLtPeruXXk1+u9cPbJMFx1MDAwNvpBtDBHvc8jy4+DtF6iRLNJTFx1MDAxOVoqN7A5hlx1MDAxOOHYv75cdTAwMDMuYb++7fhcdTAwMTatxvM6Py/3VpGWZT5cdTAwMDWYpMNcdTAwMDBIZF8gXHUwMDBmkCbb+1x1MDAwMGdBkIGRXHUwMDE4plib0OnHzDbEbXWohr1cdTAwMGbPXHSEoEbJ/ipTM5zlLve23HDd2TqJq2X7+X3l4aBVNV30h4K051xugePv7Fx1MDAxMpB92Hx5yfbq2aec5pvxofGR/KmZvnBph3Iyxcvmp2eWW3l8XHUwMDAxzPdcdTAwMWb+m8W931x1MDAwNn7jqHx6OF5/suhnguH96fGAovQ2lkVv7690yjFcdTAwMTHVflxipoRW4lx1MDAwNF7tXHUwMDA3xYK6Ofd+X89cdTAwMTb0tFB3Ourc0nRcdTAwMDdcdTAwMDWVej+ckdi1I6alqYLEKOtnx6DlXHUwMDE5XHJf7E1Fg1x1MDAxOSl5N1x1MDAxOG490s2mj7Bhd1hvvomgLX9j/CNROVC9icCFhN94IKIoZ6o/s1x1MDAwMqVK+JaI06mdtCtcdTAwMWFWXHUwMDFjT85PJ1x1MDAwNyn63sg1Jlxc/3q291x1MDAwNlBFXHUwMDA1urlKV1xy97v4eVdcdTAwMTKrhOGNJ1x1MDAxOdB6s1x1MDAwML9BXHUwMDFkXGajOLlj1Yzr5jHteSuChMbeuy55XHUwMDE2f/MlRJvzhydcdTAwMTK+kqVKnt0jXHUwMDA3o1x1MDAwNr/EXHUwMDE2XHUwMDAyrYxl/ddB7id1gD1YiqSu50FUrmBFXHUwMDE2Zsm+LiBJt8TRZlx1MDAxOTE44pSMrUlJp1x1MDAwZkxIpJ1cdTAwMTFeZ1XgYj1Ukl6eTmpk6NBFTlx1MDAxZslcdTAwMWI7V+bATDtf7rS/Xl/mmzGlgMOFdDdcdTAwMDfCkU70aCB5XG4zkmpcdTAwMTXbQ3iyR1Urnc1IRK1aXHUwMDE2JHRcZsupmsJ854zEdfXUe93CTKuGT7FcdTAwMWNcdTAwMDCk9DSTZatccv0mV/BcdTAwMWbPzk88YVx1MDAxNnbMn/X8eXlcdTAwMDVcdTAwMWXAyGxcdTAwMDSjXHUwMDE5pSk7+7N/c64gyGnLq1x0rbp2WjuoK9+fzZ5cdTAwMDbzfZCAen5SgMH0XHUwMDBmpZ5O6apQlybzkIUm4WpcdTAwMTOIhHZKXHUwMDA3bV5cdTAwMGW17X5OuqVSX+P0wumlrYXtxHi9k44uXHTgs4roJ/TIXHJJqJNI1/fWVUPWxZjtJO0rup9J4Vx1MDAxNk51f+P52bRcZud8cjpfq1x1MDAxY0Cv41x1MDAxM1x1MDAxNiRmjiRMst7WvFJcdTAwMDX/l7eMi9fX3oZa2lx1MDAxMCnbsVx1MDAxMjitXFzvXHUwMDAyXHUwMDEzN1xuXHUwMDAwgyloVprzUe2WeLkgUyAxzjfEXHUwMDAyONwhK1rGT3JcdTAwMTfk2sZcdTAwMWNzm7tcZj3HwYn4vjd6v/RFnd9cdTAwMWVTNDymmLZaP6yKkyTtIbDjh1x1MDAwYqVcdTAwMWb81++ssEfxtpvH/Jbmclx1MDAwNFx1MDAwYsuqjXrO7Me4Q00p3LrXvc8n2zZ+KH19flx1MDAwMrdwwlMrXGYn24V+tmSUkp40dnBcdTAwMDC8gofVjlx1MDAxY9MgqCxEbfD89XPpg2pyMK5Vw9I5L/T18lx1MDAxZFx1MDAxNpx1vS765bNzaFx1MDAxMzottZNcdTAwMDaQXHUwMDAzvtVTNEC8yMAl7edo4v38YmPKXHUwMDFhgqGok/7iVOFccsLPyp6fs1x1MDAxMnXCXHUwMDAzXHUwMDAyi6/OXFzcbtDYRERcYlLNrvJcImbRxUChKrtd7Jq87HT53FtFYZN7LVx1MDAxY87d3/rXq8AuTCk4P/lcdTAwMTV5p8NcInvcJ91f+Vx1MDAwMGAnkn9tZaVcdTAwMWaXeVx1MDAwYvvfnumVsT6uqriO8ICbTdebZbUsXHUwMDE0coTF3E9cdTAwMTXalrdcdTAwMWZf5Vx1MDAwMGZEgl5tjshcdTAwMGLRdYN8kLpD7yuKRN96dD6mxXTHV2jloofBNdbk4VwiKlx1MDAwNvl3/uZylSn424pe9Mw+XHUwMDE5ytHM91x1MDAxZfxe1JOoJ1x1MDAxNtZE4PiNMWSwZzpsO+9fXHUwMDFmnIKj4Fb85Ji053fkPkdcdTAwMDehnVx1MDAwMdHKmuapSTRcdTAwMWZcdTAwMDFtMnww3zaTl+guh1x1MDAxZJ7Kb1xyv5KLNXvZQz+E+CPd9eCO68Hgon1ccslP0POf8Nkv+n6Bi1xmduZcdTAwMWXR0vmdXHUwMDFmXHUwMDAwxehpRjmGXGKud/EuXHUwMDEyQYu6Q1x1MDAxYUS8XCJe9VxuI05fL5tcdTAwMDB3QXWiQO9XXHUwMDFheXjLjfXduT33o3h8Z7woTMG9pm9HZzSg2i17Z31gpXtcdTAwMWI4aXspXHUwMDExTPmUXHUwMDFkrFx1MDAwZulbi/nW2lx1MDAxMOU59r89JpQwVMPNX/j7zGtcdTAwMDJZd6C722g/cLfA4rtnVFx1MDAwMq+6N2ghcX7f3VOJ+DxahZtfnotg00lcdTAwMTZdXHUwMDE3olx1MDAwN+h7J7bx3GJcdTAwMDBlr1xyrKlccn10mL3m1lx1MDAwNzTWkIPSJzj2U6CZTuycZ6jQqPE+vVkl4Ey4Ku2U9lx1MDAxNNVcdTAwMWKe0ZtKIN+Smkvws7TeXGa1YK3WXHUwMDAzLMEk91x1MDAxOVx1MDAxYdhcdTAwMTnwpbfXcrxMp3s8XHUwMDBmJFpcdTAwMWY161x1MDAwMvtqr6JN3M/jdVxuXHUwMDExw1xcgffb69NcbrUgXHTs1phcdTAwMDK8adyxXHUwMDA2O8jsKlxctYqWcC9/Ylx1MDAwYiNwbn5m0V9+9uP9XkaDXHUwMDA2s0BcZo305mVcdTAwMDBcdTAwMDXrTn0tTmHgzEPcxXYn3uC87JSxXfpcdTAwMTJtNzCxteN+a3W5jI5cdHcpU0B8J3ztMHFccsCHrpY8REmBIC6roGFcdTAwMTCRXHUwMDBipX+Cdp9sYlx1MDAxMasvfFcgXGIj3DPuu+H4ULpXvzjhXjSUsJ8z4o/hp37iioMg68X4Ol+SLX3e+Xsnz/U7j+dEZpuH9ron/OXWXCKP31x1MDAxZaCkpdj6i8NcdTAwMWNLsJyy2XJCzdkse0VcdTAwMTbk/fFg1zStwrBR2Ic7RCbam8Xzd1x1MDAxZU1RXHUwMDBlXHUwMDFhk1SPqTzaXHUwMDE5heLL7ZlexnC0JZFUiKxcdTAwMWJnWyvtrX7/6FxyOtBcdTAwMDLOP1x1MDAxYZ+l9Vx0R5BQr8b8muZUXHUwMDFlxmLeJfopXHUwMDE1/DOWg4ZRpm5+qJtcdTAwMTZW6USGoGRvXHUwMDAxvC835j2NtkDyVWeX149PTDxcdTAwMTjJVV+TtE7LKkMoc0NcdG2WJo1ekHdcdTAwMTZDVJxcdTAwMTD51UrnSbb8lzxw/MlKSnGv8aC1uXrWOShcdTAwMDXrvjOkkSYmtY+0XHUwMDA24v+rXHUwMDEzWUwzbFxuoVfdrEfdLazsZJeAhHr4MKuOT0hNk56u90HA0Nzc9FtcdTAwMGUjSIHwLILbyIh9p7XW6UR4gtNlJ6dgbLVyXHUwMDFk0z8jgHdcdTAwMGU4sFPc3/WJ8+RCxpH6leY9Zdi1+9Ag50nLQvLlZySzj7p/eOWL7rfdlIDVL1x1MDAxNnlcdTAwMWUr7dvLw1x1MDAxMVaqXHUwMDE32LdmJGLJ9f6Z88KwyaF8hImHXHUwMDA3fFxmuFx1MDAxY401O69wKM/qXHUwMDBlilNMXHUwMDE1hXSgkM/n15dRXG7tIH5S2P+oXHUwMDEzMXpzfzWX8YKGXHUwMDEzN0FcdTAwMTJcdTAwMDXRSsrXPXxcdTAwMWLJOs5cdTAwMDZkQb1ycduIXHUwMDEwL6Kv2OwlqLD3fKCjo5dcXCqOXHUwMDA1Ofa51Vx1MDAxZtNLqddHk5TprCFcdTAwMDYvQzvOtoFSW1tcZuKUmb2Pt/5549yvx2F8MSvW7mF5S9PL0oOg3lx1MDAxMq+CU+GRx9GqiYzMK4WYf9dcdFC6ePzNb2GZ7zpcdTAwMTkykiv6sjFcdTAwMDDPXHUwMDE3jDLq92Sgh+lcdTAwMTVcYoJcbm5cdTAwMTjBXHUwMDA3V/5SmzZkX/rENNqQXHUwMDE12YbG1Fx1MDAxMe05iPhz6uWm4I/0RnH2nkGwXGbeYWVbwHDErHZdaNZcdTAwMGVcdTAwMTOs83Zv1CSu0jb3WWHY3NnTNDA3r7tcdTAwMTZ/2KGAj7ZqeV2ze30645vH/ignk0ycy95/8YxJXHUwMDEwn8Fkw8BnQPOTQm9cdTAwMTnnSHqdXHUwMDExr+9MVk3g5HKMpL+5XCJcdTAwMTZTXHUwMDBi7qDneaJAxNu2TVNcdTAwMGX9tUNDXHUwMDAxj9Pn+1KE4/07V+j+55JUcFxcO8lOa2urbjNcdTAwMTFNyX45p+lcdTAwMDPsd8WJ657lRE2/pjBExHdnfFx1MDAxNi+p+PA1xFx1MDAwNkU9+VuewoIlJXDKMu+Bgb5cdTAwMWNcdTAwMWLgsnpcdTAwMWVs870o/pJcdTAwMGLbut3QZ8kzjuF9SVr5o3VcdTAwMWZcdTAwMWP4NFx1MDAwYuZcdTAwMDF5dvGH+1x1MDAxZtZhvLGmJYJ6NmjCOlx1MDAxNJ3fr1x1MDAwM94ofsJcdTAwMTT6xlx1MDAwZuQwi7+c2ZP/XHUwMDE5q1x1MDAwM/RcXPpykfntXHUwMDBmiH1ccvdcdTAwMTGn2YeZXHUwMDFkvVxuNpg72FO2v2pEXGa/tWJooI2zvlx1MDAwMa9ZJJhOzPf3THMmKzs6b0ukO1REV+RuWeZAdYfW2Jw+L59KMOKmmlwis3yxoIL8iMKZ37k+oVx1MDAxMHI0Qzw1Kv1cdTAwMTC0XHUwMDA12lx1MDAxZiDf7Vx1MDAwNyyB1MN1uMJ7Rr1cdTAwMTnWvdlUXHUwMDE4X/x65TibxVx1MDAwMzSYLKCCXHUwMDExTDSmQ+zZ57f2YtJcdTAwMTlF1Fx1MDAxM073/UN0XHUwMDA3Rok9ZZWwUOk9373kSNVcYuaFVC8kkFxu8t5kXGbuZD0nXCJcZpmTlH7WQCFDXHUwMDFhon5GpK7Mr/9fKW4x2Z0oXHUwMDFhKvDnIVx1MDAxM3CU1kBN7ad4QbuZZHJrt23xrVx1MDAxMDDMy32y3o8+XHUwMDBmv3spdk0l/NNtXfEudIidPO9o6UNxWMBCP+79ksCCXHUwMDFl5uBZcFx1MDAxMWz/5z2rXG6RaUco7lx1MDAwNsHosYfBu8z9TpS5UiFcdTAwMWV3kZHghydWIGJcdTAwMTDdXCJcdTAwMDdDdkyqOiPI5S1cdTAwMWYnXHUwMDE42YdcdTAwMGZTmuOCMzBA9mlsXHUwMDAx6oFcdTAwMTNSWkojOsNwxvOQyqrFQpjxeinvXHUwMDAyXHUwMDFhTLZ+/XhcdTAwMThcdTAwMDS9xFVGZKpB1F7nO9/u0Fx1MDAxMVx1MDAwN3N5XHUwMDFhXHUwMDFilVAt103Qk0L2LDH4b+rLeXBYs6KxOFRTke8snZe3fOsu/m82raD0jTS6S0T5dONcZmBcdTAwMTSHiJy/jLymWCirplx1MDAxNIWnzXkxtWv901x1MDAwN1x1MDAxYmvaQnM/L1x1MDAxN56LdFjR2sRhXHUwMDE3jCv8qMaSevqLdblIl8ZvXHUwMDEzlCUtrewqJcc8eeByqzWarMqY/9ajokFX0C5cdTAwMWWIXGKe+c2+/vPSYLdGXHUwMDFinlx1MDAwN+u+OmFBu3Kb0s3isVxiuFxi5qnF05Yl6LyJmFx1MDAxZC2Ny3/737nAqbA39+3TZJqndutcdTAwMDN/SvmJgrN3wqtcdTAwMGZcblx1MDAxNOOdprlyQFx1MDAxOC9cdTAwMTLv/Z03wjhcdTAwMWOO4n7X86hcIvvm5OJcIkHOXCK1qXxCeDbM4vbC2CD02luWko76gDWyJbwuIbV3Yt97VSCX7W1pXHUwMDEzaqKXpmVcXMyZQlr0zTbvyEK8P4AoceSO0S/bXHUwMDBmdXNsuZTtwcq3hrfbXHUwMDE0bFxcIYLyKP122VJcclx1MDAwMFxi/llMPlx1MDAwMVx1MDAwZm967XWlOSZWXHUwMDFkZObGI0Z/Q4X+l4fAXG5PeVx1MDAwZfpcdTAwMDLkry1JLeCDmHDcXHUwMDEy6qc63PlI041pKcT48yMxUMl40Fx1MDAwMzVcdTAwMGV9tlx1MDAwZS3qXHUwMDBlYYbOjYBcYpebxt3xcCNhJs2KtjIpZu3JXHUwMDE50NXPOGJuVa/MXHUwMDFmx7ei54pcdTAwMWZcdC94g0KE7pDvhqNhLfEyV8w+jV2xylJA5p+5opnHcO7qq2umqvBkJjhJYDS8bJ5guyr+YEZcdTAwMTg1kYs9XHUwMDEy7693WKhdYeBSOXlmq57YoCw2aVbm3eLFymxD3krQf83r3FxyJvHSP/nuk7D0c6XdZ/3NJdGxyFx1MDAwZW9B8ZvYg2RcdTAwMTI6Jk6IXGZcdTAwMWHJptPqzZzkkllGlj2OXHKsf9/8MJRcdTAwMWZcdTAwMDBnXHUwMDE1oVQsfZ44/PCyba745r58ey25KpxFXCJZwtCSd33De7/Ih+ozhvHgcz3kKNXBzMOjueH365dcdTAwMWJcbut+XHUwMDE3zsCv989ESSSRhCxcdTAwMDZZclx1MDAwNcJcIomiw8PaVVItwqpcdTAwMTYn+PFnfGuPXHUwMDBlIdWqXHUwMDFiP1hELzKXIShwXHUwMDA38ZvviF5D9i+xKHSnfUyTdFUhI67m41x1MDAxMDaa/KyEdate52XeoEKLuPK90/S9XHUwMDFiXHUwMDAw9Vx1MDAwMkT4oaiDRbtcdTAwMWZcdTAwMDNnb1x1MDAxOGrpt3KwXHUwMDE0qzu4zmltU5FzkueIeHpcdTAwMDUxvt3VXHUwMDAwPywuXHUwMDE1r1NcdTAwMGXkjz1cdTAwMGVzKfz1zFx1MDAxMqx747551t+Lr8l6XHUwMDA20Vx1MDAxY7xZXHUwMDExiem1t4BcdTAwMWOxc4z3JFJIyf71Zaqu+rO/YNu699c78snTl1xyXGJ68CC3jMAn8n3EpJ5cdNIuoTI7yGDkwYTdfFVccm2gPbxnoVx1MDAxZTBp3fgox06Zxc8t716Nklx1MDAxMSRWNIef9lx1MDAwNvpcdTAwMTaEq7MjP3dPfVx1MDAwZnW+hMpBxbmoXHUwMDE4VFtn7NWnX1x1MDAxMbWiXHUwMDA3hY/n4iPkUIBIloBWzbH6YWP315Pxm/BcdTAwMWbqv55nplWNacud5Fx1MDAxMjt9XHUwMDFkXHUwMDEytEDT0drAykOAh53DPvql2kqVXHUwMDFh8pGcyu8oXHUwMDA2VmOvMUxcIoyP5mfz3EYgO802p1/ZXHUwMDBieEpcdTAwMTVFXHUwMDE0XHUwMDFi35jKtU9mTVxiNukmu3H/n1xyiFI4ZTL+W7pwKPSL473RXHUwMDFl/o3jhnLyXHUwMDA3VFx1MDAxNVxuo0a5XHUwMDE42W3prGeUu1x1MDAxYnGHQkpSY5Jvn434yFx1MDAxY0Wlhey3XHUwMDE35fjXi8K8OYOJMltlhCXZQGZG0H754T1cdTAwMTIxct7JXHUwMDFkspu7YuX86jBForhXyVx1MDAxMDw4c2t1XHUwMDFl+X6TZFx1MDAwNMVcdTAwMWbFOFrDc1xiXHUwMDE2peZcIqKDqac5rUM/udx3SFx1MDAxM3PCXFx5ssyIXG6xfVx1MDAxZuhn7uHD0kHY+0pcdTAwMTBkZPfiZalDaIrFg8PPcv7xYpf6q+g+05berP+hNPeRWn1cdTAwMDTHYmQ+f+vZXHUwMDBmhs2KYzKU7s/LyVxywiFEXG6qTJiT0XhcdTAwMGZcdTAwMWWCmG8s7KVcdTAwMGXNbfjGrdK1UbCscJuG/83PYZlV4aRuYut358vfQWtcdTAwMWKAj/AjwG++3ZitXFxZ8buZzKCRpkEzw9eMrU/+jTg+XHUwMDA1wPZLJMyPzFvqXG7sjIK8r2ndUemTXHUwMDE4av5iP8Z9Tp8uN3zb5DhvhCfxkZdAYXbvMLpw+1x1MDAxZPBFJ7wwhkv1kore0L/c8qBcdTAwMWNidNCShZ0kgkhJ+FnxU0OcKuSe8WpXa3zouGc+QSBnXHUwMDFlf96K7etcdTAwMDFayZTII1x0ljQ4Ti0nUK+u78xRLlx1MDAwNWI+d1x1MDAwMvq0J5dU1FxuXHUwMDEz3OTboDp+5oj8uFx1MDAxZpXctqs1XHUwMDA1ek6OXFy+XHUwMDA00IyNXHUwMDEyaIuyibPD57mvh1x1MDAwMDJojLgxzG7akve67dZEiyFcdTAwMTLZeqlcdTAwMGWdfVx1MDAxYcCN3Ou3N6j91rB9lYB+c7qaKJzFxXhcdTAwMDNPnYNp1el506Usr33XYi7VWFx1MDAxMWdcdTAwMGXTyOXL2K/+8+MrzHi/XHUwMDBmYUJxo1Bisbnxj95fXHUwMDAwXHUwMDAwXHUwMDEy0YNxnZbOeoDzxzinnT2xRX67XHUwMDBmmrA+8KC03peX261tJlx1MDAwN2ms/vNcdTAwMWONj4s6iUP68Yp11EV8YiDlXHUwMDFlZseXXHUwMDBm2T75dVx1MDAxMFx1MDAxOFNuXHUwMDA0XHUwMDBlZG+6XHUwMDAwf1TkXu6cRztcdLGBjE0wzqefodE2iVVG7ZurcVx1MDAwM/F6/GqcQ1x1MDAxMTmJ6Vx1MDAxZLkhaF8+7C1cdTAwMDehipNcdTAwMTau2aBtfFxcRCdcdTAwMTFM41x1MDAxYX/DWV+VI7CBRedcdTAwMDFTLlx1MDAwMDPqa1B7kPFBlkpQIX2H1ungYuy0XHUwMDFkJZ5AYlx1MDAwM03UatwrtlpUzZhLmlx1MDAwN9IuL90+c5nkmCvvXHUwMDEy1GcxnIWgSlx1MDAxMfmXxlx1MDAwNIydmlCje/xcdTAwMDJjUSZcYjp/gdtyKORcdD/k33xi9c1Z+5qN87/zUm7eWt46Yq6RXHUwMDAwqzOziUeK829cdTAwMTJJe17KRYhcdTAwMTR1XHUwMDFmM9Irzvybq4pcdFx1MDAwNrtv81x1MDAwYmbY3WesIGaMZbJcdTAwMTV783TeZFx1MDAxMlhwTXw8NjtcdTAwMTlI0s7tilx1MDAxZvup/Nb42I/EcVx1MDAxMtpcdTAwMTRIy1hliqFdfFmzuLNfT9nbuFfnZjPfRlxudj9qgitcdTAwMDLm1uFOP1xiXHUwMDA0gGufJCmL3Mwr+XI0KdeDcbNr9uh7tbs5tPWbd7CsWlW+es5kXHUwMDFmY1iYOHajhoVcdTAwMWTYlklQom2BXHUwMDE3XHSUhuihrt3cIPFmhVbdn3OXlKr90tM4ac9dTjKff5PIdFx1MDAxM5pccmn4fHHamFxyeGtcdTAwMWRP/N7gXHUwMDA3UUl689br3faMNj32p1x1MDAwM+XD093J8Fx1MDAxY4dcdTAwMGZ1XHUwMDFhXHUwMDA2Mu++v9JcdTAwMWTlXHUwMDEwtt2/lv7bN1tcbvfXvLmmNlxyhUGcXHUwMDAwXHUwMDFhoGdbtFx1MDAxOIm3xndW0M1LXCL13szftfCu+JF+/MyNW7u3eqKZtJcgRvNOlKxoXHUwMDA1XHUwMDE2XHUwMDExq5vDctFt5XLnYbg1pdPYf3NcdTAwMGVcdTAwMWWFZUh4XFxtR2KjNlrEIVDr9upy6326iFx1MDAxMajfXHUwMDEwXHUwMDFhmYdcdTAwMDBNXHUwMDFkuo6bXHUwMDAzi1x1MDAxN3dW71x1MDAxYtzMVK+WTjqT+UYhTaRcdTAwMTGgrWCgTCCMeWBgzGvark5WXytcdTAwMDBBlVhoJzRcdTAwMDFQgv16cHFh850/sZFcdTAwMTGtiP96l1x1MDAwNKFT15vU27JcdTAwMTY5vnqx7rfezGCihiE/d0jY3zs/XHUwMDA1XHUwMDE2PfbHLcNOmH7l4VxmvFx1MDAxMUNPKfZm+Dd03Fx1MDAxMuvf7HHtjmPfPi+EUJNUtqVcdTAwMDdcdTAwMWRa3nKmXCL/TI7xfcefOX5cZq3eQ+t18zfN9GVcdTAwMTlcdTAwMTmmuKdIr9iJQOpcbtR8XFzvjs/L6Fx1MDAxNlxcLVx1MDAwMN7B1GafzTJxznItYdG0vDDEvLJcdTAwMDFF+LxcdTAwMTnmplxionhgzWPy482dUqT3JP3CijMjRVxyOFDUVPWDk0S0+fLruj9cdTAwMTXi9a1hyeHPul5kXHUwMDFicFx1MDAwMcpcdTAwMTAyelx1MDAwMJe12yvSXHUwMDA1L6nljlxuwc6KdI7wJ02myVx1MDAxMMeVjI/xM4P3966/g8gq46PZ5HCi09x7eVxukfrw5V6cT19oVCv7ZFx1MDAwM2ryrsD863FmS+nYMlx1MDAxZXRcdTAwMWEnOzKWXHUwMDFmXHUwMDE3XHUwMDFmXHUwMDEzPNbmpnJcdTAwMTFJXHUwMDE1hrhcdTAwMGZ6uN9cdTAwMTFAcTX7Jy7EXHRcdTAwMDSt1Ev91uxcdTAwMTbb+btYorrPXHUwMDAyd+uIJntcdTAwMDc2XHUwMDAwglf0KWG4u9yYxlx1MDAxY3dWXubwnrvzp1x1MDAxZvdnJuW2wdJYeXJcdTAwMWOF7fOcxzWrh3GwcOFcdTAwMWTTteFmQFerTexHppJcdTAwMTbvU+WiKz/jpC+fJ1x1MDAwNd20nXxPkIWR5Jrq4phqRD7I2r4s2POXl96vpfC+d6yyXHUwMDA3IT1Tmjn4XHUwMDAym21bXHUwMDE5t8fgt7Ga7vpMinJcdTAwMGV4XHUwMDE0aX3M+1x1MDAxZufMr3emXHUwMDEwNEiUVdaCfmeb29jXi3PNhb/H9Fx1MDAwZdZ7Y4GyrOnGc1x1MDAwNXmicZibl7+9X29f9bSHwoHYwV3rhCdqTO6eXHIgkFWsvUtZXGZbyOhfSFx1MDAxNlx1MDAxYtC5XGZcdTAwMWSbvz/zVr9cdTAwMWVPk3mJkfLXP9+iaXFzXHUwMDAyfFx1MDAwNCj057tTooItjK1rxXs7n6ZrknCvk/VQrXlcdTAwMWR96PK8heTrLFntXHUwMDBloFwiIeqGbn5nK2iKftxrkdHumjZcdTAwMDHc+tJEdNdcZtJcdTAwMDIhotz2JqKHd7/Fg3o79MG0/2ZgqVx1MDAxM6NcdTAwMGZcdTAwMTGimlxmdks2OGhcdTAwMTZTi79cdTAwMTepoKh6U+rl/XFelufwXHUwMDE57MC8v8Ym0WGfSTlcdTAwMTNvON/SzW8oXHUwMDE4XHQpm0hXX6RXXHTHwqLY3utjo5w7XG7bJcKciE5ccv/8sno4XGJcdTAwMDFXXHUwMDA2h66JrvDwJzPdgDPLdlmgXHUwMDE5MaSfl1x1MDAxOH899lx1MDAxNvMzZ/z135zxe+PT+PKcPzpRXGJcdTAwMGZcdCPz3oG8+npShW6ntj/evP1vXHUwMDA2tatcZoLZOGp9c2hnXHUwMDE5nHFe0tKedTBsJ6tcdTAwMWTPkVx1MDAwNT684LRBP25cdTAwMTdqnpfR6zfC46BUSc9KPZ5cdTAwMDfjXHUwMDBlc9ZDXHUwMDA13Vx1MDAxNFx1MDAwNz1cdTAwMWRm+HjvNq5ailx0XGanfCBcdTAwMDZ3KLJcdTAwMTNcdTAwMGbdhD2Zm91qXHUwMDEyQL9XXHUwMDEx4cWqckgrSZpcZn1d/e98hp7kXHLkq/sj9odcdTAwMTZcXDo4qVx1MDAxZuJGfXD+wGlFvJ1PseH8qFwiIcBngfA5hN/eXHTxwW2VL8eL/8Fe1r7jkYdHNNBSK+NUXHUwMDAyfJHi2DiNfMD4hV8z6+q1ud37dniyKyYoxDReydfxifgytq6WWN9YP1x1MDAxNjJcdTAwMWWYNN5RKPnRsZR/SI3zmXCxn1x1MDAwZbyrjO/8lYHhWlx1MDAxND2h58M1I9omTyovyO6RkZZcdTAwMWVsxko+7Kf67ckzbeU7pjBcdTAwMTDq8Tv716ZcdTAwMGJ7sNllZXJImTtcblx1MDAxMqNcdTAwMWKbymysIVxczGCVfe3INStg/2xDvPo3hP5xY6fG3vvY1lx1MDAxMMv+uOLmRInuJm4/JFx1MDAwNmxcdTAwMTnBM4BcdTAwMWPrXHUwMDAyMWtRPkgoXHUwMDE4UK2HYmAj6dNcdTAwMWNgXHUwMDAx03CAjiR/nKnsalxy1XBI47d3gFxmcPzKnbFcIiG+OUuLPylN+5+ua6dcdTAwMGZcdTAwMTeXh3uovj3UXTnknoBmxifa0X1cdTAwMDTGbI0q41x1MDAxMfRhl1x0XHUwMDE0LjH5ca/Vgi7s8zezn8O+nlxyKeeXqW+hJMnRp2R1sVx1MDAwNkuknXBcdTAwMWJ0k8OcVc7PUrF/uZSeKVx1MDAwNrvLqPeKQJIxQTyq2jcjzFx1MDAxZMW6P9txNdTPXGKUMnsy0lTIXHUwMDE4x1x1MDAwMpmH2ZRh9Un24So4XHUwMDFlTyOgOk9cdTAwMGZcdIb6VSjAY6G1SoVepoyztJ5LsXg81sqOXCIoZMVjeGLTJHvXXHUwMDEzkblcZlx1MDAwMCr1/Z1cdTAwMWayv1x1MDAxZkfY+D36N+f5uDFErpvKI76x1lx1MDAxNb5cdTAwMTiiXHUwMDEzJ5pL0HDxXHUwMDFk3JhcdTAwMDd9yMHQkY5gXHUwMDE0XHUwMDFlyewrdz7kb1x1MDAxZb1cdTAwMTGYXHUwMDA3XHUwMDE3PeNkfZK600bdjHz1uNlD6lx1MDAwN0ZNmDKqW/jFTlpcdTAwMTbVqkt2f8dk09uA41x1MDAxM5VcdTAwMDdBXGJ80zCXt1x08HDwdNVcdTAwMTZcdCWCRGXt4U1/IERccr897lx1MDAwNFx1MDAxOSSN0sDU6PZ1/8isPcsuycn6mvm56Fx1MDAwNfv1midL4+XfXHUwMDFj/Tnces+v8yzFszum3pxcdTAwMThk0Fx1MDAxYciLeDBcdTAwMGVE9FxidnXWzTrq96P/veOJTTj5XHUwMDA14ULBSXTCZKPBXHUwMDA1MZK8gFx1MDAwYlbOwkx5XHUwMDFmmlwigE55gH9txf1cdTAwMWLJLrMqcaz1nUMxMd7vIcf2xGDo92zHi0PxXHUwMDFkqFxih/SEb7qNcJh6v/+IK2TFXHUwMDEz1qc9UTffIc2YX7JcdTAwMGLhL1x1MDAxZKU9TLd+7rBSP19fjNlh74H8vYvM+Wo+XHUwMDAzw9dCapKH44KUgPL4qZZcdTAwMDNEXHUwMDFliNLef1x1MDAwN2Wvvz5uRWVaPEyM90a15aUxvmORXHUwMDFmgKykXHUwMDFixd2nbyN0zsVkSL9cZlx1MDAwMe/syP62XHUwMDE5pnWvXHUwMDExZJfBRCkz8Wl/PtzFPN78lmx8IbUyV1x1MDAwNzdbL07D34Ms2nY0qdpcbjfe+UCblPcpZvO3j+7LXHUwMDA1bs5cdTAwMTb9eVxuuUplmHgocmumoyOVnVx1MDAxMmHjXHUwMDBmjPHIgOal5z/t8f/F68cgrGadeEy6+IxcdK1cdTAwMDXrW6dcbrFH6tiOTM9ccrTZL7RZy1x1MDAwM8dcdTAwMDFgxiBDmFxiyejY8MbmWPOfWM6pXHUwMDBmipZcdTAwMWEklCnOXHUwMDE4XHUwMDEzuX6e/dMgWUwwu09+qFx1MDAxYZ+IUdpUXHUwMDBmv9KzbXs/4rpvXHUwMDE1wpdokrZs6jtcdTAwMGZcdTAwMTBcdTAwMTNcYoaRs3yBguT+s/y6zy27bVx1MDAxY5XV2fiE0FT2wFx1MDAxY0RIN1x1MDAwNjF/XHUwMDE2ppubXHUwMDE1oXYgv3HUsNW3OJ6qsbH1k+JTJ8jwwaHX6EaOM+5ucXvR3mwqXHRcdTAwMGJ3NG3Pj71N4PBiwt3egmtYPYeItrVUto9TmiTaIFx1MDAxOVx1MDAxNjMxXHUwMDAyfVx1MDAxNl09XHUwMDEy31xyeovcPdJpn5HXosajy41cbsvLwl7zXHUwMDBitmlcdTAwMDJdb4w/XHUwMDA2XHUwMDEyXGZYQtj4b1xyXHUwMDE5Wop6+OlcdTAwMWYp2q9WYKiugzGyhowu/8QkiWK9ZDhcdTAwMDDHXHUwMDFj6Uv7XGK/XHUwMDE3J31/jVx1MDAxMVx1MDAwM1VcdTAwMWE091x1MDAxZv8wXCLjfsawbWR5asfbXHUwMDAyT7hGslBcdTAwMTh44DebozjT3JmrvJlY3YGQSqLwh7AqfFxuS+PWpkxccuvM0F1cZl5cZsolP1m2pkQ9iaxCUXjIx9Tpo1X7Lk40QDpqZ+n+XHUwMDAxMbu84j9cdTAwMWF08rhvwJz81yv5qf3a5tfHX2TBXHUwMDBiOWXycVDWZ6/SXHUwMDExXHUwMDExMTxcdTAwMDOfyDYy41xuqvX+qf2OcaO/fO45+ow4KXHqbmaNcYi38Fx1MDAxYV3CTUttrHxcdPD7XHUwMDAwa4t5bjtcdTAwMWTY6k5E3NK/9WHrcPzeaj5k0K1rzE5m61x1MDAxMvfB61x1MDAwM/169tU9SXM6XHUwMDFkmT1cdTAwMWND2cKZrN/nfzVcdTAwMDWjyFx1MDAxOTvnltAhXHQ3gvNcdTAwMDV9bpaBQpfG78GK/a1N+K5N831n+V2b9Lu2+Fx1MDAxOVHJJ2xsXHUwMDExrHU6Kq536Dwj6Vx1MDAwM4dGXHUwMDEzXGY2LzvS34yYVmFcdTAwMDEq8mkxrb9cdTAwMWM+x2FPTmmLoUpO27BwSo6b71x1MDAxNM42tFx1MDAxZUdcdTAwMWMsXHUwMDAxjMhcdTAwMWHN295b00I98Gks6c1898hCv88xelx1MDAxNGW8gVnwXHUwMDFk0V87YI0nZVxcVzFcdTAwMTFSTyjPXHUwMDBl56qxrlx1MDAwMTiuXHUwMDE4nkBXXHScXHUwMDFjtdN+PyGQn1bTXzJf4jEleVx1MDAxNfovjvVcdTAwMTg+UMkvjt2EXCI1mfc1nzpcdTAwMWaKV0BcdTAwMTaMjSZcdTAwMThcdTAwMTf9zax++P3wYD/Q+TuX9Kl0XGYz2DctyMOtkMOlkoS2PHG9coFnhmd2b29cdTAwMDD2pltcdTAwMDGau37T1kfcS/n8jIPukPqB5IdcdTAwMDfVoVx1MDAwNMTUz9acfDB5iygkUphsXCJ8IXOl2+qKcnOkcJpJmm/68Fx1MDAwNoVtuLBLgaT8zTcuqymSfcdBXtQlXHUwMDAzav/GXbuDYKjJkjn1ouEnRFxuXHJcdTAwMGJtz3a75vmyXHUwMDFiwiez/L+7dYbE1olcdTAwMTjFeT7my5DgaD1ZpNIhRGxcIjBa6+m104/IWVx1MDAxZUI6hi9cdTAwMDVXbp5jjjuyeKdBQ0hlg1x1MDAwNy2iXHUwMDE1hNs707OqXHUwMDA1XHUwMDE0+fPeRN++wThJ5qxrXHUwMDE5XHUwMDEza6dqmVh3tq7ZXHUwMDBiglpIn01cdTAwMTPr7ZPsNp56J/xvz1x1MDAwYtt+muLLP/YvXHUwMDA22NRcdTAwMWWkpUzskid/J1x1MDAxNcCEtp7h+7Ep3M1QoSgth+5/M+egmyCCw1x1MDAxN8/42Hs/pXqdIOCzSStmpqtcZujO6mFcdTAwMDVcItxBTyR0cvJ1pM1cdTAwMDeANJ9N15mvnlx1MDAxZPurkIBhK5JY1fRZXHLvOJ9cdTAwMTZcdNizXHUwMDAzU6SWnoa+97TnYtfX4jVcdTAwMDVtuOtcdTAwMGWW1PhFg3RH/lx1MDAxZmHvtewoXHUwMDEzrFx1MDAwYj5cdTAwMTBcdTAwMTd4d4lcdTAwMTHeXG5JIO7wXGLv3dNPsfrfO2ZOxMSJjuhuxdKSqorMz2RlweMqNWqbIFx1MDAxOGK3T1x1MDAwMr5cdTAwMTc6hbNHgkhcdTAwMTSiwzl+ljya5cA/YKQ1fy/lcT9VhuvUKZK49/P52J5iW/W27L6J/fdcdTAwMTPANVxcdVxyXHUwMDE4Pv75XHLSMEi7im3TLsRCPGxXaCNynFwiomXMunVcXMeK7Ea6SVilot9dNGx5XGY7NJ5hXHUwMDBiXHUwMDE4XHUwMDE5/YZTKWdcdTAwMWJcbv32bEjRUTVcclx1MDAwNqdZwpPn7nvWPd2iKFx1MDAxZZzCu7/CJorYelwi7CdfKudcIlx1MDAxZlx1MDAxZVx1MDAxYzG+uMnNXFxsa1x1MDAwMFx1MDAxM8Cl451GxKrKgZifl4eW11x1MDAwMmdcclx1MDAwNDpcZlxi8ntb5Fx1MDAxNkY1dsHRotO5+viFXHJGXHUwMDA3X6LUyZpcdTAwMTLa4csuXCJlXHUwMDBlXHUwMDE2iZCrX8Kt8X3LeULXfpsuoTtcdTAwMTQmiVx1MDAwMb6S/LY9MdyPtohcdTAwMTUlsfJC8XxcdTAwMDEhr+GmjHCweISq5lrOx4yapUaYNdiLfLXRXHUwMDEy7WKFnnHI7tUvXGKgvXBdJzfuc8I8L/ZK8Vx1MDAxMCjOXHUwMDBmR6gqS1xyhs6UXHUwMDFkqcyGJ0fRNv9pqrapl1x1MDAwMYglXHUwMDAwb4LjYcDmXG5unMSAf3vLUCl97kqNRlx1MDAxZVx1MDAxZi5/2q4hvVRpwJ2wWrDivVx1MDAwYjFrXGL+fj01yCqXXHUwMDA3SqPoXkCR0Fx1MDAxYdOimTSqkkGyhrNcdNtcdTAwMWFcdTAwMTaQ0jxcdTAwMWbLTsbAyDKYNXxcdTAwMTbGxFx1MDAxMvTpp7FcdTAwMWNcdTAwMTZw0FhD5sm5ZEZYS1x1MDAwN9N1PFx1MDAwM3ya7Jf0YG12XHUwMDE3wbQoIeG5tYTaXHUwMDE2l39cdTAwMDUn4J7EcVx1MDAwNlowx4sl4GTL4ZrZXHUwMDEyoO1cdTAwMDeLatuDXHUwMDEzwM9ga1c513V1VeBcdTAwMDRKxl/Mu7GTqH43vdp5ZuHtWNmyxeFcYlx1MDAxOXelv2CxXHUwMDA0XGZ7XG5UXFxSucSTXHUwMDFkbS+Vd6pNZcIxLp/0mGZNt4hJX2NxQbz1PrCY8t6rtFx1MDAxNvTzzdv+g6c9iSCcN1x1MDAwN862QGe4hpnHJ0vW73lcdTAwMTaoXHUwMDE4ZCpiPGxKPDjcq1x1MDAwNlx1MDAwM1x1MDAxM2Ce+1x1MDAxNVx1MDAxMLZCsodcYkDnXHUwMDAyXaAgxUx7he6GWyZ8LvZcdFx1MDAwM4fYaNVcdTAwMTdeXHUwMDBmTZ9cdTAwMGaLcr2Mb09cdTAwMTlcdTAwMDSkbmgtv3y4hDJcdTAwMWVzjNa/Sqb09dJrXHUwMDFhfzzdQMRcbpSfZFx1MDAxNMhcdTAwMDJzf275x1xm1l6SxrZcdTAwMTWl0OdXp/PkL762UCenz6En0/GhLVtcdTAwMTI4XHUwMDBinO9bvudfZ1xyUpDObuxkb1o2XG5cbrbgV8VcdTAwMDbiQlFcdTAwMTX5iLeXyFVuxGuca/TaKlx1MDAxM1wi93g87N+X4yTkwKrJel5LqdCQXHUwMDBlx17LUOS7tCpcdTAwMWX9jE9+q6L6c/3lVVEhXHUwMDA1wVx1MDAxOWmKwkt76l6nv0NI91x1MDAxNONcdTAwMWSzgS5cdTAwMWaxXHUwMDA1cOtcdTAwMWK7r+8zWfNUXGbRRsLIOEWcQFx1MDAwZVx1MDAwND+fz3JcXFK7bKbATqquY8fyIb5wSF9odP1CS9yS7MZ+3nlhL1x1MDAxZKziKfrzP9/me3jfMXs4pZ1kudIzymNYUydjkG5+YD9cdTAwMTBfwCs9gYTgwJywX1WwrSo9rtAgki+GXHUwMDBmfotbdueWODLR24BmaTLJWFx1MDAxY1x1MDAxY8pWKiF8TXOOXHUwMDE2iSBcYqJr7Pqqmfn7KXneXHUwMDE3U1x1MDAxOaxEWFx1MDAxMvWLXyRcdTAwMTDYSJfXgiWxl8itV2/+p1x1MDAxMy5cdTAwMWNcdTAwMThlw1x1MDAwZlx1MDAxOTlFY1x1MDAxNrNVbUpcdTAwMTFxXHLe4Vx1MDAwNvup0ZLLXHUwMDA0f5CgtNlcblKDNP+h0dknXHUwMDA2h7LCKpL5ujneXHUwMDBlkmGDXHUwMDFmNFPIMK4/icaih+211lx1MDAwN7dcIr6q8utyVotcbq5cdTAwMTL3Q/THQ8Dv+y+Tn4dcbiea2Kw/K4QpXFyrXCL4/dLLl1x1MDAxZKT2ykJ+Lzbv4k4oYeLVvSu/Mlx1MDAwMjfSwMBDXHUwMDFm0i96vurQm6ndVkyVfpNzv6JcdTAwMTK2Y6n1Ldfn/ku/ojNh9aBVXHUwMDAwctPfhXQ+Qpx7XCKkXHUwMDAxS2Lb4dTXXHUwMDE3R2E6h1x1MDAxMlxyn1x1MDAxZFSke8J32c5cdTAwMWRRb9NPjMZcdTAwMTeSJEOZouPjgyrbWs1t1ezF3HNcdTAwMWPPctovOWdcdTAwMTB8XFzx2zk+5aPmXHUwMDFh8FxuXzBcInhcdTAwMGUyoCyq+X0x5bQmIXrQJIJcdTAwMWLg4nAu95BifidkrLv4tlx1MDAxM3tUc6suXHUwMDE0l3N9TN2JYF7pnkcjkFx1MDAxNGJcdTAwMDRuk4I8olx1MDAwNPpcdTAwMTHb9Vxmk+PpZa2EXHUwMDFk1aOZ4sKULKlp37C5jeRVwdDBilx1MDAxM+3Eelx1MDAwNkxPXHUwMDE5xii6bKaOM9K8Q7903nXJpFx0OSVxn4bAR+lcdTAwMDR1XHJBoptcdN2xuMhXXHUwMDAwXHUwMDFmOIE/UFxu6bo4hFYoXHUwMDAy4sZ+lz9iO8BVguc7uP4wQH9wQOZWXHUwMDA0XHUwMDEzoVx1MDAxZM6i3zyPnu9cdTAwMDNcdTAwMTj5iG8n7Vx1MDAxMyTzXHUwMDAzMUjPcC5cdTAwMTi5Y/khXHUwMDE1RJG2nmIvvlx1MDAxNzrA2OE9tWydqE5dYE3tunCGVOu0m7py4Vx1MDAwNqFcdTAwMTCiUURvPDK379j/UnpcblOxOHKvYVRyI8tSXHUwMDFjTHBJf9WhrjQx3Dn2Pfzp+SxnhFRWcaVcdTAwMTBTXHUwMDAxdsaUUOgw8sqo41xcv49cdTAwMWGBsZDFuHNk/ynAZFx1MDAwNf5pXHUwMDE2N1Lzzu++bjnCKXaHn7aApuzRWbH2MfXQndXAPci+zP5hx1xcXHUwMDExylx1MDAxN1qJxJtcdTAwMWFmiVOiXlx1MDAwM9Wp3oaIPrgjxn4pXHUwMDAzX2+IzXYto+Xr73mwPu9HVLxcdTAwMDXwst5H7VxiszBHlmcj5Fxu0pV/XHUwMDE43ocx9sqmnesq8o4lWu7jXHUwMDE1XHUwMDEzXHUwMDBl5yZqe1x1MDAxNrvGjlx1MDAxMtVK3GHfulxcWHNcdTAwMDM6kVBaPrmghsLhqcpNca1aIa69m39cIoPhxFOaN6y9jHfo0Fx1MDAwMW0tXHUwMDEx/MLha8ixzYBcdTAwMDT69Fx1MDAxMIWpoKPFIJe6t7M5VV5cdTAwMWZDsZyeNKSqjSRf5M1zdWP7o4i/XCJcdTAwMWYzy1i6htdPmj4489pNZP3ij17FI+H9XHUwMDFjafRcdTAwMWRBqVRcdTAwMWJAdlx1MDAwMdspsVv+XHUwMDAwfPWa9026XudcXEuSwa3ZXHUwMDE2m7XxaTfnejL2XHUwMDExXHUwMDAwtsfn0lx1MDAwYvBfWXRcdTAwMTBcdTAwMTh7UbyfYI3XXHUwMDFmXHUwMDA3fH7yXHUwMDE3j9GtKWx9LkmE7lN4P1x1MDAwM9j7oSw8x9Gcf1xyxn1cdTAwMWI9Me9P51xygtJ1gXlcdTAwMTKXcqC/eo/N9fhtXHUwMDFmyHCSXFxb4nFNpldcdTAwMWF0JNNoJnpe7Vx1MDAxOYT06n3mvjLDck5cdTAwMGVgSeAjmSzcXV9rXHUwMDA0lFx1MDAwM8ZKomRt2XAlaMNBwkxcdTAwMTTdd1x1MDAxZfehXHK1lGRxaNBt0YZhRIel/CtT0lvRq4y35OpcdTAwMDBcdTAwMTa3XHUwMDAwmGBJbelcdTAwMTB/eiee86W08Ud6tkf8flx1MDAxNNjSXHUwMDFkWFxyQW8uY+FyWPw4y2HukXVcdTAwMGIn6Fryu39cdTAwMDf3ulwirVx1MDAxZKdZn8THXHUwMDFhXHUwMDAxUU1K/fx+l83mXHUwMDBivFx1MDAxMalrL1x1MDAxN219Z76jzaVJqe9zY1x1MDAxMSi8OFx0M1x1MDAxOZihKCVF5GZcdTAwMWHXx/bWllx1MDAxN3HjXHUwMDFkicFcdTAwMTCOx9G5hCNcImTyp4LyYDOybz5O41x1MDAwMnlMa21ccuKI/MmHxVx1MDAxYlx1MDAwNO/6Ia5cdTAwMWUksVBcdTAwMTS7+kB4/Fx1MDAxMUfKoKtPXGKOsmxcYjOG/W2RuWkm5Dqrl8Lrdd1YwvG8M2g9b4xy2yBPa9w/xZB6X+r93L2an6U/rGY18WEofoy5gCVcdTAwMWJGKtZcdTAwMWaWLNrX6OVT0jxTXHTD0OxcdTAwMWEsM9NQgzrfp3NcdTAwMDWGQ1x1MDAxNN7j9u87XGZcdTAwMTXwXHTfNZnK3HH8XHUwMDA1+CroXFzwXHUwMDEwt26K1C6j4Vx1MDAxNkFgz40g0m+dKfjxQCHywudcXCNuf/zNXHUwMDBi359A0Fx1MDAxY8tIP9cmflbZ8Vx1MDAxNKzzYjvdXFxcdTAwMTfDMWfcpOj8enPiUTLDXHUwMDE0iSFyXHUwMDE0Oo1YWMeHXHUwMDE2euD+7zA+oVZNo1x1MDAxOK1cYl5cdTAwMWNcdTAwMDJlvaA1rr/FW6yqllFSq1th2CGee/7ON2FYNWfETe6GVMF9XHUwMDExXHUwMDFjZ1x1MDAwZkxcdTAwMTCeNlx1MDAwMFx1MDAxONVQgendPNF8pUyNXHUwMDE1XHUwMDFke9TwOj5zljzeUYC3u8VX6seIIMZcdTAwMGI+Q9OSjz9cclTKnLeQmt+09thcdTAwMWLO61x1MDAxYjnhuVNAX2ozb4pf9KKHwY49tlx1MDAxNCeV6UV+qrX9UcNBhOvQrniV8lx1MDAwZdtsUalcdTAwMWGOLy1NaYTbe/p9fnVzXHUwMDA3o+J47fmQ3ojG2JbV1sKQoVx1MDAwMSPq5UpcdTAwMDP1b9E6Tni4gsd9PFxyeVxm1UCr0b1fP4tcdTAwMTfxUlVxnfemW0GCIzxcIvCWKHVU2rNMXHUwMDFhXHUwMDFi6LiS9EW5K/qFnow+XHUwMDE0XHUwMDE2qX2g81x1MDAwMGHlvF3uXHUwMDBmz3SbXHUwMDFi9235JGNcdTAwMWQtXHUwMDE2XHUwMDE1pSalR/vDlieiXHUwMDFk+C7FnVxmXHUwMDExgYg0vFx1MDAxY4VcdTAwMDZcdTAwMDA89Fx1MDAxYqjLMP1NOCXT/aWQy6vtX+SpTO+WvFx1MDAwMqyHdKaLXHUwMDA0hpiWh9CbXHUwMDBlh6zSKysnXHUwMDAwSVx1MDAxNkNTME7hXHUwMDFmtEryalZm0frjXG5cdTAwMTGYZ05MJ/5cbv50TIm873mpMlx1MDAxMbdcdTAwMDRcdTAwMDVcdTAwMTfdXHUwMDBmnUgzT1x0XHUwMDFhy9OpbIGBPXl2p2HeXHUwMDEzelx1MDAxOZufXHRS3p8j8K7CyTiEN8zv8k5/6Vx1MDAwZmDxXHUwMDA2KVx1MDAxY7yCOUdEXHUwMDE0nTX87Kbw2V/OQr6Lakkr0YleoSFIyDb6J9Z17oVf+biDuVx1MDAwMbxNXHUwMDA1XHUwMDA1SUPWbOx0SjqQ41x1MDAxZvLISeDTfi5SU8dcdTAwMDJDUcmyYr6h7WeDUX12zdbKm92u+JZni9l1jTxv+O/zxtvmznlpblx1MDAwM4OTwynD5Vx1MDAxOIfJnu3p3YG8w4on5+BcdTAwMTdotVx1MDAxNuxtWFx1MDAwNZ5cYnfsXHQ/t1x1MDAwMGZpoFODQkOdwKzDc2m8bsROvvTB9WPbLFc09GhcdTAwMGarYTr7qC5cdTAwMWX6dFx1MDAxZqyz0b1e2qtcdTAwMWJzT3SJlXFhaFx1MDAxOFx1MDAxZYH4NKZEL1AhI4+ZZniLZqDEQU9o3V5b9rJcdTAwMTVcYln1Kf/OmJXu31wivJ/fXCKuY9bU5lx1MDAxZGPCfMdYaoX2XHUwMDE10+38mjqSt4Ff1Fx1MDAxM8T0YlLLXHUwMDEzXHUwMDA3XHUwMDE4fSFl01x1MDAwNGnmP1xmXHUwMDEwXe2jvWpsXHUwMDFhTKzyfuOYXHKYe+VqMo2j9siX1/p7vEVrirPUp2pcdTAwMTVvXCL/lK8hXCJl1K4s4GHAqjz8+lx1MDAxN3jCO/XeeDo88NBjzFxyN3jzM7DX020s1ihtzuR5RTVcdTAwMWVcdTAwMGax01ZTuDGrd8C/lpBaQHIq0SBQ0pZNXHUwMDA2YttcdTAwMTLzaom8XHUwMDEx6V9Xgjcs6Fx1MDAxYbPlzdXS+lxieLQ30rVOo6Wep9etqexcdTAwMDF18G+bhGeKvNvWtIa8Tkz7+9nHXHUwMDFmXHUwMDE2q9FcdTAwMTS+zlNbXHUwMDFiXHUwMDE2MFHEJ7VcdTAwMDUjW+VS9VGi/dwsXHUwMDEwXHUwMDFlryOIn1nfXHUwMDBmPex+ODBmgFx1MDAxOFx1MDAxOCu+qmUzKphcdTAwMWXMk6pQXHUwMDFj9V+e73qU299cXL22vzfxXHUwMDAzNFxy3/WOXHUwMDE0ysyLXHIhcfOgXHUwMDE2pVx1MDAwNmCUXHUwMDBis0ZX/zlKiFx1MDAxMVx1MDAwZlx1MDAwYlx1MDAxMYPlkbfHm7tzO3vgXFzJqkT6dn9s/F6S+udIXHUwMDAzuWAulUmITPW0XHUwMDFhrW1cdTAwMGXg0XhaKOGvNqJY8KFcdTAwMDFcdTAwMDVYWSnxnaLdm2O+0lx1MDAxNVi0XGJcdTAwMTXIm5BNoDNOWbuldaPj7Vx1MDAxYVxidJdcdTAwMDDrzeOyVrX391x1MDAxNv73IehC/PY22/I+Wlx1MDAxOOJcdTAwMTT9XHUwMDA1XHUwMDAxcrCM79sxS37hh/n7NkL6lPyEYzmX/7tOXHUwMDFhXCJYxZjuqFx1MDAxOM2AXHUwMDA1XHUwMDE3kdBDfpUuXHJPxFx1MDAwZqLx7MqAmDhcdTAwMWN13cG/OGM11UrJxodPKFx1MDAxNj1cdTAwMTFcdTAwMDbP7GVQpVjndkb0XHUwMDExd6Gj8iScXHUwMDBmi16VTJApadeUXHUwMDA1rVxud9eLxO726jaWXHUwMDFh5/73+sVcdTAwMTVAXHUwMDE2peaHnI2eXCK2XHJOqJzyXHUwMDFhOFx1MDAxOd4tukH8ZPbnsSHifVx1MDAxY+xvvFx1MDAxMiNVQmZV72lSyE87/N4w6c5nXHUwMDA2JPZcdTAwMDc3mufY5NekJqMnXHUwMDEx+8/D4leKbK/J8ty5i+DWfvbryiFcdTAwMTLSjFx1MDAwMoyMb0yjP4OCXHUwMDAxflhJtFx1MDAxN6GBhbxHVSxfXHUwMDFmbvCRb1x1MDAxMqe1XHUwMDAyJ/gxRofTa/5g9bh7JsGx3lqGnj8rzGx+ziZx0IUumcidcd9XvvxvrMpcdTAwMWYvLDN6mc1opJqassRcdTAwMGWji4KsKMStOVx1MDAxNZ9VLbRM6Y53febGqrz87MbuxFx1MDAxYWV7XG5cdTAwMGbk+lx1MDAwYm5C74Fcbjqhi46dtMfwPVx1MDAwZfuNtbH1XHUwMDE04nVf8Vx1MDAxZp7y5IFC9NTYW4w7hY0vMNBYOMUy+5LZ2LzEIJZcdTAwMDRmTFplr/PVXHUwMDAxXHUwMDEyfctYurGOXCLzXHUwMDA0bufu3OU2U/zh7v6nP9Rbf7yz0U4oLdVcdTAwMTKGimRcYox9XHTG6mLRfTLCZ+t0qZiaXHUwMDAxjDyKv3pcdTAwMDVXaEHyaovYW7fA082471bCX+STzaAgxNNcdTAwMGJfuIvOT6RjXHUwMDE4I1xiLeyL5eFcdTAwMTju72OLwUxcbuBJbD/B1fUgQyCdst65wHjtdlx1MDAxMbTSTefvxSFhu1x1MDAwMnNcdTAwMDZpvtPp4uc+SlJvXHUwMDFiPlx1MDAwMr+B2dzWSfF60oDCVJFzuIdcdTAwMTDxX+lcdTAwMGU7IKN5bi2EV91cdTAwMWJBoGvuWHZK7Fx1MDAxOXinPJvjOcN4XCI1TzGCM1x1MDAxYuYgePXXYmhO/dYtqqFcdTAwMWbc4L1cdTAwMTSt7dhobJKqXHUwMDFkJOtAhZVcIoJITJFmwF3rg2e/kCl/XHUwMDBmkuFcdTAwMTPk9amyiOqmZXF+Z/ec6oUtoc1TjsLUJThG1mNBhTHbQ8eXXHUwMDE1zC9g2aGd38Vk6blR6Vn/pcpsgGCwOINi8Fx1MDAxNFxcXHUwMDFi7q5cdTAwMTZcdTAwMDK4XGZbY1x1MDAxYVx1MDAwN7vIIYRhI6lScujBNFGe9yM/9yy6llx1MDAxNpDooYVI9zWRfzjgsHQ4o/rxybzvtev9c/WTlqy6LI9k6i1ccnJccr9oTVx1MDAxYvc1td+VPfdcdTAwMTa1XHUwMDAwvXKNXGLeh1gvkEjzNcnzVdrGbNfuWjgs9Vx1MDAxNl6vb4VQv49vXHUwMDE1++fcXHUwMDEyucTpXG5cdTAwMGZiXHUwMDA1yd55vlUxXHUwMDEzM3j3usqEgm3HtoTeKv5ppJKlyp1cdTAwMTNyb+A4XHUwMDBii1x1MDAxZlx1MDAxN0zj/ljNOH1cdO77olGVeDDDXHUwMDFiL5XzM+44SVx1MDAxZc9/2qR+xDzwdYiCJKZhyZSuXGJRJG1cdTAwMWb0U8+2NZDh75FccoJcdTAwMDX7h0GvZcqAbIQhXHUwMDEymaPW3E6PTebB6E7fq1x1MDAxZFx1MDAxObJcYovdXCIgpOjYoSE/m2HgPzHgPyVBOHhOwlx1MDAwN4ri97ueO901OJpcdTAwMDF/rHlcdTAwMTlcdTAwMTmGgSToRKh00qbX6XwycaLVtC3+y3eekYhpcmNAIJqZqz0qadXci8K6vqM3YoyOs8YzSefrxEbQ95if5DEgTl+aLpnCYliEuNv4ZEO9fyBcdTAwMGZcZmgrX1x1MDAwM/F9WrknuFx0fbGAt9HCv4qWUFx1MDAxYVx1MDAxM4tcdTAwMWLjXHUwMDAyarlTzFx1MDAxMrLL51x1MDAwZUtk/cc//lx1MDAwN2jvrFPY9TX/afG7toGns7HTWJzKXHUwMDEycD5cZpRrnl8prF+zdrbpkjv3L3d74XjFXHUwMDEx91xcVFx0XHUwMDE3m9ZcdTAwMGI7XHUwMDBm1+ZcdTAwMWHp1/JBkFI746n+dZco3n7Ru7BL9CHRXHUwMDA1llxuMVx1MDAxMJT5c2bQZu1yXHUwMDBmW1x1MDAxNzdnXHLffrGONPGlXHUwMDFmkrk5ftLPsuW4YvdbZ5iv8JV8jcfNXHUwMDAx/M1cdML1LVMuub97vzlcdTAwMDGOXHUwMDFmdl9cIsOBofSUx3muy611Ulx1MDAxZj1uqVxcXHUwMDA1P38pcMWr4O1C/zgjsi73ZnztqVx1MDAxM1x1MDAxZTsg9NpdXHUwMDE2+etLYy1cdTAwMTVcdTAwMWZZiqFcdTAwMTBcdTAwMWQ5X0EhbGrCXHUwMDE0tnwxSJ9pbXaV4IiIXHUwMDFk2khrLOVMp4h/wsH7Tm2sVP1IpKzxcnu/tERxbiOsstglh1mGTs112EjnMa3Z2n1U8I2iI1x1MDAwMFx1MDAxZMNC19usuNu7tHc9N1x1MDAxZSg2V1BcdTAwMWNje1x1MDAwMU7m0GBNeHNCeJE/SFxm11xye300lon4//Ft8Vx1MDAxZfzO+lpVpnuKQHpaXHUwMDFmzW3qQetQpVx1MDAxNb7LlFx1MDAxZVP3XHUwMDAyqrHMuFx1MDAxMKvJeWK7XHUwMDE0XHUwMDExfWN4aqd2YsUgcJSLwp1l+bwqTqhLvEJxfS1cdTAwMTFcdTAwMTFcdTAwMDKMiOLYmVx1MDAwNGjAR1czQ17Rk/fgXHUwMDAyglx1MDAxOGGJQGBNtFx1MDAwZjJ/7ThwP01GRWpw2Wbo38ZdXHUwMDEwzobjXGbMxZbduP3LKWjF4Ive0JLWuahvXHUwMDEy91x1MDAxNJd/XG5cdTAwMWJcZtZv/Fx1MDAwNVxuvjbLeLDzdniq0IkpXHUwMDA15FxiIf7jXG4wT1x1MDAwMM269yVcdTAwMTdkrvRRfCrfurW12ukvXepwh5lJhiE1xPo+94JNcbmW22SP/YhcXNLn7Fx1MDAxZLlDY1jcYqvcw1x1MDAwZvTHXHUwMDFl/Fx1MDAwN4JcdTAwMDGexi6D5GZcdTAwMDEnmfI5cKTy37hcXMGGZVx1MDAwMnL6IVx1MDAxZoAj64gl1lxyKOC1e78uMFx1MDAxNU/TXHUwMDA3K1x1MDAwNVp+0VBcdTAwMDU/XHUwMDFkmiZ1n43hx+vueWY86vX4q0Gbrlx1MDAxNFx1MDAxNK3dXHUwMDFhOppLYV4zcq9ba5Bi4YXD+vhcdTAwMDSmoPZdo/HHkkQxd2jIR8U/9jluXHUwMDAyXHUwMDE3cKWtzVx1MDAxOEFcZveDYuogrFx1MDAxN2vp3ENccjzMXHUwMDA2b51CpZMz08pZOEtWulxc1y3iIc1cdTAwMTIoyvRJpGvacFx1MDAwMmnzp1x1MDAxMcSiv5/r6TbUP38zXHUwMDE0rtpry49cInyjXHUwMDA3fFx1MDAwNOPVXHUwMDBm7yaJ+cDPXHUwMDA2OI/H28D3yT35v7ozl3LN90y+PbU2NNB8X51jXHUwMDFh3DjwT/txsq/YOdfaRknkSYPUXGJk/H0gz07ETM9TlI+A0N5xhcDJXHUwMDBmr/rkn4/l6pDuiVx1MDAwNlx1MDAxZYNhqSjxqYPBRm2EwLtChXlcdTAwMTGknVx1MDAwYlx1MDAwMXpcdTAwMWTBhu/tWFx1MDAxM7lcdTAwMTLnnW391S1/v1x1MDAwM8ArXmNcdTAwMDDG7/Xt7lqMg5A0LPf9IVJNxjJFQ2JcZvDlYfZsmFwiXHUwMDE02qTHhiuCe2iZwj1ybo5OdYjTmfqYP59oQabI+Vx1MDAwNWQwI9NTI9x1/qS73PD0V5dcdTAwMTC+ydV1hdop7t9SYynur0Tw60Uvm67PrLr+XHUwMDA0LUktNnLfxUW/UzpcdTAwMTI+SyTVOYh62ZLYhT5cZlx1MDAxNIeJXHUwMDEzVzZcXE+9eE0uflx1MDAwN3JD4pE71/tcdTAwMTl4vTdwa/m/+sB2tZtcZlbfnWBcdTAwMDRPNmTc0mQwO2Bap1dBXHUwMDAx3v777bv+Wlx1MDAxNF/B3zRcdTAwMTM1vdOeXHUwMDA2XHUwMDFkq5CM7D9UVFEp7mZvYyr5Rlx1MDAxNZCeXHUwMDA2n9aFXHUwMDFkXHUwMDExXHUwMDE2jDBcdTAwMDNvN66BIVslW0VptlI/gFxyXG6uYlxmZG5IY1x1MDAwMZJDyvxNo/2jNc+hdnR8XHUwMDAxuufsw0/A9Fx1MDAxN1x1MDAwMFZcdTAwMGbeVnPPM1x1MDAxYlx0znrcbVx1MDAxYoJqUau++7VjNVx1MDAxMD9if2Px71wipPSuS91YXHUwMDBi9GJYd1x1MDAwZoz6/azjnStcIlx1MDAxYlQoe1xyetS6W1xy2ZRcdTAwMTQqYD63Pq67d5lq5y9u9i7+7NP6xrzuXHUwMDA3hfbvTb5rxzSKs9R36aC/hipzXHUwMDFhZqivdX/Q/fWQiGNSOuiJjkCz+kZNr6GbRZdpP/OWju2yXHUwMDE4RfH8lOtnXHQ6XHUwMDE2g3RcdTAwMWPf6mz60Ksns9LlXsVfntClWlx1MDAxNDa1QpGO3/El/ouv/SQ7eVUs/ITlIEdKJ2dqZVF89uN3nOZuczmTj/NcdTAwMDHmr/Kcsv9cYlWZYsykPIUz146aXHUwMDAwhdafX1x1MDAxM0AhZbtcdTAwMTO3ipFcdTAwMTKK6HkhS+9cdTAwMTdcdLss69K2XHUwMDA2dcFcdTAwMDJ78tqy0Vx1MDAwYvI2wLpjhm57XHUwMDFmtKeklvzmxFx0QdpgXHUwMDEwXHUwMDEzKeGkUf2r+1xyzl27h6DIVH425+rM7alxqLg6eYHnak3dXHUwMDAzZdlJo6FiZvt7XHUwMDAzwMGKXHUwMDA2Y1S6XHUwMDA1Ro+Q3cefVoxUY+V5KqvTd91azIy9mFJlxlx1MDAxMWiNRctcXKk2elTDfc9/L+9tfMla31x1MDAwNZZjXHUwMDAy3ULhJ6pHXHUwMDE1bE33TZKscKWMi72MivOxXHUwMDExXHUwMDFivluX0qJ1+e/3qUjR+8CQXHUwMDE5SOXJhkJcIt6EXHUwMDE4x5nEwU/7goz0wmhCaz35atpCMp+uzrt3LJVhb9u9XHRcdTAwMDZZPmBaNbVcdTAwMWbidLJ5XFy8rCqVduGiv6GE4sD0XHRcdTAwMTTOPuaMwFx1MDAwMlx1MDAwNKO/r+J/6q/p1/jWJbxtL39tXp7lyY+voyvXfPJrv5S8sOJry6dcdTAwMTJJIVpnx9CnS1x1MDAwNc1ccrz0IUpL7Dj+l96iMaRtg5O6prNOeNNcdTAwMTFUflx1MDAxYVx1MDAxMpxSXHUwMDAyj6tnlYhFcpn1XHUwMDBmknF46ud4gtFcdTAwMTZ74+aPdKo65VxcT9eB1lxuUi/sP4yqWlx1MDAwMvynWV5cdTAwMWIuviMoOXNE+GSwW7M0XHUwMDExvSOc5lx1MDAwNXjkab1cdTAwMDJcdTAwMGVNKs5/e04qzX/2NDJcdTAwMTIjW8CaXHUwMDA3PSWMj5h2XHUwMDBmW/xYsaBrL1xmI1tcdTAwMGJ/ej+pi1x1MDAwZlxuXFw2T2FC4DnY5c7SXHUwMDBilbFtIFx1MDAxYcLs51n/vDTjJJ1WQ1x1MDAxOEbPL7sjmVi8jKgwXHUwMDA1/lx1MDAwZiNcclx1MDAwNlxm+IXfz1xmvnMjKM07N1DZx6dMV5XrOGj0vSGVXHUwMDAxMc9cdTAwMDao8V9cdTAwMDObXHUwMDFhL6S1jjdhJ//FlUdcdTAwMDTjXVDi6U/5pPNHhSWJSStNcPPETlx1MDAwZoczy0Xw/L1YQ/B+MVx1MDAwNqShXG6/TFxiSGCDU2hFJezGfqm4miRcdTAwMDRcdTAwMDNRsLas81pcdTAwMWLSeb2uelx1MDAwNJrveoAg9KIm4lx1MDAxZNEmiFxyni+KJUaMgGAkP+aLTFZcdTAwMTdcdTAwMDVcdTAwMTLQVch6v2t02K3P5yxT8J/MuVwio9/5QlAgXzpcdTAwMDfhtLEytvnlZPa2jdpcIu/QXHUwMDFiSCd/9qjkP63sulx1MDAwMueZXHUwMDFhWbtYV7VjUZfXkphcItIhTP96SknURWtsg69cdTAwMWV+T2Xf0JGko5f78ug+dmBt8t9cdTAwMWGQjEy+XHUwMDAzNmpJmiuBXHUwMDEyOOeCkmbKrG1cdTAwMTCP2fZcdTAwMWJcdTAwMTmK3Fx1MDAxNEr/XHUwMDFh6Jw3aFC5Xym0r7uq51x1MDAxM8+bJ5r7XHUwMDFlt3tRIFwic3sk1mSTpVx1MDAxMl29d4E3ovIhSyD43dpTRy2774niay38l1G/7/FTwKireCPLXHUwMDAwXGafJfVcdLtQ3Vx1MDAwMMZSPfZcdTAwMDG80dwlg0T/SmhTXHUwMDBi4dvooXVGrjg9w2/iYbdcdTAwMWXMJ4EvSFx0Rt9Yn+jnQClNzVx1MDAxMpVI7/hmXHUwMDFialx1MDAwMmlO+fuRb2DYevwv1ue/Nce15PZxgvLUb8x60yqLYuS7Wp0mhaiOvODq8UPzPOaxVWCPdWXD5PyLe8CXXFxDSESU1oecRjJcdTAwMWV/UVx1MDAxMXytRs9cdTAwMDQ8yp5QfVxyflx1MDAxY6Cma4C6oF/XXHUwMDAzh7LPoFZjXGah36DzfnPxzZeQxWrDc146XHUwMDA2fUq8rsfkcog9Rrcj/c6fp5iHeFRcdTAwMDXGXHUwMDA3YVLciDHJi+GDOuZR/pghfaR45zrbXHUwMDE17/hcdTAwMGLFMMrgIZZ6xXhn9c5LXHUwMDAxY5TumzRcdTAwMTn9/kYk5S/2Pz9cdTAwMGXEU1M/zFx1MDAwMvu1XHUwMDE3iqxcdTAwMDGV/5y8bkV9p5+X9Fxmu5ohq/JUO7X/68fYeuFTXHSQXHUwMDE0+p3ot907T03YmDs+Xu9NXfZbj5aNXGb1wOlcdTAwMTRcdTAwMTTHXHUwMDAwk/z+elx1MDAxZlxmVVtcdTAwMWX2h0dn7nx3wHtGWJDDfV+hUIZH8VhWiNCnXHUwMDBiomVcdTAwMDeF0CWJw6v3MeRvL9uV/3FcdTAwMDa77ad99/w8vnfPz9pcdTAwMTlcdTAwMWaJXHUwMDBlXHUwMDFj5FiD4XXAXHUwMDFl8YHZzjnL/XJZKZmuXHUwMDA3y4xcdTAwMDY2OOurvj0jt1x1MDAwYqpxXGJvcmlPz1x1MDAxYU9/aLP6veJcdTAwMTheXHUwMDFkjbXpSXuJyKJxSIy0XHUwMDAwR1x1MDAxOeTF7bVJRW9glEJcdTAwMTRjZWSrLatDy9p1eleMkStcdTAwMTFOJYjFU+8oYt3snzjHebhaf77HLtlbP+FcdTAwMDNbPfviflx1MDAwNnp770vEL8v/ObSNXHUwMDE2O1x1MDAwMs1cdTAwMWVcdTAwMWJSXHUwMDA1kmlauzRcdTAwMGJJd5hcdTAwMTXnJr2+dbNB/u1HXG6G+yN4Ul5FZD1fj6NcdTAwMWJcdTAwMWb1k1x1MDAxZFxmz11cdTAwMDBcdTAwMWT0KlxyVurnXHRcdTAwMTTSXHUwMDEyy3fpifG+jVxci/nMXHUwMDBi9ys3xi/2Y19xcVx1MDAwNuFS0kpcdTAwMTdcdTAwMDSPW6M/j1x1MDAwM3eWi3cxw1xc+5BcdTAwMGJcdTAwMDPYimA6VquzglxiRtzWdc9cdTAwMGb2flx1MDAwNFx1MDAxM3dpP1x1MDAxN+Sx/Vx1MDAwNnlcZqRwLyFcbphf1lxidywpXHUwMDFh/inLyqONc3vLeZZccrpcXJpg/bWghTJWe+PZ+Fx1MDAxMVhcdTAwMTOle/VPXHUwMDEzvoWd/5CGWDNcdTAwMWHnb1C/KI0oOTrFXHUwMDFmX0yozZhcdTAwMWbqpbRcdTAwMDRNXHKs5YP14lx1MDAxOXqcWS/95dM9NnqUyaxcYuWdJOWur4NVWrLRd1x1MDAxN5iOVpXKXHUwMDFl665XsHVcdTAwMTJcdTAwMGKNXG5cbpdeS+1cdTAwMTRdXyNx+I+3UGBcdTAwMWPQSqZcdTAwMGaAdVTA4Nm/XHUwMDFhwlx1MDAxN7rw6XtcXDSFztv0xX34RVx1MDAxOMa1yFx1MDAwZV1wkYlhkihYXGJcdTAwMTaWwIVcdTAwMDJ9n9Ve8VjUKEpWWVdcdTAwMGL7XHUwMDFjjFh5Id1ozrFhJ+x2XHL9NXBuWLT+SCXdXHRsK7/I2q1ro2BMOfElQvzAcqJIz8hOtytcdTAwMDCv91x1MDAxNZBr01x1MDAxZFx1MDAwYiQ1wzBTmUEq/nElsLV+ZTRcXJrLY2yndvJKRFx1MDAxOH3Lt01ERmxFuVx1MDAxOO0qc5VcdTAwMTBS5FQ5e1x1MDAwMCyip3pcYt8g2S1cdTAwMTG9+Tt4QdLzWXKLsbVcdTAwMTdcdTAwMDCE57xcdTAwMDb5R47Pequb/Vf+Lu5iucdfqafvxc5DnXgw/KnfYEy65Me0enj2Xp6Go62U6TlcdTAwMTnvUI3QMV1oZyjKLGu66i0zMIGb/sNe4MX5jkiht1x1MDAwZmxw9Cbhpo3MN1x1MDAwNTHiUkJTVNNsyH7bXHUwMDA3QL3oz2dYgvNPZ1RTxdc8r/aLy/Ep7XRDv5DSil1cdTAwMTmziDw02E1D1czcQ6aCVDL8+ldTvHPk41x1MDAxYX7jn97Zflx1MDAwNthcdTAwMWZcdTAwMDaGiVx1MDAxZVx1MDAwZmP0RFx1MDAxYmK0KlAvxVov36uXXHUwMDA2id9touriRlx1MDAxNqbK2JR8VTJiP69cdTAwMDV7n8nMLk8oXHUwMDE0+YXssn7ww3jtSihmtzjQfzstXHUwMDAz4ZZcXN9y2Fx1MDAxNlx1MDAwMyNcdTAwMTi3glx1MDAxOFqXXHTyXHUwMDExXHUwMDE3yjw9RT5cdTAwMGb+fE+F/O48V1x1MDAwZkcz70VVk4eg83QkqkF+lk9BwXdcIoBKlyXhNVx1MDAwZdds6Fx1MDAxOXf/sZBjXHTi8bdn9Fx1MDAxM+ZTrkczXHUwMDFlOMx5Vv4v/0AnmjZh/G2tZ+1oPkFURH7Iqi/7TDmieLhcdTAwMDXBotlkXHUwMDA0pHRIXHUwMDA2xlFcdTAwMDGGxHVjZVx1MDAxZkhcdTAwMDXYm/4xIClGQVsod47iT4j5ckd3vuSQNEtpqji+l5BcYoNcdTAwMWZ1ZZlbXHUwMDExrzxL48GfSEo/SfjoTVx0u3hpub3Dss/Ap+dAMWvw3UvquFx1MDAwZoGyqFx1MDAxOEHe2fvj2cT52XI9zFx1MDAwMJBPVkxcdTAwMWbV+f57XHUwMDFhXHUwMDBlK1x1MDAxOI5Ap8o/j7xcdTAwMTXummmJ36Ve24xqMZbkcZBuW+LfXHUwMDEwiFx1MDAwZrFcdTAwMTGpx3ShaVpcdTAwMGJcdTAwMGaw9G+1wycyXclcdTAwMDJ4Ra1cdTAwMTNcdTAwMTLzasXoavv5/Vx1MDAxNFx1MDAxM/wpbCGiYPRlOJm/OVx1MDAxM0ZcdTAwMTDOVMHVOFSC5H/LXFwm2yDgrJu/+rvfQ4BtvbVcdTAwMDROVVaw2lx1MDAxY73SJLCnW0/iroHTotNNy0HRXHUwMDFlpH+DXHUwMDEzL1x1MDAxYjlzhMgl/nxcYue+WoH+KY8w7Fx1MDAwNsWfXHUwMDA2Q3qegU2HXHUwMDFmrF2KXHUwMDFm3XtzYzSqt1x1MDAxN4BcdTAwMThC/F1h4K8knyPfjq1rTlx1MDAwNd1IYf2b+Vx0qcX+a1x1MDAxNeJOXHQ6lGzh9TVd7WRcdTAwMWHC+unxXHJIYlx1MDAwZnc8ssdfuXVQ6u09gkPT4/WZXGLD3YCgssb7roE6r1x1MDAxM+LuXHUwMDFhyHT3La+4XHUwMDExrSNApDeV5HjFXG5cdTAwMWI+XHIn/cHMYlwiXHUwMDA23KVn+NqyYCxcdTAwMTfFe+7/9mek4jMrYmnIXHKSN5Cr9uj0/Fx1MDAxZJKwsnJdRk/SXHUwMDA1zmwl/et+TjfdP1xcu95cXJxcdTAwMDJauntcdTAwMDZcdTAwMGZcdTAwMWXX+YGQm3l6oVJXVlxmw7zjPPOH7zvPRKf4by9dRzjuXG6H/2okIZBbXHUwMDE4XCJn7Vx1MDAwMNduyWpMvjTPLc8hqS1Ldso8xVx1MDAxYz54TbxcXOdcdTAwMTV8RO5711D7nlx1MDAxMGMxRpfx8k5v6SHphVx1MDAxNYlFPYfzUNyhtcpcdTAwMDVbjFV5XHUwMDE2Ke76b6c19De9Vph6gbRD9y7xUfTEn7zgo4v/0GKzLt/x9mEhkq1cbmgxt4pILci6Rlgx2TtW5n+x4lx1MDAxOK0l/sVcbtBcdTAwMTD0TJJcdTAwMTSlZc9TQVTgeIH2vC72VUOtVXuUzJzT93TXYm3rXHUwMDFm9VdjXHUwMDE0zv5vz53KXHUwMDFhNlwi6lx1MDAwM4u1XHUwMDE3PoUj1+ozXHUwMDEx681rv2jv3d99kJhcdTAwMTRGwlx1MDAxN6qv9quhz4zWXHUwMDFlmZhE/tNcdTAwMWHG/FxiXHUwMDA27lx1MDAxYkXoW4eryd1cdPZlfvRjiTLXzoBwZt7werUsNctcdTAwMTeL5fQ1YemHXHUwMDFh1pdcXGyUdJhcYohcdTAwMGbRuGvSXHUwMDAwT1x1MDAwNUog7n1cdTAwMDD+1rxcbnKdRFx1MDAwMT+3t23gv1x1MDAxZlBz77L5pJArru0kXjn86bxliiVcdTAwMWGoqT+vyvPfUFXCujx8rCp+d1xyxPdW8mtcZpn3pd+OIVx1MDAwMG9cbvTcXHUwMDE3X5FcYmnsjyFC1tggOoibXHUwMDExr70ogVx1MDAxNoZg4XZ00IdcdTAwMWbQcNYjw26FnJVcdTAwMTfMVk84XsOyeKVcdTAwMTn8TNPM8og+Y83zz++p2n2ARkg1YH/+9oe/77tnNYtcdTAwMWNcdTAwMTnaUnams5SL4S55XHUwMDA3XHUwMDEzpPrpxKDjYPGl3pRcdTAwMDJcdTAwMTWTicQhye2PTkF66kl/SFwiMMXEezhXu1x1MDAxN8W38URcdTAwMWb7/jqEdFx1MDAxNlby7Vx1MDAwYqFFPLGdKb3651x1MDAxOPbT90revoJhpn82yj0s7KO9XHUwMDFhT0JP+fmkcqJcdTAwMWXWTFx1MDAwZmuvXjEs9lx1MDAxZEX/XHUwMDE4eDdcdTAwMWOw5vQy9v6vJ1NcdTAwMGLvazCf5SFcdTAwMTZgPobwVz9cdTAwMTCoztqeJP01qZKkUfuCsUCgn01oNDpcdTAwMDdcdTAwMTG8XTdcdTAwMDPX3lx1MDAwYsD91Vx1MDAxOLjB91x1MDAxNHGtU29tXHUwMDE4XHUwMDBmf+5715Fcblx1MDAxOZ5N+v6iUVx1MDAwMHLdU60o6fBY60RcdTAwMGWn/adAKZ2xOSzmXCJJY8E7fzGHiWNcdTAwMTac5OZz3YJZQaWzoFx1MDAxOe5vXaN/++7f1fz9XHRcdTAwMDP17nvg0kNcdTAwMGZcdTAwMDZNVXR8jHVjoPBcdTAwMWMmXHUwMDFiaLLgtT4qXG5cdTAwMGaDKOTcdvOFv2tl8Zwq0Fx1MDAxYZFcZnss9XetrCt9mZHpXHUwMDExU2RcdTAwMTL1tVNuf5k6tXhgKVTEXHUwMDAxXHUwMDAz4eNb5GJA02ZfzKV/+VK4XHUwMDFlTFx1MDAwN15sLPdt6tVyXCJCX1AvM3/AxCuB0q9cdTAwMDacvkLOLry0UFxyo39ezPhcdTAwMGZcdTAwMTfh64KKp6tcdTAwMGLqvcbPXHUwMDEwXHUwMDEw01q+Pma+I46VXHUwMDBmdlx1MDAwNlx1MDAxMe1oVdk+dVx1MDAwMPfzl3KJf3svfO//eChVXHUwMDAx1rwwyE57i37e4dBp7ycqpLiKp1x1MDAwZjy+S8k+YvThvIyhga2vQYwt7022xcBcImha0ptcdTAwMTRYZEu+KHlmvzu8mjjDlvkm5jA+KE71XHUwMDAx/rN+kWKn3kaset/aLWyRPz3zfJpFIdBR5Tw/OaW60Fx1MDAwZlx0nMfmQFC2RfammsDyN79ggodd/PP7XHUwMDAww6FCX3k1m3hcYlx1MDAxNVwiKcnXXHUwMDExxMij5dPI5MxIllPTeUU49FXDM0mR0TfFdsBfXHUwMDEz7m1XNShLTdlr4vvDni9Uq7RbXHUwMDEwKmWdpLZlwcRcdTAwMTJd4+O1Yo5O18/zt5FHw55cdTAwMTWMP61cZn7HWZ76sd+seFx1MDAxODs4XHUwMDEz/1x1MDAxN6O1XHUwMDA05nO1tNTeZ2pMXHUwMDExUFx1MDAwMM9cdTAwMTnEfqVUPVx1MDAxMUa08MFkrG/YY2C68XtsyUhS93Z16Fx1MDAxNLRXXHUwMDAz979YL2rB+HmKQr7L1qnktnt5imdjXHUwMDA3nrIy3ZeyQPZcdTAwMDHCp7XViaFcdTAwMTZnr19pMkV6KN/ip4SsZ6LoXHUwMDFiYXt6Slx1MDAwNlx1MDAxNi67mHS+XHUwMDFkymHs41x1MDAxODw5NobfJiooXG5cdTAwMGY2RXeaXHUwMDFhX1x0Yn7+zk9o2lx1MDAxZDNcdTAwMTP3r+coun3Dw4/rmJ5fx71cdTAwMWbUXHUwMDE4XHUwMDE5tEgwfobLSDM++TGK11x1MDAwMXxcdTAwMDJcdTAwMTachMSrXHUwMDA0+IimlnAhfC7X5tfMXHUwMDE386AleLrMON1GQKRGd1x1MDAxNt+5oUtcdTAwMGZjOKm38S59uorXyuSCOHtcdTAwMTi9yOXP+aGRuDiZ64DEnfVEuVx1MDAwM1t+S4tOPZZmXCKANKaJWWqChZOAodg5K0payj9RfPdxPMF/ZEpR/4sp+j7cJFOd1mKoylx1MDAwYlx1MDAxMmLCXHUwMDA01Fx1MDAxOexBstA7WG5cdTAwMTPfhrtBasEtRL4+PVx1MDAwYs1/feSsjnJcdTAwMDPwnsP0mZvqy2r0+qnwRVx1MDAxZVRcdTAwMDNcXDiTcNEu+lndqzXFxigk5NWZZERcdTAwMTbkzz74x3p+r/tCjFx0XHJDl0irb1x1MDAwN9IpbK7ew8rb8kZn8Fx1MDAwNjwzlG/GkiS1hWLjd0Pa1f2vNq/euiHV/lx1MDAwZt3QTfC8Q4mZXHUwMDA3JVx1MDAwZe92hlEoKUdyl1x1MDAwMKu+llx1MDAxMD6EplL86/lH+KT+mb13bL6nzYD+cytDymJcdTAwMDC52848Zv34pVFcdTAwMTUgJ+WLXHUwMDA3VH7VKzWrb3etjLdjSytcdTAwMGbed1x1MDAxOFxyMO0pXHRcck3TZe80oz7WXHUwMDA3N0RZht1ImShcdTAwMWRcdTAwMGWn4aCmT5Bt9cstXCIvroJXbf2rxVx09M2z6W+7O9vBnEJcdTAwMTnIXG7qXHUwMDFinqSHRTxgK/pFb1ePjsCTs0M0rFx1MDAxZqDJK8ylmFx1MDAxZnMlXHUwMDA2Qj7+evPtwufuflx1MDAwN2Zuo1x1MDAxY1x1MDAwM0J2n85MXHUwMDFlZdaFXHUwMDEwXG5cdTAwMDVG7ylcdTAwMDDtgHwohlx1MDAwNFcvOvNHPaiB6SfO+GlcdTAwMDeR3Mcy2lxyXG6b/HeSVlfTXG4tnoqWNVAnIdpcdTAwMTZOj6f8XHUwMDBiKvH7ab9cdTAwMGIyXHUwMDEwebPZXHUwMDE1ulr51Er7X/8r51xut5fh6P49xv9e3/17wkIpIPB2d4zPZLKJ0F4hi5jSikbYXHUwMDExupLqXCIwPVfifrq8f/0nrEpxOtNcdTAwMWX5W4sgonhcdTAwMDPTXHUwMDFk3dnOPZqH+3GR9Y2eMM7a4tC41uiUXHUwMDE0b1x1MDAwYmR0dVx1MDAxN7tKXcCXXHUwMDFhXHUwMDFlitaxXGIog041XHUwMDFlWuSO4lx1MDAxMjbjqUVC4XZ8Rp5cdTAwMTV8ppXrzWeLXGZcYkHg7HM531x0ZoX9qINcdTAwMTUtiG/1odmmZbvIX5+DqppcdTAwMWNcdTAwMTe4svYg+Xu9pcbjOGXg17hcdNNeTtXcU3KYb+l4XG74sI+UuzuxhSNcXCCHf31O97XtVUwoXHUwMDExXHUwMDAzmGZFZWWgXHUwMDBmXHUwMDEy3yr7XHUwMDA1V8RK1DZIXHUwMDAz+DqahV0p6otrLFx1MDAwNFx1MDAwZnmbRGbyfC1FTTHLTOTh0muBiH4691dcdTAwMTJEXHUwMDAyXHUwMDBma2yOXl7DXHUwMDE0XHUwMDE2OTDJXHUwMDAxodB4lc7nlM2S+YFTWppcdTAwMDdIQHRcdTAwMWHk63/+XHUwMDExgD7wXHUwMDAxLfGqzL+9Ub66sUyJ7IZIv1x1MDAxMm4sXHUwMDBm6foq0CwuXHUwMDEz62ZcdTAwMTlcbv1+3yYlnfWB6HiMXHUwMDE06t++sLLrn8TiVf9cblWVYPXvq9aHNZ1dXHUwMDFir+P1XHUwMDE3LYuFuUey/GxcbsNTwVxiSLVqOM1Jq1xuOdvNXHUwMDExbIYh0VeahtnEIJdW5TQhXHUwMDEz6VPtec50gcdQ50OEXeHOkfuZMVx1MDAxY4BcYopT+Vx1MDAwZn1ek2bDXHUwMDEwnVJEaW4oXHUwMDFka45cdTAwMDc8pKis13P/X89PueqaKlFjP0LfXHUwMDFizFfdwHRcdTAwMTj2XGbgXHUwMDBlg3yVyeuc6fm5ILbPkFU9xkuGNHRcbnzxg9hoNbRcdTAwMTlcbtlcdTAwMTdcdTAwMDXpXHUwMDE2zUc/c0gwXZrSL3anSIVnnzDz/O1cdTAwMTBEilxyq1x1MDAwNLrs/t8wXHUwMDE18IwgRnb++kEkVH3I94oyp1x1MDAxZDJVNPfHXHUwMDAxbMz/a9zGSnxfTZvdZy9n3GtcdHxeOpK21r54Rlx1MDAwMmVOjVx1MDAxODpNXHUwMDE34Obc2PhcdTAwMDO569J++cCqVlx1MDAxYyN528vGfn7Xn1x1MDAxMZ1F5lryx8nSyWJcdTAwMTlrUShrXHUwMDBlnOdcdTAwMTP+MdsnXHUwMDFi41xmRM+mYcn/MVZcdTAwMDB+/9+5zPVDQFx1MDAxZfBEXHUwMDFhMCOCREnG603CXHUwMDFiVJuaMORa9l//PUjQ5CtcdTAwMDDrJFVdXHUwMDAyVVx1MDAxOFx1MDAwNXKT0qLa3ciW7nHhTZrrldDZc6XMnU+b/ttdz09cblxmzDcpUe2irVx1MDAwNddK/UpBSC5U2PFDJEYz9KmI4ZXCs6PztvfGIWv+O5vpP3aeWytcdLXz7Fx1MDAwZms0IFxiXq+pn+fH3Vx1MDAwZnDBlKJBw0JcdTAwMDLCoNPZ/v5SpGGQXHUwMDAyf1x1MDAwM/Hneroq/XHWOlx1MDAwNcujXHUwMDFkRtdbietaRuBEQPrao403sZGMXkFaiNXFlWjP20qP7m7VM1mxXHUwMDFkXHUwMDE00o3S01x1MDAwZiyr+VJApIParkZcdTAwMWP1JbY/XCKjXHUwMDE5h/dzMpdmXHUwMDE4e6rWQd5+9UfZVvdcdTAwMDdcdTAwMTOwy3Pui/JcdTAwMTNxzqGOovFJPHfSk1x1MDAxZJHpXHUwMDE1Mlx1MDAxM777316bXG6BWFx1MDAxMLpcdTAwMThbXCKH6E+52zzNlZ5cdTAwMDbzaVx1MDAxNVpXK6fDNG3KmHdnNLZ46Un+XHUwMDAy7kf4/q2FPVx1MDAwM5OlO4/i11x1MDAwZbk/XHKxZCU+3mJcdTAwMDN3vWghIdkz2kXLWIaeLlx1MDAxZtRohUjzkommlOnAWEOK9j1+nExcbitTYYXF8Pyx5LFN+UKnQKNiXHUwMDE0i86O11x1MDAxObDYyXR3tiSS95su/Iv5yVx1MDAwNaBiZL/jryeR57RcdTAwMWTkMuBcXG+YjT9d8fjr4du2rWRePsrOjLo3esOgdCSlXHUwMDE0oDPFWv+nJvDgXHUwMDFlgTtDPsn/NK/TXHUwMDFm01x1MDAxMG5YYeomXHUwMDFiklP7Mu2EWs7o1amejzW57jVoodjJvN57Pna/XCJcdTAwMDa/+pZRPvAxes6MXHUwMDEzT1X5XHUwMDE0WYxQdyo/90+IKe6fPqaUf2eEg10279o1sLm3jmDsSFJa94M5VTdOXHUwMDE2lI1hp1x1MDAxMccreuvxKVx1MDAwZYhrV2al/dczeTpZXHUwMDAzbJ23XHUwMDBlgVfVndZkvy+DTN6+0i0qXGKU1nU2U4x+euXIJk2qXHUwMDFmhIJ2XHUwMDA2vyz4XHUwMDEy5NXieNnP70dtszBfyeTLZGQq3uJ1s6+YXHUwMDAwZFx1MDAxY1x1MDAxY1x1MDAxM2Y75av7xyNcXP+7a1x1MDAwZpLUXHUwMDE23b99gPne59dPySizb+6nI1x1MDAxYnZ5XHUwMDE3aVx1MDAwNUUkY4BcdTAwMTMoWHAqglx1MDAxMH/5XHUwMDExub6gyj/N8OtcdTAwMGJrI1x1MDAxZNFcXKroLpmQsk09XHUwMDAyQ33ZclEpXFxcdTAwMGKINMTRrsUzXHUwMDExxMhXYy7kiaj9y/5cdTAwMTB4MVx1MDAxN0riyMNT50j6KFfqdIBUs6CGJmFizFx1MDAxN6FcdTAwMTBIXHUwMDAyUILyXGaQPXrePbb/Z7+8+c838mNMlk9+p5EjxfirrzFLOT8wLCeo2bQuo1S/4+FMyb99k6K5dc5O+FZcdTAwMGatdeXPTVx1MDAwNNmeYr3DL0mnyKMuY4I6XHUwMDE1uSnjl1x1MDAwNdbIpvvPrPVPxkjWbG1cZu+4PkuguL+fjqJcdTAwMTOmSdw37Vx1MDAwMoRcdTAwMWLI6KBcdLer6E9cdTAwMDY/z2rGXHUwMDBlSL4g5lx1MDAxN/9Pn1r2b38gXHUwMDA2XHUwMDAx9fjzkTXwkVx1MDAxOTP1ci5vl/3Il1x1MDAwMHBmkNOBXFwu6/HVXHUwMDA3xl3btG3Vx7+9mjMstJhcdTAwMDFjhrS0drZW0punmSVVRJIu4ExOXGZRXHUwMDE2w3x5Rj8y8ONJXFxcdTAwMWEt0GXU/tK8j789KiedxHWVXHUwMDExXHUwMDE02WI1W1Nn7l7ZYFx1MDAxZlxmVosy9GFcdTAwMDc0oquxKy2EXGZcdTAwMWXB8UyfSevweZmRXHUwMDBm96+W/r615lx1MDAxYjuSkvvbx3TvfcyCLpDtWVx1MDAwMCv1UFl7elx1MDAwNeMoilx1MDAxM/rw2XhcdTAwMDF6n3OeL9VcdNvsf3E+24WpXHUwMDAw8k1cdIdQfyNb1ZZG91x1MDAxNFRt6/qvbSjvZ9BccqUrs1x1MDAwN0AkQKtijryKdTJccm5cdTAwMTSDoc22zaF9NFD0hp5g9IBlZFpcdTAwMGU/q8stzImZeOx/Z03Ne3/s+IhdV/zdd6FcdTAwMDIg36N14lxid03QniGmTCkmkoJcYnaigSpcdTAwMTBXbG1lOPqyd2+PiXxmgVxu9+Hxd1x1MDAxZSR8Y9N3g5Z9bVuWsPDEsKmvx2QsTcz7S0efXHSqvNUu9UIjs9DiYdS4XHUwMDE5XHUwMDAw50h7XHUwMDEzXHUwMDBiXHUwMDFkQ2R0XGaTIFx1MDAwMV+lXHUwMDEw+3DZ3GR8XHUwMDBmQFx1MDAxZluBd5fSrauwu492Odo3+Xe2Q/ZvneWfUV34KjDfuFx1MDAxMz7RXHUwMDEzmiyEkdZcdTAwMTVcciM0P0t4tz5jqtf8317H7Wm3+lx1MDAxMdjVnNby5p+dXHUwMDE1q6yRLG67flx1MDAwMni7z1NMyzqQQX1Kg9eTn1PhsJPKx1x1MDAxN5pcdTAwMTAuNoRNnNSmwSM4y8LntonyiyRS/Mqprzb/q1x1MDAwNeh8/K/O57eUkNx1PueOXHSYOVCFIJBsdoiyh9eeZlx1MDAxOYRccqJ5lbePMDyr0XSkXVx1MDAxM59cdTAwMDB3eKlcdTAwMGZcdTAwMTKOqYxHgPaPJKvjyGJ9Xlx1MDAxM0eHhFx1MDAwMtnPXHUwMDE2b2lsr5dOcO1i2S/aYpLRXGJbylx1MDAwNT5cdTAwMDNcdTAwMWPT0CRcdTAwMTlKmLlcYvhXl+uqQmT8+VtcdTAwMDDu3lx1MDAwN63u/Vx1MDAxMSewpNch3WdcdTAwMWaAp1x1MDAxMOkwiul0uJ5cdTAwMDWh2nZOXHUwMDFm0DK/jCX/XHUwMDFlQ6rlv/KFhaNcdTAwMGYxwCdGm7rz0p9cdTAwMWbU7EW47/c6xc+henmU0WjDx1x1MDAwMUqAxLvnj7X895J8XHUwMDFlqE9cdTAwMGZqgj9cdTAwMDfBwvnJ4dLn6aKwb1x1MDAxMOl6Rlx1MDAwNFx1MDAxNa1cblx1MDAwNZPTc7W6J1040+u/M5H/v31L+7XN+WhN9G+wgdtcbqS8XHUwMDExYYxmx0MlnznT/eyH/d+1XHUwMDEwXHUwMDA0oFx1MDAwNi7AXHUwMDE5aqJSa9363d+B1E/Jat9Atlx1MDAxM7HBXHUwMDEzXHI5f9NcdTAwMDFwbNCqetq77uWIXHUwMDFjg17KXHUwMDAxbFx1MDAwM71WxHzRPVjbTV900UZO+kVeb+CNJlx1MDAxONsqp1wiXHUwMDE26o2bXHUwMDE17DGPzz+d9Lhrd4bFb1xif7dOKXfPvTBcdTAwMTdcdTAwMTfxTGxWnlx1MDAwMlx1MDAwZp1cdTAwMGU7h5qajeJcdTAwMTSPOvXXiGmhaVx1MDAxYj35WN6KkvnvnLEkcyOxsiqtjVx1MDAwMkBuqVx1MDAxNILsXHUwMDE3XHLiXHUwMDA3XHUwMDFmtb2bZfLibCxqj1x1MDAxNPDcS2n/OLm50Ha5NmTswJhtr6VcdI6mXHUwMDBl8psv8IshPmLKUlx1MDAwMFx0wPrHXGbx1PJcIvm/r/Vv5Ef+VGxcdTAwMThcZu+Ava2DXHTOR+IlV1x1MDAxNVxc2yxsRKddkLn/6sO/r1x1MDAxMFRcdTAwMWVGVLRcdTAwMWJcdTAwMDZ1a7GpQUxcYvSAXHUwMDE4/JpHbnjoICxjoJGYfJ9dXHUwMDFm/Vx0XHUwMDFheX7TYaWAeUpWjJBZXHUwMDAy8yB8WDg/SjkzPpvB4Vx1MDAxOPN8oFx1MDAxYoyyJMZuXG6QgnP+ey/ryiXWp2ZcdTAwMTOswFx0+8Zf9fY279vbXHUwMDAwLe3qfzrw7sdcdTAwMWTYbjthxWk22k6fdHyVXHUwMDE5XHUwMDA00882nL6T8HuEQLtcdTAwMDZcdTAwMTSh8j3yr4eX4Vx0ZFx0n1GO66vwVO47XkxcdTAwMWP1Q1jjp82sddLJ5DDsV2tcdTAwMWR/yFxyvU1fuSFIgKO3ka3aoXp02Vx1MDAxOVxy677H62M3r1lwkVxip+FcIlx1MDAxN3T1XCL8/Fx1MDAxMlhmd8bNRK/7hl73uFx1MDAxZv/GTeiwq/2Nm1x1MDAwMOOe4G4jWEWh8TA3IStmeeiiXHUwMDBm7kE5XHUwMDA2yUFE94ZW+mf+r7eB3E/ifelcdTAwMDWjwIg1p1x1MDAxMrw3XHUwMDE5XHUwMDE1Tpz2sWt5zVx1MDAxYS0m6UJVSCiTXHUwMDFkfmqBaL5cdTAwMDIlTlpqTV9yxpLfe1hlk8GDtcHZNlx1MDAwZpRopreOZzc+SJdnyNpE/z9cdTAwMThcdTAwMTfcXHUwMDE4l2HvVnb/MM7+d6Zhb1SmbmbF7Fi1y/OpzWD1Mlx1MDAxNlx1MDAxOUU+cCv2vjtcdTAwMWOkbNSD+fyLO0Hn7/X1NaDszmHxn/CiKFx1MDAxMVxydMeH1FxuKy1nT2prPHV27qg69npqj89cdTAwMWVFpjm0KSp3XHUwMDFm0Vxisyh1rcqNXHUwMDAy2TBJ51x1MDAxYtNOXHUwMDA2p/pr3XCiYUOa7P78yJPy7zN4Y9Y1zKMsXHUwMDFlfCA0rkBcdTAwMTl8aSb6qvBZ+vxcdNWuXG61XHUwMDFj4/jR21xietkrsn2XjFx1MDAwNmJtNJPh/Fx1MDAxN+MgxIn/h6/3anaUXHSWRX9cdTAwMTBcdTAwMGZ494g3Qlx1MDAxOGHFXHUwMDFiXHUwMDFl4YVcdTAwMTX8+lx1MDAwM9Kab597dsSNXHUwMDE4xVxurZmRgO7OyqzOqlx1MDAxNvhcdTAwMTGQZX2qyVx1MDAwN9B41vIhl5KgbdEpkNKnXHUwMDBiPLBBdMxwXHUwMDFjPXGHnFx1MDAwN1x1MDAwM356XHUwMDBiolx1MDAwM5OV51x1MDAxMyZtRYRCx3T7TPLa4Vx1MDAxZkpcdTAwMWZRNL2BQstcdTAwMDBk5Fx1MDAwMPTT+cUqlom3/upcdTAwMWLUrrzyvvZ6w6vGX1wiMjNcdTAwMWYztZf7KitcdTAwMDZcdTAwMWTcVbrrXHUwMDEw/THmVLFcctp9xsae6f6Ld1x1MDAxM6QuqpKMpSPvwjBEzUzYT/xcdTAwMDbo736tXHUwMDFktliqXHUwMDFiueBR24aoLiV6XHUwMDAzrNhhwpWHKlXN09a9wYchRz1cdTAwMWEj3fmgYYv+ONuSt16l/+p7Z6i+4olcdTAwMTPrYnDFXHUwMDEz/lx1MDAxN0+eOFx1MDAxNobRwNBKXGbtXHUwMDA2RVx1MDAwNy6YkVava3K7hN1TuE5e3b659y/3OJgm3LVdX1jQluBUa/lQ63RcdTAwMGKfpS22mueDiOt8Z/Wn2lBU7KUnXHUwMDBmVWrzJu4nvo6dXHUwMDE2wdNT9FwibKjnnswjXHUwMDE2ofFcdTAwMTYgKEDLP/dcdTAwMGaejFl+qvFKd7gx+Mtru8G1vtbyeDDUw7rx+a/fXHUwMDBmKkk+xTNxXi3RQXckXHUwMDEwVCNZc33AokRByUl1cJFcdTAwMTjqf+vNsd7Yyt+NzoN1wvTGW1x1MDAwM+xvy3HobODmw1x1MDAxN8a6TafjYDQ0UTpf6FJJw7pIaFNcdTAwMWS1TEOMok3HP0062DqpvOvLXHUwMDE3XG4qLOlcdTAwMTF0aNeE6af/eHFwaTxzboay7i7eVV19VMz8LjpwKjBisPCme4dcdChQUpCyplvRJGN7XHUwMDEzklx1MDAwZqZZyef+/YzP5rU2epsyyI7avrwllfV+hkL0XHUwMDEwU9xLhyFcdTAwMDRbXHUwMDAz6ZTCXHUwMDBmtXFgldepn3j1VI3HOYfhIT7vLDCjxsTaXHUwMDBmlVx1MDAwZf7Jfu5vXGbOSriz/uqU1N+4R/EzvJ1zL1VcdTAwMTKGXHRcdTAwMWXowVx1MDAxYXQgcixxR9+WlXk0XHUwMDA35CacskDMYirpkFx1MDAxNHasXHUwMDFim0Ervd1/2MKMrHHiXHUwMDE3bzrQVLyjbO5pTXt5JFx1MDAwMOFcXPupXHUwMDFkvod1jnivqJtcdTAwMWN3YVx1MDAxZr1011TSWO9jXHUwMDE0xZsxPODxXHUwMDE1mDPZ08CdXGJcdTAwMWZAx1wiXHUwMDAw0OBCXHUwMDE4gIJm2T/8+taIduGtXHR+78OLXHUwMDBih4uPjVNcIlx1MDAwNno1rVU6p0a0mm/ZWoWVrVTvk0Obgmb6cYDMd8/nKMY72cTZKmJR5tm7le/MNo/7h+94bG6yYYs15+kkXHQ93muO6eiX6PTq7r4nXHUwMDEwnIjXcHnYXHUwMDFjv1x1MDAxZFx1MDAwZTWCcSzPjXVcdTAwMTaqdCOFZ25aftLV6fOHk0w/XZ5cdTAwMWPs3pbR5em8JZdcdTAwMTeMNlbhbmArQ/Jz86bAJMdcdTAwMTWOQiVvQNBTw91cdTAwMDRI7CjjV/90jo/0rWe421dd01x1MDAxMVx1MDAwZlx1MDAxZvWaXHUwMDAzXHUwMDBmUcxzjaJ4br6O9N3PXHUwMDE4XGY/XHUwMDEx8lx1MDAxOVx1MDAxYq9um/szXHUwMDFhJKhcdTAwMDVx8TqcQ+6gfDzsxC2+ynpcdTAwMDJy/Pkxzrkp1vyX++h/3OdlQlx1MDAwM8JwZIOsXHUwMDAwXHUwMDA09Fx1MDAxNU1cdTAwMWaLXHUwMDEy3jraRGTL3NlcdTAwMTk1biVu+Fx1MDAxYa/21fTFOnhrMUE+tVx1MDAwYryfIez+Rkl7yO9cdTAwMTiuQu1cdTAwMDLEVJi+eDNcdTAwMThcdTAwMDRf01PgbZ98htvLpO2VbvSBhLjx3qN88taHXHUwMDA0e+xcZlx1MDAxN1xykE9cdTAwMTBJ6ydL7NuMXHUwMDE2K1x1MDAxY2+0WV9vi/9RIYn5ravw8s6oTzWyvvvq/XStK3Vmo1xiXHUwMDBi2HNcdTAwMWPC60hcdTAwMWM02Fx0aYFcdTAwMDDgId5a+tScQWJhaPuxbJq7c8+/Z0CoPtNgMP5cdTAwMWG1x3Dy4U/1cKLyxN1HiumdLVgnaC734/FcdTAwMDBcdTAwMWP+WX79XHUwMDFhXU7ri1ZcZkCWkluWy1xccnL11Fx1MDAxZlx1MDAxNuj19cDa81x1MDAxNVNhXGJLZTdhilx1MDAxMPMuXy9cdTAwMTI1zdOAgqt1P6GmNLiA0LileT9Kap498NDt/qevyHlPTsJ5XHUwMDE52+c1XHUwMDE0+o+Xi9tcdTAwMWSub1Hin3pcdTAwMTjqXHUwMDEyJEWLblx1MDAwZXWVI+49nlqvmT8/Y1x1MDAxZI9yXGbGOlx1MDAwNEBcdTAwMWKGXHUwMDAw+s6TzpDnbobg86l74Vx1MDAwYrMh6bv3QOtv486eOLU0wCnZR1x1MDAxMseZh3YrXHUwMDE5WohRXHUwMDE5o8FxJfGBm+B5wVx1MDAwN6p+XHUwMDBiXHUwMDEwM1x1MDAxMeez/a51Qlx1MDAxMtgz0FfIXHUwMDEw1D7XzGh03JIto5DGRvZn4qh9zMzh8+Qs2NTnN8o/rOdcdTAwMDFuXHUwMDE2Mr2l3n3z6yV1JzDL06ZcdTAwMDRWXHUwMDAxzVx1MDAxYlx1MDAwN+ZtXHUwMDA3jW3L+HLoc5zf3z5ccrX5v+bn9stjgqiT3EHfJMkm8umcnvLN1iOJPGV2r1x1MDAxNN86nJPvLlx1MDAxNaR3NE1FMPRcdTAwMGXhukBj/7zuKUj5XHUwMDEwRYo+lsrRXGbum8bfXHRz0LaFpvHuNa9cdTAwMWRcdTAwMDWBS/RcdTAwMDBALvhP29tcdTAwMTbLtNWpXb+e5b9cdTAwMWFcdTAwMWZIXHUwMDAxL2OjX3T0fTFcdTAwMTAoXHUwMDA3s1n1pGZcdTAwMDWxd5GUhJA88PSu6PB3L4p7gVx1MDAwNUBrz7f2WFx1MDAwNsc+lH1U71x1MDAxOd0nVVxuRUU1x4N9kE4zh6/qXHUwMDFk8G1ztPipYNL6UJiB9zGUXHUwMDA3j1xyN7n2fmBcdTAwMGWPI7aEeflcIp9T5sr7ytaVq1x1MDAxM7tNIb45XHUwMDE13VLObzzUa19+YuiC513zs9PWeurXIYPT1NTCfN9cdTAwMWTDZ8tHl2VOSlx1MDAwN/t/e2ZcdTAwMDFz9S2s0+SqXHUwMDE5eVx1MDAwMY9belx1MDAwNmRQQrlcdTAwMWRC2oSvJYc/werBXHUwMDEwN59b2rjCVWc/Netcblx1MDAxNFx1MDAxMs2Zflx0ZneXTM1cdTAwMDRGMVqL56qPntCfl+OyOFxcOfWI/cb02nXOn1x1MDAwYtJcdTAwMWZWt2POS1x1MDAwZV9rzmNqMNJcdTAwMGJcdFx1MDAxNLJtrDD26W6bwCqBXHUwMDFkOHaQPq51r/T9V7NcdTAwMWORpb9371FnL6rcm0U45CeMXHUwMDFh0uNcdTAwMTHwpFdyXHUwMDFhZOmR2Fx1MDAwNYc6K9JM8/b+QGJccnmDXHUwMDEx8qKJoURcdTAwMDHCeVx1MDAwZtRkzG/zcVx1MDAwN0RUUqFX8v+b1ypMXHS1bD7iXHUwMDAy1Hrbbno+m1x1MDAxMGlRqEt7QJ76+K6qjYpacSHV331cdTAwMWHrzs9MXHUwMDFl1WMgqtWq3md2jTwp243EfPmzbbCzOHTUQpQ6ioUtP8xy15dEJqHHQWOo3MtcdTAwMWEqJa8/v7zKpuf4XHUwMDEyy8f7Wsuvfl1nTKPvdzJcdTAwMTmyRExHnDWXd+SC176bWFY+sFNFmtwrvttphdYogfnrTUGoXHUwMDA2k7niy55rWiHgUFx1MDAxNVx1MDAxMPPnibljc6mz+N6JLrXY7lx1MDAwMVddQ5/MoFx1MDAxM1x1MDAxYZ0+xiHLQ2pcdTAwMDE5XHUwMDAwwShHS/NcXFgpzVZRhtI6/lxytW39x92vXld90jXExd254KqJTYFOgDLoxU2bdESSsayPp5lcdTAwMWLFRD7gXHUwMDAysMxyUJqSI1+VLnTf+GdMXHUwMDAydnKZp83Oueh8e1L0OrpcdTAwMTB87d3G/vVi8MaCXHUwMDAwflxcXHUwMDFjaZdcdTAwMDPEQJK0J1x1MDAwM5DeKrhcdTAwMWLnxU3V8vs50lVzzortRyaKXHUwMDBip8/fTdvTirSZ8dicIIQ5f1x1MDAxZlx1MDAxNEUwa7S0UlxiMlx1MDAxMlpgk7Us6PeUoq9cdTAwMDdcdTAwMTLiKfwxmrZkxIMqetC03z1ZWU1cdTAwMDR676GELGSH+PE84Fx1MDAxNFxiZplcdTAwMDdDoe07w+zRKFSDZ0hz+rm7d72Ou3/1JjdcdTAwMTa/cFx1MDAwND/181/fhPtcdTAwMTU7QvgzzFx1MDAxMSWiWnRcdTAwMTDSyn/gg1x1MDAwMIGTQpLEND6mbKTVXHUwMDEzhXxv+Oj7v5pBiH2y3pZHTfZ4XHUwMDAyJFx1MDAwMy02coaxjLSJ5Fx1MDAxY+PKSZdcdTAwMDBcdTAwMWNOPphwLsp0Jy1MSvJjruWQJEJcbtNo4H/YNctcdTAwMTCN6SPL+tZWZVdugcSTXHUwMDFm8eaLa1/p5M51SpRcYlu/7b1cdTAwMWE7SEODXCKAgYp6oqTbXHUwMDEzVbpHQW1//USioJRaUlhcdTAwMDfUh/KQQHE/nepcdTAwMDB5qFX9psPjXHUwMDBlkVJcdTAwMTfDLVx1MDAxOJIoWiYmXG44TbpvKIRcdTAwMTFoKHhcYphrxXNd/57Vf7VcdTAwMGJ8QFQnvq02zDA6XHUwMDFhU9Tai1xyVHBvyVxczCNcdTAwMDTeXHUwMDA2uNZhXGZ/tj4niulJ7/l/tSY6I1x1MDAxNdHblsVcdLE5Y1x1MDAxY1wiJoGf/kJjJ41S0dtcdTAwMWPD70wmuXHJI4qA5p0oa3aIXHUwMDE1kILobn+vq1x1MDAxMdLLXG6egFFSw/KQJPjJOvbvs7+Hyd7h1zd+K3178b6ZbUvzvHtB91x1MDAwZtOQbuo5hlxyjMyU464u+3JD58NcdTAwMTEskcRKJPz6S7y/XFxPt4n54vud8kGsOdF6PyHbV3Z3KlxixTJJ1l+HJu1FXHUwMDE4QVx1MDAxMVx1MDAwNZA4XHUwMDFkmlx1MDAxY8+RVITi7zMmLISvXHUwMDE1+HdOaN99XHUwMDA02iDd+9VHdGmuOpZhXHUwMDFjMMJI8ZQ5XHUwMDA3KKfepyhwU3OFbJLMV1x1MDAxNFx1MDAxOTG4XHUwMDE20z0mcYdrQ1x1MDAwNIb4QfvmaHhGKd7YkTJLypFXz7an9ulMMyPWodF1uFx1MDAwZlxm0eVjV39GvI19wPUlXHUwMDE5mEJqXHUwMDA3fV/Jblx1MDAwNvdcdTAwMTc+PauxgKfqik+g/e1cdTAwMDeaU9TWXzVcdTAwMDbtpZW0eZiXcmy2+bwyZzng15LC8Kd+Rr5cdTAwMWNpw+2Rclx1MDAwMG7TpHlcdTAwMGKH/Mc/IevRXHUwMDE2gKZcdTAwMTNEXHUwMDAwR1f+xCCbsCZC/Omke9dJkPO68y+naunbdtzuZsdcdTAwMDZZkj3lWZYr41xcXHUwMDBiVMFcdTAwMWXaXy6nvvaKXHUwMDA0lEtcdTAwMWX1X433yTNcdTAwMTXyXHUwMDAxVVxmZ1u3IzhyJDXHXHUwMDE0R0qMeEhR11qdLk3iby3zOrPKXHUwMDA3KO7wgLUzNJW3yO9f/FtcdTAwMWNjOrg8Iz67qlx1MDAxNPopjqijYVxulFxiMlE1rJrt5G3qXHUwMDEz9Dn+fENfXHUwMDBmlfYlXHUwMDFl/+OhXHUwMDEy8tFhN23h41Jj31x1MDAxYpCuqaxrVZ2H72xWhpvVXHUwMDE4Rr9RPiPo31x1MDAxOC7WJGNfecj7fp9lwtO155BXrzIjW9VcdTAwMDKGW1xialP5xslxcPUx38pcdTAwMDPYn+vdzMBcdTAwMTmUiZuQoy94wIE121xuJDH+cij0XHJgkFx1MDAxY7DpXHUwMDE0hE/gSIdzSmB0VoKz95twXHUwMDAy87j0+Ov4XHUwMDE2iZhsupPpSfNcXFx1MDAxNsSReIFDs+50XHUwMDA3XHUwMDFkrOJcdTAwMTawJcvRgMQ978X32eObPXlcXFx1MDAxYjztR1C35ilcdTAwMTZcdTAwMTXLlolRddp3XG5hY6P6XW9cdTAwMDc7XFx9tnx9VVx0XHLMuj+1V1x1MDAwZp7Fa5vwz8+3XHUwMDE05/PiNuP/xXzopFx1MDAxZuSAkMjH9Vx0085Xt+H3nbTod1M2VsjtcVx1MDAwZuLQP1xc5mhmwIJcdTAwMGJLZ1iL7o9WhnRcdTAwMWaNJKWbXHUwMDE5VKPW3aasJ9LCYEbp5Fb1XHUwMDEzKJPJXHUwMDE5x1x1MDAxNuY/vvh0vctj60vgUl5+5pulnePZSaggXb3VXHUwMDEwtuFycO9AXHUwMDAyb24kUce+Qe7cVpZcdTAwMDZWXHUwMDE4NfRdI7mNXHUwMDE2J99cdTAwMGaJuKg/RFVLSXf3pvbZJLX7XHUwMDEw11DRXHUwMDFkxp3pe5WjXHS4XHUwMDFl5zzLaFx1MDAxOFx1MDAwNJKrh+ZcdTAwMWH3T/NXXydcXDFGmTYu/2Kp/f7uv1iUXCJcblx1MDAxYSM+mYUgoEqj3WODJm+cYVx1MDAwNy7outIn+tP/l+eJWe9zcpeXpr/NcWDgUT350sNJlMu3b956gyZYdncy3kZcdTAwMDJcdTAwMWY0xlx1MDAxNyWlQVx1MDAxN/FcdTAwMWWN0bdXQ5rGXHUwMDFmr1x1MDAxN8SC+u5fxWZ3fD+b28/fQ7dzyLaiXHUwMDE0XHUwMDAy2Fx1MDAwMzCrXHUwMDAxhzlJs8ht1YJwdU6v2GJ0rOP9zyNcdTAwMWIzL1x1MDAxY0KrZ1vFr1x1MDAxM8/N0O5U125cdNeu46w00bSz8zc+mmZcdTAwMDVcdTAwMGL9korxXHUwMDFiM1x1MDAxZn/7KO9vnztHl9cr7yUn4lVnklwiWOh7ye3Br3Kw3lxik+ZGXHUwMDEzlZpPlVx1MDAwMFx1MDAwZuqUi9VcdTAwMTl8UFx1MDAwNSFcdTAwMWPri1xyvHXLNFxiXitI60+tvVx1MDAxNHGhVpQxk1xuh0yt1Fx1MDAxN76cI1x1MDAwN3kymqpcdTAwMDJRRFx1MDAwNk81PMPi3n+mtnWw1298vVx1MDAxM1x1MDAwM+FcdTAwMDCi4OLCwNtcdTAwMGZcdTAwMDNf7VLW+dZcdFx1MDAwNiGYiFx1MDAwYqxcdTAwMDBoeZe/f/Kd232KROjztyd0nVwibjPLnsm3RPpEKlx1MDAwMkdcdTAwMTJcdTAwMWXUlIb2K2H2Rsg9Ymjk783qXHUwMDA3rJzld4mcc5nVI+xeXHUwMDEy9pZcdTAwMTTP/3LQn8vXwpGSqTPat8/k7Yz7jj0yT5HjxpLrbmJcdTAwMDZMYZNNwSBcIms8NMnDKk+IXVxu91x1MDAxYmvEiYvX7EC2YE5rg1xmUlx0XHUwMDAwgO3gJYtC0YK/XHUwMDAzXHUwMDExK5Pb1SNcdTAwMTLvsEKWY9hP7P9qQK/zv/rnXHUwMDA0yeuvz+lcdTAwMWKBfe7tMbCDhyxbXFzaibHWWFx1MDAwNOGXxFx1MDAxYutx51x1MDAwZVx1MDAxN1x1MDAwNupcdTAwMTjF/SxEXikrRlxcl37rsa5eW4lcdTAwMTCIaC9ffLuF41F485/eKVx1MDAwYpAwtVx1MDAwM2nB+7qignNcbqrZOdxff1x1MDAwMLl0i8IgXHUwMDFmVyPra3w/p3yCRIjKXHUwMDAym5a3x6ldoDTpq1x1MDAwN3eAwN2FV9OTpVx1MDAxNkSi+4dK6OR+eyrbN0ZcdTAwMTbFgtXlXHUwMDBlIGCRRJ1N3y0wXHUwMDA3g4Asdlx1MDAwMHCeXHUwMDE0MCmtLW1cdTAwMTMgpZv1b6/r4nx5Zfy8m3z/7cPoe3T0IFixsF9MOqWqjlx1MDAxMyWaP1x0N/JY+sP09J6cOIe+kupXo2lcdFx1MDAwNuvqXHUwMDA0c89mXHUwMDAwRD1yI5pcdTAwMTXa7qDyZNvt7zmnP69cdTAwMWV6sCr9OO9cdTAwMTn89URYXHUwMDAxP4JcdTAwMDLb36bNkVGSbLnPmFNcdTAwMDNcdTAwMTiFXjbm+Vx1MDAxM5XKl1x1MDAxZFx1MDAwYich9k755SffPiNxaW/een6fo1x1MDAxM5BcdEaEm1x1MDAwNTl6hCmgPlxcXHUwMDEzwCVcInPMl/H1lSuXr/xcdTAwMDFcdTAwMWVcdTAwMDf39ZX/7bO2XGIhTTnnPlZSXHUwMDA1aaj1iN2ZXHUwMDE2eHawN/K4+65oQSuzRzHFXHUwMDBmN6lxm6ItXHKieiSi9fXau+5j4iNcdTAwMGL/4JzBf6p8JT2X0jRcdTAwMTS4Z9ZS3ayHyGnUW0jE+1x1MDAwZo9cdTAwMWaXfn/5XHUwMDFj8//od1dk1veDYT9cdTAwMDTVwThcdTAwMDGzfoSsw0tcbt3GJcZneVx1MDAxMyCDO+ZcZuOgkE2vPmL3XHUwMDFmJvLdSbiVOPqsJ0e8jfKK7St3o8mP9lx1MDAwNvDMgtD+mPWD/atcdTAwMTVCrziuderyze/w/XT+TJWMvVx1MDAwNjln1Fx1MDAwN2DuU3PAKfuhgSaKpe6lV8VSXHUwMDBlrmaacmeVs1x1MDAxYVCM3+VgXHUwMDE0NFx1MDAwYtSzXHUwMDA2IVx1MDAxZvfgjvzhs8M0T4Tj/Vxy5lx1MDAxM8f/XHUwMDAwXHUwMDFielSdnI/DJ87F89+mL9jxONh1xuCu/lvz5EO4vGymQvzz5d2v97lqQyV00lx1MDAxMJknwXP2OpubZuNcdTAwMDLH3d6GklvzbjzBJDCnnFx1MDAwMeNQRZL2PmVcdTAwMWHmL2r1P349+Vx1MDAxMW1Pr1x1MDAwMd7+Y4pSLaNcdTAwMTPISVNXxSlcdTAwMGatWMuCLzF9TkvbfbCeSMr/XHUwMDEzXHUwMDFmyuRcdTAwMWJcdTAwMWbyoCOvz7qz1OVv8Fxul7u8MLhcdTAwMTPcsqUjefrJXHUwMDFl5CcpUmi0XHUwMDA3W9fgheyj41xyUiBwkEim8vByXHUwMDEwXHUwMDA1xf55cE9elYon/Tb8XHUwMDA3zWfUm6RcdTAwMTNwsW2KrE05XHUwMDAyXHUwMDAzukdFla+13llX59/enrJcdFxcpP8w0uWv/MrrdVhcdTAwMTVNOHdWQGnYSNlRQ1x1MDAxMS9twI/qwrNvk9ViO6GZboNRviWIf773WFx1MDAwZVx1MDAwNFwikMldXHUwMDBmraVcdTAwMDB86H5cdTAwMTd/Po6Jic6gzPvQwafxPH/mXHUwMDE1RVx1MDAxN1x1MDAwNFxmqtd1eNk9fTlWjn5zXHUwMDFkLKf8Ynb/x3m/PlBEXHUwMDAx7a7aXHUwMDFlSDlcdTAwMDFykG8t4N6D6J67k3nYqMng7lakJn6cgX9WMmDrljDuyjSk1fts/eVcdTAwMDB858Xc91evN8pcdTAwMTZcIu1nWTOnpszR0fpyderWKMNJJL++kaKYxHM9q6P3zS+xXHUwMDBm/dKHXHUwMDExr588Zlx1MDAxMLarMUdcdTAwMDWU/IrkKTJcdTAwMTeEncBcdTAwMTONeqlcdTAwMWOKunvw+FHpXFxcdTAwMTiOe3dcdTAwMTf62InlWctcdTAwMWM8ukdU2CBcdTAwMTmG/PPfX96bTetcdTAwMDPZmEXVaYC0XHUwMDE2MdLvVnh60Vx1MDAwMu7UxI3BXHUwMDFk+9tHWIHZa76G8//KI1x1MDAxZJiV3FxcOJDVKc2KZkCajTCRXGLx5Vx1MDAwNvDJIFx1MDAxOTZcdTAwMWamQ3psRFxcU1x1MDAxZYZxXHUwMDA3ROg+ozX4xC1Tob/jJDJ3wfr2flVcbvXkyEzkZ1JIgUyOII1hnlFcdTAwMWJ11VulqDqv//zDgHDVRL5NNXxcdTAwMTeX1mx+dcTqI9X0gFx1MDAxNVx1MDAwZkxWg6dhOvZ0uFB6s9t5y/dAVCaI5P2EgJlccketXCJ+TN5cdTAwMTmiXHUwMDE4wrEt06IsNORoqo+e5fZcdTAwMWT7yfIm6V7klID2cVx1MDAxY6FBXHUwMDEwUfFa9Z9AkkOY4l8nXHUwMDAzzPrkl1x1MDAxMzC+PSdTszd/tef1N9eL4sOJjt6zePc+XHUwMDBlXHUwMDAwpEZHQL42XFyj5kD5lKdcdTAwMDIjJ1x1MDAxMEVrKFvYoiv5qExIfidcdTAwMWWnXHUwMDA2fur8qm/bpCzc8ZZ+moBj5qd0z3lcdTAwMDNzjKhcXCjK0FDQvKUjtVx1MDAxY+ItWZ1cIuDv9S8u//r+tVx1MDAxZp0ov1x1MDAxYVx1MDAxML80/HrD+I+Gs4x44lxyhq8oXFziYPpsfTJcdTAwMWbRdiCjJb/j74ehp1XZ8dEnNSwsMCvwc+LK5r5cdTAwMWGoJSj8L59v+Seuep88KuuY3zFcdTAwMDRMcj/dnFx1MDAwNFx1MDAwMCwyzaj7in34aLW5XHUwMDA2Vueo4PGTcv/wOSitK/6Lvu/dr/iPXvFfh+hcdTAwMWO0gdtmvyizydE1qeX8xb1JXHUwMDBmRrbJbaZpXHUwMDBmXi1MQ4hcYvHBisNoXHUwMDFmsG+bnuHcXHUwMDFmo0Tge6973H85fb1/P1x1MDAxNWO363sjIC+eXHUwMDA2Ua0q3kCWj16SLy4uXHUwMDE1o678PMbc3bp0+8T+ckT9r1x1MDAwZWt6nIqnOnlvrS2zN1x1MDAxY3h8XHUwMDA2+lBcdTAwMGb7p1x1MDAwMXNAgD8/Q97B3bLcTWlWq3HsWruE0oLCUSNcdTAwMWKgfpSv3l9cYqdWxq//asn6n2eWQYdFzU2+aumdMvJOlna5XHUwMDFienZ3ca6ij5T9xavHb1x1MDAwZjvR8/f9qm351Yqtx1x1MDAwZVx1MDAxNL5nM7dcdTAwMGWmcaBYYVxcSsFHePWYXHK6x0ZcdTAwMTXpPaM2rWRcdTAwMDN8uvXRjFpTUs68bKM14Kfzwlx1MDAwYvLwaLYn+vVBmoO93XvJm0zNjHWAXGbySaewc7DzlOLnay41fstbfzVcdTAwMTVXXHUwMDFmdPLtrr+aXG7+ynXw+ltcdTAwMTZ05mSjXHUwMDE156BcdTAwMWTMg+AoXHUwMDA10UyBi7s7LVx1MDAxOFnmh1x1MDAxN2JSRYP5XHUwMDAzcTpSxFJUTSXidZ9mqFCkUYFcdTAwMGbP3WHu6+di2WfESOOdKV3ptYeQXGI2QZ5cclx1MDAxOKbk51x1MDAwNPRcdTAwMTbWcHGx6pGMXHUwMDA1/vptfHvO4OO2365+XHUwMDFi0l/OqkKJoOHYt1x1MDAxMVx1MDAxZrdcdTAwMDOkpFxubYxH+k7W+55Fnlx1MDAwNddPssNccmNcdTAwMTREXGK+ao1LXHUwMDEyLtpXYKVnfHjzaCZp0Po/e0NPm5HRQlArkzc2m+5cdTAwMTKARMxypVx1MDAwZkJJRpn+3CB/6v8vXHUwMDFmwdXPXHUwMDE1jans53OSfrUoXHUwMDE49Fx1MDAxZXO73qSDk7PFXHUwMDFiSPrhdJ2BqNUzXHUwMDA0nifsa4ikOtnOzpxeLF5EjfZmXHUwMDE0r8ot90VV8nik4cJFvfx4RT/v2zlHZuGU3GhcdTAwMTEhtdeiWVx1MDAxZpNiIMuEL5NojWmN51x1MDAwMfFcdTAwMGKCPkiR/2n17rfm1Mj3rGvNwT/OTeeBXHJcdTAwMTiMQq5HTMVElvavXHUwMDFjRJ5cdLwkwe1GNzdA/NA6846NXHUwMDBmLsDkXHUwMDFl8Js6wPvJplx1MDAwZdqjxlx1MDAwZpVGrfaEaPOHXHQ24VGch2tMJJlcdTAwMTElJzKPJXBuiEdcdTAwMGVcdTAwMDA7ilx1MDAwMaJVv3VcdTAwMTI/hcS3/qyfhiuf3ppjXCJ9tXxhn7jbXHUwMDA2Nm9NNVx1MDAwZrFra51cZvpcdTAwMTTYt0PXKup2h+9lrlGIN1rJkX6GZ3CPXHUwMDFj2uQ13dH7XHUwMDFhflx1MDAxN+tsLWUqv/JcdTAwMTmAXHUwMDFkVfuI3ExuSfRcdTAwMWJLRtEyhrd0/GSwgNZ6x4FBOfeiaKI/blx1MDAwNbpXLJjat71Hb+yvXHUwMDFlIf/lPU/NXGJ+NWN98UrFT8Rq9ExLfYzJXHUwMDE5O0dVyEFcdTAwMWY5Tp1cdTAwMDZXSd9pwt64qKn13GK0XHUwMDAzh/UhO9FcdTAwMTPWPYRyTFx1MDAxZCnmddhCior1vVx1MDAwMXlcdTAwMGW9XG46xSQ9UiBBXCKyzSf+nfxw6Vx1MDAxY6NGYWHtIMpcdTAwMTGQm/tcYoJ0XHUwMDEwIJ+aSt9cdTAwMWVcctK0hGnj1ejSXHUwMDAw7lVcYmc7zv3tJ3336buhOdFMuXo9fL2Md9hULTbMXHUwMDE0/fzf+Vx1MDAxMYw0m6+5rCFVTCRl4zT9plxy2VLPR8NcdTAwMTG3XHUwMDEwsapFYFx1MDAxN9CETs2NRYFtrrNmo9HDXHUwMDFhMHbOWe1VTX+6mi7CRLdcdTAwMTjIXHUwMDAwkFx1MDAwN0l9VtBcdTAwMGYxrEdR8qGltkiuM8x8vfSc9bjOJugpXHUwMDFm//nVtUurrFx1MDAwZv6G3u4yXHUwMDFi3dJcdTAwMDNcdTAwMDWBskMhXHUwMDE4XHUwMDAxKLc04uClmSlMeVpcdTAwMTNI7Vx1MDAxOJHL413Ljn9SMILr5lxmRYbR6lx1MDAxZFx1MDAwYlx1MDAxM5XAiutcdTAwMDQ6f5hag0g/X7HNXHUwMDE2XGbc4WbNf5ppjzOQQF4tgc1I/pKndM3x//L5rlxi/LiW9f9wLXJgNiW4hzFawFx06L5onGjiSFx1MDAwN/uTtuHclMFcdTAwMDZFQVW6eZtcdTAwMDeOz6pcdTAwMTTOpfdZkTHu1z6zvb5kXHQgM2rIXGLeJ43pi85Txc/l05UzYWSQkT+UXHUwMDE0ZYIsmkFcblxiNmo4uVx1MDAwZfkmdcrK6bFcdTAwMGbU7V8/XHUwMDA32750nP9I/lx1MDAxNyfFXHUwMDE47XG8p2DNXCI8W8R4PDVcdTAwMWShmy0p74tcdTAwMTZcdTAwMDBcdTAwMWaIX0rkXHUwMDEzclx1MDAwYsRHNVx1MDAxOOKv0Vx1MDAxOcllXHUwMDE3tPX1XHUwMDFh5F9el9/mJ2Lz7sZquSNcdTAwMWTkXHUwMDE5faNcdTAwMDEjrYNcdTAwMDAo0yZV7Fx1MDAxOevMNpCZqYRS8fVw15eOrlE2+ebb5N/ZN0/yVGLyxEHJXHSxJNrGoIvGZONihEl6d7V701x1MDAxYTVNU3idnVLxt6wl39VSnJxqRLvKyHCCQE7ic8Z07UVjReLQM1HfX8rfnjBmTZJQjICj3Vx1MDAxMNRcdFKaqlxiXGbD4lx1MDAxZIMvrqpoQ49N37xcdTAwMDBznUPAUZuhpfy1Jtzv/rahXHUwMDFhjMB6KMitiTBcdTAwMTNEaa7wiGxcdTAwMWN9q6GpwdAwXazkoS47uK/StjlbmXL+XHUwMDFhr5y1ZW88er2ZsUBcdTAwMDU0h7koT+khRdFTO6RUTkzSZv3jXHUwMDFkXHUwMDAzJlxmuyRm9lx1MDAxM/MplMaPJKhoLslcdTAwMDfsmaGUwnPpS3PE7zNkvv5cdTAwMWHTka7GXHIsK1x1MDAwZt9+Xlx1MDAwM1x1MDAxMTlb/MjPeWdeXHUwMDFjXHUwMDFmXUl4RpbB8C4me9/RdY9cdTAwMGXQXHUwMDAwWHXryjt+xO+UJ1x1MDAxNJsxrFetXHUwMDAy20zmUm1z+sjpJFx1MDAwMESs+PPJyoA4MjeGWMowxEI5R3DwXHUwMDFjI342TI1cdTAwMDRGolx1MDAxNcRcXFx1MDAxOCNcdTAwMTRYeOjL91XjvJYoff62o5zLXHUwMDFm2lx1MDAxNifZp24qz5M4j4xPkv70lXNwLmz6aFx1MDAwM1x1MDAwNFx1MDAxY1x1MDAxZtKx0+b+SfODXHUwMDA3l20rntxV/Fx1MDAwNNesxeVb6LeoXHUwMDE5nVx1MDAxMXT/4PJLhIrH81x1MDAxZHzzT1x1MDAwZeFMnNTnu1x1MDAxZIJ7eWRcdTAwMTFcdTAwMTlcdTAwMWMnMzVJl0NcdTAwMTSepqCaqDVcdTAwMTR9qsV2LdY7k1xcXHUwMDFhVSysb32OzpxcXOmm6ZxcdFxyL4UlXHUwMDE5YLL9m1mtXUTsi0iK6uOU869ZXHUwMDE0osWc+9B6pVx1MDAxMypccjKnQ1tww1x1MDAxZTFsXHUwMDEzXHUwMDFigFxiwYphUVx1MDAwNnT222dcdTAwMTdcdTAwMGWHeDdl1YFd/p3xtihcdTAwMWPc+FTVJidcdTAwMTZcdTAwMTdgmntcIkZf51x1MDAxOFJP+Vx1MDAwM1x1MDAxOLvvSmaFk+XX71dU7lVbXHUwMDFldu7/t1b+hJTz74SFSIzb0mJcdTAwMThFe1x1MDAwMru3PXsonq51hoTM/HNcdTAwMThtpLqjn42OyVx1MDAxNNpcdTAwMGXFN9zhRPdWhp5cdTAwMDRcdTAwMDFxhFx1MDAxMIxDgizUqZJYhZthMlx1MDAxN7SeeX/ipf9da49xXHUwMDFlXHUwMDFmQVJZQce6ejI9j6hMXHUwMDA0ZNwpjZHuh0R/jOicp7RhvJ/37erDtP56P2OcxFNcdTAwMTdcdTAwMDZ+vc6ZrHPVJ/RcdTAwMTTmnacoKCUjumA4XHUwMDEw8Fx1MDAxZVBBup9RwnhkuGtbZfaRhTxO65tcZq28fVOsLGBvXCKkPK2sXHUwMDExXHUwMDAzrfr11Fx1MDAwMZqOKdtcdTAwMDAvdteJNIPGsLFKTXhoKCtpXGanx9GARdiv3168fHJp9lxm9fPyRDE7tdRcdTAwMWJLINNcdTAwMTSbgymTT0PmoJxcdTAwMDFtbqJvcVu1/HY7plxcjsg3qyEu583vun/3obBXs5VcdTAwMWWiN5/AJ7s+6DRcdTAwMDRcdTAwMTTamKk/fYnvtqu/dNGTeVx1MDAwMkVJvZDKI6OM4MY/xL/zvarnXWU+a1x1MDAxMfl7vqZcdTAwMWF1tX8jKVFCn5NcdTAwMDDbtDlcdTAwMWG/OrHrnLxvj9NcdTAwMWTCNufiQVesW7q1fVxyOHKqXHUwMDFj8VBcdTAwMDQjz0BHz1/JfrhcdTAwMWLA795A3NFpXGbkVdhcdTAwMTDrw6V0XHUwMDExXHUwMDE06Vx1MDAxMFRvxmlgJ1x1MDAxZFx1MDAxM8OY8MO99cl9e1x1MDAxNz5NbrI9lb5ccoDUf/5cdTAwMGVNJZjGQqayiz+g6Y/k9lpcZmBKl1x1MDAxNVx1MDAxY2loifI45JHXumOrn1x1MDAxOL8zgZRZWK69ybRcdTAwMWWvM1x1MDAxYv/v947zsa54UqD5XHUwMDFhmXOWsVx1MDAwMS0jLz9XkPF2fyXzoupcdTAwMGbUqZEmXHUwMDAxXGLhXHUwMDE471rWkEqgXHUwMDFi4XndYSuhPlx1MDAxZnlcdTAwMGZcdTAwMTD+MGS+2kFccjzSXHUwMDBluupdXHUwMDAzcNes9KexOvZ+K0ZFKuuhVuGr9UFVRih49HMuP/tcdTAwMDJIjMcvP5U17TXuQYhnn+uM0PTy+sp5t+ryOFx1MDAxN/XdVsdHS1GgrVAgxlxyM0rezjhcdTAwMDJmrVx1MDAxZU/5XHUwMDFki25Silx1MDAxOZJUjUtcdTAwMWVyITS+7lx1MDAwNCGQo1x1MDAxZMmKSZzXr1/lk9LAkKBbR3FCq8lsXHUwMDEwWjS77K+PmiCVxqZcdTAwMDZ1bco6pYxcdTAwMTYqo9VA6ZrWnetBT+8gO5inrkluzY+zoVe7XHUwMDFhXHUwMDFk0ifIyi++uP48qeNadvNz05ZX0C0mIWeJjoFRRPHabLqIRO5sranZVJ9cdTAwMTLcXHUwMDEwIK5mU0WnZvp2KFx1MDAwYiB0XHUwMDBinFx1MDAxN7RmNzm5Tlx1MDAxMVx1MDAwMFx1MDAwMSQ5lUZcdTAwMTTw1s+fxzE3hHrzXHSWXHUwMDA10iiDkLquuvNBloxcdTAwMDQ/wPFcdTAwMTLSXHUwMDAx8N3hVnGaLsjf3ImMXFzekJnOXHUwMDFj+FsjJP9qhI6sLiPMTTS3sEh0XHUwMDAw9XQ8dTPow3q1XHUwMDAztocvNOVcdTAwMTS7gMCcrYDBXHUwMDFjL1xiz7SLXHUwMDFlgYuVPtNcdTAwMDNe75Fq+Pq1N5SX4c2hS1xyWXRVsjR4bDYyZfvffoE2XHSj9Om9x7g5ek09r4M1t1x1MDAwN02S+/qpXHJcdTAwMDWsUObfmrKvNaVBUItt4uVxsa41VeVt7Ym1OL9wXG7sTjK/d+px0Hd8jG5d3TTgi+goiJ6u/sleM1x1MDAwZlx1MDAxZvruy6Yzq6jjPyis1TwgXHUwMDE1h5Q4+Wg6zzyyrmq9yq+6PI7MMU3p9Tsv7fr+d39i/jPRWkps4Pk40CcgNPBn85vdvs7l8rxl+WpppW8uXHUwMDBmwmi2hf47X6XJsJz1xGJ4JFdjKUo7+Vx1MDAxOFx1MDAwZoRgl8MsaZqe6/hcdTAwMDRMNSimmdlh1LlcdTAwMWQvXHUwMDE2YWBdXHUwMDA3ypKUlLuKXHUwMDA1XHUwMDFlrF/7xlx1MDAxMlx1MDAwZcVcdTAwMGJqSi3Kjlx1MDAxNYbi8UfKqIhzxfFjSG0+QO/sQMg+WMH52f3yVvpWPunDTVx0vGOHVFOQcp08iMK8M27R3qySk8yTw2y9U/pB9GFcdNU/XHUwMDBm1rG513ylXHUwMDE4h6W+vfauvDkjdKWNw9bE0ruhZVx1MDAxZfumsewwr/lb0Zrrc681ZFXUnHOkN9qr9lFN8DCCXHUwMDFhN7X1NVxyTlx1MDAxNFlSXHUwMDE594NcdTAwMDTzyJM1JZRUXHUwMDA0S1x1MDAwNZC1lVxyeVx1MDAwM42YbJtcdTAwMThjnCtzitVB+O3pXHUwMDE241x1MDAxNcNcXEXXzrVcdTAwMDdroUePSyDfyDXPiFOo3su6ITCKjE3gr+79tc9Xn3xcZpyv2mXLajmaYe7Im2Du7EreRsL11iBcIrt1jcAh6YJ3tTn7+lr02lx1MDAwNlx1MDAwZVx1MDAxN1x1MDAwZoulXHUwMDEyRj5sdNSJ8vd0YpZcdTAwMTMtLlwiQlxcXHUwMDBi98B6MoTylGxvwv48OH77aHBcdTAwMGJtXHUwMDE4NFx1MDAwNXnOkp9cdTAwMGbz3ad5XHUwMDE263PiXHUwMDBlU8M7XHUwMDFiXHUwMDFhbziOP81STTK6blQ8L9gyI8XXvzMr+OmMcVx1MDAxY5nQZK9bikJryrVftFx1MDAxZTtevaB5LM13p3yIzjzQmuvhOVx1MDAxYrq6dNR2LkNI9NSIK/dcdTAwMWN511x1MDAxNlJcdTAwMDX5ZKiiv1x1MDAwMlHusOUpX+P5oVx1MDAxM5nSQlx1MDAwN0jadYPUkIaAKua0+ud39tBTXHUwMDEzxJgr4qxcdTAwMWNcIiU23+hcdTAwMWKMx/NqT7mC5zZU0pJmcuAvZvvXvpVEqFx1MDAxNTY9fj3wi6tcdTAwMDc+09iRppS8l5ukrIC5P8H0USWhXGbWXHUwMDAz8I5cdTAwMGVrqd4m56bRJi6p5+RkfVx1MDAxN0SUadI99Jz0RZpuUlx1MDAxMvFcYu+yKeUqSD7tk9s3VlRcdPI7XGKstnyBamxV1I9X31x1MDAwZU7RnUKY6alDSWZcdTAwMDVbSqHeaNCxIyi0XHUwMDAzQNpcdTAwMTD0uJuQcP/mJW8qdvVcXP7gvZX9zpaerlx1MDAxYVx1MDAxMZJbqpA6XHUwMDE32lx1MDAxMu2gXHUwMDAx3sJsJsBcdTAwMWP2Ylx1MDAxZERKUNVI41xyjZ+PIE5ocMD9h03VKIVUj4RcdTAwMWY9KsFEx2a8RyNccnLOXHUwMDExX+CHz1NcdTAwMTTkW+PpxGg55aDm9frVV1x1MDAxNOdcdP3x/G8//8FyfWPEu32zkVjXXHUwMDAxkNSdbSlcdTAwMDDixJzlZeL69vdvIe6XQ743562c61x1MDAwMKgv3jOA+Pg2XHUwMDFm5ejlPIlcdTAwMTFcdTAwMWF4XHUwMDA20yM+8TNcdTAwMDdEXHUwMDA3V+OU3DNEQbtWoFx1MDAxM82vTl2m+ocucGFwvFfPoWu1XHUwMDBiSt15zMNcdTAwMWNcdTAwMTJjTL4tg1x1MDAxMLsg6z9Gl5u2PIF+OsDOlfumhVx1MDAxM1xmdfFcdTAwMWH3pWZcbo8tXHR/vI2rkGQr51B7n1x1MDAxOTDQ51Vzs/ttbqvXb2/d2L7+Yf1/+Ychn73JXHUwMDA3XHUwMDAwXHUwMDEwev5eclxu2f1cYtFewapq8ezZXHUwMDFkqcTks0UlQWuyz9F7Vpur22ORIGXBOHpcYmFcdTAwMGLF3mhUkGAjXHUwMDEwVkPaXGLe6cy/PSbtfPpMY0SbVFx1MDAxZdBhXHUwMDA0flx1MDAwZWbv4Vx1MDAwMbwyXHUwMDAyxVx1MDAxOfuJv1x1MDAxY4b49YPjf+cqWYbifue/8DvXsVGXOHVJXHUwMDA29kvIwDdeXHUwMDBljjpcdTAwMDJcdTAwMDNcbiRLyz+SyUmP81x1MDAwYm35alx1MDAxNvc9e4jCpqeI9sGpqWtw8Ms8ffp701x1MDAxOJ9eJFxcoSdjaZ3NXHUwMDA1uLuGXHUwMDBma/BxPlx1MDAxZf9v78fKhJO3vmWqbjNq81FkoDP6XHUwMDAxZzRAXHUwMDFlWEhcdTAwMGKHWv31WVf691x1MDAxNUtgtS2Dq45B+/WmNsCE1s1biuWm2pCw45JLPuSqYCdRXHUwMDFjoFGFvvlcdTAwMTF+oYbwrFx1MDAxMKsoz3W2j1x1MDAxZnyH1c52TixcdTAwMTPNkEVcdTAwMTDYjFxiqrXvTyjv9JJ/4VH511x1MDAwYlx1MDAwYiqeXHUwMDFj3PtcdTAwMTbNR4hF0zOpXHUwMDE1xGpmjTBcdTAwMDZzz+wuvrT8QnDKVcd2XFza36Qo4Fx0JcxVV3zidZDAZO/5T1Y88ODZXHUwMDE4NLHlK0xcdTAwMWR9SbjhXHUwMDFllD48XHUwMDExM1x1MDAxMO7N7oWoNVFaXCKlq99MhkLUXHUwMDA3R1x1MDAxNs4ph8DwcFx1MDAwZvhWXHUwMDAysVSEzDJL/Fx1MDAxZUKkZbOzMTmDhuRKV1x1MDAwM0pg+3PS43/8V1NcdTAwMWasL1x1MDAwZj0537fjSZgo0tIg+UZcdCrz0E9cblDv8eA07yEvXGb111x1MDAxZuibJ7476v7nXHUwMDAzPD8mP3/bXHUwMDE5Y1osWKG3154jQaRLXHUwMDBlr46QWL23j0WH3k9cdTAwMWG4M5v1uXw4Rj10Ieft+P3R4q5cdTAwMDBcdTAwMGbSbchcdTAwMWE8nlVcdTAwMDDY1svRIFx1MDAxZSPvLq7709+CKGps6Vx1MDAwN8RcdTAwMTDej83r1ji087dEpIA5YqTq1H7CvjHR+nqO2ctzzHxu3d9cdTAwMTnB7ytH2utHMsonQoRcdTAwMGJcdTAwMWRcdTAwMWXw6HJcdTAwMTRIXHUwMDFjx9zyXHUwMDFml2yX/TN7W1wiNS2cyptcdTAwMTXAsDFbm3ZHMCjqhrrcwrRcdTAwMDS61Fx1MDAxNuFDdHX81mto0tqy8Lzts2bj6VxyXHUwMDAwoIXfiHE6hWl4rM9Z8f448Fx1MDAxOYtcdTAwMDeMg4vnXHUwMDAx63GZoL2O5lx1MDAxNUHRL3OFp1P7nvSrTo1cdTAwMDf0y2tcdTAwMTlf3zFcdTAwMWRcdTAwMDW/enSZunQlkCDYc1x1MDAxNsR+vZz0dDp0XHUwMDE0RvnqjILPt1x1MDAxZnqNc2uWXHUwMDAzVnjkaY1cItJ3s7bCq7ijn0BJXHUwMDFh51x1MDAxOVx1MDAwZqlccquuXHUwMDFjXHTcTlrJZ1x1MDAxOGopTn045VhY2aClXHUwMDA2LcIqh6dtvUBi/Ezpv75cXELM7UVcdTAwMWEw94meLmvYmoX8XHUwMDAzKFx1MDAwM1x1MDAxOKRe/FtOqT23zddTXHUwMDEy/2pdvv0rVFx1MDAxNFx1MDAxZVx1MDAwMvd73+tV61wiY8fYlO55U1x1MDAxZa8/j4DczaAjb3j4zkyh8vWCyN/kQkKCXGIh6MmEXGLHjfwrY1xymqmo1I1cXHep8N7QJ2YhXHUwMDBiTMnly6Y75D3LTmCcelx1MDAxM5ZcdTAwMDP5+NObgnrSnlOXZzffdrNcdTAwMGVcZlx1MDAwMfq+XHUwMDE5fr+vXHUwMDA3bcA+jfKuxnlNyOxE0WNcdTAwMDR2d1xurt+VRcFGnrjxPS9PNj37zFS0XFzPMVx1MDAwNbBhpSVWnLJOviCcj0e7XHSfJ8Natlx1MDAxNiao4Syo41x1MDAwMTltejBqz1xiXHJ7dDBcdTAwMTDL+002XHUwMDE0zZ9/4oFcIuhcdTAwMTBFO53Mrmr8XHUwMDFkcFx1MDAxZPizXHUwMDFiXHUwMDBiRIBHi1x1MDAxNrlcdTAwMTiXlqXUXHUwMDE2o9TQKUVEndOVXHRcdTAwMWPrglFrgWmY0rFcdTAwMDJ2XHUwMDFhlDezd8z6xKcp3/jMWFx1MDAxZVx1MDAwMlx1MDAxZlx1MDAxZJT6jsmCyz1xXHUwMDA0LKWdoPh5cmCsO1x1MDAwN1LEPll+6PrHIFwiZaDLcnotZPd0oY6M3p7MTEFbNuFcdTAwMDH6VVx0K1xm4vj8rt9Y8nw40OvU78PrwTDXq1x1MDAxMlx1MDAxZTc1XHUwMDA2i16cysNcdTAwMDGAkyqT+WKAVu1rXHUwMDAwXtlP4lx0mPddXHUwMDE1XHUwMDE4TjVYfWPlc65cdTAwMTLpU1xc38fgbC1tONrVzvN8WYYljGbw7o+7KdRcdTAwMDXC2FlcdTAwMWNp85qzXG55hC/+jOGml+DUyVBcYjiUVWPJXFzqczxcdTAwMWVcdTAwMWaGJW0p2Vx0/1x1MDAxM+L3TVx1MDAxON9T7N6bWcxcdTAwMTO2YnFcdTAwMGXhIUPC761xdLfbvWJcdTAwMWUn3/KeTX/OXHUwMDAzRq9cdTAwMTcljEHsXHUwMDEwcVx1MDAxOFx1MDAwMjqMXG7kXHUwMDEz68VcdTAwMTJcdTAwMWQqipzSt+fjSbp9n/+JXHUwMDA35/PnYWWaXHUwMDAx+8lcYvaNka7nryd89Y5cdTAwMDUr4W8nfaioXHUwMDE3XfbE0TxcdTAwMTdE4UqTV3JcdTAwMTYvc26Sh31x04RcdTAwMWEr+6H4XHUwMDE2aY7EUFx1MDAxMtBNrlO2XHUwMDExx1x1MDAxNUvjJlLXdmOeQVx1MDAxMdxkM+pUgFAttd2U2IlsoVrc4YMt32d1vlx1MDAwNJVjyvjZ3I+eXHUwMDEz1aB8XHUwMDFkk4yRUYsuMoRlcL4p5yVer5cyMWzwSIbzm4RcdTAwMTfDXG5FeeKfQrDchlShz+zTJ1xi6P5ULFx1MDAxNYlcdTAwMDDFM99QXCIjhzIszOzR+LJjvF5cdTAwMDNcdTAwMDF9artVXG6OPDaLhFx1MDAxOcmlwPtcdHv6+3lcdTAwMTdq22/h7abIXHUwMDFmXHUwMDE3O1/wlkRlt+E9/OxwiZL+ja/scu+XJVx1MDAwZidmRVJLXHUwMDAxOlx1MDAxZtIvo5tsS4a3Ta1cdTAwMTlG/VxiwDmnXHUwMDA2XHUwMDAwXHUwMDFmt9dlQefywu5P2HoklsTbp366acRBxcCEXHUwMDAyXHUwMDAy2UlBr1Eov99cdTAwMWSXJ4JHs8mCh4zlXHLrp95wcetcdTAwMTVzXHUwMDE5VI6YcSNuxd672V1HXik5qsi7d+JFaZm9j1x1MDAxNtyw4kks8XNYXG7m+9Ke1rl8Jlx04mNcdTAwMGaySJI8XtpB0oyxUSYuaveO1V2Fu+b09JCKQsF03aaF73qYXHUwMDA01Vx1MDAxNVx1MDAxODmkfJ968E9FpczVXHUwMDEwt1QhcTFcdTAwMWZcdTAwMDPu8WqnQYhuXHUwMDExXHJcdTAwMGI647GBolj6+1x1MDAxNFx1MDAxY2Q7P7FYgM55+TTdjSU5XHUwMDBmqZ1cclEmsWKJJ8LbeM9sjOpNw3ifrHrzWlxcYb7PKGSZiNHseeDVtlZbXHUwMDE0XHUwMDE30a5cdTAwMTO2biz3YKpjr0dQXHUwMDE3843ylf3G4bzqXmGXIe1aX2hcdTAwMTlWVPlrPuieebJq6V2Xq9GQXG6PXHUwMDBmuzT2cNtcdTAwMDfAXFyqopfTkXVcdTAwMDBU7Fx1MDAwNDRmNJ1+rb/HW5n7XHUwMDAw2XtcckrSoFZ5XHUwMDFhfNpcdTAwMDRRXCJNTLyXT0C/zVd2N6m7yGWcXHUwMDBmsahvsDdv4sIpmjlcdTAwMTjlqZXNZf/DMv/wZFx1MDAxMVRbm5in/1x1MDAxMIZcdTAwMTJ9XHUwMDAxSVxuhs3J4KBmMf2yS1x1MDAxMDf7Ysn5oq9cXJBcdTAwMDeZ72V32GtiS/25TsVUgbhMLlu2d2HCYT9cdTAwMWJcdTAwMTh3vVxcJVx1MDAwZVx1MDAxOEN+eetcdTAwMDB5XHUwMDEwU56701xmRmpcdTAwMWVgSVx1MDAwNJcqacdcdTAwMTWVVdOHeY4x+bnl4qNyX+9yo22BrpxCglj3XHUwMDA02OVcdTAwMDH7n+58gMzM4Nzw2sWQ15PA5Jj7ck7Ca3GdL3ZgzzG13Fx1MDAxN39GV8dOXHUwMDAxwNY/XHUwMDFm+qbjXHUwMDE03lJMJyB+9lx1MDAxZLfz5V57YVxuXHUwMDExvbWp2q7JZ71cdTAwMTSBOVFSXHUwMDE00uYktHbiXHUwMDEwwims7k9cdTAwMDNE6+bTokBcdTAwMDCUcUTJSitcdTAwMTBqab9MVjjJmfvpNVqIp56ARogxW6abiXCDo1x1MDAwM1x0nC6BfVx1MDAxZo0tXHLjW62Ha2k+9k5cdTAwMTdob1x1MDAxNlx1MDAxYmEx8lD4XUtsXHUwMDExjNXF08DOO1bBa1x1MDAwMDhcdTAwMTRBUYJCJ4DCk8NcdTAwMTJMWVwi8excdTAwMGZEiluhuJAoPUKe+uKjwFx0LLdcdTAwMTTKM1ZGzbpcdTAwMTm5TjYj0z2fcVx1MDAxZfom+TqXJ180jJjX89S/qZ5cdTAwMGbM2airvu+5eYrsau4rZGmJU9HK2v0t05/lXHUwMDFkpFx1MDAwZVx1MDAwNHneuT5ufusj3jmFOIBcdTAwMGZfhJjakkOy+Fx1MDAwMzWe4abF33j4xY+KmV/Icyjaan3QYJaVwsGTm6PlkKRcdTAwMTnlXHUwMDEz307Q6E/s5lx1MDAwN85jXHUwMDE5XHUwMDFkhNxcdTAwMDRjzutXh3NOsV1cdTAwMTKGXHUwMDExTjzl/MQnqI2ft1x1MDAxOVxcN58mUchHLLxcdTAwMTGEzEej0iN7vPCKRJVd/27ZXHUwMDBmqJeVJE12QS41K0kjcXxFo/ZYlbBcdTAwMTdVXGLjl3voWEduXHUwMDEymyr91iB/tydOmFx1MDAxObB5XGJcdTAwMTJcdTAwMDCk6kqRj86h8nFF0TtcYnxsXHUwMDE0QVDJXG70+3e+s1dfpLGXJPlwv2vFsppTJKRcImvHbFx1MDAwMjN2XHUwMDFlh1x1MDAxOODMkyun4yaa9oJcdTAwMTTh+fmiRq95/yizklx1MDAwNreB3SFcdTAwMDdjvWDP7ujnvFx1MDAxM0KErF6k4M2P2EdY31x1MDAwMtpcdTAwMDOoZ1xcRCutWlvHXHUwMDE4SFx1MDAxN/VdOKmj86w7zcLvUkTVn04vtn9gadu2e/lcdTAwMTG4R3Tk4jJcdTAwMTJcIrVcYlx1MDAxYU+pVXOQt1N/q1x1MDAxZPeRXHUwMDFlJ4ep+f7iL0N7KJJz8Vx1MDAxOaZcdTAwMTduNzZ+hpGjQ6FsLjRcdTAwMDKNdIngaNe3eeipRVx1MDAxOFqfU4Y7oFx1MDAxYptcdTAwMDVvl9JcdTAwMGLFPeUjqjh+7K6Vq6VcdTAwMTlDK+guXHUwMDFmWETch9fhamflrUpcdTAwMTKK2ojks1FcdTAwMThrSzy9IFx1MDAwNVx1MDAwYlx1MDAxNY73XHUwMDBitFfa2734mivfl8BgzHxDno+XdOdX/3WKXHUwMDEyUGloXHUwMDAyXHUwMDAyjbSanshQ4IFMT85cdTAwMWZcdTAwMDfrmZOOyff07/9y11x1MDAxY1JR1m6rolx1MDAwZS0jPYJcYkhANaBuUlx1MDAxYVwiplx1MDAwZa1SiZt364SXmlx1MDAwNJfChXdDwTmBnlx1MDAxNo5eKqFBQOawXHUwMDFhuWeQXHUwMDE4zY5PzFx1MDAxNlx1MDAwZlx1MDAxZm71aFxysE9jsJR3Z2ZPKPnPv9ikKrdCXHUwMDE4tJONv9ot+PDn/EwkXHUwMDAwoyueMsfDOnUkwEU+LDfVXHUwMDE5bFx1MDAxOKauz+ArpbjelPH1/lx1MDAwNWtcdTAwMDVzI8IoXHUwMDAzzsCDumagXHUwMDBl54xUXHUwMDE4Vn1cYqJcdTAwMWJV5JrOt1xmkePuRUvHKi98LuHWsFxuXHUwMDFiz9QulFx1MDAwN/eSJU8gnsU5XHUwMDA1XHUwMDEyVnWswrZx4yN7uKzh9Vx1MDAxYnZFcnha6V36nIxVn0n3SHlEgma+K1x1MDAwMOr2x1x1MDAwNc5cdTAwMGLDSFxcs5vpXHUwMDA1SZGKou56XHUwMDFkkdJi726UO3PlxbvdtvQr4JJcdTAwMWa2qNvFYc6g91G/cWJcdTAwMTTOXHUwMDE4xlx1MDAxOXzgaVx1MDAwMVL2LiRoKHhcZlZeKSe1lo9DY45bcTXA/Cj5KaJcdTAwMDZ1XHUwMDFkWvKpXHKzanVLXHUwMDE4kPRE8INK8FxcXGLd/e2GO+FNhVxyXHUwMDEzbmei5szWYu9IsVllg+FNzGslXHUwMDAwq39cdTAwMDOgWGp2wv+03T8tS8pvXHUwMDFjU7AqSe9cdTAwMWaRbNLJtmWtMbLHds5v5Te/k/SJh1eOL7GcM+5cdTAwMWEgazdmzXrJZHxedp4mXHUwMDBmlUBqULBugPCM3mCTlN05ofLWXCJsPkOHg1pBQpf69sUjTb5lqsO8eTu6v26Ei3lHlpJcdTAwMWVi1zdcdTAwMTMpXs+V84r2XHUwMDFjk7Vf7vz/xKObpVx1MDAwNvW5gFx1MDAxZVx1MDAwNKZ9PsVcdTAwMWMgY25cdTAwMWFFvK6aklx1MDAxNJpcdTAwMGWyXHUwMDA1Zf/xRfDitHnvYMZvnKDiwlx1MDAxOcYoZpppLlxc/HywdphQTFxmXHUwMDA2ku+9XHUwMDEy+fCSy6E99yogsnLgJnqUbzvZXHUwMDA0uNd7XHUwMDBms5H6jFx1MDAxZqBcdTAwMDYjLLNpRZPqXHUwMDBmPWJcdTAwMTSXg3goavlN31xyO6HK7b9cdTAwMGKwOVx1MDAwZWc5u1ZDedTv9jtcdTAwMDdx0exG3OyqV1tcdTAwMDRcdTAwMGJcdTAwMGbmotWYKlx1MDAxZlwij1x1MDAwYrhrgee/WI5uN+lvXVfXXFxPYM+1Ke5YkFx1MDAxN1x1MDAwMoCPaoCMpdzpN1x1MDAxOFx0XHUwMDA1XHUwMDAzKTJYU6JCSuk+5/ZjQN6CgFx1MDAxZcz6iD/WXHUwMDA3XHUwMDE4/OymXGbvXHUwMDExL6krXHUwMDE2TYMxflx1MDAxNvyBvPVcYkBkfUO5XHUwMDA10kPTaibx5D5xqylNLVFyfF9T/jBcdTAwMDVUXHUwMDEzXHUwMDA27l+MP1x1MDAwN9hcdTAwMTJ7sdXau6C13qe8o7JkpkmiNeTip6bjYf/wKGNPPmlExPdRXFy2jDfHOFx1MDAwYlfrgqhU3ZFh4ZpcdTAwMDJ35TGRXCKCO2kpqaHzYtObpSSY9EJeLr6ppN2+NmjoK1xip9RgVPXs807GhpIsy4OccWZvTJ1qJF+nTIomXHUwMDA0uO2kLHBL4Ljtb75cYq9cIixUXHUwMDFijZ9cdTAwMTVcdTAwMWZcbvnJ0G6nMP2QZFck2kHD8tvHb69Q46dcdTAwMGKP+uDiXHUwMDAxd4icP1vIfU82aCzrlmJUqURfV1x1MDAwNY0uNSg1XHUwMDE2XHUwMDAxykvpktvB3FxukYO5wzV4S0zTW1x1MDAxNOFoIyFGb5+qvU15t11cdTAwMTZcdTAwMTcr+qFxSFx1MDAwM3hm0Vx1MDAxYn7aSFx1MDAxYyX3XHUwMDBm/lx1MDAxOCw97S3dV/CTcfzjgrtcdTAwMWRcdTAwMTV2pz132X6GXHUwMDBiXHUwMDEwqcQndnCEXHUwMDE1XHUwMDAxXHUwMDFjK2xcdTAwMTevK3ioXHUwMDE07Iz7V6Xeq5CwKFx1MDAxM/fneatcdTAwMWO7XHUwMDE3Vt9rNdG/nFwiVrlcdTAwMDNcclx1MDAxMqBcdTAwMTIho32uWZNTnOI57XRilf7AXCKrauxTU1Rm4DfpqYnYd62Sj5Zw9lx1MDAxMKplnXrSuV7eSM5v52pcdTAwMWI1wGPpt0Vpqr/xKUZ/dpl3XHUwMDE3XHUwMDA3x43/+O7qtopcdTAwMDRpJ1x1MDAxZlx1MDAxNmL7XHUwMDEwLTzJy+fVgiWiXHUwMDA32ewk69+yXHUwMDEwxVx1MDAxM7cjXHUwMDAy+61cdTAwMTGhfp066c3W53XV6nHHKXCZXHUwMDFlMGIuhTSKIM5Y5aPQXHUwMDFkPeeIruekXCKNvFxytmqlJtw44UL6XHUwMDEx4eYpZdSIXHUwMDAxP1x1MDAwNJyNhvtJXHQl8jGQsyBjMGvyyXzqvShcdTAwMTlcdTAwMDLz9Pb+b15s1sO1LazkJZssXHUwMDA0XHUwMDBmXHUwMDA0OW8xsrLWRISAJ0RcdTAwMWH6x0KZzkZd99bXxVx1MDAxNXteUlNcYt/Yc1FcbkbUxVRcdTAwMTBcdTAwMTkrXHUwMDAx8kNU0FhS0SwsMFx1MDAxObBcdTAwMWbsO8F3+5BSPT+2M1BcIkZU+pSC3ZT3/pAhTVwiyPxTT49B7m9AK5fTzWtVKzb6IKS6Kp9cdTAwMTRiZ1+3ya3A/Vx1MDAxM8Ve0kFeXHUwMDAxXGafPZ24fk/ZU1x1MDAwM7bHf4FUUYxaaFx1MDAxNNufa1x1MDAwZbCxsiHBj3Fcbqc95T5cdTAwMTTNuVxmsVx1MDAxYc+sMo9cZtFccqAoQnm78LBzrTdzMkj/Olx1MDAwYvPZdIPuyZlKcX9Lpy3qk0M/cydEMX+sZd5h51x1MDAxMNklKE8oXHUwMDE4rlx1MDAxN1x1MDAwMudQbEA4yawlXHUwMDE0qVx1MDAwM8yFjH52rGXObkjRJuRlekllN+4lP/BcdTAwMDBhXHUwMDFjqSSmXHKLdFx1MDAwMm3UXHUwMDFmT+/jqfGDXHUwMDEwQ4dcdTAwMDG4jlx1MDAwMW71XCKRwIc1ZFn/N6deXHUwMDBmy9vUJchcbsTdNv/q8YKiXHUwMDE2Q1YkrK/ZLZr0blx1MDAxZDpPdChS3Vx1MDAwNNvmmYu3XHUwMDBizobzyvk+XHUwMDEyhZOnMbOxylx1MDAwZl6c6cWT5I8qoWSxPvJCJmAgLcL3ejmJQniX9KpzxInL1kW7XHUwMDE15Y5lifZcdTAwMDGY+X1OaSmk4Fp92jZcdTAwMTRA4c6dYaTSzidcdTAwMTGeglx1MDAwZkedaEVcdTAwMDayPUeVn1x1MDAxZa3GhIpiX2dtQJ9TKG0jXHUwMDEzXGJ/4UvoX2eMsrSrsVx1MDAxM8hcdTAwMTXPnCRBzVxcPyfkMNjk0XH1hFL6rZ/qglTP5WEzX1x1MDAxZOI6rMpf7yP+dz/6ct6Pl4VG7ueVe8rycmjxMunpW6ujoXOjSFC8Rf+Hq/dajpRrmkYviFx1MDAwM2i6cYd476ExZ3hcdTAwMWHfeLj6XHKS5nm//U+EJkIzLVx1MDAwNctVZlZlLSiFMFx0f0L1XHUwMDAymkWw0HvJXHUwMDFhR//rl9nHYHku5Vx1MDAwMT+ILIjVPsvj24muXHUwMDA1PSglcuA9vnW6wFA7XHJnjjk/XHUwMDExXHUwMDFhs1x1MDAxNlgs2H+4Jn60wnxcZjTCJtJq5J5cdCqXljtcdTAwMDSDXHUwMDAwni3tXCLiYijVda4pTeJuTejnXHUwMDA2XHUwMDE3/ejz74/QlfH9QHjNLeZ2/4h5mjmjeipsz7BcdTAwMWax71x1MDAxMr2rlK98osz+fVpuZH0mXHUwMDEzXHIhzlx1MDAxZvktSeL9pk/2YXqYzdhtmef1pf3l0dErXU2YOnLJXHUwMDE2hVx1MDAxMf1a6ZB6wI+YTf6LrbWlb6MpXHUwMDFlS3BsZ5zXa5ZklZqsy2xcdTAwMTCxXHUwMDFl1ExO/lx1MDAxY6lcIlxyrvMupPxqqG4oknRkS/dzt20wsjGLtttjWeBcdTAwMGKDkVx1MDAxZDCmc1x1MDAwMstqmmE6OCpUmJ8m5UcjeDAuhpdec5Gg7PmRabdcdTAwMTSaZtu+9Wfh+MXBs1svzsdiXHUwMDFkMVQz3qrqdJE8vrMyOtFcdTAwMTe1XHRcdTAwMWEpXHUwMDBlJvnAtyafWJyZP8m/c5mQdj3TUvGBT7b3u2pLjSXi7Vxm3ZxcdTAwMTJL178xZEF3j1x1MDAwMVx1MDAxNFxmlf1cdTAwMWSDdo9cdTAwMDFuo6nP2e/h7dVrSlDcwTt/q0+QuHQsZVx1MDAxNm9cdTAwMTmimbzGNcrS0vO4lEoomMG7XHUwMDExXHLrcVxcMGiftV6d5UMyTJHbt8+EdaJcbjlYNImvWnGeV4T9Slx1MDAwZeqWKvogXHUwMDFmekfm9WLK44rpXHUwMDFjXHUwMDE4bC1cdTAwMTRrXHUwMDFmkfp3IGSx6Zmgp1xmJTU/O1x1MDAwMUAvhMA/XGaeRPT8KHy9XHUwMDE5RUyEblx1MDAxZbXfWMee0+PnYMtUc/OkXHUwMDE5ON1yh1/16Z9cdTAwMDKeXHUwMDFhu5mAKVxyo9Jcblx0VDe8kVG3T8zN2+X14otunp9NXHUwMDA268LbdCVfUWuLk844bqozq7s+XHUwMDE5hWnHXHUwMDEyqGqHmXwhZaT0NFx1MDAxOFNmPj5tT7Sc/KM7JFx1MDAxYU6Ub6vJNO8lXHUwMDA3XHUwMDE5MYv/t7dcdTAwMTibLYL3XHUwMDA0Ty3covqM+Vx1MDAwZYJvvomna8vEXHUwMDFmS3dcdTAwMGLW+F2/Ur956em0q0C5XHUwMDE356OjeyzDs4ODfk3leNlcdTAwMDHi0s9cbrs+X/Z7fOIyS0Xsh1xygPXA1X5cdTAwMWZcZpdu4nR8kFsl9ZXgmZDgSyWN+rvLjWaTvOL9k7FapyFhZ+5cdTAwMTnKNJUqwV9MfnK+UipBXHUwMDEz8Fx1MDAxMXm8J9r31KFcdTAwMGZUgEo/+r9cXFxib16bi2dcdTAwMDOqUmbQr4BXXGJ+4MLQlVx1MDAwZV2SM9IuXFy8yP6207dcdTAwMGXwXG7JZSnhQHTij7/O9zpFcFx1MDAxZSBcZvTCuzZPTkD+WED6Id7KXGbxsEm4XHUwMDFml+osyFx1MDAwMlwirCtrkepTy/5cdTAwMTaGac1ZSKJcdTAwMGZocUtcdTAwMTm9XHUwMDE43kMy10XXXvZWjVNSXCKXUiw49UltgWGhXHUwMDFi4ENcdTAwMDTwScDsMH9cdTAwMWb9W8Sk7ZWDXHUwMDA3XHUwMDE3seOw8Fx1MDAwMar1M8tcdTAwMTOHyjKgT+fDXHUwMDE2ssZwXHUwMDAwnXJnuFxuVfNcdTAwMTdcdTAwMDPtnqSXJqJcclx0/4lt/f1OlitcdTAwMTRCUfw9j1x1MDAxNsNcdTAwMDP9XHUwMDA0dzjOXHLRI2Q0IFx1MDAxOW0kXHUwMDFkJTr5ZFxyJY5gUqU/uMwth67SW4vmiFx1MDAwNzz4L6aqsuPOw1nGcrFfWURsJWJ1eFxmbdR3XHUwMDFhPdBzf3JcdTAwMTG/mki2LEToSSah/rq4U1x1MDAxML74mJ1+99VcdTAwMTX0yW+/zKxccj8tZlx1MDAwNPZYKlx1MDAwZjBcdTAwMTUuYFx1MDAwNfhKooqEMiCzXHUwMDBl7I9amD85jO/Ns5FCLH9iQGTe+VFcdTAwMWTut1osr6lFRvTEXHUwMDAz41xca1RbOzbNylS1orAjoeGRwVx1MDAxMW5cdTAwMWRWbj5tlP6ok2E3rplIvuNcdTAwMDGFrmriV3jDwuHkrtZee+yNsupmg73qiyNj3m+p18uv2yzcYL1yY3NcdTAwMDNcdTAwMDPxQkhBxm57/PGUO7vERJRV8tZio8DiM9pcdTAwMTU+l1x1MDAxN0g01lTZT7GORzFgL61W0Fx1MDAwMUW3pZYwh/azuPrA31o/bivnqVxiJ+U5XHUwMDA2jqHG6SCo7Fx1MDAwZn6aMOr3wlx1MDAxNlwiIXDlm3iQ7KNcdTAwMWJcdTAwMTFPsuJ+9Ml6XHUwMDE1iH1eXHUwMDFhyDfwsWmTXHSogU7R+jaEdDR4s62uWvqlb1x1MDAxNiRcdTAwMDdp7rVlRoWo/+Wj8yvYKlx1MDAxYWZJq5yyPEBoU1x1MDAwNoCAxVxcJ/E8iKeRLf0p/Ek+m1FvvIbOXHUwMDFkqW4+XHUwMDEysa+7zqLpXHUwMDExXHUwMDEw9Vx1MDAxN31cdTAwMDbis1x1MDAxYjeQXG5LXHUwMDEw1K7npocypN3q4fG6fmhHZtVcdTAwMTlQV+ZUV5+zN3V9PuqzTz38TZVgy7RzUzxmz31cdTAwMTEo28T691JIq1x1MDAxOadzu1x1MDAxOea/XFxEwzpcdTAwMTBFw1V0xNFFvJ4l9eyUhDHOZoaATelcdTAwMWOo1+rqXHUwMDFlXHUwMDE3Rl5agdeEs1js+2dcdTAwMGJcdTAwMTK/5rxY2DAjj26A8eZcdTAwMDBBYHGmrFx1MDAxM1x1MDAxY4hZ6ema40JU8dBPcemrXHUwMDE31OtcdTAwMDGz+zelXCLEkze7XHUwMDAw0EdRj7U90HS3XFxUZtJcdTAwMTiQXHJDXHUwMDE2+5aIU+B7XHUwMDFih6aRXHUwMDA0XHUwMDE2JMdeXHUwMDFhccxcdTAwMWHUIT3Zf/qwZkNcdTAwMWGmXHUwMDEyXHUwMDE1KpPP0vhcdTAwMDCKXHUwMDFlVZJeqjS+jpU1/4lcdTAwMDeaXCLu+Fx1MDAwMp1pV0nFnftcZn9zn5NK7d/8aJGL4bLA+3GQlVx1MDAxM8VFjj60Yj9lWkVdOn3EqFNW46OCllJ8b7tfSlxuedeEfNCTv8B+8Sgl2lxiSD9cdTAwMWVcZoxE8zVcdTAwMDbj3MqLpNxGskZcdTAwMDevz+ruL8dYXHUwMDE4ovouz7GKy09cdTAwMGaAuslcdTAwMWT/eHNJk7PMl1wih0uvk6NcdTAwMGbgOV5cdTAwMDcukvdoJb/kdLCP31x1MDAxY5gkclx1MDAxYiujgqNxqNrc+pMyL/0pQ9vx8Fx1MDAwNZS3n5hcIvlcdTAwMTJcdTAwMTbHwNarhFx1MDAwMPnF8yFcdTAwMWJVXHUwMDAyo0Q9huRj9YWu5lx1MDAwN4hrQo9qXHUwMDFl9oPnnHeNkyll0V/R+Y7Ny9bVUr/04GaI4iFcdTAwMDTmU1xcvG9cdTAwMWGTXFxAXVx1MDAxMEsjn0Ncbpn1pUcsXy/+gPzpfMdOXG7Rmu3MRFx1MDAxOY0/Qa5DIFx1MDAxZYQ3XHUwMDAw7ECtI96pXHUwMDFmdlIv/Hw2un3B74tcZkXSXHUwMDBmV4pN+87vvodxZj3tgVx1MDAxOJpPzLXYgaNFZGW4flx1MDAxNjZw9b5cdTAwMThcdTAwMDPJXHUwMDAxWPX11sdcdTAwMTOjeFx1MDAwYuFllCnOPlg9bf7QzCGXqVx1MDAxM7RcdTAwMDS5lZZcdTAwMTCeWb5pStJY3Jh8d+T6+5RLXHUwMDFk6ynv8FTVUlFYlCr5T1x1MDAxMt3XcLtcdTAwMTdcdTAwMGY9xU1CpLhiziQvnp3gXHUwMDAzXHUwMDFkj7S7fVx1MDAwNupPrK/vvttqRFx1MDAxMtxcdTAwMTTvOqjXQ1x1MDAxN7m0xzOvsNfTr3FcYlx1MDAwM/WtzZ9g2o5cdTAwMDK24id5XHUwMDFlw2fwXHUwMDBl2Mk3XHUwMDA3+qos389cXFx1MDAxOH3e0EdcdTAwMTE8XHUwMDFikrCypHhzSENMtcRrRqTYXHUwMDE0QoWhXHUwMDA2XHUwMDFhpUZcdTAwMTFcdTAwMWH7gCXI+Vx1MDAxZlx1MDAwNaqLiLSb2bz+q3rJO2okPnzmIEZcdTAwMTVThvnC08pYtrrf//t+3c973PlcYkHTfnO2jE1zXHUwMDE0KcFcdTAwMGY+6Dvhm2XP7YVcdTAwMDPFXHUwMDA3nJLd8JRcdTAwMTVcdTAwMTdcdTAwMWRGJfCxdl3zk3tcdTAwMDM8XfHFspfi+Gb9e1Sxhzy8nEvjUJJiy1pK+ZB/bThcdTAwMDZcdTAwMTM5tutfnf3em/VcdTAwMDCBXHUwMDFlW046rcxGqHxtNKf8WPWQ+1+Oi5LJKqqvfTSzvKKh37yOISCvlrxcdTAwMDVcdTAwMTPvXHKJwlLcL4QxQu5X07Giy9JCoXrtXz1AufeLx5BcdTAwMWRqS1x1MDAwYrLqQIdcdTAwMWKX0Cucx+eMXHUwMDE5NuSx8NuCXHUwMDAzXG6IKHXJ0GCrXHUwMDEyXHUwMDA0XHUwMDFhXHUwMDA05lx1MDAxZMgj21x1MDAwYsvcUzLiNjt1gtlcdTAwMWJcdTAwMTJe9NKWj1x1MDAxMspLXHUwMDFkXGJt3Fp4P/zAXFxCud9tTnN2I9kz4PZcdTAwMWGr996hup6arL+ceM2a9Fx1MDAxZYrXU2tignU7IHmCXHUwMDA3XlwiIYRiqZ5cdTAwMGZJ4Fx1MDAwMZ5SpVokP1x1MDAxN7fWUveX+9k3tVx1MDAwZWGIj5rRkFx1MDAxMfx5v1JZ54RcdTAwMDfKdYBtXHUwMDA2sv3F3DdvWlM9vSzp4ntfjVx1MDAxNdNcdTAwMGXdsJ2eOSu8dJd9Stj5JsjpveGax8TfcpKayS9kXGZLiemtvPEvm456rSEvOWZMzpU6y/hPWFx1MDAxNkV18TaFJYuLMF84XHUwMDA14oB1Yo9cdTAwMDEkOIPA1zmZn1G89Iv2W5+s68+dz1x1MDAxOLSmUH7yXHUwMDE5TvG9TtNcdIS6Z8NcdTAwMWI/XHUwMDFjXHUwMDA3XHUwMDBmrlx0yMDq2eBXJFxuKZr32bdcdTAwMTHJSMnRXHUwMDAxP2RiTlxydVx1MDAxMH2gsJ1cdTAwMTNcdTAwMTcrNr+GXHUwMDE4elx1MDAxMG1cYphna1x1MDAxN3DTZ1wiZIvai1KrXHUwMDAzTFx1MDAwNKTpXHUwMDFlgNdcdTAwMDEjP7yZkVFfl7RcdTAwMTC2Y+hcdTAwMTPCN3rjdanIXG7B6Upav/5HaOe3ouiLjvzj15JCU8X12yVfTMvmXHUwMDEyXHUwMDBiXHUwMDAye2lcdTAwMDVn8FxmZzOblP5i61x1MDAwMJCx8Ljr2Vx1MDAxMnmpQEX5XHUwMDEyXHUwMDA0ZinWXHUwMDAzK6xcdTAwMTizrOx45tlAXHUwMDFlUvKH7cBvflx1MDAwZmS+i2Yq5bpQYftkJqYnVt1cdTAwMDSuXHR/XHUwMDA14WbN+zZcIp1FRXpYp7vdXHUwMDE24PFcdTAwMWVcdTAwMDbLNK1De3suwZyGxXv3TPtiMu9cdTAwMGbWy3RGo1x1MDAxM919oZX5buCx7i0vx9L5opL8JjpcdTAwMWHpai5rdFx1MDAxYegqLPSvZumYXHUwMDEymS5HrcJxMFGROFx1MDAwMHjgjIuRP+BcdTAwMTQ2pyNla1x1MDAxN9/LmiVcdTAwMWRWpsm4lySEom7OXHUwMDE3VVx1MDAxYsmlhqGhKS02wu6VuHVcdTAwMTFcdTAwMTSY9lxy4mRIROapttn5UczplzB8mlx0xV1cdTAwMDLqKDr9Rlx1MDAxMYpcdTAwMGalYL3Qx6tcdTAwMWZZYlxis+ztLcZcdTAwMTdcdTAwMDSTO1x0x/LNTGebh4qaW3mE+EGU/S5cdTAwMDG2MVtjXHUwMDExWZFnwTlSUGuGXHUwMDFiPiXkrH/O0a/Hh6S/XHUwMDFmXHUwMDE0YuVYTN/rp3RzffqCXHUwMDE5tplkcZxcdTAwMTJcdTAwMTQxyIt/S1x1MDAwNenIN4YnXHUwMDEw/FtPJMXbd9AlnPih2SustD5JiShK7Nk2ylrBwZvY+K9wzl1Z9uqKl/aVQ3hu0Diruz44XrNINolPZ0/qqPGeXHUwMDAzVOlcIqypQfvselx0XHUwMDA0iOJq87tcdTAwMDZl69NccvhcdTAwMGUnkVmghHbHgFKbYXKAXG614OBfbGMoinf2nbDweWfWNefNVV/xPGa2XHUwMDE5XHUwMDA2XHUwMDEw/rGMOvCgV67uMslUq4uDi5delWXG0flFba/ve72+x/N87iY2Q9QyvdWYqCrg0oAo0YezXHUwMDFklFx1MDAxZqjTU/d4OVx1MDAwNFx1MDAwN1VQQ0J6q0lV8TRGhVx1MDAwZSFcbsmyr90zXHUwMDE121x1MDAxNdfjI6+3sjdcdTAwMWN62qMvnMLzft3bXHUwMDE1XG5cdTAwMDTupJDooPPhZS3rXHUwMDE15qr+N1/j9S1ZzyR8KtswXHUwMDE4n/hcbq+0eTJgMVx1MDAwMyjJfe53snjklMrk9Fx1MDAxYlx1MDAxM0ajKTT6N/d215Gf703Z8nZbXHUwMDAxXHUwMDE49vMq0t85xa/bXG6LLn1cdTAwMWRgzz8x7FBmPiGxUpZcdTAwMTdhIGpLim2gNKL3o+3kkkaIeCxiXHUwMDE2iKOOPXuiRmSUjXBtpaN/Z1x1MDAxYrJ4021cdTAwMWZD3Jfq+37hXHUwMDE2QFxyxHBcdTAwMGXGplx1MDAxN1H9sMw6XHUwMDE1Wlx1MDAwN75cdTAwMDNcdTAwMTcrXVx1MDAxMC2E29v78YxQZPzLY1x1MDAxOT9PXHUwMDE0OWmmIJhcclx1MDAwN5fAzu+rUWTTIJ04WuJcdTAwMDdcdTAwMDDxXHUwMDA036Wcx1x1MDAxY4yHWtFQVva7XHUwMDFlQoT1rWFcdTAwMThcYqDSYi4lXHUwMDFhVbWGXHUwMDA1kLh2XHUwMDFk0lx1MDAxOOqopIGd1OfFS/LH1/xOufQww+rTOYWKWGdcdTAwMWRx/zdcdTAwMDaPpu2WYlx1MDAwMNU6zj679cnM+4vQuVx1MDAxN4604GRbgvfJ3CTUyO9v3EGBssDvMUy7vFx1MDAwMY2jkz1cdTAwMDCxXHUwMDBm2l5cdTAwMDJcdTAwMDZsc62s1FU1Y1xm81x1MDAxZkI/XHUwMDEzp3qFU1WJzGBcdTAwMTQytlx1MDAwZVx1MDAwMmdcdTAwMWHVV1x1MDAwNIljVfX2skhIkFx1MDAwNF9cdTAwMTLeUE+uP6HRPMz54tmV1q5YSGnllmzu0lx0Ylx1MDAxNtNcdTAwMTFcdTAwMDRL0oFLKU3U4ST5XHUwMDE53pHg1P2lk4tcIu6tWiFnXHUwMDFla2BcdTAwMTZ7jk/crjjoKVx1MDAwNEieek/R94fC4DpXqUvYuetqhnnxWDnKg1x1MDAwMjV/sehaXHUwMDEz7Xo2XFyr0krOQTCjXHUwMDFkmPmuOMJhhGiYski1XHTYiJRcdTAwMDFcdTAwMGK2fiSMidq9zo6V6+jfiiUm01x1MDAxN6lcdTAwMDX16lo30Lvvp/HaRL206XvmXHUwMDFmXHUwMDE23WBvp73fwkVQkrfR1X6qjr7C675v1K9uo3/qmmewbfDnRF5fQ3hccj1zfqDWLlx1MDAxOD18XHUwMDA0v95cdTAwMWKOyu9cXFxmkfnKs75rRiX5uWLpTEXwLp11yGDgXHUwMDEz9sHbvOhcdTAwMDdcdTAwMDBwv6lcdTAwMDCZTSFcdTAwMDNdyth4ofxcdTAwMWVzSthWadlHj1xubeB5g1KAKXpYsqUl+6V9PqqQXb/tTXPn+uhG7svvqlx1MDAwZbrkXHUwMDFlvLXiSVtypEGPXHUwMDEz1P7zIJhcdTAwMTAl01x1MDAxOKnNXCLkvVrQeFx1MDAxZUGu6+9iNcbE2MhX93ggf/yPuPnf44XP2U/9h6TiWz9oY8933488LFx1MDAxZklQqexcdTAwMDHusXfgqP9cdTAwMGVWLHCsOVx1MDAxYVYk68VrxivbgFx1MDAwZla59H6lLzOJsuP41U1B8HBcdTAwMDCFNPfoc/iKoJ9cdTAwMDfyduFBtqxcdTAwMDcloVx1MDAxZVx1MDAxZOLLe/cntyyelFW80EZn5X6ZeZpcdTAwMWKYMruilPZ7JGhqKWmzlvvaeiXD4/sgXHUwMDFjXHUwMDA3OVx1MDAxMFx1MDAwN1xycoB1sCVidz/nluZ4d7+6XHUwMDAx/dFcclxyfpE8/PYkfH49XHRS9C2CRyibNTE2X+V1xlx1MDAxOCdPPlx1MDAwMfEqqsGqu1x1MDAwNFx1MDAxN66lXHUwMDE2Ll+H2PSqOlx1MDAxNFx1MDAxNLXec1HA7Mw/MDRcdTAwMDMw1/C2XHUwMDAyxfVIMHwyeV8q+uhtKIb54lpcdTAwMWb2XHUwMDA0/TFD/VlcdTAwMGJw81x1MDAwZr9cdTAwMTTNYen3ha+81dro4647gJRzXHUwMDFhq1x1MDAwNGfI5oVy1WZZXHUwMDFhXHUwMDFjOrWXfFHwryR7oOHPXCLQvX3nXFxcdTAwMWWAZOJNR4SwnstcdTAwMWIoLOpTN1x1MDAxYsAgXHUwMDEzzVxyPyeFd7U49dE0Zjl+c1x1MDAwYuviXHUwMDE2YS2O5cC15pYk4zNoU0YopqFZ+05MotZhJMFcdGH6VL5mQmTmTPLCcL5xsGPyqf3v7OYkXHUwMDFis5ViXG4vt1LSrG2feZJglMfsIOfOR0nmklxuXc8pbFx1MDAxNy5dZL9cdTAwMTWZv9pEfus4UN1cdTAwMWYjWrDTU8deXHUwMDE14nf9sLc7bFx1MDAxMN5Equi6PF3QyvP+XHUwMDAyXHUwMDFid1x1MDAxOWKms6z72TNcdTAwMTei5vY4s1x1MDAxMVx1MDAwZfT1eTblIKyFwn9y4aHTYc1cdTAwMWKtsVx1MDAxY5tlToFmXHUwMDA1gSFCm7qR7vwsNlH9r67g1lx1MDAwZnJcdTAwMWLDKdRmjSAhvHzW3ZlYJ44gR32s7saYgCN7XHUwMDEx9VKvWCX3zK2fjWFcdTAwMGKjX9+WS935l0+Eq294XHUwMDFhXHUwMDE0w+lbbY3wXHUwMDE3XHUwMDAzqM/uOjnRcVx1MDAwNLztZS7CIL76XHUwMDFhglx1MDAxNF/FYlx1MDAxNnpU95QksSy69IHPK1x1MDAxMstcdK1Ec/G/mCyIyEvhq5heXHUwMDFl/Ck8XHUwMDA2ffvRzlx1MDAxNf+bn3/c+XmYQ5bM/lx1MDAxYobIo+zwXy5jbiYwwT0jyZaTw1aPN1x1MDAxNtAjcuUn2P7jXHUwMDA2oGWdxY257c2f+Fx1MDAxNOSa0+jPNWG3i1x1MDAwNHRVmHwkXGaWt+dLttRUT2VZLCNgQt5cdTAwMTfv6Vx0zpJh69qsNpZXSmhDsmDQmVpcdTAwMWHhyKNcdTAwMGJLfVx1MDAxOTmJrVx1MDAwN8npMLnKaUFcdTAwMWauJI5vfOuotf5fnbwq7qJcdTAwMDJXiNrEvVx1MDAwMHz1vTDPsm1cIpTjeLLw9OIhMHVcdTAwMWRjrNuCMkvTVHJSXHUwMDEydPGOo+iP/nlOejKRss7EXHUwMDE29CRXYFx1MDAwMyh0zVx1MDAwMVS6QJHm6/sy3HG26FjmR/n5zFnXc6eP7lx1MDAwZZdotj1Jhlx1MDAwZTdtXHUwMDFlvYIggDiOOFx1MDAxZVOn2+r8hKbQeK9XzEElcvu35OKK/vrZ8GSc+piXML9cdTAwMWXmXHUwMDFmvkbyZKPQ88c/uiBcZpZMRLJcdTAwMDRfXHQ8PedcdTAwMTNcdTAwMWLtpfpIqFx1MDAxYVx1MDAxNFx1MDAwYtncn297/NL7znnajWD9+LguIJNpR381OrKqi1x1MDAwNVx1MDAxZrJcdTAwMDPgMIcufm6i4chIRjTlm3ThLTFDXHUwMDE3b7u4WrnA+lx1MDAxYk4v3rPCRD7i5bUhXHUwMDFjwTtoXHUwMDBiqlx1MDAxOTG7eHOvq1x1MDAxN3tUuy+Bq7OMZ+Wg6CFlhyua2vx7cZF2YZ9fpl9cdTAwMTM/NH41sn2RZPkrsUlcdTAwMWJt31x1MDAxMHNcdTAwMDQg0VfqMZ7V2PFVWLc6x265edhcdTAwMTRFyUXBYsXAXFzk6CdcdTAwMGZ++yyC6PZwr8+xnteqnmGMb79+vE1b/0JcdTAwMWTg2VtcdTAwMDIt1OFcdTAwMGVcdTAwMTQ3XHUwMDExOu+8XHUwMDA0XHUwMDEzqzjZXG6IXHUwMDAwXXTZXHUwMDA0pLtHSGZY21uhRDK5XHUwMDA3jlx1MDAxYpdsZnf+xtqlSKZcdTAwMTL6850xXHUwMDA37ZZcdTAwMDNcdTAwMTlcdTAwMDdcdTAwMDPeqoXfPT/uusDQXHUwMDBio6cmxZ6qqTzXr1x1MDAwM1JNXdL2JXIujGLbiEkukP5cdTAwMTnr6zqzVa2Y79s3hz6M+IVcYmBWSVjjwlxce02x2IKYySnx41VKoU71t1xiKzdoXGbFXHUwMDE0fYS1el66XHUwMDA1Q1x1MDAwMrSn3+iR96NKMVSpwnT1XHQvbPfHZXr8eVx1MDAwZkSOZyXabGpcdTAwMWKGdpL4gq9cdTAwMDI7y9NcdTAwMDfP5jGkycWLXHUwMDAwXHUwMDFhnvGeXHUwMDFmWVUotVx1MDAxYsOoUr/iO7ZRXHUwMDA288/7/1PT1LOZfviWV89cdTAwMWQ91peGTGdcdTAwMDLfv5Pn9Fn4XHKkXHUwMDAzRtxiuFx1MDAxNb5nlV/D8sLN9r5XkIHeu+DJXHUwMDEzXHUwMDExKmb3uY6FdV+HYPNcdTAwMTJcdTAwMDTv8jfQLmnx5pmEgyRcdTAwMThDlFx1MDAxM1Yt8b9Uiyy0+bWEW1LW5VSvzfpOslwib8FWh4BDXHUwMDEyk1+PmUTdvIBCXHUwMDA1VvvzV6p3nJQ+1Fx1MDAxYmuT7/KYXvZcImCvbl47aM+G8DEjIa58XFzHbFx1MDAxOV71XHUwMDAxq4xcZlx1MDAwYlxuylx0ZnrDY9NW+2zOUp8qN1x1MDAwYq8mM/tcdTAwMDarr6NoXHUwMDFiZ1BcdF/QSpPUoOq1nj9LbFx1MDAxYtVWXHUwMDEzWiltqqU9PV7g2SW9xOdPff4vPkY0W1x1MDAwZSZOkXNp3Fx1MDAxN/KCU4mDiFNMPlNcdTAwMTXNV3PCrHn9+Vx1MDAxMv/1hfzlZ8ifvpFcdTAwMGUxtTYhXHUwMDA0o1N7TLjm/r30XHUwMDBisMeDvvOD2Yg1eyhcdTAwMWFla2fTlyw29mX8XGZK6lxuXHUwMDFjtlx1MDAwNXWOXFxar6O0XG6WeGjAXHUwMDE21yMohqdGX4E1YYeDVrXyyyFWJpH/1Vx1MDAwMICiXHUwMDExbW76PGBeRJIpq50kUzdccsxA6d0sllxi4tZB0ZZcdTAwMTlu195cdTAwMTZcXP7UkVx1MDAxZo+dKSY3KdPnrNIvqcuxRVx1MDAwMiakeIB2zkxcdTAwMWab7e3doS9tSVx1MDAxNPogeiuxzFx1MDAxNmFcdTAwMTiSaXZx3zyhOGp24IFcdTAwMDTR21xuxi7TnmOskCTi6zg1TEBQZ0LwfLl4nX/rXHUwMDAxXHUwMDE4MZQ+XHUwMDE298s+jKmvZf6i18PDkVt6XHUwMDBmtuizbZG7kiczNrr/+dd3cfs/zVx1MDAxZp6PtInsnbh5XCJcYug7SZ5/U2ymk2VLf7mmSm2/68D+/9ah3c2mQ95cdTAwMDS7VtJcdTAwMDakXHUwMDA1XHUwMDE2XHUwMDBmzKW34JKjwHDDKlx1MDAwMFRtt2W87Hz9xJn+LLlZRVx1MDAxZtHnKbhcdTAwMTlSf1GYiWpcdTAwMTnJJCQnOid8YWiIfNhjwPWNfth6j1xmRXrqpVx1MDAwZVx1MDAwNVSNJtRcdTAwMTJcdTAwMWaYbnO5tYxEMv0v7lx1MDAwN1x1MDAxZnF7S2L1eLib31W4YizR6uL03Vx1MDAxNzPRXGLkcFx1MDAwNnkgt5+rvHVXP5XF915XdKfvs636zJQ3VVx1MDAxZa7lM9dcdTAwMDHXZuQz/oLlerSZXHUwMDAxp1x1MDAxN03JveSBlzS0bH2lnVx1MDAxMGJRlNSCiJb1nz7Qak1YQ1x1MDAxNCFteMzbtITqlLNcdTAwMWb9ca2fTmySYFx1MDAwMyRGTr1RYtz/vIl2RFx1MDAwNjR06X9cdTAwMWWVj5gpjrt7j2RcdTAwMWLWfNuXxvlcdTAwMWOAgCBPoj7xTCZGbLK98UFFT3SLilx1MDAwMFx1MDAxNkj1Plx1MDAxYlx1MDAxMmlcdTAwMGW9UiS/tSf69r5UL1x096xcdTAwMTNcdTAwMDGDyLxIW859R245PVCAzYiVXHUwMDE3RjmXXFyCJH3DrMgpI8H0mpe56FxyrFx1MDAwMfQ341B5XHUwMDE1dfe1Suf50YE8L2V0lIzP+/FcdTAwMDF19n6/RezNXGJgc1x1MDAxNl6zxNeJoHqai0eN43f+hIGVNqR3XHUwMDEwRM/Pb03prq82L/pLP6DpMFx1MDAwNSWjJqNzcKZ67K9cdTAwMDacQm99fo9qcC/9ZTzrumB+deNmv1x1MDAwZevmJMjNM9RcdTAwMDRDXFx0XnpcdTAwMDJIbFx1MDAxOcjWQ0N1MKRdkjJb58PY+vxcdTAwMDZ1p6h4Q76ijMZMsnimXHUwMDA0lFdsL+jz0lp0tledKSuRc1FccoNDXHUwMDFlJ9npJVx1MDAxN9je7NFdJWoodVa3T5VKSP6/fKNEZuQswUZFdMvX2fFCXHUwMDA1J1x1MDAxNIiS4GK9SN/oqXh+XodL6cPtZ0P91lx0lX++qkvOLEX4XHUwMDEyXVAjy4q1MFx1MDAwMGJibK/3ZY9XX3iqeydFb6Sk5UL2dsa3teJcdTAwMDWVXGaUlaq17b7wXHUwMDFlXHUwMDEyyWnoivHMQEagXHUwMDE3/ERcdTAwMGWbY1O5P3v7XbQqXStcdTAwMDF1hbFPSZ5oXG5cdTAwMDfbv1xcPEdxVlx1MDAxYbFcdTAwMDVcdTAwMDObSIGGXCKW6PNeXHUwMDAytCZcdTAwMTHXeaBE7KFHrOgg08BXXHRzsU9bpVxykvQg4WBcdTAwMDGn+Mndab99XHUwMDFiXHUwMDA0JIFcdTAwMDbCQlx1MDAwNMCP07RsXHUwMDAygTSR2Xy+mJm30+5cdTAwMTDl80g+P+dcdTAwMWEqmpSCjj51k1xmXHUwMDBmgmA8I3ZcdTAwMWXH63g1qViqqNgnhvRitfBaXHUwMDE0kZGvuX/0dLow/Vx1MDAxMZpkO1x1MDAxM++RqaF/XHUwMDFlX8m4PaahNp39l1jr+MQuXHL0XHUwMDAypvvykVx1MDAwNMVjg7+YW9HdXkd9lprnnYP4PzVjmtNcdTAwMTPAOcl3XG6ykdrdulx1MDAxZOw7NSdcdTAwMTFqhFx1MDAxNYc1xOMzTVx1MDAxY2rrdi2YaG1cdFx1MDAxZGBU3LVXXGJ7yV9+NKmgWLXCkmNz0WDValx1MDAwZrLeWuH7sV9wXHUwMDE2NHGgtUO3iGn2PiV0o1x1MDAxZFxuntaZMdmqNdNcdTAwMDCAkf/hhrg1XCL8ksqWVlx1MDAxY+1T5tm6v3zlmXve6yWXXHUwMDBiXG6plZnx0IWJQnBr3f2FJtyfnyG/scRA1ajtylxcL4iLtlx1MDAxMpBcdTAwMTJbWlbGj1xyc1xc6b41YYAuXHUwMDA0bWuWtrimXHUwMDEx2/LJNSY8Z1xijD5EV1x1MDAxN1x1MDAwN+dcdTAwMWR8l1JcdTAwMTBcdTAwMTP0mUdxvTMhxFxuSOWVvlx1MDAxOIRfLDVcdTAwMDe5nNEnf+l4XGJOwuvnXCKkwbo5xunJ1P9cdTAwMDWrurZIeKDsj3A8N25Zn59x1Vu3XHUwMDA111x1MDAxODJcYthcdTAwMTYkx7TD/rvXXCJN3Hfnv1x1MDAxZvm6XHUwMDFj6c9AXHUwMDE0U3RZalxmcpWwsyeNWZ+1gMGIweqdg+VC265JXHUwMDAwu+lzIFx1MDAxM3niXHUwMDAzr0QgrVxyXHUwMDAyN0i8XHUwMDA1XHRcXPilysf3fl/XR1x1MDAwM+2R47lcdTAwMWGpPsxcdTAwMDeu1e9cdTAwMWJ/23hLP6YgXG5cdTAwMDeUaXTxu+qs4Vx1MDAxM/iHnT+PXHUwMDAyI61iW0I9Mu+cI2OQVfD513vAmezFsOSfXlx1MDAwZmB118PNXHUwMDE2mFx1MDAwNFxmP6ddXHUwMDAwXUagO1x1MDAxNqNfz59Yzf/W8Y1cdTAwMThPXHUwMDA088JNtv/xvVx1MDAxOE82RlxmQ13ci4blVohyYFx1MDAxN5PVhf95XHUwMDFmxWDevy5976lcdTAwMTDkPbD+bFx1MDAxN1VUnFx1MDAwNtJcdTAwMTOxXHUwMDFh2UzURZSm5uOTjjtTv49mcFx1MDAxMS0mXHUwMDFkvSzZcXxVXHUwMDAwZ3nVjd1al0DKoy2dQV/vbqGd/J/nlv2pc5b0KEFpXXXX2pHtXHUwMDBiweZ8KdN3+rnWXHUwMDA1TzZ6hES6ui1sKdTj47b87M/3XHUwMDE1XFxJNsVyyVx1MDAxNOBrKi0+MNZETcVccuV7Y5TCg6D6nE1cdTAwMTXLXHUwMDBmebyhWEU8roj3p/etXHUwMDBmfsWOpSSTua3wPu7GTc3qrlx1MDAwYu6uu/u9XFxcdTAwMWONxDkrdHJbIEyF37rtxnHGxVx1MDAwMlptmmdcdTAwMDLJgKH6ez1R4z/P+H6da09SXHUwMDE4U3kpezOtJ1x1MDAxNq862GyrXHUwMDEyXHUwMDE2bTiZZlGnyMPZvIvTKj+181x1MDAxMsHh/rev4lpWyjdcdTAwMGJHZCM9nLRgnpJwQCBjXHUwMDFleOxcdTAwMDVQqVx1MDAxNagu1Fxm8PAgaVnrXHUwMDA3mlx1MDAxYnusnFx1MDAwNuf1XHUwMDFiw1DqUHeaufu4Pp1cYu9CXHUwMDExS5HyTlx1MDAxM93lxFx1MDAxNru02CPwXHUwMDFloSksvojyZ3zBN8CIb5S5lPx/ftW6XHUwMDEy6WvrucftPaBWgPGgXHKjfVx1MDAxOFx1MDAwMbbBN3c/P66IILzufFdeOHc/aIib3l9cdTAwMWRcdTAwMTS781+RRGIzqGlw9GKeZ3X7fSOceULjsV6o77lDd+hlx4t+qcC+Ld+5U8xcdTAwMWW/7Ni9K7OFKD928jBb5Vx1MDAxZdO+XHUwMDE3hrhcdTAwMTjndYOJNTpcdTAwMWKKwNFTb3nLXHUwMDE1k2x6X5s3zZ5cdTAwMGIlWLRdRXdNV//nmy9cbuXHXHUwMDFmjTi5jd2ZR1x1MDAwN39h7MrV/nKNXWLTXGJcdTAwMTmova5/eeFPM8uvn4q1bj9VXHUwMDE3u7xJcqCOczXGXGZVp2/AXHUwMDE3x8hXwL1SJ31pbE9cdTAwMGXfY26w8lx1MDAxMlx1MDAxYj/7iW6LNXqvS1wi66rqWrnp3vo5XHUwMDAytEhQePFcIu5cdTAwMDJyvvL0JWeDzG9cYjqXXHUwMDFkXHUwMDFhXHUwMDFjNflyq84h0UAtnj1P+sFK64j/wSlMSv5EXHUwMDEzc0lkXHUwMDFiXHUwMDEyZXOYXHUwMDA2yMxBcETy+G3tgKKZs09cbiRwgOqP/5/79f9cdTAwMWb1vlx0d/x2d74oZGTWXHUwMDA3+OCxJTdcbih/tq/l/Vx1MDAwNTNmaHG1Kr7tS1x1MDAxMratZWsp3XdrXGLtS5+WIVx1MDAxZq/V+XXFV+UwrWKvLMcmO1x1MDAwNZdcdTAwMGWm4ESmjER/ZLokq3nJ5lx1MDAwNvZcdTAwMWNcdTAwMWJIoV42PG0ki6XQhVx1MDAxNa47/PkrfmuDXHUwMDFk+fbsXHKKgGN3lObcOlx1MDAwMSsh/zhcdTAwMDLQzjyEr/Qji3pvXGLufIbiVJBwY3nNm3fcQifAXHUwMDEwkfNcdTAwMDGsXHUwMDFmXHUwMDE4hlx1MDAxN85cdTAwMWK5J1x1MDAxMIRVSH7ua6c8Y6cu+FL8R8U87Z9cXDxcbrNMJXi9KCNe22omqUQmWEWPTFKjqtbfLiWSfUA5WqHyjEpNnPvh5Ul45HpTXGK/eHzXXHUwMDA1apGa777SMLDmcbDATkj6uFpcdTAwMTe9SqJcdTAwMTRcdTAwMDIuWVx1MDAxN/P27bVKLfnmUO9exLuffjzne3Mor1x1MDAwML5cdLpm2DdcdTAwMDVIXHUwMDBixIl9NVx1MDAxN3iTK3mXedhcdFx1MDAxOVx1MDAwN87UcHvfupVlXHUwMDFmkEcgfUXPOv1+QDMn8LxCr1x1MDAwN21DJezALJGWdqe8cLOTx/nLXHUwMDE3gD8ubymNaK9sfDVbt3qLi4tfZdpLyMjHP+zj65RsMpvUNFx1MDAxNqanUKlcdTAwMWVEbzyZwfUr7Ju705Hy157k37ZNfu6zwFx1MDAwNlxcrVx1MDAxZL+6m78wxjMgXHUwMDE4XCJ2muTeqLU+ulx1MDAwMMydtX9cdTAwMTm58IKzIdOKsGngXHUwMDAwMllq9TWZxquLjtmsYV1qrofJU1x1MDAxNSfUXHUwMDE2SEG4NFx1MDAxYUsslXhxWP9cZsylJsY38lFUg/OTRKEmdn3Uc9Qzo2lD7MzbWnRcdTAwMDHe5lx1MDAwN/W/XHUwMDFlXHUwMDAxXHUwMDExYiV+V/rvU2Hl2TPobjW8OVeuXHUwMDExcWFcXNu65qptYGdcdTAwMTJOUpfUI3+4bF1XdyOyXFxcXDu6z31PeXZcdTAwMDDAMeBcdTAwMTmXWZk+XHUwMDBiz2lcdTAwMTOglJlcYk9cXFxu4d9ZUlx1MDAwN15cdTAwMDW/2WDLOmWQ6jq9vpRcdTAwMWVLXHUwMDFkyMJcdTAwMWHt038+XHUwMDBlJTn1xO9cdTAwMTc8h59tcdaxXVYlxeGN/M/HVkPdXHUwMDFkSHko4C2Nj4s6W5eiN1xmZkRcdLh/KK9cdTAwMDVkPPj1NljyilVcdTAwMWN5YVx1MDAwMUe/YKn404PU7eFcZi5cXFJcdTAwMTFcdTAwMThIXHUwMDEzhr7+vvayMqubWsqmXCKZUUurttdcdTAwMDaXkvI8p4hcdTAwMDTX/fb0LMKzNDywJtt9la6aXHUwMDA0Y88vWVx1MDAxYfGoo4OK8mJPJlx0NvJwIGxvXHUwMDE53r6FSzJ8RSZtvFxibrkhJ1x1MDAxOJn4w6r/d3ZNs1x1MDAxMcXlXHRaZX/3rMGV1sF5kqebeN8rcU4oO1xcXHUwMDFh8lximcmOmO3WcPy5sdVvrkT46fEhUUhs8rY4xZP9+DjBRJMvXHUwMDE06Vx1MDAxYktrU1Gm23Rq8y/PzHI3M7/2j65b3p+J7Y1ldk6DPlx1MDAxYs94NFx0XHUwMDE0XHUwMDEyWPf+ZKtzqlNB5GpcdTAwMDCbkOpvx6IvjcqlwJpcdTAwMWTaXHUwMDEw3I3nnNRCUqiI0/FcdTAwMTbWx6bAzvZX1+dcdTAwMGJa+5pNrUPutVx1MDAxZCb3fSk+cpu6XHSwXHUwMDA1XHUwMDExzq5tnlOqaPVcIqnvr2X+vV+CXHUwMDAx7nHkVjtifCxcXECLvoRcdTAwMTNcdTAwMWGZXrRcdTAwMWHkfVqY/DHiuSBcdTAwMWaiyNBUzdydPHipXHUwMDEz6nvbPYaWNIRHKHNcZjtcdTAwMTOt5ExcdTAwMWQ/kUOhsmIyXHUwMDA26z5k8Fx1MDAxMrbzefAqJYJcdTAwMTG3pGkhmez4rWjkg3MhNSZn0iFcIpST74utIH9+i8i2LpCbQ0FsqcW0XHKhq1x1MDAxY21/ou1zUZlcdTAwMTDXoKpaqOKkY5MnY6F5ZDggzl/0QqBcdTAwMTmdXHUwMDA2Slxunf0/LU9fUb+nvadob1u5vbRcdTAwMTRcdTAwMDfmJunWXHUwMDE1XHUwMDAx36j8RDC8/IydXHUwMDExfoyu0tIlKUTK4JONXHUwMDFj+lx1MDAxNFxiRvua8adXuO/uI6Aj96Y5gGhoibEwqlx1MDAwNbqHuVxuUFwifrOTk0GmLXn29YbLOPU0WopY5eJKTsuIWqQvdUmie6i17j9cZlx1MDAxZm4v922bmVx1MDAxMy5cdTAwMDCENW9fIK5pXHUwMDBlnscxSjxXcukvzoHfedH6N29cdTAwMWPhKt3f33tcdTAwMTcho3xfgFx1MDAxYu+CJVx1MDAwM8p4WFx1MDAxMFxuOKpSsPFcdTAwMDOruO12yFNcdTAwMWSM9lx1MDAwMopxaVxy61x1MDAxNfXQm0vYse+zSNdcdTAwMTWYXHUwMDAyzYvzpVx1MDAxN3Tf/WT7vm1cdPb9alx1MDAxNy+kXHUwMDEzI0KLcryxO6bQwCAv7NZcdTAwMWZcIppJivh/cySc+OMhmUk/Wvr3K1x1MDAwNTlcdTAwMDZfuFx1MDAxY1x1MDAwYlx1MDAxMvCJZVx1MDAwMTtcdTAwMGVcdTAwMTKCrExUXHUwMDA2P/xcXFx1MDAxZNSEuuKWaajmza06durwZ4s97bySX3n2UXxl3aiSIcVcdTAwMGZ8bueJsHVXU2S1XHUwMDBmk0BdIOP+rFx1MDAwNeytTcO0K/t+cFlcdHzGi2tF6svc4JQs4Sn4Xjp37Dc48DzmaGrGt9pXm0qf65hcdTAwMDT/+V8uQkpDo2xcdTAwMWXhSm/N2m5IkrtC9eqMhSSg9UhcdTAwMDKD5tjXYMLI98ZccseBXHSB2u68zvfWglx1MDAxNVLAt/5OXGIwo6opTyrDXHUwMDFi101kXHUwMDE0lVx1MDAxNCVDpr34XHUwMDAy6sTcvqknoDtvIZyMMl9cdOVcdTAwMDYlmS3F7CZde1mBUubPXCKZd0aG6Z7rdH6B5cmqyIGGSciaXHUwMDFk85uD7yCo/rPzsVx1MDAxMlx0XHUwMDE3rli7fPuFSTxcdTAwMDfTgVh2xnmGYOhngFx1MDAwMZI/+oku7pq/o1K6+lt3tCRus0aTR1wipp42LtdcdTAwMTGsw31cdTAwMWR6+C2+XHUwMDA3XHUwMDFiQ07maHTqXHUwMDAwnVx1MDAxNc2Xr1x1MDAxNz5SUWd6w8vx1ndstlx1MDAxM/re+FK5NJG95scncZueiVlcXJydw5hcdTAwMDa5gIo/vjFZNXtcdTAwMDLRfCiUTKjkX45b3Fgpcrt6KeCdkJ4xYj2FXHUwMDEzt0dcdTAwMDfEXHUwMDE451x1MDAxZFpsM1bbI1KhXFyzJY2M7njkwXqmu/d+v1/lSPKEsZyIZy6YUdFcciiEKYowPkGwtFxc0Fx1MDAwM77jzkUt4jlcZkRw+vZEa41lXHUwMDA1d1wijt6veNTMXHUwMDA1RSW+2Vx1MDAxZjmfNN2kRSTpsFx0RNt6uWHmPKJ1Olx1MDAwN1x1MDAwZfyS+VeV4izP5GFhXHUwMDE5g9d2nnQ6wn9cdTAwMWVEQaTtWolvXHUwMDFmXCJcdTAwMTh44FGtRvdqOuVcdJpCqDlHj1x1MDAwYn+5XHUwMDA102Qy2/hcdTAwMTLaz1x1MDAxY5S+Szt60eViRF3k9om8tsdcdTAwMDOm886hVM1cdTAwMTUs0KXqXCKRJFEjSVx1MDAxNVx1MDAwZlxyjtbOj+h/ttqF7G8tap1rej3eQFx1MDAwNO9YMlx1MDAxYVx0kUDsn9ele4Kz9CNg9sK53YX7zlx1MDAxNd8+hG/MXHUwMDAzxYfI5s9f/8WHpkKKNufiyag8XHKPXHUwMDE3K6n2w0DRKH9tMX/fn9DSXHUwMDFjXHUwMDBmxb+95CnwQpLyp0fBjlxmVo34t9zwNpxcdTAwMTgmXHUwMDAxwYJEn+TdXHUwMDA0LVx1MDAxZktWK03Fc5FcdTAwMTBDXGLN1tfRU3lcdTAwMTHaVcdvXHUwMDBiKJUoI7ojXHUwMDBim3+1I0nl98XrID9x2XkwlFx1MDAwMuB8XHUwMDE5TulcdIZcdTAwMGKNvShxXHUwMDFik6+4bFx1MDAxNstUMPZ/gUamJdot31x1MDAwNdRHh5AzmbG8lzye+lxyZKYhz9OYqDhcdTAwMDGM4kWxXHUwMDEyuKhr7ubVlNRZ3c99XHUwMDEwkNKzXlOSMVZcdTAwMTBY/8HCifWMV/JcdTAwMTB5PrhvpVdcdTAwMTFcIiaO1qpcdTAwMDZOXHUwMDAwmjffY3r9XHUwMDAxPpHkO6TDl1x1MDAwNrLvntnNXHUwMDEwW4cshcSm0Uu4x1x1MDAwMNHgTFx1MDAxM1xyVFx1MDAxOS19cMmjas9KUCHC20pcdTAwMTL/npuCyVKGpVBYVYWGid3FU7VcdTAwMDEyQ7El4oyL7sxcbn5cdTAwMDF14e5vXHUwMDE2XHUwMDAzMyDptl/on1x1MDAwNZMkvmdd7to9xKuQhKdQt4NwzS7JxltDgSE+ZFBcdTAwMTlcZi+QbXud10RcdTAwMDDuJduD3nt0cIR3MZSBzYLnXHUwMDA3cWXosSuKlpTfXHUwMDBij7C7WXcohHCV1PBcZtP32n+tv3pcdTAwMDNEXHUwMDE23OCdpMpcIu1iVPtcdTAwMDM6ziSdj/Xp8afSmePJgEJL/85tWzx58ydcdTAwMWYpL0H7efAzpTtxMMBPv1ghXHUwMDFjXHUwMDEwNlx060/ymu1MhVx1MDAxMGWzQ1x1MDAxNiZcdTAwMDdOiiiw9MRGXHUwMDE5KFx1MDAxMa1cZlNV31x1MDAxY1x1MDAxNVWDL3DX1KAsUe4zrUiZgopha1x1MDAwZYlmzVx1MDAxZVx1MDAxYi9cdTAwMTM5tJuGaNPQu+r0PoPmX55IN9kroJJwbeHcXHUwMDBihblcdTAwMDTYY+eEWOw8ToG86PY3xaOyXHUwMDAxvr+1he9SXHUwMDE2030+7Z3qJ3PvJXAuQDFD7z6isVx1MDAwZra0T1x1MDAxZZ5Iblx1MDAwZjKlw1xufe7icElcdTAwMGaOl77sQ39ccq65zj/Y0+rWITBvXHUwMDA1pVx1MDAxOFpvPzNcdTAwMDJL6pA/vs2ib7HNxFR9ZvxS9ZRmg//dwXPfn7TTZi1FmiMt0t3kvlx1MDAxOFx1MDAxN2WHXHKqclx1MDAwMYxtvoToXHJ4z9faXHUwMDA1lFxy7VrsXctcdTAwMTRcdTAwMDdmKou/O3tcYoom51HS1+rFoOmnRImsjGPLh6LSx7vO4S9cdTAwMWO0WElcdTAwMTNcdTAwMDcy5IhKY77ym6Uwfu7Kt3DRTkxn07FWt12zdPNcdTAwMDXSXHUwMDE5hD0/llx1MDAxMpFtwF94+b7wkmdcdTAwMTJnaTiDbVD/v15AXmxF/UHxfOh9tC1cdTAwMDKSPd1cdTAwMDFcdTAwMWHuXHUwMDBmYlx1MDAxN2FcdTAwMTJO1d3ZkuUh3FxcX4ripECDm+Pgplx1MDAxNVksOVx1MDAxZe+TzIdcdTAwMTRgOe3ZitN7fG6JykPilkA8i1x1MDAxMTTvUVx1MDAwNVmOXHUwMDBirMzrXHUwMDE5ILjldUVcdTAwMWRcdTAwMTdaXHUwMDAxx1m5XHUwMDE0T7pkXHTxe4iWYuUrzMLSZ5exiMGLMVx1MDAxYfFFI/ds/77csktDQ7rtXHUwMDFkbqb+v3ulJ1x1MDAwYsmGS8Y2lcC5YsjaXHUwMDAwNHpNXHUwMDAx9anfI8lUufP8/NRcdTAwMDeK26/LwP1U/4agr/gm6a28Tr1WYKBcblRFnXf99JBPVIzZhKrVXHUwMDFkXHUwMDFmW7/EtbNmZ1x1MDAwNtpcdTAwMGZV4JSg4nNWXHUwMDFifN57ocXnja+UrHVf+bVcdTAwMTBNnZDd7KOE5eN0grLKJVx1MDAxYjf1Qk+Fd2SZd1x1MDAwMGCkjn/zrlx1MDAwZrf4j7ROTIfmg1x1MDAxMHyDXHUwMDAwSOdMOaMjXHUwMDFi3YdU9aBKrDAhiSBbfZU0ur6xs31aXHUwMDFm3d5u7HRZuDzI7FFzy/54XHUwMDA1aFx1MDAwMKpsPPHYI5TKkEYo2V7Vu1x1MDAxZrVhtc7nVVjP+ffAXHUwMDFiVql2JkM08yl1XHUwMDBleZo1YYKJg1x1MDAxZbqaXHUwMDEydVx1MDAwZbI2OPaFvp1NXHUwMDBmI1x1MDAxMmzip1x1MDAxMJuy2m6S+OhNfeHGsPrTtj1Xi7a60K3jUU9BwZNcdTAwMTQpXHUwMDE3w1x1MDAxNyZcdTAwMDIub9/lhG/7jrDuzbPssJb2v/tcdTAwMTbMzY7eLD0y5vtt9fxcdTAwMTXikVaDziysYm/MvnRcdTAwMWS71Fx1MDAxMYuxb6Cz6TKOXHUwMDEwXHUwMDAw7O238UlcdTAwMDVcdTAwMDWt7KhcdTAwMTmeV7y8nD2ZXHUwMDBlWXnEweNcdTAwMTicJ0ZcZoK5dlx1MDAxYrHzV7SPgMcrYrqNXHST/i3nu7Wtt/blL+37NfXuXG7e2KbE/GeXXHUwMDA0+49cdTAwMDO4wlY1mkSu5cp/IVx1MDAxMNxHXGbDeGOvNn98kpCsWOKHtGSxvO8zoc1LxdU/+VOL/Vx1MDAxNLTpQ7XamoDO3dclSfDjUFN7jVx1MDAwM3pEfMmxjeszmvlhU0V5915cdCGfWdoghIHkM2aNXHUwMDA3upeXVFFC33tcdTAwMDFgXHUwMDE5+ubF4bs8r/lGI9/omWKJuMvveYJVYahcdTAwMDJd9KqLZ1x1MDAxNs7JYor4v3tCbPtdkM+YnconPXIokIH1M0uSj54u/vSxXHUwMDA1tk2VKXqbd76Nblx1MDAxM01cZi9cdTAwMWXnmFxiaUdcdTAwMGVLrbVcbuYg/ihbZdRcdTAwMTSMXHUwMDAzXHUwMDFhs75rXHUwMDA0XHSiL8GGzrTIyMhA8NZ4mJr+1Fx1MDAwMMRePlx1MDAxNcNcdTAwMTU+6KslXHUwMDE3vsretfpx51lcdTAwMGZcdTAwMTaJzvUhz9s96sLVXHUwMDA0XHUwMDBiO42EvjBcdTAwMTDxQlx1MDAxNE7Mn4fl+lx1MDAxYUSenGko4N+e/TohPJ1aa9HBqb94mNy2/Fx1MDAxY422KmaqXHUwMDFh1b9cdTAwMWWhSlc/27X3XHUwMDA0V9Iknlx1MDAxNOaRJcGqbKP0g38zw1x1MDAwNHB5U1x1MDAwZnR5XHUwMDAwXHUwMDBmrNxPhDZNP1xiXHUwMDA3k27iz7DZWaFrotRpSLK+ledcdTAwMWHd9yfdvWjjgYKeRE/4Qc1lXHUwMDExvuEmIN+F0Fx1MDAwYqSmdkVYJz3lpjt6YU+aT//uxeG+4iV5PYrda73nuPwsXHUwMDA0XHUwMDAy31ChXHUwMDA1wDXFtPJcdTAwMWKx8ZdvNpnj735XvZFcdTAwMTNM3P56+Vx1MDAxOVNcIpXosJRcdTAwMDCNTFVbVyo+qeFlckFM1NundJ+eXHUwMDEwVEXn08rwJVx1MDAwYjHAiPL23WRAX5nqa7Na87tuXHUwMDA14tSQJJiW0yS7e2JT/Tik0dRmIUHYaszJtJjyvWvbhIb/1VhPly48Ko1EbSp3aWwqvFxuXHUwMDA3XHUwMDFjZF/jnJFcdTAwMTFcdL+5dK2kPl+HL8UkKUk2N3ekXHUwMDFmk8H+eZ1u21pgQlwigj9cdTAwMTevd7r9e9FcdIu4ts/e0lx1MDAwMuXq/TOyfjxcZlxyJYuEPiuHilxcXFyqXHUwMDBivl6/X9jUjd1cdTAwMTPRXHUwMDFhif7usyV/XHUwMDFl7J1cdTAwMGJ/boj6LIZcdTAwMWV7XHUwMDA2R7+5Z5+ogEh8sn+6XHUwMDFhuXS175Jts1x1MDAwYsRjXFyP9Km1r4k9kbF9Ut/6aXkhMzx3lPfR6Y6VXHUwMDAx7mufn7zD/a5cbnHgXGLyK6M0qVx1MDAwMC+MXHJBXHUwMDA0bI/Jz+vmI26cXHUwMDE4eu4wQqJqXHUwMDEwk9vitGi/5/WiKaCbw4T7PmNcdTAwMDX9aOTBRoubb6vlQGP4zUnh+mOdJlx1MDAwNlx1MDAxZXzzklx1MDAxY+L9vdZcdTAwMDR+u5dwV6hcYkDpmOkxXHUwMDExlFx1MDAxMbiLXHUwMDA04Zjm3WNJXHUwMDE4gS36i4nJKTqer5J4Zf7lXG41l/10Xlna9SG8ZZxY7UtcdTAwMDO+sc5cdTAwMWOKTYV55WuhMXlklC5Wolx1MDAxMuHo/Fx1MDAxMCxufTojOWNF8lx1MDAxNp5p9vnXjzwyaGhcdTAwMGbNXHUwMDE4XHUwMDFhXGIoumFcdTAwMGIo51x1MDAxM4NCI5lAXHUwMDFh19xcdTAwMTktdlx1MDAxY6lcdTAwMTXjy7LkNCq6LPm9++vjvTXg/lx1MDAxNqtV4lx1MDAxZrWYtJJrddP1b1x1MDAxNSSg+Fx1MDAwN1xuLZikMFM7W9FeiEkjXHUwMDAxT23AR0h8SUh6JFx1MDAxMfvMtMlcdTAwMTNV2FJ4j62nYc95dOP/3Tta12VApfdrqZ4wLKZ7QohcdTAwMTTwyjhcdTAwMDDP1Dx/ZjhifyNcdTAwMGVgabuh2Z0pZbH5yYVcdTAwMWWvzPmnlYOiMqXI9lx1MDAwMsU/98J7ni1wplx1MDAxZiyVwFwi5CzeZL9cItJcdTAwMGJXPHRNVVx1MDAwNmTIbHvHXHUwMDE3XHUwMDEw+465R+Wfra5cbvB7vkJSbV+TXGI6+CR15rrAhFaaXHUwMDEzXHUwMDEzy7jAJm+j5s+e87Dv3IWPuNA7uyDh01x1MDAwZt37KnxGtXh9d1x1MDAxMKecTI6io1x1MDAwM6m6OvjzMFAyOcrBXHUwMDEyNrNcdTAwMDZ5JS6GOKaOQ2bQXHRFXHUwMDFjli7WL+PXs2z1XCLTwn86jqIksX1R8NFiU66TOqBcdTAwMWRZQvBnSo4qw1x1MDAwM6OdMXRQXHUwMDE379GzXHUwMDBliL3GlHqmxlrQzblNcovENEpcdTAwMThcdTAwMGJcdTAwMGVLI1xiOuQ6Oos3tluTXHUwMDE2uY89XHUwMDFjXHUwMDBmP9rDVfLJmizX70Et6qa6mkEl1U/Z0bD5XHUwMDAzZlFusFx1MDAxOEz4L91cXClhX2w8qUj7P185WYqRK1xcXHUwMDEwiI7CXHUwMDEzwPGHo1x1MDAxYa78RjhaqFx1MDAxMYa57/Tb7rtiXHUwMDFkx6fM37WuWSqiXHUwMDE0+4tGO4DF+bZbLfaqjHy1wrGBIVXE9YPfmuRNXHUwMDFlXHUwMDAzX7Ap/Vx1MDAxOIT+1lx1MDAxM+pjv/NCXHUwMDEzr6/v9VXGXHUwMDFjsVx1MDAwMChpL1fUNlx1MDAxM/DJKFx1MDAwZvkwXHUwMDA3g3lcdTAwMWPZM9ueXG523/2Uq/s6XHUwMDE51CVcdTAwMTHcaEei8MPX78XYXHUwMDEzIFx1MDAwYipcdTAwMDI6m457gHPKXGaHXHQk8a7tb2+NXHUwMDEz59SV0fBW/P9Zw4iswumAqFjDTfDS9V18glxiS1x1MDAxZlx1MDAxMYjFWFdWoYR1LtRcboXE0DZJutB7c38w7fpZ0itsXGI/VlDowJxFpnUlK2KNtFx1MDAwMD9b6vuqrzPOXHUwMDE00lx1MDAxNjIp91x1MDAxZSHoXHUwMDAzLu1HlaGXhNnNTG70xPO6iJuBXHUwMDA1hZyIKlx1MDAxMlx1MDAwNazK++7Dpbxwd0xfLLlowJ8xZX3Cle89SnvtXHUwMDFkMr0mRTlBo0v5jpmzdXTASDirRV72cPKeXCLPUK7off6vbrF3zpScup66mileXHUwMDFl+Fx1MDAxYbEzXHUwMDA0XHUwMDE06dhcdEh7IP7H6acj5ezjxTOEzZFkXHUwMDAyNb/6ULzHXHSRMVTiYPeyNoRcblx1MDAxMlx1MDAxOPG4hKykTbO1gHUy+tqvJUVcdTAwMDem2UA8NsrvVIaa3s/toZ7JR8gqmJ2PPVpLilx1MDAxNDXcXFxDwVx1MDAxN4mTyHlcdTAwMDBHxFx1MDAwNfg0fqZcdTAwMWH2XHUwMDFlwkLyl+jMfFx1MDAwMFx1MDAxNITnSNQx6Fx1MDAxNTP/KOg667f/5fxjUy8yMTXRQJowmOSAIC+JXHUwMDBlXHUwMDAzk+/7RDfl6XzHgjZcdTAwMWV3L1x1MDAxM5ZcdTAwMDCi4v7iSlpIXHUwMDEyNzPfXHUwMDAysas9QFCcNVVCQtxTLk5HXHUwMDFkL66YSMqjyMmxb2dcdTAwMDazOGHRXHUwMDE0geBD+Gx4onur04t8bKBcdTAwMTlcblx1MDAwNfvIRFx1MDAwNVx1MDAxZVx1MDAxYV/YfV3Iw248gyxHZ9SZqtd3g4d3Uc+YKbO1dWl1XHUwMDFh8sCMc1x1MDAwMYA780espmu0RFF9dCtcYlx1MDAxZdUuXHUwMDA1Ri+ckyxcdTAwMThcdTAwMWTOvke8q5N2oI2GXHTph8FcIojyz7NsXFz6XHUwMDA3XHUwMDBim4LHy+f2qFx1MDAwZaA5sWZRjVxymZRn5z5DLm++vVx1MDAwNMhsl8NUfSlVs7o9XGJcdTAwMTWlxb/3h9DTXHUwMDE1er49k+OfXHUwMDBlVC88Y01cdTAwMWSwJs1tXHUwMDA1UXlcdTAwMTiwllxu41x1MDAxZVx1MDAxOKRpXHUwMDEzXHUwMDE1XFz2V1x1MDAwMJjvq51cZouA9YtcZlx1MDAxY5PjXHUwMDE1XHUwMDBm0Fx1MDAxMs4mXHUwMDA3ybFcdTAwMDMuxXtcclx1MDAwNbFcdTAwMDR9zcSfUkv0rrfkko4gd3E8fCpcdTAwMWa9XHUwMDEyx1x1MDAxYrHRIGfOo8Ge+nVO0yv+bCphb5xje2Vr1vnu8Gz+j7d8bfn3jjYli/tv3r3zrsaU535cYi2YXHUwMDEyhGE4XHUwMDA0NfBcdTAwMDPESFx1MDAwMVx1MDAxYn1+rt2JXHJcdTAwMDT5zdN1blmzJoWlXHUwMDE21o1SSmFcYlxifNxcdTAwMDA1putnYFxmXHUwMDFm64XVioF2LooovqTRM1xcx9ZL8klq0Fx1MDAwNSjou29SiUIhkWVnNqlcZrhJZ2Q03y79jdCvqti1hjD9XHUwMDE1nDGk5/bttVx1MDAxZDj4TTnRXHQt+dIlXHUwMDFhcGhcZryDZFx1MDAxYUzRS1x1MDAwZlx1MDAxMS+CUn9cdTAwMWJcdTAwMDIt+Ze7lqQvs8iMolZqXHSNlGacyNw8nyOUeSh0rskgXFxcXL29/VfcfD6r5nvH5JLSxLanYOOzz8Ta7oCOSm+Y20Dv2vDmSr/k0KHfhMjQuExWfauJ4/heikotujl6K1x1MDAwNFx0Ju8hR1KGJywnpHksmWfhYdZvoFx1MDAwN1CjXHUwMDAx3LlcdTAwMWLjZlx1MDAwMZPniTSdaS7ULpRx60G97Fx1MDAwZVxyc1x1MDAwMNGjOzFlbX31g1x1MDAxYiF6XHUwMDFkNMHzXHUwMDFh2SyTp3eKRruqaYRO6VhcdTAwMGJcdTAwMDZUo8GTSslk80+N+tfzdilcdTAwMWQprmsyjpaWx/FUmoBcdTAwMTefn7j9XHUwMDE5iP+PqfNYdFNp2vVcdTAwMDUxIKchOefMjCxAZFx1MDAwNIKrP8j2/v7jme21XHUwMDE0uis8b9NVVWG/u1x1MDAxNJW3VarJLn/PjlHJ+pXlK2IgXGKt18h5T+FZPSbdMcqKz1x1MDAxZTv60lx1MDAxZFlcdFx1MDAxY0T0nFRl3oKzsKma+8NHPt+Z202ZN8pYWOdV1Fx1MDAxOUw1c/DlvcBiJt86U1x1MDAxYlx1MDAwMXiM10cvSS6JSut3i6R91ftcdTAwMTBcdTAwMTl0YVNcdTAwMTS94YnZY+sh4j2fjqBcdTAwMGJcdTAwMWX8mJMu+Z7gUVx1MDAxZL1cdTAwMDT//3pcdJvsI9nDuNX2TyRUm1xmtv5hVVx1MDAwNmPLdrddIakmPr7ltVxuyVxm9otFT3xcdTAwMTFVXHUwMDFj5n+PUz2eYGfmNalpL1N1dNvTPFx1MDAwZjBg+1YtJ0a2I8H0XHUwMDA0PIbxXHUwMDAyl1xyXHUwMDE5ZFx1MDAxOTbQqFx1MDAwNVx1MDAxMpCGX2yxnbdcdTAwMWW5X0BEXHUwMDE2Q1N1zjO7Vlx1MDAwYiFpNrjiXHUwMDEy9Cl7K7hHfz/G2G1bTeNcdTAwMWa/efhHobLGXHUwMDFi8ITZe0spk894UfUxMlx1MDAxMjqiX9xl3ib4jXbb6vBEjkFuXHUwMDAzdsvcXHRxXHUwMDAw2OIyrsPXXHUwMDAwXHUwMDE1Vb7Q/9W2aM6/e3hcdTAwMWR7LaC8jZL5va4h/lhm7yXEMMrMXHUwMDEzPZQ//U/4f+d+v54knNSNXGYtg/Exz7m9qlx1MDAwM8lcdTAwMTOrXHUwMDA3vXwzh3yLbZPg9Vx1MDAxNVx1MDAwZc5vRlmamqly5YC+Y1HUXHUwMDE2ee2Zd1x1MDAxOXg8yVm0t1xuj69KJWp9lF9dkTXMXHUwMDAyTSuWXHUwMDE4XHUwMDAxdHqyfFq+t62qwphcdTAwMWXNeFR4sVx1MDAwNTfGtSFcdTAwMTGx3lx1MDAwN0p9kNMp0aNcdGm7PDiRT1x1MDAxZFTnXCL2/O9Z+Vx1MDAwMMmNXHUwMDE49r2pMPT7I0lcdTAwMDD4XHUwMDA0Klx1MDAxYVx1MDAwMJk6oYI2TJWOOOpcdTAwMDZcdTAwMWVsXcgq8Vx1MDAxN4yiIdOKvzV3QVx1MDAxMyR6ZlU8JMkxmfjFi/2c5Vx1MDAxZfSp+WjtMvU8nOPX4MtcdTAwMDR0XHUwMDFlXHTI0Lmy1zPdwohmysZ3LDUsJPUlV8VpXGZcdTAwMWFJXHUwMDAz6Vx1MDAxYrzR02HrxEGAQTD+7oPzhlx1MDAwMd3Wl8TmIe9IXHUwMDFlKI1cdTAwMDMmXHUwMDE3XHUwMDBifpvXtC9z+Fx1MDAxZFxytvpcdTAwMTKglef1k3C3+KDTxOA4Q+5l34drjm7Q/zihb569VFPh2CFHg1x1MDAwYlBcdTAwMDEooLiX6lx1MDAwMJ5cXFRcdTAwMTLi2/K+xp38eu1cdTAwMGbS//HsNCssMlx1MDAxYjJcdTAwMDBcdTAwMDNcdTAwMDRcdTAwMGKl1uc8XHUwMDE2+HfsdLdJ9oeBxZOrXHUwMDA37Xx0Z6Zmkvx6LWknXHUwMDExiC81x1Zhj32avTNcdTAwMWWQXHJ+obCiU2UvP4N1xLaUXHUwMDAzWL7w7JuoQEJ7oCGMfFx1MDAxZoq3y0JnXHUwMDA0QqVcdTAwMGWgXGJxgUqU8lx1MDAxOWDTXHLhijDkgdnTOf477+lZhstegORcdTAwMWKPln2fM4h25JR3+8c6ista4Vx0ZTl2w85o/vVcdTAwMGX2dP1krN89XHUwMDE55cmYUvtsgcPDI1x1MDAwNtPr3ufJVZbNQcCS+0qvT9mvL1F6QImjY1x1MDAxN1WcOlx0+ei/XFySnHlzTTlMUWcnS49cYvzs7YhiXGadPVx1MDAxY1x1MDAxNHlXrtpKaZg4XHUwMDA2XHUwMDBl+oqkT17cNTFDLOCRd/iE5Fr5QpKiiMXLytFzY1x0XHRLcFrF/GKRbuv/u8vBJHJbkVx1MDAwZVx1MDAwNPlY9p0+doz4dVkv38hOXHUwMDE3n7pcdTAwMGYogJif/Vxuvzpi1jXF/m8/XHUwMDFj2VG/XHUwMDFj0ryZ15fcSjB0XHUwMDEx2Xjztlx1MDAwMyM2c2ntXHUwMDEzaCy8LJPSJWbxXHUwMDE0KCNcdTAwMWKjpYZ1P1x1MDAxNVRy2O9XLPtO+PVwxZ9yKCicqTrhceZSSMfaz9vlkDNSfCFLXHUwMDEwN5ZcdTAwMTaMKlJcdTAwMWa+oDD4XHUwMDFjQlx1MDAxZVxmo3N/1lxcl5ayqpeszPzNeNVcdTAwMDHiXG5cdFx1MDAxM6wo+L8+mY99hU/4N5tEomZEinT00uLxiOK9OzPk2DhX1q7HLl/Nzcau7vPGn3O+nk+4wpkn1UlcdTAwMGIgvkPCbW467Fx1MDAxZTlcdTAwMWacMIs+hGvO0d1cdTAwMWE7LFxiztbp1fTs3Vx1MDAxM1x1MDAxYrnfmVxcNHNcdTAwMTWWf/aApHA5norX17pcdTAwMTJ4XHUwMDFiXHUwMDEwXHUwMDE5Wt9wXHUwMDAzglJU5/I5dtSIXHUwMDE5x1x1MDAwNpBFKFx1MDAxMTVFeCWyXHUwMDFl8Chx38Fpd1x1MDAwZtSkXHUwMDFiXSid/Nf77E+/Ys3f31pxITTJn9+ibJva+pRcdTAwMTJt0Fx1MDAxMW7hgcz5jvy7p4jPL7mblN/dXHUwMDBllTOc92TCxse2L4SnUblP98NcdTAwMDeJkN7OUEyzzT3lX8+jpmB+qfJcdTAwMTVcdTAwMTaXW4eoK6vlcSVcdTAwMWST2KguSlx1MDAxZolcdTAwMTDRSOnd8SFcdTAwMDBXoZ5cdTAwMTCsabI3kD3y5ONcdTAwMWRsNFx1MDAwMi3iu9A8N9i75SiKVNBk9F324P4oXzBcdTAwMWORXHJcdTAwMTRcdTAwMTNcdTAwMTUgXHUwMDEwLHuPk+4k3//6S8mD6rFvJlBcdTAwMDdXT3RsXHUwMDBmwFGCa6raaubcJMbvSFxuZJqm/tfX+vv91fM8plx1MDAwYitcboOxZOR1+W9WxE1cdTAwMDI1XTVcdTAwMTRcdTAwMDXRhsidXHTbLSTu237eTpbmYJziOW9UXHUwMDEyIKhR5WxgwpWlflxcukLbg2R0YkfGXG5cdTAwMTJmrY5uelx1MDAwMNFXXHUwMDAz39uwJFx1MDAwZb6uxtRRhVF3XHKSVph3Xar0nfCYSO3KnmXCXCJcYv6JNSlcIi2gkyWci8rXqVx1MDAxZP/N0+nFhlx1MDAxM3bt6ivo3KI8dMju+6XtL3B8Ra6eXlYuN5LYLL+6sFx1MDAxOdEyiXN+rL0+cIo2cvaIXHUwMDE5cCeEXHUwMDExXHUwMDAzzPLztVe0nLxSh1x1MDAxOIWOiz918qYrO0YmwHHOXHUwMDEzV1x1MDAwMm3Xs/BcXFxim3lTXHUwMDE11/X4XHUwMDEz/2jeZz+W/KJcdTAwMDJU52/2LSVcdTAwMTWDXHUwMDAzoLDym7hSOK08vkDeL1xis1Hwlqiu05Zvbr5cYilzpDZSLf7/z2dcdTAwMWEjw8dAsreUXHRdXr8xuihf9lx1MDAwZVx1MDAxNkmtTy+ZtHR/MmU+Kf/OzZBcdTAwMTfr8v7NzXhcdTAwMDdcdTAwMDLFkvH3ROpYjlx1MDAwMM6PSSpdaJB8qyauvlx1MDAwN36j01x1MDAxNFx1MDAwM/ueerimsZTLXHUwMDFmNPeV+W6QOS3SUr71WTHmSOJS+Vx1MDAwMrNcdTAwMWZpXHUwMDE5oUJcdTAwMDYkXHUwMDFkuFx1MDAwNaIyWbxcdTAwMWVph/Nzu4Ij8abL5u1cdTAwMDL2/vKOwrd05THS9SNcXCVNXHUwMDE4JVxywujjOWNBssjXS85cdTAwMDfAIDmR7uy/XHUwMDFlVanj9KYmMY6Vdo1aXHUwMDAxgDV/7Ju0UUNfRZGbXHUwMDExR5OqRPlbd+X8r+6KdnXnbqpcYrxvRFx1MDAwMTtcdTAwMDVGcPamXHUwMDE1+6SuZVx1MDAxOPRcdTAwMWZ7NcrAKplXOIF4S2bxVU5annStbfjC6fymL5Ply36BZp2KY7Xj/denqlQjTsulyo7sjmnrrFx1MDAxM3Gym/ojXHUwMDE3aWNrXHUwMDA0mUJwoj5ZfERcdTAwMTW/wl1KeDEx6z+yxD+D/7WGzaSEM4dbd8Rccv3yVIR69vFgvXHwKlg4XG5cIlx1MDAwZfiAv745+KvrMStbj//VrUfQ8714x99cdTAwMDczTkDa5klcdTAwMDBOXHUwMDFmXHUwMDBlOfpgYEd99YZB9l72r1x1MDAwNy71XHUwMDA0XHUwMDFiZ+CJ0o1F7F/981x1MDAwM+B5pZ6qaIp/v9fzLzf0neZcdTAwMWLv51xygkhFiDsnQmX4hZVcdTAwMWbC17xcdTAwMTZcdTAwMGZcIjiSo1x1MDAxMXhV9K6tOP3t4Yss1l1xfN1pQkBemdd/zCF8zUeKbt6Qn2x03VKCl+ZcdTAwMTd8aNSqrFx1MDAxMEDzXHSU2FV5z0X0Un/3psbKT5Poz6yl3btYjckgYNC6S3plgP355IBalitcdTAwMTTb2y48KvM+lyiKxbOobExcdTAwMTBqv1L+1C5OioZsnC+q1d+7uJJhaIRcdTAwMWN+VynKPb7mYjuVUGtcdTAwMDfKxzeev+hxXGJ6olx1MDAwM2pajlx1MDAxN3yqo9ZcdTAwMWL8Tkd5z01XwSU1pKOTpbj17THu333zmcnjdFM4NVbLty3X4FJnxZBN/Vx1MDAwYl1cdTAwMGZcdTAwMWZQh1x1MDAxM1x1MDAxN6wxhWD+b3+P1GtcYuHH04PzXHUwMDEytIwr+SusXHUwMDA3MojtNV9f1SuFm+A+SSW/czez1CxcdTAwMTCY5mVYRlx1MDAxMkR/as2C0GQk/PmwLzFhX+7r6GWRKN814JJxOolcYmPwRjvA24iONzCDWamCaLY68YyaqCcrlc/lqC+/0cFE6e+eh1x1MDAxZjr+1eyi1Zf27MX/v37Yv2cyXHUwMDFh05tZtjz0zld9t5/0s1x1MDAwNVx1MDAxOFx1MDAxMNfHQ4qChngtpFKe9C479ouf52OPfGHY3r/7RHOgupzUmIhcdTAwMDPUYIRCoPhcdTAwMWRcdTAwMTVcdTAwMDBursRo8NGO5b6HeIbj6r1cdTAwMTLEXHUwMDFlk16Q2OfWXHUwMDBiX96zmnvCcjxxMcqMM1x1MDAxMVCSrT+IS9txTZ9tyodccktpuXmZaHBPo69j+Fx1MDAxY8TJji5gMnvRq1xyIFm2WY2W/ztTcVx1MDAxOX0pMME0kEpj6iGr7TtmXHUwMDAx+XV9gf4lkG3IS4PxZ37N6f07L3z0W6BcdTAwMTFcZnpcdTAwMDHu55Cxxda7U7bTPFun9bJcdTAwMTLJv1M2a1x1MDAwM56LJanHoufDL5VcdTAwMDCvcPStTa7ja2X3XHUwMDExcrvgJ4Zo+Yt8XHUwMDAzZIRGf57feSFcdTAwMTjOm71k37Es9/1BXHUwMDFmj/bvPDDtK8R2oKlJIEF41Dtfflx1MDAxN1ZqxmL/11x1MDAwZsqcXHUwMDA0WIXd1yy4SkdNMbpilnFVQLDFnjkhXG5C7lV07dBjJDudUlx1MDAwNfkn5s1KyK2NnFx1MDAwMFx1MDAxNevcI1x1MDAwMOmQZKqDXHUwMDExXHUwMDFmpH2346yIJ8/l4/Ndjv++S+877Fx1MDAxYvO0glx1MDAxMMLBKLhcdTAwMWTYaa+98jzFXGIs8El+XHUwMDA3qnXOi8VcZrNcdTAwMGWyUv+bWzbKYoi4Vd4khY0h0Vx1MDAxN6WAots4/8VqL1x1MDAxOVx1MDAxNVx0VrSUX4Ut82BcdTAwMDQ4U/zhXHUwMDAxXHUwMDEzJ4GZYraGkVx1MDAwNvQ+ZZEk/uZY0JJ44XeXT1x1MDAxN7SX6PDH9Vx0u1x1MDAxYiiBj9ODbGFcdTAwMDU3gVTIaegvwTRcdTAwMWbstVx1MDAwM3g0sb93p8VCeK+oNYpvp93EPNjU82aF/Vx1MDAwM5lcdTAwMTj2XvnVXHUwMDA2Smsv8603aX/5kIM7z4XhkjtcdTAwMDXSUI3RXHUwMDE2XHUwMDE2J1x1MDAxNFx1MDAwNFwiXGI7hPXjXHUwMDFjXHUwMDBi2P3HXHRcdTAwMGWj7X7PclGXXWSWJs+SO+CH0GqfXHUwMDA3p1x1MDAwZVxiVJaAkU8lhW/K9lxcXGZ8tIaXYtX3dza3cydcdTAwMWI78n5Z1Vx1MDAwMYIvXHUwMDFksNpcdTAwMGb15LbUKe5cdTAwMTHeXHUwMDExPpabxZNcdTAwMWEtulcjx1x1MDAxNefJOb5YWCHiuOGdQq0uRjJhmMitXG57Y09xPNi1vVx1MDAxMkTYYZB4fN7QXHUwMDBi7l0mXrbHpYO29taJxFx1MDAwZUjGUVqv7TlcdTAwMGapNfSonLuf3Pj4JVGJ/9WTi4Lw5knXbVx1MDAwNy4zad7NXHUwMDBiILKL2nLFfD5cdTAwMWZWkVx1MDAxNS461N9Qj1xifaRu1Pxq0HuBZlxcSCBcIoQjbnv62uQxTdWcms32zt+pXHUwMDAxQMlls6w+Pu/mj+rfnlx1MDAwM2VcdTAwMDa+q5BQqHgpdVwiMFx1MDAxNVx1MDAwN3XNYXVqyWajJCD9rnFcdTAwMWRDNmnxMeQysrFXPd1cZmih1EjAej1cXDNcdTAwMGXmzdldKGRGI1x1MDAxY1x1MDAxNvb53768WemrIFx1MDAxMFx1MDAwN0hUXo/rXHUwMDExXHUwMDFkXHUwMDFmwHBAXmr2mNJcclHsX7+aa0Z9wF36u5/P71x1MDAxOIqWaVx1MDAxNUJ9XHUwMDBiXHUwMDFidVx1MDAxZlKqN3ZcdTAwMTVcdTAwMGbEcFvKTd962/ie63HCqXy7RP3lSsldX+3n4qLPo2tDx+C/+avtPvhOw53XV6JF2TIw0FWHl+T+XHUwMDAwVu5R/DtcdTAwMWMuKtrGT0Wd42qANNyS6DDCXHUwMDA3e3OzuoKk9X8zlFxcxZEhp09TYX/0OVx1MDAwMS7Vu66posmByoZqNP+ozvh1lGDy2j9zcPzeM/u/ebZ0LUcoXHUwMDE55H6W57WdkE3RnCHmPfKpXHUwMDE5MP3NZ/Q5rvlg2LT86bvxb9bAQqdGZlx1MDAwN28o15hY3c6KLqikg1x1MDAxMPzkqPqgWlx1MDAxMzbVtC6XRtnXxvc3a1wiXHUwMDAyXHUwMDE0tLes7lxmeS3bO1Xtjf3KJ5Bx4r8+SkLfLE0meTKngVJcdTAwMGbWXHUwMDA18/3YwNszaTdCilx1MDAxM1tcdTAwMWXkv0bRdfT6XCJle/vF3dZcdTAwMGJcdTAwMWO3Z0j50oEnKDwqb6U+OaOJk9/g/aWO4SS5jVx1MDAxZXKcb5jQ4+hDKn9cdTAwMDb9yVx1MDAxMFJcdTAwMTGVzMLo1PdcdTAwMDJcdTAwMTT7XHUwMDE1ZMhJYVtcdTAwMDVcdTAwMWNG80T7R0fr4lx1MDAxMZFIfi5cdTAwMGJeyqmji770okDya1JaT+OLjo70xkOTcsL29jLp+321wv+0KdZcdTAwMTcuXWKKgMxHm5fV4VxcIFj1j/a+x9C71bOKXeXXk4OBuJv6W7ft8Fx1MDAwMfeITKg/R2RcYlxu8OWBKNhcdTAwMTArN1x1MDAwZYnz7u35cv7qudTxKNWKXHKHWrffnmCz7lp7NVx1MDAwMyouXHUwMDE2yfp7vjD4wlx1MDAwNWRxe4NFnfIwcIZf1J2HUJS/s1x1MDAwNdBg9XxrwSfphthfZX2O3GfbJHH0Y1x1MDAxMJOP8/W/M8xe4DUub97Wg/609sXYJ8fajlx0fsaeJclUXHUwMDAzsmsw0PPXT9eSXGJj+J1cdTAwMWZcdTAwMTSN+riw5+N5LPrjuJX70m0mSMvC7/TOf1x1MDAxN/iDplxycYjOa2r3mZimflNcdTAwMTXEKo3oVDGK+N3pya1KQ1x1MDAxZJx0JMhSVV5tk1tIsFx1MDAxOFx1MDAxNyFSbk+AJqWEXrDvxPtcdTAwMWQ82r5AXHUwMDAzkPIoUPT+WGRcYlx1MDAxM4KR2lx1MDAwMFx1MDAwZuwk1zG312O3cK9fiCqY/+tdYDX1cVwi2/f9kpCj39DaPPVvt6LVcbtcdTAwMDCY4J8nXHUwMDFkUM6vrks/XHUwMDA17m+tv8YqvztcdTAwMWI1mYFoMU7xobZup0Rfzpv9yrPUj9E6XHUwMDFlxHm+4f6ztT6ZJ9N7P2mao8MtXCIg81nOdGvRM7zxSr05XGY0hiRCR3i1XHUwMDExhIPH75dXT3yHpVdcdTAwMGJcdTAwMGaPJFx1MDAxNjKfp2xCbvp7eTZUWOfhsK7/nbE+8ulcdTAwMDHHy1H3WTrR7k1cdTAwMDN1Sn/Pm1x1MDAwM0Hsey9cdTAwMTGILJlcdTAwMTSQhPPE4f7G+U6hfnNH31xc3aiZVcVEXHUwMDBiXHUwMDE04ENB+VTLQdxcdTAwMWXMpa3H0N1cdTAwMTea6vqreGRZr2bGmlW9pOrs/d+sXHUwMDBl21x1MDAxYVxcvsO+ttPPOVx1MDAxOLBcdTAwMTMuVLvIgUWJdzCkj/HnI5zE1Walv0JoW5lRQlx1MDAxNSlcdTAwMDJAVzROXHUwMDExcvCGPVx1MDAwMFx1MDAxMlx1MDAwM9d0/3dcdTAwMGWmajJcdTAwMTSrXn+GXznXTeK4eYFNSGL4kMe/voyfLMVcdTAwMTjPfjFcbnGmNlx1MDAwZv29f1x1MDAxMz8+w6457kj0XHUwMDBiib52XHJcdTAwMTRwsYpcdTAwMTcgYVx1MDAxN0UhXHUwMDFi8sdfvOQ9ce+VgILuj79Mc+BwO1OmsSOsiYnbOkeyINaAcjE6hWV3NqkjRFmP4Yt3eHjY/YBcdTAwMDY/wMsgrWFcdTAwMDVrTEh9nfJcdNNcdTAwMWRcdTAwMTIpPUhlcYG865n/fD9j+l9VyqOjI+bWP0lNh6+PTcWoQrXRlm+557Dc0H5+vfz/nnmLy+/u52BcdTAwMWXdKtFcdTAwMWTRl59XhzTCTM3j18Ba51J/M1x1MDAxYnqejaWwx4ZcdTAwMTcsaou+Kou4I0zI73LMRrZcdTAwMWPlxF2Po0GF7TfDqNlRg1x1MDAxMHdcdTAwMDWQXHUwMDAxXHUwMDEyIdpkXbbzbjzNzlxcN53Y/Xe/dUlPQ5VcInfln7knf3upXHUwMDA3bJlUXHUwMDEx8rCiXHJNmVx1MDAwZYKAb1x1MDAxZtqRYMd7bITXNudzPGM8j/+bXHJRvPl/QrSxplx1MDAxNDL3z0CF8T1OWfhcdTAwMTH8xl5cdTAwMWJF776KWJhcXO5cYkxcdTAwMDCn0UUhP+aCQqln3lx1MDAxM9u+WW75LrozNy1M9lx1MDAxN0Xn9+tcdTAwMDSr6nPC5Ms/OVx1MDAxOKHhj34+qYPhum6GQtTd6/e2ilx1MDAxMMDvY1x1MDAwMbH1UnF6XHUwMDEz/ncvS2hcdTAwMWHZcbfF1Fx1MDAxZMTB+Fx1MDAwNc6L11x1MDAxM1x1MDAxOKxvo+NcdTAwMTfYouHjRPpcdTAwMTW4Qc+OuaImZPOH0ZyM+/M86VtcdTAwMTEjqXx2XHUwMDFipVJ4gT3Tw+aHtTo/5lx1MDAwMtViPEjlYDpK4ij4V782fFwiiNWQ1LN844RzcFx1MDAxYqpcdTAwMWFcdTAwMTjYylx1MDAxYVx1MDAwMFx1MDAxYlT1WIfiSarB+zje/lx1MDAxN8zkl1x1MDAwMVScXHUwMDE56TRlPFx1MDAwYqJMlVx1MDAwM/3ffL7HXlx1MDAxZEhQNW83XHUwMDBmXHUwMDA2Tiz7XHUwMDAwTCh8XHUwMDAxXHUwMDFhUFx1MDAwMFx1MDAxOc6jXHUwMDE2yC1EsPzmXGJcbqXYXHUwMDFm//q3Ks6vzypcdTAwMTTQ9EVQNILBn9GeXHUwMDA2wHRcdTAwMDGxj0QpxHxcdTAwMDdxXHUwMDAzdVYq5rW0O1xyMC1cdTAwMDdcct2EuErGfpA06ZDAZ4lcdTAwMTDGhztcdTAwMDdcdTAwMWJPv4mUodH3XHUwMDAyoudyZFx1MDAwN26oddXzI8XmXHUwMDEyXHUwMDA1syW4IVx1MDAxMnudinNcdTAwMDOFeThZJYv/xVahfzPIhpWx2luXXHUwMDBlXHUwMDAyVORcdTAwMTb1R59PTVx1MDAwNd5ccq3j0vU2vEYjfu1ah785o2p+Q/FWXHUwMDE1P9boivfXQtFli4lcdTAwMTVHqVxyWVVDfE6Fwlxmfatwklx1MDAwNSbVXHUwMDE4pXKRjFx1MDAxM3ZkrOqLWuTwWyc9IT1MqFx1MDAxYaA2gFx1MDAxMO9cdTAwMWGwrPZcblBppanRXHUwMDFmXHUwMDEzfPjkXHRN3ytU1uSJO1x1MDAxNFx1MDAxNVx1MDAxYYSR2zxn/G82ojyJbVx1MDAxY3W/Wac69oFRcrZcdTAwMWZZrJQr9a1Jm2jWWatNXHUwMDFl6NVcYpg67oX8zok2z1x1MDAxZdk/NdxcdTAwMWQzQlx1MDAxY96IeXp/9TyfXHUwMDBmXHUwMDFlpp7QQGIwXHUwMDAyXHUwMDE5SfYy1nSU8VxycfRfnLCYt0CvoTBcdTAwMTGmwuZcdTAwMWVcdTAwMTe2geRCqo7omZmbXHR0K+R4O+FNf1x1MDAwZlxudWN7s1xcaWS2XHUwMDBmpEdcdTAwMDWCVShAq9NWleKGhDV5XHUwMDE3XHJcdTAwMTlcYoryPaac/6/fwp+ZOi0mX8BVhY9cdTAwMTWB2Fx1MDAwN/1S94hjXHUwMDA0W6NcdTAwMGKOXHUwMDFlsXNmMq1m3MXKXHUwMDA0NDxcdTAwMWF80v9ypeN5XHUwMDA2mzsyeIQwKMBcbkW9XHUwMDE0XHUwMDExXHUwMDE2NiVcdTAwMDFcdTAwMWHOOW0mXHUwMDE1msfujM1rbWdtg/TPXHUwMDFksayQLl934TO+UTT9bDZN0Vx1MDAwMlx1MDAwMVx1MDAxYVx1MDAxMUWU2NdcIqlcdTAwMTk2XGJcdTAwMDXcoWGkKEVZSUWuyG9cdTAwMDbGulG4iDJ2iuT+9/xiUDiIw3hlkmCIiVx1MDAwMVxmjPyi2NyZXFxcdTAwMWVXMqz1XGYtXHUwMDFm2lx1MDAxZVx1MDAxZdVKXGJ7NcjvzKj4XHUwMDFhk0jz1lx1MDAwMH5dk8LFmipBJ2w8wfhcdTAwMDL5XHUwMDA3g09TevhxUjP91ZGnuJaii3JcdTAwMWW0e+pLOtbtWcdcdTAwMWJMwM8wUdRx9Fx0XHUwMDBmXG5aRIrxmlxu+rGLtlx1MDAwNNqriMNcdTAwMTNf+0bTftVcZsx4XUYj344ro2v+nYPwwv96QX7l/bhnXHUwMDBiXHUwMDFk476JR7CxK/xcdTAwMGKlnerZ71DLWN+eXHUwMDA04/dMaeJ79f0svou8KHzf6i+Hy4//Plx0kJCHKMa7KitKjNBYdZFcdTAwMWIlQdfui3VcdTAwMDW5KIRUxpVmrpKUVFx1MDAwNozRlUxzT+hcdTAwMDS/r8NcdTAwMGLQcFx1MDAxYkMtWsZuNEvrmy9cdTAwMDCGXGI20rGG93n97jfwqvNvxrcqMS9cdE4vy7k3m1nIY8VL/qRxWvKKmV8+V28/XHUwMDAxpnNcdTAwMTh5d7HW7s8/fcJ4TnU0grlcdTAwMTjmSFxiXHUwMDEw5VxmXHUwMDA0VLdIsUU06XOBNf49a1NcdJb3qa2uxF/dgt/7+cZsXHUwMDEy9YFOmCDIb75cdTAwMWWdYH9cdTAwMWZ2XHUwMDAxsOjhuouupE2escpNTdd0tvf77cBcdTAwMWJGYVGnyOqTWajY0FvU2eBcdTAwMWVxhP849f7T/zGSkkvPUWxcbmV/c2FcYlx1MDAwNd/8nKJcclx1MDAxZlx1MDAxZqvwkGezTpo0XFz6n3irKa3BOY2c3Hv+eFxcmYoloY5EWDYps370gHLjZP03q5UrucBb0i4gXHUwMDE2XHUwMDE45lx1MDAxMIyBXFxccr9P8UJcdTAwMDDF53anqlxiZ1x1MDAxZWfC4bvb8Vx1MDAxMI578STdytBdUX6RRCYkJbViTbdvqX9i3r/3TzhIiSBcdTAwMWWJ8Iao9HSQbVx1MDAwN6s7OaOOQkZzfPDaIVxuujn12ia451x1MDAwN1x1MDAwZbdf3Vx1MDAxNP54oJpcdOWnlogjz3maxnExyZhyerdDv1x1MDAwNsuAXHUwMDFlwMPsf2ahSFx1MDAxZlx1MDAxY1OZzvRcdTAwMGan37lcdTAwMDVPXG7jfNTQVFMhln7w1yurPtI+PVZcdTAwMGVZXHUwMDE0tkfAu1p6MoJcdTAwMDForL9cbknGXG7691xmwNZk9PBtXHIq/zcnzj61RVXKv7qTrmiNXHUwMDA1qEJcdTAwMDYpcFtG1Fx1MDAwMiZQ/lx1MDAwNjaAzyTec9ZcdTAwMDe6L/ul/nqn9z03N2qegODEQ/44OC9HyplcdTAwMDeT9jYwKJztXHUwMDAzZlx1MDAxNUxcdTAwMTb60vhk8pOuXHUwMDEycvi+tlx1MDAwNr6E671eXHUwMDFkZdwwXHUwMDBi8LNcdTAwMDSSav/azVx1MDAxZGbQVFBBXHUwMDAwd8qttitcdTAwMTPhw37rT4O6hHxdZnxi/5uH06pcdTAwMTmrXHUwMDE1r7/nXHUwMDE2ekqQ6Tf9WJ9cdTAwMTPNXHUwMDBmgHKur1x1MDAwN1x0qC85IVx1MDAwNEHnm4VcdTAwMWU+NVmDVbJcdTAwMThTX1/UR5Vu78OyXHUwMDE3PeeJXHUwMDAypmxsqslxLO9RReRw0Vx1MDAxOFx1MDAwNK6g6lkgZ/PQ5Gn66Ej8W30sXHUwMDA0XHUwMDEz6MuTINysX6TpXHUwMDE5XFyKIFRF3/IjgutC2YtccnR4o7OeQGdyXHUwMDA2XHUwMDA2RMn/1cmxXGLzmW5cdTAwMDE5faBcdTAwMTRO8FhHXHUwMDAyuJ5QdVx1MDAxNr96KFRGwdBcdTAwMDI6W3g17W8+ollw/+pcdTAwMDGcU0lNTqfo4nshYEHqkVx1MDAxZbZcdN6kc4Qn9W/8XHUwMDE0lTm/93BenOJcdTAwMGJK3MWawpG7uUDv6V3AXdqf3Vx1MDAxYqV9XZ6Xz1x1MDAxOJNaXV/vXT9b0SReb8tKyLoz7+czUyxOf6Y3QlxuhVx1MDAwYs1jP0j/+lGMgldw0s44XHUwMDE36ag0XHUwMDE4g+xcdTAwMTHVe0PUo249qImKluMtXHUwMDFm15HKdni3/e/531x1MDAwMkuJYjHo0csxVY00SZVcdTAwMDRN6uev//5cdTAwMWGJpy15jml4kM1LaHtC1neaXHUwMDFmUYHiSuZG+XFNhbqWwGV/XHUwMDExXHUwMDEwXHUwMDE4yGPWSKtcdTAwMWHQ5NW92qSgjzNEyl2XXHUwMDEzXHUwMDFh4DJcdTAwMWN/UeRcdTAwMDNGW2tp9lx1MDAwMZ7sR44jJii1/+pbXHUwMDFm4fBcYvRnX3j+8Vx1MDAxMvfXj0WSfVx1MDAwMHjxYFx1MDAwYt4gQja21S1zXHUwMDAzgq87/eSf/DWpv5FLwjTtzaQ0rdhy7cRcdTAwMDRcdTAwMWOULUwjclx1MDAwNMsyjrhOR9Cogjw1b85cclx1MDAxY49hO4VpMoZn3zD2Zj7vN0BjZFx1MDAwMZJgXHUwMDAxlJ9yNbetXHJvkiavgVx1MDAwMmSY/KIzft92VFwiKY4/rvW1hWIn6iexbVx1MDAwM15pU/GsYbBAXHUwMDFjwdRcdTAwMWZcdTAwMTbKI9RcdTAwMGVVSMWLwbyH30G1IFxcfdW8wfdXXHUwMDE5RCg7X3teZ++CyJaDWFdcdTAwMWNcdTAwMDdz2mbqezfG8fZPQOrwUjcquHUqrkZ94SzXLy2h2lx1MDAwM9NcdTAwMGK8cJCOXHUwMDE421STSVx1MDAxY1xigsAwjOMsXHUwMDFlxZpXJG0rwjG0SaPrXHUwMDFl0+n3OnwkI7JrXHUwMDE5jOyzjTub5s7QXHUwMDEwjvFoIPYxwlx1MDAwNbpcdTAwMWSRhpmPn/og0Vx1MDAwNV/YXfVcdTAwMGZ/XHUwMDE3OtM0TSBiXFybxM5Rtu6Aqvz4oVKD3ilQpuWXXHUwMDAzXHUwMDE0Rjc8XGaTkfSgyXhcdTAwMTlAYnjlXHUwMDFmXHUwMDFiljvmXHUwMDAzkclcdTAwMThnNUuyxIIjObxdXHTipK1cdTAwMGKxcWEsXHUwMDEzxvxeXHUwMDFm0lwi5u1A3Vxcr/g85ipcdTAwMDXmX+4k/SczYS+vxz+js9Lfh9eNXHUwMDBm/cr6mmnaYFx1MDAxNpjCkel9oWOoJY0qRFFePDTKUzWSisJ/a001W9aiyP3RUs7oXHUwMDBlalx1MDAxMuJhlvBp1Pk9XFwhmuzxpaM+e6rBXFxTcVx1MDAxOfxcdTAwMWS39FOsXHUwMDEysFx1MDAxYmFcdTAwMDJcdTAwMTfATb2tT1x1MDAwZspoxYVccuI67POHmVx1MDAxOEXI1Vx1MDAxN71imXrYI4I7lVxy766vXHUwMDAy4TLWXHUwMDA3XHUwMDE5NYJcdTAwMTTqXHUwMDEy/XxcdTAwMDZcYnSEP7/iTFx1MDAwMtaI5Jjh+0JcIvuwSLJcdTAwMWLIPaBfzHZOWes9XHUwMDBi0Wsss5N2t05kiid4XHUwMDAxWFdcdTAwMWHyQKrmxtF+ibrQ5sEugYT7xuVcdTAwMWKFNk53tI/Gp6XXrtuzXHUwMDBmXHUwMDBiR+/VJC9cIvRcdTAwMDLeabAphDyr57PAT0jitK9yXG7PtjhLXHUwMDE1TFZfXCI54PlVUao6lLi2P4phv19cdTAwMTKzbq9hpn/SmN+eXHUwMDEwwoCJxZc0i5YjbVx1MDAxMEmqfD+G6Fx1MDAxOXGVzY7NOG5cdTAwMTQvvE7qLflcdTAwMDJekFx1MDAwYufRYzdcdTAwMTF9XHUwMDE2XHUwMDA2+PZcdTAwMGXf31617bXwLmBUcYxcdTAwMTHLY4fAryhccio2kLNBJVx1MDAxMVx1MDAwM3ytwFx1MDAxNIZUY1W+pqGKwvyxiU3QWNKOkjsnp0+8NEZsj7fO2fFcdTAwMWRKK4TjXHUwMDFhWIs1eL51aHtzz1x1MDAwMoeQslx1MDAwNlAhXGJcXIM3fsvYXHUwMDA3oTq0W1Q4YlxcOdYsgLs4ieA6XGbHos9SV6/PVUr1XHUwMDA334plsVPKRptcdTAwMGZo1zxcdTAwMGJ0akaTXHUwMDAzvlx1MDAxNChcdTAwMWZ6LkI69lx1MDAxNFPlmlx1MDAxZqorfsBE4amlby/fKN0+RDivtX41LkrJoVx1MDAwZdmtRpfkXGJcdTAwMDNcdTAwMDNcdTAwMGLQO3fezVFcdTAwMDeDXHUwMDFlsGMm24jQk1x1MDAxOa3syzJvyFiD5s9nfaTjITK149I4dNz3No+T6eVcdTAwMGK2iY3jOFx1MDAxYXOxrKJPucFnl/royXJhtyVcdTAwMDdBXHUwMDExxoLd7/ZqhYBcdTAwMTlX0P1dapGQXHUwMDAxXHUwMDAzwFx1MDAxYngg3/k7XHUwMDA1etNcXCkyey/Qsl7MQVx1MDAwYqpCXHUwMDFh5M9cdTAwMThcdTAwMTlFvITqdTpRuWucWS+JfD1iXHUwMDBigT7dTEGk+1x1MDAwMSjk0dPZJ/dR7rOzjFxiuXdwvoWAa2bGi9idle2Yi2dcdTAwMWW+Oyy4z2Xpo1nmlIlllEZZJchcdTAwMWRz1DPIM4A5XG5cdTAwMTnJL1aiIyqQ+fuiXHUwMDFjrXDZZVLGyuMz0f9CaKWsqPU+yoVKdPhdK3f/XHUwMDEx1TlZN/7tZE9Mc1x1MDAxY4nHmVx1MDAxOS4vKVx1MDAxYZ3b1GjfzHaZI+TXXHUwMDBi/ZhEXHUwMDAyNtjRtCRZP8RcdTAwMWLXqekzgetofM+a01x1MDAxM4nL0bNT+Vx1MDAxM1x1MDAwZt/KfLtXXHUwMDFl9GyQME3gPEtQclx1MDAxMfmW7Vx1MDAxY2Vo5MaKw1x1MDAxZlx1MDAwZShdgXV8XHUwMDA0WzL0bvpSQdH3Msk6JFx1MDAwYjvWdU855DGCdFNn/1uJi4pOwlx1MDAxZnttXGbWa6qw+lx1MDAxYXGcXHUwMDA1Urji+VSjK/BubYhgXHUwMDAz2+DDLIqLkvm0V/7GltfJcKo3OnnjQ1x1MDAwYq4gasJ8rijroT9xwGVuSJ9cdTAwMDI+v/yQ607BQefqyUyMT9P0IPr64KaKdepQP3vRuNvSzOdxLLhmXHUwMDE45Nknwt9cXOWfL5OG/uRcdTAwMDTH4ZiVf2mPuzxbz7CqK4hcdTAwMDFkXHUwMDA04qhAXHUwMDE3td7MXHUwMDEzvXpcdTAwMTRFcd9EMPhcdTAwMWU/mmd9kGK5gJ+tXCLRXHUwMDFktP1jq6+5iVx1MDAxM5bmqlx1MDAwYmhcdTAwMTW2XHUwMDE0elTFQnlSXHUwMDFjsZpzXHUwMDAyX5FcdTAwMTb1dsvtXHUwMDEy7bAmlq/X6XatrsJcdTAwMDDcelx1MDAxN5945Hz6zJaLsVx1MDAwNYVcdTAwMTBQdHyEQtx1cqpcIqGXlX0tJd1itJ/TXG7dhvnF2SRcXFx1MDAxOFJE6I834cryXCL7IaDAynCAenu/qlx1MDAwM3mgM6ui0T6iiJn5U3qoXGap7SFcXNhcdHZEIcOhinxcdTAwMDe+uTSP0z+LfTpm18a9iuGKpav5Y/plxU+P/zpGr5dWLU1cdFx1MDAxN8Yy/kXli+tnIabZg1x1MDAxYd5EUVxu3ZDfXHUwMDA1eFx1MDAxM1bBRld+dXBcdTAwMDBasbSxXHUwMDAyjLZiXHUwMDFjf/eUzGijbD1cYsDvebtcdTAwMTY0htn7r69JXHUwMDFmt+dQXHUwMDExm64p1OnatDxwY4CKrtlhJN2eXHUwMDFjwFx0wI/F2bYomPOG4Yjd/NjQ73OpvYYz+sR+pzecurOc9dEv93VcdTAwMDLvvmjOza02ncRlsPKTXHUwMDA0Plx1MDAwNe1cIutcdTAwMTDXXHUwMDBmXHUwMDFhku/eeje4yDvoOVx1MDAxMv3zlUBiiNKL37XAf1x1MDAxMKH8msYlQlbunGXw10ZcYiVkeIJ65alLV7m3sF054zNowzwqxypDalx1MDAxY2CTU1xi9Fx1MDAxMcwxXCLc84H6/cNcdTAwMWNe7Ug9R7pcdTAwMGY2+Vx1MDAxZfSHXHUwMDE3IKPg7PxiL7mcXHUwMDExbPK1ZKJWJFx1MDAwYq2DXHUwMDA2V5yIjk+Faagmp9ti1nrBXHUwMDAyXHUwMDAwNUHsXHUwMDA0IVx1MDAwMN/CXHUwMDEwpUK0gJu7UVxctaFOVb9yXHUwMDFj94uxobZzK1x1MDAwMVWrxnuL5Pk3ktQoclx1MDAxNVx1MDAxZjkz45mCX95EeCSkXGJcdTAwMTBcdTAwMTfXL/FBYMfXXHUwMDFlV2c+r2/+9qdXYCvckS/qJVb7munKdbRVXGKj9Oeo2YIwblx1MDAxYUfp8kuGN1ugXHUwMDAwgFxmjnQksjVcdTAwMTRDUStcdTAwMDRapdFrMZqJw/l1Uy9pUv7kqk/QQ9a+uteWu82y1Fm8XHUwMDEz6Lo9Ulx1MDAxZEYt2C5SOIZGhGf0pVx1MDAxZjCQUzCW+TjT+SQ/fG9v2FmeOFx1MDAxNT9cdTAwMTlcdTAwMTdcdTAwMTf7O0PaTridXHUwMDFibFN8XHUwMDE5UvfCsOBcdTAwMDVcdTAwMDLUbUrf1lVvXHUwMDFkj5yNezZcdTAwMGV3seS26mhcYtjle41psnnFeHOaXHUwMDE4M3NoXG5/9tTVglx1MDAwN6vW72cvSzOtguc/gOGdZfU0LsZxXeM5i8dcXDpcdTAwMDVHmOpqQIvxW2PFZDKHXHUwMDAzoq+wKVx1MDAxYcGzi6dwT5A5+67wNThMpWvRatM83l5cdTAwMDampTBcdTAwMGbeXHUwMDBlXCLo1Fx0g8Pb30Ro+6IhZ5NcdTAwMWPX4TZ3XHUwMDFhnd5TxKfxN3ZpeCSNvyzCsVx1MDAwZeMoasxbhCCuUYAsjWlcdTAwMWaldfvzalx1MDAxOTCOxelhfTpcXJ9sJvZV0+1Ft+FY79FKXGbQdPLcvKeLVpGykKmv1nnDXHUwMDBiJ6ZcdTAwMTfjOX1fiLbbg7NcdTAwMTT4XHUwMDE59Yhh+/E1qi4+yf2w7bxGuYpcdTAwMDPoXHUwMDA01kI/XHUwMDA2uupyoClccrKCXHUwMDAyzVjj51x1MDAwYs+NKFx1MDAwMKqH91x1MDAwZozHR8dh/vKecYrCukel+KC1XHUwMDE2XHUwMDEzVbhcdTAwMDaUklx1MDAwM/WOstWTJ0wwyqRz3PlZT5pioZx6uarGd+pstDdXfJZVfnOWKzk8iLWDXHUwMDA3Plx1MDAxOGnakMA0lVx1MDAxMmhmXHUwMDBi14sz0aJcdTAwMWbGXHUwMDBm7oEhb6JcdTAwMDSGXHUwMDFmtiRcdTAwMDJI/nZn5Vwi1lx1MDAxZbPO6p29LMWFdLC0vSHda3/eV7EgsfY+t7fzxHv9ec2fL2uyxb40KpxupkNPus/mXHUwMDE1Rlx1MDAxNrMryzqh/JFcdTAwMDGYvX5cdTAwMGZK9NjvXHUwMDA337NX/jhtoFx1MDAwYtxcdTAwMWGap809zIhriUmqTyxWQpdgXHUwMDAyltWAT9hcItdrXHUwMDEwiYIxYlx1MDAxZYLym77Tw2ekqlx1MDAxZeq2vCZY0OLEuPZmXHUwMDE1wDpcdTAwMWEnur5LkHz2kEXAPbni9yrNXHUwMDFjy/24/Fx1MDAwNz41XHUwMDEzeEefQeGqIG/tOurJ7o96jNZSrO/7K5FcdTAwMTRcclx1MDAwNU/Kz8OukJOe+fxGj9LKq1x1MDAxMTiR+3hcdTAwMDMmd2f5XHUwMDFhXHUwMDFlcfrQbp1wy1x1MDAwNP/Z/1qx3Dr1PXebhbpjT4K7wTEqJfOmz+9i73NraqDCvL/BXHUwMDEzL2ChqVx1MDAwN9mjT7o0y47G9e3eY1x1MDAxM3y/NpX08XFYYC9cdTAwMTdlrftjs7zzXG547o1sn0bB4uVqtVCM91x1MDAwMVxchlx1MDAxMHjSNIZ61Nes036xplx1MDAwZvHsMCui/lx1MDAxOfCNIGjvoOGXXHUwMDA3SUF6q6o8QC1TsLU5X3KErVrTMVx1MDAxYU1FI1d4PvLY42qq1mFcdTAwMDBcdTAwMDclaFx1MDAxMT7eNUeFR8GtloarWd3FVrpcdTAwMWKVXHUwMDFmS1rcelx1MDAxY1x1MDAxN1161bu+v52xp1x1MDAxND+j/+ieJ1fzTeF9+Nj6XHUwMDE2WE0jXtPd59Hz8DVJflxyOlx0XVx1MDAxN5LxiFx1MDAwMNn5llXOaZy+QtAkOL87yFxm1vAkcJ/VpOXf1N37OFx1MDAwNyTux7iiXHUwMDBlMt5OT64yXeMyfmRcIojuXHUwMDBlXHUwMDAx03qZcWSNViMvWjatTLGj5ITxylx1MDAxNnI6zKlcZo901uNjhV+nXFyN5N3nV9B7ZzflXHUwMDA3kpzQXHUwMDFm7dqkilx1MDAxYlnjelx1MDAwZeGKdMmDnehozlx1MDAxYTwuk3yBR2NcdTAwMDNW98Uw2n/RXHUwMDAwYniBLMSx57RNS+DqI5ue/eGamOFoXHUwMDFjXHUwMDEwQCidSFx1MDAxZq6TVFxuqJKytSfoPCHHw1x1MDAxZI0+TO3auvIq6jdcdMJRXCKOKFxmhcYhgFx1MDAxNWmHfmKRXHUwMDBmeGsswO5cdTAwMWROIyZcdTAwMTRni7WDXHUwMDBiR1x1MDAwMKlMkarvgDp0jGg2qD/m+9lcIuhcdTAwMTOflb13XGLjXHTrWsK3LGl7XFxcdTAwMDeQvaN3/EhcdTAwMWZcdTAwMWLGX9ZheKFcdTAwMWPEXHUwMDAx+PBfmzWY1jz8x1x1MDAxOVx1MDAwZUc53bQniVxyXHUwMDAzwKd6K2ZLZ1x1MDAxZVx1MDAwZVx1MDAxYa0zTvIv1/fCk0q7dpt2ZuH4u55VTFx1MDAxYklcdTAwMTJcdTAwMTB0XHUwMDE0XHUwMDEyRPPzXHUwMDE22TWg3erXt+9ORVx0RTPu6PJW2eOHqb/L40WGXHUwMDEye4dn9spcdTAwMWZcdTAwMTbUOIyVZ8guXzCUXHUwMDE2tWPUOdK2wVxiKiFcdTAwMTDb8LPvXHUwMDE2XHUwMDFjWKO/rfvbXHUwMDEwXHUwMDFlpXdcZtVcdD2wfepcdTAwMWJK/fFd8VS/jI5+4eWYRKA0XHUwMDAy2vLWKsaTXG57SIXculx1MDAxZXJ+Out48Vx1MDAxM9zD8sx1kG8gzSXR04fT7+9MW7BypmtpWJ+afiifL9hKy7HpXHUwMDAxn5IxZFSC11x1MDAxNM6VXHUwMDFiXHUwMDE031x1MDAxNPlGP2vAn89ba43SRPgjtdJ6WjbGeu1cdTAwMWNcdTAwMDKz0rFMkjeAIFx1MDAwMdFcdTAwMDRhfn2zrmFryXuCx+9xT/rGwHxd38Wfb4R98vhcIl9cdTAwMTa7ZjxflMwvXHUwMDFhd8LZo/d38VdzcVx1MDAxMKumN1x1MDAwNYiVLFndyVJnqeDVXHUwMDE4p1x1MDAxMGC2Ylx01Ms32Ttv+bBahWpcXN6CNECAXHUwMDE3XHUwMDBm9vibfqDx+JjrjqFcdTAwMDMjavmTybp3vPfJX8Z64rLdtM2GRkj/8MdcIi2M4Vx1MDAxYyO4Q0BRxE8uXHUwMDE5XHUwMDAxXHUwMDEzbV9lSiPcw332Q83YXHUwMDBmqFx1MDAwNH5kXHUwMDA2iKVcdTAwMDVSXHUwMDFliZdZrl+GT7au8lx0XHUwMDFiN9XutycsXHUwMDEzXHUwMDAwJWi4Pjm4y5FSNcXe4HaT/HA9u1x1MDAxY+Uo61x1MDAwNYlpejjniKjxkVxmSp5cdTAwMTAy0Y87bbdcdTAwMDUpN3KmnE/TN2VcdTAwMWYzf237xT6r3Ci4n5n91L+e3LWsXHUwMDAzMb9znraglsiH43iW+lx1MDAxMPNMgTT7i7GlXHUwMDEyooy22Fxmo4tayUSOTWO3XHUwMDAywqNcdTAwMGbVXHUwMDAxjVLvx35BJ7JdKLv/sFNcdTAwMWK8IXnik95cdTAwMTKnXGIk+DRBXHUwMDAxXHUwMDFj/WI+Vdnv8bDXWVxiupTSiH5cdMJG6F+1MjbVbOTlLo/o+1x1MDAwNVbSXlx1MDAxYkiv0suYKlx1MDAwM5BZX/d8XHUwMDE2mnnytq0skFawpXje2W1cXGbHzY6vg0MsfkvjyYS4d0Ek+v2KcIWA+G1d1YNoJ+pCXHUwMDBmXHUwMDA2OVx1MDAxZaH++fzgVp42dNdoXHUwMDFkfqx2d4bmg8Sy9ztcdTAwMTPTTi7fJjM5db9cdTAwMDZcdTAwMTgvp9PcxVwiv1ubPYTdilx1MDAxN60tXHUwMDBmMlx1MDAxY+iV5mjlisZcdTAwMTeTrpCSpCNcdTAwMGYo6Vx1MDAwMFNcIq9Igfu/845AUDjXZVx1MDAxOVx1MDAxY1EnpGiXZVx1MDAwNcZvbY1cdTAwMTmwYEa8jlddpIwoO+tP44bsh59cdTAwMWWbal6QTzBwI2fdmKHIgVx1MDAxMstruVx1MDAxZoyMi9vkpMxviZR6ZT/eslx1MDAxOf37foT7uyrfxkJcdTAwMGJP/kY2La3BXHUwMDBiXHUwMDE4UK6t2EXpXa9w7K94Qkq8ZrZZo1kk3iVcdTAwMTD7SXGN6yZhwjBNw/bhJufvuZ3+ZiDHd9bxXHUwMDE1mc39XHUwMDBlz2BIblx1MDAwMrnh7z2rXHUwMDA0XHUwMDA29tKAc69cdTAwMDS9XCJGfzUwXHUwMDBiKX/WVqdcdTAwMWbGNKqOaVx1MDAwMKy4KVNcdTAwMWWv1Wgh92E99HFQ//lcdTAwMTnNabmgi78hXHUwMDFmcjDvXHUwMDE1kI3qmVx1MDAxNs8k3p1VdV3avlxiztf7m1+OXHJ2wFpvW3ehgFxyX9ZcclS4U0V/M2F/eet3xkk5W1x1MDAwZtq1pq5cZihhwfV9XHUwMDE3p6JZ6Hjv/o6dhFxu1Eop8zhcdTAwMTkyXHUwMDAyZI9wWlF/fm89vYjPONCQ3jzpXHUwMDFmvZhHXHUwMDEwryrfm7FLXHJWXHUwMDEw5+HSszlcdTAwMTJPzKo3sSxwUVx1MDAxZaPrmrK/XHUwMDAx4Zk9a/uiXHUwMDEylFx1MDAxN6CXp9x4/DqJXHKi5nSFYyBcZqL5c1x1MDAxOd1cdTAwMWT7nelZ3cNcdTAwMWGm1v20qug9NqyxRfzZ1SdcdTAwMGVUMuDmUlx1MDAxM/A8l9nAYVfHVZxgVM83OFx1MDAxMPlFlf1cdTAwMTOf9fvaRuNPfC5PdS8gXjbxlu1GcMm7YFx1MDAwN/XIuKmPUlxytVx1MDAxNv7sjW/ZOaJKnpjkQztj9YVUQHmYN7QvY6ApO4bFa1x1MDAwYmHBp9d3XHUwMDFk66+6lo74xYa8PVV6XHUwMDAwRfKYapmgTsFcdTAwMDess579Y8NGwnFO7Vx1MDAwNJlObud0h71cdTAwMDSnlH7a9bHNhlxyf7XIxr9cdTAwMGJ/urpKQ9NNWqk93lxu3EDJxO1cYs2Ijy5cdTAwMWZAQ379mFmoOLhBXHUwMDEx1PwsuNfvMnZm01x1MDAwNXwoXHUwMDFhMz1CS3WlXHUwMDFi4eZPnkmetVx1MDAxNZWoWo5VzZ5XM+L5+M2MTTa1nfdz+i5Z63OPTpNnM1GMXHUwMDFiRMVrflCjSnxHLV1CZFx1MDAxZsRluSlSRIFBjFx1MDAxOXHYrGitZU2QXHUwMDExXHUwMDE3XHUwMDFhMzNF3cdQXHUwMDFmNozPrVx1MDAxME7XmFx1MDAxZdtDPYxcdTAwMTbqpFp3Kvy1laTRd1x1MDAwNunQXHUwMDE3RS9cdTAwMDMurlx1MDAxOfnpYtprfbqKRkTJus2bXHUwMDEwV3hQxVx1MDAxOTCObCaaQcGkXHUwMDBl2NWsrPtN06RcdTAwMWPjdm6O8qIqudVxr/RUcp/UocWsXHUwMDEw0Zh3alx06XVcdTAwMDB69lx1MDAxMdCYKlx0YXC6XGK//DmDfGIuzHBM7EQ3lVx1MDAxZrrWV6ptp1x1MDAxNlinmVvUk19VQOrMlqvv0eOzbaxdxvnnbCht6oTdzb1cdTAwMDPtbj/2ulxc+TiyIH6e+07CkOSWolx1MDAwM/kxlHZRjk++XzVPJYbN7bD9OeS9wYCyXHUwMDA1XHIglq7NutjTITi9YZ5gRPNoTNhg6dFcdTAwMDWbvzViXHLbJVx1MDAxY1x1MDAxZpvTnX8xWpn1SXQ4gm/F+03a7DtcdTAwMDKMXHUwMDFkI6uPxzlgbHtcdTAwMDE4gFx1MDAxZoJ4XHUwMDFju1x1MDAxOCp1WVx1MDAxYy14NVx1MDAxY8FcdTAwMThNwTxcXC1Y7excdTAwMTjFw1x1MDAwMZh41Fx1MDAxNFx1MDAxZSFcdTAwMWZYT2m/wMzetlKa1PqFuCzG4TFcdTAwMDFVndx9XHUwMDA3sDq004CvOG1LXHUwMDFkXfLmiPjjOtfFaFx1MDAwN9tvY1x1MDAwZYGl6lx1MDAxOaVcdTAwMDFcdTAwMGXP8vol3ClyL+N5XHUwMDE0r0K+XFxAsz3tz3mvYrJ5kzg3gn6Ns5S+WZdrl9yyzWeKjlrHrnS+UCnCw7T1JrIuXHUwMDE1k7BcdTAwMTh5fYNm8+dM81J25ntyXHUwMDA07f3G9ZDAXCJOWd2m3bk/XHUwMDE2pp9Bo0LtTyujLq94fHKGju2FdVxmq3dZ08SuXHUwMDE39Fx1MDAwNzo6b5fIvVx1MDAxMX9soYVMreK7jaQ5XHUwMDE4+5tcdTAwMWMts4yndIo5X3KH3D9cdTAwMDczzFx1MDAxZlx1MDAwZX7Edy9BXHUwMDAyafreZ7zEOmSk0apcdTAwMTEwRmOK8meAttWCXHUwMDE12yOcXHUwMDFmvlx1MDAwZbHF7v5qWIqTnehZb3RYXHUwMDAxXHUwMDEwc8usLGBSzEdcbqmZ6zxubINcdTAwMGJBXHUwMDEw22+jRnBcdTAwMWbvr1x1MDAxNihxXHUwMDE5X8E6dlx1MDAxM8uOXHUwMDE1XHUwMDE378dcdTAwMGUheMdcdTAwMTBEbJZcdTAwMWRcdTAwMDS47iXIqlxur1x1MDAxN1x1MDAxMf3yxiHr71x1MDAxZoT9bIPlp1x1MDAwMlx1MDAxM7wn9t75nmuvWfTAXHUwMDE49lx1MDAwZrBcdTAwMDHLYzZfQFvv9y2/2Ysm345cdTAwMDDpyJBAv/jHNPWplWzJfy+skjqgPdCCSNc2qut3XHS0b9lcdTAwMDGijaenk2FmSP9y9Exle1x1MDAxMIYxXHUwMDFkXHUwMDE4m1x1MDAwZn+J91x1MDAxYlx1MDAwMMnW5lJyUpnxXHUwMDFjhVx1MDAxOGZcdTAwMGYjVuhccixFmu5cYrd8YneQS1x1MDAxZpnLWEf4q198LNCsnnky9p1cdTAwMDRpJbAvP47oevTTKKBS61Lk6yuCdvVrwmRcdTAwMDBUxG5/jlx1MDAxNlqDv2aAc5RcdKFwvsxAePdhvVx1MDAxM67DSjlyavxCZVx1MDAwNYFlyKO0RXlcdTAwMTnmXHUwMDExlG5cdTAwMTWHn1x1MDAxN5Z33nprXHUwMDE5XFy/9Fx1MDAxMUx/1Uc55rZW9UYlvU902/6m5lx1MDAwNlx1MDAxNlq5XU8syWRy7oJHePzNh/6DnsynwV5cdN6vWb00tVx1MDAwMlT2XHUwMDEwXHUwMDExyqh3e0xcdTAwMWHfemRcdTAwMDf25MuLXHUwMDA2e4xBfWiE+1/+djRt5SjGnEKlIYpcdTAwMGWdp9ein69bXHUwMDE5rlx1MDAwZZJCk+GKjvmx+sT49fs1Ry7+rGy9XHUwMDAzXHUwMDE0VXouVtgjyFx1MDAwNePJ7Km2TGtg9q04dfbXlUmYcFx1MDAxMauOh1Kyy7jToyNtznrStP+tcaLob2Fj5Kx2uM6Mwlx1MDAxYaJcdTAwMDNcdTAwMTLsYzQn4MyGV3L/o7/zsViYz+tcdTAwMTOQQsv8y3WiXHUwMDEzO1RmXHUwMDAwLo3cY6K8IDr2XHUwMDEyycM+3reAUKZnudlSVMXs6nPBrp0w5fv4+FwiXHUwMDAxXHUwMDE4OlisYlnUXGLDzZXUPC+85klcImc+YlVSVlxuNn36mobrXHUwMDE4oEzOp3Oz/v2H2dmUS92QYVx1MDAxMbRjYH4ouDgkTeaGIMJJgOrXXHUwMDFk4XLbYKs0wDvZMvxcdTAwMTTI+7eHj5tcdTAwMTDSJOz6x+1k3yHzakFxnk55iyq0V1x1MDAxMc04oYhswSxSXHUwMDBi8dVcZi5ibYFcdTAwMTV3XHUwMDBiXGJoXzbJpk1wgK3xW7PH1pnYs4VcdTAwMTI84yNcdTAwMWWQ9+7Vy2tFd9UjdYxcdTAwMDT581x1MDAxN/J+Z6uaKHidzJhcdTAwMGJBf02pP8LAXGb56lx1MDAwYlx1MDAwMrg9z1x1MDAwNNBcZlx1MDAxOVxyJ3uAatsmXHUwMDE2rsPWw2xcdTAwMTnT73dcdTAwMWSFXHUwMDEywpfL7DTORFx1MDAxM5rUKLw/OdrQw4lcbkWSXHTZk1aG9P07z59cdTAwMTJcdTAwMGXWXHUwMDA3xjq0J4DcNix/zyruwOEsb+KQf1x1MDAwM2rMh9M+UDe2XHUwMDE2bXitXHJ0aXfRQS/nuEFcdTAwMTfat6SRN8v88Vx1MDAxYlx1MDAwNVx1MDAxMy4+4ztx1a4+jJbv2yxRXHUwMDFmhFx1MDAxMH2QiTlcdTAwMDJcdTAwMGZD0z9pnddcdTAwMGazX0BnzO2kKFwiXHUwMDAzMG9IhDToVWp+bctXclxm3lx1MDAxMVx1MDAxNM1E2OpcXFx1MDAwZlx1MDAwYueolFx1MDAxNlx0kWvmXHUwMDE4Zd/h6Vx1MDAwZXmmJvWyR+9cdTAwMDPvXHUwMDEz+kPLNlfSKi29S8tvONy7m+ctUKxcdTAwMWKD/FwisSMmzvt0dmD5ZvX0XHUwMDE4xPzNx3x6/WKv60VcdTAwMGUlhd3b5lx1MDAwMVJZkVx1MDAxZH+oKlwick11YkBXs1lcdTAwMDar8uFZeyy9tVx1MDAxObOxb5aly+eNUlx1MDAxY8cuUtsppZ+GfbegMzpcZlFcIlx1MDAwNn5/2p6scFx1MDAxZk3UMlxyvsiXe4TJb184SjRW1U1EXHUwMDA1NuY38IZSWz5w+ahxgoPNXHUwMDBmLWr+7TJcdTAwMTM/iZi/TbRO4ylKo13YXCLVka+UaFx1MDAxNvq3XHUwMDE0kDej/FnvXHUwMDAyk1x1MDAwNFx1MDAwNrBaXuNuXG5Sx1S4mkTjoTP4xEQprP5ujMb3g73exFB9TeZcco6pf1x1MDAwNL9nmFx1MDAxMJtPvqN/sq9fhVxiQJJhhOD4eYmPh2uVRVx1MDAxY7ZsUO8hI1x1MDAwM2RcdTAwMTKAnnzId1x1MDAwM6rTjFx1MDAwNmRcdTAwMWb8XHUwMDBlXCJGmVxm43yI31t436vx06Yzt3rmyyTX/lx1MDAwM+RrXSXJq1x1MDAwNPc5p97ypz1cdTAwMDNkPjGF+adjq1x1MDAwN+36RsFqQXZcdTAwMGVyzlx1MDAxNlx1MDAxNl2HjVx1MDAwMqrNtz7Wuz3sw4koSDnIcFx1MDAxMiC5Jy662f88g+ZcdTAwMTVcdTAwMGV1kFx1MDAwNvXlXHUwMDE2XGI7XHUwMDE0MK0qXHUwMDFhaiyO5kzY1vuTiYVcdTAwMTQjiPu7xWl+9VA5r76WeHBcdTAwMDPJ/Iawz1x1MDAxMGdPtn6B66pcdTAwMTGNXHUwMDFm7K1cImwtZftcdTAwMTX8PfOaez43ZVx1MDAxM0u5YzLVsFx1MDAxY6HMS+W1P75QaTVkXHUwMDFmPeRcdTAwMTmyXHUwMDEwpGz2Znq/fCRcdTAwMWKNf1hcdTAwMDJcdTAwMDRMoqi7L7bKSsx8Oi2P96VrfvZ1O/3DXHUwMDE0euJcdTAwMDDAXCLraWJ2XCJcdTAwMWbL3cl9/+rtLWo1X1x0sKOvXHUwMDExdOcqaazvvVx1MDAxMnFUkch7Np02WCGemutY4ejcp8GMXGKhY8jb58egV2Hg7tHDxp/nWtNjX1rHMfeUO+bsuSvt/z+u3mPbTWDrXHUwMDFhfSBcdTAwMWHk1CSIIHJG9MhcdTAwMTlcdTAwMDRcIurpL2j7nHO/v2F72MNbgqpVc825UjGntMGIt9bnq6C0YkNcdTAwMTc03Fx1MDAwM4FCnIzK+uu5SGDHtdv/qGxaRphcYpmiJ1wiy+bFZnGReWvZaFOIZux6NfU/+nLieVxizGeWg40v+u1cdFwixfmEXHUwMDAyXHUwMDE2f+1cdTAwMWJccig37sIyiz04XHUwMDEyXHLXfptccrTTvVx1MDAxNSglqofaPCAmfktcdTAwMGJul/9yNWX79C9cdTAwMDQn4/dcdTAwMTKxgeAvIW2myMVcdTAwMWPLfFx1MDAwNVx1MDAxOWsryEeBmm6UjPDjXHUwMDEzPSdtOJfjw1x1MDAxMeY3+vTpT1vBu0xfuJOVuWpcdTAwMTGPJZwns0h4PcOKpWiJoXeLnE5KXHUwMDE5sS8jZuPzk19cboZKXHUwMDBlQHdNunKoop3JXHUwMDAzf1x1MDAwZUs5Zcp6lCuCxf2rrD9cdTAwMTdcdTAwMGYnpVcmSs1cdTAwMDWzx1x1MDAwMk/HRIW2h9iFzM2gulZAO/xhtYo/oFx1MDAwNvvMz1dcYqkvzVvWOXwhlYxdNlx1MDAxYVx1MDAwMPta8WY4+FAxk4lcdTAwMDV2XHUwMDFityxcdTAwMTCTspmJXHUwMDFiulx1MDAxOd85XHUwMDFlmVx1MDAxNqZS31x1MDAwNSjYa5pcdTAwMDbLZTFcdTAwMTNcdTAwMTGiXHUwMDFkLFJqqntuRVx1MDAxN6VcdTAwMGU9j2/kXHUwMDFlw1IpP23F+bKS8Fx1MDAxNlx1MDAwMFx1MDAxNo3wXHUwMDA0+mX7mp3dXdZcdTAwMTD57Kh/uNW+WK8vXHUwMDEz4Padl/wlskR1pHYtQfL5IOdXrZx/vHm+1nAvzdGvullGXHUwMDA30fsyJXxX0Uwtyc9cdTAwMWTjXWxcXFZVhXhoXHUwMDBm6Fx1MDAxOdrfxXLuXFyWq3Aokzjz5Vx1MDAxMKa4oGdcdTAwMWJpYPVcdTAwMGKUVVx1MDAxYvC4lWtcdTAwMTVHXHUwMDFjfMtcdTAwMWVcdTAwMGavSnf9bcHb1Ectu3jPXHUwMDBmYDZw1e09/qJcdTAwMWNcdTAwMTO7c1BcdTAwMGamu/AjXHUwMDAzUVx1MDAxYcNKZflkxDPuyvT0KJwjXHRq/li5XHUwMDE1Qb9aXHUwMDEx++5cdTAwMTN4Zue1rDFvnbNY8zqQlzZY9NBcdTAwMGWG7HnQPiSvIFx1MDAxNzOumVx1MDAxNC/xjqE/OW3XLixRsFx1MDAwN2WhXbHqKHS8i2GaRdvpRKsuXFzN2IUyk11NeCGN6GjkzZGykFx1MDAwNCi40T60XqiXjFx1MDAxYVwidabaUbNcdTAwMTRBXGLqXGb4XHUwMDBlp/u+xzO6MbDmc/pcdTAwMWHaN31AZro/w6xGMLH8cbvealvpwZFB7jihXHUwMDEwY1x1MDAxYuClXHUwMDEzrS/G9E2IOFrZ+Zt27ME2XHUwMDAxXHUwMDEwi1xygVxcnCSe7aGRiNWaXG6+ZtQ3XHUwMDAxMZUgW2bbrl+JZD6/fDxniclSbzQgfqjHMIFcXLLMdCCiUzBcdTAwMWOM1GuVQDz1XnDZx9uWXHUwMDA1y1x1MDAwM6aYXHUwMDE4yKPXzoFcdTAwMDJcdTAwMDCrobVpqfFcdTAwMTeg+KKix6p26y1cdTAwMWVcdTAwMTM7OXSnyuhcdTAwMWKo/2gr/NJr2DxcdTAwMTk0Vb9eM1x1MDAxNnL9dfdfLUx9oU4kmim36Fxmm4lcdTAwMWY7iVx1MDAxY9tVeK981LdcdTAwMDEp7+1bYcvu1nlIRZzMZlx1MDAxY0Aoz89P91x1MDAwMHYkyyOLRK/vkNHHXHUwMDA2anj8XHUwMDAyNFx1MDAxMk5YTChcdTAwMDaNi9Dt6E3w0kdSqUHjYFx1MDAxMVRcdTAwMTl/UMBcdTAwMDYpXGZcdTAwMDPfOXRxISFf0/me74ZcdTAwMTPOKDCxNX74WJzdd1xy5OhcZr9sfYFcdTAwMDBcdTAwMTUopC7rR/g5/emm+lL8TNKvUjNcdTAwMTntXGJ8oVxcXHUwMDE5Y+XS5utcdTAwMGXGNoGl405cdTAwMGaFmkBxntTXXHRtXHUwMDFk6MFcZrHVXHUwMDAzv3iZ5fz6M6VEqL2Mk75sxVx1MDAxMlxiXHUwMDAydvA0XHSwX1SsXHUwMDAyj751XHUwMDAzpidhXHUwMDFjOUt4rk26n2VcdTAwMTiCbl/CXHUwMDE3ozNcdTAwMDSpXHUwMDFjwFQlLLpcdTAwMWXksmtbWa/WXHUwMDFlSvdlXFyLy+aG7KlcYolhet7dxluk6lnoiDPQyF/N4i++vMvPXHUwMDEwjVx1MDAwM6CyUjL3Y1x1MDAwMniKXHUwMDE2uPhlpkTL113ORVwicFx1MDAxYzYvplx1MDAwMV+mfXlcdTAwMTEs9Vvvp1x1MDAxN55cdTAwMTHbMjpcdTAwMTRYXHUwMDE1XHUwMDA1XHUwMDE15bqs68PTXHUwMDFkMrWU+XmKLlx1MDAxZtuvX0qw9KpcbmlMn1x1MDAwMVxcX533rTBcdTAwMTBgXHUwMDA0Q65I9DOEXHUwMDFjnOGGasX4s4y1/rKdvXnwXHUwMDE0Xni4R1x1MDAxNt6uIcP1z84rUvVTqlKdZu2/mkibkJ/8/lx1MDAwZVKcXVhcdTAwMDPCQmsoe82H9VxyXHUwMDA00ZeYzFx1MDAxYv5YvqdcdTAwMTFC+G0zXGZoSEL0y1x1MDAxNXB1YGVcZr+cXHUwMDE1XG5S2VxmXHUwMDAzXHUwMDEzfWFihJ7gNlx1MDAwNvtbJ1x1MDAxZdFTmN6OdOHrXHUwMDFkb35ob3Gr+j1cdTAwMThXMDejd59vyMpZJOuBs89cdTAwMWa4edF5e+dYrXLk+ViBrTBDOttUslN6wF9cdTAwMTVtXHUwMDEytVx1MDAwM/V50X0hvnfvvXvKXHUwMDEww6B5XHUwMDEyp9ZkNE1kP8VcdTAwMGbtW4hlbmjJNzB0LmJMXHUwMDE3XHUwMDEzp70np9xcdTAwMTnCPNMoh+51t1x1MDAwM6dmXG4msWbPjI+gh7E9nOMkgkhBQVx0XHUwMDA28nX0ca6+YFx1MDAxY5r1pNWe7eRzaUydMtHG2Ex0XHUwMDE5o+UtQKi+QWj0XefxorneT5c3XHUwMDFlS6HuxVx1MDAxM4DtXYrb5lxyJk9cdTAwMWaOXHUwMDEw8lx1MDAwNWS/n8ufVlx1MDAxYj1Z5tei5LJLvp8vx1x1MDAwMVx1MDAwN1x1MDAwMlx1MDAxNNelgODzY0CvXHI1YaqHQe9cdTAwMDGxIW5grHLXRnys7SXUn1Ay/Kb2aW01XHUwMDFlQUmGiZik789MW50hXHUwMDFlyHDIXHUwMDFmiHpQNWUp1qRPZVx1MDAxZe+Ku57fXHUwMDAzwF2J+GJagUORslx1MDAxYVxmjsVcdTAwMWJcdTAwMDBcbrksn1x1MDAxNyfWXHUwMDFmz4MzKv34XHUwMDFjh3HgqFx1MDAwMyFcdTAwMTD4VOdqVeZcdTAwMTFcdTAwMWFcdTAwMWZ3XFxH4Fqm7Ir6ncxcdTAwMDL7jeB+XHUwMDE5XHUwMDA0L7BNXHUwMDFkcCe/r1x1MDAwYlx1MDAxMMSfPLwjc4CzI7nh3vKVX8z6XHLjXHUwMDA2vs+g8eJcdTAwMDDrLCVcdTAwMWalKmR71exMU6M9R65JKtR+bfNcdTAwMDf4wsVcdTAwMWXmkW5f/FhROUaLJa5cdTAwMTHpie1dqqEpSv+aOFwiifjj7bqh9Fx1MDAxMOzVvzn9LsnSxSkl7OTe24ZqvX1cdTAwMTF54GLONvT8olx1MDAxZVx1MDAxN/6rV3iV159cdTAwMTm7XHUwMDE4l43vhUFcdTAwMGVUZKWwZbRcdTAwMTlcYm5CXHUwMDAzXHUwMDFmdDlcdTAwMTAovn1cdTAwMWS0UvjyOVx1MDAxNl1a/umT2lwif/zRRl6Fa/MwVYtcdTAwMDcxK6LeoSrUyqFl02WvVFx1MDAwZm4un/5nklx1MDAxM3FngVx1MDAxM1x1MDAxZTOCotpmb1x1MDAwYiMnbE36IE13Yd8olVx1MDAwMspcdTAwMDRcXOdFXHUwMDA0WIZDyOJ9P+Ke8Hidw7bVfVxybDVZZFxu2/7l13f5XHUwMDAxqZA5qnpytFx1MDAxNOlvXHUwMDFlOnXbXr9cdIxcbji6MHMwLU1FXHUwMDEyyWsxhkUpXSvP/Vx1MDAwZd9/ObLt8lx1MDAwZralpmY/XdJcdTAwMWO0vXemXHUwMDBmXG50JNfrQ6l74S1cdTAwMTE1yu6eSsV281fnMbArUPRcdTAwMWVS03glXHUwMDE47n1BLVj0sPLUr+/PbNWKiekyJXJcdTAwMTn9dpcxvM9aXHUwMDE36PxJkVx1MDAxYf+LUVx1MDAwYufDKzGJQDzFrVKKzIdcdTAwMGYsiGHFyzMx+1x1MDAxYZhcdTAwMTbvszDWWlxuLej9dkqMIyRcdTAwMTmf4/aX2+08rmLWqrOA+uBcdTAwMGZsXHUwMDEyQfhJhLbyrMLempCznLzz4rfr7Y9cdTAwMWV71O8sP3/ReVx1MDAwMLU9TvCzm1xifOoqWz7f9ro5JX5/Zv9gXHUwMDEzTkLzXHUwMDAyw21cXEDqSetDKrlcZlxcXHUwMDE1xbf6x1x1MDAwZsDy4jT6quXfUbCxXCL4uFx0YFx1MDAxY5vnXHUwMDE4XHUwMDAwrbXiRVx1MDAxZmtcbp9hP4Bk3rPqkkJBLrWsn1x1MDAxZjh2ReBcdTAwMTU2uWVRglx1MDAxY1wiXHUwMDAwkYmDXFxcdTAwMWKlNFx1MDAxMGliZ1x1MDAxOW6sXHUwMDE1vjCd+XCc6XSlhsr9h9HEplx1MDAxZa5ccvhYx7KZXHUwMDA2XHUwMDA3hGKXPp7u3oVwXHUwMDAxv/XmPvu1VWPoXHUwMDE3PbLUbHUwXHRjYJh9XHUwMDE2XHUwMDBlzmNaRWhqXHUwMDE5p+1/8Vx1MDAxY7ZmK452XHUwMDE11Htk5sdDIFx1MDAxOOzi+fB9XHUwMDEw5b8wRNdcdTAwMDJBUF14XHUwMDExQSd8cJkm1fX2slx1MDAxOKNcdTAwMTOM7Jc3K1tcdTAwMTnmR0adYNiU1JOMXHUwMDAxUixcYijKrlx1MDAxN0EvWSq/oMjWWlJcdTAwMGVZaexcdTAwMWVcdTAwMWFIXG6To1xyZGRcdTAwMDJcdTAwMDdcdTAwMDWmXaNcdTAwMGVcYohth4KfxuFX2Z1bt1x1MDAxNadmXHUwMDAxpjeGXHUwMDA3Wjh0m2m+gX7g3Fx1MDAxM1x1MDAxYdlaJyduP7+4XHUwMDEwXHUwMDAzsLZqWHtfPoOifK/uXlLsI5txOs1nu1x1MDAxZpL3W9hnYTPVk+mvte+nT/CXd+/2Jy14XHUwMDFjiX1cInBRXHUwMDEzXHUwMDFhjVx1MDAxMlx1MDAwMpxq0nczUEZ7ICe/XHUwMDA1XHUwMDFhOOe9x5hlc0jGhrDDdYlUvYE36bpLemn0RSF4kdzb7nhezpngPrd0jU2n9eM1c7c+RyTUXGJD1ybNomXhXHUwMDFkpmFHToX991xiXHUwMDEzY6njskav02mxYCg88aOQittrtFx1MDAxZELdXHUwMDE3p1xiV82MXHUwMDE192I/alx1MDAxZVx1MDAxZWjad2zLSPvKu2uT7LpMMG3U0Vx1MDAwMztcdTAwMDQ9XHUwMDAwqG/IU1x1MDAwNMGS/qVtXHUwMDFmw1x1MDAwN5Cfwzgwo+ecXHUwMDFheURcdTAwMDPiXHUwMDEyTfqmOm6/1Vx1MDAxYvPoXHUwMDFllu+GXHUwMDAwWOtcdTAwMThlvFx1MDAwZlxi1aRk8sLGdlx1MDAxNFx1MDAwZTHumorCXHUwMDAxLLBQiHhJ3Vxyl3JyrEgyUqNcdTAwMTBcdTAwMGZNx6iB5IiUX1x1MDAxY9x0YIa53Fupjlx1MDAwNlx1MDAxZu+fSfA1jXdBmVx1MDAxZVxiuZ/5RUxcXJLIXHUwMDAwVH1hTpEy3OZcdTAwMGb7/1x1MDAxM1x1MDAwZjdt+MdreoDE6TnONouO31xyWNidqFx1MDAxYsFwj6NkJog7OvjhXGakXHUwMDAyKD37XHUwMDA1x1xyXHUwMDFkstdJ6+FcdTAwMDbHrXCpOXH/5Vx1MDAxM3LZJM/8nbowaKBcdTAwMDZyKFx1MDAwMZ9tXG5OlOP4VzfXOYSVmuTz8kuHwFx1MDAxZWpcdTAwMDec4Jw+tbfCxz5RmXSuZjZQP1x1MDAxNXguXHUwMDA0WNdKOJVHbqPhXYJv3jFW1liV18umNvhRkzw6Qlx1MDAxYTDYZ9BcdTAwMWObXHUwMDAwXHUwMDBlUZvxa1xuXHUwMDE2L9X6pUJcdTAwMDbMiEi6PXxcdTAwMTNtVVx1MDAwMYbCbVx1MDAwYrZPOFx1MDAwM+mWvkJXMvEoSsmsdW/cKaFcdTAwMWYnqHtO6lx1MDAwNarIX8g2gN731Fx1MDAxYVVcdTAwMDRtslmnR1x1MDAxYbxL4qfDm/tcdTAwMGV4fn2wMVxuoFx1MDAxNIlcZk469lx1MDAxYVx1MDAwZT0pczR0y5hcdTAwMTW74c9cdTAwMGVoi1xc/GprXHJcdTAwMTNcdTAwMDTdOTSAkF9o2FxiafaTsHv1pXZx2u9/6jqIMmAu27zYcY9LNK1ox4O29lx1MDAwMqaFoVx1MDAwYpHwrSRn5M/RXHUwMDFjiTKXW0P45LcupeMnXHRcdTAwMTL+0kBomqfhtj4x18xY+Sf1y6JB4Vx1MDAxZVx1MDAwN0XF3Vx1MDAxYVx1MDAxMteJNCqUTHPOQs+YXHUwMDA3JIfBtDhh+9OJ3d3zy+EvhoXMasRbmTAm8JNo/TfMzGHGsXBcdTAwMDaJMFdwsVOYtfaN96VcdTAwMTVvbq3VpsU/XHUwMDA0SIQqWi7t0n3hOCpcdTAwMGKZl45hUHRrnC2qm7tA3vKk6p2scnxcdTAwMDStM1x1MDAwMVx1MDAxZvO2aodcdTAwMGK3UvTjSzpvIX1cbpHIwax6cTS5gphbo1xy8n0ji0s2SzqXd765NiyhWlexkLh/uop9sVx1MDAxN8Zzx8JEkD52kCFx05t65yhIm65fXHUwMDAxK25cdTAwMWP0hz79fVx1MDAxZlGHTHCJ0eFF6aLHXHUwMDFmR86shLnQmWzVftVAf1x1MDAwNvCLtMeYtlxmXHUwMDEzSjxbm36szuXfL2HZ3vFGTLD0TdHD09tcdTAwMTY+XHUwMDE3eJxcdTAwMDY2XHUwMDFlp6JIbDvFhnLfsYP64mqMpy5cdTAwMWFE5qnjUV/7c+K6r1M0jeWRjGr064/bu0pY89X81PCRX1x1MDAxM+Y7XHUwMDAzXHTXwWRFIeenwspkXHUwMDBiP1wiRWfkq5fQXHUwMDA1ISuimXFif8rMXG6ARsbVXG5jca1cIohcdTAwMWGDXHUwMDE2hKhlqlxc76TPdtdqJaNcdTAwMTDWxFx1MDAwM+/jU5A+cZRjc/k6P3xyeH500ZJjL9ysIYHuYOu1XHUwMDEz5Fx1MDAxMO529GFf60mxwrTxjpzlOX1cdTAwMDRcdTAwMDP4dWBcdTAwMGJcckFlRp/Q6cKc735cdTAwMTf3ca+9yFxcPtu1XHUwMDEyl8lwtDJyhlx1MDAxY5tShFxmkktcdTAwMDR6prdcdTAwMTidkq9Lblx1MDAxOD1cdTAwMWWjL1x1MDAxMVx1MDAxM1x1MDAxNJo4423fXHUwMDFh+1xcmjxcdTAwMTNF2rDHXHUwMDFmd1Iv1szHl+8/aDBcdTAwMDbnpFx1MDAwNlx1MDAxMydfgHyUY4FcdTAwMDH8zoZk11x1MDAxYfI59/t3WVx1MDAwNp9Z/Vi8XHSXkDFtRFxmNjy1UppcdTAwMTFGqKA9yOpQXHUwMDAwbqLLKXhcdTAwMWJcdTAwMTdlXHUwMDEwnjpDzzNrXCLfXHUwMDEzXFxFMYCJXHUwMDAx2Fx1MDAwNp/qnql+2C5cdTAwMDc/gjsmKHNcdTAwMTTH+WD8bCDO6N42XHUwMDEwJd9cdTAwMGZEqtBcdTAwMTNcbjnzXHUwMDA1lVx1MDAwNmlQ2bpAcHut91x1MDAxNPW43Ph5ME+XXHUwMDE5mCGY7OFcdTAwMWLBKlx1MDAwM3/i36yjpJVEXHUwMDFmlXDhs1VXX/5X2MpJzMfLLfVcdTAwMDP6XHUwMDFj/uG3IOFQoOaTXHUwMDE481BP3U5cdTAwMDZMdaBee9pccuzLXHUwMDA3mlx1MDAxYYc4LSooblx1MDAxYlx1MDAxN1xcXHUwMDA2XHUwMDE1XHUwMDFhKsVeePE3s0rB9fn6XHUwMDAx3eXSWmVRXHRGM1x1MDAxNXNcdTAwMTOLMFXRzVx1MDAxNVxcXHUwMDFh5KTTo9vw84zmd/yvLoq5uLXwKVxiTWOQKuSqqsOLmlx1MDAwM9c2XHUwMDA0+5AgyFx1MDAwNuzG5Vt2kKJXdczgVcr9OItscYeNM1x1MDAwYq5cbjIhoavJkcGWki3sgVx0jOJ+jlx1MDAxZFx1MDAxMlx1MDAxNHFcdTAwMDJcIlx1MDAwZWNb0UrFK9FwbiDNiiRcclx1MDAwZl+qSVx1MDAwYurVrdZcdTAwMDd4L99cdTAwMTFCkuquXHLzRI4lXHUwMDFm8Pq1XHUwMDA1tFx0qiih1rdXoDVcdTAwMWPZSpUowUOdXHUwMDE5PpWqnyZL5Vx1MDAwYtiY0LWYzETKSHlN2lSmr284k0yBLn1rQuigf7nNgp6lXHUwMDAwvTyMaMY7jn5cdTAwMDG2wnpMX4VTUSZcdTAwMTAuXHJ8lu9zXHUwMDFjT6+CXGbfvjW+yDpcIlx1MDAwNdH9oEp0qYO3Tlx1MDAxZulcdTAwMWInXHUwMDBmdkbXXHUwMDAydJ0x6iV3mFxiTse5ME5S/44pPd6XXHUwMDFi3bKWfyPEO3lnyaVcdTAwMWX2XHUwMDBmcElg37eHJ8XYPndRfNuzfjr+bjhcdTAwMGZcdTAwMDOLXbjV8KP6edffTsTQuS6EXHUwMDE345FcdTAwMGabgjLt92lZfPbBXHJp+flpkeOetsNcdTAwMTgwc+ecV1xmTlx1MDAwMmDb9EfYQ1x1MDAwMPXmVX1DXHUwMDFkRFx1MDAxNsqMXHUwMDFk+VKQl8FKadBcdTAwMDZkfSZLXHUwMDA0/Fx1MDAxOOwuJSZK6l9If1x1MDAwNXFMQFjklD5TVt7aXj4v5D+4jMK0TVx1MDAxYnCQXHUwMDE3hbcqq0iMtICz4K2BmF2462s1mVx1MDAwYj6r3iSca+amcnF9t8Z1XHJcdTAwMDJcdTAwMTNVTftQh1x1MDAwZiNmdbbL5ch9/mq4XHUwMDEx1ivXXHUwMDEygdRRhVx1MDAxMbpcdTAwMWZeSaas0zZzKrRcdTAwMDWVqYM0k+s6TYTFk+jYZrc/XHUwMDEz15xbwJbeOdH40+1jXHUwMDE0TPL2XHUwMDExVif2+Vx1MDAxNzs+XHUwMDFlsFx1MDAxZKJqnJtLt49dlGBQNp1cdTAwMWSGUozlXHUwMDE3lvZcdTAwMGLti/uDI1x1MDAxNFlcdTAwMWZcdTAwMDWUXHKZapmVzCuAwV3O5D2+Vlx1MDAwM8K/4Mo8vkBSXHK39u1BI65vzL5nKYgyg9qXXHR8XHUwMDA1apTwLzxUPlxcXHUwMDFjXHUwMDA24UTr87O+I1hcdOfSTTt2rXLcTVx1MDAxZDhcdTAwMDBJvEN5XG5Oi8WBmOaCyy7AXHUwMDAxvv31XHQ01zPzObF/X8k46sva5Vx1MDAwNWi9h76Rv+ZcdTAwMDN2XHUwMDA1RJg8zvrVglx1MDAxYzef86zCopKv5TcxxPUjXHUwMDA1Z9eT41ha4FWeU5Uu5qXYzq3f9u9cdTAwMDezlvnwpT8/PmjYxShYfMxcdTAwMTUu/WmM0ddWXHUwMDFmXHUwMDBlwVx1MDAxN26vXHUwMDExZ0Pg9tFsoFwiXHUwMDE555NcdTAwMDS5XHUwMDE2fVx0KqJcdTAwMWZsj7xcdTAwMDFcdTAwMDNSqVx1MDAwMlxcQCfPVHJcdTAwMWJO719ccrZYZlx1MDAwN7xDTWFcdTAwMDD5pYy0TffnN95cdTAwMWXrk7dNj/WbXHUwMDFhfvS/XHUwMDA11z+cXHUwMDEzXHUwMDA04WpcdTAwMTnE5Fx1MDAxOE6oyD5cdTAwMTlQuFx0rFx1MDAxMM+iXHUwMDAxXHUwMDE5um5zwWao9POAZj0kXHUwMDEyybtcdTAwMDA/pKph0cWNVFx1MDAwNeZXXG6otadTUHVcdTAwMDBcdTAwMDYxRVx1MDAxNcqem1x1MDAwNVx1MDAxOKPm+3mvNvOEW1x1MDAxNPGLXHUwMDFm3j1k7m1cdTAwMWZMttfVXHUwMDEzXHUwMDA3VmLDh2nyn9SwoySBklxmXHUwMDE1c1x1MDAxNyY+I9FpdsH2gy+QXHUwMDE59fKlLbJJq1A7XHUwMDAwfcaDSCrsX39Tp5NcdTAwMDVrXHUwMDE0XHUwMDAwYIgmheH+e9mU84M+LGvRwH+13b7Dl/tz5Fxm/O7nwmVcdTAwMTJcYtKNXHUwMDAxKixcXCvrM1x1MDAxM1x1MDAxM9tcdTAwMGXbdVx1MDAxMNVhvjiwXHUwMDA2XHUwMDEzhSdwXGYyyuNjQ0wlKW9b+JZKJ7VcdTAwMWOKNlx1MDAxYyFSb6uicfKtvCdwsqHxXHUwMDE0XHUwMDFm6pqtXHUwMDAxIcBcdTAwMWbqLX9fXHUwMDBmMNXgKF9cdTAwMDezwlxuV0XXXHUwMDExtdNlXHUwMDEzz92aP1x1MDAwMnz3XHUwMDAw2ph698+CdipEIDkvj8NcdTAwMDdJ04PaUkZcdTAwMDNd1NubYziKc/dcdTAwMTAtxn5cdCNsdTm6gbJcdTAwMGLHvWF4K81fnaaew68zsYFcdTAwMWVmkVevcZ7EhNYxRJP3q13QyuclXCJcdTAwMTk0m16U1VgyQGZcdTAwMTYxTFwi7TsmzE1cXFx1MDAxZpzqNyqtmPNY5ym0ce49XHUwMDExXHUwMDAzXHUwMDA0XHUwMDFlLqzsgJlcZjMxMPSpXHUwMDAy8L6HJufTZ+c+wuju8ylcdTAwMDPsqV6eSM9cdEHzLlXfzu+qZYGd1T00fzbPX803/7p7OCTx9cgkXFyy1GIzm0Q7L43eZ3a9hU2YhvNJvJfTXHUwMDA0yOWBY1x1MDAwZkjzkbyT89s+d8ZcdTAwMGbVJP5ITa+DUJnl5maIc1x1MDAwMyTWPMxcXIK/XHUwMDFjYlx1MDAxY6mHrVxcNMB79lBcdTAwMDKOut/PwHrkkCmFUlx1MDAxMM1wIVx1MDAxYTlaVVndXHUwMDEwnvh3Xpe7llx1MDAwMlxyfd7uM1x1MDAxZCQhMeFtln6tU+RcdTAwMWVcdTAwMWOhXHUwMDEzyqeCftwmuuNCXCJcboUveCfXeVhdtEv3yfiCgauYZNJcdTAwMWZjuVx1MDAxNYhJgOHHXHUwMDBlTPh0Un2LTqfcOeJL4Tx/1/qU5Sck+PT2YdBdT8jHZOYvi1x0MqtcdTAwMWW7QZc+raNhnL4xqo5xU1xcrG15XVx1MDAxMz8rsO9z+357qeKtXCJcdTAwMWaIhfFqcFQ4zzzH8faNrXNefHthpHDmvvo2w/ZFXHUwMDA2LVx1MDAxYYWkp1qFtoo/+lx1MDAxY/ydO0PmWJ3rJI9cdTAwMWRcdTAwMTCKmrja6ICtn8KiTsFBfct33eJAXHUwMDEzd3vD5aVr/EhJ+66FXHUwMDEyonxkdz5WUqfBXFxcdTAwMDDv8Vx1MDAwMrZwXHSNXHUwMDEx8Vx1MDAxOW1PhYNcIlx1MDAwMVwivr+e7S6y7U2ZXHUwMDFiXHUwMDE2jMRcXFx1MDAwNJ9cdTAwMTWyXG5ETKHjqs6Isj1cdTAwMDGfv/Gpbr1y68lXsrlcdTAwMDGyXHUwMDA2nlx1MDAxM0/Jgj+oXHUwMDA2WMVX32bnr6+1gpTLxkLrxS7PXHLZqbfYJl+mI4MvnSrtXHUwMDAzdNBcdTAwMWUhTThGSFx1MDAwZpUtS8rwbWb++I5Us2mJ/PyXXHUwMDFiXHUwMDEyxzy8XGKixmBVf1x1MDAwN8doOTLxUFFcbsJeJfWQ24u4gKO5TH1AK95SkMPkqyhcdTAwMTnzuptsNtNcbt6/vu3hoZMv0DQuXHUwMDFh3+WDe1x0e7zH6i9gXHUwMDEwY5hcdTAwMDeJfFx1MDAxZohL5lxclGX9JcLLXHUwMDE4sfnL2amkk4M0tc+6YdLeN8Kz4VgtiFx1MDAwZVV470tcdTAwMGX9XCKpW/5cdTAwMDJcdTAwMWPGrnbSg0OrjEtI0lx1MDAxMYvmiYzVXHUwMDE0klxcXHUwMDE56Vx1MDAwN1wi5cQ3+Fx1MDAxNqhcXLbcwanVXHUwMDA2QGakmDzB491cdTAwMWNcdTAwMGVcdTAwMWLVm/zhXHUwMDAwpCa8sLeOTV3nlL9Y33rpMSnNkVxy3kxcdTAwMTRE0pUy4zzbrlx1MDAwM9ZG2Pc/vWbMXHUwMDE4lJfvVWVlXHUwMDE0Llx1MDAwYn341/dcdTAwMDPNXHUwMDExUfRcYnRhk4nkl6xcdTAwMDfrclx1MDAwNUe9XHUwMDEwXHUwMDBm99JcdTAwMDCXR3tcdTAwMWaWds9+XGLiy76RJlxcXHUwMDA2XHUwMDAx05Hj0XjXV4xaLFx1MDAwMNDc70jV21x1MDAwNtFcdTAwMGVcdTAwMGLgZWG2ci0qT/5cdTAwMDQqLEHxZv7lN3HhXHUwMDBm/GK/6zxOk1Bd6uQnXHUwMDBmXHI251xcaJk0XHUwMDExSCiAvHxxsUrm89dWXHUwMDEy6873rvFg01tDnifBwMtcdTAwMTNcdTAwMWZjlFJa8Fx1MDAxZCskYFx1MDAxNO1uhiZcclx1MDAwYkfWfTO5urYlfNBfYvTu+v/FY9qbT8uk96IlsFxiJ9o5MYlcdTAwMTXgNeoxhGmzR4ditrxtz0/wbL/kVLWfy60lMJZtYJ9/opZcdTAwMWNJey2c4+SxX1x1MDAxZOxTkFx1MDAwZr6AZfK1UclcdTAwMDVORzJSkZBT9cvhXHUwMDEzkmbdkPcuh3pcdTAwMDHz/X7xxbJKjnRcdTAwMTl91jlcdTAwMDBcdTAwMDVOqlx1MDAxYz3BXHUwMDA3iSxcdTAwMWPURSxcdTAwMGWc6oushlx1MDAwNrFVuJjHj9evXt9cdTAwMWI9rrvO8nLX56JQJV1cZlx1MDAxMVx1MDAwMVx1MDAwZlDPlPF0Tsu1n2rnXHUwMDE2mYDwg7q1jVx1MDAxOFx0bvGQSr46SVx1MDAwNCdxODGndUTAJ5z0pEqXY37KU/1cdTAwMTeXqizzlEmstLc5XHUwMDA2wWr21YNY4lx1MDAwZkCLcmutJZVUntbcnGWwPpb1zGDmiSyDXGa3sy9OXHUwMDAzLVJBXGL6XHUwMDFlnOvwsJlcdTAwMWK9PTt2f0DmXHUwMDE5/6u5tcanzMVaUeSL9orjXCJpaK6fYKJfp9i7eKUue55cdTAwMWO+rGx5nGpnQnF4XCI2jqBnXHUwMDE3ZTO6zaF1ydlGXHUwMDFh3/BeZPDPXHUwMDFmsd3UXmzmhoxiV1djXHUwMDE1XHUwMDAxqThNazMgrPi6XeI+6s+WPulcdTAwMDONWLDAiL+ZXHSCVmLpMujAiJyOXHUwMDFmQ1x1MDAwNVx1MDAxMVCkbpw0W6FcdTAwMWWGkkllXHUwMDFjeEBcdTAwMDBDv2KfT7rRXHUwMDEw4oBghFx1MDAwNEU0qlUmLCRBUlx1MDAxOFx1MDAxMO9AXG6g3XBcdTAwMDDf8SF7XHUwMDEx4Fx1MDAwN1x1MDAxN3FcXFRcdTAwMTfG6UogcJBcdTAwMTI6ctO6i++1wEmS1q+/XFx2JtVi8qW1gDVcdTAwMWZIxdeL5s0uoSadLSCsXHUwMDAxbT6IZ6fvXHUwMDE3XHUwMDA2Vsz0NetJmnivbT30La7DQMjvhTp9QVx1MDAwNbH6l1x1MDAxN7t5XFz5XGKmXCL9mDOdXHUwMDA1XHUwMDA2jKTUXHUwMDA2r2o0jLJcdTAwMTfCWFx1MDAxOECLLZXXQb00W8XozeX+MGJcXDvneFxikIJrXmTTb9w8Jsgkj85cdTAwMWNcYuLx/VI13fM8SevK3n/py/Nbpjg9RlxcpGG2oIPRuOva2JR5ey9LzUXIIC5cdTAwMDLzXCKHpHb1XHUwMDA1PdQl1MXza7ppwdZKUlx1MDAxM9Oz86O35eVOYsVcdTAwMWbI50PdJCTcRVfjS/tr7oCWomyKd7Q/PKyYMFx1MDAxZSY+LihcdTAwMTXA31x1MDAxZjJcdTAwMTTz8Kv0QUh5UFiH6cRa2Vx1MDAxZIf5fznS8chcdTAwMTiVQNwlUYNpmsA3PYCFX5vDsD7MXHUwMDAxveh7vkd0o1x1MDAwZlx1MDAxMITClvZcdTAwMWO17S0o6XrzPKpUfPHieXq3U8TgXGYmeoQ9cOxcdTAwMWQwXHUwMDA2/FMrVkFcdTAwMWPJQVx1MDAwYtin7HxUxe5cXDHHQVx1MDAxZjzCbd5j7WxgkHTVz2bQeyid+1/tz8fb2ifSoFx1MDAwN1x1MDAwNb/iYlx1MDAxNOmteEWFdkm18rg4XGKVpMnz0pllXCKHssytXHUwMDFiw1x1MDAxMFwigSeIyzqegcyfoqXNcGtEXHUwMDE1ptDD5JOtaWckYTD2oWj7vivg8lx1MDAxZPax/tWmXHQ2wVx1MDAxOGishGSFXHUwMDEw2FBAcFx1MDAwMdJcdTAwMWQ9vTcyXHUwMDBiO+2AXHUwMDFmk5SUj7Nq79Y49I6WXHUwMDBm+PyiNlx1MDAwYn6BYVxyXHUwMDE2+lx1MDAxN3NNNt1bSH74vzhcdTAwMWJStlx1MDAxZslqs0ade4CW9lx1MDAwMVx1MDAwMox4zVx1MDAwMM8l3TRj1d/ZS7CLZ0+MO5eIgn+dXHUwMDExd/tSirdP38NE+kqhJ6rf3X7r5a+1PYdcZvDr0OGzu4SDVay82q9JieHdMF8vVybre+2j2c5abnlcdTAwMTBdXHUwMDE3cs2n+fzr1cTkx4OXgk2QXHRcdTAwMTa+7DHaSKk2xTX6dFx1MDAxMWLsR5NnOuCiXHUwMDFmhzj390ukJnGb2txcdTAwMTcpoNhcdTAwMTAtNuaXg2rzIdDE56+3X+6UN0PP48VjZyUhXHUwMDAyXHRcdTAwMDSeXHUwMDAwnKKRbH5WLtgyXHUwMDEyTYN/81x1MDAxNDjuYC/+LaB66ov+XHUwMDE3NMl4cI2YU3WZRaLEQ9o5yKe83+hcdTAwMDRcdTAwMDD613fLXFyVdrRcdTAwMDf5LLPfWj7Ehv7Qz1x1MDAxYfCivffZXHUwMDFkXHUwMDA29Fx1MDAwMFx1MDAwNtmMvGQ0amFKXHUwMDBmXHUwMDE50S6AvZvgkGQ5hMDzx4iwOSZ9YFx1MDAwYiZRdECnVvvS0ZdMsFx1MDAxY9XCi3tcdTAwMGK3XHUwMDE2unlVN5Zg8zxAapWIfCVRJVx1MDAxNdJvXHUwMDExls9Ji56NOFx1MDAxMXXSpHdcdTAwMWYzi3NcdTAwMTXL+OjOkFx1MDAxNvdZ7ts3L4+WYeiBXHUwMDA2MLVvSG0+qDxcdTAwMWX/OI0tMzakfc7jXHUwMDA0eFx1MDAxMe1cInOHc1xueumh5G+L6zyo5Vx1MDAxYr53XHUwMDE3ZvPefoeUpVx1MDAwM4Go+SHdZMCOqaS2fSnC5YBUXHUwMDFitrdibs58nYO/Ont2fGD1Ju5cdTAwMDTxalE60d1cZphB1P7UpvVcdTAwMTmadVx1MDAxNPK//lnbk1xysdRyKZvdUo6syXhbl7JtPoJccixcYtxHkjlcdTAwMDEg4b/qy5+OXFzasD9bcTCBU1x1MDAxONClrVx1MDAwYpiU60W0XHLOXHUwMDE5uOme7lx1MDAxMFx1MDAwNYWU8Vx1MDAwZlBcdTAwMTCybGqV8CPFpLyOrlx1MDAxNIL4NMdVnFwiKMmHT7fXc3lcZn/9mVx1MDAxN1x1MDAwZkwrRy6otMiNi/ignCRcdTAwMDJnqG8nLFaxRNb9K532T/arn3BcdTAwMTTv5KuDbyrUXHUwMDE2mFx1MDAwNfjAQFTyXHUwMDE34yOMXHUwMDA3rTq/ta0hXHUwMDEwXGZNgT0zeiyCUVx1MDAxZqZd7odcdTAwMThkwm9nu3PkS5yGRlx1MDAxMNFf1HrbkELjv9iryP1cdTAwMDdmNDqAq25a70mGXHUwMDA3m9ORXGbE7H/19anVY8T+mpNIclx1MDAxND/L59elmLrX14VcdTAwMTnfP3RbvN5FXHUwMDExXHUwMDAxtrpIx4PGMsa12Ezqi4K2jF+vqDAxj4xXdWRUR1x1MDAwYohztVx1MDAxNItcXDj1LFx1MDAxNajhQI1cXM7n4DJepn983tK2vc9xWmdcdTAwMTTHI+nbLEpCkZjGXHUwMDE3XTVs9ktXwpkom3/9XHUwMDFmg8XvWUUusmGgUUqYwFx1MDAwNML2N1xm18LiKEgtMVx1MDAwNFtcdTAwMWP5xTLB3U+v9Vx1MDAxOWVg8sjcddRvaPz+vZ+6W/JlXHUwMDFh2sW/Y9SCu0lcdTAwMTBRctKq+DrS722ccu/RXHUwMDA2njqGg4Npy6ft1Fx1MDAwMHAuXHUwMDE5qeuBXtNcdTAwMDRFd1+9N8RcdTAwMWXpyth621FcdTAwMTG3xl+9Llx1MDAxZsI7ulwi9d323UBcXCaWuoM7KYm2rFx1MDAxZp+uoVx1MDAwYuRvzoF7Pt/s/np/d7K8TC7mv/BcdTAwMTZG2l1/JzD1XHUwMDFkV0eDS/Obp7FcdTAwMDDntPtcdTAwMDB1kVwitfq81TVcdTAwMTOXr1x1MDAwMb7MhD5cdTAwMDNq0ddAyLY3XHUwMDEzL8ZbgtJdanZkXGLRXHUwMDBlnN/K41x1MDAwYoRcdTAwMDGy3HeAXXuidlxmPUDO5Jtg1nM9eOTrksKwUlxm64ms+eWL8af/V2922Zts8IKRS+lcdTAwMDO6Nlx1MDAxN81cdTAwMDdhlrXb3rzPzrCZmSU6iuGYT6BJrF2sykD7Kt6exKo1WmfwXHUwMDFh7CiW3LclopdcdTAwMWbmhSB0TDtcdTAwMWazXHQ6XHUwMDAyWEezN1x1MDAwMNxbplwi/9VcdTAwMGKrmTDWYMt/v2skTuHmXHUwMDA1uoNFslxuKCpcdTAwMDGQ3zRX/uI+1OPRXHUwMDEy2n/t7XFpTeDz6zPCnYphdOTrj7BkjSBBkZlcdTAwMDehdVhcdTAwMGV44eOlXHUwMDExWXszhltcdTAwMWYo73lcdTAwMDX5yFx1MDAwM4NSezbo7lx1MDAwNFHt5unzXHUwMDAzaziUcCvMsf/t1yhenOJ1b6koLHeb61x1MDAwNaCvXHUwMDFmy/gnXHUwMDA3OJr3bWz337yCyv8/a1WHXHUwMDEx+penr+/bNtlMo1x1MDAxMtXGnvdkTnjJt6OFbVx1MDAwN4TRSNGtozZcdTAwMWXk3HVTcFSRY6KE6m7vPTGmjoTO6KEvXHUwMDA3uVtcbrmnIV3+d56HZLDAteTki8yD5VNobVx1MDAxZuEj3Ko+nUPwx/pX9+m44+6iXHUwMDE1xOqMXHUwMDAwjVx1MDAwYpJcco54+6pOud5cck1cdTAwMTaxPoBZSkjdM+D9aJ2uR+OAz7RzqLb3ITxzpsapZVMmk1x1MDAwN11qLvac+OTjXHUwMDAy0oCCppOYhk6d0bn/zvPlT2tdKu55+cQgaYZzoudmnzd/XHUwMDE1y+97XHUwMDEz69d5+8nnk6ttyonIfzbPuaSBfrhfbr5cdTAwMTLu3Dw6Z7H0eIJcdTAwMTSS8stFnHSixouajoiDmLNcdTAwMDDAcVxiRbcwXd41zCNpiYbvi55ccvZBXHUwMDEx2jBMc1x1MDAxOFwiwGW5dP/6N0vEUniS2aSi6UEgr1AwO4pCdF8rOIpcdTAwMWaRXHUwMDE5ssJcdTAwMDWDv1x1MDAxOMWrbCW2XHUwMDFlTH698P458lx1MDAxZP2LT3njxafYfLUxq6LZJHlKXHUwMDBlT5F0+1X06nhy83GMj1x1MDAwMMnaJGBxOv1oQlxiXHUwMDFh34nCXHKGTPtARfBd+D3HtSdDuT1kQkRFfniRkpTb+vJa8KXNY+H4Xsriryew/H+fo/v/P1x1MDAwN2CTpd1sUnc2kssvqpfq77O/XHUwMDBllk7TR7uK/kKgkLTKnyqXj+HNfnN+2FSw0KakXHUwMDAzvH7TLlx1MDAxNjNGK4udty08O+VgwdbtavvJx0D6SiBcZoFcdTAwMDEg7Cvposy77SPui1x1MDAxNDzt15T2fO6v57V1zO2AzC9y6Vjjb65cdTAwMDZ1XHUwMDA3Wc4ks1xi0otbXHUwMDBipM/GnKKLnHmYNnzRi1x1MDAxYud8V2mfWEBcdTAwMWXrqJhPXak9XHUwMDE39vfCXGZcdTAwMDeeXG7ftLOgzup+VM9SjN+8q4tHc5a8JiZcdFLpXHUwMDBiXHUwMDFiQVx1MDAxM1l9JVo/elx1MDAxN0l6XHUwMDExXHUwMDFkOudDsjnK2F2vvFua8kxThZSx6+lcdTAwMWVcdTAwMDS2/5tcdTAwMTU3XHUwMDFh1oNTODf+PtFcdTAwMWRoOHzcjTy3XHUwMDE4Py4kXHUwMDA1O6ZIPpN5XHUwMDE0L27S4jiim2Slukr7JtFcdTAwMGZT1SCKRlx1MDAwN1FcZsN8NknL32tnftzo+c9HXCJ4XHUwMDEx4iSGuJuvR0RcdTAwMTN/vmrk7Fx1MDAxMVx1MDAxN5v37IuyhDiDrVizqaRMYi5kQGNz/Wrj72dFa7QsrigmU6KaWjNcdTAwMTBfSC5xQlx1MDAxMmu8qTW9q8TxVVx1MDAwZrpWXFyMVY4lWlx1MDAwYmlcdTAwMDK7cVx1MDAwM3KQilGXaGP9otxcdTAwMThUy/r7j1f8Zlx1MDAwNjT3XHUwMDFjquCLXHUwMDAwlFDTgDZcYnX1psWIXHUwMDFh7lulvj5253c/rK1cdTAwMDDRXHKiu2v9cjbA29b+ZmskP7/zcqc9mNdokfVwny6gqpYlXHUwMDBi8ox4I+S1XHUwMDE2TI/1Oca+esHX3zy/9PFcdTAwMTizKVx1MDAwMuvEq9jW9+Niclx1MDAwMOPrq/C4hMr5x4+jS4fN1Vx1MDAwMmT5XHUwMDBiXHUwMDAwXHUwMDE2cVx1MDAxNMlwh45cdTAwMTlXov/Vh6D3VLj/43NIZZbLXHUwMDFmjk53TaCJxfBcYmPftZbGb+FnYFx1MDAwZfio/92gXVx1MDAxZVxc8Fx1MDAxM6477rMuXHUwMDExfXgrmOjqzJq971x1MDAwMMSdW7tB2P/NQ1JcdTAwMTmOyoBcdTAwMDLFT7KlL9j7bp+26Xi8MLssXHUwMDEwk1LRLn7Lv7naSUUup4z9OTJr45hJepnTX338navRRlJFoIXSwP6704lcdTAwMWbV5ublXGKV5NZX8jLgTLZ0hT3PblSRJ8ZLQ7xBVMJHfGvJoTeVxiGzgHn8nklWKS5cdHWORMlcdTAwMDDuk1x1MDAwNMyJ425lUr+gcDFcdTAwMDY8XHUwMDBiiu0+XHUwMDEzQik/n9R1XGYx7HdcZtVcdTAwMDf2VX6xzvpzeUCWfsxlXHUwMDE2mi7A+Yj57Sg9QI+JXFy8XHUwMDA1ZcnTWrpPT0VY7fPoRWRj1Ze9vI76UTo344JTffRtYIXtI+nxNUN0sPyXd5NlWvVcdTAwMTn6s83TgppAXHUwMDFi9VxiiG5ccp5oeNlPW4/ZzUjd8bBcdTAwMWZ2JcyKb1x1MDAxMGEs2Y5Cof1aaL3OunPAoHdcdTAwMDa631x1MDAxMNU+r0XEXHUwMDFihIQu64SBbuk6gFx1MDAwMpMkK+L6O8HfXHUwMDE4XHKRlFx1MDAwZVx1MDAwMKGXyPj0KVx1MDAxN1k2qlx1MDAwYrT5vvulXHUwMDAwn1x1MDAxObcojvzDXGK7fNpIpXBcdTAwMTfdpDFcXLJcdTAwMDJsz2dcdTAwMTFFL409XHUwMDAxXHUwMDE4dFx1MDAxMl4jniQ5XHLTXHUwMDA1okvUR7rBilx0K7YgiGhE1krVXHUwMDFiXHJyYnTVzmYk7Fx1MDAxZvbwloxcdJg40UVTrT1cdFBoXHUwMDEwXnZ2XHUwMDE4IKQ3u7VquZbI551DbVqmYlx1MDAwMD2fXHUwMDE0bIe4mFx03+/pXHUwMDAx8eg4XHUwMDE4XHUwMDA398fl4vtMVcE63HHIU+tcdTAwMDF/XHUwMDAyXHUwMDAwp26zy2+pT47a295rs0tcdTAwMDXu6Vtsi9P79VIk5tSkqZFcZjOGinmU1jqIXHUwMDE5e/RvXHUwMDFlol1cdTAwMTY18cpz1188k8eBumpasI1zrTFywDBcdTAwMDJCtoU6u3Pfq9dYXGafwe8oa0J+JdZcdTAwMWM33Vx1MDAwN7dcdTAwMGXHtePT31xcJPmyn9CuxFNcdTAwMDT60FXRLtch+F1cdTAwMTieodcwJJMuXumS6ySBoE1cXNNM6FSCsleYXHUwMDA3XHUwMDA30Jtd9cMgvXH5RUcnpFx1MDAxN8svPv/Qaskyv2g8ZcdcdTAwMDQ0w0pcdTAwMDOTnV37xyftNu99pWGSYS5cdTAwMGZGXHUwMDE2XHUwMDFjweEuR8dcdTAwMDbZZ9TfKzPCofFK7/mBanvHXHUwMDA1wm1cZpOwUSBcdTAwMWH2pZhAtnCSRDtSwrTSJy2W31NcdTAwMTHtWKi744V6XGYll1ODwFGqXHUwMDAwXHUwMDFkYlx1MDAxNdFcdTAwMTlRbju9QOfPjoXHq1x1MDAwNC+WimHIvEXQup3vmEY+0oRcdTAwMTL2XHUwMDA1N9KTKFx1MDAxNYyi7Tt29GSsn27gYlbFOqdr/81cdTAwMTm7MJOGQffg8zCHgbNZ3Fx1MDAxOLBeiFxuUK26d1x1MDAwN4NcZnmnbFCzwoMuf4Ph2kv7w1x1MDAwMDNpPPm+XHUwMDA1XHUwMDAxJLGR5vxcZoXkx0DPe//pUSCYIDBbqZOKPNRcYm274Fxi0pPS6ut8rGeyU7ifjpVlQ1BcdTAwMGJcdTAwMDHnXHUwMDEw4yFcdTAwMTTz+fg8mKxP/zA0cpaLXHUwMDA3w6ibLevTdH2TzuLwglx1MDAwZv61/uKC7Vx1MDAxMJioqkK+xr1cdTAwMWOjh94wo8T9vJ7kQaKoQJD6y+xzXHUwMDAwf+Pcp9n//HDFKIuH+lx1MDAwMrpU0lx1MDAwMUVzXHUwMDEyOm+iyp5F5d954OpcdTAwMDU/2lx1MDAxYlaXm+s+XHUwMDE3zEc1Klx1MDAwM8Mv+iReXGY5W0PUNPJcdTAwMWR37r3ltkWagpJccuiA77mAI0cv5iOEl2BcdTAwMTPl0EaGXlx0knJ9OaJcdTAwMTRrmCEtk1x1MDAxYojhkZ+4VFx1MDAxOOmHrp6eOlx1MDAwMDq+wO2/PntmTCxcdMWTS6y1JojIXHUwMDA1ytFcdTAwMDVxllx1MDAxNqxOhCOQNZiShzrObtItclNqrMLZ7O2Ov2yaKYP3/DR/+fPoWj/iS/FcdTAwMTl6qShrpeiXq9NUsKCTOFx1MDAxODrifFx1MDAxM3I2zW5TP618+2ShXlx1MDAxNFx1MDAwMEZcdTAwMDCYp3ZJ2zHzXHUwMDEyrlx1MDAxYpTtQeLQNMv+4TojS+dDaFxiVlxife9cIkbyjFwi8FnER1x1MDAxYsynmMYz+Fx1MDAxY8N+uv6jQj/O+1x1MDAxY1xcXHUwMDA2Z5DZmurBT/OIl2UojIrRZzZSdkUkczJPcNaQ8HXUfFNIYuyhT3plJF31hJS+rWy7nf38IYGLTetmWLjyXHUwMDBiNlx1MDAxYlx1MDAxMHgpbk5cXIfoxe5/9nYwYUp74vgpsvVNXHUwMDA2gOFcdTAwMGa6XHUwMDAzxyF9gep9N4TzoZbscirMdXRcdTAwMWPPZn3zrlx1MDAwZuPQXHUwMDFizy5Rcde60zld/vS+XCJbN1x1MDAwN6w6dVx1MDAwMVx1MDAxYqlsaTlKeP21vkH6XHSvxJCpxqudNNdcdTAwMTJcdTAwMTdcdTAwMWV5XHUwMDFkXHUwMDFiUFwitlx0blx1MDAwYvXVllx1MDAxOCd6JaFhXHUwMDBmL1x1MDAxZVX9L955+fxccmIv+TVKqFx1MDAxYcB3bMkslFx1MDAxOMYzX1x1MDAxMY3XMW1cdTAwMTSCY7E88oxWyj++wOo85f3LeVx1MDAwN3c8d6viN4LGtWiuXHUwMDE3eHJynk9Fh5VfNK+UTj9Xqc/mXHUwMDE32orZpYO291MzV3iHt9UwXHUwMDE1NuS1XHUwMDEz95KDXHUwMDBlMqX6zc/jrPDyXHTXmcpU9Fx1MDAxMKSdIOxcdTAwMTN9f1x1MDAwM+vrXHUwMDFhhlx1MDAxZqIm8tfDmt1js3/yNFPSjv3rg4lvm1x1MDAxM5BcZlxy+Fx0XHUwMDFjwZhcdTAwMDDSLC7SXHUwMDEyrjdcdTAwMDdOTHb6zPrhXHUwMDFik1rVT6F1cjBcdTAwMThwz/iiXHUwMDE0jS5cdTAwMTKxXHUwMDAyw5ZcdTAwMDYjXHUwMDBlqJ/jaSl/uoYtmeEhg1m4wHRcdTAwMDT4NFF9RI+0o3bXMTjcrZkt/+pcdTAwMWKA/9nVnW6gmosjM0xcdTAwMDdd2MqiSWaHMelcYpCwbUtcdTAwMWNcdTAwMDNcdTAwMDXN4/HUgjL/6Sog69JcdTAwMTFcZv3PnEJPsYbUkehhWy9cbqo0lVx1MDAwNTi6PoyBRFsukvp+f/6rc84qlsGDWGlcdTAwMTD2v1GZJLNfnVxioYhMlyE+wiG1bjnWf/aM8zMtcv39lmpcdTAwMTB78aw6IVxyJHZ8RFx1MDAwNLM5KdSGI31sT2NcdTAwMDV6q8OKp/piJf7hXHUwMDAz7vAurNDrRK4xgKksXHUwMDE02HTBXHUwMDE45NBcdTAwMTijTVx1MDAxMDDyjp595Oj3/8youjhcdTAwMWRVXHRW21x1MDAxNFx1MDAwZU1RXHUwMDAwpZbjlz07jYKeTV6+7rlFzH83j1x0UkKw7Lsu/pePbax4RkPl7rRcdTAwMTDVXtzmWeXs6fy+hSlcdTAwMTDKJoYhi8xjKauN4uz9x/L0P1x1MDAxNzc+cas42f2L79JcdTAwMDZW1uZ6XHUwMDEwQJhLls5cdTAwMTO25lx1MDAwZlx1MDAxMnNmXHIySqOz/2KZzIvxOIdcdTAwMDQw/oPjdKZoS6D50XRSpOI/Vn9cdTAwMWYg5vFbY/7igehcdTAwMTFjOXFXwofrjOvN+qJcYtVTJJ5cXGH3k/vGijdG6Gfvz7lcdTAwMTBkkyxC/MqWz/LBNmQgiyRZu36woY2Gu8GtN2rWdFx1MDAwNP7M2LAkRcR9XCJcdTAwMTQukPDd/u2rwowsc88rlKO1Q+RlkaxcdTAwMWWEL+5cdTAwMGKPpDGc2rxOcfgoXHUwMDFmZPlWun0kKDXyOjRcdTAwMTU8eVx1MDAxNPd4XHUwMDE1+8RcdTAwMWH12ds3OkNAJTxcdNCbJVx1MDAxMGxgyXxn06f7zVx1MDAxM7lnlTKcQ1x1MDAxNMfUzCSK5JAow24vRSj+ujYlwGT+vqNg9Fx1MDAxY4evRpefsKfMrsReZ0F1nS/grWHuX49IuF/+wcz9wlx1MDAwMExcdTAwMDLBptBmsi+6UVx1MDAxNKijsJCjZvu0yZRUbL1nd3pcdTAwMDBfpNxcZt5cXEWv8NDZbcVfSi6QdKW5flmnan9mj1x1MDAwMTpJf/NzsI8vsan2NvpfrLp7vX1cdTAwMDZcdTAwMDFDXHUwMDBlcFxy09ObTVx1MDAxYj1diYZcdTAwMGYtIF0qoVZmwVx1MDAxMXPjrlBOt1x1MDAwZlRXIVs6mlI3tmN5a+D/zTXBrGvBmGVcdTAwMWJcdTAwMTbLRojk+tmNuo43cv1cdTAwMTaBNCuDXHUwMDEz3W5cdTAwMGZWz3K8q+JcdTAwMDeFwnAlXHUwMDE4JiQpeCq+gsg3Y1x1MDAxNpNcYj6KxlggXHUwMDEyXCI6Y2gzN1xmXHLnsuqy09O2QDtbmlx1MDAxZbX/nFx0nLvPv1jkwHft9Fx1MDAxOc6J7FxyaG+SfMyrN+DlXHUwMDA04nFT3e/40NhcdTAwMWZcdTAwMWQyYoZcXIXnXHUwMDBl/GlZ6/fMmzJEOa/am5XM2+aT0Fx1MDAwNoLcSMhLXHUwMDAxRGJcdTAwMWOQRPWug8X7kqJcbny+iCeJRSHV+1D2XHUwMDFmXCIsdmEzm0xGXHUwMDE4LHnJrGksT1x1MDAwMNDc4UtVXHUwMDEwSlBQiFx1MDAwM7mHytWQYUZK6X5cdTAwMWIuXHUwMDEzM/xnlpHAa8wmuDZPkVlXLLl2LkFzXFya92TajFx1MDAxN1BR8Xjr8cjr2qI4iPdQXHUwMDE26nkgMmKWRDghkqw/f1jecU2pg+rgQt+QhZEhRq101IAxXHUwMDAwyVx1MDAxY0C5y1dtuHT4ny5YYq/qgEuFfyeCzlx1MDAxM7fKqueGN1x1MDAxN1deXHUwMDAwL2A8YFaD9KQ8X+AyMG1QkKG190Ccl+JHXCJKXHUwMDA3QbC3L/XxxYHFkXr4of7LvzyMSmXcojYyx7BRUEp4XHUwMDEwkbpcdTAwMGZcdTAwMTnt+m/O41RT6pH83Vx1MDAwM1x1MDAxMN38VP+kK/6uR2ItcDB5OHt9XHTg+fMvhlkq0OWWQyzDXG6NJfv3tVx1MDAxN1xuiMFiUuFk5MPgK39sjVx1MDAxZtPViF9/VblRXHJTJKxfuVx1MDAxNMBJXHRUyEg4YVx1MDAwN8GDXG5jxKbPr0BcdTAwMWbkc09cZiRccmVeqPxjM1x1MDAwN3vzVLyMYYqIZ3rUSa1cdTAwMDVTesQnXHUwMDEz70NcZqGW9Dhen39xgNtezNKtXHUwMDFm0jy8SHwtmlx1MDAwM5kmJNPIb9bRXHUwMDEybrDkX81cdTAwMTAztq3JLCxnlKIlZOOTVF8/fyYoj4vLq1x1MDAwYlx1MDAxMGSTsFx1MDAxNopcdTAwMTnJma2DOc/MmfIuXHUwMDFhXHUwMDEw0Vx1MDAxN5ouYiNoXHUwMDFjJUroz75F49lnuyfZ0Io9VDRtTVx1MDAxNGwot8F1REDs3Fx1MDAxOedCzKo1LWjw+TSm7i2h25pKIEbUeDdcdTAwMTBcdTAwMDeMbG9iJt2AXHUwMDA24s+TlNxoXHUwMDFjojWe3ERZXHUwMDBl2vnNIbv2XHUwMDAzq1x1MDAxNPlccphcdTAwMTjhSzPgftJcIqBfXHUwMDBiUql5XHUwMDFh0VxcXHUwMDBlXHUwMDAx0S8maSv+7U8mtFqruUL10EzRpWYl5zmUXHUwMDFmT/yLhd7iZ8T6M3w+Nr9onS+CUJSAurM2XHUwMDFjWGdH0lx1MDAwZbrdkNBcdTAwMTb4gpdcbrKWms5cdTAwMGbPZT66OSmNjlrBhHRMgcw4XHUwMDAz2J2MSY605jBfXHUwMDE176bLnoR+IdNB2sOIas/eTMTEelPQl4TPXHUwMDBmkIPG5Vx1MDAxMfLhQlR5RYdhJIdKjP71Ud9xSFldlfw68Fx1MDAxMFx1MDAxNo01SNFcdTAwMDJaoZ6avZmq4nBIRlx1MDAxOeouTvBqvrpgXHUwMDE3kEppiflxsahiX3mTT8pEm6PPOlx1MDAxMzgteMymhuQq4Yg/XHUwMDAzXGJtXHKPS1x1MDAwNtBgjPhUXGIs29qFSPH9oK6qXHUwMDE2XHUwMDFmh/r7/lx1MDAxY1Nu3uJcdTAwMTNcdTAwMTNcdTAwMDVcdTAwMGZcdTAwMWE69CT0KdaZXHUwMDFjX8iMNIcuKS10/T1f3vvLPvqNXHUwMDA0Jjjdn3Omdyq7jCr5XHUwMDE5XHUwMDE2XHUwMDEyS7w8MKDvOFxc5/3pVZ9/98/Yincyxpik+PKmRal524uFgK1cdTAwMDU1ff5tXFyvXHUwMDA3XHUwMDA1QoYqp4R/s21/tfRL8/AuxvAsrMlb7PuOiVd5nUtu7acoS6DslXyz+P5lny6C1+vSomv1IbR9jMDxPzX53OFs5Taehi5cdTAwMWStM1NcdTAwMDRojzrF4I6DXHUwMDE5fppTXWi+jdqQXHUwMDE30/mrf+vKXHUwMDE5wvW4XHUwMDEzkVO7ed1cdTAwMDXJXHUwMDExkyE6/1x1MDAxOae/Wr32eVx1MDAxOVJcdTAwMTi+XHUwMDE3+/Wf+OCvx6FnSf2TfZpPkoJLhFxmfFx1MDAwMsFcdTAwMTb6pd7mmtKnethcdTAwMDbR8Z+fRtDq8I5z9efejGzLXHUwMDBlMfhtzL+5bpudltf30pL/l3/5V5/dyVx1MDAwNsfhW/1+u1x1MDAwMirFgb7MuLZcdTAwMTQ6XHUwMDA1OC1a2K8q43tIk3xmNO668ouWXHUwMDFhXHUwMDA2Pj5bfl1cdTAwMGYzqyf5l5+46+RjWbfJXHUwMDFi55h/Oura9eyQ70BjXHUwMDA1YlVcdTAwMDZgSbK5WVx1MDAwZnuoeXqgLNvG49lld95vK/+j2/lvXHUwMDE2xkf461XhOjbevcjZt77r3o5cdTAwMTT/w6M/rVFhXFxcInxHjZ87+kC5hoSQM7NW8SwvQqmt6klcdTAwMThcInzPXHUwMDEy0t7WRfPjm1Cv5WEmyvT4vff9zFx1MDAwZbY4LmT975mlXHUwMDA3q8pVpoJ8suE5dHcpXHUwMDA02yxcdTAwMTB711x1MDAxY1xmofkwcmuL3L6s4PeRvLFjg6D+9ea2N99qUaFV/3NcdTAwMDfOva/P9vnmnC5LeVx1MDAxOKVcdTAwMTPRJLvwa13avsj4M6n2v1x1MDAxZfeLRpWP/zxkbZzt+8cvVF5cdTAwMWLOuMdcdTAwMTSW/y8nvj/3onItXHUwMDBiPefIXHUwMDE0XHUwMDEzooIzfKpXb1x1MDAwNdTAO7VcdTAwMDGzNtKw2L/22aB82eCT7jiyp/BcdTAwMDOY/k99t1x1MDAxN1x1MDAxNVx1MDAxZFx1MDAxY1x1MDAwNtFcdTAwMTfe0Fe20UBcdTAwMGagKOJcdTAwMTlQcYH7ssLZ2/PhdKNcdTAwMTNj6NeQhpaNdL7f6bNDXHUwMDFmuVx1MDAwNoLHm735XHUwMDE0z3xKRSuVSPo/z6hcdTAwMWPMrlwiL02Xl4Y4u1x1MDAwNY6z90Pgi+mArLNpVlxuzOp9if5y9rKliHaJyts0N7z1XHUwMDFj2bxvRvfig3VKPp6/+k7mrmW9VNCj9Fx1MDAxZf/yfX9565W1hKd4XHUwMDE37L+2XHUwMDE4JLxX4lx1MDAxYsCaXHRaq1x1MDAxZVx1MDAwYvfnx56/kFx1MDAxOZq95EZm84I2lkg6XG5nXHUwMDE42/yQoEye/tWE3JrYfurVKvy7XHUwMDEzhPnrObvnvrr5a1xcvYVaYFx1MDAxZrrnoFx1MDAxOX5cdTAwMWNYbaZcYkmZa1Wpsee9/1xczEVcZv4u+L9cdTAwMWVx+665XHUwMDEwXHUwMDEw1PV45r/P/KuPNmQr6OSdfINDNKpAcTpcdTAwMGZ1fvVjs8u+MjI/qXWd5XdE0jD717ty39XBstNTrpX/nYWP12BGRF/bJ+zBXHUwMDAwXHUwMDFhXFz/XHRXn+pcdTAwMTHCMnVKgKDv03O/XHUwMDE30LXWxDN/fJBRR67Z3pOD3feUODdmKIlcdTAwMTdEnvf3fH91e+L+TL13i5P0xELgKTVwdmFoS8mh6yxcdTAwMTb0uD6v/O/n1c22TO7v3lx1MDAxM+P+PFwisfzn//08TX5cdTAwMTJcdTAwMGWGWSFNs5OF4I5cdTAwMDdAjGjryjGGrvrXq8z+elx1MDAwM39cdTAwMDdhwfbhMf41iKT33tNcdTAwMTTyXFz+syc/u1x0vIf3Vlx1MDAxZONy7UPixvRcXKj6tPdcdTAwMDRcdTAwMTA/9fYrWV52XHUwMDAx6IO79+BPJVx1MDAxNntl6NbvXFxq1INTWFx1MDAxMv+E8X9i5r/1fFPu+SClMUBcdTAwMTG0nUCzXHUwMDA3XHUwMDFjYo02VaPbJ6uXlfWL6Yn/xZSGXHUwMDFmxDb7+du8vnBAh1Sd/5///dkoV1oulVx1MDAxZt9cdTAwMDRLelx1MDAxYTX74JhxhFq/hNVhUCT/s1FcXKj/6f6LXFw5abL+8ohcdTAwMTl26X5cdTAwMWVFR2x5/Ls75beez5d9yshD2tquXHUwMDAwc5Xcyfn/4+u6llxcRYLsXHUwMDA38YBcdTAwMTPuXHUwMDExK7xcdTAwMTEgzFx1MDAxYlxiJyG85+tcdTAwMTfU13XP7kZMzL0x01xyRVVlnnMys7KwXHUwMDFhyIxIbCXrPLP+d22Wdu1F+quXRnHmZVjQQmiL+TuXTJ5a6mpcdTAwMWL5eMtcdITaXzPVM8VcdTAwMTbh9vbIXHUwMDE30UpcdTAwMTIm53ny+f4lt9lk31xyLbM/d1H18jGu+S6TsbT8tX+WW1JLfFx1MDAwNTmri8ab8GD4XHUwMDEywTZcdTAwMWFcYlx1MDAxNJY9X3KRmFP4qZVj6CWX7ofnXHUwMDA1+6lJzJ5O7sCrw4iq8ryIOPTvXHUwMDAwekldXHUwMDEz71x1MDAxMUHBXHUwMDE0mEDDrOaM8SWQXHUwMDAwtqDeRlDkXHUwMDFj0b5kYy/7q1x1MDAxOSHgllx1MDAwNNs8UtNcdTAwMWPYxJX4XHUwMDE13zaeqyXbK0q/IE+C9D+2+JVLLi9cdTAwMDexXHUwMDEyIJlApv7ZXHUwMDExt2bvxO1cdTAwMTX6c9vYSKFzkHj8qC08XHUwMDBm6Gj0UZnoKZqyYypqlKtcdTAwMGY9cu5cdTAwMWSWTqHDluRcdTAwMTb4i69n7olcdTAwMTbp21x1MDAwM5pA8vnKwCXmvGuL9Df6+ZbOelx1MDAxNfP63O3F6rzD5M/8UGI1xq1kfEohWeXM0ZRufy7ZyMPccvtn74eSXHUwMDFmMehcdTAwMThzflx1MDAwNXdcdTAwMDa0WOR0n1FSmctW3zwxRcri04dMZv+JkUg134+fZ5DP8NhyXHUwMDEw6tVfPbp+++6SXHUwMDE5XHUwMDA0XCKKS1b1Zz1cdTAwMWKbXHUwMDAxhieoVUM4k1x1MDAxZNfD0ug8xP85f2z9wkAm3UJD2r/OvpGnrWGY59dfe+PXc19cdTAwMDc2ynLlcXOHXHUwMDA2kk5RcHn2gF+bV5OW8Vx1MDAxOat7XHUwMDFk63CGKM+8NLbKxCf3Z0pne+pEhDPkmf8zpyo75PJ0vHSwjd439YSUdWp+o12BUH2/uetbVtu1+jxDbFrr16PRx+RcdTAwMTTk111cdTAwMDHHp1pcdTAwMTaT8lWg5f+uXHUwMDE3RjtcdTAwMGZUo1xu2MF8rlx1MDAwMsNgfIij+Fx1MDAwMt6ATzT2ulujzp3AOi5/4mFnnWbAfcr5n/zp+6TQwpj875zmPEPk6VxuiUyLUXlcdTAwMWNcdTAwMDVcckWMnlNgXaNoLyn9fW9cdTAwMWVEXHUwMDBmf2zWb5dLLH16XG66zqk/Ks5cdTAwMTXp/Fx1MDAxZptl8zpg49fTtIfUuEbDzFx1MDAxMWNA1FxiNLeOts1PKtRhSGS/zvrrXHUwMDA3XHUwMDEx+VAs/IqnqnJcdTAwMTZcdTAwMTNIXHUwMDEy9UWCskHUrX/9Km2XXHUwMDA04UbN455OzfzO5lLsY/NcdTAwMTbr9mZgtDtcdTAwMWQj5NtmOP01+sdfqyM29Gfu7MyjPz45l2XAmG8+S5RY0i1cdTAwMWEuXHUwMDAy7S01ZkihYVx1MDAwZb6rvv10yFwil51cdTAwMWJ1+Gtx+lx1MDAxNe93LDGb/Ss/fmHA6a85Ym2R10FcdTAwMTb/+lx1MDAxOdWSMV5uNufAs9h4Lt6UtVNcdTAwMWO5bEDwY0+9Pn7vq0fNZ1x1MDAxMzg2KFx1MDAxNVx1MDAxZl16XtlJq1PsNd7yz1pxb1Z95kh0l+DXeHrOm1KNSTuF0WZcck9reim45biCJKZ/xmlmXHUwMDEzeuX7zzg5+jxzIzxcdTAwMGW28FxyV0bI2bSLWjttXHUwMDAxdC9cclx1MDAxMr15hGA4d/asdWeNTSDKpEK2OVx1MDAwNvbh2cdiKSDHt+Sn3po9Y/hyclx1MDAwYr56h/9aKyW38mPsxFxyRFx1MDAwMVx1MDAxNuTgIEu6IVx1MDAxNnLAPfDLeWC//OuhXHK+wKoqXHUwMDAw9ZNXU1x1MDAwNfVMIT620aLKf/mvXCI8nleIa1x1MDAwMbxcdTAwMDThwkbnu2Gwumfdt4Jh71xi7jdGIKk8QH+NkI3Q5atcdTAwMTe5dp5ccmCSXHUwMDFkh2nk3z065He7XHUwMDFj1ShK1oP+wlx1MDAxOWpXPXezhUJn76idNqalJOd9il/zaPT0h7dcdTAwMTbVqaeD6pJsX/1Tftko/eFhifHQx1x1MDAwN3mnXHUwMDBluVx1MDAxZpdjWGHB+tfe1VmFIGspglxyXHUwMDEyXGJjcFx1MDAwZS17SeBcdTAwMDGnRuL+mr/ONV77XHUwMDAzKpGR3FdcdTAwMDRBdkpcdTAwMDaSLI2QOKMwnCBcdFx1MDAwMF+pyde+8MUpXHUwMDA3MNq5s6lcdTAwMTQgXHUwMDEzXHUwMDA3K7j111x1MDAwNPDLilx1MDAxMFx1MDAxOXVcYqavnmmd86lHl6PabP7RV8pbXllcdTAwMTHSdFx1MDAxMJzBYFq1xVxiOlx1MDAxNlx1MDAwNFxmXHUwMDEwb4lcdTAwMTBNlsNucNI6ZNOdtVx1MDAxNeZcdTAwMTC0etBJPoM1wpVy/ZfbNY3kK1x1MDAxZHNmXHUwMDA0Nlx1MDAxNElpns5lSXrmXHUwMDA3XHUwMDFiZo+/50CZ3FxcgdZKcZ5cdTAwMDOiI8BcdTAwMTLUy8du7Fx1MDAxM6FcdTAwMTFcdTAwMDOhUcNKXHUwMDAyO2+GXWR2JXXfXVx1MDAwMnTfM2VcdTAwMDLBXHUwMDFlwutcYqAz8q7dvXFQr1Bw8CBxPCvcmEaOXHUwMDE48vZUTESy7JyltPNcdTAwMDJXXHUwMDA24zBAsr72+eW0x77BoEa2/vo6yFjY6sbgRD1WlVx1MDAwNDxGijZcdTAwMTKVyuBeetxcYlx1MDAxM2WnzrSEg2+LrXPbcnghalx1MDAxN6DKXbOMaFxi3F93U/DMoYOUoJa6b3wvapT0YL97OPmkmVx1MDAxMoC5LT04LIj9ksz2Zd1NX6mZhWGu0vAxd1xyiiCOT1x1MDAxYsbST1x1MDAxZsRcdTAwMWa7rLbo7z40tzYptkpcdTAwMDK3wZq5XHUwMDFjnlx1MDAxMnCl5/QmkYQ93HJnPzrF0lxc/o9N7tHDYPhPnvXQWCzOdvmjbP5y+8P8u7y7NHopQJFggNpj9XpwWrG+tO9cdTAwMDTLXHUwMDFjvCdxXHUwMDAynr/mXW5cdTAwMDdGI6XQXHUwMDAzL9962VH1XHUwMDBlXHUwMDE3kO1eYlx1MDAxZOtkRKfY63V9vSumWNlKJJ9BZr1cbpHBWERwuJo8a/+Zj+3AkLu7bv5tXGZ0zvtWP4BlhFGXaMZcdTAwMWSSnGG1nJSQtKpcdTAwMTZnLVOTj2meo1m3ad9oqUOJVlxiSLrXrztcdTAwMWSAM0enuyiWN9K/ulx1MDAwZb6Jgc6Y+EImIGrsK1x1MDAxZYzDinctWVx1MDAxOIVsZpb1+nyb8oU3RWVxmeAqqX3O11x1MDAwNzNFP05cdTAwMTjr8Vx1MDAwN1x1MDAxMz4xjskqXHUwMDE5p6F3ML0jhzBUxehOwqX8ulH0Raj437z4ile8SyVnzFx1MDAwNjxjXHUwMDA2xjTvdr7+9Vx1MDAwZux5+p1x6Fx1MDAxN7XcQF33QGKpPeRcdTAwMDH6XGJZKIxsPvCz942uWn/0lbVQ6+dcdTAwMWXl2p1PnkVBsMT8w7Noy97o6cJcdTAwMTQyb4CG0O/qXHUwMDBlTtRcdTAwMTXp0YbbUNHSV6Zh/mj3orpcdTAwMWH1R5/i7/Rwsy2AXFxw+5O/+z1GernbXHUwMDFhwMeveUH0mpk18MGr9oxCXGIgQN1VP/i7auVQ/4dcdTAwMGY5XHUwMDFjV5FdcfBcdTAwMWbO/uhcdTAwMGJrd/P3N/5qSrz2MlxuXHUwMDBlfKWqip6xxS5cdTAwMDRcdTAwMTHAfj5d88DGKS+P3/3N3bmk5I3Yfl5cdTAwMGZccqSd/Vx1MDAxOVBH0G3+n/U4NFMhZTfGx7YhWal1cnr9tvpQYcqHoLzE7Wn/Mv/HJq7Im3fXx7nu5Om312p0ol93tvxaXHUwMDE3i/fpvS7NcbpcdTAwMWEqdcGzurhS0fRcdTAwMTDwd9tjcXppJcmq3se+/Fx1MDAxYdNndXRyXdrnyV9Y68Q/LqmGO938Y790rlx1MDAwMCyLlVx1MDAwYp5khb5cIs9eXHUwMDA318C8XHLP1MPbSK3DT7MjgfubXHUwMDAzXHUwMDE3XfB1XHUwMDA2rFx1MDAwZVf1qX/gNVTFvmJ0v+d0XHUwMDEzxm1BW1x1MDAxMTU3ONJcdTAwMDa0VvwpcUNAeyp8W5NcdTAwMDdPy9lfZMJ6OazdWdohd+zp5H5cdTAwMTdcIlx1MDAxOHVX+7s2XGZcdTAwMTfIXHUwMDA2U1x1MDAxZLZcdTAwMTjuuFx1MDAwMFx1MDAwMqpsXHUwMDE271mfXFw1ua7qVmLx2zDyitVt4lx1MDAwZk9XXHUwMDExM1x1MDAxOM57jVx1MDAxNF11z7jFa7SBf+JU9KnYpsvopCzcgckkUFx1MDAxZI5B3i2B4nBozUKv4aZcdTAwMTfYg4/jXHUwMDAy+8t2XHUwMDE0Qm3cqThtJ7JcdTAwMGXbkaeqi8rmX9uxhCAnUY5l3DntKzRcdTAwMWL5W1JHgEWsXHUwMDAyXHUwMDBi7ZDVXHR/+elUXHUwMDFj+/X0tXLLnnFcdCXsQvvfuMThxo9lf7exk1/6OqI6WIX1jFDeJfiWXHUwMDE2tT15h8JOXzGTM644dpsgXHUwMDA35/lcdTAwMTDjPJOqhP3j2f3QJndJJdPCTzFgdN5cclx1MDAwMEzDjDZ+YbWl+cu24bOB5S/bRq3VZ88z0yXUnjm8t1x1MDAwNlx1MDAxYu2pU77ZNnHY9lx1MDAxNclcdTAwMDBQpeIqU+FbSb0963BJt1x1MDAwZtdX8uxcdTAwMGZ3Npuwxyz3+L3o657Pd1xcO83ru35cdTAwMThLuDk4ypSGWD6oKlx1MDAxMd3MTl4k2amHdVx1MDAxMUHLZqbid/yQnZ64oEhn345refbtiMepalxy+l/twKbWNagodcXYXGZMQmxJtlx1MDAxOdiaRrDI/FngdiCtXHUwMDAy/ouP0Tg1XHUwMDE4Ln32XHUwMDE5XHUwMDEytLNcdTAwMTZcdTAwMGJNMt1Jf9p2bJfvyTzAWaFDXHUwMDAyqFx1MDAxYlx1MDAwZbCxdZSJnIxcdTAwMGatxrtfWjSiuc6zMJ391Fx1MDAwMr1cdTAwMGZcdFc9cfpfXXN8d7VcdTAwMWPi1ji41+WBY504d4i/Pa1GlK/TkzDG4IzvXHUwMDEyf+uyXvq2tPyXLj6hWE+gf/zYmU9X2WM3iVx0VExMNlx1MDAxZvKv80iNulVcdTAwMWVyO4CrwNlcXFlcdTAwMDWpIGhcdTAwMGWykVx1MDAxN/NcdTAwMWXJe6qiz1x1MDAxMVeuXHUwMDAysDrT20xQXG5cdTAwMDVUv8tcdTAwMTYqWdb72F5STcD0d7CCoEdeUHV+wfZspdT7tSHHulx1MDAwYv1cdTAwMTRTXHUwMDA3udOJ6lx1MDAwNdfJWqGFSS1JML5FPPyKXHUwMDE10Zo6MWTWpL7P3qbLMyqjb5ij54KWk/Vselx1MDAwMuC3w0K6yoQkkt/meksmwL3Bjk/mlfNcdTAwMWNZvEjvc2r7mVsutfWJn6Znz2ft0W8m/21uOXtbXCI7hiZcdTAwMDJHeqpcdTAwMDY7ZVx1MDAxYzCg8zdPq1x1MDAxMtpAjbvX21x1MDAxZm6vNo47LjzP+ZjNVuedzpB2+ihWR9X+k0v9XHUwMDFiezy0RFuFkEFFmp5cclx1MDAxNIb2sZ5GROpjeXTji1x1MDAwN2FGXHUwMDA3/lx1MDAwNcLyx8dd1pZcdTAwMTU/sZ3CdVx1MDAwZiyb2lx1MDAwZa9/5f9/86j8vGIms1x0jlx1MDAwMlNcdTAwMDTMJPkumvgrU1x1MDAwMfYtb1bUSfD9PPj1R9vg52WV1XJixvXEjLAq3niT/4NcdTAwMTmMJVx1MDAwNYLGcuisgOCLQDO37Fx1MDAxOYK4XHUwMDEzXHUwMDFiKvfW2qPGiYn8XHUwMDE2/nKbNFx1MDAxNTxcZpPdjFx1MDAwZu8+/Yq91Kv5Y7/myznOW8pcInHbKMbkPsBDjVpgyfHDXG5cdKLlXHUwMDFk/u+3T2KTXHUwMDAxXHUwMDEwheLDd+VPvVQrJZj4L1ZYV1bKxeHSJD5cdMRcdTAwMThiZG+FikBcIuQ69z0l8mNcdTAwMDLW01x1MDAwNpxPzv1jXHUwMDAzvTHZlyv9Wfro/HbIe67q8n2c18XdNFxcSFhcdTAwMTO5ioe7a1x1MDAwNSRcdTAwMDeLS7+jiVxc0dNcdTAwMTO5nZo4+LNG+m2c/E98gFx1MDAwZc6AXHUwMDExdX1cdFxiQzLf+HNcdTAwMDCxU1JcdTAwMWLwPJPrI1x1MDAxMXpqJjzRm8psK1x1MDAwMazXnWt+2JdcdTAwMDT/qT9SiPBh6F97/JpcdTAwMWZrx4hcblx1MDAxOVx1MDAwM990bZ5r/JhcdTAwMDfWNC3bXHUwMDFhNlx1MDAwNfquO1GH3fqylYPDsWk5sPqN/1x1MDAxMy99htwr+DqzXHUwMDE0rHyeM7h6XHUwMDFkXHUwMDFl32Iwx7yUhVx1MDAxOKtx41x1MDAwMEGYUKreXHUwMDE2aHHwOFxiiUHpmLB7ZeTkwVx1MDAxNXT3z37qdkKbvjTicv/0NFx1MDAxMJXHbWG/jbXUeGhcdTAwMWFZXHUwMDAwXHUwMDAzXHUwMDBljlx0NmNcblxckDo6uNeaSpVV6Vx1MDAxYyTkXqP+5lx1MDAxZnf02Fx1MDAxZf7lXHUwMDEzXHUwMDFm3emzJ4hRXaB/4vifuHYjt7zZYMpjRp07uVx1MDAxMEvcXHUwMDAwXHUwMDE32CNHk2kl+8Ge2/uvfuh2XHUwMDBmN86+Zcc443OcXCLvPFx1MDAwZa797Zl0I0CHXGY3a7Ry6t7JnbRcckBcdTAwMTQhX5t3wdlMXHUwMDEyaPhcdTAwMGYmKY2uQvhcdTAwMDcnX8LBOcWOzIvNpL9hXGJzo53sZSRcdTAwMWP5gIFRJ0DCyO/UtOVcdTAwMTKNlql2XGJcdTAwMWSNLlxcX/rl99X+uVxcXHUwMDFh51x1MDAxM2dpXfs8n/xmnT/1+L9jxk+JIejrtezDcIxzXCKJ22uCqbBPg1xic1BFq1x1MDAxYY414v+ukbJ3pcF89VmyT+3Et93jefkxn4FcdTAwMTTK8Vx1MDAwYjFcdTAwMTRcdTAwMThcIlx1MDAxNuF+iJvRvWA32kzKeOPL1Fx1MDAwMYZjTlx1MDAxNzX/89x1RzSD/tJk6vncay8/3j+ey1x1MDAwNUp4XHLZiHx4xJL6dfHWqzl8c5l9PbRcdTAwMDFwN8ScXHUwMDEzLb56K/kymdJ9bklp91x1MDAxNU1/dF5cdTAwMTOxWTCkXl+YXHUwMDE3XHUwMDE3wzL0XHUwMDAwYuKJc3VDJZdV5UVcdTAwMTlWnJe5PvtqxjBcdTAwMTTVYu5ZuDhcdTAwMDB3a7RcdTAwMDa9/1x1MDAxZoypsyxevYlB4ke13qKveq1PjEdwuVKg82/28GZiqVx1MDAxOFmbXCLN91xuheNBMtVCZ4Fq8Uf02LXH1lxcWdi6RMpcbj2495O0nrmOx2d/r5eY849Pn1x1MDAwN+1cdTAwMTad9bLwXHUwMDAwc5dv+saK7I1FMSnURVx1MDAxMZ3Lh1iqLnG3JLBcdTAwMDRcdTAwMGU4SK5cdTAwMWGsq147nj6FXHLXsKR3mui9y1x1MDAwNew/vOB57m2ulfLvY4ZcdTAwMDWHLlx1MDAxMmby04JGXHSC0DQ0XHUwMDAyxVx1MDAxZKa2pGRcdTAwMTWhR/L20Wu/NIRQclqCI/ZcdTAwMDExXHUwMDEyzcg3XnCngb/qyf1cdTAwMTCHwvXUf3HneC17+eYjXHUwMDEz27ZS51XoXHUwMDAwSJRqfKm3XHUwMDAxXHUwMDFhrlf8xSTKb3xoVulcdTAwMTfXolM4ZIrw04OS9c65XHUwMDFlXHUwMDEzp/J+jJs7XHUwMDEzwDoj+lmQOj7YW41HeWRcdTAwMWa5UmBVNc4uXHUwMDA3Ob1cdTAwMTRcdTAwMTh9cFxiwO5IxrdpNOTQ3i1HKJSA+Xl5WMJrIzXzYS0tilxc2CvfrCNNnLz0wE//cFxi976CcaVcdTAwMDU0XHUwMDFip7/Z6Vx1MDAwN5/sg5ypXHUwMDEx4Vx1MDAxOVx1MDAwNG5rtVxuq2j1TtSiYCOnUenu5FJS9j5sM7271DP8VcuCn1xiLGTiO9ae33ypcDDZkz/Kg5l1LpDMKoxP74u9d64+RFx1MDAwMoSc+oixP/6Za2fWwipLfjy0dPu1jt2hY4/1fi8m/Y1HXlx1MDAwYrrFS1tcdTAwMWNcdTAwMDHc8CvQobJYnCNcdTAwMTRzjfb0z8Rh+4et/8an0FrcQ3ie+60649npcGhcYof+7p9cdTAwMWLto2MxXHUwMDEyzy4+WMrLzM0jgVx1MDAwZVtcdTAwMDCZXHUwMDA3b378rVx1MDAxM1Cvdj187jTmz/5nXCJ00967/+/4jv1d5G1cdTAwMTmWqllhXHUwMDA3XHUwMDE3JNCDb7E5XHUwMDA2s1x1MDAwMu9cdTAwMThcdTAwMDdvLqVcdTAwMTdb/NbEerF8Ub3w7EXHPVGu+q5cdCM+OuNcbuNYgCTubnDxpnyl5zb+ib1cdTAwMWbAifGHXHUwMDE50r/jrPmhjT5cXPtycr6VeMNcbjP8861cZj0sZ4yoKt+AdcE7UIzu8eaZ3vg+/rBVhYdcdTAwMGV7UfBcdTAwMTeq0b/zXGZcZml+fl9ez7j1qzZcdTAwMGZiXHUwMDE3fIv5hMfupmOH4IH366yafKCPi3ODk9htSutdYVSknvn2/NSUXHUwMDFmgNNcdTAwMTCRPikow9QnXHUwMDBmMdSHXHUwMDExftOuTJOcgXezg4Ckh1x1MDAxNyxtwchr7edcdTAwMDE+4USFMFx1MDAwN5r/fDNf/H/ffGLJ+9DjxPWBcZft+iZcbmJIZu2G9OHlrVx1MDAwMqL39Fx1MDAwMuzwqVx1MDAxMj1stNhfTEQ7dsDEzVx1MDAxNkWYddVbOPF+xTpWksS+c1xc+1x1MDAwNqdcdTAwMTFbgbvimTdcdTAwMWPJXHUwMDEwxY/NXHUwMDAwLMZM2V+GV9RcdTAwMTlcdTAwMDRsXHTVcmvmVZfpJTx/1VxmdeqZ9vD1Tf3GN1x1MDAwZkCWc55/nm2OLsdn4lx1MDAxN5xMpifX+zE7gLxbbD2hXHUwMDE1kGaxu0Sn48zLjTxefIGBPzEs7nLsdW6NrPHr/u9/1lqxeJTfe1x1MDAxN5T1tE8gIO01XHUwMDFjnpCm0KhNVHw3VcFfeW8mzDuTYfb6blx1MDAxZPTbKFx1MDAwZV6kXHUwMDEwO9M5l+88XHUwMDA2qkv5XCL3WS3uYzjV8LNcIuZcYlx1MDAxYt6XZlx1MDAwN/VcdTAwMTJcIkd4YEUr/Lt3dH16ftqxw5+mlnai317C7Vx1MDAxYp7T+bSFUKdcIuBM1IgvsrA39ll7uVx1MDAwMpZweZZxXCIpMC3pZ87ol74ul1x1MDAxNema8oydfY77tVx1MDAwYixcdTAwMGXf9XXkXHUwMDBmNJVznFxyd4lcdJVZlkglXHUwMDAyUpTZqY/9zqqMY1x1MDAxY2Nfe535/VhcdTAwMWRcdTAwMWVcdTAwMWGMwKWGoTOrtCw98VNYiL7lpyxnY5xDXHUwMDA0VLMo1Fx1MDAwN7pcYlx1MDAxYfzAZ1x1MDAwZU7G4u1cdTAwMTbKXHUwMDE5a2ZQ5G1bv/1cdTAwMDVcdTAwMWKHx6ucY1t3gnbGlvHYeX7dffvPOt1cdTAwMDda2NOS31/zRlXGc49jashcdTAwMWFcXFx1MDAwMisgcOFcdTAwMDYoi/1ProLLRE9JvZNz9GdcXNP0o0drxd99pKDTfVx1MDAxZO5jQOB9klxyhIFcdTAwMTiPXHUwMDE5ScpcdTAwMDJYnvc9PuiQnluR94d3dcfaXHUwMDE3n7Vnzlx1MDAxOMFcdTAwMTWnb52lfOfbhXSmaFhs5MTsXHUwMDFhO0D99mCgRZ+Ymb1cdTAwMTRbZXnIj+y/dVx1MDAxNMx4OdTpuUdcdTAwMGY2d/g2OmxuSvdcdTAwMWR3zlx1MDAxOFx1MDAwMy/bXHKrT1lMpeDY9HA8Tm2hyK5cdTAwMWVdPn7jcPd/OCdcdTAwMWQ8XHUwMDEwwZI/3OHMTTZ8VFx1MDAxZeLtR977vnHbXHUwMDAxJML9eCSSwkhd14eTe3bWgXuPsDRcdTAwMGUp9nt96DhcdTAwMTZcdTAwMTjnzLFHZ43KlF8jmO0+/v3f9XnSrVx1MDAxMvkmiLR+XHUwMDFjo0IwV874flxceO19UbWEXHUwMDExkHI5/ZhjwVFw5dXYPWPqqNNcdTAwMTjGtlx1MDAxMi8w5pbDdWyc09ZgOlx1MDAxMaCAXHUwMDBl47zM1d5SYFMps1x1MDAxMEZjwFB96K/mXHUwMDAwZIOUmlx1MDAwNNSyuFx1MDAwZT/Rdv+qnVx1MDAxNq06gPT+QUNz1+m5K/yrrc9111x1MDAxYWtjd5FcZjtqpIxcIoSBPs9wdONjrWAv3OuNdmfvojNWXHUwMDEzL8GZ76a4O6Gc+W3HlvOcYDNabeVrO3bf8pyc/c7leVx1MDAxNY03nFwiwORgXHUwMDE08b4rXHUwMDE0sJWKuytptYl6UdLcP/uTtpRAOc9GLrSEPPXm2Fx1MDAwYtMl/1x1MDAxMbs4tLKtVSNL7MXczaBMbqTpolDm3uxNpJOkgf6N81x1MDAxZSC+XHUwMDFj/+FaWHQ4KPDh53Xk9XKfXHUwMDEw/7/Fo1x1MDAxM2zPLjVITqrx1Ez3fV284mVkXHUwMDA3kVx0ePz9/J1DxF/5Y7m5XHUwMDBmOn9cdTAwMDTeg1x1MDAwM0rHeVqH4qGnno+r8esuw3/2lfPQQVxuQt7JpX+JzoKVM64tz8mKpW2eWCCvXHUwMDEzu/1cdTAwMTNKbS+GXHUwMDFmnGdcdTAwMTNcck1tabO5XHUwMDBiIHhB91ts7te2XHS+cS/WsEXoekFcdTAwMTIld2rwWVx1MDAxMFx1MDAxYWPCN0ppn57di1NywC3+V1x1MDAxYuO75Y7rXHUwMDE5T00t6ylcdTAwMDEmnFx1MDAxY7qgPr4nvXVJ9T1cdTAwMTaaX45hm2dHY5MgUVx1MDAwMlx1MDAxOO5EmrbJxS9BxXazXHUwMDEwfjNsIy1/alx1MDAwMFx1MDAwZlx0Q3/2VlVcdTAwMGV52SwopF/Xgmbx6dalyI9nl8eE9/RILdd63505yzBx9DnK8Z/yoqA3uuA56s++0DMzVbzy0+fy2GjHP/OC9c5cdTAwMTl77Fxy7+vKjn/mxLNcdTAwMDRUXHUwMDA16NQqXs2imCj8msBUgfB7XHUwMDBma36jhJBo34xC+lx1MDAxM89sXHUwMDE2QXXPeKZa8tZQ71x1MDAxM1x1MDAxY4DZdvaa0WBTvVx1MDAwYt9iJ1xuYy1cdTAwMWF84XpcdTAwMDdM0Fx1MDAwMCbXYFx1MDAxOFukXHUwMDFmkUely0iZ/eV7fUistntQ3Ihccs6W9Fx1MDAwMb4lODzvKLQ41p44XHUwMDFi/G9e/FN3LLHx88AzXHUwMDEzXHUwMDA2Sb7ZXHSCjWMjjerUx05fXHUwMDEx4yX3x59xTdAx59khO3I15lx1MDAxYaQs7LjAMKWKlC/PvFwiaM69uj91v1x1MDAxNPJqk8XA2lx1MDAxZUO50DGcXHUwMDE4l7Zyn6lcdTAwMTarLbOmm3Rj/r6DyVxyRzprTyXJ4z1cdTAwMDbmgj6dr5eRXHUwMDAwVFx1MDAxNZMhlv7OXc9cdTAwMWWu5/PnW6xBNZFN75BcdTAwMTKzUXHtl5ngwP5/PfumKjdcdTAwMDHsXHUwMDFjkEC7XHUwMDEwnKdcdTAwMTNTi1x1MDAxZjHWXHUwMDAzl0jaT82A89En9KYu1eh3XFyGsdlcdTAwMWQtMpl6YbWVyFx1MDAwN+f4Xd+gJbMvSM/zdy1FXHUwMDE4MCVcdTAwMTnIw3+CXHUwMDA3gVx1MDAwN60qx2/f45YnJioyXHUwMDFislx1MDAwZXyMgFx1MDAxYcFRdIg4XCIyXHUwMDFkRvpYUOSzKtGBeNC+X//kZbhcdTAwMDNDXHUwMDE463N2aaP74H21bdelLlRcZoBDUZpSdMu+v+PMV/CMukNcdTAwMGUyo9jWqq9RQ41cdTAwMTVvicyJ+PFAgUTugj/7XktKTZA+XHKnXHUwMDAzxaC5wKTrPdihrI5cdTAwMGIvnee52H0gVSVcZuLonzqiMCXUpoKYXHUwMDE0Yf+ypkBcdTAwMWHusOpcdTAwMDKSXHUwMDAzXHUwMDE27ov0XVUrNI3/o3X4fZEmZ/mKRbG00stcdTAwMTVeJeHjoD2c0T7Sx1oyulxm8T/fcyvkhVr2yVx1MDAwMW5gmvHFxZ5rv6snyj7gY+VcdTAwMGZZXG7Xl/x3XHUwMDFjka6zYrXp/Fx1MDAxM4O0csF1rzya9ldzLFtcdTAwMWQh4Fx1MDAxNad0UmqMsvhcdTAwMTGvO56A0dZbzUVcIlxcMnDuxm1TptdYbazBq3lqZNHfmin/XHUwMDAx3db+685cdM0qXHUwMDAyitwsRWpTwEzuXCLWnSE0+dD/YqPlP99cdTAwMDN1LodfXHUwMDAyR9439GHGPleX831AL33lWnlcdTAwMDBDlz2IXHUwMDBmsD/rsM5XMeaica/yXFxfjTuva762lWdcdTAwMWY7SKtcdTAwMDFcbiPDXCJBgTtQfvoo4NxP3dycWVx1MDAwMYrDXHUwMDE36b6PRlx1MDAxNsdvZsZcdTAwMTb88HRaOCVZyCtnv+5foCBBolx1MDAxOCbc15xcdTAwMWaaybefh3ikKCpH7zO49F6Kyclwzlx1MDAxZPRz7jShY9rDZaN1v3ckmsZcdTAwMDRojK+NesJyKmnUS55vjZy8wfpcdTAwMGb35l5cIm89zrOmrHDzXHUwMDE2vbdkNsOiNZjRXHUwMDAzhOCSXHUwMDFj5Fx1MDAwYjupLFVcdTAwMWZA/S2mXlx1MDAxZKag4VdcdTAwMTRcdTAwMTi5yphW4k5cdTAwMTaa+WaKbGM4Voe12uOeONTQfqjR3jueMqxcdTAwMWN3dLEykOinjMpcYtUn/VanZuCJPVx0e1SdYiYm0NvmZ1x1MDAxYU5cdTAwMDBUXFz22V5ntFx1MDAwMvPUzsuPhpRcdTAwMGJDXG5ZbSZbaVx1MDAwNs1ZyvzYQSZcdTAwMWaUXHUwMDAzZlx1MDAxYVxujE6+8fuDT6vM4fdvwHqb6pSeppmjN/CZ3vFcdTAwMWN8XHUwMDAzIVx1MDAxNlx1MDAxMzjIwsDh31x1MDAwZf96zGGVa3hMu1x1MDAxML1HXHUwMDBm/jOf+kEv7uWb2eRcdTAwMWR79FxcW1x1MDAwMFx1MDAxMbBcdTAwMTPSm1TkuIim11x1MDAwZlx1MDAwZZhZ02XgKlx1MDAxYnt6ZFx1MDAwMF1AXHUwMDA1lFx1MDAxY3Z1oNuuXHUwMDAwXHUwMDEzleVZZ1x1MDAwMFxiXHUwMDExXHUwMDE4dkn+lilcIo25z1NPlMsrUOhcdTAwMTe5OZpcdTAwMWSh1E76WazC1PLsXHUwMDFjaKhgUvI2mytp+FvN2oHLTUOrzVx1MDAxZLIjXHUwMDE1folgu2I8hN9KXHUwMDAxVFxmbeWJTsHlPfpbXHUwMDBipof5V7yNX9hGe11jw+uzbtbAXHUwMDAxXHUwMDAyXHKiO1x1MDAwNCuUXHUwMDAzLZdXeUDJrEBr33HLafxNh2NPRMFDdrRJ1rbX6enzb6KEZ7wnifZcdTAwMDbqufI7Rr2i4cU97z+/5lx1MDAxM1x1MDAxZM1cdTAwMDcpj8k8PPi2sYHoXHUwMDFlXHUwMDExoXq46Vx1MDAxNGBAvn08QJePmuGHXHUwMDBmdVx1MDAwNZ9+Jlx1MDAwZpXqusPtXHUwMDAw212v0WtqzFxylbpvXHUwMDE2V7pNXHUwMDA3Tfm3yK/A0snV5nVoXHUwMDA2jVGkRmu1usIvoOm/XHUwMDE0vFx1MDAwNShcdTAwMTKdMORBXHUwMDFl/lxc6KTLV7+Kvzrj4KeelTrz61x1MDAxNu7AYKT8+/rOXHR3XHUwMDBibmFF8dfuXHUwMDE53a/+8492YVx1MDAxM0BcdTAwMTQk9qsn+Jsv22o4L5pcdTAwMDSkaJpcYlx1MDAwMpA548BcdTAwMWX3P9hcdTAwMTOfeSNcdTAwMTMxelx1MDAwMo1cdFx1MDAxM1x1MDAxODtcdTAwMDRFkSf8nlx1MDAwNXojalx1MDAxNznvZ/7j31wikVmvX3ufPO9cdTAwMDNDg91Kc1x1MDAxMDTXwiAoLu1cdTAwMWJwXHUwMDAy5SuQP+BcYmLNXHUwMDAyO++Z+pGzZC1mXFxXsVFcdTAwMTMwLlx1MDAxZclDW+wkXHUwMDAyXHUwMDEzZ1xi+LK+zsMmWLT1h9spXHUwMDFje/vqW1wirebCXHUwMDA3LUQpXiyCg05RQUI14j6sWdZodFpvkPiJXHUwMDFifuPrZzh4b6yD//t1RuE4Ot9G5O2uyvq8qVwi2aSsbNlcdTAwMWZbOyXl666knzxcdTAwMTDbXGZccnOvZCVcdTAwMWOyKrrbj1x1MDAwN6lcdTAwMTPTilBEffDKbVJcdTAwMWVizv8nXHUwMDE2n1x1MDAxYZVAJ+BWPVB9eSSHv1x1MDAxYtBZXHUwMDE4ryeHuuFcdTAwMTX9t7b4gJ8u+ezj9bnmvVx1MDAwNZEoXHUwMDA0QjFcXFx1MDAxMDjZvMZcdTAwMTfSaOKKyEggv17i/nj+iP3lT8160juP9qhcdTAwMDNcdTAwMTG+5VCP1sRTmjhbnU/1ZJMhY9tcdTAwMDSWXHUwMDBmv/CC26tPb+RCO5iP611BJVx1MDAxY/tcdTAwMDW5XGbAOFx1MDAxMba6QUUuXHUwMDEzXHUwMDE2PHHPn7g0u0wlz7ZBwjNE3rTJfYN+XGJ4Qlx1MDAxM6wmq6OQ71x1MDAxOcOvaFx1MDAwNFx1MDAwZl21xLxcdTAwMWRS6JNfXHUwMDAxaa/SSc6/waCRgj41dlx1MDAwMGjv5qVcdTAwMWR2zlxu5v1Wf+Nwn550kqBcdTAwMWR6XHUwMDFkgTBcZqd32HEolsaQm8kljDddKD2/XaXf8ThcdTAwMGVR6IcxffXOc1x1MDAwNeiQp7LQ2F36SEEy3k2qd0x/XSAwJWd2uFlC6tah9l1cdTAwMWZ9elUpWMPVm1n7wCO5PsBcdTAwMDC7r9Bk16hzlqZC14BcdTAwMWLKQvt9hqlcIj+4w1x1MDAwNmdnXHUwMDE51+bicXyr140gcX2OMlx1MDAwMiz9g2PzlGX7TMB8j8PYXG47WdVcdTAwMDJcdTAwMTdcdTAwMTQ2qNxoaFx1MDAwMIZcdTAwMTe7XHUwMDEzzSTD8pDoXHUwMDA17lx1MDAxZn6naIFmnJcyS9Kd3+nbW8zH2CrTmYBhoZzF2FT5ULJVTbhpd8wo6Fx1MDAxZvujcM9cXFx1MDAxYVx1MDAwNKxmXHUwMDBi0Vx1MDAwM1x1MDAxOFx0OLpDajz5XVx1MDAwNF7tIFx1MDAwYlx1MDAwZZ5rXHUwMDEzXFx0a/0/ucZaXHUwMDE09f1+5kdcdTAwMDKWeIU7ho1cdTAwMTVVwWDTzsSorsjhXHUwMDFjtGRcdTAwMWZC+CG+J1Z6uKOt/+DhVWnlpqdVZFSqVP5GkSqViXtDWOtlb8KpJFx1MDAxZUno/ObhXCJvSPlXfvj2pPKGzEuE2FNcdTAwMDFcdTAwMDMoULvPM0js0sU3j0V4YYArfZ/LXHUwMDAzS1x1MDAwZl5mNDcjmzZccr3Ls3ll5fSVkm5LmI7x6jwuszyr+lx1MDAxZNdpLEG7n3bNLddeUeWuSjqCmPqZ0Nd13YBcdTAwMTTJ8jh+XHUwMDE4br3WXHUwMDE2lVxclzcjfd+bXmCRrCdcdTAwMDBj0Vx1MDAxYcBLJ1xiKqxTZC6BVNBq5eO3br9jU3JnMvmv3MlcdTAwMThcdTAwMDeLbGS4gFx1MDAxMOS0+C90XHUwMDFmdUItXHUwMDA2bIA0Y73Sh2RcdTAwMTQmOfpcdTAwMGbv5JucXFzYmMNwqE+IXHKcXHUwMDA2XHUwMDE4Uo2YPjvj7pvHs6tcdTAwMDBcdTAwMWac5Fx1MDAxN3GidcCUWvJyJmVcbrpcdTAwMTXZ5fpSdlx1MDAxYe53sFx1MDAxZbz9oOxg17qHjUyyZFx1MDAxZlx1MDAxYjRI0a9cXP2/c3rlg1xcW3W8gO4xLumEr9zbK4XX4Iu13lAhXHTW5Vx1MDAxMVx1MDAwNVx1MDAxMi7gxZJcdTAwMTEsbOrkXHUwMDAyb21UNDL1XFyxaOLBwun8dEcjwUoyU/TMvXhcdTAwMWbi3YpcdTAwMTJtXHUwMDA24dnQN9PbyrSCyFHPMbLvm7XWS4qcKfTehChlXHUwMDBldVx1MDAxNlmkj7TQIYYx3OC/+sZcdTAwMWZmXHUwMDAwPWfQ2WVcdTAwMWMl8DJcdTAwMDRcdTAwMDZgXHUwMDE20lx1MDAxNVx1MDAwYlx1MDAxY7PQ6Tu0Zfyn59+3OJ3AJJuGQa84XHUwMDFl50qM1aWpXlxu1lJeXHUwMDA2kfmO31VHsdtBdJNcdTAwMWHHvTzjg4pcdTAwMGY0q1x1MDAxZJpcXFxm76Jzpff+0bBytiPucDAj7Vx1MDAwMPDMsvfyo0VcdTAwMTThkZdccqLFIfo5Slx1MDAwNMzWXHUwMDAzzK7RPm2M7JOBtlx1MDAxOLh/VZHvPPVcdTAwMTjavVE/uVVcdTAwMDSz0Vx1MDAxZNx1XHUwMDFliZI4v07dMSdQI0q+PV43I4W3XHUwMDEx2/dcdFx1MDAwZt5cdI49XHUwMDE3JtGijFx1MDAxNltcYlxm2a/ejVkue/ydXHTZ2CTHLHuMYa0/d1x1MDAxY3v7770mKlx1MDAxYp7Ja6vZUvBdXHUwMDA3LleWQVx1MDAxNSvEUbSuXHUwMDBiSnBhXHUwMDEw4Fx1MDAxN1x1MDAxOLqBMkntjVx1MDAxM7VcdTAwMWQwnrU3QMO2YVx1MDAxYyjm/Sw5vnuSwtFq39625jzUZWGLhLBccuKTkjnNI1xiYNSKMUAvy1x1MDAxNMwxuDmY+9XrmTVD+MZcdTAwMWXOmr/vcVlt0LgrL/TZnE19NXfKg3IyzFx1MDAwYtlcdH6pauIzcG99aUTx0LOeJb+6mJKVXHUwMDEzn1x1MDAxOCtcZvhm0MVyfygwXGbCy1xi4LFTr6SuXHUwMDFhmf8opUaZXHUwMDFmZrukPzWj8lRz4lxyP1x1MDAxMGbvXGY0Ie+jgUz3XHUwMDFi029Uj1x1MDAxYUtsTU+F17OXbf2ps1sxQa6YT7xJ6C1cdTAwMWN47ylFYv31dV9cdTAwMDFcdTAwMDKDqlx1MDAxN1x1MDAxN5LHz01Nb5fdd+4hSS3tnflJXHUwMDFj6yWzu1wiROE2PITcT9csXHUwMDFk/nDL1z/xxzekZJ+6X2nh4+tQz1x1MDAwZeGS06w2flx1MDAxYbb73aCqNNlbIUNVdHwxtVx1MDAxM96NTfqp67SbKJnyulx1MDAxY4g5w1x1MDAwN1x1MDAwME5u19ZcdTAwMTVcXMY284JKslx1MDAwZa9Dld/FXHUwMDA0xKLrxb5cdTAwMWVcdTAwMGV7pN/ApSbOXHUwMDAzn1x1MDAwN9ZcdTAwMTdcdTAwMTdcdTAwMTbW841cdTAwMWHfXHUwMDE1pVLwXHUwMDA16Ef8XWzwoX9cdTAwMTE6ub7ojT23oJ9uxlx1MDAwZlujSUbYXHUwMDAz8fryOVx1MDAwMlxmM/NVrnFUZ0FcdTAwMDIpV0SbduFcdTAwMTmth6iYXG7duaOdXHUwMDE0XHUwMDE4b3RcdTAwMDDSp8XikVx1MDAxYpjC5+zj7SqItClWW3ipM5KKLlnPwVx1MDAwNbia4jDfrsR83pNgwf/BXHUwMDAxIWV2dntcdTAwMThWMrSQXHUwMDBlXGb3XHUwMDE3Vcez/GxPP95FwdagXHUwMDFmXHUwMDBmyY/L61o3XHUwMDBm5qvuJW9oWD+IQVxyPd/5SJJcdTAwMTnAXHUwMDAzXGbSXHUwMDBi7Pzg9IOSXXNcdTAwMTHyXGb3wv3keVx1MDAwN2pd9Fx1MDAxMHi9nDpcdTAwMTfq6kJcdTAwMDBcdTAwMTd4XHUwMDBl4UMy9u6uXvubr8Mz/Se+wTmg1tnHO/VbsKiNaPLjobmobJpk9WBFQDxcdOBK9NCtI/Ljd+C4lKZi+Vx1MDAwZp77m7bxaC1cdTAwMDJ3XHUwMDEzcFaYXGap+fFQmVx0w5ziYWhcdTAwMTDlkFx1MDAxZXZBb+zvmlNDgqXtcz9cdTAwMWN0LI93Q17xflx1MDAxZuGNyFx1MDAxM1xcKEBgXHUwMDAzr9dcdTAwMWTCeVx1MDAxNdF0iFx1MDAwNZqftYosm5/8Ulx1MDAwNGxcYsf4rFaWXHUwMDFjqJeqMJOIj6eX8YtY0mjCcLXWnD3TRyaSlvDeXHUwMDFkfHFcdTAwMDZI7JHNXCJcdTAwMDf5ajaRWJ5cdTAwMWHvXCI4x4W8gtdcdTAwMWTSfsTYxI6NX0RcdTAwMDUtzzRZnZbsIbF7u8pbqnL0ICv3mfujXHUwMDE5uewxKOFnXHIl6/BBuTGHvvxcZjQz2kCKXHUwMDAw9CjbL7FcdTAwMTm/KuORXHUwMDAxi1x1MDAxY7Bpycbv5odtSlx1MDAwMv0+43pcdTAwMTdcdTAwMTDjjVm9ieel4TLQ9bC5ZeKDu1lnXHUwMDEzOFs+XHUwMDE08oW4lKJAoVx1MDAxZVnvnK+MzdXqXHUwMDEx1W+bi4NcdTAwMGJcdTAwMDZ2x01oWHGzw1x1MDAwMmRNQZlB6/Ja71wiSVx1MDAxMXuBenPml2l7J+ReoEbw4s0x+W99XHUwMDBit9aZXGKEXHUwMDExTyXq5EhcdTAwMWY6m56+XHUwMDA20GpQuJlcdTAwMDRpmiC6gVnmmEKIYFx1MDAwZUApb1x1MDAxOTpMSVHqXHUwMDFmepi2nKdscNNcdTAwMDM+bNHoOGpcdTAwMDOtetSBJouY+1xcplx1MDAwN7Y8vK58htH7XHUwMDFkcFx1MDAwN2A2ZFx1MDAxMFx1MDAxZMtcdTAwMThDXHUwMDFizEacXGKp5YX5nJV6url0bIw7loOh18evlfRnYLyDy1x1MDAwYtihjtw5lq1cdTAwMGV7ZO40xlg/9s3BdC+iNo20WINcdTAwMDUwp/7rjrc75e7Y02VsqY3e7Z158cdcdTAwMGaizc2LmnDvsnRcdTAwMGZcdTAwMTHpSjEvXFxcbr7q2yi7zSXIK0KqrXpcdTAwMWZs362ZXHUwMDFlXHUwMDFj9FJcXKhy3lKMgIY7sjxzXHUwMDA1iuXn91x1MDAxYVx1MDAxZOtAjopux8pcdTAwMWFIkFxm4VxuvlBZuI/+XGbJaX74XHUwMDA1zZua4ZaKXHUwMDFmlf7y8nXHXHUwMDAw4+R7cvtY2EZ5ySWkUHdsX32i7+uGRVx1MDAxMz+dwn1vXHUwMDFm9DS8iet4/17XqNAyo1x1MDAxZlxcY+OwS1xikEayw/yeXFz9dMyUhDSHXHUwMDA19KNA7XRUuv+OXHJcXNGKd/fHOdeRpVhLKVdb6oM++XTFfif6hkhUu2yVe2oojM7dXcN7/OSIPPdgTFx1MDAwMqoonlx1MDAwN7PQR4DJ2pJcYlxyveCsk1c9W9FmbvliiJTxXHUwMDEyOfdx8lwih4VcdTAwMGJBOXh6jItcYoOAJK42O1x1MDAwN2N2XHUwMDFm1ub5XHUwMDFhnI3nx93KvtsoX/HD8/DBXHUwMDA32KMgXHUwMDA0575cbqtg1TsyIF/NR3ZcdTAwMTPRW+2H/F/s3HDhoN6HVlJcdTAwMGWtpL/sKk5DXHUwMDFhgDQ08/rkelx1MDAwM4Dm1vZmkXivJ1x1MDAxNfKU//CZx4/9bFXWk6VE6WFcdTAwMTjVRZ1TbYfxZ09cdTAwMTKQwkAyNudTjaSt8UfDTPhVte5XWrrKXHUwMDA3fXaZ8FLFSZxcdTAwMDFcdTAwMGZ2s6goJbFrPFxm023yfLnrm1NcdTAwMTPe35j2+qlcdDnaJe1QQGaVXHUwMDEwUpJEXHUwMDA0yJsrXHUwMDEzXHUwMDBiqSziyUJJQ/UtPqsrx93J8m+Nf7dcdKfmY8NcdTAwMDPCo1xyfpvqqONcdTAwMTOwZqaPmkCLUvdcdTAwMGXkwnuYz/fVdFx0YfF+8lx1MDAxM/lt5cO6iZh4sFwiXHUwMDAzgVwiaVx1MDAxZV8wN1x1MDAxN2VcdTAwMDFA1Y2Nrvhd7m/w1l8uv1x1MDAwM3bIw1x1MDAxMMQzh8SWQi9BbFx1MDAwMMFsf9f9OH71ZENNk7lcdTAwMWRQXHUwMDFl7/lcdTAwMDGzpfn24PCWvKDmP99MNTyhXHUwMDBlV8iYXHUwMDE0pCF8IXmmzUihSoKPUMlcdTAwMWYqflx1MDAwMVpsYfDrVYh7/lwi9Ks3Jlx1MDAxM1x1MDAwZlx1MDAxNM50T19UXFyXor+v8Fx1MDAwYrVfMuEwXHUwMDFh1sIo2KC1YoZR1iM7saZE+LqKy2xWYIWPL4NqqXahQn3tjNLVcVxcXHUwMDE3Xaj5xHLL/PTr2oyEgdRMr1ZAyFx1MDAwYvg0Wlx1MDAwZlx1MDAwMlx1MDAwMXeDa3PKOis/2P09fvv0T7/OzHT/JqRu5jKwfM+pXHUwMDA0Y/hcdTAwMTNdMMPnOjFxXHUwMDBieFx1MDAxOG5BnjOXirMv9lLI9Eo0XHUwMDA3due/zmDKnutcdTAwMTU6XHUwMDBlW/PoXHUwMDExd99cdTAwMWInXHUwMDAwXGaLLH7MWVx1MDAxZntcdTAwMWF28D12jjt50X+uXHUwMDFm/s7oXCLhPjmJJClcdTAwMGIoXHUwMDAzh8Ppjlx1MDAxMVx1MDAwMtzfl1xcalIz7b5cdTAwMTZuWFx1MDAwZXtx3Vx1MDAxZTvfieXKrVx1MDAxOem9xKM2XHUwMDAzXFxwh0dcZnimYFx1MDAxZrp9+lxmn9hLO/g/XHUwMDFh1/nw/LluO+0/RiOhfVx1MDAxOCNcdTAwMWI1ToFbXHUwMDBmJ+XmY1x1MDAxN89+pKMwkHf7t31cdTAwMThtyJWQVORcdTAwMWHHs3revLkrXHUwMDEwh/Vcclx1MDAwMv1LTFx1MDAwMCg1ZUTdQuPTnEQq70GI3cDnc2fc+HJPN+VcdTAwMDfn414scmNxTZvQ0pizg3Jep1d0XHUwMDFig6vWlrCRvJ7ymytS4K30K0S+Z2NlarsqXHT+mujL9VxufOpcdTAwMTUvLGQrdDXYsX8pwYOHn9ebXFzuXGJao73ZXHUwMDE4SeJcXDnszN/wMqV+O1x1MDAxYnZcdTAwMDJccrtcYqi01y5cdTAwMDPgl0NHXHLUXGJrM9ZcdTAwMGJRyF5cdTAwMDMghFShV/Oz3lx1MDAxZrajYy+6XHUwMDEzVe/kjWOvpr9tpfWJqatcbv263YS6LUlr0Xuwho/9os7ieF0zrcInyTH76eSet//oZevKNpYg23ZcdTAwMDeG0T5SwCBcdTAwMGJsXHUwMDFlXCL39fh/Qzq1XHUwMDFmfs/uXGafXHLF01x1MDAxNaycZbz8zVx1MDAwZt31XHUwMDAw99tcdTAwMTBcZl33mqfZ8PskXHJcdTAwMDFMXHUwMDE353XngGpFrFcuYbJcdTAwMDV/XHUwMDAw/ts7nzJMY1M4Um98T/RcdTAwMTd231x1MDAwNol6P9z2apHnPYOrq/w531wilMbNOu9+5aEv34D5XHUwMDBi0kV9XGbAYFxmY1x1MDAwNLD4XHUwMDE5XHUwMDFlg2OrgrXp7KHp5phenHdXb1HeSPn/7lx1MDAxN69InWSV6PfHduJ1s+Nz4dG+jFx1MDAwMLuMjPvxSWrDIbo/XHUwMDFixEtcdTAwMDF8dKdwsYA8/tNcdTAwMDe2SmfLP1eR5t+8dbekXHUwMDE3XHUwMDBm0kj53NbnLXJShtjBXHUwMDAwINPBgbGVJDU/LJEoXHJWkXtZNF40MFv+XHUwMDE36z36ifNj21x1MDAxY29K0lx1MDAxNiNfKLrKwY2TU+Mwo3rqWFx1MDAwZur+9HK5Iaz/OffavFx1MDAwN5Mvciqc3fi14dboqeAsbz5kqvVcdTAwMDVcdTAwMDFglM9ugFxmR3udMU9A1b2uQunkP/rjmjKoijhwQHk1S8+P2GZp5+Egje+gQqJ72mD/ztkhJvdaPv15hk+P3XJcdTAwMTZ0ZNne01x1MDAxYrtcZiaKsFx1MDAxN6LzzdhcdTAwMDFcYs1/UfdoJ1xyhuS9VngjQrSxP+yPfrHXRWl8YLm8xk630z6DuK2siGt5XGJZxGumT2/sz/3vXHUwMDFijDvUhFuId1FeXHUwMDE4bdif2L9cdTAwMTlcYpbrcaW8b07FWjE1XHUwMDAzbXJcdTAwMThASMDQ4l390Fx1MDAwNkKAutyQw+VcdTAwMDLOsYt0v1fkX326//F711x1MDAxMqRR18BcdTAwMTA3YubZad7E4Y2mtFx1MDAwMZd7Vlx1MDAxNFxmXHUwMDFltN0v1nP8fVxi0jvk0rndyN7hMCA+l1x1MDAwZmWvMVx1MDAwZZSAQFxyIItW91x1MDAxOXp3cNApydmHXHUwMDFm+nYlXHUwMDBmzaywPSxcZlx1MDAxN9X6oVM4XHUwMDFisozQ9+dcdTAwMTSjeDNKwUyF9XJ3sUtcdTAwMTZcdTAwMGVmW3TYZWZb8de5l6TfXHUwMDA1+XNmh19YuIm20s5MfVx1MDAwYjA7XHUwMDEyXHUwMDA3XHUwMDFmbdIp9XE9XHUwMDA2XGJAtCgynCeCe79cdTAwMDCMY9zaPXbQ5b2ag/Qzt75cYvRcdTAwMDFG4DubIVx1MDAxOFx1MDAxNiczkzLEnJdojMDIe12K5FxuXHUwMDEx7C9cdTAwMWWWXFxRUVx1MDAxNFx1MDAxMu5zxlx0tzL1+Vx1MDAwNFcnXHUwMDFky9WHk1x1MDAxN1x1MDAxYYNxltXJilx1MDAwMnitTi12XHRcdTAwMDRcdTAwMWbx2kqUvFxmgI2D21xiiL+7UfEzr1wisVx1MDAwMVslb1x0QNdXXGJcdTAwMWGThOBcdTAwMGJcdTAwMWFNyFx1MDAxYktyJ31GuotcdTAwMGJcdTAwMDTpJ+mg3FEt3OZOXHUwMDE1XHUwMDBm19VHXHUwMDFjr1Jb/ehcdTAwMTKHQILGnGpiujLZhlXctr/M5m1WM7ZcIihcdTAwMTkzz+KBXHUwMDAz92mL1tuCzO9wUZOI7it7xu6fumiKtqfYXHUwMDFmmHStn2nl3Fx1MDAxMjfNulx1MDAxYjpcdTAwMDOUPqp3XG6GiOmOZ/V7XHUwMDFl80K2o7pcdTAwMTPwXGa/XHUwMDFm+7rvL+v9P3VcdTAwMTfiVTj5plx1MDAwMVx1MDAwMvhzhuunPrtmXHUwMDFh+efZK9tBjfd4ZzzJukqUO19cdTAwMWFcdTAwMWXi/c5ju0N0qEkwPYK1udBT11Dv9uB3PLNcdTAwMWact6dXTWBD46Gab7k4pnujXHUwMDFlwGjsLDGSo1x1MDAxZm11RiFcdTAwMTnsi2qmliZcdTAwMWW3l+VKY6rb0H5wsYGf9nesvbR8nV9cdTAwMDTwKcZ3WFRcdTAwMDXfLOpEUbXkXHUwMDA2ulx1MDAxOEfL0Kq+PGI65ja1YYFcdTAwMTZQ6iCg91x1MDAxM/NcdTAwMTHL2qLlLpSOL99HSqu6g+Y/SFxumn1xgsCANMZcZlx1MDAxNILZXGaF+LLXu1x1MDAxZkmMvqhcclOtbvf9vPA5LkdqWeyR7DNp1Fx1MDAxMZjOvqJcdTAwMTdLo6xsXHUwMDFhYvGEXHREjzeQXHUwMDFkaFx1MDAwMmS4w1xm82W8RfR4+Oeeeu9JXHSCMOCeXHUwMDA3XHUwMDFhT7+iMcqmXHUwMDFmfCSQ3e1587qwaa53h1x1MDAwMiMqePQ9smbJvOhpet/nXXznU3pcdTAwMDUz7mlcdTAwMWZYlT514T85nSC4Pa7C3pqQXHUwMDExU1x1MDAxZTGjyi1cdTAwMWRUM1Lo+i1ni6zN1J304umhonjrXHUwMDFhanl8RHW2xX7Ir/dcdTAwMDHu/Fx1MDAwMdrUY9kldkpZ8H2WekLSwupvK1x1MDAwMLpw7CqbzDNcdTAwMWPeKTAh02l3plx1MDAxYaduNVx1MDAxYcqZ99BJ/zFcdTAwMDOlZ/BZOIs7lo9cdTAwMTaodzz//Fx1MDAxOStmqJPLROpj9MQtXHUwMDFhW4JQfW9+JWv0wuRNx3bYf5jBWyVYXG7YXmywqtdgR3zVVVx1MDAxYf7RwVx1MDAwNNPfQM1a3qq+Z8NcdTAwMDcrgSpcdTAwMDVcdTAwMTNcdTAwMDdcdTAwMDReXkZcdTAwMTbcXHKLXtxCQclcdTAwMWO/qfVcdTAwMTBcdTAwMDfJdiGILMQsbCxvTmzdLC65XHUwMDA1sH7/XHUwMDBmvshcdTAwMTXNYm1iVD2cXSbg+PeYdFxuXHUwMDBl943I9bU/0UDvcdrBRVx1MDAxZY1NwsteTyBB0ziInfrc74d2kc7aU/fBjsS6SnpVR+1QXYOwiEiAUlxy5IKFnnhM2Hl/MrJcdTAwMDBUPYOVXHJcXHcnXFyLNJOrcel+5MGPuYN58pXEfIBcdTAwMTNKb+L3O+ErbJqctTdcdTAwMTWGXHUwMDBinFEolKRcdIfAXHUwMDE0XHUwMDAxZMBSsdNcZlx1MDAxOSue7524hrRwiaPp0VdcdTAwMDVVY7R2Z4m3yiRgTFx1MDAwNcNcYlxiplx1MDAxOVx1MDAwMELPpFx1MDAxZYxw6TPxaFx1MDAwM5dcdTAwMDZDKbdPf0BcdTAwMTZcdTAwMWW6Q4rlJLS3YVx1MDAxOVJcdTAwMGZcYkzNXHUwMDAyIWZwhmFcdTAwMTmNk/RcdTAwMTFmw5as+yVZXHUwMDAw5Fx1MDAwNmh4K592I1fwpWt+5oeP70hy16rBosupbqKQ+T6nuJIpXHUwMDBlUVx0XHUwMDFj0UVufP+c7Vxm56o3c1xyXHUwMDA3XHUwMDE5WoQmtVx1MDAxOZjNOPinJt24Q95cdTAwMGWUKuuOLT9nXHUwMDA3zTKfIY/xmOj7jvrZXGKyckz7yY6C6OtM+KOoXHUwMDEzL47lJKRA8z99XHUwMDFlXHUwMDFmsVfHS8F9XHUwMDEw/LEviOzsXHJcdTAwMGJrgI/tkpXq+3JcZuVcbnkrfpBo7iWW3ePcK1txXYZWJJBcdTAwMTQmysOJw8l8XtWNrTgxTKDJkvuDXHUwMDFjjCdG0PVjR1x1MDAwN994Z1x1MDAxN1x1MDAwNrawNZhnM3cs0oNi+1vvmE/uXFyXw1x1MDAwM7VcdTAwMWRcbt0nXGan/Mnr1JG6opXsSlFcYl31XHUwMDE5y1x1MDAwZqQmNP5cdTAwMDZjzkA7XCJiXHUwMDBl79uhXHUwMDEzLF6TPWZWbu3FZj3N7oPmXHQgu4hcIjhcdTAwMTbOUPIkwfuzcufQmFwiXHUwMDAwh6rwtfiRv7C4XHUwMDE0RPz9131b//iR4Enk8ZvhsrQvYaQ3XG6EsqhlIJSweWza81x1MDAxMMHb6zznsbfMPbUqw4qS+iC7t1x1MDAwNNaMs1YhLXxJVf1CXvVcbqptgbiNKW7uPVx1MDAxOGVcdTAwMTBoRFrowyY613OsuIjp21x1MDAxN79cdTAwMWHDXHUwMDFjlVx1MDAxY0t/0JU7/ODBx1x1MDAxZnXJVmFtXHUwMDE1257dez174MihaVx1MDAwN5Ncbkerrlx1MDAwNFx1MDAxZFx1MDAxN1x1MDAwNJQ/79Wpnt6FecGDcTbro1x1MDAwM9vmiIBcdTAwMTf6kNtfTohcdTAwMTeBZnQrOlx1MDAxY97av1XvcTbej4Ob17LYrlx1MDAxYbitdVx1MDAxNyBbWlx1MDAxY9pPeGuE9Fx1MDAxZp8v3Vx1MDAwZkWhrSae7Vx1MDAwNKrVKFx1MDAwMPHz4dxr4p02MmbWWsFcXO7a7/iP8rxy3PDKNVqiX6F7XHUwMDE1u6p9XHUwMDFjXHUwMDFmuTVcdTAwMGbchFVcdTAwMDAgJyM2qdybfFxcJnuk18SpqM241nsrNu6fu8btwJ1+5tmO8Vxit3DRietcclx1MDAxYjBcdTAwMWSv0drvnPLNXHUwMDFid7x2v+pcdTAwMTHuj54lJvZ4wFx1MDAxYq4pXHUwMDA0u1x1MDAxMauvXHUwMDE5bppcdTAwMTSv57SAmOJWfiO9REtcdTAwMTfOe3BcdTAwMTBnXHUwMDFl65mYN1x1MDAxM3sn9qGGXHUwMDBl3YRcdTAwMTWitPuFYZKo68jVdFHutVxiwDhZp3VPgCsuz1x1MDAxMFTOiVx1MDAxN/RavFx1MDAwMevLrWh1v7+CScv/o9tcdTAwMTT6Sbel5b3UlDpkhul1yaFC3sBTxuZ+9C8oPspcdTAwMDf9OIOsxUCeOSjmYWI49PAjZZ4jyaSePeJcdTAwMTLLXHUwMDEwU+yAXHUwMDFkuFx1MDAwZW+tesij83xvzHm37nrstKvdxzLwxJUpicF2NqanQj1mw1x1MDAwYm/oeJlSMTCFbrc4bK9iulx1MDAwMiDuVk+w3v9H70lcdTAwMTStVpuRmDdqxd8w3PNcdTAwMTHOXnm1XHUwMDFiKaWlxTvXnlx1MDAwMYnpXHUwMDEwQsltJFxca3nm29qMn/1SzKBmTzZcdTAwMTfAbeVtbszP8FxmvjRyXCKIeN9cbvBR9sR4dc66cHBcdTAwMTFcdTAwMDPQW1x1MDAxMXG37lx1MDAwMH/lzIMwZ9/PvHzGU4lPxrFFaFx1MDAwNFxiYqpiXHJo3CvQLORcdTAwMDXByINN6U69tFx1MDAwMZyyx4jOM/Wx1/uBc+iNXkws4WVIM1VcZlx1MDAxONLrp1x1MDAxYXuNsHU2OFhcdTAwMDWQVmpcdTAwMTX0qjtZQi9lLHdvMXVcdTAwMTNcdTAwMWRf8MV0/eS5U9vhZFYvbV92XHUwMDA3yZZcdTAwMDBcdHdcdTAwMWGTf2qBg4ozuYBmQOxlXHUwMDBiXHUwMDA2XHUwMDAxysHnsDD2u2eaXHUwMDA3Ny3abuEhjZ6NoWmNMtzMLt2hUFTWW2+lwVx1MDAxYsVmwEjz0jib32YqtrC0rCtcYjNcbkxcdTAwMWXL8XqwOftQ/IpfXHUwMDFm0IVdsH1/wyCGvsFNUctsXGJcdTAwMGVIfytzYNFT2S31f+o/XHUwMDBliFZOIInvzDF3pVx1MDAxOFx1MDAxMrvndylcdTAwMWFVb2ktK7qkYFmjjXbOuS5cYvmG9aumelx1MDAxY7p80nBaLFx1MDAxMndYXHUwMDFj8bqvXHUwMDBmw8JcdTAwMTmZue7IJVA3R1RsTE1gytxf+Z1CUVx1MDAxZnR2olx1MDAwNVx1MDAwMdBcdTAwMTTJi1xcvy9cYq6HRNg9XHUwMDBi+tings/j+k/7ZaWD0WtcYs/NXHUwMDFlQlx1MDAwMNibe72g6zg7+n3YlFvliIaJXWdr+Who81x1MDAxMezQ60rtd6KlUFx1MDAwN1xcYYypO47Lve7s92lcdTAwMDSidCuF0uSowusyiXnFd1x1MDAwMFg5XGb1XHUwMDFmaYY/0XnwzNBJttQrpuBBv0BNZDPufdZcdTAwMWW/cZM3f+ZpXHUwMDBlLkVY5/l+XHUwMDExXHUwMDA1NdkwplxchPGxJ9L5Xd3p7exlZi+Tpu1Jzlx1MDAwNlx1MDAwNFx1MDAwM1x1MDAwNnl48MP+zNn6XHUwMDBij172yn7564w/N2FOoJl6XHUwMDEx1EVVXGZ8I8E+JbMniId9XHUwMDE4XHUwMDEzU9pWxlx1MDAwNdxcdTAwMGIoo6RcdTAwMTJ2N6vKZahL8Z9xr2Ns7Z/xWD1o6cCjNINcdMX87eD061xi88NcdTAwMDVCrc/ZXHUwMDA3plx1MDAxMs4z7VwipJ54WJQhXHUwMDAwvVxmWXhXTqrUxMW7+4m5XHUwMDE2yMOnXHUwMDE0XHUwMDFjI+T34UCpKWydoFx1MDAxYVx1MDAxNPcw64dVQ8PrP/hTuZ96+inTa5w3RVx1MDAxNVx1MDAwZTNcZlx1MDAxY8rhtorXXG5/lFT+dSfs+qSJ81x1MDAxN3reXHUwMDFkXHUwMDBlnmJcdTAwMDE6xnrg5tD3XHUwMDA0h4khS6Obto+zKYYrSpFpxoVxMGe7tvYgd1x1MDAxOVx1MDAwM7hcdTAwMDcmtnRp/57pN++fftW/am7tY1x1MDAxZVwi2Fx1MDAwM5LsUor+i4TTvjeFwiuDdaXQm55cdJR4aKCQW1xcw5TsxXbIquNcdTAwMDLWsVmrnoXBzCpAs1x1MDAxMUeIQlx1MDAxY6RUiuRRv49RcKhNXGLgoHjI1Wm83Fx1MDAxZaSxXHUwMDAzg3anXHUwMDFiqVx1MDAwMjvtRtfbz9hcdTAwMTR93lx1MDAwNXbWVWyEk4NdoIOPRnSBvVx1MDAwZSVZ8TVZXHUwMDFlh3pcIlx1MDAxZVZsXHUwMDFhvl5ZNDhlvlx1MDAxMNF7l3Rr0mKI/MZcdTAwMGWfivmAMrBcdTAwMGY2scdP7klcdTAwMGZKxCff3ldsYqVcYj10gFx0v5BaNIUrXHUwMDE2vCPEXHUwMDAzyCRcdTAwMWFXnlxc8S2pgFW1h1x1MDAxZFKsy496h7NMu2FcdTAwMGVG6tvp3chm2uVcdTAwMWU7Ps5ccjIxXFw0h1xuQd6I5JqOW3xw1Xy6XVxulsbq9DalNVBCZ77viYn05X5tJF5AXHUwMDBmat1ng6ZhxFxcxXHLjsEh4F7+86BcdTAwMTBcdTAwMWWY9c81bLGgS2NcdTAwMWTGpiunXHUwMDE5XHUwMDBizyTaXHUwMDEyP1xyqfjPvOUuO3kuKtXoczaAyEhBokrhh5y9ZVx1MDAxZDB61lWbw5JcdTAwMGWOvyH5lCkxbt32fdb04EG1Yz5cXDRphVx1MDAwMkZ90LtvXHUwMDBlXHUwMDFijeXaLY9cdTAwMDLr3G8vXHSyz7p0jHVhSEUrbp2nY3s9iS71/Gi4K7BcdTAwMWMyZlx1MDAxYVvphSuZ2tRS8n6W6cZcdTAwMWKr/CdcdTAwMDd+lkSdXFy9oDZ4yuA112bXzLpWXfn8klmChWtcdTAwMDekiMfGXHUwMDBldokxZFx1MDAxMlxizytUzWLMdoBcdTAwMTD5YiVtVrVcZlr1br3yP4T9x7KkTFx1MDAxMyyKPlx1MDAxMFx1MDAwM7RcdTAwMWFcIlx1MDAwYq0poGZoLVxuXHJPf6n+zzU7++vedia9Jr2ss5NIXHUwMDBm90yPXGLH8HtcdTAwMTTWP61cdPK1dYLfQJOgRyyQN1hn7y+p32FjWmzOzsH/evdN33ZU/4ubT75xOPZcdTAwMTZA8lxcXHUwMDBl0n1cdTAwMWRcdTAwMDDmT/D8WTqLVTQ3RmVcYm0jZrC7noM35O4zxsFffjHh/fMxmGS+Tlx1MDAxN4Psn/FBLcdmpYiXm3zkK1x1MDAxZL4hiPravVx1MDAwMlx1MDAwNfiAhJem+3Xvl2q39G1uR/NEoFx1MDAwMn9/tcNveIuo//ox/vSes/70nlx1MDAxYpGcslx1MDAxMYogmFx1MDAwZjyH/Vx1MDAwN1x1MDAxNOKMe6PVLVx1MDAwYlx1MDAwZk5cdTAwMWEkPjP3aFlcdTAwMTlF597d0NQmXHUwMDA1vXN8vVx1MDAxM1V0cLlHL0+R4Vt8UjC2qVx1MDAwMv1qMezuoaT3jjhcdTAwMDalOCdcdTAwMDFX6y+h9/DUOLCHkaVghiTDolx1MDAxMFx1MDAxOYIm4EjWp5r07WRcdTAwMDDMXGZcbmZcdTAwMTln3Vx1MDAxY1x1MDAwZVx1MDAwMkcoXy+F/uOt+DPTVOaS5fOsqVx1MDAxZO7MTyxS0a18XHUwMDFkLlxiXHUwMDEw2iGcozux35u0lPb/akCdMnvbMWeynNJcdTAwMTW7xepYXHUwMDFifFx1MDAwM/SyTbCQ5lx1MDAxYccxMFx1MDAxY+jPieBcdTAwMWR4q6uE92lcdTAwMTLQv/lQfFg4hvtfrfGn5jvnObxjpIF0M7zCqfGew/0tXHUwMDAy8cU2L6TE+VJcdTAwMWIzYVx1MDAwZn9cXCGjXlx1MDAwNozYL0Oh0F88fMpcdTAwMTdcblx1MDAwYlFcdTAwMTnhap88WVdXwi9I0YXW9yCeOXNeXHUwMDAxXHUwMDE0uJNL8IZcdTAwMWa6szdbKlx1MDAxN0Cvb8aRm79+Qfl0MdLvoeM/efDX/kWANFx1MDAwYqTEXHUwMDAwXHUwMDE5UJZcdTAwMGUmMGlpMYlFXHUwMDFk6GOAyUlQnU5RZ1xmXCI10iz5XHUwMDFmj4n48KWWLUNzXTn3IMFQ/p28jXZcZtaQhGVcdTAwMTMk5mFYJlx1MDAxYVx1MDAwNnuperRcdTAwMWOcNlx1MDAwMIjyXHUwMDE4XHUwMDE1akzek5XQO3vJQSW/ltPbLv/LXHUwMDA3vZc28XiXXHUwMDA3dIcgm1x1MDAwMVxcpy9uXHUwMDBiKlx1MDAwMrQxeTtcXIiXxPrmMJjIc649SeDI68xcdTAwMTJcdTAwMTn9Ymv8UJlcZo2S78FaRWw9ek1cdTAwMTjZiDM62Vx1MDAwZoZOQUlcdTAwMTdSZ+1L7OBtOU8sPV/gN9RlN1x1MDAxZirGdNeDfXwwuXJcZl36r6fBqVX3+69vyZV9qT3yjlx1MDAwNrJ4R+fQspog0cFRI8zDwMmyW2kv8rZ2rtJ7JmdDxZ373NtgMTeQOvBgi1x1MDAxNK/8ilx1MDAwMq9dVVX86lxc71aXv2A/XHUwMDFkc+uoP49ztYlDIyg60r+OiTBFdFx1MDAwN6mUXHUwMDE3pSQvsvdQYGRcbvY3Ylx1MDAwMOjQfpo1JKKHZejq9Vx1MDAwMX+9Xrg5oY73f8/An/drvV7HoINgXHUwMDAzXHUwMDE5YmPWXHUwMDFhWFx1MDAwMbPLszIwZ7NQ3lx1MDAwM/Od/lx1MDAxYVx1MDAwMqVcdTAwMWGwXHUwMDAwjpz+9pdKJcZwXmM/cvBcdTAwMTjc7cujK09f2+mt0Fx1MDAxZZpcdTAwMDLZbtZcdTAwMTTznIdcZsGxXHUwMDFmS0+F20Vgf3akOs9lXHUwMDAyyGTHu0+1sv+LvY1cdTAwMTDqnFximfhcdTAwMGJcdTAwMDW+o0lcdTAwMDJ7/N7yr4VvX+r8SvxcdTAwMGKUiPNcdTAwMDKU27S+K9S8JStmiU3SIYJ5vnXEjyRSfkPsxbyePFx1MDAwNFZ1lVx1MDAwYkclXHUwMDE45VHPhN+NudOyXHUwMDE5lIDrXHUwMDBlYypccsBDsedeXHUwMDAxWzsq4aRcdTAwMDVnN2Chelx1MDAxNN9cdTAwMGatku3v/LL0XVx1MDAxMtBI7uy/3lwiXHUwMDA0tV5cdTAwMGU1gY1cYsDIXHUwMDAygJB4N9/oI6op2rJO7rtM+Vx1MDAxNzf6r8iQg4hcdTAwMGJMPnD8XHUwMDE5RK9Me5bwwsBu40ZcXG+akKl9NWA7XHUwMDE5zNgksClcZkKSMXO171x0rsV2hzBxkWCxhLFcdTAwMTmqw3bi7TZcZsLM+87UL03SJkzoNGu9wf84M1x1MDAxN1x1MDAxYmpa0npcdTAwMDT+RaRY/yBcdTAwMWTSlzEuUyhcdTAwMDVcdTAwMGI10sphnP56UoVcdTAwMDWEXHUwMDBmX9WMXHUwMDFlkP+CeV7j1376XHUwMDFhnXpE1zM8vFhROlx1MDAwN+RLXHUwMDEykEhcdTAwMGK6yoxpY7YoMK+9oFx1MDAwNLKK/50neJ1cdTAwMTlHXHUwMDE296BOk1x1MDAxOP1xYPg583fTaDqiafS6vOPtYkLrlurNXHQs//L8X6/QdnTL/r9cdTAwMTgki1xm+3vb0mJ/XHUwMDBm0b5cXNdcdG6TLzldQ1V9XHUwMDE0ZaZaZ8ZcdTAwMWWustWCbT88ZuHzaadNhkV2yF+nV6cx1zyB4ENvqY9cdCgt6Fx1MDAxZPpcdTAwMDRaxlxyX1x1MDAxYzSsNHgu91x1MDAwNuXDO1xc12TDoSFqXHUwMDE5xY+X31x1MDAxZFx1MDAxY9tMm8H8Q8tvrKNNIVZcdTAwMDDk3JHxPlx1MDAwMjDxXHUwMDFkXCI0IUgqxmDEvGCXpbImWM9KTuHPwYZcdTAwMWa3u+SVvzpOe2XsXHUwMDA0XHQ3+FxusD57XHUwMDBiyaflpY/BOjzjvlx1MDAwNPJ/Wt6d6uDd9btcdTAwMTP3v3vmXHUwMDAwSDZtXHUwMDA2elxmSFx1MDAxZDG3c3y4hC1XSYe9S+PdUr/eXHUwMDE2MCx+/653fzRJI7B9tX43iZ6VwuTaXHUwMDE4gUFcdTAwMWFcIi6jjapMRq9cdTAwMWFcdTAwMWEl6KUrXHUwMDAz9uTTcVx1MDAxMS/Kj3eEXHUwMDAz/Sig2DxN4FNOhfPNbGQ5/6TOx8NCk1m48lxiXHUwMDE2PnjzKOnobXFcdTAwMGK2XHUwMDA1aCB5gVx1MDAwMInNXHUwMDFl8qicSCSncE+3hcDxXHUwMDBmdPHk2tlcYlx1MDAxM/3qYrfffMD/8FVIOf7ccZkkvVx1MDAwNyjaNq/dh0lkSFhPzVmTkoTU0I+DI3T1UHNwXHUwMDA3crTs5kHePz5cdTAwMTiR3YHJZ8dcdTAwMGWugmlT9DpcdTAwMDPAKflsUOhcdTAwMTLWppiZXrVqwa2HXHUwMDFiS/tRPbjY04haiFx1MDAwZabBYi9cZotcXG6SUD/DJS6cYv9cdTAwMTnDwFYq+d93t2e9hjpxXHUwMDFmLkFvXHUwMDE2Kb7HlWVTQeZcZlx1MDAxMjSPpj5j6G1BwsO/oldBsINcclx1MDAwNH706230KOmYzfiJXHUwMDAwXCJcdEsv5pGv7NX7iUsx37qUPz3oxVPd6lx1MDAwN8KXXHUwMDE2SieoXHUwMDE1JstcdTAwMDUuu5lfXHUwMDE24s7XeFx1MDAwZmc/3/1cdTAwMWG8XHUwMDE4beph8c9cdTAwMWT7/4lDct2VXFw6QeuFu1x1MDAwZVxm4Y6vsjdRqZJ9j1x1MDAxOTpcdTAwMGIob7m/uipcdTAwMTGxXHUwMDEzJY/ZXHUwMDE00lx0sVx1MDAwMlx1MDAxNpFcdTAwMWLNSpQtuDystKRmXHUwMDA0Ue1tXVx0XHUwMDBiTVx1MDAxODJcdTAwMTWvM89cdTAwMTaT2DhcdTAwMWPU4UWjI1wiTFx1MDAxNOLrXHUwMDA13cPJmE4/lFxceX7a0n9rpH9x6KTIhvIsIefWUFx1MDAxN1YhdNWvXHUwMDFmxJZ1m+HYdflcImPGmOAjVrTi42BcdTAwMTAns1x1MDAxOYNKXG6efWVZkqtH11x1MDAwYmMvuEmMT5lDbiBOkWRL0zBcdTAwMGWEKc3XJ6h8kaI3kDBcdTAwMTLYWvrlZdNiMJH5i+f9XHUwMDFhtf982Fx1MDAxM3tcdTAwMDCZYliElXWAilx1MDAxYrkwf180hlx0kFx1MDAwZSW2me7z51x1MDAwNZ5M9KzDoO+Oe9dOfiyd0MYovCN9pJrzlFx1MDAxM1x1MDAxMti38Vx1MDAwM1x1MDAxOSdM5ivl7SBcdTAwMWSuQ7VcdTAwMTVBXHUwMDFhmmtxMOhQR27F0rbzXHUwMDA1uKDOp7C8/+tcdTAwMWL6n8/WuVxmqFx0ni3AcUFdXHUwMDFiXFxcdTAwMDRzJN9lW5P7XHUwMDE5SnU5xiuIqiT2mM6hboNN82OMJVOCoN6HSL5cdTAwMDd/XHUwMDE3myjkVOaeqZdOMLO+l7hcdTAwMWLp/4f+f7fhXHUwMDE1XHUwMDAyXHJx4O+Q5i6QTO5cXMEjeiBgOtna7tNcdTAwMWNoLuVjVvxcdTAwMDZMLuu9+399yzJ8xLG1XG4/27W5c9hBeuGY518w9Vx1MDAwM+DRNvQ31Z64oFx1MDAwNJ9cdTAwMWRK01wiXHUwMDA0XeWWXHUwMDEy+n7GtszfzDFkgHFcdTAwMGVVqi1cdTAwMTeSfFVgoluSdMlcdTAwMDbA9MJcdTAwMTebXHUwMDBlXeZJiEueXHS2RufdfFx1MDAwMJn+hrlvkaIqOoM0uLvbx013XHUwMDAy3bfxV2dBXHUwMDFml8eHXHUwMDE0o2K8XHUwMDE5TZH+6y0nT05ay39zfFVcdTAwMTD0bVx1MDAwNaShScF1vnU4n1Lw3VOVySpWPiPvMI2nXG78w2X5LTBs88f11eFDezLMTIy7zjLVXHUwMDEx1HA2wTdcdTAwMWSJ11xmplx1MDAxNNVcdTAwMTgwgNIrrt204tFo1muU475w38Xvo/nN2oAg4e8z8avLXG7OWFx1MDAwMEf+XHUwMDA0kFx09WhyT6YgcYNcdTAwMWSpf0WPbq+7n5JcdTAwMWQ8YtmHUEtcIuFESp7QNbomXHUwMDFmQNV/XHUwMDE1YK1p8GZcdNjOr4ExXHUwMDEzIGPDjfBcdTAwMTRcdTAwMTemXHUwMDFmi6G95Vx1MDAxMph59EHmwyzN99WBM1k34Udcbk3w+fLAgvlGXHUwMDE5/3opsuHwKbW/cU6Btc+DcyHKQN4+JVGRzSZcdTAwMDEjVFx1MDAxZrm88lx1MDAwZUaC/+PvarLcqTImoXRXkkLa9q3qvMLy01xc5Jl9V8oxXHUwMDAx5Fx1MDAxYk2hXHUwMDE1LuND+bdcdTAwMWRNszBPU1x1MDAxNclcdTAwMGJcdTAwMTJDczRCMXqglXJJmMZ//3pcdTAwMTmqXlx1MDAxYf63huXhMF+/ZrxgvtGvWExcdTAwMGbPQj1ccspMalx1MDAxOVvr9V3YU2qe/O/WXHUwMDAwiH0m+JRM01dpl1x1MDAwN6K5XbKNaEPx047h3iUvXHUwMDA2hJDwa0W82VSfNlxuvdXeoutz+3F6NdVuXHUwMDFhk/lgTf6nX8ZFUVx1MDAwMdfAeemWqqIsT8BFU/t2vmi0o9mK36frZy5cdTAwMDbgXHUwMDBmeffJinJRn23O3cB2r1x1MDAwM7w/PSmNXHUwMDFhu5h/aM5W+PnIXFxpXHUwMDA1s9CkXHUwMDAxYtXgbEe9tVx1MDAxZDte2Fx1MDAxMLUpnZLLXHUwMDBl526E6mq4odZcZnF3XHUwMDE0r3o9R11cdTAwMTKTQJe1zlx1MDAwN+yYXHUwMDBloc+xNy+GnkPD68FKjuy3JPepukVcXDLCw4vqn0+otStcdTAwMTTSXHUwMDFheN+PQu668y7AnH/TyHuwzDzwQ5n/+lEx81x1MDAwMjqipfdrQ2VcdTAwMDVcdTAwMTJcdTAwMTSyJftf/vPlN/aW5JQ6iOybZDRcdTAwMWSMXXtkY8SxT47v3bcqPZpr7lx1MDAxNP1itJXEo+rNiId3PvGgM9q8Wa09UlopzKp8tFuBny2oKmo+4k8u3mdpeGhF+OztXHUwMDA1tTD+XHUwMDAxkqrcjFx1MDAxYd9YlYO9kYPUrqZC/C/98ufN7mv3dk/Tee/RssDfdFx1MDAxMITP+fVOXnHPRnlvTN5cdTAwMWVcZlx1MDAwMVx1MDAwMYRhMCbRcFxmvpN4V+UsPl6m+uBk0dtCXHUwMDA2QZRed/6HeeiNXHUwMDEzSFxcfyue747Rg/lnSGb7Zu4+XHUwMDA0TkBcblxm+3JcdTAwMTbynO7W86tqLZlcdTAwMDFXTj6mryzr7/z3v76xP7VcdTAwMWNcdTAwMTMrs1x1MDAwNrdcdTAwMDHwbOBI+yZvIFx1MDAwN+ZM+NVnyeiNRbZcdTAwMDBZgjUyXHUwMDBij7+vUFxuXHUwMDA2pVx1MDAxMTUt/rhnoWfHQj90wtwrXHUwMDFk06+mXHUwMDFkXHUwMDE4LTEqJdCpXHUwMDE2qd+eT36JcK/v7uE1NI3EXHUwMDBiRe9o2ebUnOJcYoZN7XpcYr/35+d8z6Vwdf/1v/x8VVx1MDAxZFOKtyNcdTAwMDHbbKB0/Fx1MDAxY7dVRJ2ltYCXe0pSXHUwMDFh09Gv59mLqvbJk+J2WYpWjlx1MDAxZW7bXHJcYmla1MHXYIZRsMuRXHUwMDA38q5Nf3nBXHUwMDAwkdqflkExM9NcdTAwMTa4ULTkyXlK3cafrVeFulx1MDAwMyacXHUwMDA2Vc1cZkGU6ldCSrorr1x1MDAwMDNwQlxyfIk1z1N4n5za1zpcdDZcco/ppdOd6fz91vHwcpblXHUwMDEzY7d2XHUwMDE3qumRuPN0plx0c+LvgnWVZmC6rDwv8de8bm5TXHUwMDA2tXm+rWd/xjh42TqWkNotXHUwMDE3iC7cJoDY8W5IKJwmPUD0UrolkDCgwU+Rfvqi3MQ/vYZ++zhcdTAwMWGvcSz/8mfZ8iFSrTaeXHUwMDBlaMPNWow0iaiF7JJrwaL5w7CDh2+w/aF+oVx1MDAwN+ZxeEvM84JhVyZcdTAwMDHlvEd++/LmXHUwMDE5fFx1MDAxOFx1MDAxMzdqJ8mCXHUwMDA3U6JH1/oyhmbR5ZToW07GT1DQhvHbTiRL6WaFQVx1MDAxN1xcilk8sGVcdTAwMDc/O/JRL1iI9X686kYgmD+FVNv191tcZsfaP619x4K5IWORJGFcInzD+ENVWvNcdTAwMTJ64+FUXHUwMDA0o41yL8GtzOKb6a9147Xpk3+qw1x1MDAwYrs3wUVkyeRfL1xcXHUwMDAw/8n90f0ob1x1MDAxMVx1MDAxNZ81elx1MDAwN1x1MDAxOLmJ4Vx1MDAxYi5Mf1x1MDAwM6C4z8NP81V51kpcdTAwMDNcdTAwMWVcclJ4UCM+QsxcdTAwMTmthkO+41x1MDAwNFP+dVx1MDAxN/DHI9Sxiur6zbRcdTAwMTBcdTAwMGVOwM62v8H8lVx1MDAwNK5cdTAwMWVQhVx1MDAwZqZcdTAwMTPWv7c3XHUwMDAzVF8toU5FZdb5ReBcdTAwMGL2YDTuk1xmOZYjXHUwMDA3x02vXHKvb0TRTsVcXOQ0rLzAb8vhnD12XG5cdTAwMWGDdDJEXHUwMDAx9tCs/ukgxn6+dZo3YOLGv6/nKCRcco3ccjdxndFr9pt1K73U9FIldFx1MDAxOcnYv846y8vcy+ntXHUwMDAxXFxhI5tcdTAwMTYwSzViwetOZVx1MDAxYjHrud+AskBItZrZ4Fx1MDAwNVbvkMlcdTAwMWSboVWdyYnk5u94Lyk1fb5cdTAwMTDDuL7DvmVmU611lOo4XG5cdTAwMDHA+VxmQphHXHUwMDE0049AYVYvOWGraCbC91x1MDAxYlXdciFcdTAwMWaR9z2idVCgmNq3Z3MtXGZYb+NTQYeRXHUwMDEzhOOKrMn6vzlcImog5P/pRf3/eI0hpsZcdTAwMTd+d4k827+t9lx1MDAwMF/lbZPHvFx1MDAxZvndzUxnMFx1MDAwNlx1MDAxMjGFc1x1MDAxY6FTwdRcdTAwMTdcdTAwMDGR8udpXHUwMDEyKoCe+7tYup3c69eaNmQ0LDfFYWd+JJ04ZOfcXHUwMDAwXHUwMDFm4mN2XHUwMDEwr5HIMVx1MDAwZbs4n59tszahXHUwMDA2vWVB0c9DXHJcdTAwMGKZ6V8gnVx1MDAwZpSTXHUwMDBiTzo5/N+ce1bvbtR3/uKnaVx1MDAxNPxq1oZcdTAwMDZcdTAwMWW6kqCJevrkzyFTZqeI6l8vN4dittqxN4tDMlx0XHUwMDFmksHlL3lcdTAwMTHe2K/GXHUwMDBiUaCWhikytsVXpL9gT3mZPtE1aGqmK0c9gG/uK1xm7J9cdTAwMWPV2Fx1MDAwNdyWTLZev/qVqmX5XHUwMDFm1zNcdTAwMTD39uv2r1xcL7NcdTAwMTFHdoVcIlNI0tFcZnmTlVxyXHUwMDBmZ45FbNIsuqgtVtrA0fngalx1MDAwZizg1EhuuzxQxec1J0lcdTAwMWaPg7OZszGOXHUwMDEwa10uJyc5lFx1MDAwMP4+//Bnbb9cdTAwMDSAqPlcZpI0XGIg1s7wcbZsJpCaoOe6NPrh+lx1MDAxMGgjzCjdyJZldivbuK//eu/8NfWbWruvUTCvK1x1MDAxZFxi4KJDXHUwMDFlzrvse3pObbi6zFY95+xd8XlZ426NTLtpo1GcMFx1MDAxZlx1MDAwNMVItiqcYfaqNL+Oe+ScO1x1MDAwZvnJ+tU12WBhvz+P5lx1MDAwNo+AT+7jVqHs0W6Xk6WrXHUwMDA1XHUwMDAz8YqDpOYwoSVcdTAwMTbngeGI7bI588dcdTAwMWY0Wu7/f6b6/2uthqoyXHUwMDFimEF1aI7PRlx1MDAxZVx1MDAxMYTE6Xi6YEBWaC1XXHUwMDE569+9XHUwMDFmR8xcdTAwMWKC+lx1MDAwYoNcdTAwMWbMbFx1MDAxZp4kZ+fevoWotJSIMVx1MDAwN1RPX1x1MDAxMH3VPvVwqYTyzGbfpjZxy+Tn7+vH7c2CU1GY8XbPz3Z+w5lurO3CXHUwMDEyY7NTbVvw7LRcdTAwMDFcdTAwMWPo1WbVoebnebZesOH9p/fOz1x1MDAwN1Q7zkHj4OZcdTAwMTHujqKb8JnRJWPe2TDe+6cthmNcdTAwMWG+n0ZcdTAwMTcgZY+Ly9VcdTAwMTbbs0tIXHUwMDFi9f7zx7+Ni02LPFx1MDAxYXFRpHQ5XHUwMDAyg/Kv6+1/kan45vnO9/OY7eZcdTAwMTec30SRXHUwMDBlYa7cgvFBXHUwMDFjdox+vcu5z1aoX/MvvDecKDJcZp14XHUwMDE5XHUwMDFioF6UXHUwMDAxX+VbypNGeoHNROR8h76vSIRFn3tIstiCva0/+dtSXHUwMDAz7COHNlx1MDAxZSORhcSFnH9aNsyNXG613HC5I5VBXGZcdTAwMWSaXHUwMDFks0ve7Fx1MDAxM4tpXHUwMDBiZzA6JLGTQFaoLdRcdTAwMTe3SPbOeovP6OyQmF99JXRQ/9BHzvenPYSiNtlcdTAwMWNcZotcdTAwMTXA7Vx0mT/UcMtLh7FcdTAwMDaPe29pM1f+zauM1m6+84FSy1x1MDAwN5PK3pyL2Vx1MDAxYVxiL6zZOdiMoCSVTmSOXFxeXFyfkmNcdTAwMWXDnuiHXHUwMDE1slx1MDAxMkO3gjFA8W9cdTAwMDVccvNcIus8JEFTi3DxwtNmdNZ/9aXxr46lXHUwMDE5/6uN/lx1MDAxY1x1MDAxOYepiZErgm1cdTAwMDaIrUhweE7mYG+/eYer/ixOVd/7L1rhbWNHuciIr1x1MDAwZXhov5RcYq90wLurQsm8cebSzN44nlx1MDAwNo/cXHUwMDBiXHUwMDEzvzqwwWMmwSipsm3L3otcdTAwMTXTXHUwMDE4v6S50/RtZ1TWXfc3XHUwMDBmvClCu1efUpBR/mBaebZcdTAwMGX5q7fJXHUwMDFm71xmV7Pei7+bL0CF+1xuxERHwDNcdTAwMDQs5ynhWy+IXHUwMDE5JY987sCdzlxmKZE6eCn+LONULHFcXGJmdzeiLT2g04K7kFx1MDAxNm5VRoDWwMPP/1xyNKFcdTAwMDLcLbBcYlxcXHUwMDBiRc5jy8yELVx1MDAwNztmhVx1MDAxZtZwff5cdTAwMGb/MidcXK0tRXjzpZdcdTAwMTFFwM2/M1x1MDAwMs3fevTSXHUwMDFmclx1MDAxOWa1yWg1wHhcclx1MDAxZGlcdTAwMWZcbtDgJSFcdTAwMTKYXHUwMDE13of4+bnKxFxmkSRcdTAwMGVp7T/kXFxcdTAwMWMqeT1cdTAwMWI41ZmZK9AwK1xuXHUwMDFkLnw6zVx1MDAwNtKKSDrrPVxiozG6vaW6ty7RrsrfxV4nk/+b3fjfOq4341x1MDAwMvRn+1I2UnzRJ0zHmTBpqMpx3/hccpO9fvmDeVTtXHUwMDAx8JzVaGl5NFpoXHUwMDEz7W2ajasn6JpCSdbuYFx1MDAwNrJcdTAwMGJcdTAwMTHPSFx1MDAwMJF5wKjO2DBX0ajV2reqSSfUXG7uTlx1MDAwMIHrnm/UlKCWZV1FXCKG2ef0LbG/luybXCLGb461irH6lP2tI35XXHUwMDFhP69knlx1MDAwMWlcIlx1MDAwM7lpw8RcdTAwMDZcdTAwMTLjkyFcdTAwMWVcdTAwMTZLXHUwMDAydKKi2uLaYvrEMTZAwzDcXHUwMDAxOOil1UbZ1t3i8Cuc6dgzJXluLbuwx0bpVVx1MDAxOG8yeas+sltcdTAwMGV2Uya4v5JMcvJiwv05n1x1MDAxNWmbw4nBk3jk0krnY/baXHUwMDBmW6I32LTHv/nDg3+FLP3al+7ol35L99wzLZJcdTAwMTTfijBrXHUwMDBidz+6WesxaVx1MDAwNMeTmlx1MDAxOW5cdTAwMDLpOFx1MDAxMYY47dO8Ifk+XcWbP7Ofd9eTibuxXHUwMDA0XHUwMDE52KzXijlcdTAwMDRDXHUwMDE4MUM3Z2/LNFrwXkJlfWe059zjr/Bt8Fx1MDAxOZBcdTAwMTcm+oj3XHUwMDA1RNjK32HS1JOlujeJ+lxyo4+5T6s/aUZQXHUwMDFii5JcdTAwMDC23O/Xf3sk/i8mRFY8aKL/TJacuFx1MDAxMFx1MDAxOcxcblx1MDAwMvy4vCvhhJtX6Yu3kU1cdTAwMWK1UYTg+vBcdTAwMTTHodF3S2Chjlx1MDAwMUE2V9L+XHK1TqlcdTAwMTg3wkolfutcdTAwMGa+R+fie2HmJ0t8XHUwMDFiIelcdTAwMWG42cc93+nXQrzB+6JlgvRIWFHhov805/DL9b+ew/WfXHUwMDFl8rnQfvS/71x1MDAxMX+zX168Z343KdzbdVx1MDAwZmfLp1x1MDAwM/hcXCpr63o5OoDq51UwYGFqSIUndKU0Qer6uESjXHUwMDA3ysd9VCP26I3tXHUwMDBlyoy+3s/2ziZTJqToXHUwMDA1TieOXHUwMDFmVu9cdTAwMTE36tptKlx1MDAwMJxcIjdcdTAwMDCgsV01P1x1MDAxZZ11Ylx1MDAxNtLwXHUwMDEyzYt+YuTAmiX/7t8l+5xcdTAwMTWFzovvX1xc/ln7aYcpXHUwMDE4j1pcdTAwMGZcdTAwMTk0PmlcdTAwMTbRhPsmeFx1MDAxOXFql4Do1ugv4rxcdTAwMTlrXHUwMDFkKjysa3NjxVj65MRcctl0QzRxwlpENlpcdTAwMWKGR1r0ReJhqY1UmGRVQ+ZIW1wimbmQPdVg31x1MDAwMlx1MDAwYoeBKOmDXHUwMDBlpZVcdTAwMDaoXHUwMDAzRV1cdTAwMWZEP3RcdTAwMWXdINo7T3TDXHUwMDE5XHUwMDAzvFx1MDAxOYJ9/fb3/+a/LWs9cLlb291Bo6tipmGyTebwnriQ41x1MDAwMlx1MDAxY4ZyVPCZn0uze1x1MDAwMp/edlJEXHUwMDA3wV3kmXNcdTAwMTVy6CH3XHSDa9lcdTAwMDdcbtg1r3no40ZcdTAwMTZcdTAwMDNcdTAwMWMnoKlcdTAwMTJVXHUwMDEyL1x1MDAwNj1UXGZ1XHUwMDEyXHUwMDAzrFxu/+s98ORlz6//4VdQXHUwMDA1XHUwMDAxlZD512vJXHUwMDA3cjr09mV/O/RcdTAwMGLGelxmo1x1MDAwMWVwp0NcbqhENbPrc5FoX1s9znwglTiOXHUwMDBiXHUwMDEx/aLK5dw5LpTTo/YhSDG+ynhSvl5gkcRekzie7JTdflxyXHUwMDBmoSF6dp/eYEhPjz5cdTAwMWRcdTAwMDaaI0BQXHUwMDE2XHUwMDE3I7Q0QCtN1+JT91x1MDAwNVthIM/P+jKEiKvoX/fcQ8u5fjvdXHUwMDFlfc9cdTAwMGYnoJFcdTAwMDRO1krdK1qd9utcdTAwMGa02/fuu1xc1Fj9eTRcZlV7r+JccqR58IJUS5CwX+8+Vk5cbr3aluZszLVFXFz6IVx0O3aAXHUwMDE5sqNH5YH7vuXqXHSa3Fx1MDAwN8/5zVx1MDAxOazkj4nnT0/xOFx1MDAxYfTpX1x1MDAxOJXaXdttOkbLWkhIIVx1MDAxOaqgyXu7Vo0vXHUwMDFkR1x0Y9+dX1xyXHUwMDE0/uhnuVVOIMosvKKOWVx1MDAwYlx1MDAwYoRcdTAwMTZKz1x1MDAxZlPcQUcjllx1MDAwMUlQopyJkFx1MDAwN6LskTP9rv1+4Porl4RcdNJcdTAwMDRcdIWZXHUwMDA1buPvkqMjkVRLuK1cYls0oFxy3TRxIVxc2Cz60r85daSyyUz9t1x1MDAwZpAzbWVcdTAwMTOBokE9XHUwMDE5XHUwMDA28XA5XHUwMDAw/D1cdTAwMTn9Lui8XHUwMDE1XHUwMDBi1Fx1MDAwZTr6r+YwtVx1MDAxM7typfv1ythcdTAwMDaZ+iwknFxub9fflL6KpWx4XHUwMDE56VDkr4el3aL1QfaMJ1x1MDAxYizbSO1ecaJArOKVXHUwMDE0yJtcclxmXHUwMDAw58Ll9Y6I4bcuy9hE/7+1LP+bm7hjstrZXHUwMDE2QFx1MDAxZWdCkL/byc9JLaJKT741bkxiXHUwMDEz71x1MDAxM93k/uO8sVwiK/HhkVWfTjMsab/GY5N/QWB9c3q8OqdcdTAwMTVcdTAwMDebKK1cdTAwMTi+I/yGQCpDJ7l6XHUwMDE36Z/6ufHzKmjhqt9vwd+zmsamRNv2J8u7b5qnXHUwMDExl8PxW8fxT/y1tlx1MDAxN36oxq9Rd+g2K+fB/7iLj92LuVx1MDAwNXi+hX3OqTyfs2Kq3N1//fp7glx1MDAxOc+NzsLSXHUwMDA28+aEh6qzXHUwMDBl01x1MDAxZJdL4Ws5KVx1MDAxY1x1MDAxZeglUH99bFaC0H01M1xmUPWDgf1cdTAwMDdcdTAwMGZEdj/G3/m3JayO3Y/xpl1cdTAwMDBYwmepNPjeM+OEQY+mqDdIkVx1MDAwMXz7wIVcdTAwMWNQZFx1MDAxYd5UjOHvXHUwMDFlXHUwMDFjvOOW/Yc3dTlcdTAwMWWthlRcbkqS+0dAcuCDLumT2+hYQjdcIuTgXfh2zVxycro4XHUwMDFhXHUwMDBmpvNHL0NcdTAwMTelz30w6V26lFx1MDAxY/EwotKS6zMmK4kjudpFafU7v0lUqYamn4g1sp1F1GdVJ/FcdTAwMWTmJzF6XHUwMDE35K9WcVx1MDAxZoZcdTAwMTNcdTAwMTmWzVx1MDAxMldcdTAwMGIkhebhMOjrXHUwMDE0tlxc+jyZ9tG68p+ZV2fCuupfPeJ+dahazGxcdTAwMDRcclx1MDAxN5dCXHUwMDEzXHUwMDAwVsTG3J/X/iboT5tyaVToXHUwMDBmcemPh/FrPCk2XHUwMDE3KPmRrW3fplx1MDAxZVx1MDAxN628XHUwMDFlXHUwMDExjLzys6liWTvLXHUwMDAxeTjXk5ay6aruQn29VPPJXHUwMDAxTc6eu3xuL7jfPiS3O2PnhUj/XHUwMDEw15mHukeJzCSu3Pd1qN3+QjVcblx1MDAxMfhbXHUwMDFhaWFkbY3ndl7xzH/xLXZkmVdoylx1MDAwNUF2kGa8XHUwMDA2baG9gkj3O3yreOxPy1x1MDAxNbHYwFx1MDAxY91cclGMXHUwMDE1lC/621x1MDAwNN2JVZdcdTAwMTSxtOopyC7D6VGXJ92LXG5YXHUwMDFk6rl1z2+chU6tayaBUGdaXHUwMDE5T1x1MDAxM/BcdTAwMTWuO1xi4l04I0iCL0BYY1x1MDAxOGOjopJJkfbH496IgVx1MDAwMf5cdTAwMGLLtkfHd5uH4atixWaCdERccua45r+WcbRcdTAwMWOEIEpg+EIjM7gk5ptAXHUwMDFkhDFcdTAwMWVfvfWZP6eeZO6JgZCuq1x1MDAxY9DZdSVj9eojyfedLTT5/XVBUd/+zDijuHRcdTAwMGZp9K93072mXHUwMDAyjFIjg+HTLvLnJzagjtHyXHUwMDE0tVI6ouOwmu8yzdy/uTgvK5DZ/z1cdTAwMTP/n+eQLUNGUVxct6OBieBXXHUwMDAzMrnTf3SpoW5cdTAwMGKvxkTJ5FOVbvNcdTAwMDFcdTAwMGbtXCJeclxirFx1MDAxYlx1MDAwN01cdTAwMTFWXHUwMDEwt5w67lxiR9+62H3Mj9Op1+g0QJDbYo5GMkLnW8zce827z018XHUwMDFlPFx1MDAwNlx1MDAwMjdJdsSjQMRCsaXSyedcdTAwMTiNXHUwMDE5/MWXOt1zXHUwMDA2n8Nm3Oo/NSb6j39Hiptxf8dcdTAwMDMn1z7bm1x1MDAxMYErj/7jXHUwMDAxXHUwMDA0XHJ4tFpcdTAwMWJcdTAwMTlplZCEXHUwMDBi9JskQfozSzJcbprPdFx1MDAwNVx1MDAxMblcdTAwMTRENfnyz+pXvkHh8rPRXHUwMDE0hfsjm6nrbVp4kcBQ5YxmvyPiXGbuJEKWn3ieTYpcdTAwMDZcdTAwMDdcdTAwMTBBXHUwMDFi48aXU/FaPL/s5ZSDWli7Z1x1MDAxZtxcdTAwMDbRvni92VW2vuZ4+875RVx1MDAwNPC87Vf2hZNcdTAwMDDZaHT+XHUwMDA0WlxmVH09jlx1MDAxOLMoQmUojtCqVIW5rlRrjlx1MDAxZIgl83I57mW3qGXuT76ypJTOkVx1MDAwN1x1MDAxZdNB7z10yFJSz66NU9BcdTAwMWQpJtJagDw1XHUwMDEy8MZBUFx1MDAwZudcdTAwMTK6eVx1MDAxZFx1MDAwZjqSqVx1MDAxOYzzn3xcdTAwMTFccoIzQ9ul3SBcXIJcdTAwMGW/XHUwMDEyWIZcZlo3fWdcdTAwMDdCvlxy/sldxpXt32xuc1x1MDAxYb3PP+p8OOHYy7csg95ShHVcdTAwMDfS2lx1MDAwMLfNcCGIJoiE32uja4pcdTAwMTJh+ic4UvZVXHUwMDEyWOK/7T3XX3ZufVx1MDAwMef7ZZIqvVxmcD6/oZR4dkKVXHUwMDBinm+t8kggbFhxnqVIapjorEaAoDa41Fx1MDAxNuZ2Nlx1MDAwNVZcdTAwMTeA4ppzXHUwMDAw3HbAjL+oliTrXHUwMDE0XGZD333IleasarWnXHUwMDA15NsnhVx1MDAxZU9s8+swf9rpL01psFx1MDAxM9N8XHUwMDE2elx1MDAwYnT6XHUwMDAynPdcdTAwMWJMVWNgU8qRZeH7zlvVoiGBXHQ/cCRcdTAwMTE0aU9e9GVUXHUwMDEy+lx1MDAwMKH2XHUwMDA1fGHTw09BqNBlwzGGj+hBk5xkQu3IO9GeXHUwMDA2meI2u2xHXHUwMDFhPlhgoJGkbVqJVlwiOVx1MDAwNcTD22+0XHUwMDA0LszfLEJcdTAwMTNcdTAwMTJcdTAwMDCVTFx1MDAxZm2qVn/hxlx1MDAxM8/qKLhTaO/o21x1MDAxOdC7pOa3e4lQe7anroQ2ydJMQGtccm5k87GIQkFYXHUwMDFjd+LxRNjzTLWbIeRvYlx1MDAxOXgxdrTdXHUwMDFiXHUwMDA3Z+38w/dzrWDyY/aSJb+Qflx1MDAxYmZcdTAwMDGQ33W20VZyNuk2TFx1MDAxOb2+jFx1MDAwNvekmC00sFxyxVx1MDAxNFuW12IwXHUwMDExJz/rxSghnlLh+Fx1MDAwN1x1MDAwN1Z8gdTAYEZcdTAwMWX07TJcdTAwMTNcdTAwMDRcdTAwMGWCilZQ6ebE7Vx1MDAxYpIuJDLkn4NWuMeiRXVAXHUwMDFhrP1BNjbWjVxcXcMlXHUwMDE34Kqm8fHkiPpN2srhlXi4TlpcIm1S92T4dj53tqRHca9CJ0WwXHUwMDEyK8Q27T70qNKR+fmQSdEmIFxiLIuUrShcdTAwMTJKvUxXXHUwMDBmeldcdTAwMTdpu6X06Fx1MDAwNWhLeVxmjNk1ver+XHUwMDFm3vJSVyExMarlY/hfhyapXHUwMDE1przUo3qzXHUwMDA3hVx1MDAwN7G4hqZcdTAwMDdcZvt5tExkrU1g75J3XHUwMDFhQ3D8drOQK9ikaZCgWmKjaq9cbpKuNFx1MDAxZVx1MDAxMMoxxpckXHUwMDE3OfrqQP+Dovf12cHbiErFXHUwMDAwMGgqoj1+V1x1MDAxYvvuybSFXHUwMDFijmxcZkyxXG5cdTAwMWbeljtcdTAwMWIs9kRIMlx1MDAwZruRnuFcdTAwMWXFNuSt/Om3TzgvniqWXG7h2MZz/nXPpEVcXFx1MDAxN4JZSG0guqed6t5E8/Jcbt3UhIRcdTAwMWJcdGtcdTAwMDKsXHUwMDE3XHUwMDE2Y/7pMFx1MDAxNSXuJVx1MDAwNnExjt2J+lx1MDAxMK8voPB2ZnEqO1x1MDAxN5z4fTLNwUBK8cjrrc16rYM6W5MjevTaPqCYXGJyXHUwMDFmdoJ2Jn3dZ3WQgLmj0Fxc7flmQbNBtVx1MDAxYU2evjSitFx1MDAxN1HGkHVRqqlhXHUwMDA1Llx1MDAxNcTIXFzxyrbSf5fcvzTKpPe+1aaJ6Vk7OKLLrlHq5dBcdTAwMTfro5/FPJeANlx1MDAxMVZmM1x1MDAxZPFXKGJQt6HmROg9u7DXXHUwMDFjO0Hta6hzMq/A9yhcdTAwMGKT+lx1MDAwNIBcdTAwMDPr52fd1IDbKiU/N3GnXHUwMDE5+XxVUlx1MDAxZb46rFx1MDAxY86UbumS3Fx1MDAwM5TWwFx1MDAwN8T3a3tcdTAwMTRIvVjVO0pasu1RZmPFyi/LXHUwMDE36VSBXHUwMDE4/UtLXHUwMDBi1+eYXHUwMDE5lPl+XHUwMDE3UO6zPP3qujRe2ou06PhcdTAwMDWTpSZk0dFXPYKyvpvNWlx1MDAwYpdcdTAwMTNLap3bXCLcXHUwMDAwzj7vfqeGrJZcdTAwMTZBiLF0M3NlULHixFx1MDAxOYV5SeKyXHUwMDE1S9vLLZ1ijXO7s4R6OFmYptVcdTAwMDRtTrhoyXlcdTAwMDfo7Vx1MDAwMTcwXHUwMDBlT5j95r4lUpe9cknGjtrPc8wmOVxuRdJftXOPatBtXHUwMDA1MWfdNnBcdTAwMTD231x1MDAxN1xc++hFc1x1MDAxNZIrRERcdTAwMDBCUlVMg5cxTHS+tFx0cPZZYofpw1x1MDAxMT+96Fx1MDAxMGI2dVx1MDAxZbZRLS9RRmO2r9fQs4jJwlx1MDAxM3iczplcdTAwMGLR1KW9VJ57WjZcdTAwMWIomk74jaSURMVcdTAwMTdcdTAwMDVcZvugwN1OPPn/yteeNOBcdTAwMWPYXHUwMDAxeMBOnfJA9ptKrTBNLcNcdTAwMTQ2XHUwMDE03Nyr/tdcdTAwMTl+Ydx5fStcdTAwMTAotVx1MDAwZrUnXHUwMDE2WX2gnlqEJb+Z91x1MDAxNzOB19iUrTYqizHG5uuCJetFJM6X+Vx1MDAxMvjAJbNsmzMsXGa1XHUwMDExs7dcYlx1MDAxM9/d04c6e1x0XHUwMDEwZ1x1MDAxMV1vULWWxK0uNe3Ydm5l1dtcdTAwMDAotIVcdTAwMTYhbIBksie4XHUwMDEzXHUwMDBl0DfUYGGyg7RcdTAwMWGn6uJLOfv5N9BA0O7B/uudjLFcdTAwMWRT4Kq3/VCMlKQ6/Enh/PW+c6XFyK2cxzSNbSPVw3iXQm455jn/+qnVfc3sjcaZI4ZetktHavdVc8qoiKv2e4KWZfgyXFy+31x1MDAwNWxcdTAwMDbqXHUwMDA3QfxcdTAwMTeadohriVxmXHUwMDA1ru5cdTAwMDbmaVx1MDAxZoL7u8hUOzU/+pNRNVx1MDAxODX/V4Pu/Gb65t7xj7eAX99bn1x1MDAwMkBVXHUwMDAySSUt+uL9WdpnNXqKR+vldIKSeMvb4JQ11VWMjtQtxemHaC+GXHUwMDAyS9/V4I4u/Vx1MDAxY/VVsvmIfHFQXHJJPebPmlZv+lx1MDAxMPWhUNJVjGtcdTAwMTCKT7KUe4lBXHUwMDFkwqdEf5M3SZgk6cabUZB2UtyIJ7PucFx1MDAwNrPgXHUwMDA2LLp4d3LWhkzycn69XaxRpViYXHUwMDAwvlgmQ+lfvlxuga1cbuZhZ7a+71x1MDAwNVx1MDAxMuehVTv8R1OGK2Pvqui2JEGTt4m++uVNa6VcYkmJ78dbMlwiZ1x1MDAxY1xieuVPJS3VXCKUeYspg2YwT89Wz31dvFx1MDAwMYHRvtNJWv2VJO+qbFM4XHUwMDBimoZvcGzHXHUwMDBiUihByoR2KeluOrK6fSHeRrUuWlMhSUwwtpAqhpXyq2qMPXf8XHUwMDE136XASNzkxNx0gd+uyPOtRz9cdTAwMDbpPidsKdlEWnCg6MFFRz1OkL5cIpbxNpspyGKGI1x1MDAxM+Y6x+eZ/YWye853P5+Ul390a1x1MDAwMfm2y99cdTAwMWYpSYr0dcBcdTAwMTmTXHUwMDAyk6ljXHUwMDFmXHUwMDE3XCJ0U8bmXXbljlxiRYVcdTAwMDZBLWpM+lx1MDAwM2Z5vcFFXHUwMDE2onFcdTAwMDElR3X8Wd9Xt2OTkPCr2lx1MDAwZWH5Z+z0r4ib/PmhXHUwMDBim0s9yXyeYsBxgFx1MDAxMH0xZbOl0NtcdTAwMWUyXbuymY/S7KNN22bM6/P3o9xcboM+2s2uI/BcdTAwMGJy56BcdTAwMDUtc0a7kuRuL84+KjhGM2EjRXFcdTAwMDdYjsw7/qInXHTm8Xx30/D+SlwiLj9492aedVk69a+7ZVniapvrhXXJXG5cdTAwMTT0d73fXHUwMDFkXHUwMDEwXHUwMDBmn2VS6lx1MDAxOPvuLaPLk6KZudL1N1xmwMizrm3qXHUwMDEwWCTtNY38Kc7gU5jHvjNNv+xoUlx1MDAwZTZcdTAwMTE3RFx1MDAxNcI041x1MDAxMqA2OvFdptSXamhiIalpMlx1MDAxMYrB90165SxcdTAwMTnpqFx1MDAxNM549M5QdFwiXHUwMDAyi03zXHUwMDFkw/8340JQXHUwMDA1gbOEXHUwMDBmXHUwMDE3/rf/2W/dq4ow/Gd62Fx1MDAxN1x1MDAwNi55XGJe2tU9umXzde88SnuHvkfDxl6Dyt+mdzhcdTAwMDLf65pcdTAwMWWvTXb4Lm9CSbxewjogeUloutn3yi1+j0A4bMhacKjVo+Frd5RcdTAwMTZgw7eo3UyM01ZcdTAwMDeRROlTYyPo1Fx1MDAxZoxcdTAwMDb+ZM6QlEv0ulFcdTAwMWJ5yJ3W22X50OhcdTAwMTIpaf3F/vdcdTAwMWT2j1x1MDAxN2NcZmXRXHKBXHUwMDA2XFyL9uqLoicuXHUwMDFmJOShQSZuS91cdTAwMTCqmMTOWun79pIw+F7nW5DCL8rlJ8vHL7nthEFz1YByYGz1QOeewKDWKzG0sOY7WftL4jfQsqxcIkry/sHmg6CJTVxur7M49lx1MDAwZrrOsM4pUNOHsvtrJ6NCXHUwMDBmPsdHhP+jjo6T3NrmeyHcaeCBTFwiWFoji/ZcdTAwMDbJeLOYUUDPXCLGXFyuyHlcIqU/+pI4vMBcdTAwMGZX1jhPrXdFVVxm3WzMvFxcN175LDi6/zPUi1x1MDAxY0TCXHUwMDE2bVnPdmOl0klK01xmpVx1MDAxMtAqVSDNcPZ0n6H3TtBcdTAwMDO4v1xmXHUwMDEwiENEvEpEJFQnqzPAQSzzIVx1MDAxYfXPX628lFs9/vZ6l0G7+sy3skCS5lx1MDAxMG+LM+B9TNJcdTAwMDdcdTAwMWJ6QyWeVL4yXHUwMDBl11x1MDAwMlx0XHUwMDE3PeSaQ8P6a+SMSM698+hcdTAwMTVcdTAwMTXqhvZWjs5cYoTmskA2uqImXHIzXHUwMDAzidw9VlFcdTAwMTCM9+X2eJjwkFDDp/XQvIfnXHUwMDE1dbdcdTAwMWHfXHUwMDA0Xi/h1VA89Jv/Nlxm+HyO5T/yntt7NdPLbYh/8T2X45xcItD12iy69Vx1MDAxZFX29+eAOctcdTAwMGKSXHUwMDAyXHUwMDBlyUe8ebA406ByXHUwMDEzP7WVkfT42lNcdTAwMTNSrPj1XHUwMDE28Fx1MDAxOZ6qh2tcZtz7tdxFvuhF0YlCiieV+odcdTAwMWaBKzqdYLGb0nGQXHUwMDA1td2/bMPjhbF+XHUwMDBmQGZNKSwssryZXG6afv6BNt3N6V9xq0elr35cdTAwMDVr3yz0UkBKXHUwMDA20LomXHUwMDAwzz9t0Vxmo9Saheg+OILn0CFnXHUwMDAzSVxudz3DXHUwMDFlJWKsNnbJfO+9XHUwMDA2xr8+4CtBpOpcdTAwMDBcZqPz1OHt1PdUs3mILUxyXHUwMDEzcYFIjlxi0lximihxuFbUNsDk9PbJw5Ij1HJpkZEl51f72dCE+f5HffpcdTAwMTOz21x1MDAwZsvCfcidQq1iXHUwMDA0ePRpREG+UF7fLuM8KJdcdTAwMGJcdTAwMDfiVS7hkpBPsZT2ja9cZuOBXaVrWG9cdTAwMDbO+1x1MDAxYdZcZm1EpjF39vJcdTAwMDSjeqv7xjXfJFx1MDAxYZikXCJcdTAwMTHgtIPgRVJcdTAwMWJQZP1VqTBGN+uritq6XHUwMDE0eO3nwVmB29X5v/22XHUwMDBmx1xixOtJoGqeotdS7MN3ZXVcdTAwMWbkrX1Xl/RVUGnR2tpcdTAwMTiU3Vx1MDAwMlx1MDAwN35cdTAwMWN+zc+1aWpcdTAwMTZcdTAwMWKBQedkNnpcdTAwMDBcdTAwMWO+eYKV+oAkXHUwMDE2obbublVcYlxmqLyH4+5Rc7w9bMTmyn7kiFa0xbptjUSXXHUwMDE0WFx1MDAwNHvQXCJm4XKddqKmVthsmTNcdTAwMTNU/7676u6G9a/vzn24Q4tQSNLy/EOkOVx1MDAwMFx1MDAxOeOogXIk7jZSJkxFkrdcdTAwMDFcdTAwMWRcdTAwMTaLVYKK5XRQf0eh0NdYf0GcKZ6ObtvV0o1cdTAwMDPyyTKlJj5cdTAwMWLoarbZbGZay+9cdTAwMDVcdTAwMGL2OO5zcou50ZHpXHUwMDA2XHUwMDE1aztcdTAwMDfCz+DrXHUwMDE2ujdcdTAwMTZcdTAwMTFnW1x1MDAwZTVcYrkg7zS/b2dr0qPcXHUwMDE16MHR929OqYBneVx1MDAxZf/DS8hcdTAwMWNhqXaCMeZcdTAwMDM94J+3dIJcdTAwMTdCRFx1MDAwZs9cdTAwMGZcdTAwMDAgsIbcelx1MDAxZnxGibPxblx1MDAwNTSgu1QhOSTEiFhXztL/XHL+XHUwMDFk3pBsQPeH2qhcdTAwMTbPLficjFx1MDAxZFhcIj2Qn9BcdTAwMDE+Y3JFiFx1MDAwZYkpXHQ+kSOVi4/Oerdt4Et6V69b3H10lEGsj6zJ0V+yIChNznRcImhcdPdcdTAwMWV4XG7x973pn/1cdTAwMGVcdTAwMGWJXHUwMDAw1rG7ZYs+yDNcdTAwMTM+XHUwMDAzXHUwMDFklN/DOUmzil6tt1mCOrp5w1xys0B5UVx1MDAxMpRcdTAwMDA/3ztAXHJcdTAwMDHcXHJcdTAwMTXqVtFiJe9cdTAwMWK4sVx1MDAwNMNcdTAwMTbTMsJMpaJcdTAwMWRcdTAwMWbUfVx1MDAwZvnwUFx1MDAxMyvEw2xcdTAwMGJEKUjMa4nZR7XUOWKlyPvhjP9feVdcdTAwMTaZYFGA00Uge1x1MDAxZlx1MDAxYUkh3lx1MDAwN9HPyp6/XHUwMDE0jFx1MDAxZb7EXHUwMDEzM1x1MDAwNPPBo0UvN7r9XHUwMDEyPLtag+C8jlA8YNBJxfOtXHUwMDExXHUwMDE1Oq9Sfeb6XHUwMDA1QsjgNlx1MDAwZu1PP9HWXHUwMDEyijZcdTAwMWVB4tsp7pa7/FHkT6ODXHUwMDA1yt+QTibzQqZcdTAwMGLyQWHPXGKA1pfY4+eBYVxylp+7XHIsocAmXvU/fJv6852a7s09LFx1MDAwMW+oXHUwMDExXHUwMDA3QYh4eU2kxfjAQDrKS2NcdTAwMDPHXHUwMDFi8iTF7LOa8NloXHUwMDFjIESJwy7NvG0vLDRr8/J7TnB8h7KDdVx1MDAwNm7SWXJcdTAwMWaG6HHcxMJKxFx1MDAwMcbQzMzfKLVvyOzcXHUwMDBml1lcdTAwMDSwkz2agYqTOn9NpX/l2s1emWibzOf7XHUwMDFmdUq2XHUwMDEzh1x1MDAwMFx1MDAxYnGPtLJ2XHUwMDFkyLOsQ/GALUm0RtppxCBX4y+jbVx1MDAxNOv95K0t5snXu7remX0lrllcdTAwMWZomjyxmin6+k7QwT1oJyM8ToeyUuKd0PHh41Dq8U1cdTAwMDNcdTAwMWViJSyC4fdcdTAwMTbiJ55cdTAwMDHEfq1cdTAwMDFcZn7OhVjIoew1XHUwMDE211x1MDAxZt7o/ZpcdTAwMWZcdTAwMTWOT1xmxv6ve/6s+lx1MDAxY1x1MDAwN1x1MDAxYylcIkpcIlx1MDAwZuZvk7Prh/7yzvBN64HCn3YjvWXPzrrGWE09uouBnzpiK1x1MDAxNFx1MDAwMv1oXHUwMDFkRKeHPdJcdTAwMGJcdTAwMTWTb9rxz7Jjs/v0V3m0gopcdTAwMTRccjS8XHUwMDBiiFLR4jbhdCfzJVx1MDAwNa7wxb5yUcD/+Fxcg65nXHUwMDFl3fF+Y/n533lcdTAwMWa/7390Mds9m8zXq+JcYqLvSSmLXHUwMDEwdHhhb7DAI4K+6M3AdMk7XHUwMDEziaPs6Fx1MDAwNeGSqSdu3ZutUbVccprMXHUwMDBm/n76m1x1MDAwMIiVjOjh1K+Mai83jIdrXG6txFnfL2Ncclx1MDAxZG5cYn2qy1X7ooovf1xcWFx1MDAwZVx1MDAxYbvbfFx1MDAxMdC0ZnDFXHUwMDEzVS1cXHxcXE6pXHUwMDFhUmH64VNhezE9P1RHbDlnXHUwMDFj/z5nXHUwMDBmR2bmpEZcIrqgzKFQLVx1MDAxMvh8duNQXHUwMDA1tFx1MDAwNixC7oTvo5FdW9zfUOTZIzDsljzaQb8qmVXIqPDWlCx5K36SXHUwMDE4a7e+RCuqnaFRddpcdTAwMTPaVdG94vBeXHR6dotcdIKlXHUwMDE0I55VXHUwMDFjlz+gcJwkXHUwMDFlblx1MDAxY6++gpiBI70qXHUwMDAzP2bYkn1T/n22IFXmXCJvM3E9KML3SeFIkIB8XHUwMDA2XHUwMDE0SYxccjXw9e2ShpsoXHUwMDFkXHUwMDBmpHLQKkMz0vMjY5ZcdFx1MDAxNX7WaXZNqz37b9G+m6z9RY6uP76qcM/qIFx1MDAxMCSgXHUwMDA0wbbxiFx1MDAxYoQ2jkZcdTAwMWY8yU+anIorRcpcdTAwMTlfmFx1MDAxNalvXHUwMDAy5ZnlXHUwMDE3ntFyMCytlMr2L+/2s7et7XFZddxcdTAwMWFYP1x1MDAxOanVtFx1MDAxOXqQXHUwMDFk7WrodiBA/ipB3EIrJSO5iyVQXHUwMDEzqdrDXGKI6NVl7KtGlZT4IKQtzcPNZt10kzXCmfi6KoozXlxiJzxcXG1S/Pm0rV1jZ0pNwbApjjlYN8HoPe2gkM93r7lcdTAwMGaexHlcdTAwMWJxXHUwMDBmdnmK/Ttfwlx1MDAxNSp/9df9g1xyXHUwMDAy5qsvWFx1MDAwN2TyfcXEbc0jsYOc2OA7MLYlNfVIUu1TXHUwMDE5IahcYrmVLfX95KxijpE1XHUwMDE3Vlx1MDAwYv1ShLJcdTAwMTXLS030UFM+7U3dXGKC3PZLpCHsSY/XklhtS1x1MDAxNbnn0DicXHUwMDAz+syDd4leJ2uJy8xmj2iIuzp8+KPwZ7Zn8PNp80f4r719ePn26Fx1MDAwNUf8XGZnXHUwMDA276CygihcXFM+v6GzUFN5LcpNXCJgXHUwMDE4XFyxhGEh5ZNcdTAwMGbCxv1WXVSaXHUwMDBl35u05T0yd7i9SkbFflx1MDAxYopcdTAwMDXo37qyPlx1MDAxOaaZa4dUNHBcdTAwMTfv3d1QXHUwMDEwmlwiQVx1MDAwMjeINUOm9E+fQq4klP43XHUwMDE4QPp5VjL6cnXk7/v6XHUwMDFm/1x1MDAxMvgmXHUwMDA20MKcXHUwMDAwnMhQaVxuMioyLW5cdTAwMTZcdTAwMWRcciuTOlx1MDAwN1x1MDAxMz1cdTAwMWXoQkLGb2N/Slxuq2iJzOlUcfZ+aV9cdTAwMThcdTAwMTTwO6qYLVx1MDAwMkc0XHUwMDAyaFx1MDAwNd3XeOR7yUeEKDFfXFxcZv26JlmhKfhcdTAwMDVedGokSXf5eMCh79tmXHUwMDE3ylx1MDAxMb+UOLTf1/+zZ8xPy7Aqe7l/9+P4rb3mJlx1MDAxYlHuuzlqn1x1MDAwNkE9gZHgQqLdm0nqiy0uZMr4Xbywj5xcdTAwMWHLy8SQ71fO48x27L7qVFx1MDAxY4dfvEJSkadcdTAwMTPK8mTSqa+RXHUwMDA1fc1OkWDFo+44Peve4TV8jMtx8lwiJFx1MDAxM0j77Fx1MDAwNSpcdTAwMWRNvSFcdTAwMWSRhXFcdTAwMWNy+Kiti0HqjP1nbt9cdTAwMDOocG/XxN8x8Fx1MDAwMzalXHUwMDE0XHUwMDEyJVjQXHUwMDBma97PiSZvIHpcdTAwMWLAwILJ3r8l+dM+eCXFw/61pPzJXHJ0rzVIRDzcT2h5hYA37SXQ+v1tz/7G23KRqmy1UYn80KH3Yq3woa9cdTAwMTGCTFx1MDAxYlx1MDAwMq3CXHUwMDE2Ss7iXHUwMDEyIKDuklx1MDAwMUbgsktcdTAwMWFcdTAwMTLDIUmMsVx1MDAxZvjrhLg2ytp/3s2dX12m+EnFNFx1MDAxNv5eN2/HtlwiXHUwMDA1qKbvpnPvdEGWIUi5PTGCwNHM5NFW4VFcdC8jfVx1MDAwMXxcdTAwMWMu88tRy3ZcdTAwMThcdTAwMWQ1VjatXHUwMDAyXHUwMDEw68JDI6mPTUenwY2/qFx1MDAwNyjP5ilwQHrJw/+4XHUwMDEwu4VBd3QqXGYqglx1MDAwNSNcbkchuPFRPr+wNChwOVx0P+432DPMK1x1MDAwNMmLR1xupn5zw6HDl0d+p7mAXHUwMDA3/nXu5idw1s21uVx1MDAxYviY5pA2KFx1MDAwNmz5uVx1MDAwZdBcdTAwMDWuNYXrPFdyYE9BS8BcdG0mfq84v1g+rjY2rkGZckO7U7ygeZPTQMvzjNhK+c6mNuWfXHUwMDA0J6dTgZedXHRcdTAwMTG1cyhSuEDAXG7AUlx0Zlx1MDAwMFx1MDAwNdM3QoKkvffsXHUwMDEyrJ2HzcdcdTAwMGJcdTAwMTODfLH/YJvMc/jPQ99cdTAwMDK7gf6rXHUwMDA27fkmisioo1x1MDAxZrT4aaKgkn1IsPbAM0WBomjZXHUwMDEy15RcdTAwMGU9dLxjV5zXkEJr0lx1MDAxZP/wX2etXHUwMDEyj3aH8LCM0UY6Ulx1MDAxM1x1MDAxYj6xIzfhPlx0uHxflzB2qOJcdTAwMDZcdTAwMWZiXHUwMDEy21xmoyElWVdP3IiEskjjM1x1MDAxM51cdTAwMDXg3cKH17jiwra4UtowmGSgM9Q+sVx1MDAwNCfcvW5cdTAwMDA6vFx0mdigj2v1jPBnrzVcdTAwMTdnXHUwMDE4XHUwMDAzrTnKO/5V+2d2cSlKap73U1xyjsW2z1x1MDAwZVx0JMojXHUwMDEwXHUwMDEwlo3ei19cdTAwMWMlpFxyeqtYxqS+I1VugvJTlipcdTAwMTMykV+lbzfMdNZF9ESnd/zA+GNLu9xUMXKuz0B1PVx1MDAxZPHJzrWeM1x1MDAxMuWvXHUwMDE3vFxciJCMKVx1MDAxN70sXHUwMDAxXHUwMDExpp70fmzKXHUwMDA3063paFx1MDAwNXvkM3BcdTAwMTZcdTAwMGJcdTAwMTJ+Mur5YKs1KshcdTAwMDGmPpN4XHUwMDBm93lcdTAwMTLa+Wi+iP+fl8PPdfj/guvmYYgqQuD33EFcYnZRz1x1MDAxZfU5oqtgxzGFgeJ5I2n0wVx1MDAwMURcdTAwMTWeJuJyhK/XSnidqmCVrmjBroqdMlx1MDAxM9pTJcabSmAhR1x1MDAxOf1ccmK0NGXYWO/Uhe2ieoVcdTAwMGXub8FcdTAwMDY7Olx0R4kxd+gpQzOe+q2uk3f5yKZi3sEnbYRcdTAwMTepW1x1MDAxMjfuy1x1MDAxYuJzzHlcdTAwMTPO8b81L5DyfFx1MDAxN1x1MDAxNKfCz//l/4KUXHUwMDE2uiRNOvGMZf/G12Z+8pVcdTAwMWNcdTAwMTDPXHRcdTAwMWE97LQzT+7OXHUwMDAxe3pgZpzeV+M5JYBcdTAwMDD8510nsy1sZZGJrGCRN/VcYlx1MDAwNzKOX4+WXHUwMDE19s+SPYIkXHUwMDA1XHUwMDA3OqHyS8bQue74NIZN1Fx0v1x1MDAwNoH6cvpxi1x1MDAwZuruXHUwMDAwplxuIXRcdTAwMDMkiM18//xp01x1MDAwMzrggYpcdTAwMTN6YkMkUlx1MDAwZTr4v7dl6Nd/K4m94PPnPP23to9fNETg/WLErFx1MDAxMmjyi8BBXHUwMDBmmNZcdTAwMGU84cL6KORtTcVaRO+qUuPYT/04XHUwMDA01VwiXHUwMDEw5rHxv5i9XHJIZn1Bh5p311lcdTAwMDdqXHUwMDE3vfpZ7Fkqgu3CZPT2o97HXHKDb5BfXHUwMDBmos9cclL4vNe4ZcHQ6FNv4VSLt9NsYPcpk99cXLupZVx1MDAxM5BxP1x1MDAxZc9vf/fR+YkwxufOM+y9tYHzcO+HgVVuzKmpXHUwMDAyeDPvmPCVuJFU9Wo+m7iZkFx1MDAxYpZPopRcdTAwMTPL2C5KqVVcdTAwMWErMbeceOf8XXSHJ3o869JOkd6OWFx1MDAxNZ+QX7+N9JnihlxuNPjP3ZDWqL/64ZhIQ+b4py/cdXRMa1jj/8femyy5riPbgvP6imc55TNcdTAwMDP75pW9XHUwMDAxKYqixL6nOGNcdTAwMDdR7PuurP69XHUwMDE452Tmzby5785cdTAwMWHUpMxuTFwipKAg0OHuay1cdTAwMDJwgDRcZs/qm8GZbpdcIr4wnSbutzPAXHUwMDFk7Xt8Kyyuk2KIwvOF47xHfMonfo8yrHSZuCC96pLQx/dMXHUwMDAwxLeKI0LZr5gwTOw3XHUwMDE1mPqqXHUwMDBiXHUwMDAxIWlb+ic28tbzflx1MDAxN0z+NoS/mr+2XHUwMDFlN0d4MqOIXHUwMDEza1x1MDAxM5bEjsWV31OEk1wilFxmevfFfnM17fxcbkVUWrs9yc3/4oSBRnsxWzhMXHUwMDE4aXh5XHUwMDAzpWTPfLa2184h+YXp5YzezVx1MDAxMfZulk2m6Ofz93Ndey52V1OvV1Dqy2f749mZ97O20j5QokK9f507elx1MDAxNCVcdTAwMGaniDix+ML1g3rvlIRxVL30XHR81Fx1MDAwN1x1MDAxZLVrZqv5u9dyydDC5Fx1MDAxZaDhNnydXHUwMDFkz3tcdTAwMWNxI9y8gyrXiEC+XHUwMDA0JdlcdTAwMGXt0tCKXG6Cllx1MDAwMVx1MDAxYYtUIVx1MDAxOKP5bYI0x1xmXHUwMDFjrm9cdTAwMDXxKXxcdTAwMTaj+eru6b2TdX+8XHUwMDFmn+dzfl1CL7TH0cpL61x1MDAxN3VaL1x1MDAxYk6XbrrhVmLv6SAhXHUwMDEzXHUwMDAzMlx1MDAwNclccmRcdTAwMTaHMENcdTAwMTBcdN9cdTAwMTdvRVx1MDAwNszUVOY1V06wjZEsPlx1MDAxYn4+Zlx1MDAxZufY15GF1kh9XHUwMDAy3JvrwFxipn0pXHUwMDFjfDlcdTAwMWb7Y1x1MDAxYq701Vx1MDAwN1O85XmLqfm6xi1uQ1ximoB4XHUwMDExYFx1MDAxZVNcdTAwMDVtx/eTO/nK+vOMsrd5kc71Llx1MDAxZourt+X0izqEl4ZSyVx1MDAxYlfqgFxuTYC+R7gr7Vx1MDAxYb4kkjkgxEfiIJ5zSbh4aChccnJxJad4OLLNQ2q6PaR7jHShYipS9sTRXHUwMDE3rVx1MDAwMIX3jOdq281Sllx1MDAxN423XGbmTn6VlzzLMVwi9mesfDZcXOZcdTAwMDCZ+q1Ou+uyqP12XHUwMDA1YT70g+FM3MiuYZwhUtS8/1jnqWyztluI5a9/XHUwMDA0+q/WpKNcdTAwMWR6q81cdTAwMTTujFx1MDAwM3MwSm96OqHBXHUwMDEwanpQx3meINt1zqFixqmoUCv483FRTHxcIlx1MDAwM/2jIc1cIlx1MDAwNUHNXFxcdH/w9DNN2y+KXHUwMDFlxTDkX1rGmMg/3WSaV3YukPhC+tV7efZ9T1ZpUcj72pJccuBGZE19SJg527L19NBcdTAwMGaEdOVcYkFvSzzJXHUwMDEzfSzJbVaTxcZhZPxwP9V1XHUwMDA30Vx1MDAxNkm/13+e1/9iPP4846D3lL6fXHUwMDFmMsY65or7XHSWuXO27ntcdTAwMDbXxGXEU1Vlr+XGPn+2Mc5S5rFhnk/WqvqdXGbsSEZxuC2+WtouI1docazcx0JcInImy7H2zFx1MDAwNS2wKd9cdTAwMDX34Fx1MDAwMY3k+5JAp8RcdTAwMWS4XCJKXGImYsW/kVx024zBNixcdTAwMWJPhTxcdTAwMTbBbHftr/M04q3+4VZcdTAwMWU7mue/7Pf785zmtJOULLGyr8hNusKg3ERfXHUwMDAyYvfjJXldraYpRbi1XHUwMDAxuX5Z71x1MDAwNPJCeztCVXdipPFDd/ZGKF6PfS9OUmvubaXAe65cZrVKjif1PFx1MDAwMyPGMLevv8R60kugXHUwMDE2hyaJ+5pDXGaVkSBBLMSvXHUwMDExgtZWymAy4/ZcdTAwMTWRLZN6Wbw19zGMSlNQQlx1MDAwZX38lXdcdTAwMDeXzZfxbke/2qd1/V+xVL/ZhceNKMxwXHUwMDBmf56dtv4of07TTlFcdTAwMWHLXkijOH3LX8SHzL5FXHJccvT+Ia/wwMjdpEqjJ8HzuS/nPVx1MDAxMOfMXHUwMDE5w29cdTAwMTk3N1x1MDAwMdZcdTAwMTL/J1x1MDAwNlx1MDAxY/bF7V5kXHUwMDFhIfTtl3pGtrxBI3Vl5VLghklqmJ3Q5WXz4GtWodlZV/mOXHUwMDE5bIHBU3uTVWf/0ZlScHdufNJcdTAwMDf+W9h+uafHvSNcdTAwMDKZSmhHXHUwMDFmhdFYTfii85iluz/OuE0/tzIku0uSWq9fzXP85/XMN2JcdTAwMDObbIe9QGc/c9H8z4/wsj3qPlav64r//b//8j//j//xx89f0jGP5zz7y//6XHUwMDFmXHUwMDE4Q5EkznAkx5HM3/9fx9Ns5/P4zdd/veqPi/7vP6/9XHUwMDBii5NUQlxcUpJAY5rKOUjTWM5QXHUwMDFjweI4SVJcXMxwcYZcdTAwMTHwauT/+lvrzbfJ3aPPr/f+8m3iT1x1MDAwZfr281x1MDAxZp37/nzj//uG//65LJ5jz1Z/Pvzz5//6e9P/Z1x1MDAxMk85Tf7Pry9cdTAwMTj2hiqPz89GSl53vOLuXcZcdTAwMTTin5facON/XHUwMDFlIFxuaIBE2lx1MDAxZuZcdTAwMGJ1x0af/DiRKX1cdTAwMDXV88eed8nLJWZcIqzm/XpkXHUwMDFjXHUwMDA1aii/aiyTXHUwMDAzbJzfkvO8WdtPvUrx+am0eyo0XHUwMDA3u7DGe0/f+Vxi0ig/d6Q0iD03UPvJVVx1MDAxM89GJSvK+KWZI/NkXHUwMDAyri3m0/xE5Fx1MDAxNkY/XHUwMDA1hNPnRVM7y1wii1x1MDAxYlx1MDAxZNRcblEu9KKdWkmsIWNXdlx1MDAxM0lWnmB+7Td+XHUwMDAwM91cZlAs9DUraYmyLNNcdTAwMDKua2OSXHUwMDFhSYBRsFcqfeXgqDCG9b+0z/msZ/5Kw/zTe2ZcdTAwMWNa1+s1YVxyQ17U3/thOdV3ceX17o7AeFx1MDAwNExcYkJzT8bjffDE0IrFmfxcdTAwMTKv/+lcdTAwMWNA/ONuQvZTT8RC0m9uUHDytJhT9VdPXHUwMDBi3C85/T++N2hcdTAwMWV+f/Knc7aeTfJY5/2XMfPnPpbd/3gkz6T9XCLehktPpC/8xv6yb/+8V6eYzI43hOng9Tl05Fxc77Rlvv9X9/X3dSB8LJBcdTAwMWE9hjNSprKGOWqsUs/Jtu7gUlx1MDAwYoH++/tcdTAwMTP58TNZllx1MDAwMehnzFx1MDAwYv/uWqJwukvXiXHFh1x1MDAxYS0w7uuzJNKWxT7521xc8qdO+ta8OrJ37SlkXHUwMDExZf9rXHUwMDFkpP98f1wib5E8j3+Ml/1rrf+P7+HqLqZ5XHUwMDE2mFxc/O036+xO3zxcdTAwMWXbb/rzZy2o+uOS5tOyXr/12T/PUJp/nlx1MDAwMyYsYlx1MDAxMuj79z4uiN3zb/25lcLb5p7HXHUwMDFmz5N/f1x1MDAxZp9cdTAwMThVXHUwMDA1OUfYd0pcYjPfXHUwMDEwZlx1MDAxNyNcdTAwMWX6b3znZ47Psi1d0//tddr7e/3mpDpcbr6/eO7+T7bSXHUwMDA08WZU4r+Nj0azr9/57ZhG+9/E4k9dmf7D/psxeT7Le8DzcjeNyub9u3H52cdu/mpcdTAwMWb7f5q7lX7qXHUwMDA2qI9tqv+1htp/bpdvSvrf4eNHXHUwMDEz3j9r+3ZWVZziV3zpn9p9dv9ty/+25X/b8r9t+f8nW/KP6Vx1MDAxM0na/f45iLV8RNr0YNaM/NW8+D9+XHUwMDFlwfKrPyM/WYguvUpLXHLut46zXHUwMDFhtFenlZvDx8+BhsJcdTAwMWSjuOZEsMrCW1ZcdTAwMTc+ib2vXHUwMDE0gkTwmOdSXHUwMDE3n8vKJFG2oGOiMulcdTAwMWNcdTAwMTMmzlwi3UHkq8lcclx1MDAwMCg4tu40vVwi7YsxXHUwMDFjXHUwMDA3qlxcXHUwMDFmg4y4TVx1MDAxOYLDbFx1MDAwMvjtNa5cYlB3Jlxml/48pVx1MDAxNqPHXHUwMDE4JKoxq1RujnOTaVx1MDAwM+RQbtZcdTAwMTFEeFx1MDAwNOaHj0aCwy9cdTAwMTW4fClcdTAwMDJcdTAwMTeRud046OdcdTAwMWKRsDaCnJ7w2FwisVxcTpNLlFWemlx1MDAxY55pLp9cdTAwMTNyTDHPmuNcdTAwMDep11x1MDAxYzubr1x1MDAwM1k+cFx1MDAxZXKusnBscY6izVxuS27baFdcdTAwMDY054VpccInWLaV5eeSZeOqUVxmVUZISaTIXFw23mE3LVx1MDAxM5Tfx5TuJzTf0e08lnOuSVpcdTAwMGU5OcZBXHUwMDAyppbsXHUwMDA36lxyz5cqn1x1MDAwYqT74cFcIiu8voOIODQ8dZXC1Fx1MDAwZjPbj3RCU6ZHMGhcdTAwMTbHz06O70pFM3R3XHUwMDBlb1x1MDAwMWnS4EhkjVx1MDAwNVtmrrQ3tlx0wqJjvDL2XHUwMDBlNMTwiPtKY2/qfTtOXHUwMDBlT2ZuW1x1MDAxM9pcdTAwMDRcIlxiXHS5xWWuNFfArvKccVx1MDAwNLYwXGZcdTAwMTOqXHUwMDAxs5NcdTAwMTlrXHUwMDFiLlx1MDAwMtkvtVx1MDAxNFx1MDAwNCDz1OFcdTAwMDBcdTAwMTe58z2aOPRuIFxmwFx1MDAwZoiit1OkwSiBkEWQ0c9sKqpzs17lXHUwMDE3cmZcZliqL0NwxyvU3Lc9XHUwMDE5XHUwMDFj+IJt9IThzlx1MDAxNNYr8fuPt+aietPSekmocIc43j/vKG9cdTAwMTiDcY1zp2NiQkRn/M4qwVxmXHTwTNDbS3NcdTAwMTdcXFx1MDAwZrmP0d210JZz8Fx1MDAxZGGozjb+XGZU4mTnlVc6scFcYi/LR6fh1kNccmwqT1x1MDAxNo3w37YlpDPt9yBYd3yOMKojVS9Jl7knXFyRkKiQtrBcdTAwMWNjXCL1XHUwMDA1jktcdTAwMTEm4WOnXHT3fd0q7ohZcbeyOaqnMr3U1chcdTAwMTVzNI/7M5bMOWKkXHRLb1x1MDAwMK78pnbPLO/vXHUwMDAzXHUwMDEyXHUwMDA20bJ7XHUwMDFl30JcdTAwMTDC5GtD/1VcdTAwMTDc0yPx13BcdTAwMWaC3vSHbJOdXHRcZp75XHUwMDFlRm58YFxy//HnVn5cdTAwMDKFXGLZp4ZcdTAwMWLcxjBcYn662Xp8IVx1MDAxZcLv7bNcdTAwMThzU+8hyt9pd9bph6hcdTAwMTZcbkLhXGI27q6cXHUwMDFh353QLPmSIbeveYrzsCdRgHhEyIlcdTAwMGKFZGZcdTAwMTNcdTAwMTHGvXauSJGL6Vx1MDAxNKlccuMvQbZSPlx1MDAxN0NOKvOOXHUwMDA0zOVLciw7b6d8aO2kVlx1MDAxOeuJQlx1MDAwNWykXVxygsL3UZ2aM032U1xyb2SGkEZuXHUwMDE0XGIkg1x1MDAwNMsllflcdDlris9cdTAwMTV5cXCV9s7bXHUwMDE5deqohGmyR+zGQeNRXHUwMDFmnd6z1SUtXHUwMDBlJsQjnadcdTAwMWK36LSIXHUwMDA0zDtcdTAwMDZcdTAwMDTTeEiUr03W7OeTYtNcdTAwMTRNs/ZQK3ZuXHUwMDFiLlx1MDAxY3OwxLQt82Iwy1x1MDAwNDKvWlx1MDAxNFNJXHUwMDFkXHUwMDBlXHUwMDExqN9UXHUwMDE1P4F5w0aqXHUwMDExzGSmXHUwMDA175Z1sd2dRPLQxlx1MDAwNWfbYMFcdTAwMDCWXHUwMDE4XHUwMDE3vKQ48phGaaLF4NRcdTAwMDapuORcdTAwMTOCXHUwMDFkLFO3obEg9K5cdTAwMWGTXHUwMDE5wEWWM4BcdTAwMDdqXCJyXHUwMDE0mzBzo66jWuhj9exMk/l8iPA0juWQMFx1MDAwMv3azFx1MDAxM5vZt4pIYFx1MDAwMXOIbeJiglx1MDAxNoycXHTmXHUwMDA3ZXKArOJx5eKJrvugbVpcdTAwMTFcdTAwMTDHarHtXG7MaWROgipcdTAwMWZcdTAwMTBcdTAwMDLcx8zzuq9XZEbnOq1cZljNrE9cdTAwMDRcdTAwMTByuM1cZidcdTAwMDfYhKUnXHUwMDE2aqRryWk9U2jt0Jrf1HahVOFcIpCyg95cdTAwMTNcdTAwMTPPXHUwMDAy5KaI2ezSQOKwkYT3jutSPu+E7/37Pqx0yYXP6DivR6+cN1u6R1xuiX5nQ7LOSngmk1x1MDAxMlxiXq9ccu77nIqd03uvnyzJMCyvf03E6nratqg3zD9vycJ5MU3o7rf04J6w4UFl7ChcdTAwMTK79FL1XHUwMDFkwHZcdTAwMGJO7PX5Plx1MDAxYoY9eOWprtl4uCtzjzA9wj2Jpm7OmNc8XHUwMDFkmzmRgO/RMfX+mPrlo/OsrJ/pT2nDXflkXHUwMDE540JcdTAwMGJcdTAwMDZxU1x1MDAxZqBcbp1cdTAwMDdaoFxihjDtLC3S+1x1MDAxZL1l9FWfXHUwMDAxP3yOnlOifT5bTqFEZDze6o1cdTAwMWXbQ+x+lsBcdTAwMWafTs5cdTAwMTBcdTAwMWQmXHUwMDEy+rNcdTAwMGI5QpjPzIEjQqXmin9sSZErXYJcdTAwMTdcdTAwMDRfquZDXHUwMDBit1funFx1MDAwZVx1MDAxYTxcZlOFwUlm65RCjaak8sKyXG7bX1x1MDAxZdiMXjvSsdW4dT9NXG7mQFx1MDAxY+TPosD+LTFcXCXLafBccpBcdTAwMTaYRVLrXHUwMDFjw+1cdTAwMTT3VW/LJe47RNaKvIVMM7GoTiFvXHUwMDFjyETSklx1MDAxOFx1MDAxNYTceOVcXFZVNcLs8WdiljWBXHUwMDAzlpEo81x1MDAwNFJ7x81HqmpcdTAwMTOv4EZcdTAwMTQmqTL5P7HLM4nZXHUwMDA2YtxcdTAwMDFwXHUwMDAxMblcdTAwMDGYxocpiSpXXCIg6t/IYmBcdTAwMDDY+FxmgLhrXGZLJ2PRUFx1MDAwNbcsj1x1MDAwYsJcdTAwMDY6ws8hxL/ZSS1cdTAwMDJcdTAwMDMwPaDPXHUwMDE2mXmzYzTTPOtvXHUwMDAwrbI2x1x1MDAwM+Nwo05oOYJjkoFcdTAwMTKkJsJcdTAwMTZX0lvwJ6Jj7OnsT/HoxHGYgkNcdTAwMDWTYea2xP8kjalcImJcdTAwMWRv/FxmVGJRupAlIInoZlx1MDAxZrHmMiVEXHUwMDEw5UBm1+U41+/JJnRDP65cXDMqO5JnZZA34maqSLYyxlx1MDAxNVx1MDAwZph6q1x1MDAxMPTWmHhusFx1MDAwMDljOFI2Rlx1MDAxYSTAOZNcdTAwMTW+LVx1MDAwMLf9XHUwMDBmfGtRnVx1MDAwMyDzyahA3kKGL4DGIFx1MDAxMjfwstmKMPtcdTAwMTReSfRlXHUwMDEzJlx1MDAxMpb0wdhdXFx0peBIT0/51ELR3on796OUTbd/n1xcXHUwMDEwfzN7cJrxKYjvc9ahd/DER59dXHUwMDFjiVx1MDAwNG5TXGKzXUmbh85nwyemwnrnfm93Plx1MDAwZWKU7enuXHUwMDBlw1x1MDAwN9GhcT5cblg3LuG5XHUwMDE0VOzfL1xc0lx1MDAwN3pcdTAwMTnj0oqZ0sAqvFx1MDAxNlx1MDAxNXygnlxuJGUljJLbgGlbylSsUCmlUVx0LIaofVx1MDAxZrdP+1x1MDAwNTvdIZTsnqxcdTAwMTeoXHUwMDFky5SVXHJTmlx1MDAwYkFPbVxm5vFDNVx1MDAxNP9F2dt3X26JXHUwMDE2eVxmdSU3v3w/gsNPwFx1MDAxOLkkkzI6KlBexOI4XHUwMDE3RpbeIVx1MDAxNOOuLncyaZvbQibMXHUwMDA2XHUwMDE3MY+ILrDm7r2+mLCLXHUwMDA091x1MDAxZfRcdTAwMTHQ5/Tsolxi0mL1mLF1kXFbndiPXHUwMDFhw1mv+PlFJMtcYqr3W2aOXG5cItR3SKRcdTAwMTmParc3XHUwMDAwseNdiSO5n21l/kHWlVx1MDAxNDJRdomFYqT2XHUwMDE2MFpSMWA0OzNJXHUwMDFlmYjfUTJ8tK7iq9+ySpCX2K0lqcs21Fx1MDAwMKSLxSXnXHUwMDAzJ5itW8lcdTAwMDQ7MUpPW3xspDaGg+6ur9Yo+5Qr6upTIc5IPy08cKGOzDWOXHUwMDAwzlx1MDAwMtxTJ1xmcd9cdTAwMGbkXHUwMDFhzYvzfFwi9G3OKoFET1x1MDAwYixFNDMgybhDYJVcdTAwMWNEk5q8Y1x1MDAxM3A4113YV1x1MDAxZJyzJqRGI1x1MDAwM7dcdTAwMDMwfXpcdTAwMTfDg1x1MDAwYmOw5rNcdTAwMTDTVFx1MDAwNuGcujeGdNbgMlTmrIBgJ05GWblcdTAwMDTH+0abKnZlSrWoXHQ4I1x1MDAxM1x1MDAwMOboI24kv1x1MDAwN67Z3c/YXHUwMDFkJbDkbbziSiBcdFx1MDAwNMZ4hFx1MDAwMa1cdTAwMTJpnlxiXHTnno351Ydcclq4czJsXVx1MDAwNPCWTydWXHUwMDA2NFx1MDAxOJgvJFx1MDAwMaFcdTAwMDK33iBcXHH0+7lRP2frcae9XHUwMDFmkPNPYEKU2zvA7q31hVx1MDAwYj+VRrAkNLYnj0lcdTAwMTbceTfxXHUwMDE2XHUwMDAzYVjoXHUwMDE11+XYikSrPjZzw1x1MDAwNlx1MDAwZiMmxL7BXHUwMDA3blx1MDAxY5GS05C1SU1cdTAwMTle3PBgYUSBY1x1MDAxNiuYrFx1MDAxMOmTXHUwMDFlMFx1MDAwMDnyal2BO4E3s15cdTAwMTh3MipIuJKOcpg/XHTQ/5ReXs81pcE3g+BcdTAwMDVCpMFcdTAwMTAjXjJcdTAwMDJhXHUwMDEwXHUwMDFmXHUwMDFhbYxcdTAwMTdKw01dJlxmr4r0RyxIXHUwMDEx097WI6VcdTAwMTbYSLpcdTAwMTdcdTAwMDf9pmY5kyruMJpcdTAwMDNwu7EzsH5cdTAwMTiKXHKVYm+xvclfYKorIY8xXHUwMDEyXHUwMDEzXHUwMDEwXHUwMDEwJXlcIlx1MDAwMPykPVx1MDAxY/FccscpinyUkn1b51hacVx1MDAxMDBcdTAwMGIvXCL0v7aThT7hXHUwMDFmmefpKOY6Wtd73n7I8ejHTLOKr2X02KNeluf0kjFcdTAwMWOSq9WhrtzFXHUwMDE0jS+pr1FcdTAwMGYl91ZPXHUwMDBmzlx1MDAwN9PBXHUwMDEzO1x1MDAxZs8oQ8fq4b1tvrHuvW1Kq98u7eqR2WviPouD6Hic65d3MUluu+L9nK2ym7pZ0T9mbGdG3njYXHUwMDFlXnF3N1xiay2tc+C4MCHX0lsw48MwXHI2rOOc4vTa09FK1rjo7LdteNl7Ss2tXHUwMDFh4Fx1MDAxYWCy8GhH4Emyklg90rfjXHUwMDFip+W0SyZ8U+tHYDGkXHUwMDBmuLx2XHUwMDAwN0DK1blv32J4ym2vzsCnXHI+KX35XHUwMDFlXHUwMDFhtFNlXHKId0nUQcjM4pFcdTAwMWPynrQ5aFN5dDl2Ld01voCGdVx1MDAxN1x1MDAxOUGlxSxcdTAwMTFmeke7XHUwMDExYlx1MDAxMrJ087CmbUtC3WypnNypZN36ejeVXHUwMDEyTcLglWAzXHUwMDEzXHUwMDAx+aOij/MyRSUydVxuX1x0flNcdTAwMWZRwu39UOznZkb6dHam5shcdTAwMGZyOtjpWbtgY9VqZu1cblxmyNqbkKl8smT9XHUwMDFiQcyX5lmN4tZ6TVx1MDAxYWRA+SzwSyMrddntau3ShFx1MDAwYoHD86ekyaP9iaH3lqDuujJlXHUwMDA08Fx1MDAwZuNOwTZnb6ztN1x1MDAxMjNcdTAwMWPxy9agyVeMaNFePELNXFwgXHUwMDE4MTyiylx1MDAwMFI9ZC6d21x1MDAxN1x1MDAwMvGYJlx1MDAwNeRcdTAwMDS5wEtcdTAwMDM3Jpu06UnCzNzO+ctcdTAwMDZaMMKC/aQ5XHUwMDA1lyO5nYlcdTAwMThcdTAwMDLIXcqXQVx1MDAwN6FcdTAwMGXiz4zOflx1MDAxNtPZRixcdTAwMTFcdTAwMDNKuMbJTKyALCGggP9BNlxcLfXElC+eql/csyVA3Vx1MDAwNCtcdTAwMTP5xExcXFx1MDAxY3QlcpPdJ0RfmSVDdlx1MDAwNNBcdTAwMDe4XHUwMDEynLmMTFIyZ4ZwY92kK1iXXHUwMDA1kD+68CeGXHUwMDA3kFx1MDAxZVi42Gy7XHUwMDFjlt8+/IVcdTAwMDJIR9VUwJ2UmZ5cdTAwMTVRXpcygFx1MDAxOUhpXHUwMDFlXkK4JtH+lopBvCnYY4y/sTdj8cviXFzR2ZJKUi+EuZSqKFx1MDAwMNebNqa/xfBhrIi3NLGre8HMXGIzSVx1MDAwNevWmXA11+yW41XELyVcdTAwMWLrnVF1Llx1MDAxZY2XzatVYs+h55l+XuJmJdr5XHUwMDFlMqA1S4x8V76qXHUwMDA2XHUwMDE1Nbt51lx1MDAwNU/p25yZxFx1MDAxOY5cdTAwMTc/yXk2l0vb9mHYXXomnNQgOqWL+M3W4lGbdEd2SK9avSeEe5CK82TmrnWXSktHUym+eyhcdTAwMThaZLmtMVZRj9tLxvCYOc+eroc4w1x1MDAwZsJUZsFKXHUwMDEyeWa8XHUwMDAynCuHXHUwMDFl6j2cNVx1MDAxONzYPs9cdTAwMTOiXHUwMDE4Vy/01lx1MDAxYV1o5pHZXHUwMDExStlh6lx1MDAxM09mjNs4XHUwMDFiXHUwMDE5XHUwMDA1x5qGxVx1MDAwMkpuZ3vUxHKLXtnpXGYyNdbccqWIe0ahXHTzYNszsdRcdTAwMTDQ/sc+XHUwMDEwe40r2LY701x1MDAwZnMjc5itl+SRi1x1MDAxN1x1MDAwNjyZ51x1MDAwM1x1MDAwNiE71fv68vtcdTAwMTJbrlxmutjXkLcpIZuaTmEqUpSseb4wQL1HX3FcdTAwMWXWiVxclL+ZXfV1cM+UXHUwMDFk+8g2OZrBfLhGm6z1NIgpl76s76Wrcklurlx1MDAwMsmDJXBcdTAwMWQucFxcXG7/SE7vgjBrzEzT+YrS+lx1MDAwMT1cdTAwMDBcZlx1MDAxMrgmXba1XHUwMDE0ZtJE3WpukuQ54oL9NKhcdTAwMTZJYyw1TmTNXHRa3Ff1W7TGnqXJ98RnbjRccoxLTlx1MDAxOFpcIkhcdTAwMTN8QbPiXHUwMDA3J+qEsVx1MDAwN4z1vsRXe+RcdTAwMDHGucEoaDh3LrXj2ZB4XHUwMDA3RZ4kXHUwMDE3pI3p5aXyQ8xbsFx1MDAxZKdcIl9DdCkz1Lpajsp3Noejzrx22DBHIPJcdTAwMDVcdTAwMGZjXG5iwdzgl+DSXVx1MDAxM8R12OaYO1x1MDAwYk12kYR9P+3T8qkjt08wZjEx68mIySbyg8k48Cqs/M5Zvb1cdTAwMTghXHUwMDFi6StcdTAwMTbf45VnXCK8gJdyg+FcZjVmja6xUkiV0S+Kz+iEQoNcdTAwMDSsSZIvdNQmMcG0gFx1MDAxMYOgdpfXflx1MDAwNudcdTAwMGVcYj9bWDCfecAldbOUTLBcdTAwMDZseZHjXHUwMDAzlOZkyDJcYk/SwGGuQi0x6eKLtnA2R8LfXHUwMDAxhyBvWVx1MDAwNCEzYGqY5szKqa/sIFx1MDAwMVx1MDAwMpGVvcTGIK/yuYD3z56kvn3P1b5cdTAwMDTz8cTnZ+J5OF5Vd2//jKKj4VVcdTAwMWZEX/TIy9xudWWWi1wiXHUwMDE5clx1MDAwZVotbbdtSy+t/W6b5iB8RjZcXFc0YPaAq5bONelcdTAwMGXExjDEqpmQ8oB8/7hcdTAwMTZcdTAwMTI+XHUwMDBlXHUwMDBiu1x1MDAwNOWYflxcN7w1XHUwMDBiNWKhW4ZcdTAwMTZcdTAwMTgrcCl90jDlKHux9eCN36im8HnEc6zyP+6tcGM8vENGXHUwMDE4tSdI1Piu11wiXHSexFxi6uyLV60m4rfZpbhBnJHLbS0uwILzzFx1MDAxNmalR8wk9bdcdTAwMTe3IHxcdTAwMDftZ5LwXHUwMDFhcdV6tJGsZ7iggeaCoVx0Rlx1MDAxM8uLW+STiFx1MDAxM27AXGYrvlKszrIr2SY0gl8pXHUwMDFi5NwuJ4+d31x1MDAxM5AlXFx3fruL31x1MDAxYk/y5TdcdTAwMWNbU9yUqHhcdTAwMDJrppTN6MExXHUwMDA1SOFshVx1MDAwYmVcdTAwMWKjXHLbdLqGfEbMlU3mxCzGXHUwMDFj5CfHzFxm8t5cXFpcdTAwMWLDXoN6R9HSedCNObPnxLjnXHUwMDE49In8aq/koaX6RaTGLlwicESvyfjNZFx1MDAwNyOfj6k54Vx1MDAxN1x1MDAxOFxm8pH4XGYszL7tTMc8dlx1MDAxMFx1MDAxMedAaFx1MDAwZtG9fHpv1an1zIRg8bpcclx1MDAxOVx1MDAwZe+BXHUwMDE3ZJT3monkOMd1iVCkbmrAXHUwMDE059m/g6nRo2w2glx1MDAxNfZsXHUwMDEyblx0tivwzU3I2uKrkVx1MDAxMfPJxtpoXHUwMDEyUbG5XHUwMDE5c8HHXHUwMDE0n1BPgFx1MDAwYmdcYlxuxlx1MDAwNvfpfWRs22VAjJmUvXFcdTAwMWHDOZf5OYFQlcbI9zN0I/LEZXZRYlqeTc4zeXGcmVx1MDAxM1x0/jix7GJ2THYugVx1MDAxZVPRXHUwMDFhrVx1MDAwMLnto/hqcuq4+LSqj89NXHUwMDAyMVx1MDAxMrVwkdU7SPNLfJJvXHUwMDEzM9dLm4OdRepcdTAwMWFfWZWDRNKrNs2Yl15gMlx1MDAxMpvAilRgXHUwMDA1ZytcdTAwMWaGXHLo8vqelV05XHUwMDEzQGCuWLVw2Vx1MDAxNadcdTAwMWPBXHUwMDAxXHUwMDFhmGpETF35XHUwMDFkhDdQI+pVccCk8HAk1NVcdTAwMDSveuVcdTAwMWH5p6rWrXmnXHUwMDA2/f0p4zqEIVx1MDAxNKrWXppvr7jx3LbHXFy3h+/d6MdcdTAwMTNlXHUwMDAxjq9cdTAwMTOcUcmarI+QXaSLd4f+cpSk4aDnqlx00X4x4FI7x76UdcRWMo6eLLFcdTAwMTleslxid1x1MDAxOVx1MDAxNVfnc+6rJaO3nZdWIc1cdIUzc1izUbmJ3lx1MDAxOFx1MDAwZmyoQ+3QXHUwMDE1+ZkwiWz4XHUwMDE3XHUwMDAxXHUwMDA3XHUwMDE3an1a8kOalqrfaFZcdTAwMTNHg15N8jieXHUwMDFiXHUwMDE2S1xiYWb3znxkn1x1MDAxZZmwaWcg8PnXvd1cdTAwMDRaY4k3Oyoo3MaHNrI8duY8TrwgnpIrstpcdTAwMTeBWCCT2OXAsFxmk1x1MDAxM1x1MDAwNFx1MDAxZXBcdTAwMTDSgJG5y5/prGin1Vx1MDAwMu024edHOCR9i/bkpEuQXlxmY37fXHUwMDBmZt1TjWNcdTAwMTEmXHUwMDA3LMtAKr9cdTAwMThcdTAwMTFcdTAwMDCxaYK32b7GXHUwMDFjxZ/CkWRVhWmiXqlcdTAwMTGY6iwvZj13mpMqS9cnXHUwMDFlu15fQ22d3EaGNb0vd0pIsVrPz9Xv6cSfdvX1XHUwMDE2c7R/xKDmlDKThsRnQlx1MDAwMlx1MDAwNFx1MDAxZnN1Zlx1MDAwNFx1MDAwNHN1oJh3VEdcZi64nyZCUbFcdTAwMDZ9ONkkl0pcdTAwMTbCeZ2fP0eW+Z3QWlx1MDAwNq3G60ee9Vx1MDAxMKmkn6N+2cfDbv3GMriFXHUwMDE38ZqBKXdIXGbS26t14b3RTkSNk/asepDpj1x1MDAxYqpkKC/mXHUwMDFkgGmuba7xmTlcdTAwMWasMlx1MDAxZHFcdTAwMGJYxMRcci1nzD5SXCIzXCJ5Ps0+T89cYnmwyilkc3KqXHUwMDEwiDtxXopcdTAwMTNcdTAwMTcnx1wiQLJzXGZcdTAwMDFcdTAwMWXBLFwi9JFeWIzomUGAbePqcfI+uoqsTzBX48XpXGbVh0x5QUKYcrLqMlx1MDAwYoJt3HYhM8OxjHtccl1w0MlcdTAwMTWb2/fD2HTII9/j81wi6kQ7pk9r++65vWnRXHUwMDBiTZQwr/xX7KmsXHUwMDE0Te7ePYHhepSbqO+4XHUwMDA3l4mFanDj0Nd1QS5cdTAwMGaiXHUwMDFmT0BJLuE09Vx1MDAxZNWOPJKsi2aUviWw+M/RXFzNR2BK3L3sid5QXGJU6L4y1Vx1MDAxMlx1MDAwNL5cdTAwMDRSxYzZkFQ3hvjwmuxqz1SFnlx1MDAxM6ecZcIsjlx1MDAwMELuK49cdTAwMDTUWWuXI05ccojWXHUwMDExb2lZTvv05un9lUtcYkWLV7iMJ21uMu1cdTAwMTaHXHUwMDAy5uXNrbOJj1xiwyd9y1A/Z5VfXG5v5lx1MDAxYq+/XHUwMDE0ulx1MDAxNvL70pf5fN5Wk1x1MDAwZVx1MDAxZFxuaSSKJXqiJeJbkJjEXHUwMDFiyOQ7Ql9cdTAwMTR3cdIwZfz3VtmD8yY6XcKI83xwXHUwMDFjYVx1MDAxMHRlxcpWjpeO/ib+w1x1MDAwMFx1MDAwNl1cctzrw+a3LPloiaVPYONIT2JcZiRb5DGrNDNYk8/M3le8RLw03lTEXHUwMDFjXHUwMDE5WVt2fXTNo2lBclx0XHUwMDEz2E9cYkgz4tRXXHUwMDE2XHUwMDFiIXhcXHlcdTAwMTYhkzLs9Fx1MDAxNbD1grZJzbO0IKhXbIpYpVx1MDAxYivBuCzyZqMuXHUwMDE4XHUwMDFkas5E5Fxm21x1MDAxOZufVzuQXHUwMDAwTUpwnYwzZEJTY9LjXHUwMDA0x5ZL2MzlXHUwMDEx90FcdTAwMGJi4ZRXO4Zg0Vx1MDAxOXCay7xGsYlcdTAwMTBQhKGe/PhcdTAwMWEoc4DvXHUwMDBijejJMupwt8yFp6bpRVZGUcXrXHUwMDAyrT5fPanENFx1MDAwZfp2j75cXK28PVx1MDAxM1/OuW9cdTAwMWJoI1x1MDAxNbiTcTHBzaClrG39b+QwMY9kc7qDPGyZWSjd6Fxujs9z4TlwiWL6w+QyKkN3mi4u0Z2s0M9cdTAwMDS0SSsxXHUwMDA0pGZcdTAwMWT0ZCCNaCPTVlx1MDAxM1wiJ+Nfc6CMeM2iR1x1MDAxOOPCn7hgoaN6MfC5XHLXTuqz02NCjU+AI0c5g/Jvtrlftkn+v7HNxCHCW9LQWY2yvMZO4jjCVam03aqP89n4TTnU+duynlx1MDAxNzhcdTAwMTkn3XyMXHUwMDE5P7LgnM6xnGDA8SlcdTAwMDH9hFCHQCGZn2dngMOLj9fQXHUwMDAyzMWNXFw0JqCJSSA+aIWPbEL3a9I3XHUwMDAwsG5cdTAwMTP8zH/Fr7hcdTAwMDGxvstmXHUwMDE2Q3MwXHUwMDE55p5ml6pcdTAwMWUvPfuP91dza4pdnGR+IFxmfMFcdTAwMDR2XHUwMDEzPm9cdMzWapmZZma401lcdTAwMTeCeLg6Ps5BpmYyQvjilZhcIlx1MDAwZenAOmXnv/oluFP1oi/xJVx1MDAxM7V1Xbcj+qCQyVxmccyw/YBvxD5VOStd4oJcdTAwMDZcdTAwMDShbHOVn4g4Msya5tJAIUmIJzhXTaxcdTAwMTl8XHUwMDBimrhcdTAwMWI1NHP2XGJDNW6fStVlwr1OUct6gFx1MDAxY1x1MDAwNj3y5Fx1MDAwNKdZ+qehLGA1a1x1MDAxY0Ll4utcdTAwMTaTooKCXHUwMDE13lx1MDAxYsFrXHUwMDE1SYL99fRcIv1LmaWl6b+dv39K9o20i16KRj9lOVxucznE8E1cdTAwMTQxvr5cdTAwMTnkMnv5jC3QJ5V8nPtUpIHlvnet+/qdwqR7u7tcdTAwMWSSX8C9QjRBJnH+qdUvXzLl9Vx1MDAxOVx1MDAxZLumXHUwMDFlXHUwMDFkZ9ZIXHUwMDBmk4dcdTAwMWNcdTAwMTCRjP52XHUwMDFkwySkd74wX1Q3YPE9XHUwMDA0jFCb2GPJka+rj1x1MDAwN9nfnvuUXHUwMDE0VVvB5eZcdTAwMTjPXHUwMDFja75ovXPaoqS3WM7JfNqNcn5NUmuawz0vflrl7/Xd8q0zrI30MYRYXHUwMDFlYjj0KJDp2mys6vNJ9mJAjGI0XHUwMDAx6bUxXHUwMDExT1wiSpZUXHUwMDFiXHUwMDBlcDMxgmJcdTAwMDChdvtF/ct/tCV+Kz+31rl7/Vx1MDAxM89gaXUtM1x1MDAxY1xy7Fx1MDAwNajrQ/JcdTAwMTh0fsNQemBcZvH5qiiKVbtqXHUwMDFhfla0w1suxqJqhZes+1xmOupcdTAwMGZsN5f3YEBXuuNWkCRcYlx1MDAxOcxEfLwv/Vx1MDAxY0REmprMJOD8csGK0Tu8gn5utEiw39T1OHqNXfI36y9cdTAwMTTm1Ytcclx1MDAxMt/VXHUwMDA3bcRcdTAwMTebK0hcdTAwMTCWXHUwMDEyhZRcdTAwMWa2XHUwMDE5vCFcdTAwMTh0XHUwMDFjplBPq+OjdvFcXGi8io1cdTAwMDXObMU0nZ06ibE8WWXU21x1MDAwZZtotL7qzUxx6H65Oa2rw1xmv2eryfhuJM4moctcdTAwMTmpedBj3CqJyqWnPOFcdTAwMTH/cm/Uf/hcdTAwMDGjZlx1MDAxN2wq3keU3YLsT1x1MDAwNLODkK5cdTAwMWHcVm/x8G2C2+V4lyr0eXloS45cdTAwMGZmLl0/alwio1ZiXHLBltF3P0NcdTAwMTCC4aRcdTAwMWOuKDqy7/P2fPE7XHUwMDEy7rhPqlwizFx1MDAxM0udXHUwMDFlNj62XHUwMDA39OnMK85cdTAwMWGBolx1MDAwYt72rcWhnKzyxj6m367zvZHSwb/QuENcclx1MDAwMX2zgMJqmk6aVvF6Q+Hp8zty/Vuw7vzFf3raXHUwMDBmRZ7+vFx1MDAwMu0re6DltItEKveEXHUwMDE5KdNcbvZxjNxcdTAwMWKJojJ6fzdcdTAwMTPPXrBcdTAwMTXewrSbXHUwMDFm9vzGwWhb4aq3/jOjstG+OOOchp+w9+xpwLcz9Nsxm4s80e+B5bBf+nZTSS9LL19hXHUwMDEwt9sz7lZeMYFHv13zWmg9Koai8flUr15f4fFyOVx1MDAwNUAjcfVcdTAwMDdiKNvm6mCJeHlUylx1MDAwNkBeXHUwMDFj/OfXwLZ+QKb97FtcdTAwMWawS0NcdTAwMDFKLVx1MDAxYcbX2i/XmnrxnkGCs/RcdTAwMTmzqvdKXHUwMDEwhMsm+pV10nBcdTAwMWbqOlx1MDAxMtfl7mBZTZjU/klsu9NcdTAwMWRcdFx1MDAwYpPoOeuYXHUwMDE2bHnwgqF59rjP9umrOzy8ZJXQ5/Nmdv2RiISRm1x1MDAxMaWv71lHkdzUqOJbnKdcdTAwMWV/5+M8p/X1ITHuXHKmnWCX40LAMHg8pfY8l1XYRoe6MYLFqStjZtkqM79dqyRcclx1MDAxZoW8XHUwMDA1mKhcYmpJocvKzJfGXHUwMDBml1DX7aBcdTAwMTbj4IrZu7dgM35LvU2ToYcgXHUwMDAztbbncff43um4ZFpcdTAwMWZcdTAwMTSXS5fEns4wM7nBXHUwMDAy3sdcdTAwMGJXh8XeXCJ92+g6e3lW8PFcdTAwMDT/OSZxg2P1k3NcIu8+L4fcXHUwMDEw2UShXHKjiVx1MDAwMbZAW1PUbItcdTAwMGKueTwxtm/lYLzbdqRf5ntZaHKXT+ded1x1MDAxNlx1MDAxMlx1MDAwNzdcbpb9K5bOx2NAlkOLjE5JXHUwMDE01ixfylx1MDAxNNvvxdxWZWIybqEgp1T3wFQy4f3VZ/s9eolcdTAwMWF7jXRByDkkV1JcdTAwMDQqY21cXMtJn/hFXHUwMDBmulOpvbVcdTAwMTSci1Oba4GVnH5Vb+avNtzY7ZnwSGG5dGnSRb7kr/jSccMnf2B+XHUwMDFjbFx1MDAxN3Mq5ITyXHUwMDA2gXeti01oq1x1MDAxYb1bS8ouXHUwMDEzbCxRXFyoXHUwMDEyXHUwMDBiXHUwMDFmZiy2XHUwMDE0ovZcdTAwMGW4qo98XHUwMDBmd0XPnVxcQ9tcdTAwMTWzKN0mrdj4adaPjMexXHUwMDBmNmhbr3XDXHJcdTAwMWKbglx1MDAwYt6webZXuMVwwN/QxFxmRfhQw4j5nvk+cXRcdTAwMWHsS+RcdTAwMGVcdTAwMWTT7pPjc1x1MDAxNKU4wVZcdTAwMTf26Vx1MDAxNHPv17ooQlx1MDAxN1x1MDAwM0xcdTAwMTS2lWFcdTAwMTBcdTAwMGJcdTAwMTlcdTAwMGVzn4SYruBTyyn2+TPn/rr4c3RpXHUwMDAwXSSQ9tVcdTAwMDVuU/ezLfeVl4pcdTAwMTCGeE6447wzXHUwMDAxxXB7KElb0SSN1PvdboWNNnrsR6do2VwiQ3PKX2g9XGZzXHUwMDFhK0FzgdpGw2HWliBzittcdTAwMWWjuSzYXFzY66dcdTAwMTe5zoZM9CCtcqaV2Vx1MDAwZcJvzk60dyM7eeDG0p3FkX11KmZcYnv0i5rpf8Ut/VN/wiefQFx1MDAwMzFepW1FZrdTXGbjq8R0XHUwMDBi0i6s8SNFw59Co1xm+X3cXHUwMDE3wvno41x1MDAxYcGPhEpfUlx1MDAwZcpqXHUwMDFiQXZxXHUwMDA1muPYN1x1MDAxM2lPkclcdTAwMWFunlx1MDAwNeJF8vk6e9WkeWWi3Vx1MDAxNYRRz/xKzlNcdTAwMWOLNLvQ5Cq19OGbkOpcdTAwMTZcdTAwMDN6nmp3THBmoFckfZmM5jFcdTAwMDa0XFxG57KGiFxynFx1MDAxZEdcdTAwMTgrot65n+iLidCbXHUwMDA3I/zSb1M+KpmRnLkrh4M1lGEo10+AzKrKha7c5lxuvdQvJay1b52faLFcbut9XHUwMDFi0VnCaNgnMmdcdTAwMDPIXCIhXHUwMDA3PdnrPDnCcC55VeTOXHUwMDE1qVx1MDAxYrxcdTAwMTNjnKODqLPKsSc6kZvn2W/MsC2r8byFYUlcdFFHXHUwMDE52NuZmacp9Epz+ZUpXHUwMDE1zopxNm3oXHUwMDFlYbZGuLZq6eOBUfTDK+JQRHLYXHUwMDFibUhcXH3713O9/z4+8jVcdTAwMTDiwtfNMCjBsdBlaK7od82zp3vR+kO9XHUwMDE4XHUwMDA2XHUwMDBm3UWO1VwiQEjixWRk31x1MDAxM1xcXHUwMDAyXHUwMDFh94M6gjsxXHUwMDA2XHUwMDFkg2WR1pBYN72Aj2maNyrnXpVU8SZBU9nWx+2kXHUwMDAy59Zs4OZcdTAwMDbMPJzi8e5cdTAwMTFyVf9cdTAwMTiXfFC++6eRvlx1MDAwZVxu70lfU0F/c1Dp9MO75Vx1MDAwMJ+afTc8rjBcdTAwMDRgxUakg+tKYnr6omZP6Vx1MDAxZtlcYifCXFz1XHUwMDFk0viKdbGHXHUwMDE1/iuLwuzlXmhhq1x1MDAwMFRcdTAwMWMyM2rTdWHIvePgVb2IQX7HdjBRXHUwMDE1dkG//7qhWIe59pZqdLpcdTAwMWNXnuGvXHUwMDE0XHUwMDA0L8Fi671rtMeK36ZAOihtkKl7J1bJkz7RaFx1MDAwZmrdXHUwMDE1M19cdTAwMGI96FxuhFx1MDAxYqc7RNlcdTAwMTYg3oTnXHUwMDFlZ75I9ev4w7P7RkE12Io7PFwiXHUwMDExMbdcdTAwMGam6dH5js58KY1cdTAwMGWMN4Kjhz5G1vigcu+lxsjsR4jGqr/bXHUwMDEz49hBJ8y3hfvRNiNcdTAwMDNcZlx1MDAxYvY2xeFtkVx1MDAwNP7uvr2xXHUwMDEyo0pk7MctcW2B2PBpiNFbXHUwMDE4nSPT6W2NnqL1XHUwMDA2j1x1MDAxNKzqpWxcdTAwMWRcdTAwMWJHKJRcZjovkqTmRYq4gTs4z9Xbst+j003LNtPf6GXJXHUwMDEz92k6l09f4nK0XHUwMDFh5petRTZM+lx1MDAwMkZFjnpcdTAwMDPTU038mGKcQMKuXHUwMDFlpjqqeVx1MDAwNrSOXHUwMDBmfmbNLpdHona2o0aP74TsiYlwjMY4LNSsRG175mtcdTAwMDZO51x1MDAwMG7lYTG2ts9vQ5vz0e1VXHR0lWXa5DXtt8henJl6eal7lHbrIHDJLvKNX+4hzEOB0lx1MDAxNtpPvIB2ojcymiVm+Py5UqZf7Z9QXHUwMDFkvUjtMWq3NMBiKOfLd1+pULto9PCWtc3ZoE1+XHUwMDA25FJ2RnYlXHSQXHUwMDFjdF7blJZBXHUwMDAzQqwyYd5UUjPgZlx1MDAxONNIMprvII1+t045q37KycUozKL4XVhEXHUwMDFmZWn2lFx1MDAxMKC3Ld3blVx1MDAxYa9GpeU2Zj/TtcNxzE5cdTAwMWKQXHUwMDA0K79cdTAwMTTyVrfc8UMrXHUwMDA3uC51Jki3Xlx1MDAwZqhcdTAwMTfHP1x1MDAwNEZo7X3XXHUwMDBmlLJcdTAwMTlZvXg7f06ujvFDd5phXHUwMDAwxrA+sYQgYE7Sri95XHUwMDAxnnb+q34m0Vx1MDAwNuA0YOjx/CCfJN9cdTAwMTNgUjTeW4G4zFlcYr5cdTAwMWFYMmJcdTAwMWSkT1Y9XHUwMDE2fm2aXGJcdTAwMTXVOrFIXHUwMDA1XHUwMDFi7Vx1MDAwNNBJjTRUvVk0XFz3Qs0+NHpE1sX4SOUtXHUwMDA0jVxm7u9lXHUwMDEzeUGThlxi1df46yPCyVx1MDAxZPNcbnuUYyO/uYLT8IbXQ6JcdTAwMTWysk8kKW/T636GZebC0/C/L12ei/FcdTAwMDVZsvBjs1x1MDAxNW5ONHTSlFx1MDAxZno8zjK4eubx4URcdTAwMTe6wnn9tM3xXHUwMDFh53XJXHUwMDEwZ9SFhHr7am86XHUwMDE0hk6Z2z5wYZU45ue/jqHBzruzu+GOX6aVylx1MDAxMNtcdTAwMTf24aUsyoo8xVxiOlx1MDAxNy254fj4c+gs11x1MDAwZszX2Fxm2uCF/n776NaO6nE7hm5cdTAwMDJHXHUwMDA3zY3F4c9cdTAwMWJ6XHUwMDE3hbB5lVx1MDAxYSXe+FxcXHUwMDFhzdj9xtHtdOoszJ7jedaXeD9uXHUwMDEyXlx1MDAxNLFfv+Rbq1MsztxmqVDodWxNJFx1MDAxOcgltZlcdTAwMGZeyFHi+Eq0KFx1MDAxNFx1MDAxMzVcdFx1MDAxYe+X2MKpJKG7XFwlvlx1MDAxZX80MnW1cVx1MDAxN4OA8ybA1Vx1MDAwNG1iXHUwMDE0Mlx1MDAxN8O4c056c53EVkhj9lx0nrpLTOp/j29WRKhEn1x1MDAxYS3oXHUwMDBlS3jKq4bYjYC3NsRcdTAwMTJcZm+fyKQ6y9LHXHUwMDAzXHUwMDFll7dXXHUwMDE4NqZ1XHUwMDAwmpXc0PtcdTAwMTbKPMage7lcdTAwMDBYP1x1MDAwMVx1MDAxNNex0UrO23bwXHJQ+Fx1MDAwM71Mqa0gmmFcdTAwMTnM0UBroma5XHUwMDE4XHSSJ8LFXHUwMDE5xOqdtiS541x1MDAxOPF5JUzgd9Pv9lx1MDAxNvBcdTAwMWZcdTAwMGKtXHLB6uJqXGKv7r1NXHUwMDEwsC9kmY47NbvJUz5Mn7wp91XdXHUwMDFl6MhZTc3NKP/AK/05otVD5UCFXHUwMDEzdDzLclx1MDAxZL1cdTAwMDckPWsxdS19clx1MDAxZVx1MDAxZjzqlKDTYyBBeqCB9lx1MDAwZU1vhabPXHUwMDExc/RcdTAwMWGzJTqCNjUvirLcWnRsruBzT2RcdTAwMTFmYZlJzMZcdTAwMWXjU72oqflHxdxAnjlyOG3MMUbrkzk5L04v64SeXHUwMDFmhseVm2lcdTAwMDI8eUMg0jHJxuhUXHUwMDFmXHR00e2jRpBPXHUwMDBi9TvbU9hTyoE+fuxcdTAwMTVdjFx1MDAxNULfXHUwMDA3SMdcdTAwMTGKT6W+6tBPwVhcdTAwMGXSxVGqKnqvv3VsfrOJ8MHuXHSG9lxi5U1pUtJ1XHUwMDEzz+3L51x0QdhCa672V9zM0kl/cVhcdFx1MDAwMNDMWMvkid1lhtVs9DZScNJq5Mx/s1x1MDAxN6OdxU7o+X3rs1x1MDAwYsW1i1x1MDAxZfbhyax8j7lcdTAwMWHXnni231x1MDAwZoRq8Vx1MDAwMHt8eIHWsCFcdNX4KSNYK0Ast70jxidcdTAwMWWdeVx07XWEY9OVxjvDVGJGn2XkNJBVj6qQyLkmWtIkKDFK4Vxm5aeQ56hcdTAwMTLDXCJVJPIsNffY326JPVx1MDAxOe8svLjPTuE9z2Luf5Ospon0bC/K79lcdTAwMDPBx2pcdTAwMWNcdTAwMWSVhVx1MDAxMa5cdTAwMTRi1IQgd4mLXHUwMDBlzJN0XHUwMDE4R05Pz4dcdTAwMGZcdTAwMDdnWSun701lI1azn0B+jmu9vpDyLn2i4DVRrc10jdaG6OB05puzk1pdTkhYJuJcco3f933U6rlcdTAwMWVirXtcdTAwMDIgl/RcdTAwMDdLSeaLXHKq89YxXHUwMDAzz6n1jWRPXHUwMDAxazm6g6JAhNGDolx1MDAxN5YmyZ+TUnzMU6ftRmP0nInnICtjul5cbudcIjqfkyVcZlx1MDAxYVx1MDAwNCbEXHUwMDA0iJDlO1x1MDAxMy8lZrnVL+pA/uP+3cfnUYlhXCIxb61cdTAwMWRj0jex4jst6FxcXHUwMDE3z3r9zHvP+0d23WI+K6o0Plx1MDAxOeubgOtcdTAwMTZnYrlVWC3mnyPI1d24XHUwMDE3yand79WbXHUwMDFj0HJewEtB2EzYsWA4XHUwMDE56ziHO5zS4+NcdTAwMTTe8G2WyFx1MDAxOJe6XZfpla+EJFx1MDAxZH1cdTAwMWVG79f98Fx1MDAxNuqJVVx1MDAxN79IbkmHXHUwMDE3XHUwMDA2aXSqNuPGM9GvXHUwMDFjKyd331x0PcZzhyeX3YpcdTAwMWPirctcdTAwMWRVyVx1MDAwMW5QlFxiz+/CrMrj13ZcdTAwMWbfi74xnFx1MDAwNlx1MDAwMVRPTnm1rWJis1x1MDAxZkRvicDJaFiwO9xcclxyY1x1MDAwNW4yQWL6VnD0X+zFh+0+VJ2lm/aRXHUwMDBlZ85Sb4NmcuqCel/Upsioclx1MDAwNkyTtMu6483CXHUwMDEzc2tgS1x0d1xmQWJ8qWB5rPCzXHUwMDA1j5Xu6r5Pn2h9peHtKC26RnVcYl3CpFuq2lx1MDAxNuUzXHUwMDE22ZtY3/laUb/b62NcdTAwMWOtpZBX3rhcYmlqXoR38cJQ2c6KjFx1MDAxM0tcdTAwMWR9Xu7iqCQv3jx9P3LiP7rXUzxGXHUwMDA3x1x1MDAxMdLO2It4qFguRX0jY4/pVfFGXHUwMDFkdH7tuqeuxMRapl9cdTAwMTCIXHUwMDE0hc/vh1x1MDAxZlnuwotF+Fx1MDAxNnYr9rcwdsN8qSt04ZvPXHUwMDE1Js1cdTAwMTY5caUpZT8lVVx1MDAwNNImXFzpXHUwMDEzsNBnJO3UXHUwMDE285l+kFcu4WEyiXNcdTAwMTc3VOOEXHUwMDE314NwqFr9Nl7c1EFcdTAwMWU0On0654Exy2TC9CNkYVxi7DyDju5cdTAwMDSqhPQhXFxnXHUwMDFhwv10qCEyXHUwMDEwPlx1MDAxZstyilx1MDAxMujHyjmicpqhpokwroFNrXDhhlpLMStcdTAwMDNcIlx1MDAwNrzYXHUwMDFiTyZwimYwT2N5mFx1MDAxN1x1MDAwZmlW+C72NtCJMC3GIGl/VTP9P85lXHUwMDFl/sCL+/HpXHUwMDFmIbqLWsilyZrHieHob6+YYlx0vVG386HzxN5aP/W3jPqZ0+BcdTAwMTHzOdYgVUSjT5c+7XnFwjRcdTAwMGbrt4cpXHUwMDBle95cdTAwMDOmbVx1MDAwNWTjs1x1MDAxOfskl2FcdTAwMWTXn1x1MDAxM3ThXHUwMDAwXHUwMDAzVWxL/eTV1DhcdTAwMWNdIzu9L95cdTAwMDVcdTAwMDBvLukpsst5p1x1MDAwM/Xsrfl+XHUwMDE0utW3kVx1MDAwMFx0X1x1MDAwZeGwclx1MDAxNFKQalx1MDAxNLxZXHUwMDFln6hVXHUwMDFjwzzUY4riXFx0Zzi2cEh2jmUsqlxy5VH184tJ3O65ynH+ZupcdTAwMTKbpjCbm1g99WpXxzQ8ufhccpDnsVx1MDAwMFi8Tvt4Rv4zsXgkP/Iznlx1MDAxOHrRKI5cdTAwMWK+XGZY3jP2XiPbXHUwMDBlXHUwMDFhlrLEXHUwMDE4XGbknFx1MDAwNFxuvJ81eNd3XGJmYpxhnPXLgFx1MDAxN9poXHUwMDE5c5XL70L63TPohyrx+vtm3L+1zlNcdTAwMTixf2RcdTAwMGXZMziUptt3z8/zzedcdTAwMTOcn36TjW3kXriw3Cv5/Zh5/COft1x1MDAwMiyGPiNfxOZSr4l6RlNcdTAwMWXjp95YVCPLXHUwMDBiI4vJIYQqplx1MDAxNzpCVzg8XHUwMDE2QyouuSl/33NVzas0+p0qRoOG8KHzeDfOScRfpLtcdTAwMTg6qFxijugxwpFIYX5hamKZnVx1MDAxNGFMVmGAXZBcdTAwMDWVdCP0jTK2XHUwMDExXHUwMDBml63a4F8lx9xcdTAwMTldID1LSOUji1x1MDAwNfdDclx1MDAxNlx1MDAwNFx1MDAwNFx1MDAwNFxySqzIXHUwMDFlpehky6SQXHS3XHUwMDAx9U+X9GZcdTAwMTNcdTAwMGLNPH3WRvm98WL9ZNzs7Mhn7XKaXGZcdTAwMTefXHUwMDE5XHUwMDA1nS+NKHvffnFcdTAwMDbO3+pcdTAwMDbkvIVf3OKxd/bljvW5LFx1MDAxMdPS+Fx1MDAxOSpt0ps4+3OWY4mkZPJcdTAwMThmvTMnXHUwMDBlPvVO1za0uLt0mS+AfOaGTl2g2Y1cdTAwMTCRvyHy41cx5779wkPm8Vx1MDAxMzLnd4FjXHUwMDE05HlXRyWWXHUwMDEyXHUwMDBmN32xwmjNeSC1j2SJ9mJVY8E6O1x1MDAxZDM/qHA6vjk6sbqhXHUwMDBmmdvtbL1cIlx1MDAxZbDWT+1t/Shil1lHXHUwMDA14lHrzT2Fvu9MXHUwMDA3mLYxknFyXHUwMDEyKT7jxNn1WJjbwCFpdcjkKUhcdTAwMGKJx7nWoDxcdTAwMTGa8bLlalxc9FqSXCJXt1xiUDAwj0c3JbTW6P3PZFx1MDAwNnlJU1BSW9P0rkyTXHUwMDBmXHUwMDBlYbNkIEml/y3a9MlSksdpXHUwMDAx2lfndz6it1x1MDAxNmdJqEOwPUOCZVwiLmDR72B8PbJo5SP9xZlcdTAwMDV/4/+hrb6957NcdTAwMTQjp7mYXntcdTAwMWHFldKeaVx1MDAxYlx1MDAwN02+fYvPcFaqJaNqgXfsXHUwMDE1dLzak3hjMtGmi3iz9fleuppcdTAwMWXbcOtQXGKwsuV08YWZ/mdcdTAwMWOc9emK1EftiuX1cd845ojcvkUm5rFcYlx1MDAxNVx1MDAxOJfE/lmz+OjaXHUwMDA3t8j8ONBcdTAwMDerifFrxebpxad4LVx1MDAwNlx1MDAxNYeys3NyWTJegSnLRK2h2T699nKlfeSOnjFfzn5cbtFcdTAwMDOw21x1MDAxNNJ4XHUwMDEwyvXtPd46dC6Ll+vEWqiVXHUwMDEzXTHJZ3ZcdTAwMTaq9S8hqoe8gSFtMUpcdTAwMTP3ykqKLlpiXHUwMDFkXHUwMDBiXHUwMDEwZDbtkebtKPvCQidWXHKgT1x0XHUwMDBm5evPgqtcdTAwMTftuIzY8UVuzz7wJq+wo5ZVZsi/8K5cdTAwMGY/XGLa6DDU7y1cXLkzaD5cdTAwMTn7XHUwMDFkey3YXHUwMDE5IPyqXHUwMDBl3N/nXHUwMDAw99tjvzi8xJX1NLQhvvU1x9GBRzs0MT3frvdcdTAwMTFIXHUwMDE5cEmwZCiPd87OlFx1MDAxN5Veh/1E2rc3XGZxaz04+splsFx1MDAxOGzls7lzXHUwMDE2OWGYKJ+BodZcdTAwMDKO88uUpXdQ3MspMVx1MDAxMlx1MDAwYut4Q1wiPlx1MDAxMjqIxVx1MDAxY9/iXGa187jLKFx1MDAxNN0wunt53bHMLselw1x1MDAxNeTFoCWDXHUwMDAzie1gXHUwMDE5Z1x1MDAwNFxmyuJejlDJRDzSJPkuqEbzhITy7eA/UEOZXHUwMDAx0K9erztcdTAwMTNirzKro1wixsjmh/u+XHSely1H2ag+wKhcdTAwMDQrX5dg+NAgku5jVLfYJDLoZqZKd9eZtL9cdTAwMTg+6bQ/K1x1MDAxOK87oLdcdTAwMTWQVUVD0zlcXPHVZWZru+pv92SLf+zJNlx1MDAxOFdo/ZyD38tcdTAwMGbv1auTcC9G9vRS3HuMXHUwMDExXHUwMDAwXHUwMDAzXHUwMDA2XHUwMDFj/TyH3ehE3156w7dlNZpIP+zuZlHMQ3ol5aHPSl9RvVxiXHUwMDAwPlx1MDAxM3SCXHUwMDAxZGreXHUwMDAxVSbYR8SSYjD9UE+pL0pwNcYx/YVbXHUwMDE3Yb9FtTlyvl1UXHUwMDFhynI9KyT5ajvKcpbc/0PYd207qi1Zflx1MDAxMFx1MDAwZnj3iFx1MDAxMyBcdTAwMTDev+GN8Fx1MDAxZb6+0em6t/qcrsqbY2hkjp1bXHUwMDEysFwiZsxcdTAwMTkrVkSeXHUwMDE0XHUwMDFi6Fx1MDAwMDvXO/WYr4xcYqlZbm1ccsBcdTAwMDd9UlxmhN1Fs16VeKFcdTAwMTGFjFx1MDAxYS9Uik7Q6vVYeqSIJ9xcdTAwMDZZpZxHwlx1MDAxNUaxXHUwMDE2jb/QgFx1MDAwMJvMvodQXHUwMDAyRlx1MDAwZvGdXHUwMDAxaL9/7CPTW89T4mJcdTAwMDbd5U/8Wlx1MDAxNpQnXfU4bC1z7NbRrbnvLVx1MDAwZXWHjzi0ky9cdTAwMDeANtiS3JMhbdDx+jV9iqlXVW/J4DWIXdfNNZBYKoh/XXCeu3iRxV9l+UFcdTAwMDOaKVx1MDAxZlx1MDAxMKvaXHUwMDE4OIwwST9Wd4d4Pqe5XHUwMDEyfueum06wXHUwMDAxf21cdTAwMDFv5Fx1MDAwMzHJx1x1MDAwZuv0lckyrHS7ZFfvUevwXHUwMDEynE1cdTAwMWPeXHRcdTAwMWVcdTAwMDCB9lx1MDAxZPOPXHUwMDAzjJ5vxZ9ehq0hzlx1MDAwN0SYs0FCr6iVsrw1jNYzNuO9zE+8VIarLlTwXHUwMDAy1lx1MDAwMOdccquuikTIeH+kIEjIqlxi/W6Ni2RcdTAwMWFcZpKBlFx1MDAxOVx1MDAxYZm04tJ149hbcmpiXHUwMDE0x/2PvcH+78/Id8JsjDa0YLHCXHUwMDBivqbz/lx1MDAwMExcdTAwMDL5N06kcMxcdTAwMWSopaTqg1x1MDAxOcu9reneQnGXYNYtLKFcblctSbafYlx1MDAxZXFcdTAwMTD3xHb0XG5cdTAwMWShJd1cdTAwMWTjXHUwMDEyMUVYPFx1MDAxYnT5MCu+IHhcdTAwMTVftJQtb+hD+1x1MDAxZn6bw9Lp6fN3JFx1MDAwMHRcckORj37UP3OipUVcdTAwMTlsYejyXHUwMDAxJJZcdTAwMDLQXHUwMDExr1WT6Ne654qXXHUwMDE3ezf6LUB46OeeQiSN3FtLMkqw6vhw6P6DIEbtfPmcXHUwMDE3nceMna+lVEW+5PC26ayfeV1E29fb6W2VPXKwXHUwMDFjXFyEnUMz5j14fnfO1M+tXHUwMDAzgulcdTAwMDT9xlx1MDAxM81XNNd5Z6uuniXqXHJ8P9FcdTAwMTOjcoSXNJSX3oG8vqe4OXOYlj1XXHUwMDAzQXx23qrVda7S4Vx1MDAwMqvxPH9Y6p/2gL/Dr48lSlxugorS6rggU6VcdTAwMTLo+C1VXHUwMDE0mLNy7W5NXHUwMDA3hoXZ+kswXHUwMDE4deDNXHUwMDE0alx1MDAxZVx1MDAwYiy+MphuokPb+qM9XGL8/HYvgtqQVHbsz0u2r1x1MDAxZHlYNtbZXHUwMDFlNKBcdI/TPEVcdTAwMGK8qEe9X2ffXHUwMDA2pOOtgI9cdTAwMWNcdTAwMDBcdTAwMWK3hULZ9m+KeHBt24pcZnv4XHKyXGbw9Fx1MDAxOeBHXHUwMDEx71x1MDAwMVStIDB4XHUwMDA0XHUwMDExZFLcmLn3VkMxvW5uXGZcdTAwMWWFmyBENLF9JqZsyiN6iCFcdTAwMWGPm1x1MDAwZolCpVx1MDAxNjQ7mqTNXHUwMDAwnabrefA3nE0xopNfgj1iXHUwMDE3XHUwMDA1XHUwMDFlQVx1MDAxZfGoRXJcdTAwMWVs5Du4XHUwMDBitlx1MDAxYZ23O7WtJc6uWz3aqkdaP15M+s2/PFx1MDAwNbfr90tNedHjXHUwMDA2sMNNeKK1LJDAnXPqXG7Ivvk0Pldcct+O1SNfSuxcdTAwMGLTaYzwf+xcdTAwMTX5f/tWXHUwMDFkIGOqw92IXHUwMDA1UnLEJWZZyfffyKEl+6OFXHUwMDE2cPKcXHUwMDAykL6bXHUwMDA37uK31ckhXHUwMDA1XG7NTGJ/XHUwMDEx27FQQ7mC3V9GYJFU8jRxrHiiNaRpXHUwMDFlWiY8gC98u1x1MDAwZt9HrsetXHUwMDE18ED5vfV769C2MkiKI4uBOqiiXHLbXHUwMDBldodm9MXheidcdTAwMDfBzVxc+PDaMNiiNjqQbHifXHUwMDFm2lx1MDAxYqF4XHUwMDA08N0zYDBcdTAwMDNJ+EuQXHUwMDFlq92WNnPjoLFxNOKITzpwflxy/GpcdTAwMWG8vnv9JVx1MDAxYX1Aplx0OqtcYmnOXHUwMDE5Rc3rnHbuvF7rrZIhXHUwMDFiXHUwMDAwIbw8XHUwMDE09FxcYk90ujGicq3Z81x1MDAxYVZpfrzv62s9rHtKRGTuXHUwMDA3e3NiTMxcdTAwMDakQUhNYYjPq4smqFeWjSSPWscx9KHlXHUwMDFm+6uEXHUwMDEzLFx1MDAxMcj44jM/vmUmR6s1ZMr/reaFLdffvF0ji1x1MDAxOFx1MDAxMe6B93DAPYSUXHUwMDFmXFxNtZLZWleb7zQzxYydLnhcdTAwMGIjRVx1MDAxNCeoXHKSN1a3JNEqxbQ8bFx1MDAxMrLaO0tcdTAwMTFh8Yd1oGtxXHUwMDE5RGhu+cL3ZudcdTAwMDRAam3wXHUwMDEzJVHC6jXvQ7rR2++n6JskW1x1MDAxYcIhZETkWlx1MDAxY4w2y5VcdTAwMWHF6cU20SlKi3s33ZtcdTAwMDRhqaPpMs9nJKVcdTAwMDD3ytKYXHUwMDFidb5cdTAwMWU3jbA/gd/e3lx1MDAxN1x1MDAxNm+Pxmms3Vx1MDAwYspBab5AjVx1MDAxMjYyJYTSV4ScWOL66T02244tXHUwMDBic0BkRnXn6N8t4U37TMBjZCjCvYNcdTAwMGJk5Fx1MDAxZdlPZVx1MDAxZkicXHUwMDFlf6Vh2WZcdTAwMTd592aZJ1x1MDAxYeP4fnePXHUwMDA0XHJLXHUwMDE5lbY7MeOJ1CqrXHUwMDE2p9ike55OKlx1MDAxY9xhXHUwMDFjTTJcdTAwMWQlff5QY2QhdsgweUWJ0Mf9XHUwMDEwiizS4mP83DnwsWG+gmhbrXHS1lx1MDAxNIaPXHUwMDE5OqVpXHUwMDE5cfxcdTAwMWVcdTAwMTdcZlx1MDAwN937VZtIyVxcUFx1MDAxMdAqTSBcdTAwMWKRXHUwMDE03XffjaHeko7/1dc8XG5j3ZQzv6uyZedIz3jvkNrwt75CnFkuXCJcXPLliV2jxVx1MDAxYSHWeFx1MDAxY+qwlsBcdTAwMDCvcUZcdTAwMGW/63smb/ab+XLpdoybXHUwMDE1PqtlNFxiLzpBZPDX6Jnri5h+5Ne1o3XWUptHQqHRmnNcdTAwMGK7XG5oL2NcdTAwMWU7v5JcdTAwMTRWRa+6rZtcdTAwMThcdTAwMGXdXHUwMDAwO/O1XHUwMDEwIUSJfI1NzVx1MDAxM53tXHUwMDAwnZdNJrM1tmFcdTAwMTl+XHUwMDEzw9RcdTAwMTFo5GJcdTAwMWWvyS/Fr4bG0Ynv3vOwlI6FyN/2XHUwMDFm+kfyrPnLlZalMTwki1x1MDAwNmugXHUwMDEwqnNje9tsXHUwMDAxXHUwMDFli1/xr1x1MDAwZqr4MY14bTRweFx1MDAxM9lcdTAwMWRtIMlcdTAwMTHfOX5Cv1x1MDAxYi1cdTAwMDWOgW327raY/KbWNXtcdTAwMTM1OyHEhccmVFxu5lNLVMuLS5Dhh6/wNF68xy9cdTAwMWR4NVx1MDAxZjjdJcRcck7rpa7Vpq2xO+5JT3cv0Eq0dVxuaXP1Ri31zuBZXHUwMDE48z4mlKCm7lx0wojH0IpcdTAwMTaVXHUwMDFi3VxcyVx1MDAxMF301q3ihqijb0P2O1x06duNySZIkIXehDmgMktcdTAwMTlfWfgsiNtd7zuJ2avo3i7LbVxiyCvF8cSwpf5Tf53wr/465HBqPiO1KTPbvFx1MDAwZlx1MDAwNt93s1xuXCLEtlx1MDAxZOU4SlbzOYZ1XjK3SnSQN5JcdTAwMWNIpcFcdTAwMGY1QWeD6+NXVjOoXGJR11x1MDAxM1x1MDAwYqk1/rg+6/y26lx1MDAxZuafRfFw92RcdTAwMWGa2lx1MDAwMiNcdTAwMWTchlx1MDAxY1beZGzB+IiMbrZwL1xcXHUwMDFlzTlcdTAwMWTuizyQI/Bccu1/r2t4sMksfzNcdTAwMDNcdTAwMTYpqn+ukZX7fezP452rXHUwMDE5Ttd55H/zqNfWXHUwMDAyg9IxfWdMWWXPQNS1XHUwMDEyXlozXFyDp1/cnu8sXqqCri+fOFtGpChbUlxizXj0P025I9wuyG+k7sZhXHUwMDFj8UGRz1x1MDAxOEn/e61F9WbM98BspdVuvPyRltfuXHUwMDEw2danXGZqoVx1MDAxMDlSXHUwMDBmZlx1MDAxNoxj8iuE0SH7XHUwMDA33E3Lv3C3eqRcZlVcdTAwMTncXG7TyFx1MDAxMl76yiRcYs2o822qcP4huDvLnntojThcdTAwMDTrXHUwMDBmXHQqI9x/xEz3UpJcdTAwMGZ2/b2wQXI/YbNfoSrn7Z/Dxlx1MDAxY4nQXS9/O6As5Fx1MDAwZmFcXEXwgodcdTAwMTXIXexdp0uk+3+oIcM48XhCMXnp0d6uXHUwMDE2WLRcdTAwMWTdQ1x1MDAxZit4XHUwMDA0XHUwMDAycrS0XHUwMDEzhCpfzVxu0n/sgz1FQuT1hUiIX95DXHUwMDFiRF0jalFcdTAwMTBQQjhpmerP2UTo9th3XFxrqz26q1x1MDAwNFx1MDAwZv7UK0pcYttF+zJIR1x1MDAwNuxCn8GkXHUwMDA2eNTj0ovhiJeQtcFBXHUwMDFiJVWp4uBcdTAwMDNHYpL9i3BtmORE4WTgXHUwMDExfrtehvtywfHH41Ihu3KpW1/i/865hVx1MDAwZstsjW5mVPDoTmcjaZwxXHUwMDEwv6GJZYC2MVx1MDAxZcJcdTAwMDengVx1MDAxY1x1MDAwMI7rT/no8EzL8k0+LjFcdTAwMGVF+1wiQrh8N7XCrF2G0fqjnZ632K7FepyLJVxmu9ror3NcdTAwMTdIXHUwMDFi4uePvbtIYXmur3zzXHUwMDEzT8IptMUjXHUwMDAxxThcdTAwMTA6XHUwMDFi3DNbRedcdTAwMTZxQ3/qNylcXN+/5rIwhVx0XHUwMDA248e1tpiRhvqhXHUwMDE2/6F+U8F/75PKuiRtMuxSmo3tXGLaT1wiR5RMsmZp+yDiyFxuuVadzPX+XHUwMDBmPTwvxv3Z+q8tu95cdTAwMGZ5gDElyVx1MDAxNFx1MDAxNpyb8GC500Q7XHUwMDA0l+l21ljuXHUwMDFm8OtcdTAwMDEwXHUwMDAzs5/Py9vjXHUwMDA1OTlWVY+nXHUwMDAxwLpEXGL1P8yn/HdfzDD8zUxhvvogr/FN4vSwXHUwMDE2XHUwMDBiXHUwMDBlTOA7ke+HqjBSPqwwXG7nJ1x1MDAxZdqwZW2b6UhcdTAwMGLbXHUwMDA3e1x1MDAwN/f6n3tuhvnxfjRk47RcbrRKb3P6lLZcdTAwMWS2q4K8w3ztgWu/XHUwMDA2mZpBKGSm+WVh3ZdXMIqYXHUwMDAzXHUwMDA3Nu/zjJhcblxmNnFlXHUwMDA0iDVCyf/af7Iz6KJcdTAwMTlGg/Cq/SQmm+NcdTAwMDUyIPiW0lx1MDAxMcRJWVx1MDAwNu/yjLZcdTAwMDNO31x1MDAxZoJfx6N9XHUwMDAzQc5cdTAwMGb64lSYKkdYXHUwMDAy02/KJlx1MDAxOeE/9HWbyuTgaF/T9z03rz72/UY/XHUwMDFlnmLT9i9nXG6N4CWNVPTlk1x1MDAxMlx1MDAxMVxus6uKOtpMdH+U05KIXHUwMDE2/37knMXtjrtcdTAwMWaWIJXe0OVAVWrDQn/5ozC/j29U6MSLh/innIJimaFearHqfpHuslx1MDAxOXSXeOLUmPbc28/DXHUwMDE5u1x1MDAxN9NNW1x1MDAwYlxiwKxJYLdILWFjX3baQi3d5duGlSpEXHQ+Vp7YoNPYinB/7MnqyFxiM1x0MNxUzntcdTAwMWPUjy/v6HRdZODH8fh5O5xbvfrnnndqXHUwMDEz1nJrXHUwMDExKocpbNZAhkVHm53Hrlx1MDAwNzC7SNPAi1x1MDAwNlx1MDAxYuWE315AsZXmtvdu9lxyocdcdTAwMDU3XHR9LOV/mHv+3zOHTCVjXHUwMDAyU+vWz/utyfhJ55BcdTAwMDKCXHUwMDA3s9+MNvmYXrnZxTHo5vPBw1x1MDAwM1x1MDAxMVxuflx1MDAxYu54bIZcdTAwMWMvOYaWMVx1MDAwMdDf5KHi54te9Jcqs1xi6yBcdTAwMDRdXHUwMDEzXHUwMDA39Vx1MDAwMC+9oo2mQFx1MDAwMkyuy1x1MDAwMYR/8Fx1MDAxOZZcdCVZcKS+njCo83GIXHUwMDAxOmTfx0dQ9LLuxWmL4Fx1MDAwM5t4qYOwclxurcGjMC2yqaFnMUJxfe+7+vI7z3poM1wiXHUwMDFig/Cns1x1MDAwMtWnOlx1MDAxODbTU4xccrKcLibNxcqe4mv9jfF6XHUwMDA22kX81UlcdTAwMGYmkspkXHSmWVx1MDAxOMeV//d8lMgqv1xcXHUwMDFkjVxiTFx1MDAxZoaw5Ei2ZlHDjTFd+SbsXHUwMDE0jzr5XHUwMDBmvVxiP7zLXHUwMDA1plxi9UVcdTAwMTZP5UvjQjwzhvvliEVcdTAwMTHtT/DROL92omo21uXh1GrKnpk3WfJcdTAwMTSgsfyfei6L7Jf5xuM2UlVcdTAwMDStXHUwMDFjQlxmKo5cdTAwMDOnzGbMdPVvY7CP5TxcZtm6I8aqqaFcdTAwMTdekNhcdTAwMGVcdTAwMTL0llx1MDAxOVx1MDAxNX54p6T98cyFQL04hVdZlKzjL0+yXHUwMDFhj0BcdTAwMGbYzvCVxeLnTVx1MDAwMNNCXGKWLbh8Up18XHUwMDFlI1x1MDAxOdNBZVdzQ29cdTAwMTZpL4A7xItcIvrr3f6/31x1MDAwM6/+evbnl8KofVhr3vLE/eVcdTAwMTKh8Xh4zVx1MDAwZSR3/Tr/1LeSZ9osLp/Y0cvQnfJi44zXfZ9jiSNHV4gr9+DZj0J98j/3yeRcdTAwMDbWrMuLkJ1cdTAwMTfEozp9vuJcdTAwMTCrXHUwMDA3XHUwMDBlV9K/zuVcckJcdTAwMTj8hzMqkvuLr7Tgcmh2KS37KXzniFx1MDAwMOGPZ0Qs8TdverdTLlx1MDAxNlx1MDAxZjxcdTAwMDRjKFx1MDAxNP/8PVx1MDAxZmZgXHUwMDFm6+NcYsVQ6/KAXHUwMDA3ITv1WdD/3IezVH8zVjKG18yjxIP/cT7Cf/PJrvQ+XymOJahi5brz7oZuTJ8m6cglbFxiepXBXHUwMDBirNu0VKKEXHUwMDA2cZWGwfimZHVB0Yk+XHUwMDA21KvtXFxPcjk325JKNDaoh9RcdTAwMDS+0yn9h17plcy8lSdcdTAwMWXbt/LOXGayMmRcdTAwMDZxQrd64rsuyYuG/PCq8lx1MDAxMO1/mlxy+f/OqTjlstTxh4S5n5jfx/1dZ/38eGyG7MR0XHUwMDBlXHUwMDFh9aFcdTAwMWLJXHUwMDA3vz+Mq5PMPtBBiGBlZsI/9jPVNtu5ZXb7Qlx1MDAwZvl/QcDwdkqMsf53jv/rie1+XHUwMDFmiVx1MDAxZUE4Un1cdTAwMDKGz2bi445OXHUwMDFmn0lx1yklQG9ccopXwf9PfVTR8sNm0lx1MDAxMrjf8UiFofkjt9F/M3X4/TpcdTAwMThcdTAwMDLaoe4vTFx1MDAxZJuglPGWaVdt24/JiOAr3YdZdYU/5uNcdTAwMTXreZZcdTAwMWHGM4FzXG6Cslx1MDAwYtXRPaq85S+JOoQnXHUwMDFlPGJIrj6/fu2W7a7On/y9+7Wjfbim+GCGmHHVvJNMk8woXCJcdTAwMGa1cL5cdTAwMTnnXHUwMDExxva9/CGWcKFcXP6Lf21cdTAwMTJfzMhIoVopP3xZm/WSweRBQizfxP64jlx1MDAwNuN/3N5cdTAwMGaAXHUwMDEydlx1MDAxNI9cdTAwMWIoilx1MDAwZSFtzYs40N1W/9FrqJ2NV9lp7Ts0Vlx1MDAxN6A/QVx1MDAwM2HIi1x1MDAxNTdN/6S60VDOnWySrv5XnHnHW1x1MDAxMjJbfTxcdTAwMTKQUbuRqVx1MDAwZpbAySHyoT/FXHUwMDE3XHUwMDBl5J6ftVx1MDAxOFxieUxiqvtthKBcdTAwMGVcdTAwMDHCOs7EdFx1MDAwZtXHUUx41lvFxfiaXHUwMDE4XHUwMDFhfijk2Vx1MDAwNDw3N+eqqEpcdPlcdTAwMTO+lIXwl1x1MDAxZGyPXHUwMDFkOLZcdTAwMWUtSkI6SjXPM2zR55m5tjmiXHUwMDBlK1x1MDAxNbHclVx1MDAxONCDpPZnO2Tr5sfl4YeA4Fx1MDAxNnpMppiNk2QrmmJpWuJJZMU+9iBcdEb4XHUwMDE5XGaDUzpjKaYj/lx1MDAwZvNcdTAwMTSu32daP12RjPmjK4ggOMieuJeXy5HsgYt6J9feYVx1MDAxMP1kqFxcXHUwMDA3MYlnXGZz4yRgvfyx9uqHZdMhXHUwMDBikLTUpUjuljqdiVx1MDAxMMKtXHUwMDE0q+xLXCLl0H4oR74y0e9cdTAwMThcdTAwMTh399Ny9+ji11x1MDAxYT41gIH+Of7yxW/tSOzL6Gvj8mKdfNKcQKHqcbbNIZu2e2KPZHeQknhU14Pf9MVQVa/JzLaiXHUwMDAwVFx1MDAwYlx1MDAxYj2h8/RKi3WtmuKEj3d2o35bvFx1MDAxN1x1MDAxMtbk05Vmo0Q13KeF/XbAXHUwMDA1t45cdTAwMTlM6/xcdTAwMGL2KpClwVSyuWbAJJLCeKNcdTAwMDE8XHUwMDE4JrKyXHUwMDA34N6dI5T9/WwnW4q//McvcMTMXHUwMDFjXVx1MDAxOHtqpii8iFxuNE1JUW2QVl48XHUwMDFk6lXQiVx1MDAxM5hdXCKP83FsmFx1MDAwNTCAtKzqw+15XHUwMDAz+U5cckpJTmk8kH/MwT6SX+6XS4lSw0OX0+Zkl4C0W+BBRPDGq6RGcjRcdTAwMTZcdTAwMWJcIkh8jWxvXHUwMDAyXHUwMDAymT5cdTAwMDKiIKo+4pyKT6BFXHUwMDE5Op5KxbdhvHOibS/YgzVeV9Ut4OgjXHUwMDAxxENCk/tLXHUwMDBmwEycXHUwMDFioM65/lx1MDAxZJE5XHUwMDFk5excYueS0LJWo/e83lcyclx1MDAwMFx1MDAxYVx1MDAxOd1xM/piNPtYpE7FIK1cdTAwMWOJVVxmg0CQvEmrwsG+4UGvPvbGucSr8/d3UKFgXHJC07zLiY1F2vWB3vc/8UxcdTAwMTaV8vWKO8f03msrLODHUIFqnUncjvCuK1x1MDAxN2ZQOLhHoUBcdTAwMWEje+zDj1xiXHUwMDE3KtunMLzMxdswm7/2ffdcdTAwMTbstmtb1TJvn2U+frVcZkZCnOT8YVdcdTAwMGVl08CKvrbSMlx1MDAwN5HfZISGePtgXHUwMDFjXGZ8XHRcdTAwMWMyz2CO111JKIJEpyowt0zvtFx1MDAxMSSpuVwiX/Y2XeuXJJFcdTAwMDI2OVx1MDAwMqlB9U3mgW9/01x1MDAxZZrubCmBsifY4lxcT4/CWtBcdTAwMTD2Pk1a/kToc1ZcdTAwMTWWUltcdTAwMTGrR19LXXpcdTAwMDc3glx1MDAwMty2bJLGWrp1+P49znCY2qk8xOdcdTAwMTHDtZNtZ6ZnynnFx1xmSVx1MDAxMseDxcUwyFBTfjAg/FSTqWa9+V7laFx1MDAxOTiCY+TIoL5xLndm1iNcdTAwMTFcdTAwMGVcYrTRTOCQXHUwMDE4gTO0LbiJk4VVISnFWPVcdFcgsKubb1x1MDAxOUWL6bktXshsJFx1MDAxM/jR59Cpd2NC2VWxjSzziC+N0LCRgXNcdTAwMGbc0ZsgVe1owJ2JcDpcdTAwMWJcdTAwMWRJ6IFcdTAwMTE0hVx1MDAwZtjCPGQ3JFx1MDAxMttbXHJcdTAwMTLgXHUwMDAyXCJgYUJL9OW+aFx1MDAwNlxciPJKPnfM/zO++ufzL50ondz9XHUwMDEwhrxMhCUhoTHNYvnrb2BLXHUwMDFmj+d0XHUwMDAw/tVvq+zHTVx1MDAwMEj56i+WrFx1MDAxMlx1MDAwMqEq4G2e3Jl44e1HTlx1MDAxY8nDKotQ4Vx1MDAxOXE/zcVcdTAwMDSikTFHoLBWl6S5XHUwMDExhImcIUqrwU7HXHR9ZOquMdD6XHUwMDA0ZZ/tXHUwMDEwiC2Oqq18i1x1MDAwN/RqXFzeqlx1MDAxY1x1MDAxYlxmb0FcdTAwMTFWft/LcNrhOe0wc3yrm2wv/iA3Pp7RWfhr5mtcXFx0uV/iXHLlQ1tRRnI9uEdcdTAwMDKeY8zLK1x1MDAwMIlZSMeEXCKr2rjUXHUwMDEzVFx1MDAxZu1cdTAwMGXeO1x1MDAwNto7eG19kvSgKFFxjunlXHUwMDExg1BcdTAwMTGBYMFcdTAwMDFvI7auXFxcdTAwMWHyky7VXHUwMDE16Vb5U1x1MDAxN9e+25OE5Fx1MDAxZVF42lx1MDAxMvFpNzPlP7DUIbiKZVx1MDAxY/T7UFxm4jJqXHUwMDE3y8vCXFwt7H7w5C6lkI3OcopcdTAwMTNcdTAwMWZCu1x1MDAxYdNwvYe36CHJl7f13OPSRfYwsfl3NtlQUVxynVi/PVx1MDAxNs/rhjiC2lx1MDAxNY71W21T5Xz73q9V3CGYW/Ehc1rbV9pcdTAwMWKDh//F67SGcGnTXGJcZn6mXHL/XHUwMDFl7J6QNGFmuI9cdTAwMTNcdTAwMWFcboRb1IFoXHUwMDEw0d8oclYkf/CRXHUwMDA0wyB6OD/+6ORcYn5+XHUwMDFmPb2Ovlx1MDAwM1x1MDAxNdRcdTAwMTbYXGaW3D6XuKEw0NXti6ZcdTAwMWW/1mCQ24GaJlxcPfJcclCJXHUwMDBm4u2eXHUwMDE0sN3PL1x1MDAxNVx1MDAxOYjt21x1MDAxN4D3XHUwMDA3nVxu1M/IXlhcdTAwMWG6olvwXHUwMDAyXHRSj/V3rlx1MDAxYsT5gNujyECkoC43tM9cdTAwMTH8XHUwMDFjXHUwMDFl1nvIZrXVNsdcdTAwMTOBelxuaExtbLxMu9pOalx1MDAwMMZP5tAnXHUwMDE2XHUwMDA0OMCYXHUwMDAylGDpP8/8wb99U35HhTvkt3424jivXHUwMDEw6StjjvmCaMzYXHUwMDEzpYyv2oTXLPazbE67XHUwMDExXHUwMDA30bUjXHUwMDAwSeqJ6OA5fDBMXCJA7tjr53DN8XQkW+dcdTAwMWHnXHRPM3S6byRJiXkkXlx1MDAxZb/Dd6HIULdcdTAwMTfx7Vx1MDAwN/pjQvJUyuC2d7hcdTAwMTTsXHUwMDBmY7ohcYZvzCdQXHUwMDE1lFx1MDAxMlx1MDAwZSB6fMssQP0qanwo6MM3Z8ssXHUwMDE2PGaBOfM9mm5cdTAwMDS1v2PgueSCLFx1MDAxYZLsXG5cdTAwMGJvheJCXHUwMDFmXGJcbta8mVxmg28u38jnPtkyXGbYiL5cdTAwMDEprEFcdTAwMDK8YHFcYqdUXGZcIlBcdTAwMWXgdYKA2iaocSp4iMBcdTAwMTjtO6jGXHUwMDAwrTG8Ps5i3Vx1MDAxNV2rhP1L+0bQ8mWB+3LIIdVcdTAwMDWI35Fx0bTh+IcmeT0qlv6/nFx1MDAxZl2RXHUwMDFi4Neb45P41svlZvDmfi2NnzrT/Cjpetdccnjbc1q8adW+eWREsm/0XHUwMDE2vvWayNGYQ9GipdBcdTAwMDT7aUZcdTAwMGLWJ4Z37FW+XHUwMDE0wTpcXMxcdTAwMTcsUHJXXHUwMDE4MWh6y175XHUwMDFkw3OrXHUwMDFjcL6yvlx1MDAxZZSLNZletsfTXHUwMDAxaMtcdTAwMGW/XHUwMDEwfndvdfKZrulde+ihbb1LXHUwMDAw3fCroedEM4CjeIJcdTAwMTdJzz1cdTAwMDTQQHfjjkzuIdF7OJU9z1x1MDAxZEVAUE0ydFusq1x1MDAwNYmGLOhcZsBXilI+j1xiNOPuXHUwMDFlUvmJq9HG11xuXHUwMDE1XHUwMDE55/tcdTAwMDLLb0BNi1xyiv3FebU1xbZreN950nv/XHUwMDFlroNcdTAwMDImXHUwMDE1fFx1MDAxODZC4KHU1FvETb7vdoN+vZwpZFIokf5ZU//Vf/NcIlxmVuPXIGFghVx1MDAxYvb9nM0vXFxzMrHApIZRXdvAp1Ij1FjlWf59XHUwMDAxU1x1MDAxN+xfTopcdTAwMGVy+EDFXHUwMDA2915cdTAwMDFg86bvXHUwMDBm75igQ4Fpq9Xy4VaTNa/5spSMx4dcdTAwMWHZJMxa4zDJ2iBbtMg5ObJstFx1MDAxZWJcdTAwMTPEWOTObO69+M26Za9L7Xagr8yN71x1MDAxYiX8XHUwMDE1bk3amGg3iUFEjKxosdo59sx5pT7ofT3hcbB+p6Z2qPc2+vWQb+LGrFtcdTAwMDNcdIFcdTAwMTjQLnToXVx1MDAxY0BcdTAwMTBcdTAwMDP2XHJC/+pNZVxmWFx1MDAwZqJcdTAwMGa8tz3e53hcdTAwMDGlcE+LSEBcdTAwMTRgYygh3C/vXzPpbW7Ie1x1MDAwNYA9XHUwMDAxg1x1MDAxZUZcdTAwMGW0jbqi15//ok1/26msXHUwMDBmUKCgsizXzfeUNahcdTAwMDNMcTG/olx1MDAxNLDPPM3meTNcdTAwMDJcXFx1MDAwMMFv09NOT6LjXHUwMDAzyFdccn/1Jt98v2af51xmSmJcdIf/2F+g/tr/SP1UzLRcdTAwMTRfjIf7PfCBU8xcdTAwMDCpN4SIXHUwMDFhQZh+T1x1MDAwMFlOQVPkTSpagC9cdTAwMDRMgVx1MDAxZFWiRrlcdTAwMTal/Fbj159eyEMzXHUwMDAzmbXs8oc8mNZ+tsosvnTcvOb1e1rz6s1cdTAwMDVcdTAwMDGEnLNcdTAwMGVgkaDsXHUwMDAzXHUwMDE286r5RUeAWEx8RXafXHUwMDE5NDVcXM2LqI9nXFyPz9Wgh5Lpsq1cdTAwMWFcdTAwMTDhjnZcXCC/rltcdTAwMDIv6f6LWalcdTAwMTGFW/kpXHUwMDAzqYmTTGM+qVx1MDAwN4J34lx1MDAxNCNIu8ZcdTAwMTVOLKnQwOhk+4pcdTAwMWHERnlcdTAwMTKWYI+7XHUwMDA0KLJmVs48MHlN9NzV/UGR7eJcdTAwMDJJXt/9XHUwMDBl962OokZcdTAwMDAmOEyOXHUwMDA3sVZcdTAwMThcdTAwMDSAXGKGZvHjaUlcdTAwMTFNym/NXHUwMDE2XHUwMDE1+4Al4cHnbN1cdTAwMDWAqL8+Jms1vcJU6YiFXGJVnEHnXHUwMDE1j4rRSynCO4BFK5yEJFx1MDAxZi8/4cJz3r1B1lugL+ORXGIgXG50XHUwMDA3/Pe9XHUwMDFjR354LOp8P6z2O1x1MDAxMyBzzFaWmVx1MDAwZlx1MDAxZV/C3tLLXHUwMDE4XHUwMDFkXHUwMDA3hMJcdTAwMTY+4ElcdTAwMDVcdTAwMDBcItvgXHUwMDExzFx1MDAwMMZ/VVx1MDAwNzZz3qJ039iafO9Muqqxiq3LdW2hjIg/oZn0PWJcdTAwMDH5XHUwMDAwxMqXaGVNpE6SJd/2Vk3Sa9n8cqsupN2BfE1cdTAwMDIoKyxl0aZcdTAwMTlcdTAwMTTeONxrsNa1eG5cdTAwMTeWTPpcdTAwMTD5cFx1MDAwNWfTtoJcdTAwMTY/4bh7/KGnaeLnSSVgbZeg7bz2gNcgqkZbStNbmX2ruIteL5O8aVx1MDAwNFx1MDAwMXU8blM1XG70yNSyXHUwMDE4V3lsW6RlvVx1MDAwZc3feSGzronN7omVwLNtXHUwMDFmyHuhM0o4oFx1MDAxZj729aGN0Vx1MDAxY7RcdTAwMWPlw7lcdFxuXHUwMDA3XHJcdTAwMGJUOmlcdTAwMDBcdTAwMDVcdTAwMDM08Fxu8lx1MDAxONA3wDtcdTAwMGbOhGD7NbD72mP0vPpcdTAwMWZcdTAwMTEqoEXDtVx1MDAxYtX57Vx1MDAwYlx1MDAwZSdccspzwLlcdTAwMWbo2Fx1MDAxMVxmXHUwMDEy7zn0Nc8zwKreXHUwMDBic8SBdt9RTlx1MDAwMndcdTAwMDPu4ddcdTAwMWR6JPx+Qs+EXGJcIi3YXHUwMDE0STDW3/I6++qWXGZHpFx1MDAwMNM/UXp7uaVGTFx1MDAxOTmbMeS49NqP16LmO9n3XG4x72OPXHUwMDEy1F7s21BsRtwg6+tcdTAwMWKN70Gw32b1XHUwMDE5eEVekkc8S4Hyjvriilx1MDAxZlxiLebPfGGv84lcdTAwMWW1mOx+sC3jQ76u9+aTgUKv7ZxcdTAwMDck/FwiXHUwMDE3/10oe1x1MDAxYlx1MDAwMEDRXpnjzViORliBXCJihXdUXHUwMDAwJPJ96reh5Duy+Drsw22Q36BCVKRfXHUwMDExrS5UhHGhXHUwMDA0/tp82lx1MDAwNVx1MDAwMZxUXHUwMDE1mM2cR8aRrkHcQJOoj9qgwc9i3d9cdTAwMGY2Nr5cdTAwMDOhRbG/XHUwMDE23Vx1MDAxM3P7UkHfoYjg7LTlKqg021Vcck8wiDqZPlCKwUHenUhcdTAwMGZ2ocFGkICA4k1fXHUwMDBmXHUwMDA2i1x1MDAxZFxypjVp4chtkLh1u+/1yz89XCJKQt3wb3klhlx1MDAxMVx1MDAxYlhAo1x1MDAwYlx1MDAwNtiXOu6qXHUwMDFjPmByvPZcdTAwMWP1PGBYtIdkvVx1MDAwZTvDXHUwMDFmNXY0XHKo9Fxibojvklx1MDAwMFU4N1Fi3Fx1MDAwNsFUy+7R2qhcdTAwMTT2WX9IKz+MdEr2xFwikaf3+G6B7v5cdTAwMDc0e1x0RGxwr++A1j57hL+OzNPhgyg3ei3AXHUwMDA3Zt7Wt1x1MDAxYi3D5v99LpY/XlizQEf8aM1+ej4undG7+4COTtxEY5AorNWoLsFKnG3YL29PO97X/sf8P4trTS7m9/fdJtk7ZHK10HxcdTAwMThcYkmGXHUwMDFj6JLOlp79ILtJVas4VVxu8bVmlnRcdTAwMTLwNm0wSN83rSdcdTAwMGaUXHUwMDE5QMU/X13lM5LfwdA9en+iXHUwMDAx9d+5kk5cdTAwMWFY4GjqWPJeM7qLj2q4XHKQ+bWA7kma21x1MDAwYqBcdTAwMTIl7/4861BnpcnSmlnE/d/nXHUwMDExhuLw195DhWBTXHUwMDA0cUFMfTrxmFx1MDAwMXv9pOZ7KT12XHUwMDEyuTY3XGKTzoFrzGi1cWjl4WtcdTAwMGaPznXAxreki5TZ6XLUot8li8ZrR2l2ftxm+q+8ZmFcdTAwMWYmUj3G4Ps0vSo98X7ikq/Q5K0/JDNcdTAwMDWL2ZgoUlOg1t5cdTAwMWM5p42cqSpjw1qSn//mn/My/2ZcdTAwMTLSXHUwMDBmV87NXHUwMDAy8Ut0kFx1MDAwN0b3KtAvwL2fae7l3Fx1MDAxNVx1MDAwZoP3yoLBO8czrye+jqk/2voj+f/Kl1wiksv6mND4XHUwMDFl6PMwTFxmXHUwMDA1mV1cdTAwMDToXHUwMDAyN01uIMmfJFF25udmNY4semv4py71np/kk8xcdTAwMTNcdTAwMTKRrVxco7nuwahdXHUwMDAykbPLIGNSfsSXXHUwMDE27f73MUFwh5qCLp5n5j/PLGKAtFx1MDAwMGyFkqz4iCCkx11cdTAwMDRx3EWMy3/PJpWlk8tKZlvbXHUwMDEw3rY8jSSAtNdiMoqseK9cdTAwMDB16WgsRpX17Tleb84r0bp/7HNQv/1cdTAwMTVcdTAwMWEyXHUwMDE5NCPe0GrkNVxuJHglp4j7XHUwMDExI9xe5rx+ePJWqVxyiWYqOu7W4/Furk8wUcghj1x1MDAxOClcdTAwMWTx/1VcdTAwMDNTJtAkiC5LM3SRji+A8lxcpDSIXHTdpUolRp1R4aC5XHUwMDFi8m91XHQ8XHUwMDBi/2uvXHTdj1x1MDAwZiFUXHUwMDEy9P0rV9eQXHJCXGYtZzmGV1x1MDAxNePz0aldvTTbnTl07mOAhMrA/J2rJ1CHZ+6Y6Ud37LY6P8aSLrVXz/bOI89cdTAwMTM9gdCsczf+3znwz6/4QYKIXHUwMDBiwG1cdTAwMDPsWq+YyFx1MDAxYkc79IFvmHZJm7lcdTAwMDf9W/5/e5glw9Iqplx1MDAwZdpcdTAwMDdq5bZG/fxcdTAwMWLf+PFcdTAwMDUwfJ1u2Vx1MDAxMubMRW9lhr7vQfy0MbRcdTAwMTI4sFx1MDAwMdaZXHUwMDE3OVxc7eC4XHUwMDE5hFx1MDAxY0pOZ96/OoU3R7AofDBcdTAwMGZcIq9v/W4j5lx1MDAxMFdG/tfajsJVKalxy1x1MDAxZlJmgI3e9++jQ+/nXHUwMDFhXGYzs73p8/d9rvTnm2hkcpm1uFx1MDAxZoJdoZtcdTAwMTQ8y45TiGHj0fqd3WNcdTAwMWbjZev7/JfGrGOTfTHb2ZszOdtwyDy4QcTvXHUwMDA0eP3jTDnGclx1MDAwM5tx3Ku2XHUwMDExSlx1MDAwNGbqcybQ2mbFlFx1MDAxOG721tSSYG4vs3RpgNc8wynkN2ssKJOpqSC/gjtcbv70QFx1MDAxNaR5XHUwMDE2zG9iik7TKoLbL6qTI8SMrWbu00GrW2yapJVcZuY5XCLGSFHUm2+g0kiwXHUwMDBmybm6JFx1MDAxNVx1MDAxMD6KVlx1MDAxMWtcdTAwMDNv3bFcdTAwMGVGbGfvioeqzjR2RFx1MDAxZCP+X3lVqrRcdTAwMTZGe1jTZ1x1MDAxMSGVLiVIxZBcdTAwMThcdTAwMWNIXHUwMDBiwK0kePnFo7fb/6/X1lx1MDAwMVx1MDAxY3KnakiC4Nf2jlpB3+lD+nLJw1x1MDAwNU125bJZpph8yHWELLn4tVx1MDAwNkBAvFx1MDAxZd/fosb875z3u/J/2j124Gtll7/le43ja5pSrtOto//mkbBcdTAwMGaD5mtcdTAwMGKXcutiXHRSr5toxD9jjIo0XHUwMDE3XHUwMDE0XHUwMDA20KGOcVDb9aFzh890/n3ZMf/w8L9y5J80ynejKIRcdTAwMDNFVdrvzFc2lVKmdoH2+DutvblzPv41O89g2JV/510q0lx1MDAxYZjdj4mD2ddBxOVcdTAwMWa9UcL/2leyn5XpI/+t1OKXT4TqQEopbHVcclx1MDAwN8N7Y9ZcdTAwMWRMwWgy49rcSlx1MDAwZfvtKVxukLJH5tHcYFxuT4forKo3rnbjNaRKO2Wn289cdTAwMDLG1X/Nhz20UFxi/qqTYtP+XHUwMDFklL+an67Wwb/XLPGM/qsr4lLst7NcdTAwMWGDq3iQXHUwMDE4/NtjXHUwMDEyXuRdWiu8opA82PBriV9Khi5cdTAwMTPlPEBcdTAwMDWyMH1cXKVcdTAwMDfKXHUwMDExJPWlpDXga33dwXiljDRhqrv8u15cdTAwMTI3VU+oTpCmu/3xRvdX4zVA8/23/TIjjv9dY+WMyW8vXHUwMDA0LFx1MDAxY8mQdpiLXHUwMDE553VHkj6q4rYlsfisXHUwMDE3ZFx1MDAwNWjKk1x1MDAwZT/xN6b1UN45hdo7IG9KUJbMVc0gZYQ4tvluX94gN9TVxKhcdTAwMDdzXHUwMDE125tcdTAwMWLKL1xiZ/7XM1Cb11B/o10wjzb7Pk5cclx1MDAxMlx1MDAwZqZPXHUwMDEyYT5+o3c4XHT/Pd/Pl3/tW5spR1x1MDAxOOE2fjQ1XHUwMDE1TTZTbtKJuXkmf/tLeJY1evlcYlx1MDAwM9+L7I1mIXJcdTAwMGbKIIJcZpSb+D2AI/p84tLFYnX83nt5q2yGhWKma1xuM+Tbf/OJ18SmJZe1XHUwMDAwi51YtkPm8eNcZrlbTfrfcMlIhVx1MDAxZi49ISszZMcsjlx1MDAxOOJjrp1cYoBWTKBkzp58XHUwMDBiKql0IbBCa+i8XHUwMDA2XHUwMDA29KQsXHUwMDE1bfyRe8T9q9MvI2itQK+u1c/Da8jyzMjqvzRUaUDu7lx1MDAxYzzQQ1x1MDAwZkl0sY55aSj0/9e5cFxu81x1MDAxZVhv7Ep1aFx1MDAwMJfNeGg/PEFcdTAwMWZ0iFwilENgXHUwMDBmXHTCmeNaXHUwMDE587/P2GXl72JcdTAwMTlwfD1s1iryj6vSRV6A4ZwnpTFY7ng0ny2l/1G3vLy+/6rpkyiL537GXHUwMDBmlefw0NjOVDM1lUxcdTAwMTBcdTAwMTaBW/q1ez5onFx1MDAxM4VcdTAwMTh5pKI2OLr0/YS4XHUwMDBlXHUwMDE5dt+8eElKxm44vyH8sqHET9tY+H/mffrY88bwiDra/Gd91/O3NHFcZtDUYahcdTAwMDMn2qtvp/p4zFRcdTAwMTZJjpjUXHUwMDBl8/GDXHUwMDA2ft3EJZ89vKUmbFHBTZao4FmLqv/GK/awJ6ZwSKrqzd95Wlx1MDAxMmOA7lx1MDAxZs/3XHUwMDEwXHUwMDAw5tdA2V+F/Flrry/FTIJcdTAwMTkuVimrVNx/c/lwXHUwMDEw6tIgrfpcdTAwMDJtXHUwMDE1MFxyOfmdXHUwMDFmrstcdTAwMTGsS6g3/4ZDhp0xXGaPtkxiroonfShcdTAwMDFOhXDePNTzM52yJVX8XHUwMDE0Zlx1MDAxMdDu0Fx1MDAwZqS2d4xEp1x1MDAxOXyAyIxcYoLiKCViS1xu+zxcIsknOW4lXHUwMDE3esiILFx1MDAwNDBzaIKk99nlL/+PXHUwMDA2scxccm4tinhcdTAwMWSsxu7ULzpL2Fx1MDAwZWR70lwiXHUwMDE27cdcdTAwMDBYMSwxgouFQJ+/3/crf1xcdGhe2YnD+dJcdTAwMTMtetxjUE6GO1x1MDAxY45QQfEoceZvXHUwMDE2XHRCXG4u26Ox27zs+khcdTAwMWORdYydbaaEfoxzt5Nv0Fx1MDAxZTvvXHUwMDFhkbHDuf2WLTNcdTAwMDclhqRf9DK8Rj1lknVcXE+JoVN0dFx1MDAxZLs10OhcdTAwMDYo0iBcdTAwMTC/hl9u/nxgsVx1MDAxNvrxK+Tu2KmnTu1LzyDyXHUwMDEx6Vx1MDAwZlx0iWTM/SOeI7/6qXvieuZnMVxm+7aEl/u+a4bss7JGOFwi/+D5x9RcYuL2y/G6XHUwMDE4Y1aWfIa28JJcdTAwMTbmqG+A71x1MDAxMs6Dpj1cdTAwMTEzXHUwMDAxMUzyXGbPuGN5RfGUXHUwMDAzskfmXHUwMDFijI2gOmlJv1x1MDAxY97ePd5cdTAwMWSD9ytL6izXKj65v/dDmHEgs8BcdTAwMTVcdTAwMThnbSy30GuzYE2UXHUwMDBianRh7eA8eN3uLZw+TC6xp60gQuFcdTAwMDBcdTAwMTmaNEKXIDNHxVx1MDAwYqWX4EL1jlCK11x1MDAwZcAggvOetU+9U53HXHUwMDFlVMWWh2CR8dVB4LJcdTAwMWHKjJM6qVx1MDAwMDh771x1MDAxZmVxj4/o375XZsR9i/vuqtr3eGAynzz6YKJcdTAwMTHJXHUwMDFiZepFj6WX2Fx1MDAxNJCphrSANXNcdTAwMTQ5X6OCeCSh9qv5j3BcdTAwMWNcdTAwMWa3LcjaXHUwMDBiOalX7lx1MDAwMkWHt1fRJ8n563twp/FV7LZdg869lo5cdTAwMTSRQJ2h9/e1+iPjwJp5aOvf9oS1pvm/fJhjko3mttW1Je3jmi+gXHUwMDE3XHUwMDAxvPBW5NUmIVOHW57dXHUwMDBmUa1cdTAwMTU70aM7/Fx1MDAxYVx1MDAwNcQk1eDKju1H2bv79Zs4wiDSOWtcdTAwMDA5RVopj+vXvoQrsFx1MDAwN1x1MDAxMbS09HmaPyhcbu5zPm+qfnTWl9OS51x1MDAxMlCJiWT54nh+rstmqDG12nWuvJphXHUwMDEwX5nFsm7UW5/sfMR2o1xyZP1cdTAwMTlk++VcbiUrXGIhY3rWq3SrtzBz8mQ79Et9vlx1MDAwMTSmYJpcdTAwMWRcdTAwMWHYyJn0glx1MDAwNGpRYJF0oiOynMBv+EvQ0Y3uW7pcdTAwMTdgp/ZcdTAwMDHPcUVcdTAwMTRcdTAwMTSgXHUwMDE3mI6NXHUwMDBmzNe+T3XunshcdTAwMTWA5NVcdTAwMDJo1yFcdTAwMDDCmovfyCXX56hcdTAwMWRn63hcdTAwMTfSvmq6KupakVx1MDAxNrOeqp08XGJ6TO9cdTAwMDVakeSnOCp+1CcqL1xmrriwVI9ysEdcdTAwMWTbTpJ5njeRwsarXHJcZoxUc1x1MDAxMPRcdTAwMTFcdTAwMTLQXHUwMDE19UDkXHUwMDBmjiBcdTAwMWEzjqSFNtuDXHUwMDA2NOk9l/lOsoym6Wx/qFx1MDAwM72JvLUv5lx0XHUwMDEyrtGMXHUwMDFjLK5+XHUwMDFmI3fpyykw+zCdXHUwMDA25ECBXHUwMDAwXCJzZNikVsLeIOLWe5wpprHWXHUwMDE4T5KkqFx1MDAxNUA6XHUwMDA2Zlx1MDAwZlx1MDAxNYXBs1x1MDAxZiEvUlxuw7NlWVfMXHUwMDA2dC1cdTAwMTXWVzAxzahcdTAwMWaBhDhcYnD0XHUwMDFi2vsxgiTO6X0k6Fx1MDAxZWLsy9Ry+bdX9WlkRlhcdTAwMTlcdTAwMWbxXG5cdTAwMGVTXHR1pOZuXHUwMDFk+IE2+nlcdTAwMWEwcHj4z/q5xUmuKOmjlDrvLYuovoHCf43azCuhj6bral9jpTfD5GBUWrFnmbOH7L3FsFx1MDAxN1x1MDAwMPxcdTAwMTJy/TGC76yiJXRcdTAwMTGPS5Akv1x1MDAxN0BI0MDH3aXda2aUhCdcdTAwMDB9uFx1MDAxOVxy1IzaQsXJ+HxbX4iSL4VR21wiv+dQvel2fpy1JFx1MDAxYpakOZdcdJZ7NTroXHUwMDE2XHUwMDFixWw1ZNjaeCzkiFdFXHUwMDA1StC+YOFZlCRcdTAwMDdMtyT+ifS+PsP9MVx1MDAwNJCeXHUwMDFjtPuEVERdw+xN1/HYVVA8Jj6FXHUwMDE3++k09KxGoKxyUVx1MDAwNlWgdmnq18L6cclQMdOiUJ+YuO+r6XLGY8tAd9iQjSRx7VZ106Momlx1MDAxNVxiglCPXHUwMDEzPX9cdTAwMWU7IZNotvqiSNM0yzZcdTAwMDSGsVxiWFx1MDAxZUPUMYg0pig2OTpZ62PJWlYyMFxmXHUwMDA0+5qkPrKaXHUwMDE0+7qeXHUwMDAwXFzMXHUwMDFhXHUwMDEyPEvkoKxAdJ9aZuS/vZ61XHUwMDE13lxuJ/lcdTAwMWaAkDSuyUz9US6VnbI83aumXHK9Plx0XHUwMDFkOd/JhJGucFxyelx1MDAxZJutXlx1MDAxMdwgSSSNWbVImoCGvzxcXHRcYnhBJzlIKbD0gTQoXHUwMDEwpmCQ0X+iXHUwMDFib+5f7lxu+1xiOihcdFx1MDAwMoJmW+9W1Co3ilx1MDAwN5tcdTAwMTCRUvD1kOrA2PZcIstzek/QLtrzzychP/RzT1x1MDAwNkbhXHUwMDAzXHUwMDFjXHUwMDAz4+jUsWUsZmONr2N+XHUwMDE2nFx1MDAwMFBZxqhcdTAwMGZcdTAwMTSKclKrO71WXHJ/70Ns5mfZcXuhuzOZps9niHJpRHMyQFxcsk9cdTAwMWS9dbRQie7K7dfVXHUwMDFipDMluyOC60licXhk49Y1ltzv3lx1MDAwNOPtjDYvXHUwMDA1ufa9iCZ1bYRcdTAwMWVJqECax7FIXHUwMDFlZCH9ZL7Ps2d0c+/q+sJcdTAwMTR3fmOy6kpsmS9cdTAwMWLx3Mu+5zQ99Vx1MDAwNoiOsnKhrCnRXHUwMDBiXHUwMDBl0qpgXG5cdTAwMTBcdTAwMDQgidbW1nmelYGezVx1MDAxM3f2Mp6R6NJPIO1H482yJ/xNUJBEXHUwMDAw1DRcdTAwMGZKq0/1VWKu+qqjMNK1kadCVcjEps7j8bWygql9ejFcdTAwMDZcdTAwMDFcdTAwMWRQMFxmI+5cdTAwMWW8v29Eqlwi1ZlvXCJ8le/6XHUwMDFjXHUwMDAxXHUwMDA2I1x1MDAxN7bN9rdV0cNcdTAwMGKmz290fV8ncsVW61x1MDAwNoLFsH97Ocw7ZvpBt0K2iLu17jXGIXTmvX0kbO7y9N5Ov/HReH8gayZcdTAwMDLJXHUwMDBmXGa0h1GCXHUwMDAwXZJfUFAjgFxc/+6zp0ay2VxmpTs+3NLnJ0uqOXZcdTAwMTBUWG1Gm6bjvNHq9/3DzE2xcpOL7sZcdTAwMWNcdTAwMTmqp6qWZcaLXGZcdTAwMDVJmtm92PUk21x1MDAxZMvCsiFySCPGYeylbc+jM6solFx1MDAxZVHfsFx1MDAwNTj1xTFY/XnLzSPDXGKh4Ef5XHUwMDEwaO3G+cKPYfJcdTAwMTb5Zl9cdTAwMTaWoVx1MDAxZHK394p4XHUwMDE5aLGFnaVcdTAwMTWhKNVi6udcdTAwMTZcdFx1MDAwMp9cXPqeXHUwMDBmY9ZcdTAwMWSbjz/khVxcZXFx3y/wKvc3/Fx1MDAwNOlcdTAwMWX5Xbvi2pSxrdF9zM031M9cdTAwMTNusFx1MDAxM1x1MDAwNanzZLzblz9uXHUwMDAyPtedk6SnXHUwMDE3wGpcIsLxolx1MDAxMd9cdTAwMGY00715gyRmXHUwMDEwjMn5vu9OoqM5VOJcdTAwMGa4O8FuozR4Nn0uaJvFaOtn776Ay2tcdFfY8TduZJU7P32Pnlx1MDAxN/BpU1SYXHUwMDExZ/ZcdTAwMTm03/fd1VxcY1YjXG6Wi1x1MDAxY7jO0HpcdTAwMWRquVx1MDAwZlE56HjI5Vx1MDAxN61vRI1xcs3892vmPGHkXHUwMDE4qZtD30pZ8pGfUbHmXHUwMDEz1vBYt8CR0MZr4uNIOHlcdTAwMTOCasBK4G+CXHUwMDBmklndyH1cdTAwMTIzR2hQ3LSCb5/LuZhEgoDxcPibXuxcdTAwMTDntCCDXG6c6luJethfboRIwb1vb9B4Ylx1MDAxZFjA4Vxcok/EWZ2cdihw1ciJXHUwMDE5XHUwMDE3tHvV/lxixzP+ilRcdTAwMDbsjtiXsa5WyETfXHUwMDEwY3l4lNj1vVx1MDAxNVxur05cdTAwMTaEXHUwMDAwfb+jVKBCdzDRg1x1MDAwNuje4Eu3tFx1MDAwM1x1MDAxMr9gQFxm3rRgXFyfj+Crz1x1MDAxN1x1MDAwNuD61Z+IN1x1MDAwNkHge0ZcdTAwMDHi91x1MDAwMVx1MDAxONFAdWY41rlyylx1MDAxZZ4mqTeIJ/NwlrJ9VEOqSzstmp/Uglj9XYlYO9upXWfbmH7fRaKYtpJFXHUwMDBms2lFZFx1MDAxM8Atw2Bwyq3bsE/w17aI9Hi+6Vx1MDAwNXjCM/FSsyt3ScT0P11yXHUwMDFhKFFrxTI5bJ5nXHUwMDE5jJkp9kTjW6csZHidZWtdJ1k1crNcdTAwMTHbgzGj8npiJLIofFx1MDAwM1XDZjBcdTAwMGZcdTAwMDBJ9+TiYPzSnni35mQ5sFx1MDAwMKx88pf9KFx1MDAxNqBcdTAwMDf7cn5cdTAwMDH4Kk1f4ktiYEFsgUFJI570LLBU1YtcdTAwMWKINyfW4Fx1MDAwZahhl1e083WgtIOA85K5PNLwdHBmXGIgMyODWP5cdTAwMGKUXHUwMDE0bypl36FoXHUwMDEwqlx1MDAxY7JcdTAwMDKgQaI7mVx1MDAwN3t+tmF8fejReqNvXHUwMDEy2MLeXdNaTbeWzIEnhGOmkL2ufFx1MDAwNdrvMMl9/lx1MDAwNV/St1x1MDAxNGiRS1x1MDAxOXKoXHUwMDA2dYM4X8KPeLgtl1x1MDAxMSzh/3mJnMK5XHUwMDE1w1x1MDAxZqJfsqSPOMM35YqkzDooTldcdTAwMTFcdTAwMDDts6J7YHuc9ENcdTAwMTEk/Iq0XHRjdOBYYzX9rjZqzOJyrsFMR97UxsFDrY08XG5Iw34wyzeIs4Pm76zN/S6TPFpcdTAwMDDDayVfeGnktnh3m//Gek+ZvtrSXHSVm5kwa7TfIzNB8lCJLKbJIGJcdTAwMDNJsPx8M9tlKDSQalbCLFx1MDAxZT5eS1x1MDAxNuW/4U67V/0xS3JcdTAwMTdDui3A/OFlx6BcdTAwMTe3Sc6TJ8mXKlx1MDAxOVwiXHUwMDAwWbfZyEuhSjliX4xcdTAwMGKVXHUwMDFiyUsgfmxcdTAwMWbryyZ2XHUwMDBmQPxVhf77rKNccta+jZDuclNxY8dZ7KPPJ6FcdTAwMDdWh+/OxFxitfO+svJbqNtiV3N78NloZjhcdK/vzKrB8Vb1XHUwMDAwXHUwMDA3IydFXHTo2sVrfqWXflx1MDAwZllfgFx1MDAxZrRguddDjimkRT8sXHUwMDFhYymt4kKBj4NcdTAwMGWRiNEjt1Yrrko2JdNuRCZ+79WsWpBcdTAwMDJBUKZpzFxci0V9cKjZqKarKGjU89dLfS8yy0dcdTAwMDb48DVcdTAwMTCQ31x1MDAxYY1BUn9cdTAwMThQxXjfr77zXGZzpcvw0FBcdTAwMWQv6nvZyZdOk2+FROdMisPpfn2jqvXtfmMqXHUwMDE3qV/zxLa6oIBQzrjIJGygXHUwMDEzPfa+e+CRW0CB7tRcYlM5o6KTR5hai1x1MDAwZlatW5h34zf54C0xU3qNRZIqgehgXHUwMDAxT7hcIiijXHUwMDAzt3OQI+o9T4kt9sDdVFx1MDAxNVx1MDAxM3GvXHUwMDA3XHUwMDEwUsI5uXiMn9BcdTAwMWVSXCKZtnQg5lx1MDAwM+kmM/hQRKmNilx1MDAwZlx1MDAxNkiWZI7aflx1MDAxNJpccsGPXHUwMDE4gjRztYxcdTAwMDElmig2kLXfXHUwMDA1QCiIXHUwMDE1Uc15oM5l1Dm7vLCD6+3P37H4eUGQxjD9JFP44UK6WKFD8rnfQ0KZaFx1MDAwNmthwFx1MDAwNGikMDLBo2rQUK1ocrnvf1QxXHUwMDA04cRcdTAwMWNI//35Lo6nzFnvRd+RXHUwMDEzXHUwMDA35Fx1MDAxZCVz1Hy6qt91+ZXtjP6ydnmlq1dBj4NEoqWw7Tu6YtPkfV9cdTAwMTB5njXdltGOevCD22dcdTAwMWVLhI5cdTAwMTDWu1q68lx1MDAxYkCCicnUgNWfmcRR8OHrTHDxXHUwMDFlcZTfvtKuq2Z04SW1MlI4u1x1MDAxMNKY9alWXHUwMDFifpbMXoOqrIxfT51cdTAwMDdcdTAwMTBI88uRX+VcdTAwMDPKLo6gfd/LfIFcdTAwMTlcdTAwMDaI493ZXHUwMDBlm2DKtDO3L01fQprCOb26q1/DVEL52vP3K1x1MDAwNNPXXHUwMDA3XHUwMDAyqpJcdTAwMDaY2U7c2lx1MDAwNMpcdTAwMWGuhLff+J7Kb7ph64U+XHUwMDEy3OJ7p5P5jmqbkVx1MDAxOfdBqKnRJeToliX3iizBXCLUjpyubXNcdTAwMWSyp07ymytcdTAwMWW29PdEXoq22Vx1MDAxYzpZdyvAsFxmXHUwMDEym2fVnkFcdTAwMTOXoVPQmYHgXHUwMDA2gvSWXHUwMDAz9N1XX/TbNPM0cXxcdTAwMTFcYjyJXHKMXG5qXHUwMDEyUTPL9vpC5jZzVY/24LaDXHUwMDAwQGnr4XdcdTAwMTNJXHUwMDFi0sv/olwit6cqXHUwMDAxnuiRPrxDKKVRzKXloZ/0r7tCJ1x1MDAxM/GzOM1cdTAwMDS9UNRcdTAwMDHwXHUwMDFkzORcdTAwMTdcdTAwMGXkfsCe0qw4jfKgw02CZr+9XHUwMDE4YNZcdTAwMWI0kWeZzr/JXCIo+pfaMnBcdTAwMDFCPJldJSPKVa1KoScyzVCA9VTexYztpcTpKk5cblBKUFx1MDAwZVxyplGUZcdcdTAwMTJRXHUwMDE2Izkn1J1U9ujTJvk6RqRxxjflhaaC6uHFPjfOXHUwMDE3XHUwMDAzTkPzlrOhSLA7tJD7ti2LuYP8w4RJKcrxMEUuklnNgCdKXo/PTG51XHUwMDEwXHUwMDA10S2DpPpTxkN0Xz5h7Y9opUFfv0hqXHUwMDE55lx1MDAwNzkqdY1ocGPTV1lE95vByzV/Tyq5rutcdTAwMTZPPlx1MDAxNDLUqaY+XHUwMDBlJjC4tVeWXHUwMDExjHFcZlxutqjNW1x1MDAwZlx1MDAwYuChz0dcdTAwMDe+YY2T+oJcdTAwMDcmvVVCXHUwMDAzKFx1MDAwZWe9+mAgKYdwgYTaN66yXHUwMDEzQtRh0Vx1MDAwMPS7aMBXnkSeTjpqQVq4alx1MDAxZjZccnrx51x0y2vhplx1MDAxMKuaLogkpu6r5T/EsSl9uUd22ZD0Wdg0gzi9XHUwMDExqOa62/eV5T7xYDxhXHUwMDE5XHUwMDAxOs59XHUwMDEy9CdwwVx0SO9cdTAwMTlEf8TaI76PvzJoXHUwMDFj6nRB6rBkrGu+XHUwMDE2qT3B3kxPdFx1MDAxMCBgXHUwMDAxZH7mjVx1MDAxYjrQ7lTHflx1MDAwMiBn5M9BXHUwMDBiXHUwMDAwZ9XA9Vx1MDAwNSkkdcAocqFLvrSTRm27tY5cdTAwMWY8XHUwMDEwwyz9MKxcdTAwMWO6L2bjqFx1MDAwNIf7XHUwMDA0ne9cdTAwMGV7l+CqXHUwMDE3YGXXzfuVcOz15U1ZQFKWXHUwMDE1S1x1MDAwMbk35ZZEmsLOfc3pXHUwMDA3u1x1MDAxYvbEXHUwMDFiRTfUajlcdTAwMWVGKWOKXt7Ko5GS+CtcdTAwMGXMXHUwMDEw2nJaXGJcdTAwMTfyXHUwMDEw071cXIfH8yTriWPf8nNcdTAwMWVTdLzPXHUwMDEzLCv07DmNQy2mtVlcdTAwMTPRkr2u641cdTAwMGL1tKfD/TUxXHUwMDBiOjJ9e+i3lqDTLVx1MDAwNaSAxa9PxOJcdTAwMTf/bqVTT0DgXHRcIupRdm+JWWKLczkleuSWnslcdTAwMDUk7Kx4kWhv5JiyXGb+bXvSXTInJZdcdTAwMDNcdTAwMTiEYSub25tcdTAwMDL1T8HTUm/rVq09wPCVWlx1MDAwMUtIZI0pTYhMWedMXHUwMDA3VFx1MDAwMFx1MDAxY69mXHUwMDEyM2kw1lx1MDAxZY7Y51xc+yZcdTAwMTX0s0Pe4Tyh7KHvXHUwMDBmxrAnlVwiXHUwMDEyb1Y4V8Ksfj44kk9cdTAwMDNDyFx0qv9mdcp6XHUwMDE0X74xOWqXXHUwMDAyuFx1MDAxMuxcdTAwMWYrXHUwMDA3dyVATj2nZLvDlP/D1nksx6p0afSBXHUwMDE44N1cdTAwMTDvPVx1MDAxNGZWeG9cbs/TN/q7oyP63laEJkdHJYrKvb+1koQ0ci3JM7x0S2RcdTAwMTjuXHUwMDE4KVaw68nVZ3m/v2xcdTAwMTeywKp8KfXlSFx1MDAxM7XHq9JNXHUwMDA1ZdypdFJcdTAwMTFYtt9kdlx0eTpmjliv64pcIuWM00whXHUwMDE1j3AwuFwiMGFcdTAwMWVBg3u9UG/AlL48XHUwMDA2oPBcdTAwMGLUt8X7/kPRsJojsWh7XHUwMDAxRNGmd8dcdTAwMTD79oCWXCLxuW6dXHUwMDAzXHUwMDE4/mawv3KGoLttZ6VcdTAwMDe4YOpcdTAwMWY0ePe/TECCMd85XHUwMDEy9UtcdTAwMDd7XHUwMDA3XHUwMDFljFx1MDAxZNHF6q6M5soxqEBcdTAwMDFazmhcdTAwMDLg5+/BnibaLtXrXmvpXHUwMDFlfTY16UQjrFaBS8ZlxVx1MDAxYSdcdOaaXG5cdTAwMGX1b7umn/bmYSuCLVYho+252e9cdTAwMTXLhzmyXHUwMDFj/vDdXHUwMDAz0lx1MDAwM1ximotcdTAwMGJjXHUwMDA191x1MDAxOFLIe1x1MDAwMGGrcOVcdTAwMWPrmetcXIu9YFx1MDAwNalnWvFcdTAwMWPQ/PZRfvVYJrP3XHIqRlx0cszqrTGHtFk9y1x1MDAwNNBZsTfSlO/aXHT5XHUwMDFiSzt5YTmjXGbTxFxcYnVaTbJcdTAwMGKCMm15STI4KPFcdTAwMTZMiL9resZx61DoXG5cdTAwMGXzf76lWK5cdTAwMTRcdTAwMGZcdTAwMTKsXGZHXt41LzPswjWNIFx1MDAxN1JcdG56ttdVMoB9XFzO4kXdIFx1MDAwZZjeXHUwMDE2XHUwMDE2uO+nJa9u96B8N6hiqz5cYlx1MDAwNC4yKaxv3f9cIjBcdTAwMWH0xF/XjYNpnv7dLoA342uMe/4t6XwjjyNvdzSlxWVdUVOQivczdi5cdTAwMDKvXj9cdTAwMDZkc1x1MDAwNWFcdTAwMDRZz+jzlN9cdTAwMWZSKeSbmvtcdTAwMWGtaKqzeFx1MDAxYiA/tbVcdTAwMDMg0uzaYt2S8q91iHSSLUBAXGKdgKpE5S/ifuHBfiU5l1/ihKnYrGdcbj1etjtcdTAwMWTfqPqLqkGQcml2aFjzXHUwMDBlXHUwMDEwXHUwMDFktfhjbFxiftQ+QunqMD5cdTAwMTWjeHDgiEZhXHUwMDE4XGJvmZwxmWKE9mXcuvBe8Wtlu46Fr21XS8wrpGe3jX1JPGc+8TiqtqeYnU+fju6TTH5g5U5cdTAwMTLY2+u22S6TOc+LvnM6XHUwMDFjk84zMKvaY2lcdTAwMDT8XHUwMDFiJ3VcdTAwMTCdlojr1JBcdTAwMTdq2nmYgplVq92CXHUwMDFhXCJCbOuQemF4q9acJ/dArFFptzZtM3YmXHUwMDEzZ1x1MDAwMVx1MDAwNbV5Xlx1MDAxM6JOr/JRoJOHZWV5NGeLXG7H+vF0lHwqkDnWWixcbkh1XHUwMDFmKlp3RZUm11x1MDAwNJ44p99cdTAwMTK9r/p4o9nKQFx1MDAxNLtcdTAwMDW9P1BjL1n+xf2pYuk6PFxc9uIuUPBcdTAwMDGFNtyTI5NcdTAwMDZcYkMvyFx1MDAxZclcdTAwMTFNO+TFqqqaY1x1MDAwYl3Y135JXHUwMDFhXHLqNJR/vHH+UEHIwKAjSfXNXHUwMDE0XHUwMDEyoeldXHUwMDFjbbAsXHUwMDBiuXbPMEo4fOPHuyNcdTAwMWS6lVx1MDAwNbBQXHUwMDAxXG5cdTAwMDWxrqYomZbW8GOS0NxcdTAwMTZicPWHPv/oXHUwMDE1cMBkJJpSwUMhZ3ZdXHUwMDFlbDf1fL+dZ5RLuodcdTAwMTdkIGmXXuGGkW9BXHUwMDFhXG6iyHXCUa9QfCo/XHUwMDBiXFzIRVxcXHUwMDAzxvxcdTAwMGLo31x1MDAwZlx1MDAwM0jJSeLbty5E9XBcdTAwMWb62kb8u8xcdTAwMGI0/1x1MDAxZZdcdTAwMWSst1xcXHTbnInJrZVFXHUwMDAyINRG2Vx1MDAwN1x1MDAwYtqidzLQ+npcdTAwMDTka7JcdTAwMDdx0kFcdTAwMWHafVx1MDAwMjWvaFx1MDAxOXJkmu20s5xR5pLoXHUwMDBlt8q03vLOXSj/zOJTOb1OYYqzXHUwMDA1f6ztTnZm9Vx1MDAwYlFklPxwXGL2d1xydtjCLU9R7P2Dnmpnu1x00p65geql8PsulXpMzeajmFx1MDAwZt7VXHUwMDAwSFx1MDAxNvJcdTAwMDFcdTAwMWFBnqy78Fx1MDAxMsrsXHUwMDEz+Fx1MDAxY23+sVx1MDAxZnlpXHUwMDAxuXCQ8ZfV6/2Vg61cdTAwMDVqXHUwMDAwWTGabMq3rHTbP8jIIzd6Z4GjLHSKTihQzPffw5Pp1i2TSTNkzPfoQ8p5btHdjJLQ5HIpmstldFCbrVS/71x1MDAwNN34NyUp6mrJJ1x1MDAwNXAkxlx08m3qTVx1MDAwNeHUXHUwMDAyXHUwMDFm5bpa9u5XnYi3Vzx9nPzMXHUwMDAxP5eRI3o/J9BS3CXyndP1XHUwMDFhmoDig8P79j2hs0Rx2tNErCRcdTAwMWXwjCbgXG7hIL6ZMEVRMHs0qt9Eamc8geVcdTAwMWEh+Me7Ld5ZU21wSGNcdTAwMGVN9iOft+yfi4VrvGr3XHSUb1YgYDWbwsUh9yhcdTAwMDHBl2Lqu7Zm/dCjmNpVXstcdTAwMWHh7oTusez3d1x1MDAwNW1QPUWotVx1MDAxN8mP3SF4XHUwMDEw7ZXoYN9WV1x1MDAxZODv88OXtKHk2cpovFx1MDAxZNH2xVx1MDAxMYVcdTAwMGVYKzhcdTAwMTOuXHUwMDBmN1x1MDAxYaut0tD0wPpWJFx1MDAxNFx1MDAxN5B4rjKOkkskXHUwMDFmwWtaWqv0gGtcXPhSuYLqyiPMQJfvOUtXb26bNVx1MDAxY1xibG+2zudLq02Xplx1MDAxZLrtKtk8ZEi1vnQzhVDGXHUwMDA1Xlx1MDAwZaFJgmK/I6Su1KnL91xyhFx1MDAxYVx1MDAwMYWPIECC4Ipv+750s2uYSuqfLCPZy33q2nsuXHUwMDAxWmQ+yqtFJ4jexdeBaKw/MXxcdTAwMTa+uFx1MDAxZdlcbi7o6GpjOFwiJ5ZcdTAwMDEsXGalXHUwMDFiP0ecKvJqOVx1MDAxZipcdTAwMTDsXHUwMDAz+X2BlCTgMiFEX1TYUlxyyTuZRUx1MLPgvtmmta02YmF+ZH9cdTAwMDIpzYRhLlx1MDAxZHLWg0PcWFx1MDAwYmVN+j5cZlx0RdFcYi2/jUhSky66XHUwMDE3Sp9jc8+rNL31qtRb0L2j7EFR08wq1UlcdTAwMWamRPMrdVx1MDAxZmVYXCJcZn1TXHUwMDEwfjApyJTt0p3eKDm+o9VMgm1cdTAwMDBSwd16XHUwMDE1XHUwMDFhUlx1MDAwNLPa9lZCbS6D48TBXHUwMDFiWW67osm9TG5cdTAwMDN7tOVcdTAwMDAn717n4lx1MDAwYm2hTUiNn/c4Rlx1MDAxNNPF2LxcdTAwMTjO6G7iqlx1MDAxZj5/RFx1MDAxMFwio77mQM6C7Y+eINEmWCPqqalcdTAwMDLymdnAXHUwMDExSMMoXHUwMDA1J2l1cKtUZlD7XHUwMDExWqDHxitmOPvNxlx1MDAxZoZcblwiqPRcdTAwMTk4UJFcdTAwMTf9sOn+tMB5gUCs0PQj2dtcdTAwMWTQeDaavrvGV4OcXHUwMDE04UglYFJdcHVs6oZPVeKFXHUwMDA1SExSpsh0XHUwMDEyMFx002SHw8/r4OHhQylcdTAwMTmQXHUwMDFkeurtlpBvXHUwMDA2/t/pqr/vr1owrO04q9/9JnVHXHUwMDFkUW/OTSCY39x8QTv4LDd1bt+VxOFW86t9/Xx+XHUwMDA1gZAzjstW3Fx1MDAxOJPvx93lO22peeh/7pRcdTAwMDG2pF1HMTpcdTAwMWVqstebK9fYj35cdTAwMWKJmzz8s0GJJMEsNexRr/Ho/fxQXHUwMDA02TUw8kdSpYCbbd2IRKY39yk0R8tcdTAwMTSTy2OlJcNeXzZcYpFcdTAwMDb+SVxubedbas5tvFx1MDAxMVx1MDAwNFx0+zhKXHUwMDA3KFx1MDAwZtWs4f55OqcvvCeJ75ur1kvOfmlZSI1Tr6vXpi2IQDH4XHUwMDA34av81fObkbQvxy89VmfKkrlhTdB1f9ZSXHUwMDA1uE3rNahZUED7QYDvT1x1MDAxZjA6Ue7qXHUwMDA1jFZGtlx1MDAwMlx1MDAwNI/wRDzBS+3xxj35RmpcdTAwMTDXwVS9nXnyIZORqt/OOIO6XHTSrpBcdTAwMTRe6sbTP7ksozAkmJxcIpwuJSuh8rPJTn3oOUVbXqLUUVxihk61OfOFXHUwMDEyk4I6Miu+L3N+byRgrPo48eZvVlx1MDAwMoBw98FGTzrsXHUwMDE1gjRmw+WpkbvO2Fx1MDAwM893xoF+3y/YkcbcQZzm9JTuZGBVgVnVXXXpNJuTu3PhXHUwMDE1dGyTbt2y8ilaXHUwMDAziVasRynfj9x8XHUwMDE4f1x1MDAwM1x1MDAwNyUm0Gfv0Vx1MDAxNLFaXaasilx1MDAwZcqow5bozTzo7cnb86lLX2h4uZN6XHUwMDAxXHUwMDA2XHUwMDE3qTdBXHUwMDAy/mWcRnnZXGbtrI2tss6nTtmWL9VYNKBWXHUwMDExSyaA35RH53+7NuhKLNFcXNssO73MXHUwMDE1aO48SLwjgEjsXHUwMDE1YSH484kkr3NcdTAwMWHlXHUwMDEyXdMoXHUwMDEx27NqL/KgqFx1MDAwNb6L82qnYbdcdTAwMTgrOSqNouPIs7yjv91MMO2xj2LlPkD2VY78xJpOmCYrMZHqXHRFwUKF6uPQdO387VWwx29cdTAwMTQt1+skgaJcXLr4XHUwMDAzY8VcZlCq8Yhhpb3oXHUwMDAyyllcdTAwMGLqfVujJ6n09mmbhmfk1s+kuyE9SKKS+6yRoF9fpV1cYlx1MDAwZW1vkVx1MDAxOVx1MDAxZl1cdTAwMDBcdTAwMTTRttD2lcWjXHUwMDA0z7dhv5FoXHUwMDE1Qr7YXHUwMDA0feFcdTAwMTeOXCLoUdDm/WRcdTAwMDGLP6+wXHUwMDA1XHUwMDFj/D0nXHUwMDE58IKpxdFcdTAwMWRMM2L31SlcdTAwMTadXHUwMDAyQHUxPk1a2SmrVFnHuTJ0ylx1MDAxNFx1MDAxN9O/xq+hcJ9/XTHbw3Jw1y+HXHUwMDEz/pif8INPOs5BemBcdTAwMTel85Il//xcdTAwMWE7w6koTPzeXHUwMDA2yDit2sliSlxi8Vx1MDAwMfqMpm4ycnG+zH/Kglx1MDAxMOuT4lx0jN0lxMOMM/dyV8KMXHUwMDBi/MtcdTAwMDem0vDYblx1MDAxNC3HXHUwMDEzgf+GM5wm6yZQZYG320GvjVx1MDAwNViUhzxcdTAwMWZr1Fx1MDAxY7PRqubjWMz261x1MDAwMcp9tNpUU+cl7dTaUe3yPFx1MDAwMkJcdTAwMDZzbL5rYEXpd5TTXHUwMDA3XHUwMDFjjzQmszN8XHUwMDAyYP1cdTAwMDIyklx1MDAxZlx1MDAxNp+8XGaPTuD2NlxiXHUwMDEwejNcdTAwMDfIgKt4Slx1MDAwNFx0qH2niZAkx+A9t02F/O0oXHUwMDA3I+V7JmgwXHUwMDFl8zXjwSid81x1MDAxNHi+KFxytq8t/lpcdTAwMWFBl46/XHUwMDAzq5NNSW34s8nf3nulXCLyd/2LzXtm5uqGYsOjXHUwMDEwQsVvPtrQ1OzFWzdDSYwpuJlcIipcdTAwMTT/iO6beVx1MDAxMk2iR1x1MDAxOYhcdTAwMDTFVEiLVe2oXG6+3EoqpYnGzHjuJZ3rrdlnqvFcdTAwMWatns+10r+zXHUwMDE33Dw3XHUwMDFhVcGK68yg8NfmopdcYr2ZS1x1MDAxYWNr0D7aXHUwMDE5XFwwNcRRrchSiy5UlLiiS4draq3+qFxmNlvtlXNfJcLy4nXyTPlyqvp1wJtV7fc4x8H6Sq491elUQ+43eWT0kqnNNO3yOP2Cgn9/9368Q61TreVbXHUwMDAwJlPWltoo7lxyxF/F2Tw3uSbV15yuy11BL38tkKBLglxueMac7ih0X3PvhZtcdTAwMTNaIcyO0lx1MDAxNPSKaPRcZpb5392ktlx1MDAwNrGjMlCvu946yVQ4aY/T+FHfXHUwMDEz1o7OyXVmXHUwMDFlm5p4XHUwMDE01OL9TXrhwNK3tFx1MDAxZHJiXHUwMDEwXHUwMDE1pUtcdTAwMDNzM+Z4NTNcdTAwMTlMXHUwMDFiR1p5jvPQIVefXdjN1MXQplwi2/nyUqGD4UEnXz9YfuSEc0yjeN2C7p06buF0eOVydlWb79rpkft6UsLQgDH0qltnXFy2vldcdTAwMTFLuJy6M6otp1lbU9tAiymeXHUwMDE0UESyzVx1MDAwMiiYWK9513ul28h0xd2VK1widsLFTOxcdTAwMTjYPJZcdTAwMDUhfLU48CO09fH2XHUwMDE0mfyZMcqNhrL1cJyI+cuXR+NcdTAwMDKSvMb3V3NcdTAwMGLn4C4uu97mXGbMw11Kz9XRlJpqiYrUsSVOOTZNXGYypVg2XHUwMDFhXHUwMDA1J+2G02RkXHUwMDE5ulxyp4ToXHUwMDEyz6doXHUwMDFlpGVb4KPrNDmoh1wiXHUwMDAx5FhcdTAwMTaRXHUwMDFlkVwiOtqalWXl0DP15Fx1MDAwNixcdTAwMWE3cyB5/1SQN1x1MDAxY1x1MDAxY8WDzP1bXHUwMDE5uH/f8yfE9/SX1qde/Sbv71x1MDAxYYD++2l+3TAxzDwtJF6UL3l9nFx1MDAxOMIq/eRXkIfkQ0Drr++dRbU1mE0/XHUwMDAwgqJynaZj10XIXCKU1oa+/c6whzRcdTAwMDXasoDBXHUwMDEyqcj3kD/yRkLia3U/evq17eOBP72OjmOLwmNcdTAwMWSrrNg2sNxpci/C5klcdTAwMDOC1C10N8pcdTAwMTjx+Vx1MDAwYrxXb7GKy9dcdTAwMDfHZc56mFx1MDAxOYJjr1HzXHUwMDAxv3pQXHUwMDEwoEhOhdVcdTAwMTIkqFxyeYTd4pJjVlx1MDAxMs91uur1sqkp6katXGZXXHUwMDA0OCbuWFdAb2lrhERcdTAwMTjYXHUwMDE4lUtbsaCXv9Onm7tcdTAwMGZSXHUwMDEw7lx1MDAxNGT1y1x1MDAxOLys+Vx1MDAxNibv2ofjwcWdPCR9sJhBNZYoOiVcdTAwMTLONiW7kmWHmStYpefkm6vGVojJYESPi2b0bpCD2tfw9Gkg7atXvlx1MDAxMP9tNIpcdTAwMGJcdTAwMTNKntVFXHUwMDE58G17Qjq21NySjq7mtGrppFx1MDAxOVx1MDAxZWX6+Vx1MDAwNMdcXLy5d8rLR1Y5XHJcdTAwMTBcdTAwMDSvs1x1MDAwZlnJRsBcdTAwMTjH2ddHTdEkp4myMWkjr7wrSF08XHUwMDEzlr+nWVftqmj8cfA2ZCB+XFyo8nt+KGKdhaK5+XMygHtcdTAwMTE5I7I+mcvZXFxcdTAwMWJul2L+lDzfZsaBUah2qknsmcxcdTAwMTRcdTAwMTWY/82KfPp70lx1MDAwNZAslPNMNeDSoO45tbnYx9i3k67WpIe3tr+Cfuf9zFx1MDAwNFx1MDAwZlx1MDAwZcc2VsNgzpTPaya9XHUwMDE2si4srFahzCuSpOjjXHUwMDA323S/PqBcdTAwMDSZQ0D5Jlx1MDAwMFx1MDAxNFCaNOBtOomr8UptNI1cdTAwMTRcdTAwMTe/61x1MDAwYuWegsdcdTAwMWJcdTAwMTSIT3WFXHUwMDBm8cilaVhH7Yn2bFg9x1x1MDAwMbBcdTAwMDCB0jhJoC/iXHUwMDE0OlBFl5o8tVx1MDAxMSZOXGLh1zR68y46Klx1MDAwMWA2OdHvmHH/nnU5YqA8iSY6ZIiCRu59K1nuSdvbnrUl4OJcdTAwMTNF2TZcdTAwMGUyqMrdrSvCXHUwMDEzXWy7jJUlXuJcdTAwMWS8Z5YtnUdcdTAwMWNcclx1MDAxMKpcdTAwMDGxiWb3IWRcdTAwMDMu74ThqSMgT/WENOpqdINkmzOx8UqeXHRgVsNcdTAwMDP4aVRcclx1MDAxZfDtpX+LnjCy4nt6VN1cdTAwMGJeRPh6XqZcdTAwMTe5XHRcdTAwMDP62Prb1KpihF5wXnvuXHUwMDE1tbXlhIjOf07yeUODMVx1MDAwMs2dIcRcdTAwMTn+d3N+XHUwMDA0gN9OO1RcdTAwMTXGXGZsUIqf/sJcXM/grFx1MDAxOeb/5lImZWDqLqCDdlx1MDAxM1x1MDAxYyV3KCFcdTAwMTZyaWQt/Lo/dVx1MDAwN3nnd9POdvJq3rnEXHUwMDFhnb/9R9cjXHUwMDE2bVx1MDAxMKRcdTAwMGVcdTAwMWKqTkfTo1x1MDAxZST83byc+uj4S8m23UWRRdE0bcvf8TJ9lJJcdTAwMGW8ryZcdTAwMDSs8Vx1MDAwNodk0d1cdTAwMGKRhFx1MDAxZaq22cNZXHR7uVH71dqfQnWzSP1cdTAwMDRPUVpJgTpreduNMdltkZP0qIM72WOBkixOLqRA9tx22IiqYKqbXFyWklx1MDAxZZ1cdTAwMTfHXHUwMDEzw0m/XHUwMDAzgH1Gs4B8SfjA8j7tTfDy9Vx1MDAwZudk2/iaqlx1MDAxMDLiZpyAyKU/hVx1MDAxYtLOcVx1MDAxNVwic378/Vx1MDAxZVx1MDAwM3/17HdTu7/pXHUwMDEx0W6RqltcdTAwMGVdXHUwMDEwIMqQMcNcdTAwMTQyV9nB2i32xaiEtOq8ha+wuq2F04F0hFacUHIhpp1Y4Xa5uGlxkZMr0Vx1MDAxY1x1MDAwN1vTqnmqWdZtN0fPYjOIK7E6QFx1MDAxNFmB/ThcdTAwMWVcXGDHlWBcdTAwMGKSZ71cdTAwMWFUf9PHXHSmVJglRVx1MDAxMFxmrk1cbi7WNfDLxe0ko3VtO8ZsvuNcdTAwMWJcdTAwMTT8M6ZcdTAwMDRcctRHue/PyYTc5mFZ1N6lITHNpDBbrlx1MDAxYyRQ822Bio5pXHUwMDE2r7f7JS82f/GzJOSvXHUwMDE2XHUwMDExYlxuOHj75OCk5l7+8ptjPyuEpHSXXHUwMDAxXHLtQb0tXHUwMDE3XGY53d+0yuwvwFmRIVx02yrv7UZExoeDXHUwMDAzpVx1MDAxY6nm/JhnwGdcdTAwMTYycaJ4xVx08EuhMFx1MDAwM6hxZoD6rudcdTAwMWU4XHUwMDAx9qhW3Fx1MDAxNyPA+8662lxcgqE3LZ1vRi07viPSIFxi17JqSNdbQStY81FcYlBUXHUwMDE2nyxcdTAwMWXm+1x1MDAwM8vW3qEvkb1cdTAwMDVcdTAwMDQ8405cdTAwMTQrX2PQtllrXHUwMDE32qHpXHUwMDFiXHUwMDEzXHUwMDAw6bHNVkKW4lCX25YlXHSGmjvurbNSeVx1MDAwMPaqffeja/i8XHUwMDEw9MjQijym55ermVxmylrYXHUwMDE5f89bd1xylVx1MDAxOVx1MDAxNnhbYa6NyTmv81x1MDAxYzjtiZ+GKPW74+JY50XoNZl5XHUwMDBlhVx1MDAxZCfLJm/buVx1MDAwN5RcdTAwMTRs5r9YoCVvzFG4YP+5aI2ftdOG8yheXHUwMDEy1Y/uMZm2KPXyMVx1MDAxYaGs31x1MDAxYVx1MDAwNo9fgetcdTAwMTDc6s7SXGYl/DxcdTAwMTL++mkp8Vx1MDAxYyDQT8YvbPPHws8hybmKLFOdX9M0XCKwfqN+8Zfxf7uEY1x1MDAxY5JImErooSmyJ1VvuDHgXHUwMDAyaiH6dMOj6lmN9J7MJuJNL/u6r9/CKmFcIvMnsYNuuYavj09IxjFhkqQ+rsd5eyBcYifa4ZDqMmjGXHUwMDA10uru71x1MDAxODayTH5cdTAwMDBcdTAwMWWLtHrB3H19+1wiXG6/n+WzI4it9V/dr2/V9mOF0HJcdTAwMWSIXHJbclx1MDAxNCAh3LeN3SqLzy/yXHUwMDBistdcdTAwMWIze3qiIKsjXHUwMDAy0PgnIZHNKsXGgVx1MDAwNlx1MDAxMr7srzNnczCZg1MuXqqs2cWqnOFuh9CSXHUwMDE5ZnCxlCmW5rjgc+zvXHUwMDE3JWVIONxcdTAwMWZcdTAwMTZdbmZeXGIlbVT+RVx1MDAxY3B3JXpzlCT76ve9XHSGqVx1MDAxNa9cdTAwMWEpMXgpPaBcdTAwMGVxTbyx4Yy211x1MDAwYlx1MDAwNWfenlx1MDAwZbC5gommclJsnOlfwaM4pNnr1zspvWHUY4mymVX1hVNDztW6MmHq2kxcdTAwMWXLPilcdTAwMWYlamOzVfbavNyp02woy8RcdTAwMTbyY/akKL2sxHAhmeWSWlx1MDAxNJ9JUVlyKL+fsivwXHUwMDFiuD5m24lrXGa9Ja5U2fW3/jnK2Vx1MDAxZIyPMbvQ2EbIXHUwMDE5Q56+hb9WozBcdTAwMDPssJtgZfJIVbBKXHUwMDFhqlx1MDAxMkWQbUErV1x1MDAwYpc/O1x1MDAwYlx1MDAxZChFO8aVvOScY1glMLI0deDEOOjfnnSZ2fIv1GiKXHUwMDFjXzJ8vT5jm1xuf2t5MImlVqlrhFx1MDAxNCqI+JnmXHUwMDAwJMnHfcVfQ95+pFx1MDAxYnY46l2dVFHdT29cdTAwMTOGZ8SolHjG8M/tg6NcdTAwMWNcdTAwMDBPK4NcdTAwMWJcdTAwMTaAipdcdTAwMDbXV9J086Zwdmw03nX0gXNTMmKnJyfN82bP4O0+inAlTKMmXGLw1mGt8khkLlx1MDAxZFx1MDAxObBcdTAwMDNcdTAwMDCuyvdKI5tFbFx1MDAwZalcdTAwMWFIRvnzXHUwMDEzu5DxvkVWblx1MDAxNrc5XHUwMDE4JLpVXHUwMDAxod4kyVx1MDAwMHvs1Fx1MDAwN022bVx1MDAwM3aapy2rPN7YOM5Bc1Go+JXbML/6r1x1MDAxMIZcZkSHkUFWhipcdTAwMGJHim9sdkWvjpfwj7LlWM3jnFx1MDAxMEu2dsKgXHUwMDEzssbzbfW/5lx1MDAxZN4qJNCsXHUwMDAzudl6JFxiMlx1MDAxOFxibjtivl7Z/NmGlFbbr9NjTPG3XHUwMDExlmdNXHUwMDBlkez1iNr6NtyXvG7rhYUzmeJTQm9Pf4dcYkqr+S/cI6BM6ZsgkMs/XvNcdTAwMDEhe2jsYVx1MDAwNuPoXHUwMDAx4aZMR5uGR5NcdTAwMDavhNxo1LFcdTAwMTCsXHUwMDEwXHUwMDBi5PHiUFx1MDAwNr0k7O1ccvjMT6S2S1hCXHUwMDEzXHUwMDBlXHUwMDFk+Ob4RSx3e6lrXHUwMDFhZkBcdTAwMDAwR8e1dLops7N8MaQusVx1MDAxMi5zLr82XHUwMDEyg+E4y5C0yfJcdTAwMGXl5Nm0UJNSW/XfbliPplx1MDAwNKNzXHUwMDA1vzSl7lxuS6Jea1x1MDAwNWLEXHUwMDA0llx1MDAxMdDx7b1r5kow+ewmXHUwMDE2k8xNe5EniTF1dlx1MDAxNKSZilDPXHUwMDA0d1I7Y1x1MDAxNNRcdTAwMTGS8cpJsyBcdTAwMTPdXug3XHKdylx1MDAxN8pCeDw4QcVcdTAwMWOR0bRcdTAwMTjB0H3+4Ksv5mGjfmq4WLK/ubbpXHUwMDE3gDQ52pJ7qJn3RoTITNRRKmHg/Jh5XG6k0v2w3EM/b9Sr6FRm/uHXcCsoXolG43GY4ek7x5RglNU6TU5cdTAwMWNxp33V0m5l8a5w856jXHUwMDFhK4e6aFx0XHUwMDEzXHUwMDE0vuFVWXjHXHUwMDBmlWDMum+CPfRccu7OXHUwMDEw6OZkzSFxXHUwMDFjSChQJVx1MDAxOXV7RfmWO8+9p9aX+Vx1MDAwMuNcdTAwMWKNk4LK2rC/7Vxy78cyk4RcIvmQVPtEXHUwMDE0XHUwMDE3a4hnnTdycYQ2XGL5XHUwMDBiuTT+/pWZXHUwMDAynlvf7jIodErHhKvtspHMXHSYjETjpNI3ailcdTAwMDWqm3BcdTAwMDIwheGH/Y3Mwyr5Z3hikPzbXHUwMDA2S/1cbuB4Rp+YVn4jLKeD4sZ1+D1/9lxuOVx1MDAxYiSQoJEv+VU6KnCDj4Bccszx+1x1MDAxNtVkcUV1T1A0/ntRPlx1MDAwYlx0Kse0zWjfTj3J+uclWFx1MDAwM1x1MDAwZalBXHUwMDAx9OArnVx1MDAxOKIsrL2jXHUwMDFjjKZcYmBcdTAwMDJOJ8/DXHUwMDE1/5LdXHUwMDE5m+T3Wcg9xdQ4wVx1MDAxM3e9XHUwMDAwxuRmzqqIn8ujo5hwpuU3pp6P5CFOXHUwMDA18Ct2ulx1MDAwMzwgTbEqnGnvylx1MDAxMlx1MDAxOcw++scu7ZxcdTAwMDPA6Fx1MDAxNfUhjUCc2sGIzaNcdTAwMTTH8zKdomNLXG5cdTAwMWGgcvBLblx1MDAwMVtcdTAwMTA12L0nrTDYXHUwMDFkKI1cdTAwMDEg6ZT8fUtcdTAwMTSMZYR8+OrgJ6pv7O+vfK78XHUwMDA1XFxWbGeFZbTGaFx1MDAxYW7qmVxunmui5n+cXHUwMDAyeynNqrzpbmdG01x1MDAxZUO+SP1URFVcdTAwMTd1orpRLyC4TFx1MDAwZV4tXHUwMDEy6yssfGNCXGJcdTAwMTUol0CfMzM5ucoqiuQsXHUwMDFmo36DjOFcdTAwMTfZOrMka1x1MDAwNPFcdTAwMTX4e1UtgUqY092wXHUwMDFhnznexYZn+fzdsUxcdTAwMDWlXHUwMDA0RDQgZOC2wyjC40LtWqxcdTAwMDVcdTAwMDdv2YhcdTAwMDKAiltiYzBcZl/+c4I5Nlx1MDAwYr4k7/u3c8LFe8KfOPpGpdFcdTAwMWRJv2EhVd8ga46ncyBcdTAwMTPErjbnkDnDmO2XNj/ceFx1MDAwM6t5PSBUM4hj6lx0J7QuUcdcctSHNDlcdTAwMTnAJVx1MDAxMcWZMlx1MDAxMLYsJdBeM0A7RzDt6C5iW/lcYqCIyVx1MDAwMyd8OSMtXHUwMDE3bUaZOnnCe1x1MDAxOIyF9f1ewbNEoHFkY3r8oYbfM9aLXHUwMDBi8f5cXNVcdTAwMTN6clx1MDAxZqp+/43rgOOH2lx1MDAwMUJ8ZujB7CTtX45Y0it9c1x1MDAwMe1CKba0blx1MDAwZXTCylx1MDAwYj+1wlxma8a9iPBcdTAwMTZzyeL9QrBcdTAwMDdcdTAwMWF3yl5lXHUwMDE4yGHub5mGbvW+Lf3w+Fx1MDAwMsmQbcBG4lx1MDAwZZMuJK5QSHHjjbvw41x1MDAxN3l3XGK2qkLslK+s0yvCXHUwMDBmQbn1LO/aacrEXHUwMDE3/Sy5x9IwXHUwMDBm/8irc8GCbs9yXHUwMDFkJNzy/N03U1x1MDAxNH9uqTRcdTAwMGb+/vZcdTAwMTIgv+hqXGI5XHUwMDA3XHUwMDFmi6D83ZtARUuF1tm/8oTw4opxIX/EX1x1MDAwZvtcdTAwMTHsXHUwMDFm+4ZJLDFcdTAwMTFsRz/Z//SY+3Zf93W457Pe3sz18/dcdTAwMTdsXHUwMDEygPrXhVx1MDAwZlx1MDAwMFx1MDAwMCC3gWEkrXFcdTAwMTWXotmD9K73uCrucVxuXHUwMDA0ZqQrXHUwMDEwX7FDPFnxLCA6XHUwMDEzetFpXHUwMDE4+iqLIG+H+938XHUwMDFktk98yI9cdTAwMDTVySA1XHUwMDBmPz1cdTAwMDef8Vt08PTtXHUwMDA3oSgyJ58ofCEvfU/Iju80dUZ6XHUwMDFh59Qpa7eLZlx1MDAxYsduc1lGS0TvIFxiXtJA5lXlhZ9LmmCje6IxVDLKJC1cdTAwMTE1XihxxIt1vN5cdTAwMDOBVL5lV7BcdTAwMWPBgI2od1x1MDAwNUGUzUZ0O1x1MDAxOd/kLrZcIo9cdTAwMGaF9lx1MDAwM0Sc+HbBl/Zfzex+XHUwMDBm2JCwXHUwMDE06pM0VVBRKy3gXHUwMDE4hLk5W6GK7CWAnsRaSuW5aypK5982t1x1MDAxZi/FXHUwMDFjs8uxs1x1MDAwMMNfdCGdMlx1MDAwMbmCSlxuMlx1MDAxZOnJl4SCQtI5taRbav662D6zzY+j2lx1MDAxYWP2r6dhIVx1MDAwZlenwk5fJfvB2OVk+lhR+n2MfpZd0jv8XHUwMDAzyIms6KOKlMlcdTAwMTaTXHKC5lx1MDAwNbZry5JhLyFcbm9mj+GDwaiJXHUwMDEwcEHaSM5cdTAwMTHlJSVYt+hcdTAwMTP74yhrXHUwMDE5XHUwMDE0XGJCnYujqjCUXHUwMDAwu8/RoObd6r5qulx1MDAwMkv+xo/nke8gkGGqldHuvIBrpTBAgz11a7JG7L9/XHUwMDFiwf4slytcXIHzlbVoq+1QX49peKCrbXNcdEWuWsNNRjV1m4onXHUwMDA1Y1Rm2KLBx+dcdTAwMTf541x1MDAwMX4z81x1MDAxNmTTzFaa5If6XGLpxas9cm+c4FQmRD3f0dhcdTAwMDVcdTAwMDS/Z4j4VWvS+Okgjsg79XFcXLumPNeBWlx1MDAxYtAvo1x1MDAxN9gnjepcdTAwMWI91VxioukzUNzc3X86qprAlNpcdTAwMWF4dWTDbuxhnel9KeNINH030Fx1MDAxOLaeaJO593CGhLI2qeUr9Vx1MDAwMlx1MDAwNlx1MDAxNThcdTAwMTiiwFx1MDAxNeq1W72B+qxHVFj2XHUwMDE2jj5kXlx1MDAwMfpalUGabzhg6cJBW+FcdTAwMWZUvTq6SGpcdTAwMGbZ8Tg7dJGXM1x1MDAwZbOhT+R1ijKPS/5tk1x1MDAxYylXwDRT7MPkyIxcdTAwMDRg///kXFwgJG/OraNlVVx1MDAwMi0mq6MsfFLLbP5561J/O1x1MDAxNbmRzlx1MDAxN3H15/fi0UckXHUwMDA0XHUwMDEymIn5NrN+VVx0+bO+cFH7TiPjMWvpXHUwMDEyXHUwMDEyXHUwMDAz4lx1MDAwNK/fXHUwMDBinVx1MDAxZfh5SHRzqFx1MDAxMthcblx1MDAxOFx1MDAwMmE4JIBcdTAwMWT51TCy+lx1MDAwN7HRXHUwMDE1jsP0cJDEXHUwMDAxo4t/vSw8ROiweVx1MDAwMDLQZVx1MDAxZbtcdTAwMDCASape1HiPXHUwMDA0XHUwMDE2Tc8nLyPHUVr4jaCkr27HXHLZXGJcdTAwMTKrxYLm6ePJL+dcdTAwMTBcdTAwMDCUXHUwMDE3R1x1MDAxNFx1MDAxMuF4n+lcdTAwMTN2lTzG34NcZkx5h0HDcoH5+iata1lcdTAwMTfjXCJ2Vpv5PYMqXHUwMDE3P4Hjn7VcdTAwMTa3q2r89sqG7FUtXHUwMDAwUlx1MDAwYmpubrJcdTAwMDXHXHUwMDBixlx1MDAxMNmyV1x1MDAwNHOif1x1MDAwMlxu62Nvdeyss1dqgy6PVSZ8XHUwMDE3+8+dYH/7cmFVxEH5MlpNy+Jo4oClJFx1MDAxM225b8tYlbZLXHUwMDE240dOXHUwMDE0IVLUcS95zNk/KappXGZ8my1a0HhOVpaVqqpXKPiXhCiyguZcbqiG3/3rO0ZcdTAwMTGyfJ6ZXHUwMDAySldaXHUwMDFhZs1kpGNcdTAwMTm+NbmFl5eOa/lRXHUwMDEzViearlx1MDAxOL+yuZdpdFx1MDAxY1x1MDAxM2xcdTAwMDFcbu6+PYLs6tFcdTAwMTnI8bPJR1x1MDAxNsHZ0ry9mPEqO24llaR3I1xulVx1MDAxOWLr/6xPXYlcdTAwMWXMxrz9PL+P7Tx0aSowXHUwMDEwyvrLXHUwMDEwx1xiXHUwMDE3r5Ki5PyhsMBFhD1IZ/J3Pi9BXHUwMDFh27d1XHUwMDA2Q8p8Wjp7/L69T009Z9RCtYxzlvsjiVxu0lx1MDAxNtBYvyovx2qTOr1QXHUwMDAzXHUwMDE3oa46VZPNUL5IbWT0a05jtNYqinlcdTAwMGVYv3HIsb5cdTAwMDZ/0oxcdTAwMDK+XG5L490k45WZp1xcKFxi5ltP2Vx1MDAwN3LH9maxKGhcdTAwMGbHbVx1MDAxMZy2Kia/Qay3S0l52MfNXHUwMDE2d+WGpUau1tFcdTAwMWTa+yxcdTAwMTJ+hJBcdTAwMDOd81xuyVBdXHUwMDFkXHUwMDA0plx1MDAwN8ZiTcCXTq/ksanc21RcdTAwMTiHXHUwMDFi21ncbY6hisftUvWBRFx1MDAwZWrSlVFop1x1MDAwZXLHLs1aNW6HVfAhRFMwcsPGXHUwMDA0XHUwMDE0VNclMTK+pqlcdTAwMTI/hHwvd+pxucafV9cvWr5UKFxyTU28oYDU5tBxkWJcdTAwMDDQLFx1MDAxOY5ViVx1MDAwMdcywyNDxnBelD84j872Mf5AUp1UwZzB864tY7QjJSt+XHUwMDE1VJaXMzhhXlx1MDAxNUjSkvua4Mo3LsFQNv6uY1ZcdTAwMDddQFxcIVx1MDAwNlx1MDAwZlgt/55HdVx1MDAwNq9jOKuJUeL0oa+BLsNlIDlKr4M1e0LO1KieNN+3YTuswVx1MDAxZd+unkRcdTAwMTg1XHUwMDFmd1xuIFx1MDAwZf2bUJhG+NpcZsBcdTAwMTRMLkK0XHUwMDE5znPJY26lXHUwMDA2XHUwMDFiVLDp3M9cbqc3r/f11lx1MDAwZYODulx1MDAxMT1deLGJUcmZLFx1MDAwMDTZXHUwMDAxulx1MDAwN1F/ndLkIX3ip/6OWHdAXHUwMDE08fLo93NS+IS/ebmL2288XHUwMDE4/1iNXHUwMDE4gNpcdTAwMGJ/1Vx1MDAwYqUhJkmp7O/6XHUwMDAxIe/LtVj0bzh+YIxcdTAwMDVrXHUwMDE5h1x1MDAxNIH1I0Iw4Vx1MDAxY5a5XHUwMDA0wFFpi8dcdTAwMDVcdTAwMDfHdsaQXHUwMDFkkuGIIEtcYnu2pDav9ESqMOpor4fURU3+TfDje5DyVV0gdVxu+PtiXHUwMDFkYvFMXFwz8mzEL5BcdTAwMDXktr+A4jjfK3BbXHUwMDBlWcNfXHUwMDAzY1xypjKtradmgrXQXHUwMDFiwlbmqvpX8TT32lx0gFx1MDAxZGgvNypLriCZXHUwMDE5LSw5QMU/mnK/7tnsM9z67LN6YOhRXHUwMDAwXCKoxlxuTSiRgqE86L5JQyRtwd5eQfZcdTAwMDCWZKlISIgtyoj+jnHkyVx1MDAxMjc6qE9cdTAwMDVWM49cdTAwMWVcdTAwMTmuUMRcdTAwMWZcdTAwMDN7JoGiTYdcdTAwMDNnibY/+3RcdTAwMTM3Pzx5rUpcdTAwMTRzdrF/XHUwMDE0XHUwMDEzIE1cYlx1MDAxNqGiaVx1MDAxMG2iiWAujlx1MDAxMkR/U1x1MDAwMpyILXFcInlWL5BlyVx1MDAxYfcxd2eFXHUwMDAyI5NcdTAwMDN6P4Q1hmrt3pJ1h6CwlN8nUW1cdTAwMDGgwC965FxiQG3hYVqfYVx1MDAwNsiodnt6PDZcdTAwMGUz5bIs5Z7+0m+kVaS8R3ZeXGJcdTAwMTZcdTAwMGLiJHZcdTAwMWSlZMT6noWqOqFp87Itep9hXHUwMDE0kThcdTAwMWXK61x1MDAxZVxcXHUwMDFkXHUwMDE1m5BYeCg+LtTz64pf9sCN24JcdTAwMTDblev4Slx1MDAxMYywQnZcdTAwMDFcdTAwMDB9lGwrpFxyXHUwMDFjXHUwMDEx/CZcdTAwMTPaXHKsOvA7aSZqWX40bEHC9eOTXHUwMDFjmljuwdOtWN3jNdNpdimcazGCO+zT+/s+9D5B4e2VjVx1MDAxMOc8n2Z00Vx1MDAwMKpcbnFcdTAwMGJcdTAwMWaQsnVcdTAwMWRFXHUwMDA2XHUwMDE1XHUwMDA3YGJBJCZIXHUwMDEw/oWUqXkrVW1Nu+LyrM9KUtEuiFLlIVx1MDAwMctbcSFcdTAwMTa0uK3JXHJkuHcm4iBsXHUwMDE09OPoYumLLlx1MDAxM5z4hnHdXG5anVx1MDAxM+0lUILW39pIk1x1MDAwN0R5QHtorzaKWrP29+lcdTAwMTjXwkl/6EJ5azNoXGJcdTAwMTAwOVx1MDAxMaXQUjdgrKh5SaXauaOrZenRXHUwMDBmKnFcdTAwMDScXHUwMDE2XHUwMDBiV3uly8vp68nwxFx1MDAxN9ivQz3kjFx1MDAxMsbbwkdU6FZcbmQzu8TRXCKPe8A21rhGVHmLI2PEjvCoSzZ+bFx1MDAxMaB1+DbMOybVL4u3zMrKflxc29pSMOBvbf7zXGZcdTAwMDM4WdSqJzJfqlxiXHUwMDE5/X/uJfypXHLz/l55jGzkPMlR3VxiX2vCb86E2fvf+1xcsez1NVx1MDAwYtW9L/fVT6SjZefn+Fx1MDAxMNKTP7JcdTAwMTHk3IaH4VRcYlCDzdjH1tfzXHUwMDE2pp0uXHUwMDAyou5cdTAwMDV0bGTQf+tQXHUwMDFlXHUwMDAwUpN3S9gvf1x1MDAwMLTK5qC+pWSSXHUwMDAy+icxi+X8+d6TgFx1MDAxYZdcdTAwMDPWNVwixmojhiEtfURcIkJcdTAwMTghXHUwMDE5vUeSQXNXmjri8jwvjSVcdTAwMTBcdTAwMThnXk6Ss41uULlcdTAwMWLrq+grsm3Hz2KJa4yml3rOlFx1MDAxN8E6bO9cdTAwMDFcdTAwMDWoKFx1MDAwYiBcdTAwMTf7VovAb5KAy8+whlCj1uLQcE4nXHUwMDBmnd2w5zDfhEdkju8jp2bQdNZAXHUwMDE1OO16/FfN1K9ChYhLizZcdTAwMTOBwuJYSuJQTm+6mVKkOVx1MDAxZn5F8t/rhVx1MDAwZVGxgaBcbmbmVTrFukdPXHKmq6LlTXQ52bSCXG7H6lXNZmr/1WJcdTAwMDQr2Vx1MDAxNDCe6mI9UUu/yVxiOi+xUeCviGwpXHUwMDA1sMEsZE5JujirXHUwMDBm5IalX8t2U20lb883aSxWXHUwMDE5sldcdTAwMTBlXHUwMDEykUGOLJXygVx1MDAwZitcdTAwMDU1P9Vuzfe2oKiSo0+NolneXHUwMDAzK2J2m2eZf/ViXHUwMDE2xJpx5PniQ3fFPVllZtqmaF5OO4CONFx1MDAwNIOCMlx1MDAwN37osJSuwk2ZXHUwMDExf6bENi5cdTAwMTEmIbWYZPUk7Hl6fKVkiuDLXHUwMDAxk4txPahm6KjsYDIqsVi5XVxmXG6uqV3NV5TJqFxcxqaVJ4KdNcIp6fJr0mFcdTAwMTVdtYcve1x1MDAxN41cdTAwMDdekSSK8tMqvFxyd/NAqnJcdFrOyFx1MDAwM6qdnu4y+mm7LYaGyJmBro3yYFx1MDAwZsFHuVxuXHTY4/hcdTAwMThH7nXvqZsw2r+qQVdcdTAwMTavo4K6JSbdsI/nPPFjzHzs7pY6fqjROFxcdubFbFxiXHUwMDE2Nfp+7C9jjrrFxSBVbCWNTiSdXCKj2Vx1MDAwNFx1MDAxNJitomm/h2dXKlx1MDAxM3tcdTAwMWSMXHUwMDBm1FW69G+N4unlk+LvXHUwMDFhXHUwMDE0XHUwMDBiyGvMXHUwMDBmsjUxLFxuNNVDNtx9KOE75ikrrXJP92KnJ8Vfolx1MDAxOI/+Zefbf7O9YFx1MDAwM5TseiB9PjCdxer9XHLB5YKbvvWH0pyEyypcdTAwMDdcdTAwMTcy/6Ygc754W8lm0Kb7unpcbo70avNcdTAwMTd4XHUwMDE0oI3VIzIhSpJgXiyZ4nhlLqw7oyw/bdBrKWhxnIz5pU7ib+HHlf+c18aA8OThJWAokfNbb3OEgdyRN+ouUU+fbHxcdTAwMDRsZ88pRKWfp1x1MDAxZGrbxi3gsVFcbnU4XHUwMDBlJ407J+VSXHUwMDE3z02XXHUwMDEzclx1MDAwN/AgyzFdY9Lh4lxu8GOor6xYjfdC+j+vS3GJ7DBcboG3+cim7uH0XHUwMDE1wPymaWJtXHUwMDFkUbpT0mCJlUX/0dNsithcdTAwMWL8XHUwMDEyuY9RXHUwMDBlxFPp37XNPjCCzdjQXHUwMDE2Y3apXGYgX+CjT1x1MDAxNNNLu8DN+Elzn4NcdTAwMGaVnlD813/DL2/H41x1MDAwN1/CXHUwMDEw5lWdXCImelrAyFx1MDAxZX9cdTAwMTlUpp1731x1MDAxMPM9voVf0qePo3dcdTAwMWWGT36o1OA72lx1MDAxY7ArSVx1MDAxYd9cdTAwMTHhPz87WHdimT9o/mmEUtNWtnV8Z0q/roWAaEN2uoE5vfFGMVx1MDAwM+XGe+IlKVx1MDAxMGJF6pxcdTAwMWPy6y5MOdwxuNpBxsaohbdcdEZzR1/6LNKy4NNjmjabziS9XHUwMDBmWm12cTXHfjTFMi8q9iGh8pVjmlpgy+nS+pGah46u06hNXHUwMDE3XHUwMDE1mSNFToVO3SfFXHUwMDEzU1x1MDAwMlhcdTAwMGW/vzYpXHUwMDBidTv9dnU6XCJqf0PInMiHkGBhMLakf4PKvyd5Zu4yvlxmVKl6kIq3ktVH7vA4pjFrXG7YrELeJrWIcSaXXHUwMDA2wVx1MDAxM5SGumZYTSgkyMOrXHUwMDEy4knJw4KKr5Fn7ddAs1xietWi/Vx1MDAxOLKivPxcdTAwMTH3dq07tmw6qlx1MDAxNpVpmmZcIlx1MDAxNUR0Z8eU3v1cdTAwMDVqVTtRf1x1MDAxY0JcdTAwMGLlU1p/rZxcdTAwMTCtMkWPL3KqXHUwMDA04iouQFxiRsn1sqNXuGo68jGCIIVD8lx1MDAwMOzy37qMW3k1ZNJcdTAwMWPbkkFtOoG7y4nRPsK541x1MDAxN1x0I4xcdTAwMTe+W+xB7TTf1aJcdTAwMTk+WM1zODR0PLi/Q89cdTAwMWairVx1MDAxMzi4Sn7mXGKyoM4yZyGPkJBcYrVnNOVHYmlcdTAwMTRxXHUwMDE5S5JvO4G0lOmOXHUwMDFi01x1MDAxZJT9XHUwMDEz96HLXHUwMDE1QK8lmH3QTbFcdTAwMGb3rinzRndjUVx1MDAxY7JLI+hcdTAwMTM4K4a94rF5arle2ESgXHUwMDEzRZ82jMW1lcUuyGKin6BzXHUwMDBm3l1cdTAwMWG3XHUwMDAxfvCQ9f6cmWeAXHUwMDAwLdGlXHUwMDAxP8SrwHJJ91x1MDAwNvL4kNSsa7OkKeb3f1x1MDAxOXhxTtZzyttP71x1MDAwZmU851x1MDAxNrUwXHUwMDE2rGpLlehWzMJobMra6azsXHLqucC8w67JLFU4pC5cdTAwMGJNzTOUqfOS0jhglFx1MDAxY3zykEnDhc3epE4lbalcdTAwMWL1krrzRjzDRWhyXFxToqN5XHUwMDFhQytdXHUwMDFk4Ki/Z1x1MDAxMPHjXmZcdTAwMTnOtTHFJtA394yxyU5cdTAwMTb+z/p34FlcdTAwMTaCsoz6cslzoyn/qZltilTyKSFcdTAwMDbAXFxgtsLsLlx1MDAwZvDYSODRRphKXHUwMDAw3pbPXHUwMDE5N4OnnyQgScVcdTAwMGWfXHUwMDEyXG5LdHeh0Zx+JlxmfnxKvFBFhjmrfX7EOzDk8phe0FiSKv18Y+Wf8yubQDNMO1x1MDAwZttcbilcdTAwMDR/z8hvroWcfbyALb/LxvF7LXFcdTAwMTNucUDdXHUwMDE5TLup1np75LRtyI++UctcdTAwMGKTNNSZw8XUXHUwMDFlRt5k4Fx1MDAwN++t9JimV+oo0nRr1trC6f0jkWlcXL+hJdDrnWJCXHUwMDBmhJyDpFx1MDAxZu3KebtCpF7Rg+5G4KLvXHUwMDE3XHUwMDExNYDuhlx1MDAxZePmYo/Fl5dJwsxqNNl7YyB5OVx1MDAwMr7tvtNEhWVcdTAwMWPoje+rIXxEk+LiXHUwMDBlUk/ZLFxy+jpKjcNcYrpcdTAwMGVcdTAwMDBtXHUwMDA0h/TtXHUwMDE2S2mQoyRcdFx1MDAwMrNXV+f3Lc9cdTAwMGIl0b5cdTAwMTVdvC/iVG39TbxcdTAwMWXObVY0c+q8Lsy3g4pcdTAwMTY4X4s8QdbUiFqdpZuuWbg9XHUwMDE27Phj+Fx0XHUwMDA1td9CrTo84uiq/0Zu9Vx1MDAxNjE4juP+LVwiXHUwMDE05+1C8SWfNyjnw6JcdTAwMWZcdTAwMDZcdTAwMTGZkWVofFx1MDAxMJFvXHUwMDExuOOopTzru9xoq5W/u6vhKF9wd8/WsyrLoevLsreGPV6qwvb5uZvQXHUwMDE1XHUwMDA1Wahac2da1Pm4veDuXHUwMDE2XG5gQlx1MDAxM5qB4DZbv1x1MDAwNN+Diq6iKSdcdM+Ye1x1MDAxMHnF8Nlb+ThBXTpx5XnZTXdcdTAwMTjGnu4lf0VDXHUwMDAyVf5w7ZSIK5OuXCJccruIjMK90cxcdTAwMTm/Y72Ey1x1MDAxZm+Gi/F1XHUwMDFlclx1MDAxMlx0L8pcZnmKN/TJI9OUXHUwMDExqjhcdTAwMDJskdkyQleKMmZcbsH1t3jpM7Wi7Vx1MDAxN36RhKbLg4lHuVx1MDAxMNRcdTAwMDGgvnKkXHUwMDE0gFfT7SPv3Vx1MDAxN1x1MDAxNFUmm6plnqav9ZuF3IJcdTAwMThfj01iXHUwMDE2jNXKNXGI6lx1MDAxY5NjPDU0rJ7MtexcdTAwMTQmg5Jo3ZNcdTAwMDVnXHUwMDBmXCKhrkpabTa/R2thn0upXHUwMDBmmWedbXt+XHUwMDBmzIcl15FcdTAwMGYjXHUwMDAz6Vx1MDAxMLgo4sA9iN99ztlgcUlcdTAwMWXdiOaeXHUwMDE2hZg86Fx1MDAxYy4sYDSoPSdMXHUwMDAwpUGdKraUxHhlh1J7XHUwMDAyWVx1MDAxNv1cbpUokumDQ+mXd79+bHlNj77pY39cdTAwMDFcXEbNXHUwMDFiXHUwMDFi9diWRMtcdTAwMTNcdTAwMGLCNq+aOVx1MDAwNzNhXHUwMDBlZ5zLXHUwMDA22N4yYouExoxcZpW+iC5cdTAwMWM2+U1cdTAwMTh8JinmI4mtXHUwMDA2gFZw1FCw88ei40Rh3aAj+j6uy8PPI0a+XGItXHUwMDBi+p9cdTAwMWHfxFx1MDAxNz1lsjXQkVxmpihlTb9MQvdcdTAwMDWZ5NQ+yb9r3Fe1V2BcdTAwMWMjM2P1a4BwpH8/N5QwXHTQn8xcdTAwMDdVNTzu0+9318R9vlx1MDAxMzL6/m1cdTAwMTZfeIxafWR59TaZlFx1MDAxOT+vlCWHWs5Splx1MDAxN5aK1b9UYj4qM1JNXHUwMDE1Q/SPan35MjaRkdDzn/PRnyPLa/j9ybJwb69jUZ08+Vx1MDAxY/jq0Yb3fcPckrdcdTAwMGZcdN5cdFthg1xuvdJ9PWpcYpFZXHUwMDFm5HuRXHUwMDE2jbVSg+J358InxlxitTHaPt7B7LfhXHUwMDFmQZdcdTAwMTR7cixoM0Wh1fxFcFwiNsFcbsXD/C6wXHUwMDAytNtKYNNcdTAwMDdcdTAwMWNQNWWYXFx+d1x1MDAxNbVV78Owf83CMjPL1lHiXHUwMDA2N3dcdFx1MDAxY65/ZaKwXHQsXHUwMDE2lEWLgb8937yKVuXjcviqTVRcdTAwMTFp9CuMt0TkWFx1MDAxZJpV0+JcdTAwMDaNLDjWapzvaP+Ezt2cKkl4xVx1MDAxM9u9esdExX2XXqhcdTAwMTWfkliJy1x1MDAxYoSwiMbxRt1lcVx1MDAxYiTdXHUwMDE2gD8/XHUwMDE0/1x1MDAwNOg7pirE9rrAXHRcdTAwMWGce2mNXHUwMDE5MagpgrOksm2MmNuCr69fJCCC2ZjbXHUwMDE4LfKWXHUwMDE5geAkulH07+6VY1x1MDAwMFx1MDAwYpXkUZo2Tf7zij7bw1x1MDAxOeDZ4Ixft/f3mFx1MDAxY5c4XHUwMDE1Sss8abfTv4WtiL/H5NvbWnzz/dXdXHUwMDAzXGYyejnWbVx1MDAwZrLaxj66OP/GdDg1+LBuNFx1MDAwMJwh61x1MDAxNYvwqXJbZ7mrtVx1MDAxZth167Hc0iSh++v3NPue9ykod02TyGUjrsjdOFx1MDAxYltcIoWRzVxc3Vx1MDAxZIBlavFXerrsu1x1MDAwM1dusKl+y4j0vsqTyHGtJVx1MDAxZdxcdTAwMDHlzEstXHUwMDEzXHUwMDE2XHUwMDBix2jj5lx1MDAxOFQglbhIKPBcdTAwMGIsK8iJkpRcdTAwMTfU8Vx1MDAwNGvuj1x1MDAwZnZ+7kU+XHUwMDE0y1IhXHSGO3WRgGOUXHUwMDE2xIKXskjzKpw8lFx1MDAwNKN4XHLwXHUwMDE5j1x1MDAwNU6ma6FkN3JCfDiu8H6IY14yXHUwMDAwkDfDXHUwMDExMlxmuzhcdTAwMTFLdlx06nM32jWAg5QpJKDH9OX3XHUwMDBmXHUwMDEzrVx1MDAwM+9967M++oGKXHUwMDA1nEDDrUxQlC5Dia3WXHUwMDAw8M+oYbalN7ecXHUwMDFiflx1MDAxNobncnal01WOg4enNkjlw1lYxTucXHUwMDA3+CaXnIpvRj6cv1x1MDAwYibV92X9/O64vUZcZqvP/nVj2Dw7TOhEjUK8xeKHz1x1MDAxY+/o+lh2NOB61it4tyTIbew1qC1vz5bZ4Vx0MkysdoVFkjGqNVx1MDAxMlmbOqSeN+PtXHUwMDA1Tez0qJjSjVx1MDAxOYZjmL9cck0/cvx9Kzei4Z+oarxMtOx1qXf5eb3vO/RNlH7Mbdfig5RHOyTUNDg9gFJ7k57xg2zVblxu6GRcdTAwMWNKuFTfjuJcdTAwMTaBXHUwMDAx5FwiSFx1MDAwNlx1MDAwMi3J7JtWQJd4b1x1MDAwMVx1MDAxMqttT7amqGAkXCJTc+LXU6BahXctqoq6KCBrdbFccnzxQMNiXUYqUVxmSLpngFpePvOlqTXA8vGo2L3QXHUwMDE3XHShUjEquDBcdTAwMDWVwDcz7DdcdTAwMTkwXzyz+dh3w7Lojed5LKBcdTAwMTCjRpXmwH9WhurpXHUwMDE3dfFcdTAwMTdg7DJJLqpNXHUwMDFjr+HDUS5Tm4WB32eBXGY8k5ZcdTAwMGZaafUl2TfHXHUwMDBmjY5cdTAwMGXQK6vFXHUwMDE19IF1RN3R1pnBXHUwMDE5tedZTCo42cvYeFx1MDAwMMNI4OKwQmdL/jXXmaFhgFx1MDAwZY+yXHUwMDBlXG4kzuZsc1x1MDAxZr2jO2V+lFx1MDAwNL3YKo2bxDHpmqmv6E+DXHUwMDFlYN/3ZVGMW+NOXHUwMDE2XHUwMDE4L0J9XHUwMDFhmy4nXHUwMDAwUNzf3Vx1MDAxZU6uq7FcdTAwMDNcdTAwMTZL+lx1MDAwNLBcXPNcdTAwMTk18lx1MDAxMerezrR8Wlx1MDAwNFx1MDAxZMpcdTAwMDNiS6wlv3V6c3nhL1xmXHUwMDA1pbpcdTAwMTNcXPix1TxK6GWnXHUwMDAzmZFxNFx1MDAxMH9cdTAwMWJaRlx0Wde98VqYLqPllfM9kSZsxFxu3M/Sh+dvhJjbe9tNxFx1MDAwMFx1MDAxNj+zbqJgQlx1MDAxOWzfPKFsUev5kq7XwEVsc7TXvGH37ulcZjRr6dK9fP5x27978PIu5GrWMM3RSuhcdTAwMWbElEruYKU50y8/qyM4WamL8HKZ8yNcdTAwMTc4MFRohp9r/m5ecsDbaCCAklx1MDAxY12UPlx1MDAxY5/+zlImQJI1ejHJik2VQ7eXXVx1MDAwNFx1MDAxOYxFm17Yy9u8gL5cdTAwMDBcdTAwMDCA6yyL21x1MDAxMYVcdTAwMDDq+eHBhVx1MDAwNFx1MDAwZengODpcdTAwMTR5Qq5cdTAwMGXLPCatXHUwMDAyv1wirnSMwsdykGxrXGbqtz6ApNNvpzdDmrObRFx1MDAxZDJ4sVx1MDAxMIRcdTAwMDD17ILtXHUwMDFhb6v8yTxZKpPoJde4kIuM/J06/ESkU4JcdFxicCDYXHUwMDE4yafdvKbyMpFldUegXHUwMDA1d8jQ19H/6fXaVzp5hvWTZ5xcdTAwMThcdTAwMWaCVa5wtL5XXGI2T8IvoME09Cu06KjncmwhXHUwMDBlWPXPNiT8j1xiaqgtrOuEiZRR4HHS7E25mWS2SIvRiGjLVVx1MDAxN+Ls4EDD148y6Fx1MDAxM+nA87piu1x1MDAwZvnhPCNSg+XO1lx1MDAwMNCZXHUwMDFivfJEdKbe6/ppxkiMj1x1MDAxYmZTSiCRLpNcdTAwMGW5vHvuaX/H++rffIlRQEUk+CtfRbww8Vx1MDAwMVHaLP9cdTAwMTdl77HsqpKtXHUwMDBiP1x1MDAxMFxyPIgm3lvhe3jvjVx1MDAxME//o33uPbdqr4rY9TcytFwi1pyakDnGZ9KMtGRje5V2yTbmVrHHw8ZMvmFcdTAwMTQ04jBcdTAwMWbEb8VcdTAwMDBT4Vx1MDAxNvDQY1x1MDAxZmJwYNEsUIRcdTAwMWFxa6jShTD4zPPstC/aU6xcdTAwMWHvMFCCXHUwMDFmJVx1MDAxObNohG5gdEG65e25ZMZ7rSfc43Brn1x1MDAxY5SsTztcdTAwMWFJRlGvdpWp0Ku2XHUwMDExXHUwMDFjblx1MDAxY+R6XHUwMDA1XHUwMDE2kbJcdTAwMDVeXHUwMDBl2cuh82jBh+fvgX1cdTAwMTlH61x1MDAwMdQ3TKFWXHUwMDAxS1x1MDAwNu2xM1x1MDAxM0Hk46fgZz9cclx1MDAxMm8tXHUwMDEz8lxy+MWQKGmhJnF/fS/2gHqTZXd+9FRXx2BnXHUwMDEwn/leITzKdtpcdTAwMWFf3HK2aSZjKPokXHUwMDA292j8coRcdI5cbnmGsDBcdTAwMTDPUnLMzmgqXHUwMDEyXFwpXHUwMDEx+VX0g1ehXHUwMDFjVPbjJsA4aE27nutkoVx1MDAwMX04Llx1MDAwNGdcdTAwMWSYpuCOXHUwMDFi8vfHzJhY9jRqu9mGm+pkJFx1MDAxZaqIbtTpjlx1MDAxNSvLLfldzGyQIPa8XHUwMDE18Vx1MDAwNnQpWytLwNI1oCC7e/IpjkmsJvF3eGLyXGag2vXBR3DBXHUwMDFml27sgjHeZ4F3XHUwMDE2aVx1MDAxZM5cdTAwMDW0IFx0VWp2qVx1MDAxM16u3UZmXHUwMDFjubst+DGjXHUwMDE2mVx1MDAxMJBmI1xmwMFcdTAwMTFrluCm0K1kqE9JekFcZuubYCpAr5mlXHUwMDA1+DqldY/F/eosMLnU75xE60GyktCkkZrrQ1x1MDAwMH87wihNXHUwMDFjzStcdTAwMDQrmtkts+JcdTAwMWPOUDF0RVNcdTAwMTXTZ5z2XGLKIPGQK50g7WVRsOxcdIG+hubuZWpIwFdcdTAwMWGp+1x1MDAwYrwrXHR3J05qXHUwMDBmvr+GbzE43lx1MDAxNFx1MDAwNXGRaYl3XHUwMDBluI/tzUmHafb59KUvUMVL31x1MDAxN0O1fac4S97wXHUwMDExXHUwMDE41MdcZl0ocFx1MDAwMjiKXlaHvTZSe71QRam1XHUwMDFlXzWPuFx1MDAxNo3kNLg5gFx1MDAxZCgrYEHG14rzKVx1MDAwMuxhzy67rM3bLHzDxnCVuoQnzDSkO9pcdTAwMWSEvMfYcc9vXHUwMDE0OCxcXJ3KlUR3k1x1MDAxY1x1MDAwM5W1/YFcdTAwMDJB3Vx1MDAxZlx1MDAxZeXNZaZTKV58MF4tXsi9mVGIhqlDmK9YXHUwMDFmjsDpSORCuLhcdTAwMThik7ruhjDwlD5NMmzPo2TBXHUwMDFjWbsjXHUwMDA1JoVfSCVpkz6i9JSCxaDeQIcopCX1XHUwMDA3LZhcdTAwMTNcdTAwMGLV4oJAXHUwMDFikFx1MDAxYVx1MDAwZuVcIk7k8n1cdTAwMTA53kGAjUJJZVx1MDAxNGZoXHUwMDA1KHxfUOuG4qlRv3sryHZcdTAwMGKxwEJcdTAwMWH+oyXEVYaT25hcdTAwMTiZ6Fx1MDAxN4pfZINcdTAwMTZcdTAwMGJqXdthIS+3r09OVV3xIVx1MDAxN6dcdTAwMDPuprVcdTAwMDRcdTAwMDJvrFHKm1x1MDAxMXVR7CTf7lx0J49cZmyl7CCAXHUwMDAyPnuMXHUwMDA0K1ohLCFcIkLojzPwXHUwMDAz+6uHxXC4WXSVSMJMKG7w/WGLXHUwMDAzU1x0ft9h3+0rXHUwMDA271x1MDAwNS1cdTAwMDXsXHTbZFC+tvR+x2hcdTAwMGZDjzT9XHUwMDEwZ1x1MDAwNq1X0KKyyVx1MDAwNlNyfC5cdTAwMTP7VOczZJG/vt9cdTAwMDbid1fvhFx1MDAxNoHfXHUwMDA3XHUwMDE4KNfbhTUtXHRcdTAwMWL8bopUyKTHTEfNuHhL6Vx1MDAxZj45XHUwMDA2PEckgK5oV5FmZe9qfjJcdTAwMWUtnL7T8FrrXoPIytpNrY09XGKeb4W6rONhWe5cIlfLXHUwMDA3XGLk0KmEXHUwMDEyMsCKw2Z9OfpJrO9Eek3bm1x0pVx1MDAxYmlbmcG0kTPjzUfEONkvy9FZ5DiTZFx1MDAxMyvU7ffV2lxu12FRoLv1yffIXVnSq9bssItcdTAwMWVcdTAwMDV2Ulx1MDAwNWG6XHUwMDE0fFxm3CNa2lo3XHUwMDAzMT793z2W20NcdTAwMTXVn4W4zc8v96Rug1x1MDAxZSH0XVx1MDAwNXGT1Ltw0zbjRr+nXlxyXHUwMDAxXHUwMDFhpS1ROnzAbVx1MDAwN8nHXHUwMDE3PnG2VT6fhJFOdF88m1x1MDAxMF5STlRcdTAwMWI+p3otl2BcdTAwMGLMUTXUZ03IaGiDp/Nm+eR4gJY6UV0hXHUwMDE15kHCoW5rdYdcZuFe5yZYn95cdTAwMDDaVFx1MDAxZtVLXHUwMDE0PVx1MDAxY9lQkU+kli3FZpO7lr03ISNWIdVOWNPNRN9cdTAwMGZnPcxcdTAwMWNFsDzA4XLfSeEmU60ktLBJwFRbd1x1MDAwNIjf+Fxmx6124Vx1MDAxY+lcdTAwMTM3WlraLYKtZjdGnkFf0nV9ijrMiibAXGZUXlxiq9ClXHUwMDA05Jp65vuxdsCv1rCTpLxcdTAwMTSv/Esxoz6O/15jUW7pmX763lx1MDAwNtthlZlcdTAwMDPtVERL3OrQnWAtXHUwMDEwmKzxr22Up0XbifFcdTAwMTX0XHUwMDE2o1x1MDAwYuuYIz6hRW2FuWh2RNxrpSr+XHUwMDA2lUJ6rlx1MDAxMYo1krO2YFLRRpZ+LdlXvk0q2aaHXHUwMDA1f5K6j1x1MDAxMZGIu3t4XqRKV4rcnaq35pVcdTAwMDSQVIO1nljDXHUwMDEyc09cdTAwMGZ/hfY4XHUwMDE1O0m+ysVhJFx1MDAxN2pxolx1MDAxYpdkXCI5yc9WeLO8JPO/nUyI+7mtXHUwMDA2WExcdTAwMTaccqCVrKGpebF1SCQx/VG4/Wl8TztcdTAwMTQopO1cdFx1MDAwM8LwfVFkZOU6qlBcdTAwMWZEJugz8Vx1MDAxY5rC3E3o7Fx1MDAxMP74kG6rRFx1MDAwNsGx1c2bQFx1MDAwYjmHPZbSmZs93lx1MDAxY0hB1oh6TIuEeSdwjcqoXHUwMDE0XHUwMDBi0r5cdTAwMWUx/Fx1MDAxOENAXHUwMDE3Jj/W1GMr2MEtXHUwMDE27sltYH+skv7AxjdcdTAwMTFcbnrvd+BcdTAwMDCKUEiulor3gHRDn4JcdTAwMDdcdTAwMDTtvILM43XaXHUwMDBiZaW240DTdNO/kTTAel/221x1MDAwMfpzXHUwMDFlYlx1MDAxN5jlXHUwMDEzjtv4Svnjl0xd38BPJFx1MDAxY1bXXHUwMDAwp1jo+/X5fWPAY6f5Vu29eudcYu5umJqXm0f7x4V6VlxiP//hzK5W/XJKaLL7f2qEoVxc/EjAa1moXHUwMDE05pawemtyTTtIf1xmj1x1MDAxN5EvXHUwMDE4PGyBXHUwMDEyuPm3hoSNIyGTlsrOrvJcdTAwMWH28MOjSHFKz/PlIU5ghGhL+eFPeu++XZDNWnKfez1cdTAwMGZRM5cuaCAoZVxc8nzsd/XpXHUwMDE3KaKWmVx1MDAxOGf+6a8x+OxcdTAwMTZcdTAwMWRKmZ1cdTAwMWRcdTAwMWJuWuZuXHUwMDFmh1x1MDAxOVxy5mdjVsfOOihYb+z4W4DX9PWpZftXqv9cdTAwMWKe23jzXHUwMDEx2bpcdTAwMWGUp9QxQXu+XHUwMDA0bZnO0Vx1MDAwN7jBME9jschcZirjKYuTXHUwMDA2YHtwi4KAurd6oEnSiq9pXHUwMDE3flH6pytcdTAwMWZep3qzco1cdTAwMDIjjVx1MDAwNpTEXHUwMDE4t1x1MDAxZM3Wqf3xPih4yPSRdvIjhZFcdTAwMWL0mPCP2iiyXHUwMDE4VY9O1pjUXHUwMDFlh6VNlTKPXHUwMDFitYJJWZHdocpe+4uGOD49XHUwMDFjontdt1x1MDAxZFx1MDAxN/1cZv5r7Vx1MDAwNHdcdTAwMTAr/lc3XHUwMDE4Ylx1MDAwYlx0b59cXNc6n77JYPAlWPjbWU0k+tVje1x1MDAwNHz2fbFPolx1MDAxMipOvHNx+9/pNE8haEZycL+d3T+0vZiov2eVmNJmrEdcdTAwMTVcdTAwMWV1kn1NYIq3xenC8GYvbSEjxICPK1uDPchf5PXEVpzGXHUwMDBiWcTi871D4Csr/Tv4wl+GvC7H/46P/vFo24HWXHUwMDA0XGbblqqGXHUwMDE4faHWNNTmm/YrXHUwMDE3crVAXpvtj9qw8qeXbfEl0I9cdTAwMWOSnV3V9u9rIWDricKEN1g88OQjtvvJXHLp/33HTYVcdTAwMWOWVlx1MDAxM4G5yaczzlx1MDAwNEGelPX+/XXjimTYd1x1MDAxNZNcIt2OenLByHJEef47OFx1MDAxM9xDdbyMoVx1MDAxY1x1MDAwN7Z43GNOXHUwMDFiiV4vr8PVXHUwMDEx39f/ZWyFi2VcdTAwMWM3k25wmM8t5X16oYA/a3Opn+e5foc7QijhUMH45tBcdTAwMDVMs6lFXHUwMDA2XHUwMDFkXCLK+shARLZtnu9cdTAwMDJ+XHUwMDAyO5B7Vb+a1Ka6XHUwMDBmouCL/+K93rbub1x1MDAxZi77a1x1MDAwZkh1mNlvXHUwMDBmXGL51z1cdTAwMTaoSK+e+UdNe4dlht/e8Fx1MDAxNPJZs32Uld1GhJHOXHUwMDAwOyHG9NpcdTAwMWRvXUlcdTAwMWEm7jxWXHUwMDEyKlx1MDAxOWfGMFt8+MZcdTAwMDViaGHSTyhCXHUwMDA0urWBMFx1MDAxYSDOOErF73nThIIo682zw6LPk26VzZldXHUwMDEwZOjwlf1rXHUwMDFmf+lVpNPjTVvnMVx1MDAxYXBjMdbbk/2S+WOcd/qgXHUwMDFmXHUwMDFlWD2G3p/vXHUwMDE4/Sbwh2uvJ6ZIg1xy2ei+jm1MIVx1MDAxNDBexoCiXHUwMDFlnS5cdTAwMTJSJduwlH1cZrHF2EKxVVxudcT5XHUwMDA1+f+vXHUwMDAz9MlVn89cdTAwMTGldstcdTAwMGUkeeE0mXr/XHUwMDA3fuT8Xzzst8eMSVx1MDAxMfjJglx1MDAxOG2eZoWQXHRcdTAwMDZcdTAwMWJcdTAwMWGVXHUwMDAz/XDU11+m2r/+N8HjtmOyjn2I1MRovIy/XpYndZ5luJnXXHUwMDExV9jvXHUwMDBli8fRXcLpb9PaWsr/vITQPaSZd/yvZCc/Mt5cdTAwMTNEj8+qkzuxq8aM7Uuye2pZfvPZ1KNpiG+H2XU6dVx1MDAxMtKOk9x+XHUwMDFkjzlt1IjI2f+/453Gb9popMyp92L/Qn97T1ZizXegPFx1MDAxYT70Z1x1MDAwZU9cdTAwMDIkt1x1MDAwNCQ/UueLwIo1MErXb+8xKuvljl4h1IDIo6xcdTAwMDbskuX7y8v1b16uXHIybz5M8NHavm+gyK/6V/9cdTAwMWUuuplcZvNQ6Vx1MDAxY1phf9Oqeco6zq2icrp0paDXeVspXHUwMDAx/3/PwqCs82SyNVx1MDAxOKxZXHUwMDFkzl+TJ7F/e/6/XHUwMDA3sVx1MDAxNj1x1Pd+zdniW3zcNZzDXGZnXHUwMDFiNcu+XHUwMDFmOVx1MDAxMlx1MDAxM9z86CfaR27h24ewa7ecuilcdTAwMTlcdTAwMTK59sPz/SRcdTAwMTbVXHUwMDFiWN7/0lx1MDAwNyurNbQ1SGBcdTAwMWPG3+gyWG9kZFtcdTAwMDeWuFf6v1x1MDAwYvt9+EvXX69cdTAwMTf4q1x1MDAxZFx1MDAwZm1cdTAwMDHFXHUwMDA24n5cXFxcXHUwMDBlXHUwMDA1r2BcIoS5XHUwMDEwo4Wm6tv2nJaE2Hx824v25Fx1MDAwZnM++TPEWVx1MDAxOZ/nuW+1aVx1MDAwMa/vgWg7fj7Ypz/jybAy+rlcdTAwMDX8wjw6hY1cdTAwMWL5XHUwMDEyxf+B8ypAeJpWXHR4z9frXHUwMDAyPrdBMJWI87ZQKJX+5GhK9fssXCKQiKh/1OZcdTAwMTW33zPf4eOrXHKYXHUwMDA2XHUwMDE4u0h5RmZKz/NcdTAwMWWuWrfpXHUwMDA1pd/jnIU0PVxy/lf6pqamt1hcdGR+0+IuMN9cdTAwMDTp/ndcZqrgXHUwMDFi2y3GXHUwMDE1sV6eJ1nkenfRXHUwMDFhySTOIOPSXHUwMDFmuuJpraHZj1Xyq3OC3EWagXhSdurhcetNr8vbaKM6XHUwMDE04dU4nUSxKfy8XHUwMDBlSaDiV+SlZFwiwDRFLaCEXHUwMDFlslx1MDAxNYioQ60zXHUwMDBlw8sjjdf16XuEZlx1MDAxZOVcdTAwMWWvXHUwMDFig4lihXzKfbdcXFJoXHL2L2fL+MpcdTAwMTWB9txcdTAwMGKzOGQgf+3XiFhjXHUwMDE4ivlcdTAwMTiW10rAXHUwMDA0tn3VasZMcG34P3hcdTAwMDe7VLsysOXRo7eyqo6XfVpvZKMgjoOpqiej4TOkXHUwMDFi3oLJwVx1MDAxMe7mYJbuvlx1MDAwMr1kN39cZvhcdKdpfLcoXHUwMDEySGmbamNKXHUwMDE4X+Drh2BcdTAwMTJzXHUwMDEw9Xp9y1VG4Vxy7/iczVNbXGaUf+GKwXvkXHUwMDAwYVDTStWghp7S61x1MDAwMyAv9OmjXHUwMDE4pbrr2OJcdTAwMTffKioz5pk5Z3/v930zfzia+lx1MDAwZd1hXHUwMDFhl+qhXG6n8XDa59TxXHUwMDEwwW+vR1NZkduBK8JX23VTaUi9XHUwMDA2XHUwMDEzOHuH6pn3lSYneoP8eSpoilx1MDAwNk+m7dp8SFx0WFx1MDAxMJVcdTAwMWGvxPUvqZk3XHUwMDA0XHUwMDFi2Vx1MDAxOWRBXHUwMDE24mxcdTAwMTayn1x1MDAwMDg1XHUwMDFjXHUwMDE5nyGoR09MjbAxgEU7J0JcdTAwMWbMpadcdTAwMDD5kiVcYrmnXHUwMDBlXHUwMDFhXHL03zs9INd6bEhcdTAwMDNQclwi6bYwXHLyUVrRrN9repN6RVx1MDAxZu1cdTAwMDLE1dM4MUpCYzBcdTAwMDFv1+qGXHUwMDA3czpcdTAwMTaTbFx1MDAxM9RcZlx1MDAxMFx1MDAxZWDWXHUwMDE0pnH07cdT0kzouHZThEWhXHUwMDEw2kSNlf4tKu/pgu54I0tcYmhnMdhcdTAwMTVww1+wuFOYhN/3jlJcdTAwMDWErOhRiPFm41NQwElcclxuo1x1MDAxZnFh9K+6bu9o2nr3vktQXHUwMDE0NqIoNPDWhok+ieSPWFx1MDAxYbw1hfdcdTAwMTF9pHCUWs2UmECU8v+Rn4l3Uv02hlx1MDAxZrRcdTAwMDNcdTAwMDWKM81cdTAwMWFcdTAwMWIxXHUwMDBmcr2DJZjnfie3c9tcdTAwMDSoTIJcdTAwMDLARo78YFx1MDAwNriVRZGTY36gYptnVCo+v9t1mWJfqyY73UnU/zpO9cLSt2BcdTAwMTZ2XHIs4uqtvnHaYOyBcZSqWVlGLUzl5Vx1MDAwNovgXHUwMDBiMcmNJPnDXqxYjlx1MDAxNFDGXHUwMDFjIa9cdTAwMWVeTqKW4OO/TYg92lRcdTAwMTZcdTAwMTVcdTAwMTao1a5yz/nTTmpwfVvUPlxu7MdcdTAwMDcs0kycqUK6XHUwMDAzid5p1OiouMG9i3FcZlx1MDAwZjqZXHUwMDE2w1xywTgxMFxiktJUWpTInlx1MDAxZnjfUydx6vtcdTAwMDaO31x1MDAxNW7Vtd45KlC5kFx0XVx1MDAxNlx1MDAwNOVOMW15fTlcdTAwMGUwi1g6lNpVSmpTg1xilWXcsLbikURgwjFBWFx1MDAxOLxcdTAwMWHy90tcdTAwMTk/QKa6rCZq+E0+5lx1MDAxM8R03npNvHs9b/Y4synBYOReq/HJXHUwMDE1XG67SdLTXHUwMDE1XHRJ/e7kuUjN87gneuBFwlK6dSF+ZVx1MDAwMKHUw1x0Yre0XG5+2TihXpi+NbOoXHUwMDBmQvlbpVxm8Fx1MDAxYXbt3aCm97KSrNJcdTAwMWVcdTAwMTc8g1NcdTAwMDKrII9F6/f5OaL4gJe1o1Zl9EuAw6mawG587l12jmJ5llx1MDAwNv7g8UVRq2aF65iAx7GgVPtcIpsggMk0erHlrajsiOFcdTAwMGamTv9hX1xmq9pcdTAwMWRqce3L3kTX1Vx1MDAxMiTWhDt/Z6bN+d2oQ30tK/6oRYrcRW5Bblx1MDAxMVjZSDyn5rI1XHUwMDBmzsOVXHUwMDA3PcJ3+vrLXHUwMDE3smZSXCLtkaTmXkLvuUG+Z+Ge6ZVcdTAwMDLglZJYXHUwMDAzg9FKRUD6uzfnPSvhqlZcdTAwMDNWwlx1MDAxZu1cdTAwMTH8XHUwMDExPLGASrtcdTAwMDc+XHUwMDFhosNcdTAwMWQ49NWWcy5F5YJ+x8tcdTAwMThwfO3lXHUwMDAwT8SFiJ+Lt+6XXHUwMDFlhEtC69Pjpq+1XHUwMDFmXHUwMDEwcDP4XHUwMDE0eKy0XGJBjz1cdC5SeykvdVx1MDAxYmJleKxcdTAwMDZcdTAwMWGfXHUwMDFiMkhdfIWR+plcdTAwMDB/r0ZIQkBti2tcdTAwMWNIkOH25e29x2Dw6IxcdTAwMWJ9N1pcdTAwMWWCLLb5XHUwMDEzdlx1MDAxYtuJjL6yheZ0XHUwMDEyJd5cdTAwMTKfW0pcdTAwMDAhXHUwMDA0U+D+eEqrXfVcdTAwMDJuqFx1MDAwNHDk+Fi1+2toXHUwMDA1XHUwMDEzXHUwMDFidDDLXHUwMDBm3LFcdTAwMDGJvDfL2mxcdTAwMTNcdTAwMTlz9Fx1MDAwMJfDokZcdFx1MDAxY4tcdTAwMWWNKfTRXHUwMDA2hJadmPF6f0yYV9tTXHUwMDAy+oT8T3u0VfaxnFx1MDAxYybm3UclpNNPT2zYnIDkot6BPO2RN3lysYUo/O4jqntcXLM/XHUwMDBltFBccqFcdTAwMTYzrERrf+7q62zX94jGqb/0sXE2tFQuUVgge4lcdTAwMDZcdTAwMTGZXHUwMDFh2FRcIjj5XHUwMDE1SSzNUWRdJGM/XHUwMDAyWUldPtnSk4m0S6Qndlx1MDAxN3fM2zGR2Fx1MDAxYdfrsjpdhS55TGl3jPlCztmaRTNcdTAwMTUsIMNHYaxcdTAwMTL+u81msPC30zvf8z74XCJZf3pcdTAwMDI92Ofl4UR1spHYv2taQ1LWKkaNL3pcdTAwMWTvia41YFxcQvH6XHUwMDA25kTTQL97XHUwMDE0zXZLWntFbtPvcD9cYsFDJ94ygvW1h+D0zWCnXHUwMDFlQOKkYHpcdTAwMTBcdTAwMGIpXGJNz3qVQLhcdTAwMWZcdTAwMGI+gt3rUTyVtG7xuu/geeQ711JkcjR7b+QgqIBn8FaBL1x1MDAwMoDLNiNHXHUwMDExh6OhXHUwMDFm+6Lxm25Fry8lXHUwMDAyjTGSc1x1MDAwZlZoXHUwMDAzYVx1MDAwZf1HrXM+XHUwMDFhfnWQXHUwMDE4tkw9hY4hh579gFTu7MExfznQnVrh8Ktth3ilXHUwMDE1NyfNMI/ZJDuMPEZCLWvL3s+TMVx1MDAwZvFcZlwiabpcdTAwMTCl1I6oaJdp+L3wtbnSb7kh313FMmj5TFBtaO9MZFx1MDAxNrF9XHRcdTAwMDAgXHUwMDEzIXXEeK5rRIFcdTAwMDNI2lx1MDAxNsQ3xGwtma5cdTAwMTFHws/Z7ci+XHUwMDFlg1OqSINcdTAwMDLWt/l232pijWl8S2GqO6NcdTAwMDc94OPTr5IrXHUwMDAzyztcdTAwMWaQXVx1MDAxZFx1MDAxOZNYXHUwMDFmxiDU+Fx1MDAxNOCwXHUwMDE33Vx1MDAxNINDuEp4VsJItsWL+cDhJfZGsFj3myWo87BAYZi80IeSyVx1MDAxMlx1MDAwZWB1rddcdTAwMWOAXHUwMDAwRiq12/ldprlYsIFcdTAwMTLh4jUjjrBcdTAwMGWG1HTr3vZcdTAwMTk//u2gXHUwMDBiXGKZlKHarZpcdTAwMGIgbL3aeD9VUFx1MDAwN0CGuMuj+cI7p5Xp2oOnXHUwMDBmXHUwMDEzyFx1MDAxN0U2ZFx1MDAwN2L0XHUwMDE1XHUwMDExWqmeJrSLSZ1cXI2BXHUwMDFm7sv3S1x1MDAxMHVcdTAwMTnya9uU1rZvXG4kOVx1MDAwN/b+INhK/P6mYNDftMYncf1tXHUwMDA3S8J8eXLycKb+UYi+WqdjjE2NpkppMlmuVVximVx1MDAxZvaFONNt4plcdTAwMDX5XHUwMDE026N7t8Xaj7EpNFx1MDAxZvlCZlx1MDAxY68l3kNcdTAwMTBcXHq4jGRcdTAwMWSNgv2vfkAr5/OAR0KTtLym4m6lmjI5tFxuulx1MDAwN0ahW5S5aD1cdCS0lpBfyvx4PP5yw4eTqKhcXHqidVx1MDAwNMVqLsNcdTAwMTa+5dUhYm0p1zBRQShcdTAwMWNcdTAwMWVJ9Oq11Sq/YJ9gcshcdTAwMGXyOERsd19NgatMXHUwMDEyTjOiVcmXLyotXHUwMDE28i1U+StEKyqJl9FcdTAwMDNcdTAwMWRcdTAwMTBcdTAwMTWEti7WXHUwMDBixVx1MDAwN+skX0FJnCB3LFx1MDAxMlFcdTAwMDJn6SgrSIDAsITpXGL3pUZa5SqRakqSaEmO12eCXHUwMDAzXHUwMDEyh7ddSu5cdTAwMTNAuFvjKeLTKYR44rmvXHUwMDAwXGZixd2bZ0MgQM5cZvpjXGZ+dYqEn1x1MDAxZmjM98MvdLHGUvvV52idw7jmXHUwMDE43maLX20hg47RhJRcdTAwMGaaXHUwMDFhT7Qwk7pnXHUwMDFj/M3PpjihyUfkqC/iYtXe252OZPetp59cdTAwMWOZ6WT+/lx1MDAxYp7WmtxlqN/0wVx1MDAxYb6l3lx1MDAxOU3GfMT7tU1cdTAwMGY8YVx1MDAxN1tSYnKGp6Lx/p95LkbFb1x1MDAwZU04XHUwMDFlr0VcdTAwMTb0mOCZ9lYrLemS4VT+mlx1MDAxZZPcq6y1VkVKyppy5IwuRPhcdTAwMWSOXHUwMDExv5DAykaRI85U+PVYmFx1MDAwZmzenZHtwal/4C+VPCFcdTAwMWFqo1BcZuFcIlxcMcKeXHUwMDBip4WaZJiiTe6jYCHDXHUwMDEwWlx0UCbRo1xi9pPSc1x1MDAxMlWpXHUwMDE5+FLFy1tcdTAwMWbpklx1MDAxY8WLSMg0XHUwMDE1UW1cYphcdTAwMDcjQd1cdTAwMWZcdTAwMWV9coN5mVxcfPDBQXWxjz40i6paQa2uXHS0kXdSRJlgXGY05uVcdTAwMTFFlC3vP84nPlx1MDAwMMfYf61fRVpcdTAwMTI/enR/eMpKXHUwMDBiL6BcdTAwMDIshOTukXLh2kT/12PRiJ1wXHUwMDAyiT5cdCRcIlxyXHUwMDFlXHUwMDA27t89VPbAqGmLeVx1MDAwMCypUkhot3ycmJNfU4BlXHUwMDA198S/YyZ6P1x1MDAxMfDci0rFUyvtXHUwMDBm84s1/sez58TXbIl/Wb/Qflx1MDAxY3ljiugx/p/PLv3Ps6dikldcZrZvkHFnXHUwMDA0KHZEfFD6OVS/u3x4gMy0MD9TMoxH3SRELaRKO6XyPH18Ulgpllx1MDAwNVx1MDAwZp55e9G/SCk1V3KuyVH8oVxiq65h5ZMzXHT5rvU/dPxWuV9TbHhXmzsoO/W+IZN7w17F2u2bLWhaRND44mR8zvS0XHUwMDA3XHUwMDBllkFtm/iJY9uHxj7dx/3edj4yXHR+XHUwMDAyijurNek8ze71x56qP5rIXCJ81uyHkKdDLVx1MDAwNEOFuVx1MDAxMD+Y1a+SZFwi+EeF9JhZf1x1MDAwMIhcdTAwMTAqMWFoWzKUya7pceZWwsd9qrrKs7pM2HjerbmaP97tP7Tf3F6t2Xo+xz2mtq3Mmlx1MDAxZLKGqfiY8UHxcrn+pI9cdTAwMWZcdTAwMTDee4jgK3x60e+GVqiXoa/w/vw5z/u3hnxcdTAwMWLGrdrpUr9O3pZXa6/SpPZcdTAwMDZrnFMyeHwuXFzZ4NjZM+a7ITOmYP9zN1xy9Puv75yybWWyrFx1MDAxYlx1MDAxNs13iLzhIVkhaFxm7abJ/Vx1MDAwZrz/R6jVXHUwMDE5zTOc69z7wmdiTPZ8Llx1MDAxYV/NSlwi6qM+XHUwMDE4XHUwMDE377vgX3+v0fFcdTAwMWZaVCnu849cdTAwMTmJlfj0J1x1MDAxY+Dro1x1MDAxYt7ttIeq24qO61x1MDAwMqznMWh58X5cdTAwMWJJuVx1MDAxZVx1MDAwNnjtp1uo+qs/gN/3jPvuUF2v4tD/XHUwMDEz5v69XHUwMDE5U1x1MDAwM9FcdTAwMWRjXHUwMDE19qsj7C+5e/2vVrNhYUqHLfRdW5ra++nwLVx1MDAxMOyvfTtcdTAwMTE3XFxM8NtXd1x1MDAxMdj9j1x1MDAxZPw0pNHseuJEydou7Xed6jrtuFx1MDAwMmFF+Fx1MDAwNMj0q23lvSFcdTAwMDWeeMWr/9OS3d/Xp6qJfmzIpz9cbtTDoDKlXHUwMDEwSjwmQMNXOdRwjzO7nDaenPxNIPKQT/eP/Hj9N33BT+7XMDZE65X7/T2HN5yfXG6SXHUwMDE3pfNccnDZXG5Y73pfXHUwMDFlXHUwMDEzxvN8QUSmV2Ke72NiaZ6vXHUwMDEywMcodnJccn5rLfBqMN6f90b/h3dROEa32Xz4Jo+OVO9ZXHUwMDFhPGFnX2YsXHKKazdKRWPs0EFy6LGpvDCjm1x1MDAxY6v8j9+rfiiHm578O0SK7t5ZJkxcdTAwMTAkX5BcdTAwMDflvFx1MDAxYz9cdTAwMTKHW/0upn14Zs1cdTAwMWFKXHUwMDE4g7UhOlTv6GVohJFcdTAwMWO7949d9Wt2xStcclBV6Hw8Xe3wo87H9jhcdTAwMTntXFyIv6su4VxmYNA3LFVcdTAwMDI1/ebo+JneYcFcdTAwMTnf0z/m+q9pduPxXHUwMDE0i89B11x1MDAxZVxcbN2xpnfV2ydpXHUwMDEx5XfORdY+c6XTy1x1MDAwZWX3vpPgXFzKbk9cco1cdTAwMGVvf1RcdTAwMDLZPm2IS2Dun1/kr7NpzKR86bv57ITeXHUwMDEwXHUwMDE1g1x1MDAwM7s071x1MDAxNzfyb4zSXHUwMDA1TlRMoM1cdTAwMWPcSt1cdTAwMTZcdTAwMDb6Pt5cdTAwMDFcdTAwMWVcbpjQvdGHY9lcbru/lKLu9Fgry8FcdTAwMGLM9TKq9yTgu4/lXHUwMDBmcSH68rb/XHUwMDA0XHUwMDBldZpcdTAwMTWwommZZlx1MDAxNIdcdTAwMTe8v6/dqbbSskc7amTWXHUwMDFiXHUwMDAz6+9iPEPXXHUwMDFhuqnNU/SFdFD/aKiMXHRTXHUwMDFmPlxc/7bVXCIwJIVWIPN75GNcdTAwMDVcdTAwMDXbXehcdTAwMDCx/3Mwylx1MDAxZuPTelx1MDAwMk5cdTAwMDMk5ENcYlopwHn2ecNtXGbemNDJtWa+MZJNqm4ld1x1MDAxYukuO+JcdTAwMGU4gmTr//CnOsdR30bNeKOwc6gp/4z3TcL16ix/3Fx1MDAxM/fH3zY/lcdigoPb3NFL+2S3k+xcdTAwMDKxYOiPUKlcdTAwMDW2qMzd2jt5+Vx0dOjR6S5U98SKM5otXHUwMDA1VSC8/5yv/aP1dKXzXHUwMDE3zeNwpr/2Nf7NJ1wi/2c+8fjNgXTdJFx1MDAxNlx1MDAxZEbWkzae16nbQ83yrDlcZlx1MDAxZCZWMmHYS7/6MtGjyNHO1n9cdTAwMTVXfPT+stB9k45d3qWByN6xJ4EmPuKRaW6Fz1njdU2x2K9DJfxq4mYk4ttKwlx1MDAxZss+R3/dtTdcdTAwMDbQp39H//x+Ne10XHUwMDBmpFx1MDAxZS9z+36E/FdP2vTgZZwgMj1cdTAwMTTWl1xcLIFcZnpE49qyfSmqg3WOQ1x1MDAxNmJcdTAwMWFAf7Sn/Pljyug/NG3ng5qzuVx1MDAwMlks6yvYUi5cdTAwMWSdMvpwYEtnXHUwMDFkZJ0n0e2UO1x1MDAxOHM+XHJ1XHUwMDAziFxyxHt+dFx1MDAwMY9MUOlV/0zKKsNEyvNcIs0j3I5q6iA/+s1cdTAwMWJC5fitzlx1MDAxMG0/pGT1ToU4t31W3e9sXHUwMDE3ulx1MDAxNlx1MDAwMNxUXHUwMDBlJFx1MDAxMkjjQf4/j4s+OYPaPPlcdTAwMGU/eZaB5uBwXHUwMDAx5Fx1MDAwYlx1MDAwMrDVtI9cdTAwMWNxXHUwMDE2vb6P2FxmfY60O/rBSuje4JruMLm9022TSOH1O4PGtW+/qf/pz/3W31qaeb6k2z0hf5R9pVx1MDAxMMPa21x1MDAxZaT/KnxcdTAwMTjthO1vpFxuoFx1MDAxNFKxuqontqjnpO1zp/on8fFGXHUwMDE0W3V/O1PutmKPtbFQr1x0XHUwMDFlYX7YXHUwMDE2uDj0Q0eSLYmdXCL8XHUwMDE3gyu3vEDT7VwidtSFXHUwMDEwp9jOflH4OSw/ujAwXHUwMDFlj/DfxFxi9DubY703YWfc7Ukhb2Qm7Vx1MDAxZvvoL/140GP3Jt1QOieF8ZS/161NksBZxlIkf7mitk2/K1x1MDAxOFx1MDAwNWnj8ejBqPbpxdx6XHUwMDA3XHUwMDFl/9gn9lx1MDAxZvCGt1x1MDAxNVxc7Fx1MDAxOZtcdTAwMDaS/zmDsKXPcJZcdTAwMWL/XHUwMDEwiFx1MDAwYjvnbFx1MDAxMeODMbPFzZ/vP37db21L/3nZhVx1MDAxNobQJif9gYvH3V/CXHUwMDAxyUSa+608XHUwMDA37ITF0ihcdTAwMTLnP35ZvdlcdTAwMWZ7+Fx1MDAxNd7xM9Dq3s41TmTAi0Zp7tvnhjpG8lxmj53IXHUwMDE4XnxPuv5Jn0rRXlxy/8Ol71x1MDAxMVx1MDAxZjdoc1+IiEe/7SAkXCJcdTAwMWRvXHUwMDA3SnElKpS9u0uAN3yZzzlcdTAwMTdtv/95XHUwMDBm1d/XXHUwMDE1ZYNGPirxSvtcdTAwMDDKXGL1XHUwMDE322nv/U9sP3lcdTAwMGZRNn9M/0Xg8LRCXHUwMDBmukqY2bl/PSRSXHUwMDAyKFx1MDAxZbr7eKVcdTAwMTPhRt3EbzT5sufuKu3HwaR/re02+3aXc7FcdTAwMDCO/4XKzsV6ZFx1MDAwNi5+9lx1MDAwM/GfXHUwMDAxs6WNrqj0j5bMpYtcdTAwMDHKg2rjJWI4di2PjyiCOZ6Dec1I3Vx1MDAxN1xiXHUwMDAyMZzNhp6oJCRxJj72P0tfWUBY71x1MDAwMzBe3sBbLYxSU1x1MDAxMFx1MDAxY7/IXHUwMDBmZqbVXHUwMDAxm1x1MDAxMvil5+nhXHUwMDE1J1xipUZY8+Hz0+9qJeVVXHUwMDE4O/x/WkP9e9t05Xd/ysur/1p777zBi0lOOsTqeCx6U0/GK/0l4W9dmZ+5X1x1MDAxZKHxkdn/PzTxw1/IjSU9XHUwMDAwvT7blr9cdTAwMDNtX837iY2x0olvaGjFW5dv130lWqdMb7V6o/JZ5IvHXHUwMDE2XHK0XFxcdTAwMThDPn7EtVVcIlasyfhj//SfrcplXlGZ1pf074NFXHUwMDFkipB8XHUwMDFhlEBccjSH85Ot30s7kG8+XHUwMDAzTHR+x003enm6XHUwMDE0yps3u69xyez5/4JjaKFyXHUwMDFmvjU1RVxyb+5TrlZkK+Fv8ZVcZvxeXrhUyJnYX/lcdTAwMTeZKuRrd8xcdTAwMDBcdTAwMWRcdTAwMDQ0hYFcdTAwMGVcdTAwMGV17WG3QtNcdTAwMTdcdTAwMTHqx0/ymJh/7EqWSd7co2ro42umPFO+7Vx1MDAxObpcdTAwMTfEXHUwMDFkReuxXHUwMDAxz1Dx01lqXHUwMDBm6WFcdTAwMDcn45Omb3tyvbfQj2E/zlx1MDAwZX09XHUwMDFl1mb7J7lweuZEOFxml/8mPvbtVXmdSjzkI/2uRZ3tQko+j3/KiDHaZ1x1MDAxNz9rqFx1MDAxOPpfXHUwMDExmUxjXHUwMDFhXHUwMDAyVNQvLVBcdTAwMTQ4XHUwMDE3XHUwMDExwFdcdTAwMWZItjaq6/taJzL2tdj/yEePXHUwMDE5XHUwMDE2t17neWZcZt678Vx1MDAxNb3nkYu2l1x1MDAxZjxA1rix3Lh+9zlX9Ytro/LbXHUwMDE2mHuofntYPudMY+84UaamXHUwMDE469P3/5y3/bOZ0afKnvdcdTAwMTN/kCWqeWMnv/tIJm3XtUpOLvhcdTAwMGLv6Vx1MDAxODdzsJJcdTAwMDVmPGM/9oNYm6VcIuKS1TxeVrWlovr6/4WAXHUwMDE0v9xvP1x1MDAxMFx1MDAwNsXWX/tHXHUwMDFmJ/zCMZ7iXCLMXHUwMDFmQ+2f4YZcdTAwMWL/mq9CJsaKJ4Oibot/bYybLsayoNrtXHUwMDExJPRcdTAwMTgp6PvweM0rZDT0cmGHw6jnIeNcdTAwMDX/PFx1MDAwZiFGpq3icVx1MDAwNuss6Cez5lx1MDAxM8KU9FxyWdw6Rlx1MDAxNWl3fmlv2zlkYFx1MDAwNyi7XHUwMDE50nln/DUj6NBl1KD1xsF3VrIj7aOvXHUwMDA15bOaj6bqvU3FJfpAPlSuYP+NQJRtlrGs3D/L8sBjg95Wqvs8XlNxXHUwMDFmflTWVfNcdTAwMWaiXHUwMDA1KoWz7Fx1MDAxY9I/MrHCXHUwMDBm77uQ6ybX2kz/8P06XHUwMDEzuFx1MDAxZc1cdTAwMTZLjccwZFx1MDAxMtyjXHUwMDEzd9Lfgqjt0MibXGLZ+Z1BfPGQXGZfNDP62e5eS8rdMe6wm1x1MDAxYoCe/cSh8s+JU+tCJCksUi/+9nBwbMvTXHUwMDA0U4Tv5lx1MDAxMORqY/yrqUrGetNhQXVOa1x1MDAxZDmQZOS/Oet0XHUwMDFlUMiSXfKtXHUwMDExIf+lUe6KK1Se9a5cdTAwMWaSmOCprU1cdTAwMDH/O3/G8I2ytF1WfpTMo0E5/fBcdTAwMWRcdTAwMDe3Rl9cdTAwMDGeU2OXqu9cdTAwMThDL1x1MDAxM/BRXHUwMDBi+LCa/PqmJD2JXGJl6Vx1MDAxYVx1MDAwMlx1MDAxM9btJ1x1MDAwNtEhWXTvn+xbclx1MDAxYvl4XHUwMDE5IT6IwtypRFx1MDAxZIWNntHTeWuFbGtdUN23q1xc+uZcdTAwMTn9clX/flffw+F/zcviXHUwMDEzcnZltzxcXCRcdTAwMTlcZmNF2fruWJROSX3xzd96I1wiq9yKXHUwMDAymVx1MDAwM1lIUKugXHUwMDFmP1x1MDAwMmz/uquebeuUgkuCirHU1pA701x1MDAwMOsqIKSpXHUwMDFlbkmv/aFOgE61mP9cXL5cdTAwMDVcdTAwMWVcdTAwMTXGmVx1MDAxZlxiuOlk7/zs/NaJqFx1MDAwM4eg4NGx8yh1YVx1MDAxYsU4aYBVhTTO5UDjcWjIKYV3vWRcdTAwMTXLXHUwMDEyr15f7Xmh6uiOWFx1MDAxOWyNLqjx0vBcdTAwMGXewapBQXfqWnNxKVx1MDAwMLpccjrsv1x1MDAxM1x1MDAxMLGmwsnuJ0gwS36hf77i/rBm0kBcdTAwMTaGg5f/gt5cdTAwMGIoXHUwMDEyfpT6LVx1MDAxNFxmci4xIcdD45RnXHQsirWyZXDHu3jVrttcdTAwMTNge7CKXef1oUit4lxumob3PTX97DVzxD+VdUeLh+tYdNdcdTAwMGL65SiAl/Flr0G+XHUwMDA08u3YXHUwMDAw/PUm62DsXY6E3OHLY1xuYUro75xq7SYrrtn5ebdcdTAwMTBAlvlcdTAwMTBX9YWApaVcdTAwMGVClslYxH0+2SPtX9pcdTAwMGXXXHUwMDEz9nKDr21OITNEXHUwMDE5slx1MDAwMvGAul5cdTAwMTKAXHUwMDE2QXGZ9kJG40FtR1HYsW9C+Fxi7Fx1MDAwMXg9epqi/X9dc47rg9krXHUwMDFm2mhcdTAwMWZ/U932aGBjLY7ZLG/tlF61/3EgXHUwMDFi0cUmXHUwMDBl0tk/WVx1MDAwMawgkkw9YPm+c/9IZkj4XHUwMDAycbn7PVx1MDAxODdcdTAwMTWx3dxwuNieT4pvJYRcdTAwMWY2OLjinEd6ftSbjFxi3KJcdTAwMTMslLt8XHUwMDFhZXWU4VZ3z25cYt2gXTxcdTAwMTWoZvPFIFxiXHUwMDFhSCbVX42Sp89cdTAwMDI7OFvb2D2sW/xcbktcdTAwMThcdTAwMTLW4Fx1MDAwN/E3XHUwMDEzrC2j30FptDSvK4Wx9ObStD0ulL9cdTAwMTWp+MuQpPVpxPlFO7DHXHUwMDBlMKtIti3YjXbMoXpafYJKQbw5byBiMlx1MDAwMMFGQLoyXFworFx1MDAxMFx1MDAwN1x1MDAxZDVcXI3EXHUwMDFjWO6x7DfQbMigrD60v9/6OUTzyo68heqiSlx1MDAwNjdcdTAwMWStK6+NcG9pq1x1MDAxMJdDsqDSa5PpjJRznvxVYI3Sso5W/3BcdTAwMTLuXHUwMDBlXHUwMDFkpM6bIFxyQmjYXHUwMDEzklx1MDAwM3DdXHJcdTAwMDRaylx1MDAwM604NfK4IDv97Ue486yPyNdcYptcdFx1MDAwNKRf6SuvUb2sgk9cdTAwMTKkdWFoWXfWnaRum7PBWmchvVmtdNCbxsY6XHUwMDE47C+3gb76K1xcdrHTqVC9dYS9bndcdTAwMWa+wVxmoVA49ORvTMLXr3YyV3fQzpo9hoXxcFx1MDAwNWrwqo+c6bAk/JDfTWsj71HAjMvnYFx1MDAxOVx1MDAxZLRcYsCT4SxngDQ4XHUwMDFhfFeDXHUwMDFiNvJcdTAwMDaokodh84icUrdN3z03R7M7XHUwMDFjXHUwMDFjfVn+XHUwMDE3XGbneDb6zJNcdTAwMDKAqFx1MDAxMtm14lx1MDAwNo/Jl1x1MDAxZIxC+sf5XHUwMDE23Fx1MDAwMVHZ0FRcIlx1MDAwZZjMiftJnnFHs2u2Lz1+PNjUiDtKXHUwMDE4JFx1MDAxNUhcdTAwMTlcdTAwMTn8XHUwMDE5caIkjuNcdTAwMDGGmmX1Js5o92N3mM93LJMxL2VlWaI6cYfPXHUwMDFkOHx7Xc3rXs5kQmikPppcdTAwMDHFMWojXcvs4XXsqjeUZErmOyPib3qhXHUwMDEy5YMlXHUwMDE15iS1nzd4mlx1MDAwMERcdTAwMGVllCuLXHUwMDE1ufxQXHUwMDEwXHUwMDBisYN56IY7jlx1MDAxM+9cdTAwMDaiQ1x1MDAxM1wiXHUwMDExXHUwMDFhsmpdXHUwMDE3eLWlKpzyo/vFcpHLhu9td1x1MDAwMTi2hvmaLZqiv7SzOm9cdTAwMDNdXHJcdTAwMTgoXHUwMDBieoM583A+r3fAlTWWsbFltyFcdTAwMTJ0XHUwMDBmRtHLJMZcXP12WaqWPXmnXHUwMDFiJtdcXHic1cSd0Y9ocOrWg0FcdTAwMDBgk0wr5YlqNr9zWOrgtN7yPGprKqHGzoO2rOL07Vx1MDAwN1jpXHUwMDFhw1x1MDAwM4KUNL6BXHUwMDFkgk1cdTAwMDZ39bi4Zz2mNeSiMc56b6fZ/iit/M55XHUwMDA02mqcdt6r0fJO2m3GXGaEY/rmcFx1MDAwMUJcdTAwMWaQfLNH/KEt1/Od3PUjPpTqb2dcdFxiXHUwMDEy7jquV1x1MDAwMeRcdTAwMDCsI6iPVk9cdTAwMDXwevPguufmXHUwMDE09LtuzULukm3u+5tcdTAwMTlWaoeenW72n6ImXHUwMDEwzFx1MDAxM8LH4okxMJ15TKeKTlxmVeMrTKPWTsNRTVx1MDAxZtWNXzqnIUptQugt/KZ1ctt7T1x1MDAxOFH7KDHti1xi0OtdKo/cWSgpnlx1MDAwNbsoXHUwMDE1ylx1MDAwNrxvJqxcdTAwMGKttjyTXHUwMDE4kpo48pdQ8VVVhZRcdTAwMDLJLzBdy/UlL/DBS1x1MDAxM0KJrFxu1HVcdTAwMWGfeLGP+pPbuSpM6lq3n3f//Fx1MDAxZaNeJYz1r+Pl77rhwr2QoI5cdTAwMWRcdTAwMWXiSaugXGI3rfaVX6mZXHUwMDAwMYVcXEMwQUD8pNuYtC1Mv1aPuWhcYvVPaNKW5nFJXHUwMDE1XHUwMDAwPlx1MDAwZWd6fI/M6pX8fz5Vrum4luamaJTqstn9avs8P/td1KtcdTAwMDGCRyxcdTAwMTJbqDGCTLBfUlx1MDAwMPVcdLd2rWjfolF7XHUwMDA3IVxi7MW6Tq68XHUwMDA3zvry7KsrjWXLiylZinqnVdMzvevzuJpujqJcdTAwMGbnfkZcdTAwMTntwu9cdTAwMTeJMebIXHUwMDE2WzN6Us0zXHUwMDAx8VP+dS63uPQ8MmtR+/zf3fJcdTAwMTRcdTAwMTKJlOB44oWxXHLzbV5cdTAwMTUwk4vncDO70NnzoMxEXHUwMDEztP9cdTAwMWXvPmNcdTAwMTI/XHUwMDFibn9cdTAwMTJ8XFyqcFx1MDAxOIOLu5ZacbatwIOTXHUwMDE1TI99fYXs2DwyOYKuTLzGcGfyXHUwMDBi8oyMKqqYbSvtXHUwMDAzXHUwMDEz48vTajNb81x1MDAxOEhybC4551x1MDAxYi66+5aRzsi5XHUwMDE3c1x1MDAxOaahdq5MeieDzrpIgGj6S/6EJtXdXvI0clx1MDAxNJ+4iVpltFxuS3VcdTAwMDfCXHUwMDE2XHLiXG5iWiSjYOZwVYNIztFanKZsR7k57X3ARldcdDPdXG5iXHUwMDEydZpcdTAwMTmNh96QZOarSOzXPjs7WX9cdTAwMDeMmzRUwlx1MDAwZvpikiT/UIRi0uSUyHk9XGZq79aMdaMzJ5sqQHNBlzREXHUwMDFlkn7DyCj7wlx1MDAxNEPlRCyp7jM1XHUwMDBl8fY8d18wrcD9XHUwMDAxUXY7XGaFhpOJ+IOJuZRXpDTlXHUwMDAzlEyx+66uhVhr+1xuYN5mjFx1MDAxOc5p7Jo+XHUwMDA37rlcdTAwMWZcdTAwMTmlSZOjXHUwMDAyXHUwMDAyyrn2XHUwMDA2JU5cdTAwMTDh9qNcdTAwMWHHXHUwMDAz7kppyFx1MDAwYugq7GPRWqemXHUwMDA2+jNGIVx1MDAxYr1n+j16n3L7XHUwMDE2iabnXHUwMDBi8/1cYn7oIZTa2Vx1MDAxOExcdTAwMWG0WjnxSMJUwZ6mcFx1MDAxM1x1MDAwNmCMRlmagTShXp3caTtGou7A/JOzXoOL66IpfXyiUZI5ney6eHdwV8eINlx1MDAxZtPO//1cdTAwMWNcdTAwMTjuu7Gt338ytnGc1O9cdTAwMTHheicyXHUwMDBmTyqr6JNtXHUwMDEx5LCiYVx1MDAxOaWeXHUwMDEyqXf1to3iNFx1MDAwNmdHYsvAul2SonSOoYs2V507llx1MDAxN826XHUwMDA0+Fx1MDAwMVxmiPZFVlx1MDAwZcFcdTAwMGUgv85cdTAwMGJZ1PKrq1x1MDAwNJ+++cmMeGFY+zRcdTAwMTfvfYh3dmnE11x1MDAwMvJit8RcdTAwMWFSR7BcdTAwMWVcdTAwMDAmxumUsCc3vZCcsPQ0RNX6XFyZ9fhcIuRjxKyb47o3cTDIQkLbtDbLPIxcdTAwMTCI0LMsRJqm2NwuwPbMs2LE2bFcdTAwMWb7dOZVXHUwMDBmsGXFXHUwMDFkXHUwMDAzlpCmiExcdTAwMDBodWBcdTAwMDO7jdgqSviosrOdXHUwMDE5MpaoLy9twTPU3mRhi73vkVx1MDAwMCrgwMNcdTAwMTnpnaJY7tlMmHotR4alrYVcdTAwMTmKXHUwMDBlXGa9rsnGfXScmc3lNX1TX6SAV1x1MDAwZr7Mq4tcdTAwMDNhSsP6iq5cdTAwMWNcdTAwMDBOms3VXYFOgWw+cnNRNJswxfF4c/N1to6Z5C3WXHUwMDEy7UPi70zt6TexjpHs83j6pj1cciWKN9hcdTAwMWY5XHUwMDA1v1JMYL6FsU68pVf4UYRVgW5cdTAwMTNcdTAwMGVcdTAwMTl2h4iY6Ilfo7pyQrdcdTAwMDbMXHUwMDA1+FS5XHUwMDAwq9CmdFi5grXY0KBcZlx1MDAxNtjCLy5H55BcdTAwMDBcdTAwMDSzMFx1MDAxZYKpU1xyvlx1MDAxYnTf+ehe365egJrQiHVcdTAwMDDsNa4nbFx1MDAxNl6nMkmlS4f9MdNcdTAwMDZ6XqtrmJ+1K62rTo4qU1/fJK5cdTAwMTaL7Vx1MDAxYulcdTAwMDVWcF9Zikvej+egXHUwMDA2a0Vd7PSxc32zmZFcdTAwMDP7XHUwMDE0XHUwMDAw/DGM+Eo6XHUwMDA0flx1MDAwN1x1MDAxZVxi0Vx1MDAxM/mtbayGo5c5kYCBNn5WdciUSZVcdTAwMTjpzvuwbKhcdTAwMTT0XHUwMDEyeb9IXHUwMDFh1F7shyVpb1xykrhcdTAwMDb2ePFjPlx1MDAwNFx1MDAwNufbN6umXHUwMDFlg/9cdTAwMGVcdTAwMDE4e7jFwoy5XHUwMDBmdnB/XHUwMDEzMVx1MDAwMSmtxJ1igoJt4ZQ7XHUwMDFkJL3MqtRhT5pErU/SY1x1MDAwNStcdTAwMTBYY/JwRKpJXHUwMDFlqNa/J8xfn9b8eVxcW1LZ+GYzO1jOKfxRZOZcYrLO8NVqtlx1MDAxMk5zPEmD0bLL1raDXHUwMDEw/cIot+08XHUwMDE0tftS/cJBXHUwMDBikD75xrK1XHUwMDA3belcdTAwMDO+Plx1MDAwMDEgN3pCyEA/xlx1MDAwMNV8clx1MDAxZnt2XHUwMDE3Vlx1MDAwMlx0XHUwMDE4dFW5r1x1MDAwNeZcdTAwMDL1rtQ5kcSdkPxcdTAwMGb1glx1MDAxZpp1alxiqb4zXHUwMDFkMkxcdTAwMTnFvmta4tvRL7zkqC5cdTAwMWLRT130NVaTNtNwbdo8nFx1MDAwNllfSFx1MDAxYiGVooKe/aonfcvIJ1x1MDAxN2hYMDBcdTAwMDIsglxuXGKP25RcdTAwMTNsxHzHXHKhSDpcdTAwMTaig1V0Qpj6jkqd5erTrXygLL+z+NLuXHUwMDBmd/qb+J1302xcdTAwMWY5tYA3hS7wXGI8QFx1MDAxMqNlhlwiXHUwMDA0nM03XGbAoVx1MDAxY5K7QVx1MDAwMWTfO2/wXCKbZopPtqXib5NcdTAwMGLQtIo9aDH4RnufZTWGm2+j1+bA8yx8aFx1MDAwMtVZXvSiXHUwMDFlu3zFsL1cdTAwMDJuZqjaKtWh9lx1MDAxMlYhdJReX+UgY6Z/lJjomr6XyFCKVZJBL0CBk+/vi3H36DVMPGyCKlx1MDAxNpVxc1xuvjeZy1W3cacoR1x1MDAxNVx1MDAxNnHFjVXdXHUwMDEyP1X4XHUwMDA1yvzCXvqPpyGlOPdcdExuRKkmMCvQcf4q9iHHxZ2xp9DcXGZcdTAwMGZQyMeDXHUwMDExT6dTVuha6YmmxyhfyEvzNlx1MDAxMqCzXHUwMDBmmNBwVNNAqon8TPpnU2liOz6anzOTXHUwMDFlMq3kK1xmmGJcdTAwMDdEi0Nhmt4sXHUwMDEzUIOat8Q+8S5cdTAwMGIlM3Ij6ThcdTAwMDL4itwptHekXpTdXHUwMDBlmlZjfc2SOFnkuNrpQmROcVx1MDAxMduDXHUwMDFhJ5p3vJQuiONya5yca61CM4k813Vnj8iKtdRcclx1MDAxYovTxaksKiadclx1MDAwNWtcdTAwMDD5hFx1MDAwNIikw1x0XHUwMDAwZG3gpLY6PIMnwG5cdTAwMDfgoL0867GRdEL7g1x1MDAxNGj9cFx1MDAxNTjL/5ti+n1C1kcupEPtbTJhsFx1MDAwMjkxkaWh4lx1MDAwMc/4fuT3tGXy+Vx1MDAxMlBcYvFgn/1cdTAwMTDz4zdcdTAwMGXehiGX5ZmcXHUwMDFigWFJKuNcdOA5fmU1MIw8xpk2o/uwsFx1MDAwZpLpVXSnXG6+YHvA4y5cdTAwMTTVN7/gvqo791xmQFx1MDAxOdZxlsBcdTAwMTC0XCJytXg0LSRe4Fx1MDAxOS9+XGJccp5ZyVxciZj+bXAn+Fx02NRoXHUwMDAxlXDF7e3kXHUwMDE3ZZvWlJ3+lPNi7Ho9Zlx1MDAxMFx1MDAxYyQ9XHUwMDA0MtDBRrZXy+hcdTAwMTeQ0lxcp1x1MDAwZuNkN2Ctcfm1XHUwMDEx6K/K5iuXu83sXHUwMDE2s7snQFx1MDAxN7hcdTAwMTYw+/FRqcEq1/eqaHTyzTlqsEOoO3lQVqSUXHUwMDFhTYAgXvRcdTAwMTZ9o5NVXHUwMDFl+qBVUud3L01cdTAwMTaASdFcdTAwMDJcdTAwMDKrfGTAoFxmh9IzNodvbCD4fMf3jalQNe7iJ4CU0DqM1sRjg4Bl4INcdTAwMWVqwJRcdTAwMTbYWSSvqYXP1oqiREfIU+n4XHUwMDEwfyhvTq6TQqmT0mehqTZcdTAwMTNSMdNh/IXSjoUmlWVcdLa4Z6dJXHUwMDA0VXPLXHUwMDA1li1cdTAwMTHqleswRDBEVNc+aFlGOlx1MDAwZp9cdTAwMWFoRNIqZD/qycvKcWy31L+ur17Ngejd8utx3bNcdTAwMWLrMHgmZ1x1MDAxNzVcdTAwMDIvfOBv+KEp/0rERG5cdTAwMDXKupZXXHUwMDExYqmIXHUwMDFlXHUwMDA0J3gwXHUwMDBlXHUwMDA2aVGJlWTDXHUwMDA2dYtKwi1Brl/S2DqNsOLgRCf6bL50+E2CUGqxTe5cdTAwMDMnXHUwMDE1IPPNO/5OXHRwZCTw71wilaj2l1x1MDAxNUR6XHUwMDE47DaBdKuP2StcdTAwMTghe2hWXHUwMDE231x1MDAxZaFcdTAwMDdsxdve5Z6QoU2xZqPa+ZqiirYxrMu2dnxcdTAwMTLlJcP5+dqpNZpUeavR8VWjXHUwMDE2UOE5h6KFwn5D/3E/Z7rpT95fnPv99JZK16V1ktb3Ta/1XHUwMDEzsuH275RcdTAwMTGJ+WNReZve65Z2bfMqNaG/fVWmzWv6dqK8XHUwMDE1YFx1MDAwMLOFhb56v0Fccvv00Vx1MDAxY/pcdTAwMWRDlm2x+Jr+/VVtio4/kTKp21x1MDAwZUZcdTAwMWZ2NbTozH5cdTAwMDWZ56SzhSdMLcj40OZMeWX1gCg4WWtcdTAwMTK/Nlx1MDAxYqPqNFx1MDAwMVx1MDAxNPL+YrSAdnRcdTAwMGX9alxuylx1MDAxN1xmeSw8ZoVcdTAwMTHzLoNb7NFcdTAwMDb00FxchO89/UDJtLBY1V1U5MzTR+XlQ0U7Wn1Ln4FcdTAwMDcqhnxwrK6cplwiICZTXHSGgZpKrabHSUBcdTAwMTkkq+5al/RcYlx0+Fx1MDAwMi17XHUwMDBlvD9cdTAwMDTIuzyYxt9ZqZVoXHUwMDBi+faJSUxcdFx1MDAxNTXaq2dswz5cdTAwMTH0aG0pkG5cdTAwMTIzsZ9YxILdbUxcdTAwMDKJkdm1VTlp16DsbZoyM4pcdTAwMTYgaPhcdTAwMDTVQlx1MDAxOVx1MDAxZL03XaVjiTQxXHUwMDA1Rlx1MDAxYtNBdTTSYFx1MDAxY6FcXL7ksdrtlNS+uyVcdTAwMDBtbMK+2LVcdTAwMDKqmCQ/wkhQJOtHTdyAMUB9aIPtKiP9QK9+jJxPhrD4zmjwTWtzXHUwMDAxwuNCgYjKp6HT8Fx1MDAxOMFZKTlTI1Xe1i1cdTAwMDH2Puj25j5ujJamtVxcyepdfOU5c/lOy6/1XHUwMDE5byqQq/L7+necpFiVpT+8LeSskVxmdNr5uGMoXHUwMDFiw9NSJUfHbFx1MDAwYqT1+IpcdTAwMDW5cifTReFTcVx0iyHVZytcdTAwMGaKfuPN3E/Jpj5EkGknXG6Z/Fx1MDAwNyTDutPrYTKJ4ZGkgeM5XHUwMDBl7cChXHQ7ro2VapMqpVx1MDAxNzJcIu1cdTAwMDdbOzfNI66fn1x0K1x1MDAxYd7uXHUwMDE3RDFC/2FcYlZYQXJcdTAwMWO0uLKmKSHBXG5BQLpXtSAngPqTmXRcdTAwMTVC9TrRR/tcdTAwMTLy7760j1x1MDAxZl6jajniXHUwMDE2Y4/Krqy0YFx1MDAxMemuTpVcdTAwMTLhmIZJOpHPXHUwMDAwer5cdTAwMTmW7dBmj4NcXDlww79cdTAwMTCzXHUwMDBipVx1MDAxOEXH+/XI0oWROMnjTj4zrFx1MDAxObrZwFjkrjZpqkkmZpkqaSFLXHUwMDBis3ZcdTAwMTA/KdCLr2VIqN/NWqmz5vBcdTAwMTT1yzd4+lx1MDAxMLU03/T/XbDxUUHbXCKt0i2NPPlDZ1x1MDAwNWlcdTAwMGIlZDc015RJQ3tcdTAwMTJcdTAwMWQ0R2I9XHUwMDE2XHUwMDE3jWRcYtLVhFx1MDAxZSqALD6s+Vx1MDAxMJ5cdTAwMGaxXHUwMDEyz2xcYurXXCK3XHUwMDA21GNcdTAwMGXfTVNxXHUwMDAxyK1mW1x1MDAxN+D6JuRcbpHfXHUwMDE2NEkygtPzVFx1MDAwN91niKTTXHUwMDAyKyw8PrOsPpDLPpK80okqg1x1MDAxOd2S3mqPjpV2MGixsL++flx1MDAwNjFcdTAwMTNsJlx1MDAxMHlGMiDyXHUwMDFlWJPjJ7BebCTNLItbcMZPXHUwMDFl68lcXCb7oVxuXHUwMDFkXHUwMDE4I+VJ1JpcdTAwMDf6oPBcdTAwMDRQpZlcdTAwMDQmWcTAtifNUOlcdTAwMTEjwtLxgaT4xufULepDhjuOVVx1MDAwYp7n+Jspc1x1MDAwMduwabUkXGY9JUn/uJy191x0jDGT+FJrolx1MDAxZqbAi1HZ21xudlwiQt/aa2KhXHJcdTAwMDZcdTAwMDV+XHUwMDBi53iybLpai3AqXHUwMDBlfuJcdTAwMTZcboa0uXdym3VcdFx1MDAwNje21yb8pvRcdTAwMTS/XHUwMDFjX4ch08ajz87Hv1uKXHUwMDBmt2eiK5tcdTAwMDfxe1F5UCCZb1/aIfkwNepcckpcYopcdTAwMWNGyjQv/YNIXHUwMDFh16iO871qpGRcdTAwMWWPPVx1MDAwMVx1MDAwYpmJNp3HqlSwc52vJfWoMl+jVXY9vXNcdTAwMWFcdTAwMTPRYeyMIfRcIpBcdTAwMDH46TfHsa2ztGBcdTAwMTJcdTAwMTTz1lNzXHUwMDBmXHUwMDE19yY+XHUwMDFh8eycv1x1MDAwYnteblx1MDAwM3u1VI7cXHUwMDAw9ok5jkrx8L0jylx1MDAxY720RI4wlZVjN0pZdFx1MDAxZXG8v1x1MDAxYVx1MDAxOD7tKt1YVoZcdTAwMTk6/dpcdTAwMDLF3VbVmUy7P06MOZaq+4pGw29cdTAwMGZAauVmOkH7/5F13lxuXHUwMDBl4uxcdTAwMDJ9IFxuolx1MDAwMZdcIuecO4LJNjk+/WW2+ndvP/aA9IVzLCE+uVxuXHUwMDA1x1x1MDAxM3S83TYqXHUwMDAy0Mpz4eNXblGsbVnNklx1MDAwYvP3XvZvXHUwMDBmXGJsbFx1MDAxMlx1MDAxZEs4P1+rv7N28SSHeNvsbV+6U3hcdTAwMDRgWNqNhjfg7oUkXHK6jYTyu6gltGaqUJhcdTAwMTFcdTAwMDZcdTAwMTHar8ZcdTAwMDXxeogq0iO6K+aWMmSVN4FPO+DOXHUwMDFjXHUwMDA3JPtcdTAwMTKdq0FlOfJK5qOV0ThXSFx1MDAwZspzvL2MpkxcdTAwMWWOiZz0XHUwMDA3XHUwMDE21jnHTlWDnYc9vJROmPtcbvpcdTAwMTiPdLTjbMbcT4pcdTAwMDZw57xcdTAwMTFcdTAwMWKYXHS+5Fx1MDAwN3K8z+30lW5cdTAwMDfbZOHuOaBcdTAwMWZNbVa/f3uMWPpcdTAwMDL2i5Po1MHBvI9VJKBva1WLmVx1MDAxNSXAXp/j3t2yin9cdTAwMDHV+qnWkTH/lHjWPN8w30H06iBcdTAwMGYsxD2H1dYzMMTV+1x1MDAxYtSlXHUwMDFisiW9OtU22Vx1MDAxOVx1MDAwMzc+lcea2CU17SXSj0iNXHUwMDFh8ztwiaJ3LVx1MDAxMreHyVx1MDAxMp+wKdz8hKhcdTAwMWZOXHUwMDEzkIxcdTAwMTN6llx1MDAxZFx1MDAwMru0qkLA5NQ0baszQqlEsm9cbvHlXHL4fXN07Fx1MDAwYvLw5Vx1MDAxZekk1njscFC9XHUwMDFmvKg+XHUwMDBiR5pVMSFQY3DvUlwifH+AIFx1MDAxN/CZ9yag1P2KL2BwWsfxNIdVn3S+9SBcdTAwMDWkuDVcdTAwMDXoUrX4XGbw6U14v4ZBi6jJJX78/4jnIDxcdTAwMWNcdTAwMTHw7Ns1PVxiXHUwMDAwUFx1MDAwMb7n7cC+22n4p2bVZDo5toCQ6SsoZtGaJk1Q/YNcdTAwMDOfXHUwMDFhgFxmo0BYpd96U1x1MDAxM1pyWJn9QpYvbYs2dTtlsvTUP1BcdTAwMWVcdTAwMTBMkFEvsl+f8o+4T1x1MDAxN5G4j2+G5Xa8mm144XpFQlDBNJlcdTAwMTgro1ZcdTAwMTlttEHVSFx1MDAxZM14iEYwXHUwMDAwtYpRjkn8c+KJUeZMXCKN79KGXHUwMDA3+7u8XHUwMDA38Fx1MDAxM8WU+JaSu/9mX75cdTAwMWbb6FxuoODfQLNcdTAwMWTv9bJ/oLVFvegvlHlAy8GWRlx1MDAxN1x1MDAwMIjC95Wq7fz02zRD3VXonFx1MDAxNFauaiCl2sM2nFCyV0kn2OyY5KP4eFx1MDAxOev9XHUwMDEwPLnKftXFfNeMelx1MDAwYt5cInXkKaV1Zlx1MDAwYqdXXCJAXHUwMDE5XHUwMDE0XHUwMDBlavFcdTAwMGZsPi5cdTAwMTiru1x1MDAxMOpHXHUwMDAxiIIrok87s3edaIfIn7y9T+nZ5EzFjOyhXCJcdTAwMGLSXVx1MDAwMpWNasrug4/Id2ZLv+/CkOKMi1x1MDAwNdOJsfDlMpytvvpL+m24SFx0MT9cciuvudE27W4xI0dcdTAwMTDMpd2+b4fDWm4kqyDDuN5sUlx1MDAwMmJJ/SpcdTAwMWL4XHUwMDExw07zacBg6JTIYOuJTsXhXHUwMDFk0TZsOJE7wquyuFBKiuKGiTGv0dlcZqjxRcPUUDNvITxcdTAwMTh9P66xPNv85CNcdTAwMDNnVGA0SG7108g8wcmBIYXGOE1WXHUwMDFhvj8tfNx8TlnL/FPex9Z7OirBPHGi8fZcdTAwMWK07LfSTDQ2WUFSoHWdXHUwMDE3gzfhOzBA8zLUta9a6SXxXGLR3+VcctSpokPkv7+WpFx1MDAxNX5UutCxUvC73fW4Zo0kh/PUoVx1MDAwN66oi22qI3CWQlxi9Fx1MDAxZkWzJJU9is5cdTAwMTXzwyxcdTAwMGbTfV2zYL8n8/1MXHUwMDEyQmfdXHUwMDE2UFx1MDAwNeku23BN9lx1MDAwNI5cblwit79T41x1MDAwNfM6t1x1MDAxOKr+3lx1MDAwNq6F+P1lnoL9fYrLuyrzy4nO+V0pS+yMzdxki1x1MDAxMcuMLqOTu7O80bSdwTrfWCbGp9+IXFxcdTAwMDdmXarYT1x1MDAxZYE3XHUwMDE00+1WkDnRzqN5/b0/o9o6wZrtubJ7wbWV5btl4HWkt8ptXHUwMDE0Rykn1uNcdTAwMGIuXCJcdTAwMDD3JyjzS3pm9lx1MDAwZpfxe1xyXHUwMDBi3iHrSYXZblx1MDAxNeP1XHUwMDA221x1MDAxZlwiKV5cdTAwMWXJqS6iVazlXHUwMDFkP3osXHUwMDAz9ZWotS7Opz20+WG59r1cdTAwMWVmgsdiXHUwMDFmjf5cdTAwMTO0RFx1MDAxZodcdM7EXHUwMDEys11McSDJ8fvodY+0oexwVSrNXHUwMDBlWN5cdTAwMWVccpla8Lmvkl0gYfDcK8Vqolx1MDAwNdy4j6moOjDwXHUwMDExgFx1MDAxNEEqXHUwMDFj73RcdTAwMWK1p7cwyZdo5iWcc5U2qLxcdTAwMTG+m6Rusb2HXHUwMDBiO6bu6jPXW5JqmPF3XHUwMDA0XCLo+WGmXHUwMDAycM7zQfbhqG9V3cPTgsHvXHUwMDBldsFxNlx1MDAxNXdfVzezl8/YXHUwMDE1XHUwMDEyf5Nnplx1MDAxOfP1oVn2caO7Nujf5IGVzNCGbv2nt7pcbr7A6SXwT1x1MDAwYnzknzvzR/xl8Vx1MDAxY2VcdTAwMTBOpEaio1nN1lZcdTAwMThcIlS1XHUwMDE4hkRcdTAwMTiM7KZEatM3gm/CeW958sy+7W9o/F5jXGZ/7lUsNIWb2vxJMKc8ppabxiTqOyFcdTAwMGJQ/ZifppupmsF9XHUwMDEz799cdTAwMDGbVOnf+3K0IecrWHxkSSWAXHUwMDFiPGw6V4BskFx1MDAwNTJsyvPgXHUwMDFjk1P3XGZJrH3idPuse3Y6sk5s5sPD4feJPrKFYOMn55/BU81cdTAwMDaLXHUwMDEyaa6G6dZcdTAwMTR0ioBgulx021x1MDAxNXWjmyDKK40lXGKNW5GIjFx1MDAxZTxYtLr7TTdcYoJiT9hcdTAwMDC3PzTI2lklQTFZrUNJPTGmS+S6qFx0LbXtT9ShNn5cdTAwMTlcdTAwMDZW1ElC/pVcdTAwMDd1XFximn0nXHUwMDA1XGK5gKWPXHUwMDAz+mE3KO3jM7vF1U1CTGTzsVx1MDAwNoHJzJxcbkH7QcM/S+6WrLi/ZFx1MDAxZE4+olx1MDAxOU9jwMTrRWgg2UaFRa2EXHUwMDAxO7ZcdTAwMDd6YoPvOlx1MDAxNFx1MDAwMerF2yBcdTAwMTm4h1x1MDAxMdknbnaFvodwQSrH2y5cdTAwMDFcdTAwMWKOn8pccmk1XFxcdTAwMDaPTpVcdTAwMTRcdTAwMDVcdTAwMTF6bNvjYeIwc847gOh3qt2na1xusyw21Pabc/ZCXHUwMDBiXFwmv7+D3Vx1MDAxN9Gr/FfHnFnQTNWgTIfgXHUwMDA0O1x1MDAwNHVcdTAwMThcdTAwMTebg6o/7MhcdTAwMDdA5qVcdTAwMDJsRXxcdTAwMGUmXHUwMDExXHUwMDAxuPO1Ta2P5Zt7XFyJXHUwMDEzXHUwMDA1TGW08lTvVe2kiInnJIH8mVx1MDAxZFx1MDAxN9mdZf3K1LY1r9BuQlWLKtdfQLjr9CAhIFxuNFx1MDAxZqKKJeClvKpPKFE0JFjlI9dD/otqXHUwMDA3JS1cdGzhy+lxqPGtzOGT2Fx1MDAxOOZvXHUwMDA2JzJHwNiBJb6D3lx1MDAxOe1cdTAwMDY6rrNcdTAwMDdcdTAwMTLsOk3G0D7zn1hLMKt6XHUwMDFjkSjqd1x1MDAwMlx1MDAwMFx1MDAxMqBcdTAwMDF9XGJBbkFvZTZWkf3W/YoqgKdu24jj5eMzXHUwMDFh0PBcdTAwMWL2reGqXHUwMDE4gFx1MDAxMVx1MDAwM9d6P1nwL5p0xuNrT4VKy3snx5OxoPvGXFzpdOzDrlx1MDAxMyPRlrcwiT/WbDamNcvTRn+ezlxuNURqXHUwMDFly2tBaTwj/VRcdTAwMDbVXHUwMDBik4bM41rYsddo29+dvVx1MDAwNlY8Q6e1rTfKZ7mCs794nn/EivgzXabfqGOtw+lkII5qL5Www7pgbu5Wl5pcdTAwMTa9JS9cblx1MDAxYbpRbmFJe7lImPzmf4yrUF3UL45oMN9KpZqH696Qbl590fh6Kk2TL1BcdTAwMDAuXCJA5P6jwlx1MDAwYnKwXHUwMDFl5rap8iRYdzUkU7tColxybFx1MDAwYtfwhoOFSYfP8Vx1MDAxZVlmh1x1MDAxMYhTluve2WRcdTAwMTi+g5xRckI2daWShc2lVbpcdTAwMDSdZGqYUkedxlOxw/njgbalV1x1MDAwYrCrKrKASnVi2bS1/X60qVx1MDAxNm+Sy0au6bex212rXHUwMDAxId5cdTAwMGagsFXI9uVDQHavXHUwMDBl4ZHCXHUwMDE0XGKkXHUwMDBiXHUwMDFizM80XHUwMDA1PJJE7Les4F3hhmT8cd9DQ1x1MDAwNF3RJFx1MDAxOM/KXHUwMDFiv9o342ZcdLeEv2bQXu9rYa6XXHUwMDAyXHUwMDE38sNly7mdv6JcdTAwMTktvdFcdTAwMWPg0qxDiI4nMVx1MDAxY2Nl7DOEt2HxkX/GpvdVfXQ+z7Bpjj6sJjv74EYqbOc7YdkyYWbd9eldvqr//kRbIaotO4BHqaaQbM5cdTAwMWVMycDEkIaSSsP4PXU1djfZriqQlz1GaS45oygrXf1cdTAwMWIg7je9r1x1MDAwM3JcdTAwMWHdblx1MDAxMyN1VvF4gObcM666wPQ7XGZ05lx1MDAxMZlFeEB+6bCXbXbtxuHIu7anaTBpNq86keBoRiuLfp/y14H05Fx1MDAwMD/jXHUwMDE2/D7CoUjdz6xtj0T9XGa9sYM3N1JKq+mJ+59u4ch9LEKhkrGTQIZcdTAwMWP7gfPt53UmXHUwMDEzXHUwMDFlWbk0tlx1MDAwM8jCfJNcdTAwMTRcdTAwMDcwjnEzXHKgXHUwMDFmXHUwMDAzzvn+8EBHO/94WtW0NFx1MDAwM7WwLlu8QI3r9lx1MDAwNKt0YrxgYn0sYGHqXG4zS/7x8lx1MDAwNTQ7vuW421x1MDAwMHhqUPeg006ZozrX15f+c8NcdTAwMTB7em19lMw7aGpk/OGRVKdT11x1MDAxOS7o8VxmIZ5cdTAwMDBcdTAwMTYwZa5cdTAwMWPX+k5wmiFoIVx1MDAwNjLQvOtccpQtubRV0DlcIm3riVx1MDAxYl7azyh93ONPXHUwMDA0eazbdDdcdTAwMDZcdFx1MDAxMSXTa4wgijv4Mq1S4abAtZyvndJcdTAwMTf78MabrX7L65SCVrCXjvs2XHUwMDA3UVx1MDAxOEOuPSzDwVx1MDAxM0ZyJXPPtlftXHUwMDFmLKWtWlx1MDAxMi7rKNwhupzDSVwi27/J6cWiW4o0XHUwMDE3V9cp1+Y7hMJ6XHUwMDE56kY8pGZTR7SRTil5P1x1MDAxZer/4mow9Xizz1xy1LZF81xu18qB8bWaltbpXHUwMDFkK0hccpueLmZcdTAwMWJ9np9K9dM/8LpGVlx1MDAxObNNo5jCpVx1MDAxMVx1MDAxZFx1MDAxNEosXHUwMDE2f9WOXHUwMDFkXHUwMDA01Nw3MWgzNpC3m3GiXGbfXlx1MDAxM3Rr7Tx8mUFcdTAwMTd8rtnMtZMkuVx1MDAxYsLfwFxynaA3XHUwMDE1irKOZ9ZE/ndcdTAwMWWkXHRZLimJJs3UfZO2xVxmy1x1MDAxN/tx/+1MXHUwMDEyobNcdTAwMDZQ4VFl0F7FXHUwMDFhh1x1MDAwNDaVI0dpa1x1MDAxYlI6bepccsGpXHUwMDAyXHUwMDBlQZxcIp6Ajlx1MDAwNJKzXHUwMDE2jq1ccua4WFxch4xcdTAwMTQ64nxCVtOwrI9JwrBpuFx1MDAwNVhtp9JcdTAwMTOOuJOpXCKD6WzGcKyh50sqRTBcdGrhhVx1MDAwZle28pTaoJ24L02QbKJb2Fx0J/aU9kCZ/Do4z5h92oe0VvpcdTAwMDO13cA7zbHKyV094PU0/Y9mNz1OfGFcdTAwMWSqXHUwMDExeFnv9/Z98vnGbv1AXHUwMDFhW6eGnvOaNOKQvlKJx9Hm2bI543jGTiPhrJ7fcMK9sIntXHUwMDBmZ48x4fswXGJVt4fEJ9z64o5cdTAwMTiCS5ZcbmE/esGGmTRvptUzqalkhptcYrJmXGaGbdx9MZhcbktalaBS4bkneK/MjlxmjMnvXCKL14q5e5LQvPPYiG6Cg9k3yJYsTyiA/mKzV69KlT7cYVx1MDAwZTFXqXHa9XpwyidcdTAwMDaL2Vx1MDAxNqNccpLUKFwiXHUwMDEzYn50QPOrK7NcdTAwMDPffcqzdCEwwamJbjIyXHUwMDFjlkB/zTBp7S7BTFx1MDAwZlx1MDAxYrJcdTAwMWRTgH2SfFxc/rKvOK/ccN9jXHUwMDEy/uF1hzQ/znRcdTAwMTKJXHUwMDE5ozN3d1wiz4BcdTAwMTdcdTAwMTPtm5jr5PUpXHUwMDFi/GftRFJqXHUwMDEywqTtZT5cdTAwMTRC9DZLMq5/c4rZXHT2XHUwMDAziVY1WFq/aZ9cdTAwMTf9YVx1MDAxZVx1MDAxMfaqpXVcdTAwMDBSY5JcdTAwMTRHoJj7nVduKDw1P/pcdTAwMTFcdTAwMTS+fm+pgN5cdTAwMTnr4lx1MDAxZjYokd+EUv1xc5XeLZf977rLXHQ8r8jApMvPP78hhVx1MDAxMnpcdTAwMWG2Wlx1MDAxZNRCdnN8fzo7QOSXVi40+YCjgECf/bTGdZTZbW17kqROPkQhfLRVMvBELGA+T9rIXHUwMDE0XHUwMDAxcd+thKSo25iBjOpcdTAwMDVcdTAwMWPuTzdcdTAwMDT2u5LSkzLCj8Be8Vx1MDAxZc8kUvgnXHUwMDE0N+/gxSBcdTAwMWRcdTAwMGXcrTyJU1Ew7nrqpp16XCJ4VePqm1x1MDAxOSiSJ44z4UdcdTAwMTfJVyRmxjc8tzFWYeLr2kZcdTAwMTJcdTAwMDHfcHb9XHUwMDE0NDd9dMtu8Fu49D7YXZ2zXHUwMDBidoLD4TFwLH6LW62AN1xum+O2VOiaKug7QYiYXHUwMDEwmpfgOYtcdTAwMTJKQZ0yVScgKuLjXHUwMDBiQWBq3tb3XHUwMDA25c/9XHUwMDE1j7g9oV+eeOpcdTAwMWRa5CZ0oOlcdTAwMGZ//nnQZ4KSVYubLvcwj5FgXcxcdTAwMTNjc1x1MDAwMpWbpPFcdTAwMTNUXHUwMDEzc4wm8UVN+6FcdTAwMTnIiqKbjnLHJPJcIvMwRTOHtG77Q7OLSVx1MDAwNDNcdTAwMGVDqXC+b51cdTAwMWb+XHUwMDBlIFx1MDAxMDLeiSOWXHUwMDE3XG6281x1MDAxOUJcdTAwMGaZMkPCToz4XaLQXHUwMDFjqugynOOiLlh1XHUwMDE3UraV1cst2nrFNKbWSVx1MDAwMnr5df6OI4tIkkSFpUe2YdY1RzZcbqjdJr4v7udlPsJ6XGbupfckpezkfNFcdTAwMDUurFx1MDAwNmFcdTAwMTEu5dCWSF30/ZLKfCnt6eVwu2s234zFalx1MDAwZvDleCjzqlxmVFx1MDAxYdLBPlOH3Lyol1x1MDAwNd/vYStcdTAwMTm+yi5jxq2waqrmTP/Wtp7Y13+Ez6STb6up9GZnY/h2XHUwMDA0SuNcdTAwMTCFJcXMM+SFiYPc+2jzSlx1MDAxYVx1MDAwYio/vCoodudcdTAwMTnj/k16Oa/MMMZcdTAwMTjvXuSfXHUwMDAzbU9cXCjKR9o943fjePOp3YorTkF13LyT/7WBzvLqjjBCWzBVeHlcYsp+6s98XCKbXHUwMDEyiYtlgmyzucd77TlNIPLYquvz99wxmMblXVZlxFaTnj61XHI/mVx1MDAwN4ic0vxnrcH9O+Sl0fXHwVx1MDAxOGluhkNcZoBcdTAwMDJcdTAwMTRV6I6R4LZcdTAwMTKcuGVccrqxXHUwMDE3XGJBpppHXHUwMDE3XHUwMDFmXHUwMDE5VWNoXHUwMDAxy674uyxcdTAwMTNmqHVs1ratI5zyXHUwMDEzSpjsuL5cdTAwMTJ40ffbMrY9XHUwMDBlV7ON5y+OZUhcdTAwMWPytK1ypVx1MDAxM1D6XHUwMDA31t5cIlAs3GPDz2ZIlV5cYsU3cZ43yv64XHUwMDEz+TMgXGY83mVDiompY1xcnpHdVyb5Q/VcdTAwMWWqXolAnvNcdTAwMTXxYniGXHUwMDBmJIeNyfmrNtDtdZmFXHUwMDA3aSsldcLvWJKiRyH9UVx1MDAwZu1rSZX9veo7XHLjbV1AKlx1MDAwZm7oe8BcdTAwMTfB+fSzXHUwMDFmI49pJDWx2lxyYlrazdll9av/abROhW3ZXHUwMDFhffBm9e+7xbbrt3hk9CRtmrdcdTAwMTSNf0X0XHUwMDE551x1MDAwMFx1MDAxOKNuY0JcdTAwMGZ4XHUwMDFjbElcdTAwMDe+7YGJgktcdTAwMTgjXHUwMDEzXHUwMDA2pTfVc65ozPfAXG5cdTAwMTSog/+ayVva6fennZZv6WSltVx1MDAwYjEs3qa6nDnsUshcYkjOk9tZXHUwMDBlm4uwXHUwMDAw87b61rn4XHUwMDE2RI9cdTAwMTD+NklcdTAwMTNk30au7cX0XHUwMDE1OyyfpcOVyu2waPtiubnDt15cdTAwMTKlt583WuhHYsCfXHUwMDFhwzWJMJN+yVx1MDAxZoVcdTAwMTCcwV1cdTAwMTeTqVx1MDAxMl1wVoklOJKToGSxg8qyQXx8ylx0u1U/Qlx1MDAwNjdwxWonqsBcdTAwMGaYLHs0O0FeT19stzAh2Hqrolx1MDAxM6Z5knzq2c+KiZO1UbzcjGbXqFx1MDAxYeBPTH8jm6/RI1xulmngIKRcdTAwMWJtvK//x9qK5i2/2fhhzCWCXHUwMDExXHUwMDAy0Z/st0OJMcA6XVJcdTAwMTCwXHUwMDA2sqBDSVxyKGFcdTAwMWI6qNvHpFx1MDAwMEPi1bTgr/gppFx1MDAxYlskkVx1MDAxNHNOqNmrUlx1MDAxZD1cdTAwMDW4yZuLi++UXHUwMDE0d1xiqKBcdTAwMGJm0Vx1MDAxOZN6hT9WqTjArVx1MDAxNntBXHUwMDFkrfGo8GM/dtzGpsTzXHUwMDE5Tjn1udx9qL3fXGZGklx1MDAxZkZcdTAwMTFb7OZaXGLKmqy8lE1eXHUwMDE4d4tcdTAwMGXicT360Vx1MDAwMfuDSDzQOKz9XHUwMDBlXHUwMDFiICCN/rBcdTAwMTSmVnWlj1xcK+0jXHUwMDBl8Fx1MDAxYaVcYrO8f7TY9GjZZjT9Zlx1MDAxM/r9XFyk/tV0+cbwmGuxcFrWuFhcdTAwMTY221x1MDAwNe5p3IVFsFwiQTTQh1ny3Vxi+mFcdTAwMDJxo3VcdTAwMTO/1C1lVkTFJTRxw19Z5U9cXMJfgnivV8hNt1x1MDAxY8Xe31x1MDAxYcd6l5NcdTAwMDbQ2mt89tuejHFcdCSuIWn96MX8cXIvXHUwMDE4cD79xV9Ld+XMuVx1MDAwMon4XHUwMDFleUTMvvGFuUy9ICZcdTAwMTm/sblcdTAwMTXjrD9cdTAwMGXGXHUwMDE49upcdTAwMDWnyF/TarOIf/3tgyp1XHUwMDAztFx1MDAwM1x1MDAxYrTDXHUwMDBlM1x1MDAxYfJ39CUu2I9n1/R2XFymNolvPOtcdTAwMTZcdTAwMWT5TuqX/Vx1MDAxZdEyoFx1MDAwYkHq7JtWYGuXU0rCXHUwMDExXHUwMDExv9dcdTAwMWaYyDznzu2bIeryftFcdTAwMGVaXHUwMDFmf1uZWfBcdTAwMDSDYFlfULGI0FFcZo0/xUuh31x1MDAxZViGfbDel/ixy+dPzDqj6yxcdTAwMTTEgzBcdTAwMTeQc1x1MDAwZWryfrkghFx1MDAxNG2wRlx1MDAxY1x1MDAxMWyd/t/bXHUwMDE5ZThqXHThgimE+ZHXi+uIyamRXHUwMDFhzyhaWYWORElQgUJVn3yo2HTdN6P/iSv1XHUwMDFlLD29qLeKcVx1MDAxMEjKXHUwMDE1iuBcdTAwMWLxYXqQXHUwMDA0WsrCqkJcdTAwMDJ1K2TaOSAzXHUwMDFiOPFcdTAwMTiFP1x1MDAxZVx1MDAwNX785fc2eFx1MDAwNeZcdTAwMDFccpZcdTAwMDGZ5Nsl+Vx1MDAxZeukNaAyI8rG9NJv7V9sYyyyXHUwMDAxyFxuTmlcdTAwMDekjFx1MDAxMlxuLdmNvkqq/Ib7wFx1MDAxMKJbZqCLkFx1MDAxZpEn8FE4/XSLy5lW6Fx1MDAwNWyd08A5XHUwMDFjXHUwMDA3XHUwMDFiXHUwMDE2WpXHXGZNflxicoJow6rZf8+Wflx1MDAxM8f+fW0gjVx1MDAxNeOrkyMow7zRKyFcdTAwMTd3T7JZXHUwMDFhg+Cpr0b8XHUwMDFlXHUwMDA1XHUwMDFlXHUwMDE2lZbAmdV+ZvOTLGJcdTAwMGKVeZWJq1bWNVxcmue6vtrK82q7RNqwME7TOyEqz23DVIGaXHUwMDFjX5U0U+izXHUwMDFk0/KW+K5vO1xyN383/NPher4pPM0vorz4cKd4XHUwMDExfaE4374o0lwiYz3MX1F/wUI6fVL1m1x1MDAxNlwi4+A4bj6VjuRcdTAwMDb2a373IdSCk8dcdJK6fl1cdTAwMWZ78UvSfZWYeupjiG0u9Du+yFNU5Tv8S82izTFcdTAwMDKdk4tiheUjzIsz1JRcdTAwMWFKvm5cZmJcdTAwMTdYqIHuimVcdTAwMTF0/HIpXHUwMDFl8l5GqdWParU0RJ1uni9uvVkq/PpqxmvDn771Ljgj3+JtzkeKXHUwMDFmM3tlrzdcdTAwMTIyX/03nIeAyPK+XHUwMDFkL1x1MDAxNVjzUCFixoNcdTAwMTh8mmJ/ouXiNq/Ni1x1MDAwYk1cdTAwMTn/XHUwMDEzUojRhLZaTLwk4OglqVx1MDAwNEkjXHUwMDFlXW6+tpnbmcBcdTAwMWO3IDBvPN2Xa0srjIPXTEFayFx1MDAxZp60eShXUWW1XHUwMDE5+k2onGCw4k5cdTAwMGI1ZIxi8PtcdTAwMDXbu5BeZYmw6eugXHUwMDA3xvw7JC+DdFxcRUmmI1x1MDAxOUNcdTAwMGWRXFx3VVEk07xcdTAwMWXJjzyRr+RcIkw8/CDAYLVcdTAwMWa+XHUwMDA064XSIJhzoFx1MDAxNqJdxuNq9V138MhcdTAwMTguj0pspppcdTAwMTiA/TaZpl6+WzHFXHUwMDBlPVTJT7eZ01x0vtonpGSoMVxyfMDVXHJHXHUwMDEw/fRcXK70ej1to2vZkKBMtlx1MDAxZImtgFx1MDAwYm/IMVpEuZs0edutdjxm8LUlQEpCyS1cIlx0XHUwMDE4Nq8kUIVYLsH5//uum6pFnsiwflx1MDAwM/uOeSUwXHUwMDE1V/5oXqrOLzHYXHUwMDEzhSWIb6CDoWKJPlxmIyV3aI2rxMpcYk8kdHyN63m6c26X6lx1MDAxYlxundma70BZm9+fRLz1sS7UM0hT/Gs8botcdTAwMWTs9+clg5nWezDy7zecslx1MDAwMpk+XHUwMDE1M7FcdTAwMDG1btb3urJaP8qtoiAqO3ksibJKQC3zVFx1MDAxYYzb72Nve8LE6Pr+OTHknptpXHUwMDE5/H1cdTAwMThpKFx1MDAwMZlcdTAwMTEs02H01dRcdTAwMDdgXHUwMDBlJPyl/HzGs6xcdTAwMTHXM+FSuD3fn1x1MDAwZqtC5sNcbo/fPyB8knCE6iZON227diV9xbDrfMKZXHUwMDBlmo7MhHyoMZ2ZXHUwMDFjXHUwMDE4u5WY3fjLcFdoIH8reTHe+1U8XHUwMDA1QFx1MDAwM4TE6T1t4K9cdTAwMTdcdTAwMTZ1RG7an808ce5SekXicCH8S1x1MDAxZToq23PWs3E5XGbgJikkQp1/XHUwMDEynCmKXHUwMDFk532QwuG0M7pMS9z87TQqa1x1MDAxMFx1MDAwN+ND6VwiwlKk7Fx1MDAxZlx1MDAwNCxcYiW0XHUwMDFln1xuhoJMIKTbUjPzYydZ8WPtwFx1MDAwMb+W+DFp7EuSapDC2+ZcdTAwMTGrY+e2rVx1MDAxZpe43zpfMZk7q09YzmVfyZ0mdDKdPSrSjDA3pOhie8+4XHUwMDBi0njQaW6ev9K0XHUwMDE4XHUwMDAxXHUwMDBlLb+hfveSlveKOdbRJqZ55uhcdTAwMWRg0qM8dCWs+vvBxJ9cZtjVzFxi6a3VziVUn0omoexcbsFcXJdcbmK+i3CYhkNGfvSn1ShIiViY1lx1MDAxNZJi11x1MDAwNqXzge6S/iaY0vlKwv0+747IXGbY2axNbSjuXGJtzb5cdTAwMTFDO/VcdTAwMWG1/XNBXGZJPuFcdTAwMDHkzeOFrVx1MDAwZu7wZzVcdTAwMDLDzunPXHUwMDAy9Dxmv+BcdTAwMTJ5VpLoq+fCfuWRuGk+f3vkgrW9MSXSXHUwMDBlXHUwMDAzl4QjVTY1vFxi4plcdTAwMWXak9BD9uY2L++JrvbzrPIs17F3Q4JcdTAwMWX7XHUwMDFkIMqggkIzplx1MDAwN3T7b6nQXHUwMDBmhVx1MDAxMVx1MDAwN458WEtcdTAwMWW48ePZvrVTa1wi7Ngm0bD3WyyVmdGYY1RcdTAwMTIotm49g8xcdTAwMTA2Z1x1MDAxMod9coN0fKGkw1x1MDAwM6NcdTAwMTdA5rKG0Fx1MDAxZqU05OP4XHUwMDE2XHUwMDAxN1x1MDAxZlwiSepT5dlcdTAwMDBaf1x1MDAxYcM+pUSEUFp+8vxcdTAwMGZcclx1MDAxYVmO+1iOzVF4kfJAZ1v7oGRu/+XMfj63/4snXGLjy7beI+vwXHUwMDE2gXV3XHUwMDFkvMFdg1xmsfS9X3r/y9CsI1x1MDAwYnbYTkrhK0f4em9cImrQ9npcdTAwMWO3XHUwMDE1UIM+MFx1MDAxNoH9cc3L33iyJ9j2elx1MDAwYsGnKFp7++JcdTAwMGanrTDMKCm02Jl337RyntAlkZnxzHmEYpAgdCtLb1x1MDAxZlx1MDAwNo1R8f5cdTAwMTJBpSaYZ1x1MDAxOd2dVJeqXCJDmmtP0Wxrw75TXHUwMDE38CuwnFx1MDAxMDY9p8+rlpmSyVX6XHUwMDExNqeLplx1MDAwNNg5Plx1MDAxMKwtUue5LqQjQYJcdF5G5Vx1MDAwMDHWXHUwMDE1XHUwMDAy86B8XdLpXHUwMDA06J/9R6WwXHIxSPKjXHUwMDA2+eUgns1ccvu9U4pykqcoXHUwMDExJUyjXGb03slcXIXL76JG7EeaXCKzPNK40GrXqLLVlNHgcnVoZCaGYbeG3o+uXHUwMDA2YauBN1x1MDAwN2FoTiSDa9FsynPFZ75qZ1x1MDAxMOr5tckkJUxcdTAwMTS7c1x1MDAxZkxWXvLRUFxiMcotR1x1MDAwN/g9XHUwMDBl1XN/XHUwMDA1i2ZcdTAwMGZsQY9PQmX5+OTP8rvX/nBcdTAwMTnRPvhV2nFtsWo1XHUwMDBmyVx1MDAxY3mV4+Sug6ZFXHUwMDA2aVXq+ZDW10443FBcdTAwMTPt2adgvSxoqWHfXHSj0H6DYTysmp1Trtg8/Vx1MDAxMlxu5M1cdTAwMDT328KNXHUwMDEzsl5cdTAwMTSRQFBZi1x1MDAxZsgw581cbpXXXHUwMDEz31x1MDAwNVx1MDAxMKvwjuu/tVx1MDAwM+JcZtsmLEO/Y73rXnFPbU9TeSU9za/c9Wat9Sm9VHxqi3CQkL1XbKeOK1x1MDAwNTN8JvJw27+conrbT+7k6Jv921x1MDAwM/fVXpf634bjkc5cdTAwMDRcdTAwMWU0jIVV3oZitvUvvdLdk8v05YKsk9dcdTAwMWWwJHwxJLtVQ6VTXGJeMqY6XHUwMDAxKWJ2XHUwMDBlWONcdTAwMDRWdqvrWpPHbD8ze+Rxyd8s/IQ9WD9cdTAwMWZcdGNmiGhcdTAwMDCDjChcdTAwMDP2199Bq1x1MDAwZfKVQ50hgYVHhVxmSttieWY33nzo0YKSPXOj1Fx1MDAxOHdd8af97HtI1P30zlXGs1x1MDAxOdJcXL/ayIPPwqLDzmuK/PRcdTAwMDFysSuNevFPbcpcdTAwMGJwVV58t95cdTAwMDaJXHUwMDE1NzAvgPg1XHS8X9lia6897M5cdTAwMTZitiTVOCxcdTAwMWJn01wiWTfM9+4xYT07KUdUPvj8uNV0y1x1MDAxNmUtkUCG5+ogjTFYw0C02kNlXHUwMDExkSFonzt+YOH3LVXMIEEwWUW5mdBPPv9cYqh7Wi1cdTAwMTm/1PtcdTAwMDC/4oGFXHTXoVx1MDAxNiZcdTAwMTeItf/2jL7FXHUwMDE5/j34j6+pXHUwMDEy5lx1MDAxMNxcdTAwMDT0Xlx1MDAwNq8455rwXHR1acQ5zkk/9XQvO7BsXHUwMDA3giBjo96Q/rRYXGKneyBimlx1MDAxMMnrd2JdIM0/XHUwMDE29+3gXHUwMDFkc4gwNFVaRuNP0nA+kpVirkNAiUosZCN+OrhcdTAwMTRNcPxuXHUwMDAzVlx1MDAxNTDqje1cdTAwMTVn41x1MDAxNFr+zaXv3Jdf/2f90Y5cdTAwMWJdXHUwMDA0Vsq9XHI2XHUwMDA1XHUwMDE5a74qXHUwMDBm+ynKYPcsQdpgXHUwMDFkg+vJXHUwMDBipFx1MDAwMv02R0qsvL+pXG5HQVx1MDAxZWW1xnaVTsrfxFx1MDAxZJxZZdzErO+yOvbXKrjkgnKflcyC+z5cdTAwMTidtfXHeFx1MDAwMTeQZKKfXHUwMDFhL0kxM8Pb6mRs39E25N20XHUwMDFit1x1MDAxZEVcdTAwMTNcdTAwMDbx+rDvnzyJk1x1MDAwZZZcdTAwMTdIwe/vXHUwMDFj9k6OWNBcdTAwMDQ3bTKoYDAscT51cjHEt4XMXHUwMDAz0MFTeHHWZt5o6rQ0XHUwMDEzuLZcdTAwMDHjppLu0bCPXHUwMDBmXHUwMDFiWW6Ozlx1MDAwMs/hXHLSs19cblxi5MpcdTAwMWRMdzbVl1x1MDAwMD819OtcdTAwMTXu60J3XHUwMDE38Vx1MDAxOJBLtVx1MDAwMsSS9D9w/qRScEmPXG6oI/rNMGIg99+wv7GuY2CbcfUnXHUwMDFlXHUwMDEzXGL+XHUwMDAyY1x1MDAxMFxm8OjKM97kW97iSlx1MDAwMVx1MDAwNSZNZprLTGnj8Ev3XHUwMDExYz8w7G2B1Ga3hcdcIlx1MDAwNlx1MDAwNSHcIUPFkTVWwNFcdTAwMTPLX+iznNpcdTAwMWSJc1mx4ptcdTAwMTWlXHUwMDFhMK/FXHUwMDBlep3jSNdAI1xcVneUQ1x1MDAxOIin3rj+QTPEflx01ohln1x1MDAwZbvq1UrMm43BnttcdTAwMWOiXHUwMDFk6l/Ov59PRfIp3Fx1MDAxNKmGZ/Hk+Fx1MDAxMzJbnX5P7lJcdTAwMWYlLsuUmvutolx1MDAwN1x1MDAwZpJ7bnVRZFx1MDAxOLROMVx1MDAxMlx06NjuQfqPa17AY79PQINx+31cdTAwMGWGXHUwMDE0/3JcdTAwMTa8sV4jXkFpdVx1MDAwN5NcdTAwMDat/p9973zd5CxcdTAwMDCZXHUwMDA3I1x1MDAwMcE88zTgNqd3xzNljjfbSlx1MDAxOVx1MDAxOTOhxLnLXHUwMDFlaMBcdTAwMDFpXHUwMDAwonOL46lcdTAwMDKl2kz3n3o2jHzMhIWDz1x1MDAwNVxcge+2yeot8XS70kBCqnknd4di0U6P1o6G+d8zkJCyU6+Nfc/yt5smJb5MIIKUwzGkXHUwMDAzUbme0GxVXHUwMDEz8GxcZueCUbVO9GGsI4rwzzNcdTAwMGaf6lt90dFKmyhUZW7TbqNmXHRtMIlcXCRQ21x1MDAxModAI5zCXcs8XHUwMDFhvdB+Wr1cdTAwMWOTpUe3eV2KmWesN3JcdJa8Xb9cdTAwMWF6j9/CXsCe0lx1MDAwMLE+7V8/zPFcdTAwMDPsjpdpUo5cdTAwMDc8S+WcL1BnsN5Kg3Li7vFPXHUwMDFm1XCnJdfuR1Cu1dI5XHUwMDBlY/qGr1x1MDAxYilkMLXOXpVqXHUwMDA341x1MDAxY1x1MDAxMqI8XGKZZcy1Jz6AZiF4KshtofCnlsDv6Xlogtw8XHUwMDE0PvBcdTAwMTY+IWul7Y95yVwiueM/I3ribVx1MDAxZVxy+MHZaLHe12fdxE/1xFxuKIuP+6JFSYxcdTAwMDFUat43S2JcdTAwMTXbWruy//axj/OEU1x1MDAxNmHYT1x1MDAxY3TCijxT798uvLefk2J+U43hMOy/+I7Fp6butv8uO9e+I3JccqCWnFx1MDAwYitteK3pVtmkrchgO1GaJc0sPF3wXHUwMDA0N+uBdWaMMt9cdTAwMWQux3nBaFx1MDAxYvND5lx1MDAwNf50yVx1MDAxNoufPGsxJdPdXHUwMDFjvJVcdTAwMTbzXHUwMDFlPy+rN1BOt+dcdTAwMWWDlVx1MDAwZniAeWJ4iNVcdTAwMWFUXFw3+lx1MDAxMzUraSBubsWrIF6SgVx1MDAxZdiygnhcdTAwMGLrzzif01x1MDAwZVx1MDAxYlx1MDAwM/tvXHUwMDFkzYtccoitTs82bpw2LFlcdTAwMDaSbVF7O5lFg8uX7yNcIip+XHUwMDBmzv7iK05cdTAwMTjD496S8VpcdTAwMTkg1Neq0mz9Jlx1MDAxOIz4XGY6dfqyzcJcdTAwMTLWerdgcFx1MDAwMpW12yxcdTAwMThcdTAwMDdWPyBcdTAwMTTssOmUe1Z8WVx1MDAxYyV6XHUwMDEwea1cdTAwMTLQmi3nXHUwMDAxosPtvVx1MDAxNCFhXHUwMDE3vzInOEQyorh8XHUwMDE0+nrsl1x1MDAwNtnyt1x1MDAwM1x1MDAxZlpUXHUwMDBlq2blStx06ktcdTAwMDaeXHUwMDFlK1x1MDAwMMrUZ49cdTAwMTmBT10roH/uoXnRkodcdTAwMGahpMDJcCB4JNnTNlx1MDAwZlx1MDAxY1x1MDAwN1XnXHUwMDFm7zjRXHUwMDFiulx1MDAwYoj35bKHrOVnXGIvR2whT3UrX3NcdTAwMWVmhSrua38q3G9cdTAwMThcdTAwMGXLXHUwMDA1d9Ot7dry0C5AhLtpXGJuYsD3X4w8s49R8Fx1MDAxM7OubdLq6c63+r8zT4HM4Vx1MDAxZsDQ+/sz6lx1MDAwMDwlwfVcdTAwMWQmkOSam1eDZZakl32YVJApxFx1MDAxOWHwnPWC7Ms7hDdcXF5ByH8yXlx1MDAxYtJNg0ff63LNtVx1MDAxM/vNXHUwMDFjho7jlUX5f88+wFHdIWc/IIPS+or42/qUXHUwMDA3dPj3ZP9r3mOm4FVFflGz+sRBilT/YMZcdTAwMWauLyTKXHUwMDAxs0JDxzjrqFx1MDAwM1B3liDBLTtcdTAwMTRIXHUwMDBiJ1x1MDAxNEBuXFzrNlVH2bqR6UXwQqFcdTAwMDA88ndVzFt9PFx1MDAxNdMjnnZcdTAwMTBcdOztSXntXFxtUKOINCsuT0xcdTAwMTRIj1xy6kkwNyPP/fF8z/HUcqPTXHUwMDE579M7ZT2qXHUwMDE3XHUwMDE0fpj886U8XHUwMDEyZFXhXHR/b1x1MDAwNM7aVoWKXG6nXHRgS2VlvD5lReOjVL/B9mZyycUzMzFfvnBImX840+F/22/H3WfO9F7QXHUwMDEzdDGtcfmJbLfCLzT9ctLspveaxK1kgSeCVtbj9id3uDVbIVx1MDAwNlx1MDAwZlBERunfPoyLjf2461x1MDAxM9znUzfOO/5cdTAwMWPsR2xnXHUwMDFjrlx1MDAxZZe6N8u+a7z7IOxaXHUwMDFlXG6iXHUwMDA1mywlOIopXHUwMDA3i7BQTOriIfk0TbChx3RZclx1MDAxZt34VeVcdTAwMTepXi67T6JDkatIo4thgzKqW2xn8PWhcOA9dcdcIrUttMDng5psij9A5CMvLkDoT1x1MDAwML9PraLKh91r5s1+69zCXHUwMDExi73VRD/Qh6TdgytSgKSw9FxyQPN8UDM6XGaYJJdkhu6lI5GlmleHO1tp9of6oO5cdTAwMDHekMVpwn+3/zOTbos6XHUwMDEw90fM64rdXHUwMDA0mcFDzlx1MDAxN+9zXHUwMDFkZDNcYlx1MDAxZlx1MDAwNtL17DZcdTAwMWFMXHUwMDAx36qwtNlI2O25XHUwMDAyXHUwMDA0gjHGRG5XxPvD7PF7kvWDoDJLXHUwMDFljYd7+OJ0o0BcYibr8UiEzqjm66RR9cqRp4df05OdxUNFs/TPnswutO+jZFxuJoElTf06tVx1MDAwMayJMYPGW1x1MDAxY1x1MDAwZb5IaoZCOXxcdTAwMTj6W5vGyNOKXG5cZiyy4fipc7rzt4ZmOt736Gy3hK1Kni9cdTAwMWG3nZdtrIFQMFx1MDAxN09rzKpcdTAwMTXifIWya3MkoiEkbT6GRlRcdTAwMGUue1x1MDAwNvP1XHUwMDEyTVx1MDAxZFtfKFSCL3xmzvVPuVx02Fx1MDAxOMKcNYFr9lSEq1S/XHUwMDFjqaCh13pnKf1BcZJcdTAwMTBOenn1dcODt4xZlmzmPs/OJFx1MDAwM1x1MDAwMPR95MqALGN4PFh7XFxcdTAwMGWgw7zGXHUwMDE30Fx1MDAxMb7iUidups2C6e7HuV8pJlx1MDAwMMJLXHUwMDE2XCJWRmpcdTAwMWQ09VOJevqA/UeF+XQq0N9zwEQwJi+MfYb499QxYJtcdTAwMTD5+JfolVxmy/UwXHUwMDA1Pzj/2mrO1zg357uVsj6vsng5QzmUcJdcdTAwMGVcdTAwMDbx9t6NbD6wJlL9RYDKrWK6w0yjsyuBROljXHUwMDFjPkv5KGhnPpXUy3UptspBQEyB/uC/hTyVwprKj49PkVx1MDAwM29cdTAwMTJfXHUwMDFkIX7DXHUwMDFm+FxcZcqcXHUwMDAzbFx1MDAwNlKhuXT61Fx1MDAxOWYku1x1MDAxYsPH9lMxpFx1MDAxMVx1MDAxMin0LYlHLDc+NIf71Vx1MDAwMVx1MDAxZfkgetg0uSGScDv2nH5cYlx1MDAxNTlo5Fx1MDAxZVx1MDAxNlRcdTAwMDZ9ye1JL62G1rpsvOj+tVtcdTAwMTT0T1x1MDAxM4j5nsBrMrNT/Fx1MDAxNjA5Y2Xlwlx1MDAxZkecelxyXGLYbud7eVx1MDAxZP9uvit7sNWh2USnX4Y61u9cZlx1MDAxYWpYV3dR/FXqKyBcdTAwMTdcdKhOLfeOQyliJ0u+gip4XGZpJ9xcYrovIZZOM5nL4vZcdTAwMWJMh1vRd5+/d4HTTcvnX9xcdTAwMTOSiqdxILR5dNfvPeJIjZhQt65ws9lev9drVt73sFxmXHUwMDFiMlxiMpG+XHUwMDA2P3Ytn05cYlx1MDAwZcu+SXJcXLA/O5P1Yq4zqlJKWKJUakNcdTAwMWF+c1xytlx1MDAxZImrK0BcdTAwMDZhez3F8Jvs7Fx1MDAxM8JF08JcdFx1MDAxNlx1MDAxZMJ6oIwvgEHA+b9g4qVB+9j1lKaj/2VInfUpZprmontaXHUwMDAyV+KHXHUwMDBiNLLtb1xyMvPDTz2a4cFcblx1MDAxNZBXf8iGrLQkQ4zmIVx1MDAxOIL0WtpEPnTDxi9cZiHENlHJ+IpcdTAwMWbeN+biIFx1MDAxNbLYzI1F3lxcjVXq889EaEJfWNWT6/ArWlxcXbWRVb9bLzb7R8Bw6SNcdTAwMWTTOFx1MDAwNuGJilx1MDAxMeVcdTAwMDRcdTAwMTmF7NJcdTAwMTVcIqQ9zlx1MDAxNVx1MDAwMzue8Ezmjpf+kD1cdTAwMDZaXHUwMDFj8pKtmyS1JMo7Xc/E10A2m/30LUCS0WPrXHUwMDA38y7rXHUwMDFlhJjHIN5cdTAwMDDmnFx1MDAxNVx1MDAwZXuTyVx1MDAxY1x1MDAxOK/XxXZ0grBcdTAwMWLbqX36XHUwMDFl1nnEX1ZQkZa4uP1KLFx1MDAxZkvTrcx0mTp9pFx1MDAwNUNk8KmoXHUwMDBmlsnF/t5cdTAwMDTNq2KNltdR+ueZlbZzTYrdXHUwMDEy8DR8d1x1MDAxMzzBfrNosHDvzVx1MDAxMVx1MDAxY4t6XHUwMDEwlyWck6RDi+ilaIXkXHUwMDBmJ1x1MDAwYsbLXHUwMDEyn0aUU9e3+uFcdTAwMDNT0MTv8SBcdTAwMDWgXHTw78diuEP/ezZep0hA01x1MDAxZtOZ3m3VxGe1Juwj1jq8lONcdTAwMGVTTFxuVMXQXvkj5lx1MDAwN8ri3OonaZd8Psa7/4gxfvRidjxNXHUwMDE0NlHUUCloh+b+XHUwMDA3SS/E/1i4puxpjn4kpCXcXHUwMDA1fZFslG+lk2ByRcbaQKSOXHUwMDEz5yMpzlx1MDAxOFpcdTAwMDCKgiWe3SqQbVx1MDAwNDjpss/l1acprsqP8Fx1MDAwYjGvrMGZXHUwMDBltZJ+hFx1MDAwNVxiilV38j5cdTAwMDZaXHUwMDFllKP7qMj+vTlcdTAwMGLPLI9KKFx1MDAwZec0mmLGNaRFZExHdajIiHxcdTAwMDE/xCWxOtv9QLXhiZ2fc1wiXHUwMDAzgCaWaPtlt+agO1xc/uE/dIRuOfjvesHZqId/sOm590EsmehcdTAwMGZcdG7ZXHUwMDE2kFx1MDAxOIpcXFxu7Vx1MDAxZCAgpGlfXHUwMDE56W0lz1x1MDAxYbh6JPUpdX7P5TUuIIxcdTAwMDEuMWNT7bqJU2hcdTAwMGKazvTh/dwqcjThx1x1MDAxMo7Tzyk41rvSIKTtLmIuZ1x1MDAxN4Zs3sdT2SFcdTAwMDbGfos9cbLJ2UlcdTAwMDLv21ZG9/CjNCT23CWuQTQytrWkwsjsizLWOfF3XFzAY0XNmmxRKcL1eU/SbK4vy4Rb829pTogk/lx1MDAxYlx1MDAwYn7Rbtv3PpzzfNHV34s8lT0hXHUwMDBmY/A7zjrHSVx1MDAwNyhmXHUwMDFj+avXS1xc53GOgSTMub8lXHUwMDEzmHRy7EzCqVx1MDAwZX1cdTAwMTlvSfNDT31cdTAwMWHZTiVmI++MyH6PgOOehqqVX8r3NTzJQFx1MDAwN2aTylxiaeUk6PFe8pbelqA8XGZcdTAwMDFcdTAwMGbKz7Fgt2RcXCCsxM45Utn2L0E/jqZniVx1MDAxOJC8llx1MDAwNztcdTAwMDbP7KtcdTAwMWTO/CmCJlx1MDAxZUw1y0yrtsHKIbKLP8zsiDKkirPimM3x+eTpOmvc0zBOXHUwMDFhUCVdZVxmbz9cXMKZwpPf/D7/5bdcdTAwMDdcdTAwMWaKXHUwMDE1XHUwMDBlkqAmlcPy+qB33DZcdTAwMWIuKNBcdTAwMDawiI+wLYtcYnheWDH/05xcdTAwMWb7zZy6m+1ccvGlkXqlXGIlvlDataRcdTAwMWVT0GNJuyFlXHUwMDEzkfDGXHUwMDExRfO+Y/Y0eMAzs59wXHUwMDA2cmzuZZlcZpGE67bbxGHMjNGOXHUwMDE4UuHH6Vx1MDAwM4vbOkhB3zDkXHUwMDBit1x1MDAwNmVJ6ZknyjlC1Px851x1MDAwZvk0jkOs1VrCy1X/PW/9trWtNI9cdTAwMTE2OZ2HRaMjiOJxLmT6hFpjdOE8XCLIg3SGSIT6YnJ/78ZcdTAwMGVKeMrMn1x1MDAxZVx1MDAxOMLW5XpAabfJ3uczvNWDsvPiXHUwMDA0aFxiddfSXHUwMDA0XCKZRStcXK1+eKppXHUwMDBm/8amont6ejm+XHUwMDE1tW+nydLZ85xgOZmRUIh69LPxt96lp0Zsxc7pijqvnVrUVX49QNJeLvVcdTAwMTDnc7H+iILqY1x1MDAwZX7+9HuJiGuIxsVfXHUwMDAxl6Vqf3zGw4KBtdnyRI7dPIImZJD8XHUwMDEzi9PLO20n2M9dm6Fd0/BcboJ3aChcdFx1MDAwNFLJ8V2iXHUwMDFjbV/QXHUwMDA1z1x1MDAxNDxJ90cxIVx1MDAxY5tcdTAwMGJcdTAwMWR1vVMrKlx1MDAxMjbKtINcdTAwMWLl41x1MDAxNVx1MDAxZKw3rVDpXHUwMDFliVvElLyaXHUwMDE3Y1x1MDAxNlx1MDAwYnuZeiZcdTAwMDTFiS3Z4/eGMLtXPP973cOwlUPlwJtccuRLSeug3LtHqaLBTiFccuGRh5yukJNcdTAwMTNPJSi94fRcdTAwMGaW81x1MDAxOIO+/1x1MDAxZWVQ1Fx1MDAxMFx1MDAxZmJxachacaaO6awslrjmiUXtzb3yLULiSFE/XGZcdTAwMDVp06w3XHUwMDAzN1x1MDAwMFx1MDAwNEew3J6L5XBfZElQOU2Hr5rWudmqp+qc9YV7XFxcdTAwMWbw61xcn6fSmIFcdTAwMThT87iy/+ynKu3nMundXHUwMDAyZmve87nbxTf2sfR4M+1cIlxy91fKatdrYVx1MDAxZt7aTu9cdTAwMTknO/2vhPix53mBXHUwMDFmiGGnLdawXHUwMDBmn1x1MDAxM2F4flx1MDAwZcHP1C51VGBcdTAwMDN5NzDHro3q0o6T/3nM3ztU/n63TPmfYcX+i9BSxYZcdTAwMGKZKNP9N1xizlxc/Yx4Zd7yI/O378HKezxRbeKUsVx1MDAxOOhBSoEkfmNRbi2199gyUP8m6u14UOZcdTAwMDHh5b8t221nK0B7RdlcdTAwMTlGiaVdlu908vvwXHUwMDE3XHUwMDFiZ1x1MDAxYVx0XHUwMDE5y35cdDU08KzeXs2IpC+0WX9Ft9dcdTAwMTOwXHUwMDFhqKmEJEtcdTAwMTaB4TpMx5BmPCw/+sWyXCIhO3P3XHUwMDFi4L+P11B221x1MDAxOdFcdTAwMTf8uFx1MDAxNfb3M3kqj2ZcdTAwMTLNb13jIWagXHUwMDAyW6Jy39eo+LBcdTAwMDdcdTAwMTko3/BcYmFcYu5cYlxc6pu4fCjDrWQ2rTLpLf2OztuRlzBD01x1MDAxZFx1MDAwZt5cdTAwMTRcdTAwMWTi0VW/XHUwMDFj3lx1MDAxYu9r7Vx1MDAxN/N8rT8z1/fp+X97xn9rr1x1MDAwMFx1MDAxZV1cdTAwMTEky5eWW6tcdTAwMDZubkugXHUwMDA2odXtrH1D0Fx1MDAxYszwy4Muu3KTSEuvf85cdTAwMDTZm1xuhTUlqVdcdTAwMDBtZ/Fz3tjjo/Zv8KR3Xlwi8sCynlHsveSUg5+ibzRcbilcdTAwMDb51Fx1MDAxMlx1MDAwZUHBwTXEg08/ti2hblx1MDAxOfCXQO+mVuO/+qOlO6bCXHUwMDA33ihcdTAwMGZBXHUwMDFmpo11/Fih3bJcdTAwMTNcdTAwMDQl3LRp/v1cdTAwMDb4ZG82jpc6j6+Kp+WaWYG+qFx1MDAwN83VXHUwMDBmh9D0/otcdTAwMGZuZS5cIiS4XHUwMDFh4lx1MDAxOP9tXHUwMDA0XHUwMDEwLNyBcPD8fT5cdTAwMDXJ+jBZ2tNcdTAwMTVKXHUwMDEwZiXtx/vtSiVTsrXPVr9xZEq/h3bkkZ5j6Fx1MDAwZYZ8ZiCY8Pzx/Vx1MDAxN37jTNpLXHUwMDE0XHUwMDAxW9x7mGnt11x1MDAxNsQ9kzORXHUwMDBm9nd+3UZR0S1aU1x1MDAxY1x1MDAwZkFcYmFmSfPmtbV7+FxcPrSJqtZhtbrzmfDoXFwuyfjPOo2bSoMkgshJ7E5pXHUwMDE4XHUwMDFlXiPu5/7tISHzwLNyiVx0f+DAXHUwMDBmg9xmWiHC1+/weVWtsONcdFxmXHUwMDEzw3Pf22G+3MDL29f+XHUwMDEzXHUwMDFieXREa5foQKpFhK1ooFx1MDAwZen4coU5XHLRQz7mgVTBaImVSXH3kKBSkP+ayj0sxGaEnHxRXHUwMDAxUs3Rr+DAXHUwMDE0vtIqlr+lXHUwMDBlX2XyY2OJl7Bj2F77+eKiKZHn8+e/flx1MDAxYj+A8HuyaVrej4LobyAhsJoyq6hcZqaBlVxyylpcdTAwMTJcdTAwMTFYVHtolvlmcqSpJcFg+1nJmYJjP1x1MDAwMim/ooMvVtmEdJmuRnYh1UDLuuWnw2ZcdTAwMTnGXHUwMDAxblaOXHUwMDE2XHUwMDFk0oZDXHUwMDE1R4r8Rb1wcVx0NYRBaCj6nsB0ylKIgWm2XHR/cp/iTdVsXHUwMDE38SxepE1Xi/cw6Vx1MDAwZSc4ZDvsmJuvSmTL+1eSI+tvL3gtYZOqJFx1MDAwMlx1MDAwNTGZ+Ixi+ER4g/o+eL5cdTAwMTDP41skWVx1MDAwM8tcdTAwMGWJXHUwMDAy9GzOXHUwMDFjXHUwMDEzXHUwMDFmXHUwMDA05JrlST683lx1MDAxNUYrL5hcdTAwMDM5OIFcdTAwMDZQ2ZZcYtlR7bJcdTAwMWV0lcQ3yC7iXHUwMDA3NIRD6VdSfZGwvma/TlxixX1gPJ1CZFxurjy9279cdTAwMTehxlx1MDAxOPlcdTAwMTSD+ikt1eF9f8jTJ9F0XHUwMDBmdeqSZKGlyMd6tlx1MDAxN1end8y4XHUwMDE4VM1cdTAwMDNdtt/ywc5cdTAwMGa6UbROO0BH/W28MJxBP1xmXHUwMDFjKEhcdTAwMWE07Tazl5OcSMNLRNpwJsZkXFx1m1x1MDAwM1x1MDAxZq9rOtBXXHUwMDA3XHUwMDAyxHB+3bwhP7vMN5n/XHUwMDA1M2RcdTAwMThUmrpqpVLWXHUwMDE5RsLo2oBmbU5cdTAwMTe/d3c0XHJlwpZDSJr7wPnCclxmiVxcsPLheFmgPK1GP9C7v1x1MDAxMcFcdTAwMTD6k1x1MDAwNduX4KJcdTAwMGW2V1x1MDAxNVHI9s3heSj+7uf/Mrd3XGJcdTAwMDVfsVGmftRmq65cdTAwMGK7YJZU1l1cdTAwMWZKQKhcdTAwMDN+flx1MDAxNk2ePvwnaLpcdTAwMDVxwTvsaZFCIckucOfVtSHpIP5TyCc7Wlv3XHUwMDA0XGK9Qq+3JvU4iztBhe6VKSn+XHUwMDA377xjh5Lq0k1cdTAwMTmAd5JXPlwivO7Xp7Uj/nhBrTWg7Fx1MDAxZN+8xtJcdHlcdTAwMGYjXHUwMDFkdjDhtyZLyXtt0stELGOJQL03ITdcdTAwMWGUUlf5c0zRlS3gX2i47dxcdTAwMDNkMD593eB3ZNlEmNgl7tXPXHUwMDA0Nk3Ht6Fe1rRcIve3T45cdTAwMWLm8JCKcH+vKd25NFLr3zRcbr2woTRcdTAwMDOIJYWmpVP8+TtcdTAwMDF+a/VcdTAwMTkwVLFIXG5j05GV1lxmXHUwMDA3WoisPbuiXm7KXHUwMDFm0ILKkf6vvVx1MDAxMouwSlx1MDAwM8dcdTAwMDPKl1x1MDAxNWu5hJTVXHUwMDFmvtxLt1DZmGim61x1MDAwYp6aRn2Bj36+slx1MDAxM12DrrOzjYdga9u3mrOSxVx1MDAwNCCfWsQ8XHUwMDFilNOjXHUwMDE2dL5cdTAwMGJcdTAwMDZcIoK1XHUwMDBmYtRcdTAwMTGO9CNcdTAwMGYz8m/7Ufwy7LL9KMLCLdVcdTAwMDCkIFx1MDAwMbVcdTAwMWRcdTAwMTele1x1MDAxMEfzTJtENFx1MDAxMEGrX+J1MPZgWdPPQXIwiSpHfGyoxJvPOsmamJFNXHUwMDAz7KJSlvrvi9H4XHUwMDEymkNcdTAwMTamV89cIlx1MDAxYdOMLcFnlSlcdTAwMGaNWJC6iKtcdTAwMGVz4pdQ2ZXxcrnHjmWYfUNY59m1KVx1MDAwZVx1MDAxZINyWW1yXHIgXnpcImxJLL1G33Bl7lGkRdWu3Fx1MDAwMlClSo2wJPPN/D0qpSqVIFr8+1xi5VPXfYZ8/75cdTAwMWZcdTAwMDSUf05C2vx7UF9cdTAwMWFq/I6RXHUwMDE34l/gv8dANuIzyZelrdT6emj89vhcco0n50GRbL9YYbJ6XCKVTCSYeauT1bxcdTAwMTlwx8gnjatY4WX7XHUwMDE5V+OuqX/LsVxyN7VXbiV8KrVGoki/at9cdTAwMDS9dCdS9bL+XG614de6heojvzwqyCdcdTAwMWFcdTAwMDVcIqkkUzNu3lx1MDAxMO34LML2T2WBd1x1MDAwNyloxaLGZrdcdTAwMGXbp6NxQd/8uurCLTZzQ/yybc/EXHUwMDAwZFx1MDAxM/VEc1x1MDAwNl1cdTAwMWM+oL6d5fVHjmORXHUwMDEwn1x1MDAxNLCNo5fk/Gl7t5z5T03MZ02i1JpmU9lcdTAwMWackTpcdTAwMDTZV9VJXHRUKlxuXHUwMDEwIFx1MDAwMWmmtFxuq7Q45DB30neARjdcctxcdNGGMii2p7JD2lFHhlx1MDAxZCBz/tBef+mTLm+cYkCP6zFcci8qxaXVgsj8NlxcXHUwMDFhXHUwMDEz/LBSjVeInJhcdTAwMDdcdTAwMTZcdTAwMGbqMJlcdTAwMTBcdTAwMTVp/o+r81iOUGmi9Fx1MDAwM7HANmZZeO/9XHUwMDBlaDw0jad5+kH3n5iYe1eEXHUwMDE0UktUZZ78XHUwMDBlVGXtYlx1MDAwNvxcYivsVtVccrOhmjNcdTAwMDRjRUT5XVSPjkuvXHUwMDA3WTBdXHUwMDE5XHUwMDAzkZOrd8k8Uk22jlx1MDAxNastTvNOrtaTPVdwl/6CaYSkSYGQWYazXFy3XHUwMDAzXHUwMDBiSYZMz8fwcL3965rxVpCTjcBIP2YmXHUwMDEwsn2v67ErXHUwMDE2ss1p+bfe6sSa3iZz95vtXHUwMDE5TKmJPF8p6SFALCmyXHUwMDAwYTh0XCL4XHUwMDAzXplcdTAwMTVk/LGPym847te7ulrE2Vx1MDAxY+H+PmZcci5Ed7OC+8UnXHUwMDA3z5pDefh4xrRvRrhcdTAwMWZCttFH1TS99Vx1MDAxOUjlmlx1MDAwM0GxaJk2RTi47l7Z6Vx1MDAwNUmJqnM3LUYxZKVcdTAwMGXn59NcdTAwMGLVXHUwMDExyTCh/Dq4qVrD2VhcdTAwMThcdTAwMDBcdTAwMDPRwDKiMy2hPC1as/5cdTAwMTa5XVx1MDAxYSZvgnpjXHUwMDFkVKVcdTAwMTLvMn+biNh4w1x1MDAwMCyIkFx1MDAxMahi9LjWm76+tHHmXHUwMDFhtGlzPfMyLc68uzHzu5YyJHk9SkPyj1tHWqaGv6VcdTAwMWO1XGJcdTAwMTEyMO5cdTAwMWWOV1s4T4VPTVwia1x1MDAxYSOWXHUwMDAz11x1MDAxZlDObDtcdTAwMGYyvExNPnS9pP7PhpFTSEjAmvxwNlxmNl48Jlx1MDAxNz5cdTAwMTKj9ltrtlx1MDAxN1LA3Gg+VCp9iFx1MDAxM1x1MDAwNFx1MDAxY5v7M7++Tc7Yyi7zPKL2lPpcdTAwMTej8LexdT2wZYrMfrblMEo5fFx1MDAxZlx1MDAwZsjeWdmvmWyQ8uLtpUbhJ6c1VIE29Vx1MDAwNuKq2bsvqFxirbvp5HV60HymL0VuTauHqWk6v5jGIOtcdTAwMTfMXHUwMDFhcaRcdTAwMTlcdTAwMTNJ9Vx1MDAwYlx1MDAwZXBcdTAwMDR0XHUwMDFl9yXNQT1cdTAwMDXI63Rt5lx1MDAxMkQ8eTo8j+W70k7YnILCl7HQdcNVXGJic920TEmuePuPz1wiYyWo5Szko+46klX0l2NWbLdemEOuODZkx1x1MDAwMFxuTNFov5CeJbLO1i85YDvfmrzeWGad9T5v0WzFQruLRjaah4JoUJJcdTAwMTMyNpR3yU3FeO+LNVs1sFx1MDAxY1x1MDAxMCQ7Rqalu/2GdDIp/Fx1MDAxZst9Z8CFXHUwMDFjV/YqcUk12Xe+XHUwMDE2sppf81v7XHUwMDBlzuj5feeduaD79UWWJtJWUbt8uvBXpfBgUVx1MDAwN7tA6q9ZXCLLrClcXFS+idhcdTAwMGJWe1fZvFx1MDAwZlx1MDAwNFx1MDAxMZm4XHUwMDA1iYSoiKz5cVx1MDAxOFx1MDAwN6Wl8rlcdTAwMGVcdTAwMDVcdTAwMWbDR1xidUKDXHUwMDExXG6x3Gs2Um+cILPrg4SGkMxKddNm/2ZpKfzFyYJ/y50w6Eab/UH77rI6e0yXq8Q5OilcdTAwMTVcdTAwMWPF4fOydo+aYFx1MDAxMOHJeVx1MDAxM3tpi39PU4w92c/vRsN6c8ScdaLnXHUwMDAwQfUzXHUwMDE0zZn78sZoRqXAwVx1MDAxYlx1MDAxZS9/2uX7wmfm7Fx1MDAxZFx1MDAxM/nAZG+B8Jo+uMCKQjB1z3orylbzeFx1MDAxZo00sylEZHeg6lxmaGbtoMJcdTAwMWGZPNtcdTAwMDPVz/n2RZWhyYGCndTHYYlO8mCtJYFcdTAwMTn0TWWnrIlcdTAwMDTY12hcdTAwMDVvwFx1MDAxNTxALzCJJnWktWyoyq6pYDJcdTAwMWWSXHKlXHUwMDFlp1x1MDAwNzvFOVxyhbQj0KqN1ZhuXHTpoWxfXHUwMDBi0ZrDU68vWoxcdTAwMWLExlx1MDAwN6zlq7fpwY23XHUwMDEz3Hhh4GTzXHUwMDBmwu/1vLzT64pcdTAwMWOff6XfMHNysumFXHUwMDE37rO7Z0Ft7P+utlx1MDAwZoqnXCJaWlx1MDAwZaPvT3JwlvzX4acmIFNSPlV1MHpk34ZcdTAwMDa3MutBYIO2c3E0ZpnEXuiDXG6eNlx1MDAxY8qAzU7vx3xfbOg2XHUwMDFl5CmGX1x1MDAxOFx1MDAxNsA5QUdp8Hn8W6bTXHUwMDE0LZW700R4Klx1MDAxYv1RQ3QnXHUwMDBmXHUwMDE1y5BGMfFcdTAwMTfp7HYtLd5rbb618KlKx0djJ8CuwCnw7YNcZqHEsOeZ+Zxd2aREh1x1MDAwNFx1MDAxYStcZlN06eXfn+pFRmtcdTAwMTioON3i5Y/7vVwilutaiHxP412fZzFpJKtcdTAwMDF7KDhSkHDwXHUwMDFh/93mXbmAclx0iaHwmPCKcoFPPDyQSlx1MDAwNJnA8Vx1MDAxNsTlKDZLSbrazqTSfP1i9kvMyiQ2oafErFx0ezriy06icWzC9Zj2KtKhK2HIXHUwMDFhhEE9yjefoSZcdTAwMWG8/UeCvGn6XHUwMDFjLq1cdTAwMDZ1XHUwMDA0N1rFgFxiXHUwMDFibkWCmEDKf1x1MDAxMWrkbOfY4duru+NcdTAwMTNcdTAwMDKm/Hqv6mLReX/vj1x1MDAxNOdcXODubFdgjlxuLlhjzknvdsVg2MpcdTAwMWYrjtlcdTAwMGZcZnjupzROu3h4zsaRK/HGNkG817d1ftZcdTAwMTHBM54hfJNGXGI1XHUwMDA0JYFP649ZN2dQ2KpcdTAwMTl863Slesm5amF4XnNBXTdcdTAwMWOev5/7XHUwMDBipO8pXFzHULPk6zezNsl9XHUwMDBlpF08POHMj1x1MDAxN6KGpLW6XHL4zFx1MDAwNVx1MDAxZM2diWqzgGuouU9synTnXHUwMDAxXHUwMDExovqeXHUwMDFhoIfztPNSr1eTujmfTVwi/ENFrL7iyi6RoqdQrFxy4WVcdTAwMDA3Q5A8PlxyXHUwMDE0mlx1MDAwNlx1MDAxMVx1MDAwYrRcdTAwMDBcdTAwMWGbkVwiXz6rsZ+oMUUwvKFwMjG9ilO/IbdOXHUwMDA1e25cdTAwMDEu4DYjaTY9pn6YhV+qnTHAtGSyYnP4vMmsUOPjUy/1I9C+hIq4XHUwMDFjglx1MDAwN894mOy/d/VyYHrDzvFcdTAwMDVPjuC7XHUwMDE3aUe5k7wst5bLXHUwMDFkpVxiPlx1MDAxYt5cdTAwMTHrfN+zNnvfJlx1MDAxYUfCWt5cdTAwMDbbiJ0jttbf8/jd2t/dQ1aOWH5hMVHr1yWpX0z4yWTPXHUwMDFhY1x1MDAxZJs/XHUwMDE10iXpbMrGoE1WluOo6eFEXGJ8blXd2KxcdTAwMWZ+mdo6kFx1MDAwM9RPboW3+MIrTNtN+C5HaSavVUSbWYKDXHUwMDA07EfQOWzM3zUyZoLzXGKkS+fNufJ1MNneqzexjFZxnlx1MDAwNP4rfTCZhfnARpi1XHUwMDE4JtMxTe3z5cW6a1x1MDAwZmniRs9ccsJ21IB1JVxiimhcdTAwMDWWKdU3TNrQXHUwMDE0XHUwMDE5dfpxXHUwMDEw/nmMS17ISpV1tVx1MDAxYYapiNNwR7RsM8b8KY6MksZ2KZc3izFPfEJv7EjsXHUwMDBmfExcdTAwMGX16lx1MDAxMFMlXHUwMDAzXdL6QPJ153xHPaTkbTZcdTAwMGJftptcdTAwMTCkjGar0cj2SFuQ/NKf1e+hUrXIt2X641xyMVx1MDAxNITAbPBcdTAwMTHLrvo75sRcdTAwMGZfb0Mg/fJOsVx1MDAwN1x1MDAxNtjHXHUwMDFml1wiJWxcdTAwMDBqa5TsxVx0VO+PnKXsY1wiXHUwMDExjdtIsSY0XHUwMDEwXHUwMDE3bpNcdTAwMTT5zFx1MDAwMWr1t/glgPJbfH11+FdcdTAwMTfAOkRo8Ld25tzOXHUwMDAxdVx1MDAwMYs+YjhbmfgrvzZtrJ5cdTAwMDVYNzCChzOHuVx0ZePlXFw1tr6dXHUwMDBmarQzy1x0b5qkwrowXHUwMDE25Y3bXlQ6XHUwMDE5iXmdwYX53k5cIjaxQNeiQXO6XHUwMDEzzk5cdNFt2CSyaUe+d0NcdTAwMWSDPYXlSr3dh8/e1HBcIsCxi1x1MDAxNN+CrDFLb6HCXHUwMDE54SlnnXtpXHUwMDEyhtg5XHUwMDFml1mboLliZ9taXHUwMDAxMcZ8t9xbplx1MDAwYpWFXHUwMDEw00BK/Vx1MDAwZYYwXG5cdTAwMWZIy8Jh8GImKeu3Y42enoJqWlx1MDAwMNpcdTAwMTVsXHUwMDBlT5k/zEtcdTAwMWJfXHUwMDA108Jv/KVyhorJeG5cdTAwMTfMpMD8Jq9xYsSzWSg8tFgypcCLPMzcwLyPxv3a7Pi3PkLOqIKOiSxTx0lTvZSGROnNXHUwMDEwNX9+wPhcdTAwMGWyfeVnjm9cdTAwMTNcdTAwMDPqsVx0SpIuKlx1MDAwNj1kXHUwMDBmlkXByM5cdTAwMGJiQvuLIZuA3vFk6cTGiORcdTAwMWEhXHUwMDBlXHUwMDA0+SpBW8np2+Jz+ctcdTAwMTn2Sfo8M1lvXHUwMDFkbvP18fgq+ZpcdTAwMTUy+XXs4bZ511x1MDAxMPZoslxu31nShXCLK1x1MDAxMTRuWqXzoIQne0H4gsk5plxybZSbVnL830dLSvx1WvKr1uKPXX9lPcY5vXmJ91x1MDAxNGeGRTUovzZN7HyjQSi5ZVwibFx1MDAxNqFcdJFbs3lcdTAwMDNtn4Zuid1cdTAwMWJcdTAwMTfeXHUwMDEwj/tcdTAwMTRcdO7H0Y2zyOqRc1HZeVx1MDAxMMrNX5CVw8hcdTAwMTNz9Vx1MDAwMUHZpFx1MDAxM/735T/CxfP5poB9jIuaj2qhQGhdZZ/iTVx1MDAxM0TG0vuvZ1mw5Ofrg3eLaVxyoSOjXTN4SDMtMlxmn1m4YJRcdTAwMTTkRa3G3/NbwJXbQlx1MDAwNZNcYrBNfl+4/IG16qwp0zr5t2XVXHUwMDA0fqOYXGJlXHUwMDEw06KNoSB3Vr2wXHUwMDE2XHUwMDFlti5Q1kK8LlRcdTAwMTJcYqJcdTAwMTSgROxLrcdErr/IVqnLfVWe6oiLK1XgXHKPbHGiIFwiyZ3WXHQrq95OmETiirOxYKpcdTAwMDFpcZ+/vVx1MDAwNVx1MDAxZvdcdTAwMTRcdTAwMTFIv1x1MDAxZGSiNSBikFx1MDAxMqNcdTAwMWYtcvIkXHUwMDFjnMiV4o98cs9soWC9rZZHZlRVTTdcdTAwMGZcdTAwMWNcYpdxKvhcbj1mXHUwMDE4wzh1k5teP7VmXHUwMDAynd1cdTAwMTaTROTMRlQjP8an2CtcdI3v0/w4QFQyps/+6S7owJ/UbdxiXHUwMDE2JsM3u4K3ydpLyjYuXHUwMDAwlPti8S6n2GC1ceRBK8ZfWEN57lxy56XsXGJcYnNcdTAwMTCRj15Pkbc2xVx1MDAxNoBpsJuEf3NcdTAwMTUmkcKx91xiJlx1MDAwMlnD+egl+txSXGKIXHUwMDE1XHUwMDEzZf2UXHUwMDA1wJK0XHUwMDFhvr/tf7Di5iZcdTAwMGWcpaO+mz5jbJIvYJDSSail+dtcdTAwMTZ3juR52lXzza7/eVx1MDAxNo+OsFk3vnNeXCJoX5I897wq2rxcdTAwMWTfiPi5cL9N1G+dSkVfpz9cdTAwMTDW1vyAak2vILWzj8U5u1CfeVb+PtaPapfJNPXVXHUwMDFlYDgh7Jll+0zhbclnXHJcdTAwMGZcdTAwMDA807PH+r7wXHUwMDBlyo2cP3Jk+JRcdTAwMTn7blaBXHUwMDA3b1x1MDAxML05g/104kXfXHUwMDFmmdBoaHWYn+RapCC8X8yJr1wi1Fx1MDAxY+DLs0H1fWWu9aH39HxlXHUwMDFik4TTJIfaQZIkt1x1MDAxOOp5+7hOx1fM79jXPPgtjlx1MDAxMcAo9+2v7tVApJ05XHUwMDEy6NpgWaQti5OZio6vUaC8XCLGsvlcdTAwMGKqhtxccrtW+/3Jylx1MDAwN0QqVntHXHUwMDExojwzq52cjKduRlx1MDAxOCEtXHUwMDEzpt6FXHUwMDAzTCGepuWqeS1GM+pCUZq8XHUwMDA380nJ7E4rV4DpyktcdTAwMTbzKyE4SVx1MDAxOe783KLPZ+r0h5LOW/yNqdXfiH5768ffybb5STh3t9LaXHUwMDExslwibmOkpT2sQ3nPjeqsnlx1MDAwM8wxqp1qXHUwMDE0izg/pl1cdTAwMWS/UGthXHUwMDA0+5xFl1PDRqJcdTAwMWZTfVC84fmrXHUwMDEw9apcdTAwMWKMKFx1MDAxMYfAXHUwMDA0XHUwMDEwclx1MDAwMOeHPTjKMdzbO3FcdTAwMWN1XG6s/lx1MDAxZY7x+Y5s9z7z2D6AgHdvNONcdTAwMDV+XHUwMDEx6lx1MDAxMnkmstZyhtsvTnzulOIl4vUxn1xmuvrHXFz8OrJdtVx1MDAwMFx1MDAxMVx1MDAxMW1iUaJr5It5d+Jw5Fx1MDAwMVhcdTAwMTEn+eAuwiFcdTAwMWNcXN/HuLzrXHUwMDE3XHUwMDEwzvyJ4zZqsuFcdTAwMTlcdTAwMDP9XHUwMDExqJF3XHUwMDE2XHUwMDAxXHUwMDE0x33smLw64sYzlf3df0mc0dZoXHUwMDFilsncmFx1MDAxMJ6TJXKYuFvDXHUwMDE2s2/u/Fx1MDAwNVx1MDAwN/PlXvVTo79TXCKveTckQEJCkuaL3Nixj5KhKIPYK1Vmt0dgjlx1MDAxOZ7WXHUwMDA3wneTtc5cdTAwMDdTNlOo/3rUtmcgS9JaJ+6siFRAiHVqgdT0zYcr+ZZcdTAwMTCKKrKN0mRoWGjR3vclTE636sqjXHUwMDExKVxyXHUwMDFm+lwikeFhXHUwMDFk0ZBcZs055c9+XG4284I+dET7OaZp4Vx1MDAwN1x1MDAwYrzf70xnJVRNUupcdTAwMGZKXHUwMDE4Vlx1MDAxYiStdaU2MsL2r2lewmWNsr+h31x1MDAwNHVf2Vx1MDAxYpVhi+xdj3hJgNGN/IO9tVx1MDAxYVx1MDAwMFx1MDAwNbCqK4jBZqiVleDy2mlcdTAwMWZ8z565M3U29jrX6+z++vfqjUzo//q+7FxyXHUwMDFlPXaBb6JB1sH9pe+WkCc2XHUwMDEwdfFcdTAwMDA2ipKyQr1cckJaOb8uN+86gt3523V3/3o61zT2O0c9IzF+bXzDWzW4a3zcXHUwMDFlXTN2clvfrXGyU0lgXHUwMDE4lH/nt6n7iYdRR1x1MDAxZjVzrT7nJtjmS1x1MDAxMsSGNlbfW1x1MDAwNPj9M1x1MDAwMejwfk9cdTAwMTJL9Sx8kvJt4Dz/JV7NXHUwMDBmYinlJV1ARXerXHUwMDE3lPUrPoKxsYLYb1x1MDAwYjJueYJvXHUwMDE44PzkrVx1MDAwNIOHUiGtXHUwMDE48sPMf21cdTAwMWNcZo+LwYbD9fNv/G/9XHUwMDE0Uj+VObnv71qLJuun8P961UIkRrTz1FxmVHiiic9cdTAwMTfv4CpJy7lcdTAwMGJcdTAwMDObuXNp4IEx4WLe6EhbXHUwMDBmX18knXV47qV55/aTjqSeM5xIM/lDK0/ZLdyOiljotd382kXTXHUwMDE2msLE7/tcdTAwMDdcdTAwMTRcdTAwMDJallx1MDAxNe9BzNrzgXF9TuOvXHUwMDE5giHbo9NNssaLz6+o6Wr6XZNcYq6lPpNsQYWc/Yz3/ZNccnGjX5S4rlx1MDAwZlx1MDAxN8lcdTAwMDFGs+91mVKIxzrF0/tvrDwxXHUwMDBmTf1YXHUwMDE2b0e1oKGm6G+iPnk1XHUwMDAwXHUwMDBlp0Gw+KVcdTAwMDd0vluUmnJpxHjC82dcdTAwMWYvKlhZuqnGsZ/NT1x1MDAxMFx1MDAxYlx1MDAxMr5cdTAwMDdoXHUwMDEzd4bsSGmLvvPqV4vpV6HfXHUwMDFjXGJp8vW1XGJyafj+kVx1MDAxOYc3kr5cdTAwMTjztFx1MDAxNqe5JsQr4Vx1MDAxNrXi8iZbz1x1MDAxN4mbXHUwMDFl52ePlcKIt9LBXHUwMDAxojTOQ0hcdTAwMGZrfmstS0udiuGTvrut9zFvlS3diCgkkK2H50d20ezRXHUwMDFmKUEw9yCpuvw28p/7JqXJiFpcdTAwMGKFco1MqipDX29dRo2Gz1lcciq21fAmfuZ1dFx1MDAwYoZcdTAwMDHfYfC7XHUwMDFlo9D6XHUwMDEwXHUwMDE0U30rXG63ppq2biXlLvSf589zalx1MDAxM0mf+eRRbIPbgVir4duGXHUwMDAxxEgoJ92VJ/xcdTAwMTYkXHUwMDBlXFwq7Fx1MDAxYWWss4RY1aiFXHUwMDE0htSby1J6wtzfXHUwMDA1zn9vXHUwMDEwUmZvvHXcfCwh+DA12orniFx1MDAxNKPkXHUwMDExTHB8XHUwMDEyn4lcdTAwMWHL8sSiXHUwMDAyoplA31x1MDAxOU5q3ky2Mt9uUbJcdTAwMTT8XWi24Ea6iGlcdTAwMThZ7Vx1MDAxN59G3HtNikGoQup0WmmrP0xcdTAwMTiWe1x1MDAxMOggh47Xl7ZcdTAwMWXae+yhXHUwMDE2kvyAXHUwMDA2jFx1MDAxZd2oOXXHwWrAb+fyySVRnXyvXHUwMDFljdP1vGP4T4/xjP9bg1k5r3hF10bNtFx1MDAxOeT6a89S4smu5WRcdTAwMGZcdTAwMWVcdTAwMTLmRVBcdTAwMTO/fYhzXHUwMDAz/eVKbHGMtLrpKsQnx/vr6HyteFx1MDAxMC4qj/ZjLlx1MDAxMONeXHUwMDEy/1x1MDAwZTGL7jFofm34WaJcdTAwMTmMd8OLXHUwMDE1xODqSlx1MDAxNLPMa1x1MDAxY39Gq8mGKVxmqN9cXL9iZ9K3oChcdTAwMTTtapZQn10vXHUwMDA3XHUwMDE3YPCn1qjYXHUwMDFiMlx0foVFXGKbpGajZetcdTAwMTXLj4k0L+RxWkp66M5cdTAwMTCqa+hG74fdXHUwMDAzvDEkY7Q0i1x1MDAwMS/3+Z8ouo7tXHUwMDFj0Vx1MDAxMFwiXHUwMDE3eM062EVmLiZrm5L0lUvZJlx1MDAxM4dcdTAwMWOe/Ps8PH8qmzWb77S5qN4p/HOZxuA4kWPeIFx1MDAxYl5cdTAwMGZnpEUzSlx1MDAxOVx1MDAxOFqO/DhcdTAwMGXngWQjXHUwMDEwXHUwMDFk392FyPP9IHy+rt50XG6Lrlx1MDAxMazZ9LNqpWmTNktcdTAwMWacfNkv8zJ2iM5JLTUhjdNcYu2312D/XHUwMDA1XtfmqqDmOp/mg75QMVRcdTAwMDWv8Fx1MDAxZL7jkIH3YymO2HZcdTAwMDO7zoiNmkmyXHUwMDFi9E9lMFx1MDAwN2xSLiBcdTAwMWaBaL8sy4F7dv2Rl/e3ef4otuuRXHUwMDExc0Z7Mei731x1MDAxM1x1MDAxNfPI09cxsSBWZtnmrOSr9FtB11xixFx1MDAxMVG85sZcdTAwMGaqlnRcdTAwMWPPfvtcdTAwMTXkRjFxKLBU1Vx1MDAxOXlJT62RTEuQQXRcdTAwMTl1iebnIJQ3VCBFp1VFXHUwMDEzV1/jNVx1MDAxZFpaUSWs2dtbhlx1MDAxZd0oIVh5QFx1MDAxNl2EXHT1YFx1MDAwNyCDg7+MqlwidV5eXHUwMDBlsElcdK24XdDmbL+22qJYVsa2/PJOv1x1MDAxM7BcdTAwMTQ6m9iMqslGXHUwMDE5XHUwMDE016o9XqSRby7hzlNomczo1Lp1TEd1VPghJ55mumHNzUfJuKJcdTAwMTlcdTAwMDTH97tMnJHs+WKT+T5cdTAwMThcdTAwMDdcIpFAME2pXHUwMDFkXGKIXHUwMDBlgtQyLtjYNVx1MDAxNJbbpkFcclx1MDAxMGHYVmok8lBX18VcdTAwMDfxLVx1MDAwZSFcdTAwMDFlnK9cInudU1/H6c+SMJrOW+Lh0t5Ub89sfyNps1x1MDAwMJt3P82XJbzBIFPePoKB/lx1MDAxY1xmYTB0jEl4g7FRQsza4vY5/XpltYM+lKJyXFza6jXSnSbVPYHkdWcusu55RGdMXHUwMDBl42G1QHfbKOpcdTAwMTQ1lm1GNi46qyFEtoLWZNuV90lNXCLyt0B8Q/tNeTjE7jwgVH6dg9A61ejozuxcdTAwMWQlXHUwMDFmlOJcdTAwMGZ//vpnXHUwMDFjJzG86NBor1x1MDAwMCuEXHUwMDFm37pMVVxckpVMvZe9S4G5/VdcdTAwMTF8g8jNNVx1MDAxY1RGXHUwMDEwx+/w8dGfXHUwMDE16Z/Ebmu/wKnVenDmJVx1MDAwNuP260l4XHUwMDE03zy0/7pcdLzxkFx1MDAwZaDzbUxHYjkxTVx1MDAxYZpxacKAwkDjnshcZpGV+/BUla2wISuxc04gaidAXHUwMDFhRUQ8XHUwMDAwXHUwMDE5XHUwMDFmXcq71U9VXFx0VI/Lg4FCg+7k7P97XHUwMDE1PcsxXHUwMDEwMHZ1wKVm4SNcclxcXHUwMDE4XHUwMDFm6Fx1MDAwNTiyWO6l6JPEsYrDWyyjNVx1MDAwNphcdTAwMTaKvVaz83aFq4SlWVx1MDAxZSmWcNTJSGP2QGmcb1xyK1x1MDAwZlx1MDAxNMw5XHUwMDA3iuvhXHUwMDFloi1cdISJ0zBcXPF4gFx1MDAxZk2zQ6GQMc74s4PfpFczXHUwMDAwh/1pvlx1MDAxMd9cdTAwMTHfeUtOXHUwMDFjXCKGln3asdbfQVZs51x1MDAwMCqEZtqUcVhkYUiCKj6fVZfetlx1MDAwNvIkXHUwMDBi7lG2IVx1MDAwZjBA/Yk4WJeXV/ZcdTAwMWHZXHUwMDE5uFwiPMjVvIFFgUG6XHUwMDA294RQ+5hUnIF6ouHOh6lY0pLyx90pKEmlJ1x1MDAxMNHtXHUwMDEza1Q5tV7dn2Trfjp/NbaTePH6hs/DXHUwMDE4XHKLkzfw+rlhO6dMndle6+Elvz9T0Fx1MDAwMIfAXHUwMDFiuKmqU9XNZY2EV+lpv+5FQI6hTmpfI6Z6aaftuLdcdTAwMDL0pMnuSlK1b3rCUfWx+FTnXqPQ8IOOr9ysez3yq/2JJC3A1/bUXHUwMDA2XHUwMDA1oozxLHAtXHUwMDFi1yPQp1xc3+TG4Wauq1x1MDAxNOcxp75XmiuXXHUwMDAy3aHcT7FVLJpcdTAwMWKb0mojXHUwMDE4n0GZXHUwMDAwg1x1MDAwMVx0Z+85PJmK9Ytyn6bgZFx1MDAxN3/wtlOdztBzPJdcdTAwMDNVi4DJPGZ2Zodfkq6vJ7a+ukE/kCjWJHba2yQjorvlebIooK2nx7CtUjRcdTAwMDeiMZWrcVx1MDAwM4CmV5qtNT7YS+FXSJ30V+Kk0excdTAwMTj6J9O6XHUwMDExJlxikSRna5/DVcpCXHUwMDFhxV7K9p4nLtKd3dw9d4w/gnV31OydXHUwMDE32G9cdTAwMGXC7Z3YJSRgfyZcdTAwMDGXXHUwMDFkNdmtMu63lNLCgplcXNl4J2VcdTAwMThcdTAwMDO0ZNlTTpa+qzkkOp3mXHUwMDFiP1x1MDAxOFhcdTAwMGI1+XvPulx1MDAwM9VcdTAwMWOc5s2IXFzAxqOrSehNXHUwMDA2aT/MXHUwMDFj41uYZy0/p7+K5LJg/5x4kpurY1OTtlxyXrOdZkFcdTAwMWPQoGfj0HuFYGyOek5zsc7F1zNmdu3AOyZkLMOGV7pX1/9Lrv9dXHUwMDExM1DeLFxuWMxJXHUwMDA2u/2cq1x1MDAxMFwiatCGRvx4aFxybPVcdTAwMDBcdTAwMTY6i/DSYfUqdHiom0HsNdIy+YbMzFLoXHUwMDAyXHUwMDE3QyQqJoCcXHUwMDEyjttj4/RLelwimZxAYOMgqFxuKY6DVPdcdTAwMTeB4mYge2PnjTVcdTAwMGL7c1PSXHUwMDE3kFA2SLf6XHUwMDFiWkRcdTAwMGWris/D30Bzfl7SetxcdTAwMGZdaCdHQXhcdTAwMTK8XHUwMDFhXHUwMDAwRoVxsmzCx7fKhsMz1zZvT35dpXJcdTAwMTbPR9eaMzaCcPTv0Fx1MDAwZptj11x1MDAwYvS1XHUwMDAxflJcdTAwMDRaOWr9l5mXR1x1MDAxNzJSP1x1MDAxNe+vXHUwMDFm5dAso1x1MDAxZVx1MDAwM27LOjnpdlx1MDAxMmOI9lVRXHUwMDAxPfGHlsc0IC2d+m5Pap5cZjDOXGKZXHUwMDAyw0vFiiGVujy5Y/tR01ONXHUwMDE4gdu7z1x1MDAxYcvxMZlcdTAwMDVwXHUwMDExXHUwMDAx4Yp6XCJcdTAwMGKrrLnN45Pgn/1lLOV9fmNNXHUwMDEwhD6B8YdcdTAwMWSfTTueulx1MDAwNGYsbVx1MDAxMJo2XHUwMDFkbTGgJHhytYS4XHUwMDBiYYuAXHUwMDFjS/lJpv1cdTAwMTMoXGLPJU8qi4hiXHUwMDAwXHUwMDE36N+eXHUwMDExLDVcdTAwMGVM5pCGXFyw9EupWfPJXHIt/VWY+Fx1MDAwNoUjXHUwMDFhNJli/XhcdTAwMTKS6jqxw1x1MDAxZiCuTPXRbFx1MDAwMcTuXHUwMDFi63aY+7fa2lx1MDAwZVx1MDAxZrgzeFx1MDAwMYCpXHUwMDBlgnp9bSVg/05cdTAwMDRcbkeF/rB+cKCKsSSv07pE+ZlbQFx1MDAwMlx1MDAxMesqw1diJplvXHUwMDExwMvNz2D7KYSmvzFrfNtyQvt1XHUwMDAyS2/39eKLZ7xg/E6hsqvmu4RcdTAwMTja+zvM8G9cdTAwMGaSRqqEOlnv0mRfn7JJir/PJ+dcdTAwMTdcdFx1MDAxNL5EwVdEw47TQjVgulx1MDAxYfjpXHUwMDA0R3S5XHRE3ki/inrGP1x1MDAxM0vVVV2JXHUwMDAxgplDLNLLzlx1MDAwN9fD0Vxmw93LVCe3XHUwMDA292HZgFU9XHUwMDA2IcJTZEIyYJ0nXHUwMDFh1CDz1s+RpVtSantCntL72oJHW6VNQVx1MDAxMTszMHdHXHUwMDEw9i6WPEB4WHvmXHUwMDEwhSAwjq2AhMmjVl6qcG173r86v5nD5IhcZqmZr53sxHTrXHUwMDE0h81HXHUwMDE5RPT3XHUwMDA3dlx1MDAxZLzwuFx1MDAxNp6Y0LBqTvrjS69qp0iqXHUwMDE5cGVg3JCaXHUwMDFkeIeojmlQxaWM8obEj5ptXHUwMDE3Pkfgu2jzskDTm9BI81FMnaSf77V/bbOaXHUwMDA3zFiFk6iS3yGP6Vx1MDAxY9ZgSW0oQIjeOU3A539zXu2VXHUwMDAysO9WnG1cdTAwMGZRXHUwMDEztMZcdTAwMWRcdIUk3Wlnr9eVf85UXHUwMDEw2uSI2vBLgJFcdJekpyzsxUvvOb7Cysu5erachkhH90Wizae4KnJcdTAwMWT8RE8v0+w0+jqM3clcYmqQxVx1MDAxZXXI9HeySVFj9KVcdTAwMDetm50kkYCNf9ExQTRTZFDV8NHLKsVF8TeW7Cf7m+5F5WnFfPhaJNDzm33yxiZcdTAwMTGOq4d2lnNjt6+1k1x1MDAxMlx1MDAxNrpq21x0XHUwMDE4XHUwMDBlRn9cdTAwMTJxO7ZT1Fx1MDAwNXjk+6o3wdjqOLZu/4kvp1x1MDAxY+DX/ahUwoHd6lx1MDAxYd/5i6/g/NBcdTAwMDU58YhMpmy2NV5cdTAwMWHfj1Hmqlx1MDAxMCPsjrNRXHUwMDAycNBcdTAwMWPaXHUwMDExyX5fqqvLXHUwMDFib2BpyKpbLlx1MDAwMZT2XHUwMDEwT9ftJ1x1MDAwZZqY+u5cdTAwMTFcdTAwMTlcdTAwMDew6OTvkiOgTD1hOVxmzpS7f06DuEmjX12Ym9m+XHUwMDFkJGVcIo+aXHUwMDA0vjR8eNjDjlx1MDAxM9tSzJR/o7iUrvbzkWSDN2aUMI/7XHUwMDFh3qCP2KdcdTAwMTB62lx1MDAxNO3hSoGGXHUwMDEyXHUwMDE4s36NSGuqxkVt73eq3kNsXbBcdTAwMGbGXHUwMDFkj+tcdTAwMTTJoPyCbqFcdP1vsyOLWLcr1+49XHUwMDFmv1xyfV3B8jhcdTAwMDArXHUwMDA1bJY+eVx1MDAwNiNTiVg77p789L5Pm+RcdTAwMDW0RDhcdTAwMTlUvljDa5NGXmN5c28rPJbTKTNcXHncfYDeYtNcdTAwMDZ3nzJcIupVbVx1MDAxZHGkXGaLXHUwMDFh4Prxk1x1MDAwM+r50uvopf2mhnyranSIyVx1MDAxZN9cdTAwMDZcbqb5T0JQ3dwx9rTop20sTLeOPJSRO8Ku6jOV1DLQRptcdTAwMTS4u0ufKVx1MDAwZYiUW1x1MDAxMI5soVx1MDAxN9yWir+AbXB7p0LQ+aeyr1f5TPEmtp7K65725eLS+VKCbmxJatZMXGJcdTAwMTHV317rulx1MDAwZe1GjMRcdTAwMTBJd1x1MDAxM8psbZqrXHUwMDEzVE21XGYulrbWXHUwMDE5JzPrIYQrslxcWFx1MDAxN9F+UujGULmS0sRX5GfRrd7tSDTa/nVRYn5EbMz5iVx1MDAwMY9cdTAwMTA4MuKSNnmPfClHVKqS0pdISstcZrn+Y1x0XHUwMDFmsXBW0f5cdTAwMTLMx9xC/Fx1MDAwZSFccu6fqX5iXHUwMDBmwz8/XHUwMDFhr4VcdTAwMTK4XHUwMDA0K//fqz5cdTAwMTXAIWvuJ6+Fw5Ho7PKhY06B98FqLlx1MDAxNYpcdTAwMTQ87Hx9XHUwMDA0sqM/3GfyoMtcdTAwMWPab2qFrJH51MTDpVx1MDAxZXv8W1x1MDAwYvpvreeJIJI952D5z2z3aX2AmfyJXFx+VFx1MDAwMlx1MDAxZl2U0yxujI0rhsFcdTAwMTlTaP600T+LUYTNRSyIZCDxZ0hcdTAwMWbHOI5KQZg2zNfK1l+jVtVe/cGdh1x1MDAxMbRI03bQfeZcZlx1MDAxNqhssmu6kJRcdTAwMTePdfCgXHUwMDAz2Vx1MDAwNJXzyZCbKJiQ3YAoiPf7jSYkXHUwMDBl4Tn3xFx1MDAxZKux3Vxc56zhsd7v5yycxCw2bGl/TT7CuNB1aYiuxMLqb4VcZllUeUNcdTAwMWTJplxyOte2Lzv6yEZcdTAwMDFMXHUwMDEza3g8miEto+duJzBWp787b2vxXHUwMDE4616nYI1SVnJvhuPrcNDLV8ylR6CrM7/CNlxyI3dcdTAwMTncnVxy9Vx1MDAxOUVvpcXWkFpr+fGJZ1x1MDAwZX0nn29p4H38XHUwMDFhXFzelFx1MDAxNqX7MGVdkdhcdTAwMDS33pNC52zVbOU+RkTrPlx1MDAwM1x1MDAxMrjdl+JQz4I6cZM/XHUwMDEzt+I1XHUwMDE1XHUwMDA2XHUwMDFli25cXJOumVx1MDAxNtnEc4O/O1x1MDAwNvC3XHUwMDFhqLVEpJlcdTAwMTaCnHpyXHUwMDFhh+qReJdcdTAwMTNcdTAwMDFbpPmGZf1KPYHWLlx1MDAwYkhcclx1MDAxMFx1MDAxZF9x61x1MDAxNC//+lxcXHUwMDAxcdqfKzFcdTAwMWJcdTAwMTDH4Fx1MDAwNoG20Zr0gDGtXHUwMDEyXGZTw/o+ys8/+cdBkGj8yiPeXHUwMDFhJqOclOFcdTAwMWaHc9nL90sxacI4WFx1MDAxMF6KuvdcdTAwMDPAj/RcdTAwMDXwn1x1MDAwMdjmXHUwMDE2OvePbydIbe6URfvu5/rHUCSevvz2o+JSN8+8U0q6Lv/YelHKlPPqIydPicuxUGSWpbRzLeaNVVCx+4PoIYCaQ/BWOWssXHUwMDFmhWZcdTAwMDVDi+KVgV+vXCKHzlxczulcdTAwMWanXFyyXHUwMDFjvehANFx1MDAxZv90p29X5dNIQUxcdTAwMDStL6Q20Zdpvkvk19mXsEIlj+8ldGAzi29VXHUwMDE1ILFcdTAwMTFcdTAwMTI7mlx1MDAxNUpN6HNeq2hpJG5SvGFcdTAwMDZiq+ntPFx1MDAxZYpcdTAwMWLeILy2vWrI/1x1MDAxNEEuVjbwXHUwMDA1XHUwMDAy1ll+6ugqQe2SjXVcdTAwMTNsdV96ifOiPGCIXHUwMDAzUa2uj5vsWtzM/Fx1MDAwNCVOPltcdTAwMDLVXHUwMDA16lx1MDAwMzpcdTAwMDCo+/dJW2C0mi+8udu7KKNcdTAwMGb35qnQ3++SXG6ffSzwR6Xf5sl0bP0/XHUwMDBl4orfXHUwMDFjslxmh9twX9j9mNkuXHUwMDBidqRXcLSl2PB8XG5cdTAwMTOqQlCFXGJcdTAwMGabXprsWL82TkvcXHUwMDEziiFHR7f8aVE9w/rtenj95PA8YT+qXGaSLlx1MDAxMOGGUPP72iXJQEiuXHUwMDBmvjyz5Mlw2lx1MDAxYVFCc1pL46l4k4pqLlx1MDAxNNxccmywt47JX7TBlOyWhWKSUWtOsDfGaTVcdTAwMTcprWh5zlemYVxuXHUwMDExXCJcdTAwMTZjXHUwMDE3l5AnXHUwMDAzllx1MDAwNtZgXHUwMDFlXHUwMDFmMNa/Qk1ClylqXHUwMDAxiWLwXGY3tYKo8Ti8sFxyc4NcdTAwMDE/639cdTAwMGZPmmCXKjCoXG5iUynHYlxuwUUqO+ZFTe2/05ya38i4hVx1MDAwNVx1MDAxMmheqcF8f6lcdTAwMTerPfFMO1x1MDAxMmKTYFx1MDAxOF/edEZn8jnm0/AmN5ZkfHCgXHUwMDEy95n3bz51a9ekOlx1MDAxZuI4+anuXHUwMDA1WVx1MDAxZpPg3lZcdTAwMDGwOlx0ZmfIXHUwMDE53lx1MDAxZO2jL+DtuztsMLz6eKuxMFx1MDAxN9SGabzY2YVMkCRIcMBT+q01ZD7ow+z8oZ/s1p5fhEXZZ8hcdTAwMTP2xHNcdLLRPIy3WFvoj9VRfPxcdTAwMDJcblxuUDhVh4q0uvl9OnD8WjmsU1xu2YRqQijw+GGt3pb465V3iJZIsPWTOGL6a0jre2NY3uRTIyHl/ytcdTAwMDTPtepa9yExUlBT+eVcdTAwMDCrbsDi1NV9s8HqnqopdNVrqkVcdTAwMWVqTvZTRz08TT21XHUwMDE0g6BEslx1MDAxNVx1MDAwNIhcdTAwMTJcdTAwMWa0V23oXHUwMDFihUPnO0VcIlx1MDAwMDzLPEmQY1nCJVx1MDAxM+2ZYY+pNDVcdTAwMTXN377X5ORepr7tdidcYji/1kAmqNE4pm5Mr5bej1x1MDAwNHwniYGJYaD7RamzQ1witZnXgX/AL0bQSC5PSurdXceHL1xmS1x1MDAwMFx1MDAxM1x1MDAwN1GkeknG33r1fU2rv/37/Y9GPLmsuplcdDCXXHUwMDFi641fe6SQtUqHZGRcIiBAZG59XHUwMDEyzySlb4nMLM1Ne2vqTXYgXHRh3vvfPuO8Of6Kgv46XHUwMDFmc4ZBpEfN6lx1MDAwMFaQTvLjnoPDXCK0i3vvXHUwMDBm7UrFh0VqXHUwMDFhvupiy4p2Zlxy9Fx1MDAxNFN7P+oqlpkoctnGky1mx5Vrg16aszmu8ftRP3VJXHUwMDE4JrIhi55AXHUwMDA2ot75VDbXXHUwMDExMcje2o7KnFC+XHUwMDEyUCHZNob9xTrstJFGXHUwMDE0XHUwMDFhn2SdVVx1MDAwN5f9/Fx1MDAwNfPXZDwlfFx1MDAxNSbZSGPebn+v+spcdTAwMWH+rsUsjYuY5TLuXHUwMDFiS1x1MDAxNlx1MDAwN4Q4LqqjXHUwMDE38obwRLpnvPMx5Nn2T5+rv3flZZlcdTAwMGVhJ9tcdTAwMWG7nSw4ibVlJfN3mLhcdTAwMWG1R6o4drY+MjbyXHUwMDE3XHT0Ra9pXHUwMDBiw8BcdTAwMTIhXHUwMDE3TyycSv0t5uj5XHUwMDAyfibn0dVcdTAwMTBQJnv684x2WDt+kr491NFzaDfjrJ3kLOqo/fxt7e4361xy269QzJbTzFx1MDAxOCWL2lx1MDAxYfjlh4LFm4JURkPe6/LvqVhcdTAwMGU6voAwXHUwMDFhzUxQXkmeeM1Rm8T8KtYszNzcOUmBOz+g2c9b8VxmwTH71q8pQ+BcdTAwMGLFac/Nfff49uCBXHUwMDE2M2KVWdtcdTAwMTdccvdoMeQmO1x1MDAxNlSaM5a5XHUwMDFj4kvwa5N4XGZuYYHvO5VMqyTy2edKLVV9mtDvSbzb4YfX8sU8WWNkbfdgQ1h3R+nQ0OtrXcojjP8mrb9rXZ/NXHRcdTAwMWVLffeCOimHdFxccv11XdA+Y6nWMaKN19f/9Fx1MDAxYSmDbS6Nevc2c5VcdTAwMTJcdTAwMTCXVlxcprZ2XHUwMDAwq1x1MDAwMkjdYlx1MDAxNk9HXHUwMDA0XHUwMDA0tWOaN1xc85ncRsVlfDP9jsI4241ohlx1MDAwYrjRwnOvW9dUtlTuY2CMvLtcdTAwMTKnXHUwMDA3rE71dlx1MDAwNHKKhKDymsgghHFdXHL5QiVSQ5gkXFyJ6nP0XHUwMDEwhVx1MDAwMENZvLnWXHUwMDFiPVeYfVLFXG7lmmxccpl5THlcXFx1MDAxN9c8Za6so51ccopcdTAwMDOTd1xcdOTJjHY8WSkxucVcdTAwMDc4eKOSklx1MDAwMd9cdTAwMGWPXHUwMDE3RZ1RnWFcdTAwMDRmekhcdTAwMTFcdTAwMWO93D41le/NNrg0XHUwMDEy6bu5fmSYK9Mz1cX7TG90qlxm0eFcdTAwMTCOgbF6XHUwMDFh1NXUTMjMJzpvX1x1MDAxZmN0Olx1MDAxZXNcItLBlf6+82F5gX1cdTAwMGYm0lI0oDCTUa7tkm1cdTAwMDNRKHs6KU5tYCvv9Vx1MDAwNr47d4Zy5DyA6Z/FNThLsOP+eNZcdTAwMDdcblx1MDAxN+9MWz5581x1MDAxZEtzXHUwMDBl3Vx1MDAwMHpJmf7SXHUwMDFjqnydrFWnLIl6PM8wmTOUZcXws/JcZpDU6eXOTWLPU2JzI/BcdTAwMWLhJz6k+/Wul+ZdXnlm1N+6dTZcdTAwMTcvTy5cdTAwMTNNINuPx1Wz2b9Lfe5cdTAwMDPjSlx1MDAxOP/68UDnd6xm36zR/lx1MDAxOKVXkIL6NrTaXHUwMDEyJW6+fccoqdiRXHUwMDE4tTxqfHzHz6hmNVx1MDAwYvAxj9W4fFetsdmQr/TWOYj9I2uMysixN3bmuHZEidJPsSHpXHRzfMwskKGIXHUwMDEyXvx6b1x1MDAxNGrsXzBnwuNZXHUwMDE2+T3zXHUwMDA35my6/zPeXG7SbWWQ4ohl4mLP+p9f4rtDskYyZtVcbpIkS8JcdTAwMDYvL3l++JXAa4H1d45JljLaMoVjbN6erzSf3DTxpT6uOVx1MDAxMln3XTm5N8pqQNVMdz14nvy9m9KGIMFcdTAwMDRKkCXyLT/JXc/0UZ2KyfhcdTAwMWZcdTAwMTHG7lurfvr9mIHjQJVcdTAwMGX6MVx1MDAwZjBktOjhoUxS7UDfXHUwMDAzjLbk/DlLqPeprvpcdTAwMTWpMNS+KYzyQr1bXHUwMDA3+chy9YNcdTAwMDVcIlx1MDAxN4jqXHUwMDEwbFx1MDAxMdOZR4FcdKqxdYVcdTAwMGIyTCiLe7nBjK9n1WT/ZjZcdTAwMWHEXHUwMDE2UFxuhy20gy5YUlb4VGaKSKf7hpWxkkdcdTAwMDfa7N1aIbJf+L5wOlSRZPZcdTAwMTVWXHUwMDE26Mep+cmTo1x1MDAwM1x1MDAxNlx1MDAwMVxyd+s3XHUwMDA3ibdxjMl8d91p6Fx1MDAxNIX+nZX9SeLmIVx1MDAxZl1cdTAwMWJcdTAwMDHbfVx1MDAxZFHWXHUwMDA3P4LhXHUwMDA1gWkh7cJ1bdqkYZ3vRn7TiGtwPf8+Ka0p98dd2VSbXHUwMDFjJVx1MDAxMGNXv35tmVx1MDAwYqk5wFbr0WVcdTAwMTdcbob19ilS6bJcdTAwMWVcdPX+WEQnK36ZfaphZde3+mY1zjO/P1x1MDAxYlx1MDAxZHxcdTAwMDVE6YtcdN+an69Zfue8N11Y7um6qFx0XHUwMDFj4JhcdTAwMGI1wVx1MDAxM6FslEBMJ8aLicnWVZpcdTAwMDWwsb9+3upCTSRcdTAwMWZjg1x1MDAwNV80/KXosLO/5nomJT6BJ241q9Hg71x1MDAxMLuqbbLtpo1GSlx1MDAxNH6vXHUwMDEzzJVOtNv+filOXFxcdTAwMGLnXHUwMDE3RfVcdTAwMTKoZ9wgpkaz5I1Iys+V5tjahiuwglpHuVx1MDAwYmj+zeEhxFx1MDAwNSWbQlBkm8FcdTAwMGa6iqGQQvpMi3N9bFx1MDAxZPmFlUl2XHUwMDFihFJcdTAwMWb/331cdTAwMTNL+16YnvRcdOL8PYMvJnH03t28XHUwMDEw3EhcdTAwMTIz13Gucdg+5KLdY0ek2vpbtJRn3TPvk+RJ9Sv4XHUwMDE1MFx1MDAxNPhFqVxcLqSzXHUwMDAz+qhV9bUnPimcT6+0xCtcdTAwMDO5XHUwMDEzt5n6W9T5LlV6XHUwMDBlXHUwMDAy3se+2bQ/nmByyjp1xvaoy/v7VcSGhFx1MDAwMD5hcv7qrVx1MDAwYlm6z15V5/SKXHUwMDFhqk8xgTxcdTAwMTdoflGP9zZBXHUwMDAzOvyBOTOdXHUwMDFh/Fx1MDAwMkB29KXbmNla2SNLXHUwMDE27yHg5pHIsbA3eWItyVx1MDAxZKZ3O4Lv6rVvf1hZSuuJzSi0jI1cdTAwMTNcdTAwMTbVnbH5e397XkzvP0YgVSFd3GBIYPBcdTAwMTJ1OJFKXHUwMDE0PFNcdTAwMTaMSsZcdTAwMTcl2lGLQZ2Stlx1MDAxNVn121JeLICQXHUwMDBmXHUwMDExm41cdKdcdTAwMDLQ0uqvl+u7aSVmfLGPmqi8wV/13D+278LoZTy+ITS8Z6X+MU2j2nZVsvv9uO/WXHUwMDAyhuVOwdZ7I/ZrfOM10Hk4XHUwMDExZfdGXGb/OFx1MDAwZWFl2uDm5YPUXGKONNRONPfkZZQ//LPTXHUwMDFmviVI/lx1MDAwN1x1MDAxZj8gvrlcdTAwMWZr3iVGaJL4Q4CWKd+9YmKufpXvrjByk7uI8sKxXHUwMDExpEGX6txz+6aQ6m8gPppbjNGAcOgu+O/+8CGclC4vXHUwMDEz19yDXHUwMDBml6qtXHUwMDFkjDOeXHUwMDE4zPNz/K6szlx1MDAxOX69ey/JwMp3rPzRU1x1MDAxZICbqqqKYNxgRX7U5eJO7jvXx/H7J5/mws1lVzwq/VS/cKhcdTAwMTEq9OS+imL4XHUwMDEzO19rUYr8naQvXHUwMDFlhfA+nzVyk1x1MDAwNkj4LzBcdTAwMTTMwPIt0Fx1MDAxYnfpTtt5Rd/CXHUwMDEwjJf0W6hkauanliDTg665/s9+iN3kvKy1Qvl4XHUwMDEzzlx1MDAxZXRu4fBLNf09n9SgeelcdTAwMGVC4t9cdTAwMWaXJfszfTytoDi69anNl1xu+Mfmlyhl2OWPu1lcdTAwMTJ5cFx0qo5cdTAwMGZd5JFcdTAwMWSyq0B895NcdTAwMDJCJGvWXHUwMDEwWClUXGZcdTAwMTAvca/8vb/HsqOyL3VSSbm7qVGBo1xm3iYhhcJHSFx1MDAxY8SELFx1MDAwMfZcdTAwMDWpnVx1MDAxY+mWP3RaIfSo/K2b1HJ/l+DfmDZcdTAwMTAyisrXR0STXHUwMDFmLLetJzhe3kLR/FT82OEy/lTGvVxmg6h/R2JcdFx1MDAwMlZcdTAwMDZWl1x1MDAwZXhccspV1Fx1MDAwZYFcdTAwMDbWN61v2nusW+vM81x0JlA0XHUwMDAzNoo652iNK1x1MDAxM5GGq6FmQb2XcyzXiGqSvVqGXHUwMDAyXHUwMDFlXHUwMDBlV1xy2rbc+4NcdTAwMWRVlz3RdKKUo0KmoP9gsargWpeaIO12XHUwMDExrJw3Kt9AUTa+t3+Qyiwp/7o3K/ys2qtEbeawTyxKSqh8tSyGf5ltXHUwMDEyP0GV79fIvNMosL+wNXppL1HdRlxmMtG8JD7Ro0ExLNPHXHUwMDBikClq1n5cdTAwMTewfFx1MDAxY614vZKWjXNsloXTO4lE2k9cdTAwMTVYXHUwMDFhWjvXXHUwMDA02fuPTmtoXHUwMDAxzW6XrzBsobyz2y7HXHUwMDBitjnX9TdtXHUwMDE251x1MDAxY1xcJG0rP86dZrCbotp9+ym2XHUwMDE0rJboYStcdTAwMTfP0KlopFVea/55XHUwMDE1p1QvsFx1MDAwMN5a+oxtg9PFXHUwMDFla+DTkOrsXHUwMDBiop5qu3PklvtYYlx1MDAxNlxcXHUwMDEwQmTEJjLZlVx1MDAwM91dzkyazK9cdTAwMWaZXHUwMDE2QaS/c5fxYqY+1Orm93n6ucC6WDRcdTAwMTlWXHUwMDA0jN1ycuHdXHUwMDAyYjB/JI1ik4ywXHUwMDE4o+X3XHUwMDAy7fR33dur1mtcdTAwMTW2vCXEeO5cdTAwMTTMRpJcdTAwMWXEq1x1MDAxODdTKsRcdTAwMWadSEqFKCtCTGTjKoBcdTAwMWNW9/wzy1x1MDAxMvNccr928M5GWeuQc0nXVFxu0nlcdTAwMWW4rqvYe8elXHUwMDA1S4s2tSmmXHUwMDEwXHUwMDFluSteufD9KN6mXHJ/vcgrUlx1MDAwM/Gj6tbKJL9cdTAwMDDE70tcdTAwMWVcdTAwMWN1opdcdTAwMDRcdTAwMGV1/UJsV1xyJCPLXHUwMDBm+Fx1MDAxMCnw11oqYpehXHUwMDEw22n61mOS1CT291iOkfnjrDCTRIfSUtY1NvRcdTAwMWFH0DlOr1x1MDAxM7Fwvf1Ww9Qk/rnD0jlrYoXCJfRThEnZN+LUautwiLzW1bMxXHUwMDEzc/pcYm7aSnzQR5NQe3d3XCLNl4FoVFvxd8ZR91xyuWdrmq3nc5MvgPh0wkfKadf8t4BcdTAwMDB3blx1MDAxZmONKOEp54+nP2glt5hcdTAwMTdcdTAwMWSK7VlcYmB7fOhcdTAwMDfD48+CXHUwMDEy76LllHNcIty2SuZsjN5l3Ee1hMAo8s7ZfmN7TvS8ivlwif962EZUztRkuVukflx1MDAwNk9leFLNXHUwMDEzcku9/7N+j4nsdc2nxYPcbZn92NeR0E2POvTXVrWJRVx1MDAxMpFcZlhVzklcdTAwMWHeXHUwMDExXHUwMDFjjyZcdTAwMWbPjVLSlPnUnT3KXHUwMDAzXHUwMDAz85WTIFx1MDAwNy7xXHUwMDFhey/ha1hcdTAwMDToo0S9yVx1MDAwYrxtx3Svd3tcdTAwMTOjXHUwMDA0e6fnT6lZpKqXse3PrvtxgP9cdTAwMTL5QIpcdTAwMDNcdTAwMDCgXHUwMDA2wiA4oVx1MDAwZn5b3eDRgVx1MDAwMnnu/94xXHUwMDAxXHUwMDAxg3b2XHUwMDAyXHUwMDAzXHTpU/sjgDw9dVx1MDAxMshK+t6tXHUwMDFmXHUwMDAw1lZCLEq/XHLXxWO/Zlx1MDAwZrx7vf37mV7mJNLxr09xXHUwMDA3rXJQ5+3qXHUwMDFjPnklysBiqMqsqM0x5v2mt8tcdTAwMTFcdTAwMTbJU/xcdTAwMDUrXHUwMDA2MqyzovWEOCdhbIPB/bNQ9HSmwV5cdTAwMWVzai1cdTAwMGa/y0wo8j+VXHUwMDE53dhcZp9cdTAwMWNpazLa7qZcdTAwMGVZUJHI4uCmOH9cbt5sMfB+QJskv5GdQ1+46/ZcdTAwMWEnzjLujMewXHUwMDEyOH/QXHUwMDE4fVx1MDAwMlx1MDAxNl1cdTAwMTSeLXGOXHRmXHUwMDAyRGyChv2wMJ/ZnMOHXHUwMDEx1CFa6lx1MDAxZc6Qx3uG3Vx08EJh39K7XHUwMDEy4Fx1MDAxN/fJgronuiZ+lXDTXHUwMDE0OKWALCd8V1x1MDAxZVxc8D5R8Ht+J62XSYkxXHUwMDE36VxmXCJcdTAwMDE8ietcdTAwMTJcdTAwMDFr18NcdTAwMTXMrVE8XHUwMDAxXHUwMDE3OIF9vUsym9x5hPMgXHUwMDE15Xb84FChiIWumSnh78pfNGnNkEWO1U9cbrZM08ByXahlL+JPX1x1MDAxOZbGOO3Mz2VcYv5Wh8f9XHUwMDBmtPrqnSjStXeZRpQsXHUwMDA2s+o6WJaJtiv9MMWL8WNNKFx1MDAxY6dF+KZfe09MXHUwMDAx7afHXT25+1x1MDAxZFx1MDAxMqnNco7MXGbR5Vx1MDAwNFhcdTAwMDb6XHUwMDFjZStCT4KhkUBcdTAwMDN2U143niu3fP20XFy1ZLMsTefHvMCvnmdcdTAwMGVlN9kjwm5497Xjf/KKLcV+2y9T0PI+V6S7VHxONNlcdTAwMTWwXCJcdTAwMTGvtKTcjJCWUICwNvWiuGqH6NREJMI+yc9cdTAwMDHvVO7Mi4BcdTAwMGaW/6V1XffIXHKaS1x1MDAxNy3vXHUwMDFjlN5iXHUwMDAwxI9zeduRWlxijm5RXHI5WS2L1ylcdTAwMDZGSVx1MDAxMcvqXHUwMDFm4PAkfjDIw/H+XHUwMDA1K/9Zy+TE/7zbwVx1MDAwNTJcdTAwMDNcIkI5y2QoYFx1MDAxY5LoqOy89lx1MDAwNsJ8q4Aluckzz4DtNbqnK0G/UmVcdTAwMDX0/87W/VuRqU9cXMmUbruYR9rW5ejTaVxuXoeTj0mD8GmkpVJlKl5cdTAwMWVT1eLZulx1MDAxZP8twkjwVuehfM44wMwvcTLLny40XHUwMDA22FGT4DBXl6DrvJSTXCKHz+pJft2eyFx1MDAxObxcdTAwMDZDrjRNvKy/c+HAt8Nzbij5duZjJXRcdTAwMTlWXHUwMDEwXHUwMDEwS+rz2K3Q8Hv2XHUwMDBm7lx1MDAwMaib4+a7XHUwMDFh7aZff8/h//pvXHUwMDEwwjhjXHUwMDE2clx1MDAwNJxJVETMnctcdTAwMTSba1nJuFx1MDAxMNh3fdZcdTAwMWZcdTAwMDJK9Zi2moWC5L2lYdGMiscxXVEtuHlcdTAwMWJcdTAwMDXpdz6FUH9BytzQM1bY+pc9XHUwMDFjhGfCiVx1MDAwZr7ycieAu9+HuExPJaV+c2VnrNn+hv6XiltcdTAwMDNcdTAwMDVTzpegXHUwMDE3PqxomU7umJyJXHUwMDBmXHUwMDAw+eGDzFpaxmmduYpe8nri5KXVXHUwMDBlr6zVQ6ZEUerxasNcdTAwMTFssNSyzcaclWVzj7ZdSMOMV53c8M71ej5H8ZwrXHK1XHUwMDE5UGDjUDVcdTAwMTR6NyouVqvs/frnPVx1MDAxN8Od5F5rJDRcdTAwMDTZ44dcdTAwMTOdfeq2ibY7XHUwMDFiVFx1MDAxNzQ3+WvASzVcdTAwMTT701x1MDAxNT1HXkG5XHUwMDEz94+Sp09cdTAwMWVcdTAwMTJcdTAwMTB/xIlxN13UqN7FKzaxo3n4VbSC56B2rqvn+1x1MDAxNaPf0Vx1MDAwN1x1MDAxOIB6wNh4jYpZ/zWd51x1MDAxYoGgzEnJSIWI3+NsSu9+jpSZZXrH18WBPz9ePXpTkEq8wlx1MDAxNVe6XHUwMDAzZ7HR1q6o41x1MDAwYo1cbliy5T1NwMI/0KspPYv8fFx1MDAwN8Disk2/Kt5cdTAwMWMj2qLxeMogv/mSXHUwMDBix6xcdTAwMTfGd6KjXHUwMDFm+v7U9SaRPvdcdTAwMDNcdTAwMTWiy+83l9j2T7dcdTAwMTHO2ZsmKG9cbqb4XHUwMDFiP1B1KCAxXHUwMDE0qCuj489cdTAwMGVpW43vXHUwMDEy9GbOTFx1MDAxOHx9v+njMlx1MDAwMdVBj5nAf3BJXHUwMDEwwFxyxVri3Ot9XHUwMDE44ahcdTAwMDFhd6jyXHUwMDExxNy4itXJ05jXVNVcIrp5zaBhppBcdTAwMTC+f/95hsB/dEdcdTAwMGZBVMvJh/iRXHSVsnZ6VK8yNVx1MDAxOfLrdI5nOtSi+fLfXHUwMDE5yWagw8lz/Xa18rdfc3CmXi/MXHUwMDA1I2xK12k25Vx1MDAwNXAkn9eL/lx1MDAxMTD7K1xmUonhWFc0jNlcZo6PKXYrdFx1MDAwZi/7yM6y8KJ2kdudqdkr+5Z0sLEsm7KUXmnxxiG5UkeWXHUwMDEzwlx1MDAxZUB6p+FcdTAwMWLD+z9kncd2w7qybT+IXHLm1Fx1MDAwNHPOucecRFFiXHUwMDEww9df+rw3xr1n75Y9bMtcdTAwMTKBwqo1gVx1MDAwMlAmdHxnfED1Lcy+NenvXHUwMDAykzxRKEZjWeFcdTAwMDCOR8BccvxCYaVA37iibJacNmvh1cqCnmhcdTAwMGbXXHUwMDFlc1xybbzw3DdcdTAwMDRcdTAwMTVYlXylz6R0pLMnMYr+VFx1MDAxNOHvXHUwMDFmvrxKls+XXHUwMDE1U8zLPshcdTAwMTC3sFZf9MvqXHUwMDE5glx1MDAxMTzbVlxcMGRcYv/SXHUwMDFlXuF04fMo/pias6+8cDSCTzI4c19cdTAwMWRcdTAwMWTfJLtcdTAwMGLpudJqXHUwMDBlXHUwMDA0dnpJalx1MDAwNla5q5Z+xYFZ43+5sGH+rlcqXHUwMDE2y1x1MDAxN9yJUFx1MDAwNrDXJZ9cdTAwMWJGO1xuiMRKtFx1MDAwM8ivLyqqMby+XHUwMDA145WZy7NMdeFcdTAwMTBKnIZZnI2IUywpwumulHgmhDbug1QphHaW4nHvMK7zXCJcdTAwMTiJcnfOxlxmXHUwMDE3uN1+xsDCiaR+JFE/iqqRc/hm2K3Uclazt7FgXHUwMDA0/PGGtlx1MDAwNlSFecyIh8hcdTAwMDNh85dJ0MpVlk1cdTAwMDevscGYXHUwMDBiddP8cVc1eVx1MDAxODN+3VwiOVFcYmG1XHJwllx1MDAxZEr3zjX93+9NaNi72lx1MDAwZVx1MDAxY2LYVzNcdTAwMGauZrb0slBmQs16LOfUXHUwMDE4/91cdTAwMWT65DlcIl2Eu8fp+Y9rsUicIVKTULd7UmtcdTAwMGLuJLuhXGL+6s9QNWxcdTAwMTTq6GqWJemVuLt9XGZ9XHUwMDAwf9Ov/lx1MDAwZYTswcz0XHUwMDBlXHUwMDBi9eVxnqBcdTAwMGYpilx1MDAxYTL+6LApXdOjx8r9z8qfg2dTXHUwMDAyPIok9c7zjYRcdTAwMWKc6nTjd2b/cm5uznrCJF+3QJZcdTAwMDRNXHUwMDEyiun5+fiiJZP8eH7n7cdccr5cdTAwMTCco2xTTn9Z0NNcdTAwMWPm3Wb9s7VSUfBcdTAwMTlY933J2opZo/zxJfvLL5fO/GDUgSxcdTAwMGVPXHUwMDE3x3OqgumTVVx1MDAwMFx1MDAxYVOLx1x1MDAxZFx1MDAwNmky3r+kNeh6tqHOltemXHUwMDE5afamlWZnm1x1MDAwYmZfhPjiR4rkzVEu4sRISWOYe4lcdTAwMWI5Uv9cdTAwMWVeOmL2OJJ/JbNcdTAwMDRccvnyk0Hrvyt/XHUwMDAydKMs0e5CY/25XCLYrfF64T0oUFxcxjJTmdOCXHUwMDE5R9VcIsxllldj5TtPXFw17CaMwbZcdTAwMDN/yTjJXHUwMDFm1TSanKh64TAtz1x1MDAxMVwiXHUwMDE2i/I+N1JcdTAwMTLKupZcYtjcjFx1MDAwNTLxXHUwMDFjpkz7XCLK9vrZsuo3joNMry/c8KtcdTAwMTdcdTAwMDVk21x1MDAxNE+uNFx1MDAwMu177NhyWVx1MDAwN83AXHUwMDAxi0+InMHH/pbT1u341nepNeOWZrpcdTAwMGZcdTAwMWLF2Zco6JlkOFx1MDAxOF/D9bLEjnFWXHUwMDE2+qtccuGjN9rT6jBcdTAwMTEla/Ix7FPLwT7FTjN8O1x1MDAxZVx1MDAxZZRcdTAwMGKqO2U0XrtwOlx1MDAxNPmy73J35NAll/vQPrnH4Z7wd9jURebxofhcdTAwMDVcdTAwMDVCg6Fy+5xcdTAwMDNBfkyVUPY1h1x1MDAwN29/eVx1MDAxMyErPvGAWu5v4L9sXHUwMDFmR1x1MDAxZVx1MDAxN3hqSz7tQphcdTAwMTkvlk/s0YeyhZzBj1x1MDAxMeG7XHUwMDBiUl2tZLjvnp+I4Fx1MDAxOJLmuJhkXHUwMDA0XHRcdTAwMWF/7qudr4PYXyu3lO3X2se/y97TYYk+Sj73rrhNpbOPa9EhqDmlXHUwMDEwc1xchrLgXHUwMDAwvr+vdTvjXHUwMDFmXHUwMDAzQTb9S9ZcXKnhilx1MDAxYmU/9rUqr1xike6wqUZRmCCI2Gdx70DKr9IsbitT99C5UWW+2dlcdTAwMWPstClDclKegDhbcryiXXDKp9ngXHUwMDE0TWheTfd1Unnr8p78bqTlXHUwMDFi815kXHUwMDFilib+9zpJfSuO32fDo7P6XHUwMDFhO1xm/uSyLT8n8PvFuHGr4PZcdTAwMWZTvLkoalx1MDAwMynsnIKbyY/pKEN+0XxYeKtHfZBcdTAwMDKu/IdtjTZcdTAwMWVennK/6rNcYlZcdTAwMWZM4nswfERP0U49XHUwMDE0Tlx1MDAxNDywOoFfXHUwMDFhw4NcdTAwMTHNdJySpIBcdTAwMDanh3K/y1/rNDU0R5r8StW5O1xuqyTU877LSciVJ97xSFx1MDAxNnWierBK3oedI8lQy22zXG5cXK6Gs1bTXjC6/NVcdTAwMTnMXHUwMDEwtERcblx1MDAwN7jefOGbXHUwMDAzXHUwMDE5gyVcdTAwMDE/ykmHJ5WJedhccvnvxbJZ8XmNR/RrsFV5RSxcdTAwMTKWzVx1MDAwNsmZipdcYlx1MDAxY8y4hFx1MDAwYmnfk/Hm2mf8wYxElSqAo6uVadzf0ftukDh0qD/+WPGBzMpw1VSzsjxcdTAwMGZcdTAwMTam74sogvLRkLRcdTAwMTSEXHUwMDFiXHTNm8JcdTAwMTNtxTWbU/RcdTAwMTJxN7G+oMRAXHUwMDA2XGJWVFx1MDAwMdMo9PGBplx1MDAwZaxvw1x1MDAwNJqruElIyVxytFx1MDAxNXdWlu9VXHUwMDBi+Owz9NFcbmHqbtBqo6hcdTAwMWImn8PnMLjRXHUwMDE3XG6utYPta/C37lx1MDAxZFxywlx1MDAwMMQuneNAgm5y4lx1MDAxNNmP/IfGt0GOhtG0X10hd1x1MDAwMP631v4g2lami5aCPFx1MDAwZfZcdTAwMTGmXHUwMDE5snFrXHUwMDFlOFlwxsE+XHUwMDE5JOvEkzLeZ1x1MDAwM1x0ZMFcdTAwMTT+T/T48ypzeixzJ+/RXHUwMDA2n0ltXGIjxNneXHUwMDE5LpbsVpKf+Vxi51dZ/bJcdTAwMTlcdTAwMTe2b1hcdTAwMGVTuHFa3HiiU+9byvx4ivuUdDjPv/D+XG7G71x1MDAxM0REjf1cdTAwMWT0XHUwMDE1ylx1MDAxZk3ddoUuU+WG259EMPb0qp3DyWFFoDI742CP5Vl2ejx8rFx1MDAwMq66W1xiPaxcdTAwMDW3XHUwMDFm48+VrVx1MDAwZupcdTAwMTah30tXPU/tz+1HXFyDkp6BwipOilx1MDAxOTdeXHUwMDFlcWviM41cdTAwMDKTn52m2zeLXHUwMDA1XHUwMDBlvrtu30ouXHUwMDBiXHUwMDE2Rsgrk1x1MDAxMFx1MDAxMGv0n59cdTAwMWa367c15Fx1MDAxNFx1MDAwM1xy85LG9EfYx6WJRp2YNknyhrl36UPBz+T4XHUwMDAwkeSsNrs5XHUwMDE47ln0Pqlvnapp1ERLtVPLhbj4wcaiJFlGyOBcdTAwMTE8tlrltuzWxkvQTFlgRPamaLH/hVxygZZ4UoaANcomTnxcdTAwMTfYXHUwMDFkW8tDV379Z0ieit5cdTAwMWFudWOYrM0z8cRR6b+wx1jJdFx0bW6wbdlXYiQvWMTfalan4rG4a1x1MDAxYsRcdTAwMTIx6rKueSl/3Dc3YS5qUFC67KXdckTBv8nhn7lcdTAwMTW6XHUwMDEx/u9u4eM2ct88OFYhfn3Z/lx1MDAxNi6zIdGSrC+wlSh8qbGrU1x1MDAwMr8uWsl6XFw1xIXJ263n6PjB1q6bXGKlOjzc6lx1MDAwMecrXHUwMDE0xe84sJ9zsLKizHk2XFw3p+E/f7TNhyye3lNSXHUwMDA2XHUwMDAwhEdUQlx1MDAwYscnXHUwMDFlV1x1MDAxNbDAXG68Xb7mXHUwMDA2c9OOdvu9dmPthofyMatcdTAwMTigXHUwMDE4XHUwMDE12K9cdTAwMTdKXFyTJ/3t/0tcdTAwMWZRbb1cdTAwMTFqNdJcdTAwMDHKfGcvhlG+Ju+77es9+8dBXHUwMDE2j1HrQl7klvHh1lRkfbrwsbiNXHUwMDEx3/3MZCuyysA2zPCB5ENwXHUwMDFkXHUwMDFj74ZDXHUwMDA0SWBE91x1MDAwZmpDXHUwMDEz6qVKeP3dgNc/XFxBXHUwMDE3XHUwMDA0QyUjiiQpx1xu01DW6MejzCfZXHUwMDFiU88nXHUwMDFh9F024vqh83jCRvqZ1ce21EJS//Wji1x1MDAwYu9cYlx1MDAxOO5cdTAwMDVcdTAwMGKEclx1MDAxMyvYXHUwMDA0XHUwMDAzxSBZ2uFcdTAwMGbQ5lx1MDAxMNFcYom7prZ6WFtnY2V4XHUwMDEzTVEqXHUwMDFl4G1SYOvKXHUwMDFh/LZVqME/PvNZ9tzYcbWluz/kPct9TGOtVIxyyyG/mybY3VxcVidcdTAwMDVcdTAwMGYr8LiLkX/xardpwHVcdTAwMDQ/XHUwMDFlXHUwMDAw8Vx1MDAxMZDI7zqKL3tfXd1cdTAwMDXbLCFcXLHXlFxuZi6UZ7W8gYDfWFx1MDAxNqW/XVx1MDAxY2Brs6LbXHUwMDA0cIbu3MaZ07ljK8zXOrZwXHUwMDA2fKucXHUwMDFiIZkrsD9cZmJcdTAwMDRhw+lV227qsIE8OFn+VvFVizxcdTAwMDWqQeJbUVo3d//PXGK03PNcdTAwMTj+XHUwMDBlYaRbpvtcdTAwMDbcRYDlK1x1MDAxM9/1gXpX8Nsvykhi1Uppb1xiff8qXHUwMDBlXHUwMDE0V0g2+D5v66zut1hog02Pfdgm3YWS95PWXHUwMDFknTNcdTAwMWXs6HfAUWXLgc99XHUwMDAwxcX339+FXHUwMDEzav2ZXHUwMDFm325cdTAwMDFpxn6ZXHUwMDE246Pw6ExcdTAwMTasoke6Olx1MDAxMLY4XHUwMDFkfsdvvj5cdKScX1x1MDAwMXLPSL451+Wo/ajbXHUwMDBlXHUwMDEzY8ByhVnXPeO1Z8Zzk1x1MDAxMfVcdTAwMWFLl0h7cEhcdTAwMTXEs7MlTGrsus6PXHUwMDFl0JatiHNHnF3Dc8eXSqdMhNpxJqNcdTAwMDNcdTAwMWZk4v9bRzjGTn1sI+wx4mgkXHUwMDAwnnFO59/7XHUwMDEzt2BcdTAwMDbTwS3Ea+P78CSxyNBhxsukdr1GTlx1MDAwNLShhlFkTnKdXHUwMDAzbrPuUf9cborA5FV4VVx1MDAwNL+3jlx1MDAwM1x1MDAwMMs75cNcbiurIILyV8cqXHUwMDE3Riv+3Sc2ae/QI1x1MDAwMX0h82zVzN8mgefR9l1cdTAwMDZr8TlcdTAwMGatI4knr8ZcctxqlvpEbFx1MDAxMqxC+EPf0DFmlikgqkOrXHUwMDEzOopcdTAwMTbsXHUwMDAwafGAjmztvT6Dw37NXGL82Pryw9eiUjvDRJVcdTAwMTf/XHUwMDA0p7PAT8hcdTAwMDFBmWOfgFx1MDAxMIZcdTAwMGJcblQ8pkG5xZ9MTM8geLSBS7yTiNKb+16T/fPEh9/RwohcdTAwMTmGXs3ZQFxu3eR2g5Gs1FRohuqfcMkhRvnXvPVfbfJcdTAwMWL8QoDINJ9cdTAwMGJcdTAwMTm2YMZxXHUwMDAxXHRcdTAwMTH8KKMgf2DOxzddJUhCXHUwMDFixDlipWX+t1x1MDAxZSbOSiXrulx1MDAxMPlPR5TCm2q7XHInNlx1MDAxM338Or81l5hcdTAwMDP5d3XzZoMlob6H1MEl2Vx1MDAxNsUt3kb5O1x1MDAwMJU4hqdswlx1MDAwYjSB+v/nmK5cIlx1MDAxZuPn9Tawh8NCncZcdTAwMWKE1lx1MDAwNc5MKIh0y2dJ2STpXHUwMDE4K8BmOfN3XHUwMDFiK5Gc5KeW5bKkrYRqM9RX6HLwXG6smcs0iXathvC+XHUwMDFiXHUwMDAx/VxiXHUwMDExMSrL6cykft47W8uu6/1f5VrMNttcdTAwMDdH+71cdTAwMWRcdFx1MDAwNUJ3XHUwMDAz8upKc8/GW8JcdTAwMGVF/TWQJ8BlZUfKLGCP1o2OXHJcdTAwMWVLiaal6nY1jay2dfeqK1Qul5bAjZFExcRcdTAwMTkzPt5cdTAwMDc+ILdwjaSbiUBcdTAwMGbZlI89535cdTAwMGZZ1aFcdTAwMDRZ7TaeoXFcdTAwMWZ8tbNcdTAwMTKwLiZ/I2THn65LXHUwMDE53n69X5BZ/buveLVcdTAwMGZcdTAwMDFcdTAwMDOSol1ZQqhcdTAwMDMyMbl7kVTD/Fujdlx1MDAxZcSspJr5RurNZUpccoHt22RcdTAwMWI3ejopP4zEds/YXHUwMDE0mMT0yKJcdTAwMWZZbGz1TKwhKvJfNizJXHUwMDE0NuNcdTAwMDekua/TsaKX8rJcdTAwMTXx847KXHUwMDFlxYluXHUwMDAz+ED8lkkvXG7KVYqXbLOHXHUwMDBl1IOd+/FcdFXjq5/5T0W7KMR+S8KYezLzUbYo/thqXHUwMDA02Vx1MDAxY+94sXa9/tuP+3o5XHUwMDBi49ExOXdlXHUwMDFiIVx1MDAxZI1luvhT/1PIXHUwMDAw3Z9dTtJZXHUwMDA0vvv4XHRcdTAwMWNcdTAwMWSlzYJwsvz5XHUwMDAxQmu0XHUwMDFhU8KXN6hBoT1cdTAwMDKoXHUwMDExK+FcdTAwMTKoX18hJjXV/MxcdTAwMWM2i+NcZjbu7kCFZ3XHPCzWXHUwMDAyPO3CtcWT4XxYl6ot5mFcdTAwMTZcdTAwMWZIrPLNq7JcdTAwMDPzLL2axZhrXHUwMDA0/Fx1MDAxZPyRm/2nXd0qwLmP6jozZN0lovzcXHUwMDEyWV+v0mQ0y/20J9Yrv+p5/nXn5/eh5drT92NpVu82UpC1XHUwMDAzJaQ94EP1M0I9XHUwMDAyLs1Ctl3ClMKBR7t2XHUwMDE3RN3n1InfXHUwMDFl3O386ErToSxEXW3iMmjVXHUwMDE28bp4qpRcdTAwMGZUXHUwMDA1ZVx1MDAxZU/M+neGScGGPerh4HbMXiQl/WyALlaIUiuq61x1MDAwYru8577VaVZPZ5jwv61cZlx1MDAwYrF2+O3rr8bo+ZzAtUTxYK036TmPxVOAXHUwMDEz4O93uNlioJbmXHUwMDEynrV+XHUwMDA2XHUwMDEzQlPLQlx1MDAwNaCBXHUwMDE4XHUwMDE0QshcdTAwMWI/xLrC/2u2XHUwMDAxXHUwMDE2pKfP30Dw79pcYtk5beFcbi43m/86b3p85JRAXHJwtVxmWSOPJ4lcdTAwMTVcdTAwMGWX1tZOJfDgindcdTAwMTZAXHUwMDFmxrPq1lx1MDAwN2vjmWJ6bNZcdTAwMDYzoNNfXHUwMDE3wvsvZVx1MDAxNMFpw7/5hsdk/rRcdTAwMTJU/PVrXHUwMDFmq764s0aqez13M0hiJPq2vrXjWpNmgzXrziO/JohcdTAwMTeXXHUwMDE1oFaXuqviXHUwMDEyyXM+XHUwMDA29PN48GljOW9cdTAwMDFcdTAwMTInvKmB1X5iaPm+qN4wWlB/XHUwMDBlZ7bWlifGPcY5kW4+LZ2FsUjeX+D4T38mSnBcdTAwMTaQXHUwMDE4rthcdTAwMWZcdTAwMTO3T/86f7WoOSUggJBcdTAwMGJGUqUwTr+R74HPXGasXHUwMDA3xnlcdTAwMTdb+PfvXHUwMDExXHUwMDExqnl45nnVm/hoXGKwlFx1MDAxN9CJQTNHn9VcdTAwMWXWXHUwMDFlXHUwMDFmbYunn1xyvzjQXHUwMDFkXHUwMDEycj1x4/XT325cdTAwMDCmjD/suFxuZO1cdTAwMDLrVj6UXFzlr4fjv4L/XHUwMDBlhlx1MDAxZGqoQ5kzsug+zV+ViPEkTlxuVKt467FtXGZcdTAwMTDFIf5frWOMcFx1MDAxNHe/7HdcdTAwMTHFojIwXHUwMDE0JDFOXHUwMDAy5Sqfi1x1MDAxZl4391x1MDAxYbyXt/G+8amKVH9cdTAwMTbGR5Ddo2o1KJHGt5fp+0uQWIZV7FSoXHUwMDFkXFyZcEb9v1tcdTAwMGJcdTAwMGYvRcFfe7TJqLv7m7C9M1x1MDAxM77CXHUwMDEyWs13fl5Dt/wtUbj82pBPb9JvXHUwMDFmKNtJVzLg0HBES1x1MDAxOVFcdTAwMWZcdTAwMWbcXHUwMDE0W/CMR1rlXHUwMDA0JoVcdTAwMWPDjJRcdTAwMWG1XFyxe4ZN4oWA4rNU0MuOr5FuXHUwMDE3Pqv7kZUsTOpGRWlcdTAwMTNwufZdJf8gJGtcdTAwMWTbkyCSzuAhqjaPPVx1MDAxMqBLmYGHoEhJ/83NXHUwMDAyc0cmflx1MDAxNGjTR5xHKbSnXHUwMDE3OLgs8jvrbibpXS4sa9csfZVDcIdSh/CJ5Vx1MDAwMTH3wOWpOSxcdTAwMDFls03N5buiPFx1MDAxZUHl6t/5pMDHXHUwMDEyOyne7uJcdTAwMDTDXHUwMDFjXHUwMDAy6lx1MDAxOC7aJ4pD7Li6OFxi3bohf5cyhKoxXHUwMDE2P8306llcdTAwMDPGrH2bXHUwMDE0S1x1MDAwNKiWLD7sXHUwMDE08FHeML3AQye5tVx1MDAwMYbZnOVEzMxQQORquOan+yvrx4vC71jN25it4a9cdTAwMDCZwdjOo1ZBnn/pvSpeO0RcXPtxLOL1cUCGoFgvcS3a3+pcdTAwMDJR+PdLgyCoPPfawefri1x1MDAxMnF9eDjnQ2A8PrhN2Se9YOkvVlPHbFx1MDAwYlx1MDAxNaBcdTAwMWZtq1xymiTI88l9T780vUPhykKzpFx1MDAxNdJcdTAwMGLOVoa7tXyYe7jk4bSEXHUwMDAwvFx1MDAxZUdVO1xihlO+dvJcdTAwMTFL1/n9YHmOT1x1MDAwNCtcdTAwMWX2sWp5XHUwMDFiXHUwMDBlVVx1MDAxNVx1MDAwZSB4h+hcdTAwMDQ3XHUwMDE26jlXgUdcdTAwMGZQiyrvJ///6nBUySeZKfX9+nlcdTAwMGJcdTAwMDdcdTAwMTJcdTAwMGZ9uzPcI/+u9f22T1x1MDAxN+m8YOqdXG5KhKukuFv2SktcXMXVNH06ZbZQaqE+8/3cg1G6XCKpfWE3TPOyPlx1MDAxMJQvKmmIXG4zoGRcdTAwMDaC+lx1MDAwZmbzWvgoVV5BXHUwMDBldF00mMS/4tr182Q5mtGtRduVXHUwMDE0pE1Hj3VC6Dab+632cq3ZmplcdTAwMWaQW2JptdyzXHUwMDExYE/XR4ySXHUwMDEydZVZlslmXHUwMDA1XHUwMDFhjE/2k/FcdTAwMWW1U1BIXFyNrlx1MDAwNFxuXHUwMDEyrVx1MDAxN5vzt81ygftSPZdcdTAwMDA8dVxcpDG2/mjSXHUwMDA0X/9cdTAwMTiB0prbd1x1MDAwN5yY1iFguFxuuYo2I32xdOKGaVx1MDAxMOOEXGbdJKhNfuKapjO+XFxCvpVTNzT4xVx1MDAxN4dcdTAwMGaYevj+zlx1MDAxY1AwizyUXG5+2I6PXHUwMDExzJThM8e7JT91q+yhXHUwMDEx+5h166SPp6EhIEBcZvE6TVx1MDAxYlxuXHTcaFx1MDAwZTp74oXTp5zQpTqyXHUwMDFlXHUwMDA3anRC2Gfc5M1VsqNdg1x1MDAwMS8vwWyzXHUwMDEwXHUwMDExPE/FLK7ERf22RZGrscixl7JcdTAwMGL2zNCJmoo+XHUwMDA3LTJcdTAwMDAuf69cdTAwMDVTPGhHXVx1MDAxMVx1MDAwYrg1Z3bf7di/vZDAWXo1QbnH32llzMKuruioyHCC313Cg09PLt1im+ByUH3XXHUwMDE2xaHHf93XLVx1MDAxMFx1MDAwM7RcdTAwMWRcdTAwMTRcdTAwMDTXIVx1MDAwZVx1MDAwMD1H896/XHUwMDBiloCB9qEkclxmXHUwMDExY/zbi4hYJlFj2paVovBVWsHq9ie6LndcIjY77IKX81Mzp5z5kZd407AzU05JrSWqllxcXHUwMDFldkxuwYN7fKJomU+wnNFQRZqk2253bWyrRDX1UeHKXHUwMDE1ICU+OcO5eU2nXHUwMDBi/VG49bVdXFyCWW9/XGbGjHkwwWpef3fXXHUwMDFifURcdTAwMTI5ZELw3/zG5PW819qIXHUwMDA0m2SPXHUwMDEw9OdcdTAwMGLLcsCFXHUwMDFlXHUwMDA22H17XHUwMDExXHUwMDFlRYLls+PBXHUwMDBli//Y6/33VcQgKWOLPoOtXHUwMDA0+LpNVbXaXUTZIVbn6nxFi0qnuY3L0Vx1MDAwNVZxXHUwMDExwKg/81x1MDAwNCBcdTAwMWQ8hNnL2bmwjXXOXHUwMDAzd7vtSJlZXHUwMDEw+Vx1MDAwZmSoV9ng7LX2XHUwMDEyQ3zysL8o/eolPmUsv/DP65ROXHUwMDAyh37uYr7cl8mpf/NI180ndPM7VOhXdYlb3Vx1MDAxMCUp7PD0qT1L4/HkjY13P1xmf9CaWMsq//NM7m2/hdV6aTiiXbFcdTAwMWbXXHUwMDE5JvvXe6Y5+yVOzZ3nXHUwMDEwcVx1MDAxY+9cdTAwMWSz2Vx1MDAxNHI/h8LZfMqri2507Fx1MDAxMX+ZnWHF8FK5jGXtW+tcdTAwMThuolJcdTAwMWKoN0nD5qM/t3EuXG5IXFxcdTAwMGLP5tVf+1x0w5Wgk6yDobkhcUPkUvVhk1x1MDAxMVx1MDAxOVx1MDAwYuOXXHUwMDExXGKvXHUwMDAzOFxcQNq+qM9fcsFcdO66M0zN5Vx1MDAwN+TIqmVBQGLgfaEnaPwqZJr+OylcbjGXXHUwMDA2THAv+Vx1MDAxOYt9V662+njLyFx1MDAwMvvB5a2G/fpcYlx1MDAxMVx1MDAxMMf7XHUwMDA0XHUwMDE532WkQbBf39udPJxJJcQoQIk/XHUwMDA3XGb1N2rs51x1MDAwZsPIrfi5syTbXHUwMDFiXHUwMDA1nVMuXHUwMDEykmJ2K5B6QMH+2Vx1MDAwNn9XcJY/XFybXHUwMDFhXHUwMDBmPs9cdTAwMGKkXHUwMDEyXcxvm/Unq/jZXbVrvS1XxVG2vVx1MDAxMFx1MDAwNFZcdTAwMWF4mzdZssn2I1x1MDAwN0bXWlxctMiklWJcdTAwMTmPwtzrc5hBlYO33HBMMVx1MDAwMlx1MDAwNJB9aCujuXTX31x1MDAxYYn9Vt3yPS+S6XZYop9cdTAwMWU+Qae4R9Oc6KFMXHUwMDE5gS3erFBcdTAwMDb8292GXHUwMDFmhNJKyMB0tfVmmad5gVx1MDAxMdX3J5jy9rRVV2G/+vCffNpueFwigNhCXGJCPFx1MDAxOOZ35IZcdTAwMDNcdTAwMWbi1OeBiP+kvJvfXHUwMDAytt49XHUwMDA0Vc55JYrFJLnvaIbQ6zjzwvCZmHatbH/cPiVcdTAwMWHkOlx1MDAwNEzV6CeLbu+BYYGW+lvaXHUwMDFmOYozuf28Zv7hTmO124qZeYj7NihcdTAwMDX9hT9jtlIqgvC7XHUwMDBihbnb51x1MDAxYVxmdyt2I/FcIn6pXHUwMDAzXHUwMDBmu8mGs1x1MDAxN19Q71x1MDAwZlx1MDAxZFx1MDAxMy9cdTAwMWRcdTAwMWGnhOBcdTAwMWUmXHUwMDE0XHUwMDA0XHUwMDFiUZqSXHUwMDBlXHUwMDBiiNCrs3iVd/tcdTAwMWJmkEuiq0bzNEzkVTpwhNy8m3X6XHUwMDA0soSykVKlXHUwMDFk/7ow9s1v+ZdcdTAwMWZ2lrJK8lwijKBcdTAwMDRdXFxUX6vByVN2L5TP023WoPRMXHUwMDE59mFF31x1MDAxNX9mO5lUtaPr+a6buFxmmVk3Q0SNf4LIXcvM75hVkHzw73VCNCxbTlx1MDAwN5JruESrXHUwMDEzULOhTDaE39FcdTAwMDZcdTAwMWLkpI7SYKae81Lagm2eyu8sYfJcImpm1lxix5abZz1cdTAwMDL+m1x1MDAxZGqMqou3UZaXR9mgoVx07rTJXHUwMDA2wmBcdTAwMDT4uvZcdTAwMTHDkFKUXHUwMDFi6euUXHUwMDFlXGJcdTAwMWXXm17Y9fvdQbJcdTAwMDC1YSdMvCGIXHUwMDFjXHUwMDBlk3ozKf1bKnG604lI84jt8+FccrtK071kIfZcdTAwMDSBXHUwMDE1xbxdyPvlMeWLPsDEc2F9pJKSYYFcdTAwMTa4mvP+uEhWb1x1MDAwYoCzulx1MDAxY8bNpudcbtmJ+G/xSneHl/dTLqf4ZYHW31Z9+YeJ49HfPbI1e/qr+J744fXQ/Jz5pYe/4WPAt9cya8oqS1x1MDAxZkw6XHUwMDA0JL3gYUjiwlb5/VvN6iiG2Vx1MDAxZblF8flcdTAwMWP6RNS1d1xcU5SrQauPMvjxkcGO+mUvw1x1MDAwNIMnh5SFaISeedJ0h6zQ5UueauvG45pdXFxJUEd8XHUwMDAxZal5jLmBjotcIswvo7I2R5Dpj7lcdTAwMThcdTAwMWWRd4xcdTAwMDSGP8Em8YKivMV8ZJ9h9HhfNVFgan2euPoq3CCKX5SalHH+xVx1MDAxMXeIXHUwMDEyXGI5PUTl+1x1MDAxZFx1MDAxY1xi2H+Eim5cdTAwMTDZ8vaGxTpC8pg8XHUwMDAyI9SPy1WHrnhcdTAwMDfaLqzquXvXXHUwMDE1dlx1MDAxOIKOiS1UxfLYjVx1MDAxMdhcdTAwMTBcdTAwMWXOQUt9nFx1MDAwNoGwNlxuXHUwMDE3k7ErLUBcdTAwMDKVKD3YhqrtvmFBW+/25UZuZC8/9P6kXFwsptbro1xi5Jf/O9wq0ErDsEZcdTAwMGKAI1fwxPKNVjY+50WuJqo/Qqa9v5rhhXNcZjade1xmsUGg5fO5qVx0LsKQQVtwb3llXHUwMDAz6Vx1MDAwYsgh4NfIefLin25cdTAwMWFcdTAwMDRcYlx1MDAwNOTnXHUwMDAxSYu4XHUwMDA0N1x01paLs6fJXHTYaFx1MDAxNrsvK2i6JT5cYsf5iT2gLn9cdTAwMTElY6tcdTAwMDXMfcjsrKH1wOHHWsdcdTAwMWNXcaEgpnn7XHUwMDE5ZFxc3n/H8GanXHSkeuCm/Fx1MDAxYYDHtkLyTuy6mPbaM2RcdTAwMWNcdTAwMWHNXHSDuVtcdTAwMWOTXHUwMDE1xIZccjpcdTAwMTVVPdIhaSukXHUwMDFmjNCytlx1MDAwNtbHPYErfk9cdTAwMWNPXHUwMDEyMN3Dr+PMk2K7eGqdx1x0PVx1MDAxNo/JdilcdTAwMDDiplM+oJdWeSEu98SXfz7cflx1MDAxYTdcXNyzbE/jXHUwMDFjtdSXLFxih1x1MDAxZqtzypqFvD6TxZXgOLOO3b9OXHUwMDA2Q1x1MDAxOHCZX9JKSjFrXHUwMDFmfu+dhCNcdTAwMDFcdTAwMGXjqTr21+BAXHUwMDA0487IXHUwMDAzRnZcdTAwMTT3XHRXNfU57yjxV1x1MDAxOKJcdTAwMTSoXHUwMDExRctcdTAwMDIhYaGqPVx1MDAwMf2agKm/TPSFX1x1MDAxOez8y2bgoFUh3lxyTVx1MDAxMc6lc1x1MDAwNbtf1uJcdFx1MDAwN4eyyVx1MDAxYVBcdTAwMDO1ct8rkHczuv2d4JK69mmeXHUwMDAwQqjI21xm+H0qhZx7Xf5aXHUwMDBiXHUwMDEygctyglx1MDAxNIhMXHUwMDE2l6a+vDlcdTAwMTGWXifFymS6vcDXXHRcdTAwMTPC9r2XfVAyzL1gNqJcIpyruetcdTAwMGX98Tgv8lx1MDAwMVc2VJOHYJooT3uTSKOL3CZjlzC7x6ZFZ2lW5Fx1MDAwN3JcdTAwMThcdTAwMDJeu1cldX/nXCJdTVx1MDAwYlx1MDAwMFx1MDAwZoBcdTAwMWZ6XFxkZ4zzbu3HK8ux25mhp1JcdTAwMDZBQDVP2lo3yVx1MDAxZNDEXHUwMDBi4YeP77CY+3dorKcsMu646YpcdTAwMWVcdTAwMGbdMo9O+ObJ0Hxoz/yKfn7Cj0ubTVx1MDAxY/hLr46/PawlXHUwMDAzhX93Uk6jllxmK1xiXHUwMDEzXHUwMDBmKmCG/SRWXHUwMDEzw1x1MDAwN7tcdTAwMWRcdTAwMDXfY0GEJM3yRpKHSFx1MDAxMZdAxbTxXmuQeFx1MDAxZlwiXHUwMDA1lvAj3Cr48/tpWfX4z/ql+8iBjddnUUhiXFxcdTAwMTCw3DyKhvdcdTAwMTDFoZ+fWfp5LkIyvZjriVVNRD5KWMF0hlxiXHUwMDE1ueSp+bVcdTAwMThuRupVnMW3lvNyRy3D9jbEXHUwMDE092tu0V5cXNBnUY5cdTAwMDFxbFha1D5cIsj8Plx1MDAxZdV5/frBR0LW6dt1XHUwMDE0S7GQ876sqpt69Fx1MDAxMZ5wplx1MDAxOHrkXHUwMDExwy9cdTAwMGVBf1xmSjC+cIXtU7PNnIyLIPPwymRhiS86lefyXHUwMDEzXHUwMDA2w9XbJyxZxYEp+2SPXHUwMDA3wFPej4IjubY4ZafYiYS+rIbPtnyy0ux5blNsQvq9h1VcdTAwMWZd+Fx1MDAwN5Bqb7+oqn7B5yi4uoXosKNeSEY1dFx1MDAxYlx1MDAwNz9cdTAwMTdcbtz4U9Ws9lBcdTAwMWZcblxmKKtFv7BSyVdUhtP55I/tc6FzNVx1MDAwZetfZo7fw6ikNFx1MDAxY0pk7ml7Q1x1MDAxMFtcdTAwMWEk822d1Ns9jzRJXHT7vFx1MDAxOIuhiVmEpvc7pk1ccrb114tcdTAwMDafT2hxXHUwMDA208l7T4Bpo3/eN7U82NeIlDI+XHUwMDEwSK/Ua8dCfqDhI8xcdTAwMTmqvaIm0Vx1MDAwZmmu0KtcdTAwMDXS5/czspd4kiychGnYXrFcdTAwMWXLYIZcdTAwMWMlQk7e4VxuJUmZX9d7OuTEVoRcdMk9q8omXHUwMDA2xPvvrkZcdTAwMTi1c9fQ/Vx1MDAwNd1RnHSajN4ycmmB8VmO2m/I7r8nlW257f82y6ZOwWz4vn/v48JnVopcdTAwMGZcZlxi/VxmN34jXHUwMDEwT7bg4H03rVZCnHKPZ9zaUdOdTeH79WhX5JVMaOnEMF1JpOf20E/5XHUwMDFiqt/ZnVx1MDAxNYaEzVx1MDAxNz3A0vFcdTAwMWElRGnWXHUwMDBie1x1MDAxZm919PVZW5NIXHUwMDE5XYOCa4xmRDZcdMq8beaHrTfmXHUwMDE5XGZLLFluWmTjnnySXHUwMDBmL4KgPrCarkP6i1x1MDAwN4XTwHhcdTAwMDCUreVcdTAwMGaCXHUwMDEzS17zpVx1MDAxMaPJh0fUjVxihMiVWY+7X0JMXSVcdTAwMGUmdDm7dypMM2+E7JDPilJ1pCZcdTAwMDPd87WS+GqbebA6XHUwMDA2KIzyPtdcdTAwMTNT/sG+t1x1MDAxYX3cfynfhDTgelODZYniNcZ/4u/7sX5fPY/yuOtcdTAwMDdBXHUwMDAyr1BcdTAwMWGCrY7RU8I/cXM+XHUwMDFmY9506118ze2jXHUwMDFk/ksvrSVnnNDTIKCQQGZJJWHwO9xbg6b0h1x1MDAxYlrv0WLDQONzmo22ZFx1MDAxMy14499kiOHfaJKGXHUwMDBmupBccuyX3ac0r1x1MDAwNdrfXHUwMDAxaqtcdTAwMGJ/vmI3S1wimc1HL1x1MDAxMjiCaaQ3POZcdTAwMGV5SJW2YjckVZfOpInHs1x1MDAxZnBSorxcdTAwMTLoJINcdTAwMGJcdTAwMTZEjGWfTJO859XI4Vx1MDAxOHT75ujEinFra9evcVx1MDAxMiyJXHUwMDBiuqz6mmNexFx1MDAwMO2jkP/htVx1MDAxMY6pXHUwMDAyXHUwMDA0XHUwMDE3zcZcdTAwMDW5TOJphfGFIdH1+UrDh3xcdTAwMWHUXHUwMDFmnzH000lmXHUwMDE24smvs4NYWStcdTAwMTVZNdSOXCJP51x1MDAwZl5fMbm6zGI20m2Qj5jo95tlsFx1MDAxM3OaOfnV9txr8+1yOquCMT7F416+u8G5JTsyXHUwMDFmfV2YL8FcdTAwMDH6JInfp9L5Qlx1MDAxMX906sg/WU+sMvCHXHUwMDA1XHUwMDFmPZjmX79cdTAwMDZcdTAwMTPlKVx1MDAxOarJXvSsr5lcXCZLP71TPWeHqz3Jy9zdR1sskVYgo5so9lx1MDAxYU/BTlxiXHRdmi11knDbXHTAQPY1VfuHTz/i61xczFxuXHUwMDEw5VxmPnNJdeuKiaIhLOxcdTAwMTPHdYdR9XXTRiXbXHUwMDE0yz2sS2RofCQ9RaPp30lvYKyN9NPtR1x1MDAwMaavVlpcdTAwMTc2XGLvdpdTXFxcZiVLWae9fUtuXHUwMDA0Z16rUpW47D5cdTAwMDDUqkBcImjML1x1MDAxMLygjkqCXHUwMDEyPsiv8NqZwVoyRqRXXHUwMDFmXHUwMDFlOMJfhDoo6Vx1MDAwNZxcXJxCpl6L5Tp4xFx1MDAwZVx1MDAxNFx1MDAxYYL8h6bKb6gjoT3V+Vx1MDAwZmVP8lx1MDAxNe9Ap9D3cDH4+I/d81x1MDAxZug/++BcdTAwMWVfVVx1MDAxYYDPXHUwMDFkxqPVnmuS/lxi/lPzzGdcdTAwMWPuXHUwMDAy12lCTfVcdTAwMTGtXG7j3NBAtUf79l64iFwixWKEMW2aX66BIWaaRlx1MDAwZj+KVjshXFygm6pcdTAwMThHgpzry+dcdTAwMDUwhvCBg1x1MDAwNV+GXHUwMDE2XGKFUoiShpNZR1xy/zWbpfpSRP4uqqenecRr5YzxZ3Xw/zLd4StJlVx1MDAwMVx1MDAwN7axXHUwMDEw745TKlx0XHUwMDEykl+BZ1nMvmFcdTAwMWHEcWhWOtqs6nurr1wi11xu8+Grli2NmT9/V2tleYLQ1Fu64XFLV4hcZm7jRSiPWVXmLrupW6xJX1xmxS1cdTAwMWOTfifx5sBcdTAwMTNZWYxD5HGAXHUwMDFjvIEsps1xL3v03Fx1MDAxY387x7CowX47SLjsNUhePa+Zsq9cdTAwMGIyXHUwMDA33lIjv5jG9FxceFx1MDAxMmbbQf/WeFx1MDAxYze7ReAkTVx1MDAxN6P9WfQ74nGn1+RWXHUwMDAxQ7Mz629cdTAwMTmqSvRrsb3UPjggXHUwMDFkj6JcdTAwMTNcdTAwMDRvXHUwMDEx1N9cdTAwMWWot+qMligjV6TEQJovSK1OXHUwMDE3XHUwMDE22G9E+MdcdTAwMDAzUmPvNmCS96Cq7IUyX2hcdTAwMWU7gVx1MDAxMFVcdTAwMDarU2tyJ61GOdHu4c/Uhqt3h1x1MDAxZX7G7/FcdTAwMTO5T1x1MDAwNyt9s7lOsVbXXHUwMDAzb1x1MDAxZoNrXHUwMDAzr+1cdTAwMDUk+3XWS8RF87dcdTAwMWU5tGSTYvR88eRihlx1MDAxZFLY3Fx1MDAxZOU2KqGL5V/JwGeGbY/p0qRcdTAwMGbOb1tQic2445llUVx1MDAxNIJNhaDOMUwg3KVJPbYxg1xmrZ5bSJPAcHtWME2HXHUwMDFmXHUwMDE1971aaVx1MDAwMzDeQsybf7rqwTZLNN3y5bh7orBcdTAwMTR6Yy1cdTAwMWWXPZmvoIM/lEAv3/WPXHUwMDBmuLBcdTAwMTconsVcdTAwMGXmccObI1n0x1x1MDAxZFx1MDAxOFx1MDAwN3s/XHUwMDFkILopYlx1MDAwMVx1MDAxZZqp8iPqlyZ3I0x6e0WarjhzUD2MMVx1MDAxY09cdTAwMWL3/DfC+t3RSbjAxPVcdTAwMTO2pGpcdTAwMDJcdTAwMDck3izn4zH3W1x1MDAxNZzQhSF5X0wuvY0m9z5wlvAhf1tcdTAwMTRq0Vx1MDAxYtKbi1xuME/1LCRKg/63/2rBXFxaa46//OVxra5KK8mrlP1cdTAwMTZ9zCnoX4VJXd+8UI6A5uVr9e+WpTjydTxcdTAwMGVcdTAwMTNcdTAwMWU1TD2N7Fx1MDAxYi/54/OvSvNl84RsoobJvtdcdTAwMWbjgsNcdTAwMDM/XHUwMDA0P2xOivdcdTAwMGJcdTAwMTOi9dU129ZNdPFXi1x1MDAxMqInVkjDj1x1MDAwMVM8TDMpr6lcdTAwMDKt2I9cdTAwMTVcdTAwMWNcdTAwMDb557zhgHBO71x1MDAwMlx1MDAwNVx1MDAwMVKMbCaohFdcdTAwMWOGpPlcdTAwMDCjsmmQOHKBO5GfIFx1MDAxMN5+eMiIzcqTUf6VXHThrlx1MDAxZr9cdTAwMDapLVx1MDAxZSwpsOgs3N35XGbOIWc8gT7Jfveidlx1MDAxOPlrMHi3XHUwMDE1w8BVgm3f/+4ubDO2tLxJgE5MV+Bz16tcdTAwMWN7PEGOP1x1MDAwMOFcYlx1MDAxZt911sNcblx1MDAwNo9etMhccuE5fuQ3tzRCT9Qy6Fx0xWOYs1x1MDAxNWNcdTAwMDOY4kZcdTAwMTZcdTAwMTQ11ZjJRoFbLDhGdN90SJvIvek1M3mZzL9jUad5YO7iLPeP4lx1MDAxMlx1MDAxN+ROKL3G5lU65aNpzi89UOouOnzcyr9cdTAwMWFcdTAwMWYqi4hcdTAwMDZZ77+zuS82fTxcZlx1MDAxZrQvTMq0zr3BYZ68qFr7xdibw9ZcdTAwMWHYOlx1MDAwM62+XHUwMDE09Vx1MDAxNayLytDNhGri27dR1rJ8fFxmlSyY2YZQTft+wHPYIJbtSci00TVx5Egtht9cdTAwMTlH6ZpcdTAwMTBGZMRcdTAwMWNaPKr3uKMsXVx1MDAwNEJQ5XeNo1x1MDAwMkslXHUwMDExa2JwQFx1MDAxNa3BXHUwMDE3jbk9z2ep5JvMosdcdTAwMThGZSOHyMdPKdGlYjV/barqR36HgfwwiLDgRc6RmTJEVFx1MDAxOCZKy1x1MDAwNnHPXHUwMDFmlLa5XVx1MDAxYdnKLHdcdTAwMTPOrXE8fXjsR/xcdTAwMWP66MHBZrBcdTAwMTnBNWkmZfJytWR+k7VmhmiqtpRhhIl5aIHH2WelrcqsNv0jXGZQRzxcdTAwMWXxYOtnXGaJ+JVcbjflRlaJrIah/0xcdFcnq3ZrNkmWXGLm7D2Qbd1dnnBriHfpt+zFc9J+zel6XHUwMDE1+siNX07wd1hi87pCnHDs7HMy7PzWST3H2KxzMcdd6eCSIIqZfmlUdFxy6YVcdTAwMWZqu55Yfn3exJOEY4LOtM0zZYxqLJAnwzBnJcl0wMAgQeUwXG6zOFAhLI9E+5OAr6F9SS9emqqqXHJcdTAwMTVUQVx1MDAxZqNJXHUwMDA26DB77C1FMNTGu7jMqjN0XHUwMDEz0LrnnZtOdqU52jj824u51qpYTlndXHUwMDFiXHUwMDBm6onibo912PdASWnuXHUwMDBmqeV7fNtf82g+iSrjrzVccmDiXv28XHUwMDFhT4LtJpvO0oIu+4djri52XHUwMDA2T6rrfvZlToEv+Ex7TfyR97nVR1lvWGNDWldwL6koXHUwMDA2XHUwMDAwXHIt8lx1MDAxYcRL+Fx1MDAxMphmJadbJ7/8t3zzSVmRo/p2uqLl24qEjyOcKFx1MDAxOL6OTIhcbjuNjCqC7ftfq2vAo1wi4Fx1MDAxMi1PhFx1MDAxZcFcdTAwMDauVi96QedawVx1MDAwNrhcXN2R37e+Z8acxY2HL1J9WzXtXHUwMDA2p0xdXHUwMDAwOIpccqVa/OLs09rWgPBcdTAwMTjVXHUwMDE13L5cdTAwMGXqsIijuTErqNmpcJDHXHUwMDA2q0uDMEffs/pH0+4ttUNlXCKls1x1MDAxMFvT5cq3mpwwhOdcdTAwMDQ/tY2r1905tb7sYu1cZlx1MDAxOdHkvnF4/tAvmnr/zVx1MDAwM3TpXCKhYj42X2tDfNumZotrPP3QbfODeavK2aWOn32Nf5TdiW6TjDXFYVja15xcdTAwMWOLcnd9+yu0uFx1MDAxOYYgXHUwMDA1X07yPjMhYlrHQVx1MDAwNN0kRDBcdTAwMWblXHUwMDFiTtyZRLA4aHz+1bRcdTAwMDaou1RNpOqFXHUwMDE5p91cdTAwMWOHiFx1MDAxZLrw0uOuMlx1MDAxNdZ01Fx1MDAwM96PXHUwMDFmsnpRXHUwMDE3daak0TbQXFxMlyR1qdnwt05n9lx1MDAxObRBmSgxNVx1MDAxZHhcdTAwMTRcdTAwMTdrcVx1MDAwN6XEXG5TXHUwMDFlx6NcdTAwMThI06JcdCZCXHUwMDFiJlb2x9HPgbG8/Fx1MDAwZtZsXHUwMDE1VKNcdTAwMTGjzkf8/XXqndfqrCFcdTAwMTK/6fww1Dhd6vamXHUwMDEyckzwt0G8l/PA5XflyFx1MDAwNCNK/q3AXHUwMDAztFx1MDAxZTSzaJs/tVMsXHUwMDA0YDpcZiHVdVwibHC3YiB50eVO6zLfllJcdTAwMDZ5rFx1MDAwZVx1MDAwMjBlXHLdvlx1MDAwYqLvXHUwMDE3tMa0pFx1MDAxNOZcdTAwMWblbmKbvU7polpaYeKcLuDK4oJpmKH2I/H3qmlcdTAwMWTcKFxi7/S+sPqWZIt5l1A/v0VccnnVktZcdTAwMGW+XHUwMDE2tMwuQGZXntTJQF89TnzFSHE7tdX2bTxCWcdNNvw+TyhcYr/d5O46Qop43LhW8veESnKj6ouQafkuu1wiZlx1MDAxMVpcdTAwMWRcdTAwMWJcdTAwMGbuS9doXHUwMDFhlXtH96mbXr6oXHUwMDExOPepbbZcdTAwMGJcXFx1MDAxYXtcdTAwMTT8rqqhcijoWGapZ7L59YP19+igp9Cv38qPo08vvKXibFx1MDAwNFxiXHUwMDBlZKI6tM/IYfKYMM6+TuYvkNKx1tlcdTAwMTJu1Ndgi7KmyoyVY7+qr4LQXGbWv6MnWm6OW37APYq1PPwtXGKEzLvrwVx1MDAxOVrHpCj/M9VcdTAwMTdcZqsz3l2XoygpPcdz56/wopGOhK973cGuhTyRwO3WOlx1MDAxM1x1MDAxZu2EuG50+Z6lWftcdTAwMGWU8+d6XHUwMDE5xtH+8XF+MFNH/Ci3eJp2WrW1QyNLq8XIl1x1MDAwNLc28ntcXF98U0uJhFx1MDAwNkjObKXFn1x1MDAxMTvJg6KtZlxyfmHIb6ZCZ1wimFxcZ6OhQN3yofpZy79XXHUwMDE5O0RcdTAwMDGiPYPfacctVzmEd7zWQoVvLFx1MDAwMWBLq+3trPUtUTD/2lNEXHUwMDEzm/35yHlQeSOf6JfUwFx1MDAxMFx1MDAxYa4ns3HCaGKTXHUwMDFi8Vx1MDAxNLKJXSvnXHUwMDAx9ytzrlx1MDAxMT56Lqh3lF+rZfmMicPMXHUwMDE50CGbhTyPcsBAUlx1MDAxYYLT/vP4h/T1OP67rZD92D4hqNRDyIXcXHUwMDEw0M8xynpFc3M5XHUwMDE5qvgx7NSEwzVRXHUwMDE0XHUwMDFkKfsxfHMqsbbTQIhcdTAwMDPHa+VcdTAwMTlccifiSVx1MDAwN+OKXGJg137UVOTR18ecXHUwMDBmXHUwMDAy3fv5XHUwMDA20rl2OVabXG6rOadcdTAwMDWd2Fx1MDAwZSif0Vx1MDAwNeKWnyeo2EHOuPcn4IzmPbT8Rjy+vXqFOuF9f9a4WNXl4/C2vVx1MDAxYlx1MDAxYcnb6W4o3r7l4uuGXHUwMDEzNpbbay5bK+RdyfZXXHJ/0tz8d7dW/EKciJTeXHUwMDExRsovmJ0m6OTwXHUwMDBiXHUwMDE06jjGTFxc33TO3vi261FcdTAwMDbvXfkkcin2j31XkFx1MDAxNWBL0k5cdTAwMGWksFx1MDAxZVx1MDAwNZyWxo3kout2tePvXHUwMDE1cI2LXHUwMDA11klDoV9W0dGQijpJdobjaSzMKqOUqUpcdTAwMDWH4a/9XHUwMDBibK+IeZlbT876XHUwMDBi0/pLVFctXHUwMDE0VPpcdTAwMGZcdTAwMTm4XHUwMDBiXHUwMDAy2puP11x1MDAwM1Mn/4KctyhcdTAwMTZcdTAwMDNNXzS4/KeNjVx1MDAwNz+/1GqzOD+i58W/V77Wja95XHUwMDBlXHUwMDEwVcjuu1xyMu5cdTAwMTQgXHUwMDE25j81boBcIu5VTi3GXGIlWaiRkFx1MDAxMFx1MDAxMca7O4rgXHUwMDFj2LrqqemdqOkgXHUwMDFlulloXHUwMDAy/0s28mn4/Et6XHUwMDFm+4tF8XFm1n2TisFo8Vx1MDAwYkQ+Mo7v7fyrXHUwMDFil1Ou7sbQdCX2fvpcdTAwMGKpkUR3RVx1MDAxZC8t9lx1MDAxNeJKjaRl+1xuZ35djzhlMaFqXHUwMDBiXHUwMDEyXGJf90tcdTAwMTgnui7DXHUwMDFiXHUwMDE3mPwhik120u+8p3Dp+ouITyq/YpGBsUb7mXtOvz7zXHUwMDE4QONCfLB9XCL8h8vBLn5U1WknLy9VioFJXHUwMDBlbnhZq0DclFx1MDAxOLOSTGZ14lx1MDAxMCupKlx1MDAxY0h78ydp9aGMKV5H9Ttej1YkxzvZVVx1MDAxM91J5buHKF2ndtouX1udjFU96mUyoItcdTAwMWW9Jlxu9NHxilXf2k/UdFx1MDAxY9zA+EC9bcNiq3CYUbEnJFx1MDAxYYkp9+C19XYxofl3henjXHUwMDAwK6lcdTAwMDXO7L6fiFx1MDAwNEL+Js44ZaRcdTAwMGWp+b9zSCygzOi2n7ZZwtpcbvQt034jyHu8sNTNXHUwMDBmuUnBSfRcZsa0+fZyoVLh67VIOzRcdTAwMTJIijjr+5DiWLqI5KPZU4+lv+H53/uBXHUwMDExXHUwMDFmblx1MDAwMNaE4SlTWq9w4EZENMxcdTAwMDRcdTAwMDJcdTAwMDKVgHuv8K5cdTAwMDKF66TvXYaXs590y1FtTnl/s1pcdTAwMWP1K5DFbyhJsvFpeNyx5efNNbjiaz+1+Zj2XrYmgHthXGL/TsPpbeFcdTAwMWaOxltcdTAwMTfjcnTyU6HNf79m/OJcdTAwMWS8XHUwMDEw01x1MDAxNHPnlC/7u1x1MDAwNVx1MDAwNE8pYulalYtcdTAwMWKe4Vxu9Vx1MDAwNVl5KuLKvcp2+2HndjxQ5ZV+XHUwMDBmamG+k4xds8hccs2P97myvFTNeu9cdTAwMTfvm25978HjMNEsQLLOXHUwMDEz/aZbJlx1MDAwMbAth7BcdTAwMTVLl1x1MDAxYaoxXHUwMDE195qlXHRhKjPBV5eOaV3VXVxc3YqM4Pd+XHUwMDA3cZdrhtbOOfvoavqab+E7cb25XHUwMDAx2vLf/nlbXHUwMDE4hDLlwYWmxkxcdTAwMTA+my1vfb1rcppVn07tyoRBnIT1/F5cdTAwMWbxVl6eXHUwMDA18Vx1MDAwNFx1MDAwNmRE5r9BXHUwMDFjXHUwMDA0kPMlXHUwMDE2iJfNsOGuwu2LPm5jzVx1MDAwYlx1MDAwZVx1MDAxYqdcdTAwMWIgbNbF8LvnLtBgw55kXHUwMDBi7aeNy2p7cVx1MDAwNctQLrJCZFx1MDAxYlx1MDAwN+feZXTTYV845Fx1MDAxMGF5zaOMMHwlkZjEXHUwMDEwKXKY32lcdTAwMTSEfuSHLrOFmVx1MDAxM3er0LqRxlx1MDAwMklpXHUwMDBlVoWMWmOLdiRcdTAwMGY5KkQ3gKhcdTAwMWSMIOifIV0q3s21QFx1MDAxM7pcdTAwMGZcdTAwMDLgqi5cdTAwMDNSVto8rdv0+vKIJDIsXHQ03yfg0Vx1MDAxMEg0zD3HlVwil5tYk1feXHUwMDFkI1x1MDAwNU87dSCUXHTKO1x1MDAxNSSpLIxv4U+jQlVLXHUwMDAxwJVcdTAwMTfU9Kb9krjb8NZzrlx1MDAxNFx1MDAxMyclOM1cXFx1MDAwZVx1MDAxMctcdTAwMTOVjVx1MDAxM1x1MDAxYpCvZi3YKaOja1x1MDAwNuGp5+cjzIxKv748XHUwMDE3fupcdTAwMWNZXHUwMDFmXHUwMDFmvMmPn1x1MDAxObR7PXJBKSu/cVx1MDAwMKz0Zm6/f788QuyzXHUwMDA232U5dIq8JkZcdTAwMDdcdTAwMWJBvVXfXHUwMDFl0PWFOzCdVb2mTVx1MDAxOZuRmtOwQc397XUh6ujNiP9Ye+NcXO9cdTAwMGIoYKOA1cJcdTAwMDVcdTAwMWX6XG5cdTAwMGXWWdA7e5JcdTAwMTRxen/S0yBSoM2MfYVcdTAwMTlGXHUwMDFmYycgmWs4n+5cbvh7KXqLfMhGU1hx6u+VXHUwMDEyXHUwMDE471x1MDAxM9vDJ4r+6pdFJaOkaL/a1N9m6+WXXHUwMDE2XHUwMDFh8Ky0fjeAiEnmiaNqz8JuNsfTqKfGM0+i8jg5S7hcdTAwMDWuTFwiTVx1MDAwNJww7Vx1MDAwM8Um+ftcdTAwMWVljkPglFx1MDAxNXa3sFx1MDAwNDajRlx1MDAxZdshR303995cdTAwMTXuylx1MDAxZNza9UKKTSnTeP7PYPBcdTAwMGUlvm3hTG2bKOlfXZhcdTAwMTffxvl+XGaL//K6hHCqiZzes71cdTAwMTFcdTAwMDclVczzIFx1MDAwNlx1MDAxMoGd0ufcgn9fwKzX2+SP8+tcbleElzPli3Of1UWoXHSRhMhAj1+u4WJ9eutw/tNZtt5cIiFlSUQ79VeXILixPqHAVjtY4JVcdTAwMGWr6aOBz4LWT3u2ykN5XHUwMDFjbu7KvJ/eXHUwMDFk8TfmZeVcbu3Kk2OFoVx1MDAxOFx0QER+qTRI/zabJntCmSBDW/120rVwXHUwMDE0+PC+RLpcdTAwMWPEXHUwMDAw7ctcdTAwMTJUa39cdTAwMWVnXHUwMDBlfdq7tJ2ZIDjEJralWe9X6TNcdTAwMTjpXHUwMDE4vSdsXHUwMDAwN1x1MDAxZsNKcJNcdTAwMTFmLqJTXHUwMDFmyE58lJZcdTAwMTD32lx1MDAxZll2XHUwMDEwlCdLlky4JKrASJZPZ3lcdTAwMTe3U7XdXHUwMDExiWBcdTAwMTOWSZqcpnxOXHRu0nek3N5cdTAwMTbi7Vxc84vMXHUwMDA16CqzXHUwMDAxjelcdTAwMDOt9tbjt1xy4+1cdTAwMDShlnqtzG5LXCJtqTtTxUVcdTAwMTXHlP5GYvpcdTAwMTJtSfspoWCmPTB2eyqoxPxAXHUwMDBieLzksXV758JD0tRluVx1MDAwZr7caV07Z1SYXHUwMDA3JcpcdTAwMTG45eQ7z/xEqlx1MDAxOXauhlx1MDAwYnfGlFxmo+ZcdTAwMWSzrEu2kupbrTXhUjglyLk0kFfztFx1MDAwZtJPXlx1MDAwZe9cdTAwMDWNZsY2mc5EyfRKqo231/JIXHTWuqtP5/r+nP75fSR194vtXHUwMDFld+tcdTAwMTZcdTAwMWX4rJxe0y1xplxcXHSVv3Mk3txLdmNh11x1MDAxMqH5m+heljOB8n9cdTAwMTaVekTxnzNdkCQg/vYrXW63cT3QXHUwMDFl78RcdTAwMTdmspR6jMdcdTAwMDFHlLpBfFx1MDAxZFqbuGg7Mj1cdTAwMWbzz11ZXHUwMDFm2IY/461QPoLOXHUwMDE2XHUwMDFlg5fwI3vU7SBMn7ZKeZNcdTAwMTlDOZSYzMHoV9t4/YZcdTAwMGYsJ0WmXHUwMDBlrlVKX953++HJd35/Vlx1MDAxYnWdeHadZLBzLd8rP5xcdTAwMTCtXYqVb1lXXHUwMDE3f1x1MDAxMFxyXGKRwk9wUPggXHUwMDExcqu7cuuIYmFAuMVoI4P3q+x621EjXj2xd1x1MDAxZEVpikCyb5FcdTAwMDCxpPV2/9qb2nvB+KeSXHI61KQ+7Fx1MDAxY4u13GFYzMJoMTXIXvjfXHUwMDE5gDh6cWmJXHUwMDAxv/VISqaPg1x1MDAxZVx1MDAxZm4s4m+y1Yy9QNrikkKgepySPPZyXkOb3Fx1MDAwYm1cdTAwMWSpK6dfaFx1MDAwYtO7XHUwMDE24HdqXHUwMDA2byyyglK+1UetcfNcdTAwMDQ4TSVRrWxcdTAwMDXfjq9hOouH4+GflzqoPXN3zic8xdHNWUx15ChpfXm/TInNk/ucOV2GOXF5jlx1MDAwN3t5fcEvrv39ZN+wnSFcdTAwMDPpneBtNKGqT3xm2fRcdTAwMWGsXHUwMDE1SGI8eWoubC5cdTAwMDB0I1x1MDAwYqZpXHUwMDExXGahjCkmRKJZXHUwMDAzjn5VXHUwMDFmYdyPIK2Phk2WO4I3o4hLXHUwMDExU2lcdTAwMWQ47u+1UPLHg7cuy+bWeteDvdlcdTAwMGJi+u5ePFx1MDAwZiDtk9G9r9YrK+Xv5MpofVx1MDAxMlOEXHUwMDE3syGzXHUwMDBmlFx0tIV9XHUwMDA2XHUwMDE2XHUwMDE1PyvCIfO3ldHF81x1MDAwMMw0XHUwMDE2XG7JXGK8oCeFmVx1MDAwZjlcdTAwMGL5XHUwMDE2M2rMvFx1MDAxMFx1MDAxY346/WlDTlxiXpV10I1nyEolg7csXHUwMDFmiodLvF/cut9cdTAwMWLnUVdcXMV/ZVx1MDAxMlwig4tcdTAwMTbOz6H5nt5mKkaBuH1nXHUwMDEwP1x1MDAxYdREwMSi2eb3nN3VzlWji19cdTAwMDJcdTAwMDHO+/Holu5E/dA+XHUwMDFj7H9cdTAwMTklQC73d81cXG5cdTAwMTRcZm1cdTAwMTfEqj+S5EWWbVx1MDAxZHyNQSfOQUhPUf74XHUwMDE1XVx1MDAxOFx1MDAwNVx1MDAxNFx1MDAxZc64XHUwMDE0afvOMMN5e1xmXG5cZvP9e1xmQNt+XHUwMDE56sJ0sYDQRivk0lx1MDAxZf6HsPNYc5TZuvRcdTAwMDUxwLth4Fx1MDAxMVx1MDAxZWE1w1x1MDAxYlx0kPBw9Vx1MDAxZPmd3/Q5PehJ1ZNlMlx1MDAwNbH3Wu+KgIiB/eHvbt5cdTAwMDb6/zmqXGLovMjLWfPytO2u8Eo+wixG/G3xv72glFx1MDAwMP+o1Vr/ouhf+9JnUVx1MDAwM0qs673O9V/AuVx1MDAwMvzvXHUwMDA0Vk6JxpR4oo+fZ783S1x1MDAxM5Cn8PRM01OKy66LX1ZcYu6SWtckTquIife3MnKUxYw7T3UnzkFWXHUwMDBlXHUwMDBm5FrTwupOX1x1MDAxZvbU+SRVOeaA5fT851x1MDAxMjV/8lx1MDAxOM9lxiCMXHUwMDAxXHUwMDExXHUwMDAyYnooz7TXmVx1MDAxYoKzQE6Ed1x1MDAwZmPAZdhR1E3kXHJCKC+Be/Iskakv+3rzXaihzyttTaenvUJdgPdwWlx1MDAxZlLM+1NcdTAwMTncp8Gyz7tcdTAwMWW7u+9R6e9MSHxDZmi8i+stefvljYEq3dZnfi1cdTAwMDHpib2SvJ1eN23w0MqLw6uc0Vx1MDAxMW7uM2oy8DUzyMCWcSjIK+KhKO+z1ebh74V1s28xbj9cYnuv+eZcdTAwMGIs/KqDdyztMuCVj6YtelxmrvH8qoUq+5pebPOkK81cdTAwMWPE5mRy3cn/XHUwMDE2nbC7+Cwx80pcdTAwMWaSXHUwMDE3nZFeNfJkXHJic1x1MDAwNt5N2H2BusJAXHUwMDA1XobtOr2LuFVYXHUwMDA3xd39u1S/yelcdTAwMTd4wkQ+OyDvnqpYpS6vW7bN9Vx1MDAxYqk511xigSdhYEjZfJ+FnyCgsFxc2mRcdTAwMWJ6XHUwMDBi5lx1MDAxM3TqsthcdTAwMTcybmx15If8yPtNrfZcIjA/qHFcdTAwMWNMWFx1MDAwNYJ4XHUwMDEzoVx1MDAwMir00/qJT3PuXHUwMDFkf++JXG5cdTAwMTW6I3d55Uf48cl9RyN8WUtcdTAwMGZcdTAwMTCUXHUwMDBlo4buzFx1MDAxM1x1MDAwNTP+MnTdXHSiJDRcXNVK3/O9nGZcdTAwMDD1c1x1MDAxMoX3u1x1MDAxZOtdfl/D83Z267gtjuKeUVDIXG6AXHUwMDFm2bM4enRcdTAwMDe1XHUwMDE5XGb1K1x1MDAwYuqTPlx1MDAxNJLlP6ZZ1az7q37b/GOQJMH3kkeUXHUwMDEwdVx1MDAxZj9FKpM6nkOmdOpcdTAwMDLdUZdNSVt+9LlPpLEnXGJ8vovhhX77d1x1MDAwNrPL13xcdTAwMWOkeLvq41x1MDAwNe7LXHUwMDFml+AnRlXF4s+zJj1OXHUwMDE38lhgz0WVXHUwMDAy5lx1MDAxNlx1MDAwNPxtfuRH+zKwv2ORzfo21cMx6OWWK+l9ZbEjXHUwMDA3RsScNKLfP3vA5+tp7VTbk9u7Qkvmx7txW9M8aenrV6e+XHUwMDAwe+mP3YakYkqLUJ2x5DBA+fZcdTAwMDWZTqA0eSRKaN3oQPRcdTAwMDZfXcg8MWxUqEJCMmlcdTAwMTNgc1ZozXt5XHUwMDFlQklxa5lcdTAwMWPimlbqXHUwMDBmxzzfXHUwMDFi61e1ifa8vEaMQmCxSFx1MDAwZpB4kItPXHUwMDEyZKnleFx1MDAwMi8/M/i7Sbp7epFcdTAwMWJted5jgmH2Z1x1MDAxZWJ5rKY7luVcdTAwMDFcXFwi+uKoOpzYy1x1MDAxNnZ7keas9f62ivSW2Ewzhi2Xg9PnXHUwMDE3Ylx1MDAxNGJlnyT6SDg7c+yl6VqNrOc/vZNcdTAwMWOb4JCXbTZga9HymnruXHRcdTAwMDSQ81fppXvcK/forlx1MDAwN0dhPpdcdTAwMTeUZSpcdTAwMDRcdTAwMDKxN8UlXHUwMDBl3DX57idcIlx1MDAwZTCAOVx1MDAxOchh3eKQo1kxXHUwMDE09lx1MDAwM9CXZ9Ww802o4aP3N0cqXHJcdTAwMGJcYpJcdTAwMTFcYoaw61x1MDAxZeDp0taH633OPP83RVx1MDAwMb+F6T1cdTAwMGWKaiaHlYQjt4pdXS/qpVx1MDAwMYmvJ2owSdPb7tXU+05cdTAwMDTKjH41cVx1MDAwNF+VTPKRXCJcdTAwMGKB7Vx1MDAwZlx1MDAwM9yD1O7CkFpP9lx1MDAxNVx1MDAwMpFHXHUwMDFl5cyFWtxcdTAwMGW/42rYKVx1MDAxMl5MoJeRNct1Y328IzclXHUwMDEwXHUwMDAy15b0idpDXHUwMDE3qF2u2WBrNPogvHnRm1xuXHUwMDEzbOCfryf79OI3+OjCL1x1MDAxNUJPnGDIeHqQqVx1MDAwZTstXHUwMDBiQS5C4Fx1MDAxMORHX964o6+M/iOG6HV4XHUwMDA2j3XQg83fXHUwMDAwXHUwMDFiWJTMc0a6/dFcdTAwMTHPvEaVXHUwMDBmO39L1zGAPVx1MDAxZW4m9l1cdTAwMTMhxprk+8lpYZIuRqpjoX/86IrRP7C/2mORuubniVx1MDAxZUijL/BKLPdkbKegYVx1MDAxY2hl/vXDXHUwMDEzaJpcdTAwMTdcdTAwMDKy0kVGsk+OOb6xKVrwnlx1MDAxMVQqz9/B/XVF2Vx1MDAxY5Eleup+fvtfMvlz1Z9/Z1x1MDAwN9Qxn9ks9I2X01x1MDAxZUqHZ6jUI2BcdTAwMWbGoav77JXpOvVEkfR24vu72U5WlY1cdTAwMWPO9qCtn43QXHUwMDFmtN1IXHUwMDFkiZos6reSJTD2y2Xnalx1MDAwMlxu9Fx1MDAxZIbg9rXjXHUwMDBiSFx1MDAwN65cdTAwMTl+0SvtXHUwMDFj01x1MDAxM1x1MDAxYoeN3+mtTS7oWqHS9enp/u1tja5RU7Yz6ebFY7uXl1wik7JcdTAwMDcurfdcdTAwMDDGnbcne1wi5rLGd0at+fqCjeg1XHUwMDBiXHUwMDA0XHUwMDA0XHUwMDA3gif+eTXVcWdcdTAwMTWosVx1MDAxZrksJ6O/XqwuIFWHx/ssKz1/0s25XHUwMDBiun973lx1MDAxMYGQoq8tJpp8kKtWVTx/ziQ/RJazzCxcdEZETLNb2b/qk/Ol+NZQzK9cdTAwMGX3XHUwMDE1XHUwMDBi+dZ4rzQwczKA4C24auw2+ouTht1I0TAhhCF8vFx1MDAxZbJUNdC59blcdDXM19RcdTAwMDcwvulyydhPXHUwMDE3Yk98N8pcdTAwMTeGeZCNQFSi5u99KEuhfvNPfppr1/RcdTAwMTLXJ/Pain+1g9wwu2NcbiZcdTAwMDSCXHUwMDE3hvrlqTy5VWDeneepN8lUN7xTXHUwMDFjXHUwMDAyXHUwMDFiSvaOQXhDvb5Z7IQ2ptCT3El8O3mKiMTJXHUwMDFlutRvXHUwMDFlRGlQtUW1w4yBaVx1MDAxNNBcdTAwMTJLWFx1MDAwMX986ItcdTAwMTRsXHUwMDExL2XpjthcZlbnfICqXHUwMDE5Ylx1MDAwMd+E2XM9iafO8LTcRObY7z/7QJfMXCJcdTAwMTLY3PejXGY9XGZ7XHUwMDFkjahT+khDXHUwMDE0fvWCXHUwMDBma/ZpiCmvmuYkxFx1MDAwM6FcdTAwMTDs4thcdTAwMTaGyvhRXHUwMDE4k/vho0byMK5y/bl+lYevOVJcdTAwMDBcdTAwMTPpIDyqsq0rLcg9XHUwMDAwdCA8fFlcdGE9nbZ26tLWjzYhsDNFXHL6keI4lSpcdTAwMWaSVVx1MDAxNU6GvEbCi5c8XHUwMDFhl+XzeHdQU7T8W7x8dzBpNJvVXHUwMDE0t4CKpVbEyIWjXHUwMDA2MzVZmY2Lt4Bcblxc7WWzdvdacF44XHUwMDFhp7aTXHUwMDFlpItR8Fx1MDAxZTiM8FPeilwiOE2leOPT7lx1MDAxYzCVb0Cqb2F2JitcdTAwMTZ/wv73npvYlkBlryZVuNzEjHRNpEtcdTAwMDW2SS+kiuW+2H5UWFx1MDAwM42EacFd+faoQ0BP1cazb62P29Z+5ifbqJpv4mwjXHK9XCKUkrK1r+qn9ovZTN/Phlx1MDAxOciYkNfBP/7be1x1MDAxYcVcdTAwMDd/fqTKh1wiNH95rtj1u8lKMeHVvEWAUNBcdTAwMDD/XHUwMDA25NOQZ3gphvSje07BXHUwMDFijtrR24E1flwiQCEkcH1PT1q2xk5NaWso8dC86tDB0OlUL8FasVmza1x1MDAwMi/0XHUwMDE0jHO+cTGpUYlcdTAwMDFccmjB6C5XbaaTR+4o1fE9dY8pVzihNUpuq4pnijZzXHUwMDA1/V6Ngl+DsFx1MDAxN109lIdFYez9JeSNo1x1MDAxODHOfio1XHUwMDExojB6dtWI/vJIQmWSnEzKh9RUXHUwMDAwLD4hnZufqIJkNF9cdTAwMTLkg7r3mUD55rA+gp+BXHUwMDFjx2zy731hT6DZaZNcIqw1N/HxbML7l6X3XHUwMDFjklx1MDAwMlU3XHUwMDFhXHUwMDE1x/xOSKilS+2yXGan/MKcJ7j35Pg8XY6oqJ2yX5rHxIhcdTAwMTX+1H3vjLc3NHzUQ3PEPj5FTyCTdqQ66U2ds1/Uc7j0W1BcdTAwMDdcdTAwMWZcXM1MyleD0Vx1MDAxZqnY46OEsVx08/BcdTAwMTI3XGaxK2VL8uRcdTAwMTLflDrIybfDOPjXeOuTZouG7GVccko1NXkqh+dCyZ5ptK+NmTtcdTAwMDSGXHUwMDFkjlwiKDjt6rFBdIj86VxyXHUwMDA0jZ6pPXpRslx1MDAwN4RGvrDWXHUwMDBmwTe2NpJYzc5x0+JcdTAwMTLZXHUwMDA3hvcnzGZ043ppgP5Yv0gj/vGTXHUwMDFlX1x1MDAwYmFcdTAwMDTzREmUxcelXHUwMDAxtPL1xryZJSzH/eKDZ1x1MDAwZWdOjTDZjlCYjyRihSai7ZiW2Gfzbz5cYsuutYRsUjHpiYRLn1JcIlx1MDAxYZrWa5ZhXzDyXHUwMDA0XHUwMDA3KkBeNKbL/oFdSoiPh5N1rcSciFRR9kZKmnh8mmdcZv6Ol8HwPOGqyGTXKstRsFxmXHUwMDEwPZSYdXS976dcdTAwMDZcZr/fTz7GI9lNXlxudTEzXk+5MCdYu/xcdTAwMWU9VTTCvo2YuXJcdTAwMThcdTAwMWSq21x1MDAxYlx1MDAxNkGppXg4P8Kph0Pm1Vx1MDAxYfbEIfLg4KugoSeoq305yFx1MDAwZfDSuS93d0xcdTAwMDP6Rb271viqbMRvXHIjgzJ4//xEPLzG1378ZP1Iq85cdTAwMWGjQWq38pdldFn//ac1P/8u41x1MDAwNFx1MDAwM4wkTNi7qrXEXHUwMDA3XHUwMDFj1nxcdTAwMGZcdTAwMDRAtlFcdTAwMWIpXGKUyGlfYFx1MDAwNeFRyZFcdTAwMWVcdTAwMWPH/idCk/LBelxujJVcdK+UXHUwMDE4O5f3o1x1MDAxZr22njahgsOdksxbjYqpXHUwMDFkXHUwMDA3XHUwMDE4rbqjXHUwMDA3JO/56kW0LFx1MDAxY1x1MDAwMU/GZPkpXHUwMDFkXzd0jFx1MDAxMtSpsfNcdTAwMTG/ubRo5i3ZPHr6QKrTz1x1MDAxNbzvj9D5I2Uof0eXNeakXCLoUomAfVx1MDAxM+zf/eOJXHSOXHUwMDE2fnk6hy9qsOX6XHUwMDE5aFx1MDAxMlQ4knhcdTAwMDOn5Vx1MDAxMvz17UNcdTAwMGUk+2qswjeTpI2J3Hvlrv1cXGLyor418lx1MDAxNiXfLn86d6lviE60ejB9+Vx1MDAxYsXP7100qJJ+cu6rvIDxXHUwMDA0/1VDISihWFGNkZ9cdTAwMDNcdTAwMTRYg6tmP0gw3FFCg2Q/b31vXGatlsFRe4olXHUwMDBipnLhINgzXHUwMDE3SOtcdTAwMTmmssCL0iCPiVxmv94jUa9Z41x1MDAwN1xcf7Eps3/ld4l7XHUwMDE27z27mpRcdTAwMWVQ31x1MDAwZc2kXHUwMDAwoem7XHUwMDFifENcdFOoRFx1MDAxZYPjk7NGXHUwMDEzbNI1YFx1MDAxNcF96/CZXG6lXHUwMDE1VTPNsbIuXHUwMDEyXHRcdTAwMTD49VxiPDR6nmXLz4IuXGaKpbWAl96NzpxcXFx1MDAwM1x1MDAxONalI2T0XHUwMDE1XHUwMDA1rZVjXHUwMDBlX8VlUfhgs8aUXHUwMDBmg1x1MDAwM1nMhSz2fENNZfN6hSbvnliRNlx1MDAxMjGs5TelM1iHmjFJXHUwMDAzTrpAfm5cdTAwMWa0+DYgbnpgSPRXn3fVpzFPryx32omZybXZeEvbd6qldUhcdTAwMWVrgZ1hXHUwMDFl5++XNrUhjYeatYQ7WFx1MDAxNvvCXHUwMDFlncI399EnPFxuSjyW5DtK/3ZiKMCsS9z2b2NRQKx4wlx1MDAwMK5l7iBcbu7bc1x1MDAxOOvRhj9XcNtcdTAwMTBcdTAwMTNhL1x1MDAxYn7ds1x1MDAwMPZWXHUwMDAxSkyWwZza9zPoONTsetu85KJpRIZ7+5oghNLG9uN1qFx1MDAxOPWT7K5+d87jXHUwMDAygJxcInL94evdidNtKW41XHUwMDBlw8lif3vY+MHT647Salx1MDAxMDpccoVQ6T/5XHUwMDBmXHUwMDAylfrIXHUwMDFiOVx1MDAxNlx1MDAxObK1b5Smo87RmqDc7CD2O2C3ZqFcdTAwMDQzWlx1MDAxMHVLfz4jhdJcdTAwMWaT0Hri3s9JqeRQflx1MDAxZL75JVx1MDAxZrroPFx1MDAxNFcqd71zrFx1MDAwNkZm0ZxcdTAwMTFcdTAwMTcn/cFcdTAwMDP0dE3q/mlcZir29FwiOlwip+S+OFk3MeS9p3X/3mDS4fV83+ykle2Rhb0oi9JfXHUwMDBlkbZcdTAwMTZqz42gvZTWJ72Ax9Q5XHUwMDEyiylP7Vxyhaf8Y3R3MiVcdTAwMTbWnbBiQl6lRaZhoe6fk8/rOsxcZi7lQH2wJr6cpt7RzVH2XHUwMDAyL1x1MDAxOXdcdTAwMDJcdTAwMWSPxjxOXHSqYrCcoz7BUjm88tu2XHUwMDE0eKbb41x1MDAwN8jkXGJt5vS94HFSp7jvwWNgWZ6uvZT5elx1MDAxMUQt+6bqTHa8kS7+d5z/K79cXOArQ81cdTAwMDXMXHUwMDE3XHUwMDAxXHUwMDFm6DGFgWSCLeCYxLnTnynB7lx1MDAwMTLBPdL2w3xcbvHnsZmQI0/KtFxcT1tgcaRSJlx1MDAwYlx1MDAwMVx0OufLY7rUWV8gXHUwMDA1bvNgLOTk0Wf8XHUwMDAyPGNDuJVKidd+iKCgQu9FOoxNZGBCXvc+z+5DXHUwMDBiqK9cdTAwMGK8UFx0s5+3ktBBxoRpkOGcXHUwMDE4etZcdTAwMGZmXHUwMDBlz1x1MDAxMfQpIGstY4ZD5e0vgIxcdTAwMWJcdTAwMWSSXHUwMDA2td2E8UzGNIPKdMro/s4tn7y1dyWnOyCCtlx1MDAwMiNIXHUwMDEx8ZRfMnBcdTAwMTdcdTAwMDdcdTAwMTlET5KejlFK02tH3fXaXHUwMDFmXHUwMDBiLkc2flx1MDAxYVx1MDAwM6MzWKdcdTAwMTfiop7dSLtcdTAwMTJvcqj0k7mya3dcdTAwMDTxR2xonlx1MDAxZi1qLkD+QIRcdEjy533/0z+GMEFUhtysXHUwMDE4t/b+q40hz1wi9U3AXHUwMDFiXHTj0NBcclxuzFx1MDAxYp+Eeb9cdTAwMTO+XryuZe5+OE9vklpcdTAwMDdcdTAwMDdcbkxcbtDPMHCufVx1MDAwYv3fQVx1MDAwNchcZnU3vEdNd5TgIOH9XCK7jJ6D8o/TnXlcIoFiw1xc4txfYL9kgZW2XHUwMDBlXHUwMDE5vklNhDWLVUtbXHUwMDFlXGZdlLtcdTAwMTDbg1xi6J9cdTAwMDKcP4Yn2dZz/55SSTm3M2NcdTAwMTP96DcsXHUwMDFl77TGXHUwMDA0WOxcdTAwMDdFxJXNMO9lK522cFx1MDAxOJNcdTAwMDDz52uxKpOEXHUwMDAx6GX7Zy13/m1cdTAwMGWs/UJcdTAwMWE1jE1AmCR2+lDgJ63CXHUwMDExhKH7jIRSi2Uw7LOQmrJ15trfpJuTyeHa0Yea/PztXHUwMDA1e1OVU4tgdUukeUqpkJdcdTAwMDRcdTAwMTnM3k9FXHUwMDE031x1MDAxMjLhJGe1JU4tXasj+1nljjRcdTAwMTd6XHUwMDFhn153XHUwMDAyXHUwMDAy/J1cdTAwMWa2f7Uh1NXVyDTlqXDajUBcdTAwMDBEmoWW70n4fKCXnZwtXHUwMDE1hN+4YVx1MDAxYXhcdTAwMTclbmV35KSN5F+ndmutUt4sp3F1Nlx1MDAxNqFyfHw/qOFAPLlMQWfm264u0iTyR1wiy0DRrlx1MDAwMquVfSffQVx1MDAxZZ5C735cdTAwMTeCeonU9bBPfmP5t/1lObMmR1x1MDAwZj+n06HkXHUwMDA1TShl81x1MDAxMVxygkTgyS9GKNrqfzj9n3mjNFx1MDAxM8DXI0PpXHUwMDFlwuG9ad3P0UpHZDnm1Tztxlx1MDAxYtSFgOP8aibkXHUwMDEydyelQ1+TYoS2Q4foIDL1iVx1MDAwZTz3b89ccjaXyExcdTAwMTNcIub4fb+CVVx1MDAwYiBcdTAwMTO/rdJAXHUwMDAzNL1hXXcupqa3jqbJXHUwMDAx+Fx1MDAxNjK624VC+fC3XHUwMDAwmJMhTnjecqJ1nsA5poqXo4OWZpIqsr/znOZcdTAwMGZHgpWu9uP/k//7mSui7XO+MXV/6Fx1MDAwZlx0bN3PJFx1MDAwMdWYefvVNrM7/97GJqJ1ebQxZCZcdTAwMTYpXGbg/maFpsauXHUwMDA1iFx0M1x1MDAwNe9cdTAwMDFcdTAwMDbw2OHJebn3aWT0XHUwMDA32JO2qmHm39FcdTAwMTe2XGJP2cazoYZcdTAwMTXnXHUwMDFjRe7ZzslMk3h72TWDMU7TWozex5tcdTAwMDVXXHUwMDEzW22m7Nls1v0mI/tBeVx1MDAwNctcdTAwMDGEhFrdx1xyWaBcdTAwMWFSea+q9z5hazHizDQkxKT/i21hf0tcbqYgXHJcZkKeOaVjs/7tWziTXlxiXHUwMDFjLJoztabfcVx1MDAwZT6L92ztwbBcdTAwMDZAN+yUglb+xnNtXHUwMDA37GsxOLNcZsHtdiBRaYLHj4Z/XHUwMDEyXHUwMDE3YipcdTAwMGVcdTAwMDYuqFx1MDAwMLZrXHUwMDAymM3ZxFx1MDAwNlx1MDAwZuI6+q6BfYIt3+PG5zY2ZIGygPLD/Mb01K5cdTAwMTNcdTAwMWI6S+P361x1MDAxNEbffTTxsEXDqLy++d5cdTAwMWavV1x0pFx1MDAwZVq4XfkwuC1cXNM59utnRdG7Yv/4V/C2+O3Zf9u/gFx1MDAwZuRcdTAwMTaiw6WK1iSox8HmuMXz1aL4e9T58SXhdTAll0RC1lx1MDAxMOtG5Cs3mVx0XHUwMDE5QrAy3Uzza+7n3dVWnu3BzkuXi1x1MDAxMmGEeYqTU1x1MDAwM2mi1S1Qf+ehOIRJWd1QOfScrCV40rJcdTAwMDMtXHUwMDAxllpKW1x1MDAwMaHmXHUwMDExJbdcdTAwMWMnJN7VrIjoOzfiPmO7XHUwMDE0SMhcdTAwMTCkbzeYiYtL97m+aJ32fjRT2FXfkeaRXHUwMDE2XHUwMDFjkOR+XHKSuolP9S/PwrjIv1x1MDAxY3rRXHUwMDAwYfRVh1x1MDAwMn5CNVxiyC+iXHUwMDEzb0iAe3t73qmAXHUwMDBlY2wuUcyWTuR2wKBWkmknybBAR3WVuVqKXSyFee6UYDFXXHUwMDA1UjvQXG5gaMyOs65dTyntJVPsWFCz4MfHv4JcdTAwMWK3XHUwMDBm+I+awZVQXHUwMDEwM4nnXHUwMDFh1lx1MDAxNHX2XHUwMDBm//uHbvR1xzfvcsX2Q4AhMoRpNW5cIvariGrZXHUwMDFm36YvXHUwMDFjvjdcdTAwMTF7TSbfK1x1MDAwZlx1MDAwNSOEkcnzr1x1MDAwNFx1MDAxY1rbm54nXHUwMDE0tc08VoV9pIJSqORCn3bsXHUwMDE5WO1cdTAwMDP4uPrb98UzzcC2VfpvjfTFTFnHPKONd6eqrU9cIqA0XHUwMDE1IK3PSMptTlx1MDAwMtFz+qp92it6TjBbnLtcdTAwMDFkjH5zNKjevsBAkk6RV+u/0l9orlx1MDAwZvnrXHUwMDEzz5bcIJ/U2S7f3sh3/zqjco4lkyzuNltiXHL6SVx1MDAwN1xmNTNcdTAwMTbJPaK+j1x1MDAxNExgd/yWiujTJOr7VvGvqanovqKat6xJesZcdTAwMGZvUp3wU7zIeceWvsc5W0h55DYrkldcdTAwMWSNpy+zyJx+s02UPUTylcqYom01O7iRXGb+r3k0U/K9v3nMgm/crPZcXFx1MDAwZfJUXHUwMDFhNNqLg97oQSaYMH+li49lXHUwMDExzZBDzVxiXGb5ocO/4/fmnMBcbmW3XHUwMDE2cLeRyk9qVFx1MDAxNlxmXGZMoVwinHf/7bm5fVx1MDAwZW39m+dcdTAwMTZcdTAwMTkhT7WwXHUwMDEwLVx1MDAwMrhDLVp5677egpbNXHUwMDE4LMFU41x1MDAxNXxcdTAwMWP/JuxF91x1MDAxMc1VucNor4W3MK1xJ6ryrTzVJfZSXGZcdTAwMTBWXHUwMDFj94jQycs2ptp9tlx1MDAwZeRZhbws9FVcdTAwMWbS2vOCn5TV94PQOCd1zVx1MDAxZOtaKVJK/KbiY9hoTHZrUOBgK9Pz4jLS/Fx1MDAwZY9cdTAwMGLjKEWCnD8oYyQvYPaXs3ZcdTAwMDKzsV+4yMqIxUhJmtgjgqnQtXFFlFCdMNpcdTAwMTUyl/i3VcvHlFx1MDAxOW2eh+LsdsKEXHUwMDE1tuI42tAl1OzRXFzf2mRAsVx1MDAxN46gfN9cbsJjqrLjl5285iBcdTAwMTaNJlIg41wiSC5OQ98vlnQzpPJZXHTNXHUwMDEy3X3s1kKWUFx1MDAwZXWnpSGmXHUwMDFkdK2m1DFcdTAwMTPOj5lcdTAwMGX/jU0nQ4ZfXHUwMDAz/lx1MDAwYlx1MDAxNGzL80aqMp5V1r0sWVx1MDAwMfLcXFyYVehcdTAwMTgwN2JcdTAwMTLbneIlXHUwMDAzkVx1MDAxN1x1MDAwZr4uT3nopfeTv1lCXtmNmeKqM2F0/T2Nao6aXHUwMDFkZKM9tDVcdTAwMDWHxr/VZlx1MDAxM+Ti73MoLStgQVx1MDAwM8ZQuWfwielDs0ZcdTAwMTKL8y+F/81cdTAwMTdUp5yT/OBcYn/PTWVDXGJyklPyi55cdTAwMGXiZ8qPdKrf1GJgWN7zo7xRXGJyXHUwMDA173AlwLzsXHQtq1xm4/Vx1n4lXHUwMDA3VpafiJg8SdushL5cdTAwMDf1/PGZ0FxuRlxuoJFW5vpcdTAwMWVk4ED4XHUwMDA2XGaCxzVkNpCy46hcdTAwMWNcdTAwMGZ+XHSd77MplX9cdTAwMTjRJClq/IxpzYTB5ZRPOFxmnem2j/Lxu7/sL0n/1iWej0ElaOBOXHUwMDA3lYpqp+xXzoawb2ZL4VR/wlx1MDAxYVxiXHUwMDE5mmOud/9cbqG9Ulu084TlI1xmI31dVdNccvbDkFx1MDAxMlxyXVx1MDAwNFx1MDAwM2l4yjDvhTpiT8eLeNBcdTAwMDT1N1x06zWzt7dcdTAwMWHqtsR89K3I99VA0SmUXCJQXHUwMDAyatRcdTAwMTi6v4L4tkL6pFx1MDAxNLCtsOi+rzhcdTAwMGay0Uv4vFx1MDAwMFx1MDAxMXlVp7+RXHUwMDFjXCIxyJ42iG3Qk/A15mxIx/64oiS9PEgzqeuXXHJtmjTy6MJcdTAwMTJcdTAwMTHfW1x1MDAxNadcdTAwMWJZskmL4Eg1XHUwMDFjtTemlNBcdTAwMTfVXHUwMDBid+RUQD6vR8LH/7Y2N6lS/KdccnIhN1x1MDAxNlNcdTAwMGImcVxu7GtSS0m6XHUwMDAx/PVcdTAwMTA3a6B6VqFcXJiJfm2Qsu26I/dcdTAwMTOHLVt+5cIsXHUwMDFkXHUwMDFjXHUwMDAzbLo3TzEwXHUwMDAw0nM5X3/buJj4XHUwMDE4epGZPjzJsmkoRopcdTAwMTdZs1x1MDAwZqltjZ5+RC8kjHuoP3pqXHUwMDEwKMNcdTAwMDBcdTAwMDG84cDfjoWeUkPAf4L587uckVx1MDAwMVx1MDAwMfLw5NBMQIHdk1x1MDAxZFxyhFx0x8vqWt53vDX2XHUwMDFjXHUwMDA3pi/s5dxcdTAwMTDwXHUwMDFhJDaezfFcdTAwMDA0eVx1MDAwMKR5vlx1MDAwYlx1MDAxNveqZ35cdTAwMTYg91x1MDAxY1x1MDAxZlx1MDAwMd+mcYq3mLyWIJHf4lxcwD+7e1OWwH5KsO6wv3WlLZpcdTAwMTf3QVx1MDAwZaimj7V1ZMXVbtr+iodcdTAwMGK6alx1MDAxN8H0pLqTXHUwMDEw/82hPvs15S0/yy0yhVx1MDAxN9/kXFwge/hyolx1MDAxMFx1MDAxNCNPmVxmulaM2MJdx1dcdTAwMGKpcTzuXHUwMDFhTNdqXHUwMDE1S/Ojky+etFxyXGZdilx1MDAwNV1A0i5cIiyBsIygl//WXHUwMDAxwVWUtv8yx8+g3flOUONa702m9dTcKuNcdTAwMDPE57Sn4t9cdTAwMTHGWD3uxvz1/tZLXHUwMDA28C/tj6ZcdMBEqXM6XHUwMDEwMVx1MDAxOLZZk5G1byeMMVxuuTdpXHUwMDAyrY3DXHUwMDAy01x1MDAxNXZzXHUwMDFhUmpSwNagK31cdTAwMDbg7WHGXHUwMDEzXHUwMDA2bPFjSu9cdN1cXFB8QjVNU8uIhlnf3qFOXHUwMDEyszvpQ3HDtixK5bW5I7eQXHUwMDFhunzrXHUwMDAzWfecq0Bk3Vxu3oxcdTAwMDLY2biXwl8nvvy3mZeH8ITQXHUwMDE4l1x1MDAwMDlvT+qH5lx1MDAxYilz+Phaf1x1MDAxNcol0UI8Qlx1MDAwMY7pLP5EU7PFXHUwMDFlezg9zKyIZoOokelDSNGxcdPusUGT8OOY4dgm5mBcdTAwMGVCs7CJ/aKh2bL34iSZRDO4qUeJ3lxcXHUwMDFjn6tDiTXZh8ntsEpd8Oux0Y7wXHUwMDBlJe1vy99ByMTQRI3zSzl2SE8u5msuYdptQ0tD7+ohXHUwMDE1sN6zccmnKavswyqCW1x1MDAxYVx1MDAxYYh/9PV3plx1MDAxM7JcdIdnQ+Z+WFx1MDAxMvJcdTAwMGKk8nmUXHUwMDEy5N14MVx1MDAwN3fC7HS+tVx1MDAwMVx1MDAxMMN20JNcdTAwMDLbxVx1MDAwMNLUhZV9lsYohlwiSSVcdTAwMWKZTCFk71x1MDAxOLCzh6n69Fx1MDAwMzX8eUry6bHpv9bC/jW2obYov781XHUwMDFjqXvfPkFcdTAwMWH+TWBcdTAwMGb0tFx1MDAwZlx0iTiN/K1CXHUwMDFiR3j8sV/q8FSS1pSKrIDRe6a2XHJcdTAwMDTemr9LYVx1MDAwN+tzs6BZqGqugr/3q4VcYnpdozG3h/nHXHUwMDA3Zp8xajkk8a2ys6iHLm61g31cdTAwMWGDWcKnS2bSXHUwMDA1+lZcdTAwMTKsXHUwMDEwgCBcdTAwMTJ9mJM5Qlx1MDAwZUHVWFx1MDAxYWZhp1x1MDAxNH8383xcdTAwMTVVT8HSXHUwMDE4OsGW+GGXTshYNcUkpNRJXHUwMDE1XHUwMDBlLvZcdTAwMDVcdTAwMDOiq2FcdTAwMWQ705jQsjlcdTAwMDJeyKJNXHUwMDAxO3/ezsDA+v+Y47rp0WtBPenaXHUwMDBlTKtccopcdTAwMGLFtpxC4GuOJ/HJxFxub1x1MDAwMFx1MDAxOPJI/L30dCDhi943mfRcdTAwMTNfXCIsZ9ftZWM4SfsxVSfRxn9rnlxiYaGNRjnjK91A4vVcdTAwMWFcdTAwMTNcXCvz7+tFP9NcdTAwMTLlt8Rcbj59XHUwMDAx81vwhjtq0prCPISj7roz5ULS1Xx2vkFOSuJcdTAwMGJ1jlx1MDAxY1e1UFx1MDAwYrFsXHUwMDFhr428W4o6nV/Y66hcdTAwMDA91Uf6N/+F/b3J7+JeSHVvaFx1MDAxZVx1MDAwYlqe7Fx1MDAxMLSd9oR9dfCd4Z72M1FLXHUwMDEyTFcr6Huqt03ilIUwerXHVkTqoqtFwkCvPCgh8NjpfNXuXHUwMDFiiEy3VLZgXHUwMDBiUWfHIPFcdTAwMTfpn7mqgJOcaZPhx0gr1vXayPnov1x1MDAwMHHY/mDJ5+JKtGY8melE14XnUHiDLlx1MDAwNt7kksB0OGRDI4ZcdTAwMDBtXHUwMDE5XHUwMDFjWlRcdTAwMDbAPZWXXHUwMDBl4qr4tGop4lx1MDAwNVx1MDAwNnLEZs2de5gsgmum/bZcdTAwMWVsjLaNlInLXHUwMDAwzCZJ8OqVV1xmMf3U8HzOdIdph8NoXHUwMDA1XHUwMDBmM+Lu7U34XG5FlI1fIDye2udQ11x1MDAxZW10aZR3XHUwMDA16sNcdTAwMGZcdK/JQald2Fx1MDAwNc4ziO9teun9W8R+fO9cdTAwMTbMYUvwSMlwXHUwMDE5giX3cUtdXHUwMDFkXHUwMDFilIxzIVtcdTAwMWRK5IBsNK5xmsSlhLpcdTAwMDdVOFx1MDAxN5Eg0NopXHUwMDE1KIJRXHUwMDFmo0SbbN94dM/51qK9qGg9NzuAg9ZAy8VcdTAwMTTMzjtlX1x1MDAxZlluT1x1MDAxZaD86I5vJ/nL4eBkaq6r/n2tJ+5S0JyOrivgXHUwMDFixnNgxWeK71x1MDAwN1x1MDAxObzvXHUwMDAyQFCujYh9UFx1MDAxMjGSuanMm9mSXpl/3rjHZj7p+cew7IfzPOeif2uCXHUwMDA3Sudtzln1OlBF4cJNxomcZ48sXHUwMDFjkLl2Idfh1NiuS2GopeDQOMWVblxmXVwiXHUwMDE3raiHSKFNblx1MDAxMUGGXdnpWdiNNvpcdTAwMWHuXHUwMDBiMFR96Fx1MDAwMVx1MDAwMEzK0nSx4/Qjpv1Oq4VcdTAwMWV8XHUwMDFhdN67XG7IgSagv/Z2eWBcdTAwMDD0g2tqh6tcIt3UnoRcIvqHRunLekzGvlx1MDAxY88/fzZcdTAwMGVn46v6XHUwMDEw7IuDdlxm26jHcuNcdTAwMTaNXHUwMDE3i1D6z4Tgl6y9srHR0etf6fvi5eCLXHUwMDFjwlT0oE++U+purEmLgG1cdTAwMWKbXHUwMDFkYT1cdTAwMDWNSuU0rFx1MDAxZqVcdTAwMWQ9jDxcdTAwMTVRSM7cWLRGeJm4d2LncXIsXHUwMDEz1VSRkPxcdTAwMWGmXHUwMDFlcIz0sochXHK7VkgjvbqSJN+ne9dcdTAwMThEXHUwMDE16oDAlZ5LjvT1ainf2alcdTAwMTFLPGEtx7r7RVRwMEGUXCJFylbOc2OwUOVcdTAwMWR7XvIhgD368KxcdTAwMTLeXnhcdTAwMWIxXHUwMDAx/Yift6euTCxoXCKPar3DXHUwMDFlXSsuciOlViwkjElHlczqcdAyc1prXHUwMDA14beuXHUwMDFjXHUwMDFk8uS8K+1cclReXHUwMDE2mSBDbFm7XHUwMDFkiFx00z3UVY+Ggfeo6brVhKluwFxuckP05zVWWlx1MDAxOHul/lx1MDAxY8xcdTAwMDeG7Ee/cILpaZhnMFxiNKj/ydL/ZIO3XHUwMDFkgSolm4dcdEVKn5xSdicphiVcdTAwMTCclXgs+dtWXHUwMDBiO6CM91x1MDAwMvLU/kpy/+Gszlx1MDAxM2zxtmLVmuFlwEbvpFxyXqhedJBcdTAwMDGbM25cdFD7r01cdTAwMWJihlx1MDAxMpDXucTJTVx1MDAwNW+MK8zbaXT01cow1ynGV9juUPWUdUK9wDLNXHUwMDAxUpnoZH1cdTAwMDfIr3xhXHUwMDBm+KE1SuNtXG5cbqpcdTAwMTSYkzjok/f9/Z1nXHUwMDAy9Vx1MDAxMbhzaTdMXHUwMDEzV4igQlx1MDAwZfjbXHUwMDA3dPMkJnQ9XGbIwrz4XHJy9WCpYVxcrGAm+TtcdTAwMDc39Vx1MDAxZSCEZdGXXHUwMDEyJYLaW4Vpylx1MDAwNyE/XHUwMDE3RYKRy5RunbiAur4wXGaGx+Yyv1x1MDAxMyV7W1X50UxeIWCDoUlge1mEXHUwMDEwXHUwMDE14GZB7ietXHUwMDAyxVM2R+1cYjyHblT/hD62XHJcdTAwMDX421x1MDAwZlx1MDAwMi/yfefh4Mt/81uS9mWv13/4RGY0f5t4J7RAX7J/+sBcZmq9iE27iYlJXFwzxz7x2rqAgL+2w33xRtZbXHUwMDAwLKHf6lx1MDAwMkk5nFxcwK+R/raScTFU/5JcdTAwMWXfjHyPkVx1MDAwM2os6U9O87RJJ7U9vdCWLaiQN7xNK1x1MDAwNVx1MDAxYVgwrOrecVx1MDAwM8VOMDRxtHZcdTAwMTdcdTAwMWX4icv6clx1MDAwZSBXe8NoMlx1MDAwZUFcdTAwMDOzymWkf5SpwTooQC2kjCHLKDiGaJH9XHUwMDE2xuCt4n9nv7dPO1x1MDAwZTSksaeu/1x1MDAxY5g7PS5cdTAwMDWa0PHPc2z3U/pWU8Dvdvh3PkHde1x1MDAxZr+LOHlcZklcbu9+3OQ/XHUwMDFhKe6tsLa78lxmqjqBsmT45CO2TtwzV9jL3EdA/Vxu1Vx1MDAwMlx1MDAxOONcdTAwMDSi+jYxJFTt72Wy5VbQ61f59y9ruKEqXG6dU1x1MDAxNV63bP1vjUjcNEogZNPiXHUwMDAwLIFqOaxVl/PJdZVcdTAwMTdKusJq9JQuXHUwMDEwnFx1MDAwNYJcdTAwMTl5lG/+kZtcdTAwMGZPhDZN0Vx1MDAxNpVb6rjoT1x1MDAwNkAx3ML0snR4XHUwMDFiuG5Lmb5GwkxcdTAwMDBcdTAwMDUkXHUwMDFl+n6kjsqpr+k0j98zSvz4Wr36+Y5cdTAwMDAviOWWSlx1MDAwYj2BXHUwMDBmeF34JEyOv4Q64N1og/9bYP5cdTAwMGXNLVx1MDAxNZKdXHUwMDBibZK5V4qAttvERp9cdTAwMTOrbdLfXHUwMDFh1cwusPpcdTAwMTZcdTAwMDZ8bnNcdTAwMGVcdTAwMDOrtMh4OoDCX7qvSlx1MDAwMNVhZzEr+0c2XHUwMDE43/ZPvy+ibKi+9WFm7Fx1MDAxY41qQFx1MDAxMoTP6ybfx/8+U1x0669RxekogFBWNlx1MDAxN7beyJKLWX2vL//9KKh7XHUwMDFkwqoghVx1MDAwMXtHmonlXHUwMDE3fFx0eVx1MDAxMqrV03JcdTAwMDI3vVx1MDAwMaij4Mwxe4RcdTAwMGLXxJ90TMP29TEopk7GXHUwMDE0fYwn7E9oWU04aJ/+in1NpOJARcrv7H42XHUwMDE4JlJcdTAwMThcIlx1MDAxYpuZXHSy4Uc0b6SX1vqUdkBe/Hu0y1x1MDAxZoGuXHUwMDE2byHxfo1cdTAwMTEsn1x1MDAwZjKKXHUwMDFl64xpxchcdTAwMTNcdTAwMGZTXHUwMDFmxNpIv7U7RoljgFx1MDAxNd1cdTAwMWE6zVGkilx1MDAxNevos2fSXHUwMDE1ZqrvQtmAmW7MiX6i/V1QWLxHMSWLLFx1MDAxY+CR2unPj9XOMYYmqP9ejlqLlX2jvLhSXHUwMDA1VuS41lx1MDAwN+GjXHUwMDEzu+Sabe2rYetChGzPk/JAMdxcdTAwMTWkRsZQTsPcaLyiflx1MDAwZa2WUyHqPZN96VW7IcVvm6L+S1x0XFyVR1x1MDAwNfbZXHUwMDAwSovd4OlcdTAwMGZ3MYaxSTTGmJ5cYmI5tlxcO8Sl1j3B9Vx0dSb8cq5cdTAwMGZ6ubVxXHUwMDE1nCOzwmG2iUurlbfcXHUwMDFk7ntx3PeXXHUwMDEzUqLnXHUwMDFmplx1MDAwM3OOXHUwMDE0cFxyPVVvmjqyc8P1XHUwMDE3+9uCg6OYVYDX6l6WKjiPvVxuL1x1MDAxMFxcNWNcdTAwMWVMs/EmhU+TrYNcdTAwMTKzUomwfqK2QYZ5XHLiK9nv12pD4UG84C9cdTAwMDRvs0i4XHLIuuahdJmWT1x1MDAxMOZcIlx1MDAxZbNcdTAwMTglpdx6PanzXHUwMDFkZJ8/3OVE2Szt2nGezKu9UVXhlrfxIVx1MDAxOVx1MDAxMnl0PeObb12aXHUwMDFiX7O3S1x1MDAwMlx1MDAxY7J4OVx1MDAxY4Fg+mhaQaY0u8NypePtgGh71DZjU1x1MDAxYfxB0ExATlx1MDAwMOD6vvjqXHUwMDA2QGFuuf3uwlx1MDAxM0tcdTAwMTlIzPSs43TY4/Y3SVWXJ7DmtvJpQc/yk58tglm3g3NoU9stOs3Cl1x1MDAxMFxc8Fx1MDAwZfHrtf9m2Fx1MDAxMdHeh0dlSIj14PTTki6Ulmsj9WDl8YAnXFzuOnnk8Fx1MDAxZHhcci6lXHUwMDBm6vB37X6III2KyV8/lKarkYit+mduQMykmYzyN48t/5a5rEdjSMJcdFx1MDAxNIqu/FFcblx1MDAxMflcdTAwMTd7ZypcdTAwMTnhQ1x1MDAwN/bXL6v70myoRFmTQmrO2l1npNJnK1Tk44tVh7BcIvSvdXLcXHUwMDE2NKRhfuj7yu/JaM9cdTAwMWRLf1xuKMJcYlx1MDAwYpK5+9Fccoxz8FZ4lEM7JtWhXGKrbkQsdF5cdTAwMTgrpCA5fXn6o5fkup7WNNNcdTAwMDJl+tkgXHUwMDA0XHUwMDE464Lkvq/PQKEy4nrPPFx1MDAxMmrxc1x1MDAxM2ZcdTAwMWb0eU0/V/JR7FClTpS/ONoyrOK5Rqq0kNTZ8fXhoHk4dFBI83JccniIJJJAXXyHvvK1ckVDXHLa8ehVqmbfXHUwMDAwe0wypkashWhNSCjjNko3/9dPlHG/Q3KVqZh7fl5PyfSDl1wilN1DIZt5umXuUvT2PItHuapcdTAwMDCkjMNrKHsnyXtcdTAwMWTjhHxdkKN+zqPmMMdLjWVH+qgqpXiMq95/o/3211d3QW+nfvuhPZPK39lcdTAwMTevXHUwMDFkwURcdTAwMGWmWlq7o8zzhNScd8r6tjgrauYr2bqQddaSO8T3taImalx1MDAwM+mk+f1Bxchme4JZwuwvT5KEkp1cdTAwMWafpsqDQNiDQusuqnS8UC+9UolerkIwSFx1MDAwMVx1MDAxM0ltU99FsspaMVPmuFx1MDAxZaNcdTAwMTeVtM1G7ImmISHkdm+eXHUwMDBmjbmoT5nyXHUwMDFjVU1O6Fxyxljanutccj9SWCSTQvowoTY9OC8jYZDc5X5iTtA422lXgLy4XHUwMDA3uiGdXHUwMDE4l2aIKj6x5DWq6Su5INOui1x1MDAxZnJ11JkkXHRXOXA28pZkpmJcdTAwMDNF57y+e60sO2ztXHUwMDA1XHUwMDAze+hcdTAwMDWKn0+sXGZcdTAwMWVcdTAwMTO+k1x1MDAxYTi/LUeKb4pcdTAwMTC8bFxyWptqXHUwMDFj61x1MDAxOPTMXHUwMDE5c8yBXHTo/LAyfsaSwkTs7zBcZvM+aLlwm1x1MDAwMlx1MDAxM2RhXHUwMDA1qb1cdTAwMDSBxGWW7bri354h1Vx1MDAwMsBoUIeNvj4sx8a6u1x1MDAwZTjBvVx1MDAwZvcr3Y9ZNGpaqlx1MDAxZJ5JWtnsUted2UPV3Fx1MDAwNJX729VcdTAwMWE/XHUwMDFks3nMXHUwMDAxXHUwMDAwXHKQP7JcdTAwMTd5N2eVm4ztKOqPS1x1MDAwYl1DWazJ+HtdyJ2uSYxBv1x1MDAxZeUlXHUwMDEw/76e5Heq+M+hXHUwMDBipMFXRrnwnf5oXHUwMDE0rDl/gOf1l2npMe4pNp5cdTAwMTffZnBahlx1MDAwMtVcdTAwMGb60i6uXHUwMDEzplnx94tjKqB34dM6gHFcdTAwMTJcdTAwMGWaXHUwMDA2Z6Ttp5dYTftwZKBcdTAwMGKapzZcdTAwMWNcdTAwMGbuXHUwMDFkuaJu6P1cdTAwMDRcdKlWpm5w7iimp5V/uJ30fT716ckmQFpfb+FcdTAwMDZcdTAwMDI2XHUwMDBlhPR9+1GE9GfatSB2XHUwMDE46UExx1x1MDAwZmrJ0oejVje/WmtcdTAwMWQtRVKwMeNUjc2xXHUwMDA0XGJcdTAwMTmOQGl/3yx0XHUwMDBlK5wzISh3XCI1kK+epeOkXHUwMDA1+1x1MDAxMVx1MDAxMffN5fbCsWozhDvUUP4tbU3PaX/vb4rr0YJcdTAwMDf9XHUwMDE1TVwiQvthf9dp/sO638GC03FcdTAwMDY9vPueXHTtdpDwJ6uGv1B/85Fo6WOfdd6nMt9jblx1MDAxOFxmhiXoXHUwMDBioT5cXPRcdTAwMTNuTbGFNlx1MDAxZlx1MDAwN4RyXHUwMDExdk9cdTAwMGJPwL6Ix2C4VcpJXHUwMDA2Y5b0vlO0N1LkK/WXN8n2zyR1ZtQ4mtzYpVxcw1x1MDAwM5a+4WAlYpmYjGr4xeTQJPeE2lx1MDAxNVx1MDAxYuWxXHUwMDFkXHUwMDE4mOc6vnklXHUwMDE2RVPP3pJYIZWsX5C9hEdW3O5Jn33PZjpG3aHzpmqEpYtLXHUwMDFhv4ejjUzp9T+KLK7DyefvqtQojb5pTIeFJfT+h58ngPztXHUwMDE3XFzb45In62FKTmO8XHUwMDFlXHUwMDAzcVx1MDAxMcpV1MXVOiptgVx1MDAxOVx1MDAxY+HvXHUwMDFjXGad0NtdxJcyVNJdXHUwMDFlPus7OVx1MDAxZP9pp87yQFx1MDAxZMatWHH+cKr1iMXRXV72izyZXHUwMDAz0JNh+45ozp/Czk9cdTAwMWYxqVebWPdb6HE9L1x1MDAxY87JXeP3/DtcdTAwMDOF5fRQckNfan3JS+tcdTAwMDencPVqyMGdXHUwMDBiuFx1MDAxNGY/qS65sv1tzrdcdTAwMDB/8y82YtU5jY5gaEiAT/jpeK+10DiuXHUwMDBlJFx1MDAxMK1cdTAwMGbEMiCSZL2u5lx1MDAxZs6otZ5zKeWL11x1MDAwNba1i4dF33M5llx1MDAwYmPkVntcdTAwMWQ/kFx08/c2VprLz4pcdTAwMTmD5tqavCR1W/lcdTAwMWNHXHUwMDAxW2XYIOpYNnTI70k95LRcdTAwMDV09FqU556gXHUwMDEyXiHJgI2ndj+rnnxF/uRJXHUwMDE5ifJC6ZPx9EXeXVxckVx1MDAxNKkkaz1iPXg2XHUwMDEzzuqLi1x1MDAxYlxi+UKCQvVefsZooERcdTAwMTFccpDbd3BG49fh1S+CuNtcdTAwMTTL7v7H87NcdTAwMDcrPCeYnYMvaVx1MDAxN1x1MDAxOO6enqJ/i6+jPnHlJ7VcdTAwMGLzblxiWtTpXHUwMDBiazyh1Ch06Vx1MDAwYm3txJCel0nt6UFts61qyJwgf63XXCJP2b9cYvHbZd3cvDxcdTAwMDa5NebbXHUwMDFmOXhSXbiWrjtcdTAwMWVJs29cdTAwMWQj34s7XHUwMDE2szVQSyx4j2ylY3GWLPJcdTAwMTdDcpJcbpi4YpR0XHUwMDE4IaEysnSoRbDVXGI8TphkXHUwMDFlju42XHUwMDE1drXPSeqILUJcdTAwMTRPXHUwMDE0W1xcnj+VIVNq3+rScoyZctGD6anYXHUwMDE09J4pbHw/RelcZj6O/qZtXHLLNW256iBcZvVcdTAwMDfhXG7W+Fx1MDAwMCxcdTAwMDKgcM1z8zcpVVx1MDAxNJ9GZGu7tFxy8Fx1MDAxNHsrbmPpM1x1MDAxMYBehtq4ZIV5PTGcLlx1MDAwYnn0n1I7Pdb+bX8nsdizTldn2LZcdTAwMTE6eMVD5Ohw5VxitlCyQ/aRkKmtXHUwMDA0WZq35IFcdTAwMTTPNX9W/TZMX6vVvNnXXHUwMDA0XG5q+GowiFx1MDAxZHWlXHUwMDAzXHUwMDEwPL+zJcSNcXeH1Vx1MDAwZVM0xSXkmVx1MDAwNZFcdTAwMDHx3Vx1MDAxN45jbLTfXHUwMDE5rnRJXHUwMDA3wJRcdTAwMTMz+bfvXHUwMDFiR39yR3yoZvmWY1x1MDAxY+rxnWXYvkjS1rdSXHUwMDA21ubj/MRyNyZ7ICixYVKxajl9jL2tSOkxXHUwMDFiXFxkXHUwMDBmdP87JWxw+bhVOEb6OIncg4CDvVx1MDAxZTqK4iM5w7w/qZ/nsab6Zlx1MDAwZuCVXHUwMDE5XHUwMDBm0ix+a/JllLm9JZVlTU+qf1x1MDAwM4eTmCN5z6o09YWtY9uec1x0V3W+xFx1MDAxNJPtLp2KoC3sg7N1jpDSjTbFqiWswkJcdTAwMWUnolx1MDAxMM9cdTAwMDNcdTAwMDN7zt1Ez4VNkdhWXHUwMDFjXHUwMDE44oT5R3mr+im/P5w8IPSnIHlcdTAwMWJyIcZcdTAwMTivz8FcdTAwMDM8tj9cdTAwMTX5IVx1MDAwM0TEd7CJ5cqvtSDSuFN6dW+HP+Tb7SjrvFx1MDAxY5SYXGZBnFxyfVx1MDAxMkpb4UOyXHUwMDAwSfVcdTAwMTOVjV6EYLL3T9gofdVk3lx1MDAxMS+8xF1xXHUwMDEwYMs6PptcdTAwMWFcdTAwMDMqjVwikfqfz1Ml4G9uXk9InUqaYPo7iKQ1xHdCIYdMT84o/a35UiOESSzZKHVdNFx1MDAxZlx1MDAwN3JB+6xsmOEnmaLGXHUwMDE4yGWtjfupoTpCW1x1MDAxZFq2hYJcdTAwMWUpu/NXyrTp10map4aQZrNcdTAwMTcp24E3XHUwMDAwwqZ+vCDUXHUwMDFlJyX9zls7XHUwMDE5XHUwMDA2aVx1MDAxZpaDyKmpnb9HyWa+L1x1MDAxN8qZXHUwMDE5spbj3lx1MDAxYpVcdTAwMTNcdTAwMDBKTnafsM9DnLDfeZpcdTAwMWb95ldf6dziL+02kO4m5fekdeojXHUwMDFiRHBhJ54qamyxdvlcItb2XHUwMDE5JpjmKN1Y4+ayXGbrL/hh9GNp+rGLvuFb8SNXqPbMXHUwMDEw/97Fk3hcdTAwMDfaZ1x1MDAxOWv9R4JcIqvf6TdcXPEjXHUwMDAyaqTq7mA5XHUwMDFlJizxN6B5wUSlKqVeZMI/f6RLXHUwMDFimyHzNHI2yIvnTevm8ftIX+CnpfvlqUX8+NtLhF9Hku6wsUf0RlmRj4H48ytcdTAwMDGWkr8675JFXHUwMDFmXGKMJ4ze9EY+o5rb3+YjbHtKZKrxXHUwMDAwRK+UXHUwMDFkp2hcdTAwMTlHXHUwMDAy0FZcdTAwMDKP0LSMZlxms5ePai54/zO5XHUwMDE0JX6eaS6G/kzbXHUwMDFi3jxcdTAwMWFR592/Z7Al8lBs/kBcdTAwMDVPL1+YTFx1MDAxOO9VoP1HoFx1MDAwN246JNPcd0VcdTAwMTAsdeBcdTAwMWErKWqywJpjhDBX79l6ksS9wEp/e8Fgf1x1MDAxYlx1MDAxZNuZ40Q4tciGjI+x89pI9aSsoKxSXHUwMDAyX5WBwVx1MDAxNOipbLdcdTAwMWXu+jDMR99EzTZyOGhcdTAwMDFyXHUwMDFizYgzZlx1MDAxNKNcdTAwMWOoUVm/XHUwMDFih/O0Sei35ojB1FrHXHUwMDBiW9+FbZPN8jhjq1x1MDAxNvFHoVx1MDAxNu/3lNiFWVvkI3GO0XORj9NcZqRcdTAwMTT6cFx1MDAxMCFOw6zLN1x1MDAwMV7W6V7PvJdgcUTM5NBib1x1MDAwYlx1MDAxOfg3bHLxoSRIeyfQwVx1MDAxY0a8sueNmsXz8p5cdTAwMWGDPJ2uYoD0o3PRd5/uxW5cZjp2JIfWK7VcImFcdTAwMTZ3byZ1xDa+cOFcXFxcr1xiXHUwMDA0Q7ChIDmYxn7M/3imqVx1MDAxN1x1MDAwZWWC+oA6XHUwMDFi4rhyJ7B/XHUwMDFih+G75FlcdTAwMTImTrs3dyZAetjwTVx1MDAwYv/9q/snXHUwMDFmylx1MDAxOfDPgTI6uX1BetJcdTAwMWVemsZ7WCWQh1jzMaBcdTAwMWHPclx1MDAxOGZte8bJP7CC7VD1X3KbhsHOuTG+PoyR2I0/3WlcdTAwMDJcdTAwMDP8y5hNNFx1MDAxNDJcdTAwMTFcdTAwMTEprC9cdTAwMTC+NStlXHUwMDExXHUwMDE568FT4DFccj3bRJRcdTAwMDdW2fl1I4faXHUwMDA20z7CdGrmXHUwMDEzRbelTTZd15SgXHUwMDEyXHUwMDE3KYtZd5FcYuDVzC6m5ZORqlx1MDAwYjON56tpW5rOv6Ry3p5cdTAwMGJs5nG+KifC4M/4dVx1MDAxZMrUIeCEp5r1UeRcdTAwMWW/vHE65OFo5rRcdTAwMWKUXHUwMDE2dVx1MDAxMtpcdTAwMTFcdTAwMTSZycFcdTAwMDBVTz78sEzwt7/fW+B1eVx1MDAxMcZcdTAwMWK7K0+Ir1xir7nVQ3zoYnr/XGZEJ8YpkzGCK8Pc+SAx+45cdTAwMWaRbT4kRjKBfXOBjk+sN0W87VmaXHQgplx1MDAxZItt5Fx1MDAxMlM1la5cdTAwMGLEiH6stlK8m9jb8J5cdTAwMGXnl1x1MDAwYsVKkO0rcr9cdTAwMTWFcvEghpb8XGJa5PhO72+biFx1MDAwNcsyozt5xlx1MDAxN1W6bz85L3hcdTAwMTGrP4aDrrzzq4hcdTAwMTNtQsyeef3NdUtcdTAwMDDYbfnTuqfb20D+4Y7RXHUwMDEwXHUwMDFhUbV1rKPpWFNutV+LmFx1MDAxZcQq8EpcdTAwMGL8ezKZR+CSXHUwMDE0lVx1MDAwNzRcdTAwMDdHXHUwMDA0rEhTXlx1MDAxNa/jUPFcdTAwMDYqXHUwMDEypJZcdTAwMWJ2XHUwMDFkJV42jr75PWx/bNaRXHUwMDAzWtX9WTVf6lx1MDAxYybGemXW+vHkW57vNZOIUvBqXGY7XHUwMDAzwYNM1iHC8fdcdTAwMWOwo1x1MDAxYtIhjjb+XHUwMDFjjkJpXHUwMDAzTca5W9aO4fm6f7t6+3hlkDhhNHmgLCbCKlx1MDAxND1cdTAwMWOKXHUwMDFlnlx1MDAwNllcco0wgVx1MDAxZFxy1avEXHUwMDAxY1x1MDAwNc7HXHUwMDFiaZyet6kw3dhJwVx1MDAxNS4kXHUwMDBm6elcdTAwMWJg7/2dN89cZlWMLuu/dKhcdTAwMGVDcLaPjn1cdTAwMDBccjPYfCt6LHGPep5cdTAwMDQ+q1x1MDAxOJRjzEW5z84qNPWBfajeV3d7XG4l+TjW8k2JjNPbsUP9+/swXHUwMDA10ENcdTAwMTmImcBcdTAwMTFcdTAwMTWCICrjeDP1KvlhMiU5MVx1MDAxYS2dxLcmme9aOr5hvmg4+nxLlV51gN7ol5865b2p7Y9jhZGiVy+YxmQ1Olx1MDAwMZphcjXo4volb5hN6lA29WNW871LNo1Sdj4tQjSLTelG7VRcdTAwMTnAfVZv0ZAjqf09pbht5ySaWvRcdTAwMDJxv71cdTAwMWMjM7Tru3+T31x1MDAxMfHc37PJJapTX21jp3q69ffaPO9cdTAwMGYkVnItUfTrLTXHMGq+XHUwMDEye+DrkYqIm/p4opz4WZxB7Vx1MDAxY7twt6KzqPvLiWFcdTAwMWFcdTAwMWM6MoD59/tg0lx1MDAwM9FeXHUwMDFmS/yjVlx1MDAwZiPH5C1a23tLhueltStaZJX4hlx1MDAwM5K+R+7gNvSI95zvVD/TTSNcdTAwMDfUT2RY+jmIpPYuU2J1PJlcdTAwMDdEUJ5cdTAwMDfbXHUwMDA1llth1GBeq8iVv687RFS7XHUwMDFiPI5cIvXv9nBeRMNcYn2BM0RcdTAwMTOzeKBsPIpcdTAwMTiuyszllOPZnm/QO/ZVf0nPJdz+176sk6/a+CtcdTAwMWWm8dWR9X1qYdqKXFw+x4vqb1x1MDAwMCYs7bleXHUwMDA3tbNBYv6wNiSlNCN6PUYrUubLPT1cdTAwMWX6kfLmIVxyPfRcdTAwMTHOjdf51Y6euv5cdTAwMDBr5cIvQZGPTEozXHUwMDFlOf6VeUzNkeNcdTAwMDPdXHUwMDFmv6Zo7ICNXHUwMDFhdCTqOTqEXFwulUebSymykGlJsM6puPbi/txcdTAwMGZcYoBMoEFMb809UHn5XG5cdTAwMTPNXHUwMDE05bDLbVWRwydZvdNcdTAwMGaq5+VcdTAwMTVcdTAwMDS51mTGTDw0g5Kr2SZcdTAwMWU5MWWDwYvMRmrui6n754eRXHUwMDBigE3N5vhcdTAwMWJDRTBzuDOXXGZ3w06/hsmG1nthkv+iXHUwMDA2+rNwu1x1MDAxOeS+7FxujvEjQbHaTYxuxnNcYvrxp6hH0UJz+5yOXHUwMDE0KVxy/tpkg2fM8Ydy2sdONVx1MDAxMvvblCclbKWnTj6GuaBcdTAwMGWvNExCt1xi7FD2bJu6zceNXGLcaiX3zU3r2apfQVcyQ1x1MDAxMd/FjItcdTAwMWLi9jywv9BcdTAwMDFGgnWzhOxZWvSuXGZcdTAwMWZ0Qv5cdTAwMTErYiHr32Jccp5xjYJtOr3E7GXpuP6teEZ3xPt47WdcdTAwMTjV93GjtMLXXGJcdTAwMWTl6NNG4jrI8u8yuv6zXCImblx1MDAxMDPQk71/2cx/P5v0r+dS/SlcdTAwMTVfXHUwMDEyivWvdfpcdTAwMDSCm0b+yT6auNZqR1x1MDAxMlx1MDAwZeGNOj21XHUwMDE28vnGsEeFWNZk9OtCdFx09M//Q9Z7bDlcbmxbgFx1MDAxZsRcdTAwMDCEZ1x1MDAxOHjv/VxmXHUwMDBmQlx1MDAwMlx0L76+I+t1r373vkGpVmWllElwzjZBxI6vl+NWXHUwMDFmuTv03sI4Z3+c+lx1MDAxMIJ5Pvw3q1tljotfsnpo+fWYX+JUTGibSGKxRmIhlbSLYn3cXHUwMDFkdPp8jW2aXHUwMDE1LPzqqECfiWqa9lx1MDAwNFx1MDAwNmBcdTAwMWFamoRITHWy6LZcdTAwMDGHKIu+wXtAls8q6odkfODNvG1yN81cdTAwMTemfFx1MDAxOWYk1Jlp3sJnmkxuwazyI1x1MDAxMVx1MDAwNpMhQPX9LCwuXHUwMDE3i/dcdTAwMDFCfNpcbpbvXHUwMDE395hYXG66a2mBqlx08NZtjYuMSLChXHUwMDFiLYFWSZxcdTAwMDdJUVxmYo2TXHUwMDBlXHUwMDAz717NsixcdTAwMDLKqVx0313h11wiRrHF2vJcdTAwMDN22EuiXG7DxfNcdTAwMTmyX+SyXHUwMDExSTd4XHUwMDAw21x1MDAwYlJdWr9DXHUwMDFh9828b/NyXHUwMDExlpTuqtlcdTAwMTb/ZyRcZqiTOfzQw6TUaYzOt7hcdTAwMTbs/P1CXHUwMDFhN4aS/Fx1MDAwZTNnKfLfrN2Lad+Ysjwgclx1MDAxNTe3f3tcdTAwMDXoXHUwMDFmcNNcdTAwMWaX7Fx1MDAxY65pO+r9TDjh91xyLGrIWyvRUs91tbkyujnpqCPfXHUwMDE0ypC/UsP6vPKFQubp4SY/iOJcdTAwMTYk6b3gMfdMmEb5KDK4Y0nqkVx1MDAwNqhcdTAwMDdcdPBN3nDn1bSqarzb5/ehTVo+7Vx1MDAxZHRccniYlEGiiUhcZl3i/JvBXSf2XGYv7eRcdTAwMTCOXHUwMDEz9rVVK4KcX++3SDBVZeWAqFx1MDAwMXtfXc4rRFx1MDAxOfzYv3N7nYNcbn+Kb9OCulx1MDAxM/s8jetRVeTNQ/lcXFdcZk9cIsVGfthGyjz+W59cdTAwMGLRqrlcdTAwMDIkvu2x11Pcx9LTXHUwMDFi8Uavt3JcdTAwMGZg+yqdnrfy+F2PU0ufyVt+/52lO/A/XHUwMDFjy1x1MDAxZoqCIShHhGPrqTKyXHTt8Fx1MDAxZUJ2x1x1MDAwMTKytkrHsaku9Fx1MDAwM+3F7Vx1MDAxY7fPIDQ0PdqdUep2XoqsN3UljbQ94nhcdTAwMWSJVaq2IKyOe1x1MDAxNlx1MDAxZkegXHUwMDEwa0Tljj7b0FA5b+nxuaU7X8uqXHIoLuvkotKD6stzR1x1MDAxMs+TiylQ2ftcdTAwMDSLt/HgPNOaZT5K+ozFu80rXHUwMDA2xFwiXHUwMDE1NIVdglx1MDAwMJZZPvJSXHUwMDFk3Y2P/O/n3CP4WjyIXHUwMDA0KCfvSehA8r1cdTAwMDfTXHUwMDBl6cp4u3+5XGKl7/ug9IhcdTAwMTQwZnT+6PmNI6ItwoH4XGK7XG6N9Vx1MDAwYo4ggVxcYmY8Z09cdTAwMGX+XHUwMDAyXHUwMDEzRFxuaZ+L5ZZY9qZJ8F1ejVx1MDAxMr6lznTCl3mIyt/Sk+1GceMoXHUwMDBi4fCkjrNq/stPMvRcdTAwMTVfr++nXHUwMDEz0Kyshzid/TaTtk26JTxT1J5oJNKgOty+vcMnXHUwMDE5XHUwMDFjxbhcdTAwMTfC8ir9uqFF/Fx1MDAxOLvGPzHE+qxvVilFoVx1MDAwZUhQuN9ImFd2JTN7vCaSfjlcdTAwMDfp1lx1MDAxNDBcdPfOhGboUjN+u9zrTVx1MDAwNCB+xFx1MDAwMqw9Wtze4WrU+UW7kMJCXHUwMDBmmb6CckTqIyF/3PjuXHUwMDExMJlLo6ZcdTAwMWLs/nqlR/5UgLvs76TtXHUwMDAyuqaB/HXNkfUp13zkYfA5XHUwMDE5XHUwMDFiO6KrZlx1MDAwYvYvh2ReX9HaTpJcYq2dXZ1C/f29Qf1cdTAwMWP+9vh/ZFx1MDAwYrL7MoLZJExaXCJccqFcZof3TVx1MDAwNlx1MDAxMvyGUVx1MDAxYuU94GNXUY2/3NA9XHUwMDExRWtcdTAwMTbqI1x1MDAxY2F/kJy7L/6onXlkulCUXHUwMDE4UkM2XHUwMDBmXGKlwLZcdTAwMGWM7LZpyqAjUs9hhTeEmUXcpVx1MDAxNvg5XHUwMDAzurzUQ5+kR7ZcdTAwMGa2gj57/IizLYncXHUwMDFhXHUwMDAzKfQ4Ldk1S8pW3Fx1MDAwYrvVpbTeXHUwMDE5+7pcdTAwMTVG/rJno11ETFpmuDKEXHUwMDA0pkhcdTAwMTXqSWz90D6vVH6OXHUwMDE2nWPObM08JmDyaFx1MDAxMlx1MDAwNIPbyaVTXHTIRIjM786dvyxcdTAwMTmLe1x1MDAxZlx1MDAxZr9ItYE8VyNcdTAwMWbyUqXWXHUwMDFhUVGdpNY8xts6V2XBt1hCrzlcdTAwMWOdbZW8XG5wXHUwMDBmmImhXXI62X5C0vdYQL2IqT7ykoOLq1x1MDAwN1x1MDAwYueQoFOgUctn7Pe3QLONL+GMUXe/XHUwMDE2XHUwMDE1miyQXFxcdTAwMTc4XHUwMDE4+qGmKHe+Zmd2J1xilLNIu1dNXHUwMDExq85cdTAwMGWZO8/EXVxi6FeP1+r7XHUwMDBiXHUwMDA0XHUwMDEyQdCWj5ySJPpcdTAwMWJej2p+VjXLhYya6NC5XHUwMDE05nbH6b+8JCys75xcdTAwMDFcdFPJ+Fx1MDAwNeHnrFR/qjbIXHUwMDBlL7pcdTAwMTJWXHUwMDE504Op2Pnn54BE1Vx1MDAxM0z0/H02LiBcdTAwMWTTXHUwMDAznMbtb03V/dt7ToVcdTAwMDT/f97XXHUwMDEzYVx1MDAwYnVcdTAwMDbNXHUwMDA3eZFMjrbR3zHqIVxiOvHf2pLU51x1MDAwMU1g5Gw+npDK6EjbyibokZ5r3r67ro5cdTAwMDFSKVx1MDAwM1xiXHUwMDE1PLHP8qmBhS9yqyimXHUwMDFk6CSsi1x1MDAxOPrBlu5AKZ+qrcTWfoq0gXE0UOfoVkjXk1C+e0fRXHTFe/LOQcw5Slx1MDAwZiy6XHUwMDBmV93T0Vx1MDAxN2g62oFcdTAwMTBcdTAwMDXU5Vx1MDAxYXZJnF2OjZdcYuDf5L68gaiU8etcdTAwMThcdTAwMDJTgsSMtyr1XHUwMDA0hCuFz1tcdTAwMWQx5y87plx1MDAxMJjRuSxLI9n34pnXfstcdTAwMWN03e4sx1x1MDAwN1x1MDAxYset+O6UXHUwMDFmLmbv6tOfrXMgf3FiflxyJtJj1CFSOZlha5eJMzUruFx1MDAxYieEcmVcZo8rZbGri36l2tnZUyy5s6Sugfh4aZOeQ1xy5/CcyLP05CDNxeGd61ntzb235jR2SNNrZaddidFcZiqLj3y7RDyd5rrMMfwjjvy96zlP8Fx1MDAxMkDW5clnwPndzf7x7L+9UGVAoVTtU6B4PD5QUvaifD3u7ytDXa9YXHUwMDA0XHUwMDBmtE37eIth8mzEmVY93rZcIlx1MDAxNVx0NFLp/q3neVxiXHUwMDE0S1x1MDAxOVx1MDAwYrwxXHUwMDFk0lx1MDAxNZVcdTAwMTFcdTAwMGLdK1x1MDAxMWghdc21eTPr9lx1MDAxNSV5iO9ccrRhm9or/OlcdTAwMGZveZI8XHLQks2J6fEzoERcdTAwMTOLZdiBuCztkSpcdTAwMWF8P1x1MDAxN1x1MDAwN1x1MDAxYrf5XGJxnaeIQWrevpLmiStdg3fXP2bCnDn1P/dcdTAwMTXIiPFcdTAwMDM8Z0JcdTAwMGbokuGga/ztXHUwMDEzXHUwMDFl9K7Qs1RcdTAwMTj0S+mrLo/6XHUwMDE1qlwipYnKd7TayVxmQ+mk5v7NKfGXTUaLXGJcdTAwMWNePqtcdTAwMWRA/7vsdiRjUlx1MDAxNnhyI1x1MDAwYlx1MDAxYb3LbiDdXHUwMDFh2Ikr+PI2/3oxOH1QXHUwMDAyWk5UR53V+jdPXHUwMDAwprDvXHUwMDA0XHUwMDEy0HomdFwihVx1MDAxYX3G/uVbvD25ZoKHdU+JQZr9/er2zsh0MaxDXHUwMDFkRJhDkFBgfIGCuZeA5I0nY/Vp81x1MDAxNzAwXHUwMDFj+VxmbmKiQNfZ6OOonTh6MZt7qMy5vOt3KWRsu+io5Vx1MDAwMUQv1vxcdTAwMWKR/LPpTIa6bfd6nUFX/V5F9ih/L7BBW1x1MDAxMlx1MDAxZsAgZlp7UFCLPzy1Jlx1MDAxMNibymlcdFx1MDAxOJ/9XHUwMDAyXVx1MDAxM5sjs1J1qlx1MDAxNCO0KugjSMOnXHUwMDEy85Jxw98y3iiEV6FcdTAwMDDl6YJcdTAwMTivQPOQK+NcdTAwMTaplYH6ePKoxjr5fuG1+necncLR1jc3Z1x1MDAwMZ9r6cPDumG7ZGqyXHUwMDExrUqOpM9pxlx1MDAwZkd4pT95rCCk6+T30+DCWctRq/v+6lx1MDAwNPmz7USnXHUwMDAwuqfUy1x1MDAwYqhbhfEpv1x0PC46L8ncYkehjlx1MDAxNt5cIt/pwebBK6uIXHUwMDBl/m7oXGLdbzdY7fvymk+jtXPM+/dcdTAwMTeISWfOxVhcctWE/N/56l5cdTAwMDdcIj6CtCAvKuZcZsJSSI4lXHUwMDAzMVx1MDAwMstcdTAwMDH6XHUwMDFlRFwiXHUwMDAxZUjdKq4u0p66YaPLz8I7eyvRX4bTvj5cdTAwMTJcdNBdzWywXlBwZFxi9zQhVVximfrVhlKS95doqfyjLK7jQSpQt1xudZZcdTAwMTDBS5WPXHUwMDE5SW2W5ZXdyOJccsONc06M8vReq8bX/NU2qVa3XHUwMDEzXG58abeA6ze3znHym0TaW0tcXJdcZlx1MDAxZW80N6F3/75P62XjNbNcdTAwMTPCXHUwMDE0wlx1MDAwMqBcdTAwMWXT7k+eKolppSaCiuNOXHL4eklcdTAwMTj+5W87P4VPIPpypVx1MDAwYotdQSGxq1x1MDAxN+nZxNxU46w9yH5+P8Q9umdcdTAwMTFTN8jxiNc5cvLBU1bi0X/POONccmVcdTAwMDSHXHUwMDE0XHUwMDAwYFx1MDAxMp+GZlCupF8uuFZoKP2t7NPg9y2QM/6JQpsqK+Q0f4pCxMTDf146XG71e/l8cn87t2nvZLeP9C9cdTAwMTeiTZiH+O5cdTAwMWJKXHUwMDE0RFx1MDAxZIJqflV/XHUwMDExTzJ/bqBpgFPwrfbqVI+WmGeBXHUwMDA0wD3qyDS0oTfR+qlcImxGUacncKXx08iGV4Xd2Vx1MDAwMfchOS5e/zQ31r2L5XGm3oyLP7wvXHUwMDEwiuaP2F9qXHUwMDAzkUKx0Vx1MDAxYmE4XHUwMDA26mxqclK/py3FoFx1MDAxMFpcIlx1MDAxN91OIbNOLVx1MDAxOYOR8G/dXHUwMDAzUuRcdTAwMTCGeYr3UoGJTVxiR1winWay7nZxXHUwMDFlas3BP2I0P8K/XFz3vHiEpUxWiMNa72hedk+molxy0u7qhr932H9cYrlbm3SuiVxyp2RcdTAwMDJFqWKjeKvaXFxidaYyc56QaLVWesQh/aNcdTAwMWHqf+29+Vx1MDAxZn/bz0CQRsFcdTAwMTWAULvnOHmdp1x1MDAxZdl35lxyPjblS1ZqIbKxSfE9pOI3Qs48JryWtPb/zlxi63Pd9shPt0I2M6Vx5iGWxD95I8rDhFwi+1x1MDAwNZRaXHUwMDAzsPdGcdL9rXL9jaAyXHUwMDAzjVx1MDAwMVx1MDAwZWpI+y//tzJ0snvvQFx1MDAxNf52rivzX3bfV01plIDj7Kar1OnkXHUwMDAzz4hcdTAwMGXXXHUwMDE0OWahfVx1MDAwMJNKusxrQYRNTVxij8SIIVrnLVx1MDAwNrJcdTAwMWT95VxcXHUwMDFkXHUwMDA2+1xy+FqMYbeqXHUwMDE0dYl7N2OGa407c0Bccvn0Wu+lP8rP65p/4ki5XCL9WZVcdTAwMWbXdMKGXHUwMDAwXHUwMDAxo0iAWFx1MDAwMuxcdTAwMWZT7DJcdTAwMDdcdTAwMDO2Lm8vv+plKOJcdTAwMWHM88+dbi6o86RNy9jptiiUYJzTR89cdTAwMTjqJWNcdTAwMTSTmb0kTXxL/rXzR/i1UVx1MDAxYbTM517WXHUwMDAx3PB9OKz5QsgqTIZlulx1MDAwZlbyuHM3SvfCo8N588a73Coy83bacfVk7mftXHUwMDA0dqlaPKdcdTAwMTSEoEhcdTAwMDP+OEJtXHUwMDBlXCLgXHUwMDEz387NRNpcdTAwMDLSymy7dlxilZCvwFx1MDAxMMhfXGK5seA1gHy5ZJHiY55fbuFhledW8vO32atcdTAwMTP5zYeF0uxUbNB61lx1MDAxOYBcdTAwMTZcbjqOZ1g0b/bR44vnsv9XTtTQw3pcdTAwMDFuoFx1MDAwMVxitVx1MDAxMF5pyEWamJj9XHUwMDE3/Djh66qCPVx1MDAwNDJDYlx1MDAxM0pp527xXHUwMDE4XHUwMDA2XHUwMDAw5qdcIjtcdTAwMTA8uC5LgLpcYqF63XL/PVfrXHUwMDA3yG7V+lx1MDAxN0WHcnnI97fsUFx1MDAxYyMkLFGPplx1MDAxYsk95tOAXHUwMDFi2JL7uFx1MDAxNtJcdPRcXHNi74kz8aZnz6ux4/NhnXZZ6L2hptbeXHUwMDFlSDPWPPGXNeSLX1xigWiwrozcvZtcdTAwMWS84Pu/QzFcdTAwMTbJV1x1MDAwM49ZKCRO6iNhyVx1MDAxYnOHVs1r4r5cXCb0XFyKTNtjM2Kybuh1jz98peTepfdcdTAwMWQgUEEyeOO5ddnV8Sapw3wg5nW3nE2VzpvEqFx1MDAwZoVcdTAwMDM/WPGswVx1MDAxM/j+acR5hyqvsf/LpFx1MDAxMjRcdTAwMTGfoCM47fnBdevzKUCf/jFcdTAwMTkrelx1MDAwYrNcdTAwMTenRv63TI5cdTAwMWSKIZo9u4xcdTAwMTlw5+34m13s39qQXHUwMDEz6lx1MDAxMu2yXHUwMDAx/+NudYCXvObIjdYkrKFH2mVQaFxujH/9QPyXv6HDcn5E0iytXHUwMDE1Zlx1MDAxNSf0vU1OXG5cIjR2T8Pbu1x1MDAxNfnL2j21uSCH0d9cbiDO6KvD64Jfv8D+lrr3XFy+XGaG0sRexSdcdTAwMDXgXHUwMDAwUPKN0uQnXCJcdTAwMGYxcVxc9MhZZPiJxfBcdTAwMDUvi56NtZjYof7PvX1R9u0+0P9cdTAwMGJcdTAwMWMoXGLm/Lon+itC761UV41QXHUwMDA2fspcdTAwMWVWvFxc/0A5zNlhbVOCl0VnLCVcdTAwMWXfiG61zLK+Slx1MDAxOFR90Efaev5M9H+ZXHUwMDA0XHInzOUrhlxiXHUwMDFleUidnqeKSTPwXFw7pUtycMwzNDrTm3eCRuhcdTAwMGXR7p5ugVD4hLi+pEj74ud8+VJ1/Vxc1YJcdTAwMGVcdTAwMDBgQjl/u5LKnjRF0F9X51xuhqa/Sn/e/Y20dfhFOKF9jtJGXHUwMDAw+tNcdTAwMTBcdTAwMDPf8IYgspaZvij/4elcdTAwMGVcdTAwMTRErkcz8kf8W+u3XHUwMDA3ND6p4ZO3XHUwMDE3WIOTWuOW2jO8XHUwMDE26Nhw/GYkoDxUmO68PJPXppgg8igg4e1MhXPU8bZSg+hMpX/Pbv5cdTAwMTad/23HScY+M6fwtY03IeAxoNGeXHUwMDAxXHUwMDFiX1x1MDAxYcCmR0Ej6X1cdTAwMDB2XHUwMDA3PfvGt1x1MDAxY8T7v3N/zKCw3VxuclxiTzdA/44sd7vaXHUwMDE5g4YleDpowGehNdVcdTAwMTYj6tezZY7M6lx1MDAwM2Qv9JVkmkfRWKLGrT9IxIxcIn5Dy83DQ4JUU+NYlCFb8KiPheL1XHUwMDE19VxmWU+qrHeGfzJcdTAwMTRcdTAwMTn7XG747F2hVLK/x03YYN1/rk/lz+hcdTAwMGJysN930Ebszm/iUFx1MDAwNr0x6ayEifEsXzp4cLysqk//XHUwMDE31WcvXHUwMDBlnfrTVO7voClLXHS/qMBE4C/TVXy90cpcdTAwMDObSIlO90lcXJFcdTAwMWNuXHLabo5cdTAwMWI70SPK/tb7qFeN06KVLLNnJ6TPOHuttmU8sbzwXGZI93V1R01cdTAwMDbowemYXHUwMDE1bU5qd2GzXHUwMDA1rbxOjFx1MDAwMVx1MDAxZIckXHUwMDE0XCJcdTAwMDUl1iSA8vF1Y6bFyM1Pxs1cdTAwMDahJ/7uvVx1MDAxM1winpBIoICmXHUwMDE3eKn1wU23v5icrVdmd0ZhxUb2wW1cdJpzsWxub8x6XHUwMDFhXHUwMDFjK3SdUp1AyNnfiCaT6FmupcFunFx0m1x1MDAwNPKolpXQh+Z/OaFY1Kmb2DFWXHUwMDBlrIWHOnVcYrmnI57A9NIzVlxuUGLO+95ZyFx1MDAwN/Y9/0mcf3tccrfjrE3t2Sm3J23LUz1m0qW4Qse+Ta9cdTAwMTJG7kHluVT8eU+nyk1NLfNaK9h/aZhcXPd+XHUwMDBi2Ft/JMZnOFxmjDDLVHozxtvBWVx1MDAwMS2+buf93T+LXHTBJaP24XVcdTAwMTOaoVfjip+6fv7YgGFZaUtJV0x4hUF09lx1MDAwYp6HvFbGnvRltUyzW3nB/85d+suQXHUwMDEzOFx1MDAxOXSgMGBcdTAwMWJ90SNS1fXN52zNkpZcbpRQ5l5JXHUwMDFjXCIgX1x1MDAxOKKf9dxcdTAwMDPmrLyQqXixu3ZFvVxim8Q6taedXHUwMDA1tF37/SpYJLfNxjjJ4OPdc/Fj+KYgRWSqmVx1MDAxYdGPYNBIXHUwMDE08qOJmZzQL3HkzHRcdTAwMGKxXHUwMDEyyI+sJXdcdTAwMDHc3JmojzfVflr03enHmUAzqlY9+r5vNrQpYoV4bOe9KVx1MDAxYV9cdTAwMWH5OJvBubDe5E6e71O2leb5oKPGsL5Q+5F9jHOLj1x1MDAxZt7HXHUwMDEwxpBcIm7ask5cdTAwMTat7dPaXHTvW/7S6PlytP3C5t/da3GXPFZWOTBcdTAwMGVyIeTVoXFdP1T1jjd2VZjx93ZcdTAwMGXUwqWuSlvCUHRcdTAwMDOlnpm1pKy77Cd0aqy5Mt9fXHUwMDBl6KZ0ulxmXHUwMDAwqDWCyOdjcdZma+SXUFx1MDAxMmooZtHunsmVozDtbUibiTrhnW6XyJOePOtl25qROeeRQIj5atE2j39cdTAwMWWWfz5cdTAwMDOksstcdTAwMGaic6FOasC2rVkxNq+3gUuR38Z0cZbwf2/2vGdcdTAwMTXVLFrGNf3x6T5Fp5GR7/eu+CBcdTAwMTBN/dLw3+lcdTAwMTTLP2mk7s8vXHUwMDEwXHUwMDA1XHUwMDA1wXPoOVL1XHUwMDE5SbSPM9SqOVx1MDAxYlY6/nZFtcNo+OvJ3Fx1MDAwNX7pVFx1MDAwNEAyRU/HoKt6mJPogprjLp9jue8n7V09XCLufzNlXHUwMDE1Xae9LlxmOX831OonM2JcdTAwMTl7XHUwMDAzhnaV3Fneunx/XCJyblFngZOCopK/YUE+XGY19EVcZqtcdTAwMWFihlxi9YElSlU0ylwiizDKWlxy/LlS6Vx1MDAxYlx1MDAxOXe7WlSVI7Mqndtsskvlad/pkzuJnFx1MDAwNPxcdTAwMTd/Lk/RUtpiQsw57lx1MDAxY6NIpXaz8oxcdTAwMTjUJ6sqSkRccjNcdTAwMDXVVnVcdTAwMTPTTDos6t9txeLEY3bUTd22q+ZcdTAwMWFcdTAwMTRQ3zj9JVx1MDAxZdFcdTAwMWUtokOjXHUwMDEzXHUwMDE41tmG4pON/MOeXZP/XHUwMDAxjslXz0JcdTAwMGYlcq6ZMsh5RVx1MDAxM1Jy9DOPP8lcdTAwMTS3XHUwMDFiM2NNXHUwMDEyNf+1L/tvz/1cdTAwMDBMXHUwMDBisMcuSb9cdTAwMGIomXiR1Fx1MDAwM2LaPVx1MDAwN6M0a5s6JsqZeH99xv4gXGLqZmHxX+9Cqs22QvE9KCWWK/OSVlwi35yeXFyLo4DuaTWhx0JcdTAwMGK3XGbBV0FEpdNn62jBaPmehEKXUqdcdTAwMTmKJUIhLEw5K3IkXHUwMDFjuPaM8XvxXGLRM+JpZY5n+Izdm9Jzu+cmXHUwMDFm2NS3d1x1MDAxMvOzpcPbb9hlft6AXHUwMDE211x1MDAwNSRQrMeeXHUwMDEw3UrwU7Om08tP/03VOVx1MDAxNJaH/qitP8Xjs4Inouf5RVx1MDAxN/BcdTAwMDVcdTAwMWbqXHUwMDFkRjpS//mZ+3o2T1x1MDAxZN+EPNBE51hcdTAwMTL3XHUwMDE0ONadUlZXXHUwMDE3XGJOP544fdXi+oI7oNjlUSeNIL1ArW1je+eQ7Fx1MDAwZoj/gJfjIcKO4GicPF5Ugmjbm3zu68XWfHKrXHUwMDFjxpclkX//stVPXHUwMDAzhT+MuDZcdTAwMTY42MlcdTAwMDeERlx1MDAxNlxiYoF6eiq4TFx1MDAwZU/olbxcZjJ7t+evvCrEXHUwMDAwitP0WTvSi+izXVx1MDAwNZRLTl8vWVx1MDAwZaqq5Fx1MDAxZvpGP+jj42Sa+nqPKEq0pFf6qHvV4HvOh8hPS5Ao6LdcdTAwMTH6nEBkWCr71dbH7unQXHUwMDBltn2Aclx1MDAxNlx1MDAxMFx1MDAxN17ENqWSoHdZO+6/tVx1MDAxYt59NCDjpDtaO7hnXHUwMDAzeo1j+/lpmFx1MDAwMvPs9V+ae5HWeFx1MDAwZVxyXGZMqjnfPWuoWlspXHUwMDAz/JxcdTAwMWM4e18tP0YnKNZcdTAwMWEx9WXxU2G9XHUwMDFjXHUwMDE0Z1x1MDAwNFLB5EfU66CaXHUwMDA1ab9oLXRfwz1XKyjkyLW1XHUwMDE2yUl68Vx1MDAwM1TflDtcdTAwMDZPe31cdTAwMGI/Z7l/lLiwaGZoL7v7vDdkXHUwMDA30zOSXHUwMDA1Kveh38X/5sru6KE/n2ZcZkuXoKL8VDWu+nsmn5GPy3MqaFxuneq54GRRfT6EMVG/R4uA34GugNCprzdcdTAwMTNKUCClZVx1MDAxMJ+4T0R4zU5OlFxiaEykXVx1MDAxZfxPoVmk7rXNUcA6TZ5cdTAwMWF6O9RKgMeQLEtSNXedj1x1MDAxNf5tXHUwMDFllTtcdTAwMDF7zpr4b013XHUwMDAwXHUwMDE1mEmQUFx1MDAxOSxnc2LMtO1cdTAwMTKRXHUwMDEz42eNKqX7tpCyXHUwMDFlUkXRob+7x4ahXHUwMDE2+5Eo1f58+W/ypJ1T3GXLqudcdTAwMTdUXm/gOcNcdTAwMTlBTY+fUY+TpHenoCQusb06LuHO+5eGVbOvv/j5I6RixY+TJyepXHUwMDBln8y1Uz/SYyt+SZPXXHUwMDE5WOT9XHUwMDFj44GCPoFKUFwi+5c724xs1lx1MDAxOP3tqTnh2X5kPCm9nyWj5HxcdTAwMDZtXHUwMDFjJs2/azrQdDFUbGVXkK9Bq2aKSsNLQEW5UmtBXHUwMDExZtSwi1sqi3GFpMJ+ofb55KJcdTAwMDWbQsvMbH89XHUwMDFlP+vEbbtRw5jmhjiPgSWHU+iL19/jk7zbXHUwMDAwXHUwMDE2RUP5wsFhLjhqo023tlx1MDAwN/Zz2/jMO1x1MDAxYmxpI21cbkCYaVx1MDAxNlx1MDAxYf9OW3f4XHUwMDA1X/VHXHUwMDE2eVc4X1xc/1x1MDAxOCc2TCzkm1x1MDAxOFx1MDAxNy1aKCtk4tK5clx1MDAxY+9h5Yto5ihcdTAwMTXH47Rp/yd7W57/Z/9cdTAwMTQx+IPrLs1vN1x1MDAwNuOHVaSLtltcdTAwMDc9IzKdh+l3k+lDXHLmS6t8VUCfnff6gMZbNy5cdTAwMDek+ynQ7t6m2kh4p4y5glx1MDAwMcpJhHZXQ2OCXHUwMDA1U9owe5dcYqW8zIvoZKaQ8bVGlFx1MDAxZFx1MDAxML3T65ziQH21amNV1v2/KVx1MDAwN8+sXHUwMDA0tcHJvJrHVk2dXFy9pz5G+1x1MDAxNEWfanZtz1Z5ceaNxzz5k12uwFxy25j9XHUwMDFkvfVcZjVQmvtkh4H6yLMtXHUwMDEzq6ODjTzKPFwixPpdtVx1MDAwMjNOl6ONQVx1MDAxM1x1MDAwNOBcdTAwMWXXVIz4RVx1MDAwMtRsni7dJNeG386q3d2sr09n6DrnPpXNXGJcZkHjXHUwMDA2aFwi8Zv9gOWQpFx1MDAxNCR905tAj/dcdTAwMGZcdTAwMDBcdTAwMTJ/KJ9cdTAwMTEgX2Yh4PX8ZnHvLOZcdTAwMTl2PbBvQ/Aw5X5VxWD8j16xnFx1MDAxN1x1MDAxMPZcdTAwMWHt41x1MDAxZlPIXHUwMDAxuvU+hoAy31x1MDAwNqk+XHUwMDFiq6qp4DJB6oWmfMhkMjst4dp+Mlx1MDAxODqq2ChTXHUwMDE1XHUwMDBls4WFXFzq0yg/JT5yUrTUXHUwMDFkzUve8CNfXHUwMDFm1GYzRqijV/jhXHUwMDFk/cWhKUJcdTAwMWPp3/xzwYlcdTAwMDTb0lx1MDAxNbrQs6msfTu76Oe5gSpcdTAwMGWl2ZKTnyOvXHUwMDFlhmWKkr5YXHUwMDA3K1x1MDAxN9YgQ5JcdTAwMTDMlpt4j8oqvzPcKlEu3C/sisP2gvvPPe9dM4FnxGM2o8Ghof9lX0x58tyTSKFuwj3tXHUwMDAyvJ/HevApuNKsRN4kXHUwMDE3c62X75tcdTAwMDaN7ktcIvnZQp++N8hcdTAwMDBdevpHfn2Vxz5cdTAwMDWYfkAqqDr5XGZjdmZTsakk2D2pJPzYYMNed4Dq/2G3alx1MDAwZlx1MDAxZfTDSy0qPSpVmlx1MDAxNpIyokrsp1MoteKgK9LxXHUwMDFhccwxQsWHXHUwMDAzJdjxoGixRX/Iu6wqaL1DfSNtiZf/KW3QzSt1XHUwMDBlM181t69cdTAwMTifbIewnVdcdTAwMDFCXSjTXqpcdTAwMGaZ31x1MDAxZvAusp/6msGO4Fc7v+3H5YMvXHUwMDE5ac9cdTAwMTfOKUZCPERP3J9cdTAwMTk0KtHRPlx1MDAwN/B4/e2y/7BcdTAwMGbDXHUwMDFhpNjpKbf4y71cdTAwMWFcdFe9c0Z5lDXHg0JkqnqP0OhZgzJcYjxO23NJJLBcdTAwMDUj/7LmZ4+Z939cdTAwMDZcXNlcdTAwMDGxeNZXXHUwMDE0gVx1MDAxYlx1MDAwMlx1MDAwNKPQRPPRULLPKc5kkS+A+fnlNMK/wabSzeNMf1i+U7tcdTAwMDSS1fFXV0CXY7TeXHUwMDFmTSfcY/xcdTAwMTFnwK7oNGls0rdcdTAwMTIpXHUwMDE1uVx1MDAwNy9OfGYmRTTX1E6/SHpgXHUwMDE47WagbkXNg9jJfIYnLqlcdTAwMWL8rVxc9Fx1MDAxMLmQ7vkrjTDF6j7G+DPIU+igllOfyVdcdTAwMTG8ukU/dYwr7Vx1MDAwN1xuXG5fWlxm2ip1r1x1MDAxYf8rZ1x1MDAxNOKUh1xyPP2XIy5cdTAwMWS66PT8oVxyTVx1MDAxNFht2jSbXHUwMDA0fvzEaXzayFx1MDAwMp9nODbu4NOJjJGZz/TB8nlcdTAwMDRHza9BSlj658OdXCKfIZ7H0+E5XHUwMDAwe1xigDlsROtcdTAwMDHsyLtrI4ZeZmVcdTAwMWXFXGJcdTAwMTIvitUnP0NcdTAwMDZeLFW8XHUwMDFmiPtA/rz9XHUwMDE3p0zsXHUwMDBlxubeLoq9IefUuTpcdTAwMGJv0VxyYGtcdTAwMDRndl6EpyFcdTAwMDKRRmDDTkqIXHUwMDExtFx1MDAwNCXCIZ+WfKApejFEOo1X+aRuV1xcSoeTnWUvMn47jMG7vcPa7D5ub+y1U1x1MDAxMjL/MvpcdTAwMDN4hPqw6Scguvbm6YU8tVxi3Fx1MDAxMCe0Ylx1MDAxYzHDo1x1MDAwNmWrMVx1MDAwMVx1MDAxN1x1MDAxZYJsQsGuz2Jkp9Vtd05cdTAwMDb26Z1cdTAwMDG8+0EnXGZqszF8+ceP21qCv/lcdTAwMTVN2Nm12G2Sx7tcdTAwMGXQOab7PzKNY3U6Sf8hXHUwMDE1vFxuOUKEUu/6Pe6Tn/Xa5yFKaGHQddrnY68zXHUwMDBmzfT7O/GAPf9yu8RS5YFbu1x1MDAwZb1hRktcdTAwMWRxzVx0Z+VcdTAwMDJcdTAwMWWa/kc+8ELvsrube7YsXHUwMDFi7iyBoivjQ46qWyFcdTAwMWXXreW6XHUwMDFktk9lfaVenZVcdTAwMDdBzLa4To9ZcKbTXHUwMDBlPzU9uWZcdTAwMWZSlME+xPVQibnrxFx1MDAxMHU4XHUwMDFhUqDoOO6Jsst7pJuDNbxcdTAwMWQ9jlx1MDAxNJc86qNcdTAwMTjFd2C7l43T6rB7QV+39ML4pWhTXHUwMDE0LeRcdTAwMTh+XHUwMDE3UvpcdTAwMWNcdTAwMDLDnLT2P5/1/8vvgNw687aJXHUwMDFkXHUwMDA2SZqzdmzyS1x1MDAxYWwjguBebJo3dOxcdTAwMDP9vMSF/Etk/Jun41H/udCiXHUwMDFkfVx1MDAwMVx1MDAwMZpn8SSb/ejCUJBcdTAwMDC6+frBXHUwMDA02l/Ue3j1P765OEZJOIKLeDfSqevTXGZcdTAwMDH6rqpcdTAwMDctfkRHT1x1MDAxZjxcdTAwMDd7XHUwMDE5cZxnYWQ5XHUwMDAw+5NOU9uK/tastlx1MDAxMFdcdTAwMDVqKVx1MDAxYcBvtU9cdTAwMDBcdTAwMTnFQLM6JeJ+KzzvmatcdTAwMGLZ0kpNxHqoXHKrXHUwMDA0Vc4wRiBo8c83UNtcdTAwMTElNzxa6HvJ7mD/XHUwMDE41HKUQsJcdTAwMDSxvVmKjn1wI/5JpO8pq8icJIVGXHUwMDFkXHUwMDA1/YVldeDxdaOest7ZMoQgy3lYb/lJXHUwMDEzXjh0JFx1MDAwMXjOfZOIXHUwMDFl6LvjTjeuLsRRiGBcdTAwMTRUKnyog4iZjPeXz1x1MDAwNvDM76zkVUOj4Vx1MDAxNHBAqpD/MIEgicmM2ZLH275cdTAwMTlcdTAwMDbC94tcXCfXl5nvvlx1MDAxN7X/m1O9+u8rzSq+sKpcdTAwMDC4X6b6cVL0sMJjXHUwMDFjQbKkZ/c4JrJcdTAwMTLVXHUwMDFkVTmKq/pcdTAwMDdxatb8Te7bdC+CXCL5jkxDt11++XScrKl0lST0fkh8YFx1MDAxM5S1bb6q73JcdTAwMDRcdTAwMTVcdTAwMTA6VNzxXCKBoGbt3/7x3p7b455cZlx1MDAxMVx1MDAxYv/LV0ZZXHUwMDA3NJHnXHUwMDA0mS214KykXHUwMDFltH9HLJVcdTAwMDSWSfSsv78kbin/vCtTXHUwMDFlXHUwMDAxJr+s2Vx1MDAxNDGqKKzfg/pcdTAwMTiJuzGjU4iYvjpk19nMXHUwMDAy9u5ZNX+Zqup29yGmm48uXHUwMDAwoCbWcFx1MDAxMWnBhIJTki58Vsb4XGZAjYnlt56/rCf+i2lB3FRgY80/XHLgflxixMlfXHUwMDEza8c5hVx1MDAwYp9cbkE6uUJxsG7y3Fx1MDAxYb6kXG6tIVx1MDAxYllcdTAwMTLt5Fx1MDAxM7eSQPpcdMngtezpXHUwMDBi57CeQp7aOcd9kvRcdTAwMDUlcVx1MDAwMmS7x/j+5M5kXCLpMlx1MDAxNOcmpDsj6qGJbsNQwv7l94FcdTAwMTK3X89cZlHvsvNUnuOZ1eFcdTAwMDOh4OVcdTAwMDZh2inEflDXWM79b36D+Te/kYDsfkJz6VJL4lGKf8LLoFfxvUA99dxcdTAwMTBgPDLEUTeW4Vx1MDAxN+6UWZJ+xX95vH4j8z05+/LaXHUwMDAwVljPWYpYdFx1MDAxYlx1MDAxY9LC8ltL3j5cdTAwMDVcdTAwMDDmXHUwMDA0yGdstKtcdTAwMGalUviA7ypYb5rHqs/6WYWPXHUwMDEzusGhUkI7dp//1MVcdTAwMWI/81x1MDAwNfySwc9sXHUwMDEy+H/PTmgpb1fWgG6w6Vx1MDAxOO1hz7hcdTAwMGZG7P1Xv1x1MDAwZdiExX7zTHLOhYVcYpGpIVx1MDAxYi9rZcXN3zv5jtbx1MPQuqisf3Mq8+v6d0Nwi0ueb5pcdTAwMTk0npZjsrhgXcusssHxlFx1MDAwM1xukKeE7VlcdTAwMTW9PbW+r/3JkPBGelwiZ15Hc5nVPmWP5X7O/vBouM5ucGY2dvWcyVhcdC3r6mlJ+jtcdTAwMWX8lkFi9W3OLOVKXHUwMDFlqtD8pFx1MDAxM0RnJ23a307f9Vx1MDAxNTi0/HXq81HcXHUwMDA2YrnSjDuvnZnBjpQ8XHUwMDA2/WOZXGaw1lc+mu/u35qAud9C8O5TcS07+EP+5fZ8XHUwMDEw51thjEx+2zRz4qOnISB28dt//lx1MDAxNuHZR3/72USaPHnC8/5cdTAwMWVU9XSeI7byd0+n+0GxTPuOaTkpZnGzXHUwMDBmqLo5dFx1MDAxOSZcXMQuUo+cuVxmXHUwMDBlojH5VudcdTAwMWKPXHUwMDA3/eX9OCHb1dSYjXPG9KBNaFx1MDAxM2Rv2zRRfLyeUWP8ov97VlUg838gKsRx2OxcYqq0x1enNyuiX4pcdTAwMDR1KjYjS0bBa8FcdTAwMWa6p3lcblafyVx1MDAxMzamXHSS4Vu/yo+fyID7LLRtXHUwMDA2SqtsXHUwMDFjMH0y91x1MDAxYmJJucH7+uD3MySu/GLdXHUwMDAzkVbg2mFhd/XOTJJ/t2/RXG5R9JBcdTAwMWZcdTAwMThcdTAwMDDIQpkmqz1yXHUwMDAyK0T6XCIlf0VcdTAwMTB+KNpuyE7k7eycxNF9IVx1MDAxOL02f9xtXHUwMDAyL3NEcN1fgrkrXHUwMDEwpdH7bnuMMuY9bJtQXHQkti9cdTAwMTKb+oyGXHUwMDA1L/tcdTAwMDKLXGJccpR8XHUwMDA03bJxdKSULIjjXHUwMDFj+YGF7EGTTOYnts6KIP3onsPv5X7QU5NdaNc556B+9Fx1MDAxOGS472F9+XO7XCJcdTAwMGLmyUenX/moIb8/XHUwMDAzSlxiXFyc8zuxOGtcdTAwMWTqcXk751x1MDAwMZLFV25+ZFVAq6j1xSBcdTAwMGIyhlDjwOFHXHUwMDBiRe9cdTAwMTCLt59ZQStcdTAwMTbs0Lv0VXJcIktDoVx1MDAwNcf1tflvXHUwMDE0r7/OQXxcdTAwMTCzNnV99qjZkCGPKVvFyNNccpVcdTAwMTZXj4+f8LlcbuF0XHUwMDEy3Zt+0uf3NYm9TYSP/JNcdTAwMDD0UsqL5HLEmvN0fVx0XHUwMDBmXvZMSXic/lM+X31cdTAwMTdLSVx1MDAxZT70RHm1ycLvSfrz/uP8w05cdTAwMGW6Z7d4uLGRqeFcdTAwMDbQXHUwMDE2QG13Z/J0XHUwMDExd3dWZ3Q1ZmTRf6dZK9WHq+OhSVx1MDAxZtBS1Fx1MDAxMVx1MDAxZsZZOex8RovfToeS6yvOJ5CwQ0B12P0/+9Fx4MWsU+lcdTAwMDLDffK5KHNcdTAwMTRkJaTFQKJcdTAwMTVXbP+ghlx1MDAwNug+iZFeU8zLT8FIf/I4KUhN89Q5oXPrXHUwMDEy2+m2zFx1MDAxNlx1MDAxMnbRLkxv1lx1MDAxN4EnNclcdTAwMWaBQD1Qvn+ie/8mR9rH0dVV1HRcdTAwMTi7yrxYWtFcdTAwMDVcdTAwMTWoXGafXHUwMDAxbMGH2KOgQFVTRLavk96UMzqDjn78pEhuParsZUFtiexcdTAwMTMmyWJccj3/i75cdTAwMDJcco7RXHUwMDAztE6t4SxUylx1MDAxYlx1MDAwYjy3smdlXHUwMDFkV1bwTa1sXHUwMDFhcKKpa1x1MDAxNfGbyDti+Fx0cflcdTAwMDVcbklmP3M/Jk9Rt4PkJ/psenffXHUwMDEzjy4/2EOJdujs+/h9c8A1mGklXFxTPVFZRVx1MDAxMi9cdTAwMDM3cee0Y5Bs2d2+XHUwMDFkv0BpbK8vXHUwMDA0vXHoRG+6wlx1MDAxYuJcdTAwMTdtn1x1MDAxYYTcLcFcdTAwMDKBO4hcdMDhV+glW/+tg6qf1Ug67y/2XHUwMDFjm0WdyfVNXHUwMDE2ji6Z6vNcdTAwMWRcdTAwMTdcdTAwMTfHXHUwMDExXHUwMDA0i2jMYrWqXHUwMDE3r1x1MDAxN1qDXHUwMDA05/CiU85iXHUwMDE1hvVhuFZjqXJcdTAwMTWtKizUv2nwJ+91tFx1MDAxM+xUjT7KuUa3XHUwMDFmQ2xPglx1MDAxMS13QIjpXHUwMDA0mNbx8+d1kFhCQPxDXHUwMDFhaPK+sOH8KDG9n5xaXHUwMDA1nUWTUzyKbGp6xcBKwqWqXHUwMDBiIeon3e+fgjjQc/8/+nN2xk5ZXHUwMDAzzsVpaFx1MDAwNVx1MDAxZf+TW3hcdTAwMDLRt4xHa/6Oe9FcdTAwMDSNUVKDoyFcdTAwMWX/PIHtgPN4e9aqiZNs65mwx9y221x1MDAxMFxiM8v5XG6j0FqIlFx1MDAxMWb7l1x1MDAwNf2Yz1x1MDAwN31cdTAwMThjlmy5+Xqr9FFFXHUwMDAw6TxcdTAwMDLcM/L8XHUwMDBipmWqlJU6snNcdTAwMTiVb6BSW1ee0zFpdrnRlbvv5cn7UOz7q5eq2iu92vk935rzemGEfFx1MDAxYk6J6dbNXzJIScFcZonClMysVuxcXIZKsu/oNNyd1ypj/Fx1MDAxNG1iXHUwMDE0dTXmPj5cdTAwMDOeIVZcdTAwMGL+4i1cdTAwMDfmXHUwMDAwNn1cdTAwMWJcbtlwr6J0mFx1MDAxOWqjU5t9X61B4EmViPFcdTAwMDT5RdpU01x1MDAxZtCMWHE6h950qlx1MDAxYsRcdTAwMTWDNJ/Tu248XHUwMDEyeuTZU7qCeLk/XHUwMDA0XHT+fz74f5/Nun9YIFx1MDAxNi2JKynwVVx1MDAxOYjQIfMh1dydPPly9Ws6mlx1MDAxNPGhh9+rXHUwMDAwXHUwMDE38665j3/i33OBZre7XFxcdTAwMTKO80GVXU5FWp/1L8DM7OfROJqgfPvmkcyLL+lv+pGgXHUwMDE0mFxcdmZcdTAwMDLw8ExezV3ZuL+dyvSD8y3++ihxXHUwMDA16Fx1MDAxYvn8XHUwMDE45635PaDFzz9fXHUwMDAxtFhoV/xUZENvqn/nRJOrMr0tqpTI/m8v3afUqW+ZvGVcXP0+oX4kZTcvxyZHKbNhZ1PN+ceVgzfZ3TzRNO4jgv1MRjF0Ntvf4cxxmt2OXHUwMDA0kG1Pp2ZcdTAwMTVo/sT+sltRhEkz1/ompHfmidqz13FGZSP40k/OXprvQVxcc8l9O69cdTAwMGJcdTAwMThkZutcdTAwMTShPFx1MDAwM1x1MDAxYdx/mZzYV/5cdTAwMTnLXHUwMDAxu1x1MDAxNJm7XHUwMDFlXHUwMDFjzFqyXHUwMDFlxHV7W5hZROTnu3teiEh8Tt1ccv3oI2VTUMtD0p+MXHUwMDBi9cjdVz1cdTAwMDX9jf63TvvxsZTJ0URcZpSRxDttV0c2xq+Y/1ujNtqVXHUwMDFj+lKtya/OTm/Wk+H393l/Ibe3l1x1MDAwYo5++1x1MDAxM/pRXHUwMDA3I2c+XHUwMDE4mue3k5NywIVMblx0/C/bvfxp2ofSRJw7UV+1eY6Ol7VTXHUwMDE4nn6sXGbL41x1MDAwNil12JlKkerEUIPulPwz84fmXHUwMDFmJizd/qeR5Vx1MDAwMn9cdTAwMDWMN4FNtPKwovr1vzVcdTAwMDesMVx1MDAwMyTC9nf46ZGcKIfSYDHJ3bKsO4zI8fqyPiH+5diG9/XlQVx1MDAxZPqgxCrt2c1Kulx1MDAwNG9WcVx1MDAxOWiwOT5ZIbbLr1x1MDAwNqHNXHUwMDA0VmyVcdtIl8eexoyQRv0vMF5PXHUwMDAyhFx1MDAxN8ZcdTAwMDVJVq/albjPKFh+j+Jkm+NN4vp8UuCo/lx1MDAxNlk21Fx1MDAxOGmiP/FRm9N/WcKxwqayXHUwMDFkzUDpZUpcdTAwMTBcZlPy2rfTiYF7XFx8nDhcdTAwMWNcdTAwMGWBuW9dvubdpXJcdTAwMGbusc1D2VxujPhcdTAwMDVI6bqXhd+ft8ivfXO164q7TifQ8EZ2XHUwMDFhdfpUJGKClF+/tPXHQ5vRS8pcdTAwMWNcdM9cdTAwMTjh01ZekJj3YFx1MDAxN3fj95M34zJed1x1MDAxZeD0beetZlpcdTAwMWKRilx1MDAxObXvXHUwMDFlhPdcdTAwMTS86oFP1lx1MDAxOd1cIjDDqVx1MDAxM0llMSpo6nO5RUV1tvhcbvHT5OGUn5DV76+wfvxcdTAwMGZcdTAwMTc8I6BsdmZ8mTW0WYyU/uZkxC9ypOemblCEPDq6vMv3pGaC/CWy3oxLaCFcdTAwMWFdXHUwMDEyXHUwMDBmeWW/LOZ8vyv/lsfsXCLtPVxy04qvQVYs1JWAiE8nWfxtpii3XHJcdTAwMWK3X3+NJUK9X9BcdTAwMGb8XHUwMDFktpm9M35IXGLxXFx3t+ZcdTAwMWWexlx1MDAwMmBcdTAwMTBlJWqC56Ky4zv+XVx1MDAxNF2EKb+grzmgoofzt23Cr3zVQXfveeeisU8znUHsXHUwMDFks+P5Ypy9qCxQ5CUgr2myy9ZcdTAwMTYprkfZ4be4z1hO/vZEPL8nXG64r4J/XGLBzZH6+T1cdTAwMWPXT8xcdTAwMTeN8sbfXHUwMDFlSJ58V17771leoTW7ONBgeia7XHUwMDFjl0lXUbdpXsyvWVx1MDAxN/ZcdTAwMTOHaZRcdTAwMWE+XHUwMDAxXCL3XFxNcGiykopA6Ybu+q2UpUDVKOck4rqYUVx1MDAxZpClNFZaLlx1MDAwZfX4ovBfMW/wXHUwMDFi2ESrXHUwMDA2MiZtXFy19Vx1MDAxZks7/9b6XGI2sPnYfv2o/fGf831/mffBLH0hyb0qVEwzeinJcjj38jlcZl7o/S00RIKlZpbd4Fx1MDAxMFx1MDAwNke5XHUwMDE3I97D5zdcdTAwMWQoSrjfl/2QI+GnXHJzNCROb/hnXHUwMDEySf36/YrSO/JcdTAwMTVr9TxTXHUwMDFlwfXeLiZMmF/IvHRmR+Lma1x1MDAwZl5cdTAwMWOMQjRcdTAwMTCXTXqxXGbZ0rlcdTAwMDVmvdfNdpqWYVxcJ2nft3NbzH7vpvW42XU2a7SNmIfrNDXjUuiLXHLO1Ct7XHUwMDFkKmDeZFx1MDAxY9721m70T5njUmBBUSNcZr5PXHUwMDA1YT7tsjFGqnFcdTAwMGbTqHjd71coxqE1rnJcXFx1MDAwZZBcdTAwMDdB9Vx1MDAwMz54n01XI1x1MDAxMrr0X3vpcfd8XHUwMDEwaKJ93JlQNVx1MDAwZlx1MDAwMstrVyE1Wlx1MDAxY74gaeFcclx1MDAxZE1Z/lxiNNpCevy3RNSVXHUwMDFm4va5+eVYmZFcdTAwMWE9PdWeYiM41KPsTlx1MDAwNlO+XHUwMDFmXHUwMDFmt1xm56F4PEc8bHNVmTD+XHUwMDAw4T2cJPNBXHTjyWRpR/gxXHUwMDA2iOhJ/EBcdTAwMWJ8MN14SIJ/zFx1MDAwYvp7XGakXHUwMDEwXHUwMDAy7+2HXHRIvC3JWlx1MDAwNVfmUFRcdTAwMGIx9VOVO3na4VG/QNW0bqjuQp+Xxdiuzc2iXHUwMDAzi+i4J7vJu1x1MDAwMHNjYUXBZ4a1MpH7p5lSXHUwMDBi2CpcdTAwMWKJn8/qp1x1MDAxZdV0pzNcdTAwMGJRXHUwMDFjRYd063VK3un+d5iZdi18za7GXGZSS1x0K0m7v4RHXmxcdTAwMWIkjV3oj756SJZEx5NrkcD+XHUwMDBlLDlcdTAwMGLbUGGEi1x1MDAwNsn7t7wuPpC15+fISGHvmjfqxnIrv+o26stKXHUwMDA21lJ69qxyWDlV41x1MDAxNnZRl9/eXCKVfvuy/ZLzn6/fS/tKkuo53Fx1MDAwZqjBWFx1MDAwMqFcdTAwMTi9XHUwMDA2u1KR6MNcdTAwMDKE+3NcdTAwMWNcdTAwMTJK+EijXHUwMDFjUthcdTAwMTGjxKT/5dzGMTDOn3a1Ulx1MDAxOIxcdTAwMWFcdFnTei+VNXB/OZ2cs/v69PdcdTAwMTh9u3+Uyq9Dbsk8/r5cdTAwMDJ251xcvlxmNOGJ8/yPLO9tXHLgMJgvffHimEzfddgz95MomYmhLObGzUT8MO2zeqyJYNro5Jvn6Kz8knXay5ZE/Fx1MDAxNVx1MDAwM5co4zxcdTAwMDCgLKVIeH7+nlx1MDAwMWL63szC4Z2fdex67iiBOvNGXHUwMDAxlkyek+doXHUwMDE1T1xmq/pcdTAwMTSQT1x1MDAxM1qwztf0iULPK33xXHUwMDFjT1x0qfdcdTAwMDN0mHBZiWApKaHgSUrt//dcdTAwMDLaroL3YsBcdTAwMDAmkZiwym9cdTAwMTVcdTAwMTOPXHUwMDBm/VxyxD/pgMR6nFx1MDAxYUQr9PauXHUwMDAxYFx1MDAwYlHf2rzujVx1MDAxZHg/XHUwMDEzb2HaTdr8wFx1MDAxYlx1MDAxM1FaV3FcdTAwMDZVk5By9JvBiJnCl61cYoZjTWZfX4PrtL1mhVx1MDAxNsThXHUwMDEyfVNlZVxmfft35lxuj+74PKG78onkkVeljyBSmlo+dDxm90Clbmr80NqUffpcdTAwMDeW8Fx1MDAxNVZaoTSP81tcbr5489NeXHUwMDAwXHUwMDA178tcdTAwMTVUjZ9e9HtZXHUwMDE3I1x1MDAxM6JcdTAwMTGbXHUwMDAzXHUwMDA34Fx1MDAxNybXWlxc8IHVelxualx1MDAxOX97p+SHQVx1MDAwNKs1S9H3h1x1MDAxNFFcdTAwMWG80+qo+rw8X17sx7dKUbqfo4fX8sORaz7ikO0slL1cckFTcGpdXHUwMDBiRqjp9Fx1MDAwMGpcdLrp9bIqodZcdTAwMTFcbnOQIWF1VoSV2HUnXFw4a3F9pd7UXHUwMDAzPe5k87lnkl4gx+uRSm9ccqgq4Lle9njroSt/KeOvXHUwMDE2aXi1XHUwMDFmXHUwMDE5WbBcXJNcdTAwMTQ5XHUwMDEyJHpBPID90dF1MPWvpelcdTAwMDRcdTAwMGXxsEu2of7rmSGZrtr8KbM0XHUwMDBiO/uDbozAQNiIfijEXHUwMDE3l4lccmIrXHUwMDFkM1x1MDAwZS/y7EEn/c7to34z7Vxy3mGlM1xy0zxk7Vx1MDAxZWHP8P1cdKXIy/es6rlcdTAwMWI50eSaJ2zhkvTFO707ScJITulGToTuaa9F6DX+5k9cdTAwMGKcoMWbXHUwMDFkXHUwMDAyaen0oqOheZWY7n6pYuW8qVx1MDAxY1x1MDAxN3GW3U/ExmzEdqIvIeJYg7maXHUwMDA2/ohN+uST8JR2NUM8Pa7FUH+FPlx0XiljXHUwMDExnLvLh4W0XHUwMDEwdlx1MDAxMvXIUcZm1mG3n3m6x/x02OMt5CDn8yhwO1pvzF7mymGkn06MnXPTXHUwMDFi9/XJJiGQeFq3hdNwQpNtdELTnle1MirVhm5TWnb4clx0/tTCpjqVzFxuilx1MDAxOU2P71wih8wo+2dk/Vjj8npcclx1MDAxNqdcdTAwMTZ5g1p2syNRJYLOXHUwMDFlXHUwMDE2YVx1MDAxYfRcdTAwMDXujt3pO3tNLYV+ZIR3T1xy4dX/71x1MDAwNaikLJpcdTAwMDCW53vI1E3+VOVq/+stRD/cTEhW3dZcdTAwMWJF9CHuXHUwMDFkz9FcdTAwMWXYUXIhtjFcXFxieUkorNg2JMboeoGz9vr3ZqKrl2OyXCLAXHUwMDE3yMkpcVTOLqq3OiD40Vx1MDAwZtpcdTAwMDF6J/xcdTAwMDXvX1x1MDAwZi+d8UVcdJdMfFx1MDAwM/Ev0K9X8PlvsWJcdTAwMTV0XCLDOZZcdTAwMTdyXHUwMDE5Q3yOpqP2l1fRtV4qq7hcdTAwMTOY93tmXHUwMDFklJn0c1x1MDAxYVx1MDAxN7aVXHUwMDEwsZGBcz399+uUN9i4gSdzXHUwMDA06uA8XHUwMDEzdlx1MDAwNlxySoN9WzzqRews7s05Y/Dvt7JcdTAwMWM/ePVTSl23XHUwMDEyrcJcdTAwMDOIb1P+6Z96W2a5wLz7XHUwMDEzXHUwMDA0QK5cdTAwMDWo9ZlcdTAwMWFT1JPRKv/vZFx1MDAwNnZcdTAwMDXEoyAoyVx1MDAwNLM9vD/d71x1MDAxMJHdySxQ8793KbD0hrR0Ka5cdTAwMDK3I2P7XCLjepabb1x1MDAxMZRzmneGr1xyoSVafXJcXMhOSoLEl2O5/CBOUlx1MDAxZJ9d/cljXHUwMDFmtNBo/zOOyvd+tYFcdTAwMTei94tDilx1MDAxMYVcdTAwMWNQptpfhLb5eNtlKule5PHbxFbiu1x1MDAxM7FptIu/PVLvb1x1MDAxMrztXHUwMDAwtXEyzyFDxUEuXHUwMDE0iea8XcpcdTAwMDLiZ6F1YzNmfNdcdTAwMDa5331fgoJcdTAwMGJq/G98h7HX4eo8pDi5jydIes/6alx1MDAwNe/82KrbOcz1cohcdTAwMTRNW0w+WXRFio/jx1x1MDAxYYXfp2RSeWmy0ZS4XHUwMDEy1jlSXHUwMDFjZ1x1MDAwMr3uR9S0NVxmd1x1MDAwNdr014lR42M7TUFcdTAwMDKtb/GFrIPxjFU18XXCYuHlK7+PpOt+q3aXa52U21x1MDAxYuJXXHUwMDEwbUWBY1x1MDAxZGSU3Cl4sL6t+ZlcdTAwMTc/V4prKWhcdTAwMTHUT36sOJdcdTAwMTONx1R+io7+PlxyXFz3QitpQWGv0SaAXHUwMDE5+vD3XHUwMDBm7H34xT3WdiXGkdQoXHUwMDBigG19zItbJqzlL4NiT7wpflqwL1x1MDAxYvQnx9srpWHKs1x1MDAwM4/adslPPjZ5o39apyg3QHxcdTAwMTBS5PM41OX4N/2YXHKhXHUwMDA351x1MDAwZlx1MDAxY9TagpBcdTAwMTXaXHUwMDBlvrid/+9cdTAwMDVcdTAwMTG8pyRQwPTMT7463stcdTAwMTUmo3QxNWdUXHUwMDE1kr5cdTAwMTU1W1x1MDAxOCWqkIVZ9MbhfeD7Zj+PLFx1MDAwM5vqe+Dd0+1LXHUwMDA3K+ZcdTAwMDUt0+NcdTAwMGXImoiUpfdz0u9jODHdaTVcdTAwMGZcdTAwMDBccvC6L8nRK2Avqvg8u6I5VlJxXG531TDy1M6cXHUwMDExOlRVQOhTXHUwMDFl9Fx1MDAwYlx1MDAwYrtfXHUwMDE3XHUwMDBlP3/IvKXKxVx1MDAxN/m4XVx1MDAwM/KOjVx1MDAwN/lcdTAwMGV9mNZCgJTjI/w+3f6tXHUwMDFhWXzLtiBN+ZfJM+6MtFv0JFwiOKDwrvlSMlO7PaHVKuLgXHUwMDEzJ6LvhiNAlsRObpVxMOua7V1vLOFcInlByCq9RV/ZXHReo8yZnn+0ylx1MDAxM1x1MDAxNFX/Kn6iJjd/x1x1MDAwYlx1MDAxMVx1MDAxNGdGl4DrXHJcdTAwMDZQxNZ+pv2jXHUwMDE1RD5cdTAwMWSkf6RcdTAwMWQ3x1BcdTAwMWJcdTAwMWZfXHUwMDA3tH262DtcInFcdTAwMGUq9Vx1MDAwNanWXHUwMDE2SaX+8kafprsw3qNcdTAwMGY4OHhcdTAwMDH2fI9PXHUwMDFlXHUwMDExaeJcdTAwMGL50q7FiO3kxyNX8Vx1MDAxYlrhsl49O6DvTJuDrLuktkFcdTAwMTBhSdqX43JvTV6UfsM9gC1Bp3ls6F4zXG6QXHUwMDFjYyog1FvG40B/ibgzTjYtl/5cdTAwMTaum+spIfuBXG5IW2Siq1x1MDAwNOkzXHUwMDAx1Ss4lmo7mntqo2HwwkuX+3tq7l/HITz6eWFKPkCvyEbEKlx1MDAxY4Im9Vx1MDAxOFx1MDAxYTlPPthcdTAwMDdcdTAwMTLi6FxuuF2tv1wiwPtcdTAwMWO20Fx1MDAxZfWsOVx1MDAwNLvZxl3curW/XHUwMDA1XHUwMDE2MLODpHI9hlx1MDAxZT4vu0DQ/OdFL9o8XHUwMDFir8agNVx1MDAxOerg5zLvXG55XHUwMDE4zeSroVxyXHUwMDA24T2NqfR7vkr8RFx1MDAxNNwuyfr5XCJcdTAwMTY98czopcjC+VxyoFx1MDAxNqc4is/Zl1x1MDAxOHVGd/E2STK+d8tcdTAwMTctvzO0vX6m+mI0lFwiMSpcIpGrV6HGTis4XmQqKVx1MDAwM/M6RqRAe+yLVDh9zINcdTAwMTCFu9BcdTAwMTdY3idKJWB8nlx1MDAxYU1tQbImJVxyjiViXHUwMDBihU3Trt48J4qI3XuUISXN1OFcdTAwMTFaXGLLN93Ct1x1MDAxOKNiSJkj3rB9XHUwMDAy6OE1pltM8qHPXFx05EXuX2yKylXNmTjyw/R4z7GiVFc5lMx7lv1cdTAwMWREVH6WtcJcdTAwMTfovcZHY72zLrHHJrjRrP+wWzKPUpLyI3A9WdCib2WhlZ/zXHUwMDEy2KCw/H/YOo8lSZVtwX5cdTAwMTBcdTAwMDNcYjRDtNaBnKG1XG40X//I03bb+p7Xk4qyykpcdTAwMDKcLdZcdTAwMDJ30Njh4DuZvZdcbskyaqdcdTAwMTmo7Fx1MDAxN6Pb9+XA9f+d/zi78m7l2IqBnkdA51x1MDAwYl76323McFlWkjosaSavK2W1XCJ6+GN05kr2q0xcdTAwMTKGdXdbP0BAXHUwMDA0OdqvnmhleN69N7QgnmJcdTAwMTHG4vSV6nJ3dq776it+XHUwMDExXCLnrVXTK9G7OvpNmlxiPb76x3OZ38knLVxmNOXbXHUwMDE2iOxcdTAwMTJcbpa1vVx1MDAwMG/O2EKQ3qachH7jkf2KuEjoh4RutYJcdTAwMDEygFF5K1Nw9/p+8W0/g6hfoFx1MDAwM1x1MDAxY5Fg5HQ3nbdiUbBpblhcdTAwMDVcdTAwMGZDLbrOXHUwMDE4b/g8bZKBjCEnXHUwMDEy85y4YFx1MDAxYoz9i3QrJSugyoA5doFoLcrJNembvVx1MDAwNMonyr6cg1xy1DhudLEj9d7FWWmSSlx1MDAxY4e0uOl2XGJcdTAwMWXlRKUqNi6Ky/KsSbw/jo6jKlx1MDAxNFd4m1JfIERlrDdcdTAwMGW/jqlcdTAwMTdcdNhMwIeQmYiHpO5+XHUwMDAyXHUwMDE5XHUwMDE5elx1MDAxMP5+qTdt5Y3y756YXHUwMDBiTktVZv5pOr7vyTJBrMOLYudcdTAwMTF10+JjlMkzkYg9/9BcXP9NJy1cdTAwMWT3gorHmGy+XHUwMDAyoUVcdTAwMTRUKD+1zqHEdlx1MDAxN+dcdTAwMDEpYyFcbk2Hq4ROmG1cdTAwMGLri9RcdFx1MDAxOSdcdTAwMTT0oTUsXHUwMDFkaKDxXHUwMDAz7T3yk3/Pisy7kbuKRHNcdTAwMTPAgKL6XHUwMDE3jvRcdTAwMGUyuLFaLPMh5dfvXHUwMDEyYFx1MDAxM23OKHCcpJs2uIdcblxmIF5cdTAwMTXpRqZcdTAwMTdVbEpcbiNsY22ESW5g8cz6+dRp3Z8mZcYwXFxZ8dlT2FObqzlcbiVsI6dcdTAwMGWUf6Cur7UhXHUwMDEwXG59/H6etH3e07eO9fZcdTAwMWO1elx1MDAwMVx1MDAwNl7GXHUwMDEwZM+KI/qaeeszyEqfp2iUXHUwMDA1alx1MDAxNI7n+TZAU+qcWlx1MDAxM/El31x1MDAwMsxcdTAwMWFIXHUwMDE3sKzajz7aLdfuJiBcdTAwMTigYPSiXHUwMDFi1CdOz/PJaVxuwlx1MDAwMppBRKsyS/EruVx1MDAxN9dNikX/XHUwMDAyYVx1MDAxY1QyyMGi2rAz/DIpXHUwMDAwm1xuXuDOh4VcIrRV3+JbsVx1MDAwN4FWlUjXdLOlXHUwMDE1vFx1MDAxMXmm72hUtlx1MDAxMjCW10L6XHUwMDA3quOXjUhcXENcdTAwMGIooIefQHNq9pRcdTAwMTkxXHRWL1x1MDAxNlx1MDAwNGbtzsxAKv2RuoGhXab33yFcdTAwMTF2gEjrhWUx/ipcdTAwMDTzgIbw/O7Y3bzjoNbRRX7JrPBcdJhN04lfcb+n+JaMXHLbXHK5XHUwMDAyN4LSXGajrCNEkFx1MDAxZFx1MDAwN1x1MDAxONLa/lx1MDAwMHdbLT+bz7z6sodcdTAwMTU4IVxufi5pvnjEp59SSquqXHSTsuJTQYRUmeZvMrvgR6vvgHW+UmB5rH3bZ3BLXG7AspZcdTAwMDdcdTAwMTFcdTAwMDKM4keIRf2M/U5g2uVoOfwoz81Dl1SOz6VOXHUwMDFlXHJYLCiHXHRcdTAwMTQkMJWQyPVcdTAwMDbP/Vx1MDAxZb6Q9uGEJKViW4RcdTAwMTVftVx1MDAwNdtcdTAwMTdlzHjyMTsqpkvMPpNcdTAwMDHzjVx1MDAxOYQl7bVcdTAwMDe/drVi3Fxy8Fx1MDAxZmtcZufbmsXTfUe2eDdcdTAwMTMu32z1aFx1MDAxOP29/4cxbdra6rhcdTAwMDVB4nPmslpcdMA3IFx1MDAxOL1cdTAwMTTYmpdrxEKg+6J7XHUwMDAxYsJcYlxcyM1r3tHMc5LpXHUwMDA34Va/iL8/LKFe8olClZZQXHUwMDA3hVx1MDAxOO1cdTAwMDJRgXhcdTAwMThcdTAwMTjUPDZgl//x/P+3ft6ioVx1MDAxODxcdTAwMDGlq1x1MDAxYuPZvrtkrlpcXPxWkLfRLmBBnlx1MDAxMvR+XHUwMDFkMdjPpfg43r8yXHUwMDE12Fx1MDAwMYTRzOR19Ffhapn+fnthkNk3XHUwMDFkxCZOJruKNdorYO7WM1dcdTAwMTSkmcGSYVx1MDAxMf7Il/Gz1Fxc6ICrNIc+XHUwMDAxXHUwMDE3lS/cle1qboQkWuU2VHOxLST1zefo7lwizHRPV2f45q5Gp3m7IUm2999L37W4vSm2flx1MDAxOUtcdTAwMTfAb42L/LN8Llx1MDAwMFx1MDAwMUNcdTAwMTndisuw1Y9cdTAwMDNY7e5SXHUwMDE1x0vthVx0/ITJXHUwMDBisGpcdTAwMWXL4UxcdTAwMTZRTpQ0Zlx1MDAxOPD+rH5ly0BkYyZF0UJT1TiK/oHj0EQysjhARkBI/Fx1MDAwZVx1MDAwN2UwdFx1MDAxNelJMFxyVFx1MDAxZNU19nhYWlEqRa9geWi8lFkn4lxcxGSmXHUwMDAwXHUwMDFluvHxXG6+df+9cHRcck6T/3v2XHUwMDEyRrtK3Ly43JNcdTAwMWXw1lnTRK1fXHJcdTAwMDA0TVx1MDAwMrr9KyzzXHUwMDFihu1p3pY9w9n4laha+MYrYkNcdTAwMWZb0Vx1MDAxNSAvXHUwMDFmhKdcbksy00TU6TV26t+R4Vo6XGZcdTAwMDJOe9c6w0XeK7+rLpVcdTAwMGWpTG51lMD1KtnDJWRcdTAwMTZcXIbR2ZOPPGFIPoh092mAflx1MDAxMHXGXG7jXHUwMDA1xuVNXHUwMDE10CSfv1x1MDAxYnXJtn6t0p6ea5+zgN44gadcdTAwMWSlclx1MDAwNiWraKosz9PSMNQocZioLH1cdTAwMTDp3yRcdTAwMTbAQce/XHK4Xy11UVxm/6VqXHUwMDAzSeavNVx1MDAxNE6vNGxlh97V+Fx1MDAwZWSVls954TWIaHqq0iVhiy6RbLiiIyA8ZsCp7I9Qo1xu92ongLNF48eeclx1MDAxMMdU0Vx1MDAxNK4/SFtcdTAwMDOqXHUwMDAzZNt1XHUwMDE5b+u6Je0tr2xQXHUwMDE0L6NoyMrd31x1MDAxNzVZOaR/auqf3Vxy7VxcwLvdUSYh5dCc8fHpkMVVJlr4IXWF6jb7SOZcdTAwMTkvX95zkzOqTFx1MDAxMnhcdTAwMTRccnyj+Ks8yCiY5ulcdKdxfbN8S/F4XHUwMDAzel+zsc+Z1SOKhi558SdSl1wi6JqfmKZA8Fx1MDAwMIprTiexJLBZnrS5WO+MuqlX0+ioWbut0Fx1MDAxN9As/HBRiU5lXHUwMDE1rU5yk3NyOn2iqd5cdGg2sa7/bCXAqPTXXHUwMDAwovrNS3pl9lx1MDAxY7dcdTAwMTNcdTAwMDGsXHUwMDAxqnPFtLSa8dtqwP7KXHUwMDFmXHUwMDA0hY5S/62H4dFxu74xddNi48BcdTAwMTduW3b7oVx1MDAwMp5ifNOWXHUwMDFkXHJSiVx1MDAwNsu/LfjSxkFVqYvT2kFjizdXKMA5w1x1MDAxYtpsd7RofOXIyJFa//Y7jvlgUTV55SFn4DeF3PjCKMUkgFx1MDAxNzUjX1glXHUwMDE3T1CsTGNqL2xcYs7RZtPSYtr9TFwiXHUwMDBlXHUwMDFmrkDv9XJcdTAwMWTnT/qRXHUwMDFmgF72RzmYXGbi4N9+P+RcdTAwMGbTVpFW5brVsFx1MDAwZThBbKJ0jaRIXHUwMDAyPNMuZoOeqcmB7OqJXHUwMDEx2b1cdOigQUDCJfxjM5VMZFM13NLHXHUwMDFi5IUm4lx1MDAwMjPZ3tCTKEiCtyZXe7hhoFxu+GEtUFtUXHUwMDE2PVx1MDAxOD/QYb1cdTAwMDTF93fVMLZmJ+UzzoVuc1N5dnBeMIJcdTAwMDGBJiE2SVv40UaMn0EruoCP5c7m5KVPvZ9JojBU1L5cboR7is23XHUwMDAz91x1MDAxN1x1MDAxY8EstHbqecAh1irPOFx1MDAxNjOHmzH/2cDw3zVXXHUwMDE1Mz7h71x1MDAxOI6qVrTpLTQ/9981lSHDnmNcYvlZx5CS5LtaQ9l9vlx1MDAwNFxiucpDkf9e11x1MDAxNbFDXHUwMDFivufr92GmXG6yZOBLXHUwMDFmVtyQuaLCXHUwMDFh51wiKM86SVx1MDAwYq1cIkXqPVx1MDAwNpZcdTAwMDJ4Y2mdZ3ApXHUwMDEzv3qGNSgoyjZcdTAwMDf1l22PlFpN45U89j146v1WJrH6SfwqqH3CiCqY+TpsZWTF1fdDrduhOjyvvISyX8utTFx1MDAwZnvf0IDiYFx1MDAxZpLZaCbH0zSHceKbIKFcdTAwMTM6XG6w8FXoXHUwMDAx6yo605LggzosXHUwMDEyXCJ2brY6XHUwMDE393JcdTAwMTd//V+p4eOky6NcdTAwMGbVy4hcdTAwMWZ1v+xcIo99npdcdTAwMDUqquGcdH+KXHUwMDE4dIsuK/nskpDXxzlxwb3NXHUwMDEzXHUwMDEx24G4Jbq0oM23Klx1MDAxNFx1MDAwNUXuei1jXHUwMDE5T5Z7XHUwMDEyXHUwMDEwXHUwMDFknbhh4uG5rD8jNyxjr+K2nt0tXHRHXi1cdTAwMTZcIi15XHJoyn9ORdA0oocoXHUwMDE4XHUwMDE4IWC9SqBf6+vRu1RcdTAwMDLZ7yaiq/A8g376ZoOJTDk3vGGNXHUwMDFjvKeUhz3HRVxyPFx1MDAxMXNcdTAwMGac9oRsbtTZMN7kvHprMo6PfsRm0IiytK5cdTAwMTIq6fY5XHUwMDEzlGHkt/UnXGLbXHUwMDAyM2uUebmdKm5kuGlS3llcckGQiHFFl5+Cb9xcYnJcdTAwMWFgPIHq+lDVy7jCXHUwMDAyQ7RmlzU2lL248TBDMVx1MDAxMHhryNKW4FhcXH5/+rIhXHUwMDFmmu1cdTAwMWJ7dGWzfb1Vwlx1MDAwMlx1MDAwN+osim3elemjg4XuzJddtNRcdTAwMTBcIpq7zF0gnLheNK5/XCJcdTAwMWJfxrTm8KanzXtQ92zjMe6dX+C3pzJrOI+xJiFnWsGwetLfhipykpX1XGZcdTAwMDDZpVx1MDAwMeJlMdo0wWfXgVx1MDAxOFR5rtGb6sebysPY6HxcXJayYiBcdTAwMDf2plx1MDAwZqdCXHUwMDAxLy4g92h8q6szon1cdTAwMWWwPPczL/NcdTAwMDK0YMmHNFx1MDAxZiXacf6GkdDmlVx1MDAxYTlccnwydEzNvVx1MDAxY/mtTLLQXVx1MDAxNmXqlsIgOkTN5Vx1MDAxM0hcZt9cZok1+fLGb4K5gK9zc1x1MDAxZq/mXHUwMDAxJjxRQF7Y97A/7dBoj1xc0v+2WSPuQWPsgpqgt7WxllxyrL/GZ1xyjynuxSZW8HniYVx1MDAwNk/vLSlGifWbWViL/Ji7p6ol9SxcdTAwMTFw14wwqD21S1RcdTAwMTd+TjijmeHQKtZ9XGKUscBjXHUwMDFltvP6vfmwRW8+aNrRVJOLIUqF4ZRcdTAwMWXx9JqvN+GRXHUwMDE2QCFzXHUwMDEyr+Qh9VtcdTAwMWbiYYh+NibUdvLDr4uYplZcdTAwMWFQyVLa/Uhm35KJP1aM7uE0XHUwMDEy84Pso+42N6Wp2jf+4CFcYoXwXFyM8E/71ugnNFqUdJ1cdTAwMTBccpXOqiivUfhcdTAwMWMv11xyTmpAXGZL0D/VjvBXNCWcoqBq5/17cI0xQClewmZ15b9+X1x0LOpweyFGisJcdTAwMGWGRV2nXHUwMDEypmtTiCZQ7I5d0WouNINcdTAwMTWKSVx1MDAxMaxcdTAwMDVacYl5N1x1MDAwZkJmTVxyyvznMLcwPGkkcCXCXHUwMDA0/4+wMyRjnco/18k3gX+plHt9bKOs3UywtVx04KWW1yXbXHUwMDFjWzIsXGbIdyT9Pkh9aFxmpVx1MDAwZej5klx1MDAwZk7nXHKEsu0sXHUwMDFhNNzA7UlcdTAwMGb2XHUwMDExpStFcqxcdTAwMTGtqvzZJexMoZtIWLtcYlx0XiQpXHUwMDAyY1xyS3rLXHUwMDBmj1xmefNsb5cxf4Pk01x1MDAwYrzqNqPXs5SJPOvBN1x1MDAxYWVaao1R529cdTAwMWZdLySo151DnsZrrG5cdTAwMTlcdTAwMGZcdTAwMDCuooyj+lLfdmVy8s5rXHUwMDE0QIgsOY5xjffRQ9mjXHUwMDA00acnXHUwMDAzxuR8nn8/XGJcdTAwMWG5iFxilvUhf+X8uKUzqoCd4PNlksfuuoKloT0mN1x1MDAxMzj8+lx1MDAxZqLjXHUwMDEy8Gd+W7lcdTAwMDXzK2YxLC/XYFx1MDAxYpi51KlcdTAwMDPzXHUwMDA3+sutXG47+SzrjLdn5NOqT5xcdTAwMTVGTKR7nbrwnaLQ0E+t+FTDeFx1MDAxZslMXHUwMDFi2OwtwUU8o5NcXNpz3SbmOGBcdTAwMWZTt2veRj6wJuZk3DabNKJcdTAwMTZcdTAwMDGCKPRcdTAwMTlxVCpzS5L3elx1MDAwNkvWRqxcdTAwMTGlPjlcdTAwMDLRSo3R8aVlKjPk7Vh/slx1MDAxZeGsXzpcdTAwMGbQySW/OnJcdTAwMDNhodVlkFx1MDAxObs9u91gIFx1MDAwMCmYPOgyxf7QmIdP8tB5vyAssOzki06phDLGXeTRxKdKf1JcdTAwMDZ3XHUwMDAybSu0zaG17KZuXHUwMDE13lx1MDAxZD1xIN9a0lx1MDAxOMFamc5cclYxX1x1MDAxYr5Fh96WmWauZmtcdTAwMDdaaevOnqP+XHUwMDE2bWFihkxcdTAwMDGW7rviKa5vLH1SmVx1MDAxYTRj9zKGxLXHKFx1MDAwM1x1MDAxOSd+tVpcZlx1MDAxMslQXHUwMDEyjG3pWKh7xmB4PalX/YFcdTAwMDOVV0ynXHUwMDE1PomQkyVwVY/0wMb3XHUwMDAxsaVEYT9odVxyS79vJbJO4CAo1JDpO/ZSkJFVR38pv8LdSHsrvMhsXHUwMDA3p8JcdTAwMDWu4laygmRjO1x1MDAxOfSqYztI48U4bfC781x1MDAxZDR0kjBuTFx1MDAwMClcdTAwMDJF/Mqvf8hx2E2y6Vx1MDAwMyfoXGbrPNpO9FSC88Bnh0FEUpY78zddaTh+g4H20tu3lW/T505cdTAwMThWKUNUZ+rmYSfdo3qp9Yfk+vikXHUwMDE2fY2E+n2uczy67UwvPnRi+lx1MDAwMKO9/IWTkZ9YWtW7yIln4ERZac1cdTAwMDI/M0Mv17bzMNu5OD57hi+/2+IkfIxMXHUwMDE1lVx1MDAxZIqDy2BcdTAwMWay9UD/1b08rZ+coTIzPCOpkS2cy8DzXHUwMDAwi6z+mDhlM9uDfFx1MDAxOI3I3Hf7vld/q96ysFx1MDAxZnSkXGJcdTAwMTD4z5r6KtX8SElEXHUwMDE2RECOklx1MDAwNG5pZOs4XHUwMDE0QlP84dUp0J2oelx1MDAxNZppXHUwMDE5koNgQ3M/wvDUb9E6s3eiVqIub3FSXHUwMDE58TvzSMSo2qVcdTAwMGZk1C0pdFS6glx1MDAwMzs6XHT3vGVQiVxmN/jNt+WNJ1x1MDAwN1x1MDAxMJ5ljc2OQDc4TORXiFx1MDAxY7byrt/H0rxYhkqWSPyyXbFcdTAwMGaRXHUwMDE5++Peb5dcdTAwMDSFfvTPnvh17/6j3b1tM6FcdTAwMTVPZq9djJu34EGil+pcdTAwMTXTh1x1MDAwNUKpKm1ghPRx29GCXHUwMDAy6aD++/rl+8fJ826Vy7Tx9zSUszHB+JPKXHUwMDAyIFx1MDAxM6eQY52WXHUwMDFmJ42D+Fx1MDAwMaHWpc6eXHUwMDAz/72noZTyiaPOK6trYC+vzbKsXcEqIG7pnUD0t6W87MdlyIUzns+Kw4xIJumVLVrjo7zgfZQtnaRpm6q2QNepvFx1MDAwZqdW/Vx1MDAxY9TIXGaNec5DXFxPsuimprnzU87N7pnOx/Ljf+JcdTAwMWFOv6Vo2FopXHUwMDAw5Pwlh0czXHUwMDE0mnElZ8O2lUhMK/2+TIb5VFx1MDAwMPmxjPj3RFhcdTAwMTYjVVx1MDAxMMLSL1xyXjEtXHUwMDEw3+rmnOptO+JcdTAwMWRxt0s0V1x1MDAwMierydtvtIfr169RdDMtQFGIPivmrGBYT6bfX92bdqcgXCLCXHUwMDAw51x1MDAwMoSij1x1MDAwZlx1MDAwMfqa3nHDdM6RUzHE/rtcdFx1MDAxN+dcdTAwMGXPKyrgXHUwMDFlN1LHQ1x1MDAwNObSX9Wa+DtkXHUwMDBlkVx1MDAxMcy+XHUwMDAy4Kl81Fx1MDAxY1x1MDAxNoXrXHUwMDExoY5NPpjMXCK/XHUwMDA3Kj6FgDWwXHUwMDA0XHUwMDFh4odFqWzw62+a7VTcR+m4f1x1MDAxMsssVVBTXHUwMDFksGw2gV1TOpLniuBtcFx1MDAwN7icYL/KsFewuFXiXHUwMDA2RVx1MDAwNqEoQ8/rZto9zlxm2kwoPtJcdTAwMTTrblx1MDAxOamqp6ev6kk/S+rZclAjbVx1MDAwM0g9OzX526nrU+40X362pPZalHVcdTAwMWHXnVFcdTAwMWH4myBg2M1tb/SJKe5XL1o0wvk0i6vmg6ZcdTAwMDOjXHUwMDFixjnHedhjKL30dUK+uku9XHUwMDA2LVZcdTAwMTcuJ/zsrOBVlI4quDM/RH+XxjJ/pyElQTPfly9QZFDjc1JJxVx1MDAwMNRxp4XVl1x1MDAwM8hNfaCfy7CFj9TWTPpcXM83s2d7kvvJL8aI4F+H/dRJ1b+H9lx1MDAxMt9cdTAwMGWPXHUwMDFhrlx1MDAwNFxi1/FcdTAwMWFGouxG8zTE/762mHMo41xcZHpts2FirJ5cXDV8r1x1MDAwM/ldXGIwq003MtiYfcU9XHUwMDE5XHUwMDFm9zc2f+9cdTAwMDeSUlNPytlcdTAwMTD+9vWOgVx1MDAwMVx1MDAxZZs6QfZi+/DCJn324rfYoTxulNet5UF+P1x1MDAwNkc4l1tcdTAwMDfqK1x1MDAwMTjaSnpcdTAwMDXTXHUwMDA2i1Fk5kOv0TNcdTAwMTBcdTAwMGLWXHUwMDFmclx1MDAwYjay+VtcdTAwMGZgs9GT8Fx1MDAxMeVcdTAwMWNcdTAwMTHK2KZl2TF779znwCXfXHT0t5PDXHUwMDBmanFwV7pk13yvQHlcbtxuMuRcdTAwMTCiQzNcdTAwMWWOSPclkzArnVmuqNFcYljDxnCWSJyIWapcXFx1MDAxNHiGcmfxXHUwMDFmibh+w8XqdrFHXGKa91wik0rqXHUwMDEzvo89XHUwMDE2nVx1MDAxM1x1MDAwZuxcdTAwMTHOl+ZvfeY5k/vb7Fx1MDAxNVx1MDAxZsZbX226xjtoL6xcXKwsO23XXUXpYCkoXHUwMDA1jZuz5V/f83QpjPJGXHUwMDFmcFx0W+JsLvZk45dBlenBXHUwMDFj4ONKeWPYXHUwMDExQ7ONXHUwMDFkwFx1MDAxY+wrXHUwMDFk/reJYW6rXHUwMDA2XHKc4UdXafTZ2L5cdTAwMGVIIPfNRVOF8/sxnVx1MDAwZca5fVx1MDAwN+AqdkzllVx1MDAwYsL2MVx1MDAwNXskIVJcdTAwMTNplpqzlu3gycLI6CWYYjWmXHUwMDFkxkdWQ1x1MDAwNFx1MDAxOVLk/zPHyNa/b517WYegYluAqN+OeC6sXHUwMDAx9yfGjIM4uYtCWj1vqt80t3gl3kvl+JWruKJHZi/deah7drJcdTAwMTIxUyoyOIrWXG7PlMF1pPVcdTAwMTDQlG7BpFxc/o4u/D5cdTAwMTRRpVmRi9iutWVcdTAwMTK25574KICuOMMui6dcdTAwMTQyXHUwMDFh/4pcdTAwMTmQmKzIXHUwMDFhPvrQqPNK6Y8h2WTixsNcdTAwMTg9UGF+0HXbvcnGblxciaNfoWFkXHUwMDBiTlx1MDAxZpTfT4ktJ7+clXAyync0T3U0v1x0mZj9bfROh3/47fcxgHh2uarEbM60fIylVVx01Fx1MDAxMFx1MDAxNPjtzkrjrFxcQMpI/d3MQ1r/ebCAymZcdTAwMDIxXHUwMDFmh3GMSY3GNVx1MDAxYqxcdTAwMWZE4s1FV9V5h8LymtGx/L1PmSs2p5TOXVx1MDAxMKPciOaFXHUwMDA39zpQxijb9pJmVFx1MDAxMSOH20JcdTAwMDGGbKCfRVxci50raMuJzepVMq1cYktkN1x1MDAxZSRTnLN8o2RS7V61OZbPW6g7ePHq4O8n/PzRxCNcdTAwMTEkS+xPnlx1MDAxMC2fo1x1MDAxMUnReM8hcIH0n62XXHUwMDBicz9cdTAwMDOYVG1vQzpz+JSW0HyFXVCqlF34dVx1MDAxYbhcdTAwMTRcdIJ7Mi7arWp6PaKO9k75R2c9pFx1MDAwNSiW3uzAtef39myD4SRcdTAwMWH+hFx1MDAwZvRStFx1MDAxNdhLzqQohFBcdTAwMGVcdTAwMWN3nol3KkfgqMDv8Gehb5hcdTAwMTHEWUvq9+Tx5MNe36eUaGRcIlx1MDAxYzZAx1x1MDAwN65E241jtXvrWevpwoNcdTAwMTDIeqHHWlx1MDAxNcD89/bCXHUwMDA3i2/uXHUwMDAwtaV8JGpcdTAwMTbeXCIjr1x1MDAwMj1el46yUvhpWP+7LbxcdTAwMTBcdTAwMTGnfImkXHUwMDAx15jCU1x1MDAwMkf2XHUwMDFjUCHWmmQqmUA3beJRlHU2P/ooXHUwMDE51TEg4eyZvrxshCg4IMbAwVx1MDAxZqdsXHUwMDBlXHUwMDA2XHUwMDFmo+PvnoK1SelaL4E0XHUwMDA19Vx1MDAxZFLmzlx1MDAwMK9t0G1fpO6RhE570EM9qiE8gPkxkHNvMVx1MDAxOM5DrVxcXHUwMDA3taYrRvhcdTAwMTNE++NKSiq+LkaoYq2ySohW61x1MDAwMoRsXGLxYPddTlx1MDAwNJeiZFQlppmTzCC43PvBsEFcdTAwMDaqdlx1MDAwMOejg/s3PMC5pOCPTpL+L/Vrnt2hUFx1MDAxNpBtoDjEXHUwMDFhtCyGPfbqVGWE4auhnyOyQO4jXGJtSZb5mH87TVx1MDAxNnJ6Y/JcdTAwMTerv47s1Fx1MDAwZlx1MDAxMrZy4mNcdTAwMTjA91x1MDAxNcn0m0+wny+wdlcmzra/4co23CWGdE9cXMxcdTAwMDK42OZ42kPubu1cdTAwMWJcco5YiUjNR1x1MDAxYb3QvFxus679jjYjelx1MDAwZV9cdTAwMWS0x7tcdTAwMTH2bstcdTAwMTZCpkDckeP3/GErfmJ28j4378mSpdlcdTAwMTCOpZhcdTAwMGZcdTAwMGJpQlx1MDAxN7bYeYMnglx1MDAxZYHcp6+5fkPtoipah0bK8rqiPuNrtcJQlneNRlx1MDAwNEhk3S/xSNHkXHUwMDE2XTEnkVx1MDAxZEBcZnrhcM/BMNk+4Fxup7SmWTHI+0HwxewhWOf8Lcit0ulR4/1mqWRcdTAwMDXHp1x1MDAxM1x1MDAwMz43yt2diFx1MDAwMnJQvWy7qt0rYFx1MDAwZlx1MDAwZkKOz/3LZXJ8Noy/kj7kXGZwWmVKJEO/dfzDSp1Gy+1ieYi0ysp3/Fx1MDAxMyCT1n2fOcP40YO6iD8qLK//O5/sfMvq+Fdba5tcdTAwMTEmYbKMwKlj13FKnGixyEdphbl2WutjXHUwMDAxiUBcdTAwMGZknURcdHs6XHUwMDAz6SVKslx1MDAxZXZcYtuIXX6V2WqBT2XPfinE1y/eXHUwMDEw61x0llx1MDAxNlx1MDAxMVHpdXyl9INhUvZigC0gIWfLPVx1MDAxOFE0YVx1MDAxNkGEfmBcImpFXHUwMDEzp1x1MDAwYv7LzZqOoyB6xbfutKXFJFx1MDAxNlppXHUwMDFmkHpMXHUwMDEyTu+csNn+RTNYl+KdbflFZfpGt44qVbtV5bo4b0xa+YZ4q3JcdTAwMGWNXHUwMDAy5Y1cYvt8zHxPXHUwMDE0peFRoVxc5pJcdTAwMWTa01x1MDAwNHDKgq6lpWVGIUyxXHUwMDFhzpShqlx1MDAxY4ZcdTAwMWFcdTAwMWTbSja/QsOGLPq3W7pIYavMXHUwMDE5XHUwMDAyhHhzlIrvNU5cdTAwMTVRiVxi/Dl1gVx1MDAxZL2ppNngb1x1MDAwMbO+27GfdCtcdTAwMTCwhul1LZGEXHUwMDA31XR5XHUwMDFkPo+azG/IlIJT67L2eyyfUP1zXHLUsVmtRvm6Q7pw4bOMOcppQpI1K1x1MDAwYiqZXHSwRtl0YcfY3tt30SaC8WHVw8w0Klx1MDAxMuSf8mM539lhLqlcdTAwMDP+LoVcdTAwMDFBeVxizXm8PYhJYWVjuVx1MDAxNiOP4jSUTY+cf+Zr+4VF0MiGdjX7el73dcbpn/m3XG63+/RR+NRbT1x1MDAxN3He1JpcdTAwMTZAXHUwMDE45Vx1MDAxMr2XI2qR6biGgGo40VGg5Vx1MDAxZrVcdTAwMTXgYFx1MDAxN0+BNVx0leFmXHUwMDFhdbVcdTAwMGKJXHUwMDA1vX9WlPf7mPo+OPiKZlx1MDAwYn6w8VV+d/NcdTAwMWJQRVH1byp6wsKAiZ8pQ7HWI+zmTFx1MDAxMeQsn7Q4c65u49WMolHNXHUwMDE3RYjCI0JcdTAwMDG0XHUwMDE5XHUwMDFiYlx1MDAxNH6RZ66u9HpcdTAwMWRI4CXfRmiIUdFZylx1MDAxMOTlNlx1MDAwZa1cdTAwMTT3uET3i/ZcdTAwMDXxXHUwMDEz6ZBcdTAwMTRcIkAwod/4QbpevVx0+CnK7XPweH5sSJ/J0CeEKeJRnzXTXHUwMDE3x3ncY1xmXHUwMDFiXHI2iJJKP1xigOyEYX668Fxy+lx1MDAwZVx1MDAxYujXmFx1MDAxZPugJ//xf2/yqyM4tlx1MDAwYjze/m+wz35zSFx1MDAxZu/EiVxcXHUwMDAzXHUwMDE5yn+06qq8pK6XcqZvrW8pwVx1MDAwZbKTybWz+IDfPbKtiSrA2kdXxaapZas8yUoxkzY0L8spQUY4xfWyZsyjXHUwMDA391x1MDAwNkqX8V9kb0nFXHUwMDA1I01iP/hxXHUwMDFjzHnMLs3aNuFwpyTb+OuCylx1MDAwZj6AXGZCO0IxrcQh1o3E6lx1MDAwND6Dze43S66Ma+lSJfmZOydQXHUwMDBmIUmfhOJug29if/Z9f+esXHUwMDA0oedp/1x1MDAwMf1FcctNj/ouRsA3iGc8XHUwMDAxXHUwMDFhj8pLpVx1MDAwNkTxXHUwMDE0iU+do96VXHUwMDFkXHUwMDE58ODQTUVYfVx1MDAxYSfi9ao1lL0tkostr8OPtpVYXHUwMDEw+IUk1/NULNpcdTAwMWPn/P1ickTBnVwiLVBeq4fUXHSI/OWYXHUwMDFjXHUwMDE0wL7nP/1NkFxcoFxuXHI1XHUwMDBlk1o3vDiFgoj/bkF/QLdoXHUwMDFlQFxuqDKn0OnLo9aSe55cdTAwMWa+tbJ5XHUwMDAzPZDjaFJcdTAwMTRcdTAwMGJcdTAwMTAqXGY+hMDvXHUwMDFlMOPI/+XHNqe3XHUwMDEwK9Oa37xcdTAwMWXQqCzfkFx1MDAxYumCXHUwMDFiNj2b2Fx1MDAwZSThXGZcdTAwMTSkXHUwMDA3tphcdTAwMTX79PZwW1x1MDAxN1xmXHUwMDA2zLpKS76eXHUwMDFhobTB/Vl5vrNcdTAwMTlcdTAwMTfYXFyzXHUwMDE1iaiVeMDGqcRzIKnczCDNtVx1MDAwNT5wn5cnKOwleiRXhTCKdGq2SjA4QGVyPVG8pSotuVxyOWnTXHUwMDEyRPfyuDosMcGePlx1MDAxY+6Hh1x07K6gt+B5a1QmyFxysZC66Fx1MDAxYaxcdTAwMGbp+Fx1MDAxOcRgjlx1MDAxNt6mtUx9sbFVWDGxRPSN1Fx1MDAwYpB8dSrkqrTrXHUwMDAwSrNKgNLFJVG1mmlcdTAwMTPKXHUwMDFmqSMmM8aEb5579ZWZkeWM4ob7PN6Hm65B+naBN0Y+86BPZmjLnbF1u7RcdTAwMGJnT9Oo6NJfp0qYeZckeZgrXGJ97NSmt1x1MDAxZdlohzauT1xuTzq9sfHLc7dfwpLyeUT+hHL6LVx1MDAxYl+GZ5Aru8PRdXl3blM9rCSc6sqD0/En9Sw1TEtG61ZXTszF1aVIeuNmo1x1MDAxNW5hsOBcdTAwMWIpXHUwMDEzP1x1MDAxOHhcZvmUlWqXLUK3+OU1RnyEXHUwMDA15Fx1MDAxMlxu9CZoWWpcdTAwMDb/Xd+Q21x1MDAxMYVcdTAwMDbJhozjlsCm6KaHdqDN5tHDXHUwMDEwlblcdTAwMTMvL+9cdTAwMWRzylx1MDAxMCfEedNcXGql4aefXFzyUVR0/6sr3C7TksvTcK2ptEBnXHUwMDFmXHUwMDBmUlJcdTAwMTiKgM92XHUwMDAw7pGShk5Pyb78tFlvTnlSkEeAz3FcdTAwMWNkYKK5JHDiNrifmIBcdTAwMDOHXHUwMDA2qsSyvm4yXi1cdTAwMTP2zbNdvoFccmSp4CPJxvhW8D86hFx1MDAxM4Xt0oqP1GaQKnDaRNSQdymWgr95zVRvY0nPjIIvz/lg9pSjebl4J85HuL9+dXfXXHUwMDAxt3y5L/HZpXGnYN+TRqI4XHUwMDBmlsHqLYSX31x1MDAxMlx1MDAwNDvocVhcdTAwMTlW/sqF/tTM2sJ3IbxyXmWqbWXkWqlW2E6M8uhGvdMsLpz+7q/DnOLW1E1cdTAwMTBN01x1MDAxNc33vO3bXHUwMDFhnr6pkmvEMZZWXHUwMDE0XHUwMDFlX1x1MDAxM5LVqjixUftccl+uXHUwMDFl3fl0J2lcdTAwMWHE33mpp1shsV+bXHUwMDAxXHUwMDE3vyi+V1asXHUwMDA3ol9lXHUwMDAyXHUwMDA2+sWP2jFraENcYsSs3CFa74lcZlKALPvzN6vx86THXHTrWr/oXHUwMDAwb2rb85RVXCIlXHUwMDBmeYLnvznmrlx1MDAxYuZTSVMo9/JvZi+SR3Bam/Q6z3DmazNcdNNcdTAwMTFiydHTXHUwMDE4RmGNjObP1as19l+xXGJshlDpXHUwMDE3kjDNtKjzxbliyVxudP6bi9wtNc5GtDXZk+W8+TRcdTAwMTGAdWgnm2fkJ3h/fiNcdTAwMTJcdTAwMDBcdTAwMDDbMFx1MDAxNIGjQP1bW75cdTAwMTVcckwnR6tcXLm++YfT7cTbmj2/ct6uWfgj0/LTdiquYblcdTAwMWWaXGaL0z9b70PEK01O55VT2l198Pyf+tl0XHUwMDFkkiDmrkyGuLgwXGLDLthw1nFSsy7VWWbhWr6605pMY1aEcvVtjoTLK1x1MDAxY45fxnBcdTAwMTC0Myrz3bVcdTAwMWH53Dc9r67N1YSuLuzzolxykVx1MDAwNXOAxnCrXHUwMDA1eKVcdTAwMGUoVUmxdlic2lx1MDAwNFx1MDAxN3W/XHUwMDAzV9fN+DihLfrksD+YXYgnfTjFXHUwMDEzflx1MDAxNlx1MDAwZYnjXHUwMDA1Jp5Oyb+aYoZatN46XHUwMDE4XHUwMDFi6Vx1MDAwNz7pMTtZXFxcblx1MDAwZtTPtc8vzujwQ9OhXHUwMDEzhPFcdTAwMDGGQ69WMT43XHUwMDE3KlA8b0y8vviIXHUwMDAyXHUwMDA2J1x1MDAwM5UrlXFvrLNjQUx3haK+89ZpXbe5XHUwMDEyXHUwMDA2Rz90XHUwMDAxV0tcdTAwMGV5fOhcdTAwMDUoXHUwMDFmXGKz+5tGRs73V4vQkGiXIFx1MDAxNqF+yCZcdTAwMDHUv/i2XduzRWluSjHPXGLoXHUwMDE4uUp3t1x1MDAxZDV4XHUwMDBmaD7fgnX8eZZFXG5brEtcdTAwMGV2X1x1MDAxMp1cIr7ncVx1MDAwNK39sjGqrL9nx37UnbZ+J2NI49W0rC6IaHZY5PvrfrRVXG6Op8BcdNOlbTqBo3H1SstcdTAwMTDHLmwpVyGEXHUwMDE5fFx1MDAwNKGQXHUwMDA3iWvGpLbqQUeL/kxcdTAwMDLdXGLGcjmyuFx1MDAwMlx1MDAxZXPd9dHCiqRFyHx6902pVpZpXHUwMDEz1WC8/CZ0XFwtyFx1MDAxMExxxUZaOztcdTAwMTJdQmb5XHUwMDBi3tB0bIRjXHUwMDFhmsGA7Fx1MDAwYlx1MDAwNWnesLbMundcdTAwMWLUepO9u0LRPXj4N1x0Sm/PI9m9epWziYVcdTAwMTOhmb+5aeXf3DShga5cdTAwMTJcdTAwMDVjR8FccrxmfyVJXHUwMDA1/uridqWei640T1x1MDAxY9K7ufUx3Z9LVSTX3/Nef5Oxd0I5jZRr/fc9OWH60lx1MDAwZUVLb3Pb59pv3lx1MDAxM5fE3d9jjVx1MDAwNIP99HlcdTAwMWTN2FxmeOio225EJy/d2JWFRttcdTAwMDeCXHUwMDE4pYSterWeXHUwMDBmLHzyXHKRXHUwMDE5Z6+RXG6qk1xyXHUwMDFmUTpcdTAwMTYwnJlFkIHiXHUwMDE5kEdzZezPbeta0MhhOva4efiJXGa8vImsTrpZbcx3fHFC51x1MDAxOdmd+CtFMXGnkydEnYnykPZcdTAwMTHdmYzQwnHx0T5cdTAwMTSBaVHUj1x1MDAwN1wi3PbvN+hcdTAwMDWa6mtcdTAwMTHC9CivptUuhVxuSrOXMYjzgFOoXHUwMDE1XHUwMDA3sXumWTiW/ZuKXHUwMDBmXHUwMDE1NVx1MDAxMNXKvVx1MDAxM1cz90rnp1iJM500XHUwMDE5SoNgmTPNzo1cdTAwMTONXy5JXGaegV5zsvnM4X7hyO7tj0FSISxcZlx0fWnxs7NcdTAwMDdOXHUwMDExXFxr8a2eXG6H/7yCz4Tvue1cdTAwMTQvXHUwMDFmQXaoXHUwMDFkvZF+zJJcdTAwMTQ+ybLVs5vwtW4jXlx1MDAxYZtcdTAwMWKfdPLdilx1MDAxZN8oXHUwMDE2z+bcW6i/J1x1MDAwMeFhYEakZCu6cCGza+s7TFx1MDAxZr/khS36+YWVTIeQXHUwMDA3UNtlPsqEXGJcdTAwMGVF4ihBdVx1MDAxZsAoYVawPyxn5pdcdTAwMThQ+zvqNnFwf88s6Pa780OdmkSoLN1son6UOVx1MDAwMsqnMstJJ0zSio+z+1trKr1JQlx1MDAwYt+J+1xmN2ldkfu5xd9BwetcdTAwMGb7XHRajrTjz8NIalx1MDAxN1nQX+yDfFBSJeju4rE9uYt2Ja02kDjvXHUwMDEzaLBcdTAwMGLv14BpTNPIK7BcdTAwMTVwjuQ7lGr+ZKI/pFx1MDAxYuhcdTAwMDRcdTAwMDNNrkkxjH1cdTAwMTP897e/UpBF1tWC/oGmQHjIRMp6tCWhXHUwMDE1puGEdFZw6p6pzbzMpOw4mHBccoLybf83r1xcXbD29Fx1MDAwNXmIn3gmRlx1MDAxMPJcdTAwMWMwXHUwMDAwrvxcdTAwMWOspaRcdTAwMGLsXHUwMDE3bdKM2ssnv9L0PfK44unUnkhcdTAwMWS1trWAIc6L4VRcdTAwMTmJZ4tcdTAwMDOCML+9t0VccmBcdTAwMDJr+bmQfcxJnXv+clx1MDAwZn1zb/ybXHUwMDE3qn44ISQ8vmIon/aKI3Eu9lx1MDAxZD5cdTAwMTTSnsNqb+RcdTAwMDPuXHUwMDEzXHUwMDEwgDf8MYmtvVxu+qlF4ClrWk2eXnNcdTAwMDGquFx1MDAxMIQlflVcdTAwMWFm8cuIZV6SyoxR6Vx1MDAxOO3+9eOfbGDq7uv7Tlx1MDAwNcbxyyWR+1x1MDAxZadNdj6xeTXMY49cdTAwMWaTKOGk35LANX9cdTAwMWLjREtcdTAwMTBcdTAwMTBcdTAwMWP/vVx1MDAxZVxypCeHZFxuLPitXHUwMDE0bz8/5ytJ4Vx1MDAxY8ijpFRcdTAwMGa35lx1MDAxY2bqUaxsXHUwMDE1XHUwMDExt/c7srtpLFx1MDAxMPOUvqCxkFx1MDAxMtk8/SS26Fx1MDAwNk9C6a/1lipLW8vWviiWecbpxsCjXHUwMDE3pfK6I/VzfszdcFxyXHUwMDE0zjq+QbF+o6RcYnUjXHUwMDFiSMCcXHUwMDFkNZ3D6vWMXHUwMDFk91x1MDAwYir7I/Al47e7XHUwMDA1z1jevk2XwbIuPbrRUXk2jY/lbmg3XHUwMDE5VFlcdTAwMGY0Vpf1S5JcYknkdjqH5HrgVDpRr5XpdW4oJlx1MDAxN5ZFLWixoza2nXY5XHUwMDFinbEn1Er3/Vx1MDAxN4ikgPesZDr4XHUwMDE4XHUwMDEzbd6tXX2LTPdM+Fx1MDAxNqwxrbx+1pXZ1tnhXHUwMDFhZS+twW+SXlE20z+fcTowLC+RPlx1MDAxOepBXVx1MDAwN9BDd/tbg3OgYVxieHTQy0tcdTAwMTTKJFxuqVbKqPD20yqetbm1i+iiYXdiXHUwMDBlR7r49DbkZaY3boSb5OonKtNsNfundqJcdTAwMGVcdTAwMTb+1tLRXHUwMDE0Y1x1MDAxZIdwXHJIT8Mng/NwbEmTru1IKYJcdTAwMTmwn/OR4rc4y1x1MDAxZaOh8vJ81yC3kYOGxFx1MDAxZqPoJTiEVGbSLPJCkPV2V8xZx4qn+MbElHtcdTAwMTNcdTAwMTKihGvYwl5cdTAwMTBcdFx1MDAwMrxx5PJKPW+SXHUwMDAwjPHy7SNcYrR70T2d3Z5kM1x1MDAxYlx1MDAwMHB3L03k4oql85O/hOn1QWPTaZ586d+Ulu2zh9x9XHUwMDExXHJCXHUwMDE2h5juXCJCetZ1XHUwMDAyXFz39162NemUJOJo4fe1aeJ7PXu2XFxcdTAwMTdDXHUwMDE362/7e6ixL1x1MDAxZEbOXHUwMDAxjc1WqtFcdTAwMWFb5IX9SCTP2lwiR/pbPZdQh1x1MDAxZFHlL59/m13KyVx1MDAxMn1WyIafcYT85YmBKicxdq9TkEjsd+z6wfnabZ5f/Eb8ikqmhpOzkZVFMOWjU5nzW3xxlfWDeoZnXHQ3SOnVXHUwMDE0VoGSwuBNIH9Ur9piK6hcdTAwMDS/N+CPNMywv3l34+AqXHUwMDAzytzxafBeMp6hXHJcdTAwMWQyL0dcdTAwMTb0XHUwMDFhXHUwMDEzRkzSVOP6Udd/5rT8J9dQllVpnSq6UVx1MDAwN42Xcrf0TXtcdTAwMWXC/ubDlDar/tKBW1x1MDAwN3Ks1Kirme2EqZZcdTAwMTlcZlx1MDAwZdT0XHUwMDBiL2r/7Vx1MDAxOVx1MDAwMFx1MDAxM1x0nn17lfrBLozf0fLj7LNLz+63gWGWsiVIh3+w6q7e7FXb9v3tVoD5XHUwMDA0I3kqr9JV7UBD/KPPTm+CNzzUtFx1MDAxY5ypXHUwMDFi61rOXrB+3Vx1MDAxNmtcdTAwMDHTdnVcdTAwMTdlXHUwMDEw+2ri7lx1MDAwNVL4Vsu8MrvjUTh2mNjUeHNFS0BGqVx1MDAxYb6jXHQ1znvWXHUwMDBm44g37nPXXHUwMDAy3Vx1MDAxZex+XHUwMDEw2yft8GHMcvNcXFx1MDAxZvZcdTAwMDPeo43WvFx1MDAxY237Ms8tb8pcZlDTXHUwMDFj9OlcdTAwMWHzjVx1MDAxYqYyia9QXHUwMDE24MZov21/Tjp9uSiHYVqaeuyHae/n6sxcdTAwMWZAMjGqrP6uXHUwMDFmeZLu0Lx7R+fiZ1x1MDAxNsIhXHUwMDEzp9RJb0ZcdTAwMTBhXHUwMDExIUNxXHUwMDA2jrLU+IvMysIrY5pjXHJHuLSJ6bj5e6mr/K12omNoYXIrbprFsWW7cjeKNaDp4kvvSkJvRYHYMNI6OFx1MDAxZlNcdFV9yKOodHDcaVx1MDAwZVx1MDAxN6PQY9ZcdTAwMDJiXHUwMDE4Wr1OPMBcIp34XHUwMDExXHItLLt4XGLRulx1MDAwN6GZekSFU16zW1x1MDAwNVt+TmTpc70oYp+QcIhEUFwi+4TZW08lkKI6XHUwMDFiqFxc5Fx1MDAwMaXppMXD3YT9po34QNBd7H+4XGZcdTAwMGKyxovsV8vEZVwiXHUwMDExXGaBxvD+PYWWdOGOz1x1MDAxM/zTXHRgKaF/rzM+Qtv547uNnCyTJiaPNj/53TUvwZuIXVx1MDAxM/bD9yxgcmye11x1MDAwMY+WckzjcfYrOP1TwFx1MDAwYspcdTAwMDHnt+P0XHUwMDAyYcuj3VScqpF+L9FfcmGw0oDPXHUwMDFimFx1MDAxOKCtoqb1Z1VOrlxcQF92/lwi2d/855OfReiXf41cdTAwMDbjrUk5QvwzXHUwMDA0L5xkl1B+2PzBMfmIbizgbKfR+80lPHn0XHUwMDA2wlxyqtmB6Yae31pcdTAwMTlPTVXyNJdcdTAwMWbsy7H7ZTTJqnukXGJsMlx1MDAxYZNY3kRcYqSyTSCRd1NcdTAwMTKsuFhu9VnC3Vx1MDAxMThCkXlTnFxc/1wi0bbYtbFUc9rlY6Xd3vPwXHUwMDA1/p5XeenPP+tcdTAwMTbY19Q+TH7oy8S/0IdcdTAwMWbEvZWt/nVCOoaPk4Vg/HVcYsGb2fuCXHUwMDAy58VcdTAwMTn3aWh2b/zC/OXPI1x1MDAxMGTnRTCut8RcdTAwMGKutE+ARZ2zfSDwVJOehy2MaI6/PsL2lyvJXHUwMDFmSbC/jvys1KFvcSs3v9+Wtd1cdTAwMWJHlVn7OE2r+sSANOBD7HFeqKwrlWnbXHUwMDBiKzbH96tPXHUwMDE3O1xyP3ZpXG6YjGmiVoBwo/LIPVx1MDAxOFx1MDAxN4fMXHUwMDBmRvhcXJpcdTAwMWImQ1k/i7SPXHUwMDBmXHUwMDAxiSNKRlx1MDAwZVx1MDAwM5iy7EHmfma6XHUwMDFlLOZryu5ecZ/2c7/VJ+5cdTAwMWFGsc1EyVx1MDAxOHmGeJWfhzWIW1x1MDAxYXhCokGLaVx1MDAxM6s3SyHfsFx1MDAwMCr2XHUwMDA0nVh1zj9cdFx1MDAwNkg/eHTEz1x1MDAwZtb8XHUwMDE5Oy7zXHUwMDA0aHCbXHUwMDFkmyv6olx1MDAwMYaKS3nEXHUwMDA0VayfXHUwMDBmSWPemJRDaiQ0aFx1MDAwNEaKc6K3lL+COVdUtWk8vVx1MDAwYq9cdTAwMTW5sW5cdTAwMDH+buWaVmY6z8Pa8Z4twVG5ZkVzt0aaYq1FRlx1MDAwM/vj3/Euclql9bTBxbZ3zppJVeCBksrrYVx1MDAxYoT700RcdTAwMGZcdESzXHUwMDEwt0akyTZ/MS9FJS9cYpXx0aX+fIT+V2a3fc9uXHUwMDA1rFx1MDAxMpex23SmjUFuxflcdTAwMThHiU6E1p7S31x1MDAxOEshVYJcdTAwMTVcbsB+Zlx1MDAwNI5nu3FcdTAwMTVcdTAwMTX+PIacWZnA9Fx1MDAxNYYvQ1x1MDAxNYSO9Pzcp8lKIS9so1x1MDAxN5Qn0zpxS3CKYHhEsOdcdTAwMDYyIdhRq4v9IVefQaPNQG0slpFuYL5+c3lvoVx1MDAxMzm1sq9XXHUwMDAxX1x1MDAwMW0jUfjjgO0g279nc878gjD0uzFcdTAwMTA6XGL+mlh6UjU1QtWmlfRYjiNFpXvm96ryXHUwMDAxT1xy/jeFx+6mjp9nJOSeXHUwMDEyMamOgcyZoVx1MDAxN87KT1x1MDAwZVo+XHJSuFx1MDAwNVJpr1FpXHUwMDE3XHUwMDFj98IzfLpJoiv6m2dcdTAwMWWfXHUwMDFh/CP8Oipi91x1MDAxYlx1MDAxNP+0mlxyOlwi/LvcXHUwMDFmw9pC8nzFoujfNX9cdTAwMWR+s+N0/Vx1MDAxY1x1MDAwNizwXHUwMDE3oumAvCy7gdVLjlKjvlxuqE7PXHUwMDE3MrMkvtVmjqxJOL74T389XHUwMDEz5XBcdTAwMDPWX/ZSXFxVXHUwMDE1PJTEuVx1MDAxYe55Wp6re6tTb1xyP3DSTXYgyXxle0OfQar3aDXiMu9cdTAwMTeXtlx1MDAwMezF9UE4qVx1MDAwZV/2iCWSJFdcdTAwMDU/rGfGPown+tEgXHUwMDA2qrPDIF81XHUwMDE22LxaXHUwMDAw++t3XCKtXHKWTvrx5IXvo7zqeMWKUIIvIF1WWFx1MDAxOCGdbrhdXHUwMDE3s1x1MDAxN1x1MDAwNFx1MDAxZlx1MDAwNXIyPnvHRlx1MDAwN8/TXHUwMDE161/Xd3hFXvW+0lhjnFx1MDAxZu/w9IB71pt2V6m4XG64rtfcnL6tlsV3z9f6xZU6Sp+BXHUwMDE5PyhOJ9lLJqm78i5OkyDityY1nlx1MDAwMEJcdTAwMGWHhpEj1S+hsrC2XHUwMDFkv8Q6o1x1MDAxOHhcdTAwMWPoZXA8fVx1MDAxNdpTjk/bXSzLRkHcsZ5iJFx006b7r/NT+bW3ocM22diWgFx1MDAwM8xcdTAwMTJG/+t6XG7Kf2tdpmid1qGNMVx1MDAwN65OLlrLXG5M5srHabr1OUv7SWqVK0P9W1x1MDAwZuhcdTAwMWS5Wfno2ZVaXHUwMDFk9Pvo1mxcdTAwMGa0XGIr+lx1MDAwZq1fllFxc0JcdTAwMWTmTGhlOsSP312qQWS5jsWAXHUwMDE2eK+7XHL4m+5TgFirk/NoWtdcdTAwMWKWd99cYlLYze9oNpRtupN/bFOcgqPFj/7r6HtcdTAwMThcIlx1MDAwZkrzxUfyeW7qXGIyZFx1MDAxY1x1MDAxM02zglrlUutv9FJuw7dcdTAwMWHHyVx1MDAwZu/ZPbR0/DZXSbxSeSNATrfLyltyXHUwMDAx4+1J2r5db12psndnf6S1ryNcdTAwMTPOfrDSbzudNlx1MDAxNOag41I6qlf22lZsQVxcXHUwMDE4vWIwiK9cdTAwMTlVgpr0oHho8qsmmIdcdTAwMTf2XHUwMDAxy1x1MDAxMT5lNWaIz9JcdTAwMDXnskU7SHNcdTAwMTFCz1xcPJpcdTAwMWLSfG7pND3Msl1OdIxCXHUwMDFkg2QwjFx1MDAxYVxySWNy8td7oMrFP5UrkFx1MDAwYlx1MDAxYyjU7+/GKFx1MDAwNj3qTsFDXHUwMDFkr7zT3XUn5C9l2X2tlE4069Bb3lx1MDAwNule+pdmXlx1MDAwMcMjQ0JtjPyAnHdR+6lapVx1MDAxNOm/7zMpalx1MDAwZbN/r205OMOg0S08se9Wv1x1MDAxON6zWZdR1KjVrVJA7JjctVx1MDAwNTmXXHUwMDE431x1MDAxZD8xoVArrlx1MDAxOYGzj5C8oFxckOanut3ReuYoXHUwMDEz+UxEMqI/+lx1MDAxYv/UXHUwMDEygoXTZ/2vKt+B3IGHxjtcdTAwMTmGpdW2XHUwMDFlUiSm9UnQXHUwMDEzaIXoXHUwMDE0WkYnXHUwMDFiy8S2XHUwMDEzeyb3XHUwMDBiXHUwMDAx5jLOvNXxmUlcZjkoXHUwMDE5XHUwMDBixmE086tpU5vN0abmanqUXHUwMDBmoHaofPu8yLtjtFZz/cVGu1x1MDAwN1x1MDAxZatgpj1QLUH1lDFrXGK3Qo1/1mV2XHUwMDFk9HKVi4SofsF92V7hXHUwMDE1N9k7XHUwMDE2ri/RbzOyc/5nfFV2pHHGeovh6lx1MDAxY1x1MDAxZCtW2oS18HUgxcxnVVxcXHRcdTAwMTJcdTAwMTHXsz5Urq3er1A6PLNcdTAwMGV9/eJvfGyZXHUwMDA3oyinuo7Op2qFKkZuXCKvMWOotMDtWEhcdTAwMDRxToxcdTAwMWJcdTAwMDHggUH/Wl+p2EnlRHRcIuVGeFxuO3Zak/ey4X1A6lx1MDAwYnaDhyVLJUdVdGecNNJcdTAwMWUkZ2YlRqdSKvDrPkZFbC28tDVgIG5cdTAwMGVyLoCBNahcdTAwMTnmhTOterOxlzlVVlGNS1j2z9Mj8LuWrG+0pc76XHUwMDA3sqA9/0vvXcZTXHUwMDFhQ1xm4ZX+ZTZ1glx1MDAwM+7nI0O1knpR/KLUXHUwMDFkNeqXlcU1UOeBnpIsq/GmQVx1MDAxNWz0XHUwMDA34efItr2q9EjBXHUwMDEyvOu80dV0sDacXHUwMDFja1x1MDAxNZiyXG5KcqfMudBcdTAwMTZ3iq2JzVDlXHUwMDE5/MElcXvdR65cXK1UgFx1MDAxY/pFa017XG6G2IA4KvLV6Vx1MDAxYUIyhHl+7PDXe9nLXHLt3nyZnGFvgdhcdTAwMTEvTlx1MDAxMyfKXGLYXHUwMDEyXHUwMDAx+rhcdTAwMDWDZVpcdTAwMTGibd9A0qxkuIXW6lSIumVdKzGJtrCiPiP5dZ59psdpbYbXXHUwMDE0s1x1MDAxMvpcdTAwMTPRW3t6Vc3YYVDn2dTQM6WLgdNuiTtJXHUwMDEwgshcdTAwMTXmNeXt6/RpJZKdXVInJFvzdkf57qFikHlpKvPzquas1WqPSnh7flx1MDAwMJjTXHUwMDA2j96UrI/ET3DZwFx1MDAwMjG2XGLFrOCNpJP3KEE3immd2mRcdTAwMDRcdTAwMWZxfFx1MDAxNaRcIr/tczu52EEraSTSc1j2Q182Z2cmrzFcdTAwMDDzIcCkvv3jiMhZwGAtsd0q/DRcdTAwMWPwfp6QILdChFx1MDAxYoy6yFx1MDAxNZNk3Fx1MDAwNj24sH0+a+Z1fkyuXHUwMDEwzFx1MDAxOPTiLV337Kh9zreCnYaM5t5cdTAwMTZC737R9mpcdTAwMTBcdTAwMDPExVx1MDAwZubQxEFp7WNWp+Pya1JN0cuRLa9e4HbJ6Vx1MDAxNlx1MDAwMtKVxGVFqDM8WL+xXHUwMDA3XHUwMDA1waw+b+Lxhlx1MDAwYmTNq429nF7Q63Bnm+aYgCQhKHNA28CmbeLIz0BM0XfWL5meaFx1MDAxYeW00O9eqsh2JKx1w335pmqbZVn+LnxcIlVQXHUwMDEy+cAtXHUwMDE5sFY1szKvdiRcdTAwMTKFL3ogoFx1MDAwZTj9e62IIPd0Y7PJLMPxXHUwMDFh6VTUtDzhzXWR/j0j7vZ1h6JjXGJTyD0hfzHNXHUwMDAyPS1AljPNxtfG4fmicrbYpVGPrFx1MDAwN8ZcdTAwMWNcdTAwMWalZsR4gZTVsb8gUFx1MDAwZi3lXHI6XHUwMDE3IHErXHUwMDExy4at8MtHVOhfrqolMof3vjG9sdjX2TmrcfdcdTAwMDW2V7iZv3dA4sFkdGFKUKk7+Vx1MDAxY8WjRmVXjOTj31x1MDAwYlx1MDAxNvxcdTAwMTbSRi5L21x1MDAxZnilXHKJ2rTrxJXSmJFcdTAwMTG+uX5EKLf2nuVRrEo3TYxcZqjk/lx1MDAwZWg4S1fzXHLKXHUwMDE1I7tYYPjnMmpIgVJccoaJT/tun1x1MDAwZnZcdTAwMWFF9lx1MDAxNPEqQvNcdTAwMGUnstdcdTAwMWSXtUFIkvxcdTAwMWVlXHUwMDBmm1x1MDAwNr5/XHUwMDExIWZcXOrb9IdFRJ9cdTAwMWZcYmGs6ZzCVb61KN/o9pPWQMTlXXcxOG252ltTd1x1MDAxN5pZV8NcdTAwMDOqid2zIcbj2nRn9rdDgFxuJnRrryHNSVx1MDAxZofeXHUwMDE1XHUwMDA2PmJgjWu6pY1cdTAwMDTIcJB77dCy5cj8XHLxasQjXHUwMDFkyd5KXHUwMDAyoCzMY5XortLPRqv2LmxMVTZcdTAwMTGrz4lr9aB8s4b9XHUwMDE2Ny/LNl6zsYTS2txcdTAwMTPpaldK5LGkhCtcZlx1MDAxZb09XFzMW4gxQHA205vQzrc+y9I38dqOuudkXHUwMDE1ICjlmFkjvbCQUZ6crmGvXHUwMDA0gessz/vVdSyAmfVcbrfUL6fUUC+vKbQre7yZmupk/lx1MDAwZllnse66ll3hXHUwMDA3UkNMTTEzu2eLmfHpo12V5Mut9M5pbFuW5lx1MDAxY+NcdTAwMWZLXHUwMDBiuEw8ZedQbVx1MDAxYsGWXHUwMDEwxz9cIm4zoFZmzFx1MDAwMp7MXCKo4vH5XGIo+mFtnpyE4Vxmm1xc61VcdTAwMWPnRUbh+rLF/Y+lXHTtXHUwMDE1XHUwMDE3KVx1MDAxZctbY4HbaVx1MDAwZkpmYORz3crcKNqrdOZgopBsN21W3Vx1MDAxYlx1MDAxMCXC4ZXa/X6/zzdcdTAwMTFWt7bCfMWU9XO0QMGPzdp/x/RB/oumcrJ1w1x1MDAwMFjuXHUwMDFlbCxBQVx1MDAxMFx1MDAxN56hXHUwMDBm0FxiXHUwMDFiXGJnXHUwMDE0+GCC6Vx1MDAxOFx1MDAxZSBxXHUwMDEymjD//ZmxXHUwMDEzVLFcdTAwMTGBOPJcdTAwMWGoXGY+/3/+WFx1MDAxZFx1MDAxOKf+1jz3XHUwMDExfif9OYRcdTAwMTCygrW2vlx1MDAxOUHvc6klI/RTveWLWeFJkdxDXHUwMDAxx1xyRr/tVnj0XHUwMDE3OKpcdTAwMWJcdTAwMWG6wJlcdTAwMDLj94yscrW1eXlcdTAwMTN7aTz+dsSBy1tBJVxuy0CDzWx7lldBXHUwMDBmfNfpTr3/XHUwMDExlcw0qqE4WH+xTFxyQzkt1CuAOp1e77Z73zQzwW+yXHUwMDFl0FqNLsNIa+9bp5X8935cdTAwMWaohHFcImLOXHUwMDExR2Sobt3KkOJvzEBWpzvDXHUwMDA01WtqdbJP0ih+q7d2jip8Mq61uKiDWoXk6lx1MDAxNiZXzszLq/WrnU9f5GdcdTAwMWSK2q99hWmnnJWoViU7Z4ZtOT6a33xcZvFSXHUwMDE4XHUwMDFl+nVcdTAwMTfoXHUwMDBmb0ZFsbZYpEDnS+BcdTAwMWOva1KYnsPweI1I3V/rmejarC2BMlx1MDAwZYJydmxcdTAwMWSPd1x1MDAxMDw5yFwibFx1MDAxZMFQQTBhm1En3oNcdTAwMTeqVfDq3rkntdBzXHUwMDE4XHUwMDFhXHUwMDE4XGZQ7JXKoPuErCqVUcBMnNB70OdcdTAwMWO92assklZyXHUwMDExf1x1MDAxMu73YinFK31rIS1g4PJltbeVXHUwMDE2XCJ9f09cdTAwMWH41i1cdTAwMDOUJsm/5sa+lF03bSE1KV9cdTAwMDbkUdJccnWcxLdtNpl+Vv6qWNTURE1jJ5tX3Y1cdTAwMGKW6+0vXFzDU7ZV5SBj5iFqofZN6W1A8yAu8fdN1cZcbsjOr1NcdTAwMTilxlx1MDAwNWKd/nZoZk0xRHRcdTAwMTDGXHUwMDE0x1x1MDAwMmDTdieR8lx1MDAwZf1cdTAwMDJ4+SdA5HBcdTAwMDHmx0XE9YfYpanFnyWSWi6WPC9nXGY3XHUwMDFmIT0ycS9tS0d7v72Kel9OXHUwMDA03oXwxsFRXHUwMDBm4og+oVbn+9NcIjXBYvbVOsz210j+XHUwMDFi21xiQ+b1vNE8u7o+7VKGS4g5hmI9vEdcdTAwMGKOZJeoI95cdTAwMDBI9lx1MDAxMlx1MDAwZTK63XtcdTAwMWOnXHUwMDFjJ1pzxMXedu1XXHUwMDBiLohcdTAwMGWmJd9EfmVcdTAwMDBtXV/OXHUwMDEyXHUwMDExQUDNXHUwMDEw4slcdTAwMTdr/uFFfy9Ky7NcdTAwMGVe0f5cdTAwMTjfXCK9XHUwMDBift0wslGDpti4aIxe4MvYXlt/wcuhPcKC3sv3XCI7ukYnXHUwMDE0oqJ/MfJ38btknr61mWxcdTAwMWSXbYl/06pmXHUwMDEzza1qO9NqZizZmXHwXHUwMDA0XHLTL5IqR1x1MDAxOcpfYixiitlcIulccirS57OaY3G7xvtcdTAwMDFn6Fx1MDAwNIL88M3c1lNvk+trXHUwMDE3WYDhsipcdTAwMTJcIv9x4r0vVu5oy6Q1XHUwMDAyTVK68Vx1MDAxYTX+ZStPMFx1MDAxYUataGYjPlA/5OvPyZYzcaS11GCtpYWohDnTa6fWIc25tcTMcfLc/oSvYXZcdTAwMWF1v1TwWPab8lx1MDAxZfVGJYlcdTAwMGVdgpnfXGbj0Z9K4tr2LXyHPTJqs4SSJVx1MDAxZH1cdTAwMTRcXIyx/Wk5c4En+O+FaTyRQKPhzGO+nVx1MDAxMMjSqW2dJnE4XHUwMDAyLSjeOC0ve9W3wIRcdTAwMTKrXGKdXHUwMDEyXXN5eaxrJ3Kl6uXfXHUwMDFhjlx1MDAxY1KwY3WAsqcj5W/NgJ7Ud9kzVFx1MDAxObbxgJnPXlx1MDAxMTZcdTAwMDJcdTAwMTKYKL+efZBcdTAwMGL+5sK+vtguM1x1MDAxNbbTTl1e4VLbX4Lj1Ju5lE9Zfb1S9X2BcVx1MDAxOWNq1KnDPkYk9zZcYohnLX3EKihcdTAwMWGC+XWfT1x1MDAxN1x1MDAxZMPf2Or681S7TUfAXHUwMDAw1ZNcdTAwMTSebuUy/yb571x1MDAwN5qpojRDwqiTVnSZtlxc1N5cdTAwMDGsiLbXRlx1MDAwMG7EvivZ40SHaX7nT32fbGGxoexs2Xnj5rJ6cI34XHUwMDFmk9m6yeSVrWPysr77snDYbJlcdTAwMTaH4v/eK8CXulxiXHUwMDEykp9t6IRe6Fx1MDAwNSNNrCNnn7/e4Z/PI5j0XHUwMDAz4sxIhKL99CycVSdBZrtcdTAwMWR/TIf9pLxcdTAwMDPfmYs0gFQgyX+OXHUwMDE51KtcdTAwMDIz85tNXHUwMDFj1PNcdTAwMDS/uShGh1xurX1cdTAwMDM75cVEKW/qXHUwMDFivJmfL/Aj1Fbq/eFcdTAwMTK2n2TRu1xi21x1MDAwMTC/UZwyXG6NXHUwMDFmXHUwMDE2dDaBKZ/urFx1MDAxY+jVt88u4SVly5uhifJcdTAwMDevVZZxWbpBylxi7o45wdV2vLLa9XJAZvxkVoTIqcuzUU7ycHZCdN2q2PI3i9KQW+Z97FTIXHUwMDEyLedcdTAwMDbb+uq9/lx1MDAwMLGWc781zjfsbt3kmlZ9UuLz4JKJtfKEmET+YtjbU1HN/DFtO2bF4WrqsnZcdTAwMDYyj66DyVWAT4VnaY6jPzBcdTAwMTU6MkB279x258tgXHQrxHKKXHUwMDAy3svSJtZQfVx1MDAxNnWlp0BcYkeh5VLymWOFuUhcdTAwMTR3XHUwMDE2hVxiXHSnXG6ERX2WQpmROqIkXHUwMDAyl2J1XGbqk9VK98KI3pdbmOxYsP71yeCg1lx1MDAxOS2sXHUwMDEzZ0pcdTAwMTHjwPFmY2VqyFx1MDAxZMBcdTAwMDfuJOtcdTAwMGX/Tlj6NFx1MDAxNvFcdTAwMDZhxHKbOi85Tpld1uyRmjNVx2Wdblx1MDAxNIe7THP7vCRcdTAwMTN9ce0v2aWDclx1MDAwNrvm+ZlbLFx1MDAwNkPwXHUwMDE5+Jqh5/Q+QiE7mFx1MDAxNDdcdTAwMTP6+UdNK+2UqFx1MDAxON5tXHUwMDE2ppOShqL8Ny+ywIC0XG4/xrchuaJxXHUwMDA3XHUwMDE4lIZlXHUwMDE0ilx1MDAwM+E1WrRCm1x1MDAwZnacqpM5qnrjXHUwMDAyYnREgqpVfEWrXlx1MDAwZp9ZXHUwMDAxYv62uNNqXHUwMDA1QDqC18FcIvg7TlLLODm5rd+CsftKTF3kXFz3flx1MDAxMlx0SL/0aCBahklcdTAwMWGjqlx1MDAxM4eiv1x1MDAxOWw+OCsn8jzIcUBtp9fJXHUwMDFilVx1MDAxZsdDqVx1MDAwM4pcdTAwMDDMTdN7iXBarSueXHUwMDA171x1MDAxOeYh4N+Sw2lcdTAwMTS5z48l2cCc19nvvVx1MDAwNOYjekdHXHR6802s51x1MDAxNVx1MDAwNc2C652vR1xiXHR3fM62XHUwMDEyYVx1MDAwN2Hs7+ttW9iEd0dEXHUwMDFlSm5cdTAwMTZdt2yhe6RcXK5cdTAwMDBynpvEJI8uO4Epns/KXHUwMDE0yOSgRi5jolWPN7iAR5zcJlxu+1xyPVx1MDAxN7HDVFx1MDAwMVx1MDAxNfQ9PmIgspMqyNvk/10j9Td+UMGGXHUwMDEw8XiiXHUwMDFlWypcdTAwMDDVnXFB3j+McT3KXHUwMDBi61xmg1x1MDAxY1x1MDAwM4Jr2kepklR1Tq9wQshAJjt9KOZvn3Nf9a7yXHUwMDE0bKttXHUwMDE1/m9P0zBcdTAwMDVcdTAwMWM+MyT290K3pn1cdTAwMDNcdTAwMDXiXHUwMDBislx1MDAxMOvukVwiVlVSx0vD51x1MDAwN8JcdTAwMGX1Pl/27XLEcWWFeab4ys1fynuNM+kz5CiBm37i1Xf3Vyguun0/sZHOL4dcdTAwMDJcdTAwMDS96IbGP39Zp0/jRCDgh7FcdTAwMWR3t3L17WLP46yx4l9cdTAwMTFVc59ccor0751djeI4/bLIj1BWZVIkcqh6zv+JvOOFjKSRMyqjXHUwMDFmtyiBWaaNXHUwMDE43T20QqnnR9HKqEP5n+mIXHUwMDBi2s7U8U2juZo4revtr/dqzPxcdTAwMDXiL+e+0YpqXHUwMDE5lpBYvFirXHTEriStboKZtnTVk1x1MDAwMf2V6VL+vd1kqobzXHUwMDE5XHUwMDEz2qZP+4pcdTAwMTnXStJU55l7MSXbh+PsOLtNQj+5Klx1MDAxZkGcZ3n6XGJXybVcdTAwMDWZXFymktX2yOx7XCLEXGbNXHUwMDFhnStcdTAwMTnqI1x1MDAwZaDIXHUwMDE4xCBw04F2bn5PTW6jJlx1MDAwNEnGVe05Mn6UObFugkc/OUG2+s1poVROe6vMjJiUZZQlutpRr2HUX1x1MDAxYVx1MDAxOVF1UVx1MDAxYeTDXHUwMDEzrK6vRU9upeNom/Ktf8RWgtVcdTAwMDe3LexkXHSgM977XHUwMDEyjc3R+LBcdTAwMDVWnZ+Cl2DpcWuUosWW1oeqdlx1MDAxYTDUXHUwMDAxXHUwMDAy6zf8RLmEyOyHXHUwMDBlcGGwrDhcdTAwMThccm8rZyvVXHUwMDA3nVx1MDAwN9XdsDUmY2RIU/A9Nt8+xN2nYoCm74bmb+OPZZT6W1x0q0+Vv1ne8NIqXVx1MDAxZD75VD3zZFx1MDAxYVx1MDAxMlPJpomG2is7kGzOmYVnXHUwMDBmXHUwMDAw5kn8jnmQ5NiOX9xGSkqEeil6Jm6hpeKkQedthfTYolx1MDAwMGNcdTAwMTiOYbzAZUP7XHUwMDFm+5S/ttQyUclcYlH1LFxmUPMjwOpsxu+GqjHBQUQ8XHUwMDExq1x1MDAxZt9qSpHA+G1bsDdVnpPh4Fx1MDAxMdlRrbn1cONdz1x1MDAxN0xcdTAwMWVyOVx1MDAwM1x1MDAxZVx1MDAxOLOHa7ckgkCVXHUwMDE3W6eW1ywsfkt5lKusVP2CO61B3bFjj+xcdTAwMWVcdTAwMWa9XHUwMDEzXHUwMDEy3qqZ5ddDbFwihTb3Rt4mTJSgQXhkcrM6UVOf+liDOGvfXHUwMDE3dsKRlt5AZe9Ani6IqirKl5NcdTAwMTJVXHUwMDExL7piNSZkPsjckufwO1x1MDAwNGVOI3DWT/fjdG6zy0Vu9LfWn43KfN1lfmT47GWMnFhgt4+piiuUO+VcdTAwMTHKm1x1MDAxMHBcdTAwMWIjXHUwMDFmklxyncmcg1x1MDAwM1OZXCJcdTAwMDM/xZF2mHmUX3v29vI1YC4y+95zmuy7/uiRXHUwMDFmPutBvSFUNTwyj+nTdFxcRuSiteiO31KRlUiP0Vx1MDAwMFx1MDAxYlxcx4++kVx1MDAxMYw9XG7Vvn7IQmJiR0upxD5cdCZcdTAwMWZcXIiJU4p9hZCz8Z7kWVF34bkmXHUwMDEyhYqfSG20kblcdTAwMWamun1VIKvOcKPl4pyPK6pQMzA9nyxZxlxuTEz1ja7q2V6UNdBcdTAwMDUpxM+8fYFcdTAwMWal+TuAXHUwMDE3XHUwMDAz55pcdTAwMDfzgoWjw1x1MDAwZS65O1xidnZPRlx1MDAxYT6/b4aPudn95I2/YUe+2f2rXHUwMDFlylZcdTAwMTO0PXLUvFx1MDAxMUlcdTAwMDBBLPmvvXlVQ6xOoKRcdTAwMTEqfFxuIPp8XHUwMDEy1VxmPZZcdTAwMGXB/W/OcngzX+5cdTAwMDV//XN+xUNcdTAwMWVVz2Beccwo/NtcdTAwMWPeUsM08Ctcclx1MDAwMEBcdTAwMTKDxFx0glx1MDAxNfmbe3uCXHUwMDAye1x1MDAxObRHXHUwMDE4NP/f/sTs2Vx1MDAwNPzEmLNa6jC0oIzndFx1MDAxNFx1MDAxYmf4/CZEhm5cdTAwMTftcVRdVVaWUFx1MDAxMYtcdTAwMDV9hGgqhYmRkckrYzJ6vzczVULJ5Lk3JvGWXHUwMDE5O7tcdTAwMTQt1lx1MDAxNuVpRFF1V5O8KnF1jpp+bzSikOEjXHKTolx1MDAxZOM17Vx1MDAwNTpedCOo7TzW7Vx1MDAwYlx1MDAxMXhcdTAwMWQ1RsG1L9bQw7k5wVx1MDAwNbIjbsujXGKHOf3QXHUwMDE3r1Kew365VFS6kig9oLL5XHUwMDAzYDZA8IOBqrxKraXVzp5cdTAwMWLlr6biPTGs3COr7jLiKVx1MDAxM30vn6eJT3GhU/GjrDpMaH5cdTAwMDEk41x1MDAwNOhcdTAwMWVcdTAwMDbEXHUwMDAyjuuaXHUwMDE1dFx1MDAxN1x1MDAxYuSN+dvtmvcy7Fx1MDAxZVx1MDAwNtKXdId1e1uXMb4mM6mVXHUwMDBlXHUwMDE2it/bXHUwMDEwY1xuvChtJWFcdTAwMDfcKKJpXHUwMDE52lx1MDAwNZ9v+Vx1MDAwNbS4SvBJTlx1MDAxNXDUVS75edo8+LXmSUpcdTAwMDWJzzdPaFxcX4r5Rj96llx1MDAxY65cdTAwMTTKKtqQuFx1MDAwNrWLk7KKXHQnuERcdTAwMTLvXHUwMDEzbtKd9KZP8lx1MDAxNvlbiLj563P/x2VcdTAwMWJcZlXcSfRa2UTT31x1MDAxOVx1MDAwMlL2PvldR0QzbmiwsN7or+Y8ouJJeZdnUpf8fJPIrz+faCjqXHUwMDA2nFxuwFx1MDAwN1x1MDAxML6wqcc4XHUwMDE3y1x0omFWVuary1x1MDAxNP9FwsB/IH6lXoW9ODdQXHUwMDFl6EMto1x1MDAwMcr0MiZFo6JKQO5cYiuC/aBk3Vx1MDAwMsKCi2dU/W1XZYa+/KCqpG0/YeyaXG54aGpEo7jVjlo4XHUwMDE10yx/jYsuT0pxXHUwMDA1Pn5cdTAwMTlcdTAwMDJcdTAwMGb5RFx1MDAxZJ2/ulx1MDAwN2mt9MouZJJcdTAwMDWlwtMzXHUwMDBlXHUwMDFkMlZR+fb9U8KqxVx1MDAwZVx1MDAxZFx1MDAwZdlR2eE0autQSLiUdixcdTAwMTdgPUNcdTAwMTZYpYTJf/uMy+ZZdzb0i4uXav5zvY7e1sGbXqdcdTAwMWT0UW6NhJEkXs3RQ2/ZXHUwMDE5XHJwXHUwMDA3XHUwMDBlXHUwMDEw9S7S2CRfSlx1MDAxZUtcdTAwMTne2cjZsz/yln4xwGN5/DvOUcPN+qVyP9hyhUe/Zsbl3V4jeHpcdFx1MDAwM1dcdTAwMTFcdTAwMTFjXHUwMDExXHUwMDFhzJrfQl46fT1cdTAwMTlCSq3Ve8PWwGFcdTAwMDO2XHUwMDE2YK9cdTAwMDA07Vx1MDAwYlQ2XHUwMDA0eyl+XHUwMDAzQTiPUiBcdTAwMDVPtsVcdTAwMWLbXHUwMDE4l8TeKlx1MDAwNN688T5cbpc0VOJUXHUwMDFj6yhcdTAwMTlaNGnnrNxEcGdKNsfz1yCrTKdm4euAmbFcdTAwMTBXpL97K2V8eWBiLD1cdTAwMWV6y6DfS4aQS8GamVx1MDAwMkqNnFx1MDAxYlx0Qd60ejRbv8rKl5ZcIvF4em+GUFxukr6vUMpcXMlcdTAwMTQusZjUx332z5tVSFx1MDAxNmL9XHUwMDAzWVx1MDAwN3Ow6H2tk1x1MDAxM+zchGVcZjksYHJcZshcbvSEact56kcmcEOS3F71IYegZPV7kVx1MDAwNLNGXHL4O1x1MDAwZsb3Llx1MDAwZfbF0pNWXXlcdTAwMDORoGNvXHUwMDAxw3l4cio+hkbOrsGZXHUwMDE2tHii4ptuceXbTFx1MDAxNGOiVLpi4FjVXGZe/e3EamiEaCtlbdiOtVJlzOXEXHUwMDA2f4D8Y9lLRY9HToAsi8Zzn7DqyGyq+OJrzmGIO65GzSmA/WY1XHUwMDBmXHUwMDFmXHUwMDA2XHUwMDAypTP5fFx1MDAwMM50OIHRXYlBu1l2r2R1UejkXHLoTIMxXHUwMDAx7K5cdTAwMTMxlj27t/BW02XcXHUwMDE4LFxuXGKTIZ6E0/4/xmDkRL/EUUz4PqHQlUXa6Vd+XHUwMDAxXHUwMDE2dT71XHUwMDE2hu6e8p1EvVpNXGJ/ezjFPzpcYppNxtrOIIe1/nRoXCKDsZvXpcjIXtWr0furyV9cdTAwMDCUp/JtvWPEkt1CJ/Vbw6FRz43A3PXUx/FYsXFAXG5LXHUwMDAxJFxyisLG989cdTAwMTWVXHUwMDAwXHUwMDEyqP2PL1x1MDAxYkdcdTAwMWXP51OyoMRLiVuLrnRtqsNCglx1MDAxOJautF2d8+ZcdTAwMGKbSIolXVx1MDAxOIVgiFx1MDAxN3xubWRnXk5eM7WrblwiSyFDXHIqkoWMaVx1MDAwMJKlz1xmOUH3it/KVOtUXHUwMDFk3YwhcbC2XHUwMDE4huk3T2vHXHUwMDE3ObIyktmLXHSBXHUwMDEzZVTE/F5cdTAwMWZuPzdf4oJcdTAwMTNCXYP4WyeGXHUwMDE1iCvMNpMoWplcciNSwKfCrlx1MDAxZHLc6kR8lm8s6E2vaFx1MDAwNLfSjLnUTkqiOVx1MDAxN9iJTl48tlx1MDAxYnyzXGaftqnitZk1JFx1MDAxZpSS+7bj0NYvl0Z5XHUwMDFjZrxcdTAwMDfY8Vx1MDAxYbAmR9Q+uTlgg79oei0pgbyqXHUwMDBlM1xuXHUwMDFmscZsJ+G27eoxMlJ9IztcdTAwMWJZZSjwp1dyZE3izjdrq7ePNrY9M0lEglbR0n7MQINcdTAwMWXNfV/2lzm4R3eZXHUwMDBmcyAnT+guy/VNad/Yj00/gi/TvZZcdTAwMTA7Z0ngnahccn6RKVA4X4+R79L8vMb7XHUwMDA2jE9cYn6af/j0uSQ4U59cZlRcdTAwMDfYL2KSeNtjhScw+28nbbT427PiXHUwMDFiLOtjp9jf7EONXHUwMDFmmlx1MDAxMHxcdTAwMWZcdTAwMDTl3lKlT3ItVvdzXHUwMDFkXHUwMDFmtvB9Vsx4nPlbVKJmufJcdTAwMWSuqVx1MDAxN1x1MDAxOV5oXHUwMDEycVx1MDAxMy+ENvUgWsXdU4heuSq8XHUwMDBlXHUwMDFiw6qDXHUwMDE25JrjQWxkKGl5giipzYIs5TOfXHUwMDFlc4j5W1L4SFx1MDAxZCZ7rVnL/lx1MDAxY8VcdTAwMGU5ICrDbpr35rJH3/NcdTAwMWVcdTAwMTNDiJNDt5N+XGbQW8x7a0qAUcvVXG5aXHUwMDBldE72XHUwMDFivH66qV+FaTWlQ8Lfz4E2i1x1MDAxOVx1MDAxOUKPgkpmIPWFvnpq9bC3t66CSsaCvr51XHUwMDE24t+UVX2DS/V39tRd0kWfoFZcdTAwMDaBkjv6hFx1MDAwZmuC65zt8kufv8n4uZfp0kZsdZVuRMRIjStcZsxP+75VgelCYrm/VHeqUsAna3be249cdTAwMDGlhOeNt1xuo7WqjpwqWJ61Zy5ijvqihFC8UoeJXHUwMDE1wrHIjeNpvbRcZlJcdTAwMTNcdTAwMTKmO+hAepujXHUwMDFltICLilx1MDAxMDDIXCKXXG5Dv0LE1S1cdTAwMTmndpbIkFx1MDAwMS0k8Ftjp2JqQDjjXHUwMDAzIPjB+JtcdTAwMDLLXHUwMDEypvXiM53b5Vj+nTnxr7rZrVx1MDAxOCbbN6d6wsqMklx1MDAwN67M3lxm7Gv38H++Q/FGnCFOXHUwMDE2Ov7WmU58jlhcdE9oSVx1MDAxZFx1MDAxYXpcdTAwMTFcdTAwMTFcdTAwMDDTLbzfXHUwMDFlPDMucVx1MDAxMk9cdTAwMTZzaS5cdTAwMGafryDdgC2yXHUwMDAwo7X16H/d089cdTAwMDHfsPdcdTAwMWFcdTAwMWRcdTAwMWLpb796Z1x1MDAwYufxXHUwMDEwNE+wZIH1zyz1XHUwMDA1+e/8XHUwMDA3XHUwMDFmWzghcoXgXHUwMDEyXHLbrqlSXHUwMDFmXHUwMDFmjktIIfvloFxyUFx1MDAwZVRjjD7O3O/vkM3i+n5cYuZcdTAwMDW0slx1MDAxYbLqs8k4PJ22kOSQiqSq4sA52YVcdTAwMTWxM8OmXHJcdTAwMWOtqZpaJuhKMXuFQlx1MDAxZYNcdTAwMDA2yZDTSFx1MDAxNf+7/m1cdTAwMTLEi6g95ufEXHUwMDFknlx1MDAxZk1cdTAwMDUpjFx1MDAwMFx1MDAwMYuGcXmDRlx1MDAwNWDMo3Sg9ZlBvz2+6TXgfENcdTAwMDdjRs6Yh/rApfWV+1x1MDAxNSnthFtcdTAwMDNlflwi+kfdr2eJgUCQsMqJILe0ZXCQ4MS1df9lzNHbXFzdc+qs0uGdZKfQ4TdcdTAwMTY/l7FROrP9lnEgcCSjLqRcdTAwMTev39j74nH2t2lcdTAwMGVcdTAwMWOFf2c9iWuo7Vx1MDAxYVH/yO18tWhi9tN2XHUwMDE3ln7Rjlx1MDAwN1x1MDAxYXCIla07wEV5LulcdTAwMDWBkPF1XHUwMDExXHUwMDEzP0LcXCI3d8NcIqKabJVcdTAwMTHQm+9cdTAwMDFTm1x1MDAxY8VhtsowsfOUXHUwMDFk46eXhoCkQqlcdTAwMDNcdTAwMDSpuoJcdTAwMDCpXHUwMDE5XHUwMDA1Z+WIh2LcUPshY9i00rtk7ExUvUhtMb9cdTAwMGXOS8Fovlx1MDAwN55cdTAwMDGV/M+1kMdKMlxywTztJ1x1MDAwNeRHMvOwXHUwMDExJDhpZ+j1i1tQ06F8r1GHXHUwMDExkeS9oLLZk9m0tLRcdTAwMTImslx1MDAxMlx1MDAwZdhXWs2lypAhf+FcdTAwMDJeP8rXuovIg5Vrmtg3/71Zf3+75XtGZVqGL9imlSz7t1c0Llxu5I25XHUwMDEzXHUwMDE3Jle19EvaXHUwMDE25lx1MDAwMsW4Wjv62nLi6/l1yy5raF8xXHLJXCKS3m7aXHUwMDAwrOhd7y9cdTAwMDXSf1x1MDAxYpNcdTAwMWFcdTAwMDY5+29f5pXJho5cYv7NbVxu80uMRKlWJVx0y1x1MDAxMTdF6WdQmYxcdH/OXep/W4hcdG/aPXd9o39cdTAwMWbPKZv8Rd/Sh86iuE+xNMdcdTAwMGVFQlx1MDAwM4g8xepcdTAwMWTTgf3nWeNcdTAwMTBMXHQmTCgmqFx1MDAwM9JcZiNcdTAwMTH54D2Khr5cYv2NVLSV7FpBOn1T9nJcdTAwMThcdTAwMGLd6rNj9r81XHUwMDFjgDGc5IxyXHUwMDAyS2KAwX/Z1Vx1MDAxN1uam6Xcf+1Y/Pe64T+tar1zbcCHxsnS6NxBPPiJso3XNFx1MDAxOKYyxacqXHUwMDFky1x1MDAxYvWWZzyudUF/K5OfZDblXHUwMDAwqcxkblx1MDAxOFayXHUwMDAwSKLATSFstbLKS+tuyDCCXHUwMDEzeafEMiwnuFx1MDAxZJ9cdTAwMTmkzeNLPn/nnJz6vPs8X1x1MDAxY3F/QaFLPbovXHUwMDBiXHUwMDExWiOR5TPFd+9ccoMyJqVnXHUwMDBmoqgwXHUwMDFmR1x0XHUwMDExx6+RXHUwMDFlXFyBQXl5SCRcdTAwMGYxXHUwMDEz082QqEVC0yR06HmlSVx1MDAxNtVcdTAwMDRcdTAwMDJp00BcdTAwMTItpVx1MDAwMm3dcVxi8G/4XHUwMDA3mZ9Qllx1MDAxN2VAXHUwMDAwSbDftmM++IWQZlx1MDAwZXJ+/ro1rDEustn9/plcdTAwMWKFjVx1MDAxM2AlfYZcdTAwMDOOz/XSXG7J1njDyo6vXHUwMDEyfLxcdTAwMTihPZUjZ81tXHUwMDAw6dEqq68vtUw1sqzDvXlLZFT8/SdcdTAwMGJ+g3ZkkDV14NSOXHUwMDExdsL4aDtcdTAwMDVx0+m4f0ZcdTAwMTdcdTAwMTL6NFx1MDAwM5pcdTAwMWQwolHB285VkcUgVDnebylCXHUwMDE5Ja9rTVx1MDAxN458PZvfgfPPrLqFXth1JshcdTAwMTU3fbd+0K+YL9lfINlcdTAwMDRYt3CqizxFSmqzs73WV/pcdTAwMTK57+dcYlxcXkfFUnt5wFxyXHUwMDAxm+mKas+nXHUwMDFkXHLySD00XHK5pDfc5fz2XHUwMDFkJOh8rWCE1FFr+sz3lbtHWKxcdTAwMDJcdTAwMThj3zSpza/yceEjOqXY91x1MDAxOME0XHJcdTAwMTeaRsb6O2stjzcjj5kq7lx1MDAwNl3MuClkcsBGnVM/lplsyz5cIqSQXHUwMDE3lFx1MDAxMXZcdTAwMGLcRF9cclx1MDAwM0aU2MNZqk/6rZdcdTAwMGLlq0f4kEDOQ19cdJ9dhPQm93pccnPCu7JId2lQjKeBT5EuMzlhq6riXHUwMDFk1vFcdTAwMDXE8jFQQyBGXHUwMDEysqYqXe8luM08Xs3gim2WbCSpVvNcZipd7O3Q7Cy+xETFf1bmRZLzIJXPdyjaXHUwMDBi9iDG+lx1MDAwMlxyhKZfuaiTXHUwMDAzjFxifdVOpFx03D0034esNWtcdTAwMGVuXHSIXHJcdELeXHUwMDE1TnwxSYG/f+dZIFx0NTVcdTAwMTQofVx1MDAxMsyQlcLxIfVvfP2NXHUwMDAwT+pOXHUwMDFk8mrfLy9fVbmNXHUwMDE5gPSnXHRrr4xcXOiFu1x1MDAxNSmG32yoJ/7leFx1MDAwZonukU0y5oZopqIuc0q+XHUwMDFhqD+MrFxc/LcjqUGP6rY2LaeAlpZcdTAwMDNi8UE1XHUwMDEygVPa4lx1MDAxOD2srjP3b25QQJuNyTlMU6RxTlx1MDAwMPT5XHUwMDExOorTRZ94jDNJMGZcdTAwMDLgT7uFXHLmh2hv9lx1MDAwMtW302zw6c7DOOk7qEeRblnd66BijVx1MDAwMZT131x1MDAxNmTwrrjyx7BcdGai612N8fmKSFx1MDAxM1x1MDAwMFk/t4Brwlx1MDAwNENZeyriM/dGkJA7MW2BpjdcdNJ4un79V3xcdTAwMDJ2+Vx1MDAxYZrXPL+qmvPcXHS3N55mzFx1MDAxN5tcdTAwMTlw0mD+JVx1MDAwN66UxFJQXHUwMDE55cs4hNC+XHUwMDBlUY1Aq6GMM4qm9KJcdTAwMTOCffL7NXHZOE2BR3Wnfz/Ye5208fb3ekTXmThOmEY59Fx1MDAxY3mNZGklXHUwMDExS9SVoaHCXHUwMDFihUtcdTAwMTHSXHUwMDAypOnZSnZcYodIXHUwMDBikM13mWyhrE6Q8f3yXG7Q71x1MDAxM1x1MDAxNJGzy1x1MDAxZLSJoVFT21x1MDAwYqVsXHUwMDAy9tSkXHUwMDE0XHLFOFjefHPkdEF/Z77eZnp5x1xcfcLy+t3tU/WExH1cbo5cdTAwMDAtXHJcYjrl87iy4Zus+DmeXeJcXFx1MDAxY5TUZc3TXGZmbT1gg9vh8tb2gr+14C/YgE0ry7frz3zq35pDUsruXohN2Vx1MDAxZMhe/Un60kRDpVx1MDAxNs9cdTAwMWaIrjq1yV+Fpj5cdTAwMWLIglOcm0dQaGZQ+z+Zqacw3l3pXHUwMDFl94i4JYCghGHFworlktnriMDH3XGB5XvtoGzavlxuPN/S8GA3j1C97PuiL/HPh6xcdTAwMWRb4/61T8f0XHUwMDEwXCJcZn/3c0V8XHUwMDE3kzhBJElI0ChqXHJcdNhI/a9Ao1x1MDAxOJNcdTAwMGU89Xlv4f13MIhcdPGhpbGf4jDIMXuWUPZXSV9cdTAwMWLpXHUwMDFlYjaL135cdTAwMWTGXHUwMDAy4dmLolx1MDAxZTy3l+ahZVx1MDAwN1Ge9eo+XHUwMDE0RjR/m6kmLSj9PtevlHuZTbMm361ZzcNcdTAwMWFKS8TINa1lSX8kvJD43amsV3n/Wc1rXSrsVlx1MDAwNaxcdTAwMDCBrFx1MDAxNXrYecx6ynb2JtovfYArSSiNK5XY2Fx1MDAxNqO1jX/btoKHw+k2sskyYaj97/NcbmNaR1x1MDAxZi8t2X14Ulx1MDAwMezmh+FdU07yh81cdTAwMTFda6H1xHE49Ew/PtGIeFx1MDAwM1x1MDAwN7yF6cBSh4WtXHUwMDBmXHUwMDBiXHUwMDAwtoa9mbZcdTAwMDV+OVx0KFx1MDAxZZl13bC6QivKo3GQeaOW9diNWqPn3Zvh8JVcblRKqYwhx+DbXHUwMDE5XHUwMDAz5d5cdTAwMGL9XHUwMDA2cCPu+LBcdPE7Qk6DwVx0TZRcbipcdTAwMWS7qHT5O3qYtUW33Vwi3b1ojC1nXjD6O++PjzdZXHUwMDExN0tcdTAwMWV3y31cdTAwMTOAVFx1MDAxMYTHTM08bICD43NKxFx1MDAxN89cdTAwMTHLykCfm+gxf//Isjh7xplmadZcdTAwMWF9m1x1MDAxOGlqsZ5cdTAwMTJI/kSAM1x1MDAwNbrWpK9cdTAwMDBcYrPZeHBcdTAwMTjtXHLV4yQx3pHpZ8hcdTAwMDN/MFx1MDAxNX1YK8tx4fRbYCZrprpcZppCVbRgJ1x1MDAwZt/zeFx1MDAxNmE4li7YXHUwMDAwXHUwMDFmTp60+lx1MDAwNtcgOV9pYE9cdTAwMDSgylx1MDAwNzTw04WsXHUwMDFlLlOV6lF5QVx1MDAwMvm+Z1x1MDAwN1x1MDAwMoucmUhdoF/fXHUwMDFkXHUwMDBl/UxNik6Zxar4kqDtV/yZXHUwMDEzglx1MDAxN2XpaFxmcIY5wVQ61/6Oy8HS5Ll6y+lcdTAwMTFhzo3VUUhcdTAwMTR6W2JkYPI42Nij2y+AovtcdTAwMGayT17JRiyS4Vx1MDAwNY1/u8Z9S+aL7DxZlLk09shcdTAwMGIlrS5spNi9vsDu1VxiXHUwMDE55Xjwr5Rx010jb7+E/f3n+YrGJFx1MDAxMfPHXHUwMDAxXHUwMDEwXHUwMDFmKKKyfTKlUFx1MDAwNV9cdTAwMWNLIXtrIVqIe+T2fp1H+d67X2NjJupyeZnAy/tjMD53y25Efe7UskhbLuC2XGKMxINcdTAwMWHaXCKAmbPg+XzghN9cdTAwMTR5J3a8cppjM02uRq1cdTAwMWWzVE1cdFx1MDAwN1aA8V/uzWTDaIsj1fGCiu66MOJMZuPjgYVGXHUwMDBijd2PLa7Lt7K4Xny0nVx1MDAwMZvMRZ2Y3Vx1MDAxMzCVITLeczSEMcJ7yVx1MDAxOfGIXHUwMDFkypXpRqXl3zx9VWNfq4BcdTAwMGa4luLvXHUwMDFhXHUwMDFjftN+MTDNalx1MDAwM1x1MDAwNZWvMaUqYneulb5cdTAwMTH2XHUwMDE1XHUwMDEwIItRIIqSSlKizyfuXHUwMDA0hVCZcUZeKaFhfFxyXHUwMDEzZ4zu8IZcdTAwMDLBYz/X22eSR2VcdTAwMWR//51nXHUwMDBiSURvSDTDsGCxaOGvcV9cdTAwMDabOEvWY+KSlY6QM23MxJOiRTbN92oloFx1MDAxOX4paWbYyWOf9Fjgz7G+Uc1dTElcdTAwMGVLVHmD6t7/XHUwMDA0x0dcdTAwMDGIXHUwMDFm+/5okKBk3l9V+V+puEpAXHUwMDEyMFx1MDAxMuO3xCt+ry+6XHJraWiXjUrWYyc99kJcXFKRWLeDs9u7KUIsfoBcdTAwMGVdZTZcbl1xV/vObH/K/YnUmVHZXHUwMDE1XHUwMDE2n3aqzkomsULxaSxyUcaVv+dcdTAwMGLPeckxXHUwMDExwptcdTAwMTFcIlx1MDAwN1gksJ7xXHUwMDFjP9p3eEt6qs9cdTAwMWT4uiriV4N8y0SRx8VcZjk3frruQzt1+CpCXHUwMDEy2YIwVI1z6bGtj85Ay7nf3JYrb8j88tKbXHUwMDAye+FnvnbzrILwJItcdTAwMGasXHUwMDE5q39cIk1cdTAwMWRcdJhDRkBcdTAwMTa2qFx1MDAwMTdJXHUwMDE2L1xmvVx1MDAxM7wtR+Ewelx1MDAxN8fv/ZCCa5S12TjVpstcdTAwMDfcRJT4XHUwMDBldVx1MDAwNP2Gbch0dGM8ZDFQL5DIRthz9uFX+dG2UjVdq6mDXHUwMDE4Wtjkmoa9kVx1MDAwNa3LbFx1MDAxN8PawVmP9kawtqOhvP+wqfMlSt6kdWZ9bKjjUtdcdTAwMTJMXHUwMDE2WUpD/mW50VNYUkOicm5cdJFYK0VLLrA8K5ih/Y+rplx1MDAwZi3zSP9cdTAwMDGU0fQgzPOBx9tcdTAwMTlSsoPQxVhcdTAwMTBNWfqzrrQ9XG7iXHUwMDAwpk21571iR0D5aX/sRoaLX2KMXHUwMDAzZVx1MDAxMvhcdTAwMWPU1YiOtEVzyDmc9N9ccuxcdTAwMDTMXHUwMDE2VOPLXHUwMDFk0pfK8VPIqoSLROpZnVx1MDAwNz9ZNzu2/mCgyMZgM7yewlx1MDAxNSM9QkpcdTAwMDDaRVx1MDAwZXwjTcr1ZTNuI1x1MDAxZTU8TfHgXHUwMDA1PaY8XCJ66WZZJ112QCCaI0JD2OqxKrLC439sXHUwMDAw+SnrYvoh60xF2clQwmLVy9PyXHUwMDEynLhcdTAwMThcdTAwMDesWunJQXWfivHQXHUwMDAw+Vx1MDAwNGSO9Vx1MDAxNFwiTlHH5Zy0TqSgRZDP5Fxiket+VuYxiFx1MDAxYYg5KWKFYFxyvFxiOYxBb1x1MDAwN9lcYspCMXs2o1x1MDAwNlx1MDAwMEVT5L72ej0xieYv/XbTdZuGU6y1/kOyzV30jIFL3HQ+uuXcpFx1MDAxY1x1MDAxYuffXFyXODs5Nqzeepve7+f6KuqxXHUwMDE3LNeWM9ys+EhoSm0sd5j7rrhcdTAwMDKaRCTBm9RcdTAwMGaLO8ZHIc976KT6rEOTflnrhF6N4Y5CXHUwMDE3WCous4C0ilxm0FnASq78tmmZev8489+I97ysZutrV9Fr911cYpo1SzA4pv7TgqhcdTAwMDR/aU+fN1hRVT6IzfMqXHUwMDFjIVrEU1x1MDAxZsnWTqtcdTAwMTV1YZXpLm3OsIDrx/Jh7t+bKn+FNEDtNYDwW5Q/q+dcdTAwMWF5XHUwMDFho5LAl1VCfljAw45dOp+SJHtcdTAwMDeVt69EXHUwMDBlXai6XG6bNsV9XHUwMDE5SL3UgIxcXFdWI2mazcqKKtlcdTAwMTFtQ1x1MDAxMELK1TerPHuWXHUwMDBljeBPprGkYHSLXHUwMDE2P1x1MDAxZt9cdTAwMDWxw5CsVNRs0FNFXa+YPvrEidnbhalcdTAwMTZSUivS/EVPunN0pllcdTAwMGXtottqXGbA7GaTiOhmSlx1MDAxNZdFMlXNXHUwMDBi6lx1MDAxZGGuQMe5b0raNDYx8TB0K5xJ3zrHe+WDRouFXHUwMDExXHUwMDFm8W833btcZst0dVxikFxycozplr/zVsXq4r3tV4++v5+JlaygzVx1MDAxOYJbw/TJYD+vx7ZRXHUwMDE0bIaU8ZeTXkJcdTAwMTeSRnLi8GtdXHUwMDA3XG7OdpZZ88FcXOOH+/6qeYNOXHUwMDEzXHUwMDEwSFx1MDAxOeDJiWqseCOCXHUwMDE0XHUwMDE5ME06MaqLfUOzWedHesrbV32e+1x1MDAwM3kp2lcnzaEoTJ78LGFjeEyAXHUwMDA0S3QktZ1cdTAwMWTXZFx1MDAxZMdokThJsVx1MDAxYo3/raNqKCuJUCNRXGLjzS0+PLLvc1x1MDAxZLBcdTAwMTXXr/SNXHUwMDBiMMBM851VTYRtXHUwMDFip9WpXHUwMDBiiVHaSOqzRWa1UVx04avDaeZn8FBcIlx1MDAxMmAlXHUwMDBldsaFXHJ7cCxDXCJLfpeoZa9cdTAwMWK5JCVU01FcdTAwMWRGXHUwMDA3dCeMXHUwMDEz5PlhUZ9fosm/VVx1MDAxZUxcdTAwMDRcdTAwMTWP1o+t6GhhW9z7UcQ6fDwj8X5cIpa7zDJSqUHzQDVcdTAwMWNvXHUwMDEwSUA5n5DtQlx1MDAwMttmkNe61fqNxphcYmHPRWrlVqmnXHUwMDE2MD5kbnNcdTAwMDK/jfzv4YO/XGaklffFjawjZpHsikL+e6ujj48wXHUwMDE5XGaAgFnZXHUwMDA3ysdcdTAwMTKGv1x1MDAwM2hcdTAwMTWiOemwiSzou0s/yWk/THt/j0hivMF9ZtXEs1x1MDAxY1+lSCH04TNBpFx1MDAxOVx1MDAxN4wtVuvHUYNN7mqrcUu9mpS9SFbu/O39wMFcZprso2Ho6Zjk3tdi8HT5No5cdTAwMTj2kivewoFcdTAwMDJq6Hc0yYZfKK1izXlTXHUwMDEzOf+cYZHPp/94k7o4XHUwMDE5c1xczYhgv+2cLFk+0Fh241x1MDAwYlx1MDAxNK/e+f2ajlx1MDAxNMX5XHUwMDBiYIpcdTAwMGK9XHUwMDBm0jTZ+iplhNDMqkLHuJutx7NuKFx1MDAxNeZcdTAwMGXC7qSmwmZcdTAwMTWhv3dcdTAwMTOcaVR3ZZRGtD46eVx1MDAxMbuKnTejS3Anqlxm9Vx1MDAwNJ2ssuOe2iqWXHUwMDE4h657f7NcdTAwMTRiYP/AnTOM0pumh3AzSPNqz1hWlvFr5dLxclx1MDAxN3nEqK+gpKZ+uUhPRvsx9qctvywxTmJubTZ7TexcdTAwMWR09aMlpim52f5WTYrPjHhdXHUwMDA3XHUwMDA2fJqqXHUwMDE3mEh+o/dFKDbccFx1MDAwNSqrlvZGKzhahPF+WXg++Jtdks9vXHUwMDE1sr6+kshhXHUwMDExVCx3wFx1MDAwYr+V/ZTgTLCyXHUwMDE2XTGR11xcmOREwbRSb2dcdTAwMWZ1U+/R7DZX5znEXGaNh8txYGh/cW1ITIngZHqXXHUwMDBlXHUwMDA0hVjfMtorXnizXHUwMDAxXHUwMDEw3Iu9TEfgjF9cdTAwMWZcdTAwMWN57SwpXHUwMDEz8Vx1MDAxY1wi94mSj5b2Unxr3ZFAk14yW8SGwTnbXHUwMDFlee6aL4PaaIXsXHUwMDE0X8n6dX3pUVgytElcdTAwMTe5UqNcdTAwMWMm5fa6U1xyxHizuOXtnd5cdTAwMTiqIUz0flwiXHUwMDFh1CVcdTAwMTIv23zHXHUwMDAyuFx1MDAxYcDxN38jXHUwMDFiIO0kRHBYVOHcSZpcbqN/XHUwMDBmaljD1sC60pRgsOzrPiy3U9hcYrFcdTAwMThcdTAwMTQ1gcvo1Jb+YN9cdTAwMDDmw3RF3Vg1cuMyQis9pvQtirlcdTAwMDGKXHUwMDAwXHUwMDAyiuU0JqnIXlx1MDAwZb4vbvbCvV5Frrf1+suo1FxynqPSeKKt94htVInSeaKxXHUwMDA26O1uh5j3WCjoilx0VZjMR910XCLwwK/qzFx0PHmK8u83VL5TlNpXNFlKsVx1MDAxY1x1MDAxY8Y9hv47XHUwMDE1XHUwMDE3S3igJ+Rd3URt/zBcdTAwMTlSQjibo0ithdYl2yZvYZ5aXp+l4Jkp9lx1MDAwMJczt2lL4TlXXHUwMDFjK/S39LtGtFx1MDAxYsqjXFzSXHUwMDE4pffdlmZmXHUwMDAz51r2XHUwMDE2pp2NXHUwMDBlXG44XHUwMDBlTJRcbruf0pskq8+xgK1hk38zc+ff1lx1MDAxYq9tznEyQruQ7E9cdTAwMWVCLqSNola+7FKObJWwfzxz4k5cdTAwMTU4XHUwMDAxP4w0/5BcdTAwMTdcdTAwMGYs3vtQipbTmVx1MDAwNVx1MDAxY/9cdTAwMTign7fO1Fx1MDAxNljLMJFZLWVmspPiXHUwMDA2vlxmqlipQlx1MDAwMldyxkVccjOfK8yb8pnf/e/iXHUwMDE5hiOQXHUwMDFjXFypb7x8wf/Lo8WIJMB9uYi8TSuSXHUwMDFjsSNcdTAwMDJNXG4nhV8yIO9cIs3PiEAsglx1MDAxNuc1ierNpN+Hr6tcdTAwMGatLCzlOal2o+dcdTAwMTefYsuL4lxyXHUwMDFlXHUwMDAzXHUwMDFkjqbY1PVcdTAwMGIrpU23zq8jfmDqReyvr1x1MDAxMVtjiFx1MDAxOUuSSa+Dz2ub9EqmxvFRrpIt0vj9n3QrWC+Mge2/4niTMb+aol1HcFx1MDAxMrFcdTAwMDBC2Fx1MDAwMVx1MDAwNtBcZkdcdTAwMDE7ZVOF9lx1MDAxYVx1MDAxNndcdTAwMWXxT4aKYyvT+ChcdTAwMTQnJFHKQJOGN6TWVY3FrPOh1qixNqM3V01qzFx1MDAxOPlN+ptWdLIm1lHxtWKP8G6mR1x1MDAxMmngpaaPYI74jeavMKVCXHUwMDAyhdVvQMCQMFCRXHUwMDA2ip18x36LWGin5bdeu0BELFx1MDAxZftcdTAwMTjJ3lF8d/5cdTAwMDX1TVNaJIFcdTAwMTK8beb5ZZOkftJVdd/29aVpn8yB/uRNXHUwMDBltWqhkEqo0s6aXHUwMDAzXHUwMDA1zocjodKIddqlXHUwMDEyhv3iXHSqvS1heoxcdTAwMDKB8V+LXHSEk/yxcEpcdTAwMWIuoKNcdTAwMWRlKlx1MDAxMCaYWsbiUr9oWNpEXHUwMDBi/9LxiWyx2SbWdH1MY1wieamUojzPmVx1MDAwN6BcdTAwMGJhfuShiZ9cbtpg+DxHkUxs8s5A6TDzo7okXcnTwlx1MDAxOenpqO207uDsd0NcZkq0XHUwMDE1+Fx1MDAwNM35XHUwMDEzd7bU8Vx0qZ5cdTAwMTRcdTAwMDSUXHUwMDE3u7hK+tuzPqFccif4mFxi+3NcdKhDsDdbepGFkp/xJFx1MDAxNpZftX5jMOpcdTAwMTVpmCR/J/3ezj7grlx1MDAwZuVcdTAwMTDRoVPfqNZZpFxcioVrnErc55L9wfE+XHUwMDBiQejB63ZcdTAwMDHUuMyOZnm69623JvuEXHUwMDFlWlxi4IWNgy710itcdTAwMWbW/Fx1MDAxM2L7ZfRTN3BU4r95Vks2itBtM/IrxkTwXHUwMDAy2Fx1MDAwMrgzOXSf1WhPv9ZcdTAwMDbMmeVcdTAwMWX9XHUwMDFh4tIqPz5cdTAwMWTtXHUwMDA0R1nmmVx1MDAxMlx1MDAxMDbvJL/6198g0OSt4LnqXHUwMDFkiehC4mQ1JVx1MDAxMiRGvKCG6GFB3i851JaorjJHk1x1MDAwMahvXHUwMDEyuJVG++lkZsqVx+beVIbrzVx1MDAxN7o/XHUwMDFldGt6domzh3lAsGQ1NnKyj3XcZ/2KzVx1MDAxNDPQ9e04nFx1MDAxN1x1MDAxZr5cdTAwMTTJouLHrUTfX63dXHUwMDFk88sz09FcdTAwMTZcdTAwMDReLlxipa1cdTAwMGLB+N2JZVQtXHUwMDE0XHUwMDA2nERJgdszkk5cdTAwMDGK7/39XHUwMDAz36k/xPHTkHIoPrlwLN/wWbRrai9bVlx1MDAwZa95WlxmQ/L6Z/D8TDG2XHUwMDEzbLkywTiwJNTjM1xmozCs6lxuYsBApHVOgyxjXHUwMDFkpI6o/Gfqunl0eHWIIHsrtyZzg0G/+c2Ua156Ka5A46Ofa5unT1x1MDAwMWtERo29+k0kXHUwMDEwh+JuOPaYjD6sTTHRulx1MDAxYlxyfa3XXHUwMDAwyOFdOOyJ49q5Zv1cdTAwMTFQ2vq4pG2C9/rmPoyF5Z9lOdHnw0xgjlx1MDAwNOGnXHUwMDA2QUExkZ+RTNeFcFNOXHUwMDAzpd0udstm4yhl37LKvVLIvjnr1u7/sNi/x6NvznR4R96KLLqamLfhznhcdTAwMTlzXHUwMDFm9KRcdTAwMTM7sTy4Q+mFUjbhipLgpeyXibhcdTAwMTjtiNSt855HpvazXHUwMDBi5Vx1MDAxZphazUvh3Ft9e1x1MDAwNZKMmUE4b05vKjvO399Y7vDHLfAu3Vx1MDAwN4TySmJcIldcdTAwMDTaXHUwMDEydnzuh+R+vtkr9O7cTJo3utZAtVlcdTAwMWPfVcO/w1x0mKpZQXH7t99cdTAwMDDxxrHXJJrU0vNcdTAwMWPQ6+MhuCdHt92O1vZzM2CZXHUwMDBlozBUd3yl0YeBRXzaXHUwMDE1s3CbTiZ5ytvQXHUwMDE3bI6HJKWBJHHZwlLLu1x1MDAwMJtU3sfoY1x1MDAxNFj13/BQ/t7CoIlgX9NOwPzL/UmkLVHuyZ27XHUwMDEy84rZga9pQSFzb1arJX2yuJfeiNmltVx1MDAxZlx1MDAxNIno1Fx1MDAxNr4nXHUwMDA0+q6uKGZo7jnqjZZcdTAwMDJcXHI5XHUwMDE2KnWkL3enXHUwMDEy4p/9wuFM9XOlXn8lblx1MDAxOJPo2jjIh6Uvp0U64Ln9gzdUhm3kU0KNJGPadDkg90f2XHUwMDE3jVx1MDAxN3k1XHUwMDExI4ZN8t+JdFTTh+1HUL/Cz8o5J1x1MDAxOFx0jTpIXHUwMDFigaBRI2SEVlx1MDAxNEdPU6Ceilx1MDAwNu85gX1xvvIh7llTnFxmZJ5aTPeej5ZcdTAwMGWwy5WQ1H1DpGeqrDr54rxgMoZcdTAwMTbUp7qzPE6+izycX/TagDek3K+dXHUwMDAwpkXBoFx1MDAwNda4z89Sc1x1MDAxNl+O86bkwsTnJ/QhQemdekety77CWo0yfeFrs3OQrlTpsyZDtFx1MDAwNyDFXHUwMDFiXfLeqLf0K/RcdTAwMDWl04aJh99A8lCu6oZUXHUwMDEyI399Y8ixS4CNiZpZafL+W9iT2lxcyzVx8XTVzc+RxE1Jrp7UZ8riZTn8XHUwMDA230iC/CTKxlpLUWxMrlx1MDAxNyPePEVvxMpmXCJ09d/NKdCH8vtcdTAwMGL5XHTvbS7Wo5uJWOm0XHUwMDEzilRW0Fx1MDAxZm5K3PpsX/kjiIPEXHUwMDBlRVx1MDAxZEFcdTAwMGV8bpQlk7dgrsOyS3iQUeFcXIauXHUwMDE09y9An11N+2KrsVx1MDAxZZLZg+wjdDrTXHUwMDEzV1x1MDAxZlx1MDAxOYE3Z7puW1jbofPd7jaA5VRaXVx1MDAxObF+ulPk1+Iwh1xcwFknXHUwMDA2fa5Dbq2+vNrO00DVSCS632CYlUzF7Y3jNc9cdTAwMWZ2YqxcdTAwMTa2UydcdTAwMGXL0V5vNtJcdTAwMTJcdTAwMTOI/kpcdTAwMDOIP+yQXHUwMDE0XHUwMDEwS4N7wVKPjONsROSAo1x1MDAxYlXppENcdTAwMDI+R5NMoc2GP0GLpbJcdTAwMTBcdTAwMGbD/1x1MDAxYsRZ/OcxLLDjJDol1f6hqH1r1lx1MDAxN1xc3lx1MDAxYjVcdTAwMTRcdTAwMTde1ntcdTAwMDOSmPZQ5kBkv1x1MDAwNlx1MDAxYlx1MDAxZdv9VWOJnYU5ZqOWVFx1MDAxOZX3soVcdTAwMDNcdTAwMDYnZCx0vq6LdENyclVQhCXNvv5sMOr3g69RlSAtU4fZLaz7eFdcdTAwMDXxuzBBxC71UCG8sDxcdTAwMTPhMbdcZp/ryM+n2Fx1MDAwNVx1MDAwZlx1MDAwNFwiXHUwMDEznj/lXHRNkFx1MDAxZpRk5L1cdNbSY1xm+j3eiS3D9frWXHUwMDBm+aaJKUBZw9I2RyCHv9tKsaLyffpH01x1MDAxZPSj7ThId3Fq22a48a7LSKzoiMXDf3nvn7wpOEev1HQrXHUwMDAxzmg455HIindX2fii4lx1MDAxOYo2j0zxMKdskE6polxiXHUwMDE5j2c3PzxKuVpuy/1cIsucdaap5iHIXHUwMDA2he/fOHfmroJl2+zP806sXHUwMDFk36iMTow6XHRcdTAwMDN2/PlcdTAwMDA8n7nbSWf+my25WI5lvWJFjJ4hXHUwMDE4MJD0fYouK7tqYsOz3c3J+uG6xUJcdTAwMTIvwJn21Fx0XHUwMDE2penKbkn87P7Oc1x1MDAxZlrq5sqP2zfq2VDti39yXHUwMDA0JZRcdTAwMDcgiKwh36JcdTAwMDL3LMZcZnzodvanXoBFnlx1MDAxOC7rwFx1MDAxN/DUXkfXXHUwMDFmlXwjW1x1MDAxMZNlS0ImhFx1MDAxOfWaP36yQSyGSzU8vFxuLY7rtaRwiWJDm73XoH1ziCVZ3YkrnauOXG631GlHoZp7M55W8ldXYkdRXGZcdCNqNPn+WLvHxr/3SpZcdTAwMDZhJD9cXPl6ml5HQqZcdTAwMGVbkVxylnv3dZtL9Lxy/qFOUbcvi8eX9Hdi/ctYdcL0bOHnMSPR7Ztr+JhJ5eM8XHUwMDFhhYlmM1xuStVAOLessEt2lPNcdTAwMDefXHUwMDA0PLxG9PmRt1x1MDAxOD8nwNNcdTAwMTRFeVxyhVkuT6m5eIMy2tFcdTAwMDDbfllm/jza8lx1MDAxYeRnmtxcdTAwMDZje4vy0nY/K1b22H5cdTAwMGaTlFFcdEphetCeV1xilK/p2i6oQP0004FcdTAwMTLl9Uo1rl/aaqAsV3WNXHKjtv+cePr+XHUwMDA1IN9cdTAwMGJcdTAwMWFnnIBkWr/C3JmVx1x09MWwg3fWI4veXHUwMDFmg5L3w1x1MDAwM6NcdTAwMWIlSo8r2VxmVs16XHUwMDEzXHUwMDFjgcJSgU7TY1FcdTAwMDH7eFx1MDAxNkCyfVx1MDAxMmBmKrUvyn1/zpu4XHUwMDFl5DVHXHUwMDFhrLuKP5iT1WOkyFSNoYf1yVx1MDAwMXCjUG933zAopp7YXHUwMDE0Y8l4XGIwgedgXHUwMDE3Slx1MDAxM5hcdTAwMDRcdTAwMWGtXG5QvbX6aD7kc4DEuOsvVuGN0V6XLr8o8aczrIwtOsR3r868nLhd5zBaXHUwMDFldVxcXHUwMDE0bLenQjDJXHUwMDE2kFx1MDAxN/np81xcPFx1MDAxMvg1Z/BcdTAwMGLNh/fq9MMu2d/GNjuW/FSFXHUwMDE0m1x1MDAwMFx1MDAwNinKXHUwMDAybOOnXHUwMDEzzVxm2Cc9mlx1MDAxMspPXG5oPyzvgGptxfNzTY/SfbDvlinm1MVcdTAwMDDIXHUwMDExSaLl8Vx1MDAxMKpjkztcdTAwMTPgiCZcdTAwMDSwsXvOVFx1MDAwZq4vXHUwMDFmkNNcdNHd8OTMfjrLwFx1MDAxZKtMs7qXisjWxU03UnBcdTAwMDOY11x1MDAxYbtsO52a1Ss53K7h5vNcdTAwMGLw9jBSXHUwMDE26Fx1MDAwMurSU9hcZoP6LmHafcNTOL2femTr6SvX8U/Q7699XG62rVPWgVx1MDAxMzCTXCKWrsxcdTAwMWO6KdZcYlxcwT84i1x1MDAxMi5mvHQnnW8v/ZtcZlx1MDAxZLBoQNjftFxmoFc4XHUwMDE42Dei3PEgdkwj07p1uFjPh97Yjn9cdTAwMDWtRY9oPuT7XHI8ZJ5bXHUwMDE3li0wYM0sTnLl79hrc+2bladMuGjobbCVzXRi4mboXHUwMDFhdlx1MDAwZVdcdTAwMTNZyVH1aHfXulx1MDAxMko3RJJXxrVMeVx1MDAxY2BeSEmN3ygogtpajebxQ4aXaTCmd1OUXHUwMDE0SmGb+N0oXHUwMDA1XHUwMDFjSSxcdTAwMDdcdTAwMDBjOdsj80JcdTAwMDG922W758DGulx1MDAxM/M6M55cdTAwMDWs2NdcdTAwMTE+WpfU/VwiNSt/XHUwMDE4upqENlx1MDAxYqt5j172jlx1MDAwN+2eOFx1MDAxOVx1MDAwZmK2TzTt2pjOakOTg1x1MDAxZlx1MDAxNrSaxIDt3Fx1MDAwYrOBQlx1MDAxNOgnMKz8+7SfTE61ydOLXHUwMDBlelx1MDAxNVx1MDAxOdmlemNcdTAwMWST5ljbs1x1MDAxMNAoK+mIR5JcdTAwMDDkIelxor9qLlx1MDAxOVx1MDAwNZNcdTAwMDV3mfHE+lx1MDAwMkWSxnKGlORYYJbqeuzXlX5N+95BhFx1MDAwZVx1MDAxOIXYTEDYhPj2wV8o3VZpnslqiaT8UKmhXbzzfjQrfMEjK0NIeMmmNFx02kZx/Kkqo1x1MDAwMGEztsEklp9l0uzrvMXiTW+xbli0TkKZ1/Ik4eR5SrKI9JPa9FxmoFx1MDAxMMZ/kFxi8VlJO1x1MDAwZZs1wdvbXHUwMDA1altS0YzQiWLgXHUwMDA2XHUwMDE0Z9vKpEL+1JJkz5tar4uKdDFcdTAwMTUyc1D995piVdb9Y8dcXIH5eZqDXHUwMDAwz116d1/eXHUwMDE5ISzHqc5cdTAwMTXDfaFjiEmycqxJb/6LsfNYcp3JkvRcdTAwMDNhXHUwMDAxrZbQWmvuQGgtXHT19IOsKev+q2fMZu4mLZk3kWTghPvnQOCEKzvCXHSm3Fx1MDAwM1x1MDAwMkjNZz+wXHUwMDBlQUmWKLJcdTAwMWRcdTAwMWX2b7+5XHUwMDFh+Nmyiz88iSaU+yUu2dz4XHUwMDFlcH3HLc0mKb22UmPWXHUwMDAzq9VcdTAwMDOyonl19pE2wn7H1vtZXHUwMDBl5eVcdTAwMDfZsDR/eSuVxrhcdTAwMWS6oS4hLJswNppUree0K7ToslxiKmOOxpz5XHTGSSnbXHJMO1x1MDAxN2KP682ef9e6uF+1RZHuIFx1MDAxY483yW5cIijDReM8vMbcemT0sVx1MDAxOSnfZLnFVTmZUsHWXHUwMDBm8qvcJ0PAf8zIXHUwMDFj8Fx1MDAwMso+8TVcdTAwMWTyN5+Ej/blvXhAPC+oYDtamqozyGycocpcdTAwMTPm0lx1MDAwNrCN70xcdTAwMWYvXHUwMDE1h6LuZ++zxGmlrltcdTAwMDLx5vuzXFxcbrOE8IG6XHUwMDBinVx1MDAxY1Rsw5TMurmje9GjU1/MVVx1MDAwZvG0p0yvd1KZt7I8RkZ+teJz5pmBXG5CvvQ29tJcdTAwMTWM6Npud8n+XHUwMDAzfz9L2qDihO5cdTAwMDVcdTAwMWPXjvFcdTAwMTWCxSGJxIM6yf6ellxcji38b+6Qz09gVFNcdTAwMTXIYy5YpXGGt/Xl9mf/gGFE9Iz2t4zILVx1MDAxN+pcdTAwMTXbqmI/ysS0q2P5O5vJ2d9NqX7kJexcdTAwMGJcbjfKx49cdTAwMWJfI8dcdTAwMTVVXHRcdTAwMDQupCXNZFt79NZFnZCmaLL761x1MDAwN0dzXHUwMDFm8qi8eidcdTAwMTiRLLhMXHUwMDAxXHTKiDeyXHUwMDFiUlxyU09cdTAwMDRcdTAwMTCrj7c4qEDzft88svx6dWWSXHUwMDBla2w/tX2hLFx1MDAxM13Qe7xcdTAwMGUgXHUwMDFjLmpcdTAwMWJcdTAwMWaN7MpMXU9cdTAwMGZV7tfKXHUwMDFlPJ80c3JFW1xycpBohFWeXHUwMDBmv5VKLlxury6XVZhcYrnscMBuIyqHta+Wg6+Wgm07eGxQ2srCyolSXHUwMDEy9tpOaJcnlNCLjppcclx1MDAxYvJqXHUwMDAyb5FyxeBcYqZcdTAwMGafVqpcZoe8XHUwMDEzpNctlHvE6btBXHUwMDBlXHUwMDA1SnHmoT1JW1x1MDAxMZFa1SGTJFx1MDAxNc/z9Ug1noL8XGZYSVx1MDAxNkAyXFxcdTAwMDVcdTAwMTcnnYLqXGI5Q6dcdTAwMDHufELhf98//Ts3XHUwMDAxezhcdTAwMWPTMFx1MDAwMTSaSeCc6Lb/6bhcdTAwMDNcIlE0NDF2XGZt0THkb+pt1Vx0IPaFfGragPvr2Udkn6kkoIdcXMW2piWvljBcdTAwMGKRXHUwMDAwT3Ni3/notJRcdTAwMWTtJDdKXHUwMDE3gvpcdTAwMGKMe0BDvTvwyHHm3Nr1JJLQOMq2f0SR0Vx1MDAxMFPkZFx1MDAwN9xLM/51x1xmQ5DN5mRcdTAwMTXv4qr6vGOO+WhcdG7fXHUwMDFkXHUwMDA09a3k71Sy3+zTjFx1MDAxY//czbROxsBhwJ+IS79cdTAwMGZMXG45llx1MDAxNZXzk3gjOT4kwURcdTAwMTFA8V+rlvz+8vFcdTAwMDFcdTAwMTG+ScJ1L7PInNB8f1xc84s825OS8KyhPXv07Fx1MDAxMfZ1/jV3NeNcdTAwMTktb7PuuqL5t3M6o35nXGJ688VusnzcVTrRgNGUXHUwMDAyzca0r6KDXHUwMDFmSqfCTmkjuDSa8dX26klSa1x1MDAwNPLSw6yBuFx1MDAxNNZ2PLCIXHUwMDEylux7wXFcdTAwMWH1XHUwMDFkN+L9qi/YW3xcbjA5r0e1XHUwMDFhyF3jXHUwMDBmz+dcdTAwMTFmplx1MDAxMbhcdTAwMTWNtz/1N5OqXHUwMDEz052eKlx1MDAwM5/eoj6BSOZcdDHn/JFIxZGS01x1MDAxOVx1MDAwM4zJPPs4tc+IplhfqC6e7PFcdTAwMTXUfYBFqn2Oqlx1MDAxOVpcdTAwMTHx1aN8R0JgR4HhdYNl7Vx1MDAxZFx1MDAxMCX9bOurXHUwMDA039iVovmPt4xOUKhcdTAwMWJM2excdTAwMDJcbieGlIVg7PFcdTAwMDRR23/n5/PQ3YsvfFZJNI+KZ1bTXG4obS3Cgexuo1x1MDAwMGJKcXdU7a32K2jnlDJcdTAwMDM21PKhbnCB3Vx0N69cdTAwMGXFXHUwMDFhXHUwMDAxOKyEiDcrwTSmyJe293Ors1qShaWVwVxuaXVcYoWwy2F9R1Tyv6aSovhmhvRzfyS7iqDB/mHpmk4zOoGLdm5Nrn5AZp00xoVcdTAwMTLzXHUwMDBi301cdTAwMTWHXHUwMDFm/Fx1MDAwYmRcdTAwMTQ+dmcu26qF/XU9ez9wV5Vjms08roX4UoHgj9uJ8SlcdTAwMTegYbbESHXlXHUwMDE3i0egJ2qEzbTlcvFIrPwupV6225tfXG79yYBAwMSv7bpkVny9sGNCXHUwMDAwkPUqvvbPXHUwMDEwipHIoyBcZs9TXHUwMDFmaNPQXHUwMDFltKZcdTAwMTB3Yp3UXHUwMDA0XHUwMDEzKE+/07j62Sj6eTmown5cdTAwMTHW51x1MDAwZnpfqiNcdTAwMTZ3nIye3jvpv+9cdTAwMTP8e93D61x1MDAwMEztoNpIuVx1MDAxZtBcdTAwMTE1X2CcxExccmVPIFDgt9aNPHBydmgrNKY5ZtVixFx1MDAxMvDfP09wa1x1MDAxYWJcdTAwMWWWkmQ21bqzXHUwMDBleEPHXHUwMDAwt4Q0/9bJXHUwMDFiu15RcEVpXHUwMDE2Q1x1MDAxN56JwmQnXHUwMDE29M6bLnxWq+p3cEuQq4laXHUwMDBmQsa9+d95n4f3Jlx1MDAxMbqdXHUwMDE37fMzpMpxtepcdTAwMTSoSv1INdBN5LaVXCI080BcdTAwMDPaiVx1MDAxZcHtW75cclcloIC1gN0pXHUwMDA0/1x1MDAxZJxAfllcdTAwMTHV+0X64TQu5NS3aDzAuUjnL1x1MDAwNyDZUSTBqqxybltprs1ZqsLV3rufoJrM4Yor6LxcdTAwMTkwxU+ZVkVcdTAwMTJ886DJRTXY8VwiPlx1MDAwNTArZMavXHUwMDA0WFx1MDAwNqxeLDXxN/4qWHe2k/h33YiVXG42yyhdXFzwNyBcdTAwMTk63zQvPIRLqVx1MDAxNJBcdTAwMTg4kEacrjf7mijFr5/4P1x1MDAxNlx1MDAwZlx1MDAxYzuHmGNFMopkLlx1MDAxY/j194nV7d8+8tRcdTAwMWW/8+3V2HC4jZJHuyp4M+xcdTAwMDVzcfrLNEKG0auLUYGR86fqJ5cyepqiXHUwMDA17YxcbuWhKyFhLVuLolxma+JcdTAwMGbavZ5cIv2s2EjUXHUwMDFhXHUwMDAxXHUwMDBlKGdKrFx1MDAxNrLbuilcdTAwMDMgsUDMODBxztbMXHUwMDBmIXWc4/t0qia6XHUwMDFmwu+7Ulx1MDAxMGbev4RcdTAwMTjr1TdcdTAwMGV/XHUwMDEx7mJvneZucrOfR8FcdTAwMTe08Xh7wzRcdTAwMDE3nIctJ5M7Z9M+6PqtXHUwMDAxwbGAXHUwMDBidXhcbsh08Hzz6PHmuL+ts+lcdTAwMGVcdTAwMDGgsYblYY6Dr1xmh5+ssipxPznfXHUwMDA2XHUwMDA37owjXHUwMDExXHUwMDBmXG72mFx1MDAwM87CVosrXHUwMDFl781R9PxgMdpKPOc4WzONv8905rZMPOrZJ1x1MDAwYo9eyY9Zn8HiOVxu7dW+oW+trGNcdTAwMTGluFx1MDAwMvm8PjJTLTZcdTAwMWP+9aVcdTAwMTBvd8fesTtzpUb6QodcdTAwMTFZt+RcdTAwMTjd0NKxkK+CXG6Zv1xmKZP0zVx1MDAxMSSGsNxcdTAwMDbGb6aQcULFwG/J0EWZO1ORMFx1MDAwZVx1MDAxNELsd1ZeOnuxLk9haVx1MDAwZZP/9sN3riXizlcy+vXe4Vx1MDAxYqpcYjNbdpreXHUwMDEz+3u6RFS3xYdYXHUwMDEyRYS61IJmko7MWpc3XHUwMDE2JV9exThgXuexKqD0Yew7QnGto1x1MDAxOf5lTEg42TghXHUwMDE4fqyaosZfKG1xUVxm+0CBXHUwMDA1hylKKSCd2kNcdTAwMTCrR0o1J1bp5fPc8aF8bZFVNLCXf1Y1PDFaqKLaZpA/j/5Vq46G1c6UkPS+Pd9cdTAwMDVsZnTK5ldl8SslMIG/ePFcdTAwMWWHfjNYpOgvM2E4M06fv9JcdTAwMTdfdpJxwHZdYFx1MDAwYitcdTAwMTfi4Vx1MDAwZsO+mTe6M+tKjUOo3vnUWJXu/caXp3prNC4mQlx1MDAxYX1cdTAwMGZqIWftRFx1MDAwZdfopMbJLluxfkF8rYaXeVx1MDAxMqNEvmGlXHUwMDBi30ar8IxjP04/+aOu9Vx1MDAwMHZcclx0MZby54ObZEM+puiw5sJcdTAwMTan9p6Jwu+4h0f3YoR/eqWlo3CK5lx1MDAwN0mVisd/10Ng5X45pc3jUf+QXHUwMDA2N1QsIFx1MDAxMVx1MDAxYlx1MDAwNIqwXHUwMDEw6lS24ff1XHUwMDBliFx1MDAxN5ZJM/v/1MuS79yA8aBLXHUwMDA3QFx1MDAwMDSfnVStZ6eU6c1cdTAwMWTb4mX8nonriy1RzTtK1dYq4TF5h1x1MDAwZYrbY0D7XHJcdTAwMTVociGmPF4w/FxyvsNRNJ62OWj8jSvz+PLHel2BbnE8tbdDXGJsPfI+o54l6kWxcuaGQV3EasqLZaF/3jk4zn/rPVx1MDAwNU5eUpRcdTAwMTNccrhcdTAwMTdcdTAwMDUuV19cdTAwMGXEMI/OqcImx7+V0O9cdTAwMThcXFxc9FpJzFlcdTAwMTVog0ZzbFRcdTAwMDBcdTAwMTlcblx1MDAwZtSw5GpcdTAwMDHNUzaX5WaDXHUwMDE4XHUwMDE2J6hcdTAwMWbYciU4XCJey8NcdTAwMDClq/NVT2Tq7DA0f5LjboEkJkM8XGZMJn6+sOddYHnCv/md29aJXG65Q+2XsZdcdTAwMTmjp3eXmM5YZeSI/yRcdTAwMTdPgJaAXG5cdTAwMTbeXHUwMDEwiGbuh9NcdTAwMWRJ5ThcdTAwMGaVzGvSvVwi/PhcdTAwMDJ3XFzPmz6rPG5rREOf55Et/PMzX5G1y5rlnXmyLLWr5klKNi96NlhyXG7UZcR8PSBBzDlqM09cdTAwMWVZOPPKk+5p6TqGT1x1MDAwNO/8zJIgXHUwMDA0POSGO5yOO3HRkehcdTAwMGZcdTAwMDXo9CVcdTAwMDXjoDTjbjtcdTAwMTjRqyrK84PL3qT8ZsYm4Yv4ZX1cdTAwMDJdLmZeiZBAjqxaJ/ShX1x1MDAxNnp44+9qzsKr1c/kVXVJuyA2Quw62a+rOHPiOb9jJkKJpj6lxLPE5mfEb1CYgY1Gp1ukSuLQTMN06/5cdTAwMGVqritwwL9+XHUwMDE298b0XCK3xbGV5uhEsOqVxDNcZlxivVx1MDAwZaJmf/VtcDA5jvjDVSdcdTAwMTj96lx1MDAxMIthKWW34qbc4C09djp9wY2Jq8TPoKZf0FF9glGdQsfWRcQumaBVklx1MDAwYp9cdTAwMTFcdTAwMDPDN9Bepb28hI5nMaibXHUwMDFl3bPFs/7sxyhcdTAwMGaO28VT1Enb/XaTpelcdTAwMTm6XoSaRmSPZY6n7DhcdTAwMWHn3G2Fy2dfXHUwMDAywchj6pynKdeRo6VFu76k49SI4W89Q/yeTkDiXHUwMDFm+tM071xc/lx1MDAxMVx0v4jnP/LcO78sZoWDd7YyXHUwMDE1erfXwjrgxMx/7WLQ1q0jsbKTfU1UWZz7Y1x1MDAxOUFW+PNDSFx0IFx1MDAxMVYv2klcdTAwMTam/dSu/ddNRyHUbWip9PmiXHUwMDA0h1J32qLui5JcdTAwMGX1XCJcXFdcdTAwMTU9S0rnXGLetO0weSTvXHUwMDE39Nx7OOhqNqqBcebtKN3dMdo1t8iMYNmtsVmFOmJvNrRiTfykhTigt9FDfIA011x1MDAwNFK/RyHNgdeLl0FAq0K+0bOfXHUwMDE0PFx1MDAxNCz4YjUoXHUwMDAyxtRjnrNZTcJcdTAwMTW748R826Xo1Vx1MDAxM+9MpZNHXHUwMDFj9HJD36D6yL9Z2CbXJVx1MDAxOVx1MDAwZlFcdTAwMTZGlz1BS4Nh9uD+LGVQoPxcdTAwMTZEXGZcdTAwMTkjXHUwMDEy08YmJExR/jurklGpZFNcdTAwMDSsrKTcMTxJjL3/XHUwMDE4nlx1MDAwMkm/fYmHhX1cdTAwMTneVc+q1jdcZphax1FgbIg7dFx1MDAwZp6zTmbZXHUwMDBlULnXb77lN3k3cJB/h1phfMQrIH5cdTAwMTRzXHUwMDE2zlxmhWl89lx1MDAwN3MvXHUwMDAwvjXpQoZ15ZCOblx1MDAxY62DkO4uWp3ZfrZcdTAwMDHctCtcIpvyLJXr+HVNlf8kXHUwMDFmNezUPf1cXCTKXHUwMDEzXHUwMDE4qHt+ZsPtXHUwMDA2craa7SeGXHUwMDBmrWF/K9uX+9uLXHUwMDEyisJcdTAwMTbVWlfMX3rzXGaXOpGVmvo0mCPvKsGjp1x1MDAwNPn1T3d7/NvyS8S0lUOqXHUwMDA0k1uSL2PScua6XnmWJFx1MDAxOV6Ov+FcYipNPW3XnZiYWCZx+kWhQ+KpvKMmXHUwMDE2IMXxx2SQkpqSZTl+zcrvobHk/Xj3fVxuNJMhyvlWZt7KcU1cdTAwMTGJb7xSPiemXHUwMDEyPlx1MDAxMCt7XHUwMDE1XGIgylx1MDAxNIL4/XqVeMaQgcpfJJOfqN+8/n1ZRZ0vdKF0XHTIsUGd9TQ9XHUwMDEyK+vmXHUwMDFiazthV1x1MDAwNvJ4XHUwMDA0N6WL47wj+1x1MDAxMVwiOc3Yk9dbnEc4/DHOWFx1MDAwMamIzZ/ngziLYPLUXHUwMDBmK/zfgVx1MDAxZpOk6HxEjmf29adcdTAwMWZ1P3Wid3PR60LPXHUwMDAwVL/5daNfL4XgXHUwMDA3OFx1MDAwMLmEilx1MDAxOWpcdTAwMWWWjFx1MDAxZlx1MDAxYZv77fnwSG2fLGs5yo9KJaI6rPhcdTAwMWHdneaYXHUwMDEwMoaj/qlImtlcYqaUbbWB7zk52M0/RbrpVca9XHUwMDE2MfS0/7pu+y/Q0WY2UTaFUFjHmO6An9P+rZhpnv28g79r+pZZsFD7sVx1MDAxZOJcdTAwMWJqi6J/Z1wiXHUwMDE3fr2m44CFzfONM7vXf0GZput3XG5FSv3mfCPzwWFz/Y/Ei5bFfVx1MDAxNGI0XHUwMDFlWPS95ZOUxzzqtmh4iEpR829cdTAwMDG4kfRefSonddZ55VxmOjhcdTAwMDCN3GXt7+bbKsq8LKWS8yC20Zn/rHHrgNZHLzdGXHUwMDFm6qMpXHUwMDBi22ZfxtRcdLCmXHUwMDFhTsBfP3kjMkhtp1fKZVx1MDAwMpWt1Wn2+Vx1MDAwMzqdemujf4XjcjNdU1x1MDAwMIavhf1cdTAwMDRcdTAwMDOlsbCPPq5oXHUwMDAw6l/Rw/FYVsAvnOx11aPBvf2keDKeXHUwMDE2/GX2g01eeVx1MDAwMlOxZi9xPy8rUO/E6JyyPSDsU1x1MDAxZHRcdTAwMDEwSlH+wjy13/xkvFx1MDAxManZXHUwMDA0XHUwMDFm12MyeFx1MDAxNVqKXFxcZmpUoMGmyVx1MDAxOGWjwtHk+lx1MDAwMUXpXHUwMDE1P/nZXHUwMDA0+1wi4NHGUCo6MCBv665nOaF7XcCByFx1MDAxYvAq9FdcdTAwMThKmz3forq7zYO4rGzd99fZ9lx1MDAxN1x1MDAxZn9cdTAwMWSwwfrrNqo4eHR1leJvezh6ziqNbsp47SaOk8uJk290Sn9cdTAwMTL692yG4Fx1MDAwMoA2Jtinvn/Wk+W0vlx1MDAwMnZkQCXiMCphdWRWXCJglv+SybZXbSHrXHUwMDA3c1x1MDAwZodcdTAwMDC3XG4jUj1U92/AoF94QSDlU5Ut2q+bXHUwMDAz5XzWIajML1x1MDAxOXs/IERglEbZSYZcdTAwMGXm/sDo16yRelx1MDAwNkqbNr7yZ/spb+BcdTAwMDE5XHUwMDFhYmN60k9cdTAwMGVcdTAwMTj7v77FglrTXGIj4VTOy8MhQJEsh1xu66lFd1x1MDAxNSdp24bzXHUwMDFirieg/4aYPOf71q6OsoqTN3mar1x1MDAwMVRccvf+XHKbvT5ryiFcdTAwMTPE9jh59iSZJSYj9lx1MDAwNZHYxS+NxuXVRHtmR4JdNlx1MDAxZvvSqLGlPMn3RlxuUKnHiFryONqnLsqRi5pHcSQ94456gZ8+RZOliDo7fStuhX8o41x1MDAwM5+9YmZcdTAwMDcrWovkn6VHL7swwKxIxpLZsSxQX47jdLORzL52gk6SWVx1MDAwNOaDw270+zrIeGN5s5vCXHUwMDEyf/NaXHUwMDE5XHUwMDA38T2YKI/xhS/WXGZcdTAwMDXq9k1FyJSCh62g49ikNERsi6DD5PYzc1x1MDAxN/WNSORcXOLosb3KXHUwMDA39M2oknV1VfsqZflGbFx1MDAxOD3ReGw3PahTauUw3NrjXHUwMDBm3EH/0Fx1MDAwMdbhZpefREbau4xbXHUwMDAwyczfPJ7DXHUwMDA2wf2tXd48yd1nh0P67U7Z5f65jkX0P1x1MDAxYqGovD3B+LuxYXBR/Js/0JFcdTAwMGakXGYkYf0gIVpQXHUwMDEzysdcdTAwMTg24+ovmFOhXHUwMDAwz5t3MHxvXHUwMDBigDWXYTfI2lx1MDAwN/28wTyfXHUwMDFjXHUwMDE3wtRXXHUwMDAzPannwXjTXHUwMDE3yXt+2SG2ZOEsRFAndaJcdTAwMThjL1ReMV9n0zu4j82sxz5DMiQohiS+a8nSYcf8XGY+hMZHsIrKjTW/cay9f1x1MDAxNXErXHUwMDFlxGaGdf49S5BcdTAwMDTg0b7UdyVHrUplsF+ndjvHL5HeXGJcdFx1MDAwNyi4rVx0WK+JcOTBaPqLZ32L+YzasoVmyz5f1pWTS5fR01tRXHUwMDAyktrcJiuHXHUwMDA1S4ZqeXT56/25XHUwMDA09vkqT3F93Vx1MDAxODyhXHUwMDFknu4teVx1MDAwNPj4vjqLaImKv78vwVx1MDAwM9IlNLv84D7sz5jHXHUwMDExTSb1qmZ+1ydcdTAwMWF5MOJcdTAwMDRm0ttxwuKZsl5OeTzwxbJcdTAwMDRKw1xim5lj+bu/zcvnXHUwMDBixjJd7OpcdTAwMGK5lrFXbCbA3kvo41x1MDAwZVxmXHUwMDFhopew707SJilcdTAwMDSrwlx1MDAxOW55c8P07+GtkHpPUVFcdTAwMTbV9Fx1MDAxNlx1MDAwYo1cdTAwMTXee1JHXHUwMDAzu2qCYomEXHUwMDAyXCLFXHUwMDBlOsZnvpD9nTtMmlx1MDAwMFx1MDAwMGT0X2Q7WlKhdFK8octcdTAwMTFyuErp7dszMTBcdTAwMTihrDaVOn5qXHUwMDExyMxalUky+5Yjb4fyXHIsLvxWXCJj5VrOOPxvYIJNmJlcdTAwMWZcdTAwMDTAk1x1MDAwN31cdTAwMDKF0Fx1MDAwZbl9y+h88yveXHUwMDE15b/2t0p4XHUwMDAyr9IynE23STE99tRcdTAwMTdcdTAwMTlQXHUwMDE5n1x0xui/UF/rrChcdTAwMWNcdTAwMWZcdTAwMTPqyak/XHUwMDAyhDp6klx1MDAwMpJcdTAwMTEn78O1zVx1MDAxOe1cdTAwMWFrP7X5rTJcdTAwMTJcdTAwMWOIebOY9vhsXFxVXCJcdTAwMTAqr1ZkXeVgRDY+XHUwMDExXHUwMDAyZkj7jzlEnLB/XHUwMDFmjLP2NHnRTyjqiS1LiX7fW8CbXHUwMDBm7adcdTAwMDRcdTAwMDNuXHUwMDAz9Cuq1/e/XGYl2/34XHUwMDE1KlxyXHTmXHUwMDAwkElcdTAwMTW669jUius4hmQpfadJXHUwMDFkSL+074dccm5lpzVsRrn2l6tkdnefXHUwMDEyM3C+gD8tPP7GhTDqjyWvo9udOHV6XHUwMDE0XGJ2LyGNp/W5MZR4Oex3u4M+K2/+/ppcXDNccv/jfqwmqNXfukdcdTAwMTDMoihXw987b3+1ylx0MXG8OVJRmMjrbY2xhyZeXHUwMDAxJn79m51GXHUwMDEwlFCaSlu8aYKvsPqVrWRONyiKwjfnT6llJ+lF796Ijn89XHUwMDE2rlx1MDAwMeKslMG/b1x1MDAxOS9oN5PuKzRetOm/k8dsXHUwMDA1XGIums1sOFx1MDAxMyEvdfueXHUwMDE2nnjheVx1MDAxNlx1MDAxYUM2aPlv7lS+XHUwMDFk0HHM+6kz0/tCru+gXHUwMDE3jvBcdTAwMWOWWHWN2kdcdTAwMDB9XHUwMDFhkjSBydOTk1piZ2Zjp69cdTAwMDXto1vguVM7rTqQ+YtcdTAwMWNSry/CNjBcdTAwMTBo6ozKeL+wolx1MDAxNv62NWlgLvTioVVdcct3XHUwMDA1iFegeFx1MDAwMvTBaJfLW1DMXHUwMDBmptJcdTAwMDBt+XJUL29S911VeIIwXHUwMDAw+9sw27hcdTAwMTSQk6VgP1x1MDAxZkCPMyOeVXRcdTAwMTNo/rFcdTAwMTlyqetLdyjwlWxcZlx1MDAxNN3gZepcdTAwMTXRRYA/dFx1MDAxMjNcclx1MDAxY2dsNm+l09jouUZZ8VdYbIec41x1MDAxZVx1MDAxMHVcdTAwMTJcdTAwMDTTKky085i5Qlx1MDAwZVxymUJNb1jHVMW8Tojig1wi8mWUZffq/zy7XHUwMDA21U1cZphcYs+LyVP6We9HXHUwMDFhr4Ji2zxqsTTj4uhU0qcsjvXlc19cdTAwMDBx6M5Gbsv7XHUwMDBiXHUwMDA2hir7ve+yLXVcdTAwMWOvyFxmyOEnMatUP0bZ11x1MDAxZMJcdTAwMWNuXzRZ9pmuXHUwMDExXHUwMDFlIYHm1CwvPucoj9iLNPlcdTAwMDSBXHJS5rHiikc1XHUwMDFmfSg9LEO/R9ZGTHJl21x1MDAxNfjH9406qZDFO9DHzUnrZPeMXHUwMDFix+tYvV6VnbOEXHUwMDAx0/skbjL6bV7vXHUwMDAw08K2I+zdbrTy+LxGfStcXLSU5lx0n1x1MDAxZVx1MDAwMKY6hpTjX1x1MDAwZlx1MDAxZjLj7Lkj5UlcdTAwMTFpyiqPXHUwMDExXHUwMDA30UrB4I6hgec2bS5av1xmw1SM0Fx1MDAwYk7oVTr58lvmwlwiXG5cdTAwMTJ4421cdTAwMTG4zeu4Ylxc7HREzevXwn+yXHUwMDFhJljeaYvOJlx1MDAxY6BFIybgfs1LnXoxXHUwMDA3Y1x1MDAwZrPvXHUwMDFiI02II+FcdTAwMGVcdTAwMWU8XHUwMDE4xIBcYjX2nvKvg2GboYpcdTAwMWT4Y2ElnyNcdTAwMDfX3plxPtvXXHUwMDFheVx1MDAxYdY7LM3p/M1Gn+lyWPTzzq7xVcj/7C/SXHUwMDBieX0z63ryXHUwMDAxTDlaqFx1MDAwYjlcdTAwMTdcbsp6XHUwMDE2SMxcbo7UJazqOeLfXHUwMDBlXHUwMDA1l6xpXGaKrbTCfNHvs7Y7zdruZ4kurVx1MDAwYvWTb5uPMDKw5VhcdTAwMTHpXT6alYp3lsV9o6/H+ZAk33enMMNPQblmqab7ljS2rIVcdTAwMWKxim1ZpI8kXHUwMDA3wqKzwXpcdTAwMTKB3FxmOzhGPk56w93cfKUmhlx1MDAwYuGyuiNcdTAwMWGqOiotMDdcdTAwMDF8n2+0e/lFPUNcdTAwMGKZeibCRfRmVpVkb5xE08Q4ulx1MDAwMNX3SSqIXHUwMDE0dDXAXHUwMDA2nVx1MDAwNLQ4rFx1MDAwMnmgntBcdTAwMDQ33FxueX3afZ0pRFx1MDAwMbyh3XyMqiEm5q+tb1x1MDAxMjnbXHUwMDFhgevqp4ZMXHUwMDA2MFx1MDAxMHqoX5Oj6M2pjoPMNFx1MDAxM8dgpip/u1xmh/LO+nOL6Fvw8m+zS/KUmsRTVlx1MDAwNv1cdTAwMTPk6eBzXVx1MDAxMbOlXHUwMDEzMF5h5S/5R5NP0jL3O8eQN2Kg+Vx1MDAxMWFcdE18X8ZcdTAwMTNXQL5ccoiULsF+Y31oP4bN9eleq/NaXHUwMDE1y9qsUclOL1x1MDAxMj5cdTAwMDMvTFx1MDAxNnreqC0l9rp+XHUwMDAxnbiAb1x1MDAxZEGWdYG5hbD7alwiJPOBJ66tRXm0TlwiLWxcdTAwMWRLiL0oopbFZsOuSyNvXHUwMDFkomNcdTAwMDCe943A3/Ahylx1MDAxYqRCcVg6kq/FMugjny5Noqc1XHUwMDEwhcFeLf/rP/LOxGBcdM3vrD3JtUVayXKQ1SlGZLpmVpR10fw6o/8lcjqjwlx1MDAxYmuUSdhcdTAwMWFsTlx1MDAxZjs5fIn9bUmir/Ch9unxpaJ3Mm1cdTAwMTFFXHUwMDA3PTMuzzczLl+aatJOuVx1MDAwZYvLiqyiiOnEXfusm2rtg+xX8dFe8DtGR7KXzFx1MDAxOdSH/PVcdTAwMDT1uiBcdTAwMWRP3qHczXW+UnnK6s5og0kq1TQ6P6C9iWnPOGy+Vd1ht6Aqz1RcdTAwMWTjLSMyLlxct49cdTAwMTF0K0+VTkdX/UG10i8/z37yl/bB5FSkTSU5ZVxcXHUwMDE535jjZJifxolEf7su/73RXCIn88FcYnr+IaQ4LlN5XHUwMDA03KrmJVx00Fxupl1ProlcdTAwMDNsjV5SUe3NZl6UXHUwMDFh+atcdTAwMDZcdTAwMDC7XCLMvE7Kz24qw4Qo+HknfcvM3Vx1MDAxN2i9XHUwMDAxXHUwMDFkbjC0uUtOj9RO+VX/e8ApXHUwMDA0lJzuYVlloLlccluZ/T5cdTAwMTDOd838lFdcdTAwMTVcdTAwMGZcbqr8PLKL4Vx1MDAxNlx1MDAxYcFcdTAwMWW0W7GA1p5LYVx1MDAxZfBf5a2ezL3zXnqZWiHKz2Ja3utcdTAwMTI2r9HA5vavpU+SXHUwMDAzlqXsXHUwMDE3Wektg94/S1x1MDAxNDPQiapPnFx1MDAwYluoYv/Vn+BfOlwiP+orJMJue/n63Fx1MDAxNZ6n4NdcdGrVXHUwMDAwP61cdTAwMWFcdTAwMGJnjK7UZ38uwGp1+lsvUzEkOPhmdCmAvJK5xV4x7YRH/FxuqzdcdTAwMTSAxSud1q0w3Dxb7CpUXHUwMDBiua3HJ1xi7pRr8M9cdTAwMDBVtHC0OuD8kr5ssiNcdTAwMWUvnUi05dXGQVx1MDAxM1x1MDAxNTNcIlRcdTAwMDLINmHXXUxbN0X378d5PcF144d3XHUwMDEyXHUwMDA3vpSTd2xlb/Q9XVuqK8dcdTAwMDQ2U2m4k1fMgKhcXNtbfi1jayz1xcSzXGL+OrWwZuaAXHUwMDEzcVx1MDAxN2V9bNExYSROXHUwMDEywnpSJL9TeckwXHUwMDFigr0kyPHjvtlRMJ9cdTAwMDKNVirQXHUwMDFiXHUwMDFiNFx1MDAwNcTDjJejXHUwMDE1XjNPuvCmXHRMszrEnfG8XGaexqlcXJb3rpf9f/xmTpXyxrBBXHUwMDE5viM+cJ+Uplx1MDAxZfEn85TAXHUwMDAyXHUwMDEwJZhcdTAwMTm1M6x+wI1cdTAwMWSJUKtcdTAwMWKHZsGgR7nZOGZGjVDxeZ3bmFDynT98XHUwMDBmRdlF/Vr2sSxs8lxmXHUwMDFlQVx1MDAxYUZcIq06hfqSvWs823tdXGZcdTAwMTI30Fx1MDAwMcMqo2nHXHUwMDE3N2+/jG82XHUwMDE4ToVollx1MDAwM034XCItYplcdTAwMTc+iCSWTuO4WVxyXHKXfMOXXFz2TX/s44lUhnTBVb12Rlx1MDAwM3n5nVuFXHUwMDAzyPe/Zlx1MDAxNqmqXHUwMDAw83VcdTAwMDFEjbhJN22P/37423LM5X5cdTAwMWXJWYVYe+GvdubUmTXrjYB3m9Wj0ipcdTAwMTMnycZcdTAwMWGUmtdcYq5cdHJknVx1MDAxZCekaj1gRFx1MDAxZufhXHUwMDExTJAwcun6wbaPMGhcdTAwMDMz465cdTAwMWZcdTAwMDJQ6qPcY3EwiWMvVP7W3c9uTXc/sVx1MDAxMraxvOFpilx054v4e37U2/eOUa+Uv725/FZSz2nWKYSNIa4xtuw/71DUNjf9++WwXHUwMDAxPX2zRWHBXWfGXHUwMDE3/u43zOfKOUTSfoFcdTAwMTSYXHUwMDFlQFJ961x1MDAwNZ0zXHUwMDFjnS/7i+2W0SXk1N54uLbKVsxKVH16WVx1MDAwZp8+r1x1MDAxMj5CskHbTiqpWcCWsJlcdTAwMTRvUCSRbD+XcFx1MDAxYyffp/dNdltFtfNEgLGWhThYWqdcdTAwMTWvXHUwMDA3aCtcdTAwMDaDfFx0sMk7aTuYuzn1R0GXXCLBjMOudpLkJlx1MDAxYYc+1HJAKC5cdTAwMWEydWXPqpJf/MVz5bvlXHUwMDBmLufEru+xTsTaQ/UjPX23m1x1MDAxM0pcdTAwMTW4MnGeW8yCTCl8ntsyXHUwMDEyU2NK8uVcdTAwMDPbuPDU7X9/j8ckXHUwMDEzNMTKr2xLNkeDmYGwNGkuuDVff7BcdTAwMTn9a5LvZF4pkN3c52dL24qIpPTbXHLeXHUwMDFmaCF2pFqqO3fVnyrnSZ/yjo7L5CG8Q1x1MDAxNMIpXHUwMDEwqsCEoI7bUlx1MDAxN6pa9PlcdTAwMTZ04Xm8yOC+MvHlPJv1iqRH+1d+0Itx3EmN725cdTAwMWKuIVx1MDAxMjvma/71WIvZXHK3MDiJXHJLX+iyhTFcbmjdN/K9XHUwMDFmX51cdTAwMDGJvdI32Vx1MDAxZsOhyMPcfVx1MDAxMtRtprw7yGmdy39ee+BecmgwppmYXHUwMDFkhlx1MDAwMItcdTAwMTPEdL2Z3q+4yU41gFx1MDAxYlx1MDAxY4VoSpS83vqkKFBY9qjE5kn+3Fqv5mxHMIxrSMo17zZXXHUwMDA3w0vN3utoKeVcdTAwMGaVXHUwMDFiWVoyi7WD16VITcrhc1CuaqOYdNPmW0HYhlxmXHUwMDA3OLZccohcdTAwMDGgdJA6bSmKMWe7XHUwMDFi0beYfnXXku6XXHUwMDE5svgqPcoppH74VFx0RUp8g8I/Sea4ov2iirOCoFx1MDAwMNm/WlGGXHUwMDA02qh2/Vv7bLXarCrf/XebP8VRiWu1sILqvUFGUijg7d2Rv1st6VLM0KHLuHrvyO+ItFx1MDAxYdNzTujCY89fK7N0I7gvJ/XT4bRFm79nYOxztUM7UX1cdTAwMDZcdTAwMWWzRt/OXHUwMDA1UGPa1lx1MDAxZtBcdTAwMDeQjdiAv9RcdTAwMDOQfO723/xlXHUwMDExz0dcdTAwMTBSsNfxmsyDgItcdTAwMTby/Fx1MDAxMnG3p2dP9Ue0/TnUkP23WN/iKJJDzby4Ps7nIbRr9sBcdTAwMDXjWe6MXHUwMDAzXHUwMDE4V+9sXHUwMDA2yS/VXHIuMt/1XHUwMDEw81x1MDAxZneW+JbFeXVcdTAwMWZY+cRo5mfZSG2BhT31uvysXHTleP5cdTAwMWKR2dKLbDLyraJcIqxVySV+mOSRwtJbK0qrN2P7MJTDO75vXHUwMDE02SNEZlxyKr1cdTAwMWXIeZTFLzRcdTAwMDXs71RDnMRQXGJcdTAwMWXHv7MhXHUwMDAwMFx1MDAxY5zQXGZDrGxOweq3VPG5bsggPkaMebhoN/vkUNnf1iVhU5aHVSHognuWfJFyXFxkpkOs4YBybGiVrlxm58a1fKo97yOWdX1cdTAwMTeZUpGay2tcdTAwMTZcdTAwMDX+b9etN1x1MDAwNfkrcC8r41xyVNtmXHUwMDE2gIEoPmTMtzD0ZcJuWHiR9eLhb3RcdTAwMTCci9Y1g8FK+kHCNktrc9vZI/22OU1cdTAwMTU8jeat8Fx1MDAxYu3kZ0ZcdTAwMTlcdTAwMWbcajL8uDBcdTAwMDYg6C1cdTAwMWTeUndcdTAwMDMrSSDPjOEzgVxmyMGkIJdmeU5cdTAwMWPAJ417PTZexW1toGP7yc3jTIzBh5hcYl/jO7pkXHUwMDExwWDXbPgnrHNcdTAwMGZflITaq1x1MDAwMlx1MDAxZVx1MDAxN1x1MDAwZSgy9KtFXHUwMDE0wHSG3VxmXHUwMDAxsJLtXHUwMDFk/MJcdTAwMTjFV7T7zuXjIcQ6WS/S1cHzOvxZQldcYsW+oVx1MDAxYnNcbrbI0etcdP+Nz+xZRnkzOfr9NnAgOCoj6MvpXFx+XHUwMDAyZdNcdTAwMTJmWzbTSlvnWc4mkyDwaeGycsCO4FBcdTAwMThcdTAwMGXzXHUwMDFhdFx1MDAxOWQn2Fx1MDAxZllC5vxCoy9cdTAwMWZ5v6CX+6eO3qQ/lr6LhcbXQ3uccV5N929AL+1cbq+mL+rEXHUwMDFmOY1Adv/ptOxcdTAwMWONNqxcdTAwMDG4X0jcfKHzhvLYrc5KIJNtwYK4neYyPzH8iSHz8Tht+5p3tyaE6/1zncdcdTAwMGJWTnSJXHUwMDBlK3s1XjssXHUwMDE5XHUwMDFkYuDjv1x1MDAwMpZcdTAwMWWV+OuRl7Cla2HU5/GpfFxczLLVXHUwMDBmI1SGVeaqoFRJvPKbmbTnvrK2Nri1hFDmZkdxVT05j3DO2VnO4cPLOmToXHUwMDE1IVx1MDAxNt0nXHUwMDAysUp0fVx1MDAxNmzc9nrng0RA1fDTUeqELoRcIqZcdTAwMTavcmdaXHUwMDE0vYhlWJzFklYxi/jtXHUwMDFiKPGQ4bbOXHUwMDA3yjMwXHUwMDAzP5E5XHUwMDE01XAskFx1MDAxMoKMcrCLIc+eJL9cdTAwMTFlb+7Jd1x1MDAwNz3GXFz/OZHfocCf/rTloIxSLvnNgj32XHUwMDBlXFxcdTAwMTU/91x1MDAwNnus23Vv3KOLskGollx1MDAxZGCFkCtUc+V7K+aHXHUwMDBisXHTUVBexGFcIj22NJs1VVNmfGF3XHUwMDA2tVx1MDAxNKlcdTAwMTldPUSfSrNWh1G0XHUwMDE2Y9uvSlx1MDAxMMQxO+ezhrtG42qklnFV/OBD8rNeXHUwMDA0QtuXtFx1MDAxZivF5s9NSF6J6KXSmWndpVx1MDAwMYTGRKNztVx1MDAxZqDn7iGCb1x1MDAxOD/1XHUwMDE15ppCJc2yXHUwMDEwpkB9mSo4OKc43aq5/Fxyu868hCnuZNOEnKaqtmxcdTAwMWI04mFcdTAwMGZTJd5w2TxdcChcdTAwMWTOyld/PWZkvKwpqtOtdHFyRVxuz1KqXHUwMDEymfWPLn/9rc2bWJpcdTAwMGUkqVx1MDAxM4sgq7xjSVmHr6cl3dzeXHUwMDBmd8g0XbWNy90xWViwm8QkhTinJSNtXHUwMDEzXCJFWWVgvFuaNJSvXHUwMDA2O1x1MDAxMCZOXHUwMDEwSq1VXFyKozosrVwii3OzJlx1MDAxM5V4gY2kzVx1MDAxMbJOXHUwMDE3Tlx1MDAxN7pNyv2Rru5Ru4QkfyeoxSmT0jBZXHUwMDFihniiIJJcdTAwMDNcdTAwMTh53IfyMfdcdTAwMTOiXopkzMWvIVxiY/3c9EB6NIFx4iNebFXTIPPyzjNLSlx1MDAxMnnEay1NfnFcIlx1MDAxM25tXCL2WG9cXPBbbEksXHUwMDAxUFf9TEDX8Vxih1x1MDAxZDSE7/pcdTAwMTEm3Z+ajyhWZcFjNst5/VxuT1qD99F9uJ+jWzlfM7uNr0Gn4fq/3kCZSYP8nlx1MDAxYvGJXFxzXHUwMDE1XHUwMDFkV6Xg31x1MDAwZeNcdTAwMTDdQXiegdDx6d6Usn2z4mg3UFS1KcI8d2KwUDbNXHUwMDA35HVcdTAwMDBcdTAwMWOBUrhcdTAwMTeeXHUwMDFiqK+U1cl7kFx1MDAxNb327UZDXHUwMDFlj9wlZE/6N1BmXHUwMDBm3OpObEco9/pNvV5RMlx1MDAxZbr4b1wi13TKPHGq27Q763tcdTAwMWb2XHUwMDFiwkzAj4FZ+r/uO4twWcOgXbiC6Vx1MDAxYsjdV1x1MDAxYVx1MDAxZWTFiv7z2mnA1IIjMO4rp07RXHUwMDA07ONj+1HQ2ndqq1x1MDAwM3e4YaRcdTAwMDFcYlOO/j2hjfK3z8JcdTAwMTH7kND8Tnkv6suaetFD7DelgeZEM1x1MDAxYXBzXiOznnojuN7l/H32rId/4qWTx8OmZj+eXFxcdTAwMWREvotcdTAwMTRITW/8wG5bjtDG67rYXHJBXGKLfXr8yiek1iFQISxL+0JcdTAwMGbVtE4zMT9cdTAwMTnPpuOVXHUwMDEwmcqu38yeWYB4YT/L+PtcdTAwMDdz7r5cdTAwMGJcdTAwMDReXFxcdTAwMThdXHUwMDA1tPmaaS2YvGqTm9I3kqnhnFx1MDAxNc+Ri6/wdaBuOnxcdTAwMDc7d0F96q1cdTAwMWVcdTAwMWafSHjNTn/OJ3VcdTAwMDE3zOa/xv/swFx1MDAxY7BXLF870N6xXHUwMDE36Vx0bNttmGORMUwxmuj2Xj080sXFzu/BXHUwMDFkXHUwMDFjOvVcdTAwMTbauOGsjZyoPq/p9NBScjZcdTAwMTR0XHUwMDAyJPLnJpVcdTAwMThWlYanyl6kJcVcdTAwMGaal43wc1wiPNv4QFVvfcqi11x1MDAxMrcgob+fl1x1MDAwNn9cdTAwMTFN8Vx1MDAxYXIx4XBQk1xyq7mR9Z9yXHUwMDFjPVxuXr7x/mGWlv5cdTAwMTE2cadvdvxG+XK/gbbeUytUmbnPOi9cdTAwMTniXHUwMDBmd9NSNidd6niAXHUwMDAytDRvXHS3JlxiheRfr1x1MDAxNkgnTMhcdTAwMTGOXHUwMDAzVWyUtslLXG6032pcZstcdTAwMDVKXHUwMDE1WJl7ZXjMsYKlSy6h8lNIhvNI8TMwvMgvetHTP0E/xNCyvbtcYoVHy+JWb/OsZ4GEQ1tCXFyEk+m/XHUwMDBiWjNcdTAwMGIx21x1MDAwYq5Rq21cIqVcdTAwMTGzXHRcdGfxSW5cdFx1MDAxMvP9XHUwMDFiXHUwMDE5Plx1MDAxZM/WwyhcdTAwMGZcdTAwMDZAlcHLU1x1MDAxNOuoqfukn0tcdTAwMWXebOX0M44wrbshU2Dap8aolYNyc1Az9HZwLoQnmYmlZlx1MDAwN3xqg0CdcWi30Ue1e1x1MDAxMlOsY5V5/1xidFZcdTAwMTGaUG6nisyKN/BcdTAwMDUjWdiWS4CWUHlK/mRZUtZcdTAwMTZmXHUwMDEwflx1MDAxNd+32W2Zo3sgv/500Zo6NMtcdTAwMTaLLU7v71x1MDAxZUqRWtcrg1JppsVnJdGhy1x1MDAwMOhprWOcNWHnIUriy27Id6Dcxnt6eaSjxHFcdTAwMGWbgvHYTifhZvZ19Kh9uvM+o1xiJlx1MDAxNvdcdTAwMDHUQ/FcdTAwMTJ4XHUwMDFhtduHzFxusVLq9elVfFBcdTAwMTLHaDWwM9MyVJ8nv05cdTAwMTk/e1x1MDAwMDlSt3tcdTAwMDR6XHUwMDA31b8zxb/7MtE3d+J/91x1MDAxNkOkpZj1NtHedqDOhfT3NJZwk2t7ZMnDXHUwMDE5tV8kXHUwMDA1XHUwMDE2+YudXHUwMDE4z8FcdTAwMTNcdTAwMDOffDuQ2tDXoJB3rvv+4L7pXpKErrHYm8Nvh41j18iLU+HTe2qKajI6sEeOL8BcdTAwMDXH8WvLUP94rlx1MDAxYVS7XHUwMDExNlx1MDAxYuY3rVx1MDAxNH6dXCKMaemalTSfN5VcdTAwMWTG2cmjXHUwMDE2XHUwMDA1rF+GXHUwMDFmark55r1VlKCkos5cdTAwMTPbm1x1MDAxOPBwu5yBJKeXKICbLzQsXFy7VGKZXnJEy8JcdTAwMDVYZ3mHVH6T6mR2kCDyYkbpV1xi6/imiqYuXHUwMDEySFdhI1xcXHKTXHUwMDE3hMRcdTAwMDNH/GZmm1x00d/wRWZQ1nW4h77zgrR+cFQkXHUwMDA1gI2dgejJtWsr2pGrS/Xy5f01bNbzXHUwMDFkXHUwMDFl+GjbyS4251x1MDAwYn9b6J0gQukoXHUwMDBmvuRcdTAwMWKS6/C9m9OUYNFAYPekqFx1MDAxMUXQjJusWnZcdTAwMWLqKXueqe5cdTAwMGZ61ztcdTAwMDbmsD155ZLIv+XHM1xc1LtziOFYK7sm/rBcdTAwMTj8YFhJN5fDTzr6pveMXHUwMDFhvMs6VKjqXGb5XG5qTzM0nH1ZVW+06yziKL46htt0XHUwMDE4QVx1MDAxOVx1MDAwNvrFWFx1MDAxMdk2XHUwMDE2uCuSyyh5/EX6/fPaLLqVglx0JVlcdTAwMDN9iL3GRuEq7vuXtM1J6T/X0PPUXHUwMDE0vGPS9Fx0kLP219JWaGWYR4Ofb6eWjK21XHUwMDFluYKP8eZ3q+Orn6+2mFwixfU6Rfpmjl6Q5MJ+6c5ssDaOK9h3XHUwMDAzgUH239PPf4OHc26zQL9cdTAwMGamS6T/XHUwMDE4KNd3UP6Fp0XnJMt+MdNIvedruTFRaJCSWt1X0d9qR5qj/Vx1MDAwNU0/tTWQ0DG2SXG4MVxisDHXNmthS5e2LYGUXHUwMDFlXHUwMDE4O7KjgTygsvvyQluallU7Ml1QuomErHlZ55Agyqpwv13oP9/JXHUwMDFh/1x1MDAxNlx1MDAxNkvN0e99qfvpnuJzXHUwMDEwK5BTI5pcdTAwMWT6nvBcdTAwMTYshz1cdTAwMTaAQ9HDcVxiXHK29l5EzoL6XHUwMDE3dejdXHUwMDFj27qdXHUwMDFhy1xu/aePttCn8lx1MDAxYYHmm1x1MDAxZmZaP38tOH+cP6CXx31cbmEyeniL5ozT57veXvVxuZBFvY+6hH9dbqsu2VosSj5IKuFsfzWu+jpj3LJcdTAwMTiphLZtxImxl8/r3K2dj4ht6rrqJsEoZbZyXHUwMDE5nZuLL0tcdTAwMWRcdTAwMDBzf1x1MDAwMC0u3Vx1MDAxMKl6uIbwr2VPh+I3UVx1MDAwNPMtJZGXdn223OmRWri3pUK/YZ1ymOE2+nuyXHUwMDA2Zlx1MDAxZpi6XCLnjJcjglxykVx1MDAwN/uqJpN+ejyb4aDjfJVcdTAwMTRcdTAwMTTnXHUwMDE3zLfih/VrXHUwMDFkmZytI/RcdTAwMTWMUvFuYu1cdTAwMGXhTU1cdTAwMWPh1Fx1MDAwN65cdTAwMTKJPV+y2dN+tFx1MDAwNq7cxXv68Vx1MDAxY0xL4lHFXHUwMDE1d1x1MDAxMlx1MDAxYuWAylx1MDAwZuUxZVRJst0rY/TMfrmfOFx1MDAxYVu1JWtY5NLq6XD5ZVx1MDAxNqM4JFlcdTAwMDfmrLYtnFx1MDAxYu0363eSqSs23m3rXHUwMDBivlBcYlx0XHUwMDBlYJz0XHUwMDAy1FQ7yT1oupzMOtZeTJgr117mk49ccjdatWRrM2+9xm4/6Vx1MDAxNX2Mo2VcdTAwMWadXHUwMDA2XHUwMDFkOmBXoF4nNFx1MDAxMtfYnSCKeaVNml5FwEO39njuLdncXHUwMDEwcXZccmKrQlx1MDAwN4ZAfbU7Ql+oXHUwMDFlxqJcdTAwMWE+pVx1MDAxZlx1MDAxN1Xz9lx1MDAwNldcdTAwMWElI+BUxK7eQclcdTAwMTQ6XHUwMDAxXHUwMDAw2ZzoI8NrbS6S+0bQuC+F3lx1MDAxNDgyk1x1MDAwMlx1MDAwN1x1MDAxN8T8xo5deaNcdTAwMWVk07lAkKxiUdizsMDXL2e65nxWXGakW5lcdTAwMDfL8o48wnJcdTAwMWXbulwiz685V2Xdol+iXHUwMDEyr4mqUVx1MDAxOSOIZphbt3SiXHUwMDBi0bGAp01cdTAwMTDSVSauXGIlVDjO9PNm6PuZK8U8fq2hbi7DYjve4Fx1MDAxYWxCwVx1MDAxYtJcdTAwMTe3elx1MDAxM86ibsQqnlx1MDAxZf99XX7zq4/Uol2lpFxifXr13rlbXHUwMDFlXG6s13AosjXlN6RHXHUwMDA10MHusFx1MDAxNtgpdTiipteN+nFQqZBcdTAwMGaSXHUwMDAyJVx1MDAxN7TcWiNiPb5cdTAwMWG+Yi5cdTAwMDdVfs8/kVbQkjVcYlx1MDAwMy3m0PvP62PizijixOqOXHUwMDFlx5exgVx1MDAxNdJMfLH0wSF2XCJcdTAwMWJ0f2tcXKP1Slx1MDAwNSY+idGmwlx1MDAxZlx1MDAxN3aUqyPcudxcdTAwMTONolx1MDAxZuiQ+s0hfcWJXHUwMDFhXHUwMDBlLp4k/kk3cs8zKWP08LheIbdcdTAwMDTrIMuHTjBOsrNdhTtw661cdTAwMTNrjWDspXFWa1x0SMylUFBccmY/WbtPXFxGXHUwMDA1MLGw51x1MDAxOG1mYcYyYVx1MDAwN3qZ2NNouaVsOFjwUMtfl9rajVx1MDAwNVF3eZ5upshNfuPfnvCAJPaZKEY/XG5cdTAwMGa8R6RcdTAwMDZdglwijXdcdTAwMTndcVx1MDAxNl9L9GmihNF7gYZwZjKZlHZcbvHoU+C/N39/ivAzx1x1MDAwZqagtWO/NIVcZlxc+zhcdTAwMTYmXHUwMDFmsv/Ly1x1MDAwNVx1MDAxNmGDyE5cdTAwMDQwXHUwMDFi5lx1MDAxNH6DLSRkXHUwMDFkRfNcdTAwMDBftlx1MDAxMYCtZpvThz5/rJd11Nwpqlx1MDAwZoA+KZjpXGKp3ElqMJ2+yfD1XG5cdTAwMDJ8yN4vYHDNi+FcdTAwMDOgnFVcdTAwMTBzt4xcdTAwMTZSQmfy42CSweFcdTAwMDaQqPJqXHUwMDFmtYRthUZin21rXFxcdTAwMTXQXHUwMDEyYFwiXHUwMDFjXHUwMDE4j6LEq2p1/IH7XHUwMDFkalwifapQW6/GLPtQ2VxiNOzJXHUwMDEwvrVcdTAwMWOsbVx1MDAxOHc9lzbjcVx1MDAwNvB/3zv+7z7Vp/mhzkm3o/OziFopsFVifv/1zFx1MDAxNynwo9dEXlYoJS+KjfrWzjp9h9l3XHUwMDFjhVx1MDAwMOmG8V9Rwlx1MDAxOPZynIKRc5SR+lL+ezZcdTAwMWabLVj2+UzijFx1MDAxNlx1MDAxNMtdJOycXHUwMDE1QPHCWa/bzVx1MDAxMfZcdTAwMTBGu6Fda0nMwzWGXHUwMDA1Vl8ye4Zod3l72TDX70hnXHUwMDE1ipmnOUSgojLgdUa82rHORE8m81x1MDAwNFx1MDAxY0q9rcF7s97pmovJXGI9QJYySnd1+mzatGXrr66p6LNcdTAwMDfLsHLQyr6mXHUwMDA1SFx1MDAxOG/PODiy2+Y82lxys1x1MDAwZXX0h2e1RWJ0WtXPl7NcdOPa9bhXXHUwMDAyzdhwo1lcdTAwMDWTPnVcdTAwMDJcdTAwMDSYfHc97XcpK+v7Mo1cZq+yTIrMmC2Su8BcdTAwMWHJgYZIS92aUja3jJpScisp3ii7ailLJ6RcdTAwMWM3RiSkbtvrwZDkaFwivDpRXHUwMDA17kRGfjxruVx1MDAwMZMzlddcdTAwMDVnRU3uvqihZkvPa49yc6NcdTAwMWHO9stuZrc0zIdzXHUwMDFmk8FPXSCSmVx1MDAxYlx1MDAwMZ6eP2k3XHUwMDBiXHUwMDE3g1P5RtJcdTAwMGUn4emKMNxcdTAwMGbbXmFcdTAwMTVcdTAwMDbaWsrDylP43FJzXHJmpkAtKVx1MDAxNmzcS9ZBRHA3QFx1MDAwN0x7XG49PH69OIZSu2tbMcxFkE2FZ1x1MDAxONx3NEBygFEzZ9TYdPb/kW03wdFCrqgy3kSksVx1MDAwN1x1MDAwMspcdTAwMGVcdTAwMDHJXHUwMDFjNs6q9mVaJ5POXHUwMDA1poBcdTAwMWPmXHUwMDBiKSNxtsy+YlktO+gu0rvDWegvXbysXHUwMDBmQsJLVE/73Fx1MDAxZaLSMj8zXHUwMDEywVZSokXOzN9cdTAwMWP111xuZqX9hvVA8lsysslcdTAwMTXtqX5YyuE/xuSSXHUwMDAzXHUwMDExjuZcdTAwMGbzetRd7d6kXHUwMDAwmNND7bVpXHUwMDFjuqW9cOe46lx1MDAxZXdsnsfrXHUwMDBiXHUwMDE5e9S36qE3T4xcXFF7pTdM91x1MDAwMsGMXHUwMDBii3RwdHqJ2Hu67IvC/776T/cqXFxcdTAwMWVcdTAwMTJG/7jMPudTi88wzYE0nZTRcFx1MDAxYm2aqIetfjxGbWlcdTAwMTI5Tlx1MDAxZFx1MDAwMf1JrtS07PZcdTAwMTCHYVx1MDAxZiekcVx1MDAwZlx1MDAxNM6OU5FY0UzCwt2zW5865ZR7gzHMVnP/OiyruFH8jo2QsZ73P3qPNYrLfJx/9aK0gpBd3ICVqzVfhVx1MDAwMXKZXHUwMDAy8WiCUE1cdTAwMGY/6dhcdTAwMTVcdTAwMWRtXHUwMDEzM1x1MDAwYv0ub110IFx1MDAxMdK8XHUwMDFkXG45XHUwMDBmYJSUVcxcdTAwMWWLfcjP+3fxv6VkXFzvgUKcbCbmxSpcdTAwMDVnxnVccpifVmlkmIrOIEMhk5+2Ylx1MDAxN6dbOCHk6f0r6bJ5XHUwMDEzXGJwo7P0g1x1MDAxNSE3gImFXHUwMDAz7Z/PR32FTVx0LYglv1xipSxcdTAwMWM5uVFgbedcYnNITk3swPLuJ2NcdTAwMWKsOGbOP2VcdTAwMTNcZnhcdTAwMWGmk1pdJzacacomXHUwMDE2YuNcdTAwMGZtTyGqumxnVqt+ejXqcojHjTmBXG7GQoTbKZi7R49cdTAwMGa6anvtLFJOprK9/LohqKXZsJapQ1x1MDAwZSGxaORcYlxmz+a0hFx1MDAxMlxmL28ub31cdTAwMWb2bSdccvvqKlx1MDAwM0+WWMdRTylD06/Iz2s6jaZOTUOYd07kRMlCs/9cdTAwMWX0XHUwMDBi2E2fXHUwMDA1OudcdTAwMTHIcazw+Fx1MDAwZdaAxXFcdTAwMTjEhzeXPkBcdTAwMWUhiPiuXHUwMDAzzZNhW97ko51cdTAwMDfjODTvxrB+0Vm5S2380d5EXHUwMDFlYqEjqXB6SFx1MDAxM1x1MDAxZVx1MDAxZb5wPdDTM1M25Fx1MDAwZo/5kL4jaNruXG755IdDXHUwMDEwc1x1MDAxYzj/mUGli5vGiVx1MDAxZsZcdNEqi5DupVx1MDAxYrB2aVx0QVx1MDAwMZBpoyZlYODBXHUwMDA0eKSKJqvVXHUwMDFkiEVcdTAwMWQ6mt2HI1x1MDAxOYqeXHUwMDA3uj9cdTAwMTbthypcdTAwMWKnll+iXHUwMDE2pGVAw7301fCrlGzvUNzzIHLJ0URcdTAwMTBDh43f1He0Zlp0lP9cXEPwbz+pikpcdFx1MDAwNZjZTjazOTxxPv40fiqbXHUwMDBiXs1mOlx1MDAxMvqGsClmoZPLXHUwMDA1WFx1MDAwZbidzlNcdTAwMWPsjETWxFWp1NZ+VZRjQiZErjKthNDTqldDXHUwMDE2pvjV979cdTAwMWHAXHUwMDE4q1uHulx1MDAxMjI7My3M+lx1MDAwMnJcdTAwMWZi//FcdTAwMWX++31x06tL71x1MDAwMTBcdTAwMDbxNjVVR3eHzI2bplx1MDAxMGI+2d/zXHUwMDBi/9W3/VxmaY1MjkBdQ+lcYq4+gf+zXHUwMDE3/D+fS/pcdTAwMWavYcJPd/j3J9Pdvqzx11PnZa1rTlx1MDAxMjlcdTAwMDRzZmFjJ/RTaFx1MDAxNU3Omlx1MDAxZYMr1nDF1OnDXVx1MDAxZOvn8SCKPUc31VWw0bSkzv91XFz/76+FjFx1MDAwZomMkDPeSpO+zjeEUlX1+/3f5mhvjGJg6MpcdTAwMWL4XHJj4kQqXFyEXHUwMDE1tVx1MDAxMELEPezhXHUwMDFj8v/Bgf+h5//na1x1MDAwNFx1MDAxYrx/UCPYvzlcdTAwMTguTiAkcnXWXCJcdTAwMTfok6D9dils267KIC3lfLlcdTAwMTJ2QsJtXHUwMDAyx8ZJsVku3sVcdTAwMWaciuH/59/612vyxPydX7RKXHUwMDE0wj5XQ/5+yjNU01x1MDAwMGdcdTAwMDa4bZm+tP82+XF4Q+d/qSNsVVxyc1x1MDAxY8E+blx1MDAxZTre//v4/5hD8229NVbvlcJHtonhv0ohPIFdM8XXd+D3caL/Rdd5LLvKJev2gWjgXVx1MDAxM++tQJhcdTAwMWXeeyue/rIqbsSpc+qv5lasrZCYmfmNgYC5NZwknyrBwO6ykLbwaVx1MDAxZlxyXGKptlKzk3Wh7qs6XHUwMDE0cMbpsndxOekkqij945k2XHUwMDA3XFz5zkIurns30Fx1MDAxZqRKnUlVXHUwMDFjt/JcIlKBVFx1MDAxNWfS6+0uREKLxelLyIJG1ehP/+e62/9hdaGoO1x1MDAwNmL2RVxcq+PjXznlOJU+s+Rtq/4hRp/rX884WYFerH9HfKjeeKlE8HpwmLb++6HO2HLbcSS25i2W8dqcOpDZckuquCDr8NC1MaVcdTAwMWGK/9qYXHUwMDE5kPJkr4HC+/ywXHUwMDAyi0hEk++pXHUwMDA2vFx1MDAxNeU0XHUwMDEypOKft7r0PzBcblOrdUKnND5+dXclqT1y/l1Gg5vRjJ9Ne4h27NdsMVxyrnNcdTAwMTORMbpcdTAwMWbuPtGfw1x1MDAxZC2Br2FEv+l4n1DCl4D6XHUwMDFm+81skveAcMGhJ0U/Oc5LYi5cdTAwMDK93Fx1MDAxNDrt8dZcdTAwMTiDhlx1MDAxNWvW9I9drHDmrLm4+Wdu1ilcdTAwMTDG9ztcZkrjglhdoVGNKK7+VX5hb1SF2sCaP5qNP4V7XHUwMDFjNsLpjaNcbku/2Tr/tnb0w4cjsOI2elx1MDAxZIrm/uAkXHUwMDBiNoHrx39+nZz8XHUwMDEyPU9cdTAwMTV2T3gmXHUwMDE30Vx1MDAwNW5TP5WmcbUm7lBcdTAwMTBSiPJ6z1gohM24VcKw4LNw9iOg2ofl4t+qzWdEat/C2zWche5flDfUoIqIzH5cdTAwMDdYZjZcdTAwMWVlr03ZXHUwMDE46FtcdTAwMTRcdTAwMWKVdkdqmMIzhrXFJlx1MDAxZreGJ1x1MDAxOK5R2WroXVx1MDAwMFx1MDAxY3Tud1NcdTAwMWFHw/NcdTAwMTmGY5iP77JfvkqkXHUwMDBlyut556DWrVx1MDAxMY4wXHUwMDA04VhcIi4zJJAmv0K599H37nJ+TaSWdbeCmz+Bs7FPdOy2vj8zXHUwMDExXHUwMDA3weQ02z/On6K6uK9rO+E28rCB/+uezGRBXHUwMDAyXGLbNUc/iCb3j4yBcUdcdTAwMDPfvlx1MDAxMvdOYZBcXPt4mvOU6VNkJXjXPz1GXHUwMDE1XHUwMDAz39y0+tZgdVx1MDAxZZxjdUBFalwihv2Az77YyVx1MDAwNVTLXHUwMDEwUZQpXHUwMDE4Ktutk5+4Tz+8bs//bHlcdTAwMDJcXFx1MDAxMXf5meX6M2HiTVx1MDAwMiuoo/z8IVx0gY5cdTAwMTfr0GyWUGQu+MZrPYnETaVoXVx1MDAwM+JZbtC1rX1ku8JcdTAwMTYm5o1hXHUwMDEzUlxmXGLfXHUwMDE2Y1x1MDAwNNvZXVx1MDAwMjn90YsnX51cYmKaXHUwMDE4KvDTL4bJ7ybsWbHPaOTlqH+6pH70tCFcdTAwMDZcdTAwMDSU7VR30G81XHUwMDA1T1knrbShOsOW8EHxXHUwMDE2LMlavF4oS0RMYb3c5Vx1MDAxZLfFjqtwXHUwMDExXHUwMDBiT1x1MDAxYlbq2DH387HbXHUwMDExf3n5XHUwMDFigvZf19LLWfNJ0bRSLtaT4V6LY+pke3hz6y3Q4VwizSlV+1x1MDAwZlx1MDAwZf+3uaZcdTAwMTTM3/2ir6OsqzNPV5LhymdBMEZLXHUwMDE3LaBeviOU8fdbX2hIMKbs4+BcZpdcdTAwMWY3S9/jXHUwMDExWFx1MDAxMkCSrKTr4rBJXHUwMDFmw8UjjDKBl5qj7zOBxfqKKlORXHUwMDFiattyYWbRzm22utsvfvlEfOb4S0jcU1xyk1G2XHUwMDAwz8+YopIjpYRepdxelFx1MDAwNU6ARmhiXHUwMDFjqVNhx4RcdTAwMTEq5oOeS6hcbjiNnYFcdTAwMGWTNNxkg2tcdTAwMGa6XHUwMDE1XHUwMDFiXHUwMDExX1x1MDAxMTvfpZTggDnSXHUwMDFiKVCLL9nDw++eQa3p38NcdTAwMDeyxOszm7VIr2qnkYcy8KCMXHUwMDFirV+Xh5VcdTAwMWbyhJ9cdTAwMDDfWFO1+Y+Lg+09XHUwMDE15Y3FkYF6Zv3KgpW3pD6skpVcdTAwMTVslz3NXHUwMDAxWfZ95n/3nCNxY0LqleTsWWlcdTAwMDP0L8bSrLGMf7Fp1lOajnDDXHUwMDA0XHUwMDA1gChzPE2j8TRcdTAwMTN/cGv9XHUwMDFk/5FcdTAwMTdeXHUwMDE0mFQmderpfCdw9OK1rXFrwtauaDK/SY6U9DtolUi2hc+CTjVPJpXS3VxihyTsXHTNt3R41kr9XHUwMDA1wkiAzzNcdTAwMTO9rqA+UYyJiEXCrcaqkPxcXGzx/r6xXFx+mVdxsvno77bSMUNkSfhEtqr5XHUwMDBlZdVBUKCP86S3acp7XGak+05cdTAwMWJ2X54ktHckXFwgd+e3XHUwMDFlXHUwMDA15H2B8lRCxsxB6dG8X79QkkhcdTAwMWGZu3UvOjF0KkzStm+N+jWDXHUwMDBmxHuL+oVl61x1MDAwMjeWXHUwMDAwbcBcdTAwMTRouXxbszTc7TqSIaA1+vDJhlx1MDAwZiPpjS1gv1x1MDAwMMA6J/F7Vv4pi6T3vlx1MDAwN/PceN1xO1x1MDAwNZAtS2F0m2NShChAKkVcIpdrl0Yg9zZ9/VxcfoTv365cdTAwMDPkOGJsRuOHXHUwMDAzI5Trvk75xTzipZJ/5NOYXHUwMDEwLzXyIMuliVt2oqwkXHUwMDE4XHUwMDAyWP9cdTAwMTiTaCmN+cCjSFx1MDAwNZzza6pcdTAwMWT1uaDNjFTAXHUwMDExjN1kcpLS+ib4x0XSTjgnnWU/4TlsSfGcf+dCXHUwMDE2hVx1MDAxOSCMqJC22i4xiKZ21o6mniWRipRxsKjtmpJPXHUwMDBiZscgeE5cdTAwMDNvfvRCXHUwMDEznWRga11cdTAwMTDddrclL8FwXHUwMDE1XHUwMDAzL+gv61Prblx1MDAxZexIPWTtZcGntMw1XHUwMDEz2d+TXHUwMDEzJ7ncNac1XHUwMDBlPJk7jKgukuWdl4HcmTfsIa3vYllQXHUwMDAxZVx1MDAxMO6X1OBcdTAwMTY3+zZB61x1MDAxMZl9Q9zKPFx1MDAwM4+gnH/6k9v7fn5CzjH6ffhDcunhdjnvXHUwMDBl1V2fXHUwMDFmVFx1MDAxNFx1MDAxOJ6NYsJcdTAwMDeJxMh7sqJePvnyKH8q9UWEp1x1MDAxNWXs3GXS2VDomqK9zat+KKre0Vxiukb86/W71lugu7AxMHtGwzroPGrlXHUwMDAxkFxiK1x0mLVFM60r/nF+OVx1MDAxYc1GxqZcdTAwMTKGtv5t4pYuM+L4l3717FVi72DrP0x61FNcdTAwMDKBXHIoXHUwMDE4XHUwMDEyls9u/bPeXCKwjo8jq1x1MDAwNTtcdTAwMDXTznplaUlcdTAwMWFWaUBBXHUwMDE3QTVcdTAwMGZfyGXZXHUwMDFmrGtcdTAwMTJcdTAwMTIl7WMgzcdYo6VxXHUwMDE08PdY+k+8fyfuRIn6eXWAeKE2QvynTlx1MDAxYs4xyv27YMlL8IFVXHUwMDA2ip9iRnRcdTAwMTPw8p2tUbNcdTAwMWF07jKrXHUwMDEwOq+h0vuKtcvMdVx1MDAwNJVcdTAwMTV7XHUwMDBlenUyXHUwMDE2UDiclrJXmzl6XFywXG4kwanpNFkhR4PozDsmOVxu6WLRYUY7jzUntUyMkicgiY/5XG7LIMVcdTAwMDFHXlx1MDAxMMBcdTAwMWNG0NHSdSXSOFsve6Chq1x1MDAwNEvyXalhPlx1MDAwM2o77+xk5JZomORcdTAwMDNcdTAwMTeJz+KfXGLv4TyX9llQrkZcdTAwMDB7JCDs5iY4qF1cdTAwMWIjSKFjh/9cZtHMXHUwMDAxPr3vnynfyM2jXHUwMDFhbq7VNklcdTAwMTFOzSPYTkpITftS/1x1MDAxNlx1MDAxObb4fmNcdTAwMTnvY7SYXHUwMDE0JqX06IBcYsBXfXrV3zO/j1x1MDAwYlx09oRRfmY2XHUwMDE0MHEpYf5cdTAwMDXC76nuoSN45tvz92hcdTAwMTQ2Tb+wK41nI5pcdTAwMDIpkdey+//M5/1PdUxHNInfaFJ5jERcdTAwMWTU6ny1yHJcdFx1MDAwNzpWvDOn2/OytTVW35OuYmLYXHUwMDE2XHUwMDAxnVx1MDAwN5BcdTAwMDDGOIY7XHUwMDE2Y29DXHUwMDBiPJrjkEdo6lx1MDAxNlgl9Fx1MDAwNVwiXpt4sN/0Y1xy8Z3byP5cdTAwMWNxxaVk1zyGVUPlvi9YYU3bKturXHUwMDEwXHUwMDE50lPAONfNpoHwsV6vuWhjV/JxLOKmeXN+6zhXXG5I7l7Ju1x1MDAxOZ6VXbajZpfzneWCOK1YOrFcdTAwMTM2XG6ZXHUwMDExNJJ66/K5YzPFa6r5XGZdRtkxWlFE8tfdZF56XHUwMDA0kiryVsZcdTAwMGZcdDhTaVNQOXCoXHUwMDFk8Ktp0WjIST5yW75DOl+zPDR6nJVcZrphK1x1MDAxMzdcdTAwMWNpiy2r685cdTAwMTE1/LTtXHUwMDFhXHUwMDFkcZ/Qv0i0uK9vXHUwMDA1teiSJumP/ijOXHUwMDBmeJTamXOFYDVccigvyi98KVxcMWfPa67bqalWmIOqIbVAorCPQdhcZnBcdTAwMWJ25VBiXHUwMDA0unz/9mY1s1x1MDAxMlGcIaWw7Io1+i+s+L7mXG7m3z1Ky+U1XHUwMDE2MNPK995o/1hcbrLc6ZVcdTAwMGKavuLwQ5l/zHPo2VxuXHUwMDEwXHUwMDFiJzVvSm1cdTAwMWZthmpFqNgxMuNcdTAwMTh0XGLmjbdcdTAwMGVKXHUwMDFiSMbut8k23nhcdTAwMTFrulu/8qBcdTAwMWUrXHUwMDE4flli0ZHz8GvuaUzzXHUwMDAzolpHjZb2XHUwMDE5KyGvYiGEM2+7lJVcdTAwMWGRxV2xT1B7hv9cdTAwMGWUdXZcdTAwMWM6KDBOXHUwMDFlS59FTeHLwGRcdTAwMTIv9PXP7r9CRVx1MDAxNbxqonffjzSPr2clf/c1o1Xjs37e/1if1Vx1MDAwM9N/8yrZXHUwMDE1IXj4yZPJOOleZ1x1MDAxOc25NrZTXHUwMDEzvyUvXG5cdTAwMTdLpvWUmzqGXHUwMDAxjtv+PVx1MDAwYib1hve9+q9Ruz+hWpKDXHUwMDBlXqa+TCZLjcFjKfcptOVg+iZjTPq6TiWGYXrYll5kyrtTXHUwMDEzNlx1MDAwYnah0lx1MDAxMml8JS+syFx1MDAwMyHh/Fx1MDAwM05wf0FcYorBq8Rn2ViB3sUh1eVAqvqx1Fx1MDAwZiO+8GzWt8ZkkLvEXHSDL1x1MDAxNkVcdTAwMWVNVqlcdTAwMTgs01x1MDAwNoiIdcz4UPmmXHUwMDA31n5DT+6/yX87J6KwP5ZgPlCuU82k50f2d35QXG6pV1x1MDAwNVx1MDAxOfoo7dS/l+nDXHKlfKLv0ZHzgFx1MDAwZu6SrYM7XHUwMDAyi6FcbuDGYLtcdTAwMWLue1B2J5tcdTAwMDLpXHLjvYlsnrNcdTAwMDC92kA0TnKdiGFcdTAwMTgvVmO1n1x1MDAxODdRNEVg2Ie9zjFcdTAwMWY3XHUwMDE5slx1MDAxNJVn7OFuN11Q6XM80HMs7MJcdTAwMTI2R1XcRlGqmFHY7pJcdTAwMTSXVZ1anfr0W/tjXHUwMDE5XHUwMDE2ILCsXHUwMDA3kYwzmSM5XHUwMDFjJ99iOVwiykYsZF5P/JuXIbKjJKwhieKKIV9bXHUwMDA3aVxil91cdTAwMGb097fXsFx1MDAwZqbv2NFcdTAwMWS5M8SKSc7tW1xy8lx0TFx1MDAwZd9ZPblcdTAwMTHj9mJcdTAwMDArZDunXHUwMDE326/ikS2HM5xcdTAwMTSginhcdTAwMDdDyPiaSlx1MDAxNcp1sJBcdTAwMTFIXHUwMDEymvy+XHUwMDBmJpoyy1x0UH9cdTAwMTQ1iYo3XGZcdTAwMDRcbs2EXHUwMDFmuHS2Va3hXGLPXa3ET6Yz81x1MDAwZs2jUeKU9lxuXHUwMDEzelx1MDAxMlx1MDAwMUClPi6vbsn2+3FcbjmDUmnX/i/G3Di+w3hZ9Sl0XpjaUCw55ZFcdTAwMTLWXHUwMDFhflx1MDAxOGVcdTAwMTX5s5a+XHUwMDE3m6BcdTAwMWFcXL85XHUwMDE1XHRcdTAwMTdS/e6jXHUwMDA3Li7RqN3I+UpcIse1SbxcdTAwMDdcdTAwMDLHXHRcdTAwMWKcXGJcYn4l3O9GzLbQqDGS3keaQdhcdTAwMThcdH2l8FkmXHUwMDFkel2ETVx1MDAxZC6opL1cdTAwMTJjRiOYL8Ss28UsPlx1MDAxM9REXG6+/vr6lZUo6lx1MDAwZWGYkFx1MDAxZZfQ/HjZ5LRcdTAwMGY7MylcdTAwMGVcdTAwMTXd5dxWezzo5Fxc/lb80vBcdTAwMDOJozC3XHUwMDAwg/F6t8tcdTAwMWW3sVx1MDAxMlx1MDAxZrSUrMGvsewxLr7NSetW0G36tbcoSIzAXHUwMDE4OTavbVx1MDAwN+vdXHUwMDAzhn3Y+lxumVx1MDAwMyBcdTAwMTK1myNcdTAwMTFcdTAwMTLwOnbVNe7ZOM87vSTJ03zIiYOEPpSHtCcrJrtcdTAwMTk0SXvbvcHyXHUwMDAwf2eRZiifXHUwMDBm1zU01Tuyhlx0fnuFUjuxXHUwMDA3WKhpIzaTmMieW9th2DlAseV+Lt1cdTAwMWVcZiyRq5ZcXNe3XHUwMDFjXHUwMDFmXHUwMDE4wVx1MDAxNHz8VeWnhkPYeSbVYjJcdTAwMTDuP+xZIKdNXHUwMDFl43pOXGbRb1x1MDAwNoxT6TNcZk+IvVx1MDAwMtFcdTAwMTm6vC5cdTAwMWFcdTAwMDUrZICSop631d4hrerwPZjJXHUwMDFiMkHZWK7+XHUwMDBimknoi1x1MDAxYenVXHUwMDBiYtjXU0qkQjdGRrG5XHUwMDExZMqnaImxadO9XHUwMDFhzZ+0YePviLFcdTAwMDAlSNVY17dcdTAwMTiAWpHKNkbtIVx1MDAwMigsmXkjtute6eBcdTAwMTaaykNcdTAwMDPqYfY2yjJcdTAwMTCIbyvLJqmcKa55g3/63NCGljBcdTAwMDHE9Fx1MDAxM7tGbOBwRyXmjEYqjGbYNfXg72pcdTAwMDKUwHY/Q2YxJlHdylx1MDAxMCNrst53X4GoR+kwhvjwcPaZMeHH8Vx1MDAwMoZcXHvkl1M+Y66InbhcdTAwMWKmmlx1MDAxNONcdTAwMDA0wFx0SHBFVPUku3BcdTAwMGJpyX1hjPkgukunJ/MrSjTLkYNrXHUwMDE5lnp1OiX4jnkkJTLlK0pA/lx1MDAwNopSwGRe9p1cdTAwMTSPJu2YtI2wWI1cdTAwMTVcdTAwMWI8cbynx1xiI0Q3Tz+vkYl002dcdTAwMWaHS1x1MDAwMb+JxX3ZRVx1MDAxNSeKn1x1MDAwZiD7q5Wy0UomsPmMPVx1MDAxNTs9l1+/qL6Lbnn8bvJkdrCEfZJ+ln46vj7e/m5cdTAwMTNbXHUwMDAw8sFcdTAwMTA7tZ1ttumj8CFcdJCrXHUwMDExSS3IXHUwMDE1rCrpXHUwMDE39y9cdTAwMThcdTAwMTbf6Fx1MDAwMfiEKrdcdTAwMTbS6m/F7JO+Ylx0w+Yjio2M/EnmmOWZt/eBi1xi0lx1MDAwNmtSt6/soctaN5MoRIpVt0ZcdTAwMTRcdTAwMWMvzzrVzddAXHUwMDExhzTzPVx1MDAxOLV18v99ff59zSaWmidGgpC6pdPafnuYg47DKz8kS90uwslcdTAwMWKUXHUwMDBlfFx1MDAxY7x8tJxacWdcdTAwMDNE1rf+XHUwMDE5XFxHhcbSgjX4XHUwMDE1kYpcdEPgy3l43Fx1MDAxYdLvM1Sn6IlcdTAwMTOg45VcdTAwMTZqWT/WQkVccsKPdipcdTAwMTE/+8uAz3tbmubTg6NcdTAwMDLYQf+axuVIxCRqOrA9LOlIkIjCjGpOXHUwMDE2arN+x1xyRZhjXrVAU3zuw8PSXHJ5fpPyvnT36ENuQ/r+yYxcdTAwMTOKT7u9rb4yve02udPLY0GHNWAwmWcpmFx1MDAxNGotjYtd1LbcuH1tX+PpSV2r9qjWjIU/XHUwMDFi5Vx1MDAxNVx1MDAwN9nJXGawfVxyvURpwJBcdTAwMWbgXHUwMDEyxO1cdTAwMTVFUo56gVxmy+BaS5e8rouhuVx1MDAxN2TluFx1MDAxOTL9ldorg4RJosVkwVx1MDAxY1x1MDAxY5ZmjPW+orm4iuZFdlx1MDAxZGNRS+BxRan+l+l4XHUwMDBm/IExryF9Png7uz84fGc3hlx1MDAwN2jEXHUwMDE3XdU0luxPvzJcdTAwMTVcdTAwMTMmQZhvx6xcdTAwMTNcdTAwMWI63FCJO6MmlVx1MDAwYjOMg1T7tTH6XHUwMDA34PqZlO17ZoirsYpcdO9sVWdNU/xolmjrJKCbm8WR5XFp+i6rXHUwMDFjx1x1MDAwMy6RYJbFRVx1MDAxN85cdTAwMDW/RFxcPCOIsu8gXHUwMDEwPSTYvNdeXHUwMDEyRFvlzrFcdTAwMTjV/lwiT2b3fZxKMlx1MDAxY7twwbbCmFx1MDAxMrVcdTAwMTf2UH9cclx1MDAwM2XgNOdF4Fx1MDAxMSpcdTAwMDNBOuc8wVe3m59avWVcdTAwMTniSdaxZ5tcckJasdNcdTAwMDUw0qcm2SzFksuVcHT3jTJccvLuYiHUpOjN3sSK2jZASViPPp/DXHUwMDA2YJpcdTAwMTaHXHUwMDE552Fbc+mQ/oHswZH6XHUwMDE4xem7kNNcdTAwMDW+Olx1MDAwNGDvKm1u0OqHXHKFjmhcdTAwMDBFLGRcdTAwMTBTPrzU1i8xUYUnXHUwMDE0TURJkP2l+NFccsRcdTAwMGX2gVx1MDAwNbN1ZK+fWe1cdTAwMGL5u8vDqDvJ5KvneeWnpJNei0OqgKUrSGdZmfVcdTAwMGY/kkFwSd3vijj1SehvOELZ/1qXf1urSKretjKR8y/PXHUwMDBi87tcYoI7OkL51lx1MDAwM+qU75yTeHZnf1x1MDAxYmGLz1x1MDAxZIJ5y6dmJT3Y9pvQPsuZgVx1MDAxYlwiTfldtlxyolxyXHUwMDEyVFx1MDAwNaxUc4kvelx1MDAwYm/mrOvd5/yIXHUwMDBlPDdTgE5cdTAwMTWDN+1mXHUwMDExP6txzl47XpzRXHUwMDE5c4agvi6pU7ZPXHUwMDE0clZcdTAwMDRUlcLANvNX6Vx1MDAwZSTZ+Jd9+7xxcdO+XHUwMDEzqc23wLdcdTAwMWZAVINccrl8or/iXHUwMDA27fPld1xcfNJe4lRcdTAwMWRcdTAwMWTN0Dy9ZjDh31x1MDAwMEHmv1x1MDAwZvcpv5WZgWGUr+DJVHC7xTPXiP1zVGXiRJCEx5bcXFxcdTAwMTVcYmI3dV5QMVx1MDAwNyGft0yozsPY/Jwqh6DVXHUwMDFhTDRcXNEw3zdJlVx1MDAxOY2VNYdLPlx1MDAxM2xq2WBMXHUwMDEylMm5RVx1MDAxMlx1MDAwMFqiRPJcdTAwMTWIpHT6M7lcdTAwMWHkkanU2OGo7SiUyY5cdTAwMGWPMlx1MDAwNrHNNlZcdTAwMGY32Vx1MDAxMV5cdTAwMDM+Zf1DLPt26FE3XHUwMDEyKqdcdFx1MDAxMX4pP9mmtjvnd2SdJXKcSeL8Z4YlTEisl5I4dr4yXCKyY8RcdTAwMWJ+J6G9XHUwMDA2OPNcdFx1MDAwM1dcdTAwMTb5XFxZWiVgcm9xK0PEhihB/nZmwONJ4Jju5acuXHJcdTAwMTZcdTAwMDduirKSXHUwMDAzlojHXGJcdTAwMWbiVUyRXHUwMDEwZWMrkrHUqUFcdTAwMWMhyeKscSaMblx1MDAwZZy7KOdgT0D1VLt+yGPnh5+egEUyPpFuQDcmbnYjXHUwMDE2x4WOX9a4OuDzt98tVUGxzYU4nldFtlx1MDAxMX/XmnNeTZGAXHUwMDE0UXMpb4nby9ntXHUwMDBid83+XGL00+9cdTAwMTBcdTAwMGKxTk1APjOsPmtcdTAwMGawMl9cdTAwMDL0JWVcdTAwMDGS2DT42yvsKMO9McdcdTAwMDF5TVx1MDAwZdP7y462TdFkXHUwMDEwfiBhTDXkbPueXHUwMDAyOapcdTAwMDNcdTAwMDNcZlxcYlx1MDAwZVx1MDAxN1GjZY1sKZH7Plx1MDAwNeazOVx1MDAxNY8p8I2/w2rG/+ZcdTAwMDCCPD9yR1x1MDAxNIRcdTAwMWXd/cXoX8THsWXjXHUwMDFlnVZcdTAwMTWavJw88mZcYl0wlVZcdTAwMWVjXHUwMDE2Qepb/IOixorDTzdEtlx1MDAxNVeg5CFcdTAwMTnaTmvwvbZcbqOQnVxy3uQpXHRcdTAwMWOk03ZfTVx1MDAxNML/N4f+fzadXHUwMDA04OszPGFBnKNkYZeyuIcqQo2F38fw/FwiOv6yTdaldOWtXG44c1x0XHUwMDE5KYW+XHUwMDAw5VxyhFx1MDAwNJOLKrJZVymCapln/n6/ayR8d0qkSzp2MVx1MDAwMM0/LPLDXHUwMDAw/tnQOJTz0qGrd6jaXHUwMDEw9MDFxexcdTAwMDEyy4wpXGZ4XHUwMDE4k7xcdTAwMTLHrni2XG6P45jJXHUwMDBmXHUwMDE5immPblZWhkTWXHTNtn5uXGb4TFx1MDAxZqKsN1x1MDAxZZEyh6NzXHUwMDAzXCIkrZdcblx1MDAxYnJcdTAwMWTFZs23+nbReFx1MDAxOXNhlLZNiiuosGekkiNcdTAwMDVer1xciW/PWOlcdTAwMWQsmdN+ZZXPJ3VcdTAwMTRcdTAwMDPpUeYmntr62tn8c9gz+EBcbpJcdTAwMTZqXHUwMDE4PlD6o/PtUt3Y+4ljXHUwMDFj2Vx1MDAxOHpiXG5Dm1x1MDAxNeDgWVFo7GGniqJoPPmDolVcdTAwMWGmfXaniVx1MDAwZitG604valPWOYav767+tYpvdWb9ZI5FyurmvHpe2ZQxnlZcIkrTzJ6bQHtccjLqX+l4TlZ2k1x1MDAwNIp0291jptHN9K1V391hilx1MDAxN81PjVx1MDAxOP5v/v1rzi7Mw3pcdTAwMWZcdTAwMDZtMCbXs1xmMi7mdaGN7mBjXHUwMDAwN8juyZCvVLeoTc7+ev5U8X2rXHUwMDFlVvP1c7e8ics5I5Yx479HSb19wj03woBhlrdcdTAwMTZolIy7wnV5QdA4RnVmTSwobPNlI3RkXHUwMDExfzdozavsq/rjbqBcYqLjYn6us1c55EVcdTAwMDGc2aJcdTAwMTKAh8ySZtBTh5vhaOBgNTREY4LT+DJIjeIxRsS7WFPKYqMp2Gp1Z0a7XHUwMDExrZu5OC24vFx1MDAxZkPsRN+mXHUwMDE409TJV9hQPfywPD9cIuVn4mRcZlx1MDAxOUHTWae6/tJ58dZeuFx1MDAxYYV/45jUXHUwMDBlRFx1MDAwZcgsXHKuLb46Kn/UXHUwMDE2XHUwMDEzupx5esFpXHJcYoXaN8fg0U/7UqBN4K+Hc0SFd9Aw+NSCYqCKk9is3S5goVx1MDAwZolcdTAwMThcdTAwMDfwysVv8Dwq66OLZFx1MDAxZs8qLs3Ue8KaXHUwMDE3Z1x1MDAxMJXX0ttgTZ4m9HpcIvufXvu3/kNcdTAwMTjBJ5iEMSdcdTAwMWL16iTyyZrvZCw4s/NLraQzXnB3r8rcg6FMZ/5XTlx1MDAwNVRwf4D3Umia3Fxy97Kp6+7eUFxu/Vx1MDAwZoRcXNN0XHUwMDAxXHUwMDBmmFxmwlxcYGIj3jlcIlW412KThlxiJIjXcr9cdTAwMTi88Cw+XHUwMDAw7YdcdTAwMTX+dICL7DDlTSTaL3WF07Kdb93WXHUwMDE53e3n8qBcdTAwMTl0ljOe1Ok2no1JYFx0pPtcdTAwMTFccmBjXHUwMDAwXHUwMDFj8Ei0NFx1MDAxNLRroLQ3XHUwMDEwyYpZltVcdTAwMDFIXHUwMDAzrkyRif1cdTAwMDWsUZxcdTAwMDHrssOS63XQuGHFmnj7XHUwMDAy7ZdvXHUwMDEygc3NLzmcUeyZPVx1MDAxNpXDeEghYsDtaVx1MDAxYcytO9eSbtr+9l1YXFxQUnMnmF3Jj/BcXKDMgr97o1x1MDAwNjvAMYpcdTAwMWS7VJXxJ7zcKbdAu55cdTAwMTmaXHUwMDAwkUmq2rq/eWmlMVxc6qhDc0SvM1x1MDAxZWufUIxaeJqyYVx1MDAwMVwiOVx1MDAxMEVrtXyorchvinJcdTAwMWWjXHUwMDFjXHUwMDE1XHUwMDA35OnBOS+E31bI5KNG0MDR8qb0WlfgP1nmX33Hzlx1MDAxMyd13Krnr27JbplcbqrCmFx1MDAwYqrLT1x1MDAxM+BcdTAwMTWSP1x1MDAwMlx1MDAxMO5cdTAwMTnboUlcdTAwMDdfLDGZXGKNXHUwMDEwXHUwMDFm4HWsXHUwMDFkoVwiOXVcdKAsaWrlQ89cdTAwMTAgbykvXHSVeWtxKzJrPoBVXHUwMDFh7mpcdTAwMTKYlOamzVx1MDAxYyQ/rFxmXZYmXuFcdTAwMTOX8N9mz1x1MDAxZeQxrLt6+OrYXHUwMDFl055x9KVei71uWJDqL+NU1MSitFx1MDAwMCm/XHUwMDEyNpThRjz/XHUwMDE3XHUwMDAzn0+w26Pi6540nyGGzIOM+acsT/KJ8lT5oFxiJq253Vds4so8k1x1MDAxNFXIXHUwMDFmLeb5jHvH5FLZccpcdTAwMDQpy5lL1lx1MDAxZfkzY6lcdTAwMDKKXHUwMDEx+Ilcclx1MDAxYoFccqFcdTAwMDbap31dXHUwMDEwh4vjdsDBjihkuSWmjlEqP59cdTAwMGLbrYumeVx1MDAxNjDVM150Nj+Z8ov/ePyDrllm8KzGPLTqVe+YXspvalx1MDAwM2RcdTAwMTEwXHTayEuBxHxKlfxxgObDXHUwMDFlcmIgyseRYqdFzVx1MDAwMZlW2eSCXHI/PGKIq3DyqJ0yp43ESUCxXHUwMDAyXHUwMDAwvaRVm3pPwbJNbjNcdTAwMTc9R2YrzzNrwFx1MDAxNp9+dINszpMxXHUwMDFkS4i9XHUwMDFk6Zj0avi6XFyg/1x1MDAwZizrcNUtsHFTS1wiqsqWr0agrWA+guWZplwijN9cdTAwMGZcdTAwMTJzXXj+OFx1MDAwMSpcdTAwMTRcYo9cdTAwMDMwtN9Nu1dcdTAwMTYu6djIt1x1MDAwNFx1MDAwMVx1MDAwNNs21Mynirw64l3Ts1wibuBcdTAwMTjMnPTz8z3pQrN4Uu41pHXA1JafVsfomoE2vq26cb871POq/Fx1MDAwNpBHJDGy/Lx5uzruXHUwMDBlYYREbjMjzlJmu9/5XHUwMDFkppn9bS9BV2nIYMqydljIXHUwMDE3XHUwMDFkXHUwMDBinNJi4a7UYvWEUFOKjirtu9vzuqtzk5pcdTAwMDdTelx1MDAwZmX0KH7wOk6i6EORkfU9JIhhgjakUfnK1O49XHUwMDEyQ1V4wLAoWC5cYvxTk3mLXHUwMDA1QPk3fo9cZqhqIYnOXHRyV6VNVVxm5MfNkLD4X4Mh/lFcdTAwMWFcdTAwMTg+XHUwMDAyq8FcdTAwMTOiMvp07rRg2uPx5Vx1MDAwYlpcdTAwMTSYnJIvL1xcMfOLokckXk88Uv57jCxzRjOoXHUwMDAwnzVcdTAwMDTpV/4pnNfMw7bd10dI0lx1MDAwNytTy91EOmU8KvdcdTAwMTZcdTAwMDHy3L1cdTAwMDGQ+umHdbriw/ZY/XKTXHUwMDE2ZVx1MDAwZVvw5+eH0IcnwXuujrDwj+6yScZ8SVx1MDAxZsg9mV9MVlxmhXGucinM4y9cdTAwMTfPflx1MDAxOVx1MDAwZUU+L4lKkFx1MDAxY1x1MDAxZVx1MDAxNlxuqVx1MDAxM0/X4kBkx1WV6y+TTd3hj1xy33dcdTAwMTJcbvDLZ4ouWGvkXHUwMDE47kuGLPZcdTAwMDeS9LuAp/vON8llbFx1MDAxNyP5ZDJCl0kuPi/RSazS7VPKXHJyOTKUXHUwMDEz0XmZKlwiQ2gqR+zB3LW5xT7/c6HUMU9cZvnlq1x1MDAxMYTHdklM3nKcXHUwMDE48ikuy1FCV1Vor6WBczfnc+XqiFx1MDAxMEj2PVx1MDAwYr+ZK9XyXHUwMDBm/lx1MDAxMVxcmFx1MDAwMXStXHUwMDBmOlx1MDAwMzG5vMl6S0NfNmOOquuDLWXUZ5Pz6olcdTAwMThpusJv8J88+WbcJcau8/b+x4pcdTAwMDGRXHUwMDEyXVx1MDAwZWNcdTAwMDO98Iud+IQloFx1MDAxY8pcdTAwMTGnVyWbnvDyjdRTp47luJSiv+0t84xHv8fAl6HyXHUwMDE5XHUwMDFkOVdJ9ceS3o6IzX1nXHUwMDE2XGbdIF8sbo0wSYayaWZKcsUgXHJcdTAwMGUtVlBcdTAwMTD0KZo4MaeTv1x1MDAwNIzK2OjOXGJcZmrtXHUwMDA3y9Bza8m1IFx1MDAwMNibXHUwMDEyjjH7kPLXa1x1MDAxZuX949/BvLiyb2louVxmOVlcbodcdTAwMTiOiqPvYeOtXHUwMDBi7lx1MDAxOVx1MDAxZaJcdTAwMTn2XYtcdTAwMTKCh+VLXHUwMDE2XHUwMDFiJb3cXHUwMDFlXHUwMDAyyLy+yPdP9eKzlFhUQDX9bnPCXCLzlFx1MDAxZMF9ymRNN2c1I4VcdTAwMWbSxGas5PVcdTAwMWGBPyp2K+nmKea3Z5Hna0JcdTAwMDQkXHUwMDE5hWyeXHUwMDEy1Uc2/C6SkbyZtkTmzNTMizm4rIM2erZHq1x1MDAxNHe0XHUwMDE5XHUwMDAzXHUwMDE58Ue/qilcYjBYJVx1MDAxMyPqlzxdcdXvp2DFUTDouezQno9cdTAwMWWjO9/3de+iXHUwMDE42rhYnmBoafY6eVx1MDAxYlOYsPb12Vx1MDAxNTlbw7dcdTAwMTUt5Ziaf8q8ndHT8e9Ha5pzVX7hot9cdTAwMGXz1zDgnzhxT45cdTAwMGI/XHUwMDA3QzfQw5g8x1x1MDAwNNBdKY+LNYa+kKyQXHUwMDEywbpQ9Gwq3Jsm5O1XNdNdNjHBicukSNE5RvJcdTAwMTFcconmx5atP8xcXFxyXHUwMDBmJVx1MDAxMs04UIzp/1x1MDAxYTpCLoRg/Vx1MDAxZexcdTAwMTg35HxPvse70ii0IHj5zeydkcGEYFx1MDAwN0cx6ufv96XH3Z2q0tluXHUwMDE3I3hDjYVDndSGqE/fMupcdTAwMDRf00dcdTAwMTU+1/j+X35cdTAwMTjlOb1qXHUwMDA2XHUwMDAxW1SjSLFpllSwk5OXKv2dQflcdTAwMTdDet6qXZuxk42acpJYJlr/XHUwMDE5d1xioltcdTAwMTGRwd9cdTAwMDYyXHUwMDE2Pb2z9Pz+/vOcosPtTnPpObtzXHUwMDA2vfJP/9Yg8Xma1Mf4l5/9lTLuzGFyse43dLFcbqVcInrgk3jz9OdiXHUwMDFhXHUwMDE0sSZX9EFo8DthfvNcdTAwMDJKzFx1MDAxMl5kJCAyhU940j2yXHUwMDBm+/edUUeY2O6nTdzAS+1RqaSzPln9t/bbXuqfXHUwMDE4XHUwMDAx/FRcdTAwMDR7YbJcdTAwMTKxkoLudNXJi183MVifXHUwMDA1SZLEXHUwMDBim6T7tIW73bxcdTAwMTFcdTAwMTUjsSglZapM9WJjXicuXGawqU5cdTAwMDKuYlXT/nJeqLBcdTAwMDKdPqTeMIzn4JN0xc+vXCJDwb3fXHUwMDE4XGJqhTFcdTAwMTK2SypcdTAwMDVrK0m59Vx1MDAxMjJiyMBcdTAwMTjWZGQsnm72clx1MDAxOKT6lUkpkoFjT2eNg6bCXHUwMDFmXHT2hYHv/z1cdTAwMDfxd0xcdTAwMTe2SmqGfP1cXFxuor6yyMTUttayVueDTvYkIVu88X7h0y2ez8g4kZrGNIlJuEIm63k2f25/Kl5YXHUwMDFlXHUwMDE0QF2XT1x1MDAwYqTszsJdO1x1MDAwNy2zVFqk/f1cdTAwMGUzoO7GoOE3bZpcdTAwMTkq43vuz4xHxubA7X2ibVx1MDAwYsNcdTAwMDH1tuTfVCHaLEm44v6YhZy4oCffz6JJ3suEvDayzIhcbpHewjWvXHUwMDExZPqQXHUwMDAwPVx0XGakZDIjTypL8zHLvH4jh86Lkd+NyDTm74xcZu/2jpZcdTAwMTO8xrdcbnUyXHUwMDFlaimyyaD26WxcXMPIb6fWbr2/IFRcdTAwMWIkXHUwMDBmQ1x1MDAxY0eSj/Pr2PvD7LWRQezMwKBcdTAwMDVcdTAwMTA9XHUwMDFlv/NcbvV+NL3/w7x+Z3h1w1xclVdMTlxi4oDwipzbrpTW7fdLwprpXHUwMDA1zNpZINFBQo2yzH1JkOCwXHUwMDEzNj6srij1+1x0z/TiXHUwMDEyuFx1MDAwM2WDZdFELdq3ditcdTAwMDTUMNpk6Mwy4vpnobNjSb3H8spCh0mcXHSsXGLI331cdTAwMDOapvkwz9xHYFx1MDAxN/A0XHUwMDEw2S3FQFx1MDAwMjdMWObKklx1MDAwMPpYolx1MDAxY5ZV7GhBPX+PNppcdTAwMWX6x7Nb/1x1MDAwZZ03K8WRymtW43T3WzlAykNdmX1IXHUwMDAw1kR6LVx1MDAxOO8zXHUwMDEzmSVHTvRirFX+KzfhYeSC+1x1MDAxMVxm4aabOstpoFx1MDAwNcxNXiBFplx1MDAxNVx1MDAxOCzrW4frXHUwMDE3QDeO/9tS0IMx9qyvXHUwMDFmrOHFXHUwMDA3PFx1MDAwMypPKuJWmKNcdTAwMTbRMVx1MDAwND6NxU3MwtGSXGJbyWhpKqyAJ5dJKHFcYlApuVx1MDAxM3r7yDpNdt/7XFwySznDMFxuw6quIPrM+Vx1MDAxOVwiwMbhYLvTgnh+muV+UVxyg1xcgSM4XHUwMDEwiJv0s09wyeOVwld5sdZw2LaQXHUwMDAyY2Q8PkdcdTAwMTVGR5H46k1G3IFdcODDgsGOtttcdTAwMDV/XHUwMDE3Kpjlrd4ovLHHZ7EjdJJ1/kbEXHUwMDE0h2FZJsFHOTCCXHUwMDE2QkNcblx1MDAxYimuKLxmqZKOvMFcdTAwMDYtrnUgc5FcdTAwMDVXP/HGMTXPXHJcdTAwMWRcdTAwMTbp/tGB3jygfUVO3np18Fx1MDAwNvVcdTAwMTl5Tffl77dcbohPTFx1MDAxM4FMOai3zUKu3btvQFx1MDAwN604kOSU44WOq1hcdTAwMTLTt1x1MDAwMiBwqlxizSaogFdLVlx1MDAxMujJPvqR2qU7VtxOXHUwMDEw/XtcdTAwMTmC0V75iFx1MDAwM49zXHUwMDE04IZ3XHUwMDExklJ4Rlx1MDAwNeZxLn1cdTAwMWSA6lxuTl7/UThcdTAwMDdl1odcdTAwMTBfqTNcdTAwMDXRKJ3syiF/mjc73C2PRNA9XHUwMDBm9PZUXHUwMDE0yqwkc92Cc0RBXHUwMDA1bcgxkd0kSu43lFx1MDAwMSp6eObN+1x0bVx1MDAwMTD3X05cdTAwMDRcYlx1MDAxOFwiok/FXHUwMDExsVx1MDAwYkfLSHGJNYFjf1xu18f6XHUwMDAxRtBBj+T7jitcdTAwMTdOXHUwMDAy1UatUvf13XhcdTAwMTXRiI5cdM44QKtcdTAwMDEnXHUwMDA1r7puLmxOXFw9b1x1MDAwYlx1MDAxNEukXHUwMDFiV6Tf26N4Xr1TXHUwMDE4jl6qr4f/buFcdTAwMTl+guOOzs9cdTAwMTJGXHUwMDExpdjiwoqqXHUwMDAx6bhKflq0Vlx1MDAxNpOtwZ7WdVVcdTAwMTTuRlpNOz1dXG7Aa/D3sFxyW0+QXHUwMDA04D9g2Cy7bddcdTAwMWX49vQk2kZcdTAwMWVZYqdQsoPs3lxmNFx1MDAxNe9WrPzxuzvk5WKeniYxPmBcdTAwMWSbXHS2lyy1clX2vlx1MDAwZfPKt/t6c3CQ+yxZXGLZ9iqLU98uoyAsIeSRsrJcdTAwMWQu2WSYuS2Fc1x1MDAwNmhcdTAwMGVcdTAwMGLvXHUwMDAwp/mnXHUwMDFjPC70s1RM6Pm78X6XuPyS31x1MDAwMJZbWLpW8ZX9uVx1MDAxNyhVYJ/Po1Q5tH7K9LdlMSvgzVxukL9cdTAwMTPo8lx1MDAxMVx1MDAwNOxcdTAwMTPJdENcdTAwMTicOedcdTAwMDDWNSx56kH78CfRPIPrXHUwMDFkhIzVolmyXHUwMDBmjPLhjE37ucJYPa+tf1x1MDAxZL2B3iM9XHUwMDE3m1x1MDAwMN7z06D2r1x1MDAwYtmM0/9OjrP98oXOSudcdTAwMTer7O5P8FUjc4+DaHnG5IwgcHpcdTAwMTAlUm/orKGLrIDxVVvFXG6rwYqZiFx1MDAwMcLg5ixcdTAwMTk6+lx1MDAwMYxcdTAwMWGVznI+Rlx1MDAxMoRk6Fx1MDAxMCjawMdlPPmqvco3p1x1MDAwZd5cdIBccsdcdTAwMWVdXHUwMDFh3m3a3/45wlx1MDAwMyfcr/R4Xl0pZLSUoLRcdTAwMDHKXHUwMDAwpXhcbjr/XHUwMDAzwNXO9TlbVMhv49xlXGYjXlxuPNHvcVx1MDAwN1x1MDAxMsj6gGJZMzDa+n5cdTAwMDfdYSO9Jlx1MDAxM4upzP4zrXNyMmdzfCvWT7pcdTAwMTDl30CyQrSAPzUyZW5cdTAwMDboick7vr5TdNrY+cNcdTAwMGLwoMBKXHUwMDFhgFx1MDAxY/i01afHLprZS7BxeEhcdTAwMDXbe1x1MDAwZcqK4lx1MDAxMTnKl1JcdTAwMDS43SxcdTAwMGWGXHUwMDE3vpf/RrahqFx1MDAwNFx1MDAwMLtAZlx1MDAwMEpJTcE80zKMW1uMQpKobFx1MDAwN1x1MDAxNITRmY1C7lx1MDAxNkXli1x1MDAwMVx1MDAwYtCzaFx1MDAxNFxya1wiOlxcXHUwMDAxi1xiLlx1MDAwMVx1MDAxMU5cdTAwMWbZXHUwMDAw72FcdTAwMWGJXHUwMDFmilx1MDAxYsWqV0TnkIaH51x1MDAxZpxcdTAwMGZae/JcdTAwMTXK31x1MDAwN/vRz7n+YIVlQtyz3FBPn+UkePKYd80zJS3wi9JcdTAwMWG/dP1cdTAwMDam1Fx1MDAwNKyg9Vx1MDAxMPVZXuwhXHUwMDExXHUwMDE21SmKpVmCZ1x1MDAwZlFcdTAwMDdcdTAwMWbf490uXHUwMDA1UVx1MDAxOa+lynOakieAk5yTtycx2fqNyXaaxVx1MDAwNyGn4Ea2T8XHM0ujiO61Z4aVXHL69+u+XHUwMDFhppxiulx1MDAwNW3BwuNcdTAwMWM2XHUwMDBlXHUwMDEyIzTajzbRXcA8KbJcdTAwMTNiL1x1MDAxYrV1XHUwMDBi01SoXHUwMDAwxFlcbiSUlDToLvC1XGbNQLSFXHUwMDBl9nLPV1x1MDAxZqHSn1x1MDAwN3MoMd4/rM6CnkuF3/7tU2pcdTAwMTT6/s7wWTKaL3JcYrB5SO9MXHUwMDA0OYN6a1+iktfmXHUwMDAwPs7BvPZcdTAwMDA8eVqKP49KxlxuXHUwMDE4hjGrwWLqXHUwMDFl90ojbUrL/9t1KlByfVx0VuPnNDr56VRQjUVZvyhcdTAwMDa4Ylx1MDAxM8FzmHOZVz+MWS56RFx1MDAxMrpcdTAwMWT09zm3S1xiK1xirlx1MDAwMmVhJVx1MDAxNzfWW5A2jHF6Y/xxxaTSP10+XHUwMDE5KVx1MDAxN/pGZXiPZafOVe04YFx1MDAxMpXCfFx1MDAxYVx1MDAwYlx1MDAxY6o2TWEovlx1MDAxN6eovGNMzDBccvGtcTK7fX66yLJwy5O/wWLRKeDo1Vx1MDAwM+VYZzZcdTAwMGWP12lmUSpcdTAwMTJV6O6Ql4ZcdTAwMTXcS1t8NFx1MDAxN4bmXlx0llJXXHUwMDBmj9RKZFx1MDAwNqgqvJFnsTduXHUwMDE16up+x56BJ2vfPVxyXHLRw10xpFx1MDAxZlx1MDAxNto2j29D4j4y1+pxXHUwMDFmZTDyffhbTajbXHUwMDE4XHUwMDE4q766jlx1MDAxMbeP+MPn0lxcqJj9XHUwMDBlIYh9ca1cIox9WeHf8pkhslKYu1CnW4nXqNFcdTAwMDRcdTAwMWHBiFx1MDAxY+F9ulx1MDAxMLj5tfG9XHUwMDE058v3Vb5+3niXXGL5pDCyqjNq7Vqj+NotwIn06yTj3bGEXHUwMDFhw+/Ei1x1MDAwZkOm1UqAOuhcdTAwMWPizJJqM1x1MDAwYostXHUwMDAz6lx1MDAxZITnSs7lrzL/SLxjXHUwMDE0so68Uq6HwcfUTShvtEBH7eO831xy825cdTAwMDaTyJ1U77p8XHUwMDE4pkNAQjuxcWdgSZBcdTAwMTVcdTAwMDWiQMwmTCutOWFusVx1MDAwMJyq4ZN58W9LiUOMvsYnZvk8bLtBXVxinatsrF3NTYp+XHUwMDAwYJtrIXiZ/1x1MDAxOaTQXHUwMDFkqnRrWVx1MDAxNchOKX67XHUwMDFiN3RcdTAwMTJcbknbXHUwMDE5dPmSYYrmblx1MDAwME1ccs1cdTAwMGZ8oK3u51QnezxcdTAwMWWfTeSvsG1cdTAwMWZGOlx03NfQb3Fp1Z1+Mpam1qnt/5JOXGY0TFx1MDAxN1R30ELJzildO66gckokQnCkLV5cdTAwMTDZ8NrYwFx1MDAxYYdVw1x1MDAwNdmIOU1cdTAwMDNZ79pcdTAwMTaaJO71aJOBzSuGbVx1MDAwN5OiwGFPm46jS+3uc8toXGL5st0wXHUwMDE39YOkozPMkN995lj3dmjx4lx1MDAxZviZ0UiO1kzmYVx1MDAxNIhx1OJcdTAwMTFemyHoa00q2anc3naUn+Dm6C1cdTAwMDLP8vo+Jv7tY5enuLNuU7tcdTAwMWHfrU0keajdnWpmWeBIRqnvUsqcq7Ur4PpcdTAwMWQ4Jlct1W985Vx1MDAxObdQyUE77X1HP4HBTlIqTZJqX1b4u3uKTWC/YVx1MDAxZsTHkfeYXHUwMDBm3Vx1MDAxY65v+Wdh/jC8zm2VK7TK12KNaX6OQ3v/jVx0dda8gVx1MDAxZVx1MDAwMNv+/E4r2biaRf52JYIsoEo4/UFDK9edRXCfXHUwMDBm40HFuz4oW+FcdTAwMTP/Zlx1MDAxOV5w33h5i/TlXHUwMDA2TlBcdTAwMGZcdTAwMWZ4wbBgXGJQUnxcdTAwMTdBqqqnkE8h83SHRmdcdTAwMTV6XHUwMDA2LF5n9PcjJitpJftcdTAwMDZ/XCJy04LF2orbuXP/XHUwMDEyf0FjllxyUH358t2t+OyGaYyBwHdWWp9WdMl76yhFKWy6iXCNkHf3uWqNq1x1MDAxOGj87lxiQjF1OndBalx1MDAxY1x1MDAwMlx0W9SnWqX5XGYwfLnbzMZdXHUwMDE2kVx1MDAxN7C0b2oqX9029Wfj61x1MDAwMkCEXHUwMDAxwEmZXHUwMDAz9qDqSYrjncDQT6PtcEGO66AsqrVaWFxmYlx1MDAxMEOhXHR9KW/HR1eDxp3EJWSISbJpXHUwMDAyPj9HYfRMXHUwMDAyLVx1MDAxNV32g7IqNW29c6RdXHUwMDAx3SmsW4BcdTAwMWGcI085XHUwMDFibXZGM1J7quHyXHUwMDAzXl/OMcvL7ZPSeZaIXHUwMDE4WPqoXHUwMDBiMmPixb9vXHUwMDBlrOGpLy9cdTAwMGI333FGnTfNRHQqlTCO6zueXHUwMDAyn79nXHUwMDFjXHUwMDFiXHUwMDE58rePNlM6yqS1XHUwMDA2Ua1cdTAwMDXhbSdcdTAwMTQxk/JtXHUwMDAz4VxyKvFnjFx1MDAxNTuRzauiXHUwMDBlJD2gWVx1MDAwN0tf5VbpeeI39LaGMLzxtZ9a6W5Dm1x1MDAxOVx0lkNw+L1m7Y6FcOjuhUwjT7TcWWFcdTAwMTRpzFx1MDAxYiFccsfnnq1cdTAwMDO1fr/rlNtumzWptT5zJS5WkI0vMpRCIN9cdTAwMTarXHUwMDAx5qTcyKuIVUVcdTAwMGbDVn25+nVTurVfafrna3lcbtj9u5ZngqO8Y4WMdmTH65S3XHUwMDA0g/Hvme28U1x1MDAxM/hcbn3QxzMj55p1SN+ZTls/OD0j3sYmXHUwMDA2f5dpNfg8P1uXWyz9WNeWsbn6xT5cdTAwMTBcdTAwMWHvyp1SVYhHXHI1d1x1MDAxYnsyXHUwMDE5/lG0XHUwMDE3XHUwMDA0aj9ZIK5DOX+8eO0rXCKaPkmX6lsurjKN1Vx1MDAxM0HwveBcdTAwMDGGdVAyLkN0Rbr6UI+KXHUwMDAwuP5TU5sh7Z/w1Vx1MDAwNfdcdTAwMTIm5lx1MDAxZNTMxUHseXXYtvydXHUwMDE4gbC94D7kXHUwMDEzeVx1MDAwNs93kNVLUnOZyFx1MDAxZbJcbs5zXHUwMDFi+HrkJGXYT5zCZKSLQK1hSsLw9TL2qGRNXHJcdTAwMDLtSkIwpv6ojC6K086LOcyVXHUwMDAykn+T/Eiz76tdyEw0vCnI0uf5Mlx1MDAxOSqqXHUwMDFlxFx1MDAwYlx1MDAxMqJosf5rr1x1MDAxOcDOfDCdXHUwMDFj8KW9XHUwMDE4+N/YMlRVSUlcdTAwMWSr85U6e/BM4Vgg72hDXHUwMDFm/dP9SIJ3XHL7xJ3SomxcdTAwMWWw4znZL1x1MDAwNC+te1x1MDAxNlpcdTAwMTfhXHUwMDE3+SZF7YeUV8M7OCzGxrgwWD12dDaDnzlHReONIEexXHUwMDA2XCJib1JcdTAwMTVLaMlcdTAwMDRrjS3LdE6menzt8yHieWP3ovk4QFKLOjtxdSl71IySTeChjt96QTeRXHUwMDE16plcdTAwMTYnZu75jnt+8/thwLZCNFXFKOHKlYXMj9BcdTAwMDaD3ZNcdFRcdTAwMDbkeqLuQMHPvlpmQlmONWQ/wcbkXHUwMDA2IHjMXHUwMDFkyX8xgyNxOnSwfSrB85ypVWxcdTAwMWV5z+iNrfd6Mvwq81x1MDAxOYcry1x1MDAwZVx1MDAxN1x0om+1Mc+gXHUwMDFhaZKNhbjecrV1/1x1MDAxMOrFJS6iX1x0oHrLW1RhKnPzR1x1MDAwZjS971x1MDAwZqBg+Fx1MDAxOYNhI1xuvPSONuv2LTaUXHUwMDEy2Vx1MDAxN1NcdTAwMThPwo8o8+pSXGJgVspcdTAwMDSI6ZS38KAsdLElw58k6+VpXFw5TclVp1xyXGZtuPzxXHUwMDAwXHUwMDA0UieOXzb6XHUwMDE5Q5WkqKL1xEZzVGRcdTAwMGX/ppfOXHUwMDAwdcLWOd3+l3M9XHUwMDE2XHUwMDFjM6+fTZmTdZWYkvFGPZO9PS/PVlx1MDAwNU9YdsDavLRcdTAwMWLXb8Y/+uYutWx8IKaiXFzhamdW/lxy2YteXHUwMDE4kSog703G+SNTbVHtSOVmYonj4fQufuyPn2yPzuVG8u83+U1ltEBcdTAwMGV+2258P9K9L/7i3Y2BWe0xtmbjXHUwMDEwXFx51NrRr3aNqpzzwYFQXyCEUTjVhlx1MDAxZFx1MDAxNJtcdTAwMDY6XHRcdTAwMWR9ylGjSPWNXcVWmD4meuVcdTAwMTjJO4mmr2qBKZUxXHUwMDFhsc9cdTAwMDA9zGNfJ1xuP9nDJKCPUpmVXGLzq1xm1qaz11x1MDAxZOXR91c116+RXHUwMDFjfWVcdTAwMTUs66xAaUVi9YNcdTAwMGbTQGnRmaeEtC2Vw0L31lulgYmp8EzYUcYs42FcdTAwMDFQjXxUc1muXHUwMDBlKdb5hlx1MDAxZVxcmjheiqWAOqnR5lx1MDAwNfhcdTAwMGaBSSxcdTAwMWG6qfagLEBa+eh4+LpGnMRKLOxcdTAwMDGO9p6yhVbpdahsYC9cdTAwMDCgWTzIV4+Px8iPXHUwMDExSXk8aH1cdTAwMTKnUZ8hWyRhaOqYN4KgOVx1MDAwYq9JXHUwMDExXHUwMDFhbFx1MDAxOO173ejnXHUwMDEzXHUwMDFiXHUwMDA2XHUwMDFhgr+/TTU/5lx1MDAxMlx1MDAxOSOv2ePJXHUwMDFh/kZZjZ7xXHUwMDAywUK6XHUwMDBlbYLvLTVcdTAwMDdqhFxyXGLKRVx1MDAxYadcdTAwMWRuq7h8buIsdedjiMZVUZ3Qfa+zXUJMvqTKdY+F/D56MpfHXHUwMDAyS336KKVcdTAwMDMrwX1cdTAwMTAoey9RTd69XHUwMDEynPgge1Hltlx1MDAwNaTUpY5ieVx1MDAxMp81dZhSXHUwMDA0ncVcdTAwMWTTJeAyub2zXGakKoOcLYiqXHUwMDEx2/dvn0XzXCJBado54kyRU16ajq6kZmRcdTAwMDRcdK/p3PBcdTAwMThcdTAwMGVcIuThRd/oStDpaul9+j5cdTAwMWM0uGAkQO5IWZfEeN9cdFx1MDAxNjVYalwiQM5tICltbfdl191cdTAwMWGEQknFlYknZ81cdTAwMTX6dqlcdTAwMDMpn+nQXHUwMDAy3mzyS4fzUVx1MDAxM02dmocvbFvtxapfJVxmN/+1o+xcdTAwMTO0XHUwMDFmh7xcdTAwMDfAeVxcXHUwMDEzXFzS79hjd/aEYmvwjrazbIt6TomfMsuUyEltviDRzFx1MDAxMVx1MDAxOadgeCz+NFx1MDAwNsGQJ2qu/vlP10E63OmSf9fpfHfypY5tqM0v4Vx1MDAwMS3Bm1hqwTtcdTAwMTf225t1lFx1MDAwNGmRmsteXHUwMDA1wyBhK2ScO5XGxiUvOz2G61x1MDAxYlx1MDAxY9LfXFytK9ygfDvRXHJcYmh8WUnlL/poaV/f6Sh9nX3Z1NX2zdBcdTAwMWVAXHUwMDE5SvSY4pA53VxyO5JcdL9cdTAwMDapXHUwMDAyVoNcdTAwMDRv1eFy7FhcdTAwMWW/mLhl+ZbaQ+x834HXtoblPdvyoYt2XHUwMDFiuOb8tk1NlIA+OOyA+DWcW9zAXHUwMDE1XHUwMDFmXHUwMDA2rc5y9Fx1MDAwNFt7kuMmXHUwMDEw71x1MDAxZSzUiVx1MDAxMFxmXFzJuODL8Vwio0fTXHUwMDEzXHUwMDE0KzfP21RxpCHviDAkkHnOK24uXHUwMDEzvvv8dcVY5nSrm8JcdTAwMDWbXHUwMDEx7cniXHUwMDA2dZbLXHUwMDBm3d+hpPSDcF+6XHUwMDFjO7/Dbf6V+ZqtvsNcdTAwMDfqXHUwMDFiK8XtSFx1MDAxMWQ11ok9Y0TKXHUwMDFka2lgZWsvXGafrFxitFx1MDAxZoj4y1x1MDAxZZaf0ti0dlxmkVx1MDAxMNaylMGSd1x1MDAwNFFfTcL7XHUwMDE4+9r+ZjP4zE5TL7/CQZlXXHUwMDEzmoXYQSuvqlx1MDAwNVx1MDAxNFx1MDAwMI4rR0Q+vatKXHTO0rEvRY1097ZcdTAwMDR2XrdTwFUsQWe4W1JKU6+bNlx1MDAxYlx1MDAxZlx1MDAxZHxcdTAwMTdrqHw/rClcbjNeSul4lW2Py0J07WtcdTAwMDU8aYXQ6lx1MDAxOYxSktnKwiSPdjbBOd03w1x1MDAwMtPDI2lyRVx1MDAxN4pupi2PVKxcdTAwMDXFlVmORFx1MDAwZWkvuFx1MDAwNlPkXCJJoLaIfkXzVixs/miWpHdcdTAwMGa5tpXKPFxicrCuqeTn9TtcdTAwMDcghvd516i8x2ZcdTAwMTUk01+c5K7kpl9cdTAwMTCYJlwiiMqRrWfRioAsJlx1MDAwZlx1MDAxYlG/OKvxUcpWfS/McVMwwytPtqJcdTAwMTffXHUwMDFix1x1MDAwNlx0o+eG97mnK1xul1x1MDAwN/w8XHUwMDFlMl5cdTAwMTRJwD5mJLtUW/7FXHUwMDA3nGqOKmdcdTAwMDdEXHUwMDA1wpFcdTAwMTb22D6Eivh7qMTfXHUwMDFksyw110+9wNHGXFxbcPxFQFx1MDAwNVGQ5CvX8EuRUsdcdTAwMTdcdTAwMTdsp/uTzUqX7i4ge/qxUE5cdTAwMDR8llx1MDAwYn9nXHUwMDEzqmU/ZfvQMYerc5jua1x1MDAxYcRvI90yXHUwMDE2qs5n1auLqVhcdTAwMWGRSVxmn0dcdTAwMTkziTGk2LwlXHRF+sUzY1wiuVx1MDAwNVflcv/T9cp+9Huzk9FcdTAwMTBcbnZgn2Hhwum0XHUwMDAyL/+4XHUwMDFhsfjzSXFdwIqxet7Y14Q+XG636Vi/mKDU2Kl9XHUwMDFlvi/lXHUwMDA10uY5W2dXXXJcdTAwMGXnXHUwMDA0Ts/O+sVLnr/EXHUwMDEwfTMpeDBX/O7A8lx1MDAxM1x1MDAwMubVb7XmQurrZVx1MDAwNWkgXHUwMDE3lHc4/Fx0o9H/irldUlDqq41AXHUwMDAxNrb8KItNtcQhsv41XHUwMDEwWWViWFxc0v9H13ksR8s0UfqCWODdsvDeNaZhhzdcclxyNJ6rXHUwMDFm9M1qYt4/QtKipVBAVWae51BUXHUwMDE241jJeVx1MDAxOa1bre33grqIsSWMbCWau/VcdTAwMWbDu6BcbjvX4rpcdTAwMGbb/vj3xdxiQKRanVTKXHUwMDFhxftBjXGLNCfg4TrESX7TkXB+XHUwMDA12MqKV8QhZ+DHkufPZOlfXHUwMDEx+NWv96ssXHUwMDE3zuLDXHUwMDEwy18vJ2ZcdTAwMDVFjemJRPSanJiNjyqTc3JUmFx1MDAwNlwiib1cdTAwMGaDXHUwMDBiLVKO5ifpIO5l8nK9cmWId1x1MDAwM5C2/Fx1MDAwYmzsk/FngVx1MDAxMtLuZLU6UIeMOKf9VFAk9b6qXHUwMDA0m0RcIrr+3/4h7W//XHUwMDEwJNGSgHJcdTAwMTFcdTAwMTZcZulZ2Fx1MDAxNFx1MDAxZlx1MDAwMIrja44wLpt6KuH7inVvu//e11xcLzY9avFX2VO3XHUwMDA2IVVY753ae1qYhUJcdTAwMWTpOL2bzYbWUXCk1EW4ap0+XHUwMDFmvLQ5ZTl+O6OMJIlwlMLxlno0eSR/XHUwMDE088y35sJcdTAwMWatM9I4f8RccslcdTAwMTH1TFx1MDAxOLCQb0XJ3axcdTAwMWIuSVx1MDAxY6V5XHUwMDAxKTdXZX7q69+bjEeecoFglNrxd66ftDpuPVYrXHUwMDBm7Jb+fo90Ydmf6HIpXHUwMDE2llx1MDAwMUuHtWLb/rDI8nBf11PnxUbbUlx1MDAwZfXBdJxnO1x1MDAxMvqkXHUwMDEzhWvu9my94HNvPepcdTAwMTnbVU6SpMPZcHxcbmeGvJltXHUwMDFm7MNRJVx1MDAwZiCYNI4k+Fx1MDAxMW39kL67TVx1MDAxZOv+c69SJufP56Cwolx1MDAxNm4hfkTXXHUwMDAys0CJYFx0LfwuguWDasdNt0A43Zx5eFx1MDAxYcOMe93eWvA5zFmculxcbq5cdTAwMDFcdClcdTAwMDTeYVx1MDAxMdcwcVx1MDAwMc1Ixlx1MDAwNI9wXHUwMDE56lx1MDAwNztCq871UqhcdTAwMGZXeuVcdTAwMDXeeFxcfyRY+Hn71z1SO5dcdTAwMTavoVKJ2SNW7SpVteZcdTAwMTHehUoyXHUwMDE3NLTUQTZcbtleXHUwMDA3+Pf9ybWGYmRYJ62pflx1MDAwMlx1MDAxN73yfOXiUEd80DriwSGYTdaKUr9qh3pcdTAwMGbuKlx1MDAwMFx1MDAxNVx1MDAwN1XyiY1cdTAwMTD3gVx1MDAwZWEhPuxU/fhR1Htsulx1MDAxMmK0XHUwMDEx4Y2599NtWUIvXHUwMDAwZy5bhFx1MDAxNtRcdTAwMTiBXi0pXHUwMDE1QqtZIV/8XHUwMDEyRUbWsLBcdFx1MDAxZUPuNPpccriyPmWRn7bFW59AXHUwMDBmh+JvXHI5eWmVoVx1MDAwMFBVpTRh/OhcdTAwMTN8mC+LVEsxzORcdTAwMWaANlx1MDAwM1x1MDAxMMbUf9U58lx0/s5W+8n3M8DEnn5cdTAwMWa0P4Dzw1x1MDAxNlx1MDAwMu6B9iOF5kH3XVx1MDAwZoE5sKvvXHUwMDEwX8e1iJjDTM1cdTAwMTSgrvSKMVx1MDAwYlBXWctXXHUwMDEyj671/irg+DXIzc9hXHUwMDBiMlJDXuTsR8FW6IejXHUwMDAxZWzbJ1x1MDAxOVx1MDAxYWSIv6t5I+pcdTAwMTZDjs3Fy5mgXHUwMDFm4ytcdTAwMWWRYba3QS94XG5cdTAwMTZcYqyC/lOD5T1cdTAwMWadmCXTPiFccn4370o93Ehf/S8rxoqDXHUwMDA22/Zccnk+Ja/odCOj1j36i+WGXHUwMDE2fDMuwFx1MDAwYlx1MDAxMslcdTAwMWN+0ac1pv2pi9pjXHUwMDE5szpRRqL355ErTEipdtT6576snMPGXHUwMDBm95ToXHUwMDFmJ2h5zUG7XHUwMDBivVkjplx1MDAxYVwiu6Q7XGbLSjOtNmThJPrBb2BMJvWmW7wzV1FcdTAwMTUgNlxuvsTWXHUwMDE2lytcdTAwMTZcdTAwMTlcdTAwMGbeXHUwMDExXHUwMDE152GPXGKpXHUwMDFlhNz1XHUwMDE4pd/SgrIj6q9qjbwtrU1cbvxmVlNcdTAwMDKuRVx1MDAwYlx1MDAxYfhY0oGI+PJn8Fx1MDAxZFx1MDAwYqme4lxu6P64UVdcXFx1MDAxZm9cdTAwMWZcdTAwMDBcdTAwMGJlz2yHvDZcdTAwMDJK/Vx1MDAxM6RT7Km5/IresVx1MDAxOVx1MDAxMdNcdTAwMDBcdTAwMDHHVOmkSYdkhZknW/qj1yr1c4OWlEdcdTAwMTCdxFx1MDAxY/PM3NJPPPRzNFx1MDAwMmHG5LlcdTAwMTiemP4pXHUwMDE00ohvOJlLPLBiXHUwMDEw4axcYrZtod1cdTAwMTNq/rG+9oxbe0pcdTAwMTZcdTAwMDD28NuruqxnKiCaaXlzJaRheC5cdTAwMTfgVXfs0MtZzzxcbt9cdTAwMDdDhvY1XG6HW1xupJa2PJs9b5BoUVx1MDAxYtOjXHUwMDFj/k5cdG2pdfCj9pzCNoHePK4wRkU1ljRRJHTjQLFcYqmPuvN27bdcdTAwMDZkhDrMcFx1MDAwZryvqKziyVx1MDAwNFxcpL5VPzxwV6N+9VXPjvk401cnvrzf/suHt1x1MDAxYlx1MDAxNzNcdTAwMDVvQ1x1MDAxZu/8hTbRZCR9aMxcdTAwMTY9rMl1L7CdTEvg8/lYIFx1MDAxMiVcdTAwMDF6vs3Rz4JAf2ycI1x1MDAxNPVcdTAwMDR5Je6xXHUwMDA3T8nCUF+lZHxQXVx1MDAwN/TUMnR19DNcdTAwMWTYPVx0b6uuy1rA0SNcdTAwMTeBt7fCmY05pNp2XFyPu3wuUPorXHUwMDE0flHeRkUs3etcdTAwMDG5XHUwMDFmcdRcdTAwMTdyVM2EITspws7XvNKZuVx1MDAxNzFTbW9cdTAwMTBe9veIgL9uXHUwMDA0Q3ylwUBcdTAwMTch1Fx1MDAxM2574mmncsKBdfdqiERSgpVcdTAwMTkt9KvBYJPFflx1MDAxM1x1MDAwN29cdTAwMTNMYcuwJPhy8aODWmh3I+yNVDhFXHUwMDE0ymD5OF71cj86XHUwMDFhXGaod7tLXHUwMDE2OEkyT0k6vN9cdTAwMDdVXHUwMDBihcW/x29ccll4K+HCN75HYZsy6Fx1MDAxN8PePz3HcOz80llYXHUwMDE5/GRcdTAwMGLK8Prv+CiY/3mWffLEyLzwQj1cboRcdTAwMTGTQPpCtVJwLNLAgWKdqT9cdFxi6ODDpPhcdTAwMWaAOt204lx1MDAxMaXLtOjR6dVccmX7aNa2gFx1MDAxOVxmXFxcYmN9+9fOvnBCpFdcbuye6TlAVufVTTL2rjfMbD2iK1xiTq2mw1x1MDAxY3A0XHUwMDAz2uhcdTAwMTlcXF48o2a26PF7vYiTmrlw+ZwzXHUwMDE5bC//8j3nuEHuKTq76rzR2cJTpcojy1x1MDAxYocnZV38zirUW5+ZIX5GkKBJzJJ/fSmdkVJBqX7uS7FcInZi03v6xLInPX76XHUwMDFij+DOXT+Rclx0yJZcdTAwMDTmzedcXKWvODz5sLSfnjQ+LMYhXCJO2iykuvCuxd7E61x1MDAxM1x1MDAxM79SR+y4jkd9XHUwMDBlyHj/1UJP7691Wfa0q1x1MDAxZqtdYTc6XHUwMDEzblacsUzw21x1MDAxNF6Q3KpcdTAwMTHKaODJaeVCmPj2cPfvPbJZPfMnrz9cdTAwMDEgXHUwMDExZJo5zPqSeSTW3vr9KEfl/sbBllVeNlxih/eqviAz3N94e1x1MDAxZT+XpXVndSpccpjzmWHJJFxmXHUwMDFkXHUwMDAygWb5MiNUilwileHz1b2RXHJ+dTNEfc097GN1jW2rXHUwMDFhXHUwMDFlK1x1MDAxMrxcdTAwMDWTf/tuJ1x1MDAwMsRiVKtVXHUwMDAyYMyRMkPOv9dcdTAwMDOnZyxmlVx1MDAxMlx1MDAxNfSAK69cdTAwMGU/8qh885mezoiMXGLB+1tcdTAwMWIsICREnnGVXHUwMDEw5ZDG5o5cdTAwMDP+sXVPxeZcdTAwMWE+XG6IXFz6ON1toDVHPaI2XCI4p4rs8rdcdTAwMTcji3XMqXVXRmTVP2ZX7TZcdTAwMDLK74kmbVRcdTAwMDXWT7NGXHUwMDAwVpmnWNd3k1x1MDAxZveqXHUwMDE5lUlsMpmUXHUwMDFmXHUwMDBlXGZXpKnJiKY+pZ6a3U1RXHUwMDBm3q9cdTAwMDKGf/5cdTAwMTn9j3dWulxcslQuimi/8t5CXHUwMDAwaotcdTAwMDdn9LJcdTAwMGUlU1x1MDAxYdxccqZSXHUwMDE3XFyPNL5+LVx1MDAxMnvfUqNllCZByfnrM3q91lxytVx1MDAxMk/LqH1S81x1MDAxOKlcdTAwMWak2/NNipf2Kc9UXHUwMDFjXHUwMDA0iEBG1JyWtPp2wl7MZmfHop1Elio93ow7XHUwMDAz7eQm21x1MDAwM+RcYlYz4FjjdZ+QQlRVxlx1MDAxN1hlXHUwMDFlTJ6hm6NIXHUwMDA0rlx1MDAxOKOZ5rnFLrBU3mMxoVx1MDAxMFx1MDAwNcg+VFx1MDAwYkdcYp26/topf3e141x1MDAxYrBcdTAwMWWSkDqfenXzgG5qOZVdUXjMUtJHXHUwMDBlX1x1MDAwNskuOFlcdTAwMWHvpdaeNjS9Z21jprNvIULgsG6/l76WXHUwMDAxMe6f54fIesDwwnBmXHUwMDFml8xcdTAwMTXkonvDXHSgXHK0XHUwMDE59ErFXmX9by1cdTAwMTZnVyA5bvFt89YkZHn4/HVcdTAwMTPj441n6zdcdTAwMGZh/suwd/G3KVwiwmMsxXloT+rBlVj7YY+FeJTu5P/WlVCUjz2XZyFcdTAwMWX7fO1YXHUwMDEz8L4svLeCYE9cdTAwMTVS8a+hXHUwMDE0XHUwMDBlXHUwMDBmXCKsViFMXHUwMDE0vdOeRmn32mFzozPQXHUwMDA1+rxDXCJcXHHnZV5jzmCvwXzij4qf61h2RX6gJj6G01RcZoZcdTAwMDS2Ls4oR74t3DpsYkaeYFx1MDAwNd/20lx1MDAxOXm4VFx1MDAxOWDlXHUwMDExXFxX6PnZNkq0LtZql4u8kl6FyVNhXHUwMDBlQlx1MDAwNiok5mOnXHUwMDFjbDqm5ji/je9cXMxKlU97/8JP/S1HKFx1MDAwYt6s+k+uTv9uwjVQYFx03rfzZCHY4jCkKOFFXHUwMDExXGJq2i/Ar+9VtomnlCviM1x1MDAwM/4o6D7CI2rs4LDZmIjV+6pGwCkjmVx1MDAxMVJcdTAwMDFpXHUwMDA2gauEhv14dJDDz/+tXHUwMDFjiDX/ez94XGJAuVx1MDAxNVxcl7Xn91x1MDAxOY/rgnmG+qwj5Fx1MDAwN1RrXHUwMDBiqbTzI3NcdTAwMWSlwb7Ue1x1MDAxMWs9dlx1MDAwMeivz8Rh9jvbXGaT5JNcdTAwMWapW7zvyDG2XG6G+5kqPU9cdTAwMWJo+YlOb79cImB14oerzpnpantUl1x1MDAxZWuuTdF+qKUt+Ct8KqfAh8XOYddjjXIm4TNeXHUwMDA1foVMqffMp0Yl2ijBzsHR31x1MDAxOG/S2lOee/7alPBjXHUwMDFhTm9tcDheXHUwMDE5ZNCbVIaCZfW+7/XGqPxx8ixMZOTq+1x1MDAxZEGT/TZVOz6geudcXCG4UYFrL3LRzOnm2Ou9PWP1wT/vVD6qx6e+wv5NhVCag08qj+7eXHUwMDFl1ZvOrYfFf7pcdTAwMTlDx+14n2CSXHUwMDFlRcpcdTAwMTGNXCLSXHUwMDFi2a+vsSlcdTAwMGZz7UHMp9oofzBcdCyf5FXd702lb/pzxYtcdTAwMTZcdTAwMGJDt1x1MDAwNXFt01xi+plVXHUwMDE1kvpXmGO/XHUwMDA08Vx1MDAxMyqDM0Z9yVx1MDAxMolVq8Wr4TNtQWlcdTAwMWVdXHTn3L1V1Sjhznt8wO9EtoEozfObW/aiwcJo1nL98mFKrjdQ9XAl0lx1MDAxM/O/elx1MDAxNsTyMlx1MDAwNoBcdTAwMDFKXHUwMDEx+lx1MDAxZf5EVo7NdTpcdTAwMTbVM9aiMn5UXHUwMDBluSE5fKt8ZFO6/mZ31aSMXGLio+z78Vx1MDAxZlx1MDAwM2GYd6q4zCBQXFzIjmaQJ1x1MDAxN/r88fUtS6pHXHUwMDFkXCKtXG5sy1x1MDAwM5K0XHUwMDFlZ0VcdTAwMTmKXHUwMDA1XHUwMDFlNvpsU1x1MDAxNduw5SRcdTAwMWEkq3tVSWzxd7ZIJPtV55GOXHUwMDE4i35bO1iHx/5cXNg68MGD95uZ2ZtWPoCNdmpIZ5Fo6NeiLmT2cFx1MDAxYoHIJ2FcdTAwMTX6XHUwMDE3KMq1Z1x1MDAxZl9cdTAwMDCHOtFhJa7cUFx1MDAwNu/hfX5RyerjQV665GX+XFzhpDSqXCLy0svEb5Tr8lx1MDAxMMpOWF2mXHUwMDFiosFH9+ZwojMjZblcXEKE/iP7jz+pXkZzXHUwMDFl7YfIXHUwMDE1IPBcdTAwMDPR11xcjMxKUYRfOuNiu1h24Zy6LDe/XHUwMDBih1xygiDt5EW6LnJcdTAwMDVcIrhcdTAwMTDX09NjLXduyVx1MDAwN4RCXHUwMDA2N1WaTSGopO+HXHUwMDAyfFx1MDAxOPtN6PNcdTAwMGJ4WKlcdTAwMTdtvFrFW6or926E+Fvj2Y3JX6+2bTJ3jlx1MDAxN1x1MDAxNHbezDrYYvKyzYe16WB441S2jJjD7+RN/TNAn8m6yethduPMp9Paeqc3gsAuO2uNS/lcIqvWaV4w94pcIu6wg/TtRkKGz4fPWWvWjFl702phLoQsVHz/KrVcdTAwMGZ1IE2omFx1MDAwNGx0XHUwMDFl5KRmarmG7XO3or4rXHUwMDAyXHUwMDBl+KXASZf6dq6eYKrnclx1MDAwNd/6nedcdTAwMDBcdTAwMDBqIPaiXHUwMDFiviafN01cdGuvWpctYT9b4D33fktzgYZJ4Ubm/M1yPcWjQVx1MDAxNbFqi7KliC/tsb/KXHUwMDE0KT1cdTAwMDLJbNC+KZv6e11AM/NcdTAwMTTE8W/8KLzVRt9LiH2lwuLq7WCkXGIrSsLSwDhcdTAwMWZjWmP+uSnteNCyn9nlMzriyC2aqy5nLzJus9ErvoZBhS7/s1x1MDAwN1x1MDAwMVr/XHUwMDEwIPKGn7U8S2hX21fGRmiYa5XNXdrbXHUwMDA0XHUwMDAz1o5kXHUwMDEy+sbFkch14r7qXHUwMDE0733/akHoaiOK9cK5v1x1MDAwZlx1MDAwMyqLhlZoIdb8QpazsD6WwopcdTAwMGUnPVx1MDAxZDTSfmpsoI5eirQnjqIrpFx1MDAxZVx1MDAxM4ttT9jSOFx1MDAxZZ9cXFx1MDAwZv628cDrXHUwMDE0wfbSJ9hjI2IshuYqgVxmoWhYcaptwjyUV59Vxv63jyNpb5E6V8PUkeXVL1x1MDAxOGEvfrfkZHxQoI9W6fyc96dNkubsVLDV4att3ztTNlx1MDAxZv98rPCDXptcdTAwMTlEwfuR6U/iybv4/Iv3lk5CzL+LxlNTPmJcdTAwMWKo0iA0lkep/22R5lx1MDAxZkOe2os0Qzyz4sdzy9E7v1NhVaVRSM3PLVk44ct7iXn4IIOCrVx1MDAxOflcdTAwMTCUMqllPutbzczCKV5ZXVrVulx1MDAwN1x1MDAwNvb9O2n8+1x1MDAxNFx1MDAxMvRd99N8yTlDiqvSQ4/7XHUwMDFjZWaJ+KXuXHUwMDFiXHUwMDE54v2DLq7gnlAt8J2y746fr1x1MDAwMviVveZIXHUwMDAyV26UUVx1MDAxY2c7rkZNP5JcdTAwMTN/RJ6KLjbVyFv/e0pmP2yiiVx1MDAwZeiS3crLRSZUuczm2/VcdTAwMDenOu9ZUDudJFxyRSmPkl+eselcdTAwMTBx6mXxLIdLXHUwMDBlKOxcdTAwMTBeLns2r3W0lfeXqXb0S1xiwrgo6PD7XHUwMDE05bnczFx1MDAxNnFcdTAwMDPA/95TV4LYf/BcdTAwMTnSXmWGXG72XHUwMDFmd2iH4dJcdTAwMTTJbbOoNVWc3/tt7nurLFxiJX+eeVx1MDAwMlx1MDAxOG5Tqzx8d8+bfkKLeJtcdTAwMTZcdTAwMDROXHUwMDFmXHUwMDA0eIthmlx1MDAxMOzTXHUwMDE35m1U2PFWra7QwqilyrfWXHUwMDE5flx1MDAxM5y9gzd5XHUwMDE1PqqnqEFz01xic+h7XHUwMDE5cNcsMCso61x1MDAwZWZp12FYWyFcdTAwMDfFOG3pXGKA3ZA0hYJcdTAwMDAz/UrIecRcdPMqVIywnLp/v8+tpXVGvkY+XHUwMDA30cdV273i8jpcdTAwMTlOKdk0NkxcdTAwMDFUP5f/fi39WmZq9PONVkVcdTAwMDFMhm/8XHSYaYjLmfHCllxcazNaiLcwb6dcdTAwMWZRyaq8qC9zaSb/30NEXGKiRTdfkOUuUElcdTAwMTK2Tv9cdTAwMTFpctefnfLfoeWmdYRcdTAwMWXCPYPX7aTWoPygyG/IXHUwMDFikWI476lCcy9G+1jXrf4snZ5cdTAwMWUvRahcdTAwMTZzxIlOXHUwMDBiTzWMP4hcdTAwMWQuJlx1MDAxNjxZq2u1XGbvuNbTXHUwMDFjXHUwMDE0XHUwMDFjXG5sXHUwMDBmXHUwMDFmvqnR9bBcXPhesqtooENGhVx1MDAxOVP17O5cdTAwMGVbPOBU8DAybJpcdTAwMDGAhFx1MDAxZaoy1/RcXFx1MDAxZlxyhs0vqcRDTlxcO/mxQ1lcYtlEcmLKXHUwMDE1V2tccqUzimmac2TxXHUwMDE1c77hluDxnb+hhXAySyX+/Vx1MDAxYvdcdTAwMTZokpziLe5cdTAwMTjQmL5HZJVcZpGP7Vx1MDAxOXxlubqV8b0go4FeI1qdgjtcXGT27e2yx5n10MjrzIpcdTAwMDbuXHUwMDBi2HrdfMP1bZ7LXHUwMDAysSCEKcj4YlkrV5udUJF71ELjQ/v1q1x1MDAwNoT0a6Vhxn4meXTaRCHjM5npsayRnMLtUSYpXHUwMDAxgqyTMOdcdTAwMThcXNgwO27GOJ7B0Vx1MDAxZugyszzL+cUxhVx1MDAxObrCkVx1MDAwML5cYlx1MDAwZlx1MDAwZfkrXHUwMDEwiMw0X280f2Sn7O3n/ZgtwVx1MDAxM16BtTlcdTAwMDL7/lx1MDAxY+TCY49cdTAwMTFluzyJqK9dXG6MdX2U5IXpj3dEglNcIkRj/5nNy327uIc9OFLFj1x1MDAxZrM4l6nIXHUwMDEzj1E7LUFilzaimOBcdTAwMTd2I/nmwcuWiVjuaUjAmnh1r85cdTAwMDf6OMKWXHUwMDExTzVP0Vx1MDAwNM+Ll4h1KvmWv1x1MDAwMbNcdTAwMWOPt0kx7iuTSrU0xFtcdTAwMTGIXHUwMDE3fq+0YqRIZvJpUbOJyqzvSHTPW3qn+3AzM3t8a/vBzY0wvqx9Mpm2bOO3+lx0+qxcdTAwMTFcdTAwMDaQSjQyXHR/41x1MDAwNNpwp/A879x8XFxAap1jOFekpFx1MDAxMrm9noE1RzGzfN1cdTAwMTDe74AnXHUwMDFiXG5cdTAwMWWGuLBcdTAwMWV5klx1MDAxNVx1MDAxOXQ3g9cjXCJcdTAwMTJcdTAwMDKWTn1OR8SOmsXvXHUwMDFmnvs/XHUwMDFmjqEpV9bCSEk4Z1x1MDAxYVPJpiNXcGi6S7mdylx1MDAxOVixa0nqdLi/SKqzJXpgRsTWdl0/RmhcdTAwMWJ/NaVer+iVuUd95nCxfJFSTS7BPUZcdTAwMTlhfz+WXHUwMDAwI1Ft3lxuscaiMPZv9qN6XHUwMDE3vdarXHLVXHUwMDE2/Fx1MDAwNbSNQDxcdTAwMDQwtitTt/JwWMJdNYNcdTAwMTlcdTAwMDHfVnaAL7TgN13LOu7X9utzheCDj1Z4XHUwMDAw4yGMNV4oxprryGVURizrkylcdHFcdTAwMTNIteJcdOPlXHUwMDAyvOBj96tcdTAwMTRpf8Cxd2xyZ6Yre8FAheDl1IfsxVX6k+JbVctcdTAwMTFcdTAwMTjFV16TnZ+onXZbalrbSkzNuN9cdTAwMTJSXHUwMDFi11x1MDAwZomKwopcdTAwMTnIfKtKwnAnIJvioyXjm1xy3Fx1MDAwMZ5qKftpQnL3Jk9cdTAwMWJcdTAwMGWTXHUwMDBi/Fc4XHUwMDFloVwiwvL9JSyhwVLXwHsmQL5cdTAwMTTKraC9N+nIgLlcdTAwMWLlXHUwMDA22IqJX1x1MDAwNCa3n5LL9ftUkOq3LS1ddPGaflx1MDAxMlx1MDAwN8av89VcdTAwMTBacTDMJS83uYEsXHUwMDA3Tr+Fhip9tMdcdTAwMTLzLlx1MDAxZVx1MDAwMuRK6IhhuKpY/eySfblWg7/D11JI3uaL5idsf1x1MDAxM9pcdTAwMDaXZ02OP+EoXHUwMDFkgqhLvibwsvPgXG5cbmxcdTAwMDf27yNiTtJWfsie/b5jXHUwMDAyjnXdlaSZqVZ5j/rjUHjLfsexkWpUXHUwMDBlsbW/VNVcdTAwMTFu8W2aPt2eTplxy3C6xr6d5XFzT1x1MDAxNUtcdTAwMWFr2PdYor/fT/hbTXG4jecqOmR3TYrlXCJcdTAwMDN7V1ttZIba1Vx1MDAwZpvhh91l3W2JNEFlt1x1MDAwNmlOd1/O+8Ip+1x1MDAxYzOzrVx1MDAwM1x1MDAxZZKWPa8vXHUwMDFmnsfflulMQOf7pUpRffhIJVx1MDAwNd/f+T5u6Cill6o8tnc0istcdTAwMGZRXHUwMDFinX/o7Cdk8CM1I0BcdTAwMTAuJMd3v1LJ3kLNaVx1MDAxOMftxrR8RGdcdTAwMTHn03SyZkvAZNQwNEwqplNcdTAwMTWS1+VcdTAwMGVooVx1MDAxN2WLzcpcdTAwMTXse2dL6v/XN5Di4JD0Wj64tIo+c45wP2DgIUafOLCmXHUwMDAwOF4rpEL381xu3FVcdTAwMTZZXrVkMWJrU+hr9lx1MDAxYmgn8bOGPk6cfy/Wb1x1MDAwZVx1MDAxYce9z1N7SHXq0W6XddqM+cD7cMKX1lx1MDAwNTjhlD99vvnt6MsrcDE8Pnblm1x1MDAxM0vzMVbmJGRcdTAwMGXCtlHw/55dXHUwMDBiLGEpXHUwMDFl4tUqXHUwMDA1fuv4uFx1MDAwNr5eXHUwMDBl9EDp8GCU5zfv/a+ve3mQ1l6pneBtXHUwMDE0R86JXFwqt7Y/NZr0XHUwMDE4rXRNZTU9NYnJXHUwMDBl+mQmyPHpdX9cdTAwMTfCb1x1MDAxNLKG/I86+aalYrVANLBcdTAwMTQz3aCE/KNZd8ZcdTAwMDToXHUwMDFkwFx1MDAxMzRrnUkqjLbC3/CafmOBeMdXXGJqYnMgxKW1XHUwMDBmXHUwMDFhOKpcdFx1MDAxOVx1MDAxZbOPXGawNOztWrPup1x1MDAxOMFSQ59cboWvS5/ybdlKkiyHwTmG0192YdhcdTAwMDJ2XHUwMDExlIzT3sH6k49xXXPYkTpcYlM9ZSkrM8/Qu6OkSOBcXFQ2JDEjTNaIIGGIaV5ywt3L9oghKFx1MDAxNTKTUX79pminWXFcdTAwMDF5XmToXHUwMDAyV9NU7bwkPMyYSEPVp0qFdXB7Z0fQVmk/NX1xOs9Vf29cbr5We5lcdTAwMGU+bXeLkeikI9hcdTAwMWV3mETIKIK7MM+zuG7n6GRlivtMSujJXHUwMDA2XHUwMDA3l+PHR96jkqMkXHUwMDBiaJaAujdRNOZytf5OrGZcdTAwMDVcdTAwMDRPylxyXHUwMDAxc8zUUcY0+6tcdTAwMDP4hTLcO2chPM/Xbdkw5Vx1MDAxZFx1MDAwN9qLuFcjUTg2Q1x1MDAxZIl7XHUwMDBmXHUwMDA3SXHvzvO5Uyq2OEjwUIBg6lx1MDAwMMHKbZt4u6lvtd1cdTAwMTLKOYrdJDRKXHUwMDEzrMWa0HpY02pFsMRum0Nyxv30g8jeQ279vC8jJd55gfRtRrFNv57cXGIs0JRIYYJtXu1cdTAwMWZcdTAwMGXt/1xcO/Ka48lcdTAwMTPw89NkiW49qTBdfWfvM9lcYjc0mXo0vVx1MDAwNyxaW1SV1dBcdTAwMTFcdTAwMGL1PvKF+Fx1MDAxZMuK3yA8NNPFXHUwMDFhTsy/sVx1MDAxZva/XHUwMDFl1GfsxDfKfFxcme2bgfjbXHUwMDBma1GZb0oj/pDPXHUwMDA3wVx1MDAwNX6W8Fx1MDAxM0/6eykv38i6XHR2RKKYocax9sD8XHUwMDFjT9iil3dUgcrrUV/vkVi+SLklzJvghECjyUhcIpDcXFzZXHUwMDA1VqC+1ZdbXHUwMDAyQY4uXHUwMDA3XHUwMDFkn11uP1jlXHUwMDBmQGhNwp1cdTAwMWFZXlx1MDAxMvSnMVx1MDAwZnKKN6+H6Fx1MDAxNzN0OzJPKO1YU3nbcXtcdTAwMTLEZZlcdTAwMDNeXHUwMDBmz03VXHUwMDEy5KqUpENcdTAwMTb27pttXHUwMDFmqOqcNTHOXHUwMDE5fS78t9gxVG1bsS4gXHUwMDE0V6tMXHUwMDAxLMb50p+Aa/KARemd1SeHXHUwMDFl+Vx1MDAwMy645LU+0dZjZ5zLfIguxnVcdTAwMDFlY6WP2NA14fZcIvRWNDXZS3CyltiOwqOKYYqEU73ZXG7eUXLYV8L9Ykgwh53I/vVcdTAwMWSa01xc8DtcdTAwMDTPKaCp1oQ9Plt0ZoR/SdJcdTAwMTi4XHRiIUVIb4xcdTAwMTbZmagnvlx1MDAwYonvlq3hXHUwMDBiXHUwMDE2jJmhua3+61x1MDAwNzThXGYufFxct6ix0fOJxE/rt3tcdTAwMWKWJT+ojFT26H65opjUQ0NcYk+VXHUwMDE1lN+PXHUwMDA1XHUwMDFiSauYr1x1MDAxYlx1MDAwZVx1MDAxZlx1MDAxMG87o3mfapY5aiVcdTAwMWYpM9a7v0ZcdTAwMWMpiOnEZS9cXGXYTtte38K2qTR6gY2dk8dLXHUwMDFiXHQm9Vx1MDAwNVH8tu9cdTAwMWRcbtnRXHUwMDFhnH9Q07huTlx1MDAwMid/T93gTPwmjkxQzKNPXGIt0Yx8M4OonyqVXHUwMDFlJjcqNlx1MDAwMau+99eDK3jVXHUwMDExg3FyUiZ4/0AqcSiBMibfvlx1MDAxYmot5svcXHUwMDE07EEwzsI5XHUwMDFiJN+J8+U4xMR8v6q6d1x1MDAxZMJcdTAwMTerpGjTKuFcdTAwMDNcIuTUXHUwMDAz8opcZre05MNcdTAwMDVcdTAwMTBldf16bq7Myvf8hkXykMeFJE6K1ayMOdq3kvTsvCyctL1cdTAwMDTzWDt9/IafQ4rHXHUwMDBl01l8yXXWuJNT2NPWTFxc5bL402VC1TX1XFydXGK3XHUwMDFiXHUwMDFmXHUwMDA3h2Hm0TA72M1CgiE2qpLujUlcblx1MDAxNv+zz9ffZ/zvQWRqrIzqXHUwMDA0dsypSI5cdTAwMTBFrGmY+lx1MDAwZTf1NznflqhcdTAwMDQhdlx1MDAwNLyFNVx1MDAxYzT/7d+C0Fx1MDAxMFFcdTAwMDPBXHUwMDA2VoMtSftwY7+ZfbRnbrFPQl6blI7II4fFv3I9XHUwMDE5xjttmYKdii+it3Pec5ExpnX7i+xtxy2byFx1MDAwMrufh+m1/CW6Js18inyPoeVFkVx1MDAxMYdthWBnLOxFS9pcIjVyXHUwMDAzc6ridVAyysy6hz9HMExXk3u3L1x1MDAxZFx1MDAwMsWJR5lcdTAwMWbcNvxMlWdpilx1MDAxN8oqP3VocVx1MDAxONVQXHUwMDFhWlx1MDAwZSeWo8iGj1xumtdlOn/G4G/9QC5APn1fXHUwMDE4LmHk2vp1aCmKXHUwMDBlW419sVx1MDAxNftJUXjWK2yMhVx1MDAxMWvbI/g1zcMtcdpJhPNcdTAwMTl2mUdoYlGFKY9cYqpYV8NcdTAwMWaY6lBcdTAwMDaSx1xy4ZVazYVLkWnLKrV8XHUwMDFlaazw4/XzyadYR5VHSY+dXGZuaZA6fPSbwKKfeq240Fx1MDAxZFx1MDAxMpBcdTAwMTX+SVx1MDAxN7v93lx1MDAwNLYx5THJiqLW1Vx1MDAxN1x1MDAwZl5PaWbaPoezoOLWfLu6XCLSloi/3yxJNPwzYb7aV3pKXHUwMDFiRmNpqjDQr1x1MDAwMONdmlsw9vX7XHLgOjx7KJmGXHUwMDBl93hLRc6Dbr+Tr+lcdTAwMDTiuCVK6ONl5SSYVb7om5CDuJ/hrP5cdTAwMTVcdTAwMTFcdTAwMTlyeoTVY1R0XHUwMDFh81x1MDAxNfRcdTAwMDSu+JRkt9OO4OpsK1x1MDAxYqt3XFxxmtJ8XHUwMDA05t6IkpV/uWRPxi+RJbnoWeBcdTAwMWGg8iHsIMFcboVcdTAwMDc7yjSxT38tfZRcdKU5vLLL01x1MDAwZvxuMcOYgMVcYmPZRlx1MDAwYjJcZlV0eauPtyGHqcLtXHUwMDAz9u5qulx1MDAxZYbZ9e5T1XLellJcdTAwMDZtSHKJmFx1MDAxOZqwQox0XHUwMDA3XHUwMDEyT9z82LpcdTAwMTNOaPVOvseJXHUwMDA1kV94YWfNmMmHk/KNlCZ/yS1SdVxu054x21xuZrnnxW6g2FNcdTAwMGVk359cdTAwMDP2iq1RqT771SFrtPxjLfB0+MnlUmVSimjhXHUwMDEw2+s+VFx1MDAwNl5cdTAwMDCxRnvPTWyWgKNJi69iqiz67qhaisj99f7dXHUwMDFmmFx1MDAxZYA2xlFcdTAwMWMoM0O+XHUwMDExxmm3XHJcdTAwMDPSWjVcdTAwMDWmdnRGXGJbo4GK5mZcdTAwMTGjKFx1MDAwMlxcJq58iOor7Fx1MDAwMO0oysviO/G+uFxi5cSNXHUwMDA120lW6iU0XHUwMDEwSPB0n23OZ/uxfPn69Vx1MDAwNNon/+1cdTAwMWRcZpXSiVxcXHUwMDFjXHUwMDE5Klx1MDAxNsfyXHUwMDE0yMzRqX+vQGHBQEB8zY1cdTAwMWHLMDdq2lx1MDAxMHzbXG6N4L+O9GnnvObJMi1rgjSCt+9h4V/cJvZgXHUwMDE4ON9pP2RKrsRcdTAwMTSI9Gw/ZvTwXHUwMDAyXHUwMDEwysjt0W/I9dK7817m+Gh+5C3wVrqIYnnLaHMkI17edT61gm9/uvL73nXmwEr40rOLLFtrXHUwMDFiXHUwMDFl6bamxVJMfeCb9bjQfIidl6pmXHUwMDFkhnf9yF44Q6zaqWupvsk0pVx1MDAwZU9JsFx1MDAxMFx1MDAxMTExgmQ031RdejQ/2Ne+wK+OiOLdO+HDhd7BUUpGY1x1MDAxYlxyt7Mld4zOPPDFSVx1MDAwNlxySe9cdTAwMWLHxP73qOfRSWdW6TGwu8aAQleuiINcdTAwMWMtt4htbWKdmpr9fppzprCIuCtcdTAwMWFIXHUwMDE5Xq+i5o3htGOw3Vx1MDAxOL+zxfdcdTAwMDHUJFxiXHUwMDE5SMJcdTAwMTJB3qWqPG/EeHI9s7lWYlx1MDAxZnCVWVx1MDAxOXxR9DT6ZElNOWRcdTAwMTlaxIClXHUwMDEwXHUwMDFipSWYY7dcdTAwMGarsqi5XHUwMDFmXGKcMLL38fn8i3UjsL8jxPyW9XBla21uO6hcdTAwMDXEgHK2pqCqcK/NdsJcdTAwMGYuOKzp31x1MDAxN/bdXHUwMDBlrsvb5PTEVkyOXHUwMDFmrJlU0X5kXGZcdTAwMTdfJVx1MDAxN4KhgZwj/mnRVCSInb2IXHUwMDExXHUwMDFh5/h8XHUwMDFkj1x1MDAxZZTIOIzm3qpcdTAwMWTLv/jOKTV/niTfaXqAwOWYKVJumVJcdTAwMTR+2eZDZJohdaan01xc84SIsIfS+nbuXHUwMDFkQT6dXHUwMDBl9SvU/+/nhVx1MDAxNTXXIHP5XHUwMDBmqNqH/dKd6LRXJTu49F5tNov1VFxi8/vvYa/TXHUwMDFjgMKM1YHeI1xm0m/BrUI7XHUwMDE17b58r2R/PFx1MDAxZVx1MDAwNuqepOOlXqw2deTOd9t78F5cdTAwMGK6R0RaqoRiwLuyd9vP+NRAwW8uKtpcdTAwMTXFZFwizWh4nHpcbraOZfvMT1xioyi7wVx1MDAxOTRJXffISXEmV7V9an5AoFfAUY/DzYVj4Lyv23tiXrnbf31fXHUwMDFlXHUwMDAzgpLHXGKqylmeckOc3y0udoJQXHUwMDE03H1ZXHUwMDA3QlxcMlx1MDAwM9mfYZKMXHUwMDA3+6irk1x1MDAwZVx1MDAxZXdA2d5xaChcdTAwMGXc5LnGcFx1MDAwZfRcdTAwMWJ+w7xe5m/8XHUwMDE5NkRsPyvdbVx1MDAwNkX6iP6vXoGewZCmzUFJXHUwMDEwxXX8XHUwMDFkXHUwMDEzNEJPWpmPWfaahjs6s6JW6506lo59z43KRruy4YakXHUwMDA1L1O9b8TUkVx1MDAwNalficCFOrdTplxuafJcdTAwMTK+XHUwMDE43f0+X0VcdTAwMTVcdGF47CQ3XG6bQ1x1MDAwMM5EXHUwMDEwXHUwMDFkiky1USFcdTAwMTXYtb6kY1xulf2A2p/lx6FDtdHT19g/7nrDqPRxxYZYL1x1MDAwZX6gR3Fq3TlrpKlcdTAwMGVS259UK5+bRIqitV6Xlq9aaPykbs4k/06ig1shQLrLV1n2395wWJ7XqdxbXHUwMDFkXHUwMDBm8ZFSgahJkyTCXHUwMDE2vKv76NHGzDJcYj+2vbjMXHUwMDBlsmvS4iAhd42XlJDe8JcttIfFxS7PIVGEhVx1MDAwMCBcdTAwMTKdTs8lb9BJVC5UXydcdTAwMDaBXHUwMDBmyKRn/ryar3/HkiNOZZZH9v4qQf7rfr3nnFx1MDAwYj7ZMcOOl231smlcZmVncrerWFZSaupoSzXz2UicccYubIZKXHUwMDBl4V5dtpO/JEqyrv1Bcuf0XHUwMDA1sVxuIWdcdTAwMWY/L1x1MDAwZXMgXHUwMDEyeGZ15ddaXHUwMDA3P/q5Y/jUXHUwMDE0QHHpjklhXHUwMDAy6aKWQDflp5AhXHUwMDEw6NVG2jybuergXHUwMDFmmlW27bKgmv9n77RaSuuhVlNXrJ4sXHUwMDA0XHRiXHUwMDEwu9UqzGnkR1GSbWWctq2DXHUwMDFmeLvwXHUwMDE2XHKUkPJcdTAwMDLKkvYmRt9Hi8BQXHUwMDBl3elcdTAwMTcnXHUwMDFiQZX7MKuqrdqB/YpcdTAwMDOIiPfmVOBgO0liNv7Ok07u4e9o4eiv4u76UFxcm/boVaYmroC7XHUwMDE2okPkXHUwMDE2OU5Pfy1s6DNcdTAwMDOHyXx8XiuT2149iXhn21x1MDAwN/L3Llxi7Eqgulx1MDAxOIBcYpVVuqPxhlx1MDAxOddcIlFH2Go2t1x1MDAxZPORe/JzIFx1MDAwN9LtXHUwMDAy675cdTAwMDKRnTXqmMhcYrxcdTAwMGYpo+CUs3jMRT7POFx1MDAxN0FL8j0mrr3KzI9eZG+HoN/UtbP8J1xmLfvxLVr4pl4mgGS0g8Yw6+vRXHUwMDFlO+mte+6h82bj77bjRYol/XJcdTAwMTAgfuj4XHUwMDEzf1xiq5z4VVwiXHUwMDFiybDgXHUwMDA029rGokZcdTAwMTEuLcNQz1n+1Fx1MDAwNKZoYExcdTAwMTBcdTAwMThcdTAwMDJiKneh7txkelx1MDAwMlx1MDAwNaNUPVx1MDAxNT7eXHUwMDBlPYJcdTAwMDPHtVLFrVxitsrqqrEs9HzuYCx3vFrfimBRXHUwMDBle1xcuXeVlbxoVUfDZfbKOv+Eo4N4L1x1MDAxZJ0zXi+nrusptshcdTAwMWHFlNnaLlx0lGmmjij8+cfzzEeLhtfy5lxmzbtQ+qSIorhO2T4xRjhcdTAwMWaLxEjQlnVyIOjZXHUwMDAyhFx1MDAxZk1cdFx1MDAxOMnSyjvF5OxxvU9cdTAwMTlBR656K+rm9Fx1MDAxN86HMIW/TibbvXKTq/aZh/GMXCJCxzlcdTAwMDDdT/1zKFx1MDAwZniIgig5XGbz1ya/XHUwMDE55tfRqG1cdTAwMWRQdtN/XHUwMDBmXHUwMDA07a95XHUwMDFjvXouiEh4tUoqkVx1MDAwNlx1MDAwNPvbvpgq8T1cdTAwMDLaoGFUP/AnllxcxzVHuUSCNEbc0UnSef3plSZcdTAwMDY+tChX6mvufigqXHUwMDAy77xn5HUh4TRLOmOmXHUwMDAzaeBcdTAwMTDoY03AXHUwMDBlXHUwMDA3OTxwXHUwMDEyKlGxLJZoWFx1MDAxNNxcdTAwMGbxaPpn3+rnM9f6O6NBQiZcdTAwMTmDXHUwMDAxK4RDj6JX+lx1MDAwMeNcdTAwMTSbqfQrr6H23Vx1MDAxNeYt8Fx1MDAxOHS4/Y1cdTAwMTe0eKz8xXpcdTAwMDPat824XiHOzcDfXHUwMDA3UdZcZvz7YmrNNVx1MDAxNq5WiJfhUe5cdTAwMWR59Vx1MDAxYdGipWiAO78uTcFlIz3xdaC0cEL2XFzlbGfkWFx1MDAxNrgz7l53XFzb7F1H/lwiXG5QQIQ1tSXtmj9IuHYj9CvkqFKo193xJpJcYuGJkOPc8+HOiIjMLCeCf7+x0XlcdTAwMGY3d/7fusvyQ1x0rpdRpVx1MDAxNcVmXHUwMDAzXFzJfVK3Z2g50+DGkcpdfcpPrSn8i9JN+Zaar1x1MDAxNJWvma82WDJcdTAwMWZcXPBen8xKelx1MDAxZLf3uc5Ud6T+VvJcdTAwMDWOiPPH016L71x1MDAxOPeRcHfh0V24XHUwMDFhj3Cv5lx1MDAwNf/aislcdTAwMDNEvu/soP98uK1wXtF8XHUwMDEyWaSEaTZcdTAwMDZcXMm8R2938tFbXHUwMDBlhlx1MDAxOI7XOVx1MDAxZHzbo7Xp6+MpXHUwMDEyQo084kORyjXEOYqNmL+bXHUwMDE1yCzRe4qAPDy2lVa7I7m9/2bXTDmFc12B8k7LOatcdTAwMDPHXHUwMDE5s2BgyFx1MDAxZadB9kpLQoQ3f6lhbFxyUOBeZMsznjJksTqgS3JA71rMmURcdTAwMWJLemDMXHUwMDEzgihcdTAwMWJjXGJGXHUwMDFhnVxcaFxczTXzXHUwMDFjXHUwMDExMJlxP0JcdTAwMWatLv3NdVx1MDAxM2VcdTAwMWajkkO7+0pQXHUwMDFlXHUwMDA0XHUwMDBmXG5cdTAwMTD5t45cbvSklD5FM9NcctmbUsdcdTAwMWK6OYiiXHUwMDE4+W5qifioXad+XHUwMDBiPPSwk1x1MDAxZsyqP1x0WF4jS1x1MDAxZcNOrclcdTAwMWVcdTAwMDX271Wl1+Z2XHUwMDFj40z9UCrpW9hamtxcdTAwMTHrgVx0VupcdTAwMWYvW3vbl87jXHUwMDA1hVne6lx1MDAxMfW+SOzVVoO4QXZcdTAwMTPzlNxJ3XbtMKCcKoaV6HB/Jet3qME4ic54MVx1MDAxZFOz90Zm9UWd5vq6SLO/+PSFYEp4n/36az9ftqqJ5GjVx5ZW3NuakaxT3qWKsuojmeNcdTAwMTfaw3/uXHRcdTAwMDaP2KxSXHUwMDAxgL1q8Fx1MDAwMYyR4Vxm5uoqta2f1JmSsUlcdTAwMTa3+l1YXHIxXHUwMDA3lS/Fj1x1MDAxZvOE3Vx0MoVoIMxuLZ2hU+2EXHUwMDE481B4t7VJfsybxzJcdTAwMGb4yizgxzfp7//mXHUwMDE5Kov297dcdTAwMWLryHiR2/GxMYfmsqjFeGhpXHUwMDA3SCTWZlx1MDAxOLC3XCJav9l5XHRoyvrqZ5n9I3T17Vx1MDAxOPsknKeoP+og4SieXHUwMDE34JltLWb8XTmXmnFnXHUwMDFiKVx1MDAwYuhcdTAwMTmhe9tcdTAwMDX4dH2eyGOcd79pXHUwMDFmgTLQ84B9hSkz3WfE1Gw7IJ474Fx1MDAxZcvN8zG+1Zl7ZJFyQZVRxSZDTD71cvn6gLV+wC1lzCZNXHUwMDE2PqFcdTAwMTZyfvlxmYKcMaNegTpcdTAwMDVVrFx1MDAwN244xr78OZbLyc1cdTAwMGXLL1x1MDAwMc9N/LHGiXJccoh7gFXtakp4XG7361xc0/xcdTAwMWRE8XZcInnHv+aAXHUwMDA3XG5cIrNcclx1MDAwMrXAXHUwMDE5P8OOi1wiyC6uusVYwLBDqejeXHUwMDA0fiVcdTAwMDJv/XH/7VxykXOjPmpcdTAwMWKswHK+JIr6XHUwMDFmveYoSUFcdTAwMThGjiFcdTAwMTZyJcjamb43j1x1MDAwMD9cdTAwMDBcdTAwMTZ1wFONzlx1MDAwNopcdTAwMWb/Zo1FXHUwMDEzXCLEUTleMcVNmFAurlgyXHUwMDE3XHUwMDBiZe6Gwln0wOCm24BNpVx1MDAxNlx1MDAwZlx1MDAwMf2XvfHPyH5B33x/+HZ463KQjz6MXHUwMDFi3dOM9dNtYPFKd1x1MDAwMVD5ZPQrXHUwMDA2UcdhXHUwMDFhmHG+dfv25WvASpjxrlx1MDAxM1x1MDAwM0ve3Fx0vsL38N3wmVxyuWfg9MtcdTAwMDT895tOqSrTuPsmcKvFRbwmv6FPie03L0reS1o2XHUwMDAz+EtcYrAxXHUwMDE3XHUwMDA1pzxpuLKyb+6E0+PdsC1gO3ZeKpXc7dqSbFx1MDAxOb6huSPS+eDTbno7vDfSqNSaulx1MDAxZfdUvVx1MDAxNl1cdTAwMDXPJpJcdTAwMTc3ZP5cdTAwMWSFfS3F9EnWL/FITpcu0E7twVtcdTAwMWVcdTAwMWImXHUwMDA12Xzc19a+4lWc+Zs22cJBv6j4z56Uz2dcdTAwMDFcdTAwMDdcdTAwMDdcYlx1MDAxMFI7LDaa7V2p+lx1MDAxOVx1MDAwNnq5ilx0sshEXHUwMDAxlby4/UVcdTAwMTU1nXB6oWJWr8PFXHUwMDA3o1xm/IN2WZbvXHUwMDFkKiGwaPpcdTAwMGI+Xs7ePJ56slxuXHUwMDFjcrVcXCf4LddB4nxu4/Sm4a/+0qRcdTAwMTVcdTAwMTPnksujXHUwMDBiXHUwMDFlXHUwMDBlqlUgsFx1MDAwN2zZp0/QdHxMXHUwMDE1TsRcdTAwMTlcdTAwMWO/XFxxiyWeQulWfiZxKNDiXHUwMDFjXHUwMDFkV3HT/jMvXHUwMDFhx1x0mFx1MDAwNFx1MDAwYs6kLFx1MDAxZnvfXHUwMDBmYUxcdTAwMWU3VzbT6u6dnO93jUvWeWwta0ZvisCbjkxcdTAwMGLgXHUwMDFlce/1YtvuNnnXXFx66Vx1MDAwMTVcdTAwMTN2XHUwMDE1XHUwMDAyYVxcXHUwMDFlhL/JwLZuXCLQJZ2asb9nK+4w7UzHwZ6jkZR+33HCiFx1MDAxM3L7omKJhcBWvfp/e5eute1cdTAwMTKydFdccjruzqG3xUOuWykgXHUwMDEyYr9AWEtIRDJCKs6j5at28sNR50thjIh9XHUwMDEwxGlIdHBBgfhcdTAwMGZcdTAwMWFAcahcZjWgznRgQFx1MDAwMSSFpvOs6lxmSDaIRzZm8Ciz8qqKq8BcdTAwMTeeY0GSf/hn5D/aspC1pE5Z/CSVtSRM8a1yO+pcdTAwMTn2XHUwMDEwkZFBXHUwMDEwhu6Y5rH50Cp3gXlcdTAwMWHAwo33tKgjsL6/qZCd6S1/Q4SnXGaZgH6eILlCsYhcYldYXHUwMDE3+lPp79LjvYnUPGVTJsxG5ftSkG6GXHUwMDFknsMp8Fx1MDAxMWiJ62zrxD+ER4TvXHUwMDAwXHUwMDExKJsuq2pcIv5cdTAwMWRzXHUwMDAyXHUwMDFjpFx1MDAwMFx1MDAwMyZav55cdTAwMWO9Y5Cz6iekNol+XaWs7O9iaotzlVZhcZVfXHLId3RVXHUwMDFmjY/pUTNBYfFuPvY45Ohs5+FuX0edXHUwMDEzXHUwMDE38IY8Rl26y8aT8py7hrnBXGaXXHUwMDE10/jjP1x1MDAwMIhM1Vx1MDAwM5Ncclx1MDAxZCzY+DrUXHUwMDA04yS/rXXXeS7VXHUwMDE2XHUwMDAxPZquXGYnrXjN5EGPJSjeeNRcdTAwMTRcdTAwMDaivvGLzI75XGIwaVFcbiOiTldGyv5cXIWts0zVZoiypSWxd/GfyuIxr+9bxbssOVx1MDAxZkbxNZbXTyam8Vx1MDAxNl7d6lx1MDAxMD5cdTAwMTGDMn/MTS1R3kNcIoW30Fx1MDAxZPzX95j0V07klGb960v5XHUwMDEy7qNcdTAwMDEy3bHjZJ0vzdTCrydcdTAwMTk/5bngzPLfm8YsqiE+aat/XHUwMDBiwFx1MDAxZFx1MDAwMqWdZVFXyDNcdTAwMWT+XHUwMDBlXGb3dZQy3o5cdTAwMWOtzaSGt9Wr1K/UUHYqtnXneLvpQqZMQzJrpVs2eECJwVXwXHUwMDE4ob9jbovzL+ziJDtPSFx1MDAxOCNCeX1cdTAwMWZaU1shsMWOPlx1MDAxYzT/cF+znoGyel/gzFW3UpWHXHUwMDBi7sSPfUSt67v5UEhcdTAwMWVVUnZcbqeyQozFlnKDTZZNb+DDwXB6nVx1MDAxYj9cdTAwMDJEYdnCfb+GID6+I1P9fE6dP28pR9dET1x1MDAxZFxmoWthXHUwMDFiLv/QhXpS6FwiyiBcdTAwMDdAXdk57MVqLth++pLXJVx1MDAwMiwh9M7FXHUwMDFhjUr+Mlx1MDAwNqVI/+6/u/fyfz1jd85cdTAwMTQzs1x1MDAxZVx1MDAxZlx1MDAwNm+715t0soHB95D4QkimxaDgnnieRtT5O9vpt82A/jIgmo9UeuKi+s+v90xcdTAwMWJcdTAwMTe5J3HRPl96xcxVXHRNy0vORVx1MDAwYj98iWW+qJwmvuw9XHUwMDFjLuacLmjgjd246lx1MDAxZGR/LFx1MDAxMPKY/8eXQONfj2I5i+64pX1cdTAwMGaxXHUwMDBmm4LGjaQ4TOskXHUwMDAyXHUwMDAwXHUwMDFlgFfgcaGdXHUwMDE1XSmM/EdATqBcdTAwMTTyXHUwMDAxmp1cXOKjkCEuTKRw2Hupsi1U1Z87tngq3Er6snZcdTAwMGJSaZOkRf141cvzXHUwMDFkXHUwMDFlOYBcdTAwMTaQXHUwMDAy5fWJTKaz9e5cdTAwMTLdy1x1MDAxN737lPq4M5fxSWI3mrmMU5OXhttt4eFAle1SsLq9XHUwMDAzyu81++1cdTAwMDdzwU+SRcn0yMu181xmXHUwMDFmh09pifZRIZ/f1eZfcF35iNfRXHUwMDE2nem0eS673NnrLPTLJORBSKwxXHUwMDE2ha15XHUwMDAyaGKRWGhcdTAwMDaZY4JZoE76tTTgXHUwMDFjr1x1MDAxZmabo1wi3NKIwoFOYvRcXDJcdTAwMWHnXHUwMDFikKE74Pd6ydV5SLuRm1x1MDAxNY+SkibEScVcdTAwMTjSPp7sx9VcdTAwMTnHnLlfV1x1MDAwMvexf1xmXG5YIGJfjMhG3nVg4iebx2ljteZwx8yMrtOOfsnr11uVz7aNMHO2Saame+rodCC45ChUb/SQisu29SV1zjVyMO9cdTAwMWGqXHUwMDA2QX5R4mqR9+k+mYu7TnBO3lxmrIVnXHUwMDA04ffSi8dfXHRcblx1MDAwNI2USohcdTAwMWMtXGZ5sfHbNtyuXeH3nFx1MDAxNFx1MDAwN0tcdTAwMWZhbsOE+Hbe5Fxy6diWw/WPYplOcVx1MDAwN/6GvSjEy1x0fb+X7HaIabXnlVx1MDAxOWlSbNF5uHkvsEZnn2+kKX79/2BklLPqd7NoNmb4M0z8P+ttoybl7/ul5yNnqSZAXHUwMDFjdX25zuhsfYNcdTAwMTeo+qNcdTAwMTKL5/tcdTAwMWbyTFxcW1x1MDAwM8R780tcdTAwMTbnko5eXHUwMDE0fuVvZLH4Mnn09M0jJCz8LoRcdTAwMTaRP1x1MDAwNiDd3/i+YI9nQLyp6LvM5qBORjtPNX2WocpZ+1x1MDAwMXp7VM9cdTAwMThrPSAl/1x1MDAxONrFyXeNXHUwMDEwKM76WyQrXHUwMDEwc1fBXHUwMDFiheyYsydvXHUwMDE0XHUwMDA31MR/7uTImE5xUlnYev1LLVDIWSFFr7FuXdujaiHtejRqVJviiGVGS1x1MDAxMWCd5a2GQfTo91PzRPNcIlx1MDAxN+O3LzFKorTDx5Xj/XyyuyRccmWr1oNyXGL/5Fx1MDAwZT7uvvM1Ko7mYt/FXHUwMDBlPbJcdTAwMGW5XHUwMDEzXHUwMDE2j9xrKyRcdTAwMDc8l3tz3pqRXHUwMDBie4yGVKWlL8hcdTAwMGU+zdChJVx1MDAxMVx1MDAwZp0mcLRX6YtcdTAwMWVJmsFcdTAwMTNl8KUk7sKkXG7n3PVcdTAwMWQ7wCxX9TeYl4eViW4mr/nOj6CfyfVgX0lLK95tXHUwMDFhXHUwMDAzUMZcdTAwMDdPxdWkuHtcdTAwMWYx2jhcdTAwMDcl+MkqzaBxXHUwMDAzMFx0q3kk8XdVulSFlXi4XHUwMDBmLGx10WmyOXY+NIA8jMymLLSTIZ36WPTAvFU6/Mo+gFx1MDAxZlBQc3iDXHUwMDE4LMqTNEhcdG/439J6c1x1MDAxY1x0Q2e5XHUwMDEz51x1MDAwN1x1MDAwN0GGXCKRlMhcdTAwMDVcdTAwMGJ0NIjx/ijeou9fSSqF3kInXHUwMDFjriVR81x1MDAxMdk4X7rruyv4NOBdXHUwMDFhQZVup0XKXHUwMDFmkckt7oJxXei1+LDtma3yiFx1MDAxMTfp1XxP6o5lNzUrJ0yyhjaD8PhcdTAwMDCHgmlcdTAwMDXXvlx1MDAxY1x1MDAxNtpcdTAwMTHF0taMSabzXG5aRVx1MDAwZmq1Ub2Edz9cdTAwMWZcdTAwMWW4plx1MDAwNo7h0jiRpr+Kf36YXHUwMDFkgkua6HDXcjuVo0KCXHUwMDAwL+2HfjcnT7ldelx1MDAxMFP8zLJkanA7XHTgI1x1MDAxZVxy7+qBINP1XZRUd36/RYhcdTAwMTZcdTAwMTQ6/51cdTAwMWPMYuyGrzgzxTCXrT+UXCKfX0zhu4LRn533QEP0JFx1MDAwMI6pXHUwMDFhXHUwMDAyx3LvbzlyqYZf2GVcdTAwMDJ7JtgkTa7JLSSvgODaNj9IgupcdTAwMGZcdTAwMDR9sV2JKXRz759cdTAwMGaonG5g8/PA2PJydVjIYph9udrYblx1MDAwMnHkM6o+MKhOXHUwMDAzR1x1MDAwN7DbOlx1MDAwMksmbFx1MDAwZbS9z6/Plb9Gg1xy3iBcdTAwMWaZ0DHDb6z321x1MDAxYq95XHUwMDE1v8x0Kat0Ynq0PN+3T1229/pcdTAwMGVcdTAwMTJbXrjtsFggRUCKai78v18jXGLj5+uxpaEr/errQ9rGyIt13a/OyMv6e+DdXHUwMDFmo2ZveTCUXHUwMDA0oPRQcMczy4edPvVVecBxI42bz/XQKsd6OsMxMq5xeyWJcW32ekNi9fApRHNnKL1kQ3hcdTAwMDaSlfslP9zrcv1cdTAwMDD3l0+tXHUwMDExXHUwMDFlsFtHj1x1MDAxZrlrU0yJz93ZOXpw5Vx1MDAwMrGcMvVcdTAwMWb2/9LJojCH8OHwXHUwMDA0Lnheh+v3WzZcZmXZpV+gu6k2j6ehbuF6vL1cdTAwMTeiPvPi8VnIKeZcdTAwMTdg7f49Ylx1MDAxME1cdTAwMDGA1jq6RoAlkchcXFEp6VxcJnWAXFxzXHUwMDE3pFWjXHUwMDA06iRg4O1cdTAwMTGK4aggxWfR5f82/Huiu9VC7lx1MDAwMKJcdTAwMTZcdTAwMWb7TiQmpLqcXHUwMDEz7vf7sbZcdTAwMDOn+V13eU3mXHROhO9jgrpQe3yeXHUwMDFj3XdxhXn3YZyP4N2vZLN3vcVcdTAwMTFcdTAwMDCntTOaTOrUnMUjYy7RSU+U7lNgMtyYLjt4J1x1MDAxMdyI9Yuq9NJ1JP3SUkWAWaxcZttcdTAwMDPAbFx1MDAxM/J68taNztvMNZCfy/s4XFxvjbmlTY70wL4qXG52/1GA+H/oepMuV2GtwfJcdTAwMDcxoO+Gou87XHUwMDAzXHUwMDA2ZphcdTAwMWWDMT3m16fivZVV9WXeusuDXHUwMDFiscJcdTAwMTFGOjpnbyFcdOwzUubjhladXT/HxCiWaDxcdTAwMWZcdTAwMWG2P66/R4prXHUwMDAxuWMx5f+ISW3nrbJN3qel2ele4W5cdTAwMTFcdTAwMDb/atayXCL1r7O3LVx1MDAwNlx1MDAxOHuzgLdcdTAwMWP0ZVx1MDAwMq+R0cR7r8OxXHUwMDAyYr9cdTAwMTVcdTAwMTDjXHUwMDE4TdVcdTAwMWVO8YJcdTAwMTgxKHHYK1x1MDAxOF/e2VGksFx0PFmQXFyF5+A/XHUwMDAx+H/EoCqcXHUwMDEwJUStfFx1MDAxMpSo05BcdHxcdTAwMTC5rZiLXHUwMDAzLuEg+qXPUahOoTHTrjVcdTAwMGVcdTAwMDNUxFxcePjAM1x0pDCOkmRKYz1i4oHhVC85Olx1MDAxM02DxdTJKzenymdcIr5cdTAwMWRrXHUwMDFm86NcdTAwMTDkYDD1PpS+yVE5WvqrxVTyzVx0fMw8XGJcdTAwMDXK/3J0xcbyXHUwMDFikEZcdTAwMThPO1l3yFx1MDAxYlxuNunXvsVloFx1MDAxNFx1MDAwZnZn5GUsxUF0mFeCsZNeSlx1MDAxNKcx90ZBysDvXGZcdTAwMTF/6clcdTAwMGIxWSQvKVxuzehcdTAwMTjcZLReVUWmr66OT7yhbFGmfG1qaVR4XFzYaK+fXHUwMDE5WI9cdTAwMDdcdTAwMDc9XHUwMDA2/Fx1MDAxNpEo283qXHUwMDFk9PX8O1x1MDAwZU1zXHUwMDA2jlx1MDAxNItcdTAwMWMzLceWW4VSJzVcdTAwMDLdiJxDK1nlJWha5ndgXHUwMDE2XHUwMDA2XFxu3v7AuPlrdp1fJ1KMjDNcbvhhkq+k51QmrVwiwnHFy1x1MDAwM0HoLemjvvf3RIRcdTAwMTdO3S+vL6yJJnhHL2CMmltcdTAwMWRX30T5tCPd8jrrk6+jb8bk0Vx1MDAwZfNOfK6nLPZVdk2zM6JSyH9LXHUwMDFlOnBcdTAwMTVcdTAwMTD+SmrJ4GlcdTAwMDFWuta842XDdMHPt5FZgslcdTAwMWSbiO/emM+8Ut8nV7f0ilTtkLPqleOQXHUwMDAwXFzcZmb2+o2k+kNl417o38eyy+ylPFx1MDAwMGyQk2z6vdTfXGaEkIYz1meXxPZcdTAwMTd182Fjz65cdTAwMDXDz4dcdTAwMTFUyuKBgDU2yTNcYt+GdFOdp705Slx1MDAxNCPnXVx1MDAxY5CZL8YwKVx1MDAwNlxy2lx1MDAxNPF1XHUwMDE5h2xAj+ZcdTAwMGJBsJnl7lx1MDAwNomkTauWOo7GXHUwMDFhc9R2X9pccn9OXHUwMDFjl6RcdTAwMWG2vkdcdTAwMDL+lvuLdpCJufWkSdSlPcRDx8+ULlx1MDAxZWLHevyDSd/7NlLGPmLfY+eRykj+smfW1EyrUkZWxoMmRbtcdTAwMTKJi+VcdTAwMGXnXHUwMDEzmFx1MDAxYzDXv5d4XHUwMDAwcfl7gcVcdTAwMTb1eFx1MDAwNlx1MDAxNbBcdTAwMWFZtei853+k/a6XvGRa1CN0oVx1MDAxNIVIXHUwMDE2oX50XHUwMDE0NCnZm7QnpWdVxKOftr5IXHUwMDFj+p/4zdeXh1x1MDAxZeIza5FUcn9CXHUwMDEwi7JcdTAwMTViXHUwMDBl8dn1o7pcdTAwMDWs4FxcMVx1MDAwM4z/5kWspT+0fOpHy5lcIlx1MDAwM+o5ZaXN3LuKcE9cdTAwMTjNXHUwMDFl5W6CXHRCbVx1MDAxMpEzRZvde8Gua0pfr9dcdTAwMTLzypWqW4TRwfimXHUwMDA1U1xcbFagOZoyPFxuNWBeS6pEyEei1Vx1MDAwNcxcdTAwMGJQOpxsiXfkP1hcdTAwMWVIWOL86Vx1MDAxOYur5nNkM46xR1x1MDAxNbFcdTAwMGKQ96yVQlxmYC4lX5V2T2RJt1x1MDAxMHA/XHUwMDAyiNanp3x1Se3Buvf843OIJk09RvtcdTAwMTFMUPC8g/hbSpiuSVuAXFxBtFNcdTAwMWSK51x1MDAwMPNXdDlzM1x1MDAxMa9tlF43pFx1MDAwNVx1MDAxMPrznD5BXHUwMDE4XGa+wvEyXHUwMDEwN+NcdTAwMGJIybjOXGJcdTAwMWP74Vx1MDAwNmtvvUhd5LGn3Fx1MDAwMqlZkCNA5TB7fFx1MDAxZd6n9ylS4fErafP0w2VcdTAwMWKE9GpjXHUwMDFmXFz/eXbPtlx1MDAwNuP3bVx1MDAwN5pWoN08hn17XHUwMDExwMRcZiHPWipcdTAwMGa83nY968tcdTAwMTjKdzdlwVxcoXOutNNcdTAwMWEoqZqwQ8iusobqOPasf9dUhWvh/vl9PVx1MDAxOCz8sjjp0vsyOleuqDiktIxcdTAwMTOuXHUwMDFi71qwpe9VXGZcdTAwMWIt2MXXuH7m88fxXHUwMDFhxSHx6YLvXHUwMDFlZ8920bM5kpB9unvqXHUwMDE5W4XY8lxys1xy+mc0vaPcvfPCjrq2mIS3goNcdTAwMWV066VccohEslx1MDAwNKJUXHUwMDAzlnONgFx1MDAwNmNcdTAwMDZcdTAwMTKSTUlUIGlcdTAwMWWdP1x1MDAwMUBRp89ZpftLk7lvrlx1MDAwMz06dlNiuXRcdTAwMWHGe3lXcUl/1ph11pd7n1x1MDAwMqNcboyJXHUwMDFhz/9cdTAwMTHvJ4DXNt8w7nDw8UVsIWSvXHUwMDE1xt6CPqL238Lwy/Bb117em01wzaBsXHUwMDAzYKNuWle+4Er+kDqb4aqNO8et/c1cIlSk7EHCqmRSzNRpfZyXR1x1MDAwYncmpXRK+e+ZXeJpoJVmXHUwMDFmfNNcdLFsSmojTY+0bp+Qd9KwXHUwMDEzJ7LQSl2k87Hn5Fx1MDAxN71oMLSfzHjC2EBcYiBT3+EppeH7vFx1MDAxZVx1MDAxZHoqxPRNTiZqUr4hczvEn4ZcdTAwMDaB48IkkfEzXHUwMDA1SDdcdTAwMWU2XHUwMDE1MVxuXHUwMDEz5vnPvqEm/15hXG6HXHSrn8u6XnhN+Ph0o1OV9/FcdTAwMWZnYjGEsePM14aV4EXcb+KChVx1MDAxMlx1MDAxNzJcdTAwMGUpultcdTAwMTUn91x1MDAxOXDCU/5QecOWXHUwMDFlkc5CJO3y9VNohH5MWVx1MDAwNdX1a/NAMHcpXCIuqCFLIyHIdlx1MDAxZWXezOatS5VcdTAwMDVrjfyW6v2yym2yXlxux6h5MFPblOrSLI+ps1x1MDAxMtL6mVxctz7tqM/cWFDX3/Mhz1x1MDAwZm351XlmYXTw2Vx1MDAxNt2JcOAkXHUwMDAyLIBcdTAwMDTFPEth8HHxsVx1MDAxZI74N+fZpMSPctUsUb9cdTAwMWPkiPHzoVx1MDAxZXrr3434XHUwMDE2by1yR3WYo7NcdTAwMGUqXHUwMDE2P9eJfndj6Y2Gln5cdTAwMGK3cjfn0LCCeUBPa+VHxlx1MDAwN0mwz0DKVrZcYlx1MDAxOalxzXHKvqz9gungU6xjg8BilLVcdTAwMGa0hMQ8fu6m2nBcdTAwMWEmjJTbzsH6i1OMXHUwMDFjXHUwMDFm5ExcdTAwMGZU5mrbbr7taEi3PXZcXCFsYUmqZsS831x1MDAxOMOP8JvxlvvylFxuXHUwMDBl82lbXHUwMDFmIahccttcdTAwMDV6fraGd5zf22hcdTAwMTG9tm4s4W/01lQ6XHUwMDBifHZcdTAwMWHrjl0xXHUwMDE0hDRM7zxsb2GYzcZLtmTmSSZ5nJAzWXf4eHhhfbDDc2Fa8vLAzpKhXHUwMDE4TnP9ueRO+kO7SiRcdTAwMTdxrGSD+1x1MDAxN7P6/2d8/L+14lx1MDAxNMBcdTAwMTdcdTAwMTM4wKYyc0+gmrrcROi5m3hcdTAwMDFNXHUwMDFmTG6LzqWierwyk9432d9xT9ZRVdzKnWKqbP47XHUwMDE1zjotx9X/jlx1MDAwZjNcdTAwMDGf+LNcdTAwMTFseFx1MDAxMFx1MDAwN5TpXHUwMDBmV/ihLDufcFx1MDAwM1Jn9lEgtmXfu7ngfUg/RXe1XHUwMDFkku7VtaJqz5JcdTAwMDWSUEbibyy/hpZVRIlznlx1MDAxN1DmIVx1MDAwN878gNqXYlwiZbYnyz5cIldhn8e2K4xHjMYv9Vx1MDAxZFxi5lx1MDAxNmRH70c32ZRnXHLrXFxcdTAwMGZpXHUwMDA2pKxcdTAwMDNEvd1RU6jVXHUwMDFmoOhKWi1zLMV2ibdVqNikdlMrT41cdTAwMTftKLFcdTAwMDfHiM511KGWmFx1MDAxMFx1MDAwZt51+n2aXHUwMDE1XHUwMDFjTTj1+tlPSlx1MDAwZejPLNtXYqZ4tkayIT5WXHUwMDE0TFx1MDAxM9NcdTAwMTmhymB6clh3XHUwMDAzyVx1MDAxZiuNh01B79MmQIanlliPd6RrWai59KP8LOdcbmbdTJxdfcVyLaKGiKv6WLtS17+/sc3/wkJ5gehlnFxucM1heszfXFxk1O9P7NIxuz5cdTAwMGWIbl/xn63GfCFcdTAwMTWuLccv5iB0dMFcdTAwMDQv8rplYziHd7VcdTAwMTWvTDzC1zmAN838glx0XHUwMDE2lehgq3p6bN7rd7WxM6DIQN2zYr2v7YF4mojULZpyXGbnPtmaOsKwb+zHj0F9aW5cdTAwMDbmJvS+XHUwMDE331RcdTAwMTfvSzpcIsxcdTAwMGZk8cfn7sy+U1hcdTAwMTm1UeaeXHUwMDBi/WW29n5pdfw7RTN273cphpFcdTAwMTKX68h8VlD+XHUwMDA1vfjikLqvj/zD1U6IYllyk4fkQTihWO39ruortV/eZD7Ct0q1IXtgS/taYvRjObuDbsAyvibX+Tk06kGf7lx1MDAxYdIsiavJhz2ksGqC/+mlIP6vL/DvVUFcdTAwMWG1YWrcciVcdTAwMDZYb72fXHUwMDAzKtGDX1x1MDAxN7a+gplcdTAwMTH5M5hjediJr63CltKiLT+k17D5XHUwMDFh0J1u9ztBsqyN1NFvW7wwu1h2ojDMi1F1/ViMTi6knO5OxXpEsi90qa+yLuNcdTAwMDd++2lcdTAwMWJcdOOJScDs+OhgYZBcdTAwMDa1Vqv5YDJZkPyC2PLn7FuuLFx1MDAxOHwldZxwJYLV1lx1MDAwNIGG/HKf41x1MDAwMZI07/ZcdTAwMDPE5lx1MDAxYnVLMVx1MDAxNjy9/JsnQFx1MDAxNvJvXHUwMDBldoPS/Fx1MDAxYSzr2fBcdTAwMDFds2g6Yab70Ou8wb9288BcdTAwMGLC0qNXhVG/XHUwMDA2XHUwMDFiXHUwMDBicqLj1CxxIZDbgYinj7Pu6mRaXHUwMDExrMafj7CH3e9cdTAwMTU89v1TKJK8b2okWawmmmymKFxc679fXHUwMDBmVFx1MDAxYnWRKdT3bzqol5uWW/vQV89cdTAwMTFmxp/0zvrSMlZcdTAwMTBPXHUwMDEwaHKYzl/9YVx1MDAxYcJwJVFcIj7HSbvZZN15Vnp9UtS+dz1cdTAwMDbvI8Ut7r1IXHUwMDAyqlx1MDAxMD5SkeWVXHUwMDA0cj7yXHUwMDBluaOYizn49JiIj3aS3yVcdTAwMWKEhmna1H1TWLFjzyn2Kbd1JYBHbMZ+g25Ej0L2+ILfzZr31J+IfFKk53jXXHJcdTAwMDCZ9OnrQfOIXHUwMDFjolxmXHUwMDE0T6plh1x1MDAwZuVxPHJcdTAwMDdcXIlEs2fdrfVcYlx1MDAxZXnW/1x1MDAwZW9JzTdJ4I5oZPnv6V+2qlx1MDAxZVx1MDAxZj8rPXNcdTAwMTOS3345nNRbXHUwMDFlXHUwMDFhu180ZVx1MDAwZuZnUTzzb1x1MDAwZT/BJIubL/lGWVxy0n0/K+5cdTAwMTWQXHUwMDEy9o1BfPB8/Z/zRMTILmgznZVtklx1MDAxYp02VLBcdTAwMThZXHUwMDFicSFevmV349lcdTAwMTK37rxBQf++3nhujVdLPUnzJKPta0VvUlwi2L+9slpDT31uXGLnTn+g5Vx1MDAwZraKooBcdTAwMTdcdTAwMWVyWVx0QSUo8S1UhiTlXHUwMDAwUqtcdTAwMTStQy40u4xcdTAwMGaL81x1MDAwMqZznmUw935cYnCCXFyVMc3NRlx1MDAxNFx1MDAwM1mcnqVL6IA37//wNGk6w377U6O9+Fx1MDAxY+K80yvCzUhGnElxY535Jlc+V21lXHUwMDE4c3evyYGvyiWjqWExiTZVSE/ndZVcdTAwMDRw4ThcdTAwMGUjw5jMXG7VJKEqO72N2kMrlFA5XHUwMDBlhVx1MDAwMuOhZoszhNrZ+bj+K2rxO4nxOXRcdTAwMDLx3Vx1MDAwZYslvyQzjlwiS1x1MDAxMEKKxMI1xVx1MDAxZTgzRJ2CRvOnWtO2XGKj56w0XHUwMDE4o22YW891ZjVcYvBcdTAwMTg6PjvBI4pmIX7T71xyqPGAXHUwMDAzpuRcdTAwMDaAmeH1Qi9BXHUwMDAwv0Ft6YtcXLdcdTAwMDBf8Vx1MDAwZZ9oXdxcdTAwMTVKVFx1MDAwMVx1MDAxZSeRJd25osSaPr1cdTAwMTOlO+OSp5O6/LawoFxu/Cf9XHUwMDFhSee+RFx1MDAwN4xpWflcdTAwMWRiXHUwMDFmnO15XHUwMDE2JHtY6M2DovpcdTAwMTFGP4O9Ue2+SMTbnlxi3z5cdTAwMWZcdTAwMTDAXvZjflwiXHUwMDE1XHUwMDBlu45cdTAwMDerkM/56WWFtKyl+stcdTAwMWPQQye/5IhoW8DjfI92/v9V0/9cdTAwMTN3x2PwXHUwMDAxXHUwMDA23On+/drbl0yJjZbPfvBIXHKsR1x1MDAwZj4v91xm+bpsIcRIRU76XHUwMDE5zaxcdTAwMWSDQ2m6bW7ki1x1MDAxNqJcdTAwMTneXHUwMDA0PCtcbvlTc7d2XHUwMDEz0Z+XPfaLuIxcdPsuLbvPXHUwMDEx0CbVzUG9tJJw+lwiY2phXG4qTMht4Vx0Sm+/PijLm8VV8lbLSDqrm72fxFx1MDAwM1NcdTAwMWJcdTAwMTjYXHUwMDA0ztPBqVxmX0/l8Xw7x7WseDHS9IPj+0aD0qHC3va/XHUwMDBifehzXHUwMDE0XHUwMDE3rlxywdSbjFx1MDAxNs/wXHUwMDEztLgqhF/leFx1MDAxMmfqTuJwXHUwMDEz71j9epK7NFx1MDAxNsIkXHUwMDE1el5cdTAwMTQu5PJcdTAwMWLLrLpccrhcYtSB+Vx1MDAwNI9G4aPnXHUwMDE5aZ/ZnMTqVVgtxTtUntI0Y/89wUoxXHUwMDA3gmrYJKPNM8nzXHUwMDBiQVx1MDAwM5JjRdTzMa5cdTAwMDLStlBMh7UvmFx1MDAxZXXE7Vx1MDAxYrogXHUwMDFmglwiKkS6OifX9zSlqEzqXHUwMDA1m1x1MDAxM7bM6E9sXG7Mm3lcdTAwMDX4XFxcIsPIXHUwMDBmpO/HQbDGdcrB9nopXHUwMDAx7jxCv3Xi49CR2qu5YlD8++1cdTAwMTBWxC9cdTAwMGZEkUu971x1MDAxYVx1MDAxN47N/dY+l/2hsCP4Rp5byuLXcVx1MDAwN0kgXHUwMDA2XHUwMDExplxijPElQMs0845cdTAwMWVcdTAwMWZanZgwOCdxeb6tZ3GIn+WngttwXHUwMDFl1jqvYyokr1RcYnCt/W1diO31Ulxmf4+c0TNYXHLEcp6y/r5Ru2WpXHUwMDFmtp4jPrfPMMM8rmBcdTAwMTGxkVx1MDAxOFnZxJCi/pXnVoOD8VxiXHUwMDE4XHUwMDEyaPJ35LkpRVwijNE2XHUwMDBi3Vg5MjONmVxm13lz9cHSRNZcdTAwMTKpuJqC78C4YXrWjGjBWFx1MDAwNm50a8+rKjZeKlqAKeMxueXWmFx1MDAwYlxmOdhBOdhcdTAwMDdZvE5cdTAwMTEzaudaf33VXHLiXHUwMDBmiIw9iWOvKMqkSvtcdTAwMTnh972+hutiXHUwMDA09nNqvKX/nl54oaPoI8Jb3cOlip+i6Xgsu77rXHUwMDBim+g9U4z+XVx1MDAxMlx1MDAxN6COz11I4lx1MDAwNPpW+DtDQKzAMn9/iU8u9FSenaGcdy9fRvMptlx1MDAxMez9iFx1MDAxMylcdTAwMTTiMSe1XHUwMDBmXHUwMDE211x1MDAwM64pjDx6moJb1Pe5kXVTXHUwMDFm5LvYed+eNaF5sJTk4e35gS6RkJ/60XZE269JXHUwMDA1r2Ho/jRecFxcquwlYlHen88nXHJcdTAwMWbMoVx1MDAwMqNrly+DXoP+Yv/OXFy4XHUwMDA31Vd/fM73X4Q4TrA5Qfa8x0WHXHUwMDEyauZ3vlkyRaNcdTAwMTCjU4eiVVx1MDAxNcd+1934xrd5zzKX5DvXKZy//eSP8Xy4sJYv4cSo9IFcdTAwMTUx5T5etiZZXHUwMDA0K/d8gUh3watvZlx1MDAxN2E1/Vx1MDAxZVpcdTAwMWbU3nVmmfvnnZ+fKVx1MDAxN+ujiUOT9ur+pz7qft5cXLdFekismi+27WFcdTAwMTnqILgzMVSl+bv9bM6BNVx1MDAxNT2QXHUwMDAzXHUwMDE4Vj3NxHKkKeBJ0JH58WZztic+eycyeZbZ53vd6VjaxtzNdig4XGJW01x1MDAxZssjrfxcdTAwMTZfsNNcdTAwMDBcdTAwMTlzWqlwi+ZnxHlcXN//k/n+O0ecpPFcdTAwMTWfJ/JcdTAwMDaXuk5/y1x1MDAxY4zFxykkt+5VXHUwMDEwbDd+VUXjKcVcYrKmxibv6VDqXHUwMDEzITpEr2652IOPXzpxZEQkuJ/ZdVE67bpcdFDaTvFcdTAwMDSjpVx1MDAwNPnHfp8wXCIl/pz21/K6aVx1MDAxNuWGQjRAl73LftpcdTAwMTdcdTAwMTb2P4Fj8/BN1fJYXca0OVx1MDAwMX2MPeGasmRcdTAwMDJrn4o7XHUwMDE1nmKpT1bzVZW+Ksp7Qlx1MDAxY/RcdTAwMWQyNo1HcStcXKbgXCKFJ6RPPV/2ppC819WNi/JK2cU3m11cdTAwMTLDc0uL6uL28lx1MDAxOfrDxYjLp5VcdTAwMGKvYD7EsuNynd16cCYp6StcdTAwMWJ+MlwiV+HQj6Dtesivjj/QwVx1MDAxZWX9JufRkFwiP1wiXivaMSxfNlx1MDAxOIOLkVx1MDAwMXFegtFdbb6tPVx1MDAwZtC4Jyd1XHUwMDAytimi+Ca+VvVcdTAwMWFLQzJcdTAwMTXj/dvaYHefd0aI2EiVzqNcYlwiz+RcdTAwMGV8r4nPQ455XHUwMDFlj35cdTAwMDD9Klx1MDAxYcv/2p1aUSw2XHUwMDE0c7M103mmXHUwMDBmXHUwMDFmWMFA99q2ys6FYdFtm5n/XHUwMDA2PNWt+1x1MDAxONaxss5vfYogZVNErY03nmqhruDI5frWyWCi8jDrk7P3I31/2Fx1MDAxZinmz1H67Fx1MDAxZs0kxNf/9PuoXHR8xVx1MDAwZc7tyI+HKdPCa89p+2+JiWNBRtRcdTAwMTdcdTAwMWH7bcpZdC99r7gh8io6nvPjpGvUW77Nd63vK12jacOKg1x1MDAwM7VcdTAwMTQo1e4riTHmkCzR+bGW/fJ+gm6yXHUwMDE5Jlxid7TYrae3XHUwMDE0XHUwMDA0XGajXHSJzdZt79Wfv3RcdTAwMTidjclsP1Sq/uXoML82ZiWZzJEgQSPm6chvqa1TXHUwMDFhJrLf6WdkXHUwMDAw8JJEqODla5NcdTAwMWOTXHUwMDBlQqeuUIZcdTAwMTJcdTAwMDV9Q2Jq0ciNgN6/xCZddlx1MDAwM7ZcdTAwMDTWaGtmXHUwMDEw/nzXvlmacnC/XHUwMDFijaaMkn5cdTAwMDOHXFy0UpZ8sIqYLlx1MDAwNjdivVxuXHUwMDBllVF71KZ+J50zXHUwMDAz/KVcdJjvUfE7s1x1MDAwNVxiREAjnYZZU18u89D6Jq+ngEVr7Fn9al1sRPknrLn+2CgoOj6TYKZ14YlcdTAwMTlWXHL/XHUwMDBmpDNcdTAwMDA5XHUwMDExzsbfib7NhH6S4vnciLU0SEJcdNDOO0nWKb5/62ydhOApLalWvlEwr5F8jpdcdTAwMDIsXHUwMDFkXHUwMDE3XHUwMDE2Z4Q5s0fq2Fx1MDAxM1x1MDAxOCyhyqOKXHUwMDE1IXvzU7FjMmXkXHUwMDEzIUdC6Ik1XHUwMDEz76LCwutnjjfFyoxtVf6YXHUwMDAx3NnfXHUwMDFlbvMnveEpU1x1MDAxNyWXXHUwMDAxtc2AiJRX5y3J6j7443k+v9+Gfpmps2SGO1x1MDAwM02agTJAJzn68Fx1MDAxNpTzeoXmuojyx00nULUge/1i/lxcoXpoXHUwMDBlp2tcdTAwMGKx3Y5cdTAwMGZr+ldxWZo7XHUwMDBm6kq8w5dhNEhcdTAwMDYzt/duU9K+cFx1MDAxNufG/76/NcupIGygRTd6gn1cdTAwMTZcdTAwMDO3P0WG3Fxchlx1MDAxNaVcdTAwMTd3uKawgFLikydVXG4lYH++wrOXl+a+91xywEIsb7Yo3GH9uFx1MDAxNDupq4qJXm7Gh1x1MDAxMykmXHUwMDEyXCJcdTAwMWNAmtv+3D/kdVxu5fDMY/BcbrCjtTClXHUwMDE5oKy8hVxcX1x1MDAxYVV3drVQLlx1MDAxN3LjSN3LwNY989Tl61efvVx1MDAwZnNcdTAwMGb1cp6M8rZcdTAwMTeBU4jOm1x0VJ4mXHUwMDEzd2hcdTAwMTnaOfDAszOTXHUwMDE4XHUwMDE0wWlN6dmCm+ZjXHUwMDAxXHUwMDEyY6Voflx1MDAwNUBcdTAwMTloQsGqMbBILIooblx1MDAwNFx1MDAxYf70/372o1xi5Kk47IaBqE6rNH7QXHUwMDE0XHUwMDFhKZP9XHUwMDE20Mrzbq7SYFxcVcRcdTAwMDe2tlx1MDAxZG1cdTAwMGZf4JHmQ3FLaKzW6piSXHUwMDFm/p3FqEI+59GKxnVcdTAwMTRcdTAwMTJcXHlekMG03vrZ/5gv+HulOjAl4Vx1MDAwMtg5UMH3O4fqS0p9cY5nU/1R4i68JVL4XHUwMDFl31x1MDAxMl3zRqRcIm5cdTAwMTN44qaHPE3vgHpb+DF3XHUwMDFh/0zlN1x1MDAxZV9F7JKnymOMrPffR1x1MDAwMlx1MDAxMuL7+VtcdTAwMGbkq1vGXnNcdTAwMTLFn2dcdTAwMDYkalx1MDAxM/KGWFgqZK5cdTAwMDTjXHUwMDAwXHUwMDFifVx1MDAxYcjYKOs7U7eD5ktcdTAwMThcdTAwMTnMdFx1MDAxYlx1MDAxMiBp9jHEoI1+zercvla1Zlx1MDAxOKlEhbH6KTFJeWLo77ZH4Vx1MDAwNIyKIY1Jg+VIM+DigzXhrnjcb1x1MDAxYvLNpF3Ns9XDXyo+XHUwMDA1x0qmXHLlXeFcdTAwMTaiXGaTkIZCm1x1MDAxZJarzqYmiH5/a1KDeX+BKzJcdTAwMTZcdTAwMDG+32hcdTAwMDDRvWM981x1MDAwMfJuOZTWb/5e4WeOz0C4feTxXHUwMDFiXHUwMDA1+D5cbicprlx1MDAwMcBRn0snyzKmPVjh51xiToEkwGm0fjSYa1xi772Qc0SG9VGor1x1MDAwZamR5+dvm05ZVVlcdTAwMTFl187JgnY84zRv71FMWSHvUtT6n3P//82brLeaMaia5NEqXHUwMDBlbT9+qTBcdTAwMDKJfFx1MDAxZrmvJ1x0MUefu+Wz0uHPfMig/ky73Cto/0yJ/aqSlYyVSotZ/4Cj40bZJypcdTAwMWZPm1x1MDAwMvBCnK5cdTAwMGZcdTAwMWEhs107yOVcdTAwMTdqWNhcZnXyxYPQf5T47cuVJWv0gXaX/ZLWlCTvhidbvPzVmD5JO4smu0sjllCKM/g5XHUwMDFh8Cb7NriftpHZUVx1MDAwMkNbx+w9ftv1PG1Of5jvL6PX0FmSOFZAOO9VXHI8ezJ7N4zMXHUwMDFk9nNRXHUwMDEy3Fx1MDAxODfv7lx1MDAxMvdrs19/z3tRLebqYdtcdTAwMTOM+Fx1MDAxZVx0zUCIT9NYRvDEk0ogXCJATPH3mctcdTAwMWR0jnfhlFSZTn3HariyKlx1MDAxN51gS6pMuaFcdTAwMDNCin/kXCJgrOSrrYk0XHUwMDFiwJfRM2yJ6PUri89lXHUwMDE4Lq7fXHUwMDEx8N2GXHUwMDAwvc9cdTAwMWXNr0cpo9j8maTOkl3G+DldhFx1MDAxMezy7bx+Yspdm3e6ZqW9V1x1MDAwMS9Evcj6XHUwMDA23SpcdTAwMTL0U+eV7ahcdTAwMDFsJZpnwZS2oUtp+Vx1MDAxMVx0vFCPKeppOykp2Ls8mebTr1X4XHUwMDEwWanbIzxdt8VqXFx6Y2aJyl5cdTAwMThgrCbs2lx1MDAwM51cdTAwMTNSmqS33Vx1MDAxNzbaX8zxftZRQzp4YktGpkneXHUwMDA3h8ko4Vx1MDAxMVx1MDAxNYd/L8SSklx1MDAwN9SXMs1m6UwxPnBcdTAwMWN3afNcdTAwMWL4Tj9JjLZcdTAwMTRyctr/zFx1MDAwZlx1MDAxZVx1MDAxZk1qXG7YYo1oMlx1MDAxYlx1MDAwNdT3+Vxcnlx1MDAxYVx1MDAxMXbyXHUwMDBi/1x1MDAwNkvG342yZaZGO3Infi4qSVx1MDAwMPWjToDVj5DKtIB2fWVcblx1MDAxMsiP5OtS0qXhXHUwMDA00o+bXHUwMDE2oJwjmahGXHUwMDA0LCxcdTAwMTOY+KmfIEOntGVa3+H7XGKGXFxcYlNnqVx1MDAxZdvhNWaq9z3p/1x1MDAwMtygefpcdTAwMDBcdTAwMGV2/+7AJ5mwe9LfJz1cdHs40UJcctkzkcojaFx1MDAwNnCguvv6fsnvXlx1MDAwMePv5KUwnUzf8tGvOotRudlcdTAwMWWxuFx1MDAxOWlcdTAwMDJpmq6tJtE4cXg63KLzXHS+zTWBTfyJpuxN0mpqXHUwMDEzjCzrradPW8hBXHUwMDEx2shcdTAwMDNIvdmokajZXGaw2kyXRvi1XHUwMDE4SZ6rUtxrOVYwgOB8p1x1MDAwMLMjursppkpcdTAwMTH2a1x1MDAxNMb9XY7h/nJcZljNXHUwMDE3XHUwMDAwQIe4XHUwMDFlyP85b1x1MDAwMntcdTAwMWHvXHUwMDEx8n/I4T1DWlx1MDAxYlRy3NeAO4eMyvM+NmuyNpRnXFykkaxj+IFTipVcdTAwMDV/a45cdTAwMTg5Q1x1MDAwNPH/514hXHUwMDBmv5CYs3dOWf5NXYvN/lx1MDAwMEv9ZMP4XHUwMDEz8C8lS7lcdTAwMTDV+2PeXHUwMDEz9q1qyNlcYqxPXHUwMDE0MG7lt8BKQ1x1MDAxM1xiP5L/UM9cdTAwMTboKrFcdTAwMDKbIeUryH6wLcRvXHUwMDEx/GfdrkBcItCLWVx1MDAxZOYhXHUwMDA3J1x1MDAwM4rTMC3V//jThzlcdTAwMTheY9lcdTAwMTc75aqRX0SSdlx1MDAxMaFPNo/mXHUwMDE1XHUwMDExmlxuY6KDyqTS+XFccu5x6M5cdTAwMDHlNrRcdMhoTtLNL1x1MDAwNldnijdcdTAwMWJvgo2u7I65fLpuKpRcYlx1MDAwN27DKkdcdTAwMDOQVSFY4fp7Tlx1MDAwN/nkX3uj0jZcdTAwMDCk0sSenqJLO0H+1f1cdTAwMTJL9YSQZ8HCXHUwMDAyW2JyW3Y424XXILriX57nxVxcLVx1MDAxY6iUkrsz3EzGf7U0pyi2Lk90YdlcdTAwMWFHw0+CPdVcdTAwMTGOuqH7oX2NkrT16L9K02utYK6jp8P82SBcdTAwMTWFu0N4li9meH1NXG4mXHUwMDBiicW/XHUwMDA3+X+7219h7oRcbiQzYIBkOlx1MDAwNPmbXGIuXZLWnsHyXHUwMDBiR19cdTAwMDSsXHUwMDE2VeKs9jTWVFuyXHUwMDFjXHUwMDExxKSvpj7kQJPT5970nf+AUdo1p1xuWzJcdTAwMWNstTSr5O/8ZWzUqJYqeFx1MDAwMVxySDc1e6rFayWV3PLtavh7RV6kRFx1MDAxNSZFoI+zOGP5XHUwMDA1283p38quXlH70VVcdTAwMDVjclx1MDAwMDw/XFxYxlKRXCJs4I+TeEc83tmZO7qQPEZRJ0+kXHUwMDBmhFx1MDAxOENr8Lw0+Yqy01x1MDAwMVwicPqk2Fx1MDAxM0CIcy5cXFx0JVx1MDAwYudLXHUwMDAxXHUwMDEx4d6EtM7874mcXHUwMDEwMFddwlx1MDAxY1xi3/pyJJBhJorgXHUwMDA2jCtWuUbdh8ThYVx1MDAxOFx1MDAwN99cdTAwMTDDXHUwMDFit4eMrFNSRy/+SNZcdTAwMWGFeFx1MDAwN+hdNS28i7aQfVx1MDAwNPHHXHUwMDFj9Clwt1P2IasgXHUwMDA2t3ivvlx1MDAwMaX5biacXHUwMDFiJ1xyIV9cdTAwMTaHZLG8hrH9KNlcdTAwMWFV61x1MDAwMtnP0VxixH2qijUpv62f2kpcdTAwMDCUzTvfxPv72HIryzveXHUwMDE5MVx1MDAwNs0nk1ePN6J7q/9/zn//77FWg1O0qceeKVH0bDX/5ZdV24Ez8ft56VKsXHUwMDE2tovqYVxufM7zejbe62VcdTAwMTSUoPmJj99cZiZ/IVBPRyPqk4/Palx1MDAxMKBNq8qArFx1MDAxYpvYgMNcXMCZfjBcdTAwMTehULHu9WU0Zm4np+VcdTAwMWaNw4SidqxV2Vx1MDAwMkfCb1x1MDAxZLJcdTAwMWJcdTAwMWNnaIY9hlMryXun5F1cdTAwMWMpPoI1vmSSiZ7PwXBcdTAwMGUrx0VcdTAwMTItv1x1MDAwZlVx9GA527i6e1d5Wd35t1x1MDAwZXzqRmWrXHUwMDEwpGfquoJcdPGBqfdcdTAwMTZcdTAwMGLNXHUwMDEw15ErLEtcXFx1MDAxZDTnMf9oi/Nv3yFcbltcdOxbuEtVXHUwMDA1pLdcdTAwMDDfi93sXHUwMDFhwYDxvo2RKaK8XHUwMDA2mueL7kcvMOkz1Vx1MDAxZnDDXHUwMDBl6HqvrNlpr1x1MDAxOI1WhcJcdTAwMTdzXHUwMDExU3BcdTAwMGVcdTAwMDGfj1x1MDAxNqU+7FM10ko1XHUwMDE0nPBzIZ83gr8yfkLwxKVEtzZ1dJyioqejzlXmR4pL6d64XHUwMDE2Tf5x14bu17w4XHUwMDBio6lIVf/dxzxcdTAwMTZ2LV6/X/XYsViw2Un2soVLXHUwMDEwp1x1MDAxNJDF6cC0mzhcdTAwMWK/V3TF89JsMtOYzeE4XVSVhCrrU3yaXHUwMDE3dsCMXHUwMDFmny/FW9SuuzZcdTAwMWJFh3kxnT0z35RX+ZAj451cdTAwMTabTb6/Q0BAVSa/77DUtk+0dPh1VKdALFx1MDAwZSZ4W6HPhNGlf3ffXHUwMDE4XHUwMDAzkyelwFx1MDAwMkFcdTAwMTHjRGvUJlx1MDAxZuvK9KfGy6f8wmpo78a7WuI1miE/XHUwMDFivoN2yk/j1lx1MDAwMZE5J7NcdTAwMGX/nlxifuZhKMlBfVx1MDAxNLODLa4p9dlyS43VPzPiV9O8cbp3XHUwMDA3xKEjhFx1MDAwN1x1MDAxOZpcdTAwMDe6/N4zR07jQ/l+l9/dLFx1MDAxN9Gq/vrpXHUwMDEznKfEpEaKXHUwMDAwi5I0UpfHT/u7rXje0fm5/uX16+m3wUn5j4Wosfv7XHTKuX/fU45lXHUwMDBljr6zXGJYOJV0XHUwMDE3QqmaSFx1MDAxMKIos5N7vNjliWhKYU2igtXAV0hUvye5iFx1MDAxYZF9T/VeXHUwMDE2j0ZwQFx1MDAwYqIz1KJcdTAwMTjmlXuEdVhI2Fx1MDAxZFx1MDAwMlx1MDAwNSP9XS9pqShcdJE11sOzSHBcdTAwMDTmINRcdTAwMTRcdTAwMDElYkJoyEbp3YFcXKBcdTAwMDH75ftcdTAwMTV4XHUwMDAxV2pcdTAwMDFBVfvYj9qCvetcdTAwMWUxnnX3S8mD+qZcdTAwMWack328XGI9Xjm+XHUwMDA04GfFVlqnYVx1MDAwMDq967PWhv1ChflR2cLpTciSktqD+Fx1MDAwMPfzdOab4aiNop0kmVx1MDAxZc+HXHKa9cSSRzmrtPv9rU32XHUwMDBlr921VqbuXHUwMDE1XHUwMDBlQdtcdTAwMGZKU2c+PeIpo9P4XHUwMDE0hFVivJmULiT4ly9cdTAwMTNcdTAwMTJcdTAwMTel0Clfe1x1MDAxMTDQbYLuhUqlaijg9zjOyZTqIWH6aTZ0gVCSa7mCL7dK9mJid+5VZqT+tFx1MDAxN97EXHUwMDExKLWyXHUwMDBm1+e9JlGDf1x1MDAxYllcdTAwMDcuqS3vxss+XHUwMDFlZNFsXHUwMDE5XHUwMDBi1+r9Ubsnc2fnR0NPpfbq2nVcdTAwMWL/95pPgVx1MDAxMXHjg9D2XHUwMDEym4X8wnQyXHUwMDAzM1x1MDAxN1xc8eMrjvaTpOmfgcS2XHUwMDFiJNWza4Eqm5Q7vqNfQuC/cp5cdTAwMTixM4X8oovWx8okh4Bhm4T26t2bXHUwMDEykVwiebPoIc1cdTAwMTXbt9RXl/7W5qpx81x1MDAxM+7abV7jXHUwMDAxiFx1MDAxZVx1MDAxMq0jXHUwMDA2xWjyXHUwMDE4XHUwMDE191tcYn/UVjHbdidcdTAwMTfGlIowufhSVW1IXHUwMDE1W2p6xlx1MDAxM25LRyGMXumR81x1MDAwZvxcZvxuT67H0I+o1N9cdTAwMWOqtfhGUNFmaVx1MDAxMGPka1x1MDAwMDyDj2yypnOTbnYweVx1MDAwYvq22KO/P4w6XHUwMDA0s92EajPp8vMmve9UuueXsv/W8/lcdTAwMWWKXHUwMDFjym5B+kbpgVx1MDAwZqfpXHUwMDExPFVo7Vx1MDAxNVx1MDAwZlZcdTAwMTWzkuWm+X/ey39cdTAwMDLZS5TX1ohcZvJcdTAwMDapXCKQ20+EoLl83GNeUyFcdDmgPchRXHUwMDE50GIpmISw61x1MDAxNupbSfvelLWdXHUwMDAyPn4tbibustSr6iF8XHTO37OQgnNdOeFcdTAwMGWUQlx1MDAxMFx1MDAwMTpXf2f0dVx1MDAwNKdRdOOiXHUwMDE3s7MuI9/wb1x1MDAxMlx1MDAxOcZpXHUwMDBlUCZcdTAwMDHLXHUwMDEx4qx9ilfLv3XowPlcdTAwMDIw8GwhxFx1MDAxNTOfsa/U82fXhOXS9jfKlkNcdTAwMTbdk/0u1fL7lmxcdTAwMWSWPefcNVxuMO5aveRSa1wiMVx1MDAwM01JIPmoXHUwMDE4W5PblNlzwe1cdTAwMTe+lHeNNJlDescl+VVbXHUwMDA1XGK/slx1MDAwZVx1MDAwYkPDgzpPpVXVabtcdTAwMTeUy1xu8vJLnVx1MDAxMNtkX5SFXHUwMDE0y05e9ndx0Fx1MDAxZS+Exlx1MDAxY4+ir17i6r/1wFxuWvDrKZDe0tSPuf3VeWxHL8xMQPKQnNCspe5cdTAwMWZ161x1MDAxNjpcdTAwMDVmcN8o61hcdTAwMWPFiVx1MDAwYupAeFbRj1x1MDAxNp+y95lBXHUwMDA2XHUwMDA2Uu06Z6UrVbZZzM4whVxu/IZMXHUwMDE2oidhwz1oOVx1MDAxM54wW0QnmVx1MDAxMISTXHUwMDE0iz83dktQKaV8XHUwMDFhl0lh+/OfOe9dYTKAuFx0WKS7vstAh3b/nte5p7I0Nlwixsyeg4xcdTAwMTmIUE7XXHUwMDFjoVx1MDAwNTKWYd6wfWFuV0mGVSf+qJ36P35cdTAwMDSpXG56TomtXGJcdTAwMDK0d6O99ttzulx1MDAxOVx1MDAxY4eJXGahsGlJsX10Qsxh0uBtRmxcdTAwMWNcdTAwMTCPXHUwMDE1X+TFtTyByK+MXHUwMDAzmVNcdTAwMTiGb9am3vSBTU7WfoGRjzKA/NiAsWO/0bi3oDNljaW4XHUwMDA3ZWd+hqU8XHUwMDEy8+HKslxipykns9FcbogzIXL2s0F8Slx1MDAxYne1u3jIfKNcdTAwMTBcIpyTPlHX5mFW27+/V0+vh3eR5Kay0rtH1lx1MDAxNuu+j+VbQLtcdTAwMTeZeifFgND/sVx1MDAxNyMhwjNSRVNcdTAwMWNMWFx1MDAxOSaPjMdcdTAwMDX//uB7pJ7YnlpzxHIzSf1LQ1x1MDAwYli9fKQ5YfumxPKWXmH6d3hhhGWJXHRoeeh0iv40YFx1MDAxZlx1MDAwNT13hnvCvr2e9tWNut7fszGJRoFDR8J3r1x1MDAwYmqYLoBJglx1MDAwMlx1MDAwM2FjQMHZXGLaS/Tf9KRDLYQsrlxiuKyLSLa958O5szZ/Rar7IFhOwP/8I2T/Nlx1MDAwNHztZ1x1MDAxYZ4qt1bXmVx1MDAxYZOyNb/gkZ9cdTAwMWW5XHUwMDA0vKW7RsS4k6mt2cCCsdG+yzXVteTOzaT9PYiwnyhWWVx1MDAxOTVNYHdAP9PPL6Bx3L6ljmIw2Fx1MDAwNH/z/XvkRP+9z1x1MDAxMNqSwJ+drOt9N0GXLc1Ip0Yg5XojlDCDYDRS9lx1MDAxY52Vu2p99bvfdk+lWEhcdTAwMDGiqz7wXHUwMDE4xvRcXOVYriaQqy8tXHUwMDFjilaTTvez9JrxXHUwMDE5X1x1MDAwNvStXHUwMDA22euTtJJtsr0ysk++s1wifs5cdTAwMGKXVGhEpFx1MDAwZpJcdTAwMDFcZsnirkhRVWhcIlx1MDAwN1x1MDAwMkTSwkdAwlx1MDAxY9OTWFx1MDAwYiymomRC2ERcdTAwMDejac741zpvW9JjU6xhOqI6XHUwMDExXHUwMDE3f0BgcusrKDJIXHUwMDBlPFx1MDAxZfFvdmD+NXFccv9IXHUwMDFmalx1MDAwNmoyVce7+nwjXG6nI6A3zHpcdTAwMDVxq9LLMlx1MDAwMCHfwlx1MDAxM2hh14i/LPrbX1C8m1x1MDAxZvxYf3t1Pnz7XHUwMDEyprzg0zpccnxp9OOdMmDIXHUwMDE1V4VcdTAwMTmTXHUwMDFl1ewmeWLq/lxu5FR8jd/GoFx1MDAxNnxcdTAwMWYwO2FryrFmmFx1MDAwNCWCwj7J8V5enVx1MDAwZbwqPmuPXHUwMDEwLlZrT4b03zO0OqQ/XHUwMDA3/tVcdTAwMWag6HhcdTAwMDBcdTAwMTCCgf5cblx1MDAxMTLurIOxulx1MDAxMPbbl1Km2jePXFzUXGbwOKWNmqmFvqOoXHUwMDExUvlvcytyXGJcdTAwMTJnkFx1MDAxZdTkyf/SPyVNXHUwMDBiXyg74D1s3bd8Kt7HzyzwwKo7SmMj5SM98vr+IXVC8ffz8DlcdTAwMDSbvlLd3LbrnoC0vp1VVjzaqceRUJHlfVwi7FigWG+/u2xcdTAwMWPk2CZcdNNcdTAwMTl0mTCBd1x1MDAwMSFcdTAwMDdI+U8m8YpYXHUwMDE1O9D3c0NRvy/9mH/gj+qeX1x1MDAwMFx1MDAxM5oxSTFHw1x1MDAwZlWN5+aM6DHA2Hz1XHUwMDAyK1x1MDAwM1x1MDAxMdfX85XBuPyby1x0ZtlcdTAwMDMmRiX9pS21PPgv11x1MDAwN/hcdTAwMTSDfitcdTAwMDS8rrnTZzRdjT7Tg51Pm0z278eX0DWLXHUwMDA0tCSpN4CIgtlJlVx1MDAwNDDK05BcdTAwMTlcdTAwMDCHKU+kVVx1MDAwMdhcdTAwMTSHXHUwMDEzwlxi5lt29/u/s/fp6vibWyS/XHUwMDExqNY8OlHRXHUwMDExaFx1MDAwNnZ/M/zFic5zT8Rn1/yU8lx1MDAxMohBr1xc2FB/XHUwMDEzm81ihlx1MDAxMomy/CE/mPSti7mkvVGFUlx1MDAxY1x1MDAwNejywv0oYHz9XHUwMDA3Qlx1MDAwM5L6zzxIXG5L8e3jXHUwMDExcjPuUkjOV5NQ8Ye26H2zxlx1MDAxMmBcIndz2lx1MDAwN4qgpFL1Klx1MDAxN1B8jlx1MDAxZOWMW/p8Te1cIs/6XUFHr3vKlzGPfltEXHTwXHUwMDFmxdWU/o/7wrBTXCLdhGXYLc/qYoKtVlx1MDAwNTm+6sxcdTAwMDNcdTAwMTKWwFx1MDAwYsVgzLMwn3mKLITn4zd/l09YJFx1MDAxYX5EfFx1MDAwMyGmXHUwMDAy3lx1MDAwNFx0lzFC/9dUXHUwMDE3bqonVHg2XHUwMDAwciSEgl3tXHUwMDEwXHUwMDBih4tcdTAwMTFcdTAwMTb6pFx1MDAwYofgVOVNvJpcdTAwMWXGfT2cte2QvuRcdTAwMDKpL1x1MDAwZYB0P1x1MDAwMYux2UeGdX48XHUwMDEw76k6pKQxXHLp/z2WRd3eglecwF1hXGIv4ya+Slx1MDAwZV4kgjidRVx1MDAxOe2Fas2qpjCNfYRcdTAwMTfbcC4jQX5cdTAwMTn4haRcdTAwMDFcdTAwMDRcdTAwMDGXVImidNr0b1+YpfDsq4dxXFxf11x1MDAxZI4+uCtO+/d9x/V8gumE7TlcdTAwMDGFMNpjv3qFfYAz/iDSplL3ayrRv7wua5tg/Hy5cE2YYzY6rIjP/LshVz+uXHUwMDBmJC7piaqJXHUwMDAwx2FcIlx1MDAwYrgoXHUwMDA3P8C5by5IXHUwMDE3LLtzYWh/IdR1ezJcdTAwMWNGbih6ku1As1wigXFBkbNcdTAwMDf3fl1kXGLH+DlEgv5rRddcdTAwMWJ863RyUURcdTAwMDenzFxmT/rbyI7BJrztXHRcXJOYS1x1MDAwNohwRTRt3/k8buHFd1x1MDAwMlx1MDAxOWzkyzf/y3ZNdL7UxtONPlNj4NJ9SrviblK6zcjFS2+cPPhcdTAwMDBMhHHRtcLON1x1MDAxYfbnL1x1MDAxN23811x1MDAxOc/0XHUwMDAy5PfvWc9udM5odVCDrYv769V3R/z+532kSaHMXYNgwE2GdFx1MDAwMWvsxV1ccsu6XHUwMDA0qVu8sakwVVl++lx1MDAxN1x1MDAxY5e96y6xvGjaXHUwMDFjxuq0cYBcdTAwMThiXHUwMDBiaF9/YZpawFx1MDAwYsPXqtieRcfzXHUwMDFljX1Z3IyDyNrma0bxsXhLJHBEwzAu16OMXHUwMDFlXHUwMDFi5UZAQ1joo+dcdTAwMTnLnJ8gKkzsXHUwMDBmXHUwMDEw/Tb+fan8h7lcdTAwMDK/jS9uXHUwMDA3n4890m8u61x1MDAxMWpcdTAwMDXPXHUwMDBlhTXuXHUwMDA0VUt4XHUwMDE22XpcdTAwMGZE9O+5iSmoQ2pj6tfM/633qi9cdTAwMDJTXHUwMDFigWexb+r7XHUwMDBmLa9EJssjqDDsXHUwMDA0pTw/R7tSXHUwMDFlma+Bas9cdTAwMTE33YZXUVx1MDAxZDKdy9Fzg4Azb9z7OXGiqMlcdTAwMTDurC37Y1x1MDAwN5dcdTAwMDV4tFx1MDAxYb6AXHUwMDE4LM7/jC9bwFK5V4leSqZcdTAwMTZz+W/OKepsPNaFXHUwMDE1/Fwi1kaS1ug3RGiCl3ZcdTAwMTaq7vx+L/07eVx1MDAxZWn0YavGh/pvQdmQS0xBXHUwMDEw5JL9xqL+nkO4/e1l2+jFuK/Zkt2/efMv8WjlQn6Lnyehwtw8Myr1XCLT5t/zknv3acxOTbRr0K1UNL9TXHUwMDAxSzVcdTAwMWNN1nfvtvLUwctcdTAwMDdcdTAwMTBLcV7o1bFM/lPHrzy+u1x1MDAwNyGqspTJQv3nJC6lwzZD8OlnXHUwMDFmPmy7t/9stPLCs0pcdTAwMDTJxHzfZ1x1MDAwYj5sUlx1MDAwM6Jbvv7w9Jr1z9VhbaWn3yRWdadLjC2njt+C4d6bJyG9+VF6XCJSlrWeqPA3XHUwMDBitlx1MDAxN9qJOitgXHUwMDA24/38f6xcdTAwMTmELGH4UepcdTAwMWJcdTAwMTWWW43NqFx1MDAxMyitbp4uLHRcdTAwMDclXHUwMDE29Go567i3ou9vcCNPcmyeOnVcZv2vXHUwMDFmJ/eqRc2vkdymLPdBXHUwMDFihuT4XHUwMDE4Mf6jfVZ7f3KcLitmaXJcdTAwMTNx+q/y01xuxm/e7+ZNfcKd16dcdTAwMDdcdTAwMGZcdTAwMTNcdTAwMTVOb1x1MDAwMt1adLIvIVmeXHUwMDA1XHUwMDE2JFJqe0ZGSj1cdTAwMTkq51xuXHUwMDE5jPC/XHUwMDA1XHUwMDFjb8XczPYrLD7BXHUwMDFislxyecr868rGXHUwMDEwvDvXysRHWFx1MDAwYsXWXGJsyTf1XHUwMDE2OFqaXHUwMDBiT1BhzffFhcfVnMmYXHUwMDEyTm5cdTAwMDJZqv+fOdjiyNfS9n0nXHUwMDAyxGpG26Ckdne6jFG1X+wlvKHXq2RZuT5Salx1MDAxOUEhO1x1MDAxNY/S96svNPrLT1x1MDAxNUAhXGalg4vAXHUwMDBmXHUwMDA36ETqfoVccsUudq2EXHUwMDEwXCIvXCJipGLak9or3fOhz/GdTaFcdTAwMDeZObTYwOunj0dcdTAwMDTQilx1MDAxZVx1MDAxM29f4qy9sXfAlZysJHpwYsosStz5j3XFy0qek63JYli3LMuw8s+NXrkt8pvjxprxl8P4XHUwMDFlXHUwMDE1XHUwMDAxxVx1MDAxYpPZyz7AdMVPyo6x3Ku2r/CRgYzEQVx1MDAxOJS7z+NcdTAwMDKsXyVcblx1MDAwN4VcdTAwMDZLs2RcdTAwMDaNRSxiI27ZTz9JUKWSKbZiW5lp5yQ/11Q5XHUwMDBlXHUwMDA1NFx1MDAwNZHZwfDtb1xyXHUwMDFltY+xuXqTWnbYKzR2jaaBKXnXXHUwMDA0nd//O7NLaumHXHUwMDFjs1NcdTAwMTF4ltrsXCJdXGJXXHUwMDE3x55cdTAwMTb+OFZcdTAwMTRcdTAwMGLM7UVcdTAwMDXzXHUwMDE1lP1cdMtcdTAwMWFtjlx1MDAxZlx1MDAwN4mDRCyX2iq9+lx1MDAxMkM05dK5wvlcbru9zT2tL15cdTAwMWLHsYIpQYu8d9WYrP7v7Mi/eZBskn9cdTAwMTNcdTAwMThAdclFwn7YKDp55t1cdTAwMTeoNWSVZ+JUejerq6ZCdLOX1nI060gqp12YvFx1MDAxZmnxmflIuGXuKpTBe9VQXHUwMDBifVx1MDAxOEOTJVx1MDAwZjiFXHUwMDFkf7uQlm9DqFx1MDAxMUPCfPnTZbGuXHQvson5ff+417fF/tbG/IdfSL5CmugxXG7PjLA4yoU4ZE969c3qdnn6/9hLX+NWU03AsdR+csRSYY/lrF5At1x1MDAxYlBcclx1MDAwMnNnINZcdTAwMTP/pWBcIjs2NjtwXHUwMDE1io5cdTAwMDXBiJ8+6JSljJREUtCDa9gpTFx1MDAxZMr7bZp0a6xcdTAwMTKva2M/kJRcdTAwMWb2YDWclCp7at3RXHUwMDFhiulUulxm2yiT9TbSMkSg31x1MDAwMb+bcNGbilx1MDAxN83d4mG/Q8wg6zZ9nLo2UTzjbcFDRb6vtUWsqumjo+K+1vLRrcWKXHUwMDBijVTks01ZXHUwMDE0PeCgSKxPsjze41d6rT6Z3NkuXHUwMDA0pTtWQGLourww9vZcdTAwMTCY93RgM1x1MDAwMIZ6cf7K9lxu+lx1MDAxNjhTut+O6sdkop3Ed3nMptM8S7F2oVx1MDAxMFx1MDAxMlxyXu4ggkOa3ij8ePn1qVi5XCIo6sjvZOpcdTAwMWVL0phcdTAwMTVcdTAwMWTJilx1MDAxY2tcdTAwMTGhJJDL6qrkzdHDVr/p01UhPZCQ2qHZ169XXHUwMDFh089l2zz2/c+5XHL8XHUwMDBiXHUwMDBiklx1MDAxY0uEXHUwMDE08NlxyUiVpLw8t5FycqpsbJVHuT2I6Vx1MDAxNOlcdTAwMDZ71NLxZV109bc/U6aY7CreobR6pFx1MDAwNSHaytNcdTAwMTYhxaFV72yAhZ4hezKN33vBdMflnFZcZpZn9Fx0J+i6z4VcXFx1MDAxNVx1MDAwZp9ZaZxGwLj+32bMu9RcdTAwMDWvXHUwMDA0XStOK1RcdTAwMDKYWXvGQNX4TfGK/uSF+HFNq2q+7OX3m5VcdTAwMWVskKepXHUwMDA0xz8/XHI94G9On3HOQfXCXHUwMDExrUaXRqjmNC4/XHUwMDA1ebdcdTAwMTR6T2hD6NfCoojEUlx1MDAwMPlcXKTv87SI6v/eW4nOXG64fSE/5pFZn/SnfFx1MDAwMy/KOCOZgSRcclx1MDAwMtclXHUwMDE5q+/HrPdNrmDgb2DeZN3XXHUwMDFjUnbE0lx1MDAwNoS7vVx1MDAxZqzderW/p1VNXHUwMDExQ1x1MDAxMsw63aCX/pYx6vFcYitjeUlcdTAwMTddQ3XW0iR39IdcZv9duFLJheFoeDH7XWfcgYS39otcdTAwMWY/XHJgXHUwMDBiyy5cdTAwMTGPcV/2iVwivfRcdTAwMTenVkqYdLxcdTAwMTf5Lf8+XHUwMDBmwFx0Q7am+PC+p+RESNT/LamczqQuU1x1MDAwMpJcdMmTLVx1MDAxOVx1MDAwYn/7IatidYqqXHUwMDFjxio+2Pu48pbhjiPAXHUwMDAwcVx1MDAwZVb6XHUwMDEwYExi63ZcdPHysHaWXCLFy85cdTAwMDNNf/7SR/DUJDsshNxcdTAwMGI+2vhk21ekO1h3Lie30lx0i1xchuRPelx1MDAxM5HbzFxifLXWYGZcdTAwMDchiIy/NXfC7krft/BcbjrqXlx1MDAxMfB3TpfSNvBcbuWuNZkzLTSxgDWFsjL6w8lC2TJjurpG2J425eSGt7f2LLdTXHUwMDFl3lxm1Vx1MDAxZZTtq4hjktEqqe0vg3xl0+5y9m1cdJ1Zul1cdTAwMTBPkfJDPqJxcqhcIiGpe9lb3GhilEvM+6QvinlF4duaov5Ql5sx+mvsXHUwMDFlaSnrU1Iv265rKHlcdTAwMTmPLjPaQFx1MDAwNN4sWa/tvEpDg8ZMca9+W5vjZDT3tf5nqiT056e+XHUwMDBluZRcdTAwMTG6fdx9I9Ro9TWLJjN6v53slJOQZyRqSfzwXHUwMDBlXHJ9niDJXHUwMDFmrddNkCooqEFHslx1MDAxNDDHuVx1MDAwM55cdTAwMWLD05Uw4MjxqenaYY1cdTAwMDCQsehcXL9a+udaIDiieTA31n1KXHUwMDAyXHUwMDFjt/PWtbDexmRB/eXgKcV8ofSU5aRHXHUwMDFjbXhcckrEaLriZG03l1x1MDAxYzd7XHUwMDFl9oVcdTAwMTbCmFx1MDAwMezlv4dn3M9cdTAwMThrTVqoj1L7VEjt9KOLkvdEva44vvFcdTAwMGVJUqrLfaw0fHcpWbVcdTAwMTR5sHdYiVPX+yFIuFx1MDAxNOX0uDHg73xyv02JkKQu6nBP2CrXz6tJn3SMglx1MDAxNFx1MDAxNWsp2Oq0nt9MsMzCOpc7dFjKclx1MDAwNX1V4nLBPD5UtOBrxvc982jbpvTumOUrVVFeVP7WVc1QXHUwMDAxXHUwMDAwQL53pd+NmOWehbyLXyOmf2vOys1S3lj5pl7N1ShFI3xcdTAwMWXtsFxi5TH1XCKQduFuPFXE51xmbbf1XHUwMDA3jEzI+qOJXFx3clx1MDAwN1x1MDAxNmb8I0H37MtcbplhipPASMRcdTAwMDDZko07qGN714imXFyfuTLXvjONp4itmsQxYro+w+b1StJqm1x1MDAwZkmOYeNM5E+gXHRAl4v/XHUwMDFl32uNyFx1MDAwZekt0eNcdTAwMTIzu+heVXRNdn9qpVl/XHUwMDFhg0ZoT9BcbrGbXHUwMDAx7+nptshcXN19kNA+f+slbWmMXHUwMDFkfk3GwaexkINcdTAwMDSp74ZIXHUwMDEw92/14f9kXHUwMDAwR6NvXHUwMDEzb45bjVx1MDAwNXGHkKHUMd5965mcc+dKKdVGLStcIkDpliY76q5cdTAwMWLG+jKeXHUwMDFmrcHuXHUwMDE3JkhgmpdryWhL/UHENXDmlqT6IYWNY0anRHovTvJigltcdTAwMDFcdTAwMGbIRKKSm0VZkLNsjz9T8/ybmFx1MDAwNl5Jelx1MDAxN8/a/9iLa7EwQmOANGdO9V5FpDCpPvjM4i9cdTAwMWasSb/rQPC95CPZTnAhfvNcdTAwMWOph1x0yNFccoSfXHUwMDA2VcG4JItcdTAwMTSualx1MDAxMezCj6Ip1yQ80ZJcdTAwMTTj+y+zXHQhXHUwMDFjS6xDXHUwMDExPlx1MDAwMGWtlVtcdTAwMTCo2ixcdTAwMWYx+tw7YCznMEPw6KBcdTAwMTdcdTAwMTB50Siu57bCszyVb1x1MDAwMIdIXHUwMDBlU0+dXHUwMDA3rJO2JpdcdTAwMTCp/lx1MDAwNJEuc1wipmvBUDPfWfquuds+Yu9Xf/msx2hqZ9y3fFx1MDAwYvhcdTAwMGJ+8krSMvBmUpeMOGLpXHUwMDE3MpDPdCnkXHUwMDFkgDerRFfNV2eSRWxKOZTRqKEvd7JWumKu5LSMIf6z7KOSJe5XW+9cdTAwMTWZtnubTpaxKV3mqdJcdTAwMGbFbIghz0lcdTAwMTWW3cFJX+TcLJJIZlx1MDAxMqGlOqk9XHUwMDE5fS3NxnFvpPp+Se1oXHUwMDA04ONzvfnjKWr/0SFcdTAwMWGVPmZhkp2h7sfhWa2zXHUwMDEwXHUwMDE03Pnjwn8peEVcdTAwMTMgy09cdTAwMGLd5Fx1MDAwM7VAXHUwMDBlKPO3slx1MDAwNlx1MDAxZErs21x1MDAxN08mPZfH0Fx1MDAxMDGsddPz4Yyk53eubrFcdTAwMTYpYsGvzs5WZL6MrqSR83eX33uxjEU/XHUwMDEwTmT88CesdG3Om/oqfVx1MDAwMVx1MDAxNFx1MDAwMqOgnDJcdTAwMTdcdTAwMTBdu+f/outNllxcZYJtzVx1MDAwN2JA31xyg77vXHUwMDA0XGKY0bdcdTAwMTJCgGie/kbuumZVVuc/o20py9xcYsJ9+fqCXGKPRMuQXHUwMDFisl3M/3WO3Vx1MDAwZSqv3XO5XHUwMDA3iVIyWe5Z37bwd5tcdTAwMDRW+Fx1MDAxNWONrnGHYtVcdTAwMWSK7FxuVkVcdTAwMDSXXHUwMDE43vQ5oSdCYY2+RORRfohcdTAwMGJ+NeZCilx1MDAxNmnqOoZfwbPRK4p0lWF5RFx1MDAwZv6Tb5uoXHUwMDE3mF6nNE9cdTAwMGamXHUwMDE3Nlx1MDAxMcp56fO8iL/PIZc6U1x1MDAxOSwvYFKR7ICSu25i9Vj9yYevuavie6uLh8NcdTAwMDHdXHUwMDEykWyp6o3h7WHlgeuRXHUwMDE54YpcdTAwMWZcdEfqz+puLNqPmOfCXHUwMDFhsMRGf1vrsFxyxGapi8Roxlx1MDAxY5xbpDLeKufy0Fx1MDAwNruTr1x1MDAxM0vGXHUwMDAz24y1Y8HHQ1x1MDAwMt0/Tlx1MDAxOMN+JShcdTAwMDBmz2aox9Q+mK/KXHUwMDE0XHUwMDBm0Neftrva+5tuiLdwr4KS6lx1MDAxZmJTnuivMJ+MXHUwMDEyxzLb30WjP0Zdl54vxT9+31x1MDAwZe87i2rZkpJcdTAwMTNomPz7j12Kg4LFtVx1MDAwN89MhFx1MDAxN9pMkbidVlx1MDAwMWEuXHUwMDE1l+dcdTAwMGKYnZrDo1x1MDAwNY5cdTAwMGVcdTAwMWSgj9NcdFx1MDAwNul2eDKzo/SMXHUwMDE4tvJvX1x1MDAwZn5dduNYW0T44dCggY16iWFI3DDWX9dcdTAwMDFD59bdZk8h8p07UMjry66+slxiYntcdTAwMTWE/5YxVzZj+Vx1MDAxMY1x6IOOYaNcdTAwMDdStzm1yd+xNfyVpV7KiO5cdTAwMWSP6zmYjfZ+XHUwMDA0bChi0eH5Ov89e8Kid49cdTAwMWbu7aRhnS6d71x0o2bE29bFPmjv9Fd7hUlnTlNaLCtnclFhJp819SvMVlx1MDAxOLlkVFx1MDAwYotcdTAwMGLs8pfK2FvhXHUwMDEzc2TuXlx1MDAwZiCEUtvPdqXIxVx1MDAwN8ssW0Xf+6B8UV2egEd843BAo+NqmTuQOVX5jzj7XHUwMDBiNWlP0sP+LFxumScz+clCR6zdvGxcdTAwMWMlQ0CLU4FcdTAwMTnU6VBcdTAwMWHj35o8+HVcdTAwMDWrXGbjRqHIYnRRb1xmTrtcdTAwMGbkSFxuXHUwMDEw+rDK+kn9XHUwMDFjgt075+VcdTAwMDfHJO2Lscv6rmrATVx1MDAxOKTvr4B5XHUwMDBi9kz0i0/F4+dlXHUwMDE1Qy8+eoo2otVQ22WujVx1MDAxN/guaVf9xkAzbPdgI69cdTAwMGXePkmvqHh6/5b2atAsJFx1MDAxYlmJMfmz/s5OXHR9Qa+1WW5TlS7VyLavUIo70V1cdTAwMTIk4T7k9IaerIS/c2Gx3G/xj3GfvDdcdTAwMWJK3N2zoj07Terydoyq/dBdXHUwMDE4VFxc46vmaFDVzlx1MDAwNZqjzUMu3kPV6tKOXCLRdD/iWY6fKjBcYlxc7Z5cdTAwMTVcdTAwMTcwOPH6XHUwMDEw3vHlopFyzXFcYppGlvGUp6+J3Fx1MDAwM4FzXtH34XQgy56t+HusxoOX9UXFp2u3dEta/9ZcdTAwMWE55ZZzletjXHUwMDEyNvqKY1xc4jyw465cdTAwMDDLLT+mmFx1MDAwZb/eV3UsWlx1MDAxZT+5yDDpYUZcdTAwMDZGost3NnaTUuZqOt5isFp+Y5WaMj53yV1uxro/RPWnxebwar27tlx1MDAwM7+dUq3o9uVrN3FcdTAwMWV5lbRcbuLVXHUwMDFkjJT9/KXg6d9FYuX7hSTyO0RfU9fQXHUwMDExXHLOOO9cdFx1MDAxMatcdTAwMTLfXttEenrt563gVvZCNSnwtFx1MDAxYlxuSr3v3k663lOGXHUwMDFlXHUwMDE092BcdTAwMWNEbYFcdTAwMTU1Xlx1MDAwYl+/+NGPqTbT6zOO4LU4f9OG87NlzFx1MDAxN2bUXHUwMDFm7C1frzdcdTAwMTfkPPJcZlHSYFx1MDAwN1x1MDAwZY5cdTAwMWJ41eLl05WnY3ueWlx1MDAxZmt404zdv46gXHUwMDE5oyZcZq6fYNZWx9Ykoz1o4ptZ1ym+6DZcdTAwMDFcdTAwMDC0QJ5kP/YzLc7uX3iuXHUwMDBmSMTm8JZcbp9cdTAwMDdcdTAwMWFfvEDdo7+9hOD7NzfHIF2rId7jP965Q4/AK7agYGyKy8FLbfTZL1XZ6XhwoGFNXHUwMDFmjs827nO3WqdcdTAwMWElcj3HpXneqLBJXHUwMDE4XHUwMDBmJSFcdTAwMDTG5HbHW8KrNFKP2P3iyomJwWP4mlx1MDAxNbmbmT5kc92+eOLvaLI5inVo6/56sFRRjElRTFhk3CNiSlx1MDAwYlHXePuwi/+2rUl9bfcu6MDOXHUwMDBiLXGH60tcdTAwMTT9XHUwMDBmXHUwMDA1etc220W441pcdTAwMTbVedLMX1pcXDbKeGBcdTAwMDdcdTAwMGah5+Q3QSpdPvmIrothXGZeXyBEUoVVXHUwMDE0rFFoXHUwMDEwg/pcIqZ99+34XHUwMDA1KGFR8lx1MDAxY1CfXGb7cFx0VtD910dcdTAwMTVdfrTPXCKgXHUwMDFm5KNcdTAwMTFOYll/YimEZGp7T01cdTAwMDaZXHUwMDE0/Yzr3ds4hFkx+utPYz6/tUdcdTAwMDSF071AqvtaXHUwMDE5eUDaXHUwMDAy5dpoWFx1MDAwM/NcdTAwMTJ6Vr+q/Fx1MDAxN5pYTTuSWVx1MDAxZcpcdTAwMDL1XHUwMDFiuFxcxsBbVTjuq160fEV4ITjC1Zj68Ok1/ZEzXHUwMDFm2zlevqR0z2Syb6erhXegXHQsffGMm/71/ehOXHUwMDA3YPSjklx1MDAwNfNcdTAwMTGhPcnsXGZgJ4k1XHUwMDEwIXq9xI9tXHUwMDBlZo2NXCLx1lx1MDAwZlxylj1sreVcdTAwMThcdTAwMTH9dFx1MDAxMv+O5TL2btugbCbhktqM/mzOZm2qWrJQP/SbXHUwMDFleWLOXHUwMDBi5zbJXHUwMDE3s+i1i/2zRZl2SSSEyvua09uQd6Y+ROXf97wol1x1MDAwN1x1MDAxNYQ7XHUwMDE5w+2DXHUwMDE0g3IuhUeumNNcdTAwMDbmXHUwMDAxdZ7x3Xur+Wg2qoVZZspayF5pU3dcdNaoXHUwMDA041x1MDAxYYRcdTAwMTD6tJg3ZjszhN9vXHUwMDAxXHUwMDEwa1IhoEpvqYZBRv9b4+X+OOOkquE/1+3AcXuKrYZ5fu3ftPBvPjyqXHUwMDE3oZJcdTAwMDSR9cPWl1x1MDAxZmST9K3FXCJrkVCzKleYZ615gbGdq7XUZL/T5pqVv1xujG/YkqBcdTAwMTP/0X/oV/aPZrPNkpU5Ysr71iiUcshBi6L5w722duV9X2BcdTAwMDI6XHUwMDAybi/sUYlcdTAwMTYoXHUwMDFjXHUwMDA3fuubLO7TpjnltybNudEqXCL98bNKXHUwMDAzttZcdTAwMWLur1x1MDAxYv1Ta03chIlcdTAwMGKWXHUwMDAyc2Gh5tDtXHUwMDEx822fRoXyXGa+67IlfjL3j+By2aLf3693XG79XHLUc6m+ZI13vZRz5afpjvZXXHUwMDEzgvtqM3FcdTAwMTRe2sE6Z9dcdTAwMTnUyouvlZ/ihVFFjOPVuVx1MDAxZWHldFx1MDAxZSvmQk8q0NzC36nauVZHglx1MDAxZih/j10qXHUwMDFjrOevhFx1MDAxMv/2ZlR9cFx1MDAxM1x1MDAxZf3meTAhhrhcYlx1MDAxZpVumlx1MDAxZUrQXHUwMDFixlx1MDAwMFx1MDAxMU8nzlx1MDAxZbMs7a1cYupWI1j1XHUwMDE2W8Ep3nPOdmdyVlx1MDAxZCZ+KvtNPWzBRtzEqYers012dVx1MDAwZsAuOaL7XHUwMDBmsz0kXHUwMDE4JzpmXHUwMDExi4FKr6mlOHSdNVlcdTAwMWblUHI9nf6spDCNvlTqrZlcdTAwMTZ3klx1MDAwM0Cv90trrkBccnXt+Vx1MDAwYutZmVx1MDAxMTn9pcSSqfxQXGZcYtvNXHUwMDE2KaFM2LyS8MucL27PsTBkb0SZ/E2qvLRl3kO06cIvXHUwMDFiXHUwMDAx71hN+ltcZmik209YN635/VCf4Vx1MDAxNFx1MDAxMP0+z8P8PFx1MDAwNWCqn8wt71x1MDAwM0/990+3in2/uSaucGCQ0nbTXHUwMDBltlx0qLhcdTAwMDX8JoVcYno3zdHYTaGrz1xcT1x1MDAxZIxazX5QQ/xY2uMmLudcdTAwMDDVX//14Mc9WrNcdTAwMDBmy1x1MDAwM1xmXHUwMDExdGDMclx0q8PfumNul2yaS/9zXr48PrLm/LF/d22XXGY1vm5t3Jdm29191EyCbzm3Yv6i+zn3frdHl7A2u6T/JO8sXHUwMDFlXGJfXHUwMDE1j1x1MDAwZi3v2Dxa1YtrPFx1MDAxNE3LW+ooxzJcIi7a8Yt0UuTuhainXHUwMDBmt+7tXHUwMDBixSNNV0eTlWKlXHUwMDE5XHUwMDFlP4ZcdTAwMDUnw1iZpCusy6xgXHUwMDE03uZcdTAwMTShkvqczj1cdTAwMTUkI5dcdTAwMGayKFfR/jHKuFx1MDAxZlxytlx1MDAwM1x1MDAxZcmcw000lDMgd9yRXHUwMDE2eFx1MDAwMyn9+mtcdTAwMWXT81x1MDAxYyfdS5pJfVx1MDAxN4lcdTAwMThcdTAwMDRFtdmgaVx1MDAwMXjNjJJcdTAwMGIoyTYjPjRYXHUwMDFhR0v7VNiMoIqNsi1jJoSq/Fx1MDAxOUeJgbrLmjbUKL4/an+PQpA+z6SQizKxKUJccuFcdTAwMTg1X2s5NOBs+oyx6Fx1MDAwN81cXEndjlx1MDAwN0bJlu9+XsdX4MVR/MBcdTAwMWOnJevB1cFK15hS/Yr3XHSzobRcdTAwMTDMfVBiZ32M73V9fKfZXHUwMDEx7mRcdTAwMTU/jDx/fM5cdTAwMTiPuI11c1x1MDAxMJxN8SOa6kSVjLJiMqi/cnOkMqJVolx1MDAxYz3JdJi94TxcdLCz9KFsn1WkaOlcYmxcdTAwMTkvPX9vmpXq4GWOT9evYGOF6nlcdTAwMWKjO37GJ+qlvy9iPjOcXHUwMDEy7cVcciy6T1+aakp7/1x1MDAxNSNcdTAwMDGytdX8XGL/+d5uynrRdNlh9lx1MDAxYz/lj1x1MDAxN38og9aivNNnOlGuXHUwMDAw+s6DQ/nzZds9NmMtVr2Tx1xm4WjynezHMVx1MDAwMo8mu3dORaNTRMlcXFbgXHUwMDAxyvO+ZeCRLDOc0lx1MDAwN1x1MDAxMCCuXl5OiFx1MDAwMbLpf+vSiv6BrVxyXHUwMDEz1ODz4j2x3V6zv1vegFU4d3DikyYn8jHE/FdcdTAwMDTSbL6ekbv9XHUwMDFkXHUwMDE1iFwiu6h9P9B44pqSgHjaXHUwMDBlhHDQXHUwMDAzuFx1MDAwNTnqveczdedFXHUwMDAypihtUo6CVlE/cVx1MDAxMSXmXG491/fmo1hcdTAwMDbE6v97XHUwMDFkPHRcdTAwMTlg+Jtf7etcZlxi1bvUJVjQcyCQSPua/72/iY5cdTAwMDI7SUqtXFxcdTAwMTFcdTAwMTSjXHUwMDBm2Dp+5YKUaS6d12B5bUxcdTAwMTJcdTAwMTTFcmwxY8p23q3noL3n0nxMe7s9Myh9Jrm3y/5zoVx0XHUwMDAwurKkvrpcdTAwMTZ7LrlDXHK8XHUwMDA32FdTR0jJXHUwMDEzXHUwMDAxkyOK0Fbdj+I/91DW45myMptxglx1MDAxMU3bs1qAKlx1MDAwN6eQn8/kXHUwMDE411xcS4mXVSf+Y1x1MDAxOFx1MDAxNqCEvW1yM+Kt2pvzmLDdnMW/bbaS9eGHQWLblEMzgf0wXHUwMDE14szLdndcdTAwMGLN6F9cIlY7rVfqpctcdTAwMDXfWiPvt7i2xYXqXHUwMDFklJlcdTAwMDF/61lsUt5zc1x1MDAxZieSXHUwMDAyjJlCP/JS+ZlSPOZcdTAwMGKlsJm4oPQyJsVHUY5cIlx1MDAxYptyu1x1MDAxObFWgva6VueshLvA5y/k69FcdTAwMTDulqb1SHrgdLg8jb3ONOXX3f7pXHUwMDA3NVKSXHUwMDBmmDoo9SO4VPnqXHUwMDFmZTm4NSa5zHmTlPgsdCe4VKNcdTAwMWb56Vx1MDAwMMo8XHUwMDA0Klx1MDAxN5eu/pZWy1G4U+5pQtOvvjcsWHn4XHUwMDFijlne6qRbXHUwMDA3TXU/XHUwMDFjvVx1MDAxNMdcdTAwMGXqjlx1MDAxNCg8KoQ0z6vx59LMmys+dzmt/va+SvCLVmaWOZqKpbLe3zS0JFx1MDAwMEOngIgudrTL6UMz+o/mXGI1zpAvd+Xsgsctz8V64aBzYlxcZ8NPqrQk4NlChspAUWqeRqBai/BIp1x1MDAwNZcl39oo2G3ps7Mr4J9BuG1Rp1x1MDAxZVCHtVx1MDAxZLswXHUwMDFlPlx1MDAwYn+V3Fxu0VbuSVDoW/9cdTAwMDH0m6N4r4jYn0enXHUwMDAynpEmmUj/q1x1MDAwN7Y6XHUwMDAwXfpbfFx1MDAxZtFcdTAwMDOZbGxSk+fEXHUwMDEx+vBcdTAwMTBToqlty063t4po0bVcIp1cIvw6tLjSLt5cdTAwMTRBbtp/fYmd+sfDiyhuN4dAcD5j5Mzff/1XOUs+UFt8Vl3mXHUwMDFiSY09K3k07uSYlTaV00JqtcpcdTAwMTU+25Cy/ULl+3hcdTAwMTOurn9cdTAwMDTDMK2V7Vt2/utnUpFrpPuwsDmtxLziLKaj+4ngypBKPNWqmLDA3z1/79B2/3qnyOx0JIpcdTAwMThcdTAwMDVcXIgk1sLqyEOXwqLdslrTdVx1MDAxZH1alPdug1Lorst4zUT5cM08K/k2yWsjNOeY/qXb+DDln6/NtuWXoLSSUp/lWSW189XFZ45BLTZcZrVcdTAwMDRYXHUwMDExtjLOLUTZVlx1MDAxOGdCx+aeXHUwMDFioXPuYuTHrMaPWsMt5SxQpH+vymvMXHUwMDEyXllYI1x1MDAwNfVupdDj8OTxXHUwMDFkNUCQyCHmOuR5yW1cdTAwMTFcdTAwMTBcdTAwMDbOKr3B+iSd3SNcdTAwMWUhYds8LPNv1U2M4avnNeqFRoibXHJn9j+5PGNN0vBLXCJStr3G3/5cdTAwMWM+Ndl/QMGx7ZxBlzijSTFcdTAwMDZmQbnVjWj64ChcdTAwMDf0XHUwMDAz1EdcdTAwMWRhLixd0VxmXVx1MDAxN7p+0FI7XeHWi/zgz7vDje9H1Z0zbN8q8TxcdTAwMWZ+obLqfPHrMaIwr1x1MDAxZU9ccri3XHUwMDBmXHUwMDAwk/h5+zlx1FRcdTAwMTme1a61VqlwWm6i7yTmXGJ3/t218aJcdTAwMDFTaK4kulx1MDAxOeOLMVx1MDAwNVg8P8xcdTAwMTIy0lx1MDAxZUtMVllcXJNTkrkgR9bZUJyUW/3c0viveppZtvVcdTAwMDTx8C5z6OYtXHUwMDE2meXjzumjymVcdTAwMDTQ0ItcdTAwMTGf+OSQqfxO3HPlauc4kFx1MDAxOFx1MDAwZU+N/mZUkUfBoyH3Oc/B2v+XfpK+iJk8TICIJirVXHUwMDE5bGDNT9avj+JcZoBycPG93HhztslcdTAwMDF9a+tL2IZcdTAwMWU2I/+xw1x1MDAwN1wiJkMwymm7V+/4i1xm9KfyKOKNypNn2V78cUxyYMbL67dh8e5+94yVXHUwMDFjXHRyisYp5/T3atDxINVFelxyKeqsvKqilNcuR1x1MDAwYkC6nZS6t9BTPN1cdFx1MDAxOE1WkswucvslXdT2QVx1MDAwZYxGa9sv1IxpMVx1MDAwNDNcdTAwMTJmWfMxat8jiTHr87c5wFx1MDAxZJ4mKMImXHUwMDAyKtBcdTAwMTbbRLWwI8L21Fx0kDndgYPe+6rS1EOGXFyM+Z1s76zjfMebJ3ec1dVcdTAwMTgkg/ib3+tcdTAwMTNKXHUwMDBl+HRcdTAwMDPP7vJcdTAwMDVcdTAwMTfEQ6TgvjDjpHKGyqpuOH8pa04lXHUwMDA1qKRHW9hcXKswy1Ou8a1cdTAwMDFQXHRcXKFZVVx1MDAwZXBI98Y33YhbxyyPr5GQP1x1MDAxZFSm7lx1MDAxNN/0XHUwMDA0xeNbt1x1MDAwMnP2sjzLvET0XHUwMDEx+EZcdTAwMDZujtUzkJu8VDWDXHUwMDExl6qUTojpXHUwMDE5tFx1MDAwNp4xzZBcdCV+I49cdTAwMTb3/M+rXHUwMDE5ubVV6OtV1+DbxkDkI1x083ic6ZtcdTAwMTOPXdcvtVlcdTAwMWR8YCWrVVx1MDAwNdi3/3uHXHUwMDEy702ie9OLTTus8uWT1Vx1MDAxN7D31Fx1MDAwN49/kTWvXHUwMDAyiyRHqJZ8cLNaYIBcYlx1MDAxYVbk3YLZxkvtayO2T5GJm0qMgmzHXHUwMDE42bP6Y2fKXCKz/2Xtldr5qamDXVwi1njeeZLwJDb3sbfbP1h2KF1cYn+xxo7L75ek6vs6vGidNuGbg1x1MDAwMFx1MDAwM4w7ap9MXHUwMDFlXHUwMDAwgCTqNL3ZrqCy/LfwR2aUQCjKiUtcdTAwMDfkXHUwMDE1wM7At2Z90uaafoPRXHUwMDBiXHS/YVx1MDAxZSRE2DxkXHUwMDAw2TqxXHUwMDFlljDEgzpcXFqxXHUwMDE1WcHH+NBIXHUwMDA08XFcYo5Qj6urfdvWS0GlOJdcdTAwMDJmdttcdTAwMWU+/Fx1MDAwZWRcdTAwMWFcYvtxqmcuXHUwMDFhT1x1MDAxMlxiQMNcdTAwMDCoVy1zTeWTXHUwMDAzXHUwMDExm8ZcdEZsuideXHUwMDAzXCK+nz6m8lXH4u35JaY8VI7bqJjRc5W4dJfxKCh6v3Y9kPaX0Cr0bi+SXVx1MDAxN+F+KCpVWqo/p1mrLOUxe8W7tTbmrnr10UtcdTAwMTGz+76MufnfTFx1MDAxMUQxoHswLntccszgl+qAd7/JrFx1MDAwNjlzXFwtXGKr5nCQsuxMxH1hl9hmSql3Qlx1MDAxOVx1MDAwMU9Jxf1EwerfVSngj9Kmu1FMZ//1XHUwMDFkxazDXHTdpN7Ag2ZcdTAwMDBcdTAwMWa4XHUwMDA1T6gvXGJ9XHUwMDFhcest+EGHW+BcdTAwMGbRj1xcj2qqdEHNWX9trtv/9lx1MDAwZqxE/73v/q+n03TGLVx1MDAxMPCdbDDJd5xHfiVLq0LAN1x0QDpcdTAwMWazanmE/70zXHUwMDExXHUwMDBlcvO3rlx1MDAxOLg71TGbOkpSl1s54VK69reI7u2L185USVx1MDAxYmjNSfpBXHUwMDAx61L53lx1MDAwMfvDgFx1MDAwM+RcdTAwMGWPquxX1aQ0vFx1MDAxZOUkblGbr1x1MDAxZFx1MDAxMajWm5Ntv/JW2nRiNGZ73Fxculx1MDAwNW5cdTAwMTeGtmxcdTAwMTU524LNoFxyaouAb25cdTAwMWbGnLVZQ1vlUjnqU34xl3wqmMDKwYE9KrlcdTAwMDFcbkm8dFx1MDAwMDNffD5TqZ5sXfpbQzZyeJdO3lx1MDAxMCSSb8t+hplcclxyWcJmKfDMdGIv9/1cdTAwMDdIKMXNw7BnQ1x1MDAwMq/epMzhql/fqni0JWY964i/XHUwMDExXHUwMDA35F9F/9Ywvlx1MDAxMfZDkkYqXCKM6Vx1MDAwZqosJT7ZXCLCf+31gbp+ijBNtFx1MDAwNVx1MDAxNVx1MDAxY9FddmNcYrhcdTAwMDQ3+d95+PTli6vDzKBOXHUwMDAwqLpcdTAwMGatXGIsNPtWSYtcdTAwMGKD0MS08lx1MDAwZpvqXHUwMDAw0mZcdTAwMTjFSMYhkE01XHUwMDEzmy1YXHUwMDBmKVxuQFx1MDAwMFgq9+uKXHUwMDE1XHUwMDA1yo6HaVVaQJnFXHUwMDA2dV7w8lx1MDAxMpOKXHUwMDE26UHWSlV1ofOeVo5ar/JsVXjaqNeHV1xmoHxcdTAwMDLkINqW4Nr4yiZfkW2IvmJ73r5cdTAwMDeLXHUwMDExK1x1MDAwZUE679NcdTAwMGKQv11Wolx1MDAwMG1cdTAwMTnF6lx1MDAxMPRcdTAwMTN+XHUwMDAzUkgnoFWTnV/xXXRcdTAwMDGxc6JOq8ImYL/BkeTgclx1MDAxN1xmciRcdTAwMDVcXHiJT/7splx1MDAwN/y/53NcdTAwMDZkxtm5ZH3291x1MDAxODa3h1x1MDAwYtqJ7ztcdTAwMDK0V1xukjhVZttcdTAwMTTF8LViNTLfaFx1MDAxZU5jlVxm42Nwr1x1MDAxNsrVpupIiTQ+iud+/PrNwn12iK5eXHUwMDE0L3EoyifET3Tlt1x1MDAxYUlkht3Dzf7PMflXa6XIXGagTlx1MDAwMCEosF6wc/Wn3kFdtanT+t92n6BcdTAwMWVGoSy9eptaJpUm0U3m7oR1J6nEtrZWK9FcdTAwMDVTXHUwMDEzcKb6pd5zdlTyZl96sVx1MDAxZV3HXHUwMDFlgFx0Z1x1MDAwZdRT+Fx1MDAxON5U3X3igGaw7997OTGXfk2bXHUwMDE1fy0nXlx1MDAxMVx1MDAwMLNa2dxgtiTKzNtxz7/ps5Aoz399kdnY3PZcdTAwMTeqrzxf+8A/5dXTUs9cdTAwMTB9nbaRWO76O+VcdTAwMTL9VsbaeW95Joyya7s7XFxL6TVcdTAwMTRVLk5VcTE/yKdcdTAwMWF+Vs4hVGCTJ2D9NVNremCV1jTuoeZoZW1+XCKmqKpcdTAwMDR9/L56N5slXHUwMDBiVMKWXHUwMDEzx1x1MDAwMevwcoQ7W49cdTAwMTYtXHUwMDEyVIY6z/p/XHUwMDFiIPqvSdy+8YpcdTAwMDRF9ChL+lxmXHUwMDA27s3iTn/GUFx1MDAxYlCWnFx1MDAxMCgnXHUwMDE0XCKYXHUwMDAy6kNcdTAwMTZjgixcdTAwMTXKXHUwMDA13Lv4XGZcdTAwMWH3rMt1b9z3XHUwMDFl3Fx1MDAxMn96KsVXulx1MDAwNYnj37tcdTAwMDY5Mskvm3dcbkRXjzIl4IUwpjs201x1MDAxY/Zq9FNcYoPvXHUwMDFkPrx42l/pOeflMkZNP98wd3qi8m2c1cZTqJTnJo8vcStd28JnlVx1MDAwYm7FjW/NgPJGuLhcdTAwMDWLechcdTAwMDZcdTAwMGKynZr2rbvg9rnhkkHvNidySlx1MDAwNFx1MDAxNCyjbjpoSqGsJSiX/Gy0XG5k1HFF8e7FlHrYJHnl/9lcdTAwMTdcXO7CQ4lFVFx1MDAwZuv4cYMtlVxyijxcdTAwMDCbLdFnbUE9tPm2I1x0gpr30mXApVx1MDAxNnfAYXlLgvOR0EZw8GDnh9ffwZJcIvN4uFAr1Vx1MDAxN1x1MDAwMt6tkLe5/krVhKTWnP4g2sNM69Zkq1wiWI6o51x1MDAwNOW3uNF1kl626Mr+b+10plx1MDAxZofaalx1MDAwMVx1MDAwZn6syYs4jy5cdTAwMDJWPds8j6DabczWwFxcjcLg5378v7NUStVXXHUwMDFjwW33XHUwMDBm3Z5cYtqYXHUwMDA1XCJrbDdDn6nT2aG+WUVcdTAwMTeejS/wP6hNXHUwMDE1ulx1MDAwMlx1MDAwMt5cdTAwMTQjqYhcdTAwMDRcdTAwMTZQtMrqW3+bXHUwMDE50s9cXDiSjcaHXHRu/YU+otZcdTAwMWHfrVm8XHUwMDFi4Vn+ysZcdNPma9eF4ppcdTAwMTNcZrhOOWL6toi0anpcdMlLmfs6XGKmNjyFXkvporHeiHVcdDI8olx1MDAxMl2tVEIyd9T5L81dgVx1MDAxZcNCXHUwMDA3ksx8UaHZLtDTUo/Eq+ZLgT9NRdZcXO93zNHiQOEv57smo+bm0pDMoDiqMWOhhzGscEVcdTAwMWG9QqdcdTAwMTEn1qjyWTY676WtSCjHXHUwMDFlTvigsVx1MDAxMG5PpPr6priLXHUwMDAz41tcIq6vXHI2LH3tXHUwMDA2XHUwMDAyNlx1MDAwZU1J7zZFayrcb/+6sLlcdTAwMGLTSGFccpLf6bv3gkvao0s1X/bVspKKcnu1pGRbXHUwMDEydSRcdTAwMTmmgIdcdTAwMWN+pcz67lx1MDAxMVxux1x1MDAxZp3xXHUwMDFmrtSSqLN937RcdTAwMDCZYVx1MDAxMHC+XHUwMDE3XHUwMDEziFx1MDAxZvjD5m+t8Fx1MDAwYpzEwlx0YYkq7/iVaHXldeNiPOlZct215jckP1x1MDAxZILjuu6qLCU+Ye1M3npql19xTPnq5vHyLoa8hulccjZdRd00XHUwMDAyvKJcIlx1MDAwMF8+b6BU2SHxjJlvXHUwMDBm6YFf9uPZnn5cdTAwMTVQ56dLba5QXHUwMDE1UFx1MDAxZZ040XRcZq+ieq93w9W3lCGLs0FcdTAwMDNLXHJyjz5cdTAwMTRGXHUwMDAzPOhQXHUwMDE23rRBm1x1MDAxND+c36QtiMw52Vx1MDAwNS3W0vmRR75iSNa73PrWN1x1MDAxNv+yvfJQ7KUzm1x1MDAwYilH5ZLLSyG19/9yjlx1MDAxNki+b7VcdTAwMDBcdTAwMTLx3pvxx1x1MDAxNXWJXHUwMDE4WcB0vd2pOVx1MDAwNVx1MDAwMpFcdTAwMDGSXHUwMDFlXHUwMDEwXHUwMDE3isVN0NvoipNmfaXapn9+XpGqL1wigoxxW+wpSmM11LZcdTAwMDc9yWtO9aPGlr9tZr1O/fXH2Ie+vXBDUFx1MDAxOfKHozhXt8a8vImsM5LtmHEow8/pPC/7u1x1MDAxZPUumz/RXHUwMDE0vnF0yjZEj6uNn0tcdTAwMWL6XHUwMDFjh4qD/WpcdTAwMGWprGvhKJxcdTAwMTeijK+XXHUwMDE4+E+unbG/vSyPXHUwMDAwPy/frLC/c9n2uSmwXFx5z7Zz+1x1MDAwZcJR0lFcdTAwMTJVbi5cYl20zSwwXHUwMDE2cZg6L5xvUd7o/rS3sKvnw8rCXHUwMDE3Qv64TzuwVmAt9Fx1MDAxM5ptcFxim1x1MDAxYTDg9/NMpFx1MDAxZVbGXHUwMDE2kmlgzPGCpWIl/r+9XHUwMDAw1/aSsV7uOVx1MDAxZsdldsda2Vx1MDAxN6u/fT2XzrZcIpCwslx1MDAxOVx1MDAxNlx1MDAxOHNcZlC+cdeeIDpcdTAwMDJt+UZcblx1MDAxMVx1MDAxZu97QJdcXDlZ7FlcdTAwMDflL1x1MDAxM0Pcfs+p9Fx1MDAxZdu6OMdEQTHXeE20XHUwMDFi4LpcdTAwMWPcnFBJvvT6zIg7v32AXHSSb9mY6U37RzDorzaRXHUwMDAyw9IkiYI9r+xTJixr9fn8hrfP5r+W/viU11dvSFx1MDAwM7ODZCj47zW43sKDypfyruZRLmaeXHUwMDE3rL+Ph65iuveIXHUwMDFlMyxuS0c95979Oz9jijzf5MuWw9h1XHUwMDEyJjlcdTAwMGbnqNkyJX/tj/aoW8DsTjvTV6bO5jv9XHUwMDAwflx1MDAxNqJ5XHUwMDFhn36gRXp41KjzTp9WcTTDXHUwMDBisKi2sCs713smXHUwMDBlOaHrO/bddYy3tVx1MDAxZfwtv060eilcdTAwMDbsXHQsv0ZU82M0kbq5n1x1MDAwNSGEs0htyNhGtcxcImb+Tl7PyDK2U19DKClacqCF8+dP75knevrKrPize2nr/5jfsejDwe7gYNO/rcYq4KfM4YVcdTAwMWNXKZHdLTplXHUwMDE2sUdMVHi5U161XHUwMDFj/Frp3/5RmnHurM0hTs2f0OhcYud1cfR1ND5DYsCqlCEpXHUwMDFlMOTE3Z/HLuk0UbvjWfg9TPrOukf0t3zv0XI0JT1bayYh+1xyXVx1MDAxZfNCciXlXHUwMDEwM26Mv8b+7LFW5U3nV4xxX0kus3+Lbl5t76CwJKFcdTAwMDKSJDnPXCLQXGaEkeArpeBeXG5/44Hvo55g3/j3J9EyRrNcdTAwMDJ/PIZku2dcdTAwMDU5XHUwMDBipMOnMKt+lXwzYvLGXHUwMDBmXHUwMDEySbumXGYxXHUwMDEzk1lZf+bdh8oxrpZcdTAwMTi26i3He8FvXHKrK8FOOytccnyzXHUwMDFmalx1MDAxZX5sooIxJTDiO1x1MDAwYof98/rytVxc/U/t+b+MtbwzgKG7hlLUXG6K8LvTpGVcdTAwMDbU3zus+XHAQTRcdTAwMTbheT6BMdfRvOuQXHRcXFJ7rT9Qd70wW+g8LmO69eThw7qVXHUwMDFihJeuT3dcdTAwMTOVribcdvnttV9cdTAwMTRcdTAwMGLoOr2dpoopkyNRo5iCIMTVPGRbO3Uh1b5cbsnaXHUwMDE3/y2DtXVS/Ong7Fx1MDAxZvvCa6xcbn5cdTAwMDXLPDTUS4exXjYuXHUwMDE4PjQmy1x1MDAwMSVajEa1xWawglxcgtlGwSDCVNVYsYSsN4e+ilx1MDAxOWy5RemTdywpbdV/80dcdTAwMWNn3aVcdTAwMTOk96FUq4SBXCJr1e+0PftdOEy1JTcvqo5Ydmdz8uJgRmtqb0z7yXbAYOn0oYl0u489Nlx0pN9jfmFZqiiylFx1MDAwNJ2gopTyweaDsaPTrYNcYlx1MDAwYjRbPrv9sX/E2GvVMbFtXHUwMDFiXHUwMDBlzDvpXHUwMDExyTfNXHKqp02FXHUwMDAz3nlGVtJd1CWWlZuYNVx1MDAwYvGA/dax7/S4NHXoKS1/v1x1MDAwZc000ypfL6JP+DL51+fgbYCMrDpyfkhlXHS9XHUwMDFlqlrxczvP0/6lcZD7POtcdTAwMWOsfKO/XHUwMDAw2sZw+XpcdTAwMDH2qTQzIabAXHUwMDE51odQachcIudJ9LdVIbx+jM/dRGrVROx1wy40XHUwMDE3Nft1b99uzVUnrWmP3o+eKX/Tm1x1MDAxY3K2/btXhc9pVvsxd93Lflx1MDAwZuk7+aSvXHUwMDAyesPml1x06H38996z5vH2l8P7f/qwgWvuJ1x1MDAwN1x1MDAwZclcXFpcdTAwMDdF/PVGfSBcdTAwMTiDhpRcdTAwMTnpi1bli/63tvm5Otp37lxyylx1MDAwNCSMLKs58ZryNv5vIchsu296JPZcdTAwMGXGPcZ3r1x1MDAxZZ1cdTAwMDHj6omU1zX6ZPTXwKVcdTAwMTIjxN+j71x1MDAwNlx1MDAxN1BcdTAwMWaZ+7Ovqz/+0vkqXHUwMDFmkFx1MDAwM1x1MDAxNcTV7+iw/FhW8Vx1MDAxMHqHa+JPjD1u++ldVDOo61qfVOlukaLLs+w1Z8vOr99cdTAwMDZIXHUwMDAwQVx1MDAwMTryX+sxplx1MDAwZWFMK5XBmsXcXZxPdVJuwjD9/njgyVx1MDAwMo3Ruye/XHRtKtAqXHUwMDFiWf+3XHUwMDE2NHdgTGhV5Vx1MDAwNlxc9Vx1MDAwZX/nlEdf2yN1oYUx8lx1MDAxMnJtllx1MDAxMCp9vvWafFHWvOCyrGLm6+UoObeCXHUwMDExLd6cY47krnhFS1upXUwjptE7ydpmwr4pXHUwMDE59Vx1MDAwYt98XHUwMDFm2t9cdTAwMWH66I9ZRsGQulx1MDAxN5gg51h/NXXv9ZbUXHUwMDA2OmhadEs8qkLq2iea9/vAPt39bGfDuV/hUkO8YYSU1Vp8XHUwMDBm9Fky2Mv7zGt42PJNPN67QXp6z6FcdTAwMWagRprO0KjlKlwil/KB4KnXXHLH4/lWWoIoXHUwMDAyMr51JZEw32/acXK980LqZK7QJtFcdTAwMDdcXPbDr+FLx+bbs7teqKdcYv95/miD521BXHSbOIZiXHUwMDE29usr/DVpKfCSQLwomf17j3hcXJtoSm7rU0+87Zom/dxCXHSs8PBcdTAwMWI/8musXHUwMDA1jkM4wy46nKD50ixBXHUwMDFkxHnpXZNcdTAwMTV4Iyk7//U7YXVpn1KIdEDjjdffzPn173N6rKBcdTAwMDRJg1x1MDAwNv560LpcIuRcdTAwMTXsSnAhXHUwMDE3pVxmJ1NX+L1bQCP01LnSv3fh7fBqXHUwMDBmv3Xp1Vx1MDAwMFxyZlx1MDAwM2m2XHUwMDAw/FlhkaMvuM3D8NxcdTAwMWSfXG5IXHUwMDFk31szTF6Wp9Kf3Uv+NluJ/DszxLGRXHUwMDE28qzAi+jzh3HF71e9Scn5QO4riMr2K+rQXHJRNFtfXHUwMDE2KjtxeE5IklBEOJEmvIlT2FLGXHUwMDA1RrZW7VxyZDb0Llx1MDAxYlx1MDAxMO1KjJ8uv8TZ+ySkgUZ/qb5eVGZpiUGFszErXHUwMDFmK4rQXHUwMDE3uYnooFx1MDAxMC1cdTAwMGXm9vlk1udfS5u6XHUwMDE00Vx1MDAxZfznnIWFTix5XHUwMDAzQ1x1MDAxY3bLQ1x1MDAxNuS7i9lcdTAwMWGBxGnTS1x1MDAxNVx1MDAwNdB2Mmh9LLJkcFx1MDAxY6bo/Vxcp89LXHUwMDE2ce37XGLZQ1x1MDAxNVx1MDAwNpVcdTAwMDSg5aRcdTAwMGb7c3hojuhUMvRcdTAwMGL4xihcdTAwMDCavoAkzL4+TnlhvJ8z8rt+7If9vDKCcq9925xcYpG+YYEhSqx6z1/yRdFeqVtnXHUwMDA2L1x1MDAwMdp5XHUwMDBi1Vx1MDAxNKVcdTAwMTWwNkIud2KyXHUwMDE441x1MDAwNb74us7b+krW2kNfvCeHN7ef/YxNXHUwMDBmXHUwMDE5gy9cdTAwMWbnx/MoNcOBXG48XHUwMDBibzeGRUfTp1SyTvZcdTAwMDdzTPIhN/69XFx0xEV05Vx1MDAwM2ySXHRcdTAwMTKigdqiPprbXHJaqC3Yw5Sl9G5fzlx1MDAwMHGUglx1MDAxY7dpWjav0LqWI1xiW4vu7Dz3XCJQYcG26Nv1PHvoWbmtXHUwMDAxT/7TXHInXHUwMDAwTcmeXHUwMDFkYllcYoLYNc3TysLzL6Dazrvr+Fxi1n8+SqZWnCnzzdShRHBcdTAwMWYxN7uHWlx1MDAwNzPSeXmFu1pz6Vx1MDAxNi88uNIkg1x1MDAxMON0S83PuHm7lHdhpEw+nqWCsZf9fqfGXHJLfIWmi3ewdvPlvK/2bpheSrz4a0L/XHUwMDBinKZ5f5JvKjx9cW+VXG6YOXhiYJqFv89m81x1MDAxMPmg7CyzUNVR+HWAwlxyOdK5Uy5lmIN1R/CJm47kM9wkm+lGxmTA/UHP5uFrTehxalx1MDAxM3PT/ann33AxXHUwMDBlio+R/uLVmoZu22ZgXG6Ts1x1MDAxYX5cdTAwMThMio2oM4AnjSDZnnHYn1wiIcDxSSNaYppB59ngdVmxMYyaf1x1MDAwNXZ9drPt0Vx1MDAxYql62ZwlwiZBd1x1MDAwYs2jr62X3GVNwu9cdTAwMWFHQInBiEVQn1x1MDAxObjp1VFK7US4RFx1MDAxN5d91+dcdTAwMTBcdTAwMGKC4EWiPzR8nF66WZRcdTAwMDJ96zFe9lhgPtNhXsOr5ra00vNHtJn8xFxmW6mCJPGPz1x1MDAwM1XqQoL3JnLUXFxiolxu3iPIMFx1MDAxYromVXZcdTAwMDQyoCY27kdsxZftXHUwMDEyVL/7d34y8IJ49r2cXZXaXGLkXHUwMDEywdhMmuqmXHUwMDAxR/63j1Ox1TNcdTAwMGZuXHUwMDFm/lx1MDAxYtzJYyCgZKlcdTAwMTZ9srJMsTn47N7tXCKsRNHwL+4g1dm5XHUwMDE5+mBcdTAwMDZAXHUwMDA04Fx1MDAxMVx1MDAwNULsVeHv3lx1MDAxNfSUZWevq2tR+6O5woqQtTpcbvl8XGLkZ/8oXHUwMDA1ylVmXHUwMDE2pOlzLFx1MDAxZeUn5Cny4ZfIc3RMeVx1MDAxMFx1MDAxM5iY3oPjxL/T+mrUw4Hy0ErDcmNvmf4zRuBnR/1YW/1h2d3OKFx1MDAxMTW+r0KT4lx1MDAxN0GhVi+tOo5cdTAwMWRKJKeewCnSlSqtNnOKYrqMWFx1MDAxMCe+QKpHJDpcZubXW7Cw1ZJxi0W6N9R4YVx1MDAwYoCAlVxi35Vy/ZVcdTAwMTZJSs9t1PqVjnIvV0LahVxmyEh7W2irpU1ArjZOXHUwMDEwXHUwMDA1NHBcdTAwMWLIXHUwMDA0XHUwMDFin0UmplO79avlga6UXHUwMDExXHUwMDE0SnfFIMSk8sq2XHUwMDFlfzBcdTAwMDJv6kFMfSxcdTAwMTJ9X2ucXGZXO430y5df/vg1KOHn697v5++/dyWOQOEjRFx1MDAwNMXrpTxcdTAwMThWXqFcdTAwMWScWzg6wlx1MDAxZJeUJuU034FcXHJcZvncU+3BiDeSV4f/MoHAO6z1OFYjzFaVKOLzeDCyPmehXHUwMDEy+P3Qj6nAu+FpNVx1MDAwM1x1MDAwNFb7fEJuxaF32GLWiPxcIrI3f0PZXFyh8VTGxFnav3aY8cQhaptHglfyPv2Pv3Y2XHUwMDFkPTaPmlx1MDAxOM7Dtb+/p4JR9d7IM3nZwl9QVW5cdTAwMGbu6W/dz0MuXdn8QS/1lVx1MDAxMzFPfVc/XHUwMDA0ntSDrWzUckbVt1x1MDAxMqFcdTAwMDPRPz0q++s/XHUwMDE2fGy0kVx1MDAwN4Rm1W+Ncl1mj9SXwcNnIVx1MDAxNcyp3qf4W/qTXHUwMDAxSHaQZe+86F/RXHUwMDAwlXfpXHUwMDFj5Fx1MDAwNIhH8J2FxFx1MDAxN1+tslx1MDAwMVx1MDAwM35GXHUwMDAyW8lhcVx1MDAxMC3En85s+WQr51FAliSQOVx1MDAwMVCwXHTgs8S4OVHltj9cdTAwMGI+gfHQOTj4/KJ88No9mClsXHUwMDA0rE+ApFx1MDAxNn9BnX9cdTAwMDKx5XlcdTAwMWLUs8g4P2c4XHUwMDBlXHUwMDA1fO86XFytXrDrcU8k9vfnXHUwMDEz0Fx1MDAwMt7mgVn4nca+stGY8ltaXHUwMDAxOlKXzN1Hq1VcdTAwMDJcciyuqGWykelHWbWv5+83r9/pprxcdTAwMTfzw9BnSuQlPlx1MDAwNL6GhVx1MDAxNFO1aWj7citlkyiXYlx1MDAwYlx1MDAwN5r0vrZcdTAwMTlfOFwiYZXplq3AuNA50OclnVx1MDAxMecqsvRcdTAwMWLeXHUwMDFl8U77XHUwMDEyO+KVXHUwMDA294xcdTAwMDGl0kbBO4OE9GatSMiJ5Vx1MDAwZcmng6xoZ6ZcdTAwMDNJ6Oh5XHUwMDA2yfczXHUwMDBihS8+W3VrlVxmQKWN/31WzstcZlx1MDAxZlpsZN1cdTAwMDSZSKJEt3t92OwpqGZcbm33Llx1MDAwMnRlXHUwMDFlU9I3fSeYMmZNgZyTVC2tmjZrlfvq+8dCZaDj9PZPq+z8YVx1MDAwN0PqkN+/uSdcdTAwMTDubUDn2lc0QbjEx5VpbFqyY5FcdCaP6Xk8RvC5YdZzjPhtXHUwMDAy8/1DTrVFcXdcdTAwMTE971xmWZad+d+bXGaj741cdTAwMWRl015BTilpXHL+9lwi88KOO7ox/LJYlkChZt/Pof71sVxuMFxubVx1MDAxYUfYwOulXHUwMDFmMSBcdTAwMDYmOls+XHUwMDEyvoLcXHUwMDFjNKqRXHUwMDExiPBTWG75eMzcTnNcdTAwMTKxrkGrwVx1MDAxMKzH97zst0xU9e9cdTAwMTjCqk9BXHUwMDEzis9fM5OJ9V7dalx1MDAxOOGwzPDynCZG5K5SLkJwrDZwSNVmeVx1MDAwNtJaXHUwMDEyOknMRWVcYnKT0jpCyWGMaFx1MDAwZmJcdTAwMDA2IzjSXGLr/OssXFzfXHUwMDBlPf3BTMhKXHUwMDA3p6U5WaOpXHKZSO5vlOXulDXmrEI7klx1MDAwMqbvxKegXHUwMDAw7bbDz4lhStxA1Fx1MDAxNOblplx1MDAxM/5cdTAwMTB/ld1cIs7XRH5pZlx1MDAwN2+8/c96XFyCv1x1MDAwM6JcdTAwMDWgXHUwMDEwp6gqgjdcdTAwMTHyak/VXHUwMDEyUEBcdTAwMGLxyfP/JlLFx1x1MDAwYu1gbkFSyKfy+kCd8VZSXHJfLeTPf+uKWlx1MDAxOCvj/dNsiS9cdTAwMGK/wT6HXHUwMDBlQ1xmemJcXFx1MDAwNoOvaKV3OOT962T3Qi+mOdnst5/YXG6rjllcdTAwMTe6Y7VEZJFDqlx0bDBcdTAwMTB3h45/PmrW6r9cdTAwMWU8L9JvYV6WXHUwMDE1Le49XHUwMDE2sCrKctTnR3GNmfjC2/9CXHUwMDBmZb1pXHUwMDA0+WkzaVx1MDAwMSFDcUJu0tpopbwk3VT2Nd9qz2NcdTAwMWRT74rT8lxiZJFRZ5exZYHR3zpRkWD9a+KMzm5ur+lcdTAwMDZcdTAwMTnI5y1cdTAwMGVZhP9Fa/599rHlXHUwMDE2JM/Zvrb6XFyu84dbgCWFT0dIr9Y8xqjdp0er6D/I5DZcdTAwMDO4v/6zm8tcdTAwMDA66HJgbLi4XHUwMDE5g1f6JOWe0dNmh6/LXGKocvft8ujCv7pwyGxBsWfBcvlcIjHb5Fx1MDAxYnXEiPpB9Fx1MDAwN0m+QeFcdTAwMDTP/UNcdTAwMWWB3zmuuULzO6++McWFXHUwMDAzrqJF3SXmLGlrf1dnW8mpjtxoqWjdXHUwMDE2WDncVNT2rX9UXHUwMDE4hKGPYWqFW1xi0sLmtrtcdTAwMDByPNJPSb8lXHUwMDEwXHTka1x1MDAxY/88RMA9bKpqj2tWsd+/3lx1MDAxYsaJcseybucrPUPVl9zuXHUwMDAxXHUwMDE0/JvmfJlcdTAwMWOXXHUwMDA1i0yFeaynulx1MDAwMvOw0r9cXNOqn5TF3Y66XHUwMDFlLldatlx1MDAxZsY7Iank42IkoDNcdTAwMGVV7a0mUFx1MDAxZj5cIpfQUqTRXFybhdczoyg9W4Gda/du7uRcdTAwMDCaj5iyx65UVbWGs1x1MDAwN1x1MDAxN1x1MDAxYbfPcVxmjvmP8Ui9sGnSd7lcdTAwMDRqxZbWJvC6/q1cdTAwMTXBe/Vt5pawQtk4XHUwMDAzrdCXqdTyimf2XaesiMxf/PhftDDMXdDaMiZfbaQ/jtJMpmbKXHUwMDE47fxcdTAwMDCHUabHoWDoR5g04zfpw1x1MDAwMEToR4N7XHUwMDAxw0CvMl6N0Sr01paaw+Ag/Fx1MDAwNZC/Xodr2FH831x1MDAwMeivvyVBjyP1QdVUXHUwMDEzXHUwMDAy0b7LRyu5XHUwMDA1pPd06eXNXHUwMDAw6efZXHUwMDFmW5eRaJ2UMPE2dfFcdTAwMTX4WVx1MDAxZapcdTAwMDJcdTAwMGXgn5OcRlx1MDAwZUtcdPlcdTAwMDRVN4JzIWtcdTAwMThDL4rzcYH4XWa8cTu7SGgyXHUwMDA16ulBulDPoO5cdTAwMDTvu218MGOJ/vCBXHUwMDA0TYOrfmmod/EvPZ/MXHUwMDE16WG2jceE6mVcdTAwMWLnz+13S3uXXHUwMDE2XHUwMDEwXFxPTna/XHUwMDBmZoY8oyqlciro32t0sv+0ia/I4/BcdTAwMTbOXHUwMDE3ajtcdTAwMTTq9qn6bFx1MDAxZGBcdTAwMDWRbHxfXHUwMDFlyelcdTAwMDGPaGpwcpk8XGLBouPi4yPWbmRqXHUwMDE4YPVjXHUwMDAyN1x1MDAwM1x1MDAwN8lcdTAwMDFCXHUwMDE4PquD+rqfQknu7Fx1MDAxMphcdTAwMWJ/wm/L1N9Q4NOK+WK/3+f8XHUwMDFmOfl/8/TMxPZ4+kKJXqHzRMjJhFxc9eJFXHUwMDAwUW+clTCToLlayWWhNdN2XHUwMDE5T1xihbCigVx0puNcdTAwMWNJz/HbVqU2QlP4XHUwMDAw/n9vtU9tQ1x1MDAwYoYs4WDGTTlmvVx1MDAxN9T2aV/G+kOai+cqMtqye/tcdTAwMDKCv7y6s9KhXHUwMDA0xIX19n2MgLebto+Vg6NcdF3qutOXS1xcXHUwMDE10v3sdU7xrk55pUrQwYu3XHUwMDFmoEDbd2Z0XHSZJSx0xs49XHUwMDA0XZ7+r0jZkoW+XHUwMDE1Ml31hb7EJ2VcdTAwMTWlklxyIFx1MDAxZPU6XHUwMDEwKDGmZPC/zulwQFDyv3c8e1x1MDAwYnlcdTAwMTlqXHUwMDExXHUwMDAyNXr8SKe7N9FcXL02YEqSUNxcXEXo1Hj6QcZ9gEbPXyz6a+f6X89cdTAwMTN+9vKVV6u24sFccpYkXHUwMDA0ceysnI3cPl/W+pWLKenA+9py7Fx0XrU1a7/7Mym/ojLmybbautN0QimqXHUwMDE25Ja9UVx1MDAxZGa3lzRcdTAwMDf0avoqwmCTXHUwMDE2a5VcdTAwMDTrPzNcdTAwMTItYFx1MDAwNiDPXHUwMDFiXHUwMDAx/O7hK++//W1vXG64M/0jvVx1MDAwM7w3vp1v6Ji/XHUwMDEzriFcdTAwMWFcdTAwMDdcdTAwMGK6ZlZcdTAwMGV5Js3+nCktoSiR8X6c5Fx1MDAwZfLL0GFOrFZcdTAwMGLY4qelQVRS6VwiXHUwMDBlbW54XYba7nEykMbZzVx1MDAwZtrJpCZnXHUwMDEwjo9cIio21dyFNprvVypcdFZ6u5WrmnVUtX4nXHRY7GuOavq3+KXppV/De1x1MDAwNFrKdpfZ79DKfP6WXHUwMDE1uHYroOUvXGYx8HZz4beDX2hcdTAwMTAsI1x1MDAwMvrytc2VulDgnq5JyUB1n3mLXHUwMDAzmXeAxITxRVPTM+W1TPi2PDtEaH9Njnu4i7f/xFhFWOCLNuVaZTt3f+fSUY0vNV/2+MTQg9V8KUlPL3ydWE9sl1x1MDAxYjJldsJcdTAwMTKinInrnlx1MDAxZv7p6Tj0nJdaUlx1MDAxNFxy7yhcdTAwMDZ711x0XHSwgPTJTytePbz+Wj/CKqXMyt5Y+b/xeypvT1x1MDAxZnhz7u6uXG5cdTAwMDQn8IekXHUwMDAw6b/3I2aO5Fx1MDAxZvR7LMdTS7/I9qQlg3gsv0lWxHZcdTAwMTWNSL10XHUwMDFk/bSWuKeD+zpfo3whryNafbEjsjhcdTAwMTRATaJ/vXvxfG64arBcdTAwMGJpXHUwMDBmXHUwMDA3XHUwMDA0+ohZ3SCM13FigWe3vywpNOOToyWKylx1MDAxYuv5MJOQXHUwMDEyr86b7L3EU8FcdTAwMTCX/Fx1MDAxOT1cdTAwMWWLm/BvdHI9MFx1MDAwNp3NW/Qy9fmbZVx1MDAxZmP7STVTkHRonY21+TtTbO6edJXxM5CJ3D7Yj5hcdTAwMDSpPDWee17shi3U1m4wPtDDkbyb+NjuYPVKzDdcdTAwMDSVWkVMwKd4nLNIyPJJQIPrPPF6XHUwMDA1+/OKT9xcdTAwMWbhs1xi185cdTAwMGar8L7nXHUwMDE3oulf7Fx1MDAxMK6/c63sQndcdTAwMTFqiFx1MDAxNJNcdTAwMDLr+ylt9z9vczV6XCKnu9dcdTAwMTJcdTAwMDSLqNd3vnQqXHUwMDA2XHUwMDA1ZsPqN1x1MDAxOfakgYZFSydF3SFFMzUyw2HBXHUwMDFmMYrlSrlcdTAwMGbT93KjXHUwMDA2r1wi9Dl+X6PafY/cfMeI8jZxRFx1MDAwZdJcclTthy2qp2hcIqWnQYa9QeOLTOadw5tFoOc7eyxccuOVXHUwMDFh03hcdTAwMWRHMN330+9cdTAwMWb1welq/LTCJb3Cwv1IbmVE2lx1MDAxZj+601wil9LAf2JcdTAwMWQyllx1MDAxNqm/T/6fOlx1MDAwMozi2+q5XHUwMDBm+C/0nN+nkn1O4sJEV1FcdTAwMWUohEc9Ld+wflx1MDAxYaX8KGZ1gshcdTAwMThDmG9/XGZZjDZuvoB+fPzS+yai89UtrZtcdTAwMDeBl/q5NyUrgEChTNBQfC7XXljNU1x1MDAwZVx1MDAwM6SHdXHth9PuXFx6/M7xWbZjIYL3+0nRZtBcdTAwMDOPlOSDVTpPbY43WlaAr5mKXHUwMDAyy0VcdTAwMDEvXG7DR0MhyKtilFx1MDAwZnG+QeoklVx1MDAwNXTMt3UqK93Ztlx1MDAwNppcdTAwMTAh1zXqZ6pcdTAwMTXs7S1eZ1boqEvQk2pcdTAwMDL9tkHIT5SkSVq3rKWhYi9GSaWUY1tVPO4wvDRR/fIoplx1MDAxOOymt1LVblx1MDAxN7OVmIRcdTAwMDH8gyOPiiG+d/Run0nrfFx1MDAxNKrCJC2UbbZjyElNcVdcdTAwMDPV2z1cdTAwMDLQfVx1MDAxZvSwzVwi0lx1MDAxY0+Z5sTwQNYqSzTp+3g/zrhcdTAwMWLKQK5cdFx1MDAxMW9s79DZYf9cdTAwMDG1QFBcdTAwMTWfPlT1pVdCXGLl0ijiXrJbk447Q8pcdTAwMTNcdTAwMDAzp4Ccwi2hNPpcdTAwMDVcdTAwMDNcdTAwMWarmnb0XGbtXHUwMDE5LpQs5tElMLGslntisJXqZlx1MDAxMUFjeE6zNFx1MDAxODFDpr2zmUNFXHUwMDBio/hE2vv7OyF282glZFx0pNVcdTAwMGLjipSmda/99PTDqNo/3mvIuKP2e200OONcdTAwMDZF5+Wch6NcdTAwMWVcYlxmsp2kWl5cdTAwMDbIvbkyaiX6YfvGoE+0uzvmaDBA8u5cdTAwMDd6quvpa+ybfilcdMswkn3Ii8NcdTAwMDOHXHUwMDE49dlX07dYSW5hXHUwMDEzwvvNSmWW7FT4lHT1YFxcpeM67lx08nElqW9CJIxPw/r5pVx1MDAwYlXKU8k25pNEK1x1MDAxZbqf5zfKrXQ6XHUwMDE5m9jOW1x1MDAwZbdVnkqKXHUwMDBm4P3BXHUwMDA3gKjFebAyU1abUvmdXHUwMDA3tpeRXHUwMDFhXHTutqi4XHKfXHUwMDA261RcdTAwMGJdbMZ/o+FvXHRcdTAwMGZGlpBcbq9SPiZnXVx1MDAxN4l6QfNcdTAwMGZ9umPJXHUwMDFiWHbOz+iCejx9X4TdbDiH5br3Mf6XubL1qMB3TK9L6jD0XHUwMDA1Nl2qtn6RsrKpTpHQSzvXWaekhe9cdTAwMDVtnvWmXHUwMDFjTJDrkCBeM5BgsktcdTAwMWMsWI9DgFx1MDAwNmlW6lx1MDAwZnKbXHUwMDE0vcFxqlEqKrtRUG5JqG1CXHUwMDEyOSNoUZ03byt0Y66qns2eL1x1MDAwZjXzdVx1MDAxMdtVXHUwMDAx+jOIbcJLXHUwMDExUEmUlfaKOMOV2pR7n1vF/c6yfDxsf1VcdTAwMWTyy1x1MDAxZGJcdTAwMGXxXHUwMDE12fLU8nhcdTAwMDD2naq/5211bURmtcfNaKOKmYeAXHUwMDFjqqVccnj6mf8271Xztelg5vhcdTAwMTElorja+GdayFx1MDAxZLnY9lxmrkdWjp6EZHkuR6r5oM/jSXjU771byvx4+EQ7ZcdcdTAwMDNcdTAwMWGftlx1MDAwZfqw1CTlUVZcdTAwMWSO58bbqJXMjOkriciSj+CglMqQ86kk8iip41x1MDAxNjtdgvSEuqTIcnBXiKK/W1x1MDAxZIg8fFx1MDAxYdmqQp64oY1WXCLIrNRrqFEgYUja+0zQjdUvdMN79o05boNnfpa/RcuG91vysUE3q5u87YXmqUE9TqU41vZgjT5G6uZ7Plx1MDAxZITWXk21XG5cdTAwMDNcdTAwMWI65ylcdTAwMWbOrIvp+pB2y1xmPI0qzUHCXFyL1fWxS/2/xXWHkuJqP906JMdcdTAwMTVP32rynIJLXHUwMDFjwMdvp8OKXHUwMDE0ojOHsirvL1wivcNcdTAwMWKTXsGhXHUwMDE4fK3lXHUwMDExYVGmNL9cdTAwMTTW9lx1MDAxMsF7SzFuT1x1MDAxZKGFR91cdTAwMWVSXHUwMDE1XHUwMDFk3T6jXHUwMDBlR1x1MDAxOMtVSMlcdTAwMDRh2eGPrTNXpUXxdfrkwXxcdTAwMTDoXHUwMDBlzVxi+bNWlauDNLN0Plx1MDAwYm5fMMX33/l/hf9sg2x4RXd+f4VcdTAwMDVI2zKbM3BZ+rV/j0O+W2/mlCHOJsqZjfXmkNfw/5tcdTAwMGb+f+N+/oid9ozatbylXFzUolx1MDAwMplcdTAwMDVM1Gw/QShcIkNHpVn6Pit9S36asz6ARTLw+MlJPqeNXGJQP27V3ej/oes8tlx1MDAxZFx1MDAwNZYo+0FcZlx1MDAwMIEww8R7J6xmeG+Eh69v7nuTXt31ZrVU60qYjFx1MDAxM/tkRkZcbmfD8YxwxakoMmThNDOrVSZcdTAwMTgv7KhcdTAwMWU7+qTUPolw/ndkep1VP/F0LfzNaPEyXHUwMDA2jFxc3y7405XfPpuBfKRuXHUwMDEwfKLSKYL3xFxuZfTQfMnQ1Pf8mlwiV9NNg/lcdTAwMGbHco9RyzRcdTAwMWJmLIhmn2fz67OTmdJE3dZcdTAwMTZF+X5cdTAwMWRcdTAwMTEtlzVuyoOVaXKCp9YuXHUwMDA1h6JU5fLC9fDR6TfTXarAgWxjXHUwMDBmhb9FpC6PVC6Yz4QveUPpXHUwMDE3TlWvZGlNwlDl2lx1MDAxZc3YXHUwMDFhT1dcdTAwMGVGfkxcdTAwMDD500lcdTAwMDTwXHRXXHUwMDE18q+8x3PdOr/Rf1x0XHUwMDExl/JE5cZabuFGeZfSg8u+9E9RVNTQSdGDqtx0Q1x1MDAxMLk51ejP4uHanryaXHUwMDA2oGKRQe6lWMbnKlx1MDAxMVx1MDAxN73e/upcdTAwMDdcXHNgXHUwMDAyxzu7t3xcdTAwMTDfwlx1MDAwNDFccrBcclZw85UyVJfIXHUwMDAxXCLx6LrA1o3wtPguSsvcNn4jNeT+eqBYlzZF+ONcdTAwMTJ8gXtIP/IrnVxcP1x1MDAwNdPK39mTT2PKolx1MDAxOaSTsMHtaVB+Qlx1MDAwM0SHeopB4MCu5NDHnJ56h/WD9WqORSZ9XqH6bcFeXGayP3fDqYmfXHUwMDA1Z+JcctPyaH/shFx1MDAxNJ69yyxQfMrN/ZsgJ6BFVSnTwtfLfsvc+IMvpFxyv+HwXHUwMDAws+14XHUwMDFh7US5mGXaXHUwMDFky6JWOlx1MDAwZT2vp8aTxW/EXHUwMDAxPEdcdTAwMDDXdYLNXHUwMDBl6Fr347bXS5UxXHUwMDAxmfeEK9lYmVxceVxcrNx+oYCcg+Ghhfl/+djK9kTuXHUwMDAyWnVpv0+jXHUwMDEw00qYXHUwMDE1XHUwMDFhXHUwMDE4YVmjJPx7XHUwMDExqflDliQuXHUwMDE5g3euuTxqXHUwMDEzt3+ln5bsm+QyTba9SP7y2pwyXHUwMDEwXHUwMDAyx8ArVpORMKtoX2GHZXXWuVx1MDAxOZVccutrXHUwMDE35lx1MDAwZlx1MDAwNVc2RYBou6pgeESsnVx1MDAwMY9cdTAwMWSyXHUwMDAxk/ZcZj5tleafsO1gPbJXSPll1KbbRbycqTdcdTAwMTQ2LpGaTd8zSrPZ+4vg2Fx1MDAwZUNcdTAwMTajjlpzTPt+XFx7NqT6UdbWgilCKHxHedRXYZ/sXHUwMDA0/o1cdTAwMDZcdTAwMDeIUCmrzTbt61eB+EGt/Fu3ezJcdTAwMGX7so2LPazJOqJPvFx1MDAwNe/hXqKk/OFU2oY6MymD9NfUpUpuJMdxslx1MDAwYvF05KPyK1x1MDAxNFx1MDAxY1x1MDAxM/nmw4Ehk1x1MDAwM4O7abpcdTAwMTWEi4555y81l3e24zq8mVx1MDAwMVx1MDAwNEtcdTAwMWaihUGLeYFcdTAwMWNcdTAwMWYofvxNlK9iKttDo41cdTAwMGaZ0vPemp5cXC9txK2lvci3yZx1NnhcdTAwMWOhy1x0k4a0XHUwMDFjPGqw9i18y62Zve9WjfkodEBaLT33N17f419hXTkytjhpXHUwMDBi44pcdTAwMDGLkD+JOFaXnzvX2lx1MDAwM1x1MDAxY2ujpnNcdTAwMGZcdTAwMWYgxt1cdTAwMDSSKMeI2bmDkZ6dnuhY+UZh2uLihaRUXHUwMDE4XHUwMDE2cWfaXHUwMDEwXHUwMDA0uPCDWEJcdTAwMDStc5FcdTAwMWHBJTxcdTAwMWNcdTAwMTd5XHUwMDFmVNe+p1GNUjHgUHWlvKTTTvp+261cdTAwMTf4QnU1ttFcdTAwMTW9wNlmWlx1MDAxNfPRl5OdaVs5f9JrMcVg9c+TezHbcWujWGhNyUgocI7teY/a+2FcdTAwMWXLV06IczxoPVx1MDAxNtm/XHUwMDExzWNiZnIjIZ9cdK6uS1x1MDAwMndgREvFfv1QXVx1MDAxY4hgWYnmY9Fyl890917osvas929cdTAwMWJWUdX96UlbXHUwMDFj0CfI7s0hYVxyjmBDXHUwMDBix2ZyaNPwflhGOrt35VKQQVxmabbNXHSlI2PJXHUwMDEyobZYzsFcdTAwMTjo6TqLw1x1MDAwMzfY4OJcdTAwMDdN1ERq5zbAUH3+z3WiqVx1MDAwYsqiXHUwMDA02eeDj49rL4mDarhgS97NXHUwMDA3JD+WJlx1MDAwZclGUstvXHUwMDBmPss8YGVcdTAwMDe3WlD6XHUwMDEzy0TBr6lcdTAwMDdQLVx1MDAxMsJL005cdTAwMDSX8jTNXVx1MDAxMGBz+3kgXHUwMDE4VWtcIs3PR08yxMHg2ZVI6cJC7+CRXHUwMDBl/1xu7m1JVe62fHh+XHSta+BcdTAwMDdcIl5cdTAwMWPX3lHgV2U4rkRkRtdEgSeZxPotTVx1MDAxNP3+NItcdPNSwVx1MDAxYVwiXHUwMDA08z1cdTAwMDSt59u///rSzEnBMiFEgYt+gllcdTAwMGaIq6bm6k3DYddo2tCOXHUwMDFlMEpOk2OU39/8+jlcdTAwMGZzmSQ1UjGnXGLZ/lxiL2pcdTAwMDAsXHUwMDEyddHY4n1cdTAwMDDY48tcdTAwMTXRnf7yn5RFlG7XT9JcdTAwMDPf5MT2k8JgmN9/hJJcdTAwMTJcdTAwMTDcvlx1MDAxN/M1LsUuXHTjQ3pcbrGfw3ffyn5FXHUwMDBlntc2JuB6XHUwMDFhXHUwMDA3N2k6i1rKXHUwMDBmROIkbErRXCIyXHUwMDFlzFx1MDAxN8Zjdy70XHUwMDE5yeRcdTAwMWJD+iPVh5bd934wn1is3jCoZYhJXHUwMDE139jEz1xcTC//7Fx1MDAwZiRuvsWlku0lo1bT4N41mq+j/2lgn6GE2tvTjlx1MDAwYi8rVFx1MDAwNZzKPVBuXGKczbP9Rb1zXHQmxZKtXHUwMDFk4c007cR8S2SHPlx1MDAxNEerOo7CdiZwqSc4Zu5QWSlZpVjY5lx1MDAxMfGjtVx1MDAxZa/wLsBf3Sfz+KTk8UlcdTAwMTDAjYWYdVxc5n41/M3Y8JjkIOpQrem/TpnZUrDNa/nls1x1MDAxOLXkspdcdTAwMTlcdTAwMTbTL9bBfTc93q9mK46agI2Tnk1put/FXHUwMDBiZvZ5fYxcbtxLY0aGWGtY5Fxm88Hny3hbZKSFaavEXHUwMDBm71NWXG7K9PNcIp7nZ4urv/t5LNntq4RcdTAwMTRcdTAwMDXo8VBMPz5kXHUwMDE2Q9Q4SLJs2n3yXHUwMDBlaDuUZ1x1MDAwMpVcZoB2plx1MDAwNlx1MDAxY+VcdTAwMDPFWFx1MDAwZvc9XHUwMDE54I6qzNz2w1wiyYzHS+X7i6ROtYnROLg7bKDYeZvza1xmilx1MDAwN/xG0lxiwyqthsD6lU9cdTAwMGVzJcFJ5MmArfIqTeXXbCXoqrSpTFx0J1x1MDAwYsI3cchwXHUwMDFiqvjrgSCj9Vx0XHUwMDBiXHUwMDA2XHUwMDBlJbVr9OS4P2P+XHUwMDAyL/T9XHUwMDA291x1MDAxNZRcdTAwMDLzfnM4ot1vZ1x1MDAwYtvjltlcdTAwMWU7W08yX5h/XHJmXHUwMDEzfFx1MDAwMYKohTj+fLlpvPrHwLP8S4JpXHUwMDFjl5uJlppxcPf2NOFj2X7ZizLMXGKcI1x1MDAxYbKzXHUwMDExXVx1MDAxMzC0/v/WXHUwMDE0/IchXHUwMDEzMVJRkJdKWMqe2VTeg89utquyc6jD27qzSGaB4FwilHBfXHUwMDBihSi2lYW9cyFcXPshXHUwMDE4mKJcbnc2TelQi4EseLR5NPiX6thcdTAwMDJLXHUwMDFjivrYXHKvY37Qylx1MDAwYuNcdTAwMDN6LUNgJIZcdTAwMTn82e52XHUwMDA3KZhwflFccn7cnVx1MDAwN7TL8jHg92OnXHUwMDFmanuxPiZgVp5cdTAwMThcdTAwMTjQyaRYvrBZqFx1MDAxMyxt1blcdTAwMWXkJkqRd5GnRK0hTmIm1Vx1MDAwN/3VuHo6MriHJcXxvemqbEKzrp6wrtFcdTAwMThPlzLm3v7fLrZJ8pPjXHUwMDAyXHUwMDA2gKzH9b/J+1x1MDAxNZ9m51x1MDAxMInAKFx1MDAwMrpEL+dcdTAwMWNC+HGqXHUwMDE5XHUwMDE2YjjaXCJWZCynlDRcdTAwMGJ1W+drXHUwMDFl81BKSK9p0krc+YiZTpc55zHy75XpzlFcXLJmOiA2MZ93PFx1MDAxNHNYejd5k7JHJLn93Fx1MDAxOVx1MDAxNqXCj8CZXHUwMDE3jE6V0CRf5qVG7PY3XHUwMDFmgnNf+XH9XFy4qKeYYNpi5Fx1MDAwMn7XaYCvxGfG9mhzLeKTTVx1MDAxMFVcXNb7gL+431Rh6ka9XHUwMDA13zBR/Jq+rP31yy1cXC2pq2us5HotgvFcdTAwMTHqzTPzNr44z1x1MDAxMTKeMnjrLGthceyS5sqV5VuZXHUwMDFjmVx1MDAxM1x1MDAxMPq1J1x1MDAxNVx1MDAwNW9cdTAwMDewWVq8XHUwMDFiXXtcdTAwMTBh1yq7XHUwMDEyLOSqLpO2XHUwMDBmwVx1MDAxNC5CqG/WLNK0l7mmK7vlXHUwMDEwUcyIX7Ut6CD2aO9D6LhgVcZcdTAwMDBZ2lx1MDAwMkiJWXex+KDf8k1gXHUwMDEyvl1fXHUwMDA34iY0gFx1MDAxYmhKXHUwMDBiJ1wikprbW5b9lqL2XHUwMDE1XHUwMDFiO2hhKfDFO624J2Zz+1x1MDAwN0e3Qlx1MDAxMZdOfaHgXffyplx1MDAwMkbZuCQnl1+JXHUwMDEwXCLGulx1MDAwN26HK29BXHUwMDAzXHUwMDA2XHUwMDA1XHUwMDFj41wiL1xmXHUwMDFlWtn6rduh9OxcdTAwMWFu1udcdTAwMWEl+j/zx5z/KDdojNfroOT3X11qv1x1MDAwNVx1MDAxMKAnuFwiQvXs28nlXHUwMDAxwTE66fRcdTAwMTKZ1YzUXG47ekA1+5H9hjJlPm+mJPZRlmjmKjdx+HaF48nKz63aXHUwMDA1t1x1MDAxZVud9PfzXHUwMDFlLvQmwVx1MDAxMEFQ3VxmpEtZjlx0vUzrvlBcdED0dkx92nza0YSUtEc8uL6v7b6padzGruSzu56dS1x1MDAxMT8kWYxsK1x1MDAxOfLo/mpSXHUwMDEzVVCbM8RgXHUwMDBl0yqn9uLB+kBl6Neh/ZU/8sRTia1tP+Ht5NDyj1qiJ+7rv41Tj1x1MDAxZKRo1thBtVxiXepcYqyfPiafNJTtXHUwMDBi+b81wK/n/Vx1MDAxMOlLXGZcdTAwMGVHmvxlZzLuXHLnlVx1MDAwZk3qWoBcdTAwMTgp3eCDXHUwMDEzcsdcdTAwMWQwyT4jiPyUsFJcdTAwMTTlXHUwMDE07uc7fFxy+Fx1MDAxMzBuKqL0TZhO+jBSk5v9KDRcdTAwMTNEqJ9cdTAwMTf9bfY9hz57LcWmQyBdRXZcdTAwMDSJy39ePt4mZGO0lX5cdTAwMGJccr50hNmzj4DzXGZBp+0jSlx1MDAwN/6hpVx1MDAxZjZ45mbYZHW6nOq2RrRnVXlcdTAwMDZMPVx1MDAwM1x1MDAxOYHtgunKoFRdM1x1MDAxZnRp/7qvNKNcdTAwMTZcdTAwMWFiSjGa7OfucsaMXFxjXHUwMDEyi0g7UnFkOt6tS1x1MDAwMEc7rJ9P7CdcYlx1MDAwZVNxx7ZMUexylYvoamBv/Fx1MDAwNWNyam+b4Fx1MDAxNZ9cdTAwMTST3lx1MDAxOGtcdTAwMWUoXb5yLVx1MDAwNopZrvqr9qX+9Gf5bDpZXHUwMDFkuOat58Pjg5PmqM+9t33ByVx1MDAwNu7dOlx1MDAwM/u95Vx1MDAwZoJcdTAwMTS+xLSRaPiI6KvLwYG82ay/vVx1MDAxZuaP8OzZOL5cdTAwMDfxsLFjVaZnLIKm3GmtXHUwMDA0PV/XXHUwMDBi4lx1MDAxZr8wfKzq/DGdN+5cXCtcdTAwMDTBzFxyXHUwMDE5qJtQIMHsdy9CLDS7dmSHXHUwMDA0c1x1MDAxNaDIQlY9ZbbCLDbFNEuvXFxbX8WMTIueen1LfC+NXHUwMDAxNun6XHUwMDA1dICI85J+uGFbq3fCbZu5dceqb0uIX1szXFzj1lx1MDAxM9DZ4lBcdL7R3ZmOpILfvsjiSOJjXCKfqFx1MDAxYtjL422QyFx1MDAxOfuEl1x1MDAxY9vgMZb9of7wXHUwMDAx/vfxfvtcdTAwMGL1V8dcdTAwMWPRIfJ+5djEh7dZ8+bAkszQKPicqplXO5vdY6iRM27BJlkkLNJcdTAwMDbFXHUwMDAymlx1MDAxNmtcdTAwMTJMWnObMbi+5M5cdTAwMTKU6lc46tvYztZcbt+/k6NwKlx1MDAxNjL85djUO7FNTJ+Y/lx1MDAxZFxuv69tSf3gfp47wod8a+iZZlxcb1x1MDAwMHjpcXws6CxyoL+xXHUwMDBliapA1ml4LVx1MDAwNJNcdTAwMWW/lPKxXG5Ostg6XHUwMDE2jVNihUibgsle3Y5zsYQpkkXkQV0m33fepqW3XHUwMDEwr5WSbWZrWldeQmkv2PXG3s3M40eP03zsOCvLocJcdIf/o+ZcdTAwMGb6TLaIXHUwMDAwUtdKaWhcblx1MDAwYtKp5a9G9Gi+e11cdTAwMWExLzN5nYWz1zCe28/TY5wyR+KbmFx1MDAwNnLJXHUwMDEzSIN4PzRa3Wk44o66Y1x1MDAwNuohd6ovN1x1MDAxOU6qJ9a6XHJG2LijXHUwMDFkmLqZs1wi+2lcdTAwMTeWpTitMeXFJlx1MDAwMZ82glx1MDAxNDanKV/p6P1cYiokJUySwSrLtKbuV07Ds1DUWH/CfL7yrFx1MDAwZdNxbnmmZ+Mvllx1MDAxNnBcdTAwMGK1TmBcdTAwMTPH7LUmYVxyI7nNJyjcXHUwMDEx8OxOXHUwMDFkXCKSpG7Vg4Fv01x1MDAxOH18lFx1MDAxYVx1MDAwN4bx4lr2+cpDXHUwMDAzZPWdnNmg3nWk4Fxm289K4ChnvZe2Vlx1MDAxZVx1MDAwMWVLIYhcdTAwMDFHb/NAVLLGRVWKSpX8vJusK1pMlE61g9NcdTAwMDTZXHR0l/Ncblx1MDAxOf2Gsf+Oa25cdTAwMDVfREtcdTAwMTUjXHUwMDFmv/aGMOJk4Fx1MDAwNFx1MDAxN3ZcZsN9/4ZvaS/JWC9Dd4WxWFwifb5cdTAwMDMzdfKqXHUwMDAyX46v5+vbKVx1MDAwNVx1MDAwMWa40LZLhmjB+1x1MDAwN3V61VxysJ6S2lx1MDAxN1VcdPJxJpfOZy/bZ1x1MDAxZFPhUlx1MDAxMzZcdTAwMTVcYpfd4ftcdTAwMTH4RvlcdTAwMGVcdTAwMDdvx/pcdTAwMTMsYqRPSqixXHUwMDFl7oVcdTAwMTFGXHUwMDE3jGZcdTAwMWJpX0lcdTAwMGLRJ7hcZkz/fv24tFx1MDAwMFN+7/x03Z+KXHUwMDFhXHUwMDFjMlx1MDAxYl5bg5Z/VVx1MDAxYqWdQ1TJfEi7PM+j0O1i7bHiduDxcCZ6g1x1MDAwZVx1MDAwMOQnTzq84ElZrKGc2sItXHUwMDAw+Vx1MDAwZj61XHUwMDEwd45cdTAwMTFcIikjLJhcdTAwMTJcdTAwMTD3M5bg+qI20MJIMlx1MDAxMN3Pur+vV2qEejFoZEFP7FdrK1x1MDAxZuDcNY9cdTAwMWL9gHnaXHUwMDE5cXVVtXPdfVlefFx1MDAxY/LNiZQvw05HVjmwUXOWieHu6WiA/tYqPkGu8rT9OCymnEpcdTAwMDU8d5hEcVx1MDAxNS70gFx1MDAwZlx1MDAwNNR7XHUwMDExgH3sLFxyXHUwMDA1XHUwMDExXHUwMDEzS+GG9yvGPcCZ2osm3Fx1MDAxMPuNl6vWizjOklGAvau1ethcdTAwMWZge6fTf7Lt85k4XHUwMDFkXHUwMDBm3rr2e5T7WXAp6a+mXHUwMDFkT8VcdTAwMGaaS7F4ltbLbeIkiUxCjv72XHUwMDA3Sjp/LVC4Z0u0b9ggM5mmrJo0f9TivpNmL1x1MDAxOTyzTvyLXHUwMDE493WfXHUwMDFmmvVXj3G/yJqLXHUwMDFlXHUwMDA1ON3jX0BcdTAwMDXp3qQswtjQt9xcdTAwMDRcdTAwMDfcsjPoa9Pmm/1JPel9McIxx9yTnz4lcJb3yV9cIpoh2z3faLE7+MdcdTAwMGVKzP1d03dRRrY7MnS5veNTWnfwXHUwMDBi3b5cZlE4LE84L1x1MDAxYTqVcVwi5aNcXNEssnjjMFhccv6k5XHBg1x1MDAxMDSpfkq6wzNcdTAwMGbUpFL7wfiFRcqwMW1fckN5XHUwMDE3XHUwMDE2hEadXHUwMDE3l9sg+7KVXHUwMDE0+Sfec1x1MDAxN2hK9c0zX1x07pBkgzvJXHUwMDA3gIDZ9COd4HWijL4pXHUwMDFmpYf0vGckiY4gutxpiK5cdTAwMWXE/ztcdTAwMTeK/F7rvnXEKJOsyXhcdTAwMGYg9772tZi4XHUwMDFkXHUwMDE1omRcdTAwMTGty0NOwIwhalx1MDAxOdjdmTNhXHUwMDBlP0TK0V5D84DmytPc+/BcIvJcdTAwMDVcdTAwMDFR+cA88X7JVl/MjyfaXHUwMDA05ZfG3Fx1MDAwNIF7XG72xH7ETjY+Uimeh5rwJU5cdTAwMTPSIYtG6D4uXHUwMDFl3aLpxGjRQcqto7x4/SYvg9lVXHUwMDFmXG6BMFx1MDAwNb1KjTj9O0PLlstg33LGsYqJ5ZInRXVcdTAwMDNeXHUwMDFkhPIprpDuXHUwMDBictTzmKRlXahDXHUwMDE5QC1z2VxuTXEmUcujwzAgo+fhN3/cXHUwMDFhoVx1MDAxNFx1MDAxNk2LXHTKIaGYWlxuXFxwwlx1MDAxYUFn0ku2T4lYPrnyXHUwMDBiOoToXCJPc77+J2RcdTAwMWNiKrZmb+G/XHUwMDFl77ydZYaujNxcXHflVqr9m9zhzjVJTHj5XHUwMDBm6zSJ173xXHUwMDA3OjnjXHUwMDEzusBcdTAwMDZcZspn34jy7/DTkyZNfN/DR3dcdTAwMTToXmCW7lxui10zJXtcdTAwMTedJCFcbnvTXHUwMDA1VZd5YFx1MDAwNFquXHUwMDFlflndtpLlXHUwMDFkXGKd+33StKH+e34oXHUwMDE14lx1MDAxMrfvXHUwMDExXHUwMDE3I6Q0cHn25+lwVyqpTpuZ7f+cu1x1MDAxNuVsvZ1/tVaMt4v73z6N4YXkjfHk2u76XHUwMDFhh5Va2EHRhIvjS8GgXHUwMDA0yn2j3zpJXHJcdTAwMTg7zKmouyrZlPtcdTAwMGJcdTAwMGI/a1x1MDAwZoFcdTAwMWSNxz4x3udAto5cdTAwMDRjXrOtZvVWcrfgXHUwMDAxXHUwMDFmU/4yz1x1MDAwNZL7k1R7ssjK8vli3v7u/MGN7tl+YeWoTSBLNFx1MDAxN6k2XHUwMDAz6Vx1MDAwNp2gasmtfSi1XHUwMDAxf1xuXGZ89ydrni6SfnZXXSNFms6c/WFcblgkw+Sce2CeXHUwMDAw0/Ncbojd12xui/ngzFWdWyhcdTAwMTY3y7NGNCmV5yXsXHUwMDFkXHUwMDFiISMgj+uFw2bKnbmaTP5N+Fx1MDAwNGtNvbRDokJRuSYo+5y9IOdHXHUwMDFjPkYwx5NcdTAwMTmFXGL+W7YlpflNJ5X3uSSHXHUwMDE09C87m1x1MDAxMVRcXLn0eCbtXHUwMDA3jJn/sSx7XHUwMDFjhV3DU2erXHUwMDEwJn5cdTAwMWJBXHUwMDBl/G5TR2Aw5mHZmXtcdTAwMGVJ+ap087jLnX2nNVx1MDAxZo9BKO71V8eZTys/WV1XqFx1MDAwNZ2odN65w1x1MDAxZrbzSSeLM71pRfhhpIny085+XHUwMDFkTdjgkFx1MDAxMPxNa+bBwWFfQo7PS0lFXHUwMDFih5FUXHUwMDBmayGsXHUwMDE216FryrZHZUaCkk1W1Fc4hueSZoNA039cdTAwMDF3PCmfXGb2Nlx1MDAxNFx1MDAwZWi86DSPIPOQvtZQXHUwMDA3P1iFhUC1XHUwMDFhtWBcdTAwMGJ4f+R4IUd5R7kqXHUwMDBmfJ5cdTAwMGXguE6t1cZcblx1MDAwNyxi0leXj2feZTJC9/OKXjDKXHUwMDBm6HZcdOZ8Zsfx1Ha0qtSnhVx1MDAxNpVcdTAwMWb/d7SOoyNh8WRcYlx1MDAxM/rUZi3xjo3C6dH81XzfJFx1MDAwNlx1MDAxMaxcdTAwMTBAXGYvRfCTazZcdTAwMTBzyL3N3+/N/Fxinf79s9bx+UxEcuYsRVx1MDAwNIZOX9D5J/lzaym+r/72Y4PY01x1MDAxMv3BnPjomnH87lx1MDAxMfRcdTAwMTZcdTAwMWRcdTAwMDVcZsFIY1xmh2dVYFx1MDAxMHtsVi9cdTAwMTeTNF44n8D+XHUwMDFiatBcdTAwMWRcdTAwMWZjs973XGL2RTNcZppcdTAwMDWsjexcdTAwMWZMwEZ6cicxZFx1MDAxNcnchlx1MDAwNFrqZ1x1MDAxZKu49YxcdTAwMTA7QdBcbl2tkckxYlN5dpRcZk232+tccmWF6vRcXPSr4yvx0tBF+W8jXHUwMDA3jPLrM35cdTAwMTM0dL3bn/aZeKjKXHUwMDE4TFNt41x1MDAxY1x1MDAxOf5gh6IleaeK1mPHo8P0L0Q4mWlmgOSj4ZabXHUwMDEyue723v3eXHUwMDAzvDjiL/kxMLxTTnFcZtTjZ71PzSXKiFjl5uJcdTAwMWGLf7+wh+i+uzlvhnTbrp7YXFxcdTAwMGb+PIVccsxa1zXu6IT+SJwlxFx1MDAwNHm0u/LPpVx1MDAxZVVkZedcdTAwMTCW4qCAljIyLICmXHUwMDFm1oxcZsnDNP6Na1J9+55cdTAwMDFcdTAwMGIp8i6JT5qdX1x1MDAwZaXhhmKh9/vihZHb9Y2d2Fx1MDAwMKBcdTAwMDDCzFx1MDAxZkdwN0t8XHUwMDE5Rs9cdTAwMTFZ1lx1MDAxYThcdTAwMDYyboskR1x1MDAwMWb+KCsjPaFCXHUwMDFiPSkjO0lSzS5eu3SsXHUwMDFl2LH7s7pfXHUwMDE41r9oyzvHwJmqXHUwMDEwI/CDijtmfLFhzlx1MDAwZSlcdTAwMTN1KtvDwrBkYs3gnzzDvkFTKFx1MDAxNv2+NfP7279h5Vx1MDAxMFx1MDAwMulcXKxPhriAYHbao5ThuXn9j1pCoHGOLIogdFx1MDAwZlfQX1x1MDAwMJ2klPtgfpRcdTAwMDaPd8BjvVVngUjoXHUwMDBlgrDy4Vx1MDAxMXWWXHUwMDBlJ+95mcu3q1x1MDAwNX3PftTpeIEmq9XI/lxmOS+OOlx1MDAwNTEu6lVcdTAwMTZnfUhcdTAwMDFccs5lM+G23I2/RnzrXHUwMDFlXHUwMDFls1SzusZj0oQrKT/y6dCGnvxgwPpcdTAwMDNcdTAwMDIysanF8Vx1MDAxY0y/dH40aDD+glxmaVeKYDIvJFx1MDAwZWNkh8o/XHUwMDAwNZXgb6vLX1x1MDAxZZ92XHUwMDE04lx1MDAwZptcdTAwMTmVg7P9N42r+vctfiZnRVqQqYxY8jxGYlx1MDAxZFx1MDAwN4KyqXpSSfX+U8GcXFyR6GhAyuPo4d6X5/L1wGi/q1PjXHUwMDFkZni/S3EmKJhyXGbux9FZTX9cdTAwMWJ1xsyXrj2mXHUwMDBm2/9qotVllbrAdVx1MDAwZWv8M85YS/2rPn3WteOJaZZAOJLTSpOQSpA9QIfsQSNcdTAwMDRcdTAwMTglrYJw2HL6Rdhwc2FKPlx1MDAwZSj6Kbm12emORctO3kv2xd5cdTAwMWL7I2j6XHUwMDAxqbzH/X2QPI45yMzP0nxZL8wqzPAtLFx1MDAxMu4jXHJuuP1cdTAwMTGXhVx1MDAxZv5cdTAwMDLR/mK1XHUwMDAxlUKOQbY1vmxcdTAwMTHco1xcb5S5okDIQnh5XHUwMDExI9gwl0bkd0qM6jq4SrZv7WhcdTAwMTKG0vihXHUwMDAyfLw6f2ZTcpUybDGfXCJcdTAwMDL/d3TPq+mOUbA93bjps1dlXHUwMDE5XHUwMDA2pWWdrKSut4gogoJH83shuWZcdTAwMTP4X1nrXHUwMDFkXHUwMDAz/Vx1MDAwML0xb66OZlx1MDAwNnYqkbU+amnF3MuyX1xi8FXAjOpfh8NSXHUwMDFhXHUwMDE54yihOysqXHUwMDBl4Hbysd9cdTAwMWT4z77h/t0+hGuXQHi94Vx1MDAwM/ZAjmqe2a01X+ruPIjxX9+K24CI91x0XHUwMDEzY5OLUfk4dFx1MDAxNlx1MDAxMeOCYGG/f3BcdTAwMDc28cvEnWa8jKBA/llrPurSXHUwMDExPlx1MDAxN1x1MDAwYsao+VwidDYyuyPFXHUwMDBig1x1MDAwMyl5Pboo41x1MDAxN5BoXYh31/ae5yQn8Xb7mIyUXHUwMDE1Sm1/NWu7/fPAXHUwMDE3m9KEKa8+O6/4opEsT4BravLdjLnBXyntNaZ1kDOgbb+LXHUwMDFhcfeOl2g5QSpDyHI2Ti44xFx1MDAxN8U72V/Pznvguscw2UBrq983ZCk0+ZtcXNKDXGKEXHUwMDE1vpnWL+s9ZzqVr3+KTYjoJqSCc/61wXjyo1tcdTAwMDPNfrxScVx1MDAwYoOwR/HgueJSmG7gl3ar4mOi5FxmgTai/Vx1MDAxMJ1cbjOdj8E/iSdcdTAwMWNcdTAwMTNQMNAmneTTXG60cubLUvdIKq5uXHUwMDBlr+JMyrSPxfDYUl9HaSy5WHrRkNg/mlx1MDAxZVx1MDAwYnb2WKrHXHUwMDEx7n7FMYtTTVx1MDAwZqvFjG0+jpo7QpC7J5nPrIyfcrlUqqu2fn+C4ataf0dcclx1MDAwMfFVXHUwMDA1yJRS01x1MDAwMySSYmj3rCvcicO9wrbAy0i/XHUwMDE3ltSl7Ilh+Fx1MDAxYvStJHxe0jb7+410XHUwMDBmm5hjU74kXHUwMDE4I0POXHUwMDE4RPMg1M7f/lx1MDAxYSG2jTTPv4k6cNFcdTAwMTZSPK+9KLhcdTAwMTByz7TFJz9cdTAwMTHyOoD0JVx1MDAxMLawrMe/XCK0tFx1MDAxYd9cZmhcdTAwMGZ8l2VtILaSslx1MDAwNMeW51x1MDAwZS3WXHUwMDA1o1x1MDAxN1x1MDAwMVxyXHUwMDE4LWBcdTAwMWayP8iKJ4TdX+PjX37Qe/mHJzIx61x1MDAxM0RcdTAwMDeGdGJcYl/JxjHJ8Dj5PvD3XGY8XHLcj69cdTAwMGKe94qm51x1MDAxYrNcdTAwMWHDPzqAweHSw1xyJlx1MDAxM0VFmL2bWsLqvqTut/pjnIfjc1x0Qtmg2DFkXHUwMDFlM9gm0imSKlx1MDAwMraeXHUwMDAy+UH5XHUwMDExa8PYuVx1MDAxNXBBoo3sXHUwMDEzicSP8XFzZY+cXHUwMDFlPap9NtdcYjjIXHUwMDFh74ZMprZtXHUwMDFi2a3pXsFmJW++02CJji1X7FxcI0/IP9RASDNy9/u0SJdPxk/auziC8pJFXHUwMDBmZaFldCXOrT5ltZjRoi3dSVx1MDAxMTlcdTAwMDC0dGNZ8fmx0Xt/MSxO5p9vTrZ3U69L4ZEnJ4PA3ZLq8b1iZM6RXHUwMDExpIWi3ePYKtjO3co4YW9M2j+hzmzv0ODxKThcdTAwMWRcZtbIIOtcdTAwMDI163bdNEbZzFx1MDAxN5pcdTAwMWN/pPPomDb8d7+PWOQ2p33B85Vcbnool4fiytYpqdZcdTAwMWRcdTAwMDVJaEM5+lDLRlx1MDAxZSWwf7tEzDSJiqS67u4xXHUwMDFkXHUwMDFjroYwxv3tXHUwMDE3PclgKFx1MDAwMPGKIIvq0bxcdTAwMWNqlW8k00c8XHUwMDFj5HNxjlxicCRRXHUwMDFmXHUwMDAxOq6oWFx1MDAwMutb59Og5lvUbdfIQSziXHUwMDFmtCpcdTAwMWFcdTAwMDEx12M/8K2qsKWgsS1DpotRlXvJlsMhrcmp6izKVGeDiefONtp5WTSaYfjsziTlQttcdTAwMGKyflxiXHUwMDA1XHTjotgqjVx1MDAwYrXSXHUwMDBiNTp2XHUwMDFhXHUwMDA2iU/8PakmXurBXHUwMDBlkmuCXCLsneJcZtz5Nr7QZ8oz3T05XHUwMDA27USCdqJqt3fNJN5cdTAwMTRxlylZtPvQmJWAnnhjiHognLZBf35Qnv44l8qaQKtcdTAwMTAlf+erQzx2ZeFTWL3n4qeNKndeNTd1zieehcDwSdiOYUc1ZJDfeuNcdTAwMGa098/5XHUwMDExjqFcdTAwMDSm/JRiKHLwQp1/c4uTlFx1MDAxOOdcdTAwMTHzzSzbyfQ92Vwi0HDQpPVr5XGZybsj8d+T8d7QUVx1MDAxOeK7s41VppFr+NmfMsGGzVxyz4ZuXFz9XHUwMDE1XHUwMDFhUijN7qe5YbcudGGMob1E8Dz/baZVjH3aIDSvRNUg685cdP1n/9XqXHUwMDE1++8x1rSUaHNcXHvpOHxS9NtAhGdiXHUwMDE2h0ffxXp3XHUwMDE1QnrBhlx1MDAxZLJL/Vx1MDAwNE14JFx1MDAxMFx1MDAxOCh3c+q5NTnHwm9Md8fH42nie5FcdTAwMTlOpribl4KPrlVkXGLejG1LlXM0usZ+waNCTelAmakwuWhkXHUwMDFh9iYuXFw/NpvvdZKDmlx1MDAxYexwqp0vXHUwMDExTc3zToC9caTgLVx1MDAwN8JqkFx1MDAxMs5s5on2UYe/PUaYNnP3NP99STim2J4yXHKKuVx1MDAwYlx1MDAxOUBrYe0yXHUwMDE5oJ0g89Kgf1x1MDAwM/5iS/NcdTAwMDJ5VD05v4faT8dcdTAwMTBcdTAwMWXiXHUwMDBiVFx1MDAwM1x1MDAxZUT6inJ+XHUwMDBlQOreNPXcMlx1MDAxZFdbXG5FXHUwMDA1+fipTFNOOGDeIIOiqOc9Tfr6XHUwMDA1flDMKrH0XHUwMDBlXGbib09cdTAwMDBXxFx1MDAxMzWvroeJ7l8rXHUwMDBmnVx1MDAwMDDR6nO0sblcdTAwMDPSuzWNb2/IQndcdTAwMTKUbFx1MDAxYaKd77boIERF+4XUnPixXHUwMDA0LeJ1Kb1cdTAwMDQulZKxwVx1MDAxM2RRXHQ9qUXr3Fxm74A9ibTygnkog6Xkget58o7IjvTg8vNbmvNcdTAwMDFcdTAwMWGNhlQ1prC2+qi6J1x1MDAxM/zu+iqVKT5cdTAwMGLakJFcdTAwMWNni1jjcc7x11x1MDAxMEdcdTAwMDL+9f4jP1xmkS7071x1MDAxZFOFXHUwMDA3PZxcdTAwMDb0X1O/v06h43Tzu5WlXHUwMDAw+1x1MDAwNXPg9dqcWlx1MDAxMPJN2eGmXHUwMDE26ThcdTAwMTVZeENO9jVwlWhcdDLTXHUwMDE4L2dcdTAwMDLGK/xbwv/3XHUwMDFltij+glLnXHUwMDEw0VlUXFxcYtUpboYtXHUwMDBmo1x1MDAxZMdcdTAwMDbTjrKSXHUwMDFjP5vqga2hip9cbpfESD1hfTqlXHUwMDFjan735Vx1MDAxN8EhN+nv4FCjXCKQT/mI8ulmJ7nddJqNm1x0cdlcXFx1MDAxZNDdXHUwMDBlLV92x2bUMVx1MDAwYp9cdTAwMWNcdTAwMDZAw4sh/ktcZlx1MDAwNzDo6y3OXHUwMDBlSyFcdTAwMDCxwp9/QEDa6tNewYd0Id+Scv9uRVtcclwinNDsbDZ7TX6tMVx1MDAwZuxYcLOKiVPsXHUwMDBicfqR/NKqgKCH/pbMdpb3op1cdTAwMTLnvyttxFx1MDAwMMJh2V5UXHUwMDE4s+/nXHUwMDFkZVrRTNZJmJM4VDPdLlx1MDAxM1x1MDAxMHHRydZvpSVZU8lcdTAwMWZmTUWpXHKO0/PEg1x1MDAwNVqdmatf3E9yU33jtdtF5aGk8GtcZvhYi41cdTAwMTjLkFx1MDAxMi+K/Ws1dUxJwP1cdTAwMDBWXHUwMDFkQ1x1MDAxM8DMrpyEwS05M0l32ZakcVx1MDAxNbxcXFxckjxavZqn9SWJ2ue036vm1beokVx1MDAxMESEcu7I2lx1MDAxYv5bKzC2wOaN0VxcMtozb1x0e1lcdTAwMTBg4ndjluZLWSlO+d5GRz6qXHUwMDA3vVx1MDAxMFdcdTAwMGWZKdW8yN/Puctw6dCOotWHpOpcdTAwMTlSfFx1MDAwMCREXHUwMDFjXHUwMDE0z3tEXHJJXHUwMDEy4rZcdTAwMGJ+XHUwMDExXHUwMDE5/WBcdTAwMDX+x7Lv21x1MDAxNNVcdTAwMTVccnBcdTAwMTn0gEeFJ7JcdFxmcaPNxyPDgkZcbk5cdTAwMWX92n9tK8H34zFw7oY+1mffXHUwMDFl49xcdTAwMWTaqDfG+IrqhFx1MDAwMnHMqdwsJjB6NzT6Vp1cdTAwMTCs7O/8XHUwMDE4sFx1MDAxYpVcdTAwMWE3pe+cXdfxWNZcdTAwMGZ4/HeE4a32eXBfdLnlxE2YxC92jeC1wKLUbZxcZrZ+TTGxMlGJmUv8hH/U/nY/polvgD83Q4V6XHUwMDFmIYnxu+hBVLH3XHUwMDE4vZDjXHUwMDE1aaNlbag2ZsgznPu93/ffb9hcdTAwMGKOJlx1MDAxY1bkwlx1MDAxNMC2s+VY+3iZW87YKzJcdTAwMTjxRSB8385cXFVcdTAwMGWm4i9cdTAwMTnTv1GXo1KP9XlVMNx5v4NrcFx1MDAwM9BcZlxmn69Bblwi5TvIXT11wMm03+1cdTAwMGJccskoYVg/uoyWuLdkfOWmXFy3vGz+XHUwMDEw73D1mVel+ODKXG5471x1MDAxY1FtnShRKLVcdTAwMWOIxj59mkFcdTAwMDYtMvuwPVx1MDAwMlhQboRWdapcdTAwMThcdTAwMDF24drX6JWApadWOi7fXHUwMDBiLpY5XHUwMDE29Fxmbu9+Jd3brM2vuIRAiNtagN5s3P5NXHUwMDE03la9K8bvh1x1MDAxN7dlXHUwMDA1RdS+/dQrbGCIauQ7XHUwMDEySzW9m8RSPWnq9/F6Slx1MDAwMWd6XHUwMDE4hclAccKD7+V7XHUwMDExWV39giF2RFx1MDAxOe/aiGM7T2nCO53YXHUwMDE3Q1F2wKxccmSQO4mHq2g1XzWxSueB6pHBbCPZTc9E7drk/rS4gFx1MDAxMlx1MDAxMM5cdFx1MDAxZphK68HbXHUwMDBixEWjhqtpf5pOVs6qfO9cdTAwMWEjvKZcdTAwMTdpZy1cdTAwMTEgMod0fpE+7P5Gn8eSwJhcdTAwMWPQ03CIPoW83aZ/8ErhgtmJfFx09V8obVx1MDAwYibz5/tcdTAwMDFRXHUwMDAyQjJpZ1RuXHUwMDBikYtDylim1Fx1MDAxMVx00fzwXHKjrkGWspE/9vpcYvlcdTAwMWGhbVx1MDAwZWdcdTAwMDKKpJEotb9orZqGSYP6ei79/YaEe1x1MDAwNpKHXHUwMDBijHvpjzg117xcdTAwMTXHXHUwMDBi2ffyd1x1MDAxYt8vNozZgJZcZoHIr4X7v+bO/m/dXHUwMDE1mf/WXHUwMDE5TYHyjn/WYDvPs4qwkmL6x7Zz0YdHXGJcYtTm7XSApSpEgt9cdTAwMTP2avHH+UybmCgy2TST649cclx1MDAxNTiLtZRcdTAwMDLIjEOLKFr0rl6DpWZvXHUwMDAyUnrZRItw1Vx1MDAwZf+K0/lbXHUwMDFlzHK16Jglj2f5sfvkaFx1MDAxMXjAbFwiXHUwMDAzwT1ccvFcdTAwMTOIrvtMTSlcclx1MDAxMCNma5igXHUwMDA0dSPLx8VcdTAwMTFNaabyY6i0XHUwMDA3XHUwMDE1XHUwMDA1JsFcdTAwMDWjXHUwMDE3Zlxuz1x1MDAwZpEwMLcppyW3RTi2703zXG5k/ls3tbHaTm3c1Vx1MDAwNpyij0p/xaPff1x1MDAwZk1YmIuLmXlcctFcdTAwMDZcdTAwMTiT8b1cdTAwMTl6lv2i2FpcdTAwMDSz4OVcdTAwMDc331xih7mylMLV8ZHx99jblSpZXHUwMDE1uUYwXHUwMDEwrN1MtjayyuwnLss064tZXHUwMDFlyPGnRzZemO8x+2M1IeCNvi4gjFebwqlLK8TEXGJOcaohXHUwMDA0fVx1MDAwNtDX3JtcdTAwMDNZWH99ciT7XHUwMDEzzmP4hS7MpHCclEw82flcdTAwMGKzyFx1MDAwZoE3kpbUpo1RXHJrJnG0VMo91Fx1MDAxNvutek5hvoIt+sRcdTAwMWScxEWumzVqyotzeGI9ZluzV475OYFFQig6sSrzRcvCniA6edniXG7Cz7uqcPbR2N1MSv33rVx1MDAxNeJcdTAwMWSvp4Tus+dR6KhGXHUwMDA0/CQhVFx1MDAxZM/Pylx1MDAxNEHxypRcdTAwMGKnb1x1MDAwMidlUlqKxjBcdTAwMWVcdTAwMTBcdTAwMTN79qjrt1x1MDAwN6CSYH5N7nz+vXYufury+c2qjeJcZty/eEYrK7ymUE2IjVx1MDAwNYR/uSNcdTAwMTU131x1MDAxZlZnXHKlafOSs+BTPGpqYedcdTAwMWJcbi1cXHmHcJlwn0W5XHUwMDEzxXOvxzHpT1wiXGZcdTAwMDEpuTRufk9cbnlo2JPO0r8/85foWvRcdTAwMTd2hvwqpXR+X+3rudxFetSHXHUwMDAwnOdcIpxcdTAwMWQ9717oMZ37dfJcdTAwMTLEuXltX5jr5XdcdTAwMTBa9aCE9X5cdTAwMWWgXHUwMDE5+c+GXCLChupKgC4mnjPQ9jDkXHUwMDFil9BvKJFcdTAwMDOAqptcdTAwMTXKXHUwMDBl10ZcdTAwMTOfvt7y4T6NLtze3kCpndUrzCtf8WCU2qJla4pz60NU65lZfOlcdTAwMTjbLH1cdTAwMGWmXHUwMDE27VxmqTFcdTAwMDU843BccoFcdTAwMTZcdTAwMTabp1x1MDAwNZbGfp7nXz64XHUwMDE1SrJ+/lx1MDAxYeBcdTAwMWbFYfJnXHUwMDA1+cN22HJcdTAwMWZRspVcYkCw876/2EHRWVxcLKyt7fNcdTAwMWFcdJNcdTAwMDBfjDdcdTAwMWEpz6+pXHUwMDBm4nS23uLsS21lfC6NsIDfdmNcdTAwMDUjq1xuXHUwMDA1LTA7QFx1MDAwYsA8NluiXHUwMDFlXHUwMDAyQcAgZzJtilx1MDAxYvxxm6bmrVx1MDAwM8uW/GSgXHUwMDAyvlx1MDAxNkgnxywg/ShlW1x040JcdTAwMWZcdTAwMTNYO4SHXHUwMDAxz1x1MDAwNFZWTYfUxfruueRlve7P96RRXohg65QgI+RuxIjeirFxPFvoIVKnlctETt1cdTAwMTFcdTAwMWZKzZQ0aERcZjGxpGRHXCJ1iUlcdTAwMDBcdTAwMDFe93hTodSSXHUwMDFmtjmjtf6tXHUwMDExi1x1MDAwNY6uz3HMaFpxYG1a4DRk9Ti/k43udzT5UpmYpvw8+oQq/cZcdTAwMTe1YW6HVtB/ryt4f715XHUwMDEwjuBZN12vTZriQb7LmFx1MDAxMD6GVV2PejProffb8diOIbp2XHUwMDEyS0tz2N2PuupRXHUwMDA2XHUwMDA18z1WXHUwMDExVZ5s2jWxXHUwMDE03ITEkFx1MDAwN/jQr8fH22voxs46LjVcbvk49bdipMyKxWytrfVsV23OncaoXHUwMDA0ViTFIVNYP6S4rUdcdTAwMWU+6T/B6SlJM75cdTAwMTA2Yy/8z9JcdTAwMWHX3sRfk37n3mu59Xwtf32qoCG6XHUwMDAx0r/Lwl0k5OVcdTAwMWVcdTAwMWJcYiezLX8565XPv6veaYbsI01bXHUwMDAx+K//lYCcisiDYa9sXHUwMDA02+yvXHUwMDA271x1MDAxNMywfEqOpFx1MDAwNfYkIcenaFxul9L0zHPI1O1cdTAwMDPiXHUwMDE3Li+rNCu9PZ5th9c791x1MDAxYk9cbiunttFcdTAwMDQg3rNXdlx1MDAxY19Mo1wiMbHPe/VcdTAwMWRdXHUwMDFkn1x1MDAxY0Tt1SuUrHp0ymapmM+fTojz8NM6+UpZq1x1MDAxNy6JujCZWurvYYs5SWnhtEHq8rKLMsdSqmyeS3Fm04TaR/uHmdtZyqqdrrFcdTAwMDDMsOtGQZVO6pQsPThcdTAwMWVccjd78shejJfAPXCovd5cdTAwMDBlXHUwMDA2Zvzb64XcXFxQrKajRnrJJof7eJpM3J+xXHUwMDE2XHUwMDFm5kjwN6rL7XtHeXE5XHUwMDE3XHUwMDAzP1qe16Jall6YVr6Ya138aMk3PoON/MNgXFw+yMZJdIRLXHUwMDE1WFwiUUY2k4jww71A4j5AKlx1MDAwN9oxoOZf67eXYIBHM9j+XHUwMDA1vbitOVwiXHUwMDFmR3og0cPHm6mCjFx1MDAwNXB3JfumsZA8Ro19XHUwMDFmV49LS1K+OzVai4WXOHoyULYz01x1MDAxZDnEUNRwRZqb2cSfQVphwlx1MDAxMlx1MDAxZLzbjtychkEx/e1cdTAwMDCUX2hbZlx1MDAwNYbiZOVnxMM8yqT7q/1VXHUwMDFmbVhcdTAwMWRmufgygPOCSyFiIUtqXHUwMDFm/upcdTAwMGUkUFx1MDAxNTRcdTAwMWWQ1Fx1MDAxY0FXlD6XXHUwMDE4lMq7nFx1MDAxMJFLIDJpvi8mXG4kee506cJ+V5Yq7Hk9biDHXHUwMDE5QDVcciqmpKOpwyRcdTAwMTR/zcyRZW2Lt4YvZk+J32Z2XHIvR9OHfWjoPVx1MDAwNMhcdTAwMWFBXGaho+W1lvzcrFxy+MY0zY7blq/5bdCk+z6xU5Xw5y8wa1x1MDAxYlx1MDAxNu8xxUPrvd7LfLM4Wlx1MDAxMZ/ILik7XHUwMDExsfnsqTw/pV/geOrLr1FVOJQxXbjdmPHsv+sgsapcdTAwMTnHVeW1+Pm1K52U/pOXelx1MDAxNoWTXGbNU7N4UqM0k1x1MDAwN9l0hJ+dLyc3T18sMOdccsOBzXlcdTAwMDP6fdT8aHxtzqdSkCxcIjkohIhFej18OodcdTAwMGZcdTAwMDazrFTsRa9u+Po3ic8z1lNcdTAwMDCkXHUwMDBmrjRDum/I6429eaD81N2d9TP+PcHuXHUwMDEwyqR8XHUwMDFlcX8n4tLpz1x1MDAwNSRcdTAwMDVXqCjMXHUwMDFl+1KcUTDcizp5V9EgzaODzmvfI/RcdEKcsl6waW/V/+5cdTAwMGZcdTAwMTONj7o9Oe/xajH+JJyMRY103r2IXCLV6zf6j2HtuMn8XHUwMDE1RPxmI6jlXHUwMDAxY1x1MDAwYottx+JxbJ5h1b+q9Ld1XHUwMDBm9tFX/ZCOPUuAdGrqSOe7ylwij7bw95u48Cs/Ktn3pipcdTAwMWRcXFx1MDAxYWHeJ/KWktfEuaxDmFx1MDAxMEtcdTAwMGVFsX7oTjHhirX55rupNFb+7dzhoURcdTAwMDE9Z7RcdTAwMGbtXHUwMDE3Vf/X+2J215VcdTAwMTJhXGbDLfR3z1x1MDAwN1x1MDAwZVx1MDAwZtK4nuTnhVx1MDAxMzLclmxcdTAwMDTu78KOevdz49b0XHL7p5VIXHUwMDFi2OonlPJUqFx1MDAxMP0jU38tlZkj4MlMXHUwMDE4JZ/CYUmxJFFvvsbvXHUwMDE4n1x1MDAxOFtd5kV78ZdEj77MSVx1MDAxOSq59/2MPYhcdTAwMDY/aIVK6DbWgV1IXHUwMDFhYyVcdTAwMWNLpzA1d1c7mPNcdFGf0ZRYXHUwMDAxka+7RinLcVx1MDAxYfHVWU7la2PSXHUwMDFkOr9cXK7zVSlFXHUwMDE0Q/D/WWtBXHRKxtryL4c9VD+CoP9cdTAwMTCUXG6rIETKfdilXHUwMDAzbm79glx1MDAxYlxiM1x1MDAxZVqtXHUwMDE1XHUwMDFlZrnXu2i2zJ9xoU21+mX6P5WizUjt2WewXHUwMDAwnXQ97/e1j15z8C+tolx1MDAwMWNTXHUwMDEydqSXjzFggtC811x1MDAwZfw/8/OGXHRf5CGX2Fx1MDAwZoqP/GGehuzA9NWd5nM59Vx1MDAwNlE7XHUwMDE3WLNo1m5NpnVrXHUwMDBlkjox2NlcdTAwMDS6dcCBZeGvmVx1MDAxY6hUoFx1MDAxMFx1MDAxYZT7q1x1MDAxZu9cdTAwMWQrWlmYMcLYNKVcdTAwMDeJLVx1MDAxM7BGcHvw/+9cdTAwMTX0XCLZXHUwMDFldallXepcdTAwMDZcdTAwMDDRfWFPx9/fuiY4XzNcdTAwMTJcdTAwMTV1Xst4/biiZFM41r+8XGZh9r9cdTAwMWE4REYmlK19/Fx1MDAwZTXL8l3vXHUwMDA2h4PLZz1cdTAwMTZHXHUwMDE0RV00MGR+XHUwMDBiXHUwMDE4icBccmya/Vx1MDAwMZG/SpdcdTAwMWE47zlmXHUwMDA1XHUwMDA2zTdgPJSPsOTk/iHNXHLmoUxcdTAwMWbxjbMr5ISb7djMQ77X5/7uXHUwMDA0W0BMfzH8U9zfXl+cXHUwMDEwIFwiws7Rr/Qo5tQtXHUwMDA1XHUwMDFjjONLRlx1MDAwZWpu699/k9RtrTei8aM0laTe6Fx1MDAxMKXEwbTpwFx1MDAxMGbxapA/3nVccvhcdTAwMDdcdTAwMDD/So+baSBcYubDVnrg+GAzXHUwMDBlcMhFNsjce/gz5KbHSy5cdTAwMDCW7ndcbldnleWlXCJcdTAwMWUy92JdwXtx/Ye2mlouXHReYIaCwSPFfb0/TUWJVV3y/13zxVx1MDAxY1x1MDAxMUB1rPlcdTAwMTNZIbJo8P89m9SlRo5Qtjx/mO/mkI+D3ClXXHUwMDE16Vae1vzXnkD+cWyiX1x1MDAwNVx1MDAxYe1cdTAwMTJfylxiLmmcXHUwMDE1XHUwMDA05dbFOoe45Zb/QvRQSotcYlx0x3TS+vk+fpRi+EOu87eWsdRcIuplY251ZT9cdTAwMTdF/q3F7q17XG5cdTAwMGLR6uhcdTAwMGL3Njdb2LdzQjJ2kyenXHUwMDEyXHUwMDA0fHRpuiqLpjS/55rJsPYkw1xm7+6iIXOQfTTMt3/XyZeXwJSPXHUwMDExI0ePh+LSTmw3LzE8Na5L1FhBXHUwMDE2iP/UXHUwMDE2XHUwMDFhuVxy4Gn7O9smwnRcdTAwMTbR3lg7TpFXtNc2XHUwMDE0xFx1MDAwMlx1MDAwM1XMWN2jXHUwMDBm0bl/2VlcXNNAXHTCXHUwMDAyZ+w6L+GgXHUwMDE0SrfaYPvxOZGygmhzY0JfiMCsPJhi/Uh/y0lmplx1MDAwNVx1MDAxYdL9XiB90XHVeMlDtVfuZXXIXHUwMDE3XHUwMDFlyLFcdTAwMDG6vzeFU/1cdTAwMTPzlFx1MDAxMpa6r/bmdVx1MDAxZcv38TBa6kTcWpg9XHUwMDFlTFx1MDAxMXK2g3PIvjVcdTAwMTZcYsE2cbe32P2TTZXlxlFkxcBcdTAwMDOZjkuImC6HoYYhJXbZhVx0sNi5qUE4XHUwMDEwZIbX+/HcKbSDXHUwMDExlmT1XHUwMDAzp4IzjYfXqt1Xmb1pVdRg0Nf3vPopY2tbZCk4oEU+XCKIsFx1MDAxYVx1MDAxMCSUnVvfLJ1Zhe5TaUCQVzTjVLYoKjTUVVZcdTAwMDdcdTAwMGYhXHUwMDAzvuNt/1x1MDAxM97fl1x1MDAxMTxcdTAwMTJdv+Bsq06rSGzGme5yuUY0KNqPqlpfXHUwMDAzYTnkJ0/Qu9XAynl5XHUwMDE35uevdW11yT0zQbYu1acu8+DfMZfBUTejr0lUWKN0WvfBxfX0XHUwMDBieESmn0YnSbg7S1grslx1MDAxME1LXHUwMDA29YbSmlx1MDAwMujIXHUwMDEw8qeLm2Z0/+05n8+aS1x1MDAxMMvIZsybzX+08MWH46jN10JcdTAwMTliXHUwMDBisNGG/L85ZTlcdTAwMGJmMvWTzS5NnaFBdZDjbXfAgagt7+GHhPRcdTAwMWZrZmlcdTAwMTld0CrrgkdmIeDmrMU1XHUwMDA1ery89/pI2DaFJWBcdTAwMTE+N/BcdTAwMDfkXHUwMDA09Fx1MDAxOVx1MDAxM3VNOH+1ml33s5I3jehqsq/AMmH4iTdcdTAwMDU875N37PJcdTAwMWJZXbXQ7Xd1cc+JPzq47Sq6qrPWWSFlz/hOMzRcdTAwMDUrOL/GseSgxFxymd2wyunY2/58Jtu+LZmhRX3HjcLaR+K1zry925/yr1eRJXN5fkDp5+CI0clcdTAwMGVcdTAwMWMz9jL1VlbsQutDZcOttFwijV3AmNFHpOf9aKpApq8jXHUwMDE4XFycPFx1MDAxZMvbh6DHRSDNio01rU1S8ug1XHUwMDE4XVq29XBZXHUwMDA1NFx1MDAxYiPfXHUwMDFk8yWpXHUwMDFms1DOsnKok2aEcPXnS4L2tKy0XHUwMDBm8eHRcXWsutl2tTNcdTAwMGW2vM5X28z5i6mtpLZei3rWV/3korBcdTAwMTifvFx1MDAwMj3y0fEqeVwiXG5CfLfGMq3tXcJcItktaIXfL1x1MDAxM/eANfLZKtEyOv//3PPTLeCJXHUwMDFjXHUwMDAxtFvRP7w4/Z2rXHUwMDE3er/axJ6EXHUwMDA2kldcdTAwMDfMylZL1WZbWYxcdTAwMTRcdPpGbFxizFx1MDAxMrklzWHPXHSgtNSw86I7XHUwMDA3t1KIf1x1MDAxZJKB3+DDkTjYwMo8OUKy9Oz7d1x1MDAxZZtDXHUwMDE4XfrGis4pd+tcdTAwMTW5t2+7NqfhnLnxXHUwMDFjIWa5jS4kyMu/3s82UObuR8koN1x1MDAxZZjyjNO4TbfteyfdXHUwMDEwTa7DTqtAcyWpifdcdTAwMWWkXHUwMDBinaBcYr5o1oNcdTAwMGJcdTAwMWJrW6P+yLyr488wU3R4Sbrzk72BMVa08VxiVlNcdTAwMDZrXHUwMDA0tmmgo7y2zlx1MDAxY3Dx49pcYpVcdTAwMGaDN82o/5pcdTAwMDckua8qgKJUk09SS1bEemZcZl6lgU1NfDCZJrXT839FP12NdvqoLS5cdTAwMDCLLtOcjye9XG6W+UlcdTAwMDWOXHUwMDFmXHUwMDA0ZmmZJFVq7kckXHUwMDE02Vx1MDAxOX893GqZiinbMmKlofRUuY1FmMLqXHUwMDBinvvZXHUwMDE5lTPKvz1eWeGgXHLRmzZcdTAwMTNz3Fx1MDAxMXx9nXvkb5zzz6KlSIxVpYmZ5Vslnjd64jHI61x1MDAwZUVcdTAwMDNcdTAwMTlnXHUwMDFiozTx4shE++8spUxi6njvemDWyOvYOMFJq5lzeWNMINfB8p5cblx1MDAxOeOJXHUwMDAz7YHsJ4n9u29cdTAwMTirz1x1MDAxZVx1MDAwN4GmOyPP/kjPXHImW9qDw9bGXHUwMDA1NNV7KpnQI5d0XHUwMDFl2K5cdTAwMTfLlYJMR2JGYLz0Zlx1MDAxZPGSx82PI7HFntdK7Vx1MDAxOSNYhJ2PjtKKUpfB4fhn9LaRspsowNjjIFaVf/KzXHUwMDBl9jhcbrVQVHGzXHUwMDExUTjOKs5cdTAwMTgkvNJcdTAwMTKMioxcdTAwMWKjzTJSR8FcdTAwMTNXhvtBXHUwMDE01lWq8U7+zlx1MDAxOZGtvNSHjlI9blx1MDAxYUWVZ1Tw3j+w2eHsT8yL73IlMrREYstas5VcdTAwMDRcdTAwMTmx/HNcdTAwMWX4x1NcZlx1MDAxN1x1MDAwM82cXHUwMDA1XHUwMDFmu1x0tGmLXHUwMDAwXHUwMDFhnfXsiG5RtUB3lsneS0b4XGIpXqWVYbpcdTAwMGaxfI6uTCqSapnZXHUwMDE2kD2Y/Vx1MDAxZIUzoP1m/l1YPY6eZIxxXHUwMDAywoZhisiSVvqYRvnd8/A+XqrSU6jNPYZsRlx1MDAxME+/9+1NoWl77/n68fFLtHza1eVkkfQvwsJlXHUwMDE2v/SCIaCG6UJcdTAwMDUwsK/YlcTt1mftbc1gNlx1MDAwNZkvT3sjMf7kJ+SLyFnVKMVpXHUwMDA3scCZ5Wiy+GMjYrBU6qiIw5hcdTAwMTJcdTAwMTI7XHUwMDE1m9D0VqzcJ1x1MDAxNHAlmpdw11R0XHUwMDE2s+d6hFx1MDAxY1x1MDAxY4/vPvNRZnl7pLW/XHUwMDE2bFtcdTAwMDaU3Fx1MDAxOS10lDraYapcdTAwMDJ5kJnaOpRcdTAwMWZ3xGtTSoQgebh9XrFZ51xmlyREibqyKqVccoxJin1ccq2S+9bMwrKKif9cdTAwMTJcdTAwMGZvkovb2cnmXHUwMDEw81x1MDAwM4xtXHUwMDFl6d3TmyBcbt1cdTAwMWZcbq8rmtLE4dpcdTAwMDatidn/oes8diTmkS39QFrIu6W8tym/kzeplPdPP6p/XHUwMDA2uN23e1x1MDAxNlx1MDAwNFxulVlcdTAwMDVRjIhzPpFcIlk5NuQ/9CuHmGb+zuq6Nlx1MDAxN4OT7f+7Nzn++Z5cbsOarKC8JJZmpOxIhWqTXHUwMDE3zLCprDL+JXJ8yk9hVl2L+f2ZoPkrvNpcdTAwMWO5XHUwMDE1XG5g6ERcZmDOtimEn5/Mf/mhvVx1MDAxOIDCUlxy4+rXXHUwMDEyg69p3cO4wqVXKlvGZIq57lx1MDAxYYlcdTAwMDOX5OyjWlx1MDAxY9M3zmVIhlx1MDAxONm3XCJR7zCdWjtGXHUwMDFkW0tcdTAwMWTlkclv63tyMPnNj+FhTPVcZnKfXd48gn5pxjLIK8wpW5dD+Vx1MDAxZmt//+L2VFx1MDAxYedvfz+nM4++Jsf51dNcdTAwMWI8Tq4rXHUwMDAyYsNaXHUwMDE5XHUwMDFllZGj03e8XHUwMDE35iwhnnnxycNwgXXOykiNvz2YvWBbqbfm3H7azTVJJqLXvleIvZzXXHUwMDEy13UzLFJcdTAwMWHXXHJ6r7+cXHUwMDE4vMv1L3tiXWdCf+tQ04BJXHUwMDEwzdJ4/S2V5XYzlIVz2EFbLvvMXHUwMDFhU47fn1NELz84NY9cdTAwMTkx5LyE+mH0nmo2+Mv8mlhcdTAwMWZcdTAwMTEy9cfiJlx1MDAxNOZ3oVx1MDAxMlx1MDAwZcbZh3EhOlx1MDAwMT1S2WdmXHUwMDE5XCKaddiCXHUwMDE4uZ1PWTP/8vzLRF5cYjlo2IyKQTAyssfpa3LNN1xcz1x1MDAxMY55SD9qUnp5raTK0o11XHUwMDEyRYVcdTAwMDLiXHUwMDBm01x1MDAxOar9flx1MDAxOdAoYVx1MDAwNl1e4t7stP7v7+ZsjpI6XHUwMDEyxTL8bFx1MDAwZpJcdTAwMGKmfPJhMo/lK1x1MDAwZsYjXoMt+IJcXJFUNsSr87dcdTAwMGW+dv5cdTAwMTa79dWIiFx1MDAwNlx1MDAwNpDT+WnJTs7s79iISbTs7zxcdTAwMDfNT6GM4Y/XJFdcdTAwMWFpcLe+9SPS01x1MDAwNZ/gXHUwMDA0RFhsNoIhNoZOKXHy9LlcdTAwMDWrKzRrgpDOc52iv4ai/S4rWSj2ays5tdCOWktcdTAwMDTlgXKPk9BcdTAwMDUtfnWe52fmhMVcdTAwMTevP1x0wyN97MpiWeU8L7XiXHUwMDE5MFx1MDAwMkw2j1x1MDAxMCxarURoN5etgY2HkNLmYFxuPreEnuRcdTAwMWOVR3A+l7nNmbFSwOhUpfH3j1NOXHUwMDAxheHI+1uI5ihFypOeSXz8MNmrc3J7XHUwMDEySy9aaVx1MDAwNsf5oj+1XHUwMDE0XHUwMDE2sFx1MDAxZrhXgYPTl2Uo2Fxu7mhd/bz3XHUwMDBiZ81L5lx1MDAwYuZcdTAwMDV9sqtCZcLXXHUwMDA2at54flFbY+yu5sfQkZiqcdGjikNh/Fx0r7eAtVx1MDAxNEah+r8+21mr9/dvb1xyJvrEKDyky2ek+a30XHUwMDE4XHUwMDBm/vxz/opo0nZQn9lH2e1f/PNfT1x1MDAxZnMnmzSjc1x1MDAxZstQO2v2nVx1MDAxOaiDXHUwMDA07ZScXHUwMDFmz5F1+fuK+qqaZ+q3OE5cdTAwMWXajlx1MDAxZeF4XHUwMDBiy7xcZlx1MDAxNDPuVKNEsdVcdTAwMDNlUPxcbp6WOKFDXvg28cNcdTAwMGVLn1RVq62gXHUwMDExyVtNyPxcbtlcdTAwMWbb17WQvVx1MDAxOVx1MDAwMIRftF7kq2iG8GbVz1xy0Vx1MDAxYcpvXHUwMDEwRkj2+vrLXHSGsbhmyKn/XCLvkGFcXDjUvTfJclFcdTAwMGagXHUwMDAwy+KFvFx1MDAxYVx1MDAxYrFLPdWhjfQ1XHUwMDE2XHUwMDBiXHUwMDFhk5+4N35Gu+5cdTAwMDSsulx1MDAwMVx1MDAwNJ+/olx1MDAxY6TPT1x1MDAxZKpoXHUwMDEzxVx1MDAxNlaHjFx1MDAxMCpD0TMzw1x1MDAwNmJES6pAujJwUitcXNj8g85K+LAqeMA40Fxmalxc1eBcdTAwMDCNpVCI2HxcbtViU2n1VCpMM4dkUKVEST5cdTAwMTX/clx1MDAxM0k4koGGU6CnT/16vZmZXHUwMDE2PISZI7C0vfeG6PrI3yayTmipo+jxIEvO65olhru90cBtyfpcdTAwMTfOTVuYWHJdnHVwXHUwMDE4Y0NHpHhaXHUwMDAyY/JcdTAwMDSsQ1xmcjxlj1x1MDAwYu7ty1x1MDAwZVx1MDAwYiHO8dVuOCzpXHUwMDAyXHUwMDEyPtlcdTAwMDBccvtJeWVHZJHpuYKf+XP8fGKrRIMlZ2/LZC+nds1cdTAwMTP0XHUwMDE4XHUwMDAzTkpHM/Dv0IijYNO9lz961rxcdTAwMTmAXsHwTIT6XHUwMDAx6LhOXHUwMDBlLVx1MDAxMViZiVxc9/eUzVF+LZ7TnZ9zXHUwMDAz+f66XHI+6Yztyjtao6644csupohcXONZ/0Viw1x1MDAxMDrn28hsXGK6wuqUnt+FW7QnZZBOoGe24XT4ncNt71x1MDAxN+lhscJcdTAwMTLVwOpBgCWZ8fMhMvXLN1x1MDAwNSqyXHSrq7p4Up6eg/lCXHUwMDFh4iY5REwwJ1O8NfcoXHUwMDFkJ3o6NH8wXHUwMDBlcE57XHUwMDA0tkkkXHT/v3pcdTAwMWJE/n9rzOWM10et85dSXHUwMDEz5+LDcVwipm8+g/SlIU/QXHUwMDE2N6qlg1mStes7rN9h0s2CXHUwMDEynEzlS+euXCKu/fYnXCK/XHT8oaSSiVfllHVRYqhcdTAwMTFvX77jYu3DJqXMv+5e9TBOYfLhq8jWXHUwMDE5OZ0j5oZcdDptN8m0NTibzGWLXHUwMDAzOXarzzClik3y2lx1MDAxM5EtXHUwMDA13D7dqDrdXG6fXHUwMDAwXHUwMDA1XHUwMDFmwVx1MDAwM8Nvh1HwQWGgcLcmXHUwMDE39JiwhiuRZ1g4r1Am6bV1luNcdTAwMDS2XHUwMDFjXHUwMDEzrI7AnCTH6L+5RchcdTAwMTFGf79yXFxcdTAwMDCFPa85ZNGo38ic8kj7ePlcdTAwMTFcdTAwMThcblx1MDAxN/iGRqCZyt+rPqsnsNwsoz9NTq+Es7RcdTAwMGWWv6b4XHUwMDE4eFx1MDAwYsJcYlx1MDAxOVx1MDAxZlxyfMpcdTAwMGUg9ZizqOFcdTAwMTMxXs607y3zR4WUu6c53SfgvvldasJ+Vs1H+/qxzzq+eNq0vzZcdTAwMWUgMj4llGx2OT680jV3rlx1MDAxZttWXHUwMDFhXHUwMDE560hcdTAwMWM4qyUwXHUwMDEzUNTRmaRcdTAwMTgs24UqeFMxz46iTaOVlfl7qcqrtI/q5J7EueJcdTAwMDFDpvjSMHo8xdCe7lBxz1x1MDAwZVx1MDAxYpnfTrxdM1PqajDGU4n8lvZ5XHUwMDFm1U33Y8DSypLioMz+KDJ3Lm1wXHUwMDEzXHUwMDEyKuyCnJOx4XW35t8pXHUwMDFmtflcdTAwMWKDXHUwMDE36ER94bRcdTAwMWVKUFwiPV+SXHKJtUpcdFx1MDAxY91cXNGBXHUwMDAzuvmtfJSsXGJcdTAwMDdcdTAwMDRBxudcIrr4m1x1MDAwZlx1MDAwMo/cqkQr7cAtXHUwMDBmXG5TrcePSdy96pBcdTAwMDFtY9Xc2lx1MDAxZouSh8BkpTtxhZRYNegrXHUwMDBmXHUwMDFkkaTPVJS8+IW4sG1Y6+p/z1x1MDAwYtBcIsf0TIXSZf4yhaZw1rZ8iar8tVx1MDAwMWY+zIVyilo85mjT6o4oR1x1MDAxNMf8Y2VBXHUwMDAzLfpcdTAwMTfGvJrO9Vx1MDAxZn/mXHUwMDFlU4jXkDnZ/UepQ/N5XHUwMDA1f1x1MDAxOCBcdTAwMWOVQL5wV1x1MDAxMUf3oHRccoSreNal015b/H5cdTAwMTMyTacxMUvwnXdcdTAwMWQ9XCJ6wyi9mSRcdTAwMTErXqPptYxa9dnOVfWrslhBe6FDNldj7+9Rm8I/JKBtz+I5+lx1MDAxOShbqLPRsbeLZVtUgzrcylTJ6yFcdTAwMTlcdTAwMTQpM4T8r2dcdTAwMTf82CfwXHUwMDE5nlx1MDAxMHQ9y2LGXHUwMDFhKD1cdLBAb0A2XHUwMDBlOVx1MDAxM9eb8c7N+PBi08Gn3jF9p84101x1MDAxMFx1MDAxNUWZfpw8amK+8mwxeVx1MDAxM5T5ibuWXHUwMDFlYvfeSHNcdTAwMTGRhy9TkoKl869lXHUwMDEwY1x1MDAxNDk67CEzl9YkXHUwMDFl+/KyXHUwMDE2lFxcTFx1MDAxMKONVoDEIFx1MDAxZLVyoYVW0dF4dZdcdTAwMDOhgVx1MDAxZsbatkGU8YzgeJwm07BhkVx1MDAxZJlcdTAwMDetmDJXR4d0ZElcdTAwMTi/M9dcdTAwMGKEtEGr7Kv9KtiiTO2+d1x1MDAwN8TE0NBqr2I4R5nhRiyPk1x1MDAxZSsh/yr8aXsrIVphXGbx9lxcJbdWXHUwMDEyq1x1MDAwYvJcXM7wTqVl+Wkgllx1MDAxYnpI6SNwn4r7lfPddlD3z0ixoVx1MDAwMauAJnTpQTQyOJdcdTAwMDZcdTAwMTN2XHUwMDFhmVx1MDAxNr4sPoxwY9ag7GckuYlcdTAwMWL082u7Je3LqPzqXHUwMDAwaqlJXHUwMDExLO/rKEe03JS4PobJ2SZHrN9cIlxmx1g/gFx1MDAwZaFo0d6lPMbfzk3PilrqtVx1MDAxMVi0/eFcdTAwMWX+iGtcdTAwMTZ0akZ2sd0xRChcdTAwMTK4ub5PKbaCu5Vl1n12n6tcdTAwMTn1h6HsXHUwMDBmMTDCsu3KJZZplFFcdTAwMTPL31pcdTAwMTSw9HGLN1x1MDAxNutcdCfEpDnqyuufR1x1MDAwM4pUqc5fXHUwMDBmhdlP6y2uqzTUVDGyV/ecefXa0H3wb1+elb6TjqOhTSVcdTAwMTaeNzBr8J3yIM8/tftm8qCoXHUwMDFlqn4919pcdTAwMDWdw2q3xjHjq1xmXHUwMDAwKsJ/e0pPf/nmWFx1MDAwNE+h3Mx028M55q+EUo5cdTAwMWLRvFx1MDAwYkirXHUwMDAwayD+YilvJmZzIbB4RlxmfVSl2phSXHUwMDE1x8nmhqbtNSfo0Xasn+Ip+0Nbk1R/XG5+y1x1MDAxMkJLiq2WOFx1MDAwN5tTc6LkXGZcYoxfXHUwMDFhosUs1XHdjnZi62clYlL93FF6IF7kR2dwqkKyeGTzLXFcdMFgXCIxu0G091x1MDAxNkz0NbWs6beHxlx1MDAwNdHO1mKxntHhv3l1XHT/lfRcZv8nM716WOdw8c+8M4dcdTAwMTBcYqOPXHUwMDE3+3x4jMlCjtFcdTAwMWSNXHUwMDE0iciZJVOPR8aAVN40XHUwMDE2elJqblx1MDAxNPNcdTAwMGbZN7K3i1GeXHUwMDFhl1x1MDAwM4BWUy7osMpcdTAwMDFcclx1MDAxMzyapVlz7tbuY7at3zvY2eVFXGJoXHUwMDExW1xiXHUwMDE4VJ87Vzx1rX5cclx1MDAwZjhcdTAwMGb4VHr5zVdaXHUwMDFjYlRcdTAwMWP1nFx1MDAxOV5nX1x1MDAxNrynXHUwMDFjMVFvwuum3ftnZbZUoJV9V7pcdTAwMDWmbcxcdTAwMTlUXHUwMDAySlfFsp/yi1x1MDAxMSYxdFraXGL6r1x1MDAxM3+1Osi+OKK0kDjKSdlcZkWvPJGrXHUwMDA3+dufgG5cckRsQ7fqUZXxzr/5QHpcdTAwMWSZ1upKgFx1MDAxMUeB/323yMrOKVx1MDAxOa39XHUwMDAxlTieMTb2eiXxSJbw87yLKFwiY1x1MDAxMlx1MDAwMDSqV2vkVlx1MDAwM7vfYFx1MDAwZXFFXHUwMDE3XHUwMDA1lVx1MDAxOCA62lx1MDAwM4ye3EKFglx1MDAwYsB6zI1M10bS/aaXf5pcdTAwMDK+ivPFXHRcdTAwMTlcdTAwMWXDbiFcdTAwMDYg++b5+rzF6mPEi4l3WuYkK2/CUTmDVc6kWFx1MDAxYlx1MDAxM/1cdTAwMGVw00B+2Lr2vr+8+caRyFx1MDAxYi3UffqXVc1RuchHxHwub9bNXHUwMDE2qy88w2pMbVx1MDAxNO3EVlJPXu05Tn5DooJalFxiwJKJkmfzhvnPXHUwMDEzuzzHXHUwMDBmcuT1Ot+BstHDKqstmH5cdTAwMTCFn6aqYyZLYITsIcZvIFx1MDAwMELrVF5gaLK9vXqHrfOnje6Xt+t2R5CempSXLK1ke21cdTAwMTK3bTFcdTAwMWLvLP63PVx1MDAwZnY/+yM6Z1DzPHNx3VvagFx0XGZcdTAwMWbmyzP3kb/M6fBcdTAwMTD5ylx1MDAwN1x1MDAwNtu0XFxwoVtcbkhTripCPq/QvnfQhvBHppaLZSSe7T1cdTAwMTDqypqGpVx1MDAxMOxYXHUwMDFiR4yNLrbTLMDy2S10gOxKtksh696UqK79LF98KvVcdTAwMTM29a7RuGtcdTAwMThcdTAwMWNcXFx1MDAxNPNcdTAwMTnFXHUwMDA1mnfPXHUwMDE03LZZnOFcYjLdWlinmntzjFx1MDAwNrpd4MawXHUwMDA1x1x0XHUwMDA1z1x1MDAxYWqRikdcdTAwMDddLnq3zFxy4NtcdTAwMDQs+lx0cjolqsM3XHUwMDFkWFx1MDAxOMY+3OpheIfAemIlXHUwMDE1PlJ4xVx1MDAwNsU4qsFcdTAwMDNcdTAwMGJcdTAwMTHsMm+Nf+/HZV/QLbv/z9z84s8+SzPizDUntY5cdTAwMWbRXHUwMDAzvZ8h2p9q2OdcdC2zZ+/GI2vtw+xcdTAwMTTGlEJcXGqz8GNx7U5cdTAwMTZcdTAwMDajweWNx5+m8Vx1MDAxNMl9rcbo9JLmmatQkZb9rFx1MDAxY1XVnVx1MDAwM5bXXHUwMDFkoLpR7FxiXHUwMDA2Slx1MDAxZFx1MDAxML9cdTAwMDRSVKDLgFE2ctFvzUo1VVx1MDAxY5ZcdTAwMGL80n26rs366kiaK1x1MDAwM1x1MDAxMKXl8JBcdTAwMDHhwuY5haCOx1x1MDAxYuFazu/l8Dg1I8Xd4ih8QvTkflx1MDAwNHtzS9anKlx1MDAxOO/x83Dbko71XHUwMDFmZ8Zb/q1dva9cdTAwMTlcXFx1MDAxYWsqP8/aXHUwMDAy8VtcdTAwMDTN6lx1MDAwNFx1MDAwZdj9gENcIiVcdTAwMDbw4Cz0cVx1MDAwNC5MXHUwMDFj9vBcdTAwMDWWkKFcdTAwMWb79Vx1MDAxNfOUXHUwMDE4fL1rSkFcdTAwMTlcdTAwMWIgWczRXHUwMDEwJneo/YvZRlAwYUtcdTAwMTLrhmLALD2UXHUwMDE5Jj4oXHUwMDE39lxy8vVccuznN3j4NWZ34Fx1MDAxNj4gXHUwMDAxXHQrXHLCzC/BbcZHNE1sVs1cYtyPLvOfqe5UmNnrXHUwMDEx4H5v2bfxXHUwMDE1XGY47G4xbYL9XHUwMDEzWFx1MDAxM1RcdTAwMTcplHXKz41qL0dcdTAwMTI494AgcFx1MDAxNyx+XHUwMDE2QYFcdTAwMDLD/UOzXHUwMDFj3aeJcTjFbVx0dlx1MDAxMr6pXG6x2mc8hXVcdTAwMWNcdTAwMDeajYhcdTAwMWbntFxcY+KS1f5cdTAwMTRWTJxW4Vx1MDAwM+jLaqmiQ2qjps45J+uL2zqqXHUwMDBlb6JSj1x1MDAwMVbWXHUwMDExbWjxJFx1MDAxOTThePRcdTAwMDBcdTAwMGVpno9B00/SkqSd0bjX3EQrXHUwMDFjUf1cdTAwMTNcIkHIcyC4XHUwMDAx9I03XHUwMDAzJ1x1MDAxOOXUU/xcdH2mXHUwMDFiR0FMdWhcdTAwMWS+3c8l92vMVWz7XHUwMDFkjj141Vx1MDAxYapdiWBKXHUwMDE1ofHGeYbdu1x1MDAwMCHCK1x1MDAxMGHHSUZcdTAwMTTzuTk3T4LbKiBKPlx1MDAwMoBQMVxy1PwhwDosiOBp9udcdTAwMWO7XHUwMDAzXHUwMDBiV1TcR+rss1x1MDAwZeNeov2Dxb/zPsyPiYpcdTAwMTgxy1x1MDAxOJQuXHUwMDAz/qUgOkp26ucsV9YoQdZ80bWgmVx1MDAxMlx1MDAwMYVUXFw+X6ZSTpXYXHUwMDAw+Nx6lznA2nran45ZXHKD8lx1MDAxZW1CXHUwMDEy5V/Th3FRjZxS1TQsV8vO136W+uOOZiQ/MXi02ObAMuoxOlx1MDAwMN1JvVng/qB7eVxiJmjhXHUwMDE1SWmW+lx1MDAxMVnjJ7BRiVx1MDAwMJzzgVx1MDAwMmWUIb9cYtTLpnZVYVx1MDAwZbak/Vx1MDAwM6852TCBebvjeadUzFCvnvhcdTAwMTZQXHUwMDE0XHUwMDE0hdtcdTAwMDVvLdQx9Fx1MDAwN011cdtfuamqXHUwMDE5dFx1MDAxMVx1MDAxY7w96aNcdTAwMTfBsSxcdTAwMWFcdTAwMDKQXHUwMDE2wOhpXHUwMDA3cC/8k1xySHk95rdcZiv8a2vqy9Xqt1x1MDAxZV1cdTAwMTHwXHUwMDE1XG6J/sxPycr3l1x1MDAwZut+bEvmNCQ7hPBcdTAwMTZccjlcdTAwMDWbLFxydU/05Vx1MDAwNSSpn4vwXHUwMDE5f1x1MDAwM1x1MDAxMlx1MDAxYT/xqKpcdTAwMTB5iKQneYu6Plx1MDAwMVxiT1x1MDAwM/lxXHUwMDE5JylTxU+Aqk6kQZptcFx1MDAwMEDMnN7rJ1x1MDAxNy3TkO1e1yb90Nh1yYBgPpVJlIjnO0TOSKu/mFx1MDAwZlx1MDAxN8lHQbia77pcdTAwMTDlXHUwMDEwie5cdTAwMTEogDNcboNJqo/rvOmgJW+o0sNcXDDzKc5GQ1x1MDAxYlWCj0GGnICGjVx1MDAxYlo3SeaUNiB+a/20+KewmGPeKOLD5Lhpb5YsXHJcdTAwMGJgyFxiXHUwMDAyiFx1MDAxMEBjrFx1MDAwMlx1MDAwMIZTXGayzujbXHUwMDAxcqp6XHUwMDAxN2BiSSjInjb4RXS78qU7fVV8I9yc4DBLz/Ejry1cZvKzJFx1MDAxN9qFSGCARj2e4UWYo0NAxDSps0mqspdoLi0njsmhJKRcdTAwMWRcdTAwMWZcXNS7XHUwMDExXHUwMDBm7XXbbFx1MDAwZpuvatTLU5WAXHUwMDE1eWvyhL+8zrjJPdl9tXjmNDpevv/sxPQkfL1skLxcdTAwMWbkxJ55tyTl0EXSryt7L+ufXHUwMDFlxOFC+lx1MDAxNPL+M3VcdTAwMThcdTAwMGZ2neSycrVd50i4+lx1MDAwMbqgZtHWx0BCvWW+i5/wXHUwMDE50Tv+RY+3XHUwMDFm9z5lXHUwMDA3VVx1MDAxMaHyOUHzoW5cdTAwMTWoX7lDXHUwMDBmedRHtkHk0P3OsJ+Pga9cdTAwMTAyQNHcW/ajXHUwMDFhJXWdLYVcdTAwMWLE7oEqXHUwMDExQeaVL5p/Qu02d61KsV2NXHUwMDFjOfiQlrT7pGNpQn2gvnTr96KWcuVImXktXHUwMDE4nsokhtthcTzfh7ROXHUwMDFjiLN4T9BtzVx1MDAwYlx1MDAxMMWiXHUwMDAzRW+56K5cdTAwMWY/XHUwMDFlRCjhl39sgVx1MDAxOV9cclx1MDAwNFxuXHUwMDAz8n6oXHUwMDE0XHUwMDAwxluzZVx1MDAxNZ9goE+yiGRcdTAwMGahbSpiqiBLX1x1MDAwMlx0XHUwMDE3g5nbwJ+p1y8+213SND58vLMgwFUgXHUwMDFkSlx1MDAxNlx1MDAxNuE+XHUwMDExfdRcdTAwMWRcIll22vAhUZZMO29cdTAwMThXqf+11UX4qcVcXJFcblx1MDAxY+qDdolpLbb6XHUwMDFie04snujs/tbLXHUwMDE48yDcklNFuue+/lx1MDAxY5FWXHUwMDE5+5u+6UtcdTAwMDWVKVjtopfg975sXHUwMDE3XHUwMDAzRGPmvWhFx7RN61x1MDAwZkFTJXZcdTAwMTBcdTAwMWY3yMaEXHUwMDE38dn87JbnMFx1MDAwZjvEn8PaJSjcplx1MDAxNjNXXGZM+Zyi7Fx1MDAwNMzLiFdmVnZIi4sojnZKWozBz09abThcdTAwMDVcdTAwMTGa7sivgziCdF79142Xql5njVx1MDAwZSBsbsxccpB9hoyPl39cdTAwMTcmg8hwn1x1MDAxNqM0ftUlcj6gkECvIS9Y5G1cXDhbKsz8U41cdTAwMTet/S04Z47QSF5cdTAwMWPs06dpXHUwMDFi4lx1MDAxN1d7yZfWx+RRXmKyrXuTZ21p8yhcdTAwMWTu0K1LiNgkps5cdTAwMTBcdTAwMWHkXHUwMDE3gaq+1CZkuXO7XHUwMDE0rencrNCEgIUq21x1MDAxM1xiiDT+TJSqUc9txeTHu6dOXHUwMDE4VfFBPbXJXHSltuPOMnFMXHUwMDAwqpy6amtYpv76aEJVXHUwMDA3UFx1MDAwN1vbzcGl3PSJlyeT9HtcdTAwMTNcdTAwMTY7si6g8rVbkVRbZFx1MDAxYcRcdJM+49z0XVx1MDAwMJHV82+ParB6Qk1V+YHF3ci8wteDXHUwMDA1drHaRkvqXHUwMDFlvsxv5bFZRFx1MDAxYSngReUlPJD3J678RSOhlDZcdTAwMTm4Pf9mNj9cZoVP4982P5xuXFzSXG77m8fqiq0sm2poY77M+Ve4XHUwMDAxTE156Fx1MDAwN2dM/7oyyv1cdTAwMDU/queRPTSbXHUwMDFiXHUwMDFki1x1MDAwM3ZcdTAwMDLIgjCsmlx1MDAxMkRGdDqSiYIkLFx1MDAwYiYxXHUwMDFkJUmYXUdV0FlcdTAwMDIzQVrnREGR68Vd8Gri0GRwcX0oYCzhtmNkO1x1MDAxYYlFk8n/3nRl/q2lXHUwMDE3zupcdTAwMGZ32sxv6L9ayqUmXYfQgSfRx2fJXHUwMDEyLnVcdTAwMDRhhOvi7NFcdTAwMTJe75j8UFx1MDAxYvC3s21eXHUwMDAwXoJ3XHUwMDFj7z5DqGfmmWA/c7qhXHUwMDAyXHUwMDA22n9ZXGba/Vx1MDAxM7fTXHUwMDBmRYP8XHUwMDAzSVx1MDAwMN3cayU4cuHU4ithXHUwMDBmuSDh4lx1MDAxNlx1MDAxOKQmeHFcdTAwMDdDKFx1MDAxYl7BSotH+lx1MDAxM+PhXGL1d3YlgdiYzvJcdTAwMGX/XHUwMDE5XGZAX1x1MDAxNcKmdNRcdTAwMGJNweWd8fvhm1IlpH4wRUYumt1EkFwi9iBcdTAwMWJY387acz2N3N45XG7Tqs6bi8KUw77PLVx08ZvBJFx1MDAxMjlHjFx1MDAxMp87pPrVfFxujS7s5Fx1MDAwZlxmI4e5ZORdXHUwMDA3XHUwMDAza3AjsWE+b1x1MDAxZt/uT1FcdTAwMDL5kGGYw454XGbzc/61ncKk14xCoLy/RI4ri4y0aftDXHUwMDExXUp+pmBP8nBcIt255/b6b55hpktvXHUwMDBlcmTR5lx1MDAxN1aGydWQrLTqLVs6w8Whr0iLx4G9RXtcdTAwMTitLFOSkOOmX+iIxbJtgv31XHUwMDAzSHg5xpfIMVxyXHUwMDFiuKlcdTAwMWO/nTZ+2Vx1MDAxOXKnk1x1MDAxMIJcdTAwMTlcdTAwMWJcXCT2aVx1MDAxZZBGriGdmaphXHUwMDBl/ZpcdTAwMTLGhfpylsD0N+Pkhs3RZ09cdTAwMDJjz4NcdTAwMDQ8pnBcbq9IxlS4L1x1MDAxY+lwXG5cdTAwMTdGtm5rX35cYuZV2COcNcNcdTAwMWNqUOtcdTAwMDN0sMJcdTAwMWVFe7ydiVx1MDAxZbFcXFx1MDAxNFxy/1x1MDAwNleyXHUwMDBiusDt/WxcdTAwMDFcdTAwMTIzXHUwMDEzim3TSzriPjOPioXcTSos2uvQ69fz6Mns6DFv01x1MDAwM8GBsO9cYtvPw1tcdTAwMWZcdTAwMDTAgO9ioUpB4vibRWJcIkgwOFx1MDAxM1x1MDAxMVxcmCnQhlx1MDAwM+pcIneMSIkv5bvs7n+MgzVxMVdcdTAwMGKbXHUwMDBlhL+mXHUwMDE103ZfXHUwMDAygtFcdTAwMDBaXHUwMDBiulKZtZTnXHUwMDA1zlx1MDAxY1x1MDAxY2u/OU30XHUwMDFknirmkSnRXyuIXHUwMDA1mlx1MDAxY84xXHUwMDE20cmCPq44aqGv+Vx1MDAwNMFuQOuf41x1MDAwN6h/z/rxXHUwMDFjPvHgXHJjP1x1MDAxMLjj98bO1UI21tFcdTAwMWYmgY3Zr6U9rThcdTAwMWGO/J9ylEDb5GaxZY2g++BcYn9qb3e2KZFcdTAwMWSm2t7Rs6b7fv0+kudcdTAwMTTQgb579qZ8qnauiSZn6dDAv8RXx1x1MDAwYpBcdTAwMTJcdTAwMWFcdTAwMTSerlx1MDAxODhiteyAn9iQsY3KMUzl4aw75L5V/5/1tqzrOX5cYtpBSIBDraZcck7uJydm2Xh1NIhcdTAwMTHZ0CFJ8MCYdOfVzlqW9Fm8iEeiXHUwMDFjbIeh+ilqb1x1MDAwND93WVAtelx1MDAxYeP3vzWPcbXx82NGVv5MsZ+cncmc3D132lx1MDAxOYRcdCNuhI21jW5cXFx1MDAxOSqk7jSglP+On7LXgq97XHUwMDA0XCJcdTAwMTPixpFcdTAwMTgmoa9cZlx1MDAxMmHmK2OY6NH8jYpcdTAwMTlcdTAwMTN6ZoI5I8d5iVx1MDAxMlFs+sFFdTWppWFcIpvrXHUwMDAyzVj34E99UTBcdTAwMTVcdTAwMWFcdTAwMTNcdTAwMTdYLzaMXmTiwePrQ9Q8Klo2VFKenOs6iFo1L1x1MDAxYlx1MDAwYmNcdTAwMDDUxt2whmPSXHUwMDFiTs7Mf2Tz5mBcdJBraool/1x1MDAxYcVcdTAwMDfRn+TBWMC4eOdcdTAwMDdVRq3gt1rbVXK/VVmRXHUwMDE4eX3JftpcdTAwMWTOXFzGhZzphVx1MDAwMlGaXHUwMDFlgGcwzqyq0LBcbqCIw1i0oFx1MDAxM1x1MDAxZSSHRWFK27DZrWdcdTAwMGJHr5qvXHUwMDA2vyRcdTAwMDO9sUNcdTAwMDE1bdio+uXKhTuB6PtRXHUwMDE44d9ayPmKrpSM2Fx1MDAwMpOVilwiZ1x1MDAwNVx1MDAxY1x1MDAxOEdNSTlcbo15zHvtjcS2XHUwMDAxsyzxZL54svQyq1x1MDAxNERRjErg87oyelxym59cdTAwMWPo+p/lgJO+lbBpXHUwMDE397HPWTtcdTAwMTJfU1s55NDVZFScuG/bZ1xub7VcdTAwMTiPgGKnMcCpl8dFq8JYS/7BpYGfl1x1MDAwYtCYfvaIN1x1MDAxMiCtnkcrP6h7ryVku/Z1ZqLu21lcdTAwMDJBYpBAqePqkDu1OV3XXHUwMDA1X5ohMOn90ydrR98rsU0nZN89Lt7XRO36vZVcdTAwMTlu6ZdYdKT/5e5hcXHlTCN4Zm7hmntx4Vx1MDAxOf12Nkb59dDON8P2ua0g86xl6lx1MDAxMFXGQ4j5wsVAbCWfY8hsop1cbsbkXHUwMDEyXHUwMDFmXHUwMDEweCNmRHSa0S7Mio1cdTAwMWOSXHUwMDE225FcdTAwMTh+tfjczFHjSJDTxIQxm4S6eb43XHUwMDAwoLcw/yny6lx1MDAwMihOIYpcdTAwMWYj0bJwysAkzYL7TJPXfGdcZqG4X+2+Y0i3tFx1MDAwNa73alx1MDAwMaXiXHUwMDA3X8ZcdTAwMTZ5XHUwMDFlVc9/XHUwMDFmR4U1dFx1MDAwZa1fgWWYj++ygVwiXHUwMDA23co6nNV+KtqCwN0gX7GVY5Uxoi+rs0x+UiCZ/Mw1fb9TXHUwMDA3i/qpMMTQ2JHTZVxigTKAXHUwMDAxW2CvrCaJIH5ooW3rXHUwMDFkXHUwMDE3guSn11x1MDAwMKchMiBccmI46lx1MDAxM5xlI9d19F2xXHUwMDFln9Zmhv+7WaubeVx1MDAxOahcYpuUrlx1MDAwMHONUamOXHUwMDE2vZ2gQWbYcGRcdTAwMWVcdTAwMTVNIHo6f/s7Olx1MDAwMrtcdTAwMWMjXHUwMDE3znHVvFx1MDAwNZjuoe9cblx1MDAxN4RsYG336qlGj1xuyENcdDMjtYFcdTAwMTJq+Hd43UvpgiNcdTAwMWXx2P3E6IJhjsXpf+pcdTAwMWFcdTAwMDDyltzNYuP/k0tBXHUwMDFiQsGHWKjj++xcXMGHXHUwMDAyW1x1MDAxNUa3c4xcdTAwMDPFK1x1MDAxYrjALavOTuZcdTAwMTZZPIhRM91cdTAwMWO32Kty2+dFkPgokGDT0Fx1MDAwZVxiSkiM/Fx1MDAwMmI+8NHHVz7AuUZYJs1EqFR7R1O0+FtA20xbtVx1MDAwMbg8XHUwMDA3XHUwMDAwbkVCUr2WXHSL6UbuXHUwMDAz4Fx1MDAxY9O+8vGvbV7lOlx1MDAxNlx1MDAxNILjXHUwMDEyx01Sri+YXHUwMDFlxVx1MDAxZrhzpqmEyVx1MDAxMeP3XHUwMDBl5oThpH7119ImXHUwMDExLS6p6Jl+ecTJ0bhT2XwxXVaMXHUwMDAzZHizXHUwMDA2y1xyXHUwMDFjXHUwMDFkhPVcdTAwMTknSPlcdTAwMGLWrT3QmIKOxvqMhsEh9d5qXHUwMDEy/oZ5M8+LmCZQ8Wbt3uoxIFx1MDAwNC+vnrCkb9+vuL1cdTAwMTf89r9HQPlcdTAwMDGzjIeNYcFUN5NXg5tjXHUwMDA2KPlcdTAwMWMyi6zd1GM/oVx1MDAxMqiFRDQjScA84rtTL1hazXqiXHUwMDEymWm5QCsnmezSXHUwMDA1P6Dwq45jaufaI8FNye57ZM3Uc6ZSNeyTXHUwMDAzmvnIflx1MDAxNFxceLRcdTAwMWWkWMRcdTAwMGXhPfNE7n1onodcdTAwMGJcdTAwMDNgXHUwMDExkWRF/5xcIrBia9vOpN/TXHLoWpyU6Zm5rZRcdTAwMTElwFx1MDAxZXlbIUwkzIO6f8fVLj92XHUwMDE0v1LgenZRj/Fvu9bIO4y3uoNA3lX5OLJcdTAwMTZGXmS0sq1cdTAwMWSNYsEz9XhlXHUwMDBm3Vx1MDAxN+5SXHUwMDEya6tX0EevXHUwMDAynPyKzLDMV9dcdTAwMTBcdTAwMWJcdTAwMDJfcI88ebHpJKBRNVrxT7NbXHUwMDE30aO24kdcIunx/ltcYlx1MDAwZWdcdTAwMThjS/W6zlx1MDAxNaqAWGs+OYnMoyl/WIzmIXF0XHUwMDBi2L/XSfjXpzNcdTAwMDBYVZMpsiqBlCb5Yam/RaHd4Syj7lWcXHUwMDExbYd3SnQzUnbUYeqXYf6nXHUwMDE5XFz6kVx1MDAxOIbpXHUwMDE2XG54XHUwMDA0kVbGQleMN/7xPVx1MDAxZVx1MDAwNf1RXHUwMDE5LVX/XtWONUJcdLefLdlcdTAwMDApv/hjnuAokphcIqBcdTAwMTFV9PRzqodcdTAwMWa3XHUwMDE2r1x1MDAwMiy6d/bOXHUwMDE2ou2KVkDh/DB7dKCy4eaGh3OXOdd/7SfR5Fx1MDAwMKBZk0ZDWDaCRdi8h0dRQVx05s9cdTAwMDS651x1MDAwN+J4S8W4emRCiPh8Xlx1MDAxOH/kp0LfmGKgXHUwMDFmhv/FVMT9TftkP2K90i9anmpqXCJmLDlcdTAwMWZcYqFDXHRDs5L/XHUwMDE2u335T0ZSVUeiXHUwMDAwl2OYw3hcdTAwMTCrXsT5oNhDnr0hbd4qXCJu0lxi4iY8K8fmVSx6rkQnR1xcpUvzalxm75YqJnOEXHUwMDFlnvjeZJF8XHUwMDE4vG3rkvV0XHUwMDBm+q1O9ENcdTAwMWbNXHUwMDA0bpRcdTAwMWJR9DhEeWUsMqUpXHUwMDE3wFx1MDAxMGDt2rDzy1x1MDAxNDdzoLZka1x1MDAxZf/yxFNFSl5FXHUwMDAzhVxuvHnCVYW45c6Z00VcdTAwMDOXjaFcdTAwMWPJUIltjlBXanpcdTAwMTFC6qs//Vxuv2POLtnKX1xigbJcdTAwMTFxw1x1MDAwNIZcdTAwMTFcdTAwMDAxUFxuXHUwMDE1oVSMg6SxXHUwMDE02zTaWlaBrVx1MDAwN+jRME81bqL+XHUwMDExaDMnfyA+ez1cdTAwMDR7SpFHry+G+ttFiuB+pkSWYcxzkOtcdTAwMDN2MilWXHUwMDBmQlx1MDAwNUWjQjdcdTAwMTaE2tJcdTAwMWN6ZleX0HmdbFhcdTAwMWS/nI/Mc6OZ2dTif+Jcci1xxFN3wvDJtILAnDLOZbf0XHUwMDA2SW9GXHUwMDFl3GP935rz51x1MDAxZkRf8Vx1MDAwNU4uoYmswFx1MDAxOdKscFDolExK5Tl7qdNcdTAwMDUlfn3rwil4Mox/pzdyqmAxXHUwMDA15roh0iOzXHUwMDFi8cYu+6HZw6iwkmVcdTAwMDWX1Fx1MDAwMTadbVx1MDAxZj+b81xmqXmLZ/dpaVxioJGFc4ilP/XBq1x1MDAxYnmfklx1MDAxYk416besm2pP4lqP8uZ9W1x0cp1cdTAwMTdcdTAwMTA+KF5x/KX0n6Oneii6lICHQ1r3XHUwMDAyf5K+icfOzubs59/+mTG2m4YuTlVyIThhxVx1MDAwN+pcXHo3Yd7joHBbs2Aoplxm7Fx1MDAwMVc805f3XHUwMDFhXlhksidcdTAwMGZcZpDG5Vx1MDAwYifJwDZcdTAwMTCJiirJ6tasO/BcdTAwMTh0oFx1MDAwNOajXHUwMDE15IrW1yOBwPVHqE71LVxu2Fx1MDAwYlxuulx1MDAxY1m6g8a5XHUwMDFmv1awtI+X1pLuw34ySfbvbO+gsiSpwFx1MDAwMGiQszegiMdcdTAwMGak0yT2huTEzTWGMpoy8yQ8iO4kIT5cdTAwMDF/PNVcdOpe+9tcdTAwMDTH8n7AdMJ2gCppJufWt1x1MDAwMShd1Y2wkylcXHTv2EIoXHUwMDEyMdJvl99An9MpZ0LJ2+uhXHUwMDExp81dXHUwMDA2XGKjQen3N1x1MDAwN7KN0Vx1MDAwNje7viDAKeY4SclcdTAwMDNFXHUwMDE2YZSbKWshNsrnSVx1MDAwNzRIWSukXHUwMDFjb1x1MDAxY8f9XHUwMDFh2N+UaVxmi5LyP/JS62nxdZlcdTAwMGLlp01cdTAwMDJcdTAwMWKIzkTLSlx1MDAwZlx1MDAxYXm9vldcdI9cdTAwMGWjp7g9KGU+w02weJfWo5G0dFxuYb/A6y/E96hcdTAwMDGmooXka/xzx8KDXHUwMDE233JKIFx1MDAxNDchOrlRmNa3xj0y46rX3FDXmYvPpOo9XHUwMDA0uErvSl9/kO+wi0hcYv9UPFqBVHSAXYQ93XaqiNZefFx0XHUwMDAwWK6q1lx1MDAwNNlVlCt4vX2hN0CZf288/2HFk6b5vVx1MDAwMlx1MDAxNdxhNDdMi/959obD4+mySEA4SvQ7JnGk78dQ1K6Vt2N/fYbJUbw1t0zUXHUwMDFiXCLN/lB0XFxcdTAwMGavx2xcdTAwMTF90N/DO82cpWLj3tLv7CSzK59Umnjz1p5cdTAwMTZcdTAwMGUzKHaufe4u1yvjXHTfV9/v19HgaVx1MDAxNvhGTaxBs5Fa912w9Fx1MDAxNu6SdsFiXFxjtXJcdTAwMTFPk6RCnGYrzk1cdTAwMWJnfEH8soFcdTAwMTTRV1FkXHUwMDAxRPVjXGL+yaReVe35wYwud+ol/DKZtV2Q//pRMyco7MIoeltkyz7+XHUwMDBlnKrwxnJcdTAwMWWqcOfTXG6xXFxBXHUwMDBlad/LlaDpXHUwMDA16IxxXG47XHUwMDAyQdfS03Gc6Ys90k9cdTAwMDNqyF/qPlxccD7krufWtFx1MDAxNa+9X5CbXHUwMDFkgNeJR+RzaetcXH9NXVx1MDAxNVlcdTAwMDf6JHRGXHUwMDE57ciAhVx1MDAwMOz2vNouTCNq8iYn7L94xYtcdTAwMDTj19DIpl3srvjM+FFJXHUwMDBm2suiIHdcdTAwMTGYkFx1MDAxMpd9vvRKgb1cdTAwMWW33Fx1MDAxN5KA/UTMzTXON849wD7WXHUwMDA0lZtcdTAwMDLMmKXV6slRXHQnLrXIlzH7+fi1RoQwXHUwMDFkgbvSca5cdTAwMTVcdTAwMDDWjSHLU1xcdyiSMUBcdTAwMGVcdTAwMWaUN1wiXHUwMDAwXHUwMDE05G1ba91cdTAwMDK3z/rxXmCER1x1MDAwZYtcdTAwMWMw6sW2IVZQxdjYPuivI/NcdTAwMTSl0kNGfoiqXHUwMDA36HNPXHUwMDE3p5dcdTAwMThngknYcIV8pSe0guWdXHUwMDFlXHUwMDEztdtzndDVrllcYmCe0CVWsGm4fMBxmyBXkaDivam6LT3SY/OT5WGFPo1cdTAwMWOcXHUwMDE48eouYGfWz85EzeuW5VdcXDS9Pb5oeY1GysHRoa7qXtdcdTAwMDD/b7B+myO5P1x1MDAxZWd5l2JcdTAwMDJcdTAwMTRoL0akXHI+pslccv17nrRp0eGp5yw4c0B9XHUwMDFm/IBYprnnOsvQu1x1MDAwN/lgjlx1MDAxN2+GsVx1MDAxNeH71Z5Hqb9wguHxdGPrJ8NcdTAwMDFxP0Yp0489XHUwMDFjXHUwMDE4PSrYQsAwz6FxsIK7Vs1cdTAwMWWTXHUwMDBior1plant58amhWz5rfpDn4LhzuzLxFx1MDAxZlxmSCtcdTAwMGZly+vTWveSfJu7uV9NkILkeP/yxXNUUjGbXHUwMDA3SOGLlFx1MDAxOVq6n9H6SVx1MDAxOGt9XHUwMDEwa1x1MDAwMuLN4TTvonyZXHUwMDFjXHUwMDA3qWlcXOvYv2WlduFYfqVIKkZVtEBcdTAwMTOiXHUwMDBlXHUwMDBiaX/8XFwsUkxWiZPn4OJcdTAwMWbxXHUwMDFlbyDldflDymazb+1rjtVEtq2I25jxink9bZjXXHUwMDBi3lx1MDAxM3NcdTAwMDPlg1x1MDAxZdVIXHUwMDFhXHUwMDFlfFdcdTAwMWbtZWfS0Utcbl9w3lx1MDAxNj+F6PysXHUwMDA3kCuWrn43WkTNvaC19W1jfVd3nqX7XHUwMDFj7Zr6XHUwMDA0r8GH0FOgUeRM/7wgjNp3xVx1MDAxM0z/nVx1MDAxOFx1MDAxMVx1MDAxYlx1MDAxNbUnXHUwMDFhV81cdTAwMGZdXHUwMDExT7bKpVx1MDAwNqU8YkSWXHUwMDBiI8G8JsK9vSB0UG7CqcWzYFx1MDAxYoRXk+mk/Vx1MDAwNT1cdTAwMTVFzvpVmJeD2zHYebmdglVUN1x1MDAxYktef1x1MDAwNNvdYMJccr+KV2xcdTAwMWOFXHUwMDFmXHUwMDE1uFx0qFx1MDAxODE6i4deYVx1MDAxMexMcj2/4OlFcl7Ni6OmgKiq8WrQddCtwdH527/vb7dcdTAwMDPMRnhZXHUwMDE4+O5uelxiP1x1MDAwMnKlZC739lx1MDAxMI2Tvl48XHUwMDA1u19TX+N5V7flW75bWFxiXHUwMDFjIzhcdTAwMTdcdTAwMTFwPNN9kFx1MDAxZrBcdTAwMDNcdTAwMTLFyzyzLG1k2FFQXHKVXHUwMDA0ktFoT1x1MDAxMmFBmdcjXHUwMDAzJ3VgPGrHY0xcdTAwMGZcXLhk0CXrflx1MDAxZFfC6kchRSf5fKvYXHUwMDFl0YLKXHUwMDFh/6nEjt/La/hcdTAwMWKiS1Be9UxcdTAwMWLSpDrMXHUwMDA3+P98XHUwMDFloijvXHUwMDE1jVxmt48u3cdPLbEjK8d2geHRLX5WrVx1MDAwMaddYMUg1184XHUwMDE0XHUwMDA0gZar81qLl1x1MDAwNciio2RtX7iVZ1x1MDAxZs9cdDBqJTLWzf7WfjMhZ7TnzMClkpRcdTAwMGYpUFx1MDAwMFx1MDAwYudcdTAwMWZhUnvBXZptVlx1MDAxNIxgaFx1MDAxMH00pFx1MDAxZee+3cVioKBcdTAwMWFZvdFtP5BcdTAwMTFFuHHY8/2pk4AygaRW0Sh0N2Z2rF8+pCHL2Yqs8/Q32zL/5y1cdTAwMDNcXDVcdTAwMTErxNSAadeb5pC3mraeXHUwMDFiumVcdTAwMDGakmWAMNAwZr2SnjNcIlx1MDAxNEBcdTAwMTX75HIoi+3eMNtcYsmnu/6UZeSOIKDBdlx1MDAwNYCSbDdtMsdh/FtbdSe5ZE27IZ3ZXHUwMDFkOnk3RTza73t3XHIkOXaVXflcdTAwMDR4ZG35sJ5cdTAwMTn6stRcYmyW9WPeXHUwMDE5XHUwMDE4TTK0kf1w+VtcdTAwMTQvuVx1MDAwMcTCMYf2XjP1KuhcdTAwMTCX2fpMakhcZlx1MDAwN7hcdTAwMGY4RUe5JoNvTmCWhzc7P1x1MDAxYS5WbZY1XHUwMDAzbZH/YjZZPZNcdTAwMWVcdTAwMTLgJpFoxPA3XqlS57yuvmSHWCFWlJwvQ1wimtM07WohV1np4q3INHhcdTAwMGLcXHUwMDE5r6ZefM1pQaO4bnLqVdEmM6K1XHUwMDBlgEg4aUCqk24jgW91ScBolGRVroFGcONcdTAwMDE7ro3uXHUwMDFj1lx1MDAwN9Y7vkPmwpQoXHUwMDE2VaM6OmEh2fUjYK6sq1xiKVx1MDAwMPTbTb9UJFx1MDAxMFJGSmxcYlx1MDAxNoOFPLYoPpqkwuqhJcxIVulZUaVRbkZlW1x1MDAxM8rb4UW1P/9hyMi4UMCPZ/tU/mNcdTAwMWUl4ZnP94W+ZfH5dP/WXGZhj3OdQIbQNtzI771/j5J5XHUwMDA2g8HqTsZo4edMXCKjeDp6jFBcdTAwMTfddsuEv8SX18CPXHUwMDE4jeW2xX/bXHUwMDFiONGEgr/lXHUwMDEzoftAtLSIL4ZcdTAwMTVcXFx1MDAxYmlcdTAwMDPU/tBcdTAwMWVcdTAwMTaR5pax0aeWXGJFIzNu51Q6Klx1MDAwNceYNFh7XFxcclx1MDAxMuDrID7RTdXTqLCvJmatXHUwMDFkuoug07vVpI6V8Vxiwlx1MDAwZn1xYU/2d56trI5JXHUwMDA0XGJcXNgkQv7sIbbVdLG67F/e5i9GdVx1MDAwNpjmUCdhXHUwMDAz31I1zrpf2JeEjstFRy3Eft/8ul7eMpnp0DVKylxiss846qUuviOkx1x1MDAwNFx1MDAxN3XXXHLJxNSIcqq7dFPH7Vx1MDAwNyOGkiqOucqAWtbVNFx1MDAwNLGYP68kXGb2fnVRpbRo49NcdTAwMTjhVO5ujLVI/0wyXHUwMDFmiVGNo+YoXHUwMDA1vmxuhjSuoFxyUlx1MDAxNniQrVx1MDAwNXG3WIfLa1x0OyXl4Xo0fypmPfy2ylx1MDAxMdJOV1x1MDAwNv50QUPJj1x1MDAxMlx1MDAxYYSEW99HrsNjiK3WXHUwMDEyydxDhjlcdTAwMWbwOdckNOh1gjBAVCR9tVxcjqlTesdcZpF7yX+3wPcq9CtcIsmj32TIp47exDBcdTAwMDLK46bUXHUwMDFiJMuw5kJcdTAwMWRhR6kwSlHkp8P6XHRcdTAwMDY8Tn8rklx1MDAwMSRqrqrOnZ76qdzok1x1MDAwZivkXY8y/d88r90xR8LrXHUwMDA1IDesv7um7I2/OivgkMHMwYshXHUwMDExXHUwMDE5lFx1MDAxZTR2QG/957XKmCc3UT5cdTAwMDA+XGJqXHI6dO5xzHtUfcDBnpyk91x1MDAxN1x1MDAwN0LN+3b9m8ahXHUwMDAxh3fqat/Pon5cdTAwMGau+7FHO0l1eMW2jzpowympZV9K7cNcdTAwMDLpXHUwMDE3STQ1LFlP7peiMjJYiz5XfYdcdTAwMWYxmztyUZklNrXYXHUwMDFkrlx0ZZtcdTAwMWO0WX23KtOK68FHOalcZmWFm1x1MDAxZko5/32O5p95XHUwMDFhpnZHhdnrgJxY2T3i+1x1MDAwNd96+X5EUVx0Pj9yxr1cdTAwMGbVvvc35kLX6YpcdTAwMWarKXixzUEtmFwinKDsXHUwMDEzVzD2SZrrZorkzLFl5rNJXHUwMDFh9uPadf3XbFxydVxifsspjIH5XGZ6e+CPVGzhXHUwMDA2pNLfn9Apw1xijmNzfU19hangjZBUxVx1MDAwNELfzVx1MDAxMVx1MDAxMVx1MDAwNmnpgU160tVUwVx1MDAxM+724Fx1MDAwN2BMd+xCYVx1MDAwMCxCXHUwMDFitsB5XHUwMDA3yWtcdTAwMTJcdTAwMWOhxMFrXjWL6lx1MDAwMVx1MDAxZpK3niiTJceV4Fx1MDAxNK7B4PdAuFxutMQ9YEhoscpcdTAwMDCCnNpcbsJPynz5oD2l6KNyXHUwMDExU1wiPsYrm8/VmnH8gvshonmIPnF+S65Rc8RYOFA6kXpcdTAwMDAjKbBWXHUwMDExmM/hQuW/39oouH+kO2JcdTAwMGJoOFx1MDAxMshcdDC/mSv8tk7GYVx1MDAxYZdBjYS5aoAlwfLjjGf9J1x1MDAwNsrEXHUwMDEynIE4N1x1MDAxOFx1MDAxOVx1MDAwMZeiws5cdTAwMTHXmy/Y7p33XHUwMDFkLLllr+BuIVwiXGZcYj9cdJBmKVx1MDAwMcpcdTAwMTDuXHUwMDEw/udLm9S/weI+P5uka5KfZr6ZSebUXGZcdTAwMTdcdTAwMTLRmGnA8iZy9syMcVx1MDAxMd06ua505syspuvvXHUwMDA2XHUwMDFmXt62X2W/dXCjqlx1MDAwZbJcdTAwMWJWXHUwMDEwXFz3ycdV2j1cdTAwMTdcdTAwMGVcdTAwMTKVnPKnPtophlx1MDAwM6jUv5jd4TDQ9X3Cp1x1MDAxYmH7ipiS0WOCz1AzXHKvRllgUCz7XGa629XOXlmMe/BcdTAwMTMqlerP6cPXVuBz83x5aWH0Mrrxyfk+PFiHxCaoO5VKMzZgXHUwMDAxQ5O7RLJcdTAwMWbqpVx1MDAxMl9cdHA49Vx1MDAwZlx1MDAxMjYxNVx1MDAxYVx1MDAwZbWS0oaXMVx1MDAxYVx1MDAxZSa/LSnTdYBgXHUwMDE123FcdTAwMDN5dMGx13XZaeBcbs3jIVROJnuX6J6AnVx1MDAxZm28qrZcdTAwMWE19FNgXHUwMDE0+lxyXHUwMDFjXHUwMDAyJF+/uKjjmJBDhCZG8XeItyE8Kn9cdTAwMDXib9LlwFBT9VfTKlx0XHUwMDFhPf7tyat3XG4jy42If83qVTz4XHUwMDFiWVx1MDAwMXdcdTAwMTb08FVoopr+y8NcdTAwMWaJ6Vx1MDAxNYhh5WreXHUwMDAwXHUwMDFinSB0XFxScZ/2XHUwMDE5/jhsYS/fpfclirP6VshfKZHWZNZcdLa45SOyStfNkCVObSc2WUeDVIjTjVx1MDAxZlx1MDAxMPSqxepcdTAwMWaqb6C9dFahsLtcdTAwMDJXOUZ/66xcdTAwMWOKWCBcItCzUiY/u1dgbeEmaSVrc1xiXHUwMDFlXjqSdMwwhtE9KUjl9d5cdTAwMWGpwVx1MDAxNDNh/tm4M1x1MDAxMrRVgqJ1SCstVSyHw3/Yjtr9zS1XKuDaU/NIk0NNfzCNKXWQeitcZvkzVCg1JOYxQ/CeTVZuXGKCPc1wrVx1MDAwMWKkNEdzXHUwMDAzXGL5Ni+oakRQ5ZF0nfaAxevPq9pIxe3vXHUwMDA041x1MDAwNf4mhrW9XHUwMDAxXHUwMDE2jbJEtWHQSSheXHUwMDExvcHXbrRlid9hpeyQbbt+mvo+N7w+J21cdTAwMGZpTUyE3Vx1MDAxNEzPd0/1wqSglczdvatXXHUwMDAyXHUwMDEyXHUwMDBluqx5XS7fXHUwMDBmXHUwMDEwosBcdTAwMTLeMTau9JQyxme+yEvkZWRL2C1relx1MDAxOZpn67m/rjn+etHhvKkpaFxceu5QbLCR2lx1MDAwZVxc9Fx1MDAxNlu1XCI2XHUwMDFmm0363vvq07Ing1LxUFM9XHUwMDE3w+VeXHUwMDFlv1x1MDAxYUy5dorAYkc2MtMuWVx1MDAxYnXK3IIqwVx1MDAwN1x1MDAwNFWfWezu9sO7XHUwMDE2hVx0v7xh+in6NFxuUViOIVx1MDAwMNRcdTAwMWFik3Vh/mTkXHUwMDA3cotcdTAwMDHTgpE9xsyPsDtuluKvMCjAutw3XHUwMDEzt4LeYq/Rhivys4OqqpL9/KqXLF5iLmtcdHo4iVgrXHUwMDAxuv1Eavdr+sEwOZQoye19QSnuKUPxlEZxsCPprVx1MDAwZlx0eePIoLpcIlx1MDAxNmApvLyUXzHPpNw+iVx1MDAxMi/dWUVqk75cZoYkXHUwMDE1m4RXbkCYXHUwMDEzQatk/vuaxf+7brH4mMzLyTPkhTMzLKaw8XdJjjxcdTAwMTc0zkJlmfTTZqpcdTAwMTfu6IZcdTAwMDP6M4OiUokx2Vx1MDAxMp6kiPdcdTAwMDC6PFxicfIzrObnQlx1MDAxZDjY69RcdTAwMTmDPpDLXHUwMDE3XHUwMDA1WD+Et/5jJupHOoxcdTAwMTn61GJcdTAwMTH0Y6XzTpR+scKfVdXmw+FcdTAwMDS9O2DhzI1YpU/FrzbuQn+YZ3ynNdaVXHUwMDE0t1x1MDAxZKc5aVx09Fx1MDAxYSvn/CThxH+cXHUwMDFjRzBhNmrBOVx1MDAxYUGBXHUwMDBmqdZJ6Fx1MDAxM2BTMNb5KF726ECGL+65/tFJXHUwMDE3TJxgXHRcdTAwMDVOnu9cdTAwMWbNi7+D68dJVaKMSre5j6awukAr5lx1MDAxMIBqiFx1MDAxN9z9WfSQJCp+4YZSR1x1MDAxNvg4SI34d2bAk1TDwJWW1oFcdTAwMTmdbMpnxjGdNrNTVFtcdTAwMWRT1c5mRtnBWL0yVe0nylx1MDAxMM5cdTAwMWPI3+5cdTAwMWRCXHUwMDExpG7ho9SE/63mcITVr1GwXHUwMDA0a2bz2lx1MDAwZateu+9DXHUwMDAxkD1cdTAwMTEwf2diXFxcdTAwMTiklYyR/oVKhrJ2o1x1MDAwNdfOa4R0XHUwMDE09aD6XHUwMDFiwMZlXHUwMDAyXHUwMDEym1xcXVx1MDAwMWA/PI3wifHCXHUwMDEw/PWxilx1MDAwMCqwwuEmjajOXHUwMDExM+hcdTAwMTJcdTAwMWXTa1x0Pq1k10Sd5Fx1MDAxZLJ0lIMqlEhj/9VnPmTrW7PeXFwwXWLJXHUwMDEzXHUwMDA3l8tcdTAwMWWb89hWXHUwMDA3njMp2zpcdTAwMGYxOHSQLufgzc9cblojXqlcblx0d+JcdTAwMGZSfVx1MDAwMYBpm29pel//0P3PIJRcdTAwMTjXL1x1MDAxM/Vjfrr42eS4XHUwMDE5QLJjqVdjg1x1MDAxNPFcdTAwMGZEdW9JoCtcdTAwMTDE1Vx1MDAxY0yxXHUwMDA17fNEPjjTci31/lx1MDAwMlx1MDAwN1x1MDAwZfNcdTAwMDZqf288XHUwMDE4qJ1cdTAwMGX4ULbpXHUwMDExle28/c+1XHUwMDE0avxxmlx1MDAxN1qZnba05bKJjChcdTAwMTf7TPRcct2pqFx1MDAwZeyRoHXugK1DZVptglx1MDAwNDYq4k5wot+9pfqRXHUwMDEwNshqy1x1MDAxY9ZMVFx1MDAxOeFcdTAwMDe3XHUwMDA0r41wWDpcdTAwMWN0P1g8tmNcdTAwMTm40o/ARCiGXHUwMDFjwlx1MDAxN3RVbDunSKl5R8mks1Vm41xckiiJe+ZGdO+HjjZaS/MhJ0O3R+mnPcx517LfQXVbXHUwMDEwRF9r2lSarVx1MDAxN82rp2ct7P71PC9Mfpaz8vyZ1W02+flcdTAwMTBcdTAwMGLDW0FWwfbzP7Zn7UFdINvKxVx1MDAwM3llf1sz1V9cdTAwMTDI9vpeOuOtXHUwMDAxMFx0V2V7za8uXGaqwInrunFcdTAwMWTRXHUwMDA2XHUwMDExK8/jkbCQ3oc3sc+UXVx1MDAwZfPmhiGsiFT/nUI6XHUwMDAygPlcdTAwMWMrg756rLKcXHUwMDFjZlxi/WB7xldcdTAwMDOs7eS8XHUwMDE3XHUwMDE0VVx1MDAxZmdzXGJ9RnmjXHUwMDFjXHUwMDE2Ls9TcmabXHUwMDE5xjdg0tBcdTAwMDO+aIlIM4Wf3IFfZHqzhnXwO7PZO1KOSHCS9oii9Fx1MDAxNuhcdTAwMDHYwS+J3fBcdTAwMTVcbuLRgtDpMdecbkz9kjMrXHUwMDE5psJccl/57aDgcsNvXHUwMDFhREfZLj8/r9WO5oNcdTAwMDWC17xcIupHyV52Mr5eIcn9JLQwXHUwMDA1l+JcIuPwkX/CUjWQ13dcdTAwMTe1XHUwMDE2Zlx1MDAxZitm74tcdTAwMDGssFx1MDAxZVx1MDAxYonYR7dyYlx1MDAwN/9EIYBcdTAwMTlb9D0731x1MDAxMJln8m+wsrAm+jo/XHUwMDA1Y7H5XHUwMDAwXHUwMDBlPl7Kg1PIU1x1MDAxNVx1MDAwMTf8XHK1yK9tqcRhduKVU1c28irH/s3txlx1MDAxY7VcdTAwMGaw1I7LlVxyc2mUvC1cdTAwMWHZ/jDeZnOyPWI41mhBKo/HXHUwMDE50HNvvE/MRpzVlcbr2arAeJrKK/3Fjs9lJHraXHUwMDA0xfU/56PMf+ajovJ391x1MDAwMs1cdTAwMDZt+1x1MDAwNEhcdTAwMTBrXHUwMDAzoZzS34NtdnrtL1x1MDAxYezo8HE+411F399cdTAwMDKoupy6XHUwMDExVG7BOaZSY5dH1Vx1MDAxMGeAxSE5XHUwMDA1XHUwMDFmPOxAXHUwMDEzJTFcdTAwMTFs5vKm7Vx1MDAxMFi+c+cgzlx1MDAwZsWZftzst3CmbDhpv3BcYr/xRrXBXHUwMDFkztGyXHUwMDFm+rzD3tF/XHUwMDBm5JteK4UolSk0yJLObCCGRrSEXHUwMDBmrOPhvfktoizkvJXf/0PZfyzLziPbmuhcdTAwMDOxQVx1MDAxOVx1MDAxNE1qrXX0qHVQy6cvzjzC6lbmtj9vXHUwMDAzq7VsXHUwMDA2XHQ4fIyPcFx1MDAwML3EuO5Ncnb7SUM7KPZwtT1A+EAg11V9xkjhVZTD8/nXaeVcdTAwMGLA5eSjljKibp1m9Vx1MDAxYiFmRLAsxFl0RVJ0UlAlsMwsyVx1MDAwZuPAnoBOoaleWzyb185WaD+LXHUwMDFkXHUwMDA05jBcdTAwMWF1yLMhbscvSiPL1vw1XG6tgekvZC7lkTTuKnP7jELHNdtcdTAwMTG480pcdTAwMDUxfkD0wUnJWGdccoGlr1x1MDAwM8eqUODEtf9cdTAwMTN04zuxYzvHmdqSyzysc/WJXFynlFwizO+oXHUwMDBmXHUwMDFlVGxwdECFe8ZG275/XGIqXHUwMDFivVx1MDAxMWF/u+6LXHUwMDE5OECWy/Ip1fK+Vc5cdTAwMWaiw7M/WFxmX8ZxNye066zutFx1MDAwNFx1MDAxY+OfQ1x1MDAwN+f7hVx1MDAxYmPm429cbqplNFx1MDAxMVOXTyp4Unx0S07620fvXHUwMDAxSStcdTAwMWYhgVx1MDAxNHZpXHUwMDEyr0Li2UeCreRs1mSixldHIKSuYiwgupP+/11Xf1vL3ExlbyNcdTAwMDFm+eI/ISCBUXwhxG/LXHUwMDFj8IDRj4rdyCSEZsXnhyi/Wcij3O1Ftm/HSF+/oOCtoHtcItjZXGZcdTAwMDJcdTAwMGWZl1x1MDAxYk5cdTAwMTNuI0VcdTAwMWLrzm771Gl1Xts+tjRLVUFo1lx1MDAxYotcdTAwMTWolm7XmVxuTpeR1Vx1MDAwMHScO73gq6D38IBu+HjfL/tP34PubqtOWkuOjzNcdTAwMWav3Fx1MDAwMSWSv4aYjjGeLSr23Nn1f9dcdTAwMGLQiYfRbDFC5YvF9L/VpTTuydd/ezQ+8N38q4ZcdTAwMTNcdTAwMDF+SVx1MDAwMFx1MDAxN8aXTiFcdTAwMTf9+aTyb9ry71pjn5VcdTAwMWV1bFx1MDAxNHeRXHUwMDE2P8NMI7ZA0bQoNHvFnKy2f2T639/j3+qFIYaOj5Hfo4tuTLn4vJwmY1x1MDAxN899JfrfOf/fuF+uXFxRY99pXHUwMDFhddvf7VxyK2tntcTyXHUwMDA1XHUwMDAyjZySXHUwMDAwnYw8XHUwMDA1IN1LZVx1MDAwMM5fbVlcdTAwMDIlaHX+m/37t8YyvCwyLFLlXHUwMDEwc2FwRvRKOifKfICUXHUwMDA2XdWsg3YtXHUwMDAwUTNUzUVdxfbVg6u0mT0hmCHNwMtcdTAwMWK2KOUyXHUwMDFlwebO4lx1MDAwNvxSXHUwMDFmXGb6d8b6XHUwMDBmrZ9AXHUwMDFho1x1MDAwM+iO+nnYpKNcdFx1MDAxOJrC9lx1MDAxMbwgMbClLfnROlx1MDAwZlx1MDAxYTnnXHUwMDE5w5Ml5PUmpaXjXHUwMDE51KNcdTAwMTCi4/99ffPf1jtcdTAwMTma3njeUFlcdEcsTZ3paaRcdTAwMGK5tFiCe01cdTAwMWF+81xm6L1jabJEdSP/OFx1MDAwNjT9g/71Tb1yxFx1MDAwMn2NmEGEYLDW9F3ZT8BbUtO97OUzhJ+fwvu/jOBccjks0sF/2zv0XHUwMDFmXHUwMDFhK7uZyVeCXHUwMDE1LnQ6XHUwMDFhiUFfSWTn2nb9XHUwMDE47OaYXGaG73uvMF/znDxcYr9cdTAwMWT9VI3eXHUwMDAwYkNw352GXHUwMDA3MyaAN1eVoDdcdTAwMThFUlf8a1x1MDAxYyvqXFz+03rZ/7e5XHKPV/aLwJCCzXTdXHUwMDAw1U1cdTAwMTVTfH6h3FJcdTAwMWRqPOdRNjBBL4z1dX1cdTAwMDFPL7SLaDxcdTAwMWSz4nzT7Wa3qNz985izNE7by6irW6CPcnuoc1x1MDAxYlx1MDAwNaKr1XkkZlu9Y+/8sFwiV1x1MDAxZd07etouhPnpXHUwMDA3I28mbzDlP3xcdTAwMGL799aNJtxcdTAwMTVn9r475/c0tUDqzPyYeLWD2rJcdTAwMGY++C/6wpFjjuZVleMoIcHZvS32NpE/VTP3rVx1MDAwZlx1MDAxNq6VyKOTJIzA8jmX68JDXHUwMDA3iVSMXHUwMDE5XHUwMDFhMI95XHUwMDAzwn9Yi/n3tVx1MDAxOfhX0Vx1MDAwMiWO9Sivr5x4cqV8Ty6HZM3XYi7oXGKo98PwXGbwwDhDcd1bXHUwMDE4rCTGXHUwMDE2/zlPWLI9ykyh2Vx1MDAxZVSxc9XHbMjSn+o6kEdPSJizzeR38nm3wsx4q29nfXmNpEZcZsn/i77xQpWWOd5gXHUwMDE4e7RcdTAwMGW5jeAvPPyW3j5n5EdNT8LD5JVcIlx1MDAwMXuIXHUwMDBln1x1MDAxZPY0XHUwMDFlt8nhNLSFsmvTv6lcdTAwMTfxipSuf865hl3pXHUwMDBlz1x1MDAxMdamoVx1MDAxZOCzyM+Mhj75olx1MDAxYuvR1V9t9K3bYUD7XHUwMDEwbdk2cLL/PKxVVWJKQNcjlzPb/FpcdTAwMWM97CHJJbLvWejVXHUwMDE5XHUwMDE5eVwiLfGbd843Vj6pxFxiXHUwMDA2R/FcdTAwMTdoS6MwtsdcXLvy/4qjpeJfW3cxsGVV5f9Lb2Jk3YeTpmWaUVx1MDAxY17w/12P/k+zK8a4aE1fX1x1MDAxZvXOJVx1MDAxNTM8ZmlZpI2qWVRevSpRXHUwMDFjT1I1oaVdvlx1MDAxY5un/v/Rib/vw69ccpj0mW1Zsz6ncdjcTdM2cp5cdTAwMTNjPyqBqOjW+D1Zml3hb5wrLZmtuutonlx1MDAxYXfTYW79XHUwMDFm01x1MDAxNd83XHUwMDA2S1+FrZThbFx1MDAxOY1ZLsVAS7mES/aD6+pftWi77W/UfjM1WlHy28m4tf1i5LOIY5xWuFx1MDAxMTG/2rNpoJqJavlH/fwytGArnPx3h+1sdqxg0Fx1MDAxY0LH+1x1MDAwMq341qRcdTAwMWZcZnBpXHUwMDE3YpFNMFxcOvo7Q26kS1vMb/+f36WuxirmtURcdTAwMTFcdTAwMWJtqlx1MDAxOCvgXFybqEGf6XJWXFxcZoNSXHUwMDFjxrOhV4u4V4AlXHUwMDE1Z6VVOmLhv1x1MDAxOI+Kp/7lZWBbMkg7gHx5WYJiuvlMdsQ+XHToZcJCtj+WrZqn1EtqW8FraVbrV5v+SbeN7/F/9dPKk1x1MDAwYieHkHcuTjc+Me1Br/C9XCL5j/3K0StjysrMMmtcdTAwMTPNdzNXf/XVx1efuVdcdTAwMTCsQpNcdTAwMGKf/i9ymtTLPM1EsTpcdTAwMWNcdTAwMWVFhVx1MDAwM7hcdTAwMDA3JCHrS1x1MDAxYu+84SasXHUwMDBl73+WQb6vXHUwMDFkRjixoTeQzEBCw/7CXHUwMDFlM3n1eaCILbVcdTAwMTG94qglq4kw8D7zXG4h/sZTxl+XXHUwMDA1xVx1MDAwMTdJqZfOr37s6S4/wqf+gG/aS32Uy16zXHUwMDE1XHUwMDA3nojK5H+jUzPtZKZauVx1MDAxMI20tlx1MDAxZVx1MDAwZZCGM7VcdTAwMWTpXHUwMDBi4/2vXHUwMDFhk/DVsdk4W6LNsjcmXHUwMDA2kXnyi5ZcdTAwMWRIM4ZcdTAwMTggXHUwMDFhQ7JRpi+fYJLXtFxic1x1MDAxMVx1MDAxNP3dWf/Nl/+nXHUwMDA20PY46lx1MDAwNlx1MDAxNyehhslVM+rmYm5joPxcdTAwMWTO91xyXHUwMDAyKFx1MDAxNunfTrI6gJdt1Fx1MDAwM29sXG6GQqr/6IfeZkP7a2PmQKC4msUq9/R5xkpdlFx1MDAxN9b2n6VRXHUwMDFiW/vVLX7cRulcctmZvs2+6XzLfHZ2qIpk/7f9Xf+hrdbf+1x0mUZcdTAwMDdcYsmqOVx1MDAxOfjtp4C+58LdqEhcdTAwMDL/XHUwMDE0+DRjxCv9po5cdTAwMDRvaKPlSsPjWnAuKU5svOZi9zDKgOVcdTAwMTP/4zg7I0fbL1x1MDAxNPjCucxcdTAwMTTGXGbNXHUwMDA3zI/roay/jVx1MDAwNiv1XHUwMDAx2aQo0d3SZWKRXFyNt75cYlx1MDAxOJsqJjGwKcfKa3vq5Vx1MDAxZO7tqYzz8ceRz7HVXHUwMDEyzn9cdTAwMWNcdTAwMDeNw/mroSvjSyHFhXdL141K4FLHx/zby1x1MDAwMEMxgzpAzXJkecjs3/n8uY7EVFx1MDAxYlxy2o6ImFlcdTAwMDVcdTAwMTBjXHUwMDEyWW3/XHUwMDE3XoZ9fXaf0zuB033zt6+vYV7Xa1x1MDAxZv8vTfvjXHUwMDE4LqD+tV/PeflP8DRU/lx1MDAwZssk/9/W8Fx1MDAwZs25c/px9GRkfFx1MDAxYT7joU1+XFxdXHUwMDFlayWJO+NcdTAwMWLPmLw2IVfCJZ+/Qs46q1+mWV7xXHUwMDFiQzzqzHKcWNs2Xy588Vx1MDAxMf5nvfy/unnytOxDrDiBXHUwMDA3XHUwMDAxJUWYlC7d1YhUqrSSTF9cdTAwMDL7XHUwMDAyb5q+ZLz/l9atMEbb7N9cdTAwMWTKXHUwMDFk+33JJOPpXHUwMDFj5DJRWLvqv+g7XHUwMDE5qnSpYlx1MDAxNieivphccrNcdTAwMWFKt1Okkr1Cn/DLXHUwMDAxi1x1MDAxMlx1MDAwNZtShI2xuzDW/TNcdTAwMDOeXHUwMDA1wzZVgPKM5OBcIuSZ1dd5feRjXGZW4Vx1MDAxZnZfXHUwMDFitlWA4+7NmX2cavdfcIOcaKdJXHUwMDBiOd9WyVx1MDAwMVx1MDAxMS78pTlIsJiNz+zwXHUwMDEyfe3MXFyf4SpcXE9cdTAwMDeTjKMqheJ+4HmJg5vaWkgn5zJTWav/rj9cdTAwMWFdpFx1MDAxOS34uFx1MDAxOUBvJtN0htQ2w+uv242zZ8ezr0zHrVB/iuFcdTAwMWSvXHUwMDBmTmvNh0VcdTAwMThExVx1MDAwNO6hryCSnW5cdTAwMDEzcm1ccrYnXHUwMDFmurNp+Vx1MDAxZpq68LLEsEDjkpRccrGOtVx1MDAxN4gu5Fx1MDAxMsDLx0VmTGTLM2NoXHUwMDEy++Lo/8m9zpjJ1k0l3Fx1MDAxZNprKCfuyyh0j8r+P1x1MDAwN7VKq1VYseLGcUbK9EL+Wsw306503I5qICNbYJRszFx1MDAwMsffnqM9qWfh9T5n8Vx1MDAwN5ZkSXS0P/yj2cjd4F/rL2GBUnhu4N++WU+FOIjQfW3s098xXHUwMDFk0lx1MDAwZezbOmnTXHR0j1ZoV9Y7fVx1MDAxOHrV8pdeZSww6Vx0S5h/9tG5PWBXYlx1MDAwYlx1MDAxYVxiR+vtt6+7hF6KjIhF565VZDVcdTAwMWWUXlRcciA9Z6bI8m0o/9ZcdTAwMDInOOI6fJaNllVcdTAwMDZcdTAwMTYlullY+kt5Nyb9V1x1MDAxY/aT5VE1XHUwMDExM7Wn9mjG0r/pXHUwMDA0+Wivb2/qaj/voVJsXHUwMDBiz/WBjlx1MDAxYflcdTAwMGK9XHUwMDAypuJcblj45z9cdTAwMGVPqEHKX50+gFx1MDAxNn1cdTAwMDOw8utcdTAwMDe5+VlcdTAwMTKc+SV+0Fx1MDAwNURcdTAwMWP/sarAcmG8Sv6U029W9XRvXHUwMDA2XHUwMDBi41T/XHUwMDFijZPjonp9ZsL1i/bEMVx1MDAwYrNNZ8X9SVCUfe9XXHUwMDEwuLacXHUwMDFkhUs7kjqySFx1MDAwZvA+X6z9O1x1MDAwNVOFZotcdTAwMWbHNV9y+D97Plx1MDAxNZbR2NGNRJau/ydcdTAwMWZcdTAwMDd/UZp+zetXsuTPPtOfo7lNt8GmmC76ib/lcbW3dWzqt59OSmVSxf7fPoXhbdlcXFxizVx1MDAwNFx1MDAxMVx1MDAxNcVbbLktdLqLOUi4T0W5/8Oc0tmKvW+xglx1MDAwYsBIt2D+/uVcZnx8xlx1MDAxZok1ZmK7rfathvlW37mVTIKCxs5cdTAwMWKLQGw4xyPMRb0/XCJmZUtcdTAwMTTafH74xf9lc1tcInnDXCJBWXFcdTAwMWGqXHUwMDBiIa5CTJzkiMFOXCJy6cDWOj//w7exhmFfT2e0doODOtVcdTAwMTOb97KIvcHl60W1XHUwMDFhjfBcdTAwMDejTcZyyJe50YeMyTc7Jq+P4c1cdTAwMTGQZPt/MXUvsyg00lx1MDAxYUxcdTAwMDQ1zo1cdTAwMTlcZoV1zOpFS1x1MDAxYdfXUDxGc1x1MDAxM1xm/nBsKd5u/Fx1MDAxZoJLZGDlf1uCS5pBO0i8581p8uOI9Syzf3uWa27W/pc3/1x1MDAxYjeOjjU1i1xcU4xUnK6mQLJcdTAwMTSRj18sapnjLivCM+CUWzNFk6v/XHUwMDEwy4b+L7BYKiPXbmDXsn7wXHUwMDAyvKdcdTAwMTJcdTAwMDe6PFwiwCXZOVx1MDAxYj7OkFx1MDAxZK+ElNPcxvY//InORzov8lx1MDAwZXBcdTAwMTnoXHUwMDEwdlx1MDAxM/1sXHUwMDE510xldJNcbr/klbjiUlx1MDAxMaSkJ5pvMvGP72Hp16HK2pd2w1x1MDAxYmCZaSrDvElcdTAwMDaXuVx1MDAxNErM8GWkqkjh2SY+YyP+4LDQXHUwMDBiqWBcdTAwMWOxWmFEZfdcdTAwMTHbXHUwMDE1LFxmya91nrhcdTAwMDHWajJ8t1x1MDAwYr5uXHUwMDE4I4pO4o2inmf181x1MDAwNtd/9LNcdTAwMGKP8WM1jVx1MDAwMjqfrCqAwL/6lDbpV6OogObumClcdTAwMDT373tZ7tptMC6jzmb7XHUwMDA0bsOXyz6aTbi2fmKMt6r819w1hVx1MDAxMVx1MDAxZomuz3Ta19G54aS65Vx1MDAxNVx1MDAxZqpcdTAwMDQ8YIhcZlx1MDAxYaS5XHStnrdfJyn6LmJu31x1MDAxMHhApNVcdTAwMTbvbmdolapAXHUwMDEzdrNFI3VcdTAwMDd+XHUwMDAy10LJXHUwMDEwg8VcdTAwMWOizGJV4fEy7rxWlGPR/6ahktIu60zT2VW4XHUwMDE428uxbL3ppuj6zmfHTCVcdTAwMWYvnFx1MDAwNeRGfElcdTAwMTDNo4bJ/1x1MDAxZcC7XHUwMDBiXCJcdTAwMDRjdPXqSDmk6FxihbxcdTAwMDUq3rJ/dnaTQF5cdTAwMDFHXHUwMDAx1MEj6W0gXHUwMDE2zaVAXHUwMDAy8IBcXPefmUBnVC9jN0FfXHUwMDExzFjoiVx1MDAxM+BdYkvJ48wtZP+CZFx1MDAxZShcYpDb+uU+XHUwMDA0Kn2IibKPN6l6izXUPi6fj0HPw1xcuGHQMpXJxjpcdTAwMWbce4W6u/jpIYVYvJ9Hw1xm6MOvWaBcdTAwMWP+61U0ur3TwU8+o2jlXCKdJ/nKuPAuXHUwMDA3vP2Bb+1cdTAwMTDx0L3hfpBQjTDG07PRzzZGXHUwMDE48dlcdTAwMGaZXHUwMDExLM5cdTAwMWP9+Vx1MDAwN8fqL+07Ld3VSth2ZmnaitDynjnZXHUwMDFms4qgwKOMuVxi6kyRVN6vayNcdTAwMDRcdTAwMTFT3Vx1MDAwYkh0XHUwMDEw28NXIVx1MDAxZeZcdTAwMTFj3EtjUvhRz6dLg2xjRUl1z81UU+Ezat23XHUwMDFl0mbT9/2EYoJcdTAwMTglxFA4XVtTpVx1MDAwNnCV0lx1MDAxNKFSXHUwMDE2XyyU71x1MDAxNErNOXyV//FcdTAwMWKoW3mQoKVcdTAwMDHO0m333Vx1MDAxOStRX4+qXHUwMDE5YVx1MDAxZEQ9si/yVPROVsM0lEtcdTAwMDGSh2LhaVx1MDAxMcfAXHUwMDExKcRcdTAwMWR0plx1MDAxOX3mWiNcdTAwMTJjftImulx1MDAxMWVcdTAwMGKtRK/6XHUwMDFhQfzw8lwiusOSZYx8lNpH5FRgKlx1MDAxZHdcdTAwMDY6XHUwMDBlXHUwMDFlhL+NfU1cdTAwMTNjXHUwMDA36Vx1MDAwNFx1MDAwM5aZ4ENgrEOrXHUwMDFmtV3x+9fIsTjM2FpSXHUwMDE3Vjyrm4JNvpSSylx1MDAwN4IoOvLNtlx1MDAxN21cdTAwMTNcdTAwMGbD8abRqFKNdJVsqXBd58ZLXHUwMDFi4mz1SaxcdTAwMTlcbtTyksvjsCH0h/lcYmxGkY2OvUok16JCXHUwMDFj6cx/Jc1ssf1+mVxu6ZM55y86LFtPitlhV/iahl70Qk+RhFshdX2jRZtTXZfKMGWi61x1MDAxM/9cdTAwMWL3Md2J+kZQ8Vx1MDAxM0nSb51z2uBBXG7HXHUwMDE0XG6jXHUwMDE0XHUwMDEypaVv4XmKXHUwMDE4XHUwMDA2TGPTeX5FcfH8mjqwT8H7ZP+pNlx1MDAwYpZcdTAwMWQmt+lsvnWKWFx1MDAwZVXVOLOq0Zd+/lx1MDAwZW9cYphtLoBcclx1MDAxNeKFTtBcdTAwMDXXP1BcXMhDRCpCSVRcdTAwMTKTZlxmXHUwMDE5nWh2dFCqXHUwMDBlolBF2z7UczopbLi0jZPPXHUwMDExlopESmolXGLS6ZfbI5nBXHUwMDFl0JTxJtDt6FBMwGFQVKOhXHUwMDBmgeDWUW+zMX5RpcfobWFnuUsxclmk8Vx1MDAxYvjYzqaZSHM9PCPxXHUwMDExrD81syX643ZEXHUwMDAwk85JXHUwMDAwoHnmwNv/XG5MxciMt1xiSUWAXHUwMDAwXHUwMDE2SE37mF5cdTAwMGZibeWAwjrb0SCGtZ9XYsliXGJU3tzpgnX8yHHfVtCBXHUwMDE0lJlqXHUwMDAxzYFrRGnj6oTPj49A7VtcdTAwMWX6694+0ki46K9QXHUwMDE0Q8mlXHUwMDA0wrCmbUkzykFcdTAwMTJZTMyMJFxyyTXPXHUwMDA0bXYq+KtcdTAwMDe5133xI7iANTVx5IPmKIb1XHUwMDA1cmXvXGJiXCJcZlNj/P7zcDWOXHUwMDAzUKIv/aotk3V1YCZlKp7QZFx1MDAwMUPfn1x1MDAxMmdXwiPMaE7xlvhcdTAwMTHb8lL0zlx1MDAwN1PjXoJcIlx1MDAxY+NcdTAwMTO2R1x02lx1MDAxNkY/XHUwMDA0XHUwMDEyRVhcdTAwMGL4XHUwMDE4/bFwXHUwMDFizbf0f1g/qMc3gGjeXGLSOvz8qnGUi59NqptTv2Nfwlx1MDAxMXBeY+RnwC9LXqBcdTAwMDJcdTAwMDUkXHUwMDA1QFx1MDAxMVx1MDAxNHHz9/ztiMGocXpiZ3Kl4mAhKYRaXHUwMDA2l+5cdTAwMDBImlx1MDAxOTxIXHUwMDFm0aV2dZxZXHUwMDBl11x1MDAwZoVJQm6AN+/e1jxcdTAwMWQullmPIWao31vj3PhIYDTkgVxibeg3LVx1MDAxY1TX5n+GzmVcblVzKODNdaCsnp4ru4K1mFx1MDAwM/7D+CVMK5dcdTAwMDZcdTAwMTTwmfzZwkF07kNcdTAwMWVcdTAwMWZcdTAwMDUoyMpb3OxehH89biefvf+kXWevXHUwMDE34fXaXHUwMDE2QLhFXHUwMDAwZ96eVaORTmn54DTNLqjqSkbCsylvXHS0XHUwMDAxUyXiPCDf9Su+XHUwMDEw6nXs1UHe59ZdnFwiJDlMmN3N6F29V6FDWKpAmi288Vx1MDAxZVx1MDAwNrd4oPuuXHRcdTAwMTTpg4JcdTAwMWR4wVx1MDAxNvxX7VxiRFW3IL4zu89cZv20upGHSc++34WyyN/ydzBcdTAwMTQkwF8wmO/Ta5ya0PZtPLPkyDMrMHKcb+lPjdBx2GeolHUlyc34XHUwMDFhTNNcdTAwMTZ1XHUwMDE3wWTJUlTwR9niueWFYr9GT92/XHUwMDAxXGL8XHUwMDFlofB3sjWXXGat866XjKB0XHUwMDBiwpX2ZFx1MDAxNu5DyHdELn9BMl/zvk58/0iLlmGT/FfLXHUwMDA0XHUwMDFkJltwM1NfRoX3gNW6t4tcbn5cZk+SspmGT/7t5z5cdTAwMGXq1NfwsS1cdTAwMWTDXGJ6PIZDllx1MDAxMoe5PjCx/lx1MDAwMpnEvdf/wjeTmGx1UuBk5amMfvuQrLGLXGI/XG586N3vSbfSucfQKVxiXHUwMDA3XHUwMDEzWrdHRl1cdTAwMThIXFzD4UwpXHUwMDAxvpw180Wd4Hf9hMN+4NQ9wIlMWPXDR+ROIXj5a9tXi1x1MDAxNsRcdTAwMWKvLCFXhySbSkGgXHUwMDAzZHioyIeDXCJxYEfaJnNcdTAwMTNxW877Q1x1MDAxMFx1MDAxONVqYEV1XHUwMDA332ktiCrcdeKEXHUwMDFmI1x1MDAwNFx1MDAxZLJcdTAwMWRhXHUwMDFlJKBqQaa8XHUwMDA2JGyc8CdcdTAwMTln2Ta6571xO0fVLoiciGF0XTpPd4A5XHUwMDEwvOP5wkFnoXtcdTAwMGZcdTAwMDNh0bd5d5jF14LWQlx1MDAxM+y5dGj9iV+787x983X0lm2LT1FWSf+BupsoeWLe0VVcdTAwMWJV6CtcdTAwMTI/XHUwMDAzfsghXHUwMDBlXFwtJ6Dt9cmWTGHNy6/IhztA8Jxfw+AhfPR81+Y/fFeIVb96XHUwMDE5hJHiz0CVsFVeWaBt7ZZSgFx1MDAwMy4/XHUwMDA0PJzJhl+u3p+fXHUwMDE0t5PbXHLPXm0jUPggRCE9Y71cdTAwMTaE/LBEUiWHpfnn07aI2I+uPMYk7fhjwNLjdcRfcz2wtPY0UovzJGv88Gi4Ky9cdTAwMWJt24/Xllx1MDAxYXlEa339elx1MDAxN/h7Qymz1qw1uGNrzjGjXGaybduaUe+ihlx1MDAxY8nuNYHkmLNcdTAwMTLL++J2XHUwMDFm6+9ga3//SF9bIVx1MDAwNqhcdTAwMTKgx3WeonCeYJdcdTAwMDeP91x1MDAxN/aZu1bie7lBYn+v9klL1V+IpcYto/TCr0WC3eouXHUwMDAw3Y3pXHUwMDAyP+5v9texqsdcdTAwMWXas2n0dlx1MDAxYrinXHUwMDFjO3tid3rmXHUwMDFkKvzM9otB4d3toIlZ+ZlcdTAwMTGrLc2pXHUwMDA02WdaXHJ56JpcdTAwMGbXndGtrKImIFxcYoPW+JNYdVx1MDAwMHtIe8yv9dzAWtRKcThpUTqRevxcdTAwMWSMbF7BeoD0asxetfLRpqpKsbuxk1x1MDAwMZRmddlcdTAwMDZcdTAwMDEgUlx1MDAxZqo3U1xiRjDrysRcdTAwMGLj9ChTN7ljKlx1MDAwNldA9k+CQjaOXHUwMDE2XHUwMDFjaozet1RcdTAwMDJ3LfRLRa3myK4+fu5WLvqhMz/j+SwpIVx1MDAwN1pKjJFcdTAwMTRAu19P1XaDPFx1MDAxNJdrXHUwMDAz3jdcdTAwMTM3aZH4XFxcdTAwMWTqa1x1MDAxZiv1ZXJxnWgnRX1cdTAwMTee2n/0z1xuzqlRnNeSXHUwMDEwYYe1o/Dil9SNg5HO7Vx1MDAxMlx1MDAxYlx1MDAxYXJhMiRFhFx1MDAxY16X5zP8XG5o6M9nhle6klx1MDAwMFx1MDAxZGFcIupcIqddRXbi2ShfXHUwMDE1/tjZXHUwMDA2XHUwMDEzf9qH7lx1MDAxZVx1MDAwZUdRqfV11ttVkdk2/Vx1MDAxY0VmZ1c2S9lUXHUwMDA1PvYvtTZ66dhOXHUwMDBimY5cdTAwMDRIkTu24rRxoUFcdTAwMDXKtJArlj9cdTAwMWGu77/R3YjmnUWcOlFccmVBR7pPIeMtvcDvocSuXHUwMDAzXGZNnjlzqPWVzNE1a2WQxniBXHUwMDExhdXP6XR4lVjb9nVdXHUwMDA0wyhcdTAwMTLqQShcXN6f1NaFi/eBOFlcdTAwMTSmXHUwMDAxurO7O2x5+SSfWUJvPirdzpg39XzHo+JcdTAwMTbfZa6/8Pw+amSMXHUwMDAyzJatrjpHXFxu6OqfRVx1MDAxMcpcdTAwMGbCeVx1MDAwNsUmXHUwMDFhW8eZea4tUalcIit9/vazKlx1MDAxYVx0duTG6oOkeYanhVx1MDAxY1x1MDAwM1x0RvyrrTRjXHUwMDExXHUwMDE3jD5aZaZaX/JtXHUwMDEw71plXHUwMDE0wIXyMkZhTzEm2FNcdTAwMGaLXHUwMDAxvNq9g22YXGZdMlx1MDAxNVx1MDAxMDRcdTAwMWO5bajGb0t6jY5cdTAwMDFVwVx1MDAwNO2411x1MDAwNiG+r+VcdTAwMThccm/EiUCnt1x1MDAxM3WuXHUwMDFicE4o8jTq40Ay5XHwYLljLb0m4DdgQYVcdTAwMGZJxsjXwH/a34i7/JuynnlZ1lBXvixUfT1Sdlx1MDAwNM7b8mrWpCHNsa71blErg8xrvFx1MDAxNrJCrFhSlXwum3LV7o2NvNOHQ1x1MDAxNE+CPeHvZVpwpcyZSlx1MDAwMSxrf2HYTWwoXG5g7or5nt5jcWPGQW1cdTAwMTgu26/uJXwqe5C2b2fvXFxGLIXBN83/XHUwMDA3huNkXHUwMDFlrnY6gVx1MDAwM1xynjV+2+S/NbryjehR3oygd4G5XHUwMDA3IFx1MDAxNVSuXHUwMDAw6PREoOiFsK5AeV4zUNhzhzaPk1x1MDAxNSfRvTlcdTAwMTFcdTAwMTdrNjOtNKxU70cgXyUkrCiXXHUwMDAwsVx1MDAxM4NivFxupyiAcYqkJ+mSRnEzfPxaaziaXHUwMDFk7LKuXHUwMDA3aS42N1x1MDAwNvxVxE+qXHUwMDE1rqSNhY2uXHUwMDAzTZiIMOxv4PNbTCZcdTAwMTNTNPhOXHUwMDFjtrWTz5db0sOY3KDsJiHTm1x1MDAwN3dZP3NcdTAwMWX6m/bxcSU4zk6zXHUwMDFkwFRcdTAwMTnJ381cdTAwMThDcPxcYlxyiDHaMqhmt8GR97dLOlQ7JSidafTwwnG3sC3ys2vFsaiwXHUwMDE0Z8bKJkhcdTAwMWOKgcFtKVx1MDAxMcBcdTAwMTm9c1xcTko+YSV04d5nndNi/XRNnPmZ3Oz3gkA9Vj+c4lxcvVx1MDAxZYVcdTAwMGJcdTAwMTJ+e1x1MDAwNWs9ivBf+1x1MDAxOGzQyeUpOidt8kHvR1x1MDAwNbdv5kK10Fx1MDAwMSqP0W/jXCLuii6c+821dC1f+0dwr/Sa5tVcdTAwMWaWNdpcdE/QVbXUmc2ukF+h+1xydf2bTV+CWGWD8nlcdTAwMDSrWmJ3nfRcdTAwMDNYpYp5jIuYm1fGgrhcdTAwMTlI1Vx1MDAxYfH9joU7gr9SN9Hf0TOOjfe3XHUwMDE4XGKyNLlcdTAwMTCTVzfE7iif+S2f75FNKFx1MDAwM1x1MDAwMXPZjVx1MDAwMe1cdTAwMDRNXHUwMDAx6lx1MDAwZs50u1dZXVxmRXHoXFy/05rChEihXHT2TkLPlYJPn1x1MDAwZbU3dlssVt+7X2uQXHUwMDA2tnVnojBcdTAwMWOyXHUwMDFinrAz6uFcdTAwMWP5aFx1MDAxNplcdTAwMGIgSqbk/lx1MDAwNapcdTAwMWRf881cdTAwMGKUhPadu8eFbOHdUPdnmDT0beXc3HH1dPVubb12XHUwMDA2hvPF41x1MDAxYa5VX6hXXHUwMDEyK0/eZO1cdTAwMGZcdTAwMWWMWTFZmDa6pVwi8KVIWlx1MDAxYUqQRlxiyU7ZMVx1MDAxOVx1MDAxM6WfRXtkXHUwMDE2XHUwMDA3g+ZxXG5qNdyUnCvSQop9XHUwMDEyZNONxP/yc0KaXHUwMDFm/fxcYjhxo1x1MDAxZKcshzhdXHUwMDAx7lx1MDAxNFJcdTAwMWbvXHUwMDEzhZ2k6vSrOMxmv1x1MDAxOY9ZXSHtp+i3I69cdTAwMTHJXHUwMDFiJVx017BcdTAwMWVcdTAwMTOeXHUwMDA2Upx/I/XWXHUwMDA09DWjI2H53022XWe9XHUwMDA1yMz5WkRaIFx1MDAxNlx1MDAwNM1cdTAwMTPSJUtuXHUwMDFjN9v5jb9vRVx1MDAxOMsyXHUwMDEy30lcdTAwMTM1RVAvUuxRTVx1MDAxOIQvXHUwMDBlqbAsTqz6O1x1MDAxN2FG/MyV7jBcdTAwMWZdPb+DO9PshOBChO/HtFx1MDAxZTbiMNat3rTwymsoli1fY6PR/To0Xti1kqNBqFx1MDAwZU3MRmz89TX78pTp564mvOdSjqj+L1uPXHUwMDE0T5hcdTAwMTHlUzEpZs9Dg+aOXHUwMDE5XHUwMDFjtyZAmurJavJjtqpcdTAwMTV53Vx1MDAxYe9o9y6N71x1MDAxZpaO5Fx1MDAxYz9ESW9cdTAwMTJoXSxsXHUwMDE0KWBswlx1MDAwN+AmXHUwMDA0xPlr/lx1MDAwZZPhe5AseDdrRo87v51Q+0WUTO6AwWQot4O/KF7Bwct3p7Xj1EV7XHI1dm+VkVeDXHUwMDBlN/IyXGadXHUwMDExjFx1MDAxNtM26Fx1MDAwMbw15Z2XrG/swZksw16v+Op9N2g05M9XxC2xXHUwMDFkM8fDxSW3+1x1MDAwNFx1MDAwNdfDUDNvjuM44otcImV9QYuU71GR3lx1MDAxNlx1MDAwNWq9bPs7xoOKky5gkv7NSl3x5WC0qU7nXHUwMDE2vi/NMPjIXHUwMDA2fXrhKYUw2Fxcw1JcdTAwMDBcdTAwMGVcdTAwMDVcdTAwMDJEm1SgMiXFlSS1yqxcdTAwMDJp9TTfXHUwMDA2vnef0EGwfvNavDpcdTAwMTK80citVzP6hbjwe/9d02qwTtqVu/NcdTAwMWa+ia/06IjKTXO/VzdJ0UEnzFx1MDAxMIJ5S//OWfgrXHUwMDFiXHUwMDA09Zx+rL28lkf4lVxcpsHloO/oXzlmeVdEmCy1Y+E7iYWTaYJcdPNhV1x1MDAwZlCN71x1MDAwNVxuu0dSklxmXHUwMDAzTOScXHUwMDE2q1x1MDAxNzY1X5D2PtTSVuS0nsUqx5uEknSGXHUwMDAxmbMkfzFcXOhcdTAwMTNcdTAwMWY+uNV6KcWMXHUwMDE4kXgzXHUwMDE0cND9Rlxc0svdj1g6JaeeU3xqhEvTOP9t5Fx1MDAwN1xcwUvxjKlRv+9wz9aH30riOVx1MDAwM+75nFx1MDAxY1x1MDAxNVxiYVZ1ITJcdTAwMTmSbXzpXHUwMDExd+bX5Vx1MDAxZCn4XGZcdTAwMTJ2byVyqo7yd1x1MDAwMZKMKiTRlFx1MDAwN0YhaLQqW1x0ks/nXHUwMDA3QlI9uXrYmFPmoIVk1LNasconZXuiXHUwMDA0mV9aXHUwMDAyJ/uaSSlcdTAwMTQ5eJf0O1x1MDAwZW5cdTAwMTb7WoKrWVx1MDAwZpSmXHUwMDBmStVcdTAwMWJGyVx1MDAwMkFcdTAwMWFSutxywF9+0Faiw9Jk9SFaWaCvlSyCbS2Av1NcdTAwMWaoNslcdTAwMWJQ92A+3rTeXHUwMDE17adIrsTA08I64Fxy5PRcdTAwMThcdTAwMDRZ/CYpOrOmqukuvlx1MDAxMF2YlWaIwdiwmavFu1x1MDAxM/xcdTAwMTXNbFMt0lx1MDAxYVx1MDAxZlx1MDAwZa3YcE1cdTAwMDbz97HpXHUwMDAyUkCUhereXHUwMDE2vqBuTlx1MDAwN4pNVH1cdTAwMTFcdTAwMDDQWF9YwFx1MDAwZlDddfBcdTAwMDOk4mlOZa08JCVcdTAwMDTHttJF9uV0tVx1MDAxZVx1MDAwN56r24+3PMCjmthn0lx1MDAxZUhLMf32XHUwMDFhve7+7mds7scjQaZcdTAwMDCvxDaMLt6hM6SmKpzWr1XvzKTDmLDniUHdrjYuvcOFXHUwMDBindEnXHUwMDA0s96DtcB2XCInXGbaPGws36XyaUowIyOqgGB2hYNmpm2tXVx1MDAwM1x1MDAwMDRcdTAwMTA7p1x1MDAwMqg7h6rgvCagcVur+PcjU+15XHUwMDAwwVx1MDAwNFx0JCBcdTAwMWVcblx1MDAxOPfRXHUwMDAzWpvQzuPNcYGAIF9Lx1x1MDAwMUoo40KfkcRcdTAwMDRcdTAwMTDsWyF4byilRVx1MDAwMCbY9rtcdTAwMDdKZ1x1MDAxMz16lFJcdTAwMWHAXHUwMDExylx1MDAwN9dcdTAwMTZcdTAwMDRcdTAwMDfV8+IqJPrOryB1XHUwMDAxeVx1MDAwYndcdFx1MDAxZaflXHUwMDAwa0+oc/n1K2UjreLT6Np+yDDFXHUwMDFkXHUwMDFkQ23LIaveoy3jypBoq+BKTUl1h/yMeFx1MDAxZirT0H9In0zgdm2w4YkkXHUwMDAwzNpuprN7ieiK1Yw6iNTck7CcvNL0+rdk3i6C9tY1L9A1h0yUdHBcdTAwMWNcdTAwMDH0fZkxU7ohrZ/fX6NwXHUwMDE2LPPcQ1x1MDAwMSqnqVk+XCJcdTAwMTlcdJNVvfc4+PHaxFnq4YjtbUqiNt3GLy1yl1wiXHUwMDEzXHUwMDAy4HRRoricJtNZxnNcdTAwMTI1Ylx1MDAxMPtcdTAwMTG4XHUwMDAxXHUwMDEz9UlcdTAwMDKU01x1MDAxNpZWM7iQ/opxY0RcdTAwMTK/tS1cZpPSgbpcdTAwMGL6XHUwMDA017pZfYhYXHUwMDAwTVx1MDAwMJJcdTAwMTZRUK75qKGLajJPV76ZtFdaXHUwMDFlc1x1MDAxM+02XHLHhe77MbpcdTAwMWaHg7M5i1x1MDAwZscwcN7jRlxytNpOfyRYpY5cdTAwMTZcbnpcdTAwMTRbltdd9cZGrUxcdTAwMDF8XGJaSz/IiMVcdTAwMTbSc7ugXGLo0unLlzyuXHRCQYawUDRr+VYw1uB7Sff0s7Bd8Vx0nIdIglLS8Vx1MDAxNqpZlvMoqzZvfNXJMC3t+ZBCstfNPsTs9r04L/XaKe+vh1xuI1xmU+FcYlxmi+tcdTAwMTFcdTAwMTRNkWNtfFx1MDAxMkYpOohr25Gh6ud3W/ZcdTAwMTD46KhoVj2NO30+0lnDIEhHXHUwMDAwmN1gr9/HtrCjJ7idjlxm+q+tXHUwMDE05XMhcjAnXG7AzixJMCpcdTAwMGWSXGZsgqu7XHUwMDAzZUnXiHlrXGLOXHUwMDBls1x1MDAxZlxiXHUwMDE17kbbblE9XGaKS1x1MDAwNOBcdTAwMTJcdTAwMDOA1Km4s52+jyVT9jlcbntcdTAwMDS4piRcckxQg+SaxCaQXHUwMDE5kVx1MDAxNWpcdTAwMTnOvtxINkHh9UxmXGJfolx1MDAxMDBcYsNcdTAwMTlcdTAwMTjMM7cgXHIg20CLuFmK/fPFXHRMr0Ng2vhHR1JL1GSknlx1MDAxMVx1MDAwNFxyUELzXCJwq1fyXHUwMDA2mmNJhZngXraWipBcdTAwMDTbOSuPkzVcdTAwMWawXHUwMDFhflxixM/yV/f8XHUwMDFhLpGmqWqg0er1P9aYr8ZfPVx1MDAxNL/la1x1MDAxOMvJ+9v1+PuAV/H83Vx1MDAxZpHqV/pcdTAwMTPwntFcdTAwMWM+U1x1MDAxZopJSHaf473Ji7K4vN8vqnhnjkiWxnrfvns4VcWKakaqZDVcdTAwMTUhXHUwMDE4s97XXHUwMDA2I6zPrurYizfrrytlRbJX9/bO79ejSLU/XGKCnDebpWm6ovmet1x1MDAwM9uUQowtvNdcdTAwMGL/lmq2X+4wXu5cdTAwMThfXHUwMDE1aTvVISGMR6N2mKSlnmf8MfP7X2tcdTAwMTI0+JOwXHUwMDFjRKMs7eYusdAtwmrIXHKNJL8+7paT3DV9XHUwMDAwrSm2lZWGT7FcdTAwMGW3UrQrzjN5ZM9GTMaLmFx1MDAwZlx1MDAxNCBcdTAwMThZfnyhg/OILD6L3rZVuV4oLzf8VyU2eFdl6YPI6UWQVmInXCL2YvqHosjmd1x1MDAwNzWuXHUwMDE0tFx1MDAwMnsxPP5cZrZpXHUwMDA19DeuIYZl00OW7oo8yFfsXb9cdTAwMTnqK5fsiDNcdTAwMWb4XHUwMDE3dlx1MDAxODY1Xlx1MDAxN55cdTAwMDWX66zwe3A2nXGoW1x1MDAxMIOL0Xi7ui7M6aUyMGAnXHUwMDE20iyWZ3RSUfn4w4bxlFnjklPkJG+S1OFQXHTjTHPlQv4vXHUwMDEyNFFcdTAwMGaomutcdTAwMGV+WqtcdTAwMDRvVVx1MDAwNGxxQz8ur1x1MDAwND+v/uTBPDbIjpFlXHUwMDAxnj5RXCKMn6aLLKy1vNBccvOj028vxzF5tWmIqVx1MDAxMkGsXvD54Lq5u6ROh9PT+t5utmL9MFd3/+Svd39/JDKZfVx1MDAwNDOUiNxpXHUwMDEzuck1XHUwMDE5y1SNalx1MDAxN1x1MDAwMob1nVx1MDAwMFx1MDAwZVx1MDAxOFDAXHUwMDAyxq+TdKf/dZcmMdc5lveDkFtPIyqdK/RcdTAwMDGzTNMwNaWW59C3+FrvXHUwMDA2W8Pp65tpeyRXy/NcdTAwMDFcdTAwMTQkXHUwMDA2zXOuXHUwMDEyPrjczv1dOv1N9OtcdTAwMGKU2UYh5qRFZNR8c1xmXHUwMDFlvNm+pbT6QFle6X7uotyspCDXs1xi+jJcdTAwMDShpl9cdTAwMWXePmtcdTAwMDTSxdMugG86qVx1MDAwNfHNd6arXHUwMDA3U1x1MDAxYUTn7vIulMok9M9PWpOibEnVXHUwMDAwqibYxLS9XHUwMDA0bnyE44VcZvzqylify95fUVs9g9o6MVx1MDAxMUFj4KtcXIhcdTAwMDLFl4pcdTAwMDTOXHUwMDAy2n1ffNfqw6zJbp3Rv965e8rC7U7A3JZkXHUwMDE1vYmvg0lHiK3xObVWXGJccjN4XCIlnUMjyHj7yqz/ZUxcdTAwMTGct0Fccnc8qyquOcKKNYCSe1x1MDAxMFx1MDAwYqxHnP4pLJ2EWjlmUraHo4b3olx1MDAwZm3jR9RFslx1MDAxZNhfu5Nxfj35T6LHUFeevIdcdTAwMWF+SKFrXGZcdTAwMTXNjJeMm3aJuD63XHUwMDBlJVZUhVg6WOX3e0/STlxmXHUwMDFmMVxu2mFcdTAwMGJS9kjdqWw54e1cdTAwMTMs6NBcdTAwMTh2jEj0geJZ0lx1MDAxYsvL/lx1MDAxN1xc1+aj8VRQOSnkJVx1MDAwMaXvO5xcIkhcdTAwMTGfo1x1MDAxZsWXK2pcdTAwMDA07XTaVGdaOqT+XHUwMDE2XHUwMDBmglx1MDAxOWVks+iPJGfvwD7+T4KcPPUnY1x1MDAxOFx1MDAxYtqbs1x1MDAwN5G4mVpaZFx1MDAwMSn62aQgPNv7XHUwMDAxk12iJ5yfTc9cdTAwMTYg97Y6rc6Tr61cdTAwMTdki0qkXHUwMDFm5zXmlof88U9YdEzy649S2Gph2+I1Z5xcdTAwMWaNXHUwMDA3r1xc2V0+Nj3dIFxiMcQrZ+GukDLNU1x1MDAwM4u93l/eeNNcclx1MDAwNmJcdTAwMDHuZ8Ch56JcdTAwMDQxvXGSXHUwMDBlXGI0qdhegFx1MDAxNX1hQJ5cdTAwMGXey0znsjAu+IScaVwiIL1GxihxZEK56Fwih78xtDxcdTAwMDV42pZReuwnb90jrLx/9uONXHStsbONXHUwMDA1ntyA3JdSJG+Gv0xcdTAwMTP4nqNB5/ckhtWw5u6zqoBcdTAwMTlcdTAwMDVcdTAwMDaipWhUclx1MDAwM0CBlWVa1uXkzfNcdH2HnI+uxP07SSimTdg3tlGQ/9viJIFBKzS7c5/GY1mj759eYYmxXHUwMDExa2p4L1x1MDAxZuC13ylJ/p2MXHUwMDEx6ZquX1hmy8OtxiVQS7rQ/ac6s787icSqXHUwMDEysJZJXVx1MDAwNkhwRkzNgmz2ynJcdTAwMDT3qF6D9FPHXHUwMDFhXHL/alxcQkglKepuTVx1MDAxMPjVXHTfq+liRlEyhqgnQ1x1MDAxM1x1MDAwM0l5qKOXNUQoVik4XHUwMDBlSN9IXHUwMDA3r/X0uC5Kv+hcdTAwMGKFXGaCtWOIf4RcbmpcdTAwMTVEVoIuXHUwMDAyLlxu4GhcdTAwMDJcdTAwMDN/5fVhLFx1MDAwYnOB6IelS/kjf6g14pZV6jLazn/3NmlcdTAwMDd3QSTIzvpcdTAwMTdcdTAwMDdNlZdBToVOsv7Nk9NcdTAwMDCcokf6RySiXHUwMDE2JjPhILpcIkFAjHFcdTAwMWaAYHRcdTAwMTJcdTAwMThJXHUwMDEww7vf76DDXHUwMDEwMzU130jJzsrc0cRWJJixXHUwMDAyy+v7apZcZq9cYpLN2Fx1MDAxM8guxVx1MDAxYjS54lx1MDAxOVW/ZpPH8Ml95HSBwLxcdTAwMDSqlyhKR1xmtWm2XHUwMDBlrZzFWjWeb3NeXlx1MDAxYX9B6ohxU4lR7vuY1oV+isK+1ZeVcUghL15cdTAwMTJRcnLg89lcdTAwMDKwmrCk9qPHWnmwXHUwMDA0c+2wjuRcdTAwMDCEN2KnjlHW4Vx1MDAxYXBEiNJcdTAwMWOHXHUwMDE4Mi0mXHUwMDFmlbStjtpcbm7J5nW7s+C+qX3YXGKBYlx1MDAxM37j2K2NJ3I9XiRJtN3pzshBxEDCZqBcYlx1MDAxNeXvbH+wXHUwMDA15m9eUZhu2uiR1Fx1MDAxM3E4lULHsM71i72fWP6gnZV2XVx1MDAxNOfyukHpXHUwMDEzml37UyRCqJXIwnTZXHUwMDAzq0xDf6fZXHUwMDA0nlx1MDAxYVKMraOS+o1AXHUwMDExkCHUwWNixFx1MDAxY4dI6lx1MDAwYm1UVl250FmL+/mrQ3ZDKUNHVs2sXHUwMDE36kiKXHJJXG686lx1MDAxOX+TTSCvbvWZTWK+tdwrkuan7+BcdTAwMTPpvmPaW31ChrNgXHUwMDFm3Vx1MDAwMrHltTBcdTAwMTCDmiMyIegpXGbQQ6nLiK9IrVx1MDAwZTmLXHUwMDBig4VnXHUwMDFlKDpcdTAwMDBcdTAwMDBw7EDWXGLMXHUwMDA05mtcdTAwMDRp/Fx1MDAxN6GyYGztON/1OMI0WtTPvY2vf/ZcdTAwMTZcdTAwMTMsXHUwMDA3i9SCV8/olz/Gom/Qd/ycVlLksdNxfH6NP2lcdTAwMTEvvVmsj+Eskvq2XHUwMDFlv7mqe3xKv6/oS5h5eEpPaIkjXCJBXHRcdTAwMTOlkIh8TNOVY0JqteOoSCjYXHUwMDAwI1xiJoS5cCw7Y+LNl9V3zukt/5GgsHZhKddfS1x1MDAxNoBcdTAwMGKb5znrSFx1MDAxOFx1MDAwM68yiillgD6C/D1cdTAwMTj+79rasiyLO8PNdlx1MDAwYko9w8XX8NIoXGJlyE2STu58kVx1MDAxNiNcdTAwMTHQvD4wXGLcUNJcdTAwMWRCw5TLXHUwMDFkvXj/+/BcboN22thcItGlSNIvTo/SosAug7s1alx1MDAwMVx1MDAwNWwlLlx1MDAwMnlcdTAwMTOkPsyP90c1n/VcYqe4VKKeZWtcYlx1MDAxNLJOgzr290mi31x1MDAxMFx1MDAwZXWldJPSyVm0p0yclkMn/aRcdTAwMTImLnFJfEmqRvDckPU4kf045mQ/4/uLSMvPSqVX5YpqXG6xbJE/4U/63fYrR788t1WUz8DO9SzOXGY//Z1lR1+uZWjuONdCWFx1MDAxMKfIyVk9QrJcXFlcdTAwMDJsQVrWelxyVrfDxVx1MDAxN3AuXFz62S+0OOpkclx1MDAxZoCyw1xm+Jqcn1DplPmfj4/QXHUwMDBloy3LUtTzT9tcdH1pbuo4/rJcdTAwMWEmXHUwMDE2Mozn55uTwLrIyt1GpmuTZORZmqFcbrf9hDRcdTAwMGLEj2a8ne1NXHUwMDE2LPFxPT73WHeDYzKrzXRUijS0v/XzXHUwMDEy+IWgXHUwMDE2REtcdTAwMTLhZ1mN5CZvfa43SV1AXseJeLVcdTAwMTifM4vxjp264sDnteMxj59CRkjfXu8x4qVcdTAwMGJM/i4lhlxi0lx1MDAwYpKD+GUkKmR/5E1KzLaCtd91z7zvoJI91qLBYb3PQvBaRJ+x7OlcdTAwMTf9dM3YapIl35fJSexDeoed6j1BgYRVu5REXHUwMDE5sGZCK2Y+XHUwMDFhiF1bvnVcXEqAoOxcdTAwMTJcdTAwMTRcdTAwMTBKY3TYzqNUf6dTfF9y28NWN7ljKTtU4luIYuVcdTAwMTBtTzgvrlx1MDAxMEFBXHUwMDFifqxcdTAwMWbmQZw6JuFcdTAwMWawgbiY4tDj4i+mNlx1MDAxOPCdtezvJCC8Q1x1MDAwNVlcdTAwMTFcdTAwMTR83z5cdTAwMWXnY592+481gDoj83flQZZMjDhcbrFNYsyZKVx1MDAwMMBNZ1x03sNT4Vx1MDAxYZSphVx1MDAwZs9ccjWfndRUXG4+PqCIIYSjY8/1XHUwMDA3nmNcdTAwMGWRnzqBgFx1MDAwNVx1MDAwNuFAsXkg1uvoXHUwMDE3XHUwMDFkK+1cdTAwMWaBS5eQrLXtxWqOXGZcdTAwMDfQ6Fx1MDAxMPEwXHKGXHUwMDEynIm3bafzhVx1MDAxZsT5RFx1MDAwNrBcdTAwMGbEXHUwMDAyqHqHXHUwMDAxXCKaxraRtUzHh9SPdm9VZbfSXHUwMDFkgJJSetNqflx1MDAxNlx1MDAxOT1cdTAwMGJxMiOif/Ptt+NgXHUwMDBif3PjpVx1MDAwZTQ6i+HWRUk1pvazP4dcclx1MDAxYiqdYUTBoUZR2vM0tGOfu45cdTAwMWFHQsqsRUndx5pvTI2Ld1oj627SsPVcdTAwMTCjxkVcdTAwMDGcNPzJJ0n+XHUwMDBi0PhcdTAwMTOsXHUwMDEyXHUwMDA2ZY9cdTAwMDZcdTAwMDWcfVn768gjQN+Pp8vbxS3toJynhu000+QjXHUwMDE40JdcdTAwMDJAlHOTzUh6VjlqiSss7GSugz4uwlvgpDp8UzCP/lx1MDAxZL6o4IhkXHUwMDAyXHUwMDAwSMNcdTAwMWH8sE5cZvdcdTAwMTJ14FDdglx1MDAxN1BUo2G9z4R8r1x1MDAwZlx1MDAxYUndTCyvym1eXGLjclx1MDAxNWY3LqFMfeNcbsq06fdLj1x1MDAwMLjTeWj1u1wiWpds11x1MDAxM871kHqGUJdcXFL/ibiwgq7Iejzs4YjEXHUwMDExP/6MxMFcdTAwMWQ+3Tv1ZZmI3zHcpvmEJuPxueo35jrBcFx1MDAxMEBcdNKalUxcdTAwMTPmjm/nN6IvMVpTTl6eNbDvznNcdTAwMWOlzy4qLiCv6KaA6DcgzrfGID/TzW3B1OxWmnWgVD0vW8zqd/Ce8aNNk9TGReGpYpuc3eDlXaLjXHUwMDA0IFx1MDAxMjN+JEuQqnHw/cCYKN9mnTPvXHUwMDBm0KL/lPZcdTAwMWHaXHUwMDE3ufRrVvBQXHUwMDFmhktSNDc2tUBcdTAwMDNTLUCgyFx1MDAxOVx1MDAxNpom33NcdTAwMGJIn1x1MDAwYiF4+FtcdTAwMTRtmZja5Fx1MDAwYr9FzyTpjSavrSCLXHUwMDEyXG684PpjjH8/4nxZiYRbQVx1MDAxZYIuTmtcdTAwMWNvuGecxWF0wlxcXHUwMDEyflx1MDAxYlx0YFx1MDAxOfbd48+glb7d3Fx1MDAxM5ZcdTAwMDbRy1G4XGJdYlx1MDAwNq3PXqfmXHUwMDA1wyB4XHUwMDFlXCJcdTAwMTiByFPpQNNqXHUwMDE0RlBcdTAwMTPyXHUwMDE0XHUwMDA2Wjv8ZY/NlyxcdTAwMWZNzca8d1x1MDAxM67oKi/8uV2AXHUwMDA1vjaqQe2sNUrPhZzHXHUwMDBmNqrqqLh21di/4Sl/31x1MDAxZlxiov3PoFx1MDAwNl6meVx1MDAxNtugJ0cvf9CftTSLnC1cdTAwMDfgXHUwMDAxN0KcXHUwMDAwIVx1MDAwMVx1MDAwMIz/jEpqLV3kn1+k2ie/4/xsMullxo22to3roi/7oWEuxelmltpcdTAwMGYgJVx1MDAwNTW25r1KMbrkzYGAZUVcdTAwMTIvXdgm2ch2oFx1MDAwN+9cdTAwMTTwilx1MDAwMVxiyjh3XHUwMDA0YZCB115Tvlx1MDAxNY2FbrNOXHUwMDFmb6D81ZRcbufYz0wyJZjutsVcdTAwMTjsiJddrCOk4O8rYlx1MDAwZlxcqY1nWTCk+X2dTpBcdTAwMThDXHUwMDAxXG5yi4wrNmVcdTAwMDFcdTAwMGbiZ9snr79NXHUwMDE5XGbI6s/PrUitOF5cdTAwMDd2/Y526nH43IOzgT7j3Fx1MDAwZlx1MDAwNu7xNlx1MDAxNEnedeVccpI6XHUwMDA36cSRPZt9P/7VXHUwMDFlMPSVOlx1MDAxNUKiXHUwMDAz9IIriktcdTAwMTioVODUrCBcYqapXFziyWVTId59WUVcdTAwMDQ+XHUwMDAwr0ClaFx1MDAwM9FcdTAwMTNcdTAwMGZcdTAwMDf8huJcdTAwMTDq0ql+XHUwMDEypChcdTAwMWG1p1x1MDAxY59pXTJv14/Xouu+1Tomj8BcdTAwMTGkXHUwMDBmM4KisVx1MDAwMUDQd75ieLCrO4hcdTAwMDbDepFMXHUwMDAxxUJFZHTE2rK1heWYXHUwMDAxoJvnmNX4kVx0XFw5XHUwMDE1Vp23eNeW11qibkaycIGzXHUwMDEwYEhyXHK+dlx1MDAwNoJa/eZVa5hVeuhcdTAwMTltzadxcnPc1eexb9Sk5VPp9XTjhvRiXHUwMDFjYCxCgSV3ir11Tll5SlZb7GybXHUwMDE3II3dPpP6vqv4udOYy+rTLDxMuJSVRmSnyW/U4q35XHUwMDAxIFi9XHRBQZS/L089qZvhV7AjgWX7vsybgX96iIH3klNcdTAwMDDktVx1MDAxOdJ1mEzAWSpcdTAwMTVC8N/t14lcbpVGaX+s4XNcdTAwMWJcdTAwMGZ0v1Oaypzv7FaRhUNRkDjESbVcdTAwMTRjaVkpwlx1MDAwNqBGXHUwMDExSjCwLOY+K88jXHUwMDBiX5660vLkeOhx3a1CoJJx7+LRXHUwMDAyJ5hdXHUwMDE4we9y81x1MDAxMUZcdTAwMTDlXHUwMDE5dqj2Tbtwq/0mXHUwMDE2jlx1MDAwZVx1MDAxZvZRLquVXGJMcqJcdTAwMWS1XHUwMDEzYZ2iXHUwMDFhzlx1MDAxYu050rnwXHUwMDFlzORcdTAwMTGa9WRa0Wl+OGk3plx1MDAxOaOiu6dqb7/aq1wiXHUwMDAwzuaeWcTPwsXYZUZcZlx1MDAxOFx1MDAwZl1lXHUwMDBloFx1MDAwMcInXHUwMDFky1x1MDAxNo8kWSefXHUwMDAx3cyDXHUwMDE0m0Fjmjc4v6a49jyBctFL0VlcdTAwMWF1r97k5fg6xubca05klUbrXHUwMDExol3oSEnU01x1MDAxMbFcdTAwMDWJi1x1MDAxZFx1MDAxMrM8z69XhTMxZrM69lvFXHUwMDFiolx1MDAxZvCAeVx1MDAxNGm97biFPVnXaD4ptSdcdTAwMDG/+Va9plx1MDAxN9AtR4Qv2lxu0yhmp1x1MDAwN1x1MDAwN4SxXHUwMDFiY8TsccJcIib2qTOYfjSHqzKnMIbF48gmLJxymKhDs2YnO1PzZGEriFx1MDAwYp2D/e/b3ExlqpZcdTAwMTY9eJeNpczr6VWkammZ56T1XHUwMDBmvajN6kHdL4yYXG5cIpwhK7MguI1cdTAwMDFcdTAwMTaut+NllFx1MDAwNif4NNuQbz2mUYx9gup1Vtlv3JJRladcdTAwMDdcdTAwMGZccths4O5cdTAwMTCmrsL2XHUwMDE3yCqQ9Fx1MDAwNm5aX7ioPVx1MDAwMG9mJoGRuYV2ppFzRfOtTsdfhqbbXHUwMDFhZmBcdO5cdTAwMDNaXGaOfm1cdTAwMTdKxzWs+u6yJLBl/KDic2g2T9uXXHUwMDFjonkwelxy7C9tXHUwMDBlklx1MDAxY6y4XFwrXHUwMDAy09e2/OtcdTAwMWFkXHUwMDExrXyT5/7HviNcXHVnXHUwMDAwRVx1MDAwM1x1MDAxZqs2XHUwMDE2vOCfV2vXMohcdTAwMTW1NeD8XHUwMDA2lfPsXHUwMDFmJ8DxXHUwMDE5U8JcZnPAjylcdTAwMTVNnps8Xc17ds1cdTAwMTNcdTAwMTj9j8v3xnqPperGjSeqhdrbXHUwMDFhZN7s/DBcdTAwMWLgrSO5v1x1MDAwZZmeWaU87L+TqEemXFyrJP44nC3hgdF4OW+z30D1XHUwMDFklPFcdTAwMTnu5aaRqrvrW6tcXCeIKqSwmXZcdTAwMTLzXHUwMDFix8zJwdfeflj5fXfd55B4+9F90rpcdTAwMWZbdFx1MDAxMlx1MDAxNedlpUL3RiGR0q1cdTAwMDZVdJM34vDEXGLocsGsXHL1xlx1MDAwNuO9aVdR0OXjrPcy/bOucVmYRFRcdTAwMGZnzZB7KeSo0VxcXHUwMDFjOFm/XG5RRYtcdTAwMWFcdTAwMWZ3j3Xw48CS4saP771cdTAwMWOWwHBkuVWWpPH4xqHT6JxcdTAwMWSAM22AfqlfSoBu+t/t4pcu/WiU/OV7laHDO7ghiFx1MDAxYkpPT4Y/duD1zbDI7GIqs++fsTT8/qSHXXBcdTAwMTIxcqRYcnbO1+MyZ+LuTzdcdTAwMGKpWIJcdTAwMTcyyoA/SLTjViR1kSSjXHUwMDFlRFx1MDAxNENxfcjtVVx1MDAwNFxyXHUwMDE0UO9sXHUwMDE5qlOjOnPzalwiI1x1MDAxYZTBzlVdXCKbXHUwMDEyOZPMTEnV7eR5SsM89ek3QbObwctMwz9+2npcdTAwMThcdTAwMWPd8OjxL/5xYoZcdTAwMWPnw31bjHu+pqk9XHUwMDA1WVx1MDAwM783KrncS3/bPrUyz/1U3Vx1MDAxZT6803lcdTAwMDJx8yS8XHUwMDE1zFx1MDAwMndcdTAwMTaWXCI7b/iSseaU/nhHNat2O4tcdTAwMGaKmVx1MDAwMkz8P3Sdx46sQIJFP4hcdTAwMDWQkJgl3nvPXHUwMDBlb1x1MDAxM++/fqjWSN3T3bN49aRSVWVcdTAwMDJcdTAwMTH3nlx1MDAwMyTh0lx1MDAwYkaY3Fl8qFx1MDAwMC/BikvnzF39WjtcdTAwMTjyffFIMy6sIGhcdTAwMTf4zNGmtZpcdTAwMTmZccve/ENgReNcdTAwMDQ0j3p7WVkupLtlXpWb8KDZ80RGj6J5XHUwMDA1JrvaxVihXHUwMDFlKs+RXHUwMDA3vWfhtTr+TilwMLKf7bZcIlx1MDAwN6L8b502gHeDUDGcXHUwMDE4SPm0Slx1MDAxZmFo1eNG5O/MR5VcdTAwMWbRXGZs5dtf0H20IFx1MDAwNVx1MDAxMqhZQitPze1HzZGBW1x1MDAxNVx1MDAxYTIjrz5cdTAwMTgl3eMvXvV8bH6DeVj98fhLRKyh+GNcdTAwMTGC8pqr0lx1MDAxYWZ9Zy3b6+pZtF+FXHUwMDE0oti8XHUwMDEw5MNnXGKKWeMx9Npq5ZnFkcTa97vZJD+c3XrsXHUwMDEzXHUwMDE5XHUwMDBi/Vx1MDAxOFx1MDAxNq9HpDi0XHUwMDE4O/z0XHUwMDFmum9cdTAwMWaSoS1RU74lXHUwMDBmPFx1MDAwNShcdTAwMDCoXHUwMDE4L1x1MDAxMqYksupPeedcdTAwMTPOuf224Gdy3VxyUlx1MDAxOFwiVnU8sGuR+HVKfVx1MDAwNyVw5T1MhVx1MDAwYseBb2L+s1x1MDAwM+63XHUwMDE4KFpe32KgKFx1MDAxN1x1MDAxMDR5lWjjO4BO7NGh7bEuS67yXHUwMDE5qFx1MDAxM1xmyqmdXHTt71x1MDAxY7XAMz5KYHa/XHUwMDExsH+FXHUwMDE2nkdamYPpS1gyZyijMktVMUVcdTAwMDNG+kPkXHUwMDFm9jFUfkKv+e1EvrjVXCJyV9XZp1x1MDAwNGpZOys+mmjqNClcdTAwMTj0R7pehSVcdTAwMWJx/4hv+Fx1MDAxZFWWd9Xlyc2dvuSZ05sl8jblLvBcdTAwMGZVP0c517eRi1n+XHUwMDA1WoN8dER5SMKYPlxyxzs986DFMFx1MDAxYUjymbUmN0DeXHUwMDE2tTZRp9HqhnMhRv+ET42FXptPaFuspuqJXFxcdTAwMDZcYo8s8aaz8Nibbiivxj5CpDCVgc6xYeb0cPO1PbjXU4j5XG5mXHUwMDA0Zlx1MDAxOKaOXHUwMDAxXHUwMDE1dsKcW11YWaNHsnV6XVnkXHUwMDEywj9lc1xisPoqTJlTkOihg1xcXHUwMDFjb1x1MDAxOXysWN0l8kvLJn3YWSUnnlx1MDAxZnbi2rJiWX6snLwgnFx1MDAwM9W3RVx1MDAxMVx1MDAwNKDt3Fx1MDAxNKJcdTAwMWTYXHUwMDE3n/FcdTAwMTTa9mtcdTAwMTRmqp+HR1Usi8Lc8OPfyq9rXHUwMDA3Ycsjr4nppz9qmqaMXHUwMDBmsPmWUJqpXHUwMDAz1WlcIm9uop5zinRVtMhClqLN3lx1MDAxMVx1MDAwMzA/UFx1MDAwZtBcdTAwMGY1c657QjlcdTAwMTXvu7o+xDi2jlimtGryXHUwMDFhXHUwMDE01XLuyVx1MDAxNpZK7N9Nn+7yU4dObOOXNWZcdTAwMGWs+2lcdTAwMTJ6LDOt72GymjtcdTAwMDdd7NdcdTAwMDFpZceER83EjEotTY99sKGgXCIn++YmfTlRy7dccmXWn6P2XHUwMDA1j/b9K+DD5WK/XHUwMDA14T3+yMgmfylKM1x1MDAxZa9t0Vx1MDAxZKLPvYnLXHUwMDBmNdf5jXqmj1x1MDAwM/pcdTAwMWORsIXP4brMmzwx89hcYuAlkcD4fZ0yLLNcdTAwMTZSynZcdTAwMWJ32lpcdTAwMDczmpBwIFx1MDAwNMHpoHjvJ1x1MDAxZqNHS/zSlIBcdTAwMWNY9CZ9h9NPf82/OmGDR6tej9HOqa5bQFxy1Sdm4M5Al5/+bt81maZ1XHUwMDEyWupcdTAwMDB+hb5cdTAwMTCTxG+Ul4xGhz6Utp4zQ0xkXHUwMDBmNWtR0ItcdTAwMWL9i7LcKmFST+KQuz81wMXSgcTYXHUwMDAzweZbj5VWXHUwMDBm+kB4452Tz+PB9IKmJoL/2HtkPlx1MDAxMzZcdTAwMTdKeM0uPLmOUL2D6eXmRVx1MDAwYl1HVFxcb1x1MDAxOXlcdTAwMTPGb7pcYnTM6v0pjDKY9+n8PfhdxlaBbUC/70fNXHUwMDE2Olx1MDAxOD9cdTAwMThFl0d7O+hZQDRnXHUwMDAwzCdcdTAwMTYnYHbTW8ZcXN3JnUsmczXLat1ShGTQJFx1MDAxYS9OkFx1MDAxNnNIPIGvR1x1MDAxNE6E+q/d9oPniEXQYLQlu9vtjFxuOpJcdTAwMWKVXHUwMDFiI8DKyoqC/VTh7N7GZUVcdTAwMGWj1UZRrdyzUj2z0MSNpG/tdd9AXHUwMDA0clVYi/rHksNcdOTjtU2SUTGpXHUwMDE4Y31M/3135MLiXHUwMDFkzNvvQu1cdTAwMWbV7Fx0XFySfrOFd1x1MDAxN2vBeEJyJ6BcdTAwMDVcdTAwMTZcdTAwMWTOVaFeJ1wiXHUwMDAw71x1MDAxOO+4kTH66DdSXHUwMDAwMFx1MDAxNlx1MDAxZb+Z4Vx1MDAwMDfjO1x1MDAxZqLaxFx0KX1zw4pcdTAwMDFcdTAwMTlcdTAwMDKohTHEeM0/s6ywi/770KtcdTAwMDeA9eFgW8lcdTAwMWP6S87g6tLvdibvyFx1MDAxN1x1MDAwZqGc3mZxXHQ2pSbGW7yy8K6thbCUuPKPhdzieJpcdTAwMWIvzm58USlcXMnxnCHXjVx1MDAxZlx1MDAwN2FEXHUwMDE3uDNs7/xcIso4bdVKnVVK5JHTXlxu23I4pTBzOMZF+H5cdTAwMDFVfXKg2t++JaRcckieY8FcIlx1MDAxOcmZ2jmxqKs/v0VQvUPOL7xcboeXKv1cdTAwMWJkoUlcdTAwMTOsmP7NQVx1MDAxYsuej5hyXHKI/5rn0Yv8b8i/cZ+e12WMbMVt5SpcdTAwMWSkJYg7XHUwMDE2dyEyo6VcdTAwMDdCXHUwMDAzSE50aDE8g4TLUvu8zlxiliO/UzqZXCLDTVrUoaY9fHyVXHUwMDBmy/lcdTAwMTDy4vBzJlfp0o35j5hVm39cdTAwMTZcdTAwMTNcdTAwMTJcdTAwMDHEjlx1MDAxNFx1MDAwNrD5Ob2qXHLHXHUwMDFjPHogTF/o7HCE8ktWjHenbMpRXVx1MDAxMFx1MDAxOVx1MDAwMVSBXHUwMDBi/GFzhfDpd07m2VRXv9l/PIgjQlx1MDAxZXhcdTAwMTOqvJe9UKpcdTAwMDNXXHUwMDE1XHUwMDFh/qbm9ZjPhVx1MDAxOT/Tgt+jxjbSL55vvcg9jtfxRrZkdjRcdTAwMTiLcMe44dLO+KFcdTAwMDWIIFLBdLWkXHUwMDE1Oy3wXHUwMDA2SNBDkvqFkHRcdTAwMWMxy5TDRP6F+vZKaD/u1So7KVx1MDAwNFx1MDAxNT3Bllx1MDAxOIKgoaace4FcdTAwMTNioPj6dn5cdTAwMThcdTAwMTHOKsdUprzyIIgpXHTSXHUwMDFmXHUwMDAwMCu2NI2yvHlcdTAwMDRBXHUwMDEy72v4XHUwMDE09Fx1MDAwYlDkXHUwMDA1Y97yhVZUmHeO2f7Cw1x1MDAxNvAjIJ/y5tA3T6z63jCL90LSdIFUqddWluB4pOZ0U1xiXHUwMDBloC4xqlsl3j5Tf/LLioul42tBx1FXm5NcdTAwMTTvkTu6K1x1MDAxYvpINa13XHUwMDEwyiaTNWlezEXsXHUwMDFk0jzbyqN91y7NZcxYVkRNXHUwMDAwxYFGtchpjcP4ILcxXHUwMDEyis+S1Da1I9JLsPg3XHUwMDEzY5Feb2Zr9Y7P8Vx1MDAxYV2iP62wjuKie3C3KpGZjbHDxHryfyaKez30ZYK+xs0oXHUwMDBlKoGZmnm8qJGqh01o9OsqwNZjLG3oe5tScSg9SORmv2Snu2GevmXgQFxiIOvnxCuqXHUwMDA0R67UTFJuXHUwMDE0J9y/SmBbhjRCNTpccjFcdTAwMDRcblx1MDAwMkZcdTAwMTBcdTAwMTXuaDwj6lx1MDAxNy1cdTAwMDN2JFx1MDAxZFxcJ+LpqF9cdTAwMGZcdTAwMDKRXHUwMDFlLzlcdTAwMTZcYnl88tpH5PfOp2RcdTAwMTIyq+3Pj7GjmHFz8S6DNj1cdTAwMWGi+LmVvoMy5IiSp/vnjVxmU63FqTZEaKLWJXNZXHUwMDFl+iXlXHUwMDA1MudcdTAwMGbbUo1cdTAwMTZcXFx1MDAxOfhNolVcdTAwMTla31x1MDAxNn02mJZAgFx1MDAxMXKgmKJTS+PL4NVpQYS7QInXU8Ap05uKXaaVaMNZsq9/bLF3nMR0XoQ0XHTjJ2g7R9LfNnaRYVx1MDAxZVwi0sm+MINcdTAwMDeuSWx7vzziXHUwMDA3qj4t5sRqeO/FNqw7JDUssauPXHUwMDFlXHUwMDE2XHUwMDE1mM+DpJd4M9zH+TVsXHUwMDExTV37oIDNVFpld1x1MDAxYzuBw679iOOk5GeRb7jHP92JnvXfcqo8cNREOnF06sKL7zlcdTAwMGZS25LUgKFIpOL0QXmB81x1MDAwMaPlZZwnnsZCQ93iWlx1MDAxMo1hqnYukI7/rk9cdTAwMWTkh0LyXHUwMDFkiUDlZXTFOmz446be2zUsM80j6tE0vZC8iZqpMcSM30dabF1f7run5t37lIx9Wd1EXT6nXHUwMDExdOVabqM4JFaLydVcdTAwMDR0XHUwMDFjVypBeLq0dP7lfXueKXKKfYspS1x1MDAwM1x1MDAxY9cxoKItXj9cdTAwMTf892Cwr8tdwFbY+nOdX2pcdTAwMWaNXHUwMDE5S1x1MDAxMIlcdTAwMWR4JYzUelx1MDAxOVx0uYGTXG5ccn5cdTAwMDNjieRX0HuqXHUwMDFmvYnIX3/zXHUwMDBlu32Zes7gXHUwMDE0fVx1MDAxZPBcdTAwMDMyPynDRcepXHUwMDE2qzE4LjWCKFaX9lx1MDAxYlm62br9UDz+VDSr4PZcdTAwMDTv7ldcdTAwMWFcdTAwMWPg38fR8an2LVFcdTAwMGacrncjh2U/wmzc9KTWlW1CkSZ09bJcZqR/3Cjqw1pR2LRg8oiNXHUwMDA0xieZNXvD/p+8jk+Q6rIqYlx1MDAwMvRcdTAwMDE56Fx1MDAwNH5fV6mWXHUwMDE4cDhcZl8yXHUwMDE5iN/srVx1MDAxOSYkgYTvrpknnL+1ibieXHUwMDEy0JlJJSPhRIx79Itcbjk6NIXZd7XRXHUwMDBltc+Ff6eMcmGAXGImaa7WgtfY1vVeN+36eT27UGGmkTq9XHUwMDFlMH7LgvNcdTAwMTjsyW909HOhw5Nm2ujuZvxb0Vx1MDAwZW+vXHUwMDE1zdr+qzDs/sFIzun203DecSbCJZm82138ZiV12WBEZYK3kESGf9jgviNFnSZG1npLrFeSoILis9c3XHUwMDFkUVx1MDAxZFx1MDAxMICEedNCOfOUXHUwMDAwZ7JDO6Q2q4qWsM6bo7OeXHSJ2lx1MDAwMMKGZyGTJcZcdE7eV1x1MDAxYY2IZt2c8ULXoy1cYipcdTAwMTcsIJmvg2SQYfrazVu1aPlcbjMoV1xuZp9UxyE6xb8gb1x1MDAxMoCOhFx1MDAxYSXzt8gs1sqOPVvkXGLvOpSmYC07XHUwMDBmQ7RcdTAwMDLtefH3uVx1MDAxZZZPP1x1MDAxNlx1MDAxNir492J4I13PMimPVVx1MDAwZkNcdTAwMDRTnifebZU9KVbJ+sZ15+QtNlx1MDAwMcytd786XHUwMDFj+3p+O7+6vZ0vQqpv/1x1MDAwNviXataM92754mvjeyZqYlxcKdvCIEmTPGX+LIVV5LPD31xuqpZcdTAwMTFcdTAwMDPAvTVvR9GVTNi+YO5cbsXviVwicSZSLlLmpKmUn1jfkL2iR+7zNzNgpiVsXHK1jJZKWfHjgNRIXHUwMDFjYVx1MDAwZs2jYtBg0frgb5KO4XPOJfdrbWvgUlLRXt9yopqXXHUwMDFh2Yg0d+VhccBfUWW5tNq6TnrtjUXgTLtcdTAwMDJuOFx1MDAxNen2utOjROZcdTAwMDdHqtpHcaRIXHUwMDExJlbIcVx1MDAxY2j2XdGivlx1MDAxY5ztXHUwMDFjVlx1MDAxMzzZ14NigFx1MDAwYuZHLsjZaO6wMvvBVNDvtL6dpMtcdTAwMTU+VTBcdTAwMDGWJ4TGL1NxnFNJgj123eQkzFxuaZZrMmM1e9lbVVx0tlx1MDAwMpSD0PzZtk+VXHRjbrIjRi+nrsTtxyRvxKxzXyZsWNkz9sKNXHUwMDBmm2iCeGHYOzyr1cPJW8BK5DhcdTAwMGaUXHUwMDA1IG/fLsaBnaZqUFx1MDAxZFxiRdL0n1x1MDAxMyrkXGLF97d/drW3fbPKJ0maxl95Xpqvp7PAdvpcdTAwMTVlLjS5XHJCpqH0iVx1MDAwYjGJzN1cdTAwMDajI4T0x2OwT1x1MDAxZX9cdTAwMDJdjdQxx7tqi6Jccqg3m3ar91xilmd02tQtprzSzFIyrdSHcyBcdTAwMDZovr6HRFx1MDAxYfhJ41x1MDAxNr0p84xB4vfOs0s6z25cdTAwMTRccqXaK7io41x1MDAxZEMqcF0kIzJni8bpgUBcYuPv+TRNNV2iNYyQXHUwMDFm8aQsX1x1MDAxNS5cdTAwMTjKTD3KvFPuyvyCtOjKXHUwMDFi5KPOP1x1MDAxM1buLbqsi0aoJrRS/lb22n9iXHUwMDBiXGZl5UZLZfA1RVx1MDAwM1x1MDAxYVPUoZNsIVdcdTAwMDPAei7PRX3534bNXHUwMDE2h1x1MDAxMPnoXHUwMDE3XHUwMDBmmmBsXHUwMDEzbcG48tNcdTAwMDRcdTAwMTj4XHUwMDAzYvwnM3BrxHibvoWd+ntmhOs3sNBQx8jg5lx1MDAwMnzesf2+2fD0OMbYspKrddTq6GN9pbXUO3zMl7VcdTAwMWE+tYo2avprxNPWXHUwMDAyaT6X21xc4ODzgGmjr0z3QT1d599cdTAwMGXBokXK19/MXG5cdTAwMTZStXJcZtqR6bqQjj4oXHUwMDExfVx1MDAwZf9HU3LNOVnnXHUwMDBmvlx1MDAwN30rXHUwMDEyXHUwMDE02s6MK+q/nlx1MDAxYm9cbuaUOVx0M1tcdTAwMTP0ZMr73i3Dv7RNl8tcdTAwMTf/dl8kkFqCYPZ62ZNbSaSbw7lcdTAwMTZY31chyaWjKIaiXHUwMDFjz6b9N4+bL1xi8i/V+NFcdTAwMTXtl1x1MDAxMFx1MDAxYlx1MDAxNmd/XHUwMDA1avxcdTAwMDbA71Yl9HajeqR0QGdbXFy9XHUwMDFhXHUwMDEwXHUwMDEwXHUwMDEw6VebdtUjXHUwMDEyXHUwMDEya3xcdTAwMTAmXG5ld1qNU4dxbV9cdTAwMDPHxVx1MDAxNN7B81x1MDAwNNJcdTAwMDPiUK9SzM85jLCIzmX/+fXpXHUwMDBiXHUwMDE51qhcdHD4/Sa8e1x1MDAwMD90hvLjayDyJV21+bIrRFx1MDAxNmfi4Zyt/X69u6eJ8Vxy/TrX/lx1MDAxZehcdTAwMWRcclx1MDAwYlx1MDAwNGFAnaVawEglkejV+Niy9Fx1MDAxMutPrPBFgWayqjqOguiEaenlolx1MDAxYYIsT9fRgLGxXHUwMDFinsxcIkRcdTAwMDE1qDVdyNcv1Hn2LMu5beY/h1x1MDAxMo/Q7JCNQEi2RLMwXG7kh7mad+FcdTAwMWJXXHUwMDAy6mAnp1xyv0lXXHUwMDEx61ryO0fpsoyzXHUwMDEwTjSZXHUwMDE3XHUwMDEwxZ5cdTAwMDXApL1DTJuEk62gP/Nl600ll5T8XHUwMDAzwahB+lx1MDAwNqR64CiseWLt6FJQXHUwMDE0YFnlt1Lt66JcdFx1MDAxZMyjelx1MDAxZFx1MDAwNS6+XHUwMDFjVNpSmlYu3c1cdTAwMWYlsLT0iS74Y1xcXHUwMDBljNOTTPF/672brErxeUDLfNObLFD76lx1MDAxYT4zI1ZE3lx1MDAwYpuzXCJcdTAwMWIxSr+pIcnQakdEkcakXHUwMDA2bqqfaFfR59zb3pptXoKV6CXzXty50T6Ml8O65fwzzUqXakU1wM+CeqtT86vdWLzdf/bHM+xEWL7JwS+fxpN7ejw7nXEt8Fx1MDAwNMelf/1cdTAwMDRcdTAwMTNcdTAwMTRcdTAwMGKNvkxD2c3NeL7dxWRZtTGSZ1nLfUFcdTAwMDbfzupgelx1MDAwMzfxmkGf/Vx1MDAwNVx1MDAxN1wir/y6i7JcIv2Mb/02ufRSTvfF4bluXWU5xbaLKf9OY0d3v9TrdGBOW5uxXrw66eeuxFx1MDAxMchcdTAwMWM9kDVIoZFcdTAwMGVHu1xi12twS//QeFx1MDAxYjNcdTAwMDaVMZq4XG6PXHUwMDE1vYrX/WzoXHUwMDA39NVcdTAwMWPtrPNZXHUwMDFjVpeyTlx1MDAxYc7pmW5cdTAwMTFEbOyFgNLzKcpcdTAwMDEtvN383lF/VJNfu/554IHpgD5HXG5s385+O3UykNbAz8xXoVx1MDAxOFx1MDAxZUw8P9DhXHUwMDAzvVx1MDAwZfxdu6FcdTAwMDH9XHUwMDA3XHUwMDAzxupcdTAwMWRF3Xzld+6wwt9KT1xm4Vx1MDAxOYCnXjet0qtSXHUwMDBiUqqXdVx1MDAxN4Zix5I7XHUwMDFl1WsmXCJUXHRcdTAwMWXTp7mDsClOXHIu13NSOuHQcv1cZtCs+FpcdTAwMGU0JFhtNVx1MDAxMXq4mdKcx0V+j/3ijPbu8rf4Yshgv3Xc8GprolxuZWgxJFxypWzxR/c5x5shXHUwMDAyalmQ67VcdTAwMDBcdTAwMWV1rkR8Qq3i8tF9g2s3LSk5XHUwMDE1jGJnzzDliSS5ZIWSXHUwMDE3r3NcdTAwMWZccih3XHUwMDBl5Fx1MDAwYrJY801cdTAwMGX9w6PaQ1+QM0KpKFx1MDAxOfpcdTAwMDArb4bWt8pVMuf582Vpzf5YXGJd9b+aeVx1MDAwYlx1MDAxZFx1MDAwN1x1MDAwN6JKIYxwOaabU++du1x1MDAxZjv0XHJLsOqa5+znYvZ2klx1MDAxNVx1MDAxNvFsndmRKvSw73M/Sa5cdTAwMDUuw6EtV/FO2NJT4Vx1MDAxNO7TnD1/RVx1MDAxMzJccmDos+JRc61cdTAwMDRseHWDKI+4R07xgCx+p1GSXHUwMDBmlPnGMOjcbVx1MDAwYmLxNyG7fz+//Me36PsuPM6j2Vx1MDAxNCY4QmZvIVxuIKZcdTAwMWOPPvIgJXglq6DkXHUwMDEw0Kq3XHUwMDA3alx1MDAxYXbXvHiT1GRcdTAwMWX+XHUwMDA25YTh2cuYN0VcImfmrIDKzpNycGXKhk7cXHUwMDA0q0FQkZF1f6isXHUwMDBiJMjOOpp3QuJytOFPb1x1MDAxM8njpqxcdTAwMGIzWqJP/z2oXHUwMDE5SE20I1VcdTAwMTj8uqmDXHUwMDEzkJT2SnOo9lxcXHUwMDEyXHUwMDEwon9I9pxvreXJglx1MDAwMdeXXHUwMDE2elxcjMRolrFVUXg3araCXG4gdGXOIFx1MDAwM9tD2lx1MDAwZlujw6pcdTAwMGXVXHUwMDFlYlx1MDAxMZ5cdTAwMTD2YESKmZFjkdH3qXZ4ZSg2V09cdTAwMGbzIKhcdTAwMDPEXHS1uIz6S/3d8eXvaNREcY2xyqRbOIJNgOlB7+z8RmE4XHUwMDFhfu9DzNKfcVxmXHUwMDAxXHUwMDE02Em+XHKmS3Vcblx1MDAwNHhcbt6AhvaJvKFDXHUwMDA3y85br2NcbuuuXHUwMDBiS8JKsJm8gvi0VdrDX1hcckbI8E0pQTP7bYKW3o2HfMdcdTAwMWXTQDVcdTAwMGYh5Txk7puVid2l7DS1XHUwMDE4QuWWyONodImeK3Ov9VBmqer1XHUwMDBitnTopD87xe6ZdiB9Xrylaarj9adcdTAwMTCBhFx1MDAwN3rjxraQr4Wl6O+4qyr5mbgxv5iaXGJrY1fqi8VXsllcdTAwMGVd2SHjzSiz21x1MDAxY6VcdTAwMTKLwmVso2267bEyeJn0nFx1MDAxN89AgFxylbFV/sH1xjinm8z00Ve+e3g13HZg2ew4vCbH48LZKtmA/oFcdTAwMTKQf1x1MDAwM/zb7Fx1MDAwYqMpdlx1MDAxNHJUOFx1MDAxMnBulqxEv7AwYdaXeFx1MDAxZDb80ERLXHUwMDFl1dr8mtVxdDk4+qZynlxcT05Q/Kzq0vPLSWJDU7Gfl1x1MDAwMlx1MDAwMUr7sPT4ZTAkXHLsweo9/1x1MDAwNGWMOva9joI2zLA6slT6vOqaILQpm9SVmCw1uY+5V1x1MDAwNS5GS+CAauBcdTAwMDFcdTAwMDRcYjJ24vVcYjCquo41XHUwMDFhbviiLLqis05EeF/8XHUwMDA2gqdcdTAwMDJ2Nz/0S/5cdTAwMTDBVjQxXHUwMDA1w1x1MDAwNVx1MDAxOHrsXHUwMDExjVx1MDAxZthpXHUwMDAwXHUwMDBmx0bDhUWvp+7mr5hcdTAwMDJMXFznZUWe7Fx1MDAxZVfXxqx3XHSemtvnX8qDXHUwMDFjw2CR8TOo8C695DZcdTAwMDHE87b2eF5cdTAwMTbAn1x1MDAxZarT5uXwtGh556fYLWldXHUwMDE2oiyGfD2PgVx1MDAxY1x1MDAwMLPczL+neY3lZF04N6xw2VDPWEu0UUovZsPX6ns0XCKmXHUwMDFkhdeWyY9cdTAwMDCizaxbdiTVkF59+1vztXo+li05kZZcbmPh+o3FbqTBo6mg8lxypMqxcDe6bPDWVm6jSfj3pOJPKVx1MDAwYqubN1Z80Gec0UqOZj5nXFx+hpmRNI0zSU1zZbXRt+jBuavxS0/cj6Zf51x1MDAwNcE7XHUwMDE0yFx1MDAwNVxuXHUwMDFiOvGRrEArXHKVg3qwxr/bx+HEqpjkq55cdTAwMGU0S5SBXHUwMDFhUvr5ia8o/iSlwlx0Ulx1MDAwZkXAmMr5yzVIXHUwMDA1XGKJXFxNNPuaXHUwMDBi7C57nGlcdTAwMTZkXHJ0+OCrgOdcdTAwMDFEvcld24v8m5A620VcdTAwMTT6t/ss/jdcdTAwMDNcdTAwMGZG5NrKoWJcdTAwMDQtUmlccpa0sT9cdTAwMTldRvL+XfjQklxyiu6SXHUwMDE1dKt95LrsXG7ByvUtoD9nzmlXb5ipRVxygSSmOLLcuHRVN3c1XHUwMDA3N4+rz67sY0Vr8NpIylnOpdo4K7X8oN90KF1cdTAwMDL1gFx1MDAxZk1m1Y+yg1VcZslMIOxAOImGhf/DteC1t4+9XHUwMDAz3igl6ueG9PG1Onn+xXFOXigswGWRs4XCXHUwMDFjqnWA2qboyyM9ri7Xi1x1MDAwZVx1MDAxNVltOb6nt2HQQT11o41ggVx1MDAxNDqkbJzoPSl7XHUwMDA36lx1MDAwNK28/poqviqbyyCL+dbnbX/R5CmZI9F+6P6oXHUwMDBiKqZSYbI6TNhukWa//ptcdTAwMTBBO9nAXHUwMDE2WmtcdTAwMTKvlZz7Nevnns1abt1zXHUwMDEwXHUwMDE28nj+XHUwMDEx0N+CXHUwMDAzXHUwMDE3XHUwMDAz2KBcdTAwMDRcdTAwMTRe6tKIwydiU1qlbvah+HiEhNHTRSVIcpTsxOW21Lk8bIk5XHUwMDAxXHUwMDE2JNhT06icXHUwMDAzXHUwMDEyUX0hz7ROaypcdTAwMDVmpvpm7VEg3tR3REonhFx1MDAwNclcdPRURPJTXHUwMDA16G99goolo4Y1Ulx1MDAxMPc9S1hcdTAwMTPdXHUwMDExs5ZE86VcdTAwMTKUXHUwMDE143pcdTAwMDaoX9bbXHUwMDE4S9fzXHR9htM3istcdTAwMDf2NDoy6lx1MDAwZcYwK9SrNMrzs5ktpLI+vTer5/hrXHUwMDEz1Jf7aUpYUlx1MDAxZGmitMCoLus3T5xcdTAwMTZ8S1x1MDAwN0u0b1x1MDAxNFRcdTAwMWNcdTAwMTk56J1cdTAwMTHmOW2/K1wiNUTQXHUwMDBmOFx1MDAxZdpV6STPhWRd37VJe/fHb4r9ucbUjoNcblx1MDAxYVDTqmYt4/Wft/aPaGfGT9o2zFx1MDAxYlx1MDAwZXr2+o2EgVx1MDAxYrDz6apcclLQRIVcdTAwMTjKuvo8OGujuPO1XHLnbFTNbq08vOTtnnSXJeY8t1xi0HnWck/bh29cdEqTaFRvuJnBXplUz5vPskBcdTAwMTdJ+kB6pe7KXHUwMDAy7Gm/OkFX6Fxm54fs3kWBIPpYk6a/XHUwMDAzs4tcdTAwMGWWm1x1MDAxMD7+PZvt7a7YXG7vgWI1WELh0NJNXHUwMDE48lKQNHslM8QyXVPql1x1MDAwMe5EuMNy41xcVXcuakZcdTAwMTjn6oxHe+xcdTAwMGJoUUvASVXEIVwi0S/2xTX+5tVkSVx1MDAxOFx1MDAxMXbOmyPkXHUwMDA1Pexiw7gkbGbeX1RcdPeGxZRcdTAwMWZcdTAwMTn85ZzO5nZcdTAwMTP7lkrOusNcdTAwMTExXHUwMDE1QqhlQSnTaipcdTAwMTQzlpx5fV1axeYkXHUwMDE5N1x1MDAwNpBpx2fHgVjrkVwiZpRFvb37yDj/7ltAT8PGZlau32Rl55UpNrXpg1x1MDAxYfosQ0RcdTAwMWE99tBPsvhcdTAwMTKtOnNcdTAwMTXgLvPsXHUwMDAweKlcckBcdTAwMTLK+kLcXHUwMDFiTO33XHUwMDEy5Sw7fJ0++7GzuJwx1KyB51x1MDAxNnyDNdOLvcKLUCVcdTAwMDSHiYjqKVx1MDAwMkg+KEchXCJcdTAwMDf5pLxcdTAwMDS1L6hcdTAwMTm3sprTJCSfbFNcdFx1MDAxY+Qkc55ccv3Jyur8xzWiN6T+r1x1MDAwZmesxc1/p1pcdTAwMDPlLlx1MDAwNf73XHUwMDBizp346lx1MDAwZTqWPFx1MDAwMnajqPGXblx1MDAxNtO5lYR6XHUwMDFlo6XRg1x1MDAxZFJryeueJYJcYlHukTlXabJVkzpK3HJcdTAwMGKzLYZcdTAwMWPaXHUwMDA3Ui+SqpFdXZT86jBcdTAwMWWknmmE8+uqtOiAc9CW61xy3uQnbu75Rf+iXHUwMDE4UmzsRmVI9pnqXHUwMDFhMc3rnaGpN4pcdCk4I942U7NcdTAwMWZ170KYn1x1MDAwMon8I9E1XGbhUFx1MDAxZHli8JOaTqpRnTFlmy/gquw9XHUwMDBibpzCgXlLd0450Ge1Oa5AhqfN5XDtPJSiqLBB9VcjRb3QaGGyzmXQgFx1MDAxOFx1MDAwM4CasGtcdTAwMTKeXHUwMDFkvm+hM5fAXHUwMDE2K+U9MS87QW6dLdRRX/CWuiFEKrPNXGKSg6ZLytJPXHUwMDFhXHUwMDAx26XRtXJcdTAwMTfQ/OGk4DuIkEvPutAoc7avzK8uXHUwMDFmWrWgs4Q3yoEutD9LU6lcdTAwMGWJ+bnQo35cdTAwMTTo10RTJ9FMgF5cXDbEdClyQVx1MDAxMlx1MDAxMCbOa9xcdTAwMTXdXHUwMDE2IUvCK1x1MDAwNYklPtY1XHUwMDEyoy1SMTF6XHUwMDEylIAo4vI3KlRcdTAwMDJI2arVZVx1MDAxNECqz5D8WlpkmtnC7mVcIiZcdTAwMWNo2UCgLVx1MDAxYSVpj0+HL1BUQE7H+4FcdTAwMTM4c5hsJlx1MDAxZVx1MDAxYmA67fPQSEblncKikSdQyfSSQOd4y0pWZ2IpNLHGPk37savQ1lx0vSWbRFx1MDAxNsREXG4zXFxjXHUwMDA2Z1xiKy8nzcrPXGLVMlx1MDAwNLLp1EFcdTAwMTFBsm+M+lx1MDAxM6PTujZcdTAwMDQjXHUwMDExxFx1MDAxZl7fLHPSXHUwMDEwdd9cdTAwMTT5U1x1MDAxOG5Y9cynlj2b0mb6fa062Vx1MDAxMzFDyF9WnpJcdTAwMDPkXHUwMDE37tU85XDP0T/2SfK311x1MDAxMTf2pVx1MDAwYqNcYipcZoxcbiVlXHUwMDAzssLnqsiY9dN8XHUwMDAzlO/owOdcXEaKL1x1MDAxOKm8SFx1MDAxM7Tvxi8wkX2wXHJcdTAwMTS7VSqrjG/ih1x1MDAwZZCXg3dSOb2akEfEkFx1MDAxNVesMT6452pCymN8W6jAWOkr5lx1MDAwMcbfcDRcdTAwMDVGWjm/a+y+dSRAQkhcdTAwMTX684l48DpYXHUwMDE03lpcdTAwMDIoXHUwMDEwon+rclx1MDAxMVx1MDAxOYvTXHI4XHJ5hzPwlWj1XHUwMDAzd21WXGaeuOb0hFx1MDAwNFxc2YGWW7I50+I5XYJcdTAwMDTh8WeanyN2Z0xcdTAwMDBweY5cdTAwMWXyynjBKS5cdTAwMWWefKliXHUwMDFkc6+o0baSKF7n7MujXG5YI1x1MDAwM/baNT5cdTAwMDLvybeErFq0d1x1MDAwZYyRhaNaysLLoVx1MDAwZktcYo2as6DUzuc0XHSFRyPLller7Hs8sP7NTFDFWPNcdTAwMDSaXHUwMDAxgeyk9WeR1ylcYvtcdTAwMTRcdTAwMDFHsosm6iNcdL85lsUv7UVuwfLNac1cdTAwMTk8S355XHUwMDFjgIM+U36Dncb7lPfBXrs9akg4UZRcIitAu1x1MDAwNqicsVx1MDAwMGfhXHUwMDFlsJTE2HDmXHQ+brLFNGGUZf2B3Ydwd1x1MDAxY8do1Vx1MDAxMHOav1xc0zX4n2GDM+qJXzO41WLeXHUwMDFhKEy9T8I15bUks8M7j0/keFx1MDAxZj3/9bo4RZvoW/+eXHUwMDA3qY5cdTAwMTOALq5sW2TJXHUwMDAwZSBx9vp0wqtFLbX79KJCQti/vop3eUpcdF+befM0veLl3YZ7eqvq4mHLVLRcdTAwMGVA9lx1MDAxNyuMa1x1MDAwM2Rz/8ycM1x1MDAwNDPnx4ZwZsmZxMWli3uzOsrTklqye6KjfndC0b9a623PXHUwMDFmkVx1MDAwZrHif3f74ENcZjx0T4iI9DlGfVAj78dybtY/XVx1MDAxZuLCRI2gl4gjXHUwMDBiKCuDgdRPXHUwMDFk1JFdnFVcdTAwMTT7rLljs75cdTAwMWRcdTAwMWLSte2WXGKHrcb3OE7gXHUwMDEz/DpcdTAwMTKyOuvsVOyuUKRRlLGvu1x1MDAxMaRcdTAwMTWagtGUx8eoXHUwMDAziXO7XFyl099KZaDR2feWXHUwMDFmYC9Bk81nnyUqXHS+NfdcdTAwMGbHMffnUlx1MDAwNVx0VHQytdvKq2zc64qvXkHyV0Ekaa9vPvLeTutcZvHb0XbY8IIqVnlcZpOA7j82p0UgQqNgaUJcdTAwMTdcIlxu9Fx1MDAwZm8/9+pcdTAwMTZo8c0vlzT5jXb7XHUwMDAxouaRMi5GXHUwMDE5u89UuTJgXHUwMDAwhl3ihLhk/eJ/QUHJ46VcdTAwMWF/OePLTvpCXHUwMDE4wTa1Q0vT9JZA8M67SOcv0P+UXHUwMDFkXHUwMDBmXHUwMDE1XHUwMDE2mob1e2hDXHUwMDE07+Ov5UOW9TZmdim6XHUwMDAww0qoqNHc5GOh9kFgXtgkxVx1MDAwZbep2+nYTFBdbDI1Y0tHXHUwMDE1lVx1MDAwZaEkTFxyWTjLKUGMXHUwMDE3oeJpYFx1MDAxYlx1MDAxN+7tXG5L2SeRQMukK6VeSaTNdNOrZZb09+hQbu1I/j5NXHUwMDFjX6zlXHUwMDE3zY+WM+eETbbYlYeEMfFcdTAwMDPs9NirvVx1MDAwNn2M628hPp/K01poUYeY6r0/XHUwMDFiXHUwMDFlXHUwMDBim4Z/f4b4cGiUWTlcdTAwMDaY+vXJP4T2cy1zXHUwMDA3pdbhPlx1MDAwZprn+vBcdTAwMTGlXG74WN8+snTaqUH/acRpPW3BVL7SU7y/mFx1MDAwM22VqcJufmUs8Lef68259OMoXHUwMDBm9Er9pMNccu/0XCKvcMFcdTAwMWNOhFx1MDAxOGKCRkudXVxyqFaaXzKrk9x8gFFcdTAwMDSUaFx1MDAwMJKf1E5cdTAwMWVrztH2XHUwMDEwPsIqQZC1XHUwMDA1uX1aXHUwMDAzhnVM4Y1C/cKBhsWcR9+5y3AtmCBbXHUwMDE2XHUwMDBlVqHxXHUwMDE5aP+gbYj2oMFcblx06LVllvCfdVx1MDAwMpfKwcm8P4ng+jtcdTAwMDdcdTAwMTHASy78yLx7XHUwMDExi7ht+Fx1MDAwMNT1XZ2FZFx1MDAwM6nYMU53bYe7OCrv5UbaJ7FaUcfrS0NqX9EghJdcdDF2SET+2lx1MDAwMnU1XGJcIlwiXHUwMDFhifTy70dcIs9cdTAwMGb3tDpcdTAwMGJcdTAwMWWYKT48ZmjwltdflXijXCLPaeLePv/4iFx1MDAwMqXSUcDZN21R7JveXHUwMDFmhZ+RNNJBY/E6XHUwMDFmMt3PyiZcdK91XHUwMDEzMYvIj/mhi6ebuN6n8kzlhH0thI0p5bVX5Nt/jivse8l/TLbFXHUwMDE0t31b9G/BqZogjImJ1XptjNrbPVx1MDAxMPc+0YN4a0yvn6jzXHUwMDFh3cSIXHUwMDFmaL/+ibVcdTAwMTC9OI13v4c4XG5xKIlZXHUwMDExtGL9XHUwMDFhgLGmXHUwMDAyk0RTgSw2O1x1MDAxYVx1MDAxMTrnoq1wtMCGe1x1MDAxNEK+y9+6ZMZcYsuWSNov/1x1MDAxZaj89YVe8zxRLnLwpUbnXHUwMDE3OVNvsVx1MDAxOUmTJLDX2FNL1J5AijS/veJmxjnBJH1cInoqmTtcIkJO1l3nvPKpZVx1MDAwYsZpXFy3VEeS9DtxLTStz2vPXHUwMDE1n6Y78s5NXG5qd/ySdcZcdTAwMThy1U9cdTAwMDdbkVwi04S/m3ktwt3WVHtcdTAwMDJ/10WAfXSLl664XFzzL8ZNnjtcdTAwMTVW5eJQU/Otb7h5Wnj0ZXzzRyHToVx1MDAwNZuLTSjMf7LsSdlcdTAwMDZTyT+im2JlS1x1MDAxYaCnWENccn7010y2Lso7uqiH79GUjVxuVJ/uS9lcdTAwMWaQmzHqXHUwMDE1/jRcdTAwMTjwXHUwMDE4NDjzfbVfrSSrtK6c3UucjaIlM71ZXHUwMDFlXCIoXHUwMDAxXnbxtWSMWq/y4ECU+8pnnqXwT3VG+GPjvasyUXVcdTAwMGJvU22QMlx1MDAwNVRQ3YVcdTAwMWH1jLj0cqby75hCj684zSxbiXjU41BcdTAwMThdXHUwMDE4wMFcdTAwMWSYRmreV5ieTbyvXHUwMDE0grRk+7FqTiZzXHUwMDE3XHUwMDEwubzwwDvNXHUwMDBm5MbgUFdcdTAwMTnl0GpZulx1MDAxMDBbzFPYMK5cdTAwMDI6jo1RpOApXHUwMDA3MFx1MDAwN7W13V/gXHUwMDAzSlsqRm8kukT6W1xi3rrrJ0C2NSBLKcVBnDU6h1x1MDAxNUbnbaU1Vlbp7EVcdTAwMDC+MFx1MDAxNIZcIuOn2bK8ulx1MDAxZlx1MDAxY1x1MDAwN3hBK/HqxkVacWzY7b3Z/lvB7Vx0+o+wXHUwMDFmQVx1MDAxMq1cdTAwMWGIoN72lXS97d7h7ohTtHAjqHFcdTAwMTbW+ku7XHQvZ/P2/GDvm1c0XFyMcPad7MxcXLL+Mlx1MDAxM2HmcD5cdTAwMWTL2eiw40/iN2F5pJlcdTAwMTa7XHUwMDAyk9FcIvxqON/fV4xcIlx1MDAwMrZcdTAwMDRwflx1MDAxYm1cdTAwMDdLX23knoJcdTAwMGLxXHUwMDE4oIuWX3mevXCGqdFYPy1cdTAwMThBojJcdTAwMWJcdTAwMWJ6LiY4XHUwMDAyiIlxICa0XHUwMDA3WlJcdTAwMTRKaptggVTX57NqambZqMck/Pvr85tNXHUwMDEyXHUwMDAzwWaMv3zDXHUwMDA10Id6RrRWtLyeXHUwMDA3VLRd7KLsVXc9WrXR0JU/pnslzf2GqI5VdMXkxVx1MDAxMdjzXHUwMDBlbpqKJyTJeSFcdTAwMWHo2ifRZupcdTAwMWSN4zv2v/Kmtli+W0LUSM1JNjhDgMZcdTAwMTBccuZcdTAwMDGekdlcdTAwMTOApFx1MDAwNVY/XHTCXG5PeWVvx2FcdTAwMTn12T+awGaauHlOyTglZkOZ393jbGOccysoliY7xsIob0aBXHLwOpTSLUHm6FwikohDpNPKLLV1XHUwMDA2XHUwMDAxKnmChT6xrftcdTAwMTcoxX6iy0itXHUwMDE2XHUwMDE3YqCNXHUwMDAzo1JcIu9W8kVwc0w+YVSyrFRegEpcdTAwMTeAobBcdTAwMWLMslx1MDAxMfqafmZF7Sa+XFzgoFxi811cdTAwMDKPJkZ0KSko+GI6XHKqXHUwMDA2vmvW5cCauzRAXFxd5XNl+r7NlO/7XHUwMDA1pdqx6Fx1MDAwMPyp/V5EdH9IwjJ+XHUwMDFjPMJcdTAwMWSfXHUwMDE5x1x1MDAxY3Eyn8VseEV4s13HpJijKVx1MDAxOIbbKGGK0YdcdTAwMWQt6GsgKL/pXCK5isWjw6dyx+vacD87tHO7c8IsxJZcdTAwMDbnXHUwMDE38kY5Z1Dqpiwk3e587TYko/W1XCKINmF6uWRcdTAwMTcy6tt+XHUwMDEzsSRcdTAwMDCjx1x1MDAxZFx1MDAwZZZfXHUwMDFmonNccictm9h3THuK6pOzM5g3XHUwMDAwXGKYd/6Ft4ZelVx1MDAxNWNlXHUwMDA1kqtBryW6qOxkS7HzhS9tXHUwMDE52bDjzcEuiKtDdKyWceUmf+rMvfi2t1x1MDAxMu2WWc9Xv/b2XHUwMDA3XVx1MDAwYvApQKmWXHUwMDBljqKgIPWqSGGuXHUwMDE1zo1gkfn+sE6JPjusS/G8VNuT2GyDXHUwMDAzXCKKXHUwMDBiKtvrUp+4nlxcg5SaQ9hI1Fx1MDAxZJBS/Vx1MDAwNVxuhy7mhEFcIuDJXHUwMDFmzjxFovcqx+Phvt2ouuU3/UvBo1x1MDAwNoqY+Tuk+8Mq77ikfORcdTAwMDI98KtHXHUwMDExwvtauHguXHUwMDBiXHUwMDExOL2B4JdSXHLBo2zxR3270orzau5wSDhcdTAwMWGrv84nXHJPXHUwMDFleFjpXHUwMDA0s2ZlXHUwMDAwPKGFXHS0yJpzUHU77Iyg0HdcdTAwMWbsPDo1lpBcdTAwMWF+9+zIhVx1MDAwMzh3j3m3UdC30utVQzFSXbRgXHUwMDExoo6Bo/Ltl4/4omDJTUqvZ3CzZNBcdTAwMTlDSWMogoRcdTAwMTL4/bcgx2FcdTAwMTIqL4fMsm2y7JhcdTAwMDKAnstcdTAwMTgh3etcdTAwMDDZ/V/PcdCSM1xuqlxyjTDgKlZcdTAwMTkjYVx1MDAwNfPTRVx1MDAwNbAwRi0zRFx1MDAwZVx1MDAwNU6Qlkh4NesoXrInt8l11fA51cKn+6DUZ3aX+yuQmM1Lk8BM9Plox6m/joRKg2l/UvNcdTAwMThcdTAwMDe5euZqsEInV+4zflxi/OxCr/9SXHUwMDBlxlxcOFx1MDAxZeNo8I7XcVwiy+36pFximEFcbsdmRzxExFx1MDAwMHl5g0f3XG7F58RcdTAwMDBWZj06WbqTlKtcbtXXjF7D7N+T62IzOKcjqVx1MDAxMCmywWCRXHUwMDFiln1yolJcdTAwMWaCmpuZmYtcdTAwMTldryfY1aDA99btR2VcdTAwMTjuVUbwgqg9b4dXaL7U0Fx1MDAxMdTvXFyvZ2pOzZey+tJ8dlx1MDAwMawxxFx1MDAxYrOPXFywXHUwMDE5Y1x1MDAxNScmSon4vVx1MDAxMvJJUJhDoc9cXKXTqDd3oV/y6P9N4plRcX+KfFuRbV14MlbRf2qUtPg+oKmmYaWJXHUwMDFizJtxyZMzXdLAmL6+wTU/K1wiulx1MDAxNFxiWyBwqp6j61eTXHUwMDFmi6ZcdTAwMTCQXHUwMDA1so5cdTAwMDXp3VXG/t+Crr3Y2Vx1MDAwN+Jq5lx1MDAxMJM+vYadzalpRE/QXVwi6KSM8bNfTFxu+O7r71tjkcX6M3VcdTAwMDWhLmqh52CgO83ZKyxtfseBS1x1MDAxN1x1MDAxM15cdTAwMTR8cNhaXHUwMDBlXHUwMDFj0LfExbybLJFcdTAwMTjncXLx91FcdTAwMTHbOWzceKs3odCWXaZ8OYnivorQPfWk6GCbe+PGXHUwMDEzY0+hXHUwMDFji1xiOSpcdTAwMDXkcDVcdTAwMDZUi1xy9lx1MDAxNnCDmmSv4J3cs5TsYu868qxXS7NZXHUwMDA3KnlPzZ9EIT1cdTAwMDFzyW9WflwiUzlcdTAwMWJsZbaQXGZbl6FfXHUwMDEyXHUwMDEze1mILovLXHUwMDAzN/K12qaeXHJJXHSDRpjzYlxu4f1pZlwiPdT2XHUwMDFjfvqNYtg/N91b2+/sPCZ0i8pp1VtqXHUwMDA1bWC70M3IsYqamPqBurExW/6oUERTPICUbFu3K2RRwUM3alx1MDAxYa9gTZq1pdtWlLOQ1EJcdTAwMWP1c7Lk8dREme9pXjCHcTjtXHUwMDA2XHThwtJcdTAwMTV+N9FcdTAwMDBcdTAwMDHcy9ZSXHUwMDFjf+vLTaxC2HVcdTAwMDb/TnjQf1xyR5o2vIAgJ4hq2jE2KtvNqeU4/Fx1MDAxM9iJNOxcdTAwMTFKoknyrKFcYsBcdTAwMGVCXHUwMDA2XHUwMDEwUVx1MDAxZO52fVhcZlx1MDAxNtglXGa2YtyWXHUwMDFjjPi8sSRK+Vx1MDAxNr97ZWGCvDnnXHUwMDBlXHUwMDBiid5cdTAwMTNcdTAwMWNwgSQoXHUwMDAypUiMsFxmbNB93ytcdTAwMWOIKDren7i9UqW/9Vx1MDAxYqCjhqtcdTAwMDNcbtyKId5ccvyXL20378d1zZNfmLjMhVRfeFFcdTAwMTJcdTAwMTChLfFThpxcdTAwMDMrtyhvwZn1UbVcXCU+caNAYIpcdTAwMDdzxX2qr1x1MDAxZoZogok1YVx1MDAxNH1cdTAwMTV5vEArw6tcdTAwMDVHXHUwMDAxi583aDfZKVx1MDAwNN/QPFx1MDAxYyzb1zNCXCLiS1x1MDAxY5JcdTAwMDEkXHUwMDA1WlFgjdVA+u9o9b1PdaRrqGVSP99m2lWfdIEn/6HBZF1fXHUwMDA2npJDqUPLZ2GzL28h1lxu1EiAKolcdTAwMGW1e1x1MDAwN1Jcclx1MDAwNOr3Jz5fgGBW91x1MDAxYX+VXHUwMDE2J6F/XHUwMDEyWbBcdTAwMTFcdTAwMTmP41x1MDAxOFXlWOlcdTAwMDM8m1HoUoxi1TFuuMBSqKOQ4MlcdTAwMGJcdTAwMDW94e1V2HbsXHUwMDE0iJD2R/FcdTAwMDQuUu9PVCkgsF78vkE5R8c9xohDbLzcI9V8LTmcw7y89Fx1MDAwNju1Z8ikXHUwMDE3U42So/8zXHUwMDBmVIJcdTAwMWHdhVx1MDAxZWuFtDRyXHUwMDA1XCLsrpxkx+T9plx1MDAxOFwi+G1OaIZUu1wi1qWlKbw9SeNRi1x0KULGgIwg5cNcbsOSZFxcx6H5dFx1MDAxOSTSXCLxe+yp6lcsz0Rfx3OWnNBmVz/TRz1AXHUwMDE5enb46npcdTAwMDBJQiaoZ+lYwKIgXHUwMDAwpqiwkr33PVxy8F1cdTAwMDZiXHUwMDA0XHUwMDAxpN4hgFx1MDAxYTvz4OJ0wFx1MDAxMWWul1x1MDAxN12ze1x1MDAxZs/5XHUwMDBmkm6rIT55WM/Qr+lcdTAwMDReXFxW59r2oV47t/WN4vlcdTAwMDbcf97j8HduqSrG6qQk7E7JQyDT66MntU9kueNOgm+9kDY3n6GxXHUwMDE0XHUwMDA38/M6WPy/a6k6I2bWXHUwMDE1WlM1JXJcdTAwMGZcdTAwMDNcdTAwMDbYXHUwMDAzlFx1MDAxYc0oN513321E2TR6yXRFyb56RzawZlwi45iqlFx1MDAwYk06XHUwMDFlZtl+KXi1+TRsXHUwMDAyxFx1MDAxOIThXHUwMDE4XHUwMDAy3Fx1MDAxN2OfWGC414l1Kphpteb6IIqW6lx1MDAxY/zmXHUwMDEz1X5R/Kp7aG77Omsqe6Sysz9f6lxculx1MDAxMLSh9oJI0d4/XHRDT1TmdbLWak9cdTAwMWQ6yy9OlN/iz1YosV1+Olx1MDAwN1u3hp5sZe0lX+dcdTAwMTGJXHUwMDBmwqJOs+/KuFx1MDAxOYdcdTAwMTXX0fmbXGJdXHUwMDA3m8o6XHQsXHUwMDEzXHIr5M/9a12Bo1x1MDAwN0vI6zJcdTAwMDM5elx1MDAwNJKxWpiJfGFcXFwiZVx1MDAxM9BcdTAwMTiZ012OiUrXj8dU9Vx1MDAxNPlcdTAwMTE2L2eXbyqsa6adXHSORmfFjm7xXHUwMDA2emHJZzhSjWVsh1x1MDAwNP6Sr9x7bt0wJ1xiXHUwMDE3oz6t/VxcaDqUzFx1MDAwZtXPpu0zj+XrWlx0fllHXHUwMDE5Wc6Xg7WzbcSn/ZvwOlx1MDAxZY3T/YVcdTAwMTU+O1x1MDAwYsDsRFI8znhrYIU+X+XwqDDKdet7fESfyzRDgFx1MDAxZLgloZ9EaOB+7Vx1MDAxMvWx2CEqQjR3XHUwMDFmXHUwMDFj11dcZvvSalx1MDAwN0hcdTAwMTSWZMytXHUwMDE0xik1WJXYXG6lV5PuWZA8Vz+v5n7CMEo2XHUwMDA0pC1JrceJf1x06lx1MDAxM3s1tLmRbqzfO3Lala3XRrCO9/jsS8xbgUA3clOhZN+/IPuMRNCXkFx1MDAwMUKuWZuFr33pIPFcdTAwMDTPVYZcdTAwMGbpytxsrLLFsVx1MDAxMV2fXHUwMDEyelx1MDAxZVx1MDAwM0pcdTAwMTLLQFx1MDAxOKfrXHUwMDAxPPRcdMRZpuT+K/naI1x1MDAxZVNcdTAwMWFfj+dcdTAwMWNcdTAwMWTf742aTO7UZrBS2asyszZ8ljdRttRytNOMkjxcdTAwMWb03mU8XHUwMDFjXHUwMDFkutNN8Fx03qv5K6epzt/KeS471kpRWK5Aq8hcdTAwMTJj/i3mNuDszf7ef2++ycL0PVx1MDAxYoB6XHUwMDBlyFx1MDAxMtPj/erOXHUwMDE5joyOXHLUrXKbWWqYR4M99EqKrrfwmVx1MDAxOFlhNMQ/fZzlZpbmd3pDyfuHWcbpf+hcboX8rvJcdTAwMTNW0qpcdTAwMTfwIPfZZ1x1MDAwNdsx3ICOPMy0xF5mXaiEctRESVxiSlx1MDAxMErHaX5HXHUwMDAxwVx1MDAxZDjBgVx1MDAxZGWpy6omQVx1MDAxN2dqP76oe15eUUZ5Yj1cdTAwMTPdlvPK9E/ifJzJiobF+o6YXGIpyCCpXHKZdk5jXHUwMDE56e7SVthcdTAwMTNsSyR0PUKxldIycaX93+dcdTAwMDK4Y8DBOGxzf77ZPu21Pa+pNVx1MDAwN0TNXHUwMDAztrNcdTAwMDd2wN0+YCmpclx1MDAwNVx1MDAwM5TZ4du50qnrXHUwMDBmdHHP9YB8a7tCXHUwMDEzO933hcDLXHUwMDAzhtU70t68xv/OUb3qi87Cr1x1MDAwNeS6QVx1MDAxYkB7fbFocu7hXHTeXHUwMDFl8URcdTAwMWHJ31x1MDAxMz37371OXHUwMDE1kTiNO0OCIeuSZFGUyPayzfFeorNSc5WDSqS3jCZcbmN3NsCph1x1MDAwM/ls2XVRXHUwMDBiXHUwMDAxZUvsR3LngeQz1Vx1MDAxZcScLfqXLft1c3FGUyuXMPCz3r5WtMR1Klx1MDAwM3gnbtVAtLg89Co1jY2hRVtJw5NcdTAwMWVcdTAwMWP1iFx1MDAwMEC7ve95NVpv8K9PgIQ8XHUwMDA10XCUfNV35oykkaC5pmMgy600XHUwMDE2VEpCpPPcwLfDRb3wdz9cdTAwMDHdK0VpXHUwMDEzkDDdWtCnNOg+yb3iJl9cdTAwMWJcdTAwMWP/xGureiGj3HtcdTAwMTDlXHUwMDAwbVx1MDAxZO5q2sy7w27lXHUwMDAyt08tgIf6qz/KZ8+uKtZcdTAwMDPj57RjqzdnJrpE4Kf5wrprOHivXHUwMDBlfE9KIY6Uxr2efvJR7+R5Z9xvWZZcdTAwMWFcdTAwMWaP+Fh9akP+2b6CfZjv3/37wzRcdTAwMDNu/c9rXHUwMDBl/+IgXHUwMDAzc3Jzk1SXp1x1MDAwMlm/xTRXximicfZcdTAwMTOWcDJKmGG7flx1MDAxMzAjXCLRi+87VFxiZY9uXUTD0aI14JDxKtnDj8SgjG5DXHUwMDAygHnmJlx1MDAwYk9cbq+2XHUwMDBlXHUwMDE2uePhnG/WXHUwMDA1nFx1MDAwNVx0WY5/e4xVb7m3XHUwMDEwXHUwMDFi4847YqCkldIhZNVDXHUwMDExYdfSMThbr33pM4yNRcHrkzrYZY9XPdfyeDS/4LeHoDIpaITF4jyTUO9cXDbb41x1MDAxYsmhhnxcdTAwMDPPJdpCwHT1hGyBJ0ulfOswUYlLhplEaVx1MDAxNjp+WXj+XHUwMDAyP6c+XHUwMDE2uVhm3tJqXHUwMDAwLeVcdTAwMTD105z17lx1MDAxOJ67Iz43XHUwMDAxxs2T/Ypcbjj1aIF+POy76MnLz9vtWI1Q4fRcdTAwMTdCxD5cdTAwMGbLdn3rvdlM06jBXCKocUtJXHUwMDA262fY/rOgzNdcdTAwMDCTViBcdTAwMDDwbJZwQIt8g8z9MzZjr/ly1fPOd/JcdTAwMDeUXHS4XGLiOl/BuSg131x1MDAxY/FOm/tEX2o8XHUwMDFhWmnLWFp6XHUwMDFlss3uK5XTUZNcdTAwMWah6knw0iy7XGb4UPpSOlx1MDAwNVxiZ8t9SVx1MDAxYjBcdTAwMWTsQ1xuzltcdTAwMGZtWX1cdTAwMTZcdTAwMTGN1Vx1MDAxYkhotVD7zXS1XG6V6Vx1MDAxMGUlLNus2XxeaLM1KU0wN1lLYVSQ/oBZXnWh7oVrQfPkgKPydSFyp42CbyNcdTAwMDaHb1poVpxcYnvBaclaX832gpnjwUKWXHUwMDE3tp8wJNpMrlx1MDAwNFx1MDAwNKr3U92RIG5cdTAwMTlGZjb8T9J0tKxcdTAwMTUjYtpcdTAwMDWC6IS5lF9Mxq9JbURdMcHYoi1vpimlLlmS/5Jcclx1MDAxMmzqWlx1MDAxOPhcdTAwMDPZQqpIzOBj2LEwMlx1MDAxYZu/0eC/PKGFWkF7LC3YlsphMlx1MDAxYsNJn4y3SFx1MDAwYkzLg8TAXHUwMDEyoIFcZs5rzJbndnW/3+vgqCR64tda3iNcdTAwMDNcZlx1MDAwZvRb80ibXHQhzFxuPlx1MDAxN1x1MDAxMb2ptUc2TFx1MDAwYlx1MDAxNmyuwM7TI4Uu/vl1XGYg6vlcdTAwMDLsiYrkkFx1MDAxZc3HL0LHXHUwMDFjL/c1z85qK1x1MDAxYcaekDbL8nPyfVx1MDAxOEpcdTAwMDX2d1GFcMZcdTAwMDbmdDs2XHUwMDExgs+/YHF6QGFk+sxF0a9RReraZ1x1MDAwMJvXZHjkXHUwMDE3XHUwMDA37DlYzvrWLdHCs6zP8U3FdvVvn1mk4lRcdTAwMTPjj9xRXHUwMDFkPfBKPcAg94XGIFrocOLoXHUwMDFjXHUwMDAzKZn7+zhcZjGDnFx1MDAwMePvkTvpXHUwMDEyf/f+Ym/IXHTr6vJqXTB+ucSTXHUwMDAwpua+h7E/PlhtxVt/U6lcdTAwMGY318OW1jojsnFcdTAwMWTxvVIrXHUwMDFha1x1MDAwNUdQlzdcZsB5SWPYauKKkau0Tfm2je+DLl2vpdgxUixiPpJX4iAsXHUwMDE1j/xcdTAwMTlNvjvjXHUwMDE2xNODvX9cdTAwMTVWXHUwMDE4jmBGXCL4+lx1MDAxM/rbzlxiy4tET1xiuXghjoLw0jNsRVOl9obAcnz3XHUwMDBmXGYyXHUwMDFiSCZy4FxcXHUwMDAwtzO3QIZecZujXrRcdTAwMTJcIl66+/6vnOz8OrSU/Vx1MDAwZmXv1eyssqZcdN7Pr5ioW3VcdTAwMDRGgKAn5lx1MDAwMu+E99zhvfdMzH9cdTAwMWa0q7u69j6n+uwhXHUwMDE0a32fllx1MDAwNGne9zFcdJnJgrFYS8p2NCDcSG1QSWDgKUSWNsGGXHUwMDA1707i6M6vQMLlxVNw4v7oXlxyXHUwMDFjMPDja/O7Lz75ccvXaYnd/pqoXHUwMDFirPA6XFy+x6ZcdTAwMGJBrXiDm1x1MDAxMUus951xXHUwMDFmn9AsnayruahcdTAwMDQwzlFcdTAwMTXwMd6cdF5Q5Vx1MDAwZkRWsirzgb5CXHUwMDAxMlx1MDAwZdKfzDtcXPZWyL/9S41v7KjOJNX9XHUwMDFjz+phS2v8uohAXHUwMDEzkGLo+1DccFx1MDAxY/dhf9hdd9orL6Yrs//WXHUwMDEzOu8msUSfxJtsXHUwMDEw5m4tYoL5q3foOSOfLNXx5C1EXHUwMDFm5nz7OXuK39Se2TZM8I5+1VP+/qDVP/VcdTAwMDc9vlx1MDAxOJZmPdZcdTAwMWODW04nglRfnHLzmHf9eV9cdTAwMDWOb713uKCY0C3F2GgktuzqdlxcjFxyw2i/lGNcdTAwMWQwQlREXHUwMDFmT2TfKS9zVjrq9TraU1x1MDAxNkxcdTAwMTd4ZFx1MDAxOFx1MDAxNZtvuZTjMHB2lVUluW1cdTAwMWWKXHUwMDBl3rSsZ2E7XHUwMDAy8yPDb1+8xFx1MDAxOSzE4jGKXHUwMDE3OD76WVQsXHRcdTAwMTZcdTAwMGbBmkJcdTAwMTKyXHUwMDA30ZLX7/DoZao0XGJrc42dXG44qrEz4PtcdTAwMWVUwrP3UnQ58TZVlbyi8P5cdTAwMTYwt0vJ4I05XHUwMDBioCTDt2Pq8ndcXINgpJqkzlulwrlcdTAwMTHVUokn0smHXHUwMDAzxVcwl2m9XHUwMDE1V1x1MDAxYfb2bEUs2uFl0dpi2rRDZDSMnHxcdTAwMTj/XHRcdTAwMTlxclbuwVuQvppNoqph+zpcdTAwMTJNULiLvkC/W3CIZzJpyOLXXHUwMDExps42sJswRTfZuGPeizqvIFxyKIeYaVx1MDAwMUtzPr5cdTAwMGY444+lfJU2tFx1MDAxYiNycVFcdTAwMWUjtbNcdTAwMDPnXHUwMDE2XHUwMDBimDhphe6dXYHySqBJZWS+fnNhcqK5TqM2YaskX9vjajK+WN3xW1x1MDAxN6xlm5q6Jnw4iTvjpOiM2VjeXHUwMDA086DGfTsy8TIwq1x1MDAxZlx1MDAxYv5RjMUkL9/tXHUwMDFkb2eI41x1MDAxOae5rYh7Y6WN0uMwy1x1MDAwZVx1MDAxNN7OzY9Tu9Hfk+JdVTJ2sLkhfjfor/uYXHUwMDFihrFHRadcbiS5WKHrm7P5pMPYTf7j1En8nVnq+ejm1Vxildv7pHw0TuOuXHUwMDFhXHUwMDA32J5dXCL9JsJUOOV3ZMxcdTAwMWUu1/HfVVx1MDAxMG2yer0oXlx1MDAxZlx1MDAxMNJcdTAwMTNrOjOgT0NfNJGWbydOf/PwmrDoViqwuCt5a+bqJTqmy+lU3fx3gEIna7ZkXHUwMDAwxzNsokhcZkzl9J1oLYI0m31cdTAwMTOHIzVjdzzSXHUwMDA2hSRC7ZPVMo1cdTAwMGJ81GZcdTAwMGbf21x1MDAwM1x1MDAxNvF40lnUN5+62jrrLlu/XHUwMDEzXHUwMDA1gMMxo/lonb7K1/Y0eDFeOrU6iZdHUMN84SjvL1x1MDAwN1x1MDAxMW5vlFx1MDAwMbmEnVx0ZZtcdTAwMTZxjof2vdHDiJNcdTAwMWVccnLHOKlwofzGlWgyarXf9lx1MDAwNXSzUMzzvVx1MDAxNydUXHUwMDE4f4GQKjzGotcslFx1MDAwZoaX4lx1MDAxYoizjSQ0XyRcdTAwMWJEgMxlSoHbh/25gJSD6UdH8lx1MDAxZK4wIGGX3/u3cMyRouWC2Fx1MDAxMe2WgsmGXHUwMDA2pHYjRlG7XHUwMDEzXHUwMDFkU4ey5I05IZ2XJ/xJL2aRXHUwMDExxrditcGzXHUwMDEz1qqA6IeAXHKxwadcdTAwMWLwVYlcdTAwMTiLO+drWo7+cMDT4b+I1LSBXHUwMDAxZsNLpJC6/LpcdTAwMTAvi/I5Lu9xpJ1xf5Lq5LLI34FbfnHUVlx1MDAxZCPk0ajciWZ8ia/vl3tpc8xo5XXbY+goxaTo5eXQ9jnlZUtG6sNR3Kwlp3JqnFx1MDAxNj6hXHUwMDE4lYZAoVxiuC0lJ4JFJ+DkXHUwMDEzlyo7/rZcdTAwMWTHu8Z9XHUwMDAyccqloSNcdTAwMDPe7CAnXmE/sv2J9PxcdTAwMTPZrKZcdTAwMTTNIJaAXHUwMDBmjFx1MDAwZrJdkDWhlGffV1Pjbjqcklx1MDAwMvDAm4b/0+dccnE56Vx1MDAxM86gu/KxXHUwMDEx9mteXHUwMDA28mUkWjlcZuSme9DlN1x1MDAwMq5cdTAwMDLAh2LMtKP5XGJcdTAwMTe79kZFuszF6Dd/6cQ8gjWzVZxcdTAwMTXwO7D20mCD0DSmhVPj8Dnz6FpdavIr7dtcdTAwMTFcdTAwMWTgXHUwMDFjnVixXHUwMDA3KCqNWTXviy2/fCNcdTAwMGJMqFx1MDAwMiSyUlx1MDAxNm6XaDDYrrm3x1R7lG1GijUhk19flS1JqYBYq/NIXHUwMDBmTTLPzJiHLZeIz6tCUO48k5NvjTDSai+8JWlLlbyRLGdI62VRmklVxo9qyWJjby4nb5bidLiLXHUwMDAxynLXk2Ltwlpb/kbPOmu0mmu6dFx1MDAxNYY9KHm2wlx1MDAxMmykUq2TI9dcdTAwMTJ1XGKYg15SV9nmXHLr58pO71x1MDAxYvE6wI0n/TmBXHUwMDBm3chcdTAwMWJzv07GfVLUW8Xis/jRXHUwMDAxw5DhOpBcIlBk36ybZ8uylWar3VBH25uBTD0l3/k2pJZWMFx1MDAwMnGKaVdSWcqW2F1042gynENp2cfJ0ue1XGawYt1vjutcdFx1MDAxMzy7lVx1MDAxYoR2WTZ9QSgtkfOBlVx1MDAwNlDxXHUwMDFkRnG5y8Zxx03drzhGvNTk7HOCoVx1MDAxZKDb6meaXHUwMDEzRi1cdTAwMTTL+vGPU8hmNseYQKgwYzJ0fP0yPsztXHUwMDAzXlx1MDAwZdXuertgQ4hcdTAwMTCYoodrpVx1MDAxZFAoXHUwMDEwT5v6mDOIab2rTaaYPVGbXHUwMDEx7bc5NXH/jK7zsFx1MDAxNkeCNaSVI0SW7jZHw6KAoVopjJNtV9RbQ7H1aWnzejnsx9/KXHUwMDFj+KTbnebfzdtcdTAwMDUy/mh9VVxyoFxiXHUwMDAyXHUwMDFkS6K+uyqNiNBcdTAwMTWmePfRedaUyixWvj3lNHO2TFx1MDAwNWBkXHRK/Va5i5lwLyyXuomPYzdtnXlBd8Xiim5cdTAwMDZuM4KvXHJcdTAwMWJNXHUwMDAz1y7buIFMXHJwPVrBm61Yb5W92Dd0LJ+Ht7OoXHUwMDE0/WTnXHUwMDE4SNX+kPbbaVFKnEmt/FC2i4yeXCK7tcFzZHfJQyeyju+xsqpcZulXRt/1XHUwMDEzt7Hh5o126Ms/zzk6qVx1MDAxM/6gt/3U56Cv+pRgjt+DXHUwMDE0NkU+XHUwMDAytr82cKVDY8FcdTAwMDJsIOvx9cVn1pFaZ6nO0Fgxp49UxaDTLeSax7TJK5fsJIKApOwgldnto+xwnsVi1teenIyBMtPgU/ZcdTAwMDF/pFWdpp2tXHUwMDBiXHUwMDFhiG9xZThcdTAwMTXwq3Gs8IdzXGY6YafRJ6L6MWopLDbWw6ZcdTAwMWT9nVYusHmLtC5bsJIq4MigPDCGQGq52SpcdTAwMDWRZ3FcdTAwMDKR1HU84XyhWJCKxT7F+Vx1MDAxNnxk/svgsLVcdTAwMTFBmYPLy/VcXFx1MDAxY1x1MDAxYYX2NLmKMyz0skm2+KrN6ntJdMqXXvaTTy3shDiyQ7l7Zd/XXHUwMDEyOsP8dZv+W6ltVrnJJtlcdTAwMWN7WptcdTAwMDK+cmU2etnXMThcdTAwMDD2knkk2znwXHUwMDE5JfejXHUwMDA0caJtonIjTmtYs8Q5RH6CcS+LizbjtuTLKCWrxYM5j5UyXeM7/rCvxZAxZFiTYlx1MDAxYSNxTFwiIFx1MDAxNaDKXHQxgsFPxansMMixkvdcdTAwMDWxQVx1MDAxYTTxZJKbvoapilVypI+2XHUwMDE1hlx1MDAwYpxcdTAwMDBcdTAwMWKl0Yu6oL5ns1CpXVR+lVW4zCokzlxcuFx1MDAwMqqGnlb1rSA8Wj/jhjqAvUOPZFe726Wjl4XiUlx1MDAwNJJ5VimU7/FzTEq8zlx1MDAxMWc79HqCVYy0XHUwMDExPlx1MDAxY/VfwcYz3pFnoylcdTAwMTBcdTAwMGbqq2C3eerK209K7nj2JfynvzVcdTAwMWWo8pX/qOWkXHUwMDFhqeMoftNKZTuuXHUwMDBljJaowaWMj1x1MDAxM0GhXHUwMDFmxj9Zl06hJGtjXHUwMDAyyretam1cdTAwMTExXHUwMDA1dt9cdTAwMWG+XHUwMDE4P1x1MDAwNLRcdTAwMGXErHlcdTAwMDFcZkBccpRulDVUSoRHuc9nueBcbntnWFx1MDAwMjpcdTAwMTlcdTAwMDJ9sEhumVx1MDAxOErxytmZx2Rv2dNcdTAwMDNGcINkbKhsXHUwMDE5JO2lXsOGK6xTXHUwMDFjXHUwMDE1VmA92mDT9r5cdTAwMWPzPeBUbp06JVx1MDAwM9+XpaFJJVx1MDAwMO0wo4+Ar0Y/XHUwMDFkXHUwMDEx+1x1MDAxZc7KuOqorE6ddi2bkjiserp0lDRcYseFak5cdTAwMTRTflKqiuKqanSgplx1MDAwNHtcdTAwMWPPSGKkMFlxc0HdlSNcdTAwMWRcdTAwMTjPq5dcdTAwMGK0JHT4NohAXG6VZ/VcdTAwMTlEb0X7nos+zqZnc1x1MDAxOcpXmlx1MDAxM0J58y7Vyuei76jPkTCIgIqms4I+9respfxcdTAwMWKfISZR0IxTUb7sO5r92uSFXHUwMDAy4nGHJJY/fSnzXHKye1fBfPA+Y4l/eC72h1x1MDAxM0B1P6aF8v2410hccnvTxYtcdTAwMWaE47xxPj9cdTAwMDfqa3bG5HHuXHUwMDE0XHUwMDFjf7i1XHUwMDExobdcXG7oPFxmXHUwMDExN/zNmzFGX1xuhauQsZg/ekow6bhcclx1MDAxMsJJqkFZcuRD5Fx1MDAwNpdkXs/8XHUwMDA22PWvTOsotFx1MDAxOVRunyP3QFx1MDAwMW9Q35RlvtFcdTAwMDRcXNj8/VpcdTAwMDSBkZVmgFx1MDAxMOnJfckpKWXCJJV7301cdTAwMWFf3D+9XHUwMDBmXHUwMDEzalx1MDAxNEnuQ1x1MDAwM5WkdE3pdI+G3G5cdTAwMWKgvkLShVxccb7zz8lcdTAwMGV+iGpcXPw+qXZUPophTmrJXHUwMDEyipW+XHUwMDAy/OO8v1xc1vVe5sonTrOWXGJcdTAwMGWAXCJcdTAwMDK2/vpk+OOm0EB2R1x1MDAxZkNcdTAwMTJ3MjlcdTAwMDdMeq2U8y+a/+Oau7+4pqlcdTAwMDbJSDfA7F3pqlx1MDAxNtVcdTAwMTRcdTAwMDdeMUVu14gwKUhcdTAwMWKpdr6K7WtIQd7Qoja76VxcqeJdaOZVjzfUksLBLu/dXHUwMDBi6C9cdTAwMTNoV4ibgM9cdTAwMDHI7zlcdTAwMTLJoI1cdTAwMGZcdTAwMThcIomd3adWw9OAm6nLXCJ8/SSZm1xuw4v5J+s+/jEvlyXkgnRBfFx1MDAwMD+YJVwiUyVcdTAwMTfIXHUwMDFibk7BNWiskmGMnYbvw4OKXHUwMDE11Vx1MDAxZraHXHUwMDBlIIRYi5mBb9zfXHUwMDFhjYBcdTAwMDAm6V8hLP6j3bNCdcjWTv5xLtz/uK5GiTRk8cUj5v0sNpdXXHUwMDAyMFxcSlx0ifDSSoTu9vbVzfT3S7HRXHUwMDA2mFWo+cgwXHUwMDE2Ue2L8GeMVTQ4pH86pvpcdTAwMGZtblx1MDAxZURhKSYodpWAT7LqMdx5xYQwwZk+VVwisVH6WXwxWkO93705fOOnpuBUcp1cZjco5OjhUPNNvjPuv67Ln3JHxJSDYsWInIRxgVx1MDAxZM8hcz6zp/e9lGO1dlx1MDAxN1x1MDAxN7qGtFqZwa7FtVx1MDAxNVx1MDAxM4BvuMmH//K8Uk1cdTAwMDL3RMnFOPBcdTAwMTI5q2I2zepcdTAwMTTKXHUwMDE4pYNCNcky9bXB39xcdTAwMDdcdTAwMGauWin60OJcYvP7Q35cdTAwMDIsnlx1MDAwMnVcdTAwMThfjFJBRC/Af8z1f2g7XHUwMDFk6S/JcI2HltHAalx1MDAxMvpcdTAwMTJcdTAwMWamf1x1MDAxNXhcIitpRFx1MDAxYZBUXHUwMDFi6yBcdTAwMWZqVC5iXGJcbkBcdTAwMDFkpq1cdTAwMWP/ZO7jX3MyJzSy+Vx1MDAwM1x1MDAwM2z5XHUwMDAxbrak9WJkmuPOXHUwMDA09LiHqCyl87JcbubBl99cdTAwMThJ6ND3XHUwMDAzIY/vkoV/Xe4/rluQXHUwMDAzO9FdbZfSY+hFJC9cZlx1MDAxZqTNUimBL1pldz/gXHUwMDEzqXZGUFxy0mLggqiaeKmgyTTw3lYwXGJFoOo/56N/mD/wwKJUXHUwMDFj1qRAM735abSbiNxBulQ7a+1PXHUwMDFkJ4jWT4MpalwiXHUwMDA2MiNjtH5/KMllXHUwMDFlgZOVbtRIw8VQLeN2XS1cdCfDXHUwMDE3XHUwMDFjW+zD1Hw74L9an+Qv5ZlcdTAwMTiRUj7d5Vx1MDAxOXLD88wk01nBXHUwMDA1XHKbfo9cdTAwMDRcdTAwMDKulHk4XHUwMDAzkYuLuOY1+z2/xKNcdTAwMTHZXHUwMDBmu+vQ+zuolZ6kmsdYVLd1OXHQXHUwMDFin2skXFxcdTAwMTWT/us4/OszVCTFrVRryeb6dF+mLz5GkVg1XHUwMDE19YBy1CpcdTAwMTgpXHUwMDAwiKNcdTAwMGLGo8RcdTAwMTipZChLsORh/VF6yMD4iUDmXHUwMDE3b12F/aJXtFXOf5nPXHUwMDBmhlx1MDAwMuBAu+ZcdTAwMTM7rHdd7lx1MDAxYVK9ZVx1MDAxZJojY9qQipBjgkrbz+zAUpBL0lx1MDAwN7fKXHUwMDBmO1x1MDAxM5W+XFx251x1MDAxNFxm9tuPXHUwMDFjKn47j1x1MDAxOP86Xn/rcVx1MDAxOUWRNFxi7V1cdTAwMWPvZcksj4LNVWCxwVxmWHLvgpXufpQnWjdPlX5cdTAwMTLfPc2vXHUwMDEx3dglT5Ta5Gua11x1MDAxYlwi6YPo6PL2r/rzP66by5rlNN9cdTAwMTK/yLklqW/YXHUwMDFkoaCiXHUwMDA2Pjx5aKlcdTAwMTNrtqlcIppcdTAwMTXSkFtcdHXcg9skVV1iLVx1MDAxN6bxNHdFblx1MDAwM6XmPEZA39M3KNi9e5meUVX515j5x5xlqpfeXHUwMDE0+OCgSMNlqTuLaXFfTl4nXHUwMDA288mHUjylXHUwMDEzh8c7WIbZOtwqToQ0XHUwMDFkXG4miKagfWFXr9ihUUvVPye9MP5cdTAwMDbmPNfeiZlcdTAwMTJR1eCyR9BTWzq/gCUgX4LMToDenS5I+Vx1MDAwZjJbNidYdqnIuNuwsstG9/Fk1pyxKcz+y3z5lWN4uOcrM99BOkE+pVx1MDAwNX5ml0Fvw//JX//79rmLXHUwMDFipFx1MDAxZuFhSl+ZtIe5m0isn/iUdH/9PUaPn5qGXHUwMDFlXHUwMDAx4H+NXHUwMDFm/+NcdTAwMWHlJZDkOHAqZXigflV/XHUwMDBm51x1MDAxZVFAUVx1MDAwNZlDufiU42uIKn5VMUtcdTAwMGWUXHUwMDFm81xmqlxiglZ86vpcdTAwMDCkf9nX/661XHUwMDAxJVx1MDAxMCY2pT0ydLRkLITipfyxXHJOJ1x1MDAwZtZcdTAwMTGyiqvkJt1Va1NU2m9dXHUwMDBlXHUwMDExqMmdXv5e3z7QXyX0ScNV2W9cbq21vJzBNfvTfYFeuqZD9sLrMyhcdTAwMThcdTAwMTVcdTAwMWFcdTAwMTRAxVx1MDAxOZd2xv9cdTAwMWV7/v3c2iBcdTAwMGX8RHuFvZTHPtduazBiYUWWxVx1MDAxZd77Of9cXH1XLG02MbKVXHKQfXa3+4kmXHUwMDExXHUwMDBmVN07XHUwMDA0iuFv5mTDYlVUMEHhgoW4XHUwMDE2JviK4Ot9r4OATb7e9HZcdTAwMTm5XHUwMDBmXHUwMDA2TtlIvVZdiWRynkH7gDVEY4Tuv5hn+4/6MCc/xzx00FQzk2SEXHUwMDE0dE22XHUwMDA328xD4FxmcFxivchcdTAwMTFcdTAwMTQu9iCg/q1+ZWn3XHUwMDAxy/Tx1VqWVVxiXHUwMDEzYeRcXH/hgNjMn7fBM23/u3F/UvTgXHUwMDE1puBcdTAwMTS/lTnV8/m+tNkvt1x1MDAxZpz//2WKafLbqFx1MDAxMNi5pFx1MDAwNJq3m726y1x1MDAwMcVcdJlkXHUwMDAyVv5WXHUwMDFlI6RhaLxIxclEhopxXHUwMDBmlEJ8XHUwMDBlJL0g4WS7Uo9cdTAwMWIpOM39S86TPFxixfvv8NlvrohViMugrNuFvi6ynkNMW8WbrFx1MDAxY9+1uakr0oLm54uJqMZbXmZcdTAwMTdtwkdcdTAwMWWP0Fq8wLpuu1x1MDAxOKnrXHUwMDA0/vk8lH+sXHUwMDBiUP/7M1x1MDAwMKTdhjZcdTAwMWHNXHUwMDA1jf7YpFx1MDAxMfSY3p4uX8TK4lx1MDAwNIqToFuCrnhcdTAwMGZaoyyWXHUwMDA3w13Va1x1MDAxY4fOtrdwKfdp3CzEa/6mSLBI5Y9kfVx1MDAwMLE1/l7MWUV1XHUwMDE0NMYkq/Ro001gVVKA7jbmIN59NIlcdTAwMDWKzSMzf1x1MDAxONm1f0tcdTAwMDM/WjWx7D+sXHUwMDE3t9LCtr2kWHv4gMXYqE1dg1WtJU3Y34Rlqk1JXHUwMDAxT/tH3f6t2Fx1MDAwMbpE+u1P8j1cdTAwMTljXGZTXHUwMDEyTUB3XHUwMDFkRsvbjkpOy/n6g+vVXHUwMDA2LYzCeDlivVx1MDAwM6F7ULn2d7D4Ll9cdTAwMTRXksCZiI8hmJ/iWdTXcklcdTAwMGJiXHUwMDAygyNcdTAwMDBcdDn1Wvyb+tk1XHUwMDFlXCJbjTGuz9jrXHUwMDE4yZyNplx1MDAxZWb5rCx7xMH73Iy2UI1cdTAwMTdcdTAwMWOIdaE8XHUwMDBlYDZ7+vhpXfhvaN1Df0HpnaBMopK8XHUwMDE4XHUwMDAwNeR6X5ZdspPbXHUwMDBl8Vx1MDAxZKlOLj9cdTAwMWT7RqIk9lx1MDAxNLmrilx1MDAwNJ1cdTAwMWQnXHUwMDEye4ptxFx1MDAxOfw0mUfY9Yms6lCTJE2TXHUwMDA3S8skYORcdTAwMWZIRMxcdTAwMTZS4kDQ6ldcdTAwMTeljVU/YY9J3u1cdTAwMDT6/HrJwlaRaDeSJMk+x/PLeFx1MDAwZZKknuM/3ivChvPprlx1MDAxOW5vbTOrQzNcdTAwMGaNu9eWZs6n80Uhlfuvnlx1MDAxYy94g1x1MDAxZeaxlVx1MDAxM1Kw3tu83pTI7XqDqFx1MDAxY0LqoWO2y7Ig4/NcdTAwMTD921x1MDAxNlp8jt/u0M/xK/N/vMeQXHUwMDFjyflgRZN231x1MDAxNWXXoolRXHUwMDE1q6tcdTAwMWZ5QVx1MDAxM/5cdTAwMWJfYvqRvZ2UO/nik749j53xjW1oeqf3KlxcrNL0r7B/f/HANZf2XHUwMDE0/8t6/fGeTPZcdTAwMDbJpMB5avGDh7ZBpWU398xWJlx1MDAwMKGI9Vx1MDAxYd+7lty6v1x1MDAxYtPc+1xiuG+F8vhcbp3Rn7J2v2VcdTAwMDL/y3OTNPU+aoV1qPc71lOpkdBJp+Nv+L5ExMiBjFPztzA2T2j8XHUwMDBly3E1U0bpQFx1MDAxNP/vf/tv/8f/+cfxb8mcRWuW/tt//z+hXHUwMDBmiiDwh8CQN1xi/cff22hZzWydq2z/x0/98aH/998/+28gjGVgjEV5QiBQ8s6QXHUwMDA0j+FPXHUwMDFhwWiUXHUwMDEyIJxcdTAwMTFcdTAwMWZcZs9cYlx1MDAxMH9O8v/8z7N3VZfZ15g97/1b1UVFXHUwMDA2jH3xv1xuV/2u+PdP/Fx1MDAxZt9LozVyzO/vy79//vf/OPX/XHUwMDE1R0uGIf+tcinNPECZL4Zf06iWU7LOXHUwMDEzKOSmPD9ojCaD3/tsXHUwMDAwatdcdTAwMWaN56uWXHSK5LwgXHT2dIb4ZNrv+beM+yy9keKCmkKfhfBSUmzImJZty3RlcUx3l+Gazamutzisd2ni+7fZpbRcdTAwMWbvXHUwMDE27r/FkT+BtsHKJy2/cZW9g8Q7zT5cdTAwMTZcdTAwMWLrXHUwMDEzslcoXHUwMDBllfV1XHUwMDFmSbtcdTAwMDSlXHUwMDFl0Fx1MDAwN13F0oq+jndnUJmffmL1+6WCnt7LlahT7Z1vOaN8gS1fUlx1MDAxY5dcdTAwMWHbNFxyyjAo53k5pMOS7vN6op8qTOqBu6XNf1tPXHUwMDE19PC8XHUwMDA2clx1MDAxMMnpecmkTJNyo9CIT1pVQf/1798nmZpCYVD6WNbNNLh/vEYgnOCEU9CCbLlRh075XHUwMDBmZSi+9FIo3KeB3Vx1MDAxN1x1MDAxNLVes85cdTAwMTG8Plx1MDAxYX5/dVx1MDAxMFx1MDAwNGH3N9knL6ZcbiN9Raq3XFymgbRvx/lLPUjufFjw6TPOL+jZxXAtfZsgxGKBwnOTSlxyXHUwMDA08GKoXHUwMDAy0PJcdTAwMWNA0etcdTAwMTOvQu5DhIXbYLjPXHUwMDEwXHUwMDA27NIlSy2VXHKTb9h/LeP8K6P0XHUwMDAx6KJO03VdwXjCtqJ/gJDIObFl59ldX6+ZeFx1MDAwManufYiXnjCf21x1MDAxN+qzXHUwMDA2PXpwstszrvltwmn5XHSXzv1aXHUwMDEzie9cdTAwMWbGMs4/t0dcdTAwMTHzT85TSF0tZDvaUnMlb1s6kMRBcGHGXHUwMDFmMuyTSN3hZvtsnzFcIjIg49XuXHUwMDBl2K+0ajdUXHUwMDFlg61141x1MDAxNN1R62CV8F1GXHUwMDA0Sbc7WKfWXHUwMDFlUTRZYSR96vLYbmDub1x1MDAxMc3bf287k/xcdTAwMWZ9Z1x1MDAxZlx1MDAwZUtcdTAwMTVv+tRenziOXHUwMDA1dpVcdTAwMWRIt/H5qe+2VWBWupdnXl5H7PHrbq5QXHUwMDAz01x1MDAxN5Flu8BxV+daLfe1kD2Fniyqm6gur/c3q1wi16pBq8K9XGZ7zVPW6c/H+1x1MDAxNKky/0bxP8Va9bxcbrahipwvp8H0ZndwuztcXOHFPlx1MDAxMTzLXYjIc1x1MDAxMFrj7FxyNU7Z5FVkT9k+Y8eWar0n1+WBXHUwMDFh+1x1MDAwZX9cIs33+0lqlqapzeVdj1PcYV03LpFm0rLk0Fx1MDAxNaif0Vx1MDAxN7Cj0NaRrnVcdTAwMDZig3O9XHUwMDFmMK1cdTAwMWWQV1x1MDAxNX6/JfTn+PqjjTj3XHUwMDE30mSdMnJrLXWIPsdcXD/9lOtz9Nr3j/X8wPhfXHUwMDFmhCEnjrRcdTAwMTfaYmxjtv2U3DFcdTAwMDP9XHUwMDFlwEhcdTAwMDNzgHhJt5xZtDVMUS+R+TeC20k+PdGp8WyNXHUwMDE4O4qIXHUwMDFkJmbstbdcdTAwMDBEXHUwMDAwXHRcdTAwMDCtuU+8pdRP4fNXp7HwZdRRhn/IWY1cIjGu8sn4c7BXqqlcblx1MDAxNqsw0Vx1MDAxOaDOVGvsQd2TYd2wzVM3duYkmbz8K+NvyeiUZorsXHUwMDE3WlhancHbRnCe7ZXh4/PlXHUwMDEwTV/s9Vx1MDAxZbhcdTAwMTNQ7DpcdEZ+OFxyrSS00NZCVlx1MDAxYVVUXGZdWU9cdTAwMTlcdTAwMWJcdTAwMDT02KMvOHnpfFx1MDAxZGWixYllvXtfXHUwMDFiQfM/xVpcdTAwMTLhZKeE56LN7lx1MDAwNE9V4lZcdTAwMGVcdTAwMTZqfTzigF6fXHUwMDEwblZL8vTtNnasy62PM0JcdTAwMWJcdTAwMGbASSVAlf6Dv1x1MDAwNFa4mHR/b1x1MDAxN+62qo1cdTAwMDC3XHUwMDAzpVx1MDAwZeqIn5y1eP3pZ1ZJvmVCy6m9XHUwMDEx+vhcdTAwMTTPvGTTf6fvXHUwMDE0xpFMp1x1MDAwYo/LeUBJdeo/l8uxqCX6kJ5onueZZZdndPdYnFx1MDAwMc4jSaZ6alx1MDAxZMD+mjuQYGpcdTAwMTIljzbmWoFjM2TKe6HxpjUqnMj5+mzzICpcIpZDT+/1/vjJzvdA9Vx1MDAwN3OWbHtiiiX4ecYgOXOxfVx1MDAxNkC9h72fXHUwMDEwXHTw5slxIevXj4qsUFx1MDAxOJ1cdTAwMDCl+cifsNUjXHUwMDE3+aa9QL3P0kmqJovD5Ynd3/xcdTAwMTaw8utzgD/rXHUwMDEzN3nfIIKEXHUwMDE4XHUwMDBm/lSLXHUwMDE0XHUwMDE0ZIFcdTAwMDQr/I5pTUv7XHUwMDEwZvtT6e2VhuN0STQhWeVcdTAwMDDlKIvJYLVcdTAwMWVMJaFQjTsynVx1MDAxMfaUsdrOSX9cdTAwMTjGP81IKNroatP4Xj+ZXHUwMDFmvXC8mfxfO+JNatYt+GdMnkQ6OHz+uPMs43XmpVx1MDAwYnX4sd4rhCs0T1xm0bdcdTAwMWHmXHTd5JLjvslK7/tP2GSKeE2agJOoXHUwMDA3PVx1MDAxNU5cdTAwMTL6XHUwMDFlsUyokmvv35+0yJV3Ur9cdTAwMWZNx5yF0JGC9Lo/3qxRwvvJa/atKdL1+cLwXHUwMDFjXHUwMDEzoUBcdTAwMDBcdTAwMDCmXHUwMDEwuv3WzVx1MDAwN/XUO93eYjH1a1x1MDAxOOxU3XbsX3mknOnW+NRi6v9cdTAwMTbP7G+qPCYjVOBgeVx1MDAxMnTcoqhcdTAwMWMyfnrSgfficIVcdTAwMWXbJINcbqJjQ1GvOIW8XHUwMDBln0KePuY5n1xm7lx1MDAxZP7yTCOoSenz8HTTykSgJ4dbqcW00SO0L2NcdTAwMTKMyTm65fZMS7/4ivrs2Gv9TFx1MDAwZpZ80NL5rf0ggFx1MDAwZer/XHUwMDE5p4PqXHUwMDE4XHUwMDFkXHUwMDE5OT5Sdv9CXGKJXHUwMDE4XHUwMDEz++473aFbzCHm0+VBRW+LUW9cdFbRWio6dFx1MDAwMmRcIplcdTAwMDThXHRz5lx1MDAxMyD3XHUwMDE4cnk5MelcIudcdTAwMDVVyMvxfJZMxPAkUp7DZ3OF8fRcdFx1MDAxN+Rs8Fx1MDAwNofUPa7gXHUwMDFhrWdd1+f1S1x1MDAxN5F6XHUwMDA2r1b4Kn/C75pyuKn48PFcdTAwMDcgiKXyvu5cdTAwMTZcdTAwMDWzXHUwMDEw9Fx1MDAwMonkYtt6aVx1MDAwMqmMmbBcIsR7uF4misFcItZcdTAwMTNcdTAwMDXl4JYgyMnGQSEzPVwiQlx1MDAxZTjveIU3XHUwMDA3P4H4qONcdTAwMDU9x3euJYrsL+pcckVY5blBgG6QIUtcdTAwMTb45VdAXHUwMDFioVczXHUwMDE0mVx1MDAxOEk9i/Rs99r9XHUwMDE5fImp5y05bbfan/v60Vx1MDAxZK2h2vQr290pY4BcdFx1MDAwMVx1MDAwNKRcdTAwMTZcbnyvxKzGcKXENb905FJcdTAwMDHl0qGuV1wi3UHQ0Vx0juxz37P4iX9VlUCRXHUwMDAz6ZRcdTAwMDNaNERcdPRcdTAwMTBiqVLQnmqEVz1cdTAwMTSzbLzSXGJ5XHUwMDFhbkPqZcKSpYM+0VU4r9ox52RtnoDQeqY+L2mAXCJIslx1MDAxNL5YcvtuvT+VlS/g0lx0XGKb2Yy+wPlcdTAwMDHSqsWtrsfNvlTv9LRLTphcdTAwMDI/XHUwMDFmTZNV6DKyXHUwMDExsFx1MDAwN2TiKJDHuaVNaipcdTAwMTJSleCeT1x1MDAxZOxDKGnlmlx1MDAxN1x1MDAwNTFxIZwn8Vx1MDAxNa0kgVFv/2vdm1x1MDAxOSZyietPt66YYlx1MDAxYfJcdTAwMWOr61x1MDAwYmtBbVx1MDAwNzE2hP7QXHUwMDBmdFx1MDAxMZZsVIB/1V+myJmzQlxyZS9cYtyNQthqn7ZcdTAwMDOpNDzOXHUwMDEx9jrifMN+vCtSh6ZcdTAwMTJcdTAwMTOse6WE5DrDu5KiKJ+dTFwi9DdU5iH+aVxuL5pdOopsaLFmNCW4T3ZcdTAwMDNcdTAwMWEh4WE6cWzxMS+aXHSYvvhSXHUwMDE3XHUwMDFm5+aXXG5yn8owheBkxXJZrvdcdTAwMDD2XHUwMDBlXHUwMDAyRFx1MDAwZq7OPz3Zfc5cdTAwMDZcdTAwMDEqXHUwMDFiRVx1MDAxNd/8q0ZFovpcdTAwMGVaR5FeP96p7UdRSaXvQesn+v2w/TNcdTAwMTPO8OG4cbmOXHUwMDE5XHUwMDFkvksgz3TOkFx1MDAxYcslfsJ/S2n6XHUwMDE2Pdtyc1wiSpqSz1x1MDAxZqpcdTAwMTVC6aa83eOWN57UwPFBT8hfsClcdTAwMDA0ZVq+XHUwMDFi4L24Y6NeIyu2w+65YY2CWOqNf1x1MDAxMOg+pnk+tzqgWfXHmLxXMPyZ41x1MDAxObo45EquXHUwMDE1zVx1MDAwMtc+9EJVkZZcdTAwMDdP4e0zyd2IeSCk2o5fPrGL5TRcdTAwMDc/sTHSc3NcdTAwMGXux6XqXHUwMDFlXHUwMDAy7GGjm+uue1x1MDAxZXIyraW1VvR3nkyNhMuSmMwjfYLozd3cXHUwMDA20cLnXG7K2Yh60kWYXHUwMDA1tIx6XGZfXHUwMDFjuWE4zlxi8eFAPbzl8IS0keOPpYQtc3xfzV/9XHUwMDAwL4BcdTAwMGY+XHUwMDA0QXpcdTAwMWQj7ld4nMgs/Wh77LXt9ZLXLu5WS9yXybfQPuQ88omBgsubvLPXuPdcdTAwMDKoxKBWXHUwMDFkQ4V8TsS53thcdTAwMDE3XHUwMDFha7U9z2Y8XHUwMDE3XHUwMDFjX4xcdTAwMGLtJ6s1XCIrXHUwMDEwrjev1UH4eHpaz11cdTAwMWSXrvs36v1Wp79mSYNjXHUwMDBmkEJG0kV9lX/tfSEti0x1I51cdTAwMDTxXHUwMDE0M1xc/uyFXHUwMDE033AmYVx0/Vx1MDAxOUJS3bdcdTAwMDeHU7/WsV+lS5iPi1x1MDAwMHLr8DTiXHUwMDA1f3xhoaH0OWnlXG6a65EulFx1MDAxZnLPaPyLMVx0zyNcdTAwMGLKf6BhlT90/1ExXHUwMDAyXHUwMDA22/elto77+Hvr20VcdTAwMTl61MhxZ4wmYWnpXHUwMDEwxvShNVx1MDAwMfXj+muZgp0s0+WDr1x1MDAxZVxm0FZBty7rR9T/Yb6NXHUwMDE31f1cdTAwMTE+Q1x1MDAxONTc8Z9zUjBcdTAwMDeQ4Y66WOQg0Vx1MDAwNVxm3SOvXHUwMDBieVx1MDAwNOK/MDpGcVx1MDAwM3PDmvJcIiDAjzaou+DqXHUwMDEyYeqs682sJbZyl9pcdGpcdTAwMGXYXHUwMDBlUVx1MDAxZDOjXHUwMDEyq42LRY5SmWBcdTAwMDfOr6xcdTAwMGX8ZMJaXHUwMDBlKXp4aSXedZ5g2DAoqImfqKBo1b3wol6+3nG6iplfs8t0qpNrT+pcdTAwMTP/L/nxJSC6wp/yRK6mMrbAjaL/5Fx1MDAwNf6H5+SikpRcdTAwMTJcdHmpYVx1MDAxYyPwe/2aj3h59M7im5Furs3jNsBHKr62zlx1MDAwYlOf5DCUxGg6mFr0cEAzIZDHoZWRVmurmfxmMdNcdTAwMWKeSGopSNxZ9qzbXHUwMDBiTlx1MDAxML7wXHUwMDA3XHUwMDEzS5dX8p1RgcloPulcdTAwMTdDXHUwMDAwXGLDa1xiRevHVKQrXHUwMDBmf46PvFx1MDAxMOGv/Vx1MDAwNe1ePpCJIFx0nFx1MDAwMiaYsnt1XHUwMDFmM64qvXOKf9KTSkQ85eeQSPcn6Fx1MDAxMSU/n1x1MDAxOPPr7Fx1MDAxMcJPR7a++0jSXHUwMDFmnnNHNVx1MDAxNVx1MDAxYmc0iJRcdTAwMWThmkd8t7WVbbj72lx1MDAxZFx1MDAwMI/bXHUwMDE4jlxm1KlcdTAwMDaLjEgrgVxuxVx1MDAwM1x1MDAxNGR03EVcdTAwMDZlxyCPRa1MqIdutlwid6fu+O9O2nDkUTTYJVx1MDAwNS6RjG7qXHUwMDBitpiHYTs7d+uMZZNl2KOVzyHWbpx4ws3eXGapXHUwMDE1rlx1MDAwNy/R+lx1MDAwM4p/8Wfu0FDcwZRcdTAwMTbnPL5igsct7tFdjPiy+vnDOlx1MDAxZVxiYTiaolx1MDAwMVx1MDAwN1x1MDAxM3x/x0Du7lpP3etYXlx1MDAwNNdVXHUwMDEz6/N8XHUwMDFhYDKOS2rdI3dHqnCWs13xaaPC1GuMXHTce3zY2W5Rxcpj57ffXHUwMDE1eVdRy1x1MDAxNvVYzzUwVvZcdTAwMWHyu92e8VEl1og9XHUwMDFlJIJSZiZcItjMsOxe8m/32CUveCnNjGZKj5//qO8rRURyjf2kL2z5jTg8ljaC+1H6UtHnQaXts0iipIqyf9fMUmBJVJrJXHUwMDFkVr9N5k9FQT2O/oBcdTAwMDfBnSQz81ZcdTAwMTVZLXuoXHUwMDFlXHUwMDE3XHUwMDFmXHUwMDAzriAwXGI4XHUwMDE3U1x1MDAxN93Gx8EjXHUwMDA10PzC6E1GXHUwMDAz7lYhWdxwxqY2KiDMV+T+kcuL68i7e4gjhyDr472I7dFOK1x1MDAxYy1wpDrFKKLCteSob4h/8VBOqFx1MDAxNCFP43/40XVGl1f+Jj5cdTAwMWXUh2Xuv1x0+PUkxfXST0/qS1Yu+Vx1MDAwNVx1MDAwNe6xZVK69GW4vzIswlx1MDAxMX+cXGaQXHUwMDA24Vx1MDAwNkjb+l1G+0jvSsxcdTAwMTVUzZNZXHUwMDEyUEDgzFx1MDAwYiM1T79FXHUwMDAx2iF3K1x1MDAxY2pXXHI/XHJBmO50bHqAzUaUjMzcxJxtXHUwMDA3XHUwMDFl8Vx1MDAxYeVx1ce6M65XbLZeXGZsn1x1MDAxN1x1MDAwMUgjpH1QrzIsXHUwMDFkhkMlrVx1MDAwZflP40qKdnI5ej5lerxQpvc3+lx1MDAwMjQq+vpmJ5ky9lxiXHSQKJFcIkKMXf9ZvYaJ2i9h+KE/uETNUjs511PlPHQgv5pcdTAwMTQxcoOpXzxcdTAwMWKYUOA+usSdJonf7O7R+KtcdTAwMDexXHRcdTAwMWbX/nWb9G7io1shXHUwMDEzNklajedTXHUwMDFkt/D5VTb4Ky/vXHUwMDA275eVvmfata+P9l7faZ2+fchcdTAwMDA0+4LAv2ogoXRhJlx1MDAxMDf9KKPUmqJ/92YxTOz754LXMnZcdTAwMTU0XHLa2ilcdTAwMDVcdTAwMTJcdTAwMTVSn+pcdTAwMTbVXFxlOeR6fYK12bhzeTHTXHUwMDE41plNIVx1MDAxM9X93jt6rrM+0HdcctHjodz79duWSIjwajs24FxcstlMbIietySG0Fc8SDdcdTAwMDTusi1cdTAwMTJQyZ3cak+5vYO/IY5Xplx0Qlx1MDAwNVlQvPZcdTAwMTbmuTm71V+8XHUwMDA3/XC4/sx3huHxJFx1MDAxZTNcdTAwMTBcdTAwMDS9/Vx1MDAxNHZk99FEYXOj2PdJlfHx5Pv8RWYuaNVHXHUwMDEyYj1cYrc9U1x1MDAwZYs2pfT3cTfo62BQQGs8XHUwMDEwVVx1MDAxYV9wNexDb1x1MDAxYbK797tcIlx1MDAwNVxyv9HA+Vx1MDAxNjbbuf5xSZ/zvaJZiFwi3aJcdTAwMDS4XHUwMDFiLfKDw6XnsYhcbvo2ZElktIyM6k9cdTAwMWI5XHUwMDFmXHUwMDFhfk1cdTAwMGV209vepKycbjCDhdaU5dhcdTAwMGJYXHUwMDAxKP2NkZiCiWeZXGJmXHUwMDFhwVx1MDAwZdPJXGLI00+a9yfd5/F+wF1HX1x1MDAwZZ/1QnH/XHS12Vd7pr+P6uGk9rbf6ol7XHUwMDBmr3dcdTAwMGYvpo1cdTAwMDLyXHUwMDA1eL6/kmsgMN3BJO5CVlx1MDAxMrggl1HagoGMRipE+yE671x1MDAxOFx1MDAwM0fNcSTD61x1MDAxM1b7XHUwMDEwy4zw8+RhgpPpiTE9XHRlX+CmiumitTfhr5A4JYwuc8e3em2q8j3b1obcTEM1XHUwMDBiju3da2PstVeJ/SBdvT+B1J2ydIrCY2STPlx1MDAxNIV+XHUwMDEx8C5cZrI/55FcdTAwMTg48uOjgzfXSZIu1Vx1MDAxMk5kQIh+svfq3lx1MDAwNqS67/itXrhITWrdKJ5BxknOdDdheIE8UfNcdTAwMTZ7j1x1MDAwN7hBfPjMooKGnl1fjMVcYlx1MDAxZvSOnK834vxcdTAwMWVQ8yvXhc5cIrZPaiGVMpxE71x1MDAxMHxccp1HiFx1MDAxMlx0+rlcdTAwMGJg2lx1MDAwM49LQoi5XHUwMDFiZp1HXHUwMDExoozRhXGRXHUwMDEwvTRcdTAwMWHNZE/iXHUwMDE0uvUx1cfm59+YvJey94hBu1x1MDAwZlx1MDAxM/MnXHUwMDAxV+lcbjadr72OwmtcdTAwMDF0QVZz/9KPdsBcdTAwMTeB/WBG4Phqg4VK52dF4Xy/XHUwMDFkscTfXHUwMDBiXHUwMDFip7CLbCOKjYdX+1x1MDAxZoaF7cP5tqqNZmy+WVx1MDAwYnFPLiFResOab2vIr4XM715tNC2tdLRcdTAwMTBelXjtPVx1MDAwMOSLSNvDLUG2qcpGXHUwMDExXHUwMDBlTP/eqCE939HUOr6uRVinuFx1MDAwNoFcdTAwMWF3P+5cdDqNyHwhgye4yf5cXLlr7s6yJlx1MDAwN1x1MDAxNm1cdTAwMDCdXFyt77d7xNLujIhkmzmLg6Ar+qvuebiWpFx1MDAwYoNDMC6OPzCELjRFXHUwMDEyXHUwMDBmLobrXHUwMDFizH/Dz4D35COWPD7r9u147faShvJcdTAwMTLObFx1MDAwMt10U0yP71b2XHUwMDFh4WR8nGqVXXrHT1fzNVx1MDAxNtj3XHUwMDE1pvJ4TH3gU4+fRXp3IXFcdTAwMDDp4NdcdTAwMGJ7NFx1MDAxMtf705iBYSV4MZ0l2ZO7tUBBPn1cYiOM9cfs5p1KcmhdWkJd44CNK/Tdf77LXHUwMDFldc7U9svz3/WTvztPXHUwMDE36u1cdTAwMWTvb1x1MDAwMthBW8Lxpv8gy5/9XGZHXHUwMDA3ZN+NX1x1MDAwNT/saaZ/4yvEXHUwMDE2d2Fn8p7Z6Sf29CV/JU8m8/yHezWxZk0qs1x1MDAxMPGigYq7XHUwMDFkwFx1MDAxYkpcXEOELi7+jbVcZlx1MDAwMtX4XG48XHUwMDFjO1x1MDAxOJwjp5bWoyu0zGXRq0aM21x1MDAxNkjff3g5T+Anh8OrfOjjnI9cdTAwMDIlIOGDbblOaXInf7tcdTAwMGZzXHUwMDFhnNa5ITSHhqxbbJxuOrHb4K7WIey3zYVcdTAwMDarXHUwMDFjXGLXUaNcctgsf1x1MDAxOS9md8qZ+CQypp5BiWzXXHUwMDExPFN8aLWdmbw4o035gWA5kzFKjlx1MDAxY1R3XHUwMDAxXHUwMDFjkdgnkzPiMkN09Xp3Klx1MDAwZs3VZM0wNnpcdTAwMWPls7Dx2kw8XHUwMDBlefyxk19OP5hcdTAwMThTskdfOTbPJ/Hpf71q+tKLcXvAXGKnXHUwMDBl4knk9kj8p46Ul2dcdTAwMTZcdTAwMDZcdKfP0lx1MDAxYjE4njyYnydcdTAwMDPTOCNDXHUwMDFkXGbZmahgwH5cdTAwMTRYKEghh6Vcbi/QVtRXsk8k/0tv/HveyVx1MDAxY0xcclx1MDAxZJtI2Znnue++XHUwMDA258vh2CNgNb9M9DLCdFx1MDAxM+O+8bruXGbik1x1MDAwZsDMt1x1MDAxOVx1MDAxN2HUgMe8SFx1MDAxZtGi9+KTaHh4PWz9dibr06C6xUXTg52h8uD/hmZVzmzZXHUwMDEwhj+FzoWrxCHHXFxcdTAwMDa002vmdLhcdTAwMDCkcz/+p/ZjnrWRuZO3o0Q8SWep1qJcIqJi4HA97fpodujjXFyGlYWW2NfjgShkjL9iXHUwMDE1O4PhXHUwMDBiQIzMbfJ/vv9wqKU7UEWQvu+SvVx1MDAxZThhuFx1MDAxMaxs5IjwbijWXHUwMDE1RlHK/HpwbLy00YlcbjdnPCTc81x1MDAwMGhVVn5lXXvH3eeuYCmmOphP8lx1MDAxNMe5Mj9Bj03mW0VcdTAwMTJcdTAwMDI930VYk0n8/qR7byo1mtruVHuQOmZI2Fx1MDAxNYIzblx1MDAwNTLeoyO/VeyIM2x/XHUwMDFmZlL6ovecTJGRrH3L2uepXHUwMDFjRCW/JVxmWGNcdTAwMTJ6XHUwMDA17Vx1MDAxNfbnY9euNpHXa/H8L7e0ut7HQLtU5p+0VkNKdGnQXGKC7LtcdTAwMWN1YSvdXHSgW7+8i2D5hCnv9PhDs1x1MDAxZcHSbp6zqOkqTTFYtJ9cdTAwMWK89OJ0RyfTX7hccoC8QbpcdTAwMTeL/Nbu+1x1MDAxNOamc119eMc97FrnXHUwMDBm4VlcdTAwMGJcIkZ51Ft0z7q15uVcdTAwMTHOkEKi/nhcdTAwMGXy70bTWs2Lilx1MDAwZWmi9eh6aORcdTAwMDFkXHUwMDA2bu5cdTAwMWX35Jwuhbp8/saZmSTTXHUwMDA1XHUwMDAy319J83VdXHUwMDFkq4z/VJeFXG7ci+xrRfGFXHUwMDAx4k/8lWi+fm6CUM+/JcfiXHUwMDA2XHUwMDE3SGRfXHUwMDFl71ZcdTAwMDZVRTKgW0j+gGXMLK2bZPlcdTAwMTZgyCh/Nlx1MDAxYpXEUamId9w2b6RcdTAwMDbeXHUwMDE1oylcbtGNja+nXHUwMDE5/tb261tjeqGgXFxPT57rO9G33LKb407B1TfjXHUwMDEz+yN3XHUwMDEzTkjr12uaoYMwdyem23oyMM7gzlx1MDAxMP2NSbvMlOazXHUwMDA1PHhY/+7JgL4/Q5swU2lcdTAwMTmPYvNcdTAwMGb3X3nKOI66xJFHScbegOD4cd9w+/Pu18+7XHUwMDBiXHUwMDAxxN9cYsGKXHUwMDEzjD5+XHUwMDA2ezyu8Vx1MDAxMVx1MDAxY/4pkcC3nH9C2lx1MDAxYjJYoL0gvvQtclxy55TyXHUwMDE0ep9ZpMHzplxmV+98aNeCc8t+7PHbyHnnQZMgbCiY3DI7XCLuqVHtlDv1IPntXHUwMDEwKmPc2/DJVzL5ulxu51x1MDAwZsdcdTAwMTJJPFx1MDAwYmJIi15mjrBcdTAwMWJ+4eTqgvSRXHUwMDFiu5/6IVx1MDAxY68wllpbhVwiVWWdXG73VzxcdTAwMDEpXHUwMDAzYZLQ/93v6+/1/ZmuqFx1MDAxYufvsFxuQ1x1MDAxYXNBzDpcdTAwMDMnjVx1MDAxM/xcdTAwMGXUXFzjsU/AU97h9u9YrszPXHUwMDFiWlDmXHUwMDBijtLsvUFAUN8wPn7qPEH6uknAe0ToQ3HhN53Z90i1XHUwMDFljt5Cm6aMOtsgqH6I7ShHpm5cdTAwMDRNwXhtzWJCf3g+PIlhvpNPtOKkZHDBRMT0q0teirtm6d3QyzXvoXneXHUwMDFjUfXVU+d3XGbE4fr5pGv2XHUwMDA2sd5Hht89xd4pXHUwMDFhbbLkXHUwMDExuFfW+PO9REQwuHJhkGt0fuOjXHUwMDAwsI9feN1cdTAwMWael9ZcdTAwMTc4VEX1wt9zvC58qPLUKVx1MDAxMe53PrCtQD9cdTAwMWUhrL6HpFx1MDAxZtBXYd1F7YTSWVx1MDAwNTyP1DxcdTAwMDGtJ8VcdTAwMDBdXHUwMDEzYXhpnlx1MDAxYVx1MDAxOZaEK1x1MDAxOLFcdTAwMDL5+4UvXGJpOedL1Vx1MDAxMpfvu/yus8qOKa2dIG5br6V7moGH5Vje3lx1MDAwNYWQvlaCXHUwMDE5lFxiKJUoMlx1MDAxYXv8/V1cdTAwMWZpnnBcdC6shOVDXHUwMDAwkHBQ+lx1MDAwZZTeXHUwMDFl71x1MDAwMF/fe16mZjLz68Xh1V/HhztcbnKl9HPWfa7sQFx1MDAxY0X368z1/kpcdTAwMWbkVj/po6O9XHUwMDEybDpIyah2XHUwMDBmh+7AhNFx8zTC+I556EBUXsU8aNVcdTAwMTTjMpDNXHUwMDFm4DvIyHuITErHSeIyLcPTt1x1MDAwNuI+XHUwMDExIYytk6tcdTAwMGKRXHUwMDEzSHKD8rZcdTAwMDf34p6rPzxcXNGM1Vx1MDAxYVx1MDAxM8HmZ5vja0VcdTAwMWNcdTAwMTcrXHSwQ1NwmVx1MDAxY/sulEa/e0R6Xa/e7u+zdFwieES18df6a8w+XHUwMDE1XHUwMDEz6+BcdTAwMTK+n75pysX7tjeyRavnz36zi35/RqHagVx1MDAxMbTGjsNcZo5AL3aRfzJnK1GUXHUwMDE4blmed7JoXG5bkzZcdTAwMThcbvjwRn3JnVgmXHUwMDA2UXE9+Ugwak1ZjytiXHUwMDA2I57bO+R9w7Xze5NcdTAwMDHqmmRghFYu/b5cdTAwMTGNPV5cdTAwMWaT5qjqO79cdTAwMTRcdTAwMDBmKlKPOtpcdTAwMGUw54Rd7cnz4LvKjZKPXHUwMDFhXHTMpan5TGFoMfqUXHUwMDAywGZBXHUwMDEw9v36rPAnXHUwMDA33kVx4F0xYnFNJ/9Jh1x1MDAxZTRcdTAwMTVcdTAwMDU2aLasKvHiWXLmXHUwMDAyrIFcdTAwMDHaqamakslBbCpdYl0y5rdOZ9gqXHUwMDEwVfptwOo6t3gsfjyDxetB8fCVKe9d83y9u8Vm0XicukNcdTAwMWPor1Dvmlx1MDAwM1Jtl1x0pIviXHUwMDEwXHUwMDFjXHJcXJryb3DqSeDYXHUwMDE1yqVcYjchXHUwMDFl1um5h1u9Y1x1MDAxZDclSka1gKOM2eadydUtXCJ4ZU1cdTAwMTBcdTAwMDGJrDTe3GZwWVx1MDAxY+DA61x1MDAxNftcdTAwMWNzXHUwMDEwQe5cdG2WbU2LoZwgrP1cdTAwMDHoup6/e6EuQf03XHUwMDE2u91Azuvy6z9p8KMqvUHCxLnSikucJ6fin3ZIXHUwMDBlqz7SY1x1MDAxZjPRr7LqhEiqQ1xuuL0rL+aiki4uXG53vC/XQ1x1MDAwN77ZUo9h83Rv8zwhW7JcdTAwMDRhSDBKZ6sjXHUwMDFjS63K796XXHUwMDFmt3hcblx1MDAwM5WNSlxcoTq5vXtcdTAwMTLn8M8ro9FWXHUwMDA2ZThcdTAwMDRKQ/7QK4Oim1x1MDAwNeWowo0ndXzfLvCKg8fAv2GE1Okm3lx0TOVrQi3rmuh0fZ+H6r3DXHUwMDFmvZVNMFx1MDAxN3ZcdTAwMTNMXHUwMDA1q1AkXHUwMDE5vDi3buZSpcTo9SAlXjRII07OgVx1MDAxNoOem5j8dKhgsv1vtFxcxsbFXFyXtNOrrPRcdTAwMDRi8yNChWD/lSxx1EN6PMZcblx1MDAwZn/RXGJ7zFZcdTAwMWGXr4JNmI08iYo/uVWMJNXUXHKajSHR1Fx1MDAxN+aN749kreiKRoqhctlVqsS2eOdzoefgiVRd6SOTwiqbSIvvZmU/71x1MDAxOGK60MGvol9Ax1x1MDAxNy6r2j76J5tcdTAwMTh6eGW5KMt7y2lKYFwiMbzreenmyX5cdTAwMTDIZ1rUJWpcdTAwMTYv/jbt0NhcdTAwMTKAqrbzVrecQ3ROyn1cdTAwMTBAyNDWe3vz7/r99qVcdTAwMDFccq74yf5cdTAwMDTlXHUwMDFkUyFKxo7ZgVx1MDAwYiBCcLcvL+2rWDl6+1x1MDAwZe63XHUwMDFhziBovOT6YM0kskRKLO9znNXuzm3fz9MwXHUwMDA2YLjb9lRwodx/P7hcdTAwMGW9XHUwMDA1Zlx1MDAwNGlxQcZcdTAwMDDGyVJcdTAwMTMxPnhHhVwinjfgtOnBnlxyXHUwMDBlaEhl+NmnXHUwMDFldXBlc5ipX1x1MDAxMFxuwtNDi0qzkOeSyJqlg2RcdTAwMDRcdTAwMWRcdTAwMTQoXHUwMDEzifGiT+BcdTAwMTTfMrlY85SBtVhcdTAwMThfeXJVcVx1MDAxMlx1MDAwMSmSXFyTMd9cdTAwMTSdQjlcdTAwMTB0qJOyqZaI98LNXHUwMDEw4fBcYvRcdTAwMTFe9mHqjsqucMboXHUwMDFmfCXqQylyjqvOmLhcdTAwMTdLYlx1MDAwMcArc3ZYXHUwMDA2s1xiLCXr0CmK9Fx1MDAxOcRiszhcZlG4qlTtXHUwMDFhXHUwMDEzSn1Ha7SMufx75+59jLZp994pf3xY1euHpbsl79x56UBcdTAwMDeaVZJ612tcdTAwMDRIn1x1MDAxY8S8z3PEjz5dYC1+XHUwMDAxO7ZcdTAwMTNcdTAwMGZNvX/rs6OhPbzYYHpb2uzYYF5JmHByqZpMmuMxOEHp8KavbiZ3Pd69XHUwMDFliUk86VCHcXWTXHUwMDFi/bFcdOLcuVx1MDAxNFx1MDAxMY3vqyj7QmD9t4V+ktZI4NbXdHJu+efUuqhZgi187Vck0VxmVZPevvpUeI6FX7XrrNDItKe8SlCni7H9YdT14lx1MDAxNkqT84NXOpZBvvOMX2dcdTAwMTmHQ1x1MDAwNc8ovO9vdFx1MDAxNVx1MDAxZY+npY93zPbmlf6e5Vx1MDAxYaKsxvdcdTAwMDWFXfFcIoHed169XHUwMDEzUFaCf9S7LbMm9++iMPKh87Js8Vcsaz8r9lqYWsZNnnqZyXHrSInbYPbSLlx1MDAxNWPgqCe357xcbpdai6zjjViQPFRcdTAwMWUqJKoqXHUwMDEx5vzh53HhlTdYMy/Kfkvb/S7qKlBcdTAwMDaMik/yhUHzI16quFx1MDAxOIKsulx1MDAxOe1YmI3YUpZcdTAwMTDI11x1MDAxOMTkS/tyXHUwMDE1gb+DRGbvg+GDXHUwMDBmXHUwMDE3tMp2J3fkRvQ9XHUwMDE1TLbI6MP572iRobrQsqKvcVeDIbxsclx1MDAxNW9Q+y2DXG5FfYw1w2mt6etvvcg3glqGLFpgvkNYttdliXX1gKu/Z2h2XCL3oTzS9vmF+94n3c5gPKNEq0n+XHUwMDE4enzH6I5j+FxmUlx1MDAwM+4sdk7eXHUwMDAzt1xmgJFcdTAwMTZcdTAwMDPKXHTuNWRN/ZXccWliXHUwMDFlXHUwMDE5jHRQ05mWi4/y6SDDR0nezaKzX+B1XHUwMDA1XG7cPFx1MDAxY/F0OnA57nJcdTAwMDb6t3+vdp+aXHUwMDEyeFx1MDAwM7X6XHUwMDFkjr1ijcqxXHUwMDEw5Fx1MDAwMFx1MDAxOXUtPScuskG9XHJQk7jLVHpdy5KEXCLImD+XkVx1MDAxZFx1MDAxMCUsWzNwj1xupXXIs0pix4a+l/W8XHUwMDEwhMAxmLznXHUwMDAzs4ZPXHUwMDFmjttbXHUwMDAy3lf7eTVcdTAwMWNE4KyxPFLOuLZcYlx1MDAwNnbglWf9iOVzWJ9cdTAwMDe2MFLq+YWftVx1MDAwZXRcdTAwMTFCyq5fXHUwMDBi387eXHUwMDAzXHKfp5JIIFx1MDAwMnFcdTAwMGW8jOy3l7Nw4NhdJCGU8da7uXxOKtKhPIlnXHUwMDBmvspcdTAwMTHNIYiX1Fx1MDAxM9CBsPuiMy6lT7d4q+fviWiSbVx1MDAxZllqMlx1MDAwMlwinKTL5/eEfDIrMVx1MDAwM0NcdTAwMThcIlx1MDAwZlx1MDAxNGuaSLfd6Dg88MmHu0a9MVlcdTAwMTHJ05zt3uNyXHUwMDA0hlhKd7Pj43GFwVhHXHUwMDE5/2TDSZhcdTAwMWWNP3VA+SBlOepcIu/waYpvXHUwMDE5PZL5fWeJS9+Pn7NX3r5cdTAwMDFipVx1MDAxNFd/f1x1MDAxYppn0t9YNfz5PYFcdTAwMDa4IKHfIFx1MDAwNH/Siten2b5kkVIkXHUwMDAw2L7LsdwnysetRSWBcD68h9ErcTtUOyXb+/xcblx1MDAxOcUzyKN/QFVF7pra9ti1vlfywlx1MDAwMMbDNVx1MDAxY2DF+ou3L2XfsultxzyM2Zmfxlx1MDAxZbT2yJtcdTAwMGKG/ffAq1x1MDAwM2MrWXdcdTAwMTXyKYhHXHUwMDAyW1xcYZKQ+Vx1MDAxYZnXXHUwMDEzXHUwMDAz+r4uXVxyzerswas9XHUwMDFhc1x1MDAxOft8XHUwMDE2fVxyIfRHUpr23nFUZ+qo6VtcYmTrKzh1hNTtU/5HXHUwMDE4XHUwMDE2yPf7/mnScX/Hs1x1MDAwYlx1MDAxYkGocNpcYunR737ug4E2XGKwZrErhe305TtUfSS+5Mjdi27Apv741uSLr9BAfynVXHUwMDE3XHLHpa9wXHUwMDA0Vlx1MDAxOKvIlDOOXHUwMDEzhUO+pkDIp0DkoyfV9EmusOHnNY7VStIqXGbqxP9cdTAwMWZL57EkKa9E4Vx1MDAwN2JB4WGJh8JT+Fx1MDAxZN57z9P/9NxbXHUwMDExs+rqiUbKPPlcdTAwMWQhpWhcdTAwMWEjV9JcXPN7fqVcdTAwMDRcdTAwMDfB50Go4LVrOPYqOdCLQspcdTAwMDRfWk9ptVRwv6RzmURcdTAwMGW0yFW+tnD3wVCqh1x1MDAxM63npdedw8ZkXHUwMDA1XHTXXHUwMDE38ym+869MtXcyM9iKbv9nZORkie0m6lb1jSGGoFx1MDAwMFwio7TyZZR3xu1jhJTOeZpcdTAwMThOLFPMQFx1MDAwN6Zq+bXZTD7UR0e8XFxcdTAwMTLn87xb/avGtznta6KTmck0V5V/XeYlKsk0sFHsUTRUT6pHN4pwuJatqC+SiCVIXHUwMDAxYmzJLIqnapNyUfXalorkUPTFdYSSYvhYMJ99/2qZuuDmQ1x1MDAxOSMqXGa5IOd840rSh4axy2P81vShKZZcdTAwMThOotfXRmMpcSBaUVxyXHUwMDBmlEblzum9bllcIvzKa8jd9J9XYndpcq6FJHrPXe9r2C65dajXUzS4KTeQuVZcdTAwMTA1iFx1MDAwNrjg4OZnSI6cUn16XHUwMDE3tSpcdTAwMGXZjNXOSklY25f2yl193PThhJBCX4vxvSWT8cpWKlx1MDAxZntS2PHpulx1MDAxZFx1MDAwYoOz4ovPzOKL3Hfqy9lg6jBgZ7Y4kyYmXHUwMDBiyCFcdTAwMWJfYqqXjvh38Vx0ecTw1rw6z6jJtuuz/rUq+Fx1MDAxNK5mYiVcdTAwMDZRtPly2zzjXHUwMDA3Zsw7xsZcdTAwMWVYyK1cdTAwMWV5ps/sXHUwMDE520vsvlSSQlx1MDAxYXZxR+xcdTAwMGbpTOijW1x1MDAxYUo354rkqeojeWv0Z1PDNlx1MDAwMsBcdTAwMTP8JNuIbEpK9Or4cFOt5KTPmOo5abLw+d31bVa/8F9IwzPxyCbS/PhcdTAwMDNvKb63mKH3P2hoY8FcdTAwMGa5XHUwMDE4O7yGPog7XHUwMDBl2XlfZZdcdTAwMDGkXHUwMDFk8cnn2i6lXHUwMDFiikjj36Qm4+6T15D9Tt+Hp7+FfvE8NTt1XFxlKTVcZun1XHUwMDEyJVA6XHUwMDE1Kr+VXFzBhIzBkXxcdTAwMTLrmlx1MDAxNE/8032Hp9vBh1x1MDAwZStcdTAwMTHTt2hQOvRcdTAwMWN65tvmsOOy+/nOYFx1MDAxNthcdTAwMWaD9oBhWGbFmTBytyzl+qLmXHUwMDE3einmeEV86P/W94s6zkmXM5Tgblx1MDAxY8iTyXCjubmmLct5NTxUd/6c53K9bVJKXGInz1x1MDAxNFx1MDAwMmWsR1xm1qQq3Vx1MDAwN6iw8HsxXFxugTOAjTNeotFbhVx1MDAxZGNj5YtcdTAwMTjIXHUwMDAyxGJMXHUwMDE3mTFcblxie/xk+92/kfq3vzV6v/edsd28yii6StO+bstcdTAwMWJcdTAwMGZqlcC3jqPWQlxuJrevyig91Tl6XHUwMDFmolx1MDAxOVx1MDAwNmPqQnnjXHUwMDE5iVx1MDAxOHPRTkNcdTAwMGXAnVlIcIZnXHUwMDA3XHUwMDE37oeYpuhBO1x1MDAwMpLC0ZQmQW7DsThcdTAwMDNY1PTzocJwautcdTAwMDY8XHUwMDE2JWlWqFx1MDAxY0xxXHUwMDE0XHUwMDFmXHUwMDA2XHSTroybqe3fXsb9XHUwMDA3N6xFPoPtRPzHxDjbXsmS3o1huF8jrkXsKMhcdFknLy7LiLeESX25KItcdTAwMDWbSig0hUKsgVx1MDAxY1x1MDAxZlx1MDAwMPsmRCZccprgX0a4RFx1MDAwZt2gP4H7vYZfLCtcdTAwMTRBxd7Pklx1MDAxYXz2yLxcdTAwMTDPf7HnJGZkVmuVbWL25ZH4XHUwMDE4nFx1MDAwYntpV1x1MDAxOCmhw1x1MDAwM1x1MDAxYmfl81x0lVx1MDAwZVx1MDAxNqxCtHBcZkForv/2K1x1MDAxN4xGITGswU6E7FrEwtZ09thtQZ1ccmo+1mmGwl1gpCnES+StX1+QcX5+5kX0fHLhXHKyZFxmVZ94XG5Lhvdj3HPAVVx1MDAxMoSvMdT6oXlBOlx0os9cdTAwMWSYu0o9uJvwKshT914mlvjyrWTAT19MJM6sXHUwMDAyrTbIXHUwMDA0XGaSa31cdTAwMWWykLhw/VLwbzFrhahcYotR/VBQacu/PDQkv3WTJnWydl5K3Fxid9GBmKJcdTAwMWJu/u4h9/82q1lcdTAwMTj7dyVz5YtcdTAwMTFEWLfX+ZRcXGNGVez0XUnOoTxPs6h15DRcdTAwMTlsZ2VKpU2Mz/A5h1x1MDAwMkjZocv1Y1x1MDAwM4WT3I27OtJcdTAwMWZg723Uu0Dn+mRBYLdcdTAwMWZcdTAwMTLAXUfgLpQ0zEZnloQxgkRi0JNcdTAwMTCc0qlD+53UXHUwMDA3oJQuWTRcIrdcdTAwMDIwRy62yfqdITPdRHIzXHUwMDEyRC9cdTAwMDC4upnZXHUwMDA0bVx1MDAxZVx1MDAxY8Y+XHUwMDFm4Vx1MDAxYVxmtTbOYcF+I3lcdTAwMTeqqPJr6o7N3lxylj65R0SAJVx1MDAxOG+VySqujYA26IrKjtpcdTAwMTVClIxcdTAwMGZEvjPGZlGc52OBQqyydFx1MDAxNoA08Orrc3/GdVtI0n4z/vPp/I/36D+1SVx1MDAwNN0mLGj+rVr14eHqzM85brFLd5TdauzEPVjZjvBcdTAwMTFcdTAwMWX72srzLPt724mfSzOBaVx1MDAxMz5cdTAwMGLPVnRwVNKViO2kXHUwMDFi3DFwRjt//eflUXxYMkZcdTAwMTRN5DVcdTAwMDPiV4I8iKK6LN6DfF2R0lx1MDAxOTWKe0R61lx1MDAxMmA4XGKQwpXJx4t099U4VVx1MDAwNlx1MDAwMvl4jENLsO/qXHUwMDE1sUP7XHUwMDAxnIT4rb/vXHUwMDE4zlZcZm6v1eGn6SBR/5f0fUcjWVx1MDAxMmCarVx1MDAxNvhr0tNcdTAwMWWK1Ii5va9K/dRJuFx1MDAxYmZ7SPBrZlx1MDAxNVhcdTAwMTFcdTAwMDT+XHUwMDEyL7aaT0otl2rvlrCUJHlcdTAwMWRcdTAwMTUuYZZZZj+1JNNcdTAwMTWTZNr2XZaNRepcdTAwMTFIXtK8eNdcdTAwMDI83lKOrOBdwH9dXHUwMDE1PcaDoFW91Fx1MDAxNb0pNU+ER8RcdTAwMTgt2kbvkDMh37A6PtDX7Za+xjiYyNNcdTAwMTUogTQnUlx1MDAxYVx1MDAxNsXV2vy+2lx1MDAwN3HDXHUwMDAzJm5M64tcYtuVO80367VcdTAwMWL2km+50DmZ/E7tKcU8XHJLmeX73d+aSzN4pihkbmHE/aOcXHUwMDAyy4298bBQZaPnZX5cdTAwMTlt+Vx1MDAxOVx1MDAxZnb3O1x1MDAwZVx1MDAxZJRcdTAwMTJcdNRW0U2RdaiLXHUwMDFlk7FPx+lcdTAwMTWU5CdcdTAwMWXfXHUwMDEwb3qWVLBcdTAwMDHUfeBoiLdezlxmXHUwMDE5ybuNXFxCXHUwMDEzXHUwMDAwLlx1MDAwM2V599hKaO9VxFx1MDAwMsA2IFxmmFxugI2sjsjlxenO11x1MDAxYzMzwVDezVx1MDAwN77N/+iKJFx1MDAwNeP9VqLQWrbw+lx1MDAwMObZ5ePu+Fx1MDAwMCWvXHUwMDEy5WOJhuHNUrx+/OMjunt3q+HrWXg7XHUwMDEywXaHOVx1MDAxM7ZpPmDFiVx1MDAwN5+I4JCzO1x1MDAxZOkzXHUwMDA25lx1MDAwMeokd5Uoc2F6c3BcYmNcdTAwMTRjhFx1MDAxYpdAqTmbYHrHhdJfXHJcdTAwMGaCLYlhuVFcdTAwMDDhi11CzEGDoeOM/lxcTb1PXFxZUMjA0lx1MDAxNVx1MDAwNcZNPnLQyWch/q0jJDQyI46iZ7LT5qz13zt431+DyEBcciX11teu4Fx1MDAwNlxmNP6i4cdJmaiKXHUwMDEw811aYFx1MDAwZplcdTAwMTDmbGxcXI+jrUHQcI84y/fAJdoh2oBcdTAwMTZcYliA3WnS0iRuuzBMK+1XsoNcdTAwMDJcdTAwMTCoMixcdTAwMDFcdTAwMWa8+neWmVx1MDAwMqTtvnjM0tRq4Y0gbchXr6pcdTAwMGZh2pRvyqNcdTAwMDG6yHyBqyW9rKNpQUKHXHUwMDA2MEjQTVxc+juG5G8tOjhiwVZcdTAwMTA2vFx1MDAxZpKgMJjZr2nR5CZcdTAwMWRPOrFee8AlXHUwMDA0tsDJ5lx1MDAwMOTy+aBcdTAwMTZcdTAwMWSg1KiKXHUwMDBil0aR0DXkatJQbUaMlMaHTfGFlEa672JcdTAwMWaWnC1cZlxyhZ6beZxcYj0hj63M8lx1MDAwMHK+umpFXHUwMDAxXHUwMDAwPlx1MDAwN7fBKOAljX1URpU2XHUwMDFhjHWLvITHrvrB00Gzj/fkxEdcdTAwMGXuQflcdTAwMTRcdTAwMDVcYrwltHZi699+I8jTXCLuWCg4jn+3b+dObf1e0/pcbiyTVSeaKbu37DW9U1x1MDAxYo9fU8dXvFdifnOq7PdXrd83TE/+WqFcdTAwMDFCKcqqXHUwMDEwe4Fzku/59Drzg1x1MDAxOMbaqHeaO9P7/c/2dDqLSPm04MupSeHsNtqNU3Ho/VxuVHOfPDNcdTAwMDWRaMtcdTAwMTe8Ms5nO7M9XHUwMDBlVnGXdfFcdTAwMDeh7SFcdTAwMTNP7uAzm3LHkZmrQJCbxkt97eg2XHUwMDA0YTzTktpCXHUwMDEy4t5JXHUwMDE5XHUwMDE1miPhNtte9+ejXGLJaJbOUXtxzS7WXHUwMDEy5453ppfXI8Z4iKVAYr1myP9o6iN0KjFJoXRzYlx1MDAxZXn7oFx1MDAxNlZcdTAwMWEj2G02+axeXHUwMDE3LKixO0vYueCbsF3JXHUwMDA0ZvVeSciHKlx1MDAwMpskSdBcdTAwMDGLPMdcdTAwMDEnwO4le4VVQDxCf1QgXHUwMDFjKFx1MDAxMIT+eVLY+WSSjfdAQJBcdTAwMDFcdTAwMDA3mdRRXHUwMDE3XHUwMDAzQVx1MDAxNVx1MDAwZvYm+KiLS2og1Vx1MDAxYlx1MDAxNfuHrd9cZlx1MDAxZqxUSNb9XHUwMDFii4bdXCJlTZvgfqHNOKBHmlx1MDAxMFx1MDAxZVJBb01cdTAwMTS/U1x09rX9oUmEc15mZVx1MDAwMbxmXHUwMDEyV8vcx6GN4/1Lzib9XHUwMDE222h6dmmqXHUwMDEwTlx1MDAwMlx1MDAwNux8W4iN9PvFxXu1IVx1MDAxYko1YuCLXFzpv8eqXHUwMDFjZ1x1MDAxY4HUW3YshVl50OxcdTAwMGZfVXLli09YU61IUrPb2Mmfn5yRJjm5+Fx1MDAxMs5cdTAwMTQvXHUwMDBmam+YTOT3meyRktrt7mEl38vQ0CdAn6HYXHUwMDExfkBcdTAwMTBcdTAwMDRcdTAwMDBDSGeU1vRKXHUwMDAwr3pcdTAwMWaKoHL7t0xjXHUwMDA0y1x1MDAwN5c+LPrxMt/dVIBOSeR8XHUwMDBibVx1MDAwMlxcXHUwMDFje/QkXHUwMDAwIV9cdTAwMWQ4/vKzK/20s8dcYoNXv/c4g0Ra5rhzgjR2QF5cdTAwMGJcdTAwMWFtR1x1MDAxN2BnXGL1XHUwMDBlefVsfa3YXGbcXHUwMDFhKLWL34bRXHUwMDAwKUeN6bKXXHUwMDBlzUIjQKtEWdqpZpmVuMZApcWDm3Ho3HJcZk9y3Jo0QP+NXHUwMDE5glx1MDAwNyxcdTAwMWFWxNjLRvFcdTAwMWF7+jHdrGimX2JcdCxI55xsXHUwMDAw57Iq6N87n9/l7qlpuNDm+Fxc/VxcenpcdTAwMWXzPN98mpV9uVxmZfa48TNcdCc1elx1MDAwNOx9tYuUXuiART3PqNC7XFyI/LGPlVx1MDAxNoXJfn7TilF99re3dmrdisT+ztHBXHUwMDA3QlBg4Z1d3Ewyxlx1MDAxONBif1x1MDAxZErY7FmsXHUwMDAz6X2mz2vU9N86ss+q7CvL/Vx1MDAxMFLYy/GML+dH9Fx1MDAxYS5cdTAwMWVcdTAwMGKoeZNHdm89nl8zRvi43f1eNsWwOVx1MDAxMlt2XHUwMDEzXCLFouJBOkNUXGZPSUTvwts/bzqSwG87iPhHaq+uXHUwMDFlf+9iXHUwMDA2XHUwMDFm2pJcYtBtVlHVdFfmglx1MDAxZN5QbzUkWVx1MDAxNUM8P5Tranl6XHUwMDE5irJRgHZl/i4kk8540lx1MDAwMy969/mkbmD4f8fcQPla1WZcdTAwMGUpXHUwMDAwUvpP4iOqNNa8f2pcdTAwMWTx/VxifU/EVudcdTAwMTOBUejZ63VcdTAwMWHlmFiok1x1MDAwZTlcdTAwMWVcckhcdTAwMGWRvzArnDjGSYyaLFZ1XHUwMDA1/+9cdTAwMWOhOUFGXHUwMDAxXHUwMDA0cvszQIEpXHUwMDBmQJlj/qCL3LNcdTAwMTfqazj7zn49mJPi0bv8lMbMd/C0Ll//LiV1Lt5cdTAwMWXVVzSqQlxcf2WSp3PH/epTmVZcdTAwMDZcdTAwMDVj+uKZ+MdYilFxVs6/kFx1MDAwZfH7alx1MDAxM/So1T1WZMnoz1Ka1lx1MDAxYfVjXHUwMDAw7TBXyVKbXHUwMDFmXHUwMDE2rnmWt79IXHUwMDAzxFx1MDAxM5dcdTAwMDTA51KH+Fx1MDAwMq2qyUnoWmD34VGGyKNcYoJFk2Cbp1n9Wvu2cI6xz2maIElin9GwI5Re50Wz3Nri7kxcZpmj5MRBXHSs4PdcdTAwMWFcdTAwMGbekZhcXMHk3Vx1MDAxYUQq2jdcdTAwMGJNXHIj9Sie6SS9cnexs+hW2OHE/ztz8S1e971cdTAwMTZcIodcdTAwMTBcdTAwMWLstVx1MDAxMzqWKuVE9qeeZbfqWas2zFqiIeJas3pcdTAwMTbSRJhcdTAwMWGZ9Fx1MDAxZZNEqo0kyjHSXHUwMDBmvLo5iTyb8tZMiGqLfcV2jPFeMNnnN23V31auXHUwMDAxXHUwMDFlvkAr9Chdwk1cdTAwMTBcdTAwMTXmYVx1MDAwMt9mVHlcdTAwMWH9u6W0XHUwMDFiyylcdLlvKqJcdTAwMTAsU1Cg1l4oOFx1MDAxNDpcdTAwMTFnsuG2tLhcdTAwMDJJMthWSuP+XHUwMDFiXHUwMDExuf3Uf6/XkdryXHUwMDFiTmavmGpmwf2m+zXki2SPXHUwMDBiXHUwMDFiiSN9XHUwMDFlUtPFsYXhXHUwMDEym1x1MDAxMX9jQjTzkFx1MDAxNmKtN/ffcW2gXHUwMDA3XHUwMDAwXHUwMDAwb+gzXHUwMDE16VLCJelLXHUwMDFi/jk/f3tBf3/7XHUwMDEyh1tcdTAwMGWlq5xJ11x1MDAxNjCr0uzDorBvrlHqYnFjXHUwMDA2XHUwMDAy3irB0NnUXHUwMDAw4XI56qlJhJay2Vx1MDAxOeDjk7CQlVxiKIY6XHUwMDE5rNqehCbab++AXHKoM4nOX9/QXHUwMDAzUSYuktBRZleI69x7iJ7aKv3ux8XSXHUwMDE5rYzV1c4xhj/uQFx1MDAwNulwUKkgXHUwMDA3+KfaJpw3XHUwMDFmkS1NXHRnW4BgP0doINdI6dOk6cS/9bdcdTAwMWZr30X9unDP6LmaLK/b1oPBXHUwMDE4XHUwMDBlbFdcdTAwMDMzNzFCWVLeXG7hm47NN3Pz74ileOh832BcdTAwMWZcdTAwMGU2XHUwMDFjQYF9XHUwMDFkXHUwMDEzK9hcXEXFwkNGW/3sJ2df1t/1slx1MDAxZVx1MDAxM619f3FHlYtJ8jQ3kGZcdTAwMWWSuVx0/T4lPbda6FLYn59cdTAwMWaC/pxKN1x1MDAxN3yO7H3rXHUwMDA24iBHNqwgXk07IVx1MDAwN9hItrraXHUwMDEz6fgvYM5swyUzbX04R9yi6i3+4teRXHUwMDAx85vaQifhqi1cdTAwMDGo/f3Vyjfk5MXp9HFcdTAwMDZ/8Vx1MDAwMFx1MDAxOdpcdTAwMWM5R5rTkX2L4Vx1MDAwNyhYW1x1MDAwMVx1MDAwMchdnd+28si8foCrbNnrZVNcXKa+9bDfdqGcP/Vwt1x1MDAwMf1bny6O48n+zjmDr3SJXHUwMDFk7N7+r1x1MDAwZSrBM0NDlHbEP7NDNfE3ssFGtm5+XHUwMDAwYz6ec7dxYSFCXGLwQdhwkFx1MDAxYlxmOId6qPf8jtI1Vf7Opkq0n2tqXHUwMDFjlupcdTAwMWVcYkzyXHUwMDE2hS5RXn5QXHUwMDFh7Nz63/nWhOJ1dK/eedehXHUwMDBiz+ZdXHUwMDFlU1xyXHUwMDFmI05cdTAwMDbPXHUwMDE4nKb7/1mTMfRcdTAwMDCgwP42VVx1MDAwMFsmSlRcdTAwMTiqdzmfpiB9XHUwMDE5/CNSnPZcdTAwMDJlpUX4XGaFoUCCKCk8UU1B8yZcdTAwMTFwVf2+zeVipU66hdmI8l66Revm1up9uFulJFx1MDAxYVx1MDAxNY08XeBcYq9ZXHUwMDE0VUatgdGkyFx1MDAxY95GuqeRfZm7voTuXHUwMDBm7aZCdJ4gsT/ow4XkyP6aXHUwMDFhXHUwMDAzTpz1ffSVqKCsXHUwMDFkRCGtPDBr1i9cdTAwMDWpb/ah0UqrS1x1MDAxY6DgxyjXpIuepv7+kC1xMbdQ/62FpjpcdTAwMTHCRkVcdTAwMWLFcufmmEJGXG7YLIS7YNDTh65OVr4q6olqXHUwMDE3XHUwMDE1clSb63csdl9nnsxfwld6XHUwMDFhYkB4omhmXHUwMDAwdZ6/rPF3tt3oMOhDXGb6iFx1MDAxZHSuXHUwMDBi73SaLUN6XHUwMDAwyEWt29JthJ9IXHUwMDE5SI/wY4TiXFyISH1TRsJyXyjMoDLeObxsNjFC7Mh6XHUwMDE23PFBLmm2NzDZSj+hflx1MDAxZFx1MDAwMJTW1k5sn8yJV0RcdTAwMTeB1lx1MDAwN7kwqEhcdTAwMDMyXHUwMDE0/7OeXFytxJj3i6JcdTAwMDJcdTAwMDLV00CfXHUwMDFj3ohcZvxWsVx1MDAxYVri8EXvhVx1MDAxNPN76LlPoDFDPVnmUSZqvVx1MDAxY2d6Vlx1MDAxZlxyY5xavPkz8js1xZ6NXHUwMDEwKfpcdTAwMDPYPXVOomqX9Fx1MDAwZsqPb/V3zpD5pFVcIjgnxs6gkd3Oqlxmj3OetIZcdTAwMWKu0HaonVx1MDAxNq7zxvCw4sZcYmPV3ulcdTAwMGWyZmBzoaCTIMQj4sVcboat80WTdtBcdTAwMDDkcGQ/NJ/JY1x1MDAxN2iK8Hxo01ab/t6kd1bxvD6PXHUwMDA02ENaXHUwMDEz8fq8vlx1MDAwMFx1MDAxOXyfJVfjXHUwMDAwe6qf64o8XHUwMDE2Zb8gbO2WXHUwMDAzRGeLpNGx17DfpSy8YMFu0DNf7uWUrPNMpVfM5fO9vcNMuMr6fdlqpn7+XHUwMDEycIB01n/9XGY0bYR1rCtB1bh841wibS2JRvTUKdpnclx1MDAxOWLcXHUwMDE0+lx1MDAxMn5AfJTPOu1cdTAwMDVcdTAwMWWTXHUwMDAxPTmTRHVTXHUwMDEzNC6kp2j9YO1cdTAwMTNtylx1MDAxYmpvXvK5eyhcIlD66jXmreW9XHUwMDE2VPEvpie0QVx1MDAwNM1Olz1cdTAwMTRjVNhcdTAwMTjYZOGWOf9V4oKcZ+POyV9cdTAwMWaJtJ62ZNvhJ+x/KbkhI+5mh8aglldwIVugz06DJPVcIoew1mLquVx1MDAxMyN4XG56q1x1MDAxMXKhy2t2anw4vrGS/KZy1lx1MDAxNppvrY+AXHUwMDE3p4XYwKKGdVwiXHUwMDBl50Ougq3UzC73TETpm3LY/ZRVleRq5mFcdTAwMWTVXHUwMDE0vVx1MDAwMchTpU/vLDnkuKBW1lx1MDAwN85cdTAwMGJj1I7m8vXr+lx1MDAwMMZg/ORWoM7T8lxmo7X5XHUwMDA3cU8qOIR+SVx1MDAwMtWBo0xLvs0s75/OWlx1MDAxYWBqcnP4eFx1MDAxZVx1MDAwNY72XHUwMDFjPSOEW2dwXHUwMDE2XHUwMDA3XHUwMDAyQVx1MDAxN1xcXHUwMDAw/Ou9c9uFt19cImB0cnTdmbDz31x1MDAxOX6Vr9pcdTAwMDPXXlO60nLWWDv+XHUwMDFjh9rXJpRcdTAwMDGT30vpgkKMvJvYgnxoUcVrijKs2pIjJZxetZPtZKnZWCtcdTAwMDMuOpjfh9f0dVx1MDAxMcnvsTFoRrywRenabPhcdTAwMTi8I1x1MDAwNOmJxvFW/VrA5WmDrKfxhVpcdTAwMTEx6Hc8Pt21tZp/hZwyUurvuO6q9K7EXGbDitnH6v+qUMG4WMVcdTAwMTdLI8Xx2Lc1XHUwMDAz+qlcdTAwMGVcdTAwMDfpXHUwMDA1pvejdlx1MDAxMFx1MDAwNPe5NlUkmVx1MDAwZYPsREaSRDiBMLBcdTAwMThcco5VpSWTqt5bXUj50kegOpdox36teHFiXHUwMDBmgVx1MDAwM4OTuSHFhiQhRKhcdTAwMDS7OU9737Xr8EKdaFx1MDAxYaZcdTAwMTC4XGYwYkgogoR9cmT+KcN/fVKCs2VRolx1MDAwNeWEwWQnh1x1MDAxMEy9p1xmXHIhYlx1MDAwNNLnXHUwMDE0oYRcdTAwMTVcdTAwMTlByu1T25UqcUFZzr9oU8dcdTAwMDWHn6BcdTAwMDb21faLXHUwMDExXCLBToFUoaNlv3FcdTAwMTF2K3Q+pb9Fyb1E+YxGpP1xXG6V2U1cdTAwMWPO1Mo/PVx1MDAxNnL13W+vkFx1MDAxM+u58HyiurDJvq3QlYh+4PRcdE+ULtNcdTAwMDVBeHrVLKVuWlo/XHUwMDA3vasgXHUwMDBic0jElInj9Fx1MDAxYrpB1H+Byr5cdTAwMTLlXHUwMDE37CSJXHUwMDA0kTQwMVF9c0NcdTAwMTRcdTAwMDSgMVxmgPpcdTAwMTBsXHUwMDFmjniHnU5t2IQ2j5b6ykz38Ts5wZp1el1aU9nTby66iVRcdTAwMGJcdTAwMWNMzSV6+WqbXHUwMDExejd77e99RYC3XHUwMDAxn0mUWWVdWFhcdTAwMDWf8Vx1MDAwNWBW9GjKgzKy/oj4eFx1MDAwMVPWc8AhgOqfes2/LH38XHUwMDAwLlx1MDAwMEDPwr6d1GtcdTAwMTmQq0FcdTAwMDOPXHUwMDFhRZ1GcvNcdTAwMTHVNKbT38rMXHUwMDEx3Fx1MDAwNcCb1kXlPdlVI3HOd49cdTAwMGa41Vx1MDAwMPspXHUwMDAz7/XdOEcmf4FF8SMl1vJuXGKDXHUwMDAwwy9cdTAwMTGdhFx1MDAxNYxz77PXjfL+Jlx1MDAwNJtcdTAwMGaPw5Bm5tKNvKTYJz6yNzlDXHUwMDEwRCy5tiw4Jlx1MDAxNMXMRvJaXHUwMDBiXHUwMDEyXHUwMDBiXCJpulx1MDAwNNGZKFx1MDAxMPJcdTAwMGWain1do1BcdTAwMDBKXHUwMDFk5lwinaJccsCAeSHcXHUwMDA0XHUwMDAxJfuTNS1FXCLJXHUwMDA0VepP/JZcdTAwMWZcdTAwMDUoXCK6zk5Ck1Fl0LqWrIXo/Fx1MDAwZVxiZ87bPqbZyC1p/Vx1MDAxYSVdXG5xVr6Th1xi3pLd4zLjjuNYgeLGSeFcdTAwMWTaROFeQkunloBOTSpljLHTXHUwMDE5gmdcdTAwMTJcdFx1MDAxNYtFXHUwMDE0n1x1MDAxZn2Wlo9cdTAwMTbV6JtcYlx1MDAxMTwn7a01fM8lR/56XHUwMDE4dX9bXHUwMDA3wDObui+viCs6XHK6KnhqxE3ez1x1MDAwNKCzO751blxmvymnpndcdTAwMTS5eDWEQ2acXHJcdTAwMWTGVTjGyHTG7ZwwY3JcdTAwMTbNQFx1MDAwNbRcdTAwMGXVmppcdTAwMDJcboVcdTAwMTfQXHUwMDBiXHUwMDE2XHUwMDA2wY9cdTAwMTnfnrqMt0Dtf+rynNY0XHUwMDAyRTI1PiVUnplcdTAwMDHYM1x1MDAwMZRcdTAwMTHcVHRWduK3xlx1MDAxYr06/Nazisx1iIrPj1xuQeBcdTAwMWWFzClcdTAwMTRcdTAwMTFcdTAwMDZcdTAwMDB9j79cdTAwMWZcIjbA/EhcdJ1cdTAwMDZHb22ZYCDA21x0LVx1MDAwZSW71u1pXHUwMDEyJFtlbKfUOZliXHUwMDA28lx1MDAwMs+b2Y0/J7FcdTAwMTW/SlwieVJcdTAwMDZcdTAwMThcdTAwMDRIglx1MDAxNlxcaT5AXHUwMDA04rZcdTAwMTWYwac3M4mipUK3onX7XCKmkVx1MDAxOeekVFcwXHQpm3M44qabnYNcdTAwMDHCMvmXdHm7VmOL/8lriUlcdTAwMDBcdTAwMTTC50Few7P/XcskXCKk/GlcdTAwMTlJKCCan7+lz8hX4Xwsbo98aSP/Ln5YXHUwMDFkc1x1MDAwMFFcdTAwMDBhhFI9JFx1MDAxZDLRa/1+82h0rsE/1lx1MDAxMn+Mupk/ypVcYo1DnH1cdTAwMDe3r1x1MDAxZn//XHUwMDAxaVx1MDAxMIB4XHUwMDBic2AzXHUwMDFhXGJn+eNuOd9cdTAwMGb2MY1cdTAwMWZN1p7aNZVQXHUwMDEy9W9cdTAwMDLaXHUwMDE2XHUwMDE3hJpcdTAwMTm4nLnpXHUwMDE3XG6OXHUwMDBlpXhcdTAwMTBCxJBgX4g5XHUwMDFlZnSfQjCedI/0/Vx1MDAwMCH4wpNcdTAwMWZMrYTxfs1eZyxcdTAwMTbYVElzhNlcdTAwMTdi6z9PI5FT715cbvNi4Fx1MDAxN9Rw+Zi9XHUwMDA3NHTGXHUwMDFiR7dWN9Xy/7wnpa4vPGtcdTAwMTWqe/iy8zxm4oxcdTAwMDCZQFLTXHUwMDFjXGZlkbVcZvBcdTAwMDYgLlx1MDAxONe7Oz6QZovgYySc8nNwSdwkvS14bkBaMEk6woJcdTAwMDJN5CU65yRCvF/fmvNyXHUwMDFmomLOz1x1MDAxMeX3dppcXFx1MDAwMz18XHUwMDAxJ/Qu+lxyW55YQ1FKe1x1MDAxNFxiXHUwMDAzXHUwMDFkXHUwMDFjXk3ux9+wM4ud0z1cdTAwMTCPRLWDIzRcdTAwMGXyrqe6UacpiV0j8zyf+XWD2++WQr9BhlFw7EC0QUVx81xcR4hcdTAwMWTf99q2L7zS/cN3xWzALvYwWLXZfbxcdTAwMDX0Z1xmiUVirqpAqFwioFx1MDAwME/71to5XHUwMDFje8tgXCJGXHUwMDE3XHUwMDAwijj1XHUwMDBmgkKBWLY4tE9sYsFndDKlMjf9XHUwMDBlg1xmQGFccnhqvt7Oz/CD3/L9peeruknlu1ucXHUwMDE3fD6uXHUwMDE1Lj5cdTAwMTFyidyeM4HUckGT35pRNlt3fu1cdTAwMGXCwHOaTNj6LV7fPVx1MDAxYt7FsoXmXG7GkFx02cVTXHUwMDBljdJzy1biomM9oj5G6ahcdTAwMWO7Z/qmdjZvXHUwMDFlY9DUXCJ2hkZMZu/OXHUwMDE2eoVcdTAwMGJ8ln2H+ebSaa5kJLG1XTJ5Pp92n45cdTAwMDTJbm837FxiM4ZYsvwntWCamNhjdcCX435mvPSIXCJcbojmdfh+SJskheunXHUwMDAw80pyXqtcdTAwMTS8VIVUXHUwMDE1ZqdcdTAwMTUk6oX4kjt5XHUwMDEwVFx1MDAxMXJcdTAwMGZ4v4zFXHUwMDE3UFx1MDAwMPYoluNcdTAwMWNdUsBcdTAwMTFcdTAwMDWQMeYyvLyeqSMr9PKg+Vx1MDAxOW3F8f1cdTAwMTCHK8uxU1x1MDAwNN6CXFxcdTAwMWHEZiNJKVPYpLBDMEdveSmxUa01ipOJRn/QIX3n0D+kRl5TS2TIXHUwMDE5ZnSe0Vx1MDAwZr39PrZ8/s3paVx1MDAwNp1w8VxiuyxIx+xcdTAwMDNhkzzMS51cdTAwMTCYXHUwMDFhYXxLLI1cdTAwMWXF6JCHrejW6Fx1MDAwNOolXHUwMDEx/1x1MDAxM66ugj3D3c2Hdcet4qZT/kTfX9Oeo1x1MDAxZKBWoyPQ7oBcdTAwMTj2NT9gToFcdTAwMDOK5mY+pvuV8/knkKlojaPgbvXRXHUwMDFlXHUwMDAy8ZxcdTAwMDGXTMGKP6hcdTAwMTLIzH1cdFx1MDAxMM3tgFwihbPhr1x1MDAxZtClRupzL7uU0GNcdOTVx7tcdTAwMTcxaLt5JztHMW+NXHUwMDE3XG5MYbCE7DHEXHUwMDBmiVx1MDAxN9uvn8VWMmJtgfXURu0hZ35/qaHGXHUwMDBl0MWE5q054NeufpOHcbZcbuPV0FVcdTAwMTJzjPWJQa3gNs8+XHUwMDFhXHUwMDE5zzXU1bhcdTAwMGUj3Vx1MDAwMcfsb+45jH6qiNlBXHUwMDBiWaPSXHUwMDAxSVx1MDAwNYaahaHLRdDkeV7Y3yhL0a5cbvF+WVx1MDAwNqNEXHUwMDA1kKvwqVttT1x1MDAwNJWCjSOMXHUwMDBmMp/LXHUwMDAw+ypfJEVcYrwgiGU3paEpab9glGhcdTAwMDKSrlQ9W6P2N/TTwoND7vZ+a8s+xzVwXHUwMDEwL1x1MDAxNVx1MDAxMtJNyIfCIZP6PSTnXHUwMDE5XCJcZr24zFf9MchcdTAwMDe0XG6rO2W3XHUwMDEwZjHBku2MkY2qX5qrXGbTsXWlXaqLi21cdTAwMTnr+Vx1MDAwYlx1MDAwNFx06uCTxFauNcbVh428fvz311xiLlx1MDAxNU5cdTAwMWXVXHUwMDA1XHUwMDEyz1x1MDAwMjd9XHUwMDA20S9CdzaIb895Re6R4/FiXHUwMDFi27HB31x1MDAxOVwilUTTVsDVqlx0XHUwMDE2J9RI7sxVdlx1MDAxYYah71tE6vB5P6ZBaq5cdTAwMTKKWrG/z4NcdTAwMGVtj6CjXHUwMDFjMYxap1BbN01eQFx1MDAxMImXiOx1MyBcdTAwMTM63651WHaniTY3gjRIuVew2Vx1MDAxZtC9LPFVvYpYXGal0Fx1MDAxY1x1MDAxMC1Mvrhcclx1MDAwMj4+RyFjdlx1MDAxMq1q8z3MmX1KSlx1MDAwMjpcdTAwMWFM9lRFkFx1MDAxM5NE7vTl0PDoaMyvXHUwMDBmwzDFXHUwMDE3MPGpkNFdXHUwMDE5jFpR9u1KbVclnFxiVlx0zlx1MDAxMabjk+JcdTAwMGZrJFBcdTAwMGX0M1x1MDAxMFx1MDAxM1x1MDAxMydcdTAwMDPqt7thbE18SIhbbXiQunr1pLtcbppcciskpJinncZ6+VuFeutcdTAwMDVF7N5yITFGTt9nXHUwMDE5XHUwMDE49P477/WhXHUwMDFlbL0rXHUwMDBlQUbrsVx1MDAxN2g+q67EIFx1MDAxMFwiXG5ZcFx1MDAxNObabJIr8lxc079RWJNvPJF3XHUwMDBiZZvWXHUwMDFm/e+cp9ZP8H5VXHUwMDFhbrfJXGYmsus42HpcdTAwMTPaS8zti1Zcclx1MDAxM1x1MDAxMOovQ1nZlLB/PkrI1Hg17Xz+1JFcclx1MDAwMLcrYzH0+1x1MDAxMMze01x1MDAxZr7ijFx1MDAxZmVcdTAwMGbDvWZqubpe34lysi6/1M8v8XdQ89zH2meHXHUwMDA3+GcokFx1MDAxMrpcImCH1SCRhUvHXHUwMDBlflLwt1Pxmz+P4cHIITP/+j6lpKa//sFn9phw5fmaXHUwMDAzmpdgIzaNZFx1MDAxZbtcdTAwMWbcz/TrwrFRs0Y29PmhNG/fh9EqXHUwMDEyXHUwMDE2XHUwMDA2ILp7hPI6uVx1MDAxZakuz7k02Vx1MDAwMlx1MDAwNJ8hMzia/uUqx5CHXHTESvHdgav466NcdTAwMDRcdTAwMDYwdSz237ayQc8/Xj01ba1ccmdiXHUwMDFh+bl/5rG4Vr93my540UFcdTAwMWEoxGQ8blp19m9vXHUwMDE3cVxcgu3ifNJcdTAwMThfYP5cdTAwMDJ0oYOC38VcdTAwMTZeudO33Tb/m9qRSEzuntqXXHUwMDE0jrBssiaCxio7n3PlOFejaK9AV90v28dcdTAwMTFZzvE8pfFcdTAwMTBcdTAwMDatRo1xxklB1Fx1MDAwMWmJtIXdpGroSc8uXYREgMiBNICQclx1MDAxOL7h91x1MDAxYr84pGn2r4etzXhK83iK2Vx1MDAwN1xc69A0tvytvW/OXHUwMDFidFxu8DVIqnJOUVx1MDAxYpDA9y1cXMYpdn46g2JcdTAwMWQmOz1cdTAwMTRcdTAwMTdcdTAwMDJcdTAwMDPCXHUwMDExSEdufNxqfjVe2CySlUNXkiTR22ExqEK+jsJcdTAwMWI6oWaY++Ar8/lcbvrf3tb1a3xcdTAwMGK17mxcdHQ/nrhcdTAwMTFYwmZN1uedt0R/e5RNeVx1MDAwZl1Hclx1MDAxM8kmqNm0RmpcdTAwMTUroVx1MDAxYdIqXHUwMDA03uLq/ET6RWpxNlx1MDAxY+Hy75LKYPfxlefRXG64S6zpqKWzJ8kslJEx51x1MDAwND2U7tHvaonm99lcdTAwMDWuof1cdTAwMDLv0Oir+0iMYc6RMMhcIptrOMF4z1ZcdTAwMWXbTGEuycV9f+5GVlx1MDAxYp7s0qlJ/XUqVavyV6Kvpz/eckPEJkFcdTAwMDKhgV2Ui+FcXKp/a1x1MDAwMI9cdTAwMGJAkNpcdTAwMWMojn411zpOXHUwMDBmkKIoM978v/6QQzlISC0yh9SLpP1cdTAwMDWXSa9cXO71XHUwMDAwUyZMpamTX1x1MDAxMSlcdTAwMGIj1uy6kJy57n/o5zUk2fa3JNze6pJWn1xu/H1eTVx1MDAxMnVcdTAwMDLZnENeWnrqmMuCuYzZooNcdTAwMTOy5Mc7slxigZsrXHUwMDEwq25tIJi4gFPKPtZcdTAwMTL3XHUwMDFhfLokmDpzo246MqlcdTAwMTAskp5WcG5cYm2RozI1e1o5c9t5oPEnqvSvXHUwMDFkq2pmNShQpS+2XHUwMDFiXHUwMDE3LN3NvNsotcT+Kpsyc1tzXHUwMDFikWSyKijK+eHOJOZccnLCm+wh0Cw4Yt71zzhcdTAwMDD9XHUwMDFkgjNVXHLwNdk0yOUsZuYsau6FnIfmXHUwMDEz/bVcdTAwMWZS8cDBPeDr/IJcdTAwMDF5aHf6cJ/rQ3KiXCLxy/JDXHUwMDA0pfLF7/tcdTAwMGKiV2BcdMXZUmqQl22LdDNxN/jvXHUwMDAya6xvg4PbVyOVr6NcdTAwMWJKoSFcdTAwMDe5s3BK12L6YGKA6kBXX8X2x5RdspV7VGIv2yVQqlx1MDAxNlx1MDAwNObn/3uPgEVCXHUwMDFheTdz7qJU7Px2/3DST0lXxfEu9CB7N1xim/9GXHUwMDE3KyWWSTlcdDa9nP6Cd4OyWGtcdTAwMDLlXHUwMDE5NOabQTuS2GCRpidJUTrDvdmSXHUwMDExWeWkXCLmXHUwMDExXHUwMDA0MZc36d6mm1xiR0rSa1xc0OHdQOZuSM76q/LxZo5d/+JqQ9tcdTAwMTeyRfbBtbRcdTAwMTKdNZMmxq9tP93MXHUwMDFlmvl370tfLMEnXHUwMDBmMixcdTAwMWaaXHUwMDEwm1x1MDAwZqFW6WGV1nFyLcxB2PeZ9YYqRplAsbKYMPP+XFxZ69YgmzdgXHUwMDAyX/lZo1x1MDAxZlx1MDAxMDPlNydNm219TW6kVdWPSi8vNDrwflty+CGDhjQ59166zXZ0bNG9T0lQ2XLGzi56abVqtUNI1iHoj8dE46zRuqhZcY3KsN5YuJZcdTAwMTJO0rHri1x1MDAxYlx1MDAxMopcdTAwMTHIUcRU40JcItNcdTAwMGbkXHUwMDAxbVuemFx1MDAxNGlcZt1Udj/ReVx1MDAxMEgwkVx1MDAxNyGBXG5JVttm4NiFXHUwMDFlhGRSXHUwMDA1XHUwMDFkzpzjaeMhXHUwMDFhOldRh9pcdTAwMTJcdTAwMDLJ2s+Pr1xubE6r88Dv4Vx1MDAxNOdE2Jm00L6CXb51wMs5rvaLJ+Tyk7FQn+RNzVx1MDAwZSE9U2zGzGzwNqB7xqTfWVx1MDAwNz5vfXPWXHUwMDFlrCl6Y5sgobXltFx1MDAxNFS7Q6JcdTAwMGZKXHUwMDE0Mo2/XHUwMDE2xDtHNb4tXHUwMDE0VFx1MDAwMoS9sfQoYCrxqW3469koy/diXHSQXHUwMDEy6adLpVx1MDAxZlx0XHUwMDA1Z9YmjfrUNWOx6VLH3b2iXYGUIaFcdTAwMGYqPvre1OdcdTAwMTj1qp9cdTAwMWE6fIrcMHRdXHUwMDA0c1MxtSv9QmuBPC/5aXlNU/JcdTAwMTVt9GoxmMouKJ/wnTD9XHUwMDFhTH3A9vFcdTAwMDUjY9NcdTAwMDX8fkRgtWbeqlx1MDAwZnwlXHUwMDAwZFx1MDAwM5Mvf1x1MDAxZEb2997de8vx5Fjg4i1cdTAwMDBZsE2ZTNv2XHUwMDBlK4JQKepIQHGKsvrFruTiTV5cdTAwMTc+O3dyXHUwMDFmqUUruPJR4Vx1MDAxNLJcdTAwMTgsvvDvXHUwMDE1rfJ0XHUwMDBlVqRcdTAwMDfDZCCeXHUwMDA1XHUwMDE34IvzJpeLT1x1MDAwN1x1MDAwYv7GUlx1MDAwMsdcdTAwMGaau8dGY7/Kj3HJqDZs7j9O+3ltbVx1MDAwNYp/x1x1MDAwNlx1MDAxMvMyzOvKzpe/45C5sc2SolIkIOblXCLp8mrI14Pl16CSXHUwMDEze1x1MDAxOVx1MDAwMVx1MDAxMohjI+p+LdOnXHUwMDE4sreiMtSBITVcYtMwy5J/rc02jnttz1x1MDAxYVx03ITz9FapqVx1MDAxZi/yduWb+LOyvehxNr0/+NPQRk8uXFzYmd/8To47QPX3XHTII/hcIiVP/uJcdTAwMTRouV9lLVx1MDAwZb3naSRdl2/QXHJcIr9cXLktrv9dW1CPpl/0c38vjN6NLTfqlGWv7LdtgZO0lZLluHxcdTAwMDRKO7zJs2QqXHUwMDE5XHUwMDEyi8tA71x0l0eYXHUwMDBi+ZZcdTAwMWYuXHUwMDBia0Ff+WvQXHUwMDE2rHvU908s/lpQbVx1MDAwNbRpXHUwMDBla1x1MDAxNFF5dya3dLZcdTAwMTVhSFuL40Wi9vmNsFWx0ZrC5pNVe45cZnJcblx1MDAxN0g4N7P9wWVgLlx1MDAxZVwifI5cZli9XHUwMDFj5Hbz72jY6zPXw/CES9UxvrRJqJ5f4uJsfsOQLEdcdTAwMWG2eX/GZGolXHUwMDA2ZCw41Vx1MDAwNiNcdTAwMTj/+sejd38tf4SMiX+WnmyZ9lx1MDAwN030v1x1MDAxZapXcJ+qQVx1MDAxML3KtcWdt1x1MDAxZdNxw/6cclxyLFx1MDAxYVxyZn43yVry+yHK6lx1MDAwMy3z+dnjSFxuullcdTAwMDOJXHUwMDFh1KLlXHUwMDFizG+nXHUwMDAz4NA9S2hf+Tn3PpioXHSMxkYrSGe49Zej7ETiXHUwMDE4Wmq6hDbYJoN/MnZcbpVIweBn8srNKe5iOis6XGZcYqG+cuCzLVx0kPz1XHUwMDE0hHK9MVx1MDAwZXpJlZmowMBKQutNXqa5XHUwMDA1o8p0VmXr/vWBKcmh9KHg+zNcbufWXHUwMDE37UqyI/tUnvHJ1N+5UySGXHUwMDFjL6Q9XHUwMDExhvmkXFxA9+D75Vx1MDAxOFx1MDAxZIVHpneaNkfZ0VBl89eXQtFymHFXoiq1KPvDUHKq83LxdCYjZTMzT09O2zWBQO0nllk6gakhXHTLcilcdTAwMTIvQFx1MDAxNiFcZlx1MDAxNyyRXHJ6XHRCVnC+jr/CJEuWXHUwMDBiPYDcap/JuiY5d/D9WFx1MDAwMcInoG/4XHUwMDEyXHUwMDE5X41MXHKKVOfyqS+gXHUwMDBiKXyNn74wkzNcdTAwMDe3qZnguqLF+S1cdTAwMWGQhb7G4FxcRn9GXHQuTVx1MDAxMn9bU1HN1lx1MDAxYuT92WG3fE0ws4AoKnCdmtP4uWFHsEPl/LvuVXee3NrwZ/uQ4Vfs4zadXHUwMDE4efJWw8fORlx1MDAwN87zg3yYblx1MDAxOFxmsTXrq5WkIL+K8PXaRlx0v/ZKesBcdTAwMWRjTPD6UYCVlscyLIVcdTAwMTgn0GHI/a2FKSV/6e+0K1mDMihwXHUwMDEwXHUwMDAweFxiU6eGv9BcdTAwMWF4XGJQgVx1MDAxZT534lx0iJvx1lx1MDAwNSpEXHUwMDEzOFx1MDAxMlXUXHUwMDEwXHUwMDFjotUsXHUwMDFhisQ4ra9cdTAwMTMrvctEt/fq8+djM8NyXHUwMDE2dvO1XHUwMDE2imZEaiXtbUbEXHUwMDA381pKL+0z1LMusU1ZxvBDzjNiXHK9meKkK/lcdTAwMTn3pyi3L/ZcdTAwMDL/7qEmWlx0y7dcZkBDeVx1MDAwYunmvnpgOFx1MDAxNtdmp31+2rdAK9RcdTAwMWPDXGIhXoG4Rnr68Smne0NcdISw+dW0sIS1XHUwMDEx4/2YXHUwMDE2f0M8x4TC6HbqXFzDaDiN0lugsddvbF0vL9uDqVx1MDAwM29WLVxuiUJDX+uv/FFcdTAwMDDgXHUwMDA3+IaAhE7NaFx1MDAxYWvO1y2cI3+nx8jnU+nEXHUwMDBiMZhdlc3r0YxcdTAwMWWd0D+dv1JcdHF/rt5bXHUwMDA0qVx1MDAwZs9cdTAwMDaOSWHFU5lcdTAwMTPkWVxmXHUwMDAwXHUwMDFkfFpRyTNfriZcdTAwMTmD7Ji/XHUwMDFhc7k2ZUxfp6lk25f9u6LgZa63iMMm+FHSarNNh3o5XHUwMDA11cxNR1x1MDAxZO1P11x1MDAwMqZcdTAwMThcdTAwMTItXHUwMDA3bahjXHR661x1MDAxZZBzyMVcdTAwMTXjp/vGeqqhlF6xtpG78njfj+Xhbz10rkW0iVx1MDAxMlxuhKfp/b35wqBiZDbH48QojFvJhSDHZ2NFrm9ybZVFYqRMXHUwMDAxS92zklx1MDAwZuDck1dcdTAwMWakk3JcbmVIONR8JlGe5Gfab3xcdTAwMWU08NeXvIVM8mmOI5NcdTAwMTRlXHUwMDA2XHUwMDA33ss+0SmZzDbg+cGeM6JRVMTUQcLOQkA5KHPH8kJ4oDgy5moykVx1MDAwN2Pm8dZcdTAwMWXWtDohqFCbOoVcdTAwMTT3XGbn9S6aXHUwMDExkFO1XHRNP67R14G7Uj1bXHUwMDBlPNyLa3k+XHUwMDEzXnqOXHT27lwi+mtfXHUwMDE0cSDHXHUwMDAzXHUwMDBiicqxe8/JXHKMMFx1MDAwZlx1MDAxZIDmlsUjccevZVxciDJcbsFHLviO0TT8nN1EhrJMe+Fe+DyeRX7ur1x1MDAwN1T27HEqr+HYefhC72GNUFx1MDAxZS1nmEGAXHUwMDAwXHUwMDE0elxyXHUwMDAz+uLDMydvrKB0XfWJ7iavccyLYpu/9Vx1MDAwZb7wfchcXGjuXHUwMDFjmLNp4OXGcC8hSFx1MDAwM1xcJtynWT61a7FcdTAwMTJcdTAwMTBLXHUwMDExLVxmlp/+sGhVgWKGWk08gVxuXlAtu19cdTAwMGX6XHUwMDAxoEvLXHUwMDE12H108HXaL3+JPDuu9VfCSl/kiqWhv4NcItl+POqFXHUwMDAwuVx1MDAxZFx1MDAwYlx1MDAwZoVcIknX6OCvcyi36IsxVD8oy2tcdTAwMGauoV+Ll1x1MDAwYjN1P7qmXHUwMDEytzdejl26XHUwMDAwXHUwMDE0/vJpXHUwMDEyaVx1MDAxN2FXfkFTi1Ll5qBCcYlZ2PpFOidUgLilz5FBR+7E9qi/ULyOPslXx4gvtkpcdC6ESSMjMqBcdTAwMDZBsG+tXHUwMDBiSvc1XHUwMDFmXHUwMDA0pFx1MDAxNUFysmw1SGtcdTAwMGWCXHUwMDAwWDiNXHUwMDA0XHUwMDAyIbGAYNGOLVNOxVxczVx1MDAwYq1gsUs5fzs2vVx1MDAxODlcdTAwMWMgsItcdTAwMTIuSNi3bjbalVOqXHUwMDAxXHUwMDE2kcpcInhgXutcdTAwMTiiw8EkzpPturpJy2ZcdTAwMDD3k2BGXFxcdTAwMTTNXzj0L+XTcYKI/+1xN1x1MDAwMfJYX8t+vFaURrLoXHUwMDE4XHUwMDBlvmBEJmJccvo05YK2+lx1MDAwNm0/20bveo9cdTAwMTX3nlx1MDAwN/VZa1x1MDAxNMR/XHUwMDA1VHqr5Yu1ybqJ1lxcqdjHoSy89ZdETaf+XG5tYFxu4nLkrr6//dX/TfzdPNlcXN05XHUwMDBlmoV399jVg1NcdTAwMDJvg4M05cNcdTAwMTnsVUbym1x1MDAxYjvb1ktbuGA2uTl3v8V7/VpPXHUwMDE5XHUwMDEwkMRsXHUwMDFkR/z+9oSSzcyFb9kn9P5cdFTj/Sk3RkBYcNxOfiyjWE2aROkuymA8c9H5X9962bCCXHUwMDBi0lx1MDAwM7yeok6tjGBhdlx1MDAwNo2uN1x0z1x1MDAxMaNiXbhsLS4s2Fwi/3ql79KBXHUwMDEw7ciKXHUwMDBicHeISVx1MDAxNHdcXJtn9050qYS25PhcIlxm3uaCJ4eAkWZccqNNXG5cXGd1p7iTn8hcdTAwMDB9zlx1MDAwNUKMJKkgMlxcSHtV9vFcdTAwMDJcYlxiYLRE9ygusyXbOcZ1ud76XHUwMDAyr6lcdTAwMDU7SHCBXHUwMDE46uJcdTAwMGZXWjlcdTAwMDHzs0vnN46yPODwv1OxXHUwMDEyu5XRXHUwMDFmeOFcdTAwMWU8KjTpTnKSV1x1MDAxMPhNnY9tdPWu71x1MDAxOcFcdTAwMWIoQCFhcaY3XHUwMDEx1t+R/uSpdvVaXHUwMDBiJvNcdTAwMTLWXHTenUuFayh9ofQq1Vxc+tG5cmKffvnFrZ11gVx1MDAxNpicpldv3epcdTAwMDWH/ck3cei8MS23kTNKT73Me6Rp/7ftdntCXHUwMDAzp/CTgO7GWGGBw1x1MDAxMPxoXHUwMDE3WV2VULo4ZVxu8LSevfyN5MOgnyP8yfyXl+eaT1hVYVx1MDAxYi2ArVvBoTxn/rrMe8b1mGsqp4NcdTAwMDHKsoHJXHUwMDA2dfImVVx1MDAwMmhw/Va8p6dcdTAwMGZ/jVx1MDAwNpluZHzDQC/W96r+XHUwMDEyx3lcclx1MDAxOT2hlDlQwOf2fZvyXHUwMDE58cTaXHUwMDE5b82QzlHUpZlcdNKAq5LD51x1MDAwNnP3eyhrXHUwMDFmqGbDTJ/ZNi9cXLlS+L5N/zMr1W+RhUn29JM/uDntcdXNp9ClzfolXHUwMDE2TVR/L2x4btWCmTezKTlAPn99eFAwYVxm2OeFhVxi+vY16VxiWKfBJKn64Fx1MDAxMldBt1tcclx1MDAwMCGm4Fxim1LT9Ko+eGq9ZVx1MDAwZrOjrCxcdTAwMWTy2K1UPFx1MDAxM2km9HDikOa/M6XIVoIgQY3wcP1A3HSljlx1MDAwMFhcYllWcE98lFx1MDAxOUzV2I+vyOGKxZezNFx1MDAxYVxm9/VukITOY1x1MDAxNoCO/Xz0XHUwMDBlJkF6NzAhUuVd6Fx1MDAwYlwi65Mz5H/Q7L+K+Fx1MDAxNZmOp2uxIPyfilx1MDAwM5TSXHUwMDA3S7y1zFx1MDAxOFCLz1xc/lx1MDAwM7xOW3Rl2/h7d5PbJYtivKouTVx0/nmb435cdTAwMTHwNlx1MDAwNC7mNFx1MDAxMWWT8dmEolx1MDAxM1x1MDAwYlx1MDAwNDXB5KwvbH6xpLw8XCKVZFplycx0IeNHXHUwMDFifM5/UqrtPVx1MDAxNvFA9yyDdNI4jFx1MDAwMlx1MDAwZYfU6qNgJsu5XHUwMDFhXHUwMDFl9qiFJIZcdTAwMWP8farpNkPXtL/5T7RTwtdwj5g3xpVDoOZvrmrA39++/5tcdTAwMTSucsdcdTAwMDO1cVxiolx1MDAxNLRxiVx1MDAxNVx1MDAxZVx1MDAxY0ZFqaxcdTAwMTSfXHUwMDEwUVx1MDAxMzq/QFpoOFxmITFcdTAwMWHE5rLSbn9cdTAwMDWXlO1EKVx1MDAwZftcdTAwMTL7KTdf4K1NRGUznm6Sn0mGiJbWaoCvbbp4cFXqyDEtX5UtXHRT1Vx1MDAxM4lcdTAwMTElXHUwMDAxddp6e0aFObqJ3s1cdTAwMTdjVlx1MDAwNb03fzEr+u9w8nRKzegxIys/i179tCT8XqYzXHUwMDFixdGtktrRXHKZc5zl0sHf/SeAZXhXNmnl763f4Fxmdq/661x1MDAxMlx1MDAxMkjz9FwijNFcYlx1MDAxNFx1MDAwNHmvJYgotjBcdTAwMDaOt3vJ9IPieCWHoiDkc0FcYsJcdTAwMGJZ4EFcdTAwMWN7PCWg3vc0VJFX2Mff3mNcdTAwMGZcdFx1MDAxMLxKlSph6Vx1MDAxNNbwocDmXHUwMDAyXHUwMDAxQX+ULvBLKUv6SuU6XHUwMDAywjOiwlx1MDAwZVFTq9SHXHUwMDFjXHUwMDE4sFx1MDAwYoDKqc1RiPy2tFxmmvycZcpnXHUwMDBmnlfvsZiEV+ZcdTAwMTDHXHUwMDA00vuLXHUwMDFmKOmoXHJcdTAwMDPsQ8VYpjQn5jNcdTAwMTDoSKpkk5dcdTAwMGIw3Zz18zSd/WXP2cA2M4pHespwQXA/XFzawK9wXGaY+Xr/9ynPompt1NtWXHUwMDEzhuXoue9w9Vx1MDAxNY6I4e3AITZccqN4cEdcYlx1MDAxNVJcdTAwMDLO2VxcQsSgYY0kXHUwMDEyc555PTuJXHUwMDA2y7HnJCmiv1ioZUDPX7axyeCizeo8m/GcVOI56Vx1MDAwMymZXHUwMDA3KDtcYsPvtC/RLmgv2FnCmDO6PLJcdTAwMGVAskcg72+p7FvqdaGzXHUwMDBmwFtcdTAwMTFsRNyM8CuuMIdcdTAwMDFcdKtBakzTXHUwMDFhQ39oXHUwMDA0lEXeltlcdPKGjVx1MDAxM/PGKGn0N6cyjbHGlYtbpb/FNv3Yrkiy18jQMlS7/Kd42F1qxPIp1Vx1MDAxMU41WLlybqdx9fCSo6Z9XHUwMDEz2OZcdTAwMDRcdFx1MDAxN2nWS1x1MDAxOKFcdTAwMTFY9NlmxYvnNcDn0M5TrvTF8XjcrjOqQadi1Vx1MDAxNX/vKaq/3VhcdTAwMDeOfzvs8eo6NVx1MDAxZmWHO0HjXHUwMDAzXHUwMDFlws+Jy2shULzCtJlfKsAte6lDR7dy9qhcYjyTXG7KTVx1MDAxYy5cdL51XHLCXHUwMDFkSU93v1wiqMjP0ytB7JnfKFZoXGI0pL9cct3D311K1ZBcdTAwMWPIXHUwMDBlt3prfyRGeEC7emkznzSRUFxmXHUwMDE0Pez6UfNajFx1MDAxY1a+i1x1MDAxOaRzVixK3cTN77zRQ+X9vKNHgFx1MDAxMqLgI1x1MDAxOYDgMOaJkLlcdCtaRiol6lx1MDAwNFx1MDAxZpaO+fL6gENDyPKKcaWhzCqSvDqWc7xz60JcdTAwMTByN9IyclR81kLQMVx1MDAwNrE0MFx1MDAxOPicS5hQOZ6agPBJ+HnPkMNleqRcdTAwMDG5XHT8vkpcdTAwMDe/8UJcdTAwMTVY+7qC4Hf+gkogJ1x1MDAwYoCyKNhcdTAwMGImg4gwdSQm9HFcdTAwMTasP+DOWnOc5fdySfFBg4xcdF9cdTAwMDKCXHUwMDE431x1MDAwNFx1MDAxNzLNXHUwMDEwz677hXxR/dQyjry8guGffdP5YYzPgM9cdTAwMDBwvWxvXHUwMDFhelx1MDAxMEiiXHUwMDEwQuZFXHUwMDBmuFx1MDAwM+7+y8VccpdcdTAwMDFE+rNXOJFo+lBzpFx1MDAwM5NcdTAwMWRxt+M42l5yMFx1MDAxMlCducdjOZtcdNmQXHRhU2pne0SKwNDmNGtVXHUwMDFkn0J+2Fx1MDAxY4T0XHSXJF9cdTAwMTPKXHUwMDA21UHyNWQnXHUwMDFmINCKzMAkayv5SVxujnn9Sryc72Cr9Vx1MDAxN51R6raZvDBrq8KuUF9X9UjFjKWLXkhcdTAwMTN2ZIawVKQzgrXs+cjPLiGvi7F1neSYb1x1MDAxYjpcdTAwMWUlLvvtXHUwMDE25Fx1MDAxMe259FuXLmaP9DjbQtWK0pat2vtIwFx1MDAxMXewSIP5tHxJoJDNjchcdTAwMTH5kXNDvpNS8IX8TaKior9cdTAwMTj0XHUwMDEzXHUwMDBlnnXUp8yuXHUwMDBlXHRF8pnRxKc/iMOk3WvHIDrEkE/9XHUwMDEym+dBWMRHwoXQZ2ZcdTAwMDRcblx1MDAxZlxmz2Xny4hL7KpcdTAwMTQ148T+MJEpQ/ZIsm3ShZLp1LlzJHQtru2/e9k5KnhcdTAwMWTSXHUwMDBitc1cdTAwMWWSXHUwMDFhXG6BXHUwMDBiXHUwMDAxXHUwMDAwoFx1MDAwZrMkxlx1MDAwMVx1MDAwNSmVzZFhp+7+jFD06Lxccl7MXHUwMDA0P3Uuxbk9wOVHzrDw22MsKMJSxVx1MDAwYozd4Uc/fHjtXHUwMDE1f2Y29IGqLsZcdTAwMDaV/WljXHUwMDEwtsp0XHUwMDFjK+pcdTAwMDZ9vbAy6GTDZ1x1MDAxMFx1MDAwNmC119DO3VCU29/p2qVw7HHpVzSSsiVMOVx1MDAwMNtPTCVcdCWJvtOrviDnddXaeD/lP8a+Y2lSbUtvrqdQ3CmKXHUwMDAwXHUwMDEy31xuXHLw3iaQwFxm7yHxRqF3XHUwMDE3eaTue+q2XHUwMDA2+qOoqPrTwN57rc9g1vpoVda0NWpcdTAwMGWw15NcdTAwMWUswrYr6sCOXHScXHUwMDA1sFx1MDAwZj5cdTAwMTHlQVRRcldedN44KVxmWm253juRlS8l87ukXGJcdTAwMDegy46QZnczxnNo5v7YsVaj7jauflx1MDAxOG6lcl0lXHUwMDEy8y6vpp2KWr7ml2+rdXFcdTAwMDXyrZpcdTAwMWM70cnHseiQnU9UuUswq8JUqt3W1X5NXHUwMDE2pHxRb+hjJNNcdTAwMWHjTYpcdTAwMDQ7dmjwolx1MDAxZMiDq0j7u1x1MDAwN1x0mJNcdTAwMWOhXHUwMDAwjKtcdTAwMGWs4qNcdTAwMGKCKvf4XHUwMDEw4rZq8OfsYtohQMBx3FlUm7eRhFx0/ShcdTAwMTDam0uBTFx1MDAwNFx1MDAxZCOISDtcIo+zsUPQXHUwMDAxtLUqp/Kxa4cgzFx1MDAxNMSD5lx1MDAxMVx1MDAxNvC3IK7oIVx0VMTz+Vx1MDAwZlx1MDAwNemKj0Xv76SwQqe3ktRcdTAwMDP9XHUwMDA13+d21bdcdTAwMWV00sZcdTAwMTJ7XHUwMDE1LnIv9JD4+nnlZWjEIa2eMERWW3TTbIK+XHUwMDExs6xqUyVbXHUwMDBmpFx1MDAwMWUxL+Jt8ycraWyfzlx1MDAxZFx1MDAwYn+Z8kOXKJNTXHUwMDE2YdYnXHUwMDFleFxiZlx1MDAxYnerXHUwMDAw+ZkyV2hAhfiFYFx1MDAwMse2K+xFsrVwMsCBXHUwMDA3rc6TNFx1MDAxOUa5RtNE51x0XHUwMDAystVcdTAwMTRkU+VTXnI8jH9DYJbPXHUwMDFlKr88+HhcdTAwMTnd4Y1cdTAwMDNcdFx0JJIgXHLZoNeF68jlXHUwMDFkxLbukio38+F4ty5cdTAwMDVcdTAwMGVcdTAwMWaV6MWUoGHwXHUwMDE0TTa6lamvK/hI+KGlgsyixCBQzPK7XGZaTDW5ZK7Oblx1MDAwM+owaYxcdTAwMTS15XOV7qRfsPlcXCNtamjEvlQmq1x1MDAwN6kkXHUwMDAzkrjg7rjv5NE7g1x1MDAwMH4gWFx1MDAwZYv4Q+0g7Fx1MDAxOG5cbpHUeCdwy6DS47ks71Nxa4PLLeZcdTAwMTboJVxcXFxaozRzvlx1MDAwNFx1MDAxOXVjXn1x36XHOU/FtXmNX5Pze46IVt27j0ntwsvyXHUwMDE5I1x1MDAxNmWFOzLnrlx1MDAxNlx1MDAwNFx1MDAxZVx1MDAwNCtcXMBY4Vx1MDAxOfZl3VDqXHUwMDBiWUpuXHUwMDFmLXEoXHUwMDAwjMnpXHUwMDFknlx1MDAxOeTy6DuXhk9cdTAwMTDMXHUwMDFkZFx1MDAxZbT1ht8lRk2CtMGe4ZrgQMpE0nt33/mPvU1cdTAwMWJ0sLVcdTAwMDZwXHUwMDAxP1x1MDAwZka+z2aTer3FNKTLkDm/+0G/slRHXHRoTuDI4Cu+MltcdTAwMWUuLS2PXHUwMDFm78xcdTAwMDQ9zFx1MDAwZohcdTAwMWPoR1xu41x1MDAxNdWiXHUwMDA1XG6W1XfpZJyLLVh42WdyqfI7Y/TwxsGRZ2orXHUwMDE4mqpyfvdpLlxco5NC81xiXHUwMDAxrE2kX139c4FcdTAwMDSsI75cXCmgj1x1MDAxYVLagKa3z/hccu1NZodcdTAwMTCvlK2Gp1je9C5cdTAwMWZHsGPSq+9cdTAwMGZV9Fx1MDAwMo/B8GfQ7df9Qmi2yp7Hrj2eTcmNSZ97tFx1MDAxMmFcXCCOOVCUqlxcU42x6TKomORcdTAwMTJyUCVcdTAwMTLTe9ddQt+2XHUwMDA2Z4RcdTAwMWWf71x1MDAxZDiGmlxyXGLjODZOqkhETGRdfsRpXHUwMDE49at33yz8uVx1MDAxYqBa7mOZXHUwMDFlsVx1MDAxZMOQ9mJcdTAwMTAh4zuWaaQyuDk370LeTmH6a9HyPFx1MDAwZfSK78HZSPZcXCT0XHUwMDE3c1vdwrREa1x1MDAwNTI+P4zgeK+W4z+O191HvjBV+JBcdTAwMWFsfsxTdifLiVx1MDAwNeJC3Fx1MDAwM7aJxn+978FFNo94kCOWrdKSir86klx1MDAwMrYtStlcdTAwMDVRnVx1MDAxOVx0l7B1Jz23hUyHL9riXaZccj3+p4v8u+bmKl1whN3ou1x1MDAwNSmoXiPKlVx1MDAxOW3D5N2YXG7gkE5EetYoNZ0lirhcdTAwMGKca1x1MDAwN8PgOu9cdTAwMTIstc5S8miJQc9IXHUwMDEyPVx1MDAxZS56fVx1MDAwYu4tXHUwMDEzg9x+XFxwXHUwMDA2M9kzbi6QPtLoyFx1MDAxYyZtbYTObeLAXHUwMDAxseW2qSdHrP9qSCGS1F6KWFxuI4LtViSBeSSPoXdcdTAwMTEvs2PsoGk+WC82QCTy8SNJNlx1MDAxOVfCyzXQvVx1MDAxMfVcbinI5SAuVuyU0mLLXHUwMDBlXGZJbrG2h3lEXVx1MDAwNi+5lnDQXHUwMDE1jVx1MDAwMJ/ZsUM5gUhrN5jQXHUwMDBmI99cdTAwMDEviFfAWJD5Qe2HjDbx0Fx1MDAxYVx1MDAwMT6PI/9cdTAwMTVcdTAwMDHNwOWRlMJXOkmGXHUwMDFks1xymrjh0e6DvMtmIZtcdTAwMDYqPfrnwTtO4lx1MDAxMFVCb89FNL5cZlZhR9owcEufXUNq456dzyj4ZYpossBYXHUwMDBmXHUwMDEw13E8Y1GnMVx1MDAwN6rH2knPIN7H96OwysQ9gd9cdTAwMWMg6MUy9rLZjMOsUlx1MDAwNM1tlE/uhHBMvpT+anKkXtWkm8gpXCJcdTAwMTKPLXlRXCLhwSNAXHUwMDBmyVx1MDAxZV6BpeZEs/ojf62GmoVkx0BEu28hWVx1MDAxONpMP1x1MDAwMn00df9cYnbu9FFWMuqTQ99h+HrDJXT0OFx1MDAxMFx1MDAwNqfMKVxyI/1cdTAwMWFWl01cdTAwMTBcbvdOklCxXHUwMDA1XtQ00jlM0SiOQq5DiYFfXHUwMDA3PeJC1X66hCQ3vvXrUlJfskiTkzgzmNuYXHUwMDBmRyVOKTUttVxmxa3k4lx08KQnht6LJoeXJ7R0hpZcdTAwMDckdJVNmzKTrig+lnr6iPxpxLdhj1x1MDAwMW7ok3hv9fpcdTAwMTZHXHSpl/BcdTAwMDZcdTAwMWWW0GZcdTAwMDJccus8YTtCw84haCBcdTAwMDCUyymSXlx1MDAwMEfJTljSfWHKOrrjWVx1MDAxY0qaUb+hmZYk31x1MDAxZt2HWI49XHUwMDA3k0VMNNm7qVx1MDAwMFx1MDAxZn71sqtcdTAwMDdcZu9k7X6NI61cdTAwMDI3iVxynFx1MDAwNzo3XHUwMDE5kIU5NMyhXHUwMDEwYEbi/eT0+11JcDLT7lx1MDAwYqPpV3xVfrzJl+w111dcIo+94avBKvyE/zZK6ZJCfWFI96CWr6fGVlxmtEfFc8/0i5pOSMNMRarZZSjBm5Nmlae0r5hRXHUwMDE2VVx1MDAxOGizXHTvR9TgL/tccmB8LVxyvjQ4b8OJWmNcYmGzoTdhOs7j3W4hm9r+XG5S8pRih4JcdEFcdTAwMDSzaFx1MDAxOVRmXHUwMDEx31BDm9KG/SrVXHLeJ7mYbVx1MDAwM1bXR5Bhw1x1MDAwN2neXHUwMDAxXHUwMDFku7+LiUm16bJcdTAwMGJdtG5O53mqd6JBmruTlmRG50bCO8OObzNO/Fx1MDAxYWNcdTAwMDLGXHUwMDE2PPtmazqgPODeYqJcdTAwMTC261x1MDAxMFxcP4Y41iwhM15cdTAwMDKl5fByRLNcdTAwMDOq2mr4qMSvNl+3fqRNv6zIl5vcfVKmXHUwMDAzXHUwMDE21lx1MDAxOG/Cf3zN9ZJSXHUwMDA04TZ2XHUwMDA1IFk13lPmazVcdTAwMDbPPMfkjyk7f7FkfonzivQnluQ8u7TmLlx1MDAxNVMo2FRcdTAwMDfoXHLX33s+Oqnrf8aSKIGmfPzgzvjoM1p1S9n8tPj+xaXxgeVQkOZcdTAwMDJZKI9X/nJh2uiPdDtoXHUwMDFmeLH59oFcct04XHUwMDE3MkNeucRcblx1MDAwM3d3+4UupIs9pFx1MDAxMTRcbv9uJVCyeqGAyV7nUuSdLeq6XFx9eiBcdTAwMWIx4WC7lrtRg+FcdTAwMTEgj7KZfXEmz9eN70PDfNBX3mxcdTAwMWY6zStoXHUwMDA2V5/IK2fc2SicJIt4XHUwMDA1t2pRXHUwMDAxXHUwMDFhbd5zXGJPIK2tpVx1MDAxNU/EQ1x1MDAxN7hcbsswXHUwMDA06ULDXGJAsEl6rtizIFx1MDAxZOqvXiSTmDFcdTAwMWWSQL/1XHUwMDA2R+THlU1cdTAwMWVcdTAwMWXpoVNcdTAwMTZ81SGmcVx1MDAxYvNcIlx1MDAwZrxLm48hhnp8XHUwMDFkljpLZ4RTXi9d1+BcdTAwMDai+0N8v1x1MDAxZnyneyCLuY+VbVjC1j2ZuUGqXfTj10QzWlT79Vx1MDAwMlj4XHUwMDAwn5eLiYdcdTAwMDTRI+nzwVaSk9rtXHUwMDE07OTt5EZcdTAwMTVSx4JcdTAwMWRNWyz8ndImkiwpXHUwMDEz4WStWGttfWVcdTAwMTXPZ1TSzlx1MDAxNc/d6bFvWeBTmf7Xs1x1MDAwMNhqyMied1x1MDAwN6MhMZyEPj59O9tcdTAwMTI/XHUwMDExWfCruMJv+8NcdTAwMTdcdTAwMWZcXGYw7yrWlNxrIVxy+58sRs9BaUHx0Xo6+YRox1uDQeJnXHUwMDA1mStXPUbPe0FcdTAwMDYjXedbyn/4f1lzWqKhdE+w2ppccmv5K0NcdTAwMTjZfFx1MDAwYnC3XHUwMDFjUlxiXHUwMDBikkuiQlx1MDAxZl3Kw6EpXHUwMDAzXHUwMDFkVF5MQsTP/bhcdTAwMDJb/J3ytVN8mftQgOfXKdVludB4l9X85j6N2VAme9I0PG0pd0pQXHUwMDFlaCxW+st87YadXHUwMDFlb4CTskFB4Uu81qnWkkb8xP3vVFtpXHUwMDE296hyXHUwMDFhXHUwMDAyXHUwMDAw22ZWdmDBOeKRuDteXHUwMDFjXHUwMDA3XHUwMDEw8ZOFX1JumFxmZ4pmq3Bcbm4/cPewiaP2Jp0uMtrMbCwsxpY6ebW7kf4lXHUwMDFmrtRcdTAwMTf2Xo8hro9ccuXfQFxmOYdcdTAwMTfWPV99aapcXPlKXHUwMDE4hVx1MDAxMUcy1P9u1/eD61xumf80RuQ/XHUwMDE4mO/e5FugWuf6eCiP16VjZOXC53vk7VNb8Nk5s1xyYKVx8M1cdTAwMTSP8UXYt1x1MDAxZLiPOMJcYrbE79+J9OjXKylkvmlcdJTjZ4qXXHUwMDE12a1cdTAwMTZCwfxMSHq/1oE7cCR+I3WO7zdk5iU9z4RF6ohvgnxu35F0SVx1MDAxZOHovZPbwX3wL+bTvOVcdTAwMWRcZmys5ENcdTAwMDRcdTAwMTNcdTAwMWVoXHUwMDAws1x1MDAxZlx1MDAwNf5cbk9cdTAwMDJcdTAwMDW2MVx1MDAwNVx1MDAwMTxcdTAwMThcdTAwMDMpXHUwMDAwVlx1MDAwZumD/s/+r1x1MDAwM2lMxuGPXHUwMDA09+e0QYaeJ+eaQSrvXHUwMDE0LuWjh2dj/moyKK6aXHUwMDAzr8tYXHUwMDFmXTzDh23dbCogPFx1MDAwM2BTOIdcdTAwMDTmPHg1XHUwMDFlXHUwMDFh7rdyoOlcdTAwMDSZ65yftVx1MDAwYjb3k0TmNIWeWZrq4vqLXHUwMDA14L234q8rwdyNXHUwMDFjrlVcdTAwMDHXu1x1MDAwYv5cdTAwMWVlM1x1MDAxNfb3XHUwMDFj4i4n20qpldajXHUwMDBlhFxcIPrgXHUwMDAz4M1LYEw0J0Vyr56c8+iXkNKo2Obv6+Qj7G6ZwpSKqlx1MDAwN5JcdTAwMDA2KunOlDHgRoNZ7Fx1MDAxN7rZ7VdJ9u/ypFxuP9D3XHUwMDE3pFFaXHUwMDE4wsakyarqPYlcdTAwMWZ2S4nhUWmU4nrMI5rk0VCEXHUwMDFheu05h+GxbZc0LWmU4vCC58hcdTAwMGXo81FcIlx1MDAxZWhcdTAwMThBr1x1MDAwZr9cbkVUmE7xor3afpdOXHUwMDE4hlx1MDAxMd+GRFx1MDAxZFx1MDAxZUO3njvkg2c56Vx1MDAxMuJWfN5cbirRrilHzVx1MDAwNFx1MDAwZdrvhNjmXG7B72OKXHUwMDA2kkHBSj9XWlx1MDAxZGLYwnzuyC3YfPKZTsZnXHUwMDFjyNqEOO9yZHZ4SVxuXHTHcS1q2UyQf2dcdTAwMWWGzZZ2XHI5ZVLAsEafwlxySJJH94OaueZuiFx1MDAxY5YjQchFvUBrvmzEXHUwMDExuqiVk1x1MDAxZtJtjiT96lx1MDAxM0acllHwhyVcdTAwMWRNZlx1MDAwZWIvNJhQnIjZfvi3J0mDkkY6jVx1MDAxZuMzJVxmrHijKVx1MDAxYcDnd15cdTAwMTTOLJeEjej43cz6rn5cdTAwMDWqo33tYX28PtdAcGxukPREXHUwMDFi9SqWaN92eOnKXHUwMDFiXG7IpFxmbqnoi7rwSulNZ1GEXHUwMDAwYlPoUejJP/lD0pB3O22e2NC7mCdGXHUwMDA2nlx1MDAwNFx1MDAwNfZFXfbk+Dh2eCMkxaHSyWrq91x1MDAwMUuc8s1f75M8ZO6EJkaH8LxWomn1jY45mFx1MDAwN9TEclqrnuJtiVx1MDAwMNFIXHUwMDFmXGZv2PH8Vo5LuiaTqq98TN1cIvSy4NprbZg+0O+5ejHF0LOBXqRJtp9yT1GngC3auJls8Fx1MDAxMfNYXlx1MDAwMDhcdTAwMTNMXHUwMDE1LWR0UUTdTOJWgVx1MDAxNGDYXHUwMDE4vmVS9SF5+IvIXHUwMDFi50HSW60x4YBYXHS7XHUwMDAw/XuSXHUwMDAwa1afY/pgmoJx6btO7f1LK1x1MDAwM9iC3ePNad6GUaRjXHUwMDA0wpyXcFx1MDAxYT5hhoFjsiSsU1x1MDAwNVx1MDAxOFx1MDAxYU5ZTl3sXHUwMDExZYFZtzSAIaqyY5jT1sdaoG/LfGlcdTAwMDB3vk/Y/Kv2slHNXGawRHDFO6B+d9dAXHUwMDE1hHKqhE1cdTAwMTZmloyjUNrSmN+7V/FcdTAwMTmx0OCuXHUwMDFjxFxcy4X9cMmZzap8XHUwMDE2qc5cdTAwMGL7va6v+VxyZrupO0TNW1x1MDAxZZNq2dV0X0RcIlx1MDAxZUWiXHUwMDA1Llx1MDAxMzVcdTAwMThN2cqLx07iSEpcdTAwMDXpfFx1MDAxNM5I5EiaOIApuq42V3ivXHUwMDFmyHSV9sivW2ucNPBcdTAwMDBQmFx1MDAwMVx1MDAxMmFwjsDO0knkoNRo5/Nl9kp6U3hcdTAwMWIgq2gpWGbi6vJcdTAwMDFXXHSGX2Kmvc+pXHUwMDE4NJJrQVx1MDAwMopccmnI7lx1MDAxNlx1MDAwMIv9+6tzXHLIsIl1+v5VdGVcdTAwMDY+7lTsluSOvFx1MDAxMMFvfE2ZXHUwMDBmU5VBXHUwMDFht1x1MDAxZoYv6lG4Z3CJyvormP7B3/r9OXg/QJGKwXuk7LHwa0N0haRcdTAwMWav4Fx1MDAxYTsny9GSgEau4kK+YZDjhpbFXtPILiQ6Z2+ztVx1MDAwMPJcdTAwMDNcdTAwMDJrXHUwMDAzaGg1XHUwMDBlMriqL8FcdTAwMDVccliq24g/XHUwMDFjiZmzSL1pmM9kKEF4ekteb4SdXHUwMDE1Zifz23h/cnmSpaXry5Q1Utx+MVx1MDAxY2NnJGV8XHUwMDAwqkdvY69cdTAwMTFoXHUwMDAznVhcdTAwMDFGNdbq+Fxml1xc5iA8Mlx1MDAwMGz7dN/4/vX6k1x1MDAwZuZwZNqRPkX4yGd3JIRJXHUwMDEwYilcdFCr3OpjXHUwMDFhN0991GDyWuJcdTAwMGLfrO6EhSEyXHUwMDAyRzlcdTAwMGJcdTAwMWa38tL61XRcdTAwMGYxXcZ7fJJzj0BcdTAwMTNcdTAwMGVcdTAwMDe0ykpcdTAwMTXL5upS2KW+kk1cZjqMyVx1MDAwMYZ8xUmNK0lcdTAwMTC+NMvyXHUwMDFierg5mUSj7Mv1/FxmcuOosnZ0wtGvlpxcdTAwMWb9hM5cclx1MDAxNsgj8jpxPMBcdTAwMDWZX8ROXHUwMDFlXHUwMDA1x3T5P/tlvkeG/jxcdTAwMTRJtY9cdTAwMTaEnMf/qs9cXNl14NjrtCWaQ6VU9K7lXHUwMDEykTpQXHUwMDE2di72l1qE+lx1MDAwMlLjXHUwMDA3flx1MDAxZTXDXlx1MDAwMFx1MDAxOaaxLkYkgaLH3TX2y1hcdTAwMTKf31x1MDAxM3yMWrr7XGImXHUwMDAz624rfZm4wdCHr+9cXCZcdTAwMWIqXHUwMDE56Fx1MDAwMH3UOMT4I0iSXTO+XHUwMDFljXSiy4fTdVx1MDAwMmdcdTAwMTg+8u+HjGiN51x1MDAxZERcdTAwMDL3Pu1NpqCybTagRzP22oU4J1x1MDAxNmRcdTAwMWFcdTAwMWV2t1x1MDAxZpGY3ZSfob+z3e3vYt9fTjPi5nyHkMFdVJpb4uNliF6v9X/tw6zKJGuf6jdAJEH4pMtndsdcdTAwMWKPrFx1MDAwMSTyX7vQKVx1MDAxNmxVJJKsLVx1MDAwNeOr+7/i5kYyTc7i+kRmXHUwMDAzcff+XHUwMDE0QMb5SVGZUZV7JJ9cdTAwMTglXHUwMDA278BcdTAwMTS+hNjQnlTG3GOTdtE4gmFcdTAwMTi8/ElQSFx1MDAwNfXjeLHa1ehcdTAwMWbnV0tcdTAwMTOO4zrfcyqpv5eTmlTSlSEm6ZmoksLBnLo19MtrOVt9XHUwMDE5frUudoTwZ5ikikdAwCBWniGZbHC8XHUwMDA24zWVhvDPvjr/PtaNjzzBj9dPXHUwMDE1fPG8j56sNVxm6rHzxkmGV+za9lSQUdSd71tjm/bR2Fx1MDAwMoOMjNSvVtpcdTAwMDfKe1x1MDAwMqyJVKFccu/e1H1FMoaIpDxX+YyswsvSmZzF57qcsVo+uHP1XHUwMDE3tVx1MDAxNfJnt2fExoyLXXeLV/HEYKdcdTAwMTDhVNFcdTAwMTfHXXmdT1x1MDAxNtb3Llx1MDAxZYrnRKC4XGKATLJcdTAwMGY1vYhcdTAwMTTj5VnCXHUwMDBlmecogvg9T1x0WtKNkiaxXHUwMDE3OUXwlWeRteosf+9b7lx1MDAwYiXMrqXa8PGDXHUwMDBmkvVAiNEjMfhr1UlcdTAwMDDDkkgnXHUwMDExXHQypp7L41x1MDAwNXuXXHJdNy7eso+j5409gqWC+TfrkeFcdTAwMTTisHBcdTAwMTHbXHUwMDA2p1xu3ZyeOCah4lf95Vx1MDAxYV6wztTqXHT1XHUwMDE52lwivCahXHUwMDAxkG+uP+GZfsz3VkpO6b9eIVx1MDAwZu6oXHUwMDFiXHUwMDE4PSmExf7BJpdLh+2D075cdTAwMDHgeW113YxYXHUwMDBlqzpcdTAwMWX0hkjq+bJcdTAwMDPcX0SxXHUwMDBmiylxXHUwMDA0iNdcdTAwMWVFjk3qsfPLx7hjXHUwMDFjP3b6n/rLzy2rVGVcdTAwMTFpglWYsktcdTAwMTVWf7vr/pqdL3G8pIMqXHUwMDFli+nqy/uapzzz3OudvW2Kv76+Lo9cZmRl2trFXiNg7NzvMlx1MDAwMEt3wKlcdTAwMTe2cpmQXHJcdTAwMDFR2USvjJWfvKGp0c0+XVBcZjtsXHUwMDE1vc9BYrdFLSqmXHUwMDEybrhcdTAwMDD1XHUwMDE0zlLVtFE3VLZcdTAwMTdcdTAwMDQ+ilBFXHUwMDAxXGbb+JhzpspTK6S3ry1cdTAwMDdcdTAwMWZ9bz5ZNU/bsM/whFi/i+uD4yRX3YDsJbl/9upcdTAwMTYv9Utr51x1MDAxN8qO21x1MDAwMohcdTAwMGZcdTAwMDVur+H95Vx1MDAwN+21zrH1ZcwvXFzEa1x1MDAwM1FcdTAwMTJNXHUwMDA0cpViZNtazjKu8ck9XG5DjiBcdTAwMWVxUlx1MDAxNEPxg92P+9H8N2f+epshsG/7XHUwMDAxiJDfPkGVtfJQXGLt8WN+WymaXHUwMDAxWMqQiUOZNVxcrFx1MDAxMVx1MDAxNCCfbTm+XHRbhaDcfUp2RTB5T/HRsk7MXVx1MDAwMamI4OBcdTAwMTlcdTAwMDFcdTAwMDayQkVaVcSVqbXev1tcdTAwMDHSXHUwMDFmd1x1MDAxMtSFJFx1MDAxNNhcdTAwMDBgsprEiVP5qGtf4FxuZuja2D/6zD5/jLRMjuNeciTfgyn9dTqgfr7I3ONcdTAwMTe1XHUwMDA3WKBEylx1MDAxM8RfUem9o1x1MDAxZtqjZ3CrVatrfrS/R1xuXHRcdTAwMTOYcLNMw4iCXHUwMDAyXHRzgqdbKfsunGBcdTAwMDQ8fVKjcbPn67uU6Fq30pMlQPJ9XHUwMDEzXHUwMDBl0mE2N1hccpBX31x1MDAwNzOdtIFrLcNcdFx1MDAwMc/J4MxT2Fx1MDAwZmBMfXOjz1x1MDAwZb9e36vvfiFcIltfjyh4hivdOIlcdTAwMDN6XHUwMDAxXCLVW5YuXHUwMDBmhD82XHUwMDFl/r2npUYvbGfr8jF7XGa2Jy+gKJ6FwajDY8cg79KuvWdhXHUwMDE1XHUwMDEx4mKZXGKbenY5iDJX7LQl+5VTm1x1MDAxN27eXHUwMDA2dnf+3NDzXHUwMDBljIrBdNyrXHUwMDA0MnwuTZLdLHR4W++4t2P2Llx1MDAxZPFDrYmDQOeW4jH6u3e4O9wuXHUwMDBiXHUwMDA0XFycXHUwMDE0N91RIVx1MDAxOeJEvXA9d3Ay5m5s/YpP5P7mXHUwMDE0wn599sL22bGUXHUwMDAxYF7k+a/3dFx1MDAwZVx1MDAxNPdgUWSz70xcdTAwMDVQt/pA5N+wRyzflT2KS5KhXHUwMDA3wbhcdTAwMDRcdTAwMDbhmXb/noVATlKtYlSpPPnW0m2qXHUwMDEwnYGrXHUwMDA0glx1MDAwMGg2mytcdTAwMTk3XHUwMDE1s8wsZyFcdTAwMDW+XHUwMDA0l2k3qFHHK0mYtFePeW8oyvWO9mpksmigXHRcdTAwMDX8pdJpQuNudZS1XHUwMDFjTWqEkSxbV5eA3STCXHUwMDFk86lHyGt8KGSKqP6FfMCEmoRcdTAwMWaeXHUwMDAy5Fx1MDAwMy8xkiwvS/qV4CBegPHk4cUo3uf/0WuVddjvk+8kttFcdTAwMDZSXHUwMDAwKYYo45FcdTAwMThcdTAwMDChPun3oq7cvexfZ/CxP3PrXHUwMDE0W1x1MDAxYbOl+nhPJvFcdTAwMTJ0KW5gPFx1MDAxOaZcdTAwMDK6+lx1MDAwYk6DVqJcdTAwMWWTy072csXCq/G9WPCqocqOsFx1MDAwM0Z3mD+fT+FsXHUwMDEyz/nhXHUwMDE3XHUwMDA2niyUdo0x1fRi5KZcdTAwMDGkSrfeXHUwMDAwntSFo77ufvmuqJ+T0G0jjSzqXHUwMDFhYXHfjJudXHUwMDE3tVx1MDAxMrCWrO6jfcCi2F5zMFx1MDAxYuDzbztcdTAwMDWAR+d+l8/b2+zBnZ+A/FuPy5KtS9V8sGbo0+69XHUwMDA2TrfGnykuXG6QwOCLipbN7Vx1MDAxZu33cVx1MDAxMiHkWKn5cFPGbW3kXHUwMDA3Mlx1MDAwNd9IXVx1MDAxMqEn4lx1MDAwYsO8jvXXI3F+f5dcdMZcdTAwMGVcdTAwMWVjk3tGv+pEvDxcdTAwMDRJQO5bXHUwMDE2v2dcZjPXgzlbRueetphcXEfvXG7PhymtubpGiY5E1Vx1MDAwNIFcdTAwMWavxEJcdTAwMDA1s+1EKOvVLcbVLl3rPVx1MDAxYrm9XHUwMDE1/sryV1x1MDAxMj0piFjWvi/2j0KCvTnstFx1MDAxMFx1MDAwNFx1MDAwMFx1MDAwNZnWYf7gR/5x21x1MDAxZVtcdTAwMDZcdTAwMDJcIk18ksxl9fO+plx1MDAwNVxc14VcdTAwMTN5XHUwMDE2L59cdTAwMGawT3FcdTAwMWZcdOgunK1Xt++6xplDoFxidcCVzvHFZpi45tV53aAqsMJBsS0mX/hztFxcdPM4nmFzZlx1MDAxZv7rK8W8gp07Jpw302pGJIm80bmk8CRxjHDPaN7zYqLdXHUwMDAxS1x1MDAwMfme6GbYT1xuXHUwMDA2za+lZFL2yjZcIv31XHSfMVxux6eOXGKGfV1TyLLA85ghl62JPv6q5Fx1MDAxZn0hn3XEXHUwMDA0u3yfQ2ehiWWa0179no9cdFx1MDAxMudAU+XXeDzNfL/xXHUwMDAwS394KW6Ij917t6g6U3s0/n4xwlx1MDAwZbtcdTAwMTnwmlx1MDAxNOvCY53yXHUwMDFm7JdfPE51Yd0gXHUwMDE44NGkgN7DXHUwMDBiy4KIOe+zV1xmwWqqSSu/3lx1MDAxN9G0R4Mm/sxPXjK7XHUwMDE5hnNFuF6Egv/OiSPAPeJWs37bV0Ks11x1MDAxMabmrcLxgitcdTAwMGWJXHUwMDE2g7lox/4nXHUwMDBmKDRpT89cdTAwMWVDaSzuZ32AYvtdcVmWfcvf789cdTAwMTWZg1RVXHUwMDFhXHUwMDEzJ5HQfZqPXHUwMDFmfUz3S5mG1Hzj5PfcuFx1MDAwNZttoOUwpu/I4JG1XHUwMDE0ff2SeUGlwMqLzN231lxyZlx1MDAxM/v2d1TORkC+nMSPLYyeayDv5awoTVx1MDAxNdDRjVx1MDAxMEfQmF9uJn+9YLqw5du2fd7YWC5EiT9cZqHAnMpcdTAwMWPXveFcdTAwMTem145ccuyfOTJINPykodk2/zou9lx1MDAxOVx1MDAxN0/GXHUwMDE5/j6TtT5fZ9Vccq62v179uvfco2lcdTAwMTdcdTAwMDSmXG5PS7IlT6j19bjVZvnuOS/Bvogu31x1MDAxNFx1MDAxZFWSxsPPXHUwMDFkRWvjtyZcdTAwMTXRt41evyrJMkwz7cdcdTAwMThcdTAwMTjrPU/niybzpI+2XHUwMDFjLriUUar6gUlcdTAwMGZIk3ggWcXTXpvKrWvO3lxu3KN/tT5VwzBjx9jpPmn+rNqC7CDHsq+tKPb5+6stbc5OUJh8Vyjflof/RWOHX280j4NY0GFcdTAwMTVnf1qn+75cdIKwnlx1MDAxZlx1MDAxMOzJ3JJcdTAwMDKI4tNHI6SKsb5OIfTPanwleO2Qks9qc+6gPso/Pso2i7cz+lxi0ecsXHUwMDAy8aHzcsmb0yUrt4Rfz1xymtQqIUuTgzBiXFwuXHUwMDEwnPjQ0OGmv1uPXHUwMDFmXHUwMDE2RGL+IS9cdTAwMWFDXkRMUWntyFx1MDAwN/hMpNTszb5tojW//npQ0Fx1MDAwZYLtPby1f8XCh8hKjXtgidxcdTAwMGJWssC7OvtA6+pXZCEgUP1MXHUwMDExXHUwMDBlXHUwMDFjSbDGyveJXGbUZ5vBXHUwMDE3bsKp81x1MDAxMWGCXHUwMDE0qoj5+izRKW/v9p2MyqNcdTAwMTYsqvBcckiMXHUwMDAxwX5cdMOCzbH4XHUwMDFk74hEy8Ys3IHSa3LAyjcknFx1MDAxMtjwXGbpKdxcdTAwMTOJy1SPM7BEXHUwMDFl5VA4XHUwMDExxjbhXHUwMDE2ZFx1MDAxOCTrXHUwMDBl9/q3I8PH6D3ObEfmXHUwMDFiM98yriTEUYiZg1Tpnz1V30zIhGFyfpFohnHKnM9f353X19uCYFxiti3PN3YsuOuFJEm5XHT2zrrmsZB+9lhQd+QojGHtrknrXHUwMDBmnMl6XHUwMDBlkC2PXnAnR9zxbspcdTAwMTPiTsk/xXW8v91+XHUwMDA0NVx1MDAwMD6CnyTuSlxiM4EpjOBwQG46hXW+7yZf37mOf8ZcdTAwMTBcdTAwMTE+QpdKvWW7Xe9l7tt+91x1MDAxMP5EyTD8cEKah9/lM2tcdTAwMTY2hNtcdTAwMDf2XHUwMDFi/udeuJyms796LIV8IUhcdTAwMTAmoOm6XHUwMDE4eUUpZbVXZOzT1H/NNH9cdTAwMTFR9KhwXyhcdTAwMDZcdTAwMTlG0Vx0gITf+c9oK1nkLdVaUs9cdTAwMTjdiU9cZmLz7aSPeiZcdTAwMTlU5Y5SLFT9xkZ4XHUwMDAyOHmTvk2plig5fu8r2FxcyntbzXe/qntHmFhE3Ena5KCQXHUwMDE2XHUwMDExSc5a01u88/D5s81cdTAwMTNB/KVcdTAwMTOHZH3NXHUwMDFlXHUwMDAx42fUnspjfFx1MDAxOVx1MDAxMO1cdTAwMWTkX8ek0pOuylx1MDAxN0FcdTAwMWVcclx1MDAwNYKJqWlcdTAwMGbUXHUwMDFmYENhOGEmfnOGXCJcdTAwMWZccuYnjapvVXtMXHUwMDFi1qw6bd6c6vQ4XHUwMDA2piVffG7yTOmXfM3lIJmWXHUwMDFjX8k7K/dcdTAwMTJcdTAwMTRe3ejY4+tgnb6X3m9ZMMdPKz9eoa7GcO0jLiZcdTAwMDNtl1xuKJNcdTAwMTDjOlx1MDAxMbHU4IFcZt6duqjg/qi/YVxcXHUwMDFlaZFcdTAwMTdEQr1wOCrBXHUwMDAyRKXS48pcdTAwMDbyXHUwMDA1J167T4yfSbZcdTAwMWGBe7i1Z0/DQ4NjR5Gu4JFIzt+dJ+bSk9XeVy8xSLNJL1x1MDAwMef0jY69y884MXuDXHUwMDBmr77j+ZyDz4ONu1rS1DCp41wiMNVfPcRwYCBYQP9cdTAwMDY4ephRbVx1MDAxOfuMNljNQJjTqLmVRHJ3uq5RXHUwMDExQkhcYt9fsaXiRc0xOFx1MDAwNO2l8E4tcaR10KxM/3NrIapUx+p0W1x1MDAxZUhNlv7i+JZ0ne9nn2JcdTAwMTewvb5cdTAwMWMliqPv1t7ubTXKVjCwtqktXGZ27D1cdTAwMWWhgoq5293VXHUwMDBl+Y5cdTAwMDYooHBcdTAwMGKm/Vx1MDAxZPjNXHUwMDAw9+KVnu6a9tk6t8cwkU5cdTAwMDPUXCJcdTAwMDNay6Jah9PabNc/dKZd3qU6MUOmknXO0StcdTAwMWJwgMg2kNJoN3Z/NdeYN03T9d+31jCoR1x1MDAxOStU2k7Oe6dcdTAwMWWxvj/aNqCOzT+0yG+3rnZcdTAwMTRcdTAwMDFcdTAwMDeDLWFdYrRIdD+lmU9utpktXadeNzHwplx1MDAwMECX8/5M4eW6YcBvOjiIgLFLKDnMXHUwMDE045bjN1x1MDAxNIJcXCX9OzNcdTAwMTCrq1xyg6gn1YZkQlxuZzHoep8ybvogXHUwMDA133JJMFx1MDAxMC4sXHUwMDA1eFx1MDAxMpXYeGab0KZp/p+bzH9cdTAwMWSRU+tAMqv9brvo46dAYVx1MDAwZcnWLVx1MDAxYXOsz1x1MDAxY9Oe7+xatE7EQ29ox2K8XHUwMDFhsIjk7Iu8as1cdTAwMTVYmv94fIx91Dh+gVx1MDAwM6aDXCKbdlx1MDAxM3299MDfNVx1MDAxNdA2OU1HX7n4TZlqOavsLlx0LUVZmu+2N3OmQ2ZBNIbIWqBcdTAwMDF4LdW+XHUwMDFiKNw9y9Xjpog2hMCzYEnFP+eaPlx1MDAxOLvTP66YR7X/XHUwMDAzXUN/PdOt/4pcYv66UpPDxTT3XHUwMDFi09pvXfFXXVxmR7MmXGZEOckzVG3tXHUwMDFi+nu8fdJZd31E/TTAXHUwMDFlreHQ8uaniaBaXHUwMDE0XHUwMDFhtjfU8WPfXG79S1xyXHUwMDA2KVx1MDAwZcC3juGTbr6gqZ9cIlx1MDAwNzpcdNfQ4epcIjQ8nIXw54dcdKD7q39cdTAwMWGiPTl5vFx1MDAwMZJcdTAwMWTQ01x1MDAxNN9/TDpPl7pcdTAwMTFcYqZGednW2HL264dusr9zXHUwMDBmPVx1MDAwNW/U+Vx1MDAxOIZcdTAwMTVcYlx1MDAxNL3rPn6iuiTR8LpcdTAwMTc6alx1MDAxMVxu3W5+XHUwMDBm5/x8q2HC3tZcdTAwMTMjXHUwMDAzXHUwMDBmv686XHUwMDEw4sNcdTAwMWN0XHUwMDEzKUxdXHUwMDFiX89Mt14uPHpcdTAwMDZPMunMpaDoXHUwMDA3bklcdTAwMDCOXHUwMDEzXcH3R/LR7D/dtFx1MDAwZsOhczSeXHUwMDEy5j2HVFx1MDAwZYb6weRmdFx1MDAxZfzfj/lb5lxm/tZE735zR8ziv77Q04OkePM7XHUwMDA1XHUwMDFkzOwxqkJdq/qyPVx1MDAxNuBV81JcdTAwMDdcdTAwMTfawXe+XHUwMDBijW5cdTAwMWLnWIMtXlx1MDAxMuj3OGNRt9OO4Z0znCePIVxuxHbadd7yU9/3XHUwMDFmYaFcdTAwMDKY7uZCPVxihX5cdTAwMTaFW8DGI4AjXHUwMDA1aqyrSihcdTAwMTIotGX2N+SRJ691kVx1MDAwM6t55aZ/dH9cdTAwMDCIdnwhXHUwMDFlk4RFKCHNfzJgLlxmzoZcdTAwMTLpTSCf1fNtOOy2XHUwMDBmrLF7pyC5mq48XHUwMDAyXHUwMDBlVG0xsPJcdTAwMTbb+eW5mMPF/rFo7EBXylfR5Vx1MDAwMkRwKmrMftJCYd3zhirYoVx1MDAxMcTu++Y1feGevHssXHUwMDE0alx1MDAwNts84/deIFx1MDAxOfIrqy8gs3tcdTAwMGUyytX9XCLSzlx1MDAxM7v/dyvdo9PVx0Cj6NmOZGFcdTAwMDHoqr3hlVxmJkq8XHUwMDEw7dNHkT9Cy1x1MDAwNdjDXHUwMDEzp57wKa66M+1cdTAwMWHz12dcdTAwMDaEXHUwMDE0XGKuhifbc+vSwlx1MDAxMHtVc1x1MDAwNFx1MDAxMf2ObsC/XHUwMDAwqN3h9rjO8efHMOTRJkuTXHUwMDE2TfR7XqAn/tJeXHUwMDEx2LAk6Crn58X9M7FcdTAwMWGdpTX388RcdTAwMTUzsjVvPPH42LFlVq2CI1xujJg2g9wuSy6uK+6+vJW/U1IyJiCuV/iCetF9+5nqk50tmGg2WEpcdTAwMWF+X4ZTLrNcclx0dM+mwVeIi6Y9m4FcdTAwMGLAXHUwMDExeT6jot9aT+O60fhhmr7Ao99cdTAwMGLw5T9/kUhM5VthXHUwMDBiXHUwMDA1IJ8oONDu35c497DyNa6nNaBelVQjXHUwMDE0q/HvQFxyXHUwMDA3tzDKXHUwMDE4XHJtpnX58ob7+NRPsOea1bXyXHUwMDAypLPAXHUwMDEy3yO4x3NcdTAwMWam+P1Gb1x1MDAxN4ibRKmRXHUwMDFj5pz1+OVcZo3j0jJq8P02XG5TssTPr++y5ZCkxVx1MDAxZNhcdTAwMTP97o7ojK02SVx1MDAxOJx2+EfoyVx1MDAxY7ey6Vx1MDAxMepcdTAwMTGas8FgXHLNa2Ps5Vx1MDAwM2pT+1x1MDAxNd+Upm+gflxcTfBNuqO167F4SGZcdTAwMTX7Y/mgPVx1MDAwZm31IJ/Vl9bS4Vx1MDAwYsqNYJ6AiaGDrfObXHUwMDE1tZ2CKtGdP2FitnO0ejCGrlx1MDAwZlx1MDAxN/pHKDJcdTAwMGLxeDKxiX+081x1MDAwMeqP+rhcdTAwMTVdN1x1MDAxZZMt/33jZTFSllx1MDAwNJv0qSgsVVnx/lx1MDAxYufDo7JcdTAwMTckd6+cO1x1MDAxMI5Ut1x0n8LRMVPWfWFcdTAwMWTvrlDUrlLuL6f7XHUwMDA1OobxJ6I1NePVumdSP6xcdTAwMDLsvfLkflx1MDAwMSyqPnFjLFZcdDHh24wtyVx1MDAwYtxNaYZwcUePXTzK8m/Ho3O6wjHu6ZaF9lx0YHz9dNpcdTAwMWJapcNjy1x1MDAxNFBrdEt8/9NcdTAwMTWSli3T+UxcdTAwMWJcdTAwMGJcdTAwMWOG9dXOdMbUbtdmNa3fge47w1x1MDAxMFxm/Fx1MDAxYlx1MDAxZFx1MDAxY1x1MDAxZKhOQWxGXCJRI1xu/YbLdf1V21qRv1wimv9697hGMHdcdTAwMTdWbHe4fHJv48r7e1wiXHUwMDFiW/4tOZ8tZKPgXFxyPWlccq6kiFx1MDAxNFx1MDAxMe7sZdTo/DshMb/62CGPc1x1MDAxY7/sl4fWtabS+1wi3lPSauMjcMi2O9ue9lD9d0efi5pcdTAwMTH7XHUwMDEw8fhOsMPxpbr1mraKp1x0oYBcdTAwMDdzi/RRXHUwMDE2iFx1MDAwNlx1MDAwM3hmdkz8WubCXHUwMDE0UKvlaYan/30ruaPRKX1CTdm9pu4zI7tFgIWZ9NiCXGJVXHUwMDFhzJRcclx1MDAxMX5cdTAwMWV/h255XSGYeyNJXnhcdTAwMDbKhrlcdTAwMWSTpUhvlfRcdTAwMGX1XHKOqCBmMlx1MDAwMEz4k3Byeon5XS7Dm5zsh+5cdTAwMTHpfo7fXHUwMDFhmPIoXHUwMDA2rcNJgNdRSVx1MDAwZXfrca/mk1x1MDAxZH9cdTAwMDS7aKt70MvlXHUwMDA0h0uqXHUwMDA1sOFC4cdo0Csublwi8yDCUS9CVtulbUfoXHUwMDEz+Eabu+h9w1Cv+7Dvv7M301wixf1VR7xcdTAwMGX660txXHUwMDA1xljPWkr4kMSZwzhCXrhcdTAwMTNcdTAwMWNvr4fbtkHDcOozXHUwMDEzv3vh4seqxEb6e9ztT1x1MDAxZDZ0nKyQXHUwMDEzSmKM72a/XHUwMDA3WD/Qql3pm7ZfpnNtzlxiu7FBps3LeatvtFx1MDAxNoZcdTAwMTZcdTAwMWTzL9rC9a6qtVxcXHUwMDA3YpybZ504Y0utbqxQUFx1MDAxNFx1MDAxZIvqSq4hXHUwMDAxqsOq2e9cXENAfJBcdTAwMTVcdTAwMDSoXHUwMDE5XHUwMDA3dus8zFx1MDAxZJaA3LXWVNX/JeVcdTAwMTRefiRoLo5cIkPLTFxiSvVcdTAwMTl8NKFG8FX7qYZUYOxcdTAwMGb4xDmsMrj1uPRcdTAwMTfEdf7GlLt2gZavR5hcdTAwMTO9frrwiJ1SrFx1MDAwM1ZVJ/tDNSRZXHUwMDE0M2S3XHUwMDBmw4Otq0BcdTAwMDSUPVp9XGY9amj/oG/7knQ2f4NcIlx1MDAwNOg7g1x1MDAxYVxmhcnd+1xmX8adgdj+izW0b4lPXHUwMDFmR2oxSHzCfslZ0aJM+2ae34U9XHUwMDE5h+DOKiaAySDC0Tr+RbGbaeaiePRt9vNU+Fxy49hcdTAwMTPFw+++MlljO1xmXFzdivojhlm6hllb5E36XHUwMDE37zPV7NRcdTAwMDXM0zTjgSB633CqO2N7XHUwMDEx3iO6zmF+N+F5z0j9cMKbXCJcdTAwMGbHzcz8801g4lx0zlx1MDAxYqRe2HJFOJpaXHUwMDEyglxufEhETPlcdTAwMDfMlTKj0JF7a1x1MDAwNV2K5Vx1MDAxM+tZvkzXsj9pVuN7K1x1MDAwNdQ7SdY+XHUwMDFmxpNxh4tcdTAwMDZNIVx1MDAxMC1cdTAwMDez4lJcdTAwMTj0b1x1MDAwZmU+bP32d8zqQpxVI/z6XHUwMDFlk0BuXHUwMDBlwcRcdTAwMDd3lZvVXHUwMDFmeEHT74tcdTAwMGbp8L75/Xe+ME6v2IhcdTAwMTeApytcdTAwMTItfFx1MDAxYybdhkz6t1witZ7z4U3dI4zcR5NqXHUwMDEw9kh0W/J3rY20vKNBPXbhg2ZLzb/l/7MxZUDLNnpcdTAwMWHW47/LI7T+ulx1MDAxZfz18Z069mT9LlGIXHUwMDEwnG7gXHJcdTAwMTNcdTAwMWT5I4t4vYg9PUt+17G1XHUwMDFkcaBMuIv1s1x1MDAwNJ+1sm7GJ/6YMJ7LeZRcdTAwMGVcdTAwMGJy+S7ScEfTXHUwMDA32Fx1MDAwN+z1OD/hUeh3XHUwMDFiPJFcdTAwMTB02ObtXHUwMDAx5YBcculWkTdjXHUwMDAwZTZOXHTTY8Ukr4RsvVxy5f9GhlxmvVcmLUqgJDq0WmVvtlx1MDAxYzXkgXitw2KvU2ydO0BwfOZcdTAwMTaAstBbUUeRQumPaXVcdTAwMTj63st9sM1Xkq7Pmp1cdTAwMTVcdTAwMWGwobpJ47B3mp0r91x1MDAxZvyrcFx1MDAxMiPQ0VxyWMyJ/13b/LZK10pRJtOha1xi819ea1rdfl5zj7wwXHUwMDBl/F9IncZcdTAwMTiVXHUwMDE2XHUwMDFmb1x1MDAwNzYl8edrXGYt/caog82R5mt5/Mm3Losz4MFvr/r6XGJvTXt+9/wwyu9cdTAwMTGfuVXKsvxcdTAwMWb/41x1MDAxZv/tv/zXv37+kc55vObZP/7tv8JcdTAwMDSGoi+Colx1MDAxMPxcdTAwMDX/x+tdvKxOvs6/S/P/6V1/vel//Z/3/oPCUDhPc1x1MDAxNE1cYrjIXHUwMDEzosBcdJjMcDzF0ySDoCzO8SyOU+r5kv/579/e1/0jXHUwMDAxvvnzu3/UfVxc5uB3KP95cPVvj///X/xcdTAwMWafy+I19lx1MDAxY+334d8//+0/vvq/J/GS4+h/q33GdFx1MDAwZUhcdTAwMTXL8Tc5xtureO83Ue/f/1mZpcPfnNlcdTAwMGZAXHUwMDAxf01fYLxcdTAwMWRIpudcdTAwMDVN8Vx1MDAwN+Hk33zywmN5iKWwMzQwPjCVfOG8XHUwMDEzYUXf3oj4wi5cdTAwMDZe7HZ78kiV7GfNcFx1MDAwNfJYXHLmJjm086H3nMe5N+coX6FOj0lVimDaXHUwMDFiZP/RsnWSoVex5VxiSUjG4Iu31vZcdTAwMWXBgdpM7oMrXHUwMDFiLyyKqFx1MDAxYl67jkgggWJAit/qwNZIft/0x1x1MDAxY1x1MDAxMM1NXHUwMDE1YG5Bb1xcyej9cG1cdTAwMGV2qVx1MDAxNmdcbnqH3oCOaSNcdTAwMDOM+25wsFx1MDAwNdCgo41cdTAwMWREg55cdTAwMTVYZYAqXHUwMDE0v5fmXHUwMDA1MMXE4Xf5ZN5hvd5/fVx1MDAxNqZhl5SA365Qad9pXHUwMDE3L/ORsCCX4qhy/+uztOGD51x1MDAxZCangv76vr1cdTAwMTRcdTAwMDSx7Hq/0YJRPG9UnZ4uV+WNmalcdTAwMTfyXHUwMDE1wFx1MDAwN1x1MDAxYUl7N3lELmAmTeFsNIiRXHUwMDFh1Vx1MDAwMjZcdTAwMThdXHUwMDE3mL6oXHUwMDBiul7IUmV54UBTXGIykVJcdTAwMWRv+6ojmjG6jbaVZTpot1x1MDAxMrb5LDCgXHUwMDE45ItcXIU04L91XHUwMDE5PunVfdVQYyTmXHUwMDFkdD1HVvxAkaBNXHUwMDE4xFxmXCJlMVxyXHUwMDA3XHUwMDA3XHUwMDA2w1x1MDAwMFx1MDAxNshcdTAwMDe5LpwqXHUwMDA35IBcdKCyXHUwMDE1wZ62zqbedq0zbFDaTvNW2l5i0cFlY9pcdTAwMGXtqm7LRJjoMdRknrVcdTAwMTVPWdjGrCSZS7WGxMUjprmLLZdj0o6UsX1M0ivy8E9dbLaquFxikCGBXHJcXCSKO4lcdTAwMTRcdTAwMDTWwFx1MDAwNFx1MDAwN56n+sd+LUfi0WexjdooVM/+j4tTcn1cdTAwMTLpum+PenBVXHUwMDA3qjp2ccr4eInQ1zfGN55iNS96XHUwMDA3Z4tOJDE+0+JcIucyZS0yxVx1MDAxZFx0slxi/e5nZMtNuSSpYNWkwc5tJzDQXHUwMDA1qZTbK3BHOOBcdTAwMGLw4lxmKlx1MDAxZkhcdTAwMDEt1i6p/tXk+9mCXHUwMDA3K2l9R8c6xFx1MDAxZpFWPlpcbqTgmq5PrexDZWGOqZPpXCLuUDNcdTAwMTN6VmlXmWW1+jvOfUTPSfiCR3fJXHUwMDBm47GLL/5own6wXHUwMDE1Rlx1MDAxNMdWQTZN7NQwuVx1MDAxNt9cdTAwMGZ1kdpA7Fx1MDAwNjjsIcfQwqW7XHUwMDFlXHUwMDExzFx1MDAwZsQmw1x1MDAxOX5DjNxkw9Q4KH00RFx1MDAwNlVcdTAwMGab5Vx1MDAxZcAzue5Nq+x4yDztMkz9LmVbfn6Hq5Ja6tXBKHrZdrKInlxmPapHcptcIo0qul2OxudY2D4/h73Q5MwxaM51m1LR7oNMMdDCwVbbX+I19dp7syRcdTAwMDI05uIxXHUwMDA2uNaAXHUwMDEyiGRsQPgkk4Gmh7ZtwKKB83hqXHUwMDAwXHUwMDA0Ms5CM1x1MDAxZdHW11x1MDAxYyxfqFx1MDAwMFhcdTAwMTalynSXXHUwMDFh/VORZ9b47JtlaL2lfTY8XHUwMDE4w4jdh1to8SGEjT5cdTAwMWWRXHUwMDE0WbJCa/2s6Fx1MDAxZUOj9KarTnU4b3pcdTAwMTVcdTAwMTkmvJJ3Wbqu5DF3UPJcdTAwMWaAgNGchONTOlx1MDAwMECeVC96XHUwMDE3JSR0NCilXHUwMDBiXHTuVFFcdTAwMDPA2riElVqIXGa0UcpGKPTkUoOp7Fx1MDAxMZao9alWzdaBoFx1MDAxNVRcdTAwMTbYj1x1MDAwN9jOtLE08m17ofVcdTAwMDK+XHUwMDA02DRcdTAwMTJurUhjXo8zfq9cdTAwMWadR9yWx4cwtmHc4sdeXHKb3jtcdTAwMWWPcdTSuJ9cdTAwMDPaoZLy7WXma1x1MDAxZFxyvVx1MDAxNFxynrXQ4zwzcFx1MDAxOFxir5V3/tDEiF3EMqLljlx1MDAxNye5ls/IOrZcdTAwMWRcdNNg8jNcdTAwMTJcdTAwMTODq1A6XHUwMDA2ucG562Dgqlx1MDAxMexcdTAwMTTmM6bXTO/D8Vx1MDAxYpCISIqlroYrw5feyIsvjy/pWb/jWrU0q6y5o0BcdTAwMGbgfatcdTAwMTnN0Vwie5y6wNUy9Fx1MDAxMWS2Uu0lXHUwMDBiXHUwMDA2XHUwMDFieMljUFx1MDAxMe9cdTAwMTP+9PRtMOL1qVrG5GqcIOiZxLtcdTAwMWPEdz1MMVx1MDAxNsedpN2Cl93LXHUwMDFmXlx1MDAxYfP2quhw/F1pg9u17rCrXHUwMDE1PVI3uZvBXHUwMDFlYXVcdTAwMDAggoLOcaSNcZFcdTAwMTJcdTAwMTNcdTAwMDdcdTAwMDLLuH2KTGJcdTAwMDLReWH12CRxOFx1MDAwMJ4peHR3xIN5mJAqvmdcYkLu09o4LIxcdTAwMDT8uMClS6d3kjHKXHUwMDAzyS00VuLxoiH2XHJpwmyh0SuJQJJcdTAwMDJcdTAwMTOKXHUwMDAx2Ceds3uWs4Zba+/lWtJmKnxcdTAwMWJJaKl0kMl+J+9JWzyFJ4at3m9cdTAwMDJSr05OvulminiMSFx1MDAxOFx1MDAxNlx1MDAxNbt/XHUwMDBmy1x1MDAxNXLkXHUwMDE3u4nvI3jrXGZcdTAwMDYhXGI+KtxEsYjhPK6bjTGGqqJcdTAwMGWhWpVCkUxzZFx1MDAwZZFcdTAwMWEhXHUwMDE22maN0nOaM5tcdTAwMGJ2fHU2wVx1MDAxN6/X5njLIVx1MDAwMMIjSUfuMXhhaWRFYb/8LvJcdEuPLFx1MDAwYlx1MDAxY8dcdTAwMWOsq+rkvNL+XHUwMDFhRyf6IS7xr56bxDVEklbXOMPuj7ZEXHUwMDE1XHUwMDE1XHUwMDE1oFx1MDAwNrBv6PLCSIvYMW6H0nY1jmOGr87v8uwyXHUwMDAxWT5cIlxm5FAh1Y7Q0PRAhjY+9Fx1MDAwNVv9Ulx1MDAxYlx1MDAwN+3y1SgkmYxAkUFUXHUwMDA3XHUwMDA0XHUwMDEwXlx1MDAxMKRcdTAwMTJSeLrld5peXHUwMDAw/bX1X1x1MDAwZkxFV860TlKUlXuWXZZr1EtSXHUwMDE3X1x1MDAxYz+bg2zzvlx1MDAwNL812/G6Wj24yqxJglx1MDAxNWKlVFW2e4guXHUwMDFlf0WYa+x7U59cXFxuMm7tJnmUV1Jn/Cis+vdcdTAwMTRcdTAwMWK0dds1XHUwMDFjXCIz7TMndeks/jhIjUdvQW7La4DQgStcdTAwMTCXL76WRr26i9BfN7jxVvFid8tcbtHHXHUwMDAzO1xix1DMmJiA/eXGXHUwMDE3n3zNmyEyq7tTTI58Uu63k56oXFyD10fqp2y/+tWvq65p3Y5cXKtZbVpD24JcdTAwMTJcdTAwMDRB4Fx1MDAwZUVcdTAwMGZW6G83MUOKgmhcdTAwMTi6KqVcdTAwMDdcdTAwMWL/UejcR1x1MDAxMFxyuo9cdTAwMTjd0I+dRSG9hLFcdTAwMTBcclx1MDAxYq1cdTAwMWPWYk4+XHUwMDBlPVVvxjWgd1NXo2Ro2VbaKKdcdTAwMTieRkeMjMTecEO9x5QrwExqwrzlzpZcdTAwMWO07Vx1MDAxZt5cdTAwMDD3ctwtrrhcdTAwMDHEIcFI6VxyoNFcdTAwMDBcYlx0k1x1MDAxYlxySOD+vFx1MDAwMJJ9Y+6h1umzOENmn7ak0O3nMK6JIWySjlOmerhOfdKZXer2XHT81jZccvtgyL6UXHUwMDA0hnZcdTAwMWNMVLtcdTAwMTRyflx1MDAxN/V6iEd4/I442On043C1WHTIlYTHaLApcp3ix9YgoVxcmVx1MDAwZlx1MDAwMPMzeyvHTSb4KrSfiqaS2nHF5shcdTAwMTUwhVx1MDAwYutWvuBqaCvQbIlcdTAwMTA04JwgIP4pisDMr9r4XCJcdTAwMTKwqOJcdTAwMThoIW9j2slNXFx9UeFcdTAwMGIsklx1MDAxNtdcdTAwMWOLjIEoo1x1MDAwN6F623xiMcRcImp6+quxU32TtpSh7sjrXHUwMDBmylc6d0OorKNA5rj5o1N8jFx1MDAwMttcdTAwMDJcdTAwMDGoR0c4xnJUqn9cdTAwMDC25KJRjbC6XHUwMDE5snJe2ZczVexRnd5cdTAwMTlOi8NUh8yu5qd36eXjsNVmXFzvnUGUraVTSeODqk2vMZnkdVx1MDAwZXTcmc3PKUehXGaMMFx1MDAxN1xiXHUwMDAzzb4+jIHMhyNJkqxcdTAwMGbSsEE+XHTgXG6hXHUwMDEx1lx1MDAxNyBcdTAwMTDUOX/39S5HXHUwMDAwXHUwMDAy5clcdEwndTYmonn4XHUwMDExmPHjTbba4mG7XWxcdTAwMTK/K1ZiXHUwMDE0LcOEXG7u8+rDhKRqQ1x1MDAxN0xyi3NcdTAwMDZ8Y5E1XHK/847uXHUwMDA3peCK7Cbi1VVcdTAwMWVcdTAwMWRTqZBcdTAwMGVBjCCKirtcdTAwMWRepdhcdTAwMDbiPa5cboAlXHUwMDFlXHUwMDAyNFwibNuOaZnjdkvD7FCtXHUwMDFiXHUwMDA20nOc83UjL/cuXCL02Fx1MDAwM+SVkihW4VxiikmGpzstSCXjXHUwMDE5XHUwMDA3uqGussLqd57y9U2Uq505j12rUlx1MDAxNqZcZt9Lo9d6rvCIJk2LlCxI3Z+yiXfh6npZ9GKRXHUwMDAzTrZcdTAwMDJcdTAwMDH0JJ8lXHUwMDE5bvdcdTAwMDY1aSaQoG5cdTAwMTSFT9RDXHUwMDFhirjvt4c77d59XHUwMDE2XHUwMDFiXHUwMDAyz5pcclx1MDAwMrz1mDgzeVdZXHUwMDA3rH20Mfv4jvrWMJNcdTAwMTFcdTAwMTb4i0xcdTAwMTndis4o0NfbYVx1MDAwZVp3XHUwMDFlwfxcdTAwMGUrRflcdTAwMWVcdTAwMWPzYpNcdTAwMGLl1+OtksuHrtZG10I8M4+XXHUwMDE3XHUwMDA04ZtEhFPvXHUwMDExrGzIR0LfXHUwMDEy9qxcdTAwMTOCoPaxfEb2IMLVNMpcblx1MDAxZF2Wr1xcP2kz8z3qSoutXHUwMDE3JVx1MDAwM2mLqlx1MDAxMV26XHRcdTAwMDc9XHUwMDEwN1P8QPa7olxinOFu31xmY6GEXHUwMDE2L8XTpnNcdTAwMWPLL76LXHUwMDFjw0m9a2PQdIQtwflcdTAwMTgkubRjXHUwMDFkJ+ppi3/Csolq5Sps3ymt1JSz3JvMKOpCXGLISlx1MDAwMWSqnzw6lddcdTAwMWShkz8mJVaRQGLE4vfrdFx1MDAwYnQ8x7VN/s1FXHUwMDE2XHUwMDFk9G9cdTAwMWFcdTAwMWY0XHUwMDA2XHUwMDA3+apXNlx1MDAwYtTlulx1MDAxMzz9XFw41n6Yy2LQZtojXG6zLFx1MDAxNEWp4Vx1MDAwMyT6cYuM3N6B9228rfKFOmrW8VKYVdno/Ir92eyD5tHR/YNcdTAwMDVe+kZnVcZaufhcXJ2IxqD/9vnl7Vx1MDAxOC1jXHUwMDA3Xqn4NYrpqpZasGEgIYHBXHUwMDE0XHUwMDA11uBC7OtWUjgpxEbLRpk5tdp3qbyxvpJcdTAwMTKyIZRcdTAwMGLY8uuliFx1MDAxM+7WXHUwMDA3+35e9lx1MDAxZc+YLYRfQVLl7mVcdTAwMTfoxC2QZyo0XHUwMDBmfp9cdTAwMDTe5CFi+CRwUMhVetEhXGKU7WFTQN5cdTAwMDP9bekmXHUwMDFm2nJcdOilXHUwMDE1UTRcZpNUl1x1MDAxNYWwwScjhZpqNI3AdeirMCnXZyntp6xp82jhPZuBtvmjsVxuXHUwMDE3tYpCI7JuXHUwMDA0rd1E6se15futUU2034ekXHUwMDE0vJxUVcFcdTAwMTZcdTAwMDXJOPVcXJON+2ahPnJe9mWCvFGQZmt8vzWJoHqiOEOFXGLQRuyxXHUwMDAxdNlcdTAwMTmntL1FeapcdTAwMTlcXDdBWjzpio9cIkaJRmWfvlx1MDAxMp69tYNxUoldNSaa7TQo0+VK9tdcdTAwMWK8xGiv9vj+RMDl3lx1MDAwNC5KJtCPWz9na6VkXHUwMDA27Y06J/dcdTAwMGaW8e7jSFhZkI8jZNrYXHUwMDE3RPrNY1x1MDAwM7FcdTAwMWV+XCLh77hQhKO3o2pqXHUwMDFi606DXHUwMDAzTfUzd1x1MDAxNe9RZ3hlp9l25zFmuV+IXHUwMDFhXttcZptq1qp6jKw9k+bsfrW7uFx1MDAwMcpbXHUwMDAxdt9/vOaxVEt6+p/yV8nEi7aivkhRyOl9zTcn3Vx1MDAxYmfs14MpYPl0LJSQXHIwNOp2cFx1MDAxMF+7XHUwMDExQlx1MDAxY/ZxXHUwMDE4NptcdTAwMTVcdTAwMTFcdTAwMDGQaS16VqzeT1x1MDAxOL/5l8A/fPpcclx1MDAxY4buXHUwMDBlc2RVo2NcdTAwMWRjXbdgZPOGWFx1MDAxMlxcePbrzutEOzHF7FFcdTAwMTl4gFx1MDAwNEfm8L9JOo/lOLUoin5cdTAwMTCDJjVhSM45NczIOWe+/qFnVdmuskuyRJ+791o0XFzCSfzeJNVcdTAwMDPzK7lLWmF5Ukmnk2lcdTAwMDf3+3wwXHUwMDFmvCNwXHUwMDEyqU82LVx1MDAwYs4nXHSORTv4k/aAUIzWjaOoVZaXhVwi9tFcdTAwMTCnnsFzXHUwMDE3zzM4IOIgl8uRSbXJXHUwMDE4I2lPXHUwMDAzgqWJKirtWGzua7CjXHUwMDA0mOSZs1x1MDAwZiB+SjDSXG5cdH9NXHUwMDE1vlGN+GSli2uCXHUwMDE4wXJcdTAwMTnfay7wqYw8qap5tod651x1MDAwMDjfg/0++kj0jGNuIVx1MDAwZdRcdTAwMWNmrOsz3OZ5M4VySyv4XHUwMDEynknfg/BcdTAwMDRcZnfCjVxyKPm+XHUwMDA0o9+5UjtcdTAwMWFJLSsrXHUwMDExfIzB7MRBbG6l2HhzOG6n3Vx1MDAwM7VXj8PUgr8ztVx1MDAxNPxcdTAwMTQ/XG743ISps6DpooJWM+Xp7qHCmFKaUF5HXHUwMDBm28pcdTAwMGa3Si/WbNlcdTAwMGXTybFIW5trgXGYxLrjxjpcdTAwMGbqSuDGgqRJqcd/hzdj8ufctC9Zmi3LNMJcdTAwMWPXj9BcXL24glx1MDAwNCZaXqNcdTAwMWNRyPam2PQ/oOqi1G9Gxnqi49yb0N+d1ntiqFx1MDAxNFx1MDAwMrBVUcp3XHUwMDEzrD9hXCLSofRcdTAwMTJcdTAwMTWR5fTAy7N77PGWM69DXHUwMDFhX3e6XHUwMDA08KZGXHUwMDA3tao7XHUwMDFkpCtbJ+5cdTAwMDW/PoCQ/Eu+wJb2+1Fw/W56XHUwMDFl3a/xU43ft5/hhdOnXUJUXGJcdTAwMTSoNmtfR5KHXHUwMDE4tFs+e9GQ/1xyXHUwMDE5eXnvIXJ/1old99c+p6lk+8hcdTAwMWPGcujuv8qXS2KuocvtXjnz9+jvWl3R/n73PM/fYM01gqzZXHUwMDE0XHUwMDE568Zkzza2uZ1b2j7Nr0jfUnVKU9OJ2KNWpMWqf6TAglx1MDAxNqCBr+5eP8foXFz5KHOyw7hcdTAwMDRcdTAwMGZQr7PymVx1MDAxN5tUXHUwMDFjaqZYSlwiKd2bQCpAbr3V9FBTXHUwMDE5XHUwMDE3XHUwMDE14IBcdTAwMWFomlRdStY8aobyXHUwMDFkXVhcdTAwMTIxhSNcdTAwMDSDleJXX/j4XHUwMDA1spyVk12g8mlsmWXgcc+X3fKmXHUwMDFlNJCCXHUwMDA2wU/E8fDgl6F7XHUwMDA3X5xcdTAwMTm14S9cdTAwMDU6gFx1MDAxY78sMMzSOqWL4W5cdTAwMTSZ+Vx1MDAxNVx1MDAxNVxmWUns1GNKXHUwMDFhN6xYgO7yslx1MDAxMdg0xv1S54H2zppbXHUwMDE3XHUwMDEzbyYkPlxm31x1MDAwZtl+kM7FPlxyiH5cdTAwMDD+/oZcZl++3WS9o64zQYDS9lx1MDAxNP/Cif2xcIqyTJDT49pLL2tcdTAwMTNcdTAwMTRjka7NdXtE2YVcdTAwMDRH0fFcdTAwMWRsizekUaFUQqy2XV6Nl6Hbg9lcdTAwMDZKXHUwMDBinsJcdTAwMWZvMLZQK91vxfKYn+RWaTqOslx1MDAxZFx1MDAxMkVcdTAwMDVJh3FZ7TDo1pLHV7GjaJZ+XFybXHUwMDEwoOmkIVx1MDAxZoRcdTAwMThiq1x1MDAxNratQSn+u1x1MDAxZt+ZXHUwMDE3ukgvYMr9MM1cdTAwMDG72lx1MDAwYpqGqJ40aO/vXHUwMDE0hVF0aMTpMS7qKOqtikyRYv/g+iGjX1x1MDAxMkLQQn2evTiIbXpUnMaThcjMtuOK5lx1MDAxNpw70uxcdTAwMWTD9LhcdTAwMWFcdTAwMTPOsndLlizcs6tcZnDatFx1MDAxYlxu4I2oMvNEe/pMl3jIXHUwMDFjl+NwRGVcdTAwMDGaf5quYmXsWMbQoN8ydPu2XHUwMDFjXHUwMDE1XHUwMDE5kTo63H9yx79HnNyqXHUwMDA2V3pRXHUwMDA0XHUwMDE1IDLUMI50K6GH83V5LTOp9JZLu4K7MFx1MDAxNnaZeJxuUtommt+DPa7lNFx1MDAxN1Y/llXnTXTn35Zs+dok5NWHXHUwMDFi6ar36a73pLJ06XborZKqXHUwMDExW83L+KGjiqH/LqhiZr8jUsyUo7atR+6lrMExXHUwMDE05TjzvzfmdOTMXHUwMDFi6DQ68GW6XHUwMDE3Z1x1MDAwMVh4gJz1IO+lcOJXLIT46andl1PXvlx1MDAxZeCEXHUwMDEwY/W/+qGj66Lhgy+h8YnaI2Okmrrm5ltcdTAwMTZizVNcdTAwMGLPsntCTnaYLTSN48/yi8BjiYu24HiOyzr9/IS5I1x1MDAwZlFVck4o9Vx1MDAwZd9MWWDml86j2eorsv5cdTAwMTavrmH1XHUwMDAw0pvqgGNfnXRcdTAwMWVcdTAwMWWDSlx1MDAxNl9Vw3PnXHUwMDFir9FIfvayXHUwMDAxRNWI0Fx1MDAxYdZcdTAwMDWJSlx1MDAwM7xmvFP7XHUwMDFhhlx1MDAwNTaKluGjXHUwMDFk+C8z24rQgycub5XtWdJ4n0pcdTAwMDdavYa2aGY8yNaprttcdTAwMTJcdTAwMDCX9Vx1MDAwN9BCsk/T3WSFYkWaTGr8sshIolx1MDAxN3/CQZqq7IeuOuGUXFx3XHUwMDAx2zR+XHUwMDAzga7CYIyW5Tj1p0E+54Yo39z4XHUwMDE0RLnvOeU0stZcIuxV8/TzfDGdqW+Rylx1MDAwMzLCY8f1XHUwMDEw8DiVZYH1XHUwMDE17Fx1MDAxNmuUmK88Uzi6XG4s56g3kVa+U5f6XHUwMDBibb+i5CSuXHUwMDA0XHUwMDA1XHUwMDAy+Fx1MDAxNj8t+OyJfqEwXGKdtqKNXHJcdTAwMTidd2xPN1x1MDAwZjxsq7vx21x1MDAxNE5aveNcdTAwMDQmXHUwMDExXHUwMDA0gMeFXHUwMDA2TT1IoFxcsspHf78wXnLLTWauITHt1kQ/cedzoWo0zueLXHUwMDA2JFx1MDAxMFx1MDAxMmqL4cDxWT1cbjFcdTAwMDXPWlx1MDAxMFx1MDAwNvbquDbcXHUwMDA0ziVm+ZqlkZWrUotGOqJaW/3u0ZCtj0zTUaps+VxizpKWfXhqqCHKXHUwMDE1iVvPjIBJXHUwMDExy3DpyOWkd51cdEjEuY7jOdArXG5NmLqu4lir+PdANMe+rTtEyrJyuZlWt1xuMPA2jZc+XHUwMDE4OS7wnydcdTAwMDfiXHUwMDE3vriaVlx1MDAwNjZIytWsLO1cdTAwMDY5rZHPMztcdTAwMGVpV+5cdIbWXHUwMDFmXGZw+odEjc+6t+vxt1x1MDAxMeU1XCLuXHUwMDA0q+mgtiE/XHUwMDBlcU9SO6f8fpb6a1wiXHUwMDAza+ud3M39mYfG/WJmXHUwMDBlmU02XHUwMDE3XHUwMDBm9Xdrat5okKFcdTAwMTJKwKhpdTLcUovPguLDhjfb/16JXHUwMDBmWpRcdTAwMTU5QVx1MDAxMlx1MDAxMFGxXGKGUtpIsqXtcbc0XHUwMDA2XHSRaVLL8r7HMz70Mlx1MDAwNVx1MDAxY3JcdTAwMTTRtNLcfFx1MDAxNc16JDqzSKSN0Xg+a93ikFviYkDB0yRcdTAwMDBcdTAwMWRBXHUwMDFlXHT2XqhbNl+HVObtRGeBblxcxZKNXYLbm6VHmKrytDjbfX8z/5cufeNneZhleWHBwkXraGLOdMrAaYPJLddhc81RT09/cFxuK7GKXHUwMDEzm51cdTAwMWOWXHUwMDEzXHUwMDBi5fYjrnVcdTAwMTWMcqOhnOG+YLKh517bsbJcdTAwMTSNXHUwMDE2bpvdLOku3JqtWYHqxVNcblZcdTAwMWTLxj5cdTAwMDXiwo/7NFx1MDAwYlrNXFypqPOj3ISuXHUwMDFh3pfgx506pOtlXG4j77+CU86dO71/lXy+Znfn38/2rlx1MDAwMy0/jvFSop3+odhmmVwiQdNj1Px0s0L+nuhcdTAwMDQ9uVSmXHUwMDEyXmlccqf1lFx1MDAxZJ1166BcYjhJWvn5XHUwMDFhpYWJ5ygo/Vx1MDAwYlJcdTAwMGbHXHUwMDE1knp8V+FH1z/p5pPUXddUtlGs6L9GXHUwMDFjXHUwMDA1ttPfd6taRmynlHgxkkf5nuXe6bt43j9Xz3ZcdTAwMWTvXHUwMDBi87ziS1xuaMnEr3nTN+Bno7LW32dYwbnajl3+kXhcdTAwMWP8NPbOzi14NYi1yuOdLelYudl9XHUwMDAzXHUwMDA2mqSKKqNf/Hv63ZlJzyvzrtJJ1PdcdTAwMDRcdTAwMGa5zvjgkMCXPnTgPFx1MDAxYaCHgvWVwtAl1IF806zuzdjKdIToi1VycFx1MDAxMDssv/7GV49hX7ZbkYUzLenWo/XExY4vylx1MDAwYlx1MDAwYthQ+caNe26P2zV1z9/al+nA5lxc8XrQSlJcZttB9Mh9XG7ePmPo+uTOlEeQd1x1MDAwNVx1MDAxZIfR81x1MDAxNj/Znlx1MDAxY/NcdTAwMTHl8ZrN06hzp52zSFxytlx1MDAwNiigJ+WwjDAo0eV4ZUZ1PuJzhuGZ+KTf8TKJXHUwMDAyglxiQ7RujrOysVx1MDAxNmCK51GgqyfJgn5iL0BLYnhNb+nCQVx1MDAxYftp1jtcdTAwMTKbflx1MDAwN7opv7OKe4aILoJ+k4I1oNs2ukn73V3K0VJcdTAwMWLSjbRcdTAwMWNo5bJqb8lgbVx1MDAxZEpFrEHB8j60a/Xyl6O6VIfM6o7nmlnzhF4vUSVcdTAwMGY4XGb5TeglXZUyofJoKH2ZI3SiXHUwMDAyqdFcdTAwMWE9j2Onme2gXHUwMDBmXHUwMDExpj1jhFx1MDAxZnryq59cdTAwMDBmdd9nUcRB67s6OMySXHUwMDBiVZ2cn2VK09e57edcdTAwMGWzLlx1MDAxNtV3gsTuyJhL81x1MDAwMMkorG9K7Vx1MDAwNmU74Vx1MDAxNFx1MDAwN/RcdTAwMWK+mYLlXHUwMDAxyFx1MDAxYogn1/PnxH1cdTAwMDSdXHUwMDE2m1x1MDAwNlx1MDAwNdpcdTAwMWW5x1x1MDAwZdU2XamIMIXCXHUwMDE3gNX3g8sq5PrX1MpcdTAwMDItM1x1MDAxODuJYVx1MDAxYd5wc0cvbaVnMzOIvvyPJtVcdTAwMWJ2XHUwMDA28k1z6beCzeepvPjqbltKsZOsq7lrrLmU6YJcdTAwMGY30CSLk/c21bRmLSXeNXlcdTAwMTkq/Vx1MDAwNViKOFRUgPGLluSl1lx1MDAwN9dzRLM4mf049Ff2XHUwMDE35fhcdTAwMDLP62Q4PVxmXHUwMDBiypJcZqxzlLFcdTAwMDVMyT01XHUwMDE0N6dcdTAwMDCxabWrXHUwMDFlXVwijl5cdTAwMTHJJsGrUfOXrqO9aU/6kuHJwU6Pota60aPseFx1MDAwYqWBKJp4ladUl7KieFVE9eWlO5tcdTAwMDGZLVlL4ItcdTAwMDTBl11uKKNaJ7ZcIj5LzYrsKIWrsVx1MDAwZq4tcFW4yY2RLY4jj16HN/PJfF97f2dFoi/DIfSlPu/VZy5CYzJLXHUwMDA2c61ycNPOc5TPQOvbWpJcdF25jVxuScxcdTAwMDecXHUwMDA0jtcyR7FdQu6mTlx0nV18atlwVlx1MDAwNC2r51WhuFouRFx1MDAxZFwil0L5pvvh+UrhP4fYZqv8XCJCmegniiw8rJNcdTAwMTb30TVNuObHXHUwMDFk5kn9iep1Jc1+VTtmamM0fT9cdTAwMDY0PJjxw0dcdTAwMDaghlddXHUwMDA1SI9LWe4ooXXFMc/7ddQ5a1x1MDAwM6PYgD+weHFpZYbp4n7Qk1x1MDAxNuru6Vxyr1x1MDAxNXrPslx1MDAwMezTXHUwMDE2xFx1MDAxNMqmjevx+1x0XHUwMDEzuuc3lt07sSrXXHUwMDEzMlx1MDAwNiuZui1vs0r9wSCWmvGHVzXudlx0hcQ0ue2pXHUwMDBlU/LZtUTbUsW/k1CUR1x1MDAwMEDuXHUwMDAwNDbZX09cdTAwMGaTptZcdTAwMTQ01k6d2fpHWNXQTTNFTdD8O0lcdTAwMWSrS+V8aOC4frt5pYTEOVoxhjTceFg48sEusmfdLd2hsfiTyE5cdTAwMTRcdTAwMDZCyVLfiJu3el4mnHPdXCIr633fXHUwMDE1ZbjI24XxuFx1MDAwMIhoUXHzXHUwMDFkuXdgXHUwMDFiRzjeXHUwMDBlkVFgvGhcdTAwMWXQyXrunEqKy2qUazv7fo2+8HiYnTTlXHKpXHUwMDAxfG3UxjOqK3tkg4hcdTAwMTIj87v4yFx1MDAxOU9NoPMmWbdQMKpcdFxumJrXXHUwMDE3+S2gN/adpsmNK3JcdTAwMWXCaSqDc3yU5U25XHUwMDFlh6+g6CqrcPbJizNcdTAwMTeNXG5GZSeXxuG3oN7Z7bnM8dSYI2u5tipiT0PIKVx1MDAwN/7ZROauwcj5d07e9y+K+LDUR/vYXHUwMDEy5NbMdD2cxsqZ2Y9cdTAwMGLzXHUwMDAy71gzluXQXHUwMDFinFx0RFFcbpl5fkXS+FxiQD+d+8VE+rl56kFcYv3AUCBzWJNWX+pcdTAwMTek62Lftlx1MDAwMzBcZlx1MDAwM2FcdTAwMDHbR8hyTYv8elx1MDAxMnMnXHUwMDEy0Vx1MDAxMG/UYfVTcoOocrr2umrcM9tr8V/ZLlx1MDAwMW1rO1x1MDAxY1F+xG0v47b9XHUwMDEwV5j7POCy5I27XHUwMDAzyD8+jn9OfUzF/jJVgltPTy3Ot/Kfv8dRaZ6Z+LvW1koj64ZR9qb5ms9RXHUwMDA28/HgXHUwMDFmbTmuoTmqmKxcdTAwMDXz5W2a/btMUmv5US6cj1x1MDAxN81cXPNaJsL8YJX0Zlx1MDAwZWJcdTAwMWWFT26QUUd1Ouajv1x1MDAxOF9RKiVcdTAwMDBcdTAwMTI4NH8jOnTwzVLfg4qa1pLfWtJJLkg9qzB/vv9AtVx1MDAxNVx1MDAxMEP0iYlcdTAwMWTAgPKDfC87L3VcdTAwMThcdTAwMTFLx+tcZo3ybaFzXHUwMDE5QXPfJlx1MDAxN8Lj1dZQZ7pcdTAwMGXJn+9cdTAwMTfGw4zyYi7Lg1x1MDAxMje1Yd9cdTAwMTjQ+cGRXHUwMDAzk5/5PozKvFS6XVvjjbxZrlx1MDAxYaqeRzk3XHUwMDE5VVx1MDAwNahNQO/eplXtJVx1MDAwNiRLa4dcdTAwMGXzOvy74F14sm36XHJcdIj+VPn5weNSwXjCOj5/zWNDRcBcdTAwMDNQ2JhdhMCVbFSwXYIzOLWbaDP4xJclUopcdTAwMTh4Oy5DIcE6Lqpr6jNcdTAwMTc85eKrps1cdTAwMDYpfp7hZ6PHNNdjhu9Wz56RfkNx2c1cdTAwMDV7t7XBrl4vJcL6cON8JFx1MDAwM1x1MDAwNH3EM0wzuH+LdfhxrXNcdTAwMTNcdTAwMTndXHUwMDE5z1x1MDAwNUhz6tRcdHm/4+Z6zTxccngrXHUwMDE3klxmzT6YXHUwMDA2hth465h+21x1MDAxMTrxoc5cdTAwMTa1XHUwMDBmPz9oWLWRQSXsh1x1MDAxZud7nK63Y0dIqMljXnmlO3XI5vB+/km1zlx1MDAxYtSilShJXk9q5FlcdTAwMDZ8k1FdtrpcdTAwMDOejsS/XHUwMDFhXHUwMDExkTeYYzlJnbxyxU12tVx1MDAxNZdcdTAwMGZ7s2FWyTqz1ET9LeH9pCizXHUwMDFm21ZcdTAwMTBzsWsmOyxs5Fx1MDAxOaKOVGOyosZcdTAwMTihOEpgnpCsdM7fxWuCKOvv6jyPbte/X1x1MDAwMqjbtDiaynShOYFx+UGGfnaKkHr04ax6XHUwMDE19emPOMdcdTAwMTI3xrw1V9JcdTAwMDTQ5rWzyiREp6WjXHUwMDEz86SuvL/rkoSb/VtsyVqfiFn8hFwivVx1MDAwN3JDXFxLmuSa6m6rxpGgzM3yPK7ZRLXp4rw3Ruux7NqfUJVQ71H1Q31cdExcXPpOklx1MDAxZFxyTVx1MDAwMMtcdTAwMWHUXHSmiJizpjdC1lZbRfCEg6JcYjDxXVx1MDAwMP69RLQ06lsnQjJ7XHUwMDFmYrD1k8dWgNA2QaKxTidBpFx1MDAxObnWXHUwMDA0YP1cclx1MDAwMfuq5M+mISFi0bx/ebHJkcJLYW+XMlx1MDAxZVxmXHUwMDE0INH6XHUwMDFkbOTnyoQvPNDDcVx1MDAxNKAx15GOm1JIXyA6JJwuILxcdTAwMTE6g1BcdTAwMTFaiKhcdTAwMTaf5y0nnlx1MDAxYbbW6Zt0zFx1MDAxN25fR1x1MDAwN+u7PouCKF4yjUeyzbxgufZkguzr09X6jZqbr2yv7ShSo1pdyuKhbGdZKW/73otcdTAwMDW1+Sbb1JLq71xiz1x1MDAxMolRnkPSL0zFlVxc0oByXHUwMDE1XVx1MDAwZmKf5GE3XHUwMDFie75d0trQONO1pmZX8ESvfjB+peuSXHUwMDA14Fx1MDAxM9UgXHUwMDE0TVx1MDAwZd5mo6I/olG5pEmPi06qyLRcdTAwMDbwt7GU8eCG2sd8NO3DWtb52b5cdTAwMTGy0sjQQFx1MDAwNdnrn8+ez7VQvzlIYanfzXJcdTAwMTnekIA5Led9XcQxwrTEakuffD92548t5OVd4yjeXHUwMDAx74RmO1x1MDAwZmQgNY/Z70ZxyWqH8T2M+rGQMd1+hSMjiFx1MDAxM6zt1JMu11x1MDAxYtU6XHUwMDA1tVx1MDAxM1x1MDAxNGOL1aBpXq724b8j/Kpwv18w0TerVv1ukoqCI/w1LVewp2ZxeV9whImSpjsgK6NMqOrIlmafLMS3+lxyU0yI2ZaQ9Fx1MDAxZP3rpObEk6xPiMbRXHUwMDA1MvHV4dNcZlxmW/2Ww0fBhq5pXHUwMDAwyler13d1V4RrXHUwMDE0XHUwMDE1jfWBXHUwMDA0L9hcdTAwMTJY5s1dyXO3ZO7bL0V9XHUwMDE4yr3wgFx1MDAxYcJcdTAwMWSbbXb4/uDTL4LZmYq3wkS6vIRcdTAwMGZ+XHUwMDFlPIRGXCI+yT6el7koXHUwMDAytWjSXHUwMDEw+U/ljFxm5WTNd0RJ74klXHSXlC7MZcZw6m8/XHUwMDBiXGZcdTAwMDFF/8VaVWA+pnFcZlx1MDAxYa3ru+BcdTAwMTJcdTAwMDZ931x1MDAxOVxyXHUwMDBi+pJQiqtcdTAwMDCAOYGaLDxzpe3sXHUwMDEzfX2xXHUwMDE22fTXd1x1MDAxNZO2biVcXLx6Xrdhxfay2ZkjXHUwMDFkXHUwMDFi3mY9L4NSXHUwMDA22Y6P5rlcdTAwMTZAzDrz3CtcZlbWKt/81+XCoz548WJcdTAwMTRcdTAwMTZcdTAwMDNoSo6727Q5/TRsgKb6JVu6/Vs0Iyq40ZRDQ368WaJgXHUwMDE5XHUwMDFixMtcdTAwMGWg30k+h41kMU90Ps+zXHUwMDA30dMy6LFaijXvp6/wxs5pKziyXHUwMDAxui7hOozxw3bfXHUwMDFkMrW7Lij4XFy4YZgl/vNQYJK5R5xujLje3kPg9Fx1MDAxYtgkh8NXxlxyyic7IFx1MDAwNH5cdTAwMDCohlxyPsovXHUwMDEz2tKm7XjL6pg/xJL0nFx1MDAwMlx1MDAwNVx1MDAxZCVSXHUwMDBlXGZAXGbnXHUwMDE29ad/XHUwMDFhTlBBtPPVipzvdTlfXHUwMDAxXGJcdTAwMTLTQ0fboKLnPYBG+M7hI3xcdTAwMDRcIsBdS606S4vqny2IKFx1MDAxNDGNom9+XHUwMDFkK5a+525xXHUwMDA3p7Rt3WBcdTAwMTNcdTAwMTeS/axcdTAwMDVcIp5cdTAwMWVyxMP8NY/bfuRcdTAwMDVcdTAwMDfUPdsjml9cdTAwMTNCUNnQ1U9cdTAwMWPKXHUwMDFmLlJcdEfpjFe4y3jUqpumO+ZXpFm57qZcdPzFhuc++M2LR30smyUz7lx1MDAwNd+9q1x1MDAwNUtAde43pFx1MDAwNomiqJLiOs7yXHUwMDFkboSeXHUwMDA2K/Q4RJJrtZorz87b24NcdTAwMGVQZ0xcdTAwMThTXUA9O1x1MDAwNtZTk5PymFx1MDAxOFIriLFyuLWOXHUwMDFihM4oMCqvPcDR8KU42mIz1MyB9jVcdTAwMTOvXGbTPC9cdTAwMWJxyGqbV0fxJdWXLIxnmN5cdTAwMDO/fuyt5za7beenPpPa45NccubPmDnujbZcdTAwMTFK1+tpXHUwMDFlzV8s/1xuO8rVL3nqWFi5wFx1MDAxONC623171Vx1MDAwN0xcdTAwMWWNj05JeC11eCpcdTAwMTJ76eyvyVFCeJhGu5Gi61x1MDAwNMdcdTAwMTYlV9tNTT6KPvI31UyPelhsfmdCa2U+XHUwMDEw44rJ0clTX1wilnJ2u/NcdTAwMTLdvy1aZlC/T1k8LVAlOyQv6IXbb+CeiFx1MDAxMkrodXLSn5rwbGKpqzfLJG3+TYHhXGJ28OtcdTAwMDLzaUaEhHvL99zjXHUwMDE4R5RcdTAwMTReMpdnNDUtYMBYu3Rqh1x1MDAxYYYkmuip9fRcYq3BU7eiiMBnpEO6Ov/EXHUwMDFlMcdA+nueq/NcdTAwMWZy1r+rTT0hd8Ql8GHYlFx1MDAwNPzV1iyKldJEXHTFulti/HXE9SyO44S6YVDxozRcdTAwMTZNQ3CaXHUwMDFmXHUwMDEwUFx1MDAwN0+b5s8zbGphgTD2o4Yn+/1cdTAwMWOQP7py5uCiX1x1MDAxMiPNLIgzXHUwMDAzgbpcdTAwMDb8XHUwMDA3P+2rhIFr11x1MDAxYSUt38FcZlx1MDAxNomIXHUwMDAzLKEtflxuOD9IXHUwMDE5XHTMmre232GHllFcdTAwMTB/YMnLcbtwLUpgjkukXHUwMDBlOdMyhED9sN5I+jnlJi3o81x1MDAxOSnb71/tUOmYddCDflx1MDAwYlxiXHUwMDFlwNNcdTAwMWFlPZCzvyfK4fKSpEuEpDJcdTAwMTIr0qxcXGWWMaJcdTAwMGLOKlx1MDAxMXxJ01eclsw+0vq+XHUwMDAwgdTZnld3oVIzQ7M1bn6m6fpSqlx1MDAxYkV2XVx1MDAwNWaTfaV2/MBnUHU09jwoP6+Pulkpm1x1MDAxZPmtd6zdOlx1MDAxMDSwcHJcdTAwMWXih1x1MDAxZmGoJ4rkO/BccpIzVc5cdTAwMTRePVx1MDAwM/JcdTAwMDVk54m5oFxmYU5cdTAwMTmyytlzn1x1MDAwZs3nhVx1MDAxOUBqZ9B1p+QvnE5cbke0qXagmlOluzV1qMswwlwihLhQb1x1MDAxMP8lpjJ/rbSodYUwzsgv7j54IUF58LBcdI74Qlwid3mqVsPn4Fx1MDAwM+tZKFx1MDAxZX51wdTnPPnsaWWG0HhcdTAwMGLhujhuIVW2PbYhN8dtgL/rXHUwMDFjPtnblFCyS1xctY3xwPthI/SyzExJ/3118ENx8Fx1MDAwMkUp64pYKeeL3FmVS1x1MDAxZfD4t193nOrimDbzXHUwMDEz1ZOoqz86yjdSd1x1MDAxZYmvqbVW8DP+KjMlfsnA39m/W1x1MDAxNcuelYdJLufM66pDfC1F7Vx1MDAxZeCw5uwhT1x1MDAwMTlcdTAwMDYgKsr4xFx1MDAxYlh9ZU1/KqtcdTAwMTBnPa3VbZMyg6m6Mlx1MDAxZMsmXFxG+eru35JpcIYynvdcdTAwMTlwK1x1MDAxZW8hP5+c50CgtHOl3vl6l6PAtnnfQui7i13VfeRMvlx1MDAxZbm6OP2LfSGkXHUwMDFhyjSPhNexz0uBoen8RNakyCDJw/5cdTAwMDVcdTAwMGVcdTAwMGY+dTyUXHUwMDE3V1x1MDAwNlx1MDAwYlx1MDAxNpl86lxigGNQqSfE/Vk/Y2+ez+1bScFja4BrMXsjWYVcdTAwMDQzg4FzgErV6j86w4+mUexfuCCpI1x1MDAwNWD114LmXHUwMDA3+NifXHUwMDE1bNfd8tu6XvblqvXP11x1MDAxYbVEQqiJ7PqEXHUwMDA3qLlDnnC16+170N7s6eXSwSbk4FlcdTAwMWaz4t03Xz2u0vYgPuS+2IJcdTAwMGL87bfYTFx1MDAxYVx1MDAwZV1k0r8h96KreVxy8PNtmZ/JOyrDcs1tXHUwMDFmllcpYTJNKFx1MDAxMHu/1HBsXHUwMDFiQJPxRYBcdTAwMWFcdTAwMDGuliBQ0dMgXG7PTVFcdTAwMDJcdTAwMWM980Je6PlcdTAwMWZmSrZHLFGRfSasKa7lSlx1MDAxN/lcdTAwMDR466NccmEg3WgvszWxO3xcdTAwMWJC181cXGBF47mzJkBhw2roTY+44jO7eFx1MDAwNPdoSyfxMfj5tjn6mu2nNFx1MDAxMsVcdTAwMGXPmZlLh74nXHUwMDA1Ne/j85lcdTAwMGbTTV5svYpzRXFcdTAwMDJxQGh+2FeD3n5pXHUwMDE3XHUwMDFhNWC9pqzYMyndrPcrXZ83XHUwMDBlk+DHQ+s5bINLI0RcdTAwMDBhn1x1MDAwYjS9SKVVWquaM19cYkS3/s7y82S8X+9cdTAwMDCVmzl9rUPCf1xcxY3bLbTZXjTYfny+L1ZcdTAwMWPwnip8XHUwMDA3ffhoQb7m9+rTdNeEtE60K+/qXz1gpVx1MDAxOe2fn2PjXHUwMDFly3VCPvV93CplTVEwXHUwMDFj6UU4oSSIrSiHzuibk0iRxXmLVpiVwOTPXHUwMDE18qeYTLP8LpP3XHUwMDExy0NcdTAwMWNCfN3elVx1MDAxNrn+Oe3+YJRhM++7qf52c8GWXHUwMDE2+ntcdTAwMWXAy1x1MDAxM8m2ZXml6opcdTAwMDDcuVFcIp9Xkqy2XHUwMDFk3iRcdTAwMGJxbtIuXHUwMDAyXHUwMDFiv1x1MDAxNuJin6xcdTAwMWSN7ktcdTAwMDU250xUOM/SLp/Ei1K/waHVPplcdTAwMGJcdTAwMGW2fd7vz7lcdTAwMWbGqMTo21VcZixo36omZVx1MDAwZlboW8KS3knGXGJcZsfMp/UrzIum6p+pZVx1MDAxZCRhucrnSNsywYlWq32ej0JcdTAwMTSEf3tp5vVcdTAwMDbmZPO6RSSQnz1Mblx1MDAxZLj5XHUwMDEwMMyTpa90syPNrbbEzuRPXHUwMDAzpUtvk89HVt+O5lx1MDAwM1x1MDAxNdiYkViD81JB8D4r6kxcdTAwMTHLp8Y1kFx1MDAxZcIvsdT9OEIyrL9ClVx1MDAwZu9dXHUwMDFmOOHEYaFcdTAwMDKIZ5BQXGJcYiVV1L87ocp4fqVL4VS5c4bfjySJyZVcdTAwMDFTS1x1MDAxMuC0SVx1MDAxM69cdTAwMWbVXGbvrSsk51x1MDAxM1frOrhrLH3fmVx1MDAxN4SZ768uXHUwMDFiZzHSXHUwMDA0oNfhrMCIXHUwMDA18lx1MDAxNlx1MDAxNY5dR6yFwlx1MDAwM3JG19aS0z1oZZDGNlxmnTLVq6TiV1qN5CTG64tcdTAwMWaarURHTvNcdTAwMWHXyaF+7o9cdTAwMTl9OPVTuFx1MDAxZVxiNWxZeuhbaOdE2VpcIlxmTMnZ9XBSfmVPUlx0XHUwMDE4XXH+ajis0mqW5WhvXHUwMDEwXHUwMDE2q17ZwVazKKlHfj5stKRUbHM61Dhla81dbD+v01x1MDAwZp8ynbDt6lr+XHUwMDBiYMknOopcIi1cdTAwMDG1p5tcdTAwMTNccp2LqK+oXHUwMDBluZl1gKP01J85wd+Uobtmp43hyVwiNOY3c24xMO9OqzpxnlshXG7cYdr5cqindv5cdTAwMTV/L3v45TqNXHUwMDE4yZe0Ndc5O1xyX0bQi/uZjzt+2lJA25RcctJ0aqd/9NjTQsTwbLlw08pYzp1pXHUwMDE0d6j+zFx1MDAwNJJcdTAwMDQqduDAKIRq5cCjuZPeXHUwMDE28fYk3VxcKJ7pIFxykXs7rEj/fHtGQFfZZ6ddXHUwMDFlmLxHY0Zy+sz42OgmPbuXuFSkW1x1MDAwMf/+11x1MDAxNPvB7sXCelxybdKUvn5diVxiqzlvXHUwMDAy3ZrEM70yb9QrknAjalSIrFx1MDAwYl3m91b7ttpcdTAwMDPmXHRNQHSj/5bWZyWqymQoJumkUOnw86tcdF/NIdLCMVx1MDAxOEF65V2Sp3pxcJLaXsfD5HLKjGBX9uK45SpcdTAwMWR2114xVlx1MDAxMFx1MDAxMmmtXHUwMDFl2c2E7vNcdTAwMTDzyO1cdTAwMTRGY7BVSY9GJl1+2HhaoZHrXHUwMDFli7fTXHUwMDAzXCKuJPBcdTAwMDUylYar+GZF7vj7viY5XHUwMDE5p1x1MDAwNVx1MDAxMWhBkJTe93LbXHUwMDEwXGaJ0lx1MDAxNyo8rUzc2stxsdQ+KsYxnsN4QFxyqYe33r2kuU+wj2XMrMWZflx1MDAxZlDKbmlSXHJiZ6RQruxJPrN8Z8OY5C8ugO5nXHUwMDBi1uaE47yISoIgXHUwMDE49u3G5fR0b6Tp8LAq3o7Xuuo3vjR4xl6wMclb/zcqir1cdTAwMDJtresr1JxZ8qMmxkKLXHUwMDFh9bxcdTAwMDU0XFyYcGrU6oNNpY0g/GVQ21uR4lx1MDAxYqLUvl974IDqXFyB6dz2y1x1MDAxMsz7XGZEadWaXHUwMDFiYVx1MDAxNe4gNdJisna16Vx1MDAxYSwlL0zVXHUwMDFmXHUwMDFh1b1cblxc7N619bH33noxXlNUIzNa1dhjQFxyXHUwMDExv1x1MDAxZIGMrVx1MDAwNlNcdTAwMTfE8axpOFx1MDAxZCZ4O1x1MDAwYvxejOt+fkc2qcJ2kFwifVkvXHUwMDFi0mapYUpcdTAwMGJkmYNcdTAwMWJcdTAwMTlYgENOveiag6uBXHRvdH9cdTAwMTRisrdB6pxd9mry2Fx1MDAxM04h+l9cXGKlXHUwMDFmZlFcdLBUXHUwMDE3WZXZXHQtXFyUPrFcdTAwMDUhXHUwMDBmmTVZXG6/p/a09UBcXPpcdTAwMDRcdTAwMDBcdTAwMThBd1lVgcNcdTAwMGa+XHUwMDEwXGbW3Xra+eOZwSZcZoeLMSPa1Xj1/ZWsXSkza4ubpFxuzZ1kJj2nXCKqStA8YmxUvJ2RXHUwMDAwxGY8XFzXinzOnv7pPHrJ8PhIi99us4m+v51ScVx1MDAwMvvAKWt5gKsjzuhcdTAwMWSRTzk10/VIi+4vqY5IrV1cdTAwMDO7hTYjXGantV7ZOfPGXHUwMDE2iUXFXHUwMDExXHUwMDAy0ZVFXHUwMDEw50TddcAsXHIoV85cdTAwMDU85Vx1MDAxMoyeXHUwMDA0qYdmZFx1MDAwMINuQmTxoiBcdTAwMDJo4K9yXHUwMDFhU/dcdTAwMTFcdTAwMWTBglxmefpxc27g6lXnjWdcdTAwMWLrjrZw/zV3llx1MDAxZKtWXGb3mFx1MDAwMcJcdTAwMTIzdYqXUT/KY81cdTAwMDXBwVx1MDAwN1x1MDAxMYf4XHUwMDAwOC6wXHUwMDAwXHUwMDEwI0VvX1+iZlx1MDAxMVx1MDAxMme1XHUwMDEwVku/uE6EWd7DXHUwMDA00SPFYHUlXG7rOKhcItm+oIFRdTwkIUrwb/xcdTAwMTnJTSzXuYT9wmhvRLqlV/lcdTAwMDZueK03qLB3an51mmnhyfHidX2M5pNcdTAwMWJcXFx1MDAxZth1vsN3XHUwMDA2NVx1MDAxZlx1MDAwZuw4I5xxW07fnlx1MDAxZGtp/y7SJPp9YCNcdTAwMTO/gqaZaFSo56n2i99cXFi6h79cdTAwMWb6clRgvVvgN6GaME2rkS+K8au0n2XAbErzXHUwMDBlXHUwMDFk21PkOJvc6qYnnIbSXHUwMDFhXHUwMDFhyoCwKy056Gt5r+XNMMRcdTAwMDZenZqwJrj3rLOKfetccqvzw1x1MDAwNi5UuiHTXHUwMDE3h++2km8p9XXOzTvqeGNcZk30kFx1MDAxYXuvTFx1MDAxZYJqXHUwMDFjoW/qI+5U31CfL9KR+GHKovhcdTAwMDHY31x1MDAwZrmmgubBplpgqtLmrJfqgVpM7SnN5jevmvYrPPKHbV2SUCvqIcbsfH5cdTAwMWFukIh2utv9SC40x1x1MDAxYTBbeKkg+084Z4X4ae6LVWfsM55v78Qg+OZkXHUwMDFjXHUwMDFkuCyGgWlcdTAwMDMg2lx1MDAxNVxm3rix+DFZX9dcdTAwMTemXHUwMDBlJexcdTAwMTE2gnmxuJt27Divdlx1MDAxOYwyn8HKy3ykhslax1x1MDAxNelK3o/qOH9cdTAwMTXTrujrlkLvXGJG3NpYTiilIW3p0UNcdTAwMDb6J4uEXHUwMDA0XHUwMDFkXHUwMDE3yvVm/3xCU/uNI1xm/tLo91iXMlx1MDAwN809UFx1MDAwZVx1MDAxNZmUxmjnsorXprBcdTAwMTn+iWHtNfZcdTAwMWbLf0T3cDNcdTAwMTAsaYgoNFx1MDAxYTbVXHUwMDBl1vq/8yD7V+ovulx1MDAxM7yOrshjuPLR/1lHXHUwMDBmJtlxXHUwMDAwXFxPbstSXHUwMDEwiuQway42p0TH+4K6uj5Ttod7gjpcdTAwMTRwPsRcdTAwMDXtNtjc6Ea6i9zmU1x1MDAxY1JBisFcdTAwMWOsM7VIuCjN6aVcdTAwMTJcYsXrnVx1MDAxOFx1MDAxYj/SUXVIsX/b++1Njl1WOtjLXHUwMDFkKHOtN2ZcZupBo8Veip1cdTAwMTB/V+UrsidY/upZylg7zDz2fZZsLq94NJg0tploejlssdzA9aNcdTAwMDDHp/nhX2w7QunsiWREgcL4vJzVxHGOXHUwMDEwXHUwMDA2epk+zpg99yPuvt47cSNcdTAwMTTmWitcdTAwMTVZ+FmDVplcdTAwMTDU0Zj243RcYiYq0ay8XHUwMDBlxVx1MDAxN2hSTVx1MDAwYiW3JVxmcDdIN/hcdTAwMDZCjyhcdTAwMWFcdTAwMTWZt3yP1PfwXHUwMDE3alx1MDAxOFx1MDAwN/6qlVxiZC5y0/Qoqbp2yoNQvFFcdTAwMWGK0/fg9NA3dUBcblsle+JAMCmNQrZD79XWXHUwMDA2JoFo41x1MDAxMY2Ia0Ho5u1vbTzwMJc+cDJjXlx1MDAwYlxmWXMlhok2nuYxZVx1MDAwN6HqbeiBgfRcdTAwMTNgXHUwMDExjjaeycfV0ny5S/c0pHWf2s6KU+NEMaU7XCL7XHI/nHqK4c382Xd3cfBC2tl/Uq/k1Fx1MDAwNCw/bUJcdTAwMWXEmsWQmpeyXHUwMDFlV3Gr2G9lKjhcdTAwMWWXaN/YOyt9j1rQz9Ta3lx1MDAwMSNa5Gq/VJe/aFFcdTAwMTTAR+FcdTAwMWVokkiaqFx1MDAwZmuEOD610dte5WU7iV5qw5/OXHUwMDA3t25pOmok+Vx1MDAxOXlDpFx1MDAwZUouUDqCXHUwMDA2KzuHJUrMXHUwMDE3YPhNXHUwMDEySLVcdTAwMTOZ9pzoQ4ihUcy3XHUwMDFl01x1MDAwNlx1MDAwNVx1MDAwYlx1MDAxZFx1MDAxM9LBZOz/VjNcdTAwMDVy+tN457s4roJcdTAwMWL1Wfe4Plx1MDAxOVx1MDAxZNyDrVwibZP6pXRcdTAwMWGmlVx1MDAwNcY3U7PWpjuTJVxy61x1MDAwN1x1MDAwMT68kd7m7EfKmy5cdTAwMDJ3L621Runs0S+eXHUwMDFlhfnRXHUwMDEz52bjQE5cYichaWbtc82H/oYtaPyhaf2Z1Uv52UzhS1x0KC1cdTAwMWR3sYd1WMfQICl3Q5W1XHUwMDA3w4mHYEiNXHUwMDEwyFx1MDAxM1tWekJcdTAwMDLON7f3KVaGXHUwMDAynfdfY+st5tJDXHUwMDA04Gg2k9R/oYv005njXFy7naz6eSdcIibWvjIhj25ccnFua1wi2lx1MDAxOHpcdTAwMWXlgi7k12l21WIkXn7F7u6/Ie79oP1cdTAwMDZcdTAwMDBcdTAwMDRHMY30XHUwMDBlJq4lXHUwMDFiVyNcdTAwMTRcdTAwMTTJhjJPWFW6gCnUWJBg51x1MDAwMZ06ZbtsZ1x1MDAxNeXGxS3LYISAuaXZWkigXHUwMDAzQfrb/I3Yo9rSWVx1MDAwMU+fTktxXpqzRleWOjlsX4WWIZFwXHUwMDAzuGucaSxcdTAwMWTeK5RGPEDU9f0mpVx1MDAxNlx1MDAwNKxcdTAwMWZhzUSsn/dcdTAwMGVcdFx1MDAxMKtcbrJsxCXP/2JUR1x1MDAxYYZyZMybXHUwMDA3sW3Qj+BgXHUwMDAwXHUwMDAxsZj4OZZcdTAwMDBcdTAwMDaee8ZwRuFMUYxccnFcZljeaXGF9JWoX76jT1+i0S6A3VlRXHUwMDBmWfY1vpUvJHBcIlVcdTAwMDaLoN+ZUvwk4DREx6RBsFx1MDAxY3ZcdTAwMTKcN+FoXHUwMDA1UcRcdTAwMDKPNnjG86LPy7HalJoqX6Px77aIUfRHKyFcdTAwMDPrioS7OeYmOoTnXHUwMDE2LiG9ZWS595pjvVx1MDAxZVx1MDAxOTXaUMqnXHUwMDA3i5WMXGKodiSUsCqtRFx0a3yDd56HRXrlf4pcIieHLFx1MDAxOY2XL+8gMYc1cI9cdTAwMDFohKv04z3JqrGJR9Fi5lxy3Fx1MDAxMFx1MDAwM6OclaCgV93D9fIj9e/920rYviYue1x1MDAxZC5NVN0+QDf92mHE43edwDxcdTAwMTPTI1x1MDAwMXi+1t/WupbpV1x1MDAxNyq2Rn9dMchki5QoXHUwMDE32T9+dOnGr7hfg1xmwVM8I8c6XHUwMDFm9ovoXHUwMDFkzkLuw9dXOX1wwpddUffPb0hXgs465evc1EgnjV6vr8clratcdTAwMTO8J/hcdTAwMWY/L55XXHLC9Fd1J1x1MDAxOK/OXHUwMDFjVzSqprmX2Zxr+JdBg9SWXHUwMDFiwp9cdTAwMDbB46XIM6WCcFx1MDAxN2K90aTBV5LcMFv2XHKxz2hL191cdTAwMTR6hFxiJjhPXHUwMDE4eKbYN3UwQlxiXHUwMDE2we9cdTAwMDLeQvxrXHUwMDE0ZdynzkQvz6L42NH2zUjcXHUwMDE4RDiDXHUwMDEwZJwvV2Ozk1xiy4zslE6JaoLuYfBJk7AuTOZcdTAwMTk8XHUwMDEyWCTOtLBl4yevtz+wXHUwMDA1/eoqxVCgjSE+VutcdTAwMWVQXHUwMDFjbdyPTf9cdTAwMThcZlXgpPsrkYFcdTAwMDTFgTQkXGJZZC5TOllmw4C3k6ZZlu06y0Hc0qPa09dcdTAwMWLM9PNhqHmcIXRcdTAwMTWlNJ3C/URpXHUwMDBmnLFh81x1MDAwMMppXHUwMDAz3Vx1MDAwMvn1rt306EdcYtulSZSVX1x0mFx1MDAwZtPQ689cdTAwMDFnru8srlx1MDAxY59bcfqgW8FcdTAwMGYyj8vE23JanuDfLVx1MDAwYrsqZGP6yzyP9aK/u/qt7tQ/aa1cdLKu3lx1MDAxM807XHUwMDAwlY3xXHUwMDE5oZRcdTAwMWbFg23oZtKvM4WDs3xcdTAwMTamscGhcvaSRlwi8FNQXHUwMDE41jmPk0rXdd3s37Pjozn7ZvtyybjROVdRM0rK8nhcdTAwMDCHgf1od1x1MDAxNnAg78VcdTAwMGWp7ax+xH6aXHUwMDA0Z9ogXHUwMDA1ulB+8Hrry5bpXHUwMDBmRVj3erPMr4uzpO/FXHUwMDE5h2qSPZGiXFyjRzHkpbAoWKDD3GTHXGLYmsn5lUtizkInLlxmJ07ixpbrW0U/qMvS6YnXpo7bXHUwMDE5WLNZRc6ZW9iUtrGDXHUwMDBiXHUwMDAzXHUwMDE3VGvvlcV/6F5jL1x1MDAwZlfn31x1MDAxYtbHiiPOzH9J0vdhlFx1MDAwMJFRPbu6TvuPRX3vb9j0QtMjTFxm8HDk7SS4v5VA/cFcdTAwMWZFRmihlFx1MDAwMElTXHUwMDA0YHipzHtcdTAwMDcrXHUwMDE1SpArXHUwMDFlw61UINvKq0SVXHUwMDA10bmPpvJolUp7tyczbY+ImlTif1wimOWoXHUwMDAz01xmRPdcdTAwMTGrxJnKeNrErOH67+lFqfqNmXa2XFwnqDajk6ZeS4ViyIFcdTAwMTdObWN4IZowPt3wXHUwMDFle9+5sjri11C/Us0ysVl3aodWXHUwMDFiye0/XCLnXHUwMDFmoGlx/lx1MDAwNG0t2O9cdTAwMTJcdTAwMGaGiaVcdTAwMTX0XGZUwzgwMEuwRreTo76lXHUwMDE528dNpFpoXHUwMDEywi+oeVMsit9VXHRqqlx1MDAwNUA90IG+s0msn1x1MDAxOKX5+lx1MDAxNWtV3kfXQIKRvOiHYoph7utdwFx1MDAxOPZcdTAwMTlcdTAwMTZcdTAwMDSG63WMXHUwMDAznMLQNGOCXHUwMDFmLFx1MDAxYU7bNlx1MDAxYpimLVDkQIrZLv/NQ5ojuf7GWH2Go9Ow8SiQUmF5qXOj3qa8MJZ6svVEm4BcdTAwMTGVTedcdTAwMWP2LX3Mc+FgXCJzi/BcdTAwMTD/sLzWt3LYXHUwMDE44FG9cVqVXGKXgNL1jD13vl5cdTAwMTk/cZa7ZuK2y7RcXG8olKTp050k7ko4IbtjsYzt30Pr8JBmXHUwMDFl6exWNlxmbf3xJKZVeF06WWlcdTAwMWWdpiFJXb+Q91x1MDAwM/856ohcdTAwMTJYv1x1MDAwNftMRKbpY+lcdTAwMTGAuNJcdTAwMWFVQ1x1MDAxZLR+IKuWXHUwMDEznSf8Rnm3i3H+2Fx1MDAwN1x1MDAwMOXsN/Q6gClqy+2FM45cdTAwMDdX0krkspnO5q1ge+3wXHUwMDBifmVcdTAwMWX9XHUwMDE0wf6NeJxbg/2zfFx04CdcdTAwMGKi5oWUn95V/kLErb40XHUwMDEzYkOeZFx0g33RQyFp7G/X590sivvzIeiWwiuBXHJk0LpccsKfblx1MDAxMdnWRSw8sJ1gqm7wm9+Q1EvzU25y6cHWXHUwMDFl3Vx1MDAwM0hAalx1MDAxYfhVcVx0MDW/jdpYt2Wo2DbXXHUwMDFmdFx1MDAxMqZZVVxuz7fnS12bPzLaMm1cdTAwMTWzzuuSQnJcXFx1MDAxNPK7y8T6pbWx7+90NNlcZnzP33XBlnZf1k9W88L+oK1cdTAwMTemtfJ5R4zA6d+vyLZ0R4SH7N9cboRcdTAwMTLC/0po0tzqb9HcJWXmrLLy6UxcdTAwMTPXJORcdTAwMTdqIF8ygJTZalx1MDAxMsI2X7TZzS5fqPN941x1MDAxMXLN89YqhVx1MDAxNdTeTD3LXHI0iW1WQ/co1SZfOHeRXHUwMDE25tTt0VC7xk1ns4ryokErxFx1MDAxNOUz3Ot0uZu5T/pcdTAwMWXAvHlMw1RcdTAwMTG1cog34Yq1vonPVVSg0KRcItMw4zZjbKtvYlx1MDAxMy65SWwzS3RGQi39uMRcdTAwMDQ1kis8Uth2KrLg1OY1sEmvtZLafeRPyFx1MDAxMJ+pK9s3LTtcdTAwMDagTdhpXHUwMDA1zlAhtOjP1DyrKOEqklx1MDAwYjCdg1x1MDAxMXaauEFcdTAwMGWWNClcdTAwMDNqyd95XGZmtZmOMaOioCjTQjo954lcdTAwMDdWqjni7Vpw+4VcInhWL1xcePZpIGWiP+36vsSmrlx1MDAwM2pd359cZrOD3pVcdTAwMDdhXHUwMDFjQd1QXGaUYfIjQD/26MZcdERYdrxcdTAwMDKUMq2qk1x1MDAxOFx1MDAxY/QpPVrdaFx1MDAxY+VElFwiVL5n9LFWO1x1MDAxNpFdXHUwMDE12jM98lx1MDAxNXSyXZdcYlx1MDAxYffB/Vx1MDAxNmnwsoPxj/bNkbyxypOsSHtb0kBcdTAwMDY0XHUwMDBmm+c052LKmW33rXn9OVx1MDAwNST6sVhBxr+QUtppSuPS8eZYhlKO+lVkWJZkclY0R38y08sh16mioKdcdTAwMTSx9Vx1MDAxMqox1HuNglx1MDAxMNCgm5VcdTAwMTAh9CnPqlx1MDAxY1urQTQvqZlcdTAwMTg+oeFB8PdK8FHr2nTSx8RHXHKzXHUwMDFhYVF4X580xHuess23sK3x0spJ8Fx1MDAwMfZuuuFNK/5TfJ5cdTAwMDNHXCL/d9KCiarLXHUwMDA0PnSFV7dcdTAwMTZTx0N7XHUwMDAwj75EpSXb9fy8SOHn8ZA27VuuuN3IUzhw3/bbJ07yt8takVdeTlx1MDAxYVNcdTAwMDdcXFwiMlx1MDAxMbRcdTAwMTCub371532HSqEuTLlcXGVuM+xXnS7xylxyXHUwMDFl2Vx1MDAwNXb+MieEXHUwMDBidawqXHUwMDA2sVxiylx1MDAwZnJsoFglOTFcdTAwMDVcdTAwMDdwKy/LX+yTlIrM9nKtLLHFsbjYXHUwMDExKLmF2vnxtVx1MDAwN6Jyt1x1MDAxN1x1MDAwM3r0gdFfcD08rNJwm6iwXHUwMDEywP34kHI+QXg5qtVFoNpcdTAwMWNcdTAwMTW/wztu7LJD7XPfPF9FnjxmXHUwMDAwkvp3LuSLyEpcbvHvL5OlIWa51Fx1MDAwZaPQPrSesdBH1YfNXHUwMDEzRFx1MDAwZp2Z4/BcdTAwMDLjZiy9NTZStb+Qeqz0fqRcdTAwMTe+hvjBXHUwMDA1xODkOF+wcs/iXHUwMDE5ouSAj5RHhuFcdTAwMGY/N2XzXHT+u5wrXHUwMDFhXHUwMDE3jv5CgYfijVx1MDAwZsVNa1x0/sugi7B3mvqFwPVcdTAwMTNfkiGDg4Fm6KukVDRcdTAwMTFcdJlcdTAwMTlcdTAwMDNcdTAwMWFcbt9cdTAwMTT62/WJXHUwMDBmXHUwMDA2/mFHJ+5cdTAwMGJcdTAwMTmTpVx1MDAxNlx1MDAwNb62m/69sZ+jXpGjcl0kuD2w3Vx1MDAwM7P9MFx1MDAxMDjJQpnvplx1MDAwZVx1MDAxN1x1MDAxNNppVnjT2Fx1MDAxNO5fv7V1XHUwMDE0i7D5znW/uVx0lrZcdTAwMTWLY5JcdTAwMWFcdTAwMDKaJVx1MDAxOD2czX0waJFRa1x1MDAxM1x1MDAxNbQkzYzT26R0wrz8o9ei/lx1MDAxYfFZNVx1MDAwMa9J7v42STTRTYPk15fXXHUwMDBlXHUwMDAwdbVnp+4qTHpL9F53v0TXXHUwMDA3zG+kmzZrLvyt56vOOCVFsFP/0+H2XHUwMDEx5C+GWkGamrb9XHUwMDBibFx1MDAxNERhZHXzvLjQRnTmd2xW4YSzT+mItqBcdTAwMTc3zvVgdPny7s55YDcgv3Ux1Fxy3TBea1xc1uXfXHKMttXKSiONN1g95rhIXHUwMDFmMu6I+p1h3z5cdTAwMTCXpVx1MDAxN9ZJX2AsMZNCy+tcdTAwMWW73Vx1MDAxM4nfor8zXHUwMDA1XHUwMDAxKcVYflx1MDAxNffNoktRoFx1MDAxMPh3hYxfe5imeYEwgqiLi7z+XHQ3buDzXHUwMDAw257p+5o6XHUwMDE431nwXHUwMDA2SoFcIvRcdTAwMDSFlWjS2881TLbpcKpvWEnsM2Qgazin6i1jXHUwMDEzoVx1MDAxNFxcj/N+I6iGY942MIJnXGLh5s7CeFx1MDAxOdfOXeGXmXrPXHUwMDEx/K/ra82hNujYy6Vd7qTBNlx1MDAwNUr45kbkqn5J3yl1N8xd5vqiPFJcdTAwMWKs5HeOP8mNi+pcdTAwMTlcdTAwMTJcdTAwMTJ2jHJdkVx1MDAwMOe42Pcr3zNIP7eGOvjm+ynEx1x1MDAwMFx1MDAxNl7EXHUwMDBmlSSw1lWLcm72vv+wXHJ9XHUwMDE2m2xkXHUwMDE3is0htN2SXHUwMDAyxua582rX81qMreT1XGZYZOC+R1x1MDAxYe5DmZOQoZWdrdIkVM2McTu6vbOrY9+UZNfnXHJcdTAwMDBcdTAwMWHoTqO6pIitVVx1MDAxZbpOKsCA7ydcdTAwMDRQXCLPS93Zk1DOf7tgNlx1MDAwZlwiXGZcdTAwMGI+/Can9ZamazndXCKN9jfrtqNpnVxiXHUwMDFhbVxmXHUwMDA36IX4MJxcdTAwMDJZZNTZXHUwMDE2ePUkTe+CaV3x7+x0/c1cdTAwMWKoOkpcbky3/CWjSYplwnNcdTAwMTj8I1x1MDAxOVx1MDAxM8rMyVx1MDAxN5bIr6XbMFsxuz3K1eUl30kzy+WTXCKkT5KvPzb19ybyhUTqa1x1MDAxMc9cdTAwMTHpt+lcZqStSdyCQlx1MDAxMSkuUFxumzVbXHUwMDE0P8r9a1x1MDAwMCzGZ5xohyFcdTAwMWTholx1MDAwMPWoaVJAXHUwMDFh1DpedOzhTrfC5KOCYCxDjS2kUlwid8exr1x1MDAwMzlcdTAwMWRPlcpim1x1MDAxNpODmZ2/bY6CTpGaKDaA3lLaxFx1MDAxMbpcdTAwMWTRXHUwMDBmSdtcdTAwMWJCOunxI7JRoSYlXHUwMDE1eYKlkUxzOr5cdTAwMGLDkjAqhuDu1bw2d2aJ4EGP+pIhslx1MDAwM++eg42xca40dVx1MDAxY5/ztsdPtDtcYrbrr1x1MDAwMND0flre3+mrM8q8UIxlLPS7XHUwMDEyWVx1MDAxMHPSj2+bXHKYktXXk0MsXHUwMDEyl3Ku9DA9rlx1MDAxOb8k6uu0K51cdTAwMWGUg4en/vYvXHUwMDFlucz2O791reomN4lIXHUwMDA3YFx1MDAxYdL7XHUwMDE4k03KmdhcdTAwMTb+3Zpq833heoCNXHUwMDBl/TEyo/A1aaVjV1wiKZ/103ExViVcdTAwMGVcdTAwMWNcdTAwMWE/SVJfXYScXHUwMDFidVx1MDAxOb5hts1cdTAwMGVcdTAwMTCJwV9Ty7GsQrFcdTAwMTdMLX+Q9lx0Tm1cctdFNI26+DiRJZ+jXG51qHOfcDM7eOwp3lx1MDAxNWypTJ1XII6nlislIYi6qTs/NHm6aei69/1cdTAwMGJcdTAwMWVcdTAwMDExxaxx48i37tGhqlx1MDAwZWfq1osqkFx1MDAwZlx1MDAxM6ioXGJY/LzHwFx1MDAxY6LorCdxdeVcdTAwMTLMOdebXHUwMDE0XHUwMDE3i6yeXHUwMDA3KIIgSPZbXHUwMDE0qVx1MDAwNiFcIlZcdTAwMDHZMU2JZqxBVJU9W1x1MDAxZFx1MDAwNE1pP1XyStxcdTAwMDNxMNL8joR5ksg8wUvUX6R5r0PA8TlcdTAwMDbyp7Fz8/SKprlcdTAwMWJ/JMxcdTAwMWFcdTAwMDVSXHUwMDFk73xO8r6SzSx5tamnl0T831x1MDAwNtRcdTAwMTBcdTAwMWGKXHUwMDE3+GWenO3Nz9FO5F2505Jlco6y7mKhXGJfJ1x1MDAwMVq+XG71Q/FcdTAwMTPxY9P9ttzZo6Ylcrqnfemk/dvnd1x1MDAxOVx1MDAxMElu7/hcdTAwMWNu/XFcdTAwMWK7Q4F5q1ihsje71y+e/+I5LOKtXHUwMDA1v1wicDDdaSNcdTAwMGIvI65K8dN0kXpdXHUwMDFkf9tSrsTYoFx1MDAxMFx1MDAxOcUqXHUwMDA3dlxcoeMtXHUwMDFmZYdcdTAwMWN6jIPifG0n2mHcXHUwMDE1cWqAaXmH7io1v8TK/V3jYGexw6vuonUhjue+1/mbIJ1XdIdZXHRcdTAwMDJcdTAwMTBcdTAwMWWtKHpnYJLpfqxcYv68+nBG+1uZmc897FskXsiBXHUwMDFiuHi/vMJgO8DQXGIoXHUwMDFiXGKL90z7j6Pz1m5cdTAwMWOGguhcdTAwMDepYE4lc85ZXHUwMDFkc1x1MDAxMnPm1y+9hV34XHUwMDFjSSbw3sxcdTAwMWRcblx1MDAwNJTIc95Uw41213llrDBUXHUwMDFh3jcvr1xiLf5t78i4RtxdnnwmPUjQt5+Sq6+IQFx1MDAwM3Y3hDtJKaHg33fIP2JcdTAwMTbL22Fnvlx1MDAxZtCApmI6XHUwMDE2LPvMVGVG71wiZzNcdTAwMWY0mLuTXGZHM9N6ZdeUmoYja+b1kpbKXHUwMDFj4e00XHUwMDE3XHUwMDFh9GPRXHUwMDEyYu6mYlx1MDAwZpq/cSclYk0q/NBjP6o4bXpcclNcZlWewVxuiYZcdTAwMDdcbrXrnubA0ZjjVo9fPnn9ld6MK85Hk6Ocr1xiko0lSlx1MDAwNddcdTAwMGLx8mLEr0Fkf75VufUl2p/GmU+Q/Vx1MDAxM9ZRh1x1MDAwMzFJgF/oXHUwMDA3MCffpnBiVY7hQJ29bXtcdTAwMTBfPO3O/bXenJZ1xrhso/dcZnCIjXRo0HuZe81cXL7HRVx1MDAwMi9BMtR8Zs4oST8lqURcdTAwMWK3P+HjSfNcdTAwMWN+XHUwMDExrOrvXHUwMDFiLeglXHUwMDFihrNQKm3Brlx1MDAwMlx1MDAxMGr/PJJDIFxuaZxBNlx1MDAxZUkzgMxNTjnTsnT9XHUwMDExXHUwMDEwqrm7eSurqlx1MDAxMVtdjX+1IVx1MDAxYfDDV0N2n91cdTAwMGXyt4ZcdTAwMTY/XHUwMDE1v5BcdTAwMDKScv1EXHUwMDAxiTDc+W6Cbd1cdTAwMTVMXHUwMDE2nbDKVsnmWshgXHUwMDBlz1gtUnWNsJR/xd+2rDTt+lx1MDAwZVx1MDAxM6hHvGYlKfCmJ87oqvmG8Pix3qZcdTAwMDF8+8FaYt+C/lx1MDAwNbCY181aXHUwMDBmXj/bXHKa1cKS7UabmVx1MDAxMrpbW0iw5Oxg13QuivBx1qI1fvX9zcomP3a+M/Sq6T46OrqTm6WTtWgyJEXaidGJO4ZzOaOlzalFLf0tIzw/rNa8w+rYXHUwMDAy8NnMUrdCXHUwMDFh91x1MDAwZaNcdTAwMDcyXHUwMDAwXHUwMDE4nTz7/Fx1MDAwNFJ20ywzQfpcdTAwMTFgajjNgEHASsOmQOhKyYtcZsRsnziHQTx/XHUwMDE0+PNAMn8nldreyLD5ertYqqsjYuZjNppX/lx1MDAxMYg/rkBOd3XXnIGZiJH021x1MDAwNW0/0aw3kbKoXHUwMDFh41B6JaVcdTAwMGVvXHUwMDAyNyR8KNyuXHUwMDFi71x1MDAxNTFcdTAwMDdD0Z3o8PCXqCfi0nmDc6upXHUwMDBiXHUwMDE0RnKALzQuO6ivaYDUXHUwMDEzl1ZQgCnpNVwi015cdTAwMTN51TRX9+XxI8XEXHUwMDE0u1xyoSV1wLI2THkm4IOfXHUwMDFifKU9ULNZce2f3stEfi/1a22QJFxyXHUwMDBmXGZcdH++oVx1MDAxYbL/XHRcdTAwMGZ7O/dxrmhYrV9Xr0A6+uwwelx1MDAwN8JcdTAwMTFIuaSYgbD8bWrRIcduUYKlXHUwMDA2XHLr/WzUROVcdTAwMWK0l7FcdTAwMWGgXHUwMDBihj7T8WK0qpkmiqJcdTAwMDSHgiRcdTAwMDWHXHUwMDA1ied6hCDDUUbpL/hcdTAwMTaNxlx1MDAxMFJcdTAwMTTqs582uNhcdTAwMTlccltWYNNOUNs+IM2IufeG+1NcdTAwMTEqXHUwMDAzWamQ22BLwOL9QlNFnSNv+l0tt92ux/jMVv7IgsW+XHUwMDE4wZjw59P61JvFrNe9VUFcdTAwMDa/zW1pgsi4WuZiQV5cdTAwMDNcdTAwMGJcYm59tm5NV1mpui7XIUpcdTAwMTVcYlVxXHUwMDEyl2rhR/xcdTAwMDYpXHUwMDAyXHUwMDFm58abrC2A6vbUSutcdTAwMDMgXHUwMDE0rX1cdTAwMDCLfihoxN/qqUdBxYorXGZ4q4Bg84jt2XxcdTAwMGVcdTAwMWW1XCJvT3ShQoSUplx1MDAwZiNEXHUwMDA0ajtpdGZghNZcdTAwMTDk7nuW91x1MDAwNyNz6Gr1607+8a0ndMlqdPRcdTAwMTW/QtOCls9cdTAwMDP2xJ9cdTAwMDQsyHBBYk21O1vLdZVCIYdcdTAwMTIqttjZINOh2NS0ZP482lx1MDAwN3NcdTAwMDeZ/Fx1MDAwMKdCoFx1MDAxYlHKVOve+k5cdTAwMDQ6lleq5O9pRrmahNiaX/M6q86BdX009ZdcYuGoo0Suc7rjkdrBgYp23dKUelx1MDAxNcjr9OEwpFxihYhoc7ohwDnhf3xB9Pt+XFy71DatSl/PiLFcdTAwMWVcdTAwMGJcdTAwMWKRWJ7a89NC8qRWosDVk2EyIFx1MDAxYTQlg5d+mmmjT69SfspO1S6FdpNt/UVcdTAwMWb2mWi1P9hcdTAwMTQpiVW9K0lwXHUwMDBldDJ4lfgqqNBZucJ5fYtZfy1cdTAwMWJcckDrPYfyWSBcdTAwMDSBM1x1MDAwNHir9COo225cdTAwMTI07lRcdTAwMGb+2Sm6mT40JNJPXVx1MDAwN70p0JIkYjxDQvy8j1xiv33ogFx1MDAwMvpcdTAwMTmtf2PVjknheGqO2XJfbC7oopegzbMhYlx1MDAxMTUytye50Gtkiv22olx1MDAxZFSbaaAoXHRI42uSa/HRVr9cdTAwMTiJgnCUJSWWWztKT2XfQM5cdTAwMTbWNDdcdTAwMTOKNVx1MDAxMG37s+SOnqgpJlx1MDAxYX2tXHUwMDE5aVx1MDAwMX7HmU7oz3A2XHUwMDFisUdlLOSQzbaez31/XHUwMDFjjk6wXG6qwyDEdP9cdTAwMDS7scp4XHUwMDEyUa+3kprDXHUwMDAy4IJokXrfq5TC5T7L8pbSrG8v2Fx1MDAxYt3t5EzaZmRcdTAwMWbNYXqN71x1MDAwYlx1MDAxN5d2WC+ZMyOgeWGIqSFAvTpzX0zQlNGQspCbpnr80JyrlIdJRPj7UXJKXFwjxiCHXHUwMDFjqPIgpmFcbrdddlTutHxcdTAwMGWR3lx1MDAxNeioeFhtjEVdo+ZQY1x1MDAwN5tcdTAwMWS70SpcdTAwMDAy05hcdTAwMDBcdTAwMTFcdTAwMTU2XGbfWoe1/k7DkI95xtuJI7uh0pNcdTAwMDDfxdOifrHh6zouqS1Zo+ctKTWkpVx1MDAxNlx1MDAxYcZfvyhuXHUwMDA3e/JbYjlcdTAwMGVrulCy64lBvFx1MDAxMeQg6eKzY19IYItcYpWk2LuL0rClXHUwMDExXHUwMDAz5eOBhaReeXQrUlx1MDAxZrHbM/CUXcTwflx1MDAwNPHz0fHiW7nY2n5KxVx1MDAwZmM15ER+XHUwMDE0dTS3KuUnPnlbqlVgljyIoe+Q5UNtI5AjXHUwMDE36W8/hMKz4WadKFx1MDAwNPZEwVCp51espsz0VjYv0vRcct/QLTVTUun1Y+I+X3qnjOIusb/mXGbpXHUwMDE0ekVccl5OkHSQoXDebzjjYYJh9U3055fzY0xcdTAwMTbmicxISCeBzWtNcsBLgLiV5WhzqORcdTAwMDaYXHUwMDEwODs3Lry1XHUwMDBlMpEz7bLEOlx1MDAwNEyhfFx1MDAxNLH22derQGjSQz9cXPCOlZPewFx1MDAwNu3JXHUwMDBiIK1cdTAwMTZL0n2I3788JjA2RYJh6Vx1MDAxNjOP84xcdTAwMWWPk6osPjpcZlOPcJJcdTAwMDBwY/0rd1FcdTAwMTBuXHUwMDFl0FCS09+CQkrezk//7VpcdTAwMTWVX1x1MDAwNKhm6CWSXHUwMDExyLnf5buqqduw8Zr72LPZO1eYXHJnxFx1MDAwMrlJXHUwMDAyf02nldBvXHUwMDAyXFyfh1x1MDAxOVx0Zlx1MDAwNsK0Y/kmPVx1MDAwMctcdHCFdOBdebIuXCL+vndlm/tDNnqKO8eDkrxeK7/pio+3Z4Uoql+VXHUwMDAx2M01Q2FbUFZcdTAwMWS6rT2NOJOorzGMXHUwMDBmgZFcdTAwMThcdTAwMTc/nDykrJtEineqJjrz/KQtyCfZxe+FUT33gHhHZUrRe65A25Hmf1x1MDAxZHlcdTAwMTMn8I2/24d8K1WUXHUwMDA3XHUwMDAy5sDbrSx2cjf8yNXf1+zJJ+VEWKo52tNV9uRZuObFXHUwMDEy8Vf+codgTPqeuT9vXHUwMDAz4KZix8S5XHUwMDFl8i2YdpRZf+sm1Febj5HZXHUwMDE1Q/ZsyGBln0uMPr5hMq1cdTAwMGKAqyDdRfTn9bdZ1Vx1MDAxZYz6XHUwMDFk+TOVWjlkW1x1MDAwZvhA+uq9e1vmctdcdTAwMTJcdTAwMTbHXHRnWIbXIM7nZPwvP3XUT779PO0+lvBcdTAwMGLcoIj+7o/Q+Fx1MDAwYsjQ3y2UTp3YqELspl2VTIPVNGklfrNYQrSLOjPR7Kcn3stvXHUwMDA0XHUwMDFjfVx1MDAxZt9cdTAwMTFC7EwvwFh+iVx1MDAxNYuyUlx1MDAxN41cIqvwXHUwMDFi9uEtYc+Orjep0vtaYlxmOytcdTAwMWHZXHUwMDA0+lx1MDAwNbAqeZzFg8Mwmqruk5feycMyirbJ11bg6lx1MDAxNVx1MDAxY9BN6V+n/yDqXHUwMDEyXHUwMDEynELzOccshMzuz+l8cJL5Yrz+IT6gw4/AXHUwMDFiIVx1MDAwNlRUv71cdFNcdTAwMWPnZG5N21enXG5s31x1MDAwYlxmYYC7NN9cZqH3UpW3uPOqsVx1MDAxMuzvML9cdTAwMTicjIjE1eY35CNBa2Qwbso9WnwzR3dlp6lcdTAwMDVNeOIrML34Olx1MDAwNeZSXHUwMDE3jF0wdc5MMeT2N+KSXHUwMDFk0VvTPIxcdTAwMDFcdTAwMTZUgP9cdTAwMTa6hOqlXHUwMDE29Pw80HzT/1x1MDAxMEMkrCjbilwiyj6vy8S3S4NU6lx1MDAwZsyUqPh2VkjTnmhiyFwi36t/u/VGXHUwMDAxXHUwMDFllGzYTfuIL8uwh79cdTAwMGLDvlx1MDAxMVx0ZihcdTAwMDBQXHUwMDBmcFFcdTAwMThh63lcdTAwMTDlXHUwMDAwV3xcdTAwMTJcbvdcdTAwMTEj24E82z+x8JtYeuY7inV76mJcdTAwMTM2ZNXEXHUwMDE2WM5cdTAwMDVFen7tdOY9jlx1MDAxNjmVqFx1MDAxMfhcdTAwMWJvMKI6XHUwMDBil7jTVlwixfeVblx1MDAxNOpcXNdIMaUkoU+B/Kb8l3ySoCBJ4u95ZGrrUlx1MDAwNHmgN1x1MDAwNkvd1Fx1MDAwNuVVZyqUNdalsECLXHUwMDA27Ke7ifWu6T1cYnUowUhCyn6xbuH13pUsKIRQWsTdTzeB6zys1MTR5IXLXHUwMDFipbZyXHUwMDE4OtW6m5E0QrRB2C1cdTAwMWO7dWSFo5G1/JPYlZ2dalL31c2mRmNcdTAwMTNS2sZcdTAwMDCerzqxI1x1MDAxOSu1L7TpU59N0Fx1MDAxOE25JNMukX9cdTAwMDCmey85yz3H+XCy/GpFklx1MDAwMjhlS1x1MDAwNuXkZfl3N08jafZTXHUwMDFhXHUwMDBlXGZBXFzQmMeeJlx1MDAxNuFg7WJcdTAwMGVcdTAwMWVVqFx1MDAxOHCm4CUrg6mcseT86sDle0TumE8xilx1MDAwMq9cIlx1MDAxNaSk+vWgXHUwMDE0wNVcdTAwMWZcclx1MDAxYcLwNYy6X1xc2WlflteugpiHvIU1ut4ttWFcdTAwMDGOJjyj5sbvXHUwMDE18fznWdIvauAw/7xcdTAwMTdcdTAwMTU2x3C0rLBmXHUwMDA0/GR1sNGBYENOT5+mVLJJwtMrP2pcdTAwMWXaxTc/etyb6q+9qj2hgbguL6PGwqxcdTAwMWOgkMTcIzRsPU0lsvitzjy0pI21zlOXXHUwMDA1kltyfu9/kuN7uONcdTAwMTWHXHUwMDE09e9Irnd3IOKHXHUwMDFjJFx1MDAwNGJcdTAwMGKAcF6bUYNdNYfrVuyc3K+EweVDTFx1MDAxZCTOX4nW2KT8qoG2pX1PL5DX+qivo6Eja8kzYS8qtpqfmM2gZMVcdTAwMDBqxlx1MDAwM38ySFxmuDWo9cQ6gfBtXHUwMDBmcVChUtRcdTAwMWVcdTAwMGI61XYmm30/ZVx1MDAxMHmKxo6idLSx4fjk63Ekr/Lq5dZI3UJmnGKRXHUwMDE2bVx1MDAwNlRcdTAwMTUqYHl1yfWwXHSXsm9ZUsbijFxiRlx1MDAxOSj1/bn8ktHIWjXIXHUwMDBmRtis+WrvlNZpIzf9XHUwMDFjpFx1MDAwM0VKO2UqXHUwMDA2ReE8plx1MDAwZp5cdTAwMTN01Pc8XHUwMDAw1F9cdTAwMTbifFx1MDAxOXyhdlx1MDAxMWDjiF6jOGlYKbrtXHS6/FLJrVx1MDAwZaG/nXiBtvf38G28RSiX70TK/Fx1MDAwNrlcdTAwMTCrU65p+Sws5UTL41x1MDAxOP+OQ/a/w0DsYulcdTAwMWVcdTAwMGJptidcdTAwMTjXOVx1MDAwNeKvj3BDZPjdtHWG2tVcdTAwMGXDLmDcXHUwMDFihVx1MDAxZKDX/K2jVm68ddlzVi9aUL/wZlxyyfMnjGDawPt+XFxgP1x1MDAxOFbUSMVVpcJcctjOXHUwMDE2XHUwMDFhqpKHz1BjXHUwMDA0YM9Ttp7Y3/Y/VcNnZkVuyCiMXGLlypi6IM7+SFFcdTAwMGJ4RE5KWDClTK2MUFx1MDAxZjtbRVx1MDAxMvwhrq4/O9ZJ+kUpwt+iRFx1MDAxMfhcdTAwMWXXI1Y8rrKPN4S5v4W5zCu2XmPl/vaLh2HGQUVcXJPvXHUwMDAyVlx1MDAxM77yIC1SplXiv0eB8tl3XHUwMDE0XHUwMDE5rGU43ezRuUbI22vY0NC9sXKw8OVAPdSmYPEyXHUwMDEzjphcdTAwMDKWXHUwMDA2XHUwMDFmlX6vvlx1MDAwYvhCXHUwMDEzuFx1MDAxZmDStqupXHUwMDEyWVx1MDAwNFx1MDAwNFx1MDAxN+XZQCSskE9cdTAwMGJcdTAwMThcdTAwMTDyectdJEngpfaEe3JzXHUwMDE4r8+b3uqYNp88/zlcdTAwMWZleFx1MDAwNuRn4Vx1MDAwMWTzSHCqv/6nXHUwMDEzblx1MDAxN4hcYphcdTAwMTKlUk+amLGdWupxRy2jXHUwMDBmyWjx97jrkpn7QGuYtu1cdTAwMDe42EQu3N1CXHUwMDEwa7OuXHUwMDA0Jus4pUo6XHUwMDAzPFx1MDAxY5RcdTAwMDLRMVx1MDAxMERaukZcdTAwMWRxXHUwMDAz6Fx1MDAxNzVq7tjfgVxceDptcFpcdTAwMDPhck6cWbQ5XHUwMDFmh0z8lV9y9C8pQM+hzlx1MDAwZbj6ULXXyVx1MDAwZaPZXFyQ8n/fJbJcdFx1MDAxNjQua9u6iL7jfmxcZjNaPFx1MDAwZujvwFx1MDAxZc8387lvWl9t9tG76YLeNFx1MDAwYolcdTAwMDalpttksLjeaCq1XHUwMDAy61x0QkzlXHUwMDEzXHUwMDFmIOJQXHUwMDAywzUjbXSlfvtPcWBcdTAwMTPc3+llXHUwMDEwKUrTsD2hUIJcdTAwMWLyU0egTlxyNVxu0Fx1MDAxOfZTMTpiJWfGwYLyft+2N9/OZb/0XHUwMDE2XG7RQGGoI1x1MDAxZo15KlVcdTAwMWRcdF7lfDWWZS1uhDGVUVx1MDAxN+lNzPyJoeUrK8pcZlHf/eHd73zn9r5LjyyXaVx1MDAxMcRTU1x1MDAwNiEjXHUwMDA21srxnLWsxm/3mTrtvdpKjNZdXHUwMDFjXHUwMDA2yPE55s+WjiW+8SZB1dxcdTAwMGU+nYQ8UZKk+1x1MDAwZknFWFx1MDAxZJI/sfVYXHUwMDE1ntRNNEvleoRWwVVyqzDNqPM2JGgzmTLyY3R6XHUwMDBmu3UlujRcdTAwMWI0+TxXnnjpalZccuuSXHUwMDFjrOVmWYNcdTAwMTGltnI08/uk5zvzwGaUnpQzuvhB71wi4vf5LV+5XHUwMDBiZkqs4JpcdMIgXHUwMDEwmlx1MDAxNlx0VCaEuVx1MDAwNyBFUVx1MDAxZlpcdTAwMDM5KC7PMlx1MDAwMoEx51x1MDAwME66blx1MDAwNaF4W1xcXHUwMDA1puRwvlx1MDAxOEB9o3lua1x1MDAxN1x1MDAwZvFd+EL4ykT38Vx1MDAxNLk1cfE2XHUwMDBmjijS4YG1+tcv+mtcZlPfNW64aCx14HpcdTAwMDPB821tamZCnlx1MDAwM4iApIVcdTAwMTNssTcoV870QICui/Ol88GU9ExLvPNkKVx1MDAxYeTr7Dh401x1MDAwNJpUMV7PTZY7aZq3VTZcdTAwMGJccinS5DbEQnJYXHUwMDBmQ3OvwVx1MDAwMmXQJExcdTAwMWHGmjOiSeNnZVm5czzGh6R8XHUwMDAzfPmmKZhO4Fx1MDAxZclUnrb7wXu6+Mauw50oOFx1MDAxYqb1uL/jzPg5edDFM1wiXHUwMDE1WFxuV1pcdTAwMTFcdTAwMWVM8NL7UoZVTjGBWf+q0b11RO7bmFx1MDAwMkZQJ+KE0tafnY3+XHUwMDFhjClbzjX9XFzAKu37TeV7XHUwMDA0XHUwMDE5bzHaYnGPXHUwMDAyV1QpR8qtMqfbrWVKXHUwMDE4XHT571BcdTAwMTJNNSfqIT7YKVlExuNqhFx1MDAxZLhFN1pYXHUwMDFl0nbepdzIxfnczJdf+CB4XHUwMDFjKrqZ7Fx1MDAwN3fU9blcdTAwMDQ7sPNQP+K351x1MDAxYewwU1x1MDAxNFl1RK3DhldbNVG5QEJcdTAwMTExK4rkW7Dsy7nIO8cm9PngMVx1MDAxM5RZo2LYJ2lcdTAwMTTmJ1xyXHUwMDE0KFx1MDAwNEHQrkbXYaDaL3NcdTAwMTextTBcdTAwMWTc9zJ7wutcdTAwMDTd9USFfpVmcZyioXI6wD/QwpyJL6rUQVx1MDAxMS9buEpcdTAwMTOhpNo0oXVGXHUwMDEyf4WC34/3aFx1MDAwNb9cdTAwMWPTpVx1MDAwZpqV1lx1MDAwN19bXHUwMDEyKXvgXGKYVIcz81x1MDAxNVxc3VQpKT/PUavT6y2hy4t1cv049Ir/rVtRR0Ul1zdT4elPXHUwMDBlwJXn8Vx1MDAxNZzzYV1nXHUwMDA2xMSh2LU13qc3e46wxt8mXHUwMDAyo1xihUlskVx1MDAxN90s1Vx1MDAwYsNJ4FR+S/HG8ul4XHUwMDFlVDuiXHUwMDA32jUlSlx1MDAwMS/ba789a96x1idRN0tcckF6OFx1MDAxNbZcdTAwMTjD7Fx1MDAxNv3QuFHzx+Tw6Vxu0ql9qFx1MDAwMjJ+etV4JiN/3Eg+XHUwMDAwiFxillx1MDAwMPM2eOzReOSEb6d3OF+6XHUwMDA0aCA95M9WbUZcdTAwMGIoOtbtoL16/jArLXy9T/1cdTAwMTCwXHUwMDFhXHUwMDA12jlcItHF2Ppe4X6BX5omXHUwMDA33absqH6TkyuRXHUwMDFjen/Ns9BcdTAwMDOXU+vj5HTvXCLXcGNpn5jcdlxcxfOcgYF27Fhg/JTw/7ZcdTAwMTFF/Vx1MDAwN8fKXG5t0/bbfqvOYZ3Hl85GyMotXGZ6bnh+lZnAJIrORahcdTAwMWRbaVx1MDAwZS2aR8U26+JcdTAwMDG6pruFMfI5VtbC5qpRflx1MDAwMSh8XHUwMDBlqV1cdTAwMTMopL71kYGmXHUwMDBln+wjuk/OVn6nerjyzbNq2vYhXHUwMDFmUMQssjxO4GL93aPjMuE3XHUwMDAyz4z+lHG4T1x1MDAxODoxypZnrZdpXd5k3+fCXHUwMDFm80yo7U38b9ThyyRQXHUwMDFlZ7NXMTV6VlpdbotcdTAwMDTwq3BQPFx0O/bChL6VMJm/JCtZXHUwMDExN9qGsFxyLNnTnZPXMkHh1FpW0r5bVFx1MDAwYlx1MDAxOZZcdFopSequJK436rVCI/BBQdFbKbGm+6N4fe7TXHUwMDFlyKRmsWaavpz17VwiMvm2XHUwMDEzPFx1MDAxOS9tyFnCqrWSL81cdTAwMWOpvYfKXG4mNFx1MDAwZoFW2CeMXCLyWztcdTAwMTfidC5P6lLLxiRJjlx1MDAwZlx1MDAwMk+vi1x1MDAxNVx1MDAxM9CRO0Ix+ItUYOzzzSXLQiNpW96gakC6XGLKqdPCX4JcdTAwMTi0zqxcdTAwMWQ49oKzLLjalIOiXFxXXG5Lf2k5hFxcb63ke2b1qVx1MDAxNXKm28g5VMmyd5Q7J8H3ilx1MDAwNu+HWm2+OTVzy16Yz1S5TbmHIOnShJf4Olx0LKnPgdRQWVdmzFx1MDAwM3TTTVx1MDAxZi3kaH17XHUwMDFivrxZetCurLBAXHUwMDAzN4FcdTAwMDfNOoX/MMlaObk8wdrMadPBOmPtSL+hvVdpoyOAutLGXHUwMDBiL9VcdTAwMWPXbyPx2JV8+cz6XHUwMDA1XHUwMDEwrohemWc6/ax9e23UsipcdTAwMThcdTAwMWHk44vGfddcXPpcbns/ilwi5Vx1MDAxZow7n93OqT9oNaWxz1x1MDAwMvdwVlKUJHUytk9FmVx1MDAxNCs3v1x1MDAxZJj1kHcnPeBcbktC1Vx1MDAxMbpRh7HjblqZ1vBZUD1cZjRcdTAwMTlt92uEa/hM26fcjefBXHUwMDEwYovS+lhHd8bD4lx1MDAxMC4/XGLC+lRMrdkgXHUwMDAy1Vx1MDAwN4PPbMo8IV2oN9M6Oj+SrJ+RtsBw7CexmFYmLUjJnyrziPtS48Lyqt6kXHUwMDFhc/XyqDfyXHUwMDFhMiespT2OeZIl9LPrq44rJ8ttMOAvXGLa/EB2LOvYQajsXGJqzlx1MDAwMFxiuVx1MDAxN+gjdP1pSNcsx366RpF3bLPkmppcdTAwMDPZXGIrT1x1MDAwM1x1MDAxY93F18xk5Fx1MDAxN9TqZVevesWSaXJ5xDlcdTAwMWaNMd6uIFx1MDAwNlx1MDAxYc4gL5u3Nc+X53naNbait3Y+N2hflFx1MDAxYX3e4IxcdTAwMDNvXGYhcNaNe5RoXHUwMDEw71x1MDAwMaY5XHUwMDFiNVx1MDAwN1x0P+Orq5RY+iZ5L6GnliYtWM+XfH8661xuXHUwMDEzXHUwMDBlhFx1MDAxM9rxXHUwMDA0tc+herP767dcdTAwMDVd3Vx1MDAwMpWDfnYkXHRcXPRR0tH/trdkXHUwMDEyvvCLXHUwMDFhXHUwMDBmXHUwMDEzZWL0U1SUTj6aMu7zzlB0eOEsplx1MDAxNmMoakCUUIlcZlttd/JcdTAwMGVcdTAwMTD3JbxcdTAwMTXer+5n6cy7nlx1MDAwMSk8P8I1Ylx1MDAwNcJVZCgkkvZZ/JHgXXPuu1x1MDAxZjT6XHUwMDA144H6aebnqE5DhN83fEhZO8LjXHUwMDBiQd53RU+RKHS2+Vqv0SBcYvJ5bMRII+Fuylx1MDAxMsk3rH2oV412ZFxmulx1MDAwM0U1dVxmXHUwMDE2XHUwMDAywJgmLo+WZI80mMpcdTAwMDM4XHUwMDE2uEOQXGKM9mFeyMJD3awuN3vKq1xuOvklyu5cdTAwMDQsQVxmZVao715cdTAwMWbqWz2HXjNpfncm1WMldrDCWkxcIkBhXHUwMDE3tLP7zn1cdTAwMTf7eFx1MDAwNkW4cFx1MDAxY1Zswdub218oSpfum1x1MDAxMs/FzD+q++5pXHUwMDAz0iA9l2lcdTAwMWTQYK2KXFy9q9hcdTAwMDRRNHBLXHUwMDE0Z1x1MDAxOKKXJ/46w/GrTsNnXHUwMDA3iiaQPrw289yKObi95r0nQC9cdTAwMWT2YK/OjHPIwE5f8fn36CCniYbATEGnT1x1MDAxZJ7fh3DkJd5Lg1xi1jOSZmn8XGKXRXFOOyPxunexqc3M4nxaRVL9XHUwMDE3pVTpUDmQz0H9pb3Rxsmuw3dcYk71XHRyfVx1MDAwMmlcbs2YJVx1MDAxNv9q/IC2qHGGrPZ4XHUwMDAw8PFQsb3aQn5rXHUwMDFilEv32n5cdTAwMDcsclx1MDAwNmaV9aFhVFx1MDAxNmjftO82WdrZvlFcdTAwMWXrqstf+ouUSn3TQMJBsFwigbvs6lxuJcRcdTAwMTGVhOq4a1wi2fdWLme75u09r8hZ8SRgXHUwMDFjw1x1MDAxMlbRv0tcdTAwMWXnXHUwMDE1qFx1MDAwM2BWjODYx5BzM1x1MDAwNnf8UFDPXHUwMDEyXHUwMDFh0emEXHTt8PNcdTAwMWR6Y9HJ8N9ggWN7LbZz30Ror2KrdciWU8pXxCtcclx1MDAwNjT51ziykyNcdTAwMTO5iC/KXHUwMDE5mnlcdTAwMGJBnX/CXG6EYJZKXHUwMDExXFzWjoOLYl+AtUrv1KfA6FeFmalD41x1MDAxNlx1MDAxMNpcdTAwMGJntNjD/Fx1MDAwNp3j38RsY56nNbmobv/kO91cdTAwMTHbXHUwMDBl8MtcdTAwMDRcdTAwMDboWm9uZyd5bFxcTC6i9fTJKX4lXHUwMDAxStWkVLVq+Fx1MDAwM4TIgW/f0jlcYrQoPyjBcCCS+s6usVxcUsfIeFx1MDAxYY5avi0r5J+UeeVYsdF0XHUwMDFlZ1x1MDAxMSVcYkgkpFx1MDAxY6uZoZ88WKqii5FXlY1O7HtiYivOO6zLdUhQTVx1MDAxZMRguTw1XHUwMDE15Fx1MDAwNbTj3/ybdVx1MDAwZqnzJ6hxuyS1pOm2LWzZnSrdXHUwMDBiXHUwMDFmUkzfXHScXHUwMDE3ot/dsSljhpm3OsXevqypkdXNcGb/XHUwMDBl1Xshm1xuZtjCeFx1MDAwMXb8wYpatrDLflh53sPaXHUwMDE1TFx1MDAwZVx1MDAxZVx1MDAxY3suXHUwMDExXHUwMDFjze05XHUwMDE4W94zhFxcXHUwMDEwXFx0JuSfXHUwMDEzXHUwMDA0foyxkGSXXiVcdTAwMDWBRtX0R4HfNEdH+kRP1rHhLGQtXGZB6ZibnmP4kLP57S+wMNgkoYpCJNJ8aJ+sXG5bxbHhQIVq57RTYDxcdTAwMTBcdTAwMDFH0V5cdTAwMTJ2aoKx5vpOXHUwMDAx9lx1MDAwMObdQEZaf9DKeUO9zDo2+Fx1MDAxOZJcdTAwMDOTWT2MXHUwMDFhzsv4nuCDeGNZT1G6fldcdTAwMDVcdTAwMDFcdTAwMTFmYs+tXGamSIH9NTJPflx1MDAxN3nNjWp3oc6f1uzJXHUwMDE1w/s4qHlaWZyUiaKE4ixO4lx1MDAxME5cZvZlmJ6B5tPIjNzjYi2Vt01cdTAwMTm3RnZcdTAwMTRcdTAwMDXeeFxuQUhcdTAwMWbzkuf3QZjKZLv8mybchNIgRDrHzVx1MDAwZZ1V9XJcdTAwMTQj75uMq+pVIFx1MDAxOPJYnHZUUzlcdTAwMDGfcSr9XHUwMDE5RobTXHUwMDEzkXZD9/CIhKdcdTAwMDe+0m9/ckSWnutf5enfSlx1MDAwZvvTOTV5XHUwMDA2jDfX2Fx1MDAxM6za31Wr39S3wFJcXFx1MDAxMVx1MDAwNNFFPZGv51xcXHUwMDAyn/rh6lxu4UaU/MDz0u57hEBwf5SAXFw7O6wtNXBSPFx1MDAwN6w1fF71VoGzgutYh4ZcdTAwMDZcdTAwMTJz5NdZ41x1MDAxZnJksFx1MDAxZf1llU+3mVx1MDAwNMd9xaMj5m8x8Og4JmKXXHUwMDBiW3ghS7Egn+1cdNZTQlx1MDAxN0757et0XHUwMDAxXHUwMDAwe74vbLQyfISji9LQXGaL5vs0sohmpv1cdTAwMDeQXHUwMDE0eyxcdTAwMTWKXHUwMDA1hjChcHtUU282+3DP6tw4XHUwMDBi31x1MDAxYaLPLr+HosHlIan2XHUwMDA36ZejZz/9NUFDh6ZBqSswVd0whGBNRVbr1FvVPdxcdTAwMDPZQMXBXCLn98ar4PpcdTAwMTlgo4lTXHUwMDBm3y3GPU9ui0Pa0lpcXPtcbsT4qlxc6TJcdTAwMDPSolPAxXa/icwj21x1MDAxZFx1MDAxZe+I8Vx1MDAxMaa/TFxc0X43gZZHfy+WXHUwMDE5SEdsllx1MDAwMGuaXHUwMDFmwlx1MDAwNo5BdclcdTAwMTYxXG7OXHUwMDFjUUwk/k5gLGj6ful6X4vnUOgvPOOuzph2mMxMQJNjXoKEX9K/wtZSKa9cdTAwMTJcdTAwMTly6qL5XHUwMDE1yq1ZXHUwMDE1n9tcdTAwMTU+/kDN4jxqaeqfcfz6k+PslH95K4T/zqi/qabotZ8+2iQ3MG0sXGK6ztqK08FVcDe6mL14tpY9X11cdTAwMWKpXHUwMDFiXFyVu9wxoD3YfoyUXHUwMDEyoaWQReer6ftccvZcdTAwMWY6hX5fXHUwMDFjQLvKNolcdTAwMDfqRuD6xPLJk7JcdTAwMDPiupSvzEKmVWdFeqbtLiE5rTtdLOXRo5rsk7PPXHUwMDE5i5av3uix5UK8wyS3XHUwMDEwhTQoplwildI5nlx1MDAxN4CjXG6In3XzMCBib1xm5Vx1MDAxNFx1MDAxZlx1MDAwZo+uKpR7oj6rN1x1MDAwYjsse05fklx1MDAxZq+fqc7h0yzLKtZ0m5liYOPLSsPkrvp//y+cJL2qXHUwMDE0b+drQuJQczJlXHUwMDA38r22sUio58DuNopSXGZzKjKr7M9rbM93KkpcdTAwMTLAJHiLXCLAQblcdTAwMTGWMkOiK/bFb3BYIY5SnDtcclxySPe83bFYpVx1MDAwZaF8XHUwMDA07J260bRcbmFTgXFJaEVo/GhcdTAwMDTwolxuRfVwSpRcdTAwMTUvJDlC0uWnQnhcdTAwMGKGf6FcIlx1MDAxZk6OPaZcdFvcXHUwMDE0U/6uXHUwMDEx53T8QCnyPFx1MDAwNyTQJOdcdTAwMTg2buZ+7ESGh1x1MDAwNcXTd/BcdTAwMWW8XHUwMDBicPde9Fx1MDAxONPP3Lw0/875jDt3PVx1MDAwN8Frss+cYFxml+zr/LKMfC/3WEYzZFx1MDAxZo9wXHUwMDAzqnmAXHUwMDEyodamteNDuEZcdPStdXEjWPrw0pWWKL5z+FxyXCLDW1x1MDAxYYfU1VwiXHUwMDEwevo0LnI8XHUwMDEzZvAqejtsJu5T/aDzkdTRyo+mNDDZcjMwfm2IxlcxXCJcdTAwMTnupl7ggfuX3fyTXj6X1DJbtea7R1x1MDAwMFxcszg36Vx1MDAwN1F3Pb9dQ+hWg3HIXHUwMDBmXGbZXHUwMDFi1vBrXHUwMDAwOF6X0jXAXHUwMDE3xYuC2UG/pCBbSJRcblx1MDAxYzUvl6aNJ2G+gmt5XHUwMDEzJnSb4541Y3M8OtBv+0/qhrZjze5fR2dWO7NONKqBXHUwMDE34EhcdTAwMDGFa09SXHUwMDFhtnBxK1OGMocg6CPiPfAtcf9ccshcdTAwMDOzvb83U91cYlx1MDAwZruRr/tcdTAwMTb99mXt0+6phf3J+LhKXHUwMDA2tnGj5NRcdTAwMWH0anDam4vkXHUwMDEyXHUwMDE5P/zKcNy2yYOSsWv5lOXvZ4RcdFx1MDAxMlx1MDAwMI7gl51cdTAwMDSyrVx1MDAwNIav+5Golti+cXyhhvVcdTAwMDAsVqXGksBmpSp4W6o76vWZn0rRkGOF360x50Uwo6mnYf736cbt6W1cdTAwMDNcdTAwMWX1tH5QaPZ79naNrkWeObKov/O1PqY8okTyPFq0QG/flJ5cdTAwMTbhrISgZepUmISWU8NZ3qIzXHUwMDFjlZhBnmTmp6eIRKlSt+NcdTAwMDeBW33+TbFMoUKk+JluS2LiIWW/nqF5yWyhM9mxM6y5XHUwMDAw3tCe38k43k2Jo0pCRUKN/sTaL2Ayj2XfxL46seH8XFzZYmFlXHUwMDFkz06kr+rJm/PTXHUwMDAzhlx1MDAxMFx1MDAxY/lpy8SbXHUwMDE2lNRcdTAwMDQ0nofZTV1LUFrAc1txLbZBKKNz7k3dxLphyq9OUk9cdTAwMWIuaDxcdTAwMWL8vTwhY+r1Klx1MDAwMCRvqMYmZyTw1ElshCeOg0/5i/FBq0diSlRbjVx1MDAxYrfpXHLFM5hg42jF2rTpTno0uyY3XHUwMDFhxcPm6p/HyJn1zXXG+lx1MDAwZaClt1x1MDAwMM32s1x1MDAxYsI5vMybWFx1MDAxYpU4XHUwMDE2dSMgjv+tRsjXMbl7VUZ3z0V3wSZP7DrWxOZcdTAwMTJcdTAwMTVcdTAwMTHL2bqQ2udFXHUwMDEzxOxo0dW7xVx1MDAxMa2zkF46NZBcdTAwMTnwvyv52lO/XHUwMDE0O11nuiQr5dL8XHUwMDE4//2w2bpcXGZ5vLZcdTAwMWFVamtWmGNR7cH3lGTZWLjuXppcdTAwMTdcdTAwMDeSXHUwMDFiq8YlyUONhcD3XHUwMDE1qjLCksZF2kFcdTAwMDVcdTAwMDJQ9YxcdTAwMDVcdTAwMWGpYUR0YuH40NVQxVvtfvCYs2Co/XxBXHUwMDAz44dcdTAwMTeW022VfrYuxapkvEY65+DMZeK3XHUwMDFkXHUwMDE3bL0/XHUwMDAwwGicMz5cdTAwMTlcdTAwMDH1r/3u61x1MDAxMFx1MDAxZK/BVd9ZN3JcdTAwMTSMtTFcdTAwMDDKop3nh0suYcXnyC+CccFcdTAwMWSB79xy0b8hXHUwMDBlhZBMlm20q1x1MDAwMW7pXzu3vOTlcOdIfEOWf99ahHrY1fM6oJb7Jlx1MDAwM1x1MDAwNVx0xDkrRVxiZsRcdTAwMTP+0UXbKP3fjvVcdTAwMTimNCla4fKVZJOPp9VgXHUwMDAzxd9p5XnRcFx1MDAwM4G83ZNcdTAwMTJcIk5xXHUwMDA3XHUwMDAyyVx1MDAwNLGLnG9FaK+BpFx1MDAxMXFiTHWt39zRzHrtPFIo/Fx1MDAwM+OqyES+l96rIGnts1x1MDAwZqBWttaYXHUwMDE5k41HRlx1MDAwNWUs99nEeFNcdTAwMDctW9V+5i3Tm8jRbXBrsLbQx+9EP0laIE+bhutW+Tr1UZB3K0XgXHUwMDA0bkc39djn8Hp/8aP1XHUwMDA0x1Kuwd6RXHUwMDE2vCPoyrYxkK4/P47cbUfwXHUwMDAy9kxqPbSuQFx1MDAwMjns50WyiEPyq/M6m0PcfGhcdTAwMGKBvp2IjVWLrUhaOyZcdTAwMTBcclx1MDAxNuqHZGEh8Tu8jUlFcedsJ1xutLOgtFe8lNvat6Tl4lxcXleb/oNccspwSDtCn9KbXHUwMDBlXHUwMDEwNrmKpmWaUVx1MDAxY17wd7P4XHUwMDE0hJm8uaMtXHUwMDBl61x1MDAxN8DD8VhcdTAwMWRdXHUwMDAxXHUwMDE5ZHpAkZwsLkyZvLpssNjAfEuOXzfOvITfNft8m4J82VubV0HasvTHR8/w9ohcdTAwMDDkqyRcdTAwMDDfjipcdTAwMDB8t6yt2I9jeiXtXHTRnFB43I02ochcdTAwMGbKNN2lNCaDxVxizcZQZ0XEty8+tJCmbjJ+/zaySMo0uetF8TGVpe23SGMvXviOU+1Qr1x1MDAxYpvlfHlcdTAwMWFBXUZcdTAwMDJma9Kv4uWqXHUwMDAz+sI3VpLZxiBCkyQ0XHUwMDBio3DO9KRcdTAwMDUrPKN1RPJyLp8l6U12ccZXxE5cdTAwMTK87KfGynB4wnZcdN8gzTloSTtcdTAwMDC2X0BcdTAwMTGAriAs/I5UXHUwMDA0148sicFwee8syT8hqPKydvSItsvW22okTrlAS5i1fTCDLWXSgVx1MDAwNjpcdTAwMGVQMq3BQfv1jFx1MDAxYyXgZ3fl5ix1pY/2ZVd80+NLz8HGiVxyS/tp5UNcdTAwMWU83fxcdTAwMDVZ2ML87l05ueGxXFx/O1x1MDAxZe93a5VDwUCrg4i+2OqpY2Zd31/3VfeGdmMqxV6dx32FoZCL3JH6Qj+t8UHmPd8jkIS5skZN4rudvCcsNIaHrTvYn7HWUl/jPFwi80L5TqtcdTAwMDfcgJMmXHUwMDAyxXlcbk2xZV5pXHUwMDA1XHUwMDFl1Vx1MDAxZFx1MDAxZMBQXHUwMDFlx2TXXXOQqfvSqpFcdMDUnthcdTAwMWE6xsEwXHUwMDEyKJ6pQ99cdTAwMGVSvYrv0SH8zlx1MDAxNv82RmhJYd5g81EvNGHp5cqOelx1MDAwYkxcdTAwMTebqmwkXHUwMDE1qXhW8UfqXGKAnMVxJG1p7lxmRtFHgCZcboBWPTLph1x1MDAwNzNcdTAwMWZcdTAwMWXD5Ub9wiRbairuXHUwMDFlXHUwMDA03NeCsEtHzvb30/dcImSqoeDiZqLbXHUwMDAxp0MyNTFQgzd8XHUwMDExn5hGXFyTolxmzrlcdTAwMThCxTvsdoVxyOCByzT3tD3HN/WSrDBfRLTU7/RcdTAwMWO40KdcdTAwMWFotlxcbt7XXHUwMDA1Tz/FXHLjqf6dI6wxp1x1MDAwMVx1MDAxM3E8SKOiolx1MDAxME8/KXDIeVOyL1x1MDAwNF6ZXHUwMDE0WFx0VWlcImiGMfHZSSdG5OtpRVf123Dc8dLod1LocVx1MDAwMelTU5HF2q23ra0ok/Oi7Vx1MDAxZILQXHUwMDBmRqGpwuw5ncY84Vx1MDAxMJRcdTAwMDOqbKpV5DJHcz6wXHUwMDFioVxcvHpVUIJfU7C/RUQ4Njd7XHUwMDBmW1Zq92TF2qTNvsWST6dcdTAwMTl++Wjmuvrvdz7xN1WbYr/4Q2BJPqckm5SV75L/3dv70ulcdTAwMGLjv1x1MDAwMUHi6Jl+5ChcdTAwMDOlUlxcf3Dy4NluN029XHUwMDBlnsM3XHUwMDFiKkFcXDqpxlEqQ/ZzsuI0lNfvdoLDYLZHcWrHSGO5eeHF1Pb2W4ViXHUwMDFjRvpQOvd2vLWuhGZ8lyO8hCfFN+XvvNOjfFlrc+52/mxcdTAwMTXTXHUwMDBlb/DAJeWqbn0gZehcdTAwMDFcdTAwMDQ1eeJOKOggQbND6D8sQZCRIY6Tqv/C31x1MDAxNlxi8VlYdlxclsD0nUngwlx1MDAwZv1IotLYK5NcdTAwMTKJXHUwMDBizfWpM4VitWWK5lnCxT27YFxiXHJKcFx1MDAwNZNzvpOKXzhfMCSj2/lcdTAwMTBTXHUwMDAwm1x1MDAxMHgviZVIk/tcdTAwMTBM45klXHUwMDFmtFx0ozA1ZEgzL5i2MlW1fi5k0YLer7iTOWmN5tFOYnTHN1x1MDAwMHiet1x1MDAxYW37ICFaXHUwMDBl6meVXHUwMDAykfpOXHUwMDEzXHUwMDAwNFxuOyBcdTAwMTFcdTAwMDT5NWtGXHUwMDBiY+e6j1x1MDAxNiqibOtaXGZpQ6SMt7Sz5HxVXHUwMDA2XHUwMDExQWNipKuK2PDHXG5NjTxcdTAwMWVw523+sdi9eUMx/6PQeY1nXHUwMDE4Llx1MDAwNFx1MDAxYfdcdTAwMDRcdMVFgf1cYtGSKZ7UqDgsurQwbnXAuvpcdTAwMDc5IPuDi21WM5JcdTAwMTC3tcqDY/X2xkQ0ZPI0PNVlebkgfTY4j1x1MDAxMN7f2JixZa42iD5//N+GY4ZL/n7dc9+XqYlRJrNum1SdzaluZVx1MDAwNG+aXHUwMDFlglxmXG6131xm235cdTAwMDQ0XHUwMDBmSo3LXHUwMDAzIFx1MDAwNntDQdlSPcfHXHUwMDFiMkKf6khtdlxcQEWh9e/GfDnsVGct+e1cdTAwMTZDrvqAJvzPwrlcIlXKhlx1MDAwZV6O/Nkv18tcdTAwMGKZp2lcbplcdTAwMTRcdTAwMDVy5rFcdTAwMDF2W6NXIK4yZHLNmVx1MDAxOSc4LYYoXHUwMDA0homSpWVdosSEX+30liaHZ9E7cC6T0r/1olxmXHUwMDE50uKYXHUwMDA3WX9foVBcdTAwMTdlm1x1MDAxNlx1MDAwM7LMc+iYieVj0vCccoFcYlx1MDAwN/lmcnJULVx1MDAwZfnpQv1cdGVl15OllbS7dbdNhX9iXHUwMDAwXHUwMDBi8Kgxs1lTxXFdeMTfSet6zS3SIFx1MDAxNvFYTbVcdTAwMTdcdLfexFadZJ+tXHUwMDBm3XzCznzNM1xcTEdcdTAwMDfFMkVjctD3W+yc7Ijn94t7XFwz2qzceDvwjjRcIlx1MDAxMUSaI4WG3+XBXHUwMDA2XHUwMDEwRETEXHUwMDA0Yex1OVx1MDAxNox/zVxuabHmrVx1MDAxM2kuMW76aHxcdTAwMTmAm3j+9J6b4bCHXHUwMDA0Q7tvdYmNuuOjlKFUsf1aIVcw9LGBjFx1MDAxZrgprNQu1+ZcdTAwMTPI1+FvmSSBf2y8Mlx1MDAxY1x1MDAxOXdmi5l/8G+bNlVZT7okR/jv+IW07by98ltfe+HYXHR+3Cq2XHUwMDFk96krZORPhJsz32lcdTAwMDVpd9GCXGbRs7fyRZN7xCeaN+tcdTAwMGXU0mpcdTAwMWHcnm7iRXW/iY2MXHUwMDAzLs5UXHUwMDE26dRcdTAwMDFhsJZaXHUwMDFjJaNSvFx1MDAxY3RcdTAwMDbziNf7v1Kt08pOxy5VWWZUI1hvZIjqY9uGpFx1MDAwMFx1MDAwMCD6gc3pXFxPWV+i9nRcZuAh9el4I2xcdTAwMTj6cCjrL//2XHUwMDBmtOBcdTAwMDemZod+lsBcdTAwMTVbmlFbsSxyjvC3tiFoXfDKXniyjna00TPeXCKS3WfTLDezj3fE78BcdTAwMGYv9Fx1MDAwZr0lloSiraA+XCL5NHu8omYxXFx2KXi5mFx1MDAwYl4qcPrsgFxifd9Bulx1MDAxYeo6XHUwMDFh01xcrb/OZqvsx1x1MDAxNF9uXHUwMDE3WZYkpOFcItBcZj9cdTAwMGUsgZBn04qyXGJcdTAwMDJK/cznfl9cdTAwMWTMlHt1Yk1K87yPSJVcdTAwMWb4iU9fXGJhJFxy5HcnOUrcqnj9a88936F8bUjnhfFwi1x1MDAxMDyTrco43ECXX1kqiMBcdTAwMDCyJmp9KvF5YCH/XHUwMDA2UCE1h3JcdTAwMTfmMftcdTAwMDJVatBcdTAwMGWMKPpcdTAwMTFcdTAwMTeSKJEpXHUwMDA0MPPjbrFcdTAwMTVcck/t5LOrfYqqeG5cdTAwMWUnXHUwMDBi41wiuOOHXHUwMDFiZVx1MDAwNZHkXHUwMDA02jNcdTAwMTEx6pdbsTaDXHUwMDA3VWS+hk5nXHUwMDFjXHUwMDEyflx1MDAxM+NubrIkK3z2MlwiuMapZup0XHUwMDFiXGI4MZulbzx18Ve+Z/Sz0425XHUwMDE5o4V3zXJvJE1cdTAwMGadTFx1MDAxZFPop3iU9I7JbNdqXHUwMDFj1+Gdnv2uKVZcdTAwMTJrQVx1MDAxM1xyaG5E6dE+XHUwMDBlTPhi+LhcdTAwMWa375mA31hcdTAwMTZ3Mlx1MDAxZFVcYnK4Nlx1MDAxYo5Fh5JcIpW1XHUwMDE2zvaC2Fx1MDAxMrq/O6debKekzFczXHUwMDE0t+LEwMtcdTAwMTBcXEN5I3Q3R1d79qqo4b96JGHz5/st+TZefDRZ2rhKXHUwMDE1XHUwMDBmvv34iVx1MDAxZUq6oD1cdTAwMGZuXHUwMDE34nzjlGdcdTAwMWQ7UGan+1x1MDAwYq7gKHZRyzdcdTAwMTZYcFx1MDAxYlE+e1xm6Vx1MDAwZVx1MDAxNlx1MDAxObIwfpouTXjWUMlqubCsrVx1MDAwYvG3sJmSRGaSlmjNxJVcdTAwMTZhkdJQ+VxmMchcdTAwMDJ/f3m6S2yd7zz2Jfm3aVWru/P6XFzln8hf9Vx1MDAwM+JZ8F12/1x1MDAxYdm+X/hgXHJ1eDXNc9KXXHUwMDAwrItcdTAwMGVcbuinha4qvz/rLnyu8U4zXHUwMDFkfiUkwKH8zW9cdTAwMWFcdTAwMDIvSFnakJDTMlx1MDAwMEp2a32O6JTpVGs/7pjMV7hoMbGqJUBzV+SP4/yDzMbSNCHbj1xitbK/RWk3lMHB75lxUfL6XGbqh7jU0Ow7uaudSzt1ov6mn9/u81x1MDAwM83NjclPclx1MDAxZlx1MDAxZrDA1PDUXGbf+1x1MDAxMk9cdTAwMDCTdzNcXOAokSVhXCKFUPo9f1/KOCeMzzamy91cZiP7UIdNurytXHUwMDFkroaYXHUwMDE1ikpcdTAwMDdcdTAwMTC6cFbqrciqWJ5ANzNv+OhcdTAwMTba/FmCplx1MDAxYkco0Vx1MDAwYvFWalx1MDAwZczqLPGZ/kqrWsDc1uVBvMuybMx94LtBj8GU85Ev5Ls691x1MDAwZkP8wIDlmtYr0fqtrv2l5Yi7cFXOjnBcdTAwMTRcdTAwMDH6wuad2Mtmqt01yKhgi37dkEimJ1x1MDAwMVx1MDAwYlx1MDAwMlx1MDAwN0nj4zQjXHUwMDBiQffn1Fx1MDAwNy9cdTAwMDLaXHUwMDExspBpSVx1MDAwYlx1MDAxZKNjLalsPV+DXHUwMDAxXHUwMDE0l2BZ5VxuunW2npa0S8wrWjDjenaAdyyleivEl5NJpEKquebruLOhlN87XZDNZ1x1MDAwMsdcdTAwMTmUQuLOXHUwMDEyOZ2VcJFIXHJcdTAwMTE5XHUwMDExv/1cdTAwMGZcdTAwMWM/n7LcXHUwMDFh5C2zwZkn71x1MDAwMVBPO/Zu3J3kbGtsNftmtubgc1x1MDAxOOFcdTAwMTbsXHUwMDEyXHUwMDE4ybRcdTAwMTKtXCLsvn9QvStW1Vx1MDAxMSVEXHUwMDE53MNY/lx1MDAwNOY4iWOR1mNQclx1MDAwMveQIG+hVPBcdTAwMWK2Y1xcXHUwMDA1XGKDmzSt1ps8VWeR0qhcdTAwMTdwLYFcdTAwMDRcdTAwMTnrJq1v8Z5cdTAwMDGHXHKzJvGHilxma+9RXCKcqGREUqtROCeijsJcdTAwMDSaXHUwMDE2r1x1MDAxNaxcdTAwMTHQ65egvEZL0vlvatWZNCUqP9K+zTGUn5SkOFx1MDAwMyNNfXxhXHUwMDA00U6hoqpAOsfa2ZQqeJtcdTAwMWQxpS1Ke6MvXHUwMDFjgCDCZH3zXHUwMDE0LT1cdTAwMDXKXHUwMDA022ZP8ySHTaZWYVx1MDAxMfDgXHUwMDE12+cnfDVcdTAwMThcXFwi76TZRcB/hVTGdmfwXHUwMDA1aylcdTAwMTaW0+lcbrkhavCcXln18ZpPe2bL6l+zqrB9d/1gcvKzLZHnXHUwMDFk5q3OZ8T1XG5cdPNJXHUwMDA1XHUwMDA0gIyQUeR3YLxcZl6bxVx1MDAwNMVcdTAwMTFsiFx1MDAxMk8r3zhcdTAwMTFcdTAwMWRTObXZKs9cdTAwMGb59Vx1MDAwZX6tp1Bd7deGUYGyKfjOoz9SWZnQVUNPn8NGgnBcdTAwMTi6w7E9/861d2LhXHLfdNmKWlx1MDAwNtPD+bdcdTAwMWXhb+fQZ3++3G3MaivOWyeHa5e8gnOyxlCKnvuRo4mINqCeSFX4ZOBcdTAwMDM6KNQvOmCdXHUwMDE0SVx0x0lIht2mwrfyMVx1MDAwMVaUlJ743iNccuHNydGMRcN1O1x1MDAwNXh98KK2XHUwMDE1juZyvVx1MDAxZjmnwYr6ZVlqusBgXHUwMDAwLVx1MDAxY/Vszmi7XHUwMDFjllre4O6rpPvZXHUwMDBiv7xcdTAwMTc6XHUwMDA2qPkrnHJcdTAwMWFmmctCYCq9MuHwXHSzjCRcdTAwMWOouZKa1XV1Rlx1MDAxZphcdTAwMTKet1x1MDAxN6fMXHUwMDExxU5P6FE0XHUwMDE1XHUwMDAwjPVcYp6Ip1x1MDAxNNfV2C+5Ia37XHUwMDAzwaUweZxL5kK+NWcr5X5cdTAwMTaxXCInNIxG/D1pbraRL3niXHUwMDA3aFx0hziToiz5icB1idDd2Tlpi3NI9Sq5TnV9uWzjt15/XGb/S7GugU5hT1x1MDAxOcRkntjq+Vx1MDAxNVi+l0ylYqW+k2U7uDIv4nWEXHUwMDE5a4uaITrhSGni7Y5KicUkq26DpsC95DS5oFCqn3nfrrRNI8D19du9LyOBVuiBME32tcaearFs2Uugj3lcdTAwMDKH5FZxojMmMfroj1x1MDAxNOqyXHUwMDFkkGrxe87uNHZcdTAwMDZcdTAwMTP+qt6sO0p9XHUwMDBmosb8sTH2SStcdTAwMGJnzKNWevilXHLPj9+mb92/8+iQXHUwMDAxoE6fXHUwMDFhPp9OVMQ679mmXHUwMDExOZL33lxiczWy2NpbQa1Gk7FQXHUwMDFlyVx1MDAwNvazQYajP+5cdTAwMWKshuObj89ZQLydNmpcIp9fqcVcdTAwMWP3eOkzXHUwMDEyyFnqp6Mgl7/taS5cdTAwMTZ7kVwiXHKDkFx1MDAxZmH3qz6ui1x1MDAxYnu7rl7jnTj0KZukKODf58L8XHUwMDE3dqXtOHiLwMD1XHUwMDE458x9w27r9FxcXHUwMDA31tGIn1s3uYAq/KSJXHUwMDAymWHim1arhmdoqKI9v+HTXWHkb1x1MDAxNqY3bsaNb1xialuPrCHks6zAR1x1MDAxOVx1MDAxNHgkjDpqXHUwMDE5NdOEx+V1kbOk39tlrqCaQy1NRWYk2audPyA43OMjxb/W9+hu8Vx1MDAxOL579PKGq0OgO1uPP1xiMvxcdTAwMWY7XHUwMDFjJpDKXGaLYnJcdTAwMTEq9ngzgJxsxpcxgOJeXHUwMDE1kNc36MFcdTAwMDbgx2lFyZjvZi+KkHJDwX3Uqlx1MDAxNqNBxstaw7cwZrafdp2Fw+tMUjK/c9o5XHUwMDFiRYu5wJxuO2nJa0J3veWJ21x1MDAxZaG4eYQsXHUwMDFjxa5X+/CV+HYr33XTwKlb3XFHN3j89HrDo1CocVx1MDAxYU719jPNZlRgL4QhrTmL1TlcdTAwMGZhXG7rXHUwMDE1ISApbIPW1OM0sUU2XHUwMDFj0CNcdTAwMTZIbfvYjzCmdyR+nMU2nGuOR6ZcIlvgNyvTVlx1MDAwNlx1MDAxYTZcdTAwMWXU05BN7Dyz2ulcIk+5KHHUh81+Pv7PlaqbXHUwMDBmNl1cdTAwMWX3vexlaFx1MDAwYjRcdTAwMWOETVx1MDAwYuXKliElikRvjn5C+c6Sn1x1MDAxY9Iwxz+SpzrEPWRcdTAwMWRIqyyHXHUwMDE5wPfQRWRcdTAwMDR/XHUwMDBlr0xcZorf9d3fMYGDiXFFJY//TFx1MDAwN+1cZvqeMVx1MDAwZv9cYtSbdsLYTE1FNylaXHUwMDEyPHyFiqxARfhcdTAwMDWbXHUwMDAzNMj4PCOO6bVcdTAwMTFffPxcbsmw2KG17abDpvw8SCWpQj6GJHtR/sHoxnrgbjdcdTAwMDJcdTAwMTFcdTAwMTTtdClcYiR4UjDXTfCe3jKVfEC6sz1d3fOelphcdTAwMTbTR1wiM4eINDxz56NFrthcdTAwMDeNoFx0R6FgfVxuRfVDflDWuDND9FVieeNa9Zpy+1x1MDAxYcpoflx1MDAxYir5gFx1MDAxZozQRUJPWGSkXG6tQ5j3/ZFcdTAwMTVxtjRw/eow2INcdTAwMDRvWVx1MDAwMvNRyKU7nlRcdTAwMGX6XHUwMDA1YcZpufedL+TVITSppc/aj79SXHUwMDFljXa6yNlR4ud16XmgUUaxXHUwMDE0ra3MX5tgR6I//IZcdTAwMTZo28XZV8y0Mjj0KLhcIv6Xr4Kjnd34e71cYptcdTAwMWbGvHeYbeCpXHUwMDExNVx1MDAxNWH3XHUwMDA0fb10yYWfqG/rsMvRNybEtvzH0XksuVx0RFH0g1iQ01LknPOOnERGpK8343J5Y1x1MDAxNzPQ9LvvXHUwMDFjXHS69Vx1MDAwYjs0d1x1MDAxNz6HXHUwMDFjXHUwMDAz5HUyXHUwMDFm022JRWtcdTAwMTbegSVbxUn+W+pjvHEqXTZlZPvSQKBKNDPqw+VIg61cdTAwMGZMXHSwYWmmXCLpZHq7+ZJ1TK3J+TtcdPRcdTAwMDFTkpykOSfAmoOPg2BUn+tccsJcdTAwMDG57Lojqcy6poJcdTAwMDdFXb+Xs5l0nj+5+G71W8FVRFx1MDAxObvJsJPL7SHOjW+Ttd1NXHUwMDBmPYq1X1x1MDAxNdm8XHUwMDE3fe6vo5p4XHUwMDA2S4JcdTAwMWTASXdQXHUwMDE4VXX0vYOnTrD20Fxc8ur41+e87Fx1MDAwMn+a57X1+lK/Y6TOOEi2sFx0Q72v6XnQXFzPly5cdTAwMTdccv2t0UTuv+pcdTAwMWUn8MAjeNlcdTAwMWZcdTAwMDSqOFx1MDAwMzFumKXJn4916Fx1MDAwMlasXHUwMDA0wfKlUlPyXHUwMDFk9LSgcaBcdTAwMWGxOFx1MDAxYzMgoeeYKubAXHUwMDBiyTx8ZfJohNxcdTAwMWRFXHUwMDAwsty3Z1x1MDAxM/hkWovlLapTfse35oyanFx1MDAxNVxmh35OXCIhZsDozS3Zx1x1MDAxNH5Ly0ygQVx1MDAwNVj6i1x1MDAxNlxiblZcdTAwMWbM8thk1ZWbQD/EzFxyOTdcdTAwMTeU/6QrVyCkIM9/78c21n6aXG59huyZmumXmnD5k8N2XlUqV5SbbugmyLn7XHSVriY+XHUwMDAx8OEznLCSWZnS56uE9Dh1NTg4/Vx1MDAxNnt0vcfIx81cdTAwMTGVzvryUJzu6iqH51xcL8iS2ZPrp4Kcn8KQjc247/l9iYFcdTAwMDdcdTAwMDCFzD1l2vA/5D1cdTAwMTHFdyqXwVx1MDAwMzSIp5i8brOgbadcYntoeamijyuiJUmmhlx1MDAxZNknXHUwMDE3km9cdTAwMDHTtJVcdTAwMWMm8I+3xDm8jKWwo2XP+FxcJnWnXHUwMDEx7aFcdTAwMTn3b6+zSFx1MDAwM5Tin1ivTyw/4mxNkfFGXHUwMDE5a0dcdTAwMGVcdTAwMDJcdTAwMDR8hFB0Up9cdTAwMTmTg1wiP9rGO1ncdzJcXFx1MDAxMoTUeFwiXHUwMDAw8stp3bSijqVyh1x1MDAxM2vtuiNnMf2aqFx1MDAwNVxu7liskMBcdTAwMDLWbFx1MDAwNSuwNb5cdTAwMTHPrX1cdTAwMTaoXHUwMDBiXHUwMDAzwrJTxlx1MDAxZTNBXHUwMDBmXHUwMDA0o85cdFx1MDAwNfA6+Fx0Ou4mP1xi8bDj7vJUxVt0gvFcdTAwMDde4Fx1MDAwMdvlrj2rr91cdTAwMWK/L84pkylcdI6+cGXKO9glWeVcdTAwMTZh2D1cXJY4XHUwMDBigf08ojCwVLGDXHUwMDE2Rb1cYoE/IFhcdTAwMDZpXHUwMDA0XHUwMDE1XHUwMDE4JT04MopZfNjlSFx1MDAwMy2zeVjlfN1gXCI2MHKcXHRcdTAwMTgyTTquzeSeXHUwMDA14Mefl1x1MDAwNY1LXHUwMDE3v/Jt+mdSMeXQqmozg8kuc44ru5tzIYgoYFx1MDAwMFx0o1xiepuua4rpXHUwMDEzwSUqXHUwMDAxPS9hVzm5nUqihK9i3Mc2lb5cZtrkREVBmFxyxEJPXHUwMDBixypwXHUwMDBiV67ifbVcXPz6PHlcdJVccjnjRT4pXHUwMDA0b3y1glec3d+4d1x1MDAxNLrze1hplFx1MDAxNnrQf85zmFx1MDAwM6lcdTAwMWNcdTAwMDNHTkxaZni5TYb9eimaR7pxfMNcdTAwMDZE56Uw1sOws5Ek11x1MDAxZmwgOdjChCOqWGnaS1x1MDAwNy9cdTAwMTdvwUBhsvGvnFBsbt9rmKmpymTe808uYKLNXGJqW3xcct9AwLT9wCGLyKKXL/VmX0FcdTAwMWPgXHUwMDFkvZrP249I7XJccjSh7DXVnfMpnoN2h1xi9Vx1MDAxNctcYkrUcFx1MDAwZfGTXHUwMDA2ZM7Y0Vx1MDAwNd81zZu2ZWVVzyraXCIxK76cN+JIaFFfP6nSlJ8osZ25XHUwMDE5xM5cdTAwMDbfqs5da1nz5NNf/ViYiNpHPtOxxOFs73VrXHUwMDAy/6b06sXjtz0+3eiYqFx1MDAxN2mAt8KA5CBcctxcdTAwMDFRNLSsUm+LJmWb5q7so6JcdTAwMDJi4ojLmo/Qj594zOQvoTvSOd+j2lx1MDAxZaviyF9UaUlcdTAwMTaCrlx1MDAxYb0z9iZcdTAwMDbNxjqLn7JPyqnCkHXqPFHjuHmDMD6ZlfSiXHSffLc57etcdTAwMWZcdTAwMDGhznKssVx1MDAwN6NS0exv+1x1MDAxNOm93GCKuYvwrCtmUVUgXGZ7yoasgd5cdTAwMTlRhvk6cu+XXHUwMDEycW9EgjhC6qqL8HXEgNnohjeWa0lcdTAwMTk/cqNRS6av7jwg5XJdXHUwMDAwMIdM80yQcFx1MDAwNeajXHUwMDA0Olx1MDAxY6ZF+p2edcZcdTAwMTVzlnZvyLGz0nl2bWmvbTuxy71cdTAwMTP+hFNcdTAwMWEztvr+J6m+XHSiiG6P/vhywlx1MDAxMv6B5D6nb3lcdTAwMTCUgEZcdTAwMWJXYviVVPlcdTAwMTdDRY/VTfnuXHUwMDE5XHUwMDFiMisg/LhA+bGN3vmwYX/LbDKAa1xmfWONSVx1MDAxNWd69Gjqc6N7kZQ4I+Sht377XVx1MDAwZvJs08/eu366LppcXIVcdTAwMTSNXHUwMDFkc1xiXHUwMDFkXGKT55GPsyggTPFcdTAwMTBOXGJcdTAwMWXiy9/Tm1x1MDAxNrC+isGCNo+tXHUwMDFlg03FNDPe9HdSRo9qXHUwMDE4XHUwMDBm61x1MDAwZnC5fj3lYZKAxFx1MDAxOE1cdTAwMTlYtFx1MDAxNy25LYGIOLvp+Vt/XHUwMDExJ1x1MDAxNiefXHUwMDEx7POOQJn7RS+Ce3nYXHUwMDFh5CmzlnTzaCtcdTAwMDaGamlcdTAwMTNQ7tpcdTAwMGb1JVx1MDAwNE7tkz+w+uBkX1ZcdTAwMDI5OjFcdTAwMTLaLzakOqDbvE4/fFtcdTAwMGa0z6YwZGgvRLKxXHUwMDE1fkXZRpy3TIIu3tnv91FcdTAwMWRdqunGUPw9p8rFVKBifFnnXHUwMDAxivFy519gioZIsmR0XHUwMDAxXHUwMDE0sTr1ulPro6bqbZ/3pHWF6dR3xbK/XHUwMDAz5MW3XFzkXHRun7KLWCruzF/PsFmUVeLj0oJcdTAwMWIoXHTjJeLhqZpWXHUwMDFjfV0olyi0uPsreZ43dbovVOH4blx1MDAxZt1cdTAwMTTw7Fh9zk36vI1n7ulH6JYmUH3wI/PFZyaU1l+Fe1x1MDAxZKt17Vx1MDAwMa68XHUwMDAwXHUwMDAxjmmBp41cdTAwMTaRbGtJv1x1MDAxZpvLJZlxq85h0f2IvovNVDvOXG7dhfaQWFx1MDAwN4r3MCdd/KHmXHUwMDFibea+XHUwMDA3myuPgJqL0JfJXHUwMDE426dcdTAwMTFcdTAwMWFcdTAwMDTgI8/fblx1MDAxYfxgXHUwMDFhwWZcdTAwMTj5XHLjODn1Of1WXHUwMDA1ezhcdTAwMGbF4zbVXHUwMDE2Zvli+lx1MDAxNbrfSp2ukJOz1UlgLCzNO/Fcclx1MDAwNLtOgkp5zk7+XHUwMDE2hJtcZmygL5KtXHUwMDE2Np5N6rjHXHUwMDAxXHUwMDBlXHUwMDE5tv1qe9v0L0fpkP6E2aDW4elurfy3XHKAyotcclrbqd1IPqCq01x1MDAwZa9XWPZDoFx1MDAxN51plXqOcu9cdTAwMDStlGCWMvchtZ7liT6UXHUwMDA2KI09lZkghz0goJIyaYeuXZvCXHUwMDBmsa+YTVx1MDAwNieRSnyqvvjvfv9WkFx1MDAwZYUkXHUwMDFkZ8b0Xlx1MDAxOGDia1x1MDAxML95XHUwMDFldft3syd+XHUwMDA1RYva0Th+XCKNS1x1MDAxNNtFRNNpZ8xNLlxi2r5YfsSPhS3dK1x1MDAxMlx1MDAwMEO6oFXxUzn/3J84Us7L1fS46bL3uaoqgYJ0XHUwMDE2+FZjR6FLy9TdXHUwMDAyS5E6XHUwMDFiXHUwMDEzXFxFY1x1MDAwMzi87vBhvjPfUZU6PEU7iKqAW3IjYiSTupVcdTAwMWPaL3e2mIT/Mu5YdU6XIYD/XHInzOxBNJ1cdTAwMDd5JN2j319ZUZVcdTAwMTb7pFwixzlcdTAwMTDegGn+XHUwMDAyTb+OXHTT0lx1MDAxOTdhnpcrn3r4ofjaXGLIQSaw+zuDR6zPsLXnb3BcdTAwMWM+Zd9cdTAwMTdcclKd8Fx1MDAxYrqXiPB4+5Z5XHLCPiS8XHUwMDFlIDtLTM8hy1x1MDAwMGW2uj5cdTAwMDR8Wv1iXGZFdilGx49cdTAwMTZhtsiD1kPOy7C3iyrllyN/glx1MDAxMdfR0lTjhjqUe1x1MDAxM9dgXHUwMDE5blx1MDAwYklJXHUwMDBi+GWeRvqr1mFRletccsqR31RoovduM1xcXHUwMDEzXHUwMDBi3OdbOELkTrrdbThfS+V3eev3rtZ22ljAad8s/MpqvSXqiCNcdTAwMDaXdPryoiQ/QyTbcf66vWTFa1tcckEpXHUwMDFi85yhfo60U/Zf+jXtnFx1MDAwZdCWtLVq1EN+68WIM1x1MDAwME7G899H44hOnlpjp84j9US8N72lKozFOdNxyebVrVxyZy+iN1nIkzZsKIA85lx1MDAxONvIbDWUI1x1MDAxZeJxicWNXFzbXHRUYtmy2lx1MDAxNTld90Q6aWc82k1bUtI4nJZcdTAwMDWaoPWkKDJNfibbtvhcXOyFr1RHXmXI9GQkllhcdTAwMTFcdTAwMDSg3Pd+XHUwMDFicpTxUtTUnN7bWexjuCr0q2Jm0fFcdTAwMTaj8/eQkDuxMVx1MDAxZWJR8PPQ07gwiVx1MDAwM/npbiVl8Vx1MDAwZVT9aYdcdTAwMTRPyofcl7Qsz+ZlkVx1MDAxZJpl6LFQalxuUtJ/vIdcdTAwMTK+vc1pf2tccu1G+EWUT+Qh+leDbuIzXHUwMDEyz2do9LdcdTAwMTiv60OjYVq7cDXD+Vx1MDAxYnWkelx1MDAwYlx1MDAxOPqJubR5VLfN93o6NOHqwUufOi9cdTAwMWNcdTAwMTFjw7Q00cWRXHJcdTAwMTXnXHUwMDE3ylVPtpNukPuF92xcdTAwMTGR94GeXHUwMDA1qreEI7i/XHUwMDA0W96IbDPYNV2QeH+NePh+mjTiV1x1MDAxOfbXVVbhSthcdTAwMTPP4Vx1MDAxMn55rd5cZvaD5Le5Plx1MDAwZlx1MDAwZZhNvIVxji5GpbF9n4lJK5mdXHUwMDEzxEc2XHUwMDA0XFy/ij5iQZr5JWxcdTAwMGZZXHUwMDA1QfzaaZBOqmt1XHUwMDBmocFcdTAwMTDWx0aqQ/Un6/iQdyab7rHnXHUwMDA3nFBcXGvfXHUwMDA3RzPV2XHiJZf9mPtcdTAwMDdi9ivikp/+U1ZcdTAwMTjagbtBrFMk3ULONMb8XCKcx95MvJgqMSr0fP496rW9M1gjXHUwMDE2XGJcdTAwMWTavdXenJowWewxrSjqg+2pqsGHQNt0dLZlXHUwMDBmOtLZXHUwMDEwd8+zeNiyqm8/UGvIXHUwMDAyXHUwMDA1tVx1MDAwNvBDxIHsXGbTXHUwMDE5g1xu7ylcdTAwMDTIydZalJJDN+WaXHRjLIhnj2Br1LbGlnmV4Fx1MDAxY46u91xikVvQwFPa7D3Er1x1MDAxOXkvt8ybJHlcdTAwMTI+TS9w8lx1MDAwMF9TXHUwMDE3ivhJ3IRKXHUwMDFhaeo4sydoK+za6WpBUVx1MDAwMspzllx1MDAxYy/qXHUwMDEyW1xmJlxiQVx1MDAwNlxcyXRE0U3iKHJVqdii81Dh3YaOYlM6e/4wZF7v9ivL+vhcdTAwMWRosdtccmX32I92XHUwMDE02vdv89JcdTAwMGZfQ4IzVmNcdTAwMGZB1GnIP7/kK65EyVx1MDAxZsxcdTAwMThcdTAwMTYsz1x1MDAxMTh9lKLNf5pZc1x1MDAxNFx1MDAxOVx1MDAxN1x1MDAxYlv3xsDH62TIXCK9w90nUV5cdTAwMWOYhEV4XHUwMDE5Z+HdOFo2VmNcdTAwMTT5XjL4p1x1MDAwYu2mt71QXHUwMDBlh8L/f7m+kpx7jWKs0puef9hsjWuphrRcdTAwMTW0XHUwMDFkiMha/KHIT1x1MDAwNFx1MDAxMNiNxfGX13e6ubwjXHUwMDA3XGJNWIUzO3w4/7W829vtyKv395NcIsaTXZs1bFxisK0oQ/qBL8lbvEDL7IbZiFxc+Kitz9/aJU0/qH7YPi5HeS2r/uCXV+WJ2lmnXHUwMDBmcCbLXHUwMDBlVCZdqkVPeJydMFx1MDAxMIXmN1x1MDAxMbC0ZaJ4ycVcdTAwMDNcdTAwMTXefZZ9JnTVnUe6a5K0oKNeXlxiSj8uNCiMxo9wQ1x1MDAxZbuGi1WdMFwiXHJ0XFxcdTAwMDTtgeHvkUirUejoXGKhr1x1MDAxZLyXXGKw9+PoMvaagYvfrksgwHOKssD+Tn1Yj5ThXHUwMDE5pdQuXHUwMDE5LrLPgH1leVx1MDAxM3+fMesje0zkxFelu8FNs91cdTAwMWFcdTAwMDVwaIVwgqaB4sI1JEwjgpvkXG7cTz+CR2msk1x1MDAxYtC3M5pK3XdcdTAwMWHvgVxmXGZcdTAwMTJwPMmohH8gjcnYw4j7dVx1MDAwM1wiXHUwMDFmXHUwMDAzNPp6mGdcdTAwMDVrsmVcdTAwMTAnSUEgUcTfdyPW18yaIFHVgrtCXHUwMDA0+TLDTlx1MDAxOFxy/mroPkzfYp1cdTAwMGJXd5VcdTAwMTdcdTAwMWRVfsZcYpZ/7OPQVPXpiLdt31x1MDAwZWyPkuV7WfFcdTAwMGLXqpmjWjJfXHUwMDA1a3xcdTAwMWUyMsm+Wrf2P9Rv0Sxw/dlhZzth5157NOHSpde3gWFcdTAwMGLgQblcdTAwMWZHajEgT4xFTEPhf9+Dklx1MDAwMnu0ezDZRjs748+ensEnLXPgPlx1MDAxZv3B8Vx1MDAxZCj0jVxyfbCbppNet1x1MDAwYsR1cuYxsqmxQTpcdTAwMTldkzd3fmlFKWUtm3j2YFx1MDAwZrx/2tt+cy01XodcdTAwMTRUXHUwMDA2f/9+pch15ZiTf+CdXHTa/VxuTTPZrF18vVx1MDAwYj9/wsfpamZcdTAwMTDvXHUwMDEzMSmN+VjKY6XtTvtcdTAwMGKAJ35cdTAwMTRBmvJttLyy9p3SndbU76BG+qFF7lx1MDAwM8AqLufj7vNTvbM2qqe96MNcdTAwMTg3w9g+yWj4qLH0OOzagIzlf/vViTf1tfGugthcdTAwMGbOXHUwMDAy6Vx1MDAwMlrEx+FT9MlO41x1MDAwYl94mfxcIjQgiDA90lx1MDAxMEPvqIxOuFxiulx1MDAxMvi+gPijXHUwMDEwXHUwMDAxLrt2aafyWJMg+CrkW263omN6bFx1MDAxYuXEV5BcdTAwMTfz/lx1MDAxNslcdTAwMDbnZHo2XHUwMDFmXHUwMDBmxnWE5/eZSW9cdTAwMDNKV3u862SAoiimfVx1MDAwMoDehIQgpbjHYKlcdTAwMGbZU1x1MDAwZXa/9lx1MDAxZYmL4cx5SoHVXk2L0jNcdTAwMTSMpdheNDGCvW63stbFxUzPLihcdTAwMWJxpSndbs8voDGYJv9cYmgqtNlcdTAwMTGRv7WCSKBGpoKrXHUwMDFkX36rRKa8erEm8iNnRpOiZoiDIL1pSGuhjyx3mFx1MDAxZVx1MDAxNs71omRB7WfLIaiYXHUwMDE4cZg0XHTcUp/Pp/7wX95cdTAwMGVcdTAwMWM0kFHfoVx1MDAwN33O/c9LIyfdbj/xc7NcdTAwMDKgO7uwnDWK9Fx1MDAxOJR13Vx1MDAxY65+XCJ6XHUwMDFh0aBHU7pMy12z0fflSHlcbkQvKCzuIYm7Mu3zNr1rL/dcYq3pr5BmLFx1MDAxYXKGTtxBrl0xLvs25lx007e3ONz79kTNhVagzspec+K696bRfYI6QObTgFx1MDAwYlv0h1x1MDAxYo3RlULRL/CIXHUwMDFkk01CY8S/Lqc7XsdcdTAwMTVcdTAwMTJcdTAwMWVE0zxcdTAwMGLLejzyM4VHXHUwMDE1KMVcdTAwMTaqgVx1MDAwMdJ+ostcdTAwMDG38V7rs4YziHL68M/UXHUwMDBmt7lRRM5qXHUwMDA17ZjbXHUwMDE07F9cZrok7SVcYjJcdTAwMTfHXHUwMDE5qsChmLKKT6E7XCJcdTAwMTF5itOeW1qOXHUwMDFmR5uttJz39deNXCJhdoqyMY5jXHUwMDE4XHUwMDAyXGZvaSudKJpi8/gzhnFk1IGF8tG0/8q0PlxyZlx1MDAxN1x1MDAwYtKrLpk/fVxy6cJcXJtBwWPWX3a/uuVWXHUwMDFjj1x1MDAwYsRLJ21jr+84oTFnN6mW1tDgsXhL4iF311x1MDAwNk1m+6d38O8qc4T/1r1KTOw7YYQn+tlZ0/dIZkRZXHUwMDA2w0lcdTAwMTRcdTAwMGY0zrjzQlx1MDAwZlxuVzrDsiw/e1x1MDAxMfFPXHUwMDE1+vChYaJcdTAwMWHvVbFcdTAwMDXBz0RcdTAwMTDkmb9cbkVcdTAwMDF0fCOpLrCMXHUwMDA1XHUwMDAzL01WynRcZutcdTAwMTchZ3ad9XmHXHUwMDFmlm34+1wielN0y1x1MDAxN/smxVx1MDAwN6mT3m/x8v2kzVi84urszFxyUNmCtZOJ8p27cPzE/Y+WYOBcdTAwMTe6NGQz6q78VFlcdTAwMTnkO1x1MDAxYlPpc+/RjsNrXHTcs0JGXHRcdTAwMDeeSuPyIHmgikdzXHUwMDA3go5cdTAwMTNcdFx1MDAxYZxL2tKkf7dcdTAwMTdMXHUwMDEyXFzCXHUwMDFi/86eN/sjlJbxJEZZ/ejcW2JcdDhcdTAwMTSYoFx1MDAxMGxUK1x1MDAxMVHac2muIWD2e++tgnmTUFwi3o5j42QotdJcdTAwMDJ2XHUwMDBmy1x1MDAwMlj6x3LcLYfdwFx1MDAxMb1ftVx1MDAwNG/7z29eplT4OrPoMCrPV+KQpFgjXHUwMDE4jlx1MDAxMHeaPpv8MGQ86tup64t2yfK2yd6uR8VcdTAwMWXIbt6Lz9qJqHv323RlNFxcMe0+a2NcItQtXHUwMDA1vjOBXHUwMDEyXHUwMDA0QWD3JV+lXHUwMDBmdFx1MDAxMTGWc1x1MDAwNKMsJ+1K2M7Ia27ttG9hYIhObZ3ja/VIeJ+EmXRJw9f1p94ru+9vYuxns1x1MDAxZFx1MDAwMVRpx36awsyrXHUwMDA3nPgoXHUwMDEwySvDXb7WYJl2XHUwMDFh9iHPkELjtVxi5Wt4Nlx1MDAwMuBxPchkgEdd/Vx1MDAxY0bGv7aY68Nn6rbRsFFud1x1MDAxYk88t8a6RNZoXHUwMDE2YShVM2xcdTAwMGWhM4kpjsjTd5RcXGdcdTAwMWMpYFx1MDAxOKpTg4DZU7nNgPNcdTAwMTVQK3RfM/nlft97vibLXHUwMDE3snBzXHUwMDFlvrUgwDAkRzhYlZv+Mb5VXHUwMDEz43S8IYtcdTAwMTAsXHUwMDA2jO1d140/h8xcdTAwMWR0k2S/1CFcdTAwMGL4LlxuXHUwMDAzfFx1MDAxZHo26PI36HJ2smxcdTAwMDaW2ceznXiEPKtcdTAwMGa6z8CpXCLUJI3j2C2vXGKcfVx1MDAxNpc8MK3ubO6PqamyU1x1MDAwMTDzjqjYy4qkK4AqbY9gNj3e0r51OuhvJ/PVXHUwMDA2ekZKs2t4QFWtcIpzmJU2TVx1MDAxNdlleLxY+nvM2+ZBYlx1MDAxMlx04rwlXHUwMDA0XHUwMDAyXHJ/e7y1W458U85cdTAwMWRtI/AhXHUwMDBmXHUwMDFlXHUwMDE56GtcdO7LXHUwMDE4e7aU2s+g+lxiLFx1MDAxM1x1MDAxNFlBXHUwMDEw9Hz9dm1ViuJ4uV95o2/9ik9ZwW5T1cLI0CxKNPix/opyYq1cdTAwMWXv52rtXHUwMDEz56Bkvkm1OOM7bJ2mXHUwMDBiq8xcbkEpQeN/nVx1MDAxYcaSvp1agGq20irpXHUwMDAyXHUwMDA1fVBwiJ3Jt0Etglx1MDAwMC60RUdcdTAwMDJcdTAwMTKDo2irxlx1MDAxMT2H0vHLyFxmILrX2qLsdtrxx1x1MDAxYzqyUUpFJSpcZo3+XHLYwUBcdTAwMTBx+Vx1MDAwMVcr7Vfk9Xf4zZeSwHKvqMryXG62ooiyXHUwMDAyYYagSFx1MDAxN+PfOqpcdTAwMWKqZzlCw664bURcdTAwMWW4XHUwMDFhN9B0ry1cdTAwMWJ259ZfXHUwMDBmkmnbT7OhpkaZPUXT7LdcdTAwMTUvZ0VZ2dFcdTAwMDHEtGjGXHLwsC9cbqGo2WS22V9cXGd/xlx1MDAxNHw6+N5mJLa0Xq1cdTAwMWFcdTAwMDJdK5C3K1f3qlx1MDAxMPBpw6xOOctLc8zYXHUwMDEx4Vx1MDAxZNxpv1x1MDAxMKt8Y1x1MDAxZWBFN/LaI2m6XHUwMDE4XCLULFx1MDAwMKmj9HxE5G1u03i1faeG8W1cdTAwMTTWwbXJ51x1MDAxNFGETcTLdGS8cS5cdTAwMGL6aNxcdTAwMTdcdTAwMDQoplx1MDAxY8bByNdZPzkxsr1cYi2ZPnFsp1DqovEjeWn4M5/zXHUwMDAzXCLfT55aXHUwMDFmNVFkg1x1MDAxY1x1MDAwZoKjPlx1MDAxZVx1MDAwMr2xXHUwMDFjcX8vMlx1MDAwNMdcdTAwMGb/XHUwMDEw1o5cdTAwMDSIXHUwMDE57D+Z7swhf/k09Xx4z1XrcVx1MDAwMndOJkWsiIlB8ot47MyTprRz1WrCi8P1yvRcdTAwMWXCXHUwMDE3xMiihSpVWPRFI1x1MDAxNd/AnCfM6V3JalWPXHUwMDE0JyxcdTAwMDJlblx1MDAxY7+w86s87OmwKqdcdTAwMDGpselI9CZcdTAwMDDIvVx0nJFcdTAwMDW6sUg+X2xcdTAwMGZcdTAwMTjtXHUwMDA111x1MDAxMjVcdTAwMDD4OyGJv3WAYFx1MDAwN65zn3bJ1Fx1MDAxZWRBhm6RLFx1MDAxMjGeefvQKEWvQLJcdTAwMWFfzFx1MDAwNzivdCaCTje4IbDXT7Yoq21vytWAZq2TPn+g5khcdTAwMWFcXCPf+1x1MDAwM4pcdTAwMTP/9erQVsRT8Vx1MDAxY1x1MDAxNYe6xUnXSDm0XHUwMDEy0rhcdTAwMGXsLqEoXHSRgNTwhLHL/8mzw5rfdqnlKvp7cbhcdTAwMTJZ7eBgMjaPYvaaXHUwMDA2mJdAmPaF46eWaXRdkzSNuVx1MDAwNZPK1VxmRlxm9KNcYoo3RIdcXKwrXHSFXHUwMDAyTF9IXHUwMDA1KpKUYWv51MxTbIjKXHUwMDE1uqlcdTAwMGaZ0Z7viVdccuu4XyXwLKs0cFp6ktRh0kxcdTAwMTnHQFxiXHUwMDBiKOl/t3NHXG5PvbEr4KKTR/09c+qypCx5U0hZXHUwMDE0TlxcVstcdTAwMDXXQVGSx1x0Rmq/XHUwMDAzZsNcdGyo/0RcdTAwMGZjJafYXHUwMDFkhVx1MDAxZVxmwI22fmBlXGLi1ZJTnJRM2Xw+7iVcYjSCW1xcRqZcdTAwMTb2pla/XG7CqGWFL59cIsmh5SmUVJeIXHUwMDEwcrF9kf1cdTAwMWFWxp/yXCKpIFx0k0OXrFhcdTAwMDK1lZ9Sh4+g6Vx1MDAxMFfARLFVVFMt5kSiK2bM67qLmOBaOlx1MDAxYYqoS5KTXHUwMDA0glx1MDAxOFx1MDAwM2Y/NN0l7isjOIxNhtPP+6RBJ+EmXFzZ6SXDXHUwMDE2I1x1MDAxM0cx71x1MDAwNVxmp2jGnGFtpHzlXHUwMDFlPTJob4HDe6iS4dZMz4udXHUwMDBiud872/i12oZQXHUwMDBiXHUwMDE0mO/dSOAhR2/oYPim0EzBnD5FQn5LnTyS3+DJwbdiO5tcdTAwMWM9lohcdTAwMWPVMJvTNL3nxV6o+l7wXHUwMDEwWzJcdTAwMTV1vKv2kD52XHUwMDEzuLDIm0bIKmUgXHUwMDFhlVdwNjRcdTAwMDWqNVx1MDAxYzhtvlx1MDAwML/BUEeDfoBX7IXhXHUwMDExPj7M253+8VhdXHUwMDEy3HmQTY1blo/B485cdTAwMDerdWxGfy5WfFx1MDAwZW3njJ9cdTAwMDOeolx1MDAwZd4qU/lcYo/Mu7A3XCLHi7ibW8syqttCdPzYf3I23biqnqON+1x1MDAwNoY/fuGhhtpYXG7K4WdcdTAwMGaAXHUwMDE5flx00iTwiJT1mXjHZyYzXHUwMDFjY1x1MDAxZYdcdTAwMDEp31rh4XHqg1x1MDAwMI2WLp9cbiFV+FNGPa6207KJlSUtUoDngFwiXG6/XHUwMDBmP86/oOdcZnO3W7GGtfqB1mO067JxvzrGn9Si0I4jO5cqX0RQUlhcdTAwMWMnmbdcIjqRgc73IEFbg9o2Oempc25jwLiqXHUwMDA3JNjmmzJcdTAwMTXIa1x1MDAxY0d4d9T8XHUwMDFjaS/+Ok+9XHUwMDA1/kKwj1x1MDAxMVxc07f33u5DNO2ijKLi9GWoXHUwMDE3JL+VX5m9XHUwMDEyNDSfXHUwMDEws0vDoFx1MDAxN9P8/MCLwnwsXHUwMDBiJWW8XCL1gc2MrbfT2MhcdTAwMDXmRqpl2KFZ1Dt7m3jYfWpcdTAwMGLjwlx1MDAxZGJcdTAwMGKkXHUwMDEzTJDEMNIv5uLombjDPqfW9yRRlMzDJFx1MDAxZkXJZt2fyDsmXFydVsOUtVx1MDAxOENnl6JcdTAwMTTMPoZhajO7XHUwMDBmXCKOxnuJR9tSWFx1MDAwNCpJlm1SkoBcdTAwMTRcdTAwMDaog4lY3Y3nXHUwMDFijDa6lJmeXFxcdTAwMTPlQ+YtbFx1MDAxZWpcImZVvnIoelx1MDAxZZZMv1x1MDAwZdyeVdP2nm2TUj3IXCKnc8PIizNuusrXxIXxnfxwT+ek7NV9PmyOzvZtRIxB/9i42TFcdTAwMTZcdTAwMDPBN4CTwzBRk7rcwuFIb65cdTAwMGLTVU3iXHUwMDBiXlx1MDAxMclcdTAwMDezKrP1fY5Cj1x1MDAxOct6UkNcdTAwMGKZyKlokUwvOZxe/stcXHc4uFx1MDAwZVY9Tl5VXHUwMDEzZFvjXHUwMDE45eW6jsNQk0nQV1wihoK0jm9IVqhxxVOkzk2P2WkudSijX5+eiHdlW3AhwFnSw0ftzX/+dqqFXHUwMDEy/FwiyVx1MDAwMcwkzfS8blx1MDAxN0JcdTAwMTKFXHUwMDE41ImCl3aR5idcdTAwMWNNS/jMXHUwMDEzTpSyJSqsfqPSrUTJXHUwMDA1qfe0X5CITkN/XHUwMDE4SjqxWrDrLoSnX1x1MDAxN7c5r0errlx1MDAxZcZRe8O9zHNjgSdIL+NcdTAwMWRcdTAwMDVRoubs74BcdTAwMWTyXHUwMDBifShcImPc0z/ST2E08/5cdTAwMDVcdTAwMDfXXHUwMDFlXHUwMDE5OTBHLnlvWtBcXFx1MDAxOFNcdTAwMGVKIWO6SVx1MDAxYmmLmFx1MDAwM3+KkeP4y6L8vfOctSdcdTAwMDAgXHUwMDE3mMe/7VqdXHUwMDEzrLVcdTAwMWSatl+9gWNDXHUwMDE5i/1OyGFcdTAwMTA2t2/tU5iGsYdcdTAwMDYhft1cdTAwMWVmcehQvzhKlFx1MDAwNiVHNc6LkiOBkNHh2TN9/1x1MDAxYaRBXHUwMDAyb1x1MDAwNepdXHUwMDA10zBcdTAwMWNcdTAwMDRcdFx07G+21GSJUq9bJ+tO41x1MDAxNEumW3TSoGejdyalmOfOLNrP2MPGOkFvXHUwMDExWl4hJ33IxjOzkjmfwW4nsOfraUmtXHUwMDFmXGZorFx1MDAwN4RneIt7XHLSpFxmXG5cdTAwMTDDmlx1MDAxM4vZtlx1MDAwMG3dXHUwMDFlflx1MDAxMVjiwNu4OOr4ti9cYl7xPLVcdTAwMTJrmOxlXHUwMDBlf7ta8OFysYBwnsqCW+dcdTAwMTNcdTAwMGVcXNPwhE2Bw1x1MDAxYYGIaqoriFJ0kaImXHUwMDE4b76ah0lcdTAwMTBcdTAwMDRRXHUwMDBiWc2ThdC+z2l469VxlEVcdFrPqJA+Xixv35pcdTAwMTcks/i2XHUwMDE0T0QxZzpneoMw/55cdTAwMDIkXHUwMDE4XHUwMDA0IVxudSqq+afbXG7lYMhbpV5Qhz1zZ/xFvFx1MDAxMfxccpnrVkWfWDkn1T7L7tW5JO+tLyhcdTAwMWL0mVx1MDAxMTVcXF1lv5VLtj8wXHUwMDFmf1qJr3xhkiNum4N+5tNG4JS2l0pcdTAwMDNyXHUwMDE0L1x1MDAwN57ByNhV1lx1MDAwMsHYcvjHKD5vlOhcdTAwMDC4clx1MDAwNNBIrIjhZVxc9d97QdLEM2pcdTAwMWFcdTAwMGZcdTAwMGVcdTAwMWFhr7fVZFZVz0rC6TPKheA8+HY7mk1cdTAwMTScZES0sfqUKPdfxYhknlCeKVx1MDAwMembSiu9sU3g99VXXHUwMDEyPFx1MDAwNVx1MDAxNE1cdTAwMDNcdTAwMWFcdTAwMDRCYNNgbNTkLVTvfcfN6bblQez9/frAaUyoNVSjrNBcdTAwMTZGS2CW01ozz1xiXHUwMDAyU7I/N8Kuyend2vVf3eNb+euvXHQ0ilx1MDAwZeRcdFf6dTnNXHUwMDFmZ/k2WMr96EJcdTAwMWYu31x1MDAwM69tVVx1MDAxZWdcdTAwMWFqlu24QuGsXHUwMDE1KC+oy1xiU1x1MDAxYjRcdTAwMDCMwshcdTAwMWK2iqosNtJ1teDXiztYL7gpXHUwMDEz2Sagt3i4mFx1MDAwNKG/L1x1MDAxZUvZj5DPmvBcdG0za3hpuWvPtWp2JFx1MDAxOFrywKFku48nQHJcdTAwMDLhlv9cdTAwMWXUzKB5bFa57jNcdTAwMWPerlx1MDAxM1x1MDAxMa9zXHUwMDExp1vLSYxlXkHw+0hi+YxmzFx1MDAxZlx1MDAxYvhd6MiYQYlAsav4XHUwMDBlp9b99Ot5SJu3pfVavOlO5rtjaTTsXHUwMDFmYJSSmuTxJy00eiST+Np1lFWC5E3r5dZi4GSJdGhcdTAwMTbl9luKYtE0XHUwMDEwM0aQXFx1sGY/bjNEnvuJvSQyXHUwMDEyTYLgZlqNkzVcdTAwMDaSdvW/XHUwMDBmutlcdTAwMTVDvnH9amZRJt46XHUwMDAyt+Sf94BH9oBZSczPXFxcdTAwMTDYceNcdTAwMWFqdP1cdTAwMTKP4Fx1MDAxYj0t2G6gWd+OXHJJbl5cdTAwMTmS1WpcdTAwMDQ56SRcdTAwMTNIpmDILs5xlYtcdTAwMWbpPE9cdTAwMDdpJZr90q+mYNX5/Fx1MDAxMsCdjDzok9bVfZGn6Vx1MDAxNyGUXHUwMDEwS1pPRNm34YzRrFx1MDAxN/JqXHUwMDA04Yvt7mKw2Ug7d5Ax/DffrcRcdTAwMTeal/bcN0CsybpeJ8/PZEVcdTAwMDD0XHUwMDE3XG6BJrGevl9bXHUwMDFkzHHN+t9cdTAwMTBgvrBcdTAwMTn3elx1MDAwMpRAK0JtLpmUR9FTXHUwMDEwXCJwb4hFzYlUXHUwMDAxXHUwMDAyhDF/1cdcdTAwMGWNX3yMMnjf9cxP51x1MDAxMLvx3lx1MDAwNpafx+r66b1EXHUwMDA2Wv1cdTAwMWJUmqM+qC5cdTAwMDDNJ7BHXHUwMDFmiFx1MDAwMKdcdTAwMTWcMk2sjaBNhVx1MDAwMUP+YGpCJXdl7ypcdTAwMWXKkFPFMFx1MDAwMFx1MDAxONq82tJDL0f5jotccifpjedNkTP0VmG/uul+nL8tMNTXc9+D+DJ02/FcdTAwMWOvwlx1MDAxNLUg//rxXHUwMDBl6m7rPVx1MDAxZNGHSjyaiTXNi1wi27T2lDC93PrSjVx1MDAxM97rOJlafuJ9dKThcFlqXHUwMDBi+7tcYv7d+MGiMXrSM6p6zTzrlzLFO5xcdTAwMTEoRsc7jFx1MDAxY0VoPJN/a/nVVlx1MDAwNVx1MDAxY0iEXHUwMDAzmo1cdTAwMTdb/Mff5feb6Vx1MDAxMlx1MDAwNeAtXHUwMDEwa7CPnO3Qq73FdI7NMTbC5J+tJMKpXG7oXHUwMDAysklcdTAwMWaCLq12y9JfvrWjJoieRlxcSjoqzDk15H+6outAxGQuJDBzbDxxXHUwMDAznyjyM1FcdTAwMTStMeEx5Nb042VQXHUwMDE1P4qJJssvQoGSe1x1MDAwMIe1nN5/fCWd3ntCr1x1MDAxZVXDUeP+pvZkPuJirrdoutiw31Hz3ITmsac5gJXQK+u0kV84RV3f35i53S+oIYpITlx1MDAwNnN6U15E7djHnzyR1VwiPlx1MDAwMu9cdTAwMWJgIHqAQUXWokHTXHUwMDE0dVx1MDAwYlx1MDAxMl2a6X2AXCKSkUQ8XHUwMDExSGxcbuwqhl5Bf820nMxmkolYXHS1XHUwMDEweIH8Xp60nLvNekNW+ElR+onAakUuoL7ih9nvr0fhsjd0qVx1MDAwNIpcdTAwMTBNXHUwMDEyLGYmXHUwMDFmXHUwMDE3yVxmonfc/6/T22rrMc9qW8bMS/Utbaj2zahcdGNcdTAwMGWY5m1grFtcdTAwMDXsSbo57rSle1tcdTAwMTAkwV/iYfJx5EPYKSXrt9xcdTAwMWXomqqFrEBOfzU+l0oz2jbnuVxcXHUwMDAyt/SfUqGWqPNcdTAwMWHJptSXY7ZMeJ3uvVS+uFlcdTAwMGY8wCf5vdk9wWLw7eBHs9A3LL8tlbB/XzvuQVD8cFR7qI7bW123sjJcdTAwMDJcIpx8QYWlX1x1MDAxZYfdelx1MDAxM8+lXVcoP1x0xZQ1p9YnVWy4Tfjw0rYuVPgjzCbmw1x1MDAxOHrHXHUwMDA14D+3itdiXHUwMDExXHUwMDAwXHUwMDE5MyrdR7Cd9du4iKBBSlx1MDAxNFx1MDAwM6c0olx1MDAxMFx1MDAxNKSNXHUwMDFilzr1UNBcdTAwMTlcdTAwMTdmidQ8N0GfTXxcdTAwMTJ9gjDdJd6Rpj5FXHUwMDE1wPxcdTAwMDZfWOmBXHUwMDAxnITslurPhG1iUVTV36dHVilJht+kz3vwVIiYRFx1MDAwM8xcdTAwMDfDl1x1MDAwM8RVb4Zq7P034yNLkuI3yFNDnzpcdTAwMTdfs1x1MDAwM1x1MDAxY1x1MDAxZcPVXHUwMDBlwImXIz9QKU5cdTAwMDIno5zsO8hd+3qXizVcdTAwMGb+XG5cdFPYXHUwMDBlmIFq6nW0XHUwMDE0/85cdTAwMTH9yH5cdTAwMDHfn9jscrbhq7aSML5CXHUwMDAz0dEjq7t6ZFrYOjrthKXykUI0XHUwMDFhrEC7glx1MDAxOMDj5iNdwlx1MDAxZFx1MDAwMOggQqYpUDH7V59N1CMrM/EvU0vZXHUwMDE2yndcdTAwMDV9b3xqzVx1MDAwZVx1MDAwNOAoQlx1MDAwZbfq5VuHJIfYoCHjX7lUXG5rvHfD4Vx1MDAwYlwidkhcdCzvkVx1MDAwMW2KXHUwMDAyMlx1MDAwM1wir3KlMaA3nDro0Vx1MDAxZG2zS1x008fNO+Q3Zns7iF1bk1O5IEVljW5SLK9Q/M6y0Fx1MDAwN1haaJXtZFx1MDAwN8F/Y9uBo5Wu0Fx0YiD7izTDkDU9v2SaosOH35LfVFx1MDAxMNjtklx1MDAwZYTMVyBJVuh9SHxIgYrCddMyXHUwMDE0+dzWIchcXJ5cdTAwMTee1GWz5OJcdTAwMTG7StUv9vJmJ5EkOf6S+1x1MDAwN+acRmZIxVwilUGdobJcdTAwMThcZmSA/9eEW1x1MDAwNMlw7Fx1MDAxZOt6XHUwMDEwXHUwMDAwUkFcdTAwMWOas0yddbrGreZdXHUwMDExXG5WQUDKi3xTXHUwMDA1RibtwFx1MDAwN1x0XHUwMDFkX3e6NCfNyi5cXJ2DoH9cYlx1MDAwN1EvKGCcNJpVXHUwMDE2fCe1p/stXHUwMDBi8n5cdTAwMThsUphcdTAwMDFnNIHO6Vxc9LF9Tai7OVZmZ9dcIlLxI3/Li1x1MDAxMSchXHUwMDEwU/adXGa151x1MDAwMN82XHUwMDA05CB6lVx1MDAwMqqpt96LOfJDzGtcdTAwMDJvvIy1i8rCv+9cdTAwMDXiwpt8r8NnRbdcXOGBpupcdTAwMDBnXHKl4f03rcsgQlx1MDAwMO87/cdphM/+2ffxgFx1MDAwZlx1MDAxMDzg8+nGXHUwMDExe1u+XHUwMDA2oGeOQbO49G+1pUN0aEjPqyFDXHUwMDBlcCOF55VIXG6Z49X26iHwt3FfqVx1MDAwM1x1MDAxNHU+XHUwMDFiTKJ/6+TDTfyL2Fx1MDAwZfV+KVx1MDAxYlxmUatcdTAwMTNY0uUx7/g4p9ysyVx1MDAxZFx1MDAwMIZhIKemZV7vUnchIVx1MDAxZP2y/Vx1MDAwMD22pafsjUZFKn7oXGa0dWFn9v75XGYrLNi+zFTgofSjVP3K6P5xM1xuXHUwMDFl6/GDd5ygboih0jc56N49w7JvhIR07tPp4dSYXHUwMDE2uVx1MDAxZKUsJbJuQCbda6LmR1x1MDAwZs/evo1FkO13dkejtzeDT5xMVqDcXHUwMDFiW7Sa4CBcdTAwMTX7yFxiWsiAgFx1MDAwMTquq1b1RFxiRa67kzNFXHUwMDA0OLVboNdVpHHgZctuevz9gVx1MDAwMI1cdTAwMWW6uIc5Nb63XHUwMDA2XHUwMDAwffToOq/sP1lcdTAwMGLXRLefXHUwMDAzXlCFomkof5E7Q1x1MDAxZFZVlvTieVx1MDAwZqFEoU/GacDmjz3QOFx1MDAxNvqlmENcdTAwMTgmcs0tWzT+xnusi/TSUDSOPlx1MDAwZppcdTAwMTJcdTAwMDRcdTAwMDDKcfNoP1x1MDAwNVxumpT0ylx1MDAwNL9ne/5q36WYybdcdTAwMDHTXHUwMDE1XHUwMDAwXHUwMDEw2e/9KWiwXHUwMDAxXHUwMDE4LZGCXHUwMDE0lNVcdTAwMGZcclajsoBJ2KLjZ1x1MDAxOfQ58Tk5eMkhiIUgXHUwMDAzonLpciN63rZPVWM4Lp+bgkxSaoDRXHUwMDAzaMW0XHUwMDFiQ+FrVchrwmlNU0lcdMY6mu55pz1OXHUwMDE4W+MvcNRfmclqezjlXHUwMDA3XHUwMDAyQvdT6rD3XHUwMDFjcKDfce5cdTAwMThiZ3xBOlxccUvQR49xzZJPxvjHOVx1MDAwYlNj8oWlJT1du+fxuy65vufztFJ1gGlaXHUwMDE5XHUwMDFlaFxuaKZcdTAwMTBRWDBJ4nizXZEkq32eXCJHbKFnJH03WP3URyW5iu/g3PhcIqWuaeTWXHUwMDEz1/WGXHTNlOBzXaDkOFx1MDAxN6iYUXtcdTAwMTRcdTAwMDVGXHUwMDAwyW+Vv/tMmzniakC1k3HouKbWMFxuXHUwMDAx1NGYPCgoZZVcdP+tke9cdTAwMDVzrb3TVIb1XHUwMDE1+ZKpXHTirjByW/ixxFx0XHUwMDA2z8lWfpYkiiDn8Sjg0NmS4G9pnNNcdTAwMGb6RdbYvi38TqLH9Y6updfSdon+5Vx1MDAwM1xcXHUwMDA0LKlDQLicQFx1MDAxYVxihZ3+PUleT1x1MDAwNC15XFyBm13aYNc+OrlcIlx1MDAwN52jOzJRqppGZftOgyXJzZZlqbGz+V+tl9v1/cPzkFx1MDAxNGRNYTqE/1WcXorBXHUwMDE2XHUwMDFiVOOzcq+DIV6TN2xcdTAwMWXUS5G/LVwiqTpPLoNkP76gmYe4aarqTVZcdTAwMWWk0rvHd1xunb5jiE3PZ+lBUeLvrVx1MDAwYqSzk3/oiFx1MDAwYkFVX/MvJVx1MDAxNMdcdTAwMDJcdTAwMDB/RtZcdE7prVx1MDAwMFx0vmt+4lOB0EqQ71xy91x1MDAxOTIgx6mut+8uOvy5clx1MDAxNVx1MDAxNnFqrFx1MDAxNpFUXHUwMDEzti7B7k/ZVcn+XHUwMDE2XHUwMDFmXGawy4z4oIz8i7KwfaJcdTAwMDNcdTAwMDNccsPay1x1MDAwMylcdTAwMDJTqltRXHUwMDE5Wrf3QDHNb42dvI/r2jD+i8Z2kpqfuY0u9JWdVuooKqN71MZKa1x1MDAxY5ZrgJfwaHxcdTAwMDHHZeJNedyElVwi8bVcdTAwMDdcdTAwMDLc0ZxcdJ6IZXPzOv6YXVqWQVxu/VpcdTAwMTZcYkPW336rXGJcdTAwMDRA6Duf3NxcdTAwMTFsOFpE62tpkihAnExjkVx1MDAxOVRA5vtcdTAwMThh/z70rPlcdTAwMTZcdTAwMTI5OnfE71x1MDAwMZOq4Fx1MDAwZrY96bFcdTAwMTNcdTAwMDNcdTAwMTZqXHUwMDA3QSy/Kz56lTbXQCVcdTAwMDMs1TvjvnwhxrKrYkmTy8rn+MTRq+Yz+qs+2d8+ct9cdTAwMGKC/GhHtmFcdTAwMWKySnGXQ3sv9Mj2lcnJ82bcyuXdvSpcdTAwMTXEXHJgKv7pzcmS81x1MDAwZaCpsi6dryNcdTAwMTl7fchcZqc44PPYREhqPNn2x9tzzW67pfyNyalPyo1cZnckvcm34L9fMi6bglx1MDAwNuk3b0hjtM5f2GZu8UW7etylXHUwMDAy91x1MDAxNv13JyRgXHUwMDEykGVbW1g4XHUwMDEzUFd3fn78KJJcdTAwMTmSXFyHXHUwMDEx8XSaVnNpf49/9lx1MDAwNJ+FeTItjSokpzfZetdCXHUwMDE41ZR4XHUwMDBm3ekusC3UXHUwMDEye1x1MDAxZrdTXHUwMDE4MEeZXdV0wqqCI19cdTAwMTmGk+I/q2LSlntn3isjOICXXHUwMDExXfXBklx1MDAwZtguulx1MDAwZlx1MDAwNeZ+pJfoNFx1MDAwMU65kiukt1KRmVRsRfFmXHUwMDFkXHUwMDFkNlx1MDAxMc8zWj6XXHUwMDA1aF+QIDl6XHUwMDE5iFx1MDAwMFQvj1x1MDAxZkzK5HYhZiX4+mnqzVx1MDAwYlZ7XHUwMDE3XHI8XHUwMDBmVtCQdnjbaN7JTqE8XHUwMDFllKjXXHUwMDFk1NNcdTAwMWRHKlX68UGaiaHNXHUwMDA2MqdeXHUwMDFiXGZMqlx1MDAxMsyHLK+nzTmMU1x1MDAwZayw4y2wWCPjyFx1MDAxOPHqXHUwMDA2aKBfSL74QW5gQke0rYpWsTloyFx1MDAwN8rN2siVXHUwMDBidXz7mY20y1x1MDAxZVx1MDAxYj77sDbA1+TrPpVMR3NcdTAwMDVtw72BJnyEQFx0Zr9hetRlMVx1MDAxMSXoK6nrg4zFXCJLoZPbvI5cdTAwMGZNvXNcdTAwMWTE72zE6K/6t6zs981cXFxcXHUwMDFh/nZcdTAwMTPEybfSb5uI+cSLmNHzprFzff71XHUwMDA1LzVcdTAwMTO857owy/W8eNtiXHUwMDA2Len+t1eN9LdcdTAwMGUjiabL8j1ZXG6V21x1MDAxNvyBdFVcdTAwMGU+XHUwMDEzhVx1MDAwMUyCsq33XHUwMDFmm+e3XHUwMDFmtlx1MDAxOHPIf0LGXuSAXHUwMDExxOlmT95cdTAwMGYtps4kYel90XbjRpZ14e1bXHUwMDFmzna/i/z5+2Du87llnkn6oHxJKlx1MDAxZNGpf/rm1XeFXHUwMDA2nz1cdTAwMDcrXHUwMDE4r1x0XFzW/zYuP9CQ2lx1MDAwMs8k6eOw9o2qQGnCTMot9Fx1MDAwZftZPZGEyVx1MDAxYnQqc+qfXHUwMDAwbfiT9FOjRMZgSL9R4ID6gPXE872J4OikX6HdtVx1MDAxZMk02sWA8Y2ztORyf/In4beo8uk3QHVcdTAwMDRcdTAwMDE+QShad9gqjpb3RqHeKX1cdTAwMDZKPVx1MDAxNkq/XHUwMDA1PeVcdTAwMGX4XHUwMDAyVGKCWFx1MDAxNt3dmKi2bOd9XHUwMDFlkS8t2DaSuTM/RLNax/RkX5xcdTAwMWFOpsryt5yhXHRNbVx1MDAxMr0ngexQXHUwMDE0x0BOhcdcblx1MDAxNJtDqFxyR3Keglx1MDAwM+/SXGJSeWVNMcVLcqk4gDstTFx1MDAxN7DuXHUwMDEzUJhcdTAwMWVcdTAwMWNZQVxyJN2iXHUwMDAxtjxcdFx1MDAwNf4qXHUwMDFjaIdcdTAwMGUm99WoT1t5ppSzx71lXHUwMDA1XHUwMDE3wzTsc3QyXHUwMDFiXHUwMDA0f0tcbvpAYbZj/DVcdTAwMTlfXHUwMDEyXHUwMDE0XHUwMDAyi9W3t5agbuxPcSY9N2Fr+VvmmbpLXHUwMDBlTbNlXHUwMDE0gsSwcGkrotP72FwiIXVcdFx1MDAxOSxcdTAwMTiXI1/R5sLPXHUwMDE2XHUwMDExmHQhZLJcdTAwMDY3JlLJXHUwMDFl3jH2oTD26INcdTAwMDZkcXVccrDoJl74Ulx1MDAxZeM8P6+XL4mhjKgjf/lJV1+l+tTgRo1cdTAwMGY1OfhgXHUwMDBiYFVa6+NcdTAwMWVrVI9Ytlx1MDAxMqpbZ5OA8q5DOpn4mfjCjDCFu4KzXHUwMDBizNtcdTAwMTTpX1VvXHUwMDBmXHUwMDE1kX1OQm4jXHJ3wHdPyjBgX3idc+LQPtiji0Kxu4xlXHUwMDBmqFx1MDAxNyXmqlx1MDAwME73g1p4XHUwMDAyeSBcdTAwMGaM5WcyQ+HcbHZoYpI7WeVcdTAwMTSYOb30XHUwMDBlXHUwMDFmu89cdTAwMGaTXHUwMDFhoSF2d87C+O3g91aBN0ZVitnGvaKP3H7JvafvPFx1MDAxM8epKX5cIqQ8UPFcdTAwMTVcdTAwMTZjr4iRrpq7Wt+ueD1DPopXhXrjXHUwMDAy8JMlUDXbj2O+XG5cIlx1MDAxZDdJilxi1+ZcdTAwMGaY/uXPSUh3kIMwSyH0TvIsdPt06W5DXHUwMDFkLzeAnFx1MDAwNO+x/ocqf0GMOeLEdMCg+JN3LmLMu0LoXHUwMDAzIPg8XHUwMDEzP5Ok0V7PtIMhXHUwMDEwXeeXp0Su1036rZs6toCPhqgsULNgnCApXHUwMDFjLHiaXHUwMDE44S9MI3hcdTAwMWQwzlx1MDAxYbrr6mdcdTAwMTPXNF1cdTAwMDfCsMzYbzzjftax1WGGmdvIdcM9r/1J34cgackv0WynqMQ4PFx1MDAxNN+55iRcdTAwMTKTLGaW4eLKdlxyyu/Fe0NOXHUwMDE5TFx1MDAxNcFcdTAwMTY+y2/hX5loXHUwMDFkXHUwMDE5ukHnVCWBM0dcdTAwMGYthic5v8Fa8j5cdTAwMTZ3Mlx1MDAxNXD2zNT298pcdTAwMDQlwJhcdTAwMTR3S2hcdTAwMTFcdTAwMTFU1b6uR1x1MDAwNvJcdTAwMWS0nDI+M1x1MDAwNrOP5bJ5z/I7lU2wqi5cdTAwMWLX6ItxMieWplxukfRDqrLnhkd5sKHZLJz1hzLZyzVcdTAwMDTcsWOJXHUwMDFhKGgsyWRcdTAwMWZIfzmaUlXnyl4p16zL0GZEPqbB/XPQ+5EhdFnqPftcdTAwMTO+4OM5s09rPYrNUerVeyxcdTAwMDX6V1x1MDAxYuDI+z1xXHUwMDFmJLb1/znXO1aaRZJcdTAwMTil2OKiXHUwMDFmhLhkKf+LJUQocoibXCK7Olx1MDAxZVNHXHUwMDA338qmQFBjXHUwMDEzazTEUyqIvzVcdTAwMGWVR38gXHUwMDE0MuN9uKS6hlx0XHUwMDAyrlx1MDAwZVx1MDAxMk+OaIExRcFUyVx1MDAxYZ5GSvOp3mnGYuJcdTAwMDUjc1xmfVx1MDAwNfLtm/ZvwHNcdTAwMDRUi3JcdTAwMDWOzo7d8vt2u1x1MDAwNzjsubaZd8CxnVx1MDAwNGTFLFBPhV/Gma3O4yBT5lx1MDAwNUU4Z6CROFx1MDAxYbNB7lH0zlx1MDAwMWuaXHUwMDA1JD3UPFx1MDAxOYN871x1MDAxOYZp+Vx1MDAxZMFcdI18fJ/vcOBcdTAwMWbdXHUwMDFme4ydkKDUOtwqXHUwMDE5XZ3tdlo5N1x1MDAxMKDTsYNcdTAwMGJcdTAwMWRhwpA4wUwr4e6+tDholqNcdTAwMDJcdTAwMTeczvJx6D/Colx1MDAxML9s+VwiXHUwMDE2NJAnOW5RdYumjuPT09RcdTAwMWP/Wrt+XCKIVnuId4KqrXRZ01dV+Fx1MDAwNXnue/RcdTAwMDGOz0Nt2zFkJXo4hu+nXCLPVmi4XHUwMDEywFx1MDAwNzJcdTAwMDF8yMzczF8lSVx1MDAxYbWD8Ha6hNxo8DZQaSdcbvB0YEmWNVxyilx1MDAwNmA0n2032uSjOr5cdTAwMWFFXHUwMDExZG2HyY7MqItcdTAwMWPj64pcdTAwMDBCXHUwMDE4p6BWjenWIJdDXHUwMDEwyMuX7bq+XGap8kL8RvhWedI78jhT2Ybh37FcdTAwMDJA6+ZLIcjy8OfLsXu/mYCLO0JcdTAwMTaP7ir8e5M5PMFcdTAwMWa1cbZaUjnuw9yvvFt3jFx1MDAwNDX+SY1cdTAwMWLL3+5K51x1MDAxY73kxE/yfntcdTAwMDM1w5a9kbVcdTAwMDTqaIFSXHUwMDE14TB1p2aWZJ7bzTAxeObI9fvZ+JFwb5Cv3cwqsCvOuuDjYEimtE+yQeknsIXsNPzC8bU3JaZG1s9cdTAwMTR2/Ea21eNTNFx1MDAxZkzVP4OTMFx1MDAxOfT5MFPs+lx1MDAwZVx1MDAxM8hcdTAwMWVD+U1xeenmLH1cdTAwMDGYzVx1MDAxOX9cdTAwMTKkhF2gtYuJXHJxZV6TXHUwMDEyjeZcdTAwMDFcdTAwMDBcdTAwMTPUS4Il8Efpfr5cYslIx6dLYGJ/66c6KfWmQI/O/k5cdTAwMWVcdTAwMWO6XHUwMDE03d098t/2XHUwMDBmj5a5Mv3jsN2FNlx1MDAwMp9+3N1nupxcdTAwMDOAyIpcdTAwMTXQ105XeLHqalx1MDAwNLY8iSor0m0oxvN3UJdXvNP7RdlpXGYrw+c/zzufwHj8pJcqXHUwMDFlgZT0jMVOhNFzvilxh8/9uebgzrWV3WO03kfysTBcdIQ2XWlNuY46t7/kr1x1MDAwNHWk7Ifivt5d65hcdTAwMDbDc13RjKlsoepcIrZcdTAwMDDhjLicOfBUWlx1MDAxNXO981x1MDAwZo6jJu2w+eOMn1x1MDAxY1x1MDAwN15cdTAwMWNMapXhXHUwMDA2XHUwMDAyx53UoUNcdTAwMDNcdTAwMDRcdCV3XG7f/1xyYMxzXHUwMDFhz4E9g1x1MDAxMlx1MDAwNUSgbpRcdTAwMDNvzTqv74JfMmNmXHUwMDFl5+XZXHUwMDBl29fay++QrupcdTAwMTZcdTAwMDR8iFx1MDAxY1Pd5HyzW+S4sXNlLqlrWuGhqlx1MDAwNMa/Z4LVplx1MDAxZVx1MDAxZf5ijorCxl8l2cTXwOOVJIn7pS1cdTAwMTUj+lx1MDAwZlx1MDAwMMNeUHd6+4JlXHUwMDAzacRXXGZmojvFT66LYj14yty/nlxunPJZ6FBiQrx/TThbxN1+/Fx1MDAxNnayP3Y2hfRJXHUwMDA30bBmVclcdTAwMWUtVVx1MDAxZOXX7HaUXFxdjmbN7pFcdTAwMDM33cTNN3mGWo+XLcEyMau+5X/FXHUwMDBmNaWybJuG2vTDNXKb4l6sU3Q7XHUwMDEwm7TKVqGNR4WodFxun9BcZsB8LI9aL4lSoMgn24dcdTAwMDdbXHUwMDAx13XYe/GLRj7TJpA+tnHg051cXLRcdTAwMTjuVFx1MDAxZM9cdTAwMDDx23Ry/bNNWFx1MDAwMtRvXHUwMDE2XHUwMDExiHf4fpahclx1MDAxZn0t4lx1MDAxZJO912Kt4zlcdTAwMTVLc+5cdTAwMTBcdTAwMDSvfOPNyCGUi/BIm6jFXG6/XHUwMDBiyyDlXHUwMDBikf6ruqZh0Ph0vHrPXHUwMDEyv09cdTAwMTR60cqUJk7dilur5kW5MY7TINq6qPY7mCfpkFUzTrCWLW5bUcXzK8HtY1x1MDAxMdPM8lxiUEhe37DHPlx1MDAxOWLc6SyuoZW9nVx1MDAxNCR6XHUwMDFhiNF4d1x1MDAwMt7ux9NxXHUwMDAyXHUwMDE1PsBcdH5A4+1FbobS7Fx1MDAwYp+gXGKgxciBmjXOzD29TFx1MDAxYbW/Mzclxrb6cmL+sfdeza5i25rge/+KivtKRUy8qY56wFx1MDAxYuFcdTAwMDVcdTAwMTLoTVhcdGEkPHT0f+/J2nny5M7Ms+vGvVx1MDAxMVVcdTAwMTVda2Xk2iyYbszxfcNcYsGgiIXW63BcdTAwMTN3kSZcdTAwMWWLjua21XJkZpRcdTAwMDVxzi1cdTAwMTWByZFxvMKp1VJMQ+SrVmuvqzmkeU9JwLHTs7lcdTAwMGbI3lG8XHUwMDE0XHUwMDA15arc713SPMj2bGnBXHUwMDAzWlx1MDAxYjiNR9ZcdTAwMWRWrlxy6XDxx+wx+t31nzqNUGEyU1x1MDAwMHF8cdqkxnfoj0bvVs9cXLfe9rdeP1FcIr/e5s3cPojOr2Pqb0mX9/f+NtxYzlx1MDAwZt71PZuaXHUwMDA0XHUwMDEwPdqYV/yEJ0r1XsqbwoLWXHUwMDFiXHUwMDA1r1x1MDAxNrLU7G1I31x1MDAxM+9Hzlx1MDAwM7JcdTAwMWHvMYZDpqQ9cF5cdTAwMTA7Vsc7XHUwMDFkQGv2stBHxqvDw2sqwsv2YSSBO8ukNtjK6fz+JIq0NU9NUZ9pPVx1MDAwNuZcdTAwMWLS+blONjW7ruNgJ4f3iCVRXHUwMDA1NVJxa1x1MDAxOVu20GxtXajatVx1MDAxMoIgQHFcdTAwMGVr45X56C3VPyPI+FvZzeJws+7vy8vvljS+fIiJu6ZIQTFcdTAwMTZcdTAwMDFcdTAwMDT+oYRCQmKYTr2o6iohtPNszLVDm5ilQZZT59dcdTAwMDerNy4vsUc8Mn1cdTAwMGJcdTAwMDDr96eNbi86V99P16pRnJF2Nlx1MDAwYlx1MDAwNSaZ6bO5Tkn6sC5cdTAwMWNcdTAwMTIqMOehz22SKyaFRO0zOr9wId68+napuYnhQn0zbp9cdTAwMDfEX6z6qYi4RVx1MDAwMqMgYkGvUZudnfSOUfQ1WDAzIVx1MDAwNMe+XHUwMDBm14tcdTAwMTW+Jlx1MDAwMZgwLjrra/VM0VP6UE9tijJcdTAwMDZcItd3pC1mwLns5yme7m/XXHUwMDA1REhn5tv8yLX1idHVXHUwMDFmr62pTEk82DDIyvyH519Ft5aV5Vx1MDAxOS2hXCKXZjMlmOONVyZcdTAwMDfhNiCFw95dzlqtxqlbs35f/IuQnVx1MDAxMkVcdTAwMTc9dnS5h5Fjqa9+cvbGKuT9w+ohVpAut7+5/FPE2Vx0mMbtXHUwMDE1ruP+eSrDdXtfYfjtX+dpXHUwMDA1T1XwsLzHXHUwMDFlu1xc+dUrsXFcdTAwMTJ9o0j+envL+XVcdTAwMWaVZfOOakGBsZBbcaY4jGKSgXVcdTAwMWZGSVx1MDAxNu+dwjnuml9Mym6xXHUwMDAxZZRtV9xadWU1rO1cdTAwMDDEZXGulUfm1ftcdTAwMTDe4mBPiNV6XHUwMDA18sO8y6WdVCn2aKNyxPZshDqNh6rpSremLzbvXHUwMDA2aMeFyeq2Y/M6++6qfNSxfZ7sXHUwMDBmSyulysdvo0Oc8WQ1u/hcYvhWeL/wRDNFtFBMdSjkXHUwMDFjW6l5P39U/tlMrZktXZ537yzb0iF46sx292/hh/ZcckeB+UfvVcHcYsyL0t7Rut7aXHUwMDBm9Fx1MDAwZVx0X1x1MDAxOELtebXuKs1kXG4n4jGcw96QPC/RJUyouFnXXHUwMDA1XHUwMDA2ZppMfZo6UZuuN3G5gka0c/kjXHUwMDE3N/1RdUtomSMyXHUwMDE3n3RWpyaguOnDa89rRtfaXHUwMDE2KWtqav45UsihQZAhbmY8O6OnjdTlXHUwMDFixU7e+1WuXHUwMDFlSeuqb41zqHR2j2NcdTAwMWTkTlx1MDAxY19P/dpccudcdTAwMWJcdTAwMGaSsbDceFx1MDAwM1pHm2acPsvFPzUyOPnD7Vx1MDAxMvQ2lp+miVx1MDAxYVx1MDAxMHtcdTAwMTZ8J+xw43Rm8Vx1MDAwNKLqToaso4CP+cBqdDl7XHJcZlAqgkBbzsr2ub/YKuViy+xcIkLTsoKcSe7CmPInL99W+ZlFk1x0Kfu06WlcXLb6Xd7eVlx1MDAxOMkxnbqcRnmK7L5cdTAwMWaIJ+zzXHUwMDE5INgnc7XdZkC/mtJzoqTl+joxxrVcdTAwMTGHQFx1MDAxZaLNXHUwMDBmg4RcdTAwMTOzk/ckriiKuHaRt++2y539Mp7q60pN5/dcdTAwMGLVXHUwMDA3PsTN5IJcdTAwMDZlvS/e9rmrb0vTiH15Pa5cdTAwMTf3Yat+/PK6SaRK/2WML49WXHUwMDFm2+ujiGz/XG5v6vnZP7FbXHUwMDE4y8t1Z8TbacBj/bWwISNcdTAwMGZcdTAwMGaFXHUwMDEwXHUwMDEygpx5bZVcdTAwMWanOlx1MDAxZsjkNlx1MDAxN4VkXHJcdTAwMDDaeVxuXHUwMDE3SvRuOOquwPD9pKxsTUA/bleCqTzJzXykY4t29p5FvGaPxtlcdTAwMTjiXHUwMDBi4b8y9Vx1MDAxOZ/eeVx1MDAxYV/l8DTtIHFu1zdZdrFcdTAwMTBhL064oUZYu883NNRWm70xX3i9X+ok0Fx1MDAwMrv30dOM2dxcdTAwMTFv747N75jZXHUwMDE2XHUwMDE5XHUwMDE1rTinWO6LXHUwMDFmnNXFPMCX73NPtTtFNcy8U7fJpbn4ZllcdTAwMDOn6mpdyYN7sq526uK+KydmZPfYdO39z/XMzNxcdTAwMDRZXHUwMDE31Fx1MDAwYqnzrMiy17ZcdTAwMTNcdTAwMWJGlFx1MDAxZkrK6cGLxGlcZiSqoqve8/WBsdzZLXpiXHUwMDA3+zRGWuVPubus9CVUXGIn17eT8kTSsJRHXHUwMDFl02PvZpzrq2sxb5zZNehcdTAwMDLOs6pky8lT1lLtM+JqRrSSnT6K95CE16qFcaPtc43kpjmhMlx1MDAxMmJmvZNcdTAwMTUhmZv/XHUwMDE0hM9JUqjliqun50ubo+CNjdXFLC0svj7A1l28znT2dIrnd1x1MDAxZWVuQM1cdTAwMWHX5riTc1x1MDAxM4WXbb2+wP1qelK0b8M5TzFos7Cbd63Rqlvfin2Vm89cdTAwMTC9oFckzPqD6TCWupqXT1xm24Eq60JcdTAwMTi6Y6e6XHUwMDFijYnqXHUwMDAydblUrybcwfGWXHUwMDE25Kz416v6XHUwMDEy4+LT3sdrbzj9Mjr8XHUwMDA105vnRX+euVx0caQoXHUwMDBmtzfNaY97KuanXHUwMDE1M2NcdTAwMGY8XGb/vsVIpCvRcJNJXHUwMDEzidBaXHUwMDBlz5Zg6UiRx1x1MDAxNspcXDRuN931ZN3ddiNhOFxiXGJ09D93MmKWu/lEpWtf28kyZVxmM1xyPVk4llx1MDAxYVgyjbhPouLXSohcdTAwMTPtPMZxsVxcsHDdoKW6XHLXT02AXHTGr1x1MDAwZm9UYlx1MDAxN5WVcln2WX16bET3585HrX1kdapcdTAwMThcdTAwMTDSXHUwMDAxXFz+nN6EvaZcdTAwMTSgXHUwMDE4Zr++VuaKQttcdTAwMTNcdTAwMWG29lx1MDAxMEY9MjFqwEfGJ95cdTAwMGKXht1cdTAwMDfJ69XXINZdIeVcdTAwMTLJwd1cdTAwMDfZ5UjWXHUwMDA2U/LIXHUwMDFic1x1MDAxYlx0qa1x2vFg+PXgXHUwMDE1IUY+b7anL4pW5Kq1XHUwMDBmOFXdXHKJTFx1MDAxZsHluI/bKiSXY1x1MDAxZjd0uqDb99PWXHUwMDE4XG5amKDaSXrnl5sz+myaL+YrdqBnTE/u0kxcdTAwMTRxMtBSf/I32uixm1x1MDAxZDyV+1x1MDAxY93sUN9PV0xRLiRcdTAwMTlKK1xm0qjNXHUwMDAxIFuXK1x0IXBcdTAwMTdcdTAwMDRcdTAwMTKpTq9cdTAwMTVcdTAwMGX4KGxcdTAwMWNtpHtcdM7Mfn6UL0RYredZXUhcdTAwMDMmsWx7j5jNJmXHPK3ioJho56DvLW1cdTAwMTJN9ryXwDdOllx1MDAxYVx1MDAxM6Y+XHUwMDA288xX0KtCXHUwMDFlbvjwYKp42lNXf6ohcvWr7qnbanI8zSyDeqNC2sq4zSnfL5klz++bXHUwMDFldGp9d5V0fvhcdTAwMWFZq+teUkRWXHUwMDA17+eaXHUwMDE1I0yVu+7kWDouXHUwMDEyV6G8YFx1MDAxOFZHNYEwXHUwMDEzdL3d9Y59lMu1+mA029I5Lcwr+HD0ziEgYyyxi8P7PNhn1Fx1MDAwNSGdu6KsXHUwMDFhgXmKa0pzq9ezgqFcdTAwMDL2XFz66FNcdTAwMDdxhTMpqKE9kXjvmoi1ebpg2da78lUhhVPDNlx1MDAxNEZz94usIyZIzV3XV/sslyhBMEzvn/HuXVx1MDAxOc1Ap05qoXdfZcdcclx1MDAxZM1cdTAwMTS7vd7kQ/ug12372LZcdTAwMTBURTKi9Lmr5UJbU88sXHUwMDBi0NYu24dcdTAwMWIqXHUwMDE3n1xcnFx1MDAxMnkw+35+IK0hZdxccsm4Ytphqibse9yIXefyW4Ikp0dcdTAwMGVgaOxbaVx1MDAxOVx1MDAwNviBIfRua21GclxmddO7Kb7YYTBZ8o0knr5HWbxcXCPoxThPOjsz04RcdTAwMDPlTlx1MDAxNVwi7u5796lIbof5XHUwMDFlNdIwYLozKJ1aLsFwgVx1MDAxZLyXgteHzE1ccsa9Nur+wmn3MzwuJ70rXHUwMDEyKt5kxJNcdTAwMDeBqlx1MDAxZrP+mVx1MDAxZlwi699XUckumVx1MDAxNjF9oZnQtLWsQklJkYp1Up7k8KNKlriqXGJp6JFvmNKK0qu0ZKTkh8xL7mH+ls/hlVx1MDAxY03B6X1vlp5OkMdaPFx1MDAxOW/2UfOWSbpcdTAwMDDDXHUwMDA00dvuUYhcdTAwMWIwUjnHRTHjwsXLO5jLnfJcdTAwMTImkORcdTAwMDLTtfNumlbgMNU9Slx1MDAxZoroXbHdY7JL0LLAtVPCblx1MDAwNDaQclx0XHUwMDE0bHmuXHUwMDFiopyHxEOc01xya7hbg3iz69Mrx14v7Vx1MDAxYXdcdTAwMTdqllx1MDAxZVx1MDAxZZd8Lndy4FsmSZL8loM+XHUwMDBmXHUwMDEx8vWEXHUwMDEx+bV6UDeWol3+NiaFPHn7Y0e67S0/5up8zVx1MDAwMoyNdphcdTAwMTKabzeUXHUwMDA3u6o/Z6OoXHJlmtpgzl6vvM518sSPy4DhTFx1MDAwNiNh83Wq9DN3jZCJzaVcdTAwMWLoXHUwMDEwXHUwMDAxi+Ze7PhcdTAwMGbMXHUwMDA25uteZUWBw6g3uFx1MDAwN/dbqGTRhVx1MDAxNM07/7rwVjH4wVx1MDAwN1P3R/mEY8NsXHUwMDBmXHUwMDFhqqvl9U9G07BrOkShYZxtoeWQPl/2miRPgsbgT6qSXHUwMDEyrquqlVx1MDAxYvNhXHUwMDA3dPTQ6Ev3NO2CICZccnxWXuzPSzrpqVx0w+/m+jaDhnXBbqxcdTAwMTmClahf11x1MDAwNndHlmf2XHUwMDE5XHUwMDAyrXk2wZuqwmKmM1H3kc/nSWpLT3m9NjLkXHUwMDA1udaMWFxcXHUwMDFmj+5plWPXj3j5QC/357Obc0NcdTAwMTLUky8tebZccqL2tsmrYpbKht30+dKRn/dlTNczzN1J/+SNadpcdTAwMDSv8uTekmaPl6LdXGbVXa9EnTmPMt5MObtf8o1BhYf0JJeAZ26Qb7etUs1cdTAwMTFnmvBq8v28XHUwMDFmuOHopJTZyynNte5NkdtjITNFVFT23ouGMTRp9EbmvlnvXHUwMDE3d4f5JG/6zftzr1x1MDAxZKajM6XOy+Qzva7ynTtcdFx1MDAwZkNcbj99/STsXHUwMDEzjVxc+/xFXHJaXji2Zput8eTr6G3SXHUwMDFjXHUwMDFknj+BXHUwMDE3XHUwMDBiXHUwMDAzeb2ib2ulXGZA2jDZXHUwMDAzrc9UQep8Job1P+hWqFn+XHUwMDFl8EIuWYxzXHQhdvDGSu7aut6rLr05w2BccvX7XHUwMDFjzFMw+O9cdTAwMTdlpEjCUWfk7JWZ1pGhwSzUvHG3XHRcdTAwMGZcXIg+Jlx1MDAxZrGN5zz++abvXHL+kKnxlC3P05XxeXFcdTAwMGWkNYSZ8JnBNfPmdbLaXHTaeLpbXHUwMDE3c5NxV+wnptgp/Vx1MDAxNdxGqVxcQtWE24xgLJVp8jv0pWYrdl+YsPXZqag6XHUwMDE4xjuYXHUwMDFm0KJdhFx1MDAxZKWclDNcdTAwMDOUXHUwMDFkLWbmr3TNKy26TVeTXHUwMDFhpmCJnrp/KozQUFx1MDAxM0gyniFtqb+zXGLZmfND4PrH+SHVxUWUlGE8M3KsXHUwMDE3rrCx1fPdr97bpVx1MDAwMo6rxcd7VvqVOpUgXHUwMDEzrqblXZFcdTAwMTdfaa1HcC6Whe2601x1MDAxYq8wYXM7n+m7/Wae8uRcYuWZ9uv4YogmyyzD60KMT4MkLVFQXHUwMDE0WVx1MDAxZKVqp1x1MDAwNlxmW+TjXHKaT/3karksxtRg87bQOO9LJqKud3JcdTAwMWbamIir3MJEQbRa8OBHh0pcdTAwMTFhXHUwMDAyiniC3Tb0c35xUrzfXHUwMDA2/DzeqfuU6Y/9XSx8N1x1MDAwZv0sXmVT5uP4eSn7QlH9lzB7bKhElzBcdTAwMWMvznLN/DKusVx1MDAxZCfFXHUwMDFlVXzU8Fx1MDAxOStcXHJM8W4xVSq2WvGeWu/6OElcdTAwMDZcZtPu3V2loKshUbp9sUyDNjdcdTAwMTjLNp/PZD/X1H7M7M02penpXHUwMDFiXFxcdTAwMDFzvK2+3WNxXHUwMDBipyZ20FxmQVxcNz5qSJ9cdTAwMDNyx1WfXHUwMDFm4+SO5H2CPVx1MDAxNIUv+6WrZy1cdTAwMTmvXHUwMDBm1Vx1MDAxM1xyf/hEaFSJsvhA00dVXHUwMDE4UyEzXCJcdTAwMTVcdTAwMWJiwFxy/lb2eZeQhjYo5d2xtszs6aaZrVx04UZcdOnsLK+filx1MDAxZqrjSb8okVx1MDAxMZ6C7nM/gVx1MDAwMsY1mlx1MDAwNnPeVKa60Hi0VzZcdTAwMWRMwXg0VJ+NXHUwMDE3cE/olnlcZqdT35xsQ9ONtyxcdTAwMTNcdTAwMGI43+ox48x9+SToVelCLW+Kpm7C2Fxu34VcdTAwMDPFkcRcdTAwMWVQfr0hXHUwMDFjfXZOx8PVRlx1MDAxY6FVaI+OXGKtV1u91FpiL/763m6KfFxuzupV3Vx1MDAxM9/DXHUwMDE5fTizQrzUb+5+ivfG+Kxv9GwuwenCIJ+YbDBQ3NSuxua7LPhdnmqsfPYuJsLW5Fj5xfSyhC2U8DktrGYm2s5hb+da8z/7ZUFFad+NwGjb4TXifS1L8WNR9px4nE/P+a5cdTAwMWMvbVx1MDAxMPBVYZVLWIdcdTAwMTJFmNi70FnUnSt1eu+eenc3RbhcdTAwMDB1z3BcdTAwMTiFX6bLKtpcdTAwMWKZtTBgft2ppMGPN+5cbmUzMe5pf8yvt3PenYVcdTAwMWFQvFo7VEJ7ma3k/mR3SzWQXGKLk9AxXHUwMDBi7TPRZka7uN0+XHUwMDA2gkvBIFpA6uTcTdi0MIVVzU3aXHUwMDFhm0fyLi9shVx1MDAxMH64iFx1MDAxZFxuSvTtnH5ryaJcdPWltcLmWlX3s8tcdTAwMGZ+KFx1MDAxOFvb3d5cdTAwMWPdcCdcdTAwMTVcdTAwMGbVl05AP5nCVHdqS63AsMy/J2rFueNcdTAwMDMy6NPkid1QL4xGLTNcdTAwMTaf7vmTzoI4xrdcdTAwMWEpgsS9MJkosVx1MDAwZvTsjuS2mJ/XxcozJ7xcdTAwMTlcdTAwMDPINuj1zpQsrujVoXVQcJ2pn8+KelHGeT0re3lRslwiZVwilOXJxLX9XHUwMDFil+ufs3+6ZNi16yZTiEWccVx1MDAwMUwm5nWKZVwiuz+3XHUwMDE1XHUwMDE1+c+5MZ7zSSPvdcilhFxcqlx1MDAxZvJcdTAwMTObwvyi71xi9nU3bv3cXHUwMDEzXHUwMDA2WXekzlx1MDAxZrdcdTAwMDZcdTAwMTVqXHUwMDFmrz3TW2T5jqD6vOTp6mHK2YNB/5tkXHUwMDFl4Fx1MDAxM7f01omGS1tcdTAwMTQjnTFccpv7KfKAXFwmPkWm2uNsvVx1MDAwMqtPgoqcXHUwMDFjJSziXGZ3XHUwMDAwXHUwMDExqZxiJJc8+DTyrV2ifrWFOEvCMz5I9n7Vwlx1MDAxN41cdTAwMTRcYsjH27hTrqBl77OJceW9v0pXqvnEV2PaxttVYiX0YV1cdTAwMTSnZ1xiXHUwMDAyzJOIVmLctfpHXHUwMDBlmPvAP91TlVx1MDAxMlx1MDAxOOG473CKnNE9v19dpla72MlXln+S5jL2q4msxUiRXHUwMDAwq49cXKRw8nxbV9J3+PmtXS+bwXHaKWXW97nxdclcdTAwMTVcdTAwMTiSv29V8InuhXPd8/tcdTAwMWXsSJA9tNl9jTBAUXKVX1R5SUzwaZ7xXHUwMDA3Iy9apapzz33W8GKL63pcdTAwMWXwKFwiqFtfWyttyMI+QZygXHUwMDE4m1x1MDAxOOsr9Fx1MDAxYfDix7nJ1OfFXHT95fY4safb8yHRld+hKPS2akvpXHUwMDBm4YbIxbs3YFxc+e6C/Fx1MDAwMYN3XCJT3flz0sGg5rOFXHUwMDA3usxrM6Dx07MriCBvK8am91x1MDAxNdFTpqPGXHUwMDE0+t2388jSdjhZwlx1MDAwNTvh513RXHUwMDAyKZ7NXHUwMDFiO9yiXsPqMXAn2qufp3tA41x1MDAxY26ujF3dfZZKXHUwMDE4e752u8ZgSj65td1UMcZcIoUrXCKdcnLVuFx1MDAxZCT13jtcdTAwMWbyXHT9c79IXHUwMDFhjPcrJ4+B6uBn8Fx1MDAwMdao1y1/quTufnFcdTAwMDI4MD+Jy/tNglx1MDAwN5o51O0x8Gmey4LoMlx1MDAxMf3yVadcdTAwMGYmXHUwMDAzXHUwMDA2XHUwMDE3t4jf3HxcdTAwMGKZUbpcItdTpPCSi4tF945FRl2e44Dd4lx1MDAxNitcdImEXHUwMDA28lx1MDAxNcu2cFppl5hZdOeeXHUwMDE3NbpexFx1MDAxYf7HXVxipcI8MkM4neGbolx1MDAwN0ybq486sbGpt4xcdTAwMTMx3J6oK1x1MDAxMZVcXFx0JLO+XFzJoCjSKz9idqZvnHq+Oq3usnJ7XHImwqM+WFKWXHUwMDFk/to+b6DkylPXLlx1MDAxZm++kzr9cIpg9Vx1MDAxN21Gk0t/QfKqgq67ULjUUMpcdTAwMGZCXCIrXGaes8/txNN+vj/wgFOewDnx7pBz0OufddZMkVxuXHUwMDFkkJZz+jGxYdiT97LCn1adtLPlbZ8nZ3C4y6XRP6VcdTAwMDTusp67QYdek5JcdTAwMTS1+vRycTXbvVx0S1x1MDAxY6Vtm1x1MDAxY41cdTAwMTUrolxmXHUwMDFhdNc3nkK3mjlcXLI41ieSLOaSdIPOnVqUrnh7rVx1MDAxZShjNLWTxS7lrJNcdTAwMWGPJuTbyIm3lkxO0FNcdTAwMTcrjWmbUlx1MDAxMXfvnjmNXHUwMDFhJ/Y9XHUwMDFlrF2uT7U2mT7JJ1x1MDAxYT6YOy/YS3Dvhp6ZXHUwMDFlk5jXXHUwMDEypb23XCJ2XHUwMDA0fFhgnpE/p1x1MDAwZu9Zam0p7XKqVWjMxzGMN2pcZrlcdTAwMTab9lu2JH4j7dpKxVl5aqu29S37XHUwMDFlokf967NSc07watj9U1CKRiWYe8LyiXNE+dpcdTAwMTRyQC+z2IUmXHUwMDFmYFxiMJ9cdTAwMTSS35N3KG5HfqXnqpDmruqkU1x1MDAwNJNf9DJccruSZK+ZrWCUe8tp7vomWf9SvS9cXO1mRMW1PiDz6Pq8Y9ZcdTAwMTNcdTAwMTmvOXbzuFx0T3zsQ/Vlu5UszZa0vEub++rSNWZvnuJTKJGMXHUwMDA0QyWbVKhcIi2ti4pK664+2zRcdTAwMDZnNbDx3mnBS0P8VGdz97a4Llg9t1x1MDAxYrXAbU7MXHLf7StcdTAwMDJzTOw+XHUwMDA2wU1FT1x1MDAxYYMuXlx1MDAxYoxEP1x1MDAxNGVaXCIj9S6ou0Ou3nS181x1MDAwMnr6QmQqf9xuctfXxasrXHUwMDE2XHUwMDA0UVe0ikmFclx1MDAxMehcdTAwMTW1ulx1MDAwZc7NwmRxxZ1W9vXk0bs8Zm07lp10a2RcdTAwMTZccidsOzOFPd2fsbxbVG7s69QtSdnuj+RcdTAwMDZD6uTOUNhcdTAwMTmYyb3dWdtUrlO0uWW2NJRcdTAwMTPwpNCDmalcdTAwMTXyRFxyYlx1MDAxOfMyzOGuwT2uz2ElXHUwMDBixvn1OT89PiuSzWbftD9EZyPgXZKySp++2qJcdTAwMTPy8cPZQ24rXu9cZu7v9cjh33VY61PRXG7cc7vZWijIdsmWzk186oP7ii6FSNnaY6FY9KY/X6cs5Jp3hC1qScddsCxJ1sIgXkLlNmO7UndcYtVcdTAwMGbLPFx1MDAxNE7yiaHU21x1MDAxNGyvsq/COZvYLJ6CJmmt43vt2fhyXHRccudcdTAwMGLUiFx1MDAxZjxcdTAwMGVjXGbB1zmHueDsnrlS+SQoXHUwMDA0793grS9cIiHDhOvSJJjF1C2Vc8v5yYFcIklux1x1MDAxN29cdTAwMDZ8/Mpvc4yS7tfs2uxdruLV401ap0YrSEuVXHUwMDFlXHUwMDE3eoiCXHUwMDE1t7m7aLM9fd/iV2O1LkQonYFw7oDYXFy4NCfO4evdXWTl3qF08lx0xOdzxFx1MDAxMYQkzotpadcqoFhcdTAwMDT6ZC5Hz9TKXHUwMDE2WlObmvYsXHUwMDFm5VwiZTqB3LRe2Kj7x7OFhVx1MDAwM3Lb1pfiuvlcdTAwMWQ/J+FrXd5brVxu3TO5ILd3lVx1MDAxMFx1MDAxZt9gdVJjiMLc0npcdTAwMWR6Z++S9L1ZU/Q2zk5nyysxieVNM9q9bFx1MDAxY1x1MDAwMvTbhetf0FFut3RgUaJcdTAwMTd4XmOy8+LalpjgjFI9kJyTXHUwMDEwkDDkXHUwMDAyjS1Ja+RcdTAwMTnEuCHvs8CeQ1x1MDAxMbtnxfUmUoXyNlx1MDAxYz3glk96KluOI2KTs+qnx+3lSSqhXHUwMDFioVxuiuFcdTAwMTAkyNmJfFx1MDAwZYaIXCIxXHUwMDAxzVrqXCJXXHUwMDA04G2RXHUwMDE3Ocet21wihIZ7d9ueemf41fKB2lx1MDAxM8jMkHNcdTAwMTMq/dMoXHUwMDEzXHUwMDA1hzhcdTAwMTdcdTAwMTi20k2zXGKLZqxS56X5XHUwMDBmKcbmRDBX/KZWVXNSwlx1MDAxMlx1MDAwM11cXFx1MDAwZVx1MDAxOVpyiqtLNTMvrFtIXG7/gE52XHUwMDEzNvrCX1x1MDAxNSUzy0hcIlx1MDAxNu7rnPjJjnNcdTAwMTdHbyVp+Z/ZruDBcnryXHUwMDFlM1xuTah1JVx1MDAwZn9cdTAwMDTDXHUwMDBmKbl/XHUwMDE5ZVn+9//+b//1//ovXz//lvb5fcyzf/tv/1x1MDAwNWMoksRcdTAwMTlcdTAwMWElXHRcdTAwMDb7/Xp9XHUwMDFmRj9cdTAwMWb7Zz7/tdVXo//3R9t/o2hcdTAwMWHHMYbLOFx1MDAxY8NcdTAwMTP4XHUwMDBiK8hcZkVTNiNcdTAwMGIyzVx1MDAxMqZg2JSkXHUwMDBiOMj/84/Rm2eTXHUwMDA32zuH5/7t2dzLXHUwMDFjvNvyn4t7XHUwMDFlM/77XHUwMDA3/r1fdlx1MDAxZu+hb1x1MDAxZZ2Pw//2+9D/d3JcdTAwMWZymvyvz4vg+Fx1MDAwYnpSy+7YXHUwMDFj+1x1MDAxYz7kXHUwMDEw7pNwP/6EhObjY8+WOF2U41xmXHUwMDFm2WdcdTAwMWbV+X4gU9r7Z33mXFxhXHUwMDA2XCLD51uRcVx1MDAwNMi5fVnbx8fxj8zrdFxuXHUwMDE3zS4uXHUwMDAzvlx1MDAxM3vTg3Iz3oz82V5z9/b900tBMEVd/PF1XHUwMDEyplx1MDAxNz2hfGzkXG6v3Vfjzr9ccrOHaTgrm8Hbz7lNxrjba4rCJ0whgtfF786Ps0Qt+0I1+3N3pS58JMPAIIVJtS3joFFrv1x1MDAxOVx1MDAwYtxzXHUwMDA2Q87csicr7YxcZkBcdTAwMTZcdTAwMWbckmJ5ejqUydNlUeDLv1x1MDAxZZtcdTAwMTJfXHUwMDBmQl5XIeWVx1x1MDAxNXjyt8s/XHUwMDFkSyW08DxcdTAwMTPKfzPGP4/LyPLlk+Q+sotcIvp/N99vx3BsrlxcfjGfeLzGQ1x1MDAxN22pXabP8++u/35cZn/nS/xjYKjIXHUwMDFml38+JpVFXHUwMDE2nMdcdTAwMWVHXHUwMDE3/++u/34siKXrWf9ir35cdTAwMWOnXCIp8vOZXHUwMDFhzK771/t6rLDy2vLvZfvHsSOkXHUwMDAyX7zTq4KH/2pcdTAwMWZ+XHUwMDFj+92+/L1s/zhu9Vx0mmB06kXq9K/24cfxXHS9kb/ChC7vr1x1MDAwYl9KZHR5pPWv8aPdLfRf6/A4pja99Fxm1vyQw/lX+i55aVTP/1qHJS9cbukqe52FKFhcdTAwMThcdTAwMWG/0renS7j0XHUwMDBiXHUwMDFkwuv85JU66lx1MDAxNFwi/fmFXHUwMDBl4TFcdTAwMDRcdTAwMDUjlL/mRsR7Mq3ZXHUwMDEw9r/Wt3ziOX75XHUwMDA1/kRhMUtd5MxmmZ7lL/Ut2mL+S/z9XHUwMDA2e6Re4+jm/VLfglq5v8bfM31CzFx1MDAxNGd6MF+fX+qb7/321/hcdTAwMGJcdTAwMWM/XHUwMDE0eWgkrsp2+YW+4XHW7f9cdTAwMDP71erQOkAj0T9X/Vx1MDAxN/qGa3NgyPhcdTAwMGL88bqyy75Y7lx1MDAxMPa+9/qFvuFvN7Z+hb/SXHUwMDEyqYP/XHUwMDE0hH33K3tcdTAwMDNh78GE+Vf4+2Ekgi7FIex/rW+vk1Dpl7ZS4ye+NNEpXHUwMDEx6dMv9VxyuWGQv8TfXHUwMDBm2Gt0pDyy+pf69uS7xf5cdTAwMTJ/orGZJS9w5meZzt0vbZM4qvkv8SdYlFx1MDAwMttcdTAwMWVcdTAwMTUlXCIj/KVtXHUwMDEy8Mr+Nf6m9Fx0/4BGYjLl5y/0XHLXxvivb9/47Vx1MDAxYr994/+hvpFI9FxcSy7RIGbQ/vObXHUwMDEwUk49N5TJTi03Y+s1ZKC+4cQ2L85cdTAwMTVLp1x1MDAxOVu0N1x1MDAxNvsxn6BcdTAwMGLujlx1MDAxOFx1MDAxN1x1MDAwNebQNm9cdTAwMTNcdTAwMWJD5MmLXHUwMDE5XHT71lx1MDAxN0liJlx09frgx7xXneFPXHUwMDAwWFx1MDAwZfNGiqApkMTgwpEtalx1MDAwNJNcdTAwMGKBPER7sE7FkFxch81E5sxcdTAwMTFcdTAwMDbemoH/WDNfykBianZcdTAwMWY5XHUwMDFhlWnDX0duXHUwMDFjeozkpuLuZNyeR32zXHUwMDEx+eq06Fx1MDAxM1x1MDAxY4JcdTAwMGX8SWCi+z5cdTAwMTFcdTAwMWPIkdSMmOfqXHUwMDA07dqS2pAjZ3euQFx1MDAwZTomwelcdHFBUrNEXHUwMDA3xYmH1O25NIeJ0kTuO7fHSMHEYOOLolx1MDAwNelcZlx1MDAxMnxcXLm5x1x1MDAxOIxcIlx1MDAwMSec0d/8poTw4zxmbVx1MDAwMcDETFx1MDAxNsuycz9cdTAwMTJcZlu6nUO5udl5neBcdTAwMTBMdNvTqXCoISGKiTM18KxcdTAwMGJcdTAwMTAo3TZGc5Pv+G1R71x1MDAxMqu2UXWXRXFxdIWJwHzfrinCfuTEJED9uMzJXHUwMDA3S1x1MDAwYvBOy6LF2vLuVETarmyRrFxmXHUwMDAwiMJcdTAwMDHwXGY5hM6r+5hcdTAwMTQ0mCsnUSihtFx1MDAwNKJiRU7BaJKlXHUwMDA2wN3ciNlcdTAwMTmGXHUwMDEx3GRdmSSJYmYmWGRcdTAwMDMycnxcdTAwMDBR+oBkW9hu1tqeYVx1MDAxZVJCgn0yXHUwMDFi2/tcdTAwMDG0TrBJ1H07zMhcdTAwMDEysFxuMEpJRYCZw0lcdTAwMDRcdTAwMTFcdTAwMTFcdTAwMDFcdTAwMTQ1kWChkDfIhqLFXFx7XHUwMDEyV2SAQEuY42FcYj3tKO2UhFc8YG7miEyEiFx1MDAxN5N7f8nLVHC8tCSilkFOi4m6n1xmUVx1MDAxZlx1MDAwMlQlk1x1MDAxN07KRMRcdTAwMGVcZlx1MDAwMjyonPDRbMabaFx1MDAxOFx1MDAwZjwqz3mhoWZXv5hcdTAwMGL31lx1MDAxNnPfZ1x1MDAxNPz5oFwiJ9AtkkN87cSc51x1MDAxNOdcdTAwMDJk3TPVpnGOQVx1MDAxY2tGZjR/1r/b2WeZXHUwMDExxuZNXHUwMDA1XHUwMDE4nlq/olx1MDAwMCRcdTAwMWWveS0t5k+LKUJcdTAwMDH5RCN6U1x1MDAwYs8qXz3MQa9Gz59cYlx1MDAwMLBcdTAwMDSfiznKbztDv4JB5FxmUkPsjlx1MDAwN3HttjN5XHReXHUwMDAwjlFyUoKnMHarxWqnQVs9XHUwMDFlt1x1MDAxNEF2XHUwMDBiXHUwMDE055VniMaCK1x1MDAwNcRMTFx1MDAxNMdcdTAwMTBDXGZcbsiblWRfWrFE5aXT8pAzzVx1MDAxZv5Y4t1Sd0FcdTAwMWLNzFx1MDAxNLw2XG4gm57N4igxqEkgY0SKTq8wRSxcImbIt08phtBaz6RcdTAwMGJlqJ88MVthtFwiZbVEnVvgbFx1MDAwYm0y5X1Y9yVcdTAwMTXKR1wiXFyrj1x1MDAwNKRioH/Mi5pyftufrcxSlbZSheb3NVx1MDAxMy+8QcRidjJcdTAwMWGPlPiMdHjexrOulDLk8lxudFNIjydYnX1cdTAwMTCm2dmN11x1MDAwZlx1MDAxYtTA3LxNWq68wYWF/Fx01Zu7XHUwMDA0XHUwMDAzXHRigVx1MDAwZaj1iWdpoFx1MDAxNJ7ZXHUwMDEwu5vgXHUwMDA1XHUwMDFkMy0ybTFuU/6wlzdeXHUwMDE3MyduPFx1MDAxZCGh+aoqXHUwMDE4vkJcdTAwMWImfrVcdTAwMWT539pcdTAwMWXydDpqXHUwMDEzNzFcdTAwMTOzdlx1MDAwZn+YXHUwMDE0q4TxQ2VcdTAwMDUxn6e+U/rrI3vArsJXW/zxe9thuMgnkVx1MDAxOVandHau/2FCRU/0Kq+5XHK8m+twfnaZysO2XHUwMDBm4dHW+73t+XqCtjPD09bTji/t/OCOLlgw5rVcYj7q5WP+OPJcdTAwMGVNXk/wWkamzT/amlxutMlcdTAwMGXjXHUwMDA0nTSB0/LDP8p8XHUwMDAzrXubwHj4acD5U7PTv9rCa1x1MDAwZelcdTAwMDTxb22V51x1MDAwNP1v1t5Qnijqm7z98LdcdTAwMDG0//tcYvdRkOH8XHUwMDFmXHUwMDE5XHLDgzjl0Va7db+1XHUwMDE1l1xixplTNTB80u/Ddvvho95ccs9cdTAwMWI4dez1Mb94cszDTnk/2qL/aFx1MDAxYpuvL/1l/9Dfb5g5XFxqXG73xueO+Vx1MDAxNVXZXHUwMDE0/ojyjrZ3/lvX37r+1vW3rr91/a3rb11/6/pb19+6/tb1t66/df2t629d/4d0vb483CCQe0rPV1VkiDRJRo9UaId5XHR55ezE21lcXLgspGViglx1MDAwNXz0XHUwMDA2XHUwMDAzl05Qbz9d64C7XHUwMDAz7YK0PZBcdTAwMDNScDCTUW7z3Gtg8fnrWFx1MDAwNLxCR7s6XHUwMDFiqFRO6Fx1MDAwNe5cdTAwMTPlhN2/Z592ZJE/fPCEXHUwMDAzyIF9q5mS6NEoalx1MDAxZkiGgDyZLC0vioDIUVx1MDAxY6dHXHL+P1x1MDAxN8Oc2OM8olx1MDAxMVPVXHR3hzrJeV6lWcbJ5f5cdTAwMDGYbZhdXHUwMDEzYVxuXHUwMDA0yFx1MDAxY5rx04hNXHUwMDFhMZtXwOjri/WZXHUwMDE4YsVcdTAwMDEtV4yFXHUwMDE5XG5EMcY738/Zlo5cdTAwMDWSvveGsoJcdTAwMDIw8Vx1MDAwNVx1MDAwNGhLKppPXHUwMDE3hVx1MDAwNlx1MDAxOHa4g8zGOFx1MDAwMDjaNInj7Vwiptn2XHUwMDFjJ4VcdTAwMDBcdTAwMDB3jmNu6lx1MDAxM4LZZWq2qemDsNRcdTAwMTVEXHUwMDFkn+cl5Fx0759LmVx0XHUwMDEzJ5a1XHUwMDE5lVh5XHUwMDAy4Fx1MDAwMlx1MDAxMIXJZoDMLsF1SNE4hFx1MDAxYrQrhjbpWlRowVx1MDAwMFwiXHUwMDFhSZZcdTAwMWL8JGp7l1x1MDAwMFRBXHUwMDEwTI19XGLN/lx1MDAwMLYryoHlrsCH+6xBqlx1MDAxZJ+rJWWYXHUwMDE3XHUwMDExy4Jcclx1MDAwMJbhlsIpXG5gjL3P5XOyXHUwMDAy1uLEmdm2hbhSXHUwMDBloKO5vkxENTLMXHUwMDEwI4BK+6raXHUwMDExlN1cdTAwMTBhZtyMPlx1MDAwZjJtWlSRjNFcdTAwMTdXwVVfXHUwMDFjJp/vXHUwMDAwYG/AXGZcdTAwMWLIQFK4mo9lObtcdTAwMTMrVl9cdTAwMDJwvDvv+OA3XHUwMDA0bH9cdTAwMGY4wKQ7XHUwMDA30qjHaJpeg544ikPJ99YsiFx1MDAxOTCYslx1MDAwM6JcdTAwMDbMuSYpwCGvdlx1MDAxY/OJSe5MXHUwMDBiXHUwMDA3aidZwH00Y6I7UTG5XHUwMDBiWN51XeDM4EW0+5POXHUwMDBiZ6zQ3bXc/LyHd15ru5PglHLYQXyqeyNcYlxmwlx1MDAwM1x0XHUwMDAx11x1MDAxNLCc6lx1MDAxMm3/XHUwMDFlXHUwMDAxKOx14cD8aFJC37iFKfZLRquC4PAgWCXAVFx1MDAxMUPRXFyIzdOzK1x1MDAxOU0r+dnLrzZ4vr2Da0Um9jutXCJcdTAwMGZcdTAwMTdkT3eeNfJzz46+kuVUUbbeSKqYK/oxXHUwMDE3k9s+XHUwMDAwMlx1MDAxNVCcdHbrz8UlnJhmvc5cdTAwMWFbT+cnPkVbQSYlTlx1MDAwNSxbgFx1MDAwZVx1MDAxYtHZ7edb1M9ccoI4w+dcdTAwMDRxR1x1MDAxNHPyoeFcdTAwMGW2tlx1MDAwNFx1MDAwMNxcdTAwMTW352f/Rl4oijhcdTAwMGZcdTAwMDIykqbJ7CRcdTAwMWWA3drYwlx1MDAwNVGI7yvI1zLXrpiTjCCfXHUwMDFkJWNcYmaafVx1MDAwMFx1MDAxMCc5qVx1MDAxYyDtUqGlnVx1MDAxNfInMrjIrkBbXCKeQr69V7ed/7AqbVx1MDAwM3a7ISRcdTAwMTjN1p2LpoNaJXCCXHUwMDE13OD2MNlbZ1x1MDAwMqQsQKXty+RcdTAwMTmIzWRcdTAwMTeIXHUwMDExgSlnXHUwMDFjqZfZa29cdTAwMWN2XHUwMDAykt1cIlx1MDAxMsn6XGJIi1x1MDAxZFxy91x1MDAxNE6K6Vx1MDAxMbRPXHUwMDA18oiKNuw9h3tk4H12XHUwMDE3lTO4J4FcdTAwMTRcdTAwMTTJMVORc0BzW1x1MDAwNtDW3TaWq1xcjZCFpFx1MDAxNvAu/tbA7NNcdTAwMDS0XG7F/cObT42gLVx1MDAxZeTngCOYrlx1MDAwNfumeXBcdTAwMWFcdTAwMDZSfmXdojRpolx1MDAxYuZ5fiSQ0y5cdTAwMTFQXGL9ebVcdTAwMDHBivlktZ3FqkheuVx1MDAxYcLRXHUwMDE4484gXHUwMDE4IVx1MDAwZT+XK5NC7LuGXHUwMDFifS4tKeU7Midz/Vx1MDAwNzv1Yspm0WhcdTAwMDMwgbqYaNuLs5SJXHUwMDAw4blZtCHwytbLSd1AXHUwMDA1POZcdTAwMTKRJ6Dp606sjZqAvlx1MDAxM6SY15xcdG1tMWQ5IF5cdTAwMWOfXHUwMDExXGYkl+7y89lcdTAwMDXDKzk+a29/tGdPbCpyXHUwMDA2hfRwX1x1MDAwYpCQiGuJnEKL/ULAv4u2LysvR15cdTAwMWOipKVcdTAwMDRIkzOcwCRcdTAwMDCtr1x1MDAxY1x1MDAwMtzq/Vx1MDAwNii/crQsLSl0K3rridnHbq3Df1RQ50Q+XHUwMDAyVkzu/7xnkTtRXHUwMDBiwKnPictcdTAwMDeQwW46XHUwMDFmKE83oG+KKF46wmMoub15m3gjfN9cdTAwMDdcdTAwMGXAQNTHzFx1MDAxNGFMztmuZ+ZnrrtCj0Q84YRcdTAwMGZCXHUwMDFj9sNvQSPIQD3TXFw0YibKtzWMPbom3lxy6Fx1MDAwZmzquHdgXHUwMDFkPpwmlkVniL19XCJcdTAwMDCsYu6OWD65bttcdTAwMTH0h6iZuE35WOCLzjrbXHUwMDAwNyAnuy2D+9fBOGVs3eO+tJ5bPGRcdTAwMTjcfFwiPSFcdTAwMDNcdTAwMDT5XHUwMDE1zZHiyipcdTAwMTFcdTAwMDf9Jf+EM+NcdTAwMWSeLjC2Ua23J2U0355bXHUwMDAzXHUwMDE1IdvuY2lzvE3qv6+Hb4P+trPH9ym0XG6uWVx1MDAxNI/5eJHTn0VLwthi9qNUPXuwXXOrwlqXeeJV/rwuYoExj46XcNO6L1t63Fx1MDAxN1x1MDAxOVx1MDAxYvf4PoF+t3gt/cJKykvEXHUwMDEzrtC1vN5T73DIpL5cdTAwMDXe6+j7+lNfgodz6Nvjx+lcdTAwMTP0aWaGcM9Dr4F+gmtN4VpcdTAwMDW4hlxuwIayc+yJelxuha8hf/Stf+77wXneRnVxXHUwMDE07WNcdTAwMGXaa73+XHUwMDA2uKfO81x1MDAxYVx1MDAxY1x1MDAxMlx1MDAxNdVcdTAwMTR2XHUwMDEwjthcdTAwMDTyXG6VT3BIXHUwMDE4jaFGk2C3M+yL/akvx1x1MDAxZLHZv3cveVx0a2tcdTAwMTFL+d/rM1x1MDAwN/JcdMZhryNGbWLMOFx1MDAxZjj501hcdTAwMWN7XHUwMDEybdHu+C8lQrtDwlx1MDAxOKO/VUupw/VWXHUwMDEwg19TtDzPkc+Ml3a4XqF5XHUwMDFkMdY1RI2j7/tPfcdcdTAwMDNcdTAwMTei1f2Mi7g69mxcdTAwMTNcdTAwMWZcdTAwMTDQPFx1MDAxY1x1MDAxMu6ZXHUwMDBlYEwsSIdcdTAwMWNcdTAwMDLE1O1cdTAwMTjyR9+/YlxuziHyvVdcdTAwMWRz5C9cdTAwMDM94Vx1MDAwNYifkCNwyJF/tPD6XHUwMDAy90yHtoFcdTAwMTNEOCQmwL28Ndw1PPqe/9S3OFx1MDAwZqUn5VDX5+rAeVx1MDAwZddG4yk4vlP2IJfjTv6xR1x1MDAwYrQjervw3Fxu132j4LqdW2Ofw6Pv+ee+RSFCO1Ldef7rhIHnUNc0XHUwMDFls7po849u4bPlXHUwMDE48rZcdTAwMWPxeOvx7Fxu1317wyGnS21cdTAwMWaxelx1MDAwNfH6U98khevzqpP84/RcdTAwMWJicSRcdTAwMThcXD/2yCo7T4frg0PCPXJcdTAwMTF44H2tO3576jGk9aNv+HPfPobr88pcdTAwMTPkwzHHXHUwMDFibvbYXHUwMDAyXFyH8S9cdTAwMWOyh1x0y8JcdTAwMTOpXGaHtFx1MDAxMei3vVx1MDAwZVx1MDAwZelBLjW3+VJDXHUwMDFjXHUwMDEz4Z/6XHUwMDEyaH/wtSz/XHUwMDA3doQ/clx1MDAwMVx1MDAxOICkXuep+TfX/9NcXCe+uf3N7W9uf3P7m9vf3P7m9je3v7n9ze1vbn9z+5vb39z+5vY3t7+5/c3tb25/c/ub29/c/ub2N7e/uf3N7W9uf3P7m9vf3P7m9je3v7n9ze1vbn9z+5vb39z+X8/tXHUwMDFj4V1cdTAwMWTleZHnv+ozu99cXP/m+jfX/3/J9f9ccv34XCKlXHUwMDEyp3OAcrWKXHUwMDAwRNagRdRXXHUwMDA0SzCXgsDacvQ0+kJQWIpEzX4pQFM8s1x1MDAxNWNWUmqTpCqIqK1cdTAwMWXvXHUwMDE0ILtcZop5di1cdTAwMGJcdTAwMDeZOydx0rtJkjepl0vdXcs2XHUwMDA0JDjVz1x1MDAwNch2XHUwMDA2Xl9cdTAwMTE0JZJqo/BcdTAwMWPDXHUwMDFiXHUwMDA0v1x1MDAxMmtLzqqvejrvaF7UycdDXHUwMDFmXHUwMDEzfzxcdTAwMGJcdPjoo4ex5Oh81O1cdTAwMTb2Ob9EPnl6XG4t39zSYVDBqa47Q15y4VxctmCyXfAqZuR4virNXeaNRDGPfJBPxbt4Y+NcdTAwMDRcdTAwMDJcIoBcdTAwMTfL7N2IXHUwMDBiw0mdkNdcYlx1MDAxNInL4VhsL6ey4Dy9MOZcdTAwMWTSXHUwMDBiOulF89osXHUwMDA3nZ7GQl5aYSc5xGlrjveT+vWJT2ZPpmXKLVWGY5RJXHUwMDEwOLZoOGJ6pIDDXHUwMDAwuMzBWCAuMiU0a6BqprpcdTAwMDWBOGZDTJG5S7eRXHUwMDAwXHUwMDFiXHUwMDA3XHUwMDEwLvErf2rrkkM+Yz5bXHUwMDA3RtSMR152rr++njP8z+g44J95oGDzY4ypa26BzPSO56zYr2cq/zN4/MuzqCvpyydB8kuZflxix3O2pZBcdTAwMGa+W1xu1FM58ftcdTAwMTmqM2Wcu/xcdTAwMTBLXHUwMDE1fVx001xi91VcdTAwMWE42Fx1MDAxN1x1MDAxYiD/f342NeX+4/4gc//8XFxy/vL5kidvUIeHVidcdTAwMTLqT1x1MDAwZVgh71x1MDAxZX5pkXChlbVf3ydPXHUwMDE3Jlx1MDAwM+LMfyE8c+jWTtz2z88pg+t/3Gbv6J+eW1x1MDAwNr3sQcg1XtjJXHUwMDE2ySdcdTAwMWZcdIJeXHUwMDAzcH1cdTAwMTD0gtNcdTAwMWSQs4jP9lx1MDAxMuA1XHUwMDFm7mPieiqNwr7XnWP+8lx1MDAxY/N/xq7+5bnmVTtw/lJUXppcdTAwMGVGUk4pMKtMi5pcbvdIOpQ6bsO7PDhwO0NcdTAwMGVALj6cgFx1MDAxNCaQ//X53W+sfWPtXHUwMDFia99Y+8baN9a+sfaNtW+sfWPtXHUwMDFia99Y+8baN9a+sfaNtW+sfWPtXHUwMDFia99Y+99cbmtcdNl4XHUwMDFhKFx1MDAxNVx1MDAwMFx1MDAwNOaoXHUwMDE5clx1MDAxOYh+30Lcu46is9Ss+uHBtLogP9v1zlx1MDAxMFOQXHUwMDE2bsGQSWtvw0j0p2bk2Osgcu5cYkg/myONXGJcdTAwMWGamqK5ltjL2+D6fvZcdTAwMTft8cFcdTAwMTCOo0aAfFxczdxcdTAwMDGof6vV8mhcdTAwMWEw9y7fkdKytzmCuJRbuFx1MDAwNpkj0enFkF8lWi7sYjIy5VBP8HmWXHUwMDAxYulaJDhVgVxmXHUwMDAw2Vx1MDAxZJTZ4Vx1MDAwZjZhVYWg+ERcdTAwMTHFTO31XHUwMDE21XapMfNcdTAwMGVcYlx1MDAxNtytxKaYlNHuzFx1MDAxZSUms61IVFnPVPiULsBcdTAwMGJgP+2JZZGcuDDMrS9cdTAwMDCFXbggXHUwMDE0jlx1MDAxN7mxXHUwMDAxS1x1MDAxMTXN5dM0hDTLgFx1MDAxYrEtXHUwMDA0uFx1MDAxMtG8rj5selx1MDAwMSTLXHUwMDE2WkuAz5bj2Fx1MDAxZK55n9+L6/ZIbudM21x1MDAxMi6Anfp6o7J8XHUwMDFj51xuOM+5KDNcdTAwMGYwXHUwMDFi21x1MDAxYfVcdTAwMGV21OfA1/vIcDaPXHUwMDEyMLVcdTAwMDTHyFx1MDAwMVx1MDAwNYdNXCJcdTAwMTeU1WdQkVRnRU5cdTAwMDBMvFx1MDAwMVx1MDAwZVx1MDAxNVx1MDAwMdchrn2bXXl+XHUwMDE3S17qXHUwMDEyP3BcYvVcdTAwMDLgk1x1MDAwZjMobnNBsvxcdTAwMWNcdTAwMTdNt0hcdTAwMWP2zFx1MDAxMe7lXHUwMDAwoFx1MDAwZURFk1xc1lxc3fGWI3orbFx1MDAxY1x1MDAxMjEt6H1cdTAwMTdo51xy41x1MDAxMNB91YNxXHUwMDFmXHUwMDFl/Ie6R/JTWojzYznK6CCcXHLoj1tM7qSYzGqXNlM9XHUwMDA0jiuYnZhcdTAwMGKA81x1MDAwMDBcdTAwMDbKXHUwMDAwKTPfMyuhT1Z8XGJcdLOqXHUwMDA0eFZcdTAwMThcdTAwMDJcdTAwMTA2/Kq9sknsXHRVOYAwaFx1MDAwMfpcdTAwMGLIj/o+yfpomTaCXHUwMDEzk1PkXHUwMDEyXHUwMDFmXHUwMDA2UOFcdTAwMGVWdNZaXHUwMDE3cDhcdTAwMWZ93Ddi+lx1MDAxY5sxxOwqx12lmeCwXHUwMDAzJzi4xTnyXCKEXHUwMDFiXHUwMDAzMD1cdTAwMDWZ41x1MDAxZffGZNpcdTAwMTXf8olcdTAwMGYm2+KLopiouWOIVoNKxG1cdTAwMDCUXHUwMDFlp8eImKuSIFvSz1x1MDAwNY9cdTAwMWZn+6iMXHUwMDAzylx0sFhcdTAwMDG2XHUwMDBmUVx1MDAxMWDirse9vLk0aNO9t4BUWZfh9iyEMqt1XHUwMDA2aFx1MDAxYuD1njmD7S9cdTAwMWPIx9SVXHLcTs3i1rrkzjpz4bhtXHUwMDFhXHUwMDAxarZniO/+muDbXHUwMDE4XHUwMDAxYS5cdTAwMDdEo0575dCTj1FcdTAwMWK2MCCZgcWYXHUwMDEzM1x1MDAxMlV10/x9XHUwMDAyj72ekzFcdTAwMDMnV1ogOXKMoXBcboNcdTAwMWJtcVPUMtNcdTAwMTRkXzWXZHxti2B1eNY86lx1MDAxZKlcdTAwMWNBXHUwMDE0XCJcdTAwMDBcdTAwMTNEMNBcdTAwMDSQTS7JXHUwMDE1M7ddqm1uVjMmXHUwMDEyjlx1MDAwMGZcdTAwMDNcdTAwMTAhm+diZ1ksJ6qdaDiCa1x1MDAxZlx1MDAwMcFB8JkmxGOOnIxcdTAwMWNcdTAwMDHslVx1MDAwMD3NXHL9XHUwMDA1R9Isf2M9mJHcad4zYFwim8jhT2yAxdirrag4d672NzFWOeCIKYeLXHUwMDA1XGZcdTAwMWXBvW6lPUhIwM08U+StXHUwMDA05lx1MDAxM9zla1x1MDAwNLiBINq2afxcdTAwMTFaoslzPbmY642vxkeuXHUwMDFl9085wlx1MDAwMMGcMJlmLFx1MDAxNDhx5Mx33lx1MDAxOX9cdTAwMDNw2W1ccqediqZ90Fx1MDAwML5Tglx1MDAxN+1EoDarXHUwMDBioEx8XHUwMDE2aXr9ZPOHdb1cbsdZwn9lLFx1MDAwYlx1MDAwMYRcdTAwMTdQncd7Wdv1QnJcdTAwMDbruXPxllx1MDAwMFx1MDAxMaOFXHUwMDE2XHUwMDA0O4dkLqHeenfHXGLNsvr5Pq43XHUwMDEycaeLsLZ3XHUwMDBlLZCXtFx1MDAxZrw3Wrg+hO1B6qI3w8pRQinK5YLIqVx1MDAxM52yXHUwMDAwoYY7SD80KJicLrjSXWNcdFxiXHUwMDEwxMVEuyP25lx1MDAwMMfYzH5cdTAwMWa5gvXR93Khx32g8Fx1MDAwN5WhXHUwMDE39u5HrOLTXG7hPFwicIZcdTAwMTOeXHUwMDA3qZiweUUyXHUwMDBl/irmwmNY6Lr4/ep7pH1cdTAwMDVcdTAwMGLCXHUwMDA0XHUwMDFhaHX1xztDXHUwMDEzUNKMd8Ejp594gkFSXCJ/J3N2Kty9XHUwMDAzNMrwgCBcdTAwMTlonFx1MDAxOKZY2ILCXHUwMDBiilx1MDAwNjtcdTAwMGLWS9GS4jTpv9dcIspcdTAwMGa/q41lnr8o0VxcXHUwMDBlf1x1MDAxMYPVuaSLgJ//VFtccnyOupz4+1x1MDAxZrXUXHUwMDFlq+51PFszXHUwMDExjoxHveH0TzVcdTAwMTVcdTAwMWSpPOpXLmnD6d5X7bXhXHUwMDAy540mwo8oPVFoft5CjVT/0eFHvdGrXHUwMDAxj3ukQY93fVx1MDAxZbNHp43nNXxcdTAwMDUjlf1NLc8lhb5cdTAwMWaZpFx1MDAxN/H+MfflOZTeXHTgtFxijMqbvVx1MDAxYfHKgl9+qlx1MDAwM3c/1m5n0KnQl6+6cFwidfV0XHUwMDExuWpgNl9/rZPnmE+4XHUwMDA27EuUr7k/R5wmRDk4R5RcdTAwMTUrtDxusvRPUb5qSFx1MDAwNiGMV4TeaVxi4rc6mdFcdTAwMTGPRfRcdTAwMDayNf+b+oxretTCdMxcdTAwMTdhfNU41S7Hd4M+O0GfXHSzgn69dqAo5Vx1MDAxZusnWuL9iMPsXHUwMDFijudf9VlF4bmGXidCP8ZcZubf1Fx1MDAwNYWiXGK8Ru2p+lWDVeLvZVxi44tcdTAwMTCKcqVST6Nfj02uUPWPNVTLXHUwMDAwblx1MDAwZWe8XHUwMDFknEG/alx1MDAxZi5WeFx1MDAxMm0oXG5cdTAwMDIy4fo3NfegKFx1MDAxZM85TIl+vV86NkORn/1PXHUwMDA1XHUwMDBlUUq+XGJfzjKkP+FlXHUwMDEwY7g5b/uNYPlXjS9HeFx1MDAxZbHTXHUwMDEzRFx1MDAwNPM3tVx1MDAxZcvYMuFcdTAwMWE0XHUwMDAz5OrXKVO4855Cj2H2JUppki9cdTAwMDFRqp/wojxcdTAwMDO4R9x7tPH+R/3CZThks1wiOifSv9ZcdTAwMTi1JOFYQ0nZjLd81f6Lj+9CzdmnmjePgFgpXp27WD/V435cdTAwMGVnKG402u9cdEu/ljsp5VFcdTAwMWbzXHRcdTAwMTKc+WttW6kk+WNccpoxn+WvU71y40uFXHUwMDE50Vx1MDAwYnJWIVZMtlx1MDAxNlx1MDAxMKH8XHQv2NM7cFx1MDAwZUVB+699UbbhqMs6QItcdTAwMTTFf61cdTAwMWKZalCuooeiXHUwMDFjldLhKSXu4ZWZm8p5i1GIleKla4v1XHUwMDEzXprhLJ+kKLP7qfa+9mU6ODzXxzunqb/WK5We5LGG9Fx1MDAxMOVr7lOv+GJ5IWa0Rlx1MDAwMlXIXHUwMDFmZvrg/ynKXHUwMDE3zmXs+Fx1MDAxZdt9f49cdTAwMWP6o17xIYqnIMNMpNHf1MlNI3jsVk/K3vwvzGNHXFx8goHSa9zIXHUwMDA1ilx1MDAxMkBRSOunOpnNkYtI12xsh/pcdTAwMDd+XHUwMDBlXHUwMDBl8zM2XCKMyP21XHUwMDA25SGKJ0DbKvyo97monVx1MDAwMmPTi1x1MDAwNkWZXCJoc956+tA54Y94iWX0qKl6XHUwMDBmxon7qkFrScrBYVx1MDAwNZlnwrv8Te1TKMqJd4OJtL8wr4rYYTPvXHUwMDFk+Fx1MDAxMlx1MDAwNdpcdTAwMWNDXHUwMDFhTO0nvJh8c+A8uFx1MDAxN2NUvr7wXHUwMDEzXHUwMDFmXHUwMDFj1mdcdTAwMTjlkX+tuaurkrhUnrBcdTAwMTXE48d75pdrKVx1MDAwYnl/0YpDXHUwMDE0aPdcZr54xOtcdTAwMWbxXCLEL8i3+Z5cdTAwMDTZh/2x6SZcdTAwMWNsXHUwMDBlXHUwMDE0pFx1MDAxZIm/1nqW+MU71uBcdTAwMDQ5an2dup5wnjeJe8ewL1x1MDAxYmIlok5cdTAwMTIryT/hpZfrXHUwMDAz58E9XHUwMDE5o6/lmo/4qFNcdTAwMWPPODctf62jSjr8sVx1MDAwNmFL0MfX3KdcdTAwMTXabSFnMqV4PYZcYto9wyvK+Ce82PHrwDlcckU5Lccoj/Rxmjl6gVfJt+HLSthDWYpEQ4hcdTAwMWH/az1fTViONZFQtNfXWvyvvLpcdTAwMDdJZ7KNXHKxXHUwMDEzUaLASvxcdTAwMWbxY/RHfolcdTAwMTHBnXmHX/tk1pDTJlx1MDAxNVx1MDAxN1xiO/1NXHUwMDFkaXI61lx1MDAxMFx1MDAxZKI9v+b+XHUwMDFjdlxcyVx1MDAxOFx1MDAwZfJyLaPuTOie+7toP94nb1x1MDAxZt9bVFx1MDAwNzopslx1MDAxZjVcdTAwMWNcdTAwMWYp5LRQ9CZHQP/6l1x1MDAxYa2aslx1MDAxZfVwSZjrvb44kFx1MDAxZHZcXOzd4m2mk1x1MDAwNUVcdKEoiPRT/WKjk2EsgrXJjfmq0ayr5sFpk0uK6Xjv9V9qXHUwMDAzQ1FkvmjtJfnBXHUwMDAx4XPYUMyHoiT1ylx1MDAxN5+zpp9dL/5cdTAwMDN+VME+cN+8mGT2f/il9eA0XHUwMDE0heFQ5W9qUkNRxFJCmUn6qv8tlONhx9WPXHUwMDBiXHUwMDBlUaBccjp7jLhuf8SPuFx1MDAxOFx1MDAwN+5feMtcXMgvv0SqOuT00+RgXHUwMDBl8dda6KJQLoOO8mnLkfFcdTAwMGZcdTAwMWaldNBHfTCfOETZ+PnpaeTV+lx0L1fDgbjHYVx1MDAwMHOff2y6uFx1MDAxZbKtxZvJlr/WXHUwMDE5Xiz5WFx1MDAwM1xmYEbpN1x1MDAxZjVcdTAwMWU+XG7/OMCQ0lx0XHUwMDFhj3NcdPj1J7ycVuPAPYo3zOXLL4nk9YiDXHUwMDFhk5uT4a/1rb9jse9Y7DtcdTAwMTb7jsX+XHUwMDBmi8Xei0ZcdTAwMTPv94Sbv3HFqPg6kfs+v4j90npcZlx1MDAxOJlcdTAwMDJcdTAwMDBcdTAwMThs9Fx1MDAxN2PPkz22ukmIRY5oXHUwMDFlXzUhLI7lrGzWKsBxXHUwMDE2XtFcXHp8kPJcdTAwMDZcXDO7XjQxoKbNLfvJx1xcO22cQVVW4Fx1MDAxMaz4xyVINDhqeSuYYPHMqEHsXHUwMDFktSlcdTAwMWU8XHUwMDAzXHUwMDE2kS5cdTAwMDA/P8blcrFE01x1MDAxM01i/ywrQmfzXHUwMDFlhouBnpxcdTAwMTexb2qqen/wXHUwMDE3YqeMPVg1gllcdTAwMDDW1m0yvr8u2Y8kNuckkYqESetpYEacw1x1MDAwM2JJsSYlovlJr1SqnVF4klx1MDAxYVx1MDAxOFx1MDAwMvFcdTAwMDGS9Vx1MDAwNFx1MDAwMFx1MDAxMVx1MDAxOPtcdTAwMWTbqGLG7YnDJW1cdTAwMDdcdTAwMTeWK9hI2CeihWNFN1x1MDAwNiBMloDdiVx1MDAwMNpcdTAwMTcgqE2CeLM5VlXgZdAuwTFcdTAwMTjL4PO+M3nSXHUwMDExzZ1wIKs1sEaSRvo/8ctcdTAwMTVGwd1cdTAwMDSMtn/oalx1MDAxZfRWo2bGpSWbId7PXHUwMDAyUHNcdTAwMGWoXHUwMDBiluM4U1xmQFxiz1xiKLnCwaaBXHUwMDFici3B0Tnq63neWJfiXHUwMDE0c5bKguVbXHUwMDAzzVx1MDAxOVx1MDAwNHAgJ/L5iqe+oFxupMtccqiu60umJ8kgXy93Ukr5MVPP4UvKXGKB5UlelvuLsvjy+6lcdTAwMDEvvVx1MDAxOPFZfN6HIDjvWt3h2ZVA2P2kn1mf0IhXROyyxrOARmlcIolGLoPI4fqiMFx0XHUwMDFhmbJcdTAwMDZY67mMKf8q/yHm0Izm8FUvnsiyL/FcdTAwMTW3XHUwMDFjLlxid3VmdqVHky86qnFpZmKBP4Cc4t8jXHUwMDEw9OWsQV+NJ7dcdTAwMTGB3lx1MDAxY6RzxqWX+5lcdTAwMTRcdTAwMWS9frt/9Lc1f9JcYoIgtfThVyNdXHUwMDFmtvolXHUwMDE4pFx1MDAwNP3BncJAQUTUZ2eFNjDYXHSpR971WoPihLs63mPXXHUwMDAyWrcnrkd4XHUwMDExgkwzxGupk1x1MDAxNf76g7/RxJCfzD2Mmex9xFlcdTAwMDZ/ZcW8RFx0XHUwMDBml5+Sd82Fd6nR2MTQpHznmYpzbz/qc/9m61x1MDAwZX8mXHUwMDFiQ7tcdTAwMTnQflx1MDAxZudcdTAwMTR6XHUwMDExhKz0RGH6euYl33/2odDE69Befvl8vjzuvfjMeTBCoaxge/d6XHUwMDBmzdfpn+tT+Fx1MDAwMbaLSjCkx3xNXHTjNVx1MDAwYtVoXHUwMDE3XHUwMDFhNee4efZMXHUwMDFiXGb9yZZcYupj/ke98+Nel2+Nd1x1MDAxOCCox3NCMZq89T/a3CE8nodaJ4s9cFxcTsdzUNHGVy+E92Rcbq6XpvDw+kf/zMO46EdsL/JP+Lc2npZcdTAwMWHmdVx1MDAxNlx1MDAxY4+7vb3J6/7pXHUwMDA3QnGBdi2XkHWBf53vR562e0VcdTAwMDdH16mjsJWxJZH3U8wg31Xkx3yiftynkjesXHUwMDEzXHUwMDA1K9ZhfFP50+v5R/u8Qn+aSSq5rzL0T1widdxzK3TxuFx1MDAwZsdcdTAwMDfQd+x9e/P/XHUwMDE4h8N+XFz5w4/oXCLcXHQ5R3vxwsc6jPskrKmPWmj/xJ9nwnZcbuky2rFcdTAwMWWjgzGAZFx1MDAwYkhcdTAwMDVHr15HLNRcdTAwMWFj9rO/8Lvkt9hBL+Ha5MC8lrq8lsdzI7ZKn/9o903l0I+VVK5cZvPAzmyO55/YUqfco8pcdTAwMWHEiTNltfJHm39gR/jGzjd2vrHzjZ1v7Hxj51x1MDAxYjvf2PnGzjd2vrHza+zMPOq53DY1eKF9TOs6TLOxKsp9eXl3sVjaRfr/2HuPnkm5bU1w3r+idKeUhIegWj1cdTAwMDCCIPDezvDem1x1MDAwMEr935vI79Yt98U5Z1KzTlx0KfPNINjsvdZj1trwUnhcdTAwMDJHXHUwMDAwmoDAXHUwMDA3XHUwMDAzaVx1MDAxMP6fvqtQniBLXHUwMDE3fP/v/Vx0kzYyXHUwMDFhtN9cdTAwMTGKXCJcdTAwMTDlt29cIo+p6X1yXHUwMDFif7VcdTAwMDXLzIX07lG3R8hcdTAwMTj5VmB2dUzzXHUwMDEzp1NcdTAwMWNpkkP57/7xZXznycVm/P2tLaGFpNP5+JjNXHUwMDA0zN8+jKb9k1r65+ehU59HJ/pcdTAwMTBFXFyUP7Img/WPJ1x1MDAwNSbKeySSPidh/Fx1MDAwMd5WPSPiNY1nXG5BXHUwMDBm6tP8z3V7bc1cdTAwMTF38OdZc9Djvjv6+15cdTAwMTNXMyWcXHJcdTAwMDTh//m3//x//ac/f/4tmbNozdJ/+y//XHQmcVxmQ1x1MDAxZVx1MDAwNERCJPlcdTAwMWb/30bLambrXFxl+//+qT9cdTAwMWb6f//67L9RXHUwMDE0XHRcdTAwMTFRkmBxlN1je0BcdEnBKY6jZFx1MDAwNuE4lKRUlDxinLq/5L/+t2/vqi6zzzG7f/ZvVVx1MDAxN1x1MDAxNVx1MDAxOTj2xX9cdTAwMWZcXPW94r/+xf9xXlx1MDAxYa2RY8rfk79//S//8dX/d1x1MDAxYy1cdTAwMTmB/efKZTTzXHUwMDAzSXzxTUpatZySc75BYFx1MDAxOfc/RZOlv8nBJFwi2TF/Js9XLVx1MDAxM1x1MDAxMuh5wZJvlVOgmT+9tuxFLruxPd6ue49cdTAwMTLuqM1NmvLDOo2xcYZXXHUwMDBiw8NcdTAwMTXzXHUwMDAyqHYzMFxuOp8t+Iy5pinH78WBw6NcdTAwMDchenElL3+K0fRLijU4SedGXHUwMDA21JxcdTAwMDM3uWJcdTAwMGacwpp8uExWt8RcdTAwMDXa5Iba/bC9tmdcdTAwMGKF99R2yZdKzmq3b1xuXHReQG7amr+rW3/53dqFJNjtlJ1cYvm32cf906NcdTAwMTBcdTAwMGKRtzWk4M37nv/5UXCiXHUwMDE4MN+wq/7JMXNmIbLK03ZuzOW+deJ/eFx1MDAxNOKT44t/YchCpdKC2cRSbXL/dFx1MDAxMPchXHUwMDE4XHJcXNDfXss/Pjhmue+rXHQgTS3/lbm7P7tcdTAwMTjhvzJplfChS95cXCeVNthcdTAwMWJcdTAwMWH+2VFWtvPP57eiXHL+w1x0Z1pcdTAwMWHD+c/n9z5cdTAwMDQr+vxcdTAwMGIhwTJcYl3Sllx1MDAxMvF8gTD/fCD3Z3lB/afze1x1MDAxZlx1MDAwN1x1MDAxN9BGLSAwX1xi/8JAaKNcdTAwMTTnfyUohWfAcqJ0XGZO+PxcdTAwMTfml/3GMH3+/zH8fzyGt6ZcdEScJOf2SX2gJIeeL5mGXWnyX+7QKGs8Rmq+eCuIoWo2k1xiXGKQ8asn1zf1tlx1MDAwNjR/+JjirKBccrq9qr4oXHUwMDA0fFx1MDAxMMXoRKHm7YhcdTAwMTirXHUwMDFhtZA6XGZcdTAwMDPRXG6MZFx1MDAxNCFI+uCeMIlBmt3gXHKEQ1x1MDAwNOP8g7liI9ZhhLFvXHUwMDExSM7uM1m/98GZTt1cdD35XHUwMDE2XFwly5raR8lCeuQsUTuglM1cdTAwMGKZJ2dcdTAwMGJoXFy29yqm1ox9XHUwMDFjyHhW8pOHqzMhZlx1MDAxYVDkqdre+yq1NiqHiFx1MDAwNJ45nKJ8Kt439dBjXG6rnSA36/2ePEpnXHUwMDA2sbeKgKkrUYFHWCaAjl645nswekisXVx0XHUwMDA07Fx1MDAxOctEYKrYXHLpPWrp4Onk9z1cdFxmSJesdfNeyZbMwH1/p/hG5MBcdTAwMDbkni1cdTAwMDcuXGZb826sS6S4XHUwMDE2XHUwMDFlXHUwMDFlXHUwMDFh30rmsFx1MDAxYqJcdTAwMTHB7W5cdTAwMTTJp32NfahswbX4hpQ6uYns/sbhI4F32T0lgNvedFx1MDAwNjzW67Lx5H36+kXl+Ftg4aPAuFx1MDAxZsHA0HvR0pZcdTAwMTaSec1cdTAwMTNccl0sXHUwMDFhXGJ69JEs/POS2lx1MDAwMevWXHUwMDE0n9tmfSOzbIqSsfJnXHUwMDA3w6919ub1XHUwMDEzRsbwWN9jdy9pqGmE21x1MDAxYs320LLE317iU3eWXHUwMDE2zTjUXHUwMDBmgVxuaUM+JKj1ZZ3+XHUwMDAxfFwi+VVTldnuOox0Otzlo22A1IlGXG6ZblcwfbBIdLjfuaGK/FxymWdsayxYmXzAm82oz1xu1Fx1MDAwMFx1MDAwZojCPd1jXHUwMDAzkni3j1acXHUwMDFhS5fbXFwo11x1MDAxN773XHUwMDE0KFx1MDAxMFx1MDAwNHs2yjnVb1tcdNVMp46cXHQ9O7bmqVx1MDAxOeNUhM5cdTAwMGYqVFe69GJcdTAwMTdtZF+A1OPy8IWBwIVq3r8xTGJcdTAwMTSaXHUwMDEzLd50JHy45/TCtCdNXHUwMDAwXHUwMDEwhmOjXHUwMDE0XHUwMDFlvtw2b65cdTAwMTVcYjwwqjjMuFx1MDAxZW9FdV+JXHUwMDEwXHUwMDBiecs4odWxS1+pd0vTfSg+n0tcdTAwMDZll1x1MDAwMGrk7qvcol9cdTAwMGbQJ6tcZlx1MDAwNlx1MDAxYbX5JMKbXHUwMDA0QWlcbsAuSuFK/sn5rMF8boDqu8BcZlx1MDAwZcbankFFXHUwMDA269udMOJZIbl2XHUwMDAy+utxLlx1MDAxM5dsXmpNVXY4YWY+VXQ6g6RGlnjVhs1So01JYmtcdTAwMGbehye1OXopqHpnI6TpXGbKXHUwMDAyJFx0t2hAVlxi5br/XGLPhP5G91x1MDAxYlx1MDAxZlx1MDAwNKihLWZcdTAwMWToXHUwMDA1clx1MDAxNUFcdLC1I+J55lJA5GW078xS2TaeeClcdTAwMGZcdTAwMTVcdTAwMTauKoCwjlxmanAzKVxcgFD0kq09w6O3hFx1MDAxMGlcdTAwMDIqqPJcdTAwMDE7zWNkg3qQmabW2lx1MDAxM7st209cdTAwMWWoxORcdTAwMDZL67Grr8ik7SVWc4/1QWDwiTophbE7M5LxTLShxOGTXHUwMDA1r2Tl/Dk4XHUwMDE2glx1MDAwYktcdTAwMTGXjCbAuDiHXHUwMDA15U5cYqFSKNjuXqBlXHUwMDEzUWi5NmPpg1x1MDAwNfU4kfY7iGydv1x1MDAwM3l3LDE7VWPQTobxm6C24svVolx1MDAxOIoxrWVZooCWTKO3fZFVzj4796xcdTAwMTbFXHUwMDE4QlxiXHUwMDBmjadh2dEuVo5wqulnOfVI2V712yhDL7btluHXLYu5VprhPIrwZNSC9kapXHLg64tcYlx1MDAxMHNh30byU1/UX+JRLsGU+PhZcCQ3i1x1MDAwZqxyZt2UTsZJLqfCSaVcdTAwMTU8LWrRcLJrXHUwMDA27ONN8WPE8XtjnqfUXHUwMDAym2vj9TpcdTAwMDVcdC6OquRUyFx1MDAxM+JPNVx1MDAwNudcdTAwMDBcXMDJ8XfJgpOHgpA7+Cz3M+MkIaax7Vx1MDAwNqmfXHUwMDE09/xcdTAwMThcdTAwMWaGhYrH2nKIUryhXHUwMDBl14RcdTAwMTf7wGbK9YFTvpVLuIBSJ01CvDRcdTAwMWX+oPrmalx1MDAxNtvW6tyokTt22lx1MDAwMGpcdTAwMTnmdsKCPt7Zv/Lclc6aRUGra3OE17izko03ZqJwfZJ6htjcoVxcrIc8VO7zk0y126DcWuFZJbBcZqmT6Wie9YjCMVx1MDAxNHFfz7ClomvEw3WXMF5NyG99zT55XHUwMDFieet+VL6WVjiKssWhXHUwMDEwMZ2YXGJM83Ftzlx01TDmQYdHwS1cdTAwMDSlcFx1MDAwZegssquH/4+4ReSgW7vJI+88Sd2wNT3PkyNcdTAwMDaDm6TxsFx1MDAwNcFcdTAwMWWv+I/98Zd6q+ogOc470HVCulx1MDAxMSc22l57XHUwMDE3T7O0j7BcdTAwMTmfmtFXjSpXWqw8xGt+SIKFXG666lx1MDAwNfvugTVRglVbOP9AtpR/cJl/Usnbkpjl+3xcdTAwMTTA7U+wo1x1MDAxNmJzicpROauxXHUwMDFk/NJRXHUwMDE3sdh57LDIuG5Te/OH4phb6yUtxoBzZ/Sdcelh0nNMM3aqysdcdTAwMWZR9IBcdTAwMDGfXmJcdTAwMTjNq75eprQ+SJdcdTAwMTBcdTAwMWbAQ/Z0/cgrqEndn/j8oocv/5bhvME06elcdTAwMWEv3Zpi40Lu1YxvzVFcdTAwMWPR0yS/XHTgbDVTJVx1MDAwNjelftLrlqyaXHJo0zX33kV1UZCsglxyLueZdi6hZOcso16soY9cdTAwMWU+r6w64fQwXGKm+LlUo1jQZZfJouTIPtqDXCKZJIpcXFbY4k7rW20utMLNkZnNsZIxr0NFM1x1MDAwNHRT2dVzP1x1MDAwNbVv8zBcdTAwMTbOqkMjvfOaiSx6bFx1MDAxNajBRXtzXHUwMDFmy5ZcdTAwMWXC07aGo0avsPMhcFx1MDAwMlx1MDAxMqArTLL1XHUwMDE0zviVXFw2e4/s1o+hXGJrmlxciMhn7ECccVx1MDAxZlx1MDAwM/Whkkv+fFx1MDAxOFu2msCTjFp8Kqt4ROCxoipyVFx1MDAxNDFcdTAwMDZcZs5cIiHOjiOraEKnyvJcdTAwMDRph2lcdTAwMDPWIVGYl5DZ6Zkmt1x1MDAxMtmumchvXFy+zTTLTUuRXHUwMDE28tufzZWwXHT5tWN72N6X/rxIYDKWxjLjnoLc8lxi7tl3QlwirMW5XHUwMDA0zS3kwlZ8pVx1MDAwMWypy+6S61x1MDAxNN7BXHUwMDAxXHUwMDEy9VxuLlqvLjH/mahykZ6B8FNcdTAwMDdcdTAwMWR/8DdcXD6znKGZXHUwMDEzp1x1MDAxM7K63J7HbLZcdTAwMTL5q0TC++Jy/taP1GpcdTAwMTejQ7Q8tFx1MDAxMcH2uSeqXGalZM6Rt/D3rUIrVVx1MDAxMPuG5k+TIVWgJ2TwZ0wydHsnrihpXVx1MDAxNddcdPMgbJkkK2WDPDLIXHJOXHUwMDE55SuLXHUwMDE2hojD1IVAtlx1MDAxZT6KXHUwMDA3XHUwMDA1nlx1MDAxZalIwvRhz7z9pFx1MDAxON9mP/bd6Fx1MDAwZiUsneslQKlcdTAwMTanPlh/1PVcdTAwMDL+kVx1MDAxN4i/5qUtwsbUPlx1MDAxN7YtfX9cdTAwMWRX6J64bW73nDejpkxZylx1MDAwYkOFXG57jFx1MDAxZVx1MDAxOVx1MDAxMjRcdTAwMGVcdTAwMTTcyjQ9XHUwMDAza1xiJVTt1Vx1MDAwNNTW0N14KC5qdZhCKJB4wUtcdTAwMGY22PiszezcXHUwMDBikbZcdTAwMTc+JYpcdTAwMGZcdTAwMWbnp1x1MDAxN1xyReNcdTAwMWKEvHhiM+pcdTAwMTJgvqOFc5tcdTAwMGVAT2U8XHUwMDE1j0+Nv29DxCurYI71W7JcdTAwMDSgTNOxJVpNS1xyODb7ifxQXHUwMDE0S1x1MDAwMm+OnJlcdTAwMWWIhlx1MDAwNlx1MDAxOLv1ckFcYnom4GZzM3XOXHUwMDA0a/zKTfG2wOxNJCtEp0vIm92471K2oMT9s1x1MDAwYppqXHUwMDA2h6VXpW4wv+b4q0O10Fx1MDAxNMoxf2CgQkl6JKq8OU+GMqsjXHUwMDBlvXilQKZ8XHUwMDEy8lx1MDAwMT7xNZd1XHUwMDE0XHUwMDFlYM1uQ1x0oGuaU/ifXFxnXHUwMDA1XGbLNUutXHUwMDE0wizXXHUwMDBmgEp9YNrn0kC55vWKxUpJvahcdTAwMThEWZlcdTAwMDRI8WLnU06x6HqHceeDRM1Pp9atXGY6wYxfYDf2oVxi4VV/xqWZnOFcdTAwMTH2O1x1MDAwM+Wr4ef1i+Bz++qnglxiZjvGS+/L76vY8Vx0xV3xhCpcdTAwMTFDRuhcIlx1MDAwMCWUN0p8ilNFptV9TMyRrv3cql5cdTAwMTNcIrYzQ8ooXHUwMDFkbH3ZWObIUti54pH/nHuOTlx1MDAxOFZpMInJljrj9rhcdTAwMDWAQONZP2TNT5yO2kOASNZAllm5XHUwMDFkJc8jI2++n3ryXGJLZp1V+4J493aeZr073SFOs0C91E9IvHhcdTAwMTb7sdh/hb7bRFx1MDAwMyNG6W3CXHUwMDE44LYl4Empn6Ou3PJTXGZkXGIhXHUwMDA0MTtp65EuXVx0V1fZ1sfycKSZM2VgoqJcdTAwMTBcYve6isW5XVxyPTIyZXBcdTAwMTNcdTAwMGbMJfN9ne7fl2Oalmb5O0VaOVwiUz+Wj2topa1nolfNmLLe9k5Ppm/n5pgtZJRbbFwi2erwglx1MDAwM1dcdTAwMDJVsajUNVx1MDAwMpxRa7KryUtcYldHu29cdTAwMDFnzkOmXHUwMDEw8Vx1MDAxMZfNWyFcdTAwMTaxpVx1MDAxMFx1MDAxMiNcdTAwMDR13IPclI9fmopcdTAwMTW64lx1MDAxNuSqxbGwXHJcdTAwMDIngINh/Vx1MDAwMj5cdTAwMTglMMfZflxc+87DWdjrKGrOXHUwMDA3cN2a9NTSZ8+/pWGfXHUwMDFhKN3LXHUwMDEyXG5cdFflgXtcdTAwMTnkpFx1MDAxN0mZXHUwMDFiqlx1MDAwMEbc/dXhaEGeiFx1MDAwZq83bn89oZbfIVx1MDAxYZe02CFxT67t6PFBhmxccqhcdTAwMDbvfY9cdTAwMGb8M0OZwlx1MDAxOD81ssSo3zJZdd5ip0r3XbuNpy+PmsC3j8eQUSgoiqL8SeD3PYdcdHreMVwib+/BJG3x8DojOf04XHUwMDFkNnFjXHUwMDExKijNtVx1MDAwYj3Tr8FcdTAwMThnWnUoKVx1MDAwZuet0ZX7flBcdTAwMTG0t+lDsTlcdTAwMWYpXHUwMDEwofpdqymEz7espJyO1+/4LqhcdTAwMWJcdTAwMTUjVOigUzJcbvVcdTAwMDeQLCcglpWxXGaqX1x1MDAxYyBswpu6r1inNnybpKdsif5cdTAwMWE2Jy/Lvb9qXHUwMDFklczl2E44XHUwMDA19/TLXHUwMDE1LunMiNNcdTAwMGLdXHUwMDAzXHUwMDA2YW++WjVu2OL1s1x1MDAxNLU35Te2erJVUtbo/f7d7/d57W3ue5O+KatcdTAwMTXNZkjaU9tyZVx1MDAxNNZ1t9EoSMV7XHUwMDFjsKl3c/fK3DHPuMCCXHUwMDE5uzn4tIFH6Vx1MDAxZYRcdTAwMTaxXCJcdTAwMWa9+v6ZXHUwMDFmq1x1MDAwM9q63ZmZ8rt081TuXFzuglwiy47tf8llUG1cXFx1MDAxM4RwXHUwMDE4fMtcdTAwMGY5ncTjXHKLuPUnl19DyjC+XHUwMDFkKchwXTdRoGXKXHUwMDAz6Vx1MDAwYiV39D08cv6Y4lx1MDAxM+AvuvspPlnaNG7o3JZKoV9b2MHmfcm3LzuEQCFcYlx1MDAwMUzw+X678lxyykH6XCJlRX9YXHUwMDFlXGZQU49cdTAwMDP5KFOT51pdd7iW+GxdXHUwMDE5r0RxlCud09ToQzR7RMba8JCD8rxkp2GNM1q2s96V87NWhFx1MDAxM1qPw3ez8ZTqz1JcdTAwMGLHOG5n53ifXHUwMDA3WVEje01Ct1wiXHUwMDE4n1x1MDAxYtPPXHUwMDAyZGF9Y0lWIO/sXHUwMDE3gpSv+EI/hZqD8KxQvrFcdTAwMTTCXHUwMDAx+1LSnKh3XHUwMDFhfnJiI1x1MDAxY/UqeT2gYUVcdTAwMDGlbWI+XHUwMDEx/as0XHUwMDAwQ43m/mQ37V5tonmElOX1QT5wXHUwMDFkXHUwMDFjWp1Q1yVcdD+F4dj9z3hcdTAwMWVcdTAwMTbS1dKZplRcdTAwMDBcdTAwMWLuvuePebyI6NMuiW/8Klx1MDAwM7NcZnTLXHUwMDE2S4i09VW4d1xcvG6CICZcdTAwMTT2z8FqiLZcdTAwMDWDslx1MDAxOVx1MDAxYqjm9VxieDzWsScp9Fx1MDAwM1x1MDAxOdnzUmTh5Gr48LPvi1x1MDAxZkJhTJCDt7IwsiRL2zjtOW5t4fqtYnRcdTAwMDePRn6dS/pcdTAwMDO0JSuXrFx1MDAxMs/NXHJC5IJ/O3NLXFwk/FXv72I6Yp9efmpcdTAwMWPP4m5x0bmdM446XHUwMDA0Zpma6dbmW0lIbmnQ+Vx1MDAxM+81ZlLaXG6oXT2JkuxcdTAwMDFmryrq/vIu75pBUUzohuBFKmnP3XdcdTAwMWQsWOOUsnlLdFx1MDAxM1xuiHJsSDmVViA+U9yWkPjW5lx1MDAxMHreVGxcXC9ulNxA4FTknX2kQv619qtxr/1LIdWs3/m3RqbbJ1xcXHUwMDAzmET3OKFcdTAwMDYqyXPfrWOlXHUwMDFjwOpcdTAwMTbewu49bcx3pT1NiKClm4NMXHUwMDFlblx1MDAxONn1XCKPwFC+1jtcZteAidI56dNjRVwiISPxXHUwMDAxR0RVuaThujXV1u5cImZcdTAwMDZOdNQw3fycu+ivufO6pCx0PNxcdTAwMTHZQ2ZcdTAwMDJ4TClcbnf3vLmxzlN7XHUwMDBmXHUwMDFlXHUwMDBiXHUwMDEwdmJcdTAwMTVUx5wvZrp65KxcdTAwMGaDXHUwMDBmnsRcdTAwMTNcdTAwMTZcdTAwMTAnXFwwleonXkEmcUVcblRcdTAwMWbLlUGWlVaTXHUwMDAxqaKr3mrZMjKzheV8z8uHrFFcdTAwMDJK9MuTXG6UXHUwMDFm4pWl/T91LUJcdTAwMWP8My7YjExcdTAwMDe6UVdx3U6ym71w4f2+x6FcdTAwMDchPchxYVX2XHUwMDA1XHUwMDAwJEDn3FSiYlx1MDAwNCedXHUwMDAwN9bUqn7ZXHUwMDE5jXlcdTAwMTWeOGmIVVx0RVx1MDAxNZrtXHUwMDFjul2rmTFcdTAwMDZffkQvP01cdTAwMGJWXHUwMDA1X/uPPszb9z1mP9+rMzLL58xcdTAwMTVcdTAwMThcdTAwMWNcdTAwMTSI6Lz9UI28JrCzdMt7dz9Krl1j0qlFJvXPPXOlLFx1MDAwN7Mpss6BY3CqZ7qky3TQk5ZBIfvdJYL0U9VcdTAwMTm9nYm4IYZs4Mf5nsxbXHUwMDE3yHu4mG6amsSrg1+RWXswKjPVjN/MpnHLaX5ueUY7P8xcdTAwMTYjfrmUhW6/x6Jdvq0wXHUwMDAwYmdcXLbhXG5cdTAwMTR1jM7V2rl1gKi2V0I6XHUwMDE2yaWM4LlfNfH2KVx1MDAwZvTC8EZ8qW+gKJLGiFx1MDAxZDJxRUlB0nNFyptPwlx1MDAxYaNcdTAwMTRUjz9Utr0/bTlFgvRcdTAwMTO2ueKPXHUwMDA3cjlcXFx1MDAwNupcdTAwMTVcdTAwMDZ5P7ZhXGJaNJZEXHUwMDFk0VIjaVx1MDAxNeKNa3yLcnyAN5I6211dJtc/mGKLvW3hfrosdDmGXHUwMDE04N3Op8tcdIK0021mXHTPbKLbUK2855m9qEq1KeqD2ZfLeGv6JlqJjkFjXCLCnTe6P2n4XCJcdTAwMDFflee3hjx/NvZcdTAwMTiDXHUwMDEzWKtcdTAwMWVeXHUwMDEzrXVQ6Vx1MDAwMuRcdTAwMWN/Nvy9QFaqrltD8CTfTvFcdTAwMGXIZFx1MDAwZoKG6PW0dlx0p9OjI/FcdTAwMDRcdTAwMDFcdTAwMTdcXFx1MDAxZad1XHUwMDAzpKLa7W1V+O/YuPB2qvh5Q+JcdTAwMDe0XGbkktGDjLy2dzmSYdqRXCJcdTAwMGXt5Fx1MDAxYz3PNZuntFx1MDAwZrxy7981mCr+XHUwMDA25W21ZWdcdTAwMDVFXHUwMDFlXHUwMDAwXHQnapv3lmRxV4i2e7rrfmqONa95tu0gmMQzSVx1MDAxMsSYW8VaadxcdTAwMDRZXHUwMDE4uVXgVnK3r7w1XHUwMDBiOJI58oKx91iRMVx1MDAxN/K237ysOtbdVqS1iVRcdTAwMGah9dCo9uYwhFx1MDAwNmLHo1xcpZopXGKjqVx1MDAwNm9cdTAwMWRKJPXmwFHcx1x1MDAxMP350SN8XHUwMDE531x1MDAxZWGJVYdcdTAwMTZaXHUwMDBiQvbT6VTDXHUwMDFhXHUwMDA1XHUwMDEwZpV96DybsVx1MDAxYXDoikVcdTAwMWMrXVx1MDAxNFx1MDAxYy5cdTAwMGa/vDPe1u1m+Ze5TbI6Qo263JpHTJl35zXY2bu3xJtz1+FfRF5lws3mqvNxylx1MDAxZr4nLlx1MDAwNIOredNcdTAwMWXfZFrHbZRpYG4uNXZAXHUwMDE3vaKjNPbmLE1AXHUwMDAy735ztZ0//PFG9KRmOy7AkYhcdTAwMGUna1XgKJmNXHUwMDAz48Rw67BcdTAwMTfnzNb3JVxcXHUwMDFjSUBcdTAwMDQpbH3YzbJgiXlccttcdTAwMGbUqei6w7bUNeR47XVcYlJM41x1MDAxN9bo9FdcdTAwMWZwRc6oQ6jWWVxmcrtcdTAwMWaR/OToJMqVISxSx/UgdTlcdTAwMDdoXHUwMDEyI/lE4c9cdTAwMDfyoFx1MDAxMp1cdTAwMDNYnFxc3/2MKasoayQzPLCg0lb9vU6jUi2YXHUwMDE2yq+h+czDeGN61Vx1MDAxZFx1MDAwZVx1MDAxMk2rnHFpWZ9S682gnqdcdTAwMTlcdTAwMTB8y6PJgb7GgS5+rKOS3LlhXrrcmk9cdTAwMGbFKmrzZbj4bNxcbmdcdTAwMDRaz31cdTAwMWSZVlCzYYdcdTAwMTJlXHUwMDBlYJpk78fs3mvjRTjQe+GWxyHQSyY0P/Dy3Y/wTEXklXl0SMS8bs+weDblnp6WpWAvTkdfb3O+v+yNYSBcdTAwMTje/lx1MDAxZVx1MDAwYvhji9l55Fx1MDAxM1x1MDAxYvpdhFx1MDAxM5pvXHUwMDBmIFxuK6XO3Vx1MDAwZVxi0jyKZlx1MDAwZrp5LVx1MDAxZMTXeVx1MDAwNSNcdTAwMDbH13m21nRR0qVgpC95cPNWs1x1MDAxYnpcdFx1MDAwM8NcdTAwMWYjkbZcdTAwMTaa6XP3jq57xfFkoi7gprjQsu1BmDl1XHUwMDA0zPLWXHUwMDEzYLEkfHJDP4fNV+JrcG6r17lTeNGjsXtRXHUwMDFm7PPgV0b9mc9fxc/yY0l3L5S2l+TQSan1e1SxhPAmXHUwMDFiTpbrT6nKJUPPc6xcdTAwMWLnXHUwMDFjpFx1MDAxZVx1MDAxN/OSOlgnUadhxjhcdTAwMDNy2tprtfVcdTAwMWKHOuGA4mp71/zLm+dcdTAwMTmc7u9cdTAwMWF9f1x1MDAxZODHT00/cFxubbTS21v4fbFcdTAwMTTWQlHqhSWtXHUwMDAwudmdraaJhumuXHRp5IRbT3R4JD0j7aVdXHUwMDE0lD1e7pqvWvtcdTAwMDYtp1x1MDAxM8jl4XthO/I1XHUwMDEzdbGTTo94paqsXHUwMDBmN5LMXjOMXHUwMDAxTZYjdfyz//8s2lx1MDAwZsuNL6qSOMrzdZJcIlx1MDAxZbv76Fx1MDAwN5PtWpaj8lx1MDAxN1Y9ZYqNoMhAS1LWdX+vZfpcdTAwMDKhqmVcdTAwMDSgxlCnj1x1MDAxMLFcdTAwMDadhulDmHTV7bGo6TxrnXBpYyhf78CxLVx1MDAxYnq7jsgn7Z1cdTAwMTlcdTAwMGbV2jLQfKMgRcl5tVx1MDAxOMpPvZRZwlcv9UhwjDK7IGjdmmqz9Y9wkG0ojlx1MDAwMNJcdTAwMWVjP1x1MDAwNeLGn4SHqVx1MDAwMbqIQFx1MDAxZa/pUVxyXHSnXHUwMDEySitnl2wn9W+jPbqX6k9hM4rps1x1MDAxM1qAuv1ShXmrJKlIcFx1MDAxOcng71x1MDAxMPyGhZjR7eWD/qyrXHUwMDFk37Wrheya2+lIsClcdTAwMGVHXiNWiFx1MDAwMtgmPFx1MDAxYkTG6USHmmE1XG645j7CaSo7+Eknz8PKw6EsXHUwMDAxj26Z2yHuUFavWpzKxyyUoTHzXHUwMDFmpV+CljfXwVrI8bPDRp8ms/v53Nz5o/9WXHTOnXfG0um6W3GlMDXhe7r9UtnkUiHSyV81t2eu133cZV5wa2hcdTAwMWRcbu+LZI1SPUBjXHUwMDAxM1IkXHUwMDAwXHUwMDBiXFy7XGK4/f1ccsFJQqZ2kKCPSzvX41x1MDAxOUGrNlx1MDAwM1x1MDAxMVx1MDAxY+5XmtqMpDA/6lxcg1JwwmnJ+r7FgU1e1dVcdTAwMDNzy63vtH1k63BCxJUpUFxykTqZP2h8TOvMO8MsvynzaVxmy22Hk5BcdTAwMTMqKITCMLzzXHUwMDFiyiXpUtPbWJ9cdTAwMWVxc1dju1x1MDAwM0GcuT8zhFx1MDAxY9p8zf3sbX03eLJcXEifxoNcbjhcdTAwMGKqeNFS4sdcdTAwMTBGsWc7ilxiXHUwMDEwXHUwMDBmVOn3+q0+VVxuPDP0TemZ+25Zr7F5aV1uL7qrXHUwMDE3uVx1MDAxNvYlopqokF79vKNpumWPXHUwMDA0oLauVSVJ4mdcdTAwMDCPe5FcdTAwMWLqz3rQ/9Bj4yGDYFwia6q/dX+4qngsRKxcdTAwMTmndjBZMtB1YZBy2vmQKeBcdTAwMTOdyHohmMU6LVx1MDAwNUVBToVZUGvnmSjVcLlcdTAwMDSO6ltHnMFhrd5MztRcdTAwMDT77ejn4PD6/Cpk1Ni3XHUwMDE0TIRJcI6Ky6NcdOXZsSpcdTAwMDZ48WLukeVx5I/0wnud393qI1x1MDAwN67tlkuYXHUwMDA3z+ZcdTAwMTNcdTAwMDaJPWityi7DXHUwMDAz71x1MDAwMUhU+FxyWVx1MDAwMqWJXHUwMDFmXHUwMDBlp3bhXHUwMDBiILXnrfQppbR6bFszPVx1MDAxMa00oVx1MDAxZTBp9GX/0LD42Fx1MDAxZaWoqlx1MDAwNE6o+a8834qbi9+++Morolx1MDAxZFnFgFx1MDAwMmR8SWmtojhcdTAwMTDqmlW151x1MDAwM9Nuf1xugiq382B7XHUwMDBiXHUwMDEyXHUwMDBm8aWiLdtcdTAwMDTDb+86xZSOeCuZRf3nppZcdTAwMTRcdTAwMDbaXHLGLeGSb71301x1MDAxMJLvXHUwMDA0Ulx1MDAxMlSq47JFXHUwMDA11H3Jn/tK9m9fa1x1MDAxZt8lPXdGy/lUZvanUKnxmFx1MDAxZJeopUhcXJePpJfOto6JXHUwMDBmXGYm+3w0UItcdTAwMDK3PoKGXG6WLe/iPKqllFYy61xmSYyP2Eqi1D9q5e1xW7l7h7tcIlx1MDAxZFx0X1x1MDAxZFx1MDAxN6rzlu3G+5eXlb5ccsCI5li0omTLlMv1XHUwMDFkLFx1MDAwYlxuJFx1MDAxZeS3RWSnplx1MDAxY1QvtkvTXHUwMDE1XHTIXHK5TcNGmiPtTMJqXbL1XGKyatbs8CSq9WX2Ia3wINdIZ0FT4ZNp/lx1MDAxNliSXHUwMDA2+/Y/e+64Xlx1MDAwZsW8Q1x1MDAxMea1XHUwMDEy522niMytu/mFisGBXHUwMDFijkmN8T+1XHUwMDE1+Fx1MDAxM2lveiGuuTmYXHUwMDE1qUVLWOxHrKqIyOuXScZcdTAwMTRywDKi6fVSJbXuqb1MTynBVSRflFwiai9cdTAwMGX8a0+NZLlf/X2b5u7I0Yp9tJ9cdTAwMTWZUM62X/B2JGRiizJK6IXVfzeQXHUwMDE3NNdyhmtj82xcdTAwMTWe/8YpXHUwMDAy2GEg91IwefOx3968m9/Sn8xcdTAwMTJifT5cdTAwMDHxXHUwMDE23lx1MDAwZvy1PdZIqMNU8m4r6U9cdTAwMDCnnLGdUFrx/tVokr76kdNcdTAwMTlPOiTkXlwir2xHjoxcdTAwMDQgqatcdTAwMWNE4uFMOnGLLHEnXHUwMDAxXHUwMDBiwcDxzlW9ZLNaNfzYw0O4vFFRXHKbs+VcdTAwMTWff3tcdTAwMWLlR1x1MDAxMC5cIlxcuYfaLoVcdTAwMDdcdTAwMTe3l1Lw2Yxr9VOr136h1nR6NdxFxE1O/sqlwNTohj7jiH5PxOFZytA3ZSRcdTAwMTF2uqyVO6y8XHUwMDE4wkeegCDxkpvFeOjPW0XB7fFwdFx1MDAwZtRO8z3wzW44uFD2XCLnoUzoWdeOk4LJJGJ8XHUwMDFiXHUwMDE43KSxgVxmlmSWXdy0ZUveZE5cdTAwMTRFdINcdTAwMDf+l1x1MDAxZqGH7z5E01FgvHexklx1MDAwZlx1MDAwMSXmWXgln1x1MDAxYXzo6bag0VTCXHUwMDEzV26hpS3BkYdS8IjRxLHi5aOGq/JcdTAwMGXAtsLotLuKq0tOrspv7e2iip5FWJWKkfZBw1x1MDAxMT6xIdTos0ameCVcdTAwMGKAXHUwMDBiXHUwMDE1LJ+YXCL724li/tprQFtcdEWINHlb5o5P++nbsl6jXHUwMDBlXHUwMDBm83RcdTAwMDO06mkkeUWBky3PVG1cdTAwMTBwtlP1vPtVWWyQlj5uSYrjU3ykjbLKNVx1MDAxOV6slYzCPfKmqTW2Vke8xTnE/5TijibjOfyov0hW+sdjdslQ5nB9J5z4XHUwMDEx4VO9lfiitC9cdTAwMDS8XHUwMDEyUCRwvoZau2rxT+mQ8vm8XHUwMDFlcMqLlZqmzaNDZuOKhiTgo6ZcdTAwMTXwhnctXHUwMDBi4UPRXHUwMDE2O9i9XHUwMDA2yIlXvYtavCd6p1x1MDAxNmB47lA3fpzCKVimXHIwXGbXQj9cdTAwMDTzPbBbSyilXHUwMDA0XHUwMDA0r2tlm+pcdTAwMThrXHUwMDE3+8pePSB6xlx1MDAxOVlzXHUwMDBlxkVyXHUwMDFh9ZZcdTAwMTSB0lx1MDAwMbFcYsPAgfhpXHUwMDEz8tq6jSq53tL6aVVyNDRqTyBRnlxmXHUwMDFhXHUwMDAwX1x1MDAwMqGWo0yp3ondiOFjXGJcdTAwMDXBoX3rUXWq6e8rZv6+oXd+eVWp16tccqdcZig9y0lKQf2cT6haO1x1MDAxMpynMdS+W1xiP4JcdTAwMDWRIFx1MDAxNTx9MCNAK+5CXCLTXHRcdTAwMDKPc1x1MDAxZW9USViVXHUwMDFiXHUwMDBmw+zNanZqrZtcdTAwMDdK13DWSilcdTAwMWNcdTAwMTh2tVh/RVx1MDAwZlx1MDAxZUlwbompWGjjKbpcdTAwMDXA9mqEk5SX6JZcdTAwMTZ/v5as+e2rnITZXHUwMDBigb5ugtXJ9W7MXHUwMDAy3ko3qctL21x1MDAwMqE2wYRcdTAwMDPwa+CSIW81wFwim1x1MDAwM5BGXHUwMDBiqvdcdTAwMWRcdTAwMTHdMFecTf1izZTrWpFLoDRcdTAwMTZzQotcdTAwMGYpQOna0u9YY9pcdTAwMGJcdTAwMGJZi1x1MDAwZj9G0mzFjy01LN3S93SagcGihlx1MDAxOd26XHUwMDE1vs91P66EZ1x1MDAwYqhcXMrpn5rti7dzXHUwMDE2N0Q4pVx1MDAxN1XCXHUwMDAxavK2iIhcdTAwMGZXkZKcXHUwMDBmXHUwMDFi+M6LRT6pvlx1MDAwNlx1MDAwMyS2gDfajVx1MDAwZrOJiGnV86mCvHWde7O4XHUwMDAxlP+sXHUwMDExZFxuWNkov/bPqX/tn4shs+aDzyo2qK01vFx1MDAwMfPO2IScXHUwMDAyPVx1MDAxY8+UJGlVWzB2iFx1MDAxZYrDrXxQQI7WK4x+bnlcdTAwMDKW1/wmoyZk9Hf/JoJg8Z45XHUwMDBl5H5cYnhRy9nd5lx1MDAwN0BoY2mHw62XXlx1MDAxZk1Wu8dcdTAwMTBMXHUwMDFhIz7VqTyUPz22WyfzXHUwMDFmrl2gaqlvr/S8JeLH4Vx1MDAxNPtcdTAwMTeuLqZEN8LHTS8saj69OPJuI1Cu0lwi92JcdTAwMDIjefYodeGp8sB8T1aNNbqAWe2XRsjIuFx1MDAxMIHGLD/3dTXovFxyQ0aMXHUwMDE3W91AQaJp412gXT1N+8Du1dnn11x1MDAxZDvvXHUwMDA3pda08Ktv9/zWXHUwMDFhp1x1MDAwN4fSIW+4YmQ+XHUwMDEzvfVJXHUwMDAzb4EuK4FCaf1cdTAwMDflQ7exbkhoi1NcdTAwMWStsNM4kbhcdTAwMTm5q13IsqY6p3HO57TkwodcIiivUN93uMIxcs/1Tc3w9OpCXHUwMDFlRC+v2uG8JcA4es8wXHUwMDA0YvvKXHUwMDFmhvPT1zYv4cZ5YezDXHUwMDAySs/FXHUwMDExwta9PUhcdTAwMWRxyzJcXDHIcvnx6kf0yWd6ePiiRYeOZ5jj585+SVx1MDAwZZ7srnt7+rDwg7VcIlx1MDAxZouG7qeHJr7b6tKocEFmypqXpdW9cUNcdTAwMWS+j37ajS/aULNUfr+6cYNcdTAwMWSymyrw4M2mPVx1MDAxNlx1MDAwNacugblzbjlZLEXGSEFG9IRqcj+5hlx1MDAwNUn6yFx1MDAxOeZvOUz4q1x1MDAxNqNJrfnEmlZUlU14+KxSXGYh4vlI1lx1MDAxOHl+bKjDhaf5WvtcdTAwMTLNXGYyu5xcdTAwMDSm25C1SXuTpUuk7zXeVlx1MDAwMyp50DGf4K++ds/Z3734XHUwMDFkWmjItnjN9Fx1MDAxNm7jOHDYzr2WK1x1MDAxM59x2r19rTaN2zM2XHUwMDFkUVFfPpxcdTAwMDND7d9+6rZU0qgzOsNP/Fx0LULY1C1cdTAwMTZ3gvArtt/Gn30r6l50WPn1SK2wiaJmNDe9rGNkXFycyJMue9XTLlx1MDAxY8uzN4epNlx1MDAwMWhFJ8FynJSnJlx1MDAxY1x1MDAxZa/EaGYsd+LfPTn8r75cZmB4/XKzrCAtq3CQ92xs4nvVXFzW3Fx1MDAwNyN2O6tJiM9neVx1MDAxMOTU+3tePO/12YhejayoU0qRUbBDMfKf/bTyj2SWXHUwMDE0jvW7h2xcdTAwMDX3ebj1flx1MDAwZp2yMohF9t1cdTAwMWShvFfztTxcdTAwMGJHc+urgdvRIaY074RKkc3xXGKCkFx1MDAwNEL9a5HDacWGwmhl3FxutJ91XG7+r76OWTmjraKQeEaXdDLly0OEcI3XR1xcXHUwMDEyNvKsZftkNzPbrixVX7vrxlwiq69yw1xi49aPJUn8KtJwhnHzXXFKTLQ+PadcIoYlJdpcdTAwMTdLn0+ZurWQ3/PCjXoxtcz5s297JG1cdTAwMDFHSVx1MDAxNzfJum1cYlx1MDAxNW9cdTAwMDPh2HViRkFm1Fx1MDAxY+rOcVx1MDAwMiRsXHUwMDE3x1xmXHUwMDE3hjea0ovZt4RcdTAwMDXy316+cEqafYWN0GhcdF5KN4eUvNV5jn6uyFJccqj7KYX2vdS12bw/cdREizVk21pVXHUwMDE0dHhtp3WZvawh+u7uXHUwMDBi8VZgn6TD/Ni30jDfZ1vEsVx1MDAwYlx1MDAxYYVylEnkvvs3ef5S35JQPuIliC1T6Vx1MDAxZfTa+Y1cdTAwMDFDdI+tXHUwMDEzL2mwrD218LqBM9b5XHUwMDE2XHUwMDFkektcdTAwMDfQnt1cdTAwMTL6TFx1MDAwZS5cIpyXXHUwMDE0OuFcblx1MDAwN8hTTocgq7di+kWYXFxxg6t1U59mdFx1MDAwMmNZ3e3ZObepqtDiauHQVt5BKlx1MDAwNzVOrvCdpVx1MDAxNtZG7vTuuWSE2EHpku19TLFcIv77eVx1MDAxMZH2v/4yXHUwMDBie5FXslKo7Fx1MDAxMFx1MDAxZIb9/VR2XHUwMDAxRYR1uSRLXHUwMDAybldOYCTvOzeE7aWt9F6cRbo8oVx07qGzfmZffHhkPD/+2k/BXHUwMDBi5Xd/OFx1MDAwYoRcdTAwMGY1XHUwMDEx3Kbt1YlFRKBbMU1cdTAwMDMzfMVEKrOf3PelbzZ5XHTI4Tbrd3HxW32MsLaj0FM6ZlTt7Ma9XHUwMDEwOUYlXHUwMDBll6zlIzplZCxcdTAwMDNcdTAwMWHIi7wk95pcdTAwMDL9+FxinsaP+lx1MDAwM8t9seW1XHUwMDE3zaf0TO9bz3U4p0bWT7TUec9cdTAwMDJpclx1MDAwNUSJLYTtciFS23ySnOqrZkrjXHUwMDE1eGtcXFxucVxiNmJQPq6m5WJjlVHsU/i/973R35pcdTAwMTgvnugo74lwXHUwMDA233rOnVx1MDAwYlx1MDAxZVx1MDAxYVx1MDAwZVx1MDAwN1xujydcdTAwMTiVT+l0PGS3X5pcdTAwMTZsJk+SzvUhLd9m8HZcdTAwMTSUvb9987tcXCpRVFx1MDAwMWx6Ub/69sufvn2orvRcdTAwMTPOXHUwMDAys7k9hCVLL8J0ryPkTbvfRcSnXHUwMDE3ru+reG1ziVmIQVx1MDAwZbYk5oBcdTAwMDSUjlx1MDAxNz4hPpbclNBcdTAwMTe3xN4/juL8/X5cdTAwMWSJKb58x15xed9cdTAwMGUqW5bpxFx1MDAxYtOQvboxeoZw8Vx1MDAwNty8ZmiJ5yxcdTAwMGZccu/pSkBRyXqlR6jam/R+Z3pSyY/BMp6aNpb2+GvvqmXS361jyHVrd0BcdTAwMTWsxnVcdTAwMWaVy55cdTAwMTX7PG9cdTAwMWKpLWiyZMp+rVs8mY2NvzpodHw8M+yXyGdN0Df4ud68d7NErlx1MDAxNuBcdTAwMDKaQfs4VNHLeKKh6vFcXFx1MDAxN06+Jca1or3Mc1xyQMHPo1U94TFZXHUwMDFjzFbUX3VrqsF1no6HX/tL/13YMobJ9oad0Kv43X8tJFx1MDAwMXuOJFx1MDAxN0a2TC5dXHUwMDA1tkNZ9VigxW1oMqN6rHT8x1x1MDAxZpEwsNY9XHUwMDA1WTZcdTAwMDGFmXlxONJOYzORsdSF2qLBXHUwMDAwku/N2axUXHUwMDFlj7CKM3e+0tGPXHUwMDFlZt3U33qjineqXHUwMDEwXHUwMDFm6z1nb4r32tsgqVxmXHIms0AqpO4z2fhcdTAwMDYtz7vXbT6B11x1MDAwMieEXzPWdjj0iWjwc6NcdTAwMTLNu2Q5lMxUwMzmST/g20j8Kj/M31x1MDAxZa/3fvfD9YotRvbbXHJFJlpcXGbcffW3+1x1MDAxNFx1MDAwZfRCdKW2V9qqvVK279xSgjIza6k4yehaKeSj0ZPzOv1Jfr6Z1W6FYFUona7F/PlBXHUwMDE1Y/j71pnAaX89rFx1MDAxOOeMWN6xXCKEiMtcdTAwMTioPsJcdTAwMTdcdTAwMDY5p1Pe81x1MDAxYTlNgtO8KkGAta+EfGRMf2vOTIQhno9xuTP3bHVI6lx1MDAxMKib1lx1MDAxYd2mKkV4/cJMyUruxO5P1lx1MDAxOWtcbp24kKZDJC1cctlAPOzw6Ppte+ZnOKNlqVx1MDAwNFx1MDAxONFcXFx1MDAxMEwsrWUt21x1MDAxMm3TOKGJuOyispDJPoygXHUwMDAwftX+XCJGo1x1MDAxYtXkXeojf1x1MDAwZc2ybl/ZXHUwMDFlbc1U1/lEXk1Vm7vEi/JcdTAwMTNcZrbngMOpXHUwMDFmXHUwMDE0t/2Js+dG+jdOPdxcdTAwMTDpscNcdCVdcjeoXGLqpedjj3x9XGIufPP5clx1MDAxNH9PXGaaXHUwMDE1fv1/3yXoML9ulrVcdTAwMTBTmZhaNzHtkWFK6lbnLYsgiFx1MDAwMlK+dSqfhIRTw0NcdTAwMTFy+05cdCPjoXOhYOrJd07+XHUwMDFlh1xyXrj1q2FcdTAwMWI4mJbrX3Vvl53aI21SIy6oXHUwMDFlX/GPMaFHV05cbnYyy+eYcvtcdTAwMTTNJ2WeTSXOm5XrxLBCJHpccuToeqdXp9PapfBtiL16YyhD+uX53l9BltnBgDhGJd6I6FPIeSVcdTAwMTOcSvlq7iubZYq4vnS4uzFcdTAwMTR9Ss86XFyN1nKb9EN4YV9u1MQ3wlx1MDAwNavNq/5cdTAwMTUjisl+/Vx1MDAxOaN826m2YTzuOFa/Xp5cdTAwMTJcdTAwMGbIqNpA11xim89cdTAwMWR3vFxyevlcdTAwMTFO2070rHj+SrDuW99TtKaKR1pQXHUwMDFjXHUwMDBlaVx1MDAwNEtpRb2Yp429vVx1MDAxY1x1MDAxMrJcdTAwMDfaXHUwMDExXHUwMDFmRvqkvjeYNNwhXHUwMDBleuSDt/ygJlx1MDAxOfg+g3lbNF6C6Jtcco3ImOVcbpnl9N3471p3eFmfXHUwMDE1bcOsOFx1MDAxZuM1ccNcdTAwMDPUgkNcYnpcdTAwMDFBXHUwMDEyTpTCXUWN6Fffw+D+7HN+XHUwMDFl9MDSPNLoRinAblx1MDAxM1xcK75C9ER0pFx1MDAxZM/GXHUwMDBli0fEemdcdTAwMTJVjlx1MDAwNcsuv/NcdTAwMGW8jp85Vl2kPkR2qWhUXHUwMDEyXHUwMDAy8YdcdTAwMTasvlpwUHreXHUwMDExVnV4pUI1ysFcIlx1MDAxZGF5UDb7ibzGXCLrM1x1MDAxYybf7MOX2D1cdTAwMTBcdTAwMDe4buVLPu/zSH3xhs//8qyUSvfLm6SA5eX7fdue2fe9ru/rXHUwMDAxqk/Ym2FB2U6qyrhdxIxkYEr+dbORxLSe6z9cdTAwMTUmjuXYXHUwMDA39PPV6FRcbnq4bc3UXHUwMDFklSmAZbAytVmwnOicgTNcdTAwMTXNceRzsthjifS6MEStXHUwMDFkdKSO0S9cdTAwMWH6YDlGeHVapjiDIbywsrOhUEp511t5XHUwMDEzqCVcdTAwMGI91q03br5ziFx1MDAxNVx1MDAxZG6vNJf4/8bTXHUwMDAyI35eJ1x1MDAxY60uXHUwMDAz5ij1fUEphiBcdTAwMGW0KOPoLIJgZOHYd0XoNu9uXG7wljZIa2vlVpXTsuNcdTAwMWX22VIt8zzfpFx1MDAxYpFZ5kBDuu973+G4PnDUwFx1MDAxNbFhXHUwMDE2t/dBsLPQz3u1XHUwMDAzXmtcdTAwMThbvPXHkFx1MDAxY75fXHUwMDBmx+Iqe4Zu18Obydf2KcLVbVx1MDAxZoJl1Fv1+oNcdTAwMGJcdTAwMDaPiVx1MDAwMjN0K6zJxbd+xVjOR6lcdTAwMDVLdlx1MDAxM3mm8IB/XHUwMDE2fWhbK951QLpxjeQj4OXUb1nl8a6ViPy+nyFRPmTZk1x1MDAxNEHpOFx1MDAxMXRiLSPV0/BcdTAwMGZasG6VolQl49OP21x1MDAxM71cdTAwMGKW66+LutJneHFm58Vrw/BaXHS2Plx1MDAxN51vlqov+bJcdTAwMTWLa1x1MDAxNFR6XHUwMDBl4fLXM1x1MDAwM1x1MDAwZVxy2a+zgVxm7N+fxXrS4KRbXHUwMDEzXHUwMDAxXHUwMDAw2WpcdTAwMTeYxpIs+95cdTAwMTfrmnlF+dTLNGQvo7LYLlx1MDAxNVx1MDAwMlOBu1x0zvEzv1x1MDAwN3hcdTAwMTFUtOqwR3CCS1x1MDAwYpryxb9LXHUwMDFm3oNeVFx1MDAwM7dcdTAwMTVec2NB0kvUUptcdTAwMThXrqbZwV590lxynmtcdTAwMWNX/dlcdTAwMDNcXFx1MDAxN3xcdTAwMTWAXG40msVfz4I/abk7R2dGqT5HL2rptti817B+KiqmQJU53vJcZmmjXHUwMDE5jklcdTAwMTR+qbrt4Jq9xjRD26f11VZcdTAwMDNwVTXP3Fx1MDAwM6I9qODb8YWA1mw2STWQYSPut/ZEt3Djs3B9wlx1MDAwMJlcdTAwMTeWzP/ZXHUwMDFmcp9fPE1FqPgz26Nj/rPxhmDD4zjK5t1yU4tn7lx0WCZ7alx1MDAwZssoMEa8MFx1MDAwNjhcdTAwMGXJ2u71zHs8XHQ/VFx1MDAxNXrWf6vBOcHnzTxcdTAwMGLOa0RLqlQ3ZNUmXHUwMDE017NhXHJk59FoXoZSfL/exYdcdTAwMTZwXHUwMDAxoofufVx1MDAwN/U4dPK5psJ9LsdcdTAwMTZGwmpcdTAwMTnziPh9XHUwMDA073VcdTAwMDFcdTAwMGJYXCLQp62mXHUwMDFmTc0/klx1MDAwM9V33NjxU5Hv1Ui1blx1MDAwM1G/YFdaeEP3eti2euZcdTAwMDNnlJwx3Fwi7jY7/bWr0ZndcVx1MDAxMPLb8OkjwnRmrXWu8Wjcc5UqQKM+68o/7vHV5lx1MDAwYlVcXN5s8lx1MDAxMK5uP4S/Q3r81lRq7lx1MDAxNrqWolOVUO7vN0u4zFx1MDAxZm1LPHFUp4zJtVx066Wy4iiPWlx1MDAwZjfGtpu5r15cdFxm4ERcdTAwMTTF65B6wjncN2f82cPE6GiSPKg0V0H6YSRcbtV6fsuulEWUJkpR29ZcdTAwMWQhcJXEuNpYXGZcdTAwMGJcYjVso0VcdTAwMTJRXHUwMDE3blx1MDAxOeU6gIz5PY5Eyy6crd5SZIs0yLJycE5cdKOAo2SRg89cdTAwMWEqXHUwMDFjXHUwMDE2ysrzbcAjOm6h+Fx1MDAxNCw+U1x1MDAxZZ1cdTAwMDGkdZtcbk5cdTAwMGKCYVx1MDAwYo+v81hcdTAwMWZSXHUwMDAzYGl0XVx1MDAwZeGJIC5cdTAwMTNZ3XpJXHUwMDA0XCLgTi6pkGfPvI6UrlfAg/58fXXDVjemh8Rg3Fx1MDAxMaSZ1PctTrTxxF7uXHUwMDA0XHUwMDA3KbTmfnpcZiVOXHUwMDFmnJHEz/4lXHUwMDEzXHUwMDBmdKLAXHUwMDAx6vu+rmL0rYXPS4GcXHT7+pBcdTAwMGbgiu1cYoNcdTAwMDTGya/ik7nR5KEwdF6e71xiTeZJgPt8clx1MDAwM5VcdTAwMWaOdVx1MDAxZfw+MXQrxFx1MDAxMWlcdTAwMTNdpSCrd6hGQSck0WBNXHUwMDA2bvmax6Di5bRwg51WXHUwMDFk9VhdXHUwMDExym7r2lSIgcygXHUwMDFirrX8STVrelx1MDAxMSisy69Jfp27eqQg0aS36Vgs/fa4Pba2KHNn0FtTXHUwMDE0f55pl8FvfalCzCrkfVx1MDAxMoKAxOmqbvQkJ7psesuVY+wzXHUwMDFiXHUwMDFhhN7i0SlE7O60N+VcdTAwMDOA2IvaXXGlQ/W7l1ehyy9cdTAwMDacYsJcdTAwMGZcdTAwMWRXmdiH/+I9yFxiwbskN1x1MDAxZDg/XHUwMDFm6L62M/aIljJ43dhr+0CUMFx1MDAwM2NknIhZjVfkxkogRCDzIzA3itxST3if77+ey4vEV0FS+1x0pWzN6/KYXG5WP9ImXHUwMDFijJpKSG7jfNqRRS3tJfOHa4r7U6LqJdPSXHUwMDA0serbckWMLn1rg1x1MDAwZc6b/rt3+ZdzhJJcdTAwMTVcdTAwMThOWn13XHUwMDA2KVx1MDAxZLFcck/ZmkuRbXbPWFusKPf26Yw7qPf9gWSIMFx1MDAxNFx1MDAxN2ZcdTAwMDaxbDisTUtiqSrca6MvU6HfXHUwMDA15lxut1p+XHUwMDFirHRkuz/ioyvjKvtuXGYsLCkh9Vx1MDAxNGuQTOE2Mr1KZPtcZqK3YVwiXHUwMDAwnH5lr4pcdTAwMTMq8WaFxqaet9F9XHUwMDBiXHUwMDBm8ZG7J+ybTVx1MDAxZOpyW7GPettYav1YiVx1MDAxZKekXHUwMDA2XGaI8nytvFpHadXn4jLpgsZKm2rP3zqXx2XDh4N8SrSUulx1MDAwM9F2c/P15IqdQVx1MDAxYYuH22aUXHUwMDE2XHUwMDAy9lBcdTAwMWWNbyCcO71cdTAwMTFfy7fWwlx1MDAxNtRIkM6bjeDMholcdTAwMDeBPlwi80LPaVx1MDAxMVxc6ftGMIlcdTAwMTFplft025PdP/d9a9xlXHUwMDA20Jd+WHrKkmSZjY+R5CB383J/k85VSIsqilx1MDAxZlla9pzybfgkMjDf9keAkL2tcf78nbVyiumoXHUwMDFjsvdJXHUwMDA1Ylx1MDAwZeIkXHUwMDE4+lx1MDAxM1x1MDAxMblWXHUwMDE2uGL1zsk1XrQq4u24pTa4cvw8mMiXXHUwMDBiuWW8utrnduCxOFx1MDAxMJiBrl1uPE+1Z0g5OLmhNkXt1lnTuZgoJ6XUdsVTXHUwMDFhvnZcIlx1MDAwZcLvfr6eXyFcbtNTnkpcdTAwMGZcdTAwMDG946KYXHUwMDFkToj6T8NcdTAwMTO7oC2jM4Kp+VwiXHUwMDEzXHUwMDA1i1x1MDAwNst0N4lWWOJcdTAwMDa7Z6Rr91x1MDAxNFqVXHUwMDEwic1cdTAwMTVH9HCvYVmkb1x1MDAxYsk4XepLkdZcdTAwMDNoRdI1ot8uXHUwMDA36jZMXHUwMDFka7R6KFx1MDAxMPUuUY+QU39tefd+k7f1pKi2xZ5cdTAwMTXs6y03tsdmNirEnpOyrZrr0CNvcmPTcUh7XHUwMDA2yWRrN2O2r9VcdTAwMTZcdTAwMDTijoGWz6bxXHUwMDAyRqu5PVx1MDAxMGKeXHUwMDAyzqfbQ3uswSpGQVx1MDAwNnx3XHUwMDA2xWBmWTdvQnD3TELEWjDRaFx1MDAxN1FPqlKyl4jsyYpcdTAwMGWlin8rXHUwMDFjJ7/PkOhvLFDOvS6T4yY96NZcdTAwMTnP0GNcYrFcXOqXTrCOXHUwMDEwXG4w7UBmXHUwMDE2MjV/uv2sgfPMSaxztYwkQ1x1MDAxMiS+Qs77vt/jKXb4Xsvr+CA8rVx1MDAwN2OpTbSFvJIwe7FQyp+NXHUwMDE1r5guIaSZNoumR7wutjzOLUOBRqYxXHUwMDFjXHUwMDEwXHUwMDBij2ZGflx1MDAwZfiAd1xyL5t6vtlcdTAwMWb6nPVyx/PKZ22qNlx1MDAxMPJ9XHUwMDA2709tYlSG01x1MDAxNPbIueZog2sunvdcdTAwMTEgwvCkNPj2qPBcdTAwMGXV9Vx1MDAwZTgmdXteXVx1MDAwMvS2R/M035+6wE5cdPhcdTAwMTD9/uhcdJJ1N1x1MDAwMlx1MDAwMmuFXHUwMDAznaGmXHUwMDFk+zm+X1x1MDAxZf6GWVU4XHUwMDEzzvn+XHUwMDBlgUpg04KkP1x1MDAwZpKUXHUwMDE5/aspXHUwMDFlJL1qXHUwMDE3MFx1MDAxZrG0bF9cdTAwMTFcdTAwMDGl21x1MDAxZl1cbn5cdTAwMWZ++DTPP89sbVfEkvnCb2qQPq9p9aXGRuzzoIt3lLSVV9hlqVwi8+i+3vZ0fijKi22gko3lhDY37Expezi7P8i+XmdmW1x1MDAxNdhySMWwxe6HJWtcdTAwMDBcdL+/+yfgXHUwMDFi/M2uUZFW5lx01m9jYEVMZ+uEKll7nvDAfCX9w+xcYk/BPv6p4jl4Q2aqZYj+Po7g8yk4xmFMReVMO1x1MDAwMrKSU7mDmlfaYDNL+4RcdTAwMGJcdTAwMTRp8H5HI109rpta+2JcdTAwMTjjrVx1MDAxZolcdTAwMDQsKzRcdTAwMDHCK59cdTAwMDVMMkbBUPbrzp5lhrMxV1x1MDAxYbeZP+9Lmyg6aVxmXHUwMDA3SiNyfFxuu3B1mlT0pthcdTAwMWNcdTAwMTV3XHUwMDBmiWT4bu57z+6E2oPy9DHF9tjUXHUwMDAxM/S3R4EsXHUwMDFlXHQ//vbYi8coZERQiPKWl9ZwW++MIcjMRMGrsDlTXHUwMDBldy+XtVx1MDAxMn3RxpfLXzeizeb9l0ev0e+Bod2iXHUwMDBlhFWALmdVIPRA3X1S8m0wXHUwMDE3nVx1MDAxYdxcYvR1XHUwMDEybk88WLPaL6SSXHUwMDE2Wogty8w6XlxiXHUwMDFjb+tcdTAwMDMw8JVYu4jkk8Tgk/a4JyCkqqXuMmz/PENcdTAwMWax41x1MDAxNW+pVJO2SzKyoPBvgFSijSBcdTAwMTQzzntpYiBVeJRCeHZTvPpIn5i8YEtnaqu0JYeCxF9m2oUqyMJcIlx1MDAwMVx1MDAwMVx1MDAwNpGk71rR9+z5TGZYd5ji/lx1MDAxMHabXHUwMDE07VK78JFcdMfMP0/EYYJ3xcWs3Ya+jFtLKVxmXHUwMDBiSn39XHUwMDFlQkar1rPYXHUwMDAwJVx1MDAwMoTFhSNIlr2GV0ySpK61Vk/Bu8+w5lO0gvLVWlx1MDAxZddcXLXqKrN0XHUwMDEwro3Uy2OlmT50X2vqPdrUIT63puhcXJlEXUA4lfTl9TzV9K80XHUwMDExQ8reSJNcdTAwMDKDKGXMdbTp6i02wqVkUHw2/Fx1MDAwMC5cdTAwMDB8llx1MDAxZFx1MDAxMoNUgVx1MDAwMeJ8rG9oXHUwMDFjrsef53FNRedcZrtJY4uOxFx1MDAxMr2KXHUwMDE3QVx1MDAxYuIgzK9cdTAwMTN/tDCV+2guia6041uXT9z+MKWi5bH5qytqXHUwMDAxUe3Ej5V2eFx1MDAxNlx1MDAwNsF8ilbM0Fx1MDAxNVljaneudVa7XHUwMDA3zIisefXLTlx1MDAwMm7wWt9cdTAwMWTp0kNcdTAwMTNyXGbu9Vx1MDAwZqVcdTAwMTZcdTAwMWLoRjVyP989qcA84j3jXHUwMDA17beEx26tIMX8SVx1MDAwNiR0PSllXHUwMDEz0H0/XHUwMDAx+mx6b2ewZlx1MDAwYm1Eqyqo+WCTXHUwMDE0q77thlRcYmyLXHUwMDBlrjyY9+GZzFx1MDAxMp9cdTAwMWbf5zg4QWCmjpV15V1pVVx1MDAxMFxmJPWtd8mG0L9lSXLUPVOUWK5cdTAwMTVcdTAwMDWDNT5wTYYpXGZByHP1WkiAXHUwMDBl5TRgocaM6I/Ry1x1MDAxNPB9Kou88JVZZjxcdTAwMTlHa2av9vWOYTdcdTAwMDGHXHUwMDA2WuxcdTAwMTJ5tv5cdTAwMTBcdTAwMTKOXHUwMDA2rbbVvKGb+5Kiy71sXFzqffGSOMs8eas9wIcvXGZ15rrtqd3Ey5rrXHUwMDA2LK+tSstGVXKYpI2p9sbdilx1MDAwNFx1MDAxZY7brJDnXHUwMDAziK4/b6fwiIjQRWNQhJlEXCJcdTAwMWFoTCq288KvRlrqg8RyJ71JpFxcXHUwMDFjU1x1MDAxNURcdTAwMWGmu92bX60tj1x1MDAxOWhcdTAwMTa3xkFWykSBWrzZ7p6sXHUwMDA0VT9iI8pm0sS3I5RenCjvO2AjwSfwn+ol2O5sX1YoK6t0VIW4j9Yr6+r/j6n3WHhUZ7q2XHUwMDBmiFx1MDAwMTlccm2SyTmYXHUwMDE50eRcZlx1MDAwNo7+k+/ez/v/Pdl70G1cdTAwMWKpatW1hFQ627XNkidcdTAwMTiDfcZ6u3K2yMCDdNXhXHUwMDEx9WQwe1x1MDAwM2CieOpcZslcdTAwMWTcjlBPMDHRcsxosGHzkm5cdTAwMDZcdTAwMDbKRXHs3Z47XHUwMDAwe53Ac9VcdTAwMDV4fmmljy/quFx1MDAwZjBE3Fx1MDAwNqWH7OIl/JtcdTAwMDdCYVWgiSBQgVx1MDAxNIafkUBcdTAwMDTE4z5v325BjTRcdTAwMWawXUzf7PVMT5HDp8J4zWZcdTAwMDRs56NcdTAwMTMuztxmhCucwv2rXHUwMDA32zZcdTAwMDVcdTAwMGI19e3bRibv1eqA01x1MDAwNn90dVpToz3uYumsf9tcdTAwMDP2XHUwMDExL1D/kFx1MDAxM92kYSrMsthcdTAwMTdR1uXG6/d+/XJMTlPrWZ+UVMGtKOO/oG6Q3vq2W+GOm7BcdTAwMGLaSVblXHUwMDE0ZIkmlVx1MDAwMd0sN3PrJZYq3UXcyfcsOpvj8+fzYbRcdTAwMTBNuuBTXG5L1NuGTp6jSHBGTT+Ab4fqd+Uo31uO6X1UglV4VUg+pNiDqP1bj1syXHSj3Vx0XSBcdTAwMGJcclx1MDAxYedwwaKl61iRyzmOwjz2y4hcdTAwMWTfd1JcdTAwMWHVLvWy4rRl4LX9wr89N1x1MDAwMpZ8hlx1MDAxZrfbXGLzv/1cYijlXHUwMDEwzpyz6eysr1IwZi3Rc+6bRySl0to4ZktcdTAwMWW/WVx1MDAwN1x1MDAwNFx1MDAwYshLYu1cdTAwMTTBlOv+Olx1MDAwMpK51iU0vdLEeJKGVtY4p94p4LHz7pfwkebkzUAkjiqcW459ZT2qtmJ4tXN36+V8s0Np7bWx6cOPLVx1MDAwNOFcdTAwMWbrfMJFmcbxXHJcdTAwMTFvpjCPcFx1MDAxOHl4toF/J0VFwcRcdTAwMWSPjpCC60Alc+W+RP1tS253mlx1MDAwNLZPv72hXHUwMDAz3nLJ0tOIXHUwMDE5tPadz1Xzd1x1MDAwZXnQW9nz+Vx1MDAxYld3XGZw3MUpp7PfaKBOYk9rm6yq9C1zRuxeUJ/m005cdTAwMWOA2Vx1MDAxZt9bneQzyShvXHUwMDBiV2fHYHtZWVx1MDAxNU1cdTAwMTmMP0BRzZby5X7kR93++bJOOIVtmZ9AVFdQWSjuq3CP9XdRs49cdTAwMWZFZ4hkrk7+qshu/Fx1MDAxNUIlRjua162UwVx1MDAxMVx1MDAxYrpRUf1dXHJjcVJcdTAwMGK+SfKP0W1OqdtcdTAwMTTg8j9cXMc+eM8wcfhgbMRL/bw725d3XHI5VDZNgzNCSfFcdTAwMTYkOP1k7aRA/tdnpVBYccfceFx1MDAxMzFcdTAwMGblXHUwMDFljbHUiaDEjrLh3duu5W9cdTAwMTT6Z0r2wteVzrY5PMHQUmA1uF9cdTAwMGZb51x1MDAxOahcdTAwMWb4XHUwMDEyqiHNXHUwMDA2XHUwMDEz3WyWQTmq61x1MDAxYqjdXHUwMDFhIVx1MDAwZuOWxfPXMVx1MDAwMvzv7Na7VcrVW1x1MDAxN8Xrz9ZfjKsnXHUwMDExvP2rPc3rskZy/dgg5j9I+HG/XHUwMDAwXHUwMDEytKXNnog8ycdj7sKF34eFolx1MDAwZtHQ8Vx1MDAwNmHDO3zNN3Bvh4V+586hbs1cXKMtWLZcdTAwMTVgXHUwMDFmlP3WVZe9fvfKnj6pTH/H8XnaXHUwMDBim1nS+c3KZ1aRPFx1MDAxNsZcdTAwMGXa9HtCf6lcdTAwMTGOy1Bv3pA1kOFlzVx1MDAwMm26rq1e4nQxTUSnJfEooltuhstcdTAwMWJcdTAwMDJ6iUxSXHUwMDEx5+9cdTAwMWVWLYnEkuZaYlx1MDAxOWKzivXfyKidNqBcdTAwMWSBb+ZcdTAwMWI1c1x1MDAwNM375u49xP0svVtPXHUwMDFmMyVcdTAwMTH683v3w1fjuVqp8FvTvj9wQpF8R+dRXGIpvVxy4kGO3IFcdTAwMTInedY7nvLDln0/W/y59ThcdTAwMDCqJ8erm1x1MDAxNFxyNOWY1oZdWTB9XHUwMDA30eZ+p1x1MDAxYmqJykIzeTawe75AKadiwlx1MDAxZW33aT7RZIs0ilxyZ5aZ3Ee6WbHn7lff8Wwwb+9yYcvJSumh6+bC6z9cZl3k91x1MDAxMsEw9X9rdWpH9qNFQmWrpfR9njPTnyDlxdF4pKPbXHUwMDBlfkcnllS/4Npt7e9TfFN6J7dcdTAwMThccikusPc7fIxOmvYgXHUwMDE4SCFENlx1MDAxZeolv5PPde6fg50+aFps12iEubV/7y8mmX0pXFy2g1x1MDAwN0JMvnrMslx1MDAxYvlscfnYP/7a6Fx1MDAxZCZcdTAwMWVheIOx395FYLnqLIP4olx1MDAxMoqJPpGH4GBmJURvzVx1MDAwMCvD0rBaMi/D/p1cdTAwMTmlmOklQX5EsW9srn47wE3DauJ4jn5cdE/nZTeCXHUwMDFk8lx1MDAxYrb4UU8lpPymMKFf+G5EYEX2MoidluV36XnBMiTLeNRYIGG5W5WcleXRgIQ13o7b5alTS0eBXHUwMDAwUoHQXHUwMDEw+KCQjlcsTic7XHUwMDAxnsNNbO6SJtFcdTAwMTlcdTAwMTSBXHUwMDAzXHUwMDBlUpFqVYfCNyyXUjGMlZay7+0rRLnYR0fNkuBcdTAwMTnqU0VcdTAwMTL9kG1B1dlcdTAwMTXk15B3QpzvSV7zpjNJ0LYjSiyPNpRLzGRNulx1MDAxMlx1MDAxN489l/ZhdzTwXXKtd34s/SYkXHUwMDA03oOa5zSMsneFslx1MDAxZMyksVx1MDAwYvuYeVeh+eNcdTAwMDVcdTAwMDHYzTNRXobw9Vx1MDAwM1FcdTAwMTg4weG/PIHvXCJ14Nj3XVVY0NFFXHRdt1x1MDAwNo1F3MctvfV0XHUwMDBlbfrKr5Q58DdByFx1MDAxNlxci1xuNYbCO2XoWjK/XHUwMDEwRq/mNFx1MDAxN1x1MDAwM05uvVx1MDAxMJ/Btte4ffE3mNhcdTAwMTX4SEfzVIU0LTFY4sW/W8qvXHUwMDFkOtf0XHUwMDBmR1x1MDAxN1l12U1vXHUwMDEzi7RJXHUwMDEy0CnDzE2jeTpyXHUwMDE4XHUwMDE2XG7nO07Vu62OnGcuXHJcdTAwMGJcYtQpu6xbudy4XHUwMDAwtIYzRlx1MDAwNaJcdTAwMTSDz1x1MDAwMFx1MDAwNNPi4olcdTAwMTVKzUuesvSJw8RcdTAwMDVvwuPR/9PoTf9cbvK7ltyMzUYu+/iczYFcdTAwMWZIYriBlDP4aWw2qImPo9CBmlx1MDAxOFx1MDAwNYFZo1x1MDAxOf+7l/t91JlumtDXm1x1MDAwMm3iUGC2XHUwMDAw81x1MDAwZj9NL1x1MDAwYrN5o1x1MDAwNlx1MDAxOSquLle+kFx1MDAwMUjV3DspYHpcdTAwMWZQmKj3J+9cdTAwMTeUKlx1MDAxNIjifv76xr2Rbc6+g7qtonojR2tyk/VUqGPmWanyiEaGkS/X0MPhSJ+5kzDXe7gp9Vx1MDAwZYH6KY0xcli+n1x1MDAxZCkwuKaXctK6ots6+I5cdTAwMGZcdTAwMWLwXHUwMDEw2KLCnCW0O7xSLZvKXHRcdTAwMDJD2yGFrzcr6Ks0XHUwMDAyv+ZzgP2dSvTt1bf5WLdcdTAwMGLe1lx1MDAxZVx1MDAxZr9ZX1p3XHKZwX9IqDmfl2skr7QuXHUwMDAzefQyi1/pXHUwMDAy3V1cdTAwMTLhpW8ktoDXqcSQauvO9O+ZeH1+qGkwhDB7MUVp/Yafk1x1MDAxOL9uxbb6q+lcdTAwMTfMWETJwC00o9nsXHUwMDFj83v1zlx1MDAxZZVcdOBtXGZcdTAwMWGGQzjwWlx1MDAxNZFcdTAwMTNcdTAwMTOzlVx1MDAwNFx1MDAxZJJuJsXhwG1cdTAwMWLE4KVv4mFu09NvY0BcdTAwMTW3oVx1MDAwM084rVBcdTAwMTGj1zm0n9I6Xk3/QHeAWsPJRlx1MDAxOP9cdTAwMDVWQPiIwpewXHUwMDA1fYznX9w/MFx1MDAxYnnYsqh4XHUwMDBmXHUwMDEwyCMzlVx1MDAwZVxymNCMneb5Wvdra0nLwyG6NvZcdTAwMDddwDdcZlxczHFcdTAwMGI6XHUwMDAx2fq9izFcdTAwMDFZzftcdTAwMWNWg54z4IxjMdb6ekRxuMO6iFx1MDAxZlxmkV2Zy29eXHUwMDEyr740YmNS5d7Vl//4XHUwMDFkyOEjmytrbEQ+lePBbp9cXEt9zZ+tPsmNZ1x1MDAxZHSo8+W0bVx1MDAxYoNjTugpicz9nFx1MDAxMj9cdTAwMDJ98ZzXq17V41x0XYm9j9RzLTTRY/fZ63ksp1rInUGnaqO6fvb+rq8oRc9s58ZcXPytJb5jSd9OUvgyniZR2NM2XGJcdTAwMDWTsldwzVx1MDAwMY35575SRf9bY29ccpVK0ihcdTAwMWGObVx1MDAxYnulTnvmJvO1XHUwMDA0XHUwMDE0tlx1MDAwNNtcdTAwMTHmabTWblx1MDAwNPLjRljLo9mayottx8rma9r1KKx12/L3xDQr1lm/SHrnsWpkwNNOXHUwMDExRzi5jpuXXHUwMDEwlu+eXHUwMDEwXHUwMDAyJNK7xe/8Sr6Qei1cbuBcdTAwMGI0l6F05lxiolx1MDAxOGfRlUZ+vYf+15NcdTAwMGZx4udYMTHIi9bolGXw1vhKl+iDnShcdTAwMGKHOlF55vAvNtwtXHUwMDBmoPjY/dajTNTiP2x3v5Lc/CykNrxg8jg3XHUwMDAxLoFcIlx1MDAxN76fy+qT+42ROnluZKeObvbFXHUwMDBits2npjxkXVx1MDAwNzZcdTAwMGXqcsv6PS7aijWrQjiCICyMXHUwMDExsshhxFBxt/FtppU9JOg8SZp+Zb1y5YtUjPc+TfVjar12XXFaXFxSXHUwMDE0LVx1MDAwYlLZJpTYZ5JcZjxlXHUwMDEy/FxiV/iWXHUwMDE09k8xvTZ5XHUwMDEwZ9/QxVx1MDAwNpnEXHUwMDA00vlcdTAwMTFMeLShY+BI+/hr0rthXHUwMDAwQj9cZoPfXHUwMDEzrVBcdTAwMTlcdTAwMTk74Vx1MDAwNcZmXHQxzCZjO7BRXHI68/kmmqrrlr3ISDkurmNiRauG5WZ6to8+1IMpnOrxRKpvq1x1MDAwNZebmj2k5cuG5CSOpFx1MDAwNMqfK/013z4w+Ery5DXmsY1vjVKqwzBcdTAwMDF31Fx1MDAxYvZ9RFx1MDAxZp+vuFx1MDAwNFx1MDAwNFmpvT9v6VlcdTAwMDLkiDlQXHUwMDE4tbySxFx1MDAwMoItTVx1MDAwYs+HoVx1MDAwNjTHXHUwMDFlXHUwMDAz/zxRXHUwMDA0MdgusXc8XHUwMDBl+ig1KFx1MDAwNnovXHUwMDFjTn5cdTAwMWbCY356j0FZeWVWLqF52XCj3ePF/Z1cdTAwMTkrjWGRXHUwMDAxO/QjfuTwtKHIbPNcdTAwMGVJ4lbRLue2qHjyIewoXHUwMDFmc2H7XHUwMDAwd+xo4oHdRulcdTAwMDM/nktFXHUwMDFkXFw3afaXz2quPrdLds/n9WmscE9Tn+VcdTAwMGK70dS1l1rRVerJXVUoq6hcYtK2wTMyMZndzmlZyHuj9E3dj8LYMKjsdCS1PsVTftiXxulcdTAwMGXvmu9C8PinXHUwMDA2Pp5DZFGGXHUwMDFlZei9vjr/sM5ZWr2PNmLAaqXdxUCpsbHDa5SK6saGccRxjHmKr5clbMBcYlGG5bzQT65S+S/FXHUwMDFjesNA3e2MOIy+5qORud6RXFy2a5mFvoflXHT511x1MDAxYzWxXGZcdTAwMTBK4yWHXHUwMDE5XddcdTAwMTOu9UBcbq2o3nTvt8hcdTAwMWRcdTAwMTCOz/dx6EWSXHUwMDE4idtC6bHwRJ+Ee1x1MDAxYe2F4+lzXHUwMDE2lVx0R7zpVrRcdTAwMGZmgzHfXVi0l1xmhVx1MDAxNjeXoL7oSltzXHUwMDFkP57TsVxiXHUwMDEyuY7Cwz9vk7pcdTAwMDM7XHUwMDExs558okvUZd9X8zb34oJcdTAwMDEy4Et/1mLpXHUwMDAw4Je/Vvhs17qv37xAJL/zIZzDfVx1MDAxYnxcdTAwMDVR01x1MDAxMCRxtlxiTVx1MDAxZWlP78i07fve70+RXHUwMDA3wj44SC4sfGZcdTAwMTLyXHUwMDAzYMdcdTAwMWXdv8HAiX3D0P69RFx1MDAxZa57XHUwMDA2p1x1MDAxZs4tf1xyMVx1MDAxOTshhCBcdTAwMDFcIsO/Xo4l9YpwXCLdWDFMXHUwMDBlOcLLmWKfQVduXFzo+en67+xKp1LiIX9ktNNcdTAwMWFYWFx1MDAxMVx1MDAxOdmbQjlcdTAwMDeUqGZXrpW3XHUwMDA2IMqDxktLUViSq/NcdTAwMTMkXHUwMDFlPOzznpb71JybmmOU+k5ZJ05cdTAwMWaqXFzVg1x1MDAwNHN6MlXN3YhcdTAwMTL34Ygn9GWi58kyzMOYLHS3/WO5f0vXN6JcYtRcbqxcdTAwMDJcdTAwMWVcZuBPXHUwMDFmkY46uZBcdTAwMThgXHUwMDA2YmS4daMsQVx1MDAxMFxiXjYhJXbPW7Cr1m5rXGImtbRBe4YmedZcdTAwMTdTXHUwMDE4pKmEQsFcdTAwMTOo8Fx1MDAxY+SmX75cdTAwMTeHmmlolshn91x1MDAxOdvpW4j3/MnDxl2VW3FSW1x1MDAxMool6TVec8lcYkXieNJTrsj94EBvoanK/NUgr0XsXFxcdTAwMDJm34V3kNokKj+TXCK7Yt6HdSNcblx1MDAwMPLTZFx1MDAxMaNUsUjL/+1cdTAwMDaKVlXvOrh/u5MvPrxcdTAwMDfwd3qQ/jhLzanszdifUVB+L2+QnYirXHUwMDAxPKkxXHUwMDBilzhHXGJFMDB81F1Lmp7+XHUwMDFkUDktjaXDQGlhXHJcdTAwMDQ+deyTj6DuXHUwMDE0WD7EOXte14VaXHUwMDEzjVx1MDAxZJTIUlxc4lx1MDAxNO6DsHg4j4LuZnwtSMxAjt/fR6zGMVx1MDAwM7hRYpdTLq5BXHUwMDFlq607qbVcdTAwMWJWR1K2kXJcdTAwMTaBzdS0XHUwMDE3XHUwMDE0JJU8OzH6Nlx1MDAwNnOeXHUwMDA2aTwnyEYoxGRMSkFQ18cuWDFBic873vGC3qdcdTAwMTKpejTMIFwif3SK0jrSxljZuGPQ41x1MDAxZC6thVx1MDAwNHKO1XcseUfExMz2hmF3XHUwMDEzXFx3XHUwMDAyLsT8NFx1MDAwZuBJQldgjpVcdTAwMWP712XS2Vuym1HoajzdsMNfzlx1MDAwMGKlaU7a+8fcxVx1MDAwMu/Qi8s7+UGazUi1kTzhzkeYXCJvmFos9SbJ5Fx1MDAxZcHjI+hcdTAwMWbW166K27Boe5Z0erjo98aAXHUwMDBmjNB85oCOu0woMyab17jVM1wiXHUwMDFl4IFcdTAwMThcZtGgpn68bd6Na2Zy3UbkN1x1MDAxMCtcdTAwMTdSPjDrYJWncb9cdTAwMWVcdTAwMDGks91vU3Ji6Ju259EsTMLkT5bpXHUwMDBiXHUwMDE2PaaGXHUwMDE0wmEoolS8XHUwMDEzwFx1MDAwMDw8Xqq4SolQWFO5b//j7vfM2CAo/Fx1MDAwMibOouJHZXrWctR7STyXr2pcdTAwMDWkoa6Ofzz4daSI8dOU7UMuXHUwMDAyXGLR7PAoQ3KnW2fFvrC5Jlx1MDAxZnRcdTAwMDKuWWtcdTAwMGVcdTAwMTj9WLiF8XBEzpKe2IxcdTAwMWS/ZNdktW2/89BcdTAwMWF0Vy9cdTAwMTBDTntcdTAwMDWaj4Dl5djfcC7GZVctSjp4MOfkXHUwMDExrVwi7XaRh04jXHUwMDBmQe1iYS5cdTAwMGWv7NS9UWjkXHUwMDBiYHKk7JP47J/jIOcqsqNcdJ7YodvGXHUwMDE4dr+a5OpRmnxcdTAwMTQh/ObBmIA0XHSeknNYkVRcdTAwMDdcbmK5Vkzy1ebOem2W+LdgseW+Xs12MFx1MDAxZEjH91PUXHUwMDE4plx1MDAxZnBxXHUwMDEzvkjCJr/3Qff52T7Cs+dU7zQpsVhQlvp+gVx1MDAwZfDtLbwsXHUwMDFi8SxcdTAwMTP8eVx1MDAxY1x1MDAwYlx1MDAwNZWXKdBcbtxcdTAwMTN5NdRcdTAwMWVcckGm8ZJcdTAwMTnR6PtsOlwiVNviZ7aWL7P2ZzKbxsvaxDAtwPObkDZcdTAwMTNz5D9cdTAwMTM3XHUwMDA0XFyqv0fs7cgp4sVbndU2IMDDWO2Cdlx1MDAwNTe121x1MDAxNtokq3l8e/nEhbnV5OLMtfFW0/O97jKG6Jc9KaIjTKFfblx1MDAwNSp8Xlx1MDAxZa7JzHfDXHUwMDFhOukk3Fx1MDAwMaF4zuTTOdaVILXR61Ko8Z9cdTAwMGbBfHguZGkxzc0gJ5RkXHUwMDAzelHbLVx1MDAwMlx1MDAwMubJP58yXHUwMDExlVxcWVhcclx1MDAwMWjioS1ZXHUwMDFlvVBqi7SZjebl89Vp9T5/7Vx1MDAwM3nL9lwi/1x1MDAxYn9yW3VzSEkl1W5cdTAwMWTtRabX7lx1MDAwZqySinL0e3/EQeqGbaLwX7+SN4B36TlJV7s2slx1MDAwMVx1MDAwNC7t2PcjKXWSsD9rXHUwMDBid9r5cCxcdTAwMTZUVPI//UvaXHUwMDA1/KgsKHLN999cdTAwMTdcdTAwMDbNULf070Hpy7J452e3YdZTO/WWR023sL9Tbn1A3YOeWVx1MDAwZXK9jinaXHUwMDFka0zj72VcdTAwMWNli4LgXHJuTv6KgO84lry7yGRTt6LmXHUwMDFmQFx1MDAwZoBcdTAwMTbnX1WYdFKoXHUwMDAwi/RhUVx1MDAxNEE/XHUwMDA11sS4XHUwMDA2yNxcZit+azcoUVx1MDAxZZgmNilqXHUwMDFio0EyQltvLX+SXHUwMDA0isAqMKrn1VU3VeuxNsNcdTAwMGZjy4JEM3Mtnilmk89Pk399aG2KZbtRPD3QXpP1kWRhz0GjOpRrU9PqvzVRXt/kwjlOzq/50rKKmq5ArLhccuDtl7vkSWZcZmEtL0c6f2h2i15cdTAwMWaDYVx1MDAxZGgmOdnhgTTxmkLGUv1cdTAwMDXal6uo2CVbOFx1MDAwNPJcdTAwMTQocTotvZvEk7GRmqZcdTAwMWbUuadGT7FmgMBOf3+d7yvnhv59Q2IlOW0y24jB82cvZYH3xWZ1+Vx1MDAwNFx1MDAxYYX6WGp0yDuy99F8M1x1MDAwMnCcbUOzK0T12rOKmeDbXHUwMDEzrvBcdTAwMTVbT8nX9lx1MDAxYqqmj+uTPMnfiO2yTcKa2WzHXHUwMDE1hID6PdPq2URcdTAwMTNcdTAwMTbLb08q+pzKSVx1MDAxNH1iXCI6tVx1MDAxMJb3yb9eXHUwMDBlilx1MDAxMnAyoFx1MDAxMTfHiFx1MDAxMI/zk5ZoXqVKxStqSlxmuar48+RZx1x1MDAxNktcdTAwMWIuKGa9R6eG0DNcdFO7Syk6P9B89a92blx1MDAxYtFEh7BD5qM9o6N4P2/0UtfKa/ZZrT7P4/VcclNd7r6Ij3gvbflG9Lmg9uygyYJGv4W7XGJOuyHEvjdv6p5ZSN+3M1x1MDAwMVs/Znb26TGlfuNcdTAwMGVcdTAwMTKMUs4oTlxcdSVmZHukdftcdTAwMTfg10C75YMm97vuXHUwMDEx4H964LL7tMyydd08pvRcdTAwMTVlUVx1MDAxZW/R59bWW+jmxqkluCbRPT5i+9PESTil+jjmg/e0ylx1MDAxZI44hclcdTAwMDJcdTAwMDU2RPnGW4pjXHUwMDBi5b9cbrJ4UMYtj2YhMNv1yXu39c5hUjvSl/KeRo/edbtAWneq3CRQilx1MDAxYfwmKtNVf+dXXHUwMDE2M9fdWrVd/1eb6zK1pyZJW5RcdTAwMGLdXlxyxVx1MDAxMvtmpY5cdTAwMTEsv2pPn3vY38cxoJ8k/Vx1MDAwMFx1MDAxNlx1MDAxYjvcSs7ywOkvXHUwMDFh5KWVTMnikNNvj2SlPPE+Scm42zh9mOpcdTAwMDOrymctxPT5XHJcdTAwMTYvYJTT2c4tkvZfRV5cdTAwMTjEK/U7mUNPXHKDXHUwMDE4bcLUwGBcYsGchKfhYFx1MDAwYo/o6K9kXHUwMDFhZo60n/lslItF31VVbSYnPkVcdTAwMDVwzFx1MDAxMD8yeNcw0l5DrXvQu1x1MDAxNi3PQEDHXHUwMDEx6VRccthcdTAwMTN23LVfXHUwMDEzoiHvXHUwMDE1XHUwMDEzQsPQ9mO7e/s105TvXHUwMDFh69bq826huHm50ulcdTAwMTRcdTAwMTRcdTAwMWVoXHUwMDEyhmP9IySOL2VfSZ3FUt7RXHUwMDExokhYe9VcItAredJo0lx1MDAxY1x1MDAxObNaNVxcLeSci3PGXGYnuTbYzei8wFx1MDAxNJMubNTsXGKeXHUwMDA0xS9dXHUwMDFmXdH3NebcKFx1MDAxM6Z/i7lpzy1cdTAwMDFKd5pQYaVeasTCJapxroitXHUwMDFmyqleXHUwMDBl/mzlXHUwMDBim1tcdTAwMDfdKP2tXHUwMDA1YuZe3Kitd/7x3jlcclxmSlx1MDAwNFnSR4JcdTAwMDRK7lx1MDAwN1x1MDAxZKfoolxigfeDSes6lWfIj5Nnej5rXHUwMDFkOL6gM0b7rFR9XHUwMDE05P1ysNz4XFyNhT1Qd8pBeEc4uWJpiVx1MDAxNFMmXHUwMDEz6uSTsjoxIJSAx4uWia2tpPhcdTAwMDRcdTAwMDbNzF5aRCGWJHn335nKvVpcdTAwMGVPyp/OOvstQ4ZpPlC5yo6x4fQlbVxi6uVcdTAwMDSx6rXLrW0kuXO4tOqrXHUwMDFinYbvtlx1MDAxNDrMiKisPuLP+lxuIUFyl8eQYqbr4lcuwM0uXHUwMDE3XFxHQMSVXHUwMDE0YKKAK7VcbuuBWDyZWVbp2TCo3vuEZfE+fFxik3dcdTAwMTZcdTAwMWHHsEVcdTAwMDKhR1sks/ZA0VxiXHUwMDA0UmmlOU6fXHUwMDBlXHUwMDEyK4OuRTKY6Ly55zuuLI0lgV/0bKpSw0f4b1x1MDAxY1xynEKpM16pONM2yGYq6b/3XHUwMDFh0WXVXHUwMDEzMO9cdTAwMTJAzVx1MDAwZif6c9CKnrk80c6e9N7rXHUwMDA2fyyNguZcdTAwMThKXHUwMDFm9EtvU6frKinNXHSMduiTSHFcdTAwMGKoJlx1MDAwMkx2P6Zm+CzVYc9rr5FJv4tf5ibXjYuud1dcdTAwMDS3zP5uXGZcdTAwMWGrK1RHdWOzIzwspyzQdlx1MDAxOTlcdTAwMDdcdC+0cYc752q5XHUwMDBltu5cdTAwMThcdTAwMGbDpiF2yvjSXHUwMDA1tXyV3a++XHLvJC/M11P4fp1UxGOMXHUwMDE2dMuK3DGYj824XHUwMDFmX0YgU3ul9ft5WtyrKz/K+Nvy9eDwZfq35/kucVx1MDAxY+KTeMEsPYXeQERxXHUwMDEwI1x1MDAwNsR4eWZcdTAwMTHeWCeZli5cdTAwMTGdgzRGnlx1MDAwM2Y6j4VrXHUwMDE0s+zJXHUwMDBmxUJFklx1MDAwZVx1MDAwNISMzmeuSE5/XHLq/Cc7UW5cdTAwMDb6XHUwMDFjIITHN634e7Xoj/hcdTAwMDbFruNx78FUPifymlx1MDAxNY6pXHUwMDEyc2Tl6Hc+on2aXlx1MDAxYiC6xVm21eSu+Fx1MDAxY5SPSczLglx1MDAxYSGtfKpAUn97QVx0JFx1MDAwNUxcdTAwMDGihIBi7W1cdTAwMWaKXGJqZtOC58usPI1H9+5fu1x1MDAxMKSqO7u5XHUwMDBmzXU34Hd4wDTcXHUwMDBlXHJfXHUwMDE2zJxcYt2nT27vV1x1MDAxN86+fMhccs1T9bu8n1x1MDAxYsiO41jmXHUwMDE5xmk6LUtfZEtcdTAwMWPeIDbZXHUwMDAwm/C2/YXQ8eIsrm7jp+y2x9UqW2pvv9ZcXM+F7CQ9VcYgWaNt8H5rnFx1MDAxNTVG6LUr9Ndm0zYkkyOa0WxfQNlJhChT7FxmPEqPyFfxiXxpXHUwMDE2QPX+//U1tjjZNyRjw5TysXd3XHUwMDE3b6XT/1x1MDAxYTFcdTAwMGKg7jb1Njf85Ww6YMKdXHUwMDBl78Dx8vBlx1fpKEdZvNLBmViZ/Vx1MDAxNPZRcW1cdTAwMWKASSCPgVx1MDAwM4TeujrzXGLp/OFcIlxcpTpcdTAwMTWmUCnVs8f3XCLgXHUwMDA3/Zo8S23nx0fJXHUwMDFlUUOdcmtcdTAwMGLCXHUwMDAzaaJcdTAwMTPCavM+aJRdJf1N//iRU1x1MDAwM8R0X+0ozSjWMLB1QYetIUKl2tTMPjXgtaWmXHUwMDAzXHUwMDE26jgkXHUwMDAwmduKpmd7ylxcwlx1MDAxNjucXHUwMDE0rTz6gVB8T680jffvXGLHb3tcZtrqdqNRid9cdTAwMWItf1f1hESsWNLLbpuhazdcdTAwMWakjjsp8rtcdFwiO8SR6LCu4frRXGZ5aDbGvO0k0PPOvpM973o6pU2nNlvRdlrvqihzNrzObUngayyffjDMXHUwMDE5ifKCMfeFaPmoplFcZmtwXHUwMDA0JryUPjnDKPB8pIv7//W4iPjXXHUwMDA3+7ytXHUwMDE19rxcdTAwMWJmgStky1xi5J3BnLxp4GpcdTAwMTJoNK9XNjFLMe/rsjPszFx1MDAxMVx1MDAwN1x1MDAxMuG2XHUwMDFhelbimNi8YvTcKzSakSjSs5EsXCKwg9BcdEIlRbFcZuRcdTAwMWXK5KGtn8HjW0lcdTAwMWXeoo9cdTAwMDb4glxyt4J26sjsW51cdTAwMDCom+X4NrcjO8aGb5SwtlxiPfJXQEe130whubLznZKf81x1MDAxOeNWwVx1MDAxZYdYYfmFhbXmb0qqe86IUo6MRa1ak830PGLljNJA/NwwSSiiXHUwMDEyJaVcdTAwMDeRKEJ+paynUCZsPCtcdTAwMGZpJ9lcYkH5XHUwMDFkVFVHisrTXHUwMDAyXHUwMDAxYUI7jP1cdTAwMDRji1uu7mNdXCKnoc0+znLJ31CZP7Ffm1DLPvC+XHUwMDE5nC9cdTAwMGLN7Fx1MDAwMZJl+HdeejFcdTAwMTI94ZLn50DvXHUwMDAw1K7v2lx1MDAwMbdcdTAwMWPGMdpcdTAwMDF5f6J1aISAaqsr7i6hXHUwMDFk0aF2l4BzuamqZ9muJNtcdTAwMGZcdTAwMWVWuEeAL8b8b2/cV1x1MDAxYeudPN19OLypRY+rVOFcdTAwMWH8W1x1MDAxOV1cdTAwMGL6PXkyoKQrvKjoIJiFgIA76uRNXHUwMDFhVNcoNcPSg1xiPrKLs2uZ0r2/vlx1MDAwNTYlslx1MDAwNzmNKVx1MDAwZlx1MDAxNFx1MDAxYdVcdTAwMWbstdvg77imQDErmXpEjsahd1x1MDAxMPxcdTAwMTm4VzjOtItrXHUwMDEyqHmiUHrCJylZXHUwMDE5dXNccr3Q8bh3iFwikbZmRs9cdTAwMDKFJ3PpfMzYUdfcyX3H12XhfFx1MDAwMH+OdJsteEOOPVx1MDAxYzn7NjC/aohcdTAwMGbwtET7pszmoHRBk5FvW8l4dXKunED75i+Axfz4XGYukFx1MDAxZUorS5KfY4lcdTAwMTFuplx1MDAxNpdcdTAwMWH+xZplbubfW36IqVxmg8VcdTAwMTArWaiRXCJcIvDX5+/o/tbE9t26aVx1MDAxNC2pXHUwMDE52uMvgj2bl800kvaor0qptUTvuHDy31x1MDAxZo5McVi5+GT79UtcdTAwMDGBvJPh3fh2v3mYXHUwMDAzvndcdJ5O1yNEfFx1MDAwNfJOd69zQ1xubYQqv0qc2fk1KcpcdTAwMTdz3Zutx0gkXHUwMDAxxSyKmK3i5DZ2VFx1MDAwM6VcInu8ZHFG2KGmY1x1MDAxN8x248X4XHUwMDEyPIKlcPh4O5Ati+2+XHUwMDEynvK76sefMHly6YKRXHUwMDE5N1xyQUNcIkgvyf8ogi5Rc0ZxQlx1MDAwYm+CvHGXXHUwMDEwqyv5Vau1eNVcdTAwMDSAc9uBXHUwMDExQf6dXGKVVvOoXHUwMDAylUpzs/dcdTAwMWNGO6D4t4tcdTAwMWFcZlxyeVx1MDAxM616tTZ+YFx1MDAwMlxmd1j7PvJ1dcRcdTAwMWSNXHUwMDFkRWGLwHnnXHUwMDAwvn/rw6coyOxs+/lOzqnfyN/ARbvhevTt2O6RXHUwMDExI2hcdTAwMTJzjqUvqtRcdTAwMDGUSVwiXVx1MDAwNlx1MDAxMFx1MDAxOJDxsXBUzjZcdTAwMTm83TxV7Fx1MDAxMFx1MDAxZU6i5FxmLzCSQ8hAzFx1MDAxYs07ltuIeMXYXHUwMDE3jF1cdTAwMDGu+U+Z7ElcdTAwMTVgmT32XHUwMDAyXHUwMDE1XHUwMDFhxVx1MDAxNsJ5WSk8K3+FbalcdTAwMWNO/7zGxX2DsDB5/pJi6TWdX+yIllx1MDAwNX9cdTAwMWI6YqhcdTAwMDVajOjm+aj5SlmMyqNcIoGYZpFcYqdlNTPclVx1MDAwN1x1MDAwMy/aNl1EXHUwMDEyXHUwMDFhjzSZTlx1MDAwN3h/rDin1O9DzjW7XHUwMDFibtJcdTAwMDZcdTAwMDU6TC73V0Wy81x1MDAxYd0ndmFcdTAwMDR9bVx1MDAwZapcdTAwMDLvxzmNXHUwMDE4NVx0ieTms1x1MDAxOW7/WVf9I4uvTE1cYqaR0UY2XHUwMDE0zp6YkI7Tzp6bXHUwMDAx4HS9X36CjdHk/9Y92lx1MDAxOKvS7Vx1MDAxOSVcdTAwMWSPppZcdTAwMDF7dzlcdTAwMTWF5Vx1MDAxOP/ePWnUgnNI+8x+PSbIPuvGk1x1MDAxMEdcdOhlXCJcdTAwMDL56fdXK5xrUz9aXHUwMDAx0Y90aIK5XHUwMDBiX/zjq1tAXHUwMDEy9MBKnEA90Fx1MDAwYoKJ9zs9Jj6Ex4F6ukJcZiffTqtdIOyBqHfaRdRHYdSzXG7tu0h72aX3REwl/Md9P/TLb8zhkURthsRcXIBcdTAwMDK7W1D5d6bI1nGcZkavWs/CNyNeQv2qa1xupp5cdTAwMTBcbtWYoFxcdicvXG77uiZ5r+ONhNmp1uuCOoH0gJpcdTAwMTQ/Ovgsp0DYXG7iZKlcdTAwMDKdyfHaxkU8p1x1MDAxN2yhXHUwMDExXHUwMDFiZnlwJn93sVwiYZyV9CVXw+st+4pbftFcdTAwMGXyR/nKnJ7/dU4tQfFrc+A2snc1SNchObVcdTAwMTJcdTAwMTPF64St2FBewMCNKHJf9lwi0zv+foCHYFxiZFx1MDAxNKLYnGK9wOlbb17OwEGmKMJrS73VNUjcp4fxmmtcdTAwMTLLXHUwMDE35MQw0MTbXHLDXHUwMDE3LZ1cdTAwMDZN986wJKh8XHUwMDE5fLy7s9dcdTAwMTW9m7E7KqC1XHUwMDAwVe+nXHSxwuvt9vR5IHjqzV9i3fdcdTAwMDWa0SQn4XL58Fx1MDAxNFx1MDAwYvexXHUwMDFiXHUwMDFlXHUwMDBmkIXL9KU8NDbP2am1K1x1MDAwN/qaqys6Mbg9gqewtFx1MDAwNa5VXHUwMDFls1xupaJOMioyMT/rVzRcdTAwMTRcdTAwMTV+d1x1MDAxY7T/zv3KK83i5KvpP+/qrIXJgIKWgC9BUZVcdTAwMWKIeSxpI2mjXHUwMDAzydeWgEFcdTAwMTSVJDSpXHUwMDFhSvBcdTAwMDXmrGhcdTAwMDZcdTAwMTlcdTAwMTWqojhFjEwhdD8wOFxmaGBcdTAwMWOd9k1cdTAwMGVcdTAwMDKSXHUwMDA1cUBKxUaTQyr0qmuyuPPSevdzJYPRve/dNt7a7+xXxVx1MDAwNYGPSv/668BNzSuaoKybz0IrXHUwMDEwlmc6g/mrbopgL7xAXlx1MDAxMY5cco+Ou+Ziuvy6XHUwMDE03u71PJ1cdTAwMDON+t3HTu/Ht8zbc/aMwt9cdTAwMTKef0W0me2LKfZ3l9FcdTAwMTBcdTAwMWFne1xiUvVuqF2zP09urT/3KyNcYsFGeMAlprtOheZwblxy4lx1MDAxNniomjJ94+8y95OFIPNlSWNyhlwiQa2OjP+8UXmrJ9r4aTXx/tMsm7V1RfLRRbR2fVx1MDAwZXbCXHUwMDE1n5XnNkFmu4aCar9YrOnSfDKwwog2faDVyVxmuE76LE9M+1x1MDAxZbp9JKb96zlWr5vQ47FE+7xT/M5MOtXHc4Yp3PY1JlpE3lxm1He+XHUwMDAwfvVVxjBcdTAwMWZrtYvy4U2eI4jM7+NcdTAwMDO/QeJ8pJBhbJxVzS1B09VHJ4OLXHUwMDA2zrnmxnB1YUKBlFpcdTAwMTJG51x1MDAxNnR8IGdcdTAwMTM4geBszeLb5PvNXHUwMDEx72G31aIpVVx1MDAxMdnCpzdGxG7HvlxusI34nX8yToVcdTAwMGLmPWhcdTAwMTbGn0rgZk5cdTAwMTaGXHUwMDFmmNeSZlxm9TpcdTAwMGJAXHJJrsCRo+E6l1xyXG64OWr6Q1x1MDAxMeD825JAXGLH4kTVXHUwMDBmXHUwMDFl4Vxy61hIp7hmXHUwMDFlwDGmPsmmNEinMOCuj5I7emdjiDv1r8dAjrKUOL0/dsvQ9Vx1MDAxYoFkXHUwMDE43bDq6yDnvCQvXHUwMDA0u1x1MDAxMFx1MDAxYiR0/2osd03TN1x1MDAxYqR76aPXvNxcboG20Fx1MDAxZXp4v1x1MDAxMVx1MDAwN9L7XGZryzf0JpvIyJPXWHm+1Vx1MDAxNeeRP7Oo5J24/6exXHUwMDAxf8/fs5WVa3FcdTAwMWbk6Ppdh8zR67vR8JqzpH1Mn19ff80sIGpE3iCI3JbeXHUwMDE2XHUwMDA1XHUwMDFhfDBWgyFcdTAwMDNcdTAwMWR6700grTT3oqbf3sLX1t/x2qKbY7bjn65631apnddvXHJyOWmaKpmLXHUwMDBmTTlcdTAwMGaqXHUwMDFhOv0rUd1cZkKD9yHqOHyrLpU+L6U26XP+zNtkyeZMpFhRZsIhb/isdUP1jjHno4C8XHUwMDFmTJCSrU1ePKhccs5sbGMwxtErgo1kx6FcdTAwMWVcdTAwMTOtodxbwnVcdTAwMTVcdTAwMGaPqKySh6SSY1xcYy+k7igh7Vx1MDAxZr3wQcZzz+Xjlc/YvndcdTAwMGVcdTAwMTE8Myh5nlxi7qkwQ6TX+WsxXHUwMDE5XGZ6YTNcdTAwMTc1K68vXHUwMDA09N/lXHUwMDE2hT5cIrtcdTAwMDVxM2T/xc1OQO9iXHUwMDE2vzhPiVx1MDAwNS1cdTAwMWak21x1MDAxOcpvODaoa1x1MDAxOK3YcY6Tplx1MDAxYqHRa3VcdTAwMDXSekTbxZbri38uM3hwLU1cdTAwMDXEK5+OutyDo1xucErg87i1k6RcdTAwMGLpUp5oxy2S6YRcdPxcdTAwMWQ8fzLrze9R43hKn1wiTlx1MDAxY+JcdTAwMDWi2FfjTpGOSVxmXHUwMDFjXHSr67n+slx1MDAwNFx1MDAwNaOlWVx1MDAwNlx1MDAwZfrOqVx1MDAxOVx1MDAwNDG9Qj2X+lx1MDAxNHw1IFxiXHUwMDA080omqbBcdTAwMWZcdTAwMGb58VRcdTAwMWNB9H12REMy37dcIkGkYPJcdTAwMTVzVfAgICnAKHiIJJV2U1xipzWzkFx1MDAxN6y34arIMD+2P+PjXHUwMDFlOX0vXHUwMDFhW1x1MDAwN7lhi7FnUIDDXHUwMDA1csVBrVx1MDAxMVx1MDAxMHXFXHUwMDA3K70rt+90KnCp6N9dXHUwMDFh1GyoW1xyXHUwMDAyxfJcdTAwMTjhNN2/vpNcdTAwMDAlI1x1MDAxOFx1MDAxNnHf8Lv2M1x1MDAwYu7M5JC5XHUwMDAzJdyRL5k64F9cdTAwMDbC3lx1MDAxOHgrXHUwMDE2bZCFSDWmyMvsx3Nlt6zxRMzT5MfSjDeSTVxcsbitt83Avmr57J65OrbdXHUwMDFhaPnEMcHc3OX8SvX9gD7lXFxIOKO8WVx1MDAwYqrT390tXGaq33A5yJ/CQZ83nFx1MDAxZXWKzELT++xz0lx1MDAxNnV0jfj+RZf5fVDQ62Ty236dzzpilH1hoFx1MDAxN+Le1Vx1MDAwYllhToueMae3nFx1MDAwN4okXCKvXHUwMDA1XHUwMDBmhmhOu68+XHUwMDEwfzosfD9V71RcdTAwMTT7TqMl2PGhel5HOVx1MDAwNkxcXOrYXHUwMDEyb/9qdVXbi3KWvafkOmWlXHUwMDE2NV5tM1xmQVZcdTAwMDPRQN1cdTAwMDMzXHUwMDBlULP3XHUwMDA0ruS97VxuWzIjJKacU3xvr3a4XHUwMDA3wV20SJPCullecVx1MDAxYmsm+rvbIGG5y+EhSm+xxFx1MDAxM9547SNcdTAwMWZ2o1x1MDAxNPaIgV9U32JcdTAwMTGlqFx1MDAwN+dLQVx1MDAwM1x1MDAxOaOaRFx1MDAxN1x0ci5La98+x1x1MDAxZHnnzVwi/LPLoJZcdTAwMWaOQ57o4dR2Qu6XXYDp+Fx1MDAxY8LBl0mkoaL0K2o2U4U5p/B3s8ptyVx1MDAwM92VXCL+XHUwMDFiXHUwMDFmzsnpi6R8yKfOayj1pbZwXHUwMDAxbu7XyyCApkhcdTAwMTHly2d7XGZ4uSa6TFx1MDAwNYxHXHUwMDA1SOb6WjBRs9C7epxPZ1x1MDAxY4fQnYoyhD2++3f20JzMf2dcdTAwMGaxq2mRXHUwMDA2eZztXHUwMDA0STpcdTAwMTdLnvVlXHUwMDFl12386/VVXHUwMDFi0PE4luWmvk11XGK4K96NPJeEc91D3aXtXvLfXHUwMDA3TCGbMc+atmim6VJcdTAwMDKMmy9mjJovXHUwMDA3YvfVWzJAortNfmu7zTP0XHUwMDBmb/xcdTAwMDBcdTAwMTZP9W+jnFx1MDAwNk8neJPvQ1xiK7K9slFcdTAwMWUsaoRbVvp+41x0QM55XcJcdTAwMTF71tLEZfQrfoNcdTAwMGYp8zI71rM+s6Oon1x1MDAxOUAgXHUwMDAwicR8bTtcIrFcdTAwMTElYv9dtnggZEnumI28kFwiyS1krWRcdTAwMTZcdTAwMDdG9TK++73Aja6aoFx1MDAxZVx1MDAwMoBcIjtcdTAwMDT9tvgw3FkvJ4SV1kLv5yj5r3eSuDhjmYFfXHUwMDExxW1cbpcsqmPiUabkXHUwMDE1OdSAzuu6jFx1MDAwMCm/wD+EiLnw43zsRziEXHUwMDA1jtBOhMOURlRcdTAwMGXkqLw6m3NrOumIpaIr3P3eXHUwMDE5b1x1MDAxYlmivIz4gHZcdTAwMDeTdVx1MDAxMlx1MDAxYlRObFi2XGKXzMlgxEjnXHUwMDAxl8niYNl21f1cdTAwMDbxI1/OI/RcdTAwMWbJ8uuXkVx1MDAxYTL4XHUwMDBmXHUwMDE4RFxurlx1MDAxMFBcdTAwMDFVoLG7zpdBKYXT5EH3XHUwMDFjXHUwMDFiPUSZXHUwMDFiXHUwMDFhsihgfzZtyN1cdTAwMWR/tZlcdTAwMTO99aBU1l+wXHUwMDEz3UxcdTAwMTP5fD5MXHUwMDFiVs1lk3BIR7/ajEZjgcaJ5Vx1MDAwNeTvXHUwMDFkb4ZcdTAwMGVaju9AViouSvCnWlekMfb0+/ZNIIOe2VpcdTAwMDXN+6Q5Rj0q8ear/mZY1KVjfTu9RGiUfVx0TVx1MDAxNX5mwtlcdTAwMGU8RVx1MDAxONbaXHUwMDBiv3rjjoFiUllRcuLuy1x1MDAwMLD5j2n6XHUwMDE4LcKMXHUwMDExutfoXHUwMDAy7U3IyDSp0sDHTHjgWyRcdTAwMTfR6Gz4XHUwMDEyWUVMavRcdTAwMDdcdTAwMWahgkJvtjd6Lbs8L+/NbuVcdTAwMTlg54FcdTAwMWKST2ROXHUwMDFhR39yrlx1MDAxNPRcdTAwMWY5yrzf8sBoLoHt1/OKzFxiXHT+fybzaGaDvI5iXHUwMDBlXHUwMDE5ajZaYKaqtlx1MDAxZFx1MDAxMtRcdTAwMDRim/k/T+jXyv+9XHUwMDA3n0plem2268qUKm9cdTAwMWQlX5vkLFxyNdVNcnovj1x1MDAxYWtmcVL1fPPqdbFGXHUwMDE3tG+KI5TfLVxiXHUwMDEx1zstRSQq3Pax/9iDqtxZ4i1cdTAwMWRl+SVcdTAwMGZcdTAwMDb3SIZk265cdNv6/TmOh1x1MDAxNtJcdTAwMTRcdTAwMWFiSlx1MDAxMlx1MDAwZlx1MDAwNGwp0Ojq4fdcdTAwMTn+Nlx1MDAxMjdC+sJnezflXHUwMDAzhmZcdTAwMDD7XHUwMDAyXHUwMDE0/vU2XtHhepn5XFw7q/G7h42sXHUwMDE3xVx1MDAxM8FzvFx1MDAwN12U4/ZdXGaMsaBcdTAwMTBcXG7ctYiZLCdcdKxC+vLbd3tgd3FYLcuk4YifqjDxXHUwMDA0jbqrJ0zq37U7bntwzXj5u4L1vGVHUj50R2Jzjshg+Vx1MDAxY+vKPblcdTAwMTYo4bqviTPPVsBcdTAwMDdcdTAwMGZ6q6ZcdTAwMTlJpXeggFx1MDAxMv7rSkdK6/Qu5NpK+a+myVx1MDAxZlx1MDAwNiotbOjmXHUwMDE2usWjk6pcdTAwMWVj8Y3XXHUwMDE5XHUwMDEzs41TlHMom7Dz6KjI6dQlyrKJXHUwMDFjJ5L8NOxaJ/3bT6+LZyiH1XaZQz+Fvai/W8/cVl6TX32Rcpm7ulx1MDAwZvrzO1x1MDAxZSgxP79cdTAwMDN7XHUwMDA1k+94UiG3V2oleH6Tflx1MDAwZjHGXHUwMDFlPo7j983AXHUwMDEyOlx1MDAxYplbqXZh3Gx0ukTbkX89XCJeL42HV2Z0Uo8s+j56WrMoOJ+xbdtTMnr5/Uy3Y0jGTmMtPcqk+lx1MDAxMrqYlSrcUFx1MDAxNK3hNdHuNnp7rFfBfH2XQbVPm/JVTTRHrDZcdTAwMWK+QlLaz1xii/aaiGpcXFj69I6VzuRcZt71zNJcdTAwMTOjYKDYT8NIguNgLiG3rMlfS33DpSC188jUXq2b3XiVtmNgfTaqXHUwMDAx/GH2oVxyXHUwMDAxIeH88rmKSzpcdTAwMTH3IX1RN3AwdF5gKcTgXFyh7ok/WOX5a2/1Kk37XGZcYt9wRsluVG2+XHUwMDAzYlx1MDAwMFxm87ktf3mInF9cdTAwMTmZMFx1MDAxNVtIl3vRajJUe0nQ4946f2FcXDtJhsJmMtbn51x1MDAwNUpCObyrwjs7XGaB8/BcdTAwMDW/zbxcdTAwMGKDzVx1MDAwNNGUiij968+6XG4nyosppDdcdTAwMDKoLVx1MDAwMf1ccsKg3a8yYVhs/Vx1MDAxNJm0uXpTeorbvrFcco9cdTAwMTk1vqErPSTkYppic8jMWbT9RUm6qM9cdTAwMDP1hLIsdT9lRLdcdTAwMTlcdLMqplx1MDAwNfDsLVxc0TAx6113jlx1MDAwMexx/DpJXHUwMDExfDZzZTvhvnw04Ss8XHUwMDEyOllcdTAwMDVgXHUwMDFmXHUwMDBiqP3fXozX3lxuKfZj33gwXG5/01x1MDAxNmJ9/+Kqj9NAxFx1MDAxOFjmvIYs0Jn3/9ZcdTAwMWEgXHSlXHUwMDAw+ONqtnRMXHIzy5tG61x1MDAxNDBcdTAwMTFcZiQhZJ2RXHUwMDE3XHUwMDE04DFcdTAwMTbLxeSorfO8XFxcdTAwMGLp11x1MDAwZeUs1ejNdnFNYpG7XGYjh0nptjtdNCVcdTAwMGYnp18rpzeHXHUwMDBiXHUwMDAzYfvAXHUwMDAxLu1cdTAwMDChcaRsy1x1MDAxMCSZ18DAmz7PgmhcdTAwMDSj0bMtQF9+1aNcdTAwMTXA8I19cHX4OIydTSriRqDsXGa0g5JcdTAwMTSMLmOmMF/RXHUwMDFlaFhDrn1cdTAwMDax9qPqQjODiTM5XHUwMDA2qVx1MDAxNodccnqFMXA87KjZhTNcbnj8IFx1MDAwN/z8esEsVHhcdTAwMDOdyzSQ7DS8/IZOicHffe1LPFx1MDAwMZfU98tcdTAwMDcjgtbGXHUwMDAzXHUwMDA0wVx1MDAxM2RliaJ/PqH951x1MDAxM1hcdTAwMTb6glx1MDAxZqDzXHUwMDFmXHUwMDAyolx1MDAwZlhcclWWyP/GXHQ7t7lxJOCxno1bdoy9XHUwMDAzM/l3N+OtKOTAnZnPpUS4m/5cdTAwMTFks4O8MXzD2fpOXHUwMDA3fVx1MDAxMmruUElXtTuZnS/x+bukTMzTOX6hhy00VOA5jfpcItJl2sPNXHUwMDExXHUwMDA1Yd6JXmBTK7JcdTAwMTamPHxmXGa2tk7ZXHUwMDEw44JeKvKDRymiZMqWUVx1MDAxOJps7Zy6XHTIv3tIXHUwMDBlaTdcdTAwMThrOZ7RZjA32Fx1MDAxOWZ8mGN2vPa3Tlx0jrgvpHfp31x1MDAxYj27XHUwMDE3fqDTXHUwMDAxm1xus/7rPztovfmeXHUwMDFksZF/mHTWSlx1MDAwMmDtXHUwMDAz+Mh8y79DTOxrNFx1MDAxNLjWXHUwMDAzk/yKK+U0oiHH9Vx1MDAxMDew3KonqFx1MDAwMkidTPi9VVx1MDAxN5N0XHUwMDBmSoGqJGxeXvGEUdGBZ1x1MDAwNWp38Nmnsz16XHUwMDBme/GtzVx1MDAxNaNfm+6yiHKxQlx1MDAxZoZcdTAwMDVKXHUwMDFlXHUwMDA06e89o1AnuVx1MDAxOG9+LNkgXHUwMDE3lY5Pc+l1NJmrpE2cnSVcdTAwMTKG7Vx1MDAxZGz0XHUwMDBlJ4dFm6ZkOVx1MDAwN3ZcdTAwMTRzilxyL2xLNsHA5V2AgnucXHUwMDAw51x1MDAxZlZHqK1XUESuMlx1MDAxZS5cIpRcdTAwMWa/clx1MDAwMpqAyFx1MDAwMjP5XG4h4bSnUi5cdTAwMWFXIH79iPqYkz2pfTsjJril0UE9YH6sbFxiSKw4XHUwMDA0xce4/nmnXHL6807milr8SO3rjyYtdFx1MDAxOUFZ6uaNXYTtd36qpjL0XGJcdTAwMDDPTSrW8I7BwGNdLqWg1q51hE2KXHUwMDFjQN6LXCJ6XHUwMDAzXHUwMDBmTFx1MDAwZvs64yqsT9rGXHUwMDBljlx1MDAxOE78b4Oq1ctcIkX32Fx1MDAxYvfcXHUwMDA2e6tcdTAwMDBcdTAwMTHvtZ88XHUwMDFkeFxm5bOirNNcdTAwMDM2esLlZ33fKdvdKMic30GHUrx9VZhLKyw4/zUnzMk+5e/PgXr384NuNVx1MDAxZHP9XHKK55iLPGKKv/7UXHUwMDAzPHTw+PvtqVx1MDAwZSmo13GM9OuF+V7Pu1Ncct03XHUwMDFlXHUwMDEzf1x1MDAxZHqifITzu1azdzeEU1xi7eMq51A1QE1TQaS4qYknm1Ok09JWWolWbGZei7RiKUszXHUwMDEzNuxv1uGQKnGq/pVcdTAwMTlcdTAwMWVcdTAwMDNcdTAwMWbYRlx1MDAxNce0XHUwMDBmZVx1MDAwMVx1MDAxYlx1MDAxNvCewb7ag0ZWXHUwMDFkusxncFx1MDAwYlx1MDAxNICfSXKQId+arJG1XHUwMDFk7nL+9TC6XHUwMDEyXHUwMDAwJjVcdTAwMTRcdTAwMTPxJSQ4YFvXcl33wVx1MDAxYafcsJmfXHUwMDA2r71U34mdjK7kdj3CrdRcdTAwMTd8XHUwMDBlPrVmjUr2k7t+5V/vv8fvXG5cdTAwMDcrhvD19+40q18xS1dcdTAwMDOXtCtpZHur2FT7fqohhcXGtDinxzVcdTAwMTKLWFx1MDAxYvWsu2PYvjwpXHUwMDAyhkZ7mrpuvmGaT1x1MDAxZVx1MDAxY1PlTMO/dVx1MDAxYVx1MDAwM8qrhq7Gv7WtXjpG6fafl1x1MDAxNGP8+XS5RIpmuDJCgO3iuHf3rlRWONflPKMqtKiy3U6RK/nHLCfxaN0rbnj5iSAgXHUwMDE4XHUwMDFkXHUwMDFioe4yeqm1XHUwMDEz/e9+Mb3RxbKY2kl4yldcdTAwMWY0XHUwMDAy0N2R7TlccpRcdTAwMDORXHUwMDE33VVPXbPIxE9cdTAwMGZcdTAwMWPKl4ydZf6/+lx1MDAxZahfKs9+R+62XHUwMDBmfenL71x1MDAxZfNWedVcdTAwMGJhi1x1MDAxMI1WWIqk1j6lkSG+vJtcbjS+yphcdTAwMDdjNVPtXHIjLFx1MDAwYu+wcvzwqkQ2XCJTXHUwMDE5xofa3lx1MDAwZeojn6pj6cNcdTAwMWJ+XHUwMDE3oyxKXHUwMDBlMFx1MDAxZKZVQsO5XHUwMDFkXHUwMDEwXHUwMDEzj1xiTOiP0t/N3/p5tt83MmjO2Fx1MDAwYlx1MDAxZsUyr1xm+OdcdTAwMDeiuS+KsV0qL16yT6Dd6eflMk00u33fsnggzf3m6i7DXHUwMDBmnO4wn5ybhy6HbVx1MDAxY3Q0n1nvN5JcdTAwMGLHkSZcdFx1MDAwYjP3UEBcZlx1MDAwNErEXHUwMDA0XHUwMDExQKeWVvq2XHUwMDFiL1x1MDAxOVx1MDAwNFrzLfLWjFx1MDAxYXLJMJPjeMdcdTAwMWM1VVx1MDAxY2VmXHUwMDFhTHz9iFx1MDAxNVtU/1x1MDAxNN6ZVcxe+57W9FFcXHOb5LVvl1x1MDAwNEXL4/tsr/zxQZLgtNymSdpcZu99jJ9pNMdoNaPzkbWu8dJbj0T7qnTcWVx1MDAwMqMxXHUwMDFkfedcdFVcdTAwMTRcdTAwMGafXFx1X9GJn/OrUVx1MDAxMFx1MDAwN0UnzmTb35168VJ26lx1MDAxYoM08YPwoPZLgVOxw/VoR6zUXHUwMDEzW1x1MDAwNNVcdTAwMTj4zFx1MDAwZmZcdTAwMDGd9StcdTAwMDLEVCPoIzVF9n1GwFx1MDAxY1x1MDAxYa9cdTAwMTRFKTYpz81MYDTmREWhVTVMYyzu4X1cdTAwMGVDjDpcdTAwMWKYfnik8Vx1MDAxOFx1MDAwNNXt2aekXHUwMDFjVbJev95Jo5I+l2PJXGJthsaQXHUwMDE0iPLkIIppiF7jrJyG7lx1MDAxNUn3XHUwMDBmJIFZ5Fx1MDAxNFx1MDAxYlx1MDAxZMSnUG3xkeDnypVBxlx1MDAxYfSMKZtaIL53zUpcdTAwMTNxXVx1MDAxZHxcdTAwMDRTWlx1MDAxZbw7rL8z2UlcdTAwMDSo/dDCXHUwMDExOM+BNl57XHUwMDE0IzFn0uy+QU5YT7RcdTAwMTDWcq2QXHUwMDFlo+1cdH5cdTAwMWOe6+5vj5/D2DL0OVJcdTAwMDXmnaZ4593Te60q3f3pVis8wl1cdTAwMDHeI1x1MDAwM97jXHUwMDE536tvyEqTXHUwMDFlP/ZcdTAwMWXz/CiM3/u2dG/miDIy51wig27ydttccoTKdYfcc1x1MDAwZnb+9SjYqrwoflWoQmh2jTnDN42Te7dcdTAwMDWA5++kOs1+2qKiOpf++bjhnYxRqk+5XHUwMDFlvlx1MDAxYkk1dqDPcm93OonnKFx1MDAxN4xT41roelx1MDAwZp7qqsyeWqpWzDOW+PFRNizVNSqeXHUwMDEwPSNdl2xZw81OtP07TFiW8HhwvFx1MDAwNJNcIiupXHUwMDAwXCKoPnWCZmra5ZXYLFQvzlwiLnrFJ8Gd504veOBL2ujly1x1MDAxNNtTXHUwMDA2I1PSpP/6y72/ak5gifpfXHUwMDFjNaf7fUsjiO5DN//82IFcdTAwMDGhzV9cdTAwMDe2vk+Ar3/jkoP6Z1Xxmrot4n9cdTAwMWWAXHUwMDE0Qcn0pDnpJ1xiZVx1MDAxOSaLckFcdTAwMTFcdTAwMTlIXHUwMDEzlKvQXHUwMDBmXGan5+9CPG+46/1m6KglY5iGXHUwMDA3PKRMszbXt3fDs1x1MDAwYiet+ErDXGKkSSxwarGvb4DIyHs2OyG0r56ol/1uWVwiJnnaXGZfs7HhkY5cdTAwMWIpqenDSyF4ilfYXHUwMDBiz0rfyr1JXHUwMDFi7mGwvjXK9/tcdTAwMTZJRO6Kt2e7OmuSxr1gU1x1MDAxOePsy3Ols8lcYk5jXHUwMDFl6G9dozftd9XV/61rfMLgMad/61x1MDAxYeK/dY2Fhb+/99ndO65cIvVZ2rBcdTAwMTNhXd9cdTAwMWJcdTAwMThcXMBcbj2GrLJ8XHUwMDEzyJ5cdTAwMTRvn1x1MDAxNFx1MDAwNypBLpFcdTAwMGL57/zL9Vx1MDAxZVx1MDAxNGydtYQtXHUwMDBmnPz+zlx1MDAwM5FcdTAwMWOabv3pqTE06Fx1MDAwYlx1MDAxOKtY34G88XM+4Zm9XHUwMDE1baO6P1xudqsyUqdcdTAwMDegXHUwMDFmIVFZvdxcdTAwMDc6ZuhOdlx1MDAxYUWi1E5VuJVcdTAwMWVgXHUwMDFmu8LUh2dcZlx1MDAxM8zdXHUwMDEwrJBcbrJXtptB4clcdTAwMTc3vHq5McYtdpNoXHUwMDA1U4DoiyTUXHUwMDFmiqmy8lXHfFxun6/xXHJcXE/jmLHKt0OvYrNcdTAwMDPcyFx1MDAxMzHvYPU+cyXOoTegzz7uJZ8tUFx1MDAxNNaUXHUwMDAzum/TXHUwMDE4cVxucdJ3wbyG//q7wuZ4VmebKNXvvuFQeE3LaXDgXHUwMDE5yc/0t3ZcYn2x//VvyVx1MDAwZkRlKqg+tsYwU6NHXHUwMDEzgPlOw1Ha0cK7WLni9EIgUjZ9pIKNW78zosj123xVRKlV1Vx0Q1ZcdTAwMGJ4XHUwMDE5wT3rNTGldXnMm/hCOSAzUl6MjSB9L9aat625o7pffopcdTAwMWR7h/d4moHCxuBcdTAwMWThoGeCce9cdTAwMGY2vO/kXHUwMDBivF2GxFx1MDAwNN34m5RcdTAwMDadveRccrZ0uFx1MDAxMdotsDJHXHUwMDE22NFcdTAwMGLmQ4hmL2rWqeg7IH/rQ208mV55XHUwMDE5XUoqXHUwMDEz91x1MDAxYVaJTK+qsnggacVOUmVGoUeP1Vx1MDAwN1x1MDAxNnDg61xywEt4Vsg3T8JD9GrxXHUwMDE4XHUwMDBl+zDPWozhXHUwMDA0RSOBtSGcrvhcdTAwMTeLaVx1MDAxNVx1MDAwNumSfGJcdTAwMTCLPPF/sfjbJ9icSPayLqX84GfEt6hcdTAwMTFFXHUwMDA0OqNpzpRev7ChXCJoV5LtV76VXHUwMDBiXHUwMDFi/T+u3mPLcZ6Jsn0gXHUwMDBlRCO6Ib33njPRit7bp28q6/v79rrzzKokXHUwMDEwXHUwMDExZ1x1MDAxZiBcdTAwMDBcdTAwMDBcdTAwMDNcdTAwMTSMyctxZiNcdTAwMGY8753ASFhcdTAwMTQr5E1tzjtT4Yhj11x1MDAwMTCAx09+v1x1MDAxM1x1MDAxMTfEdz84S1xuv2kvyW4o1lx1MDAxN7B1XHUwMDA2aXO//ZhxX1NauyRvwv3kVHSqlsdcdTAwMDNcdTAwMDLAnj8sckLQt0o+5XTUXHUwMDEyuZBghGmJ/rGy5/esXHTDb79cZuxg2WWFz98uZ5w6huOabkSDdkuklz9cdTAwMDNO236RXHUwMDE1ZDBcdTAwMTGkrWRcdTAwMDRcdTAwMTK/T1x1MDAwMvvuVkGW7Fx1MDAxZFSw/F0syHQu6IlAsyCiXCLvikfQ8fqiXHUwMDAxMoTzLfXgv3ug/1x1MDAwNvNcdTAwMWOzf/Ho1sHPtZbZXHUwMDEzj1wi+svvf/GYp2lcdTAwMWHRRVxikS+sLX46+WOrXCJ3ulx1MDAwZcY/YkPOr3ZcdTAwMWX58XfPas9qxs3pYlReXHUwMDExuO+v+2p/54nd3lx1MDAwZsalSvdcdTAwMTfw2t8vrUHceohcdTAwMTf5hC9V2Pdfjy9cdFx0q3K92ugrOCh63vfK1t9cdTAwMTdcdTAwMGVcXChjz0Hw6H4/pvFq9OjXqVx1MDAxZrVcdTAwMTc6j2VcdTAwMTJcdTAwMWWMM7dTXHUwMDE2XHUwMDExzox21S6sqlx1MDAwNTfDQFx1MDAwMd62oi2zXHUwMDA1Zzcj1u/7JOFXaOZVZM5cYlx1MDAxMHeKZ15C8JFGu+S+KVxi+7iflOc1VM5cdTAwMDT1d/6GXHUwMDExREWfRMxb1ExcdTAwMDHn9ZJ+98SaYFx1MDAxNmNcdTAwMGaJ/DGXalx1MDAxY9Ji7r978lx1MDAwMe7wP2/H8inHXzulXHUwMDFlMNN9mFx1MDAxZFx1MDAxYzGowHdcXLtcdLLIXHJD15E3VIdQY3N17mO7v+8hx4GvdOpcdTAwMDcgXHUwMDE21nSCPqsx2Z85Rn1l9Fx1MDAwMNuq41x1MDAxZNmIp1x1MDAwNtvzwFwiIaLiWrEvy4uif+eRiOnLimCqxUxVr/XXXfk0dCqtXHUwMDBlU79cdTAwMWR+/XVI4vy0xFNh5tBXvq3vQVx1MDAxNe9VZlx1MDAxM4bht1xy7b1cdTAwMGY0wFqrfcvJsiEkJ89Yd4RasF6RuUwlXFyQqDz70T2Z4Wt8uXXnsCo+XCKg8lx1MDAwMOhcdTAwMDEhXCL8Wox3wVx1MDAwN32YWYTUn1x1MDAxYqP3UFx1MDAwNmFWVVx1MDAwN6hnXHUwMDA0hpNcdTAwMWQvvJWFtcpmnJQ3bUBexFfD0jc6XHUwMDEz3K9fzHilZ91dUlx1MDAxM7K/e263RHXA88PFgnxTjlx1MDAxMFx1MDAwYuZYslx1MDAxMWDUNbpcdNonKUnPXHUwMDAxMlx1MDAwZlx1MDAxOYtwOcVwhmq/Xoza+J2tTH536bxe/oxgUIbIV9p8/GuZfIUkIIP9XHUwMDBlXCLZg9KT89/mdkVBzn53dTitUyOmpG9kXHUwMDFjXFxL1L2mIOPvLf7rJVNcdTAwMTTrllx1MDAxOS3jUfSZIFx1MDAxN0lcdTAwMDQ1ijr4ZFx1MDAxZthF8qDCXHUwMDBi64NcdTAwMDJr573/7up+mXpAXHUwMDExfXmPYPRbs5lcdTAwMDUksEC2XHUwMDFk1+yNTy7JLcuRIPtcdTAwMWLevXrbIfBcdTAwMWXeYIvnO4TKXHUwMDBm2m7gXHUwMDE2al1cdTAwMTPXXG70mFxc1ugxT1x1MDAxNpRqkz0nPS68nX38cnHA9194YFxu4Fxi81x1MDAxN8b0XHUwMDFiganpXHUwMDE35mL+kel9PPnK+9vDXHUwMDAx5sA7v9HfXHUwMDFlXHUwMDBlb/32cCjxg9QrPIevWJ47XCLlXHUwMDFm73Q/3um9XHUwMDAz8P13N7NIIOZ9v+DfXHUwMDFiy+ZcdTAwMTb1Si+DmWm/j5tcdTAwMTbwyIJaXWpNWoyHcvlcbjmHLbe+dKg/XHUwMDE5hFx1MDAwMa9Xa9v8uo+ItEtoJyjjNDzpXuxFSi+YNlx1MDAxMC94XHUwMDA2xiu+uZOh1qNkXG6SO62vnE3E8FbeXHUwMDAzK8nMbn5cdTAwMTP+OFx1MDAxNWnRm6ZErpnaXHUwMDA2XHUwMDFlapswjF9cdTAwMWPHxsqjUIizc0asWW0pyleLhCrHl5HjWN9cdTAwMGaz7advSYDDyDWneq7VNWiDoohLrlx1MDAwYvDCctSFXG5cdTAwMWbO/PBlXHUwMDE0iEG8ysXA8lx0mcZ9z7z+XHUwMDE1t7vveIKEQDUpXHUwMDFk2yXAXHUwMDAzy+gopXE8XHUwMDFhllx05IjJaqyP5VovbFx1MDAwNoLkxVx1MDAxOYrMfVx1MDAwNL4p4pq1kmii0IfERcyyn0HG7zdcdTAwMGU+XHUwMDA1e1x1MDAwNKh4QXA9p24jk6DxpqLP2r5cdTAwMTX187ZGkD5d0lx1MDAxZDGwXHUwMDA2urRdlIfmz15881x1MDAxY1dP0O3sap7wbKRT2kjEdUNdS9iaqksrrixoNP2Yl3l+svQ0R/XCgffnXHUwMDExflLJbZJG/Fxyy4RcdTAwMWW55eZWryOogFwiWXvoQ+DS53HIXFzzZXxeW946fIRcdTAwMTNcdTAwMWbgUbbj0Vx1MDAxOVx1MDAwYsTa5Vx1MDAwMOWH61x1MDAwMvnk3FiIblx0alx1MDAxOL3o7uW3XdOs33naXHUwMDE3p+O9Pu6z/HFcdTAwMDBcdTAwMDVzXHUwMDE5XHUwMDE00VFR10VcdTAwMWa711x1MDAwMl6jVaA0rlx1MDAwNESKbV1cdTAwMTdBXHUwMDFjipCQXHUwMDFkXHUwMDEwllHT9LYo81x1MDAwN5yTisfg+2HMwudZsFx1MDAxNvHu5l5cdTAwMWFm71vNwkNaXG4qJcz9NVx1MDAxYdZ0IDJpMKR2106tMkSCaFnJTHU/61xu3JNvyTW72Pn+VEk/XHUwMDA2YFwiy2GirkhcXOopXG6mt8/oR4GjXHUwMDE5h3BcdTAwMTJ4o1NXTFx1MDAxZFx1MDAwMGSmJN8xN309sSpcdTAwMWXv2/+eQi2LZ8r7fs3LhmtapuW1kSTkWFxmqzKYpTCfatVCq0XPd/Hea1x1MDAwNtl9Seh3L/xKxURyXHUwMDAxnEKUptK8XHUwMDAwdYXLgCp4aF9he0NgXHUwMDEzYyuWR41UZvVcdTAwMDefXHUwMDFitinydGSYXHUwMDBm6d9cdTAwMTLq04tIrECat5TRk6J8uzrpJZft5VrcTd5cdTAwMTSC2/dF4tfmiaG8kFAwM0pLIMVKUaVcdTAwMDTuai3sZ/n+dWuJJLtL5PuOd1x02oVcdTAwMDb3rlx1MDAwNe6Xd9VIp4jeJ3dFS0JcdTAwMGZ8I85cblpEh/SrXHUwMDBi2eE4lddcdTAwMTTqM1x1MDAwN6BOQW33+JNcdTAwMGboXHUwMDEzePjrXHUwMDA2MMXH4Lw+XCLqiEOty6h83qKgTlx1MDAxZo9taYWFcr3kaMd3W3kvcODVPVj63ZWvWu4k96bs9fNuLfn9iVx1MDAxOFx1MDAxMFx1MDAxMIQmXtluXGZJ3dRLIMek9aJVXHUwMDEy+1x1MDAxMmK+v1x0XHUwMDAzLd0y5jYn8MLXp2ZW1WUvM0a9tnR7Zn6GR2v1/Vx1MDAxMFx1MDAwN0TfUJnb6/b9QffDzsB9XHUwMDAxouC+5OMuwHMgknpEXHUwMDBl/StrdXbJUEqp7m1OXHUwMDAw80JcdTAwMDaXMs/mPpl85sY+XHUwMDA2XHUwMDFmO1+C6IFW/YNf+YLCybqlXHUwMDExsMx8XFxcdTAwMWJcdTAwMTNFqU9cdEFTZt5cdTAwMWUtSDVqaTy5JbTQk0ohMqVcdTAwMTdN/cbPNdu5/N1BWL1n/l3n9Vx1MDAxYShANvnOXHUwMDE21uy3hGNDMDM4TjKQ1O9cXMxcdTAwMTCS6LTFWaEkakVJaIabwN6vheNfQHjALuHv7q1a9qtBvVdVa1x1MDAwN16bzlHuk6p9M/a0rHrPwKdeRl2aceaxlNQmXHUwMDFkh7e38ifbm1x1MDAxYyxcdTAwMDDSxJEv3vm3XHJouD+S7CXw7nv8jlx1MDAxNG2s686jMWXveoDdzntcdTAwMDaZkuq1Z3Ake4v7PDFcdTAwMTZuQa8mPu1wnO/V7jlcIkzIae65M1pyzbNcdTAwMTg2Tn3jXHUwMDAzS+zviVtaktuoerRGkPjHXHUwMDEzS3XDnVx1MDAxYdBVdHs9jN3ERUhcdTAwMDI36Fx1MDAwZmeIr6naklxiSUKIXHUwMDAyXHUwMDEwpUa+WMwqWeowe96aeOzY+KPMwLPxysnXdVx1MDAxZtrJXHUwMDAyXHUwMDBm0V3H877JUJVkrlxmYlx1MDAwZtqNtjddXG6rXHUwMDFlzE7ERMSWr0VCprFcdTAwMDdT+tjP87v5XHUwMDFl8NdTsG2xcqNFXHUwMDE2Yu6GWYLbXHUwMDAwOKVYvLMjVkw0XHUwMDE1vfiipFx1MDAxOEe/a81cdTAwMTaOVe22le0x5lx1MDAxZORcdTAwMGWxXHTYyFx1MDAxYeRcXN05XHUwMDAxJ36+cFwiXHUwMDAwMsGwN/5V1EzRq1x1MDAxMeG9vOPRt4RgYVwilz5cYnCIXHUwMDA2Y2ZyurcpUI5cdTAwMWSRNVNkXHUwMDE0KJjS9ONXumB3JVx1MDAwMlaF40OPRqs5XYEzjOV2Z8o1QyuLXHUwMDE3fDz4i1x1MDAwMfv4XHUwMDA00OdcdTAwMTdAcPIhMsHuULg/XHUwMDFh0qrY8m2qPb/dzDtk8NtcdTAwMTTiVlc20k8+XHUwMDE4IFu80ndcdTAwMTNcdTAwMDbf7X5jPFx1MDAxZDZxQqgk98x8i6NRhHmDXFy6h1x1MDAxM1xyx3suXca5zoBQcTfHp41dXHUwMDE3e4PohL7MgWNwbauiXHUwMDE1WMrod4JGoFx1MDAxZdt18FSkXHUwMDA0h/uWrmVEdKp406ReWIMz0/E2ZTP0XHUwMDE192LDYVx1MDAwN7WyNFx0VrjJc+DSK1x1MDAxZsS4w6uITYnXY/KTXHJvzJiTKeQpMpzeL5DmXHUwMDAwfOieUFx0ynJcdTAwMTVcYu7YMFxmY7v67yxmg+ZcYvvkXHUwMDE3a6QjLWA/3Sv72p4qxaqVuIhm/4E+PIvJXHUwMDFkPlJcdTAwMGKjqFtcdTAwMTPE7fCZMWOZI1x1MDAwZm5e3LFunFwiXCJghlDtpXVSXHUwMDE0f9dtLy0/1jdOgVx1MDAxN/DhIL8tXHUwMDEw/nXsoCvBnP3TvjanTMbZXG7DM5GCR02VXHUwMDFkNFx1MDAwMme5XHUwMDA0k1x1MDAxN+/eqpt26IZg08G3XGJU+sqCILb1p8N8fCuJXHUwMDE3Nt7rXG5hoFx1MDAwNM4uLmevdWi96yTnXHUwMDA0NMtYuHE9ZU+GXHUwMDFk62Y3XHUwMDFhOnit2er7hrNdiVxyMmdlp9tcdTAwMGLDpEio4kv2sFmdMa5/dVK7Kr548dvO8Fx1MDAxZVUyWao4RzQ3dPpcZpEqXHUwMDE3ypujf/3A7sJcXKnT1Cf6RtPJb/A5K3RcdTAwMWWHsphRen05o8Ev4DaGNq+zXHUwMDAy22Usx6FnVflcdTAwMTQyu97wNXnMiIJcdTAwMWWG3dQlUFx1MDAxZlx1MDAxOYl5eTPfTFx1MDAxZlx1MDAwYkz7XG5cdTAwMDPsUZNWgCn65HHbruOgg5gvrDX4J1xyU9juZTl9rZZcdTAwMTY94lx1MDAwMZsgk2mX3t8sfkmQkDZuiGbQeXB5gzehXHUwMDE26VlcdTAwMGVffedYXHUwMDAwlXDGe0xIXHUwMDFlNo+LXHRcdTAwMWaPcmPuZq8+1lPO/rLGK5s5pVx1MDAxMk7tJp1cdTAwMWSfLLXHb1x1MDAwN9TTTVx1MDAxZleatmkp7lnHW+d2V79fjqu6X3Rlx0aPgkCfKdxz36hcdTAwMWSbRKCq4r1T1nzadVx1MDAxMjiTj5SfjeNNevhcYl9cdTAwMWPaXHUwMDAy8vN+XHUwMDFmlWDpinvRSUquo++QM9pcdTAwMTG4SDlcdTAwMTQ/MMdHnm1cXKmbQ4OZj6qpyjb0T1xu0Wg/0mm6XHUwMDFhuc1cdTAwMWXoO1JKya9tfMJcdTAwMTM9UMesK8NCj8BcdTAwMDNcXGlWPkLdqKlcdTAwMGJcdTAwMWI7e41cdTAwMWXIjlx1MDAxNX40Xu/46O64XHUwMDAxzVx1MDAwYrfmpizGl7Gqq1x1MDAxMDGHkizvjFx1MDAxY3kylVxilLK1x40mofuFat1tlDn6xtZQctQl26YtPWBUnkt32MVcdTAwMTJGjtX9WJDMIEdcdTAwMWSbz7f803q1/Kf1ZvG7g3Ut6sX88ljQ16oge1PvXHSYp3PIk1t8far4sM+nXGJxb6Gp7G4xXHUwMDFjqyhcdTAwMTKfuqyGrlXKXHUwMDBm0qdieV1cdTAwMTlJNfd4OFx1MDAxYm3opK2wk1x0P+Z3dSXfP2EwXHUwMDAypuV6rc9YXHUwMDAxrH5cdTAwMWVcdTAwMGV1ZmfAgFx1MDAwZk+U6rlpoeGF0rfFcMb9zGxcdTAwMTTB7oAs/VlJ0u1t62OnR0vbs1x1MDAwMFx1MDAwM7z0w2GoJNZ1i9q39bLay47G6tvbXrZAxDfBUWROm24qI5P3lOdjtd/rXHUwMDBle63JRz1cdTAwMWRZK2ZcdTAwMWHVXHUwMDE5XFzENbn8OETQenSGdCNpkWSJZ8aEj3pcdTAwMDZ7KYZZ7OGO9ExcdTAwMTmW3EdWP5P6XHUwMDA0XHUwMDA0N61veMpcdTAwMWLLwfHf5eyrJ/yawGtcdTAwMTl8V4icUED0SHZbeVx1MDAxMWY3Zlx1MDAwYq3vXHUwMDAy6+fhS0JcdTAwMDLTUdyC8K1K3VxcJzTYJ/9sJjiNWUFiXCJZXGZ5qJiOzP9etKK4lrN8e7HUeCZdmFx1MDAwYmTCO8B/9VOe7GS7PfrM4s/3TUs+eIav3542ScK/XHUwMDA2VD9WVX+4Urn0LEeJR31Wi/a+3tEvP2rS9L1cdTAwMGZl8TKvO1x1MDAxMMRx36lxhdj+XHUwMDA1/ozOQVx1MDAxNseX54j2XHI9XHUwMDEwRo0/jUbAV6mnV2gz9Fx1MDAxOHZGbZkq+DmBSH94nkteXHUwMDFlXelZLJvmbNtpRMF6XHUwMDFjvVx1MDAxMVwiL6okXHUwMDFi5TJJtKMpN4Uo81p2S2dcdTAwMTeC11FcIse8XHUwMDE0fEbfXHUwMDEypr2lXHUwMDFiRu9wNS77Q1x1MDAwMkGW3LQ49PNcdTAwMWLd42zdYKRMbZiGM9x8caRjXHUwMDE07pi3W7fCJStK9jv1XHUwMDEwfJWktLX4Pj7xd/34b1x1MDAwZiXRXHUwMDA3l4GI3mP/YOjYTHqNXHUwMDAz60vS/ni3q6Vtn9/lw8HmXHUwMDA3XCKaX710bIIktMlXcFJWXHUwMDEycMibtVx1MDAwYs6yXHUwMDEwkZf5W8fOZt0+5sCwWCVccquprS1V1jD0lWqCnVx1MDAxZTg+fc46ymC7i1xmW4tcdTAwMTT44NaF5pnv+EkvTliRz9ag+i1Jv2tA21x1MDAwNzbhQFx1MDAxNa1sXHUwMDE1zzDJt/q+iCtidSxXdFx1MDAwZVdl90GKXHUwMDBi61x1MDAxM2zevLV7futRIGhcdTAwMDPzN0qAL2XQ4Vx1MDAwNjlcdFx1MDAxNFx1MDAwZfFAWZRuZ2Cu+UhcdTAwMGKcXVx1MDAxMkpsczp8QVxuuS+bdlZcdTAwMGXrUG92smiFXHUwMDA1Ouo2XHUwMDA24mFb/DZcdTAwMTNcdTAwMTSag1x1MDAxMu/iMtY3LFx1MDAxNCRTMVx1MDAxNqSQY9/u2lM3hDKwXHUwMDAw7bzoWFDvn95qeVfTXHUwMDEw9rtWNvvKXGaNMVx1MDAwZsVcdTAwMDb89NmGWrizXHJcdTAwMTFcdTAwMGXYmeuA8ypcdTAwMDFcdTAwMDS3duW531JR2Fx1MDAxMa9cdTAwMTmL+/PDs+KxyJK5rurx7UesbJFcdTAwMThcdTAwMGbEem9cdTAwMWHNMDHt8OrPZTw0aXNcdTAwMDfhJau/3v1rVFx1MDAxM5pcdTAwMTa+/SWANXhv/fxcdTAwMDLWXHUwMDBlolxig+OYqmWGmy7682ui7Y0oJlx1MDAxNy8h/HtcdTAwMWRhXHUwMDE1/Dn79UA5XCJNZrdplf1ykyavXHUwMDE3njhcIlx1MDAxNVx1MDAwMOcun2lcIsu+Y82o7nx4ymZj3FblQUMgtscjPZbLVChXYuoz3yfz6GxcdTAwMTfXIGhpJmtBJJQoy4QpSKx+eGdcblx1MDAxZVx1MDAxYmVcYqy9a3bZh0apyqk4jS1cdTAwMWIpskYmXHUwMDA08LVcdTAwMTaPVoZcdTAwMDFrxVx1MDAwN43pUNRTKy5AQVx1MDAxNUg7laSH1s8v3ccq9fxcdTAwMWLM9/mZh19cbqTPcKTpXpHg9P5AcZm2wVx1MDAxYcmNuVx1MDAwM3u5xfl9LMI+TLrY97Ew7Fx1MDAwYrhRXHUwMDE4e8XKSynRLJRPWiifkohwffPV1bHq3Wf0ka9cdTAwMWJb6sc860a6RjJkhLTT8j4qPDbnnLnAt08/X1x1MDAxY7xCqFx1MDAwNcBcclxm8k9t6PJcdTAwMTfuQPtCbFx1MDAwMvfUkmjFXHUwMDAwdWRcdTAwMGZVzkW3sznuv3Ex9iecq7FRvlx1MDAwNF3Ywa0mZYck/dnEQtEmXHUwMDBiJDJrhFLaeObKXHUwMDE06NTS3lx00r9cdFxiXG7e3p628MvK6n5nriVcdTAwMDSkXG6WvN1cXLi9sjfk8cxlYFx1MDAwZlx1MDAxNehn9Vxmm4rmro97jrxcdE9h7ivzW1iqUbIgplx1MDAxZvXzdGj74nGRXHUwMDEyTilYI1mYIGHSXHUwMDEyuKbM10GHfuSQL4B1nZQ83K/Ox0itdGHMXHUwMDAxldJX1XRAXFxU10Bqwlx1MDAxMMUxdvBeXCJcdTAwMWWxsvd7qniLWiBcdTAwMTNPJkFdn8KjvYFjzo/pp7VcdTAwMWJihOeI94dcdTAwMDWzT6z87uZcdTAwMDHco2zu4PfoJ01ptThcdTAwMGVHmj/FXHUwMDE1Kzs//vxcdTAwMTc3n9nHntSAMJxcdTAwMWP0ZnpDX176rs9kJbYtiT1wW8A6pMGmvkp8XFy8WFx0XHUwMDFimZ2xRi6b6GNh4EO9jnCj32RcblSei5lI0OrvNN0uksSNpVdNb1x1MDAwYtCY09uRKueZUms3iDUkXHQjb+Vu3k3evfRpk1x1MDAxNGK2h+x67Vx1MDAxZmSF07dcdTAwMDXFgLtEOLo+XHUwMDBljlx1MDAxOWRQqXmLblx1MDAwMsRMXHUwMDFhtvhqJF7ymkMzXG55XHUwMDAzxfhF6c5/sj7yRlx0iEBcdTAwMWNLpX5+tGjs9L1pJeqZOefqs1x1MDAwZWH/aU/WJdvVfPjHn3SNKpqcV35cdTAwMWEyJlx1MDAwZTQrir3vN3zCNiY6XHRS/HLBnYT1cmm9XHUwMDA07VKCNuVvTNeF575cdTAwMDBmJDtcInhPkodbXHUwMDE00d/RWHhdOu7li1hcdTAwMDBcdTAwMTdqlHRoVDZcXMxloPiLpNlWyvV4y4PrQbrjqOmYqexY8p6BtObVStpGtnxwqGvWxVx1MDAxYtGmUOWogVx0d7NwhWFSl2hGp1x1MDAwM9xBZbmpK+29wpVcdTAwMDDLptHJXHUwMDFkXHUwMDExQrhcdTAwMDW+tZNGI1jEnDZp0VqPhINUjqemaLfiXG5B3SP/asrNRVx1MDAxYra9W6rps2pQXHUwMDEz66Lktlx1MDAxYUk6esJjwk7V2Fxm0lxmltkr5t/7TDP4dc2Tl7qR0Fx1MDAxN5C91iaFg8hcdTAwMDZuXHUwMDE21DSZ0owxM1x1MDAwMTdcdTAwMWWM/JBTpFNj6NR79ObIrDCG1aY7rFVcdTAwMTPB3byZaFx1MDAxN9Zj4Fwi3jNcIoCjIDXtZjxGu1xcrt5xxDotqTEjMsx9ayNcdTAwMDLTx7lBzofzhtVjik5cZlx1MDAxMlx1MDAxZN+7SLH1+DrxVu9AlLzDja5cdTAwMWaRhPd3zYKOXHUwMDAxl4ykpJBpxasjY8TjXHUwMDEzXHUwMDA3l1x1MDAwN+TfjcblXCL6fvhR3Fx1MDAxZMFstUenpuj2PLos2nr4RIi/7ay65//4pEqLrIieyLBcct0zoK9HXS1/j8p8TpAzi5JcdTAwMTiHj1x1MDAwZfjId0/WjSh+nviBVPLHJkVcdTAwMWRXdCxl7G/e8ayz+LXSdFx0sZfX0GqAzuqKJGFzMmpholHQac9cdTAwMWb3ncXTdFx1MDAxMHXE6LBcZp1cdTAwMTVFVl3oZ/Q8mOhcdFlcdTAwMDRnXHUwMDFmSGxcdTAwMDDaPlx1MDAxMVx1MDAwNZCYOL5cdTAwMDJXnK5AXHUwMDAziTFe7a+mZvH5XHUwMDA2T0tBJaRcdTAwMWaopO/h11NcdTAwMTcjXHUwMDFlQ1NcdTAwMTJNfUGc0eKuhPbt6Fx1MDAxMder+dUnr1cgyjr67aDePjjuQY14uu7HXHSTm0A5TpB+uVdcYnGS0lx1MDAxNlx1MDAxZcyoXGbj0NZcdTAwMTScXHUwMDAx/6FkwVxcXHUwMDBlX1x1MDAxOTNR+OicVX7CN1xcP76PgVE8YZYvLkJcdTAwMTBZ6uCsfvNrXfXMUMIoa2BcYq6K9fiG8Pt6TFe8go73uuP3vL3Mj55/OYHvTd/tOIawrof0XHUwMDE1uN/deYZezPa4XFynXHUwMDBlkebTP8P02WLqZpHtgnmERIngVWxTnOV7UMcrgFJvg90/y473OPZ2LVx1MDAxN8TFR7dcdTAwMTTSJHwr5XzBYlx1MDAwZlxmMC1MmpuzlFx1MDAxOZ9kXHUwMDExVnpcdFx1MDAxNFx1MDAwZVx1MDAxNEGDvmmXTlx1MDAwNDSd2VKWQWJZPVx1MDAwMKyfXHUwMDFj8jIlXHUwMDAwXHUwMDE2qEVcdTAwMWawrr7NoznFXHUwMDAw6rpM07IsPGlcZlZccuVcZq2sXFzHYbDlO6ietPydXHKfoE1bokxcdTAwMWR9ZaprnZGEXHUwMDA2+LxcdTAwMGbmsl45sZQqXHUwMDFkLZv7O3UhxZbwhDfV1VbeXHUwMDA3XHUwMDA2rVlXqlx1MDAxOPDNPuVWlSRcdF3fjvVAhlx1MDAwYuQk51x1MDAxZm9GXHUwMDFiXHUwMDAz5Vx1MDAwNZLaTVx1MDAxOFx1MDAxZsgriLG7v3NSbCtvvGy+UVx1MDAwYu61gaZb2eKOaO6StWPcUVxypc/f01xyV+70gmhcdTAwMWFcdTAwMTfQfuyuUEDlXHUwMDA3O5dEUExxO2wlnUuOucCnXHUwMDFhIzvf0t5XSFPtYdVcdTAwMDNcdTAwMTlJyWGjpzLXXHUwMDA2bbHSiX00UfxcdTAwMWVpyEdcdTAwMGK/XHUwMDAxOjKqJ98qYfzoT51cdTAwMTKoZlxyjYm4yYCRTjxcdTAwMTKU0HwsXHKSKHhKXHUwMDFlKKRcdTAwMTM7TJoundAmXHUwMDE1jYufxDBxi/nNXHUwMDE2/ZZcYtx9I263NSCMXFw2XHUwMDA1XTZcdTAwMWNl9jw0vDsjwXZGPVx1MDAwNXjBvsSPQ1PpfIGitsWvUXc38nT8tm8zn1x1MDAwMc72cVx1MDAxNb3EfFZYmbxiZEk9xE1Ql1x1MDAwMJtaotei+lx1MDAxOVx1MDAxZfb3RjY7LK/I/GDtZ1x1MDAwMZLCwr5QqDFsmWsgamArepxcIlXprOVaXGLsZ1x1MDAwN7WpvJ7hKGMpuYcjN5bLepVnPbgt7Ps0XHUwMDE4i1ZuS0mZPGRZSWa9zlx1MDAxNeOPtdG//cPWXHUwMDFkrVYuXHUwMDFkwTpcYp21wSrwY1x1MDAwNHwsP4wkr0WULq3CQdI2aVn9XTOeWbT8jVx1MDAwNbiLP9S63NmUop1Aoln+W12ILVx1MDAwZlx1MDAwM1x1MDAwMqahzvc6vdhcdTAwMWRccuV2XHUwMDAzXGZJOd8wemS/J1ZxsGT6myHnWqZcdTAwMDI6q29cdTAwMDbO7S0vXG6nmlx1MDAxZl1IXvCHJ7+4bmSwmVx1MDAxNP1Fi1x1MDAxNHfG4YtcdTAwMDeTllx1MDAwZl798nDo7Fx1MDAxMk2QZO9F1G+EfzBHw4BG9oFTJJrxxyBGXHUwMDBl4loo/bdGtpwp4NdWRY2PXHUwMDEztn7rOt/B0Vx1MDAwN7Knj1RQqyWs9Odv5Fx1MDAxZE+gmlx1MDAxNn9cdTAwMTG15Fx1MDAxOLjRgoTfXHUwMDE49q28w5uwh9kqkNTR/Vx1MDAxNe6DXHUwMDA1Ns+xIIigxD/GN+ZzJ1x1MDAxZe430lx1MDAwNp9IsFvj/crN5z+GwDvur9dcYryO843HRFG89q53x6lcdTAwMTlYMFiqY+S8iCVcdTAwMTOtZbTd1DNkgz/MzupcdTAwMDdzJOZcdTAwMTlLXHUwMDAwRaP0ZCjD4ZlcdTAwMTLQzk29lVx1MDAwNIUuutdrIZNcdTAwMGVcdTAwMDJcdTAwMTJcZmNpNXTvy86kgkH1OrjHIyH7kEPixVx1MDAxYSv8LaXn+9daXFy1q6r/6clYhcl7XHUwMDAzxYc532RcdTAwMTjz1sXEnena1EFoLH9HSIaQeF4+Zlx1MDAwZqa1XCImfm+wmsk/r8cu7ZFPnaeXQ9M+xFx1MDAwM1xir9XpWzjSciapXHUwMDBlY5s9XHUwMDE0/Fx1MDAxZM+QVvVkmevVXHUwMDBmXHSpNvFTgStcdTAwMWSe1FxmjW9LU0FVWVx1MDAwYpI2jVx1MDAwN7ijNTVgPEWM0XGz+/1cdTAwMTitJ/M7iI5pvlx1MDAxNPmMXHUwMDE5LVx1MDAwM6m6OiD7K/eKWIxm/rtcdTAwMGJcdTAwMTewfTIzUqRTW5zdwVx1MDAxZGxcdTAwMDX7f/4tM6JiXHUwMDFkff3f2peZg+s8m/9b+yp2jSw3euRbkoJGUZK7iNQ5lj1cdTAwMGWt14tcZimggZQ/2oo/Ui7WbzH91N+/XHUwMDA3WFx1MDAxNS6QRr45XHUwMDAy51x1MDAxM/3uqsdL6LY2UE9cdTAwMWH+gi0w/0rw9Yw3vUElXHTXeMb63L1IvLpcdTAwMTbruuC4zHtYRUNcdTAwMWRqf/BMJSFnSLKKbf72/tpCy7FLYL5fu1RcdTAwMTHinelcdTAwMTJ+tMXxXuduV6+DYTn609CKOvaC4Vxmulx1MDAwMSuoXGKfTznpmFx1MDAxM1x1MDAwNUCuvKLJiL3y8fXKp1NeQXZH/3w9tpqWQ6W2Q082n0lcdTAwMDPVdJJTNWtcdNJOXHUwMDExSI9/XHUwMDE5Z1x1MDAxYYNGnqvyXHUwMDAyWJFyj5P1NUh0XHUwMDAwQ1x1MDAxMP7rXHUwMDBlr0u9dZBPmaLS3eyDf1voOF3Qlm94XHUwMDA2XHUwMDEwQu5cdTAwMGaaXHUwMDBm+apcYkVsJlHSXHUwMDA1z1x1MDAwMO+ioOGGyP6Ynlx1MDAxN8EmSyCoXHUwMDFksfBoyuBm11x1MDAxMkT9tcmnKJlw81Xn+nT9vHS/7khccrWfb2i/ikpcZqfMM5q4xDT1V1x1MDAxZiTZ0D8j05klSF2obXhLjrfv3HPLwFx1MDAxNZpWdrOHXHQ/X+kqWE2SNX1ux+EjXHUwMDE0Q1xypeivL+nxL1+ReVx1MDAxOOTHXHUwMDA2TSk4j92MbP3hmmy1xPT+Ulx1MDAwM9VcdTAwMWTLXHUwMDE32/pcdTAwMGVpt4lu/PcgXHUwMDEwUexEa8aezFxmvD499Drsfta7V99RnCdNXHUwMDFlZdjpXHUwMDFiwMusXHUwMDEyzSc+zWQlxSRcZvx2x1+9ZttcdTAwMTRxvFx1MDAwMNLHgI5KXHUwMDAwPOLUrMZcdTAwMWRSflx1MDAxY/OwX4eIXG43aLbkM7RqwIaeu1x1MDAwNctcdTAwMWKsS1pdxVx1MDAwYodcdTAwMTLr9Fx1MDAxN+TLXHUwMDFkuKpj9G8tXHUwMDAy12jZXHJp6WFcdTAwMWa9mlx1MDAwMZVcdTAwMTNVlzDZw5h0e1x1MDAxMYWNevxcdTAwMDBcdTAwMDcu2v/WblL+Y1x1MDAxMFx1MDAwMaNJMcs5MFxcyfiF01x1MDAxZpTlupeXdNRcdTAwMGJptinAXHUwMDExXGaFXHUwMDBlgkts30BcdTAwMTV2NeHUeNe11pdzXHUwMDBlllx1MDAxMVx1MDAxYzOl1/GF5OqPLVx1MDAxYlx1MDAwMVxm9HBSiNp1eOCAz0u6UsxO3T6NMUE//9h/P/47XpiVWnQwXHUwMDFlXznVY9dcdTAwMWIpNcC7xcs7/MJpmrdcdTAwMDKM21xiXHUwMDE4zHoriDp9s8TO3Vp9lzRoM1RcXLg87FDLr241Uqtd9c8rZdS3i+WmwpuE+d0/01x1MDAxZpj4MN6pOKbYf3/bi/HiV8RP8ON2pSTpMdvC45nZqKxcXNphXHUwMDE5jUSYN66pap4kXHUwMDAyXHUwMDBlSaRXwrg3jo6Trj3AVCuIXHUwMDE0eIrHxVx1MDAwMsWYXHUwMDA1M9TE8Vx1MDAxY0125CtllPj1zlx1MDAwYolcZthcdTAwMTJcdTAwMDZLrnpqj5+FQqAqkfwq79t3XHUwMDFj40lm59fxXHUwMDExf6CZoHzMTuRHZzg/a1DIXHUwMDE2Jb1BfzrZ5C7916tQwjHfXHUwMDEzXHUwMDA1x9XCjDS1VP6/38JcdTAwMWNcdTAwMDFzbTWJOYSdXHUwMDFj3vdBU2PUl/nJzVXHqlxikS5FklfWXHUwMDFiYqFgXHUwMDFk5l1cdTAwMTDUkDzfqLposM5jOFS6g9OzXHUwMDAwYdR0oGdhSE3+WPyWXHUwMDE5sXep152OQ3uQR1x1MDAwYnwwzUhcdTAwMGJccp3F4bfDXHUwMDFl7/KdjUK0zfm0XHUwMDFj4Is6Sj9xdSZW/aGEiry9u1x1MDAxMSdOfVx1MDAxZYJoWGNcdTAwMWX88WbcXHUwMDEzPEg+kfjXZ7D1ypZ8sV+eqtOjM0/cutyNYZJwU5VcdTAwMTVHXHUwMDA0XHUwMDEwOlNYVDdaXHUwMDE1XHUwMDBlUlxusYqttFx1MDAwM8WmpTlcdTAwMTZg3cyk1VT9QVx1MDAxZe1AWtfyN2S8yVHpktOG8Vdcclx1MDAxNoajkvhnXG7xJ1x1MDAwM5yhlkVcdTAwMTJKe6X9efbh+rhIrpXUTPGfOutY5Fx1MDAxNuPcJVx1MDAwNsHk2uE9t29cdTAwMTdcdTAwMTPPWcGyXHUwMDBme8z2Q8suk+Dy2lx1MDAwZexaOapumJNcImpZtTtcIiSafmuD4M1cdTAwMTKDhVx1MDAxMjO4gsDjUd/ldlx1MDAxZj/fbSDX48rR3G/fXHUwMDAw44jK37fXXFzvezPzr8dC+tdjUbjUr18taEBpc1bMgeNkXHUwMDExXHUwMDEwnL60Wlx1MDAwMlxiWLj8XHUwMDE0e9j0XHUwMDAwutarh1xcXHUwMDEy+oFcdTAwMWLXQYcxdT27ucSTMr14l3FMcmd0QTC6lHv1XHUwMDA2Rb7I9zxCXHUwMDE4XHUwMDEx+823mFx1MDAwN0r58Fx0XHUwMDFiXSdcdPBAi1x1MDAxMu9UVj/vMtt7XHUwMDBlK1wi/lBepHrkqbp38n7Ul3MwZdbmXHJlsn7RIVxun3YyXHUwMDEzStlZcrVcdTAwMWRRPlVcdTAwMWbfQ25D+lx1MDAwYjvdmlx1MDAxZPG4PtzYx5O3tieuMbJi/GOJWoVqMVVcdTAwMWVvelaeR/+Wv+RcdTAwMWVcdTAwMDFcdTAwMGbuYVMyi9reXHUwMDE3STnR1oGmuFx1MDAwNbAgXHUwMDE5/Yr4vIJ+PoYu/IVd1iP97CWeXHUwMDExTlxcTEGj6Uk5OqqS41x1MDAxM0niUFx1MDAwYlx1MDAxN0u9PDjAIFx1MDAxZVxc+idcdTAwMTZHXHUwMDFhxt3ZTLJ1W7SpnV5ptu7Um5xcXPa7crQnXHKHiD1lS1x1MDAxY/PXijPx8u5uNjBcdTAwMDGYy9j0KWYgXHUwMDEz6TH8wV3uykpcdTAwMDW7hlx1MDAxMF6RqFDfvOnp0HaubdKMuvVcYlpsKfRXxaIh9D2T2Vx1MDAxY4A4XHUwMDAyKodkRJWyaIbgtH186lxiXHUwMDEy20swVeufTyXyzFx1MDAxNyqp+t1PxX9pSa5iktTomIpcdTAwMTWu0d1WcIdmXHUwMDAw8mKmgpptXHUwMDFhpDFcdTAwMWPgNUywZFx1MDAxOTCkdUolcY9cdTAwMGWVXHUwMDAx2Fs3e5AvLjK0ic0mXHUwMDEwVENcbtdfhin1f29pOaTq7kf68NHXXHUwMDEyyVfxXHUwMDEyZOP6XHUwMDE40lxy3e7l3FxiMjiK7Vx1MDAwMlxu1qTG2FrAQUhcbv7dLimhrPHx2JZUjsMwN+XOyVx1MDAxMlx1MDAwM81cdTAwMTbKVeAnyUVRX9WqXHUwMDE0yCRjofdcdTAwMTPTc5Az+e/F+4uDo9NcZkzpWtaeZ3/9XHUwMDFlPYjyW2p6XFwpfIpP31YjXHUwMDA1XHUwMDA2slx1MDAxMov03/xDwKFcbqtcdTAwMGXPaz77UVx1MDAxMeIk8EraXHUwMDExq1LGKYw7sm2p2JnAhrCjUsGDff7l/XyMXHUwMDE3sldflM9TncpcdTAwMTGcaMGXXHUwMDBmKPVlznzXhXWu2XNwXHQjbPd7SeO/Nr7Ycry69fZNjVfLnG8lg1LKhV+6jI5cIjs8XGadTjvs1VhP9qBqepH9IVB1XHUwMDBiwYJbsdxcdTAwMTG9XHUwMDBmVLDVeVx1MDAxOUJcdTAwMTOMkMhcZj765VvefWfeWtnz7nlcdGWeXqQ4XG6Ds2tuqUP3omJapFx1MDAxNWFcdTAwMDUqMfUzpud5ZsQjpWPgQqT4MDkhXHUwMDBiV1T6Y/SW9cRJ10XfXHUwMDE0XHUwMDFmLejz/KL1ty99L/1j6XRaoltB/UAt532n1jXzs/0sgci7g8++K6Sqv8NL+N/evahi3WY/PKRBI1xm37FcIjPEW03EdVx1MDAxZGE0hNbjqJiw7cTmg1wifo7FTYxcInB+U5c4IWeOOiYkQy6mr81cdPNCiKg9hN82Sdz9XHUwMDEzTlxcMFx1MDAxYpvy0vMvXHUwMDEwXHUwMDE3xVx1MDAxOX/5sHCre45cdTAwMDVcdTAwMTVSnVx1MDAwZkcublxcXHUwMDEzmIFGxWnJdctjQaDpXGbGJVFzXHUwMDFleGFccqjMmFx1MDAwM8dp521Fk6xmXHUwMDEztlwiMbu241x1MDAxZFxyXHUwMDFmvlNcdTAwMWYyXXw09cBcdTAwMTm623l0XHUwMDE1w1KVW0TZXHUwMDEyfNwnzW08bXFcbqpx+qNcdTAwMWZOQ5VZ8DtpIyhu9b/9lvP9XHUwMDEx9mmK/Ta0g5ecU0vyuyREvdNcXPYsipal74OCi1BcdTAwMDOWL31sbctcdTAwMWHQyGiJXHUwMDAzs9Xkd0SGcyYtW71tXHUwMDFmmFx1MDAxYktZztWcK759JyvzJ+9cdTAwMTJ1XHUwMDA2t2zZ4c9cdTAwMTZccpgwrembU8VP5p5cdTAwMTXOXHUwMDE5fK2YLcNcdTAwMWIxLV1fXCJ9+6Ns7VRcdTAwMTCnUsFcdTAwMWGkbS9MxniPXnfAXHUwMDE2aCx6YOCjju5T7SkwhuUo36aNs2nNoVBcdTAwMTGSxd/f2tddXHUwMDE22r9vLMyEvFx1MDAxZYf2j9tcdTAwMTG+8+v+3540ffzfPWlcdTAwMGLUabLtfFLqR/Vs10i/XHUwMDBmopDCU2E4RpKph/XiyvvoXHUwMDE08SiUmSjyY6HFoIdU7X1oTDY+dflcdTAwMGI46rueXG4/iS0kOaKhb3Y5wC0qXG6cXHUwMDEySLVTZaFcdTAwMGL+ZFo3vFbkXHUwMDAzbUeNVvjWR/eyhuv2bePU90s9alx1MDAxOM9hPlwiXHUwMDE4MZSHq729N9TXoTf8u9fWXHUwMDFiXHUwMDFk21x0OfAhkfAv5ydRkL5cdTAwMTZJZFKJ7DqmU3joK9w2tJVcdTAwMGVZpGb5XGJ/Yi9cdTAwMGbRsJyvP36Pxp/iUjZZXHUwMDEwa9k6Pt/VRyEj/MdcdTAwMTF8OLdcdTAwMTf69WXMKpzftlxuJZjrNflcdTAwMGV2d5eXKuBva65vwXH8rVx1MDAwZqPb6zE/XHUwMDE3vK3RXHUwMDE5x1RwPpOeL/0zhFx1MDAwYlFX26tcdTAwMTBUy69e4/dWXdJcdTAwMTFcckdcdTAwMDeP5bdHL0ygXHUwMDAx2vpBfJWzwFx1MDAxNXJcIpZcdTAwMWSNLGrtasFcdTAwMWSRXHUwMDBmuZ3QKyRM2DWGZpEl0nxsqq1cdTAwMDaMkFJfKlJcIkGw2rRJoOBccrdcbuM6QtZcdTAwMTIwhLhcdTAwMTFHiZc7u4BcdMr06Vx1MDAwNLJcdTAwMDCV2jF2n6J1uC42+1tcXDDrcVd9XHUwMDBlVSV8Vlx1MDAxMS/HTChcdTAwMGLOTvuTQ1UnpvngkWrmt93YQFx1MDAxZNxfz1x1MDAwYlx1MDAxY3V3t15cdTAwMTGxPVx1MDAwM+UwcSi+W8HufnuVk4TSmmvOQ+nna7B7oJQ7JOgvXHUwMDE3/JZX+M5cdTAwMWZcdTAwMTC506iOle33dKOUuFx1MDAwZeaDJsc6kvTEXGYgf/B3PJZPxJaJq0upXHUwMDE1XHUwMDBin5N+w2F8u6/Ui52sybAwfUxUXHUwMDAzXHUwMDA042NcdTAwMTJeJ1x1MDAxMCCT4zQzheLFxi3pUzf6K+D7aZGXXGLz2rQwsye7qZgjNMNQZ0RcdTAwMGVGgV5dNdXShKbf8W48tYPqmMF6XHUwMDFjXHUwMDAzt3aNhMmrlVx1MDAxZGzTRlxugDnZXHSAmklV2tdi01JcdTAwMDRFsiRoqZRwXHUwMDA2SCQ5ck1j+GSLuFx1MDAxYZAzXHUwMDBiXHUwMDE5zkw//46naCH0W/GPv1x1MDAwNziOcdRkXHUwMDE4V/9cXJf0WzP6//ZzfZNxOHWYs2aXvL99XHUwMDA3XHUwMDBlJyjohlx1MDAxNFpWXHUwMDA1XHUwMDE0PVwiOlZ7ZFdcdTAwMGb02LiC65u6vFx1MDAwMDfZXHUwMDAxrWpwsYI15Xc9mP/lUHIsXCJ9r1x1MDAwNYRcdTAwMTboklx0g9qRXHUwMDE5VU6uKFxcfNfQMlx1MDAwMXfULzGpJFx1MDAwMGRcdTAwMWTtZcBQPey+fuRcdTAwMWGWWNp5XHUwMDBm44K6XHUwMDFj9dZcdTAwMWRcZupdaKrnXHUwMDAyMVx1MDAwM0rzxF5cdTAwMDKlsrUq7pnvz8dPm1x1MDAxOSasgVpcIlx1MDAwZlho4ZSG7zSIt1x1MDAwNdnFXHUwMDE5IFx1MDAxZkm/ytNwXHUwMDAzXHUwMDAyaF2oXGKxwl5ZwsdgP4/aiGzfkPbbm1wigi39et9/+UegrIxcdTAwMDc698u/nTH+yz/OLXhMwPqr9Vx1MDAxZaA+3pE+ZVx1MDAwM/p9xlx1MDAwZqKtiXf/t8dbWbYztF5KNlx1MDAwZl5cdTAwMDCC0ZJDdGjSjeiQ/8K2z1x1MDAwYihcdTAwMDdx+o5ijpdcdTAwMTYrXHUwMDFilVx1MDAwZW/Y5l+F4t9cdTAwMTeeNSxcdTAwMWXeYVSXyybNurlcdTAwMGaGdZStXHUwMDEyRJjP04FErWQqRX6y6lx1MDAxYYMgXHUwMDBlJpVcIuXiy6yVXHUwMDE10FnKbZqlQMVcdTAwMDKzXHUwMDBmUlpBTz5aytKYKJ3Wb+VtJtA7Y3ekkc1cIo/801xuXHUwMDE0yFx1MDAxZCXq8Wui68SK/VXER0mZXHUwMDA0LfFL4Vx1MDAxMNmCeZBQwFxuXHUwMDBi1MfP1JzfhV/qX1/ijfydo5KvrkUy/lx1MDAwMd2FiYB78aZcdTAwMWVcdTAwMWP1ZngkQnz03VDR0LFcdTAwMDexXHTch1anWlT6y4VuITYglSSwzz3V8ITCp/gk9eLH6oP7Oa7ZxL1t39ruuKY9ofc32KeYeupFh2t4j9w+2J5o30xXXHUwMDA0QUNVUqnnXHSlSndcdTAwMWbZ+3vj0qbqMEDvg7WqVlpBTVxcuHbq725AyPRcdTAwMTBcdTAwMDWBjqb1JdGU1Vx1MDAwMvlcdTAwMTSccfuKzVx1MDAwMVxcPXRcdTAwMThBldiVd2GO71x1MDAwNsJcdTAwMDfs9GZ9if/WIKRcdTAwMTN1tWXgXHUwMDA2XHUwMDFiXHUwMDFhXHUwMDFjR3pcdTAwMGaxnEqHJHOmvjy4/eRcdTAwMTOEfbtK/90hlNqKR4r+XHUwMDA0XHUwMDE1XGKcxKTGQSS3h+1bXHUwMDEz2JE8kV9cdTAwMTON4+tcdTAwMDXnVZ/+gH89NJqAo1x1MDAxMLxcXFx1MDAwML5cdTAwMTXEXHUwMDAxMWJdXHUwMDA0ga/GI1x1MDAwNJHjmbBcdTAwMGVcdTAwMGUh4N6aV8ia7lx1MDAwMM5cdTAwMTX33eJccrLf6Fx1MDAxYl1cdTAwMDC8YOB4wu73bzngXoJcdTAwMDR43LvRgOJCPmVNfLEqxfBvXmKpXHUwMDBiXHUwMDE2OLxIXHUwMDBmilx1MDAxNr70WkviwVx1MDAxMS0gJFx1MDAxZt7q+I9cdTAwMTJnw5clXHUwMDA13NhHRm9cdTAwMTjcLvHJsVx1MDAxNs5bu+OJW8n7NNLLMWj6KcuEXHUwMDA2imOFqXO1PrZah+9Ik3hT4i2qdNyu5N78fzV51GDjXHUwMDAyz4i5UvcpbXxcdTAwMTOtssjgJ1x1MDAwMVx1MDAxNGqd9ytenMLaht/JXHUwMDA1UUPsXHUwMDEx81x0ToJvXGIweKCoqZlsXHUwMDE4rYupXFxzM3GajlxuXHUwMDEz6z3DXHUwMDBiXHUwMDEwUqbe9Za/hELPivdT1UOfQExAQFd/KtwzW3LE0+EpzjDMfNP+o7MvcDnZhT76Q85G9tKDOVx1MDAxZHdcdTAwMThVuH7AMvx2gNyWXi91fSafuO0sXHQk3KO8XHUwMDA3Rlx1MDAxNLxUXHUwMDBm2uev31ZpKIpJXHUwMDE5XFyZXHUwMDA1KJFrl3L1+bGw5Vx1MDAxNq7acnlB60eGRDdtjbJpvU5Jojatzlx1MDAxOKMpaGZcdTAwMTS63CjNtuL6/chcdTAwMDbyRYNyYKKxXHUwMDFjUtLzxb1pKS5cIlV/PTdOXHUwMDFmXHUwMDBi1zt1mKeE5+G5/tazXHUwMDAzRVxiMvdCo9XAjH1cdTAwMDZesSFcdTAwMTjTKSiaXHUwMDFi28roY/5WJfPDQ+BcdTAwMTRgZPLRdot4v6pcdTAwMTZFiVx1MDAxM0BUTe1cIsWd0dif492ybFx1MDAxOZisx2FTXHUwMDEw+fBRSVx1MDAxN3LfdZq4LTdleFx1MDAxZaleT1x0J9ig+uZcdTAwMTJcdTAwMWJcdTAwMTYvLCN28Vxcflx1MDAwN4tcdTAwMTWoeNyi4r9EXHUwMDE416GJ7uAn1zRWw9WgsXxB6S768amsJZSNTWPAtjJcdTAwMTJcdTAwMWT2sE+FXHUwMDExP755m1x1MDAxYXHBuFx1MDAwM5snmjdErzFa9n9pueNcdTAwMWNXXHUwMDBmxYirafP27W76RFx1MDAwME84aTKiUkQu0bLl2/xemMW/kLyj/tYj9Lw5v374q1uM415cbt5El2K5wmH88+TwP0+OPp58XHUwMDBm9I+CcF6/i3/rh7BcIvPMM0FLY0VVXHUwMDEz6NbQ9C5KfjQ4gMe18OkyRrikRl011FT15CqymonhXHUwMDAwy6XpXHUwMDE2JNLX9jxcdTAwMWZcdTAwMGV3yX/7wGd2zn6+7/hFXHUwMDAwaVx1MDAwMYzZSVeFO05cdTAwMDFUvmZKtlx1MDAwZumY+Vx1MDAxNk3fp5/TXty9t1trONaerUGKXHUwMDFh+Tsyk0SyuFx1MDAxOayQi0y4gVx1MDAxZOnvnFx1MDAwNKYlna6uJ1x1MDAxNq+lX1x1MDAwMVx1MDAxZe5cdTAwMWR//lx1MDAxYp3BTlOqf/7bXHTskKg522FcIpg+yoZDNSDYWFXFX1x1MDAwNFx1MDAwMUFZ+FhJaJhR+ElcdTAwMGWyXHUwMDEwIYzMi8+NOlx1MDAxYvWEt2aOo69+XGaZJd5cZmzuXHUwMDFjXHUwMDFkZ1x1MDAxZn7pcHFcdN1LU3Bq/OrxQ5xcdTAwMDcmQdt+qeotXHUwMDA2vrGM31JcdTAwMTb0pcDDKH3NcHC9Pk9ZXHUwMDA0xSY5X5pcdTAwMWOjStliR1OL7/3Dr5E5XHUwMDFkLMc//GPIqJzpXHUwMDAzbXztXHUwMDA0xavJWF8pXHUwMDE5UeeWL4LH523fXY9Rg2ziTYxWOFx1MDAwZlldKI9cdTAwMTZVXHUwMDFmJZUkwmCuX1xmuVDzyowhQiv1Q86Bs2khOXFcIqYovXmiMFx1MDAxNKjo3Vo/bX8q/+JcZlx1MDAwZmr8euxjWo3b8PxbK74t7r++6PgxV/UwofHPXFytrf+dkvPIxflNtE35LZ/6zzJCXHUwMDEwtWJtqerr7MhcdTAwMWTbhonWqI7f721cbivZ/Vx1MDAxY1x1MDAwN7ibQNi/RjTBMXpcdTAwMDSTyeaFfF5cXFZEPXWfRld2wlx1MDAwNPr1IE1RikFcdTAwMTOrXHUwMDAxas2M3685WFx1MDAwMtPR30b+1VV+XHUwMDEzOpTpTqdcZsqnplx1MDAwZt5cdTAwMWPM0sa4h3d0T8l5XGJsK9lSbz+m3S/gYZ1+YlGk9/JcdTAwMTnrWmnE5vONbVx1MDAxZbtcdTAwMGK+Yz2025pcdTAwMGLUgOW5h5U9we1cbtpcIjblj5VTRWp5XHUwMDFho2NOZbi3/F9/kp//3oHSXHUwMDFmXedBfz7De/1/+5PMVnkz1H/rduvwbszbujNcdTAwMDCtUHH6tOLjuLJLx995a3hcdTAwMTTFUJTj2bQvQzzuQPM3XHUwMDE2Nlx1MDAxMr63JFx1MDAxYnOgLWbXiEtZLVxcpOVAI1x1MDAxMjZcdTAwMDe+J01U8/1UZlx1MDAwMHT8U/OwqVx1MDAxYylLsY5cbsvZaTz8IFhgZTg4qrZ7Pol8OrP9n/7X1fJb11x0koSjolOF2YNGLYd2XHUwMDFhXHUwMDA2KLcvU1xuKGNGgVx1MDAwNmrQt63w+Ni/dlx1MDAxOVx1MDAwYpDUkIX99bfXrE7OY9H7Z3ypZTY7jehtVPN+fvy6nFNV659+OaD9vz3DktDZXHUwMDEwKZbpROxg51x1MDAwYlx1MDAwM1LGRK5+XFwoXHUwMDEwp8h8U7pcZqz37tuKcORcdTAwMGVKPlXBSFdcdTAwMTj45Fx1MDAwMUwx9lx1MDAxYVx1MDAxN2FcdTAwMWFcdTAwMWNgQ4y7XHUwMDAxRCaba1x1MDAxNSE0hFx1MDAxN68mRF7xW7y2mCd+655cdTAwMDLZ3/vD2Fx1MDAxOFlHsGQry+xHh/pcIo+obV5fkmhRlmF88XMk45ePWMqRmnkpXHUwMDAzpGQobeU8XFxSov775k7Lp2ysP93MzSeo3JjkVijlt1uY4P42coJcdTAwMGZbnqC0Y90uKFx1MDAwZZF7VTFcdTAwMTdUXHUwMDFl9cg+P17heTePr1xc8smpo1Hz1yepO7WEx4zD/4+b+/Xv7Fxu8r+zK9BRLi/Fo8FCPMnXXHL8jj7HVlx1MDAxYkhD/fisXauFMrdjXHUwMDFkfkaF+kD71lx1MDAxNE5nRUr4NdkwXHUwMDE2iYZP9oCIv7JcdTAwMDAk/SpcZnQreFXmVj3cmzjS1fg7lJ+4updcbj1vTNVYRak6cbZL7p7b7zuNoDBXr/dYg7Zlsy6Z005cdTAwMWF1TNTQl1nOpT9cdTAwMDQ2PlYkStKuPlx1MDAwMHyYQtFea/7vLFNXXHUwMDE4n1Opf2eZZILxcf5cdTAwMTKbcVx1MDAxM79cdTAwMGZkyLfwyv80hnlcbtpPY57UeD8w4b+KeO0ha4/C9+f3cOlcdTAwMTcl71x1MDAxYkF2Oi5svmxoWTr6j+Jp5bu58ftcdTAwMWJgXHUwMDA1RIZcdTAwMTGJXHUwMDAyWMNySVx1MDAxMLZZq77WtNjq/LXmgsXCr49A5lx0XHUwMDFiNsnqb3xcZmzny+vTNDpD9/FcYs5cdTAwMDdntFr3OOSxbelb9DeoXHUwMDBiXHL6jsX+VVbIx8vi5Vx1MDAxOY9fSzxVsXuY/HqkIbcmKWvO+4ht531bYV2r8zbSUHqRSPdBiPxDg9+5gXVjm96bluBzrmc7rYlcYvjzXHJcdTAwMWb/0d/P/19/y4naIJGpt45zRCZlLp+65+RcdTAwMDHNpiPzIVx1MDAxZX69KowqOt7vxpmLIPM80TqXNFx1MDAxY4TkXlx1MDAwMaO9PrGnfGH77N9Vw1ovhfjQqNGHZs3uXHUwMDA0291F3ZAtY23L72N2OZ9rmExigK9cdTAwMDfHXHUwMDBlv0iKXHUwMDAzquFvSIG8XtyU78Fsr6GbNljN3jNcdTAwMTOousnBXHUwMDEw+zlCv+SkmrqE96r3ZqOmsfF+MZrFP14qf7SJWVD6dFxu2y6716ZXXCKmv6RcdTAwMWGENpB6yVx1MDAwMlP/xqV+TLE5T8lQ5S43XHUwMDBln5TwK4azzIT/Qsg7YDH251x1MDAxN26DacaEVfNQZX9nXHUwMDBlXCJLXHUwMDE1QMZ7eFaQblxu+Nezk3kse7yNsLVcdTAwMTZ+XeFpmpCPcnafXVPLj3NcdTAwMWFcdTAwMDFcdTAwMDEl9ClcdTAwMTmjaGyFUIRcdTAwMTVcdPN5XHUwMDExuH3uXHUwMDExJWmXn0SttFQs0cuOVjpIwN5cdTAwMTfcNuOBSUt0X3pzyerQXHUwMDA1XHUwMDE5XHUwMDE4/r2SIEyo38nYXHUwMDEzhDzzXHUwMDAy0D44flx1MDAxOVx1MDAxYa1f8LxcdTAwMGVcdTAwMTi0XHUwMDE56zNcdTAwMGJ7LKB1XHUwMDEz2X+50/lcdTAwMTRm9zRcdTAwMGZ931x1MDAxZVPTXHUwMDBmXHUwMDFln5pCm3XprlJo1Vx1MDAxNupcdPh3P1x1MDAxZI7phumQu8x//Fx1MDAxNY5Us1x1MDAxOFx1MDAwM+hjvFxi31BcdKPjmdp6coqRt1x1MDAwZs2WP3q1aVx0W6rooUX611NteMuqcaPWWFx1MDAwN1x1MDAxN858dXowb23crq2sn6VcdTAwMGaoQXmzxMTDKYjpVCdFXGbGY1x1MDAxMiRmSVx1MDAxN9U7iDrMXHUwMDAxSFxmt1pcdTAwMWaBnNlcdTAwMWJfta1cIjfnYLRcdTAwMDGzXHUwMDE5xoVE/ZdjjWRxwu1cdTAwMTNcdTAwMDOq7zGsgkv8qTDbztz0itL1ZzBYvG9cdTAwMGU8mpvS/ehcdTAwMDEqz3eUctWCfEtgQkWscnbQPlx1MDAwZlx1MDAxYm5cbohGJJjN/SRcdTAwMWW+yFx1MDAwN9D31S7GKl96T854v95S9I/nUYJ8hMDUmn899KlcdTAwMTBcdTAwMDeAQP3YbHH/9qo/RG4wW/hcZjHzxNW8JY+f1MObhYabr9i4XHUwMDAwnuw6XHUwMDAz1Z8o3N1C7TLneV5LdFxupzpbXG7GofGCkDiKfC1QXHUwMDA0n6+v7Vx1MDAxNkR2ry1w8fLovERzP79cdTAwMDXSVGJKXGb+UGAg51eU3IWseLy/0/7Wx6zJTj6QyPF+LF1lN4FcIlx1MDAwZW+VsiurXHUwMDEznnyl/2qlWFJcdTAwMTWM2zvbxlB1R5zPXHUwMDE3+0htxU4r2DbzKXpt1MNFN3pXXHUwMDA2lyfyv3UmTHNa4j/Oav44yz9cdTAwMDBcIt1CpX3YXCKB/F2KsU+tXG63g4VO8+I55kz5/2nmeUhPjXyhg+v75/wusY5uXHUwMDA0rSXPV1x1MDAwZfDihFJcdTAwMWLJZ/OI/DxcbmPQvFx1MDAwMs1cdTAwMGaHpNf4ht7x7zyh+X1XO9t1SGK/eFjKR05HpmpdKtvHXHUwMDFhOm0srpzp1omjXHK+zWjJVCyGR1UrYZJSXGY/VkDB2Fx1MDAwN1x1MDAxNo6NLdLxx069N5SjwLfbetHky6ZjXHUwMDExca27XHUwMDAz1/qnbVxy9PhY/9S+OX7uPv1+c8FcdTAwMTj6de9h/5fVXHUwMDExwVSaf6yeXHUwMDA2WWhs0ve3Vyb+7ZV9yGCjlt7piPxVbE8hg1x1MDAxM73b9Va51ydXujVcZj8uXHUwMDE4SGJcdTAwMWa48bJj1cfLMWZcIpl4PNw1J+ROXHUwMDEyragu7PH9f9h6j2U5mWhp9IFcdTAwMTg03lxm8d57ZnhcdTAwMWFcdTAwMGZccjTw9D+99Z1zXCJu3FAoNJK2unpVrsxlspwm503Xol09L8qqvanzW6GlUH9cdTAwMDK4XHUwMDAyanS+29uqmHU0bZl3ulx1MDAwNb6+T1xmZLeAPVx1MDAxZp71Mlxm+KpMKjWnXHUwMDE37KJcblx1MDAxYbpYfj0rolx1MDAxYio4oSBS26B/ZDmgqr3pblxmyVx1MDAxMX1cdTAwMTBATvxQScRcdTAwMWLMyvXv0MCqUWtgXHL8q2u3XHUwMDA229jK/9S1XHUwMDFkndpm+ldXXHUwMDFi/+raJ77lnNa/QWLCgYOAXHUwMDA2XGI+pCCe7k1TXHUwMDAyNUM/R7w2Mst6XHUwMDFjnlx1MDAwNq7ZxHVZxlx1MDAwNnIv24ZXqKRcdTAwMDKcumNy4bRKXHUwMDE59iB5huVcdTAwMDD/xtfbxWqqI1x1MDAxN1xiWs5cdDmcqE5cdTAwMDOAXHUwMDA3XHUwMDEyZt+g7XZMkb1cdTAwMDOiiyqAXHUwMDE3+tKyQFFcdTAwMTdjyYpcdTAwMDBcdTAwMDffTYpcdTAwMWZcdTAwMGKVSWUrXHUwMDBiv4FcdTAwMTNcdTAwMDbsSVwiXVB531x1MDAxNJFimLesXHUwMDFi9FvOXiG5skut7TsrUPfXbv39Vlx0xbBJNm60iZNV0qe48EGUikxcdTAwMTTOnnHDzSZXXHUwMDA3y2mPzXNcdTAwMTOwUsH6OnDea9e0XHUwMDEwYvUw6VbdxFx1MDAxOaNHey9r/M2vaTqSwOOaXHUwMDE3/85cdTAwMGbEUoasbOm5I6Q5mu9fXvGkXHUwMDA1+sq/UVdLiEfxiSNcdTAwMDRNt1x1MDAwMa6q129+sSd9X1x1MDAxN75cdTAwMDOTcG8q4FeJ/j1cYv3aiPdelCXZVnbsOm7OyNp9Tsm3hFx1MDAwNopud/dcdTAwMDFPXCK0Xlx1MDAwNMCDXGZcdTAwMWXMuo3rtV/rgvZ+XHUwMDBmN6O5tPxrsy1cdTAwMGYuxGhxyHneMVx1MDAxMpjHwpCJm777T25gqic+SsiPXHUwMDFkoFx1MDAxYpdPdW1cdTAwMDeSRIJcdTAwMWYlfN5cdTAwMDYunMq5uMpcYvDel5N84ziujm2SfnKLXHUwMDA0olx1MDAxZq8g76hSujQzfvv1XeeFiVx1MDAwN1x1MDAxOI0gK21cIv04Zlx1MDAwN6Hbw8BtUMi3i5jVNUrILbyz1+d+PndbnU1+RqzNd7tcdTAwMDT6765gMVx1MDAwNjT3LN90eMHicCtgL0lcdTAwMWORLCiO1vLmelx1MDAwNIjjmqlOcU6kfU/IWTPV7Vx0+3vXv716x8aFmrpcdTAwMWF9XHUwMDAyXHUwMDE3oVxuI1wiwJKX91x1MDAwZZu0kVx1MDAwMFx1MDAxNDEz9lx1MDAwMaH+fM/bjFx1MDAxY2Uv0S3/wVAn2di81rgwQb1uqSdcdTAwMTDOVExF8rdAXHUwMDA3hPdWMnZWPJ1Xa41ZMi3zv1x1MDAxOVx1MDAxZXavllx1MDAxYfxcdTAwMDDqxblndvvVXHSXNS3PP345W2ErtFWC9YP+2Gtj7lx1MDAwNqTortffS61iOvinVdJP0n1u9K/W9jdcdTAwMWa8qStcdTAwMTP87Wp5jcIhy1x1MDAxNporlf186FxipyukjcwjPfg+3FRrKEGeJWe3XHUwMDBiXHUwMDAzXHUwMDAw14JMWNvYpElMI15A8ThDXHUwMDEyXHUwMDBm/NtttYetXHUwMDFlpfvbfjTi/j2bJSjqvN9sZYTZVlx0YZZcdTAwMDQ9q3ZcdTAwMWWTaljs2jYqP3jrKl/hVW6gK0mKbIiImbNcZv/8XGLV5ot19b5lk3TJXHQ0dOi4j1x1MDAxNFx1MDAxZptIae0wLs4gSkxcdTAwMTalXHUwMDA3hf2yV7ZP/lx1MDAwZT/UNTGCdqi+fzuuXHUwMDE2Ymzp4mA5qddcdTAwMWTnXHUwMDA2btnvXHUwMDAy+vNcdTAwMWQwuT+eletStCrdVZ5teyMw56uykGFwxflxfFpcdTAwMDRcdTAwMDVcdTAwMDDVXHUwMDA3/s2njug0pdqvpj9cbugyhzrX7VVJXHUwMDFl3JhmXHUwMDExrjhcdTAwMGb22yZY5q6zu0Y2wpUklqPz1j/EI8Eu5m1rkU2SVXm4Lf7pfOTffFx1MDAwMli8XGIxXHUwMDEzcVx1MDAwZnLnXHUwMDE2XHR4tmPqRKbb62tENM1JgJJ00aS9XHUwMDFm0N0+MOk7h5o3JydNw7HLXHUwMDE2a/SU4uJ0/+SZ+bpcdTAwMTjKYvxUXHUwMDE054q4Lmfislx0UF9J7jE5+WJpgIBoZvv+aoV8Nb1cdTAwMTf77/58hklMLFx1MDAwM6j/uFx1MDAwN/LfnFx1MDAxY0DqXHUwMDFj/ZXGXHUwMDAyKWCrWcikRFx1MDAxMVx1MDAxZjt91q10jH/igLCA9S7zQGOVWOTF3ZqrVfsqU1xudlx032WX/VIqS82x+WiFQJtccvisbFx1MDAxMNNcdTAwMThcdTAwMTe+UmBj9yHNX0eZWsdSuuX4dtp4Xuzor56aTVx1MDAwNSb+/Fx1MDAxMdpcdTAwMDbL/U+GJbZcdTAwMTM9enxBJF2uc/FNZFx1MDAwNLA3XHUwMDBiPY076HftVN00g1x1MDAwNrsv6jCuXHUwMDBlTFxiqF/w82hbwlx1MDAxOJIogzXc2JFDbYk0lrYk+Py8XHUwMDE1knFcdTAwMDW6XHUwMDEyoyTj+0RO6t7aPKK/XHUwMDFhIZiAdjfO316pXHUwMDFmXHUwMDE1d/1xXHUwMDEyXHJcdTAwMTJUXHUwMDBie7HrOOCBXG6FXHUwMDE5dL2qXHUwMDAzeVxyQFx1MDAwMsgzXHJa937S+eitXGJUI/vNXHUwMDAxI6FImFx1MDAxY7tqtjtcdTAwMDPCXFxXzjtbhjVmI1x1MDAxYz3M7aLYZYVe3K/bmEvKdrM9NV9cdTAwMWFQXHUwMDEwmO6aPN9Xc3ziJP3cXHUwMDAxNVL4TaZjPk7pXHKu+TNGXHUwMDFmbpRXPlPn1Mx/n1x1MDAwM7FWwP11sbvEZrxpobUq3WB6Zz6QrV9fUlx1MDAwNVx1MDAwNSGMKFx1MDAxZlx0hHzP6J09XFzBM/2BUlx1MDAxZoIwl6msWyX+fHTWPvVUnjr+nz+AylxmXHUwMDFlkk1/vXbzf3rtI1x1MDAxM0qWqX8yQ5tcdTAwMGLVQ/08jr7gg6Mp1NaQbHY6hpHJ7yYvoWRSX3KyW8aj32X9/Vx1MDAxY1wiiyPCsfeOW3RcdFx1MDAxZVFZNrxcdTAwMDS21vtcdTAwMGKo1lx1MDAwM0EkLHPnuXnUgVBcdTAwMDRokaq0XHUwMDE4XHUwMDEw5qWzMVx1MDAwN7x5xr1zw36+YS/xadH16VxuXHUwMDBlXHUwMDE5hq3Vr6ryQt5cdHz880JA14M9wEq13D+8dL9W0dM8p7OVulx1MDAwNU1lW91hOFx1MDAwNefV78Yzw5grN2/tXHUwMDE54P2esdA8XHJcdTAwMGVqdFx1MDAwMVx1MDAwNpeOpj89eHdbWM7BfzFydvOjxuWZ81x1MDAxN7iUoYebNVxyvV6pkuT5nW0r8iqIXHUwMDE38Vx1MDAxY/NstS938PPfudxm8PCSXFzYWlx1MDAxONy8R2ZlyFx1MDAxY8Nx6axFXHUwMDAxtV6xPGdcIpaT+FxcyVx1MDAxOMfWJ+bSuUxcdTAwMDbztKJcdTAwMTesz2ghRlx1MDAxMeNMwlQ1tfIopDqAnVx1MDAxNFx1MDAxNVx1MDAwZfkh0Iz8feuQXHTtXGat5Fx1MDAxNbIwMUONRO8taiwsYnz7i2qq6i1/ra9yeX6oKfPVXHUwMDEz3ILn5lx1MDAxZU03On8k4l9N67BcdTAwMDZDR1x1MDAxZKz4mzG57vrUvOvL/965YuzfXGambVx0d7224yjCutn7Q6/shiRE58LM0mjE39DFqFx1MDAxN1x0KouaRUBjvc9AZLrykWg9Jd6vYvhcdTAwMTBZJIBcdTAwMTR5rdVPi/58XHJaXHUwMDFkXHUwMDBms4+TUVx1MDAwZcxhnPvtjZ9dcUtAhWJmZ1x1MDAxMoIhZKxcdTAwMTN/cTnzXHUwMDE1u760jJvVmlx1MDAxYkZEXHUwMDBl3ny5TU7SKFx1MDAxN5XSeeSjfNzwQ0X3oeu5TerTXGK0+ZJcIildda3j4L+ygKXBXHUwMDBmT3We0FNjteV+y4hcdTAwMTBwnvi1x6fkk3qmmvdfXHUwMDFkNFx1MDAxOG+xLCZyX0TbpZNcdTAwMDRLe+W//lx1MDAxNP3Xn1IlXHUwMDE2+1x1MDAwNidxbvBcdTAwMTPsojNiMMK2b4JcdTAwMDTp7ldOzlVFXHUwMDA38LQyhCg+Sf2OYzxaXHUwMDEwQqjjK/Q7ZC5g4v6AXHUwMDA0XHUwMDFhlp05d1g8j9BcdTAwMTf/+GCHbfvmtZj2vi3Dx1x1MDAwN7VgXHUwMDA0+Mnrl8K+zYbkwbGlPT6QRUftXHUwMDE3MLXbaXi0Zi1cdTAwMTgue8xpoc3Ug2+LU0eB/pthNJelNjowgm5vqNNKXHUwMDFh7iqOvPP9rb57nKtcdTAwMDBcdTAwMTPQstxhUzrT0Vx1MDAwNn5Z1lx09Ct7vlx1MDAwZebHo15/POrGclTx1+DBJTWC1l1Yz/5Ef7vu2W/X/T7qtkF3+X923X9xQMXbVu6fXGJG33pwzkVcdTAwMDWgccRyc1x1MDAwZWZcdTAwMTfs4K+JMoLTZ6RyMeHx+Y6jQeXGiFuEXHUwMDE38o1T21x1MDAwYsaQMMZccsC970V9PSbxnzBOhtH8zY9EgrDtdMjLLrNccrVkXHUwMDE2pD/K9PKhO52IrjWon/w5PJSWg3bJZmzG8D3b21x1MDAwMpguZ1xmXVx1MDAxNIHKQWVFz5FcXGp4yYmkOKbvXHUwMDAyjdjeKVxybFxuKsrQ/IJcdTAwMDb9YS+d8P/vk9J8i/L3sJn5Olx1MDAxZVWCXHUwMDFh0ds8u3ZcdTAwMTdcdTAwMWK0XGa0TTV2MpdcdTAwMTVcdTAwMWRcXKX3w5XkxNupVpxWXFzLyoe+21Jcbm/zXHUwMDE2f2+PV1x1MDAwNcrAe0Y0x1E1cSxYXHRe+dTJXHUwMDE1P1x1MDAxY7iUYZ+gip9rKPmmlKlcdTAwMDSOOy1cdTAwMTZcdTAwMDVcZums3YOv3jzigaFDwVx1MDAxYofrXHUwMDEyaflccmvXajq8Rmv0y12KzKNcdTAwMGJcbqyFjikt77XZWZfJX1ZPXHUwMDA1/G3hKkOLZad8JXtcZlx1MDAwM/JSWqbw35a7ICBcdTAwMWZl2f7ulHMwnYT861unyYD0h7b87dM9SWtFyahcdTAwMGWdN4lifz1cdTAwMDE0XHUwMDE2/nw/ejRg5So6sPg6NaxQ5/KoZXDfXHUwMDE1WlFIapW4R1tkr1x1MDAxYp4nRbD2uFx1MDAxYdpFXHUwMDE3ZFx1MDAxM3ZcdTAwMWZuXHUwMDE0rCPFOOO7Vc9IyMVu3rchrFx1MDAwNetKmmY2TM2dXHUwMDAzKqm2qFx1MDAxZilTKZB47EjKwa9kxsdHU5aFynDGXHUwMDFj1JuH0jRcdTAwMDO4qqDz5+ue6HP3XHUwMDA2PWV3d0Vsbo3luy22rFx1MDAwM2hh9ec6p1x1MDAwMaQ17CnAJsmVKFx1MDAxZVx1MDAxNFx1MDAxZT3LXHJtPEbCwOafoTwxkPdlr+hINFx1MDAxYVx1MDAxZCC7O5t8cpCiTFx1MDAwMlx1MDAxM9+qQY9/98a7d6f+zTXDxL/eWimNbX/N/mua7b3ZXG55fuhccmGe7lI5nb5JnOP7teijR1+oJ02O6e9cdNR0N95cdTAwMDOyRORXb8XrlWSrmZZU6seph2BcdTAwMTlMiVx1MDAxZclcdTAwMGZfYkl5UoNcIlx1MDAxM0G87PtzUYtbKvvMdL5cdTAwMWSs8LGiKzxRVoaCovOuOjWmQI2bXHUwMDE5YqL5jXfsXHUwMDAwz1x1MDAwNvMk6Tps6El/XHUwMDFiTPrV6pknsev34nlYXHUwMDFlT9KZcEZYXHUwMDEz9MN97EDNx1xm+1x1MDAxOOxyXHUwMDFk7iksTpQqrVx1MDAwNLWnceXFXHUwMDE2SlxcM42kdVBfjOf/9PxLYFx1MDAxY1n/V8dQm8F7ef/4g/2PP1gscH3aP7uqoplcdTAwMWT9XHUwMDAxXG6g7yE8te5cdTAwMThcdTAwMGW6XHUwMDAxXHUwMDE0SK7+22Ht/Elo/49jqtJcdTAwMGVSXHQxW+Xb0TFv7qnlO6nw9lx0e1wiXHUwMDA2Pi2x7ChKh1TQJ9fRL3F+WZDJmpRGXHUwMDE1blx1MDAxYtzCcHEoaVav6oOHWnDAXHJcdLaIilx1MDAxYYH9ZeVxsE+jfFx1MDAxOMDmXHUwMDBlq46jzlZGppnoXHT3aC7DLugysDulXHUwMDFhl5F2xU53eVxcIVx1MDAxYlx1MDAxOFx1MDAwZlx1MDAwNpv2aSehYfZ7ZfqtVU+eXHKjld9rjyaP3vvVdo4hy0+wvdff/KLYtfWtRs1H/vc22n9ncn9Bw7KFi9DCLz+NXHUwMDAxucDE703ly4hcdTAwMTSq5HKF/9/5M4Jnr2KVjNVaXHUwMDA14yOZT2ao71LHXHUwMDA1XHK0jStcXCpcZu1ay+N7UDDrs6J0MdtKMzm03sdcdTAwMDMmOSA0/ph2U3dZ/Vx1MDAwZSHawdUvl1x1MDAxNbz5NkfFgVx1MDAxOT1cdTAwMGL2hE7pRf83N5U+nHorXHUwMDFmpuyrtLUo+Lp2I4r1ZChznCYmj/q6XHUwMDFjv8VZSJ73w9kgllxmZ5xsjFV+8qmmXHUwMDE41m/XXGZcdTAwMWKtckK/OFx1MDAwMaMxoyjO511cdTAwMTKF86fVkb9cdTAwMWNzPolQbCbc2sMkXHUwMDAztaBdMH+3Wlx1MDAxNCBcdTAwMTPJQYqxf+hLXHUwMDE3iP8zL/SxXHJlxvTqMENHXHUwMDAw7lx1MDAwYvs9QmC63rdI0EA4X1mooYhcIiY1JuTczlx1MDAxN02Qj+NhLOFcdTAwMWNcdTAwMGVUn55cdTAwMDAqjlx1MDAxOYTgZMYpX1xmq0z50I+SgeyhsWBtxVRcdTAwMTXAo1wiXHUwMDFjvWFzXyWk2KrokiBcdTAwMTjaJ3tcdTAwMTNFTr/pQXw3XHUwMDBm70RcdTAwMTlQ5uh1aVx1MDAwZVx1MDAwNE6662NEOvuFTXeJ8tr68UyTRtTGYFMgp4Oy04WURlZcdTAwMWbXW4h8lUC5xW+gyndccohaXHUwMDE4dZvgxz2WVEmP/eiQf1x1MDAxZVx1MDAxMVx1MDAxNVx1MDAxMFO0vlxu2H99xeur76Hm7e2Kv44wXHUwMDFhlZPfOmzMtrmXf/Xv0WNcdTAwMTWa7HSkXHUwMDAyyt1cdTAwMWSDi/Kck6JJ0Fx1MDAxY9p7++3iRFx1MDAxN3xcIlx1MDAxNeNcdHmww1x1MDAxZZtcdTAwMTnG/sYhMlvssi1vXHUwMDA1b1wia22gWLizXHUwMDAwlsmDYFx1MDAwYukwTeWHK76Hqo6kz7OmXGIhNWLYjt2CWPOLeryH316Ts1KsXHUwMDAwW1xmqdMxoLJaWFNi8XW/XHUwMDFjP1x1MDAwYqbl+5TCQe3rUSWSYKRcdTAwMWZWrs0m/tD58pwm/dZcdTAwMTVcdTAwMTj0IytcbkhrxiiTn4Nf7CzvJUKQXHUwMDE5K37aXT9H4m3anniXvP/rq4Ekqc7BXHUwMDAyoO+Gv24hXHUwMDFhXHUwMDAyh5/9hXrkXHUwMDE5TlUvMuDr90d0XFx2VoVLTqffXHUwMDBiKlZocXNcdTAwMTd88SA9YH9XNz+SgLmeRUCPXHUwMDE2Mf06Yt45XHUwMDEwU1x1MDAwNZ/uKviXr2ZH8sJG1InHL+6kdzexoyjniVUuKGJcdTAwMGL5sOJcdTAwMTiW655cdTAwMWRJXHUwMDAyR+ep8pCn1fxcXIpQdpyolMPKjo/kTbFd4uNcdTAwMDGT5+d/Tr5cdTAwMGLceHFcdTAwMDZcdTAwMGJN+6JcdTAwMWGaXHUwMDEwJlwiXHUwMDEzdvruI11cdTAwMTdZY99zXHJOm7ot/3pFLcuU3LK/RTS2XHUwMDE5RcY86WTZ346XXHUwMDE5XHUwMDE3vzxcZtb5z8lcdTAwMTgvXHUwMDAyoPePoU+C4fapVVxi1ko8yaoy2lx031tre0VcdTAwMWXCoWJcdTAwMDdcdTAwMTS9yvDvMq9gjoUzSJDIlOtSkYahXHUwMDEy5kaK/GyC0ZxfOlx1MDAxMkSoXHUwMDFk+EdbYLHKrHav0zKGlFx1MDAwMd9GL7PYXHUwMDBm2DlgwXnChoAkTVx1MDAxOMYmhaO9XGZvtFvBflx1MDAwMLuWfENmXHUwMDFlT0+irSZcdTAwMTUp1u19bWmn0n1cdTAwMTCznkz87W6uXHUwMDA0JymiPbE7rbJz/Wlxmnru52xjv/7rsmDyXHUwMDFkTeDm1nlVo1x1MDAwZlx1MDAwNzBi7CaIXFy08b/74lvCS3OZf16uo1LslPyLXHLj0P95bLbtXHUwMDAzrpxtJEmPJJJLrCF+OlxysVx1MDAwYvaSlDjrPFx1MDAxOIy1+sq73MyZey6+XnPhr1xuYnZN2ZPvuSxEZm2Bg7u6XHUwMDBlZjtcbvWxT5fyxPGKYKwyfL+7tyO/j0vjzV7ts71cbvw4OKoxazdap01cdTAwMTPlvdNcdTAwMDXo6qPWY1xmiKrNymtP37x1XHUwMDAxajc24Zu17lnGv1x1MDAxZFx1MDAxZPzmms0vtCjoOlx1MDAxZlx1MDAxYVxcJZ3Hm/POmK50NdlcdTAwMDZyY4Xz1VTWSDNnk4SPUv3z2WzPOlx1MDAxM/FcckRG3XJwx/vNa5pb9CG0zOZcdTAwMDKzQr520Vx1MDAxZNtcdTAwMDeG0FtvtWvD4FwiLbtcXLL/Ykj4i6Hpw2lcdTAwMTCMb89tXHUwMDFmue7gQdV0YVx0sVx1MDAwNHhcdNgpyqj3XHUwMDE3zUWQoqzK+p3ZkH90979cdTAwMWVcdTAwMTQ0+FV44u9HXHUwMDE0qZJR16HUUfpcdTAwMDeDmDFZ3lx1MDAwMjbYr7a1nJpccoNxZordXHUwMDE1xSfTXHUwMDFmX+LUx1+n6lx1MDAwM5TR/TZuXHUwMDBmb4teIY7xaupzXHTzXFzeYcZ8TzRcdTAwMTPPXHUwMDBlY/G9iijwSNexknjeOpQmOXCjvpBcdTAwMDONUG3WvctolW2BvJXbRlx1MDAxZli4aEp+uTrK2aJjSP1DVnFMjtMvfYRcdTAwMWKUSFx1MDAxM/1cdTAwMWNOz1GM4KElYLB3dVNcdTAwMDHZNjiTcMRcdTAwMTiFkY/L6bxg8bfTzjZcdTAwMTG9Tpgj7Huvzi/uRFx1MDAxZn6xmu+4fGzfkFx1MDAxN/ws0dzr1oBHTFFtXGLvwP7wXHUwMDFhXGZ3z+xly1x1MDAxNO1cdTAwMGZ6yCqzyj337q9gXGJcdTAwMTfeoz5cdTAwMTfq+vCtZN8sLUzDXHUwMDBig45cdTAwMDL8PNxcdTAwMWW3sM2UNuzDeL1cXCZMvdfIa09cdTAwMDTDT7/76eww+eBcdTAwMTJrcYZB5JBK67ypXGa44a3doLi1bz+a4PR0dkbz61xiulxcff4mgk9cdTAwMGLEWaz85b9cXNX85i2XWmpcdTAwMDNJMpahcVx1MDAwNmROqoup+4ZzrXJ77zvX3Fx1MDAxNlxiwdb3ZXksXHUwMDFi/fWpao+nI5vzzM2fXHUwMDE1+tMvXHUwMDFiMlx1MDAwZtD77GogXHRcdTAwMDX9X/2w/6tcdTAwMWa65MMoXCLtzlx1MDAxNHTwIa94Ylx1MDAxMmv0l+4yXHUwMDE4ViOVOUCigCAmXHUwMDA3mySBUsukg4bp6ZJMdLnDXHUwMDAxeqHL08OL/7fnMoAvy+Bjuq5rR1x1MDAxM6lzhmOCl7hRXXQ2VOx6+OC33Fx1MDAwNS9hYvWLcDRBVV4xpfqF7NGaI5E9z59cdTAwMTLp+Jdcclx1MDAxN6Rcbm5cdTAwMTgurE7hXHUwMDA3V6FcdTAwMWJdb75cdTAwMWbqdlx1MDAwNS/8NFx1MDAwZvJl+Zy8XHUwMDAy1XNtydI1TY+zdl/754+3WpuWiojH/bKsXHUwMDE4mi85dj8qXHUwMDE2qFx1MDAxMP58yHvBoj/+v1x1MDAxNX9nkJOWxdXorp6xZuDZZ8ChXCLOT2NcdTAwMTXGXHUwMDFiw9tccr6TT/vaqjKC/nA56DWOb2HqlUd4MVQvN+xXKTTnXHUwMDA3+K+wICq1sHCiYEJ87rXXXHTIXHUwMDE4Q7zm31x1MDAwZXrFPHEuI+Wrtdg21Fx1MDAwN/6Kt1x1MDAwM1Sp/fU5zjsuTFx1MDAxZKtSMYtbT/0ycCnSnSA7TCQzTK37hVx1MDAwMnr6tqj0/p5Hp0hxbeRcdTAwMWWC0EtJuDm94Ynbw1x1MDAxZFBhkyezwaKOW4YpOeqxd+jsofOBKnS2hKlcXL/byN1cdTAwMWX8eatcIrP1qs5v8C69XCJNyaOO79qhfDFcZufcha5O3Fx1MDAwM/xcdTAwMDGIvrgvyfjNXFzjWvrzgErtQc515Fd/OsRMTNs6x1LX88aF4TWNXHUwMDBlXHUwMDE5huLSl0ZcdTAwMWW6W6cu4DAs1DNvu+Bm31x1MDAwMit3ncF2iLpcdTAwMThcdTAwMGZccnbsq0jQXHUwMDE1eSaOPj1cIpygqFx1MDAxM1xioVx1MDAwNkTvLVx1MDAxY0FLdVxi+Mo46NODJf02hFhcdTAwMDehfIeyjTbe6SRcdTAwMWM0Q8+NvCxEl1x1MDAwNWVPf69rXHUwMDFm+YxcYoa5YjRfqOwqyItCZ5H70kRCXHRcdTAwMDNe7FJcdTAwMTltUFx1MDAwZZvWvFx1MDAxZNiv/Fx1MDAxYtHGOdLa4K1cdTAwMDdwvUrLXHUwMDA3Nz/5UlxcITc1h2CGkJJt647vn5Y/da9lXHUwMDFlhP1V6EA8nT028Zp2N37zXHUwMDBml6//eadcdTAwMTGxeOdz+n2uwpPWRaSNcZPoLqdSRbzuft5Hp9o4utBcdTAwMWTBrbDlXHUwMDBisjBTy+L0/cG4VaaAvSFcdTAwMTAosW5yQ1x1MDAxN1x1MDAwNVx1MDAxOU5cdTAwMGUxldZBY9zZrVuTXHUwMDA2o9uUUZGeb1xc8Kj/5YHJXHJLXHUwMDE0mTVcdTAwMGYjkPzGf1x1MDAxOMent58zk1lbaDRCjInXkbn0RulcdTAwMTklirY6TVx1MDAxZravudWlQ3+swkP/0NC+1Tus2eyuXHUwMDBitFx1MDAxMLpcdTAwMTZZm1x1MDAwZSlcdTAwMDTq8Sg9Y3XSVFKX91BqXHUwMDFi3DfErZb1+vPM9nhV3VFmXHUwMDFmrExxXHUwMDFkRe4/Ry9lXHUwMDFiQtxcdTAwMGZgQFx1MDAxZtvH7lx1MDAwNVxc0KZTXHUwMDFjNVEnmu5675qST0FcdTAwMGWukpmWVSXxz5pcdTAwMWJ6XHUwMDEzXscjfDB/T2pg50Cb0G2iRfrn2cqyy/qgQ13aXHR0XHUwMDAzaCwmXGKaVqX1XHUwMDE29dU8mnrZnDh1V9Or7MBO3f3hOio7mpZOkeU7LmR75vNXUOzX59Iq2mDVh/tzN1x1MDAxOOxcdTAwMWb5bstgzX0o9VxyXHUwMDE2xeuv/r5kzMqcI0h+fmJLZVrdc2nLpKJcdTAwMGZiR4jPgdFf9ay1YFx1MDAxMUxgZFx1MDAxNZzSgXpcdTAwMTDJzGx/nuKEfj7UXHUwMDBiXHUwMDEyXGbwXCLwrmMuP7GKXHUwMDA2xFx1MDAwYrO2XGJcdTAwMDJBkFx1MDAxZVIw3vw3eybe8H9cdTAwMWNcdTAwMTn5vz7otChcdTAwMDX4/Du//t57nnCztciTjcDgnyfWXHUwMDExu0yimaSOY2RClVxu7mDt4Mii2WNcdTAwMDJ+R403PZnNh1x1MDAxZbFIIY5IXCLaXHUwMDAzMmeC7FxcdPtHOS1feC9vr86RQ41WjFwicmaCuf9cdTAwMGY/XHUwMDFjM9X50lx1MDAwZdGJsFKTLLF9w1x1MDAwMJH2t1x1MDAwZbx8VJjm/iGVtVx1MDAxM/28jaHO8S2Xw40rM1X57rDE19+t76m1XHUwMDFhr2E3vXEzJSlcdTAwMDb/cUSk0y+8X5zUXHUwMDE1UF02rulcdTAwMTaqxv1v3+lzmPqXXCKG1WZ//Z1xksCzy1x1MDAxMU6idv5cdTAwMDckZCadr1c2tlx1MDAxMFG1NGz0iZK9XHUwMDEyMPqQfzWd+Vx1MDAwZtNccsA8ONXCxlx1MDAxNrRpWqZcdTAwMTnF4Vx1MDAwNb93XHUwMDBma5pcdTAwMWTA+Fx1MDAwNkVcdTAwMTelXHJPXc79plx1MDAxZl6wjOaoMqcsdjmKdkqOYt36jeDXiiYqu4VerumGfEsjLlmJueDwaYzTo8IszXq9gXPvXHUwMDAwfZTgOWPpce2a8ciHfEORQMBcdTAwMWXBXHUwMDFjr9KQd5PZpcLPP8NmamWfXHUwMDE5iYZcdTAwMThQvUKh4dDvXFw7Q1JxxsZcdTAwMWWuXHUwMDE460tLX/FcdTAwMGW55VhcZnHEz1xi6Fx1MDAwN5aUvNTz3GB1/ed7S1x1MDAxNHaHtFx1MDAwMvjF7efYJyRcdTAwMGJcZnVFjnlOcridYMNz3VLhxj9/+5ONsz/euOVcdTAwMWP1qlx1MDAxMFxuO0GwXHUwMDFiX1x1MDAxMVx1MDAxOO+f95OZT5TEMoIgjk35rorATT9cdTAwMWSr8mD9xFx1MDAxOKaMSOZhU6f25Fx1MDAwN4bHdTZ0Wvz6TS9CXHUwMDFiXHUwMDAx0dClf+bi1SW9h60tmFx0L6il1mzhuzjMdX6pXHTlKErS7dqGXHUwMDExezhJUZpRZWGvwrTS0Zn+Os1cdTAwMWSpV8VcdTAwMTjzUlx1MDAwNqQjMpVd0Ca78Z1cdTAwMWVEYMetsaGrXGLcMv1HXHUwMDA3RifSzT88XHUwMDBmdFx1MDAwNbmY1XFcdTAwMDKeXHUwMDFkXe1cdTAwMTCSjvxcdTAwMDZn+dVCXHUwMDBiXHUwMDBl/9VGP22OfkliVOtfv8zrPVx1MDAwMPpcdTAwMTa8IWP4o/xgt9Wk1Ct+XHUwMDE2MFx1MDAwMCB8XHUwMDAwp5UqTFZYPYCpyKB/9Z6+4ojzfcZL9tBqNrq8nFx1MDAwYjjUXHUwMDFiXHUwMDA1yVx1MDAxOL1XXHUwMDBmqlxySUv2l9XDz1x1MDAwMP15Ll3KJd+hu5f7b3FDoijztl6TbJevuYaeT9tcdTAwMWRcdTAwMDeujm8lu/2C8TN8iDdcdTAwMDKerDT4vanB8KzhqFx1MDAwZlx1MDAwZlx1MDAxNeR9iFxy+q08h+BcdTAwMTWeplx1MDAxN1x1MDAxNbLNdUjiUcKTlsvaaj1/XHUwMDFlXHUwMDA1xmkhXHUwMDEzgms1XHUwMDA0ci68Z2Ksv5e6xZr/XHUwMDAydeXmlbctyVx1MDAwMLs0YZPwXHUwMDAzNM16e73r4TBcdTAwMGJcdTAwMGK2YPlYYc2lXHUwMDA2oidcdTAwMWZqJ/C/XHUwMDFkzCFtycW+zGxu69Tv0dtrKk2ndK8jXHUwMDAw0ntwyzJStTEn+35U2ZPv3r7/l+9cdTAwMWH6q3PKXHUwMDFk/XyXUlkpaLlcdTAwMThaXHUwMDFlLMzRm/qHr68mWGrc1H1cdTAwMDPziLjfIORcYlx1MDAxZVx1MDAxYbbt0PLanE6Ga+WAZJSWgY9umy6bVndcdIJ52YlL9TCPOFx1MDAxMz/AxYxK7Tp0XHUwMDFiK/VcdTAwMTOFi/l2MLhbh2j1/LTtuF+/bT7LMbugXHUwMDEwi1GufVx1MDAwZTprbFYvXHUwMDEwe9GGvd7O0U9ZxzvqoX7ynFspw7teeYOWW6NcXGJcbn0yvE6ywFspXob9xkKqW5UmY1x1MDAxY1VU77sgS/9Gw5M3wPvLqGe+V1r/Quz5aCMmLSbIajGALH9z0VWXYHpcdTAwMDfrXHUwMDFmk0Uh+veuXHUwMDFk4uW/d8nmc1x1MDAwMjNcdNw/zN1cdTAwMTlcYtdIXHUwMDAwXHUwMDFksJf0XHUwMDA0r87+b1x1MDAxZDHBxaPjfu95uJOgQn9cdTAwMWNMXGaKLeKyR3qNSDqJXHUwMDBlPdVs7sfil6xF2ZBNmUBqN1pcdTAwMTTOYUSo/1x1MDAxODR36Xx26Fx1MDAxMItDeFxcb/DJ/Na5XHUwMDA0XHUwMDE4oGuGvnDlXCL3v12xcvRcXDq7rZxcXMdofuQ8yfcwsVx0ny/BsutFvqfu/HmFZv7+iOBcdGsvcFxcprVbXG5cdTAwMDQyrifLimn8ouKaimeMPKLPgrfsc6PMYo30LTOn3/yCpaM4IJ/TuYljXHKswYLgaaKMizdmW9O30FlqZ1x1MDAxNK3QXHUwMDAyZv0rj12gselcdTAwMDeLuSZcbmC8XHRcdTAwMTeUsjz+JlO3zLn0vdvjXHUwMDE36i+sgEckjuOcSvsxXGYrQWhcdTAwMWRnRlx1MDAwMKLYqVfo+kXyu8s9XHLU19LRXU1g491S71xygEX6Vd983Tx36HLI1Swwl6k1j3OVfNKbdlx1MDAxNnTw6CyHaXravrNwXHUwMDA3d1xcPeVtPWiK6fjN/2G3g1x1MDAwNaz9bm3BI06IZ7rV6+RKNncheL5cdTAwMTSbdX3kwbqNQ9R32EVSp1lVmFx1MDAwNCBXXHUwMDFkfS1cdTAwMGJcdTAwMTE9d7xcXL9DPG442Uc8+ov+vEJX7Fxii5SI1cjoJc10kz1cdTAwMWW0XHUwMDE2R8bjQEJ/oFx1MDAxZlj953stY2DMnVx1MDAwNoA8MaivpTp4cDXK4Fx1MDAxMlxmbaP1+THg+4NpO25cdTAwMDH6o2fB4TJN/FHjXY1Lab/BcFx1MDAxNrSAaMCbXHUwMDExb1x1MDAwM4JcdTAwMGb3ljk5JsFlXHUwMDBlsIpgyXTHaDRcdTAwMTP1Ulx1MDAxY4vlOYz5k+xcdTAwMTnDZrzklFx1MDAxM19ueD7PXHUwMDE0XHUwMDE1uFx1MDAwZZT+Slx1MDAwN+DmZZ/725WV78VrN9lKSniJnaPTwjf7lvsyXHJdXHUwMDEx57B6rSm63KtcdTAwMWXbwy1cdTAwMDZ3RFpcdTAwMDYgpbbWYFx1MDAxNXaxbddIOqct9MNcdTAwMTjErHmjyHuL1u1k1VxmpKPOeLl5XHUwMDE2e1x1MDAwZrK+XHUwMDAzdabUXHUwMDA3zFdB+Jute9SoXHUwMDAwXHUwMDEyQE9cdTAwMWX98vOs1uqHuiHLqKA6Zz8yXHUwMDBlXHUwMDFhQynoXHUwMDEyPrQ+QIVcdTAwMTDU81x1MDAwYsRcdTAwMTPDh8ZZx93qyVxyjdr5a3dONV5cXHCWRFx1MDAxYZFcdTAwMTVbSWFcdTAwMTn+XHUwMDA0PWJUwqBcXFx1MDAwZbKj/EG8l/E8lFx1MDAxMlx1MDAxZcpxqPeNXHUwMDA2XHUwMDE1XHUwMDE5Q0Ky9p/ryrCDXHUwMDAw7mRybI303EabXHUwMDBllapcdTAwMTnK6Vx1MDAwMzOCXCLUPsjkKFx1MDAxZEFEe/G0TMrecLBrs3pcdTAwMThXZ1x1MDAxOGXfg/4gIKFySVf6T5RR/Fx1MDAxMYbdk8gokNZipPdpXHUwMDExoYdO6NYgXGIoIH1cdTAwMGZ4LFxucoh4zLf7xc+O35r58UhmXHUwMDFl3G2BX8lQmEhVvn301F8rXHUwMDFlgn4txi8zTrVHclwi3eSb0vphNkRcdTAwMTR89sIzw2nnVkzIyvpSP75cdL/CuZPxkOff6YhWPq2Pvzf93la131x1MDAwN+x+zIdcdTAwMTlsc1x1MDAwNWyFM5VEqOfyYFx1MDAwMLSaOSP9sFxmyXJcdTAwMWbYcNv94eZcIo8o30a0w/fuJvn/8W+fbIiv+I3aIMtcdTAwMWFnUlx1MDAxZSrNplxcSMI5aZaB3YK9z8LaXHUwMDA0XHTSodVcIsBCOndyXHUwMDE3/mReMv5INVx1MDAxM35Fdq19lzNsTYNOXkdaQ/zcxaSlhrJcdTAwMGaaR4dwlVFHi1x1MDAwMjQox+h3b6GsZVmvXHUwMDA1vf4jmMWQPDE1lsFV2khpMVRohS/st3n7XHLVc+ewVCWkXGJpa9KSTox4IIaVXHUwMDFiXHUwMDFhXFxvebFF9+4563hcco2RXHUwMDE4Xlx1MDAwN1GTgr48jXqf366utJfGXHUwMDFitdyaMfdcdTAwMWPIVzWFzStcdTAwMTZcdTAwMDNcdTAwMDaQ/ixcdTAwMWZ84Pk6oOlwREg5fX19poDEXCJ6i0VPhOVcdTAwMTAlXHUwMDAy0JQsyycqJYhsXHUwMDA2oLBcXE3IXGbOwkk4XHUwMDFm0Mbpo5A37IFj7rnX+Fx1MDAwM8frXHUwMDAztSnoi0lcdTAwMWSsITCRwdG+N/vhjlNgRUtv8/he060vfGq6XHUwMDFiIFPImpZyk1x1MDAwZiSa3dRpdqa84Vx1MDAxNM5SXG4hsk29i1x1MDAwZsyxi3WbXyf76yt7o2OZ5cDqa1x1MDAwMT/o/trGyD3d4FpcdTAwMWXQhtLWbzBcdTAwMTVH0WFQPzB15aPizKgyMYqaft5uPVx1MDAwNDZzeeZeIVxmXHUwMDEznVx1MDAwNZR9oJvIP2atiI+OXHUwMDA3XHUwMDBmcEEqVaDe4EPy6K9RqGNMt5IjglRnXsmFymvEujT39alBXFy+8lx1MDAxYqZieHqiXHUwMDAxXHUwMDAzJUK2SVx1MDAxMqBTJrxcdTAwMWXESvtVXFzx5CH34di0XGZcdTAwMDK2aVx1MDAwZZp1XHUwMDAxIJH+gZua8+nXlGGvXHUwMDE5PMtToFx1MDAwMCyOvpDHfJY3XHUwMDFkovyHzp+jPLNC16ZLNMBv2s1lVUWB8PDjJziyhmG01Vx1MDAwZajfbOoxUu94V0WwXHUwMDEwXHUwMDFjXGY8lVx1MDAxNyc+olZRakBbsmiu9uBcdTAwMDJeRVx1MDAxMEVcdTAwMTCsnedIN1x1MDAxYUKSn89cdTAwMGKhooByg1x1MDAxOK9cXP8zIFx1MDAwNPrz0PpcdTAwMDLdXGZcdTAwMTZ4iSq0v1x1MDAwMOVhJC7julx1MDAwNTf/nrQr4WJcZpBcdTAwMDN/lbDr1Fx0a+7Fk6NEXHUwMDEwIKBCJ6xbXHUwMDE5Z/WDXTKSXHUwMDFl+nhELK3UXHRP/+ZcdTAwMTXeSGqTIMI88HaVnc/oJysn21x1MDAxNOBcdTAwMDGIvPby0axAQCVcdTAwMWOjXHUwMDA1aCVcdTAwMGLsXHUwMDA3zo5BupvOdEv2vWpAmqzt85VgVUBcdTAwMGKdrVx1MDAxNcOHgpKA3ezvK4lkXHUwMDBmJT+RlvGq3PiBwFx1MDAwZbbhcplUPzkt5Vx1MDAwNiNrXHUwMDFh6JXEW4gkYlx1MDAwNL0qK37QoFxctlTdsfuJMcN9PjdcdTAwMDKsq1x1MDAxZnze6oemP6Ou2Cnr5oO/XHUwMDA2OLUvlLsknpuz6ZPvXHUwMDEziFx1MDAxMFx1MDAxZahp4kf6hJc8uFx1MDAwMURLXG68+7BPXHUwMDEyvbFcdTAwMGJNYlx1MDAxZVBAdckjgWM2XHUwMDE2XHLN0Vx1MDAxZpauYSVbtI1cdTAwMTDJ5Fx1MDAwZa1cZqhcdTAwMWN6KFx1MDAxMCsyXHUwMDA0nS4r8sNQmv23y3utJf58P1lcdTAwMTlcdMd/eG02Yu3D731E63nTgyvu5qJcdTAwMTixWpWJXHUwMDA3XHLCIFx1MDAxNo6JedujXGa8p2vRf30hgac7gVCW5onrUee0TFTQXSrIt/pl3aLiUX5cdTAwMWIv9lx1MDAxNFxm8JS/0S1IXHUwMDFlXHUwMDE3gI9AUN7gQUZ1Wz0661x1MDAwMVx1MDAxM1Gm+0DtkX5kdkxNg+rzvleCKp+wK8t1Q3vo/Izjub1CqT/yXHUwMDE1stv1XFzzUbuQXHUwMDA0xlx1MDAwM2dnZkkpXHUwMDFiXHUwMDE1j803N0dcInrnxVx1MDAxNGgvXHUwMDBmvJeWOlx1MDAxM4vA53ZcdTAwMTCJXGKTqkRvtYqwVPpcdTAwMWJcdTAwMDV31Fx1MDAxNlPZb9pkizlzubV922Rb27SEWY7KXCLfh5DE+2VcdFx1MDAxZF9cdTAwMTZcco38Xmq4aLlcdTAwMTSO91x1MDAxOS7QbDGaLepcZi+wv6edn1x1MDAxOEyLwDlcdTAwMWQ7XHUwMDFiXHUwMDFjkN2XsHHeV5hp33fMXHUwMDA1b23KSFxcPP1cdIlcInM8s0pvYzjohY3e94aeUFayXHUwMDFmnDpNJVx1MDAxNlRcdTAwMTfc31wimFmDeC/79pxcdTAwMDXXgpszXHUwMDFjQm5vnrtTJFCGUUba27KJIKcuhm2o+daK0CGTp9HKkFH5L7OBuquyXHUwMDFmZD/z5OGL0HVrw1x1MDAxYlxcXHUwMDA3MrNmPFx1MDAxZKy1eW75Q823XHUwMDFhXHUwMDE5I4htcMc0qn6bbUw2N4i8IT9cdTAwMGJelTlEQYRccnRHIUhkouuTdlx1MDAxZFC5P5wrTizv/3Z+KTfyhICWXHUwMDBmXHUwMDE3elx1MDAxMtDa1ZPDWU0lmVxia4fjYVwiwleb3Z316Vx1MDAwMGfwdZ2WPeT9o5Oi98OrwY+TdrEgg8HJ2FooalCr7Vx1MDAxM7oj1txzLtTwd1x1MDAxZk2ySSdcIjiANsJ5cFx1MDAwM36BpsDZhyu1l8ZbcuFcdTAwMGWDhcxZXHUwMDEwjtZvvuJHopqHYEpQ8HNsk39vTqqCvopcdTAwMTiJYqfiuVx1MDAwMFlJJ0DGkoNQsZfga1pGPVx1MDAwNMFwsuM7sb+c90C5PKCRWcX+j0+Rdlx1MDAxMDLpXHUwMDE3vCz2JVx02ez1e1x1MDAxN7DBcGooXnGxXHUwMDA3u4MqP3pNRSTDnkGrt21tUI+kXCJXV/FSRlx1MDAxY5tcbll1S5Gs9/vjailxr8OjpGiaXHUwMDBlhHeDjzXffJP2U+ZcdTAwMDbhdyORUFx1MDAwZm5Fjir46bK/XHUwMDFmKaNJcIqNg6+zS4lucP7SJtpXXHUwMDAwKyH36lx1MDAxMOmHVy6twc3saKed5Fx1MDAxOVx1MDAwMjE34qDWTyC91DGrIfmb6Fx1MDAwNFaqjIeDXGKLeSWUQVry0jn+/Dj2sVx1MDAxYvxcdTAwMGJcdTAwMDFx7ddcdTAwMTfC856qXCJcYvH56dBcdTAwMTmDgfdlR0upQfGwl5tsQk2AN4YwR7/4XHUwMDAylVPxXHUwMDFjdlFcdTAwMGWeN3eQx6eBliPB+qNcdTAwMTSTQE+m1Vx1MDAxM6UyXHUwMDEx6v5on+1cdTAwMDVQazVcdTAwMTZWk2+Prv35mPuQrihcbtSMyOu24c+gvEtcdTAwMDBUNFqRb/BwXGZcIuqBm2GNXHUwMDE1RVx1MDAxOVx1MDAwZVx1MDAwZb+ca791Rn6iTWtcdTAwMDbgPbR5t1+KmfPNhX3JR0ZcdNpwfnZX9ehcdTAwMDWwi1RVp9pv3ZGlRmjTXHUwMDE59ftaXGbyhP6nhlx06GDthY5cdTAwMWSm7Ojh11XicUFcdTAwMWIxrEJcdTAwMWE0XFyJlZJlZe5cdTAwMWb3Xplunje0i+Ni61pcdTAwMWWy3eZcdTAwMTX/valcdTAwMDQjyWdcYl6wNcfRctE69ZKk8fgo37pJn9/RZqiVLjdcdTAwMWTndltkfeowSF53/WjjwJphUJCaKX1+wLUqm5vXfdQzY27cXHUwMDFktruNXHUwMDA1XHUwMDAzoOPyiVwiQG1cdTAwMDHRmlx1MDAwMuJcdTAwMTRcdTAwMTVcdTAwMGK4XHUwMDEzSESKXHUwMDE0hmdBJUODW7pi+7yT9pAqXHUwMDFmXHUwMDE4+0blYZtxXHUwMDAxz1x1MDAwM0nBZYXLXHUwMDAzzbbB1lx1MDAwMVDi2/Cvj1x1MDAxMZxOXHUwMDE5mZbB/Ozxglx1MDAxZdGZWmHilc5cdTAwMGZcdTAwMTSSxygxwqjGkkifXHUwMDFl+E1JO1BtXHUwMDA2cLdcdTAwMDMoXG7gnYVcdTAwMWFxdPetsphcdTAwMDMr+Xtl7D7Rk+ZccrTZRnxlXHUwMDE1XHUwMDA1el9cdTAwMTZqxptcblebpVx1MDAxNsbjW4VFSJub/v1o2FxyyWBkXHUwMDBiXHUwMDBipELKTpPzsHe2cSQqoYggXHUwMDFjQuu4fNBN2IOfXHUwMDExZFx1MDAxNMJvXHRFUVx1MDAxN8F/s36e2Ncqep3Y9bCN9lF14UtWj/NcIj5cdTAwMDGKQ0dVzkJcdTAwMWZcdTAwMDa5Z69cbpr6SCbxkOFFUIeSqTHAhlxcXHUwMDE3Lm//asnv2WUvt5iyXHUwMDE3oSPVXHUwMDBiSM+koeBUe/RcdTAwMDBjt1vLq6SBnURcdTAwMWTDq1lKIz1w2fftv1x1MDAxZlx1MDAwMT5k2yCaXHUwMDFhyNN6SfWrS8i18S5XW7LbyO5cdTAwMDe7hOlcdTAwMTQm0Fx1MDAwNJ5cXDZcdTAwMWSwr7TnwNtmdTmnU9M/XHUwMDAzcdlsbVx1MDAwZfVWTIPTMFeZSEj9VfvYWluD/XM7aFx1MDAxZlwiUltcbpdzOPR6wPXTcYUheVx1MDAxMlU5gpYybFurXHUwMDE43cvGkOeIxyaXhfg7zKdcdTAwMTghXHUwMDE1nt1itjDn3Vx1MDAxMbz61apcdTAwMDJ2XHRcdTAwMWU9oFx1MDAwZpb44vllwZC1vfV6VVW/SuKrXHUwMDE4ZFx1MDAxOXPe7GzN4GKEiFxis1aQXHUwMDFlflx1MDAwNoUrNLk37ZZlklxiY1x1MDAxOGtCXFxYXHUwMDFhvLpcdTAwMGLnXHJmka89iVx1MDAxNFx1MDAxMIJgMJFTuuMqq3X2NueWuXgkL+N4McFcdTAwMGXN+1x1MDAwN4iiqFx1MDAwMyHzrVMrIakw4XCPVpAz2UVl0PiAr+S751/a9cHa3t8qxou6YtJZ1N9cdTAwMWX1abyi1lRUiemIXHUwMDFmmpA+buhFtsWjo/bfw1ObaD5/+lx1MDAxODm9go+RbcLxQFx1MDAwNyaTL1x1MDAxMrxcdTAwMDKAt1x1MDAxZW56XHUwMDEzlFx1MDAwNNKwdy2eVTeHmPsjTFVBXHUwMDAxPpy0XGKhh5hWeb5cdTAwMGW58kZOaFx1MDAxY1x1MDAwNThi4eSkKMrgI9+fjlx0c8t+UbM3I8jqXHUwMDA3n5thgVx1MDAxZpn8O6SguvDoQlx1MDAwMb2dXGJgf93f/Fx1MDAwYjm0XHUwMDBmooA3v17HV1PVyJTwz+HRPMq8bDxQRONLWlxcj5ZcdTAwMGLoisKff1x1MDAxMtn4NNiPgI5cdTAwMWLwXHLfXHRF9EBcXK5cdTAwMDLtfbersTaKN6tcdTAwMGaXXHUwMDFk2LHrO05kXHUwMDE0XHUwMDEzZlx1MDAwZTrlViG/tFx1MDAwMf+9gVx1MDAxMDlz8yGE3rzK3dUu9Dx2kCZ63lxir5tqz9ie5FNw6plJ8EdmSWYtXHUwMDA0zaxOq77T2KzKksrlejVcdTAwMGVvk1Lr3eo3c6dosI1uXFxOlMvT5O53bq5nXGac1L5wXHUwMDA3XGZcdTAwMDF3T9dcYqf8pc+HPERcdTAwMDRImSHSc5hYbWLKdj+UXGZCXHUwMDE52bRcdTAwMGZ3VVxms3tcYuW9XHUwMDA0s3dr4tZhuife2Vx1MDAwN66sXHUwMDAzXHUwMDA1jNZHeNCDRvNcdTAwMTWf53nf64yXXHUwMDBmYciXi/xcXMhcXIXvR2S3XHUwMDFjXHUwMDAwMURcdTAwMTaH7Cf7PZHBuUe+L8xsmdFcclx1MDAwMSSQytVdtnO0PdzCR2gxXHUwMDE4LFwiilnAzcfw5tw8Sk+1h4GqROjUqMFcdTAwMTjZjzJcdH++ZFxyjvpcdTAwMDeHilx1MDAwZS2U/k880J5cYmWGKGZd9yCNsYFJXG7OtlclNFxut1x1MDAxNbttXHUwMDFkw9GfYLAnbdlTNiW3IflcdTAwMWNcdTAwMTiDxDBdXHUwMDA2VTI1XHUwMDEw3s5cdTAwMDdMpDQkak5YmI9it16NdH9cdTAwMTmjoIslXGLMTL36n27K2ic3XylmJDJmkLdcclxu3JbPXHUwMDFmXrs/zj2nd5V8zu2Q7Mk3ql9tXHUwMDBiQHBcdTAwMTfR3MEgZE6eSFx1MDAxY3+3o2WwlmlcdTAwMTb83DC88Vx0fl6/riHJu4dY5rjaXHUwMDFm/NVfe/VlY+ArYZGCQVx1MDAxN/VcdTAwMDLyLZomRn2yZfm756dJ7MRcdTAwMTSGSVx1MDAwMqmsNIwkQfp7lFx1MDAxYbfdtJlZ+ZBhV9gxWKpdd21cdTAwMWFEXHUwMDBiID0xO4wzXFw9N6F7m+2IefFb66JcdTAwMDK7XGJXp3NCXHUwMDE2XHUwMDA30j6oa/mCdXSJNcNLpYWOhWh8yiR601x0k1+oUENPXHUwMDBlMqh651x1MDAwNKOErEBcdTAwMDW/fu3ESclcdTAwMWEketfWRNKyoKFcdTAwMTJn1e/ZJnUyjMTPXGK+aXXhXCJqntrD/ehcdTAwMWOWOTijiO1cdTAwMGXaINc9XHUwMDA0ffIvPE7m0VxyXHUwMDE0VUPfn1rlxczYgVx1MDAwM1LnnkZcdTAwMGLz8Lq5g7O5voQrcJ+gO1x1MDAxZHdcdTAwMDReXHUwMDBifqw16totXHUwMDFj1TdcdTAwMDfy3TyqXHUwMDFmIVx1MDAxOSlqgF+RoeLhYUrfWpZTynHXfne7dbb0LFx1MDAxZc7ZfnGP+iilRJKeY9h/XHK7//xCdELWwlx1MDAxMP3NPGHv/ODBh1x1MDAwNJSSjt9cdTAwMDU1QexXq1x1MDAwN75pWKkl225gn1xcXHUwMDFjm6PtTaC1XHUwMDFjSscvkqL/ci+NXHUwMDEyR/hGXHUwMDFjP+FcdTAwMDVTe5iJb3W2NZaYSH1cdTAwMTUn19B5fHVTXHUwMDBlmeqkgHrWht53XHUwMDAxWrtFZJKMXrdcdTAwMTKz99V+uUTOaklYXHUwMDE4KnxwQKSp8NXtmF7KZqRcdTAwMTKU4I3IKLiWXHUwMDE1pypcdTAwMWHYPz/3Y3U4xyh1aDBWbWuCnyF2Mtmfd2po3Vx1MDAxMFHtnl8woWKV0lJcdTAwMTRGXHUwMDEwXHUwMDE3kYySt2AgXHUwMDEywfHDNW/MVVx1MDAxOXuXY88vPkqP0iWT0PHAZp84jFx1MDAwNYp54q/iSHyve0ZmOqzHbSOhXHUwMDEz+aFcdTAwMDJcdTAwMWL9MoaHgJKLsCTpetTz5OeJztAm+nDC5o00r5yrgVx1MDAxMUNcdTAwMTVUg4svg1x1MDAxN9j7wjb29LdP+CHkZN5nev57XHUwMDEzjXwrPF/pppZSs1x1MDAxYj5cZoRcdTAwMWXoLLsgRU55K/4spYpr0sq5ZvrBOFx1MDAxY1x1MDAxZnC5gz9CXHUwMDExYvXELHhV5mOt+ogvR1lkwjQgW+rCXHUwMDE0v+9cdTAwMTN+XHUwMDA3P12Lup71KOgnh0RcdTAwMWQhl66Xei/rzlx1MDAxZarr6Fx1MDAxZVx1MDAwZmzjnSyQfFx1MDAwMUjOXHUwMDFkUm5FIMXcu8mq2lkqkqZvaT8q6C1swm9P3IL2rzPF/kf89dY8/qRcdTAwMGLJXHUwMDAxSyTB2+xcXFx1MDAxN/XRefH2cCn9q3ejg1d5XHUwMDExiYlcdTAwMDdLVIFoXHRiu1x1MDAwNlSlcepqdNpU8VvHPFx1MDAxMsRcZkreomGhXHUwMDE13ZvPWO+O7pT361x1MDAxMSA4cXpNO+WNXFxWskVrvlxiuOyvJI+qreKJulx0q4We1uxb51x1MDAxMC2dLe7wXkrRabba79+WoNx/Ncl4WuQ4Uodf33XkIVx1MDAxNJiyTFx1MDAwZvG4jkWGJX5qipKc5kRM+M5e/YJFXGZBnS5cdTAwMDWQ5X5+MkFcdTAwMDV6uS0nIGdBXHUwMDA2L5GDXHUwMDE4Of39ez8taJvRXHUwMDExXHUwMDE0tcRVZORr7W9cdTAwMTbbgblz4elcdTAwMTi+3lx1MDAxMYu9XHUwMDEy01x1MDAxMtv4JfAuqek/r4FcdTAwMTnoPVpQXHUwMDFjXHUwMDE0vdfXIUKdeqLG2UHV7Fht4ZbJXHUwMDBlXHUwMDBi0CyPXHRvw3RzOviEy/Bxmkl9XHUwMDBiPu3Sb72fNP+0XHUwMDBlPCnS58zCNluqz31F2ZzM8bJ/WYYorVx1MDAwN6/Q8VFMnv+dlPA0glx1MDAxN0r537aSw55cdTAwMTe64lx1MDAxMWn7MbNcdTAwMWLDMULdoEz7pmr3U1x1MDAwMVbVXHUwMDE38SOD2pXZjUbnmf2v/1jss4fc9VimYlx1MDAxZZzoXHUwMDA3zlxmYFBcdTAwMWLfemun7lx1MDAwYoVOM7SWbFx1MDAxOW76SOtf+iFb5EpOdDNcdTAwMWJ+XCJoXHUwMDFhgTxfMlFcIvVnmsvCczuqbXV46KV0XFzkrdl/3ljL+Vx1MDAwZTl0fbjjXuZ5XHUwMDAy5Oan4N5m9f6FXHUwMDE0dWFcdTAwMTPbVcBcdTAwMGWzTpNUd3DwvmZqUlN1XHUwMDFh8qmPkiWedC8gwJMnvv43dsSIwfWCw1SBb1hbdrqIwZ5cdTAwMDQ3pmm0aFtNl9tcdTAwMDGmNDMy2GtmZMH3Ycb+MoRYjvbAhKhcbqRT6Lg5jeDC/PxE0a34q3Apj1x1MDAxNHB9rIdgm747cqwvL2qUNmgkznWc3y7Y3E02O5aLmPrsV7xcdTAwMTBccuhsd59SXHUwMDAzTy5cdF6bXHUwMDBmioxcIizl+Vx0u2FGXHUwMDA0xTHeWFx1MDAxZUBFVOZcdTAwMDFbR+O5f4XW39hPjT5cbt9UbU751IOFaez7i1x1MDAwM1x1MDAxY1OfL16/rGz+/vjFXGLezmVcdTAwMTesg1x1MDAxMVx1MDAxOHW8ePZcdTAwMDSt/Dh/vp4w1XFgrHaB8rY5+Td3vr1X51x1MDAwMH+PxpWZ3nZcdTAwMGLlXHUwMDFinGwodVDnolxyajVcdTAwMDaF4m9SXHUwMDE0n1wi50OPZKJxIeVcdTAwMDSf0Fwi2zPNXHUwMDE1RjM/lqCxw9dcdTAwMTlcdTAwMTSBXHUwMDFh4lx1MDAxN5zLzkj7P++ZMmFpekY+zSqEa3/PhJqkIypkw1x1MDAwYvJcdTAwMGWUtD+LkWsjsEYsblx1MDAxZJUkivfr0aSR9qq9iz5vN09cdTAwMDO4iPxcIri+oYAkUJHBlb/PU/WVXHUwMDFiTHmDI+Ar0u6A3+zLPlx1MDAxY56dXHUwMDBmUZfksNZVXHUwMDE4Wyf5q1x1MDAwZlx1MDAxY/7jq9G5J4yimpr5XHUwMDAyblx1MDAwM3ohW5VcdTAwMTXXVk1jgkxAXHUwMDE1XHUwMDA047BcdTAwMTZccqtjstjjXHUwMDA1nuy6O1jTRfdIhrTFRE6hLD0ymnbEXHUwMDAzoHmMXHUwMDAzn49AM3Cw9X/vyWx4mnZcdTAwMTNmlfpa9/VcZtjlguPqm71+vlx1MDAxZM5cdTAwMWSNU1x1MDAxNfw8XHUwMDE4SCRV2XTuQt9nIcCluGxy3lx1MDAxNFx1MDAxNYFcdTAwMThbhUpjXHUwMDE3XyD584U1k/VT0Fx1MDAxN4RCXHUwMDE0Lfk1nFx1MDAwM5meJElfXHUwMDE14bVcdTAwMWHj3HGQr8FTpN/9t2u4i3gg+9Ri8JuPf/6nktd8Y0lAilfBXoRiJvF3+9XjvPg6eTh7jkUknjOXxOFcdTAwMTLZPVx1MDAwZlxcXHUwMDExzaRcdTAwMDZcdTAwMDNeXHUwMDAwV6NPvISSvbeNUurz3uz5SVx1MDAwNTCSVauSa++X8XlbXHUwMDE5xdo/PrvprJj8ZpvofOwp6MZcdTAwMWEh/FpmoWw1W1x1MDAwMFx1MDAxNJKu4UM99DZdXHUwMDEw0HZcdTAwMTSJcdWSXHRlofP6yykl0aDwTsjH40KZXHUwMDBmn3Uh06VZM8B9NHNcdTAwMDZcdTAwMWM471x1MDAxOZ8mnT7KXHUwMDBiiGVcdTAwMTZqXHUwMDFm7dV85kijy3kpPlGoPfK3bidanVx1MDAwYv79XHUwMDE28eTmXHSrjZ9cdTAwMTN/KFx1MDAxMVx1MDAwMSBHSc4pgohMXHUwMDAyjS+LZP3lXHUwMDFlmWXtevayrD4/xt5epO/1ec5ORlx1MDAxMWRs2lx1MDAwNLx3t9yv68KzXHUwMDEwh0JcdTAwMGa4d6LFXHUwMDE1vUw+V4RnWfFcdTAwMTlDLIOCn/5PYFwiMmaxXHUwMDFm8rpM0/ac5d6F4yonv6dxMuz6XHUwMDE50TKlMXc74KlcIp4o/2+PuVxms0fUp9fq292Hb59zrKSkXHUwMDEzulx0XHUwMDA173FwmSCjsr5A8lxcXHUwMDA0XHUwMDAzXHUwMDAxQ4ZcdTAwMDZcdTAwMWJnq1x1MDAxMFwiaVFau1x1MDAxNMme4JFcZlx1MDAwZczzxFKHXHUwMDBlnHaFllx1MDAxMNxcdTAwMTBcdTAwMDKDY875XGarSEHEqbq6lLxriazzX9WptY/Oz5ZcdTAwMTbh3/mYXHTLlnpfXHUwMDA3kFx1MDAxOcbge0tg3Vx1MDAwNjLghc+IsLlcdTAwMDAmXHUwMDE0XHUwMDE4bl6mz2/FNcwow5FWW3RcIvNj9lx1MDAxNUDV3Cq93iBcdTAwMTjo+lx1MDAwNq8r6FxiWe0utj3l3T6IdYeVzf+j67yWXUW2Lv1AXFzg3SVeeCE8dyCM8Fx1MDAxZVx1MDAwNE//p9Y+3Vx1MDAxN/332Vx1MDAxMVx1MDAxNVG7VkQtlMw5xjcyU5mgXHUwMDFjkPNuTtL6NFxyjeWmlzpvt5nu5cU2xuMwweBcdTAwMDX6XHUwMDEx4D+Ny6Ckn5bUpzo/6m2TTlx1MDAwYt/uc9fr+tDKglx1MDAwM6cpjSBcdTAwMTj4XHUwMDE4XHUwMDAymiVcdTAwMDBcdTAwMDejU4lza2hcdTAwMTg8xMRbKdulPVx1MDAwNDvN5DNGh7TSP56f2/7Wq9dEb+/EXCJcdTAwMTW6XHUwMDA1XCJcdTAwMTJWXHUwMDA34XZPXHUwMDFj6KV5c0zXqzWZbfuVl1x1MDAxMcqWUPGepvTzvXhsXHUwMDBiyVx1MDAxOVx1MDAxYfQpMKaC7klu//nzXG7xXHUwMDFl99Tyuk64VzORtcLRefqJQ3dcdTAwMDNIt7yDxXZcdTAwMGaL8ydzcZePbF/4eZdOmDmN0/m8mZRN3/SI8/uGWsKfp1lcclx1MDAwNN8hy+98kSYsXHUwMDE0yN6UIGbG0VqY320qXFxcdTAwMWS2XHUwMDA1m/27I/nKXHUwMDEygbhy41xmXFyh9l5ibvFp8lx1MDAxOSzm23Uojk2f9k6aj8NMql1NXHUwMDA2RFvfXHUwMDBlg1x1MDAxM/Apt2/ZW6D26Wyr329HXHUwMDE5MnaH3udcdTAwMThcYmORSmt9XHUwMDFitnM4INWwXHUwMDFmjVx1MDAwM+m4fX+7+plcdTAwMDQtu/VcYo2x+3N1v8vQ41x1MDAxOXPrXHUwMDE0nuPt1fpcdTAwMTVcdTAwMTVYeKyI1TlT+zKzPWN8w1x1MDAxNu9ddElw852GXHUwMDFkMndcdTAwMWH7TM/MQ4Xf/uvXoD01XHUwMDFl0cSlgap3JFx1MDAwYqN3f0Pj9WZcdTAwMTIzxaPY6U0zUprtw2nWiqrC21Jfd3H/x5+6Y0iiiWve0Fx1MDAwYrOnXcrWXHUwMDA33pk398naeZQ/RkxFpO3mmN+PfG1emepcdTAwMTW9MVx1MDAxN47beS1cdTAwMGaiXHUwMDE4fsnz6/sujJR+sVGgYVx1MDAwMoohd1x1MDAwZUBFhEZHOfWJ71SrXHI4wMQrlXKsZEwg2cg7vtNcdTAwMGKFbqJgtM5GdrNHS4xcdTAwMTV/uLZ5ZvfU12RkkFx1MDAwN7pcdTAwMDMz7ECGkkl3rNfGXGLSxSMgy1x1MDAwYlAow3F8X99XrMJcdTAwMGWwQ5fT5bpcdTAwMTNWlVx1MDAxMFpcdTAwMTOnXHUwMDA3skdDo6RKbXJMgPHkYDqGsJzvXG7Kx35cIjRcdTAwMTJkgmqliEX1TbyP37s9uChcdTAwMWRcdTAwMDOD6NCiXHUwMDA1XHUwMDAyYv/uYKRIeU/lNHmPsvZVsFxm1ICCMVx1MDAwN8dcdTAwMTgqXHUwMDFhcImCa1c5XHUwMDBm/fFcdTAwMDSeNO+uRd9qPY9d3364lZxwysiLR1x1MDAxNt1cdTAwMDTOZHQta29cdTAwMWTWXHUwMDE3YW4rLeE0w6pSKXv1vd5SQFx1MDAxYj51xFRV11wii3iPXHUwMDAzPaBcdTAwMDeck4k+ZUXy6JTw+DzfYfNcdTAwMDHZ71x1MDAwMiDIpLxm9+bpXHUwMDE1z95ax06f8Gczz1x1MDAxNFx1MDAwYiXhd11cdTAwMWVcdTAwMDHD0ZdcXGp/61x1MDAxMlx1MDAxMNysiitO7lx1MDAxMFxy4oZQ93TSkMs8tk58XbWPUHHqSFx1MDAwMZ3k1WyWrqS/o0UrrFVcbmXVQY307Z5CK+xcdM1cYrxyL25dXHUwMDE5ey3IXHUwMDA0XHUwMDAx6Vxy7ypcdTAwMTlFfk8p9imMblx1MDAxZjpjOfb/s1x1MDAwNu1TMVrIrSPf4/JlIyomZUPU0XkhjZuE+OdYq+XzOcUrTvvYzH8r/Dinli58XHUwMDBm97h98/eB47iKkzrJXHS86UZcdTAwMDPkhMXhUlx1MDAxNffIMNZiqNgsTO9cdTAwMTGdXv5cdTAwMWM9SzfZl8Bp/d1cZjaluXN6YYZ5JO9Yxd+r1VwiKK1DLypcdTAwMWW0m2lBXHUwMDA0QVx1MDAxMjxVXHUwMDE4Vqt+d1r7LPI6XHUwMDFmmlV/Jl7Krsp6IC9cdTAwMDHkN1wiqCZgXGbVhL3M9f7dYvowSEE6pYqrLVx1MDAwMXpcdTAwMDX7XHUwMDFl4jimytxWV6uDieRY08lcdTAwMTRcXK+nSODnkqeMqJAyKJh9n3spI1x1MDAwNXSsxlrL+pWb54C8xmZpP1x1MDAwZrOdcMnL4FxcdV/kXHUwMDAxv6rXg/i3npz8rSezio9cdTAwMDBcdTAwMGZcdTAwMTBIyoVcdTAwMGaaIUqYZlo42zC4XHUwMDE4NFx1MDAxMkWQ+f1y5/j4oM9i/OLiyTxcdTAwMGbTwlx1MDAxZsuDXHUwMDE4oFx1MDAwN0hYZ+OBRHrgcFvE6jc/8OdwXHUwMDFmkLysn/FN8Jw5TVBrjTl/ubnjbYPbLd1cdTAwMTUyXHUwMDExkPKF7Vx1MDAxMd7SXHUwMDFjXHUwMDAyj7x85lHm9m9cdTAwMDdcbiG0p0XpzVx1MDAwZYTBNWhdLFx1MDAwYpfoaSTLv7NcdTAwMTbxZlx0abWynS2eXGbZdnXSdKQzRYhYd9RVn1x1MDAwNb/6MFx1MDAxNUVcdTAwMDTB6zNxnWewaiXMtVxc+p7iv0OxXHLsiFx1MDAwNfY4RGP7UcaE47NKT554J7HISfmfNTefXHUwMDFjiT1+6yzHszRUXHUwMDE1hltEl0VcdTAwMTRcdTAwMDfu6+Wnk3FAeSRcdTAwMDDmQlx1MDAxN9n+21x1MDAxNDtcdTAwMTg+vk9cdTAwMWLdScRTJlVcdTAwMTFUfSXkZLK9li3rMJE+L25cdTAwMWTrlndcdTAwMWKC5JfIaVvuXHUwMDEy2lx1MDAwZnGCJFx1MDAxMVxyXHUwMDA32SV8M1x1MDAxMfXMO6JxXHUwMDAyt9fmL0+MeJJJXHKv6MK6/i9OsFx1MDAxNcnq8o+uNn09L7mctCGkZ578bjOfdbYrXHUwMDFiK2VcdTAwMTDeM+ilKSFeXHUwMDFhxvng57xcdTAwMWN0XHUwMDA2iPm381xijXzjSvv7qjT+439wfFaE5Vx1MDAwMNy3n1xmXHUwMDA1TFx1MDAwN77GWVIx4Zw5Wa0oRLhs/4OcoHJCXHUwMDEwXHJy01x1MDAxZd18Jspyb1x1MDAwMFx1MDAxYiyMmlSWg9/BuH7Z4ZqC58hcItBz72xGOlx1MDAxMNLoLnp77td53uRcdTAwMWPmWXB/fGdcdTAwMWFcItOHdyzzXHUwMDE40vTkL/vb28nBt6XQXoz4VVx1MDAxYUxcdTAwMWanXHUwMDE5Q1dcXFxc24HYgIBhXHUwMDEwz1x1MDAwMWRFT3RQbFx1MDAwNVx1MDAxMs8vh/DqpZxrLr+VXmlcdTAwMTFcdTAwMThcdTAwMWRcdTAwMWRLpc7UroSx4WrsOInPdEiLf1xcXHUwMDBid/pVIKFbeuklQNZP8FdcdTAwMWZcdTAwMWLPgd+abVrEmmZcdLPa2HNcdFx1MDAxMvfPKoqrJFx1MDAxNoYyu357XHQhTc1wT3xtL+L9MK7RXHUwMDE3XHUwMDFhxo1ynD1D4uPt1DAm2VsgZ2wl4p5WV4q+QF3HqvaMLHr9nVx1MDAxZtXlUYCVI/mCap6vqXAlo1x1MDAwYiHtoN+CXHUwMDFlzlflIcKlIZKw3TUx/fqdrTOG2ql8XHUwMDExS9M28Vx02XPzXnWTmMr1XHUwMDA0TWAth2bSaviRn8qL9Hs+XHSh/FY/2vW6XHUwMDEz8tczXHUwMDFmYIl7XCJdtM5qmrRcdTAwMDLEOKZRNVx0vFLNs1NJXHUwMDBi+WCEXHUwMDFmQFxmM6JcdTAwMWJSpJt0Nm+pkoDnYKPRyYlo2burlCu/JONcdTAwMDRcdTAwMWKr97TK1OZUvtg+/oFcdTAwMDf+slx1MDAxMF/nWdld5cieMDr6m7/SxKfU+Nvd3vjZlIXOtO5iSFx1MDAwMi6jyMCPu2dhps6qT8dSr1xcJlx1MDAxN3FcdTAwMDBxyL6q7klV/twxXHUwMDEzeu5Ppo1tKj1cdTAwMTaIKZyqwVx1MDAwYoH09K3G4Nh+tYmM99hcZmMhNZR1eeZcdTAwMGb7fU1cdLCd1Pi6hzO/znmlXHUwMDEzy/PxfH88mu+aXHUwMDBi6NtcdTAwMTDGX67nO92YI2F3XHUwMDA0XHUwMDE3XHUwMDE0ri3md3CVMi0gIeVwv0BYvLhW9Fx1MDAwNsXQ9kRxzKvIp1pcdTAwMTXdV/A7c2tcdTAwMTR3XHUwMDA39OiIM7KFXHUwMDFky9Bwii1cZjLpkOTaTtWsZko7hoc9S1x1MDAxMoZcdTAwMGV1WmEmSLfua5XTXHUwMDFifl3LRzlf/kxoKlKaXHUwMDFmbq5Du33Jb+h+9plLq1x1MDAxM/JcdTAwMDCYVH1cdTAwMGL0OPBb/FSI525QXHUwMDFhXHUwMDAyuTF1nnt0XHUwMDA0hDhYo+FcdTAwMGZHTK3HXHUwMDBiJZZmeeJeyFJcYlVcdTAwMDCwm8JvhVG3iszrhdAw0lBbiFx1MDAwM+6R5if19fVccoagN1x1MDAwYj+3lFx1MDAxOU2bNFwivL81MIRDX1xmXCLBmr97onTgL+XzXHUwMDFjXG4xQozupEbH85a6XG6Fc59A3comi5HhO4mh+/NeXHUwMDA2Jv+ueLZ9V7uCvqWvOr+1uWo7uStOffTTRVn5lW5cdTAwMTedrPxyn1xy91efl7UjI/NQ7Vx04kGTq46mvWgy2az79N+L1lx1MDAxZlx1MDAxN+eo1HJ7r0TkuFx1MDAxOd1djWTOmlx1MDAwZuTfXHUwMDE2T3FXXHUwMDFllvzudYGQY7+2+3k+9dkpMZFT8uC0cST6rXtcdTAwMDKaXHUwMDE4rcvhQjFmkFf19ErYcFKL0M4ofaGQ4qFcdTAwMWTzrVx1MDAxMWFKRL7QXFxVYo5cdTAwMDGqgUFcdTAwMTBzbpqj+y32sXo+a2BT8oVcdTAwMWLh+NmvSExf7jevSMFcXEvE/iiuXHRwXHUwMDE5oSxRZFn0d1XJm/aWippAflx1MDAxYbqIq0iN19SX9v2keDk0p/F4PI5Vw+g0+uXR53a7Xlx1MDAxOX+/oNRcdTAwMWbehKC/OXyJXHUwMDFhm67a99++W91adGX9ZEB7p7Wc0Js4XHUwMDE3elNcdTAwMGZkWa862KtQ51vP39VH/HLyy6peXHUwMDFiWnmiS8VJoVxu3ffVd/grjeWjUj6dXTLIyiWsjiZcYsaHPJd0jvz2fOWy5crRSk+xQMBcdTAwMDHojVxig1x1MDAxMp3iXHUwMDA17W2ETnqE7nJBtOxCLu94x9phXHUwMDAyNlx1MDAxYstM5bQ9rtfKmYahXStV0bc7613ke3/q39S4yO82qa5DXFx1h2dTXHUwMDEzP1aUXHUwMDBmv4OLZ03JMovMLaXCMyVcdTAwMGXTioLBK25oXX2aPYZcdTAwMTO/q4pcXDs/6reaXa89pUp7/t21VF7mlm5cbp5dJfTIrKPInyDPvH/Hv6JXU9PcQFbBb709Ovg3t/b9YsMsQyDlqNxK9LXq42JcdTAwMDG3XHUwMDE4L4eDnI9cbvJ19lx1MDAwNeEzzfnH7Vx1MDAxNUHcxtqlZbmiVJ1ZSNwz5H1ZXHUwMDFlXHUwMDBl0+Hsbq7vTOj2V5pcdTAwMDftu1x1MDAxNoA8MuU/Npc6U8X+ziuoiPM2S/zBqyxcdTAwMTe5ZbFcdTAwMDLwkMWbUVx1MDAxN8Ls/PhByO+qaVx1MDAxZu7SKFS8TV/RQm7mXCK5XGJcdGbwIYaDhSO0jGNQYN2u5j6tO3jFfLSG1lx1MDAxZtr17lx1MDAwZXrrb/LKm1x1MDAxODPtnFx1MDAxYlx1MDAxOFx1MDAxZbVdx9J/XHUwMDFmQXm1mY3Om1RgXHUwMDFiXHQjhENcdTAwMTVcdTAwMWJcdTAwMTN8v4BzXHUwMDE0u4I7xlnrx+AxYa9Rhm1tQ/PEXHUwMDE1yLV9XHUwMDBl4HxRhMGHyZTvXHUwMDAxmMOrhor/nantkcK7QltcdTAwMDWESPI83OKaUrRHqaRBbFx1MDAxMus1RCNiPGuXfLpWvTSUvH17kVPpXHUwMDA1dOOLWb/e4lNkXHUwMDE1gNjIsVx1MDAxY1x1MDAxMlx1MDAxNPv8UPUjV+/U+DujsMfNhjExRGdcdTAwMDE4XFyzKZpNXHUwMDE3aFSelqQhfNNcdTAwMGbvXHUwMDFhsO9cdTAwMTLQXCL568eZ44Djy+dcXFx1MDAwNi/vbe69bC5NKG8z0rlkZtrHMo5cdTAwMTeEXHUwMDE49qpftGH7fSXOyLlcdTAwMTDW5cLe+SEtaEGL+f6tSUJcdTAwMTRcdTAwMGLDxcH+9lx1MDAxMCk9VIhX6+lIW4UpXHUwMDFhftn0iHBoX1T29WTKg9dq4Xd/TIHlT1x1MDAwZmHgqfTYTtaG7E3JqP996kVRa9I8ve+H9fzdXHUwMDFkslx1MDAxZdlor9XTfY60RlS/s9lcdTAwMGbA/9FrxM/0letcdTAwMDHL6elQXjZeq1x0XCKpJPp5Obb7edjKJG0mXHUwMDFk7FxiXHUwMDA3XHRDd5iA0TmPt7FKMnGpiIVryeOUXGK2rVx1MDAxN41o9CFcdTAwMDOdZlx1MDAwMX2Yx7NcdTAwMWFcdTAwMTiyo1xc3m5L1ELUi2P3bK5cdTAwMDVXlXc/uOprMLvrXHUwMDFh7lxi9U7h+ZL9/aJq1IPi08VcdTAwMTPGXG5O0tB0gjtcdTAwMDb4JFx1MDAxZDE3maXXnmm1IFx1MDAxNlxc4rf121vgJVxm9S6CrInEVWphscVsn1x1MDAxMIBl3zcg1Fx1MDAxN0PlyidcdTAwMWFcdTAwMDOO+O3tYl57kKVcdTAwMWaNa1x1MDAwN1x1MDAwNVx1MDAxM35n47VaaX9mrZRox0dwktZcdTAwMWLFs/rD3K/l+XacjZ5gXHUwMDA1pvCqRq0mit6jyORrXHUwMDE2s789N0dcdTAwMTZFOMvu0GfkVvS7ep38O1x1MDAwN0Wvxmj8jIJcdTAwMWKT8f0pc5RnzMFcdTAwMGYm+uujtjTMb001NFx1MDAwMYBcdTAwMTFcdTAwMTJVYy59tdWtNsdwXHUwMDA07GZO3JvD1CXK55FWueRAgf7cf1x1MDAwN/WfrceZbdiBsCVaVraB7D9cdTAwMTd4NC+CZuE5lFOIOmndXHQ8P1x1MDAwM8A5XHKt8Kacklx1MDAxMStcdTAwMTfnjTbfZuJcdTAwMTVQ7phdj3ub+1wi+PzLXHUwMDFl3IPzfVx1MDAxZceEVKefXCLKzVx1MDAwNlx1MDAxNuYmRHY0yda4mWkwVXHTb1x1MDAxOYmB4sD+fS8j9rpGXHUwMDFmONXuxbvvXHUwMDE1y6b3Y7Ep67dccuLtXHUwMDBmU3qNwmN/P8SQJVx1MDAxZoLVfTA4w4FcdTAwMWVCXHUwMDFion9Wy+Zbw+rvfKZBgqPeUXXDmqpxTFx1MDAwN//OiZaRd15RJ1x1MDAwNLhJlVVccqan81x1MDAxMV6V79VEWFx1MDAxM+t23Uv3vKCHXHUwMDFkyy60ZVxuXGZh/HY6O/W6yDV5O+u6fbnO0iMsNeHQe1x1MDAwZVxyXHUwMDAyv56VijZcdTAwMWPKv2S1n1x1MDAxOFx1MDAxZHie2ySI8bab9svl6lry+0Wr+2S9XG5EXHUwMDFmXY44/Vh7TsboXHUwMDEyXyVNh9yhl1x1MDAwZqqCf5H58VvU1+aiXCIh6fssveaMX1x1MDAxNOE9Pk2ucEhByb9zkkx4XHUwMDFl+3KbXHUwMDA1O3//jjTkLXRhgHdhrkJcdTAwMWJE8ZAtVmcwqNa/i5Bra8G+zCO6XyxnKVx1MDAwMfrKXHUwMDA0OeFLsfNcdTAwMTFcdTAwMTT+5Vx1MDAxOCpOUVZoKu5p7PROyd/Q+GbWjnmU7Vx1MDAxYuv9sVx1MDAxM3ODTDXGMDlBqz1w+1xi9JrnL1xykE7bXHUwMDFjNCCYfiu6e1Q//GGBf/clkdF4udapl3VcdTAwMTFcdTAwMDdLU1x1MDAxY4MluXrg2plcdTAwMGWYlrXQcEKzRY5cdTAwMDd53buTOWRukn9zeVHNzN17PvZlpsrOnkBbOU6dvldUyFx1MDAwN73w7WGA+3FZLJJ+xVx1MDAxZuffuUBzXHUwMDE1Llx1MDAxNSFcXFx1MDAxMU+hIT3SYHhYllx1MDAxMlx1MDAwZphcdTAwMGWqiSqOztayXHUwMDE322BsVCbMVeC7sWWdyVx1MDAwNfZcZosjtzXRzNtSzL+2OGmwuNKjl8ysaVxmfFFcdTAwMDT5KUW2c2wshzODgEtcdTAwMDQ8T0TBQe+CU0lcdTAwMTdcdTAwMGaW8N9cdTAwMWF28ltcdTAwMWbh0Ysrhvcg64JcdTAwMTDStVx1MDAxNJZcdTAwMWFxQU5/Y4bwuFx1MDAxZnNqWHdcdTAwMDdcdTAwMTfvuFxmdL6RTSHycNSrQ1x1MDAwMvyHqXZvTlx1MDAxZXRTbpplnkVb/1x1MDAxNmpyd1x1MDAxZFx1MDAwNtREbirTXGKalZ5en0Y6SWRccnHa8pdJJ1xcp/veOMp6PmqS157di0XD5P1cIjzO0lx1MDAwZp+3VPbIMPxTXGZ3hVR7KFx1MDAxM4VVk0WOj1wiTlxmiuZHXG7ylk9u/H2XibUo6q5IdMj0zqeqXHUwMDAwX1pT/+UwS5Ps2b73YZDeM0xieVx1MDAxZlx1MDAwMtm30yn2zPnjxW0yXHSpXHUwMDAy9cjjXHUwMDE5V+x2XHUwMDFj4eeBqTFcdTAwMWLSmUePi1Rjez/R+XL3Vlx1MDAxYu9QXHUwMDEzXHUwMDE37+zCTb9/jsE1a1x1MDAxOZfsTNDvXHUwMDE3XHUwMDA0s1x1MDAwN41RXHUwMDE1azSzzcBlyMBeQ89dXj8zc0lNRPmsI/Y0hMo03btmvGSXv4JhXHUwMDFijdRcdTAwMDCwlNfxdMXYaVx1MDAxM1x01D/PldqaXHUwMDBm6Fwi2O3pX7Fjpcf5WXCOxr6tifFi+7B2Wv6C/9Vn4UjniFx1MDAwMX04XHL8pOpLwVFcZpRpXHUwMDA37+OMXHUwMDA2eeRCeLYg8I2WXHUwMDAzKfBowIYsiz+X4kXAXHUwMDA3/D3wyFx1MDAxZoqDWUj3XHUwMDE54ZG3XHUwMDEz59t+KMLjzK5tXHUwMDBm6I1/Nlf4pn5fu/Kaw6y2W/2akcxPrEXOOKVcZsnLXagl1fTIx881Xdleke9TV0vvSjuEL3xNh4q7JnbVc+e2pOooZuDn3XxPpniKPolnWkmNpqb6zkBcdTAwMGbbtu27gS9qKcS+8b5RyeO8UTLcW1x1MDAxOFxm33HdsHRcdTAwMTRcdTAwMTZcdTAwMTSjI1x1MDAxYbgp6mR8OP7ud3LI1ldoXHUwMDFkt2jN5mI3xlx1MDAxYlx1MDAxYnCkwqLQQmJcIquIN40xlLnBti7gxttcdTAwMDKAI0lpfXBcdTAwMWRcdTAwMDOnXoXkziV4p0WxXHUwMDA17Pc2+EPA5/LwT1x1MDAwMFx0lOePxDTlk1Ar0pSkJS7rUVxy01x1MDAxZn1OQY9cdTAwMWbQXHUwMDExXHLL6ta/XHUwMDE52lxiRjCGLOSX/njlwlPfo2g/9C9G4Vx1MDAxMNz8bstpvlx1MDAxMXAwNcxtPMe+a6bg9dxcdTAwMWTS+jj2ZEiazd3pfoeIXHUwMDFjx0Hk0Ggt18tufX5st/EqgXM8yiF4bm3gfs1fQFx1MDAxNjUtwNDi4dyhXHUwMDE2nUsx9thcdTAwMTWZkoRcdTAwMTgmJkSaX7xcdTAwMTWHTX0uXWn34lx1MDAxM6pcdTAwMDY19+FcdTAwMDHbSTeXkUzfdF+Z0yx5XHUwMDEzg1x1MDAxNkIxXGJcdTAwMDSdd+RcdTAwMDWkXHUwMDFhuNe4+/7MYlx1MDAwZrtcZlxcTOlE8PlGMqC4XCJwQ60lXHUwMDEyXHUwMDFl8yFcdTAwMDd24+LpQlx1MDAwMZrjaSW+rqFcdTAwMTNKXHUwMDE0N3Bgws3d2CZ9Q1uHL0G2QIk5eDedZUteLvoym5HiXHUwMDFjlT2Lglx1MDAxYvhAj8vj2Fx1MDAwNuT2XCJyayD/Ov3CfPM8P46VwCe8NSyFXG7NV1x1MDAwZVNILlxcXHUwMDAysuxfyWs6/3XM+DhI8pnQzyzXl+EhZ1/a/HKVXHUwMDA02LCUllx1MDAwZlx1MDAwNDJcdTAwMTYngGChQOVDXHUwMDFiVJFcdTAwMDfUdGB0sNLmbd77Ulx1MDAxM7YwS1xuvyZKroBxeJMgm0NcdTAwMTNcdTAwMTlcdTAwMTAp4TspXHUwMDE5uCpBN7n2ci965d1rQF+fkfrI3zOKXG5cZlxyXHUwMDE3yyZoXHUwMDBmo3GQMTBcdTAwMTZ7p1x1MDAwNlx1MDAxZZJcdTAwMTFPPm6X2Y/cXHUwMDBm22efQFx0IH1ok1x1MDAxZlx1MDAwZlx1MDAxMiv7aXHRRLFg2fqqj4Gls7KEp74myo+py3NMXTbnyIgkXGLeYn5Mi1rL2Vx1MDAxMdVcdTAwMTiSwef9XHUwMDA0uZy2w6W83q+g0JTRXfBcdTAwMDXxRenUNP5A9NleXHUwMDA0gTtdTmOg19ViYbpcbvrpvs3s8cW3oC2K95ugb/zxfLIlXHUwMDA15cVcdTAwMTaOVPRubpqinuqe/3Z+IPRBM1xmiMb3UVJcdTAwMDV43Lvsiy+CXHUwMDEy9TR7utPJXHUwMDA2hM5cdTAwMTiOLzOcXG5cdTAwMTUkXHUwMDExY0hcdTAwMWWjXG5cdTAwMTAs4lx1MDAxY0Pb169UwdPXnoRcdTAwMTW83VZhi/V47PXc4LmdJKtcdTAwMDV90Ff3fjlcbn/+9MX2XHUwMDAwkvrVy1x1MDAxMYSs4oj2hSRcbr5FU25cdTAwMTP7mzarKMSo3WhcYsIxXHUwMDFm4udWrdFoV7gzXTGrQVM4XHUwMDE0x4CmXHUwMDE4oN7M3Vx1MDAxNy7NLe/yWr5TXHUwMDAysvJJOne3Qe3L3TxXXj3fsVx1MDAxOUWA+d2l3Vx1MDAxMZei9EZbRV7KUOZFSlJcdTAwMWRCzfwxXHUwMDFk8Mfk/UqAyqlT35+TXHUwMDEzqot03q5AUozAc/A7eDo5o32c7X76L0fndq5y3TzpwStcYprc5af191x1MDAwNZlPs8Lep79Az2uucYZw0FRf0SvEcv305HuFVEhcdTAwMTiv39HU/Fx1MDAwMuJaXf1+j1x1MDAwNzSJ5ftcdTAwMWVXfn9cdTAwMGZcdTAwMWQ3XHUwMDA0mbikcIfKyVeuZv25Plx1MDAwNSNnSZJki5u14DZcdTAwMTJcdM/TgDJUklx1MDAwNLVcbnhcdTAwMDVqmSyP1kxPU5OwWW1x0VUtzvQ8ruHaXHL2QFW3obJcdTAwMDVcdTAwMWRi8uv3Xl9cXFx1MDAwZbVMTlx1MDAxMlx1MDAxZHaBp+wrUIC/IXhUXHUwMDE3VWjS+q4qjlx1MDAxM5z9w71cdTAwMDGb5kGBYFx1MDAxMHJ0fKfuM0nHQ4KxXHUwMDBi5rXkszSGsYCkc1xmp2ZRgVZFjqNq9npJJz5/qY7zJ7RYe+x+WSvyko/PucaglCjPUlx00LEo1eVywPNcXKz9+pWj3Uy0Qp5cdTAwMTdVteGgZ0Myp+NHMFx1MDAwN9lcdTAwMDR+7bfEu8LjsZJm71x1MDAxZMD97bJnjSeC20n55Hmza1qJq1wiXHUwMDAyPIC4ftB2LZzbqMLXKuktnZT622Hs2Vx1MDAxNdM99Fx1MDAwNiONNZVGTuFKtFL33Fx1MDAwN8epas9ccieZP806XHUwMDA1XHUwMDE1wXH8w//sWGZ0XHUwMDAxu2xsjXT8pO8+SJ1ARkz47/d3XHUwMDA0kj05gNCvsztLoNdg7LkqTIoklTm4XHUwMDE4lfZccvx7KyVFeslcdTAwMTLbaDpcZjHmidRcdTAwMTmjoEGIy6yJdjOeXGJWSmbHSIpcdTAwMTBcdTAwMThcdTAwMTSMklx1MDAwMyVcdTAwMDBKXHJcdTAwMDZFgp6A3ownXHUwMDE4XHUwMDE0XHUwMDE5POHOibVz7Htd476u9syoXHUwMDAzR3BcdTAwMTlknjJcdTAwMDa37458qFrXsU1cdTAwMTX93mcodJxqtnlcdTAwMWKM1XPikDle1ilcdTAwMGX5fOuJpFx1MDAwZdRaLS3z5mnUpiaXWveb5M0yy2+uUkFvXHUwMDBizN/9re9cdTAwMTT51Vx1MDAwMuwqZ8ZC0Jaje05CPlNBbWdcdTAwMWaGXHUwMDAyfn/axSqTR1x0gK0nPkQgXHUwMDFjXHUwMDE2ejY9n1x1MDAxZl2Xd49cdTAwMTBcdTAwMDTrJVeScFx1MDAxOc3zNT5IiSfVPk5fW1x1MDAxML7imlx1MDAxZi6TPFx1MDAxY2Pzb1x1MDAxM9Sunj6pdNGbwnRJtFx1MDAwYmtcdTAwMTf7XHS7K0a9jMiOJPEtxlx1MDAxOSQkWrttyqckZVxcgKhii1twkf18h1/z77e/jlx1MDAxNopcdTAwMTnw/nS9gJKePOgjXHUwMDA2WnJTXHUwMDE52V1ZXGa0ZJVcdTAwMWbNXHUwMDAzXGZSqqvghTleQuH1c2Zs0D+Ca4LeyfPh9ZpcdTAwMTHl1SnygkrYLcS0g/OrNlwihcxcdTAwMTJd8ihuqCj3XHUwMDAwZNpcdTAwMTLlvln+tN7480B5a8d7XHUwMDA062i8t75cdTAwMTSMo2SkTouq8tzTiVxiplx1MDAxYp5FKkeCwDvPU8pdgViNx/ftXHUwMDFlQ5Y4oVuM+aa+gaCQJEV9bKB/uFteMFwikkB+Su1cdTAwMDJJ3Jk1UOeha2mzOUVBm7jaLP329oQkRaf8jqQvS5nmuVx1MDAwN8U1zm/YZuVA/m6kXHUwMDFmv1x1MDAwZsF701ZYhymqZtoz9Fx1MDAxZGsslP1Fqs6HvY67qKF9y/xcdTAwMGZcdTAwMDPc8MAvXHQkk6nImIPknqBcdTAwMWVVXHUwMDAz4aKb9npcXFK4qjKnVbBcdTAwMWbeoVg9/YZ4UFx1MDAwZo8lYVx1MDAwN1x1MDAxMD3aeVwiKHoph2lM7frJ7nBZ0sZoXHUwMDFk3X/xu2JyXHUwMDFl6rfo7MxfTbyChG+Cre74875XXHUwMDFiurtcdTAwMWZcdTAwMWaHv1x1MDAwZl9cdTAwMGZ7Oa/mtZfkvURF7GFTibeQfT9NtElVj/twWazNKm6y/JRza/s4XHUwMDFh/HdD5MpcdTAwMWbDnc5cdTAwMGbJ/j33OHK2JsN3v5XMl4T3Ylx1MDAwML1cdTAwMTgrrWRrJIpcdTAwMDdHcdzf783Allx1MDAxN3bDlSdcdTAwMTTPXHUwMDAwiVs6svj1XHUwMDA1kFQg4EqLKj49uopf9UaN9lx1MDAwNDlcdTAwMDdv8jtAWuyzj3bD0ETux/TlO8rilqz55E6Rslx1MDAwNFx1MDAwZVx1MDAxMVPTXHUwMDEw9NE7jHNDQLMnXHUwMDFlXHUwMDBloEar9N/Yklx1MDAxYulVT1CWildcYmlKkWSellx1MDAxZeSZny9cdTAwMGZcdTAwMTitJTWCLXhSylx1MDAwMT9ccp3BsjRN4/crK7X/pkFO9dRcIn2sy/RcdTAwMTFcdCNcdTAwMGL0wFOsWH6b1/Cuq6pp3Fx1MDAwNeFcdTAwMDbLdYWgakC/WS2I60T1KoNcdTAwMWFV8FuJjVx1MDAwNC82jeHLTVCtvtqQgqpHIfjNgyw5XGKzv57seKDkZN6z6Vx1MDAxYUZ21D31LVx1MDAwMezuIJZcdTAwMTj38ofIXHUwMDFiXHUwMDEwXHUwMDAxrseAN3Vd7sM0p9Qre959ICCmlT84VaFcdTAwMDSeV9He75XNfcq/O3464FhmXHUwMDFkk7RZi75m9jQ3WbOrp41cdTAwMTlnfFx1MDAxNzJEiCXRZ4+XKkCComGoUcUpQ3Bi2yrDW7hkh5+Z/lx1MDAwMtxOq1x1MDAxOOJQXHUwMDE5MklcdTAwMTLQVlx1MDAxYnsttVZpb5Bpr1x1MDAxNZhcdTAwMTjof0fye62Od4VvXHUwMDEz2zmmxMuub1xyibU3kNBcdTAwMWJcdTAwMDSpPtnLRdNImDFGuVWKXHUwMDE5qZyfd2tcdTAwMWPQntEk8cbW3qKb7PMlf3HEi1X63zN8Olx1MDAwN1x1MDAwZb+rOSNiOK3Hk0qyTdop47zfcfNeXGI91LX8m5n3XHUwMDA0MnTb9FCJS1x1MDAxM2+Po1x1MDAwMzD4i/ZcdTAwMWbvrCpfKviZ+lx1MDAxZGSioylbQlviXdViUCS97DmWXHUwMDBmXHTALK8lXG7UgXFjmXKQXHUwMDFmgPBm1E9jgEZcble2mC/1SY1cdTAwMTHNUDdcdTAwMTOuXHUwMDBiPuXa26pamV0lPJZcdTAwMWZTQVx1MDAxM+9PXFzHn35HST/E0kY4XHUwMDFl2rtns6lcdTAwMDGcwG+S3WbJN/pgxJRYWX1cYjOkW09/ZKw+4TXVKoainc8mXHUwMDE2SrFDXHUwMDE4ylq/wNSfnFx1MDAwNIa1x1x1MDAxYo55Pm/YVok72LKxXHUwMDBiXGZcdTAwMWO0XHUwMDE3XGKgx0mY8nBhtXdcdTAwMTPO1Smt+Fe/P3mLc1C/VVx1MDAxOVSpy7dcdTAwMWKIZZgucqviJcS3f/F1OOZcdTAwMDe8xFx1MDAxNtd4WWX5RK2e8YQqalx1MDAxOD/PpczTy9ZiR1x1MDAwZUDHfElcdTAwMDO9M9NSz1lIncyqaM1C5f+tZWJxREeppVx1MDAwMeNwzadcdTAwMTOUqtOmyN3wKFtKnN4gXHUwMDE4xpwkK/XEV+Mrc1x1MDAwMYny/9EwbrUoxp5cdTAwMWPD6GZSMIUwNa2Z+2JcdTAwMDGeqPpH33IvnbTxmlvMm9d6XHUwMDA0T32eXHUwMDFjXkhYK35cdTAwMGJ/MtO+XHUwMDE3n1x1MDAwZdpcdTAwMTWW61x1MDAxMFx1MDAwM2ued+mBhNxTi4rJ3FerXHUwMDA0dC1q8HO3ICYqquooXHUwMDEzo/05XHUwMDE5qzrxUXVheWrGJOgjmZetmnxj5dCIT7sw4MaWmTmFr51cIkF2/VxcXHUwMDA0XFxm2Vx1MDAxM53CXHUwMDFlP/tOXGIs+1dfhlx1MDAwZlx1MDAwNtxcdTAwMGJMVuTY1Vx1MDAxNK9EqLIg6uNOJJPjaX5cdTAwMTFD0DaALT1vXpBcXLWh3Fwi/o6opyFcdTAwMWamjcsp80BY0d7q8cpU6uY3P3RCb4SLY+FcdLnlWKajPFWgXHUwMDFjj2Cmwa4pXHUwMDEzZFx1MDAwMe7ko2zFRFx1MDAwNXtcdTAwMTdPRbxnm4Fal09IPCpLb2NcdTAwMDFsXFzl71x1MDAxYlx1MDAwNs+PobepXHUwMDAz4qE+hqomrEVcdTAwMTWn2JPWQUaqW3PdXHUwMDFh0VFh5St49qFv91x1MDAxNVx1MDAwMlx1MDAwZjQvt1x1MDAxOUOEoFx1MDAwMpaVf9cjVp5of2v726T6olx1MDAxZX78K1xiXGaM766LqTqeyOxyfavc1X698lct5D99Q/Dua1x1MDAwMepcdTAwMTL1jLPy/M1Akz3BNu2v87NzP+f9iPInTbPstsI+mmalkPqaj9C/vtt+XHJs+Tdiiph3XHUwMDE2rvZcdNZpVzJcInpAWoZgTuhcdTAwMWNcdTAwMWUxT2y15WZ/XS/xeDAmQjTCRemLLjA6jlx1MDAxN1VtXlhcbqLNSEb9eLNR21+02TxUXHUwMDA0K16a8NMzRsZcXON3vvjIXHUwMDFkIFx1MDAxMTE2P1x1MDAwMpxOvNgq9ijZQFxuTXapNVaj3Ti9XGZcdMCvzd/Y3mi3vbvB6Vx1MDAwNndTTY7rfEOSPuHTMa3syfqq3UpDrUzOXHUwMDEx16ZTJY1vyS3JzXrL3UJy1OfyZuZa9aA9y3miXHUwMDBiPsz6WFx1MDAxNvJGJjLbYdHSbDE8L6rSN5WajXSsq++mX3GrkfxKXHUwMDE4a1x1MDAxYvlxNTh8+dws8u2BJMhd/fnbZ81F4slYuK3S97KoUmSVLL3fK62+XHUwMDA37SrgKPjv41x1MDAxY5yhq62bfV7js3lcdTAwMTNcdTAwMDb/6Cdncdf7tJGySFx1MDAxYjrqNFwiSCRFa7Fa/3aQXHUwMDEyuzZ/XHUwMDEwXG5Xvo9jnVFcdTAwMGbvXG5G6vdpVZaHXHUwMDE07OhLtVx1MDAwZW5ra6Jp5fnHndPlVfzPn32FXHUwMDA3hqFaKVvssLt+XmbT92vI6Xq0XHUwMDBmJJbDZUjTy7KEorQtXHUwMDA2MVx1MDAwZmfXublcdPjj86/dSt+0XGaRRUB/IFx1MDAwMISnXm6lNyNuelxydFx1MDAwZadEfZJcbuidfFx1MDAxNOwzprRWRL6NI1/RZoHHmFx1MDAxY4s+djZxsLllrtuwmGfh25Wz6DxNaohcdTAwMTLLwNNv0rNLXHUwMDE5cYC4XHUwMDAxXHUwMDAx2fHyKFdcdTAwMThYMl+6bv9wvy7BsEmW0chexJ1dNjgoNlx0XHUwMDA2XHUwMDExWeI4XHUwMDAzlWvBWZ4lg1x1MDAxYVx1MDAxYT6dmraHXHUwMDFk+uxj59g6/1x1MDAxNcdK+aKs7FUlPlx1MDAxOWLjyCjxNTI1d1x1MDAxYahcdTAwMGL6UNv003QrSzqIpFOD+Z3vXG6SpfhnfeFtxq/hwPVcdTAwMWRcdTAwMTdQXHUwMDEx3ElIXHUwMDEzMlx1MDAwM+Z4teJMJ6iH4+mT8qiqlvDkmlxyp/drXHJp0Fx1MDAwMVx1MDAxYrrjVyq9zTFcdTAwMWVRbY6q5tvn275DOGVuy43t3D3631xy+/m5O8qC4C6owo5cdTAwMTiNcn7blH41ZIhAzJCoTLG0jcg1MS46zUP4JJLPa0+cti6LUlx0Oyc4pl5cdTAwMDJuxyemxiZRcGiAn18rXHUwMDFhIFxy2jFCXHUwMDAycKXnvoKkWvJcdTAwMGVqXHUwMDAytoaGpZqTXHUwMDEzvs6xYobc0MZ938eeXHUwMDA384bGsLJcdTAwMTlZeVx1MDAxZfZOWWRInnSy929IkvpcIp4+PDfKIFx1MDAxOKydXHUwMDBlJUdcdTAwMDKZIKTVgmk9qH1AOrVzg7WujtLQkjFEc7pcdTAwMWZfWVx1MDAxMrv/lyn1SrLoXHUwMDExL0zTttdcdTAwMTNp6rOe2/u6eMtX6N/Z11WigkDIrSfIXHUwMDFk27BC6Vx1MDAxM//1zKGKXHUwMDA1omRcdTAwMWK2hJQ/yCWTXCLbXHUwMDA28+PGXHUwMDFlLKRKXCJcdTAwMGZcdTAwMTHL6iPC5enf1Fl5Xlx1MDAxOIOf7nZcdTAwMDaUNFx0yEhcdTAwMWM2XHUwMDFm2FfYUSfIhCzodDBWklx1MDAxMVNcdLRcdTAwMDdcdTAwMTGCiDnknjV2tCFHpLhcXOhr0eX1Vo49cnq7zWF3UVqflEXIJ1x1MDAxNX9ccvO7fWGtZ3jAXHUwMDExvfu5REc3wftzsmeEXCKPSpLcj+go7LyG2bNv0H1Dl81IdTr6gDHFyTpcdTAwMWZKfCR/W/iYafbpUkxcdTAwMTA9wVx1MDAxNlfmOC1cdTAwMTA+PCjAoUSM5MknXHUwMDA2j1x1MDAxN+g1K/RKesnrZuOFXHUwMDE4ek7uwtdcdTAwMTjhpkmcpkDXrrPIXFwt9zTQY2QzgK1Vp1x1MDAwMVx1MDAxYqqC+kPPg0hcdTAwMDJtTPZ7Plxi0MX2lU5cdTAwMTlcdTAwMTKNiW6D16Vzp8LphoKOzNlE182B5Mxxrv/iXHUwMDAzzp9IJ+iErN4hKH8+y8g/7lxyXHUwMDAxmVx1MDAwMEjW2LbC1+uX2HF0fv7li7kvqqrAXHUwMDBlsX5ZZ1uLiEDjpqjOOPhccsOZsPp9qVwid1x1MDAwNJ5cdTAwMDD4fS+TXHUwMDBmXGKuQSxgj+nB/p9aMN6aSiBTVX/fTJU6sjK/K0Q4f/XW36+CfVx1MDAwMe1EqvBcdTAwMWTBO1x1MDAxYcErOuWv4WK/n1x1MDAwMv9cdTAwMTDQXHUwMDAzZpFcdTAwMWL8Q0DRM1x1MDAxOCGJXHUwMDE5w+lGJFx08Mwvy+tHq2z4Sv2+p1JcdTAwMWFcdTAwMTa7TPBWvFx1MDAxZZ+hU9RuXHUwMDA2XHUwMDFmPUsppIxcdTAwMTn8blx1MDAxMmB7k5xcdTAwMDGe96tT+fqpcl+Ualx1MDAxZcvgc1f9pVx1MDAwN3Xj1N/8tNXrKSVcdTAwMDAvkJ12XHUwMDA0JWqXMMNgkONcdTAwMGbUulxixDiFadfxXHUwMDEwy+ZJxpJlMG1v+6erNWtcdTAwMTY/XdV+uppcdTAwMDRMxa6s7FczftFZmiRpj768V1x1MDAwNUi7V7z09ZnCb5iAXCI9QFx1MDAwMS3i9H5GXHUwMDBmZJhEXGZcdTAwMDcqlVGvM/J5P1Gaha5TU0iIXHUwMDFkpFx1MDAwZZuziXdkXHUwMDAz9lx1MDAxN8fPXHUwMDFiNC0lwGK3svTtQMzvnaVVulx1MDAxZsex1Ft4RHjtdoehr0Ndd2LNrMbz+/w3f/fjXHUwMDE5i1v774S1Jlel/3RqXHUwMDE4JWVbmLlcdTAwMTVfxdIvdCTCXHUwMDE5Qybn4lx1MDAxNZWZdsxFKZTp7ypcdTAwMTi/uFx1MDAwZu1gNlx1MDAxMVx1MDAxYluUz7gjLp01XHUwMDFk9E0+01NiXHUwMDA3xjRcdTAwMDaJu3jE2StfYHmnaqlcdTAwMWKBWY74sVOAXHUwMDE5XHUwMDE2cIVwXHUwMDBi9k3Ri1xiW4e57ozl+M2nWezvgFx1MDAwM+zZWX5cdTAwMGZYMEGW35xcdTAwMTjony/on1x1MDAwNlx1MDAxMcXwXHUwMDBi24mAXHUwMDE0RdKooezRlPFp64NcdTAwMDKMXHUwMDFlKPn0OHHbmj/bLYjyVq1NsaujjiNXRLNb+Ioz652nXHUwMDE1tlx1MDAxYVx1MDAwMmTRKlx1MDAxM1x1MDAwN5aqtY025cKoXHUwMDExXHUwMDAyr1x1MDAxOejA59RcdTAwMDdkKvbFXHUwMDEzNH6U0Jf5N8+FfuNQqDeHolx1MDAxN3jtPO/G0TpT8c2SRFK0P5vS9+pvTkSuf/d110L4qZmf5i/t0mE3zoOfYlsv/U7iXHUwMDAyXHUwMDFkXHLzXHUwMDAzcovTdlx0vMdKJFx1MDAxM0tVsmbe6WI3p+XG015DJE6DNVBeuVx1MDAxZlx1MDAxMu4rXHRcdTAwMTJcdTAwMTnamSe3tv3R4m5yvtxfxjG/fsRfNneCQYpcdTAwMWVPy0rhPVx1MDAxNydcdTAwMTi4xUW/5+JcdTAwMDGyve1zuIVYQIdkXjU7XHUwMDEwrUeQxlx1MDAwNVx1MDAwNI9FhV0uYlx1MDAxNbppjkKbXGL2Q0GGT9C+yuZN38P7UCz/wOdcdTAwMTW0qYKV8qtcdTAwMDXmM+CBPUdt2WpgvPrgc2mO9E8n7UFGXHUwMDE0oPfCp/w7e0b2LdEhmflN95hkXHUwMDFiL1xiJNhcdTAwMDb1vrBUXHTXWzv018RxqpRcbq9f5q6uftNcdTAwMDNcdTAwMTRkbqervVx1MDAwMlxy23894id5iVdJjfSAVZM4dFx1MDAwMvCcuUVcdTAwMTEvZ6mMXHUwMDE38jKetfxmXHUwMDE576KY6ftd3Vx1MDAxYauvdr1wZkviblx1MDAxNuhcdTAwMTP11yp0ub1D0upRqVJ7hDGPz/yPLyS2/p2fZzljU7aBhl37nFx1MDAwMzaF+uR3ii5re1x1MDAwM3UsYsbSpVx1MDAwMPKWT2WuXHUwMDBl8pZcdTAwMGZqRVx1MDAwYmaxYO7c5lx1MDAxM41cdTAwMGWaoC957OOeYXZcctLTkyzzaqRvJueDYWImlqhcdTAwMWST94lcdTAwMGLTupRdySeRXHI6jZKeJYD3vWKq0ry9I4JcdTAwMWLd3jtcdTAwMDSLiPW3/jG9jNtCXHUwMDBia1x1MDAxZlNcdTAwMTk/gYBBkEx8XHUwMDA2XHUwMDBiXHUwMDE1bG1cdTAwMTNcdTAwMWV37qAvY4vN929cclx1MDAwNmraXHUwMDAxl/wqJExgslx1MDAxZvlcdTAwMDFcdTAwMTJcdTAwMDNHcMOIZ1G0XHUwMDA02+/U+jpcdTAwMGJDu1x1MDAxY+Qv40BFeSzT/e99sF5DeNf0/+FcdTAwMTbqXHLeVUQkgI9cdTAwMGV3vCy7MUziNlx0XHUwMDBm9Opvjlx1MDAwNv1qccprpr1cdTAwMWG/b+X77PPONCboc1x1MDAxZTREkVx1MDAxZcjbPKAxLFxuOTpAWHp36jO6pf0rXHUwMDAyXHUwMDExQr9fqOg/feW9t1x1MDAxYeufKsuZtVx1MDAxZn+up/P8zcOLyXHv1Zf7RUNY5EWcPlkq9I+r6FwimWVSKk99abGM61xcYUlcdTAwMGIu2tc0c0/TfOJBXf1nLkdcbpUtfrA+RJe11/Y1NuxcdTAwMTjqmq93aFx1MDAxZFx1MDAxZJR8MGiNXHUwMDFlXHUwMDE29Vx1MDAxMi11rFx1MDAxODZgi8o7XHUwMDFjVautQYAzUzS2b1x1MDAxM+VcdTAwMWbGcyhcdTAwMWRcdTAwMDaPjFAtcJrpm5vGh4ZcdTAwMDeeq1fdoZdWRVx1MDAxNzZplt/1cI56eS7vLL9MYETQplx1MDAxMlx1MDAxY3f4XHUwMDFlZlx1MDAwNFx1MDAwYkqlIFxuSUdcdTAwMTcgOZX9zZv0yZDlZVnmXHLqdmefXHUwMDBiQakjNeC4xFlcdTAwMWRXize8KrfFOVtcdTAwMGZ4XGJJ90hxtqfpe8bb7y6Dflx1MDAxOcKx1lxcVzRcZnKJWPpxUOpcdTAwMDVPW2htvdJmL36SXHUwMDAyhybm50VUJTSpdYRcdTAwMWNcclE8d/5m8FLXvFx1MDAxYoJcdTAwMTT6+ylf6aqiXHUwMDAyoFx1MDAwZUfPNd5cdTAwMWODX1x1MDAxZO05hXyqn1x1MDAxZcbx48uUxyFcblx1MDAwMsb67oCryJvhXGZYfv4uf2BcdTAwMDOR9ITP9+xb0CBAXHUwMDA2XcDtmlx1MDAwYvcxVlxutUNcdTAwMWbVolxyXHUwMDFh89jNby3VY8orNXubx1x0MOxWclOpXHUwMDBmYvKiffeScPRfa1x1MDAxZqcu75G/yTf5JmvSrEnle9Hqet9cdPtNu4dBs+4tsbDvVGg6THb8fr9AaFcuwn/N6vqbU1nMz1x1MDAxM+GAXHUwMDFlzZ/MgVx1MDAxOfhzJyve4G9qyHZZ4lx1MDAwZp1WWTdcdTAwMWRAo+9Z6UmkXS6HmY/WxiSdM3nk9ltH6lx1MDAxZKBcdTAwMTd9MLNIl+mnXHUwMDAxjEhJXS/oXGai1TvkN4tyXHUwMDEyKDwyLcjwrZhaXHUwMDBlaINcIm3fXHUwMDFkXrlcdTAwMTgzvMzsXHUwMDA181xyST79zTdepzd4XHUwMDE29FxcmVx1MDAwZWvb40v5XHUwMDFk/mCDwv1owIeQoDyL6lx1MDAxZFx1MDAxYoxcdTAwMWTeTPBUOZCgVaFcdTAwMDBcdTAwMDGv14TfnGZpwZs8bzmUI276NCglf1xi9Vx1MDAwM8pcdTAwMDdcdTAwMTKCt1nkT1x1MDAwNkrxl+s45bdcdTAwMGZ+9JbLnPr4j76SOrVBXHUwMDFmXHUwMDEysM5C89M34S2ncUWQRo9+XGaVNvy+JbzHp1xuxFx1MDAxMlx1MDAwMuSaV0+S41VcdTAwMWGebUZcdTAwMDZcdPRcdTAwMDGN1m1yXHUwMDAwIF5wXHUwMDBm6Swv8M1vrfd9qpfdgpzERSAnYTTfZL899PxcdTAwMTd/QJGXcKimP5LcjXaGuFx1MDAwNzg9cFx1MDAxOL4y4yeoXHUwMDBmwMdcdTAwMDG0uFx1MDAxNrCu7sfH3TzkXHUwMDFhhqNcXNt+t4ehsYdcdTAwMTEjPWmvn5t92fsqXHUwMDE4b/NkPkKFNHmQr6fZ70Eqa8HY9pXCPuDgfVx1MDAwNOOd3GuEXHUwMDE2k1x1MDAxZLJqnudaXHKTV/dcbowvi0JcdTAwMWFKf1x1MDAxZeIx61x1MDAxM+v8isVDLFDx4W+O5Vwi9f7x82/jyf3uMlj6XHUwMDBix1BmLKhcdTAwMWWzXHUwMDBleUtcdTAwMGV7hPtcIvCGs1x1MDAwZvTuif3mq/T4t/6RYFx1MDAwM+5cdTAwMDZDVV3vXHUwMDE4vXKbTvhX9nxVgVxc0THQXHUwMDBlwy6jt1x1MDAwNoWdyGJOJlx1MDAxZqtULHRcdTAwMDZDrm/rc9zt2i7OfFwiRKulTqDewJi6gMHpXHUwMDFmg1x1MDAwYjY3XHUwMDFjOD1gXHUwMDEx8CSv2W1mLm5oXHUwMDA3KuBUny/xfDxcdTAwMWUwnM9pP2XbsPHs0ZjUY1ZSnlx1MDAwNaUzur89XHUwMDFi9T09+2n4rVxyh+VcdTAwMTCatzJRxt9cdTAwMTRcdTAwMTlV7jxVv9k6kuhHsEI1knVygFx1MDAwNEpj2b27eDNQfObcaaF9b9BcbmNcdTAwMDd1cOVnX86tkz43PsW6XHUwMDExTqz2vlx1MDAwMKdNpOiqjtVcbuWzXUPyxlx1MDAwMFx1MDAwNVRepUVcdTAwMTFcdTAwMGXIXHSw6LKgmjt0nVxcoq77wVxuIHrJb8XX2uhcdTAwMTjyr5Goqcr7jb+k/9aRdTZO8d37Ta2lcvi28d5et1x1MDAxZFxukVx1MDAxNHeO723lbVwii7U2zHs8XHUwMDE5XHUwMDE1gq9cdTAwMDPSV+lcdTAwMTe0fIdcdTAwMWKnUOJcdNHubGqyMKdcdTAwMDDcpWlcbvCQXHUwMDFms29222tcdTAwMWKGXHUwMDEz5NhEVW4p20Fq34h/emHI85v9hcya4GxcdTAwMTXJlddBclx1MDAxZlJ2r5ZO4FxcpdNr79it6OxOf1x1MDAwZVxmJK07I/yHn6WfX7Y9e+4/v4wy1bzc22hcdTAwMDeMx3QlSFx1MDAwMGaZXGL2XHUwMDE1XHUwMDFkXHUwMDE1o65SLlqDXHUwMDBiMVx1MDAwMfD8XHRcdTAwMDQ3XHUwMDE2nbXx3sxCyP1rLJ9dectEXHUwMDE5bIyrkDRjo6CYe7MhIPxcdTAwMDF/3ixSXHUwMDAw62hd18oma+ZcdTAwMGVcdTAwMTCj61Mrn4CZSJ1TVVT+XHUwMDAyODdq8f1cdTAwMTRPfGyUXHUwMDEyjVx1MDAxZnpR01xyiTC7pzXI949pxiOJrPc2OFx1MDAxZCCvgagqSXz99lx1MDAxMrycXHUwMDAzJ8pI5JDeM0VtbslXNStV/PrE6UuN5VwijYMu6JeXZlx1MDAwYsj8m8OMYuGsXHUwMDFh5D5pXHUwMDA0xVx1MDAxOK8nYUZcdTAwMTLzqKHnS1xcYa27cbJcdTAwMDMuXHUwMDA1+k1vXG5LXHJcdTAwMDT5128zKlxmf+9b1iuqj9KjhNM8R7ya2FxyXHUwMDBix781XG4z5zVuVY//1mdcdTAwMDYsXHUwMDA1n1x1MDAxNXzYiVx1MDAwM56qKVRcdTAwMTktW1x1MDAwN1hcdTAwMTE9uG3Oxu9cdTAwMTdcdTAwMTa27pb6T4QmVduUezhcYlx1MDAxNsyy7VbBXGI0KVx1MDAxNcrhm1xuYU7oSj2af/o50VFcdTAwMWK1XHUwMDA1+FG/loG9XHUwMDFlXlx1MDAxZbXG/GAp6uVcXGj59UjaMmu7PaswdmZcdTAwMTRxq6BcdTAwMDK9md5BbnHJr798RVx1MDAxY+5cdMt/95dZv4ODrXOcsos59dg1KMzfd7i9XHUwMDEyXHUwMDEzx1x1MDAxZjiOx0z76O6ai86+Uz+W/6dcdTAwMWa/XHUwMDA1MreDTXSFXHUwMDFmzu+rLYD3XHUwMDAzn1xm/KB/XHRS8XY1J4evKl2Hb9G8XHUwMDE3U1mzQEhlu1Yg6zVcdTAwMTHk4milZLDMx4AhKqLgZfalsoCiUshzNlx1MDAwNO2ratLeTPXPXHUwMDAzjd/8fMAsrvGnt+P1bE72+O0rKFx1MDAwYlx1MDAxNINQS6h1tNs+uIsu8r7Bx4s732CEXHUwMDEyklxmiPLXo5BJVVx1MDAwNXhnuoT9elx1MDAxNKFcdTAwMGVyomSnwrxcdTAwMDVcdTAwMTXNXHUwMDE26ULY6Fx1MDAxM1au+SztWimIbYZpae5cdTAwMDBx6LZNWFepPn/om5SlY1x1MDAxZENvMqnI1Xi8MivA9lx1MDAwMzRgebCbdbZdSUNIQHtcdTAwMWW03G92RJ5cdTAwMWRcdTAwMWJcdTAwMTeiq3CO/U9fhuRUJF+oXHUwMDEyTs6Vsp9cdTAwMDNcdTAwMWGdXHUwMDFiwLZa/ZA+k55FbPRcdTAwMDZlVMOwgSBcYlxcvvfGXHUwMDE5X1bAXlH8nFx1MDAxOC1P1lx1MDAxNzSaXHUwMDFj1/qaJFWhllx1MDAxZlx1MDAwZlx1MDAxNFxynuXeXHUwMDFj3/JcXDKCKIGnqMmnXHUwMDFh5Vx1MDAwZql8akz0qlHrIHvycegr5ox7okam5XNPsu2O+FRsf9fnjWlcdTAwMTDcwbqF00sqo6WzL1x1MDAxZp3JZKJdQZ6NYW5cdTAwMWTcWWnVn15ATy3pvHtTR55TXHUwMDFj1ZO+ZrTIXHUwMDE4zVx1MDAwZUuUR7D8Tq6vuc1milnfdylcdTAwMWYklPXlkttcbjtcdTAwMTBcdTAwMTBcdTAwMDP6dlx1MDAwYnDBRppK4pNf3yb+gPveMWNqXHUwMDAxact8XHUwMDFjXHUwMDAyeEjl+15ZtdOnjyU0X4vb0EL6jJdcdTAwMTgrZZd1klxy7bdJ+rSR5TCDRtpcdTAwMGVNPkto7lx1MDAwNy9cbo1xPY+MQo5qId1lWUrNXFxsNj+/uo9i7lx1MDAxOKjQQy5OXHUwMDEwNKddlfI5jFx1MDAxZLbDyGvK3WzSPFHz/FxmZc4v+Pv+gOnzc7KW56NoylxuZVx1MDAxMOCVSSn2iujlzydcdTAwMDROXHUwMDEyLlfzIfhKqa2GKkqlXHUwMDE5XG5cZlx1MDAxZdZm49ZcdTAwMTfy96FqQZwnzfDMMTpkXHUwMDA0XHUwMDFjXHUwMDE0r7Jli2OpXHUwMDE4tqhcdTAwMWZTQIRv0CaU/Fx1MDAxZWFcdTAwMTVcdTAwMDQ6ZrOJQ41cIuLhMsboJ1x1MDAwNlx1MDAxNVx1MDAxNjSDyiTjWLDfTpmlqlx1MDAxYzf56o+1pFx1MDAwMWhcdTAwMWJgda76Lb9mhdmczCFtelx1MDAxMYc+M6pCf+vQJlx1MDAxYvOueVx1MDAxN7S+i1x1MDAwMrrtn+eGhem5N+XchFx1MDAwYnJf+9u7NEtcdTAwMTfgXvWCdlx1MDAwN1tcdTAwMDb8JnBil6nXXHUwMDE2NSvXXHUwMDA2QP+Rx5x0kPw9i4lcdTAwMWIv7nK/jfZtwtebJFx1MDAxZoreXHUwMDFlxlx1MDAxNojvbVx1MDAxNzNcbqZnxGLhL1x1MDAwMsvttOkzcG/PhFSjLFwien0s0/vKP1x1MDAxM1x1MDAxZkv/9uao/NMyeSnmVGVZgN1cdTAwMTH740OkW7rk2VOnosLQo1x1MDAxNVVcdTAwMWWxO3dcdIpH8KzTz6Z0slx1MDAxZut+7l15/na08e0v11x1MDAwMnfLXHUwMDEzXHUwMDA1Wl4gUPtD9ISIzT091VBn2/qb6z2RITMtoz+MW9i+XHUwMDExXHUwMDBl4qvt5TWhrXPuPFxmdGdcInWGXHT6L/Ox1pBdpslcdTAwMDNcdTAwMGUvf7xYvLDfvsipOkb1YeT7XHUwMDEwXHUwMDFkfruw7Ues8cjX1OEonclN4bBcdTAwMGbIXHS937hd2o/mJFxmXHUwMDBi3aD4XHUwMDFlXHUwMDBi4n49XHUwMDE5x1x1MDAxMbjjR7iH4DwocZn5e8fqVLLw+22oJ1wifoMnvL14x1x1MDAxMu9Il18t0Eo1vJ0rXHUwMDE20JMg5/FcdTAwMDa8+VlrJlezd9m/qMpcImtFXHUwMDE4XHUwMDA17iq5joH4XHUwMDFlV5VG4ktB/aeTuPH5Xr/7hGyQXHUwMDFkXGa4tU0yXHUwMDAwXGY2XHUwMDAw6VdccuFcdTAwMDRjq5tgbEm9XGLLm7lN/CH+NiDlM1x1MDAxMlx1MDAwZVKz8Fx0onrJ2EK/fv+bg1x1MDAxONpR3CpcdTAwMTS15W3EXGZcdTAwMDSkxIHSkVx1MDAwMoqn87pfjiHqKi2EuVqiJtY5/VsmmvkyUEVcdTAwMDH88G3vXHUwMDFj8SFcdTAwMWI1p6F+TFx1MDAwN7p3TyE+4FwiWXjo3D67VJtcdTAwMGbup5XvXeiGk6uQ8HdA5lx1MDAwN22AmpPTRpDQhVx1MDAxYXLyaKy8P5MxXFzE+nfhXHUwMDEwQ1x1MDAxNqXRilx1MDAxMUij5bvx/MdgUtJkXCI+LPlcXDX/7jqRM57z0Fx1MDAxMs7t/Vx1MDAwMbR6u87nk1Yo8/3urlxmW00lrKhH5FPit1TkroX4lMlcdTAwMDHzXGavrk+/m/SqXFxcIlx1MDAwMoHMXHUwMDE1XHUwMDA1+uyOY1x1MDAxZFBlXGLYcCqoXHUwMDBij4y9I9/Mrj/tx+FYnONev/lNk14/XHUwMDAxwoH2VOXhXHRS6JtcXFwi+EjXdyR/QXV8xlx1MDAwNFo2dI8uu8Nlcpy/7Y5vzulXUHJcdTAwMTOOKTHQJFxioqP/dMZPrFx1MDAwMEeoXHUwMDAym1x1MDAwNzqxh3xb7MlcdTAwMWQv1alv8eWxiZR8NFx1MDAxZfCqcVx1MDAxYvVcdTAwMTGrM0qwXHUwMDE59XyXO+yx2ZBx17/5XHUwMDBiuWOpUfMgt1xmtKLoRIv0XFx5RFx1MDAwMEfx3W/NXHUwMDBiaEDx+YD4JSVV+biY8k2Q5N1s+bFcdTAwMGJWeISHPlx1MDAwNOmAcsJTgewuXHUwMDEx+TH7gFx1MDAxZYdww9NdhTFLITvX1lx1MDAwMZ9Zeqna/7D3JsuSctma2FxcT1F2p5RcdTAwMTl9V7JcdTAwMWHQOz04rTOjccDpe1x1MDAxY2R6d8GJrMyr/E9e00QmM1meQcRcdIJms/baa33fXlxyTNoonfmOjvvzqNLZkDFcIr1wzf5cdTAwMGVK0ERcdTAwMGJcItiIu+nD5dTxR4/gX9/hovJOo3Fcclx1MDAwMo+2ev6QPWrGKow2fvRAt/qLJT2Kg4fDTXRKUKeGc37eXlxurD3vvZOH+pN//6xp3rnMmuwyU4OQRlx1MDAwMVx1MDAxOXyCTGhAglx1MDAxMlx1MDAxMXpcYv502ovnSVlofdSdbFx1MDAxYm3cRm+nlkeNf3M/OZ+Usjw3dy2e91x1MDAxZY5cZt35XHUwMDE031x0hVx1MDAwMXhBvnD4flx1MDAwZt6uw7lcdTAwMTjVJM18um82XHUwMDAwxFdGv+VcXNSfajbsumWQ0+BRK7v8XHUwMDBi+9xCxUR1svrkXHK9XHUwMDAy1Fu6gGzl7Vx1MDAwMEUpbJJcdTAwMWTYtnX4XHUwMDFlYHNgJFLpbry9yFwiXHUwMDA3/+BNXHUwMDFjY5E6ZVx1MDAxOFx1MDAxZjLeOYnjXGKVX1x1MDAxNvItQlx1MDAxYTWx7GdcdTAwMDR0rMV9p9+R/mM9LcxcIlxcXHUwMDA1XHUwMDAy31x1MDAxNl/j78RRXrH95lx1MDAxNErZWOzOXHUwMDFmti9nUbNI0HLfT/feXHUwMDE0Pr9YsTt9cTr2L17t8sLFodblMdWGdDGIr3It9VamLIeZL3IzXHUwMDAwmfpcbt+H6eewJYByNydm355dqXCEPbLXSt5BvfzkSU0wlefc+zCVXHUwMDEz89PnZ5tXa2llvlOEkNx1XHUwMDFmcbFlXHKKemPoZXP2XHI/SGNcdNRgOHFD8o6OXHLVtHZcdTAwMTRinFx1MDAxOVx1MDAxYcFcdTAwMDZcdTAwMDJh5IG7ZvlcbtM36nlcZlx1MDAxM8wsUzeTWeNeRaLgi1BheMog42c9o/bZOkq2iH6dIGYp0Mhro/ViaXtiz83Fbz9dMsUp0Vx1MDAxObCZXVx1MDAwYnyVP0tcdTAwMWJrjVx1MDAxZpQ0gD/3XG6tXHUwMDFh5VxyvlHzXHSEXCJcdTAwMGZ+XHUwMDE1NUCf3MVTfG66841VIKjTXCLBXHUwMDAyRMs2lFx1MDAxZS++iONcdTAwMTTN21x1MDAxMJc8UjeGg1x1MDAxMdZKllx01dhDOE6UMvszNIbCRobOXfLDU1x1MDAxOEXXe09+XHUwMDEzzvun8cxcdTAwMDc/wD3Qu0eb8ZBcdTAwMTS74MVcdTAwMWKKXHUwMDFiasfOJKbxLMBcZo0krLXoJFxyXHUwMDEyZYaXLdXawdNrj6RcdTAwMTNcdTAwMWLIj99D6XF+XHUwMDFjNf7lmeYnXHUwMDE2bN6DncXvN2IzXHUwMDBmmVx1MDAxODosM/Sbc1qwXHUwMDAwWsqDWUzNWZxcdTAwMDDf52Yzs8zL2MUnsUdEYJFqK1wi966KNFx1MDAxY1xioNrLr1x1MDAxY104XHRcdTAwMWW/qICYMnHe8eNcdTAwMGKceFx1MDAwMVx1MDAxYfZcYlx1MDAwM5Y9TVuq602l9Vx1MDAxOVx1MDAwNVM9XHUwMDE3XHUwMDFhRpDzrc5cdTAwMWaUXFy7O1dcdTAwMDY23zd3+Fx0Mj19qkOdqZqQPlx1MDAwNpQypIFcdTAwMTNcdTAwMTiheS675+sl5H3nf1x1MDAxYcz67FilpSpcdTAwMWElezp+lMqmglx1MDAxN2PY7Ue78Fx1MDAxM2Ql3Nol7SRq+Hs2XHUwMDFmcac5RIDWmUVcdTAwMWSYZHTMdGlcdTAwMTbEIy9FOlx1MDAxMO8pPVxudut2XHUwMDEz5C6DzMgtM5NcdTAwMTjwKLtIcuqUjqJcYkPwqVqJbEVj/6BWbe2ZtDdcdTAwMWOiVmnqtdtYt1x1MDAwZnhcdTAwMWM3XHUwMDE3rkHWkHErWFQt91wiT51mOVx1MDAwN0DTWttq9Fx1MDAwNU03M4J0m6wrrCpkzrib8VdcdTAwMTdR62TSfk/L0pH1MUiPql1cZvQjPrCoXHUwMDE5smDmTrnV+VPhi+zsQjdcdTAwMWWE86npWlx1MDAxNX5MXHUwMDA2VFx1MDAxMlx1MDAxYlx1MDAwMDZcdTAwMWLbXHUwMDE2mjhlwI/4/eLzXHUwMDBmsFx1MDAxMEGgS6F4yb799uiZQGCL+Y5cdTAwMDPyS0TpcC/0xVx1MDAxMyGXM2oj4v1YiP2VmjtB9tlcdTAwMTA9389cbkL0XHUwMDBiXHUwMDE2XGaDTbhwSmlcdTAwMTeB7ZZsXFx84lx1MDAxNPn7w1pcdTAwMTP9br+2L6Ih7K3HXHUwMDA2vFx0soRcdTAwMWV8uWOQXGZWeGWWXHUwMDBm5O3rN79Rilx1MDAwYsq76NN5sZtj5VxmTFOnXHJcYlx1MDAwNIJcclmRL59cdTAwMDevj7x6XHUwMDEwfvB8r7tYKqKfNKe7XHUwMDAy26fpM3Ih/LPLTuBlhuBcdTAwMWO3XHUwMDAwSMZJqahgXHUwMDA3dOKrXHUwMDFij0ZcdTAwMGIzWM8gjj1cdTAwMWVcZqNccreNb1NC67+Pnt1cdTAwMWY0SjP39+4uyFx1MDAxOFbexmF9ZlxyhJlSyVx1MDAxMDnJXHUwMDA1pjBaPVx1MDAxZlmmqVk+XY6VqCp931x1MDAwM0t+mFx1MDAxYig9SCfLUDJqs84655+cdIveXHUwMDFmr8C6sL6YR3j0lV8s48mXuenmz4zxxPHKwS0qSVwijX3xVDCrlbdcdTAwMWFcdTAwMWHHRZ+dpzWZU1x1MDAxMGLNrDtk9tSmYIXSXHUwMDE3+uycd/f1NDRcdTAwMDLs5C5cIiMshuNcdTAwMWJcdTAwMTnMXHIg+aaHsl34z3tYfWFcdTAwMWGpRqY0IKd4KDfanfds7y5GLa39idWEM+2+f7xcdGu7Y7tcdTAwMTee3L7JXHUwMDE2SzpBjnRcdTAwMTcjTfNAyNNcdTAwMThcdTAwMDP3qOFcdHdcdH/Kk+1cdTAwMWSaJlx1MDAwMFKfXHUwMDE1httOfnd7Y7ROR3zsu17Ck1x1MDAxNU1X01x0t3/4XHUwMDEznejgmT+lpiNAuo+vuZLswFx0dE3r713jrakpXHUwMDEzNWyDwL75isoypFKAZlx1MDAxY1x1MDAwMC5cdTAwMGVcdTAwMThsXFxIhqd3eEU/XHUwMDAySe6ZXHUwMDFhxMWMa6krwVS30CeRQV9cdTAwMGXjLztqXGJcdTAwMWOj3SFrziE+XHUwMDAybzLVaN9YXHUwMDE1+6bpXHUwMDE3bP2OXHUwMDAzM1x1MDAxZs/dXHUwMDEzm+ZsWnLiXHUwMDExk/VcdOKHXHUwMDA3vH9cdTAwMTJgt8RnXHUwMDA0XdqRjNso6lLKi1x1MDAxN3vApYtcbik/U5bOKtI64tRw39vWVC/qK1x1MDAxYZdccuGZXG5IXHUwMDA03oDZWFTgIFx1MDAwZfDDaj02jHqsiclcdTAwMGJcdTAwMTRWwWVeT/Lx9j6YXHUwMDA2fqk2XHUwMDE2a1xyKUJcdTAwMTdEc/x9jJttl7CTN4Ncclx1MDAwZXHRXHUwMDAxd6yKuetcdTAwMWVCk1GGtZQ7Nt61XHUwMDBlQdpccsThi8akJqNRnrk5OcQvgzrmyDmTXHUwMDA2WsmEaU1cdTAwMDNcYoKEW6DaSSn1rvKWYbJcIlNcYpzzPpiwcGGSLs48fVvcjqjfXHUwMDE1XGIhNkB5x9jOnJNa98lH5lx0XHJcdTAwMWFcdTAwMWZmhVx1MDAxZVx1MDAxN16lQtXuUeopIzuzK/lcdTAwMDQpiyZcXExhq4NIaFx1MDAxN0JaXHUwMDFi4+J2ePa04lx1MDAxMpglM2lcdTAwMWYgnlDjVLFPznk0+simm+pcdTAwMWGQ4T+6a2XbqkjcOTqiROtcdTAwMWPTed6fXHUwMDE4eHjhwcW1+8+Svb/5M4RcdLRcdTAwMGKzw7VM0zQmjSQxbEqtR3ViiVx1MDAxMNKj+o2sUlx1MDAxZntcIvvh4cG1nubW3fNcdTAwMTY3iSeCXCJcdTAwMDRIfGi2I51AXG6oeUCk/nPBPi1cdTAwMWOVLFx1MDAxM4P60b3YV2AvXHUwMDFkjkS471x1MDAxNVx1MDAwM+RPoFx1MDAwM6pcdTAwMGWJXHUwMDFkzdtcdTAwMWLTd46Qq4VcdTAwMTNcdTAwMGWl9l6sxVx1MDAxZotat/C1q3mqZ3rMXHUwMDE0ZX/bxbSkfnK57lx1MDAwZm8n31wikvLWayzt2J82Zlx1MDAwNSNtiItcbuQhXHUwMDBl5Fxy2fhcdTAwMWFoyiU7qDlcdTAwMWJRarF9+5d1zdCNXHUwMDA17/qrMFx1MDAxZGQ4XHUwMDExrNxD9Vxy/LzFXHUwMDE30vBPJ5ypto5nn/mInUZxyEPJxmE8kWTpRFx1MDAwM2lcdTAwMTaX+zwyd1x1MDAxZmBQNHC/NMedXqQysUpxlYjHMSxcZr41fTpX6Taj+fHCXHUwMDFiXHUwMDBmn765cMcphD85XHUwMDFlUkBwOlx1MDAwN9hcdTAwMGIm0YusukBcdTAwMDDSQZJ63vYxv8iKXHUwMDAy5137dXqCKVx1MDAxN3Xdolx1MDAwZlx1MDAwYqpnQdBLq1x1MDAxMJjDgtZ1XHUwMDEwU4qAYOY5gzRcYj2n068uj5cxvXnpObt8hoJcXFxcJeqInYg0Q0CQ1O7ipTmYy35vXHUwMDAx+dBcItNcdTAwMWO3SL9o5+nLdUBZWq+FUtCR1VpcdTAwMWTktVx1MDAxYfVcdTAwMDc/n/HSMeOHP0lcdTAwMDN7Olx1MDAxYlx1MDAxY47CirpcdTAwMTdcdTAwMWW1pzxcYkW/g+Ng49/2XHKwsbuGXHUwMDA0PyeHs1lIpNczmon85lx1MDAxOSxJstlcdTAwMTfEfCh+Nzikv9Pn2VGibFx1MDAwM2HAXHUwMDFkhuXcda9pln1/9mRV/b5PXHUwMDE2XHUwMDExYZn76lx1MDAwMyWbR6V8yZKu96JcZlx1MDAwNCdcdTAwMTZfjlxcRivILOVPbjD3dc/3qidL6ZdAU0BdiX5aXHRcdTAwMDbp7k/cd3FcIrdcdTAwMDCsXHUwMDA1XHUwMDA3MC2Gky97QugqXHUwMDEyID5cdTAwMDLpei1Mo5C/W9K+U4q1XHUwMDA26a5/y13T51x1MDAxOYeFXHUwMDE5lcxcdTAwMDBcdTAwMWFwidxcdTAwMDWyg7GE/GhZ/sPFoWdgnp2jaJIkXHUwMDE5LZ/hi1FOJqJkxuVcdTAwMTX+yXBsV3CswmecbGsjgIBgXVb3cKBv1mLXgpYuZrYgXGZ30tS246U8ecFcdTAwMTKIUYMtwNC5+rBxn8Dixlx1MDAxY57NXHUwMDEycbHKXFxL41x1MDAwM1x1MDAwZd5cdTAwMTdcblxii1x1MDAwYvOv8Hl4XHUwMDA0XHUwMDE2TGFDXHUwMDBmnNlcdTAwMWE7KrzrZX7naqZ8lFx1MDAxZctcdTAwMTj8gkhcdTAwMGaJ2/hmJkX3SaXPg9v3u3fZfn9F94KAXHUwMDE4+FXxfvMpRiWkRlHNXHUwMDE48YBcdTAwMWV3iFx1MDAxNmzxNVx1MDAwMU5yW9d6ftTgoVxiJnNcdTAwMTb+zN95n89r7adcctuu6/M7zpep/Vx1MDAxYV1mXHUwMDExXHUwMDFhoZN4tqCI2VxuyXNSvmc6XGbGo1x0XCJcdTAwMWQvI6l8tUu6XCKfMFx1MDAxZlx1MDAxNFx1MDAwZlWIXFy0t6zD2Vx1MDAxNcxcdTAwMTL3mFx1MDAxNob9k2THXFw8Kjygs+BcdTAwMWF7mlx1MDAxMTLbyOxMUYkyeVx1MDAxYs1CqXmk7TdV3WAroOqRepgs51x1MDAwNIJcdTAwMDAoXHUwMDEwxbm7hpc53qAuRY42OUAxgrTc/UC8vV9AnLnTbDLhdc3JvWfDZVx1MDAwZlxco+RIqjb/I0FcdTAwMTeIWsMqWFx1MDAwM3ye60pz7jhVPFx1MDAwMjzMcdpcdTAwMTKeX+ejkz1cdTAwMGK4XHUwMDAxXHUwMDAwXHUwMDAw57ZH3b2fsu3VjidGXHUwMDFlXHLKV5aYbn5sKPmZiS7FcySCs5U0TTVcdTAwMGWALflgbyO/y8BRsXxcdTAwMDXVXHUwMDAykyRcdGd+b77Or5lz7yh4yDXDzFAgK+xMb6e/bfmIOZv0XGZyjMnnfV4/48GdN2U45S2EkeTT0lU2XHUwMDEyT1x1MDAxOJpcdTAwMDYreZzfXHUwMDBin+rQh2G45elcdTAwMTZcdTAwMDeSLlx1MDAwM+abXHUwMDE34Yl/8orZO1x1MDAxN/plOp9cdTAwMTZt6KjfXG5cdTAwMTS262LAs4vEzv2EniVcdTAwMDBaXHUwMDFm9/7e51xm5u83cGnnXGbp3yXEXFz2o7+D2OM4ntFcdTAwMGZcdTAwMDdnof5CXHUwMDFk9DtcdTAwMWb9fspXXHKPX05cdTAwMDdv/cNvIEnpXHUwMDFh4FW0r9hl2Vx1MDAwYqOe2FxuIanTNeTc0mlWP0FJZrS3XHUwMDAwXHUwMDEw5da2jNuSRORcdTAwMTQxZ4tcdTAwMTiXW53u4NokXHUwMDFirF741+y3UCw9O/xyOp9cdTAwMTA2JEyb1uyO777IaS1oTU0oUj+NM3k8IVpqgyh457aLuXO5XHUwMDFj7GVPYvnFiJdcdTAwMDVs1VxcomGZprdr/WQtYbq1x2HOc7G33Fx1MDAxNXRy/MhJTuuB/uKClFx1MDAwNChcXFx1MDAxN3OHI1x1MDAxMi1WvlN/zUvn/eQkhMFbyj+iXf3nui/hcfFFPHP7bVxiLk5xx5xcdTAwMWadmPnY21x1MDAwNk9cdTAwMDa0UFpwtq5eu3Bcbj+O4JpUlO1xzuVccpFWniCon+2uM7wk3pLodFx1MDAxOcVAdFx1MDAxZmWR0eYkb1x1MDAwMSTe33HetKhccmH0832RvVx1MDAxMp1cdTAwMWJcXFKvOE/z1iFcdTAwMTA5xszixmN3XSBttOeDuFR+vfjRiiZbjr5cdTAwMWKILCMu0Sua+NTbyL9rIGhhfDBX4osviz9ahDPI4Fx1MDAxYoxcdTAwMTC/o0nisv3fy0+tXmO6h8golKImXGYmMoIgfWBGNrqeXGKWN35zUVx1MDAwMHvu323lTODCda9cdTAwMDWoz+T0XHUwMDA3ffxu/Fx1MDAwNY34y194cIS1j+lcdTAwMTVcYi9iXHUwMDAy5koykpY6Rlx1MDAwN8PJIVx0u3wpbP1xcyFqv8vf2Zd81yUhmHzZg1erfLDXo8RcdTAwMDBcdTAwMDZcdTAwMWJwf21cdTAwMWFcdTAwMDU5npZjXCKipt6bybmfgFx1MDAxN0Y+Pq9ALJ+0qj6BpMNpXHUwMDEwVIMw7Cbq7oX5nrJcdTAwMTlcdTAwMWPsepcyzslcdTAwMTio2JnLtsy2I75cdTAwMDD2ZYVMXHUwMDFlylFCLcg6g290qp9+JopcdTAwMWaTvlx1MDAwMFx1MDAxOCMzrPJcdTAwMTRELyq63JVcdTAwMTU5zyHuwqAk+sI0VkL5az1aZ3lQwFx1MDAxOZ5cdTAwMWY1uN5JtXhcdTAwMTOJ73p3XHUwMDEzOo9771lcdTAwMTCLZlcyKyl6QTB4bWl+6u7SfnAvoOOlZ7PUalhQfeQ6IJqlXHUwMDFjLyxD+H1z1uN1x5J2XHUwMDAyXHUwMDBlXGJUejN4i65cdTAwMGJcblx1MDAwM8Kxp4A+371cdTAwMDJuP1x1MDAxM1lWO3E0gVx1MDAxYVv/XHUwMDFjXHTchlxufKmOXHUwMDAy6f1NacVcdTAwMWGqX980XHUwMDE2Py5cdTAwMTe01YUxduFcdTAwMWNd/DVCXHSB0WmflYZFbMaJXFxcYrtW7s7g/Vx1MDAxNtyxkfBPzDHMXHImYdXe/tkngX9iRH6WwclDT3EwXHUwMDAzXHUwMDFmR1x1MDAwNH8vrEWAQDuAcFx1MDAxNprk4FxcYGHbnKlcdTAwMWEuf/l+wpzW+CxYpZmtX8vV+lZcdTAwMGK90J2I7DUqTaasWSU3efFTv3M07TvP2lx1MDAxZSDkvf+x059cdTAwMTSP8lx1MDAwM717klxiNfX0OPPlbGU9n1x1MDAwMFx1MDAwZVx1MDAxYuuOjVx1MDAxZlx1MDAxNW9iXaDFddpcdTAwMDR8zUGGeVx1MDAxNtfPhcHv/bdcdTAwMWFzMcvWaO1kLlx1MDAxY4BcdTAwMDEgeJ7oaVx1MDAxZvqo5jJZXHUwMDBmgFx1MDAwNeqwJFXDpWTVRpKTikO+MF7K5FGr78KA+nWI3lx1MDAwZkbQh+5x53fOy1CYXG6bXHUwMDA2Yo89rSrpXHUwMDFlq3z2bnM+Peqnpv9ez0ZcdTAwMDWa5+dT8CtFuWdpgZj3MtdlXHUwMDE5XHUwMDBm2v9GSl1cdTAwMTODjGY6t9dcdTAwMDUyzVxyZtBhnXGtxVx1MDAwNTlt5KozQddKXHUwMDEysp88ovhD3rGB2P3ymU0wNeNDXHLyhpGcyr7dXHUwMDAzLNdcdTAwMTEzXHUwMDFmXHUwMDAygE3bcox0XHUwMDEwZ9+z+1ne5JaR/cLbkHWXbF9IqYMnU8egcyxAS7Jy9Pu5lFVlcV85XHUwMDEwX5VcbtRAmGm+7Fx1MDAwNopcdTAwMGZcdTAwMTRwgCafZVVcdTAwMTFLtc7TMEFcdTAwMTDwtnwhXHUwMDBiP+5+acpP3Fx1MDAxZWVXnyMqXHUwMDFlgWJxXHUwMDA2hEBcdTAwMGbdtoRwVJnTXa/cXic++ql5o9dTM36E8edcdTAwMTl8hFx1MDAwMDlSXHUwMDBmYWlyp+TyooJcdTAwMDefXHUwMDAzKlKxbsJcck+R6XXqrisjXHUwMDEzQY74u1x1MDAxNlths/0ytperXCJcdTAwMWJRzlP22/Wrst/NaVx1MDAwMfT7Y+s5Vihq00FGXHUwMDE5Yd7bR00zcVx1MDAwNWPPjjf/TPfeQI+L/a7fprzwg3dcdTAwMDFcdTAwMWNI6yuvKFx1MDAxZmFcdTAwMDdGXHTpXHUwMDAyxlx1MDAxOW+zl9RPxpb8nlx1MDAxZFtZyt5FbN518cotXHUwMDEzrb0kKFx1MDAxZlRnZm777rx1XHUwMDFj5epFO2shXHUwMDE0gfvRXHUwMDFlXHUwMDAyw1x1MDAxNNXrzv1DxvLrtlx1MDAwMrc5YTrF+SZcXMZAg+lV4aVLXHUwMDE2yrRcYvUrTvhDcVx1MDAxNe/U6nEus0LZgkdcdTAwMTXM6lxuibx2XHUwMDFj1keRvjFcdTAwMTCIIVxim+tcdTAwMWJ1pEtcdTAwMGW0UjOwy9LGKPzEtS5OkNgmKOUrgeMwXHUwMDE5xZNcdTAwMGZcdTAwMDTehKfQNWaAQuxcdTAwMTF/XFyqyOk1VOjyXHJKVd40Z0PSXGZcdTAwMDLXtFxcXHUwMDFjkS948N5rltfiSC5s8ThIkbS/1Fx1MDAwYuaTXHUwMDAyJlx1MDAxNl9cdTAwMWNAXHUwMDFmx1xc8rKNXHUwMDFhWb9cdTAwMWJcInud73tPo96Dvmy7gzRElL1JIXuwYbIgiT9e4Fx1MDAxZlx1MDAwMbPnt1x1MDAxYr7MXHUwMDA3f3TUmlx1MDAwN7zNy6jzuWtrlD8kv89j7rODXHUwMDAxKdN4t1wig5Fn91x1MDAwNkXmLnMoWklLWGNVdeZleFxm6Vx0NOqkjZ87v8hcdTAwMWHyQlx1MDAxYV/gQFfPvrhkXtZiUlx1MDAxMcQ4b/e++jZcdTAwMGbf7qLJXHKb1ZtPXHUwMDE2+c/3d6S7OPCi9lx1MDAxN6Myn+ao3TriXHUwMDFlKlx1MDAxNXK0lIuQNVx1MDAxOMM5TF7pRal/7qh4THJpxZr5jOr49U5TYJgsaPFU3Tza7vmYXHUwMDA2NtxOpjteXHUwMDFkXFyFo9HALCNLgKAy8fBcdTAwMDHa2lx1MDAxM376R5T2cCGvg3qFl1x1MDAwZtP61KD0sua+0HcqsEvJJ5tj8PVh5aPyQMdP8FhAQvLMXuqTfmpQISGfw0KNX9n1lYu62ZuOuFVbJ1mqzsR4vpfUxTb0YWyNcaHFZIpexFx1MDAwM73jTfyueDvo8lx1MDAxYS9LP3PDf9j70670mlx1MDAxOC2Vkl2KwZKb83LEzMkwYnoh83dNlpnxLkqe7LT3bbrPVX3G6see/Vx1MDAxYmu+w7dcdTAwMTO/gLCYPzhcdTAwMTBtjUTSMGzZ10k6w9iuKt7vXv/J42VsJ1Zw/ks9KaGekSTtRt3mdOHO1dY9XHUwMDE40i+7XGKu0lx1MDAxMlBOfG7Bx0gmKFx1MDAxN2pkaprhy2rLqVKx+saeXVwiJD97w2lDaVx1MDAwZXHv+8pccscyhrcrXHUwMDA377D3v1xy8WSwTcjvXHUwMDFh3Fx1MDAwZTWJXG5isz95//1J64v8krydsMFSbY7PI5mpYKemuDbfXHUwMDAzN1x1MDAxOZpcdTAwMGWahqnVslx1MDAwNb/CuFuF1NzW3jNisshuXHUwMDFmeNiXXHUwMDFjzydOr1x1MDAwNclcdTAwMTQ3zyVcdTAwMTjsrYOXbdJaXHUwMDFij+2AL/7EY0hcdTAwMTVALYbYeJPC3PNkXHUwMDAxuXf1ruTXkJK/Slx1MDAxMvDkpH96+yFcZlx1MDAxYXfeeznP5Nkv/oW4gcuN+lx1MDAwZiU2dVx1MDAxY1x1MDAxND5cdTAwMTeYXHUwMDFkgEA9VMY2Pc7XXHLPKu5cYqRw40Ta1s/K2os6PmkyYy/fX/S2w0cnupZwKfCbXHUwMDE0WUt6Uv1abKA7uWFiz+DJx1x1MDAxN+0rgrAuXpLvXHUwMDFiUr7jXHUwMDBl6S5heeGmXHUwMDA3X4tYSO5cdTAwMWK1Ll8gWqZZin5su2ZcYvE1n9XffNrFndTCpSqQ3sM8p6tVT7ctXGZcdTAwMDKafj99ulx1MDAxNy5bXHUwMDA0NCtjayqIo+/iSWRcdTAwMDCgYeiH7IYtlaMgnMzIUJ2Yj1fptSfRWMfpjPaJc2qPfo9cIty+Tcpq856e7S/u+rlMxMHk2/kw31x1MDAxNznHX1x1MDAxN186T1x1MDAwMirKe129b/xmvpZj80eFZpNzgVx1MDAwMXBcdTAwMWNcXD/SK8xcdTAwMGbcOlx1MDAwYlxmX1xig6RWXHUwMDE2XHUwMDEzsDF+bzvQXHSfaMhZ6IPcIDK+SM1tQLlcdTAwMDLdnb5cXFtUXG68+1x1MDAwM/c/OnZcdTAwMGZcdTAwMDa891XNXHUwMDE5fIL2/sREt1x1MDAwNVx1MDAxOD10/DR7w4cp1e7Ncd1cdTAwMTdxeqvT4Ozj+dhGrlU6fPvZXHUwMDFmXHUwMDBloEOJMeP2XVx1MDAwNmMxjcvTuj7rxet65vWIu9+Oylx1MDAwM7f/pCOqejdcdTAwMWa9UPX3tiqZPaBYXHUwMDE0P1JcdTAwMTWzz01qXHUwMDFh/ZT8+uVRKqyiyaRqxlxmqK6GZTgrlKhzSTlcdTAwMGbB1lx0o8Pv07sm/1x1MDAxZu9wfzXgxkH8nzyd1+aGXHUwMDFmSHzPXHUwMDE3RuZRwIFknPy+XHUwMDE34yU2aILZs8LsdVx1MDAwZk/zXHUwMDAyebdftC6uXHUwMDAyXGLz17B6XHUwMDFmSFx1MDAwNv5JKllF6s+7L8xtU3508u/vwsp3ToTcXHUwMDA1ePbR72ekpHZSxlwi0ECGu3B0+cxUbj+GU/lQnVx1MDAxMFHpPfPXXG5cdTAwMGKV9qr6pVxmKlx1MDAwNcA8h8dcbjhcdTAwMDLPJVxuXHUwMDE3K2/pMVx1MDAxZYfEXHUwMDE1l/Tue/L3Z/2n51Plq6j1b9KYXHUwMDFi3GJcXJVvXHUwMDFmwMBavKGpZdBKXVNcdTAwMDeUk7KetuyiJ/pEe2lyuGKvjcXZSKfjozW4UX5cdTAwMGJpgSlpRtKJMLnJQZ3fO0frllx1MDAxZPOf5Mmzd4GCU5xuUvGexXg5/dJz8XVcdTAwMTFYzVNcdFx1MDAxM3Ps5GtcdTAwMWVbruE1/Fx1MDAxNKPu+Vx1MDAwZXp1XHUwMDExx1xcgIxcdTAwMTJcdTAwMTRzo7NcdTAwMDSbaSPJg77i/11+zJ/9j/rO25ehtiAwyEUuk62d9C7BXHUwMDEzejBBtGCtuOa5NripNtrum4mbXHUwMDFj3luHtFx1MDAxZpMzOG6xPMDLzFIlLb6BS9MvXHUwMDFjSl8477v/03v86MWnXHUwMDE2XHUwMDFj7rLaljjbxYtTb/xcdTAwMTaJXHUwMDA0JqNcdTAwMWNcdTAwMThayfehgtmbVuu+ZMhcdTAwMDXTYLjHlKhcdTAwMDco5eGDXGL4utbuXHUwMDAyhPf31z+lUMZcdTAwMTiCXHUwMDE15yH8Q+f+8/Pufc9LN5R5d/LgoPaHXCKrPo1vIVx1MDAxM2pfkdt8XHUwMDAyIzaf+5hu57nRQV+2kLMkoTbHvb5soviG4Vxua8Kqo8NtXHUwMDEzXHUwMDEz98tcdTAwMDBGp3DEXTP9z7p+PXe168s2RNLx8myHXHUwMDAzbYSWSCM0v4F1dponr1uNYZP7Vp6JXHUwMDFmcZpcdTAwMThxpqepXHUwMDE34l5B5qSF1+lVWNmoM9o9XHUwMDFh/VpcdTAwMWOUjO/wJcM3h7+7f9a/v81ffPtO5F1ccj1o0ZrBTWOzv5CDk1xmZH9ObzzaXHUwMDA3NFHYpDvL4MijyP4gqfL91q7T74pPQKBcdTAwMTjwo0W+ymHYXHUwMDAzr9zBzG6+dlVcdTAwMWRvju5cdTAwMWJcdTAwMTVcbsv3XGKs7I5oU5SLJipGVJhaJ1QuX/DpRzx1XHLqr2vyXHUwMDFlpygrgvBpsVUpWLPfIGY+6CeVRXNCS+G0TCyfd0f0mi4vXHUwMDA01fqva1xmqNvbrufRYH5/nd+/XHUwMDFk81x1MDAxZfpcdTAwMWRcdTAwMTT4w1H2fzGeXHUwMDFiiyh/sH3svlwibpd/15n7WOWFN1x1MDAxN1x1MDAwNGz3af0u9z/HrEG56zE7JHZn56/68Pd7iux562FbUzbq6X95z3/YMi6/fTqA1Ihkz7/q2N+OweKdc2fVXHUwMDAy5EK/yu7PMZdw7njJQLc1Kfwquz/HWDu9e5VEgyVcdTAwMTgw/5vs/lx1MDAxY+OKbr9osrVcZkZZa/9qPu5jxjMtavXEWUOg/9V8/HuO/z3H/57j/6/nuNNkpsZEXHUwMDFiXHKmuMwuXHUwMDAy+etcdTAwMThcblx1MDAxN3vevf1qrKklzVx1MDAwYlx1MDAxY2a3vlx1MDAxN7Hzv9BpuJ4vgYTY+WZd1DBYz9jTLtldrJohZOdfZM6x0s1cdTAwMWaMaPfW8oJcdTAwMTE+x0BcdTAwMTFos4WO1Se3o5ZpXHUwMDA2Ob7OXHUwMDE0TePfp2em4Fx1MDAwMFx1MDAxNXBccmJcdTAwMDKAK5A7fJ+uwlx1MDAwZbio1myWSb++pyzON2ZC8lx1MDAxZFtBSvD7wFxih6rnqfbD1K+tYWZccoNOfkfDXHT++IFvxD5cdTAwMTj5YVhcdCpvXHUwMDFhVN9rumpcdTAwMDEyZaj9XHUwMDAz9eFBpH7VXHRa+4lcdTAwMWKC54FX3Nd4XHR5XHUwMDFjlT1cXNqBke5iiYyPXG5cIoxHXHUwMDFhoZvWfFx1MDAxMDw8rbXoxDKquLpiXHUwMDA2YIc0rdY5Z9Y0r4297+++9KVcbkJ5PEGnsqWzl8QkXHUwMDFiXHUwMDE5fc2Bwlx1MDAxN92kXHUwMDE13KdUvrJkQUjDZ7somdKze1x1MDAwM6CQTFmyJjZ590LdXHUwMDEx+rnEhX6MXHUwMDE4r6zgS+GHMjJKO3dcdTAwMWSAN631S+eevCu/z/1+f1x1MDAwYvmEzWfs28VcXKI8W3P1y1JGoapi9nWyhcHUXHUwMDAx+Fx1MDAxNsvA+oRPsnrFk++wkXOnXHUwMDA2RXv1cVPHXHUwMDE2u1SwoTOmeGZeLlxmdkxaf1x1MDAwNGKj+IHna0hcdTAwMTg/f1lLP2mHc8O2766tUMOHXHUwMDAzc0dmKHk12t7yXHUwMDExRDNvM1xypEo8NMIm39iLXHUwMDE3l5dR1epr10zCpPpLsJoqNYnPRJeWRmrKLlR3Otn+2zpzjntcdTAwMGYtWlx1MDAxZVx1MDAxNcrJot/YQNs71lx1MDAxZYRB/NJcdTAwMWWDwT9ccunUTcSFQlx1MDAwNKSBLVx1MDAxODaZyi2cXHUwMDFjXHUwMDAx3lxyaZhcImPEb2bFeMKgzlx1MDAxZFx1MDAxM4dTXCLIP+BP7DeFVFBTQbUguIEoKlx1MDAwZoE3XHUwMDA22JevX7+uT1x1MDAwNWKK41x1MDAwNdtcIvZcdTAwMTBcdTAwMThDyYGgSKxuYl/wp3mdfM+Ny7owULrl1mVAXHUwMDAwXGZcdTAwMTOZ3DpfSNNOw1x1MDAxMtKci+9YXHUwMDFkVitilK+hXHUwMDFlQeHIzFVoKsrKXHUwMDE1k74gXCKzk+fhzC67eM8+8HZ7SC33lbmiXCJcdTAwMDbRXHUwMDFiXHUwMDE1tpH9zb5kf3qaWZ5cdTAwMDVcIuc5MoZcblNcdTAwMTXT5zWmPVx1MDAxNlWsXHUwMDAyo3iJXHUwMDBiL5avXHLA+Dsx0FbE3kSPqeu6YX49u6mzLEvX4biMRCXvKc1UcFx1MDAxY3s1PrknbCBcdTAwMTEvQ3tZXHUwMDBmZVx1MDAwZvznK/BYxaVcdTAwMDEqXHUwMDExj9/WhSbffZNaXHUwMDAzsNWoUMuWXHUwMDAyMVx1MDAwMyeUsWcgzuE0vlx1MDAwNPg+0PeU2TWJMLjvxO6QY1O5XHUwMDE5R1x1MDAxMXXUzjmNd2/eKoBcdTAwMDZ1daFcdTAwMTJ33k+/3CV7X8CLm1wiXHUwMDEzc2hjoVvj5nBHYzTd+vB9QVKPsmq6MinTi107oPG7r+Be9178K3mmXHUwMDAx83lcdTAwMDZMOKixn1x1MDAxNSVcdTAwMTTaTDxh0464XFyfY5fc1kuvONrhXoHhQUqBhMxJwOZjpSo6hFx1MDAxMlx1MDAxYnw5YqtrxfVOJ/2K/cUza0vNUdRcdTAwMTUxdlxi6ZBcdTAwMDSYU3149lx1MDAwM61cdTAwMDDFlGrCQ4XU/sVcdTAwMWb2UHjHeEHWXHKSgvvK8XNcdTAwMTFcdTAwMDM3ZlxmXHUwMDE5yplDXG5cIrLFZyTxjy9cbtdSXHUwMDE1v8teqOKYlU9cdTAwMTeiLckhiGkrXHUwMDE26Vx0pS5zXHUwMDA2LsPrr0CIxSaQ/CZcdTAwMTW7IFx1MDAxY85cdTAwMThcdTAwMWWMNsxcdTAwMThcIlx1MDAwNt6KcsxAQTT5rzalv/hBXHUwMDE1xG5cdTAwMWOjUfZ+m0mOcMZsJi/wIyzxZ4A8e+vRzqtcdTAwMTPbXHUwMDFhw1BZpYpcdTAwMTLHL1lcdTAwMTW6g+8n20NTXHUwMDAzgFuD+lOoUYAlrvBcdTAwMTRX+7xiOy+vI7NL31x1MDAxY1NcdTAwMGaSVY9q553FalCvK1x1MDAxNX0lZlx1MDAxYfc7mfqNL9Z/+FwiXHUwMDFjWPlKPFx1MDAwNJewv2HmR8t4aIxcck2U4ka97fVvXHUwMDBm/PR4RVG5bfVcdTAwMTOZn9rkofyXuMbmoX0ghUxg2UvjJsy1XHUwMDA0JvdlqPlcdTAwMTk0XHUwMDE2YetcdTAwMWEj5mgpUK5cdTAwMWQ0XHUwMDE3Ka1cdTAwMTO3iOj5qzSdXHUwMDFk5kF2/Cqrf/QmWFx1MDAxMWK9Y81DOVx1MDAxZqdQyXNp2SBAXHUwMDBidSFcdTAwMWZjfun5XHUwMDAzQvgnvtlQ6Gf9XHUwMDExJjFcdTAwMWTPujuZdFx1MDAxNyctvmihTC6mQH704LG0u1x1MDAxM8SeoubHNVx1MDAxNo+J/PqB78W8fWWsmVDeXHUwMDE5pMlcdFGJwu/SKX5DOzn9XHUwMDA1Z7GMcNeL10FPr1x1MDAxNMzt1Cez/Vx1MDAxYVFfUOqtx+Xf5Fx1MDAxN+vXqdhuznVcXJevtflcdTAwMDRdVqafRWA9L0E9XHUwMDE3JPNcbqmOg2VcdTAwMTRcdTAwMWHxMrtcdTAwMGaBXHUwMDFkclx1MDAwMO+NvpZcdTAwMDRcItZMyCxcdTAwMDdcdTAwMGJcdTAwMDDgLIeI51i33EHwq3P3Mv2LjTKexo3lkspwUFx1MDAxMKu1XHUwMDE5QnJcdTAwMTevYU2ZXHUwMDFmntNcdTAwMDaRQtNL09HgVFs2dVx1MDAwNExcdTAwMWSJkCr5ntTyXHUwMDBla+xUVlDXXHUwMDFhTNk9lj4jxFSX/0je+6xw4+tDzdNlz9TB4I6W8SO/ZKRnZD4/6ELPilx1MDAwMiFh5qRSLUL4iiRyU1fz3Fp2PrGAsovaqj3SXHQ/1N/G/LdcdTAwMWW9xlx1MDAxM0Vx4e5cdTAwMTdtOfqRjGZsyYpcZiGTPJtcdTAwMTnblFwih1xc/ii2rcfdq+MoNLWOpKfPSLVcdTAwMTMwXHUwMDExz7UnOzzxcjCG8Yjdom6TT317yaNtXHUwMDA3i9iW0NZ/8Xv/qLdoXHUwMDExXHR4q+P8mU+sS++8gXRggqWyyVxuXHSjsOSHXHUwMDEwVzPj9dFH7KlLXHUwMDEwXHUwMDE3lzI9MNBcdTAwMDVcImokXHRcdTAwMGVu0CtcdTAwMTFzI4vRP219+Vx1MDAxNvu7eV812qEp6mdcdTAwMTMvoDBNlsRxYIOhhPp8oeY7/W2PyNPuMlF3wF/fUec5k1x1MDAxNqJihlKiUitcdTAwMTUz+G1cdTAwMDZcIlx1MDAwNrFcdTAwMDM31Y/HyX0kl5k/NaU95JmXtuvsepF3TV10oXk8LmX0pFx1MDAxYWnDdFvzXHUwMDBmMNFhvk2fuYZcdTAwMGWyouFInrGUnPj1RfyGqf/ej6I/XHUwMDExp5irJJ4/4HN1WN2SXHUwMDA3eZItWZNXM2O+fWCntlQneYGZ55JcdTAwMTCstmLvR1x0Kz7qOGLjXHUwMDBizKVnRDtGh1x1MDAxZS9cdTAwMDDyqpR9IztcdTAwMDDHX21cdTAwMTKSlfbW20Y6pfZcdTAwMGLQv+GgO5fyMk1cdTAwMThGxLCn3n1cdTAwMDBIXlx1MDAxYczRMUwjrvdJXHUwMDFlTc5RZluvISZ+9sRP7cqQ7Xf9c43VZaRcXI7srjdnXHUwMDE3sy1idyhcdTAwMDN3t+G9XHUwMDFmou9cdTAwMTNAVdL3tZ8+XHUwMDE3uNgqM1x1MDAxMFx1MDAxOGrr0dagXHUwMDBlgeuiTTJov/CsQrzDaVx1MDAxYbk7gH1AZFx1MDAxY0TZ8P5uIc42XHUwMDEy0jxFYKCs2Nef1+Iy4qdcInwvoPx+XHUwMDA1pjFlwP1ZXHUwMDBiqWEl9uVHt55cdTAwMGXZXHTEc4uFSZu/33FcdTAwMTQuXFyfXHUwMDAxrinjrlx1MDAxZXzqXGJe3jaerUqRaFx1MDAwNvi4e/n94t+6Wr58SttnXHUwMDA1XGLvn6Wa3Mh1l5n5rnT9glx1MDAxZmLieyZyPcKhdH1pWFx1MDAxM1maQahf1/guXGJq2+3zyfFcdTAwMDVkZFx1MDAxN/BcdTAwMTDXXHUwMDA0XHUwMDA2gehrXHUwMDAyw9T6e6eOrM593okgjLEvjG/z8eDeW4vkiN4lXHUwMDExXHUwMDAyMWi29/hSNLFcdTAwMDOUXHUwMDBijlx1MDAxZFP+5GOpPjxU13/zxePd8/FcdTAwMTO4XHKZXFzGjrc/oEc9XHUwMDEyn+5Va+Pjr1x1MDAxZTZ3rmVcdTAwMTYnKlu9oVMm9FGMZ1mm9FG+7I/zgDr8WvnKgvhcdTAwMTe0blx1MDAwMp6LRGFcdTAwMWEvXHUwMDBmylx1MDAxZI48Kom+omBcdTAwMTQ671x1MDAwMVx1MDAwMI652Z5cYlx1MDAwNlx1MDAxZGc21P1BvC7F/21vdoNmm+OjkzSTpD1EzchcdTAwMTFcdTAwMWZcdTAwMTNxMVKuqXO9alx1MDAxOVx1MDAwNmOShrGanKWSXHUwMDBm91lEk+zq83Hds0u+y1dcYl1jXHUwMDE06q5cdJ01pjNjrZ1Kfjl6tKSNdcyHM9TCiT7m6vnbWlPu/VPlJaAvtlx1MDAwNSrV1swpqoOHtqSzrGgoqZpUg3xcdTAwMTL07kNzYVbH6K/1NuWjeulNXHUwMDA0tTGrKEPTQq6jTGn8PPi/4lfeJve7XHUwMDE3XHUwMDEyXHUwMDA07EBSqYdjwzpM+pHcipHG8lx1MDAwMUo5ZEz39lx1MDAxM4Uv2ojExGg3XHUwMDFhqlx1MDAxZIe3XHUwMDE4qKC0p7KUmUBMiVx1MDAxYahEJlxuXHUwMDFhkVx1MDAxY0Bi84pRvl1ur5X+XHUwMDFi0SCMQKPyaKXBapJHnX7+at/+0S9ccsz6hXy2znstlZZcdTAwMWW9OTWQ8MKONKrXiWcoSVx1MDAxMFx1MDAxMppeXy9Od7yjwFx1MDAxYm7e3YrbynDD46vIzynwaYhM0rtcdTAwMWbN80NxdbdJkVx1MDAwNiy7gCxxl7eHTNvFL/ZEiO969lx1MDAxN0xEbyN0wiSni4SPXHUwMDExJ5/TIynG430tXHUwMDBm4P1+I8R2os2WqOZ2WdB+jOko4/mhO1Y3yuChqHNwXHRgXHUwMDE0XHUwMDA247VcdTAwMGXiKCubcpDIar0uXHJgiSVcdTAwMWM0pKtcdTAwMTiC0rdevVx1MDAxMDx9bjFsVnidwMmqXmpp2clv/GfbvXt/gsxcdTAwMTfT1CZR9Vx1MDAxYdDmjrun04rmj2PvY+NRYeNcdTAwMTKQ6Vxunlx1MDAwNJaIc56QJl65xJaMUk021ks/QvhEkFxcXHUwMDA1XHUwMDFhvGxhXGYjU2SMcP391YVcbqPUXHUwMDA3iVb1py+3t/XJpn59tdmCxrhcdTAwMTLFNjBcdTAwMTWXXHUwMDFiNclH84FcdTAwMTN7zKfGz96BjV1gXHUwMDEwhGOanyja9XyTRjFAn2FcbicmVFx1MDAwN37DRuaNjVZcdTAwMGYziNb/ilx1MDAxN6ZcdTAwMTJcdTAwMDaHJz+qJ6poXHUwMDBipqeSe7BcdTAwMWL3XHJcdTAwMWSKQ1x1MDAwMTV0VXf+YFGSU/TDhzwjV7dcdTAwMWVcdTAwMWEn1daS1e/kXHUwMDA1aOtcdTAwMTjV4aNcdTAwMWMo6EgyOKij4Fx1MDAxOaeajFnnaCvyPs9cdTAwMWaya+fqrzpX1XesoE2yPoe/2/vdXCKPXHUwMDFlXHUwMDBi3+ZcdTAwMDd8435cdTAwMTRcXLqWO0jiXHUwMDA2ZDDBwNZQKFx1MDAwMpTvuTFs8CBHwTzq4uLaLrBcdTAwMTTX+0eC3zdSXHUwMDE5XZjicsjOXHUwMDFiRJzn4ihcdTAwMGKMeFx1MDAxN1dBeuY7RlxidnGgXFyCPWVcZqlQ9LRcdTAwMTG98NEqRPn+pVx1MDAwNaKjXHUwMDFmvlx1MDAxN44o2mmLbGiLXHUwMDE1bl1XfT4+LvZcdTAwMTNcdTAwMTbSXHUwMDExXHUwMDE1hl1Rpm1cdTAwMGJcdTAwMWQxXHUwMDE5XHUwMDAz5dg2kcjmlCZcdTAwMGZcdTAwMTf2Q3/Hfs9cdTAwMWJHVZPhVCd2V7KNydCvKJ08milcdTAwMTBcdTAwMDIy8zOeXHUwMDFiXHUwMDEwqpi6a/1cXDLuwSRcdTAwMTPQ9uJ6y7yooVx1MDAwYk1lXHUwMDFhWutQYYVcIoPhXHUwMDAycmpcdTAwMDcmickvXHUwMDE1aVx1MDAxOX3l4fRcdTAwMTA838NZfLdcdTAwMTegXHUwMDAwzdhcdTAwMDGbQUpcbvfRYFx1MDAxMm7bLk9M/G6c+Zf9KKm991x1MDAxNow2aMd16eTnllx1MDAxMebjlXRxdYI+gmVcdTAwMDT1zo0jVcbm1Sh5ilx1MDAwZYQ5abHu1ILLXHUwMDFh5rvRI1x1MDAxZnpcZlx1MDAxZIBBryCMXHUwMDE2qHFcYrPaXFxcdTAwMWNjcUOmIVx1MDAxOYpcdTAwMTNYlsdcdTAwMTQ8jVx1MDAxMX3mYFx1MDAxNj6Fl1jnU7d+JifjsiVPzrfrXlx1MDAxYWI4oL7X1eZMJsbrXHUwMDE1XHUwMDAzrVx1MDAxMP2+a1x1MDAxZZK5xUHktz3DibnWo4pcdTAwMGXsOlx04uXXXHUwMDFlU20+LVx1MDAxN1x1MDAwNHrTmYzAXHUwMDAxur698Fx1MDAxNJxcdTAwMDbvPL9bmzjAi1x1MDAxNzeVtH3NXHUwMDAxXHUwMDFld7Oz18KZqFVhayfu6rBcXFZcdTAwMWNi9t5wXHUwMDFm31x1MDAwZrrRXHKoXHUwMDE56kePaVxu+Vxuu6vLMdx9beK9psL4XHUwMDA14Vx1MDAxM7j8noaerkJcdTAwMTnji7K0uXmvXHUwMDA1XHUwMDEwrF9cdTAwMDR9ky9AvfjxSu3XXHUwMDFmK1xigkGTUy+HfIlcdTAwMDSKXHUwMDA0+y9x6fzuvUSvqCdW6n5Iw4V8M40oXHRJe1uBdaaGsvkmmlx1MDAxMSdoqqOyeXBmh413aac6nFx1MDAxZY7Yhqqh0cEqXHUwMDFl26ZQXHUwMDA18Fx1MDAwZc1hX/458vA+a49cdTAwMGLzXHUwMDA2qfGYvmji1CW9bVx1MDAxOeWY4OaAb5nYXHUwMDAxnE7BT1dKQ46DsFx1MDAxOT1cYml+NIj3eNRcdTAwMWN7uXXFXHUwMDFmzNo4XHUwMDFmv8U0VVi4e1x1MDAwM1x1MDAxYj5kqPJZp0BcdTAwMDBrqCXjlVx1MDAwN4NSsIZcdTAwMTN7wfyIL8Gq1L47VKxcdTAwMWWtiaVDjmExZj5cdTAwMTa7wOp18MBjq1x1MDAxYfPe97BcdTAwMTdqJ0zFOWZaxr5TjM3Xv1WuXFwv6PdcdTAwMTGqhfhcdTAwMGUz0FxctLig3ZBvWmvqsGzxOuvzlVx1MDAxYl9cdTAwMGUu8l5XoPVeXHLHXHUwMDA1Qlx1MDAwMlmNXHUwMDFmQUONYPt25W1gXHUwMDE2SS1i9WSDXHUwMDA04XtL7r6wf91TXHUwMDFh7tizXHUwMDEyXHUwMDEyZ0CRsK+sVvaFXHQ6XHUwMDEyy354VF9y+ThP331cdTAwMGaVq182Kji9W0lt0zfKJI2qLd9mmXVAirjsVIlOQiNcdTAwMTNPJDHGXUc/w1x1MDAxN1x1MDAwYvznXHUwMDAyXHUwMDA3ccFLI39BrVx1MDAxZX3Ts1x1MDAxNL6ALvsylzy2kD6lXHLekrNFwGlcdTAwMDX3JcrJZ4GU43N0XHUwMDFlsFx0tS9cdTAwMThcdTAwMTg+XHUwMDE4XHUwMDFmbFx1MDAxMEm0smb2Kz71v8yNXHUwMDAy30lGk67PhkZZ9cVcdTAwMDNzpFx1MDAwMlx1MDAwNI5aW8PtRFx1MDAxNjaJKqHgyGIhfUju70hlIyR7mSk01kRcdTAwMTmC1KDHMsVi1yaBXHUwMDE3XHUwMDFiTEKK6lx1MDAxN6NcdTAwMWZYLrr7eqZv9cBsmoPlvFfncrOti/fwMP1SXHUwMDEz2Pzk+IWxx1x1MDAxOFx1MDAxNMvKb9Cphcpf8jE8+Vx1MDAwNlx1MDAxZLZPbGiCj1ODiiTTb1x1MDAxNJowenqH3lNRzVx0XHUwMDAw/pBcXGZ4JzKc2JJgK2Qt7ZdzOlx1MDAwMNzHftwyMCmH6MIhwYep84wkK9vLwXdcYlx1MDAwNj1cYkDWo7dOrKBy0Fv326ep11x1MDAxOKlrXHQ7XHUwMDE2clqCXCIn1C5JdNjbaFxyRMYl9218/KJcdTAwMTPF7atiXHUwMDBmfXzsmnvOQFxmXHUwMDFiuVx1MDAxY1R1xMsndeKod0FVVdXgajNZXHUwMDE1POdxuGxcdTAwMWGFKYq2uyeL+5qdjWP0bp5cdTAwMTdJZ/drjFx1MDAxN0glK445tcbWXHTYcCCzXHUwMDAwv+dcdTAwMTOijZPe35Zz4nFcdTAwMGVcdTAwMTJcdTAwMTXYuVx1MDAxMVx1MDAwNZt5LXn8SGD+4rG6b69TRefarDwv3G3ggeD91T6yd1x1MDAwYsCHXFxcZlN32P7gu+vwRuDn5SBNylx1MDAxM5XQsyZwyulVaFji1Urk+7GCXHUwMDEw8FxiXHUwMDExo3p9NuYriVx1MDAxMWH7fVHKXHUwMDBiVY3RkIpcdTAwMWRe6Vx1MDAxMSSzxVx1MDAwMVx1MDAxNJThV92I7sEooTOyv/nnXHUwMDA2PGPwxF6PT0pcdTAwMDP0Y7JBXHUwMDA2XHUwMDAzQbRcdTAwMDQz6HJDdrR0XHUwMDE3aFx1MDAwZZyMhCri7mX4XHUwMDE3XeDTO9ZGnF5cdTAwMDXSR4pcXP6Qr+ApnsKLmon8ZWLVt0U04KPMXHUwMDFjYlx1MDAwMS+OXHUwMDEyvlx1MDAxYqud1C20ilx1MDAxOegve6FxXHUwMDA3XG6TmOo3s5jISVW6S4A6zVx1MDAwNyMsb1x1MDAxOFx1MDAxNOX7zlxifoPnXHUwMDE4wFx1MDAwNvVcdEInQvNPXHUwMDAyMmNKlHJcdTAwMGaymUtfNf2Qpq0xhsf+S5xPuvvTKnCLP1hcdTAwMDKiXHUwMDA3Jlx1MDAwZVr6XHJcdTAwMTak/yC7nXqFJpFcdTAwMTljXHUwMDA1TWsrtiBuuzm1SuJA7P66Q5WCSdhFvINcdTAwMDdcdTAwMWI2XHUwMDEyWkEouVx1MDAwNylcdTAwMGVsc4C3Sow/i/RcdTAwMDWf+yhcdTAwMDPG2J3eRq9H5M2fNlx1MDAwMVx071x0zppXW1x1MDAwMVx1MDAxNlx1MDAxOYzSyYf9e35cdMcoStKrXHUwMDA059hSo018XHUwMDEwzz3tXHUwMDA2lFNPNE18XG6opPuLo1x1MDAwNewsVXu9gWkgstGiXHSsZ4KraSzTXGJsXCJcdTAwMWRI2YkmtfHIYZKdXHUwMDAwwZJmXHUwMDA27jbLcn1cdTAwMWUm8C97cTw4XHUwMDAyWezXOFrCXFz4cukoU1uw4lx1MDAxOVpcdTAwMDFobzntgzQ+oUZvfX1cdTAwMDLEL1wic8DGXHUwMDAy5qLyuibW0IpcdTAwMDdcblx1MDAxZfuYccd7POvlK1x1MDAwN/6ess/qXHUwMDE4XsSz0Fx1MDAxZnlcdTAwMDC6Tv+uMeVcdTAwMDHmK0bUOf2macmwxjxcdTAwMTFcdTAwMTK3M1az+/y6j3XXn1x1MDAxZexgMFwiLGuSXHUwMDFjeK9UdFx1MDAxMI5cZoL0Qlx1MDAwZl70yq5FLXe0XHUwMDFmuazNXHUwMDExK3ZRJ5lCTlxyVmS8k1iHfdYoPX5cbi/ML1x1MDAxOMND61C3qWYrj1xyLvtvhlx0J9mmirFzv8ZJn9RPXjhD0orEpD778v2t/4J+XHUwMDEwoDNY7fNWPOWLLHePsks73IvMXGafJuKuV1x1MDAxNos9onN/Lua4341cdTAwMDf5TthcdTAwMTjeLuiIzlss7/Jj80ufJ1x1MDAxMYic+Vx1MDAxNyT8NWajfox7vz+JY64q7X7mxlx1MDAxZZYgkTlcdTAwMWFcdTAwMTCghFx1MDAwNlx1MDAxM1x0RsqSx8JcdTAwMDaBsuo6d5o8TniKXHUwMDAxoXHFz60m2PpjoC6n+lx1MDAxZE2woL5cYv9cIiyIXFx1J4b4x1Q9fuNcdTAwMTfXX/Offl5cdTAwMTG1+u0h7fJ4eqFNTK2lg1x1MDAxMy3nxdqC7LFt+1x1MDAxMIvs0apcdTAwMWMvJTtcdTAwMGL5uv5cdTAwMTKr4CF5L+kyek3xSUJAiFx1MDAwMtNNXG78rlx1MDAxMf1cdTAwMGJm0nnmxq/8/PV0mtGZ4YL/7jWYfV6LXWxDnW2FNokrTlx1MDAxZlx1MDAxOVx1MDAwMVI5XHSNuVwihuL0lYufStLUXHUwMDBl0Wq0iHnj2cm/5LhdXFzpeXOlMmQh5Jtz465qXHUwMDEz/GR7S625XHUwMDExwNNBl/D2U8xHn/LSUFx1MDAxZEnFnZuUwTD3/TzrvP9lP/+n/t27Q1x1MDAxZURcdTAwMWE6JLnbn5066jqN/MiJs8v8kKXJ7GSpXG6fT8I8flx1MDAxZFx1MDAxN89cdTAwMTRMbTtcZvkqeSP9r/JcdTAwMWPG0i5q9et05Ov3XFzFn2PMS7978thSksqx9i9zXHKusTe3PJpwhM7Xf5VDwCs1U5hcdTAwMDHjnlx1MDAxZPNfPJfrvf4y+fVAI7/GXHUwMDFj/3auxDN/8opPTnKw/+K5/6u//5++oP8yJ4E5Xoz8qFx1MDAwYlx1MDAwMcJ26Pfcgr/lcd5NMFx1MDAxNXXzXHUwMDA36Vx1MDAxN1/w971qW3DvveqZabqV+S+eK/6BlX962v4m3z/HdOkuzpR5Y1x1MDAxNX6+afcvn+v0XCLYgX1cdTAwMDIrXHUwMDAyXHUwMDEyfN35OoG5a7Q8XFyYauW60//8n//x3/+3//bz81x1MDAxZun0jpd39lx1MDAxZv/jv8EkjmFcYkWgXHUwMDEwRFN///8mnpfne5k+7+2vZ/2c9H/+Ofc/kjiHMpRIofydv0lcIiPu4qmESFx1MDAxMjhP6ZyIyYTIs4x8Xzf5P/7X3dtP+3aP4T72XHUwMDFmnzYu3uDQXHUwMDE1/1x1MDAxONznfuL/81x1MDAxYv/9uixeYu+p3Vx1MDAxN9+//o+/3/p/T+L5TWD//eOz5nOHVKnob+FcdTAwMTiOV1xu3iV0VruFLcBcdTAwMWNz6Vx1MDAxZMNfvKVcdTAwMDbuXHUwMDEzmNBwnpDMTDOWXHUwMDEy9j9q3t5cIjmj4ZpKSFx1MDAxOFlcdTAwMWJ/XHUwMDEx2O/q7lpcdTAwMTZpaSG2nySRJVU25SfOeNYoM53FcG/1VS1RvYrq1o9y6fm+8uRcdOe1RFx1MDAxNFx1MDAwMFxczlx1MDAwNqVz21x1MDAxNVhBZD3vyWbTOqiw7U6LsnxQaNW7dKNwZLe1hfw88ahS3dBqKEDQyZRcdTAwMDYtXG5FnSRP1JPXue1TXlx1MDAxODpcdTAwMTW9fjtJWNG2XHUwMDBmyVx1MDAxNG+xgWzRXHUwMDBmXHUwMDE14WI4h16+VSHD91Syvd5mXHUwMDA01ZNcdTAwMTlOvNwl65SXblxy9q5cdTAwMWVMy6GPuHTkqeaOXGZgXGZ5iVx1MDAxN0Y95NOUOVx1MDAxM0cwnVMq3GWG364vXHUwMDE4XHUwMDE55k5eXHUwMDFlh9Zmn4PYqytKibrfXSdcdTAwMDD2XHUwMDE5XHUwMDEznk3Zq9V4XFzzv873rlx1MDAxOVx1MDAxMVWBYbmGu/OiXHUwMDE0Xf+Mn1x1MDAxN9VcdTAwMTm4wqiNhZlcdTAwMThcdTAwMTc+kcZ0672d8N5ccr9Ao4fm/E/P/dt9ODYuvFcketNcdTAwMTfUY/fD+Wq2PzCN6d34gOBgyFOIJNfPx2hcdTAwMDPzXHUwMDFhxK9y8NTLW49wj3dLtjPFcUgtrpjOr+/rxZdZYpvaWEYudTeP4zV1XFxcdTAwMDAz+lfjk1x1MDAxOftcdTAwMTUxQXmyxFOQOFt8NVxy9vldnr1cXIuSZMPUWzmJmfJfXG4vZrv9XHUwMDBmeZVO8fd34Pj0XHUwMDFl6z5d6F1EmPt3Zn626v6LnK/r7r7591htU1x1MDAxZiqnY2R1/sJ4cPZcdTAwMDXz1/vLXHUwMDBmSVxiOFx1MDAxYnbL6Yg6725JMEJcdTAwMTHT1dhfx3G/g8VGhSBcdTAwMDUnxcyPL3TJp3tcdTAwMDbOelx0/K/jYJgg9i5cYul35mpcIm+a269cdTAwMGLDb/KbrO9r91x1MDAwZsrI3JZcdTAwMTKU9WSd6vp9YVx1MDAxMi3+/Ku5lNO7V15cdTAwMGZ1y90g+prLzshMZ/59Ltn9XHUwMDFha2vMeJw6L+iSjzKypjv8PpdcZtvtl65ZtX5a2vOWj1x1MDAxOCEwVlx1MDAxN7/PJf9nLnFyOOFptu+5XFx2799z+e+5/PdcXP6/OZdeXHUwMDA1iyvBYY/wKblcdTAwMTLjdVx1MDAwN2X5XHUwMDAw8mwn/cHtv8/ZXHUwMDBm5otcIj/Vvov+clx1MDAxZOmlXq9ecLBcdTAwMTRdnlxyJIW5q3pSffON+aucVZaZbFmf297HrdqQUb5YbINstOy1QI/92FjLKXL151x1MDAwYpElXHUwMDAyWuC3wu3fda1glJZly7pccsW6sV/PVvN1hExcdTAwMWFcdTAwMTaig9THpEP77K43e9HzQS9wuVhwgUdcdTAwMTRNIXryoPzfxnbdO79cdTAwMDSk8M1w4JOH/T6fP3IpXHUwMDBi96WwTaWov8vp/6/3e2izXZlcdTAwMDH9yKKqPGZB2uZcdTAwMWXTQblNRH9cdTAwMDRSXHUwMDA0JCynmqxAnNJcdTAwMDPVoCXuiT7STqZagll6TPhcZoPBtFx1MDAxNFx1MDAxYlx1MDAwNb/faNTAM2xnPjFis0N1pVWnb63f0cj60lTZ11x1MDAwZiRyqF/1vlx1MDAxNziafZY1m1xcvOx0g8ah3yPFP4q2XGZfXHUwMDE4mHTKh4ouNVx1MDAwMKzxS3yc8+tcdTAwMWJcIv3smZp6XHUwMDExy4iDU1c6WthsU7VcdTAwMDA4UVWBWlx1MDAwNmk9lv7BnsR5f8RcdTAwMTndkodcdTAwMTijpE+hXHUwMDAzJiZYfqrMv7BLln3bPHGWo6x9qzi3wVx1MDAxMqOi+lwismlcdTAwMDSm9Vl+lkCahvXjqvgrZVx1MDAxNmVcdTAwMTiILvVcdTAwMWbRXHUwMDA3m12XXHUwMDA2O1x1MDAwYkWSXHUwMDBm6Y7d+1WOny0krK9Y0l9XJVx1MDAxNVRS57Cfn79jSo+7k26InVx1MDAxMe84R75HuzRzsVx1MDAxNIxf+0V2WTnBXHUwMDFjNy0oY7LKO47LUnj4XtpcdTAwMDGLXHUwMDAyamB22Y1obyl24yV5flajXHUwMDFlPNEvl1x1MDAxN1x1MDAxMVcn45xcdTAwMWX/XG6necy8XHUwMDFmzFC8fTXay55hd9c+mkIzcehFJ8iT+EDzxdG511x1MDAwZfEq54wzuFx1MDAxMGaLvZT0Q/BcdTAwMTRbMvYpXHUwMDA28ub440KfbrdcdTAwMTDY7kfc7+93zbP8Z55cdTAwMTmM12TOtpKLsEtcdTAwMDF72G+7+FcyXHUwMDEx/sikz1i/4OVH0++HpTJfQf9cdTAwMTXbX9eUYnv5tZT/6HqhMkbDc3tcdTAwMTQ9XHUwMDA2XHUwMDE243630ZdcdTAwMDWzuXs8XHUwMDAxu0uBLVx1MDAxNG+kYi+rxlx1MDAwYlx1MDAwNVD+btdHIZAvn1Fw2iW8iZHsy1x1MDAwMpf12+M/8vOXdXldUzxcdTAwMTntXHUwMDFlz+sh3LiYIVVBLI7dcvhD+HUtX6r4up2YLcx8b86MwtDLhaNxW1JK2K5T88slfk1cdTAwMGUu21x1MDAxZHhiwFx1MDAwNJzNXHUwMDA22H5qst1/XHUwMDFmg30nl0zypKhcdTAwMTXA2n7SRFx1MDAxZJHuXHUwMDBlr/F02E5Dp4pcdTAwMWaCeX0k5lx0uc2Molx1MDAwM11ey1JZkjIxu7/eryq6/Vx1MDAxMptFz1x1MDAxZIHqMjczXHUwMDExQy2S9MRtUy67wm+jzdyyxl2Zkk+I2CFcdTAwMWb6huPqiHchXGKHcvG4lPCvOlwis93tk7qxXHUwMDFkLfyS8eYjykzXteQ7M9lMZLJB86t2XHUwMDBmwFx1MDAwMviWb7XP02MzajWB0JrebUTVz9NBXHUwMDFmyG/6fjKX7vDatKbL+M/6h9V10aZNx7pcblrJZu4tXHUwMDBmXHUwMDBi/6qKJlx1MDAxMME85pwlXHUwMDE3v9rTZ+lcdTAwMTc1XHUwMDFiMlx1MDAxMvb8J/20JFEo28+carSYVY/LwFx1MDAxNlxmXHUwMDBiZppNmXR6fvOI4Hug+lVXfOhHVzBcdTAwMDVl/1mu/T7oK/Ld03nG8Et1XHUwMDAw+CkvvuhDZPuuVtp7s5g17L9hKCm7/Subs8hLYXxGU1x1MDAxZpdcdTAwMDJcdTAwMWVcdTAwMTbHf2vxXCL9Q8dcdTAwMTnZmnuPUlq8nctcdTAwMWbb2dRoXHUwMDE2f/N5IbtYqlx1MDAwZes3/6/vf+xcdTAwMDf9bGr2xc+9XHUwMDFk8Fx1MDAxYUPLluSgTKWf3/j/XCLtvZVcdTAwMWVXljTAXHUwMDA3glx1MDAwMa1MaE1cYkJ7hCS0lk+/YPeZiZh77q6zTkcw+idEVdYnMrOKRkawXGIsXHUwMDAwfVx1MDAxMVxcLtJvYUZcdTAwMDbrNFOe9t/Gs2s2xvYjhqCgUjvYhr+gKJZbXHUwMDA2qyRSbKtu8d9Azlx1MDAwMcxxXHUwMDFjXHUwMDBlnVrcXHUwMDA2IHjlUvH/XHUwMDFixv35aajnelx1MDAxN3X8+3pmrYlbPlx1MDAxMF+dt8SFKV6OqaL4snGk7kX/RZ+J5c9cdTAwMDOzOofwM/NcdTAwMGJcdTAwMWanbEyPraKcsiW+XHUwMDE4I/rVi2XeXHUwMDEya1Wi6d6VuICvfUZ9rrBEXHUwMDFi47/hb/zN/sSP+dOg/yd+Xrmi8lx1MDAxYc5T8iWEXHUwMDAwtH3xbJ55/CSBe+B9zfu3XHUwMDBlYDmZ+Vx1MDAxMy/P+mHeLPkxhFx1MDAwN2KMN4925qG7OlvlaC1bqZv1KDWuUvlcdTAwMDFcdTAwMWJo6G8wJ3ngv2HQR1lcdTAwMGWOmcuXXzc/plx1MDAxONJnclx1MDAxNeqZXFxcdTAwMWI/vlBs7/1cdTAwMDToj7r8XG5Wl6EnSVx1MDAwNVx1MDAwMU8h/03DXHUwMDBivPB37NjqP8YupbT74TWQXHUwMDE2kcvtwlx1MDAwMfE5VVx1MDAxNVx1MDAxNVx1MDAxNVx1MDAxY99UunOJ0udcdTAwMGZcdTAwMDX/K/aUSmOUXHUwMDA3XHUwMDE3xY/2Z35Z/GNcdTAwMTj1VVx1MDAxYVx1MDAwZd9/fSW2xz4hgZbSVaJh6sZ+8FxmYMDHNiz0f1x1MDAxYruHNP7EyURcdTAwMTn/XHUwMDExJzLPLOlcdTAwMDarXHUwMDFmOD+z0L4l2K1cdTAwMWNcdTAwMWVrvzs57mHR5Fx1MDAxOTBcdTAwMWLrf+fW4c/aXGJ+nPd/1oZcdTAwMTNcctqCgifmb4lsyuYq0GlcdTAwMDX0XHUwMDAzIVx1MDAxM/VhrlP6b65mmVx1MDAwZvNnXlx1MDAwZvHHh1xyj0A/rcdEnUwy1bVcZn7iXHUwMDE3UifI3FIr8Fx1MDAxZM59VVx1MDAxYkRv10zAP8T7by7ms3+4WPhPLCxL42aOPIjekMVHYamCSVxuXHUwMDE4jVxyZZxR2eZ/40Rb/fkmW2ZcZuo/OFfV42NcdTAwMGIqQHpcdTAwMGZcdTAwMWFr66SKXHUwMDBiofvJedzjWcj41zy8dOhcdTAwMGbfo+XDwOWP9DjOjiN5lFwiMFZ7ydt7XHUwMDBlw1joO1xcVaw0+ZpoJIZcdTAwMTN2XHUwMDFk7fxzgX/HnVb+ud7G/l98ckNcXNHaXHUwMDE1005cdTAwMTfUXHTbKFx1MDAxY1x1MDAwM+W/MFx1MDAwMJI9mTD3XGLw5fLfdPZeLr/1mUm/nJbNXd8zMpb6KF9F872C+5u3Uiq20cNWt0a/XS7L1jrQXHUwMDA1TC//pTdLxfZ+WuCYmccr/yZUeUR5mTdqjTWrV8vDJ4x4hLdcdTAwMDTeXHUwMDFjqu+VXHUwMDExXHUwMDE4WUi5cqZd+V98rE9cdMijXHUwMDBmnH0tjqE3sNBnmkNcdTAwMWbU4Fx1MDAxNPuIMPKRVGg/XHSYmmXT6MO2rDJ8ilx1MDAxNvqiXHUwMDA12lwi80/+yVx1MDAxOM8z30pbnE87+1x02fXWXHUwMDA3PptcdTAwMTkx3n/zrZjSvqCAwVx1MDAxNGlcdTAwMDRcdTAwMGIpREncfn+FSMMy5d95Tp6ZmJ/FN9PtXCJcdTAwMDKiQlM2lWem+7bTXHUwMDEylL1HXG7OtVx1MDAwN22KWj7uzS7vXHUwMDE5o0JWc1x1MDAxOFvYlmR0Pmtih/tnvHBStDnqPPtkQ1x1MDAxYqegnrXqzFSlja4pXHUwMDEwj6qqj51cdTAwMTl/OdvX/2vOdoh+Y1x1MDAxM0fnRWPBb09cIuUlzVWKcfc7yYg0XHSzXyXt9r9cdTAwMWb0RU3EMTBcdTAwMThcdTAwMDVBdIJqXHUwMDEx4alcdTAwMTKuznFcdTAwMDM+RLiUXHUwMDFhbEZzxCRx4zZqXHUwMDA2nFx1MDAxMChZTvA+MIfopsm+zjT9XCL8njIojGTstlx1MDAwNNJ64fFBU6dcdTAwMTDrWKb+t3GqfuPEmUZ0Ok6bv99YXHUwMDE3VFx1MDAxZEOVz600UHbf5yRZed9cXEGbP5ZE5VB/h4VGOOCVrV/O3Vx1MDAxN8WHumfgXHUwMDE1LMbLIFx1MDAxZlx1MDAxOXfI+Et5or1AONNcbkO3OYBFXHUwMDFhzUKG7NuZaOdcdTAwMWHInK89qUBpwY2ENvVcdTAwMTFcdTAwMTe8loVBdIxcdTAwMTD+jT0m19val1x1MDAxN12qXHUwMDBmXHUwMDA38Fx1MDAwM6EzSSO9XHUwMDBmj81Hg3uY4OngIXpoXHUwMDE2+1x1MDAxY03wbjZfXGK4v0aYoHL0WfA3nvG9yObdJ9BGVMnkovjGXFxL9n42Qb6ZRaNn8ttCXHUwMDFjwUifKnabeVx1MDAwNlv1uSW/ei4gu8r8bUjuxWfp21x1MDAxNnDLm+r+/EJcdTAwMDaslYTE9N5cdTAwMWKRXHUwMDFm6j2t5NXAXHUwMDAzRlx1MDAxMmzmXHUwMDBmzDo9IO9cdTAwMWXqLT5zKi36Wlx1MDAxZfSrK1xuN8ZNTFx1MDAxMP6+l8VwP0wtxNcv//DScd5cdTAwMTBl7HsonVPC//i9oU43vi1cdTAwMWbPbL85aNxcdTAwMDXMXHUwMDFmj/p58TJnJb56iz1aYZvMJnVcIlx1MDAxNH2RRj3S3zi2dMdccqlK+3eO7W5cdTAwMTG5dZ4h2UW5kjxD0bO5jkHKWCtcdTAwMTSoZPJcdTAwMTKot5l9ot78ZHVcdTAwMWWEYu7afzhcdTAwMDT/6ctXQH0oIP55+nnhXHUwMDBm/Vx1MDAxM4q2zZKOwzWk4TTsXHUwMDA0atXGa0/o+dxl31xmlEVcdTAwMGKHh5jl5dV9fVx1MDAwZibAyb32XHUwMDA1UbJwkDn+p1x1MDAwNjHyXG5PXHUwMDFlbuM13Fsu94x4rsVcdTAwMTT0iyZq8bhcdTAwMWVcdTAwMWT6iYKHY3zY2K3LN5/vmCFe0te1q3bMeUJL91llXHUwMDA3juxSsvsgLauPXHUwMDA0h9Pe4WboNmnfcn6dKdLNmT3u1udcdTAwMTJqI3uASvO55fyMXHUwMDFkmnDLM1x1MDAwZepcdTAwMTlcdTAwMTNJw8BDrzjg9EBcdTAwMWMwYO3111x1MDAwZmrs+NOsr1x1MDAxNH6nxFx1MDAxM4tcdTAwMDa3sapcdTAwMTaDRiqkjSlk7qf6yuhcbkTNS4gx/lx1MDAwYlx1MDAxMaxhXHUwMDA37z3ydCfkgY7JzWLhQE9cdTAwMWHJ4YbBXHUwMDFhXHUwMDEzPlx1MDAwNMhCf96/eiRcdTAwMWJDnNTgJUzYkrx7mFx1MDAwZY9PXHUwMDE5lYMhZLz6ZviD0cNcdTAwMGaj+Vx1MDAxMKJ69dGX/OPc1KzLlerrJVx1MDAwNFx1MDAxMVJT3n62XHKxzkC22lx1MDAxZTbKqdTGxMJqz+rMplx1MDAxMGZwdsI3eEU5UCiNKlx1MDAxMrqgPNdlS4fjfM0/5EiP2ObRbeaCmytcYuY2h1x1MDAwNH9i88X+35qMxrxL/93l7FYmRN30LJNcdTAwMDNcdTAwMTiXud/jffTi+WbfQ5DzXHUwMDBmy1x1MDAxOLtcXI2JdvCLXHUwMDE3mid4vrFDwHq9dqKa+PlcdTAwMDChXHUwMDEzoW/LbZS8XHUwMDE4R3kgxoBcdTAwMDVsnlx1MDAwNrDdan98wj+5Vla/ovZZXHUwMDE3us9pXHUwMDBlwUE0s8gpjGPJKFx1MDAwYlx1MDAwNVxmf1bC3LH3WIunztqHXHUwMDEy85rIpjzSmVx1MDAxNdxg8KvdTniHw3tt7oQst+un4Vx1MDAxZbW5mGZwTMor4oFcdTAwMWLCc518gsfSXHI4iKA/foJmfE5CXHUwMDFjWHdISieDNDs6m+PMe4Cr3Sj61zT3Z4g2MYrJIb/d30RcdTAwMTfNL8JcdTAwMDSlLOZ32V9cdTAwMTLja6WGT3XewzyFjsXrdFx1MDAxMzhcdTAwMWODWsWUr7MzoWO5QCpcdTAwMTQ0xyio6v5yRiNeXHUwMDA0X5i8Ts15IGQ0XHUwMDA1qvpcdTAwMGX+0Tt+s8yykKIqP7/du4o9UtbXd+Dci4xcdTAwMTJgJXOIXHUwMDFkn7hFXHUwMDAyoWcr+MlKIyv3XHUwMDAxI1x1MDAwM1x1MDAwMYGBlDaardKA0E3Qc+JxmIRk5lx1MDAxZU5j1JqrWry0XHUwMDFkmE69XGZcdTAwMDfF1VGosfv6hGiIJs1PrF/g9UTus2bD+pW19i9cdTAwMTdvNr8+o2r6PGrlpLq9JFqAJ5Hi1U82glx1MDAwNONcdTAwMWaNyMalz0jBpzXA3WRcbt7TnnjEfz859aj8T6BasUp8lHXHXHUwMDFjW0xcdTAwMDX8iYnv91wif7nZgrjO8bFD0yFShXY/nMr32v6F5no/50yWjG370IW4XCLQXGJcIjJcdTAwMWVv7IJ8d1x1MDAwND5cdTAwMWOFTjpcdTAwMWY9b6TmM/u1ZLGpJaO19+2McLmAuYwvk+4jmSn5lSVcdTAwMWU2iOGh61x1MDAxYv+Zilx1MDAxOYU8l1x1MDAxZXgqRE6PPVx1MDAwYoBkMNZWvLf00c5j96Azk3z7nm80XCKoZJjuzfibXHUwMDBij7FcdTAwMWF6+Vx0oDWau2v8mciNo9FFb+1Of3vjXz0vlJkgXHUwMDA2PpJkvODjasRGkiFcIuY70lx1MDAxZHq8XHUwMDA1XHUwMDE0/KDh10XCY/dfmtPZYJPVSyajoTWITkexNbO5XHUwMDEwkUK6KoxcYrLMe1xyZcjLjPvXXHUwMDEz/Z71Nb9mXHUwMDA21+Np7lKAUEJ4VOEptYCOs0VhRrfpXHUwMDE2esxcdTAwMTVO8FD0iUzVfOdcdTAwMDRcdTAwMWTItav292SerP/o4tK3dctcdTAwMTnb5uVcdTAwMDKA8cQpNSRDbYrHn3U4scVvv1x1MDAxMLOtq3XecEqbKv5HZ1xyjCDa328jusBcdTAwMDBcdCWdtFHZXHUwMDAzrX5eYJzEXHUwMDBmriRcdTAwMTX6JiHI3lx1MDAxZdBxt+zDrusuSsRnI+P8XefJw2tF/SizXHUwMDFkilx1MDAwZq1mvVdcdTAwMWQsvPM9MFx1MDAxYl6I7HlcdTAwMWbfbJJ2XCLHXHUwMDA2bzlJzpOmglxm55NJ4U3BYct9TfhoWb6UQGR0rP7bXHTLo/xFl6mavNxDu+eIyp/IWZS5Yk+oU5xcdTAwMGJiNlx1MDAwZfZd21x1MDAxNKOQ6+RcdTAwMGZFNstVQUZulZn0LFx1MDAwMG/Y/OlYpVx1MDAxN3isnO5cdTAwMWOUmintkUZl/WLpl/dcdTAwMDaikql648yIh626Xayl7kBiqDcj4tdh01x1MDAwNyHxKp+XfSRM6XFGRY7xqVh5eOt+PnOwP7xKozkpoc810Fx1MDAwN8dPQoFUWJ4pncizPl1cdTAwMGKZhuNoLbwslFx1MDAxMM95xDRAmoC8kVRcdTAwMTSyzsgpz/fA8rYzcIGlR9GGM34l+1x1MDAwMoLabG2/vLFp6LJqZ71cdTAwMTi/Y9IvjDNkXHUwMDEzcCNcdTAwMDRcdTAwMDREppuc/+S6lKpiXHUwMDFlWyNcdTAwMTC7pFx1MDAxOJswbFx1MDAxNCxJLu52V2PHj/+vNfc+xmZcdTAwMWUl9ks4ypZcdTAwMDTQXHJcZjeNYpdqWF+D+9pccsRMXHUwMDAxeajTXHUwMDA2TFNaXHUwMDBl6lHgXHUwMDE09dnN5LE4j1x1MDAwZlx1MDAwYlx1MDAwZlx0LK+TKVx1MDAxMKA3MWIlrzvu7T+5V+xPfcUvrcdcbnWijOy/3F+GKDVcdTAwMWbp1Onqflx1MDAwMJZcdTAwMDXHzs+4Qz7gcZtcdGK1gu2s8n1cdTAwMGbLwfEzP+zMa3VcdTAwMWatVHM1/7hcdTAwMDBTYeGf/7BcdTAwMGZ9edjqsMfnXHUwMDFmt5rJ8OdNTVJy2OHxhS5ekIEgjIZSTW3lXHUwMDExUEsti+4+dCXaVc8o3OZdlMr+ci7m0Vx1MDAxY5epJ+WfZ+b/cKCrlvfFa19CXl5s21x1MDAwMcK5joL0ttv08JKvVELFXHUwMDEzmtbrWUdRUDXP11x1MDAxNOaP52teXHUwMDFk98TU8I6esW1gylKbP1x1MDAxY+P/albTWOU0rvK6amjWmJeQXHUwMDE0kJQjSeUjXGI171x1MDAwMrKFNdNEOYyXXHUwMDFiv3ZcdTAwMGbcq1x1MDAwNjkzTXNPXHUwMDFla8rB+1x1MDAxZFx1MDAxMEHcXHUwMDEzKpfBL1fbP1x1MDAxYX42uVx1MDAwNYl+9+BcdTAwMTnjeO7RXFyUeP7GnId2+8PrL0CtXadsRI9cdTAwMWPO0C3hwiT8XG7YoCfgXHUwMDFm2+ZL0zmOsS6seeTqkUfaU1x1MDAxZjpcdTAwMGVpS2FKyVx1MDAxZGf5ti1QXHUwMDFjW1x1MDAxZShcdTAwMGbi2fNeXCJbuuHAKGaAna7feMVa5JqFIfZcYt/45U88k/6pXHUwMDExXG7Z881cdTAwMDdcdTAwMTNcdTAwMTHG9pPIx+p6OFx1MDAxOFFqpUf+flQ/XGLs+JFM9DlcdTAwMThLf/SvVSmhv7WGmzXSWFxuK6VcdTAwMWFqjT0hXHUwMDFkPN6p3mxrK6i93Vx1MDAwYkxpQSXCXHUwMDE2TD985Fx1MDAwMEvK1Fx1MDAwZlx1MDAxNrFjRJFcdTAwMDG5YzCiz74lVlxiWExq0oFGqH/0XFwmVikxeNVcdTAwMWZvfin695Ld5/lcdTAwMWNx+vM8eGD+1+dh3Ix8kYpcdTAwMTJcdTAwMGZcdTAwMGLFm+wmJlx1MDAxML9IpHVcdTAwMDcweOhcYnQhh+53q/fT9HUyXT2bilKT/965njm//2lKR8j/3GNccrR/3eN67qHBXHUwMDE2NthaL31cdTAwMWKsQkufYIrjjYVcdTAwMDBKR2uHXHUwMDAyd7aIQEdcIvllmlx1MDAxZveXs9vN1VxmMqP8lL+eXHUwMDFlXHJcdTAwMTnGc/9cdTAwMDVcdTAwMDRnKIZRXkv0XFy/OVx1MDAwNqAleDtO9lN4vPezXHUwMDAwR1dcdTAwMTfPx91L7HNcdTAwMWbYrlx1MDAxN1a2e0huNzBmQDFaRC3/KPXVp3/154b0aidK5T/vpr17Jv2Fcvv7rLZcdTAwMWb9Mbeqk9HzL1x1MDAwN9ZnX6VEnng0tJCRb+cy2HhcdTAwMTQ/LOxw+GdcXD/vkzbdk1hWp7aS45+ac0SkrO19gt9aqcxd3zLpV+fwn8/t0PlRzLb2KqPSs1x1MDAxZVx1MDAwYi5FoIpXXHUwMDE0bZk9/Joh7XLKxFS0SHpxnVM9XHUwMDFhYJ/VXHUwMDA3eGjc87KPOpbPs0jVJkHZq1xmovfPU7ja/tr8h8w7wfnVXCKj6nlPtbVpXHUwMDFkem5xXHUwMDE3VVx1MDAwNP1cbuDKI+ZcdTAwMDO0+nDhucSmskViWz0qudNahNCSXHUwMDAy7Vwi1ELQ4E2Y5irav/mo3aD6mI3NXHUwMDFiumF8J3xccnuUa5lHZ6m/+VBSqrywd0Xev3XRmonmsI0gXHUwMDA3t/ZYXHUwMDFi/LosyWkw7q6qx2t9XGJ+uHevXHUwMDAxR2rn/Vx1MDAxMoJ/4N1otMVcdTAwMWXpM8VMKVxiXHUwMDAxekR/vGT5y+NKIdc/cMd5YfG5eYVcdTAwMWHR6K1cdTAwMThlSZzxRTprQJJDuEGucauYuIuOLc+JuVx1MDAwZaElV1dimSfnbY/Zfd5hKYOv8cuz+bliMGWFUNpcdTAwMWbPslxiv7rAXHUwMDE1pdh/eVx1MDAwNykwXHUwMDAx1lx1MDAxYvdcdTAwMDf7xFZiXHUwMDE3qirKndo+btvQXHTkyj1HQp9FPrBfP8Q3eLxRWSpcdTAwMWXyy7ddXHUwMDE3YF5/8iSCTj1cdTAwMWYxXHUwMDFi/1x1MDAxN47/XHUwMDA2yUdcdTAwMWXNQvnmK1QwsWk4RZbPl4zSXHUwMDA2Om/8psTb6YS/PGBcdTAwMTHCMZpq3vNcdTAwMTS/+IzO/eT+1Fu17pdz7JxnXHUwMDAxSD5cdTAwMDdcdTAwMTXpXHUwMDAziiql3slbscpyQqvNnulvbD1vOrrMq6rfWVx1MDAwM1bIxHyWhqZ/2Fx1MDAwMad5XHUwMDE2vluGyalfcolcbkBR+TM2UyRI0jtuXHUwMDFlXvjPdU1wzNy+O0pcXLiiZq7ciVx1MDAxNC+Qgl6gmlJcItWQ+s3roKAxlP581vV75jbsz8/fXHUwMDFh8d++XHUwMDA0n23+9czPXGJ+XHUwMDEwl6dBjzm/W8woi6BcdTAwMTA88Uq2XHUwMDFlQy32JZlhXj58pk2hZa1PxKj57/3zOKzSPzW60OBcXF4xOln9l1x1MDAxZcieaar3Ye7ur99cdTAwMDbUlZY/W2Yzn3T5XHUwMDEyXHUwMDE4oYGkZavT+c6g571dv46J1y+vXf94pz45ymX+5MDYX5+g2jOx+lx1MDAxZut3YnLbjybvLpND8iV1Yaq9XFyGhdNC93s3+WUg04/UiYvQXHUwMDBmQf5p6vpXX3jcg/AnN6Szv1x1MDAxZcjn2c1/PbuLPGD9vzlk1Pg9uqeXTL1lXHUwMDFizynO/484XHUwMDE5WPw3Lscjclx1MDAwZkZhXbwsq18nMSP89rw5sVMlrDJj2qR+yLSG3URcdTAwMDSSRS6H31x1MDAxY35cdTAwMDMlNpnyuVx1MDAxZvNcdTAwMDdHXHUwMDBief1bY/6d7fDgZ3o8WPp16JlcdTAwMTLKXHUwMDBizSrlQCcxcOA/dVx1MDAwZUxcclx1MDAwMedcdTAwMWI7PqCj0qdcdTAwMTfo27rFoqJYp2/YIF9zVvnla0J7efSLQpbH/7d+8TSq1EhcdTAwMWZcblx1MDAxZL01JvAyXHUwMDEyTVx1MDAwM7+ec1x1MDAxNDuxfVxyXHUwMDE0eC7Ypkbzq788WMkuv1x1MDAxZZd5+WGnSP/pweJYjPnNbXPE+H/OLZs/70NcdTAwMDKi3Vx1MDAxNfdSnmdcdTAwMTVzylx1MDAxMolnneM6XHUwMDA0WuWin66Y94zPa+kzILirXHUwMDFmjeg8Y0H+4lx1MDAxMVs39m8vxC8xqVx1MDAxYVx1MDAxZG8pxiRcdTAwMGb58YikXHUwMDA0cyWkte+LmyeywFx1MDAxOCeky/hcdFx1MDAxZuV7Mn744/hcdTAwMWW7d4kjX+Xn93yKj3zc8viT83iwTVxcqb91v0hcdH+4f4wn25atiFwif/PqiFDxeVx1MDAxOcdcdTAwMGJcdTAwMWWPXGJcdTAwMTlTT/yUvVx1MDAxN3XHpXcs44KrXG5cdTAwMTg7foZcdTAwMTHe1LWntGzbOlx1MDAwMVx1MDAxNzyAr7/0X69cdTAwMTXZhz35q1eHk/JcdTAwMTfLyH9h2e5cdTAwMTnLeqgjr+P3YV3+23QjR6yZXHUwMDAxa1WC+Egg4C+RsohM8+PG5/qR2ZTq3+tcdTAwMTNd2ON/r69cdTAwMWF/NC/1X65vLlOcvepcbo/j++ZcdTAwMTQmlOLGrs7ShlQwIVwiXHUwMDFjlapaXHUwMDEwvoL7q8UudlinXFxvf384NI5cdTAwMDfktu0v90T+aiDNsTDR41x1MDAxObBcdIB/+X13O1x1MDAxYjuB+VlP31x1MDAxZvtcdTAwMDI+XHUwMDE0S7VNLSCaXHUwMDEzlFx1MDAxZdKe6Iy9wlx1MDAxYtnp7HNJuXz/0/92m2bH6K9nnZdcdTAwMTPdXHUwMDA2vfXrXHUwMDBiXHUwMDBlOYXliEd/x1dIXHUwMDFiXG6fXHUwMDBiTFrMXHUwMDEy41x1MDAxMEVcdTAwMGJcdTAwMTDYtZHmTfhaXHUwMDExsd2ufvTjlpG8XHUwMDE3Jlx1MDAxM3j5XHUwMDEy/VVsO/xK0mPP0pLqJNJcdTAwMDRJXHUwMDFh/dAu2Fx1MDAwMYxsXHUwMDEyePgtTV1cdTAwMTL2XHUwMDFjxatcdTAwMDMgJGj8x3tRyrN+6ZpcdTAwMTNM+1x1MDAxNao+/Fx1MDAxZJhcdTAwMWNtslx1MDAxN1x1MDAwNt5cdTAwMGXE+DhcdTAwMTBcdTAwMTPCXG5C4z3N3/Y/NKvkntaf+lx1MDAxZFPmimw/wv42qKCW8zI7/JeHwqJnrXUogOCXLM13OW/7XHUwMDA1yn521NT98lx1MDAxMbNcdTAwMTbr9deKs5+yk7tJXHUwMDE5XHUwMDAxy3dIKkLaSbxcdTAwMGZTK1x1MDAxZFxi3bZcdTAwMGXwO35Y+Zr4tVx1MDAxZeuqq19cdTAwMWXccmfGLC5fllx1MDAwZlx1MDAwM7nLto5Ovlu9tavIMkabnvp6gqEwRyOCvcLT923LnFxmXHUwMDA2LsVnd7l7XHUwMDEzyNbV68FcXF7ntMeSXHSS+MwnnDP6bbbP2nvkOfPNXHUwMDFhxvffQaBcdTAwMTeHc8RcXC32dTqwfrygiT5SuqfT60ZtoNDlR5Erkp5xXHUwMDBmYFx1MDAxZuMhQCtcdTAwMTLWXHUwMDE1XHUwMDE1J5+b1Ht4wVx1MDAxNvfaZIqT+PDgVpFKSJPEXHUwMDEwQKpMXGa5xPGds1C6ceL0xmppz7ZvrrfvOIhcdTAwMTDwVOXTR3q6qlxyLppnUiVcdTAwMWagXHUwMDE2XCKCdnRcdTAwMTlvjmS/XHUwMDA19lxiXCJxSM6XKUTwmGbEzefeWlx0XHUwMDFhXHS67a9JvCiIXHUwMDE0jLxKUX4+bJhZXX7/anvqyFx1MDAwMIqyMIaJ0omNo5g+mFx1MDAwNz/yXFxP5OVcdTAwMDPUcZC5XHUwMDA0hE2geS7pJ7rZtyXSnq64pWe/1uiki+9cci2MP/VVR3b5+fJzoMpIXHUwMDBl3FSMV5jkIHfdL4nB4F7eqFt1XHUwMDFm6Wht3X1cImAg8XlcdTAwMDRyOtNcIsucfXtyVlx1MDAxNVx1MDAxOVx1MDAxMzv7MosnXHUwMDFk8VxcxSnJtcFDv6U6x3dp+rNcZlx1MDAwN2twfUWF6zCyXG7N4e66yjlcXOQ72yB50o5cdTAwMWNnvlx1MDAwM09CyzZcdTAwMDLPVdDBXHUwMDE4m1x1MDAxNzbyyfk93Y9cIpNs+LzHu/2+leWngblql5fMZOxR8N+cZ/uxZ7jt9lvrv1Ptw0+5fojUI1x1MDAwZuuAls8nyL69QsJPzGI7qVlccmBcdTAwMWR/MOaZXHUwMDAy8sftq/3TXHUwMDE286tGMvfHY9PvTFx1MDAxMT+CP/UlM19n+DBcdTAwMDJ6yFx1MDAxM5SCPK1t86bfn3t4p8m6NCrZffVToXRcYvfx6P2axl04Lmnq4DxOXHUwMDFmOfn68SPkXHUwMDFmaD1cdTAwMGW/vFx1MDAwNfKrtX80qnAg6tc/6L05mJjaV2WTL1x1MDAxZtahz4dcdTAwMDf40e+1XHUwMDA24yPdI/VcdTAwMGZeWFxiaZVEyOTwXHUwMDFmXHUwMDFlUT7F0OD28+7hw8b+9lx1MDAwZVx1MDAxYtb81VarXz+vhmn6WYnPezw4/zpf6Dt7pEXJPVxuU2FcdTAwMDNKhqRpM6tcdTAwMTVcdTAwMTdphvXzQlx0XHLKQ8BcdTAwMDW3dN35aYVXMWgpinmVjv18+TBfYv/TLI5cdTAwMDD88Fx1MDAwM4KHo1x1MDAxZUtG/HztqGg59vvI35zdflvlXGIuJF5cdTAwMGJ2e4Szl6ZcdTAwMDRcdTAwMWM4XHUwMDFhXHUwMDAyuq/VeMfS4lx1MDAxZsxdTlx0/lMz0X77NoSY6//2V365Ulx1MDAxMFx1MDAwMzEoqa+teJWaMM9AXHUwMDE3KL8g8eNjllx1MDAxN8ZgXHUwMDFhxPBcdTAwMDNcdTAwMTnw7Eis7C5ASVx1MDAwMd35hm2E2F9p66s/TrlcdTAwMDakb2yWK+3hx/e2dP3toeCZ6uA4PTm8R5dyX1ZLYHqj3OXxXHUwMDEzqWn7Sl/ChnVcdTAwMTeMXHLBV/qJecFYLDp7+zZcdTAwMDFoM219vFx1MDAxYXGoe/L5emXm96ygXHUwMDEyOvv1XHUwMDFia9hCVWbY477CXG5pK51wh7xylP3FVz1JqXCh6Ov8NkDRSLlPrt9gfqH6fkRN1lpEveQ6oJyaXHUwMDE0WfLVvLlVUCme/X5RMCBTdda02qzqR5q9rbOKMJ6gsFx1MDAwMTRHRihefu+9U1x01PvbXHUwMDAxQFx1MDAwYmubOFdcdTAwMTRU8E8mfPOrp5o0tnXmI6s3XYn3XGacsKA/XHKBWFx1MDAxMt4s3dvxZiXXXHUwMDFlYVTT/Vx1MDAxZFx1MDAwN1s2dtyiP9xcdTAwMTjhti/iI1x1MDAwMubzubxhUn5cdTAwMGImP5ht/7b2/YDsxZWEXHK48SrxfFx1MDAxMUE94dFcdTAwMTakwfRcdTAwMTS6hUGnn52mZ2l8YLrUuLDXkC7cfN3DvGBbkOa4XGbegP/7zVwigoI65aNZb4BXdt9rNim8Rtyt9i9cdTAwMTeSfFxi5mV3XiBcdTAwMDFDuplcdTAwMDN+IZk78Gq0Yn8jXHUwMDEw78TWR9VcXCGmXHUwMDAx7Vx1MDAxYcBFa0T2VNtNuz7ze1x1MDAxOLSIYc1vLozC+95z41x1MDAxZZpqgOxcdTAwMGbEXHUwMDBi0rskqbnyMFx1MDAxMFx1MDAwNsDh7Fx1MDAxZj1cXFx1MDAwZf4vr2UrbsXBbyNcdTAwMWJnvlx1MDAxNtHozHS12YjmXGbbvLFcdTAwMWZcdTAwMDAoxYFHMCHh3dbTNVx1MDAxNYdkvt1gvz9cdTAwMGI4zsorXHUwMDA1tJut3yFcdTAwMTCOb2T/1sMuge0zLJtcctroXG64XHT1xkTu4V3Ngl1YJqVcdTAwMDCega3XXz26Ue1cdTAwMGaHSpKbbv2aUonDv2KWKFx1MDAxNX2Xyqs9KdqkXHUwMDBmIdTtiNhcdTAwMTZx6I8yZ0ybXHLkqUhcdTAwMTYro1x1MDAxZlx1MDAwMKtLzpihUpXlWVx1MDAxNXBcdTAwMTNxpZH82lx1MDAwNs0srO6gXHUwMDA0sFx04E26XGbUeClDM0+gWdvtZG88I8Cg7sHchHKJf4Xobl9/8mohzT9cInNcdTAwMGbdMKvwglx1MDAwZTDRZnJcdTAwMDB/hKxOOW9JJ1x1MDAxNVx1MDAxMpGxXGJ/8cxoytb4LUlZclx1MDAwN87sb/TwXHUwMDE231x1MDAxNFmk0CQyOSBcdTAwMTAjUzZgdmW/ZNOGXHUwMDE5intcdHLUIVhcdTAwMGLTuSVcdTAwMTewNyxajozGfWqOe7CHhVx1MDAxNSs1hVxmhidK9kHWxVtcbtD65s+k76U3Tptcclx1MDAxMNBaIVxu5EKpwJhcZlx1MDAxNoM9NLC5KLSZXHUwMDE3/X47U8mpNJhMZFx1MDAwMNuXR85P3KtFXGL0xdvDWTiSkvJQdSWNmFR5XHUwMDBmMmPOwMHzZ5TmNk+tf2rXivlcXC7nJF/f6eOlXGLsXHUwMDAwnU5cdTAwMWFe4rJcdTAwMTBF36JcdTAwMDA+S53IXHUwMDFmXHUwMDBi9O0qLFdcdTAwMDYqXHUwMDFmMVx1MDAwMeJ2hmQo0Vx1MDAwZuxcdTAwMDTzgsffyXDYwGt8XVx1MDAxN1xmhHovKsbOVNOo/eookcPQ7iTuzM5+XHUwMDE4eYkn8VS5XCJPQDNg0IrQXHUwMDAyLEfOXHUwMDAwT1KIIFx1MDAwMUBcbmacUTdD9vGmXc97qk6srySG3UxcdTAwMTbTs7Gewunxf1x1MDAxMFx1MDAwYujYQ3IkNjZcdTAwMDCw0E6aW1TxXHUwMDE4jtVC81wiyCaQ+axcdTAwMWR0XHUwMDFlnlxy+G8xpN1UI4aCyPcx5ypcZrJcdTAwMTP3U8zVYb+qtjfSwSRcdTAwMTHp0cSPtTBwQNjIXHUwMDA1RFgy21x1MDAxMVDoy+I031x1MDAwNIJcIpaFSlx1MDAwZrRcdTAwMTbE9zOGk05i/ODbPDJcdTAwMDVsyTpB3Fx1MDAwMptcdFx1MDAxMlx1MDAxNZdcdTAwMTJcdTAwMDOQWaCx7XGgJ49ykJ64kupY8G9cdTAwMWYjPYfsMuX8oNMlXHUwMDAxXHUwMDEzXHUwMDEwqCT92KNpel9nkbKA5Sqz28NcdTAwMWTHkn/7XFxZRjmaIVmbbvGN3G2oPNGcXHUwMDExcIkwdqakcyhcbmqllH9J7qNcYlx1MDAwNVx1MDAxYSf8V8iA94tYy1x1MDAxMXj+S1x1MDAwMcNQXHUwMDBl8Ffg91x0OVx1MDAwZmfb+J9cZiNcdTAwMDV1zZOqTpVL2UWAySDzyNDAL/hdZ1xu2+LWO/LWKPHx21x1MDAwN+Lv3vtfzGVkVPzqXHUwMDBl3KdcXMqD6E7KXFwp8Vx1MDAwNlBGZqDlXFxcYu9M7Vx1MDAwZVx1MDAxZYhcdTAwMDXFSoye8URgkFx1MDAwNYNcdTAwMWY+dkC4z1x1MDAwZpNcdTAwMTG8zaPVwk7hd1x1MDAxN4+mpdPTRH35dX2Mx7S5O/EhWEw+3FxypbdcclLO9YT4TaBEy1x1MDAwZrnacovvtz1flDcj+EK5zYf2LLjDXHUwMDExXHUwMDEz3yxcbrCCu7R2WS1RWDXQeae1rkdcckp0XHUwMDE47Z5OoFx1MDAwZrtA4e/h+Wv/XCI/XHUwMDFi4VlcdTAwMTWdZd+2XHUwMDE548/2JtRcdTAwMTSsY8RV7f1/e/pccojT9ulcdTAwMTVy+lx0uCy4wOStMlDY6VwiXHUwMDE2aVFrtKtoVclcdTAwMTNcdTAwMTFISJNW2tvsVinwXHJOeYBcdTAwMWNYXHUwMDE0i1x1MDAwMeJov0PDXHUwMDBi7tg6pijf9r3M5rzuTlLWhIl9U/+cQHCJ/tTPpmxVuqk+XHUwMDA1b4Mzz1x1MDAxYylcdTAwMDbzbyZpXHUwMDAwk9u3afjkmKFcdTAwMTXlIPtARlxifeaHaVhW9nXxkr5ccqNDTmf8eYz0MDIwhEyX9sKKdvcttVA+qCCzXHUwMDFmd91PXG5FMX/nj/10dSd/XHUwMDEzylx1MDAxYqYzXGK1Wq7gLICfnF8xl6d04pVPJrg8yrRXfHAjMFx1MDAxOFx1MDAxONZcYifBnVxydFxy4VVIhnlGTidSoNGo7Yc5Z6U6JetcdTAwMWWv4eQyUVxmXHUwMDBmiMNz/ydcdTAwMGYrn1x1MDAxYqXTOlx1MDAxM4pcdTAwMTX3T29cXKWLjH1cdTAwMTlcdTAwMDVcdTAwMDHtYuH0pXnYMD34Y5ZcdTAwMWZAPiiDqJCpxr6KpNDyflxiVd41Jt0nbNKHnU//6zkkxVZqlpcoXHUwMDAwXHUwMDFjZlx1MDAxZVx1MDAxMsCoV2/zoamM4vZYwVxyTd8hXHUwMDE2id9cdFx1MDAwMNJ2dlx1MDAwNVx1MDAwMZY18077VFx1MDAwM31dXHUwMDFhLFnmM2CJy0dkXHUwMDFh+9Ghnz6tuVBcdTAwMTSuU27P0kxcdTAwMWVdk/rDXHUwMDEzWi8kN403ueXsvWik7zKFYGVcdTAwMDFKVMB74Fx1MDAxZv1zPShJ58BcdDt9+t7Ox62Kv1x1MDAxNsFcdTAwMGb9Yj2vykW6yFx1MDAwMF36XGbwuzpGXHUwMDE3yjVpr6deXlfT5/ctjJH+0CBcdTAwMTNcdTAwMTfNXHUwMDE5XHUwMDAyZTJcdTAwMDPD/j66y+nxXGJlXe6Nja9uZoJ/etJcdTAwMDRcdTAwMTXkkuDV4H2SmrWNbmhJXCJcdTAwMWap+Fx1MDAxZdd8bc649U5FeiFieqKc4kp9w/5FUDCx248mXcNtXGbSXHJK3iWY61x1MDAwM1x1MDAwZn5cdTAwMGVcdTAwMDZcIq+Ps72xpZyCKmfmO3TmaqRnXHUwMDAzeY1pSI1Enok07zDn3sfTQcDAJV5BvLrBfpY3/u5LgHxwd6NcdTAwMDBB0l+Xo8Fz8mBI98zizDep5Wd9waHRQbZcdTAwMWHdXHUwMDE3MzbTvMGMQ3Y1L89cIlrMXHUwMDA3gmS7irhccrivSVx1MDAwN+FUXHUwMDEwXHRJv5JcdTAwMTO70k1GYJe+Rlx0yUEhNj+TWchwXHUwMDFiXHUwMDFmZIr0gMIhOnBwXHUwMDAyf4dRuCWJb4VcdTAwMWNoR++QpOkhdpBX3yBcdTAwMTc74bJcdTAwMDXlm0K/cWX5377TjmJcdM9FyJko6u86ay9Djjna17JvXHUwMDA06Iqys/OpfnD4oPN0grfsRlx1MDAwYlx1MDAxMaxdj3ls6i7KXHUwMDBmjkB5J1xuVHjoKK2wXHUwMDEz2mLXI+B2MIVDtqbeWlx1MDAxZoBWXHUwMDE3X/Pe3HdfN3eH0ipcdTAwMTLLj1x1MDAxNjlcdTAwMTN3lT9cdTAwMTiriF7RS/hcdTAwMDQlM3yRkVx1MDAwZb7sXHUwMDE08Vx1MDAxZvtcdTAwMTRcdTAwMTOB8+u0cHQ+wWLjzPiEM1x1MDAwMvNmXHUwMDE2XHUwMDBiTpF3z1x1MDAwMP3hgvJcdHqa3OPJ4ILALu8t26F4QM5jYuBcdTAwMDb1vjj93lx1MDAwYvfO5rmOKlx1MDAxYW5IlNb86uSgQO5cdTAwMDEmXHUwMDFls+V33NmOI68t69SLWjBcdTAwMTZcdTAwMDXZXHUwMDA2tWnxj5cs5YZcdTAwMTKGmerLf3pcIn81wbDZgDBcdTAwMTjCV9iTPfq4sjhcZlgpXHUwMDAxnznZ6pZ5nTJyXHUwMDE37kVDIVx1MDAxMcXXXHUwMDA3aO+BhK3Hz9L0hTrrxzl6fsJEg/nehdMxLtNcdTAwMWOsz1x1MDAwN1x1MDAwNLJTXSejbVxm4MLEpodIrWVcdTAwMDeOXHUwMDE2gWo1kVx1MDAxMFBP1Xe+XCJcdTAwMDNeNWKQoPer31xiaVx1MDAxZVx1MDAxZX7x5JRPabrg2uv9vopUw3GO+vWArsA2baRFk+yKbsReXHUwMDAzqiVw11x1MDAwMWFcclxi0LtSWL437izKcFx1MDAxNFx1MDAxYZ7dTMpOXHUwMDA1a5l1z2NXhHey7ppY6mMo1lx00Z6uJViUPiZcdTAwMTFq7a/mNoXHe61Jr1x1MDAxOURhUWd4/s9eXHRxYnM8aDyw3TZrc1aaqt+aXHUwMDFk7I6nwlx1MDAxM7LN2avQeXVw46VAb5RccmNcdTAwMTk0xsyy34ydfcxcZitIXHUwMDBlx4h08jSUy4LXbswzMVx1MDAxNdfuQ1x1MDAwZlx1MDAwNsZC+vlcdTAwMDBUWWPylmDK9CBS3WRLOt5wXHUwMDAzz1x1MDAwZoRcdTAwMDfSXHUwMDA3XHUwMDA2+Y6fxVx1MDAxOVp3Slx1MDAxZrhZdS25VuZSOERcZvanvaF5jOw/NcJFlU+zPVx1MDAxY1hcdTAwMGZcdTAwMTiNUlx1MDAwNIBcdTAwMDWsp1x1MDAxZs2ZNbsogTa1t5x795z1XHUwMDAw8l6g5CrUS5qA0uTP2/M8xuLTNkpDaJLOpXo6hFx1MDAxMLHIXHUwMDBlTvL6wZiCXHUwMDE236BUo0TiXaBh1Fx1MDAwMXz7pbXM31dQYITy21x1MDAwM2R/XHUwMDE4xZryL74lndpcdTAwMTEqkYeVzeH6coe057zOPXReLF3CsE75j+3Q45tcdTAwMDSzxex4Xfz1ZOlcdTAwMTjnhzQ7MLT9yDbGJk3U5pDRuclTmW51osxFQofggHdcXCNWsoO2XHUwMDExc4BFXHUwMDExXp6ebVx1MDAwNe1SX996mIvGwFx1MDAxZJvGIWFcdTAwMTRtJa7MfWde5/XBwlhJQmh1kFx1MDAwNqma0/slXHUwMDAwmK9hXHUwMDFhlVx1MDAwMYhi6mtcdTAwMDWUucMxrMHJXHUwMDEwg0ln7NPxMVx1MDAxNGJzpkNcYt0hdpLd7NLIXHUwMDFiyZVqXGJLq3yFJFxce+pD2lx1MDAwN1x1MDAwZeNcdTAwMTY29PYq78e+xs9KQGRb5oy/fb2Do9iWXHUwMDE4Llx1MDAwNVx1MDAwN+9VUVvYTnxHmJ1MMtr1pCk6XHUwMDE2zE6eVtaqZlX5Jj2XVFM67bPQsLOEfVx1MDAxZlluiW9cdTAwMDTl0a7bz1x1MDAwNFhcdTAwMTGguVMtXHUwMDE148LsRZp9gfM5pFT6XHKDzCV37XH6qFwi+JlEXHUwMDE3v+NMT4WiXHUwMDFi59v4iaRd9zvQWddcdTAwMTKXICTOuTL5WujHXGZ7uDmG5beWn0GgJkKhWdzUlVx1MDAwM0xcdTAwMThdXHUwMDA1qH7Np6iZ5aAr09GY7WHnwoaDgiQtpGFcXLiIqmFJT4I4Lb1rasW+lOCxSfB4XG75lXZcdTAwMWFcdTAwMWRcdTAwMTOl5lx1MDAxMNRcdTAwMDN7uE7xiXFcdTAwMDb/s68tjIQ3y6fjS91nci7XbTWUbHPVxFwiXsOuZoy1SMjdcajtoFx1MDAxMVNcdTAwMTbLlvZwXHUwMDFkz82jfbWYXHUwMDE4PL5cdTAwMTCI4XGQZUTj7IYqYfKQVK+WkIDyjVx0frJ8l1fgyqNHqOSNeaDfJ/4/L0Ft619/Z4Jq6SNcdTAwMTUmXGJ979osevOx8lx1MDAxNfea5IxcZiFcdTAwMTQvYtdcdTAwMWPIvNpcXElCmDblOtFJRi9cdTAwMDKDI1x1MDAxNeDtejzBXHUwMDE1RvE5XHUwMDFh41ao17yZ+1xmm0tmqlx1MDAxN1ZcdTAwMDBFf1k2K1x1MDAwM5k3VL3nmy3w7lJlZeZcdTAwMDOvvlbZ/XMmiPJE3Vx1MDAxOWpiMVx1MDAwMavzocmPQPRcdLpwLP9OsNc0vKuBXHUwMDA02H5BXHUwMDFl/8VN+InzXHUwMDBmM1x1MDAxNFx1MDAwMytcdTAwMDZL7r/AXHUwMDE2Ru6J8nZjkl9njzD4WFRt807fQFx1MDAxZK7OdJHIrC1ccpyYSUHLXG6Eb1x1MDAxOWp+9r4+SrXELEwu21x1MDAxNIJIfO61cVx1MDAxY9+Xa+ZcdTAwMDXbIH586zZjLPMxjt9kNHXbQz/FuVx1MDAxNVx1MDAwMJw/flx1MDAwMiWM9Lx7m7xRr1x1MDAxZnu2Xln8Pi5cdTAwMDYpSHNapGlCyVx1MDAxN9mcVORcdTAwMTfk51x1MDAxNd/j1Fx1MDAxYVh+rzk5ZvhmRPcg1Vx1MDAxM1wiqVx1MDAwMFx1MDAxMVx1MDAwNjFcdTAwMGKSjlx1MDAxZULzXHUwMDE1+Fe2v6ik3idccnNOXGL603eblMrsXHUwMDE3dndhPW2Y3103XHUwMDE3JMLMXHUwMDE3T6JN5XWJOvuARLEkXHUwMDFmx+vYKiZjpZNEg4hQrm7Dh+uyyKqem6l8qFhwXHUwMDFiz2dcdE/KpFx1MDAxMdCIIHv80Vx1MDAwMdxcdTAwMWWbICNB7yVOzmlcdTAwMDamdm/WluBsd72w82JHkv9tiuhcdTAwMTZ2k3dyl93f3mgy2lx1MDAxZcHpXHUwMDE0WVx1MDAwMWCAXHUwMDA0otv14vBXJzggXHUwMDFmXHUwMDA3SVxyt0By0Fx1MDAxY+n7Rp8hjCBcdTAwMDcl/TDQeLbJYr98oHlMTz2xxPvGPonE+X/3Ndmax1x1MDAxMVD4tXr5iDtEXHUwMDA1U83aPXuSfdarTzBHqUpcdTAwMDVtbZqxepLV8YtKgrpcZjF4JVJcdTAwMWFcdTAwMWVcdTAwMDa2sX1cbsZXzbSgmqU5iFx1MDAxOKXVf+u4XHUwMDAzgknt52ar6F2yw6BSXHUwMDFlkElcdTAwMWGVPlx1MDAwYmlqKWPpY2tcdTAwMDXA93nFZmrEmfpg7vH4kWVLlkzIJ2JcYtFcXFIuXHUwMDAz5YTJ8nXOSpCcXHUwMDE5LIRcZpnpWz2L4dOYcC4w7+q378yAjvtXXHUwMDAzJpXp0Fx1MDAwMVHqXHUwMDA3O/li3Fx1MDAxZq1cdTAwMGJ9MXb7PuyhWVx1MDAwZeBcdTAwMTXwLGVR4e85XG5iW7KuOVx1MDAwMExN+/XbXHUwMDAzU6I3QGd57YSUyHz5xvCLdD+jqIDZXHUwMDAwyqp1apNcdTAwMTM8oijxYI/82/vnmShumc+fl75OK29cdTAwMWZ1UNSXdl6R9jBtkVx1MDAxOFSX7Hp5nKvtXHUwMDAxvIC3qFx1MDAwZk1cdTAwMGKQR1x1MDAxNlx1MDAwMPjc3Sf5mVx062A6oO5CdVx1MDAxYWhOLHsk75GtXHUwMDA2hvpcdTAwMTEqYEbDyWPGXHUwMDBl47GXJGXLjPBcdTAwMDfjj0OfXHUwMDE5o+GD0m04x8/0aIBL3dDazreKt1x1MDAwNkBcdTAwMTMtN86WO4Sr3Xn92qnhXHI4IVx1MDAxOEaotKxcdTAwMWX5xFx1MDAxOJ7ursXkR8wnglL76nlcdTAwMTGfYM5pIDFcYqC7XHUwMDE0iFghK1x1MDAwYitw95T9hYZo7IbkhZEwsf6t8bmhJ1x1MDAwNSntSyT+2lx1MDAxNlx1MDAxNFx1MDAxN8t371x1MDAwM0ZcZvNdQEjrxLm8LHXpXHUwMDE0gIft648zr3bn/I44YdFcdTAwMTSnXHUwMDEwXHUwMDAwipMhlYCwzD16Q54nXHUwMDFlTPN0MJeXzZiTtdom87ePQGS/7qHLzcl/fCxbSllbqEdFnpQr6ORcdTAwMTjAiKlcdTAwMThJKiFwhbpwQ1x1MDAwM10l+53qSvwv31x1MDAwNOXq9F0rI7aPeVutI1x1MDAxY6TAh3VuyUdcdTAwMDbMeYBxwHjJJ+a36bzXq9/+XHUwMDBlOpaDlFx1MDAwNeiw+uZcdTAwMGKI6tXLqKyIsnmUJEtcdTAwMDJcdTAwMDSQV1pYxOcz4UpcdTAwMWNbcFx1MDAxZsVmXGbqi9iUweFiVShcdTAwMTE65vu0hTVv8E9j87x9iY5cXO4xXHUwMDA1mVx1MDAxMlx1MDAxN6xuJrjP2+dVn/Ur/7N/b1JQjCWEz/jPOSFcbmMxz7L7NWE74OMz3v4sPuCiJYfJ96Tuaap0Kaw1w7/fRcCv4ayAdKJgjGvQiFxcyd+ZXHUwMDA1aqJ+4UaDvdbQ0Edzl1x1MDAxNILlgmxcdTAwMDa+/Xt+NztcdTAwMDHMe0m67UTHnGRgf0ZzVnlcdTAwMWVJLMp8Y7JcYjtnrmE9XHUwMDE1lVx1MDAwNem0XHUwMDE18JFcYlx1MDAwMp8mQHhvKirC6aP0Iaxl/frBY9q6gzKOM5/i+T/5Jo6Jf6c1hi5X5INcdTAwMTVewptcdTAwMTCntMDgT1qb+8nMztCX6fuRkLPoIJhYXHJ4XHUwMDE0Rzur69g9+/lYclx1MDAwNV2mXGI4IddcdTAwMGLupkeDJpxQN3pcdTAwMDdLO0vxh+pcdTAwMTftb1x1MDAxN5dcdTAwMThcdTAwMTijXHUwMDA1dlx1MDAwMrOxXHUwMDBlj1x1MDAwZeK92/dHXHUwMDE5XHUwMDEwcOzo7FxcT4p/XHUwMDA3j8M5MrtFeLFcdTAwMDZbYZCSbF7Ox1x1MDAwM4RFhqVT3eW2n1FwJKd/Yi0sPcR9XHUwMDFk2CpRdo31iFkxOYudXHUwMDBiaeKbuY5sXHKUKsvCz8JcdTAwMDNcdTAwMTd+W5DvSLI7nHqb7KdcdTAwMGV4XHUwMDBimlx1MDAwNDE9NVx1MDAwNPpcdTAwMTBWvcnB3ZzXXHUwMDEx7vfzOJDjh3qXQfRamk++blx1MDAwM2BcdTAwMTXG2oa1T/o1a12w7sJcdTAwMTg+XCImLiMvJVx1MDAxZba+2mZ0e+eBTE413NtML029cD+6tDb5mePgkOZnJVnAYiiT2ILcg1x1MDAxM2HZnpK/9SGeIVx1MDAxOGWqXHUwMDAwJN+sXHUwMDFk+8w4p/T8XHUwMDAxXHJCyOPBaoHW+OXEuOEmSVxi3vbr9ztGm0V1XHUwMDExXc6I9q1VqEJJiUQggK/YYSZ88zt3J7BPY4r5L7xdkaw09fpPj1QzMV1FKsH09+xcdTAwMGLnYkJcdTAwMDb/epVcdTAwMWZk9Vx1MDAxN+GwSvOws0goJJhlxIi2TFx1MDAwZnZXS1ZsJ1x1MDAxOffs3Fxmnlx1MDAwZXfcYndcdTAwMDa+t2C9Qpspr5N/4M9PM7xcdTAwMWTvXHUwMDFkvFx1MDAwZuRcIsvXXHUwMDExiFx1MDAxZZw/vvePzi3tOjKlll5vgeKSvXj5RSTG+4PrSFx1MDAxNXqyolx1MDAxNGFx26mdeJxt+zGAXHUwMDE0wZpkI/DGXHUwMDE0flx1MDAxYZGZv61aYaZ9vOd3eDsu74NT9b6B+CXg75xaXHUwMDE2o0BpadJ6VtVHXHUwMDE0c7kg665e6eZcdTAwMDYqcNZcdTAwMTXrYjBJ5T3cQ55jgNar8lxc76A+35JcdTAwMTGqLS1iXHUwMDFjXHKaM/tcdTAwMThcdTAwMDeBnZBI3vrwXHQ7Sz4kXlx1MDAxN+g52rFcdTAwMTJ+JKHlQEVWbuTj31xuRr+Dgs3+7ql43tE4dFwiv/cs/VxccTCd71x1MDAwNeOmUVdF+tRcdTAwMTGajtNcdTAwMGKkONVm5rWlkf28tJfDLez7vacqgZRa5q/a23w5ROB+WVx1MDAxOfvyI6NcdTAwMWU8IzRcXG72yO7iObZTNkGn34Zj5y6N38BHI1U48pKZioWN+bJ+NCxG9Fx1MDAwZT/bwU2z6fTh0bKhu3TjUk6hyapeRp5cdTAwMTmcqY9cdTAwMTL6eFx1MDAwNChjKlx1MDAxZFta3yO9luE7fbnpwH2h+Vx1MDAxZlx1MDAxZrO1XHUwMDE54Wyi1kJcIkNimcZcdTAwMGYqWFGVO7WD16SIRq0m8/JwX4Ur7XLYeecsM1PkR1VsXHUwMDA1MVxi3z434KxcdTAwMWXPuPL3WoqU5UGOR/zN7yG0KpOlbCP2sdbsozvj05jMJFx1MDAxZlx1MDAxMFx1MDAxYVwiXFzg89uFiVx1MDAwMexcdTAwMWScXHUwMDEwXHUwMDFmilx1MDAxOffdP1A+4202sFx1MDAxMfsl81x1MDAwN/dhpCBR5KndXHUwMDA0QNms72Rt8cCaXHUwMDFhaDtXySj3MzdcbsV/KW3K8ST44nBqjVdkXHUwMDAwr7BCXHUwMDEy1lx1MDAxMILAXHUwMDEzXHUwMDEzYT9cdTAwMDdxjFx1MDAxOMr/VFxmMWBVrzdcdTAwMDMy3SM3uXridSXvUPZcdTAwMDRNQJ1cdTAwMGa9wlxmvMGmXHTwqDsoJHgkidq9oIxcdTAwMTNocV3DJUrG2VxuXHUwMDE08Vx1MDAxZP5n33hplsI//fFETSxkXHUwMDE3fFwicesnvYdlZ8a37UN88qRcZlx1MDAxYpqYMCfQMIF+XHUwMDFjILG3/jDF7zuDTDNYnUNcdTAwMGKAu/8mNtt1Ttub2iA8XHUwMDE40Fx1MDAxYUugM1x1MDAxNpyaUkKVrbj4XHUwMDFigzBcdTAwMDFcdTAwMDE7j605oJlcdTAwMDIzXGY3WndccrSsXHUwMDAwczfXs7Vy7s6OoLeEXtQ9XHUwMDExaEuhTeLnb7hoidZLUexLgKlccjS7XHUwMDAyidfrXHUwMDFkUtaWOkyIvdps1bU+X/u1XHUwMDAwSGRI5Hm1g5OIm5oyXHUwMDFh7iXiOlCaPGZcdTAwMWNxxPhg0FxuqDF1fl4/0Fvn4Ib7iChi5UNpxVx1MDAxZGhLaIby3/rELFniXHQl9Vx1MDAxYlx1MDAxYmRF/8bKQ0CtiWevT+HOe1x1MDAxZFx1MDAxMIM/3eF5Rp+kXHUwMDBlhIyh3JnJ/U0poFx1MDAwZn6BNUgqJIaAkGG8oI5/PCxvy5dDcfhcdTAwMTnp8Fx0wclrx2Ey0ulXW1A0oMVcdTAwMDJ9gTKIiiXlclx1MDAxM1x1MDAxY8Kuw+LeXHUwMDA1XHUwMDE32dxYSSZFu2T16sk9aztcdTAwMDGZQjOnslCF669cdTAwMGY7hJSVg3p+XHUwMDBi11x1MDAwYipcdTAwMTPR6nRvXHUwMDBm3/97JqSS7O15yJB/zVx1MDAwMU2l+OhTXHUwMDE0wlvtJ1x1MDAwMUqv2UP146fAwHLWV69cdTAwMWFDv2lcdTAwMGIyl1bTKVx1MDAwMOBUN8PlljlYPGKAKFCKXHUwMDBlvPHmYdSt44lvXctJ81wibINBrUxHNDxcIqTdpaqdXHUwMDAyrfVccoWKaVx1MDAxMdJcdTAwMDHIXHUwMDA26073YKmU5W/sWYa4PLigObr7Tn/2XGZcdTAwMTaWonPZ77HYrm+JXHUwMDAwY1x1MDAwMiNcbuN8+ijsulx1MDAwN4Cmb5DPo13JYvYx5JU8ofie5EOztePd3EO2nVx1MDAwNMdcdTAwMTZJXG5Ynv+9fZ/nq1hcdTAwMGLPuORoL/3MxUhcdTAwMWZqk1Ok2Fx1MDAxM/inIanIXHUwMDA1Prdfv9HL++REMVBcdTAwMDaIQEyQcv3Rtlx1MDAxMJGSVJH2RFx1MDAxZiuCXHUwMDE0bDDYJFx1MDAxN08wVH6BXHUwMDFk2DdGhfWfXHUwMDExop045709X0FY08FcIrA1Okz1NeRgjFpdXHUwMDFhgHJIP1x1MDAxM1THfr9kKHm/+nPpmyZcdTAwMWZ7/+zr5plSYYuYKL44W06no0BcdTAwMWN7oXnDfWNcdTAwMWJMeUQvJG+KTVx1MDAxOX6XXCI2zWmNqFx1MDAwZXT4tO/Ke1x1MDAwMl/vXHUwMDAyiybuYHBcdTAwMTPdeLvL73KP7Vx1MDAxMJNcdTAwMDLXfHgnxbSdYlx1MDAxYaaWV9lnXHUwMDFjXHJL02VcZmfgd7bMu4zgafC7ecd60daZ2tXjaNo4OezjMptcZn/rquBcdTAwMDbCrko7LzprhWJcdTAwMTchm/o5LnZEXHLvXHUwMDFibI9cdTAwMWM8ybq2PVxuR8WBYTiGeXtcdTAwMGXrs9OZR7z501BcdTAwMWJN30UtvvtcZlxyIVTkVVx1MDAxN0qMtJ6C+sZCZMDhg1x1MDAxZqblXYXLo1x1MDAwZbuM17RHQ69cckJNYZBAXHUwMDE2lMBcdTAwMTTbaEs6oVx1MDAwZT16YDbL4WvrXHUwMDA3OSTwXHUwMDAw8K6hZ+IymlCYV9GdeUVcdFx1MDAxOb5JXHUwMDAwdsZcdTAwMTDGXHUwMDFjntRcdTAwMDNccuV8XGau6NU/4+BcdTAwMGVcdTAwMTdjgGHR/lg+XHUwMDFjolb+yvdcdTAwMDSZXHUwMDAzoCdcdTAwMWTJiSs43Irga+KASVx1MDAxMlu4NaFcdTAwMDeXXG5cdTAwMWRaXHUwMDBll7//2YdflJ3nXHUwMDE5KvTrXHUwMDAznH3qXHUwMDE1vHLS5kZcdTAwMTdku5JcdTAwMDRj4NvR8valI1x1MDAxZOldr6OiuYpidKuQmllK89WhUrF6iJ6W11x1MDAwMW/jb1x1MDAwZmfBSj1cdTAwMTbnb79BV2sm2lx1MDAwN/rbfcTpOFxmmU9wlVjGZ2/pubZD1Fx1MDAxMyhzXHUwMDFlcW6npVx1MDAxNyZ0Ors8drn2NdxcdTAwMWH9Su4+ZPRcIlx1MDAwMzhn/mpcdTAwMDRAN1x1MDAxMcj+91x1MDAxY1x1MDAxN7MyepKmQZxcdTAwMDT5bqiTzL98XHUwMDAy76tcdTAwMTZVT3ZcdTAwMTkvYVi17VLFXHUwMDFk+igvxJdeXHUwMDBmJlx1MDAxYoFcdTAwMWJNUj/f61x1MDAxOcFsLb2a8Fx1MDAwMuG3dpzkmycqSFi65H1mXHUwMDE5XGLgXHUwMDAwclx1MDAxOFfHhkVcdTAwMTgvj+hprFx1MDAxNiHVyykw/v786u+E8uhcdTAwMWViXHUwMDFmvtAqlMRROVx1MDAxY6Gu8SNT8dtcdTAwMDFiu9DHMMisokBg9kPDmkhORXVqXHUwMDFjsU9cdTAwMGbIo2lcdTAwMThucIo+ek1/9Fo2+a/c/edcZsC9nFx1MDAxNYOzgFVRaTJK921YXHUwMDFhY/Cs41x1MDAwMVx1MDAwM2Chak7wd++ScG1HQOVNRsH2qGiLnMSDxbSvzVx1MDAwN5d3XHUwMDE0pf9nj5SDM+JaxEdcdTAwMDKl4LmuwYw1vFwi99T1XHUwMDEzXHUwMDFhqjNsXHUwMDEzXHUwMDEwYsSwwFx1MDAwNjsmXHUwMDFmnixakn85tWziuVx1MDAxN+yoPFx1MDAxZsnjZlx1MDAwNlx1MDAwN1x1MDAwNLJ8x3hsPNdcZi3ycMvOXeNcdTAwMWaDXG4qY6aIglx1MDAxY/KiS+9pscm9R1D7S8df0GTDsTf2U23rXG5Pa3UwnKC8ibHPS+1in0aSm1x1MDAxNLV3b5SyWVx1MDAxN1x1MDAwNrtcdTAwMGJ5UKSQ4lxcXHTPXHUwMDBlmd95XHUwMDE3ulx1MDAxMbaFQZriXHUwMDE4R1x1MDAxZFx1MDAxMlx1MDAwNOcmTcVAXHUwMDBl1Fx1MDAxMInmclx1MDAwZXY19YiJ8kJcdTAwMTH7Ov/WN+a664tcdTAwMTg+a37wW/GNpIzgccDu9Vxi9PfcXHSJQZkxXHUwMDE5PnCMZPTJXHUwMDBm1qCNbETDUVx1MDAxNyQ26NPOKlx1MDAxZFx1MDAwZWxcIm57w8lttkXoS5pFUjxcdTAwMDZ+I0rDX1qZXHUwMDFj3XQugaVIu1x1MDAwNG064Ld95pDo7qVIxKvwnWJrlOIxulx1MDAxMtTpXHUwMDFiQGFshP/BXHUwMDExPiVTkMq/M10478OmbzRqLKC2VOizSZgpOC62XHUwMDBmeVxiW+o3rlx1MDAwN7eGXHKL/6RU4Vx1MDAxN1x1MDAwNlx0XHUwMDE3XHUwMDFiqlx1MDAwZTTvpltnJuiS3bclOy6qIF/h0aFLqnyBKTNJ2JRJrPpcZoG1XG7oXHUwMDBiXHUwMDEwc9qZh8/lLlx1MDAwMFx1MDAxNJSuXHUwMDBm2q7+WpNcdTAwMGZcXFDmqinw6yaoaelcYmF4uGDYXHUwMDE4+ppe61xmQFx0qlx1MDAwMu6b8oFEblivrE60XHUwMDAxncjlgTNtSDldXHKJ/mD95d2Arlxiy7RnXGaiUtz/7P1N1TxzXHUwMDFit7vGWFxu5/+Hp/PYlpTnlu1cdTAwMDPRwLsmNvHe9/CeTLx5+suu7z+3W6P2ICWWXCJmXGKx2PzsXaR0tTNcdTAwMGK8XHUwMDA2Jl9FU1Dnl5nCvy25wlx1MDAxMVx1MDAwNK1cdTAwMTmRX3bmXHUwMDA06Fx0aNU0JUhcZtU3s1x1MDAwMnlcdTAwMGLEXHUwMDExppfpnZIzNCT08Wu0XHUwMDFk9ULnrVx1MDAxZFx1MDAxOcSfXHKu4lx1MDAxOcE+MFJQKr24xFx0U/VR1lx1MDAxNPNh6Vx1MDAxOMKhjCux70AgXHUwMDE2PIbWwH0n0iA+64L7XHUwMDE2Q3FcdTAwMDVcdTAwMDDKQ7toh8lBZHKsIFx1MDAxMVx1MDAxZVx1MDAxNkim6apSKlMkUfaKO9F+XHUwMDAxdKube9AkYMXUpbmhzeBxOuqM5ZdcdTAwMWNcdTAwMTV0IG16scBcdTAwMDZfyTfDhE9cdTAwMDGhOj1l4Fx1MDAwM1x1MDAxNVxyRqS4XHUwMDFlZzFHbiFKV79cdTAwMWLHP8pcdTAwMDfLTeNASi5cdTAwMDLsX7CJeGbQRNW2qlx1MDAwNFx1MDAwM4tpXHUwMDFiqjqslG+81YhcclxuKMb/nZPwzqhke1x1MDAxM0extaRcdTAwMGLk896Xv+eXfu2gYl8pL0/oXHUwMDFi8Vx1MDAxMPODWcDhXHUwMDFkVLqT37dSSy1cdTAwMTHEp6VcdTAwMDCYXHRs0C9cdTAwMTQu+HduXHUwMDE3aI+5we3MzVx1MDAwMYzvzFx1MDAxMlJAuCB3fOk6v0r29y68XG7BY+ep+yEv4OJcdTAwMDQmR2T0s5ZcZi9xI1JVXHUwMDE1/tlcdTAwMDJcdFe1XHUwMDExKJFCXHUwMDE1lYb7JfMxfS9p80WVI1x1MDAxNLj0My2ki1Su1LzPqGuTbf/S3LdwZHZvXHUwMDE0uiTrXHUwMDEylFxickBf6ESrR1x1MDAxNFBcdTAwMGJN61x0+FVcdTAwMGJlPNt5om22s6FFYKvAx7tGsbJcdTAwMTKV3VTSvFxiWLp/oi/H4Ot8ootOSFGF5uNcdTAwMTFcdTAwMGbUXHUwMDE1+93D5odcdTAwMWLx3sZ73/N/vVx1MDAwYjzAynxwqlx1MDAxN8JcciQnXHUwMDA2XHUwMDE1/NJN1HKiY9l0aaFcdTAwMDF/XHUwMDFi5slYlZKdp/XURPumXHUwMDEx2aC5qUNcdTAwMDe8wGt97dNd1Pqq/ppcdTAwMTTNJ3jHyOCUOVx1MDAxN6Ga44Fcbojpp8fmJztaXHLNlFx1MDAxMbRF/T13IFFzS9Ku30ZcbqF8sSp/XHT0XHUwMDAxp0lezShcblCppZmh6Cg0PED5UjKlZ1x1MDAxY7qwXHUwMDBiWcfg7iDwJar8XHUwMDEwMVxcJkhOslx1MDAwMEWK8jFlg4HujVx1MDAxOZVui2zZSFx1MDAxYVx1MDAxOE8tnalcdTAwMGaawNaryMuwl91cdTAwMTCW81x1MDAxYlx1MDAxMVx1MDAxMOd8hTPvzWOfrbJsn8D79/xAd9WP3ZhcdTAwMGI5xLhcdTAwMWRcIpvcwKs+ZaSv54lcdTAwMDHnyDhcdTAwMTdQ3VZcdTAwMTJVpMlUPjSdc4BhxCyoWer/zvh/XHUwMDE4MZiUY3GzutKPcf5CzFx1MDAxZD5XXHUwMDEwXHUwMDE4cDXLXHUwMDA2XHUwMDEwhVx1MDAxYnqZhUD7s1x1MDAxMr1hYmR7bGVcdTAwMWVcck2Ntty4+Fx1MDAwYvrP5+9cdTAwMWSe+Pc4T6LyU6rW67EqgFkte1x1MDAxYc5cdTAwMWZGXCJcdTAwMTY0o0wrv6JcdTAwMGaYXHUwMDE4aFx1MDAwNMDDp2vvumFHwIJcdTAwMWX2XGK+V1xinlktf1Fxpq/hXHUwMDBihLKbQ9BSQecp3nvFXHUwMDBlto6JsVx1MDAxOH3X89dcdTAwMWU5uGdcdTAwMDdNNmVO4yD3ZcX+XHUwMDE5XHUwMDBlXHUwMDA3XHJ9Ulx1MDAwYmKmXGapjWKeXHUwMDA3lVx1MDAxYVx1MDAxZpfp/OWBPF/MdVx1MDAxOdyJ4nTmx9h0W1x1MDAxM8tDzl3hdm3ouz/vTYW0Y6FhqJdcdDhZXnl/PobeXHUwMDEyxfjXiol4KlbY74JcdTAwMDRcdTAwMDahXVx1MDAxZtDNmur/evwy81x1MDAwYq2mJ1x1MDAxMnfa46/aXHUwMDA3rz/bL1pcdTAwMTmW8NvclyE4gldcXOizOldWrYX15M72WLJcdTAwMTZ+dTHIcnVlWHRcdTAwMTkoa8V8SFxu/5c3gHN1XHUwMDAzX3jgkjpJ+KpY8e9dd5gy17GwXHUwMDBmP37p8Fx1MDAxN2kmVFx1MDAwNTrYWN/vgXiQXHUwMDEyXVx1MDAwMDfoT4/eiD2dPqEh9Vx1MDAxZYxcdTAwMTierUHSw7mEPGWczZPIXHUwMDEwXHUwMDAwk0RQcFx1MDAxYStVSFx1MDAxZVhlcOsjz1x1MDAwMl9Atlx1MDAwMtTIU6VV9t23Jq6/c0OmqFPOXHUwMDE5+4yy2Vx1MDAwNHryJno+Ylx1MDAxOSVTJVxu8bFxyVx1MDAxZXqnrlx1MDAxN1x1MDAxN6oxzy3uJYVy+UYvj7mhzP562KvDOFx1MDAwNHs90i5cdTAwMWNcdTAwMGV/V5GNzbXMx1dm/1x1MDAxMlx1MDAxMydcIvY7skpCXSQktf/ffzJ/fFx0/6/XXHUwMDFkx5b1/tW0hMTGKiivzkAnsLfxjCzU841sVUbkNm57sb5vXHUwMDE1NONgbj6xv1+mnVx1MDAxOFx1MDAxY128uFx1MDAxYyhsMJxcdTAwMDBUf1x1MDAwM6RcdTAwMDBcdTAwMTQtjngoPc+OyYWKyVx1MDAxZWG5XGJy1nZgM8JcdTAwMTTftu1TYttccpsqeLKnK7FcdTAwMGbUXFxqPp+0RVxuyK6QMFF6JbNnwqSVszlcdTAwMDPSzdui2bsn7/5whlx1MDAwMVTCpJCMJqGZ/HunZFvTr9PwizJG4v+9/1x1MDAwMNwy9Fx1MDAxODBFXHUwMDEx8tFuQTxcdTAwMTefNGOMxN/Q1+lcdTAwMGKwx0mgXG6ebjdz2Onp54C4N/tr2Vx1MDAxNYklXHUwMDA2XHUwMDE0eFC+iHWd92tcdTAwMTdcdTAwMTdFTl5cdTAwMGJcdTAwMGa1Zk3iXHUwMDFlVWCBXHUwMDFhKI/e+7M30j6EsEk3P2tcYtSsZofX2JFlnP71rObYN4l940V4b1x1MDAxYdlHVvuBe7tDJinryP1cInWRfYKZycBcdTAwMDK+kFx1MDAxY8V+Qfw8hU43XHUwMDE5XCJQn4pA+VxmYfZcdTAwMTCCXFzbiFx1MDAxZVx1MDAxON1IXHUwMDEx9sWyS0PVycby4kq+nMBwpVx1MDAwMP2y9UfLt/tdmXImU3BcdTAwMWTdo3bBqFx1MDAwNCs1+G9cXHhcdTAwMTFE9H5Y/M6B6TJ8QZX274tcdTAwMDGeJHhcdTAwMDPT5+PiwCX+XHUwMDE2qS05XHUwMDFln6iXo6yWXFzLulx1MDAwZVx1MDAxMcnqYKz6oZTk9+uryVx1MDAxMlx1MDAwM/KnXHUwMDA3IzUvlb7ZRd9cdK50x89cdTAwMDBB52SFumeM6CbTblx1MDAxM+bU/t4nXHUwMDFlSfmJkUqaU9CAJDpxemX9/uhaTbl0/Vx1MDAwMv89V29PXHUwMDE3XHUwMDEz/to+XGJ35v5cdTAwMTbovVx1MDAwMk54XGK9XHUwMDEyyFx1MDAwNlx1MDAxMpg+3kuGPTyBk2q3Yabh4VxmxipnXHUwMDE00LGbe3aRyVx1MDAxOLCBgnFStFkgXHUwMDBloPa6cd1cdTAwMDLt5lx0aIdcdTAwMTFcdTAwMDIo+5InW1x1MDAxZL3J9a//m5BU+/n069fPTlx1MDAwYuJtyYhJozMrXHUwMDAwTkdyik5rhnFnO5uk78pcdTAwMGJ8ueg1mFXlblWdTqSZRNLTgVBZZVxiXHUwMDFk3Fx1MDAxMZPzNWFieOFMlbpKcj94pK5m8dtT31x1MDAxMLz2N37kyMf46GiBOj6yg6+DJVx1MDAxYlx1MDAxOcCX/ELbXG5YJlx1MDAwMWZd+69nQcSqwFL4XCJu1f9pYMBcdTAwMDF1Llx1MDAxMon7ZotcdTAwMTCFxGlcdTAwMWM42VxiXuNcdTAwMWY5XGZ6fGrgO8E9QuA7XHUwMDA3OZi8dLr95iGffbRcdTAwMDPpXHUwMDAxgFBjVYkjvoXRXHUwMDE5uCP/UurMKItwXHUwMDFiK47j8fcxf++/iPRcdTAwMTeZ7buJ6eOgopNYmY/Cd1wi2WNxXHUwMDE1XHUwMDAxJqu1LFx1MDAxOfVdz4Dwr9TZZr7ZxSe+n68/3PxcdTAwMDL1bT5m0eVcdTAwMTBwIepcdTAwMWVYg8k9hyco9oja/FxiisQ8MjAm9/j3XHUwMDFlQSpv/FmhP0EtXHUwMDEyXCIny16XhJxj+m3ieMi7aptNd1x1MDAxN0K2LIRJq6ovMJ/hTT5YQVxuXHUwMDBmeM/h1lxmXHUwMDFmen98faW+07PrZFx1MDAxZcK7ofCiiGD0f/3ZRzaw0Y+GKlx1MDAwNt5u7Vx1MDAxYtvdxVx1MDAxZd68bcNcIpJRglx1MDAxMlx1MDAwZla0dlxyXHUwMDExXHUwMDE4XHUwMDAw1S3rXCKFZScp4KpcdTAwMDVno1x1MDAxZpdcdTAwMTbAcLnZSVwi4yuDXpWOSf5cIvFcdTAwMTM3/XKZ6tIoVrNx9bfo9/5kplx1MDAwMZ9SaoyXgc/0Joo3LX5/pIZHc9un11x1MDAxY+O4XHUwMDBlp+84mX1cdTAwMTnKgDHKkInr+d6VOOokpog4j9m4tdvJgH2z33Hm0nLHYich+F8+POzstK9jlza2UFx1MDAxNVxi075iXHUwMDFllzK6IehcdTAwMTnVK8d/fjSP75EnXHJZXHUwMDA0ze+6XHUwMDBiXHUwMDFjRYpoUJ8usNicXHUwMDAz+Fx1MDAxYUSgXHUwMDA2d3uqxVx1MDAxMvp36Z7/7WvA9op1XHUwMDBijsPZadJ0nLxZ+tvrp3+0XHUwMDBmI2JybLf66+zEMpH7K1x1MDAwNbaPunvKXHUwMDFmXHUwMDAx0a1Tl9bIvXea6NhfXHUwMDAzN1x1MDAwNV3pcGwk3eUtgP8xf1x1MDAxNla2QGtcdTAwMDJXjMKVXHUwMDE5blx1MDAwNazyiHvLXHUwMDA20FVcdTAwMWI+0U5sXHUwMDEw+VKfVn54v0RcdTAwMTZlgC5hNFx1MDAxZfvvw8tOXHUwMDE2SH/5MU1i04tcdTAwMDGzuCHbaVx1MDAxZFaovTBsfPCtejRcdTAwMTeOWPSQWL0xXHUwMDAzv2cyXHUwMDFlXHUwMDExJeM762J15Fx1MDAxYzFcZjl+XHUwMDEyLVx1MDAxONDR1Fxuts5cdTAwMTmA+jh6qHK4oN9PmC5EXHUwMDEzXFxWXHUwMDAz7j48J1x1MDAwMGm393pM+Dwpolx1MDAwZm0n9e9scDQrKIf+ZfZtXCI3JFx1MDAxYeJYz0dcdTAwMTJZXHUwMDE5klx1MDAwNZhbgj1cdTAwMDAwXHUwMDBmatStqeY/2eKJt1x0h9Up2Dq8xDYppvV8dsO4LMCkObybUCjm5LVcdTAwMDf2+25JhmmMy0pX129MsE0waVx1MDAwNrNu+Hhk+1x1MDAxNYVcdTAwMWIsqCRMOXKstmjXJJh35Fx1MDAwZvnklOfI+EGP6NdLgVx1MDAxNHZcdTAwMTaEW1TyTVx0q99/xfpF6m4pjaur5/3FLFxikib07/5cdTAwMDE4d/lcdTAwMWHw11uuc1widmJkw+dQTb8nL0c98yZcdTAwMDKabXpcdTAwMTNcdTAwMDat49BcdTAwMDbXjlF0/0BcdTAwMTZoLT5IhT+gam5cXG735EmoXu3oXHJYKJr931x1MDAxOVb2/IjTz9FcbvryXHUwMDFiOln3xGJuJsXJzXLe9PL7gnNcdTAwMWF4UJFNXHUwMDFkL2Jsb1x1MDAxYzTsV4NcdTAwMGWxLVxcKazx+l2pfJWKffixn+tcdTAwMTLZKo9cblx1MDAxOOZwNefbbl6oLoxcdTAwMDKe5cLwKE34njPisFx1MDAxYsaqgVx1MDAxMFx1MDAwN31cdTAwMTHgdV7ygiPmXHUwMDAzmiD/rJR8sVDPh9uGXHUwMDAy1avAXHUwMDFie/Blq95cXPl6/Fx1MDAwNcDQOcFp5jqlXaCI9mNcdTAwMTaA1q59g0uJXFzEv977MO61JFlVyFx1MDAwMVx1MDAxMyCVj1wiPf1cdTAwMDBpXG7oefD6l0hxOMo99LWzXHUwMDFhrvok0nn2bFarXHUwMDExemSpbu+/PtO25XM0PVx1MDAxNVRQne73mFx1MDAxOVx1MDAxZinG/OtcdTAwMWZ1UNfpQHxpXHUwMDE3R3ts8mqg9lx1MDAxMCeVpG47WXJYikRlrFUwy+atnev1VPHv0HrlXFxB3pebObFI79JccillXHUwMDBlZlx1MDAxM0rPZ1x1MDAwM4n4KFKl91x1MDAxNepzqT9D5OJUsUHeh/17R4lcYs1cdTAwMDY1NeRitSaaKtmmn9Y4XHUwMDFi+9W2/+NGv+Y3IWbmLFx1MDAwMl1C8L+XXHUwMDBi3Dh1hJx8odfFopGC0tnJk4D3jHRcYm+aZ8xo5OX4I3yihVhcbpBcdTAwMWbUL0n6zFXR91x1MDAwYjGCv7+89EXqKVTyxo0+XHUwMDE1qshcbtGOKWzIn8JcdTAwMDDPXHUwMDBm4lx1MDAwMc+yQMa/1+Rrer0+l/Dft5RcdTAwMDTBsUK6euvl4GSE/ezp3Tghk3Q7XHUwMDA1c8imp/nHXHUwMDA2XHJcInre61x1MDAxM456gZhcdTAwMGZMuUdccv+df4NJPNkhXHL2f4Zaxbxr1fqRXHUwMDExXHUwMDEwnMxcYv57kMIj0TZ48OBcdTAwMDM2XHUwMDEy0+VcdTAwMTHQ0FU6tah4Wdhvh1xyc1LFjVjaXHUwMDFm6Pur1e1lXHUwMDE1XHUwMDEzuTdIX/Bd/LFQ1+1cdTAwMWS2XHUwMDBlXHUwMDEyrsO11MvZZl+YsLtThKqeXHUwMDE2L/Rccp+wmC78/bdcdTAwMTdcdTAwMWbkpLpg4N9XzP7rb1x1MDAwNvzOy+HRR01en6luXHI/+Jp4QUiYi1d/XHUwMDAwa7rKXHUwMDEyzFx1MDAxM9wy/2PJwXGtglx1MDAwN/HSYlxi+1/Per9kmv2hXHUwMDAxjk1VXGZcdTAwMTQxaU89+3/fczghaqGtSJyRXHJ50GO1RzgxifC0VM445Fxc8kfEXHUwMDE2izYg5b88gyhNRlx1MDAwMKprpJU5XHUwMDBmXHUwMDFkdMZcdTAwMDaKt96XiYDnKzJcdTAwMTDge6GvXHUwMDA1kHj9fmBcdTAwMTeY/LVcdTAwMDTrq7BcdTAwMTO746C6XHUwMDEz5FbhnFxi6vVcdTAwMDdRTG6CUVHyclx1MDAxZZC1QsgoToF2XHUwMDFjW1xmPlx1MDAxN+TZXHUwMDA3u5aeqPLYvcdnyWxcdTAwMWRcdTAwMDOvneiqICBKxzewTa22WqZcdTAwMTjfV0Jls9iKJ23eXHUwMDA3p3nBXCLv9sJUy3T1stmsKGWdvlr1d/4vhlxiPye0f2vNqIXAtPm9JLGOkl/6jnOPmNFRTr6vTD1cdTAwMTIyXHUwMDFipl2d6fxcdTAwMTQqUVx1MDAxMFx1MDAxY1IwuYxaXHUwMDA0yK5AOPOLaI8gOjCghLeQnrnBuM5cdTAwMGJcdTAwMTWneIW4f73omGVHWevAkUFNV1Wkn/L5hcRv69fTXHUwMDBm6vVcXIrlOZJrwtbvpaEw9jCryLx18n1T+nizSDLQxNpsjGNlwV9GPkuKXHUwMDFlj87fM+lcdTAwMTWRQT8raMWsYis0XHUwMDAwgbDeu1x1MDAxYdLgMEo29Tptf2GRuodJTPc6Llx1MDAwMkJ0PVx1MDAxOeHSXHUwMDAwdlxu7L7DXHUwMDFhLLP9rz+5yrLAXHUwMDAzXHUwMDAw6of6tGs+45oqTph+VVx1MDAwNyXJkJqtXHKsIFx1MDAxOYm41ryF+Wu9yVx1MDAwNpRcdTAwMWbatbXkhcP0r4eCWpztqVx1MDAxYzRtZkGJWEu3ny9cdTAwMTZ0VYmEP0LZbtRB0M5DWvFcIp3/WOpdnDG18a/8tN+/nt3av57dXHUwMDE2+2j2eWq63nFlW1x1MDAwM0ladTBcdTAwMTTQXHUwMDA3RfNcdTAwMWE6tNCcKEtJbCiHfNA7Jlx1MDAwN3prr2BBw2eYPLBQTVx1MDAxMkdknE39Xy2yXHUwMDAwwTPHRWVcdJlKNPCMbc6wzdBzXHUwMDE1v1x1MDAxZK/IXHUwMDE4PNV8h+5cdTAwMWRcdTAwMTezIMGO+Yw3OajgSrz+L3/NzHS6cdSEi7RcdTAwMDFvYmYrxrWgYmgzfEyiSrJcIlx1MDAxMkllL7UjrJzd5S1cdTAwMWVcdTAwMDFcdTAwMWOOXXtcdTAwMWFcdTAwMWMo16qWNLtFs4l7LsLw+f1v3e5tXHUwMDBmXHUwMDEy5pXTXHUwMDBmhKOR6Fx1MDAxOFx1MDAxZIHrVKyrYITBOPpcdTAwMDVcdTAwMWTSQPbW2sCoLtNArfdYX/e0h4NcdTAwMWVD71/0mcu3Qlx1MDAwMn4p7qySKOC4XHUwMDAynttcdTAwMTHsXSe1UWtcdTAwMDVmXHUwMDEx1v1Kr1ZcdTAwMTbhvCdQYIH2fnOcNl00eqQkuLvyXHUwMDAygGBmXvpppstMZsBUtilrK9mPaHrb7uu/d3/59dvWXHUwMDFjo94zwa7O4Vqk0kBcdTAwMDXWciqHyXbAnozr9vOls0wg2a1512vdf/f75lx1MDAxNIX7eatcdTAwMWP2v3GfWtfOwvTvMzTpXHUwMDE4Xf1EkPubeOlJ+pYvWtTTXHUwMDBlozO6zyi5oKj1gHXVW+hcXFSa7DJcdTAwMDLLcPbKdIw3/iBOP4fcXCLL54PZv/RuMTZCcI2Y1i9cdTAwMDcrf5+OdmnhkvIgXHUwMDE4VO++7j7x24SdPLJAajuE+JhSvaCXwV1OxyDof3V+SoCELVx1MDAxZm9HXHUwMDA2TmuTXHRLa4rariyJR1hcdTAwMDFbNlpcIirZRp8tuGF88zEzhndPt4KuM8sq8p5cdTAwMDHKOVx1MDAxYs31I3dcdTAwMWPd++BSXHUwMDA1efpcdTAwMTVcdTAwMGL6I1hfwad+6lx1MDAxYtSOh5H9dSDQ/lj26DCXXHUwMDA2lFx1MDAxNk5cdTAwMWOLXHUwMDEyM8iOnH33rGXGXHUwMDE1apa13dhgopWavujlflx1MDAwNCMvOc1N91KXXHUwMDBiJZdcdTAwMDSA5ttcYv8qb/yRMIJW4Fx1MDAxMFx1MDAxN3tcdFK5IbjlecqJ/IF8aCZcdTAwMWPhXHUwMDBiJelr40zyxVx1MDAxM+qCUPI4n/WbcaNcdTAwMTMkrkaMv+Mjpc/JY5225LemulD2d6Lwr7mmXHUwMDA2K6OLq9g3ZZ8wt8BjxbxcdTAwMDDFJojKXG5QaUxdXHUwMDFhXHUwMDBm/Vx1MDAwNqdjooRcdTAwMDbar3zypzyx9uWzSSC5cy/fXHUwMDBmYlCo/YLLsrt+mzNcdTAwMGY27qWmXHUwMDAwLKKVXHUwMDA2KS30XHUwMDBlPeKb3v1IZ1x1MDAwM30oJoXHWFHJf/d6Zlbme02L4lx1MDAwMUimUK32OVhx8XaH8qAyXHUwMDA0/varPpHeTD1cdTAwMDKrPFx1MDAxNfihb9jVb39Ke1x1MDAxNGhcdTAwMDOeRzNcXFt5ybZcdTAwMTmMd4Zrsv7ywVxuQXJcdTAwMGYh7V9cdTAwMDcr3lwiK8uR4tJcdTAwMDdcdTAwMWZcdTAwMTRcdTAwMDJp2vHwn58xeKNKwD4p57CRim95nDRcdTAwMTdMQvVRMnVKpsGHXHUwMDFkqOzTZMGMl1x1MDAxYb9cZkDx4qWdq1Q+wFx1MDAxMtTY+7PDzXYwpdxcdTAwMTLz9qJcdTAwMDOSlNBhT4RcZlx1MDAxNVx0QWDwmePqXCJuMDYgXHUwMDE4Y2KzIFTxmkVG4WymXHUwMDE1bJ/hJe+Nm1x1MDAxNVx1MDAxY300YcDnWPl8sr07Wdq+P9X+3jdcdTAwMTRcblx1MDAxYvBcdTAwMDVcdTAwMTAp4HhSUVx1MDAxMXHNPLo2dNVcdTAwMWP97y1PxNQvc1x1MDAwNFx1MDAxMLcm3LzAUGjWRz1o3n7T9ZWBq1x1MDAwNlx1MDAwZu5KnsVjNTjhVyqyTFO1SYVedHozXHUwMDEz8tNkXHUwMDA2k34sY9lDwljYZbEyvTVJJMpcYpBWeMi7+ytlZc173U+fuZBTb1xima2s7GBKdZmGuKFldleaytJUQWVedjdUgngpkFxmtl9WW3jH+pVkZTDw6Vx1MDAxNynLfJA6b1x1MDAxOEh18scvxVxcdzhcdTAwMTTi48DgeHgrXCKNmsymQZBE93deg80sPYy7WWhtgWHI5Gl27uW3PF3+fJyB1H3euMdv51x1MDAwZbOS6qlcdTAwMDaSbWLiXHUwMDE3q1x1MDAwZUU1SE87/HLivS8hV7hJL0el8MqOk1x1MDAwMyvd6KqBP0Hu6Vx1MDAwNI3aOX6FOFxu7Jat2vanOsbdtcaS6CmZk1x1MDAxNqfdf1x1MDAxM1x1MDAwMFxyb/ZLd5ywxVx1MDAxY+w1pFx1MDAxYSU691x1MDAxOHVcYjimZmWHsZm4VOj1XHUwMDFjv+OcOUzhe1x1MDAxY1wi6v6TsVxyXHUwMDFiXHUwMDA0ju5VXHUwMDFlkrVcdTAwMTauXGZcdTAwMTWd0uFcdTAwMWVcdTAwMDPBylhDMFRcdCEuXHUwMDFh5nFwuVjKr/jUn8jYzc+YUVx1MDAxYWZcdTAwMWHqepFx+1x1MDAxZMDRR1x1MDAwNa25MFxcyDv4d3+IXHUwMDAzY/aC0Lq0vPK2ZVx1MDAxNPie2a3MejO4XHUwMDE3IWJRv5u6M7qOdNlcdTAwMDVQzE7bUUNJyFqFXHUwMDE1TX1TXHRcclhiSW1+S9bAq3owvzpI+9iNmD9desHmdPb196pGXHUwMDE2JOFcdTAwMTGEW15cdTAwMWXiiDzxb/tsXHUwMDBm0O/t6urprcikNjObOya36XlcdTAwMTifUNDARWODiZnKmebnPsNRPzxcdTAwMTFcdTAwMWa5fb/3kK0/0ljVnf08SFxcsiiR3H/z+4g3z2/uKeakXHUwMDFlfSC4+7w1oFx1MDAwNi/tPMF7j7xcdTAwMTmTvuGKLv1cdTAwMWUnQatcdTAwMTRU1/xcdTAwMDaN8Vxcup9MXHUwMDFmNWw7NjNvnaeYJGGMhzQ5r2foXCKv50vQ+P2q6TVjU1wiI1x1MDAwNdqJJkTaKHGOXGbMfYVGZmxO5lx1MDAxOXVM9ZvIoOJUZcVcdTAwMTUoga1RnSxcdTAwMTefYHCpvyl+gPdXg/lcdTAwMTSBtGbI5V98ViOFVTMrLKRbTUFe38nWkScleb/C8X46zKnEdISmXHUwMDEzf7LYrKN6rM7zQYncvicj9I9cdTAwMDJcdTAwMDJmztlGSrCLXuOZtJp69JNccmK8kvVe9/yf/zAnwHivN8ToS4zzUTdLMuVcdTAwMWHW/YArrGbO/dZcZlx1MDAwZlwiwvKxNEjmfF5+fbxsbeJ3RfibLNC67OVcdTAwMTD4ZfpOlEtmXHUwMDFhXHUwMDExY1x0XHUwMDFk++exaoMy641pyuHCXHUwMDE58lJUxSSFV41rX9n6XHUwMDAzaqslMmo6THHaaT9wprxrx1x1MDAxNzX2gW73lfFcbm5hyfZcdTAwMTS8TJ5cdTAwMTTLXGZcdTAwMWGVyOdh61xyXGJJsVx1MDAxMVnGp4o8kl/uzv75TFx1MDAwNGJpsl9lXHUwMDFkk+h732/ywCN/XHUwMDAyg69MXHUwMDE5tDLwkv1LtLz1XHUwMDFmflx1MDAwNcZC8bmDop5tXHUwMDFj0PlcdTAwMWJNtjzb7+CcWE+hTFjArak65rVcdTAwMTnjXZtcdTAwMWRouj6JXHUwMDE4UVx1MDAwMMrMxs5IT7mUNlx1MDAxMH+bLFxc/Xd7XHUwMDFkX/jwNVx1MDAxOFwiYUFcdTAwMTVcdTAwMTVYkFxi2fdYPvgxU4SLKTdXXHUwMDAwb6pFSNxcdTAwMGI8acE8XrFcdTAwMTS0Ou04PkSy3ql49s5cdTAwMTJcdTAwMDTGfEeyXHUwMDAzRypS/NmlXHUwMDBlXHUwMDA3xZr83UBcdTAwMTDtzZy7kX318NhcdTAwMGaFXHUwMDBmvFx1MDAxY6yOoEt9+OaR83RcdTAwMDKPONckeLfTYfDnXHUwMDA1jVx1MDAwMd+sn6+/iohStiDD5nf1QVx1MDAwZk5K+abExon02jiXIFx1MDAxY2qd785kS+D2MU2Xjq+N9iUtiVx1MDAwYvykJp+nlWBcdTAwMGZ69SqXnmlcdTAwMTZ4ne13o1x0Z/+N2Z3rk7km+lx1MDAxM7ZcdTAwMWKcS8VcdTAwMTRGeLpcdTAwMTHF/XNU50wxXCJcdTAwMGbFzozCMN62Y7eNPnPT1/q621x1MDAxYilFh/HEg/BkTclcdTAwMGa7vkFiXHUwMDA0lWU0X1xuXGZcdTAwMWJHfFOV46xnbS9cItBcdTAwMTU6XHUwMDAw+vBcdTAwMTFWkvhcdTAwMWMl9rRIvywj5KdcdTAwMWb1Zmp7iI+/lzJlilx1MDAwNPI7Rlx1MDAwZYJicpfZu/ihWbaWWEfR6+F1QTsuby6DY/Lsf8FcIss7XHUwMDE3brNcdTAwMDPsvzInRnS92v3Wj9Frq1x0KWu9oe3vv1x1MDAxMlx1MDAxNllcdTAwMTaDwtlcIr/lXHUwMDBm57pTc3FaNt5cdTAwMWHYqDZW4zeIZFs9fX5DoU7qYVRcdTAwMTiGXHUwMDE5XHUwMDEwin1qtVx1MDAwNFx1MDAxY5GwSzZ8Zec/niu/U5OXXHUwMDE3XHUwMDFlXGZcdTAwMWHY+Xn2KXDrXHUwMDE0uix/XHUwMDExMnBCe9qCXHUwMDE0wrRn/MU+QVMn+f7sosWRQy+u7Vx1MDAxN/nxhW+J9mJzq/RgXHUwMDA0fJendszRKy+zcdmkXHL2x9GBy2fK+2spjDD3XGZcdTAwMDPGbtA1aKN4WmizJTu/eqFhs7x5+vJRSWXUxkH8hiw++nWinn+w+PpMs3qxKvMrNn19Slx1MDAxZPO6XHUwMDE3qPeqZ28nXHUwMDEwTc9ITXm5VCfaknyJYXrtePPsrFx1MDAxMVwij7jrRc+3Pkur+iN4eNTF0I7UZ1xmXHUwMDEzmmVJP+yAXHUwMDE3upXL9TWH0dK6OPqkpVkzTVwikWKx4lx1MDAxMdLnn4tQitEjXuvJvaBk48Y90Yg4/j7LrYZcdTAwMDdTXHUwMDE3lJElXHRLsSd1w1xmbVNfzdeFf7xTy3VcdTAwMGXZlEZW0cB8PIhcdTAwMTNcdTAwMTaTS0ps+CaWgtZgv0TjTXWs39znvt1ccr2M2iQx3i9cdTAwMGXS2PjJMC7T0lte8kx0io48yGpcdTAwMWKfWc3x9E5cdTAwMWEn4OTb5XpWyGTk1Fx1MDAwZsp5faVcIq3U27fgYIOY8KDvs669bb3IXHUwMDExdztGXHUwMDA1XHUwMDFho1x1MDAwM9ZAPMlcdTAwMWLRPe2ZXHUwMDAyhO5cZk6c8P1kgGXDa1eD//1uJqHkSmS/pDxZXHUwMDE2kpNcdTAwMWJcZmhcdTAwMTFcdTAwMWLossxIQvDidZ5RLc5cdTAwMDbsclx1MDAxMoZcbjNyvlx1MDAxNUdcdTAwMTH2KbeMYT/QXCJcdTAwMTRcdTAwMDJXXG5Jf7WR2bdWXHUwMDA39NCDXHUwMDBiaoWMXqVNg1xmPVx1MDAxM0OG5bCyPPWvxlxm01xy8lx1MDAxZDNlrFwipyucXHUwMDA1NNOIlFhdheJwwj/g8Fx1MDAxY1x1MDAxZVveultcYkJxx5ni2M/9alx1MDAxNsdcdTAwMTdcdTAwMTZgYlxcXHUwMDE3fPykzqxlpIZxI0TKT/ImPHdccmu8UNZNaDrNc1wiXHUwMDE27GHbwCunQzS3amvi0CVm4oLDs//4PKSbrYs9x6ZcdTAwMDZQXHUwMDEyXHUwMDE3XHUwMDFkIFwiUcah0Ih0MMBZ3Fx1MDAxN4FcdTAwMTQ00DNcdTAwMDZcdTAwMWRcdTAwMDD+XHLZXHUwMDA2qbc3XHUwMDFhZzP5NYLdd5leYf74KDudUqL7XHUwMDEyLY9rLrzu8a9P807HbdpezCfB5WanR79cdTAwMTSZb1x1MDAwMZDS8IElP/A6XHUwMDE45s2otIZcdTAwMDealXe1RIxqQ41WV2atXHUwMDAwR3hcdTAwMDaGoDOPoEcxOzHOK6WmR1Zkblx1MDAwNJFBXHUwMDE2qiggK4FC2Fe6Kq8npDGERstKXHUwMDBl5O3VLlx1MDAxNURcdTAwMTiwySx2XHUwMDFmoTvR/Fx1MDAwMLx6L4/2L25XI6qHQyBVXCKscDdcYoRMpSBRfoqfwbVHaEs2w8hcZqs4gvhcbl+TWGq9XGZoYSXFkHpBd6n13zrlvp4tp4TK4fer8OliXHUwMDEyyLz+KXbx9DY6p7POXHUwMDE1xSiAPzSwxqPIgNkjJK9cdTAwMTUq08u9UsXTjqqL6Fx1MDAxY+zlXHUwMDFi0GnGY3c2QVxcM44gj7BkXHUwMDEwnG2Nw02Gk1x1MDAwMSh8LnDYXGbghLjgg4JcdTAwMDT5ccvRvPa8xlxu257dvEnzp/tcdTAwMWPnlmL5hffwkqLyXHUwMDBmXHUwMDFkteG8XHUwMDE1nsOEXCKYXHUwMDBlgkjecYZfXHUwMDAzcXifXHUwMDEyiaGE0mnnXHUwMDFiz8JcdTAwMWSlvpbyVqtXJlDCt06KWZfgrJkp+Sn88K7Ch24t3dRcdTAwMWat0X/xny43XHUwMDAyV1xiZMe6+zLB/MjP7VKNXG5Jcp1LhIjkVmTqXHUwMDAya6+CxXtcdTAwMTnKhIIqjs/vXCJcdTAwMTMjXHUwMDE0etvVOJlgXHUwMDBm9l51ypRcZjzxQ6SrR/mvkEyScJtBxISNfalBrUSBdbxFXGK+k1xy3IfKwnO/RtN+fVx1MDAwNDyoSDFDXHUwMDA1Qe09OazJs1x0UnJaRT/fMlx1MDAwM1U6xPb0dN9ObzAtMSg9claDM5dcdTAwMTk4jMCioCjAXHUwMDFjXFx6KFAp0MPgON3c1aWEyOFnvFxuXCJ3N25oijRdkz1Y69eb+qq2etVcYiVxvl6N7tX6qutTfFx1MDAxOS/N1t1UQSXKoTnAfbtcdTAwMTXAw5JrXHUwMDE4P0eR8PDpXHUwMDFkXHUwMDAzupP4K9l9XGZcdTAwMDFXk+qs2yFJ2UxF4kbIKZ5cdTAwMTZPWvX9NdDuyrNcdTAwMGWR6Nit4G/3xDdqorbF66DbXHUwMDFl51x1MDAwYnl1LpdBp1x1MDAwNVx1MDAxOOXQXHUwMDE2clInXHUwMDE2v4GAv41cIrnoRZ9cZlxyXHUwMDFk71fDXHUwMDAx4WyK+/O6Mu/ZSKWPzlx1MDAwNpaR9CEjreg9QVgsxuBMY3O4XHUwMDEyaD/glvmgg1ZcdMVM140k+/PmXHUwMDE4XHUwMDExnuhbXHUwMDE5gW9Dsfky++A5zphcdTAwMWNcdTAwMDaEXHUwMDAyeDRAQWqoRshccr5283L7XHUwMDFmaybM131Xz0BcdTAwMDcr+v43U/xcdTAwMTTWhqY8S6Z7R+wz1E8/f6iMlO42xFnLyVx1MDAxMFxu0lx1MDAwZT9GS9w92Fx0XHUwMDA3OKxcdTAwMGZgmzJSotmvnNPsXHUwMDBlYNNcdTAwMGJcdTAwMTdW+106mmP1he1n5sRcdTAwMDJcdTAwMDVMLPtcdTAwMWLBI2de/Y9cdTAwMTmRlPTS6v+4cYVz8lNSR+1w4qJGXHUwMDAyqCDIT8K0Vmrr+fv8pFx1MDAwNFx1MDAxMH5cdTAwMWRkxmbDxHhEXHUwMDE1lLJ0fVqNT37Nhyw6+fh7MSv/9I/SN4hcdTAwMWN7vktIKnS+ZLxcdTAwMDFcbqH6nKBxXHUwMDAwXHUwMDA0v3KxKCx8i85eavlA4jii+5eRWsL8XHUwMDFme9dcdTAwMDHzSvxcdTAwMTCfRXhcdTAwMWZcdTAwMDEs6sWXXHUwMDAwf5IhnIg5+GFmRVZ/zjnRjygqedbXZNF70sZKqFRcInoxKlx1MDAwMFx1MDAxOZ6OS4eJmlx1MDAxNTa36PkqLpVwV/NcdTAwMDOe01x1MDAwZVx1MDAxNCxcdTAwMDTwNoB5XHUwMDA0Rvk3wbtcdTAwMWJDM0ZAQYZgIZvmcLSLXHUwMDA3ICX2eV2bgNg5erPPlUQkIyRcdTAwMWLhPWv1XG5A6YaUOKEwXHUwMDFkypztdFxcS3P7XCJBy11cIlx1MDAxMJ3m0jjb8ZGOMlx1MDAxNFx1MDAwYky9vbrO5+fw9Vx1MDAxZMT30GLD5/rc7iyNXHUwMDBiXHUwMDA1j3+Q4PHXhlKjgIGQoVx1MDAxNsR/LNNcdTAwMDVcIsbok71sR+pcdTAwMGagXHUwMDE3XHUwMDA0WU358W+HkIzGwyiczIC4eopEZ9D4+8itpY82M1x1MDAwNGIgddr7J8dXiY7n0HE9XHUwMDFiruyeT3Glqr83UCnjwtVOKk5kLycln1x1MDAxZf9LoHPmi/rOj1x1MDAxOaSD59klO97ml/mu/2u3XlDdXHUwMDE00F7LLHxcdTAwMWTvtN9cdTAwMDJRbln11NBcdTAwMTb3RNIq1rCOKs/qq4CrRfBe3VxuV/mw2s2431nvwZffslx1MDAxYvQ7elx1MDAwYrhaolx1MDAxYiXUh1x1MDAwM6lt2T2osniLWIlcdTAwMTRcdTAwMGbxxk/5mVSn/2/vj5s9m+unKXBGpVxusyGUUnJ7XHUwMDFkNrCd2FSqpDEv7rW6XHUwMDA1XHUwMDBlwfz1de00Xp2arU9hvnqMZtFcdTAwMDFlv1x1MDAxZEVKY3JmXHUwMDE4vTBwkIJOXHUwMDFlLX/WWDomoY7dtlx1MDAwN1xmVZlcdTAwMWVcdTAwMWSbnq4xSlx1MDAwNlx0vyA72zlEeMDb/+zEVlx1MDAwNVwirC1W+j1G8cngiL1MYORse0osceNzolZDWpf2bFx1MDAxZrlp0deHamy2XG6T1KO+XHUwMDE3XHUwMDE431x1MDAxMUxRv1x1MDAwN3t9m+Gh541cdTAwMDPxoVx1MDAwNOqXKXVcdTAwMTJef2Dyc6XKXHUwMDAzn0i0flx1MDAxY6ldJ3/hhccxNrv5eeOiT/tMxiZlcvhv31d2jNr6nMNcdTAwMTcqXHUwMDAyZDjEXlx1MDAxZPyoqpmgXHUwMDAxwJSLYFx1MDAwZvaLv4bY2VxurWkr7oVW6ap44KziXCK/nDkpjGJBaVxiSrk7U3HjLPhcdTAwMGVAeIFcdTAwMTD8t1x1MDAxYljdZv5vkZ9FdHtcdTAwMGYk/lx1MDAxY1M872GQ5HKRLkuM02PaPvhSsIyghNO3MVNoXHUwMDEzKidcdTAwMTDDV1I3342xrnyLXHUwMDA1urBYWe1cdTAwMDWYXHUwMDEx6zNf2LtcdTAwMDZcdTAwMTGwslx1MDAxNVx0XHLy3Fx1MDAwMVx1MDAwMcGRTb7yjK+v0lx1MDAxMpQvQ3LL85rXY5g9YM1cdTAwMTBKg+y4M5eWxt9++bdcdTAwMDchMDLshNxPIFx1MDAwNDpcdTAwMTG2hs7pX0ovgOqIb5hgXFyt85Dq81x1MDAwMGaxbkHTdr/hRsdl8jjJfaBZk4FXXHUwMDEwUynOJHQnsDFcdTAwMDE+X8uiQ6/PXCI+kjnyXHUwMDBiteVSfrrL+2CqXHUwMDBlw9kh+IpcZk3kz8wrXHUwMDBiNlx1MDAxMlx1MDAxZF7ubFx1MDAwMZ7F3+VQsZU3sbvD9yqizak/6Vus0rdpceDsXHUwMDE3ka9cdTAwMDRcdTAwMWFcdTAwMTD7Uo9cZozWTFZAUShcIlx1MDAxMk45frjhWLSPS/xwno/31O9cdTAwMDQ0uMzUjlCLOW/IeeJdWkN34cR04Fx1MDAxMiCMs1x1MDAxZWdcdTAwMWJmc8XE4Vx1MDAxYWxcdTAwMTag2FKlPohcdTAwMTAy/2W89Esxelx1MDAwMjrDd/6BqViUdP2SlFx1MDAxNr5k0sdcdTAwMGJeJJEs/Fx1MDAxZNH5kkpwQJ3c/EaSJ9iuba5cdTAwMTJZuNJ20XBQhVwi+kI8Ie2Ce2xcdTAwMTeOXHUwMDA3XHUwMDBlZFx1MDAxYZlXba+8XHUwMDExk85cdTAwMTFHqz5lsUuCXHUwMDE0JFhcdTAwMTd+4j3JXHUwMDE5ZNuXqJC6NiBuYVx1MDAxM+m2wVx1MDAwZVx1MDAwNoUmX1x1MDAwYrhhWYfi+lr4N3uN9lx1MDAwYlrw1qIrukpKYFx1MDAxOFx1MDAxNejRWP87Q4FB7/Cg1ef9XHLoV0ulfuyShFIgx4WjbWyYRlx1MDAwNa8sQZjGXHUwMDA1YVx1MDAwN1x1MDAwMkSvZ+7/5TxM1i2WMeZxXHUwMDAxXHUwMDEzaZNcdTAwMWQqXHRcdTAwMWKCXT0rxfCvN1x1MDAwNns5YJ+ViITlk4RcdTAwMTKMXHTn7lx1MDAxZkxcdTAwMDbXKVkuc55cdTAwMTUoz/3aUlx1MDAxZHh0MV/eatxOL4b8WHFPXHUwMDA3gnjYKb54RS81bkTAnFNPhrxbXHTPXHUwMDA0vmicqsh/z1xmrOn3uarz+Jh+6PuHbOO9TI3IfLlTXFw3o+/Mn7i5b5hcIvWHylWU8YiXst5RYJ8w/TVcdTAwMTBUwJpXUXvKsYDeRVx1MDAxZWA2rEWv7yxcdTAwMGaojMP+gJbsm52YQDJcdTAwMGbDcX72LWjVOnZonclcdTAwMDMo2cO/6XjzXHUwMDBlwXjpmH3B3odX9Hp96acy2WnrXHUwMDEwmmY4lNA5WStcdTAwMGWonWHzXHUwMDE0XGaLmajvXHUwMDAxaVx1MDAxYsE9tmipXHUwMDA1O5WbR3tbXHUwMDE00M66pLxDRDk1Z49pflx1MDAwYu/Tw+FbzzP6XHUwMDA3QZlqXHUwMDFm3Fa4qrFcdTAwMWNozVDbTFx1MDAxYXOZe+DrNHNcdPpta5RBbFx1MDAxMOrH3GFrpbk8pVx1MDAwNNpu45l8/ra+g2xcdTAwMTZF8Iir71x1MDAxYnElpFx1MDAxMVxiiT5cdTAwMTEyXHUwMDEy+OpBXHUwMDEx7vzBODbt1PCP7dODflx1MDAwZTVcdTAwMWbYXHUwMDA2U1x1MDAxY55ZsS9UXnTt1+9iOH5mvfSsLVxm4Kmhpcgr5b+95oBXWLaDrvC8gaVQn0G8KYhk3kgnMWlNXz/8XHUwMDFhksjVQK6MXHUwMDFjOPE+4ba5PjhibFx1MDAxMYiJ8TVcdTAwMDFUSU1QfYv8byuAXHUwMDFkJdDfXHUwMDExbU2s0jlccs9cdTAwMWPt2SCfrFx1MDAxZoBcdTAwMWFYc5S5zMet3nlBSoiym25foMzQ6ulLzORHXiXDL6QnwZmonLnWrFxmIa1FOX2JxJzJgEaCMDf4cYfwKK5zSkpu51PIlCPJpyMx4W1lXyrrfKKfXHUwMDE2/jtkRy84ej1PyFx1MDAwN5e+X3fd1Vx1MDAwNOQlvVx1MDAxMlx1MDAwMfzMnf9cdTAwMWK/wTJcclx1MDAxNFx1MDAwNev92b6KRUf6silPh1x1MDAxZjj5SNiALU8kf8tOU0dCX/2LXHUwMDE4Ulx1MDAxYctcdTAwMTIqXGaY/a1Gxiaf6jDc1SneKTBjIKHYRYpF/qNf3PYpXHUwMDE2d4T2zaZSXHUwMDFhNXXLnFx1MDAxOOleiO5bXFz0MKC7N0JLXFzpuOmsTs7D6nl7wJTNirZcdTAwMGZcdTAwMTNcdTAwMWG1P35cYpqxQl9cdTAwMWVKsTdcZqhcdTAwMTSGOpr9g9MtfLPLXHUwMDBlVMfGq+snQJ72UFxuuJQxTlx1MDAwNFx1MDAxZeGY1/Uz+7vpe1x1MDAwMvdZKjlcdTAwMWLKtlFv85c5P1x1MDAxYfXg3fWvR1VcXFx1MDAxMrF7Rlx1MDAwZbidhdFcdTAwMWSJjvTHhuWbUMKN9btyvPMz67Np+pLdoaq5UFxi1uJ7kLtcdTAwMDfX3LlMXFwsO/x7IytEgH9cdTAwMGZxro5cdTAwMGImUes+n2w6Y75cdTAwMDNyh19AqX/pZFx1MDAxM8xtqcrPXlgzXHUwMDE2XHUwMDEwWHmRdKdUgSONaPhBiHj3KI6W4btincakirlcdTAwMDPw8pngwmHOZK17bnOdfi/9JK3WXjBcdTAwMWWP1/xT+d2sSZpcdTAwMTfBOPpXkGMqWFx1MDAxZrpHXHUwMDA1U4Qv0iy3n0pcdTAwMTJcdTAwMTmOtsK+ZIfdJFhOg76vhCBepZ3L5Z+IVPuv8O+Zkiz9tYc6OdKrXHUwMDBl1GyW2i/DWlx1MDAxN2xChOA+qkjhza8s0lvYqn2RdFxmeUz/LdLcspqfcphNLrJcdTAwMDfAkSZ3yn/7uGVWXHUwMDFlyJJcclx1MDAwMDdxdINCjvky1rh1flx1MDAxZo8gStdgrzu8vmZ+n4CLXHUwMDE2slx1MDAxODDlhH9BPjoq/OcyPIP+ulBcdTAwMThMK0PkbFx1MDAwNlx1MDAxYoRcdTAwMTY23IWyu5mgrDPuXVxuIaGbZnPY4ljsWDhcdTAwMDOENpN3XHUwMDE5XHUwMDA2ZbDmZ+FaXHUwMDA3l+9cbtxcdTAwMWJUhH5cdNdm9opNXHUwMDEyIIk4vzaY4Cr7x0eno2NcdFx1MDAwNSlcdEJcdTAwMWO2NsyjzDbIiPPJkl8roGrViFxy34dcdTAwMGUl1Z1Rq0LNSbFcdTAwMTZ2PixJan1cdTAwMDJcdTAwMTZcdTAwMTbz2VI5+e30xt2NJrTzXGKjXHUwMDEyXl65+906oVtQfFwiXGJcdTAwMDT5dLJ06qSaI1x1MDAxNbH+QnXYgvLE/5ebh7uJLF9cdTAwMWTA6dtGeN5cYuBQUFx1MDAwMcGEP+eWZC3T0b7qRVx1MDAxZD2BXHUwMDEwX1x1MDAxNlx1MDAwN1x1MDAxMIpQn1x1MDAxMlx1MDAxMbIk0qNwuLhlWJVJ2rrXXHUwMDEwdfd1XGJLNSU2/I2UfeOBomNvXHRYrJp4qnKTXHUwMDAwSMIx/3tOXHUwMDEzM0xWQkpcdTAwMTRcdTAwMDUudfOqn7aZXCIyNUevQe+rfSVcdTAwMWVTt7VHfylcdTAwMTImMFLdRd9cdTAwMWS/5c2+M0R5s/i0hs9cdTAwMGJcdTAwMGVYj7eGf9znbFilNU6kWVx1MDAwMJShLlx1MDAxYlx1MDAxOchHYo2W5DFcdTAwMWZmdSDapyE91vuH9G1OUlc62Vpqccjrr8l4sG5cdTAwMWPpL9Mjfjnw43U++OVfrfpcImK10ZAlXHUwMDE4f1x1MDAxZLVr1fAvJPpspPyLqs/vN8/LLIAg493oW2BcIkNf6d94XHUwMDBmXHUwMDFiSInqgmVcdTAwMDXPp9fAXHUwMDAzXHUwMDBlXHUwMDEyXHUwMDFhgSmEX00n0oRWM1xyZOAxXHUwMDE0QUOiiZ/nPChXcKOAZUvU5K3Ua2U+Muhy+4OYzTdlXHUwMDE4sNpl2nq5NHNcdTAwMTJcdTAwMTFhxFXqrbJaUlx1MDAwN8hr9lI7UtDGTNLqyK5OY3Z2KKPJNpkor/ZcdTAwMTiOXHQuud3JfHCoU5OVVGBE7rF/KelcdTAwMThZ4bxcdTAwMTH9uFx1MDAwMEGG1JT8YGf34jTQXHUwMDFi7NVVLj30NatcdK5Fg3xTQOFPXFxyMdnuwFx1MDAxMVgh07jpvix7y+Lig1dd2eGUYYb8/8583HW/KkBCI7B8XHUwMDE14K5GUsDJelx1MDAxZFx1MDAxOfVcdFjJrqOBPKV8USRcdTAwMDN96Eux1ZWMolxixnmWXHUwMDA3Z5xGKCRcdTAwMTB/kGxcdTAwMGa+rEnlx1tcclx1MDAxMFYpJ2ymXHUwMDE55ehcdTAwMDWTtj18c7f50SaqP9/1R3w1XHKNdWCUkU9cdTAwMTVcdTAwMGVLXHUwMDFlf3No8mTLpSTsZFx1MDAxY4zOSFx1MDAxZpHc0kA10iiArUnfXFyYq8uRI/xcdTAwMDdalblkPt1cdTAwMDG1Y5BUPSuZuZ2i2uNcIlx1MDAwMU6FXGZcdTAwMDX8XHUwMDE2U7BcdTAwMTF+ql5FMCN20dzGsYq4LZvr54xaXHUwMDEw1H9+p7bgJeVcdTAwMWWkhCmRxMX8ME/dKNN5/0/rYM/nUnzLJprdk2dBWW9grPuibHk6XHUwMDAyipqV0lhcdTAwMDCjMVx1MDAwMIF+ie47loReUVxil1wixlx1MDAwNoaFXk1t5knM+lx1MDAwNeGruehf/azFROdBXHUwMDE4XHL459JOsUt7XjyQt3K7g0Qyasy2XHUwMDE51S9evrtfuy/MJlbwYKvPbPb3xsHTjsv4//LOZ2LiU0kyOWlvw0wsqt5cdTAwMDA7I4qzsi1cdTAwMDe0XHUwMDBiR3s+JfRcdTAwMGJllL1ELT5cdTAwMWHelu21etpcdTAwMTCjQvIvXHUwMDEzgyev115VqkQhr47P/flbyWnMrv9Uwimw9Sexhm/9fTpcdTAwMDVkjJc7ZKUkjYFAYkF7mvZRZ1x1MDAxNlx1MDAxM1x1MDAxZGP0bMB9iOf3Kd19XHUwMDE5e11uey4qyrBcdTAwMTPIy3jvXHUwMDBlj484w+5cdTAwMDCwIauO4m2ibVx1MDAwMGBcdTAwMWHe7JZxqfie4pG89ZXfXGJcdTAwMDAvXHUwMDAxX+jkjaSfpFx1MDAxOHxwXHUwMDExq0b5PqVtKm6KXHUwMDA2cGxcdTAwMDdkxVx1MDAxN2ZLXHUwMDA1llfZtrvgV1x1MDAwN8tcdTAwMWZcdTAwMTennlxyKddcdTAwMWPzXG6z5N4/eylvg6aOQeWJz3spz85cdTAwMGY4i424mGg1jD9CibtUXHUwMDExMpxcdTAwMTU8Wf3Rze5g1Du/dHucJJM8vf/Bt7il/mlcdTAwMWYlXHUwMDEwXGaV8YFkIdyEgM3h5o04XG6u/nK3anNRlf6K1Yt8XGZcdTAwMTM47FFxyd507eLPNZTxwVx1MDAxYk0pr5KiIHt8XHUwMDE5XHUwMDA2YJvkg1x1MDAwZl+YuXRcdTAwMTictuI8gGrUXHUwMDA3utK5ji2I2UigXHUwMDFkXHUwMDEy/NLGXHUwMDE5Q2X7vdXFXHUwMDA0dDP8ScnmevCCnDhcdTAwMWN7qOpdJY1Em1x1MDAxYsApa9KyVab/0Fxi3lx1MDAwN2h16ujrrMNFgS5Vo2L4tSv7g1x1MDAxYa5uZWu7XHUwMDFl89k4XHUwMDA2XHUwMDFhquLX7OhcdTAwMWIhK1x1MDAxOFxmfGa/95fUi1x1MDAxYZxZlk+AtKqys1x1MDAxMvhLXHUwMDExzuTfXHUwMDFj1WbpXHUwMDExafm3n5TN21x1MDAwZsRDRkBcdTAwMWbVLs7/209cdTAwMTFr/lx1MDAxMlx1MDAwMv2nN0ojZaiV/WVUP+Kkr6HU+He/56Kz6u83Sn73pYNcdTAwMTa/2TLIj9yBWVpcclx1MDAxMFdP6uuMXHUwMDFkPlpFpVg3wlxmfsBUgVx1MDAwMOTNvVBuSVxcizg6QDBcdFx1MDAxZqD7PCvXXHUwMDE5XHUwMDA27Fx1MDAwNi9cbqH2M7ZG3l6YXHTBxcHRVVx1MDAxZIXSZsOQXHUwMDEw9qYqRjL3eeBh5a1cdTAwMTPhsixcXKabZCmq6OZcdTAwMTb5KYFPVVx1MDAwMypcdTAwMTFXXHUwMDEyZWvXxVx1MDAwMFx1MDAwYlx1MDAwNGytelx1MDAwMnrDNctXXHUwMDA2kjzTlVx1MDAxNPqKXHUwMDFhzp0spktcdTAwMWKSfVx1MDAwNj1qzZSbzDz3slx1MDAxZIVcdTAwMTaS/9NcdTAwMTPwjGc3r2/oSFx1MDAxZNk6O9D6v1x1MDAxY+W+mclccnVanNbv+C3ROX011jx5/lx1MDAxMU+FSlImblx1MDAxNSWUm0WYw5RcdTAwMWSWYF9ZeNSa8/5pfFx1MDAwMNosaL1wZ1x1MDAxOCyb45ZTXHUwMDExo5qmzlx1MDAxM2D8lyVcdTAwMTYqo9SDIVx1MDAxNO+PObtT+vD85Vx1MDAxZkD3m4ZcdTAwMTSJcP5dx2iWXHUwMDAyRP87gLk1+mNcdTAwMTBXplx1MDAxOLSmenSghlx1MDAwZlFcdTAwMThfUDrRQapn+1x1MDAwMWjulPGa/5jSXnfQayafx/o8XHUwMDBlTaaA5Y+JNsAs2s7onU5jzFfbm/Xa9HdsIGlcdTAwMTHwymxDXqRcdTAwMDRcblx1MDAxYen6la7aaVx1MDAxZFx1MDAxMsR6b+bb31x1MDAxOErSx1upQtzEr1rrXHUwMDEy/2N58fygJnZXgf5V/etzn8tvsb6/rP9x4pyeiVYleS0uvFx1MDAwNlx093/PM1vfy9mGkqckMZ997ZC/XHUwMDAyqyGuxHhcdTAwMWT7XHUwMDAwXHUwMDE1o55cdTAwMWbp88Zn9SCxUf7gtiPWLfz7emRD3P2yvEz/8lx1MDAxMNmkzIfFasmKXHUwMDFl352AqVdjjMP5q541VtBcdTAwMWF+X1x1MDAxYotcZl5kXmOIz1x1MDAxZoFuc51rXHJcdTAwMGbdXHUwMDFkic1/KTyrjNWVcyp5ZvgpyPTpaD83f/uPhqprlWGaQmZcdTAwMDY1wtqA54tQYGAp21x1MDAxN9Q+S0TdKbfKQ7VcIk3yXHUwMDAwwlx1MDAxYyTcQbvP5Of8XHUwMDFizq2662Lxr3d3bKZfXHUwMDFhyK34Q1hqkom5gU5cdTAwMTmuazCP0v6JoaPF3ecnTbiwq0D2i4PbKWRcbuVcdTAwMDBLXHUwMDEyh1x1MDAwMzcsO61/4MqWnaqMsS/777lgy3KtxTTvqucqZOb6TYPqMbFcdTAwMTnmvcS+9mxXpf7xg7EkP2awcfBBXHUwMDFim5+zyyXzgNO8881cdTAwMDT87dlcdTAwMTZT2/xi4O67LK7ub37W2H4jP5ZcdTAwMWOCJXJkJ5jNPVwir+In7U2dc5bkNFlcdTAwMTjrfLZlPeqhzVx1MDAwN1x1MDAxZlx1MDAwMqhd1u1cIqa+sr5cdTAwMWZzVX2dXHUwMDFjWD+qd1x1MDAxM1x1MDAxYr09/4YhJWnz+esjdT6jcVx1MDAwNcohblx1MDAwMX9EVZpcdTAwMWL63aBMXGJ18iPBK239OOQ5XGahfdDFXSXiR86wMoK/TujBVFx1MDAxNlwiT8Sv3d9cdTAwMTZO7+X1c3zEr1xi6pCFXXB804flkvmO8iaTUN65zHZcdTAwMDHPk4Xbgnb6mmrjXHUwMDFl4fO9xpL2eHl2g7tQ3fxcdTAwMTM+jlx1MDAxMj782Y3YOVSSMHrjrJ7m30llKlxivWHla5FcdTAwMDadmTtcIry7UvnvI0+tbHQ+/JqwgZd64mJcdTAwMTSjq3tdXHUwMDE2bCFcdTAwMDNBy2KRI17d2EE6XHUwMDFm1jzEKsIhXHUwMDA1nS6xuNF86I9g58XnXHUwMDA2setcdTAwMDVjS1oxWTitqWCl5apcdTAwMTNLXHUwMDAzWSA+gybS4Vujrqz3Ylx1MDAwNMSsqGRcdTAwMDH8XHUwMDEw+1wiNUEjXHUwMDEwVMuHoFx1MDAxMeOUX7ywRvn0TIB+kMo8mr2OT7VcdTAwMDJJgmHtuFx1MDAxOCH4XHUwMDAzXHUwMDEy8V1tN/QgLDOHXHUwMDFjMlZ3lWEndlFIglg3cFx1MDAxZjNHbfBcXOxcdTAwMTdcdTAwMGaJp6NcdTAwMDJcdP9I5otcdTAwMGVcdTAwMDTPo7iat1wiXHUwMDE39FNcXPH+XHUwMDFj5s29Psy9e27cL/io6P97XHUwMDE2sVxuXHUwMDBlIOdBi1x1MDAxMj9xdTlM4YOAcLCrI5xPVFxuflx1MDAxNaZT87FcdTAwMWNONaJcdTAwMTOcZ0lcYlxm55tcdTAwMDB3fWZ1Zf90XHJkeILklI/10q70MOvrUJ/rOb3uelXnTUFcdTAwMTI5+a2phemGkVwiRPavK9chY+yf0+J5qSVcdTAwMDWRcFKx9t1cdTAwMWSghe2TM1x1MDAxNT/bpblKQMLIv5fFaVxy+Fxixlx1MDAxZfUqkjgulH5GurtGaTBH7ySKoX809HCXZX6z4+1B0Vx1MDAwZsFcdTAwMTZQlXlrYNyzUv8+1WCx1XzvXGJyzkdcYsPUXG5Iq/CqdTg6J+hcdTAwMDVl+npcdTAwMDLQiHDwrlx1MDAxN4tcXDzz3jHLWIT8nC9UQlx1MDAwMklIc+9jO3k9Nz8t1cM3nIfmVGCPZ+gw/YXNUFwi/aGd8n91eXKxLIg4b5xcdTAwMDT02zutkSlcdTAwMWJhZfakXHUwMDFlUFx1MDAwMFjenlVcYpIkXGaWRi9cdTAwMDZcYqtR5//H2H8syaq024Jo/z5F2e5SZuhcdTAwMDBO2W2gdVx1MDAwMFx1MDAwMYHqobVcYjSU1btcdTAwMTeROefa1+z8a9vNzpxcdTAwMTlcdTAwMTk47p9cdTAwMTjfXHUwMDE4jruDoypcdTAwMTTcwlx1MDAxNT/3XHUwMDBlk7VXz1x1MDAxOME0uc5cXGJcdTAwMDLLgrlUt9snXHUwMDE3o6Rp0NHZ0yjFe+bVXHUwMDEy1LWEcVx1MDAxY/uwa7HCyn28vKPbgSCH+bil9qqfa1x1MDAwZSVKn8fRWZtQclx1MDAwNmuslFTeu0vvjc9cdTAwMTQ9Mltb3Kl+oiaCryuNXHUwMDAx8Op0MPk5XFyEYuFmnVH+akkvsbbU2UNsXVx1MDAxN3zGw0JcdTAwMDOQ1NEynGGbz1xuT1x1MDAwZeXZKvZcZsIjfZnOy0Ofjpu6XGK5+Fx1MDAxNNpcdTAwMTVcdTAwMDaV49FcdTAwMWXlj4vE1iVVX1x1MDAxM1htXHUwMDE0wJjBx3o6dFxy26Zcbs5mXHUwMDE4LVx1MDAxM8qDdFx1MDAwYlx1MDAwN52a/1O3LZl4yPGNeVx1MDAwZSWlXHUwMDE0eXZGNIY0XG7NcVZ6xW7z7mmx4cPgczcwd6OOUlx1MDAwNE7qZEpcdTAwMGKCwWxccsxcdTAwMTNiPVX7mWRBftDPR4jmjFx1MDAxYeHTXHUwMDAzr7HXO99FXHUwMDFkfVx1MDAxY4MnwYdourfzXHUwMDFiYMv1XHUwMDAyLlx1MDAwZjSD6uTzgDds7zYuzSpcdTAwMDB7XHUwMDFk9li9boNI2NxcdTAwMDHw9yxcdTAwMTS3MzDo/DCTQObaSCEn/lx1MDAwNDCvQm1684Z+2D7ufFx1MDAxZO/vq0w65FZeiqerTSBPQ5FcIvtcdTAwMDI+lmvpIeeJ5fibwnhtY62AXHUwMDFjIVx1MDAxZqPEKVx1MDAxNOtLvFxm8iWnO4831Fx1MDAwM+yGXHUwMDBmNHMvdjU7x1x1MDAxYo9cdTAwMDV8S9nQWYJdr45cdTAwMTVMXHUwMDFlWUR/12ZcdTAwMWGU/Mh52y5eP89cdTAwMWJFmVx1MDAwN3WGiNqgf34mXHUwMDE2u+sg/41HildcdTAwMTlLxGbWo2urdKPqXHUwMDExXHUwMDAwLfgs7UrN/cWRllx1MDAwMomMVIDFUtLpSJ3qOGnAXHUwMDE5fVx1MDAwZc/FJy+COW9cdTAwMWWetFx1MDAxOZ6UL1x1MDAwZjRcdTAwMWY4XHUwMDExmlx1MDAxNzqpXHUwMDBl0OLchYhcdTAwMGVWk+BcZlxiJSr7crurmdhcdTAwMGIgXHUwMDAzhZd5KdtcdTAwMWJUyJ1cXFx1MDAwYjc86+o55rlcdTAwMWFcXJhE+lxyQt28XHUwMDA0jj8sjns6miTWM1x1MDAxYlxiXHUwMDA1XHUwMDE2X3qGKJGGZjgk8bFcZshd2Fx1MDAxOFtcIlx1MDAxYVx1MDAxMEmLxsdcdTAwMWROsFx1MDAxNnMynD9cdTAwMWHRXGJcdTAwMTm4gPDpg8eC6Vx1MDAxNjU4wYko7XPX0zfAgobyoLp98ubIXHUwMDAxNlhFm3hcdTAwMDBfR+tzXHUwMDFhonRcdTAwMTRAXHUwMDE1XHUwMDE2KsCtXHUwMDEzqSyToUruaPakr+j7w09PLVx1MDAwNDw3XFxGzlx1MDAwNUDmg5eY9Fx1MDAxMFmwKWXwq+FYWlx1MDAxMFx1MDAxOCFkd0TylCe62Kfq82xcdTAwMTVcdTAwMTXSXG5cdTAwMDHovFx1MDAwMFFcdTAwMTJcIlo6yOib85GbK1x1MDAxMrd28JBA3CZ3gYaKbKH9KvTdNE5cdTAwMWU1YFx1MDAxYlx0LUBNdlx1MDAxMpVzrFx1MDAxY31cdTAwMGVcdTAwMTVhVbpcdTAwMWRXg8RtLTGR4ErB52SSmVxmM3crZsr3yijfja/25ldt2+pcdTAwMTE4K+oh4U45iJdcdTAwMDPQXHUwMDE3wUrx/n52xtlnezTDJVx1MDAxM1x1MDAwNV5cdTAwMTSf1bufLjGKXHUwMDE3qkVcdTAwMWbPgObOitrOXHUwMDAzXHUwMDBiVs6IYVx1MDAxZYTEJuMn01OoXHUwMDE0NIlPV9cuXHUwMDFlXHUwMDAytVx1MDAwM1x1MDAxMD/z2Vx0YI7uIzdVtC+3P2s3kHqfXHUwMDEytKcuZlx1MDAxN73JfSAklqJXXG5P4+XGr4fazUe4Le9cdTAwMDOpbNhWr3XpXHUwMDFkXHUwMDEwgJpF4Fx1MDAwNNeDvDipQtp95sZcdTAwMTPbils2eD1cdTAwMTGx8mDaUJVcdTAwMGJ/Yrt1jYFZ+eCB8OBAfibItDmspSNiSmX5Q77LXHUwMDA23Fx1MDAxNmQ1NsumXHQyXHUwMDFhXHUwMDFjn3pcdTAwMDb78o6XXHUwMDA0Jlx1MDAwNE5+qSF3U4tcdTAwMDe/XHJ0XHUwMDFig7Ej9HA0uFx1MDAwMOywXHUwMDE2iGBiXGJcdTAwMTNGQ9xcdTAwMWGVRUeRwGy/81iNWqHHXHUwMDEzLSmhXHUwMDBlk1x1MDAwYrpGqMaVXSuq+XRcdTAwMDeWhtM1eFxmbtlkXHUwMDA1XHUwMDEz+Fx1MDAwN/BcdTAwMWP3REZQUFx1MDAxY5yt3Fx1MDAxY3jppKC1WeC0pf6JXGIzXHUwMDEySDErUVwi2Fx1MDAxNPtWmMWDZkNN86NcdTAwMDFcdTAwMTZ0JUk1h1x1MDAxMc/nJ2w7s3VoKSY62YVRz2qHLlx1MDAxYr1cdE26Kex5Uag83VskPCE6SViel1x1MDAxN8RnKqVy9HqjZD4pepBcdTAwMGK8rKFcXDRFNuCnXGb8ff70lFx1MDAwNMFcdTAwMWHjXHS+eaSGcfsnZ7Sm+Pssbn4lco1/XHUwMDEwZERcdTAwMTSUfVx1MDAxNdXbenDudefioGxcdTAwMWGZiYTm6cfOJXjdx/EmXHUwMDE59Vx1MDAwNPZrfiDSUVtZLcfJ27qWJ60lzGcpqUCKXkp3pzyzbGB/a8f5I/r1ISVgM9acs7j43MpcdTAwMTSc7daZf1JcdTAwMDGQYjd3w0dHXHUwMDE0prTJLa+QXCLE5Fx1MDAxY9qrXHUwMDBmOp1NPujn8FxyJY3rXHUwMDFim1xc0HlcYizbc8PyiKxuzovjXHUwMDFjb6HYsa5NXG7XXHUwMDA04S1cdTAwMWHijJt0XFyGrfaROIfD/pY7MzelnM9ZgH4ldfRUXHUwMDExrMvJrEDBsYy8PMDbw3Oi1lx1MDAwN87+XCI8XHUwMDAwKFx1MDAxZYNoKpVn5uPYbVx1MDAxNWxxKZcoT3jVhlx1MDAxZMZcdTAwMDTElTHRMfxF1Yqe7nfEW7yEiN7YrJviuY5cdTAwMDAhY1x1MDAwNzSvcvfCh8jtJlx1MDAxMXD8ute0563pP9Str8q3hlx0Z01FKzpcdTAwMGZtcrx59cOFXHUwMDBmJNaClXnK9TXErVHRI4FgWNp/n+NcdTAwMGJVkVxc8llbMTLJWDRiwmd1XHUwMDEwXHUwMDE5XHUwMDE4Tsj9XFzsq0maXHUwMDFiQEg2eKs4ZXdnjiOKRNFcdTAwMDF3ZSdcdFxcs6uvd9iEN4lMXG6oILybV+9YUqqej8CBXHUwMDBi6zkvI3y8Tqg0UcvtrFxiO1nksU7nXHUwMDFiXHUwMDAwza2NjoStxU3guMmR5mGNwzEnLKpPi3JcdPXsdF6mhVx1MDAxNzIpkWKXJ1x1MDAxNVx1MDAxYdZW8IhE7Hx8enTay7Aj87Sbok1J1HdTZY3D61W32F6lYzNEQt1cdTAwMTVAIdVcdTAwMTfYXHUwMDFkbk94SVx1MDAxNzcvtutMUd4oXHUwMDE5pb6CI1x1MDAxNCXQ/YxLQn1cdTAwMTfERKdcdTAwMDFyNVx1MDAwYtjlatJcdTAwMDD/wrN8rLW36pnHOV3BslljXHUwMDE4r6JcdTAwMTRcdTAwMTHj2kAmKbvp3NhcdTAwMWH+XfM6KDz7Xlx1MDAxOO1V67KMTZPBmvbWS4W9S5jrT1x1MDAxZsLMgidtYJ8p7fWNp2uNfklJyT9t9PPow8dazvUpJ1x1MDAwZbfi6FpcdTAwMGVV9/JcdTAwMTe5Qlx1MDAxYaGmQ0yjK6KIeZSV+VxyyXO99bpHXHUwMDFiXGZcdTAwMWbjOcU3NYvF3EJJNMprNJhQfLlx7FxyXHUwMDE3yzLrXHUwMDFhJe7MKS4zc/RmXHUwMDFhQtcg8id8vY1yjcQjefhcdTAwMTaxXHUwMDEzn2G9JHuA3i8oXHUwMDFjUkPVlSdcdTAwMTNcdTAwMThpkVx1MDAxZn5BwyqJ2lxmkOi+gj9cdTAwMWY1eOyhv2nDqecvK+DgOHhM7lx1MDAxM45cdTAwMWJcdTAwMWRTXHUwMDEyhvBJ2oMuUiiPSFx1MDAxMvtiM26as7nQ89yltVxir1Fj3XJcdTAwMGWXyq9cdTAwMDbrKFx1MDAwNUI+yrHmi5rOdlx1MDAwNyupllx1MDAwYqhcdTAwMTR4kWg3g8ZLPJeNPjr9XHUwMDEzzS5cblxcXGKb4OYqjU4lcSudxKdcdTAwMTdcdTAwMTMnvK5a+lwig4OSa3MlxcA9uuqkjVx1MDAxNFx1MDAwZvvxXHUwMDFlL1x1MDAwYlo6XHUwMDFlS5KUIf6I2UA+s6l9dzden43Yg4FR+ul5WVx1MDAwZuv7nI17v52gTSSCjtE8VHCOpun84Fvecp2c9MRcdTAwMTTT9jB5XHUwMDFlpeJcdTAwMTnMtEeO4LYlqufTXHUwMDAxvvxTXHUwMDFmIYnWPKueW1U6k9+5aNl9vW9SJX+iulx1MDAxZNXxQ4KtXHUwMDE5kFx1MDAwNVx1MDAwM0+fiPhMt7Q0nMtOXHUwMDA1q6W4PpI0XHUwMDAwIF6J4JKn6tp5Lc6f6MHgU5LqXG5cdTAwMWVh3btpmn7GwVx1MDAxZWvBwVFF4IlBtFx1MDAxZDx0ZZXN1Vx1MDAxM+o7J7xHfPNcdTAwMGK113PSXHUwMDEy6Vx1MDAxNMeyqUZcdTAwMTRfN7gzhkZcdTAwMTCBslx1MDAxY0xcdTAwMGbfxFmqx0tgXCJcdTAwMTmkuFx1MDAxZT4125+7entcdTAwMTK0NXfVb4hDNlx1MDAxOFxyelxupylcdTAwMGJcdTAwMDHcXHUwMDFhOeOdKH/qi1x0WSyfvdvwXHUwMDFksPt3qtVRXHUwMDE1m67cqeFcdTAwMGZcdTAwMWaj6Vx1MDAxZX1uXGaMhm4oxJM3VXvT3HEwUFqrmoFCok47OOmaK3eBoLVorYhuvNibNL6EME9rtnLW+aNfkDlPqi7pnSW36i2ab/DfXHUwMDE4Z1x03qBcdTAwMGJtadDd/J9dZse8duLNrrtSeuziXHUwMDEwVpXQXHUwMDE0rj8nXHUwMDEyT7Qge1x1MDAxMZXEI85s7lx1MDAxY8RcdTAwMDWApy+7RHffdHiXJ5YrKmVcYlx1MDAwNKR5iPRafexmSu95aX/Wo8qFRMtVMPjcZj1qseuJk3tLfXrkSbrUj+7mdI1umt/pVyRcdTAwMGJcIvODXHUwMDBlyfkpOrhcdTAwMGU8xVx1MDAxNpR5prhcdTAwMTdcdTAwMDCPw7nwz1x1MDAxNy2B6bWqcuDngJBcXOtgjSfzflx1MDAxNk3ov03gti5dhseLv37WQ1x1MDAwNGW/M2XYy1x1MDAxZThcdTAwMWNl8DY4XHUwMDE2LFx1MDAxNltcdTAwMGI2krJOXGZcdTAwMDHFR7KFXHUwMDFjzdykXHUwMDEwXHUwMDAxj+dOM1xmscRccuj7XHUwMDA1XHUwMDEwNFZcdTAwMWJbXHUwMDA3l1x1MDAxOTixWnhcdTAwMTDsN2Pe6Fx1MDAxY+9cdTAwMDDDVX7mkZ5WSFu3XHUwMDFj7sdcbk67uYTPtWJMxtlpjsB0jUFcXEdz41x1MDAxZEpWTeTB3umyqiOnS16CjE1cdTAwMGWO21x1MDAxZquySM7kXHUwMDAxUmetXHUwMDEyx7Zz6oB0XHUwMDBmpsG071tpcWVWrWVOrtPH+o5Lv8e1XHUwMDEyVmBcdTAwMTB6tTaad5FkxSDcptWBPD8/XHUwMDAwnqd5aFx0uWNqXHUwMDEywao92Fx1MDAwNHBom+epP3lfZlx1MDAwN/NcdTAwMDHUostcbn2tT00qRVx1MDAxMU7LXHUwMDEx7z+Un0WBllx1MDAwMllcdM9An9GTwUkwXHUwMDFl4/tUsYpuklx1MDAxZZTwXHUwMDEy1M5locfu3Vx1MDAwYkZhXHUwMDAxWSqiXoxcYnlcdTAwMWJ6zsk6bOyGLUnZPiX1ZtmIw9t0SHveXHUwMDAzkDPYXHUwMDBiXHUwMDBlMmCt5Vx1MDAwZd7C1b48XG6r3em7vp1/LT1eg/0uNdikxuWhVZN213yMRSesiUx9TCDurTGx0+1cdTAwMTnKe/pn0On1XHUwMDE4rp64lNojXHUwMDE0XHUwMDAyXHUwMDEy86/+cuq7+MpcdTAwMWY+1lx1MDAxMlVcdTAwMGVH/2bw0MZov5PP7EDvWlpIxp2Zz/ExsHlrXHUwMDE0XHUwMDFjnZh6v2u7ZitcdTAwMWRgMZd+XHUwMDEySeuWyaBcdTAwMWFcdTAwMWYveUVcdTAwMWX+kb1sWlx1MDAxYsLL0Fxi5jFdfsG3+JxcIpTzs5Zh4odZ6MA4wlx1MDAxMcrneKXkb2V0rW9tQ6Mmjsyi400shylcXGNGJHP0PN+WXGbwb1x0xYX162bJYdWu1Fx1MDAwMKOmfGigrnSy/1x1MDAxOZAzy8gqlF1cdTAwMDH8XHUwMDE42DnYc+Nm4Fxmup63IyGNcD2pr2/ud1x1MDAxZl1Jz2tcYuhb+NJcdTAwMGYqUlx1MDAxOI29yfTOccu0K7u7v5FyXHUwMDFjZc6KNsFcdTAwMTUqNOqUXHUwMDBlXGZC7rlb8Fx1MDAwMODidDzN6qOQVqBcdTAwMWGqXHUwMDE2LeVzjVx1MDAxYlwiiYMwXHUwMDE29ji3SK58OvA2vFx1MDAxY0lcbqBcdTAwMTfam8ZhxKi9N5vVXHUwMDA2IywzX224XHUwMDE2UXS7XHUwMDFlQeBIcT9wdFx1MDAwZjMnezfyXGKvcbgmzKGrq4KYuziq7T6yuj7u4rPcykxBaFZwX4Kol9t0x3e8ko96Y8uXgY3o05F3VYa1/aahQeCX84fXpPzE8Hv4yUGiXHUwMDEwjVx1MDAxNtuB/lnzrzCSauD9Xk6iLyhZMIf1rUmevp5jXHUwMDEyne/i7lx1MDAwNIgvtlx1MDAwN14+c6u2Qa+qqkObXG6AXGafXHUwMDFi562x47OOKFZcck7x10OpPlF2ZIryXHUwMDAxykXDkZ1NPNVWOGZcciwmwZFSWFx1MDAxYXxLXGKPbn1badrAXmCy2Fx1MDAxMzhhXHUwMDA1/fFcdTAwMTHnOHSbXHUwMDBmOOfOjSvXOH1s3TBcdTAwMGY/XHUwMDFjXHUwMDFje4da188kYvRcdTAwMTd/ckdgrobXfMPgXTHk77N+XHUwMDFkWTPjgdGAwj1h7vTFV9o3lFx1MDAxMMqGUq2WhTufzoLzRFxiU7LMUZbrXHUwMDA1VVEs51POXGaJz+pcdTAwMGKO8XZcdTAwMTTx7kNi6jNcbtFcXJFhwsdYU1x1MDAwMWjXy4aq6lFcdKhcdTAwMTlGXFzV7XNcdTAwMDZ7+sbG2nNMjFxyiF0sXFzEXHUwMDA02tC6aDRba/VcdTAwMDLuNlx1MDAxNeNxXHUwMDBlo3aQJ+aFXHUwMDFjZ4LqwVx1MDAwMlx1MDAwZnwzgd6H6MBcdTAwMDDaXHUwMDA2XHUwMDE2QTgw6FI8z1x1MDAwZtejM1x1MDAxMF7twlx1MDAxYbatkzHrQlx1MDAwMznL4Mw4+cbjJFx1MDAxNlufdtuN81x1MDAxM994uyGI9lxun+U0v1wi+4FEpb3XXHUwMDAxTLJH5a9QXHUwMDFk0Fx1MDAwZWaO9U7snyZOaEDG9Fx1MDAwM5YsgcyNRE5VwnFH2K9Q2GmtJVhh1J/fcjnc7Vx1MDAwNl5cdTAwMGblXHUwMDAy2Vx1MDAwNt+5/qp60ZSgmlx1MDAxMKi3wjtcdTAwMTlcXMSmmvbl8mVB6Fx1MDAxN6WqIEvRZjSfhXwnfFslwKtcdTAwMDLT1XRcdTAwMWVeZjelXHUwMDE0Wng9opkuQ1xi0X7XsunRXHUwMDE4pyDJPpZcdTAwMTQ8xK5pzTi1lEO/XHUwMDAwZc9cdTAwMWWI9uxF/zk2XHUwMDFi8H4/hFx1MDAwMlxcZkBuXHUwMDA0P2LUXHUwMDEzfrTU+DCI4m1cdTAwMGaf2Na01lxyZqO1cfUp92Z7N1m+XHKc/TxcdTAwMGJzTcFcdTAwMTaaPjnQPSVcdTAwMTOcovF75kK8XHUwMDA2c5AyXHUwMDFk3dr0I0Rccik0vVx1MDAwNdGVlNbizbRvXHUwMDBmOMhcdTAwMDG1Yae+svNmXHUwMDBmom1kjsxcdTAwMTNEvq/K61x1MDAwYoXGx6SfXHUwMDAwKi9cbpxUXHUwMDFlIEZcdTAwMTW4hqzKnJpcdTAwMDWf1PmgSDbVR/ou8eBcdTAwMDSlhVx1MDAxMOj9x5tE79HNKdFcdTAwMWRcdTAwMDFSlmnmoDRD+Vx1MDAxZqf1XCJcdTAwMDHL+VWClsFcdTAwMDHgfXo6UFx1MDAxYoH2hqNcbmRcIuesvNWnIfpcdTAwMTWfXHUwMDE1IbU/gGU873zxgZqSUFx1MDAxNHrpNOFcIsBcdTAwMDLI1FOhXHUwMDExfIB5XGLTKu095NH7MnPrXHUwMDFkofZHM679uuSbedhruV6opK7R51VcdFx1MDAxMypfhvlCpSzthIdYQjX3xFx1MDAxZZ7+VLEgtUjW4PoypijAea3AdSuXS82RNHGe13pcckJ2s5JlPkivXHUwMDBl3Fx1MDAwNFx1MDAwMvtpLCae5bU8WURp9zHycJ3Vtqrv+k/hpVx1MDAxNlx1MDAwYuNOwFx1MDAxNJ9cdTAwMGKSujZcdTAwMWbaU7ez333gk99i23t6yMxcdTAwMWJ2UFx1MDAxZHbCef9Zd4rNke+tXFzHtmvaP8zKJ8VBlbxzM4i+9mNcdCZcXIw/MJ3qyXFcdTAwMDGAXHUwMDBmKd2SPUVy9SR47U5cdTAwMWVcdTAwMTQ2Plx1MDAxZlFcdTAwMWYkpVx02zOLXHUwMDAzPHus6VXe/Fx1MDAwNmyuvDNmPz7yMe6LW5eUoElcdTAwMTNz6dbxeqIupU+0XGZCIVx1MDAxNj1I2NZcIsljyL1cdTAwMDTMZ1x1MDAwNraZnbI+XHUwMDBl3VR7REb3XHUwMDFkOdSWh4OmXG6e1lx1MDAwMzHEXlx1MDAwZXNRu1x1MDAwMF3KxFx1MDAwMeLjbLZPKKJcdTAwMDe6Wkm+6mRCVFNO14ZxRjG0PchcdTAwMWHR4GV555L7VFVcdTAwMWO5XHJIc5R33olwjtDoQ7ryXCLLN/Pm2Y6Ngo9Xha3bqFCjXHUwMDE2b8iKdLRJz/yuNDK9gn1cXFx1MDAxY821wP1cdTAwMGJMYX8jcorsP2CVxMZtvTfelWtcdTAwMDBQ2Fx1MDAxNptBbFwifETRKVx1MDAxOPFw6cb+MzLGienj1Mfyy8BcdTAwMTH+xYNPXHUwMDE0usna83Smt31cdTAwMDUgkUcgtMBcdTAwMDJ+IVx1MDAwMPhcdTAwMDBrYsX99/bgrFuMYFK9/j5cdTAwMTaLXHUwMDEy5pBcdTAwMTX5U3BRgmIn0Fxy1pzGoiihXHUwMDBlqEKVisVUUZROMVx1MDAxY3FcdTAwMTjziW5S51t7XHUwMDAyZ7YrsOApa5L/eVx1MDAwNlx1MDAxZlx0a9587tzMx2dfglx1MDAwM7yzky2tXHUwMDBm+CHZ0qTZ61hfUUd6zOd8gvquNzTqQe1A5lx1MDAxYlx1MDAxOS1cdTAwMDLyuIJxltb8XHUwMDEwf/eqwzdInLlfWG1cdTAwMTi3oXjUmMOJXm+h1cenXHUwMDAz7XtmgmbZXHUwMDFlb1a3iO1cdTAwMDOZ8uzZsEaGXHUwMDBipcFMmHTxLVx1MDAxYuuVXHUwMDFipFx1MDAxMt7VKIauN34xmqVzINqTTj6QjkdcdTAwMWUuK8XsTFCngo8w5vR0XHUwMDAx7tJcdTAwMDNAueahXHUwMDBmgsPLwlx1MDAwNzcut65cdTAwMDVcdTAwMGVcdTAwMWGirjZcdTAwMDY2dbHwXHUwMDA37d3VLPq+lEkgXHUwMDFjvnw7N2P/nVx1MDAwM9DWSVxmX+R4mSXeXHUwMDFkrHlroPurg35hXHUwMDE0hfTeQyHppY3S/lxix1jBiMQtjTQ8nkBGgphfdIWCspVcdTAwMDAyepbgjpo/bchcdTAwMDf9hMfXXHUwMDBm4tSFXHUwMDBmU43gJoeYzlNcdTAwMGa40Zt/cnJaYjRMoYY748pjXHUwMDA2lto6JVxy9FPR6Fx1MDAxM6GSiGJra33cXlxuMVHTM4N6Ni+STlDdRS1cblJOqp28ciWGcnvqqYNcdTAwMGZkmPVcdTAwMThcdTAwMThv7urXK6X0xqnLTVx1MDAxN2n9yI79kLNcdTAwMTK4815uXHUwMDEz8f1cdTAwMWFcdTAwMDTQ19eeXHUwMDFmY1xyXHLL8ntcdTAwMTjDrSdcdTAwMDL/8djUKdl0U3BVwlvth2tin/BOenZETWatQIgqWEycXHUwMDA1z73QXGZ/JGRN6lbhXHUwMDBmVjiu6Gos3YLKXHUwMDE2XHUwMDFhXHUwMDAw4HRcdTAwMTaHYOTTJ11PXHUwMDFkZFx1MDAxMrikIJFUPlu9pOhdVVxcmE8+XHUwMDE0XHUwMDA3XHUwMDE0XHUwMDExYkSmtb+A8VZcdTAwMWJGKbhcdTAwMTaHwedcXPlcdTAwMGWwlCuFwu6qgi62IMqk9NClL5i5d6NvUVRJn8KgfFx1MDAwZsSus1x1MDAxMeRzrddcdTAwMWHL/pnD1Kb67je1XHUwMDEyi1p9N/O4xlx1MDAwMyCyVv5cdTAwMTB0XHUwMDE5XcfzPJ9p78OrtL5ePrJWwkI35c3v3lsxYVx1MDAwNpaY089cdTAwMWOXXHUwMDEwrqXCXHUwMDA2/Fnxe3U+j1x1MDAxNXzO4ZqchTTl9eK7L7+wmSwhf9ayoa6bYr1AfcBHXCKk3WqneW3XL8fxYtOyJFx1MDAxY15cdTAwMWQqvVx0elBcdTAwMTXJXG5SjeX3LsImguDo7PC5eqXbPFxyfuCpv/VcdTAwMTPgrLCiXHUwMDAynlx1MDAxN1Dtm77a5FXJXHLQvGHej8R5qrA6XHUwMDBlSeFR+rvrQqjH95Qk+MaWXHUwMDE3aUv2XHUwMDBiftWQeHBcYoUovoGYY1x1MDAwZn3f+Vx1MDAxZNfCky+6V9X1/ptQzSZvrnVOe5gwweVFRSSdKyzDpF2DLqtcdTAwMTSX0Fx1MDAxMS9d5K+hSWnQPMBcdTAwMDFcclx1MDAxZShfWqZcdTAwMGZcdTAwMTaRNlx1MDAwMpDUmYxcdTAwMTBMn117+dSYg3C7XHUwMDA2R8JKmlx1MDAxM5vgld1uY1FGs1x1MDAxMMGjXHUwMDFiRnbpkmFOWiNkXHUwMDFiXHUwMDE4PTedj6nM2ddT/Oj7s1xugUyIalDneFx1MDAwNdJcdTAwMDJljlSEcvBkL/Fhi95cdTAwMTNPPFx1MDAxZYyHQluS5sO5OZtccr6elaOejuBkXHUwMDFib1x1MDAxNFx1MDAxNeKHXHUwMDEx8oGgaz7Aq1x1MDAxMFx087qSgXpNoD1Yifr0XHUwMDEyXHUwMDE2p0jq6so371x1MDAxOWSsXHUwMDEzXHUwMDA3z1x1MDAwMChFM5lcdTAwMGW6zZQ/yTJSq85rYn6jPeNTjXuCb2g3etpaeaeb5O+UkvjvXHUwMDE0pqa5qf6R04lcdTAwMWKeYMujXCLxIcRg9NNcdTAwMWU7p0l5XHUwMDAxN33Qs4KMIM5B34zjyVx1MDAwM7RcdTAwMTBjXHUwMDFjpYE9g/Co5DaoY0P1OkFS2lx1MDAwNWKKK1x1MDAxZHLMJaW5+SStPnxcdTAwMTn7aoL654CTwVx1MDAxYaN4VqSf9X8ubjvbs1C/XHUwMDE4muxOJFx1MDAwNVx1MDAxOah71Ek8xehcdTAwMDPtKl/I3Pc8llx1MDAwNO511XdAXubiXHUwMDA2YW5Npd7C3lx1MDAwMi9cdTAwMWJfu9Xvve/Ze8LrbedIXHUwMDBm51CQ6I9cdTAwMTVK9d2Hu4tcdTAwMDBcdTAwMWQ75lXwXHUwMDA141x1MDAxZkFytVhcdTAwMTKsiFx1MDAxYYDuU6JPl1xc2HZKmefVJYZ06sL8+ohVbjWOtFReReEpyMD2xpzPXHUwMDFhPFx1MDAwMt2HU0PPf/bmXHUwMDEwI5G66NMjzLjA82N6mFx1MDAxZlx1MDAxMl5cdTAwMDfjrtxuKj3SqMKXdVx1MDAwMm6GkFx1MDAxM/1SR7lcdTAwMGJ1XHUwMDFiJNfS9b7lKkfRe80ta1xmSSfHXHUwMDE5XHUwMDBirD2er1nxXCJcXFxmqGmFZ0GrfMH3oFx1MDAwMVx1MDAxY1x1MDAxYz8l/aa6MlhCgnf2XHUwMDE0UlvEaqtkL+gzXHUwMDEz+HZpN1x1MDAxME5cdTAwMDQzin/WSpv0XHUwMDFiXHUwMDE3Wf2UhuVRllx1MDAwMjtcdTAwMWNlwnqs+Vr3jFxcc3rTXHUwMDFiXG5Cg6drVHtlXHUwMDE2a1x1MDAxNy2N41x1MDAxNKdcIlx1MDAwM1x1MDAxY1x1MDAxME9hK2iJ/Zy2eozrZSZcdTAwMWSKnZm7WtisPCGt9pBBXHUwMDE1zGRcdTAwMTCgQlx1MDAxZCyYyuzAJ1xcSijgLi14SmBDgVx1MDAwMVx1MDAwNsvstCaZLy5PKIVcXPohZKCdQetjPcFn/7CJ+ksncy72XHUwMDA2u6izXHUwMDE1mvitWItcdTAwMDCF1fBqyrlJ42S2yFx1MDAxZdzHJHuuXG5cZnpcdTAwMTDa2Fx1MDAwNUlK2E12isLZKLHpwFx1MDAxYnFmXHUwMDFmN5+3XHUwMDAwedyA6qRbz1x1MDAxYlwiun2kWcBbkiQyY/iztpnT6dTMrnlcdTAwMGVvZii8TVx1MDAwMzTTKbAplZDpSTNcdTAwMWUp3T5mTocxhYf3XHUwMDE1XHUwMDAwXHUwMDFlV1xiurhcdTAwMTCrXHUwMDBlwfGEljhhvUbO/k5cdTAwMDJqd5/vZH5ZXVDpX/27M0ol51x1MDAxM3FjdDTWXHUwMDEw0PZcdTAwMWTD2ZdVvrWGR+U8UFx1MDAwMpziOMlg9ILKWlSp3EplNZtL7JWJkUM7suDWhsJcbp9SIY3bs8mP4yUx5s2Wz7PBcJ+uLS3ZqW1frtdcdTAwMWKiUJejhnlcdTAwMWI55WB2o/h87iRcZiZcdTAwMWPI3qY/8ePErnDdgJrfW0Wqi1SVip17XHUwMDA1iJ1KWbD6nNwoXHUwMDA0U4P1y8KGUEFSXHUwMDA3XHUwMDE4XHUwMDAxV1EnOfK2XGKs9tdVxFx1MDAwNTtusVp86nOFJNokXHUwMDE5bqGsz1x1MDAwNVx1MDAxZN9zJqSUI1x1MDAxNlwiT1x1MDAxZSflydtcdTAwMDC7NnVcdTAwMDBcdTAwMDXGnfFcdTAwMTadXHUwMDE3RvvrVe41r72rW47dRFx1MDAxNFx1MDAxMFx1MDAxYfLDrf5Gulx1MDAwYllcdTAwMTA0sUosMc6xh1x1MDAxMK8x/UhqZ+P2a75awq7eXHUwMDEyhypX5nqDXHUwMDEzfM+0eWtvXqhcdTAwMWKjP5WYjVx1MDAxNlx1MDAwNKyco6Ar3ZnSXHLFWJGHXHUwMDE4Ulx1MDAxZVx1MDAxOE7trfZlJ0F6SXt78E/oneY9X6d0Jr50ZrZ0NVx1MDAwZeWzY3mIx6qA59TWfGNcdTAwMDXera1eb1x1MDAxZn1cdTAwMTk30uFcdTAwMWZFwVx1MDAxZlxyS3tB1Fx1MDAwMlxyXHSJgk6bgq/2xVx1MDAwNKFcdTAwMTRDsemAtMBcXNk3sZtnN1x1MDAwM72c20KClqFW2ZpH1jOQXHUwMDEy7ad6XHSg4sVcdTAwMTRCXHUwMDE0mYbMXGYjSLbdWJddyvou9ptcXDJP47hp8OE320RcdTAwMDdcdTAwMDLPXHUwMDA170adg5Vh5O3Ab5h07yiDXHUwMDFmvDxW+fh9XGZUT35cZridQm7+TdHNrPCeplx1MDAxZjZAMS1cbsWJ12iWQFHkXHUwMDBm/NXuXHUwMDEwrVlcdTAwMGWZXHUwMDAwWFx1MDAwNnJcdTAwMGI82qVcdTAwMTRcdTAwMTHwqW454k873M65XHUwMDEzMdqe13zX6HPbSFx1MDAxY5RcdTAwMDZcclx1MDAxOHbMZiWE3FvffX0oYTpJXHUwMDEwjmJ+bjV7UUFUKs/vPixpr/f8XHUwMDE2lPkzjjRcYssledDuWugz0pDj4y1VSJH6IJjBXHUwMDEwzGXLb3+Xqqx4J9WLXHUwMDA2zdp5U5qn8DZnXHUwMDFjZczUU1x1MDAwYpB+ZPekf+PIoFx1MDAxMcSY7cvnltQgPdNcdTAwMDFJZ3qlvlxcwFx1MDAwMlx1MDAxZT5LlGmnLyq+RYJQXHUwMDE3XFxcdTAwMDD6XHUwMDA0XHUwMDFli4XE1rRnkVx1MDAwNtiZ/E5lXHUwMDFjXHUwMDEzlU/4+MRcdTAwMTeDXGZcdTAwMTG6XHUwMDEzos1cdTAwMDLXpbMpXHUwMDFhVMmWx0F2XHUwMDAydyVmbiTrmujFPPJcdTAwMDKwXHUwMDBlXHUwMDEw91BebPrvIUBJmLyjJa6OS9hcdTAwMDWpQFdcdTAwMTBBR3OwpitcdTAwMTLNfZjzuKiG0K3hOIqavvWf13ZcdTAwMWRdKmBcdTAwMWE+XHUwMDFlXHUwMDE4XFxb8stPu+5cdEM2/KT4XHUwMDA1c4VcdTAwMTROzbVcdTAwMDfgNtjE5P1emDZ4zbr+oNfuSiRcdTAwMDZcdTAwMTlDzPNcdTAwMTnhu6Rwe4ZcdTAwMTDRXHUwMDA25fr2XHUwMDFmjm3R3+dcdTAwMTKsMrFspeObXHK9+nJE5INJ2OXN0XE+pW7EmDxgOrKUTeaKXHUwMDE421x1MDAwN2bz7fH0935cdTAwMTcxXHUwMDBlMZFcdTAwMTBcdTAwMTBeXHUwMDAzNX/faXInXHUwMDFiWMGTlu6FSDlcdTAwMTZwg0IxXHUwMDAz+7Etd3qiN9/KdFx1MDAwMtGGpOa67+Yspn0w5Zpbgo8qXaNO0cGMV1x1MDAxODdx88QzcEv8dijnXHUwMDEypFx1MDAwMfBFbVx1MDAwMFfTcoz7plVcdTAwMTVPkofeS5E1nWaYQGhcXFx1MDAxMlLO5EH3ub+ig9hYXHUwMDBinZhz+ij0hmTVQJtcXFx1MDAxYspn1iEslT7GXHUwMDExOK1cblx1MDAxNO0nqeVcdTAwMTJtNFx1MDAxYu2XnXCMwDvbqsCgkCBIQFx1MDAxYUzD3UTIYrnMXGK6XtRz0Df6QiUy0piXnX2011x1MDAxMmLTR1q45Xe/izu033lZikZjXaLprMycW7smZ1x1MDAwMlx1MDAwMz5YPVx1MDAwMjakN1x1MDAwMcJhXFy/6oSR6GmvJ0g6Ltqbh7DvsmIjz1CQzot1vJJcdTAwMDOlS9biVV6Vjqh40W8zWJZ+9imyr1vjYSnETz3Xbu9hIfYhTb5rY1RW3oFPjHs7+lx1MDAxMetP1PlxRTchMyCRXGJBdqHUzEZTKoI4NKTbVImtb35KdSbdNUgqXHUwMDBmQCRpXHUwMDAyXHSIISN8u1x1MDAxM94v8jNcIlx1MDAwZjDKkSjsIf0xQ3aJ6PJHXHUwMDBl9uNzXHUwMDE3f4S7jmZcdTAwMDCX9vJFllx1MDAxMVxidaDJXHUwMDEw5TvdpHVcclx1MDAwNp0+a+Y67/JVud3zKbHctZDHa1RQXHUwMDE3bG5990LChTG4TTdcdTAwMTj5w6g3abWOXHUwMDA2kjSbqXRi5d9cdTAwMDBZMqVGS5b9YVx1MDAxMD6leqpeW2RcdTAwMWVdiFx1MDAxZCNVzcZcdTAwMDVpkZ1DooomaZLYKLBfylRJ7E1P+Vx1MDAxYa5e1DJMwZLhXHUwMDE3Ifm4g1x1MDAxNC+zOHnS4mCpXHUwMDBmmYud01e5jFx1MDAxOT2lUJJP3ptGx1x1MDAxZbVuflx1MDAwNVx1MDAxMeREO81cdTAwMWXgXHUwMDExZoWGPOiRRsU+JFJgnkvPXHUwMDExnNBd3lxy2F9cdTAwMGaN5lx1MDAwYtUzjGM1XHUwMDFmhkB0iXeYuvh0bNLIt1x1MDAxOcvbaCPyW1wiUilcdTAwMTXbj1x1MDAxNaVcdTAwMWI9XHUwMDAzY4BQbyvySVpehWShZNLoXHUwMDFjiPzOv59cdTAwMTjsXFxg4CqejfOI0CRdsyvZgr8/L+T2Pcc8d7DigFx1MDAxM/mYXHUwMDBlrqc7lzzW9vdwNuvveVg/e1x1MDAxNr6T53QlW/pb8cJa7Vx1MDAxNqFC98l67jeZXHUwMDEwxd9cdTAwMDNiXHUwMDA3OlOQsnfz4Tig4VVJ+u+63+/alD9nLP3MwX/3idwgjP/MUXSXISpcdTAwMTAuktxqJ+fJvr9cdTAwMWPF5dvCuL/jWXXaVtDNXHUwMDA3PmyjWf+5rVx1MDAwZkezrd02Uyqex1xmVpZcdTAwMGLhwP6g65uUh6NqfPds0Vx1MDAwN11cdTAwMWOD/nLeK9V4ZSRr7H9s63fMNfaKmKq0T9RcdTAwMTJy3evQPj5jXHUwMDExXHUwMDA2oY9nfvdwiEWrc3FcIlXq02mRmpJcdTAwMDes3eXf7X//e1x1MDAxZlx1MDAxZqNC/+ydc8wqrk1cdTAwMWT3stVw/HHSPolst1x1MDAxMStYUmE/6HyCqnlcdTAwMWR79szXWZVcdTAwMWbvMZjL4D/44ecsWu6+zlx1MDAwNlx1MDAxYeNth1HsiXk7Vaa0RIU+XHUwMDAz1ofxqpzeWWNcdTAwMTZC7VImXHUwMDBmgv3P8lx1MDAxZcn/3Nad6yW/XHUwMDE2xmDPeVx1MDAxM/85e1x1MDAwMeIsevY7yPLpRqZ3ad+3XHUwMDBlaClu5cvy3+xWyIVNy3ewWbglXHUwMDFm45pcdTAwMDH0XHUwMDAwr3dthXn5lvjl71x1MDAxYSVP/+jnnqCvR/7sm1x1MDAxYi6a5F9tV/KMxaijcUpcdTAwMWGzKN/5JFx1MDAxNlp3blx1MDAxNlx1MDAxOGuo7JvP0uyDdWxOLiCwd5bD43HsX9v66lxyZaTd7yGO1atGivxcdTAwMTlcdTAwMTn1g8dcdTAwMTiuwIKOXGZedP9cdTAwMTKKwiRcdTAwMDPVeSWgXHUwMDEx4TJcdTAwMTD7Xlx1MDAwNtvTv475VrSy+Fx1MDAxMWLlISZEZXOnv+Eqw55cdTAwMWb5XHUwMDEzWVx1MDAxNSN+JPrJU05BXHUwMDAx+lxuJlx1MDAwZnGF3/jrLVx1MDAxN/+5fzytufaHfZTRXHUwMDAxPPrv2SeemFx1MDAxY0/6St9cdTAwMGY+VFFeLVx1MDAwNrpxUFqyx9YrXHUwMDFma6SdTfdvbSnsoGJcbizbXHUwMDE2nlx1MDAxMMU/88BTXHUwMDEx7k9cdTAwMDE2o+ctXHUwMDE26aHEaNkzfIuH53+125s/i/COXHUwMDBmvyH0UHRmhWd8eik9/ba5tr8+5Ztl2Fingb5B+Fx1MDAxY86nl9Wm1v9cdTAwMWVcdTAwMWa/cfeiiZc4aLY45SghXvNpQsVwoy7tR1x1MDAxZKiOrFxcYszKtFx1MDAxNpdfxvdcdTAwMTBnXHUwMDA09jRcdTAwMWNcdTAwMTfe6X+MXfZvXHUwMDE3b9Ine/PyuTVcdTAwMTS4XHUwMDA3l7+jN1x1MDAwM56wyp3Lt1xm8UjRktL7LV5hQSRutYrFavV/znP573b+jl8tzKJ/L1xu1zprsz7RQNeis5IwYZdcdTAwMWGWe6BGNHq36Vx1MDAxOK1o91x1MDAxNpLylI9cdKODxLH8d9/e/nhcdTAwMGUyrJ3W4odsOrXrXHUwMDE5lqxcdTAwMDWIfqBcdTAwMWPvONSbb+7qRVx06Vx1MDAwMG9cdTAwMThKlTlZa7aAIDn/2k/le1x1MDAxOI0xiFx1MDAwZn7SvOard+6EXHUwMDA3zcOn35HktN/zXHUwMDE4OZntaXd8glx1MDAxNnbT5M3W3vO7XGZFiZ7/xT8/WG9ZT+guXHUwMDFiysD4JWpHVcH6NpPEOVx1MDAwNz5cdTAwMTdcXM2hg5cki31cdTAwMTfkv7Zx91e9bTiFLCx0I5mthCOpvLZzRWbxVlx1MDAxYpv8wlxiliVcdTAwMWK0XHUwMDEwTlx1MDAxZrxcIpxcdTAwMTiFXHUwMDFlxkOwXlx1MDAxNrqr/9nPv+fWMbRcdTAwMDJriL30wSvVcaTOXHUwMDAwRqez50zz+lx1MDAxNPhyw5zibliyrrFcXGeeXHUwMDAyu8BcdTAwMWaHerasXfxb/Ni8xUFcdTAwMTbPXG5TXHUwMDAxN8i49NwqXHUwMDBipkyxKG1cdTAwMWNcdTAwMTl3ZVxmLFx1MDAxNMvtbm4yofB29rMrS8qdXHUwMDAyw51X0lx1MDAwZfF/jU2MSVx1MDAxOD5WXHUwMDExS1JcdTAwMTJlyvKdQFh4Sej4zsf055zbm+rpXHUwMDFjcZgvP9hGzSNXebzufJr96KyLf81JnlbhV8PyXHUwMDEzq3Q3UYlccix4fFxiz1l50DJcbpV2XHUwMDA3O+RcdTAwMTieVW5Mw3iIpjBt6NerXHUwMDFhu2Rvw9OW5O71rzFF39BV6YU1xlx1MDAxMuuhT01cdTAwMWPKkGKUl3nATHFcdTAwMDNcdTAwMDa9U/rolOIhXHJ0XozFXHUwMDE20rvdJzpCnSR8lMq/9vlcdTAwMDczZ4dn+I7TVrYzXCLzJb+AWpXr3d1VmWHCuHAgcKhI+q6JXHUwMDA3d6FESddw6VCiXHUwMDBmuzH+/ueM0f/Q9l1cdTAwMWG+tiZ1am2OvIRcdTAwMDBcIk691Vx1MDAxYcJtOHc+4VwiU1JutTRylppy5unsMiXsMkB23oEsO6gq/8Ix/vRcdTAwMWKTb7e0RVx1MDAxYbwsqlx1MDAxZGsxvFx1MDAxYYrf5YRLTFx1MDAxMlx1MDAxN3XWXHUwMDFh1ls2sZB10lx1MDAxMlx1MDAxNGNsXHUwMDFlcDV4TrHkj2HmXHUwMDEy731yVe5/yGPFku2ZNiqzJz1u7Vx1MDAxNY2q0pPrtJWIVtjEmJJcdTAwMGVsj9d5K+FJXHUwMDFiZEj5wszD5CwyfiP6VfAv5nhmQ/FvuPtzppv5Pd+zdCTzXHI3MUSpeIa9dpq5epqNXHUwMDFmXHUwMDAyLdWjJJCiYpamXHUwMDFkcOxeYnXRbDNvmpM3XHUwMDA2VKr9rFx1MDAxNSNcclxc0f5jbv637e66wJ+mwtqAXHUwMDE0+Fx1MDAxZTGLxmeOn1X8zFKHNkBukCC5ok1LkFx1MDAwM1x1MDAxN4bnXHUwMDBlos2CsyPy9WF8KVEnr81rlorew1x1MDAwYmKd/yFv73vK/XDXsIS/tGuqXHUwMDFlytbFlLfnz+1wNIvgk4Ajalx1MDAwMDIw7jX3nymSL4FcdTAwMTNcdTAwMGXFYmYuJiaQf/Lx91x1MDAwNVx1MDAwMeWiyohNXHUwMDE5o4Hf1LVcYv4nXFy770/RL/GEOVx1MDAxMzFcdTAwMTNN/lBgmH1cdTAwMTbGXCJcdTAwMDP2zlx1MDAxOJ5cdTAwMTOVNVxmWVwim+dcImBtmllcdTAwMDDOnWCOKJjBXHUwMDFjOJxmyVwiomf6XHUwMDAwxkPu0Ot9mlnb457rgMx7+Nd7yjD9PZ9A+cSh2s9bfNSAhzyArnu/T4jH2NRiXG7laFxuK96zjnizMlx1MDAxZKMgrKswZ1x1MDAxNO4nvZZ8Ja2I4Vx1MDAxZGHQXHUwMDBl7WaHjFx1MDAxZVx1MDAxMuexPtBRztzpvcP/U3w+LeI75sdmXHUwMDE5hmh9nucxXHUwMDEwQ/F6xlx1MDAxNrSLXHJcdTAwMDP5zK3nZLiWWVx1MDAwZXtNL5aOxOJiky5OyoR90vt+g9BSeLVcbtOIOuToSdPekUlNm3CLOqKawXM6PfCa6NO0X4xcdTAwMDOaTOglW20hXHUwMDA09nC2jlB34Fx1MDAwNySIo0powkEsd2LGT1x1MDAxNJj+zKavt+9CgfI/xIhFL66BmSRTIL04yrVMUlx0/f2x367xUnE2kOX/73/9n/+f/+Pn57+SKYuWLP2v//V/wFx1MDAwNI5hXGL5wCiSXCL++XtcdTAwMWLNyytbpirb/vdv/Xzp//n97n9R+Vx1MDAwM38gj1x1MDAwNCNxXG6OXHRcdTAwMDIhMlx1MDAxMobi6IFmXHUwMDExlFx1MDAxM/dfkOjxwPC7kf/7b+td1WXOOWb3Z/9VdVGRgWNf/Hfnqu9cdTAwMWT//2/4n+vSaIneL+178fe//+ufpv+vOJqzXHUwMDA39n9WLmO8dkhcdTAwMTVvmnn/PO339+1ONM38WMq68zq4/2VAyV65n1x1MDAwZn7W6b4wOjtTNj7WN4iCd8hdpkyO6rvjXqUnnEIlNirfjC9FiVxcOrIzRZJ3RG4qflx1MDAxNFgxxKHpkmVcYvrI1vny4sd2gWl2aWlGhj1gPChcdTAwMTR+5DXhm7dcdTAwMDZcdTAwMGVcdTAwMDHCzFx1MDAwMOq6THFbljRcdTAwMDZyyiRvXHUwMDEwt2+JwisszdxcdTAwMTnQ63TycklvO1x1MDAwZVBcblx1MDAwMVx1MDAxOcRyXG66pPSFkttcdTAwMDGDTJaxXHUwMDFiman7zyU2T7PBIVx1MDAwNmGR051cXCc3XHUwMDFi+dNcdTAwMTZ701QmaPvnWlx1MDAxNSDdXHUwMDAySkzS4CGANEFcdTAwMDYhlqU7fL07ocdcInTPt4JcdTAwMDdcdTAwMDVcdTAwMTdcdTAwMTBDktswi5tyQVxy37/9edeFZdndXfx3nlx1MDAxOVx1MDAwMdn6vSc/crRO11xysT2i3rxcdTAwMTW49FwizVx1MDAxY4vN0t8qXHUwMDE3kHFS+MCF5WFNPmExfKyyX8ZUXHUwMDAxiFx1MDAxM6lMmO0yrFXQVlx1MDAwYnVcdTAwMTZcdTAwMDOn++1cdTAwMDbF+nO/kqZcdTAwMGK9b0Rpilx1MDAwMXtWXHUwMDAwXHUwMDA2xOTtKEFJzOhuXHUwMDFlm7h4x1x1MDAxN2n7hZTTNaDlXHUwMDE4wa3U7mP4ovzpm2Sr1mdcdTAwMTlcdTAwMTieXHUwMDFlI7pUvzdqZFlcdTAwMDB4srLAXHUwMDEywk9fwrzxKFx1MDAxZjjQo8zUXHUwMDEztSc8aoNcdTAwMTmdXHUwMDE2yOScgL1cdTAwMGKke9LeXHUwMDBli9hcdTAwMGJZtovbpjyrsfmJRn1A3y7gQNyg/4xBXHUwMDFlaJJ3VzZYXHUwMDAxU8dyUsNDXHUwMDAxM4j97c5629z85XNwJZGXMUCHpDjfiMO+x9ayfty0yFx1MDAxM03dlI922LRcdTAwMDBcdTAwMDH/p69fv6o0yiiEXHUwMDFhxN9cdTAwMDfi5Fx1MDAwMGK0uY89RyCJYTEv71UwszU9dG6qRH2EkEd84M/nov6O146cjlx1MDAxMfNcdTAwMDXQQ4zd/4mtd1lAhZ3t5+ZAJnnhNnVcYlx1MDAxZk2jqPLN2dYu4r1cdTAwMTOFz6n7NCxcbvhTzbx2nFx1MDAwZYr2x358x5e1XHUwMDEy0/mdQ63246df23ZWR4fpjKXYSFl4h4NLXHRqSzf4hX94vlx1MDAwMn3CXGKhzbtk18ek74N2kTXUfu1m0dpTNlmwNbtcdTAwMWGcyFxy/enkr00tWq15pdJ6XHUwMDA0UWdcXCGJ4uq5TbxcdTAwMDBhhFx1MDAwYohcdTAwMTGZ9fUq0Fx1MDAwZVxu1ECReFx1MDAwMyZR3+NcdTAwMTHGsd/f2GRox5LNUZM5jOa9uGn/9rXRJZ29gDjuXlx1MDAwYiBl3miwm3JBj3Ft5sJBcOyZ+mYlc/lbw3xcdTAwMDAsRZktfmJcbrdcblJV6JSmXHUwMDAxXHUwMDE2i4L/jtWNrFx1MDAxYm2l1nTNmeVhXHUwMDAyXHUwMDFl7t2sra4hqC2CxPLkbqPmXHUwMDE0PF5NSlx1MDAxNor6N0Zfd3uGXHUwMDFjfNvrsPj/p72+4VFcdTAwMDUvXHUwMDAw1jTQXHUwMDFj00kvdGzv1lx1MDAwNr1xvqBIyuXkfEBqXHUwMDAzIeW6jH9y1DrNnTeNr28slMNK629cZrFcdTAwMTejKZ87LXFwb1hcdTAwMDbgpID1mPOlYIBcdTAwMDE6yahTjVxuOL/5IY68VFx1MDAwZlx1MDAxMVx1MDAwMNFcdTAwMTlbmFx1MDAxYq7+9Vx1MDAwNVQndOSaXHUwMDA1ZEqalJZcdTAwMGaktV6Pl82a3HzKzWfGXHUwMDAyJnjmrNo2wy/uWC9cdTAwMDFDpH6mpVwi4DXg/Tem01s3l1tcYtbEmFx1MDAxNXXO2IVGKVxuN9JuXHUwMDAz6fQshiNCt/mC61x1MDAwM7n8iVx1MDAwZod1Llx1MDAxMkSDO35O2YeWP350XCL75DZcdTAwMDDuXHUwMDAzXHUwMDAyS996sFx1MDAxMdM7XHUwMDFhXHUwMDE1jpHprUkvbmBcXJSza+5SXFyaR/7mXHUwMDFhJUu0vD9Ck1RNQI3z/86LqnAt+1x1MDAxYzZcdTAwMTCBjco36G97n297+t2e3o18/1xi9kdnM1xiQzPMT4ytxVK8k0zzKVJcdTAwMDLbdDt15m9OWMIsh+qNWLfq1lx1MDAxOPeht4H94Z3iXHUwMDFkOKGkJrUs6JzbveK/sarttY4zJULrO18tgP3XXovM0MSm5s5cdTAwMDWdsEmGLT+wrdU18sk4NIpcdTAwMGIndz7lYZbmT/Prb5E9XHUwMDE5MUaMeqbDJlx1MDAxNlxi6G/c25FccrDHiye5x7a+XHUwMDFmt5lcdTAwMGI7eHWyscfky8fq00h6/J/Y5M9kh+D8xiTG0STc+Zs7XHUwMDEwV7BcdTAwMTUuY1xcXHUwMDE05+8oYHB/JmXhVbORU/ZkXCLhn4ZcdTAwMDF81DDK6DlcdTAwMDVcdTAwMTej2D+xme36ZT7kjOt881iPv3gsdjxfc1x1MDAxMZez/uA7gfLR3k1XaJaVOTdcdTAwMTlcdTAwMWNWV2rVpf7bJ+zk91xuRWdaKVx1MDAwNFH7XHUwMDFiXHUwMDFmslx1MDAxZNEsXHUwMDEz4tJhgMWVieKsPFx1MDAxOY+egSbY2tTEwpON/tRJkX7Tk/loXlx1MDAxMD2fWk2d7z84o8CsffCL/DzcXHUwMDA2XHUwMDA3zY9nW0xy+0+iXdh8oYCWziFV32T3p51LdmhNXHUwMDAzW4nEw2HjJX78xaxcIpT5Z+W7XHUwMDFhKMRJXHUwMDEwg++zuON9ouXFQWRpf/nFe/qNXHUwMDBmXHUwMDA1Y2UhzFx1MDAxMV7a1Su8Zf+fesrQiqWY8nzggGCT0k1cdTAwMTlcdTAwMWbch3la3Fx1MDAxZdzoYTKU9+deXHUwMDE2/TGDO8RfmFnU/8RcdTAwMWPNs2JcdTAwMWUlbso5kNRcdTAwMWWFc4hcck+3dN/OmDbLKddcdTAwMDK8XHUwMDFi/HBcdTAwMDOjoYonzSC0fIhcdTAwMDdOKV87fj8vm61Iwlx1MDAxZEhB5GKnXHUwMDExNWSxVDhao6ttXHUwMDA38+dcdTAwMDHP8W6/KvrNfF/glCi1MFx1MDAxZcbOiEemmz++/val0e/oe/Zg4WbMOd92Z2Z6a5ObzFx1MDAxZvmsrlx1MDAxNymov/39Xk+0oMonuUWBavHfvEKmm/lKmvNcdTAwMDKp4Sy8/Vx1MDAwN1fuuq9mXHUwMDA3IDpcdTAwMTh9Yd1cdTAwMGZ/KDLMXHUwMDEyVaNLXHUwMDBi9qZMRW5D3+tvXHUwMDFi0aFcdTAwMWNwm0HZa9Lm2PitXzrfsDNoPMxcXEBJxTh+2nzSXG7dPV2oeNCzVePJ/lx1MDAxYlNccs+BbHI9VYuQjps1YMPBfnPVtNldnXO5lel51Lvut1xy5nO34V13XHUwMDFi+kvEi/1cdTAwMWbs3Vx1MDAxOFPBtpvslSPyM4asIVx1MDAwYsk7QtvUXHUwMDAzboWr7nvs6O13b+903yZcdFpcdTAwMGY7nMH+4W95KWCClVx1MDAwM7yPPdyvzSRS2ZSJXHUwMDAzXHUwMDBmXHUwMDFhXHUwMDE0bmr0tVx1MDAxN2Hre11OIX0rUtvAqr958eBExlSDuT43Qp+zVPrxXHUwMDA1vTOanFlMIF/SXHUwMDEwXHUwMDE3V1eHuPiNqV2mtdpcYqCUvrNcdTAwMTfn/rtcdTAwMGZoKVx1MDAwNH3zTGvTwPRi+DFlx9NcdTAwMGY01rLXJ+Av7o5cdTAwMTl0fvzWQqjSVaJGXG5+15prVf7w01x1MDAxYiuVXCKBsLNcdTAwMDJ3kmBvfLNF+4thXHUwMDE1Vu7dX18wO71cdTAwMWFavOc0wFV4+9eOXCL7YaT41vZ5zcTife3rw0tcdTAwMDWi+1x1MDAwZlx1MDAxZCZfv7Ek6UrNXHUwMDE5uGRxNWO46z85+W7sTjF9KWjMfVwiNrpcdTAwMTGUgamYI2kvbn7IND388JBBavhj3Fx1MDAwMu7GXHUwMDA1JXOBf65cdTAwMGZcdTAwMWHHk0+/l130uLGX/5SaTC+X1CAkTdxcdTAwMWTCxOJro1fJXHUwMDA3KVxcg7tcZsWts6h/80lpXoWSx4DWYrF6x9bAPZjXIVx1MDAxY1x1MDAwZbjDhKHSlkDfscY4rLyD41x1MDAwMdFcdTAwMTiSt/0/fFW6QamipVx1MDAxODChvaVcdTAwMDf77o9cdTAwMTW8XHUwMDEw+TOjJL9yRfFDmZ8yd/dVi27/M56Bff76X6Qzxk/rntP2/Sd2OF0xXHUwMDE1M1x1MDAxMFx1MDAxM+l68n/GzdlMXHUwMDE12Fx1MDAxN43Q1fI8/H840o07XHUwMDFjQ1x1MDAwMq1cdTAwMDB3O3SPuyuQu9Y5IKKR9OdcdTAwMTdPXfa9XHUwMDBm7oHQ/C6316L9XHUwMDFkc9hcZkWCJeDZXHUwMDAwZ8FUwte3XqNcdTAwMTR8Nlx1MDAxZc9cdTAwMDWT1d9cdTAwMWNcdTAwMTPuy+emhGhcdTAwMWUwW/SfMYtcdTAwMTJP1ik4mzg+rT85gzRpYX4myIn3xf353u3/sCzE+ltcbmpcdTAwMWS1/+K4bMo13SPwXHLAJHPHhTJomER6163AVkT/4Vx1MDAwMDJ/MmxcdTAwMTBcdTAwMWT0g65eypX/zXedgeipmTLmXHUwMDEze46YWF++WEF32PNAXHRcdTAwMGLSXGJcdTAwMGW09f5+9pZcdTAwMWSu4iWLdl5roP3D2Vx1MDAxNt0rSF4wZJBcdTAwMTjgr09ZiVx1MDAxNe3jwij4o+Gee2sylV9cbuwu1XensTtwyz/8JlUmmodcdTAwMWTSNI9k+vKQbneQ4fnJ78H/YCFJlzo2/9iZ7Srg9Sc2XGa+rezuk1x1MDAxZuB+/NTtVNlo5FFcdTAwMDG9xfzg835TXHUwMDFkx4jmtGD0cvxsTfCbz1qpXHUwMDA0VfPpv4eIjaH6W0/6gC1l1fvmpeUxNk5YXFwgaEGu8L/8yL9BRjVGgvSxyC1/6kXGsUxKy1x0YDDbykI/XHUwMDFjXG7crS7dXHUwMDAzgmZj6XLT37rCMyjLneKnfcguqfzk667v8qYs21aSvzVx0Etd767vIG2fXHUwMDA1nD+xZDRSMafW+Vx1MDAwMZHNVn85Ts3HhVxmXrv0p1x1MDAxZlx1MDAwZm5lzpCguYFTmu1cdP/mrmOlhaa9SSlcdTAwMDF8kv0zzl0q5Dx85H5wvn/629/9zb397m/0vMr0N2+/Os85X2uLqO5PXHUwMDFjfW1Z3IV5SDnSiFx1MDAwM/b3Wud7LVxcfMdqXu3fa29UcE4l6vxcdTAwMDBE1fePbtRvXHUwMDAxmFxcXHUwMDA2XHUwMDBiXHUwMDEx9OdcdTAwMGXDn7wzXHUwMDEzfuxcdTAwMTneuF1K64BvN7/1/7FXsyOjxlx1MDAwMfdwXHUwMDBmKT/j61x1MDAxOJvJ/Nr9pLVg/cGbO1+Cc/mJJdV0yelcdTAwMGaPWeSNadTRXHUwMDE0QeKfe79Z+zLo+PFs/9jeUsk7Llx1MDAxYexcdTAwMWJcdTAwMTdsSG7tXHUwMDFmzt6WXGYmbFx1MDAxZSayXHUwMDAw95srQsb7XHUwMDA1yVxcQ3hhyG+9fWFW91x1MDAxY8p70IFYU7n2h5tddmZcdTAwMWRcdTAwMWKJu+xcdTAwMTN9nNX7l1x1MDAwZmH2KVxm9Fx1MDAwYjV5jWHkL37d/dSLhH77yCDtjMVcdTAwMDC9/FtcdTAwMWa6W5ZmmVx1MDAwNbYnKVxuv1x1MDAxY1x1MDAwNWjcQtxcdTAwMWakXHUwMDAy//4+3lj6qVx1MDAwMIRGvvVcdTAwMDChfrVJXHUwMDAztVx0rbFcboaD2GKrxU9OUXdOgVxuVN5cdTAwMTng/XBpnW3YN/p4SVx1MDAxNnPnbcH85fyFdcP7ZoRcdTAwMTl/88ZfXHUwMDFkxVpqQN9x75ivP3xt1Fx1MDAwYt30/G9spkGQ/Z1f6Zr3LWGojfdcdTAwMWJm+u2L3sxcdTAwMWPZs+fNl3D+82e8NU+b1HTTNTqxzODPXHUwMDFjh2OLu7zI3Vx1MDAxY4LmYF+/3230XqdcdTAwMWQj01x1MDAwZoPV2Z+kvv1CvqThcPFbQNvsMGd/cPLW4s9KbphcdTAwMWWJXHUwMDAxPefF8dYp2X6gPlx1MDAwNoO1XHUwMDA0XGJqwthm/aZcdTAwMWGAz3JUdUHJXHUwMDA0uImQXHUwMDEyXHUwMDE3T26DejREj9thXHUwMDFkicDI6m0jR3SiW2FSXHUwMDAzXHUwMDAzMYYuNdYvj5KHm7y+yFx1MDAxMWDxOdTo3uYwNcEtQtZHXHUwMDE0XHUwMDEz0eOzfVfJzJzD93iqYapfulx1MDAxYlx1MDAxYmY5XHUwMDE25q+xXHUwMDE3UFx1MDAwMWeNXFylcMJIQTdqfNoxyzGnXHUwMDFkUpuwZ15sOf0yXHUwMDE4SMpcdTAwMWYsKd3ChN9cbtl1yfi3Rmi1/GRjP9tvtIal+pT/6OO3XHUwMDEy81x1MDAwZmhcdTAwMDJcZnw2hqxIz1x1MDAxN3hObl6CXHUwMDE53eW3XHUwMDFhjG7atS1aLt1cYpfvdl5cdTAwMTOAXHUwMDBlYm59uKMvgc5OnFx1MDAwNrqX18htud3n1fN5kLSjTrzxclx1MDAwNj1FOMxcdTAwMWFcdTAwMTGzUJrJ5Szt1oBcdTAwMWbj84nqiv/NR1F26Vx1MDAxYcVcdTAwMWJcdTAwMDZiTUtcdTAwMWGCX/59h7dHT+9bvyZX5luTl+xcdTAwMDb6JpCLXGbC4yUhbYBcdTAwMDdcdTAwMDSpgv1cdTAwMDNEXHUwMDE5sXBcdTAwMGYle1x1MDAwMetgOM9FXHUwMDE2ajbXs15+MIddXFxRxab0SLVcdTAwMDCSYL3VvD/Dm28/rvFCTJ/eWfZbXHUwMDEzw1x1MDAwNincXHUwMDBiuMtcdTAwMTjjK1x1MDAxY2L80elvXHUwMDE5p0tkTpyoeMxI01x1MDAxNFxc3kCDZN5cdTAwMTloXHUwMDFlXHUwMDEwWmeNOq11bFx1MDAwNlx1MDAwMUDQM9VcZuD/y9R3rauqNO1eXHUwMDEwXHUwMDA3IJI8bHLO+YwgQYIoSrr63Tjm+v69nnU4pjZN1Vx1MDAxYqqq2+SOSX7k+E/pOtvYvLC+RaN206tcdTAwMWTlaGLmcqC0kdtcZlx1MDAxM3Zua5hs8szZ/reF/HdzkOF/eSQo8mevlNDmP1x1MDAxMe3pa069fM3FSat5NHdcdTAwMDdcdTAwMDDh3+94bc/vMXoy9o2/96aq91x1MDAwZnlbPlx1MDAwMT3tRtvWx8efsbWMlG7nmKZ0p85cdTAwMDLrO4TpTXdcdTAwMDeC7pv7jztcZvVmkW/oO6jz9ob/PDTvKLTQmnz2sNC+u4ag1tKOZMibONpKYVNcdTAwMDZcdTAwMWQ8XG7qTn8/b4Smh1x1MDAwMSqDN4HE63CVIynmXoBcdTAwMDPZ67lcdTAwMDX7q7WhsM2ut/rEc5Sr/Fx1MDAxNZdcdTAwMTNcdTAwMDBcdTAwMDFnaP7VROpM8O/AUJcne6tWk1vJWKLl+9NBSColSSz8yKjao1VdXHUwMDA2PKuRXHKzcYW6YrNPji4ktTpcdTAwMTGNy8PgNdK4YGL9p8VcYujflvLYwUVZsvg5/4urRH1cbtei0o2uym68XHUwMDBizEuPKmgnXHUwMDE1XHUwMDFiKn2ctH/fm28vTVx1MDAwYohvXc9cdTAwMTf1rDRccu6i2kX2UpCpLK7gSzRTp8+AL8sm9adWoVxmZnr+VaRcZvBPK7JcdTAwMWH7uer3XHUwMDAzXHUwMDE3Y6xOOYdcZlx1MDAxYVr8+mglXHUwMDEzylGXwIWaq/Z2vWMln97vl+O8pshcdTAwMDXygCpTO1mKjPJL50vNT59DIJOu2cckuVx1MDAxOVj151hvQ/2n5XmVXHUwMDA04cwgg2lcdTAwMGb1YYlZw7FfZsg092NPzOrcJuNJM9GrXFzdLyGCVEx5XHUwMDEx0GWHXFy0OWtMwrRcdTAwMDWk/tWlOTYrTeow4Fx1MDAxN7BcdTAwMDR/i8Gf3uZZXHUwMDA3fNE2Z1H51XdcdTAwMDK28DZmXHUwMDEzYZtj/tLsb1x1MDAxNMp3ZTNtsnHfx8JPvfb81mXh5o41n5/5aOxnWcVcdTAwMWb4qZcgYcZ/dUheWVx1MDAwMOtPXohxfeCsj06I6Wk2+rZcZsfiwGVkpftcdTAwMTVcbqdVyyorWD3EzfqX8GiNyDabP21Wglx1MDAwM/98WYy3u3hcdTAwMDL/vVsog2+WcUdcIj6C4ZtfpkPyLZRIP7H4MXDtan/D/lwiXHUwMDAzXHUwMDFmXHUwMDE1dCbOtpdcdTAwMTC2rGV//n1mXG7o/feZy1x1MDAxME/C32fqUPNcbnaBtrdZekp1bKlItFx1MDAxN9PhJ1xmKFx1MDAwNSeLt1x1MDAxMaPAm6eXUtkyXHUwMDExqT+b3CE/f8BcdTAwMTbqTZOtsuYxmFx0cv/P/y2NTEhCZSmI8lxmZYGzd7GSu3B8borDl6KSMni+x7NcdTAwMWbOxthcdTAwMTnoa9xFXHUwMDE4XHUwMDA0v5jG2lx1MDAwMKDU91l1V9K5pfXfOzLZN4AuXHUwMDA3vVx1MDAxOEVcdFx1MDAxMPhebcW2XHUwMDE5pvyS5GbsXHUwMDBmimuCem2675w0Z348vCNcdTAwMTiEQmNeQVx1MDAwNo3aWHypeVxipOZcXFx1MDAxYt/Iz/P3XeD70sOa+c/7nDVFXHTFhILGL8nFy5z+XHUwMDFlVb7hMGVLvY+3NUndu3ZHbcSqrt37W2uGK4cy1dT/alx1MDAxM/qTV2QkNFx1MDAxZKu2yfWW/bdukINxqPavuuXI1ST8TVx1MDAxYuE6zVxuMS05jfqZwVx1MDAwN+rZs1x1MDAxY9XI/cgr98/3ali4VFNs47dcdTAwMWZuVTgnXHUwMDE4amP1qdBcdTAwMTSZ2Xr7kF3n/+rdifBcdTAwMTSYhr6wXHS9uq/jjFx1MDAxZjczUCHF5dCv1Vx0se6TxCDN/YGK2aNcdTAwMTbi2ZxcZmhcdTAwMGJ+XmXARkxDKbIww4WgP8X/PJHmqz7I9WP1aKJcdH1Hj1x1MDAwNfyjL+BqXHUwMDE1sqBdYoW7XHUwMDA3KlxiX76dXHUwMDFjbUk8ZKIlrzaddlZcdTAwMWb1bn0gdEp6Zz1FfUrouDeItzTXXHUwMDAy/K9cdTAwMGXrXGbQL+DxaMzHXHUwMDA3+3J95Kx6pUCgYow+L5VcdFwiXHUwMDE2i8A97vLVOm8na9d45snPrP78mZnAfS5cYrjPXHUwMDEwyov6v1x1MDAxY97AaK/dXHUwMDBirUNcXFxyXHUwMDFmXHUwMDE4XHUwMDFitVx1MDAwNqROcnyjxI1iglx1MDAxNYNal1xcZ+uwTCaNXHUwMDAwXHUwMDFlOWyejvJ3nVB3Pj1cdTAwMTM0NFx1MDAxOFx1MDAxM7lQMznu+3mP/mkmVUhbf8lcdTAwMTHtw8BcdTAwMDB/XG5cdTAwMDZS3Lhcbu9cdTAwMTlEaon7p1x1MDAxYyWl/1x1MDAxMpqXXHUwMDEz/N4ou8HjosMrOuDIW1x1MDAxZP78u1x1MDAxNlxiSN99rJWnvLJ8/NWbeHBcdTAwMDejsSXESFx1MDAxNOs0XXiRUzd57MP1zIO6YlxcT6qcNd4v8puIXozg3DlkjFxc8PN7leNT8Fx1MDAwMWlgv7RcdTAwMGJh/vloXHUwMDAzXHUwMDEwnOZv1arTaViTjTdJXHUwMDA0eOxcdTAwMGJwR1x1MDAxNnBiN0PtXHUwMDFlXHUwMDFlRnmpRFx1MDAxYj5cdTAwMGL0XVx1MDAxMbm59M+b5J7lyMw7XHUwMDA1JajQ/jxn84fx6lx1MDAxNdj2XHUwMDAxv2FNw3egpGp8PezKTra6vPbXN967JnPcuXdysdfsjbImzWrpXHToipexXHUwMDE2a38qXHUwMDExilhcdTAwMDSg+fqvPrJ6q34wqe3D1IF5pq7cVcC3aVxcfEqAXHUwMDFjQHBcdTAwMWZaXHUwMDFld1SWoU5bakiUPty0ikFbXGbGZ51cYlx1MDAxZWVX6uncTFxcsvX1z0tcdTAwMTi7sdo31KCgXHUwMDFhnHrvwolcdTAwMWI/slU705xcdTAwMDdBVrlcdTAwMWGIfn1erqvbq85LpqBGeZRqPmG0cHv/+js1pGzkXHUwMDAxtf7NRVb1v1x1MDAxZWbiuPtlf/Pop6Rwu7pcdTAwMTVny7NrXHUwMDA1XHUwMDExXHUwMDEx3rOqg1x1MDAxMPTMWJtzc0eF14NcdTAwMTGM51X7ODxcdTAwMDVcdTAwMDHg4VxyQGHtXHT1XHUwMDFlM0QsNDGwv5rrXG5cZkFcdTAwMWP0I1Y3cm28l6BcYlx1MDAxOPIp6oNcZlx1MDAxM7hp8a/WpmX+1Xy9wfVVuFx1MDAxYq8oq1CyXHUwMDE1UHSZ5EGNdYbCK2VcclxmoGvjfzU3dFOTxkZOj55N2SRcdTAwMTL8XCJ4d1x1MDAwM11RNFxyWUjhiXxY5VNChGy+d7c6r6n0ZPizOIdJXHUwMDBlVzPNl2WgXHUwMDAygjv/r+asXHUwMDEwx+3YXHUwMDE3KzGkMYB5KX9waJXV79Z1XHUwMDFjyomHVOc21DdcdTAwMTiorZYvv1nC/bwq9FdcZlx1MDAwYrpcdTAwMGZcZjiWh1x1MDAwMO/8tNa0drNzx5bNQMVXk7Et0fpE2aff9GKqXHRcXNZSk+6Fsa+EXHUwMDFi5vBvV0u8P8jgxP5cdTAwMDR6fTWvK5DwUGL8/Fx1MDAxYaSyXHUwMDFjdOKvXHUwMDA2gr+j2rdUg9Rn5YIqWstcblU9pdfnVHZcdTAwMThQbDfJXHUwMDExkZj/ra0rOGCca+N4Z+yS39rYte+C7F0kIdXX12iJv7HP5TW51Fx1MDAwNrRpe1x1MDAwNv1cdTAwMWSfWr5KJzD9i8X+XHUwMDFjx1x1MDAwNd+U959cdTAwMWZ0JLHsrFqQ3Ntj/eHRXHUwMDE3+tAse+VsdYt+8SjvuiV3XHUwMDE4fsGhx9Z5ZVx1MDAwNKp6g2aI+IT02jLv+C4zXX3mMOCcY1x1MDAwZaF25MF+UX/a0XckR7OfWU5cdTAwMTY2XHUwMDEzeH1cdTAwMDTDflx1MDAxNHBHz1x1MDAxMXDnpMeLLYW8XHUwMDE34pTnb1pcdTAwMGK0jy+SXGJ2/sJ3XHUwMDFkJa4kbpm1XHUwMDAyabs9j389KK4uSm93lrXtXHUwMDFmIVxcXHUwMDBiV4SUSp88XHUwMDA27YAsSFx1MDAwZZrzL9lcdTAwMTFlUHnWXHUwMDE03GFcdTAwMGVcdTAwMDGFt8F8xpygZ+O/2utcdTAwMGU6pK7e4zGSqlx1MDAxOSZcdTAwMGYwR37KP5ZCqtuXrFxidte26HPzXuzq3o+H7EnB98fBalx1MDAwM5JUSGhcdTAwMDA5XHUwMDAyv5o/j5RxXGLbZ00mL/HYYCRcdTAwMTBNM95147HUzJtcdTAwMGKdjmFvXHUwMDFjnbhobcZcdTAwMDF3d1Wgf0zUXHUwMDA3P28tsVx1MDAxY1untMQ/OZZY0u6HNeKkKmC5TZWExtznfUE2LY1cdTAwMWaXXHUwMDE3NXCPmKlfplwizC0p0v1WhcfUXHUwMDE3jNY7eHQnZ+fycjzKl7i1zFx1MDAwYj7ROcZO51+OfVx1MDAxYVEh0Fx1MDAxYqNNoYz20tOpXHUwMDFkS2XmL1wiUzPkelx1MDAwMYxMn7Lkozzu/dC82CbuyXFJ2V9cdTAwMWS2VFx1MDAwNLY5LIiHLEBL7N9cdTAwMWFcdTAwMDXCXHUwMDFhXHUwMDAzMlJnYmOULXbWe3QwXHUwMDAwXHUwMDEzLo+ZvXrV+n1rqUWAi29cdTAwMTOu/FfjuNSYcb9cdTAwMDKcdzZcdTAwMWWvft5cIk4gP+ShXHUwMDA1mKVcdTAwMGWDXHUwMDBmmJja71x1MDAxM/agt5c5XHUwMDA1gtRVNbb7VrDPz1x1MDAwYusobyN8XHUwMDFi2Ev/6YAuUHl+j6A/412EUH89XHUwMDE537uvujWteU9cdTAwMTSnhqzqpKhy4NWqXHTluKuLxXVxXHUwMDE1kXkjg1x1MDAwM5LHicHz7qxcYoue/T+CnEj3VzdSXHL1LeTE1e6rh6iHylx1MDAxYixFSZm942eOXHUwMDA1XHUwMDA2bZKlXHUwMDE3/kmApGjcbKfTwlLx/mS5yvNXlrNyp1x1MDAwMoLG0t4v51x1MDAxNVOFT1tMiDjTdVx1MDAwMPlNIFx1MDAwNLPDnflccvlLdVTiW1xmXFyuwdV8XHUwMDA3z+zHSCpE0tag7n0oNjDkbFx1MDAwMzhILjw+/vWBXHUwMDEyd1x1MDAxN1x1MDAwZs8ghptcImZcdTAwMTdO32Ook2s1XHUwMDExcOHT5t6CXHUwMDE1L6bzcZnedTRcbk+ckNfOIEtcdTAwMTZcdTAwMDdgXHUwMDE1v/s9/Fx1MDAxNZO4msuqXHJtXHUwMDE5/0guMDftr1qsbCRcZvW7jr/PSMm2XHR3fT9RgfzCXGJ6d+8kNp91a0RoXHUwMDFl1nrHgFx1MDAwNMjrcT43xFx1MDAxM7hruFwiPb6ouVx1MDAxMCzmNGlcdTAwMTKjXHUwMDFm0lx1MDAxYytqhV464SRHXFxcdTAwMDNzfuNFRelcdTAwMDW3mX+9sacrsUp0h4nOqoS/z7/PXHUwMDAy52d9jSvjb5BrJWdb0O+miyxcdTAwMGL8XHUwMDEwYkrKjWyf4u9cdTAwMWMhpu+1+vD3zjn7PS9cdTAwMTb6ilxi8lbTxXdcdTAwMDabTt56+lx1MDAxMetcdTAwMTNcdTAwMTPOkVA78E9pblVafl7xwW89XHUwMDFm/puatWiIbJ+H6XechGr7N+f++i5sk3HnZz3zu/DTgMrT21neXHKYbnSZqFx1MDAwZVklq3a09nc52SNWb1x1MDAxNGLEXlVjxlx1MDAwMlx1MDAxNznZqswj+lCrc4boplSAUchcdTAwMTfL8NBff4Y/njprO9Ezx0GOYuA52YvCPN6MmsH9klx1MDAwMo6m+P2DXHUwMDFil8LRcr9a+6VTTlxm1GtPuF9cdTAwMDBcdTAwMDWUQr9e2F+/W1x1MDAxM8pWso3qYeXcy9k5XHUwMDEz3XC1ONxcYv49VedcZiBEM/HTXHJaXHUwMDA3cDcrKUacp+ppfMwqKWnz536NVfGnc6GvXHUwMDA3oct31kGQoeyoXHUwMDEzalx1MDAxNVCbV1FcdTAwMWI5XHUwMDFl5JTSUUmkqGInOCBcdTAwMTDrqlx1MDAxMDe/2mH9XHUwMDA1nnRcdTAwMWYhNiqZdiX/tJ0mXGK1w3w+qHqHXHUwMDE2l1FcdTAwMGK/rNI7ZCl2/s0pXHUwMDE4ilx0ppqfLdzOk0FcdTAwMTGMeqqT123NT/1pXHUwMDE0QjPOhLVy0n5Djp/+bGq89lbomZ2m4lx1MDAxOeC0Ulx1MDAwZnXD51x1MDAxZdA/7XbnPPatVNtcdTAwMTcrXHUwMDExXHUwMDFjQVxm5872XHR6XHUwMDE08vlsXHUwMDBiNlx1MDAxOJb/QFxicdmhKMH+3mminDWHL20nN0avRVYpSaEvUfqQhORvjZBxXHUwMDA3lzqu2I7QdClBXHUwMDExp9lcdTAwMTeCPTVyXCLUcI2XzEZcdTAwMWRcdTAwMTNZJ6L6q8nySlx1MDAwZejpwFxm5CBAI2hUve850f/1/tz27kCQRuVcdTAwMTGLq+Ppg47gXHUwMDA3XGJmXHUwMDBijCHgXG5cdDKMXGbBV5hcdTAwMDez9b/5sFx1MDAxOZSjXHJaWno4XHUwMDBl91x1MDAxZKvU7ISRsM469Wo+JVx1MDAwM3yakTavXHUwMDA1gVx1MDAwYsJlvCaXKzGd8vBh8Kt/XHUwMDBls9ncUjvdv7qEXHUwMDBlvseYbjT3cj1cdTAwMTgrt4O06Vukm6by5He2w1x1MDAxYUJccvNcdTAwMDd8zujLUNJvXHUwMDBmpJpjXHUwMDBicmQxjm1xIPxbVztz1Wi5XHUwMDFj1DHuV8HoLyrewFnfrZPO3blcdTAwMTbUe4V3M70sLlx1MDAxMM7DUc3Zmzj9laGRNOCeXHUwMDA1XHUwMDFiXHUwMDFif/1jXHUwMDFlZXla0Fx1MDAxY1x1MDAxYZxcdTAwMWErXCLaw35cdTAwMTPOb48hIT++bo8y7lx1MDAwYlx1MDAwNTC6XHUwMDA3nrnT3/HUXHUwMDE30Gf2j0GQXHUwMDFkZdRcdTAwMTPwN7tUedGqY1UlUZ+MlYjhqHPCOPt4iqxcbnRb9njqXHUwMDA26/Pi18pcIn1LhG6TXHUwMDEzt1xyR8F43Fx1MDAxMVx1MDAxZOJ4Jc7fXGZcdTAwMWNcbvVPXHUwMDAxrlxmeF2eQt7yVotcbvZp59iT22SjIFx1MDAwNmreuqJWVrbg5JR5m5tcdTAwMGXeWFx1MDAxM1jOXHUwMDEzao7g6/LSvzrAXHUwMDAzLH3dkzFyvY1cdTAwMGbi+lwiXq5NsERcdHlcdTAwMTlcdTAwMTnPWVx1MDAxN5irZlx1MDAxZM3kIfXJI0FcdTAwMDHxPXDxnHuE9CtkzX72XHUwMDAwX/2qXHUwMDE22F/tQ05cdTAwMDRcZn1cdTAwMWLPy5e6WZQrU43EUkdvybN84bCzJjFi/Vxm3MW/XHUwMDE0XHUwMDE0gVx1MDAwZabCRzGuvCOlXHUwMDAxg9fgQPVIXHUwMDExZL9cdTAwMWVcdTAwMWJcdTAwMDZj/OSCvrVubFx1MDAwNvdNI1x1MDAxZf6XZmKMmv56MFx1MDAwNtFgNlwiZcsmnNdcdTAwMTjb8odcbolT91x1MDAwNVxc6ZJfXHUwMDE3XHUwMDAzZUaJ3r8+QFx1MDAxZvDINFwibo2cd7RiXFxcdTAwMDUpalhq7excdTAwMWTUXHUwMDE14XxVlCdcdTAwMDembtynXGb8XHUwMDE5bLWsxp7vXGKrJvKTYrdE3EpC8FeX51JcdTAwMTWq2Ht5+HchusN9XHUwMDEzflx1MDAwM65e4LKh9lvrcHzexO1SX0aGZ0JJgJ/eMlx1MDAxY6ST1/FcdTAwMTSYsVrta9z2XHUwMDAytfOnL//T5iOYXHUwMDAyK19LMGVQXHUwMDFk1X/1XHUwMDAzheQl9FwiMaX8nbNGVlxuy720slx1MDAxM4Yz1lx1MDAxONzNNS7XR5W6UyBTsfGdr5Mkklx1MDAxNHF87It+by2Uu53zq7q5hi/b1tQtxO30XHUwMDEwXHUwMDFiIL1lj6hcIlx1MDAxNJD4sVMp7ZM2O/RcdTAwMTjLczDyKffjv4pPI/15V1+d4Fx1MDAxYVx1MDAwZYnZ51x1MDAwNFx1MDAxNZT35COuSlx1MDAxY4zpXHUwMDFjaVg4qq2ajFxcuC/bvFj3XHUwMDA2rXhcdTAwMGLhw+JOU1x1MDAwMbNcdTAwMDVIfIfWXHUwMDE5TYFW/Wpfuu1cdTAwMTM+TSBizkg64YdcdGhcdTAwMGJDffhcdTAwMWZLmVx1MDAwZpxcdTAwMTT1bIfB9fRfbFxm9Vx1MDAxZJtdXHUwMDE4XHUwMDAz+7fnnFwiWLaPOFwijothy/BLXHUwMDBijVxuSvf6oSUv6Fx1MDAxMZHii0tcdTAwMTXRXHUwMDFjh09cdTAwMWFf93WH2pBcdTAwMWI8bdWcSuNUjJm+ZPd5VFxclO2+s0SqXHUwMDAzXHUwMDA1JP1d/Ln84JFQgI+Fa9F0o87zNHNt1ThcYrZH/evFbcLU6mhOWVx1MDAxZoZ7iU+xXHUwMDEy9vJA3/Yqk99cdTAwMTfUXHUwMDFm/Z56NLJ1X7RcdTAwMTnwkIlvl89eJLLN5NV2jKLAUoX7XGLQKFlNhryO91WavkBZeSn9Ondhqr06ei6f8ztcdTAwMWL4neuvXHUwMDE3v3GZ01x1MDAxNM6Lzlx1MDAxMzXUXHUwMDFkNSV9XHUwMDE0+mdcdTAwMDO80tgwoXphl+qbW+63QvKrzrxxQ/UvwFdeis4s0co8XHUwMDFjUFlIgllcdTAwMTddiMNgXHUwMDFicenhR9dp459MU3uEr4nl1Vp5LXZcdTAwMTX+52eaNnTYZNzJo+U5415cdTAwMDYlasmA+2bffFtuXHUwMDE3cCCHuq12XHLFXHUwMDA14mFQtDgxlGeY0lxue2xfjH2KVqrBWcO6llg53Sbtjn+v78iHakZcdTAwMTX55VxuvdhFn4fzN41PntBW5fGo0EtKR/x1Y7I6vW3kXHUwMDEyr/Z/PFAwvlx1MDAxNt9cdTAwMDVcdTAwMDapXHUwMDExc/5Mzqb35d4+hFtcdTAwMTPYkPmPhohcdHatPKhcdTAwMTe2uVJcdTAwMTfPWVx1MDAwYkdcdTAwMTFjXHUwMDFj4q8h6Unr/KtpQL1WTFx1MDAxNoku7+Tn+Vx1MDAxMKVjUjRcdTAwMWO3MdiCllx1MDAxMfedtKFCzTWKbMVcdTAwMWHyYeGqo1xi9jFcdTAwMTDB2M3J5tuCM8ZcdTAwMDMhO1xc8Z3JoGCfknb26Z+WXHUwMDFhXHUwMDFhqfHzNM2mJtDO21vT3/2XoEGANnRcdTAwMGWVTJxccltcZko58SZMYD8mvDXijvZkhFx1MDAxYkgv3a0oZrdYa7g6paJZNNxJXHUwMDA10tpcdTAwMDZvxSgh4S4tJfwgXHUwMDFiVVCwXHUwMDBle89UXGZ3eldHTNLjxn9cIvwtXHUwMDFhNSZAm36ox+V6Kft5NHViIfzAfikmJ9pcdTAwMGWbXHUwMDFmePzaJFx1MDAxNeEpgbJcdTAwMGYmK7xcdTAwMDFqk6FFXHUwMDBlQPFD6Uv/eszsWavgI1x1MDAxNan0qzOB6e6RbUzEl8fpOdDCoSW/QozuXHUwMDE2pzrl3DNcdTAwMWNcXCxHuzI5zN9uaNxWWkVcdTAwMWXVo6b79cApdmCfdflCps8jyFx1MDAwZennd3m2XHUwMDA3U8eP/IJcdTAwMWXksnf+XHUwMDA23mtfXHUwMDFjQPZcdTAwMTFcdTAwMWSBritoZ/a2XZ9L/lxchmnXq3WmpUxWJOOijoVGL5fXXFxeX/Q7XG7PXHUwMDE51lx1MDAwYn/hYWyFOraTZ2zpk5FcYt1rPD5oVHCGXHUwMDFmRorDTz1TP6Sr2M2itlx1MDAxY4FLiHV5XFyq7dbjpHNxXGaqXHUwMDBlOlTIvopcdTAwMDDNdFwi06ZhbWM1flx0yFuD0WB8WkFPoMmfieeScyYjcJT8NnZoOUJdXG7zc2p03PDkslx1MDAwZZNcbniWgTIo/Z6s6dPVh3v0JpC15FZkdDVWjW4tg6Zevf3Sp1x1MDAxOVx1MDAxOLFHYFegrPlg8ZOhI866R1lH2Vx1MDAwYlxu3Vx1MDAwZqOyRt1+O4xcdTAwMTl2lWY86Fx1MDAxOSDPPm76qFf1p531j3u937o3/oxJlExcdTAwMWJ0jSao3plcdTAwMWMtKiT8zTBw7PpYclx1MDAxMPJcdTAwMDTRNObJ1aJcIsvQ+1x1MDAxOMhcdTAwMDVJz/3u+O9cdTAwMTJt9qSftW+jXHUwMDE5XHUwMDA3jvHS8/LXXHUwMDFj59o3wb6IzkWMWCi/aHd9ot9Uwz9cdTAwMWbgU67G70llXHUwMDBmkT9U+Fx1MDAxZtdidcE+XpH/RflFXHUwMDE2N14sOZUsvlW1PZiaXHUwMDFiOnxudrVk3Fx1MDAxMtvvz0JI9CBrNuFccvhE2s6bsm/t9fPrP6tcIkuZx1xmvJ65r79ZWqye+e3iW3aFpHegadnSRVx1MDAwNV2BW1Q6bcfETFCEXHUwMDE0/6XqmVtaiFx1MDAxNinDjVx1MDAxMVKB10JcdTAwMTeTbqyvj3aNLiN8foOQs4Yu+KedX4xcdTAwMTQ7+fdcdTAwMGKm/lx1MDAxOIpcZn1cXJBXSeK2etNxRKRmquGSem+qLe9wUb2E1iuPqOj4qFx1MDAxN3KzTlxmfyfEl9nNny5cdTAwMTVcdTAwMDNuXHUwMDBib1x1MDAwYovxXHUwMDFihzvM6Vx1MDAxZD/nbLN57y9cdTAwMTIhvqWnu5s8/J/9oOad0kfDUylj/7zUXHUwMDAwo/KPSribgNaf+/Hy2LV9aODzXCKHzn9cIkf72E+tXCI4L52yZYdcdTAwMGbfJE+euGM2KiFMsTbGTFx1MDAxYzuqYLhcdTAwMTd2nK4rXHUwMDFhwpxNIXevZ41Le1OOXHUwMDFiTZc6f9GCOtny0sG1k5PrXHUwMDAyyV5I99RO7JM13ihcdTAwMDRcdTAwMDTATJVSn3OmxqzY6khNv1/koOCe53aHXHUwMDE3cW5cdTAwMTlcdTAwMTWnREFSXGZjZ5V9xOPBas9cdTAwMTXyXG6rR6DXXHUwMDBmymZcdTAwMGX2dt67LK+yY6E93IqddVAqxIHpoW6bXHUwMDA151x1MDAxYzn0dmloXHUwMDA17Vx1MDAwMrbo49SFN63XxF1Qh2u7e9Hv2lxipf+T6WaWrvbRablHIP3pM154IFx1MDAxOFx1MDAwMIrmraqjmFx1MDAxNoyzXHUwMDFhYFx1MDAwNKekMDG9XGZEbHqR9Fx1MDAwMlx1MDAxNbzIhPFt3F908OpQiMVcclx1MDAwMzHuit6sSdTUse/30L84XHUwMDBiPsUvd29/OV6qvOlgoLsqXHUwMDE51GNcdTAwMDJFedJZM89cdTAwMTL/zlx1MDAxMaFcdTAwMDVQmnCeyla5KGl2/KnFyda2qLgp30IyMtKEjCAuNNN5suzKQsYuJP+WlUI6nd5cdTAwMWKKOqBcXMiexcBDP3/C0+NYtjGT/r6NRFx1MDAxN62vLq5cdTAwMWRLY/jTL7BJd/Rjst1WNnE3XG4sMyNni8uFK4080Zvm+MN2zlxiTlBcdTAwMDNHXHUwMDE5g8F3l/brXHUwMDE4nLWGXHUwMDE561x1MDAxOEFtSYZCy0tcdTAwMDCCYK2U+UbP2iQmnNxOtlRVx2d+jYI362aXi+D60C86iZbJ0zZcdTAwMDRcdTAwMTbG1stln7u0fID0UFx1MDAxYV9cdTAwMWJOj2NcdTAwMDH13S2P3JKLQ1x1MDAwYp1cdTAwMDY0TLdcdTAwMWZkcoFay5Bla3t9XHUwMDFh01x1MDAxN7hzLvi4f6tcdTAwMDRBPcS/zsB6MG9cdTAwMDJA6NdqLUPOksFcdTAwMTQyr+KsXHUwMDA3dWs7u2V9zCwyQM9r3KMjc4mpN2ZcbsuSmSXig7G1dfBbXHUwMDE2LS6rnMju91GDZFxmblxi1XggMFx1MDAwMcS5nd3eh8Y/+XOkgD/nuvhz1MfvXHUwMDBl8sbYwVx1MDAxMzwn7ViX40Pe5jvUcVx1MDAwMiN5lolcdTAwMWXr9LxkO/nyVVxudJV+vKlb/vLlXHUwMDFiXCJdslVFdOKSXHUwMDFkOeJcdTAwMDL1IUhcdTAwMGbrjLvMoC7Gq1x1MDAxM1SRq1bhq97B685CqGAh71aHudnPy8lcdLrQVu9Ub1x1MDAxNdnjhlx1MDAxN1eaTFx1MDAxNZZ3e0C/Pa9qpbtcdTAwMWTtwFxcplJ7mrMg9S5trSArdck457F7KFx1MDAwMLdcdTAwMDWFNqS+hmfbwJZQ6SpYW/aM6ihSi028s9l3goRcdTAwMDWxc5dKXHUwMDAyuXlUdVx1MDAxZDTb/+TVXHUwMDBlY4Krvex2brTaY5/5jIn+rPFo6/9X41GZcWK4s27HbeYo2+vePy5NxyW3b6rQ/lx1MDAxNUow/Fx1MDAxM3W3V1qXwD9Yqlx1MDAwM4SXiV5IO+zzYlx1MDAwNfvZ91x0VFx1MDAxZVxcXHUwMDA2VyOuzFx1MDAxN2pcdTAwMTOY81x1MDAxN+HuXlx1MDAxMaGHn8vvkaVW9YTzobUqX+vxxD2I6+5QdizDPyt7n1gpZZ/iWJ1cdTAwMWE4Kiv9c2JcdTAwMGaHcfgmj3drl9VcdTAwMTZcdTAwMDTY+9LhLlE9zrrsPPvkqjFKn93g5j9cXKZcdTAwMWGGJFx1MDAwMNuNen+vi3H94K/oXG5cdTAwMTWxXCKC9UK+IFx1MDAxZfP6XHUwMDA0XHUwMDE1XHUwMDFhzDWjdnHF6LY7n53YTjR7u2ziXy9F3fgxWTbiLU92YtJ3mVYvLnaMiTW/LoWhpVx1MDAwNVx1MDAxZchccm052FBLq5eF3UxcdTAwMDN1wrdiff9mgFSWJN0+y79cdTAwMTa6fkJCXHUwMDExjFxiMV+RjqHc+fl90lx1MDAxY0pBr9X6XHUwMDBl2VVH6dnY8GuqhHRXock0XFxT372h3Hj2Nde1w+hcdTAwMDF+Pjtdd2edf7PfXHUwMDA1a432baXNm62wrictaFx1MDAwZfG3+/GK9cakKkNj7ZK8g8+RIZ/XxZ61b5jrlLBcdTAwMWbl/H7e0cb/68fBwKCCKlE/1yP4++xcdTAwMDfDw89+XHUwMDFmuI6UJ/7q1n5cdTAwMTHjXHUwMDAxac/97sfehqBcdF3kXHUwMDEyvnV8ylx1MDAwNT6xtjdVt1x1MDAwMHM7XHUwMDEyXGYsXHUwMDA2WSSAuqPDXGZ+QThcdK/dytzPWVhcdTAwMTEoi4JcdTAwMWby81k1YVCCd+Grya2xlYt38fSVt9TuWJi9194oq9FcdTAwMTO6d1l1zrFcblx1MDAxOdpoXHUwMDA0a8BcdTAwMTCp9lx1MDAxN+tu7JN4VDPEojb0reP0XHUwMDEwXHUwMDE50Fx1MDAxN+LpVesjR87651BZxbYgZOMraVxuXWR60btvu7EvJ+VcdP3OW1x1MDAwMf44XHUwMDEwJahNYVx1MDAxObGbKqm4bZPxb6+Zv70mcWf9/OZcdFxyjrbKUp6zSVSUK1xupVlA3IPg1ZxnXoxcdTAwMWV6XHUwMDE3USvjmjNruMb87Vx1MDAxNvl9Kk2atG6vaVx1MDAxNZP73/zhcaNcdTAwMTP+qY7xUTonx9acdaiZQ1x1MDAwYv9XV8o3nnDb6IkxJGKLM/ss6nQmLnmYXHUwMDFj6Vx1MDAwNOTJIFx1MDAwZWpDaYGpO65cdTAwMGbFszbT1HGd5N+zz+zsSDGf/JRcdTAwMTM+rlx1MDAxNIessD89ikrQb1i3JkxcdTAwMTbAXHUwMDEx/SH2hPJiXHUwMDA07yu164QvMJfST2q92ead/PVmwoWH8H5ZXHUwMDFhXGb4+Vx1MDAwNWrpXGaw9qQmXCJjLU1cdPn5XHUwMDAxX1x1MDAxY3SwUvjDenaUkIdbXHTZXHUwMDAyXHUwMDA0XHUwMDE5YIc5mvKUXHUwMDFj5lx1MDAwZfFmdlx1MDAwN7JZXVx0XHUwMDAyMH5cdTAwMGWIzGllXHUwMDExZ06zjJKqXHUwMDEy6l/1gv/niyypStD19tp8xWRFyjhcdTAwMThHT/igXHUwMDAwY1x1MDAwMlx1MDAxZca15J/cJkWRcClcdTAwMWL6m1x1MDAxNKd/+OBvf3CgZnzqcF+/zjnnvHCZv42/elx1MDAxNp2v11x1MDAxNybD3Fx1MDAxZVx1MDAwN2t+xIhw1nykVNysSVx1MDAxZVb8SbAybWcxol7utdA319uGXHUwMDEyXHUwMDAx+PbPKVx1MDAwNPBcdTAwMWRBgc++mHrDXHUwMDAwn5OEO91cdTAwMDErT9IvXHUwMDA2rlx1MDAxNnbNpZd7XHUwMDA3XHUwMDE08YLOhFx1MDAxMH/evEWk3JXVxvSAXHUwMDExXHUwMDE05Uovt9qE8bdcdTAwMTFXJLky2qlZalxywNdPcH5Jy/xcdTAwMTNcZvGB/2rIXHUwMDBi9LLQX49WyX5/WkWMTSjwr/SQfShSwaAlQtVz3tJ93mvfZ5ZDY7Cjelx1MDAxZNDzPGSczJuNXHUwMDE20XM21Vx1MDAxYvx0iTLQ4ID3KVx1MDAwNvpQ0GiJ8pTTu427d/F+1pBcYu4qR2t/+pRcdTAwMDWIs7cxXHUwMDBlXCKAefJFlHRcdTAwMTSh8JVcdTAwMGaMZztccufarHMh/yqJOGFUXHUwMDAy5atSXHUwMDAyXHUwMDAzR6pXdp6TXHUwMDFk/LOuT5kkXHUwMDEyfbdTs1x1MDAxY4yvjjZq5FHqizA+xHBAmu9cdTAwMTlcdTAwMWY1tOw3pDGSLtKJzUuK+KbkzVg+XHUwMDBmaFx1MDAxMOF/z/vFoUDT31x1MDAwMHHWwCejNaBcdTAwMWaxalxugibUQDapjLyPLNmstpKeNY9DJo5hlVx1MDAxZVx1MDAxNFx1MDAwYuN65cL0IWCt3LtcdTAwMThIrjaF3Fr6q1x1MDAxNKemx85cdTAwMTgybUxcdTAwMWKg/oR8+Kx9977ML/0zRyf/Q3VYXHUwMDFlaG/tL+dcdElBmIfoez9cdTAwMWVcdTAwMDZ+SYGaWjRcdTAwMWF3toVpvv/Gjlx1MDAwNLXwMdCNuuDR6qCf7788bEVcdTAwMDdKiDNcdTAwMGaJXHUwMDFkacT0V6tcdTAwMDKKfGeN8YBcXGBcdTAwMTKPfLaamV8sXHUwMDAzyyzOXHUwMDAwmlxiNdOLeexkuU7zxXlcdTAwMDH4xYuGligqV7tcdTAwMThJXHUwMDE18lx1MDAxZMvrMd58Rv7ViUWX8320uZ7PwmRRbZznuphTa9iEWM5cdTAwMDRIfz08vexcIqdC+bNeKift0cjJXHUwMDAxoUzTXHUwMDE05vW9lm6uYGqSlEAyq1e0SNc5uP1m+bxcdTAwMGIg2Fx1MDAwZsXtVFx1MDAxYp7rh+/JXHUwMDAwN3pUpqrpIfaPo1x1MDAxMF9y+saY4/v+9UxcdFx1MDAxZCpcdTAwMTKutU/Ofsft4Vx1MDAxZHFyhFxi6KDnpKjyWkLuS/HbTUxcdTAwMTml9rNZuy3UgFx1MDAxM+0nZc/+xqPgXHUwMDE4lIexs2LTmZf2Xlr0cuRcdTAwMDNcdTAwMTBcdTAwMDUjx1VbRdlcdTAwMDejnT6X+Tx8XHUwMDFlRWaU/UBJ/7/7XHUwMDAynC7rMi89klx1MDAwN1TR/nfJtcBcdTAwMTZp5pk4mVx1MDAxMFx1MDAxYdbKZoU7fJpcdTAwMTPEwcxl1V5tM1x1MDAxYa1cdTAwMTTUTSnjqeuCpCUxXHLU06nju0e67K9n3EDuNVx1MDAwNmbqtWJcbiBlopSVXHUwMDBiY6ZYZ1+RU1x1MDAxOf+GQYyAnsApgUVRj8+5VyypJkBCSi9FjFx1MDAxMGpcdTAwMWR7XHUwMDA3ljQy1/NWwEYk9KuAPM49bIb74lx1MDAwZW4+l6+kdu+GLsOH/lxc9a2sY6fVWsSWbWYjpdk85CWDeCRflLFh35zrXGZcdTAwMTirY5+OxVRFz/zg75yO0cpcdTAwMGbaJo7pnP3RV/uuzrVuOVJcdTAwMTK8XFyJtefvbp97+9nYMblcdTAwMWQ627xkitjuuDpk/lx1MDAwYm+NbWY7OzywZ22vXHUwMDE0RqDisrlXPmJcdTAwMWaDXHUwMDBiI7PAwo2kk8t8JcajNV65ViHs+/pKKuZcdTAwMWHbjGKjI4m8UTtDVXo8tSaDfNbbPCBUUaOPXHUwMDE3gz6qSlx1MDAxYVIoMNZbemFEXHUwMDBiXHUwMDEw3HN1xedOjid/631+1j15wCmSiPt1/v7VULRYaMu3cfd4efq+XHUwMDA0RbztsVx1MDAwMs55qYmXMCFcdTAwMTWR5lx1MDAxM3dcdTAwMWNfc4l8XHUwMDE0Rv/8ylx0L8/op0dE6CO8cmqtcim3N8Oi1u2GXHUwMDE4cPmOQvJhXHUwMDFh77Kvy0pcXO1cdTAwMTRiX2LzWKVos3pil1p2kcp5u91TdFGavdtsXHUwMDBiyq1iOq7d6OCoon98u6JlK6RcdTAwMGI7t8tcdTAwMTAxci9i40Z8XHUwMDFlsXw+iznlTitAac2yuUhcIvqYhJG+KrFcdTAwMDD536qJlINYeJ7PkLlvsEFcdTAwMGbLZeXeMakt4ba/IDaiXG5z85y10r5cdEF5rW6AmrDJ0ZC64sk794CkUKTkYVx1MDAxOUNjYiG6oVx1MDAxNnRcdTAwMTNLIGXm4K37fZXzXHUwMDA2UTHl603GtTPj/Vx0Na9cdTAwMGLuaHbK/tvlpmWexr9ZXq9cZsNwXHUwMDBi5l5T+/66+GisXHUwMDA2XHUwMDA2nlNzdPCHf3ta7DnLIYpGhtLjMe7dsWXKRevob2Cg0cvwJNqPWNV/1PhYx6PUXHTiRVx1MDAxY7jPK+zZMWR4WrNcdTAwMTVsaNfsPE+xcqvyQd5cdTAwMTBrOJxcdTAwMWHEVFx1MDAwNFxyNnSWxJFcdTAwMTdcdTAwMWLlhahcdTAwMGKUQEk5XFzyi8F/Zk7wqlv2bbOoII47kZa/PVOKS6oyXHUwMDA2jV4sVLN6Yagm11x1MDAxNvScs/zlulnPUEu2iTWwcUORrSxjQtuWmVx1MDAwZs9Nf/aQXHUwMDBiXHUwMDA1/HH+vCzITDv8cIRHcVx1MDAxOTtlPd4sZc9xXFx+6ricXHUwMDE0++K6yqe/XCJccnMhXHUwMDE3/Vx1MDAxYrd3z4tcdTAwMTJnV6/qrVx1MDAxY63uUM5ZXHUwMDBmNVx1MDAwNW9RXHUwMDA0aLNcdTAwMWZcdTAwMWZO4Uxx7NRypmlcYvdeak2syNEouFxy5yxQc+kx7p2d9WJt/k5k5DpWcfq3iriHJIaQXHUwMDA1mXxiXHUwMDBi6omreFVfXHUwMDFmXnxek1fcvNGRiqXB+ehPyEeeYjxcdTAwMWMyOphxaFwiXHUwMDA1N7vlLupcdTAwMDJcdTAwMWTj4JlUVn2CI3ch7VazN3rkiiiF7919x5dkXHUwMDE2ef41ZE7Gltr9fP7q8uFcdTAwMTNItVx1MDAxYbtd+NS7XHUwMDAyhFx1MDAxNM+ZXHUwMDFiXHUwMDBmcdLk85v1gl7iuliop1x1MDAxMnMvRFxy18hKwqCRXHUwMDFh3FwigypcdTAwMWTb42vGZu6O7Tj8Lq+WTmucXCL6Wm5cdTAwMDPok95YJ628iLzNxnxG5XVPoNVcdHOF+ptcdHt0746M+rhU4jeuo37Q5smyrNnTqmFm2KlCWLhcbrUguH/IXFxC99t7iyZmeG4gXHUwMDFi1/4tsClcdTAwMTj7XCLxX5SBxXVO+YxSkFx1MDAwZq6/94dQv7lPXHUwMDEwgVx1MDAwMX83UK/l+be9dFx1MDAwNUefZ6JGJqLlnkGoJfuyr4HJmdvrXHUwMDBlfV5ccm06hM6Gj4/I+kKh3ymoXHUwMDEyo2QudlG8XHUwMDFiflx1MDAxOTxA0zWf/mU/vuF5XHUwMDA2O4K6i8BQvlx1MDAxYbarL1TsuL/2g5h1oYb4XHUwMDEx9YV4ck6JXHKfXHUwMDBluJnv8Tx91ccrXHUwMDAzIaX4MLYqziiwmuHH16nx9ZOfh3gxg7dcdTAwMTG3Pn9I+etZXGJG/ZxcdTAwMWW5cpc/Ku9FfMGaXG57XHUwMDBic1x1MDAxY217i7xR914gfCAoXHUwMDA3pOKgrDmMhlx1MDAwMl1ZXHUwMDA3rC9YLbQ2b1x1MDAxNFxiwPWR4lhZOFx1MDAxMfI0VjdOJIJngSg+XHUwMDEzp6dmdyyoZlHxXHUwMDE2apf0jVxyhz9A/uiyxN/5SWQvnLogKtPMXVx1MDAwNurv+k4n7qlcdTAwMDTk6fOJILp4jfpUXHUwMDEyialDUlhcXMo8+aXZxFE9S41/9YnKvfT9Y3iVIZeotY9uy+EjKOTC8+y1wpy/kLJcXF00U6BcdTAwMTZj6twj4/mhM5tcdTAwMDdzf9nSPI837UnUfi7t++0hIZ9+PHv3VeLceTW03GrsYua3d5XKq+2io1rqq5ppXHJkJVx1MDAwNuoqt+lZ81xcXHUwMDAwXHK1OctcdTAwMWP1XHUwMDA2Y0NcdTAwMDYv9DFcdTAwMDBcdTAwMWFlof3xcPbevTEtJjb0XHUwMDExVzKDi+FcdTAwMDNcdTAwMDNv4Vx1MDAwNvnVeOvZK+gw9slFXHUwMDAxXHUwMDE4c1x1MDAxMvrh7HP1/Js48WUjoTeopVxcZuZ301Y/7amfc6L1LfSWXHUwMDFh6WZenIKbr7Ih55zniIbyXHUwMDE2XHUwMDBlp77yiD74zcrGSThcdTAwMDTKh7dcdTAwMTTZ4T+LRkderX5cdTAwMTRcdTAwMWLM2iTQKPHxX/1TsDuqKP+rzUDN6++xjZyzhVx1MDAxM0dXXHUwMDFjM2CPMLklKPCOXHUwMDA2g+j7XGJY9SlCXHUwMDBl9dSvXGIopLPBfVx1MDAxNG53V1dA8uonqnjMIFx1MDAxYafmnSaC1NH1/e7bT5SIntB6c9Zmj3JcdP0hlCdP5O6/3MvpdVx0qVx1MDAxMvbMRtCOmpBuqW9cdTAwMTV2W4R77JiMOkk4Llx1MDAwZqWa4tRdUVlcdTAwMTHQ1sDdbl6959A42n1P7Z8yN+9n3lx1MDAxYusw+9/9YFxu9edcdTAwMTf5q3x/XFygXHUwMDE2WlxmXyWuUFx1MDAwMt5+/bfOuINzINNeP302fFx1MDAwM53V6FwinN8pjVHeOT4jRZ8xWbVdftJRifTdzkmhNUbjJ7FqM71H7TzUQeLt4EWmpHLamWfIXHTcnbR75+xbTSyqbd33XHUwMDBiX2akZeyq3DZpYa6B9kZcdTAwMDSm4bLRxtDzXHUwMDEwpaPwKslOeoo+3mL1sCFcdTAwMTTfL9JcdTAwMTOFcU/f5LNcdTAwMDa6fPJwXHUwMDEwhjqr/Vx1MDAxNebkV4ibc9bEQaCotM+ZNUfI1VT3jexcdTAwMWS2g5NwNnN6Q1HyPiFcburP2j52yGSq+tTPc2XuwFwigPE+nlx1MDAwNVx1MDAwNFx1MDAxZYP5hHyhZdFzilxiO1xmWmcoI97ava6M5tEpoZKyXCL6Ia3+eft5N2U++/DoO825XHTiNcH3wy7OptlLz5U1aZCVSuO+hFx1MDAwZZOfnHfh+Vx1MDAxMvjM4CtcdTAwMGbmULyHcFxyvVX92NPpXHUwMDA3cOT7SU0wY/XMXG5bgVx1MDAxNChDPtJQ+MtpMVx1MDAxOY+7prRdsm41XHUwMDA2XHUwMDEwVLwq0K3+PJ/wVTu1mtAge7OC2pZcdTAwMTjiLmJcdTAwMTJ5jlYoJNerQ0pf7/ir3FB9uK5a/qpcdTAwMGIhXHUwMDFhMeXEyypcdTAwMWU+I/A1gWk5P7s7RXP2Ws7+I6PzI46f83BcdTAwMDfHOUrGj3N1wc5cdTAwMWHXV6lcdJ2JrskjIGBed6GC8jCPYECyXHUwMDE2XHUwMDExWM9KJYi5lfrhobFlg1x1MDAwMv7J4vHl9lZcdFk7/Vx1MDAxMno82bhcZqKzd1x1MDAwMT33l+Q746zf961qyU+E5F7R6e1n4lx1MDAwYtNcdTAwMWHHg2xcdTAwMDRC+jVcdTAwMDN76lx1MDAwNO70e3L9Ojpdi9xHdFv72lx1MDAxN5+filx1MDAxMk6dg65iap8zoLlcdTAwMTB9O1x1MDAxYZqsXHUwMDFkXHUwMDA02Hjp7u7VXHUwMDFhXHUwMDFkRzvnerHhNztRMWZcdTAwMTM0TtNxXHUwMDFmeyD1jj/rMndcdTAwMGVcdTAwMWbvm1x1MDAxYZ26XHUwMDE4rP5+U6WKkYK7krZWcuShXHUwMDBiWqxcblx1MDAxOVx1MDAxYZhcdTAwMTPSZHjFWqdnTZWYXHUwMDExkHfdKY3ve1xij7xcdTAwMDIue/hcXLVGytvQY0b7zbCLi4C7etWWYc3dndumL2iNx188nXjFmtlFlYhcdTAwMTBRoHKor5P7rOoyX1Loc6hcdTAwMWTZxNRcdTAwMDWaoy3KXHUwMDEz/3sm+trteUA2/W9cdTAwMGWVKTxcdTAwMWFoJ38z/LTJXHUwMDFk+VlcdTAwMDS7gZulochiKP5x756qqfRA7Fx1MDAxZpbzlGLh9r6AXHUwMDA0rJ/PXHUwMDBiPTmbzlHp0lx1MDAwMy50mtkl+VwiLqjC92H4Ofq1k8xcdTAwMWPlo9/syzqkXHUwMDEzyiNI2Fx1MDAxZb5jscLZPy4v0mt1bUXB7au0bJOdXHUwMDE5XHUwMDEw5+Z6LJpURlx1MDAwMJa9QVx1MDAxMb6NXHUwMDE2g5pcdTAwMTlfZaeGckf0Qqc2+PdcdTAwMWWD+ZhcdTAwMDBcdTAwMDY5U1hN+EyqZ+RcdTAwMTdcdTAwMThcdTAwMDG1XHUwMDFiKVx1MDAxZCWh8VdcdTAwMTY2XuxccmovpXZgqC35XHUwMDE4tLC7V/OtQDfnTHngjFhrgEG27vFdrmbe7Wpb3ErEhNqGI4v0Pj/ru+DhyujLXHUwMDA0fbuvluB070eFLzvJS4aonTJse/WPXHUwMDA1vb6CqVx1MDAxNMXB5Yd7MX6LzDeCrK5cdTAwMDXomEiGcjzuPNpcdTAwMWTs3CpoXGbZsoxR0DSfRFDnXHUwMDAxv3FRxbpK6TtzhKZLa5GhijB63KLVUpz5tZL+rlx1MDAxMqXLXHLJuo9cdTAwMDWvidCj6th3OutBynjqXHUwMDEzs9mFN795lcLbXXu3p1xixjr7qerp2lx1MDAxOLRUXHUwMDAzXHUwMDA1o9JcdTAwMGJxvSGahUplnkVCU0t1XFyu2GOz6F5cbk5dhVx1MDAxM8NuXHUwMDE0XHUwMDA044AphPty7KpCXHUwMDFi88c5ue3Rslb48ZDxophcdTAwMGaG1a04glx1MDAxYmA8z1x1MDAxZSm7+lx1MDAwM+HWcDGfdZpIt1x1MDAxNOvylT9LwOIkJqY+qI1hXHUwMDA21YisXHUwMDFlflx1MDAwMvxvXHUwMDBmL/Y+KiX0jbqtXHUwMDFhXHUwMDE0ed5PlzVcdTAwMDLx4Gs62Vx1MDAxNtRh25b82sXIhL9zZXZcIsTF3FZEtpqYOdr5x0NcdTAwMDVagVx1MDAxMGHFeDBpiVx1MDAwNlx1MDAwNGPy52Q1bs+9yHlCROeL/Vx1MDAxZNWL/Yqe7p1PN2xpqvGcv15YlfjuXHUwMDFhSthhXHUwMDAxRkamymtcdTAwMTCstVx1MDAwNmA8XHUwMDA0rFx1MDAwNHBPO/KCrJpSfvbyJz9cdTAwMDeKJFx1MDAxOFx1MDAwZvg81YHgXCIsXHUwMDE491x1MDAxZeynXlu5S1x1MDAxN7m3MX9cZqLWuXWYa0W9VfxZXHUwMDFmfkCKXHUwMDFly4dkb5z0Nlx1MDAwM1x1MDAxMiW/v5lNpLvVXHUwMDBlRrlcdTAwMWZH2OOUN9+vmr7lXHUwMDBl/+SXXHUwMDE4nybtaTLC7WtcYnff8X+1IS7bc4VDm5N/m35cdTAwMWbuXdLeMi11n4qsPOAy45WLfHahXHUwMDBlXHUwMDE28n9EhIwuXFw9eVx1MDAxNdXAjGZcYlx1MDAwMX4gS/s13vDXM75cdTAwMTnW1dve2Vx1MDAxM67jUSvbQVfh7/zDUfg55LxzRkq4tKnZ9PXHO9893DfUpy7KXHUwMDE4UH5cdTAwMTCFNu07rLYjLOHySlSzXHUwMDBiefOrLUHld5jF2lDIjnr/fsYodCxGJY1rXHUwMDEzbFx1MDAwN/7rZ09QyG3nuXtcdTAwMGK9jKE6vGPiuvVcdTAwMDQ4Z+uL+qk2XHUwMDEwXHUwMDEzMlJ121tcdTAwMWZA/9FcdTAwMDZrW99cdHdcdTAwMTe9y3jhP+9YzC9ZT+GO7LyKzyf1YidY1Vx0lZFMoVx08+SCd1ta0tShz/O8ieayxZ655F+/0Fx1MDAxNqyKj8ygnjlne8xcIvmmROfEa1x1MDAwMXTzplx1MDAwZmjzMNr0yLX+1eeXXFzgn1wifFx1MDAxZjf4PsRCYJ7yXHUwMDFjXHUwMDAwXG6XLtl5rkpcdTAwMWbleNVp6eV6vG/kpDppO+Zrklx1MDAwNo1AW23jMIyh0Xb+q1J2ZruuKjdccjJky3P+kmNt/fxhK2qvW7xsL0W08l+Fs88zXHUwMDAzXG4+kTr4YnXH38Fx0cLxrFef81TXSL1x51x1MDAxY6FIaLFobaNcdNUkpP+FSbfUleNbqKapaqxMi0rBb274wklOXHUwMDE3kYTXaVx1MDAxZHsrT1x1MDAxOJfjeIBcdTAwMTLWvH+/dlx1MDAxNK6mo6TmI1x1MDAwZdytXHKp3/lcdTAwMDa9yLV1hJ7SYX1f/fok+9ff4Lyvjb7vvlxuvVx1MDAwMeRCXHUwMDE3SE1Fi3Pf8qBXXHUwMDEyK1x1MDAxMeTZuuqMnlx1MDAxM1r2LtDxXHUwMDAzrEeh5tVfb9v3XHUwMDExY3eh6u2q1a1wyDWhzD949IV0oVx1MDAxZcA1SJ1p04emmzDQX6X6vKK+JGswwr9cdTAwMWTVhFxicvZLXHUwMDBmXHUwMDBiWfHfnThcXGMlPb5VW9jFimbyeLS336lKYVx1MDAwMn3j2Hzr52yu0cpzZpJE9l99202lXHUwMDBiXCKevlx1MDAwN4evT7vW1tt6Ol+Feb5cdTAwMTlLTsRcYu5LLiGQXHUwMDA2xbn8nbFkz1lcdTAwMWTd+MLMhOpcdTAwMWQhpKyrRl3j8WtcdTAwMDJKm2sjPFB9aDChnELBSIRnrVx1MDAwYoVcdTAwMWFGqnLUxSCGMuDdVmZ/nu0vndY4fWuf9ZY22Vx1MDAxZIM3XHUwMDExjFtL+921XHUwMDA09a/ogVx1MDAwMlx1MDAxYlx1MDAxMFaigm9T49WVoyNcdH3r570tylxyvudcdTAwMWJJXHUwMDFi34i4LeXiQNOt31x1MDAwYo2xXHUwMDExXHUwMDAzvVfnjFSQ0tWt/r/7XHUwMDAyoFn84mi9lFx1MDAwMuQkYXygdDhPlKietVx0XHUwMDA0uOl/50j1p1x1MDAxMFx1MDAwYja2Q0j8to9Xiq1cdTAwMTTwe1x1MDAxMtd2nC3c3zlcdTAwMWbh9lmLM7eqzipEmLu/XHUwMDFhmUBcdTAwMGKWo9No/Vx1MDAxMpz3S9b1nu9cdTAwMTNcIjX7oFx1MDAwMVx1MDAwM9N6JC04v3iXJOFaM0iO6CFTmFx1MDAwMV88kFx1MDAxYWq8W1VG3afWgZrO3HZcdTAwMTh+kWdYidoj4Fx1MDAxNiQzsmqrXHUwMDFjqoe40D5cZod5dF/kc/Y1v6fvXHUwMDFlmSjB3V+fQlx1MDAwYjvkb1x1MDAwNlx1MDAxN9zB8+P2sbmiQUlcbm9NZzpTXHUwMDEzKYQq01x1MDAxY1DA21/f71x1MDAxNedcIlt/mU7jPJhcdTAwMDe3vYn89jg9XHUwMDE0PSh3r/WrkFx1MDAxMFx1MDAxZFx1MDAwZvIriXXGtPlaqvpcdTAwMTNrZo/dfu5R5EW+9zsnqqzyXHUwMDExqPHt6lFM5Vx1MDAxNqm118xrzI857J/cvHuOfWtHpjT/PJlcdTAwMDY9mVNcctVFg/rEv3vpPmsqXHUwMDFhdnCzXFznUbhcdFx1MDAxNVx1MDAxM5c/Td5cdTAwMTRcdTAwMGUpXHUwMDE1yG9cdTAwMWXpvNT57ujWXHUwMDFj+p933rbWtKgwxq14fL71pyhcdTAwMGLC44FePWRA5P6nRVxcxFeTKyrtzcmrizrTv/4nIedtyro++oJAXHUwMDBi33+kYPOVyY/fXT65XHUwMDA3mect8ZSm3Vx1MDAxMbalXHUwMDA2orBWjroj+Od73icogWaZXHUwMDFi5p1cdTAwMDe/en9cdTAwMTSs4+gr18tz6qX6MbdcdTAwMGX664VWmzFcdTAwMTbMcnjcXHUwMDEzXHUwMDBmPYE79lhcdTAwMWbi+ne/S1x1MDAxZFx1MDAxMVBcdTAwMDBVYKNcdTAwMWWv5lxuytJvVdlcdTAwMDHlsjRR7CjQJmzG3U3xLUxq0bR60uxcdTAwMTR0/Z7nXHUwMDE5d+eegWhcdTAwMTJcckDAXFxcdTAwMWPtXHUwMDExve74uY5jXHUwMDE3LWlBp0JKf/eWyp61mmhwnv23dFx1MDAxNVx1MDAwZmWHK5fKjWKgo2pcdTAwMGVcdTAwMTT0YHJ7Q06/91VcdTAwMDIywnT8b1aRu21MJ0lOXHUwMDEztFx1MDAwNfikl7mIf3Om4Kt0UDS53nlfnu/EjppcdTAwMWFUyalcdTAwMTh7fa/g8llccnB6XG7Zi1bWjlx1MDAxMCCVivpcZl4ux/L91f7Vj57JvCvMhPQs+juHMFx1MDAxMMOhnFVEiFx1MDAxM29hKM7zYJ34dzeKx5Xg2n1lT9Pz6ew5m0t8vU3XnuG80MZcdTAwMThcdTAwMTTsP1x1MDAxZF0qh9mqrnhwTVx1MDAwMFx1MDAxMyxdyVZ8mGSsKswmt+wqkHNOWH8xfWLGW9tcdTAwMGV0+JTizVRcdTAwMTKzXHUwMDE2mJ7KXrHP76W8zeedNbZYXHUwMDAxbak8R9WD+4yh/b35YbJcdTAwMTTPR9Jj7CW9/M5TXHUwMDFm7Fb+eFREXHUwMDA1qShRwfpxkVx1MDAxMMvWyufI745HXHUwMDA1xqTRXHUwMDA036VAiffMI0JcdTAwMWX75zyvWaKA2tDLWs9+XHUwMDEyXHUwMDFjPGqe90dEdbn2OKEqJfRcdTAwMWZcclx1MDAwNjKUZPqj//5mqO5fbW6viHW+6yGhXFy+w6pbWL2/UyOBT6BU5++IMFx1MDAxMVx1MDAxZlqVfXpcdTAwMWTyyoisXHRcdTAwMWHwRJp33yd0O1x1MDAwNOeed0TrQ69Ywu+z6nyTKyinvj+/w162XHUwMDEzXHUwMDE3r6p2+nGPaFx1MDAwZW6CRvN3f476XHUwMDEwyraSS8pkd9fuVuZcdTAwMWGcc+zmZFx1MDAxM7pcdTAwMThcdTAwMTjOgryDdjr1au0/clwiPtds1uZLKdq4+uVDRoxHsmz66XtxtSZ+PeB/d2nFtUq+LSrf6OXo7fzYSntcdTAwMDY2XHUwMDE3Q87+qChLvEaoIGs1+jhccvT8NY4+RceHmCRj0XA5++5cZltByyuSMSn+adtcdTAwMWVq27ZqL//uvVx1MDAwMi3r61x1MDAxNc1z6PNOXHUwMDE1NIm0zHlWXHUwMDFj1Vx1MDAxMFx1MDAwMMTJgqYhoHfIXHUwMDFl59yQXGZcdTAwMTNJXHUwMDFlXHUwMDFlX+Lm/Z2NY7bN7O5/Wiq1xGWnuz+vaFx1MDAxNlx0LVx1MDAxNzj43bmS8IqA1f3KcjdGulOxzVx1MDAxMefsLagnXHUwMDE1eGvHtPHU4/Zt/73nYn1XR+TSc3T2XHUwMDA1yTZW2uNVXHUwMDFiP/2sosr8yJBfr1gk2dGy1rOXoYG/e1x1MDAxZLB6qKTde/vQiM7XfbPXmrXgtzrBt67OmchugsyHur/vqdzvQorKXHI3/+LpMthKMm+Xru+7hifsXG7VZ5tBg9eUsaaalu3upj+uP+eVXHUwMDE45TA+rD9cdTAwMDfpXHUwMDE2vF3nOjzRTVtcdTAwMDHCoZK9V6xcYnHUXHUwMDE4XHUwMDAzdayQnoLQ4dSFO+3lnPzV38n2XHUwMDE4PWe1rH3DgihcdTAwMTVcdTAwMTDv0jfLXHUwMDE17cOf36CIz4NgifO+KJfyXHUwMDA3XHUwMDE4YFMjQ5JUcd8kn1YnnPeCXHUwMDFks4x6XHUwMDE0+LAq1MC5Xl9v2i+GfahX/KpGoXZtOn42oUKBUvyn18xcItcz9MY8zzyxNnksLLhcdTAwMGVcdTAwMGX8fJm+evtdju8jaiDXZPbvypqy9sHbjiU0jps5XHUwMDE2n14ssVj45lx1MDAxN2tcdTAwMGb+sWznPsb7c+d5/lx1MDAxNi2/2fTqeTlIlMl+Z645WkD8XHUwMDAzN3bH+Vx1MDAxZCRcdTAwMTdcdTAwMGLuQOxnzISpRLCttmhcdTAwMTdl9Vx1MDAxOeK4cDCVuMPL18rSquZ/nohcdTAwMWavp1x1MDAxN3iAqlxiaJn6qz3YrW5ES5OdmH/3p40vxPw99eDffWZEraA+PqJqalx1MDAxYjx6zuwwPFx1MDAxM+RdW8+Oe3ds7V+dUl1cdTAwMTVZQFrx/+qUV0lcdTAwMWN+51x1MDAwNFhrfytcdTAwMTX6m4dcdTAwMWFnR71YaW6v/O/sb21AmKWtT4vfP/LRgNWfgdyCJpy9jNNYqFx1MDAxNm5qTzhnTtxa3bqfZ1x1MDAxY1wi0Fx1MDAxMNPOM1hN/uJcdTAwMTgqv+7bJeavXHUwMDA24eOqQFxyxnlcdTAwMTDrvzvZXHUwMDE1WtavcuTL937QWWZNXGblXHUwMDFjr1XY5uu92IblVcFsv53+4dariCvIKry+3u18L10vbNJObZFGppNis+VcYmI0f7kwXHUwMDA2z7npXHUwMDFigFg0nHdcdTAwMTRaXVPL3zdT+rv6yUiir57VObuCPitcdTAwMGU+KHZcdTAwMGWKd694XHUwMDFiKdl4OO8782ZTwr9cdTAwMWSpXUJpj+eRflx1MDAxMTn1KkEzXHUwMDE3JL1xesIpgp5cdTAwMTBlNIj7MlT39lx1MDAxNiPfLFx1MDAxNJqD32Wkse3g6a+a8bHL+ZObXHUwMDEy+rj3j4f/gibt4N5QWlx1MDAxM5mbLPtcdTAwMTLX5D7JXHUwMDBiifTiXHUwMDBitS/qWMsonzNJesjkRLJ3J0J4b1ZcdTAwMWKDfyDiXHIh91xm1ziwXHUwMDA0NeNAYIQpk369XGZMrK2ylveN0zU+psH/OjOBoZ9cdTAwMWLnOn/zeeo5n1x1MDAxN1x1MDAxM99fz1x1MDAxOcib0Opl++vfQ15ZvivVUuzbXGI3oVxm7eS6Xvd2z4Y5p6/SvtRcIlwiYPjDLvXSgEK3jUnEYNBcdTAwMDJcdTAwMGaub2S1M8Wg36P6pixcdTAwMDb+TXdH0dG6lc1cdTAwMWJcdTAwMTExXHUwMDFhSkdZXUajXHUwMDFh8u4gTXV3XHUwMDFm3464XHUwMDAzOn8z+dRcdTAwMWLv8aktydIg71x1MDAxY/I3icDcz/VZnKgtw2d5NVvjKkAohO+yQddcdTAwMDB8Y7PHznoxsFx1MDAxNXtYmXfX3pNjXHUwMDAzitTjxupcdTAwMWJcdTAwMTNpnZjvXHUwMDE50OCg3O17gZw4eN/czemdUvNPqqXTxFxizJdZ0T33mcrc/cVJRoP232qxM1x1MDAwYonbn5tOXHUwMDFj1+VcdTAwMWWtVmh1xM5pTYxkM81cdTAwMDTLui/tW5GCx/P/sfVcdTAwMWXbrmJL0+hcdTAwMDPRQFxi38R77+khvFx1MDAxNVx1MDAxMlxi9/RcdTAwMTdYu843/jFuu3ZpSTBnZkRmZGRDLH2MXHUwMDAwPIhcdTAwMGVnKCxDXHUwMDBiQ4vsYbI+NCCpfb2XyDsvYanwTLBcdTAwMTnzd0dcdTAwMGYvXHUwMDE4sYqVaEzIalNHr9xcdTAwMTfIbyQp9sX6XFxYvqnH13BcZo9Y/Fx1MDAwNm7mXqJYLKNbpdN45cvTXHUwMDA2Vr661tKDiYjVXG6A2kqOXHUwMDBlsihcdTAwMTCj0Fx1MDAxM69cdTAwMDJcdTAwMDNgj2vX3vZcdTAwMWVef/35vU/sw61I/1x1MDAwMU9YIVRBXHUwMDFilVx1MDAwNfYzRlx1MDAwZTO3pymJXHUwMDA3kJb0g2L3MzWegc1x6CWpU+vl3XNcdTAwMDFIs5c48l1l7zLTMqVKo1x0ZYDe71x1MDAxNlx1MDAxMnqOaDDZ/629XHUwMDE1SZUzMlx1MDAxMlxyvNndV6thdD905PxkXHSLk1xuqFx1MDAxNnlwzIdQyFx1MDAwZlx1MDAxY6z631x1MDAwMKbH0u/843eeJUlccr1xftDNzqdDdjn3hVx1MDAxZjiydqM2XHUwMDExrFFwsVx0iDo3JeFcZlx1MDAwNIxhXHUwMDAx1EPumFx1MDAxM05FvbHBennxe7Peu/OOn5mn7HtPLKfYXG5cdTAwMTEmqy98hy59f/634evXmYuez/KZV1x1MDAxM6vfPnJcbvY5WFx1MDAwMs3AZdNcdTAwMGZBJoX0W4whwC7YXHUwMDBiXHUwMDEwst6hYyeM2V/xIWVcdTAwMWGhyjZi7TRPRlx1MDAxM3rvUeyGxOpot/zfYWLAPllcdTAwMTYjbGavkGV+5LTHVTFcdTAwMTW2OHEyY1q6NSvo9HG3YVx1MDAwYvpcdTAwMTOcX1x1MDAxZT5cXNe4XHUwMDAwjsledsYvPX8sXFyQhV99pCVmecR7SOpmeTC/kfWZXHUwMDE5XHUwMDA2nFx1MDAxNvtia5cykqe1Xvkg7HyFL9CnZM1cdTAwMDP2TzxcdTAwMTZzu/q1tHX6zcCLsc50KUTMXHUwMDE2kPL7xDowXHUwMDBmXHUwMDFi4MkuXHJmcnb7XHUwMDA0+PRcdTAwMGak+kyhbzzOmPTj28BHT1dcdTAwMGWuNEyDkqCszLOO2p+rXtPgziPaRpv3ZFna5LYtM9x021hHQbN99eqvXHUwMDE2XG5cdNxTXHUwMDFkQno/NndcdTAwMDZcdTAwMDTR1mmTNClkOlx1MDAwMTfsXHUwMDFin/dcdTAwMWE+oVGr9Y/unXYk8Yu516Xrjj1QRriqXHUwMDA1S9ZzXHUwMDExanlcdTAwMTVcbk0pysnRXmnv0rF097pcdTAwMTRU7LxxNVP78sFcdTAwMTGW9uf7T7WHL75bXGIlUDdrfHhOJbTvsiFUtf6VMXiyY2xkfNDUo6B5+TRVpcdcdTAwMGIp1rBdgljb36u1Q1x1MDAxMalDXHUwMDE2xVx1MDAwNEUx1GdQI+npkFx1MDAwM7aJPnFcdTAwMDQq0fm93uV6UKaMiKB5YkxHbpc+XHUwMDE31dzamrdfXHRlyripgVx1MDAxMyY6Olf/WfH2eO/dZiFjaI/fu1x1MDAxMFx1MDAwN3ZcdTAwMDJp3z5cdTAwMThcdTAwMDTrXHUwMDA0XGZQSpbbscnSXG5cdTAwMDdcdTAwMTTZXHUwMDAzXFyy5Fx1MDAxY1dcculcdTAwMWPJu7io8tG0x5n7ZZzquPBcZvaBgoEmqDFZQ/VsXHUwMDFiLvuPjuyTLu+FYbVb3EqdftWa/HpcdTAwMDZcdTAwMDV/2MtoZvjzbMeq0lx1MDAxMi9iunojkmJEYftocUyi3zG763I/bShl7ohfXHUwMDBigZdehpZKXGZ93GdRNCGXj+hgUGzsi2vVZpqXi2yq7sBrq/X8+Fx1MDAwNm/XkCqkt1BJ82CzfFNcdTAwMTmlntRcdTAwMTNPO42yXHUwMDE4XHUwMDFjYFL6qf31d/WTXlctcM+FyydupTY4jOL7OXneXHUwMDE2e1x1MDAxOS44XHT8badcdTAwMTismtfwgj5naI7ixmODYypTdD/eXHUwMDFk0D58ZH9OXHUwMDA3+DVcIv5lXHUwMDA0Ut6htVGaW1x1MDAwNuxz8UHv2ZSAXHUwMDA3hWZs4Vx1MDAwNnx++lx1MDAxM/xSPdNcdTAwMDbL3tOlrUtcdTAwMDesXGK9XHUwMDA1XHUwMDEzm4yu/nlPfKPvcJG7c6ApTcjPQVVPOfEuhTRHjUdbQ1hM3+bTuCuvYmXfjqgsXHUwMDE4N9Hftc5f+lx1MDAwN1xmiFx1MDAxMSooXHSl2lx1MDAxZctcdTAwMGWNzGpdkJBrhJFe4kr7ooNcdTAwMDCS7vnOSlpcdTAwMTO1X3He2nJ3Lt5Al8deods7LJPVWJhcdTAwMGVHS+S469d611x1MDAxYVa63Fq63yBcdTAwMTW0YYeSpZ3X/aFCg1x1MDAwM+iA5TVcdTAwMDFrsW9keJhcdTAwMWVcdTAwMDRIk8flVV3Rkk2wwy4rg1x1MDAxYVj0dlx1MDAxZWqEm/1aY4bdUD2LYTVXjKhD2lx1MDAxNVx1MDAxODUphGqmXHUwMDE16/70XHUwMDFhwkno4O9cdNpu7z/fuHsmyd0zXHUwMDExRG5cdTAwMGbRS9slrSbU70U7XHUwMDAw41dcdTAwMTjrykSYotu/WTKAdFx1MDAxN2TW0NotXHUwMDE3RPyZdvieNvvpMSmtwvF1xMogk9TRjdtcdTAwMTnbXHUwMDAx5Yi7/JZWlGzVXHUwMDBiJ07zuOCjnPn1L0hcdTAwMWN2tYY1XHUwMDBmK+euaUhFk82OXHUwMDEy06VcdTAwMTKz6ISDO1lcdTAwMDek159cdTAwMThxmDdxy91cbkT3yrPWKrVcYlx1MDAwNEZcdTAwMDbbXHUwMDAyyJbmNDMsNrN1LFx1MDAxNM1nXHUwMDFkXFxAXHUwMDFhZDfm5ChcdTAwMTTN96hcdTAwMWPJXHUwMDE0R/70ViScXHUwMDEzr1x0r1x1MDAxM1PTYIOeXHUwMDE4sp6ceFuQNbhrTFx1MDAxNuHKXHUwMDFhX949Tat35UTuIIX3Z+qTuvizRZiVx/mttVjfXHUwMDE3XupO4VxuSOtPXG5SKclcdTAwMWPYzNXtXHUwMDE4RbhcdTAwMWZsXSaVPGtxVZmWybFcdTAwMGWP3FtcdTAwMDTy8pLTkN1dWfCl0oBX/PGtqHbf0are2kpRUpRYi5OPvzcuusqLXHUwMDAwXHUwMDAyn1rh4JLEXFy1POPsi0h8NFx1MDAxMm2qXHUwMDBmyfZpvG1cdTAwMTSPWi59Tp9WcHOaRonZLZdcdTAwMTh86Nnv+lx1MDAxZdTFeaxdsujvXHQp4KLw2IE43EZGXHUwMDE5v9CzjkT/alwidu+kTuJqXHUwMDExXHUwMDE2W5VVXHUwMDEzw37gV73n+v9cdTAwMDC3OGD+s7mmVlJ928ZNiKpCha2RXHUwMDAx4M9cdTAwMThn9Fx1MDAwNCZX6v/8XHUwMDAy+E30XHUwMDBiVdrej1x1MDAxMURw/8yjXHUwMDA0yO3xMHK8boNcdTAwMDCYosDLyqh4XHUwMDA3SN4m1qtcdTAwMGVuXHUwMDEyXHUwMDFhXG4j90w42lx1MDAxMsi1KP57a+fZXHUwMDE3XHUwMDAzXHUwMDEzNlrQV1x1MDAxZkkqmziHW1wiwJX2jDVnLj322EVH3v1IXHUwMDEyXHUwMDA3tnuvmlxmrD29XFz3fifuWcs3medW8Vx1MDAwNMrMp1x1MDAxOPaoZWFY0DJOzfdcdTAwMDRcIu8sXHUwMDAzuYTKVDGHuva+r8UzK1x1MDAxMMlets/J916ELVx1MDAxM6b6xeiLU1x1MDAxMFx1MDAxZFtcdTAwMGVcYt6fZ0Urm1x1MDAwMtCiafTG5jO6Z/Z2QFx1MDAwNaxhLpA+ukVbXHUwMDFkUXubue34TiOWofiaXHUwMDE2PlAyRJ7HkzF4rPrRvU0g9dpcZsJ0XHUwMDEw41x1MDAwNuOv6t2LyW+H4vDyXHUwMDFh1Lb5xDpcbnhzw2WjhzMm4XfNRLJOID/XyEZYVexcbsWZo2PXdv/yXHUwMDEy7Vx1MDAxOFx1MDAxMqyojCuO9eXvh++45Fx1MDAxZUFOXHUwMDE3nfJ50Sqqza6WrFIgUFx1MDAxObc0oZq6oHLkoTj8X62IXHUwMDE2qX4gRjxcdTAwMDU/hPgkXFwrzyuJ+/5cIigo2MVpr/o9XHUwMDFiXFw1omJHlWsuXHUwMDE49GzUTDFlv/3qhG5cdTAwMGYl4O6XSyrGxn3eXHUwMDFjmtNyMjRwTF9cdTAwMWHONsjgz5AywFx1MDAwZoFcdTAwMDdyYIKII2xcdTAwMDahz2tU2n9QVHHGXHUwMDFmmkhJsc9cdTAwMTFcdTAwMWU5sYpBfaafY6f1XHUwMDEw+5Invbhf8JU/aXGQ06eWOKKrd1jttOqZnPg/iSyHKlx1MDAxMoasgL07ua9hQTl1yKlcdTAwMDbFvzHrn1xc/3v/3Hj/+tno/KhV4OB+0CT8KZo2plx1MDAxYvvJXFzYkVx1MDAwNFx1MDAxMohcdTAwMTjWRttDXHUwMDAxrIeTp17cY6RFtVx1MDAwZqPzmVO8NHY8VVx1MDAxM1xcnyGosXt/+jtcdTAwMTSWNdy+5lx1MDAxZFxivqlPMIjyTnfVnNFcZjVcdTAwMDT7JKPgd1x1MDAwZXRdu4jYy1x1MDAwZTtcdTAwMGbdXGI1XHUwMDBlxmeniu5J1n80cFx1MDAxMvK710BcdTAwMDJcbknc76JA4Ob1vj5HXHUwMDAxZVx1MDAwZlx1MDAxM8Dib568VVx1MDAxN1Vf0G9cdTAwMThcdTAwMWKt4+g9fSR/c3R5cDJcdTAwMWFcdTAwMWWgrjk1fVNcdTAwMDZcdTAwMDZeS//kXGbMyixPRzRV9ZDaN2RbalOY/fdpkPFPNXZcbmOOjsRcdTAwMTRcdTAwMTLhKbTei13k4O3Sl6dcdTAwMDd9KCYw/UbwXHUwMDFiOP2eypGNsDS5ayWvq1mste+xPeSI1656XHUwMDE4XHUwMDEzZCriXHUwMDEyfa+0bsk+XVnMYFeRPW5rl/I8ySlFXHUwMDAzPJRbcmPmfm5cdTAwMWal+TOzX1x1MDAwNONAJHxcdTAwMWK/8I3yya7snpK8Q1xif/pzxlx1MDAxMFx1MDAwN1x1MDAwZj6Cu+4zRN0hmFx0yVA1352wQ/+5crSV44VcdTAwMTndXVXHotr+3lx1MDAwMVxcxypcdTAwMDeK+6QyrF9RS4/3QFx1MDAxN+CA4ee5pFTxOyqtYV6cMyeTxNcuirbC8LtXXHUwMDA2i1x1MDAxM5MntnTV0pdcdTAwMWMmXHUwMDFmLlxc+1RDNHS+1CBAX3Wl165cdTAwMWHvrIElh/K8Klx1MDAxOZ7vN1x1MDAwMf/lXHUwMDE4v45NXHUwMDFmXHUwMDFj8+6qXHUwMDE5o7SgXHSbOFx1MDAwZdD1XHUwMDBl3lx1MDAxY/gmwmV7XHUwMDE1NelzXGa3XHUwMDEx8EqaIFx1MDAxM8655Fx1MDAxNYs+bmJcdTAwMDLzXHUwMDA0VbVazGmkPy85zVx1MDAxMcS+SqDkLij+RUprtbbCNohqZ7R1N63Kq1J2QtMubVx1MDAwYtKMrjtiyu2kL2fg4qlYeWnbz1Xhy/8/0t5cdTAwMWOxOFJcdTAwMDdcdTAwMWKegXOJjPAyLkevbFx1MDAwN5LNmE7cLl3zYmdcdTAwMTKHKe5cZvZESGDoSfjT8tI+nG/iJVx1MDAwMcd3xe7ajnrNWVxuV7378ldwe1xyXHUwMDFi+XR6cGLZL1W5lFdfflx1MDAxY5iO5lx1MDAwZcHtXFxcdTAwMDXtxv6qWT3mwqpDoMrCiGZcdTAwMTJ8e6Q9QEj9QiBGycSF+dLMlmCZwdzSgSuUm4eqKNtccq5cdTAwMDJzV31ZjNqj/jXUkztjcLM3UeUh0ead5PXEnGx3RqDt371cdTAwMGLQZHTNXCKs+yDhL/3vXGKgfci7NfD1RmzUgC/9JbSPxn/Cd/NbKUzDoPmTkOdTkCpizKbZu2uIP+9cdTAwMTfkcfPsr/n2djikXHUwMDAyXHUwMDBmgaBY1lx1MDAwZpO8at1cdTAwMTJcdTAwMTZcIrzxpIyKg2g91MfnzudhasKQNLb9XHUwMDE4OVx1MDAwMCVCTmn6XFz0pHol6Mm3aXwt/yraeUXPXHUwMDEzWZFKKpf46ZH1vjde2uFEY4jOq96Pu49cdTAwMTXC8tT8zaxZ45GG6ZjJzVx1MDAxOVx1MDAxMi1pkbhcdOtcdTAwMWIzaTjIrzlcdTAwMTbohufq0VgzyyRcdTAwMDU1rnJcdTAwMTLkJzVcdTAwMWR10ILbXHUwMDEzW1x1MDAwZaBZ5/oj/Uk4yFwiXHUwMDBllkRYaSmV39NqRrNz1VxmuZDbi6Nj++z8XG5WM9loZEZ8oK5cdTAwMWHM7ZYsdZDwXHRKa5dNX5Pqp3Q9p3xcdTAwMTOGXHUwMDE0TtXPS0vMt1Bw15zEiUdtXHUwMDE1RqBcbiNccq5yby8p3vidnyxe8nvq0qWR2t1HXHUwMDAzXHUwMDEyJq1ChSAg8Krf8CBiSCSL3T2eQpdcdTAwMWVgYzxmPtpcdTAwMWbYKpeNuVJ/OlLjkLb+M4aKzj/qlsOoRv8qMEj9oPCn/ZZXu6Gt0mH5TFx1MDAxYXZcdFlkTT9YSHk6XHUwMDAwUzqB1Lo/UCGZq35cdTAwMDSw8TZPNHz3vU/sQ2/6kP3VlMX0JSOYRdzfM7d3vynIXHUwMDA02u1cdTAwMTGcTFx1MDAxMH4jR//uXHUwMDE4J2DetIgrT9fMXHUwMDFlr8CgTL64xjCA7NjnXHUwMDE5ST9cdTAwMGJqX55cXFx1MDAwNVx1MDAwMmlcdTAwMDa/MjssYipzwD5351V509tcdTAwMTRGustcdTAwMTNcdTAwMGXlwMeUZlx1MDAxOHP9PWjTXHUwMDA261GBVvKvXpRcdTAwMGbWoJLBV8OGy8e1IKa9/1xmh0bZl1x1MDAwMq9/9WHyRoBiYOM5KIFlL5FU2XVAyd6X13BShM9cdTAwMTnOrDNOJGH8XHUwMDE00M65eqPSwFx1MDAwNdmrYLNcdTAwMTPjN62ZXHUwMDA36vl9/L+eh26Ib1x1MDAxMjWS4GM7tNvrSmV4wFx1MDAxY8iQqZEqXHUwMDAyQledvy6ltzBcdTAwMTWF/SmHkNRiq8TkoUfb6sRTUGh+dmhcdTAwMTnlwLs8oFSK+D5OXGbx8O8+XHUwMDEzk9qo/ELEy0sqrk2lXHIr8cI7XHUwMDAwM2/atyCYP9whXFy4w9xcYuLp2/zVf1x1MDAxYpCEalxuouZcdCvSdn+VZpLUXHUwMDAxbM07XHUwMDFjgt2mLtTGv844XHUwMDE0XHUwMDE34d4+nZXWkTB6kSaK3mdcXFx1MDAxNYXnXG5edaNLM0KKXFyeQlfuSFl/gyZcdTAwMDG881+c3jXz3/mMREuFuTyAXHUwMDAwnplknslWJpWA88i7RVx1MDAwMEDved+lfXpcdTAwMGL1clx1MDAwNtE3jlx1MDAwN1A8ak1riFx1MDAwMFx1MDAwZqpcdTAwMGVrXHUwMDAywzUjUkjtXHUwMDA0+EzAPrNcdTAwMWK/PJZcdTAwMTKs6uN1+0PKgHyNnHXxlUd4LSrenzZ/UVx1MDAxN77IXHUwMDE4dFx1MDAxMFx1MDAwN1x1MDAxNlx1MDAxOGdfjm1JbjikrCEnN5f3XHUwMDBmL7ZxeH4gXHUwMDA3XHUwMDA1jFx1MDAwMEjWrGS8n21cdIrHnifclSaTmEAtv3My87RRXG5OfsJGKYmH7TFV1XZcdTAwMWasV1x1MDAwZlx1MDAxY6D1+LE0IIXdmlH/pFX7UD2/Ruk6v3gz0Fx1MDAwZujdXHUwMDFlhdGuWizyQsPzXlx1MDAwM2byO1x1MDAxZTiZTP1cdTAwMDGw1EFcdTAwMDTzNbf4fT1cdTAwMWZ+vzM0XHUwMDFm9+Dh/q8/5I57lmZ4qfCWfeGb+HhcbqaUbFx1MDAwZWM3XHUwMDA3w65cdTAwMDbxhlxiXHUwMDFhOHG2V4qkdHTpIFx1MDAxNFx1MDAxOPxtXHUwMDFiv5tr0Un9S7Tfcq/af8BvXHUwMDAyJ8WKSuZcdTAwMTVEk9hcdTAwMDVcdTAwMTFcdTAwMDRAXHUwMDE580W5bMtcdTAwMDDs6Gw0wtQnl+ZcdTAwMDHhwkwpXW1a5aq3b0vdXHUwMDFk3aK11Zj6e+94mGVcdTAwMDNcdTAwMGXK4SBcZjRX3l5kXHUwMDA0uXMot6F9u979pG6akHvm8lx1MDAwNJ/H5lx1MDAwNKogoY8sfb5A8Hxx6IBbKmmm4dr0iLiabJRcdTAwMDPRlVx1MDAxM/iGOZD5cLrrNzHk7+RcdTAwMDc10FpC1Vx1MDAxYVG3Pzvk7lulzXqcz+mLtf5+WJbDXHUwMDE1PVx1MDAxN9tcdTAwMDBeyoyUQXI3r9CZ3Vx1MDAxZCeh9DNcdTAwMWbKsotcdFx1MDAwMUZcdTAwMDA+TFx1MDAwM81cYlx1MDAxOFb0fe5uXpNcdTAwMWTkJodcclBcdTAwMTPZQ7C5RneMpODvXHUwMDAxfeyLU10zXHUwMDFiqL9cdTAwMTd/3q1o6mNcdTAwMWP4z+9cdTAwMDekSWbkLv18QYmeKytKdFxc2O15nlx1MDAxYtB3e1x1MDAwMG90oXWzoJn0a4uKVVx1MDAxY1guYcqVd1x1MDAxNfr2OHlTxPB4XfWFtDrSl6lcdTAwMTAn84/GVqBcdTAwMWGQx86bcOdcdTAwMTD2J0WAVjCa/zDg9rk+s0aOhOf5XGZcXJVH+fEl/SjOe+kxhX3TOJ5qqrRf18Agg38/OSScJ5XH1Vx1MDAxN+A2JvCxrTs/xS/4/mxO5Zwoi6sxP+4zTXWxVqvNgF53iiPr2Fx1MDAxOF1cdTAwMWRHL/9U2EuCXHUwMDBlkI8plqlg7VI7XHLzev6Na1x1MDAxNn6ySMOhnDViqqBcdTAwMTC+wsfqXHUwMDEyXHUwMDAwqkJcdTAwMWZW9Fx1MDAxNZtyhtzIv5nbXHUwMDA3uOhLvPjJ5K1saYPVyVx1MDAwNZY371xcWjNcdC+FXHUwMDBiXHUwMDAyXGJU11agXHUwMDEzePyT68pX5Fx1MDAxYdJbOVx1MDAwZlx1MDAxNslcdTAwMWKwQ1x0v0PN84R9Zco1XHUwMDA3g1xyctK7nDSaXCKoXHUwMDE2L3mtTlwiVFG0ua/hryrN+iutz62t+ye/vpTxXHUwMDBmXHUwMDFmtYf4k/m71maARPGxQ1mnXHUwMDE5hFx1MDAwZVx1MDAwME699KLdo5qYyV9sXGZ2XCJj2iElVY3l66m2eP1NXHUwMDE0XHUwMDFhk5bk5NeJ89KtcP/uSPtcdTAwMDVVIDPNufnT57vyme5cdTAwMDYvObFcdTAwMGWDVO5cdTAwMGat0Vx1MDAxZen/5k5hXHRcdTAwMTmvvq/rXHUwMDFluVx1MDAxYnPiZW/S3drR+rx9bfU6cTftJydcdTAwMWagLtNps1laJk2pt/hcdTAwMDCMfFNMTUOyPU/n6IyJTTHYRFFdPct2ctCHQihcdTAwMTefOfnjeIZcdTAwMTPckI05QdXHz/lcdTAwMTVktO2v5GdcdTAwMDFU//5Zfan8auohQ+10jYaNJqHw79KKiyq+knC3JZdQUjjZjFx1MDAxZMR0xFx1MDAxM1x1MDAxZYvFXHUwMDAz8dR9+3HN1YKVW1x1MDAxN+vFo6xccjZcdTAwMTBScolb36Ftj1qMq2j7oMH0fPb7mU5cdTAwMDdLZk7+f/u0X74ralx1MDAwN2LrpVV3XHUwMDA0KqJNJf5sXrY9XGZqPprh0Fx0u1x1MDAxZV7Srd/nsq9cdTAwMTZqTFx1MDAwZrLz/+tb8iWMv71cdTAwMWPJVZszXHUwMDEx6F+NeV0kUsruXrdcdTAwMTaDdiOQX1x1MDAwZmlbYi1bcTBcdTAwMDOnaNDDXHUwMDAw5pGmuvNcdTAwMWO7uVx1MDAwNzby71x1MDAxN+X+XHUwMDAyuVx1MDAxNnX5u5LB0ubFrEfMbLQnb1xu5ct3S8RrWVx1MDAxNj/DLl/xkaBP3io2qLdf+FlcdTAwMWU4IVVcdTAwMGIm+/OiKshcdTAwMTFZ6rd68p1cdTAwMDdcdTAwMWO2Z+ZcdTAwMDHT9t7LockoXHUwMDAz+jjwWubBXHUwMDAzV2LOsIg+2P4xgVx1MDAwNbLdu27qd7XPtKRCj+02XHUwMDE4Oj6XTqt4XHUwMDE0tShdvjKKKadcYlx1MDAwZkjd3a82XHUwMDA24bmxf/5cdTAwMTe3Z2az47e+TlxyudxcdTAwMTVcdTAwMDH52juqUSxtoH26gmlIPZbcjoVjXHUwMDA2fMRcdN9IfGkty8qlSL+cKGM0S+U1+7WYOVx1MDAwM/b6iMx3dURkvjiCyu25XHUwMDBl7tmt53Zr2zhxwFx1MDAxOVx1MDAxNt5cdTAwMTh9KbBcdTAwMTVDaonse3NcdTAwMTBW1XJcdTAwMGbeQer9vfxGWss2XHUwMDEwaI5dJKlze9yR6SlcdTAwMTYmllx1MDAwZtnJY2SsXCI5imekVVNTQJxWeWtYhrXETzo/Pbyx27vOiFx1MDAxMLWzLWCj3H4kRHNcZlx1MDAxMTJcdTAwMDTpPTu6qERqofFD74zzcl1cdTAwMGWVXHRExOdcdTAwMGb3Lj/txNpWufeNZFwisVx1MDAwNm2fwrDXXG6xXHUwMDEyuNWCZ/7LKLe5bG0kIdtFiiOHNLnqyue9MtutVDZXUmj+xXSA5F/eSVx1MDAxMm9Ec104yz9/rVx1MDAwMsCJ8Wn0bv1xK446eWGfXHUwMDAzREa8L09cdTAwMGWfk0ONNzXoRMxtm+RzovX8hp6kXHUwMDEw4zRW8EqizN91dUVaWsqqXHUwMDAyXHUwMDA1zlx1MDAxY1rG83jwXHUwMDAyR4yd1r5cdTAwMWaXXHUwMDE2xpFhsFwi9Vx1MDAxYncz8nbpXHUwMDBl3nG9j+fDiq9cdFx1MDAxNp/hT8aZq//tJOPeXGayOytcdTAwMGYunVxcQrxcdTAwMDVZ51x1MDAwZp8/m1xcJUw1a1x1MDAxZWBcdTAwMGVcdTAwMWYkM1x1MDAxMVx1MDAwZeJcZtrFf+t+aTAzVV7qg1xyXHUwMDFh71x1MDAxZi9OinVxblxy5TWcmDpKXHUwMDA0nk+A5pmTpKJn/p02lG29RjhpSjmjNmouWXHvrmdp4KTlUFx1MDAwYnTaXHRcdTAwMDf51kyndFx1MDAxOYMrmD18t52JNmp3dT0/XHUwMDA1YjT0c5xxgZEuX7u02Y8u+udcdTAwMGKTVnJBX3WM48T0b/Suy9ftmZNcdTAwMGbw3X39gfjY7OvjvVDWKk7cXHUwMDA2gJ7zvnaW0r3hvf/PL8CtafPVyXY/Oz6f+5bys2NcdTAwMWFNXHUwMDEzvTtzZKNCwLDiQPhcdTAwMWOI9M9XVzeqNs/s63eHZZCmOO/cXiW0oFx1MDAwNee5gMnPlo9EP7RlyoxGtSf8hVx1MDAxNflcdTAwMTMrci9E+M8jmJhcdTAwMWStavYkXHUwMDBmJVx1MDAxZteML/pLoiDYvfe3v+pHKITh6l7kLbHM/7R2RExcdTAwMGXkdo2OnVx1MDAxZnykXtyqXHUwMDFjdvlcYkj2M8rlZ/HXN7OfuW5cIvCXXHUwMDBlVZ1mXHUwMDExwUfCXHUwMDEwXHUwMDAx/ryXLaVAjFx1MDAxMLJRxJ5GKjFX+JqBYpZcdTAwMDckXGJ2TrN8ikX8hv9mrWSyQ9uzXHUwMDE3y9/6XHUwMDE55nPXKVx1MDAwZv7mXHUwMDE4NjJcdTAwMWPqhUviujCEolx1MDAwNLnnfSZAqTzPxFx1MDAwMba3Tkx2ZZDC2YHDTthSI/a30IL1hP1ioVx1MDAxOIbm1JfHXHUwMDAzoP3eKShSXHR96bM3kMXXo0bR7SQg1IImSdyo3OfWwbVsefcomUqImn2LXHUwMDE31mV38ubTRM9s6Fx1MDAxN+9t79LafFx1MDAxZk3Lc9Tizlx0jpBcdTAwMWVcdTAwMWWVXy6oRphvYipjI4fMUcSc7XtcdTAwMDaEqfueqFx1MDAwZqpA6Kufhap8XHUwMDA07y+n7G4/S/jkjOzFXHUwMDE5mfPHv59eYuKAm39tXHUwMDFkxk7SUbDmlde7S2/F0K6+g1/C5fFcXK2d6u7FjVv1ldhI3ktYgN60qjLgQ0jBXHUwMDEw+ju/gNqWoGT+xau+009cdTAwMDDLY+WNV1x1MDAwMYZcdTAwMDW0P88tbVDNXHUwMDE1+9tcdTAwMWYxpq46kFx1MDAxZPDnnUlcdTAwMDH0XG6Ox5NG0jmPKm1S9vgrb6N6/k16t2DBf//h0/rA/zBpXFwwJ69VNSfFoHaceqlhTfrMedeckVQ6x06u2F5QV1x1MDAwZslcbqRcdTAwMTSPXHUwMDAxs/ubXHUwMDBiRnV0mk7aXHUwMDFkKLFdKrNcdTAwMDRTjJ5+3u57TJTxe+2DOHljXHUwMDFjXHUwMDFkTnJ71XxS+XXFQoT91jHT9OjNwcRULqa+LVREK0f/joVPYtixfP20fnnhs7s3Qlx1MDAxOXRccrKCwVx1MDAwMdH78tvhqDNtXHUwMDFl9Fx1MDAxNIFcIuRbkItiv45LXHUwMDE5f3rASY2KlLQr20ZcdTAwMTgnNlx1MDAwMlRcdTAwMWOUfoX+Vu/5XCJcdTAwMDaKL/3lOt5nNp4slHaLJ1x1MDAxYlxy08u3XHUwMDEyXHUwMDEw7F7dzGuvZCta4PeQXHLR3bXd1ea/2TueN+/dXHUwMDAwKmzbW9V2zLPv05elXHUwMDAzz1x1MDAwMkM/glx1MDAxN1x1MDAxMnGxQV0jIfOE9viBgi3mwj5GPYOe21H2XHUwMDEzxaqkZ+2PavO0SHZcdTAwMTit1VhcdTAwMDPp5vzbwfuhvX5NwI213ldPPfurdX7rlyaAlX9psiYnXt3z/Fk3t1tyXHUwMDE3QeDoXHUwMDE3+1dz/6EvavToXHUwMDAyXHUwMDA1dVVjXHUwMDE2OlTWh77UysyxRn/gKGxw0/PFJc7xkPfcla1hblb9hYV0vMHvcPWPZfbEz1x1MDAxM2Wy+YWA23zIutX0LE5ccqtcdTAwMGVWXHUwMDFhwP+yocF4r9xcdTAwMDMriZ9o9tZI7Flcclx1MDAxZvB5bC3CXm05siZcdTAwMDOIVLrLV7PLkFvPXHS2e5pcdTAwMTW0f/tcdTAwMTSp01x1MDAxNO6hM/Dn2VxyqcLzMXFBbu8ptNBcctRcdTAwMTbf+3XnzsiMXHUwMDA0gHD5XHUwMDBlqpJcZoZh+yFcIpjp6Vx1MDAxOFV61zemNy7gwmb603KswypcdTAwMWMy/C5cZlxmqVx1MDAxNLBo5IJKXHUwMDFhimuqRUvSXHUwMDE47n4yfnmig5RcdTAwMTR/XHUwMDBmjF7koW1cdTAwMWNcdTAwMWJcdTAwMDSM34D7L4bU6oEoXHUwMDAw8dVcdTAwMDU491xus2600Vx0xdhcdTAwMTOvVdqVN551b3w6jStcdTAwMTX0g1bC5pt75aA8wrjOS+Lnq+/7YVx1MDAxNcKEi0HbpHVwg0Xuc1BsgtecUDvWsF+rePpcdTAwMDRgXHUwMDFk74X8UVx1MDAxOT/Erl3ZXHUwMDFmXHUwMDEwXHUwMDAyXFy3MYZcdTAwMDNcdTAwMWHsN16kq03pPji/PrZcbqc/Ys2G31x1MDAxM/VmSIBAXHUwMDFhXHUwMDFhIcJcdTAwMDZvnaT9lK5cdTAwMWGGb2DPlDrTwHr+6++qZcS1eOyqV55Yz/tcdMKHlK7cv8vH6m/qKF6YMC1XXHUwMDEwPHMypNEpnFx1MDAwMfIrXHUwMDEyP+FmuELG8lx1MDAxNWhcdTAwMDSlbIqGK1x1MDAxYnDyy9SYmFx1MDAxZkm2Y1nUvVx1MDAxZFx1MDAxNSFe8u2T+FJcdTAwMDM6RVxu8nVsI5mDWex/c8lcdTAwMDdcdTAwMWNcdTAwMTBPgVx1MDAxNHhR8eXDwmlqQTjnOdure1x1MDAwZZlcdTAwMTWcR9zFXHUwMDA2+v3L/VxcaSHTpe+UNVx1MDAxY3t+OK300MZJ4pcxXHUwMDFkn9FlT05umvhcdTAwMDSyXHUwMDBiOGyN527amD2d2XJO9Pr7qo2racxcdTAwMDPInrjCvkjs8Jp1XHUwMDE2XlxcITRcbsjpXHUwMDE4Jp5/vFRYXHSlctTdd1xcXGJYXHUwMDAz81x1MDAwN6HO6Vx1MDAxMFeLXHUwMDFhplx1MDAwMjThb17rytHU/9zi9Thx91xmnadVXHUwMDBl4Lsn2bSvn9DZ/Ju+zvFj5EdcdTAwMDRcdTAwMDdcdTAwMDPd7uRcdTAwMTZcdTAwMWXgPptcblx1MDAxM8bb/lx1MDAxMSquOOPK+b/yXHUwMDBlpzK4MuZtWT5gQTDLZ1mB4YhiQlx1MDAwZU9cdTAwMDBLXHUwMDAyS1S82YmHetPYXHUwMDEyOs9O1ra/XzffXHUwMDEzUWNgj4+6Lvjd7/eaXHUwMDA23NhcdTAwMWRQ09dcdTAwMWa2rMzqmVRcdTAwMDGX0Kusr9XyWOw/nMX0YctcctRTXHUwMDBm5rRLsld3plv2V8ym50dxOTyemCslXHUwMDEyoytP31wiJflagFxmjmso9Om77lx1MDAxNz2yKe48aL8oNd6CfaZAzHqQdSml7k7PQD6bJ9ulXG7AXGYt5rXrJ+as/3xccizi06/HXHUwMDA1qO7+3Zfag1x1MDAxNFx1MDAxN1x1MDAxYlwiueI6W8ea4dpcdTAwMGJ4ktx+ufa3t3jTf1x1MDAxNGLqqtIu9TZNgW7/ZLM7UUe1/SAtyGCao1x1MDAxYnX06erRllxuUefum32of/jceaKLXHUwMDAwXHUwMDFlhFx1MDAxYbuqklHqcnJcdTAwMGXvKNPsnsU14NYxTFDl7rp+foZhoYC0RHuFb9Itzl+4XHUwMDAx/PNoxLXmO9bv0v5cdTAwMDHYStQvc0o05FGswIC8IdqVWTZl39RYVWC5XHUwMDFmXHUwMDFh81x1MDAxNjk4rt5hLlEhxJvQMLGEyConn1mnXHKLPrZBi7F25kx6uvtcdTAwMTj4fr7Waz4vZ4tNb6Phj1x1MDAwM51MXHUwMDA353O6v73UZFHMK1x1MDAxM2AvPvxzu0NcdTAwMTi4XXlcdTAwMWL1lL4xXHUwMDExXHUwMDFhllxiXHUwMDBmXHUwMDA16ENcdTAwMWKE9pPSWsvrajzf/fHaczIrd9nsn5FoKdrPx0xWbVx1MDAwZqzg6byHLr03lSG9zVVcdTAwMDP4pnxey1F5MK+613mOTFhvJmwkrv5ibiHSMVx1MDAxOXrBWu4v+01cdTAwMTTWpXaj2/cytDcr80pcdTAwMTLy2vvRObVK5Iq2nyhnjN9EWcxIUmCBV26p6y6V0j7Ui1xiPTA00kCjJ2JcdTAwMDLcJnKJl8uJXHUwMDA1S3+vY1x1MDAwNLHFn4OtR4uoXCJL/r+dc3tQR+p5KUfm7m1cdTAwMTFqWcK4XHUwMDE3XHUwMDA0fCs7J4N4gTnxabW0lO5cdTAwMTm+QzqYM1pcdTAwMTdcbqGjkexJrVx1MDAxOU1r+e6fXHUwMDFmh5Ze3u7C8qzpePBcboZY2uS1xCjNXHUwMDE20HWzZFVTv1x1MDAxM1ppaP83g7TTbNyh6uB/7ufCXHUwMDE2XHUwMDE4mbRXTSleVrppXHUwMDBll+m8v37P0v/bXHUwMDAxtD2Lcslavt/4XpqmR6OBWrQ+SddcdTAwMDaJnlx1MDAxMlx1MDAwNFx1MDAwN/ghbXjkUHeEXHUwMDBiXHUwMDE0kd+gt/78PeOPnz2GelxcsvWv38T+2p9nN2pxonUvYYzd1ECnuGeAWD0merCn/2poUC1cdTAwMWJ48Vx1MDAxYb73XHUwMDE5Y6isz3D0xFx1MDAxY3TcWrFcdTAwMTBcdTAwMGYx+Vx1MDAxZPY+nklW9Fx1MDAwMZ6PXFxcdTAwMTmmUJXo3zrypT9cdTAwMTE/XFw1+dtL03xULZdvZ9y1pFxyMFx1MDAxZjbRxlx1MDAxMZawxHuRXHUwMDFljzx8JFV9aWdRh91NOb89QU/ayJo/mPDB76929X45XHUwMDE2Vl2pv7xMIcDtu0NcdTAwMGLxL+otPu/jINmgXHUwMDA2+oSRKoxai1GSXHUwMDBlwM9JXHUwMDFiqJR3vcItcWxagFYqzW/4kVqZIOtrVMl8XHUwMDFmQtKroN6/TOtcdTAwMDBij+D+eTmA5HHeneyvL1JcdTAwMThBU5n7h75i9Ukuw/GhultcYtQ1x3hX7Ux/lL5W+rQm2ElBer882LdwXHUwMDAxzDbD+Y3BQ0gg3kiDXHUwMDAy/HvK0WQnn1x0YG1cIiVauzb3XHUwMDE4jzg5tYpcdTAwMGWgg/FfTzBcdTAwMDDmXnBuj5OrZ1x1MDAwMVx1MDAxNLKH5I13+Vx1MDAxYlx0SFNvqDVFy43PTzgmb8+EgJSPUdrCycVEXGLp2vZ84lr9OE+tUWi5+VUr//D0jk11dFEyi2PMXHKhltkosqxcdTAwMTd7XHUwMDFliJris7uGQVx1MDAxOYzyiVx1MDAxMTtnNtGZwJ27a0TSwPWZ+ued7T1cdTAwMDSoNzb1z0dmTs/kOpdPsORtV+z23enavszvXlx1MDAwMiBcdTAwMTJq6v757fRxXHUwMDEy266CXHUwMDE3dEokSEDMc9wlnpN8KW2dXHUwMDE0Sjc7oVx1MDAxOUsxOnnQeVx1MDAwYu36XHUwMDExp4O7fUH3zoFcdTAwMTXR/G/W6NblNLWhidzlrVx1MDAwYoFSi1x1MDAwZt2Cyde/a09kLNvy+3X1mPC6UIRcdTAwMTOvaX972nI3jlxiMs/HjofCsVSR+anXy+qHXHUwMDEzPFx1MDAwNWtcdTAwMTK+f+hIlG2sU9fAkNaDyVx1MDAxMOzfR+05MNtcZm9dRr/R90NcdTAwMDJA3X7zXHUwMDFh8jKqNnRcdTAwMTCAvzaryiylopOqXHUwMDE5Tyi7n4t/eZz881x1MDAxNLboSHmiXHUwMDFjXCKkXHUwMDEwd82gXG5yXHUwMDFm/HylcjVDm8p1KFx1MDAwZShA9txqXShsTqrxyY9cdTAwMTjTs55cdTAwMTftRunPQ1winHE2O5+qb57BXHUwMDE0IPbY0p9cdTAwMTlfXHUwMDAy7tVfXG7RVI9tmlx0vsOrl4TYr058kKNFe7TZS/CvnSNcdTAwMGY2UMFWOfnNUt36elx1MDAxNu7ww1x1MDAxY1VcdTAwMDP968cwXHUwMDE23Xb3XTpO8lx1MDAxOXhU2ZB91kKKPlx1MDAxMHQ5loJmPkDe9Fx1MDAxZn97I3y9YNg9fmOvbVx1MDAwMPjurk2zqNmN0Fr1/l1cdTAwMTAhPmJDq1xuIV57ZUTUXHUwMDFjtNVcdTAwMDZcdTAwMWTj7o1cZoH3vObyTlZcIs+qXHUwMDFjTlx1MDAwMzfdu0XZsbf7pP/K/lx1MDAwNFxi3b5cdTAwMTJfXHUwMDE4kbqsgkjzde38zODV3+FgNHeDXHUwMDEyXHUwMDFhXHUwMDA3Sj6+XHUwMDFlweCXSV6I75zEse2bgpiU/qo3vJa1PXNcdTAwMGVCVl85PCE0wVvRi1x1MDAwNFH/rrWed/TMvbZ2Xj7LvuuehDL1XHUwMDBlXHUwMDFknDyl5qggmnC9j1ZKoZ2vL9th91x1MDAxOF2T2Fx1MDAwYrpiNizJVppj3S/GotvuWDZRpVx1MDAxYo/8zapJuSMjgDuBnFlzqjJcdTAwMTiBe0bY/e5zUtA2zV9cdTAwMTC+Z1SV+IP+8Fx1MDAxZDfDelx1MDAwZVFdzFiJ1/alXHUwMDE1bv9F7szHuEigTuN/qd9yvLFgXHUwMDEzKoCmQotqXHUwMDE4UkJej/TfXoRcdTAwMTkrnXxzRGPz5ttfR/7n7TRJvu5HLrVcdTAwMThcdTAwMTZcIlx1MDAwNsC9P6i/pG+1nP2n28jY2lx1MDAxNpVWqjhZQWDyS/ysrblr3cJEjMBLe+CqaP7qkde2wa9cdTAwMWFcdTAwMWNocyljwU/IoVx1MDAwZW7OjET34Vx1MDAwMbrNQy2fxTGJ+v5cdTAwMGVhdc9arlx1MDAxOGNcdTAwMTm/ejVXj33c5NH860XFaahcdTAwMGUg/Md91emeq3+ByOVcdTAwMWK1SO1cdTAwMWLXQFx1MDAwZWpufyWhj39uf/hcbq9BiYkszVx1MDAwMSiw9f2RXHUwMDE4XHUwMDA1YFEg6qVNMU+k5l9Va9lcdTAwMDFcbi1cdTAwMDPyeJHlaMBcZvheu3T/zLdeTUQvP1x1MDAwZlx1MDAxMPjzdCjaT1qYXHIu//U/s41tOXP9XFwxXHUwMDBicGNbJ/S/Op5ryGlDw1x1MDAwZfu25ISBn1nwsCVpc3Pva1x1MDAxOGKeXHUwMDExXHUwMDAyOueaUPuKtOHQ8vxcdTAwMGVcdTAwMDZcdTAwMDTJ147lMo9cdTAwMDGFv+tcZpzJPe3fXbeQOVx1MDAwNFCErDJufqRcdTAwMTbyY/mB4lx1MDAwNFOXV1x1MDAwYs9rffr1eoq0t6KBlFx1MDAwN5KA6LxcdTAwMTH6yr15hmeUTem6NbSfXHUwMDExXHUwMDEzvVUlJj/aS4ZPfPjB843AXHUwMDBmfqEzXG79tClcdJxcdTAwMTe1o1x1MDAxZiyZXHUwMDFj7lTJbXGCXCIwgrGxWqEzJWcgXHUwMDBiXHUwMDE0XHR9abdNpULqtV6sy1x1MDAwYspcdTAwMDFcdTAwMWN01Vx07a9cdTAwMDZE5TLBKreHLT+c51ZcdTAwMTjb279cZkWpM3RcdTAwMDSqp3xlLq0xf9TxuMhy6EVcdTAwMWFcdTAwMDSYrIeRg/bsXG7sm1x1MDAxNkIlqar0WD/UVlxyXHUwMDAz+WbcY/tSNTFsRHrPqZXny4dcdTAwMGLAx/QrdqfOuOsp/U9cdTAwMDfjbdXzm1niR9dOXFyh2vZ5b07ef819lUefaVX3XGaZOZ5Itf1Yg+40OzGL8Jeiq7xcdTAwMGJHXHUwMDAwbTq8mCxAzCijZDH6lfJViqZTdj7U+oBMz/o/v4Brn0XPXHUwMDBmXHUwMDE1+IS4Z3XNSds7vydqzJ7A8fbsoVx1MDAxY5BX0ipa75mFIDXbkpPRhr0y6es82Dz4LKxcdTAwMDVcZomK6n+WXHUwMDFjg6Yot3LNdJ/R6YGlnVx1MDAxNlx1MDAxY7q8QabomFx1MDAwM+/Ml/RDtr56VqfAiYJcXFx1MDAwZkHZf7PG4PNVi9L2z4M/N0NiJFxc9j4vY6edt/ckRn+zXHUwMDFjXHUwMDE1mk+tXHUwMDE4P7fX1YBkwfGqO37jzJbjWLJ29b1fNfCWXHUwMDAxXHUwMDFmXHUwMDFkdYa3aVx1MDAxNDFccqGJIa9Y3J8h5/ZcdTAwMDXz0XxcdTAwMGJiN+l/XHUwMDFkKKb/zY7ik41CzK3HidDCkC5cbn/VTShQUXfTwe/+XHUwMDAxzYPNeTZujLJQ5lx1MDAxOXNsV1x1MDAwNv9mnerEXHUwMDE1Wy5CkfX8sXFKakjdq1x1MDAwNFx1MDAwNOBcdTAwMDaRXHUwMDEzWOnCrzmZXUpcdTAwMWYh053PXHUwMDFiftTbn+cgKaJ8XoH/6mRcdTAwMWOV/1D3pHma8o9vXHUwMDE141xcMjDC/+1TpMkzTG7duzvvXHUwMDA3v5ndfFL5NbhzzFx1MDAxYm12nYDG/vUk1cuPW1x1MDAwNocwN4vzXHUwMDAx4nO/mbfvYSvgnvycP7lcdTAwMDWngiF8UVx1MDAwNmK28fxcXNCv0vfzK+FqW2Q1yDu3P0/l1q9cYiAjSlx1MDAxMaxLP8GKQ37P2M2pfZ1jXHUwMDE1y26+jrZcdTAwMDcwNu08gUUo249cdTAwMGbwWjxgN2BcdTAwMWNpzshFv1x1MDAwNSxcdTAwMTRmhU8pjJ5cdTAwMTf4435cYuC5XHUwMDE469fQgPXuUVxc51x1MDAwMPrsoqT/65lh/+uZcYPwXFzD7PY/MXtcdTAwMWJsmireXHUwMDEwm+EvnYs/OIBcbjC3bvSMnUC8XHUwMDA0vVx1MDAxNPNquDXjty9MV+XbVtGthDJxrGtcdTAwMDaVR0044izT+Fx1MDAwNUHqLkiSiEg2bNjbKMOfRJRfXCL+61PmXHUwMDA2XZTyPX9NyZvYdseXKG7OK1x1MDAxY+1+cmv91ok5P/nyyyxcYv+aT4mYpVx1MDAxZaTtrk25oLJNJ2Z7gpNNXHUwMDE5XHUwMDFhmEHm86XtoO+llG744ach0JAgq4Zw0ZRL7vlcdTAwMDf1OVx1MDAwYnHihsujbCNiLVx0tlF0XHUwMDEzzVxmu7y0kT7xXZVrf/KloyrA1knD1+01cP6b8yBcdTAwMDCf4Ht5J1xiWtR88scoxJZRN1x1MDAwNfvVXHUwMDAwg+95vUDIXHJcdTAwMTeHXHUwMDFmspuU/KSo3Vx1MDAwNF+suVxcXHUwMDFiq6dcdTAwMDJgS6a6+zXn18+Xh3r30mSMU1x073vntNtjpF4y7+lcXJ4tb7JD9D9cdTAwMWSrbFxic/NXm3idx71/uFxc1pNcdTAwMGLInPRcdTAwMTf0cLdn1UdcdTAwMGWfNFajgI8j6IKTNUhO0j5Gsv0xu1x1MDAxMEE238t3Zq9cdTAwMDCDNVx1MDAwNzz+XFy7tTrj8nEnyI7Q/2bXaYNcdTAwMWX0Tu3Tl/KuaVFcdTAwMWS0TttcdTAwMWZccu9es1xc8TXznVx1MDAwN1x0IJG3h6FcdTAwMThye1QnWfzcP2ZlSlx1MDAwYuJcdTAwMDFcdTAwMDMmQVx1MDAxNVx1MDAwMG6E+VxuUrFb7VBycYIvOvL5pPzm+VisOTDiUpy+tpi+2Wv/5uDsL2Q2bp+CPb10XHUwMDAyZPfHQ1x1MDAwNr6jUF1cdTAwMDBcdTAwMDHo2y4/Xlx0t+VcdTAwMTn8+Vx1MDAxNlxu4GYs9XLrdakrvs3z5dtlaVx1MDAxZrBaheyzXGLDnoFcdTAwMTDcXHUwMDA19eBcdTAwMTVK89pcdTAwMDRIW42Si9NxxHhY0lx1MDAxYTGS73N0vVx1MDAxM1x1MDAxOFlcdPTvLFx1MDAxZbWo2WGZ3F6Gbrxl/3nCmrVzXHUwMDAxMaJcdTAwMWH5e25KwK9dXHJgoVxceef7x5mKXHUwMDFhXHUwMDExN4qFfquQf4B+wH4nP1RebM/5gL2yXHUwMDFh9T5cbrHCaFx1MDAxMlx1MDAxNj/NjaOp4K33kmP8xbxcdKlcdTAwMGW1Q5iLI5ptn8IvwXytMiOlXHUwMDEw23X6ZjTWrVdedlZccpbzS55cdTAwMTjw0vvEyNBcdTAwMWV2W7J8XHUwMDFkskVFuC6agV9cdTAwMWNWXHUwMDA28tU8NdHif8uLM7+zk6MkYVxcuoRrnqVayqv/4Zw8Ztd2vk7vey7hWnb5YdFv6ZBcdTAwMTZcdTAwMTfQwEK/84VcdTAwMDRKxFx1MDAwZlx1MDAwM2jyr6fzk1x1MDAxMNXWJIukXHUwMDBiw8j9QHqaXHUwMDE2RYAsXHUwMDAyL1x1MDAxNVx1MDAwNaf73lLsa3u/oifBblx1MDAxZU5duf86/yhcZuJkcPttfaWvXHUwMDBi8IB2a6xcdTAwMTh6g+9dMerBOcW3wzbx7vFS3ZZ2MOAkd1x1MDAwZjI8+Vx1MDAxZlxyhZRcdTAwMTRcdTAwMGJigcQ72lx1MDAwN8VcZlx1MDAwN3lcdTAwMWTPZ5JUhpmiS1MuitFAeFwi0LEv/iw2mta6VitcZlTANIsgeudzQjdcZqSVQqlcIv6vz1x1MDAwN1+Oe9Ddh6JcdTAwMDZW39Axdq/a0dJcdTAwMDLBolx1MDAxN6mldFx1MDAxN9akzr+v3DNdXHUwMDA2XHUwMDE4XHUwMDEwXHUwMDFhni+seYJcdTAwMDTj5FJekT2VgZLWV+cuz/LB9m1cdTAwMTBcdTAwMThfsVCAloeTKSfqOFx1MDAxYmpj/+uDXHLtXHUwMDA0VVx1MDAxZOe8jdsv5Xru7FYoXHUwMDEx6o40ndRcdTAwMDb1XHUwMDFiXHUwMDEwZLvPWviSp1JcdTAwMDCF279AO7NcdTAwMWGUtMcnRPkjNDrGU3RcdTAwMGZhlvjNaFx1MDAxYe7qoVx1MDAwMm/LTmav0LZcdTAwMTdcdTAwMTRo7Dd28lv2mZvzn0ZcdTAwMTHawrdcct5cdTAwMWGZrk33M09+g2lv61x1MDAxON6XfTU5pXG/reSdMDpcdTAwMWX+dJbbmY5sWEuMYP9cXDXLNu9cdTAwMWaHwVx1MDAxN61CuJJHlu+ObWSdaTiLbUx+ObLvT9z5IeoxXHUwMDA1+NOtPvq2Ya79Qlx0tj/cPFx1MDAxNnH27VJZvHbWwS3j7cHqsOk7Yo6O+Pq/wo2lXHUwMDEwnFx1MDAxZlwiTXv7paVcdTAwMWJBozBA2FD/9YFGUCC0Wr/4u1cyaFx1MDAwNUz89UxcIvT31aBcdTAwMDE+ePEo0O7A311cdTAwMGVnXHUwMDA373yLa8NcdTAwMTdcdTAwMDVfXHUwMDE4hYvtMdxZXHUwMDE3ILbzR6dcdDRcdTAwMWaT3k5cZjQwu1x1MDAwZULkjenDVkk9nDHnlWek3Nd1XHRE92fdW1/hvMdcdTAwMWPBL1x1MDAxYeNUf33Vmqiae9d67JoxStSPXHKN2JikoOklLWhYyc/OKNtcdTAwMDNcdTAwMGW+5/n1Z6JcdTAwMTEtSldi7NrThXaKLlxm1rNcdTAwMTjeLVxcXHUwMDA190xbL7eailx1MDAwM/WNXHUwMDE1XHUwMDE5quhUkjbcf3qamDxhXHUwMDExMHJE22prOTlhm59cdTAwMTTo9jY4IT+mq/BcdTAwMTFcdTAwMDI/7MKQnMztl76Yd9iyU1x1MDAxNTlELF9eMKd/YfWRkVx1MDAxMyTrwaU5XHUwMDA1P2B91Znn9Lk4v/mTslx1MDAxZVx1MDAxNJRcdTAwMDUoXj5cImrUXHUwMDFl0/A36/jrgOm70sWKXXEjkNqTU2B/noZL+0zVgvqnNVx1MDAwMqNqXHUwMDEzh++F62SK71Uzd5HH4/BcdTAwMDb7vWJcdTAwMTTa2Vxi17ZcdTAwMTnlUnKiom1a2j36XGZFxH7eeaC59mdcdTAwMTTA946t3eSi2Izc2lx1MDAxZrU2XHUwMDE1XHUwMDA1ZP+re+SsXHUwMDFkXzrf5D/da/ZJXHUwMDFk8X+63ELSkNeUjLSkmOqj6t2pTWr0455R+DhR+3mi225cdTAwMTm0Xa2WIFx1MDAwMSUuOVx1MDAxM1xyiZPW5fXq2NP+9I6f9lx1MDAwNVx1MDAxMLZ0ye3QTlxicPzVXHUwMDFiQFxiXHUwMDAzrI9LXHUwMDAw/3H9XHUwMDE30Vx1MDAwNP5cdTAwMWUxVsOTdLOHUlx1MDAxNa7XLFhsSNNcbv1cdTAwMGXVOPPRm2+i81N04KHOXHUwMDBlrIQhIbXikXPreX85xkXhXHUwMDEybMxsycNcdTAwMDLkclx1MDAxN7u9/4xcdTAwMWZU6jH6dFx1MDAwZtvc/jg/XHUwMDAzbdBExZTHVMzJ61m/PfNw1MRkdflftVx1MDAwZrdfZO23/etLXHUwMDAygbN9N/+v11xmU+x5XHUwMDFlXHUwMDE3XHUwMDAyXHUwMDAwePWaXHUwMDA1hjtwn/dj0Vx1MDAxZl4tWFx1MDAxYZPEO9mdh6JpT4pfUn1cdTAwMDa8+kV7j5T2RP03pFx1MDAxObOKXHUwMDE0UNs88Fx1MDAxNCdcdTAwMDXgXHK/l1xyvvw7cvaWmlx1MDAxM/NcdTAwMWVHvnb5LeBcdTAwMWRGlM7xftx70aafi4bHXHUwMDA0c/989bFcdTAwMTPE4NC9P55E86aWjTNcYl59cjboplx1MDAxZexcdTAwMWXR/OhcdTAwMTIuXGbUNlx1MDAxZThzXHUwMDFjwM5ToCe0QFx1MDAxZpfyXHUwMDBmz55cXOjDuuhbpSGQ729cdTAwMWMgLPV15tlLa1x1MDAxZVBcdTAwMDNS7Vx1MDAwNlx1MDAxOE7iXYc4yDNsSm3VKltDnbBcdTAwMGKQ1X9eM+7Y0LO7R//mkPfUiDjie3t0XGImZ6TTl4lFySBY4lx1MDAwMf5Gi8T8YoI18Fx0a6/wQcF8o87BI486zJhcdTAwMTHuz9ctSVWzgbPbs47+bWZLkD2RcefHM2jcIS9pivjo3XVcXEkwNkH5iHHPuH6qXHUwMDE07+2rXvbn29dkw1Sh7FDj7stWoWQkhljckXt3af6VW4hI/NyUq1x1MDAwMPYgnlx1MDAwMHlcdTAwMGX8SSWI+cFAXGZELEN3nlx1MDAxN1xuri7CLeG7q1+lo+LwXHUwMDAwK/u+o1xc7se27Zpj4ztB4HB8XHUwMDFkg88wKk7iXHUwMDFkQ9o1t2a77M+VXHQjPt/hrblGXHRcdTAwMWNcdTAwMWPbcFx1MDAxN1xmjaZmctCQuX32nFAzw/vn61xinlbqXHUwMDEzwoF+fT8/XHUwMDE1VNIrXHUwMDFkftWmPyHUXHUwMDBmXHUwMDE0MsT466FcdTAwMTbtXHUwMDFl6OD5jkFO7NW+PNN2K92zfzdcdTAwMWU8Y71Msn9eTPLtM9pdnklcdTAwMDNcdTAwMTWdeJz+01Y3R8t4cFxmSnDjQZe/6rJcdTAwMTeyU9BcdTAwMTdcdTAwMTk21/LTk6ZC/lx1MDAxNnuGyINcZtcz5nhK862iOmCJ7/eeuVx1MDAxMVFuMP3tjeK4kyE/TIQ8otdvXHJcYvuUXHUwMDE2KVPQ+1xccUdcdTAwMWRKe3hrOz3CkTEjXHUwMDA2W2PEKir6ub17rDzkjW1LK3hZ4C2KXHUwMDAw6WFxm51cdTAwMDfuTmAx0lxig/tcdTAwMWNcdTAwMDDKnmDwXHUwMDAwgpXaKS9cdTAwMTnGKupDu53/fODgXTR+S9n/+VtpXGJwY0NG2J6B9KI/8eVDgnZt6SiFhox3rHvEKnb4tXvmhzOvQtooxq1cXFx0KsaHN2czvPaZWexH1FZcYnXa4rNKU0ZlXGZdXHUwMDFmu6S8kVx1MDAwNzhcdTAwMTJgLetoU7b2T3LIdCuO8O7T8OSJge++XGLMKWnBMHh7+7xSKfJxt2Wru//2Mt7z+iemy05a/IchXCL1XGaYkorh/KdJuXCu2Vx1MDAxNXYrTkIoTJN9fNCydEt75aBwVHmZbybbXHUwMDAwU0dcdTAwMGXvhdy9q6xcdTAwMGVccnG+sfCRujHHXHUwMDAzwl+NMY+Nk1x1MDAwZf/nk9dkXHUwMDAw+19cdTAwMGaA/Vx1MDAxYVBCeDtr2UA5mzas1PxTq9LQhZEwIfMtxlvgoZtNo1LlUfKRxKxcdTAwMWIsfOSsXHUwMDFkRKLcUSnW/aiixl5vXHUwMDE5UVx1MDAwYjRn8va9tJ40XHTemJWV+bjU6tjx+3t+jVx1MDAxZVvD1pa73vRcdTAwMWIkUuW7OUHlx3vXXHUwMDBlfp1DoHJoVSpTMq7T83zDXHUwMDFkXHUwMDE2XHUwMDFjJlBcdTAwMDDV2C4p5JFBXHJ+6HHyv8NEyaXfpzxY7J3Ru4v2+fM72n+qqtexK3aQcImV9nUh6Vhsl9tcdTAwMTPzTGq/0FxcrTu+MMnGtqx6a03Ucde281x0fUZX1SRGw1x1MDAwNXeauDMldW6STFvOMFx1MDAwNf5cdTAwMDQ1o31cdTAwMGaDNKQ52XTuXFxDTbUzLYPupKJZ3ORqcFx1MDAwMVxm/2b7+UtP+798XG5cdTAwMTTyhP/+w5BTW/VcYvzl9lxmesYhNjXFXHUwMDE5XHUwMDFijz/dd8CgJfO+9rhJRPBcdTAwMDLb319+Vk/Wn7hcdTAwMWP7bk+WkyVcdTAwMWZcdTAwMTGf1K+K5Vx1MDAwZVx06MJuc9SKk2mzn/xqjPHbf9yhVPC1p87/j6bX4uP8mJ/RwoiB0yfJV1x1MDAwYqyHd1x1MDAxYzUmeVd/9YFcbvHD27uy6vrgXHUwMDEzd3Hv9o+nbzctkyuyKSzPaSdz0CFcdTAwMTWKfYvgmUufaFx1MDAxYpPwtfNcdTAwMTjvQYtcdTAwMThXwDzD/z1vr6LCNVx1MDAwZlx1MDAxYl54xqVeXoRzv79+YVx1MDAxMLZ4XHUwMDAzXCLjn4bfg1dcdTAwMWTkiDu+qrPw29hB+/Pdv1x1MDAxYVx1MDAxMTH2crVby+BKmYTA7lx1MDAxM1R4vPzRM1x1MDAwN/Tgdym6Z9Oxy1dN34PApaVRijyFzdpcdTAwMGZIT1x1MDAwMIpcdTAwMTZcIlx0XGaIOLz2687BKFx1MDAxNv7VKu7d4SH0/uvRfT8vXHI+XHUwMDE50K29YKP+aDtE/aebXHUwMDA2V5gz7P2qR1xuY+9cdTAwMDGzXHUwMDFmTY9cdTAwMDdV1miOyZVWXHUwMDAyn202QlRcYiBZXHUwMDBiK1xiRVPgXHUwMDE1cFx1MDAwNH6yrVx1MDAwM7JxMVx0Ly/GXGKUpO+Ym2pcdTAwMDScXHUwMDAxRUvCrdicOJuYvz1ie/qlfVK+4vdTeiPyf1x1MDAxZVx1MDAxZuZcIlx1MDAxMc2XkK/6T0gn8Vx1MDAwN/5cdTAwMTI59VxiXkQrXHUwMDFketaaXHUwMDAz7ZufY/FcdTAwMWUmO/986ziPXHUwMDEwM4f5+1x1MDAwYoXSXHUwMDEwxuioIyj3f35cdTAwMDGG4GSU8jd/xMjxn1x1MDAwZbjZXHUwMDE1+WN79sC/XHUwMDA3XHUwMDBmcLtcdTAwMDRwc1x1MDAwM0xTkMJTxt/XXHUwMDFj+UKsXHSav8r78/RcdTAwMDelq/d4YbU0ddBVnWZuPTGKXHUwMDE5xKJMo1x1MDAxM592JyYozJfnkoEsgbtcdTAwMWXMXHUwMDE4JeyZSFHHs/3AXHUwMDFhVqg90Vc3T+JSXHUwMDFilVxibHWpXHUwMDEzy2hMinJXv2japk+rnNwxXHUwMDBiXFx1XHUwMDAyXHUwMDEx4J5H9s+zYVxi/7RcdTAwMWLnI0qIk/vz96xC73Jxb374QNV1XG7hnHT7kl+t5GvK+OqESdA0XHUwMDAzrXVFnFx1MDAxY4ZcdTAwMTlcdTAwMTkxOmH09zXymLe51lx1MDAwZlx1MDAxOUP19mDgXHUwMDEzXHUwMDBmRjvpL19WV06lhvJA39Ctj1x1MDAwZVR1OEAoUy69LTQ1iDby/V2ne/3kqfGNbd1vLW9cdTAwMWS48lx1MDAwM62Cey7FsIRVjLlfmX9Xm5LwvS8+jiZcdTAwMDJcdTAwMDLqYs9WXFxcdTAwMDXmXHUwMDA3s1x1MDAxYeraL2Lf9e7JOzwj7ooqgHxu3/7bjCRcdTAwMWHBXHUwMDA0s/GOfFstjVj6pIJx9Vx1MDAwNaE79jn7h997rVx1MDAwZvWG/8q/8dGfZzv101x1MDAxOWP1R+8l4NPdZcfuo9+fJpnWx4kvXHUwMDFh0kPRzFxcfT3woWemZLv5TcqMXHUwMDAyd/A1XHUwMDFkXHL/XHUwMDBiq+3Gzmy1we8/bdv/O0NVfebnZGP5Xdu6vHlcblx1MDAxOVVcdTAwMTfsOrfU9jpGXHUwMDE49NZrXHUwMDA37/g4XHUwMDEzRdDH0+FOv/T4mFx1MDAwZVxiXHUwMDFhSEhmrbCsvuNkO0vgSe2Z7Vx1MDAwYp9dilx1MDAxZLePk+V7Xqxt41x1MDAwMvzdlyhTR97gO4b962NcdTAwMTX/9bGyXHUwMDE3XHUwMDBi3p7hfHbm4OhcdTAwMGZcdTAwMTOpSvJcdTAwMGLP2H5cdTAwMTQz91x1MDAxZn41UyDMXHUwMDEyuWZcdTAwMTTlzLu4Z/Xj02OiiElcdTAwMDbY6CZUruvfV9hJXHUwMDEzWXBj9IuQtVx1MDAxNuBcdTAwMTdKL3vQioongr88b2q3NqKXXGIkyDs49G7MatZnfFx1MDAwNI+/mVUh9Vx1MDAxZozM5fe+0oXo9/qFiMr1zC4xwE+eWfv/uKdcdTAwMDBcdTAwMTMsiGHXvkDq+0BeXm48slx1MDAwNlx1MDAwNc9cdTAwMTSclVxmZ/1cdTAwMDCSfqdcdTAwMDSz/+2hzDdz+N9eXHUwMDEysC9cdTAwMDd16C6sI3/hVIhFe+eKbDaPPbZdV8bq5m8vl5SA6O/22Li5xdBcdTAwMTOBXHUwMDE390b9PFx1MDAxZVxcXHUwMDEwn7DW2pu/XHUwMDFkNYIkP/GMQ3+wXHUwMDEybVx1MDAxM1x1MDAwZVx1MDAxZWuwX/gr/01cdTAwMDT/mzS2b1x1MDAxN6FiXHUwMDE0zDJbwKWDP1x1MDAwZkCib135c+v7XHUwMDE2Kjv5blx1MDAwNCNXf1U+g37e/O3QjsFrT1x1MDAxZqCQUFx1MDAxOEv941DdR74/XHUwMDBlnXmjJ6xcdTAwMWJL8dO3XHUwMDA3+3OQV5qNXHUwMDAzQmNvXHUwMDBlKSRcdTAwMWNcdTAwMTjgvttcXGOlsVx1MDAxY/R2m410wV7AJfcwKDE78flcdTAwMTH2XHUwMDFjgSHLRIFcdTAwMTFxXHUwMDAzuWyGN1x1MDAxNN77+tw1wHafXHUwMDAz7v2jVSvMXHUwMDFh/c/3XHUwMDA2RsTV+Mn0vUOW+imtR8RjXHUwMDFmnWd3sFu84yaPLGqU1fdcdTAwMTfwTZvEJIZ+zJtt+l7fI1x1MDAwM9onytMxxuRqr16+PbdWZY61oVx1MDAwMevKkyxFbVx1MDAxOVx1MDAxZo5Q9K7H7eZcdTAwMTF1mzreeO2ahfj+m1x1MDAwZlx1MDAxNHBcdTAwMDGwt1W4Z31ZV1x1MDAxYvQjnvi/vOhcdTAwMWPSoPPaS3lXXFxYYuhcdTAwMDNcdTAwMTblNPSgmGtieYTf2PyhXHUwMDFm9KLOoCBcdTAwMWHJ614gfe8/Idm9QTNcdTAwMTmV5biio7aR4d1Pbn+EmLOFqjTzP08gxjKeXjHes3M22XC7XHUwMDBmhNhdK7Zo9Fx1MDAwNfSQcvU5rzlcdTAwMTFx1FStXHUwMDA0wXdvzb2PzdJhXHUwMDEyz3LtLfft0bDRmyPMs29mLFx1MDAxZnBcdTAwMDNcdTAwMDJTXHUwMDFh1/++XHUwMDBiTMDIz7VcdTAwMDP6n1+JLFxyseKGvXfPzudcdTAwMTB/YoRmXHUwMDA3XHUwMDFh7s9vMN6u+jV5Pov/j6r3WHRUaZpFXHUwMDFmiFx1MDAwMd5ccnHCXGJvhJnhPUIg4Z7+XHUwMDAyq/f/nTvbpltcdTAwMTJFVWZEVmaEXHUwMDFjhWvMmmx4NFx1MDAwNVBcdTAwMWNLXHUwMDEzv0uCfWxS51x1MDAxZrWpXHUwMDEzl352feVAt7fOKN47nlx1MDAwMqvTXHUwMDBiYPKPbUh7bIInXHUwMDE0mKDIh1x1MDAxOYT9dFxiNVx1MDAwNVx1MDAwM7b/x5eafV9WtIVcdTAwMWX/9NlcdTAwMDJvakCkf2hV11x1MDAxOSetXGam9+NcdTAwMDShx1x1MDAxYv67XHUwMDA3KjY20kZfuWuOfF/m/jGq/8W2q+bOL+CZM1x1MDAwNopoIFx1MDAxMExdvNbvWpbRP3pcdTAwMTLutaRa3+fOXVx1MDAxMnR8kVx1MDAxNlx1MDAxN4JskFZjXHUwMDA2sCnAXr1/l6H8XHUwMDFiXHUwMDE4XHUwMDA1bW61Sz/4YEFjvLW6bUOhXGJcdTAwMWbRQvDiwmdcXDdbI/+rSbLwlv7OQN/+9SqpXHUwMDE0qotx1sHT+ydGfdTMXHUwMDA3XHUwMDFkU8EnUUbq8f0hXHUwMDFkXHUwMDE5LLsq7N6kbq/E40PpXHUwMDE5aJreNT+j+798p1x1MDAwMr6p/Xm7hlh3MCm+auvdK6/cvfK3XHUwMDBlzVx1MDAxZq49c3Zya3s/pruGwP63h78mNpDff/PyOpjtZdo8PJ2ZXHUwMDA2XHUwMDEypU7wKcMxfYZ1yeJPznzsvNiVxdi1/NiyVi1lXHUwMDE2nkCRkcR33+urztV7Nu9xn1M9V+ZcbjT/+mdOTGm4zyfhITc2+GC9+8pfoH3XvP+wknbGmXP/zPsl3MOZxbytv/NcXDGDTILSJ3lvT1x0cDlcdTAwMThs7HnJUazPyqFYXHK82MxuvbX51DqRpKE5kKd299ewuHTpXG5KXHUwMDEwcM+cXGZNk2Do79YpXHUwMDFh0jnaXHUwMDEym/9PJ9HF7Vx0I/5qrWesO3RcbrH7xP85UNT/TqIyXf/ov6LXXHUwMDFldSSuwFx1MDAxOFR/f+avcFx1MDAxME+yuFo7jt+GXHUwMDAw+XbI7K1cdTAwMDefQEjuXf2kPtNh3f58/flkNLVvnnjoJCxcdTAwMWF599J95K2G3MvK6OrdW8BcdTAwMTDIXHUwMDE0mNHWq1x1MDAwZm3wXHUwMDBiXHUwMDE4XHUwMDFhPFx1MDAxNLr7QEH31/6qYEZcdTAwMGZwUblgLj67KexLXFy+zv2xXHUwMDE5JKn+mFx1MDAxZolcdTAwMTSldPGhY1D/zTtEVa1q+5Xfbdi48IchXHUwMDBiXHUwMDE4oVx1MDAxYsDwki5cdTAwMWZEsrs0XHUwMDA2XHUwMDFlf/dwuSF+//VcYodQ1KjwcdXOrZ+7XHJAf4ghdEbxXHUwMDE29Vxit3JPamNVzYNocptcdTAwMGKOX1x1MDAxNNdAXCLfPuFcdTAwMDCDI3tutlx1MDAxMvfmr35cdTAwMWX5qHdEo8f/fLpcdTAwMTXYSFx1MDAxYry4Pdgz0ekt2vybY29cdTAwMGJlaK1cdTAwMTZHrDOOVYCFY1x1MDAxYVx1MDAwMFLTrduna3uzv1x1MDAxY3vGratXav7EWnzIr59dmjUo5MtM1Fx1MDAwN+vQLy43On9cdTAwMTDFIEjreYpcdTAwMTmXJ6JcdTAwMTOySCjFIeC5NrXYUVx0NeYpeWtIRZt8XHUwMDFllDGp/uov7+ti8J+fhTOIV41cdTAwMTbU71x1MDAxYW0/UFx1MDAxM/Rr47tcdTAwMTbI6ZvQS+NIN8zrTNZcdTAwMGXXncskep9HaL9cdTAwMWZcdTAwMTd8XHUwMDAyelJFiTm0Z6TaY2T6SFx1MDAxNFx1MDAxZVx1MDAwNdSbXHUwMDA2Mkm6e1xcTlx1MDAxMoVY7sA3xo1Bfd/CXHUwMDFm+59+OZE2aedVUVx1MDAxM111bdEyQFx1MDAxMH+fOHo5oUH+4rTJdCi+XHUwMDAzk5ub+J5cdTAwMDchj5ZqtPkv5lDz9q3jPHs+XHUwMDEwXHUwMDAxg52F+Fx1MDAxNrLI00aw9eyOksV7eCSr9YWSXHUwMDEz8VZ6XHUwMDE0jGF7cklcdTAwMWVoKsrdvGRt0rWX/I1Aolx1MDAxMtIz5KNcdTAwMGWeXCJAYJXfs/+FYv1fT16vpPNcYuhQ/M9MwFx1MDAxZWOYUl9/fUA/pdVcdTAwMTWt0dbHZUcyaVx1MDAwM3JcXPO/psCUg1x1MDAxZkVcdTAwMWLgsCRo/z7rV9qr87010LZbXHUwMDA0Y4NkTM5cdTAwMDb6x3WqXHUwMDEzqFx1MDAwM1wiIH3v+9jnIFx1MDAxOWv410NZprbyN4t3boBJacFIhe/31FCV+8FVcqlv3pSzWWS+r3kpubnPNVx1MDAwMfva11x1MDAxMCw9apCaSsDgXGaUw1gjyDiyXHUwMDE0y09I8+tcZlx1MDAxNIZEXHUwMDEwf1lcdTAwMDKn43JFXHUwMDFkXHUwMDFj6P7zlohU2V/359/cflx1MDAwNXJ+wUlXnplcdTAwMTk2ouqjMlx1MDAxZk/j8tewdLyhOvywiH/30CxcdTAwMTJcdTAwMDHhioDOXHUwMDAyXHUwMDA22OuKydE6Olx08/D2PtdYpmpHXG7ygYBtUFx1MDAxYoBAYnh5lKOmz2/Laia841x1MDAxNSiPdKWRx/N8ZqvMXHUwMDEwabfcXHUwMDBljazpoZVvQVx1MDAxYo9cdTAwMTnBLfXPiyBXWvrx5zdcdTAwMTVcdTAwMDZy2kQ5c9WxVJxcdTAwMWZcdTAwMTh4tcfvX8/4OFxc9Vx1MDAxNO6B2GKnXGJwXHUwMDFmyG6oxagqXzP8X1xcn1x1MDAxNdpbU2PQXHUwMDAykOy/iZlDTM+H3+uubWyRhJ6iXHUwMDEx7HJ9NT3h8nvB/3qgXHUwMDAzIU+1M/xE9/dcdTAwMTe5jTt/NUfjYFx1MDAwN8Fv4dvb7dxHKiWB91x1MDAxZIJFuVx1MDAxMVx1MDAwMlxcekmrXHUwMDFiRzGM6H1cdTAwMWORolx1MDAwZS5Zmoaj/6FcdTAwMWFcdTAwMDRu+GlImWuuTHTwOZ/Lu69IXGae7ol5glx1MDAwNzW2ndFcbnNcdTAwMTXxJ241TVx1MDAxMFZBXHUwMDE4XHUwMDEwrEeCuVDRg1ughNgqcaLzdC+NUlx1MDAxMGBcdTAwMTOyu+bWclx1MDAxZp9EkIBcdTAwMWZU1TSM9Yy++GG7XGZNbVx1MDAwNHT7yFx1MDAxZDDcwYjzSflXP9TiXHUwMDA0XHUwMDA2Zz4k/JZQsrigN41Dls5Ny1+2ci3ZXHUwMDE261x1MDAwN/zedU6A/W7pu8C7v5rjNU//cMw/nd5LP2vnd+yf793Kin5cdTAwMWWYSnpppltG+MVcdTAwMTEwTpJbqFdPZrw9XHSZqKFebjdcdTAwMDLTn4/wcZ/BI/12g5w6XHUwMDAwb1x1MDAxN9NbJT9gWIDW9zv5crz6yFx1MDAxN0FcdTAwMWG4f0NF1DZcdTAwMTLxN7dcdTAwMGXKKVx1MDAxOVx1MDAwM2p2nyctXHUwMDEwgTKHbbaVq7FcdTAwMTBBXHUwMDExbYFcdTAwMWH+01x1MDAxNVBAvVx1MDAxOSDx1mqy3utcIsOyr8X6311QXHUwMDA03LpCz0pVRF6TUcGJ7ENcdTAwMDLLh/pSXHUwMDEyhoeChCteherinIGlXHUwMDA3mCBcdTAwMWX8o0v2mq3vyDqeKPG/+ThjqZ5XXHUwMDFmXHUwMDAycv6u4D9t/McnwqWgNe56dOzLLVx1MDAxNYNcdTAwMTlcIjCet0frZD36nGT+83VVXHUwMDBi7ZudXHUwMDFjIWJidtJ6rz80sF9E2PYgrvfPXSVz9beAoFxyNlm4xc7j/771i2xUZ1x1MDAwM1xmvtdEack8eFx1MDAxMvVcdTAwMTXfXHUwMDEyXHUwMDAxSVGzL+prLsPlb4+9/96Rblx1MDAwNPh12/VPd+vxp1lse5cm0Fx0sPNcdTAwMTdcdTAwMTBDXHUwMDA3P1x1MDAwNVx1MDAxMecquzJqy9bgVf9SmF9cdTAwMDeZ765lwM+8jUM8ZaFxNaXsXHUwMDFimHZcdTAwMGZ0XHUwMDFkXHUwMDFl7s5ezZQ3f4c3qq1x88aTXHUwMDBloniY3479PdN2rV984jz+qqHwu2goRTnePVx1MDAxZJeC8v/w3r1ffrHx37rEe3/I6lx1MDAxOYNLsZ6FJDa0WVdFg3Rx15i6yMzy7nlyXHUwMDEzYlx1MDAwNVVxQXyygKnET1x1MDAxNo1OgVxmpFx1MDAwZTpBrIdfXHUwMDFkRJe531x1MDAxZL1Eby5cdTAwMWak9E1EjfL1XHUwMDFm7nV/b6hKWj3+vCx4o0ibtsFpyLh7kjCaXHUwMDFle8/7bbNe45JcdTAwMWWdvy+lXHUwMDEyflx1MDAwMZCrn7YlWnJ5xSu0v+bFzF6NSlx1MDAxY/mX2yBGJuG6J1x1MDAwMzps4rWYqIrClk1//fmj7khXXCJLvWQv9Mw0xHk6LJq9Nb9Utd1cdTAwMDP+jEvlX746XHUwMDE30G6m4MTdXHUwMDE1xIrd59VsfVx1MDAxZmUxqTjK045PeLe7NjeKRLQhnlx1MDAwMXxpK7BH10XDpkJcdTAwMWGa0D5ItvLtMVDA88RTOJnjvYTr0t+9+DtJa89GXHUwMDFjXHUwMDA0zClcdTAwMWX2d+/SXHUwMDEx+Fx1MDAxNl3/hlx1MDAxNVRcdTAwMDZW95PH3c1cdTAwMDfk9+jhNaLgxu2r6PWkMYpaL0UnaKjax333XHUwMDA0mpFEX95cbl37LUCUb/D6Q1x1MDAwMaGyT/SP9uBRUr7gm1x1MDAwMVUwUMOGjpboXFyOsGFcdTAwMGWqdt7eXGLePVx1MDAwNuL2uDwxMvDiXGJ1NOPbXHUwMDE0XHUwMDAyXHUwMDA2eNdccvxXt5e/Ld0v3YHjjP17Nsd75DlbPFx1MDAwMsZ5rkEpPtrvTFx1MDAxM8tcdTAwMWFcdTAwMDFyJ/bRNUrjvXb8XHUwMDE3XGZvj39cIjRhR5JcdTAwMWG6Lvz6nG+FKcztN7zjI2X6XHUwMDFix4yIXHUwMDFk8SDlXvd9VC/MXHUwMDE59Z2vXlF1St3oxH1cdTAwMGLy11x1MDAxM3vNh39UuuNcdTAwMTBvv3zSc9v11f64PGMzpuqj3vUj/UO5u2NcdTAwMWQnLjXSXHUwMDEySd2Seb6ihlx1MDAwMXpbVeDJh0T2mMVpQ1xcXHUwMDE1MiGAjiXhNcL5t7Eh5leYYFx1MDAxMn9cdTAwMDLMm+/vI3Gtg1x1MDAwMU90uoCJa/P3P72Ac/Ncbj/5eni8d/ZP+LZcdTAwMWNDXHUwMDAzl+JcdTAwMThcdTAwMWVadyaEVDZcdTAwMTVUV81quLRFt8JcdTAwMWWpy5tcdTAwMDOSt8Mz8kx0+2T73P7iZ/yB+GFcdTAwMDCq7vVlljZcdTAwMWQykUlXaoy6r1x0bNSHroeUS/wvs3N6h5+hsevh7uLSXHUwMDBim839ziT3/J2g18GF16Ho6lx1MDAxNbSMuIys0SVcdTAwMWImqH1HXHUwMDEzLSd3omGaa+e+o1x1MDAxMs7UKeVcdTAwMDUvyd7Hqlx1MDAxOTSCsM5cdTAwMDHw9H7ox+5+Mv4hcuaTXHUwMDAzK/zKOa6oXHUwMDFmojh9jUzD+5BY4S5ZV/s1eeu57POjJa/EzVx1MDAxM1jTY+ZAMZ2tl/+8laxdyjVP/lx1MDAwZdezV6j39ItcdTAwMDdcdTAwMDdcXDFfnphPmqlYgG+3dlx1MDAxOCNJyHr7q/RKi4tRntDV1ZuOnTGxckhRfEhXXFx1i0Jdal+R41x1MDAxZj2a9JB/XHUwMDFhZI969MPotURMfayy3PNpIWGmTalf70FcdTAwMWFHur96suhKjcYrzOOhiLtve9uS/tfrao5UXHUwMDA1NcLfnSOwqVx1MDAxMpxw515fm/hQOiyjb661XHUwMDFkftQv2tRKXHUwMDE0ePX7amc2U11cdTAwMTg0e7pzOlr9gIVcdTAwMWNP/uXYqIJcdDq0WXBcdTAwMTiQ1rdcdTAwMTKt9fkveKdcdTAwMWLf/NRRgsLyiZ+fUKT+iWOMMpLEgk7Uj2I+XHUwMDE1TrR+Oz3MpLD+zV+VWP43V5JcdTAwMDdcdTAwMTTWeV187tW7Tlx1MDAxZKpsb2PRqJVcXP27zsVL1Z5NXHUwMDAx1lx1MDAxZi7MJtRcXCRcdTAwMDR9M1JcdHXgbzJcdTAwMWVcdTAwMWFzz5D/+vFQUFx1MDAxMPmvxmye2VhGwYyRKeqBoFWLlkqptIhJmX89Jl2gXGag+/istybB/kDBhmHbe2ZAJvb5XHUwMDA0r2J3c0DZkPrlRG/nu4wtXHUwMDAyd0dccvJFMMtFPe2g3+uqVYzKMu2Rinz5XHUwMDEzM1x1MDAwZlZOpy53xrRcdTAwMDVcdTAwMGZcdTAwMTNPzI3b74Q1sGHNXCKwXHUwMDA0r5o4Jo37wjRDufV/+Fx1MDAxNVx1MDAwNp0wT7JcdTAwMGWSg8iLPVx1MDAxYdZ7tFx1MDAwMW48LyRK+1x1MDAxNc6kpf7nddzucVx1MDAxM2ZHv3/W0tmzLvRBbeb65lV/XHUwMDFi84H+kFx1MDAxOf7VcDycud3Et4THiUeBjiXTtf1VS0VTXHUwMDAzUPc86VeuQZ6BXG48KeBlvOXS3Vx1MDAwZr1LW+p3XCJjSWRW98yYXHUwMDA2XHUwMDE4Zzidh6xSxchMmTRS/nbz2k/Oxlx1MDAwZtaypfesnaxqYjSM5bzD07xo0O9cXKq808ZXQlx1MDAwZfBgVVx1MDAwM7VIkXdpVKxxu1LFqJGM+TSxL6e86C6glVx1MDAwN/NcdTAwMThtXHUwMDE1XHUwMDAzgZ85krxcdTAwMDVcdTAwMDG5xVx1MDAxMmfuQNtcdTAwMDDAJlx1MDAwMOJL/03i/3lCOUx2VFx1MDAwYvpXj82ufk74pFx1MDAxNI8r9zub1v7P54Mzh9Gzd8tcdTAwMGbLxyP7JUYyurrnx1x1MDAxY2EkL3Uzmlx1MDAwMi0w22mPmUFbppPe2Yu/ZtVEjSxcdTAwMTjap61mtj5u+of1TjJl75FcdTAwMGZi0+3lozXZ41x1MDAwMFx1MDAxODh5/249KK+W/jTLVMFxTJfwfeb5jOct4sD4zK8v4+BcdTAwMGXONV7DulxmRHpcdTAwMDSRqTv9mHVf4+35aVx1MDAxMIj4h6WYNFBt9OQtvMVGVcG+7Jv7xayv0CZ73TOeuNuG58efz5qWXGJ7xqpcIlxinN/lknuhXHUwMDEwIH/N5z7CvqlcIlv8djeG1qN2r/5we/aC+65cdTAwMGaTZWgpt/pJJ0uOXHUwMDFmTp7txVx1MDAwZvlAb/dcdTAwMDPBV706d10/2JBcdDtcdTAwMTFLbb3jXHUwMDE3XG79RuLEvyypubX/WrSrjq6B97zys/2bXHUwMDBiXT7uZp4559J7TDdKXGLev7++w/fJQ3+xb2L/zU7Nu5ppcO+fz4/33Z5cdTAwMTfvXHTkeCR4KF9n83xcdTAwMTNYo8CPPcmPkVJcXFx0zP5cdTAwMTApSctcdTAwMGLz4MeV1JZu3T7hx645er/8XHUwMDA2YTHaYlx1MDAwNdZnoviYQ1xmMHfPaomeyFx1MDAwNkbOXHKR4UX2c9Twnmnmtk1tmemu8T9/+8ud8vfuK199SFx1MDAwZuNL/UzNppbiq4CZ++NRzCOm+syhLlx1MDAxMD9NK58wW8ZcdTAwMDbdXFxcdTAwMWFem695cUXhqrmfvUNcdTAwMGbO7Fx0NGdcYspcdMsub98k5urBz2lgfd6+veBcdTAwMTG0cyGYlag+xXaLyIJStkCOXCL6XHUwMDAzXHUwMDFk3MN808rYXHUwMDE3L1Akn7lfXHUwMDEwwMNcdTAwMDcpeE3xMnTBjSSiqlx1MDAxZOzA9TdcdTAwMDbhJLIjflrjgVxyZ0cvjVx1MDAxNM39zFx1MDAwZt9sXHUwMDE4XHQ1+lXNpMPWiWFJ0L7nKUpcdHdO/JBetdhpTCalfVx0IVx1MDAxMd16ICXVOmtET1x1MDAxNHfVllbej06UZkLZk2ptXHUwMDFhkL7ZUm/irqRTveP07LyQ/iVDPfhVuuZcdTAwMTd7z1x1MDAxZqKOkFWCKLOzjqbGJ5ayVFx1MDAwMktWZydcdTAwMTTgRCvvXHUwMDA0LdtcdTAwMDLQc0p+g8RcdTAwMGb783lwXHUwMDFidVm+XHUwMDBlobS9a1NDv1x1MDAxNFhcdTAwMDJ4z+B8xy3UuyGI/vl3XHUwMDFk4mKIXX+/p9+8zsdrwaOe6PVYzuxvjDyZRY7WkfGB90FcdTAwMDRviLTTpaYgXGZGXHUwMDBlp0OXp1xurqFNleCFUc+c8rHT/oVcdTAwMDXULyxjmVnekZid/OzWbpPSolx1MDAxMHj/XHRPbWPf/afFRtrdXHUwMDE5YyRLMVx1MDAxNe+d03lOaG/mPX5cdTAwMGUlMlxmXHUwMDEwOXGkXHUwMDFkbShlQlSfd3YnwJZ/KLnT+rtexo+4O2OwQdR55otcdTAwMTbAMu7y/Z3xyzVcdTAwMTRcdTAwMWJDr5pxKdFcdTAwMWRzTFhA354049yEV0xzr9rvPiWdXGa7V51aNuZcdTAwMDV/PUDnX1x1MDAxZrUkP7J2bWU+u0b1S1x1MDAwNeU4WO4/vapcdTAwMDJ6P5S8sFY2dLyZtE6/v+LyPT904tL78SHupEKRgeSwd2J6NFx1MDAwNMbrLvbPd8ve6d3LojPef4JXXHUwMDA2tifGLJj/pyfqOPzHpUdWMcZJdUA2J+SnLlx1MDAwMFx1MDAxNlx1MDAwM1x1MDAwMnv1676fXHUwMDEzXHUwMDFl/Vx1MDAwMlx1MDAxY9XPz5/cXHUwMDEyfkOTZZaxi7xnLFx1MDAwZkVZpFx1MDAxMVx1MDAxM708hPv22W50PVx1MDAwNT8hOSlJJJ6PfGt8UFx1MDAwNq5O+by1dayDXHUwMDE0imHDfvsk6sNjx1F6u2JZKZ5JJnnnb1wiiNpccvzVJ+R+lO5cdFx1MDAwNY4zXHUwMDEyJVx1MDAwYpblW3ye1+eBUMxAZq9VXHUwMDFkp8IyX1x1MDAxZHXuZrfsc6DIXHUwMDBi8KBcdTAwMDH7LfXWh+VVKeE0g+KAe16JPfj/25fbXHUwMDAw3nVjXHUwMDFlg+OjNk4kqjTzv97KXHUwMDA2MYOIUThcdTAwMDZ3kphJIdkoNHlKqlx1MDAxY1x1MDAwMXqhySraYTg3fzO7ulx1MDAxZpVccnhoilx1MDAwMuc5TPskO1x1MDAwMPPqe6XLYpdcdTAwMDGOWCphrs7PxZ/V43frmTZcdTAwMDFcdTAwMDWWun/+hu7gQFB9Ka1695DXVOs2YzdPzHxrKV5ATn+cOPKMIXYomLOKmliZfOZEOmZka7dvUVx1MDAxZrj3XHUwMDE22ozRXHUwMDE25F1gOTVcbpduomlVLWD/XGI74UYgWnVuTFxm0SpcdTAwMTHbeiTid1x1MDAxMcCNmdf909PAIT9cdTAwMDdOXHUwMDAyXGIxMVx1MDAxNkdcdTAwMDTumT49LI+p2G4tqZG/e2vOd9Kfid/V/Vx1MDAxMNgsMG/w31x1MDAxNNWFqWs7qk/zXHUwMDEz9JZiZFxihi0+0uqYpqzwXCJcYi8h2Nhnnu1aW9vsTVtcdTAwMTM+9GLhLVx1MDAxY0ZOq5RcYv//43hcdTAwMTg142LuwG5cdTAwMTYzt/Gyce43XHUwMDExiFx1MDAwN3J4XHUwMDA2ilxusl7XQHNcdTAwMDKCKHeudzXM303YKVx1MDAwNJprSVx1MDAxMoijXHUwMDAyXHUwMDEwl0XP11x1MDAxY7xzYEtS/i3Sb1x1MDAxMS3Kq3biXHUwMDAy0dF4S46mbESLQER2MWhr8NEhq9r+3C2yr7HkXHUwMDA3xZjmz8FFlUqYXHUwMDEwXHUwMDA0+Ol7xvP7jJ6AsEG4dIL/emyuV/OrgOTTcOzJ5Klq2L6/czV0+zO5XHUwMDBmilx1MDAxOCdpZDeOcs69Sq07Y8OZmdrUq9hR401cbu9cdTAwMTdzbifBXHUwMDE0pUSIpfdjSfM3XHUwMDA0/oD2uqdopJWhXHUwMDAwXFxcdTAwMWTuXHUwMDFlvFx1MDAxMy+AT5TY0lx1MDAwNiWZ2TpxekdEPHRyuN5bdnTncCPSx+JDKvSDSsdcdTAwMDJcYvSvXHUwMDE3OEqdxLatv1x1MDAxMPOIXHUwMDEwKdJxXHUwMDA2XHUwMDAw0fBccmurjCtcdTAwMTlcdTAwMWN9gVx1MDAwNeAhMDKL4fO5NZRb01x1MDAwZmgs+5lvilStXHUwMDEwZOK8sj7cScvk7lx1MDAxOJdcdTAwMDf4IPyPtfOgMqjoZtHlX11BhsBv0dX7331cdTAwMTKBZ+073vHrfq9Q3lCoP+0+l9ohzGxJY2ecn51lJVCLQr52mFx1MDAwMCAp4pSVu8u1h5/EjFx1MDAxNktRuy5cdTAwMTBQetVQ/sew3D3WwkHnslx1MDAxZoEr/StcdTAwMWK+XHUwMDFm3aP/08BcdTAwMWNcdTAwMWI+OmPq4XqxXHUwMDEzaF9cdTAwMTFcdTAwMWaT665A0HLPbnSqbLG/Opu4XHUwMDAwV455l+/VuXyAVVA6TjjVx3JcdTAwMWH77y9cdTAwMTSxZFx1MDAwZVx1MDAxOSvfZEjLl0yAXHUwMDE403eCwlilv+tuXHUwMDE4a1xcXHUwMDEyLL494IzYz1jPTYNcdTAwMTm9XGaTXHUwMDA2bn5Sa8Wq496fzyy/Po4k2NQ/370pvD1W09tj9V9cdTAwMWZcdTAwMWI/Q8THW3dtVXDy6GOJXFzjL9Tpk7ZcdTAwMTScXG65r59WQk/LKPWNXHUwMDE1hfyFil7K8sqc545ebDv5g2abmVxmXHUwMDE3XHUwMDAzNSw5Si+eXHUwMDE5YZlVnKojUP33jtTm+diTefn3jsA5XHUwMDEx/L/6o70zXHUwMDAwi8kzct/vXvexd13o5Vx1MDAwZf28fvbooK5cdTAwMWWlfpW9XHUwMDEzQzfEIIMnR8+SXHUwMDBm62E7b11nPCZq871yjCZcdTAwMDTZkS/HNlx1MDAwMq/i23m881xcXHUwMDE1uC/qLCg5366k7czJQFxuwNXgilEkhX703LqGXHUwMDA0XHUwMDE2k1x1MDAxNa7Ze8pcdTAwMDS8lURcdTAwMGVcdTAwMDX/qsyl01x1MDAxZlx1MDAxYUfg5E3iL+ZGpWVg/UiKXHUwMDFm0zaPrOrMK1pcdTAwMDLCVFx1MDAxZHxD5u1/kv51XHUwMDA2+lo6XHUwMDE5/U9r7/Vidlx1MDAwNVggjFx1MDAwMM7/sueWjb+++5u+PY/C18dYXGbwXHUwMDExL4ww//j6XHUwMDE4V8RM11tjXHUwMDEzVVx1MDAwNy0vj5F2qMsj7eBcZoc2Zlx1MDAxM1xiwmpkR5az7XB0iCwyZup56SN2+oFcdTAwMWa0XHUwMDExQo3k5nbzYHz3rrMnMEbhhNvo+f4wd3cxu0ovhZNcdTAwMTSUrKPmqVXNajtoWVx1MDAxZKliMe9cdTAwMDWadlx1MDAxNFx1MDAxYzFygV/KPmUrM3RUXHJcdTAwMWEomtuJ9WyQoWpHVMOl02ZcdTAwMDKKXHUwMDEzil2/XHUwMDEzNv3110gh8eJnpC9Af7RJXHSJJ6532+s9ZjZ5blxcIKxwZVx1MDAxOL/vXHUwMDFlXGaIVfZccpiw3uCuzk+UXHUwMDA3+Jf4pmzljYxcdTAwMGKj5Ma3N2e6XHUwMDEyzlx1MDAwZuhcdTAwMGYto0jpM7TCq852cGbtXHUwMDBmIzhcdTAwMDDnXHUwMDBlSPVcdTAwMWFoVrz9dz74a8BcXFx1MDAxOSxZXHUwMDFml1x1MDAxOeDZXiYuYGN2KiRcdTAwMTXZojOXj7dcdTAwMWPPcmZAXHUwMDA3ilxuyfRcdTAwMTLHPuhcdTAwMTP4Mz3pXHUwMDBmt/+8/jBcdTAwMDYvXFzNNGz8Pl66uatcdTAwMWV6gVRcdTAwMWHWKmxcdTAwMGZGYipcYlXWXCJK2yygWCRcdTAwMGKq1H2gilx1MDAxMj7vIFx1MDAxNJr4q8I3+yOItsE3g5Fnhkitt1x1MDAxNmC20YBcdTAwMTNFwXv880qZcVx1MDAwMuA/V+5cdTAwMGYrt4yOyEWFI3pcdNd8sEjrXXfNKkLl1Zd2blVCmXzXbV5ZXG5cdTAwMTMnjqCLXHUwMDA0XCJTv+1cdTAwMTO6T1ZcdTAwMDPkO82ivLhahaRcdTAwMTeLv15qXHUwMDE5biHWZ1D8p1x1MDAxMVx1MDAxYaovPqtIVHDVQVx1MDAwZWFOSVx1MDAxMmNOflx1MDAwNzifRFx1MDAwM4psNP/18UTtXHUwMDBiN/DHXHUwMDE0RCXV5ENnXHUwMDBin6ZtT74xMSWSktzgN5RHUf1Tz5ppXHUwMDBmhSn63LhcdTAwMDdcdTAwMGKqXHUwMDFk/Fx1MDAxNJJcIjFHjpzMnDI+veVcdTAwMDImulxmjEMrXlB8XHQo862XsCnruuBcdTAwMGJcdTAwMTezji0xnmA/XHUwMDAyTXix1mE3XHUwMDFj8P4oJdPaXGb/5OQy5piIZVx1MDAwZltcYlx1MDAxZVxmXHUwMDEzW82JeopzS/j+XHUwMDAzxVx1MDAwMVxch1x1MDAwZVx1MDAxMyRcdTAwMDdcdTAwMWNYUP13JpNoakhcdTAwMTg2iOyTTz/i5yvnXHUwMDE2m+02LUuQOnffSeRcdTAwMGVbZ5qTXHUwMDA1V81CW3MoyNP4XHUwMDAw7IhHlzNcdTAwMThdV1x1MDAxYuGeni9iftV0g2pcdTAwMGZWlfvzv0F5XFw+XHUwMDA18rKLUcNAubgkZ1x1MDAxOdSPKrkqMlx1MDAxNJ07wohcdTAwMTH3lFlcdTAwMWEnqZZo7rHvmFx1MDAxMLhccjRiXHUwMDE311xiW1x1MDAwN6lcctp42Jx/Llx1MDAxYbVcZpRcdTAwMDGR9lx1MDAwZaSdXHUwMDFm4FKXJKBQyjdcdTAwMTMpXHUwMDFhKOZtXHUwMDE2rr6Vz1x1MDAxN0N1bFx1MDAxMlx1MDAxZW/QI6DlULU3OOrhXHUwMDBi0U3C2LTjfKT+jFx1MDAxMTGLatBcdTAwMWNReOpxupHDXHUwMDA2lFpqqVx1MDAwMLzxnDVcdTAwMGZcdTAwMTiVJSv/p1x1MDAxN1x1MDAxMJdcdTAwMWNLoe2vPvjuW5XUi4O6VFx1MDAwMZQ6XHUwMDFjgu9hk1wiYoBdxuWJJVxu4TzZXHUwMDFkYSqdSo/3XHUwMDFk4suU27aP6n8+9TJF3D71MvfzXHUwMDEzqGxcdTAwMWaIJVqD+HVUMtXzk6Q93+Jccka0b53SUdR41tf9SlwiXHUwMDE38uXRw7P3ez84393GYK1cZjRgR1x1MDAxMPlW1lx1MDAxObbyJCXeXHUwMDFip3tlKe3V8jZcdPPuM1VcdCYquOKH8N7Vh91CnFV6q6jz260tSZngz1x1MDAxYXpNe9NcZty7T1x1MDAxMFx1MDAxZpZcdTAwMDNcXM6A4CmT4CCTgnZA+2POXHUwMDAwllx1MDAxZYtcdTAwMDNbQ1x1MDAxN0ux/1x1MDAxNVZcdTAwMGXvPMTI1DRcdTAwMDZHno9AXHUwMDBl5IdcdTAwMDB4fL6IQDbgprmCQ09Zdc39XHUwMDAxLMji6q+6/WlP/k/b6onSX8SYt3vOg4S7YzdO5XFZYop7Zlx1MDAwZjixXHUwMDEymLCh+tNm58f9TMmbi8r2L49NPuZQXHUwMDE4XHUwMDFiXFywtr+Dxcv6yyniXHUwMDA2XHUwMDA03olXPndw2CXwt7o75Hzgd8LYyDDWoS+Nc1x1MDAwZYDS1fGL4kRf/MudtPHC5OauXHUwMDBib3hcXIXJLL0xlfY3xHmAXHUwMDEwZVx1MDAxMfZcdTAwMWam7dtcdTAwMWRcdTAwMDZ6fYtzUqzJlsJw8faHXG7MiVx1MDAwZYwnRrCUVX18xC25XHUwMDE2jFqG4namXHUwMDBle5BBNLhgR590ijVUplx1MDAxNWQ64KOFcmTyoNhP4H1cdTAwMWamXHUwMDFkILMk77/5daGhhFx1MDAxMFx1MDAxM0DmzmX85T9cdTAwMDUtRvRRbi0qXHUwMDAzXHUwMDE4Y1xceuhKzXgwicpcdTAwMWRpJFJLXFzzLtjg1FGmXHUwMDExmYbW76r1y8PWXHUwMDE4I/Y+XHUwMDFjmuo15CVcdTAwMDQ1lCZUXHUwMDAwIK2KlFx1MDAxOOZcdTAwMGXHXHUwMDA3yY7hXHUwMDE061x1MDAxN5fu7cGxg1x1MDAxMLV01YlRZu0vi0lA31x1MDAxZUjBM75w+lx1MDAxMa2cI1+mol2ymtd7oM5cdTAwMDMju33y8bBPi7lMXlx1MDAxYyex6cGxc2Au26Wc70lcIqDeXHUwMDE3Luk9XiXdJ735K19kan/tZ0ShXG7j5XvvoXhcdTAwMTYud2hTzINcdTAwMDBcdTAwMGVcdTAwMTV+nH/xT9hcdTAwMWKVUSNcdTAwMWY4MsnSRCk0rr3jyGC2fWiLdPk5jtXOQaFcdTAwMDRSXHUwMDFlUblcclx1MDAwZU6hXHUwMDE5pfg9UsmJtn7+71x1MDAxNPCQylx1MDAxNcLINTjAVOBtk7X791x1MDAxOPlcdTAwMTNcdTAwMTRcdTAwMDNcdKhcdTAwMWVcdTAwMWXPmjJcdTAwMGK1Jycnvmcs7qnCnTutoKrXu9jFV1x1MDAwNVdcdTAwMTRLxulcdTAwMDT2eFOO21x1MDAxYin935iKy1+v/IlqZsVQaP7Wz8CMQdhcdTAwMDFcdTAwMTWIrzvPmbHt5c1cdTAwMWV69dcno6oyxSdzL5x4gMCkdkcy06mIj1xcOj+Zylx1MDAwZipcdTAwMDTW+F0xyFx1MDAxOVx1MDAxM09qjoJSXHST71x1MDAwNbCEXHUwMDEzoJhAccZcdTAwMDaSfcTV87WUtdWBvPJl2IWOrnuW8JXNRaD1Lf/Ncd1WXHUwMDFiktTEPLCeR22JjT52XHUwMDBiXHUwMDA1mlx1MDAwZvvBcZvStFu7jOxd19lcdTAwMGY1kFx1MDAxZs+ff3tcdTAwMDRcdTAwMGVtZtJcdTAwMTTdW9xv4DW0XHLUMoO/seT9XGZCt1xcW3qvpc0g0m5LZ1x1MDAwNJ7qXHUwMDFmXHUwMDBmwpubXHJJINJcdTAwMTNPT4iif0FcYsRcdTAwMWZcdTAwMGVcdTAwMWbSV/1cdTAwMDTUslx1MDAxNy1cXP1cdTAwMWL8pWk6gE86v2tcIlx1MDAwNeuDnJHJ/HX30/NAW4DD46RkzWM+z1x1MDAwNldAIEGrpuYrnVfgIauaw/JcdTAwMGLcV+miekcpIOyeiHWovuRcdTAwMDPNxtV8xLFcdTAwMTg+XFxsNIjOjrvMfEpXXHUwMDFktjefSUrnqWQkqnzi1WtcdTAwMWZB6V7B+aRbXGJvXHUwMDE5ONK+7r1klierJujaPE+See+tiN1juk63yFx1MDAwMZ62qz5ZdnWdsPxcbnZcdTAwMTRcdTAwMDOdMPfJq1hvzVx1MDAxMqOSOnSsXHUwMDFlsKOk/cl5XHUwMDA0JE4wnKwmoPL0fZTASW5cdTAwMTSL9jamXHUwMDFihDjp8KRQh5ZpUotHcHNcdKfu1lfd6D1WVGlARvjM+9RcdTAwMTl2XHUwMDE3Rlx1MDAxZMBcdTAwMTW4MVpcdFx1MDAwMkvrXHUwMDA0k/birn6ltCU6K4JWXHUwMDFij0VqaFx1MDAxNlx1MDAxZJexw7z6+dXdVZWT67WW8GssVlx1MDAxMJ2Aqk20pvaRao65klRcdTAwMTBRNj9rhcHvteZRx1ZZUN9cdTAwMTguZ/D5XHUwMDAxXHUwMDBmPGG+/Vx1MDAxZVx1MDAxMsifloFRfFx1MDAxY2LHaOD8kVx1MDAxZUJcdTAwMThUNzxfiCDdMyNioFA9Qlx1MDAxOa97LoJcdTAwMWP7eYfzj7tnMtVV2Vx1MDAwZXfDz9B0/rrnzalml+NNdJ7sJKws26G/ZZo/PCjkQ6z6gFxyjjCVvsIs0pmpXHUwMDA1TcVi0G+KXHUwMDE11n7dRVxys1x1MDAxOTnxJDoha4RFUVxiKsJzI//Jf2bc9lx1MDAxZC11Yrvml++O1j6o56NF/npzXHUwMDBlIEXivkNcdTAwMDKfXHUwMDE4MzYuiEDBQDG77ypFUzhcdTAwMDGhLyOhxaZcdTAwMDMjq6s84HOp/yhKz3JcXKKIo2v1x/PDs1wizvcwIeHUdyfPnLFcdTAwMGZUz1x1MDAxOFHeXHUwMDFl3klUOGPpXHUwMDFk/VFcdTAwMTbgSljEoI7IXHUwMDE4Td9Z1i/PXGYnSXtnLWjifscnlo1rqDauPsdBoOvgkMLyL981OD+or1ovPTZQVo7T+pnDecIxQF3tt/D4vT+UYT9dXHUwMDBmb5JOWcL4XHUwMDFkXG76T6Jccmd8XG55i1x1MDAwYk39JFx1MDAwMzNbVi26+v8wqj/fXHUwMDFi+edFXpRrmlx1MDAxMdp1XHUwMDBm9N1cdTAwMGJDcKuB+df35kTJi3IvrZnYmrHHofygLKaKOUrGLDaDZGbfbungJsPY49RcdTAwMDdcdTAwMWGU8pTgN/z06lxmXHUwMDE5dNw5/pbMR5D2TkR9fFx1MDAxYd9ke9JpKIkodfGvvlx1MDAwNYpvauWp9O7XvubQqTNcXJKJV/dWyD2B81x1MDAxMOTkuWrCNX9cdTAwMTP5gVx1MDAxYYOY732amIXDOnAuS3fgWV13bsNcdTAwMDGRj3ly973KhpVcdTAwMGJRolx1MDAwNTFPXHUwMDA0ajG239gowYHpmeu3VFxmY9njz1x0KZjp/aRBXHUwMDAySYhcXFx1MDAwZoW5TcRHf9BcdTAwMTJxnL+2/HghyfN/PkBnzmyXULtySIWuSrvukKBKn5Fjpaf0eW1xP1x1MDAwM8mlK6C9WeYxkyd0nXZcdTAwMDYmj09xXHUwMDAyJHnIXHUwMDAwuuUrSZzU7UzfwaqY6JP8eplcdTAwMTN1sfV+W4ZcdTAwMDK9/G3Gvlx1MDAxYS/b61x1MDAxM/iwq71/XGKoS74v49xmhqWRJ7tcdTAwMTVcdTAwMTOw6ifjwiTcXHUwMDE5WviD8D6ZideFgun0o1x1MDAwM1x1MDAxMvfzMHvd8DRw0PxQgT2l7FlcdGSakvrMKvXiX1HFkPPnXHUwMDA0jPrvdVRNQJjdXGZkdOHD1DdI0NhSSnP5zagyJqx/ctPgXGKbn05g1lx1MDAxNi+tWFx1MDAxNjq7OEtcdTAwMTdM5sjLJrhcdTAwMDSTUqYg/O1O/rdcdTAwMDVJscVvo3R2o0tF0IbBXHUwMDBmrVxylKJcdTAwMGU5SkngiXHgvfKVtv+9ZoSJeNirmC817FhcdTAwMTKyUc96j1x1MDAxZPeh0KD4XHUwMDAxm+jM9vPDPHCcXHUwMDAzoyfrPFx1MDAwNUzGXHUwMDEwx46H3Vx1MDAwNqGN5H2UZ5fHIWJ+k/VcdTAwMTlcdTAwMTgj3JeywO0zgqypLuSAqbr+LaLWLFx1MDAxMWT37HR9v9iT8L5cdTAwMWHd92CAcVx1MDAxNkd2XHUwMDBiaVx1MDAxN1xclG9cdTAwMGWjXqi7paBLq51cdTAwMTkw7tbXZ5998cDJ/NV/i6o/17Jwl9lTd0S5NLGAnMaZQT9+XHKkvOSMXHUwMDFmTryCXHUwMDE3XHUwMDAx8+Fh4kFi0nEyQLVcdTAwMTOLKnQ6iT63VfRqsZOM0Dj0XHUwMDBix33mT7pC4KnypcE0XHUwMDEyqFx1MDAwNoRem3iejED0T1x1MDAxNv6GrJ0tukH6RFxinsJzqU2D7Z8gXHUwMDE5VFx1MDAwNt/bXHUwMDAxd5/Og/rWLFx1MDAwNVx1MDAxZE9cXP/+bfZcdTAwMWQ/vOOZXGJxu5Pix3XYiWFhbVx1MDAxM/1bI3M40Lv9a5LfdsqoZVdcdTAwMTJ49U7xdHnVe3l4XHUwMDEyVEdcdTAwMTBpgXbUuXWjvFx1MDAwM3p9YnRcdTAwMGJ0W5puy1xmNlMhUsBcdTAwMTJVc1x1MDAxZTnnkfFcdTAwMTY/sVxmglx1MDAwN1x1MDAxN+chmM10ME0rjFx1MDAxM2WiXoeP3Vx1MDAxNoNq1sMsfszNSjBzydVcdTAwMDP4XCLDzt1cdTAwMTJmvDw+9F1XzS5vJV/JnydcdTAwMGZMy85VO1x1MDAwZtZcdTAwMWXg2yNcIkWYfuCiwUE3x5d2J/XtXVx1MDAwM4bxXHUwMDE3qVx1MDAxMUWiMEKdnmeN21buJGlcdTAwMTNcdTAwMDVcdTAwMWXkauCYWa6RizO4OfmNIe+rzVx1MDAwZexAoaqGalx1MDAxOGXiLlx1MDAxMmlcdTAwMDHm4qGA2Xs7doxcdTAwMGI4O+c67ULTZJ5IS9VUpVx1MDAwNazL94DlS7uFW1xyu9/Hdlx1MDAwMNhFsa5+ZVx1MDAxNWFwZ4+GN+srkbwnXFzulqvQUkep/lx1MDAwYpmHsGdcdTAwMDD0XFy/10xGyZxLR1jGilx1MDAxMv1JyVx1MDAxYpzU+mhcdTAwMWHm23usskqMSVx1MDAxOKtcdTAwMTVcdTAwMDcqr4bFsLOhrFx1MDAxOWA4Ya9Q6qxcdTAwMWJ+mddnKyhcdTAwMTlcdTAwMDX0SuNMwDz3b+9blVe26kvja0VS2nS89raRLXPku1x1MDAxMX9hKVx1MDAwM1dcdTAwMDdly8Hmb1YxXHUwMDEwjHxBulx1MDAwMMbGri9cdTAwMDVhmL/Hz7dRx7vjL3WeM5o4t9x+3XGUjPb+KYfQ1+LKXHUwMDE572xcdTAwMTRcdTAwMWGz2Yfx5PtcdTAwMWTdU52a/shOToMubOSJeVx1MDAwMVRcdTAwMWa5XHUwMDE1TjOeVeHWN1x1MDAwNEew5dWIm8OVK51cdTAwMDPIm607KqK9PDdwdtrx89hcZofmXXV0V8SBKliNSyfTkUjkYXy0TyxjjMu85Fx1MDAxN1x1MDAxMKwmI+OPXHUwMDBmXFz5y0FcdTAwMDOtXHUwMDBisOxcdTAwMDI6f9qo751cdTAwMDZcdTAwMTj7XHUwMDBimvueylx1MDAwZpCZXHUwMDFiUuy2XGJYM1ByfzygaE1cdK7in3fsZXZC9VnwJF8qZjq4+uxRdVCpdC6Nn05cdTAwMWUzkFOJWMBcdTAwMTFJ84c1JVwi1pav1lx1MDAxNnmG1Z5fXHUwMDAymCr78W2gbqDgvMHUQVwizqh0PbNcXOFp1Vx1MDAxZPMkb8J+a6BbXHUwMDAyiZp4t0d/M4GfNFwizIkyPvpbSmdnXHQ694t8spdZLIlHvOlxLFx1MDAwNFx1MDAxMEqsXHUwMDE1cELlUFx1MDAwNuZNtFVcctlcdTAwMGUqvIGBIViVa470S76zqGNEVb9iv9ThaZiuOLrsXHUwMDFjWzCSSqRLXHUwMDExmOxY7F8mZL1cdTAwMWTXKvCxkM3bXHUwMDE5XHUwMDA1WU9HXHUwMDAzLFx1MDAxN5hcdTAwMTPVOnqSfX4oXHUwMDA0hiflg5WLJTx/w1x1MDAxZdnm+Vx1MDAxYtrtXHK8sPM3kMz6NMGZXHUwMDAwfi/4229cdTAwMGIlLf64XHUwMDFk54PQz1e/IHatSnSRVovYl1x1MDAwM3mejmlcdTAwMTk3mVx1MDAwMlx1MDAwMOX2THW/4queTFYyrlHAqFx1MDAxN/jfpHqSS2PidY5BY1x1MDAxZqEtPdyfLKzybv9C4aSUXjlcdTAwMDLhb3mKoFx1MDAwYqFl+CXrz0Kfz6tRQKP2/Fi1NNm9kDimsvrqISyphm8kTL20XHUwMDA2Lo5cdTAwMDMmQjqwV1x1MDAxZJXY0Vx1MDAxNtiuP9NgyMuYTCROt7JnREc/mHXQeo1cdTAwMDfn2eepM5TDSGshyoBcdTAwMDYy/1x1MDAwMq7LuFx1MDAxN0xeL3VcdTAwMGKsR+4mvI3or9tcdTAwMWPr3Ewgmlx1MDAwZrevL+/urlhcdTAwMTLAXHUwMDEzvPfSXCJDg/nnYVx1MDAwZdBf99PAfZeeefT1bVKHuSS4OK3MQWSPW1x1MDAxOVQwNDJY5X2GfFnIiqxCT1xuhH5xxvrhhJdcdTAwMDIpZUcn37u1ifGkoVx1MDAxZch9x2LjysnvQPHi/1x1MDAxYcYyykJngJQyPS+AuF+YPf8tffWLMj1cdTAwMWIqT1hiRs1FJN5yXHUwMDBlXGZVwkdKXHUwMDAz2bePXHUwMDEzXHUwMDAx1svENCdH1N/4K1qXUPla1lx1MDAxYf/1sl+uXGKRtj/v3lxca++1XYg+sDdWnYBJXHUwMDEw9bP1/63pSV+vNTXyx1x1MDAxMa6d5jisVFx1MDAwNopcdTAwMTBcdTAwMWJcdTAwMDJcbixLzUVcdTAwMDe3Q1mp21x1MDAxOCdcdTAwMTbHwIE6Rv/wXFzZ9ZVzgLmGwFuX71x1MDAxNXbHQ8X4K9+SwjP9nus9UIxUXHUwMDE31XWvblOqMbxcdTAwMDZQM0LIZSRdjFx1MDAxOc/xuZ3lg1xuXk3qXHUwMDE4Ol+VQe63Jeg7xiBn14WAXHUwMDA1XHUwMDAxXVx1MDAxZfFcdTAwMTde0P1cdTAwMDdcXGnAXHUwMDE2u8uzRc9P4DbIj7t/RsA6lHz4iq5pssK8wFx1MDAwNmQp4PpNIWui31x1MDAwZp1mXHUwMDE21JSraI3iXHUwMDEzP5eTscRcdTAwMDHEQFwi+9KMpUSwtjaDzITlQTJmg1x1MDAxMszbrvcvtMJ14TZ3T1xuO27aUFx1MDAxNmh3z2eTNX+g3cd2eYO5aiY/0KT46671x1x1MDAwZS6BXHUwMDAy4uNcdTAwMWSfmF6svs+nojJyWVx1MDAxY+A+XHUwMDE2iP1cItc69ZxdyZEtOak9llx1MDAxOVesS1x1MDAxN7dcdTAwMWI8Y0GsaXB+LPU8XHUwMDAxXHUwMDE4uDm39lx1MDAxNFxywrL8hW6PXHUwMDEzaipm8MLSfsiUwYFcdTAwMTTyNHyv3ohSXHUwMDAwc2SCN5h3I5nZYebzdVx1MDAxOdlcdTAwMDE4gEVNcplcdTAwMTaQJqNQMsdPaqm4lmPTgUt7nF+4U4qb8FxyXHUwMDAwzFNcZo/aNI2l8v486kusXHUwMDAy+G5+ntiQW6hcdTAwMDXHMIl6nnFP1KxcIqyw/rovXGaYM9fEoCtBujmYOmg/p1x1MDAxN8NcdFOtWCpWootdrjZcYnyrkvs5ZFHU7f/0XHUwMDAyXHUwMDA01FxyO1x1MDAxMlx1MDAxOVx1MDAxZMHdXHLmxJd0rlx1MDAwMzYx+eSP1YiunoJzie7evFx1MDAwNlx1MDAxYlZXvbVcdTAwMTXU49xcdTAwMGbFxJqKomiWL6tcdTAwMDNNecvll864NFx1MDAxOS8vSUb6lFx1MDAxMUvhg7+eXHUwMDE4XHUwMDE3coaLQmOZqqDJXHUwMDA1++XXVOXG5r+hXHUwMDEzV6IgaM77R1suPpZStbtcdTAwMTbg8k/jysLhJVxc3Utjq1x1MDAxNed+5zXiobyt9/lbWdBcdTAwMDSftHhr51x1MDAxZfMn84omXHUwMDBllFx1MDAwN8WLzymrucJcdFf+XHSBVodcdMUgjFc9srBewVZcImWwsjstXHUwMDA23YqQ4e+XaJhcYnqU+Vx1MDAwMXjnvt9om6pYoe+t/ckuwFwia2R+92NoQFx1MDAwZYZcdTAwMDNmff55XHUwMDE4XHUwMDE3x3yGtVx1MDAwMmdsRkKnSH9cdTAwMTP8aphRfNLlJ1x1MDAxYlvLuvYpXHUwMDFimTg2n7n2XHUwMDEzXjXhvHC6MK2PycSXRE19sNFvr1x1MDAxZjtaeeqlnHzwsZovYW+jXHUwMDFljN2rVty12G89XHUwMDAzM1Tc/jpnnIdtQFx1MDAxZlGBe0uSQH64gVUw4qdDgLH27Fx1MDAxMjSA+NljJTqRPJRcdTAwMTV971FcYj2ZkaZp4EI/71llXXoyWFxyKY9cYuaugVv2//y7lKtcdTAwMDbkXHUwMDE0+HDyrVx1MDAxMEaaw0RcdTAwMTdcdTAwMDDqUqbwd1RYWZqUgsRk3txnJdPao1xmeWRcdTAwMWFDXCJYXHUwMDExsvufXHUwMDA2XlOLUoAlavao4cHDXHUwMDFmRlx1MDAxMez87dPBXHUwMDE56lx091x1MDAxY6Wl7plbwz5kOrdcbvIlS72uuTU7WFx1MDAxYqnt+LXuP2Y4kKvu28bRyohs98loq2G6Llx1MDAwMp2eR37fM+e06ZpcdTAwMTg4OXac7p3wXHUwMDEwpnbALN5cdTAwMGVkMDjMfyW6RWyQXHUwMDA0b33EqFx1MDAwMoNkKDp/gp1rpP+I7bRcdTAwMGLFylx1MDAxOTVMjVpj3ZZbX3YgXHUwMDEx2PiYbZxsXHUwMDE2grQ/XHUwMDFkjtxz6XspyVx1MDAxZlx1MDAwZTVcdTAwMTdcdTAwMWKtrbKfnMAngictXHUwMDAyJSDbm+OOU0Cp49pSgv+8OT7Yz3VcdTAwMTSVXHUwMDFhmPhpaUtj5uWOXHUwMDBikHFimTCyOI5cdTAwMDchXHUwMDFkL1x1MDAxYeTab+tMZH6BrVRj07NcZlx1MDAxNT9+OPGG8mzAXHUwMDAzflx1MDAwM+me9LJkZkhcdTAwMGX0r6/WUuy+cLRcdTAwMTRcdTAwMWPxPVtcdTAwMTcpXHUwMDAxyJsk+HKueW9+zad1oJvZufrXnpNMMVx1MDAxYsBd/Uzf3cyxoMz+XHUwMDE3/1x1MDAwMU1cdKFcIulNlmwx0u05uMzRY/eEkzKMw2OQY1qZzCNEXHUwMDE58KktXHUwMDA0XHUwMDA1fMUp+5VcdTAwMWG3fCRNv1qevlZ9ntaaxF7H047vWVpOUlx1MDAwNvmMXG5cdTAwMGXsRGtcdTAwMGUoXHUwMDFkpVCKe+del1wiueHq9NWw0mVcZqMnSVx1MDAwMnNyfS+rZUgtRolEsSm5XHUwMDAzw5VVxoFRbkBgMT52iCZvlVGJXHUwMDEyXHUwMDAyXHUwMDAzmb31boWiLphLr8X6KVx1MDAxNNZcdTAwMDNifa6jgTGg5LjIn/b43zmhXHUwMDFiN9eE9dFsvzPdXHRz9X1XXHUwMDE48n5AwNepWVSaelx1MDAwNZtcdTAwMDHS1Vx1MDAwZkXh2Vx1MDAwMjshKY9K+XejTlx1MDAxMFxmuKOPS0vE3X2s+k+m0D9cdTAwMWSMNaD8lv9cdTAwMDGXXHUwMDBlIc+xq42TpDRgt5dcdTAwMTWgd+7nXHUwMDAwxWFcdTAwMGWVUn2gpSVcdTAwMTB2z7yQUU/Qjk/9XHUwMDA2y8/3P0Ff6lxm5H3RN1xiK0lcdTAwMTBezVx1MDAxMFxynHQtbD5cdTAwMGZT6b1fWDn3vFx1MDAxNSpcdTAwMDDNXHUwMDE1XHUwMDBix9RWoFx1MDAwMrhrpNNJ+Fx1MDAxZpRcYkJAe+2Bv++kn6N0xlx1MDAwNMFCxef5MCyGz9xcdTAwMTlcdTAwMTPC6uQ6YUGrJ+9cdTAwMGZxppmwdIvDvLBcdTAwMWWcXHUwMDE2IIXJLld7/eVDLoHBmcPSXHUwMDE2XHUwMDEyzFx1MDAxMj0+3q7A3Fx1MDAwNyltX+5IgrB67//yuJdHuoAxndE+S9RcdTAwMTHWpyZ+U3N41KLVpfThfN+1XG42wsQ0mlx0Tvv46L6kd/6VXHUwMDEz8e2NiYErcM8hlJSrZMVfjYA3MVTWgKtHSMeepGCcWVx1MDAwN7VSecvtwT3/9czyXHUwMDEyd4bVxVx1MDAxN321Ys7IXHUwMDFjMVx1MDAwZvpccpN80sLDXHUwMDE5l1x1MDAxYir9nHxJtEhJ6SfFS0T949aD1lx1MDAxOf+0oqhhN2Xjb46wxHyn4GlfYLzXhso0vSFcdTAwMDZFX/knkIlNjlx1MDAwNopkRM5cdTAwMWZcdTAwMWRGWDlVW4SIS/fHKrNcdTAwMTF1cWm6+6bESETbjK7v6PxSX5jFXHUwMDFj+9D7T5VNUFx1MDAxNWVkhc5EimmCdnnvXHUwMDE2I/o322DI7Vx0b4v20pEyMFx1MDAwM1x1MDAxNHZAorB7Vlmh6H4zR+eztprCnd/L8POZqFkxesjMb0X93FZcdTAwMDO4PpNIQEG2Ica2le58XHRFKb6KX1xmwo9qLlx1MDAwM5Ji5vCa6S1B2mz9jLye11DSc2ez7r226rW2XHUwMDFkue1a+VCMwkw9Ylx1MDAxNN/piZM+9HvHkbYphdA1XHUwMDFl0P70XHUwMDAxp7n6uWsxSzlcdTAwMWKSU5yVXHUwMDAyIGQm4KGn61wiRuTT/JzYwNr5XCJcdTAwMDPD6vjDXCJlYqjtbtLL83XNtKRN8COfXHUwMDE0xz7/L65/dKhcdTAwMWbWsivxt8H0UK1xJU9Z/mbTXHUwMDExrKyIoT6zLDiZTrpcYu+dglxyMCrDPliL49JcdTAwMWPXSy5W51x1MDAxYf7zWVx1MDAwMC955oVcdTAwMDZvXHUwMDFknmwvcvbSXHUwMDEy+Ltj+e1cdTAwMTN+4WpcdTAwMTf6nFx1MDAwMeZZZmZcdTAwMWFOvSdQP1x1MDAxMfNEXHUwMDFilDy+ZFcjp4hhXHUwMDE00nrswJbDe9elpVqnOkiaXHUwMDEzc8D8v9n/XHUwMDEyXHUwMDA06drU6795u+9cdTAwMDbPyjWHipRcdTAwMDVVXHUwMDA1dZy/iOiff0qVhFx1MDAwN02WT663KUYpjW47P8vpT85pOykzTvprofGDoVBcdTAwMThucaaXg53cf9Pe0Ovj+yOcRFx1MDAxM5Z2glx1MDAwZqpcYsKXL124XHUwMDE22MyhumbYXHUwMDE2XHUwMDA2xXp3XHUwMDA1t+z5ilx1MDAxNuY5u+pmXHUwMDFh9N3zWF46TUF4bFj5MVo3Pb9cdTAwMWH4bNS4Ov2Zo1mkVFx1MDAxNyrKrtlcdTAwMTEjQp+Jsr5hZpVNfILuWGDlgZeWXHUwMDA1SLtjXHUwMDFmO2r31Vx1MDAxYoi36JdsKUNb+zxI0s7n+1x1MDAxNqT2SZ35ZrnzalpcclxyZoL+gDp9Y1x1MDAxYozq9J/1iJlSVt2Vg2RTlWVcdTAwMWPbqVx1MDAwNkFcbizNi3hIKpxcdTAwMWGQ+rtcdTAwMWT9fmtN3XjjUHZcdTAwMDVcdTAwMGLrNtw2XHKT3Oer4COEffVcdTAwMTTX1EHqLOWl7dLMrr2COcaVUVswXFzIR2mgTdckQyj0uW80kKHgNreZXHUwMDE4kComYH5rLnffzlx1MDAxNumLntUo4KvYfsKzICb4IFkv3W9/XGZnlErM+2xmZzBaXHUwMDE3YPD882zqXHUwMDE4b4rG6vxp7lx1MDAwNbNcdTAwMWI9liViVlx1MDAwYjZWxWC03ejhr1x1MDAxMopcdTAwMDLnRy3drlx1MDAxY2pcdTAwMWFAY1k2YOaVMmxfXHUwMDE5e1xuXHUwMDE0QfTBNe9npkP7OJjyoevfPdDeaFnfs1HAXHUwMDAzkFx1MDAxY1x1MDAxM+Suuju4v/JzXHUwMDFmo+/XpSe1sYOBrCVKlVx1MDAxZv3vXdK/I/XKJ6pMvExcdTAwMTRcdTAwMDBafCVJ3ySZpaNRP9B9gy1BmsMk/U1cdTAwMWTq3F5ChVxmXHUwMDExJyyB5U/+tnpcdTAwMWXEXHUwMDAygjZcdTAwMTTFvOZu3Fx1MDAwNVlWRFx1MDAxM0BBnqY9d1Xfz9D7/thwXHUwMDBlnH6dXHUwMDFjR5M4cfyxynrS31x1MDAxOfziXHRzyTszXGJcdTAwMGZguE14J18ji2G3I1x1MDAxMOnDk78/XCLQXHUwMDA2udSGXHUwMDAxxlx1MDAxM9ZCSek//08zXHUwMDEx9lx1MDAwMogkUeqvulx0xmatk1x1MDAwMOk9XHUwMDFiXHUwMDBm169cXCgq455HZaXa0Fx1MDAwN37jvZQpr1pV2nzDukzmX63xXHUwMDA1W/GyXHUwMDE3M6xcdTAwMGIu3mQ1bS1cdTAwMDHG0ltcdTAwMGX2iEyAZJiyyF0shv/yc0FXtvSOb69cdTAwMWKTXHUwMDAzzVH4bc/zrEZ7lTqW/aerIaFCnn19oStj5jyYbFx1MDAxOTv18jFCgVQzXHUwMDE2KLZOkPWc4Ycpx4HwTIJqvYP1NVtSz7y+oe/LM0BBXHUwMDE1gfi9UpJLm+32oW25bVxu1/tu6ecqWObOkTbevkjujiS6+3Y3kbDKa1lcdGhcdTAwMTSQXHUwMDEwWIVHU2U5sI1xXHUwMDE5YjNcdTAwMTLP2qfbK75cdTAwMWb2MVRcIoVLONE9wzmRSEvfXGJvQVx1MDAwM1x1MDAwN4OgRu1TuarqWvb+o1M9XHUwMDBmLOV8Xlx1MDAwNWdOdG92KPVcdTAwMDCWgcZ1hb9jkejesUg4vmlcdTAwMDRcYlNcdTAwMDOzXHUwMDAyXHUwMDAzct6RxfW5u/rcU5EzgTUpPqBcIk31XHUwMDExMshtdOs6ymNcdTAwMGLYOCBfc17Kyb71/YG9lDv+bLNFslx1MDAxYyBd9/p+7i5u6uLMI3Ri+c6beqhcdTAwMDaOVD0xOPzgpn/QJ56cWY0t3WXYu9dCXHUwMDAyZoZpXG69mcq8hFwiXW7kn06Dc9I+xqVuXHUwMDFmxstDnFx1MDAxZFx1MDAwM/A+XHUwMDE3sVMsrSREifixzn1cdTAwMThRoHTVV1x1MDAxZDtVXHUwMDAw2T9qXHUwMDEy/vRUxGJKeDBavNHgRC5cbiGD50d5loxcdTAwMWY5xdZcdTAwMDf51Vx1MDAxMK1uObqckKL4/dOb91x1MDAwZsR35L9e01x1MDAxM1x1MDAwM9gyXGJcdTAwMDRw+FfX1X9cIp4g8t/dq3Qgi4xRP0TrSi88g4FkPVx1MDAxZthEbuJ5hjFcdTAwMGV5ashBOCNcYqg6jDxh+fxrWJanRJtXXFzFYaV1JFhL/3l5hL0rU7t56zNJu2QoS/O87lx1MDAxOHxmws58t6x793fHcH7lTFxmc6Qw2OpcXLw6nd3lzYRSXHUwMDAyaVx03q386jFQmZpcdTAwMDSDo9sn/D0z61HGXHUwMDFm8OT0bL6+Nr5J735HPlx0N1xcXHUwMDFm5Uv/5+5hSIRfe82QuzlDbsv7XHUwMDE5/M0krlx1MDAxNVx1MDAxMKh1wWJcdTAwMTNcdTAwMTfuQslqjExJs9uMXHUwMDA2psZcdTAwMTBcdITmiyVGy3KoR+bUL4NUPVxu5ONlve9cdTAwMTmj1Fxy73q5qYK4+Vx1MDAxNfLqrlx1MDAxYraOKfu2pJ6x1633PtOTxiAjU0yLM1xmg6Q5cCg8/VxmKFNXYWC0REVJXHUwMDE4LSnma6NcdTAwMWNcdEVY71x1MDAwZlx1MDAwZlbAfWTRiFx1MDAxOfiBXHUwMDAyVJQk5b7rheWX5tIgOLHGsUhYeedKXHUwMDE2xpo1yJE2XHUwMDEw5PfU4rNcdTAwMDH+vrDX4OTQXHUwMDAys4rIXVx1MDAxOVx0zlx1MDAxNVtHtcl8L1VAM4t/b1x1MDAwMkm2q+N5Z1in6/GCpihcdTAwMGXEpmtmpOWMZdqFwSbkXHUwMDBie9B7dmJcdTAwMGbq155ZPFxc3nGeJOJ9t/nYXHUwMDE3RVx1MDAwN3PEXHUwMDAwyTNcdTAwMGW0oFx1MDAwZSrsY1x1MDAwMtTNf0aRXHUwMDAzXGImY1pcdTAwMWRNIEOIOD5cdTAwMGaIXHUwMDE2q5NcdTAwMWbzm71Ajy5DzVxi6JNcdTAwMWShfGv8oN946dDGaFx1MDAwNIlzcC6oXHUwMDA1+7LFJtIhXHUwMDBl4HMrnpFin6js2btcXLikoL2jjVx0TMJYipj6rVx1MDAwYuR3+1v0mVx096ac2KW6ucpzWFx1MDAxYswmXHUwMDFl5uLDSb8rK7XajEe/0PdcdTAwMTebjK/4xFxcr1x1MDAxZfHVnI5o6uueXHUwMDA1XiCTnpTAVVx1MDAwYlx1MDAxOEwhx5eDT1xuuGAw/tPFVUx3XHUwMDBmzJ5n6NeJT5PWh0zSzKjbXHUwMDFmYph3qti/1thrUKtxYC+9w7hI8Kfg9tJcdDt1blwiX85cdTAwMDPI+Oklmz2kNMlcZkCELyPSqlx1MDAwN7P++flcdTAwMDX+vfHcq8BcdTAwMGVAo74g8u40XGI2ZIr+7sNcdTAwMTPlxcFTRjbZUcKv1Y5cdTAwMTfCv96WiKIqu5DDN5WeXHUwMDFiin+fXGIkoZ+C/TPOQ/WUXvCMPKn5pNJRoi9cdTAwMGZ/msNeXHUwMDA110fFa5/oqfx2lDLuOvFcdTAwMDfcXHUwMDA2Slx1MDAwMsx/Pid0KmBDXHUwMDA2MmZtKMRcdTAwMTNsger/qVx1MDAxZKCfbGM+PFxurpagMVx1MDAxNtdbTGg1fjbN8sGI5IhOr1+e141gq/KD5HVEXHUwMDA37Xt2iG3qQW6W5vqskSrdXHUwMDE2XHUwMDFiXHUwMDE2/G+e1qCW2Wu+tUqbOJKZavJcdTAwMDGzmEuZeMlNXCJcdTAwMWLZUOmVOlxiXHUwMDA1ydefysr+yoi6vlx1MDAwYj+8vJElJjLoVpb+vElBXHUwMDA33/6f+rdaOJx1x7VpyV2S0m9cdTAwMWRcdTAwMWVcdFDm2kRnJnx+rCtv8CNcdTAwMWRGMlwiXHUwMDFjPPk6XHUwMDAzMzO06vt1XGaF9l3M/lx1MDAxM19cdTAwMTjVyFFwfEZoZEKHsrDttylccnTrb79cdTAwMTBH2dHw4Vx1MDAxN9efI4l3MaP/XHUwMDFmU9exriC6XHUwMDA0XHUwMDFmiFx1MDAwNZJcdTAwMDSW5JyRtFx1MDAxMyRcdTAwMDdcdTAwMTEkPv1cdTAwMDU8M3O35zsq/KG7qjolsnpcdTAwMTd5XHUwMDAxYNzTpinWYUZl98OOxq3RKEhNbuT2LVK5XHUwMDEyTLJ+P16E/NGpw5T5XHUwMDBi+epcdTAwMWVXXHUwMDFjeeA+yVx1MDAxYmeQZbFcdTAwMTktfdySPH2sbt/UVVx1MDAxOX1UYZbf3L5+slx1MDAxZI60XG7ciSRcXFwiRFxyeZlxXHUwMDBma8bUz1x1MDAwMGOpL9Wg6Tw/PifG0ZL3dy9jkigz1zbQlobHXHUwMDAzNF79XHUwMDE4J2tvXHUwMDE5RvnmV6+g0Y5u6fgsTImZXHUwMDAx/EBQr1+vNn5NznFnx7K9/d5/3dfnf/1cdTAwMDKsw84oeTRcdTAwMDDhp3lwcn/8nvpcdTAwMDGbvrurMYSuXHUwMDEwhN+SYdV3hVx1MDAwNbH1XHUwMDBlxOZq71wifVx1MDAwNlx1MDAwZtaJiECGNH+zncWaPGvb5DdNXHUwMDFioVx0Nlx1MDAwNIKyfiaUXHUwMDAwfVx1MDAxY3bSXFzJmTWTKU9cdTAwMWVcdTAwMTdmJIKV8CzZ5bAyJOhcYnlA5nZO/6zo/bZcdTAwMWKmhWng/lx0Vlx1MDAxZOSNq1x1MDAxNrbbi+OY/HRPqC0wXG7hN6M6a6+X/OKTMPnjk1x1MDAxMoE+YarrzpTZQl+oXHUwMDBmXHKDWDnRliPd6Zqy5ILZbsiaNmT6ypVcdTAwMWOOcIM/IFLaNZ9cdTAwMTGfVrI540PFl1x1MDAxZEVAtWhG8oPlIOfytFx1MDAwNse7uTRtKq/MJtO0Ouegl1x1MDAwN7FZXHRy3oRH3eamJFx1MDAxMppTZ7c35SjccvDfhWKkgIfRYMZmcX28XHUwMDBiTJRcdTAwMDdcdTAwMTRwiM/+4oJcdTAwMTml6INccm+ASVxibVx1MDAxNPNn7ujhvsDj9E018a7zJVx1MDAxZpfIxFHsN09cdTAwMTJOXFz5WMpZiVx1MDAxZZxfi1x1MDAwN8+g/ZesXHUwMDE191VBlahccih948KYXHUwMDAzZ1xyXHRMdlxydmYmXGbfYjCIzvh5x6n71WffPbVy4+pcdTAwMWTGN4RJPonq7P8gr1HGgrSrXHUwMDAw1G/mXHUwMDFi3VE7XHUwMDAw3spe1qknVaPUV3lcdTAwMGUs/3FcdTAwMTZ1tbqcWyrCLLPqTWtcdTAwMTJoZEDogcVyYGLShYBcdTAwMDHVz36jwdnkQkVJYlx0zvwj0nflOnXNx2e4cv/ATbJ/eXXVgT81v83uWmPZT/s8IHxcdTAwMDQ1sDBwcY7tgP+AYFx1MDAwZTJCXHUwMDAxd03MXHUwMDE5IGylWlx1MDAwNkWCm1x1MDAwMKXBu4RAiuJ5zcfEjlKXh9c9rlxcWm1S65coKWdcdTAwMGVcZj9cdTAwMTJkK65xXGL56sJcdTAwMDNyvU9P8PCUzpOGTsD75OFAiHMrz1x1MDAxYfuk2/F820AkU22rQemRXCLkNtNcdTAwMTVwwWhK7lx1MDAxZXXiXHUwMDA3j0E+/d1CzXI9imB9+Fx1MDAxYvbNa56QLK1zXHUwMDFjXHUwMDEy73Cn9KVcdTAwMWSZ6DvQx5+Oglx1MDAwMemO+fdcdTAwMDO99VwiRZ6L6tKkN2AulY+2b7BcdTAwMDGzxujuXHUwMDExvtxRczeWfXX2gPug7i7Z9uHetXd2OJTby1x1MDAwMFxiXCKirnztqr6LyuSBMZjeeUNKPlx1MDAxMMDWaH57X++t9p1cXGdkx2uXZo7hfKuvbeLknCy/5dvhe+h3hFx1MDAwM9GUKzTt6slkMDM4hNaBs4RMXHUwMDAz+G6aq1x1MDAwMa85iZp9Mlx1MDAxNr9cdTAwMGLc73LDb0j6XHUwMDAwXHUwMDBiyC9I61xm8E3vp1x1MDAwZo6vZcx5XvU/Sd1cYl5rvj1qfC9LnvBT+q+O3TS13lx1MDAxM2Q3NsFcdTAwMDdcIjVtXHUwMDE5mayuTKr/xFx1MDAwZUNx/CC5XHUwMDE0NdJCxlx1MDAwZaCVXHUwMDEwXHUwMDEwkXYzXHUwMDFmWLg4ky94ez5BbIe3R/qpJS6ofX+O2UxBj9tNd0S0i0J84Y7jnlxuuHhDs4qMmY/tMEhcdTAwMDP6e1x1MDAwZj2zVlxiXHLa3PIu11xiXHUwMDFkuEF5+Ijx7UExq1x1MDAxZZFi0lFGuFx1MDAxYVx1MDAwMZ+iXHRcdTAwMTFx4+Fe8c5D8HpHtDui38jcR56rXGaGOG2fo73SN1x1MDAxMklEXHUwMDAxy157o1x1MDAwNHDvtsNWaN/IhFVcdTAwMTKen6b6XHUwMDA02G087o9MdVj4uktxnLhvxtk2myCo4yrK0oH3Zi3fwWAvXHUwMDAxXHUwMDExhdPb/btcdTAwMTfpXCKKyHqYXHUwMDAwLPTXXHUwMDFh3V/ufcVR/YxcdTAwMWZcdTAwMDZcdTAwMTT/iO6Gdi/P/FxuXHUwMDE5kfjRhrVcdTAwMWb+b1x1MDAwZXe2mqY4WXRhvI2TOk5fI/i2zoOm41ezalS5y1x1MDAxMSA3XHUwMDFl393LXHUwMDFlXHUwMDA3wUaMOtWiXHUwMDE03boxaORXKoLS7fJcdTAwMWO5XHUwMDE4bIZ0n9+/WqT4XHUwMDA2hE+i1YfVVXWKklx1MDAxMUxtXHUwMDBmX/2bXHUwMDAxJlx1MDAxM4ddQsFcZl+YYqqD0y5N5DP9XG62QFPxd01Yidpq2TT9T4GA8/1cdMVcdTAwMTXZXHLJPVx1MDAwYoBcdTAwMWTp4uJbxTGlXHUwMDE0rY6xXfPz/zU6YyaiJ4NXtsKDzsGJXHUwMDA1XHUwMDFkSz/1sJWbc3pcIsgna1x1MDAwMq1Hq2+ROiHUXHUwMDEw9G70pilLwFx1MDAxM8nbrJftZ1xmVoD0XHUwMDEwtyR3XHUwMDBivuQnS1x1MDAwZfRcdTAwMTktTFx1MDAwYsq3KFV//fVGXHUwMDE3u+aayFx1MDAwYlx1MDAxM3DwooPiqXnwYVx1MDAxYtzAe+acM6SSXG7sbltcdTAwMTl476Fp61pjlytnpro/IDKMqUV6plpGR1x1MDAxZL5AuVx1MDAxM2BypFG8XG5cdTAwMDXuXGJBt7basiXGqCG0VXDkWariSVx1MDAxMd9wyT51XHUwMDEw7NF3NLiQ/61rXFy7hGGs57pGhjxWotayoe9YbHLxuT24Q97j5lxi/I4gSHWnP4vvXHUwMDEyrEpcdTAwMTnxusWAh7DyXHUwMDE3aUFgZn26U1x1MDAwZlx1MDAxY3LmzMQj1NhcdTAwMWbTvJXa68cpp9prM4dcdTAwMDWF812nVZtcdTAwMTlCvPtWKYXVRzBFXHUwMDFjPm5cItSdSoeOzCE0olx1MDAxMaW4npjoO1x1MDAwNuhQKsmmgK8qmH2gXHUwMDA3aMPFXHUwMDA2vSFcbuHAPMWcXHUwMDEwLbHCvnpajiqIt1x1MDAwN1x1MDAwN4Aufm52ypJ2xGO7aoCIKj9Mo1asgVx1MDAwMeuvt1x1MDAxZlx1MDAxNqt2gKJcdH5ZXG7V3Nrfb09cdTAwMDE0XCJcdTAwMTmlqJ+d7yhnn15cdTAwMWVcdTAwMTC3YvnhTEyV9Owg0V2GIOtcIlM5vF5zlzNcbjyuw/3qZ9vptHavXHUwMDAyKjtedD5zpNhZNpflitdTXHUwMDEyOldcdTAwMTG1XHUwMDFjr3XqZqbTXHIw0j9cdTAwMGVD/C3UgPLyseu/acYsYIyCnkkp+KMr1XfYylx1MDAwYsDml2bGa1x1MDAwMohcdTAwMTHtXHKMrvOjnnn+JqH3p5Yt4ty2XHUwMDA3IHtpr3li9Vx1MDAwN05o1sN7upbw+732XHUwMDAzI+/z9+Ze2nlcdTAwMTDYhpuUM4twJ2guj5toXHUwMDEy8a7aQ1x1MDAxMPeL1ViOdVx1MDAxZojn6WNcdTAwMGWXXYqG8pstlpxzfmGXOOetyD1LZ2RcYqVcdTAwMGb226qQ9tqZ737wK3VcdTAwMTLr94Fls6WqKVx1MDAxY1x1MDAwNYfYb46LUOVOXHK/XHUwMDE2OWdqXG6Z8f2zP1x1MDAwM96kpCgyoVx1MDAxY1x1MDAxOc1cdTAwMTRMlmBcdTAwMTQy5/nLR67lpNxcdTAwMGX70P8z0+JcdTAwMDOY7qhcdTAwMWPvalx1MDAxZe+KyiB79tZ6LGJ9UIqMgXxuyl+nXHJKv1mjd7lBK/GTVEh3TsQg3pRlrW8g6Fxu2Vwi3YiUXG4mmJBcdTAwMTGaVFtcZlx1MDAxNsCcXHUwMDEyilpUXHUwMDBlo53JXHUwMDA0rFxcdf2yaFx1MDAwMtl8x36xLWZhRrB5fcLhce9PPo/sXHRcdTAwMGZcdTAwMGUuuu5hfiwwt4RcdTAwMTM7XHLjjevHffpGhStcckPPPsBcblx1MDAwM+Blelx1MDAwN1x1MDAxNI60qJre1bm22Vx1MDAwMC3n5eylb+9cdTAwMTiCXHUwMDEx6H71W+dGrZ9dsIGGvnmCLDfsXHUwMDBmXHUwMDE511x1MDAwZX+KX7NcdTAwMWFUjOrkLL/jgmNcdMR1P+H7XHUwMDFkQV2t1cyHMEU4XHUwMDFlQFx1MDAwNjhk2exTIWOEPf/2MV7ikoY8mCVcdTAwMGVBZMuYoFx1MDAxMVx1MDAwN4lcbjNQ2lx1MDAxNf3ZY1xiI/KwOPVIjqx964affVFcdTAwMGbEsWTbXHUwMDEy4Sh/1jxiiIE3tqns9FJ+kFN3MVx1MDAwZdNKznfBZkKsXHUwMDE5SVx1MDAwNqbvb/aZIN/vnbzjwW1Sk/pdljXRQ5hcdTAwMDPkUYDS1E0qzjqwJ6wginyQb/NAcjJfqtlqXrpcdTAwMGLrru5oXbl6rtwk2epH8Ugr1HA7TINN4SAhM1x1MDAwMvM89lx1MDAxNf82Rlx1MDAwN1x1MDAxMM90XHUwMDA2wN70QTDSXHUwMDEw8znaMdEqk/hcZt7Ngfey7fEl8l9cZihcdTAwMDLsWkuiXHUwMDAzl/R1I9ZcdTAwMWNYM/ZccsTN96nzppb/JVx1MDAxMitx/F/Ow17F4aVcdTAwMTVSNUdcdTAwMWTLLDlMMzKP43dJulx1MDAwNVWdhVx1MDAxZb5cdTAwMWRg0kvHn1x1MDAwMJi+rMdx7tmRx+zXzUZv609L7r+ThbHC31xm7Mdu9J7c/ZdcdTAwMWZJ7ydPVC/dQDC5LUW0XHUwMDExKqd9fXA9TTFsTnNU/6RcdTAwMWHNbk18XHUwMDAwXlx1MDAxMlxmXHUwMDA2XHUwMDE5XHUwMDAyYFBMxjNWwlxiacfbU1x1MDAwNcGs97ed+Fx1MDAwNMPsWnlAUFx1MDAwNJArkjVcdTAwMGU5XGKx2yC9rppVaUTvJzY49XzTXHUwMDE0jJX56Ys22u1yv5uS9W4oq9Nk4DjI4uI0hVx1MDAxY7JcdTAwMTJcdTAwMTfNovXEXHUwMDExr0k2WrNcYiBdu/lcdTAwMGXKsfpcdTAwMTR3g9ZLdXwjXG5mLbM0V8Zvnth3XHUwMDExuXvNstJf7YbeXHUwMDA1mVxcP7z66j33aV21zojfeVx1MDAxNsNib6a1flNcdTAwMWNd0Fx1MDAwN1x1MDAxMTxgtVxmOFx1MDAwYnf+sDpA8Y69lK2VZ0pCZmlcdTAwMTmYsKu1tkZofFnjvUm+i989OitQp8RY5+VBXHUwMDFm3FOctjOOUqRcdTAwMWX6oc74VFx1MDAxMyV1LFx1MDAxNJFz5kd6ZZTwPvTrbXjq4eFcdTAwMWSS+p6n1JN361x1MDAwN+8mjYfMstWDbVx1MDAxOVxyMPR0+NDNwmtcdTAwMDNggJv+3T5tY7BpVDxTz09cdTAwMGXudsdcXEfJxlxif6M3Y5lcdTAwMGVT1V5zcaiA255RrGZI+WaONVx1MDAxN77Nlr7i7cqhzlx1MDAxMmsljjNcIltcdTAwMWP/i9/wt4yDmNCldlx1MDAwM6FcInDQvtPz+yX4zzOXIy7b5dmAXpOhRpRItN6GRZviXHUwMDFhM9JedkpPepFcdTAwMDNcdTAwMWH5x73lNWnnh7M1XmxJMceAXHUwMDAxaLw04co7sLdtXHUwMDA2cVx1MDAwNnisZe4qXHUwMDA3imHewlx1MDAxZVxiyqLkXldvspD4/u5vt1vqKt9dlzzGXHJ1Sq1ETDLImE6zXHUwMDFikH9UXHUwMDAxXHUwMDBlLKKKN0xWXGaVXHUwMDE5xIOXaKeeYWNcXFx1MDAxZmG8dfbGPfM8Yk9cdTAwMDRcdTAwMWZb6T6s0IXlsptROLhsXrBcdTAwMTjzm0P9zDGtuqHOM35SMKVWXHUwMDAwpEuYXHUwMDExbsA499DNX2DcqOHJhVx1MDAxMlx1MDAxN1x1MDAxYoE7/MzWKJxXXHUwMDEzOGhOO6+K7ntlZVx1MDAxZbRzXHUwMDE4XHUwMDAxw0S51XgoRXmAqXJfavTYrTOPR+q40mfN+44yien5XHUwMDFjI2QrmCP72ev3iimeISb9vtSSxPfnmoTyJ8/4b8Yk21x1MDAwN4m7XHUwMDE3XHUwMDFjku3Xf4A68vb3IPRcIofVrKr7grM3klx1MDAwYkvE84IjijP1oDqjUZZcdTAwMDOAMlx1MDAxMlx1MDAwNlx1MDAwMW0o9f5cZpOj3KeHifaXbncjckTqXHUwMDE19uxhXHTtptxs5p9cdTAwMWarsGF4vFJXkt1cdTAwMGZ3PIv4e1x1MDAxNvVTZzxcdTAwMDFcdTAwMWXPXHUwMDAyQFx1MDAxZSpoXCJcdTAwMDRcdTAwMDOeXG6BRlx1MDAwYlwiQWJIXCJl7MiNwnaXsCFcdTAwMDVgMUArXHUwMDEw/mGWkyPe5Fx1MDAxN/CUIZboXHUwMDEzXG5cdTAwMWZBzGU/fTF4nCTgj5RcXFxyk0hcdTAwMTXeKqimJrN83irD1MTgOUQ1lT+xnqiyZL5mepz1ssBOf79o+10wuVx1MDAwNlx1MDAxZOfUwed0hYVcdTAwMWR6UZ1+uJHDoOV7+kFaPENcdTAwMDFKo9zD5zuvXHUwMDBm81x1MDAxYVx1MDAxNNj1yN1DQXYglGirqqbRXGKZIOai6kitXHUwMDE5XHUwMDE000RZbUiilM63XHUwMDFjrFx1MDAxYUDXXHUwMDE0w3pcdTAwMTAjhM1MXHUwMDAyiPf5fmApfeWWc2jCtY5cdTAwMTLRYSBiez+8TuUlaaWLqf/2VMO4dGtWcvRcdTAwMTSqUELaXHUwMDEywEQjmLafb8VIJ0Lfq5Ryj53lQcJgWHzZLPDPQn9blSTGUCshWLpbS3WiSjyMXHUwMDBmyFx1MDAxMljDg7XmXHUwMDFicbvirSap2ZzuT3BekW6DXHUwMDFlk5LkNVx1MDAxNVx1MDAwM5+mOIye3Yn1/lDjK+HV2qYorLa+uSlcdTAwMDfgVihNMiWwSz6xy138XcRyXHUwMDEwTIThZVx1MDAxY7BGelx1MDAwYmc83p+jSNBcdTAwMTWUt7mocrNOib9ccmh+wlx1MDAxOIizrVx1MDAwNasg4utv/qGcTVx1MDAxMjS/6Wbr8PzQ2HJcdTAwMTbAfLyIpzH16Z+1XHUwMDE5nVx0XHUwMDFjz7bi2EB6ppBtYMtcdTAwMTXZUr+ZXHUwMDAzi7EnTsJy1nTdr1x1MDAxMVx1MDAxYbhuIMPkZc6nqLxcdTAwMWW3jcsmRzWeg+3mXHUwMDFjIM8hXHUwMDFh6oyZ0Fx1MDAxOYA/Ua8pilNfLEtsmNd9NmIkPHuylrGRzLHmnbNcIt5vzq9nykSYL36YVf2gvoxcdTAwMTl06TRcdTAwMTaeblxmSifhhzOEYC1SQio/KM8s4ZBu7jmTn3dcdTAwMTbnUl9cdTAwMTXVXHUwMDBmSlx1MDAxM9ZcdTAwMWE/dODsK69cdTAwMDP62S9+8q02P8BcdTAwMDc/9mfj11v7pkGMXHUwMDFmXllcdTAwMTjNtUYtn1x1MDAxMWNyOdHedymFXCLOXHUwMDA0vK1CPlpcdTAwMGJDlrxLXHUwMDFkpbTb61x04vM1OyHLicS70yMsYWdcdTAwMGWcJCZcdTAwMThcdTAwMWPqxJdcdTAwMTDO/UliJ1x1MDAxZW6tu+7H1XFcdTAwMTmFbi6Nj21Ev1wi+jzX+tfB3JPmO0mR4z+Iz1x1MDAxNsoqftpiXHUwMDE4bmkjUiTp20UzXHLueONjZsTKZ3K3qHNwclBonTPmREJcdTAwMWWA3o2hfvWUiXtcdTAwMDNTgtpYXHUwMDFmxz5cdTAwMTV5ee5TkVfup+q5UCx0wlWoNtZcdLZcdTAwMWZcdKFcdTAwMWNlR6A3aq7B+zv89v/XL6CuRlx1MDAwMlx1MDAxMcztXHUwMDBiVkpLVXXTd/HYXHUwMDEyP317SFx1MDAxZPyuX1x1MDAxY4I+Oej93lx1MDAxYzy2yX3u0kphzvlcdTAwMGVcdTAwMDeIKb6lhC/3dVx1MDAxOLBH89RcdTAwMTZcdTAwMDP0mzGOXFxq0HKCLmHDes7FP7Ot76mbgl/Not1cdTAwMDAmSoQ5OZhhTU7VbVx1MDAxZE6uZ6K+nUsvKaU4i0vutzbUmoRaXHUwMDE0cOya7GZ8sNqG5VxySW9cdCVcdTAwMWS7p3JuzmRb6qDz9G/9YCDdjfDxcSeGxLgvePWRZs9ejlx1MDAwNzKxv+LbsfLcXHSlXHUwMDEzXHUwMDE303wwxGxLv5NcZtHeTCSdbVHUafVcdTAwMWZv5XC7smXQqyGSpvexXHUwMDFmv3icXHUwMDFhP2+PbXcsXHUwMDBlXHUwMDE5wX04XHUwMDEwwNlz7z12Qz3V3MBcdTAwMWPfbf1inFx1MDAxMr9ccnHZ0miSXHUwMDAwkVl45OFcdTAwMTJ7klUwmDswVKO5hz894Iw3rcaVXHUwMDE3XHUwMDFlXHUwMDAx6ljy3pfqXHUwMDFiXHUwMDBirHJcdTAwMWJBvSv+II+oXHUwMDAwcK/QeVx1MDAxY3DPvrTjYuHjzMwlXdbwL6WRn7eOXHUwMDAynlnbQlfjXHUwMDAz41rRolxmtyyvXGKqXHUwMDBmf3awxrp49ZWvNrpXLuUpXHUwMDFh/nKPwklcdTAwMTkrXHUwMDA00Fx1MDAxYcs6roXEXHUwMDFjK6pRqoI/aZ+WR7mV05Jt7yVKI0Fa7lHb+KFcIod8ynX5c0jwv9zymTLQ1r1cdTAwMTF171x0P99Zd9u83q9cdTAwMWMuedziXHUwMDAz4IZOrTHSiVk1RrXwT/il6UFNPbrSg1x1MDAxNEQ/++E82UknNd9pXHUwMDBmIF/Vn6adgVx1MDAxOFx1MDAwNyVlR1f3wDioS4p1Rdz2gp1S6H3iXHUwMDA3UDdIQvUuLi92YrB8vEK2KKm6yFx1MDAxNlVcdTAwMTTTffQ5IZ/QXHUwMDFj6IGWXGb3aKe0dttYMJ55m37ESzE63LRnY7FdvZLOWtzNwkrM9c95ppbl+KjWkMRzuvSPwDjWKzhcdTAwMTDjuV6CxGRcdTAwMWYu1Vx1MDAwMlx1MDAxYfGwL5VcdTAwMDPd1mdcXMy+4ox8fnbJYIbpi0nwltLt0oyuWX9nZvXPXuY4WMGreUDe4SHvNEjMd1x1MDAxYt75e2ugLz86vL1cdTAwMWFJ9HFWXHUwMDE39qSN0sZO8zRcdTAwMWXeoFx1MDAwZnhyTvPkNexcdTAwMDBcdTAwMDLHvbmS3zexOVx1MDAwYmOVQGkjXHUwMDA0dVx1MDAxN6yxj9WN6HbhrP0hzvqjL5fR/Fx1MDAxOVMm8r1cdTAwMWNQ0lhO273W7lx1MDAwMVx1MDAxZag1XHUwMDBmUoS36ltX1lx1MDAwM1wivqPFWNZoXHRu5qsmIMR2Tu2jXHUwMDFhmf3pcVx1MDAwMoh3Y1x1MDAxMaZcdTAwMWZGXHUwMDEyhy3iqi372meeU1OqKVx1MDAwNFLqlcNigJxvzaDgnLaH0U4tW2B04nVYcsvU12RcdTAwMWXeeYLM/VfHN6WzXHUwMDA3oLkxMJRcdTAwMDTnXHUwMDFhJZq50Fx1MDAxZPVQ8pJW0Gpd5rXBmY/r0/1cdTAwMTnjXHUwMDA3t/U6b23iys8zj82zznNcdTAwMTVecarDSyXmXHUwMDBiYqTlvb3wUV41mlx1MDAxNz4+zeLC6308Ti6/pIxcIoRBXHUwMDAyg0JcdTAwMTmM3G1FsEHQITK62+bLklx0XCJcdTAwMDLUlUSXoqZeSVxidU9cdKxcdTAwMDdP/SdvpDdFna+ivCTJdlxuKvTCXHUwMDEyXHUwMDFjP5o7ym8yj5a0c4xmeKNAikaTXHUwMDFmZtSGVluU7vk5m+9FQdF3lLPl+T7z6VuR27noyuOhsjIyXXAm5c9lm6RcdTAwMDPSUe9bIVxuXHUwMDAym9J1ioLRXCJoLyl5IXrHPnnToFx1MDAxNdri2vybv/ZI6lxiXHUwMDEzZLZcdFxuvcNKv9TOfIRcbm9cdTAwMTfUkDQwzP/m0mU5e8Y8TOzrnHaksCq0f+pWtFx1MDAxNk1F2cJcdTAwMDR8iU+85l91XHUwMDFlMVx1MDAxZEvd5zct+1x1MDAwN1x1MDAwN9dFLtzUOc9uyTm/4OTlXHUwMDEySERcdTAwMWX9VKLIok+7amJu9zcjeCR6kFx1MDAwNnHys7qKTjOWRXX4ylDBK12kiu6puZUx3yj2d3f3n+uZXHUwMDBm4oY2LN2Xv/rmoGZex/023pjCfVxcg4YjdkxcdTAwMDZU/4ebPlx1MDAwMXpcdTAwMWJlhqGPRUooplxulUf4NEJ+xUVmTtLtloPfpKlcIpK6XHUwMDAzXFxjuc/DfuuFtnNNnO40Z53PXHUwMDBmXG7BNadcdTAwMTHO3fGwrvBDXCJcdTAwMTbCk07tSFx1MDAxYe+waia5w9Q17Z1hXHUwMDEwz7hFXHRcbltcdTAwMGJfwGQww0BujNiBd+bGXb10KZ81bfVWS3SBM1x1MDAwNWdPneGjnfnBZz9YN2WMlVx1MDAxZFx1MDAxNXM5Z7GfudFrUnVcXNFHXG5FU2/3jG8mRlx1MDAxMsZcdTAwMGaLW4ck3lx1MDAxNylcdTAwMTTnXHT6OJ/O409vZNVcdTAwMDSNOZlV/vK2k7tcdTAwMDAwZ73FXHUwMDE5yCzAx1x1MDAwNIfzY0WYXHUwMDBmYmAgzTfcgVx1MDAwNcrCOFx0MlpA9WyEciVyJo3Lc4ze2IJcdTAwMTF7/uW4lv3k65rqqWpyseH/NGa6JVx1MDAxZUrFXHUwMDFjvKj2bziebcqVc1xmXHUwMDEwriy4TuRcdTAwMWFGcdqMzy9+eWexdn5aajWY5PPVY0PudI+aOv7F8F9UXHUwMDE4cjf4I1hcdTAwMTNLQqrkXtqcfIpcdTAwMGJaXHUwMDE2en688LD82mR48ZJzRqbRaV1cdTAwMGXuIJ9cdTAwMTSNSJ2awqmd0yG7YtndXHUwMDEy2DF+bS6tdsCZYZY/KN9cdTAwMWKnhnfbj466n4GTXHUwMDBl2qNYd1x1MDAxMMn0Z/JE1FxcpoZGMM5GKHdH3j7Q/qHcyW6hqFx1MDAwNYRffXJK2DKWmVx1MDAwMH1cdTAwMTO4Y91iR81pjonTcVx1MDAxYZctWcDiPcujXHUwMDAy+Fx1MDAxNGwuvPwgXHUwMDFmyMh8eeohaEUttW/kVezevHU/3lxiXHUwMDFjvFx1MDAxMfvVTeA5ToQ4W/0zhyrWsLmQXHUwMDA25lHm0Vx1MDAxOdJcdTAwMTaKqFhcdTAwMWJkolx1MDAxY1x1MDAwNTJDOWk2XHUwMDExyihcdJGfXHUwMDFmdnxcciHj04+DX6BcIom85uL+T+z431xcZPbMRa7Bq1x1MDAwN5GKqVx1MDAxZPPLeTzQ3q0+x3dcbsiou5pZ3lx1MDAxOC9cdTAwMWTRelPTRSjvtEtJidP7k0DdON2WLv/cVtD3ylx1MDAwMZpcdTAwMTLnzJM/4FV/xuhcdTAwMDdcdTAwMGY2ZUBhTzsu0eawb67j/XzqV75w2Yjv34qVeOZTNZDap43R0t7bqTEvo5Smrlx1MDAxOZeWnznR7Fx1MDAwNlx1MDAwMfe/urPhuVx1MDAxOT1cdTAwMGZcdTAwMTTQX35zXHUwMDFlg+zdvjRoV1408HPGTFx1MDAxNMuSxlx1MDAwYjuhI7pcdTAwMDPFXCJD+kCshIVRXHUwMDA3hDzWtvL80P7YO4neXHUwMDA1Z9GpXHUwMDAz/1x1MDAxOTpcclxiwdVcdTAwMWZbXHUwMDA3LpzBnZjyzGs26ySjmOtcZj9cdFx1MDAxYlx1MDAxM0f8VW7lgz7x0elTVVx1MDAwNyOJXHUwMDA1kFx1MDAxN4nXXHUwMDExXGZZXHUwMDFl66uMLYJ1ayZGj8eRXCJcdTAwMTlcdTAwMTWjR1N/9aR1tOLsi1x1MDAxYVx1MDAwM7ZcdTAwMWNO9JVcXOfEi0m4uHmsMyU9PrZBU+OwUIchtk/NZqrZ07dOpFwif1tcbqbL71xcb1x1MDAwNGjzoVx1MDAwZcm66XxccmNcdTAwMDDoXHUwMDAzXHUwMDE0+VR48FZOzmpw2u/NXHUwMDE5Z3rev2e/q+BXZ8lSXHUwMDE2kk/9cb6veSk9q7bFTkDA273dinzPr5Ss3Sq/b1x1MDAxOVx1MDAxNbaPe1PfejttQfDsYC0wzrytuLY2oVN6iKVcdTAwMWbXbC36hn42YT/Oqf5cdTAwMTZErlx1MDAwNFx1MDAxMGBcdTAwMTi7q1ZEXHUwMDAwy5lWs1xcfnCyTlx1MDAxNadcdTAwMWR8KflcdTAwMWUnb43RbfJJhszGfPCXbcAm1PjPmVx1MDAwMNtedIXjIFx1MDAxY3tcdTAwMTgqodCNI2cm4d98XHUwMDA0XHUwMDEzk5pix0z0e62ZYCivwjje/JrbyXc+cPrH4oJcdTAwMTinflx1MDAwYiHDgzxOrmVyyFx1MDAxY75cYlx1MDAxZFY9VVx1MDAxMrtHd/NpfFx1MDAxOfpIpV5UU0vOXHUwMDBlXCKPLYDaKiORL9xcdTAwMWO0XHUwMDA1/ul3XCI3XHUwMDExYUanl06bnzqtlYFcdTAwMTZPOXdGOvw3c4eVXHR+Om9cdTAwMDbyQFA+eH/pXHUwMDA1Oy1KNXnLRmzijz2hV9qUscn6zlx1MDAwNkXj2IHqy6lcdTAwMGIwvmbPOVxycG6lNn6c24nUrjxcdTAwMTNcdTAwMDaWk+3rsjf1cS8y98A8b9pU+OiTe35fc/dCf9uJ8nKMbjRWWnjLQWRvIf39RFx1MDAwZq4oOIlL+pnQ1JjwP+Kb19pcdTAwMGamXHUwMDBl5lx1MDAxOW9DXHUwMDBl4umeY1x1MDAxNSNLNsRzOSuMbfbffXydOqylJThshLqkM0aPYOLOkKVuv5kvnCBcdTAwMDHB4+FcdTAwMWKcqFokXHUwMDFigv2Y5ttDXG5mSM9+Klx1MDAxZlx1MDAxYlwiqHOO2HNRZn47QK9y2cZof5Fq9KxcdTAwMWZLRVx1MDAxZJjwJ7rFkt+SXHUwMDExVd6Uplx1MDAwZj4q3NhIiXFIXHUwMDE4XHQgRYGM8lx1MDAwNTiiKOsnIVpWOFwiPapxVFx1MDAwMGm73IRTVDqNXHUwMDFmW4eVrUq2ZM548UDtSSaT+U0+3kMmXHUwMDBmMsZZNHmH3Thtj+sn9qRcbiur7955wWFcdTAwMTj1XHUwMDAxeznxlGz8q79OPuNjcjOqUjxGMfMp7jS+ar1ccqLzpdP79reYXGInXHR+uudcdTAwMTBmmb9NzvPEVs9cdTAwMWY301x1MDAwNXFQb8/8XHUwMDE1cICVqu5ov7+5Oy1cdTAwMTNcYq3zYLeaVrCQrTH7/XBtgKRcdTAwMWa28Lhadlx1MDAxOYfLWbNcdOfZXHUwMDAxQ1v7qVx1MDAwZcani23w/sLkelx1MDAwN6iTXHUwMDEz3FjtgKLsbdB0XHUwMDFjIXeYikthY1CCflvr0zFhXHUwMDAwmolM2e6uw1x1MDAwNnJcdTAwMDBEcnHnguiWMJxcdTAwMDdxQ33G6swzVieJXHUwMDA0ON9cdTAwMTBcdTAwMGWLz3pcdTAwMTFqXHUwMDAwXHKS6iiyOHkp+at3IXHTXHUwMDAydLxtYlx1MDAxN+BcdTAwMTC1OSDA40mhXCJGXHUwMDExXHUwMDFhXHUwMDBiZ1x0OVx1MDAxYe80TzO718lKRj7Ug68yXHSaJiBcdTAwMDa0x/dxMH23xIInrH7eyjlDXHUwMDEwZcmhXHUwMDA11lSRdfvEWdzJN1uWW3Tk5Vx1MDAxZj4mTdNZXHUwMDAyN8iXXHUwMDBlvyiaXHUwMDExXHUwMDE5kYtX92neKFB3o/x035yo2ChcdTAwMWONvMBS+1x1MDAxZU4s/Pa54lx0/CxcdTAwMDDFXHUwMDFmP9HmXHUwMDAyVINcdTAwMWEootPG0NVpY0i12lx1MDAwMTK7eUOC2ttrL/He1+9cdTAwMTKL+qQo7HctXHUwMDAxplWGhM+rUFA15nfc/1x1MDAxZdSqXHUwMDE5XHUwMDFhs/F452C8en3GWlx1MDAwYi/6UtCXlWBPmrqmXHUwMDFkujva7eO8RPhcdTAwMDH/Kfvujsd5lnGQXHUwMDAyXG6PIOdcZlx1MDAxNjO7XHUwMDEwyVxcXHUwMDBmUGbydCouMpR+qlx0ff/CnFZ0h+mV0mIwqKY4LvfwPOzEM7WenkeeQ+jfkkllXUy/RVx1MDAxMD1nk7csiKwpXHUwMDFm9lxyTzVSyC9cdTAwMWPReu/A/MLzKlx1MDAxZLaRM3BmXHUwMDE5glx1MDAxNnTzY9N7q8NcdTAwMDCwKYVZ7zpj7PFb2d9cdTAwMGJVUlN9w8ZnUIo5OFx1MDAxOG9cdTAwMTdgXHUwMDBm81x1MDAwMTQ6X5vN2+m1UJi2yFx1MDAxNnXZac657Vx1MDAxMahcdTAwMDKcwYOck0tcdTAwMDdcdTAwMTeiddqUePJcdTAwMTOKYE9T69Lc+qDFOk8xRtFpTFx1MDAwZnrbKFpGKCy4lEPk1lx1MDAxM0Orh8WUTfdcdTAwMDRcXNC1Y1x1MDAwN9RJZlxuty2lVMzAXvRcdTAwMDFcdTAwMWQyVcbcwntl7rvQXHUwMDA29uxDaFx1MDAxNVhGXHUwMDFh/9dzws4pV7jEIVFEcnPMuJA3cOfJ7pl2h57ypDNPpJpH1M3qXHUwMDE4Kbrs8Osrl1SUiWc3YK/tsZOIwn/L+TnUfNCHof3KSIWLXHUwMDE54+vgusPAZl3PufvuXHUwMDAyolx1MDAxMNOGS3nYqIeUUlx1MDAxOc5IrzDcXHUwMDA0JnBcdTAwMDYg//Z7cfL1Jpd99VuYgDHCdFx1MDAxZZemZO2PkvpM60GbXHUwMDE2XHUwMDE1YSYxJvTef5t5XHUwMDAwy233eF792IbyXHUwMDAwqGRcblx1MDAxYoBzxphZ845Ih3teOaY4rlx1MDAxZc04q7Sw4JNcdTAwMDHV5Yuizl1g9rlW4rGS4MLplZA6oy9PurUqqVx1MDAwMWyRUL+foqamhShycHU+5trMeVx1MDAxM+BcdTAwMDdD0DF6tef3L2/VSctRMVxizr9DwNYqkb+qPacstURxMntcdTAwMTFcXJpSWTzSLPlcdTAwMTUnXHUwMDE4rFx1MDAxYnt21lkn4lxcztZcdTAwMDDSXHUwMDFkkUV35k4r/tNAXHUwMDA1/HF7tH6GKe3LJLvbp4frOq9hO8J0l85AXHUwMDA0SHfNflx1MDAxMY9f31x1MDAxMz61XCLPSLQ7dVx1MDAwNvnO2Fx1MDAwMn3xdm3no/3Lv1VDN1x1MDAwZVqLObn226NAbkPxXHUwMDEzbFVWrIBcdTAwMDYli6RqZpyg1lx1MDAxMFx1MDAxMWz97UtsN+TUVLKnXHUwMDAzU8i7fTHELVLO+yl/XHUwMDE3wL/yc/WGUIlIdYmnsjSSRSnqiTFcdTAwMTdBXVx1MDAwMUHqXHUwMDE40cG5bLZnankrnqMyhlx1MDAwNb9cZqLFgVx1MDAxYe3vSLcpr4G26IqbPFx0hXQ0tkBCxfZ4XHUwMDAxPKm5T1x1MDAwNnU3m62ltlx1MDAxN0EuXHUwMDA0XHUwMDBmgNJuojtqx+DTJZ0ux/ZcdTAwMDRqXFzi5Zzc/vBD7lx1MDAxNUvhem7+iF9a/FgmaopcdTAwMWEyW/tcdTAwMDeFtWf6xW9dtY8pZlx1MDAxYizU0Ljd9ZVcdTAwMTTZcnRjXGK2qrfH4Vx1MDAwYic/g4yk1f7rXHUwMDE3ILpaacvUi7Oyt1xynf5cdTAwMDPIs8TRMlwiuOaO98e6u1x1MDAxMGFcdTAwMWWw49zo/per1IeZrKtObFx1MDAxNYeVpFx1MDAwMYbXTfs+6L0qUWZcdTAwMWEwinW7XHUwMDBie1wiUMLMzs45i32et++cf797Oni+1Vx1MDAwMVwijXVWTCSvYLEqyEdcdTAwMTjBptpcdTAwMTj/ep/pXHUwMDBlR2/zpuxnjrF69YFIgp6F54N13jiZZ15cdTAwMTZcdTAwMGZcdTAwMDBcdTAwMWVcdTAwMWbPNKhB9odC+DSTXGLrhd/IYdJ3XHUwMDFibFx1MDAxMVNcdTAwMDFA0IZksOho2LqR2IGfXHUwMDE2L5uAgzQmxUFUXHUwMDEzusdjskdU9Fx1MDAwZVx1MDAxNlxyIGt0w7zZQkZ5XHUwMDE4eVxuz/l59qqbOTB/wfKZ+9NcdTAwMWXUvbu9gUuXklmqoubWMZ6anqlcdTAwMWHn1/5xPcXMRfRcdTAwMWSSXHUwMDBi5lx1MDAxNe5U51x1MDAxNyY/4Kqe0SBqXG48oH5RXHUwMDE5X+y5Mqah2WbwVjBzLoPilE5cZv1yxXe7f+aiUjJIo2pVbJ4m4Daxj1x1MDAwM9bZp1xmvuU49Fx1MDAwNsMpzLBcdFx1MDAxYlxcsFx1MDAwM51cdHOjkCqkkMlcdTAwMDUwpm78XHUwMDFi81x1MDAxZfKL2Vx1MDAwMz2zkSmrOjqS3m6vSbR2cKqqU4R3S5X3fIjrYWWFR0fYXHUwMDExXHUwMDBmyH1jZvRcdTAwMTQ7VHhghtyFmrdJjFu53lx1MDAwMD5QXHUwMDAywFRcdKVBY3DdQCon7u0+Pt6wbNExlq4mvndcdTAwMDHIK+/l1CVcdCSrX+FjJ6vgmbo24UbLvlxcnObANtGv7lxyXHUwMDFi9+Rd3Tigz2/lXCJcdTAwMDCVXHUwMDE0d9v+5O+FQKck678yXHUwMDE2NqRR6eoy+lrO9Fx1MDAxZTewhFZcdTAwMTPcXHUwMDFlabbuXHUwMDFkb6zBY0dcdTAwMDNsd51cdTAwMTXS2yHkklwiIKhcblx1MDAwNr9cdTAwMDVI48H7XHUwMDFiYFxiP+nZw9m+XHUwMDFio31cdTAwMTMhglx1MDAwMJFcYkaB3Fx1MDAwZrJk61ZcdTAwMWEsy1x1MDAwZXh+QVx1MDAwMEVGu1x1MDAwNp6Nb49cImTMIG1+yLRcdTAwMTm/pfpAem6C5yCp1Vx1MDAwN7G56l24T0dUXHSYQdAgu4xGXHUwMDFmkFE5Y4hD+j5s5107oHpcdTAwMDY+oCdYXG6jTFOMkT2A74po5fyeUalLklx1MDAxMlx1MDAwZUpkXHUwMDEz1iUr3yB9cFx1MDAxMPSNuVx1MDAwMzGDLFxuzSg5XHUwMDAzKVx1MDAwNDBWKqLysZjNS1x09G+iofCB39/J11x1MDAwNdlq62SRXHUwMDFlrljmrdp6XHUwMDE4J3uJVLkxj1xmr6U0zGBly4Rcct7ybVx1MDAwZo7JmfB/dkvepemwW/K+TFx1MDAwMd9T881oVj+eSf2gUlF6niFccj3r0LTaeKSPdd155EHSV59POENcXJP3g1x1MDAxNV3zXHUwMDAwWGZsJV/2p/ndXHUwMDAzujux0U63XHUwMDA171nNzdRcdTAwMTOdZFx1MDAwMdFASO3uXHUwMDFmeObUoN/M5EC9Wmd3XFwpXHUwMDEw3MTaS+PfgFx1MDAwNVxuf7NcdTAwMTFcdTAwMWFE+NqOXHUwMDA1bqiQn7hcdTAwMGW1rzxcblRU4EbMOdd97HU6rbq8ha36i4dai5JLpy5cdTAwMWRBXHUwMDE09unge0fWti9ccjo7KpGmnD1YK6JyllxiNFJHpdFcdTAwMGbzKChq1IqrXHUwMDEwkS2ezl4z9PCJLFx1MDAwMY1IWEoxyE6Y86g+yvxxYlx1MDAxNiO5XHUwMDExJVx1MDAwMU9FMojLk+6fh3NcdTAwMDLJ7vE5c5jk5Vx0xThcYk9fXzlxhXO3tONwM/jt3UJhI7EmXCJcdTAwMGbUXHUwMDE37JpcdTAwMDW6uJDzlFXq6znptGNcdTAwMDfk+uWdgWQqT2xz5cS7/TLCfS9T/z1rcz3rYVx0/MOxr03JWVx1MDAwMo4332lTM4Vxb8f/XHUwMDFj+0a9+eHDXHUwMDE4LFxik9apcyf1bJC8Pt29XHUwMDFhf2aggz03sjMj0JuBZ/xcdTAwMWVcdTAwMWJJ4m3uNOG8UyNcdPFm4nK2raZ+JFRAzC4ynvpcdTAwMWZjLS51rFx1MDAwMVx1MDAwYsTMXHUwMDAw8L9+XHUwMDEzQYq6JYJ/7Kt/cvOZMOhcdTAwMDWeXHUwMDE5YpFtSVx1MDAwN3e9tOeDu9awYykup5ZcboZcdTAwMDF0gjr0lVx1MDAxZlEox1x1MDAxOVx1MDAxM4aPz6tcdTAwMTnzm29JiETIvX4zwINV7J5Zkfnc+b/yu5GOl5eQ8pspKycyXbnpXHUwMDBi55BToYH0XHUwMDFmjkxcdTAwMTh+p9eqdTqOa1jIOzXlykdxXHUwMDAyW/L96ps4XHUwMDEwtbNFjfqhXHUwMDFmXFx/PCD9vnKwULR6Lc9cXJ5Uoj/nMbyf2T6M0z+2Pb7u1/6sVmJtQzyJXHUwMDBlXFyMj2paJU/0+zevL1FcdTAwMGYwXHUwMDEznHn+J976/5q6OpJcdTAwMTZcdTAwMWXSK4KaU36caKKEfvlQxz8qkY6Kato6JrhcdTAwMWVcXFx1MDAwMT5InaNu/+ZcdTAwMDRHhz1mgUwzL4hz4HPWOrX2kPUzRKskXHUwMDA2b3OBNtUm8+Y023T/7ztZlFbThlx1MDAxM1x1MDAwZqRy6Vx1MDAwYlhcdTAwMGVcdTAwMTJcdTAwMWRcdTAwMTTi0YY43c3oIULzrvhcdTAwMWNX5P1cdTAwMTmLtd9D3LmesdCI1mg0XHUwMDEwm9RcdTAwMDdnLOrUhWSVXHUwMDBlqVx1MDAxOWwhXHUwMDBiWdirdpHm0cm/gdvr6sPhlpFcdTAwMDFNXG7W8PJ1rlx1MDAwNbY+9p1cdTAwMTaq7/LS646a2lx1MDAxN4+a+vi1/p6PXHQrTVx1MDAwNFx1MDAxN1x1MDAxMDBlZGL3yKqSxrE6dHxVp/ZcdTAwMDa0XiXNN/HPTlVnbHXhy2VcIlxygeGrL041RF0jWXnqPYdtOHsr64afXHUwMDFjxvLA++BCXCJcdTAwMTKH188yXHUwMDA0ueqqXHUwMDE3XHUwMDEwxlx1MDAxNdPKs4u6f2lcdTAwMWRcbo1cXFx1MDAwN5OHg1x1MDAxN97R31x1MDAxNjZoXHUwMDE2p8n233NEUFO2hlx1MDAxNJzQyeFcdTAwMDdcdTAwMDSOeW2vXHUwMDE46lwi7MCpv5zXdjNcdTAwMDbC/tlcdTAwMWT+lyfpzfuUKTk3XGJLSLOYIKcg//s+XHUwMDA2k7SCieKDwKlnrvlcdTAwMGKd4phcYqMzR06cOSFRz77f19po0aWHj0FKU2HEL+JHsFu6e85v8IrVZqhjSFOLXHUwMDExXHUwMDE1XHUwMDE4X7lQKlwie/i0zVT+m8Uncmff92f9Oy9vyjr3QnlcdTAwMWRcdTAwMGZQ1CylvCNcdTAwMTWlocf3Ois0XHUwMDA1LmViReZx1UDuzGFcdTAwMDZWcabNlfrpuDnqXHUwMDAz+vC7/8dcdTAwMWR/n3qtf19KepdcdTAwMDDWZ202LNw+q3yQOt/zTqU0QopcdTAwMWGUXHTZpf1cdTAwMWXPXHUwMDAy7FgqPC/tV+mMV3VcdTAwMTg46nHqpszt1Fx1MDAxY1x1MDAxZfdcdTAwMWN0d/lJwbvHh1x1MDAxNPHJclx1MDAxMXaWxTpcdTAwMWX+7pZcZlx1MDAwMmjfXHUwMDFl3Ltja3U9XHUwMDBlkN37cPyZX4hcXPmFXHUwMDFjW5o6k9HQ39qd/TmVPJCT8MmGXHUwMDFjokQ2lb+cXHRPJuqtOJaUyJFcImxfv8vOXlx1MDAwYvJMWWjrQyDy659LloLx06aPdWPQY93YXHUwMDBm+Ubkvlx1MDAwNqnXXHUwMDFlmShfwPUroER7ObxYm4eLva2spDZcdTAwMWVij0FcdTAwMDRcdTAwMWRcdTAwMTfd7D0uXHUwMDAydcB9fM9cdTAwMWHy11x1MDAxYbx9MqZQ6Vxcn1x1MDAwZjdcdTAwMWZGlrlnvrE9bXOpXHUwMDFjrSRoXHUwMDEzRoGOvrQ+mqF3UvFFVbxpXHUwMDA1SfH6q9rE/3ojONH6633M5LKjUPB5b6/6wGfELmaq1TXlM9pYL1x1MDAwNilO3uFujqvLylx1MDAxMEWXXHUwMDFmXGYmXsOHbU3Fs1x1MDAwYupNNPAuompz1dCuaOtcdTAwMWVcdTAwMTdi7E8t6OBQ21x1MDAxNTDUSZ7uNyVXXHUwMDAws9PoXGY2XGaXMPjLZuCOvlx1MDAxOJGArCYgesGNqTa9PPtcdTAwMWFcXL1cdTAwMDXETTNcdTAwMDSQOeNj7/O8XHUwMDA2oXXuiZhB9TbWMqD16GErRcS/XHUwMDFiyf1LXf41drhF7+qA1kHmzImSMWXl9z3bXpdcdTAwMTZvzmD6KH962JWH8Euqi4BcdTAwMTB3aGpB7FxcXHJGgHglT1xmJ82+sI714ZlsUUCJXHUwMDE0MkL7gG/OK83yMKf8NaPToMBcdTAwMGVcdTAwMDGgR99cYtf9Za1TzlvYR1x09C5Fv6FHTrBcclx1MDAxM0vLvJ55RZ+DXHUwMDA0XGJ0OYRcdTAwMDOYe1x1MDAxZUl9RpeIv2j6vGqzzMTeiVx1MDAwM2pcdTAwMWa2T/2ehsBiZ3x/WVxih1Nva2ODfr/buvi7I1x1MDAxZk7LoS3unoa3l4b9XHUwMDA136xFtX7hWVx1MDAxOai78ydI7LtcdP141ZlnxFx1MDAxY5b+1Vx1MDAxZubqwDlcdTAwMDXPqItcZsj1ZmhqjkpcZuPTVG5N0kPzXHUwMDAxYradJrvTt1D9UlxcVFx1MDAxMVxmsp45iY+tnkNcdTAwMGVcdTAwMTX/bJWl/OJcdTAwMTX3XHRcdTAwMWZSpIrPXHUwMDFhSdt3n6xcdTAwMDFQwXF7XHUwMDE47n24LnVxwFx1MDAxOE/NVT/4XHUwMDFiXHUwMDFkMnqZXHUwMDE141xcQH85c7t+kLaP7TLSgY2KnPzp+aSBJ4m+iEiAedRcXO5fd8jHUHy0V/yQO+zOOXlpXHUwMDA2waRcdFx1MDAwZjb6UFx1MDAxOXZ7VWq9L7hyzXvIZOzrYqtcdTAwMTn+YS7ul4/N6eBz5+Ln3ZSErDYp2VC+4WM771x1MDAwMH1w0ZdccpIxar+qXHUwMDAxXGZFi5tcdTAwMWVbdfCOXHUwMDA2bmRkwLn9gEG668LaXHUwMDFm5rpTy68vXHUwMDAz5pNPNNfjPKVcdTAwMTn0cGCLW1x1MDAwYpObXHUwMDFjr5tdmijF0FxipHfxzCOS4n1YVPiW4ptcbvLPXHUwMDE5g9/SzHPQaaN/d4Y3Tvz05s1cdTAwMTf8zFx1MDAwNFhcdTAwMGb9g4HYjbIyc3GPduJYgFx1MDAwM5epb9F8kEhFXHUwMDE4wFx1MDAwMTVcdTAwMDBcdTAwMWFbVUghq9PcKs9cZj87s/zpQ4efXHUwMDE38svPXHUwMDBi9XtcdTAwMTDKmn6RkUCNiVx1MDAwYrRcIppcXO9cIu8yQqWev9HBlTP6JmlR6e1v9PFViayDydYlXHUwMDEz5EnTISmYv3CM/iuVeymkmZJcXCmQzZNcdTAwMWHqL+w+62yPXHLM4lx1MDAxZedcdTAwMTltKZ9cdTAwMWVwU19cdTAwMTDer54vS3XUJVx1MDAxOeQ2N7pcXFxcXHUwMDE5vmHnXHUwMDAwk1x1MDAxNa2TPVuRI/vCO9ZcdTAwMTaceGdcdTAwMDG8Pn5cdTAwMWWYmsefLkDn7YFpnfVcdKCfU8t0Widls5lcdTAwMDHcJ92+XHKpXHUwMDE2KjnsI3iuVaZcdTAwMDQzMvhMwiTVIOlcIlXonnFObsphylx1MDAwNajpXHUwMDBig6JcdTAwMGa/9vQt5dFcdTAwMDaA3P6sS/LFQ9yJjXPCclxmdPJElFpyxXNVRlhVZIBcdTAwMTdcdTAwMDSHqVx1MDAwN5efmH/UNaBVXlZv98JcdTAwMDFM31x1MDAxNSq9rFx1MDAwNN6+k1Mz0HeEqKr1gJi73dvyitnbXHUwMDA3rrj1dWK87lZD4Mynu3FIXdVcdTAwMDNTgMLtnFx1MDAxYs/6+7d8XHUwMDE40qs8be1hk4PrcHFcdTAwMGbkdZ/s7+fp0iZmfMhYbFx1MDAwMVx1MDAxZbzOdbJUXHRb8dKxtsDnXFxbd+Er9a+mL7FkjMCQu/7DhmLPnlhcdTAwMDDpbCha+4+Fn/FU5tlARmLe2lxiivK+oez7sabml+1FUNRvREFcdTAwMTDedKtcdDYqs8X5xeFvOFx1MDAxMK9cdTAwMTD7uexndytPP65cIlx1MDAxZrxEb1BcdTAwMTXfco42XlxiSuLBQoAlf9abuMdcdTAwMWE7II8+O6ldXHUwMDAy0zQt0nPOu5/hZVx1MDAwM8djYqAm6PpVnnh/94q+nTjjXHUwMDBlXHUwMDAxj2+Msytwc3Nvt2EvW0tcXFx1MDAxODqLZ17y4Ub9vsRDYNVS1/NxJ1jMj3TVZWi+z6TebetCxru0XHUwMDAxXHUwMDBmveqpXHUwMDFiXHUwMDEySZH6XHUwMDE5z2LCxVx1MDAxZpdcdTAwMGZcYiviXHKIvftcdTAwMGb6/E5cdKQ6f7D4vVx1MDAxMWVtK7xpaYjcrOb1c81cdTAwMDQ4lvtcdTAwMDB+Vj5cXPxpuDUn1o/xXHRorFx1MDAxYvJcdTAwMTJcdTAwMGZ+Lz/p4c5ihnO7v1x1MDAxNiQ/63vuS5M41Fx1MDAxN175rt6hyaKearPlXHUwMDAz2N0pXHUwMDFkJ666XHUwMDA29bBcdTAwMTh81JHaP2va/tZ0XHUwMDAyh1x1MDAxMEKGxWnNnGXVmHFcdL87Y+R6oUr3ycA5c6NccsXvgMUosWTIsz17jpT+43vYXHUwMDAyXHUwMDExXHUwMDBmYP3dVVx1MDAxYb9iXGbmPbOkkVx1MDAxMvhcdTAwMDfzPcBcdTAwMDb6Zlx1MDAwNlx1MDAwMlx1MDAxZVtcbpefRlx1MDAwZXhcdTAwMDfmcSdJ4IzQbMLIwohcdTAwMWVcdTAwMWPqoH37NXrVc9/C+OwxpVpcdTAwMWGa+uhL6mHpwoXHnlx1MDAxZH5Zolx1MDAxOOX9ormlz8OHXHUwMDE0iTDFKs/NrFx1MDAxOWOafFx1MDAxNanlmfBcdTAwMTK5YVx1MDAxOCu7T2I92bYh6352nE/EYc5cdTAwMWU83VPrhyt/it/LQYLAXHUwMDFjOzH5YVx1MDAwZl6rdp7d9saHXHLzyq0zXHUwMDE5fqKewTd/IetrzkFAPmzn6Vx1MDAwZW2Q0GSidFx01lxc8EHt2ZBqn2NcdTAwMDGm7OfAjVx1MDAxYVq4eVxmgj3BXHUwMDE28oVDl+dZ96Vvz+JNqNx+1s2EdW1Mb5NI8aSBoLiAw+Z1eKFHk2OUtVx1MDAxMVx1MDAxYVx1MDAxOClel8SQXHTjQyBaRlx1MDAxOVx1MDAxZYRcYiDwtFxyb9CQXHUwMDA1JmBZ3618XHUwMDE1/ZWTcvHCsDy5tlWzxNfJ6fDW5EBub3ZNT2KWW/rY9dBcdTAwMDB0XHUwMDFlLYV0yFx1MDAwZnDSXHUwMDA2XHUwMDA0p6/gdMMoiudoLKBB8H67o97Vb+FcdTAwMDVIj33D3f/6XHUwMDA1OGPh3WI6L35cdTAwMWOC+a9/OGbloUMpu8SyoFwirMfvXHUwMDE1yXcmouOqvfORXHUwMDA2P+zxhSwsXHUwMDExdYC+lO3u+FTfdlx1MDAwZiursF8tfbSN5ExcdTAwMDTO5UePc99r1umguYpcdTAwMDKC8EOFzkFZXHUwMDE2JWLM/Mm7y+F/8E57XHUwMDBig3LwKax+5/ba7u1cZpJcdTAwMWYmXHUwMDFmXHUwMDE2I3tLXHUwMDBi6dlLPbrxePaya3+97F5cdTAwMDRcdTAwMTa7oFx1MDAwNlx1MDAwZj9ccvawl+mJXHUwMDAzlCqQt+hZSLTpXGL0m1x1MDAxNjHD9eo3Yd5cdTAwMWZCXFxiIUPlkLRIXHUwMDExp/aCXHUwMDFhS0p2x3bBXG7EXHUwMDA20Lw4uXqTvuxcdTAwMWKMI+Huk+3dxKR7XHUwMDBmXCI4uS7WXHUwMDFmN3tcXP2qpI81oECWU3WtiVx1MDAwYjO50INusUhjKXay9ncxXHUwMDEwwVx1MDAxM1icPNrbXHUwMDBl18VxYLO0ssacXHUwMDEwXHUwMDA3xVx1MDAwYlx1MDAxMMZZRW5cdTAwMDHZ9pqVTlx1MDAxZFxc0vTAXHUwMDExKM+cjkujom5X9ILC5FlwXGKa3O40nTf1klBcdTAwMWHGKnm67DhguVx1MDAwNkYxfD3SXFw1h1x1MDAxOYOmIymi5tYvJDrKQG6Udlxcf2OWXGKGs17eMtFcdTAwMTlcdTAwMWIrXHUwMDEwjr2yfYTMyb/iX33OJJK67mrHXn1cdTAwMGVOIHxhkotcYlx1MDAxNVvk/Lm3We6bXkZImOyWJKmONKBDSYp+XHUwMDEyt23uRUrDpJiIZmfOXHUwMDBid9VzZ7XvX807L93kOFvUcuFbXG4qgZe9XHUwMDFjvCjh7MM+9EjQXHUwMDFk8HbEOswk+3s1g1x1MDAxZGlcdTAwMTf3XHUwMDAxL1RUvyFqz1x1MDAxMW2GSPGMIVx1MDAxOPgkQzLSz1654lxydJKgvlx1MDAxN0whorRXb0qg0f1PI8pzu77AYDHSXHUwMDA0gObyxI5yJWeUnC6AjVx1MDAxMLui7TaqZlx1MDAwYrCQi5vD3YO5dVx0i2PmsZfVXHUwMDA0XHUwMDE4XHUwMDFh0FVcdTAwMTFF5OlcdTAwMDfFb+a9Sny0t89cdTAwMTkmScFcZnODZ4JQuFfc7sBozPvM/b19hvnOk6F/gLsz38XCfFx1MDAxZPWCXHUwMDA16ViNTd7Wcl+q5Vx1MDAwM7/l/LV91GNcdTAwMGKih4B0hrg6nVxm8lx1MDAxMKA3ljsxkvKv5sJcdTAwMWJqXUmbqsh/tizZrrqQcXG7qDywXHKH1lx1MDAwZtmj3Fxu0VtLiLmKcSlcdTAwMDfITbrq9LNPQlhcdTAwMWNMXHUwMDAwkchEyiTdrFxiXHUwMDEzWvjZVL8vJCC8M1nsTvNBt5jZUv96XHJiqz4qQfjPfe20qzmaaDDY86VxXHUwMDAzTzDDYW+tXHUwMDAzIDlmP2Z0RqTqUu2frvYg4XOzXHUwMDBmaorPXHUwMDFhYt+2m0qY1VxuqFxiXG7tuHueTaqk+bhsXHUwMDBmMM9deTSHV2ndpYO+K9HQl+++dLMzx5l+3ePvOFL+XHUwMDE0WOYoRZRIXHUwMDA3inFnSH7v0s8rLvE9xTBcdTAwMDS3XHUwMDE4Slco7XBwRf1uXHUwMDAzV2NryDyDz6RBuoD6qJs8OdZ0e09cdTAwMTiSXHUwMDFh1dW7sKqr8KaVQfi8/Pt5xfIz/4szqCdcdTAwMWTonEr7TOBQi+zf0FfI3qA1m9nBxEN6L8w+carHTlXNXHUwMDE33C14XHUwMDBiXHUwMDA30khUkKHv4nOLXHUwMDEyrFx1MDAwNm6E7DjLWVxiTitcdTAwMDdcdTAwMWFCM+NcdCHAPbK5qnQ6XHUwMDFmNlxiJH38aY5cdTAwMDffo358T1x1MDAxYfybZdF3zKb4patcdTAwMWTRn6JcdTAwMTf8WqeH9PKeaYB14k5cdTAwMTg4+lqLRfgmVCDsyVx1MDAxOHHx6CGcXG6AjJ9tXHUwMDExXHUwMDE1KMVcdTAwMTmqlYlcblTBKnlhZ77+XCItKlx1MDAwNlwiSeLD1mGGJU/qXHUwMDE53oiTvEL/+DtHMct2WZjl6VxyXHUwMDAxRzVhY9l3XHUwMDBioDV/7j2QeibGstd862AvhmFcdTAwMTF7L8DSNbFtY4itxFx1MDAwN35DOuTZzn6DwGdcdTAwMGVrrvekaC4rwrXuYSspTtXbXHUwMDA361x1MDAxN1VcdTAwMTn5xV24etzEs6KhXS2U/aXBXHUwMDFjePxcdTAwMTf7XHUwMDE2OPdcdTAwMDBtXHUwMDA1p1I+kznxoj1uJmq+RINcdTAwMDfMkNzT7mt4yT2PPFxiyLYuXHUwMDE1UkDU4Fx1MDAxY+hi9d5cdTAwMDDevpmFXHUwMDBiUnAyrtAmPFx1MDAxY1x1MDAwMDOJeT48RUJCXHUwMDAw3Hdw/4V6XHUwMDEweFx1MDAxMMNmLfFcdTAwMDGS+kRcdTAwMWGBM2v17Cdv3Nt6II4/PndvXHUwMDAwQvvUkeifblxmyc3r+e6/dXjWUaqoTIBtOj3mh4pcdTAwMDbzsnY39XBiVmxcdTAwMWLPXHUwMDAwK93dwK1mL7tFgFOwXCJvYEUhzPTJbjJcdTAwMTaRq/uBwZpVXFw2elnuxyOkhMTRbVx1MDAxYlx1MDAxYlx1MDAwMFx1MDAwMpdb2KEtWGRcdTAwMTktXHUwMDEy7nepJrZcdTAwMWLy04NcdTAwMTTAt5tcdTAwMTdDb+Fe2yN2qDXpO5P1XHUwMDE3XHUwMDE4XFxcYrVcdTAwMWWBzy0m1K9LjUZYdNVcdTAwMDcmn8ZU3+n921Dt+9Lj/6+vQlx1MDAwNL1rXHQ+1t1u7Y1RmSl8p7d7sTsyJvjubPNBfJpBhFx1MDAxYlx1MDAwNieyzLWoKSx+8tNryUugelx1MDAxNVNW9k63XHUwMDA38q5ymZzMxvbtXHUwMDA2XHUwMDAyqXCTfG9VsLJNSS6D8lx1MDAwNVRw2Vum2/Tje0tcYk1cdTAwMTdO+owpd0BhXHUwMDAw2+FcdTAwMGV5IOmXTbzqsTY3sYkhy1x1MDAwN/zVSzRdueJcdTAwMTL0eGpfT6g1yE1cdTAwMTgr2WFozValW5wkWEi+apHRxFSYits7j+5q/TVJLchhKCzPPus8+UnEc57EL8bncVx1MDAxN/bgZfe1XHUwMDEyi1x1MDAwNFxi6HX2uZ6lXGIqJ1xu5bPBM0BePSS60cWwIDSQmrJcdTAwMWXNXHUwMDE1y6BPuZuLaDhAtFKi5+bExj++KS+c0Z95oCOR15e230125M0jSlx1MDAxM9Kf7vr+1W5cZlx1MDAwZd6md1rcsp/tOfg1nXNirTUywI1V3Z6+LMy3/d+8u1N/seszuE7bty7Kblx1MDAxYpv72++zXHUwMDE39+7Z2Fx1MDAwMUK/9bp3Mt49P+EtJl2V+Fx0XG76f1x1MDAxOLuSz1x1MDAxOJtU0lx1MDAxMz72jFlu//6+gHLimLU2cDaU8dXDdUtcdTAwMDT8XHUwMDFjr3c7+Kz761fppmKCt1x1MDAxMms6NfXDpUZEoUozXHUwMDFlrFxmTIrv3yytsNjIv1hcdTAwMDVz7tVcdJBcdTAwMTiN0Fx1MDAxMUjKbcI61+JKyKDjM49cdTAwMDSNeJQ+tavXwWLY74+7XHUwMDFle1x1MDAxMm7xuVjnIKlcdTAwMTeCfahqe/y974FFZ+r2rd6MipLXrFV5xPDxXHUwMDFmn2/95f9TjTDJLVWcmsjxc47AtrRcdTAwMWXlNVx1MDAwMObwNVx1MDAwZoTCy0yjh781eFNnj0xGeUnWKpfR7zPX2ciL3IKwXGbFibO/ks3wTZFcdTAwMTGvzdSKfz9L/9U1PGLzTVx1MDAxNsTlN0/bfqx2rDnxjPq/mlxca1x1MDAwN4JcdTAwMWKQILFwxVx1MDAxZSWJL3/6ZliAIVRt/76j6sozfUPOPlwif3pcdTAwMTRrYplz6lHOn1/OXHUwMDFmXHUwMDA3WOOtkdfvQtJcYs7tb0+USFxmuTltRlx1MDAxMdSu+kcuLk15XHUwMDAz+fZvP8tcXDltwMG+XFydLGHvvzugU8W4XHUwMDA2o7FyZ1x1MDAxZtqMXCJcdTAwMWY2JrxQ81x1MDAxN/uQXHUwMDFjhdtPXHKQ6V5G9WQj73zHy3nSPo1cdTAwMWTsYFx1MDAwMKhmfPasJJlgs9Jddv/l3jhcboWeR6jsXpZcdKiRk/++7/hgyfi7/oHAX1x1MDAxZkOuXG7q1ONcclx1MDAxMWLfzt/asm/66lx1MDAxNVxyUVx1MDAxOfFthH/X1rC4YOTVgJDVkPfFhfW4zXlENET94pNcdTAwMDc/Yc77ylx1MDAwZs7Dg43na/x3T+uVRvlcdTAwMDSci1xmXHUwMDA2qLfNtFx1MDAxNYjusKJcdTAwMTX+L1Z45ZGUak5cdTAwMDP9o1x1MDAxMDfyaannpfitU1FwIT+lXGJt4oH1kIrAgvxA6opaezd/Z+0rbZR4f3/vODutscf/4kzH2Xw8pFnmO3JkkOWasTZJY1lcdTAwMDMsM/6+u82Lc538b9F3YT+G/95xSeW6XFydgfvV50DI1tn+ONW/Zz5cbi99oreRoHmV8OHxf3dMpFx1MDAwNqpcdTAwMDUr4pFeWDKZ5DF//8WBLk333E/Kf0Go+P6O3L9re3BcdTAwMThcdTAwMDM08+XsXHUwMDEz1FFy8orZs97k71m+v7zZXHUwMDExXHUwMDFmdWR1XHUwMDBmPvL3ObQ8wDOg1u4/fXCliFx1MDAwN8p/cOuBp06AIaZcdTAwMTVcdTAwMDdVMY3+cVx1MDAxYklcdTAwMTLk0lwiXHUwMDE49HXN311i4Kqn4/5Zy9fV25V63f/X1pc1rapEWb7Xr6ioVzpcdTAwMDJcdTAwMDRcdTAwMTToiH5IZpBcdTAwMTlcdTAwMTTlTWRQXHUwMDE0UEBQI+q/N8nkd7rrRty453pEIHNcdTAwMGZrrz3kOcWN2tLHtfTsPu5cdTAwMGXIhPZcdTAwMDQ5leH9XHUwMDBlwudcXFghKmDl/JxcdTAwMTGsKbCV86bG94Z+XCLH50jcw1Czw1i0XHUwMDFjXHUwMDBlXHUwMDE4lCafXHUwMDFmNSFnLHjHMpjbZYlcbrOO2Htjj2tpsN7AOZFPPFx1MDAxY+1OIeTnKOFcdTAwMWX+/Ew2jJ9kt9utWkdcdTAwMTVG/3VcdTAwMTNAwsVcdTAwMGX1/pJcdTAwMTjK74d+XHUwMDExfpwp0yxxypF0PyB6O+smrz+lp6v1/Kxmx26xWETp3XxcdTAwMDbIPpRb2thOurfxYF5cdTAwMWasifAl5dJcdTAwMGVcdTAwMWJtgNXHxL1cdTAwMGWiftajMzhcdTAwMTeHb9/iTUPft5F76nGAOeKAuPP8MPiUo/y9Ulx1MDAwN9ooZlx1MDAxMzPayC2hglx1MDAxYsNZ3PZ20tlNXHUwMDBmfyC3hunFPc/TdP49jpTup/jCXCLWfXhHtZB6X8okcK7d9C5DXHUwMDBl2oqL0q0x7NqN+8soKpxcdTAwMGKblJuD9Vx1MDAxZeZim2r9rkxcdTAwMTXGspNcdTAwMGZp4dyKJ2itPV5cdTAwMTTuXHUwMDE4bymK/Fx1MDAxMlZXSS3IKCTXcDYyqlxia1x1MDAxM/lcdTAwMGWYf5BjW6eHPtW6I5OEMIxZ/2U37mRcdTAwMTOjeFx0XHUwMDE5sGj7SUy8vdSLPVfG+Z3HU2w15+J1XHUwMDAwo768bt+0ybzXTuvicV5OSXq0hY793lx1MDAwM0e6hTxTUYT0S62a5Dra81LThfCWaOeXg1x1MDAxZXZcdTAwMGboe9prYCCvIzv0k8HYO+sgXHUwMDE5zmffXHUwMDBiw2NcZn6fZfFcdTAwMDZnkJGJ16jv2HtcdTAwMGXnZ659XHUwMDBmRo6/a7/jtd+k47IwXFxT/f9ccuvG9zpcdHBsw75i/3xxe0goJTfXP1x1MDAxY1dv4ekutsXzUp7McFx1MDAxNmONj7fowFx1MDAxOUSniO0hwbifXFwh+51cdTAwMTNls3+GZ/3A/TRwuXt/0l7V6FmGdqmzf3yTPqBcdTAwMWN7JfpcdTAwMTjvI2j0fpbZXHUwMDFi3ceQ/T1pkdxZ0jVIXHUwMDE5Z/xcdTAwMWNjMW7LSDtcdTAwMDFcdTAwMDXewONcdN41VL4/XHUwMDFlr8dcIlx1MDAwMOpcdTAwMTj3XHUwMDAx3VxuOSk4b8y6J8AzXHUwMDE0XHUwMDFkQiZv0XCWmFYnyi1BtVNccnMwo6ztOVx1MDAxOfYp7YvXZcM3dTHhp0iRXHUwMDAxIVx1MDAxNcI5uTr+MNcp+Fx1MDAxYXQw1STA31x1MDAwN8eBR1DYU1wi88c+RjNHvY2O3ouvm4/Jo+T/lD9cdTAwMWZs/m3Ix2+dR1wicVxu+1xcTzp/6K9cdTAwMDXou6b4czecXHUwMDE5r4zJ8s2U+1x1MDAxYzBcdTAwMGL3hvjA57r48O7MPlx1MDAxNp5kX/BcdTAwMDUqTfAjKvP0XHUwMDE26il/1fRVezlWi1xyV+2pXHUwMDFjU2xzXme36+l5wqP74lFWRy+oMtRcdTAwMGZw1Vu+IVFcdTAwMGIslpuwRaNnMOZn+GxdZTf7LOqzf7rD81x1MDAwN6JcdTAwMWRFXHUwMDFk1ndcdTAwMTfKXHUwMDA1kMX4ukV594frmnFcdTAwMDTia1x1MDAxZq67O/Bib9JXXFzYX8VcdTAwMGZffFx1MDAxMpxcdTAwMTl6UK3aedOAXHUwMDE2ZpnSP0kvUryeh4WYgYxcZiabc2JzXHUwMDE2Tlx1MDAwN01Rhlx1MDAxYeqbrCMsRuxd/sj3w/tcdTAwMDajL1x1MDAwYlx1MDAxNMLkJUfuvrNMcUfOj3covLbh7phHaS/Xe1x1MDAxMZ1NIelcdEzrzOLj3HmMaNZlXHUwMDBlXCI6n7BmoyTgeHtsXHUwMDE0arAxSqLSm4o+rn6yIVx1MDAwNbDIXHUwMDFm+Cfj2+G33pNhk79cdTAwMDBmXHUwMDFj+WVu/+ZcdTAwMDWAltG+ktVcdTAwMWRcdTAwMDa/w2b9unv/rHsxrjthXdeMr6jIVlx1MDAxOeU+dEFnWkrMu4g+9Py/uUKL0kVcdTAwMTcvPaSDM1xmSs1x06NLXHUwMDBit/Hz58U8ijtOLpNxhkDvv6hVWt3y24TL+GaYkynXllivW1x1MDAwM8w4b5VcdTAwMWFcdTAwMTFcdTAwMWPanVxm57tcdTAwMTVHOEx0imP6XHUwMDBiL2Mu+EJXLu53XHUwMDE56U57sIGp6UaA51xmxLDmgOaoa1x1MDAwYuifTFx1MDAxYWDQhWjr+KaCXHUwMDAwa8K7JXdlmfN9pUJAXHUwMDBm53yqXHUwMDEyarz5XCJd/fZXukLdXHUwMDA1mb9dYXY6+WSRczrlJPTAeslcdTAwMDdTXHUwMDE41+NrbsTXcFx1MDAxYoRcdTAwMTA+q4RZJ+p4r9tcdF/fOemtl32cPcx2/3A8iuAqjc1cdTAwMTj5XHUwMDAyI4hcdTAwMDFT7cJcdTAwMGZTRZ9cdF+zQLO3oWDG4XCWwXDuXHR6uJnn78xv9vc9XHL4yOzfkEp5/NNNv7dTQiGHM3JcdTAwMGXl3oHnYFl3Nblaf541XHUwMDFisU7WRZ9vXHUwMDExXc7TupX2i12z/M3WyD08XHUwMDBi7SD0XHUwMDE4OZaR37NeR7n5iDxcdTAwMTFgMb6f1sy98L1ccqTbW+6olVn2Uarc43K+XHUwMDAwU008lFx1MDAxMWVIlbLKOelcdTAwMDOwb+CO7+BJXHUwMDFlwlx1MDAwNY6eXHUwMDAyjFx1MDAxNlBcdTAwMDVUXHUwMDBmv1LrS4hwP9s0XHUwMDE0Vlx1MDAwManX5+qF2szMZ6mpXHUwMDFh6iHSkiVDOfSEj1XfaYKM3Eq/d1U3cGZ/XHUwMDE29GppReVmfFflqJJCUVx1MDAxN2aL2Fx1MDAxMafvV3xcdTAwMDF739aOu+ibXHUwMDFlSENN0klu1+W6mZ9cdTAwMDc2m6dM9iWTK+5cdTAwMWK7fvH2jlHD2nxYszn6jnaMY1t0QzVEXHUwMDEyzDFcYslcdTAwMTmfiDiQVkU6/fqqXHUwMDA3Qdp5hba57Fx1MDAxNowqv8c5QZCBXHUwMDBiiPyjj+ue6+lNapmWXHUwMDBlkP0wx0/WroGSoXTkzHhcdFx1MDAwZTeD9vBuXqWsdDvJmTl9kivwbeHRJozRdLSwblx1MDAwNC2ihUe+r9M7wZpNwHEl6XCdOP1cdTAwMWVcZmNFypJD2NeEXHUwMDAwt3x+NI9mXHUwMDE337pTnnBd76+ntT/a3STvW0h7K1F1lqF+oWpdSlxiSJZY8qKUw9kxslx1MDAxYWFNXHUwMDAw1o/TxJ9cdTAwMGKur1x1MDAwNox85GD8KqXHPoDwKFx1MDAwNJbrXHJcdTAwMGbYY4zb2EtcdTAwMWVoLqZcdTAwMDe+Pduje7pDulx1MDAxYYOzXHUwMDFiLYCcnaPQQ9g5jrxcdGwwrlx0forS3bda9vBcdTAwMGIwpvBcdTAwMWFYXHUwMDBiJIOXXHUwMDFlhdyfXHUwMDFjYW+XXGKoyy5cdTAwMTGZpzM47ae96U3rlSVcdTAwMGVZXHUwMDA0z1xy3fa4NzpnXHUwMDFmc/OT8bVccpvROeTKlDamdJOfXHUwMDAyV3BhLlx1MDAxNpqw8Fx1MDAxY4HvVebwJlu4XCJg59hAfJtE+WDKh+eex7V66inNOzh9fdbvXHUwMDFimlKYc+RcdTAwMDNEWvRiXHUwMDBixtnDwuqwslf9tydcdTAwMWamfntcdTAwMDD5vfSeXGL3XHUwMDE1fIhBzERD76gsnU16Wc987Fx1MDAxOcu/XHUwMDA2XHUwMDE0XHUwMDAzXHJR0/FcdTAwMWS+jqWUXHUwMDA1Yp1cbpKgcmFcdTAwMGLy5Fx1MDAxM99DXG7Ohedm//FcdTAwMWF7QFx1MDAxMfRZ+5KWjXE9XHUwMDBius7xXHUwMDFm1iaqnbJNPeSNMIe39Md3+iO35Ef311x1MDAwNVx1MDAxM2Z8LeVcXPjR5KhcdTAwMTOfqOAgwKS+XHUwMDBmXHUwMDE5TVbKc7bntjTW7+DPTSVE3W7GYltFpHZWXHUwMDAz39NcdTAwMWFireiQ4LGpkSp5n/ek+8jQ7vRu7bRcdTAwMTKbupnssiHUmYNcIv6JOPorjVxmXHUwMDAxRdxcdTAwMWItnnpcXEfbdFx1MDAxYc5cdTAwMTaxQoJ0LiG5nX5zy7KgjTPqPp5X2uIu8YpDVFx1MDAxNpZ4XHUwMDEwpmTGepvjKjuVLnU/jmuupjmdn5+Hd15hrEyxWpPw4lx1MDAxZrn7U6eTheSFuk979U4vt3WCXHUwMDFjXGbxRIkuYnY6s8bO48y5Kea1IEYm4tbbhVx1MDAwN1x1MDAwNZ3XTdaFuuVcdTAwMTMqeFXEoyyUXHUwMDAz2H43iKHR6qLHXHUwMDE4f4M5P6y6NfLK5Vx0ZeJcdTAwMWZ4R1ZOXHTShqfL67nGz52Q01xyJyHizCH0+62O8YBcdTAwMWFeVmzJfMQpx4E5Pvhua6pBP9muXHUwMDE3/lx1MDAxYm0xvbrtgv1lsXPmMK9OM1wiXHUwMDFj//KVOMWTbJnReiWdqrCXSVx1MDAxN3mv9TX9QlP5PdtcdTAwMWR3M3L3XHUwMDE0XHUwMDExrsymXk2cXHUwMDEyPHtaf+xen7VffsRO1dpAXHUwMDE2h1xc+4w/vsPCyt3BYESwWbtTPHxUXHUwMDAyc49a6zpMq8Zujsn79SdX0cdcdTAwMThcdTAwMTZcYplcdTAwMWKzjdtcdTAwMGJcdTAwMTO5p1x1MDAxOVOfjkpo7Hfv6ERcdTAwMDFF5pGY6DXz+fOTXHUwMDE1dlx1MDAxOWsuXHUwMDFlm1x1MDAxOOArddZNxVx1MDAwM8dNtlL26cpF2PRZ0Pk/uKzFrvC6XHUwMDE2fVDSXHUwMDE2X/HLdSfQXHUwMDBia0hcdTAwMWWqyk/R61x1MDAxZEkuJ+rn41x1MDAxOGXwccxcdTAwMDbdro0ma1R35N9cdTAwMTRbXHJcctFtV2cyozl/WyXi6odcdTAwMWaczVx1MDAxMGyIa1x1MDAxY3l3J+p0nPGkkJ6+XGKFXHUwMDE0qFx1MDAxN3DRXHUwMDFliVx1MDAxMVG8p/ThsV1w4Cttxtms7arGX6SPTXEwp1x1MDAwYkb+vO2vtZGGxJrePWiw+tnwwzhv60B4aPauXuwsLzbO88Gzj2NPK8r22ZAyQcLNNVx0UDqVPpDIXHUwMDAz0GnRzHXwcHbBN/PfcG5cdTAwMDJxur9M5K/u2susz+JCssRnWt/+Vj223WsluqdBVrv3XHUwMDFkRbLjzMpx77J0mDlgdHqXq09QrflcdTAwMTlrKVx0v3Pyqlx0N7ukjO9jjeRcdTAwMWN7XHUwMDFkd338L3VcdTAwMDLLokVcdTAwMGZtNGzSP15cdTAwMWbq2eQmip7mo/mD3W66Mp6FV1rZTlx1MDAwMVxuoi56J5L2zVoxT+JcdTAwMTQxViqHv312JeBcdTAwMGUxXHUwMDBm0KTH+3wlt/Rvz6LGgefG55dcdTAwMTecXHUwMDFij+ra+UmIy1x1MDAxYdrJyFx1MDAxOaFcdTAwMTmZuPZ1ju9EieM/rt9iNVsrZ0bY4FHyR1x1MDAxZS/b47VkXHUwMDEz83m8rs36UnJcdTAwMTOOZm9cXIY/c/xO7fLLXHUwMDAxqVx1MDAxOVxyvVx1MDAxMJXjX+rHbMskMPTwS0CTqX104Wau9KqzvPR8XHUwMDEyXHUwMDFiZp/TXHUwMDE2fZKqXHUwMDFitdiF/lW8XHUwMDAxufNcdTAwMWVrXHUwMDFjqoa5k8t1Nb/19oczeSi/iEw3VNR/MPv5IS5cdTAwMWLmOFx1MDAwNJ3Z61xijlx1MDAxM4stevFIXHUwMDE2XHUwMDFkzt/joy3FW/te/3hJKJPSmDeQOrlcIqNHXS/+XHUwMDAx9oZYj7pC4kajLeqHYWDdylhbwOFcdTAwMTmD154/5ilYYHeu/2BI6pjtXHUwMDE40LTvpsX/yFx1MDAxNlx1MDAwNCuDxt1fxrpcdTAwMGVu+uRPwFx1MDAwM1x1MDAxNNHj+VLMVVVXYVSGf99rPb7XujNb/lFcdTAwMDXOXCKPcLar5dnowydaW19in95v5S7k6nq7TllZbtzoUVx1MDAwNtQyO5tJ/nytd1+vdfN8zp2Mz5aNz5Z10rpccl9cdTAwMTOHXHJ93Z1Cre/hfCZcbs2guL+yqFxmuFx1MDAxY2jC91x1MDAxZVxcuolDLoVcdTAwMWL3+Vx1MDAwNkG8S57Ww8HXRoCKwlx1MDAxZl1cdMdaiSq1qVZbXHUwMDE5M4fkpLd65WdccnHK6LtEYt0qWNbgNPByrGStXHUwMDFj/ehcdTAwMWVnm+93vGbsXHUwMDFiRMVr9OlwTX1cdTAwMDFcdTAwMGI2UsY8gCO0TprP/N6lv1x1MDAwN37gmcMpQ8prf4/sd4/neI+tt/K0o7P4lVNn7Vxyalx1MDAwM/qLXsVcdTAwMDWssfKGTz5M2MD3f1x1MDAxYfrhXHUwMDExKENcdTAwMGV3jFx1MDAxZqMuilxy6mT1XHUwMDEwvilcdTAwMTC1SblcdTAwMDXHsFP9/7HZuuex5nWQNeqaI3tcdTAwMWNLUqQ3MKRozHkvzrGvQ//PblNi5O422ZVcdTAwMGWkSlxmQrBSXHUwMDAxsXZXyL6TuNsvR8inLPLsNvyx8Vx1MDAxZXXWzZhXXHUwMDAz75N1dM8tcfaSj9XVf2TGlca+LVx1MDAxMVBiuW9u5/H+QsCR+tahtlx1MDAwN8ZEb523T0//ymY2yCZ4fdN1XHUwMDE2qJNfkezpfMgkZVvkwy5cdTAwMWNcdTAwMTWcSTzMv+lxXHSuXHUwMDExRlx1MDAxOFxiwtQ3pHRgl+E3+lx1MDAxMLVGLrXiZ+ZI4b1yXHUwMDAwR5PxOdhcIl7OlOVcdTAwMWPDiUdRwyPh7lx1MDAwYnD+z4amdn+4NK7XxuFMw849iGeiXmEzb+SCPDYjXHRtiObmvlxy+tB29p+1cPIxeXtcdTAwMDdcdTAwMWJcdTAwMTT0+oPNa6FccrV9iVx1MDAxNFtd0W1cdTAwMWX3Zl3VXHUwMDBizlx1MDAxNFKY1+vvXHUwMDFhMXonKPM1Oql0XHUwMDBltaG1XHUwMDE3VVx1MDAxYlmSYkR6/PdecN3ZXHUwMDAybNp3XHUwMDE4nsC8XHUwMDFlp45lpPZsmlx1MDAxNIf069Xa9ya6LP53yKFccuSXsZNXZI7ju1x0SzvC97Jay239TckvXHUwMDE3gvBcdTAwMWLd2L979lx1MDAxOM9+edhmpfr4J59iXHUwMDEwvajZXHUwMDE2N33D13HT7r9g1VJOTfXzk7w/hrwy6Fx1MDAxMUj1rt2JUzmCTtByM6lSXHUwMDFkXFz44lx08C9cdTAwMWE9fzGRcO//otdFMTWL/Vx1MDAwN1xy/In7kdiYLch39X5cdTAwMTMhRUbll4z/sZXC2F7EPXLGwmecd0nD1EH08IxGOCqHJ3XrXHUwMDAxgbV/XHUwMDFjqDD4W2e7R7/M/TrLiUyK3rtKKu9Frm9cdTAwMWRIKN/Twlx1MDAxOTv/a/vq8FrPnKjOykqRbjtR149KXHUwMDExtatcdTAwMWMvnOr+i2eGvFe/XHJcdTAwMDR4SOFcdTAwMWLtY8Xp3biY3TDZ+rpPjTtccsKnT1pcdTAwMDVfi7tcdTAwMTlXPsYmQdpAwVx1MDAwNaQzz1GzXG55ikn1xTZXP3jhXCJcdTAwMWGS/M9cdTAwMTf34seIKHj/4Vxu0MxEOFx1MDAwMzNqoTpFRVFcdTAwMWLMXHUwMDFhzjmfMG/CwuNcbuRcdTAwMDT1sLfOzfdcdTAwMDWljXB1gJbOXu+c2Kv85E1QLThup1xcsYxcYi3H11x1MDAxYcNYmz5sfExY2S2F9n67u0L0bVVcdTAwMDdP7F17nXMuPda8j31cdTAwMGL3hkHdXHUwMDEzy6hcdTAwMTNOXHUwMDBiQFx1MDAxYe/dSItcdTAwMTRcdTAwMWS5n4Kb4CuPXHUwMDFmx1wiP+Sx1vuwXHUwMDA2KYGLk5w+XHUwMDA1K1x1MDAxNTHvracgNbaf5mnRYOnLXHUwMDFiczxcdTAwMWGURDSu2su+qqr3zEl8XHUwMDAwnMH3uJl4wEeX1nPvi0wlrjTOOe5l1CZWW3u+V5BcdTAwMWV6YHlcdTAwMTVcdTAwMGZfllx1MDAwZlxukUGlzz8x2W7MQ52PXGbRW95lXoCO81x1MDAxMpJ/Zzud3fhcdTAwMTdbsPRr70V8aDveub518na3YFxyg11cdTAwMGZ9XGLaRlNxPF0wooBxMVx1MDAxM+ur6L6TXHUwMDE47qOgfDPnW2F+ZKixVolcdTAwMTdR71bf5jz7tzL1XHUwMDExZ/P91M4tSvlDsOI0Mvqf4itcdTAwMTM78Il4m3L2pftSXHUwMDFmaUGLz1x1MDAwNnh+UEQy+fJ/endcdTAwMThnQVx1MDAxN/HXfzrt3Zx9Ou+y3tp6nZ9vycXBKnpEvc3alb/4ilx1MDAxZOMr8XPwnlxy296m+0mwTvtCXHUwMDFlaPXJXHUwMDAwN/5cXDdWRyTcb0167DP0ZpTUg6mPxGfiPq5YSovC51C2+1xyuNHZXHUwMDFkiy/7RPhzXTBed6xcdTAwMDKm381POfFkWHpcdTAwMTNrOOvTsL3XiU4kbIufOVx1MDAwMp7VNMtcdTAwMWP/XHUwMDE4mqq9wsu+bHV5zdwwv1x1MDAxM6xcdTAwMWLvauChlOdcdTAwMDCQvFxc01x1MDAxZoeO/vA7ldt7NIGvXlx1MDAwNC/xXHUwMDA3wM/YlCclVED332HejmBcdTAwMDWMJ5Ph/S/vQYy8XHUwMDA3w9Rd9TJm3ifTeXOtYTbkPWL+SllcdTAwMTc54T6/+Po0xten6tHcz/yc35Bw4ZxGIKKSplx1MDAwMdFXq7ehV8bE++fPbW7kSz75Jkz8KzHzXGL7i0by2zt6ZfYk532OfdSq74c+nZlcdTAwMGJcdTAwMThrS6u6zUXjasxxZGG7L1x1MDAwNT2aiHCq37c2RV9fxFc/7lxcW1xiuVx1MDAxMnvkSrCVw7l+uZvzXHRHXHUwMDFinFwihNqRyTq+rrtcdTAwMGYgWFwitfer513Cf/nVfnlKq2FcdTAwMTKh1vroZN7Lglx1MDAxNo6nM1x1MDAxYvjkJ+rkj3Y7l5y8c8tlfbZd2q9cdTAwMGa3XHIvXHUwMDBm05XmmEb2ezwliPnH2ttcdTAwMThcdTAwMWMxJ/XA6vKLvbyB3ivl7sC7eCruptiVh4WrTU4pzZ6H/aVC8Fx1MDAxMpKLstSTX5Ry4Fx1MDAxZVxmLdLpd7daPseuNF+d6Fx1MDAxYpxjxpHbr/RxajNb6mj79dNgXHUwMDBlXFx/4N+A4/1cdTAwMDCbdU3tzFx1MDAxZFx1MDAxNuRcclxy0/Xc9i1kvcFcdTAwMTb+YOw7jH1cdTAwMDXIr9yRrfTaLbqdpKJ2KD3IsVbCdUchQvE/cqy3NN2u/dF++6SL8J6BpzHs5Xq5qpvRqvnT/cBcdTAwMWW4h2e8LrfldzXHNJcup+9VyLDbXHUwMDFhzm1cdTAwMDd3yeryP7L9XHUwMDE5cbO+/9rH97acYlx1MDAxYV5jt5vr+dyrXHUwMDA1PcxGXHUwMDBmhXhvo7z7J5dcdTAwMDBjZtEuL69cdTAwMTPvy81cdTAwMWOnxrZaYGfFoM+whkHqLFEyO/NXr9VjXHUwMDAwXG7iiXdDiplcdTAwMWR17GT7MUBz7cZcZnyEq2BtXHUwMDEwqVx1MDAwNcInuIHN2CtcdTAwMDX+7Vn+ZLhWUHNcZihfXHUwMDA08lx1MDAxNp5cdTAwMTBORCx45u/nLdx7nLB2SVP+5Vx1MDAxYlx1MDAwMaxcIlx1MDAwNpmSUFx1MDAxYit8XHUwMDE218k2SrTAPzXWx/VcdTAwMDJcdTAwMWNZ29Vf7trhaf5P7uM4cpDHWmFeXHUwMDBmZK0u/IvLeYBDirVcdTAwMDfPrU1cdTAwMDB2c1RcdTAwMDJxXFzeIX/PLI3P7DebjHi0S85cdTAwMWS9aMdiXHUwMDEztOlcdTAwMWFcdTAwMTOAoFxcXHUwMDAyR0tPiFx1MDAxN1xi13rBiCNZwLrE1orz5DXbj1hAU5o60GybbnpZcH2lflx1MDAxY87JU/rp84ThXHKxk2smJrb1gpWOL1x1MDAxNSiSm27cXlx1MDAwMsDjwYVqj3Do44IxdXacXHUwMDFkzWo6yeRqPMlfj/3PXHUwMDFlx1x1MDAxNYVcdTAwMTTBuuJcdTAwMTZt8Ctbijp4vbW7XHUwMDFh/fY3v56hXHUwMDBmylxcPcY76lxczz7G5H1Wo0yNRoU9buwvXHUwMDE4h1xckVx1MDAxNV+If2pcdTAwMDXy687m15jU4Oz9iGip9drPuqRcdFp6VtdrsVwit89vKYQ3c+ch1lx1MDAxZl97w1x1MDAxYzhzTFx1MDAwZu2sul+jz1xcb6RcdTAwMWM9XHUwMDEzUJaKfXtw0a+13a+1mkbolpavP1utjOdcdTAwMTdcdTAwMGJcdTAwMWI0rYyjsKyXXHUwMDBle/S0w5Dn7+XZdo98dLV081x1MDAxN9+o/HBOi8E592dmXHUwMDBiv3qlXHUwMDA3x35F6Vx1MDAxYlxu97FfQ74m+uuf64ZcdTAwMTlcdTAwMDHse/8sdHm5TnxcYt5VjXBcXEeHmbxaq9Jr82f/XFxpeM+tdNFE19kt9Vx1MDAxOZqnXHUwMDEy4Fx1MDAxMzKYciBcdTAwMWYwXHUwMDA3TVx0SML/vc5cdTAwMWWuXHUwMDEz00r01dOvruPb4+AttaLlXHUwMDAzXHTPJVNbhe5Rxc/e5t7IR2SaXHUwMDE4s+ly3farJOBr3EvrQF6G69QzJdfqdolcdTAwMTWvQ6xocXtCzHRskc3ci8EhVO9qXG7qXHUwMDEy1tWEXHUwMDFmzVxmXGL5Jc5zv+C+ZfpwXHUwMDA02Vct9kStYn/4XHUwMDA3XHUwMDA34fywXCJba5h7XHUwMDFl40rdJTjyru37JCtf9Vx1MDAwM+RcdTAwMGb4XHUwMDA2q2DD0cZi6y43Pl0x7pttyVx1MDAwM6zLXHRcdTAwMDXzbIVyQlx1MDAxZbkl91x1MDAxN6RcdTAwMWVNq/BI1Ko1XHUwMDFl9FwiXHUwMDA3PnBcdTAwMTBcdTAwMGbbV2Q4ns92P3uBhNZcZp/OnKWbezSwslf+PdVcdTAwMDKV9Uhslr9tKaC7e52DZK3COZYxe3+35efw/vEq3XDmjdBpO6yNXHUwMDAzoftTb5yfvYdfkd+xzyM+O28hXHUwMDA1S479MZ5Z8zj7lfjquoW/OylcdTAwMTnIIzfUO1x1MDAxOXHhzP5Dap7t3vSOc/GH7/jckK/wr5tor71cdTAwMWb+giM4l21X4rp3Qoi3vY9neYZcdTAwMWL1TotcdTAwMGLW0LkhrZs7kYmLdFct91W/gGDufK+tZLbX4FxmSvXsKWrNfX5Y3u5cdTAwMDZcdTAwMTbU5romMTRl2dtIsE0liWBP3lx1MDAwNc7MvdTeXHUwMDFiu4GFz79cXIb+vG7/PjGbXHUwMDBmO+KbIa99O3NcdTAwMTT1uXogXHUwMDFja2R6f5WEMf8nT5/WXHUwMDAzLVx1MDAwMJxPg55cdTAwMGbpcs+94Jlcblx1MDAxZFVlY71PvTzZuHL+XFzwv2tcdTAwMWPCmlx1MDAwMlx1MDAxZDSaWNGf3uDOfqd2eEXVuVx1MDAxM2XlxXDekp5cdTAwMDc2ecVcZvHHmedcdTAwMTDjXHUwMDFjgHd5hKiukYs8JcB+XHUwMDA1TVKRbyaDNS5x7Vx1MDAwNTzaMPyPXHUwMDAzz9X2XHI2OoeCR71wKVx1MDAxMm+yXHRloXwo9bEzKFx1MDAxZk9CpXHp955cdTAwMTBymnySXG74wsnuOa63W+yKk5XhjOJWvZE+XHUwMDBlZjlgevtcdTAwMTWALYGyOOCX38lhreTG9Vx1MDAxMvY95MnZ15VS6nFe7Vx1MDAxOI9cdTAwMWThooQxQ9NYM+v2s8e2t05cblx1MDAwNPOymXCK3ZJCJ+1+OZlsrF2lqvcjnm33TlXZ3jbF3lx1MDAwNr/Wm1x1MDAwYnss3LT9f+vlolwipjfuXFz73L/W/q3WXHUwMDAy8S7hueohqHbxZqk7XHUwMDE4Z3dyXHJVePxS8yz08Yz6wHxEhnOXWVKnhJhtfnWZ3TivXHUwMDE4o7FcdTAwMTdY4ku6fyHeUl5Hoscl7JFvrpXiTjWgxVhcdTAwMDPKXHUwMDExr/PW0H7xgpb6hZZ7XG7X7rbVW6B6yVx1MDAwZcNcdTAwMDWLxLeh1lx1MDAwNI+qTF1kOMeuZ351OZCK9ZYqmlx1MDAxNdfaRfKX+nj5XCL2OI1bXHUwMDE1/qpb4lx1MDAwNLPu9yi5iojGXGY5W+dcdTAwMTCgbnD81VxuQnzN+9/sRMw1/PDc1/M1XHUwMDA0Lpkj7CrM1IBXc0vIl9wy5NcgTmI9gpaD3HNcdTAwMTb+XGLicofib1wiejB3p6JcdTAwMTOMPDyYjlx0Ztxhs2NcdTAwMWTl907izS9317DSJlx1MDAwNVF79XBlJaeqVkf1avZcdTAwMTNpQFx1MDAwZbM27s6qOYGlXHUwMDE2ouBMR0/ZVfnx18esx1b+y1xuqsOEXHUwMDA3XHUwMDE08S1cZjTYd7emXHUwMDFlVrOe5eiOXTAoKGtw/m6kVTxir/hcdTAwMTW+drBeW+ePXHUwMDAztuFDrGaQt4895nzOxjVB05h3po9cdTAwMDH9TrdcdTAwMDJcIlSXdeTHOFx1MDAwNfGy03tZx1x1MDAxZVNFT/Vi9u9kptpaazOAxYRp7eZ+rVRdKyhiWknb5lFvt7BcdTAwMDVPXHUwMDE27qnjNqsvtDFcbmM/XHUwMDE15nN4zblJT1x1MDAxOMksiy1cdTAwMWG/Jv7E9r3u6aBEiIwl33iErI25XHUwMDA2Z5hcdTAwMWQsS06B7Fx1MDAxMWLXLTkjodtcdTAwMDasnHrhXHUwMDE5u6aO+7RtpTLEK1x1MDAwMVvbxjhTgP27u035fjiW0Cw20SNcdTAwMWSEv1x1MDAxYYm3XHUwMDFm7CDvV2v29cJP6VxcX1x1MDAwMc+zYLnCXHUwMDEzV6JBX1x1MDAxNq6FxVnLL94nioO8XumqJIux7PE5YEjHziBcdTAwMWUw9ptAXHUwMDE214mALc/pdSqFme9cdTAwMWVGvDop27BcdTAwMWIySlx1MDAxZd5+ylx1MDAxNbLieEbAZ+962rpZclx1MDAwNLzMWqdcdTAwMGLlolx1MDAwMJ5cdTAwMGZ9XHUwMDAwXHUwMDFhKvnr1ep6XHUwMDFj9ek+9j00/tn/xrvvXHUwMDBmP5CeyVx1MDAwMuClXG44ni9cdTAwMWaQ84q9XZnDeog7XHUwMDE4se2o4C6e21xcYH9cdTAwMWO2jbCPYS1sxlx1MDAxM+3NV3vO8Vx1MDAwMz/1dNAkhyVv8ce3ymu2d1x1MDAwZjXw0YNC7Inej1vt+VlcdML43sZcdTAwMDNAm2a0nvvWXUFf7Frvl1x1MDAxNVx1MDAxZZDJXHUwMDE31+Ruv/9T69fYU3zcy37JrqJgV/74SPZ4p1k8xi8q1Xs5O3jmnUmYPk49g4WvgLZqS5T6XFxzPsZFatrLjKVYh6p2nuvUQd7XMGYvk/+Ddem9zmBKXHUwMDEwXHUwMDFiT11Y/ENZZ2fWbsOyt9P4I2eVTYJHXHLTTPmKRs1hfrTZ8Fi29Fx1MDAwMfWOXz1KXqwnXHUwMDEyLrYn4Fx1MDAwYtI5VVO2YulnN3EjQ2xPWvlcdTAwMWT8ck7xzTHVnDDtXHUwMDFiuEjFc9dQXHUwMDA0+PWMXHUwMDE0Y29cZuqwXHUwMDEz1zny2kehrZlcdTAwMWXWXHUwMDFlXHUwMDBmx3BPgjT51kXkXHUwMDAwZeRJMfY87jVefP/mXHUwMDFjdp1cdTAwMWHgXHUwMDEyyVx1MDAxOFVpP+mbmkjF507M++puhtycuWVOWfdbe1x0NidFdeNRuNcjXHLeXHUwMDAwgaVGK2GaXHUwMDE5XHT9xFx1MDAwNcq+tu9vN9Ukjj26MeTqz1lcdTAwMDGQ0GzLylxik4frXHUwMDEz0zyJYe7FsGf9Y1x1MDAxMuDvdU63RYMkJWht8837eEEm0+b4q/NOYVx1MDAxZNO6o7F8lil4XHUwMDE2XHUwMDE3Z31it1x0WSj7IMa5aslcdTAwMGY4mzF2UqIws3/vpVx1MDAwNFJcdTAwMGZwwGmlhVx1MDAxNiElkfc0iE5felx1MDAwM1x1MDAxNFg6bD7wV32bbdv3rX5lXHUwMDAwXHUwMDAw/1x1MDAxOeZcdTAwMDXYMN5/pfZcdTAwMWLZb5KtprAytmtcdTAwMWFn8/rl3+WHMtTpPVYvXHUwMDFk/PJcdTAwMWPSle3U4pCfS25n9brf3i5VtvQz9LH3XHUwMDEwy5RR+CH/cPLl9cbroM74tFi3J/ssbjAmbDjk+Lmlcz3hkLfPLjzuXHUwMDFkknv8y+XYJzVhiVON3nttdqL76oCduYbe7o//1N7vuS+NYVx1MDAwYoa+XHQ8nGlPtdbh+HWYbk/sMj6qJfSt/Hoohn7AXG5cdTAwMDHfuWZs7LNTXG6AI3RxXHUwMDA3XHUwMDFhcqG2Wuw8jVx1MDAwZuUhf/pcdTAwMTmGeotr24F/ZNRNtaJcdTAwMGX1mpfTZ1x1MDAxMCTY0am+u9OPrzDePVZ49ZZN2yO5cPzpUdBjXZVmqtJHM+qVMoypRD9cdTAwMWPoXCJcdTAwMWNccvN0yHWj6YA0lD82XCJcdTAwMDaX+I1cdTAwMTOHd1x1MDAxZsuFkUewXHJttV1YIFx1MDAwNaYu8dVcdTAwMWFilFx1MDAxY8RcdTAwMTdMQTNX+eXb2VQ96DhSkMxcdTAwMTcpviHbgMPNalx1MDAxZrHwpza1XHUwMDFj8bngOllSa9GC2fr3XHJThVx1MDAxMEy+MaUzX1xih4C9rOSPnqTlXHUwMDFmrm2Z22xcdTAwMWFcdTAwMTSWrVx1MDAxNiymipxkg3CffVx1MDAwZYZBsPvDTupcdTAwMWFEO38r0NzeXHUwMDA3Yf+nzlx1MDAxMp7JlaLVXHJB7f2fXHUwMDFjXHUwMDFmPFx1MDAwM/yairV78ldnyiXZy9p6kF5aoXFcXLN/uVx1MDAxZXOspS907HgopMMvb9rj21x1MDAwM6BfzkZu6D3axYa7ulx1MDAxZZRTsqmEnPVcdTAwMTIu+PVcdTAwMDH4t8Gd+4+LxHDBUs9cdTAwMDXlL4A1vT7ZtuCBXHUwMDE4LXmRXHUwMDFm/sc0hVx1MDAwM77PXzSD2HRcdTAwMWH9rTdcdTAwMTfgZkix+GRqwtdS4Vx1MDAwZu+a3fZFLd9Q91x1MDAxMUs+XHJQUpSr06dYmaVhXHUwMDFkklx1MDAxY9XEl/G4c4Ljzj56oN5cZu+xXHL+yIVcdTAwMDFcdTAwMTCQ3cSEiK5rtMcvKza/waOK/IKUss5Dg5pcYmgu8d98XHUwMDFlXHUwMDE1a4Jsk/3ZrCwtWfeL9uNcdTAwMTFcdTAwMDb+xPxcdTAwMDb84a49p56JwbeaO+F7ZVGvMVDW3/lrqm5cdTAwMDL3KK6eyVnKXHUwMDExniBV4r1F5Yp213eOLYTnVyDf+z6+/6zZWCTiQ/f45VSky1BcdTAwMTNcIqXlenV18iVmgbz5jjOPO/TWqTJGXHUwMDAxno6T7o2CXHUwMDE3olok/b1cdTAwMWWE3G7AXHUwMDEx7SHcxCVcYtyQLzmpYdtILZHNXHUwMDE4eelcdTAwMDWd9tI9qqhMQ3OIot81S1x1MDAxZs79n4E05J+AXHUwMDBllEpDO6Tdulx1MDAwNlx1MDAwNj9cdTAwMDfubm862zV3VJT/81//6z/+c/jnv85VfGri6L/+93+uqPVcdTAwMDZfYav+v6vN8vf3U904cVNd4/b//9bwpf/+XHUwMDBm+O9//19cdIFcdTAwMDcjIn0=Official MCP RegistryUnderlying package registriesAnthropic MCP RegistryGitHub MCP RegistryMicrosoft MCP RegistryEnterprise Corp. MCP Registry(a bit like JFrog Artifactory)Claude CodeVS CodeCursorClaude.ai👨‍💻🧑‍💻👩‍💻MCP Server DevelopersSubmit MCP serversto via CLI / APIData pulled into subregistries,or can be used directlyReferences+ Private internalservers+ many more ...+ many more ... \ No newline at end of file diff --git a/docs/modelcontextprotocol-io/faq.mdx b/docs/modelcontextprotocol-io/faq.mdx new file mode 100644 index 0000000..1e2610e --- /dev/null +++ b/docs/modelcontextprotocol-io/faq.mdx @@ -0,0 +1,39 @@ +# Frequently Asked Questions + +## General + +### What is the difference between "Official MCP Registry", "MCP Registry", "MCP registry", "MCP Registry API", etc? + +- "MCP Registry API" — An API that implements the [OpenAPI spec](https://github.com/modelcontextprotocol/registry/blob/main/docs/reference/api/openapi.yaml) defined by the MCP Registry. +- "Official MCP Registry API" — The REST API served at `https://registry.modelcontextprotocol.io`, which is a superset of the MCP Registry API. Its OpenAPI spec can be downloaded from [https://registry.modelcontextprotocol.io/openapi.yaml](https://registry.modelcontextprotocol.io/openapi.yaml). +- "MCP registry" — A third-party service that provides an MCP Registry API. +- "Official MCP Registry" (or "The MCP Registry") — The service that lives at `https://registry.modelcontextprotocol.io`. + +### Can I delete/unpublish my server? + +Currently, no. At the time of writing, there is [open discussion](https://github.com/modelcontextprotocol/registry/issues/104). + +### How do I update my server metadata? + +Submit a new `server.json` with a unique version string. Once published, version metadata is immutable (similar to npm). + +### Can I add custom metadata when publishing? + +Yes, custom metadata under `_meta.io.modelcontextprotocol.registry/publisher-provided` is preserved when publishing to the registry. This allows you to include custom metadata specific to your publishing process. + + + +There is a 4KB size limit (4096 bytes of JSON). Publishing will fail if this limit is exceeded. + + + +## Reporting Issues + +### What if I need to report a spam or malicious server? + +1. Report it as abuse to the underlying package registry (e.g. NPM, PyPi, DockerHub, etc.); and +2. Raise a GitHub issue on the registry repo with a title beginning `Abuse report: ` + +### What if I need to report a security vulnerability in the registry itself? + +Follow [the MCP community SECURITY.md](https://github.com/modelcontextprotocol/.github/blob/main/SECURITY.md). diff --git a/docs/modelcontextprotocol-io/github-actions.mdx b/docs/modelcontextprotocol-io/github-actions.mdx new file mode 100644 index 0000000..00f72ce --- /dev/null +++ b/docs/modelcontextprotocol-io/github-actions.mdx @@ -0,0 +1,223 @@ +--- +title: How to Automate Publishing with GitHub Actions +sidebarTitle: GitHub Actions +--- + +## Step 1: Create a Workflow File + +In your server project directory, create a `.github/workflows/publish-mcp.yml` file. Here is an example for npm-based local server, but the MCP Registry publishing steps are the same for all package types: + + + +```yaml OIDC authentication (recommended) +name: Publish to MCP Registry + +on: + push: + tags: ["v*"] # Triggers on version tags like v1.0.0 + +jobs: + publish: + runs-on: ubuntu-latest + permissions: + id-token: write # Required for OIDC authentication + contents: read + + steps: + - name: Checkout code + uses: actions/checkout@v5 + + ### Publish underlying npm package: + + - name: Set up Node.js + uses: actions/setup-node@v5 + with: + node-version: "lts/*" + + - name: Install dependencies + run: npm ci + + - name: Run tests + run: npm run test --if-present + + - name: Build package + run: npm run build --if-present + + - name: Publish package to npm + run: npm publish + env: + NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} + + ### Publish MCP server: + + - name: Install mcp-publisher + run: | + curl -L "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_$(uname -s | tr '[:upper:]' '[:lower:]')_$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/').tar.gz" | tar xz mcp-publisher + + - name: Authenticate to MCP Registry + run: ./mcp-publisher login github-oidc + + # Optional: + # - name: Set version in server.json + # run: | + # VERSION=${GITHUB_REF#refs/tags/v} + # jq --arg v "$VERSION" '.version = $v' server.json > server.tmp && mv server.tmp server.json + + - name: Publish server to MCP Registry + run: ./mcp-publisher publish +``` + +```yaml PAT authentication +name: Publish to MCP Registry + +on: + push: + tags: ["v*"] # Triggers on version tags like v1.0.0 + +jobs: + publish: + runs-on: ubuntu-latest + permissions: + contents: read + + steps: + - name: Checkout code + uses: actions/checkout@v5 + + ### Publish underlying npm package: + + - name: Set up Node.js + uses: actions/setup-node@v5 + with: + node-version: "lts/*" + + - name: Install dependencies + run: npm ci + + - name: Run tests + run: npm run test --if-present + + - name: Build package + run: npm run build --if-present + + - name: Publish package to npm + run: npm publish + env: + NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} + + ### Publish MCP server: + + - name: Install mcp-publisher + run: | + curl -L "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_$(uname -s | tr '[:upper:]' '[:lower:]')_$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/').tar.gz" | tar xz mcp-publisher + + - name: Authenticate to MCP Registry + run: mcp-publisher login github --token ${{ secrets.MCP_GITHUB_TOKEN }} + + # Optional: + # - name: Set version in server.json + # run: | + # VERSION=${GITHUB_REF#refs/tags/v} + # jq --arg v "$VERSION" '.version = $v' server.json > server.tmp && mv server.tmp server.json + + - name: Publish server to MCP Registry + run: ./mcp-publisher publish +``` + +```yaml DNS authentication +name: Publish to MCP Registry + +on: + push: + tags: ["v*"] # Triggers on version tags like v1.0.0 + +jobs: + publish: + runs-on: ubuntu-latest + permissions: + contents: read + + steps: + - name: Checkout code + uses: actions/checkout@v5 + + ### Publish underlying npm package: + + - name: Set up Node.js + uses: actions/setup-node@v5 + with: + node-version: "lts/*" + + - name: Install dependencies + run: npm ci + + - name: Run tests + run: npm run test --if-present + + - name: Build package + run: npm run build --if-present + + - name: Publish package to npm + run: npm publish + env: + NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} + + ### Publish MCP server: + + - name: Install mcp-publisher + run: | + curl -L "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_$(uname -s | tr '[:upper:]' '[:lower:]')_$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/').tar.gz" | tar xz mcp-publisher + + # !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! + # TODO: Replace `example.com` with your domain name + # !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! + - name: Authenticate to MCP Registry + run: | + echo "${{ secrets.MCP_PRIVATE_KEY }}" > key.pem + mcp-publisher login dns --domain example.com --private-key-file key.pem + + # Optional: + # - name: Set version in server.json + # run: | + # VERSION=${GITHUB_REF#refs/tags/v} + # jq --arg v "$VERSION" '.version = $v' server.json > server.tmp && mv server.tmp server.json + + - name: Publish server to MCP Registry + run: ./mcp-publisher publish +``` + + + +## Step 2: Add Secrets + +You may need to add a secret to the repository depending on which authentication method you choose: + +- **GitHub OIDC Authentication**: No dedicated secret necessary. +- **GitHub PAT Authentication**: Add a `MCP_GITHUB_TOKEN` secret with a GitHub Personal Access Token (PAT) that has `read:org` and `read:user` scopes. +- **DNS Authentication**: Add a `MCP_PRIVATE_KEY` secret with your Ed25519 private key. + +You may also need to add secrets for your package registry. For example, the workflow above needs an `NPM_TOKEN` secret with your npm token. + +For information about how to add secrets to a repository, see [Using secrets in GitHub Actions](https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/use-secrets). + +## Step 3: Tag and Release + +Create and push a version tag to trigger the workflow: + +```bash +git tag v1.0.0 +git push origin v1.0.0 +``` + +The workflow will run tests, build the package, publish the package to npm, and publish the server to the MCP Registry. + +## Troubleshooting + +{/* prettier-ignore-start */} + +| Error Message | Action | +| --- | --- | +| "Authentication failed" | Ensure `id-token: write` permission is set for OIDC, or check secrets. | +| "Package validation failed" | Verify your package successfully published to the package registry (e.g., npm, PyPI), and that your package has the [necessary verfication information](./package-types.mdx). | + +{/* prettier-ignore-end */} diff --git a/docs/modelcontextprotocol-io/moderation-policy.mdx b/docs/modelcontextprotocol-io/moderation-policy.mdx new file mode 100644 index 0000000..93c03d9 --- /dev/null +++ b/docs/modelcontextprotocol-io/moderation-policy.mdx @@ -0,0 +1,58 @@ +--- +title: The MCP Registry Moderation Policy +sidebarTitle: Moderation Policy +--- + +**TL;DR**: The MCP Registry is quite permissive! We only remove illegal content, malware, spam, and completely broken servers. + +## Scope + +This policy applies to the official MCP Registry at `registry.modelcontextprotocol.io`. + +Subregistries may have their own moderation policies. If you have questions about content on a specific subregistry, please contact them directly. + +## Disclaimer + +The MCP Registry **does not** make guarantees about moderation, and consumers should assume minimal-to-no moderation. + +The MCP Registry is a community supported project, and we have limited active moderation capabilities. We largely rely on upstream package registries (like NPM, PyPi, and Docker) or downstream subregistries (like the GitHub MCP Registry) to do more in-depth moderation. + +This means there may be content in the MCP Registry that should be removed under this policy, but which we haven't yet removed. Consumers should treat scraped data accordingly. + +## What We Remove + +We will remove servers that contain: + +- Illegal content, which includes obscene content, copyright violations, and hacking tools +- Malware, regardless of intentions +- Spam, especially mass-created servers that disrupt the registry. Examples: + - The same server being submitted multiple times under different names + - A server that doesn't do anything but provide a fixed response with some marketing copy + - A server with a description stuffed with marketing copy and an unrelated implementation +- Non-functioning servers + +## What We Don't Remove + +Generally, we believe in keeping the registry open and pushing moderation to subregistries. We therefore **won't** remove: + +- Low-quality or buggy servers +- Servers with security vulnerabilities +- Servers that do the same thing as other servers +- Servers that provide or contain adult content + +## How Removal Works + +When we remove a server, we set the server's `status` to `"deleted"`, but the server's metadata remains accessible via the MCP Registry API. Aggregators may then remove the server from their indexes. + +In extreme cases, we may overwrite or erase the server's metadata. For example, if the metadata itself is unlawful. + +## Appeals + +Think we made a mistake? Open an issue on our [GitHub repository](https://github.com/modelcontextprotocol/registry) with: + +- The name of the server +- Why you believe the server doesn't meet the above criteria for removal + +## Changes to This Policy + +We're still learning how best to run the MCP Registry! As such, we might end up changing this policy in the future. diff --git a/docs/modelcontextprotocol-io/package-types.mdx b/docs/modelcontextprotocol-io/package-types.mdx new file mode 100644 index 0000000..496ff53 --- /dev/null +++ b/docs/modelcontextprotocol-io/package-types.mdx @@ -0,0 +1,201 @@ +--- +title: MCP Registry Supported Package Types +sidebarTitle: Package Types +--- + +# Package Types + +The MCP Registry supports several different package types, and each package type has its own verification method. + +## npm Packages + +For npm packages, the MCP Registry currently supports the npm public registry (`https://registry.npmjs.org`) only. + +npm packages use `"registryType": "npm"` in `server.json`. For example: + +```json server.json highlight={9} +{ + "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", + "name": "io.github.username/email-integration-mcp", + "title": "Email Integration", + "description": "Send emails and manage email accounts", + "version": "1.0.0", + "packages": [ + { + "registryType": "npm", + "identifier": "@username/email-integration-mcp", + "version": "1.0.0", + "transport": { + "type": "stdio" + } + } + ] +} +``` + +### Ownership Verification + +The MCP Registry verifies ownership of npm packages by checking `mcpName` in `package.json`. The `mcpName` property **MUST** match the server name from `server.json`. For example: + +```json package.json +{ + "name": "@username/email-integration-mcp", + "version": "1.0.0", + "mcpName": "io.github.username/email-integration-mcp" +} +``` + +## PyPI Packages + +For PyPI packages, the MCP Registry currently supports the official PyPI registry (`https://pypi.org`) only. + +PyPI packages use `"registryType": "pypi"` in `server.json`. For example: + +```json server.json highlight={9} +{ + "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", + "name": "io.github.username/database-query-mcp", + "title": "Database Query", + "description": "Execute SQL queries and manage database connections", + "version": "1.0.0", + "packages": [ + { + "registryType": "pypi", + "identifier": "database-query-mcp", + "version": "1.0.0", + "transport": { + "type": "stdio" + } + } + ] +} +``` + +### Ownership Verification + +The MCP Registry verifies ownership of PyPI packages by checking for the existence of an `mcp-name: $SERVER_NAME` string in the package README (which becomes the package description on PyPI). The string may be hidden in a comment, but the `$SERVER_NAME` portion **MUST** match the server name from `server.json`. For example: + +```markdown README.md highlight={5} +# Database Query MCP Server + +This MCP server executes SQL queries and manages database connections. + + +``` + +## NuGet Packages + +For NuGet packages, the MCP Registry currently supports the official NuGet registry (`https://api.nuget.org`) only. + +NuGet packages use `"registryType": "nuget"` in `server.json`. For example: + +```json server.json highlight={9} +{ + "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", + "name": "io.github.username/azure-devops-mcp", + "title": "Azure DevOps", + "description": "Manage Azure DevOps work items and pipelines", + "version": "1.0.0", + "packages": [ + { + "registryType": "nuget", + "identifier": "Username.AzureDevOpsMcp", + "version": "1.0.0", + "transport": { + "type": "stdio" + } + } + ] +} +``` + +### Ownership Verification + +The MCP Registry verifies ownership of NuGet packages by checking for the existence of an `mcp-name: $SERVER_NAME` string in the package README. The string may be hidden in a comment, but the `$SERVER_NAME` portion **MUST** match the server name from `server.json`. For example: + +```markdown README.md highlight={5} +# Azure DevOps MCP Server + +This MCP server manages Azure DevOps work items and pipelines. + + +``` + +## Docker/OCI Images + +For Docker/OCI images, the MCP Registry currently supports: + +- Docker Hub (`docker.io`) +- GitHub Container Registry (`ghcr.io`) +- Google Artifact Registry (any `*.pkg.dev` domain) +- Azure Container Registry (`*.azurecr.io`) +- Microsoft Container Registry (`mcr.microsoft.com`) + +Docker/OCI images use `"registryType": "oci"` in `server.json`. For example: + +```json server.json highlight={9} +{ + "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", + "name": "io.github.username/kubernetes-manager-mcp", + "title": "Kubernetes Manager", + "description": "Deploy and manage Kubernetes resources", + "version": "1.0.0", + "packages": [ + { + "registryType": "oci", + "identifier": "docker.io/yourusername/kubernetes-manager-mcp:1.0.0", + "transport": { + "type": "stdio" + } + } + ] +} +``` + +The format of `identifier` is `registry/namespace/repository:tag`. For example, `docker.io/user/app:1.0.0` or `ghcr.io/user/app:1.0.0`. The tag can also be specified as a digest. + +### Ownership Verification + +The MCP Registry verifies ownership of Docker/OCI images by checking for an `io.modelcontextprotocol.server.name` annotation. The value of the `io.modelcontextprotocol.server.name` annotation **MUST** match the server name from `server.json`. For example: + +```dockerfile Dockerfile +LABEL io.modelcontextprotocol.server.name="io.github.username/kubernetes-manager-mcp" +``` + +## MCPB Packages + +For MCPB packages, the MCP Registry currently supports MCPB artifacts hosted via GitHub or GitLab releases. + +MCPB packages use `"registryType": "mcpb"` in `server.json`. For example: + +```json server.json highlight={9} +{ + "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", + "name": "io.github.username/image-processor-mcp", + "title": "Image Processor", + "description": "Process and transform images with various filters", + "version": "1.0.0", + "packages": [ + { + "registryType": "mcpb", + "identifier": "https://github.com/username/image-processor-mcp/releases/download/v1.0.0/image-processor.mcpb", + "fileSha256": "fe333e598595000ae021bd27117db32ec69af6987f507ba7a63c90638ff633ce", + "transport": { + "type": "stdio" + } + } + ] +} +``` + +### Verification + +The MCPB package URL (`identifier` in `server.json`) **MUST** contain the string "mcp". That can be as part of the `.mcpb` file extension or in the name of the repository. + +The package metadata in `server.json` **MUST** include a `fileSha256` property with a SHA-256 hash of the MCPB artifact, which can be computed using the `openssl` command: + +```bash +openssl dgst -sha256 image-processor.mcpb +``` + +The MCP Registry does not validate this hash; however, MCP clients **do** validate the hash before installation to ensure file integrity. Downstream registries may also implement their own validation. diff --git a/docs/modelcontextprotocol-io/quickstart.mdx b/docs/modelcontextprotocol-io/quickstart.mdx new file mode 100644 index 0000000..212951f --- /dev/null +++ b/docs/modelcontextprotocol-io/quickstart.mdx @@ -0,0 +1,289 @@ +--- +title: "Quickstart: Publish an MCP Server to the MCP Registry" +sidebarTitle: "Quickstart: Publish a Server" +--- + +This tutorial will show you how to publish an MCP server written in TypeScript to the MCP Registry using the official `mcp-publisher` CLI tool. + +## Prerequisites + +- **Node.js** — This tutorial assumes the MCP server is written in TypeScript. +- **npm account** — The MCP Registry only hosts metadata, not artifacts. Before publishing to the MCP Registry, we will publish the MCP server's package to npm, so you will need an [npm](https://www.npmjs.com) account. +- **GitHub account** — The MCP Registry supports [multiple authentication methods](./authentication.mdx). authentication. For simplicity, this tutorial will use GitHub-based authentication, so you will need a [GitHub](https://github.com/) account. + +If you do not have an MCP server written in TypeScript, you can copy the `weather-server-typescript` server from the [`modelcontextprotocol/quickstart-resources` repository](https://github.com/modelcontextprotocol/quickstart-resources) to follow along with this tutorial: + +```bash +git clone --depth 1 git@github.com:modelcontextprotocol/quickstart-resources.git +cp -r quickstart-resources/weather-server-typescript . +rm -rf quickstart-resources +cd weather-server-typescript +``` + +And edit `package.json` to reflect your information: + +```diff package.json + { +- "name": "mcp-quickstart-ts", +- "version": "1.0.0", ++ "name": "@my-username/mcp-weather-server", ++ "version": "1.0.1", + "main": "index.js", +``` + +```diff package.json + "license": "ISC", +- "description": "", ++ "repository": { ++ "type": "git", ++ "url": "https://github.com/my-username/mcp-weather-server.git" ++ }, ++ "description": "An MCP server for weather information.", + "devDependencies": { +``` + +## Step 1: Add verification information to the package + +The MCP Registry verifies that a server's underlying package matches its metadata. For npm packages, this requires adding an `mcpName` property to `package.json`: + +```diff package.json + { + "name": "@my-username/mcp-weather-server", + "version": "1.0.1", ++ "mcpName": "io.github.my-username/weather", + "main": "index.js", +``` + +The value of `mcpName` will be your server's name in the MCP Registry. + +Because we will be using GitHub-based authentication, `mcpName` **must** start with `io.github.my-username/`. + +## Step 2: Publish the package + +The MCP Registry only hosts metadata, not artifacts, so we must publish the package to npm before publishing the server to the MCP Registry. + +Ensure the distribution files are built: + +```bash +# Navigate to project directory +cd weather-server-typescript + +# Install dependencies +npm install + +# Build the distribution files +npm run build +``` + +Then follow npm's [publishing guide](https://docs.npmjs.com/creating-and-publishing-scoped-public-packages). In particular, you will probably need to run the following commands: + +```bash +# If necessary, authenticate to npm +npm adduser + +# Publish the package +npm publish --access public +``` + +You can verify your package is published by visiting its npm URL, such as https://www.npmjs.com/package/@my-username/mcp-weather-server. + +## Step 3: Install `mcp-publisher` + +Install the `mcp-publisher` CLI tool using a pre-built binary or [Homebrew](https://brew.sh): + + + +```bash macOS/Linux +curl -L "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_$(uname -s | tr '[:upper:]' '[:lower:]')_$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/').tar.gz" | tar xz mcp-publisher && sudo mv mcp-publisher /usr/local/bin/ +``` + +```powershell Windows +$arch = if ([System.Runtime.InteropServices.RuntimeInformation]::ProcessArchitecture -eq "Arm64") { "arm64" } else { "amd64" }; Invoke-WebRequest -Uri "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_windows_$arch.tar.gz" -OutFile "mcp-publisher.tar.gz"; tar xf mcp-publisher.tar.gz mcp-publisher.exe; rm mcp-publisher.tar.gz +# Move mcp-publisher.exe to a directory in your PATH +``` + +```bash +brew install mcp-publisher +``` + + + +Verify that `mcp-publisher` is correctly installed by running: + +```bash +mcp-publisher --help +``` + +You should see output like: + +```text Output +MCP Registry Publisher Tool + +Usage: + mcp-publisher [arguments] + +Commands: + init Create a server.json file template + login Authenticate with the registry + logout Clear saved authentication + publish Publish server.json to the registry +``` + +## Step 4: Create `server.json` + +The `mcp-publisher init` command can generate a `server.json` template file with some information derived from your project. + +In your server project directory, run `mcp-publisher init`: + +```bash +mcp-publisher init +``` + +Open the generated `server.json` file, and you should see contents like: + +```json server.json +{ + "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", + "name": "io.github.my-username/weather", + "description": "An MCP server for weather information.", + "repository": { + "url": "https://github.com/my-username/mcp-weather-server", + "source": "github" + }, + "version": "1.0.0", + "packages": [ + { + "registryType": "npm", + "identifier": "@my-username/mcp-weather-server", + "version": "1.0.0", + "transport": { + "type": "stdio" + }, + "environmentVariables": [ + { + "description": "Your API key for the service", + "isRequired": true, + "format": "string", + "isSecret": true, + "name": "YOUR_API_KEY" + } + ] + } + ] +} +``` + +Edit the contents as necessary: + +```diff server.json + { + "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", + "name": "io.github.my-username/weather", + "description": "An MCP server for weather information.", + "repository": { + "url": "https://github.com/my-username/mcp-weather-server", + "source": "github" + }, +- "version": "1.0.0", ++ "version": "1.0.1", + "packages": [ + { + "registryType": "npm", + "identifier": "@my-username/mcp-weather-server", +- "version": "1.0.0", ++ "version": "1.0.1", + "transport": { + "type": "stdio" +- }, +- "environmentVariables": [ +- { +- "description": "Your API key for the service", +- "isRequired": true, +- "format": "string", +- "isSecret": true, +- "name": "YOUR_API_KEY" +- } +- ] ++ } + } + ] + } +``` + +The `name` property in `server.json` **must** match the `mcpName` property in `package.json`. + +## Step 5: Authenticate with the MCP Registry + +For this tutorial, we will authenticate with the MCP Registry using GitHub-based authentication. + +Run the `mcp-publisher login` command to initiate authentication: + +```bash +mcp-publisher login github +``` + +You should see output like: + +```text Output +Logging in with github... + +To authenticate, please: +1. Go to: https://github.com/login/device +2. Enter code: ABCD-1234 +3. Authorize this application +Waiting for authorization... +``` + +Visit the link, follow the prompts, and enter the authorization code that was printed in the terminal (e.g., `ABCD-1234` in the above output). Once complete, go back to the terminal, and you should see output like: + +```text Output +Successfully authenticated! +✓ Successfully logged in +``` + +## Step 6: Publish to the MCP Registry + +Finally, publish your server to the MCP Registry using the `mcp-publisher publish` command: + +```bash +mcp-publisher publish +``` + +You should see output like: + +```text Output +Publishing to https://registry.modelcontextprotocol.io... +✓ Successfully published +✓ Server io.github.my-username/weather version 1.0.1 +``` + +You can verify that your server is published by searching for it using the MCP Registry API: + +```bash +curl "https://registry.modelcontextprotocol.io/v0.1/servers?search=io.github.my-username/weather" +``` + +You should see your server's metadata in the search results JSON: + +```text Output +{"servers":[{ ... "name":"io.github.my-username/weather" ... }]} +``` + +## Troubleshooting + +{/* prettier-ignore-start */} + +| Error Message | Action | +| --- | --- | +|"Registry validation failed for package"|Ensure your package includes the required validation information (e.g, `mcpName` property in `package.json`).| +|"Invalid or expired Registry JWT token"|Re-authenticate by running `mcp-publisher login github`.| +|"You do not have permission to publish this server"|Your authentication method doesn't match your server's namespace format. With GitHub auth, your server name must start with `io.github.your-username/`.| + +{/* prettier-ignore-end */} + +## Next Steps + +- Learn about [support for other package types](./package-types.mdx). +- Learn about [support for remote servers](./remote-servers.mdx). +- Learn how to [use other authentication methods](./authentication.mdx), such as [DNS authentication](./authentication.mdx#dns-authentication) which enables custom domains for server name prefixes. +- Learn how to [automate publishing with GitHub Actions](./github-actions.mdx). diff --git a/docs/modelcontextprotocol-io/registry-aggregators.mdx b/docs/modelcontextprotocol-io/registry-aggregators.mdx new file mode 100644 index 0000000..11848c7 --- /dev/null +++ b/docs/modelcontextprotocol-io/registry-aggregators.mdx @@ -0,0 +1,106 @@ +--- +title: MCP Registry Aggregators +sidebarTitle: Registry Aggregators +--- + +Aggregators are downstream consumers of the MCP Registry that provide additional value. For example, a server marketplace that provides user ratings and security scanning. + +The MCP Registry provides an unauthenticated read-only REST API that aggregators can use to populate their data stores. Aggregators are expected to scrape data on a regular but infrequent basis (e.g., once per hour), and persist the data in their own data store. The MCP Registry **does not provide uptime or data durability guarantees**. + +## Consuming the MCP Registry REST API + +The base URL for the MCP Registry REST API is `https://registry.modelcontextprotocol.io`. It supports the following endpoints: + +- [`GET /v0.1/servers`](https://registry.modelcontextprotocol.io/docs#/operations/list-servers-v0.1) — List all servers. +- [`GET /v0.1/servers/{serverName}/versions`](https://registry.modelcontextprotocol.io/docs#/operations/get-server-versions-v0.1) — List all versions of a server. +- [`GET /v0.1/servers/{serverName}/versions/{version}`](https://registry.modelcontextprotocol.io/docs#/operations/get-server-version-v0.1) — Get a specific version of a server. Use the special version `latest` to get the latest version of the server. + + + +URL path parameters such as `serverName` and `version` **must** be URL-encoded. For example, `io.modelcontextprotocol/everything` must be encoded as `io.modelcontextprotocol%2Feverything`. + + + +Aggregators will most likely scrape the `GET /v0.1/servers` endpoint. + +### Pagination + +The `GET /v0.1/servers` endpoint supports cursor-based pagination. + +For example, the first page can be fetched using a `limit` query parameter: + +```bash +curl "https://registry.modelcontextprotocol.io/v0/servers?limit=100" +``` + +```jsonc Output highlight={5} +{ + "servers": [ + /* ... */ + ], + "metadata": { + "count": 100, + "nextCursor": "com.example/my-server:1.0.0", + }, +} +``` + +Then subsequent pages can be fetched by passing the `nextCursor` value as the `cursor` query parameter: + +```bash +curl "https://registry.modelcontextprotocol.io/v0/servers?limit=100&cursor=com.example/my-server:1.0.0" +``` + +### Filtering Since + +The `GET /v0.1/servers` endpoint supports filtering servers that have been updated since a given timestamp. + +For example, servers that have been updated since 2025-10-23 can be fetched using an `updated_since` query parameter in [RFC 3339](https://datatracker.ietf.org/doc/html/rfc3339) date-time format: + +```bash +curl "https://registry.modelcontextprotocol.io/v0.1/servers?updated_since=2025-10-23T00:00:00.000Z" +``` + +## Server Status + +Server metadata is generally immutable, except for the `status` field which may be updated to, e.g., `"deprecated"` or `"deleted"`. We recommend that aggregators keep their copy of each server's `status` up to date. + +The `"deleted"` status typically indicates that a server has violated our permissive [moderation policy](./moderation-policy.mdx), suggesting the server might be spam, malware, or illegal. Aggregators may prefer to remove these servers from their index. + +## Acting as a Subregistry + +A subregistry is an aggregator that also implements the [OpenAPI spec](https://github.com/modelcontextprotocol/registry/blob/main/docs/reference/api/openapi.yaml) defined by the MCP Registry. This allows clients, such as MCP host applications, to consume server metadata via a standardized interface. + +The subregistry OpenAPI spec allows subregistries to inject custom metadata via the `_meta` field. For example, a subregistry could inject user ratings, download counts, and security scan results: + +```json server.json highlight={17-26} +{ + "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", + "name": "io.github.username/email-integration-mcp", + "title": "Email Integration", + "description": "Send emails and manage email accounts", + "version": "1.0.0", + "packages": [ + { + "registryType": "npm", + "identifier": "@username/email-integration-mcp", + "version": "1.0.0", + "transport": { + "type": "stdio" + } + } + ], + "_meta": { + "com.example.subregistry/custom": { + "user_rating": 4.5, + "download_count": 12345, + "security_scan": { + "last_scanned": "2025-10-23T12:00:00Z", + "vulnerabilities_found": 0 + } + } + } +} +``` + +We recommend that custom metadata be put under a key that reflects the subregistry (e.g., `"com.example.subregistry/custom"` in the above example). diff --git a/docs/modelcontextprotocol-io/remote-servers.mdx b/docs/modelcontextprotocol-io/remote-servers.mdx new file mode 100644 index 0000000..4b0c85e --- /dev/null +++ b/docs/modelcontextprotocol-io/remote-servers.mdx @@ -0,0 +1,108 @@ +--- +title: Publishing Remote Servers +sidebarTitle: Remote Servers +--- + +The MCP Registry supports remote MCP servers via the `remotes` property in `server.json`: + +```json server.json highlight={7-12} +{ + "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", + "name": "com.example/acme-analytics", + "title": "ACME Analytics", + "description": "Real-time business intelligence and reporting platform", + "version": "2.0.0", + "remotes": [ + { + "type": "streamable-http", + "url": "https://analytics.example.com/mcp" + } + ] +} +``` + +A remote server **MUST** be publicly accessible at its specified URL. + +## Transport Type + +Remote servers can use the Streamable HTTP transport (recommended) or the SSE transport. Remote servers can also support both transports simultaneously at different URLs. + +Specify the transport by setting the `type` property of the `remotes` entry to either `"streamable-http"` or `"sse"`: + +```json server.json highlight={9,13} +{ + "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", + "name": "com.example/acme-analytics", + "title": "ACME Analytics", + "description": "Real-time business intelligence and reporting platform", + "version": "2.0.0", + "remotes": [ + { + "type": "streamable-http", + "url": "https://analytics.example.com/mcp" + }, + { + "type": "sse", + "url": "https://analytics.example.com/sse" + } + ] +} +``` + +## HTTP Headers + +MCP clients can be instructed to send specific HTTP headers by adding the `headers` property to the `remotes` entry: + +```json server.json highlight={11-18} +{ + "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", + "name": "com.example/acme-analytics", + "title": "ACME Analytics", + "description": "Real-time business intelligence and reporting platform", + "version": "2.0.0", + "remotes": [ + { + "type": "streamable-http", + "url": "https://analytics.example.com/mcp", + "headers": [ + { + "name": "X-API-Key", + "description": "API key for authentication", + "isRequired": true, + "isSecret": true + } + ] + } + ] +} +``` + +## Supporting Remote and Non-remote Installation + +The `remotes` property can coexist with the `packages` property in `server.json` in order to allow MCP host applications to choose the preferred method of installation. + +```json server.json highlight={7-22} +{ + "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", + "name": "io.github.username/email-integration-mcp", + "title": "Email Integration", + "description": "Send emails and manage email accounts", + "version": "1.0.0", + "remotes": [ + { + "type": "streamable-http", + "url": "https://email.example.com/mcp" + } + ], + "packages": [ + { + "registryType": "npm", + "identifier": "@username/email-integration-mcp", + "version": "1.0.0", + "transport": { + "type": "stdio" + } + } + ] +} +``` diff --git a/docs/terms.md b/docs/modelcontextprotocol-io/terms-of-service.mdx similarity index 98% rename from docs/terms.md rename to docs/modelcontextprotocol-io/terms-of-service.mdx index b69af44..ea26afa 100644 --- a/docs/terms.md +++ b/docs/modelcontextprotocol-io/terms-of-service.mdx @@ -1,6 +1,9 @@ -# Official MCP Registry Terms +--- +title: Official MCP Registry Terms of Service +sidebarTitle: Terms of Service +--- -Effective date: 2025-09-02 +**Effective date: 2025-09-02** ## Overview diff --git a/docs/modelcontextprotocol-io/versioning.mdx b/docs/modelcontextprotocol-io/versioning.mdx new file mode 100644 index 0000000..ddaedbe --- /dev/null +++ b/docs/modelcontextprotocol-io/versioning.mdx @@ -0,0 +1,167 @@ +--- +title: Versioning Published MCP Servers +sidebarTitle: Versioning +--- + +MCP servers **MUST** define a version string in `server.json`. For example: + +```json server.json highlight={6} +{ + "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", + "name": "io.github.username/email-integration-mcp", + "title": "Email Integration", + "description": "Send emails and manage email accounts", + "version": "1.0.0", + "packages": [ + { + "registryType": "npm", + "identifier": "@username/email-integration-mcp", + "version": "1.0.0", + "transport": { + "type": "stdio" + } + } + ] +} +``` + +The version string **MUST** be unique for each publication of the server. Once published, the version string (and other metadata) cannot be changed. + +## Version Format + +The MCP Registry recommends [semantic versioning](https://semver.org/), but supports any version string format. When a server is published, the MCP Registry will attempt to parse its version as a semantic version string for sorting purposes, and will mark the version as "latest" if appropriate. If parsing fails, the version will always be marked as "latest". + + + +If a server uses semantic version strings but publishes a new version that does _not_ conform to semantic versioning, the new version will be marked as "latest" even if it would otherwise be sorted before the semantic version strings. + + + +As an error prevention mechanism, the MCP Registry prohibits version strings that appear to refer to ranges of versions. + +| Example | Type | Guidance | +| -------------- | ------------------- | ------------------------------ | +| `1.0.0` | semantic version | **Recommended** | +| `2.1.3-alpha` | semantic prerelease | **Recommended** | +| `1.0.0-beta.1` | semantic prerelease | **Recommended** | +| `3.0.0-rc.2` | semantic prerelease | **Recommended** | +| `2025.11.25` | semantic date | Recommended | +| `2025.6.18` | semantic date | Recommended **(⚠️Caution!⚠️)** | +| `2025.06.18` | non-semantic date | Allowed **(⚠️Caution!⚠️)** | +| `2025-06-18` | non-semantic date | Allowed | +| `v1.0` | prefixed version | Allowed | +| `^1.2.3` | version range | Prohibited | +| `~1.2.3` | version range | Prohibited | +| `>=1.2.3` | version range | Prohibited | +| `<=1.2.3` | version range | Prohibited | +| `>1.2.3` | version range | Prohibited | +| `<1.2.3` | version range | Prohibited | +| `1.x` | version range | Prohibited | +| `1.2.*` | version range | Prohibited | +| `1 - 2` | version range | Prohibited | +| `1.2 \|\| 1.3` | version range | Prohibited | + +## Best Practices + +### Use Semantic Versioning + +Use [semantic versioning](https://semver.org/) for version strings. + +### Align Server Version with Package Version + +For local servers, align the server version with the underlying package version in order to prevent confusion: + +```json server.json highlight={2,7} +{ + "version": "1.2.3", + "packages": [ + { + "registryType": "npm", + "name": "@my-username/my-server", + "version": "1.2.3", + "transport": { + "type": "stdio" + } + } + ] +} +``` + +If there are multiple underlying packages, use the server version to indicate the overall release version: + +```json server.json highlight={2,7,15} +{ + "version": "1.3.0", + "packages": [ + { + "registryType": "npm", + "identifier": "@my-username/my-server", + "version": "1.3.0", + "transport": { + "type": "stdio" + } + }, + { + "registryType": "nuget", + "identifier": "MyUsername.MyServer", + "version": "1.0.0", + "transport": { + "type": "stdio" + } + } + ] +} +``` + +### Align Server Version with Remote API Version + +For remote servers with an API version, the server version should align with the API version: + +```json server.json highlight={2,6} +{ + "version": "2.1.0", + "remotes": [ + { + "type": "streamable-http", + "url": "https://api.myservice.com/mcp/v2.1" + } + ] +} +``` + +### Use Prerelease Versions for Registry-only Updates + +If you anticipate publishing a server multiple times _without_ changing the underlying package or remote URL — for example, to update other parts of the metadata — use semantic prerelease versions: + +```json server.json highlight={2} +{ + "version": "1.2.3-1", + "packages": [ + { + "registryType": "npm", + "name": "@my-username/my-server", + "version": "1.2.3", + "transport": { + "type": "stdio" + } + } + ] +} +``` + + + +According to semantic versioning, prerelease versions such as `1.2.3-1` are sorted before regular semantic versions such as `1.2.3`. Therefore, if you publish a prerelease version _after_ its corresponding regular version, the prerelease version will **not** be marked as "latest". + + + +## Aggregator Recommendations + +MCP Registry aggregators **SHOULD**: + +1. Attempt to interpret versions as semantic versions when possible +2. Use the following version comparison rules: + - If one version is marked as "latest", treat it as later + - If both versions are valid semantic versions, use semantic versioning comparison rules + - If neither versions are valid semantic versions, compare published timestamp + - If one version is a valid semantic version and the other is not, treat the semantic version as later diff --git a/docs/reference/api/generic-registry-api.md b/docs/reference/api/generic-registry-api.md index a36b149..3f8cd65 100644 --- a/docs/reference/api/generic-registry-api.md +++ b/docs/reference/api/generic-registry-api.md @@ -3,7 +3,6 @@ A standardized RESTful HTTP API for MCP registries to provide consistent endpoints for discovering and retrieving MCP servers. Also see: -- For guidance consuming the API, see the [consuming guide](../../guides/consuming/use-rest-api.md). - For authentication and authorization, see the [registry authorization specification](./registry-authorization.md). ## Browse the Complete API Specification diff --git a/docs/reference/faq.md b/docs/reference/faq.md deleted file mode 100644 index 034ccb1..0000000 --- a/docs/reference/faq.md +++ /dev/null @@ -1,200 +0,0 @@ -# MCP Registry FAQ - -These questions come up often in discussions about the MCP Registry. If you have a question that isn't answered here, please start a discussion on the [MCP Registry Discussions page](https://github.com/modelcontextprotocol/registry/discussions). - -## General Questions - -### What is the MCP Registry? - -The MCP Registry is the official centralized metadata repository for publicly-accessible MCP servers. It provides: - -- A single place for server creators to publish metadata about their servers -- A REST API for MCP clients and aggregators to discover available servers -- Standardized installation and configuration information -- Namespace management through DNS verification - -### What is the difference between "Official MCP Registry", "MCP Registry", "MCP registry", "MCP Registry API", etc? - -There are four underlying concepts: -- "MCP Server Registry API" (or "MCP Registry API"): The OpenAPI specification defined in [openapi.yaml](./api/openapi.yaml). This is a reusable API specification that anyone building any sort of "MCP server registry" should consider adopting / aligning with. -- "Official MCP Registry" (or "MCP Registry"): The application that lives at `https://registry.modelcontextprotocol.io`. This registry currently only catalogs MCP servers, but may be extended in the future to also catalog MCP client/host apps and frameworks. -- "Official MCP Registry API": The REST API served at `https://registry.modelcontextprotocol.io`, which is a superset of the MCP Registry API. Its OpenAPI specification can be downloaded from [https://registry.modelcontextprotocol.io/openapi.yaml](https://registry.modelcontextprotocol.io/openapi.yaml) -- "MCP server registry" (or "MCP registry"): A third party, likely commercial, implementation of the MCP Server Registry API or derivative specification. - -### Is the MCP Registry a package registry? - -No. The MCP Registry stores metadata about MCP servers and references to where they're hosted (npm, PyPI, NuGet, Docker Hub, etc.), but does not host the actual source code or packages. - -### Who should use the MCP Registry directly? - -The registry is primarily designed for programmatic consumption by subregistries (Smithery, PulseMCP, Docker Hub, Anthropic, GitHub, etc.). It is NOT currently intended for individual clients or end-users (they should use subregistries). - -### Will there be feature X? - -See [roadmap.md](../explanations/roadmap.md). - -## Publishing Servers - -### How do I publish my MCP server? - -See the [publisher README](../../cmd/publisher/README.md) - -### What namespaces are available? - -- **With GitHub verification**: `io.github.yourusername/server-name`, `io.github.yourorg/server-name` -- **With DNS verification**: `com.yourcompany.*`, `com.yourcompany.*/*` -- **With HTTP verification**: `com.yourcompany/*` - -### Is open source required? - -No. The registry supports both open source and closed source servers, as long as they are publicly accessible. - -**Closed source servers are welcome** - you can publish proprietary MCP servers to the registry as long as: -- The server itself is publicly accessible (not restricted to private networks) -- The installation method is publicly available (e.g., npm package, Docker image on public registries) - -This applies to both locally-run and remote servers. - -### What package registries are supported? - -- npm (Node.js packages) -- PyPI (Python packages) -- NuGet.org (.NET packages) -- GitHub Container Registry (GHCR) -- Docker Hub -- Google Artifact Registry (`*.pkg.dev` domains) -- Azure Container Registry (`*.azurecr.io` domains) -- Microsoft Container Registry (MCR) - -More can be added as the community desires; feel free to open an issue if you are interested in building support for another registry. - -### Can I publish multiple versions? - -Yes, versioning is supported: - -- Each version gets its own immutable metadata -- Version strings must be unique for each server -- Old versions remain accessible for compatibility -- The registry tracks which version is "latest" based on semantic version ordering when possible - -### How do I update my server metadata? - -Submit a new `server.json` with a unique version string. Once published, version metadata is immutable (similar to npm). - -### What version format should I use? - -The registry accepts any version string up to 255 characters, but we recommend: - -- **SHOULD use semantic versioning** (e.g., "1.0.2", "2.1.0-alpha") for predictable ordering -- **SHOULD align with package versions** to reduce confusion -- **MAY use prerelease labels** (e.g., "1.0.0-1") for registry-specific versions - -The registry attempts to parse versions as semantic versions for proper ordering. Non-semantic versions are allowed but will be ordered by publication timestamp. Version ranges (e.g., `^1.2.3`, `~1.2.3`, `>=1.2.3`, `1.x`, `1.*`) are rejected; publish a specific version instead. See the [versioning guide](../explanations/versioning.md) for detailed guidance. - -### Can I add custom metadata when publishing? - -Yes, extensions under the `x-publisher` property are preserved when publishing to the registry. This allows you to include custom metadata specific to your publishing process. - -### Can I delete/unpublish my server? - -At time of last update, this was open for discussion in [#104](https://github.com/modelcontextprotocol/registry/issues/104). - -### Can I publish a private server? - -Private servers are those that are only accessible to a narrow set of users. For example, servers published on a private network (like `mcp.acme-corp.internal`) or on private package registries (e.g. `npx -y @acme/mcp --registry https://artifactory.acme-corp.internal/npm`). - -These are generally not supported on the official MCP registry, which is designed for publicly accessible MCP servers. - -If you want to publish private servers we recommend you host your own MCP subregistry, and add them there. - -### What's the difference between closed source and private servers? - -**Closed source servers** have proprietary code but are **publicly accessible**: -- ✅ **Supported**: Can be published to the registry -- ✅ Source code can be proprietary/closed source -- ✅ Installation via public package registries (npm, PyPI, Docker Hub, etc.) -- ✅ Remote servers hosted on public URLs - -**Private servers** are **access-restricted** regardless of source code: -- ❌ **Not supported**: Cannot be published to the official registry -- ❌ Only accessible to specific users/organizations -- ❌ Installation requires private credentials or network access -- ❌ Remote servers on private networks or behind authentication - -**Example**: A commercial MCP server distributed as a paid npm package is closed source but publicly accessible, so it's welcome in the registry. A server only available on your company's internal network is private and not supported. - -## Security & Trust - -### How do I know a server is from the claimed organization? - -DNS verification ensures namespace ownership. For example: - -- `com.microsoft/server` requires DNS verification of microsoft.com -- `io.github.name/server` is tied to a GitHub account or GitHub organization `name` - -### Is there security scanning? - -The MVP delegates security scanning to: -- underlying package registries; and -- subregistries - -### How is spam prevented? - -- Namespace authentication requirements -- Character limits and regex validation on free-form fields -- Manual takedown of spam or malicious servers - -In future we might explore: -- Stricter rate limiting (e.g., 10 new servers per user per day) -- Potential AI-based spam detection -- Community reporting and admin blacklisting capabilities - -## API & Integration - -### How often should I poll the registry? - -Recommended polling frequency: - -- `/servers` endpoint: once per hour -- `/servers/:id` endpoint: once per version (results are immutable) -- Design assumes CDN caching between registry and consumers - -Also see [#291](https://github.com/modelcontextprotocol/registry/issues/291), which might mean the above can be more regular. - -### Will there be webhooks? - -Not in the initial MVP, but the architecture supports adding webhooks for update notifications in the future. - -### Can I run my own registry instance? - -Yes! The API shapes and data formats are intentionally designed for reuse by subregistries. Organizations needing private registries should: - -- Implement the same API shape -- Use the same `server.json` format -- Potentially mirror/filter the official registry data - -### Can I extend the registry API? - -Yes, we support `x-com.example` style extensions in a bunch of places - see the official MCP registry API spec. This can be used to add annotations to many objects, e.g. add security scanning details, enrich package metadata, etc. - -If you have a use case that can't be addressed here, raise a GitHub issue! - -### Can I use the code here to run my own registry instance? - -The registry implementation here is not designed for self-hosting, but you're welcome to try to use it/fork it as necessary. Note that this is not an intended use, and the registry maintainers cannot provide any support for this at this time. - -## Operations & Maintenance - -### What's the expected reliability? - -- This is a community maintained project without full time staffing. You should therefore expect downtime periods of up to 1 business day. No strict guarantees are provided. (Also see discussion in [#150](https://github.com/modelcontextprotocol/registry/issues/150)) -- Ideally clients should use subregistries with higher availability guarantees, to avoid direct end-user impact (as subregistries can cache data). - -### What if I need to report a spam or malicious server? - -1. Report it as abuse to the underlying package registry (e.g. NPM, PyPi, DockerHub, etc.); and -2. Raise a GitHub issue on the registry repo with a title beginning `Abuse report: ` - -### What if I need to report a security vulnerability in the registry itself? - -Follow [the MCP community SECURITY.md](https://github.com/modelcontextprotocol/.github/blob/main/SECURITY.md). diff --git a/docs/reference/server-json/official-registry-requirements.md b/docs/reference/server-json/official-registry-requirements.md index 6ab2325..d2ec18a 100644 --- a/docs/reference/server-json/official-registry-requirements.md +++ b/docs/reference/server-json/official-registry-requirements.md @@ -10,7 +10,6 @@ While the [generic server.json format](./generic-server-json.md) defines the bas - **Namespace authentication** - Servers are published under appropriate namespaces - **Package ownership verification** - Publishers actually control referenced packages -- **Remote server URL match** - Remote server base urls match namespaces - **Restricted registry base urls** - Packages are from trusted public registries - **`_meta` namespace restrictions** - Restricted to `publisher` key only @@ -26,10 +25,6 @@ All packages must include metadata proving the publisher owns them. This prevent For detailed verification requirements for each registry type, see the [publishing guide](../../guides/publishing/publish-server.md). -## Remote Server URL Match - -Remote servers must use URLs that match the publisher's domain from their namespace. For example, `com.example/server` can only use remote URLs on `example.com` or its subdomains. - ## Restricted Registry Base URLs Only trusted public registries are supported. Private registries and alternative mirrors are not allowed. diff --git a/tools/validate-examples/main.go b/tools/validate-examples/main.go index 4df9a88..41d8ba0 100644 --- a/tools/validate-examples/main.go +++ b/tools/validate-examples/main.go @@ -41,7 +41,17 @@ func runValidation() error { expectedCount: &expectedServerJSONCount, }, { - path: filepath.Join("docs", "guides", "publishing", "publish-server.md"), + path: filepath.Join("docs", "modelcontextprotocol-io", "package-types.mdx"), + requireSchema: true, + expectedCount: nil, // No count validation for guide + }, + { + path: filepath.Join("docs", "modelcontextprotocol-io", "quickstart.mdx"), + requireSchema: true, + expectedCount: nil, // No count validation for guide + }, + { + path: filepath.Join("docs", "modelcontextprotocol-io", "remote-servers.mdx"), requireSchema: true, expectedCount: nil, // No count validation for guide }, @@ -182,7 +192,7 @@ func extractExamples(path string, requireSchema bool) ([]example, error) { content := string(data) // Regex to match JSON code blocks in markdown - re := regexp.MustCompile("(?s)```json\r?\n(.*?)\r?\n```") + re := regexp.MustCompile("(?s)```json(?: [^\r\n]+)?\r?\n(.*?)\r?\n```") matches := re.FindAllStringSubmatchIndex(content, -1) var examples []example From df06235a0255f85d089727f33adaa16cfea55eda Mon Sep 17 00:00:00 2001 From: Jonathan Hefner Date: Wed, 19 Nov 2025 00:11:41 -0600 Subject: [PATCH 023/313] Fix broken links in README (#786) Follow-up to #728. This fixes a few links in the README that were broken due to file renames. Fixes #785. --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index c26fc15..3a456de 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ The MCP registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. -[**📤 Publish my MCP server**](docs/guides/publishing/publish-server.md) | [**⚡️ Live API docs**](https://registry.modelcontextprotocol.io/docs) | [**👀 Ecosystem vision**](docs/explanations/ecosystem-vision.md) | 📖 **[Full documentation](./docs)** +[**📤 Publish my MCP server**](docs/modelcontextprotocol-io/quickstart.mdx) | [**⚡️ Live API docs**](https://registry.modelcontextprotocol.io/docs) | [**👀 Ecosystem vision**](docs/design/ecosystem-vision.md) | 📖 **[Full documentation](./docs)** ## Development Status @@ -89,7 +89,7 @@ make publisher ./bin/mcp-publisher --help ``` -See [the publisher guide](./docs/guides/publishing/publish-server.md) for more details. +See [the publisher guide](./docs/modelcontextprotocol-io/quickstart.mdx) for more details. #### Other commands From 313457571244a3469e55dc108a6a100bb0d3e27b Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Wed, 19 Nov 2025 17:15:49 +0200 Subject: [PATCH 024/313] Add DELETE method to the OpenAPI specification (#782) ## Motivation and Context The following adds a DELETE method to the reference API specification of the registry. The endpoint is consistent with the rest of the spec and provides a standardised way for registry implementations to support deletion if they choose to. **Details:** * Endpoint: DELETE /v0/servers/{serverName}/versions/{version} * Uses tags: [publish] (same as POST /v0/publish for write operations) * Requires security: bearerAuth authentication * Returns ServerResponse on success (200) - matching POST pattern * Same error responses: 401 (Unauthorized), 403 (Forbidden), 500 (Internal error) * Added 404 (Not Found) for when server/version doesn't exist * Parameters match the GET endpoint format with URL-encoding examples * Marked as "(Optional)" in summary * Explicit note that it's not implemented by the official registry * States it's included for standardization purposes ## How Has This Been Tested? ## Breaking Changes ## Types of changes - [ ] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] Documentation update ## Checklist - [ ] I have read the [MCP Documentation](https://modelcontextprotocol.io) - [ ] My code follows the repository's style guidelines - [ ] New and existing tests pass locally - [ ] I have added appropriate error handling - [ ] I have added or updated documentation as needed ## Additional context --------- Signed-off-by: Radoslav Dimitrov --- docs/reference/api/generic-registry-api.md | 1 + docs/reference/api/openapi.yaml | 93 ++++++++++++++++++++++ 2 files changed, 94 insertions(+) diff --git a/docs/reference/api/generic-registry-api.md b/docs/reference/api/generic-registry-api.md index 3f8cd65..614eb81 100644 --- a/docs/reference/api/generic-registry-api.md +++ b/docs/reference/api/generic-registry-api.md @@ -18,6 +18,7 @@ The official registry has some more endpoints and restrictions on top of this. S - **`GET /v0/servers/{serverName}/versions`** - List all versions of a server - **`GET /v0/servers/{serverName}/versions/{version}`** - Get specific version of server. Use the special version `latest` to get the latest version. - **`POST /v0/publish`** - Publish new server (optional, registry-specific authentication) +- **`DELETE /v0/servers/{serverName}/versions/{version}`** - Delete specific server version (optional, not implemented by official registry) Server names and version strings should be URL-encoded in paths. diff --git a/docs/reference/api/openapi.yaml b/docs/reference/api/openapi.yaml index a661a87..1e8a842 100644 --- a/docs/reference/api/openapi.yaml +++ b/docs/reference/api/openapi.yaml @@ -135,6 +135,89 @@ paths: error: type: string example: "Server not found" + delete: + tags: [publish] + summary: Delete specific MCP server version (Optional) + description: | + Delete a specific version of an MCP server from the registry. + + **Note**: This endpoint is optional for registry implementations and is not implemented by the official MCP registry. It is included in the specification to standardize the deletion mechanism for registry implementations that choose to support it. + + Authentication mechanism is registry-specific and may vary between implementations. + security: + - bearerAuth: [] + parameters: + - name: serverName + in: path + required: true + description: URL-encoded server name (e.g., "com.example%2Fmy-server") + schema: + type: string + example: "com.example%2Fmy-server" + - name: version + in: path + required: true + description: URL-encoded version to delete (e.g., "1.0.0" or "1.0.0%2B20130313144700" for versions with build metadata) + schema: + type: string + example: "1.0.0" + responses: + '200': + description: Successfully deleted server version + content: + application/json: + schema: + $ref: '#/components/schemas/ServerResponse' + '401': + description: Unauthorized - Invalid or missing authentication token + content: + application/json: + schema: + type: object + properties: + error: + type: string + example: "Invalid or expired Registry JWT token" + '403': + description: Forbidden - Insufficient permissions + content: + application/json: + schema: + type: object + properties: + error: + type: string + example: "You do not have permission to delete this server" + '404': + description: Server or version not found + content: + application/json: + schema: + type: object + properties: + error: + type: string + example: "Server version not found" + '500': + description: Internal server error + content: + application/json: + schema: + type: object + properties: + error: + type: string + example: "Failed to delete server version" + '501': + description: Not Implemented - Registry does not support deletion + content: + application/json: + schema: + type: object + properties: + error: + type: string + example: "Deletion is not supported by this registry" /v0/publish: post: tags: [publish] @@ -239,6 +322,16 @@ paths: error: type: string example: "Failed to publish server" + '501': + description: Not Implemented - Registry does not support publishing + content: + application/json: + schema: + type: object + properties: + error: + type: string + example: "Publishing is not supported by this registry" components: securitySchemes: bearerAuth: From fadbba2364009b9226070f94dd5ed802766a0afa Mon Sep 17 00:00:00 2001 From: Jonathan Hefner Date: Wed, 19 Nov 2025 10:18:18 -0600 Subject: [PATCH 025/313] Fix remaining broken links from docs reorganization (#789) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Follow-up to #728. This fixes broken links due to file renames. Fixes #788. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude --- cmd/publisher/README.md | 2 +- docs/README.md | 6 +++--- docs/community-projects.md | 2 +- docs/reference/api/official-registry-api.md | 2 +- docs/reference/cli/commands.md | 6 +++--- docs/reference/server-json/generic-server-json.md | 2 +- .../reference/server-json/official-registry-requirements.md | 6 +++--- 7 files changed, 13 insertions(+), 13 deletions(-) diff --git a/cmd/publisher/README.md b/cmd/publisher/README.md index 5f7111c..6af0b4b 100644 --- a/cmd/publisher/README.md +++ b/cmd/publisher/README.md @@ -2,7 +2,7 @@ CLI tool for publishing MCP servers to the registry. -> These docs are for contributors. See the [Publisher User Guide](../../docs/guides/publishing/publish-server.md) for end-user documentation. +> These docs are for contributors. See the [Publisher User Guide](../../docs/modelcontextprotocol-io/quickstart.mdx) for end-user documentation. ## Quick Development Setup diff --git a/docs/README.md b/docs/README.md index b8a30ea..ad12c02 100644 --- a/docs/README.md +++ b/docs/README.md @@ -4,9 +4,9 @@ The MCP registry provides MCP clients with a list of MCP servers, like an app st ## I want to... -- **📤 Publish my MCP server** → [Publishing Guide](guides/publishing/publish-server.md) -- **📥 Consume registry data** → [API Usage Guide](guides/consuming/use-rest-api.md) -- **🔌 Understand the registry's purpose** → [Ecosystem vision](explanations/ecosystem-vision.md) +- **📤 Publish my MCP server** → [Publishing Guide](modelcontextprotocol-io/quickstart.mdx) +- **📥 Consume registry data** → [API Usage Guide](modelcontextprotocol-io/registry-aggregators.mdx) +- **🔌 Understand the registry's purpose** → [Ecosystem vision](design/ecosystem-vision.md) - **📋 Look up specific information** → [server.json spec](reference/server-json/generic-server-json.md) | [API spec](reference/api/generic-registry-api.md) | [CLI reference](reference/cli/commands.md) - **🤝 Add reference to my community project** → [Community Projects](community-projects.md) diff --git a/docs/community-projects.md b/docs/community-projects.md index d925f50..7115a0b 100644 --- a/docs/community-projects.md +++ b/docs/community-projects.md @@ -14,7 +14,7 @@ Browse the official MCP Registry in your browser! ### MCP Registry Clients -- [REST API](guides/consuming/use-rest-api.md) - HTTP API +- [REST API](modelcontextprotocol-io/registry-aggregators.mdx) - HTTP API - [go-mcp-registry](https://github.com/leefowlercu/go-mcp-registry) - Go SDK - [mcp-registry-spec-sdk](https://www.npmjs.com/package/mcp-registry-spec-sdk) - TypeScript client for the MCP Registry - [LangChain4j MCP Registry Java client](https://docs.langchain4j.dev/tutorials/mcp/#mcp-registry-client) - Java API diff --git a/docs/reference/api/official-registry-api.md b/docs/reference/api/official-registry-api.md index 491b6c5..4215a79 100644 --- a/docs/reference/api/official-registry-api.md +++ b/docs/reference/api/official-registry-api.md @@ -2,7 +2,7 @@ This document describes the API for the official MCP Registry hosted at `registry.modelcontextprotocol.io`. -This API is based on the [generic registry API](./generic-registry-api.md) with additional endpoints and authentication. For practical examples of consuming the API, see the [API usage guide](../../guides/consuming/use-rest-api.md). For publishing servers using the API, see the [publishing guide](../../guides/publishing/publish-server.md). +This API is based on the [generic registry API](./generic-registry-api.md) with additional endpoints and authentication. For publishing servers using the API, see the [publishing guide](../../modelcontextprotocol-io/quickstart.mdx). ## Base URLs diff --git a/docs/reference/cli/commands.md b/docs/reference/cli/commands.md index 71d8c85..5ec13fc 100644 --- a/docs/reference/cli/commands.md +++ b/docs/reference/cli/commands.md @@ -2,7 +2,7 @@ Complete command reference for the `mcp-publisher` CLI tool. -See the [publishing guide](../../guides/publishing/publish-server.md) for a walkthrough of using the CLI to publish a server. +See the [publishing guide](../../modelcontextprotocol-io/quickstart.mdx) for a walkthrough of using the CLI to publish a server. ## Installation @@ -72,7 +72,7 @@ mcp-publisher login github-oidc [--registry=URL] - Requires `id-token: write` permission in workflow - No browser interaction needed -Also see [the guide to publishing from GitHub Actions](../../guides/publishing/github-actions.md). +Also see [the guide to publishing from GitHub Actions](../../modelcontextprotocol-io/github-actions.mdx). #### DNS Verification ```bash @@ -211,7 +211,7 @@ mcp-publisher login none [--registry=URL] Publish server to the registry. -For detailed guidance on the publishing process, see the [publishing guide](../../guides/publishing/publish-server.md). +For detailed guidance on the publishing process, see the [publishing guide](../../modelcontextprotocol-io/quickstart.mdx). **Usage:** ```bash diff --git a/docs/reference/server-json/generic-server-json.md b/docs/reference/server-json/generic-server-json.md index c30120e..302a444 100644 --- a/docs/reference/server-json/generic-server-json.md +++ b/docs/reference/server-json/generic-server-json.md @@ -3,7 +3,7 @@ A `server.json` file is a standardized way to describe MCP servers for registry publishing, client discovery, and package management. Also see: -- For step-by-step instructions on creating and using server.json files, see the [publishing guide](../../guides/publishing/publish-server.md). +- For step-by-step instructions on creating and using server.json files, see the [publishing guide](../../modelcontextprotocol-io/quickstart.mdx). - For understanding the validation requirements when publishing to the official registry, see [official registry requirements](./official-registry-requirements.md). ## Browse the Complete Schema diff --git a/docs/reference/server-json/official-registry-requirements.md b/docs/reference/server-json/official-registry-requirements.md index d2ec18a..ef3da63 100644 --- a/docs/reference/server-json/official-registry-requirements.md +++ b/docs/reference/server-json/official-registry-requirements.md @@ -2,7 +2,7 @@ This document describes the additional requirements and validation rules that apply when publishing to the official MCP Registry at `registry.modelcontextprotocol.io`. -For step-by-step publishing instructions, see the [publishing guide](../../guides/publishing/publish-server.md). +For step-by-step publishing instructions, see the [publishing guide](../../modelcontextprotocol-io/quickstart.mdx). ## Overview @@ -17,13 +17,13 @@ While the [generic server.json format](./generic-server-json.md) defines the bas Publishers must prove ownership of their namespace. For example to publish to `com.example/server`, the publisher must prove they own the `example.com` domain. -See the [publishing guide](../../guides/publishing/publish-server.md) for authentication details for GitHub and domain namespaces. +See the [publishing guide](../../modelcontextprotocol-io/quickstart.mdx) for authentication details for GitHub and domain namespaces. ## Package Ownership Verification All packages must include metadata proving the publisher owns them. This prevents impersonation and ensures authenticity (see more reasoning in [#96](https://github.com/modelcontextprotocol/registry/issues/96)). -For detailed verification requirements for each registry type, see the [publishing guide](../../guides/publishing/publish-server.md). +For detailed verification requirements for each registry type, see the [publishing guide](../../modelcontextprotocol-io/quickstart.mdx). ## Restricted Registry Base URLs From 453e020464366cf2a3da17270480f0b85a8f9ebc Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 24 Nov 2025 19:24:05 +0200 Subject: [PATCH 026/313] build(deps): bump github.com/coreos/go-oidc/v3 from 3.16.0 to 3.17.0 (#794) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [github.com/coreos/go-oidc/v3](https://github.com/coreos/go-oidc) from 3.16.0 to 3.17.0.
Release notes

Sourced from github.com/coreos/go-oidc/v3's releases.

v3.17.0

What's Changed

Full Changelog: https://github.com/coreos/go-oidc/compare/v3.16.0...v3.17.0

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/coreos/go-oidc/v3&package-manager=go_modules&previous-version=3.16.0&new-version=3.17.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 4d83d23..03a3f49 100644 --- a/go.mod +++ b/go.mod @@ -7,7 +7,7 @@ require ( github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.4.0 github.com/caarlos0/env/v11 v11.3.1 - github.com/coreos/go-oidc/v3 v3.16.0 + github.com/coreos/go-oidc/v3 v3.17.0 github.com/danielgtaylor/huma/v2 v2.34.1 github.com/golang-jwt/jwt/v5 v5.3.0 github.com/google/go-containerregistry v0.20.6 diff --git a/go.sum b/go.sum index 40ba8e0..5e4e30c 100644 --- a/go.sum +++ b/go.sum @@ -36,8 +36,8 @@ github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UF github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= github.com/containerd/stargz-snapshotter/estargz v0.16.3 h1:7evrXtoh1mSbGj/pfRccTampEyKpjpOnS3CyiV1Ebr8= github.com/containerd/stargz-snapshotter/estargz v0.16.3/go.mod h1:uyr4BfYfOj3G9WBVE8cOlQmXAbPN9VEQpBBeJIuOipU= -github.com/coreos/go-oidc/v3 v3.16.0 h1:qRQUCFstKpXwmEjDQTIbyY/5jF00+asXzSkmkoa/mow= -github.com/coreos/go-oidc/v3 v3.16.0/go.mod h1:wqPbKFrVnE90vty060SB40FCJ8fTHTxSwyXJqZH+sI8= +github.com/coreos/go-oidc/v3 v3.17.0 h1:hWBGaQfbi0iVviX4ibC7bk8OKT5qNr4klBaCHVNvehc= +github.com/coreos/go-oidc/v3 v3.17.0/go.mod h1:wqPbKFrVnE90vty060SB40FCJ8fTHTxSwyXJqZH+sI8= github.com/danielgtaylor/huma/v2 v2.34.1 h1:EmOJAbzEGfy0wAq/QMQ1YKfEMBEfE94xdBRLPBP0gwQ= github.com/danielgtaylor/huma/v2 v2.34.1/go.mod h1:ynwJgLk8iGVgoaipi5tgwIQ5yoFNmiu+QdhU7CEEmhk= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= From 85fc6afb81da3ade0c2268bfcec20562d5380226 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 24 Nov 2025 19:24:23 +0200 Subject: [PATCH 027/313] build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.207.0 to 3.208.0 in /deploy (#796) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from 3.207.0 to 3.208.0.
Release notes

Sourced from github.com/pulumi/pulumi/sdk/v3's releases.

v3.208.0

3.208.0 (2025-11-20)

Features

  • [cli] Expose all command flags as env vars (e.g. --refresh can now be set with PULUMI_OPTION_REFRESH) #20868

  • [cli/install] Make pulumi install recurse into local packages #20945

  • [engine] Add a replacement_trigger resource option. Any change to this value between program runs will trigger a replace of the resource #20936

  • [engine] Add a new builtin Stash resource which can be used to save a value to state #20819

  • [protobuf] Add Language.Template RPC to protos #20948

  • [sdk/go] Add support for replacement_trigger in the Go SDK #20937

Bug Fixes

  • [engine] Fix duplicate resource snapshot integrity issue with aliases #20926

  • [engine] Allow resources marked as Delete to be targeted, and take them into account for dependency calculation #20962

  • [engine] Fix a panic when previewing and import of a resource that wants to delete and then replace due to diffs #20997

  • [pkg] Include invalid property names in bind errors #20989

  • [sdk/python] Don’t raise when looking up a stack reference output that does not exist #20938

  • [sdkgen/python] Ensure resource args accept typeddicts when no language info is specified #20982

Miscellaneous

  • [cli] Document the [template|url] argument in pulumi up command help text #20996
Changelog

Sourced from github.com/pulumi/pulumi/sdk/v3's changelog.

3.208.0 (2025-11-20)

Features

  • [cli] Expose all command flags as env vars (e.g. --refresh can now be set with PULUMI_OPTION_REFRESH) #20868

  • [cli/install] Make pulumi install recurse into local packages #20945

  • [engine] Add a replacement_trigger resource option. Any change to this value between program runs will trigger a replace of the resource #20936

  • [engine] Add a new builtin Stash resource which can be used to save a value to state #20819

  • [protobuf] Add Language.Template RPC to protos #20948

  • [sdk/go] Add support for replacement_trigger in the Go SDK #20937

Bug Fixes

  • [engine] Fix duplicate resource snapshot integrity issue with aliases #20926

  • [engine] Allow resources marked as Delete to be targeted, and take them into account for dependency calculation #20962

  • [engine] Fix a panic when previewing and import of a resource that wants to delete and then replace due to diffs #20997

  • [pkg] Include invalid property names in bind errors #20989

  • [sdk/python] Don’t raise when looking up a stack reference output that does not exist #20938

  • [sdkgen/python] Ensure resource args accept typeddicts when no language info is specified #20982

Miscellaneous

  • [cli] Document the [template|url] argument in pulumi up command help text #20996
Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/pulumi/pulumi/sdk/v3&package-manager=go_modules&previous-version=3.207.0&new-version=3.208.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- deploy/go.mod | 2 +- deploy/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index 438a412..ca87ad1 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -5,7 +5,7 @@ go 1.24.7 require ( github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.24.0 - github.com/pulumi/pulumi/sdk/v3 v3.207.0 + github.com/pulumi/pulumi/sdk/v3 v3.208.0 gopkg.in/yaml.v2 v2.4.0 ) diff --git a/deploy/go.sum b/deploy/go.sum index bdc21b1..8dbefcb 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -160,8 +160,8 @@ github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 h1:w6OnO3d4j5yVf2vpm8OzXFC/xHOEGqt+9 github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1/go.mod h1:UyZyv7hz4knpFx6/Sh+SkZe6hT6sJHtDvw9A0TbvEsk= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.24.0 h1:dlDJvsugKow8tCaD0yJngc7PXdv8WT2YwPEUmj48tF4= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.24.0/go.mod h1:8HDO923pZUokTAEMgS7XepoUIDCazm2WAwX6s4HUDtc= -github.com/pulumi/pulumi/sdk/v3 v3.207.0 h1:D6EpTYN65Cmt/Qx50GzDgpK9g3TXS3Tq6mnsx7C7Li8= -github.com/pulumi/pulumi/sdk/v3 v3.207.0/go.mod h1:UsBMdaUQ+WoKoQtF2PYbQIbo8ZRJuAo1axkyit9IQVE= +github.com/pulumi/pulumi/sdk/v3 v3.208.0 h1:AUBoh7zw67NZVo1IkapOog1WBMz46DXco/7YsKBNK1s= +github.com/pulumi/pulumi/sdk/v3 v3.208.0/go.mod h1:UsBMdaUQ+WoKoQtF2PYbQIbo8ZRJuAo1axkyit9IQVE= github.com/rivo/uniseg v0.1.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc= github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc= github.com/rivo/uniseg v0.4.4 h1:8TfxU8dW6PdqD27gjM8MVNuicgxIjxpm4K7x4jp8sis= From 9a4edd02fd44259d3b9c54fc0442682629fd2ce4 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 24 Nov 2025 19:24:50 +0200 Subject: [PATCH 028/313] build(deps): bump golang.org/x/crypto from 0.42.0 to 0.45.0 in the go_modules group across 1 directory (#791) Bumps the go_modules group with 1 update in the / directory: [golang.org/x/crypto](https://github.com/golang/crypto). Updates `golang.org/x/crypto` from 0.42.0 to 0.45.0
Commits
  • 4e0068c go.mod: update golang.org/x dependencies
  • e79546e ssh: curb GSSAPI DoS risk by limiting number of specified OIDs
  • f91f7a7 ssh/agent: prevent panic on malformed constraint
  • 2df4153 acme/autocert: let automatic renewal work with short lifetime certs
  • bcf6a84 acme: pass context to request
  • b4f2b62 ssh: fix error message on unsupported cipher
  • 79ec3a5 ssh: allow to bind to a hostname in remote forwarding
  • 122a78f go.mod: update golang.org/x dependencies
  • c0531f9 all: eliminate vet diagnostics
  • 0997000 all: fix some comments
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=golang.org/x/crypto&package-manager=go_modules&previous-version=0.42.0&new-version=0.45.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/modelcontextprotocol/registry/network/alerts).
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 10 +++++----- go.sum | 20 ++++++++++---------- 2 files changed, 15 insertions(+), 15 deletions(-) diff --git a/go.mod b/go.mod index 03a3f49..1843ee2 100644 --- a/go.mod +++ b/go.mod @@ -76,12 +76,12 @@ require ( go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect go.opentelemetry.io/otel/trace v1.38.0 // indirect go.yaml.in/yaml/v2 v2.4.2 // indirect - golang.org/x/crypto v0.42.0 // indirect - golang.org/x/net v0.44.0 // indirect + golang.org/x/crypto v0.45.0 // indirect + golang.org/x/net v0.47.0 // indirect golang.org/x/oauth2 v0.31.0 // indirect - golang.org/x/sync v0.17.0 // indirect - golang.org/x/sys v0.36.0 // indirect - golang.org/x/text v0.29.0 // indirect + golang.org/x/sync v0.18.0 // indirect + golang.org/x/sys v0.38.0 // indirect + golang.org/x/text v0.31.0 // indirect golang.org/x/time v0.12.0 // indirect google.golang.org/api v0.247.0 // indirect google.golang.org/genproto v0.0.0-20250603155806-513f23925822 // indirect diff --git a/go.sum b/go.sum index 5e4e30c..b715f04 100644 --- a/go.sum +++ b/go.sum @@ -157,22 +157,22 @@ go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE= go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI= go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU= -golang.org/x/crypto v0.42.0 h1:chiH31gIWm57EkTXpwnqf8qeuMUi0yekh6mT2AvFlqI= -golang.org/x/crypto v0.42.0/go.mod h1:4+rDnOTJhQCx2q7/j6rAN5XDw8kPjeaXEUR2eL94ix8= +golang.org/x/crypto v0.45.0 h1:jMBrvKuj23MTlT0bQEOBcAE0mjg8mK9RXFhRH6nyF3Q= +golang.org/x/crypto v0.45.0/go.mod h1:XTGrrkGJve7CYK7J8PEww4aY7gM3qMCElcJQ8n8JdX4= golang.org/x/mod v0.30.0 h1:fDEXFVZ/fmCKProc/yAXXUijritrDzahmwwefnjoPFk= golang.org/x/mod v0.30.0/go.mod h1:lAsf5O2EvJeSFMiBxXDki7sCgAxEUcZHXoXMKT4GJKc= -golang.org/x/net v0.44.0 h1:evd8IRDyfNBMBTTY5XRF1vaZlD+EmWx6x8PkhR04H/I= -golang.org/x/net v0.44.0/go.mod h1:ECOoLqd5U3Lhyeyo/QDCEVQ4sNgYsqvCZ722XogGieY= +golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY= +golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU= golang.org/x/oauth2 v0.31.0 h1:8Fq0yVZLh4j4YA47vHKFTa9Ew5XIrCP8LC6UeNZnLxo= golang.org/x/oauth2 v0.31.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA= -golang.org/x/sync v0.17.0 h1:l60nONMj9l5drqw6jlhIELNv9I0A4OFgRsG9k2oT9Ug= -golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI= +golang.org/x/sync v0.18.0 h1:kr88TuHDroi+UVf+0hZnirlk8o8T+4MrK6mr60WkH/I= +golang.org/x/sync v0.18.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI= golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.36.0 h1:KVRy2GtZBrk1cBYA7MKu5bEZFxQk4NIDV6RLVcC8o0k= -golang.org/x/sys v0.36.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= -golang.org/x/text v0.29.0 h1:1neNs90w9YzJ9BocxfsQNHKuAT4pkghyXc4nhZ6sJvk= -golang.org/x/text v0.29.0/go.mod h1:7MhJOA9CD2qZyOKYazxdYMF85OwPdEr9jTtBpO7ydH4= +golang.org/x/sys v0.38.0 h1:3yZWxaJjBmCWXqhN1qh02AkOnCQ1poK6oF+a7xWL6Gc= +golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= +golang.org/x/text v0.31.0 h1:aC8ghyu4JhP8VojJ2lEHBnochRno1sgL6nEi9WGFGMM= +golang.org/x/text v0.31.0/go.mod h1:tKRAlv61yKIjGGHX/4tP1LTbc13YSec1pxVEWXzfoeM= golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE= golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg= google.golang.org/api v0.247.0 h1:tSd/e0QrUlLsrwMKmkbQhYVa109qIintOls2Wh6bngc= From 52e3744831385c83a26c37465575da3d83854f84 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 24 Nov 2025 19:25:11 +0200 Subject: [PATCH 029/313] build(deps): bump golang.org/x/crypto from 0.41.0 to 0.45.0 in /deploy in the go_modules group across 1 directory (#792) Bumps the go_modules group with 1 update in the /deploy directory: [golang.org/x/crypto](https://github.com/golang/crypto). Updates `golang.org/x/crypto` from 0.41.0 to 0.45.0
Commits
  • 4e0068c go.mod: update golang.org/x dependencies
  • e79546e ssh: curb GSSAPI DoS risk by limiting number of specified OIDs
  • f91f7a7 ssh/agent: prevent panic on malformed constraint
  • 2df4153 acme/autocert: let automatic renewal work with short lifetime certs
  • bcf6a84 acme: pass context to request
  • b4f2b62 ssh: fix error message on unsupported cipher
  • 79ec3a5 ssh: allow to bind to a hostname in remote forwarding
  • 122a78f go.mod: update golang.org/x dependencies
  • c0531f9 all: eliminate vet diagnostics
  • 0997000 all: fix some comments
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=golang.org/x/crypto&package-manager=go_modules&previous-version=0.41.0&new-version=0.45.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/modelcontextprotocol/registry/network/alerts).
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- deploy/go.mod | 16 ++++++++-------- deploy/go.sum | 32 ++++++++++++++++---------------- 2 files changed, 24 insertions(+), 24 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index ca87ad1..68d4a92 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -77,15 +77,15 @@ require ( github.com/xanzy/ssh-agent v0.3.3 // indirect github.com/zclconf/go-cty v1.13.2 // indirect go.uber.org/atomic v1.9.0 // indirect - golang.org/x/crypto v0.41.0 // indirect + golang.org/x/crypto v0.45.0 // indirect golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 // indirect - golang.org/x/mod v0.26.0 // indirect - golang.org/x/net v0.42.0 // indirect - golang.org/x/sync v0.16.0 // indirect - golang.org/x/sys v0.35.0 // indirect - golang.org/x/term v0.34.0 // indirect - golang.org/x/text v0.28.0 // indirect - golang.org/x/tools v0.35.0 // indirect + golang.org/x/mod v0.29.0 // indirect + golang.org/x/net v0.47.0 // indirect + golang.org/x/sync v0.18.0 // indirect + golang.org/x/sys v0.38.0 // indirect + golang.org/x/term v0.37.0 // indirect + golang.org/x/text v0.31.0 // indirect + golang.org/x/tools v0.38.0 // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20250528174236-200df99c418a // indirect google.golang.org/grpc v1.74.2 // indirect google.golang.org/protobuf v1.36.7 // indirect diff --git a/deploy/go.sum b/deploy/go.sum index 8dbefcb..a898676 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -221,29 +221,29 @@ golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACk golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4= -golang.org/x/crypto v0.41.0 h1:WKYxWedPGCTVVl5+WHSSrOBT0O8lx32+zxmHxijgXp4= -golang.org/x/crypto v0.41.0/go.mod h1:pO5AFd7FA68rFak7rOAGVuygIISepHftHnr8dr6+sUc= +golang.org/x/crypto v0.45.0 h1:jMBrvKuj23MTlT0bQEOBcAE0mjg8mK9RXFhRH6nyF3Q= +golang.org/x/crypto v0.45.0/go.mod h1:XTGrrkGJve7CYK7J8PEww4aY7gM3qMCElcJQ8n8JdX4= golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 h1:2dVuKD2vS7b0QIHQbpyTISPd0LeHDbnYEryqj5Q1ug8= golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56/go.mod h1:M4RDyNAINzryxdtnbRXRL/OHtkFuWGRjvuhBJpk2IlY= golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY= golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg= golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= -golang.org/x/mod v0.26.0 h1:EGMPT//Ezu+ylkCijjPc+f4Aih7sZvaAr+O3EHBxvZg= -golang.org/x/mod v0.26.0/go.mod h1:/j6NAhSk8iQ723BGAUyoAcn7SlD7s15Dp9Nd/SfeaFQ= +golang.org/x/mod v0.29.0 h1:HV8lRxZC4l2cr3Zq1LvtOsi/ThTgWnUk/y64QSs8GwA= +golang.org/x/mod v0.29.0/go.mod h1:NyhrlYXJ2H4eJiRy/WDBO6HMqZQ6q9nk4JzS3NuCK+w= golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20200421231249-e086a090c8fd/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A= golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= -golang.org/x/net v0.42.0 h1:jzkYrhi3YQWD6MLBJcsklgQsoAcw89EcZbJw8Z614hs= -golang.org/x/net v0.42.0/go.mod h1:FF1RA5d3u7nAYA4z2TkclSCKh68eSXtiFwcWQpPXdt8= +golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY= +golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sync v0.16.0 h1:ycBJEhp9p4vXvUZNszeOq0kGTPghopOL8q0fq3vstxw= -golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA= +golang.org/x/sync v0.18.0 h1:kr88TuHDroi+UVf+0hZnirlk8o8T+4MrK6mr60WkH/I= +golang.org/x/sync v0.18.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI= golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= @@ -259,24 +259,24 @@ golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBc golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.35.0 h1:vz1N37gP5bs89s7He8XuIYXpyY0+QlsKmzipCbUtyxI= -golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k= +golang.org/x/sys v0.38.0 h1:3yZWxaJjBmCWXqhN1qh02AkOnCQ1poK6oF+a7xWL6Gc= +golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= -golang.org/x/term v0.34.0 h1:O/2T7POpk0ZZ7MAzMeWFSg6S5IpWd/RXDlM9hgM3DR4= -golang.org/x/term v0.34.0/go.mod h1:5jC53AEywhIVebHgPVeg0mj8OD3VO9OzclacVrqpaAw= +golang.org/x/term v0.37.0 h1:8EGAD0qCmHYZg6J17DvsMy9/wJ7/D/4pV/wfnld5lTU= +golang.org/x/term v0.37.0/go.mod h1:5pB4lxRNYYVZuTLmy8oR2BH8dflOR+IbTYFD8fi3254= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= -golang.org/x/text v0.28.0 h1:rhazDwis8INMIwQ4tpjLDzUhx6RlXqZNPEM0huQojng= -golang.org/x/text v0.28.0/go.mod h1:U8nCwOR8jO/marOQ0QbDiOngZVEBB7MAiitBuMjXiNU= +golang.org/x/text v0.31.0 h1:aC8ghyu4JhP8VojJ2lEHBnochRno1sgL6nEi9WGFGMM= +golang.org/x/text v0.31.0/go.mod h1:tKRAlv61yKIjGGHX/4tP1LTbc13YSec1pxVEWXzfoeM= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20181030221726-6c7e314b6563/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28= golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE= golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA= -golang.org/x/tools v0.35.0 h1:mBffYraMEf7aa0sB+NuKnuCy8qI/9Bughn8dC2Gu5r0= -golang.org/x/tools v0.35.0/go.mod h1:NKdj5HkL/73byiZSJjqJgKn3ep7KjFkBOkR/Hps3VPw= +golang.org/x/tools v0.38.0 h1:Hx2Xv8hISq8Lm16jvBZ2VQf+RLmbd7wVUsALibYI/IQ= +golang.org/x/tools v0.38.0/go.mod h1:yEsQ/d/YK8cjh0L6rZlY8tgtlKiBNTL14pGDJPJpYQs= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= From 8f8fc8980168ed973b6105cd1e62942d7a721e10 Mon Sep 17 00:00:00 2001 From: Tadas Antanavicius Date: Sun, 30 Nov 2025 08:41:02 -0800 Subject: [PATCH 030/313] Fix missing $schema entries - data migration (#806) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Drafted by Claude Code, reviewed by me. ## Summary This PR adds a data migration to fix 17 server entries that were published with empty `$schema` fields. **This is a pure data migration** - no code changes are needed because: - Validation for the `$schema` field was already added in commit [6d2001b](https://github.com/modelcontextprotocol/registry/commit/6d2001b) on **2025-10-07** - That validation was deployed to production on **2025-10-14** with v1.3.0 ([PR #668](https://github.com/modelcontextprotocol/registry/pull/668)) - All 17 affected entries were published before deployment (see dates below) ## Affected Entries (17 total) | Server | Version | Published | |--------|---------|-----------| | io.github.ruvnet/claude-flow | 2.0.0-alpha.104 | 2025-09-10 | | io.github.ruvnet/claude-flow | 2.0.0-alpha.105 | 2025-09-10 | | io.github.ruvnet/ruv-swarm | 1.0.18 | 2025-09-10 | | io.github.ruvnet/ruv-swarm | 1.0.19 | 2025-09-10 | | travel.kismet/mcp-server | 0.0.0 | 2025-09-10 | | io.github.jkakar/cookwith-mcp | 1.0.0 | 2025-09-11 | | io.github.jkakar/cookwith-mcp | 1.0.1 | 2025-09-12 | | io.github.jkakar/cookwith-mcp | 1.0.2 | 2025-09-12 | | io.github.OtherVibes/mcp-as-a-judge | 0.3.12 | 2025-09-18 | | io.github.OtherVibes/mcp-as-a-judge | 0.3.13 | 2025-09-18 | | io.github.OtherVibes/mcp-as-a-judge | 0.3.14 | 2025-09-18 | | io.github.OtherVibes/mcp-as-a-judge | 0.3.20 | 2025-09-20 | | io.github.Skills03/scrimba-teaching | 1.0.1 | 2025-09-21 | | io.github.Skills03/scrimba-teaching | 1.1.0 | 2025-09-21 | | io.github.Skills03/scrimba-teaching | 1.2.0 | 2025-09-21 | | io.github.toby/mirror-mcp | 0.0.4 | 2025-10-01 | | io.github.antuelle78/weather-mcp | 1.0.0 | 2025-10-09 ⚠️ | **Note on outlier:** `io.github.antuelle78/weather-mcp` was published on 2025-10-09, which is after the validation code was committed (2025-10-07) but before it was deployed (2025-10-14). This confirms the entries slipped through due to the gap between merge and deployment. ## Dry Run SQL To verify affected rows before running the migration: ```sql SELECT server_name, version, value->>'$schema' as schema_value FROM servers WHERE (server_name, version) IN ( ('io.github.OtherVibes/mcp-as-a-judge', '0.3.12'), ('io.github.OtherVibes/mcp-as-a-judge', '0.3.13'), ('io.github.OtherVibes/mcp-as-a-judge', '0.3.14'), ('io.github.OtherVibes/mcp-as-a-judge', '0.3.20'), ('io.github.Skills03/scrimba-teaching', '1.0.1'), ('io.github.Skills03/scrimba-teaching', '1.1.0'), ('io.github.Skills03/scrimba-teaching', '1.2.0'), ('io.github.antuelle78/weather-mcp', '1.0.0'), ('io.github.jkakar/cookwith-mcp', '1.0.0'), ('io.github.jkakar/cookwith-mcp', '1.0.1'), ('io.github.jkakar/cookwith-mcp', '1.0.2'), ('io.github.ruvnet/claude-flow', '2.0.0-alpha.104'), ('io.github.ruvnet/claude-flow', '2.0.0-alpha.105'), ('io.github.ruvnet/ruv-swarm', '1.0.18'), ('io.github.ruvnet/ruv-swarm', '1.0.19'), ('io.github.toby/mirror-mcp', '0.0.4'), ('travel.kismet/mcp-server', '0.0.0') ) AND (value->>'$schema' = '' OR value->>'$schema' IS NULL); ``` Result against prod: ```sql app=> SELECT server_name, version, value->>'$schema' as schema_value FROM servers WHERE (server_name, version) IN ( ('io.github.OtherVibes/mcp-as-a-judge', '0.3.12'), ('io.github.OtherVibes/mcp-as-a-judge', '0.3.13'), ('io.github.OtherVibes/mcp-as-a-judge', '0.3.14'), ('io.github.OtherVibes/mcp-as-a-judge', '0.3.20'), ('io.github.Skills03/scrimba-teaching', '1.0.1'), ('io.github.Skills03/scrimba-teaching', '1.1.0'), ('io.github.Skills03/scrimba-teaching', '1.2.0'), ('io.github.antuelle78/weather-mcp', '1.0.0'), ('io.github.jkakar/cookwith-mcp', '1.0.0'), ('io.github.jkakar/cookwith-mcp', '1.0.1'), ('io.github.jkakar/cookwith-mcp', '1.0.2'), ('io.github.ruvnet/claude-flow', '2.0.0-alpha.104'), ('io.github.ruvnet/claude-flow', '2.0.0-alpha.105'), ('io.github.ruvnet/ruv-swarm', '1.0.18'), ('io.github.ruvnet/ruv-swarm', '1.0.19'), ('io.github.toby/mirror-mcp', '0.0.4'), ('travel.kismet/mcp-server', '0.0.0') ) AND (value->>'$schema' = '' OR value->>'$schema' IS NULL); server_name | version | schema_value -------------------------------------+-----------------+-------------- io.github.toby/mirror-mcp | 0.0.4 | io.github.jkakar/cookwith-mcp | 1.0.0 | io.github.ruvnet/ruv-swarm | 1.0.19 | io.github.jkakar/cookwith-mcp | 1.0.1 | io.github.ruvnet/ruv-swarm | 1.0.18 | io.github.antuelle78/weather-mcp | 1.0.0 | io.github.jkakar/cookwith-mcp | 1.0.2 | io.github.OtherVibes/mcp-as-a-judge | 0.3.12 | travel.kismet/mcp-server | 0.0.0 | io.github.Skills03/scrimba-teaching | 1.0.1 | io.github.OtherVibes/mcp-as-a-judge | 0.3.20 | io.github.Skills03/scrimba-teaching | 1.2.0 | io.github.ruvnet/claude-flow | 2.0.0-alpha.105 | io.github.ruvnet/claude-flow | 2.0.0-alpha.104 | io.github.Skills03/scrimba-teaching | 1.1.0 | io.github.OtherVibes/mcp-as-a-judge | 0.3.14 | io.github.OtherVibes/mcp-as-a-judge | 0.3.13 | ``` --------- Co-authored-by: Claude --- .../011_fix_empty_schema_fields.sql | 63 +++++++++++++++++++ 1 file changed, 63 insertions(+) create mode 100644 internal/database/migrations/011_fix_empty_schema_fields.sql diff --git a/internal/database/migrations/011_fix_empty_schema_fields.sql b/internal/database/migrations/011_fix_empty_schema_fields.sql new file mode 100644 index 0000000..a5d7cec --- /dev/null +++ b/internal/database/migrations/011_fix_empty_schema_fields.sql @@ -0,0 +1,63 @@ +-- Migration: Fix empty $schema fields in 17 specific server entries +-- +-- This migration updates exactly 17 server entries that were published with +-- empty $schema fields (""). These entries are explicitly listed below to +-- ensure no other data is affected. +-- +-- Issue: https://github.com/modelcontextprotocol/registry/issues/805 +-- +-- Affected entries (17 total): +-- io.github.OtherVibes/mcp-as-a-judge: 0.3.12, 0.3.13, 0.3.14, 0.3.20 +-- io.github.Skills03/scrimba-teaching: 1.0.1, 1.1.0, 1.2.0 +-- io.github.antuelle78/weather-mcp: 1.0.0 +-- io.github.jkakar/cookwith-mcp: 1.0.0, 1.0.1, 1.0.2 +-- io.github.ruvnet/claude-flow: 2.0.0-alpha.104, 2.0.0-alpha.105 +-- io.github.ruvnet/ruv-swarm: 1.0.18, 1.0.19 +-- io.github.toby/mirror-mcp: 0.0.4 +-- travel.kismet/mcp-server: 0.0.0 + +BEGIN; + +-- Define the exact list of affected entries +-- Using a CTE to make the affected entries explicit and auditable +WITH affected_entries AS ( + SELECT server_name, version FROM (VALUES + -- io.github.OtherVibes/mcp-as-a-judge (4 versions) + ('io.github.OtherVibes/mcp-as-a-judge', '0.3.12'), + ('io.github.OtherVibes/mcp-as-a-judge', '0.3.13'), + ('io.github.OtherVibes/mcp-as-a-judge', '0.3.14'), + ('io.github.OtherVibes/mcp-as-a-judge', '0.3.20'), + -- io.github.Skills03/scrimba-teaching (3 versions) + ('io.github.Skills03/scrimba-teaching', '1.0.1'), + ('io.github.Skills03/scrimba-teaching', '1.1.0'), + ('io.github.Skills03/scrimba-teaching', '1.2.0'), + -- io.github.antuelle78/weather-mcp (1 version) + ('io.github.antuelle78/weather-mcp', '1.0.0'), + -- io.github.jkakar/cookwith-mcp (3 versions) + ('io.github.jkakar/cookwith-mcp', '1.0.0'), + ('io.github.jkakar/cookwith-mcp', '1.0.1'), + ('io.github.jkakar/cookwith-mcp', '1.0.2'), + -- io.github.ruvnet/claude-flow (2 versions) + ('io.github.ruvnet/claude-flow', '2.0.0-alpha.104'), + ('io.github.ruvnet/claude-flow', '2.0.0-alpha.105'), + -- io.github.ruvnet/ruv-swarm (2 versions) + ('io.github.ruvnet/ruv-swarm', '1.0.18'), + ('io.github.ruvnet/ruv-swarm', '1.0.19'), + -- io.github.toby/mirror-mcp (1 version) + ('io.github.toby/mirror-mcp', '0.0.4'), + -- travel.kismet/mcp-server (1 version) + ('travel.kismet/mcp-server', '0.0.0') + ) AS t(server_name, version) +) +UPDATE servers s +SET value = jsonb_set( + s.value, + '{$schema}', + '"https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json"'::jsonb +) +FROM affected_entries ae +WHERE s.server_name = ae.server_name + AND s.version = ae.version + AND (s.value->>'$schema' = '' OR s.value->>'$schema' IS NULL); + +COMMIT; From 663c9c407ffdca5c077ed161dcff36dd79b2f430 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 2 Dec 2025 23:29:24 +0200 Subject: [PATCH 031/313] build(deps): bump github.com/pulumi/pulumi-kubernetes/sdk/v4 from 4.24.0 to 4.24.1 in /deploy (#798) Bumps [github.com/pulumi/pulumi-kubernetes/sdk/v4](https://github.com/pulumi/pulumi-kubernetes) from 4.24.0 to 4.24.1.
Release notes

Sourced from github.com/pulumi/pulumi-kubernetes/sdk/v4's releases.

v4.24.1

Fixed

  • Fixed a regression of #2943 which could cause Deployments to erroneously report diffs.

Changed

Changelog

Sourced from github.com/pulumi/pulumi-kubernetes/sdk/v4's changelog.

CHANGELOG

Unreleased

Fixed

  • Fixed a regression of #2943 which could cause Deployments to erroneously report diffs.

Changed

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/pulumi/pulumi-kubernetes/sdk/v4&package-manager=go_modules&previous-version=4.24.0&new-version=4.24.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- deploy/go.mod | 2 +- deploy/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index 68d4a92..5c968ef 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -4,7 +4,7 @@ go 1.24.7 require ( github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 - github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.24.0 + github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.24.1 github.com/pulumi/pulumi/sdk/v3 v3.208.0 gopkg.in/yaml.v2 v2.4.0 ) diff --git a/deploy/go.sum b/deploy/go.sum index a898676..c5ef9e8 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -158,8 +158,8 @@ github.com/pulumi/esc v0.17.0 h1:oaVOIyFTENlYDuqc3pW75lQT9jb2cd6ie/4/Twxn66w= github.com/pulumi/esc v0.17.0/go.mod h1:XnSxlt5NkmuAj304l/gK4pRErFbtqq6XpfX1tYT9Jbc= github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 h1:w6OnO3d4j5yVf2vpm8OzXFC/xHOEGqt+9FjWCUBCq6U= github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1/go.mod h1:UyZyv7hz4knpFx6/Sh+SkZe6hT6sJHtDvw9A0TbvEsk= -github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.24.0 h1:dlDJvsugKow8tCaD0yJngc7PXdv8WT2YwPEUmj48tF4= -github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.24.0/go.mod h1:8HDO923pZUokTAEMgS7XepoUIDCazm2WAwX6s4HUDtc= +github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.24.1 h1:L1J2/PHgAziDXUvOWJ4HH1JBlgxzpQseZiEIu4K2x34= +github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.24.1/go.mod h1:vNiMC/N8GNHvDwU3gQRXQ6V+kbgSl5N/lKtfrUjGuXU= github.com/pulumi/pulumi/sdk/v3 v3.208.0 h1:AUBoh7zw67NZVo1IkapOog1WBMz46DXco/7YsKBNK1s= github.com/pulumi/pulumi/sdk/v3 v3.208.0/go.mod h1:UsBMdaUQ+WoKoQtF2PYbQIbo8ZRJuAo1axkyit9IQVE= github.com/rivo/uniseg v0.1.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc= From 34daa90f6affddeba29cd6f2ae61cbe5d281813e Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 3 Dec 2025 00:27:29 +0200 Subject: [PATCH 032/313] build(deps): bump github.com/google/go-containerregistry from 0.20.6 to 0.20.7 (#797) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) from 0.20.6 to 0.20.7.
Release notes

Sourced from github.com/google/go-containerregistry's releases.

v0.20.7

What's Changed

New Contributors

Full Changelog: https://github.com/google/go-containerregistry/compare/v0.20.6...v0.20.7

Commits
  • e075f20 go mod tidy on dependabot update (#2171)
  • 45aacf4 Bump the actions group across 1 directory with 3 updates (#2170)
  • 073b936 Update dependencies and deprecate DockerVersion field (#2164)
  • 390dacd Bump golang.org/x/crypto from 0.38.0 to 0.45.0 in /cmd/krane (#2163)
  • ca44d47 Bump golang.org/x/crypto from 0.38.0 to 0.45.0 in /pkg/authn/k8schain (#2162)
  • 999cc1f Bump github.com/docker/docker (#2161)
  • d1809c8 Build artifacts for riscv64 (#2159)
  • 7471efd Bump the auxiliary-deps group across 3 directories with 4 updates (#2156)
  • 2bb5bb0 Bump the actions group with 5 updates (#2155)
  • 16371c1 Remove manual vendor setting for dependabot (#2151)
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/google/go-containerregistry&package-manager=go_modules&previous-version=0.20.6&new-version=0.20.7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 13 ++++++------- go.sum | 24 ++++++++++++------------ 2 files changed, 18 insertions(+), 19 deletions(-) diff --git a/go.mod b/go.mod index 1843ee2..f578211 100644 --- a/go.mod +++ b/go.mod @@ -10,7 +10,7 @@ require ( github.com/coreos/go-oidc/v3 v3.17.0 github.com/danielgtaylor/huma/v2 v2.34.1 github.com/golang-jwt/jwt/v5 v5.3.0 - github.com/google/go-containerregistry v0.20.6 + github.com/google/go-containerregistry v0.20.7 github.com/jackc/pgx/v5 v5.7.6 github.com/prometheus/client_golang v1.23.2 github.com/rs/cors v1.11.1 @@ -39,9 +39,9 @@ require ( github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0 // indirect github.com/beorn7/perks v1.0.1 // indirect github.com/cespare/xxhash/v2 v2.3.0 // indirect - github.com/containerd/stargz-snapshotter/estargz v0.16.3 // indirect + github.com/containerd/stargz-snapshotter/estargz v0.18.1 // indirect github.com/davecgh/go-spew v1.1.1 // indirect - github.com/docker/cli v28.2.2+incompatible // indirect + github.com/docker/cli v29.0.3+incompatible // indirect github.com/docker/distribution v2.8.3+incompatible // indirect github.com/docker/docker-credential-helpers v0.9.3 // indirect github.com/felixge/httpsnoop v1.0.4 // indirect @@ -56,21 +56,20 @@ require ( github.com/jackc/pgpassfile v1.0.0 // indirect github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect github.com/jackc/puddle/v2 v2.2.2 // indirect - github.com/klauspost/compress v1.18.0 // indirect + github.com/klauspost/compress v1.18.1 // indirect github.com/kylelemons/godebug v1.1.0 // indirect github.com/mitchellh/go-homedir v1.1.0 // indirect github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect github.com/opencontainers/go-digest v1.0.0 // indirect github.com/opencontainers/image-spec v1.1.1 // indirect github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect - github.com/pkg/errors v0.9.1 // indirect github.com/pmezard/go-difflib v1.0.0 // indirect github.com/prometheus/client_model v0.6.2 // indirect github.com/prometheus/common v0.66.1 // indirect github.com/prometheus/otlptranslator v0.0.2 // indirect github.com/prometheus/procfs v0.17.0 // indirect github.com/sirupsen/logrus v1.9.3 // indirect - github.com/vbatts/tar-split v0.12.1 // indirect + github.com/vbatts/tar-split v0.12.2 // indirect go.opentelemetry.io/auto/sdk v1.1.0 // indirect go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 // indirect go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect @@ -78,7 +77,7 @@ require ( go.yaml.in/yaml/v2 v2.4.2 // indirect golang.org/x/crypto v0.45.0 // indirect golang.org/x/net v0.47.0 // indirect - golang.org/x/oauth2 v0.31.0 // indirect + golang.org/x/oauth2 v0.33.0 // indirect golang.org/x/sync v0.18.0 // indirect golang.org/x/sys v0.38.0 // indirect golang.org/x/text v0.31.0 // indirect diff --git a/go.sum b/go.sum index b715f04..0e95183 100644 --- a/go.sum +++ b/go.sum @@ -34,8 +34,8 @@ github.com/caarlos0/env/v11 v11.3.1 h1:cArPWC15hWmEt+gWk7YBi7lEXTXCvpaSdCiZE2X5m github.com/caarlos0/env/v11 v11.3.1/go.mod h1:qupehSf/Y0TUTsxKywqRt/vJjN5nz6vauiYEUUr8P4U= github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs= github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= -github.com/containerd/stargz-snapshotter/estargz v0.16.3 h1:7evrXtoh1mSbGj/pfRccTampEyKpjpOnS3CyiV1Ebr8= -github.com/containerd/stargz-snapshotter/estargz v0.16.3/go.mod h1:uyr4BfYfOj3G9WBVE8cOlQmXAbPN9VEQpBBeJIuOipU= +github.com/containerd/stargz-snapshotter/estargz v0.18.1 h1:cy2/lpgBXDA3cDKSyEfNOFMA/c10O1axL69EU7iirO8= +github.com/containerd/stargz-snapshotter/estargz v0.18.1/go.mod h1:ALIEqa7B6oVDsrF37GkGN20SuvG/pIMm7FwP7ZmRb0Q= github.com/coreos/go-oidc/v3 v3.17.0 h1:hWBGaQfbi0iVviX4ibC7bk8OKT5qNr4klBaCHVNvehc= github.com/coreos/go-oidc/v3 v3.17.0/go.mod h1:wqPbKFrVnE90vty060SB40FCJ8fTHTxSwyXJqZH+sI8= github.com/danielgtaylor/huma/v2 v2.34.1 h1:EmOJAbzEGfy0wAq/QMQ1YKfEMBEfE94xdBRLPBP0gwQ= @@ -43,8 +43,8 @@ github.com/danielgtaylor/huma/v2 v2.34.1/go.mod h1:ynwJgLk8iGVgoaipi5tgwIQ5yoFNm github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= -github.com/docker/cli v28.2.2+incompatible h1:qzx5BNUDFqlvyq4AHzdNB7gSyVTmU4cgsyN9SdInc1A= -github.com/docker/cli v28.2.2+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= +github.com/docker/cli v29.0.3+incompatible h1:8J+PZIcF2xLd6h5sHPsp5pvvJA+Sr2wGQxHkRl53a1E= +github.com/docker/cli v29.0.3+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk= github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w= github.com/docker/docker-credential-helpers v0.9.3 h1:gAm/VtF9wgqJMoxzT3Gj5p4AqIjCBS4wrsOh9yRqcz8= @@ -64,8 +64,8 @@ github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps= github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= -github.com/google/go-containerregistry v0.20.6 h1:cvWX87UxxLgaH76b4hIvya6Dzz9qHB31qAwjAohdSTU= -github.com/google/go-containerregistry v0.20.6/go.mod h1:T0x8MuoAoKX/873bkeSfLD2FAkwCDf9/HZgsFJ02E2Y= +github.com/google/go-containerregistry v0.20.7 h1:24VGNpS0IwrOZ2ms2P1QE3Xa5X9p4phx0aUgzYzHW6I= +github.com/google/go-containerregistry v0.20.7/go.mod h1:Lx5LCZQjLH1QBaMPeGwsME9biPeo1lPx6lbGj/UmzgM= github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0= github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= @@ -86,8 +86,8 @@ github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4= github.com/keybase/go-keychain v0.0.1 h1:way+bWYa6lDppZoZcgMbYsvC7GxljxrskdNInRtuthU= github.com/keybase/go-keychain v0.0.1/go.mod h1:PdEILRW3i9D8JcdM+FmY6RwkHGnhHxXwkPPMeUgOK1k= -github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo= -github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ= +github.com/klauspost/compress v1.18.1 h1:bcSGx7UbpBqMChDtsF28Lw6v/G94LPrrbMbdC3JH2co= +github.com/klauspost/compress v1.18.1/go.mod h1:ZQFFVG+MdnR0P+l6wpXgIL4NTtwiKIdBnrBd8Nrxr+0= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= @@ -131,8 +131,8 @@ github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UV github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U= github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= -github.com/vbatts/tar-split v0.12.1 h1:CqKoORW7BUWBe7UL/iqTVvkTBOF8UvOMKOIZykxnnbo= -github.com/vbatts/tar-split v0.12.1/go.mod h1:eF6B6i6ftWQcDqEn3/iGFRFRo8cBIMSJVOpnNdfTMFA= +github.com/vbatts/tar-split v0.12.2 h1:w/Y6tjxpeiFMR47yzZPlPj/FcPLpXbTUi/9H7d3CPa4= +github.com/vbatts/tar-split v0.12.2/go.mod h1:eF6B6i6ftWQcDqEn3/iGFRFRo8cBIMSJVOpnNdfTMFA= go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA= go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A= go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 h1:q4XOmH/0opmeuJtPsbFNivyl7bCt7yRBbeEm2sC/XtQ= @@ -163,8 +163,8 @@ golang.org/x/mod v0.30.0 h1:fDEXFVZ/fmCKProc/yAXXUijritrDzahmwwefnjoPFk= golang.org/x/mod v0.30.0/go.mod h1:lAsf5O2EvJeSFMiBxXDki7sCgAxEUcZHXoXMKT4GJKc= golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY= golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU= -golang.org/x/oauth2 v0.31.0 h1:8Fq0yVZLh4j4YA47vHKFTa9Ew5XIrCP8LC6UeNZnLxo= -golang.org/x/oauth2 v0.31.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA= +golang.org/x/oauth2 v0.33.0 h1:4Q+qn+E5z8gPRJfmRy7C2gGG3T4jIprK6aSYgTXGRpo= +golang.org/x/oauth2 v0.33.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA= golang.org/x/sync v0.18.0 h1:kr88TuHDroi+UVf+0hZnirlk8o8T+4MrK6mr60WkH/I= golang.org/x/sync v0.18.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI= golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= From d528ac5bbca2794f9f2b74a304bb30e2ae6dcd07 Mon Sep 17 00:00:00 2001 From: Tadas Antanavicius Date: Wed, 3 Dec 2025 08:37:22 -0800 Subject: [PATCH 033/313] Fix version mismatch in OpenAPI and changelog (#804) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## What this fixes The API changelog had a section header dated `2025-11-17`, but the openapi.yaml version is `2025-10-17`. This was confusing because they appeared to be tracking the same thing but didn't match. ## What happened 1. Various API changes (v0.1 introduction, endpoint removal) were made in early-to-mid October 2. On **Oct 17**, commit 0828bc4 bumped the openapi.yaml version to `2025-10-17` 3. These changes sat under an "Unreleased" section in the changelog 4. On **Nov 17**, commit 7b3f01a converted "Unreleased" → `2025-11-17` as part of the v1.3.9 release process The problem: `2025-11-17` was the date the release was cut, not the API version. Since there were no openapi.yaml changes between Oct 17 and Nov 17, the changelog section should match the API version (`2025-10-17`), not the internal release date. ## The fix Change the changelog header from `## 2025-11-17` to `## 2025-10-17` to align with the openapi.yaml version that consumers actually use. @domdomegg am I correct in thinking this was just a typo? Or was the distinction intentional? Authored by Claude Code, reviewed by me. Co-authored-by: Claude --- docs/reference/api/CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/reference/api/CHANGELOG.md b/docs/reference/api/CHANGELOG.md index 018b9f3..d6b99cd 100644 --- a/docs/reference/api/CHANGELOG.md +++ b/docs/reference/api/CHANGELOG.md @@ -2,7 +2,7 @@ Changes to the REST API endpoints and responses. -## 2025-11-17 +## 2025-10-17 ### Added From 51c70ba0349bb5c49d1eaa2930c9b85e5d7fb8c2 Mon Sep 17 00:00:00 2001 From: Tadas Antanavicius Date: Wed, 3 Dec 2025 08:44:30 -0800 Subject: [PATCH 034/313] Fix misleading server.json schema URL label (#803) The schema in this repo may contain unreleased changes, so labeling it with a dated version URL is misleading. Change to use a `draft` URL instead, and add documentation for the schema contribution process. - Update $id in server.schema.json to use draft URL - Update example $schema URL in openapi.yaml - Add Draft (Unreleased) section to CHANGELOG.md - Add CONTRIBUTING.md with process for making/releasing schema changes Written by Claude Code, reviewed and tweaked by me. Co-authored-by: Claude --- docs/reference/api/openapi.yaml | 2 +- docs/reference/server-json/CHANGELOG.md | 14 +++++++++ docs/reference/server-json/CONTRIBUTING.md | 30 +++++++++++++++++++ docs/reference/server-json/server.schema.json | 4 +-- tools/extract-server-schema/main.go | 8 +++-- 5 files changed, 53 insertions(+), 5 deletions(-) create mode 100644 docs/reference/server-json/CONTRIBUTING.md diff --git a/docs/reference/api/openapi.yaml b/docs/reference/api/openapi.yaml index 1e8a842..59d941a 100644 --- a/docs/reference/api/openapi.yaml +++ b/docs/reference/api/openapi.yaml @@ -709,7 +709,7 @@ components: type: string format: uri description: JSON Schema URI for this server.json format - example: "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json" + example: "https://static.modelcontextprotocol.io/schemas/draft/server.schema.json" packages: type: array items: diff --git a/docs/reference/server-json/CHANGELOG.md b/docs/reference/server-json/CHANGELOG.md index fb60a48..3fcf0c0 100644 --- a/docs/reference/server-json/CHANGELOG.md +++ b/docs/reference/server-json/CHANGELOG.md @@ -2,6 +2,20 @@ Changes to the server.json schema and format. +## Draft (Unreleased) + +This section tracks changes that are in development and not yet released. The draft schema is available at [`server.schema.json`](./server.schema.json) in this repository. + +### Changed + +- No changes yet. + +### Notes + +When ready for release, changes in this section will be moved to a dated version section (e.g., `## 2025-XX-XX`) and the schema will be published to a versioned URL. + +--- + ## 2025-10-17 ### Changed diff --git a/docs/reference/server-json/CONTRIBUTING.md b/docs/reference/server-json/CONTRIBUTING.md new file mode 100644 index 0000000..d67bc0a --- /dev/null +++ b/docs/reference/server-json/CONTRIBUTING.md @@ -0,0 +1,30 @@ +# Contributing to server.json Schema + +This document describes the process for making and releasing changes to the `server.json` schema. + +## Making Changes + +1. **Modify the OpenAPI spec**: Edit `docs/reference/api/openapi.yaml` with your schema changes. The `ServerDetail` component defines the server.json structure. + +2. **Regenerate the schema**: Run `make generate-schema` to update `server.schema.json` from the OpenAPI spec. + +3. **Update the changelog**: Add your changes to the "Draft (Unreleased)" section in `CHANGELOG.md`. + +4. **Open a PR**: Submit a pull request to this repository for review. + +## Releasing Changes + +When the draft changes are ready for release: + +1. **Update the changelog**: Move changes from "Draft (Unreleased)" to a new dated section (e.g., `## 2025-XX-XX`). + +2. **Update the schema URL**: Change the `$id` in the schema and the example URL in `openapi.yaml` from `draft` to the release date (e.g., `2025-XX-XX`). + +3. **Merge the PR**: Get approval and merge the changes to main. + +4. **Publish to static hosting**: Open a PR on [modelcontextprotocol/static](https://github.com/modelcontextprotocol/static/tree/main/schemas) to add the new versioned schema file. This "locks in" the released schema at its versioned URL. + +## Schema Versioning + +- **Draft schema**: `https://static.modelcontextprotocol.io/schemas/draft/server.schema.json` - For in-progress changes, may change without notice. +- **Released schemas**: `https://static.modelcontextprotocol.io/schemas/YYYY-MM-DD/server.schema.json` - Stable, versioned by release date. diff --git a/docs/reference/server-json/server.schema.json b/docs/reference/server-json/server.schema.json index 59967b5..2d55b58 100644 --- a/docs/reference/server-json/server.schema.json +++ b/docs/reference/server-json/server.schema.json @@ -1,6 +1,6 @@ { "$comment": "This file is auto-generated from docs/reference/api/openapi.yaml. Do not edit manually. Run 'make generate-schema' to update.", - "$id": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", + "$id": "https://static.modelcontextprotocol.io/schemas/draft/server.schema.json", "$ref": "#/definitions/ServerDetail", "$schema": "http://json-schema.org/draft-07/schema#", "definitions": { @@ -373,7 +373,7 @@ "properties": { "$schema": { "description": "JSON Schema URI for this server.json format", - "example": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", + "example": "https://static.modelcontextprotocol.io/schemas/draft/server.schema.json", "format": "uri", "type": "string" }, diff --git a/tools/extract-server-schema/main.go b/tools/extract-server-schema/main.go index a554e25..723c6a6 100644 --- a/tools/extract-server-schema/main.go +++ b/tools/extract-server-schema/main.go @@ -88,8 +88,12 @@ func main() { } } - // Build the JSON Schema document with dynamic version from OpenAPI spec - schemaID := fmt.Sprintf("https://static.modelcontextprotocol.io/schemas/%s/server.schema.json", version) + // Build the JSON Schema document with draft URL + // The in-repo schema uses "draft" since it may contain unreleased changes. + // When releasing, the schema is published to a versioned URL (e.g., 2025-10-17) + // on https://github.com/modelcontextprotocol/static + _ = version // version from OpenAPI spec available if needed + schemaID := "https://static.modelcontextprotocol.io/schemas/draft/server.schema.json" jsonSchema := map[string]interface{}{ "$comment": "This file is auto-generated from docs/reference/api/openapi.yaml. Do not edit manually. Run 'make generate-schema' to update.", "$schema": "http://json-schema.org/draft-07/schema#", From 5cc553d1ca25e1c08c5a25da6a5e8d52613a87a8 Mon Sep 17 00:00:00 2001 From: Tadas Antanavicius Date: Thu, 4 Dec 2025 02:23:14 -0800 Subject: [PATCH 035/313] Upgrade Go to 1.24.11 to fix GO-2025-4155 vulnerability (#815) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Prepared by Claude Code, reviewd by me. ## Summary - Upgrade Go from 1.24.9 to 1.24.11 in the main `go.mod` to fix govulncheck CI failure - Upgrade Go from 1.24.7 to 1.24.11 in `deploy/go.mod` for the same vulnerability fix ## Details This PR addresses the failing `govulncheck` check in CI caused by vulnerability **GO-2025-4155**: - **Vulnerability**: Excessive resource consumption when printing error string for host certificate validation in `crypto/x509` - **Found in**: `crypto/x509@go1.24.9` (and earlier versions like go1.24.7) - **Fixed in**: `crypto/x509@go1.24.11` - **More info**: https://pkg.go.dev/vuln/GO-2025-4155 Both Go module files in the repository are updated to 1.24.11 to ensure consistent vulnerability remediation. ## Test plan - [x] CI passes govulncheck after the Go version upgrade 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude --- deploy/go.mod | 2 +- go.mod | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index 5c968ef..0dc6224 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -1,6 +1,6 @@ module github.com/modelcontextprotocol/registry/deploy/infra -go 1.24.7 +go 1.24.11 require ( github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 diff --git a/go.mod b/go.mod index f578211..5fc58a0 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/modelcontextprotocol/registry -go 1.24.9 +go 1.24.11 require ( cloud.google.com/go/kms v1.23.2 From 8191133cbe35a71d4f1957781ba7b082a07469ce Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 4 Dec 2025 12:28:03 +0200 Subject: [PATCH 036/313] build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.208.0 to 3.210.0 in /deploy (#817) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from 3.208.0 to 3.210.0.
Release notes

Sourced from github.com/pulumi/pulumi/sdk/v3's releases.

v3.210.0

3.210.0 (2025-12-03)

Features

  • [cli/about] Print python toolchain information in pulumi about

  • [sdk/java] Update java to v1.18

  • [components/nodejs] Local components will use the version from package.json rather than 0.0.0 #21100

  • [cli/package] Add pulumi package delete command to delete package versions from the Pulumi Registry #21069

  • [cli/package] Always print the schema first in package get-schema, then print any binding errors #21080

  • [sdk/python] Require grpcio>=1.75.1 on Python 3.14 #21113

Bug Fixes

  • [sdk/nodejs] Fix ComponentResources transfering input arguments to output properties automatically #21094

Miscellaneous

  • [sdk/nodejs] Remove @​types/uuid type declarations dev dependency #21077

v3.209.0

3.209.0 (2025-11-26)

Features

  • [cli] Add native support for OIDC token exchange when logging into Pulumi Cloud. Run pulumi login --help for more information. #20974

  • [sdk/python] Allow older grpcio and protobuf dependencies #21007

  • [sdkgen/{dotnet,go,nodejs,python}] Generate .gitignore and .gitattributes files for generated SDKs #21034

... (truncated)

Changelog

Sourced from github.com/pulumi/pulumi/sdk/v3's changelog.

Changelog

3.209.0 (2025-11-26)

Features

  • [cli] Add native support for OIDC token exchange when logging into Pulumi Cloud. Run pulumi login --help for more information. #20974

  • [sdk/python] Allow older grpcio and protobuf dependencies #21007

  • [sdkgen/{dotnet,go,nodejs,python}] Generate .gitignore and .gitattributes files for generated SDKs #21034

Bug Fixes

  • [cli/install] Correctly install non-standard plugins. See pulumi/pulumi#20953 for more information #20983

  • [cli/new] Create pyproject.toml for uv and poetry projects when using --generate-only #20979

  • [sdk/nodejs] Fix serialization errors due to SxS copies of the SDK #21029

  • [sdk/python] Add PropertyValue runtime validation checks #21058

Miscellaneous

  • [engine] Don't send root directory and runtime options to language plugins as command line arguments #21054

  • [sdk/{dotnet,java,yaml}] Bump language runtimes for yaml, dotnet and java

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/pulumi/pulumi/sdk/v3&package-manager=go_modules&previous-version=3.208.0&new-version=3.210.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Radoslav Dimitrov --- deploy/go.mod | 3 +-- deploy/go.sum | 6 ++---- 2 files changed, 3 insertions(+), 6 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index 0dc6224..77b941c 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -5,13 +5,12 @@ go 1.24.11 require ( github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.24.1 - github.com/pulumi/pulumi/sdk/v3 v3.208.0 + github.com/pulumi/pulumi/sdk/v3 v3.210.0 gopkg.in/yaml.v2 v2.4.0 ) require ( dario.cat/mergo v1.0.0 // indirect - github.com/BurntSushi/toml v1.2.1 // indirect github.com/Microsoft/go-winio v0.6.2 // indirect github.com/ProtonMail/go-crypto v1.1.6 // indirect github.com/aead/chacha20 v0.0.0-20180709150244-8b13a72661da // indirect diff --git a/deploy/go.sum b/deploy/go.sum index c5ef9e8..7f77dec 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -1,7 +1,5 @@ dario.cat/mergo v1.0.0 h1:AGCNq9Evsj31mOgNPcLyXc+4PNABt905YmuqPYYpBWk= dario.cat/mergo v1.0.0/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk= -github.com/BurntSushi/toml v1.2.1 h1:9F2/+DoOYIOksmaJFPw1tGFy1eDnIJXg+UHjuD8lTak= -github.com/BurntSushi/toml v1.2.1/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ= github.com/HdrHistogram/hdrhistogram-go v1.1.2 h1:5IcZpTvzydCQeHzK4Ef/D5rrSqwxob0t8PQPMybUNFM= github.com/HdrHistogram/hdrhistogram-go v1.1.2/go.mod h1:yDgFjdqOqDEKOvasDdhWNXYg9BVp4O+o5f6V/ehm6Oo= github.com/Microsoft/go-winio v0.5.2/go.mod h1:WpS1mjBmmwHBEWmogvA2mj8546UReBk4v8QkMxJ6pZY= @@ -160,8 +158,8 @@ github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 h1:w6OnO3d4j5yVf2vpm8OzXFC/xHOEGqt+9 github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1/go.mod h1:UyZyv7hz4knpFx6/Sh+SkZe6hT6sJHtDvw9A0TbvEsk= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.24.1 h1:L1J2/PHgAziDXUvOWJ4HH1JBlgxzpQseZiEIu4K2x34= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.24.1/go.mod h1:vNiMC/N8GNHvDwU3gQRXQ6V+kbgSl5N/lKtfrUjGuXU= -github.com/pulumi/pulumi/sdk/v3 v3.208.0 h1:AUBoh7zw67NZVo1IkapOog1WBMz46DXco/7YsKBNK1s= -github.com/pulumi/pulumi/sdk/v3 v3.208.0/go.mod h1:UsBMdaUQ+WoKoQtF2PYbQIbo8ZRJuAo1axkyit9IQVE= +github.com/pulumi/pulumi/sdk/v3 v3.210.0 h1:QMNdfQfB7jCa/ZoY8aIfwOwApuvhnOoIH8s4umNvR3U= +github.com/pulumi/pulumi/sdk/v3 v3.210.0/go.mod h1:0qnUzUV5ypAcdoPNOX426wV4ePMnkDvGlPBZqlizHmU= github.com/rivo/uniseg v0.1.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc= github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc= github.com/rivo/uniseg v0.4.4 h1:8TfxU8dW6PdqD27gjM8MVNuicgxIjxpm4K7x4jp8sis= From d092dd6390f1c64add83303517c4d00bfc65433e Mon Sep 17 00:00:00 2001 From: Avish Porwal Date: Thu, 4 Dec 2025 22:53:15 +0530 Subject: [PATCH 037/313] Fix issue-743 by sanitizing the URL (#809) This PR aims to fix https://github.com/modelcontextprotocol/registry/issues/743#event-20985516896 ## Motivation and Context This is needed to ensure we are sanitizing the URL before creating server.json to be inline with the validations. ## How Has This Been Tested? Tested via UTs and also tested CLI locally to ensure the expected behavior. ## Breaking Changes ## Types of changes - [ ] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] Documentation update ## Checklist - [ ] I have read the [MCP Documentation](https://modelcontextprotocol.io) - [x] My code follows the repository's style guidelines - [ ] New and existing tests pass locally - [ ] I have added appropriate error handling - [ ] I have added or updated documentation as needed ## Additional context Co-authored-by: Avish Porwal --- cmd/publisher/commands/init.go | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/cmd/publisher/commands/init.go b/cmd/publisher/commands/init.go index 6a7381d..d1ac9a1 100644 --- a/cmd/publisher/commands/init.go +++ b/cmd/publisher/commands/init.go @@ -213,6 +213,10 @@ func detectDescription() string { } func detectRepoURL() string { + sanitizeURL := func(url string) string { + return strings.TrimPrefix(url, "git+") + } + // Try git remote ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second) defer cancel() @@ -233,11 +237,11 @@ func detectRepoURL() string { if json.Unmarshal(data, &pkg) == nil { if repo, ok := pkg["repository"].(map[string]any); ok { if url, ok := repo["url"].(string); ok { - return strings.TrimSuffix(url, ".git") + return sanitizeURL(strings.TrimSuffix(url, ".git")) } } if repo, ok := pkg["repository"].(string); ok { - return strings.TrimSuffix(repo, ".git") + return sanitizeURL(strings.TrimSuffix(repo, ".git")) } } } From 65b96b03ce09e87a6ed10bca6a4e2e9127cdcbc3 Mon Sep 17 00:00:00 2001 From: Tadas Antanavicius Date: Thu, 4 Dec 2025 13:02:45 -0800 Subject: [PATCH 038/313] docs: update API endpoint documentation from /v0/ to /v0.1/ (#802) Update all documentation to reference the stable `/v0.1/` API version instead of the development `/v0/` version. Didn't update internal references (e.g. in admin-only docs) as that probably make sense to keep pointed at v0 as the "dev" option. Authored by Claude Code, reviewed by me. --------- Co-authored-by: Claude --- docs/design/tech-architecture.md | 6 +++--- .../registry-aggregators.mdx | 4 ++-- docs/reference/api/generic-registry-api.md | 12 ++++++------ docs/reference/api/official-registry-api.md | 18 +++++++++--------- scripts/mirror_data/README.md | 2 +- 5 files changed, 21 insertions(+), 21 deletions(-) diff --git a/docs/design/tech-architecture.md b/docs/design/tech-architecture.md index d163dff..03097f7 100644 --- a/docs/design/tech-architecture.md +++ b/docs/design/tech-architecture.md @@ -177,7 +177,7 @@ sequenceDiagram Admin->>CLI: Request admin token CLI->>GCP: gcloud auth print-identity-token --audiences=mcp-registry GCP-->>CLI: ID Token (with hd: "modelcontextprotocol.io") - CLI->>API: POST /v0/auth/oidc {"oidc_token": "eyJ..."} + CLI->>API: POST /v0.1/auth/oidc {"oidc_token": "eyJ..."} API->>GCP: Verify token signature (JWKS) API->>API: Validate claims (issuer, audience, hd) API->>API: Grant admin permissions (edit: *, publish: *) @@ -193,10 +193,10 @@ sequenceDiagram ID_TOKEN=$(gcloud auth print-identity-token) # Exchange for Registry JWT token -REGISTRY_TOKEN=$(curl -X POST /v0/auth/oidc \ +REGISTRY_TOKEN=$(curl -X POST /v0.1/auth/oidc \ -H "Content-Type: application/json" \ -d '{"oidc_token": "'$ID_TOKEN'"}' | jq -r .registry_token) # Use for admin operations -curl -H "Authorization: Bearer $REGISTRY_TOKEN" /v0/... +curl -H "Authorization: Bearer $REGISTRY_TOKEN" /v0.1/... ``` \ No newline at end of file diff --git a/docs/modelcontextprotocol-io/registry-aggregators.mdx b/docs/modelcontextprotocol-io/registry-aggregators.mdx index 11848c7..685944f 100644 --- a/docs/modelcontextprotocol-io/registry-aggregators.mdx +++ b/docs/modelcontextprotocol-io/registry-aggregators.mdx @@ -30,7 +30,7 @@ The `GET /v0.1/servers` endpoint supports cursor-based pagination. For example, the first page can be fetched using a `limit` query parameter: ```bash -curl "https://registry.modelcontextprotocol.io/v0/servers?limit=100" +curl "https://registry.modelcontextprotocol.io/v0.1/servers?limit=100" ``` ```jsonc Output highlight={5} @@ -48,7 +48,7 @@ curl "https://registry.modelcontextprotocol.io/v0/servers?limit=100" Then subsequent pages can be fetched by passing the `nextCursor` value as the `cursor` query parameter: ```bash -curl "https://registry.modelcontextprotocol.io/v0/servers?limit=100&cursor=com.example/my-server:1.0.0" +curl "https://registry.modelcontextprotocol.io/v0.1/servers?limit=100&cursor=com.example/my-server:1.0.0" ``` ### Filtering Since diff --git a/docs/reference/api/generic-registry-api.md b/docs/reference/api/generic-registry-api.md index 614eb81..e8a78bf 100644 --- a/docs/reference/api/generic-registry-api.md +++ b/docs/reference/api/generic-registry-api.md @@ -14,11 +14,11 @@ The official registry has some more endpoints and restrictions on top of this. S ## Quick Reference ### Core Endpoints -- **`GET /v0/servers`** - List all servers with pagination -- **`GET /v0/servers/{serverName}/versions`** - List all versions of a server -- **`GET /v0/servers/{serverName}/versions/{version}`** - Get specific version of server. Use the special version `latest` to get the latest version. -- **`POST /v0/publish`** - Publish new server (optional, registry-specific authentication) -- **`DELETE /v0/servers/{serverName}/versions/{version}`** - Delete specific server version (optional, not implemented by official registry) +- **`GET /v0.1/servers`** - List all servers with pagination +- **`GET /v0.1/servers/{serverName}/versions`** - List all versions of a server +- **`GET /v0.1/servers/{serverName}/versions/{version}`** - Get specific version of server. Use the special version `latest` to get the latest version. +- **`POST /v0.1/publish`** - Publish new server (optional, registry-specific authentication) +- **`DELETE /v0.1/servers/{serverName}/versions/{version}`** - Delete specific server version (optional, not implemented by official registry) Server names and version strings should be URL-encoded in paths. @@ -42,7 +42,7 @@ List endpoints use cursor-based pagination for efficient, stable results. ### Basic Example: List Servers ```bash -curl https://registry.example.com/v0/servers?limit=10 +curl https://registry.example.com/v0.1/servers?limit=10 ``` ```json diff --git a/docs/reference/api/official-registry-api.md b/docs/reference/api/official-registry-api.md index 4215a79..f9e3c7d 100644 --- a/docs/reference/api/official-registry-api.md +++ b/docs/reference/api/official-registry-api.md @@ -35,7 +35,7 @@ The official registry enforces additional [package validation requirements](../s ### Server List Filtering -The official registry extends the `GET /v0/servers` endpoint with additional query parameters for improved discovery and synchronization: +The official registry extends the `GET /v0.1/servers` endpoint with additional query parameters for improved discovery and synchronization: - `updated_since` - Filter servers updated after RFC3339 timestamp (e.g., `2025-08-07T13:15:04.280Z`) - `search` - Case-insensitive substring search on server names (e.g., `filesystem`) @@ -44,18 +44,18 @@ The official registry extends the `GET /v0/servers` endpoint with additional que These extensions enable efficient incremental synchronization for downstream registries and improved server discovery. Parameters can be combined and work with standard cursor-based pagination. -Example: `GET /v0/servers?search=filesystem&updated_since=2025-08-01T00:00:00Z&version=latest` +Example: `GET /v0.1/servers?search=filesystem&updated_since=2025-08-01T00:00:00Z&version=latest` ### Additional endpoints #### Auth endpoints -- POST `/v0/auth/dns` - Exchange signed DNS challenge for auth token -- POST `/v0/auth/http` - Exchange signed HTTP challenge for auth token -- POST `/v0/auth/github-at` - Exchange GitHub access token for auth token -- POST `/v0/auth/github-oidc` - Exchange GitHub OIDC token for auth token -- POST `/v0/auth/oidc` - Exchange Google OIDC token for auth token (for admins) +- POST `/v0.1/auth/dns` - Exchange signed DNS challenge for auth token +- POST `/v0.1/auth/http` - Exchange signed HTTP challenge for auth token +- POST `/v0.1/auth/github-at` - Exchange GitHub access token for auth token +- POST `/v0.1/auth/github-oidc` - Exchange GitHub OIDC token for auth token +- POST `/v0.1/auth/oidc` - Exchange Google OIDC token for auth token (for admins) #### Admin endpoints - GET `/metrics` - Prometheus metrics endpoint -- GET `/v0/health` - Basic health check endpoint -- PUT `/v0/servers/{serverName}/versions/{version}` - Edit specific server version +- GET `/v0.1/health` - Basic health check endpoint +- PUT `/v0.1/servers/{serverName}/versions/{version}` - Edit specific server version diff --git a/scripts/mirror_data/README.md b/scripts/mirror_data/README.md index 5735c8d..3237211 100644 --- a/scripts/mirror_data/README.md +++ b/scripts/mirror_data/README.md @@ -31,7 +31,7 @@ go run scripts/mirror_data/fetch_production_data.go ``` This will: -- Fetch all servers from https://registry.modelcontextprotocol.io/v0/servers +- Fetch all servers from https://registry.modelcontextprotocol.io/v0.1/servers - Handle pagination automatically - Save data to `scripts/mirror_data/production_servers.json` - Be respectful to the API with rate limiting From af29c14239ec0e4802be5a5e565acb852bdb7ca1 Mon Sep 17 00:00:00 2001 From: Joel Verhagen Date: Fri, 5 Dec 2025 10:38:35 -0500 Subject: [PATCH 039/313] Fix command documentation for publish (#818) ## Motivation and Context The `--file=PATH` pattern does not work. The path is an optional, positional argument not a named option. The `--dry-run` option is not supported. Look at the implementation: https://github.com/modelcontextprotocol/registry/blob/d092dd6390f1c64add83303517c4d00bfc65433e/cmd/publisher/commands/publish.go#L19 ## How Has This Been Tested? Try these options yourself, they are ignored. ## Breaking Changes ## Types of changes - [ ] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [x] Documentation update ## Checklist - [x] I have read the [MCP Documentation](https://modelcontextprotocol.io) - [x] My code follows the repository's style guidelines - [x] New and existing tests pass locally - [x] I have added appropriate error handling - [x] I have added or updated documentation as needed ## Additional context --- docs/reference/cli/commands.md | 18 +++++++----------- 1 file changed, 7 insertions(+), 11 deletions(-) diff --git a/docs/reference/cli/commands.md b/docs/reference/cli/commands.md index 5ec13fc..5564903 100644 --- a/docs/reference/cli/commands.md +++ b/docs/reference/cli/commands.md @@ -215,30 +215,26 @@ For detailed guidance on the publishing process, see the [publishing guide](../. **Usage:** ```bash -mcp-publisher publish [options] +mcp-publisher publish [PATH] ``` **Options:** -- `--file=PATH` - Path to server.json (default: `./server.json`) -- `--registry=URL` - Registry URL override -- `--dry-run` - Validate without publishing +- `PATH` - Path to server.json (default: `./server.json`) **Process:** 1. Validates `server.json` against schema -2. Verifies package ownership (see [Official Registry Requirements](../server-json/official-registry-requirements.md)) -3. Checks namespace authentication -4. Publishes to registry +2. Publishes the `server.json` to the registry server URL specified in the login token +3. Server: Verifies package ownership (see [Official Registry Requirements](../server-json/official-registry-requirements.md)) +4. Server: Checks namespace authentication +5. Server: Publishes to registry **Example:** ```bash # Basic publish mcp-publisher publish -# Dry run validation -mcp-publisher publish --dry-run - # Custom file location -mcp-publisher publish --file=./config/server.json +mcp-publisher publish ./config/server.json ``` ### `mcp-publisher logout` From ca6912cded5dc293cf292c20183f75e1f282b323 Mon Sep 17 00:00:00 2001 From: adam jones Date: Fri, 5 Dec 2025 15:38:51 +0000 Subject: [PATCH 040/313] Add registry extensions specification (#777) Introduces a standardized way for registries to provide experimental or community-driven features without committing them to the core API specification. ## Summary - Extensions live under `/v0/x//` URL structure - Simple conventions: REST, JSON responses, cursor pagination, optional auth - Composable design building on core APIs where possible This enables experimentation with features like search (#389) and MCP server integration (#24) while keeping the core API minimal and stable. Fixes #776 --- docs/reference/api/extensions.md | 70 ++++++++++++++++++++++++++++++++ 1 file changed, 70 insertions(+) create mode 100644 docs/reference/api/extensions.md diff --git a/docs/reference/api/extensions.md b/docs/reference/api/extensions.md new file mode 100644 index 0000000..9340a16 --- /dev/null +++ b/docs/reference/api/extensions.md @@ -0,0 +1,70 @@ +# Registry Extensions Specification + +A standardized way for registries to provide experimental or community-driven features without committing them to the core API specification. + +## Motivation + +[The core generic registry API](./generic-registry-api.md) intentionally stays minimal to ensure stability and broad adoption. Extensions provide a path for: + +- **Experimentation**: Try new features without core API changes +- **Community innovation**: Anyone can implement custom extensions +- **Gradual adoption**: Popular extensions may inform future core API features +- **Avoiding breaking changes**: Failed experiments can be deprecated without API versioning churn + +## URL Structure + +Extensions live under the `/v0/x/` prefix: + +``` +/v0/x//[/] +``` + +**Components:** +- ``: Reverse domain ownership (e.g., `com.example`, `io.github.username`) +- ``: Extension name (lowercase, hyphens for word separation) +- ``: Extension-specific path structure (optional) + +**Examples:** +``` +/v0/x/com.example/search?q=database +/v0/x/com.example/stats +/v0/x/io.github.username/custom-feature +``` + +## Conventions + +Where possible: +- Follow standard REST conventions, return simple JSON responses, and avoid special headers +- For list endpoints, use cursor-based pagination matching the core API +- Extensions requiring authentication **SHOULD** follow the [Registry Authorization Specification](./registry-authorization.md) +- Build open-source implementations in a composable way on top of the core APIs (e.g. as opposed to via custom database integration) + +## Implementation Requirements + +Registries implementing extensions **SHOULD** namespace extensions properly to avoid conflicts. + +Clients consuming extensions **MUST** gracefully handle missing extensions. + +## Example + +A simple server stats extension: + +```bash +GET /v0/x/com.example/stats +``` + +```json +{ + "totalServers": 1234, + "totalVersions": 5678, + "recentPublishes": 42 +} +``` + +## Future Considerations + +- **Extension discovery**: A potential `/v0/x` endpoint to list available extensions +- **Extension metadata**: Standardized metadata format for extension capabilities +- **Defining common extensions**: Like semantic conventions from OpenTelemetry, develop common extensions that registries can adopt (possibly under an experimental namespace) + - Search extension for free-text search across server metadata ([#389](https://github.com/modelcontextprotocol/registry/issues/389)) + - MCP server extension to expose the registry itself as an MCP server for programmatic access ([#24](https://github.com/modelcontextprotocol/registry/issues/24)) From 8b861e5e1ae914c8b0b47a71e544f9a0db5b74f6 Mon Sep 17 00:00:00 2001 From: Tadas Antanavicius Date: Mon, 8 Dec 2025 05:34:43 -0800 Subject: [PATCH 041/313] docs: add production database connection guide for admins (#808) Drafted by Claude Code, reviewed and tested by me. Add instructions for maintainers to connect to the production PostgreSQL database, including Cloud Shell (recommended) and local machine methods, plus read-only session configuration for safety. --------- Co-authored-by: Claude --- docs/administration/admin-operations.md | 40 ++++++++++++++++++++++++- 1 file changed, 39 insertions(+), 1 deletion(-) diff --git a/docs/administration/admin-operations.md b/docs/administration/admin-operations.md index c6a946b..6b3a04d 100644 --- a/docs/administration/admin-operations.md +++ b/docs/administration/admin-operations.md @@ -8,6 +8,7 @@ This is a brief guide for admins and moderators managing content on the registry - If you are a maintainer and would like an account, ask in the Discord - `gcloud` CLI installed and configured - `curl` and `jq` installed +- `kubectl` installed with `gke-gcloud-auth-plugin` (for database access) ## Authentication @@ -138,9 +139,46 @@ curl -s "https://registry.modelcontextprotocol.io/v0/servers/${ENCODED_SERVER_NA done ``` +## Connecting to the Production Database + +For debugging or data analysis, you can connect directly to the production PostgreSQL database. Use caution and prefer read-only access. + +### Prerequisites + +Install the GKE auth plugin if you haven't already: + +```bash +gcloud components install gke-gcloud-auth-plugin +``` + +### Connect + +```bash +# Get cluster credentials +gcloud container clusters get-credentials mcp-registry-prod --zone us-central1-b --project mcp-registry-prod + +# Get the database password +kubectl get secret registry-pg-app -o jsonpath='{.data.password}' | base64 -d + +# Port-forward and connect (enter the password from above) +kubectl port-forward svc/registry-pg-rw 15432:5432 & +sleep 2 +psql -h localhost -p 15432 -U app -d app +``` + +### Read-Only Access + +To prevent accidental writes, set your session to read-only after connecting: + +```sql +SET default_transaction_read_only = on; +``` + +Any write attempts will fail with an error until you disconnect. + ## Notes - **Version-specific changes**: Only affect that particular version -- **Server-wide changes**: Must be applied to each version individually +- **Server-wide changes**: Must be applied to each version individually - **Content scrubbing**: Use the version-specific edit workflow to scrub sensitive content - **Server name**: Cannot be changed in any version (it's the immutable identifier) From 370453317dccf16a57a878632aee66384145731d Mon Sep 17 00:00:00 2001 From: Tadas Antanavicius Date: Mon, 8 Dec 2025 05:42:58 -0800 Subject: [PATCH 042/313] Restrict @claude bot to mcp org only, fix fork behavior (#819) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Written by Claude Code, reviewed by me. ## Summary Fixes `@claude` to work on external fork PRs by: 1. Restricting triggers to modelcontextprotocol org members only 2. Properly checking out fork PR code via `refs/pull/N/head` ## Background The `@claude` GitHub app was failing on external forks ([example](https://github.com/modelcontextprotocol/registry/actions/runs/19938435814/job/57169634431)) because the action tried to fetch branches by name, which doesn't work for forks. ## Changes ### Org membership check - Fetches the member list from [`modelcontextprotocol/access`](https://github.com/modelcontextprotocol/access) repo's `users.ts` - Only org members can trigger `@claude` (prevents strangers from using it) - Uses `github.triggering_actor` so the person commenting must be an org member ### Fork PR checkout fix - Detects when a comment is on a fork PR - Uses `refs/pull/{number}/head` to checkout fork code (instead of branch name) - This works because GitHub exposes all PRs via special refs on the base repo ## How it works 1. Org member comments `@claude` on a fork PR 2. Workflow checks if commenter is in the `modelcontextprotocol/access` member list 3. Workflow detects it's a fork PR and checks out via `refs/pull/N/head` 4. Claude runs with access to the fork's code 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude --- .github/workflows/claude.yml | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index e00af77..a1bb804 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -25,10 +25,43 @@ jobs: id-token: write actions: read steps: + # Only allow modelcontextprotocol org members to trigger @claude + # This enables @claude to work on external fork PRs when triggered by org members + # Members list is fetched from modelcontextprotocol/access repo + - name: Check if org member + run: | + ACTOR="${{ github.triggering_actor }}" + USERS_URL="https://raw.githubusercontent.com/modelcontextprotocol/access/main/src/config/users.ts" + + # Fetch users.ts and extract GitHub usernames + MEMBERS=$(curl -fsSL "$USERS_URL" | grep -oE 'github:\s*"[^"]+"' | sed 's/github:\s*"//;s/"$//') + + if echo "$MEMBERS" | grep -qxF "$ACTOR"; then + echo "User $ACTOR is a member of modelcontextprotocol org" + else + echo "::error::User $ACTOR is not a member of the modelcontextprotocol org. Only org members can trigger @claude." + exit 1 + fi + + # For PR comments, get PR details to checkout the correct branch (including forks) + - name: Get PR details + id: pr + if: github.event.issue.pull_request + env: + GH_TOKEN: ${{ github.token }} + run: | + PR_DATA=$(gh api ${{ github.event.issue.pull_request.url }}) + echo "number=$(echo "$PR_DATA" | jq -r '.number')" >> $GITHUB_OUTPUT + echo "head_ref=$(echo "$PR_DATA" | jq -r '.head.ref')" >> $GITHUB_OUTPUT + echo "head_repo=$(echo "$PR_DATA" | jq -r '.head.repo.full_name')" >> $GITHUB_OUTPUT + echo "is_fork=$(echo "$PR_DATA" | jq -r '.head.repo.fork')" >> $GITHUB_OUTPUT + - name: Checkout repository uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd with: fetch-depth: 1 + # For fork PRs, checkout via PR ref; otherwise use the branch directly + ref: ${{ steps.pr.outputs.is_fork == 'true' && format('refs/pull/{0}/head', steps.pr.outputs.number) || steps.pr.outputs.head_ref || github.ref }} - name: Run Claude Code id: claude From 8a3d858d1d49a903163bd19b3fdd1813f491b1a3 Mon Sep 17 00:00:00 2001 From: Jonathan Hefner Date: Mon, 8 Dec 2025 07:43:16 -0600 Subject: [PATCH 043/313] docs: fix broken links in Documentation Index (#822) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Update Documentation Index section to reflect the current directory structure after the docs reorganization in #728. The old links to ./guides/ and ./explanations/ no longer exist. Fixes #821 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude --- docs/README.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/docs/README.md b/docs/README.md index ad12c02..cb06d3e 100644 --- a/docs/README.md +++ b/docs/README.md @@ -12,6 +12,8 @@ The MCP registry provides MCP clients with a list of MCP servers, like an app st ## Documentation Index -- 🛠️ [How-To Guides: Task-focused instructions](./guides/) -- 💡 [Explanations: Understanding-oriented content](./explanations/) -- 📖 [Reference: Technical specifications and lookup material](./reference/) +- 📄 [Public-facing docs](./modelcontextprotocol-io/) - Published on modelcontextprotocol.io +- 🏗️ [Design documentation](./design/) - Architecture, vision, and roadmap +- 📖 [Reference](./reference/) - Technical specifications +- 🔧 [Contributing guides](./contributing/) - How to contribute +- 🔒 [Administration](./administration/) - Admin operations From 823c1a10816d48c1848b3d1915195dfe3ddfe57a Mon Sep 17 00:00:00 2001 From: Tadas Antanavicius Date: Mon, 8 Dec 2025 05:43:37 -0800 Subject: [PATCH 044/313] Add registry maintainer onboarding documentation (#820) Closes https://github.com/modelcontextprotocol/registry/issues/512 --------- Co-authored-by: Claude --- docs/administration/maintainer-onboarding.md | 24 ++++++++++++++++++++ 1 file changed, 24 insertions(+) create mode 100644 docs/administration/maintainer-onboarding.md diff --git a/docs/administration/maintainer-onboarding.md b/docs/administration/maintainer-onboarding.md new file mode 100644 index 0000000..f6e3871 --- /dev/null +++ b/docs/administration/maintainer-onboarding.md @@ -0,0 +1,24 @@ +# Registry Maintainer Onboarding + +This guide covers onboarding new maintainers to the MCP Registry project. + +## Checklist + +When onboarding a new maintainer, complete the following steps: + +### 1. Access Repository (GitHub, Google Workspace) + +- [ ] Open a PR on the [modelcontextprotocol/access](https://github.com/modelcontextprotocol/access) repository + +### 2. MAINTAINERS.md + +- [ ] Add them to the `MAINTAINERS.md` file in [modelcontextprotocol/modelcontextprotocol](https://github.com/modelcontextprotocol/modelcontextprotocol) + +### 3. README.md + +- [ ] Add them to the "Current key maintainers" section in [README.md](../../README.md) + +### 4. Discord + +- [ ] Invite them to the MCP Discord server +- [ ] Ask a Community Moderator or Core Maintainer to add them to the appropriate roles From 80cb03ff7a6b515ed051681ac6e0c5abddd5d242 Mon Sep 17 00:00:00 2001 From: Joel Verhagen Date: Tue, 9 Dec 2025 10:19:38 -0500 Subject: [PATCH 045/313] Fix NuGet.org base URL default, improve API integration (#813) ## Motivation and Context This resolves https://github.com/modelcontextprotocol/registry/issues/738. There are two issues with the NuGet.org integration today: 1. Change the `registryBaseUrl` for NuGet to `https://api.nuget.org/v3/index.json`. `https://api.nuget.org` is not the entry point for our service and is not specific enough. `https://api.nuget.org/v3/index.json` is the value that users put into their tooling to connect to our public registry (it is installed by default in .NET client tooling). 2. Use the service index API to get the URL pattern for package READMEs. - This URL is not guaranteed to be stable. The service index URL (`registryBaseUrl`) is, however. Additionally, I polished up the error messages so various error modes are clearer. When packages are published to NuGet.org, they take 2-5 minutes to become available due to validations we run. Some possible states that are now handled and described more helpfully are: - Version exists, but the package has no README - The ID exists, but the version does not - The ID does not exist at all There are only 3 authors (me, another MSFT person, and a community member) explicitly setting the old value. The DB migration will fix the issue. A future publish will fail with the validation error but the error message is clear. `registry type and base URL do not match: 'https://api.nuget.org' is not valid for registry type 'nuget'. Expected: https://api.nuget.org/v3/index.json` ## How Has This Been Tested? - Unit tests, new and existing - Manual test locally - Set old data in the DB, `docker compose up`, confirm the migration updates the specific package ## Breaking Changes Yes, but minimal impact expected, unless there is a dependency on the specific `https://api.nuget.org` value downstream. I am not aware of any such dependency, and the new value is more proper and specific. ## Types of changes - [ ] Bug fix (non-breaking change which fixes an issue) - [x] New feature (non-breaking change which adds functionality) - [x] Breaking change (fix or feature that would cause existing functionality to change) - [x] Documentation update ## Checklist - [x] I have read the [MCP Documentation](https://modelcontextprotocol.io) - [x] My code follows the repository's style guidelines - [x] New and existing tests pass locally - [x] I have added appropriate error handling - [x] I have added or updated documentation as needed ## Additional context For more information about the NuGet API see: https://learn.microsoft.com/en-us/nuget/api/overview#service-index (I wrote most of the docs). --- complete.md | 11 +- .../modelcontextprotocol-io/package-types.mdx | 2 +- docs/reference/api/openapi.yaml | 2 +- .../server-json/generic-server-json.md | 4 +- .../official-registry-requirements.md | 2 +- docs/reference/server-json/server.schema.json | 2 +- .../012_fix_nuget_registry_base_url.sql | 58 ++++ internal/validators/registries/nuget.go | 254 ++++++++++++++++-- internal/validators/registries/nuget_test.go | 18 +- .../validators/registries/testutils_test.go | 8 - pkg/model/constants.go | 2 +- 11 files changed, 323 insertions(+), 40 deletions(-) create mode 100644 internal/database/migrations/012_fix_nuget_registry_base_url.sql diff --git a/complete.md b/complete.md index c42097d..1fe5d05 100644 --- a/complete.md +++ b/complete.md @@ -658,7 +658,7 @@ Only trusted public registries are supported. Private registries and alternative **Supported registries:** - **NPM**: `https://registry.npmjs.org` only - **PyPI**: `https://pypi.org` only -- **NuGet**: `https://api.nuget.org` only +- **NuGet**: `https://api.nuget.org/v3/index.json` - **Docker/OCI**: `https://docker.io` only - **MCPB**: `https://github.com` releases and `https://gitlab.com` releases only @@ -1549,7 +1549,8 @@ Include your server name in your package's README using this format: Add a README file to your NuGet package that includes the server name. This can be in a comment if you want to hide it from display elsewhere. ### How It Works -- Registry fetches README from `https://api.nuget.org/v3-flatcontainer/{id}/{version}/readme` +- Registry fetches and cached service index `https://api.nuget.org/v3/index.json` +- Registry uses `ReadmeUriTemplate/6.13.0` URL template in service index to fetch README - Passes if `mcp-name: server-name` is found in the README content ### Example server.json @@ -1566,7 +1567,7 @@ Add a README file to your NuGet package that includes the server name. This can } ``` -The official MCP registry currently only supports the official NuGet registry (`https://api.nuget.org`). +The official MCP registry currently only supports the official NuGet registry (`https://api.nuget.org/v3/index.json`).
@@ -2341,7 +2342,7 @@ Suppose your MCP server application requires a `mcp start` CLI arguments to star "packages": [ { "registry_type": "nuget", - "registry_base_url": "https://api.nuget.org", + "registry_base_url": "https://api.nuget.org/v3/index.json", "identifier": "Knapcode.SampleMcpServer", "version": "0.4.0-beta", "transport": { @@ -2578,7 +2579,7 @@ The `dnx` tool ships with the .NET 10 SDK, starting with Preview 6. "packages": [ { "registry_type": "nuget", - "registry_base_url": "https://api.nuget.org", + "registry_base_url": "https://api.nuget.org/v3/index.json", "identifier": "Knapcode.SampleMcpServer", "version": "0.5.0", "runtime_hint": "dnx", diff --git a/docs/modelcontextprotocol-io/package-types.mdx b/docs/modelcontextprotocol-io/package-types.mdx index 496ff53..57960a3 100644 --- a/docs/modelcontextprotocol-io/package-types.mdx +++ b/docs/modelcontextprotocol-io/package-types.mdx @@ -85,7 +85,7 @@ This MCP server executes SQL queries and manages database connections. ## NuGet Packages -For NuGet packages, the MCP Registry currently supports the official NuGet registry (`https://api.nuget.org`) only. +For NuGet packages, the MCP Registry currently supports the official NuGet registry (`https://api.nuget.org/v3/index.json`) only. NuGet packages use `"registryType": "nuget"` in `server.json`. For example: diff --git a/docs/reference/api/openapi.yaml b/docs/reference/api/openapi.yaml index 59d941a..c85dc42 100644 --- a/docs/reference/api/openapi.yaml +++ b/docs/reference/api/openapi.yaml @@ -414,7 +414,7 @@ components: - "https://registry.npmjs.org" - "https://pypi.org" - "https://docker.io" - - "https://api.nuget.org" + - "https://api.nuget.org/v3/index.json" - "https://github.com" - "https://gitlab.com" identifier: diff --git a/docs/reference/server-json/generic-server-json.md b/docs/reference/server-json/generic-server-json.md index 302a444..f037d2d 100644 --- a/docs/reference/server-json/generic-server-json.md +++ b/docs/reference/server-json/generic-server-json.md @@ -131,7 +131,7 @@ Suppose your MCP server application requires a `mcp start` CLI arguments to star "packages": [ { "registryType": "nuget", - "registryBaseUrl": "https://api.nuget.org", + "registryBaseUrl": "https://api.nuget.org/v3/index.json", "identifier": "Knapcode.SampleMcpServer", "version": "0.4.0-beta", "transport": { @@ -370,7 +370,7 @@ The `dnx` tool ships with the .NET 10 SDK, starting with Preview 6. "packages": [ { "registryType": "nuget", - "registryBaseUrl": "https://api.nuget.org", + "registryBaseUrl": "https://api.nuget.org/v3/index.json", "identifier": "Knapcode.SampleMcpServer", "version": "0.5.0", "runtimeHint": "dnx", diff --git a/docs/reference/server-json/official-registry-requirements.md b/docs/reference/server-json/official-registry-requirements.md index ef3da63..494458f 100644 --- a/docs/reference/server-json/official-registry-requirements.md +++ b/docs/reference/server-json/official-registry-requirements.md @@ -32,7 +32,7 @@ Only trusted public registries are supported. Private registries and alternative **Supported registries:** - **NPM**: `https://registry.npmjs.org` only - **PyPI**: `https://pypi.org` only -- **NuGet**: `https://api.nuget.org` only +- **NuGet**: `https://api.nuget.org/v3/index.json` only - **Docker/OCI**: - Docker Hub (`docker.io`) - GitHub Container Registry (`ghcr.io`) diff --git a/docs/reference/server-json/server.schema.json b/docs/reference/server-json/server.schema.json index 2d55b58..221eb05 100644 --- a/docs/reference/server-json/server.schema.json +++ b/docs/reference/server-json/server.schema.json @@ -226,7 +226,7 @@ "https://registry.npmjs.org", "https://pypi.org", "https://docker.io", - "https://api.nuget.org", + "https://api.nuget.org/v3/index.json", "https://github.com", "https://gitlab.com" ], diff --git a/internal/database/migrations/012_fix_nuget_registry_base_url.sql b/internal/database/migrations/012_fix_nuget_registry_base_url.sql new file mode 100644 index 0000000..7527a1a --- /dev/null +++ b/internal/database/migrations/012_fix_nuget_registry_base_url.sql @@ -0,0 +1,58 @@ +-- Migration: Set NuGet package registryBaseUrl for specific server entries +-- +-- This migration updates the packages[].registryBaseUrl to +-- "https://api.nuget.org/v3/index.json" for NuGet packages on a small, +-- explicitly listed set of server entries. Only packages with +-- registryType == "nuget" are modified; other package types are left +-- unchanged. +-- +-- Entries to update (name, version): +-- com.joelverhagen.mcp/Knapcode.SampleMcpServer 0.7.0-beta, 0.10.0-beta.10 +-- io.github.joelverhagen/Knapcode.SampleMcpServer 0.7.0-beta +-- io.github.moonolgerd/game-mcp 1.0.0 +-- io.github.timheuer/sampledotnetmcpserver 0.1.56-beta-g9538a23d37, 0.1.57-beta + +BEGIN; + +WITH affected_entries AS ( + SELECT server_name, version FROM (VALUES + ('com.joelverhagen.mcp/Knapcode.SampleMcpServer', '0.7.0-beta'), + ('com.joelverhagen.mcp/Knapcode.SampleMcpServer', '0.10.0-beta.10'), + ('io.github.joelverhagen/Knapcode.SampleMcpServer', '0.7.0-beta'), + ('io.github.moonolgerd/game-mcp', '1.0.0'), + ('io.github.timheuer/sampledotnetmcpserver', '0.1.56-beta-g9538a23d37'), + ('io.github.timheuer/sampledotnetmcpserver', '0.1.57-beta') + ) AS t(server_name, version) +) +UPDATE servers s +SET value = jsonb_set( + s.value, + '{packages}', + ( + SELECT jsonb_agg( + CASE + WHEN p->>'registryType' = 'nuget' THEN + jsonb_set( + p, + '{registryBaseUrl}', + '"https://api.nuget.org/v3/index.json"'::jsonb, + true + ) + ELSE p + END + ) + FROM jsonb_array_elements(s.value#>'{packages}') AS p + ), + true +) +FROM affected_entries ae +WHERE s.server_name = ae.server_name + AND s.version = ae.version + AND s.value#>'{packages}' IS NOT NULL + AND EXISTS ( + SELECT 1 + FROM jsonb_array_elements(s.value#>'{packages}') AS p + WHERE p->>'registryType' = 'nuget' AND p->>'registryBaseUrl' IS NOT NULL + ); + +COMMIT; diff --git a/internal/validators/registries/nuget.go b/internal/validators/registries/nuget.go index 9e2f836..c3b95a0 100644 --- a/internal/validators/registries/nuget.go +++ b/internal/validators/registries/nuget.go @@ -2,11 +2,13 @@ package registries import ( "context" + "encoding/json" "errors" "fmt" "io" "net/http" "strings" + "sync" "time" "github.com/modelcontextprotocol/registry/pkg/model" @@ -17,9 +19,109 @@ var ( ErrMissingVersionForNuget = errors.New("package version is required for NuGet packages") ) +const userAgent = "MCP-Registry-Validator/1.0" + +type cachedServiceIndex struct { + index *serviceIndex + expiresAt time.Time +} + +var ( + serviceIndexCache = make(map[string]*cachedServiceIndex) + cacheMu sync.RWMutex + cacheDuration = 1 * time.Hour +) + +type serviceIndexResource struct { + ID string `json:"@id"` + Type string `json:"@type"` +} + +type serviceIndex struct { + Resources []serviceIndexResource `json:"resources"` +} + +type packageContentIndex struct { + Versions []string `json:"versions"` +} + +type ReadmeState int + +const ( + ValidReadme ReadmeState = iota + InvalidReadme + NoReadme +) + +type PackageExistenceState int + +const ( + PackageAndVersionExist PackageExistenceState = iota + PackageExistsVersionMissing + PackageIDNotFound +) + // ValidateNuGet validates that a NuGet package contains the correct MCP server name func ValidateNuGet(ctx context.Context, pkg model.Package, serverName string) error { - // Set default registry base URL if empty + err := validateAndNormalizeBaseURL(&pkg) + if err != nil { + return err + } + + if pkg.Version == "" { + return ErrMissingVersionForNuget + } + + client := &http.Client{Timeout: 10 * time.Second} + + // Fetch the service serviceIndex + serviceIndex, err := fetchAndCacheServiceIndex(ctx, client, pkg.RegistryBaseURL) + if err != nil { + return err + } + + lowerID := strings.ToLower(pkg.Identifier) + lowerVersion := strings.ToLower(pkg.Version) + + // remove any SemVer 2.0.0 build metadata suffix (e.g., +abc) + if i := strings.Index(lowerVersion, "+"); i >= 0 { + lowerVersion = lowerVersion[:i] + } + + status, err := validateReadme(ctx, serverName, lowerID, lowerVersion, client, serviceIndex) + if err != nil { + return err + } + + switch status { + case ValidReadme: + return nil + case InvalidReadme: + return fmt.Errorf("NuGet package '%s' ownership validation for version %s failed. The server name '%s' must appear as 'mcp-name: %s' in the package README. Add it to your README and publish a new package version", pkg.Identifier, pkg.Version, serverName, serverName) + case NoReadme: + // Continue to check if package exists + default: + return fmt.Errorf("unexpected readme state: %d", status) + } + + existenceState, err := validatePackageExists(ctx, lowerID, lowerVersion, client, serviceIndex) + if err != nil { + return err + } + + switch existenceState { + case PackageIDNotFound: + return fmt.Errorf("NuGet package '%s' does not exist in the registry. If you recently published the package for the first time, wait for validation to complete", pkg.Identifier) + case PackageExistsVersionMissing: + return fmt.Errorf("NuGet package '%s' exists but version %s does not exist in the registry. If you recently published the version, wait for validation to complete", pkg.Identifier, pkg.Version) + case PackageAndVersionExist: + return fmt.Errorf("NuGet package '%s' ownership validation for version %s failed because it does not have an embedded README. Add one to your package and publish a new version", pkg.Identifier, pkg.Version) + default: + return fmt.Errorf("unexpected package existence state: %d", existenceState) + } +} + +func validateAndNormalizeBaseURL(pkg *model.Package) error { if pkg.RegistryBaseURL == "" { pkg.RegistryBaseURL = model.RegistryURLNuGet } @@ -39,26 +141,87 @@ func ValidateNuGet(ctx context.Context, pkg model.Package, serverName string) er pkg.RegistryBaseURL, model.RegistryTypeNuGet, model.RegistryURLNuGet) } - client := &http.Client{Timeout: 10 * time.Second} + return nil +} - lowerID := strings.ToLower(pkg.Identifier) - lowerVersion := strings.ToLower(pkg.Version) - if lowerVersion == "" { - return ErrMissingVersionForNuget +func fetchAndCacheServiceIndex(ctx context.Context, client *http.Client, baseURL string) (*serviceIndex, error) { + cacheMu.RLock() + if cached, exists := serviceIndexCache[baseURL]; exists { + if time.Now().Before(cached.expiresAt) { + cacheMu.RUnlock() + return cached.index, nil + } + } + cacheMu.RUnlock() + + cacheMu.Lock() + defer cacheMu.Unlock() + + if cached, exists := serviceIndexCache[baseURL]; exists { + if time.Now().Before(cached.expiresAt) { + return cached.index, nil + } } - // Try to get README from the package - readmeURL := fmt.Sprintf("%s/v3-flatcontainer/%s/%s/readme", pkg.RegistryBaseURL, lowerID, lowerVersion) - req, err := http.NewRequestWithContext(ctx, http.MethodGet, readmeURL, nil) + req, err := http.NewRequestWithContext(ctx, http.MethodGet, baseURL, nil) if err != nil { - return fmt.Errorf("failed to create request: %w", err) + return nil, fmt.Errorf("failed to create NuGet service index request: %w", err) } - req.Header.Set("User-Agent", "MCP-Registry-Validator/1.0") + req.Header.Set("User-Agent", userAgent) resp, err := client.Do(req) if err != nil { - return fmt.Errorf("failed to fetch README from NuGet: %w", err) + return nil, fmt.Errorf("failed to fetch NuGet service index: %w", err) + } + defer resp.Body.Close() + + if resp.StatusCode != http.StatusOK { + return nil, fmt.Errorf("NuGet service index returned status %d", resp.StatusCode) + } + + var index serviceIndex + if err := json.NewDecoder(resp.Body).Decode(&index); err != nil { + return nil, fmt.Errorf("failed to parse NuGet service index: %w", err) + } + + serviceIndexCache[baseURL] = &cachedServiceIndex{ + index: &index, + expiresAt: time.Now().Add(cacheDuration), + } + + return &index, nil +} + +func getReadmeURLTemplate(index *serviceIndex) (string, error) { + for _, resource := range index.Resources { + if resource.Type == "ReadmeUriTemplate/6.13.0" { + return resource.ID, nil + } + } + + return "", fmt.Errorf("ReadmeUriTemplate/6.13.0 not found in service index") +} + +func validateReadme(ctx context.Context, serverName, lowerID, lowerVersion string, client *http.Client, index *serviceIndex) (ReadmeState, error) { + readmeURLTemplate, err := getReadmeURLTemplate(index) + if err != nil { + return NoReadme, fmt.Errorf("failed to get README URL template: %w", err) + } + + // Replace placeholders in the template + readmeURL := strings.ReplaceAll(readmeURLTemplate, "{lower_id}", lowerID) + readmeURL = strings.ReplaceAll(readmeURL, "{lower_version}", lowerVersion) + req, err := http.NewRequestWithContext(ctx, http.MethodGet, readmeURL, nil) + if err != nil { + return NoReadme, fmt.Errorf("failed to create NuGet README request: %w", err) + } + + req.Header.Set("User-Agent", userAgent) + + resp, err := client.Do(req) + if err != nil { + return NoReadme, fmt.Errorf("failed to fetch NuGet README: %w", err) } defer resp.Body.Close() @@ -66,7 +229,7 @@ func ValidateNuGet(ctx context.Context, pkg model.Package, serverName string) er // Check README content readmeBytes, err := io.ReadAll(resp.Body) if err != nil { - return fmt.Errorf("failed to read README content: %w", err) + return NoReadme, fmt.Errorf("failed to read NuGet README content: %w", err) } readmeContent := string(readmeBytes) @@ -74,9 +237,70 @@ func ValidateNuGet(ctx context.Context, pkg model.Package, serverName string) er // Check for mcp-name: format (more specific) mcpNamePattern := "mcp-name: " + serverName if strings.Contains(readmeContent, mcpNamePattern) { - return nil // Found as mcp-name: format + return ValidReadme, nil // Found as mcp-name: format + } + + return InvalidReadme, nil + } + + if resp.StatusCode == http.StatusNotFound { + return NoReadme, nil + } + + return InvalidReadme, fmt.Errorf("NuGet README request returned status %d", resp.StatusCode) +} + +func getPackageContentBaseURL(index *serviceIndex) (string, error) { + for _, resource := range index.Resources { + if resource.Type == "PackageBaseAddress/3.0.0" { + return resource.ID, nil } } - return fmt.Errorf("NuGet package '%s' ownership validation failed. The server name '%s' must appear as 'mcp-name: %s' in the package README. Add it to your package README", pkg.Identifier, serverName, serverName) + return "", fmt.Errorf("PackageBaseAddress/3.0.0 not found in service index") +} + +func validatePackageExists(ctx context.Context, lowerID, lowerVersion string, client *http.Client, index *serviceIndex) (PackageExistenceState, error) { + packageBaseURL, err := getPackageContentBaseURL(index) + if err != nil { + return PackageIDNotFound, fmt.Errorf("failed to get Package Base URL: %w", err) + } + + // Fetch the package content index to check if package ID and version exist + indexURL := fmt.Sprintf("%s/%s/index.json", strings.TrimRight(packageBaseURL, "/"), lowerID) + + req, err := http.NewRequestWithContext(ctx, http.MethodGet, indexURL, nil) + if err != nil { + return PackageIDNotFound, fmt.Errorf("failed to create NuGet package index request: %w", err) + } + + req.Header.Set("User-Agent", userAgent) + + resp, err := client.Do(req) + if err != nil { + return PackageIDNotFound, fmt.Errorf("failed to fetch NuGet package index: %w", err) + } + defer resp.Body.Close() + + if resp.StatusCode == http.StatusNotFound { + return PackageIDNotFound, nil // Package ID does not exist + } + + if resp.StatusCode != http.StatusOK { + return PackageIDNotFound, fmt.Errorf("NuGet package index returned status %d", resp.StatusCode) + } + + var contentIndex packageContentIndex + if err := json.NewDecoder(resp.Body).Decode(&contentIndex); err != nil { + return PackageIDNotFound, fmt.Errorf("failed to parse NuGet package index: %w", err) + } + + // Check if the version exists in the versions list + for _, v := range contentIndex.Versions { + if strings.EqualFold(v, lowerVersion) { + return PackageAndVersionExist, nil + } + } + + return PackageExistsVersionMissing, nil } diff --git a/internal/validators/registries/nuget_test.go b/internal/validators/registries/nuget_test.go index 79955c5..32f14b1 100644 --- a/internal/validators/registries/nuget_test.go +++ b/internal/validators/registries/nuget_test.go @@ -46,11 +46,11 @@ func TestValidateNuGet_RealPackages(t *testing.T) { }, { name: "non-existent package should fail", - packageName: generateRandomNuGetPackageName(), + packageName: "will--never--exist", version: "1.0.0", serverName: "com.example/test", expectError: true, - errorMessage: "ownership validation failed", + errorMessage: "NuGet package 'will--never--exist' does not exist in the registry", }, { name: "real package without version should fail", @@ -66,7 +66,15 @@ func TestValidateNuGet_RealPackages(t *testing.T) { version: "999.999.999", // Version that doesn't exist serverName: "com.example/test", expectError: true, - errorMessage: "ownership validation failed", + errorMessage: "exists but version 999.999.999 does not exist in the registry", + }, + { + name: "real package with non-existent version should fail", + packageName: "Newtonsoft.Json", + version: "6.0.1", // README doesn't exist + serverName: "com.example/test", + expectError: true, + errorMessage: "because it does not have an embedded README", }, { name: "real package without server name in README should fail", @@ -74,7 +82,7 @@ func TestValidateNuGet_RealPackages(t *testing.T) { version: "13.0.3", // Popular version serverName: "com.example/test", expectError: true, - errorMessage: "ownership validation failed", + errorMessage: "The server name 'com.example/test' must appear as 'mcp-name: com.example/test' in the package README.", }, { name: "real package without server name in README should fail", @@ -82,7 +90,7 @@ func TestValidateNuGet_RealPackages(t *testing.T) { version: "1.0.0", serverName: "io.github.domdomegg/time-mcp-server", expectError: true, - errorMessage: "ownership validation failed", + errorMessage: "ownership validation for version", }, { name: "real package with server name in README should pass", diff --git a/internal/validators/registries/testutils_test.go b/internal/validators/registries/testutils_test.go index e5206b8..d652c7c 100644 --- a/internal/validators/registries/testutils_test.go +++ b/internal/validators/registries/testutils_test.go @@ -14,11 +14,3 @@ func generateRandomPackageName() string { } return fmt.Sprintf("nonexistent-pkg-%s", hex.EncodeToString(bytes)) } - -func generateRandomNuGetPackageName() string { - bytes := make([]byte, 16) - if _, err := rand.Read(bytes); err != nil { - return "NonExistent.Package.Fallback" - } - return fmt.Sprintf("NonExistent.Package.%s", hex.EncodeToString(bytes)[:16]) -} diff --git a/pkg/model/constants.go b/pkg/model/constants.go index 433319e..1473c92 100644 --- a/pkg/model/constants.go +++ b/pkg/model/constants.go @@ -13,7 +13,7 @@ const ( const ( RegistryURLNPM = "https://registry.npmjs.org" RegistryURLPyPI = "https://pypi.org" - RegistryURLNuGet = "https://api.nuget.org" + RegistryURLNuGet = "https://api.nuget.org/v3/index.json" RegistryURLGitHub = "https://github.com" RegistryURLGitLab = "https://gitlab.com" ) From b63a5d7f3f2ad723e038cced9ea86b4124cf01b3 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 9 Dec 2025 11:53:58 -0800 Subject: [PATCH 046/313] build(deps): bump golang.org/x/mod from 0.30.0 to 0.31.0 (#831) Bumps [golang.org/x/mod](https://github.com/golang/mod) from 0.30.0 to 0.31.0.
Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=golang.org/x/mod&package-manager=go_modules&previous-version=0.30.0&new-version=0.31.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 5fc58a0..53f5130 100644 --- a/go.mod +++ b/go.mod @@ -22,7 +22,7 @@ require ( go.opentelemetry.io/otel/metric v1.38.0 go.opentelemetry.io/otel/sdk v1.38.0 go.opentelemetry.io/otel/sdk/metric v1.38.0 - golang.org/x/mod v0.30.0 + golang.org/x/mod v0.31.0 gopkg.in/yaml.v3 v3.0.1 ) diff --git a/go.sum b/go.sum index 0e95183..542ee79 100644 --- a/go.sum +++ b/go.sum @@ -159,8 +159,8 @@ go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI= go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU= golang.org/x/crypto v0.45.0 h1:jMBrvKuj23MTlT0bQEOBcAE0mjg8mK9RXFhRH6nyF3Q= golang.org/x/crypto v0.45.0/go.mod h1:XTGrrkGJve7CYK7J8PEww4aY7gM3qMCElcJQ8n8JdX4= -golang.org/x/mod v0.30.0 h1:fDEXFVZ/fmCKProc/yAXXUijritrDzahmwwefnjoPFk= -golang.org/x/mod v0.30.0/go.mod h1:lAsf5O2EvJeSFMiBxXDki7sCgAxEUcZHXoXMKT4GJKc= +golang.org/x/mod v0.31.0 h1:HaW9xtz0+kOcWKwli0ZXy79Ix+UW/vOfmWI5QVd2tgI= +golang.org/x/mod v0.31.0/go.mod h1:43JraMp9cGx1Rx3AqioxrbrhNsLl2l/iNAvuBkrezpg= golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY= golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU= golang.org/x/oauth2 v0.33.0 h1:4Q+qn+E5z8gPRJfmRy7C2gGG3T4jIprK6aSYgTXGRpo= From d840378a3a495bc55b70f6c7146686e854249538 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 9 Dec 2025 11:54:52 -0800 Subject: [PATCH 047/313] build(deps): bump go.opentelemetry.io/otel from 1.38.0 to 1.39.0 (#829) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit [//]: # (dependabot-start) ⚠️ **Dependabot is rebasing this PR** ⚠️ Rebasing might not happen immediately, so don't worry if this takes some time. Note: if you make any changes to this PR yourself, they will take precedence over the rebase. --- [//]: # (dependabot-end) Bumps [go.opentelemetry.io/otel](https://github.com/open-telemetry/opentelemetry-go) from 1.38.0 to 1.39.0.
Release notes

Sourced from go.opentelemetry.io/otel's releases.

v1.39.0

Overview

Added

  • Greatly reduce the cost of recording metrics in go.opentelemetry.io/otel/sdk/metric using hashing for map keys. (#7175)
  • Add WithInstrumentationAttributeSet option to go.opentelemetry.io/otel/log, go.opentelemetry.io/otel/metric, and go.opentelemetry.io/otel/trace packages. This provides a concurrent-safe and performant alternative to WithInstrumentationAttributes by accepting a pre-constructed attribute.Set. (#7287)
  • Add experimental observability for the Prometheus exporter in go.opentelemetry.io/otel/exporters/prometheus. Check the go.opentelemetry.io/otel/exporters/prometheus/internal/x package documentation for more information. (#7345)
  • Add experimental observability metrics in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc. (#7353)
  • Add temporality selector functions DeltaTemporalitySelector, CumulativeTemporalitySelector, LowMemoryTemporalitySelector to go.opentelemetry.io/otel/sdk/metric. (#7434)
  • Add experimental observability metrics for simple log processor in go.opentelemetry.io/otel/sdk/log. (#7548)
  • Add experimental observability metrics in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc. (#7459)
  • Add experimental observability metrics in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#7486)
  • Add experimental observability metrics for simple span processor in go.opentelemetry.io/otel/sdk/trace. (#7374)
  • Add experimental observability metrics in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#7512)
  • Add experimental observability metrics for manual reader in go.opentelemetry.io/otel/sdk/metric. (#7524)
  • Add experimental observability metrics for periodic reader in go.opentelemetry.io/otel/sdk/metric. (#7571)
  • Support OTEL_EXPORTER_OTLP_LOGS_INSECURE and OTEL_EXPORTER_OTLP_INSECURE environmental variables in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#7608)
  • Add Enabled method to the Processor interface in go.opentelemetry.io/otel/sdk/log. All Processor implementations now include an Enabled method. (#7639)
  • The go.opentelemetry.io/otel/semconv/v1.38.0 package. The package contains semantic conventions from the v1.38.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.37.0.(#7648)

Changed

  • Distinct in go.opentelemetry.io/otel/attribute is no longer guaranteed to uniquely identify an attribute set. Collisions between Distinct values for different Sets are possible with extremely high cardinality (billions of series per instrument), but are highly unlikely. (#7175)
  • WithInstrumentationAttributes in go.opentelemetry.io/otel/trace synchronously de-duplicates the passed attributes instead of delegating it to the returned TracerOption. (#7266)
  • WithInstrumentationAttributes in go.opentelemetry.io/otel/meter synchronously de-duplicates the passed attributes instead of delegating it to the returned MeterOption. (#7266)
  • WithInstrumentationAttributes in go.opentelemetry.io/otel/log synchronously de-duplicates the passed attributes instead of delegating it to the returned LoggerOption. (#7266)
  • Rename the OTEL_GO_X_SELF_OBSERVABILITY environment variable to OTEL_GO_X_OBSERVABILITY in go.opentelemetry.io/otel/sdk/trace, go.opentelemetry.io/otel/sdk/log, and go.opentelemetry.io/otel/exporters/stdout/stdouttrace. (#7302)
  • Improve performance of histogram Record in go.opentelemetry.io/otel/sdk/metric when min and max are disabled using NoMinMax. (#7306)
  • Improve error handling for dropped data during translation by using prometheus.NewInvalidMetric in go.opentelemetry.io/otel/exporters/prometheus. ⚠️ Breaking Change: Previously, these cases were only logged and scrapes succeeded. Now, when translation would drop data (e.g., invalid label/value), the exporter emits a NewInvalidMetric, and Prometheus scrapes fail with HTTP 500 by default. To preserve the prior behavior (scrapes succeed while errors are logged), configure your Prometheus HTTP handler with: promhttp.HandlerOpts{ ErrorHandling: promhttp.ContinueOnError }. (#7363)
  • Replace fnv hash with xxhash in go.opentelemetry.io/otel/attribute for better performance. (#7371)
  • The default TranslationStrategy in go.opentelemetry.io/exporters/prometheus is changed from otlptranslator.NoUTF8EscapingWithSuffixes to otlptranslator.UnderscoreEscapingWithSuffixes. (#7421)
  • Improve performance of concurrent measurements in go.opentelemetry.io/otel/sdk/metric. (#7427)
  • Include W3C TraceFlags (bits 0–7) in the OTLP Span.Flags field in go.opentelemetry.io/exporters/otlp/otlptrace/otlptracehttp and go.opentelemetry.io/exporters/otlp/otlptrace/otlptracegrpc. (#7438)
  • The ErrorType function in go.opentelemetry.io/otel/semconv/v1.37.0 now handles custom error types. If an error implements an ErrorType() string method, the return value of that method will be used as the error type. (#7442)

Fixed

  • Fix WithInstrumentationAttributes options in go.opentelemetry.io/otel/trace, go.opentelemetry.io/otel/metric, and go.opentelemetry.io/otel/log to properly merge attributes when passed multiple times instead of replacing them. Attributes with duplicate keys will use the last value passed. (#7300)
  • The equality of attribute.Set when using the Equal method is not affected by the user overriding the empty set pointed to by attribute.EmptySet in go.opentelemetry.io/otel/attribute. (#7357)
  • Return partial OTLP export errors to the caller in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc. (#7372)
  • Return partial OTLP export errors to the caller in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#7372)
  • Return partial OTLP export errors to the caller in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc. (#7372)
  • Return partial OTLP export errors to the caller in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp. (#7372)
  • Return partial OTLP export errors to the caller in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc. (#7372)
  • Return partial OTLP export errors to the caller in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#7372)
  • Fix AddAttributes, SetAttributes, SetBody on Record in go.opentelemetry.io/otel/sdk/log to not mutate input. (#7403)
  • Do not double record measurements of RecordSet methods in go.opentelemetry.io/otel/semconv/v1.37.0. (#7655)
  • Do not double record measurements of RecordSet methods in go.opentelemetry.io/otel/semconv/v1.36.0. (#7656)

... (truncated)

Changelog

Sourced from go.opentelemetry.io/otel's changelog.

[1.39.0/0.61.0/0.15.0/0.0.14] 2025-12-05

Added

  • Greatly reduce the cost of recording metrics in go.opentelemetry.io/otel/sdk/metric using hashing for map keys. (#7175)
  • Add WithInstrumentationAttributeSet option to go.opentelemetry.io/otel/log, go.opentelemetry.io/otel/metric, and go.opentelemetry.io/otel/trace packages. This provides a concurrent-safe and performant alternative to WithInstrumentationAttributes by accepting a pre-constructed attribute.Set. (#7287)
  • Add experimental observability for the Prometheus exporter in go.opentelemetry.io/otel/exporters/prometheus. Check the go.opentelemetry.io/otel/exporters/prometheus/internal/x package documentation for more information. (#7345)
  • Add experimental observability metrics in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc. (#7353)
  • Add temporality selector functions DeltaTemporalitySelector, CumulativeTemporalitySelector, LowMemoryTemporalitySelector to go.opentelemetry.io/otel/sdk/metric. (#7434)
  • Add experimental observability metrics for simple log processor in go.opentelemetry.io/otel/sdk/log. (#7548)
  • Add experimental observability metrics in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc. (#7459)
  • Add experimental observability metrics in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#7486)
  • Add experimental observability metrics for simple span processor in go.opentelemetry.io/otel/sdk/trace. (#7374)
  • Add experimental observability metrics in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#7512)
  • Add experimental observability metrics for manual reader in go.opentelemetry.io/otel/sdk/metric. (#7524)
  • Add experimental observability metrics for periodic reader in go.opentelemetry.io/otel/sdk/metric. (#7571)
  • Support OTEL_EXPORTER_OTLP_LOGS_INSECURE and OTEL_EXPORTER_OTLP_INSECURE environmental variables in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#7608)
  • Add Enabled method to the Processor interface in go.opentelemetry.io/otel/sdk/log. All Processor implementations now include an Enabled method. (#7639)
  • The go.opentelemetry.io/otel/semconv/v1.38.0 package. The package contains semantic conventions from the v1.38.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.37.0.(#7648)

Changed

  • Distinct in go.opentelemetry.io/otel/attribute is no longer guaranteed to uniquely identify an attribute set. Collisions between Distinct values for different Sets are possible with extremely high cardinality (billions of series per instrument), but are highly unlikely. (#7175)
  • WithInstrumentationAttributes in go.opentelemetry.io/otel/trace synchronously de-duplicates the passed attributes instead of delegating it to the returned TracerOption. (#7266)
  • WithInstrumentationAttributes in go.opentelemetry.io/otel/meter synchronously de-duplicates the passed attributes instead of delegating it to the returned MeterOption. (#7266)
  • WithInstrumentationAttributes in go.opentelemetry.io/otel/log synchronously de-duplicates the passed attributes instead of delegating it to the returned LoggerOption. (#7266)
  • Rename the OTEL_GO_X_SELF_OBSERVABILITY environment variable to OTEL_GO_X_OBSERVABILITY in go.opentelemetry.io/otel/sdk/trace, go.opentelemetry.io/otel/sdk/log, and go.opentelemetry.io/otel/exporters/stdout/stdouttrace. (#7302)
  • Improve performance of histogram Record in go.opentelemetry.io/otel/sdk/metric when min and max are disabled using NoMinMax. (#7306)
  • Improve error handling for dropped data during translation by using prometheus.NewInvalidMetric in go.opentelemetry.io/otel/exporters/prometheus. ⚠️ Breaking Change: Previously, these cases were only logged and scrapes succeeded. Now, when translation would drop data (e.g., invalid label/value), the exporter emits a NewInvalidMetric, and Prometheus scrapes fail with HTTP 500 by default. To preserve the prior behavior (scrapes succeed while errors are logged), configure your Prometheus HTTP handler with: promhttp.HandlerOpts{ ErrorHandling: promhttp.ContinueOnError }. (#7363)
  • Replace fnv hash with xxhash in go.opentelemetry.io/otel/attribute for better performance. (#7371)
  • The default TranslationStrategy in go.opentelemetry.io/exporters/prometheus is changed from otlptranslator.NoUTF8EscapingWithSuffixes to otlptranslator.UnderscoreEscapingWithSuffixes. (#7421)
  • Improve performance of concurrent measurements in go.opentelemetry.io/otel/sdk/metric. (#7427)
  • Include W3C TraceFlags (bits 0–7) in the OTLP Span.Flags field in go.opentelemetry.io/exporters/otlp/otlptrace/otlptracehttp and go.opentelemetry.io/exporters/otlp/otlptrace/otlptracegrpc. (#7438)
  • The ErrorType function in go.opentelemetry.io/otel/semconv/v1.37.0 now handles custom error types. If an error implements an ErrorType() string method, the return value of that method will be used as the error type. (#7442)

Fixed

  • Fix WithInstrumentationAttributes options in go.opentelemetry.io/otel/trace, go.opentelemetry.io/otel/metric, and go.opentelemetry.io/otel/log to properly merge attributes when passed multiple times instead of replacing them. Attributes with duplicate keys will use the last value passed. (#7300)
  • The equality of attribute.Set when using the Equal method is not affected by the user overriding the empty set pointed to by attribute.EmptySet in go.opentelemetry.io/otel/attribute. (#7357)

... (truncated)

Commits
  • 6ce1429 Release v1.39.0 (#7676)
  • 12e421a sdk/log: move Enabled method from FilterProcessor to Processor (#7639)
  • 5982f16 fix(deps): update module golang.org/x/sys to v0.39.0 (#7684)
  • 9288378 chore(deps): update module golang.org/x/sync to v0.19.0 (#7683)
  • ee3dfef chore(deps): update github.com/securego/gosec/v2 digest to 41f28e2 (#7682)
  • 9345d1f fix(deps): update module github.com/golangci/golangci-lint/v2 to v2.7.2 (#7680)
  • d03b033 Check context prior to delaying retry in OTLP exporters (#7678)
  • 61765e7 Fix flaky TestClientInstrumentation (#7677)
  • a54721c chore(deps): update module github.com/go-git/go-billy/v5 to v5.7.0 (#7679)
  • 746d086 chore(deps): update github/codeql-action action to v4.31.7 (#7675)
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=go.opentelemetry.io/otel&package-manager=go_modules&previous-version=1.38.0&new-version=1.39.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 8 ++++---- go.sum | 20 ++++++++++---------- 2 files changed, 14 insertions(+), 14 deletions(-) diff --git a/go.mod b/go.mod index 53f5130..dc89025 100644 --- a/go.mod +++ b/go.mod @@ -17,9 +17,9 @@ require ( github.com/santhosh-tekuri/jsonschema/v5 v5.3.1 github.com/stretchr/testify v1.11.1 go.opentelemetry.io/contrib/instrumentation/runtime v0.63.0 - go.opentelemetry.io/otel v1.38.0 + go.opentelemetry.io/otel v1.39.0 go.opentelemetry.io/otel/exporters/prometheus v0.60.0 - go.opentelemetry.io/otel/metric v1.38.0 + go.opentelemetry.io/otel/metric v1.39.0 go.opentelemetry.io/otel/sdk v1.38.0 go.opentelemetry.io/otel/sdk/metric v1.38.0 golang.org/x/mod v0.31.0 @@ -70,10 +70,10 @@ require ( github.com/prometheus/procfs v0.17.0 // indirect github.com/sirupsen/logrus v1.9.3 // indirect github.com/vbatts/tar-split v0.12.2 // indirect - go.opentelemetry.io/auto/sdk v1.1.0 // indirect + go.opentelemetry.io/auto/sdk v1.2.1 // indirect go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 // indirect go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect - go.opentelemetry.io/otel/trace v1.38.0 // indirect + go.opentelemetry.io/otel/trace v1.39.0 // indirect go.yaml.in/yaml/v2 v2.4.2 // indirect golang.org/x/crypto v0.45.0 // indirect golang.org/x/net v0.47.0 // indirect diff --git a/go.sum b/go.sum index 542ee79..bed6ad1 100644 --- a/go.sum +++ b/go.sum @@ -118,8 +118,8 @@ github.com/prometheus/otlptranslator v0.0.2 h1:+1CdeLVrRQ6Psmhnobldo0kTp96Rj80DR github.com/prometheus/otlptranslator v0.0.2/go.mod h1:P8AwMgdD7XEr6QRUJ2QWLpiAZTgTE2UYgjlu3svompI= github.com/prometheus/procfs v0.17.0 h1:FuLQ+05u4ZI+SS/w9+BWEM2TXiHKsUQ9TADiRH7DuK0= github.com/prometheus/procfs v0.17.0/go.mod h1:oPQLaDAMRbA+u8H5Pbfq+dl3VDAvHxMUOVhe0wYB2zw= -github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII= -github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o= +github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ= +github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc= github.com/rs/cors v1.11.1 h1:eU3gRzXLRK57F5rKMGMZURNdIG4EoAmX8k94r9wXWHA= github.com/rs/cors v1.11.1/go.mod h1:XyqrcTp5zjWr1wsJ8PIRZssZ8b/WMcMf71DJnit4EMU= github.com/santhosh-tekuri/jsonschema/v5 v5.3.1 h1:lZUw3E0/J3roVtGQ+SCrUrg3ON6NgVqpn3+iol9aGu4= @@ -133,26 +133,26 @@ github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= github.com/vbatts/tar-split v0.12.2 h1:w/Y6tjxpeiFMR47yzZPlPj/FcPLpXbTUi/9H7d3CPa4= github.com/vbatts/tar-split v0.12.2/go.mod h1:eF6B6i6ftWQcDqEn3/iGFRFRo8cBIMSJVOpnNdfTMFA= -go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA= -go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A= +go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= +go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y= go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 h1:q4XOmH/0opmeuJtPsbFNivyl7bCt7yRBbeEm2sC/XtQ= go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0/go.mod h1:snMWehoOh2wsEwnvvwtDyFCxVeDAODenXHtn5vzrKjo= go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 h1:F7Jx+6hwnZ41NSFTO5q4LYDtJRXBf2PD0rNBkeB/lus= go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0/go.mod h1:UHB22Z8QsdRDrnAtX4PntOl36ajSxcdUMt1sF7Y6E7Q= go.opentelemetry.io/contrib/instrumentation/runtime v0.63.0 h1:PeBoRj6af6xMI7qCupwFvTbbnd49V7n5YpG6pg8iDYQ= go.opentelemetry.io/contrib/instrumentation/runtime v0.63.0/go.mod h1:ingqBCtMCe8I4vpz/UVzCW6sxoqgZB37nao91mLQ3Bw= -go.opentelemetry.io/otel v1.38.0 h1:RkfdswUDRimDg0m2Az18RKOsnI8UDzppJAtj01/Ymk8= -go.opentelemetry.io/otel v1.38.0/go.mod h1:zcmtmQ1+YmQM9wrNsTGV/q/uyusom3P8RxwExxkZhjM= +go.opentelemetry.io/otel v1.39.0 h1:8yPrr/S0ND9QEfTfdP9V+SiwT4E0G7Y5MO7p85nis48= +go.opentelemetry.io/otel v1.39.0/go.mod h1:kLlFTywNWrFyEdH0oj2xK0bFYZtHRYUdv1NklR/tgc8= go.opentelemetry.io/otel/exporters/prometheus v0.60.0 h1:cGtQxGvZbnrWdC2GyjZi0PDKVSLWP/Jocix3QWfXtbo= go.opentelemetry.io/otel/exporters/prometheus v0.60.0/go.mod h1:hkd1EekxNo69PTV4OWFGZcKQiIqg0RfuWExcPKFvepk= -go.opentelemetry.io/otel/metric v1.38.0 h1:Kl6lzIYGAh5M159u9NgiRkmoMKjvbsKtYRwgfrA6WpA= -go.opentelemetry.io/otel/metric v1.38.0/go.mod h1:kB5n/QoRM8YwmUahxvI3bO34eVtQf2i4utNVLr9gEmI= +go.opentelemetry.io/otel/metric v1.39.0 h1:d1UzonvEZriVfpNKEVmHXbdf909uGTOQjA0HF0Ls5Q0= +go.opentelemetry.io/otel/metric v1.39.0/go.mod h1:jrZSWL33sD7bBxg1xjrqyDjnuzTUB0x1nBERXd7Ftcs= go.opentelemetry.io/otel/sdk v1.38.0 h1:l48sr5YbNf2hpCUj/FoGhW9yDkl+Ma+LrVl8qaM5b+E= go.opentelemetry.io/otel/sdk v1.38.0/go.mod h1:ghmNdGlVemJI3+ZB5iDEuk4bWA3GkTpW+DOoZMYBVVg= go.opentelemetry.io/otel/sdk/metric v1.38.0 h1:aSH66iL0aZqo//xXzQLYozmWrXxyFkBJ6qT5wthqPoM= go.opentelemetry.io/otel/sdk/metric v1.38.0/go.mod h1:dg9PBnW9XdQ1Hd6ZnRz689CbtrUp0wMMs9iPcgT9EZA= -go.opentelemetry.io/otel/trace v1.38.0 h1:Fxk5bKrDZJUH+AMyyIXGcFAPah0oRcT+LuNtJrmcNLE= -go.opentelemetry.io/otel/trace v1.38.0/go.mod h1:j1P9ivuFsTceSWe1oY+EeW3sc+Pp42sO++GHkg4wwhs= +go.opentelemetry.io/otel/trace v1.39.0 h1:2d2vfpEDmCJ5zVYz7ijaJdOF59xLomrvj7bjt6/qCJI= +go.opentelemetry.io/otel/trace v1.39.0/go.mod h1:88w4/PnZSazkGzz/w84VHpQafiU4EtqqlVdxWy+rNOA= go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE= go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI= From dcb5a6f69660fc96b06423510386d17c2e1425dc Mon Sep 17 00:00:00 2001 From: adam jones Date: Wed, 10 Dec 2025 16:22:27 +0000 Subject: [PATCH 048/313] Add 5s timeout to DNS auth lookup to prevent resource exhaustion (#825) The DNS auth endpoint was vulnerable to resource exhaustion if an attacker controlled a domain with a slow/non-responding authoritative DNS server. Without a timeout, handler goroutines would block on DNS resolution indefinitely, allowing an attacker to pile up goroutines until OOM. Production is protected by NGINX ingress's default 60s proxy timeout, but this adds defense-in-depth with a tighter 5s bound. --- internal/api/handlers/v0/auth/dns.go | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/internal/api/handlers/v0/auth/dns.go b/internal/api/handlers/v0/auth/dns.go index 87a812a..5129486 100644 --- a/internal/api/handlers/v0/auth/dns.go +++ b/internal/api/handlers/v0/auth/dns.go @@ -6,6 +6,7 @@ import ( "net" "net/http" "strings" + "time" "github.com/danielgtaylor/huma/v2" v0 "github.com/modelcontextprotocol/registry/internal/api/handlers/v0" @@ -77,11 +78,15 @@ func RegisterDNSEndpoint(api huma.API, pathPrefix string, cfg *config.Config) { // ExchangeToken exchanges DNS signature for a Registry JWT token func (h *DNSAuthHandler) ExchangeToken(ctx context.Context, domain, timestamp, signedTimestamp string) (*auth.TokenResponse, error) { keyFetcher := func(ctx context.Context, domain string) ([]string, error) { + // Apply a timeout to DNS lookup to prevent resource exhaustion from slow/malicious DNS servers + timeoutCtx, cancel := context.WithTimeout(ctx, 5*time.Second) + defer cancel() + // Lookup DNS TXT records // DNS implies a hierarchy where subdomains are treated as part of the parent domain, // therefore we grant permissions for all subdomains (e.g., com.example.*) // This is in line with other DNS-based authentication methods e.g. ACME DNS-01 challenges - txtRecords, err := h.resolver.LookupTXT(ctx, domain) + txtRecords, err := h.resolver.LookupTXT(timeoutCtx, domain) if err != nil { return nil, fmt.Errorf("failed to lookup DNS TXT records: %w", err) } From 1be2f4edbb92ee21d0432405cc249b1c37838cce Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 10 Dec 2025 23:56:56 +0200 Subject: [PATCH 049/313] build(deps): bump go.opentelemetry.io/contrib/instrumentation/runtime from 0.63.0 to 0.64.0 (#835) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [go.opentelemetry.io/contrib/instrumentation/runtime](https://github.com/open-telemetry/opentelemetry-go-contrib) from 0.63.0 to 0.64.0.
Release notes

Sourced from go.opentelemetry.io/contrib/instrumentation/runtime's releases.

Release v1.39.0/v2.1.0/v0.64.0/v0.33.0/v0.19.0/v0.14.0/v0.12.0/v0.11.0

Overview

Added

  • ParseYAML in go.opentelemetry.io/contrib/otelconf now supports environment variables substitution in the format ${[env:]VAR_NAME[:-defaultvalue]}. (#6215)
  • Add the http.route metric attribute to go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux. (#7966)
  • Support db.client.operation.duration metric for go.opentelemetry.io/contrib/instrumentation/go.mongodb.org/mongo-driver/v2/mongo/otelmongo. (#7983)
  • Add a WithSpanNameFormatter option to go.opentelemetry.io/contrib/instrumentation/go.mongodb.org/mongo-driver/v2/mongo/otelmongo. (#7986)
  • WithOnError option for otelecho middleware in go.opentelemetry.io/contrib/instrumentation/github.com/labstack/echo/otelecho to specify the behavior when an error occurs. (#8025)
  • Updated go.opentelemetry.io/contrib/otelconf to include the v1.0.0-rc2 release candidate of schema which includes backwards incompatible changes. (#8026)
  • Introduce v1.0.0-rc.2 model in go.opentelemetry.io/contrib/otelconf. (#8031)
  • Add unmarshaling and validation for CardinalityLimits and SpanLimits to v1.0.0 model in go.opentelemetry.io/contrib/otelconf. (#8043)
  • Add unmarshaling and validation for BatchLogRecordProcessor, BatchSpanProcessor, and PeriodicMetricReader to v1.0.0 model in go.opentelemetry.io/contrib/otelconf. (#8049)
  • Add unmarshaling and validation for TextMapPropagator to v1.0.0 model in go.opentelemetry.io/contrib/otelconf. (#8052)
  • Add jaeger.sampler.type/jaeger.sampler.param attributes for adaptive sampling support and option WithAttributesDisabled in go.opentelemetry.io/contrib/samplers/jaegerremote. (#8073)
  • Add support for OTEL_EXPERIMENTAL_CONFIG_FILE via the NewSDK function in go.opentelemetry.io/contrib/otelconf (#8106)
  • Add unmarshaling and validation for OTLPHttpExporter, OTLPGrpcExporter, OTLPGrpcMetricExporter and OTLPHttpMetricExporter to v1.0.0 model in go.opentelemetry.io/contrib/otelconf. (#8112)
  • Add unmarshaling and validation for AttributeType, AttributeNameValue, SimpleSpanProcessor, SimpleLogRecordProcessor, ZipkinSpanExporter, NameStringValuePair, InstrumentType, ExperimentalPeerInstrumentationServiceMappingElem, ExporterDefaultHistogramAggregation, PullMetricReader to v1.0.0 model in go.opentelemetry.io/contrib/otelconf. (#8127)
  • Add support for container, host, process resource detectors in go.opentelemetry.io/contrib/otelconf. (#8180)

Changed

  • Improve performance by reducing allocations in the gRPC stats handler in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc. (#8035)
  • Export the ReadEvents and WriteEvents constants in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp so they can be used in WithMessageEvents. (#8153)
  • Switched the default for OTEL_SEMCONV_STABILITY_OPT_IN to emit the v1.37.0 semantic conventions by default in go.opentelemetry.io/contrib/instrumentation/go.mongodb.org/mongo-driver/mongo/otelmongo. Use the environment variable OTEL_SEMCONV_STABILITY_OPT_IN to configure duplication with old semantic conventions if needed (i.e. OTEL_SEMCONV_STABILITY_OPT_IN="database/dup"). (#8230)

Deprecated

  • WithRouteTag in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp is deprecated. The route is already added automatically for spans. For metrics, the alternative is to use the WithMetricAttributesFn option. (#8117)
  • WithPublicEndpoint in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp is deprecated. Use WithPublicEndpointFn instead. (#8152)
  • DefaultClient, Get, Head, Post, and PostForm in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp are deprecated. Use a custom *http.Client with otelhttp.NewTransport(http.DefaultTransport) instead. (#8140, #8201)

Removed

  • Drop support for Go 1.23. (#7831)
  • Remove deprecated go.opentelemetry.io/contrib/detectors/aws/ec2 module, please use go.opentelemetry.io/contrib/detectors/aws/ec2/v2 instead. (#7841)
  • Remove the deprecated Extract and Inject functions from go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc. (#7952)

What's Changed

... (truncated)

Changelog

Sourced from go.opentelemetry.io/contrib/instrumentation/runtime's changelog.

[1.39.0/2.1.0/0.64.0/0.33.0/0.19.0/0.14.0/0.12.0/0.11.0] - 2025-12-08

Added

  • ParseYAML in go.opentelemetry.io/contrib/otelconf now supports environment variables substitution in the format ${[env:]VAR_NAME[:-defaultvalue]}. (#6215)
  • Add the http.route metric attribute to go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux. (#7966)
  • Support db.client.operation.duration metric for go.opentelemetry.io/contrib/instrumentation/go.mongodb.org/mongo-driver/v2/mongo/otelmongo. (#7983)
  • Add a WithSpanNameFormatter option to go.opentelemetry.io/contrib/instrumentation/go.mongodb.org/mongo-driver/v2/mongo/otelmongo. (#7986)
  • WithOnError option for otelecho middleware in go.opentelemetry.io/contrib/instrumentation/github.com/labstack/echo/otelecho to specify the behavior when an error occurs. (#8025)
  • Updated go.opentelemetry.io/contrib/otelconf to include the v1.0.0-rc2 release candidate of schema which includes backwards incompatible changes. (#8026)
  • Introduce v1.0.0-rc.2 model in go.opentelemetry.io/contrib/otelconf. (#8031)
  • Add unmarshaling and validation for CardinalityLimits and SpanLimits to v1.0.0 model in go.opentelemetry.io/contrib/otelconf. (#8043)
  • Add unmarshaling and validation for BatchLogRecordProcessor, BatchSpanProcessor, and PeriodicMetricReader to v1.0.0 model in go.opentelemetry.io/contrib/otelconf. (#8049)
  • Add unmarshaling and validation for TextMapPropagator to v1.0.0 model in go.opentelemetry.io/contrib/otelconf. (#8052)
  • Add jaeger.sampler.type/jaeger.sampler.param attributes for adaptive sampling support and option WithAttributesDisabled in go.opentelemetry.io/contrib/samplers/jaegerremote. (#8073)
  • Add support for OTEL_EXPERIMENTAL_CONFIG_FILE via the NewSDK function in go.opentelemetry.io/contrib/otelconf (#8106)
  • Add unmarshaling and validation for OTLPHttpExporter, OTLPGrpcExporter, OTLPGrpcMetricExporter and OTLPHttpMetricExporter to v1.0.0 model in go.opentelemetry.io/contrib/otelconf. (#8112)
  • Add unmarshaling and validation for AttributeType, AttributeNameValue, SimpleSpanProcessor, SimpleLogRecordProcessor, ZipkinSpanExporter, NameStringValuePair, InstrumentType, ExperimentalPeerInstrumentationServiceMappingElem, ExporterDefaultHistogramAggregation, PullMetricReader to v1.0.0 model in go.opentelemetry.io/contrib/otelconf. (#8127)
  • Add support for container, host, process resource detectors in go.opentelemetry.io/contrib/otelconf. (#8180)

Changed

  • Improve performance by reducing allocations in the gRPC stats handler in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc. (#8035)
  • Export the ReadEvents and WriteEvents constants in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp so they can be used in WithMessageEvents. (#8153)
  • Switched the default for OTEL_SEMCONV_STABILITY_OPT_IN to emit the v1.37.0 semantic conventions by default in go.opentelemetry.io/contrib/instrumentation/go.mongodb.org/mongo-driver/mongo/otelmongo. Use the environment variable OTEL_SEMCONV_STABILITY_OPT_IN to configure duplication with old semantic conventions if needed (i.e. OTEL_SEMCONV_STABILITY_OPT_IN="database/dup"). (#8230)

Deprecated

  • WithRouteTag in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp is deprecated. The route is already added automatically for spans. For metrics, the alternative is to use the WithMetricAttributesFn option. (#8117)
  • WithPublicEndpoint in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp is deprecated. Use WithPublicEndpointFn instead. (#8152)
  • DefaultClient, Get, Head, Post, and PostForm in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp are deprecated. Use a custom *http.Client with otelhttp.NewTransport(http.DefaultTransport) instead. (#8140, #8201)

Removed

  • Drop support for [Go 1.23]. (#7831)
  • Remove deprecated go.opentelemetry.io/contrib/detectors/aws/ec2 module, please use go.opentelemetry.io/contrib/detectors/aws/ec2/v2 instead. (#7841)
  • Remove the deprecated Extract and Inject functions from go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc. (#7952)
Commits
  • 9a6a4d7 Release v1.39.0 (#8261)
  • 14c6a7a chore(deps): update module golang.org/x/sys to v0.39.0 (#8260)
  • 829f498 chore(deps): update module golang.org/x/sync to v0.19.0 (#8259)
  • a77cdda chore(deps): update module golang.org/x/oauth2 to v0.34.0 (#8257)
  • a98be56 chore(deps): update module github.com/go-git/go-billy/v5 to v5.7.0 (#8255)
  • 4385fbc chore(deps): update github/codeql-action action to v4.31.7 (#8253)
  • 3c3e7b2 otelconf: add support for parsing resource detectors (#8180)
  • 6497853 otelconf: add support for OTEL_EXPERIMENTAL_CONFIG_FILE (#8106)
  • 3f4d49c Fix flaky canceled context in otelconf/trace test (#8250)
  • 3ce5839 fix(deps): update module github.com/golangci/golangci-lint/v2 to v2.7.1 (#8252)
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=go.opentelemetry.io/contrib/instrumentation/runtime&package-manager=go_modules&previous-version=0.63.0&new-version=0.64.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 8 ++++---- go.sum | 16 ++++++++-------- 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/go.mod b/go.mod index dc89025..e6a7e8b 100644 --- a/go.mod +++ b/go.mod @@ -16,12 +16,12 @@ require ( github.com/rs/cors v1.11.1 github.com/santhosh-tekuri/jsonschema/v5 v5.3.1 github.com/stretchr/testify v1.11.1 - go.opentelemetry.io/contrib/instrumentation/runtime v0.63.0 + go.opentelemetry.io/contrib/instrumentation/runtime v0.64.0 go.opentelemetry.io/otel v1.39.0 go.opentelemetry.io/otel/exporters/prometheus v0.60.0 go.opentelemetry.io/otel/metric v1.39.0 - go.opentelemetry.io/otel/sdk v1.38.0 - go.opentelemetry.io/otel/sdk/metric v1.38.0 + go.opentelemetry.io/otel/sdk v1.39.0 + go.opentelemetry.io/otel/sdk/metric v1.39.0 golang.org/x/mod v0.31.0 gopkg.in/yaml.v3 v3.0.1 ) @@ -79,7 +79,7 @@ require ( golang.org/x/net v0.47.0 // indirect golang.org/x/oauth2 v0.33.0 // indirect golang.org/x/sync v0.18.0 // indirect - golang.org/x/sys v0.38.0 // indirect + golang.org/x/sys v0.39.0 // indirect golang.org/x/text v0.31.0 // indirect golang.org/x/time v0.12.0 // indirect google.golang.org/api v0.247.0 // indirect diff --git a/go.sum b/go.sum index bed6ad1..aba7dfc 100644 --- a/go.sum +++ b/go.sum @@ -139,18 +139,18 @@ go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.6 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0/go.mod h1:snMWehoOh2wsEwnvvwtDyFCxVeDAODenXHtn5vzrKjo= go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 h1:F7Jx+6hwnZ41NSFTO5q4LYDtJRXBf2PD0rNBkeB/lus= go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0/go.mod h1:UHB22Z8QsdRDrnAtX4PntOl36ajSxcdUMt1sF7Y6E7Q= -go.opentelemetry.io/contrib/instrumentation/runtime v0.63.0 h1:PeBoRj6af6xMI7qCupwFvTbbnd49V7n5YpG6pg8iDYQ= -go.opentelemetry.io/contrib/instrumentation/runtime v0.63.0/go.mod h1:ingqBCtMCe8I4vpz/UVzCW6sxoqgZB37nao91mLQ3Bw= +go.opentelemetry.io/contrib/instrumentation/runtime v0.64.0 h1:/+/+UjlXjFcdDlXxKL1PouzX8Z2Vl0OxolRKeBEgYDw= +go.opentelemetry.io/contrib/instrumentation/runtime v0.64.0/go.mod h1:Ldm/PDuzY2DP7IypudopCR3OCOW42NJlN9+mNEroevo= go.opentelemetry.io/otel v1.39.0 h1:8yPrr/S0ND9QEfTfdP9V+SiwT4E0G7Y5MO7p85nis48= go.opentelemetry.io/otel v1.39.0/go.mod h1:kLlFTywNWrFyEdH0oj2xK0bFYZtHRYUdv1NklR/tgc8= go.opentelemetry.io/otel/exporters/prometheus v0.60.0 h1:cGtQxGvZbnrWdC2GyjZi0PDKVSLWP/Jocix3QWfXtbo= go.opentelemetry.io/otel/exporters/prometheus v0.60.0/go.mod h1:hkd1EekxNo69PTV4OWFGZcKQiIqg0RfuWExcPKFvepk= go.opentelemetry.io/otel/metric v1.39.0 h1:d1UzonvEZriVfpNKEVmHXbdf909uGTOQjA0HF0Ls5Q0= go.opentelemetry.io/otel/metric v1.39.0/go.mod h1:jrZSWL33sD7bBxg1xjrqyDjnuzTUB0x1nBERXd7Ftcs= -go.opentelemetry.io/otel/sdk v1.38.0 h1:l48sr5YbNf2hpCUj/FoGhW9yDkl+Ma+LrVl8qaM5b+E= -go.opentelemetry.io/otel/sdk v1.38.0/go.mod h1:ghmNdGlVemJI3+ZB5iDEuk4bWA3GkTpW+DOoZMYBVVg= -go.opentelemetry.io/otel/sdk/metric v1.38.0 h1:aSH66iL0aZqo//xXzQLYozmWrXxyFkBJ6qT5wthqPoM= -go.opentelemetry.io/otel/sdk/metric v1.38.0/go.mod h1:dg9PBnW9XdQ1Hd6ZnRz689CbtrUp0wMMs9iPcgT9EZA= +go.opentelemetry.io/otel/sdk v1.39.0 h1:nMLYcjVsvdui1B/4FRkwjzoRVsMK8uL/cj0OyhKzt18= +go.opentelemetry.io/otel/sdk v1.39.0/go.mod h1:vDojkC4/jsTJsE+kh+LXYQlbL8CgrEcwmt1ENZszdJE= +go.opentelemetry.io/otel/sdk/metric v1.39.0 h1:cXMVVFVgsIf2YL6QkRF4Urbr/aMInf+2WKg+sEJTtB8= +go.opentelemetry.io/otel/sdk/metric v1.39.0/go.mod h1:xq9HEVH7qeX69/JnwEfp6fVq5wosJsY1mt4lLfYdVew= go.opentelemetry.io/otel/trace v1.39.0 h1:2d2vfpEDmCJ5zVYz7ijaJdOF59xLomrvj7bjt6/qCJI= go.opentelemetry.io/otel/trace v1.39.0/go.mod h1:88w4/PnZSazkGzz/w84VHpQafiU4EtqqlVdxWy+rNOA= go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= @@ -169,8 +169,8 @@ golang.org/x/sync v0.18.0 h1:kr88TuHDroi+UVf+0hZnirlk8o8T+4MrK6mr60WkH/I= golang.org/x/sync v0.18.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI= golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.38.0 h1:3yZWxaJjBmCWXqhN1qh02AkOnCQ1poK6oF+a7xWL6Gc= -golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= +golang.org/x/sys v0.39.0 h1:CvCKL8MeisomCi6qNZ+wbb0DN9E5AATixKsvNtMoMFk= +golang.org/x/sys v0.39.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= golang.org/x/text v0.31.0 h1:aC8ghyu4JhP8VojJ2lEHBnochRno1sgL6nEi9WGFGMM= golang.org/x/text v0.31.0/go.mod h1:tKRAlv61yKIjGGHX/4tP1LTbc13YSec1pxVEWXzfoeM= golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE= From b4e76845d53434b5ad2ebb5ba627803d24a4465e Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 10 Dec 2025 23:57:22 +0200 Subject: [PATCH 050/313] build(deps): bump go.opentelemetry.io/otel/exporters/prometheus from 0.60.0 to 0.61.0 (#832) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit [//]: # (dependabot-start) ⚠️ **Dependabot is rebasing this PR** ⚠️ Rebasing might not happen immediately, so don't worry if this takes some time. Note: if you make any changes to this PR yourself, they will take precedence over the rebase. --- [//]: # (dependabot-end) Bumps [go.opentelemetry.io/otel/exporters/prometheus](https://github.com/open-telemetry/opentelemetry-go) from 0.60.0 to 0.61.0.
Release notes

Sourced from go.opentelemetry.io/otel/exporters/prometheus's releases.

Release v1.38.0/v0.60.0/v0.14.0/v0.0.13

Overview

This release is the last to support [Go 1.23]. The next release will require at least [Go 1.24].

Added

  • Add native histogram exemplar support in go.opentelemetry.io/otel/exporters/prometheus. (#6772)
  • Add template attribute functions to the go.opentelmetry.io/otel/semconv/v1.34.0 package. (#6939)
    • ContainerLabel
    • DBOperationParameter
    • DBSystemParameter
    • HTTPRequestHeader
    • HTTPResponseHeader
    • K8SCronJobAnnotation
    • K8SCronJobLabel
    • K8SDaemonSetAnnotation
    • K8SDaemonSetLabel
    • K8SDeploymentAnnotation
    • K8SDeploymentLabel
    • K8SJobAnnotation
    • K8SJobLabel
    • K8SNamespaceAnnotation
    • K8SNamespaceLabel
    • K8SNodeAnnotation
    • K8SNodeLabel
    • K8SPodAnnotation
    • K8SPodLabel
    • K8SReplicaSetAnnotation
    • K8SReplicaSetLabel
    • K8SStatefulSetAnnotation
    • K8SStatefulSetLabel
    • ProcessEnvironmentVariable
    • RPCConnectRPCRequestMetadata
    • RPCConnectRPCResponseMetadata
    • RPCGRPCRequestMetadata
    • RPCGRPCResponseMetadata
  • Add ErrorType attribute helper function to the go.opentelmetry.io/otel/semconv/v1.34.0 package. (#6962)
  • Add WithAllowKeyDuplication in go.opentelemetry.io/otel/sdk/log which can be used to disable deduplication for log records. (#6968)
  • Add WithCardinalityLimit option to configure the cardinality limit in go.opentelemetry.io/otel/sdk/metric. (#6996, #7065, #7081, #7164, #7165, #7179)
  • Add Clone method to Record in go.opentelemetry.io/otel/log that returns a copy of the record with no shared state. (#7001)
  • Add experimental self-observability span and batch span processor metrics in go.opentelemetry.io/otel/sdk/trace. Check the go.opentelemetry.io/otel/sdk/trace/internal/x package documentation for more information. (#7027, #6393, #7209)
  • The go.opentelemetry.io/otel/semconv/v1.36.0 package. The package contains semantic conventions from the v1.36.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.34.0.(#7032, #7041)
  • Add support for configuring Prometheus name translation using WithTranslationStrategy option in go.opentelemetry.io/otel/exporters/prometheus. The current default translation strategy when UTF-8 mode is enabled is NoUTF8EscapingWithSuffixes, but a future release will change the default strategy to UnderscoreEscapingWithSuffixes for compliance with the specification. (#7111)
  • Add experimental self-observability log metrics in go.opentelemetry.io/otel/sdk/log. Check the go.opentelemetry.io/otel/sdk/log/internal/x package documentation for more information. (#7121)
  • Add experimental self-observability trace exporter metrics in go.opentelemetry.io/otel/exporters/stdout/stdouttrace. Check the go.opentelemetry.io/otel/exporters/stdout/stdouttrace/internal/x package documentation for more information. (#7133)
  • Support testing of [Go 1.25]. (#7187)
  • The go.opentelemetry.io/otel/semconv/v1.37.0 package. The package contains semantic conventions from the v1.37.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.36.0.(#7254)

Changed

... (truncated)

Changelog

Sourced from go.opentelemetry.io/otel/exporters/prometheus's changelog.

[1.39.0/0.61.0/0.15.0/0.0.14] 2025-12-05

Added

  • Greatly reduce the cost of recording metrics in go.opentelemetry.io/otel/sdk/metric using hashing for map keys. (#7175)
  • Add WithInstrumentationAttributeSet option to go.opentelemetry.io/otel/log, go.opentelemetry.io/otel/metric, and go.opentelemetry.io/otel/trace packages. This provides a concurrent-safe and performant alternative to WithInstrumentationAttributes by accepting a pre-constructed attribute.Set. (#7287)
  • Add experimental observability for the Prometheus exporter in go.opentelemetry.io/otel/exporters/prometheus. Check the go.opentelemetry.io/otel/exporters/prometheus/internal/x package documentation for more information. (#7345)
  • Add experimental observability metrics in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc. (#7353)
  • Add temporality selector functions DeltaTemporalitySelector, CumulativeTemporalitySelector, LowMemoryTemporalitySelector to go.opentelemetry.io/otel/sdk/metric. (#7434)
  • Add experimental observability metrics for simple log processor in go.opentelemetry.io/otel/sdk/log. (#7548)
  • Add experimental observability metrics in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc. (#7459)
  • Add experimental observability metrics in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#7486)
  • Add experimental observability metrics for simple span processor in go.opentelemetry.io/otel/sdk/trace. (#7374)
  • Add experimental observability metrics in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#7512)
  • Add experimental observability metrics for manual reader in go.opentelemetry.io/otel/sdk/metric. (#7524)
  • Add experimental observability metrics for periodic reader in go.opentelemetry.io/otel/sdk/metric. (#7571)
  • Support OTEL_EXPORTER_OTLP_LOGS_INSECURE and OTEL_EXPORTER_OTLP_INSECURE environmental variables in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#7608)
  • Add Enabled method to the Processor interface in go.opentelemetry.io/otel/sdk/log. All Processor implementations now include an Enabled method. (#7639)
  • The go.opentelemetry.io/otel/semconv/v1.38.0 package. The package contains semantic conventions from the v1.38.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.37.0.(#7648)

Changed

  • Distinct in go.opentelemetry.io/otel/attribute is no longer guaranteed to uniquely identify an attribute set. Collisions between Distinct values for different Sets are possible with extremely high cardinality (billions of series per instrument), but are highly unlikely. (#7175)
  • WithInstrumentationAttributes in go.opentelemetry.io/otel/trace synchronously de-duplicates the passed attributes instead of delegating it to the returned TracerOption. (#7266)
  • WithInstrumentationAttributes in go.opentelemetry.io/otel/meter synchronously de-duplicates the passed attributes instead of delegating it to the returned MeterOption. (#7266)
  • WithInstrumentationAttributes in go.opentelemetry.io/otel/log synchronously de-duplicates the passed attributes instead of delegating it to the returned LoggerOption. (#7266)
  • Rename the OTEL_GO_X_SELF_OBSERVABILITY environment variable to OTEL_GO_X_OBSERVABILITY in go.opentelemetry.io/otel/sdk/trace, go.opentelemetry.io/otel/sdk/log, and go.opentelemetry.io/otel/exporters/stdout/stdouttrace. (#7302)
  • Improve performance of histogram Record in go.opentelemetry.io/otel/sdk/metric when min and max are disabled using NoMinMax. (#7306)
  • Improve error handling for dropped data during translation by using prometheus.NewInvalidMetric in go.opentelemetry.io/otel/exporters/prometheus. ⚠️ Breaking Change: Previously, these cases were only logged and scrapes succeeded. Now, when translation would drop data (e.g., invalid label/value), the exporter emits a NewInvalidMetric, and Prometheus scrapes fail with HTTP 500 by default. To preserve the prior behavior (scrapes succeed while errors are logged), configure your Prometheus HTTP handler with: promhttp.HandlerOpts{ ErrorHandling: promhttp.ContinueOnError }. (#7363)
  • Replace fnv hash with xxhash in go.opentelemetry.io/otel/attribute for better performance. (#7371)
  • The default TranslationStrategy in go.opentelemetry.io/exporters/prometheus is changed from otlptranslator.NoUTF8EscapingWithSuffixes to otlptranslator.UnderscoreEscapingWithSuffixes. (#7421)
  • Improve performance of concurrent measurements in go.opentelemetry.io/otel/sdk/metric. (#7427)
  • Include W3C TraceFlags (bits 0–7) in the OTLP Span.Flags field in go.opentelemetry.io/exporters/otlp/otlptrace/otlptracehttp and go.opentelemetry.io/exporters/otlp/otlptrace/otlptracegrpc. (#7438)
  • The ErrorType function in go.opentelemetry.io/otel/semconv/v1.37.0 now handles custom error types. If an error implements an ErrorType() string method, the return value of that method will be used as the error type. (#7442)

Fixed

  • Fix WithInstrumentationAttributes options in go.opentelemetry.io/otel/trace, go.opentelemetry.io/otel/metric, and go.opentelemetry.io/otel/log to properly merge attributes when passed multiple times instead of replacing them. Attributes with duplicate keys will use the last value passed. (#7300)
  • The equality of attribute.Set when using the Equal method is not affected by the user overriding the empty set pointed to by attribute.EmptySet in go.opentelemetry.io/otel/attribute. (#7357)

... (truncated)

Commits
  • 6ce1429 Release v1.39.0 (#7676)
  • 12e421a sdk/log: move Enabled method from FilterProcessor to Processor (#7639)
  • 5982f16 fix(deps): update module golang.org/x/sys to v0.39.0 (#7684)
  • 9288378 chore(deps): update module golang.org/x/sync to v0.19.0 (#7683)
  • ee3dfef chore(deps): update github.com/securego/gosec/v2 digest to 41f28e2 (#7682)
  • 9345d1f fix(deps): update module github.com/golangci/golangci-lint/v2 to v2.7.2 (#7680)
  • d03b033 Check context prior to delaying retry in OTLP exporters (#7678)
  • 61765e7 Fix flaky TestClientInstrumentation (#7677)
  • a54721c chore(deps): update module github.com/go-git/go-billy/v5 to v5.7.0 (#7679)
  • 746d086 chore(deps): update github/codeql-action action to v4.31.7 (#7675)
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=go.opentelemetry.io/otel/exporters/prometheus&package-manager=go_modules&previous-version=0.60.0&new-version=0.61.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 13 ++++++------- go.sum | 26 ++++++++++++-------------- 2 files changed, 18 insertions(+), 21 deletions(-) diff --git a/go.mod b/go.mod index e6a7e8b..f016820 100644 --- a/go.mod +++ b/go.mod @@ -18,7 +18,7 @@ require ( github.com/stretchr/testify v1.11.1 go.opentelemetry.io/contrib/instrumentation/runtime v0.64.0 go.opentelemetry.io/otel v1.39.0 - go.opentelemetry.io/otel/exporters/prometheus v0.60.0 + go.opentelemetry.io/otel/exporters/prometheus v0.61.0 go.opentelemetry.io/otel/metric v1.39.0 go.opentelemetry.io/otel/sdk v1.39.0 go.opentelemetry.io/otel/sdk/metric v1.39.0 @@ -52,7 +52,6 @@ require ( github.com/google/uuid v1.6.0 // indirect github.com/googleapis/enterprise-certificate-proxy v0.3.6 // indirect github.com/googleapis/gax-go/v2 v2.15.0 // indirect - github.com/grafana/regexp v0.0.0-20240518133315-a468a5bfb3bc // indirect github.com/jackc/pgpassfile v1.0.0 // indirect github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect github.com/jackc/puddle/v2 v2.2.2 // indirect @@ -65,16 +64,16 @@ require ( github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect github.com/pmezard/go-difflib v1.0.0 // indirect github.com/prometheus/client_model v0.6.2 // indirect - github.com/prometheus/common v0.66.1 // indirect - github.com/prometheus/otlptranslator v0.0.2 // indirect - github.com/prometheus/procfs v0.17.0 // indirect + github.com/prometheus/common v0.67.4 // indirect + github.com/prometheus/otlptranslator v1.0.0 // indirect + github.com/prometheus/procfs v0.19.2 // indirect github.com/sirupsen/logrus v1.9.3 // indirect github.com/vbatts/tar-split v0.12.2 // indirect go.opentelemetry.io/auto/sdk v1.2.1 // indirect go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 // indirect go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect go.opentelemetry.io/otel/trace v1.39.0 // indirect - go.yaml.in/yaml/v2 v2.4.2 // indirect + go.yaml.in/yaml/v2 v2.4.3 // indirect golang.org/x/crypto v0.45.0 // indirect golang.org/x/net v0.47.0 // indirect golang.org/x/oauth2 v0.33.0 // indirect @@ -87,5 +86,5 @@ require ( google.golang.org/genproto/googleapis/api v0.0.0-20250818200422-3122310a409c // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20250811230008-5f3141c8851a // indirect google.golang.org/grpc v1.74.2 // indirect - google.golang.org/protobuf v1.36.8 // indirect + google.golang.org/protobuf v1.36.10 // indirect ) diff --git a/go.sum b/go.sum index aba7dfc..0f4b779 100644 --- a/go.sum +++ b/go.sum @@ -74,8 +74,6 @@ github.com/googleapis/enterprise-certificate-proxy v0.3.6 h1:GW/XbdyBFQ8Qe+YAmFU github.com/googleapis/enterprise-certificate-proxy v0.3.6/go.mod h1:MkHOF77EYAE7qfSuSS9PU6g4Nt4e11cnsDUowfwewLA= github.com/googleapis/gax-go/v2 v2.15.0 h1:SyjDc1mGgZU5LncH8gimWo9lW1DtIfPibOG81vgd/bo= github.com/googleapis/gax-go/v2 v2.15.0/go.mod h1:zVVkkxAQHa1RQpg9z2AUCMnKhi0Qld9rcmyfL1OZhoc= -github.com/grafana/regexp v0.0.0-20240518133315-a468a5bfb3bc h1:GN2Lv3MGO7AS6PrRoT6yV5+wkrOpcszoIsO4+4ds248= -github.com/grafana/regexp v0.0.0-20240518133315-a468a5bfb3bc/go.mod h1:+JKpmjMGhpgPL+rXZ5nsZieVzvarn86asRlBg4uNGnk= github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM= github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg= github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo= @@ -112,12 +110,12 @@ github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg= github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk= github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE= -github.com/prometheus/common v0.66.1 h1:h5E0h5/Y8niHc5DlaLlWLArTQI7tMrsfQjHV+d9ZoGs= -github.com/prometheus/common v0.66.1/go.mod h1:gcaUsgf3KfRSwHY4dIMXLPV0K/Wg1oZ8+SbZk/HH/dA= -github.com/prometheus/otlptranslator v0.0.2 h1:+1CdeLVrRQ6Psmhnobldo0kTp96Rj80DRXRd5OSnMEQ= -github.com/prometheus/otlptranslator v0.0.2/go.mod h1:P8AwMgdD7XEr6QRUJ2QWLpiAZTgTE2UYgjlu3svompI= -github.com/prometheus/procfs v0.17.0 h1:FuLQ+05u4ZI+SS/w9+BWEM2TXiHKsUQ9TADiRH7DuK0= -github.com/prometheus/procfs v0.17.0/go.mod h1:oPQLaDAMRbA+u8H5Pbfq+dl3VDAvHxMUOVhe0wYB2zw= +github.com/prometheus/common v0.67.4 h1:yR3NqWO1/UyO1w2PhUvXlGQs/PtFmoveVO0KZ4+Lvsc= +github.com/prometheus/common v0.67.4/go.mod h1:gP0fq6YjjNCLssJCQp0yk4M8W6ikLURwkdd/YKtTbyI= +github.com/prometheus/otlptranslator v1.0.0 h1:s0LJW/iN9dkIH+EnhiD3BlkkP5QVIUVEoIwkU+A6qos= +github.com/prometheus/otlptranslator v1.0.0/go.mod h1:vRYWnXvI6aWGpsdY/mOT/cbeVRBlPWtBNDb7kGR3uKM= +github.com/prometheus/procfs v0.19.2 h1:zUMhqEW66Ex7OXIiDkll3tl9a1ZdilUOd/F6ZXw4Vws= +github.com/prometheus/procfs v0.19.2/go.mod h1:M0aotyiemPhBCM0z5w87kL22CxfcH05ZpYlu+b4J7mw= github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ= github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc= github.com/rs/cors v1.11.1 h1:eU3gRzXLRK57F5rKMGMZURNdIG4EoAmX8k94r9wXWHA= @@ -143,8 +141,8 @@ go.opentelemetry.io/contrib/instrumentation/runtime v0.64.0 h1:/+/+UjlXjFcdDlXxK go.opentelemetry.io/contrib/instrumentation/runtime v0.64.0/go.mod h1:Ldm/PDuzY2DP7IypudopCR3OCOW42NJlN9+mNEroevo= go.opentelemetry.io/otel v1.39.0 h1:8yPrr/S0ND9QEfTfdP9V+SiwT4E0G7Y5MO7p85nis48= go.opentelemetry.io/otel v1.39.0/go.mod h1:kLlFTywNWrFyEdH0oj2xK0bFYZtHRYUdv1NklR/tgc8= -go.opentelemetry.io/otel/exporters/prometheus v0.60.0 h1:cGtQxGvZbnrWdC2GyjZi0PDKVSLWP/Jocix3QWfXtbo= -go.opentelemetry.io/otel/exporters/prometheus v0.60.0/go.mod h1:hkd1EekxNo69PTV4OWFGZcKQiIqg0RfuWExcPKFvepk= +go.opentelemetry.io/otel/exporters/prometheus v0.61.0 h1:cCyZS4dr67d30uDyh8etKM2QyDsQ4zC9ds3bdbrVoD0= +go.opentelemetry.io/otel/exporters/prometheus v0.61.0/go.mod h1:iivMuj3xpR2DkUrUya3TPS/Z9h3dz7h01GxU+fQBRNg= go.opentelemetry.io/otel/metric v1.39.0 h1:d1UzonvEZriVfpNKEVmHXbdf909uGTOQjA0HF0Ls5Q0= go.opentelemetry.io/otel/metric v1.39.0/go.mod h1:jrZSWL33sD7bBxg1xjrqyDjnuzTUB0x1nBERXd7Ftcs= go.opentelemetry.io/otel/sdk v1.39.0 h1:nMLYcjVsvdui1B/4FRkwjzoRVsMK8uL/cj0OyhKzt18= @@ -155,8 +153,8 @@ go.opentelemetry.io/otel/trace v1.39.0 h1:2d2vfpEDmCJ5zVYz7ijaJdOF59xLomrvj7bjt6 go.opentelemetry.io/otel/trace v1.39.0/go.mod h1:88w4/PnZSazkGzz/w84VHpQafiU4EtqqlVdxWy+rNOA= go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE= -go.yaml.in/yaml/v2 v2.4.2 h1:DzmwEr2rDGHl7lsFgAHxmNz/1NlQ7xLIrlN2h5d1eGI= -go.yaml.in/yaml/v2 v2.4.2/go.mod h1:081UH+NErpNdqlCXm3TtEran0rJZGxAYx9hb/ELlsPU= +go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0= +go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8= golang.org/x/crypto v0.45.0 h1:jMBrvKuj23MTlT0bQEOBcAE0mjg8mK9RXFhRH6nyF3Q= golang.org/x/crypto v0.45.0/go.mod h1:XTGrrkGJve7CYK7J8PEww4aY7gM3qMCElcJQ8n8JdX4= golang.org/x/mod v0.31.0 h1:HaW9xtz0+kOcWKwli0ZXy79Ix+UW/vOfmWI5QVd2tgI= @@ -185,8 +183,8 @@ google.golang.org/genproto/googleapis/rpc v0.0.0-20250811230008-5f3141c8851a h1: google.golang.org/genproto/googleapis/rpc v0.0.0-20250811230008-5f3141c8851a/go.mod h1:gw1tLEfykwDz2ET4a12jcXt4couGAm7IwsVaTy0Sflo= google.golang.org/grpc v1.74.2 h1:WoosgB65DlWVC9FqI82dGsZhWFNBSLjQ84bjROOpMu4= google.golang.org/grpc v1.74.2/go.mod h1:CtQ+BGjaAIXHs/5YS3i473GqwBBa1zGQNevxdeBEXrM= -google.golang.org/protobuf v1.36.8 h1:xHScyCOEuuwZEc6UtSOvPbAT4zRh0xcNRYekJwfqyMc= -google.golang.org/protobuf v1.36.8/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU= +google.golang.org/protobuf v1.36.10 h1:AYd7cD/uASjIL6Q9LiTjz8JLcrh/88q5UObnmY3aOOE= +google.golang.org/protobuf v1.36.10/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q= From fdcb38537fa08e3392630e38a3d59cac51407b04 Mon Sep 17 00:00:00 2001 From: Tadas Antanavicius Date: Wed, 10 Dec 2025 13:58:01 -0800 Subject: [PATCH 051/313] Update OpenAPI spec to use v0.1 endpoints and make _meta optional (#811) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Prepared by Claude Code, reviewed by me. ## Summary - Update all API endpoint paths from `/v0/` to `/v0.1/` in the OpenAPI spec - Bump OpenAPI spec version from `2025-10-17` to `2025-12-01` (in `$id` and `info.version`) ## Rationale This ensures sub-registries implementing the spec are adhering to the stable v0.1 version rather than the unstable v0. The API freeze (v0.1) provides stability guarantees that sub-registries need. ## Additional cleanup ### Make `_meta` optional in `ServerResponse` The `_meta` field (and its `io.modelcontextprotocol.registry/official` extension) were never intended to be required parts of the spec. Sub-registries may not use these registry-specific metadata fields, so they should be optional. ### Move extensions docs to use /v0.1/ instead of /v0/ 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude --- docs/reference/api/extensions.md | 14 +++++++------- docs/reference/api/openapi.yaml | 13 ++++++------- 2 files changed, 13 insertions(+), 14 deletions(-) diff --git a/docs/reference/api/extensions.md b/docs/reference/api/extensions.md index 9340a16..8f7bcbc 100644 --- a/docs/reference/api/extensions.md +++ b/docs/reference/api/extensions.md @@ -13,10 +13,10 @@ A standardized way for registries to provide experimental or community-driven fe ## URL Structure -Extensions live under the `/v0/x/` prefix: +Extensions live under the `/v0.1/x/` prefix: ``` -/v0/x//[/] +/v0.1/x//[/] ``` **Components:** @@ -26,9 +26,9 @@ Extensions live under the `/v0/x/` prefix: **Examples:** ``` -/v0/x/com.example/search?q=database -/v0/x/com.example/stats -/v0/x/io.github.username/custom-feature +/v0.1/x/com.example/search?q=database +/v0.1/x/com.example/stats +/v0.1/x/io.github.username/custom-feature ``` ## Conventions @@ -50,7 +50,7 @@ Clients consuming extensions **MUST** gracefully handle missing extensions. A simple server stats extension: ```bash -GET /v0/x/com.example/stats +GET /v0.1/x/com.example/stats ``` ```json @@ -63,7 +63,7 @@ GET /v0/x/com.example/stats ## Future Considerations -- **Extension discovery**: A potential `/v0/x` endpoint to list available extensions +- **Extension discovery**: A potential `/v0.1/x` endpoint to list available extensions - **Extension metadata**: Standardized metadata format for extension capabilities - **Defining common extensions**: Like semantic conventions from OpenTelemetry, develop common extensions that registries can adopt (possibly under an experimental namespace) - Search extension for free-text search across server metadata ([#389](https://github.com/modelcontextprotocol/registry/issues/389)) diff --git a/docs/reference/api/openapi.yaml b/docs/reference/api/openapi.yaml index c85dc42..4794205 100644 --- a/docs/reference/api/openapi.yaml +++ b/docs/reference/api/openapi.yaml @@ -1,9 +1,9 @@ openapi: 3.1.0 jsonSchemaDialect: "https://json-schema.org/draft/2020-12/schema" -$id: https://modelcontextprotocol.io/schemas/draft/2025-10-17/server-registry-openapi +$id: https://modelcontextprotocol.io/schemas/draft/2025-12-01/server-registry-openapi info: title: MCP Server Registry API - version: "2025-10-17" + version: "2025-12-01" summary: API for discovering and accessing MCP server metadata description: | Specification for a theoretical REST API that serves up metadata about MCP servers. @@ -18,7 +18,7 @@ tags: description: Operations for publishing MCP servers to the registry paths: - /v0/servers: + /v0.1/servers: get: tags: [servers] summary: List MCP servers @@ -68,7 +68,7 @@ paths: application/json: schema: $ref: '#/components/schemas/ServerList' - /v0/servers/{serverName}/versions: + /v0.1/servers/{serverName}/versions: get: tags: [servers] summary: List all versions of an MCP server @@ -98,7 +98,7 @@ paths: error: type: string example: "Server not found" - /v0/servers/{serverName}/versions/{version}: + /v0.1/servers/{serverName}/versions/{version}: get: tags: [servers] summary: Get specific MCP server version @@ -218,7 +218,7 @@ paths: error: type: string example: "Deletion is not supported by this registry" - /v0/publish: + /v0.1/publish: post: tags: [publish] summary: Publish MCP server (Optional) @@ -741,7 +741,6 @@ components: type: object required: - server - - _meta properties: server: $ref: '#/components/schemas/ServerDetail' From c54a5ac27773f7e935cdfe9aea33c0139bedad1f Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Thu, 11 Dec 2025 09:56:57 +0200 Subject: [PATCH 052/313] Ensure tests are failing CI (#840) --- Makefile | 5 +- internal/api/openapi_compliance_test.go | 5 +- internal/validators/registries/oci_test.go | 132 +++++++++++++++------ 3 files changed, 105 insertions(+), 37 deletions(-) diff --git a/Makefile b/Makefile index 0dca9a9..3cad691 100644 --- a/Makefile +++ b/Makefile @@ -1,5 +1,8 @@ .PHONY: help build test test-unit test-integration test-endpoints test-publish test-all lint lint-fix validate validate-schemas validate-examples check ko-build ko-rebuild dev-compose dev-down clean publisher generate-schema check-schema +# Use bash for all commands to support pipefail +SHELL := /bin/bash + # Default target help: ## Show this help message @echo "Available targets:" @@ -33,7 +36,7 @@ test-unit: ## Run unit tests with coverage (requires PostgreSQL) @sleep 3 @echo "" @echo "Running unit tests..." - @if command -v gotestsum >/dev/null 2>&1; then \ + @set -o pipefail; if command -v gotestsum >/dev/null 2>&1; then \ gotestsum --format pkgname-and-test-fails -- -race -coverprofile=coverage.out -covermode=atomic ./internal/... ./cmd/... 2>&1 | grep -v "ld: warning:"; \ else \ go test -race -coverprofile=coverage.out -covermode=atomic ./internal/... ./cmd/... 2>&1 | grep -v "ld: warning:" | grep -v "^ld:"; \ diff --git a/internal/api/openapi_compliance_test.go b/internal/api/openapi_compliance_test.go index 4877274..c4e1008 100644 --- a/internal/api/openapi_compliance_test.go +++ b/internal/api/openapi_compliance_test.go @@ -50,8 +50,9 @@ func TestOpenAPIEndpointCompliance(t *testing.T) { BuildTime: "test", } - // Register V0 routes exactly like production does - router.RegisterV0Routes(api, cfg, nil, nil, versionInfo) // nil service and metrics for schema testing + // Register V0 and V0.1 routes exactly like production does + router.RegisterV0Routes(api, cfg, nil, nil, versionInfo) // nil service and metrics for schema testing + router.RegisterV0_1Routes(api, cfg, nil, nil, versionInfo) // Register v0.1 routes for compliance // Get the OpenAPI schema req := httptest.NewRequest(http.MethodGet, "/openapi.yaml", nil) diff --git a/internal/validators/registries/oci_test.go b/internal/validators/registries/oci_test.go index 64e319d..634e2e5 100644 --- a/internal/validators/registries/oci_test.go +++ b/internal/validators/registries/oci_test.go @@ -13,56 +13,60 @@ func TestValidateOCI_RegistryAllowlist(t *testing.T) { ctx := context.Background() tests := []struct { - name string - identifier string - expectError bool - errorMsg string + name string + identifier string + expectError bool + errorMsg string + mustNotContainMsg string // Error message that must NOT appear (for allowed registries) }{ // Allowed registries - use real public images that exist - // These should fail with "missing required annotation" (no MCP label) + // These should fail with annotation-related errors (missing or mismatched) // NOT with "unsupported registry", "does not exist", or "is private" errors { - name: "Docker Hub should be allowed", - identifier: "docker.io/library/alpine:latest", - expectError: true, - errorMsg: "missing required annotation", + name: "Docker Hub should be allowed", + identifier: "docker.io/library/alpine:latest", + expectError: true, + errorMsg: "missing required annotation", + mustNotContainMsg: "unsupported OCI registry", }, { - name: "Docker Hub without explicit registry should default and be allowed", - identifier: "library/hello-world:latest", - expectError: true, - errorMsg: "missing required annotation", + name: "Docker Hub without explicit registry should default and be allowed", + identifier: "library/hello-world:latest", + expectError: true, + errorMsg: "missing required annotation", + mustNotContainMsg: "unsupported OCI registry", }, { - name: "GHCR should be allowed", - identifier: "ghcr.io/containerbase/base:latest", - expectError: true, - errorMsg: "missing required annotation", + name: "GHCR should be allowed", + identifier: "ghcr.io/containerbase/base:latest", + expectError: true, + errorMsg: "missing required annotation", + mustNotContainMsg: "unsupported OCI registry", }, { name: "Artifact Registry regional should be allowed", identifier: "us-central1-docker.pkg.dev/database-toolbox/toolbox/toolbox:latest", expectError: true, - errorMsg: "missing required annotation", + // This image has an MCP annotation but with a different server name, + // so we get "ownership validation failed" instead of "missing required annotation" + // Both are acceptable - what matters is the registry is allowed + mustNotContainMsg: "unsupported OCI registry", }, { - name: "Artifact Registry multi-region should be allowed", - identifier: "us-docker.pkg.dev/berglas/berglas/berglas:latest", - expectError: true, - errorMsg: "missing required annotation", + name: "Artifact Registry multi-region should be allowed", + identifier: "us-docker.pkg.dev/berglas/berglas/berglas:latest", + expectError: true, + errorMsg: "missing required annotation", + mustNotContainMsg: "unsupported OCI registry", }, { - name: "MCR should be allowed", - identifier: "mcr.microsoft.com/dotnet/aspire-dashboard:9.5.0", - expectError: true, - errorMsg: "missing required annotation", - }, - { - name: "ACR should be allowed", - identifier: "azurearcjumpstart.azurecr.io/hello-arc:latest", - expectError: true, - errorMsg: "missing required annotation", + name: "MCR should be allowed", + identifier: "mcr.microsoft.com/dotnet/aspire-dashboard:9.5.0", + expectError: true, + errorMsg: "missing required annotation", + mustNotContainMsg: "unsupported OCI registry", }, + // Removed ACR test with non-existent host - ACR support is tested elsewhere // Disallowed registries { @@ -114,8 +118,14 @@ func TestValidateOCI_RegistryAllowlist(t *testing.T) { if tt.expectError { assert.Error(t, err) - // Should contain the specific error message - assert.Contains(t, err.Error(), tt.errorMsg) + // For allowed registries, verify they don't get rejected at the registry check + if tt.mustNotContainMsg != "" { + assert.NotContains(t, err.Error(), tt.mustNotContainMsg) + } + // If a specific error message is expected, check for it + if tt.errorMsg != "" { + assert.Contains(t, err.Error(), tt.errorMsg) + } } else { assert.NoError(t, err) } @@ -123,6 +133,60 @@ func TestValidateOCI_RegistryAllowlist(t *testing.T) { } } +func TestValidateOCI_RegistryPatterns(t *testing.T) { + // This test verifies registry pattern matching (wildcards like *.azurecr.io and *.pkg.dev) + // without relying on external images that may not exist + tests := []struct { + name string + identifier string + shouldFail bool // true if should fail at registry allowlist check + }{ + { + name: "ACR registry pattern should be allowed", + identifier: "myregistry.azurecr.io/test/image:latest", + shouldFail: false, // Registry is allowed, will fail later on missing annotation + }, + { + name: "Another ACR registry should be allowed", + identifier: "contoso.azurecr.io/app:v1", + shouldFail: false, + }, + { + name: "Artifact Registry should be allowed", + identifier: "us-west1-docker.pkg.dev/project/repo/image:tag", + shouldFail: false, + }, + { + name: "GCR should be rejected at registry check", + identifier: "gcr.io/project/image:latest", + shouldFail: true, // Should fail at registry allowlist check + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + pkg := model.Package{ + RegistryType: model.RegistryTypeOCI, + Identifier: tt.identifier, + } + + ctx := context.Background() + err := registries.ValidateOCI(ctx, pkg, "com.example/test") + + // All test cases should error (either at registry check or annotation check) + assert.Error(t, err) + + if tt.shouldFail { + // Should fail at the registry allowlist check + assert.Contains(t, err.Error(), "unsupported OCI registry") + } else { + // Should NOT fail at registry check (allowed registry) + assert.NotContains(t, err.Error(), "unsupported OCI registry") + } + }) + } +} + func TestValidateOCI_RejectsOldFormat(t *testing.T) { ctx := context.Background() From bbbad1af1f20ebf030bce7a712b10733cfc5a449 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Thu, 11 Dec 2025 18:43:57 +0200 Subject: [PATCH 053/313] Update Goreleaser and Cosign (#839) ## Motivation and Context The following PR bumps cosign and updates Goreleaser to reflect that. Follows https://goreleaser.com/blog/cosign-v3/#updating-your-goreleaser-configuration ## Breaking Changes ## Types of changes - [ ] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] Documentation update ## Checklist - [ ] I have read the [MCP Documentation](https://modelcontextprotocol.io) - [ ] My code follows the repository's style guidelines - [ ] New and existing tests pass locally - [ ] I have added appropriate error handling - [ ] I have added or updated documentation as needed ## Additional context Signed-off-by: Radoslav Dimitrov --- .github/workflows/release.yml | 4 +--- .goreleaser.yaml | 12 +++++------- 2 files changed, 6 insertions(+), 10 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 0ec1cce..2abb732 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -25,9 +25,7 @@ jobs: cache: true - name: Install cosign - uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad - with: - cosign-release: "v2.6.1" + uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0 - name: Install Syft uses: anchore/sbom-action/download-syft@v0.20.10 diff --git a/.goreleaser.yaml b/.goreleaser.yaml index cdad0c4..877ebad 100644 --- a/.goreleaser.yaml +++ b/.goreleaser.yaml @@ -95,26 +95,24 @@ signs: cmd: cosign args: - "sign-blob" - - "--output-signature=${signature}" - - "--output-certificate=${certificate}" + - "--bundle=${signature}" # cosign v3+: bundles signature and certificate together - "${artifact}" - "--yes" # needed on cosign 2.0.0+ artifacts: archive output: true - certificate: '{{ trimsuffix (trimsuffix .Env.artifact ".zip") ".tar.gz" }}.pem' - + signature: "${artifact}.sigstore.json" + # Also sign checksums file for additional verification - id: checksums cmd: cosign args: - "sign-blob" - - "--output-signature=${signature}" - - "--output-certificate=${certificate}" + - "--bundle=${signature}" # cosign v3+: bundles signature and certificate together - "${artifact}" - "--yes" artifacts: checksum output: true - certificate: '{{ trimsuffix .Env.artifact ".txt" }}.pem' + signature: "${artifact}.sigstore.json" # This section defines the release format. archives: From b58836c48ecbfeaffa7d66774730fcb5437c28a8 Mon Sep 17 00:00:00 2001 From: Tadas Antanavicius Date: Thu, 11 Dec 2025 09:17:32 -0800 Subject: [PATCH 054/313] feat: Add LocalTransport/RemoteTransport with URL template variables (#570) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored with Claude Code, but I've closely reviewed/modified/vetted all changes; ready for final review. ## Summary This PR adds LocalTransport and RemoteTransport separation with URL template variable support for remote servers, enabling e.g. multi-tenant deployments with configurable endpoints. **Key additions:** - LocalTransport (for Packages) and RemoteTransport (for Remotes) - URL template variables for remote transports (e.g., `{tenant_id}` in URLs) - Pattern validation ensuring URLs are URL-like while allowing templates - Full test coverage via Go validator tests and documentation examples ## ⚠️ server.json Update This PR updates the `server.json` schema. A new schema version will be cut after this lands. ## Problem The current schema describes URL templating with `{curly_braces}` for transports but provides no mechanism for Remote contexts to define what those variables should resolve to, making the feature unusable for remote servers. Referenced issue: #394 - Users need multi-tenant remote servers with different endpoints per deployment - Each tenant/region has its own URL (e.g., `us-cell1.example.com`, `emea-cell1.example.com`) - Current schema doesn't support parameterized remote URLs ## Solution ### Schema Architecture **LocalTransport** (for Package context): ```typescript LocalTransport = StdioTransport | StreamableHttpTransport | SseTransport ``` - Used in Package context (non-breaking rename of existing behavior) - Variables in `{curly_braces}` reference parent Package arguments/environment variables - Supports all three transport types including stdio **RemoteTransport** (for Remote context): ```typescript RemoteTransport = (StreamableHttpTransport | SseTransport) + { variables: object } ``` - Extends StreamableHttp/Sse via `allOf` composition - no duplication! - Adds `variables` object for URL templating - Only supports streamable-http and sse (stdio not valid for remotes) ### Key Changes **1. Schema Updates** (`openapi.yaml`, `server.schema.json`): - Added `LocalTransport` union type for Package context - Added `RemoteTransport` with `allOf` composition extending base transports - Updated Package to reference `LocalTransport` - Updated remotes to reference `RemoteTransport` - Added URL pattern validation: `^https?://[^\\s]+$` to both StreamableHttp and SSE - Removed `format: uri` from SSE (was blocking template variables) **2. Go Types** (`pkg/model/types.go`): - Base `Transport` struct unchanged for Package context - `RemoteTransport` struct for remotes with `Variables` field - Both work with existing validation infrastructure **3. Validators** (`internal/validators/`): - `validateRemoteTransport()` validates Remote-specific constraints - `collectRemoteTransportVariables()` extracts available variables - `IsValidTemplatedURL()` validates template variables reference defined variables - `IsValidRemoteURL()` handles template variable substitution before localhost check - 6 new test cases for remote transport variable validation **4. Documentation Examples** (`generic-server-json.md`): - Remote Server with URL Templating (StreamableHttp with `{tenant_id}`) - SSE Remote with URL Templating (SSE with `{tenant_id}`) - Local Server with URL Templating (Package with `{port}`) - All examples validate via existing `validate-examples` tool ## Example: Remote Transport with Variables ```json { "remotes": [ { "type": "streamable-http", "url": "https://api.example.com/mcp/{tenant_id}/{region}", "variables": { "tenant_id": { "description": "Tenant identifier", "isRequired": true, "choices": ["us-cell1", "emea-cell1", "apac-cell1"] }, "region": { "description": "Deployment region", "isRequired": true } } } ] } ``` Clients configure the variables, and `{tenant_id}` and `{region}` get replaced to connect to tenant-specific endpoints like `https://api.example.com/mcp/us-cell1/east`. ## Architecture Details **Context-based variable resolution:** - **Package + LocalTransport**: `{port}` references `--port` argument or `PORT` env var from parent Package - **Remote + RemoteTransport**: `{tenant_id}` references `variables.tenant_id` defined in the transport itself - **Code reuse**: StreamableHttp/Sse definitions shared via `allOf`, not duplicated - **Validation**: Template variables validated against available variables for each context --- ## Follow-on Work Follow-on work will be done to adopt the feedback in https://github.com/modelcontextprotocol/registry/pull/570#issuecomment-3367417636 regarding variable naming/prioritzation/scoping conventions, but should not have any impact on the shape being introduced here (just validations). --------- Co-authored-by: yuna0x0 Co-authored-by: Claude Co-authored-by: Connor Peet --- docs/reference/api/openapi.yaml | 37 +++-- .../server-json/generic-server-json.md | 87 ++++++++++++ docs/reference/server-json/server.schema.json | 69 ++++++--- internal/validators/constants.go | 5 +- internal/validators/utils.go | 22 +-- internal/validators/validators.go | 39 +++++- internal/validators/validators_test.go | 132 ++++++++++++++++++ pkg/model/types.go | 9 +- tools/validate-examples/main.go | 2 +- 9 files changed, 350 insertions(+), 52 deletions(-) diff --git a/docs/reference/api/openapi.yaml b/docs/reference/api/openapi.yaml index 4794205..ceb6369 100644 --- a/docs/reference/api/openapi.yaml +++ b/docs/reference/api/openapi.yaml @@ -440,10 +440,7 @@ components: description: A hint to help clients determine the appropriate runtime for the package. This field should be provided when `runtimeArguments` are present. examples: [npx, uvx, docker, dnx] transport: - anyOf: - - $ref: '#/components/schemas/StdioTransport' - - $ref: '#/components/schemas/StreamableHttpTransport' - - $ref: '#/components/schemas/SseTransport' + $ref: '#/components/schemas/LocalTransport' description: Transport protocol configuration for the package runtimeArguments: type: array @@ -599,8 +596,9 @@ components: example: "streamable-http" url: type: string - description: URL template for the streamable-http transport. Variables in {curly_braces} reference argument valueHints, argument names, or environment variable names. After variable substitution, this should produce a valid URI. + description: "URL template for the streamable-http transport. Variables in {curly_braces} are resolved based on context: In Package context, they reference argument valueHints, argument names, or environment variable names from the parent Package. In Remote context, they reference variables from the transport's 'variables' object. After variable substitution, this should produce a valid URI." example: "https://api.example.com/mcp" + pattern: "^https?://[^\\s]+$" headers: type: array description: HTTP headers to include @@ -620,15 +618,36 @@ components: example: "sse" url: type: string - format: uri - description: Server-Sent Events endpoint URL + description: "Server-Sent Events endpoint URL template. Variables in {curly_braces} are resolved based on context: In Package context, they reference argument valueHints, argument names, or environment variable names from the parent Package. In Remote context, they reference variables from the transport's 'variables' object. After variable substitution, this should produce a valid URI." example: "https://mcp-fs.example.com/sse" + pattern: "^https?://[^\\s]+$" headers: type: array description: HTTP headers to include items: $ref: '#/components/schemas/KeyValueInput' + LocalTransport: + anyOf: + - $ref: '#/components/schemas/StdioTransport' + - $ref: '#/components/schemas/StreamableHttpTransport' + - $ref: '#/components/schemas/SseTransport' + description: Transport protocol configuration for local/package context + + RemoteTransport: + allOf: + - anyOf: + - $ref: '#/components/schemas/StreamableHttpTransport' + - $ref: '#/components/schemas/SseTransport' + - type: object + properties: + variables: + type: object + description: "Configuration variables that can be referenced in URL template {curly_braces}. The key is the variable name, and the value defines the variable properties." + additionalProperties: + $ref: '#/components/schemas/Input' + description: Transport protocol configuration for remote context - extends StreamableHttpTransport or SseTransport with variables + Icon: type: object description: An optionally-sized icon that can be displayed in a user interface. @@ -717,9 +736,7 @@ components: remotes: type: array items: - anyOf: - - $ref: '#/components/schemas/StreamableHttpTransport' - - $ref: '#/components/schemas/SseTransport' + $ref: '#/components/schemas/RemoteTransport' _meta: type: object description: "Extension metadata using reverse DNS namespacing for vendor-specific data" diff --git a/docs/reference/server-json/generic-server-json.md b/docs/reference/server-json/generic-server-json.md index f037d2d..71a0ecc 100644 --- a/docs/reference/server-json/generic-server-json.md +++ b/docs/reference/server-json/generic-server-json.md @@ -688,3 +688,90 @@ For MCP servers that follow a custom installation path or are embedded in applic } ``` + +### Remote Server with URL Templating + +This example demonstrates URL templating for remote servers, useful for multi-tenant deployments where each instance has its own endpoint. Unlike Package transports (which reference parent arguments/environment variables), Remote transports define their own variables: + +```json +{ + "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", + "name": "io.modelcontextprotocol.anonymous/multi-tenant-server", + "description": "MCP server with configurable remote endpoint", + "title": "Multi-Tenant Server", + "version": "1.0.0", + "remotes": [ + { + "type": "streamable-http", + "url": "https://anonymous.modelcontextprotocol.io/mcp/{tenant_id}", + "variables": { + "tenant_id": { + "description": "Tenant identifier (e.g., 'us-cell1', 'emea-cell1')", + "isRequired": true + } + } + } + ] +} +``` + +Clients configure the tenant identifier, and the `{tenant_id}` variable in the URL gets replaced with the provided variable value to connect to the appropriate tenant endpoint (e.g., `https://anonymous.modelcontextprotocol.io/mcp/us-cell1` or `https://anonymous.modelcontextprotocol.io/mcp/emea-cell1`). + +The same URL templating works with SSE transport: + +```json +{ + "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", + "name": "io.modelcontextprotocol.anonymous/events-server", + "description": "MCP server using SSE with tenant-specific endpoints", + "version": "1.0.0", + "remotes": [ + { + "type": "sse", + "url": "https://events.anonymous.modelcontextprotocol.io/sse/{tenant_id}", + "variables": { + "tenant_id": { + "description": "Tenant identifier", + "isRequired": true + } + } + } + ] +} +``` + +### Local Server with URL Templating + +This example demonstrates URL templating for local/package servers, where variables reference parent Package arguments or environment variables: + +```json +{ + "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", + "name": "io.github.example/configurable-server", + "description": "Local MCP server with configurable port", + "title": "Configurable Server", + "version": "1.0.0", + "packages": [ + { + "registryType": "npm", + "registryBaseUrl": "https://registry.npmjs.org", + "identifier": "@example/mcp-server", + "version": "1.0.0", + "transport": { + "type": "streamable-http", + "url": "http://localhost:{--port}/mcp" + }, + "packageArguments": [ + { + "type": "named", + "name": "--port", + "description": "Port for the server to listen on", + "default": "3000" + } + ] + } + ] +} +``` + +The `{--port}` variable in the URL references the `--port` argument `name` from packageArguments. For positional arguments, an argument with the `valueHint` of `port` could similarly be referenced as `{port}`. When the package runs with `--port 8080`, the URL becomes `http://localhost:8080/mcp`. diff --git a/docs/reference/server-json/server.schema.json b/docs/reference/server-json/server.schema.json index 221eb05..5c1c51d 100644 --- a/docs/reference/server-json/server.schema.json +++ b/docs/reference/server-json/server.schema.json @@ -156,6 +156,20 @@ } ] }, + "LocalTransport": { + "anyOf": [ + { + "$ref": "#/definitions/StdioTransport" + }, + { + "$ref": "#/definitions/StreamableHttpTransport" + }, + { + "$ref": "#/definitions/SseTransport" + } + ], + "description": "Transport protocol configuration for local/package context" + }, "NamedArgument": { "allOf": [ { @@ -262,17 +276,7 @@ "type": "string" }, "transport": { - "anyOf": [ - { - "$ref": "#/definitions/StdioTransport" - }, - { - "$ref": "#/definitions/StreamableHttpTransport" - }, - { - "$ref": "#/definitions/SseTransport" - } - ], + "$ref": "#/definitions/LocalTransport", "description": "Transport protocol configuration for the package" }, "version": { @@ -337,6 +341,33 @@ ], "description": "A positional input is a value inserted verbatim into the command line." }, + "RemoteTransport": { + "allOf": [ + { + "anyOf": [ + { + "$ref": "#/definitions/StreamableHttpTransport" + }, + { + "$ref": "#/definitions/SseTransport" + } + ] + }, + { + "properties": { + "variables": { + "additionalProperties": { + "$ref": "#/definitions/Input" + }, + "description": "Configuration variables that can be referenced in URL template {curly_braces}. The key is the variable name, and the value defines the variable properties.", + "type": "object" + } + }, + "type": "object" + } + ], + "description": "Transport protocol configuration for remote context - extends StreamableHttpTransport or SseTransport with variables" + }, "Repository": { "description": "Repository metadata for the MCP server source code. Enables users and security experts to inspect the code, improving transparency.", "properties": { @@ -427,14 +458,7 @@ }, "remotes": { "items": { - "anyOf": [ - { - "$ref": "#/definitions/StreamableHttpTransport" - }, - { - "$ref": "#/definitions/SseTransport" - } - ] + "$ref": "#/definitions/RemoteTransport" }, "type": "array" }, @@ -487,9 +511,9 @@ "type": "string" }, "url": { - "description": "Server-Sent Events endpoint URL", + "description": "Server-Sent Events endpoint URL template. Variables in {curly_braces} are resolved based on context: In Package context, they reference argument valueHints, argument names, or environment variable names from the parent Package. In Remote context, they reference variables from the transport's 'variables' object. After variable substitution, this should produce a valid URI.", "example": "https://mcp-fs.example.com/sse", - "format": "uri", + "pattern": "^https?://[^\\s]+$", "type": "string" } }, @@ -533,8 +557,9 @@ "type": "string" }, "url": { - "description": "URL template for the streamable-http transport. Variables in {curly_braces} reference argument valueHints, argument names, or environment variable names. After variable substitution, this should produce a valid URI.", + "description": "URL template for the streamable-http transport. Variables in {curly_braces} are resolved based on context: In Package context, they reference argument valueHints, argument names, or environment variable names from the parent Package. In Remote context, they reference variables from the transport's 'variables' object. After variable substitution, this should produce a valid URI.", "example": "https://api.example.com/mcp", + "pattern": "^https?://[^\\s]+$", "type": "string" } }, diff --git a/internal/validators/constants.go b/internal/validators/constants.go index dce640f..90dec39 100644 --- a/internal/validators/constants.go +++ b/internal/validators/constants.go @@ -13,8 +13,9 @@ var ( ErrReservedVersionString = errors.New("version string 'latest' is reserved and cannot be used") ErrVersionLooksLikeRange = errors.New("version must be a specific version, not a range") - // Remote validation errors - ErrInvalidRemoteURL = errors.New("invalid remote URL") + // Transport validation errors + ErrInvalidPackageTransportURL = errors.New("invalid package transport URL") + ErrInvalidRemoteURL = errors.New("invalid remote URL") // Registry validation errors ErrUnsupportedRegistryBaseURL = errors.New("unsupported registry base URL") diff --git a/internal/validators/utils.go b/internal/validators/utils.go index 9a6b4cf..035132d 100644 --- a/internal/validators/utils.go +++ b/internal/validators/utils.go @@ -61,7 +61,13 @@ func replaceTemplateVariables(rawURL string) string { result = strings.ReplaceAll(result, placeholder, replacement) } - // Handle any remaining {variable} patterns with generic placeholder + // Handle any remaining {variable} patterns with context-appropriate placeholders + // If the variable is in a port position (after a colon in the host), use a numeric placeholder + // Pattern: :/{variable} or :{variable}/ or :{variable} at end + portRe := regexp.MustCompile(`:(\{[^}]+\})(/|$)`) + result = portRe.ReplaceAllString(result, ":8080$2") + + // Replace any other remaining {variable} patterns with generic placeholder re := regexp.MustCompile(`\{[^}]+\}`) result = re.ReplaceAllString(result, "placeholder") @@ -132,8 +138,11 @@ func IsValidRemoteURL(rawURL string) bool { return false } + // Replace template variables with placeholders before parsing for localhost check + testURL := replaceTemplateVariables(rawURL) + // Parse the URL to check for localhost restriction - u, err := url.Parse(rawURL) + u, err := url.Parse(testURL) if err != nil { return false } @@ -153,8 +162,8 @@ func IsValidRemoteURL(rawURL string) bool { // IsValidTemplatedURL validates a URL with template variables against available variables // For packages: validates that template variables reference package arguments or environment variables -// For remotes: disallows template variables entirely -func IsValidTemplatedURL(rawURL string, availableVariables []string, allowTemplates bool) bool { +// For remotes: validates that template variables reference the transport's variables map +func IsValidTemplatedURL(rawURL string, availableVariables []string) bool { // First check basic URL structure if !IsValidURL(rawURL) { return false @@ -168,11 +177,6 @@ func IsValidTemplatedURL(rawURL string, availableVariables []string, allowTempla return true } - // If templates are not allowed (e.g., for remotes), reject URLs with templates - if !allowTemplates { - return false - } - // Validate that all template variables are available availableSet := make(map[string]bool) for _, v := range availableVariables { diff --git a/internal/validators/validators.go b/internal/validators/validators.go index 3c9789d..1085474 100644 --- a/internal/validators/validators.go +++ b/internal/validators/validators.go @@ -363,6 +363,20 @@ func collectAvailableVariables(pkg *model.Package) []string { return variables } +// collectRemoteTransportVariables extracts available variable names from a remote transport +func collectRemoteTransportVariables(transport *model.Transport) []string { + var variables []string + + // Add variable names from the Variables map + for variableName := range transport.Variables { + if variableName != "" { + variables = append(variables, variableName) + } + } + + return variables +} + // validatePackageTransport validates a package's transport with templating support func validatePackageTransport(transport *model.Transport, availableVariables []string) error { // Validate transport type is supported @@ -379,14 +393,14 @@ func validatePackageTransport(transport *model.Transport, availableVariables []s return fmt.Errorf("url is required for %s transport type", transport.Type) } // Validate URL format with template variable support - if !IsValidTemplatedURL(transport.URL, availableVariables, true) { + if !IsValidTemplatedURL(transport.URL, availableVariables) { // Check if it's a template variable issue or basic URL issue templateVars := extractTemplateVariables(transport.URL) if len(templateVars) > 0 { return fmt.Errorf("%w: template variables in URL %s reference undefined variables. Available variables: %v", - ErrInvalidRemoteURL, transport.URL, availableVariables) + ErrInvalidPackageTransportURL, transport.URL, availableVariables) } - return fmt.Errorf("%w: %s", ErrInvalidRemoteURL, transport.URL) + return fmt.Errorf("%w: %s", ErrInvalidPackageTransportURL, transport.URL) } return nil default: @@ -394,7 +408,7 @@ func validatePackageTransport(transport *model.Transport, availableVariables []s } } -// validateRemoteTransport validates a remote transport (no templating allowed) +// validateRemoteTransport validates a remote transport with optional templating func validateRemoteTransport(obj *model.Transport) error { // Validate transport type is supported - remotes only support streamable-http and sse switch obj.Type { @@ -403,7 +417,22 @@ func validateRemoteTransport(obj *model.Transport) error { if obj.URL == "" { return fmt.Errorf("url is required for %s transport type", obj.Type) } - // Validate URL format (no templates allowed for remotes, no localhost) + + // Collect available variables from the transport's Variables field + availableVariables := collectRemoteTransportVariables(obj) + + // Validate URL format with template variable support + if !IsValidTemplatedURL(obj.URL, availableVariables) { + // Check if it's a template variable issue or basic URL issue + templateVars := extractTemplateVariables(obj.URL) + if len(templateVars) > 0 { + return fmt.Errorf("%w: template variables in URL %s reference undefined variables. Available variables: %v", + ErrInvalidRemoteURL, obj.URL, availableVariables) + } + return fmt.Errorf("%w: %s", ErrInvalidRemoteURL, obj.URL) + } + + // Additional check: reject localhost URLs for remotes (like the old IsValidRemoteURL did) if !IsValidRemoteURL(obj.URL) { return fmt.Errorf("%w: %s", ErrInvalidRemoteURL, obj.URL) } diff --git a/internal/validators/validators_test.go b/internal/validators/validators_test.go index e5d3909..7b69587 100644 --- a/internal/validators/validators_test.go +++ b/internal/validators/validators_test.go @@ -1598,6 +1598,138 @@ func TestValidate_TransportValidation(t *testing.T) { }, expectedError: "invalid remote URL", }, + // Remote transport variable tests + { + name: "remote transport with URL variables - valid", + serverDetail: apiv0.ServerJSON{ + Schema: model.CurrentSchemaURL, + Name: "com.example/test-server", + Description: "A test server", + Version: "1.0.0", + Remotes: []model.Transport{ + { + Type: "streamable-http", + URL: "https://example.com/mcp/{tenant_id}", + Variables: map[string]model.Input{ + "tenant_id": { + Description: "Tenant identifier", + IsRequired: true, + }, + }, + }, + }, + }, + expectedError: "", + }, + { + name: "remote transport with multiple URL variables - valid", + serverDetail: apiv0.ServerJSON{ + Schema: model.CurrentSchemaURL, + Name: "com.example/test-server", + Description: "A test server", + Version: "1.0.0", + Remotes: []model.Transport{ + { + Type: "streamable-http", + URL: "https://{region}.example.com/mcp/{tenant_id}", + Variables: map[string]model.Input{ + "region": { + Description: "Server region", + Choices: []string{"us-east-1", "eu-west-1"}, + }, + "tenant_id": { + Description: "Tenant identifier", + IsRequired: true, + }, + }, + }, + }, + }, + expectedError: "", + }, + { + name: "remote transport with undefined URL variable - invalid", + serverDetail: apiv0.ServerJSON{ + Schema: model.CurrentSchemaURL, + Name: "com.example/test-server", + Description: "A test server", + Version: "1.0.0", + Remotes: []model.Transport{ + { + Type: "streamable-http", + URL: "https://example.com/mcp/{tenant_id}", + // Missing variables definition + }, + }, + }, + expectedError: "template variables in URL", + }, + { + name: "remote transport with missing variable in URL - invalid", + serverDetail: apiv0.ServerJSON{ + Schema: model.CurrentSchemaURL, + Name: "com.example/test-server", + Description: "A test server", + Version: "1.0.0", + Remotes: []model.Transport{ + { + Type: "streamable-http", + URL: "https://example.com/mcp/{tenant_id}/{region}", + Variables: map[string]model.Input{ + "tenant_id": { + Description: "Tenant identifier", + }, + // Missing "region" variable + }, + }, + }, + }, + expectedError: "template variables in URL", + }, + { + name: "remote transport SSE with URL variables - valid", + serverDetail: apiv0.ServerJSON{ + Schema: model.CurrentSchemaURL, + Name: "com.example/test-server", + Description: "A test server", + Version: "1.0.0", + Remotes: []model.Transport{ + { + Type: "sse", + URL: "https://events.example.com/mcp/{api_key}", + Variables: map[string]model.Input{ + "api_key": { + Description: "API key for authentication", + IsRequired: true, + IsSecret: true, + }, + }, + }, + }, + }, + expectedError: "", + }, + { + name: "remote transport with variables but no template in URL - valid", + serverDetail: apiv0.ServerJSON{ + Schema: model.CurrentSchemaURL, + Name: "com.example/test-server", + Description: "A test server", + Version: "1.0.0", + Remotes: []model.Transport{ + { + Type: "streamable-http", + URL: "https://example.com/mcp", + Variables: map[string]model.Input{ + "unused_var": { + Description: "This variable is defined but not used", + }, + }, + }, + }, + }, + expectedError: "", // Valid - variables can be defined but not used + }, } for _, tt := range tests { diff --git a/pkg/model/types.go b/pkg/model/types.go index 454e225..8a7443d 100644 --- a/pkg/model/types.go +++ b/pkg/model/types.go @@ -8,10 +8,13 @@ const ( StatusDeleted Status = "deleted" ) +// Transport represents transport configuration for both Package and Remote contexts. +// For Remote context, the Variables field can be used for URL templating. type Transport struct { - Type string `json:"type" doc:"Transport type (stdio, streamable-http, or sse)" example:"stdio"` - URL string `json:"url,omitempty" doc:"URL for streamable-http or sse transports" example:"https://api.example.com/mcp"` - Headers []KeyValueInput `json:"headers,omitempty" doc:"HTTP headers for streamable-http or sse transports"` + Type string `json:"type" doc:"Transport type (stdio, streamable-http, or sse)" example:"stdio"` + URL string `json:"url,omitempty" doc:"URL for streamable-http or sse transports" example:"https://api.example.com/mcp"` + Headers []KeyValueInput `json:"headers,omitempty" doc:"HTTP headers for streamable-http or sse transports"` + Variables map[string]Input `json:"variables,omitempty" doc:"Variables for URL templating in remote transports"` } // Package represents a package configuration. diff --git a/tools/validate-examples/main.go b/tools/validate-examples/main.go index 41d8ba0..2e021a6 100644 --- a/tools/validate-examples/main.go +++ b/tools/validate-examples/main.go @@ -33,7 +33,7 @@ func main() { func runValidation() error { // Define what we validate and how - expectedServerJSONCount := 12 + expectedServerJSONCount := 15 targets := []validationTarget{ { path: filepath.Join("docs", "reference", "server-json", "generic-server-json.md"), From 453956d9758d73f0bc131a5867591bc1145ea5a9 Mon Sep 17 00:00:00 2001 From: Tadas Antanavicius Date: Fri, 12 Dec 2025 09:33:57 -0800 Subject: [PATCH 055/313] chore: Release server.json schema version 2025-12-11 (#841) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Prepared by Claude Code, iterated and reviewed by me. ## Summary This PR releases the server.json schema version `2025-12-11`, incorporating URL template variables for remote servers from #570. ### What's New - **URL Template Variables for Remote Servers** - Remote servers can now define configurable variables in URLs using `{curly_braces}` notation, enabling multi-tenant deployments. ### Schema Version - `2025-10-17` → `2025-12-11` ## Release Sequence 1. ~~**First: Merge static repo PR** - https://github.com/modelcontextprotocol/static/pull/11 (publishes schema to versioned URL)~~ 2. **Then: Merge this PR** - Updates registry code to reference the new schema version ## Changes in This PR - [x] Update CHANGELOG.md with release notes - [x] Update `CurrentSchemaVersion` in `pkg/model/constants.go` - [x] Update schema example URL in `docs/reference/api/openapi.yaml` - [x] Update schema URL in `pkg/api/v0/types.go` - [x] Update all documentation examples to use new schema version - [x] Regenerate `server.schema.json` ## Test Plan - [x] `make check` passes (lint, schema validation, example validation) - [x] Unit tests pass for validators and publisher commands 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.5 --- cmd/publisher/commands/publish_test.go | 4 +- data/seed.json | 8 +-- .../modelcontextprotocol-io/package-types.mdx | 10 +-- docs/modelcontextprotocol-io/quickstart.mdx | 4 +- .../registry-aggregators.mdx | 2 +- .../remote-servers.mdx | 66 +++++++++++++++++-- docs/modelcontextprotocol-io/versioning.mdx | 2 +- docs/reference/api/openapi.yaml | 2 +- docs/reference/server-json/CHANGELOG.md | 28 ++++++++ .../server-json/generic-server-json.md | 30 ++++----- docs/reference/server-json/server.schema.json | 2 +- pkg/api/v0/types.go | 2 +- pkg/model/constants.go | 2 +- 13 files changed, 124 insertions(+), 38 deletions(-) diff --git a/cmd/publisher/commands/publish_test.go b/cmd/publisher/commands/publish_test.go index 8527020..c18c004 100644 --- a/cmd/publisher/commands/publish_test.go +++ b/cmd/publisher/commands/publish_test.go @@ -44,8 +44,8 @@ func TestPublishCommand_DeprecatedSchema(t *testing.T) { errorSubstr: "deprecated schema detected", }, { - name: "current 2025-10-17 schema should pass validation", - schema: "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", + name: "current 2025-12-11 schema should pass validation", + schema: "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json", expectError: false, }, { diff --git a/data/seed.json b/data/seed.json index 92fa625..7f65a4a 100644 --- a/data/seed.json +++ b/data/seed.json @@ -1,6 +1,6 @@ [ { - "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", + "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json", "name": "io.github.domdomegg/airtable-mcp-server", "description": "Read and write access to Airtable database schemas, tables, and records.", "repository": { @@ -62,7 +62,7 @@ ] }, { - "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", + "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json", "name": "io.github.domdomegg/airtable-mcp-server", "description": "Read and write access to Airtable database schemas, tables, and records.", "repository": { @@ -115,7 +115,7 @@ ] }, { - "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", + "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json", "name": "io.github.domdomegg/time-mcp-nuget", "description": "Get the current UTC time in RFC 3339 format.", "repository": { @@ -136,7 +136,7 @@ ] }, { - "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", + "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json", "name": "io.github.domdomegg/time-mcp-pypi", "description": "Get the current UTC time in RFC 3339 format.", "repository": { diff --git a/docs/modelcontextprotocol-io/package-types.mdx b/docs/modelcontextprotocol-io/package-types.mdx index 57960a3..4ce97b2 100644 --- a/docs/modelcontextprotocol-io/package-types.mdx +++ b/docs/modelcontextprotocol-io/package-types.mdx @@ -15,7 +15,7 @@ npm packages use `"registryType": "npm"` in `server.json`. For example: ```json server.json highlight={9} { - "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", + "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json", "name": "io.github.username/email-integration-mcp", "title": "Email Integration", "description": "Send emails and manage email accounts", @@ -53,7 +53,7 @@ PyPI packages use `"registryType": "pypi"` in `server.json`. For example: ```json server.json highlight={9} { - "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", + "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json", "name": "io.github.username/database-query-mcp", "title": "Database Query", "description": "Execute SQL queries and manage database connections", @@ -91,7 +91,7 @@ NuGet packages use `"registryType": "nuget"` in `server.json`. For example: ```json server.json highlight={9} { - "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", + "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json", "name": "io.github.username/azure-devops-mcp", "title": "Azure DevOps", "description": "Manage Azure DevOps work items and pipelines", @@ -135,7 +135,7 @@ Docker/OCI images use `"registryType": "oci"` in `server.json`. For example: ```json server.json highlight={9} { - "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", + "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json", "name": "io.github.username/kubernetes-manager-mcp", "title": "Kubernetes Manager", "description": "Deploy and manage Kubernetes resources", @@ -170,7 +170,7 @@ MCPB packages use `"registryType": "mcpb"` in `server.json`. For example: ```json server.json highlight={9} { - "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", + "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json", "name": "io.github.username/image-processor-mcp", "title": "Image Processor", "description": "Process and transform images with various filters", diff --git a/docs/modelcontextprotocol-io/quickstart.mdx b/docs/modelcontextprotocol-io/quickstart.mdx index 212951f..c1c0301 100644 --- a/docs/modelcontextprotocol-io/quickstart.mdx +++ b/docs/modelcontextprotocol-io/quickstart.mdx @@ -143,7 +143,7 @@ Open the generated `server.json` file, and you should see contents like: ```json server.json { - "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", + "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json", "name": "io.github.my-username/weather", "description": "An MCP server for weather information.", "repository": { @@ -177,7 +177,7 @@ Edit the contents as necessary: ```diff server.json { - "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", + "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json", "name": "io.github.my-username/weather", "description": "An MCP server for weather information.", "repository": { diff --git a/docs/modelcontextprotocol-io/registry-aggregators.mdx b/docs/modelcontextprotocol-io/registry-aggregators.mdx index 685944f..07ebb1e 100644 --- a/docs/modelcontextprotocol-io/registry-aggregators.mdx +++ b/docs/modelcontextprotocol-io/registry-aggregators.mdx @@ -75,7 +75,7 @@ The subregistry OpenAPI spec allows subregistries to inject custom metadata via ```json server.json highlight={17-26} { - "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", + "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json", "name": "io.github.username/email-integration-mcp", "title": "Email Integration", "description": "Send emails and manage email accounts", diff --git a/docs/modelcontextprotocol-io/remote-servers.mdx b/docs/modelcontextprotocol-io/remote-servers.mdx index 4b0c85e..8e88748 100644 --- a/docs/modelcontextprotocol-io/remote-servers.mdx +++ b/docs/modelcontextprotocol-io/remote-servers.mdx @@ -7,7 +7,7 @@ The MCP Registry supports remote MCP servers via the `remotes` property in `serv ```json server.json highlight={7-12} { - "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", + "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json", "name": "com.example/acme-analytics", "title": "ACME Analytics", "description": "Real-time business intelligence and reporting platform", @@ -31,7 +31,7 @@ Specify the transport by setting the `type` property of the `remotes` entry to e ```json server.json highlight={9,13} { - "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", + "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json", "name": "com.example/acme-analytics", "title": "ACME Analytics", "description": "Real-time business intelligence and reporting platform", @@ -49,13 +49,71 @@ Specify the transport by setting the `type` property of the `remotes` entry to e } ``` +## URL Template Variables + +Remote servers can define URL template variables using `{curly_braces}` notation. This enables multi-tenant deployments where a single server definition can support multiple endpoints with configurable values: + +```json server.json highlight={10-17} +{ + "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json", + "name": "com.example/acme-analytics", + "title": "ACME Analytics", + "description": "Real-time business intelligence and reporting platform", + "version": "2.0.0", + "remotes": [ + { + "type": "streamable-http", + "url": "https://{tenant_id}.analytics.example.com/mcp", + "variables": { + "tenant_id": { + "description": "Your tenant identifier (e.g., 'us-cell1', 'emea-cell1')", + "isRequired": true + } + } + } + ] +} +``` + +When configuring this server, users provide their `tenant_id` value, and the URL template gets resolved to the appropriate endpoint (e.g., `https://us-cell1.analytics.example.com/mcp`). + +Variables support additional properties like `default`, `choices`, and `isSecret`: + +```json server.json highlight={12-22} +{ + "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json", + "name": "com.example/multi-region-mcp", + "title": "Multi-Region MCP", + "description": "MCP server with regional endpoints", + "version": "1.0.0", + "remotes": [ + { + "type": "streamable-http", + "url": "https://api.example.com/{region}/mcp", + "variables": { + "region": { + "description": "Deployment region", + "isRequired": true, + "choices": [ + "us-east-1", + "eu-west-1", + "ap-southeast-1" + ], + "default": "us-east-1" + } + } + } + ] +} +``` + ## HTTP Headers MCP clients can be instructed to send specific HTTP headers by adding the `headers` property to the `remotes` entry: ```json server.json highlight={11-18} { - "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", + "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json", "name": "com.example/acme-analytics", "title": "ACME Analytics", "description": "Real-time business intelligence and reporting platform", @@ -83,7 +141,7 @@ The `remotes` property can coexist with the `packages` property in `server.json` ```json server.json highlight={7-22} { - "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", + "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json", "name": "io.github.username/email-integration-mcp", "title": "Email Integration", "description": "Send emails and manage email accounts", diff --git a/docs/modelcontextprotocol-io/versioning.mdx b/docs/modelcontextprotocol-io/versioning.mdx index ddaedbe..7a4da6e 100644 --- a/docs/modelcontextprotocol-io/versioning.mdx +++ b/docs/modelcontextprotocol-io/versioning.mdx @@ -7,7 +7,7 @@ MCP servers **MUST** define a version string in `server.json`. For example: ```json server.json highlight={6} { - "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", + "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json", "name": "io.github.username/email-integration-mcp", "title": "Email Integration", "description": "Send emails and manage email accounts", diff --git a/docs/reference/api/openapi.yaml b/docs/reference/api/openapi.yaml index ceb6369..39098da 100644 --- a/docs/reference/api/openapi.yaml +++ b/docs/reference/api/openapi.yaml @@ -728,7 +728,7 @@ components: type: string format: uri description: JSON Schema URI for this server.json format - example: "https://static.modelcontextprotocol.io/schemas/draft/server.schema.json" + example: "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json" packages: type: array items: diff --git a/docs/reference/server-json/CHANGELOG.md b/docs/reference/server-json/CHANGELOG.md index 3fcf0c0..78d246d 100644 --- a/docs/reference/server-json/CHANGELOG.md +++ b/docs/reference/server-json/CHANGELOG.md @@ -16,6 +16,34 @@ When ready for release, changes in this section will be moved to a dated version --- +## 2025-12-11 + +### Changed + +#### URL Template Variables for Remote Servers ([#570](https://github.com/modelcontextprotocol/registry/pull/570)) + +Remote servers can now define URL template variables using `{curly_braces}` notation. This enables multi-tenant deployments where a single server definition can support multiple endpoints with configurable values. + +**Example:** +```json +{ + "remotes": [{ + "type": "streamable-http", + "url": "https://{tenant_id}.api.example.com/mcp", + "variables": { + "tenant_id": { + "description": "Your tenant identifier", + "isRequired": true + } + } + }] +} +``` + +**Migration:** No changes required. Existing servers continue to work unchanged. + +--- + ## 2025-10-17 ### Changed diff --git a/docs/reference/server-json/generic-server-json.md b/docs/reference/server-json/generic-server-json.md index 71a0ecc..b525bde 100644 --- a/docs/reference/server-json/generic-server-json.md +++ b/docs/reference/server-json/generic-server-json.md @@ -38,7 +38,7 @@ When publishing to the official registry, custom metadata must be placed under t ```json { - "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", + "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json", "name": "io.modelcontextprotocol.anonymous/brave-search", "description": "MCP server for Brave Search API integration", "title": "Brave Search", @@ -85,7 +85,7 @@ For MCP servers located within a subdirectory of a larger repository (monorepo s ```json { - "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", + "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json", "name": "io.modelcontextprotocol/everything", "description": "MCP server that exercises all the features of the MCP protocol", "title": "Everything", @@ -124,7 +124,7 @@ Suppose your MCP server application requires a `mcp start` CLI arguments to star ```json { - "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", + "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json", "name": "io.github.joelverhagen/knapcode-samplemcpserver", "description": "Sample NuGet MCP server for a random number and random weather", "version": "0.4.0-beta", @@ -168,7 +168,7 @@ This will essentially instruct the MCP client to execute `dnx Knapcode.SampleMcp ```json { - "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", + "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json", "name": "io.github.modelcontextprotocol/filesystem", "description": "Node.js server implementing Model Context Protocol (MCP) for filesystem operations.", "title": "Filesystem", @@ -268,7 +268,7 @@ This will essentially instruct the MCP client to execute `dnx Knapcode.SampleMcp ```json { - "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", + "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json", "name": "io.modelcontextprotocol.anonymous/mcp-fs", "description": "Cloud-hosted MCP filesystem server", "repository": { @@ -302,7 +302,7 @@ This will essentially instruct the MCP client to execute `dnx Knapcode.SampleMcp ```json { - "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", + "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json", "name": "io.github.example/weather-mcp", "description": "Python MCP server for weather data access", "title": "Weather", @@ -358,7 +358,7 @@ The `dnx` tool ships with the .NET 10 SDK, starting with Preview 6. ```json { - "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", + "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json", "name": "io.github.joelverhagen/knapcode-samplemcpserver", "description": "Sample NuGet MCP server for a random number and random weather", "repository": { @@ -407,7 +407,7 @@ The `dnx` tool ships with the .NET 10 SDK, starting with Preview 6. ```json { - "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", + "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json", "name": "io.github.example/database-manager", "description": "MCP server for database operations with support for multiple database types", "repository": { @@ -516,7 +516,7 @@ The `dnx` tool ships with the .NET 10 SDK, starting with Preview 6. ```json { - "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", + "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json", "name": "io.modelcontextprotocol.anonymous/hybrid-mcp", "description": "MCP server available as both local package and remote service", "title": "Hybrid", @@ -602,7 +602,7 @@ The `dnx` tool ships with the .NET 10 SDK, starting with Preview 6. ```json { - "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", + "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json", "name": "io.modelcontextprotocol/text-editor", "description": "MCP Bundle server for advanced text editing capabilities", "title": "Text Editor", @@ -645,7 +645,7 @@ Some CLI tools bundle an MCP server, without a standalone MCP package or a publi ```json { - "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", + "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json", "name": "io.snyk/cli-mcp", "description": "MCP server provided by the Snyk CLI", "title": "Snyk", @@ -680,7 +680,7 @@ For MCP servers that follow a custom installation path or are embedded in applic ```json { - "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", + "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json", "name": "io.modelcontextprotocol.anonymous/embedded-mcp", "description": "MCP server embedded in a Desktop app", "websiteUrl": "https://anonymous.modelcontextprotocol.io/embedded-mcp-guide", @@ -695,7 +695,7 @@ This example demonstrates URL templating for remote servers, useful for multi-te ```json { - "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", + "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json", "name": "io.modelcontextprotocol.anonymous/multi-tenant-server", "description": "MCP server with configurable remote endpoint", "title": "Multi-Tenant Server", @@ -721,7 +721,7 @@ The same URL templating works with SSE transport: ```json { - "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", + "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json", "name": "io.modelcontextprotocol.anonymous/events-server", "description": "MCP server using SSE with tenant-specific endpoints", "version": "1.0.0", @@ -746,7 +746,7 @@ This example demonstrates URL templating for local/package servers, where variab ```json { - "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", + "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json", "name": "io.github.example/configurable-server", "description": "Local MCP server with configurable port", "title": "Configurable Server", diff --git a/docs/reference/server-json/server.schema.json b/docs/reference/server-json/server.schema.json index 5c1c51d..e25191b 100644 --- a/docs/reference/server-json/server.schema.json +++ b/docs/reference/server-json/server.schema.json @@ -404,7 +404,7 @@ "properties": { "$schema": { "description": "JSON Schema URI for this server.json format", - "example": "https://static.modelcontextprotocol.io/schemas/draft/server.schema.json", + "example": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json", "format": "uri", "type": "string" }, diff --git a/pkg/api/v0/types.go b/pkg/api/v0/types.go index b6eab37..513e125 100644 --- a/pkg/api/v0/types.go +++ b/pkg/api/v0/types.go @@ -32,7 +32,7 @@ type ServerMeta struct { } type ServerJSON struct { - Schema string `json:"$schema" required:"true" minLength:"1" format:"uri" doc:"JSON Schema URI for this server.json format" example:"https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json"` + Schema string `json:"$schema" required:"true" minLength:"1" format:"uri" doc:"JSON Schema URI for this server.json format" example:"https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json"` Name string `json:"name" minLength:"3" maxLength:"200" pattern:"^[a-zA-Z0-9.-]+/[a-zA-Z0-9._-]+$" doc:"Server name in reverse-DNS format. Must contain exactly one forward slash separating namespace from server name." example:"io.github.user/weather"` Description string `json:"description" minLength:"1" maxLength:"100" doc:"Clear human-readable explanation of server functionality." example:"MCP server providing weather data and forecasts via OpenWeatherMap API"` Title string `json:"title,omitempty" minLength:"1" maxLength:"100" doc:"Optional human-readable title or display name for the MCP server." example:"Weather API"` diff --git a/pkg/model/constants.go b/pkg/model/constants.go index 1473c92..e817f2a 100644 --- a/pkg/model/constants.go +++ b/pkg/model/constants.go @@ -36,7 +36,7 @@ const ( // Schema versions const ( // CurrentSchemaVersion is the current supported schema version date - CurrentSchemaVersion = "2025-10-17" + CurrentSchemaVersion = "2025-12-11" // CurrentSchemaURL is the full URL to the current schema CurrentSchemaURL = "https://static.modelcontextprotocol.io/schemas/" + CurrentSchemaVersion + "/server.schema.json" ) From c179f71215a4e88bbb8af016c903e4369614daa1 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 12 Dec 2025 09:38:39 -0800 Subject: [PATCH 056/313] build(deps): bump the actions group across 1 directory with 4 updates (#836) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps the actions group with 4 updates in the / directory: [actions/checkout](https://github.com/actions/checkout), [actions/setup-go](https://github.com/actions/setup-go), [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) and [anchore/sbom-action](https://github.com/anchore/sbom-action). Updates `actions/checkout` from 5.0.1 to 6.0.1
Release notes

Sourced from actions/checkout's releases.

v6.0.1

What's Changed

Full Changelog: https://github.com/actions/checkout/compare/v6...v6.0.1

v6.0.0

What's Changed

Full Changelog: https://github.com/actions/checkout/compare/v5.0.0...v6.0.0

v6-beta

What's Changed

Updated persist-credentials to store the credentials under $RUNNER_TEMP instead of directly in the local git config.

This requires a minimum Actions Runner version of v2.329.0 to access the persisted credentials for Docker container action scenarios.

Changelog

Sourced from actions/checkout's changelog.

Changelog

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

v4.2.0

v4.1.7

v4.1.6

v4.1.5

... (truncated)

Commits

Updates `actions/setup-go` from 6.0.0 to 6.1.0
Release notes

Sourced from actions/setup-go's releases.

v6.1.0

What's Changed

Enhancements

Dependency updates

New Contributors

Full Changelog: https://github.com/actions/setup-go/compare/v6...v6.1.0

Commits
  • 4dc6199 Bump semver and @​types/semver (#652)
  • f3787be Add comprehensive breaking changes documentation for v6 (#674)
  • 3a0c2c8 Bump actions/publish-action from 0.3.0 to 0.4.0 (#641)
  • faf5242 Add support for .tool-versions file in setup-go, update workflow (#673)
  • 7bc60db Fall back to downloading from go.dev/dl instead of storage.googleapis.com/gol...
  • c0137ca Bump eslint-config-prettier from 10.0.1 to 10.1.8 and document breaking chang...
  • See full diff in compare view

Updates `golangci/golangci-lint-action` from 9.0.0 to 9.2.0
Release notes

Sourced from golangci/golangci-lint-action's releases.

v9.2.0

What's Changed

Changes

Dependencies

Full Changelog: https://github.com/golangci/golangci-lint-action/compare/v9.1.0...v9.2.0

v9.1.0

What's Changed

Changes

Documentation

Dependencies

Full Changelog: https://github.com/golangci/golangci-lint-action/compare/v9.0.0...v9.1.0

Commits

Updates `anchore/sbom-action` from 0.20.10 to 0.20.11
Release notes

Sourced from anchore/sbom-action's releases.

v0.20.11

Changes in v0.20.11

Commits
  • 43a17d6 chore(deps): update Syft to v1.38.2 (#557)
  • 4df6110 chore(deps): bump @​octokit/plugin-paginate-rest, @​actions/artifact and @​actio...
  • 2df107d chore(deps): bump js-yaml (#552)
  • ef53eb7 chore(deps): bump actions/checkout from 5.0.0 to 6.0.1 (#555)
  • 5758fe4 chore(deps): bump peter-evans/create-pull-request from 7.0.8 to 7.0.11 (#556)
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
--------- Signed-off-by: dependabot[bot] Signed-off-by: Radoslav Dimitrov Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Radoslav Dimitrov --- .github/workflows/cancel-pulumi-lock.yml | 2 +- .github/workflows/ci.yml | 11 ++++++----- .github/workflows/claude.yml | 2 +- .github/workflows/deploy-production.yml | 4 ++-- .github/workflows/deploy-staging.yml | 8 ++++---- .github/workflows/release.yml | 10 +++++----- 6 files changed, 19 insertions(+), 18 deletions(-) diff --git a/.github/workflows/cancel-pulumi-lock.yml b/.github/workflows/cancel-pulumi-lock.yml index 4f5753e..345c0be 100644 --- a/.github/workflows/cancel-pulumi-lock.yml +++ b/.github/workflows/cancel-pulumi-lock.yml @@ -24,7 +24,7 @@ jobs: environment: ${{ inputs.environment }} steps: - name: Checkout code - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd + uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 - name: Setup Pulumi uses: pulumi/actions@8582a9e8cc630786854029b4e09281acd6794b58 diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index fc733be..372323a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -16,16 +16,16 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd + uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 - name: Set up Go - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 + uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c with: go-version-file: 'go.mod' cache: true - name: Run lint - uses: golangci/golangci-lint-action@0a35821d5c230e903fcfe077583637dea1b27b47 + uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 with: version: v2.4.0 @@ -41,6 +41,7 @@ jobs: go-version-input: '' go-version-file: go.mod go-package: ./... + repo-checkout: false # All Tests tests: @@ -48,10 +49,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd + uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 - name: Set up Go - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 + uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c with: go-version-file: 'go.mod' cache: true diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index a1bb804..97a8a40 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -57,7 +57,7 @@ jobs: echo "is_fork=$(echo "$PR_DATA" | jq -r '.head.repo.fork')" >> $GITHUB_OUTPUT - name: Checkout repository - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd + uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 with: fetch-depth: 1 # For fork PRs, checkout via PR ref; otherwise use the branch directly diff --git a/.github/workflows/deploy-production.yml b/.github/workflows/deploy-production.yml index 1be796c..7faa128 100644 --- a/.github/workflows/deploy-production.yml +++ b/.github/workflows/deploy-production.yml @@ -23,10 +23,10 @@ jobs: cancel-in-progress: false steps: - name: Checkout code - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd + uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 - name: Setup Go - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 + uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c with: go-version-file: 'go.mod' cache: true diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml index 309ce09..04a93b1 100644 --- a/.github/workflows/deploy-staging.yml +++ b/.github/workflows/deploy-staging.yml @@ -22,10 +22,10 @@ jobs: packages: write steps: - name: Checkout repository - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd + uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 - name: Set up Go - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 + uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c with: go-version-file: 'go.mod' cache: true @@ -70,10 +70,10 @@ jobs: cancel-in-progress: false steps: - name: Checkout code - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd + uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 - name: Setup Go - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 + uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c with: go-version-file: 'go.mod' cache: true diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 2abb732..648e271 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -14,12 +14,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd + uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 with: fetch-depth: 0 - name: Set up Go - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 + uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c with: go-version-file: 'go.mod' cache: true @@ -28,7 +28,7 @@ jobs: uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0 - name: Install Syft - uses: anchore/sbom-action/download-syft@v0.20.10 + uses: anchore/sbom-action/download-syft@v0.20.11 - name: Run GoReleaser uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a @@ -45,10 +45,10 @@ jobs: needs: goreleaser steps: - name: Checkout - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd + uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 - name: Set up Go - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 + uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c with: go-version-file: 'go.mod' cache: true From 9357e767c94204e97edb1683824765928bac8926 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Fri, 12 Dec 2025 22:48:23 +0200 Subject: [PATCH 057/313] Add a PUT method to the OpenAPI specification (#838) ## Motivation and Context The following PR adds a PUT method for updating a server version (optional, not implemented by the registry but still provides the ability for other registry implementations to standardise on it) **Details:** - Path: PUT /v0.1/servers/{serverName}/versions/{version} - Purpose: Update a specific version of an MCP server in the registry - Authentication: Uses bearer token authentication (registry-specific) - Request Body: Accepts a ServerDetail schema - Response: Returns a ServerResponse on success (200) - Error Handling: Includes proper HTTP status codes: - 401: Unauthorized - 403: Forbidden - Insufficient permissions - 404: Server or version not found - 500: Internal server error - 501: Not Implemented - Registry doesn't support updates ## How Has This Been Tested? ## Breaking Changes ## Types of changes - [ ] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] Documentation update ## Checklist - [ ] I have read the [MCP Documentation](https://modelcontextprotocol.io) - [ ] My code follows the repository's style guidelines - [ ] New and existing tests pass locally - [ ] I have added appropriate error handling - [ ] I have added or updated documentation as needed ## Additional context Signed-off-by: Radoslav Dimitrov --- docs/reference/api/generic-registry-api.md | 1 + docs/reference/api/openapi.yaml | 89 ++++++++++++++++++++++ 2 files changed, 90 insertions(+) diff --git a/docs/reference/api/generic-registry-api.md b/docs/reference/api/generic-registry-api.md index e8a78bf..5832e53 100644 --- a/docs/reference/api/generic-registry-api.md +++ b/docs/reference/api/generic-registry-api.md @@ -18,6 +18,7 @@ The official registry has some more endpoints and restrictions on top of this. S - **`GET /v0.1/servers/{serverName}/versions`** - List all versions of a server - **`GET /v0.1/servers/{serverName}/versions/{version}`** - Get specific version of server. Use the special version `latest` to get the latest version. - **`POST /v0.1/publish`** - Publish new server (optional, registry-specific authentication) +- **`PUT /v0.1/servers/{serverName}/versions/{version}`** - Update specific server version (optional, not implemented by official registry) - **`DELETE /v0.1/servers/{serverName}/versions/{version}`** - Delete specific server version (optional, not implemented by official registry) Server names and version strings should be URL-encoded in paths. diff --git a/docs/reference/api/openapi.yaml b/docs/reference/api/openapi.yaml index 39098da..e05c934 100644 --- a/docs/reference/api/openapi.yaml +++ b/docs/reference/api/openapi.yaml @@ -135,6 +135,95 @@ paths: error: type: string example: "Server not found" + put: + tags: [publish] + summary: Update specific MCP server version (Optional) + description: | + Update a specific version of an MCP server in the registry. + + **Note**: This endpoint is optional for registry implementations and is not implemented by the official MCP registry. It is included in the specification to standardize the update mechanism for registry implementations that choose to support it. + + Authentication mechanism is registry-specific and may vary between implementations. + security: + - bearerAuth: [] + parameters: + - name: serverName + in: path + required: true + description: URL-encoded server name (e.g., "com.example%2Fmy-server") + schema: + type: string + example: "com.example%2Fmy-server" + - name: version + in: path + required: true + description: URL-encoded version to update (e.g., "1.0.0" or "1.0.0%2B20130313144700" for versions with build metadata) + schema: + type: string + example: "1.0.0" + requestBody: + required: true + content: + application/json: + schema: + $ref: '#/components/schemas/ServerDetail' + responses: + '200': + description: Successfully updated server version + content: + application/json: + schema: + $ref: '#/components/schemas/ServerResponse' + '401': + description: Unauthorized - Invalid or missing authentication token + content: + application/json: + schema: + type: object + properties: + error: + type: string + example: "Invalid or expired Registry JWT token" + '403': + description: Forbidden - Insufficient permissions + content: + application/json: + schema: + type: object + properties: + error: + type: string + example: "You do not have permission to update this server" + '404': + description: Server or version not found + content: + application/json: + schema: + type: object + properties: + error: + type: string + example: "Server version not found" + '500': + description: Internal server error + content: + application/json: + schema: + type: object + properties: + error: + type: string + example: "Failed to update server version" + '501': + description: Not Implemented - Registry does not support updates + content: + application/json: + schema: + type: object + properties: + error: + type: string + example: "Updates are not supported by this registry" delete: tags: [publish] summary: Delete specific MCP server version (Optional) From 19c58c15d57bf9e480da43a95bf6574c638a9dc8 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Sat, 13 Dec 2025 00:38:26 +0200 Subject: [PATCH 058/313] Add NGINX ingress rate limiting to protect against traffic spikes (#843) ## Motivation and Context The following is an alternative solution to #833 Goal is to deploy and promote it to prod, then monitor the alerts for a week to see its effect and reassess. In case it's actual traffic that we've started blocking we can also up the replicas. I thought it doesn't make sense to up them now since it would be nice to isolate the result of this change first. ## How Has This Been Tested? ## Breaking Changes ## Types of changes - [ ] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] Documentation update ## Checklist - [ ] I have read the [MCP Documentation](https://modelcontextprotocol.io) - [ ] My code follows the repository's style guidelines - [ ] New and existing tests pass locally - [ ] I have added appropriate error handling - [ ] I have added or updated documentation as needed ## Additional context --------- Signed-off-by: Radoslav Dimitrov --- deploy/pkg/k8s/registry.go | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/deploy/pkg/k8s/registry.go b/deploy/pkg/k8s/registry.go index d4a3c13..346f292 100644 --- a/deploy/pkg/k8s/registry.go +++ b/deploy/pkg/k8s/registry.go @@ -246,6 +246,11 @@ func DeployMCPRegistry(ctx *pulumi.Context, cluster *providers.ProviderInfo, env Annotations: pulumi.StringMap{ "cert-manager.io/cluster-issuer": pulumi.String("letsencrypt-prod"), "kubernetes.io/ingress.class": pulumi.String("nginx"), + // Rate limiting to protect against abuse + // Allows 180 requests/minute (3 req/sec avg), with bursts up to 540 requests + "nginx.ingress.kubernetes.io/limit-rpm": pulumi.String("180"), + "nginx.ingress.kubernetes.io/limit-burst-multiplier": pulumi.String("3"), + "nginx.ingress.kubernetes.io/limit-req-status-code": pulumi.String("429"), }, }, Spec: &networkingv1.IngressSpecArgs{ From 3692b995b2b250b3b76494458d0248d260eeb952 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 13 Dec 2025 09:36:19 +0200 Subject: [PATCH 059/313] build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 in the actions group (#846) --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 372323a..cc4f8f2 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -64,7 +64,7 @@ jobs: run: make test-all - name: Upload coverage artifacts - uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f with: name: coverage-report path: | From 7cfd3f04c71df3dfc4c58d3386f2ad1de0211117 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 13 Dec 2025 09:36:42 +0200 Subject: [PATCH 060/313] build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.210.0 to 3.212.0 in /deploy (#847) --- deploy/go.mod | 4 ++-- deploy/go.sum | 7 ++++--- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index 77b941c..06946e4 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -5,7 +5,7 @@ go 1.24.11 require ( github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.24.1 - github.com/pulumi/pulumi/sdk/v3 v3.210.0 + github.com/pulumi/pulumi/sdk/v3 v3.212.0 gopkg.in/yaml.v2 v2.4.0 ) @@ -68,7 +68,7 @@ require ( github.com/skeema/knownhosts v1.3.1 // indirect github.com/spf13/cast v1.4.1 // indirect github.com/spf13/cobra v1.10.1 // indirect - github.com/spf13/pflag v1.0.9 // indirect + github.com/spf13/pflag v1.0.10 // indirect github.com/stretchr/objx v0.2.0 // indirect github.com/texttheater/golang-levenshtein v1.0.1 // indirect github.com/uber/jaeger-client-go v2.30.0+incompatible // indirect diff --git a/deploy/go.sum b/deploy/go.sum index 7f77dec..69d48eb 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -158,8 +158,8 @@ github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 h1:w6OnO3d4j5yVf2vpm8OzXFC/xHOEGqt+9 github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1/go.mod h1:UyZyv7hz4knpFx6/Sh+SkZe6hT6sJHtDvw9A0TbvEsk= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.24.1 h1:L1J2/PHgAziDXUvOWJ4HH1JBlgxzpQseZiEIu4K2x34= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.24.1/go.mod h1:vNiMC/N8GNHvDwU3gQRXQ6V+kbgSl5N/lKtfrUjGuXU= -github.com/pulumi/pulumi/sdk/v3 v3.210.0 h1:QMNdfQfB7jCa/ZoY8aIfwOwApuvhnOoIH8s4umNvR3U= -github.com/pulumi/pulumi/sdk/v3 v3.210.0/go.mod h1:0qnUzUV5ypAcdoPNOX426wV4ePMnkDvGlPBZqlizHmU= +github.com/pulumi/pulumi/sdk/v3 v3.212.0 h1:YQKFamkd+3sqcbFUi+sq50DejdymayYbqaz+OQnSvug= +github.com/pulumi/pulumi/sdk/v3 v3.212.0/go.mod h1:Bn5Z9Rzp1lPqdAccaB+F2ivUBiamEl2TNR3Gg/h7iLs= github.com/rivo/uniseg v0.1.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc= github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc= github.com/rivo/uniseg v0.4.4 h1:8TfxU8dW6PdqD27gjM8MVNuicgxIjxpm4K7x4jp8sis= @@ -178,8 +178,9 @@ github.com/spf13/cast v1.4.1 h1:s0hze+J0196ZfEMTs80N7UlFt0BDuQ7Q+JDnHiMWKdA= github.com/spf13/cast v1.4.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE= github.com/spf13/cobra v1.10.1 h1:lJeBwCfmrnXthfAupyUTzJ/J4Nc1RsHC/mSRU2dll/s= github.com/spf13/cobra v1.10.1/go.mod h1:7SmJGaTHFVBY0jW4NXGluQoLvhqFQM+6XSKD+P4XaB0= -github.com/spf13/pflag v1.0.9 h1:9exaQaMOCwffKiiiYk6/BndUBv+iRViNW+4lEMi0PvY= github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= +github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk= +github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= github.com/stretchr/objx v0.2.0 h1:Hbg2NidpLE8veEBkEZTL3CvlkUIVzuU9jDplZO54c48= github.com/stretchr/objx v0.2.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE= From fef7d3e2acd5b85165d293c7f9f5bb019e85491b Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Sat, 13 Dec 2025 18:28:12 +0200 Subject: [PATCH 061/313] Preserve client IPs and bump NGINX replicas (#848) ## Motivation and Context A few changes related to configuring the rate limiting: * Set `externalTrafficPolicy: Local` to preserve real client IPs (otherwise we only see the cluster IPs) * Disable `use-forwarded-headers` (L4 LB doesn't set `X-Forwarded-For`, prevents spoofing) * Scale NGINX to 2 replicas in prod (costs nothing, gives us zero-downtime deploys to prod) ## How Has This Been Tested? ## Breaking Changes ## Types of changes - [ ] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] Documentation update ## Checklist - [ ] I have read the [MCP Documentation](https://modelcontextprotocol.io) - [ ] My code follows the repository's style guidelines - [ ] New and existing tests pass locally - [ ] I have added appropriate error handling - [ ] I have added or updated documentation as needed ## Additional context Signed-off-by: Radoslav Dimitrov --- deploy/pkg/k8s/ingress.go | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-) diff --git a/deploy/pkg/k8s/ingress.go b/deploy/pkg/k8s/ingress.go index e1ee50b..a3fcf29 100644 --- a/deploy/pkg/k8s/ingress.go +++ b/deploy/pkg/k8s/ingress.go @@ -40,6 +40,14 @@ func SetupIngressController(ctx *pulumi.Context, cluster *providers.ProviderInfo return "LoadBalancer" }).(pulumi.StringOutput) + // Configure replicas based on environment + // Staging: 1 replica (sufficient for testing, allows brief downtime during deploys) + // Production: 2 replicas (HA, zero-downtime deploys, node-level resilience) + replicaCount := 1 + if environment == "prod" { + replicaCount = 2 + } + // Install NGINX Ingress Controller ingressNginx, err := helm.NewChart(ctx, "ingress-nginx", helm.ChartArgs{ Chart: pulumi.String("ingress-nginx"), @@ -50,9 +58,11 @@ func SetupIngressController(ctx *pulumi.Context, cluster *providers.ProviderInfo Namespace: ingressNginxNamespace.Metadata.Name().Elem(), Values: pulumi.Map{ "controller": pulumi.Map{ + "replicaCount": pulumi.Int(replicaCount), "service": pulumi.Map{ - "type": serviceType, - "annotations": pulumi.Map{}, + "type": serviceType, + "externalTrafficPolicy": pulumi.String("Local"), + "annotations": pulumi.Map{}, }, "config": pulumi.Map{ // Disable strict path validation, to work around a bug in ingress-nginx @@ -60,8 +70,10 @@ func SetupIngressController(ctx *pulumi.Context, cluster *providers.ProviderInfo // https://github.com/kubernetes/ingress-nginx/issues/11176 "strict-validate-path-type": pulumi.String("false"), - // Use forwarded headers for proper client IP handling - "use-forwarded-headers": pulumi.String("true"), + // Do NOT use forwarded headers with L4 load balancer + // GCP L4 Passthrough Network Load Balancer does not set X-Forwarded-For + // Real client IP comes from TCP connection source with externalTrafficPolicy: Local + "use-forwarded-headers": pulumi.String("false"), }, }, }, From 731198572b929b9d98894ff69fa42b345b78e4e1 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Sat, 13 Dec 2025 22:34:12 +0200 Subject: [PATCH 062/313] Set 429 status code responses in the config map (#849) ## Motivation and Context Seems that per ingress annotations were not working, so had to put them in the ingress configmap. Did tested this manually on staging so it's confirmed it's working (I was getting 429s instead of 503s) and no traffic was getting into the registry pod. ## How Has This Been Tested? ## Breaking Changes ## Types of changes - [ ] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] Documentation update ## Checklist - [ ] I have read the [MCP Documentation](https://modelcontextprotocol.io) - [ ] My code follows the repository's style guidelines - [ ] New and existing tests pass locally - [ ] I have added appropriate error handling - [ ] I have added or updated documentation as needed ## Additional context Signed-off-by: Radoslav Dimitrov --- deploy/pkg/k8s/ingress.go | 3 +++ deploy/pkg/k8s/registry.go | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/deploy/pkg/k8s/ingress.go b/deploy/pkg/k8s/ingress.go index a3fcf29..4a24961 100644 --- a/deploy/pkg/k8s/ingress.go +++ b/deploy/pkg/k8s/ingress.go @@ -74,6 +74,9 @@ func SetupIngressController(ctx *pulumi.Context, cluster *providers.ProviderInfo // GCP L4 Passthrough Network Load Balancer does not set X-Forwarded-For // Real client IP comes from TCP connection source with externalTrafficPolicy: Local "use-forwarded-headers": pulumi.String("false"), + + // Set rate limit rejection status code to 429 (Too Many Requests) + "limit-req-status-code": pulumi.String("429"), }, }, }, diff --git a/deploy/pkg/k8s/registry.go b/deploy/pkg/k8s/registry.go index 346f292..71d5f75 100644 --- a/deploy/pkg/k8s/registry.go +++ b/deploy/pkg/k8s/registry.go @@ -248,9 +248,9 @@ func DeployMCPRegistry(ctx *pulumi.Context, cluster *providers.ProviderInfo, env "kubernetes.io/ingress.class": pulumi.String("nginx"), // Rate limiting to protect against abuse // Allows 180 requests/minute (3 req/sec avg), with bursts up to 540 requests + // Status code 429 is set globally via NGINX ConfigMap (per-Ingress annotation doesn't work) "nginx.ingress.kubernetes.io/limit-rpm": pulumi.String("180"), "nginx.ingress.kubernetes.io/limit-burst-multiplier": pulumi.String("3"), - "nginx.ingress.kubernetes.io/limit-req-status-code": pulumi.String("429"), }, }, Spec: &networkingv1.IngressSpecArgs{ From 05d282002a53fbe15631928a76ac1bb486e361e9 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Tue, 16 Dec 2025 16:05:26 +0200 Subject: [PATCH 063/313] Revert "Restrict @claude bot to mcp org only, fix fork behavior" (#851) Reverts modelcontextprotocol/registry#819 --- .github/workflows/claude.yml | 33 --------------------------------- 1 file changed, 33 deletions(-) diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index 97a8a40..36a9fc2 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -25,43 +25,10 @@ jobs: id-token: write actions: read steps: - # Only allow modelcontextprotocol org members to trigger @claude - # This enables @claude to work on external fork PRs when triggered by org members - # Members list is fetched from modelcontextprotocol/access repo - - name: Check if org member - run: | - ACTOR="${{ github.triggering_actor }}" - USERS_URL="https://raw.githubusercontent.com/modelcontextprotocol/access/main/src/config/users.ts" - - # Fetch users.ts and extract GitHub usernames - MEMBERS=$(curl -fsSL "$USERS_URL" | grep -oE 'github:\s*"[^"]+"' | sed 's/github:\s*"//;s/"$//') - - if echo "$MEMBERS" | grep -qxF "$ACTOR"; then - echo "User $ACTOR is a member of modelcontextprotocol org" - else - echo "::error::User $ACTOR is not a member of the modelcontextprotocol org. Only org members can trigger @claude." - exit 1 - fi - - # For PR comments, get PR details to checkout the correct branch (including forks) - - name: Get PR details - id: pr - if: github.event.issue.pull_request - env: - GH_TOKEN: ${{ github.token }} - run: | - PR_DATA=$(gh api ${{ github.event.issue.pull_request.url }}) - echo "number=$(echo "$PR_DATA" | jq -r '.number')" >> $GITHUB_OUTPUT - echo "head_ref=$(echo "$PR_DATA" | jq -r '.head.ref')" >> $GITHUB_OUTPUT - echo "head_repo=$(echo "$PR_DATA" | jq -r '.head.repo.full_name')" >> $GITHUB_OUTPUT - echo "is_fork=$(echo "$PR_DATA" | jq -r '.head.repo.fork')" >> $GITHUB_OUTPUT - - name: Checkout repository uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 with: fetch-depth: 1 - # For fork PRs, checkout via PR ref; otherwise use the branch directly - ref: ${{ steps.pr.outputs.is_fork == 'true' && format('refs/pull/{0}/head', steps.pr.outputs.number) || steps.pr.outputs.head_ref || github.ref }} - name: Run Claude Code id: claude From d71df40c81efb7b3194f343cbf0fa2784dd15027 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Tue, 16 Dec 2025 19:46:54 +0200 Subject: [PATCH 064/313] Promote prod to 1.4.0 (#852) ## Motivation and Context The following PR promotes the version of the registry in prod to 1.4.0 ## How Has This Been Tested? ## Breaking Changes ## Types of changes - [ ] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] Documentation update ## Checklist - [ ] I have read the [MCP Documentation](https://modelcontextprotocol.io) - [ ] My code follows the repository's style guidelines - [ ] New and existing tests pass locally - [ ] I have added appropriate error handling - [ ] I have added or updated documentation as needed ## Additional context Signed-off-by: Radoslav Dimitrov --- deploy/Pulumi.gcpProd.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/deploy/Pulumi.gcpProd.yaml b/deploy/Pulumi.gcpProd.yaml index bcdfedf..5f463d2 100644 --- a/deploy/Pulumi.gcpProd.yaml +++ b/deploy/Pulumi.gcpProd.yaml @@ -1,7 +1,7 @@ config: mcp-registry:environment: prod mcp-registry:provider: gcp - mcp-registry:imageTag: 1.3.10 # Set specific image tag for production (change this to deploy different versions) + mcp-registry:imageTag: 1.4.0 # Set specific image tag for production (change this to deploy different versions) gcp:project: mcp-registry-prod mcp-registry:githubClientId: Iv23liUydBbI7Z2Q9bOZ mcp-registry:githubClientSecret: From cc1e665b324a8d8e72f4e85af844a1e97260d94b Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Tue, 16 Dec 2025 23:01:55 +0200 Subject: [PATCH 065/313] Ensure no downtime during rollouts (#854) ## Motivation and Context The following PR ensures we don't have downtime when we are doing rollouts during deployment/promotions. ## How Has This Been Tested? ## Breaking Changes ## Types of changes - [ ] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] Documentation update ## Checklist - [ ] I have read the [MCP Documentation](https://modelcontextprotocol.io) - [ ] My code follows the repository's style guidelines - [ ] New and existing tests pass locally - [ ] I have added appropriate error handling - [ ] I have added or updated documentation as needed ## Additional context Signed-off-by: Radoslav Dimitrov --- deploy/pkg/k8s/registry.go | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/deploy/pkg/k8s/registry.go b/deploy/pkg/k8s/registry.go index 71d5f75..4655203 100644 --- a/deploy/pkg/k8s/registry.go +++ b/deploy/pkg/k8s/registry.go @@ -72,6 +72,13 @@ func DeployMCPRegistry(ctx *pulumi.Context, cluster *providers.ProviderInfo, env }, Spec: &v1.DeploymentSpecArgs{ Replicas: pulumi.Int(2), + Strategy: &v1.DeploymentStrategyArgs{ + Type: pulumi.String("RollingUpdate"), + RollingUpdate: &v1.RollingUpdateDeploymentArgs{ + MaxUnavailable: pulumi.IntPtr(0), // Never reduce capacity during updates + MaxSurge: pulumi.IntPtr(1), // Create new pods first, then terminate old + }, + }, Selector: &metav1.LabelSelectorArgs{ MatchLabels: pulumi.StringMap{ "app": pulumi.String("mcp-registry"), From 4338ec157ac06f3979adbef3ff0ce8f2606d2154 Mon Sep 17 00:00:00 2001 From: Benedikt Reinartz Date: Tue, 16 Dec 2025 22:59:39 +0100 Subject: [PATCH 066/313] Default to the local registry in the UI (#799) Change the UI default to the locally hosted registry. ## Motivation and Context Was quite confusing at first :) ## Types of changes - [ ] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] Documentation update ## Checklist - [x] I have read the [MCP Documentation](https://modelcontextprotocol.io) - [x] My code follows the repository's style guidelines - [x] New and existing tests pass locally - [x] I have added appropriate error handling - [ ] I have added or updated documentation as needed --- internal/api/handlers/v0/ui_index.html | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/internal/api/handlers/v0/ui_index.html b/internal/api/handlers/v0/ui_index.html index ba04a4b..38bac7f 100644 --- a/internal/api/handlers/v0/ui_index.html +++ b/internal/api/handlers/v0/ui_index.html @@ -147,7 +147,7 @@ // Get base URL based on selection function getBaseUrl() { - const selection = localStorage.getItem('baseUrl') || 'prod'; + const selection = localStorage.getItem('baseUrl') || 'local'; const customUrl = localStorage.getItem('customUrl') || ''; switch (selection) { @@ -166,7 +166,7 @@ // Get server display name function getServerName() { - const selection = localStorage.getItem('baseUrl') || 'prod'; + const selection = localStorage.getItem('baseUrl') || 'local'; const customUrl = localStorage.getItem('customUrl') || ''; switch (selection) { From 9afbaacdfdf8966d73de09a795076fb0386c5c3d Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 18 Dec 2025 09:46:18 +0200 Subject: [PATCH 067/313] build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.212.0 to 3.213.0 in /deploy (#856) Bumps [github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from 3.212.0 to 3.213.0.
Release notes

Sourced from github.com/pulumi/pulumi/sdk/v3's releases.

v3.213.0

3.213.0 (2025-12-17)

Bug Fixes

  • [sdkgen/go] Generate three-level nested builtin output types for Go SDK #21248

Miscellaneous

  • [pkg] Move plugin downloading from pkg into sdk #21220
Changelog

Sourced from github.com/pulumi/pulumi/sdk/v3's changelog.

Changelog

Commits
  • b5f037a Bump SDK versions for 3.213.0 (#21269)
  • e317952 add infrastructure to exclude known issues from fuzzing (#21267)
  • 312929f Do not assert that the pulumi/templates repo contains aws-javascript (#21280)
  • 777230b add fuzzing failures to gitignore (#21264)
  • fe2c4cb catch panics in the engine, and turn them into errors for fuzzing (#20955)
  • de5e586 python auto api tests: fix flakes because of existing stacks (#21265)
  • 6d4aa06 Add doc for sdk/go/pulumi-internal/ (#21263)
  • a3350da Add a backporting of type-alias of workspace.PluginSpec (#21262)
  • 27f635e Remove sdk/go/pulumi/internals/empty.s (#21261)
  • 29b4e67 Expand PackageSpec allow representing a full PluginDescriptor (#21254)
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/pulumi/pulumi/sdk/v3&package-manager=go_modules&previous-version=3.212.0&new-version=3.213.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- deploy/go.mod | 2 +- deploy/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index 06946e4..b6b0cb1 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -5,7 +5,7 @@ go 1.24.11 require ( github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.24.1 - github.com/pulumi/pulumi/sdk/v3 v3.212.0 + github.com/pulumi/pulumi/sdk/v3 v3.213.0 gopkg.in/yaml.v2 v2.4.0 ) diff --git a/deploy/go.sum b/deploy/go.sum index 69d48eb..8d5b186 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -158,8 +158,8 @@ github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 h1:w6OnO3d4j5yVf2vpm8OzXFC/xHOEGqt+9 github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1/go.mod h1:UyZyv7hz4knpFx6/Sh+SkZe6hT6sJHtDvw9A0TbvEsk= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.24.1 h1:L1J2/PHgAziDXUvOWJ4HH1JBlgxzpQseZiEIu4K2x34= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.24.1/go.mod h1:vNiMC/N8GNHvDwU3gQRXQ6V+kbgSl5N/lKtfrUjGuXU= -github.com/pulumi/pulumi/sdk/v3 v3.212.0 h1:YQKFamkd+3sqcbFUi+sq50DejdymayYbqaz+OQnSvug= -github.com/pulumi/pulumi/sdk/v3 v3.212.0/go.mod h1:Bn5Z9Rzp1lPqdAccaB+F2ivUBiamEl2TNR3Gg/h7iLs= +github.com/pulumi/pulumi/sdk/v3 v3.213.0 h1:ICp0WJlTShaTLrx2fDI52fJ3xwCf1h8T8tVrKDRNUB4= +github.com/pulumi/pulumi/sdk/v3 v3.213.0/go.mod h1:Bn5Z9Rzp1lPqdAccaB+F2ivUBiamEl2TNR3Gg/h7iLs= github.com/rivo/uniseg v0.1.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc= github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc= github.com/rivo/uniseg v0.4.4 h1:8TfxU8dW6PdqD27gjM8MVNuicgxIjxpm4K7x4jp8sis= From 06fd39593981547d523004fea3fdaedadf4f4479 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 31 Dec 2025 11:03:00 +0200 Subject: [PATCH 068/313] build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.213.0 to 3.214.0 in /deploy (#872) Bumps [github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from 3.213.0 to 3.214.0.
Release notes

Sourced from github.com/pulumi/pulumi/sdk/v3's releases.

v3.214.0

3.214.0 (2025-12-30)

Features

  • [cli] Add --config and --config-path options to destroy and refresh #21299

  • [sdkgen] Add OutputStyleOnly flag to functions to not emit their plain variants #21198

  • [sdk/python] Add support for replacement_trigger in the Python SDK #20940

Bug Fixes

  • [engine] Pass ignoreChanges when issuing no-diff updates that resolve initErrors #21319

  • [programgen] Fix a bug in programgen binding to invokes from parameterized packages #21284

  • [cli/plugin] Fix plugin download URL overrides for fallback mechanism #21095

Miscellaneous

  • [pkg] Upgrade pulumi-java to 1.20.0
Changelog

Sourced from github.com/pulumi/pulumi/sdk/v3's changelog.

3.214.0 (2025-12-30)

Features

  • [cli] Add --config and --config-path options to destroy and refresh #21299

  • [sdkgen] Add OutputStyleOnly flag to functions to not emit their plain variants #21198

  • [sdk/python] Add support for replacement_trigger in the Python SDK #20940

Bug Fixes

  • [engine] Pass ignoreChanges when issuing no-diff updates that resolve initErrors #21319

  • [programgen] Fix a bug in programgen binding to invokes from parameterized packages #21284

  • [cli/plugin] Fix plugin download URL overrides for fallback mechanism #21095

Miscellaneous

  • [pkg] Upgrade pulumi-java to 1.20.0
Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/pulumi/pulumi/sdk/v3&package-manager=go_modules&previous-version=3.213.0&new-version=3.214.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- deploy/go.mod | 2 +- deploy/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index b6b0cb1..03fea52 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -5,7 +5,7 @@ go 1.24.11 require ( github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.24.1 - github.com/pulumi/pulumi/sdk/v3 v3.213.0 + github.com/pulumi/pulumi/sdk/v3 v3.214.0 gopkg.in/yaml.v2 v2.4.0 ) diff --git a/deploy/go.sum b/deploy/go.sum index 8d5b186..bec9f85 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -158,8 +158,8 @@ github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 h1:w6OnO3d4j5yVf2vpm8OzXFC/xHOEGqt+9 github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1/go.mod h1:UyZyv7hz4knpFx6/Sh+SkZe6hT6sJHtDvw9A0TbvEsk= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.24.1 h1:L1J2/PHgAziDXUvOWJ4HH1JBlgxzpQseZiEIu4K2x34= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.24.1/go.mod h1:vNiMC/N8GNHvDwU3gQRXQ6V+kbgSl5N/lKtfrUjGuXU= -github.com/pulumi/pulumi/sdk/v3 v3.213.0 h1:ICp0WJlTShaTLrx2fDI52fJ3xwCf1h8T8tVrKDRNUB4= -github.com/pulumi/pulumi/sdk/v3 v3.213.0/go.mod h1:Bn5Z9Rzp1lPqdAccaB+F2ivUBiamEl2TNR3Gg/h7iLs= +github.com/pulumi/pulumi/sdk/v3 v3.214.0 h1:MBUrjhaY7i9RmEQddyH/HR0kvF5Kxl3WT+/Ra9wV3YM= +github.com/pulumi/pulumi/sdk/v3 v3.214.0/go.mod h1:Bn5Z9Rzp1lPqdAccaB+F2ivUBiamEl2TNR3Gg/h7iLs= github.com/rivo/uniseg v0.1.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc= github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc= github.com/rivo/uniseg v0.4.4 h1:8TfxU8dW6PdqD27gjM8MVNuicgxIjxpm4K7x4jp8sis= From 44b9a6659fdec1bee94b00ccfc3fc05b04733417 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 31 Dec 2025 11:04:47 +0200 Subject: [PATCH 069/313] build(deps): bump anchore/sbom-action from 0.20.11 to 0.21.0 in the actions group (#860) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps the actions group with 1 update: [anchore/sbom-action](https://github.com/anchore/sbom-action). Updates `anchore/sbom-action` from 0.20.11 to 0.21.0
Release notes

Sourced from anchore/sbom-action's releases.

v0.21.0

  • chore(deps): update Syft to v1.39.0 (#561)
  • chore(deps): bump @​octokit/request-error, @​octokit/core and @​octokit/webhooks (#560)
  • chore(deps): bump peter-evans/create-pull-request from 7.0.11 to 8.0.0 (#558)
Commits
  • a930d0a chore(deps): update Syft to v1.39.0 (#561)
  • e4b2532 chore(deps): bump @​octokit/request-error, @​octokit/core and @​octokit/webhooks...
  • 481b254 chore(deps): bump peter-evans/create-pull-request from 7.0.11 to 8.0.0 (#558)
  • See full diff in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=anchore/sbom-action&package-manager=github_actions&previous-version=0.20.11&new-version=0.21.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 648e271..ab15191 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -28,7 +28,7 @@ jobs: uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0 - name: Install Syft - uses: anchore/sbom-action/download-syft@v0.20.11 + uses: anchore/sbom-action/download-syft@v0.21.0 - name: Run GoReleaser uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a From 50e030d927b7dffe38fddfe883677827c6f79acd Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 31 Dec 2025 11:05:26 +0200 Subject: [PATCH 070/313] build(deps): bump github.com/jackc/pgx/v5 from 5.7.6 to 5.8.0 (#864) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [github.com/jackc/pgx/v5](https://github.com/jackc/pgx) from 5.7.6 to 5.8.0.
Changelog

Sourced from github.com/jackc/pgx/v5's changelog.

5.8.0 (December 26, 2025)

  • Require Go 1.24+
  • Remove golang.org/x/crypto dependency
  • Add OptionShouldPing to control ResetSession ping behavior (ilyam8)
  • Fix: Avoid overflow when MaxConns is set to MaxInt32
  • Fix: Close batch pipeline after a query error (Anthonin Bonnefoy)
  • Faster shutdown of pgxpool.Pool background goroutines (Blake Gentry)
  • Add pgxpool ping timeout (Amirsalar Safaei)
  • Fix: Rows.FieldDescriptions for empty query
  • Scan unknown types into *any as string or []byte based on format code
  • Optimize pgtype.Numeric (Philip Dubé)
  • Add AfterNetConnect hook to pgconn.Config
  • Fix: Handle for preparing statements that fail during the Describe phase
  • Fix overflow in numeric scanning (Ilia Demianenko)
  • Fix: json/jsonb sql.Scanner source type is []byte
  • Migrate from math/rand to math/rand/v2 (Mathias Bogaert)
  • Optimize internal iobufpool (Mathias Bogaert)
  • Optimize stmtcache invalidation (Mathias Bogaert)
  • Fix: missing error case in interval parsing (Maxime Soulé)
  • Fix: invalidate statement/description cache in Exec (James Hartig)
  • ColumnTypeLength method return the type length for varbit type (DengChan)
  • Array and Composite codecs handle typed nils
Commits
  • fe8740a Release v5.8.0
  • e5dde5a Skip test on CockroachDB
  • 06f2d82 Remove trailing space
  • 2cf78dd Merge pull request #2448 from DengChan/column_type_lenth_varbit
  • 2d1c4ef Skip tests on CockroachDB
  • 1a5fa7f Array and Composite codecs handle typed nils
  • 5736d09 ColumnTypeLength method return the type length for varbit type.
  • 4c1308c Revert "stdlib matches native pgx scanning support"
  • 14ce2b7 Skip test on CockroachDB
  • 65b2724 Merge pull request #2443 from jameshartig/x-invalidate-cache-in-exec
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/jackc/pgx/v5&package-manager=go_modules&previous-version=5.7.6&new-version=5.8.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index f016820..199a08d 100644 --- a/go.mod +++ b/go.mod @@ -11,7 +11,7 @@ require ( github.com/danielgtaylor/huma/v2 v2.34.1 github.com/golang-jwt/jwt/v5 v5.3.0 github.com/google/go-containerregistry v0.20.7 - github.com/jackc/pgx/v5 v5.7.6 + github.com/jackc/pgx/v5 v5.8.0 github.com/prometheus/client_golang v1.23.2 github.com/rs/cors v1.11.1 github.com/santhosh-tekuri/jsonschema/v5 v5.3.1 diff --git a/go.sum b/go.sum index 0f4b779..075ebb4 100644 --- a/go.sum +++ b/go.sum @@ -78,8 +78,8 @@ github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsI github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg= github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo= github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM= -github.com/jackc/pgx/v5 v5.7.6 h1:rWQc5FwZSPX58r1OQmkuaNicxdmExaEz5A2DO2hUuTk= -github.com/jackc/pgx/v5 v5.7.6/go.mod h1:aruU7o91Tc2q2cFp5h4uP3f6ztExVpyVv88Xl/8Vl8M= +github.com/jackc/pgx/v5 v5.8.0 h1:TYPDoleBBme0xGSAX3/+NujXXtpZn9HBONkQC7IEZSo= +github.com/jackc/pgx/v5 v5.8.0/go.mod h1:QVeDInX2m9VyzvNeiCJVjCkNFqzsNb43204HshNSZKw= github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo= github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4= github.com/keybase/go-keychain v0.0.1 h1:way+bWYa6lDppZoZcgMbYsvC7GxljxrskdNInRtuthU= From ab6a5a6b6da58a3d98d1776415193726bd547834 Mon Sep 17 00:00:00 2001 From: lif <1835304752@qq.com> Date: Sun, 4 Jan 2026 01:14:44 +0800 Subject: [PATCH 071/313] fix(api): reject requests with NUL bytes in URL (#869) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary - Added `NulByteValidationMiddleware` to validate incoming requests - Returns 400 Bad Request when NUL bytes (%00) detected in URL path or query - Prevents PostgreSQL encoding errors from being exposed as 500 errors ## Before ``` GET /v0.1/servers?cursor=%00 → 500 Internal Server Error → "invalid byte sequence for encoding UTF8: 0x00" ``` ## After ``` GET /v0.1/servers?cursor=%00 → 400 Bad Request → "Invalid request: query parameters contain null bytes" ``` Fixes #862 Signed-off-by: majiayu000 <1835304752@qq.com> Co-authored-by: Radoslav Dimitrov --- internal/api/server.go | 24 +++++++++++- internal/api/server_test.go | 73 +++++++++++++++++++++++++++++++++++++ 2 files changed, 95 insertions(+), 2 deletions(-) diff --git a/internal/api/server.go b/internal/api/server.go index 496282b..4b4f9bd 100644 --- a/internal/api/server.go +++ b/internal/api/server.go @@ -17,6 +17,26 @@ import ( "github.com/modelcontextprotocol/registry/internal/telemetry" ) +// NulByteValidationMiddleware rejects requests containing NUL bytes in URL path or query parameters +// This prevents PostgreSQL encoding errors and returns a proper 400 Bad Request +func NulByteValidationMiddleware(next http.Handler) http.Handler { + return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + // Check URL path for NUL bytes + if strings.ContainsRune(r.URL.Path, '\x00') { + http.Error(w, "Invalid request: URL path contains null bytes", http.StatusBadRequest) + return + } + + // Check raw query string for NUL bytes + if strings.ContainsRune(r.URL.RawQuery, '\x00') { + http.Error(w, "Invalid request: query parameters contain null bytes", http.StatusBadRequest) + return + } + + next.ServeHTTP(w, r) + }) +} + // TrailingSlashMiddleware redirects requests with trailing slashes to their canonical form func TrailingSlashMiddleware(next http.Handler) http.Handler { return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { @@ -67,8 +87,8 @@ func NewServer(cfg *config.Config, registryService service.RegistryService, metr }) // Wrap the mux with middleware stack - // Order: TrailingSlash -> CORS -> Mux - handler := TrailingSlashMiddleware(corsHandler.Handler(mux)) + // Order: NulByteValidation -> TrailingSlash -> CORS -> Mux + handler := NulByteValidationMiddleware(TrailingSlashMiddleware(corsHandler.Handler(mux))) server := &Server{ config: cfg, diff --git a/internal/api/server_test.go b/internal/api/server_test.go index 6309b47..c7d189e 100644 --- a/internal/api/server_test.go +++ b/internal/api/server_test.go @@ -3,11 +3,84 @@ package api_test import ( "net/http" "net/http/httptest" + "strings" "testing" "github.com/modelcontextprotocol/registry/internal/api" ) +func TestNulByteValidationMiddleware(t *testing.T) { + // Create a simple handler that returns "OK" + handler := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) { + w.WriteHeader(http.StatusOK) + _, _ = w.Write([]byte("OK")) + }) + + // Wrap with our middleware + middleware := api.NulByteValidationMiddleware(handler) + + t.Run("normal path should pass through", func(t *testing.T) { + req := httptest.NewRequest(http.MethodGet, "/v0/servers", nil) + w := httptest.NewRecorder() + middleware.ServeHTTP(w, req) + + if w.Code != http.StatusOK { + t.Errorf("expected status %d, got %d", http.StatusOK, w.Code) + } + }) + + t.Run("path with query params should pass through", func(t *testing.T) { + req := httptest.NewRequest(http.MethodGet, "/v0/servers?cursor=abc123", nil) + w := httptest.NewRecorder() + middleware.ServeHTTP(w, req) + + if w.Code != http.StatusOK { + t.Errorf("expected status %d, got %d", http.StatusOK, w.Code) + } + }) + + t.Run("path with NUL byte should return 400", func(t *testing.T) { + // Create request with NUL byte in path by manually setting URL + req := httptest.NewRequest(http.MethodGet, "/v0/servers/test", nil) + req.URL.Path = "/v0/servers/\x00" + w := httptest.NewRecorder() + middleware.ServeHTTP(w, req) + + if w.Code != http.StatusBadRequest { + t.Errorf("expected status %d, got %d", http.StatusBadRequest, w.Code) + } + if !strings.Contains(w.Body.String(), "URL path contains null bytes") { + t.Errorf("expected body to contain error message, got %q", w.Body.String()) + } + }) + + t.Run("query with NUL byte should return 400", func(t *testing.T) { + // Create request with NUL byte in query by manually setting RawQuery + req := httptest.NewRequest(http.MethodGet, "/v0/servers", nil) + req.URL.RawQuery = "cursor=\x00" + w := httptest.NewRecorder() + middleware.ServeHTTP(w, req) + + if w.Code != http.StatusBadRequest { + t.Errorf("expected status %d, got %d", http.StatusBadRequest, w.Code) + } + if !strings.Contains(w.Body.String(), "query parameters contain null bytes") { + t.Errorf("expected body to contain error message, got %q", w.Body.String()) + } + }) + + t.Run("path with embedded NUL byte should return 400", func(t *testing.T) { + req := httptest.NewRequest(http.MethodGet, "/v0/servers/test", nil) + req.URL.Path = "/v0/servers/test\x00name" + w := httptest.NewRecorder() + middleware.ServeHTTP(w, req) + + if w.Code != http.StatusBadRequest { + t.Errorf("expected status %d, got %d", http.StatusBadRequest, w.Code) + } + }) +} + func TestTrailingSlashMiddleware(t *testing.T) { // Create a simple handler that returns "OK" handler := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) { From 61fdf17b21c8bf8ee8f537d37b369ecff3a3a84c Mon Sep 17 00:00:00 2001 From: lif <1835304752@qq.com> Date: Sun, 4 Jan 2026 06:59:59 +0800 Subject: [PATCH 072/313] fix(publisher): add --help support for subcommands (#867) ## Summary - Added `printCommandHelp()` function to display help for each subcommand - `mcp-publisher init --help` now shows init command help instead of running init - `mcp-publisher login --help` now shows login methods instead of error - `mcp-publisher publish --help` now shows publish usage instead of attempting publish Fixes #735 Signed-off-by: majiayu000 <1835304752@qq.com> Co-authored-by: Radoslav Dimitrov --- cmd/publisher/main.go | 62 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 62 insertions(+) diff --git a/cmd/publisher/main.go b/cmd/publisher/main.go index db0ef92..5337d77 100644 --- a/cmd/publisher/main.go +++ b/cmd/publisher/main.go @@ -27,6 +27,12 @@ func main() { os.Exit(1) } + // Check for help flag for subcommands + if len(os.Args) >= 3 && (os.Args[2] == "--help" || os.Args[2] == "-h") { + printCommandHelp(os.Args[1]) + return + } + var err error switch os.Args[1] { case "init": @@ -68,3 +74,59 @@ func printUsage() { _, _ = fmt.Fprintln(os.Stdout) _, _ = fmt.Fprintln(os.Stdout, "Use 'mcp-publisher --help' for more information about a command.") } + +func printCommandHelp(command string) { + switch command { + case "init": + _, _ = fmt.Fprintln(os.Stdout, "Create a server.json file template") + _, _ = fmt.Fprintln(os.Stdout) + _, _ = fmt.Fprintln(os.Stdout, "Usage:") + _, _ = fmt.Fprintln(os.Stdout, " mcp-publisher init") + _, _ = fmt.Fprintln(os.Stdout) + _, _ = fmt.Fprintln(os.Stdout, "This command creates a server.json file in the current directory with") + _, _ = fmt.Fprintln(os.Stdout, "auto-detected values from your project (package.json, git remote, etc.).") + _, _ = fmt.Fprintln(os.Stdout) + _, _ = fmt.Fprintln(os.Stdout, "After running init, edit the generated server.json to customize your") + _, _ = fmt.Fprintln(os.Stdout, "server's metadata before publishing.") + + case "login": + _, _ = fmt.Fprintln(os.Stdout, "Authenticate with the registry") + _, _ = fmt.Fprintln(os.Stdout) + _, _ = fmt.Fprintln(os.Stdout, "Usage:") + _, _ = fmt.Fprintln(os.Stdout, " mcp-publisher login [options]") + _, _ = fmt.Fprintln(os.Stdout) + _, _ = fmt.Fprintln(os.Stdout, "Methods:") + _, _ = fmt.Fprintln(os.Stdout, " github Interactive GitHub authentication") + _, _ = fmt.Fprintln(os.Stdout, " github-oidc GitHub Actions OIDC authentication") + _, _ = fmt.Fprintln(os.Stdout, " dns DNS-based authentication (requires --domain)") + _, _ = fmt.Fprintln(os.Stdout, " http HTTP-based authentication (requires --domain)") + _, _ = fmt.Fprintln(os.Stdout, " none Anonymous authentication (for testing)") + _, _ = fmt.Fprintln(os.Stdout) + _, _ = fmt.Fprintln(os.Stdout, "Examples:") + _, _ = fmt.Fprintln(os.Stdout, " mcp-publisher login github") + _, _ = fmt.Fprintln(os.Stdout, " mcp-publisher login dns --domain example.com --private-key ") + + case "logout": + _, _ = fmt.Fprintln(os.Stdout, "Clear saved authentication") + _, _ = fmt.Fprintln(os.Stdout) + _, _ = fmt.Fprintln(os.Stdout, "Usage:") + _, _ = fmt.Fprintln(os.Stdout, " mcp-publisher logout") + _, _ = fmt.Fprintln(os.Stdout) + _, _ = fmt.Fprintln(os.Stdout, "This command removes the saved authentication token from your system.") + + case "publish": + _, _ = fmt.Fprintln(os.Stdout, "Publish server.json to the registry") + _, _ = fmt.Fprintln(os.Stdout) + _, _ = fmt.Fprintln(os.Stdout, "Usage:") + _, _ = fmt.Fprintln(os.Stdout, " mcp-publisher publish [server.json]") + _, _ = fmt.Fprintln(os.Stdout) + _, _ = fmt.Fprintln(os.Stdout, "Arguments:") + _, _ = fmt.Fprintln(os.Stdout, " server.json Path to the server.json file (default: ./server.json)") + _, _ = fmt.Fprintln(os.Stdout) + _, _ = fmt.Fprintln(os.Stdout, "You must be logged in before publishing. Run 'mcp-publisher login' first.") + + default: + fmt.Fprintf(os.Stderr, "Unknown command: %s\n", command) + printUsage() + } +} From f0f885ccf971b459f50a00afc6065670cd38954b Mon Sep 17 00:00:00 2001 From: adam jones Date: Tue, 13 Jan 2026 09:11:20 +0000 Subject: [PATCH 073/313] chore: update licensing to Apache 2.0 for new contributions (#887) As part of MCP joining the Linux Foundation, this PR updates licensing to Apache 2.0 for new contributions while grandfathering existing MIT code. See modelcontextprotocol/modelcontextprotocol#1994 --- LICENSE | 197 +++++++++++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 196 insertions(+), 1 deletion(-) diff --git a/LICENSE b/LICENSE index 8dbcb3a..4a93985 100644 --- a/LICENSE +++ b/LICENSE @@ -1,6 +1,193 @@ +The MCP project is undergoing a licensing transition from the MIT License to the Apache License, Version 2.0 ("Apache-2.0"). All new code and specification contributions to the project are licensed under Apache-2.0. Documentation contributions (excluding specifications) are licensed under CC-BY-4.0. + +Contributions for which relicensing consent has been obtained are licensed under Apache-2.0. Contributions made by authors who originally licensed their work under the MIT License and who have not yet granted explicit permission to relicense remain licensed under the MIT License. + +No rights beyond those granted by the applicable original license are conveyed for such contributions. + +--- + + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to the Licensor for inclusion in the Work by the copyright + owner or by an individual or Legal Entity authorized to submit on behalf + of the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + +--- + MIT License -Copyright (c) 2025 MCP Contributors +Copyright (c) 2024-2025 Model Context Protocol a Series of LF Projects, LLC. Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal @@ -19,3 +206,11 @@ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + +--- + +Creative Commons Attribution 4.0 International (CC-BY-4.0) + +Documentation in this project (excluding specifications) is licensed under +CC-BY-4.0. See https://creativecommons.org/licenses/by/4.0/legalcode for +the full license text. From 59df9f87e27eafab2c0da3bb641d7a994c095146 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 13 Jan 2026 11:14:49 +0200 Subject: [PATCH 074/313] build(deps): bump the actions group across 1 directory with 2 updates (#888) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps the actions group with 2 updates in the / directory: [actions/setup-go](https://github.com/actions/setup-go) and [anchore/sbom-action](https://github.com/anchore/sbom-action). Updates `actions/setup-go` from 6.1.0 to 6.2.0
Release notes

Sourced from actions/setup-go's releases.

v6.2.0

What's Changed

Enhancements

Dependency updates

New Contributors

Full Changelog: https://github.com/actions/setup-go/compare/v6...v6.2.0

Commits

Updates `anchore/sbom-action` from 0.21.0 to 0.21.1
Release notes

Sourced from anchore/sbom-action's releases.

v0.21.1

Changes in v0.21.1

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Radoslav Dimitrov --- .github/workflows/ci.yml | 4 ++-- .github/workflows/deploy-production.yml | 2 +- .github/workflows/deploy-staging.yml | 4 ++-- .github/workflows/release.yml | 6 +++--- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index cc4f8f2..ac807bc 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -19,7 +19,7 @@ jobs: uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 - name: Set up Go - uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c + uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 with: go-version-file: 'go.mod' cache: true @@ -52,7 +52,7 @@ jobs: uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 - name: Set up Go - uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c + uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 with: go-version-file: 'go.mod' cache: true diff --git a/.github/workflows/deploy-production.yml b/.github/workflows/deploy-production.yml index 7faa128..8474b93 100644 --- a/.github/workflows/deploy-production.yml +++ b/.github/workflows/deploy-production.yml @@ -26,7 +26,7 @@ jobs: uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 - name: Setup Go - uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c + uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 with: go-version-file: 'go.mod' cache: true diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml index 04a93b1..c57d5ad 100644 --- a/.github/workflows/deploy-staging.yml +++ b/.github/workflows/deploy-staging.yml @@ -25,7 +25,7 @@ jobs: uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 - name: Set up Go - uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c + uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 with: go-version-file: 'go.mod' cache: true @@ -73,7 +73,7 @@ jobs: uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 - name: Setup Go - uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c + uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 with: go-version-file: 'go.mod' cache: true diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index ab15191..b2704ae 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -19,7 +19,7 @@ jobs: fetch-depth: 0 - name: Set up Go - uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c + uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 with: go-version-file: 'go.mod' cache: true @@ -28,7 +28,7 @@ jobs: uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0 - name: Install Syft - uses: anchore/sbom-action/download-syft@v0.21.0 + uses: anchore/sbom-action/download-syft@v0.21.1 - name: Run GoReleaser uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a @@ -48,7 +48,7 @@ jobs: uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 - name: Set up Go - uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c + uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 with: go-version-file: 'go.mod' cache: true From 37e2fdd70b585d2e55e5d9af94c4520733c33163 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 13 Jan 2026 11:15:15 +0200 Subject: [PATCH 075/313] build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.214.0 to 3.215.0 in /deploy (#880) Bumps [github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from 3.214.0 to 3.215.0.
Release notes

Sourced from github.com/pulumi/pulumi/sdk/v3's releases.

v3.215.0

3.215.0 (2026-01-07)

Features

  • [cli/plugin] Allow plugins to specify a supported version range for the CLI #21335

Bug Fixes

  • [cli] Filter internal properties like __defaults from diff display #21359

  • [cli/config] Make config set --type bool accept different spellings of boolean values instead of only lowercase "true" #21314

  • [sdk/python] Fix import_resources with converter failing due to --stack argument placement #21373

Miscellaneous

  • [cli] Update pulumi-dotnet to 3.96.1

  • [cli/package] Remove superfluous version string #21351

v3.214.1

3.214.1 (2026-01-03)

Bug Fixes

  • [cli/package] Preserve existing behavior when pulumi package add is used with a local provider #21350

  • [pkg] Create namespace aliases to avoid Pulumi namespace collisions during codegen #21325

Changelog

Sourced from github.com/pulumi/pulumi/sdk/v3's changelog.

3.215.0 (2026-01-07)

Features

  • [cli/plugin] Allow plugins to specify a supported version range for the CLI #21335

Bug Fixes

  • [cli] Filter internal properties like __defaults from diff display #21359

  • [cli/config] Make config set --type bool accept different spellings of boolean values instead of only lowercase "true" #21314

  • [sdk/python] Fix import_resources with converter failing due to --stack argument placement #21373

Miscellaneous

  • [cli] Update pulumi-dotnet to 3.96.1

  • [cli/package] Remove superfluous version string #21351

3.214.1 (2026-01-03)

Bug Fixes

  • [cli/package] Preserve existing behavior when pulumi package add is used with a local provider #21350

  • [pkg] Create namespace aliases to avoid Pulumi namespace collisions during codegen #21325

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/pulumi/pulumi/sdk/v3&package-manager=go_modules&previous-version=3.214.0&new-version=3.215.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- deploy/go.mod | 2 +- deploy/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index 03fea52..50c19a6 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -5,7 +5,7 @@ go 1.24.11 require ( github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.24.1 - github.com/pulumi/pulumi/sdk/v3 v3.214.0 + github.com/pulumi/pulumi/sdk/v3 v3.215.0 gopkg.in/yaml.v2 v2.4.0 ) diff --git a/deploy/go.sum b/deploy/go.sum index bec9f85..7346152 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -158,8 +158,8 @@ github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 h1:w6OnO3d4j5yVf2vpm8OzXFC/xHOEGqt+9 github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1/go.mod h1:UyZyv7hz4knpFx6/Sh+SkZe6hT6sJHtDvw9A0TbvEsk= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.24.1 h1:L1J2/PHgAziDXUvOWJ4HH1JBlgxzpQseZiEIu4K2x34= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.24.1/go.mod h1:vNiMC/N8GNHvDwU3gQRXQ6V+kbgSl5N/lKtfrUjGuXU= -github.com/pulumi/pulumi/sdk/v3 v3.214.0 h1:MBUrjhaY7i9RmEQddyH/HR0kvF5Kxl3WT+/Ra9wV3YM= -github.com/pulumi/pulumi/sdk/v3 v3.214.0/go.mod h1:Bn5Z9Rzp1lPqdAccaB+F2ivUBiamEl2TNR3Gg/h7iLs= +github.com/pulumi/pulumi/sdk/v3 v3.215.0 h1:XZMiv9aSE1pD3kW4JpA53cy7mFflbJYn1fFKH1NMIAY= +github.com/pulumi/pulumi/sdk/v3 v3.215.0/go.mod h1:Bn5Z9Rzp1lPqdAccaB+F2ivUBiamEl2TNR3Gg/h7iLs= github.com/rivo/uniseg v0.1.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc= github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc= github.com/rivo/uniseg v0.4.4 h1:8TfxU8dW6PdqD27gjM8MVNuicgxIjxpm4K7x4jp8sis= From c6856a818b3fc15ea62b09c5fccdac6262f711d9 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 13 Jan 2026 11:15:33 +0200 Subject: [PATCH 076/313] build(deps): bump golang.org/x/mod from 0.31.0 to 0.32.0 (#883) Bumps [golang.org/x/mod](https://github.com/golang/mod) from 0.31.0 to 0.32.0.
Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=golang.org/x/mod&package-manager=go_modules&previous-version=0.31.0&new-version=0.32.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 199a08d..24f49c1 100644 --- a/go.mod +++ b/go.mod @@ -22,7 +22,7 @@ require ( go.opentelemetry.io/otel/metric v1.39.0 go.opentelemetry.io/otel/sdk v1.39.0 go.opentelemetry.io/otel/sdk/metric v1.39.0 - golang.org/x/mod v0.31.0 + golang.org/x/mod v0.32.0 gopkg.in/yaml.v3 v3.0.1 ) diff --git a/go.sum b/go.sum index 075ebb4..dce69ba 100644 --- a/go.sum +++ b/go.sum @@ -157,8 +157,8 @@ go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0= go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8= golang.org/x/crypto v0.45.0 h1:jMBrvKuj23MTlT0bQEOBcAE0mjg8mK9RXFhRH6nyF3Q= golang.org/x/crypto v0.45.0/go.mod h1:XTGrrkGJve7CYK7J8PEww4aY7gM3qMCElcJQ8n8JdX4= -golang.org/x/mod v0.31.0 h1:HaW9xtz0+kOcWKwli0ZXy79Ix+UW/vOfmWI5QVd2tgI= -golang.org/x/mod v0.31.0/go.mod h1:43JraMp9cGx1Rx3AqioxrbrhNsLl2l/iNAvuBkrezpg= +golang.org/x/mod v0.32.0 h1:9F4d3PHLljb6x//jOyokMv3eX+YDeepZSEo3mFJy93c= +golang.org/x/mod v0.32.0/go.mod h1:SgipZ/3h2Ci89DlEtEXWUk/HteuRin+HHhN+WbNhguU= golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY= golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU= golang.org/x/oauth2 v0.33.0 h1:4Q+qn+E5z8gPRJfmRy7C2gGG3T4jIprK6aSYgTXGRpo= From ad207f239002f34feaf0620d0caffc9b21adb395 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Tue, 13 Jan 2026 11:19:49 +0200 Subject: [PATCH 077/313] Handle URL-encoded NUL bytes (%00) in URL path and query (#877) ## Motivation and Context Follow up on #869 ## How Has This Been Tested? ## Breaking Changes ## Types of changes - [ ] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] Documentation update ## Checklist - [ ] I have read the [MCP Documentation](https://modelcontextprotocol.io) - [ ] My code follows the repository's style guidelines - [ ] New and existing tests pass locally - [ ] I have added appropriate error handling - [ ] I have added or updated documentation as needed ## Additional context Signed-off-by: Radoslav Dimitrov --- internal/api/server.go | 45 +++++++++++++++---- internal/api/server_test.go | 88 +++++++++++++++++++++++++++++++++++++ 2 files changed, 125 insertions(+), 8 deletions(-) diff --git a/internal/api/server.go b/internal/api/server.go index 4b4f9bd..e795a1e 100644 --- a/internal/api/server.go +++ b/internal/api/server.go @@ -2,6 +2,7 @@ package api import ( "context" + "encoding/json" "log" "net/http" "strings" @@ -17,19 +18,21 @@ import ( "github.com/modelcontextprotocol/registry/internal/telemetry" ) -// NulByteValidationMiddleware rejects requests containing NUL bytes in URL path or query parameters -// This prevents PostgreSQL encoding errors and returns a proper 400 Bad Request +// NulByteValidationMiddleware rejects requests containing NUL bytes in URL path or query parameters. +// This prevents PostgreSQL encoding errors (SQLSTATE 22021) and returns a proper 400 Bad Request. +// Checks for both literal NUL bytes (\x00) and URL-encoded form (%00). func NulByteValidationMiddleware(next http.Handler) http.Handler { return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { - // Check URL path for NUL bytes - if strings.ContainsRune(r.URL.Path, '\x00') { - http.Error(w, "Invalid request: URL path contains null bytes", http.StatusBadRequest) + // Check URL path for literal NUL bytes or URL-encoded %00 + // Path needs %00 check because handlers call url.PathUnescape() which would decode it + if containsNulByte(r.URL.Path) { + writeErrorResponse(w, http.StatusBadRequest, "Invalid request: URL path contains null bytes") return } - // Check raw query string for NUL bytes - if strings.ContainsRune(r.URL.RawQuery, '\x00') { - http.Error(w, "Invalid request: query parameters contain null bytes", http.StatusBadRequest) + // Check raw query string for literal NUL bytes or URL-encoded %00 + if containsNulByte(r.URL.RawQuery) { + writeErrorResponse(w, http.StatusBadRequest, "Invalid request: query parameters contain null bytes") return } @@ -37,6 +40,32 @@ func NulByteValidationMiddleware(next http.Handler) http.Handler { }) } +// writeErrorResponse writes a JSON error response using huma's ErrorModel format +// for consistency with the rest of the API. +func writeErrorResponse(w http.ResponseWriter, status int, detail string) { + w.Header().Set("Content-Type", "application/json") + w.WriteHeader(status) + + errModel := &huma.ErrorModel{ + Title: http.StatusText(status), + Status: status, + Detail: detail, + } + _ = json.NewEncoder(w).Encode(errModel) +} + +// containsNulByte checks if a string contains a NUL byte, either as a literal \x00 +// or URL-encoded as %00. +func containsNulByte(s string) bool { + // Check for literal NUL byte + if strings.ContainsRune(s, '\x00') { + return true + } + // Check for URL-encoded NUL byte (%00) + // Using Contains directly since %00 has no case variation (both hex digits are 0) + return strings.Contains(s, "%00") +} + // TrailingSlashMiddleware redirects requests with trailing slashes to their canonical form func TrailingSlashMiddleware(next http.Handler) http.Handler { return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { diff --git a/internal/api/server_test.go b/internal/api/server_test.go index c7d189e..dc313b0 100644 --- a/internal/api/server_test.go +++ b/internal/api/server_test.go @@ -52,6 +52,10 @@ func TestNulByteValidationMiddleware(t *testing.T) { if !strings.Contains(w.Body.String(), "URL path contains null bytes") { t.Errorf("expected body to contain error message, got %q", w.Body.String()) } + // Verify JSON response format + if w.Header().Get("Content-Type") != "application/json" { + t.Errorf("expected Content-Type application/json, got %q", w.Header().Get("Content-Type")) + } }) t.Run("query with NUL byte should return 400", func(t *testing.T) { @@ -79,6 +83,90 @@ func TestNulByteValidationMiddleware(t *testing.T) { t.Errorf("expected status %d, got %d", http.StatusBadRequest, w.Code) } }) + + t.Run("query with URL-encoded NUL byte (%00) should return 400", func(t *testing.T) { + // This is the exact case from issue #862: ?cursor=%00 + req := httptest.NewRequest(http.MethodGet, "/v0/servers?cursor=%00", nil) + w := httptest.NewRecorder() + middleware.ServeHTTP(w, req) + + if w.Code != http.StatusBadRequest { + t.Errorf("expected status %d, got %d", http.StatusBadRequest, w.Code) + } + if !strings.Contains(w.Body.String(), "query parameters contain null bytes") { + t.Errorf("expected body to contain error message, got %q", w.Body.String()) + } + }) + + t.Run("query with URL-encoded NUL byte followed by text should return 400", func(t *testing.T) { + req := httptest.NewRequest(http.MethodGet, "/v0/servers?cursor=%00test", nil) + w := httptest.NewRecorder() + middleware.ServeHTTP(w, req) + + if w.Code != http.StatusBadRequest { + t.Errorf("expected status %d, got %d", http.StatusBadRequest, w.Code) + } + }) + + t.Run("query with embedded URL-encoded NUL byte should return 400", func(t *testing.T) { + req := httptest.NewRequest(http.MethodGet, "/v0/servers?cursor=abc%00def", nil) + w := httptest.NewRecorder() + middleware.ServeHTTP(w, req) + + if w.Code != http.StatusBadRequest { + t.Errorf("expected status %d, got %d", http.StatusBadRequest, w.Code) + } + }) + + t.Run("query with double-encoded NUL byte (%2500) should pass through", func(t *testing.T) { + // %2500 decodes to %00 (literal string), not a NUL byte + // This is intentionally allowed - double-decoding is the caller's responsibility + req := httptest.NewRequest(http.MethodGet, "/v0/servers?cursor=%2500", nil) + w := httptest.NewRecorder() + middleware.ServeHTTP(w, req) + + // This should pass - %2500 is not a NUL byte injection attempt + // When decoded once: %2500 -> %00 (the string "%00", not a NUL byte) + if w.Code != http.StatusOK { + t.Errorf("expected status %d, got %d (double-encoded should pass)", http.StatusOK, w.Code) + } + }) + + t.Run("query with valid percent-encoding should pass through", func(t *testing.T) { + // Ensure we don't false-positive on valid encodings like %20 (space) + req := httptest.NewRequest(http.MethodGet, "/v0/servers?search=hello%20world", nil) + w := httptest.NewRecorder() + middleware.ServeHTTP(w, req) + + if w.Code != http.StatusOK { + t.Errorf("expected status %d, got %d", http.StatusOK, w.Code) + } + }) + + t.Run("path with URL-encoded NUL byte (%00) should return 400", func(t *testing.T) { + // Handlers call url.PathUnescape() which would decode %00 to \x00 + req := httptest.NewRequest(http.MethodGet, "/v0/servers/%00/versions", nil) + w := httptest.NewRecorder() + middleware.ServeHTTP(w, req) + + if w.Code != http.StatusBadRequest { + t.Errorf("expected status %d, got %d", http.StatusBadRequest, w.Code) + } + if !strings.Contains(w.Body.String(), "URL path contains null bytes") { + t.Errorf("expected body to contain error message, got %q", w.Body.String()) + } + }) + + t.Run("path with URL-encoded NUL byte among other encodings should return 400", func(t *testing.T) { + // %0a is newline, %00 is NUL - should still catch the NUL + req := httptest.NewRequest(http.MethodGet, "/v0/servers/test%0a%00name/versions", nil) + w := httptest.NewRecorder() + middleware.ServeHTTP(w, req) + + if w.Code != http.StatusBadRequest { + t.Errorf("expected status %d, got %d", http.StatusBadRequest, w.Code) + } + }) } func TestTrailingSlashMiddleware(t *testing.T) { From d3d137e170bd08cb57768d7122799187ae05a82d Mon Sep 17 00:00:00 2001 From: Vincent Emonet Date: Wed, 14 Jan 2026 22:33:20 +0100 Subject: [PATCH 078/313] docs: Add MCP registry browser to the `community-projects.md` page (#889) ## Motivation and Context Added a fully client-side browser for MCP registry APIs to the `community-projects.md` documentation page: https://vemonet.github.io/mcp-registry I built it because I was missing a way to easily configure a server and export the configuration (existing browsers I have found show the available parameters, but you still need to manually build the JSON): - It shows a user friendly form that enables to configure MCP servers based on their registry entry, making it easier to understand and fill the configuration required for deploying a server (instead of having to read through JSON, and manually build another JSON). Then users can either copy the generated config or install in client with custom URL handler like VSCode/cursor in 1 click - It is a thin client UI layer over the existing registry API, it does not offer additional classification, complex filtering, or semantic search (we don't use an additional server or database). So it is more of a tool to make it user friendly to directly access a raw registry content and inspects available servers, than an opinionated browser with advanced search capabilities ## How Has This Been Tested? ## Breaking Changes ## Types of changes - [ ] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [x] Documentation update ## Checklist - [x] I have read the [MCP Documentation](https://modelcontextprotocol.io) - [x] My code follows the repository's style guidelines - [ ] New and existing tests pass locally - [ ] I have added appropriate error handling - [x] I have added or updated documentation as needed ## Additional context --- docs/community-projects.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/community-projects.md b/docs/community-projects.md index 7115a0b..ef59bf5 100644 --- a/docs/community-projects.md +++ b/docs/community-projects.md @@ -11,13 +11,14 @@ Browse the official MCP Registry in your browser! - [MCP Bench](https://mcpbench.ai/)🔎 - Explore the MCP registry with richer filters, community stars, and LLM-generated classification tags. - [MCP Registry Database](https://lite.datasette.io/?url=https%3A%2F%2Fraw.githubusercontent.com%2Frosmur%2Fofficial-mcp-registry-database%2Fmain%2Fofficial_mcp_registry.db#/official_mcp_registry/servers)🔎 - A minimal, web browsable, live database of the official MCP Registry [source code](https://github.com/rosmur/official-mcp-registry-database). - [TeamSpark AI Server Registry](https://teamsparkai.github.io/ToolCatalog/registry)🔎 - Browse and discover servers from the official MCP Registry ([source code](https://github.com/TeamSparkAI/ToolCatalog)). +- [MCP Registry UI](https://vemonet.github.io/mcp-registry)🔎 - A fully client‑side app to search, filter, configure, and install servers from MCP Registry APIs ([source code](https://github.com/vemonet/mcp-registry)). ### MCP Registry Clients - [REST API](modelcontextprotocol-io/registry-aggregators.mdx) - HTTP API - [go-mcp-registry](https://github.com/leefowlercu/go-mcp-registry) - Go SDK - [mcp-registry-spec-sdk](https://www.npmjs.com/package/mcp-registry-spec-sdk) - TypeScript client for the MCP Registry -- [LangChain4j MCP Registry Java client](https://docs.langchain4j.dev/tutorials/mcp/#mcp-registry-client) - Java API +- [LangChain4j MCP Registry Java client](https://docs.langchain4j.dev/tutorials/mcp/#mcp-registry-client) - Java API ### Other From fc88cf08707509d4fb8c2e1cf3bc0cdf76517712 Mon Sep 17 00:00:00 2001 From: Bob Dickinson Date: Thu, 15 Jan 2026 14:49:39 -0800 Subject: [PATCH 079/313] Enhanced server.json validation (phase 1) (#636) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Added schema validation and support for exhaustive and more detailed validation to existing validators. Added new `mcp-publisher validate` command. No change to any existing tests or behavior other than the new command. ## Motivation and Context Many currently published servers fail schema validation. Of those that pass, many have semantic/logical errors or other errors that make them impossible to configure, or their configuration when applied doesn't generate correct MCP server configuration (per their own documentation). To address this, we need better tooling to validate servers and to inform server publishers of errors, issues, and best practices in a way that is clear and actionable, both during server development and at time of publishing. I have started a discussion about the broader topic: https://github.com/modelcontextprotocol/registry/discussions/635 There is also a fairly detailed document describing the design, architecture, implementation, future plans, etc. See [Enhanced Validation Design](docs/explanations/proposed-enhanced-validation.md) This PR is the first step in the process of improving validation. It adds schema validation and updates all existing validators to use a new model that allows them to track context and return rich and exhaustive results. This has been done in a way that is backward compatible (ValidateServerJSON is unchanged as are all existing validation unit tests). There is a new `mcp-publisher` command called `validate` that is currenty the only place that schema validation and enhanced (exhaustive/rich) validation results are exposed. ### Changes Internal Validation improvements - Schema validation has been implemented and is available as an option in validation methods (defaults to off) - Existing validators track the JSON path (context) of the attribute they're evaluating, passing it to any child validators - Existing validators are exhaustive (return all issues, not failing fast on the first error) - Existing validators return rich validation results, including: - type (schema, semantic, linter) - severity (error, warn, info) - path (JSON path to server.json element) - reference (to the schema element or rule that triggered the result) - message (currently the same as previous error message) A new `validate` command has been added to `mcp-publisher` so publishers can evaluate their server.json before publishing - Includes new schema validation and previous semantic validation - Shows full details of all issues encountered during validation ### Usage Given a server.json that looks like this: ```json { "$schema": "https://static.modelcontextprotocol.io/schemas/2025-09-29/server.schema.json", "name": "io.github.BobDickinson/registry", "description": "An MCP server that provides [describe what your server does]", "repository": { "url": "", "source": "" }, "version": "=1.0.0", "packages": [ { "registryType": "oci", "registryBaseUrl": "https://docker.io", "identifier": "registry", "version": "1.0.0", "transport": { "type": "sse" }, "packageArguments": [ { "type": "named", "name": "--mode", "description": "Operation mode", "format": "foo" } ], "environmentVariables": [ { "description": "Your API key for the service", "isRequired": true, "format": "string", "isSecret": true, "name": "YOUR_API_KEY" } ] } ] } ``` Run the command: `mcp-publisher validate server.json` Which will produce the output: ```bash ❌ Validation failed with 5 issue(s): 1. [error] packages.0.packageArguments.0.format (schema) value must be one of "string", "number", "boolean", "filepath" Reference: #/definitions/Input/properties/format/enum from: [#/definitions/ServerDetail]/properties/packages/items/[#/definitions/Package]/properties/packageArguments/items/[#/definitions/Argument]/else/[#/definitions/NamedArgument]/allOf/0/[#/definitions/InputWithVariables]/allOf/0/[#/definitions/Input]/properties/format/enum 2. [error] packages.0.transport (schema) missing required fields: 'url' Reference: #/definitions/SseTransport/required from: [#/definitions/ServerDetail]/properties/packages/items/[#/definitions/Package]/properties/transport/else/else/[#/definitions/SseTransport]/required 3. [error] repository.url (schema) '' has invalid format 'uri' Reference: #/definitions/Repository/properties/url/format from: [#/definitions/ServerDetail]/properties/repository/[#/definitions/Repository]/properties/url/format 4. [error] version (semantic) version must be a specific version, not a range: "=1.0.0" Reference: version-looks-like-range 5. [error] packages[0].transport.url (semantic) url is required for sse transport type Reference: streamable-transport-url-required Error: validation failed ``` Note in the results above: - All errors contain the JSON path of the triggering element from server.json. - The first three errors are schema errors detected during schema validation. The `Reference` provided contains an absolute path to the schema rule that was violated, followed by the full schema path that enforced that rule (with $ref redirect values substited and enclosed in square brackets). - The error messages provided by the existing semantic validators are exactly the same as the previous error messages those validators produced. In the final solution we would remove semantic validators that are redundant to schema validation (as in number 5 above). We have the option to use the structured data produced by schema validation to replace the generic schema validation message with a more descriptive message if that is an issue (in particular, if the only argument for an ad-hoc validator is that is produces a better/cleaner message, we would just move that message creation code to the schema error result formatter and special case it as opposed to having a redundant validator). ### What's Next If this general direction is supported and this PR is accepted, a fast follow would include: - Add new validators (infliuenced by observed issues) for both semantic errors and best practices - Require passing schema validation (in addition to improved semantic validation) in order to publish - Remove existing validation code that is redundant to schema validation (ensuring error messages remain intelligible) - Update validation client code and tests to handle the new rich return types natively ### Issues Schema validation requires embedding the `server.schema.json` file into the validators package via `go:embed`, which is restricted from embedding files outside of the package. For this reason we copy the schema file into a schema subdir (via a prep target in the makefile) and we .gitignore it. I tried cleaning up the copy in the make clean target, but then the linter would complain about the embed target being missing if it wasn't there during development. I also considered just checking in the schema file and assuming a separate workflow for updating the embedded schema file, but it's not clear what that workflow would be or how it would be maintained. I'm open to a different approach, but the schema file does need to be embedded somehow for schema validation to work. ## How Has This Been Tested? All existing validation tests pass, new tests implemented and all pass. ## Breaking Changes No breaking changes, no behavior change except new `validate` command ## Types of changes - [ ] Bug fix (non-breaking change which fixes an issue) - [X] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] Documentation update ## Checklist - [X] I have read the [MCP Documentation](https://modelcontextprotocol.io) - [X] My code follows the repository's style guidelines - [X] New and existing tests pass locally - [X] I have added appropriate error handling - [X] I have added or updated documentation as needed --------- Co-authored-by: GitHub Action --- .github/workflows/sync-schema.yml | 69 ++ .gitignore | 2 +- cmd/publisher/commands/init.go | 6 +- cmd/publisher/commands/publish.go | 25 +- cmd/publisher/commands/publish_test.go | 6 +- cmd/publisher/commands/validate.go | 162 ++++ cmd/publisher/main.go | 3 + docs/design/proposed-enhanced-validation.md | 912 ++++++++++++++++++ .../remote-servers.mdx | 2 +- docs/reference/cli/commands.md | 39 + internal/importer/importer.go | 5 +- internal/service/registry_service.go | 24 +- internal/validators/schema.go | 476 +++++++++ internal/validators/schema_test.go | 121 +++ internal/validators/schemas/2025-07-09.json | 478 +++++++++ internal/validators/schemas/2025-09-16.json | 478 +++++++++ internal/validators/schemas/2025-09-29.json | 483 ++++++++++ internal/validators/schemas/2025-10-11.json | 549 +++++++++++ internal/validators/schemas/2025-10-17.json | 549 +++++++++++ internal/validators/schemas/2025-12-11.json | 574 +++++++++++ internal/validators/schemas/README.md | 23 + .../validators/validation_detailed_test.go | 447 +++++++++ internal/validators/validation_types.go | 161 ++++ internal/validators/validation_types_test.go | 173 ++++ internal/validators/validators.go | 453 ++++++--- internal/validators/validators_test.go | 61 +- tools/validate-examples/main.go | 5 +- 27 files changed, 6107 insertions(+), 179 deletions(-) create mode 100644 .github/workflows/sync-schema.yml create mode 100644 cmd/publisher/commands/validate.go create mode 100644 docs/design/proposed-enhanced-validation.md create mode 100644 internal/validators/schema.go create mode 100644 internal/validators/schema_test.go create mode 100644 internal/validators/schemas/2025-07-09.json create mode 100644 internal/validators/schemas/2025-09-16.json create mode 100644 internal/validators/schemas/2025-09-29.json create mode 100644 internal/validators/schemas/2025-10-11.json create mode 100644 internal/validators/schemas/2025-10-17.json create mode 100644 internal/validators/schemas/2025-12-11.json create mode 100644 internal/validators/schemas/README.md create mode 100644 internal/validators/validation_detailed_test.go create mode 100644 internal/validators/validation_types.go create mode 100644 internal/validators/validation_types_test.go diff --git a/.github/workflows/sync-schema.yml b/.github/workflows/sync-schema.yml new file mode 100644 index 0000000..6777034 --- /dev/null +++ b/.github/workflows/sync-schema.yml @@ -0,0 +1,69 @@ +name: Sync Schema + +on: + workflow_dispatch: # Manual trigger + # TODO: Add daily schedule later + # schedule: + # - cron: '0 2 * * *' # Run daily at 2 AM UTC + +permissions: + contents: write + +jobs: + sync-schema: + runs-on: ubuntu-latest + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Checkout static repo + uses: actions/checkout@v4 + with: + repository: modelcontextprotocol/static + path: static-repo + + - name: Sync schemas from static repo + run: | + echo "🔍 Syncing schemas from modelcontextprotocol/static..." + mkdir -p internal/validators/schemas + + # Copy all versioned schema files + for dir in static-repo/schemas/*/; do + if [ -f "$dir/server.schema.json" ]; then + version=$(basename "$dir") + # Skip draft directory if it exists + if [ "$version" != "draft" ]; then + output_file="internal/validators/schemas/${version}.json" + if [ ! -f "$output_file" ] || ! cmp -s "$dir/server.schema.json" "$output_file"; then + echo "⬇ Adding/updating ${version}/server.schema.json -> ${version}.json" + cp "$dir/server.schema.json" "$output_file" + else + echo "✓ ${version} is already up to date" + fi + fi + fi + done + + echo "✅ Schema sync complete" + + - name: Check for changes + id: changes + run: | + # Check for both modified and untracked files + if [ -n "$(git status --porcelain internal/validators/schemas/)" ]; then + echo "changed=true" >> $GITHUB_OUTPUT + git status --porcelain internal/validators/schemas/ + else + echo "changed=false" >> $GITHUB_OUTPUT + echo "No changes to schemas" + fi + + - name: Commit and push changes + if: steps.changes.outputs.changed == 'true' + run: | + git config --local user.email "action@github.com" + git config --local user.name "GitHub Action" + git add internal/validators/schemas/ + git commit -m "Sync schemas from modelcontextprotocol/static [skip ci]" + git push diff --git a/.gitignore b/.gitignore index b2f3118..b3e2812 100644 --- a/.gitignore +++ b/.gitignore @@ -12,4 +12,4 @@ validate-schemas coverage.out coverage.html deploy/infra/infra -./registry +registry diff --git a/cmd/publisher/commands/init.go b/cmd/publisher/commands/init.go index d1ac9a1..27cb664 100644 --- a/cmd/publisher/commands/init.go +++ b/cmd/publisher/commands/init.go @@ -58,7 +58,7 @@ func InitCommand() error { // Create the server structure server := createServerJSON( - name, description, version, repoURL, repoSource, subfolder, + model.CurrentSchemaURL, name, description, version, repoURL, repoSource, subfolder, packageType, packageIdentifier, version, envVars, ) @@ -327,7 +327,7 @@ func detectPackageIdentifier(serverName string, packageType string) string { } func createServerJSON( - name, description, version, repoURL, repoSource, subfolder, + currentSchema, name, description, version, repoURL, repoSource, subfolder, packageType, packageIdentifier, packageVersion string, envVars []model.KeyValueInput, ) apiv0.ServerJSON { @@ -406,7 +406,7 @@ func createServerJSON( // Create server structure return apiv0.ServerJSON{ - Schema: model.CurrentSchemaURL, + Schema: currentSchema, Name: name, Description: description, Repository: repo, diff --git a/cmd/publisher/commands/publish.go b/cmd/publisher/commands/publish.go index 6a42c94..7a34630 100644 --- a/cmd/publisher/commands/publish.go +++ b/cmd/publisher/commands/publish.go @@ -12,8 +12,8 @@ import ( "path/filepath" "strings" + "github.com/modelcontextprotocol/registry/internal/validators" apiv0 "github.com/modelcontextprotocol/registry/pkg/api/v0" - "github.com/modelcontextprotocol/registry/pkg/model" ) func PublishCommand(args []string) error { @@ -38,15 +38,20 @@ func PublishCommand(args []string) error { return fmt.Errorf("invalid server.json: %w", err) } - // Check for deprecated schema and recommend migration - // Allow empty schema (will use default) but reject old schemas - if serverJSON.Schema != "" && !strings.Contains(serverJSON.Schema, model.CurrentSchemaVersion) { - return fmt.Errorf(`deprecated schema detected: %s. - -Migrate to the current schema format for new servers. - -📋 Migration checklist: https://github.com/modelcontextprotocol/registry/blob/main/docs/reference/server-json/CHANGELOG.md#migration-checklist-for-publishers -📖 Full changelog with examples: https://github.com/modelcontextprotocol/registry/blob/main/docs/reference/server-json/CHANGELOG.md`, serverJSON.Schema) + // Validate schema version (non-empty schema, valid schema, and current schema) + // This performs schema version checks without full schema validation + // Note: When we enable full validation, use validators.ValidationAll instead + result, formattedErrorMsg := runValidationAndPrintIssues(&serverJSON, validators.ValidationSchemaVersionOnly) + if !result.Valid { + // Return error after printing (all errors already printed by validateServerJSON) + // Prefer formatted error message for schema validation errors, otherwise use first error + if formattedErrorMsg != "" { + return fmt.Errorf("%s", formattedErrorMsg) + } + if firstErr := result.FirstError(); firstErr != nil { + return firstErr + } + return fmt.Errorf("validation failed") } // Load saved token diff --git a/cmd/publisher/commands/publish_test.go b/cmd/publisher/commands/publish_test.go index c18c004..e7af688 100644 --- a/cmd/publisher/commands/publish_test.go +++ b/cmd/publisher/commands/publish_test.go @@ -41,7 +41,7 @@ func TestPublishCommand_DeprecatedSchema(t *testing.T) { name: "deprecated 2025-07-09 schema should show warning", schema: "https://static.modelcontextprotocol.io/schemas/2025-07-09/server.schema.json", expectError: true, - errorSubstr: "deprecated schema detected", + errorSubstr: "schema version 2025-07-09 is not the current version", }, { name: "current 2025-12-11 schema should pass validation", @@ -54,10 +54,10 @@ func TestPublishCommand_DeprecatedSchema(t *testing.T) { expectError: false, }, { - name: "custom schema without 2025-07-09 should pass validation", + name: "custom schema without 2025-07-09 should fail validation", schema: "https://example.com/custom.schema.json", expectError: true, - errorSubstr: "deprecated schema detected", + errorSubstr: "failed to extract schema version from URL", }, } diff --git a/cmd/publisher/commands/validate.go b/cmd/publisher/commands/validate.go new file mode 100644 index 0000000..ba6bcfa --- /dev/null +++ b/cmd/publisher/commands/validate.go @@ -0,0 +1,162 @@ +package commands + +import ( + "encoding/json" + "fmt" + "os" + "strings" + + "github.com/modelcontextprotocol/registry/internal/validators" + apiv0 "github.com/modelcontextprotocol/registry/pkg/api/v0" + "github.com/modelcontextprotocol/registry/pkg/model" +) + +// printSchemaValidationErrors prints nicely formatted error messages for schema validation issues +// (empty schema or non-current schema) with migration guidance to stdout. +// Returns the formatted error message string if any schema errors were printed, empty string otherwise. +func printSchemaValidationErrors(result *validators.ValidationResult, serverJSON *apiv0.ServerJSON) string { + currentSchemaURL := model.CurrentSchemaURL + migrationURL := "https://github.com/modelcontextprotocol/registry/blob/main/docs/reference/server-json/CHANGELOG.md" + checklistURL := migrationURL + "#migration-checklist-for-publishers" + + var formattedMsg strings.Builder + + for _, issue := range result.Issues { + switch issue.Reference { + case "schema-field-required": + // Empty/missing schema + _, _ = fmt.Fprintf(os.Stdout, "$schema field is required.\n") + _, _ = fmt.Fprintln(os.Stdout) + _, _ = fmt.Fprintf(os.Stdout, "Expected current schema: %s\n", currentSchemaURL) + _, _ = fmt.Fprintln(os.Stdout) + _, _ = fmt.Fprintln(os.Stdout, "Run 'mcp-publisher init' to create a new server.json with the correct schema, or update your existing server.json file.") + _, _ = fmt.Fprintln(os.Stdout) + _, _ = fmt.Fprintf(os.Stdout, "📋 Migration checklist: %s\n", checklistURL) + _, _ = fmt.Fprintf(os.Stdout, "📖 Full changelog with examples: %s\n", migrationURL) + _, _ = fmt.Fprintln(os.Stdout) + + // Build formatted error message + _, _ = fmt.Fprintf(&formattedMsg, "$schema field is required. Expected current schema: %s. 📋 Migration checklist: %s 📖 Full changelog with examples: %s", currentSchemaURL, checklistURL, migrationURL) + return formattedMsg.String() // Only one schema error at a time + + case "schema-version-deprecated": + // Non-current schema + if issue.Severity == validators.ValidationIssueSeverityWarning { + // Warning format (for validate command) + _, _ = fmt.Fprintf(os.Stdout, "⚠️ Deprecated schema detected: %s\n", serverJSON.Schema) + } else { + // Error format (for publish command) + _, _ = fmt.Fprintf(os.Stdout, "deprecated schema detected: %s.\n", serverJSON.Schema) + } + _, _ = fmt.Fprintln(os.Stdout) + _, _ = fmt.Fprintf(os.Stdout, "Expected current schema: %s\n", currentSchemaURL) + _, _ = fmt.Fprintln(os.Stdout) + _, _ = fmt.Fprintln(os.Stdout, "Migrate to the current schema format for new servers.") + _, _ = fmt.Fprintln(os.Stdout) + _, _ = fmt.Fprintf(os.Stdout, "📋 Migration checklist: %s\n", checklistURL) + _, _ = fmt.Fprintf(os.Stdout, "📖 Full changelog with examples: %s\n", migrationURL) + _, _ = fmt.Fprintln(os.Stdout) + + // Build formatted error message - include the original issue message for test compatibility + _, _ = fmt.Fprintf(&formattedMsg, "%s. deprecated schema detected: %s. Expected current schema: %s. Migrate to the current schema format for new servers. 📋 Migration checklist: %s 📖 Full changelog with examples: %s", issue.Message, serverJSON.Schema, currentSchemaURL, checklistURL, migrationURL) + return formattedMsg.String() // Only one schema error at a time + + case "schema-version-extraction-error": + // Invalid schema URL format - also include migration links for consistency + // Build formatted error message with migration links + _, _ = fmt.Fprintf(&formattedMsg, "%s. 📋 Migration checklist: %s 📖 Full changelog with examples: %s", issue.Message, checklistURL, migrationURL) + return formattedMsg.String() + } + } + + return "" +} + +// runValidationAndPrintIssues validates the server JSON, prints schema validation errors, and prints all issues. +// Validation failures are always printed (for both validate and publish commands). +// Returns the validation result and a formatted error message string for schema validation errors. +func runValidationAndPrintIssues(serverJSON *apiv0.ServerJSON, opts validators.ValidationOptions) (*validators.ValidationResult, string) { + result := validators.ValidateServerJSON(serverJSON, opts) + + // Print schema validation errors/warnings with friendly messages + formattedErrorMsg := printSchemaValidationErrors(result, serverJSON) + + if result.Valid { + return result, "" + } + + // Print all issues + _, _ = fmt.Fprintf(os.Stdout, "❌ Validation failed with %d issue(s):\n", len(result.Issues)) + _, _ = fmt.Fprintln(os.Stdout) + + // Track which schema issues we've already printed to avoid duplicates + issueNum := 1 + + for _, issue := range result.Issues { + // Skip schema issues that were already printed (they're printed by printSchemaValidationErrors above) + if issue.Reference == "schema-field-required" || issue.Reference == "schema-version-deprecated" { + continue + } + + // Print other issues normally + _, _ = fmt.Fprintf(os.Stdout, "%d. [%s] %s (%s)\n", issueNum, issue.Severity, issue.Path, issue.Type) + _, _ = fmt.Fprintf(os.Stdout, " %s\n", issue.Message) + if issue.Reference != "" { + _, _ = fmt.Fprintf(os.Stdout, " Reference: %s\n", issue.Reference) + } + _, _ = fmt.Fprintln(os.Stdout) + issueNum++ + } + + return result, formattedErrorMsg +} + +func ValidateCommand(args []string) error { + // Parse arguments + serverFile := "server.json" + + for _, arg := range args { + if arg == "--help" || arg == "-h" { + _, _ = fmt.Fprintln(os.Stdout, "Usage: mcp-publisher validate [file]") + _, _ = fmt.Fprintln(os.Stdout) + _, _ = fmt.Fprintln(os.Stdout, "Validate a server.json file without publishing.") + _, _ = fmt.Fprintln(os.Stdout) + _, _ = fmt.Fprintln(os.Stdout, "Arguments:") + _, _ = fmt.Fprintln(os.Stdout, " file Path to server.json file (default: ./server.json)") + _, _ = fmt.Fprintln(os.Stdout) + _, _ = fmt.Fprintln(os.Stdout, "The validate command performs exhaustive validation, reporting all issues at once.") + _, _ = fmt.Fprintln(os.Stdout, "It validates JSON syntax, schema compliance, and semantic rules.") + return nil + } + if !strings.HasPrefix(arg, "-") { + serverFile = arg + } + } + + // Read server file + serverData, err := os.ReadFile(serverFile) + if err != nil { + if os.IsNotExist(err) { + return fmt.Errorf("%s not found, please check the file path", serverFile) + } + return fmt.Errorf("failed to read %s: %w", serverFile, err) + } + + // Validate JSON + var serverJSON apiv0.ServerJSON + if err := json.Unmarshal(serverData, &serverJSON); err != nil { + return fmt.Errorf("invalid JSON: %w", err) + } + + // Run detailed validation (this is the whole point of the validate command) + // Include schema validation for comprehensive validation + // Warn about non-current schemas (don't error, just inform) + result, _ := runValidationAndPrintIssues(&serverJSON, validators.ValidationAll) + + if result.Valid { + _, _ = fmt.Fprintln(os.Stdout, "✅ server.json is valid") + return nil + } + + return fmt.Errorf("validation failed") +} diff --git a/cmd/publisher/main.go b/cmd/publisher/main.go index 5337d77..1b265d7 100644 --- a/cmd/publisher/main.go +++ b/cmd/publisher/main.go @@ -43,6 +43,8 @@ func main() { err = commands.LogoutCommand() case "publish": err = commands.PublishCommand(os.Args[2:]) + case "validate": + err = commands.ValidateCommand(os.Args[2:]) case "--version", "-v", "version": log.Printf("mcp-publisher %s (commit: %s, built: %s)", Version, GitCommit, BuildTime) return @@ -71,6 +73,7 @@ func printUsage() { _, _ = fmt.Fprintln(os.Stdout, " login Authenticate with the registry") _, _ = fmt.Fprintln(os.Stdout, " logout Clear saved authentication") _, _ = fmt.Fprintln(os.Stdout, " publish Publish server.json to the registry") + _, _ = fmt.Fprintln(os.Stdout, " validate Validate server.json without publishing") _, _ = fmt.Fprintln(os.Stdout) _, _ = fmt.Fprintln(os.Stdout, "Use 'mcp-publisher --help' for more information about a command.") } diff --git a/docs/design/proposed-enhanced-validation.md b/docs/design/proposed-enhanced-validation.md new file mode 100644 index 0000000..c1379c2 --- /dev/null +++ b/docs/design/proposed-enhanced-validation.md @@ -0,0 +1,912 @@ +# Enhanced Server Validation Design + +NOTE: This document describes a proposed direction for improving validation of server.json data in the Official Registry. This work is in progress (including open PRs and discussions) in a collaborative process and may change significantly or be abandoned. + +## Overview + +This document outlines the design for implementing comprehensive server validation in the MCP Registry, due to the following concerns: + +- Currently, the MCP Registry project publishes a server.json schema but does not validate servers against it, allowing non-compliant servers to be published. +- There is existing ad-hoc validation that covers some schema compliance, but not all (there are logical errors not identifiable by schema validation and that are not covered by the existing ad hoc validation). +- Many servers that do pass validation do not represent best-practices for published servers. + +This design implements a three-tier validation system: **Schema Validation**, **Semantic Validation**, and **Linter Validation**. + +## Current State + +### Problems with Current Validation +- **No schema validation**: Servers are published without validating against the published schema (and many violate it) +- **Incomplete validation**: Ad hoc validation covers only some schema constraints (many published servers have additional logical errors) +- **Best Practices not indicated**: Many servers that would pass schema and semantic validation do not represent best practices +- **Fail-fast behavior**: Legacy `ValidateServerJSON()` stopped at first error (now replaced with exhaustive validation) +- **No path information**: Errors don't specify where in JSON the problem occurs + +## Three-Tier Validation System + +### Schema Validation (Primary) +- **Validates against published schema**: Ensures servers comply with the official server.json schema +- **Exhaustive coverage**: Catches all structural and format violations defined in the schema +- **Detailed error references**: Shows exact schema rule locations with specific constraint and full path to constraint + +### Semantic Validation (Secondary) +- **Business logic validation**: Validates only constraints not expressible in JSON Schema +- **Registry validation**: Enforce validitiy of registry references (as current) +- **Logical Errors**: Enforce logical consistency: format, choices, variable usage, etc + +### Linter Validation (Tertiary) +- **Best practice recommendations**: Security concerns, style guidelines, naming conventions +- **Non-blocking**: Warnings and suggestions, not errors +- **Quality improvements**: Helps developers create better servers +- **Educational**: Teaches best practices for MCP server development + +## Implementation Approach + +The enhanced validation will be implemented in stages to minimize risk and allow for review and experimentation: + +### **Stage 1: Schema Validation and Exhaustive Validation Results (Current)** +- Convert existing validators to use and track context and to return exhaustive results +- Add `mcp-publisher validate` command that performs exhaustive validation with full schema validation +- Implement schema validation with configurable policy for non-current schemas +- Schema version validation consolidated in `schema.go` with policy support (Allow/Warn/Error) +- `mcp-publisher publish` command validates schema version (rejects empty and non-current schemas) but does not perform full schema validation +- API `/v0/publish` endpoint uses `ValidatePublishRequest` which validates schema version and semantic validation, but not full schema validation +- **All callers migrated**: All code now uses `ValidateServerJSON()` with `ValidationOptions` directly; legacy wrapper removed +- **ValidationResult.FirstError()**: Backward compatibility maintained via `FirstError()` method for code expecting error return type +- This allows experimentation and validation of the new model (including schema validation) without impacting production API + +### **Future Stages** +- Enable full schema validation in `mcp-publisher publish` command (currently only validates schema version) +- Enable full schema validation in the `/v0/publish` API endpoint (currently only validates schema version via `ValidatePublishRequest`) +- Add `/v0/validate` API endpoint for programmatic validation without publishing (see Validate API Endpoint section below) +- Enhance production code to use full validation results: Update `importer.go` and `validate-examples/main.go` to log all issues instead of just first error +- Build out comprehensive semantic and linter validation rules (with tests) +- Remove redundant manual validators that duplicate schema constraints +- Consider migrating tests to check all validation issues instead of just first error (where appropriate) + +## Proposed Design + +### Design Goals + +1. **Exhaustive Feedback**: Collect all validation issues in a single pass, not just the first error +2. **Precise Location**: Provide exact JSON paths for every validation issue +3. **Structured Output**: Return machine-readable validation results with consistent format +4. **Backward Compatibility**: Use `ValidationResult.FirstError()` for code expecting error return type +5. **Extensible**: Support different validation types (json, schema, semantic, linter) and severity levels + + +### Core Types + +```go +// Validation issue type with constrained values +type ValidationIssueType string + +const ( + ValidationIssueTypeJSON ValidationIssueType = "json" + ValidationIssueTypeSchema ValidationIssueType = "schema" + ValidationIssueTypeSemantic ValidationIssueType = "semantic" + ValidationIssueTypeLinter ValidationIssueType = "linter" +) + +// Validation issue severity with constrained values +type ValidationIssueSeverity string + +const ( + ValidationIssueSeverityError ValidationIssueSeverity = "error" + ValidationIssueSeverityWarning ValidationIssueSeverity = "warning" + ValidationIssueSeverityInfo ValidationIssueSeverity = "info" +) + +type ValidationIssue struct { + Type ValidationIssueType `json:"type"` + Path string `json:"path"` // JSON path like "packages[0].transport.url" + Message string `json:"message"` // Error description (extracted from error.Error()) + Severity ValidationIssueSeverity `json:"severity"` + Reference string `json:"reference"` // Schema rule path or rule name like "prefer-transport-configuration" +} + +type ValidationResult struct { + Valid bool `json:"valid"` + Issues []ValidationIssue `json:"issues"` +} + +type ValidationContext struct { + path string +} + +// SchemaVersionPolicy determines how non-current schema versions are handled +type SchemaVersionPolicy string + +const ( + SchemaVersionPolicyAllow SchemaVersionPolicy = "allow" // Allow non-current schemas silently + SchemaVersionPolicyWarn SchemaVersionPolicy = "warn" // Allow but generate warning + SchemaVersionPolicyError SchemaVersionPolicy = "error" // Reject non-current schemas +) + +// Constructor functions following Go conventions +func NewValidationIssue(issueType ValidationIssueType, path, message string, severity ValidationIssueSeverity, reference string) ValidationIssue +func NewValidationIssueFromError(issueType ValidationIssueType, path string, err error, reference string) ValidationIssue +``` + +### Validation Types + +The `Type` field categorizes validation issues by their source: + +- **`ValidationIssueTypeJSON`**: JSON parsing errors (malformed JSON syntax) +- **`ValidationIssueTypeSchema`**: JSON Schema validation errors (structural/format violations) +- **`ValidationIssueTypeSemantic`**: Logical validation errors not enforceable in schema (business rules) +- **`ValidationIssueTypeLinter`**: Best practice recommendations, security concerns, style guidelines + +The `Severity` field indicates the impact level: + +- **`ValidationIssueSeverityError`**: Critical issues that must be fixed +- **`ValidationIssueSeverityWarning`**: Issues that should be addressed +- **`ValidationIssueSeverityInfo`**: Suggestions and recommendations + +The `Reference` field provides context about what triggered the validation issue: + +- **Schema validation**: Contains the resolved schema path with `$ref` resolution (e.g., `"#/definitions/SseTransport/properties/url/format from: [#/definitions/ServerDetail]/properties/packages/items/[#/definitions/Package]/properties/transport/properties/url/format"`) +- **Semantic validation**: Contains rule names for business logic (e.g., `"invalid-server-name"`, `"missing-transport-url"`) +- **Linter validation**: Contains rule names for best practices (e.g., `"descriptive-naming"`, `"security-recommendation"`) +- **JSON validation**: Contains error type identifiers (e.g., `"json-syntax-error"`, `"invalid-json-format"`) + +### ValidationContext + +The `ValidationContext` tracks the current JSON path during validation, allowing validators to report issues with precise location information. This is essential for providing users with exact paths to problematic fields. + +#### **Purpose** +- **Path tracking**: Builds JSON paths like `"packages[0].transport.url"` as validation traverses nested structures +- **Precise error location**: Users can see exactly where validation issues occur +- **Immutable building**: Each method returns a new context, preventing accidental mutations + +#### **Usage Example** +```go +// Navigate to packages array, first item, transport field +pkgCtx := ctx.Field("packages").Index(0).Field("transport") +// Validate transport - any issues will be reported at "packages[0].transport" +``` + +### Backward Compatibility Strategy + +The design maintains perfect backward compatibility by leveraging Go's existing error handling patterns: + +#### **Error Message Preservation** +- **Current validators** use `fmt.Errorf("%w: %s", ErrInvalidRepositoryURL, obj.URL)` +- **New validators** use `NewValidationIssueFromError()` which extracts `err.Error()` +- **Result**: Identical error messages, ensuring all existing tests pass + +#### **Constructor Pattern** +Following Go conventions used throughout the project: +```go +// Standard constructor for manual field setting +issue := NewValidationIssue(ValidationIssueTypeLinter, "name", "message", ValidationIssueSeverityWarning, "rule-name") + +// Constructor that preserves existing error formatting +issue := NewValidationIssueFromError(ValidationIssueTypeSemantic, "path", err, "rule-name") +``` + +#### **Error Interface Compatibility** + +For code that needs an error return type, use `ValidationResult.FirstError()`: + +```go +result := ValidateServerJSON(serverJSON, ValidationSchemaVersionAndSemantic) +if err := result.FirstError(); err != nil { + return err // Returns first error-level issue as error +} +``` + +This maintains compatibility with existing error handling code while providing access to all validation issues. + +### New Validation Architecture + +#### **All Validators Use Context and Return ValidationResult** + +All existing validators are converted to use `ValidationContext` for precise error location tracking and return `ValidationResult` for comprehensive error collection: + +```go +func ValidateServerJSON(serverJSON *apiv0.ServerJSON, opts ValidationOptions) *ValidationResult { + result := &ValidationResult{Valid: true, Issues: []ValidationIssue{}} + + // Schema validation based on options + if opts.ValidateSchemaVersion || opts.ValidateSchema { + schemaResult := validateServerJSONSchema(serverJSON, opts.ValidateSchema, opts.NonCurrentSchemaPolicy) + result.Merge(schemaResult) + } + + // Semantic validation (if requested) + if opts.ValidateSemantic { + // Validate server name - using existing error logic + if _, err := parseServerName(*serverJSON); err != nil { + issue := NewValidationIssueFromError( + ValidationIssueTypeSemantic, + "name", + err, + "invalid-server-name", + ) + result.AddIssue(issue) + } + + // Validate repository with context + if repoResult := validateRepository(&ValidationContext{}, &serverJSON.Repository); !repoResult.Valid { + result.Merge(repoResult) + } + + // ... more semantic validation ... + } + + return result +} +``` + +For backward compatibility with code that expects an error return type, `ValidationResult.FirstError()` can be used: + +```go +result := ValidateServerJSON(serverJSON, ValidationSchemaVersionAndSemantic) +if err := result.FirstError(); err != nil { + return err +} +``` + +## Schema Validation + +The project uses `github.com/santhosh-tekuri/jsonschema/v5` for schema validation with an embedded schema approach. The schema is embedded at compile time using Go's `//go:embed` directive, eliminating the need for file system access and ensuring the schema is always available. + +### Schema-First Validation Strategy + +The enhanced validation system adopts a **schema-first approach** where JSON Schema validation serves as the primary and first validator. This strategy addresses the current duplication between manual/semantic validators and schema constraints. + +#### **Current Problem: Validation Duplication** + +The existing system has both: +- **Manual/semantic validators**: Custom Go code validating server name format, URL patterns, etc. +- **JSON Schema validation**: Structural validation of the same constraints + +This creates redundancy and potential inconsistencies where: +- Manual validators provide friendly error messages +- Schema validation provides technical error messages +- Both validate the same underlying constraints + +#### **Proposed Solution: Schema-First with Friendly Error Mapping** + +1. **Schema validation runs first** and catches all structural/format issues +2. **Manual validators are eliminated** for constraints already specified in the schema +3. **Schema error messages are mapped to friendly messages** using deterministic schema rule references (if needed) + +### Embedded Schema Benefits + +#### **No File System Dependencies** +- **Embedded at compile time**: Schema is included in the binary using `//go:embed schema/*.json` +- **No external files**: Eliminates dependency on schema files being present at runtime +- **Portable**: Binary contains everything needed for validation + +#### **Version Consistency** +- **Schema version tracking**: `model.CurrentSchemaURL` provides compile-time constant for current schema version +- **Version validation**: Schema version validation consolidated in `schema.go` with policy support (Allow/Warn/Error) +- **Empty schema handling**: Empty/missing schema fields always generate errors during validation +- **Compile-time validation**: Schema is validated when the binary is built +- **No version drift**: Schema version is locked to the binary version + +#### **Performance Benefits** +- **No I/O operations**: Schema is already in memory +- **Faster startup**: No need to read schema files +- **Reduced complexity**: No file path resolution or error handling for missing files + +### Rich Error Information + +The `jsonschema.ValidationError` provides: +- **InstanceLocation**: JSON Pointer format (RFC 6901) path to the invalid field (e.g., `"/packages/0/transport/url"`) +- **Error**: Detailed error message from schema +- **KeywordLocation**: Schema path with $ref segments (e.g., `"/$ref/properties/transport/$ref/properties/url/format"`) +- **AbsoluteKeywordLocation**: Resolved schema path (e.g., `"file:///server.schema.json#/definitions/SseTransport/properties/url/format"`) + +**Path Format Conversion**: JSON Pointer format paths from `InstanceLocation` are converted to bracket notation format to match semantic validation paths. The conversion transforms JSON Pointer paths like `"/packages/0/transport/url"` into bracket notation like `"packages[0].transport.url"`. This ensures consistent path formatting across all validation types (schema, semantic, and linter). + +#### **Current Error Reference Format** + +Schema validation errors now include detailed reference information: + +``` +Reference: #/definitions/Repository/properties/url/format from: [#/definitions/ServerDetail]/properties/repository/[#/definitions/Repository]/properties/url/format +``` + +This format provides: +- **Absolute location**: `#/definitions/Repository/properties/url/format` - the final resolved schema location +- **Resolved path**: Shows the complete path with `$ref` segments replaced by their resolved values in square brackets +- **Full context**: Users can see exactly which schema rule triggered the error and how it was reached + +#### **Error Message Quality** + +The current schema validation errors are generally quite readable: + +``` +[error] repository.url (schema) +'' has invalid format 'uri' +Reference: #/definitions/Repository/properties/url/format from: [#/definitions/ServerDetail]/properties/repository/[#/definitions/Repository]/properties/url/format +``` + +#### **Future Error Message Enhancement** + +If we encounter situations where schema validation errors need to be more user-friendly, we have full access to: + +- **`KeywordLocation`**: The schema path to the validating rule +- **`AbsoluteKeywordLocation`**: The absolute schema location after `$ref` resolution +- **`InstanceLocation`**: The JSON Pointer format path (e.g., `"/packages/0/transport/url"`) which is converted to bracket notation (e.g., `"packages[0].transport.url"`) for consistency with semantic validation +- **`Message`**: The original schema validation error message +- **Complete reference stack**: The entire resolved path showing how the error was reached + +This allows us to build better, more descriptive error messages if needed, while maintaining the current high-quality error references. + +### Integration with ValidateServerJSON + +```go +// ValidationOptions configures which types of validation to perform +type ValidationOptions struct { + ValidateSchemaVersion bool // Check schema version (empty, non-current) + ValidateSchema bool // Perform full schema validation (implies ValidateSchemaVersion) + ValidateSemantic bool // Perform semantic validation + NonCurrentSchemaPolicy SchemaVersionPolicy // Policy for non-current schemas +} + +// Common validation configurations +var ( + ValidationSemanticOnly = ValidationOptions{ + ValidateSemantic: true, + } + + ValidationSchemaVersionOnly = ValidationOptions{ + ValidateSchemaVersion: true, + NonCurrentSchemaPolicy: SchemaVersionPolicyError, + } + + ValidationSchemaVersionAndSemantic = ValidationOptions{ + ValidateSchemaVersion: true, + ValidateSemantic: true, + NonCurrentSchemaPolicy: SchemaVersionPolicyWarn, + } + + ValidationAll = ValidationOptions{ + ValidateSchema: true, // Implies ValidateSchemaVersion + ValidateSemantic: true, + NonCurrentSchemaPolicy: SchemaVersionPolicyWarn, + } +) + +func ValidateServerJSON(serverJSON *apiv0.ServerJSON, opts ValidationOptions) *ValidationResult { + result := &ValidationResult{Valid: true, Issues: []ValidationIssue{}} + ctx := &ValidationContext{} + + // Schema validation (version check and/or full validation) + if opts.ValidateSchemaVersion || opts.ValidateSchema { + schemaResult := validateServerJSONSchema(serverJSON, opts.ValidateSchema, opts.NonCurrentSchemaPolicy) + result.Merge(schemaResult) + } + + // Semantic validation (only if requested) + if !opts.ValidateSemantic { + return result + } + + // ... semantic validation logic ... + + return result +} +``` + +### Schema Version Validation + +Schema version validation is consolidated in `validateServerJSONSchema()` (now private) in `schema.go`: + +- **Empty schema check**: Always performed when schema validation is requested, always generates an error +- **Schema file existence check**: Always performed when schema validation is requested - verifies the schema file exists in embedded schemas, even when not performing full validation +- **Schema version policy**: Controls how non-current schemas are handled (via `ValidationOptions.NonCurrentSchemaPolicy`): + - `SchemaVersionPolicyAllow`: Non-current schemas are allowed with no warning + - `SchemaVersionPolicyWarn`: Non-current schemas are allowed but generate a warning + - `SchemaVersionPolicyError`: Non-current schemas are rejected with an error +- **Full schema validation**: Only performed if `performValidation` is `true` + +The `mcp-publisher publish` command validates schema version (rejects empty, non-existent, and non-current schemas) but does not perform full schema validation. The `mcp-publisher validate` command performs full schema validation with `SchemaVersionPolicyWarn` (warns about non-current schemas but doesn't error). + +### Request Validation Functions + +Two consolidated validation functions in `validators` package handle publish and update requests: + +- **`ValidatePublishRequest()`**: Validates publisher extensions, server JSON structure (via `ValidateServerJSON`), and registry ownership (if enabled) +- **`ValidateUpdateRequest()`**: Validates server JSON structure (via `ValidateServerJSON`) and registry ownership (if enabled), with option to skip registry validation for deleted servers + +Both functions use `ValidateServerJSON()` with `ValidationSchemaVersionAndSemantic` and `FirstError()` for backward-compatible error handling. Registry ownership validation is extracted into a shared `validateRegistryOwnership()` helper function. + +### Testing with Draft or Custom Schemas + +The validation system supports testing against draft schemas or custom schema versions by embedding them in the validators package. + +#### Setup Steps + +1. **Copy the schema file**: Copy your schema file (e.g., `docs/reference/server-json/server.schema.json`) to `internal/validators/schemas/{version}.json` + - Example: Copy to `internal/validators/schemas/draft.json` for draft schema testing + - Ensure the schema file's `$id` field matches: `https://static.modelcontextprotocol.io/schemas/{version}/server.schema.json` + - For draft schema, the `$id` should be: `https://static.modelcontextprotocol.io/schemas/draft/server.schema.json` + +2. **Rebuild**: Recompile the Go binary to embed the new schema file (schemas are embedded at compile time) + +3. **Use in server.json**: Reference the schema version in your `server.json` file: + ```json + { + "$schema": "https://static.modelcontextprotocol.io/schemas/draft/server.schema.json", + ... + } + ``` + +#### Schema Version Identifier Rules + +Schema version identifiers can contain: +- **Letters**: A-Z, a-z +- **Digits**: 0-9 +- **Special characters**: Hyphen (-), underscore (_), tilde (~), period (.) + +Examples of valid identifiers: `2025-10-17`, `draft`, `test-v1.0`, `custom_schema~1.2.3` + +#### Non-Current Schema Policy + +When testing with draft or custom schemas, they will be treated as **non-current** schemas (since they don't match `model.CurrentSchemaURL`), which triggers the `NonCurrentSchemaPolicy` behavior: + +- **`SchemaVersionPolicyAllow`**: Draft schemas are allowed with no warning +- **`SchemaVersionPolicyWarn`**: Draft schemas are allowed but generate a warning (default for `ValidationAll` and `ValidationSchemaVersionAndSemantic`) +- **`SchemaVersionPolicyError`**: Draft schemas are rejected with an error (default for `ValidationSchemaVersionOnly`) + +#### Treating Draft as Current Schema + +To test with a draft schema as if it were the current schema (no warnings/errors about non-current version): + +1. Temporarily update `model.CurrentSchemaVersion` in `pkg/model/constants.go`: + ```go + const ( + CurrentSchemaVersion = "draft" // Temporarily set for testing + CurrentSchemaURL = "https://static.modelcontextprotocol.io/schemas/" + CurrentSchemaVersion + "/server.schema.json" + ) + ``` + +2. Rebuild and test + +3. **Important**: Revert the change before committing - `model.CurrentSchemaVersion` should always point to the latest official schema version + +#### Example: Testing with Draft Schema + +```bash +# 1. Copy draft schema +cp docs/reference/server-json/server.schema.json internal/validators/schemas/draft.json + +# 2. Verify the $id field in draft.json is correct +# Should be: "https://static.modelcontextprotocol.io/schemas/draft/server.schema.json" + +# 3. Rebuild +go build ./... + +# 4. Use in server.json +# Set "$schema": "https://static.modelcontextprotocol.io/schemas/draft/server.schema.json" + +# 5. Validate +mcp-publisher validate server.json +``` + +**Note**: The draft schema will be validated successfully, but you may see a warning about it not being the current schema version unless you temporarily update `model.CurrentSchemaVersion` as described above. + +### Discriminated Union Error Consolidation + +The schema uses `anyOf` for discriminated unions (transport, argument, remote), which causes noisy error messages when validation fails. When a transport/argument/remote doesn't match its specified type, `anyOf` validation tries all variants and reports errors for each one that doesn't match. + +**Problem Example**: If you have an "sse" transport with no url, you get errors for all transport types: + +1. [error] packages[0].transport.type (schema) + value must be "stdio" + Reference: #/definitions/StdioTransport/properties/type/enum + +2. [error] packages[0].transport (schema) + missing required fields: 'url' + Reference: #/definitions/StreamableHttpTransport/required + +3. [error] packages[0].transport.type (schema) + value must be "streamable-http" + Reference: #/definitions/StreamableHttpTransport/properties/type/enum + +4. [error] packages[0].transport (schema) + missing required fields: 'url' + Reference: #/definitions/SseTransport/required + +**Solution Strategy**: Since we cannot modify the schema (it's managed in the static repository), we'll detect and consolidate these `anyOf` error patterns in the validation error processing code (`addDetailedErrors` in `schema.go`). + +**Detection Strategy**: +- Identify groups of errors at the same JSON path (e.g., `packages[0].transport`) +- Detect pattern of multiple "type must be X" errors or multiple "missing required fields" errors from different schema definitions +- Extract the actual `type` value from the JSON being validated +- Filter out errors from non-matching transport/argument/remote definitions +- Consolidate remaining errors into a single, actionable error message + +**Implementation Approach**: +- Add logic in `addDetailedErrors()` or a post-processing function to detect `anyOf` error clusters +- Group errors by instance location and analyze error patterns +- Identify the intended type from the JSON data +- Filter/consolidate errors to only show relevant issues for the actual type specified +- Preserve all other validation errors unchanged + +This approach allows us to provide clearer error messages without modifying the schema, and can be applied to transport, argument, and remote validation. + +**Future Enhancement**: If the schema is updated to use `if/then/else` discriminated unions in the future, this consolidation logic can be removed, but it provides immediate value without requiring schema changes. + +## Implementation Status + +### ✅ Completed Features + +#### **Core Validation System** +- [x] **ValidationIssue and ValidationResult types**: Complete with all required fields +- [x] **ValidationContext**: Immutable context building for JSON path tracking +- [x] **Constructor functions**: `NewValidationIssue()` and `NewValidationIssueFromError()` with consistent parameter naming +- [x] **Helper methods**: Context building, result merging, and path construction + +#### **Schema Validation Integration** +- [x] **JSON Schema validation**: Using existing `jsonschema/v5` library +- [x] **Error conversion**: Schema errors converted to `ValidationIssue` format +- [x] **$ref resolution**: Sophisticated resolution showing complete schema path with resolved references +- [x] **Comprehensive testing**: Full test coverage for schema validation scenarios +- [x] **Embedded schema**: Schema embedded at compile time using `//go:embed` directive +- [x] **Path format normalization**: JSON Pointer paths converted to bracket notation to match semantic validation format (e.g., `/packages/0/transport` → `packages[0].transport`) + +#### **Enhanced Error References** +- [x] **Resolved schema paths**: Shows complete path with `$ref` segments replaced by resolved values +- [x] **Incremental resolution**: Each `$ref` resolved in context of previous resolution +- [x] **Human-readable format**: Clear indication of schema rule location and resolution chain +- [x] **Consistent output**: All schema errors use the same reference format + +#### **Testing and Quality** +- [x] **Unit tests**: Comprehensive test coverage for all new functionality +- [x] **Integration tests**: End-to-end validation testing +- [x] **Backward compatibility**: Existing validation continues to work + +#### **Caller Migration** +- [x] **Function rename**: `ValidateServerJSONExhaustive` renamed to `ValidateServerJSON` (now takes `ValidationOptions` parameter) +- [x] **Legacy wrapper removed**: Old `ValidateServerJSON()` wrapper that returned `error` removed +- [x] **All callers migrated**: All production code and tests now use `ValidateServerJSON()` with `ValidationOptions` directly +- [x] **FirstError() helper**: `ValidationResult.FirstError()` method added for backward compatibility with error return types +- [x] **Request validators consolidated**: `ValidatePublishRequest` and `ValidateUpdateRequest` moved to validators package with shared `validateRegistryOwnership` helper + +### 🔄 In Progress + +#### **Schema-First Validation Strategy** +- [x] **Schema validation integration**: `ValidateServerJSON()` runs schema validation first +- [x] **CLI integration**: Schema validation enabled in `mcp-publisher validate` command +- [x] **Schema version validation**: Consolidated in `schema.go` with policy support (Allow/Warn/Error) +- [x] **Schema file existence check**: Schema version validation verifies schema file exists in embedded schemas +- [x] **Publish command schema checks**: `mcp-publisher publish` validates schema version (rejects empty, non-existent, and non-current schemas) +- [x] **API endpoint validation**: `/v0/publish` uses `ValidatePublishRequest` which validates schema version and semantic validation +- [ ] **Full schema validation in publish**: Enable full schema validation in `mcp-publisher publish` command +- [ ] **Full schema validation in API**: Enable full schema validation in `/v0/publish` API endpoint +- [ ] **Discriminated union error consolidation**: Detect and filter/consolidate noisy `anyOf` errors for transport, argument, and remote validation to show only relevant errors for the actual type +- [ ] **Error message mapping**: Map technical schema errors to user-friendly messages (if needed) +- [ ] **Validator migration**: Move from manual validators to schema-first approach + +### 📋 Pending + +#### **Migration Strategy** +- [ ] **Phase 1: Identify Schema Coverage**: Audit existing manual validators against schema constraints +- [ ] **Phase 2: Implement Error Mapping (Optional)**: Create mapping function for schema error messages (only if current messages are insufficient) +- [ ] **Phase 3: Error Consolidation**: Implement logic to detect and consolidate noisy `anyOf` errors from discriminated unions (transport, argument, remote) +- [ ] **Phase 4: Enable Schema-First Validation**: Update tests to expect schema validation errors instead of semantic errors; Enable schema validation in publish API +- [ ] **Phase 5: Clean Up Redundant Validators**: Remove manual validators that duplicate schema constraints +- [ ] **Phase 6: Add Enhanced Semantic and Linter Rules**: Review and implement specific rules from [MCP Registry Validator linter guidelines](https://github.com/TeamSparkAI/ToolCatalog/blob/main/packages/mcp-registry-validator/linter.md) + +#### **Command Integration** +- [x] **CLI updates**: `mcp-publisher validate` command uses detailed validation with full schema validation +- [x] **Publish command**: `mcp-publisher publish` validates schema version (rejects empty, non-existent, and non-current schemas) +- [x] **Shared validation logic**: Both commands use `runValidationAndPrintIssues` to eliminate duplication +- [x] **Caller migration**: All callers migrated to use `ValidateServerJSON()` with `ValidationOptions` directly +- [x] **Request validation consolidation**: `ValidatePublishRequest` and `ValidateUpdateRequest` consolidated in validators package +- [ ] **Enhanced error reporting**: Update production code (importer, validate-examples tool) to log all issues instead of just first error +- [ ] **Output formatting**: Add JSON output format options +- [ ] **Filtering options**: Add severity and type filtering + +#### **Validate API Endpoint** +- [ ] **POST /v0/validate endpoint**: API endpoint for validating server.json without publishing + +#### **Documentation and Polish** +- [ ] **API documentation**: Update API documentation with new validation types + +### 🎯 Key Achievements + +1. **Comprehensive Error Collection**: All validation issues collected in single pass +2. **Precise Error Location**: Exact JSON paths for every validation issue +3. **Schema Integration**: Full JSON Schema validation with detailed error references +4. **Backward Compatibility**: Existing validation continues to work unchanged +5. **Type Safety**: Constrained types prevent invalid validation issue creation +6. **Extensible Architecture**: Easy to add new validation types and severity levels + +The enhanced validation system is now production-ready with comprehensive schema validation, detailed error references, and full backward compatibility. + + +## Example Usage + +### JSON Output Format +```json +{ + "valid": false, + "issues": [ + { + "type": "json", + "path": "", + "message": "invalid JSON syntax at line 5, column 12", + "severity": "error", + "reference": "json-syntax-error" + }, + { + "type": "semantic", + "path": "name", + "message": "server name must be in format 'dns-namespace/name'", + "severity": "error", + "reference": "invalid-server-name" + }, + { + "type": "semantic", + "path": "packages[0].transport.url", + "message": "url is required for streamable-http transport type", + "severity": "error", + "reference": "missing-transport-url" + }, + { + "type": "schema", + "path": "packages[1].environmentVariables[0].name", + "message": "string does not match required pattern", + "severity": "error", + "reference": "#/definitions/EnvironmentVariable/properties/name/pattern from: [#/definitions/ServerDetail]/properties/packages/items/[#/definitions/Package]/properties/environmentVariables/items/[#/definitions/EnvironmentVariable]/properties/name/pattern" + }, + { + "type": "linter", + "path": "packages[1].description", + "message": "consider adding a more descriptive package description", + "severity": "warning", + "reference": "descriptive-package-description" + } + ] +} +``` + +**Note**: The JSON output still uses string values for `type` and `severity` fields for JSON serialization compatibility, but the Go code uses the typed constants for type safety. + +### CLI Usage +```bash +# Basic validation +mcp-publisher validate server.json + +# JSON output format +mcp-publisher validate --format json server.json + +# Filter by severity +mcp-publisher validate --severity error server.json + +# Include schema validation +mcp-publisher validate --schema server.json +``` + +## Benefits and Achievements + +### ✅ Comprehensive Feedback +- **Exhaustive error collection**: See all validation issues at once, not just the first error +- **Better developer experience**: No need to fix errors one by one +- **Precise error location**: JSON paths show exactly where issues occur in large JSON files +- **Structured output**: JSON format for tooling integration and machine-readable error information + +### ✅ Schema-First Validation +- **Primary validator**: Schema validation catches all structural and format violations defined in the schema +- **Semantic validation only for gaps**: Covers business logic that cannot be expressed in JSON Schema +- **Standards compliance**: Ensures server.json follows the official schema +- **Detailed error messages**: Exact JSON paths and resolved schema references + +### ✅ Backward Compatibility +- **Backward compatibility**: Use `ValidationResult.FirstError()` for code expecting error return type +- **Error interface compatibility**: Leverages Go's error interface and existing error constants +- **Constructor pattern**: Follows established project conventions +- **No breaking changes**: All error handling code remains functional + +### ✅ Extensible Architecture +- **Easy to add new validation types**: Schema, semantic, linter validation +- **Easy to add new severity levels**: Error, warning, info +- **Easy to add filtering and formatting options**: By type, severity, path pattern +- **Type safety**: Constrained types prevent invalid validation issue creation + +### ✅ Schema-First Strategy Benefits +- **Eliminates duplication**: Single source of truth for structural constraints +- **Better error messages**: Schema validation provides precise JSON paths with deterministic mapping +- **Maintainability**: Schema changes automatically update validation +- **Standards compliance**: Ensures validation matches official schema exactly + +## Technical Design + +### Architecture Overview + +The enhanced validation system uses a **schema-first approach** with comprehensive error collection and precise location tracking. The system is designed for maximum backward compatibility while providing extensive new capabilities. + +#### **Error Interface Compatibility** +- **Leverages existing error constants**: `ErrInvalidRepositoryURL`, `ErrVersionLooksLikeRange`, etc. +- **Preserves error wrapping**: Uses `fmt.Errorf("%w: %s", err, context)` pattern +- **Maintains error.Is() compatibility**: Existing error checking continues to work +- **No breaking changes**: All error handling code remains functional + +#### **Constructor Pattern** +Following established Go conventions in the project: +- **`NewValidationIssue()`**: Standard constructor following `NewXxx()` pattern +- **`NewValidationIssueFromError()`**: Specialized constructor for error conversion +- **Consistent with project**: Matches patterns used in `NewConfig()`, `NewServer()`, etc. +- **Type safety**: Compile-time validation of required fields + +#### **Context Passing Architecture** +- **Immutable context building**: `ctx.Field("name").Index(0)` pattern +- **Clean composition**: Validators focus on validation, not path building +- **Reusable validators**: Same validator can be called with different contexts +- **No global state**: Thread-safe validation with explicit context + +#### **Type Safety with Constrained Values** +Following Go best practices used throughout the project: +- **Typed string constants**: `ValidationIssueType`, `ValidationIssueSeverity` prevent invalid values +- **Compile-time validation**: IDE autocomplete and error checking +- **JSON compatibility**: Still serializes as strings for API compatibility +- **Refactoring safety**: Rename constants without breaking code +- **Consistent with project**: Matches patterns used in `Status`, `Format`, `ArgumentType` + +### Performance Considerations +- **Slightly slower than fail-fast validation**: Acceptable trade-off for better user experience +- **Memory usage increases with error collection**: Manageable for typical server.json files +- **Schema validation performance**: Embedded schema eliminates I/O operations + +### Testing Strategy +- **Unit tests**: Each validator with context +- **Integration tests**: End-to-end validation testing +- **Backward compatibility tests**: Ensure existing code continues to work +- **Performance benchmarks**: Validate acceptable performance characteristics + +--- + +## Appendix: Future Enhancements + +### Additional Validation Types +- **Linter rules**: Best practices and style guidelines +- **Warning level**: Non-critical issues +- **Info level**: Suggestions and improvements + +### Advanced Features +- **Error filtering**: By type, severity, path pattern +- **Output formatting**: Human-readable, JSON, XML +- **Configuration**: Custom validation rules +- **IDE integration**: Real-time validation feedback + +### Tooling Integration +- **WASM package**: Browser-based validation +- **VS Code extension**: Real-time validation +- **CI/CD integration**: Automated validation in pipelines +- **API endpoint**: Validation as a service (see Validate API Endpoint section below) + +## Validate API Endpoint + +### Overview + +A REST API endpoint (`POST /v0/validate`) that validates `server.json` files without publishing them to the registry. This endpoint provides programmatic access to the same validation logic used by the CLI commands, returning structured validation results in JSON format. + +### Use Cases + +- **CI/CD Pipelines**: Validate server.json files before attempting to publish +- **Editor/IDE Integrations**: Real-time validation feedback in development tools +- **Web UIs**: Validate files in browser-based interfaces +- **Pre-publish Checks**: Validate before authentication/publishing workflow +- **Validation as a Service**: Allow external tools to validate server.json format + +### Implementation + +#### Endpoint Specification + +**Endpoint**: `POST /v0/validate` +**Authentication**: None required (read-only operation) +**Content-Type**: `application/json` + +#### Request + +Request body should be a valid `ServerJSON` object: + +```json +{ + "$schema": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", + "name": "io.example/server", + "version": "1.0.0", + ... +} +``` + +#### Response + +Returns a `ValidationResult` in JSON format: + +```json +{ + "valid": false, + "issues": [ + { + "type": "schema", + "path": "packages[0].transport.url", + "message": "missing required field: 'url'", + "severity": "error", + "reference": "#/definitions/SseTransport/required" + }, + { + "type": "semantic", + "path": "name", + "message": "server name must be in format 'dns-namespace/name'", + "severity": "error", + "reference": "invalid-server-name" + } + ] +} +``` + +**HTTP Status Codes**: +- `200 OK`: Validation completed successfully (regardless of whether valid or invalid) +- `400 Bad Request`: Malformed JSON or invalid request format + +Note: A `200 OK` status does not mean the server.json is valid - check the `valid` field in the response body. + +#### Implementation Details + +**Location**: `internal/api/handlers/v0/validate.go` + +**Handler Function**: +- Accepts `ServerJSON` in request body +- Calls `validators.ValidateServerJSON(serverJSON, validators.ValidationAll)` +- Returns `ValidationResult` as JSON response +- Uses Huma framework (same as publish endpoint) for request/response handling + +**Key Differences from Publish Endpoint**: +- No authentication required (read-only) +- Does not save to database +- Returns structured validation results instead of published server response +- Returns warnings, not just errors (useful for comprehensive feedback) + +**Reuses Existing Infrastructure**: +- Same validation functions as CLI commands +- Same `ValidationResult` type +- Same issue types and severity levels +- Consistent validation behavior across CLI and API + +### Testing Strategy + +#### Unit Tests + +Test handler function with mocked dependencies: +- Valid server.json → `valid: true, issues: []` +- Invalid server.json → `valid: false` with specific issues +- Schema errors → issues with `type: "schema"` +- Semantic errors → issues with `type: "semantic"` +- Empty schema → `schema-field-required` issue +- Non-current schema → `schema-version-deprecated` issue +- Multiple issues → all issues returned in response +- Malformed JSON → proper error handling + +#### Integration Tests + +Follow patterns from `publish_integration_test.go`: +- Start test server +- Send HTTP POST requests with various `server.json` payloads +- Assert response JSON matches expected `ValidationResult` structure +- Verify HTTP status codes (200 for valid requests, 400 for malformed) +- Test both valid and invalid inputs +- Reuse test fixtures from `validation_detailed_test.go` + +#### Test Infrastructure + +- Reuse existing test server setup +- Use same patterns as `test_endpoints.sh` for manual testing +- Leverage existing validation test cases + +### Future Enhancements + +- **Query Parameters**: Optional parameters to filter by issue type or severity +- **Partial Validation**: Validate specific sections (e.g., only schema, only semantic) +- **Format Options**: Request different output formats (detailed vs. summary) +- **Batch Validation**: Validate multiple server.json files in one request + + + + diff --git a/docs/modelcontextprotocol-io/remote-servers.mdx b/docs/modelcontextprotocol-io/remote-servers.mdx index 8e88748..3859809 100644 --- a/docs/modelcontextprotocol-io/remote-servers.mdx +++ b/docs/modelcontextprotocol-io/remote-servers.mdx @@ -155,7 +155,7 @@ The `remotes` property can coexist with the `packages` property in `server.json` "packages": [ { "registryType": "npm", - "identifier": "@username/email-integration-mcp", + "identifier": "@example/email-integration-mcp", "version": "1.0.0", "transport": { "type": "stdio" diff --git a/docs/reference/cli/commands.md b/docs/reference/cli/commands.md index 5564903..d2185a4 100644 --- a/docs/reference/cli/commands.md +++ b/docs/reference/cli/commands.md @@ -207,6 +207,45 @@ mcp-publisher login none [--registry=URL] - No authentication - for local testing only - Only works with local registry instances +### `mcp-publisher validate` + +Validate a `server.json` file without publishing. + +**Usage:** +```bash +mcp-publisher validate [file] +``` + +**Arguments:** +- `file` - Path to server.json file (default: `./server.json`) + +**Behavior:** +- Performs exhaustive validation, reporting all issues at once (not just the first error) +- Validates JSON syntax and schema compliance +- Runs semantic validation (business logic checks) +- Checks for deprecated schema versions and provides migration guidance +- Includes detailed error locations with JSON paths (e.g., `packages[0].transport.url`) +- Shows validation issue type (json, schema, semantic, linter) +- Displays severity level (error, warning, info) +- Provides schema references showing which validation rule triggered each error + +**Example output:** +```bash +$ mcp-publisher validate +✅ server.json is valid + +$ mcp-publisher validate custom-server.json +❌ Validation failed with 2 issue(s): + +1. [error] repository.url (schema) + '' has invalid format 'uri' + Reference: #/definitions/Repository/properties/url/format from: [#/definitions/ServerDetail]/properties/repository/[#/definitions/Repository]/properties/url/format + +2. [error] name (semantic) + server name must be in format 'dns-namespace/name' + Reference: invalid-server-name +``` + ### `mcp-publisher publish` Publish server to the registry. diff --git a/internal/importer/importer.go b/internal/importer/importer.go index 94d29e1..4a418d1 100644 --- a/internal/importer/importer.go +++ b/internal/importer/importer.go @@ -99,7 +99,10 @@ func readSeedFile(ctx context.Context, path string) ([]*apiv0.ServerJSON, error) var validationFailures []string for _, response := range serverResponses { - if err := validators.ValidateServerJSON(&response); err != nil { + // ValidateServerJSON returns all validation results; using FirstError() to preserve existing behavior + // In future, consider logging all issues from result.Issues for better diagnostics + result := validators.ValidateServerJSON(&response, validators.ValidationSchemaVersionAndSemantic) + if err := result.FirstError(); err != nil { // Log warning and track invalid server instead of failing invalidServers = append(invalidServers, response.Name) validationFailures = append(validationFailures, fmt.Sprintf("Server '%s': %v", response.Name, err)) diff --git a/internal/service/registry_service.go b/internal/service/registry_service.go index f499d42..3b41cde 100644 --- a/internal/service/registry_service.go +++ b/internal/service/registry_service.go @@ -209,7 +209,7 @@ func (s *registryServiceImpl) updateServerInTransaction(ctx context.Context, tx skipRegistryValidation := currentlyDeleted || beingDeleted // Validate the request, potentially skipping registry validation for deleted servers - if err := s.validateUpdateRequest(ctx, *req, skipRegistryValidation); err != nil { + if err := validators.ValidateUpdateRequest(ctx, *req, s.cfg, skipRegistryValidation); err != nil { return nil, err } @@ -243,25 +243,3 @@ func (s *registryServiceImpl) updateServerInTransaction(ctx context.Context, tx return updatedServerResponse, nil } - -// validateUpdateRequest validates an update request with optional registry validation skipping -func (s *registryServiceImpl) validateUpdateRequest(ctx context.Context, req apiv0.ServerJSON, skipRegistryValidation bool) error { - // Always validate the server JSON structure - if err := validators.ValidateServerJSON(&req); err != nil { - return err - } - - // Skip registry validation if requested (for deleted servers) - if skipRegistryValidation || !s.cfg.EnableRegistryValidation { - return nil - } - - // Perform registry validation for all packages - for i, pkg := range req.Packages { - if err := validators.ValidatePackage(ctx, pkg, req.Name); err != nil { - return fmt.Errorf("registry validation failed for package %d (%s): %w", i, pkg.Identifier, err) - } - } - - return nil -} diff --git a/internal/validators/schema.go b/internal/validators/schema.go new file mode 100644 index 0000000..8a64b32 --- /dev/null +++ b/internal/validators/schema.go @@ -0,0 +1,476 @@ +package validators + +import ( + "bytes" + "embed" + "encoding/json" + "errors" + "fmt" + "regexp" + "strconv" + "strings" + + apiv0 "github.com/modelcontextprotocol/registry/pkg/api/v0" + "github.com/modelcontextprotocol/registry/pkg/model" + "github.com/santhosh-tekuri/jsonschema/v5" +) + +//go:embed schemas/*.json +var schemaFS embed.FS + +// extractVersionFromSchemaURL extracts the version identifier from a schema URL +// e.g., "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json" -> "2025-10-17" +// e.g., "https://static.modelcontextprotocol.io/schemas/draft/server.schema.json" -> "draft" +// Version identifier can contain: A-Z, a-z, 0-9, hyphen (-), underscore (_), tilde (~), and period (.) +func extractVersionFromSchemaURL(schemaURL string) (string, error) { + // Pattern: /schemas/{identifier}/server.schema.json + // Identifier allowed characters: A-Z, a-z, 0-9, -, _, ~, . + re := regexp.MustCompile(`/schemas/([A-Za-z0-9_~.-]+)/server\.schema\.json`) + matches := re.FindStringSubmatch(schemaURL) + if len(matches) < 2 { + return "", fmt.Errorf("invalid schema URL format: %s", schemaURL) + } + return matches[1], nil +} + +// loadSchemaByVersion loads a schema file from the embedded filesystem by version +func loadSchemaByVersion(version string) ([]byte, error) { + filename := fmt.Sprintf("schemas/%s.json", version) + data, err := schemaFS.ReadFile(filename) + if err != nil { + return nil, fmt.Errorf("schema version %s not found in embedded schemas: %w", version, err) + } + return data, nil +} + +// GetCurrentSchemaVersion returns the current schema URL from constants +func GetCurrentSchemaVersion() (string, error) { + return model.CurrentSchemaURL, nil +} + +// validateServerJSONSchema validates the server JSON against the schema version specified in $schema using jsonschema +// Empty/missing schema always produces an error. +// If performValidation is true, performs full JSON Schema validation. +// If performValidation is false, only checks for empty schema (always an error) and handles non-current schemas per policy. +// nonCurrentPolicy determines how non-current (but valid) schema versions are handled when performValidation is true. +func validateServerJSONSchema(serverJSON *apiv0.ServerJSON, performValidation bool, nonCurrentPolicy SchemaVersionPolicy) *ValidationResult { + result := &ValidationResult{Valid: true, Issues: []ValidationIssue{}} + ctx := &ValidationContext{} + + // Empty/missing schema is always an error + if serverJSON.Schema == "" { + issue := NewValidationIssue( + ValidationIssueTypeSemantic, + ctx.Field("schema").String(), + "$schema field is required", + ValidationIssueSeverityError, + "schema-field-required", + ) + result.AddIssue(issue) + return result + } + + // Extract version from the schema URL + version, err := extractVersionFromSchemaURL(serverJSON.Schema) + if err != nil { + issue := NewValidationIssue( + ValidationIssueTypeSchema, + ctx.Field("schema").String(), + fmt.Sprintf("failed to extract schema version from URL: %v", err), + ValidationIssueSeverityError, + "schema-version-extraction-error", + ) + result.AddIssue(issue) + return result + } + + // Check if the schema version is the current one and handle based on policy + currentSchemaURL, err := GetCurrentSchemaVersion() + if err == nil && serverJSON.Schema != currentSchemaURL { + // Extract current version for the message + currentVersion, _ := extractVersionFromSchemaURL(currentSchemaURL) + + switch nonCurrentPolicy { + case SchemaVersionPolicyError: + issue := NewValidationIssue( + ValidationIssueTypeSemantic, + ctx.Field("schema").String(), + fmt.Sprintf("schema version %s is not the current version (%s). Use the current schema version", version, currentVersion), + ValidationIssueSeverityError, + "schema-version-deprecated", + ) + result.AddIssue(issue) + case SchemaVersionPolicyWarn: + issue := NewValidationIssue( + ValidationIssueTypeSemantic, + ctx.Field("schema").String(), + fmt.Sprintf("schema version %s is not the current version (%s). Consider updating to the latest schema version", version, currentVersion), + ValidationIssueSeverityWarning, + "schema-version-deprecated", + ) + result.AddIssue(issue) + case SchemaVersionPolicyAllow: + // No issue added - allow non-current schemas silently + } + } + + // Load the appropriate schema file to verify it exists (required for schema version validation) + // This ensures that the specified schema version is available, even when not performing full validation + schemaData, err := loadSchemaByVersion(version) + if err != nil { + issue := NewValidationIssue( + ValidationIssueTypeSchema, + ctx.Field("schema").String(), + fmt.Sprintf("schema version %s not available: %v", version, err), + ValidationIssueSeverityError, + "schema-version-not-available", + ) + result.AddIssue(issue) + return result + } + + // If not performing validation, return after performing schema version checks (done above) + if !performValidation { + return result + } + + // Parse the schema + var schema map[string]any + if err := json.Unmarshal(schemaData, &schema); err != nil { + // If we can't parse the schema, return an error + issue := NewValidationIssue( + ValidationIssueTypeSchema, + ctx.Field("schema").String(), + fmt.Sprintf("failed to parse schema file: %v", err), + ValidationIssueSeverityError, + "schema-parse-error", + ) + result.AddIssue(issue) + return result + } + + // Convert the server JSON to a map for validation + serverData, err := json.Marshal(serverJSON) + if err != nil { + issue := NewValidationIssue( + ValidationIssueTypeJSON, + "", + fmt.Sprintf("failed to marshal server JSON for schema validation: %v", err), + ValidationIssueSeverityError, + "json-marshal-error", + ) + result.AddIssue(issue) + return result + } + + var serverMap map[string]any + if err := json.Unmarshal(serverData, &serverMap); err != nil { + issue := NewValidationIssue( + ValidationIssueTypeJSON, + "", + fmt.Sprintf("failed to unmarshal server JSON for schema validation: %v", err), + ValidationIssueSeverityError, + "json-unmarshal-error", + ) + result.AddIssue(issue) + return result + } + + // Get the schema $id for proper reference resolution + // Schema files must have $id (required by JSON Schema spec and verified by sync process) + // However, we check here in case a schema file exists but is malformed or missing $id + schemaID, ok := schema["$id"].(string) + if !ok { + issue := NewValidationIssue( + ValidationIssueTypeSchema, + ctx.Field("schema").String(), + fmt.Sprintf("schema file for version %s exists but is missing or has invalid $id field (required by JSON Schema spec)", version), + ValidationIssueSeverityError, + "schema-missing-id", + ) + result.AddIssue(issue) + return result + } + + // Validate against schema using jsonschema library + compiler := jsonschema.NewCompiler() + if err := compiler.AddResource(schemaID, bytes.NewReader(schemaData)); err != nil { + // If we can't add the schema resource, return an error + issue := NewValidationIssue( + ValidationIssueTypeSchema, + ctx.Field("schema").String(), + fmt.Sprintf("failed to add schema resource: %v", err), + ValidationIssueSeverityError, + "schema-resource-error", + ) + result.AddIssue(issue) + return result + } + + schemaInstance, err := compiler.Compile(schemaID) + if err != nil { + // If we can't compile the schema, return an error + issue := NewValidationIssue( + ValidationIssueTypeSchema, + "", + fmt.Sprintf("failed to compile schema: %v", err), + ValidationIssueSeverityError, + "schema-compile-error", + ) + result.AddIssue(issue) + return result + } + + // Perform validation + if err := schemaInstance.Validate(serverMap); err != nil { + // Convert validation error to our issue format + var validationErr *jsonschema.ValidationError + if errors.As(err, &validationErr) { + // Process the validation error and its causes + addValidationError(result, validationErr, schema) + } else { + // Fallback for other error types + issue := NewValidationIssue( + ValidationIssueTypeSchema, + "", + fmt.Sprintf("schema validation failed: %v", err), + ValidationIssueSeverityError, + "schema-validation-error", + ) + result.AddIssue(issue) + } + } + + return result +} + +// addValidationError processes validation errors and extracts useful information +func addValidationError(result *ValidationResult, validationErr *jsonschema.ValidationError, schema map[string]any) { + // Use DetailedOutput to get the nested error details + detailed := validationErr.DetailedOutput() + + // Process the detailed error structure + + addDetailedErrors(result, detailed, schema) +} + +// ConvertJSONPointerToBracketNotation converts a JSON Pointer path (RFC 6901) to bracket notation +// format to match the format used by semantic validation (ValidationContext). +// The transformation includes: +// 1. Remove leading slash from JSON Pointer format +// 2. Convert path separators from "/" to "." +// 3. Convert numeric array indices from dot notation to bracket notation +// Example: "/packages/0/transport" -> "packages[0].transport" +// Example: "/0/name" -> "[0].name" +// Example: "/packages/0/transport/1/url" -> "packages[0].transport[1].url" +func ConvertJSONPointerToBracketNotation(jsonPointer string) string { + if jsonPointer == "" { + return "" + } + + // Step 1: Convert JSON Pointer to dot notation (remove leading slash, convert / to .) + path := strings.TrimPrefix(jsonPointer, "/") + path = strings.ReplaceAll(path, "/", ".") + + // Step 2: Convert dot notation array indices to bracket notation + if path == "" { + return "" + } + + parts := strings.Split(path, ".") + var result strings.Builder + + for i, part := range parts { + // Check if part is a pure number (array index) + if _, err := strconv.Atoi(part); err == nil { + // It's a numeric index - use bracket notation + result.WriteString(fmt.Sprintf("[%s]", part)) + // Add dot after bracket if next part exists and is a field name (not a number) + if i < len(parts)-1 { + nextPart := parts[i+1] + if _, err := strconv.Atoi(nextPart); err != nil { + // Next part is a field name, add dot separator + result.WriteString(".") + } + // If next part is a number, no dot needed (brackets will connect: [0][1]) + } + } else { + // It's a field name + // Add dot separator before field name if previous part was also a field name + if i > 0 { + prevPart := parts[i-1] + if _, err := strconv.Atoi(prevPart); err != nil { + // Previous was not a number (it's a field), need dot separator + result.WriteString(".") + } + // If previous was a number, brackets already written, dot added after bracket above + } + result.WriteString(part) + } + } + + return result.String() +} + +// addDetailedErrors recursively processes detailed validation errors +func addDetailedErrors(result *ValidationResult, detailed jsonschema.Detailed, schema map[string]any) { + // Only process errors that have specific field paths and meaningful messages + if detailed.InstanceLocation != "" && detailed.Error != "" { + // Convert JSON Pointer format to bracket notation to match semantic validation format + path := ConvertJSONPointerToBracketNotation(detailed.InstanceLocation) + + // Clean up the error message + message := detailed.Error + + // Make messages more user-friendly + if strings.Contains(message, "missing properties:") { + message = strings.ReplaceAll(message, "missing properties:", "missing required fields:") + } + if strings.Contains(message, "is not valid") { + message = strings.ReplaceAll(message, "is not valid", "has invalid format") + } + + // Build the full resolved reference path + reference := buildResolvedReference(detailed.KeywordLocation, detailed.AbsoluteKeywordLocation, schema) + + issue := NewValidationIssue( + ValidationIssueTypeSchema, + path, + message, + ValidationIssueSeverityError, + reference, // cleaned schema rule path for deterministic mapping + ) + result.AddIssue(issue) + } + + // Process nested errors + for _, nested := range detailed.Errors { + addDetailedErrors(result, nested, schema) + } +} + +// buildResolvedReference extracts the resolved reference path by resolving $ref segments +func buildResolvedReference(keywordLocation, absoluteKeywordLocation string, schema map[string]any) string { + if keywordLocation == "" || absoluteKeywordLocation == "" { + return "" + } + + // Clean up the absolute location by removing file:// prefix + absolute := absoluteKeywordLocation + if strings.HasPrefix(absolute, "file://") { + absolute = strings.TrimPrefix(absolute, "file://") + if idx := strings.Index(absolute, "#"); idx != -1 { + absolute = absolute[idx:] // Keep only the #/path part + } + } + + // Parse the keyword location to understand the $ref chain + keyword := strings.TrimPrefix(keywordLocation, "/") + keywordParts := strings.Split(keyword, "/") + + // Build the path showing $ref resolution + pathSegments := make([]string, 0) + + // Track the resolved path so far (starts empty, gets built up as we resolve $refs) + resolvedPath := "" + + // Process each part of the keyword path + for i, part := range keywordParts { + if part == "" { + continue // Skip empty parts + } + + if part == "$ref" { + // This is a $ref - we need to look up what it resolves to + // For the first $ref, use the path from the root + // For subsequent $refs, use the resolved path from the previous $ref plus the current segment + var refPath string + if resolvedPath == "" { + // First $ref - use the path from the root + refPath = strings.Join(keywordParts[:i+1], "/") + refPath = "/" + refPath + } else { + // Subsequent $ref - use the resolved path plus the current segment + refPath = resolvedPath + "/" + part + } + + // Look up the $ref value in the schema + refValue := resolveRefInSchema(schema, refPath) + + if refValue != "" { + pathSegments = append(pathSegments, fmt.Sprintf("[%s]", refValue)) + // Update the resolved path for the next $ref + resolvedPath = refValue + } else { + pathSegments = append(pathSegments, "[$ref]") + } + } else { + // Regular path segment + pathSegments = append(pathSegments, part) + // Add this segment to the resolved path for the next $ref + if resolvedPath != "" { + resolvedPath = resolvedPath + "/" + part + } else { + resolvedPath = part + } + } + } + + // Build the final reference string + if len(pathSegments) > 0 { + pathStr := strings.Join(pathSegments, "/") + return fmt.Sprintf("%s from: %s", absolute, pathStr) + } + + // Fallback: return the absolute location with context + return absolute + " (from: " + keywordLocation + ")" +} + +// resolveRefInSchema looks up a $ref value in the schema +func resolveRefInSchema(schema map[string]any, refPath string) string { + // Handle the # prefix - it indicates the root of the schema JSON + refPath = strings.TrimPrefix(refPath, "#") + + // Parse the JSON pointer path + pathParts := strings.Split(strings.TrimPrefix(refPath, "/"), "/") + + // Navigate through the schema to find the $ref value + var current any = schema + for _, part := range pathParts { + if part == "" { + continue + } + + if part == "$ref" { + // We've reached the $ref, return its value + if currentMap, ok := current.(map[string]any); ok { + if refValue, ok := currentMap["$ref"].(string); ok { + return refValue + } + } + return "" + } + + // Navigate to the next level + // Check if this is an array index + if index, err := strconv.Atoi(part); err == nil { + // This is an array index - check if current element is an array + if arr, ok := current.([]any); ok && index < len(arr) { + current = arr[index] + } else { + // Current element is not an array or index out of bounds + return "" + } + } else { + // This is a map key + if currentMap, ok := current.(map[string]any); ok { + current = currentMap[part] + } else { + // Current element is not a map + return "" + } + } + } + + return "" +} diff --git a/internal/validators/schema_test.go b/internal/validators/schema_test.go new file mode 100644 index 0000000..61768e4 --- /dev/null +++ b/internal/validators/schema_test.go @@ -0,0 +1,121 @@ +package validators_test + +import ( + "testing" + + "github.com/modelcontextprotocol/registry/internal/validators" + "github.com/stretchr/testify/assert" +) + +func TestConvertJSONPointerToBracketNotation(t *testing.T) { + tests := []struct { + name string + jsonPointer string + expectedOutput string + description string + }{ + { + name: "single array index in middle", + jsonPointer: "/packages/0/transport", + expectedOutput: "packages[0].transport", + description: "JSON Pointer with single array index converts to bracket notation", + }, + { + name: "multiple array indices", + jsonPointer: "/packages/0/transport/1/url", + expectedOutput: "packages[0].transport[1].url", + description: "JSON Pointer with multiple array indices converts correctly", + }, + { + name: "leading array index", + jsonPointer: "/0/name", + expectedOutput: "[0].name", + description: "JSON Pointer starting with array index converts to leading bracket", + }, + { + name: "trailing array index", + jsonPointer: "/packages/0", + expectedOutput: "packages[0]", + description: "JSON Pointer ending with array index converts correctly", + }, + { + name: "no array indices", + jsonPointer: "/name/version", + expectedOutput: "name.version", + description: "JSON Pointer without array indices converts to dot notation only", + }, + { + name: "complex nested path", + jsonPointer: "/packages/0/runtimeArguments/1/name", + expectedOutput: "packages[0].runtimeArguments[1].name", + description: "Complex nested JSON Pointer with multiple indices converts correctly", + }, + { + name: "multiple consecutive indices", + jsonPointer: "/a/0/1/2", + expectedOutput: "a[0][1][2]", + description: "JSON Pointer with consecutive array indices converts to consecutive brackets", + }, + { + name: "single character path with index", + jsonPointer: "/a/0", + expectedOutput: "a[0]", + description: "Simple JSON Pointer with single field and index converts correctly", + }, + { + name: "empty string", + jsonPointer: "", + expectedOutput: "", + description: "Empty JSON Pointer returns empty string", + }, + { + name: "root path", + jsonPointer: "/", + expectedOutput: "", + description: "Root JSON Pointer (just slash) converts to empty string", + }, + { + name: "only index", + jsonPointer: "/0", + expectedOutput: "[0]", + description: "JSON Pointer with only array index converts to bracket notation", + }, + { + name: "two digit index", + jsonPointer: "/packages/10/transport", + expectedOutput: "packages[10].transport", + description: "JSON Pointer with multi-digit array index converts correctly", + }, + { + name: "three digit index", + jsonPointer: "/packages/123/transport", + expectedOutput: "packages[123].transport", + description: "JSON Pointer with three-digit array index converts correctly", + }, + { + name: "remotes array index", + jsonPointer: "/remotes/0/url", + expectedOutput: "remotes[0].url", + description: "JSON Pointer for remotes array converts correctly", + }, + { + name: "package arguments nested", + jsonPointer: "/packages/0/packageArguments/0/format", + expectedOutput: "packages[0].packageArguments[0].format", + description: "JSON Pointer with nested array structures converts correctly", + }, + { + name: "repository url", + jsonPointer: "/repository/url", + expectedOutput: "repository.url", + description: "JSON Pointer without array indices converts to simple dot notation", + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + result := validators.ConvertJSONPointerToBracketNotation(tt.jsonPointer) + assert.Equal(t, tt.expectedOutput, result, "%s: JSON Pointer format should convert to bracket notation", tt.description) + }) + } +} diff --git a/internal/validators/schemas/2025-07-09.json b/internal/validators/schemas/2025-07-09.json new file mode 100644 index 0000000..e4e0a92 --- /dev/null +++ b/internal/validators/schemas/2025-07-09.json @@ -0,0 +1,478 @@ +{ + "$schema": "http://json-schema.org/draft-07/schema#", + "$id": "https://static.modelcontextprotocol.io/schemas/2025-07-09/server.schema.json", + "title": "MCP Server Detail", + "$ref": "#/definitions/ServerDetail", + "definitions": { + "Repository": { + "type": "object", + "description": "Repository metadata for the MCP server source code. Enables users and security experts to inspect the code, improving transparency.", + "required": [ + "url", + "source" + ], + "properties": { + "url": { + "type": "string", + "format": "uri", + "description": "Repository URL for browsing source code. Should support both web browsing and git clone operations.", + "example": "https://github.com/modelcontextprotocol/servers" + }, + "source": { + "type": "string", + "description": "Repository hosting service identifier. Used by registries to determine validation and API access methods.", + "example": "github" + }, + "id": { + "type": "string", + "description": "Repository identifier from the hosting service (e.g., GitHub repo ID). Owned and determined by the source forge. Should remain stable across repository renames and may be used to detect repository resurrection attacks - if a repository is deleted and recreated, the ID should change. For GitHub, use: gh api repos// --jq '.id'", + "example": "b94b5f7e-c7c6-d760-2c78-a5e9b8a5b8c9" + }, + "subfolder": { + "type": "string", + "description": "Optional relative path from repository root to the server location within a monorepo or nested package structure. Must be a clean relative path.", + "example": "src/everything" + } + } + }, + "Server": { + "type": "object", + "required": [ + "name", + "description", + "version" + ], + "properties": { + "name": { + "type": "string", + "description": "Server name in reverse-DNS format. Must contain exactly one forward slash separating namespace from server name.", + "example": "io.github.user/weather", + "pattern": "^[a-zA-Z0-9.-]+/[a-zA-Z0-9._-]+$", + "minLength": 3, + "maxLength": 200 + }, + "description": { + "type": "string", + "description": "Clear human-readable explanation of server functionality. Should focus on capabilities, not implementation details.", + "example": "MCP server providing weather data and forecasts via OpenWeatherMap API", + "minLength": 1, + "maxLength": 100 + }, + "status": { + "type": "string", + "enum": ["active", "deprecated", "deleted"], + "default": "active", + "description": "Server lifecycle status. 'deprecated' indicates the server is no longer recommended for new usage. 'deleted' indicates the server should never be installed and existing installations should be uninstalled - this is rare, and usually indicates malware or a legal takedown." + }, + "repository": { + "$ref": "#/definitions/Repository", + "description": "Optional repository metadata for the MCP server source code. Recommended for transparency and security inspection." + }, + "version": { + "type": "string", + "maxLength": 255, + "example": "1.0.2", + "description": "Version string for this server. SHOULD follow semantic versioning (e.g., '1.0.2', '2.1.0-alpha'). Equivalent of Implementation.version in MCP specification. Non-semantic versions are allowed but may not sort predictably. Version ranges are rejected (e.g., '^1.2.3', '~1.2.3', '>=1.2.3', '1.x', '1.*')." + }, + "website_url": { + "type": "string", + "format": "uri", + "description": "Optional URL to the server's homepage, documentation, or project website. This provides a central link for users to learn more about the server. Particularly useful when the server has custom installation instructions or setup requirements.", + "example": "https://modelcontextprotocol.io/examples" + } + } + }, + "Package": { + "type": "object", + "additionalProperties": false, + "required": [ + "registry_type", + "identifier", + "version", + "transport" + ], + "properties": { + "registry_type": { + "type": "string", + "description": "Registry type indicating how to download packages (e.g., 'npm', 'pypi', 'oci', 'nuget', 'mcpb')", + "examples": ["npm", "pypi", "oci", "nuget", "mcpb"] + }, + "registry_base_url": { + "type": "string", + "format": "uri", + "description": "Base URL of the package registry", + "examples": ["https://registry.npmjs.org", "https://pypi.org", "https://docker.io", "https://api.nuget.org", "https://github.com", "https://gitlab.com"] + }, + "identifier": { + "type": "string", + "description": "Package identifier - either a package name (for registries) or URL (for direct downloads)", + "examples": ["@modelcontextprotocol/server-brave-search", "https://github.com/example/releases/download/v1.0.0/package.mcpb"] + }, + "version": { + "type": "string", + "description": "Package version. Must be a specific version. Version ranges are rejected (e.g., '^1.2.3', '~1.2.3', '>=1.2.3', '1.x', '1.*').", + "not": { + "const": "latest" + }, + "example": "1.0.2", + "minLength": 1 + }, + "file_sha256": { + "type": "string", + "pattern": "^[a-f0-9]{64}$", + "description": "SHA-256 hash of the package file for integrity verification. Required for MCPB packages and optional for other package types. Authors are responsible for generating correct SHA-256 hashes when creating server.json. If present, MCP clients must validate the downloaded file matches the hash before running packages to ensure file integrity.", + "example": "fe333e598595000ae021bd27117db32ec69af6987f507ba7a63c90638ff633ce" + }, + "runtime_hint": { + "type": "string", + "description": "A hint to help clients determine the appropriate runtime for the package. This field should be provided when `runtime_arguments` are present.", + "examples": [ + "npx", + "uvx", + "docker", + "dnx" + ] + }, + "transport": { + "anyOf": [ + { + "$ref": "#/definitions/StdioTransport" + }, + { + "$ref": "#/definitions/StreamableHttpTransport" + }, + { + "$ref": "#/definitions/SseTransport" + } + ], + "description": "Transport protocol configuration for the package" + }, + "runtime_arguments": { + "type": "array", + "description": "A list of arguments to be passed to the package's runtime command (such as docker or npx). The `runtime_hint` field should be provided when `runtime_arguments` are present.", + "items": { + "$ref": "#/definitions/Argument" + } + }, + "package_arguments": { + "type": "array", + "description": "A list of arguments to be passed to the package's binary.", + "items": { + "$ref": "#/definitions/Argument" + } + }, + "environment_variables": { + "type": "array", + "description": "A mapping of environment variables to be set when running the package.", + "items": { + "$ref": "#/definitions/KeyValueInput" + } + } + } + }, + "Input": { + "type": "object", + "properties": { + "description": { + "description": "A description of the input, which clients can use to provide context to the user.", + "type": "string" + }, + "is_required": { + "type": "boolean", + "default": false + }, + "format": { + "type": "string", + "description": "Specifies the input format. Supported values include `filepath`, which should be interpreted as a file on the user's filesystem.\n\nWhen the input is converted to a string, booleans should be represented by the strings \"true\" and \"false\", and numbers should be represented as decimal values.", + "enum": [ + "string", + "number", + "boolean", + "filepath" + ], + "default": "string" + }, + "value": { + "type": "string", + "description": "The default value for the input. If this is not set, the user may be prompted to provide a value. If a value is set, it should not be configurable by end users.\n\nIdentifiers wrapped in `{curly_braces}` will be replaced with the corresponding properties from the input `variables` map. If an identifier in braces is not found in `variables`, or if `variables` is not provided, the `{curly_braces}` substring should remain unchanged.\n" + }, + "is_secret": { + "type": "boolean", + "description": "Indicates whether the input is a secret value (e.g., password, token). If true, clients should handle the value securely.", + "default": false + }, + "default": { + "type": "string", + "description": "The default value for the input." + }, + "choices": { + "type": "array", + "description": "A list of possible values for the input. If provided, the user must select one of these values.", + "items": { + "type": "string" + }, + "example": [] + } + } + }, + "InputWithVariables": { + "allOf": [ + { + "$ref": "#/definitions/Input" + }, + { + "type": "object", + "properties": { + "variables": { + "type": "object", + "description": "A map of variable names to their values. Keys in the input `value` that are wrapped in `{curly_braces}` will be replaced with the corresponding variable values.", + "additionalProperties": { + "$ref": "#/definitions/Input" + } + } + } + } + ] + }, + "PositionalArgument": { + "description": "A positional input is a value inserted verbatim into the command line.", + "allOf": [ + { + "$ref": "#/definitions/InputWithVariables" + }, + { + "type": "object", + "required": [ + "type" + ], + "properties": { + "type": { + "type": "string", + "enum": [ + "positional" + ], + "example": "positional" + }, + "value_hint": { + "type": "string", + "description": "An identifier-like hint for the value. This is not part of the command line, but can be used by client configuration and to provide hints to users.", + "example": "file_path" + }, + "is_repeated": { + "type": "boolean", + "description": "Whether the argument can be repeated multiple times in the command line.", + "default": false + } + }, + "anyOf": [ + { + "required": [ + "value_hint" + ] + }, + { + "required": [ + "value" + ] + } + ] + } + ] + }, + "NamedArgument": { + "description": "A command-line `--flag={value}`.", + "allOf": [ + { + "$ref": "#/definitions/InputWithVariables" + }, + { + "type": "object", + "required": [ + "type", + "name" + ], + "properties": { + "type": { + "type": "string", + "enum": [ + "named" + ], + "example": "named" + }, + "name": { + "type": "string", + "description": "The flag name, including any leading dashes.", + "example": "--port" + }, + "is_repeated": { + "type": "boolean", + "description": "Whether the argument can be repeated multiple times.", + "default": false + } + } + } + ] + }, + "KeyValueInput": { + "allOf": [ + { + "$ref": "#/definitions/InputWithVariables" + }, + { + "type": "object", + "required": [ + "name" + ], + "properties": { + "name": { + "type": "string", + "description": "Name of the header or environment variable.", + "example": "SOME_VARIABLE" + } + } + } + ] + }, + "Argument": { + "description": "Warning: Arguments construct command-line parameters that may contain user-provided input. This creates potential command injection risks if clients execute commands in a shell environment. For example, a malicious argument value like ';rm -rf ~/Development' could execute dangerous commands. Clients should prefer non-shell execution methods (e.g., posix_spawn) when possible to eliminate injection risks entirely. Where not possible, clients should obtain consent from users or agents to run the resolved command before execution.", + "anyOf": [ + { + "$ref": "#/definitions/PositionalArgument" + }, + { + "$ref": "#/definitions/NamedArgument" + } + ] + }, + "StdioTransport": { + "type": "object", + "required": [ + "type" + ], + "properties": { + "type": { + "type": "string", + "enum": [ + "stdio" + ], + "description": "Transport type", + "example": "stdio" + } + } + }, + "StreamableHttpTransport": { + "type": "object", + "required": [ + "type", + "url" + ], + "properties": { + "type": { + "type": "string", + "enum": [ + "streamable-http" + ], + "description": "Transport type", + "example": "streamable-http" + }, + "url": { + "type": "string", + "description": "URL template for the streamable-http transport. Variables in {curly_braces} reference argument value_hints, argument names, or environment variable names. After variable substitution, this should produce a valid URI.", + "example": "https://api.example.com/mcp" + }, + "headers": { + "type": "array", + "description": "HTTP headers to include", + "items": { + "$ref": "#/definitions/KeyValueInput" + } + } + } + }, + "SseTransport": { + "type": "object", + "required": [ + "type", + "url" + ], + "properties": { + "type": { + "type": "string", + "enum": [ + "sse" + ], + "description": "Transport type", + "example": "sse" + }, + "url": { + "type": "string", + "format": "uri", + "description": "Server-Sent Events endpoint URL", + "example": "https://mcp-fs.example.com/sse" + }, + "headers": { + "type": "array", + "description": "HTTP headers to include", + "items": { + "$ref": "#/definitions/KeyValueInput" + } + } + } + }, + "ServerDetail": { + "description": "Schema for a static representation of an MCP server. Used in various contexts related to discovery, installation, and configuration.", + "allOf": [ + { + "$ref": "#/definitions/Server" + }, + { + "type": "object", + "properties": { + "$schema": { + "type": "string", + "format": "uri", + "description": "JSON Schema URI for this server.json format", + "example": "https://static.modelcontextprotocol.io/schemas/2025-07-09/server.schema.json" + }, + "packages": { + "type": "array", + "items": { + "$ref": "#/definitions/Package" + } + }, + "remotes": { + "type": "array", + "items": { + "anyOf": [ + { + "$ref": "#/definitions/StreamableHttpTransport" + }, + { + "$ref": "#/definitions/SseTransport" + } + ] + } + }, + "_meta": { + "type": "object", + "description": "Extension metadata using reverse DNS namespacing for vendor-specific data", + "additionalProperties": true, + "properties": { + "io.modelcontextprotocol.registry/publisher-provided": { + "type": "object", + "description": "Publisher-provided metadata for downstream registries", + "additionalProperties": true + }, + "io.modelcontextprotocol.registry/official": { + "type": "object", + "description": "Official MCP registry metadata (read-only, added by registry)", + "additionalProperties": true + } + } + } + } + } + ] + } + } +} \ No newline at end of file diff --git a/internal/validators/schemas/2025-09-16.json b/internal/validators/schemas/2025-09-16.json new file mode 100644 index 0000000..8766b2a --- /dev/null +++ b/internal/validators/schemas/2025-09-16.json @@ -0,0 +1,478 @@ +{ + "$schema": "http://json-schema.org/draft-07/schema#", + "$id": "https://static.modelcontextprotocol.io/schemas/2025-09-16/server.schema.json", + "title": "MCP Server Detail", + "$ref": "#/definitions/ServerDetail", + "definitions": { + "Repository": { + "type": "object", + "description": "Repository metadata for the MCP server source code. Enables users and security experts to inspect the code, improving transparency.", + "required": [ + "url", + "source" + ], + "properties": { + "url": { + "type": "string", + "format": "uri", + "description": "Repository URL for browsing source code. Should support both web browsing and git clone operations.", + "example": "https://github.com/modelcontextprotocol/servers" + }, + "source": { + "type": "string", + "description": "Repository hosting service identifier. Used by registries to determine validation and API access methods.", + "example": "github" + }, + "id": { + "type": "string", + "description": "Repository identifier from the hosting service (e.g., GitHub repo ID). Owned and determined by the source forge. Should remain stable across repository renames and may be used to detect repository resurrection attacks - if a repository is deleted and recreated, the ID should change. For GitHub, use: gh api repos// --jq '.id'", + "example": "b94b5f7e-c7c6-d760-2c78-a5e9b8a5b8c9" + }, + "subfolder": { + "type": "string", + "description": "Optional relative path from repository root to the server location within a monorepo or nested package structure. Must be a clean relative path.", + "example": "src/everything" + } + } + }, + "Server": { + "type": "object", + "required": [ + "name", + "description", + "version" + ], + "properties": { + "name": { + "type": "string", + "description": "Server name in reverse-DNS format. Must contain exactly one forward slash separating namespace from server name.", + "example": "io.github.user/weather", + "pattern": "^[a-zA-Z0-9.-]+/[a-zA-Z0-9._-]+$", + "minLength": 3, + "maxLength": 200 + }, + "description": { + "type": "string", + "description": "Clear human-readable explanation of server functionality. Should focus on capabilities, not implementation details.", + "example": "MCP server providing weather data and forecasts via OpenWeatherMap API", + "minLength": 1, + "maxLength": 100 + }, + "status": { + "type": "string", + "enum": ["active", "deprecated", "deleted"], + "default": "active", + "description": "Server lifecycle status. 'deprecated' indicates the server is no longer recommended for new usage. 'deleted' indicates the server should never be installed and existing installations should be uninstalled - this is rare, and usually indicates malware or a legal takedown." + }, + "repository": { + "$ref": "#/definitions/Repository", + "description": "Optional repository metadata for the MCP server source code. Recommended for transparency and security inspection." + }, + "version": { + "type": "string", + "maxLength": 255, + "example": "1.0.2", + "description": "Version string for this server. SHOULD follow semantic versioning (e.g., '1.0.2', '2.1.0-alpha'). Equivalent of Implementation.version in MCP specification. Non-semantic versions are allowed but may not sort predictably. Version ranges are rejected (e.g., '^1.2.3', '~1.2.3', '>=1.2.3', '1.x', '1.*')." + }, + "websiteUrl": { + "type": "string", + "format": "uri", + "description": "Optional URL to the server's homepage, documentation, or project website. This provides a central link for users to learn more about the server. Particularly useful when the server has custom installation instructions or setup requirements.", + "example": "https://modelcontextprotocol.io/examples" + } + } + }, + "Package": { + "type": "object", + "additionalProperties": false, + "required": [ + "registryType", + "identifier", + "version", + "transport" + ], + "properties": { + "registryType": { + "type": "string", + "description": "Registry type indicating how to download packages (e.g., 'npm', 'pypi', 'oci', 'nuget', 'mcpb')", + "examples": ["npm", "pypi", "oci", "nuget", "mcpb"] + }, + "registryBaseUrl": { + "type": "string", + "format": "uri", + "description": "Base URL of the package registry", + "examples": ["https://registry.npmjs.org", "https://pypi.org", "https://docker.io", "https://api.nuget.org", "https://github.com", "https://gitlab.com"] + }, + "identifier": { + "type": "string", + "description": "Package identifier - either a package name (for registries) or URL (for direct downloads)", + "examples": ["@modelcontextprotocol/server-brave-search", "https://github.com/example/releases/download/v1.0.0/package.mcpb"] + }, + "version": { + "type": "string", + "description": "Package version. Must be a specific version. Version ranges are rejected (e.g., '^1.2.3', '~1.2.3', '>=1.2.3', '1.x', '1.*').", + "not": { + "const": "latest" + }, + "example": "1.0.2", + "minLength": 1 + }, + "fileSha256": { + "type": "string", + "pattern": "^[a-f0-9]{64}$", + "description": "SHA-256 hash of the package file for integrity verification. Required for MCPB packages and optional for other package types. Authors are responsible for generating correct SHA-256 hashes when creating server.json. If present, MCP clients must validate the downloaded file matches the hash before running packages to ensure file integrity.", + "example": "fe333e598595000ae021bd27117db32ec69af6987f507ba7a63c90638ff633ce" + }, + "runtimeHint": { + "type": "string", + "description": "A hint to help clients determine the appropriate runtime for the package. This field should be provided when `runtimeArguments` are present.", + "examples": [ + "npx", + "uvx", + "docker", + "dnx" + ] + }, + "transport": { + "anyOf": [ + { + "$ref": "#/definitions/StdioTransport" + }, + { + "$ref": "#/definitions/StreamableHttpTransport" + }, + { + "$ref": "#/definitions/SseTransport" + } + ], + "description": "Transport protocol configuration for the package" + }, + "runtimeArguments": { + "type": "array", + "description": "A list of arguments to be passed to the package's runtime command (such as docker or npx). The `runtimeHint` field should be provided when `runtimeArguments` are present.", + "items": { + "$ref": "#/definitions/Argument" + } + }, + "packageArguments": { + "type": "array", + "description": "A list of arguments to be passed to the package's binary.", + "items": { + "$ref": "#/definitions/Argument" + } + }, + "environmentVariables": { + "type": "array", + "description": "A mapping of environment variables to be set when running the package.", + "items": { + "$ref": "#/definitions/KeyValueInput" + } + } + } + }, + "Input": { + "type": "object", + "properties": { + "description": { + "description": "A description of the input, which clients can use to provide context to the user.", + "type": "string" + }, + "isRequired": { + "type": "boolean", + "default": false + }, + "format": { + "type": "string", + "description": "Specifies the input format. Supported values include `filepath`, which should be interpreted as a file on the user's filesystem.\n\nWhen the input is converted to a string, booleans should be represented by the strings \"true\" and \"false\", and numbers should be represented as decimal values.", + "enum": [ + "string", + "number", + "boolean", + "filepath" + ], + "default": "string" + }, + "value": { + "type": "string", + "description": "The default value for the input. If this is not set, the user may be prompted to provide a value. If a value is set, it should not be configurable by end users.\n\nIdentifiers wrapped in `{curly_braces}` will be replaced with the corresponding properties from the input `variables` map. If an identifier in braces is not found in `variables`, or if `variables` is not provided, the `{curly_braces}` substring should remain unchanged.\n" + }, + "isSecret": { + "type": "boolean", + "description": "Indicates whether the input is a secret value (e.g., password, token). If true, clients should handle the value securely.", + "default": false + }, + "default": { + "type": "string", + "description": "The default value for the input." + }, + "choices": { + "type": "array", + "description": "A list of possible values for the input. If provided, the user must select one of these values.", + "items": { + "type": "string" + }, + "example": [] + } + } + }, + "InputWithVariables": { + "allOf": [ + { + "$ref": "#/definitions/Input" + }, + { + "type": "object", + "properties": { + "variables": { + "type": "object", + "description": "A map of variable names to their values. Keys in the input `value` that are wrapped in `{curly_braces}` will be replaced with the corresponding variable values.", + "additionalProperties": { + "$ref": "#/definitions/Input" + } + } + } + } + ] + }, + "PositionalArgument": { + "description": "A positional input is a value inserted verbatim into the command line.", + "allOf": [ + { + "$ref": "#/definitions/InputWithVariables" + }, + { + "type": "object", + "required": [ + "type" + ], + "properties": { + "type": { + "type": "string", + "enum": [ + "positional" + ], + "example": "positional" + }, + "valueHint": { + "type": "string", + "description": "An identifier-like hint for the value. This is not part of the command line, but can be used by client configuration and to provide hints to users.", + "example": "file_path" + }, + "isRepeated": { + "type": "boolean", + "description": "Whether the argument can be repeated multiple times in the command line.", + "default": false + } + }, + "anyOf": [ + { + "required": [ + "valueHint" + ] + }, + { + "required": [ + "value" + ] + } + ] + } + ] + }, + "NamedArgument": { + "description": "A command-line `--flag={value}`.", + "allOf": [ + { + "$ref": "#/definitions/InputWithVariables" + }, + { + "type": "object", + "required": [ + "type", + "name" + ], + "properties": { + "type": { + "type": "string", + "enum": [ + "named" + ], + "example": "named" + }, + "name": { + "type": "string", + "description": "The flag name, including any leading dashes.", + "example": "--port" + }, + "isRepeated": { + "type": "boolean", + "description": "Whether the argument can be repeated multiple times.", + "default": false + } + } + } + ] + }, + "KeyValueInput": { + "allOf": [ + { + "$ref": "#/definitions/InputWithVariables" + }, + { + "type": "object", + "required": [ + "name" + ], + "properties": { + "name": { + "type": "string", + "description": "Name of the header or environment variable.", + "example": "SOME_VARIABLE" + } + } + } + ] + }, + "Argument": { + "description": "Warning: Arguments construct command-line parameters that may contain user-provided input. This creates potential command injection risks if clients execute commands in a shell environment. For example, a malicious argument value like ';rm -rf ~/Development' could execute dangerous commands. Clients should prefer non-shell execution methods (e.g., posix_spawn) when possible to eliminate injection risks entirely. Where not possible, clients should obtain consent from users or agents to run the resolved command before execution.", + "anyOf": [ + { + "$ref": "#/definitions/PositionalArgument" + }, + { + "$ref": "#/definitions/NamedArgument" + } + ] + }, + "StdioTransport": { + "type": "object", + "required": [ + "type" + ], + "properties": { + "type": { + "type": "string", + "enum": [ + "stdio" + ], + "description": "Transport type", + "example": "stdio" + } + } + }, + "StreamableHttpTransport": { + "type": "object", + "required": [ + "type", + "url" + ], + "properties": { + "type": { + "type": "string", + "enum": [ + "streamable-http" + ], + "description": "Transport type", + "example": "streamable-http" + }, + "url": { + "type": "string", + "description": "URL template for the streamable-http transport. Variables in {curly_braces} reference argument valueHints, argument names, or environment variable names. After variable substitution, this should produce a valid URI.", + "example": "https://api.example.com/mcp" + }, + "headers": { + "type": "array", + "description": "HTTP headers to include", + "items": { + "$ref": "#/definitions/KeyValueInput" + } + } + } + }, + "SseTransport": { + "type": "object", + "required": [ + "type", + "url" + ], + "properties": { + "type": { + "type": "string", + "enum": [ + "sse" + ], + "description": "Transport type", + "example": "sse" + }, + "url": { + "type": "string", + "format": "uri", + "description": "Server-Sent Events endpoint URL", + "example": "https://mcp-fs.example.com/sse" + }, + "headers": { + "type": "array", + "description": "HTTP headers to include", + "items": { + "$ref": "#/definitions/KeyValueInput" + } + } + } + }, + "ServerDetail": { + "description": "Schema for a static representation of an MCP server. Used in various contexts related to discovery, installation, and configuration.", + "allOf": [ + { + "$ref": "#/definitions/Server" + }, + { + "type": "object", + "properties": { + "$schema": { + "type": "string", + "format": "uri", + "description": "JSON Schema URI for this server.json format", + "example": "https://static.modelcontextprotocol.io/schemas/2025-09-16/server.schema.json" + }, + "packages": { + "type": "array", + "items": { + "$ref": "#/definitions/Package" + } + }, + "remotes": { + "type": "array", + "items": { + "anyOf": [ + { + "$ref": "#/definitions/StreamableHttpTransport" + }, + { + "$ref": "#/definitions/SseTransport" + } + ] + } + }, + "_meta": { + "type": "object", + "description": "Extension metadata using reverse DNS namespacing for vendor-specific data", + "additionalProperties": true, + "properties": { + "io.modelcontextprotocol.registry/publisher-provided": { + "type": "object", + "description": "Publisher-provided metadata for downstream registries", + "additionalProperties": true + }, + "io.modelcontextprotocol.registry/official": { + "type": "object", + "description": "Official MCP registry metadata (read-only, added by registry)", + "additionalProperties": true + } + } + } + } + } + ] + } + } +} diff --git a/internal/validators/schemas/2025-09-29.json b/internal/validators/schemas/2025-09-29.json new file mode 100644 index 0000000..bcf5ba5 --- /dev/null +++ b/internal/validators/schemas/2025-09-29.json @@ -0,0 +1,483 @@ +{ + "$schema": "http://json-schema.org/draft-07/schema#", + "$id": "https://static.modelcontextprotocol.io/schemas/2025-09-29/server.schema.json", + "title": "MCP Server Detail", + "$ref": "#/definitions/ServerDetail", + "definitions": { + "Repository": { + "type": "object", + "description": "Repository metadata for the MCP server source code. Enables users and security experts to inspect the code, improving transparency.", + "required": [ + "url", + "source" + ], + "properties": { + "url": { + "type": "string", + "format": "uri", + "description": "Repository URL for browsing source code. Should support both web browsing and git clone operations.", + "example": "https://github.com/modelcontextprotocol/servers" + }, + "source": { + "type": "string", + "description": "Repository hosting service identifier. Used by registries to determine validation and API access methods.", + "example": "github" + }, + "id": { + "type": "string", + "description": "Repository identifier from the hosting service (e.g., GitHub repo ID). Owned and determined by the source forge. Should remain stable across repository renames and may be used to detect repository resurrection attacks - if a repository is deleted and recreated, the ID should change. For GitHub, use: gh api repos// --jq '.id'", + "example": "b94b5f7e-c7c6-d760-2c78-a5e9b8a5b8c9" + }, + "subfolder": { + "type": "string", + "description": "Optional relative path from repository root to the server location within a monorepo or nested package structure. Must be a clean relative path.", + "example": "src/everything" + } + } + }, + "Server": { + "type": "object", + "required": [ + "name", + "description", + "version" + ], + "properties": { + "name": { + "type": "string", + "description": "Server name in reverse-DNS format. Must contain exactly one forward slash separating namespace from server name.", + "example": "io.github.user/weather", + "pattern": "^[a-zA-Z0-9.-]+/[a-zA-Z0-9._-]+$", + "minLength": 3, + "maxLength": 200 + }, + "description": { + "type": "string", + "description": "Clear human-readable explanation of server functionality. Should focus on capabilities, not implementation details.", + "example": "MCP server providing weather data and forecasts via OpenWeatherMap API", + "minLength": 1, + "maxLength": 100 + }, + "repository": { + "$ref": "#/definitions/Repository", + "description": "Optional repository metadata for the MCP server source code. Recommended for transparency and security inspection." + }, + "version": { + "type": "string", + "maxLength": 255, + "example": "1.0.2", + "description": "Version string for this server. SHOULD follow semantic versioning (e.g., '1.0.2', '2.1.0-alpha'). Equivalent of Implementation.version in MCP specification. Non-semantic versions are allowed but may not sort predictably. Version ranges are rejected (e.g., '^1.2.3', '~1.2.3', '>=1.2.3', '1.x', '1.*')." + }, + "websiteUrl": { + "type": "string", + "format": "uri", + "description": "Optional URL to the server's homepage, documentation, or project website. This provides a central link for users to learn more about the server. Particularly useful when the server has custom installation instructions or setup requirements.", + "example": "https://modelcontextprotocol.io/examples" + } + } + }, + "Package": { + "type": "object", + "additionalProperties": false, + "required": [ + "registryType", + "identifier", + "version", + "transport" + ], + "properties": { + "registryType": { + "type": "string", + "description": "Registry type indicating how to download packages (e.g., 'npm', 'pypi', 'oci', 'nuget', 'mcpb')", + "examples": [ + "npm", + "pypi", + "oci", + "nuget", + "mcpb" + ] + }, + "registryBaseUrl": { + "type": "string", + "format": "uri", + "description": "Base URL of the package registry", + "examples": [ + "https://registry.npmjs.org", + "https://pypi.org", + "https://docker.io", + "https://api.nuget.org", + "https://github.com", + "https://gitlab.com" + ] + }, + "identifier": { + "type": "string", + "description": "Package identifier - either a package name (for registries) or URL (for direct downloads)", + "examples": [ + "@modelcontextprotocol/server-brave-search", + "https://github.com/example/releases/download/v1.0.0/package.mcpb" + ] + }, + "version": { + "type": "string", + "description": "Package version. Must be a specific version. Version ranges are rejected (e.g., '^1.2.3', '~1.2.3', '>=1.2.3', '1.x', '1.*').", + "not": { + "const": "latest" + }, + "example": "1.0.2", + "minLength": 1 + }, + "fileSha256": { + "type": "string", + "pattern": "^[a-f0-9]{64}$", + "description": "SHA-256 hash of the package file for integrity verification. Required for MCPB packages and optional for other package types. Authors are responsible for generating correct SHA-256 hashes when creating server.json. If present, MCP clients must validate the downloaded file matches the hash before running packages to ensure file integrity.", + "example": "fe333e598595000ae021bd27117db32ec69af6987f507ba7a63c90638ff633ce" + }, + "runtimeHint": { + "type": "string", + "description": "A hint to help clients determine the appropriate runtime for the package. This field should be provided when `runtimeArguments` are present.", + "examples": [ + "npx", + "uvx", + "docker", + "dnx" + ] + }, + "transport": { + "anyOf": [ + { + "$ref": "#/definitions/StdioTransport" + }, + { + "$ref": "#/definitions/StreamableHttpTransport" + }, + { + "$ref": "#/definitions/SseTransport" + } + ], + "description": "Transport protocol configuration for the package" + }, + "runtimeArguments": { + "type": "array", + "description": "A list of arguments to be passed to the package's runtime command (such as docker or npx). The `runtimeHint` field should be provided when `runtimeArguments` are present.", + "items": { + "$ref": "#/definitions/Argument" + } + }, + "packageArguments": { + "type": "array", + "description": "A list of arguments to be passed to the package's binary.", + "items": { + "$ref": "#/definitions/Argument" + } + }, + "environmentVariables": { + "type": "array", + "description": "A mapping of environment variables to be set when running the package.", + "items": { + "$ref": "#/definitions/KeyValueInput" + } + } + } + }, + "Input": { + "type": "object", + "properties": { + "description": { + "description": "A description of the input, which clients can use to provide context to the user.", + "type": "string" + }, + "isRequired": { + "type": "boolean", + "default": false + }, + "format": { + "type": "string", + "description": "Specifies the input format. Supported values include `filepath`, which should be interpreted as a file on the user's filesystem.\n\nWhen the input is converted to a string, booleans should be represented by the strings \"true\" and \"false\", and numbers should be represented as decimal values.", + "enum": [ + "string", + "number", + "boolean", + "filepath" + ], + "default": "string" + }, + "value": { + "type": "string", + "description": "The default value for the input. If this is not set, the user may be prompted to provide a value. If a value is set, it should not be configurable by end users.\n\nIdentifiers wrapped in `{curly_braces}` will be replaced with the corresponding properties from the input `variables` map. If an identifier in braces is not found in `variables`, or if `variables` is not provided, the `{curly_braces}` substring should remain unchanged.\n" + }, + "isSecret": { + "type": "boolean", + "description": "Indicates whether the input is a secret value (e.g., password, token). If true, clients should handle the value securely.", + "default": false + }, + "default": { + "type": "string", + "description": "The default value for the input." + }, + "choices": { + "type": "array", + "description": "A list of possible values for the input. If provided, the user must select one of these values.", + "items": { + "type": "string" + }, + "example": [] + } + } + }, + "InputWithVariables": { + "allOf": [ + { + "$ref": "#/definitions/Input" + }, + { + "type": "object", + "properties": { + "variables": { + "type": "object", + "description": "A map of variable names to their values. Keys in the input `value` that are wrapped in `{curly_braces}` will be replaced with the corresponding variable values.", + "additionalProperties": { + "$ref": "#/definitions/Input" + } + } + } + } + ] + }, + "PositionalArgument": { + "description": "A positional input is a value inserted verbatim into the command line.", + "allOf": [ + { + "$ref": "#/definitions/InputWithVariables" + }, + { + "type": "object", + "required": [ + "type" + ], + "properties": { + "type": { + "type": "string", + "enum": [ + "positional" + ], + "example": "positional" + }, + "valueHint": { + "type": "string", + "description": "An identifier-like hint for the value. This is not part of the command line, but can be used by client configuration and to provide hints to users.", + "example": "file_path" + }, + "isRepeated": { + "type": "boolean", + "description": "Whether the argument can be repeated multiple times in the command line.", + "default": false + } + }, + "anyOf": [ + { + "required": [ + "valueHint" + ] + }, + { + "required": [ + "value" + ] + } + ] + } + ] + }, + "NamedArgument": { + "description": "A command-line `--flag={value}`.", + "allOf": [ + { + "$ref": "#/definitions/InputWithVariables" + }, + { + "type": "object", + "required": [ + "type", + "name" + ], + "properties": { + "type": { + "type": "string", + "enum": [ + "named" + ], + "example": "named" + }, + "name": { + "type": "string", + "description": "The flag name, including any leading dashes.", + "example": "--port" + }, + "isRepeated": { + "type": "boolean", + "description": "Whether the argument can be repeated multiple times.", + "default": false + } + } + } + ] + }, + "KeyValueInput": { + "allOf": [ + { + "$ref": "#/definitions/InputWithVariables" + }, + { + "type": "object", + "required": [ + "name" + ], + "properties": { + "name": { + "type": "string", + "description": "Name of the header or environment variable.", + "example": "SOME_VARIABLE" + } + } + } + ] + }, + "Argument": { + "description": "Warning: Arguments construct command-line parameters that may contain user-provided input. This creates potential command injection risks if clients execute commands in a shell environment. For example, a malicious argument value like ';rm -rf ~/Development' could execute dangerous commands. Clients should prefer non-shell execution methods (e.g., posix_spawn) when possible to eliminate injection risks entirely. Where not possible, clients should obtain consent from users or agents to run the resolved command before execution.", + "anyOf": [ + { + "$ref": "#/definitions/PositionalArgument" + }, + { + "$ref": "#/definitions/NamedArgument" + } + ] + }, + "StdioTransport": { + "type": "object", + "required": [ + "type" + ], + "properties": { + "type": { + "type": "string", + "enum": [ + "stdio" + ], + "description": "Transport type", + "example": "stdio" + } + } + }, + "StreamableHttpTransport": { + "type": "object", + "required": [ + "type", + "url" + ], + "properties": { + "type": { + "type": "string", + "enum": [ + "streamable-http" + ], + "description": "Transport type", + "example": "streamable-http" + }, + "url": { + "type": "string", + "description": "URL template for the streamable-http transport. Variables in {curly_braces} reference argument valueHints, argument names, or environment variable names. After variable substitution, this should produce a valid URI.", + "example": "https://api.example.com/mcp" + }, + "headers": { + "type": "array", + "description": "HTTP headers to include", + "items": { + "$ref": "#/definitions/KeyValueInput" + } + } + } + }, + "SseTransport": { + "type": "object", + "required": [ + "type", + "url" + ], + "properties": { + "type": { + "type": "string", + "enum": [ + "sse" + ], + "description": "Transport type", + "example": "sse" + }, + "url": { + "type": "string", + "format": "uri", + "description": "Server-Sent Events endpoint URL", + "example": "https://mcp-fs.example.com/sse" + }, + "headers": { + "type": "array", + "description": "HTTP headers to include", + "items": { + "$ref": "#/definitions/KeyValueInput" + } + } + } + }, + "ServerDetail": { + "description": "Schema for a static representation of an MCP server. Used in various contexts related to discovery, installation, and configuration.", + "allOf": [ + { + "$ref": "#/definitions/Server" + }, + { + "type": "object", + "properties": { + "$schema": { + "type": "string", + "format": "uri", + "description": "JSON Schema URI for this server.json format", + "example": "https://static.modelcontextprotocol.io/schemas/2025-09-29/server.schema.json" + }, + "packages": { + "type": "array", + "items": { + "$ref": "#/definitions/Package" + } + }, + "remotes": { + "type": "array", + "items": { + "anyOf": [ + { + "$ref": "#/definitions/StreamableHttpTransport" + }, + { + "$ref": "#/definitions/SseTransport" + } + ] + } + }, + "_meta": { + "type": "object", + "description": "Extension metadata using reverse DNS namespacing for vendor-specific data", + "additionalProperties": true, + "properties": { + "io.modelcontextprotocol.registry/publisher-provided": { + "type": "object", + "description": "Publisher-provided metadata for downstream registries", + "additionalProperties": true + } + } + } + } + } + ] + } + } +} \ No newline at end of file diff --git a/internal/validators/schemas/2025-10-11.json b/internal/validators/schemas/2025-10-11.json new file mode 100644 index 0000000..8022347 --- /dev/null +++ b/internal/validators/schemas/2025-10-11.json @@ -0,0 +1,549 @@ +{ + "$comment": "This file is auto-generated from docs/reference/api/openapi.yaml. Do not edit manually. Run 'make generate-schema' to update.", + "$id": "https://static.modelcontextprotocol.io/schemas/2025-10-11/server.schema.json", + "$ref": "#/definitions/ServerDetail", + "$schema": "http://json-schema.org/draft-07/schema#", + "definitions": { + "Argument": { + "anyOf": [ + { + "$ref": "#/definitions/PositionalArgument" + }, + { + "$ref": "#/definitions/NamedArgument" + } + ], + "description": "Warning: Arguments construct command-line parameters that may contain user-provided input. This creates potential command injection risks if clients execute commands in a shell environment. For example, a malicious argument value like ';rm -rf ~/Development' could execute dangerous commands. Clients should prefer non-shell execution methods (e.g., posix_spawn) when possible to eliminate injection risks entirely. Where not possible, clients should obtain consent from users or agents to run the resolved command before execution." + }, + "Icon": { + "description": "An optionally-sized icon that can be displayed in a user interface.", + "properties": { + "mimeType": { + "description": "Optional MIME type override if the source MIME type is missing or generic. Must be one of: image/png, image/jpeg, image/jpg, image/svg+xml, image/webp.", + "enum": [ + "image/png", + "image/jpeg", + "image/jpg", + "image/svg+xml", + "image/webp" + ], + "example": "image/png", + "type": "string" + }, + "sizes": { + "description": "Optional array of strings that specify sizes at which the icon can be used. Each string should be in WxH format (e.g., '48x48', '96x96') or 'any' for scalable formats like SVG. If not provided, the client should assume that the icon can be used at any size.", + "examples": [ + [ + "48x48", + "96x96" + ], + [ + "any" + ] + ], + "items": { + "pattern": "^(\\d+x\\d+|any)$", + "type": "string" + }, + "type": "array" + }, + "src": { + "description": "A standard URI pointing to an icon resource. Must be an HTTPS URL. Consumers SHOULD take steps to ensure URLs serving icons are from the same domain as the server or a trusted domain. Consumers SHOULD take appropriate precautions when consuming SVGs as they can contain executable JavaScript.", + "example": "https://example.com/icon.png", + "format": "uri", + "maxLength": 255, + "type": "string" + }, + "theme": { + "description": "Optional specifier for the theme this icon is designed for. 'light' indicates the icon is designed to be used with a light background, and 'dark' indicates the icon is designed to be used with a dark background. If not provided, the client should assume the icon can be used with any theme.", + "enum": [ + "light", + "dark" + ], + "type": "string" + } + }, + "required": [ + "src" + ], + "type": "object" + }, + "Input": { + "properties": { + "choices": { + "description": "A list of possible values for the input. If provided, the user must select one of these values.", + "example": [], + "items": { + "type": "string" + }, + "type": "array" + }, + "default": { + "description": "The default value for the input. This should be a valid value for the input. If you want to provide input examples or guidance, use the `placeholder` field instead.", + "type": "string" + }, + "description": { + "description": "A description of the input, which clients can use to provide context to the user.", + "type": "string" + }, + "format": { + "default": "string", + "description": "Specifies the input format. Supported values include `filepath`, which should be interpreted as a file on the user's filesystem.\n\nWhen the input is converted to a string, booleans should be represented by the strings \"true\" and \"false\", and numbers should be represented as decimal values.", + "enum": [ + "string", + "number", + "boolean", + "filepath" + ], + "type": "string" + }, + "isRequired": { + "default": false, + "type": "boolean" + }, + "isSecret": { + "default": false, + "description": "Indicates whether the input is a secret value (e.g., password, token). If true, clients should handle the value securely.", + "type": "boolean" + }, + "placeholder": { + "description": "A placeholder for the input to be displaying during configuration. This is used to provide examples or guidance about the expected form or content of the input.", + "type": "string" + }, + "value": { + "description": "The value for the input. If this is not set, the user may be prompted to provide a value. If a value is set, it should not be configurable by end users.\n\nIdentifiers wrapped in `{curly_braces}` will be replaced with the corresponding properties from the input `variables` map. If an identifier in braces is not found in `variables`, or if `variables` is not provided, the `{curly_braces}` substring should remain unchanged.\n", + "type": "string" + } + }, + "type": "object" + }, + "InputWithVariables": { + "allOf": [ + { + "$ref": "#/definitions/Input" + }, + { + "properties": { + "variables": { + "additionalProperties": { + "$ref": "#/definitions/Input" + }, + "description": "A map of variable names to their values. Keys in the input `value` that are wrapped in `{curly_braces}` will be replaced with the corresponding variable values.", + "type": "object" + } + }, + "type": "object" + } + ] + }, + "KeyValueInput": { + "allOf": [ + { + "$ref": "#/definitions/InputWithVariables" + }, + { + "properties": { + "name": { + "description": "Name of the header or environment variable.", + "example": "SOME_VARIABLE", + "type": "string" + } + }, + "required": [ + "name" + ], + "type": "object" + } + ] + }, + "NamedArgument": { + "allOf": [ + { + "$ref": "#/definitions/InputWithVariables" + }, + { + "properties": { + "isRepeated": { + "default": false, + "description": "Whether the argument can be repeated multiple times.", + "type": "boolean" + }, + "name": { + "description": "The flag name, including any leading dashes.", + "example": "--port", + "type": "string" + }, + "type": { + "enum": [ + "named" + ], + "example": "named", + "type": "string" + } + }, + "required": [ + "type", + "name" + ], + "type": "object" + } + ], + "description": "A command-line `--flag={value}`." + }, + "Package": { + "properties": { + "environmentVariables": { + "description": "A mapping of environment variables to be set when running the package.", + "items": { + "$ref": "#/definitions/KeyValueInput" + }, + "type": "array" + }, + "fileSha256": { + "description": "SHA-256 hash of the package file for integrity verification. Required for MCPB packages and optional for other package types. Authors are responsible for generating correct SHA-256 hashes when creating server.json. If present, MCP clients must validate the downloaded file matches the hash before running packages to ensure file integrity.", + "example": "fe333e598595000ae021bd27117db32ec69af6987f507ba7a63c90638ff633ce", + "pattern": "^[a-f0-9]{64}$", + "type": "string" + }, + "identifier": { + "description": "Package identifier - either a package name (for registries) or URL (for direct downloads)", + "examples": [ + "@modelcontextprotocol/server-brave-search", + "https://github.com/example/releases/download/v1.0.0/package.mcpb" + ], + "type": "string" + }, + "packageArguments": { + "description": "A list of arguments to be passed to the package's binary.", + "items": { + "$ref": "#/definitions/Argument" + }, + "type": "array" + }, + "registryBaseUrl": { + "description": "Base URL of the package registry", + "examples": [ + "https://registry.npmjs.org", + "https://pypi.org", + "https://docker.io", + "https://api.nuget.org", + "https://github.com", + "https://gitlab.com" + ], + "format": "uri", + "type": "string" + }, + "registryType": { + "description": "Registry type indicating how to download packages (e.g., 'npm', 'pypi', 'oci', 'nuget', 'mcpb')", + "examples": [ + "npm", + "pypi", + "oci", + "nuget", + "mcpb" + ], + "type": "string" + }, + "runtimeArguments": { + "description": "A list of arguments to be passed to the package's runtime command (such as docker or npx). The `runtimeHint` field should be provided when `runtimeArguments` are present.", + "items": { + "$ref": "#/definitions/Argument" + }, + "type": "array" + }, + "runtimeHint": { + "description": "A hint to help clients determine the appropriate runtime for the package. This field should be provided when `runtimeArguments` are present.", + "examples": [ + "npx", + "uvx", + "docker", + "dnx" + ], + "type": "string" + }, + "transport": { + "anyOf": [ + { + "$ref": "#/definitions/StdioTransport" + }, + { + "$ref": "#/definitions/StreamableHttpTransport" + }, + { + "$ref": "#/definitions/SseTransport" + } + ], + "description": "Transport protocol configuration for the package" + }, + "version": { + "description": "Package version. Must be a specific version. Version ranges are rejected (e.g., '^1.2.3', '~1.2.3', '\u003e=1.2.3', '1.x', '1.*').", + "example": "1.0.2", + "minLength": 1, + "not": { + "const": "latest" + }, + "type": "string" + } + }, + "required": [ + "registryType", + "identifier", + "transport" + ], + "type": "object" + }, + "PositionalArgument": { + "allOf": [ + { + "$ref": "#/definitions/InputWithVariables" + }, + { + "anyOf": [ + { + "required": [ + "valueHint" + ] + }, + { + "required": [ + "value" + ] + } + ], + "properties": { + "isRepeated": { + "default": false, + "description": "Whether the argument can be repeated multiple times in the command line.", + "type": "boolean" + }, + "type": { + "enum": [ + "positional" + ], + "example": "positional", + "type": "string" + }, + "valueHint": { + "description": "An identifier for the positional argument. It is not part of the command line. It may be used by client configuration as a label identifying the argument. It is also used to identify the value in transport URL variable substitution.", + "example": "file_path", + "type": "string" + } + }, + "required": [ + "type" + ], + "type": "object" + } + ], + "description": "A positional input is a value inserted verbatim into the command line." + }, + "Repository": { + "description": "Repository metadata for the MCP server source code. Enables users and security experts to inspect the code, improving transparency.", + "properties": { + "id": { + "description": "Repository identifier from the hosting service (e.g., GitHub repo ID). Owned and determined by the source forge. Should remain stable across repository renames and may be used to detect repository resurrection attacks - if a repository is deleted and recreated, the ID should change. For GitHub, use: gh api repos/\u003cowner\u003e/\u003crepo\u003e --jq '.id'", + "example": "b94b5f7e-c7c6-d760-2c78-a5e9b8a5b8c9", + "type": "string" + }, + "source": { + "description": "Repository hosting service identifier. Used by registries to determine validation and API access methods.", + "example": "github", + "type": "string" + }, + "subfolder": { + "description": "Optional relative path from repository root to the server location within a monorepo or nested package structure. Must be a clean relative path.", + "example": "src/everything", + "type": "string" + }, + "url": { + "description": "Repository URL for browsing source code. Should support both web browsing and git clone operations.", + "example": "https://github.com/modelcontextprotocol/servers", + "format": "uri", + "type": "string" + } + }, + "required": [ + "url", + "source" + ], + "type": "object" + }, + "ServerDetail": { + "description": "Schema for a static representation of an MCP server. Used in various contexts related to discovery, installation, and configuration.", + "properties": { + "$schema": { + "description": "JSON Schema URI for this server.json format", + "example": "https://static.modelcontextprotocol.io/schemas/2025-10-11/server.schema.json", + "format": "uri", + "type": "string" + }, + "_meta": { + "description": "Extension metadata using reverse DNS namespacing for vendor-specific data", + "properties": { + "io.modelcontextprotocol.registry/publisher-provided": { + "additionalProperties": true, + "description": "Publisher-provided metadata for downstream registries", + "example": { + "buildInfo": { + "commit": "abc123def456", + "pipelineId": "build-789", + "timestamp": "2023-12-01T10:30:00Z" + }, + "tool": "publisher-cli", + "version": "1.2.3" + }, + "type": "object" + } + }, + "type": "object" + }, + "description": { + "description": "Clear human-readable explanation of server functionality. Should focus on capabilities, not implementation details.", + "example": "MCP server providing weather data and forecasts via OpenWeatherMap API", + "maxLength": 100, + "minLength": 1, + "type": "string" + }, + "icons": { + "description": "Optional set of sized icons that the client can display in a user interface. Clients that support rendering icons MUST support at least the following MIME types: image/png and image/jpeg (safe, universal compatibility). Clients SHOULD also support: image/svg+xml (scalable but requires security precautions) and image/webp (modern, efficient format).", + "items": { + "$ref": "#/definitions/Icon" + }, + "type": "array" + }, + "name": { + "description": "Server name in reverse-DNS format. Must contain exactly one forward slash separating namespace from server name.", + "example": "io.github.user/weather", + "maxLength": 200, + "minLength": 3, + "pattern": "^[a-zA-Z0-9.-]+/[a-zA-Z0-9._-]+$", + "type": "string" + }, + "packages": { + "items": { + "$ref": "#/definitions/Package" + }, + "type": "array" + }, + "remotes": { + "items": { + "anyOf": [ + { + "$ref": "#/definitions/StreamableHttpTransport" + }, + { + "$ref": "#/definitions/SseTransport" + } + ] + }, + "type": "array" + }, + "repository": { + "$ref": "#/definitions/Repository", + "description": "Optional repository metadata for the MCP server source code. Recommended for transparency and security inspection." + }, + "title": { + "description": "Optional human-readable title or display name for the MCP server. MCP subregistries or clients MAY choose to use this for display purposes.", + "example": "Weather API", + "maxLength": 100, + "minLength": 1, + "type": "string" + }, + "version": { + "description": "Version string for this server. SHOULD follow semantic versioning (e.g., '1.0.2', '2.1.0-alpha'). Equivalent of Implementation.version in MCP specification. Non-semantic versions are allowed but may not sort predictably. Version ranges are rejected (e.g., '^1.2.3', '~1.2.3', '\u003e=1.2.3', '1.x', '1.*').", + "example": "1.0.2", + "maxLength": 255, + "type": "string" + }, + "websiteUrl": { + "description": "Optional URL to the server's homepage, documentation, or project website. This provides a central link for users to learn more about the server. Particularly useful when the server has custom installation instructions or setup requirements.", + "example": "https://modelcontextprotocol.io/examples", + "format": "uri", + "type": "string" + } + }, + "required": [ + "name", + "description", + "version" + ], + "type": "object" + }, + "SseTransport": { + "properties": { + "headers": { + "description": "HTTP headers to include", + "items": { + "$ref": "#/definitions/KeyValueInput" + }, + "type": "array" + }, + "type": { + "description": "Transport type", + "enum": [ + "sse" + ], + "example": "sse", + "type": "string" + }, + "url": { + "description": "Server-Sent Events endpoint URL", + "example": "https://mcp-fs.example.com/sse", + "format": "uri", + "type": "string" + } + }, + "required": [ + "type", + "url" + ], + "type": "object" + }, + "StdioTransport": { + "properties": { + "type": { + "description": "Transport type", + "enum": [ + "stdio" + ], + "example": "stdio", + "type": "string" + } + }, + "required": [ + "type" + ], + "type": "object" + }, + "StreamableHttpTransport": { + "properties": { + "headers": { + "description": "HTTP headers to include", + "items": { + "$ref": "#/definitions/KeyValueInput" + }, + "type": "array" + }, + "type": { + "description": "Transport type", + "enum": [ + "streamable-http" + ], + "example": "streamable-http", + "type": "string" + }, + "url": { + "description": "URL template for the streamable-http transport. Variables in {curly_braces} reference argument valueHints, argument names, or environment variable names. After variable substitution, this should produce a valid URI.", + "example": "https://api.example.com/mcp", + "type": "string" + } + }, + "required": [ + "type", + "url" + ], + "type": "object" + } + }, + "title": "server.json defining a Model Context Protocol (MCP) server" +} diff --git a/internal/validators/schemas/2025-10-17.json b/internal/validators/schemas/2025-10-17.json new file mode 100644 index 0000000..59967b5 --- /dev/null +++ b/internal/validators/schemas/2025-10-17.json @@ -0,0 +1,549 @@ +{ + "$comment": "This file is auto-generated from docs/reference/api/openapi.yaml. Do not edit manually. Run 'make generate-schema' to update.", + "$id": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", + "$ref": "#/definitions/ServerDetail", + "$schema": "http://json-schema.org/draft-07/schema#", + "definitions": { + "Argument": { + "anyOf": [ + { + "$ref": "#/definitions/PositionalArgument" + }, + { + "$ref": "#/definitions/NamedArgument" + } + ], + "description": "Warning: Arguments construct command-line parameters that may contain user-provided input. This creates potential command injection risks if clients execute commands in a shell environment. For example, a malicious argument value like ';rm -rf ~/Development' could execute dangerous commands. Clients should prefer non-shell execution methods (e.g., posix_spawn) when possible to eliminate injection risks entirely. Where not possible, clients should obtain consent from users or agents to run the resolved command before execution." + }, + "Icon": { + "description": "An optionally-sized icon that can be displayed in a user interface.", + "properties": { + "mimeType": { + "description": "Optional MIME type override if the source MIME type is missing or generic. Must be one of: image/png, image/jpeg, image/jpg, image/svg+xml, image/webp.", + "enum": [ + "image/png", + "image/jpeg", + "image/jpg", + "image/svg+xml", + "image/webp" + ], + "example": "image/png", + "type": "string" + }, + "sizes": { + "description": "Optional array of strings that specify sizes at which the icon can be used. Each string should be in WxH format (e.g., '48x48', '96x96') or 'any' for scalable formats like SVG. If not provided, the client should assume that the icon can be used at any size.", + "examples": [ + [ + "48x48", + "96x96" + ], + [ + "any" + ] + ], + "items": { + "pattern": "^(\\d+x\\d+|any)$", + "type": "string" + }, + "type": "array" + }, + "src": { + "description": "A standard URI pointing to an icon resource. Must be an HTTPS URL. Consumers SHOULD take steps to ensure URLs serving icons are from the same domain as the server or a trusted domain. Consumers SHOULD take appropriate precautions when consuming SVGs as they can contain executable JavaScript.", + "example": "https://example.com/icon.png", + "format": "uri", + "maxLength": 255, + "type": "string" + }, + "theme": { + "description": "Optional specifier for the theme this icon is designed for. 'light' indicates the icon is designed to be used with a light background, and 'dark' indicates the icon is designed to be used with a dark background. If not provided, the client should assume the icon can be used with any theme.", + "enum": [ + "light", + "dark" + ], + "type": "string" + } + }, + "required": [ + "src" + ], + "type": "object" + }, + "Input": { + "properties": { + "choices": { + "description": "A list of possible values for the input. If provided, the user must select one of these values.", + "example": [], + "items": { + "type": "string" + }, + "type": "array" + }, + "default": { + "description": "The default value for the input. This should be a valid value for the input. If you want to provide input examples or guidance, use the `placeholder` field instead.", + "type": "string" + }, + "description": { + "description": "A description of the input, which clients can use to provide context to the user.", + "type": "string" + }, + "format": { + "default": "string", + "description": "Specifies the input format. Supported values include `filepath`, which should be interpreted as a file on the user's filesystem.\n\nWhen the input is converted to a string, booleans should be represented by the strings \"true\" and \"false\", and numbers should be represented as decimal values.", + "enum": [ + "string", + "number", + "boolean", + "filepath" + ], + "type": "string" + }, + "isRequired": { + "default": false, + "type": "boolean" + }, + "isSecret": { + "default": false, + "description": "Indicates whether the input is a secret value (e.g., password, token). If true, clients should handle the value securely.", + "type": "boolean" + }, + "placeholder": { + "description": "A placeholder for the input to be displaying during configuration. This is used to provide examples or guidance about the expected form or content of the input.", + "type": "string" + }, + "value": { + "description": "The value for the input. If this is not set, the user may be prompted to provide a value. If a value is set, it should not be configurable by end users.\n\nIdentifiers wrapped in `{curly_braces}` will be replaced with the corresponding properties from the input `variables` map. If an identifier in braces is not found in `variables`, or if `variables` is not provided, the `{curly_braces}` substring should remain unchanged.\n", + "type": "string" + } + }, + "type": "object" + }, + "InputWithVariables": { + "allOf": [ + { + "$ref": "#/definitions/Input" + }, + { + "properties": { + "variables": { + "additionalProperties": { + "$ref": "#/definitions/Input" + }, + "description": "A map of variable names to their values. Keys in the input `value` that are wrapped in `{curly_braces}` will be replaced with the corresponding variable values.", + "type": "object" + } + }, + "type": "object" + } + ] + }, + "KeyValueInput": { + "allOf": [ + { + "$ref": "#/definitions/InputWithVariables" + }, + { + "properties": { + "name": { + "description": "Name of the header or environment variable.", + "example": "SOME_VARIABLE", + "type": "string" + } + }, + "required": [ + "name" + ], + "type": "object" + } + ] + }, + "NamedArgument": { + "allOf": [ + { + "$ref": "#/definitions/InputWithVariables" + }, + { + "properties": { + "isRepeated": { + "default": false, + "description": "Whether the argument can be repeated multiple times.", + "type": "boolean" + }, + "name": { + "description": "The flag name, including any leading dashes.", + "example": "--port", + "type": "string" + }, + "type": { + "enum": [ + "named" + ], + "example": "named", + "type": "string" + } + }, + "required": [ + "type", + "name" + ], + "type": "object" + } + ], + "description": "A command-line `--flag={value}`." + }, + "Package": { + "properties": { + "environmentVariables": { + "description": "A mapping of environment variables to be set when running the package.", + "items": { + "$ref": "#/definitions/KeyValueInput" + }, + "type": "array" + }, + "fileSha256": { + "description": "SHA-256 hash of the package file for integrity verification. Required for MCPB packages and optional for other package types. Authors are responsible for generating correct SHA-256 hashes when creating server.json. If present, MCP clients must validate the downloaded file matches the hash before running packages to ensure file integrity.", + "example": "fe333e598595000ae021bd27117db32ec69af6987f507ba7a63c90638ff633ce", + "pattern": "^[a-f0-9]{64}$", + "type": "string" + }, + "identifier": { + "description": "Package identifier - either a package name (for registries) or URL (for direct downloads)", + "examples": [ + "@modelcontextprotocol/server-brave-search", + "https://github.com/example/releases/download/v1.0.0/package.mcpb" + ], + "type": "string" + }, + "packageArguments": { + "description": "A list of arguments to be passed to the package's binary.", + "items": { + "$ref": "#/definitions/Argument" + }, + "type": "array" + }, + "registryBaseUrl": { + "description": "Base URL of the package registry", + "examples": [ + "https://registry.npmjs.org", + "https://pypi.org", + "https://docker.io", + "https://api.nuget.org", + "https://github.com", + "https://gitlab.com" + ], + "format": "uri", + "type": "string" + }, + "registryType": { + "description": "Registry type indicating how to download packages (e.g., 'npm', 'pypi', 'oci', 'nuget', 'mcpb')", + "examples": [ + "npm", + "pypi", + "oci", + "nuget", + "mcpb" + ], + "type": "string" + }, + "runtimeArguments": { + "description": "A list of arguments to be passed to the package's runtime command (such as docker or npx). The `runtimeHint` field should be provided when `runtimeArguments` are present.", + "items": { + "$ref": "#/definitions/Argument" + }, + "type": "array" + }, + "runtimeHint": { + "description": "A hint to help clients determine the appropriate runtime for the package. This field should be provided when `runtimeArguments` are present.", + "examples": [ + "npx", + "uvx", + "docker", + "dnx" + ], + "type": "string" + }, + "transport": { + "anyOf": [ + { + "$ref": "#/definitions/StdioTransport" + }, + { + "$ref": "#/definitions/StreamableHttpTransport" + }, + { + "$ref": "#/definitions/SseTransport" + } + ], + "description": "Transport protocol configuration for the package" + }, + "version": { + "description": "Package version. Must be a specific version. Version ranges are rejected (e.g., '^1.2.3', '~1.2.3', '\u003e=1.2.3', '1.x', '1.*').", + "example": "1.0.2", + "minLength": 1, + "not": { + "const": "latest" + }, + "type": "string" + } + }, + "required": [ + "registryType", + "identifier", + "transport" + ], + "type": "object" + }, + "PositionalArgument": { + "allOf": [ + { + "$ref": "#/definitions/InputWithVariables" + }, + { + "anyOf": [ + { + "required": [ + "valueHint" + ] + }, + { + "required": [ + "value" + ] + } + ], + "properties": { + "isRepeated": { + "default": false, + "description": "Whether the argument can be repeated multiple times in the command line.", + "type": "boolean" + }, + "type": { + "enum": [ + "positional" + ], + "example": "positional", + "type": "string" + }, + "valueHint": { + "description": "An identifier for the positional argument. It is not part of the command line. It may be used by client configuration as a label identifying the argument. It is also used to identify the value in transport URL variable substitution.", + "example": "file_path", + "type": "string" + } + }, + "required": [ + "type" + ], + "type": "object" + } + ], + "description": "A positional input is a value inserted verbatim into the command line." + }, + "Repository": { + "description": "Repository metadata for the MCP server source code. Enables users and security experts to inspect the code, improving transparency.", + "properties": { + "id": { + "description": "Repository identifier from the hosting service (e.g., GitHub repo ID). Owned and determined by the source forge. Should remain stable across repository renames and may be used to detect repository resurrection attacks - if a repository is deleted and recreated, the ID should change. For GitHub, use: gh api repos/\u003cowner\u003e/\u003crepo\u003e --jq '.id'", + "example": "b94b5f7e-c7c6-d760-2c78-a5e9b8a5b8c9", + "type": "string" + }, + "source": { + "description": "Repository hosting service identifier. Used by registries to determine validation and API access methods.", + "example": "github", + "type": "string" + }, + "subfolder": { + "description": "Optional relative path from repository root to the server location within a monorepo or nested package structure. Must be a clean relative path.", + "example": "src/everything", + "type": "string" + }, + "url": { + "description": "Repository URL for browsing source code. Should support both web browsing and git clone operations.", + "example": "https://github.com/modelcontextprotocol/servers", + "format": "uri", + "type": "string" + } + }, + "required": [ + "url", + "source" + ], + "type": "object" + }, + "ServerDetail": { + "description": "Schema for a static representation of an MCP server. Used in various contexts related to discovery, installation, and configuration.", + "properties": { + "$schema": { + "description": "JSON Schema URI for this server.json format", + "example": "https://static.modelcontextprotocol.io/schemas/2025-10-17/server.schema.json", + "format": "uri", + "type": "string" + }, + "_meta": { + "description": "Extension metadata using reverse DNS namespacing for vendor-specific data", + "properties": { + "io.modelcontextprotocol.registry/publisher-provided": { + "additionalProperties": true, + "description": "Publisher-provided metadata for downstream registries", + "example": { + "buildInfo": { + "commit": "abc123def456", + "pipelineId": "build-789", + "timestamp": "2023-12-01T10:30:00Z" + }, + "tool": "publisher-cli", + "version": "1.2.3" + }, + "type": "object" + } + }, + "type": "object" + }, + "description": { + "description": "Clear human-readable explanation of server functionality. Should focus on capabilities, not implementation details.", + "example": "MCP server providing weather data and forecasts via OpenWeatherMap API", + "maxLength": 100, + "minLength": 1, + "type": "string" + }, + "icons": { + "description": "Optional set of sized icons that the client can display in a user interface. Clients that support rendering icons MUST support at least the following MIME types: image/png and image/jpeg (safe, universal compatibility). Clients SHOULD also support: image/svg+xml (scalable but requires security precautions) and image/webp (modern, efficient format).", + "items": { + "$ref": "#/definitions/Icon" + }, + "type": "array" + }, + "name": { + "description": "Server name in reverse-DNS format. Must contain exactly one forward slash separating namespace from server name.", + "example": "io.github.user/weather", + "maxLength": 200, + "minLength": 3, + "pattern": "^[a-zA-Z0-9.-]+/[a-zA-Z0-9._-]+$", + "type": "string" + }, + "packages": { + "items": { + "$ref": "#/definitions/Package" + }, + "type": "array" + }, + "remotes": { + "items": { + "anyOf": [ + { + "$ref": "#/definitions/StreamableHttpTransport" + }, + { + "$ref": "#/definitions/SseTransport" + } + ] + }, + "type": "array" + }, + "repository": { + "$ref": "#/definitions/Repository", + "description": "Optional repository metadata for the MCP server source code. Recommended for transparency and security inspection." + }, + "title": { + "description": "Optional human-readable title or display name for the MCP server. MCP subregistries or clients MAY choose to use this for display purposes.", + "example": "Weather API", + "maxLength": 100, + "minLength": 1, + "type": "string" + }, + "version": { + "description": "Version string for this server. SHOULD follow semantic versioning (e.g., '1.0.2', '2.1.0-alpha'). Equivalent of Implementation.version in MCP specification. Non-semantic versions are allowed but may not sort predictably. Version ranges are rejected (e.g., '^1.2.3', '~1.2.3', '\u003e=1.2.3', '1.x', '1.*').", + "example": "1.0.2", + "maxLength": 255, + "type": "string" + }, + "websiteUrl": { + "description": "Optional URL to the server's homepage, documentation, or project website. This provides a central link for users to learn more about the server. Particularly useful when the server has custom installation instructions or setup requirements.", + "example": "https://modelcontextprotocol.io/examples", + "format": "uri", + "type": "string" + } + }, + "required": [ + "name", + "description", + "version" + ], + "type": "object" + }, + "SseTransport": { + "properties": { + "headers": { + "description": "HTTP headers to include", + "items": { + "$ref": "#/definitions/KeyValueInput" + }, + "type": "array" + }, + "type": { + "description": "Transport type", + "enum": [ + "sse" + ], + "example": "sse", + "type": "string" + }, + "url": { + "description": "Server-Sent Events endpoint URL", + "example": "https://mcp-fs.example.com/sse", + "format": "uri", + "type": "string" + } + }, + "required": [ + "type", + "url" + ], + "type": "object" + }, + "StdioTransport": { + "properties": { + "type": { + "description": "Transport type", + "enum": [ + "stdio" + ], + "example": "stdio", + "type": "string" + } + }, + "required": [ + "type" + ], + "type": "object" + }, + "StreamableHttpTransport": { + "properties": { + "headers": { + "description": "HTTP headers to include", + "items": { + "$ref": "#/definitions/KeyValueInput" + }, + "type": "array" + }, + "type": { + "description": "Transport type", + "enum": [ + "streamable-http" + ], + "example": "streamable-http", + "type": "string" + }, + "url": { + "description": "URL template for the streamable-http transport. Variables in {curly_braces} reference argument valueHints, argument names, or environment variable names. After variable substitution, this should produce a valid URI.", + "example": "https://api.example.com/mcp", + "type": "string" + } + }, + "required": [ + "type", + "url" + ], + "type": "object" + } + }, + "title": "server.json defining a Model Context Protocol (MCP) server" +} diff --git a/internal/validators/schemas/2025-12-11.json b/internal/validators/schemas/2025-12-11.json new file mode 100644 index 0000000..9f6469b --- /dev/null +++ b/internal/validators/schemas/2025-12-11.json @@ -0,0 +1,574 @@ +{ + "$comment": "This file is auto-generated from docs/reference/api/openapi.yaml. Do not edit manually. Run 'make generate-schema' to update.", + "$id": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json", + "$ref": "#/definitions/ServerDetail", + "$schema": "http://json-schema.org/draft-07/schema#", + "definitions": { + "Argument": { + "anyOf": [ + { + "$ref": "#/definitions/PositionalArgument" + }, + { + "$ref": "#/definitions/NamedArgument" + } + ], + "description": "Warning: Arguments construct command-line parameters that may contain user-provided input. This creates potential command injection risks if clients execute commands in a shell environment. For example, a malicious argument value like ';rm -rf ~/Development' could execute dangerous commands. Clients should prefer non-shell execution methods (e.g., posix_spawn) when possible to eliminate injection risks entirely. Where not possible, clients should obtain consent from users or agents to run the resolved command before execution." + }, + "Icon": { + "description": "An optionally-sized icon that can be displayed in a user interface.", + "properties": { + "mimeType": { + "description": "Optional MIME type override if the source MIME type is missing or generic. Must be one of: image/png, image/jpeg, image/jpg, image/svg+xml, image/webp.", + "enum": [ + "image/png", + "image/jpeg", + "image/jpg", + "image/svg+xml", + "image/webp" + ], + "example": "image/png", + "type": "string" + }, + "sizes": { + "description": "Optional array of strings that specify sizes at which the icon can be used. Each string should be in WxH format (e.g., '48x48', '96x96') or 'any' for scalable formats like SVG. If not provided, the client should assume that the icon can be used at any size.", + "examples": [ + [ + "48x48", + "96x96" + ], + [ + "any" + ] + ], + "items": { + "pattern": "^(\\d+x\\d+|any)$", + "type": "string" + }, + "type": "array" + }, + "src": { + "description": "A standard URI pointing to an icon resource. Must be an HTTPS URL. Consumers SHOULD take steps to ensure URLs serving icons are from the same domain as the server or a trusted domain. Consumers SHOULD take appropriate precautions when consuming SVGs as they can contain executable JavaScript.", + "example": "https://example.com/icon.png", + "format": "uri", + "maxLength": 255, + "type": "string" + }, + "theme": { + "description": "Optional specifier for the theme this icon is designed for. 'light' indicates the icon is designed to be used with a light background, and 'dark' indicates the icon is designed to be used with a dark background. If not provided, the client should assume the icon can be used with any theme.", + "enum": [ + "light", + "dark" + ], + "type": "string" + } + }, + "required": [ + "src" + ], + "type": "object" + }, + "Input": { + "properties": { + "choices": { + "description": "A list of possible values for the input. If provided, the user must select one of these values.", + "example": [], + "items": { + "type": "string" + }, + "type": "array" + }, + "default": { + "description": "The default value for the input. This should be a valid value for the input. If you want to provide input examples or guidance, use the `placeholder` field instead.", + "type": "string" + }, + "description": { + "description": "A description of the input, which clients can use to provide context to the user.", + "type": "string" + }, + "format": { + "default": "string", + "description": "Specifies the input format. Supported values include `filepath`, which should be interpreted as a file on the user's filesystem.\n\nWhen the input is converted to a string, booleans should be represented by the strings \"true\" and \"false\", and numbers should be represented as decimal values.", + "enum": [ + "string", + "number", + "boolean", + "filepath" + ], + "type": "string" + }, + "isRequired": { + "default": false, + "type": "boolean" + }, + "isSecret": { + "default": false, + "description": "Indicates whether the input is a secret value (e.g., password, token). If true, clients should handle the value securely.", + "type": "boolean" + }, + "placeholder": { + "description": "A placeholder for the input to be displaying during configuration. This is used to provide examples or guidance about the expected form or content of the input.", + "type": "string" + }, + "value": { + "description": "The value for the input. If this is not set, the user may be prompted to provide a value. If a value is set, it should not be configurable by end users.\n\nIdentifiers wrapped in `{curly_braces}` will be replaced with the corresponding properties from the input `variables` map. If an identifier in braces is not found in `variables`, or if `variables` is not provided, the `{curly_braces}` substring should remain unchanged.\n", + "type": "string" + } + }, + "type": "object" + }, + "InputWithVariables": { + "allOf": [ + { + "$ref": "#/definitions/Input" + }, + { + "properties": { + "variables": { + "additionalProperties": { + "$ref": "#/definitions/Input" + }, + "description": "A map of variable names to their values. Keys in the input `value` that are wrapped in `{curly_braces}` will be replaced with the corresponding variable values.", + "type": "object" + } + }, + "type": "object" + } + ] + }, + "KeyValueInput": { + "allOf": [ + { + "$ref": "#/definitions/InputWithVariables" + }, + { + "properties": { + "name": { + "description": "Name of the header or environment variable.", + "example": "SOME_VARIABLE", + "type": "string" + } + }, + "required": [ + "name" + ], + "type": "object" + } + ] + }, + "LocalTransport": { + "anyOf": [ + { + "$ref": "#/definitions/StdioTransport" + }, + { + "$ref": "#/definitions/StreamableHttpTransport" + }, + { + "$ref": "#/definitions/SseTransport" + } + ], + "description": "Transport protocol configuration for local/package context" + }, + "NamedArgument": { + "allOf": [ + { + "$ref": "#/definitions/InputWithVariables" + }, + { + "properties": { + "isRepeated": { + "default": false, + "description": "Whether the argument can be repeated multiple times.", + "type": "boolean" + }, + "name": { + "description": "The flag name, including any leading dashes.", + "example": "--port", + "type": "string" + }, + "type": { + "enum": [ + "named" + ], + "example": "named", + "type": "string" + } + }, + "required": [ + "type", + "name" + ], + "type": "object" + } + ], + "description": "A command-line `--flag={value}`." + }, + "Package": { + "properties": { + "environmentVariables": { + "description": "A mapping of environment variables to be set when running the package.", + "items": { + "$ref": "#/definitions/KeyValueInput" + }, + "type": "array" + }, + "fileSha256": { + "description": "SHA-256 hash of the package file for integrity verification. Required for MCPB packages and optional for other package types. Authors are responsible for generating correct SHA-256 hashes when creating server.json. If present, MCP clients must validate the downloaded file matches the hash before running packages to ensure file integrity.", + "example": "fe333e598595000ae021bd27117db32ec69af6987f507ba7a63c90638ff633ce", + "pattern": "^[a-f0-9]{64}$", + "type": "string" + }, + "identifier": { + "description": "Package identifier - either a package name (for registries) or URL (for direct downloads)", + "examples": [ + "@modelcontextprotocol/server-brave-search", + "https://github.com/example/releases/download/v1.0.0/package.mcpb" + ], + "type": "string" + }, + "packageArguments": { + "description": "A list of arguments to be passed to the package's binary.", + "items": { + "$ref": "#/definitions/Argument" + }, + "type": "array" + }, + "registryBaseUrl": { + "description": "Base URL of the package registry", + "examples": [ + "https://registry.npmjs.org", + "https://pypi.org", + "https://docker.io", + "https://api.nuget.org/v3/index.json", + "https://github.com", + "https://gitlab.com" + ], + "format": "uri", + "type": "string" + }, + "registryType": { + "description": "Registry type indicating how to download packages (e.g., 'npm', 'pypi', 'oci', 'nuget', 'mcpb')", + "examples": [ + "npm", + "pypi", + "oci", + "nuget", + "mcpb" + ], + "type": "string" + }, + "runtimeArguments": { + "description": "A list of arguments to be passed to the package's runtime command (such as docker or npx). The `runtimeHint` field should be provided when `runtimeArguments` are present.", + "items": { + "$ref": "#/definitions/Argument" + }, + "type": "array" + }, + "runtimeHint": { + "description": "A hint to help clients determine the appropriate runtime for the package. This field should be provided when `runtimeArguments` are present.", + "examples": [ + "npx", + "uvx", + "docker", + "dnx" + ], + "type": "string" + }, + "transport": { + "$ref": "#/definitions/LocalTransport", + "description": "Transport protocol configuration for the package" + }, + "version": { + "description": "Package version. Must be a specific version. Version ranges are rejected (e.g., '^1.2.3', '~1.2.3', '\u003e=1.2.3', '1.x', '1.*').", + "example": "1.0.2", + "minLength": 1, + "not": { + "const": "latest" + }, + "type": "string" + } + }, + "required": [ + "registryType", + "identifier", + "transport" + ], + "type": "object" + }, + "PositionalArgument": { + "allOf": [ + { + "$ref": "#/definitions/InputWithVariables" + }, + { + "anyOf": [ + { + "required": [ + "valueHint" + ] + }, + { + "required": [ + "value" + ] + } + ], + "properties": { + "isRepeated": { + "default": false, + "description": "Whether the argument can be repeated multiple times in the command line.", + "type": "boolean" + }, + "type": { + "enum": [ + "positional" + ], + "example": "positional", + "type": "string" + }, + "valueHint": { + "description": "An identifier for the positional argument. It is not part of the command line. It may be used by client configuration as a label identifying the argument. It is also used to identify the value in transport URL variable substitution.", + "example": "file_path", + "type": "string" + } + }, + "required": [ + "type" + ], + "type": "object" + } + ], + "description": "A positional input is a value inserted verbatim into the command line." + }, + "RemoteTransport": { + "allOf": [ + { + "anyOf": [ + { + "$ref": "#/definitions/StreamableHttpTransport" + }, + { + "$ref": "#/definitions/SseTransport" + } + ] + }, + { + "properties": { + "variables": { + "additionalProperties": { + "$ref": "#/definitions/Input" + }, + "description": "Configuration variables that can be referenced in URL template {curly_braces}. The key is the variable name, and the value defines the variable properties.", + "type": "object" + } + }, + "type": "object" + } + ], + "description": "Transport protocol configuration for remote context - extends StreamableHttpTransport or SseTransport with variables" + }, + "Repository": { + "description": "Repository metadata for the MCP server source code. Enables users and security experts to inspect the code, improving transparency.", + "properties": { + "id": { + "description": "Repository identifier from the hosting service (e.g., GitHub repo ID). Owned and determined by the source forge. Should remain stable across repository renames and may be used to detect repository resurrection attacks - if a repository is deleted and recreated, the ID should change. For GitHub, use: gh api repos/\u003cowner\u003e/\u003crepo\u003e --jq '.id'", + "example": "b94b5f7e-c7c6-d760-2c78-a5e9b8a5b8c9", + "type": "string" + }, + "source": { + "description": "Repository hosting service identifier. Used by registries to determine validation and API access methods.", + "example": "github", + "type": "string" + }, + "subfolder": { + "description": "Optional relative path from repository root to the server location within a monorepo or nested package structure. Must be a clean relative path.", + "example": "src/everything", + "type": "string" + }, + "url": { + "description": "Repository URL for browsing source code. Should support both web browsing and git clone operations.", + "example": "https://github.com/modelcontextprotocol/servers", + "format": "uri", + "type": "string" + } + }, + "required": [ + "url", + "source" + ], + "type": "object" + }, + "ServerDetail": { + "description": "Schema for a static representation of an MCP server. Used in various contexts related to discovery, installation, and configuration.", + "properties": { + "$schema": { + "description": "JSON Schema URI for this server.json format", + "example": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json", + "format": "uri", + "type": "string" + }, + "_meta": { + "description": "Extension metadata using reverse DNS namespacing for vendor-specific data", + "properties": { + "io.modelcontextprotocol.registry/publisher-provided": { + "additionalProperties": true, + "description": "Publisher-provided metadata for downstream registries", + "example": { + "buildInfo": { + "commit": "abc123def456", + "pipelineId": "build-789", + "timestamp": "2023-12-01T10:30:00Z" + }, + "tool": "publisher-cli", + "version": "1.2.3" + }, + "type": "object" + } + }, + "type": "object" + }, + "description": { + "description": "Clear human-readable explanation of server functionality. Should focus on capabilities, not implementation details.", + "example": "MCP server providing weather data and forecasts via OpenWeatherMap API", + "maxLength": 100, + "minLength": 1, + "type": "string" + }, + "icons": { + "description": "Optional set of sized icons that the client can display in a user interface. Clients that support rendering icons MUST support at least the following MIME types: image/png and image/jpeg (safe, universal compatibility). Clients SHOULD also support: image/svg+xml (scalable but requires security precautions) and image/webp (modern, efficient format).", + "items": { + "$ref": "#/definitions/Icon" + }, + "type": "array" + }, + "name": { + "description": "Server name in reverse-DNS format. Must contain exactly one forward slash separating namespace from server name.", + "example": "io.github.user/weather", + "maxLength": 200, + "minLength": 3, + "pattern": "^[a-zA-Z0-9.-]+/[a-zA-Z0-9._-]+$", + "type": "string" + }, + "packages": { + "items": { + "$ref": "#/definitions/Package" + }, + "type": "array" + }, + "remotes": { + "items": { + "$ref": "#/definitions/RemoteTransport" + }, + "type": "array" + }, + "repository": { + "$ref": "#/definitions/Repository", + "description": "Optional repository metadata for the MCP server source code. Recommended for transparency and security inspection." + }, + "title": { + "description": "Optional human-readable title or display name for the MCP server. MCP subregistries or clients MAY choose to use this for display purposes.", + "example": "Weather API", + "maxLength": 100, + "minLength": 1, + "type": "string" + }, + "version": { + "description": "Version string for this server. SHOULD follow semantic versioning (e.g., '1.0.2', '2.1.0-alpha'). Equivalent of Implementation.version in MCP specification. Non-semantic versions are allowed but may not sort predictably. Version ranges are rejected (e.g., '^1.2.3', '~1.2.3', '\u003e=1.2.3', '1.x', '1.*').", + "example": "1.0.2", + "maxLength": 255, + "type": "string" + }, + "websiteUrl": { + "description": "Optional URL to the server's homepage, documentation, or project website. This provides a central link for users to learn more about the server. Particularly useful when the server has custom installation instructions or setup requirements.", + "example": "https://modelcontextprotocol.io/examples", + "format": "uri", + "type": "string" + } + }, + "required": [ + "name", + "description", + "version" + ], + "type": "object" + }, + "SseTransport": { + "properties": { + "headers": { + "description": "HTTP headers to include", + "items": { + "$ref": "#/definitions/KeyValueInput" + }, + "type": "array" + }, + "type": { + "description": "Transport type", + "enum": [ + "sse" + ], + "example": "sse", + "type": "string" + }, + "url": { + "description": "Server-Sent Events endpoint URL template. Variables in {curly_braces} are resolved based on context: In Package context, they reference argument valueHints, argument names, or environment variable names from the parent Package. In Remote context, they reference variables from the transport's 'variables' object. After variable substitution, this should produce a valid URI.", + "example": "https://mcp-fs.example.com/sse", + "pattern": "^https?://[^\\s]+$", + "type": "string" + } + }, + "required": [ + "type", + "url" + ], + "type": "object" + }, + "StdioTransport": { + "properties": { + "type": { + "description": "Transport type", + "enum": [ + "stdio" + ], + "example": "stdio", + "type": "string" + } + }, + "required": [ + "type" + ], + "type": "object" + }, + "StreamableHttpTransport": { + "properties": { + "headers": { + "description": "HTTP headers to include", + "items": { + "$ref": "#/definitions/KeyValueInput" + }, + "type": "array" + }, + "type": { + "description": "Transport type", + "enum": [ + "streamable-http" + ], + "example": "streamable-http", + "type": "string" + }, + "url": { + "description": "URL template for the streamable-http transport. Variables in {curly_braces} are resolved based on context: In Package context, they reference argument valueHints, argument names, or environment variable names from the parent Package. In Remote context, they reference variables from the transport's 'variables' object. After variable substitution, this should produce a valid URI.", + "example": "https://api.example.com/mcp", + "pattern": "^https?://[^\\s]+$", + "type": "string" + } + }, + "required": [ + "type", + "url" + ], + "type": "object" + } + }, + "title": "server.json defining a Model Context Protocol (MCP) server" +} diff --git a/internal/validators/schemas/README.md b/internal/validators/schemas/README.md new file mode 100644 index 0000000..33f1e68 --- /dev/null +++ b/internal/validators/schemas/README.md @@ -0,0 +1,23 @@ +# Schema Files + +This directory contains JSON Schema files that are embedded into the Go binary (using the `go:embed` directive) for runtime validation. + +## How Schema Files Get Here + +Schema files are automatically synced from the [modelcontextprotocol/static](https://github.com/modelcontextprotocol/static) repository via the GitHub Actions workflow `.github/workflows/sync-schema.yml`. + +The workflow: +1. Checks out the `modelcontextprotocol/static` repository +2. Copies all versioned schema files from `static-repo/schemas/*/server.schema.json` +3. Saves them here as `{version}.json` (e.g., `2025-10-17.json`) +4. Automatically commits and pushes any new or updated schemas + +**Do not manually edit files in this directory** - they are managed by the sync workflow. + +## Usage + +These schema files are embedded into the Go binary using the `go:embed` directive for offline schema validation. The embedded schemas are used by the validation code in `internal/validators/schema.go` to validate `server.json` files against their specified schema version. + +## File Naming + +Files are named `{YYYY-MM-DD}.json` where the date corresponds to the schema version (e.g., `2025-10-17.json`). This matches the version in the schema's `$id` field. diff --git a/internal/validators/validation_detailed_test.go b/internal/validators/validation_detailed_test.go new file mode 100644 index 0000000..fc61178 --- /dev/null +++ b/internal/validators/validation_detailed_test.go @@ -0,0 +1,447 @@ +package validators_test + +import ( + "strings" + "testing" + + "github.com/modelcontextprotocol/registry/internal/validators" + apiv0 "github.com/modelcontextprotocol/registry/pkg/api/v0" + "github.com/modelcontextprotocol/registry/pkg/model" + "github.com/stretchr/testify/assert" +) + +const schemaPath = "schema" + +func TestValidateServerJSON_CollectsAllErrors(t *testing.T) { + // Create a server JSON with multiple validation errors + serverJSON := &apiv0.ServerJSON{ + Name: "invalid-name", // Invalid server name format + Version: "^1.0.0", // Invalid version range + Description: "Test server", + Repository: &model.Repository{ + URL: "not-a-valid-url", // Invalid repository URL + Source: "github", + }, + WebsiteURL: "ftp://invalid-scheme.com", // Invalid website URL scheme + Packages: []model.Package{ + { + RegistryType: model.RegistryTypeOCI, + RegistryBaseURL: "https://docker.io", + Identifier: "package with spaces", // Invalid package name + Version: "latest", // Reserved version + Transport: model.Transport{ + Type: model.TransportTypeStdio, + URL: "should-not-have-url", // Invalid stdio transport with URL + }, + RuntimeArguments: []model.Argument{ + { + Type: model.ArgumentTypeNamed, + Name: "--port ", // Invalid argument name + }, + }, + }, + }, + Remotes: []model.Transport{ + { + Type: model.TransportTypeStdio, // Invalid remote transport type + URL: "", // Missing URL for remote + }, + }, + } + + // Run detailed validation + result := validators.ValidateServerJSON(serverJSON, validators.ValidationSchemaVersionAndSemantic) + + // Verify it's invalid + assert.False(t, result.Valid) + assert.Greater(t, len(result.Issues), 5, "Should have multiple validation issues") + + // Check that we have issues of different types and severities + hasError := false + hasSemantic := false + + for _, issue := range result.Issues { + if issue.Severity == validators.ValidationIssueSeverityError { + hasError = true + } + if issue.Type == validators.ValidationIssueTypeSemantic { + hasSemantic = true + } + } + + assert.True(t, hasError, "Should have error severity issues") + assert.True(t, hasSemantic, "Should have semantic type issues") + + // Verify specific issues exist + issuePaths := make(map[string]bool) + for _, issue := range result.Issues { + issuePaths[issue.Path] = true + } + + // Check for expected issue paths + expectedPaths := []string{ + "name", + "version", + "repository.url", + "websiteUrl", + "packages[0].identifier", + "packages[0].version", + "packages[0].transport.url", + "packages[0].runtimeArguments[0].name", + "remotes[0].type", + "remotes[0].url", + } + + foundPaths := 0 + for _, expectedPath := range expectedPaths { + if issuePaths[expectedPath] { + foundPaths++ + } + } + + assert.Greater(t, foundPaths, 5, "Should have issues at multiple JSON paths") +} + +func TestValidateServerJSON_ValidServer(t *testing.T) { + // Create a valid server JSON + serverJSON := &apiv0.ServerJSON{ + Schema: model.CurrentSchemaURL, + Name: "com.example.test/valid-server", + Version: "1.0.0", + Description: "A valid test server", + Repository: &model.Repository{ + URL: "https://github.com/example/valid-server", + Source: "github", + }, + WebsiteURL: "https://test.example.com", + Packages: []model.Package{ + { + RegistryType: model.RegistryTypeOCI, + RegistryBaseURL: "https://docker.io", + Identifier: "valid-package", + Version: "1.0.0", + Transport: model.Transport{ + Type: model.TransportTypeStdio, + }, + }, + }, + } + + // Run detailed validation + result := validators.ValidateServerJSON(serverJSON, validators.ValidationSchemaVersionAndSemantic) + + // Verify it's valid + assert.True(t, result.Valid) + assert.Empty(t, result.Issues, "Should have no validation issues") +} + +func TestValidateServerJSON_ContextPaths(t *testing.T) { + // Create a server with nested validation errors to test context paths + serverJSON := &apiv0.ServerJSON{ + Name: "com.example.test/server", + Version: "1.0.0", + Packages: []model.Package{ + { + RegistryType: model.RegistryTypeOCI, + RegistryBaseURL: "https://docker.io", + Identifier: "package-1", + Version: "latest", // Error in first package + Transport: model.Transport{ + Type: model.TransportTypeStdio, + }, + }, + { + RegistryType: model.RegistryTypeOCI, + RegistryBaseURL: "https://docker.io", + Identifier: "package-2", + Version: "2.0.0", + Transport: model.Transport{ + Type: model.TransportTypeStdio, + }, + RuntimeArguments: []model.Argument{ + { + Type: model.ArgumentTypeNamed, + Name: "invalid name", // Error in second package's argument + }, + }, + }, + }, + } + + // Run detailed validation + result := validators.ValidateServerJSON(serverJSON, validators.ValidationSchemaVersionAndSemantic) + + // Verify we have issues at the correct paths + issuePaths := make(map[string]bool) + for _, issue := range result.Issues { + issuePaths[issue.Path] = true + } + + // Should have issues at specific nested paths + assert.True(t, issuePaths["packages[0].version"], "Should have issue at packages[0].version") + assert.True(t, issuePaths["packages[1].runtimeArguments[0].name"], "Should have issue at packages[1].runtimeArguments[0].name") +} + +func TestValidateServerJSON_RefResolution(t *testing.T) { + // Create a server JSON with validation errors that will trigger $ref resolution + serverJSON := &apiv0.ServerJSON{ + Schema: model.CurrentSchemaURL, + Name: "com.example.test/invalid-server", + Version: "1.0.0", + Description: "Test server with validation errors", + Repository: &model.Repository{ + URL: "", // Empty URL should trigger format validation error in $ref'd Repository + Source: "github", + }, + Packages: []model.Package{ + { + RegistryType: model.RegistryTypeOCI, + RegistryBaseURL: "https://docker.io", + Identifier: "test-package", + Version: "1.0.0", + Transport: model.Transport{ + Type: model.TransportTypeSSE, + URL: "https://example.com", + }, + PackageArguments: []model.Argument{ + { + InputWithVariables: model.InputWithVariables{ + Input: model.Input{ + Format: "invalid-format", // This should trigger a validation error in the complex path + }, + }, + Type: "named", + Name: "test-arg", + }, + }, + }, + }, + } + + // Run validation with schema validation enabled + result := validators.ValidateServerJSON(serverJSON, validators.ValidationAll) + + // Check that we have validation errors + assert.False(t, result.Valid, "Expected validation errors") + assert.Greater(t, len(result.Issues), 0, "Expected at least one validation issue") + + // Check that we have schema validation issues with proper $ref resolution + hasSchemaIssues := false + for _, issue := range result.Issues { + if issue.Type == validators.ValidationIssueTypeSchema { + hasSchemaIssues = true + // Check that there are no unresolved [$ref] segments + assert.NotContains(t, issue.Reference, "[$ref]", "Found unresolved $ref segment in reference: %s", issue.Reference) + + // Check for exact resolved paths we expect + if issue.Path == "repository.url" { + expectedRef := "#/definitions/Repository/properties/url/format from: [#/definitions/ServerDetail]/properties/repository/[#/definitions/Repository]/properties/url/format" + assert.Equal(t, expectedRef, issue.Reference, "Repository URL error should have exact resolved reference") + } + if issue.Path == "packages[0].packageArguments[0].format" { + // The schema uses anyOf for Argument types, so it could match either PositionalArgument or NamedArgument + // Just check that it contains the expected definitions + assert.Contains(t, issue.Reference, "#/definitions/Input/properties/format/enum", "Should reference the Input format enum") + assert.Contains(t, issue.Reference, "[#/definitions/InputWithVariables]", "Should reference InputWithVariables") + assert.Contains(t, issue.Reference, "[#/definitions/Input]", "Should reference Input") + } + } + } + assert.True(t, hasSchemaIssues, "Expected schema validation issues with $ref resolution") + + // Check that we have issues at expected paths + issuePaths := make(map[string]bool) + for _, issue := range result.Issues { + issuePaths[issue.Path] = true + } + + // Should have issues at specific paths that trigger $ref resolution + assert.True(t, issuePaths["repository.url"], "Should have issue at repository.url") + assert.True(t, issuePaths["packages[0].packageArguments[0].format"], "Should have issue at packages[0].packageArguments[0].format") +} + +func TestValidateServerJSON_EmptySchema(t *testing.T) { + // Test that empty/missing schema produces an error + serverJSON := &apiv0.ServerJSON{ + // Schema field intentionally omitted (empty string) + Name: "com.example.test/server", + Version: "1.0.0", + Description: "Test server", + Repository: &model.Repository{ + URL: "https://github.com/example/server", + Source: "github", + }, + } + + result := validators.ValidateServerJSON(serverJSON, validators.ValidationAll) + + // Should be invalid due to missing schema + assert.False(t, result.Valid, "Empty schema should cause validation failure") + + // Should have an error issue for missing schema + hasSchemaError := false + for _, issue := range result.Issues { + if issue.Path == schemaPath && issue.Severity == validators.ValidationIssueSeverityError { + if strings.Contains(issue.Message, "$schema field is required") { + hasSchemaError = true + } + } + } + assert.True(t, hasSchemaError, "Should have error for missing $schema field") +} + +func TestValidateServerJSON_NonCurrentSchema_Warning(t *testing.T) { + // Test that non-current (but valid) schema produces a warning, not an error + serverJSON := &apiv0.ServerJSON{ + Schema: "https://static.modelcontextprotocol.io/schemas/2025-07-09/server.schema.json", // Older but valid schema + Name: "com.example.test/server", + Version: "1.0.0", + Description: "Test server", + Repository: &model.Repository{ + URL: "https://github.com/example/server", + Source: "github", + }, + } + + result := validators.ValidateServerJSON(serverJSON, validators.ValidationAll) + + // Should be valid (warnings don't make it invalid) + assert.True(t, result.Valid, "Non-current schema should produce warning but still be valid") + + // Should have a warning issue for non-current schema + hasSchemaWarning := false + for _, issue := range result.Issues { + if issue.Path == schemaPath && issue.Severity == validators.ValidationIssueSeverityWarning { + if strings.Contains(issue.Message, "not the current version") || strings.Contains(issue.Message, "Consider updating") { + hasSchemaWarning = true + } + } + } + assert.True(t, hasSchemaWarning, "Should have warning for non-current schema version") +} + +func TestValidateServerJSON_InvalidSchema_Error(t *testing.T) { + // Test that invalid/non-existent schema produces an error + serverJSON := &apiv0.ServerJSON{ + Schema: "https://static.modelcontextprotocol.io/schemas/2025-01-27/server.schema.json", // Non-existent version + Name: "com.example.test/server", + Version: "1.0.0", + Description: "Test server", + Repository: &model.Repository{ + URL: "https://github.com/example/server", + Source: "github", + }, + } + + result := validators.ValidateServerJSON(serverJSON, validators.ValidationAll) + + // Should be invalid due to schema not available + assert.False(t, result.Valid, "Invalid schema version should cause validation failure") + + // Should have an error issue for schema not available + hasSchemaError := false + for _, issue := range result.Issues { + if issue.Path == schemaPath && issue.Severity == validators.ValidationIssueSeverityError { + if strings.Contains(issue.Message, "not available") || strings.Contains(issue.Message, "not found") { + hasSchemaError = true + } + } + } + assert.True(t, hasSchemaError, "Should have error for invalid/non-existent schema version") +} + +func TestValidateServerJSON_NonCurrentSchema_Policies(t *testing.T) { + // Test all three policies for non-current schema handling + serverJSON := &apiv0.ServerJSON{ + Schema: "https://static.modelcontextprotocol.io/schemas/2025-07-09/server.schema.json", // Older but valid schema + Name: "com.example.test/server", + Version: "1.0.0", + Description: "Test server", + Repository: &model.Repository{ + URL: "https://github.com/example/server", + Source: "github", + }, + } + + tests := []struct { + name string + policy validators.SchemaVersionPolicy + expectValid bool + expectWarning bool + expectError bool + expectIssueCount int + }{ + { + name: "Allow policy - no warning or error", + policy: validators.SchemaVersionPolicyAllow, + expectValid: true, + expectWarning: false, + expectError: false, + expectIssueCount: 0, + }, + { + name: "Warn policy - warning but still valid", + policy: validators.SchemaVersionPolicyWarn, + expectValid: true, + expectWarning: true, + expectError: false, + expectIssueCount: 1, + }, + { + name: "Error policy - error and invalid", + policy: validators.SchemaVersionPolicyError, + expectValid: false, + expectWarning: false, + expectError: true, + expectIssueCount: 1, + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + opts := validators.ValidationOptions{ + ValidateSchema: true, + ValidateSemantic: true, + NonCurrentSchemaPolicy: tt.policy, + } + result := validators.ValidateServerJSON(serverJSON, opts) + + assert.Equal(t, tt.expectValid, result.Valid, "Validation result should match expected") + + hasWarning := false + hasError := false + schemaWarnings := 0 + schemaErrors := 0 + + for _, issue := range result.Issues { + if issue.Path == schemaPath { + if issue.Severity == validators.ValidationIssueSeverityWarning { + hasWarning = true + schemaWarnings++ + if !strings.Contains(issue.Message, "not the current version") { + t.Errorf("Warning message should mention 'not the current version', got: %s", issue.Message) + } + } + if issue.Severity == validators.ValidationIssueSeverityError { + if strings.Contains(issue.Message, "not the current version") { + hasError = true + schemaErrors++ + } + } + } + } + + assert.Equal(t, tt.expectWarning, hasWarning, "Warning presence should match expected") + assert.Equal(t, tt.expectError, hasError, "Error presence should match expected") + + // Count schema-related issues (excluding other validation issues) + schemaIssueCount := 0 + for _, issue := range result.Issues { + if issue.Path == schemaPath && (strings.Contains(issue.Message, "not the current version") || strings.Contains(issue.Message, "current version")) { + schemaIssueCount++ + } + } + assert.Equal(t, tt.expectIssueCount, schemaIssueCount, "Schema issue count should match expected") + }) + } +} diff --git a/internal/validators/validation_types.go b/internal/validators/validation_types.go new file mode 100644 index 0000000..4de21b4 --- /dev/null +++ b/internal/validators/validation_types.go @@ -0,0 +1,161 @@ +package validators + +import "fmt" + +// Validation issue type with constrained values +type ValidationIssueType string + +const ( + ValidationIssueTypeJSON ValidationIssueType = "json" + ValidationIssueTypeSchema ValidationIssueType = "schema" + ValidationIssueTypeSemantic ValidationIssueType = "semantic" + ValidationIssueTypeLinter ValidationIssueType = "linter" +) + +// Validation issue severity with constrained values +type ValidationIssueSeverity string + +const ( + ValidationIssueSeverityError ValidationIssueSeverity = "error" + ValidationIssueSeverityWarning ValidationIssueSeverity = "warning" + ValidationIssueSeverityInfo ValidationIssueSeverity = "info" +) + +// SchemaVersionPolicy determines how non-current schema versions are handled +type SchemaVersionPolicy string + +const ( + // SchemaVersionPolicyAllow allows non-current schemas with no warning or error + SchemaVersionPolicyAllow SchemaVersionPolicy = "allow" + // SchemaVersionPolicyWarn allows non-current schemas but generates a warning + SchemaVersionPolicyWarn SchemaVersionPolicy = "warn" + // SchemaVersionPolicyError rejects non-current schemas with an error + SchemaVersionPolicyError SchemaVersionPolicy = "error" +) + +// ValidationOptions configures which types of validation to perform +// ValidateSchema implies ValidateSchemaVersion (the flag is ignored if ValidateSchema is true) +type ValidationOptions struct { + ValidateSchemaVersion bool // Check schema version (empty, non-current). Ignored if ValidateSchema is true. + ValidateSchema bool // Perform full schema validation (implies ValidateSchemaVersion) + ValidateSemantic bool // Perform semantic validation + NonCurrentSchemaPolicy SchemaVersionPolicy // Policy for non-current schemas (only used when schema validation is performed) +} + +// Common validation configurations +var ( + // ValidationSemanticOnly performs only semantic validation (no schema checks) + ValidationSemanticOnly = ValidationOptions{ + ValidateSemantic: true, + } + + // ValidationSchemaVersionOnly checks schema version only (empty, non-current) + ValidationSchemaVersionOnly = ValidationOptions{ + ValidateSchemaVersion: true, + NonCurrentSchemaPolicy: SchemaVersionPolicyError, + } + + // ValidationSchemaVersionAndSemantic checks schema version and performs semantic validation + ValidationSchemaVersionAndSemantic = ValidationOptions{ + ValidateSchemaVersion: true, + ValidateSemantic: true, + NonCurrentSchemaPolicy: SchemaVersionPolicyWarn, + } + + // ValidationAll performs all validation types (schema version, full schema validation, and semantic) + ValidationAll = ValidationOptions{ + ValidateSchema: true, // Implies ValidateSchemaVersion + ValidateSemantic: true, + NonCurrentSchemaPolicy: SchemaVersionPolicyWarn, + } +) + +// ValidationIssue represents a single validation problem +type ValidationIssue struct { + Type ValidationIssueType `json:"type"` + Path string `json:"path"` // JSON path like "packages[0].transport.url" + Message string `json:"message"` // Error description (extracted from error.Error()) + Severity ValidationIssueSeverity `json:"severity"` + Reference string `json:"reference"` // Reference to validation trigger (schema rule path, named rule, etc.) +} + +// ValidationResult contains the results of validation +type ValidationResult struct { + Valid bool `json:"valid"` + Issues []ValidationIssue `json:"issues"` +} + +// ValidationContext tracks the current JSON path during validation +type ValidationContext struct { + path string +} + +// NewValidationIssue creates a validation issue with manual field setting +func NewValidationIssue(issueType ValidationIssueType, path, message string, severity ValidationIssueSeverity, reference string) ValidationIssue { + return ValidationIssue{ + Type: issueType, + Path: path, + Message: message, + Severity: severity, + Reference: reference, + } +} + +// NewValidationIssueFromError creates a validation issue from an existing error +func NewValidationIssueFromError(issueType ValidationIssueType, path string, err error, reference string) ValidationIssue { + return ValidationIssue{ + Type: issueType, + Path: path, + Message: err.Error(), // Extract string from error + Severity: ValidationIssueSeverityError, // Errors are always severity "error" + Reference: reference, + } +} + +// AddIssue adds a validation issue to the result +func (vr *ValidationResult) AddIssue(issue ValidationIssue) { + vr.Issues = append(vr.Issues, issue) + if issue.Severity == ValidationIssueSeverityError { + vr.Valid = false + } +} + +// Merge combines another validation result into this one +func (vr *ValidationResult) Merge(other *ValidationResult) { + vr.Issues = append(vr.Issues, other.Issues...) + if !other.Valid { + vr.Valid = false + } +} + +// FirstError returns the first error-level issue as an error, or nil if valid +// This provides backward compatibility for code that expects an error return type +func (vr *ValidationResult) FirstError() error { + if vr.Valid { + return nil + } + for _, issue := range vr.Issues { + if issue.Severity == ValidationIssueSeverityError { + return fmt.Errorf("%s", issue.Message) + } + } + return nil +} + +// Field adds a field name to the context path +func (ctx *ValidationContext) Field(name string) *ValidationContext { + if ctx.path == "" { + return &ValidationContext{path: name} + } + return &ValidationContext{path: ctx.path + "." + name} +} + +// Index adds an array index to the context path +func (ctx *ValidationContext) Index(i int) *ValidationContext { + return &ValidationContext{path: ctx.path + fmt.Sprintf("[%d]", i)} +} + +// String returns the current path as a string +func (ctx *ValidationContext) String() string { + return ctx.path +} diff --git a/internal/validators/validation_types_test.go b/internal/validators/validation_types_test.go new file mode 100644 index 0000000..8d8a084 --- /dev/null +++ b/internal/validators/validation_types_test.go @@ -0,0 +1,173 @@ +package validators_test + +import ( + "errors" + "testing" + + "github.com/modelcontextprotocol/registry/internal/validators" + "github.com/stretchr/testify/assert" +) + +func TestValidationIssueTypes(t *testing.T) { + tests := []struct { + name string + issueType validators.ValidationIssueType + expected string + }{ + {"JSON type", validators.ValidationIssueTypeJSON, "json"}, + {"Schema type", validators.ValidationIssueTypeSchema, "schema"}, + {"Semantic type", validators.ValidationIssueTypeSemantic, "semantic"}, + {"Linter type", validators.ValidationIssueTypeLinter, "linter"}, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + assert.Equal(t, tt.expected, string(tt.issueType)) + }) + } +} + +func TestValidationIssueSeverity(t *testing.T) { + tests := []struct { + name string + severity validators.ValidationIssueSeverity + expected string + }{ + {"Error severity", validators.ValidationIssueSeverityError, "error"}, + {"Warning severity", validators.ValidationIssueSeverityWarning, "warning"}, + {"Info severity", validators.ValidationIssueSeverityInfo, "info"}, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + assert.Equal(t, tt.expected, string(tt.severity)) + }) + } +} + +func TestNewValidationIssue(t *testing.T) { + issue := validators.NewValidationIssue( + validators.ValidationIssueTypeSemantic, + "repository.url", + "invalid repository URL", + validators.ValidationIssueSeverityError, + "invalid-repository-url", + ) + + assert.Equal(t, validators.ValidationIssueTypeSemantic, issue.Type) + assert.Equal(t, "repository.url", issue.Path) + assert.Equal(t, "invalid repository URL", issue.Message) + assert.Equal(t, validators.ValidationIssueSeverityError, issue.Severity) + assert.Equal(t, "invalid-repository-url", issue.Reference) +} + +func TestNewValidationIssueFromError(t *testing.T) { + err := errors.New("invalid repository URL: https://bad-url.com") + issue := validators.NewValidationIssueFromError( + validators.ValidationIssueTypeSemantic, + "repository.url", + err, + "invalid-repository-url", + ) + + assert.Equal(t, validators.ValidationIssueTypeSemantic, issue.Type) + assert.Equal(t, "repository.url", issue.Path) + assert.Equal(t, "invalid repository URL: https://bad-url.com", issue.Message) + assert.Equal(t, validators.ValidationIssueSeverityError, issue.Severity) + assert.Equal(t, "invalid-repository-url", issue.Reference) +} + +func TestValidationResultAddIssue(t *testing.T) { + result := &validators.ValidationResult{Valid: true, Issues: []validators.ValidationIssue{}} + + // Add a warning issue - should not affect validity + warningIssue := validators.NewValidationIssue( + validators.ValidationIssueTypeLinter, + "description", + "consider adding a description", + validators.ValidationIssueSeverityWarning, + "descriptive-naming", + ) + result.AddIssue(warningIssue) + + assert.True(t, result.Valid) + assert.Len(t, result.Issues, 1) + + // Add an error issue - should make invalid + errorIssue := validators.NewValidationIssue( + validators.ValidationIssueTypeSemantic, + "name", + "server name is required", + validators.ValidationIssueSeverityError, + "missing-server-name", + ) + result.AddIssue(errorIssue) + + assert.False(t, result.Valid) + assert.Len(t, result.Issues, 2) +} + +func TestValidationResultMerge(t *testing.T) { + result1 := &validators.ValidationResult{Valid: true, Issues: []validators.ValidationIssue{}} + result2 := &validators.ValidationResult{Valid: false, Issues: []validators.ValidationIssue{}} + + // Add issues to both + issue1 := validators.NewValidationIssue( + validators.ValidationIssueTypeSemantic, + "name", + "server name is required", + validators.ValidationIssueSeverityError, + "missing-server-name", + ) + result1.AddIssue(issue1) + + issue2 := validators.NewValidationIssue( + validators.ValidationIssueTypeSchema, + "version", + "version must be a string", + validators.ValidationIssueSeverityError, + "schema-validation", + ) + result2.AddIssue(issue2) + + // Merge result2 into result1 + result1.Merge(result2) + + assert.False(t, result1.Valid) // Should be invalid because result2 was invalid + assert.Len(t, result1.Issues, 2) // Should have both issues +} + +func TestValidationContext(t *testing.T) { + // Test empty context + ctx := &validators.ValidationContext{} + assert.Equal(t, "", ctx.String()) + + // Test field addition + ctx = ctx.Field("repository") + assert.Equal(t, "repository", ctx.String()) + + // Test nested field + ctx = ctx.Field("url") + assert.Equal(t, "repository.url", ctx.String()) + + // Test array index + ctx = &validators.ValidationContext{} + ctx = ctx.Field("packages").Index(0).Field("transport") + assert.Equal(t, "packages[0].transport", ctx.String()) + + // Test multiple array indices + ctx = &validators.ValidationContext{} + ctx = ctx.Field("packages").Index(0).Field("environmentVariables").Index(1).Field("name") + assert.Equal(t, "packages[0].environmentVariables[1].name", ctx.String()) +} + +func TestValidationContextImmutability(t *testing.T) { + // Test that context operations return new instances + ctx1 := &validators.ValidationContext{} + ctx2 := ctx1.Field("repository") + ctx3 := ctx2.Field("url") + + assert.Equal(t, "", ctx1.String()) + assert.Equal(t, "repository", ctx2.String()) + assert.Equal(t, "repository.url", ctx3.String()) +} diff --git a/internal/validators/validators.go b/internal/validators/validators.go index 1085474..2081f0b 100644 --- a/internal/validators/validators.go +++ b/internal/validators/validators.go @@ -51,206 +51,299 @@ var ( dottedVersionLikeRe = regexp.MustCompile(`^\s*(?:v?\d+|x|X|\*)(?:\.(?:\d+|x|X|\*)){1,2}(?:-[0-9A-Za-z.-]+)?\s*$`) ) -func ValidateServerJSON(serverJSON *apiv0.ServerJSON) error { - // Validate schema version is provided and supported - // Note: Schema field is also marked as required in the ServerJSON struct definition - // for API-level validation and documentation - if serverJSON.Schema == "" { - return fmt.Errorf("$schema field is required") +// ValidateServerJSON performs exhaustive validation and returns all issues found +// opts specifies which types of validation to perform. ValidateSchema implies ValidateSchemaVersion. +// Empty schema is always checked and always produces an error when schema validation is performed. +func ValidateServerJSON(serverJSON *apiv0.ServerJSON, opts ValidationOptions) *ValidationResult { + result := &ValidationResult{Valid: true, Issues: []ValidationIssue{}} + ctx := &ValidationContext{} + + // Schema validation (version check and/or full validation) + if opts.ValidateSchemaVersion || opts.ValidateSchema { + schemaResult := validateServerJSONSchema(serverJSON, opts.ValidateSchema, opts.NonCurrentSchemaPolicy) + result.Merge(schemaResult) } - if !strings.Contains(serverJSON.Schema, model.CurrentSchemaVersion) { - return fmt.Errorf("schema version %s is not supported. Please use schema version %s", serverJSON.Schema, model.CurrentSchemaVersion) + + // Semantic validation (only if requested) + if !opts.ValidateSemantic { + return result } // Validate server name exists and format if _, err := parseServerName(*serverJSON); err != nil { - return err + issue := NewValidationIssueFromError( + ValidationIssueTypeSemantic, + ctx.Field("name").String(), + err, + "invalid-server-name", + ) + result.AddIssue(issue) } // Validate top-level server version is a specific version (not a range) & not "latest" - if err := validateVersion(serverJSON.Version); err != nil { - return err - } + versionResult := validateVersion(ctx.Field("version"), serverJSON.Version) + result.Merge(versionResult) // Validate repository - if err := validateRepository(serverJSON.Repository); err != nil { - return err - } + repoResult := validateRepository(ctx.Field("repository"), serverJSON.Repository) + result.Merge(repoResult) // Validate website URL if provided - if err := validateWebsiteURL(serverJSON.WebsiteURL); err != nil { - return err - } + websiteResult := validateWebsiteURL(ctx.Field("websiteUrl"), serverJSON.WebsiteURL) + result.Merge(websiteResult) // Validate title if provided - if err := validateTitle(serverJSON.Title); err != nil { - return err - } + titleResult := validateTitle(ctx.Field("title"), serverJSON.Title) + result.Merge(titleResult) // Validate icons if provided - if err := validateIcons(serverJSON.Icons); err != nil { - return err - } + iconsResult := validateIcons(ctx.Field("icons"), serverJSON.Icons) + result.Merge(iconsResult) // Validate all packages (basic field validation) // Detailed package validation (including registry checks) is done during publish - for _, pkg := range serverJSON.Packages { - if err := validatePackageField(&pkg); err != nil { - return err - } + for i, pkg := range serverJSON.Packages { + pkgResult := validatePackageField(ctx.Field("packages").Index(i), &pkg) + result.Merge(pkgResult) } // Validate all remotes - for _, remote := range serverJSON.Remotes { - if err := validateRemoteTransport(&remote); err != nil { - return err - } + for i, remote := range serverJSON.Remotes { + remoteResult := validateRemoteTransport(ctx.Field("remotes").Index(i), &remote) + result.Merge(remoteResult) } - return nil + return result } -func validateRepository(obj *model.Repository) error { +func validateRepository(ctx *ValidationContext, obj *model.Repository) *ValidationResult { + result := &ValidationResult{Valid: true, Issues: []ValidationIssue{}} + // Skip validation if repository is nil or empty (optional field) if obj == nil || (obj.URL == "" && obj.Source == "") { - return nil + return result } // validate the repository source repoSource := RepositorySource(obj.Source) if !IsValidRepositoryURL(repoSource, obj.URL) { - return fmt.Errorf("%w: %s", ErrInvalidRepositoryURL, obj.URL) + issue := NewValidationIssueFromError( + ValidationIssueTypeSemantic, + ctx.Field("url").String(), + fmt.Errorf("%w: %s", ErrInvalidRepositoryURL, obj.URL), + "invalid-repository-url", + ) + result.AddIssue(issue) } // validate subfolder if present if obj.Subfolder != "" && !IsValidSubfolderPath(obj.Subfolder) { - return fmt.Errorf("%w: %s", ErrInvalidSubfolderPath, obj.Subfolder) + issue := NewValidationIssueFromError( + ValidationIssueTypeSemantic, + ctx.Field("subfolder").String(), + fmt.Errorf("%w: %s", ErrInvalidSubfolderPath, obj.Subfolder), + "invalid-subfolder-path", + ) + result.AddIssue(issue) } - return nil + return result } -func validateWebsiteURL(websiteURL string) error { +func validateWebsiteURL(ctx *ValidationContext, websiteURL string) *ValidationResult { + result := &ValidationResult{Valid: true, Issues: []ValidationIssue{}} + // Skip validation if website URL is not provided (optional field) if websiteURL == "" { - return nil + return result } // Parse the URL to ensure it's valid parsedURL, err := url.Parse(websiteURL) if err != nil { - return fmt.Errorf("invalid websiteUrl: %w", err) + issue := NewValidationIssueFromError( + ValidationIssueTypeSemantic, + ctx.String(), + fmt.Errorf("invalid websiteUrl: %w", err), + "invalid-website-url", + ) + result.AddIssue(issue) + return result } // Ensure it's an absolute URL with valid scheme if !parsedURL.IsAbs() { - return fmt.Errorf("websiteUrl must be absolute (include scheme): %s", websiteURL) + issue := NewValidationIssue( + ValidationIssueTypeSemantic, + ctx.String(), + fmt.Sprintf("websiteUrl must be absolute (include scheme): %s", websiteURL), + ValidationIssueSeverityError, + "website-url-must-be-absolute", + ) + result.AddIssue(issue) } // Only allow HTTPS scheme for security if parsedURL.Scheme != SchemeHTTPS { - return fmt.Errorf("websiteUrl must use https scheme: %s", websiteURL) + issue := NewValidationIssue( + ValidationIssueTypeSemantic, + ctx.String(), + fmt.Sprintf("websiteUrl must use https scheme: %s", websiteURL), + ValidationIssueSeverityError, + "website-url-invalid-scheme", + ) + result.AddIssue(issue) } - return nil + return result } -func validateTitle(title string) error { +func validateTitle(ctx *ValidationContext, title string) *ValidationResult { + result := &ValidationResult{Valid: true, Issues: []ValidationIssue{}} + // Skip validation if title is not provided (optional field) if title == "" { - return nil + return result } // Check that title is not only whitespace if strings.TrimSpace(title) == "" { - return fmt.Errorf("title cannot be only whitespace") + issue := NewValidationIssueFromError( + ValidationIssueTypeSemantic, + ctx.String(), + fmt.Errorf("title cannot be only whitespace"), + "title-whitespace-only", + ) + result.AddIssue(issue) } - return nil + return result } -func validateIcons(icons []model.Icon) error { +func validateIcons(ctx *ValidationContext, icons []model.Icon) *ValidationResult { + result := &ValidationResult{Valid: true, Issues: []ValidationIssue{}} + // Skip validation if no icons are provided (optional field) if len(icons) == 0 { - return nil + return result } // Validate each icon for i, icon := range icons { - if err := validateIcon(&icon); err != nil { - return fmt.Errorf("invalid icon at index %d: %w", i, err) - } + iconResult := validateIcon(ctx.Index(i), &icon) + result.Merge(iconResult) } - return nil + return result } -func validateIcon(icon *model.Icon) error { +func validateIcon(ctx *ValidationContext, icon *model.Icon) *ValidationResult { + result := &ValidationResult{Valid: true, Issues: []ValidationIssue{}} + // Parse the URL to ensure it's valid parsedURL, err := url.Parse(icon.Src) if err != nil { - return fmt.Errorf("invalid icon src URL: %w", err) + issue := NewValidationIssueFromError( + ValidationIssueTypeSemantic, + ctx.Field("src").String(), + fmt.Errorf("invalid icon src URL: %w", err), + "icon-src-invalid-url", + ) + result.AddIssue(issue) + return result } // Ensure it's an absolute URL if !parsedURL.IsAbs() { - return fmt.Errorf("icon src must be an absolute URL (include scheme): %s", icon.Src) + issue := NewValidationIssueFromError( + ValidationIssueTypeSemantic, + ctx.Field("src").String(), + fmt.Errorf("icon src must be an absolute URL (include scheme): %s", icon.Src), + "icon-src-not-absolute", + ) + result.AddIssue(issue) } // Only allow HTTPS scheme for security (no HTTP or data: URIs) if parsedURL.Scheme != SchemeHTTPS { - return fmt.Errorf("icon src must use https scheme (got %s): %s", parsedURL.Scheme, icon.Src) + issue := NewValidationIssueFromError( + ValidationIssueTypeSemantic, + ctx.Field("src").String(), + fmt.Errorf("icon src must use https scheme (got %s): %s", parsedURL.Scheme, icon.Src), + "icon-src-invalid-scheme", + ) + result.AddIssue(issue) } - return nil + return result } -func validatePackageField(obj *model.Package) error { +func validatePackageField(ctx *ValidationContext, obj *model.Package) *ValidationResult { + result := &ValidationResult{Valid: true, Issues: []ValidationIssue{}} + + // Validate identifier has no spaces if !HasNoSpaces(obj.Identifier) { - return ErrPackageNameHasSpaces + issue := NewValidationIssueFromError( + ValidationIssueTypeSemantic, + ctx.Field("identifier").String(), + ErrPackageNameHasSpaces, + "package-name-has-spaces", + ) + result.AddIssue(issue) } // Validate version string - if err := validateVersion(obj.Version); err != nil { - return err - } + versionResult := validateVersion(ctx.Field("version"), obj.Version) + result.Merge(versionResult) // Validate runtime arguments - for _, arg := range obj.RuntimeArguments { - if err := validateArgument(&arg); err != nil { - return fmt.Errorf("invalid runtime argument: %w", err) - } + for i, arg := range obj.RuntimeArguments { + argResult := validateArgument(ctx.Field("runtimeArguments").Index(i), &arg) + result.Merge(argResult) } // Validate package arguments - for _, arg := range obj.PackageArguments { - if err := validateArgument(&arg); err != nil { - return fmt.Errorf("invalid package argument: %w", err) - } + for i, arg := range obj.PackageArguments { + argResult := validateArgument(ctx.Field("packageArguments").Index(i), &arg) + result.Merge(argResult) } // Validate transport with template variable support availableVariables := collectAvailableVariables(obj) - if err := validatePackageTransport(&obj.Transport, availableVariables); err != nil { - return fmt.Errorf("invalid transport: %w", err) - } + transportResult := validatePackageTransport(ctx.Field("transport"), &obj.Transport, availableVariables) + result.Merge(transportResult) - return nil + return result } // validateVersion validates the version string. // NB: we decided that we would not enforce strict semver for version strings -func validateVersion(version string) error { +func validateVersion(ctx *ValidationContext, version string) *ValidationResult { + result := &ValidationResult{Valid: true, Issues: []ValidationIssue{}} + if version == "latest" { - return ErrReservedVersionString + issue := NewValidationIssueFromError( + ValidationIssueTypeSemantic, + ctx.String(), + ErrReservedVersionString, + "reserved-version-string", + ) + result.AddIssue(issue) + return result } // Reject semver range-like inputs if looksLikeVersionRange(version) { - return fmt.Errorf("%w: %q", ErrVersionLooksLikeRange, version) + issue := NewValidationIssueFromError( + ValidationIssueTypeSemantic, + ctx.String(), + fmt.Errorf("%w: %q", ErrVersionLooksLikeRange, version), + "version-looks-like-range", + ) + result.AddIssue(issue) } - return nil + return result } // looksLikeVersionRange detects common semver range syntaxes and wildcard patterns. @@ -286,25 +379,34 @@ func looksLikeVersionRange(version string) bool { } // validateArgument validates argument details -func validateArgument(obj *model.Argument) error { +func validateArgument(ctx *ValidationContext, obj *model.Argument) *ValidationResult { + result := &ValidationResult{Valid: true, Issues: []ValidationIssue{}} + if obj.Type == model.ArgumentTypeNamed { // Validate named argument name format - if err := validateNamedArgumentName(obj.Name); err != nil { - return err - } + nameResult := validateNamedArgumentName(ctx.Field("name"), obj.Name) + result.Merge(nameResult) // Validate value and default don't start with the name - if err := validateArgumentValueFields(obj.Name, obj.Value, obj.Default); err != nil { - return err - } + valueResult := validateArgumentValueFields(ctx, obj.Name, obj.Value, obj.Default) + result.Merge(valueResult) } - return nil + return result } -func validateNamedArgumentName(name string) error { +func validateNamedArgumentName(ctx *ValidationContext, name string) *ValidationResult { + result := &ValidationResult{Valid: true, Issues: []ValidationIssue{}} + // Check if name is required for named arguments if name == "" { - return ErrNamedArgumentNameRequired + issue := NewValidationIssueFromError( + ValidationIssueTypeSemantic, + ctx.String(), + ErrNamedArgumentNameRequired, + "named-argument-name-required", + ) + result.AddIssue(issue) + return result } // Check for invalid characters that suggest embedded values or descriptions @@ -312,23 +414,43 @@ func validateNamedArgumentName(name string) error { // Invalid: "--directory ", "--port 8080" if strings.Contains(name, "<") || strings.Contains(name, ">") || strings.Contains(name, " ") || strings.Contains(name, "$") { - return fmt.Errorf("%w: %s", ErrInvalidNamedArgumentName, name) + issue := NewValidationIssueFromError( + ValidationIssueTypeSemantic, + ctx.String(), + fmt.Errorf("%w: %s", ErrInvalidNamedArgumentName, name), + "invalid-named-argument-name", + ) + result.AddIssue(issue) } - return nil + return result } -func validateArgumentValueFields(name, value, defaultValue string) error { +func validateArgumentValueFields(ctx *ValidationContext, name, value, defaultValue string) *ValidationResult { + result := &ValidationResult{Valid: true, Issues: []ValidationIssue{}} + // Check if value starts with the argument name (using startsWith, not contains) if value != "" && strings.HasPrefix(value, name) { - return fmt.Errorf("%w: value starts with argument name '%s': %s", ErrArgumentValueStartsWithName, name, value) + issue := NewValidationIssueFromError( + ValidationIssueTypeSemantic, + ctx.Field("value").String(), + fmt.Errorf("%w: value starts with argument name '%s': %s", ErrArgumentValueStartsWithName, name, value), + "argument-value-starts-with-name", + ) + result.AddIssue(issue) } if defaultValue != "" && strings.HasPrefix(defaultValue, name) { - return fmt.Errorf("%w: default starts with argument name '%s': %s", ErrArgumentDefaultStartsWithName, name, defaultValue) + issue := NewValidationIssueFromError( + ValidationIssueTypeSemantic, + ctx.Field("default").String(), + fmt.Errorf("%w: default starts with argument name '%s': %s", ErrArgumentDefaultStartsWithName, name, defaultValue), + "argument-default-starts-with-name", + ) + result.AddIssue(issue) } - return nil + return result } // collectAvailableVariables collects all available template variables from a package @@ -378,44 +500,92 @@ func collectRemoteTransportVariables(transport *model.Transport) []string { } // validatePackageTransport validates a package's transport with templating support -func validatePackageTransport(transport *model.Transport, availableVariables []string) error { +func validatePackageTransport(ctx *ValidationContext, transport *model.Transport, availableVariables []string) *ValidationResult { + result := &ValidationResult{Valid: true, Issues: []ValidationIssue{}} + // Validate transport type is supported switch transport.Type { case model.TransportTypeStdio: // Validate that URL is empty for stdio transport if transport.URL != "" { - return fmt.Errorf("url must be empty for %s transport type, got: %s", transport.Type, transport.URL) + issue := NewValidationIssue( + ValidationIssueTypeSemantic, + ctx.Field("url").String(), + fmt.Sprintf("url must be empty for %s transport type, got: %s", transport.Type, transport.URL), + ValidationIssueSeverityError, + "stdio-transport-url-not-empty", + ) + result.AddIssue(issue) } - return nil case model.TransportTypeStreamableHTTP, model.TransportTypeSSE: // URL is required for streamable-http and sse if transport.URL == "" { - return fmt.Errorf("url is required for %s transport type", transport.Type) - } - // Validate URL format with template variable support - if !IsValidTemplatedURL(transport.URL, availableVariables) { + issue := NewValidationIssue( + ValidationIssueTypeSemantic, + ctx.Field("url").String(), + fmt.Sprintf("url is required for %s transport type", transport.Type), + ValidationIssueSeverityError, + "streamable-transport-url-required", + ) + result.AddIssue(issue) + } else if !IsValidTemplatedURL(transport.URL, availableVariables) { // Check if it's a template variable issue or basic URL issue templateVars := extractTemplateVariables(transport.URL) + var err error if len(templateVars) > 0 { - return fmt.Errorf("%w: template variables in URL %s reference undefined variables. Available variables: %v", + err = fmt.Errorf("%w: template variables in URL %s reference undefined variables. Available variables: %v", ErrInvalidPackageTransportURL, transport.URL, availableVariables) + } else { + err = fmt.Errorf("%w: %s", ErrInvalidPackageTransportURL, transport.URL) } - return fmt.Errorf("%w: %s", ErrInvalidPackageTransportURL, transport.URL) + issue := NewValidationIssueFromError( + ValidationIssueTypeSemantic, + ctx.Field("url").String(), + err, + "invalid-templated-url", + ) + result.AddIssue(issue) } - return nil default: - return fmt.Errorf("unsupported transport type: %s", transport.Type) + issue := NewValidationIssue( + ValidationIssueTypeSemantic, + ctx.Field("type").String(), + fmt.Sprintf("unsupported transport type: %s", transport.Type), + ValidationIssueSeverityError, + "unsupported-transport-type", + ) + result.AddIssue(issue) } + + return result } // validateRemoteTransport validates a remote transport with optional templating -func validateRemoteTransport(obj *model.Transport) error { +func validateRemoteTransport(ctx *ValidationContext, obj *model.Transport) *ValidationResult { + result := &ValidationResult{Valid: true, Issues: []ValidationIssue{}} + // Validate transport type is supported - remotes only support streamable-http and sse switch obj.Type { case model.TransportTypeStreamableHTTP, model.TransportTypeSSE: // URL is required for streamable-http and sse if obj.URL == "" { - return fmt.Errorf("url is required for %s transport type", obj.Type) + issue := NewValidationIssue( + ValidationIssueTypeSemantic, + ctx.Field("url").String(), + fmt.Sprintf("url is required for %s transport type", obj.Type), + ValidationIssueSeverityError, + "remote-transport-url-required", + ) + result.AddIssue(issue) + } else if !IsValidRemoteURL(obj.URL) { + // Validate URL format (no templates allowed for remotes, no localhost) + issue := NewValidationIssueFromError( + ValidationIssueTypeSemantic, + ctx.Field("url").String(), + fmt.Errorf("%w: %s", ErrInvalidRemoteURL, obj.URL), + "invalid-remote-url", + ) + result.AddIssue(issue) } // Collect available variables from the transport's Variables field @@ -425,21 +595,34 @@ func validateRemoteTransport(obj *model.Transport) error { if !IsValidTemplatedURL(obj.URL, availableVariables) { // Check if it's a template variable issue or basic URL issue templateVars := extractTemplateVariables(obj.URL) + var err error if len(templateVars) > 0 { - return fmt.Errorf("%w: template variables in URL %s reference undefined variables. Available variables: %v", + err = fmt.Errorf("%w: template variables in URL %s reference undefined variables. Available variables: %v", ErrInvalidRemoteURL, obj.URL, availableVariables) + } else { + err = fmt.Errorf("%w: %s", ErrInvalidRemoteURL, obj.URL) } - return fmt.Errorf("%w: %s", ErrInvalidRemoteURL, obj.URL) + issue := NewValidationIssueFromError( + ValidationIssueTypeSemantic, + ctx.Field("url").String(), + err, + "invalid-templated-url", + ) + result.AddIssue(issue) } - - // Additional check: reject localhost URLs for remotes (like the old IsValidRemoteURL did) - if !IsValidRemoteURL(obj.URL) { - return fmt.Errorf("%w: %s", ErrInvalidRemoteURL, obj.URL) - } - return nil + return result default: - return fmt.Errorf("unsupported transport type for remotes: %s (only streamable-http and sse are supported)", obj.Type) + issue := NewValidationIssue( + ValidationIssueTypeSemantic, + ctx.Field("type").String(), + fmt.Sprintf("unsupported transport type for remotes: %s (only streamable-http and sse are supported)", obj.Type), + ValidationIssueSeverityError, + "unsupported-remote-transport-type", + ) + result.AddIssue(issue) } + + return result } // ValidatePublishRequest validates a complete publish request including extensions @@ -450,22 +633,46 @@ func ValidatePublishRequest(ctx context.Context, req apiv0.ServerJSON, cfg *conf } // Validate the server detail (includes all nested validation) - if err := ValidateServerJSON(&req); err != nil { + result := ValidateServerJSON(&req, ValidationSchemaVersionAndSemantic) + if err := result.FirstError(); err != nil { return err } // Validate registry ownership for all packages if validation is enabled if cfg.EnableRegistryValidation { - for i, pkg := range req.Packages { - if err := ValidatePackage(ctx, pkg, req.Name); err != nil { - return fmt.Errorf("registry validation failed for package %d (%s): %w", i, pkg.Identifier, err) - } + if err := validateRegistryOwnership(ctx, req); err != nil { + return err } } return nil } +func ValidateUpdateRequest(ctx context.Context, req apiv0.ServerJSON, cfg *config.Config, skipRegistryValidation bool) error { + // Validate the server detail (includes all nested validation) + result := ValidateServerJSON(&req, ValidationSchemaVersionAndSemantic) + if err := result.FirstError(); err != nil { + return err + } + + if cfg.EnableRegistryValidation && !skipRegistryValidation { + if err := validateRegistryOwnership(ctx, req); err != nil { + return err + } + } + + return nil +} + +func validateRegistryOwnership(ctx context.Context, req apiv0.ServerJSON) error { + for i, pkg := range req.Packages { + if err := ValidatePackage(ctx, pkg, req.Name); err != nil { + return fmt.Errorf("registry validation failed for package %d (%s): %w", i, pkg.Identifier, err) + } + } + return nil +} + func validatePublisherExtensions(req apiv0.ServerJSON) error { const maxExtensionSize = 4 * 1024 // 4KB limit diff --git a/internal/validators/validators_test.go b/internal/validators/validators_test.go index 7b69587..d4ff5c1 100644 --- a/internal/validators/validators_test.go +++ b/internal/validators/validators_test.go @@ -33,7 +33,7 @@ func TestValidate(t *testing.T) { expectedError: "$schema field is required", }, { - name: "Schema version rejects old schema (2025-01-27)", + name: "Schema version rejects old schema (2025-01-27) - non-existent version", serverDetail: apiv0.ServerJSON{ Schema: "https://static.modelcontextprotocol.io/schemas/2025-01-27/server.schema.json", Name: "com.example/test-server", @@ -44,7 +44,9 @@ func TestValidate(t *testing.T) { }, Version: "1.0.0", }, - expectedError: "schema version https://static.modelcontextprotocol.io/schemas/2025-01-27/server.schema.json is not supported", + // This schema version doesn't exist in embedded schemas, so validation should fail + // ValidateServerJSON with ValidationSchemaVersionAndSemantic validates that the schema version exists + expectedError: "schema version 2025-01-27 not found in embedded schemas", }, { name: "Schema version accepts current schema (2025-10-17)", @@ -750,7 +752,10 @@ func TestValidate(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { - err := validators.ValidateServerJSON(&tt.serverDetail) + // ValidateServerJSON returns all validation results; using FirstError() to preserve existing test behavior + // In future, consider using result.Issues for comprehensive error reporting + result := validators.ValidateServerJSON(&tt.serverDetail, validators.ValidationSchemaVersionAndSemantic) + err := result.FirstError() if tt.expectedError == "" { assert.NoError(t, err) @@ -905,7 +910,10 @@ func TestValidate_RemoteNamespaceMatch(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { - err := validators.ValidateServerJSON(&tt.serverDetail) + // ValidateServerJSON returns all validation results; using FirstError() to preserve existing test behavior + // In future, consider using result.Issues for comprehensive error reporting + result := validators.ValidateServerJSON(&tt.serverDetail, validators.ValidationSchemaVersionAndSemantic) + err := result.FirstError() if tt.expectError { assert.Error(t, err) @@ -989,7 +997,10 @@ func TestValidate_ServerNameFormat(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { - err := validators.ValidateServerJSON(&tt.serverDetail) + // ValidateServerJSON returns all validation results; using FirstError() to preserve existing test behavior + // In future, consider using result.Issues for comprehensive error reporting + result := validators.ValidateServerJSON(&tt.serverDetail, validators.ValidationSchemaVersionAndSemantic) + err := result.FirstError() if tt.expectError { assert.Error(t, err) @@ -1068,7 +1079,10 @@ func TestValidate_MultipleSlashesInServerName(t *testing.T) { Schema: model.CurrentSchemaURL, Name: tt.serverName, } - err := validators.ValidateServerJSON(&serverDetail) + // ValidateServerJSON returns all validation results; using FirstError() to preserve existing test behavior + // In future, consider using result.Issues for comprehensive error reporting + result := validators.ValidateServerJSON(&serverDetail, validators.ValidationSchemaVersionAndSemantic) + err := result.FirstError() if tt.expectError { assert.Error(t, err) @@ -1122,7 +1136,10 @@ func TestValidateArgument_ValidNamedArguments(t *testing.T) { for _, arg := range validCases { t.Run("Valid_"+arg.Name, func(t *testing.T) { server := createValidServerWithArgument(arg) - err := validators.ValidateServerJSON(&server) + // ValidateServerJSON returns all validation results; using FirstError() to preserve existing test behavior + // In future, consider using result.Issues for comprehensive error reporting + result := validators.ValidateServerJSON(&server, validators.ValidationSchemaVersionAndSemantic) + err := result.FirstError() assert.NoError(t, err, "Expected valid argument %+v", arg) }) } @@ -1141,7 +1158,10 @@ func TestValidateArgument_ValidPositionalArguments(t *testing.T) { for i, arg := range positionalCases { t.Run(fmt.Sprintf("ValidPositional_%d", i), func(t *testing.T) { server := createValidServerWithArgument(arg) - err := validators.ValidateServerJSON(&server) + // ValidateServerJSON returns all validation results; using FirstError() to preserve existing test behavior + // In future, consider using result.Issues for comprehensive error reporting + result := validators.ValidateServerJSON(&server, validators.ValidationSchemaVersionAndSemantic) + err := result.FirstError() assert.NoError(t, err, "Expected valid positional argument %+v", arg) }) } @@ -1163,7 +1183,10 @@ func TestValidateArgument_InvalidNamedArgumentNames(t *testing.T) { for _, tc := range invalidNameCases { t.Run("Invalid_"+tc.name, func(t *testing.T) { server := createValidServerWithArgument(tc.arg) - err := validators.ValidateServerJSON(&server) + // ValidateServerJSON returns all validation results; using FirstError() to preserve existing test behavior + // In future, consider using result.Issues for comprehensive error reporting + result := validators.ValidateServerJSON(&server, validators.ValidationSchemaVersionAndSemantic) + err := result.FirstError() assert.Error(t, err, "Expected error for invalid named argument name: %+v", tc.arg) }) } @@ -1211,7 +1234,10 @@ func TestValidateArgument_InvalidValueFields(t *testing.T) { for _, tc := range invalidValueCases { t.Run("Invalid_"+tc.name, func(t *testing.T) { server := createValidServerWithArgument(tc.arg) - err := validators.ValidateServerJSON(&server) + // ValidateServerJSON returns all validation results; using FirstError() to preserve existing test behavior + // In future, consider using result.Issues for comprehensive error reporting + result := validators.ValidateServerJSON(&server, validators.ValidationSchemaVersionAndSemantic) + err := result.FirstError() assert.Error(t, err, "Expected error for argument with value starting with name: %+v", tc.arg) }) } @@ -1267,7 +1293,10 @@ func TestValidateArgument_ValidValueFields(t *testing.T) { for _, tc := range validValueCases { t.Run("Valid_"+tc.name, func(t *testing.T) { server := createValidServerWithArgument(tc.arg) - err := validators.ValidateServerJSON(&server) + // ValidateServerJSON returns all validation results; using FirstError() to preserve existing test behavior + // In future, consider using result.Issues for comprehensive error reporting + result := validators.ValidateServerJSON(&server, validators.ValidationSchemaVersionAndSemantic) + err := result.FirstError() assert.NoError(t, err, "Expected valid argument %+v", tc.arg) }) } @@ -1734,7 +1763,10 @@ func TestValidate_TransportValidation(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { - err := validators.ValidateServerJSON(&tt.serverDetail) + // ValidateServerJSON returns all validation results; using FirstError() to preserve existing test behavior + // In future, consider using result.Issues for comprehensive error reporting + result := validators.ValidateServerJSON(&tt.serverDetail, validators.ValidationSchemaVersionAndSemantic) + err := result.FirstError() if tt.expectedError == "" { assert.NoError(t, err) @@ -2163,7 +2195,10 @@ func TestValidateTitle(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { - err := validators.ValidateServerJSON(&tt.serverDetail) + // ValidateServerJSON returns all validation results; using FirstError() to preserve existing test behavior + // In future, consider using result.Issues for comprehensive error reporting + result := validators.ValidateServerJSON(&tt.serverDetail, validators.ValidationSchemaVersionAndSemantic) + err := result.FirstError() if tt.expectedError == "" { assert.NoError(t, err) } else { diff --git a/tools/validate-examples/main.go b/tools/validate-examples/main.go index 2e021a6..46823d4 100644 --- a/tools/validate-examples/main.go +++ b/tools/validate-examples/main.go @@ -168,7 +168,10 @@ func validateWithObjectValidator(serverData any) bool { return false } - if err := validators.ValidateServerJSON(&serverDetail); err != nil { + // ValidateServerJSON returns all validation results; using FirstError() to preserve existing behavior + // In future, consider displaying all issues from result.Issues for comprehensive feedback + result := validators.ValidateServerJSON(&serverDetail, validators.ValidationSchemaVersionAndSemantic) + if err := result.FirstError(); err != nil { log.Printf(" Validating with Go Validator: ❌") log.Printf(" Error: %v", err) return false From 0af9ee03b93932b68220e181cbba66dd26522c84 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 20 Jan 2026 17:05:15 +0200 Subject: [PATCH 080/313] build(deps): bump github.com/danielgtaylor/huma/v2 from 2.34.1 to 2.35.0 (#905) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [github.com/danielgtaylor/huma/v2](https://github.com/danielgtaylor/huma) from 2.34.1 to 2.35.0.
Release notes

Sourced from github.com/danielgtaylor/huma/v2's releases.

v2.35.0

Overview

Moved this release as it was incorrectly tagged as v2.34.3.

Improved Error Messaging for Form Pointers

Pointer panic messages now explicitly include “Form” where applicable, making debugging clearer and resolving #892.

Expanded String Format Support

Added support for duration and idn-hostname string formats, improving schema expressiveness and validation coverage.

Header Parsing Fix

Fixed several subtle issues in header detection that occurred when output fields were slices, arrays, or maps, which could cause headers (notably []*http.Cookie) to be incorrectly applied or documented. The parsing logic now correctly inspects the root type of collection fields and adds support for hidden headers, allowing them to be excluded from generated OpenAPI documentation. These changes resolve multiple long-standing documentation and serialization bugs without introducing new behavior.

What's Changed

New Contributors

Full Changelog: https://github.com/danielgtaylor/huma/compare/v2.34.2...v2.34.3

v2.34.2

Overview

TLS-Aware URL Scheme Detection

Huma now correctly uses the https URL scheme when TLS is configured, and http when it is not. Previously, the scheme detection could be incorrect in certain scenarios.

Time Wrapper Parsing Fix

Fixed an issue where time wrapper types failed to parse correctly, resolving #844.

What's Changed

New Contributors

... (truncated)

Commits
  • c24cd07 Added wrappers for the remaining error codes defined in the standard library....
  • b4a4ec8 perf(schema): optimize convertType with fast paths for compatible types (#931)
  • 88c6cda Fix Header Parsing (#944)
  • 0814e6f Simple HTML docs (#941)
  • 1cd5c26 Support Duration and IDN-Hostname String Formats (#939)
  • e78584e Include form in pointer panic message (#938)
  • 0279842 Minor linting/formatting (#936)
  • f30901c fix: failed to parse time wrapper, close #844 (#924)
  • 57b3625 fix: use "http" URL scheme only if no TLS is used (#905)
  • 1f43b55 Merge pull request #927 from prnvbn/patch-1
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/danielgtaylor/huma/v2&package-manager=go_modules&previous-version=2.34.1&new-version=2.35.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 24f49c1..65a9018 100644 --- a/go.mod +++ b/go.mod @@ -8,7 +8,7 @@ require ( github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.4.0 github.com/caarlos0/env/v11 v11.3.1 github.com/coreos/go-oidc/v3 v3.17.0 - github.com/danielgtaylor/huma/v2 v2.34.1 + github.com/danielgtaylor/huma/v2 v2.35.0 github.com/golang-jwt/jwt/v5 v5.3.0 github.com/google/go-containerregistry v0.20.7 github.com/jackc/pgx/v5 v5.8.0 diff --git a/go.sum b/go.sum index dce69ba..9b02ed2 100644 --- a/go.sum +++ b/go.sum @@ -38,8 +38,8 @@ github.com/containerd/stargz-snapshotter/estargz v0.18.1 h1:cy2/lpgBXDA3cDKSyEfN github.com/containerd/stargz-snapshotter/estargz v0.18.1/go.mod h1:ALIEqa7B6oVDsrF37GkGN20SuvG/pIMm7FwP7ZmRb0Q= github.com/coreos/go-oidc/v3 v3.17.0 h1:hWBGaQfbi0iVviX4ibC7bk8OKT5qNr4klBaCHVNvehc= github.com/coreos/go-oidc/v3 v3.17.0/go.mod h1:wqPbKFrVnE90vty060SB40FCJ8fTHTxSwyXJqZH+sI8= -github.com/danielgtaylor/huma/v2 v2.34.1 h1:EmOJAbzEGfy0wAq/QMQ1YKfEMBEfE94xdBRLPBP0gwQ= -github.com/danielgtaylor/huma/v2 v2.34.1/go.mod h1:ynwJgLk8iGVgoaipi5tgwIQ5yoFNmiu+QdhU7CEEmhk= +github.com/danielgtaylor/huma/v2 v2.35.0 h1:FRg3FgVKcMogVhbNY7FjyTwk+p/orLBR3hQBvXXg7dw= +github.com/danielgtaylor/huma/v2 v2.35.0/go.mod h1:3elp5brzdyyZsPlDVvf6w8RLnklKp3abolr+5op3fP0= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= From e28c64dbe91ae402c1501e4efddf7ee61bc32739 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 20 Jan 2026 17:11:26 +0200 Subject: [PATCH 081/313] build(deps): bump github.com/pulumi/pulumi-kubernetes/sdk/v4 from 4.24.1 to 4.25.0 in /deploy (#899) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [github.com/pulumi/pulumi-kubernetes/sdk/v4](https://github.com/pulumi/pulumi-kubernetes) from 4.24.1 to 4.25.0.
Release notes

Sourced from github.com/pulumi/pulumi-kubernetes/sdk/v4's releases.

v4.25.0

No release notes provided.

Commits
  • f47bc2d Upgrade runners and reduce parallelism for publish jobs (#4073)
  • 890c66d Fix a race in condition.Deleted (#4079)
  • a6affb2 Re-generate workflows to use larger publish runner (#4069)
  • 7bd527a Update GitHub Actions workflows. (#4071)
  • 3fb75f0 Update module github.com/pulumi/pulumi/pkg/v3 to v3.215.0 (#4064)
  • 7bb5e5f Update dependency @​pulumi/pulumi to v3.215.0 (#4062)
  • 04466f6 Update dependency @​pulumi/gcp to v9.9.0 (#4061)
  • d512bb3 Update first-party Pulumi dependencies (#4058)
  • bc12e8a Allow for yaml render mode to not need a working cluster (#4053)
  • fd2b317 Update first-party Pulumi dependencies (#4027)
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/pulumi/pulumi-kubernetes/sdk/v4&package-manager=go_modules&previous-version=4.24.1&new-version=4.25.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- deploy/go.mod | 2 +- deploy/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index 50c19a6..c7ff55f 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -4,7 +4,7 @@ go 1.24.11 require ( github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 - github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.24.1 + github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.25.0 github.com/pulumi/pulumi/sdk/v3 v3.215.0 gopkg.in/yaml.v2 v2.4.0 ) diff --git a/deploy/go.sum b/deploy/go.sum index 7346152..ccfc78c 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -156,8 +156,8 @@ github.com/pulumi/esc v0.17.0 h1:oaVOIyFTENlYDuqc3pW75lQT9jb2cd6ie/4/Twxn66w= github.com/pulumi/esc v0.17.0/go.mod h1:XnSxlt5NkmuAj304l/gK4pRErFbtqq6XpfX1tYT9Jbc= github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 h1:w6OnO3d4j5yVf2vpm8OzXFC/xHOEGqt+9FjWCUBCq6U= github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1/go.mod h1:UyZyv7hz4knpFx6/Sh+SkZe6hT6sJHtDvw9A0TbvEsk= -github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.24.1 h1:L1J2/PHgAziDXUvOWJ4HH1JBlgxzpQseZiEIu4K2x34= -github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.24.1/go.mod h1:vNiMC/N8GNHvDwU3gQRXQ6V+kbgSl5N/lKtfrUjGuXU= +github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.25.0 h1:N1qitmrGomEaCPsblqJHaw8Re0cqqox5V+kHsi4EEtk= +github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.25.0/go.mod h1:ACBJF6+nzUqDeRK+p2OrvykunyeHfvtbyELc6PB38fk= github.com/pulumi/pulumi/sdk/v3 v3.215.0 h1:XZMiv9aSE1pD3kW4JpA53cy7mFflbJYn1fFKH1NMIAY= github.com/pulumi/pulumi/sdk/v3 v3.215.0/go.mod h1:Bn5Z9Rzp1lPqdAccaB+F2ivUBiamEl2TNR3Gg/h7iLs= github.com/rivo/uniseg v0.1.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc= From 8ef8df84331ccdd58bbceeb5f9454b77ec6b26dc Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 20 Jan 2026 17:12:32 +0200 Subject: [PATCH 082/313] build(deps): bump cloud.google.com/go/kms from 1.23.2 to 1.24.0 (#891) Bumps [cloud.google.com/go/kms](https://github.com/googleapis/google-cloud-go) from 1.23.2 to 1.24.0.
Release notes

Sourced from cloud.google.com/go/kms's releases.

maps 1.24.0

1.24.0 (2025-10-10)

Features

Bug Fixes

  • upgrade gRPC service registration func (#13014) (PiperOrigin-RevId: 813834114) (b80fb13)

cloudbuild 1.24.0

1.24.0 (2025-12-04)

Features

  • Update GCB with latest proto changes (PiperOrigin-RevId: 837135318) (185951b3)

kms 1.24.0

1.24.0 (2026-01-15)

Documentation

  • Marking MODIFIED_CUSTOMER_INITIATED_ACCESS and MODIFIED_GOOGLE_INITIATED_SYSTEM_OPERATION Key Access Justification codes as deprecated in favor of GOOGLE_RESPONSE_TO_PRODUCTION_ALERT (PiperOrigin-RevId: 853754070) (80379edb)
Changelog

Sourced from cloud.google.com/go/kms's changelog.

1.24.0 (2024-02-06)

Features

  • documentai: Add model_type in v1beta3 processor proto (#9355) (05e9e1f)

1.23.8 (2024-01-30)

Bug Fixes

  • documentai: Enable universe domain resolution options (fd1d569)

1.23.7 (2023-12-13)

Documentation

  • documentai: Clarify Properties documentation (757c1b0)

1.23.6 (2023-11-27)

Documentation

  • documentai: Update comment for ProcessOptions.page_range (63ffff2)

1.23.5 (2023-11-01)

Bug Fixes

  • documentai: Bump google.golang.org/api to v0.149.0 (8d2ab9f)

Documentation

  • documentai: Updated comments (24e410e)

1.23.4 (2023-10-26)

Bug Fixes

  • documentai: Update grpc-go to v1.59.0 (81a97b0)

1.23.3 (2023-10-17)

... (truncated)

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=cloud.google.com/go/kms&package-manager=go_modules&previous-version=1.23.2&new-version=1.24.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 24 ++++++++++++------------ go.sum | 59 ++++++++++++++++++++++++++++++++++------------------------ 2 files changed, 47 insertions(+), 36 deletions(-) diff --git a/go.mod b/go.mod index 65a9018..28f0dfb 100644 --- a/go.mod +++ b/go.mod @@ -3,7 +3,7 @@ module github.com/modelcontextprotocol/registry go 1.24.11 require ( - cloud.google.com/go/kms v1.23.2 + cloud.google.com/go/kms v1.24.0 github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.4.0 github.com/caarlos0/env/v11 v11.3.1 @@ -27,12 +27,12 @@ require ( ) require ( - cloud.google.com/go v0.120.0 // indirect - cloud.google.com/go/auth v0.16.4 // indirect + cloud.google.com/go v0.121.6 // indirect + cloud.google.com/go/auth v0.17.0 // indirect cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect - cloud.google.com/go/compute/metadata v0.8.0 // indirect - cloud.google.com/go/iam v1.5.2 // indirect - cloud.google.com/go/longrunning v0.6.7 // indirect + cloud.google.com/go/compute/metadata v0.9.0 // indirect + cloud.google.com/go/iam v1.5.3 // indirect + cloud.google.com/go/longrunning v0.7.0 // indirect github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0 // indirect github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 // indirect github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0 // indirect @@ -50,7 +50,7 @@ require ( github.com/go-logr/stdr v1.2.2 // indirect github.com/google/s2a-go v0.1.9 // indirect github.com/google/uuid v1.6.0 // indirect - github.com/googleapis/enterprise-certificate-proxy v0.3.6 // indirect + github.com/googleapis/enterprise-certificate-proxy v0.3.7 // indirect github.com/googleapis/gax-go/v2 v2.15.0 // indirect github.com/jackc/pgpassfile v1.0.0 // indirect github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect @@ -80,11 +80,11 @@ require ( golang.org/x/sync v0.18.0 // indirect golang.org/x/sys v0.39.0 // indirect golang.org/x/text v0.31.0 // indirect - golang.org/x/time v0.12.0 // indirect - google.golang.org/api v0.247.0 // indirect + golang.org/x/time v0.14.0 // indirect + google.golang.org/api v0.256.0 // indirect google.golang.org/genproto v0.0.0-20250603155806-513f23925822 // indirect - google.golang.org/genproto/googleapis/api v0.0.0-20250818200422-3122310a409c // indirect - google.golang.org/genproto/googleapis/rpc v0.0.0-20250811230008-5f3141c8851a // indirect - google.golang.org/grpc v1.74.2 // indirect + google.golang.org/genproto/googleapis/api v0.0.0-20251111163417-95abcf5c77ba // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20251103181224-f26f9409b101 // indirect + google.golang.org/grpc v1.76.0 // indirect google.golang.org/protobuf v1.36.10 // indirect ) diff --git a/go.sum b/go.sum index 9b02ed2..0184033 100644 --- a/go.sum +++ b/go.sum @@ -1,17 +1,17 @@ -cloud.google.com/go v0.120.0 h1:wc6bgG9DHyKqF5/vQvX1CiZrtHnxJjBlKUyF9nP6meA= -cloud.google.com/go v0.120.0/go.mod h1:/beW32s8/pGRuj4IILWQNd4uuebeT4dkOhKmkfit64Q= -cloud.google.com/go/auth v0.16.4 h1:fXOAIQmkApVvcIn7Pc2+5J8QTMVbUGLscnSVNl11su8= -cloud.google.com/go/auth v0.16.4/go.mod h1:j10ncYwjX/g3cdX7GpEzsdM+d+ZNsXAbb6qXA7p1Y5M= +cloud.google.com/go v0.121.6 h1:waZiuajrI28iAf40cWgycWNgaXPO06dupuS+sgibK6c= +cloud.google.com/go v0.121.6/go.mod h1:coChdst4Ea5vUpiALcYKXEpR1S9ZgXbhEzzMcMR66vI= +cloud.google.com/go/auth v0.17.0 h1:74yCm7hCj2rUyyAocqnFzsAYXgJhrG26XCFimrc/Kz4= +cloud.google.com/go/auth v0.17.0/go.mod h1:6wv/t5/6rOPAX4fJiRjKkJCvswLwdet7G8+UGXt7nCQ= cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc= cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c= -cloud.google.com/go/compute/metadata v0.8.0 h1:HxMRIbao8w17ZX6wBnjhcDkW6lTFpgcaobyVfZWqRLA= -cloud.google.com/go/compute/metadata v0.8.0/go.mod h1:sYOGTp851OV9bOFJ9CH7elVvyzopvWQFNNghtDQ/Biw= -cloud.google.com/go/iam v1.5.2 h1:qgFRAGEmd8z6dJ/qyEchAuL9jpswyODjA2lS+w234g8= -cloud.google.com/go/iam v1.5.2/go.mod h1:SE1vg0N81zQqLzQEwxL2WI6yhetBdbNQuTvIKCSkUHE= -cloud.google.com/go/kms v1.23.2 h1:4IYDQL5hG4L+HzJBhzejUySoUOheh3Lk5YT4PCyyW6k= -cloud.google.com/go/kms v1.23.2/go.mod h1:rZ5kK0I7Kn9W4erhYVoIRPtpizjunlrfU4fUkumUp8g= -cloud.google.com/go/longrunning v0.6.7 h1:IGtfDWHhQCgCjwQjV9iiLnUta9LBCo8R9QmAFsS/PrE= -cloud.google.com/go/longrunning v0.6.7/go.mod h1:EAFV3IZAKmM56TyiE6VAP3VoTzhZzySwI/YI1s/nRsY= +cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs= +cloud.google.com/go/compute/metadata v0.9.0/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10= +cloud.google.com/go/iam v1.5.3 h1:+vMINPiDF2ognBJ97ABAYYwRgsaqxPbQDlMnbHMjolc= +cloud.google.com/go/iam v1.5.3/go.mod h1:MR3v9oLkZCTlaqljW6Eb2d3HGDGK5/bDv93jhfISFvU= +cloud.google.com/go/kms v1.24.0 h1:SWltUuoPhTdv9q/P0YEAWQfoYT32O5HdfPgTiWMvrH8= +cloud.google.com/go/kms v1.24.0/go.mod h1:QDH3z2SJ50lfNOE8EokKC1G40i7I0f8xTMCoiptcb5g= +cloud.google.com/go/longrunning v0.7.0 h1:FV0+SYF1RIj59gyoWDRi45GiYUMM3K1qO51qoboQT1E= +cloud.google.com/go/longrunning v0.7.0/go.mod h1:ySn2yXmjbK9Ba0zsQqunhDkYi0+9rlXIwnoAf+h+TPY= github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0 h1:JXg2dwJUmPB9JmtVmdEB16APJ7jurfbY5jnfXpJoRMc= github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0/go.mod h1:YD5h/ldMsG0XiIw7PdyNhLxaM317eFh5yNLccNfGdyw= github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 h1:Hk5QBxZQC1jb2Fwj6mpzme37xbCDdNTxU7O9eb5+LB4= @@ -34,6 +34,8 @@ github.com/caarlos0/env/v11 v11.3.1 h1:cArPWC15hWmEt+gWk7YBi7lEXTXCvpaSdCiZE2X5m github.com/caarlos0/env/v11 v11.3.1/go.mod h1:qupehSf/Y0TUTsxKywqRt/vJjN5nz6vauiYEUUr8P4U= github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs= github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= +github.com/cncf/xds/go v0.0.0-20250501225837-2ac532fd4443 h1:aQ3y1lwWyqYPiWZThqv1aFbZMiM9vblcSArJRf2Irls= +github.com/cncf/xds/go v0.0.0-20250501225837-2ac532fd4443/go.mod h1:W+zGtBO5Y1IgJhy4+A9GOqVhqLpfZi+vwmdNXUehLA8= github.com/containerd/stargz-snapshotter/estargz v0.18.1 h1:cy2/lpgBXDA3cDKSyEfNOFMA/c10O1axL69EU7iirO8= github.com/containerd/stargz-snapshotter/estargz v0.18.1/go.mod h1:ALIEqa7B6oVDsrF37GkGN20SuvG/pIMm7FwP7ZmRb0Q= github.com/coreos/go-oidc/v3 v3.17.0 h1:hWBGaQfbi0iVviX4ibC7bk8OKT5qNr4klBaCHVNvehc= @@ -49,6 +51,11 @@ github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBi github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w= github.com/docker/docker-credential-helpers v0.9.3 h1:gAm/VtF9wgqJMoxzT3Gj5p4AqIjCBS4wrsOh9yRqcz8= github.com/docker/docker-credential-helpers v0.9.3/go.mod h1:x+4Gbw9aGmChi3qTLZj8Dfn0TD20M/fuWy0E5+WDeCo= +github.com/envoyproxy/go-control-plane v0.13.4 h1:zEqyPVyku6IvWCFwux4x9RxkLOMUL+1vC9xUFv5l2/M= +github.com/envoyproxy/go-control-plane/envoy v1.32.4 h1:jb83lalDRZSpPWW2Z7Mck/8kXZ5CQAFYVjQcdVIr83A= +github.com/envoyproxy/go-control-plane/envoy v1.32.4/go.mod h1:Gzjc5k8JcJswLjAx1Zm+wSYE20UrLtt7JZMWiWQXQEw= +github.com/envoyproxy/protoc-gen-validate v1.2.1 h1:DEo3O99U8j4hBFwbJfrz9VtgcDfUKS7KJ7spH3d86P8= +github.com/envoyproxy/protoc-gen-validate v1.2.1/go.mod h1:d/C80l/jxXLdfEIhX1W2TmLfsJ31lvEjwamM4DxlWXU= github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg= github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U= github.com/go-jose/go-jose/v4 v4.1.3 h1:CVLmWDhDVRa6Mi/IgCgaopNosCaHz7zrMeF9MlZRkrs= @@ -70,8 +77,8 @@ github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0= github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= -github.com/googleapis/enterprise-certificate-proxy v0.3.6 h1:GW/XbdyBFQ8Qe+YAmFU9uHLo7OnF5tL52HFAgMmyrf4= -github.com/googleapis/enterprise-certificate-proxy v0.3.6/go.mod h1:MkHOF77EYAE7qfSuSS9PU6g4Nt4e11cnsDUowfwewLA= +github.com/googleapis/enterprise-certificate-proxy v0.3.7 h1:zrn2Ee/nWmHulBx5sAVrGgAa0f2/R35S4DJwfFaUPFQ= +github.com/googleapis/enterprise-certificate-proxy v0.3.7/go.mod h1:MkHOF77EYAE7qfSuSS9PU6g4Nt4e11cnsDUowfwewLA= github.com/googleapis/gax-go/v2 v2.15.0 h1:SyjDc1mGgZU5LncH8gimWo9lW1DtIfPibOG81vgd/bo= github.com/googleapis/gax-go/v2 v2.15.0/go.mod h1:zVVkkxAQHa1RQpg9z2AUCMnKhi0Qld9rcmyfL1OZhoc= github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM= @@ -104,6 +111,8 @@ github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmd github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c/go.mod h1:7rwL4CYBLnjLxUqIJNnCWiEdr3bn6IUYi15bNlnbCCU= github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4= github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= +github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 h1:GFCKgmp0tecUJ0sJuv4pzYCqS9+RGSn52M3FUwPs+uo= +github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10/go.mod h1:t/avpk3KcrXxUnYOhZhMXJlSEyie6gQbtLq5NM3loB8= github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o= @@ -171,18 +180,20 @@ golang.org/x/sys v0.39.0 h1:CvCKL8MeisomCi6qNZ+wbb0DN9E5AATixKsvNtMoMFk= golang.org/x/sys v0.39.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= golang.org/x/text v0.31.0 h1:aC8ghyu4JhP8VojJ2lEHBnochRno1sgL6nEi9WGFGMM= golang.org/x/text v0.31.0/go.mod h1:tKRAlv61yKIjGGHX/4tP1LTbc13YSec1pxVEWXzfoeM= -golang.org/x/time v0.12.0 h1:ScB/8o8olJvc+CQPWrK3fPZNfh7qgwCrY0zJmoEQLSE= -golang.org/x/time v0.12.0/go.mod h1:CDIdPxbZBQxdj6cxyCIdrNogrJKMJ7pr37NYpMcMDSg= -google.golang.org/api v0.247.0 h1:tSd/e0QrUlLsrwMKmkbQhYVa109qIintOls2Wh6bngc= -google.golang.org/api v0.247.0/go.mod h1:r1qZOPmxXffXg6xS5uhx16Fa/UFY8QU/K4bfKrnvovM= +golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI= +golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4= +gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk= +gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E= +google.golang.org/api v0.256.0 h1:u6Khm8+F9sxbCTYNoBHg6/Hwv0N/i+V94MvkOSor6oI= +google.golang.org/api v0.256.0/go.mod h1:KIgPhksXADEKJlnEoRa9qAII4rXcy40vfI8HRqcU964= google.golang.org/genproto v0.0.0-20250603155806-513f23925822 h1:rHWScKit0gvAPuOnu87KpaYtjK5zBMLcULh7gxkCXu4= google.golang.org/genproto v0.0.0-20250603155806-513f23925822/go.mod h1:HubltRL7rMh0LfnQPkMH4NPDFEWp0jw3vixw7jEM53s= -google.golang.org/genproto/googleapis/api v0.0.0-20250818200422-3122310a409c h1:AtEkQdl5b6zsybXcbz00j1LwNodDuH6hVifIaNqk7NQ= -google.golang.org/genproto/googleapis/api v0.0.0-20250818200422-3122310a409c/go.mod h1:ea2MjsO70ssTfCjiwHgI0ZFqcw45Ksuk2ckf9G468GA= -google.golang.org/genproto/googleapis/rpc v0.0.0-20250811230008-5f3141c8851a h1:tPE/Kp+x9dMSwUm/uM0JKK0IfdiJkwAbSMSeZBXXJXc= -google.golang.org/genproto/googleapis/rpc v0.0.0-20250811230008-5f3141c8851a/go.mod h1:gw1tLEfykwDz2ET4a12jcXt4couGAm7IwsVaTy0Sflo= -google.golang.org/grpc v1.74.2 h1:WoosgB65DlWVC9FqI82dGsZhWFNBSLjQ84bjROOpMu4= -google.golang.org/grpc v1.74.2/go.mod h1:CtQ+BGjaAIXHs/5YS3i473GqwBBa1zGQNevxdeBEXrM= +google.golang.org/genproto/googleapis/api v0.0.0-20251111163417-95abcf5c77ba h1:B14OtaXuMaCQsl2deSvNkyPKIzq3BjfxQp8d00QyWx4= +google.golang.org/genproto/googleapis/api v0.0.0-20251111163417-95abcf5c77ba/go.mod h1:G5IanEx8/PgI9w6CFcYQf7jMtHQhZruvfM1i3qOqk5U= +google.golang.org/genproto/googleapis/rpc v0.0.0-20251103181224-f26f9409b101 h1:tRPGkdGHuewF4UisLzzHHr1spKw92qLM98nIzxbC0wY= +google.golang.org/genproto/googleapis/rpc v0.0.0-20251103181224-f26f9409b101/go.mod h1:7i2o+ce6H/6BluujYR+kqX3GKH+dChPTQU19wjRPiGk= +google.golang.org/grpc v1.76.0 h1:UnVkv1+uMLYXoIz6o7chp59WfQUYA2ex/BXQ9rHZu7A= +google.golang.org/grpc v1.76.0/go.mod h1:Ju12QI8M6iQJtbcsV+awF5a4hfJMLi4X0JLo94ULZ6c= google.golang.org/protobuf v1.36.10 h1:AYd7cD/uASjIL6Q9LiTjz8JLcrh/88q5UObnmY3aOOE= google.golang.org/protobuf v1.36.10/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= From 8fe8725235bec8d42bfd82b2d043d6d2887c0a18 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 20 Jan 2026 17:12:51 +0200 Subject: [PATCH 083/313] build(deps): bump actions/checkout from 4 to 6 in the actions group (#892) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps the actions group with 1 update: [actions/checkout](https://github.com/actions/checkout). Updates `actions/checkout` from 4 to 6
Release notes

Sourced from actions/checkout's releases.

v6.0.0

What's Changed

Full Changelog: https://github.com/actions/checkout/compare/v5.0.0...v6.0.0

v6-beta

What's Changed

Updated persist-credentials to store the credentials under $RUNNER_TEMP instead of directly in the local git config.

This requires a minimum Actions Runner version of v2.329.0 to access the persisted credentials for Docker container action scenarios.

v5.0.1

What's Changed

Full Changelog: https://github.com/actions/checkout/compare/v5...v5.0.1

v5.0.0

What's Changed

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

Full Changelog: https://github.com/actions/checkout/compare/v4...v5.0.0

v4.3.1

What's Changed

Full Changelog: https://github.com/actions/checkout/compare/v4...v4.3.1

v4.3.0

What's Changed

... (truncated)

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/checkout&package-manager=github_actions&previous-version=4&new-version=6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/sync-schema.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/sync-schema.yml b/.github/workflows/sync-schema.yml index 6777034..a59583b 100644 --- a/.github/workflows/sync-schema.yml +++ b/.github/workflows/sync-schema.yml @@ -15,10 +15,10 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v6 - name: Checkout static repo - uses: actions/checkout@v4 + uses: actions/checkout@v6 with: repository: modelcontextprotocol/static path: static-repo From 1e8594e6e0cdb178608b78818f141f394786eb1f Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 20 Jan 2026 17:18:23 +0200 Subject: [PATCH 084/313] build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.215.0 to 3.216.0 in /deploy (#898) Bumps [github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from 3.215.0 to 3.216.0.
Release notes

Sourced from github.com/pulumi/pulumi/sdk/v3's releases.

v3.216.0

3.216.0 (2026-01-16)

Features

  • [build] Don't set PULUMI_ROOT with mise #21457

  • [cli] Default to Pulumi Cloud when using an OIDC token for login #21322

  • [engine] Add CheckPulumiVersion RPC to the engine #21429

  • [protobuf] Remove ProviderHandshakeResponse.pulumi_version_range #21438

  • [sdk/nodejs] Allow dynamic providers to return inputs from read() for accurate diffs after refresh #21315

  • [sdk/nodejs] Add support for serializing async generators #21410

  • [sdk/python] Allow dynamic providers to return inputs from read() for accurate diffs after refresh #21315

Bug Fixes

  • [engine] Optimize StackReference performance #21446

  • [cli/display] Fix message renderer on windows #21401

  • [sdk/nodejs] Fix RangeError in defaultErrorMessage when error objects are large #21409

Miscellaneous

  • [sdk/dotnet] Update dotnet to v3.97.0
Changelog

Sourced from github.com/pulumi/pulumi/sdk/v3's changelog.

3.216.0 (2026-01-16)

Features

  • [build] Don't set PULUMI_ROOT with mise #21457

  • [cli] Default to Pulumi Cloud when using an OIDC token for login #21322

  • [engine] Add CheckPulumiVersion RPC to the engine #21429

  • [protobuf] Remove ProviderHandshakeResponse.pulumi_version_range #21438

  • [sdk/nodejs] Allow dynamic providers to return inputs from read() for accurate diffs after refresh #21315

  • [sdk/nodejs] Add support for serializing async generators #21410

  • [sdk/python] Allow dynamic providers to return inputs from read() for accurate diffs after refresh #21315

Bug Fixes

  • [engine] Optimize StackReference performance #21446

  • [cli/display] Fix message renderer on windows #21401

  • [sdk/nodejs] Fix RangeError in defaultErrorMessage when error objects are large #21409

Miscellaneous

  • [sdk/dotnet] Update dotnet to v3.97.0
Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/pulumi/pulumi/sdk/v3&package-manager=go_modules&previous-version=3.215.0&new-version=3.216.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- deploy/go.mod | 2 +- deploy/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index c7ff55f..21f6c4c 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -5,7 +5,7 @@ go 1.24.11 require ( github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.25.0 - github.com/pulumi/pulumi/sdk/v3 v3.215.0 + github.com/pulumi/pulumi/sdk/v3 v3.216.0 gopkg.in/yaml.v2 v2.4.0 ) diff --git a/deploy/go.sum b/deploy/go.sum index ccfc78c..fca0086 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -158,8 +158,8 @@ github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 h1:w6OnO3d4j5yVf2vpm8OzXFC/xHOEGqt+9 github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1/go.mod h1:UyZyv7hz4knpFx6/Sh+SkZe6hT6sJHtDvw9A0TbvEsk= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.25.0 h1:N1qitmrGomEaCPsblqJHaw8Re0cqqox5V+kHsi4EEtk= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.25.0/go.mod h1:ACBJF6+nzUqDeRK+p2OrvykunyeHfvtbyELc6PB38fk= -github.com/pulumi/pulumi/sdk/v3 v3.215.0 h1:XZMiv9aSE1pD3kW4JpA53cy7mFflbJYn1fFKH1NMIAY= -github.com/pulumi/pulumi/sdk/v3 v3.215.0/go.mod h1:Bn5Z9Rzp1lPqdAccaB+F2ivUBiamEl2TNR3Gg/h7iLs= +github.com/pulumi/pulumi/sdk/v3 v3.216.0 h1:8CkcMeg/fUI+nOp0cM4XJQIn1X0Q0CeOu6ZUv9pw17A= +github.com/pulumi/pulumi/sdk/v3 v3.216.0/go.mod h1:9bgwXx4+QuVuIBgivyiVY/f4X16DgMm9gGHgAcbPxk0= github.com/rivo/uniseg v0.1.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc= github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc= github.com/rivo/uniseg v0.4.4 h1:8TfxU8dW6PdqD27gjM8MVNuicgxIjxpm4K7x4jp8sis= From 28360d5b20537fc500cb396519bab517a2697e3e Mon Sep 17 00:00:00 2001 From: Jonathan Hefner Date: Wed, 21 Jan 2026 09:31:39 -0600 Subject: [PATCH 085/313] docs: Convert FAQ heading to MDX frontmatter Replace the markdown `# Frequently Asked Questions` heading with proper MDX frontmatter that includes both `title` and `sidebarTitle` fields. This brings the FAQ page in line with MDX documentation conventions. Co-Authored-By: Claude Opus 4.5 --- docs/modelcontextprotocol-io/faq.mdx | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/docs/modelcontextprotocol-io/faq.mdx b/docs/modelcontextprotocol-io/faq.mdx index 1e2610e..9b979d2 100644 --- a/docs/modelcontextprotocol-io/faq.mdx +++ b/docs/modelcontextprotocol-io/faq.mdx @@ -1,4 +1,7 @@ -# Frequently Asked Questions +--- +title: Frequently Asked Questions +sidebarTitle: FAQ +--- ## General From 9d30456d488a24d38d4b23b7b663b478ecca4d6f Mon Sep 17 00:00:00 2001 From: Jonathan Hefner Date: Wed, 21 Jan 2026 09:58:53 -0600 Subject: [PATCH 086/313] docs: Fix errors and typos in public documentation - Fix `--private-key-file` to `--private-key` in `github-actions.mdx` DNS authentication example (the CLI expects hex-encoded key data, not a file path) - Add missing `./` prefix to `mcp-publisher` command in PAT authentication example - Fix typo `verfication` to `verification` in troubleshooting table - Remove duplicate word `authentication` in `quickstart.mdx` prerequisites - Fix `name` to `identifier` field in JSON examples in `versioning.mdx` - Fix `PyPi` to `PyPI` (correct capitalization) in `moderation-policy.mdx` Co-Authored-By: Claude Opus 4.5 --- docs/modelcontextprotocol-io/github-actions.mdx | 8 +++----- docs/modelcontextprotocol-io/moderation-policy.mdx | 2 +- docs/modelcontextprotocol-io/quickstart.mdx | 2 +- docs/modelcontextprotocol-io/versioning.mdx | 4 ++-- 4 files changed, 7 insertions(+), 9 deletions(-) diff --git a/docs/modelcontextprotocol-io/github-actions.mdx b/docs/modelcontextprotocol-io/github-actions.mdx index 00f72ce..aa62ef8 100644 --- a/docs/modelcontextprotocol-io/github-actions.mdx +++ b/docs/modelcontextprotocol-io/github-actions.mdx @@ -112,7 +112,7 @@ jobs: curl -L "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_$(uname -s | tr '[:upper:]' '[:lower:]')_$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/').tar.gz" | tar xz mcp-publisher - name: Authenticate to MCP Registry - run: mcp-publisher login github --token ${{ secrets.MCP_GITHUB_TOKEN }} + run: ./mcp-publisher login github --token ${{ secrets.MCP_GITHUB_TOKEN }} # Optional: # - name: Set version in server.json @@ -172,9 +172,7 @@ jobs: # TODO: Replace `example.com` with your domain name # !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! - name: Authenticate to MCP Registry - run: | - echo "${{ secrets.MCP_PRIVATE_KEY }}" > key.pem - mcp-publisher login dns --domain example.com --private-key-file key.pem + run: ./mcp-publisher login dns --domain example.com --private-key ${{ secrets.MCP_PRIVATE_KEY }} # Optional: # - name: Set version in server.json @@ -218,6 +216,6 @@ The workflow will run tests, build the package, publish the package to npm, and | Error Message | Action | | --- | --- | | "Authentication failed" | Ensure `id-token: write` permission is set for OIDC, or check secrets. | -| "Package validation failed" | Verify your package successfully published to the package registry (e.g., npm, PyPI), and that your package has the [necessary verfication information](./package-types.mdx). | +| "Package validation failed" | Verify your package successfully published to the package registry (e.g., npm, PyPI), and that your package has the [necessary verification information](./package-types.mdx). | {/* prettier-ignore-end */} diff --git a/docs/modelcontextprotocol-io/moderation-policy.mdx b/docs/modelcontextprotocol-io/moderation-policy.mdx index 93c03d9..7800947 100644 --- a/docs/modelcontextprotocol-io/moderation-policy.mdx +++ b/docs/modelcontextprotocol-io/moderation-policy.mdx @@ -15,7 +15,7 @@ Subregistries may have their own moderation policies. If you have questions abou The MCP Registry **does not** make guarantees about moderation, and consumers should assume minimal-to-no moderation. -The MCP Registry is a community supported project, and we have limited active moderation capabilities. We largely rely on upstream package registries (like NPM, PyPi, and Docker) or downstream subregistries (like the GitHub MCP Registry) to do more in-depth moderation. +The MCP Registry is a community supported project, and we have limited active moderation capabilities. We largely rely on upstream package registries (like NPM, PyPI, and Docker) or downstream subregistries (like the GitHub MCP Registry) to do more in-depth moderation. This means there may be content in the MCP Registry that should be removed under this policy, but which we haven't yet removed. Consumers should treat scraped data accordingly. diff --git a/docs/modelcontextprotocol-io/quickstart.mdx b/docs/modelcontextprotocol-io/quickstart.mdx index c1c0301..1ae3d4b 100644 --- a/docs/modelcontextprotocol-io/quickstart.mdx +++ b/docs/modelcontextprotocol-io/quickstart.mdx @@ -9,7 +9,7 @@ This tutorial will show you how to publish an MCP server written in TypeScript t - **Node.js** — This tutorial assumes the MCP server is written in TypeScript. - **npm account** — The MCP Registry only hosts metadata, not artifacts. Before publishing to the MCP Registry, we will publish the MCP server's package to npm, so you will need an [npm](https://www.npmjs.com) account. -- **GitHub account** — The MCP Registry supports [multiple authentication methods](./authentication.mdx). authentication. For simplicity, this tutorial will use GitHub-based authentication, so you will need a [GitHub](https://github.com/) account. +- **GitHub account** — The MCP Registry supports [multiple authentication methods](./authentication.mdx). For simplicity, this tutorial will use GitHub-based authentication, so you will need a [GitHub](https://github.com/) account. If you do not have an MCP server written in TypeScript, you can copy the `weather-server-typescript` server from the [`modelcontextprotocol/quickstart-resources` repository](https://github.com/modelcontextprotocol/quickstart-resources) to follow along with this tutorial: diff --git a/docs/modelcontextprotocol-io/versioning.mdx b/docs/modelcontextprotocol-io/versioning.mdx index 7a4da6e..6494077 100644 --- a/docs/modelcontextprotocol-io/versioning.mdx +++ b/docs/modelcontextprotocol-io/versioning.mdx @@ -77,7 +77,7 @@ For local servers, align the server version with the underlying package version "packages": [ { "registryType": "npm", - "name": "@my-username/my-server", + "identifier": "@my-username/my-server", "version": "1.2.3", "transport": { "type": "stdio" @@ -139,7 +139,7 @@ If you anticipate publishing a server multiple times _without_ changing the unde "packages": [ { "registryType": "npm", - "name": "@my-username/my-server", + "identifier": "@my-username/my-server", "version": "1.2.3", "transport": { "type": "stdio" From 4fb32e5e2ebcb3deadf28def1a31b6afe3a5ec5d Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 22 Jan 2026 14:39:44 +0200 Subject: [PATCH 087/313] build(deps): bump anchore/sbom-action from 0.21.1 to 0.22.0 in the actions group (#911) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps the actions group with 1 update: [anchore/sbom-action](https://github.com/anchore/sbom-action). Updates `anchore/sbom-action` from 0.21.1 to 0.22.0
Release notes

Sourced from anchore/sbom-action's releases.

v0.22.0

Changes in v0.22.0

⬆️ Dependencies

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=anchore/sbom-action&package-manager=github_actions&previous-version=0.21.1&new-version=0.22.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index b2704ae..fc8e086 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -28,7 +28,7 @@ jobs: uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0 - name: Install Syft - uses: anchore/sbom-action/download-syft@v0.21.1 + uses: anchore/sbom-action/download-syft@v0.22.0 - name: Run GoReleaser uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a From 817e12161d3361ff2406d4afc72ef386ac488487 Mon Sep 17 00:00:00 2001 From: Jonathan Hefner Date: Wed, 21 Jan 2026 09:29:44 -0600 Subject: [PATCH 088/313] docs: Add preview disclaimer note to public documentation Add a `` component to all MDX files in `docs/modelcontextprotocol-io/` informing readers that the MCP Registry is currently in preview and that breaking changes or data resets may occur before general availability. The note also directs users to report issues on GitHub at https://github.com/modelcontextprotocol/registry/issues Co-Authored-By: Claude Opus 4.5 --- docs/modelcontextprotocol-io/about.mdx | 4 ++++ docs/modelcontextprotocol-io/authentication.mdx | 4 ++++ docs/modelcontextprotocol-io/faq.mdx | 4 ++++ docs/modelcontextprotocol-io/github-actions.mdx | 4 ++++ docs/modelcontextprotocol-io/moderation-policy.mdx | 4 ++++ docs/modelcontextprotocol-io/package-types.mdx | 4 ++++ docs/modelcontextprotocol-io/quickstart.mdx | 4 ++++ docs/modelcontextprotocol-io/registry-aggregators.mdx | 4 ++++ docs/modelcontextprotocol-io/remote-servers.mdx | 4 ++++ docs/modelcontextprotocol-io/terms-of-service.mdx | 4 ++++ docs/modelcontextprotocol-io/versioning.mdx | 4 ++++ 11 files changed, 44 insertions(+) diff --git a/docs/modelcontextprotocol-io/about.mdx b/docs/modelcontextprotocol-io/about.mdx index d93adf1..88253af 100644 --- a/docs/modelcontextprotocol-io/about.mdx +++ b/docs/modelcontextprotocol-io/about.mdx @@ -3,6 +3,10 @@ title: The MCP Registry sidebarTitle: About --- + + The MCP Registry is currently in preview. Breaking changes or data resets may occur before general availability. If you encounter any issues, please report them on [GitHub](https://github.com/modelcontextprotocol/registry/issues). + + The MCP Registry is the official centralized metadata repository for publicly accessible MCP servers, backed by major trusted contributors to the MCP ecosystem such as Anthropic, GitHub, PulseMCP, and Microsoft. The MCP Registry provides: diff --git a/docs/modelcontextprotocol-io/authentication.mdx b/docs/modelcontextprotocol-io/authentication.mdx index cadae54..c18268c 100644 --- a/docs/modelcontextprotocol-io/authentication.mdx +++ b/docs/modelcontextprotocol-io/authentication.mdx @@ -3,6 +3,10 @@ title: How to Authenticate When Publishing to the Official MCP Registry sidebarTitle: Authentication --- + + The MCP Registry is currently in preview. Breaking changes or data resets may occur before general availability. If you encounter any issues, please report them on [GitHub](https://github.com/modelcontextprotocol/registry/issues). + + You must authenticate before publishing to the official MCP Registry. The MCP Registry supports different authentication methods. Which authentication method you choose determines the namespace of your server's name. If you choose GitHub-based authentication, your server's name in `server.json` **MUST** be of the form `io.github.username/*` (or `io.github.orgname/*`). For example, `io.github.alice/weather-server`. diff --git a/docs/modelcontextprotocol-io/faq.mdx b/docs/modelcontextprotocol-io/faq.mdx index 9b979d2..7493d66 100644 --- a/docs/modelcontextprotocol-io/faq.mdx +++ b/docs/modelcontextprotocol-io/faq.mdx @@ -3,6 +3,10 @@ title: Frequently Asked Questions sidebarTitle: FAQ --- + + The MCP Registry is currently in preview. Breaking changes or data resets may occur before general availability. If you encounter any issues, please report them on [GitHub](https://github.com/modelcontextprotocol/registry/issues). + + ## General ### What is the difference between "Official MCP Registry", "MCP Registry", "MCP registry", "MCP Registry API", etc? diff --git a/docs/modelcontextprotocol-io/github-actions.mdx b/docs/modelcontextprotocol-io/github-actions.mdx index aa62ef8..1ce90bc 100644 --- a/docs/modelcontextprotocol-io/github-actions.mdx +++ b/docs/modelcontextprotocol-io/github-actions.mdx @@ -3,6 +3,10 @@ title: How to Automate Publishing with GitHub Actions sidebarTitle: GitHub Actions --- + + The MCP Registry is currently in preview. Breaking changes or data resets may occur before general availability. If you encounter any issues, please report them on [GitHub](https://github.com/modelcontextprotocol/registry/issues). + + ## Step 1: Create a Workflow File In your server project directory, create a `.github/workflows/publish-mcp.yml` file. Here is an example for npm-based local server, but the MCP Registry publishing steps are the same for all package types: diff --git a/docs/modelcontextprotocol-io/moderation-policy.mdx b/docs/modelcontextprotocol-io/moderation-policy.mdx index 7800947..d31d3c8 100644 --- a/docs/modelcontextprotocol-io/moderation-policy.mdx +++ b/docs/modelcontextprotocol-io/moderation-policy.mdx @@ -3,6 +3,10 @@ title: The MCP Registry Moderation Policy sidebarTitle: Moderation Policy --- + + The MCP Registry is currently in preview. Breaking changes or data resets may occur before general availability. If you encounter any issues, please report them on [GitHub](https://github.com/modelcontextprotocol/registry/issues). + + **TL;DR**: The MCP Registry is quite permissive! We only remove illegal content, malware, spam, and completely broken servers. ## Scope diff --git a/docs/modelcontextprotocol-io/package-types.mdx b/docs/modelcontextprotocol-io/package-types.mdx index 4ce97b2..9014302 100644 --- a/docs/modelcontextprotocol-io/package-types.mdx +++ b/docs/modelcontextprotocol-io/package-types.mdx @@ -3,6 +3,10 @@ title: MCP Registry Supported Package Types sidebarTitle: Package Types --- + + The MCP Registry is currently in preview. Breaking changes or data resets may occur before general availability. If you encounter any issues, please report them on [GitHub](https://github.com/modelcontextprotocol/registry/issues). + + # Package Types The MCP Registry supports several different package types, and each package type has its own verification method. diff --git a/docs/modelcontextprotocol-io/quickstart.mdx b/docs/modelcontextprotocol-io/quickstart.mdx index 1ae3d4b..f2ae0dd 100644 --- a/docs/modelcontextprotocol-io/quickstart.mdx +++ b/docs/modelcontextprotocol-io/quickstart.mdx @@ -3,6 +3,10 @@ title: "Quickstart: Publish an MCP Server to the MCP Registry" sidebarTitle: "Quickstart: Publish a Server" --- + + The MCP Registry is currently in preview. Breaking changes or data resets may occur before general availability. If you encounter any issues, please report them on [GitHub](https://github.com/modelcontextprotocol/registry/issues). + + This tutorial will show you how to publish an MCP server written in TypeScript to the MCP Registry using the official `mcp-publisher` CLI tool. ## Prerequisites diff --git a/docs/modelcontextprotocol-io/registry-aggregators.mdx b/docs/modelcontextprotocol-io/registry-aggregators.mdx index 07ebb1e..93e30af 100644 --- a/docs/modelcontextprotocol-io/registry-aggregators.mdx +++ b/docs/modelcontextprotocol-io/registry-aggregators.mdx @@ -3,6 +3,10 @@ title: MCP Registry Aggregators sidebarTitle: Registry Aggregators --- + + The MCP Registry is currently in preview. Breaking changes or data resets may occur before general availability. If you encounter any issues, please report them on [GitHub](https://github.com/modelcontextprotocol/registry/issues). + + Aggregators are downstream consumers of the MCP Registry that provide additional value. For example, a server marketplace that provides user ratings and security scanning. The MCP Registry provides an unauthenticated read-only REST API that aggregators can use to populate their data stores. Aggregators are expected to scrape data on a regular but infrequent basis (e.g., once per hour), and persist the data in their own data store. The MCP Registry **does not provide uptime or data durability guarantees**. diff --git a/docs/modelcontextprotocol-io/remote-servers.mdx b/docs/modelcontextprotocol-io/remote-servers.mdx index 3859809..be2bdc5 100644 --- a/docs/modelcontextprotocol-io/remote-servers.mdx +++ b/docs/modelcontextprotocol-io/remote-servers.mdx @@ -3,6 +3,10 @@ title: Publishing Remote Servers sidebarTitle: Remote Servers --- + + The MCP Registry is currently in preview. Breaking changes or data resets may occur before general availability. If you encounter any issues, please report them on [GitHub](https://github.com/modelcontextprotocol/registry/issues). + + The MCP Registry supports remote MCP servers via the `remotes` property in `server.json`: ```json server.json highlight={7-12} diff --git a/docs/modelcontextprotocol-io/terms-of-service.mdx b/docs/modelcontextprotocol-io/terms-of-service.mdx index ea26afa..97b7eaf 100644 --- a/docs/modelcontextprotocol-io/terms-of-service.mdx +++ b/docs/modelcontextprotocol-io/terms-of-service.mdx @@ -3,6 +3,10 @@ title: Official MCP Registry Terms of Service sidebarTitle: Terms of Service --- + + The MCP Registry is currently in preview. Breaking changes or data resets may occur before general availability. If you encounter any issues, please report them on [GitHub](https://github.com/modelcontextprotocol/registry/issues). + + **Effective date: 2025-09-02** ## Overview diff --git a/docs/modelcontextprotocol-io/versioning.mdx b/docs/modelcontextprotocol-io/versioning.mdx index 6494077..8a7c790 100644 --- a/docs/modelcontextprotocol-io/versioning.mdx +++ b/docs/modelcontextprotocol-io/versioning.mdx @@ -3,6 +3,10 @@ title: Versioning Published MCP Servers sidebarTitle: Versioning --- + + The MCP Registry is currently in preview. Breaking changes or data resets may occur before general availability. If you encounter any issues, please report them on [GitHub](https://github.com/modelcontextprotocol/registry/issues). + + MCP servers **MUST** define a version string in `server.json`. For example: ```json server.json highlight={6} From 3f3383bb6199990c853ae8be3715e150af5e8bcb Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 23 Jan 2026 14:12:46 +0200 Subject: [PATCH 089/313] build(deps): bump cloud.google.com/go/kms from 1.24.0 to 1.25.0 (#913) Bumps [cloud.google.com/go/kms](https://github.com/googleapis/google-cloud-go) from 1.24.0 to 1.25.0.
Release notes

Sourced from cloud.google.com/go/kms's releases.

maps 1.25.0

1.25.0 (2025-10-22)

Features

  • Add moved_place and moved_place_id to Place (PiperOrigin-RevId: 821809971) (f46efe45)

  • add experimental Load Costs feature (PiperOrigin-RevId: 819788002) (0241a9ca)

  • add OptimizeToursLongRunning method (PiperOrigin-RevId: 819788002) (0241a9ca)

  • add experimental U-turn Avoidance feature (PiperOrigin-RevId: 819788002) (0241a9ca)

  • add OptimizeToursUri method (PiperOrigin-RevId: 819788002) (0241a9ca)

Documentation

  • Change comments in some fields in Places API (PiperOrigin-RevId: 821809971) (f46efe45)

  • A comment for field place_id in message .google.maps.routeoptimization.v1.Waypoint is changed (PiperOrigin-RevId: 819788002) (0241a9ca)

  • A comment for field precedence_rules in message .google.maps.routeoptimization.v1.ShipmentModel is changed (PiperOrigin-RevId: 819788002) (0241a9ca)

  • A comment for field duration_distance_matrices in message .google.maps.routeoptimization.v1.ShipmentModel is changed (PiperOrigin-RevId: 819788002) (0241a9ca)

  • A comment for enum TravelMode is changed (PiperOrigin-RevId: 819788002) (0241a9ca)

cloudbuild 1.25.0

1.25.0 (2025-12-18)

kms 1.25.0

1.25.0 (2026-01-22)

Features

  • add the SingleTenantHsm functionality including the management API and resource types (PiperOrigin-RevId: 858582271) (8ddeca50)

Documentation

  • A comment for field crypto_key_backend in message .google.cloud.kms.v1.CryptoKey is expanded to include SingleTenantHsmInstances (PiperOrigin-RevId: 858582271) (8ddeca50)

  • A comment for enum value MODIFIED_GOOGLE_INITIATED_SYSTEM_OPERATION in enum AccessReason is changed (PiperOrigin-RevId: 858582271) (8ddeca50)

  • A comment for enum value MODIFIED_CUSTOMER_INITIATED_ACCESS in enum AccessReason is changed (PiperOrigin-RevId: 858582271) (8ddeca50)

Changelog

Sourced from cloud.google.com/go/kms's changelog.

1.25.0 (2024-02-09)

Features

  • documentai: Expose model_type in v1 processor, so that user can see the model_type after get or list processor version (2fcf55c)
Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=cloud.google.com/go/kms&package-manager=go_modules&previous-version=1.24.0&new-version=1.25.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 28f0dfb..cc40e31 100644 --- a/go.mod +++ b/go.mod @@ -3,7 +3,7 @@ module github.com/modelcontextprotocol/registry go 1.24.11 require ( - cloud.google.com/go/kms v1.24.0 + cloud.google.com/go/kms v1.25.0 github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.4.0 github.com/caarlos0/env/v11 v11.3.1 diff --git a/go.sum b/go.sum index 0184033..866d824 100644 --- a/go.sum +++ b/go.sum @@ -8,8 +8,8 @@ cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdB cloud.google.com/go/compute/metadata v0.9.0/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10= cloud.google.com/go/iam v1.5.3 h1:+vMINPiDF2ognBJ97ABAYYwRgsaqxPbQDlMnbHMjolc= cloud.google.com/go/iam v1.5.3/go.mod h1:MR3v9oLkZCTlaqljW6Eb2d3HGDGK5/bDv93jhfISFvU= -cloud.google.com/go/kms v1.24.0 h1:SWltUuoPhTdv9q/P0YEAWQfoYT32O5HdfPgTiWMvrH8= -cloud.google.com/go/kms v1.24.0/go.mod h1:QDH3z2SJ50lfNOE8EokKC1G40i7I0f8xTMCoiptcb5g= +cloud.google.com/go/kms v1.25.0 h1:gVqvGGUmz0nYCmtoxWmdc1wli2L1apgP8U4fghPGSbQ= +cloud.google.com/go/kms v1.25.0/go.mod h1:XIdHkzfj0bUO3E+LvwPg+oc7s58/Ns8Nd8Sdtljihbk= cloud.google.com/go/longrunning v0.7.0 h1:FV0+SYF1RIj59gyoWDRi45GiYUMM3K1qO51qoboQT1E= cloud.google.com/go/longrunning v0.7.0/go.mod h1:ySn2yXmjbK9Ba0zsQqunhDkYi0+9rlXIwnoAf+h+TPY= github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0 h1:JXg2dwJUmPB9JmtVmdEB16APJ7jurfbY5jnfXpJoRMc= From f1dbb060c8537afd1832ae888efc4d43a7def709 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 28 Jan 2026 11:55:59 +0200 Subject: [PATCH 090/313] build(deps): bump anchore/sbom-action from 0.22.0 to 0.22.1 in the actions group (#920) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps the actions group with 1 update: [anchore/sbom-action](https://github.com/anchore/sbom-action). Updates `anchore/sbom-action` from 0.22.0 to 0.22.1
Release notes

Sourced from anchore/sbom-action's releases.

v0.22.1

⬆️ Dependencies

Commits
  • deef08a chore(deps): update Syft to v1.41.0 (#576)
  • f139ded chore(deps): bump lodash from 4.17.21 to 4.17.23 (#573)
  • 1b05262 chore(deps): bump zizmorcore/zizmor-action from 0.3.0 to 0.4.1 (#575)
  • 1e8f28d chore(deps): bump actions/checkout from 6.0.1 to 6.0.2 (#574)
  • c618dc7 chore: tweak release drafter author and husky (#572)
  • See full diff in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=anchore/sbom-action&package-manager=github_actions&previous-version=0.22.0&new-version=0.22.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index fc8e086..2f32368 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -28,7 +28,7 @@ jobs: uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0 - name: Install Syft - uses: anchore/sbom-action/download-syft@v0.22.0 + uses: anchore/sbom-action/download-syft@v0.22.1 - name: Run GoReleaser uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a From dc73689210a81b414f6816afffe9d139c7c1e1c0 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 28 Jan 2026 11:56:20 +0200 Subject: [PATCH 091/313] build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.216.0 to 3.217.1 in /deploy (#919) Bumps [github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from 3.216.0 to 3.217.1.
Release notes

Sourced from github.com/pulumi/pulumi/sdk/v3's releases.

v3.217.1

3.217.1 (2026-01-27)

Features

  • [sdk/go] Add support for the OnError resource hook #21515

Bug Fixes

  • [cli/install] Copy files when linking to be robust to copying across file partitions #21549

  • [cli/install] Do not double install plugins with explicit parameterizations #21548

Full Changelog: https://github.com/pulumi/pulumi/compare/v3.217.0...v3.217.1

v3.217.0

3.217.0 (2026-01-23)

Features

  • [cli] Extract organization, team, and user from OIDC JWT claims during login #21462

  • [engine] Add the OnError resource hook to allow for custom retry policies #21291

  • [cli/engine] Add --plan up flag #21368

  • [sdk/nodejs] Add requirePulumiVersion to the Node.js SDK #21528 #21478

  • [sdk/python] Add require_pulumi_version to the Python SDK #21528 #21430

  • [sdk/go] Add CheckPulumiVersion to the Go SDK #21528 #21514

Bug Fixes

... (truncated)

Changelog

Sourced from github.com/pulumi/pulumi/sdk/v3's changelog.

3.217.1 (2026-01-27)

Features

  • [sdk/go] Add support for the OnError resource hook #21515

Bug Fixes

  • [cli/install] Copy files when linking to be robust to copying across file partitions #21549

  • [cli/install] Do not double install plugins with explicit parameterizations #21548

  • [cli/install] Copy files when linking instead of renaming #21549

Full Changelog: https://github.com/pulumi/pulumi/compare/v3.217.0...v3.217.1

3.217.0 (2026-01-23)

Features

  • [cli] Extract organization, team, and user from OIDC JWT claims during login #21462

  • [engine] Add the OnError resource hook to allow for custom retry policies #21291

  • [cli/engine] Add --plan up flag #21368

  • [sdk/nodejs] Add requirePulumiVersion to the Node.js SDK #21528 #21478

  • [sdk/python] Add require_pulumi_version to the Python SDK #21528 #21430

  • [sdk/go] Add CheckPulumiVersion to the Go SDK #21528 #21514

Bug Fixes

... (truncated)

Commits
  • 381f23b ProgramTest: Fully qualify environment names (#21556)
  • 0b1bfab Fix concurrency bugs in packageinstallation (#21559)
  • de8f97e Prepare for patch release v3.217.1 (#21558)
  • 4bcb1d4 Add language tests for replaceOnChanges (#21552)
  • 8e23ef0 Increase partition for the pkg module on windows (#21554)
  • c571535 Bump tar from 6.2.1 to 7.5.6 in /tests/integration/iterative-constraints in t...
  • 9819292 split up python conformance tests (#21367)
  • 683b6f6 Copy files when linking instead of renaming (#21549)
  • b2ecd0e Implement Go SDK support for OnError hooks (#21515)
  • 16713d0 Do not double install plugins with explicit parameterizations (#21548)
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/pulumi/pulumi/sdk/v3&package-manager=go_modules&previous-version=3.216.0&new-version=3.217.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- deploy/go.mod | 18 +++++++++--------- deploy/go.sum | 36 ++++++++++++++++++------------------ 2 files changed, 27 insertions(+), 27 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index 21f6c4c..9b7b2ef 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -5,7 +5,7 @@ go 1.24.11 require ( github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.25.0 - github.com/pulumi/pulumi/sdk/v3 v3.216.0 + github.com/pulumi/pulumi/sdk/v3 v3.217.1 gopkg.in/yaml.v2 v2.4.0 ) @@ -76,15 +76,15 @@ require ( github.com/xanzy/ssh-agent v0.3.3 // indirect github.com/zclconf/go-cty v1.13.2 // indirect go.uber.org/atomic v1.9.0 // indirect - golang.org/x/crypto v0.45.0 // indirect + golang.org/x/crypto v0.47.0 // indirect golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 // indirect - golang.org/x/mod v0.29.0 // indirect - golang.org/x/net v0.47.0 // indirect - golang.org/x/sync v0.18.0 // indirect - golang.org/x/sys v0.38.0 // indirect - golang.org/x/term v0.37.0 // indirect - golang.org/x/text v0.31.0 // indirect - golang.org/x/tools v0.38.0 // indirect + golang.org/x/mod v0.31.0 // indirect + golang.org/x/net v0.49.0 // indirect + golang.org/x/sync v0.19.0 // indirect + golang.org/x/sys v0.40.0 // indirect + golang.org/x/term v0.39.0 // indirect + golang.org/x/text v0.33.0 // indirect + golang.org/x/tools v0.40.0 // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20250528174236-200df99c418a // indirect google.golang.org/grpc v1.74.2 // indirect google.golang.org/protobuf v1.36.7 // indirect diff --git a/deploy/go.sum b/deploy/go.sum index fca0086..0f1b835 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -158,8 +158,8 @@ github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 h1:w6OnO3d4j5yVf2vpm8OzXFC/xHOEGqt+9 github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1/go.mod h1:UyZyv7hz4knpFx6/Sh+SkZe6hT6sJHtDvw9A0TbvEsk= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.25.0 h1:N1qitmrGomEaCPsblqJHaw8Re0cqqox5V+kHsi4EEtk= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.25.0/go.mod h1:ACBJF6+nzUqDeRK+p2OrvykunyeHfvtbyELc6PB38fk= -github.com/pulumi/pulumi/sdk/v3 v3.216.0 h1:8CkcMeg/fUI+nOp0cM4XJQIn1X0Q0CeOu6ZUv9pw17A= -github.com/pulumi/pulumi/sdk/v3 v3.216.0/go.mod h1:9bgwXx4+QuVuIBgivyiVY/f4X16DgMm9gGHgAcbPxk0= +github.com/pulumi/pulumi/sdk/v3 v3.217.1 h1:VlDL9+Qf4IlIEKa8QJPIhCJLkIJCMMbE3AYub4ZL9S0= +github.com/pulumi/pulumi/sdk/v3 v3.217.1/go.mod h1:ZOBPPC2NZOZf729AdCX+CctfNc5SN6aJh0bdqNdzQC4= github.com/rivo/uniseg v0.1.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc= github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc= github.com/rivo/uniseg v0.4.4 h1:8TfxU8dW6PdqD27gjM8MVNuicgxIjxpm4K7x4jp8sis= @@ -220,29 +220,29 @@ golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACk golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4= -golang.org/x/crypto v0.45.0 h1:jMBrvKuj23MTlT0bQEOBcAE0mjg8mK9RXFhRH6nyF3Q= -golang.org/x/crypto v0.45.0/go.mod h1:XTGrrkGJve7CYK7J8PEww4aY7gM3qMCElcJQ8n8JdX4= +golang.org/x/crypto v0.47.0 h1:V6e3FRj+n4dbpw86FJ8Fv7XVOql7TEwpHapKoMJ/GO8= +golang.org/x/crypto v0.47.0/go.mod h1:ff3Y9VzzKbwSSEzWqJsJVBnWmRwRSHt/6Op5n9bQc4A= golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 h1:2dVuKD2vS7b0QIHQbpyTISPd0LeHDbnYEryqj5Q1ug8= golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56/go.mod h1:M4RDyNAINzryxdtnbRXRL/OHtkFuWGRjvuhBJpk2IlY= golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY= golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg= golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= -golang.org/x/mod v0.29.0 h1:HV8lRxZC4l2cr3Zq1LvtOsi/ThTgWnUk/y64QSs8GwA= -golang.org/x/mod v0.29.0/go.mod h1:NyhrlYXJ2H4eJiRy/WDBO6HMqZQ6q9nk4JzS3NuCK+w= +golang.org/x/mod v0.31.0 h1:HaW9xtz0+kOcWKwli0ZXy79Ix+UW/vOfmWI5QVd2tgI= +golang.org/x/mod v0.31.0/go.mod h1:43JraMp9cGx1Rx3AqioxrbrhNsLl2l/iNAvuBkrezpg= golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20200421231249-e086a090c8fd/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A= golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= -golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY= -golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU= +golang.org/x/net v0.49.0 h1:eeHFmOGUTtaaPSGNmjBKpbng9MulQsJURQUAfUwY++o= +golang.org/x/net v0.49.0/go.mod h1:/ysNB2EvaqvesRkuLAyjI1ycPZlQHM3q01F02UY/MV8= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sync v0.18.0 h1:kr88TuHDroi+UVf+0hZnirlk8o8T+4MrK6mr60WkH/I= -golang.org/x/sync v0.18.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI= +golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4= +golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI= golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= @@ -258,24 +258,24 @@ golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBc golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.38.0 h1:3yZWxaJjBmCWXqhN1qh02AkOnCQ1poK6oF+a7xWL6Gc= -golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= +golang.org/x/sys v0.40.0 h1:DBZZqJ2Rkml6QMQsZywtnjnnGvHza6BTfYFWY9kjEWQ= +golang.org/x/sys v0.40.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= -golang.org/x/term v0.37.0 h1:8EGAD0qCmHYZg6J17DvsMy9/wJ7/D/4pV/wfnld5lTU= -golang.org/x/term v0.37.0/go.mod h1:5pB4lxRNYYVZuTLmy8oR2BH8dflOR+IbTYFD8fi3254= +golang.org/x/term v0.39.0 h1:RclSuaJf32jOqZz74CkPA9qFuVTX7vhLlpfj/IGWlqY= +golang.org/x/term v0.39.0/go.mod h1:yxzUCTP/U+FzoxfdKmLaA0RV1WgE0VY7hXBwKtY/4ww= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= -golang.org/x/text v0.31.0 h1:aC8ghyu4JhP8VojJ2lEHBnochRno1sgL6nEi9WGFGMM= -golang.org/x/text v0.31.0/go.mod h1:tKRAlv61yKIjGGHX/4tP1LTbc13YSec1pxVEWXzfoeM= +golang.org/x/text v0.33.0 h1:B3njUFyqtHDUI5jMn1YIr5B0IE2U0qck04r6d4KPAxE= +golang.org/x/text v0.33.0/go.mod h1:LuMebE6+rBincTi9+xWTY8TztLzKHc/9C1uBCG27+q8= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20181030221726-6c7e314b6563/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28= golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE= golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA= -golang.org/x/tools v0.38.0 h1:Hx2Xv8hISq8Lm16jvBZ2VQf+RLmbd7wVUsALibYI/IQ= -golang.org/x/tools v0.38.0/go.mod h1:yEsQ/d/YK8cjh0L6rZlY8tgtlKiBNTL14pGDJPJpYQs= +golang.org/x/tools v0.40.0 h1:yLkxfA+Qnul4cs9QA3KnlFu0lVmd8JJfoq+E41uSutA= +golang.org/x/tools v0.40.0/go.mod h1:Ik/tzLRlbscWpqqMRjyWYDisX8bG13FrdXp3o4Sr9lc= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= From f06d1eda8ae43df86fc6390196ec50f70c298f3c Mon Sep 17 00:00:00 2001 From: Bob Dickinson Date: Wed, 4 Feb 2026 05:52:07 -0800 Subject: [PATCH 092/313] Added /validate endpoint and modified mcp-publish so that all validation happens there (#896) ## Motivation and Context Per discussion with @rdimitrov - all validation now happens in a new `/validate` endpoint. For details, see below. ## Breaking Changes None. Validation on /publish only validates schema version and semantic checks (manual checks) as before. We can add schema validation by changing a flag in the called to `ValidateJSONSchema` when we're ready. ## Types of changes - [X] New feature (non-breaking change which adds functionality) ## Checklist - [X] I have read the [MCP Documentation](https://modelcontextprotocol.io) - [X] My code follows the repository's style guidelines - [X] New and existing tests pass locally - [X] I have added appropriate error handling - [X] I have added or updated documentation as needed ## Additional context ## API Changes ### 1. New `/validate` Endpoint A new public endpoint was added for validating `server.json` files without publishing them. **Details:** - **Paths:** `/v0/validate` and `/v0.1/validate` - **Method:** `POST` - **Authentication:** None required (public endpoint) - **Request:** JSON body containing `ServerJSON` - **Response:** `200 OK` with `ValidationResult` containing: - `valid` (boolean) - `issues` (array of validation issues with type, path, message, severity, reference) **Implementation:** - New handler file: `internal/api/handlers/v0/validate.go` - Performs comprehensive validation using `ValidationAll` option: - Schema version validation - Full schema validation - Semantic validation - Always returns `200 OK` - validity is indicated in `result.Valid` field - Registered in router for both `/v0` and `/v0.1` prefixes ### 2. `/publish` Endpoint Validation Flow Changes The publish endpoint now validates earlier in the request flow and provides clearer error responses. **Before:** Validation was mixed into `ValidatePublishRequest()` (which also handled publisher extensions and registry ownership). **After:** 1. Validates `ServerJSON` structure first using `ValidateServerJSON()` (schema version + semantic validation) 2. Returns `422 Unprocessable Entity` with message: "Failed to publish server, invalid schema: call /validate for details" 3. Only proceeds to publisher extensions/registry validation if schema validation passes 4. No longer calls `ValidatePublishRequest()` internally for schema validation **Key Changes:** - Validation happens before `CreateServer()` call - Returns `422` on schema/semantic validation failures - Error message directs users to `/validate` endpoint for details - `ValidatePublishRequest()` no longer performs schema validation (added note in comments) ### 3. `/edit` Endpoint Validation Flow Changes Similar validation changes were applied to the edit endpoint. **Changes:** - Added `ValidateServerJSON()` call before server update - Returns `422` with same error message format on validation failure - Matches the `/publish` endpoint behavior ### 4. Validator Functions Refactoring Updated validator functions to reflect that schema validation is now done separately. **Changes to `ValidatePublishRequest()`:** - Removed internal `ValidateServerJSON()` call - Added note: "ValidateServerJSON should be called separately before this function" - Now only validates publisher extensions and registry ownership **Changes to `ValidateUpdateRequest()`:** - Same change (removed schema validation, added note) - Now only validates registry ownership ## CLI Changes ### 1. `validate` Command: Now Uses API Endpoint **Before:** Performed local validation using `validators.ValidateServerJSON()`. **After:** Calls the `/v0/validate` endpoint on the registry. **Details:** - Reads `server.json` and sends it to the registry API - Displays validation results returned by the server - Uses the same error formatting as before - Registry URL comes from token file (or default) - No authentication required (public endpoint) **Implementation:** - Added `validateViaAPI()` function that POSTs to `/v0/validate` - Parses `ValidationResult` response from server - Uses shared `printValidationIssues()` for formatting ### 2. `publish` Command: Validation Only on 422 Errors **Before:** Performed upfront local schema validation before publishing. **After:** Attempts publish first, then validates only if server returns 422. **Details:** - Attempts publish immediately (no upfront validation) - If publish returns 422 (Unprocessable Entity): - Calls `/v0/validate` endpoint to get detailed validation errors - Formats and displays them using same logic as `validate` command - Returns error with migration links - For non-422 errors (401, 403, etc.), returns original error (no validation call) **Implementation Changes:** - Removed upfront `runValidationAndPrintIssues()` call - Modified `publishToRegistry()` to return HTTP status code alongside response/error - Added 422 detection logic that calls `validateViaAPI()` ### 3. Shared Validation Error Formatting **Before:** `runValidationAndPrintIssues()` function handled both validation and printing together. **After:** Refactored to separate printing logic. **Details:** - Created `printValidationIssues()` function - just prints validation issues (no validation logic) - Removed `runValidationAndPrintIssues()` function (no longer used) - Both `validate` and `publish` commands use `printValidationIssues()` for consistent output **Behavior:** - Prints schema validation errors with migration guidance - Prints all other validation issues with formatting - Returns formatted error message string for schema issues ## Summary Both CLI commands now use the `/validate` API endpoint for validation instead of local validation. The `publish` command validates only after receiving a 422 error response, and both commands share the same error formatting via `printValidationIssues()`. ### Benefits - **Centralized validation logic** - All validation happens on the server - **Always up-to-date** - CLI always uses current server validation rules - **Consistent experience** - Same validation behavior whether using CLI or API directly - **Better separation of concerns** - Schema validation separated from publisher-specific validation --- CHANGES.md | 0 cmd/publisher/commands/publish.go | 62 ++-- cmd/publisher/commands/publish_test.go | 401 +++++++++++++++++----- cmd/publisher/commands/testutil_test.go | 117 +++++++ cmd/publisher/commands/validate.go | 108 +++++- cmd/publisher/commands/validate_test.go | 182 ++++++++++ internal/api/handlers/v0/edit.go | 7 + internal/api/handlers/v0/publish.go | 7 + internal/api/handlers/v0/publish_test.go | 18 + internal/api/handlers/v0/validate.go | 36 ++ internal/api/handlers/v0/validate_test.go | 173 ++++++++++ internal/api/router/v0.go | 2 + internal/validators/validators.go | 15 +- 13 files changed, 991 insertions(+), 137 deletions(-) create mode 100644 CHANGES.md create mode 100644 cmd/publisher/commands/testutil_test.go create mode 100644 cmd/publisher/commands/validate_test.go create mode 100644 internal/api/handlers/v0/validate.go create mode 100644 internal/api/handlers/v0/validate_test.go diff --git a/CHANGES.md b/CHANGES.md new file mode 100644 index 0000000..e69de29 diff --git a/cmd/publisher/commands/publish.go b/cmd/publisher/commands/publish.go index 7a34630..da7de7d 100644 --- a/cmd/publisher/commands/publish.go +++ b/cmd/publisher/commands/publish.go @@ -12,7 +12,6 @@ import ( "path/filepath" "strings" - "github.com/modelcontextprotocol/registry/internal/validators" apiv0 "github.com/modelcontextprotocol/registry/pkg/api/v0" ) @@ -38,22 +37,6 @@ func PublishCommand(args []string) error { return fmt.Errorf("invalid server.json: %w", err) } - // Validate schema version (non-empty schema, valid schema, and current schema) - // This performs schema version checks without full schema validation - // Note: When we enable full validation, use validators.ValidationAll instead - result, formattedErrorMsg := runValidationAndPrintIssues(&serverJSON, validators.ValidationSchemaVersionOnly) - if !result.Valid { - // Return error after printing (all errors already printed by validateServerJSON) - // Prefer formatted error message for schema validation errors, otherwise use first error - if formattedErrorMsg != "" { - return fmt.Errorf("%s", formattedErrorMsg) - } - if firstErr := result.FirstError(); firstErr != nil { - return firstErr - } - return fmt.Errorf("validation failed") - } - // Load saved token homeDir, err := os.UserHomeDir() if err != nil { @@ -82,8 +65,33 @@ func PublishCommand(args []string) error { // Publish to registry _, _ = fmt.Fprintf(os.Stdout, "Publishing to %s...\n", registryURL) - response, err := publishToRegistry(registryURL, serverData, token) + response, statusCode, err := publishToRegistry(registryURL, serverData, token) if err != nil { + // If publish failed with 422, call validate endpoint to show detailed errors + if statusCode == http.StatusUnprocessableEntity { + _, _ = fmt.Fprintln(os.Stdout, "Validation failed. Checking detailed validation errors...") + _, _ = fmt.Fprintln(os.Stdout) + + // Call validate endpoint (same as validate command does) + result, validateErr := validateViaAPI(registryURL, serverData) + if validateErr != nil { + // If validate also fails, return original publish error + return fmt.Errorf("publish failed: %w", err) + } + + // Print validation results using shared formatting logic + formattedErrorMsg := printValidationIssues(result, &serverJSON) + + if !result.Valid { + // Return error with formatted message if available + if formattedErrorMsg != "" { + return fmt.Errorf("%s", formattedErrorMsg) + } + return fmt.Errorf("validation failed") + } + } + + // For non-422 errors, return the original error return fmt.Errorf("publish failed: %w", err) } @@ -93,18 +101,18 @@ func PublishCommand(args []string) error { return nil } -func publishToRegistry(registryURL string, serverData []byte, token string) (*apiv0.ServerResponse, error) { +func publishToRegistry(registryURL string, serverData []byte, token string) (*apiv0.ServerResponse, int, error) { // Parse the server JSON data var serverJSON apiv0.ServerJSON err := json.Unmarshal(serverData, &serverJSON) if err != nil { - return nil, fmt.Errorf("error parsing server.json file: %w", err) + return nil, 0, fmt.Errorf("error parsing server.json file: %w", err) } // Convert to JSON jsonData, err := json.Marshal(serverJSON) if err != nil { - return nil, fmt.Errorf("error serializing request: %w", err) + return nil, 0, fmt.Errorf("error serializing request: %w", err) } // Ensure URL ends with the publish endpoint @@ -116,7 +124,7 @@ func publishToRegistry(registryURL string, serverData []byte, token string) (*ap // Create and send request req, err := http.NewRequestWithContext(context.Background(), http.MethodPost, publishURL, bytes.NewBuffer(jsonData)) if err != nil { - return nil, fmt.Errorf("error creating request: %w", err) + return nil, 0, fmt.Errorf("error creating request: %w", err) } req.Header.Set("Content-Type", "application/json") req.Header.Set("Authorization", "Bearer "+token) @@ -124,24 +132,24 @@ func publishToRegistry(registryURL string, serverData []byte, token string) (*ap client := &http.Client{} resp, err := client.Do(req) if err != nil { - return nil, fmt.Errorf("error sending request: %w", err) + return nil, 0, fmt.Errorf("error sending request: %w", err) } defer resp.Body.Close() // Read response body, err := io.ReadAll(resp.Body) if err != nil { - return nil, fmt.Errorf("error reading response: %w", err) + return nil, resp.StatusCode, fmt.Errorf("error reading response: %w", err) } if resp.StatusCode != http.StatusCreated && resp.StatusCode != http.StatusOK { - return nil, fmt.Errorf("server returned status %d: %s", resp.StatusCode, body) + return nil, resp.StatusCode, fmt.Errorf("server returned status %d: %s", resp.StatusCode, body) } var serverResponse apiv0.ServerResponse if err := json.Unmarshal(body, &serverResponse); err != nil { - return nil, err + return nil, resp.StatusCode, err } - return &serverResponse, nil + return &serverResponse, resp.StatusCode, nil } diff --git a/cmd/publisher/commands/publish_test.go b/cmd/publisher/commands/publish_test.go index e7af688..27fcdfa 100644 --- a/cmd/publisher/commands/publish_test.go +++ b/cmd/publisher/commands/publish_test.go @@ -2,132 +2,361 @@ package commands_test import ( "encoding/json" - "os" - "path/filepath" - "strings" + "io" + "net/http" "testing" "github.com/modelcontextprotocol/registry/cmd/publisher/commands" + "github.com/modelcontextprotocol/registry/internal/validators" apiv0 "github.com/modelcontextprotocol/registry/pkg/api/v0" "github.com/modelcontextprotocol/registry/pkg/model" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" ) +func TestPublishCommand_Success(t *testing.T) { + // Setup mock server that returns success + server := SetupMockRegistryServer(t, nil, nil) + + // Setup token + SetupTestToken(t, server.URL, "test-token") + + // Create valid server.json + serverJSON := apiv0.ServerJSON{ + Schema: model.CurrentSchemaURL, + Name: "com.example/test-server", + Description: "A test server", + Version: "1.0.0", + } + CreateTestServerJSON(t, serverJSON) + + // Run publish command + err := commands.PublishCommand([]string{}) + + // Should succeed + assert.NoError(t, err) +} + +func TestPublishCommand_422ValidationFlow(t *testing.T) { + validateCallCount := 0 + publishCallCount := 0 + + // Setup mock server + server := SetupMockRegistryServer(t, + // Publish handler: return 422 for invalid schema + func(w http.ResponseWriter, _ *http.Request) { + publishCallCount++ + w.WriteHeader(http.StatusUnprocessableEntity) + _, _ = w.Write([]byte(`{"message":"Failed to publish server, invalid schema: call /validate for details"}`)) + }, + // Validate handler: return validation errors + func(w http.ResponseWriter, r *http.Request) { + validateCallCount++ + w.Header().Set("Content-Type", "application/json") + + body, _ := io.ReadAll(r.Body) + var req apiv0.ServerJSON + _ = json.Unmarshal(body, &req) + + // Return validation result with deprecated schema error + result := validators.ValidationResult{ + Valid: false, + Issues: []validators.ValidationIssue{ + { + Type: validators.ValidationIssueTypeSemantic, + Path: "schema", + Message: "schema version 2025-07-09 is not the current version", + Severity: validators.ValidationIssueSeverityWarning, + Reference: "schema-version-deprecated", + }, + }, + } + + _ = json.NewEncoder(w).Encode(result) + }, + ) + + // Setup token + SetupTestToken(t, server.URL, "test-token") + + // Create server.json with deprecated schema + serverJSON := apiv0.ServerJSON{ + Schema: "https://static.modelcontextprotocol.io/schemas/2025-07-09/server.schema.json", + Name: "com.example/test-server", + Description: "A test server", + Version: "1.0.0", + } + CreateTestServerJSON(t, serverJSON) + + // Run publish command + err := commands.PublishCommand([]string{}) + + // Should fail with validation error + require.Error(t, err) + assert.Contains(t, err.Error(), "schema version 2025-07-09") + assert.Contains(t, err.Error(), "Migration checklist:") + assert.Contains(t, err.Error(), "Full changelog with examples:") + + // Verify both endpoints were called + assert.Equal(t, 1, publishCallCount, "publish endpoint should be called once") + assert.Equal(t, 1, validateCallCount, "validate endpoint should be called once after 422") +} + +func TestPublishCommand_422WithMultipleIssues(t *testing.T) { + validateCallCount := 0 + + // Setup mock server + server := SetupMockRegistryServer(t, + func(w http.ResponseWriter, _ *http.Request) { + w.WriteHeader(http.StatusUnprocessableEntity) + _, _ = w.Write([]byte(`{"message":"Failed to publish server, invalid schema"}`)) + }, + func(w http.ResponseWriter, _ *http.Request) { + validateCallCount++ + w.Header().Set("Content-Type", "application/json") + + result := validators.ValidationResult{ + Valid: false, + Issues: []validators.ValidationIssue{ + { + Type: validators.ValidationIssueTypeSemantic, + Path: "version", + Message: "version must be a specific version, not a range", + Severity: validators.ValidationIssueSeverityError, + Reference: "semantic-version-range", + }, + { + Type: validators.ValidationIssueTypeSchema, + Path: "name", + Message: "name is required", + Severity: validators.ValidationIssueSeverityError, + Reference: "schema-field-required", + }, + }, + } + + _ = json.NewEncoder(w).Encode(result) + }, + ) + + SetupTestToken(t, server.URL, "test-token") + + serverJSON := apiv0.ServerJSON{ + Schema: model.CurrentSchemaURL, + Name: "com.example/test-server", + Description: "A test server", + Version: "^1.0.0", // Invalid version range + } + CreateTestServerJSON(t, serverJSON) + + err := commands.PublishCommand([]string{}) + + require.Error(t, err) + assert.Equal(t, 1, validateCallCount, "validate endpoint should be called") +} + +func TestPublishCommand_NoToken(t *testing.T) { + // Don't create a token file + serverJSON := apiv0.ServerJSON{ + Schema: model.CurrentSchemaURL, + Name: "com.example/test-server", + Description: "A test server", + Version: "1.0.0", + } + CreateTestServerJSON(t, serverJSON) + + err := commands.PublishCommand([]string{}) + + require.Error(t, err) + assert.Contains(t, err.Error(), "not authenticated") +} + +func TestPublishCommand_Non422Error(t *testing.T) { + publishCallCount := 0 + + server := SetupMockRegistryServer(t, + func(w http.ResponseWriter, _ *http.Request) { + publishCallCount++ + w.WriteHeader(http.StatusUnauthorized) + _, _ = w.Write([]byte(`{"message":"Unauthorized"}`)) + }, + nil, // No validate handler needed + ) + + SetupTestToken(t, server.URL, "invalid-token") + + serverJSON := apiv0.ServerJSON{ + Schema: model.CurrentSchemaURL, + Name: "com.example/test-server", + Description: "A test server", + Version: "1.0.0", + } + CreateTestServerJSON(t, serverJSON) + + err := commands.PublishCommand([]string{}) + + require.Error(t, err) + assert.Contains(t, err.Error(), "publish failed") + assert.Equal(t, 1, publishCallCount, "publish endpoint should be called") +} + func TestPublishCommand_DeprecatedSchema(t *testing.T) { - // Create a temporary directory for test files - tempDir, err := os.MkdirTemp("", "mcp-publisher-test") - if err != nil { - t.Fatalf("Failed to create temp dir: %v", err) - } - defer os.RemoveAll(tempDir) - - // Change to temp directory - originalDir, err := os.Getwd() - if err != nil { - t.Fatalf("Failed to get current dir: %v", err) - } - defer func() { _ = os.Chdir(originalDir) }() - - if err := os.Chdir(tempDir); err != nil { - t.Fatalf("Failed to change to temp dir: %v", err) - } - tests := []struct { - name string - schema string - expectError bool - errorSubstr string + name string + schema string + publishStatus int + validationOpts func(req apiv0.ServerJSON) validators.ValidationResult + expectError bool + errorSubstr string + checkLinks bool }{ { - name: "deprecated 2025-07-09 schema should show warning", - schema: "https://static.modelcontextprotocol.io/schemas/2025-07-09/server.schema.json", + name: "deprecated 2025-07-09 schema should show warning", + schema: "https://static.modelcontextprotocol.io/schemas/2025-07-09/server.schema.json", + publishStatus: http.StatusUnprocessableEntity, + validationOpts: func(_ apiv0.ServerJSON) validators.ValidationResult { + return validators.ValidationResult{ + Valid: false, + Issues: []validators.ValidationIssue{ + { + Type: validators.ValidationIssueTypeSemantic, + Path: "schema", + Message: "schema version 2025-07-09 is not the current version", + Severity: validators.ValidationIssueSeverityWarning, + Reference: "schema-version-deprecated", + }, + }, + } + }, expectError: true, - errorSubstr: "schema version 2025-07-09 is not the current version", + errorSubstr: "schema version 2025-07-09", + checkLinks: true, }, { - name: "current 2025-12-11 schema should pass validation", - schema: "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json", + name: "current 2025-12-11 schema should pass validation", + schema: "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json", + publishStatus: http.StatusCreated, + validationOpts: func(_ apiv0.ServerJSON) validators.ValidationResult { + // Should not be called since publish succeeds + return validators.ValidationResult{Valid: true} + }, expectError: false, }, { - name: "empty schema should pass validation", - schema: "", - expectError: false, + name: "empty schema should fail validation", + schema: "", + publishStatus: http.StatusUnprocessableEntity, + validationOpts: func(_ apiv0.ServerJSON) validators.ValidationResult { + return validators.ValidationResult{ + Valid: false, + Issues: []validators.ValidationIssue{ + { + Type: validators.ValidationIssueTypeSemantic, + Path: "schema", + Message: "$schema field is required", + Severity: validators.ValidationIssueSeverityError, + Reference: "schema-field-required", + }, + }, + } + }, + expectError: true, + errorSubstr: "$schema field is required", + checkLinks: true, }, { - name: "custom schema without 2025-07-09 should fail validation", - schema: "https://example.com/custom.schema.json", + name: "custom schema without valid version should fail validation", + schema: "https://example.com/custom.schema.json", + publishStatus: http.StatusUnprocessableEntity, + validationOpts: func(_ apiv0.ServerJSON) validators.ValidationResult { + return validators.ValidationResult{ + Valid: false, + Issues: []validators.ValidationIssue{ + { + Type: validators.ValidationIssueTypeSchema, + Path: "schema", + Message: "failed to extract schema version from URL", + Severity: validators.ValidationIssueSeverityError, + Reference: "schema-version-extraction-error", + }, + }, + } + }, expectError: true, errorSubstr: "failed to extract schema version from URL", + checkLinks: true, }, } for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { - // Create test server.json with specific schema + validateCallCount := 0 + publishCallCount := 0 + + // Setup mock server + server := SetupMockRegistryServer(t, + // Publish handler + func(w http.ResponseWriter, _ *http.Request) { + publishCallCount++ + if tt.publishStatus == http.StatusCreated { + w.WriteHeader(http.StatusCreated) + response := apiv0.ServerResponse{ + Server: apiv0.ServerJSON{ + Name: "com.example/test-server", + Version: "1.0.0", + }, + } + _ = json.NewEncoder(w).Encode(response) + } else { + w.WriteHeader(tt.publishStatus) + _, _ = w.Write([]byte(`{"message":"Failed to publish server, invalid schema: call /validate for details"}`)) + } + }, + // Validate handler (only called on 422) + func(w http.ResponseWriter, r *http.Request) { + validateCallCount++ + w.Header().Set("Content-Type", "application/json") + + body, _ := io.ReadAll(r.Body) + var req apiv0.ServerJSON + _ = json.Unmarshal(body, &req) + + result := tt.validationOpts(req) + _ = json.NewEncoder(w).Encode(result) + }, + ) + + SetupTestToken(t, server.URL, "test-token") + + // Create server.json with specific schema serverJSON := apiv0.ServerJSON{ Schema: tt.schema, Name: "com.example/test-server", Description: "A test server", Version: "1.0.0", - Repository: &model.Repository{ - URL: "https://github.com/example/test", - Source: "github", - }, - Packages: []model.Package{ - { - RegistryType: model.RegistryTypeNPM, - RegistryBaseURL: model.RegistryURLNPM, - Identifier: "@example/test-server", - Version: "1.0.0", - Transport: model.Transport{ - Type: model.TransportTypeStdio, - }, - }, - }, } + CreateTestServerJSON(t, serverJSON) - jsonData, err := json.MarshalIndent(serverJSON, "", " ") - if err != nil { - t.Fatalf("Failed to marshal test JSON: %v", err) - } - - // Write server.json to temp directory - serverFile := filepath.Join(tempDir, "server.json") - if err := os.WriteFile(serverFile, jsonData, 0o600); err != nil { - t.Fatalf("Failed to write server.json: %v", err) - } - - err = commands.PublishCommand([]string{}) + err := commands.PublishCommand([]string{}) if tt.expectError { - if err == nil { - t.Errorf("Expected error for deprecated schema, but got none") - return + require.Error(t, err, "Expected error for test case: %s", tt.name) + if tt.errorSubstr != "" { + assert.Contains(t, err.Error(), tt.errorSubstr, "Error should contain expected substring") } - if !strings.Contains(err.Error(), tt.errorSubstr) { - t.Errorf("Expected error containing '%s', got: %v", tt.errorSubstr, err) + if tt.checkLinks { + assert.Contains(t, err.Error(), "Migration checklist:", "Error should contain migration checklist link") + assert.Contains(t, err.Error(), "Full changelog with examples:", "Error should contain changelog link") } - // Check that the error contains the migration links - if !strings.Contains(err.Error(), "Migration checklist:") { - t.Errorf("Expected error to contain migration checklist link") - } - if !strings.Contains(err.Error(), "Full changelog with examples:") { - t.Errorf("Expected error to contain changelog link") + if tt.publishStatus == http.StatusUnprocessableEntity { + assert.Equal(t, 1, publishCallCount, "publish endpoint should be called once") + assert.Equal(t, 1, validateCallCount, "validate endpoint should be called after 422") } } else { - // For non-deprecated schemas, we expect the command to fail at auth step, not schema validation - if err != nil && strings.Contains(err.Error(), "deprecated schema detected") { - t.Errorf("Unexpected deprecated schema error for schema '%s': %v", tt.schema, err) - } - - // We expect auth errors for valid schemas since we don't have a token - if err != nil && !strings.Contains(err.Error(), "not authenticated") && !strings.Contains(err.Error(), "failed to read token") { - t.Logf("Expected auth error for valid schema, got: %v", err) - } + assert.NoError(t, err, "Expected success for test case: %s", tt.name) + assert.Equal(t, 1, publishCallCount, "publish endpoint should be called once") + assert.Equal(t, 0, validateCallCount, "validate endpoint should not be called on success") } - - // Clean up for next test - os.Remove(serverFile) }) } } diff --git a/cmd/publisher/commands/testutil_test.go b/cmd/publisher/commands/testutil_test.go new file mode 100644 index 0000000..51c6687 --- /dev/null +++ b/cmd/publisher/commands/testutil_test.go @@ -0,0 +1,117 @@ +package commands_test + +import ( + "encoding/json" + "net/http" + "net/http/httptest" + "os" + "path/filepath" + "testing" + + "github.com/modelcontextprotocol/registry/cmd/publisher/commands" + "github.com/modelcontextprotocol/registry/internal/validators" + apiv0 "github.com/modelcontextprotocol/registry/pkg/api/v0" + "github.com/stretchr/testify/require" +) + +// SetupMockRegistryServer creates an httptest.Server that mocks the registry API +func SetupMockRegistryServer(t *testing.T, publishHandler func(w http.ResponseWriter, r *http.Request), validateHandler func(w http.ResponseWriter, r *http.Request)) *httptest.Server { + t.Helper() + + mux := http.NewServeMux() + + // Default handlers if not provided + if publishHandler == nil { + publishHandler = func(w http.ResponseWriter, _ *http.Request) { + w.WriteHeader(http.StatusCreated) + response := apiv0.ServerResponse{ + Server: apiv0.ServerJSON{ + Name: "com.example/test", + Version: "1.0.0", + }, + } + _ = json.NewEncoder(w).Encode(response) + } + } + + if validateHandler == nil { + validateHandler = func(w http.ResponseWriter, _ *http.Request) { + w.Header().Set("Content-Type", "application/json") + result := validators.ValidationResult{Valid: true} + _ = json.NewEncoder(w).Encode(result) + } + } + + mux.HandleFunc("/v0/publish", func(w http.ResponseWriter, r *http.Request) { + if r.Method != http.MethodPost { + w.WriteHeader(http.StatusMethodNotAllowed) + return + } + publishHandler(w, r) + }) + + mux.HandleFunc("/v0/validate", func(w http.ResponseWriter, r *http.Request) { + if r.Method != http.MethodPost { + w.WriteHeader(http.StatusMethodNotAllowed) + return + } + validateHandler(w, r) + }) + + server := httptest.NewServer(mux) + t.Cleanup(server.Close) + + return server +} + +// SetupTestToken creates a token file pointing to the test server +func SetupTestToken(t *testing.T, registryURL, token string) string { + t.Helper() + + homeDir, err := os.UserHomeDir() + require.NoError(t, err) + + tokenPath := filepath.Join(homeDir, commands.TokenFileName) + tokenData := map[string]string{ + "token": token, + "registry": registryURL, + } + + data, err := json.Marshal(tokenData) + require.NoError(t, err) + + err = os.WriteFile(tokenPath, data, 0600) + require.NoError(t, err) + + t.Cleanup(func() { + _ = os.Remove(tokenPath) + }) + + return tokenPath +} + +// CreateTestServerJSON creates a server.json file in a temp directory and changes to it +func CreateTestServerJSON(t *testing.T, serverJSON apiv0.ServerJSON) (string, string) { + t.Helper() + + tempDir, err := os.MkdirTemp("", "mcp-publisher-test") + require.NoError(t, err) + t.Cleanup(func() { os.RemoveAll(tempDir) }) + + jsonData, err := json.MarshalIndent(serverJSON, "", " ") + require.NoError(t, err) + + serverFile := filepath.Join(tempDir, "server.json") + err = os.WriteFile(serverFile, jsonData, 0600) + require.NoError(t, err) + + // Change to temp directory + originalDir, err := os.Getwd() + require.NoError(t, err) + t.Cleanup(func() { _ = os.Chdir(originalDir) }) + + err = os.Chdir(tempDir) + require.NoError(t, err) + + return tempDir, serverFile +} diff --git a/cmd/publisher/commands/validate.go b/cmd/publisher/commands/validate.go index ba6bcfa..b68c2b4 100644 --- a/cmd/publisher/commands/validate.go +++ b/cmd/publisher/commands/validate.go @@ -1,9 +1,14 @@ package commands import ( + "bytes" + "context" "encoding/json" "fmt" + "io" + "net/http" "os" + "path/filepath" "strings" "github.com/modelcontextprotocol/registry/internal/validators" @@ -72,17 +77,14 @@ func printSchemaValidationErrors(result *validators.ValidationResult, serverJSON return "" } -// runValidationAndPrintIssues validates the server JSON, prints schema validation errors, and prints all issues. -// Validation failures are always printed (for both validate and publish commands). -// Returns the validation result and a formatted error message string for schema validation errors. -func runValidationAndPrintIssues(serverJSON *apiv0.ServerJSON, opts validators.ValidationOptions) (*validators.ValidationResult, string) { - result := validators.ValidateServerJSON(serverJSON, opts) - +// printValidationIssues prints schema validation errors and all other validation issues. +// Returns the formatted error message string for schema validation errors (empty string if none). +func printValidationIssues(result *validators.ValidationResult, serverJSON *apiv0.ServerJSON) string { // Print schema validation errors/warnings with friendly messages formattedErrorMsg := printSchemaValidationErrors(result, serverJSON) if result.Valid { - return result, "" + return formattedErrorMsg } // Print all issues @@ -108,7 +110,7 @@ func runValidationAndPrintIssues(serverJSON *apiv0.ServerJSON, opts validators.V issueNum++ } - return result, formattedErrorMsg + return formattedErrorMsg } func ValidateCommand(args []string) error { @@ -148,15 +150,97 @@ func ValidateCommand(args []string) error { return fmt.Errorf("invalid JSON: %w", err) } - // Run detailed validation (this is the whole point of the validate command) - // Include schema validation for comprehensive validation - // Warn about non-current schemas (don't error, just inform) - result, _ := runValidationAndPrintIssues(&serverJSON, validators.ValidationAll) + // Get registry URL (same pattern as publish) + homeDir, err := os.UserHomeDir() + if err != nil { + return fmt.Errorf("failed to get home directory: %w", err) + } + + tokenPath := filepath.Join(homeDir, TokenFileName) + registryURL := DefaultRegistryURL + // Try to read registry URL from token file (if it exists) + if tokenData, err := os.ReadFile(tokenPath); err == nil { + var tokenInfo map[string]string + if err := json.Unmarshal(tokenData, &tokenInfo); err == nil { + if url := tokenInfo["registry"]; url != "" { + registryURL = url + } + } + } + + // Validate via API + _, _ = fmt.Fprintf(os.Stdout, "Validating against %s...\n", registryURL) + result, err := validateViaAPI(registryURL, serverData) + if err != nil { + return fmt.Errorf("validation failed: %w", err) + } + + // Print validation results using shared formatting logic + formattedErrorMsg := printValidationIssues(result, &serverJSON) if result.Valid { _, _ = fmt.Fprintln(os.Stdout, "✅ server.json is valid") return nil } + // Return error with formatted message if available + if formattedErrorMsg != "" { + return fmt.Errorf("%s", formattedErrorMsg) + } + return fmt.Errorf("validation failed") } + +// validateViaAPI calls the /validate endpoint on the registry +func validateViaAPI(registryURL string, serverData []byte) (*validators.ValidationResult, error) { + // Parse the server JSON data to ensure it's valid JSON + var serverJSON apiv0.ServerJSON + err := json.Unmarshal(serverData, &serverJSON) + if err != nil { + return nil, fmt.Errorf("error parsing server.json file: %w", err) + } + + // Convert to JSON + jsonData, err := json.Marshal(serverJSON) + if err != nil { + return nil, fmt.Errorf("error serializing request: %w", err) + } + + // Ensure URL ends with / and add validate endpoint + if !strings.HasSuffix(registryURL, "/") { + registryURL += "/" + } + validateURL := registryURL + "v0/validate" + + // Create and send request + req, err := http.NewRequestWithContext(context.Background(), http.MethodPost, validateURL, bytes.NewBuffer(jsonData)) + if err != nil { + return nil, fmt.Errorf("error creating request: %w", err) + } + req.Header.Set("Content-Type", "application/json") + + client := &http.Client{} + resp, err := client.Do(req) + if err != nil { + return nil, fmt.Errorf("error sending request: %w", err) + } + defer resp.Body.Close() + + // Read response + body, err := io.ReadAll(resp.Body) + if err != nil { + return nil, fmt.Errorf("error reading response: %w", err) + } + + if resp.StatusCode != http.StatusOK { + return nil, fmt.Errorf("server returned status %d: %s", resp.StatusCode, body) + } + + // Parse response - Huma returns ValidationResult directly + var result validators.ValidationResult + if err := json.Unmarshal(body, &result); err != nil { + return nil, fmt.Errorf("error parsing response: %w", err) + } + + return &result, nil +} diff --git a/cmd/publisher/commands/validate_test.go b/cmd/publisher/commands/validate_test.go new file mode 100644 index 0000000..b56b22d --- /dev/null +++ b/cmd/publisher/commands/validate_test.go @@ -0,0 +1,182 @@ +package commands_test + +import ( + "encoding/json" + "io" + "net/http" + "os" + "testing" + + "github.com/modelcontextprotocol/registry/cmd/publisher/commands" + "github.com/modelcontextprotocol/registry/internal/validators" + apiv0 "github.com/modelcontextprotocol/registry/pkg/api/v0" + "github.com/modelcontextprotocol/registry/pkg/model" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +func TestValidateCommand_Success(t *testing.T) { + validateCallCount := 0 + + server := SetupMockRegistryServer(t, + nil, // No publish handler + func(w http.ResponseWriter, _ *http.Request) { + validateCallCount++ + w.Header().Set("Content-Type", "application/json") + + result := validators.ValidationResult{ + Valid: true, + Issues: []validators.ValidationIssue{}, + } + + _ = json.NewEncoder(w).Encode(result) + }, + ) + + SetupTestToken(t, server.URL, "test-token") + + serverJSON := apiv0.ServerJSON{ + Schema: model.CurrentSchemaURL, + Name: "com.example/test-server", + Description: "A test server", + Version: "1.0.0", + } + CreateTestServerJSON(t, serverJSON) + + err := commands.ValidateCommand([]string{}) + + assert.NoError(t, err) + assert.Equal(t, 1, validateCallCount, "validate endpoint should be called") +} + +func TestValidateCommand_WithErrors(t *testing.T) { + validateCallCount := 0 + + server := SetupMockRegistryServer(t, + nil, + func(w http.ResponseWriter, _ *http.Request) { + validateCallCount++ + w.Header().Set("Content-Type", "application/json") + + result := validators.ValidationResult{ + Valid: false, + Issues: []validators.ValidationIssue{ + { + Type: validators.ValidationIssueTypeSemantic, + Path: "version", + Message: "version must be a specific version, not a range", + Severity: validators.ValidationIssueSeverityError, + Reference: "semantic-version-range", + }, + }, + } + + _ = json.NewEncoder(w).Encode(result) + }, + ) + + SetupTestToken(t, server.URL, "test-token") + + serverJSON := apiv0.ServerJSON{ + Schema: model.CurrentSchemaURL, + Name: "com.example/test-server", + Description: "A test server", + Version: "^1.0.0", // Invalid + } + CreateTestServerJSON(t, serverJSON) + + err := commands.ValidateCommand([]string{}) + + require.Error(t, err) + assert.Contains(t, err.Error(), "validation failed") + assert.Equal(t, 1, validateCallCount, "validate endpoint should be called") +} + +func TestValidateCommand_DeprecatedSchema(t *testing.T) { + server := SetupMockRegistryServer(t, + nil, + func(w http.ResponseWriter, r *http.Request) { + w.Header().Set("Content-Type", "application/json") + + body, _ := io.ReadAll(r.Body) + var req apiv0.ServerJSON + _ = json.Unmarshal(body, &req) + + result := validators.ValidationResult{ + Valid: false, + Issues: []validators.ValidationIssue{ + { + Type: validators.ValidationIssueTypeSemantic, + Path: "schema", + Message: "schema version 2025-07-09 is not the current version", + Severity: validators.ValidationIssueSeverityWarning, + Reference: "schema-version-deprecated", + }, + }, + } + + _ = json.NewEncoder(w).Encode(result) + }, + ) + + SetupTestToken(t, server.URL, "test-token") + + serverJSON := apiv0.ServerJSON{ + Schema: "https://static.modelcontextprotocol.io/schemas/2025-07-09/server.schema.json", + Name: "com.example/test-server", + Description: "A test server", + Version: "1.0.0", + } + CreateTestServerJSON(t, serverJSON) + + err := commands.ValidateCommand([]string{}) + + require.Error(t, err) + assert.Contains(t, err.Error(), "schema version 2025-07-09") + assert.Contains(t, err.Error(), "Migration checklist:") +} + +func TestValidateCommand_NoServerFile(t *testing.T) { + server := SetupMockRegistryServer(t, nil, nil) + SetupTestToken(t, server.URL, "test-token") + + // Don't create server.json + tempDir, err := os.MkdirTemp("", "mcp-publisher-test") + require.NoError(t, err) + defer os.RemoveAll(tempDir) + + originalDir, err := os.Getwd() + require.NoError(t, err) + defer func() { _ = os.Chdir(originalDir) }() + + _ = os.Chdir(tempDir) + + err = commands.ValidateCommand([]string{}) + + require.Error(t, err) + assert.Contains(t, err.Error(), "not found") +} + +func TestValidateCommand_InvalidJSON(t *testing.T) { + server := SetupMockRegistryServer(t, nil, nil) + SetupTestToken(t, server.URL, "test-token") + + tempDir, err := os.MkdirTemp("", "mcp-publisher-test") + require.NoError(t, err) + defer os.RemoveAll(tempDir) + + originalDir, err := os.Getwd() + require.NoError(t, err) + defer func() { _ = os.Chdir(originalDir) }() + + _ = os.Chdir(tempDir) + + // Create invalid JSON file + err = os.WriteFile("server.json", []byte("{ invalid json }"), 0600) + require.NoError(t, err) + + err = commands.ValidateCommand([]string{}) + + require.Error(t, err) + assert.Contains(t, err.Error(), "invalid JSON") +} diff --git a/internal/api/handlers/v0/edit.go b/internal/api/handlers/v0/edit.go index 9c0286d..5c519e2 100644 --- a/internal/api/handlers/v0/edit.go +++ b/internal/api/handlers/v0/edit.go @@ -12,6 +12,7 @@ import ( "github.com/modelcontextprotocol/registry/internal/config" "github.com/modelcontextprotocol/registry/internal/database" "github.com/modelcontextprotocol/registry/internal/service" + "github.com/modelcontextprotocol/registry/internal/validators" apiv0 "github.com/modelcontextprotocol/registry/pkg/api/v0" "github.com/modelcontextprotocol/registry/pkg/model" ) @@ -91,6 +92,12 @@ func RegisterEditEndpoints(api huma.API, pathPrefix string, registry service.Reg return nil, huma.Error400BadRequest("Version in request body must match URL path parameter") } + // Validate server JSON structure and schema (returns 422 on validation failure) + validationResult := validators.ValidateServerJSON(&input.Body, validators.ValidationSchemaVersionAndSemantic) + if !validationResult.Valid { + return nil, huma.Error422UnprocessableEntity("Failed to edit server, invalid schema: call /validate for details") + } + // Handle status changes with proper permission validation if input.Status != "" { newStatus := model.Status(input.Status) diff --git a/internal/api/handlers/v0/publish.go b/internal/api/handlers/v0/publish.go index 7631ae3..5bd371e 100644 --- a/internal/api/handlers/v0/publish.go +++ b/internal/api/handlers/v0/publish.go @@ -9,6 +9,7 @@ import ( "github.com/modelcontextprotocol/registry/internal/auth" "github.com/modelcontextprotocol/registry/internal/config" "github.com/modelcontextprotocol/registry/internal/service" + "github.com/modelcontextprotocol/registry/internal/validators" apiv0 "github.com/modelcontextprotocol/registry/pkg/api/v0" ) @@ -53,6 +54,12 @@ func RegisterPublishEndpoint(api huma.API, pathPrefix string, registry service.R return nil, huma.Error403Forbidden(buildPermissionErrorMessage(input.Body.Name, claims.Permissions)) } + // Validate server JSON structure and schema (returns 422 on validation failure) + validationResult := validators.ValidateServerJSON(&input.Body, validators.ValidationSchemaVersionAndSemantic) + if !validationResult.Valid { + return nil, huma.Error422UnprocessableEntity("Failed to publish server, invalid schema: call /validate for details") + } + // Publish the server with extensions publishedServer, err := registry.CreateServer(ctx, &input.Body) if err != nil { diff --git a/internal/api/handlers/v0/publish_test.go b/internal/api/handlers/v0/publish_test.go index 0a00659..94502be 100644 --- a/internal/api/handlers/v0/publish_test.go +++ b/internal/api/handlers/v0/publish_test.go @@ -366,6 +366,24 @@ func TestPublishEndpoint(t *testing.T) { expectedStatus: http.StatusUnprocessableEntity, expectedError: "expected string to match pattern", }, + { + name: "invalid schema - version range instead of specific version", + requestBody: apiv0.ServerJSON{ + Schema: model.CurrentSchemaURL, + Name: "com.example/test-server", + Description: "A test server", + Version: "^1.0.0", // Version range, not allowed + }, + tokenClaims: &auth.JWTClaims{ + AuthMethod: auth.MethodNone, + Permissions: []auth.Permission{ + {Action: auth.PermissionActionPublish, ResourcePattern: "*"}, + }, + }, + setupRegistryService: func(_ service.RegistryService) {}, + expectedStatus: http.StatusUnprocessableEntity, + expectedError: "Failed to publish server, invalid schema: call /validate for details", + }, } for _, tc := range testCases { diff --git a/internal/api/handlers/v0/validate.go b/internal/api/handlers/v0/validate.go new file mode 100644 index 0000000..0601f14 --- /dev/null +++ b/internal/api/handlers/v0/validate.go @@ -0,0 +1,36 @@ +package v0 + +import ( + "context" + "net/http" + "strings" + + "github.com/danielgtaylor/huma/v2" + "github.com/modelcontextprotocol/registry/internal/validators" + apiv0 "github.com/modelcontextprotocol/registry/pkg/api/v0" +) + +// ValidateServerInput represents the input for validating a server JSON +type ValidateServerInput struct { + Body apiv0.ServerJSON `body:""` +} + +// RegisterValidateEndpoint registers the validate endpoint with a custom path prefix +func RegisterValidateEndpoint(api huma.API, pathPrefix string) { + huma.Register(api, huma.Operation{ + OperationID: "validate-server" + strings.ReplaceAll(pathPrefix, "/", "-"), + Method: http.MethodPost, + Path: pathPrefix + "/validate", + Summary: "Validate MCP server JSON", + Description: "Validate a server.json file without publishing it to the registry", + Tags: []string{"validate"}, + }, func(_ context.Context, input *ValidateServerInput) (*Response[validators.ValidationResult], error) { + // Perform comprehensive validation (schema version, full schema validation, and semantic) + result := validators.ValidateServerJSON(&input.Body, validators.ValidationAll) + + // Return validation result (always 200 OK, validity indicated in result.Valid) + return &Response[validators.ValidationResult]{ + Body: *result, + }, nil + }) +} diff --git a/internal/api/handlers/v0/validate_test.go b/internal/api/handlers/v0/validate_test.go new file mode 100644 index 0000000..4436d99 --- /dev/null +++ b/internal/api/handlers/v0/validate_test.go @@ -0,0 +1,173 @@ +package v0_test + +import ( + "bytes" + "context" + "encoding/json" + "net/http" + "net/http/httptest" + "strings" + "testing" + + "github.com/danielgtaylor/huma/v2" + "github.com/danielgtaylor/huma/v2/adapters/humago" + v0 "github.com/modelcontextprotocol/registry/internal/api/handlers/v0" + apiv0 "github.com/modelcontextprotocol/registry/pkg/api/v0" + "github.com/modelcontextprotocol/registry/pkg/model" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +type issueStruct struct { + Type string `json:"type"` + Path string `json:"path"` + Message string `json:"message"` + Severity string `json:"severity"` + Reference string `json:"reference"` +} + +func TestValidateEndpoint(t *testing.T) { + // Create a new ServeMux and Huma API + mux := http.NewServeMux() + api := humago.New(mux, huma.DefaultConfig("Test API", "1.0.0")) + + // Register the endpoint + v0.RegisterValidateEndpoint(api, "/v0") + + testCases := []struct { + name string + serverJSON apiv0.ServerJSON + expectedValid bool + expectedStatus int + description string + validateIssues func(t *testing.T, issues []issueStruct) + }{ + { + name: "valid server json", + serverJSON: apiv0.ServerJSON{ + Schema: model.CurrentSchemaURL, + Name: "com.example/test-server", + Description: "A test server", + Version: "1.0.0", + }, + expectedValid: true, + expectedStatus: http.StatusOK, + description: "Should return valid for a properly formatted server JSON", + validateIssues: func(t *testing.T, issues []issueStruct) { + t.Helper() + assert.Empty(t, issues, "Valid server JSON should have no issues") + }, + }, + { + name: "version range should be invalid", + serverJSON: apiv0.ServerJSON{ + Schema: model.CurrentSchemaURL, + Name: "com.example/test-server", + Description: "A test server", + Version: "^1.0.0", // Version range, not allowed + }, + expectedValid: false, + expectedStatus: http.StatusOK, + description: "Should return invalid when version is a range instead of specific version", + validateIssues: func(t *testing.T, issues []issueStruct) { + t.Helper() + require.Greater(t, len(issues), 0, "Should have at least one issue") + issue := issues[0] + assert.Equal(t, "semantic", issue.Type, "Issue type should be semantic") + assert.Equal(t, "version", issue.Path, "Issue path should be 'version'") + assert.Equal(t, "error", issue.Severity, "Issue severity should be error") + assert.NotEmpty(t, issue.Message, "Issue message should not be empty") + assert.Contains(t, issue.Message, "^1.0.0", "Issue message should contain the version range") + assert.NotEmpty(t, issue.Reference, "Issue reference should not be empty") + }, + }, + { + name: "latest version should be invalid", + serverJSON: apiv0.ServerJSON{ + Schema: model.CurrentSchemaURL, + Name: "com.example/test-server", + Description: "A test server", + Version: "latest", // "latest" is reserved + }, + expectedValid: false, + expectedStatus: http.StatusOK, + description: "Should return invalid when version is 'latest' (reserved word)", + validateIssues: func(t *testing.T, issues []issueStruct) { + t.Helper() + require.Greater(t, len(issues), 0, "Should have at least one issue") + issue := issues[0] + assert.Equal(t, "semantic", issue.Type, "Issue type should be semantic") + assert.Equal(t, "version", issue.Path, "Issue path should be 'version'") + assert.Equal(t, "error", issue.Severity, "Issue severity should be error") + assert.NotEmpty(t, issue.Message, "Issue message should not be empty") + assert.Contains(t, strings.ToLower(issue.Message), "latest", "Issue message should mention 'latest'") + assert.NotEmpty(t, issue.Reference, "Issue reference should not be empty") + }, + }, + } + + for _, tc := range testCases { + t.Run(tc.name, func(t *testing.T) { + // Create request body + bodyBytes, err := json.Marshal(tc.serverJSON) + require.NoError(t, err) + + // Create request + req, err := http.NewRequestWithContext(context.Background(), http.MethodPost, "/v0/validate", bytes.NewBuffer(bodyBytes)) + require.NoError(t, err) + req.Header.Set("Content-Type", "application/json") + + // Perform request + rr := httptest.NewRecorder() + mux.ServeHTTP(rr, req) + + // Assert status code + assert.Equal(t, tc.expectedStatus, rr.Code, "%s: expected status %d, got %d", tc.description, tc.expectedStatus, rr.Code) + + // Parse response - Huma returns ValidationResult directly + var result struct { + Valid bool `json:"valid"` + Issues []issueStruct `json:"issues"` + } + err = json.Unmarshal(rr.Body.Bytes(), &result) + require.NoError(t, err, "Failed to parse response: %s", rr.Body.String()) + + // Debug output for failed tests + if tc.expectedValid != result.Valid { + t.Logf("Response body: %s", rr.Body.String()) + t.Logf("Validation issues: %+v", result.Issues) + } + + // Always log response for first test case to show structure + if tc.name == "valid server json" { + var prettyJSON bytes.Buffer + if err := json.Indent(&prettyJSON, rr.Body.Bytes(), "", " "); err == nil { + t.Logf("Example valid response:\n%s", prettyJSON.String()) + } + } + if tc.name == "version range should be invalid" { + var prettyJSON bytes.Buffer + if err := json.Indent(&prettyJSON, rr.Body.Bytes(), "", " "); err == nil { + t.Logf("Example invalid response:\n%s", prettyJSON.String()) + } + } + + // Assert validity + assert.Equal(t, tc.expectedValid, result.Valid, "%s: expected valid=%v, got %v. Issues: %+v", tc.description, tc.expectedValid, result.Valid, result.Issues) + + // Validate issues structure and content + if tc.validateIssues != nil { + tc.validateIssues(t, result.Issues) + } else if !tc.expectedValid { + // Default validation: if expected invalid, verify there are issues + assert.Greater(t, len(result.Issues), 0, "%s: expected validation issues but got none. Response: %s", tc.description, rr.Body.String()) + // Validate all issues have required fields + for i, issue := range result.Issues { + assert.NotEmpty(t, issue.Type, "Issue %d: type should not be empty", i) + assert.NotEmpty(t, issue.Severity, "Issue %d: severity should not be empty", i) + assert.NotEmpty(t, issue.Message, "Issue %d: message should not be empty", i) + } + } + }) + } +} diff --git a/internal/api/router/v0.go b/internal/api/router/v0.go index eae032d..62bc46e 100644 --- a/internal/api/router/v0.go +++ b/internal/api/router/v0.go @@ -21,6 +21,7 @@ func RegisterV0Routes( v0.RegisterEditEndpoints(api, "/v0", registry, cfg) v0auth.RegisterAuthEndpoints(api, "/v0", cfg) v0.RegisterPublishEndpoint(api, "/v0", registry, cfg) + v0.RegisterValidateEndpoint(api, "/v0") } func RegisterV0_1Routes( @@ -33,4 +34,5 @@ func RegisterV0_1Routes( v0.RegisterEditEndpoints(api, "/v0.1", registry, cfg) v0auth.RegisterAuthEndpoints(api, "/v0.1", cfg) v0.RegisterPublishEndpoint(api, "/v0.1", registry, cfg) + v0.RegisterValidateEndpoint(api, "/v0.1") } diff --git a/internal/validators/validators.go b/internal/validators/validators.go index 2081f0b..4da756d 100644 --- a/internal/validators/validators.go +++ b/internal/validators/validators.go @@ -626,18 +626,13 @@ func validateRemoteTransport(ctx *ValidationContext, obj *model.Transport) *Vali } // ValidatePublishRequest validates a complete publish request including extensions +// Note: ValidateServerJSON should be called separately before this function func ValidatePublishRequest(ctx context.Context, req apiv0.ServerJSON, cfg *config.Config) error { // Validate publisher extensions in _meta if err := validatePublisherExtensions(req); err != nil { return err } - // Validate the server detail (includes all nested validation) - result := ValidateServerJSON(&req, ValidationSchemaVersionAndSemantic) - if err := result.FirstError(); err != nil { - return err - } - // Validate registry ownership for all packages if validation is enabled if cfg.EnableRegistryValidation { if err := validateRegistryOwnership(ctx, req); err != nil { @@ -648,13 +643,9 @@ func ValidatePublishRequest(ctx context.Context, req apiv0.ServerJSON, cfg *conf return nil } +// ValidateUpdateRequest validates an update request including registry ownership +// Note: ValidateServerJSON should be called separately before this function func ValidateUpdateRequest(ctx context.Context, req apiv0.ServerJSON, cfg *config.Config, skipRegistryValidation bool) error { - // Validate the server detail (includes all nested validation) - result := ValidateServerJSON(&req, ValidationSchemaVersionAndSemantic) - if err := result.FirstError(); err != nil { - return err - } - if cfg.EnableRegistryValidation && !skipRegistryValidation { if err := validateRegistryOwnership(ctx, req); err != nil { return err From c25e88d6f3adbad4b43474c93efb6c3546c05a9f Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Thu, 5 Feb 2026 12:24:17 +0200 Subject: [PATCH 093/313] Resolve vulnerability warnings by bumping Go to 1.24.12 (#934) The following PR fixes the failing validation checks on our CI. ## Motivation and Context ## How Has This Been Tested? ## Breaking Changes ## Types of changes - [ ] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] Documentation update ## Checklist - [ ] I have read the [MCP Documentation](https://modelcontextprotocol.io) - [ ] My code follows the repository's style guidelines - [ ] New and existing tests pass locally - [ ] I have added appropriate error handling - [ ] I have added or updated documentation as needed ## Additional context Signed-off-by: Radoslav Dimitrov --- go.mod | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/go.mod b/go.mod index cc40e31..a631b51 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/modelcontextprotocol/registry -go 1.24.11 +go 1.24.12 require ( cloud.google.com/go/kms v1.25.0 From d33b3f5ece48b2af355cdef2d1a422666007d252 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 5 Feb 2026 12:31:21 +0200 Subject: [PATCH 094/313] build(deps): bump go.opentelemetry.io/otel/metric from 1.39.0 to 1.40.0 (#930) Bumps [go.opentelemetry.io/otel/metric](https://github.com/open-telemetry/opentelemetry-go) from 1.39.0 to 1.40.0.
Changelog

Sourced from go.opentelemetry.io/otel/metric's changelog.

[1.40.0/0.62.0/0.16.0] 2026-02-02

Added

  • Add AlwaysRecord sampler in go.opentelemetry.io/otel/sdk/trace. (#7724)
  • Add Enabled method to all synchronous instrument interfaces (Float64Counter, Float64UpDownCounter, Float64Histogram, Float64Gauge, Int64Counter, Int64UpDownCounter, Int64Histogram, Int64Gauge,) in go.opentelemetry.io/otel/metric. This stabilizes the synchronous instrument enabled feature, allowing users to check if an instrument will process measurements before performing computationally expensive operations. (#7763)
  • Add go.opentelemetry.io/otel/semconv/v1.39.0 package. The package contains semantic conventions from the v1.39.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.38.0. (#7783, #7789)

Changed

  • Improve the concurrent performance of HistogramReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar by 4x. (#7443)
  • Improve the concurrent performance of FixedSizeReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar. (#7447)
  • Improve performance of concurrent histogram measurements in go.opentelemetry.io/otel/sdk/metric. (#7474)
  • Improve performance of concurrent synchronous gauge measurements in go.opentelemetry.io/otel/sdk/metric. (#7478)
  • Add experimental observability metrics in go.opentelemetry.io/otel/exporters/stdout/stdoutmetric. (#7492)
  • Exporter in go.opentelemetry.io/otel/exporters/prometheus ignores metrics with the scope go.opentelemetry.io/contrib/bridges/prometheus. This prevents scrape failures when the Prometheus exporter is misconfigured to get data from the Prometheus bridge. (#7688)
  • Improve performance of concurrent exponential histogram measurements in go.opentelemetry.io/otel/sdk/metric. (#7702)
  • The rpc.grpc.status_code attribute in the experimental metrics emitted from go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc is replaced with the rpc.response.status_code attribute to align with the semantic conventions. (#7854)
  • The rpc.grpc.status_code attribute in the experimental metrics emitted from go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc is replaced with the rpc.response.status_code attribute to align with the semantic conventions. (#7854)

Fixed

  • Fix bad log message when key-value pairs are dropped because of key duplication in go.opentelemetry.io/otel/sdk/log. (#7662)
  • Fix DroppedAttributes on Record in go.opentelemetry.io/otel/sdk/log to not count the non-attribute key-value pairs dropped because of key duplication. (#7662)
  • Fix SetAttributes on Record in go.opentelemetry.io/otel/sdk/log to not log that attributes are dropped when they are actually not dropped. (#7662)
  • Fix missing request.GetBody in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to correctly handle HTTP/2 GOAWAY frame. (#7794)
  • WithHostID detector in go.opentelemetry.io/otel/sdk/resource to use full path for ioreg command on Darwin (macOS). (#7818)

Deprecated

Commits
  • a3a5317 Release v1.40.0 (#7859)
  • 77785da chore(deps): update github/codeql-action action to v4.32.1 (#7858)
  • 56fa1c2 chore(deps): update module github.com/clipperhouse/uax29/v2 to v2.5.0 (#7857)
  • 298cbed Upgrade semconv use to v1.39.0 (#7854)
  • 3264bf1 refactor: modernize code (#7850)
  • fd5d030 chore(deps): update module github.com/grpc-ecosystem/grpc-gateway/v2 to v2.27...
  • 8d3b4cb chore(deps): update actions/cache action to v5.0.3 (#7847)
  • 91f7cad chore(deps): update github.com/timakin/bodyclose digest to 73d1f95 (#7845)
  • fdad1eb chore(deps): update module github.com/grpc-ecosystem/grpc-gateway/v2 to v2.27...
  • c46d3ba chore(deps): update golang.org/x/telemetry digest to fcf36f6 (#7843)
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=go.opentelemetry.io/otel/metric&package-manager=go_modules&previous-version=1.39.0&new-version=1.40.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Radoslav Dimitrov --- go.mod | 6 +++--- go.sum | 12 ++++++------ 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/go.mod b/go.mod index a631b51..ecd7808 100644 --- a/go.mod +++ b/go.mod @@ -17,9 +17,9 @@ require ( github.com/santhosh-tekuri/jsonschema/v5 v5.3.1 github.com/stretchr/testify v1.11.1 go.opentelemetry.io/contrib/instrumentation/runtime v0.64.0 - go.opentelemetry.io/otel v1.39.0 + go.opentelemetry.io/otel v1.40.0 go.opentelemetry.io/otel/exporters/prometheus v0.61.0 - go.opentelemetry.io/otel/metric v1.39.0 + go.opentelemetry.io/otel/metric v1.40.0 go.opentelemetry.io/otel/sdk v1.39.0 go.opentelemetry.io/otel/sdk/metric v1.39.0 golang.org/x/mod v0.32.0 @@ -72,7 +72,7 @@ require ( go.opentelemetry.io/auto/sdk v1.2.1 // indirect go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 // indirect go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect - go.opentelemetry.io/otel/trace v1.39.0 // indirect + go.opentelemetry.io/otel/trace v1.40.0 // indirect go.yaml.in/yaml/v2 v2.4.3 // indirect golang.org/x/crypto v0.45.0 // indirect golang.org/x/net v0.47.0 // indirect diff --git a/go.sum b/go.sum index 866d824..a025354 100644 --- a/go.sum +++ b/go.sum @@ -148,18 +148,18 @@ go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 h1:F7Jx+6h go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0/go.mod h1:UHB22Z8QsdRDrnAtX4PntOl36ajSxcdUMt1sF7Y6E7Q= go.opentelemetry.io/contrib/instrumentation/runtime v0.64.0 h1:/+/+UjlXjFcdDlXxKL1PouzX8Z2Vl0OxolRKeBEgYDw= go.opentelemetry.io/contrib/instrumentation/runtime v0.64.0/go.mod h1:Ldm/PDuzY2DP7IypudopCR3OCOW42NJlN9+mNEroevo= -go.opentelemetry.io/otel v1.39.0 h1:8yPrr/S0ND9QEfTfdP9V+SiwT4E0G7Y5MO7p85nis48= -go.opentelemetry.io/otel v1.39.0/go.mod h1:kLlFTywNWrFyEdH0oj2xK0bFYZtHRYUdv1NklR/tgc8= +go.opentelemetry.io/otel v1.40.0 h1:oA5YeOcpRTXq6NN7frwmwFR0Cn3RhTVZvXsP4duvCms= +go.opentelemetry.io/otel v1.40.0/go.mod h1:IMb+uXZUKkMXdPddhwAHm6UfOwJyh4ct1ybIlV14J0g= go.opentelemetry.io/otel/exporters/prometheus v0.61.0 h1:cCyZS4dr67d30uDyh8etKM2QyDsQ4zC9ds3bdbrVoD0= go.opentelemetry.io/otel/exporters/prometheus v0.61.0/go.mod h1:iivMuj3xpR2DkUrUya3TPS/Z9h3dz7h01GxU+fQBRNg= -go.opentelemetry.io/otel/metric v1.39.0 h1:d1UzonvEZriVfpNKEVmHXbdf909uGTOQjA0HF0Ls5Q0= -go.opentelemetry.io/otel/metric v1.39.0/go.mod h1:jrZSWL33sD7bBxg1xjrqyDjnuzTUB0x1nBERXd7Ftcs= +go.opentelemetry.io/otel/metric v1.40.0 h1:rcZe317KPftE2rstWIBitCdVp89A2HqjkxR3c11+p9g= +go.opentelemetry.io/otel/metric v1.40.0/go.mod h1:ib/crwQH7N3r5kfiBZQbwrTge743UDc7DTFVZrrXnqc= go.opentelemetry.io/otel/sdk v1.39.0 h1:nMLYcjVsvdui1B/4FRkwjzoRVsMK8uL/cj0OyhKzt18= go.opentelemetry.io/otel/sdk v1.39.0/go.mod h1:vDojkC4/jsTJsE+kh+LXYQlbL8CgrEcwmt1ENZszdJE= go.opentelemetry.io/otel/sdk/metric v1.39.0 h1:cXMVVFVgsIf2YL6QkRF4Urbr/aMInf+2WKg+sEJTtB8= go.opentelemetry.io/otel/sdk/metric v1.39.0/go.mod h1:xq9HEVH7qeX69/JnwEfp6fVq5wosJsY1mt4lLfYdVew= -go.opentelemetry.io/otel/trace v1.39.0 h1:2d2vfpEDmCJ5zVYz7ijaJdOF59xLomrvj7bjt6/qCJI= -go.opentelemetry.io/otel/trace v1.39.0/go.mod h1:88w4/PnZSazkGzz/w84VHpQafiU4EtqqlVdxWy+rNOA= +go.opentelemetry.io/otel/trace v1.40.0 h1:WA4etStDttCSYuhwvEa8OP8I5EWu24lkOzp+ZYblVjw= +go.opentelemetry.io/otel/trace v1.40.0/go.mod h1:zeAhriXecNGP/s2SEG3+Y8X9ujcJOTqQ5RgdEJcawiA= go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE= go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0= From 8e0af8d82bd5eda6c0e7cc687bcb27ea6537db14 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 5 Feb 2026 12:31:42 +0200 Subject: [PATCH 095/313] build(deps): bump the actions group across 1 directory with 2 updates (#933) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps the actions group with 2 updates in the / directory: [docker/login-action](https://github.com/docker/login-action) and [anchore/sbom-action](https://github.com/anchore/sbom-action). Updates `docker/login-action` from 3.6.0 to 3.7.0
Release notes

Sourced from docker/login-action's releases.

v3.7.0

Full Changelog: https://github.com/docker/login-action/compare/v3.6.0...v3.7.0

Commits
  • c94ce9f Merge pull request #915 from docker/dependabot/npm_and_yarn/lodash-4.17.23
  • 8339c95 Merge pull request #912 from docker/scope
  • c83e932 build(deps): bump lodash from 4.17.21 to 4.17.23
  • b268aa5 chore: update generated content
  • a603229 documentation for scope input
  • 7567f92 Add scope input to set scopes for the authentication token
  • 0567fa5 Merge pull request #914 from dphi/add-support-for-amazonaws.eu
  • f6ef577 feat: add support for AWS European Sovereign Cloud ECR registries
  • 916386b Merge pull request #911 from crazy-max/ensure-redact
  • 5b3f94a chore: update generated content
  • Additional commits viewable in compare view

Updates `anchore/sbom-action` from 0.22.1 to 0.22.2
Release notes

Sourced from anchore/sbom-action's releases.

v0.22.2

⬆️ Dependencies

Commits
  • 28d7154 chore(deps): bump fast-xml-parser from 5.3.3 to 5.3.4 (#581)
  • 5e35834 chore(deps): update Syft to v1.41.2 (#582)
  • a30a06a chore(deps-dev): bump the dev-dependencies group with 2 updates (#580)
  • 750e84c chore(deps): update Syft to v1.41.1 (#579)
  • 5620efe chore(deps): bump release-drafter/release-drafter from 6.1.0 to 6.2.0 (#578)
  • ec824c7 chore(deps): bump peter-evans/create-pull-request from 8.0.0 to 8.1.0 (#577)
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Radoslav Dimitrov --- .github/workflows/deploy-staging.yml | 2 +- .github/workflows/release.yml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml index c57d5ad..044da1e 100644 --- a/.github/workflows/deploy-staging.yml +++ b/.github/workflows/deploy-staging.yml @@ -34,7 +34,7 @@ jobs: uses: ko-build/setup-ko@v0.9 - name: Log in to Container Registry - uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef + uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 with: registry: ghcr.io username: ${{ github.actor }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 2f32368..1dd5c7c 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -28,7 +28,7 @@ jobs: uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0 - name: Install Syft - uses: anchore/sbom-action/download-syft@v0.22.1 + uses: anchore/sbom-action/download-syft@v0.22.2 - name: Run GoReleaser uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a @@ -57,7 +57,7 @@ jobs: uses: ko-build/setup-ko@v0.9 - name: Log in to Container Registry - uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef + uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 with: registry: ghcr.io username: ${{ github.actor }} From 4248d135b756f097e661373a696cc5ee618f4d2e Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 5 Feb 2026 12:32:15 +0200 Subject: [PATCH 096/313] build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.217.1 to 3.218.0 in /deploy (#924) Bumps [github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from 3.217.1 to 3.218.0.
Release notes

Sourced from github.com/pulumi/pulumi/sdk/v3's releases.

v3.218.0

3.218.0 (2026-01-29)

Features

  • [sdk/nodejs] Add support for the OnError resource hook

Bug Fixes

  • [cli] Allow positional arguments to be passed to convert again

  • [cli/install] Correctly include git forge organizations as schema namespaces when generating SDKs #21579

  • [cli/{install,package}] Correctly grab package names for Python & NodeJS #21577

Changelog

Sourced from github.com/pulumi/pulumi/sdk/v3's changelog.

3.218.0 (2026-01-29)

Features

  • [sdk/nodejs] Add support for the OnError resource hook

Bug Fixes

  • [cli] Allow positional arguments to be passed to convert again

  • [cli/install] Correctly include git forge organizations as schema namespaces when generating SDKs #21579

  • [cli/{install,package}] Correctly grab package names for Python & NodeJS #21577

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/pulumi/pulumi/sdk/v3&package-manager=go_modules&previous-version=3.217.1&new-version=3.218.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Radoslav Dimitrov --- deploy/go.mod | 2 +- deploy/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index 9b7b2ef..e0a1f10 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -5,7 +5,7 @@ go 1.24.11 require ( github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.25.0 - github.com/pulumi/pulumi/sdk/v3 v3.217.1 + github.com/pulumi/pulumi/sdk/v3 v3.218.0 gopkg.in/yaml.v2 v2.4.0 ) diff --git a/deploy/go.sum b/deploy/go.sum index 0f1b835..bd25751 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -158,8 +158,8 @@ github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 h1:w6OnO3d4j5yVf2vpm8OzXFC/xHOEGqt+9 github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1/go.mod h1:UyZyv7hz4knpFx6/Sh+SkZe6hT6sJHtDvw9A0TbvEsk= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.25.0 h1:N1qitmrGomEaCPsblqJHaw8Re0cqqox5V+kHsi4EEtk= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.25.0/go.mod h1:ACBJF6+nzUqDeRK+p2OrvykunyeHfvtbyELc6PB38fk= -github.com/pulumi/pulumi/sdk/v3 v3.217.1 h1:VlDL9+Qf4IlIEKa8QJPIhCJLkIJCMMbE3AYub4ZL9S0= -github.com/pulumi/pulumi/sdk/v3 v3.217.1/go.mod h1:ZOBPPC2NZOZf729AdCX+CctfNc5SN6aJh0bdqNdzQC4= +github.com/pulumi/pulumi/sdk/v3 v3.218.0 h1:kRad759G31wo6GrIM0azt0nPyKw/738P8gmK4ogf5JA= +github.com/pulumi/pulumi/sdk/v3 v3.218.0/go.mod h1:ZOBPPC2NZOZf729AdCX+CctfNc5SN6aJh0bdqNdzQC4= github.com/rivo/uniseg v0.1.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc= github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc= github.com/rivo/uniseg v0.4.4 h1:8TfxU8dW6PdqD27gjM8MVNuicgxIjxpm4K7x4jp8sis= From cffac199b66ef4943050c6f0a75fd80fde345ab6 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 5 Feb 2026 12:32:51 +0200 Subject: [PATCH 097/313] build(deps): bump github.com/golang-jwt/jwt/v5 from 5.3.0 to 5.3.1 (#922) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [github.com/golang-jwt/jwt/v5](https://github.com/golang-jwt/jwt) from 5.3.0 to 5.3.1.
Release notes

Sourced from github.com/golang-jwt/jwt/v5's releases.

v5.3.1

What's Changed

🔐 Features

👒 Dependencies

New Contributors

Full Changelog: https://github.com/golang-jwt/jwt/compare/v5.3.0...v5.3.1

Commits
  • 7ceae61 Add release.yml for changelog configuration
  • dce8e4d Set token.Signature in ParseUnverified (#414)
  • 8889e20 Save signature to Token struct after successful signing (#417)
  • d237f82 ci: update github-actions schedule interval to monthly
  • d8dce95 Bump crate-ci/typos from 1.41.0 to 1.42.1 (#492)
  • e931803 Bump crate-ci/typos from 1.40.0 to 1.41.0 (#490)
  • e6a0afa Bump actions/checkout from 5 to 6 (#487)
  • 9f85c9e Bump crate-ci/typos from 1.39.0 to 1.40.0 (#488)
  • 60a8669 Bump actions/setup-go from 5 to 6 (#469)
  • 76f5828 Remove misleading ParserOptions documentation (#484)
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/golang-jwt/jwt/v5&package-manager=go_modules&previous-version=5.3.0&new-version=5.3.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Radoslav Dimitrov --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index ecd7808..0a3588f 100644 --- a/go.mod +++ b/go.mod @@ -9,7 +9,7 @@ require ( github.com/caarlos0/env/v11 v11.3.1 github.com/coreos/go-oidc/v3 v3.17.0 github.com/danielgtaylor/huma/v2 v2.35.0 - github.com/golang-jwt/jwt/v5 v5.3.0 + github.com/golang-jwt/jwt/v5 v5.3.1 github.com/google/go-containerregistry v0.20.7 github.com/jackc/pgx/v5 v5.8.0 github.com/prometheus/client_golang v1.23.2 diff --git a/go.sum b/go.sum index a025354..5706885 100644 --- a/go.sum +++ b/go.sum @@ -65,8 +65,8 @@ github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag= github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE= -github.com/golang-jwt/jwt/v5 v5.3.0 h1:pv4AsKCKKZuqlgs5sUmn4x8UlGa0kEVt/puTpKx9vvo= -github.com/golang-jwt/jwt/v5 v5.3.0/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE= +github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY= +github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE= github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek= github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps= github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= From 1da48694b993d4ed234691e61caa0e9d8b7a8440 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 5 Feb 2026 12:33:16 +0200 Subject: [PATCH 098/313] build(deps): bump go.opentelemetry.io/otel from 1.39.0 to 1.40.0 (#927) Bumps [go.opentelemetry.io/otel](https://github.com/open-telemetry/opentelemetry-go) from 1.39.0 to 1.40.0.
Changelog

Sourced from go.opentelemetry.io/otel's changelog.

[1.40.0/0.62.0/0.16.0] 2026-02-02

Added

  • Add AlwaysRecord sampler in go.opentelemetry.io/otel/sdk/trace. (#7724)
  • Add Enabled method to all synchronous instrument interfaces (Float64Counter, Float64UpDownCounter, Float64Histogram, Float64Gauge, Int64Counter, Int64UpDownCounter, Int64Histogram, Int64Gauge,) in go.opentelemetry.io/otel/metric. This stabilizes the synchronous instrument enabled feature, allowing users to check if an instrument will process measurements before performing computationally expensive operations. (#7763)
  • Add go.opentelemetry.io/otel/semconv/v1.39.0 package. The package contains semantic conventions from the v1.39.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.38.0. (#7783, #7789)

Changed

  • Improve the concurrent performance of HistogramReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar by 4x. (#7443)
  • Improve the concurrent performance of FixedSizeReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar. (#7447)
  • Improve performance of concurrent histogram measurements in go.opentelemetry.io/otel/sdk/metric. (#7474)
  • Improve performance of concurrent synchronous gauge measurements in go.opentelemetry.io/otel/sdk/metric. (#7478)
  • Add experimental observability metrics in go.opentelemetry.io/otel/exporters/stdout/stdoutmetric. (#7492)
  • Exporter in go.opentelemetry.io/otel/exporters/prometheus ignores metrics with the scope go.opentelemetry.io/contrib/bridges/prometheus. This prevents scrape failures when the Prometheus exporter is misconfigured to get data from the Prometheus bridge. (#7688)
  • Improve performance of concurrent exponential histogram measurements in go.opentelemetry.io/otel/sdk/metric. (#7702)
  • The rpc.grpc.status_code attribute in the experimental metrics emitted from go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc is replaced with the rpc.response.status_code attribute to align with the semantic conventions. (#7854)
  • The rpc.grpc.status_code attribute in the experimental metrics emitted from go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc is replaced with the rpc.response.status_code attribute to align with the semantic conventions. (#7854)

Fixed

  • Fix bad log message when key-value pairs are dropped because of key duplication in go.opentelemetry.io/otel/sdk/log. (#7662)
  • Fix DroppedAttributes on Record in go.opentelemetry.io/otel/sdk/log to not count the non-attribute key-value pairs dropped because of key duplication. (#7662)
  • Fix SetAttributes on Record in go.opentelemetry.io/otel/sdk/log to not log that attributes are dropped when they are actually not dropped. (#7662)
  • Fix missing request.GetBody in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to correctly handle HTTP/2 GOAWAY frame. (#7794)
  • WithHostID detector in go.opentelemetry.io/otel/sdk/resource to use full path for ioreg command on Darwin (macOS). (#7818)

Deprecated

Commits
  • a3a5317 Release v1.40.0 (#7859)
  • 77785da chore(deps): update github/codeql-action action to v4.32.1 (#7858)
  • 56fa1c2 chore(deps): update module github.com/clipperhouse/uax29/v2 to v2.5.0 (#7857)
  • 298cbed Upgrade semconv use to v1.39.0 (#7854)
  • 3264bf1 refactor: modernize code (#7850)
  • fd5d030 chore(deps): update module github.com/grpc-ecosystem/grpc-gateway/v2 to v2.27...
  • 8d3b4cb chore(deps): update actions/cache action to v5.0.3 (#7847)
  • 91f7cad chore(deps): update github.com/timakin/bodyclose digest to 73d1f95 (#7845)
  • fdad1eb chore(deps): update module github.com/grpc-ecosystem/grpc-gateway/v2 to v2.27...
  • c46d3ba chore(deps): update golang.org/x/telemetry digest to fcf36f6 (#7843)
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=go.opentelemetry.io/otel&package-manager=go_modules&previous-version=1.39.0&new-version=1.40.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Radoslav Dimitrov From 7ac2b8de492cec9506504869f1e8fdf06c6b4d72 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 5 Feb 2026 12:45:10 +0200 Subject: [PATCH 099/313] build(deps): bump go.opentelemetry.io/otel/sdk/metric from 1.39.0 to 1.40.0 (#928) Bumps [go.opentelemetry.io/otel/sdk/metric](https://github.com/open-telemetry/opentelemetry-go) from 1.39.0 to 1.40.0.
Changelog

Sourced from go.opentelemetry.io/otel/sdk/metric's changelog.

[1.40.0/0.62.0/0.16.0] 2026-02-02

Added

  • Add AlwaysRecord sampler in go.opentelemetry.io/otel/sdk/trace. (#7724)
  • Add Enabled method to all synchronous instrument interfaces (Float64Counter, Float64UpDownCounter, Float64Histogram, Float64Gauge, Int64Counter, Int64UpDownCounter, Int64Histogram, Int64Gauge,) in go.opentelemetry.io/otel/metric. This stabilizes the synchronous instrument enabled feature, allowing users to check if an instrument will process measurements before performing computationally expensive operations. (#7763)
  • Add go.opentelemetry.io/otel/semconv/v1.39.0 package. The package contains semantic conventions from the v1.39.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.38.0. (#7783, #7789)

Changed

  • Improve the concurrent performance of HistogramReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar by 4x. (#7443)
  • Improve the concurrent performance of FixedSizeReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar. (#7447)
  • Improve performance of concurrent histogram measurements in go.opentelemetry.io/otel/sdk/metric. (#7474)
  • Improve performance of concurrent synchronous gauge measurements in go.opentelemetry.io/otel/sdk/metric. (#7478)
  • Add experimental observability metrics in go.opentelemetry.io/otel/exporters/stdout/stdoutmetric. (#7492)
  • Exporter in go.opentelemetry.io/otel/exporters/prometheus ignores metrics with the scope go.opentelemetry.io/contrib/bridges/prometheus. This prevents scrape failures when the Prometheus exporter is misconfigured to get data from the Prometheus bridge. (#7688)
  • Improve performance of concurrent exponential histogram measurements in go.opentelemetry.io/otel/sdk/metric. (#7702)
  • The rpc.grpc.status_code attribute in the experimental metrics emitted from go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc is replaced with the rpc.response.status_code attribute to align with the semantic conventions. (#7854)
  • The rpc.grpc.status_code attribute in the experimental metrics emitted from go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc is replaced with the rpc.response.status_code attribute to align with the semantic conventions. (#7854)

Fixed

  • Fix bad log message when key-value pairs are dropped because of key duplication in go.opentelemetry.io/otel/sdk/log. (#7662)
  • Fix DroppedAttributes on Record in go.opentelemetry.io/otel/sdk/log to not count the non-attribute key-value pairs dropped because of key duplication. (#7662)
  • Fix SetAttributes on Record in go.opentelemetry.io/otel/sdk/log to not log that attributes are dropped when they are actually not dropped. (#7662)
  • Fix missing request.GetBody in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to correctly handle HTTP/2 GOAWAY frame. (#7794)
  • WithHostID detector in go.opentelemetry.io/otel/sdk/resource to use full path for ioreg command on Darwin (macOS). (#7818)

Deprecated

Commits
  • a3a5317 Release v1.40.0 (#7859)
  • 77785da chore(deps): update github/codeql-action action to v4.32.1 (#7858)
  • 56fa1c2 chore(deps): update module github.com/clipperhouse/uax29/v2 to v2.5.0 (#7857)
  • 298cbed Upgrade semconv use to v1.39.0 (#7854)
  • 3264bf1 refactor: modernize code (#7850)
  • fd5d030 chore(deps): update module github.com/grpc-ecosystem/grpc-gateway/v2 to v2.27...
  • 8d3b4cb chore(deps): update actions/cache action to v5.0.3 (#7847)
  • 91f7cad chore(deps): update github.com/timakin/bodyclose digest to 73d1f95 (#7845)
  • fdad1eb chore(deps): update module github.com/grpc-ecosystem/grpc-gateway/v2 to v2.27...
  • c46d3ba chore(deps): update golang.org/x/telemetry digest to fcf36f6 (#7843)
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=go.opentelemetry.io/otel/sdk/metric&package-manager=go_modules&previous-version=1.39.0&new-version=1.40.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 6 +++--- go.sum | 12 ++++++------ 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/go.mod b/go.mod index 0a3588f..cdf3fc9 100644 --- a/go.mod +++ b/go.mod @@ -20,8 +20,8 @@ require ( go.opentelemetry.io/otel v1.40.0 go.opentelemetry.io/otel/exporters/prometheus v0.61.0 go.opentelemetry.io/otel/metric v1.40.0 - go.opentelemetry.io/otel/sdk v1.39.0 - go.opentelemetry.io/otel/sdk/metric v1.39.0 + go.opentelemetry.io/otel/sdk v1.40.0 + go.opentelemetry.io/otel/sdk/metric v1.40.0 golang.org/x/mod v0.32.0 gopkg.in/yaml.v3 v3.0.1 ) @@ -78,7 +78,7 @@ require ( golang.org/x/net v0.47.0 // indirect golang.org/x/oauth2 v0.33.0 // indirect golang.org/x/sync v0.18.0 // indirect - golang.org/x/sys v0.39.0 // indirect + golang.org/x/sys v0.40.0 // indirect golang.org/x/text v0.31.0 // indirect golang.org/x/time v0.14.0 // indirect google.golang.org/api v0.256.0 // indirect diff --git a/go.sum b/go.sum index 5706885..33af27a 100644 --- a/go.sum +++ b/go.sum @@ -154,10 +154,10 @@ go.opentelemetry.io/otel/exporters/prometheus v0.61.0 h1:cCyZS4dr67d30uDyh8etKM2 go.opentelemetry.io/otel/exporters/prometheus v0.61.0/go.mod h1:iivMuj3xpR2DkUrUya3TPS/Z9h3dz7h01GxU+fQBRNg= go.opentelemetry.io/otel/metric v1.40.0 h1:rcZe317KPftE2rstWIBitCdVp89A2HqjkxR3c11+p9g= go.opentelemetry.io/otel/metric v1.40.0/go.mod h1:ib/crwQH7N3r5kfiBZQbwrTge743UDc7DTFVZrrXnqc= -go.opentelemetry.io/otel/sdk v1.39.0 h1:nMLYcjVsvdui1B/4FRkwjzoRVsMK8uL/cj0OyhKzt18= -go.opentelemetry.io/otel/sdk v1.39.0/go.mod h1:vDojkC4/jsTJsE+kh+LXYQlbL8CgrEcwmt1ENZszdJE= -go.opentelemetry.io/otel/sdk/metric v1.39.0 h1:cXMVVFVgsIf2YL6QkRF4Urbr/aMInf+2WKg+sEJTtB8= -go.opentelemetry.io/otel/sdk/metric v1.39.0/go.mod h1:xq9HEVH7qeX69/JnwEfp6fVq5wosJsY1mt4lLfYdVew= +go.opentelemetry.io/otel/sdk v1.40.0 h1:KHW/jUzgo6wsPh9At46+h4upjtccTmuZCFAc9OJ71f8= +go.opentelemetry.io/otel/sdk v1.40.0/go.mod h1:Ph7EFdYvxq72Y8Li9q8KebuYUr2KoeyHx0DRMKrYBUE= +go.opentelemetry.io/otel/sdk/metric v1.40.0 h1:mtmdVqgQkeRxHgRv4qhyJduP3fYJRMX4AtAlbuWdCYw= +go.opentelemetry.io/otel/sdk/metric v1.40.0/go.mod h1:4Z2bGMf0KSK3uRjlczMOeMhKU2rhUqdWNoKcYrtcBPg= go.opentelemetry.io/otel/trace v1.40.0 h1:WA4etStDttCSYuhwvEa8OP8I5EWu24lkOzp+ZYblVjw= go.opentelemetry.io/otel/trace v1.40.0/go.mod h1:zeAhriXecNGP/s2SEG3+Y8X9ujcJOTqQ5RgdEJcawiA= go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= @@ -176,8 +176,8 @@ golang.org/x/sync v0.18.0 h1:kr88TuHDroi+UVf+0hZnirlk8o8T+4MrK6mr60WkH/I= golang.org/x/sync v0.18.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI= golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.39.0 h1:CvCKL8MeisomCi6qNZ+wbb0DN9E5AATixKsvNtMoMFk= -golang.org/x/sys v0.39.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= +golang.org/x/sys v0.40.0 h1:DBZZqJ2Rkml6QMQsZywtnjnnGvHza6BTfYFWY9kjEWQ= +golang.org/x/sys v0.40.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= golang.org/x/text v0.31.0 h1:aC8ghyu4JhP8VojJ2lEHBnochRno1sgL6nEi9WGFGMM= golang.org/x/text v0.31.0/go.mod h1:tKRAlv61yKIjGGHX/4tP1LTbc13YSec1pxVEWXzfoeM= golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI= From 2959e0f9c1e299276290be41ffe8085c242b98f6 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 5 Feb 2026 12:45:33 +0200 Subject: [PATCH 100/313] build(deps): bump go.opentelemetry.io/otel/sdk from 1.39.0 to 1.40.0 (#929) Bumps [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go) from 1.39.0 to 1.40.0.
Changelog

Sourced from go.opentelemetry.io/otel/sdk's changelog.

[1.40.0/0.62.0/0.16.0] 2026-02-02

Added

  • Add AlwaysRecord sampler in go.opentelemetry.io/otel/sdk/trace. (#7724)
  • Add Enabled method to all synchronous instrument interfaces (Float64Counter, Float64UpDownCounter, Float64Histogram, Float64Gauge, Int64Counter, Int64UpDownCounter, Int64Histogram, Int64Gauge,) in go.opentelemetry.io/otel/metric. This stabilizes the synchronous instrument enabled feature, allowing users to check if an instrument will process measurements before performing computationally expensive operations. (#7763)
  • Add go.opentelemetry.io/otel/semconv/v1.39.0 package. The package contains semantic conventions from the v1.39.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.38.0. (#7783, #7789)

Changed

  • Improve the concurrent performance of HistogramReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar by 4x. (#7443)
  • Improve the concurrent performance of FixedSizeReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar. (#7447)
  • Improve performance of concurrent histogram measurements in go.opentelemetry.io/otel/sdk/metric. (#7474)
  • Improve performance of concurrent synchronous gauge measurements in go.opentelemetry.io/otel/sdk/metric. (#7478)
  • Add experimental observability metrics in go.opentelemetry.io/otel/exporters/stdout/stdoutmetric. (#7492)
  • Exporter in go.opentelemetry.io/otel/exporters/prometheus ignores metrics with the scope go.opentelemetry.io/contrib/bridges/prometheus. This prevents scrape failures when the Prometheus exporter is misconfigured to get data from the Prometheus bridge. (#7688)
  • Improve performance of concurrent exponential histogram measurements in go.opentelemetry.io/otel/sdk/metric. (#7702)
  • The rpc.grpc.status_code attribute in the experimental metrics emitted from go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc is replaced with the rpc.response.status_code attribute to align with the semantic conventions. (#7854)
  • The rpc.grpc.status_code attribute in the experimental metrics emitted from go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc is replaced with the rpc.response.status_code attribute to align with the semantic conventions. (#7854)

Fixed

  • Fix bad log message when key-value pairs are dropped because of key duplication in go.opentelemetry.io/otel/sdk/log. (#7662)
  • Fix DroppedAttributes on Record in go.opentelemetry.io/otel/sdk/log to not count the non-attribute key-value pairs dropped because of key duplication. (#7662)
  • Fix SetAttributes on Record in go.opentelemetry.io/otel/sdk/log to not log that attributes are dropped when they are actually not dropped. (#7662)
  • Fix missing request.GetBody in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to correctly handle HTTP/2 GOAWAY frame. (#7794)
  • WithHostID detector in go.opentelemetry.io/otel/sdk/resource to use full path for ioreg command on Darwin (macOS). (#7818)

Deprecated

Commits
  • a3a5317 Release v1.40.0 (#7859)
  • 77785da chore(deps): update github/codeql-action action to v4.32.1 (#7858)
  • 56fa1c2 chore(deps): update module github.com/clipperhouse/uax29/v2 to v2.5.0 (#7857)
  • 298cbed Upgrade semconv use to v1.39.0 (#7854)
  • 3264bf1 refactor: modernize code (#7850)
  • fd5d030 chore(deps): update module github.com/grpc-ecosystem/grpc-gateway/v2 to v2.27...
  • 8d3b4cb chore(deps): update actions/cache action to v5.0.3 (#7847)
  • 91f7cad chore(deps): update github.com/timakin/bodyclose digest to 73d1f95 (#7845)
  • fdad1eb chore(deps): update module github.com/grpc-ecosystem/grpc-gateway/v2 to v2.27...
  • c46d3ba chore(deps): update golang.org/x/telemetry digest to fcf36f6 (#7843)
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=go.opentelemetry.io/otel/sdk&package-manager=go_modules&previous-version=1.39.0&new-version=1.40.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> From 545c4c8c15484d349de484d275da4c35ca066f52 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 6 Feb 2026 12:01:52 +0200 Subject: [PATCH 101/313] build(deps): bump go.opentelemetry.io/otel/exporters/prometheus from 0.61.0 to 0.62.0 (#939) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [go.opentelemetry.io/otel/exporters/prometheus](https://github.com/open-telemetry/opentelemetry-go) from 0.61.0 to 0.62.0.
Release notes

Sourced from go.opentelemetry.io/otel/exporters/prometheus's releases.

Release v1.40.0/v0.62.0/v0.16.0

Overview

Added

  • Add Enabled method to all synchronous instrument interfaces (Float64Counter, Float64UpDownCounter, Float64Histogram, Float64Gauge, Int64Counter, Int64UpDownCounter, Int64Histogram, Int64Gauge,) in go.opentelemetry.io/otel/metric. This stabilizes the synchronous instrument enabled feature, allowing users to check if an instrument will process measurements before performing computationally expensive operations. (#7763)
  • Add AlwaysRecord sampler in go.opentelemetry.io/otel/sdk/trace. (#7724)
  • Add go.opentelemetry.io/otel/semconv/v1.39.0 package. The package contains semantic conventions from the v1.39.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.38.0. (#7783, #7789)

Changed

  • Exporter in go.opentelemetry.io/otel/exporters/prometheus ignores metrics with the scope go.opentelemetry.io/contrib/bridges/prometheus. This prevents scrape failures when the Prometheus exporter is misconfigured to get data from the Prometheus bridge. (#7688)
  • Improve performance of concurrent histogram measurements in go.opentelemetry.io/otel/sdk/metric. (#7474)
  • Add experimental observability metrics in go.opentelemetry.io/otel/exporters/stdout/stdoutmetric. (#7492)
  • Improve the concurrent performance of HistogramReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar by 4x. (#7443)
  • Improve performance of concurrent synchronous gauge measurements in go.opentelemetry.io/otel/sdk/metric. (#7478)
  • Improve performance of concurrent exponential histogram measurements in go.opentelemetry.io/otel/sdk/metric. (#7702)
  • Improve the concurrent performance of FixedSizeReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar. (#7447)
  • The rpc.grpc.status_code attribute in the experimental metrics emitted from go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc is replaced with the rpc.response.status_code attribute to align with the semantic conventions. (#7854)
  • The rpc.grpc.status_code attribute in the experimental metrics emitted from go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc is replaced with the rpc.response.status_code attribute to align with the semantic conventions. (#7854)

Fixed

  • Fix bad log message when key-value pairs are dropped because of key duplication in go.opentelemetry.io/otel/sdk/log. (#7662)
  • Fix DroppedAttributes on Record in go.opentelemetry.io/otel/sdk/log to not count the non-attribute key-value pairs dropped because of key duplication. (#7662)
  • Fix SetAttributes on Record in go.opentelemetry.io/otel/sdk/log to not log that attributes are dropped when they are actually not dropped. (#7662)
  • WithHostID detector in go.opentelemetry.io/otel/sdk/resource to use full path for ioreg command on Darwin (macOS). (#7818)
  • Fix missing request.GetBody in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to correctly handle HTTP2 GOAWAY frame. (#7794)

Deprecated

What's Changed

... (truncated)

Changelog

Sourced from go.opentelemetry.io/otel/exporters/prometheus's changelog.

[1.40.0/0.62.0/0.16.0] 2026-02-02

Added

  • Add AlwaysRecord sampler in go.opentelemetry.io/otel/sdk/trace. (#7724)
  • Add Enabled method to all synchronous instrument interfaces (Float64Counter, Float64UpDownCounter, Float64Histogram, Float64Gauge, Int64Counter, Int64UpDownCounter, Int64Histogram, Int64Gauge,) in go.opentelemetry.io/otel/metric. This stabilizes the synchronous instrument enabled feature, allowing users to check if an instrument will process measurements before performing computationally expensive operations. (#7763)
  • Add go.opentelemetry.io/otel/semconv/v1.39.0 package. The package contains semantic conventions from the v1.39.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.38.0. (#7783, #7789)

Changed

  • Improve the concurrent performance of HistogramReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar by 4x. (#7443)
  • Improve the concurrent performance of FixedSizeReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar. (#7447)
  • Improve performance of concurrent histogram measurements in go.opentelemetry.io/otel/sdk/metric. (#7474)
  • Improve performance of concurrent synchronous gauge measurements in go.opentelemetry.io/otel/sdk/metric. (#7478)
  • Add experimental observability metrics in go.opentelemetry.io/otel/exporters/stdout/stdoutmetric. (#7492)
  • Exporter in go.opentelemetry.io/otel/exporters/prometheus ignores metrics with the scope go.opentelemetry.io/contrib/bridges/prometheus. This prevents scrape failures when the Prometheus exporter is misconfigured to get data from the Prometheus bridge. (#7688)
  • Improve performance of concurrent exponential histogram measurements in go.opentelemetry.io/otel/sdk/metric. (#7702)
  • The rpc.grpc.status_code attribute in the experimental metrics emitted from go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc is replaced with the rpc.response.status_code attribute to align with the semantic conventions. (#7854)
  • The rpc.grpc.status_code attribute in the experimental metrics emitted from go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc is replaced with the rpc.response.status_code attribute to align with the semantic conventions. (#7854)

Fixed

  • Fix bad log message when key-value pairs are dropped because of key duplication in go.opentelemetry.io/otel/sdk/log. (#7662)
  • Fix DroppedAttributes on Record in go.opentelemetry.io/otel/sdk/log to not count the non-attribute key-value pairs dropped because of key duplication. (#7662)
  • Fix SetAttributes on Record in go.opentelemetry.io/otel/sdk/log to not log that attributes are dropped when they are actually not dropped. (#7662)
  • Fix missing request.GetBody in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to correctly handle HTTP/2 GOAWAY frame. (#7794)
  • WithHostID detector in go.opentelemetry.io/otel/sdk/resource to use full path for ioreg command on Darwin (macOS). (#7818)

Deprecated

Commits
  • a3a5317 Release v1.40.0 (#7859)
  • 77785da chore(deps): update github/codeql-action action to v4.32.1 (#7858)
  • 56fa1c2 chore(deps): update module github.com/clipperhouse/uax29/v2 to v2.5.0 (#7857)
  • 298cbed Upgrade semconv use to v1.39.0 (#7854)
  • 3264bf1 refactor: modernize code (#7850)
  • fd5d030 chore(deps): update module github.com/grpc-ecosystem/grpc-gateway/v2 to v2.27...
  • 8d3b4cb chore(deps): update actions/cache action to v5.0.3 (#7847)
  • 91f7cad chore(deps): update github.com/timakin/bodyclose digest to 73d1f95 (#7845)
  • fdad1eb chore(deps): update module github.com/grpc-ecosystem/grpc-gateway/v2 to v2.27...
  • c46d3ba chore(deps): update golang.org/x/telemetry digest to fcf36f6 (#7843)
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=go.opentelemetry.io/otel/exporters/prometheus&package-manager=go_modules&previous-version=0.61.0&new-version=0.62.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 16 ++++++++-------- go.sum | 32 ++++++++++++++++---------------- 2 files changed, 24 insertions(+), 24 deletions(-) diff --git a/go.mod b/go.mod index cdf3fc9..6eea9c0 100644 --- a/go.mod +++ b/go.mod @@ -18,7 +18,7 @@ require ( github.com/stretchr/testify v1.11.1 go.opentelemetry.io/contrib/instrumentation/runtime v0.64.0 go.opentelemetry.io/otel v1.40.0 - go.opentelemetry.io/otel/exporters/prometheus v0.61.0 + go.opentelemetry.io/otel/exporters/prometheus v0.62.0 go.opentelemetry.io/otel/metric v1.40.0 go.opentelemetry.io/otel/sdk v1.40.0 go.opentelemetry.io/otel/sdk/metric v1.40.0 @@ -64,7 +64,7 @@ require ( github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect github.com/pmezard/go-difflib v1.0.0 // indirect github.com/prometheus/client_model v0.6.2 // indirect - github.com/prometheus/common v0.67.4 // indirect + github.com/prometheus/common v0.67.5 // indirect github.com/prometheus/otlptranslator v1.0.0 // indirect github.com/prometheus/procfs v0.19.2 // indirect github.com/sirupsen/logrus v1.9.3 // indirect @@ -74,17 +74,17 @@ require ( go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect go.opentelemetry.io/otel/trace v1.40.0 // indirect go.yaml.in/yaml/v2 v2.4.3 // indirect - golang.org/x/crypto v0.45.0 // indirect - golang.org/x/net v0.47.0 // indirect - golang.org/x/oauth2 v0.33.0 // indirect - golang.org/x/sync v0.18.0 // indirect + golang.org/x/crypto v0.46.0 // indirect + golang.org/x/net v0.48.0 // indirect + golang.org/x/oauth2 v0.34.0 // indirect + golang.org/x/sync v0.19.0 // indirect golang.org/x/sys v0.40.0 // indirect - golang.org/x/text v0.31.0 // indirect + golang.org/x/text v0.32.0 // indirect golang.org/x/time v0.14.0 // indirect google.golang.org/api v0.256.0 // indirect google.golang.org/genproto v0.0.0-20250603155806-513f23925822 // indirect google.golang.org/genproto/googleapis/api v0.0.0-20251111163417-95abcf5c77ba // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20251103181224-f26f9409b101 // indirect google.golang.org/grpc v1.76.0 // indirect - google.golang.org/protobuf v1.36.10 // indirect + google.golang.org/protobuf v1.36.11 // indirect ) diff --git a/go.sum b/go.sum index 33af27a..0666661 100644 --- a/go.sum +++ b/go.sum @@ -119,8 +119,8 @@ github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg= github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk= github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE= -github.com/prometheus/common v0.67.4 h1:yR3NqWO1/UyO1w2PhUvXlGQs/PtFmoveVO0KZ4+Lvsc= -github.com/prometheus/common v0.67.4/go.mod h1:gP0fq6YjjNCLssJCQp0yk4M8W6ikLURwkdd/YKtTbyI= +github.com/prometheus/common v0.67.5 h1:pIgK94WWlQt1WLwAC5j2ynLaBRDiinoAb86HZHTUGI4= +github.com/prometheus/common v0.67.5/go.mod h1:SjE/0MzDEEAyrdr5Gqc6G+sXI67maCxzaT3A2+HqjUw= github.com/prometheus/otlptranslator v1.0.0 h1:s0LJW/iN9dkIH+EnhiD3BlkkP5QVIUVEoIwkU+A6qos= github.com/prometheus/otlptranslator v1.0.0/go.mod h1:vRYWnXvI6aWGpsdY/mOT/cbeVRBlPWtBNDb7kGR3uKM= github.com/prometheus/procfs v0.19.2 h1:zUMhqEW66Ex7OXIiDkll3tl9a1ZdilUOd/F6ZXw4Vws= @@ -150,8 +150,8 @@ go.opentelemetry.io/contrib/instrumentation/runtime v0.64.0 h1:/+/+UjlXjFcdDlXxK go.opentelemetry.io/contrib/instrumentation/runtime v0.64.0/go.mod h1:Ldm/PDuzY2DP7IypudopCR3OCOW42NJlN9+mNEroevo= go.opentelemetry.io/otel v1.40.0 h1:oA5YeOcpRTXq6NN7frwmwFR0Cn3RhTVZvXsP4duvCms= go.opentelemetry.io/otel v1.40.0/go.mod h1:IMb+uXZUKkMXdPddhwAHm6UfOwJyh4ct1ybIlV14J0g= -go.opentelemetry.io/otel/exporters/prometheus v0.61.0 h1:cCyZS4dr67d30uDyh8etKM2QyDsQ4zC9ds3bdbrVoD0= -go.opentelemetry.io/otel/exporters/prometheus v0.61.0/go.mod h1:iivMuj3xpR2DkUrUya3TPS/Z9h3dz7h01GxU+fQBRNg= +go.opentelemetry.io/otel/exporters/prometheus v0.62.0 h1:krvC4JMfIOVdEuNPTtQ0ZjCiXrybhv+uOHMfHRmnvVo= +go.opentelemetry.io/otel/exporters/prometheus v0.62.0/go.mod h1:fgOE6FM/swEnsVQCqCnbOfRV4tOnWPg7bVeo4izBuhQ= go.opentelemetry.io/otel/metric v1.40.0 h1:rcZe317KPftE2rstWIBitCdVp89A2HqjkxR3c11+p9g= go.opentelemetry.io/otel/metric v1.40.0/go.mod h1:ib/crwQH7N3r5kfiBZQbwrTge743UDc7DTFVZrrXnqc= go.opentelemetry.io/otel/sdk v1.40.0 h1:KHW/jUzgo6wsPh9At46+h4upjtccTmuZCFAc9OJ71f8= @@ -164,22 +164,22 @@ go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE= go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0= go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8= -golang.org/x/crypto v0.45.0 h1:jMBrvKuj23MTlT0bQEOBcAE0mjg8mK9RXFhRH6nyF3Q= -golang.org/x/crypto v0.45.0/go.mod h1:XTGrrkGJve7CYK7J8PEww4aY7gM3qMCElcJQ8n8JdX4= +golang.org/x/crypto v0.46.0 h1:cKRW/pmt1pKAfetfu+RCEvjvZkA9RimPbh7bhFjGVBU= +golang.org/x/crypto v0.46.0/go.mod h1:Evb/oLKmMraqjZ2iQTwDwvCtJkczlDuTmdJXoZVzqU0= golang.org/x/mod v0.32.0 h1:9F4d3PHLljb6x//jOyokMv3eX+YDeepZSEo3mFJy93c= golang.org/x/mod v0.32.0/go.mod h1:SgipZ/3h2Ci89DlEtEXWUk/HteuRin+HHhN+WbNhguU= -golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY= -golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU= -golang.org/x/oauth2 v0.33.0 h1:4Q+qn+E5z8gPRJfmRy7C2gGG3T4jIprK6aSYgTXGRpo= -golang.org/x/oauth2 v0.33.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA= -golang.org/x/sync v0.18.0 h1:kr88TuHDroi+UVf+0hZnirlk8o8T+4MrK6mr60WkH/I= -golang.org/x/sync v0.18.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI= +golang.org/x/net v0.48.0 h1:zyQRTTrjc33Lhh0fBgT/H3oZq9WuvRR5gPC70xpDiQU= +golang.org/x/net v0.48.0/go.mod h1:+ndRgGjkh8FGtu1w1FGbEC31if4VrNVMuKTgcAAnQRY= +golang.org/x/oauth2 v0.34.0 h1:hqK/t4AKgbqWkdkcAeI8XLmbK+4m4G5YeQRrmiotGlw= +golang.org/x/oauth2 v0.34.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA= +golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4= +golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI= golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.40.0 h1:DBZZqJ2Rkml6QMQsZywtnjnnGvHza6BTfYFWY9kjEWQ= golang.org/x/sys v0.40.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= -golang.org/x/text v0.31.0 h1:aC8ghyu4JhP8VojJ2lEHBnochRno1sgL6nEi9WGFGMM= -golang.org/x/text v0.31.0/go.mod h1:tKRAlv61yKIjGGHX/4tP1LTbc13YSec1pxVEWXzfoeM= +golang.org/x/text v0.32.0 h1:ZD01bjUt1FQ9WJ0ClOL5vxgxOI/sVCNgX1YtKwcY0mU= +golang.org/x/text v0.32.0/go.mod h1:o/rUWzghvpD5TXrTIBuJU77MTaN0ljMWE47kxGJQ7jY= golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI= golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4= gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk= @@ -194,8 +194,8 @@ google.golang.org/genproto/googleapis/rpc v0.0.0-20251103181224-f26f9409b101 h1: google.golang.org/genproto/googleapis/rpc v0.0.0-20251103181224-f26f9409b101/go.mod h1:7i2o+ce6H/6BluujYR+kqX3GKH+dChPTQU19wjRPiGk= google.golang.org/grpc v1.76.0 h1:UnVkv1+uMLYXoIz6o7chp59WfQUYA2ex/BXQ9rHZu7A= google.golang.org/grpc v1.76.0/go.mod h1:Ju12QI8M6iQJtbcsV+awF5a4hfJMLi4X0JLo94ULZ6c= -google.golang.org/protobuf v1.36.10 h1:AYd7cD/uASjIL6Q9LiTjz8JLcrh/88q5UObnmY3aOOE= -google.golang.org/protobuf v1.36.10/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= +google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE= +google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q= From 3b0341d89ad1f81df89ed3a546d05d522037bd3d Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 6 Feb 2026 12:02:48 +0200 Subject: [PATCH 102/313] build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.218.0 to 3.219.0 in /deploy (#941) Bumps [github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from 3.218.0 to 3.219.0.
Release notes

Sourced from github.com/pulumi/pulumi/sdk/v3's releases.

v3.219.0

3.219.0 (2026-02-05)

Features

  • [cli] Allow setting requiredPulumiVersion in Pulumi.yaml #21627

  • [cli/{install,package}] Allow using private packages as local dependencies in components #21664

  • [cli/policy] Add pulumi policy install command #21652

  • [engine] Run analyzer calls in parallel #21631

  • [programgen/dotnet] Codegen RequirePulumiVersion for Dotnet #21621

  • [sdk/python] Add support for the OnError resource hook #21644

  • [sdk/python] Add support for protobuf 6 #21647

Bug Fixes

  • [cli] Allow positional arguments to be passed to convert again #21604 #21614

  • [engine] Download/install required policy packs in parallel with plugins #21651

  • [cli/package] Correctly install packages that depend on other packages for pulumi package add and pulumi package get-schema. #21321

  • [programgen/python] Fix panic when ranging over a resource output that is an array of objects #21679

  • [sdk/python] Fix issue with generic subclasses of dynamic.Resource #21670

Miscellaneous

  • [sdk/python] Relax pip version constraint

... (truncated)

Changelog

Sourced from github.com/pulumi/pulumi/sdk/v3's changelog.

3.219.0 (2026-02-05)

Features

  • [cli] Allow setting requiredPulumiVersion in Pulumi.yaml #21627

  • [cli/{install,package}] Allow using private packages as local dependencies in components #21664

  • [cli/policy] Add pulumi policy install command #21652

  • [engine] Run analyzer calls in parallel #21631

  • [programgen/dotnet] Codegen RequirePulumiVersion for Dotnet #21621

  • [sdk/python] Add support for the OnError resource hook #21644

  • [sdk/python] Add support for protobuf 6 #21647

Bug Fixes

  • [cli] Allow positional arguments to be passed to convert again #21604 #21614

  • [engine] Download/install required policy packs in parallel with plugins #21651

  • [cli/package] Correctly install packages that depend on other packages for pulumi package add and pulumi package get-schema. #21321

  • [programgen/python] Fix panic when ranging over a resource output that is an array of objects #21679

  • [sdk/python] Fix issue with generic subclasses of dynamic.Resource #21670

Miscellaneous

  • [sdk/python] Relax pip version constraint #21639
Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/pulumi/pulumi/sdk/v3&package-manager=go_modules&previous-version=3.218.0&new-version=3.219.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- deploy/go.mod | 2 +- deploy/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index e0a1f10..cbcd3a0 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -5,7 +5,7 @@ go 1.24.11 require ( github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.25.0 - github.com/pulumi/pulumi/sdk/v3 v3.218.0 + github.com/pulumi/pulumi/sdk/v3 v3.219.0 gopkg.in/yaml.v2 v2.4.0 ) diff --git a/deploy/go.sum b/deploy/go.sum index bd25751..f90bd52 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -158,8 +158,8 @@ github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 h1:w6OnO3d4j5yVf2vpm8OzXFC/xHOEGqt+9 github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1/go.mod h1:UyZyv7hz4knpFx6/Sh+SkZe6hT6sJHtDvw9A0TbvEsk= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.25.0 h1:N1qitmrGomEaCPsblqJHaw8Re0cqqox5V+kHsi4EEtk= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.25.0/go.mod h1:ACBJF6+nzUqDeRK+p2OrvykunyeHfvtbyELc6PB38fk= -github.com/pulumi/pulumi/sdk/v3 v3.218.0 h1:kRad759G31wo6GrIM0azt0nPyKw/738P8gmK4ogf5JA= -github.com/pulumi/pulumi/sdk/v3 v3.218.0/go.mod h1:ZOBPPC2NZOZf729AdCX+CctfNc5SN6aJh0bdqNdzQC4= +github.com/pulumi/pulumi/sdk/v3 v3.219.0 h1:OwTSwk1ZuOI4hQUdSccWuIAuqs4fL/FcppesPOAKHQ8= +github.com/pulumi/pulumi/sdk/v3 v3.219.0/go.mod h1:ZOBPPC2NZOZf729AdCX+CctfNc5SN6aJh0bdqNdzQC4= github.com/rivo/uniseg v0.1.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc= github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc= github.com/rivo/uniseg v0.4.4 h1:8TfxU8dW6PdqD27gjM8MVNuicgxIjxpm4K7x4jp8sis= From bf628f464d6dbf2f6b70f2a9e7dc582a136760f3 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Sun, 8 Feb 2026 23:32:28 +0200 Subject: [PATCH 103/313] Group otel dependencies in a single dependabot PR (#935) ## Motivation and Context The following PR groups all otel deps in a single dependabot PR as usually they are spread across 4-5 separate ones whenever there's a new version. ## How Has This Been Tested? ## Breaking Changes ## Types of changes - [ ] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] Documentation update ## Checklist - [ ] I have read the [MCP Documentation](https://modelcontextprotocol.io) - [ ] My code follows the repository's style guidelines - [ ] New and existing tests pass locally - [ ] I have added appropriate error handling - [ ] I have added or updated documentation as needed ## Additional context Signed-off-by: Radoslav Dimitrov --- .github/dependabot.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 69e2da5..ea28507 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -2,10 +2,18 @@ version: 2 updates: - package-ecosystem: gomod directory: / + groups: + opentelemetry: + patterns: + - "go.opentelemetry.io/*" schedule: interval: daily - package-ecosystem: gomod directory: /deploy + groups: + opentelemetry: + patterns: + - "go.opentelemetry.io/*" schedule: interval: daily - package-ecosystem: github-actions From 5962f9ea75887d9a9e7ea35de0ab000ec6735fbb Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Mon, 9 Feb 2026 11:07:21 +0200 Subject: [PATCH 104/313] Resolve vulnerability warnings by bumping Go to 1.24.13 (#938) ## Motivation and Context ## How Has This Been Tested? ## Breaking Changes ## Types of changes - [ ] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] Documentation update ## Checklist - [ ] I have read the [MCP Documentation](https://modelcontextprotocol.io) - [ ] My code follows the repository's style guidelines - [ ] New and existing tests pass locally - [ ] I have added appropriate error handling - [ ] I have added or updated documentation as needed ## Additional context Signed-off-by: Radoslav Dimitrov --- go.mod | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/go.mod b/go.mod index 6eea9c0..d3c1b33 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/modelcontextprotocol/registry -go 1.24.12 +go 1.24.13 require ( cloud.google.com/go/kms v1.25.0 From 541a6c61fae160b4e91b00dde92f477a7eb774d6 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 9 Feb 2026 11:11:06 +0200 Subject: [PATCH 105/313] build(deps): bump go.opentelemetry.io/contrib/instrumentation/runtime from 0.64.0 to 0.65.0 (#940) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [go.opentelemetry.io/contrib/instrumentation/runtime](https://github.com/open-telemetry/opentelemetry-go-contrib) from 0.64.0 to 0.65.0.
Release notes

Sourced from go.opentelemetry.io/contrib/instrumentation/runtime's releases.

Release v1.40.0/v2.2.0/v0.65.0/v0.34.0/v0.20.0/v0.15.0/v0.13.0/v0.12.0

Overview

Added

  • WithMetricAttributesFn option in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc to define dynamic attributes on auto-instrumented metrics. (#8191)
  • Add support for configuring propagators in go.opentelemetry.io/contrib/otelconf. (#8281)
  • Add const Version in go.opentelemetry.io/contrib/bridges/prometheus. (#8401)
  • Add const Version in go.opentelemetry.io/contrib/otelconf. (#8461)
  • Add const Version in go.opentelemetry.io/contrib/bridges/otellogr. (#8477)
  • Add const Version in go.opentelemetry.io/contrib/bridges/otellogrus. (#8485)
  • Add const Version in go.opentelemetry.io/contrib/bridges/otelslog. (#8480)

Fixed

  • Fix panic when passing nil TracerProvider or MeterProvider to WithTracerProvider or WithMeterProvider in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc. (#8323)
  • Transport in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp now supports reading request body multiple times for subsequent requests that reuse http.Request. (#8352)

Changed

  • The Version() function in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp has been replaced by const Version. (#8142)
  • The Version() function in go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace has been replaced by const Version. (#8302)
  • The Version() function in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc has been replaced by const Version. (#8317)
  • The Version() function in go.opentelemetry.io/contrib/zpages has been replaced by const Version. (#8325)
  • The Version() function in go.opentelemetry.io/contrib/instrumentation/go.mongodb.org/mongo-driver/mongo/otelmongo has been replaced by const Version. (#8340)
  • The Version() function in go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin has been replaced by const Version. (#8341)
  • The Version() function in go.opentelemetry.io/contrib/instrumentation/runtime has been replaced by const Version string. (#8349)
  • The Version() function in go.opentelemetry.io/contrib/instrumentation/github.com/aws/aws-sdk-go-v2/otelaws has been replaced by const Version. (#8356)
  • The Version() function in go.opentelemetry.io/contrib/instrumentation/github.com/aws/aws-lambda-go/otellambda has been replaced by const Version. (#8357)
  • The Version() function in go.opentelemetry.io/contrib/instrumentation/host has been replaced by const Version. (#8358)
  • The Version() function in go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful has been replaced by const Version. (#8360)
  • The Version() function in go.opentelemetry.io/contrib/propagators/opencensus has been replaced by const Version. (#8361)
  • The Version() function in go.opentelemetry.io/contrib/instrumentation/github.com/labstack/echo/otelecho has been replaced by const Version. (#8365)
  • The Version() function in go.opentelemetry.io/contrib/samplers/probability/consistent has been replaced by const Version. (#8366)
  • The Version() function in go.opentelemetry.io/contrib/instrumentation/go.mongodb.org/mongo-driver/v2/mongo/otelmongo has been replaced by const Version. (#8370)
  • Set error.type attribute instead of adding exception span events in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp. (#8386)
  • Set error.type attribute instead of adding exception span events in go.opentelemetry.io/contrib/instrumentation/github.com/aws/aws-sdk-go-v2/otelaws. (#8386)
  • Upgrade go.opentelemetry.io/otel/semconv to v1.39.0, including updates across all instrumentation and detector modules. (#8404)
    • The semantic conventions v1.39.0 release introduces breaking changes, including:
      • rpc span and metric attributes have been renamed to align with naming guidelines:
        • rpc.system → rpc.system.name (values: grpc, grpc_web, connectrpc, thrift, dubbo, etc.)
        • rpc.method and rpc.service have been merged into a fully-qualified rpc.method attribute
        • rpc.client|server.duration → rpc.client|server.call.duration (unit changed to seconds)
        • rpc.grpc.request.metadata/rpc.grpc.response.metadata → rpc.request.metadata/rpc.response.metadata
        • rpc.grpc.status_code → deprecated in favor of rpc.response.status_code
        • rpc.jsonrpc.request_id → jsonrpc.request.id
        • rpc.jsonrpc.version → jsonrpc.protocol.version
      • system and process metrics:
        • *.linux.memory metrics renamed to *.memory.linux
        • system.process.status → process.state

... (truncated)

Changelog

Sourced from go.opentelemetry.io/contrib/instrumentation/runtime's changelog.

[1.40.0/2.2.0/0.65.0/0.34.0/0.20.0/0.15.0/0.13.0/0.12.0] - 2026-02-02

Added

  • WithMetricAttributesFn option in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc to define dynamic attributes on auto-instrumented metrics. (#8191)
  • Add support for configuring propagators in go.opentelemetry.io/contrib/otelconf. (#8281)
  • Add const Version in go.opentelemetry.io/contrib/bridges/prometheus. (#8401)
  • Add const Version in go.opentelemetry.io/contrib/otelconf. (#8461)
  • Add const Version in go.opentelemetry.io/contrib/bridges/otellogr. (#8477)
  • Add const Version in go.opentelemetry.io/contrib/bridges/otellogrus. (#8485)
  • Add const Version in go.opentelemetry.io/contrib/bridges/otelslog. (#8480)

Fixed

  • Fix panic when passing nil TracerProvider or MeterProvider to WithTracerProvider or WithMeterProvider in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc. (#8323)
  • Transport in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp now supports reading request body multiple times for subsequent requests that reuse http.Request. (#8352)

Changed

  • The Version() function in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp has been replaced by const Version. (#8142)
  • The Version() function in go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace has been replaced by const Version. (#8302)
  • The Version() function in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc has been replaced by const Version. (#8317)
  • The Version() function in go.opentelemetry.io/contrib/zpages has been replaced by const Version. (#8325)
  • The Version() function in go.opentelemetry.io/contrib/instrumentation/go.mongodb.org/mongo-driver/mongo/otelmongo has been replaced by const Version. (#8340)
  • The Version() function in go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin has been replaced by const Version. (#8341)
  • The Version() function in go.opentelemetry.io/contrib/instrumentation/runtime has been replaced by const Version string. (#8349)
  • The Version() function in go.opentelemetry.io/contrib/instrumentation/github.com/aws/aws-sdk-go-v2/otelaws has been replaced by const Version. (#8356)
  • The Version() function in go.opentelemetry.io/contrib/instrumentation/github.com/aws/aws-lambda-go/otellambda has been replaced by const Version. (#8357)
  • The Version() function in go.opentelemetry.io/contrib/instrumentation/host has been replaced by const Version. (#8358)
  • The Version() function in go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful has been replaced by const Version. (#8360)
  • The Version() function in go.opentelemetry.io/contrib/propagators/opencensus has been replaced by const Version. (#8361)
  • The Version() function in go.opentelemetry.io/contrib/instrumentation/github.com/labstack/echo/otelecho has been replaced by const Version. (#8365)
  • The Version() function in go.opentelemetry.io/contrib/samplers/probability/consistent has been replaced by const Version. (#8366)
  • The Version() function in go.opentelemetry.io/contrib/instrumentation/go.mongodb.org/mongo-driver/v2/mongo/otelmongo has been replaced by const Version. (#8370)
  • Set error.type attribute instead of adding exception span events in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp. (#8386)
  • Set error.type attribute instead of adding exception span events in go.opentelemetry.io/contrib/instrumentation/github.com/aws/aws-sdk-go-v2/otelaws. (#8386)
  • Upgrade go.opentelemetry.io/otel/semconv to v1.39.0, including updates across all instrumentation and detector modules. (#8404)
    • The semantic conventions v1.39.0 release introduces breaking changes, including:
      • rpc span and metric attributes have been renamed to align with naming guidelines:
        • rpc.system → rpc.system.name (values: grpc, grpc_web, connectrpc, thrift, dubbo, etc.)
        • rpc.method and rpc.service have been merged into a fully-qualified rpc.method attribute
        • rpc.client|server.duration → rpc.client|server.call.duration (unit changed to seconds)
        • rpc.grpc.request.metadata/rpc.grpc.response.metadata → rpc.request.metadata/rpc.response.metadata
        • rpc.grpc.status_code → deprecated in favor of rpc.response.status_code
        • rpc.jsonrpc.request_id → jsonrpc.request.id
        • rpc.jsonrpc.version → jsonrpc.protocol.version
      • system and process metrics:
        • *.linux.memory metrics renamed to *.memory.linux
        • system.process.status → process.state
        • system.paging.type and process.paging.fault_type → system.paging.fault.type

... (truncated)

Commits
  • a89d958 Release v1.40.0/v2.2.0/v0.65.0/v0.34.0/v0.20.0/v0.15.0/v0.13.0/v0.12.0 (#8493)
  • 1530d71 Upgrade semconv to v1.39.0 (#8481)
  • 135bb60 Upgrade autoexport to latest otel dep (#8483)
  • 8e92105 chore(deps): update module github.com/gabriel-vasile/mimetype to v1.4.13 (#8486)
  • 147148e fix(deps): update module github.com/shirou/gopsutil/v4 to v4.26.1 (#8487)
  • d387510 Add version file for otellogrus bridge (#8485)
  • fad49c8 add version file for otelslog bridge (#8480)
  • 9e1e573 fix(deps): update module go.mongodb.org/mongo-driver to v1.17.8 (#8479)
  • 37aa475 Add version file for otellogr bridge (#8477)
  • fc8ef39 chore(deps): update module github.com/grpc-ecosystem/grpc-gateway/v2 to v2.27...
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=go.opentelemetry.io/contrib/instrumentation/runtime&package-manager=go_modules&previous-version=0.64.0&new-version=0.65.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
--------- Signed-off-by: dependabot[bot] Signed-off-by: Radoslav Dimitrov Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Radoslav Dimitrov --- go.mod | 2 +- go.sum | 4 ++-- internal/telemetry/metrics.go | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/go.mod b/go.mod index d3c1b33..186504a 100644 --- a/go.mod +++ b/go.mod @@ -16,7 +16,7 @@ require ( github.com/rs/cors v1.11.1 github.com/santhosh-tekuri/jsonschema/v5 v5.3.1 github.com/stretchr/testify v1.11.1 - go.opentelemetry.io/contrib/instrumentation/runtime v0.64.0 + go.opentelemetry.io/contrib/instrumentation/runtime v0.65.0 go.opentelemetry.io/otel v1.40.0 go.opentelemetry.io/otel/exporters/prometheus v0.62.0 go.opentelemetry.io/otel/metric v1.40.0 diff --git a/go.sum b/go.sum index 0666661..d99c486 100644 --- a/go.sum +++ b/go.sum @@ -146,8 +146,8 @@ go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.6 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0/go.mod h1:snMWehoOh2wsEwnvvwtDyFCxVeDAODenXHtn5vzrKjo= go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 h1:F7Jx+6hwnZ41NSFTO5q4LYDtJRXBf2PD0rNBkeB/lus= go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0/go.mod h1:UHB22Z8QsdRDrnAtX4PntOl36ajSxcdUMt1sF7Y6E7Q= -go.opentelemetry.io/contrib/instrumentation/runtime v0.64.0 h1:/+/+UjlXjFcdDlXxKL1PouzX8Z2Vl0OxolRKeBEgYDw= -go.opentelemetry.io/contrib/instrumentation/runtime v0.64.0/go.mod h1:Ldm/PDuzY2DP7IypudopCR3OCOW42NJlN9+mNEroevo= +go.opentelemetry.io/contrib/instrumentation/runtime v0.65.0 h1:n8qdwrebNEHF/zHpueuZ4OacdJ8CdSaP7xef9WRZXTQ= +go.opentelemetry.io/contrib/instrumentation/runtime v0.65.0/go.mod h1:Z1pjGxUL3nJ/IbDDfL6rBD0Xbz7ZOViRqrIUg4l1CYE= go.opentelemetry.io/otel v1.40.0 h1:oA5YeOcpRTXq6NN7frwmwFR0Cn3RhTVZvXsP4duvCms= go.opentelemetry.io/otel v1.40.0/go.mod h1:IMb+uXZUKkMXdPddhwAHm6UfOwJyh4ct1ybIlV14J0g= go.opentelemetry.io/otel/exporters/prometheus v0.62.0 h1:krvC4JMfIOVdEuNPTtQ0ZjCiXrybhv+uOHMfHRmnvVo= diff --git a/internal/telemetry/metrics.go b/internal/telemetry/metrics.go index 8b24d65..2c74141 100644 --- a/internal/telemetry/metrics.go +++ b/internal/telemetry/metrics.go @@ -135,7 +135,7 @@ func InitMetrics(version string) (ShutdownFunc, *Metrics, error) { return retErr } - meter := mp.Meter(Namespace, metric.WithSchemaURL(semconv.SchemaURL), metric.WithInstrumentationVersion(runtime.Version())) + meter := mp.Meter(Namespace, metric.WithSchemaURL(semconv.SchemaURL), metric.WithInstrumentationVersion(runtime.Version)) metrics, err := NewMetrics(meter) return shutdown, metrics, err } From 70a27717fb3736ee0f441e97978194624ad196c8 Mon Sep 17 00:00:00 2001 From: Tadas Antanavicius Date: Mon, 9 Feb 2026 01:51:17 -0800 Subject: [PATCH 106/313] feat(schema): allow template variables in transport URL field (#910) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Authored by Claude Code Opus 4.5, steered/reviewed by me. ## Summary - Updated the URL regex pattern in `StreamableHttpTransport` and `SseTransport` to allow template variables like `{baseUrl}` as an alternative to requiring the `https://` prefix - This enables more flexible URL configuration in the `remotes` section of server.json ## Changes - Modified the `url` field pattern from `^https?://[^\s]+$` to `^(https?://[^\s]+|\{[a-zA-Z_][a-zA-Z0-9_]*\}[^\s]*)$` - Updated both `openapi.yaml` and the derived `server.schema.json` - Added clarifying documentation that URL must start with `http://`, `https://`, or a template variable ## Regex breakdown ``` ^(https?://[^\s]+|\{[a-zA-Z_][a-zA-Z0-9_]*\}[^\s]*)$ ``` | Part | Meaning | |------|---------| | `^` | Start of string | | `(` | Begin alternation group | | `https?://[^\s]+` | `http://` or `https://` followed by non-whitespace | | `\|` | OR | | `\{[a-zA-Z_][a-zA-Z0-9_]*\}` | Template variable: `{` + valid identifier + `}` | | `[^\s]*` | Optional path/query after template variable | | `)` | End alternation group | | `$` | End of string | ## Test cases **Should match ✓** - `https://api.example.com/mcp` - `http://localhost:8080/sse` - `https://example.com/path?query=value` - `{baseUrl}` - `{baseUrl}/mcp` - `{server_url}/api/v1` - `{API_ENDPOINT}` **Should NOT match ✗** - `ftp://example.com` — wrong protocol - `example.com` — missing protocol or variable - `/relative/path` — relative paths not allowed - `{invalid-name}/path` — hyphens not valid in variable names - `{123invalid}` — variables can't start with numbers --------- Co-authored-by: Agent Orchestrator Co-authored-by: Claude Opus 4.5 Co-authored-by: Radoslav Dimitrov --- docs/reference/api/openapi.yaml | 8 +- docs/reference/server-json/CHANGELOG.md | 22 +++- docs/reference/server-json/server.schema.json | 8 +- internal/validators/schema_regex_test.go | 108 ++++++++++++++++++ 4 files changed, 137 insertions(+), 9 deletions(-) create mode 100644 internal/validators/schema_regex_test.go diff --git a/docs/reference/api/openapi.yaml b/docs/reference/api/openapi.yaml index e05c934..4a5ba69 100644 --- a/docs/reference/api/openapi.yaml +++ b/docs/reference/api/openapi.yaml @@ -685,9 +685,9 @@ components: example: "streamable-http" url: type: string - description: "URL template for the streamable-http transport. Variables in {curly_braces} are resolved based on context: In Package context, they reference argument valueHints, argument names, or environment variable names from the parent Package. In Remote context, they reference variables from the transport's 'variables' object. After variable substitution, this should produce a valid URI." + description: "URL template for the streamable-http transport. Must start with http://, https://, or a template variable (e.g., {baseUrl}). Variables in {curly_braces} are resolved based on context: In Package context, they reference argument valueHints, argument names, or environment variable names from the parent Package. In Remote context, they reference variables from the transport's 'variables' object. After variable substitution, this should produce a valid URI." example: "https://api.example.com/mcp" - pattern: "^https?://[^\\s]+$" + pattern: "^(https?://[^\\s]+|\\{[a-zA-Z_][a-zA-Z0-9_]*\\}[^\\s]*)$" headers: type: array description: HTTP headers to include @@ -707,9 +707,9 @@ components: example: "sse" url: type: string - description: "Server-Sent Events endpoint URL template. Variables in {curly_braces} are resolved based on context: In Package context, they reference argument valueHints, argument names, or environment variable names from the parent Package. In Remote context, they reference variables from the transport's 'variables' object. After variable substitution, this should produce a valid URI." + description: "Server-Sent Events endpoint URL template. Must start with http://, https://, or a template variable (e.g., {baseUrl}). Variables in {curly_braces} are resolved based on context: In Package context, they reference argument valueHints, argument names, or environment variable names from the parent Package. In Remote context, they reference variables from the transport's 'variables' object. After variable substitution, this should produce a valid URI." example: "https://mcp-fs.example.com/sse" - pattern: "^https?://[^\\s]+$" + pattern: "^(https?://[^\\s]+|\\{[a-zA-Z_][a-zA-Z0-9_]*\\}[^\\s]*)$" headers: type: array description: HTTP headers to include diff --git a/docs/reference/server-json/CHANGELOG.md b/docs/reference/server-json/CHANGELOG.md index 78d246d..5605e35 100644 --- a/docs/reference/server-json/CHANGELOG.md +++ b/docs/reference/server-json/CHANGELOG.md @@ -8,7 +8,27 @@ This section tracks changes that are in development and not yet released. The dr ### Changed -- No changes yet. +#### Transport URL Pattern Now Accepts Template Variables + +The `url` field in `StreamableHttpTransport` and `SseTransport` now accepts URLs that start with a template variable (e.g., `{baseUrl}`), in addition to the existing `http://` and `https://` prefixes. + +**Example:** +```json +{ + "remotes": [{ + "type": "streamable-http", + "url": "{baseUrl}/mcp", + "variables": { + "baseUrl": { + "description": "Base URL for the MCP server", + "isRequired": true + } + } + }] +} +``` + +**Migration:** No changes required. Existing servers continue to work unchanged. ### Notes diff --git a/docs/reference/server-json/server.schema.json b/docs/reference/server-json/server.schema.json index e25191b..04a5d1e 100644 --- a/docs/reference/server-json/server.schema.json +++ b/docs/reference/server-json/server.schema.json @@ -511,9 +511,9 @@ "type": "string" }, "url": { - "description": "Server-Sent Events endpoint URL template. Variables in {curly_braces} are resolved based on context: In Package context, they reference argument valueHints, argument names, or environment variable names from the parent Package. In Remote context, they reference variables from the transport's 'variables' object. After variable substitution, this should produce a valid URI.", + "description": "Server-Sent Events endpoint URL template. Must start with http://, https://, or a template variable (e.g., {baseUrl}). Variables in {curly_braces} are resolved based on context: In Package context, they reference argument valueHints, argument names, or environment variable names from the parent Package. In Remote context, they reference variables from the transport's 'variables' object. After variable substitution, this should produce a valid URI.", "example": "https://mcp-fs.example.com/sse", - "pattern": "^https?://[^\\s]+$", + "pattern": "^(https?://[^\\s]+|\\{[a-zA-Z_][a-zA-Z0-9_]*\\}[^\\s]*)$", "type": "string" } }, @@ -557,9 +557,9 @@ "type": "string" }, "url": { - "description": "URL template for the streamable-http transport. Variables in {curly_braces} are resolved based on context: In Package context, they reference argument valueHints, argument names, or environment variable names from the parent Package. In Remote context, they reference variables from the transport's 'variables' object. After variable substitution, this should produce a valid URI.", + "description": "URL template for the streamable-http transport. Must start with http://, https://, or a template variable (e.g., {baseUrl}). Variables in {curly_braces} are resolved based on context: In Package context, they reference argument valueHints, argument names, or environment variable names from the parent Package. In Remote context, they reference variables from the transport's 'variables' object. After variable substitution, this should produce a valid URI.", "example": "https://api.example.com/mcp", - "pattern": "^https?://[^\\s]+$", + "pattern": "^(https?://[^\\s]+|\\{[a-zA-Z_][a-zA-Z0-9_]*\\}[^\\s]*)$", "type": "string" } }, diff --git a/internal/validators/schema_regex_test.go b/internal/validators/schema_regex_test.go new file mode 100644 index 0000000..1efa884 --- /dev/null +++ b/internal/validators/schema_regex_test.go @@ -0,0 +1,108 @@ +package validators_test + +import ( + "encoding/json" + "os" + "regexp" + "testing" + + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +const serverSchemaPath = "../../docs/reference/server-json/server.schema.json" + +// schemaHelper provides utilities for extracting values from the JSON schema +type schemaHelper struct { + t *testing.T + schema map[string]interface{} +} + +func loadSchema(t *testing.T) *schemaHelper { + t.Helper() + data, err := os.ReadFile(serverSchemaPath) + require.NoError(t, err, "Failed to read schema file") + + var schema map[string]interface{} + err = json.Unmarshal(data, &schema) + require.NoError(t, err, "Failed to parse schema JSON") + + return &schemaHelper{t: t, schema: schema} +} + +// getDefinition returns a definition from the schema by name +func (s *schemaHelper) getDefinition(name string) map[string]interface{} { + s.t.Helper() + definitions := s.schema["definitions"].(map[string]interface{}) + def, ok := definitions[name].(map[string]interface{}) + require.True(s.t, ok, "Definition %q not found in schema", name) + return def +} + +// getPropertyPattern extracts a regex pattern from a definition's property +func (s *schemaHelper) getPropertyPattern(definitionName, propertyName string) string { + s.t.Helper() + def := s.getDefinition(definitionName) + props := def["properties"].(map[string]interface{}) + prop, ok := props[propertyName].(map[string]interface{}) + require.True(s.t, ok, "Property %q not found in %s", propertyName, definitionName) + pattern, ok := prop["pattern"].(string) + require.True(s.t, ok, "Pattern not found for %s.%s", definitionName, propertyName) + return pattern +} + +// TestTransportURLPattern validates the URL pattern used by StreamableHttpTransport and SseTransport. +// URLs must start with http://, https://, or a template variable like {baseUrl}. +func TestTransportURLPattern(t *testing.T) { + schema := loadSchema(t) + + streamablePattern := schema.getPropertyPattern("StreamableHttpTransport", "url") + ssePattern := schema.getPropertyPattern("SseTransport", "url") + + // Verify both transport types use the same pattern + assert.Equal(t, streamablePattern, ssePattern, + "StreamableHttpTransport and SseTransport should use identical URL patterns") + + t.Logf("Pattern: %s", streamablePattern) + + re, err := regexp.Compile(streamablePattern) + require.NoError(t, err, "Pattern should be valid regex") + + // Test cases that SHOULD match + validCases := []string{ + // Standard URLs + "https://api.example.com/mcp", + "http://localhost:8080/sse", + "https://example.com/path?query=value", + "https://api.example.com/v1/mcp", + // Template variables + "{baseUrl}", + "{baseUrl}/mcp", + "{server_url}/api/v1", + "{API_ENDPOINT}", + "{a}", + "{_private}/endpoint", + } + + for _, tc := range validCases { + assert.True(t, re.MatchString(tc), "Expected %q to match pattern", tc) + } + + // Test cases that should NOT match + invalidCases := []string{ + "ftp://example.com", // wrong protocol + "example.com", // missing protocol or variable + "/relative/path", // relative path + "{invalid-name}/path", // hyphen in variable name + "{123invalid}", // variable starts with number + "", // empty string + "mailto:test@example.com", // wrong protocol + "file:///path/to/file", // wrong protocol + "{}/empty", // empty variable name + "{{nested}}/path", // nested braces + } + + for _, tc := range invalidCases { + assert.False(t, re.MatchString(tc), "Expected %q to NOT match pattern", tc) + } +} From b883d47d97aa575f4a3465b3aac551756bba14a9 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 10 Feb 2026 22:54:33 +0200 Subject: [PATCH 107/313] build(deps): bump golang.org/x/mod from 0.32.0 to 0.33.0 (#951) Bumps [golang.org/x/mod](https://github.com/golang/mod) from 0.32.0 to 0.33.0.
Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=golang.org/x/mod&package-manager=go_modules&previous-version=0.32.0&new-version=0.33.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 186504a..c4697b8 100644 --- a/go.mod +++ b/go.mod @@ -22,7 +22,7 @@ require ( go.opentelemetry.io/otel/metric v1.40.0 go.opentelemetry.io/otel/sdk v1.40.0 go.opentelemetry.io/otel/sdk/metric v1.40.0 - golang.org/x/mod v0.32.0 + golang.org/x/mod v0.33.0 gopkg.in/yaml.v3 v3.0.1 ) diff --git a/go.sum b/go.sum index d99c486..d6fadaf 100644 --- a/go.sum +++ b/go.sum @@ -166,8 +166,8 @@ go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0= go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8= golang.org/x/crypto v0.46.0 h1:cKRW/pmt1pKAfetfu+RCEvjvZkA9RimPbh7bhFjGVBU= golang.org/x/crypto v0.46.0/go.mod h1:Evb/oLKmMraqjZ2iQTwDwvCtJkczlDuTmdJXoZVzqU0= -golang.org/x/mod v0.32.0 h1:9F4d3PHLljb6x//jOyokMv3eX+YDeepZSEo3mFJy93c= -golang.org/x/mod v0.32.0/go.mod h1:SgipZ/3h2Ci89DlEtEXWUk/HteuRin+HHhN+WbNhguU= +golang.org/x/mod v0.33.0 h1:tHFzIWbBifEmbwtGz65eaWyGiGZatSrT9prnU8DbVL8= +golang.org/x/mod v0.33.0/go.mod h1:swjeQEj+6r7fODbD2cqrnje9PnziFuw4bmLbBZFrQ5w= golang.org/x/net v0.48.0 h1:zyQRTTrjc33Lhh0fBgT/H3oZq9WuvRR5gPC70xpDiQU= golang.org/x/net v0.48.0/go.mod h1:+ndRgGjkh8FGtu1w1FGbEC31if4VrNVMuKTgcAAnQRY= golang.org/x/oauth2 v0.34.0 h1:hqK/t4AKgbqWkdkcAeI8XLmbK+4m4G5YeQRrmiotGlw= From a5f2dc1b6633501a2395a8e6b06ce8c4215cd4b1 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 10 Feb 2026 22:54:52 +0200 Subject: [PATCH 108/313] build(deps): bump github.com/go-git/go-git/v5 from 5.16.2 to 5.16.5 in /deploy (#950) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.16.2 to 5.16.5.
Release notes

Sourced from github.com/go-git/go-git/v5's releases.

v5.16.5

What's Changed

Full Changelog: https://github.com/go-git/go-git/compare/v5.16.4...v5.16.5

v5.16.4

What's Changed

Full Changelog: https://github.com/go-git/go-git/compare/v5.16.3...v5.16.4

v5.16.3

What's Changed

Full Changelog: https://github.com/go-git/go-git/compare/v5.16.2...v5.16.3

Commits
  • 48a1ae0 Merge pull request #1836 from go-git/check-v5
  • 42bdf1f storage: filesystem, Verify idx matches pack file
  • 4146a56 plumbing: format/idxfile, Verify idxfile's checksum
  • 63d78ec plumbing: format/packfile, Add new ErrMalformedPackFile
  • 25f1624 Merge pull request #1800 from Ch00k/no-delete-untracked-v5
  • 600fb13 git: worktree, Don't delete local untracked files when resetting worktree
  • 390a569 Merge pull request #1746 from pjbgf/bump-go
  • 61c8b85 build: Bump Go test versions to 1.23-1.25 (v5)
  • e5a05ec Merge pull request #1744 from go-git/renovate/releases/v5.x-go-golang.org-x-c...
  • 1495930 plumbing: Remove use of non-constant format strings
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/go-git/go-git/v5&package-manager=go_modules&previous-version=5.16.2&new-version=5.16.5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/modelcontextprotocol/registry/network/alerts).
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- deploy/go.mod | 2 +- deploy/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index cbcd3a0..062190e 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -31,7 +31,7 @@ require ( github.com/emirpasic/gods v1.18.1 // indirect github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect github.com/go-git/go-billy/v5 v5.6.2 // indirect - github.com/go-git/go-git/v5 v5.16.2 // indirect + github.com/go-git/go-git/v5 v5.16.5 // indirect github.com/gogo/protobuf v1.3.2 // indirect github.com/golang/glog v1.2.5 // indirect github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect diff --git a/deploy/go.sum b/deploy/go.sum index f90bd52..a421101 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -60,8 +60,8 @@ github.com/go-git/go-billy/v5 v5.6.2 h1:6Q86EsPXMa7c3YZ3aLAQsMA0VlWmy43r6FHqa/UN github.com/go-git/go-billy/v5 v5.6.2/go.mod h1:rcFC2rAsp/erv7CMz9GczHcuD0D32fWzH+MJAU+jaUU= github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4= github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII= -github.com/go-git/go-git/v5 v5.16.2 h1:fT6ZIOjE5iEnkzKyxTHK1W4HGAsPhqEqiSAssSO77hM= -github.com/go-git/go-git/v5 v5.16.2/go.mod h1:4Ge4alE/5gPs30F2H1esi2gPd69R0C39lolkucHBOp8= +github.com/go-git/go-git/v5 v5.16.5 h1:mdkuqblwr57kVfXri5TTH+nMFLNUxIj9Z7F5ykFbw5s= +github.com/go-git/go-git/v5 v5.16.5/go.mod h1:QOMLpNf1qxuSY4StA/ArOdfFR2TrKEjJiye2kel2m+M= github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag= From b5f38fcc2a84b8206999e07a666959c0905014fd Mon Sep 17 00:00:00 2001 From: deerajkumar18 <47472576+deerajkumar18@users.noreply.github.com> Date: Wed, 11 Feb 2026 03:02:58 +0530 Subject: [PATCH 109/313] update schema url point to the actual location (#884) ## Motivation and Context This PR ensures that the draft URL points to the actual draft schema improvement suggested in https://github.com/modelcontextprotocol/registry/issues/814 ## How Has This Been Tested? ## Breaking Changes ## Types of changes - [x] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] Documentation update ## Checklist - [ ] I have read the [MCP Documentation](https://modelcontextprotocol.io) - [ ] My code follows the repository's style guidelines - [ ] New and existing tests pass locally - [ ] I have added appropriate error handling - [ ] I have added or updated documentation as needed ## Additional context --- complete.md | 4 ++-- docs/contributing/add-package-registry.md | 4 ++-- docs/design/proposed-enhanced-validation.md | 8 ++++---- docs/modelcontextprotocol-io/about.mdx | 2 +- docs/reference/server-json/CHANGELOG.md | 2 +- docs/reference/server-json/CONTRIBUTING.md | 2 +- docs/reference/server-json/{ => draft}/server.schema.json | 2 +- docs/reference/server-json/generic-server-json.md | 2 +- internal/validators/schema_regex_test.go | 2 +- tools/extract-server-schema/main.go | 4 ++-- tools/validate-examples/main.go | 2 +- tools/validate-schemas/main.go | 2 +- 12 files changed, 18 insertions(+), 18 deletions(-) rename docs/reference/server-json/{ => draft}/server.schema.json (99%) diff --git a/complete.md b/complete.md index 1fe5d05..045e797 100644 --- a/complete.md +++ b/complete.md @@ -538,7 +538,7 @@ The MCP Registry project is a **metaregistry**, meaning that it hosts metadata f For local MCP servers, the MCP Registry has pointers in the `packages` node of the [`server.json`](../../reference/server-json/generic-server-json.md) schema that refer to packages in supported package managers. -The list of supported package managers for hosting MCP servers is defined by the `properties.packages[N].properties.registry_type` string enum in the [`server.json` schema](../../reference/server-json/server.schema.json). For example, this could be "npm" (for npmjs.com packages) or "pypi" (for PyPI packages). +The list of supported package managers for hosting MCP servers is defined by the `properties.packages[N].properties.registry_type` string enum in the [`server.json` schema](../../reference/server-json/draft/server.schema.json). For example, this could be "npm" (for npmjs.com packages) or "pypi" (for PyPI packages). For remote MCP servers, the package registry is not relevant. The MCP client consumes the server via a URL instead of by downloading and running a package. In other words, this document only applies to local MCP servers. @@ -567,7 +567,7 @@ These steps may evolve as additional validations or details are discovered and m 1. [Create a feature request issue](https://github.com/modelcontextprotocol/registry/issues/new?template=feature_request.md) on the MCP Registry repository to begin the discussion about adding the package registry. - Example for NuGet: https://github.com/modelcontextprotocol/registry/issues/126 1. Open a PR with the following changes: - - Update the [`server.json` schema](../../reference/server-json/server.schema.json) + - Update the [`server.json` schema](../../reference/server-json/draft/server.schema.json) - Add your package registry name to the `registry_type` example array. - Add your package registry base url to the `registry_base_url` example array. - Add the single-shot CLI command name to the `runtime_hint` example value array. diff --git a/docs/contributing/add-package-registry.md b/docs/contributing/add-package-registry.md index a00f093..be0a6ea 100644 --- a/docs/contributing/add-package-registry.md +++ b/docs/contributing/add-package-registry.md @@ -4,7 +4,7 @@ The MCP Registry project is a **metaregistry**, meaning that it hosts metadata f For local MCP servers, the MCP Registry has pointers in the `packages` node of the [`server.json`](../../reference/server-json/generic-server-json.md) schema that refer to packages in supported package managers. -The list of supported package managers for hosting MCP servers is defined by the `properties.packages[N].properties.registryType` string enum in the [`server.json` schema](../../reference/server-json/server.schema.json). For example, this could be "npm" (for npmjs.com packages) or "pypi" (for PyPI packages). +The list of supported package managers for hosting MCP servers is defined by the `properties.packages[N].properties.registryType` string enum in the [`server.json` schema](../../reference/server-json/draft/server.schema.json). For example, this could be "npm" (for npmjs.com packages) or "pypi" (for PyPI packages). For remote MCP servers, the package registry is not relevant. The MCP client consumes the server via a URL instead of by downloading and running a package. In other words, this document only applies to local MCP servers. @@ -33,7 +33,7 @@ These steps may evolve as additional validations or details are discovered and m 1. [Create a feature request issue](https://github.com/modelcontextprotocol/registry/issues/new?template=feature_request.md) on the MCP Registry repository to begin the discussion about adding the package registry. - Example for NuGet: https://github.com/modelcontextprotocol/registry/issues/126 1. Open a PR with the following changes: - - Update the [`server.json` schema](../../reference/server-json/server.schema.json) + - Update the [`server.json` schema](../../reference/server-json/draft/server.schema.json) - Add your package registry name to the `registryType` example array. - Add your package registry base url to the `registryBaseUrl` example array. - Add the single-shot CLI command name to the `runtimeHint` example value array. diff --git a/docs/design/proposed-enhanced-validation.md b/docs/design/proposed-enhanced-validation.md index c1379c2..605edce 100644 --- a/docs/design/proposed-enhanced-validation.md +++ b/docs/design/proposed-enhanced-validation.md @@ -421,10 +421,10 @@ The validation system supports testing against draft schemas or custom schema ve #### Setup Steps -1. **Copy the schema file**: Copy your schema file (e.g., `docs/reference/server-json/server.schema.json`) to `internal/validators/schemas/{version}.json` +1. **Copy the schema file**: Copy your schema file (e.g., `docs/reference/server-json/draft/server.schema.json`) to `internal/validators/schemas/{version}.json` - Example: Copy to `internal/validators/schemas/draft.json` for draft schema testing - Ensure the schema file's `$id` field matches: `https://static.modelcontextprotocol.io/schemas/{version}/server.schema.json` - - For draft schema, the `$id` should be: `https://static.modelcontextprotocol.io/schemas/draft/server.schema.json` + - For draft schema, the `$id` should be: `https://raw.githubusercontent.com/modelcontextprotocol/registry/main/docs/reference/server-json/draft/server.schema.json` 2. **Rebuild**: Recompile the Go binary to embed the new schema file (schemas are embedded at compile time) @@ -473,10 +473,10 @@ To test with a draft schema as if it were the current schema (no warnings/errors ```bash # 1. Copy draft schema -cp docs/reference/server-json/server.schema.json internal/validators/schemas/draft.json +cp docs/reference/server-json/draft/server.schema.json internal/validators/schemas/draft.json # 2. Verify the $id field in draft.json is correct -# Should be: "https://static.modelcontextprotocol.io/schemas/draft/server.schema.json" +# Should be: "https://raw.githubusercontent.com/modelcontextprotocol/registry/main/docs/reference/server-json/draft/server.schema.json" # 3. Rebuild go build ./... diff --git a/docs/modelcontextprotocol-io/about.mdx b/docs/modelcontextprotocol-io/about.mdx index 88253af..3f560d0 100644 --- a/docs/modelcontextprotocol-io/about.mdx +++ b/docs/modelcontextprotocol-io/about.mdx @@ -16,7 +16,7 @@ The MCP Registry provides: - A REST API for MCP clients and aggregators to discover available servers - Standardized installation and configuration information -Server metadata is stored in a standardized [`server.json` format](https://github.com/modelcontextprotocol/registry/blob/main/docs/reference/server-json/server.schema.json), which contains: +Server metadata is stored in a standardized [`server.json` format](https://github.com/modelcontextprotocol/registry/blob/main/docs/reference/server-json/draft/server.schema.json), which contains: - The server's unique name (e.g., `io.github.user/server-name`) - Where to locate the server (e.g., npm package name, remote server URL) diff --git a/docs/reference/server-json/CHANGELOG.md b/docs/reference/server-json/CHANGELOG.md index 5605e35..c55ef41 100644 --- a/docs/reference/server-json/CHANGELOG.md +++ b/docs/reference/server-json/CHANGELOG.md @@ -4,7 +4,7 @@ Changes to the server.json schema and format. ## Draft (Unreleased) -This section tracks changes that are in development and not yet released. The draft schema is available at [`server.schema.json`](./server.schema.json) in this repository. +This section tracks changes that are in development and not yet released. The draft schema is available at [`server.schema.json`](./draft/server.schema.json) in this repository. ### Changed diff --git a/docs/reference/server-json/CONTRIBUTING.md b/docs/reference/server-json/CONTRIBUTING.md index d67bc0a..802cc2c 100644 --- a/docs/reference/server-json/CONTRIBUTING.md +++ b/docs/reference/server-json/CONTRIBUTING.md @@ -26,5 +26,5 @@ When the draft changes are ready for release: ## Schema Versioning -- **Draft schema**: `https://static.modelcontextprotocol.io/schemas/draft/server.schema.json` - For in-progress changes, may change without notice. +- **Draft schema**: `https://raw.githubusercontent.com/modelcontextprotocol/registry/main/docs/reference/server-json/draft/server.schema.json` - For in-progress changes, may change without notice. - **Released schemas**: `https://static.modelcontextprotocol.io/schemas/YYYY-MM-DD/server.schema.json` - Stable, versioned by release date. diff --git a/docs/reference/server-json/server.schema.json b/docs/reference/server-json/draft/server.schema.json similarity index 99% rename from docs/reference/server-json/server.schema.json rename to docs/reference/server-json/draft/server.schema.json index 04a5d1e..5c59335 100644 --- a/docs/reference/server-json/server.schema.json +++ b/docs/reference/server-json/draft/server.schema.json @@ -1,6 +1,6 @@ { "$comment": "This file is auto-generated from docs/reference/api/openapi.yaml. Do not edit manually. Run 'make generate-schema' to update.", - "$id": "https://static.modelcontextprotocol.io/schemas/draft/server.schema.json", + "$id": "https://raw.githubusercontent.com/modelcontextprotocol/registry/main/docs/reference/server-json/draft/server.schema.json", "$ref": "#/definitions/ServerDetail", "$schema": "http://json-schema.org/draft-07/schema#", "definitions": { diff --git a/docs/reference/server-json/generic-server-json.md b/docs/reference/server-json/generic-server-json.md index b525bde..1b1aff1 100644 --- a/docs/reference/server-json/generic-server-json.md +++ b/docs/reference/server-json/generic-server-json.md @@ -8,7 +8,7 @@ Also see: ## Browse the Complete Schema -**📋 View the full specification interactively**: Open [server.schema.json](./server.schema.json) in a schema viewer like [json-schema.app](https://json-schema.app/view/%23?url=https%3A%2F%2Fstatic.modelcontextprotocol.io%2Fschemas%2F2025-09-29%2Fserver.schema.json). +**📋 View the full specification interactively**: Open [server.schema.json](./draft/server.schema.json) in a schema viewer like [json-schema.app](https://json-schema.app/view/%23?url=https%3A%2F%2Fstatic.modelcontextprotocol.io%2Fschemas%2F2025-09-29%2Fserver.schema.json). The schema contains all field definitions, validation rules, examples, and detailed descriptions. diff --git a/internal/validators/schema_regex_test.go b/internal/validators/schema_regex_test.go index 1efa884..b4ae0ba 100644 --- a/internal/validators/schema_regex_test.go +++ b/internal/validators/schema_regex_test.go @@ -10,7 +10,7 @@ import ( "github.com/stretchr/testify/require" ) -const serverSchemaPath = "../../docs/reference/server-json/server.schema.json" +const serverSchemaPath = "../../docs/reference/server-json/draft/server.schema.json" // schemaHelper provides utilities for extracting values from the JSON schema type schemaHelper struct { diff --git a/tools/extract-server-schema/main.go b/tools/extract-server-schema/main.go index 723c6a6..a90aa2d 100644 --- a/tools/extract-server-schema/main.go +++ b/tools/extract-server-schema/main.go @@ -13,7 +13,7 @@ import ( const ( openAPIPath = "docs/reference/api/openapi.yaml" - schemaOutputDir = "docs/reference/server-json" + schemaOutputDir = "docs/reference/server-json/draft" ) func main() { @@ -93,7 +93,7 @@ func main() { // When releasing, the schema is published to a versioned URL (e.g., 2025-10-17) // on https://github.com/modelcontextprotocol/static _ = version // version from OpenAPI spec available if needed - schemaID := "https://static.modelcontextprotocol.io/schemas/draft/server.schema.json" + schemaID := "https://raw.githubusercontent.com/modelcontextprotocol/registry/main/docs/reference/server-json/draft/server.schema.json" jsonSchema := map[string]interface{}{ "$comment": "This file is auto-generated from docs/reference/api/openapi.yaml. Do not edit manually. Run 'make generate-schema' to update.", "$schema": "http://json-schema.org/draft-07/schema#", diff --git a/tools/validate-examples/main.go b/tools/validate-examples/main.go index 46823d4..54a7e4b 100644 --- a/tools/validate-examples/main.go +++ b/tools/validate-examples/main.go @@ -57,7 +57,7 @@ func runValidation() error { }, } - schemaPath := filepath.Join("docs", "reference", "server-json", "server.schema.json") + schemaPath := filepath.Join("docs", "reference", "server-json", "draft", "server.schema.json") baseSchema, err := compileSchema(schemaPath) if err != nil { return fmt.Errorf("failed to compile server.schema.json: %w", err) diff --git a/tools/validate-schemas/main.go b/tools/validate-schemas/main.go index 16aff9a..aebda5b 100644 --- a/tools/validate-schemas/main.go +++ b/tools/validate-schemas/main.go @@ -25,7 +25,7 @@ func main() { } func runValidation() error { - basePath := filepath.Join("docs", "reference", "server-json") + basePath := filepath.Join("docs", "reference", "server-json", "draft") schemas := []struct { name string From 4e1d46d843dbea7f51779b5ef9292457c1100fb6 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Tue, 10 Feb 2026 23:39:51 +0200 Subject: [PATCH 110/313] Bump production to v1.4.1 (#952) ## Motivation and Context The following PR bumps prod to v1.4.1 ## How Has This Been Tested? ## Breaking Changes ## Types of changes - [ ] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] Documentation update ## Checklist - [ ] I have read the [MCP Documentation](https://modelcontextprotocol.io) - [ ] My code follows the repository's style guidelines - [ ] New and existing tests pass locally - [ ] I have added appropriate error handling - [ ] I have added or updated documentation as needed ## Additional context Signed-off-by: Radoslav Dimitrov --- deploy/Pulumi.gcpProd.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/deploy/Pulumi.gcpProd.yaml b/deploy/Pulumi.gcpProd.yaml index 5f463d2..f044f2a 100644 --- a/deploy/Pulumi.gcpProd.yaml +++ b/deploy/Pulumi.gcpProd.yaml @@ -1,7 +1,7 @@ config: mcp-registry:environment: prod mcp-registry:provider: gcp - mcp-registry:imageTag: 1.4.0 # Set specific image tag for production (change this to deploy different versions) + mcp-registry:imageTag: 1.4.1 # Set specific image tag for production (change this to deploy different versions) gcp:project: mcp-registry-prod mcp-registry:githubClientId: Iv23liUydBbI7Z2Q9bOZ mcp-registry:githubClientSecret: From 541c8a78c0bfb60ce4d127342c36e13f3b89c2a2 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 11 Feb 2026 10:31:55 +0200 Subject: [PATCH 111/313] build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.219.0 to 3.220.0 in /deploy (#953) Bumps [github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from 3.219.0 to 3.220.0.
Release notes

Sourced from github.com/pulumi/pulumi/sdk/v3's releases.

v3.220.0

3.220.0 (2026-02-10)

Features

  • [cli] Show environment variables that were set if a snapshot integrity error happens #21709

  • [cli/{install,package}] Use the Pulumi Cloud Registry by default to resolve package names

  • [engine] Pass replacement trigger through to Construct #21408

  • [engine] Add EnvVarMappings resource option for provider resources, allowing environment variables to be remapped before being passed to the provider #21572

  • [pkg] BREAKING: Deprecate github.com/pulumi/pulumi/pkg/v3/codegen/dotnet in favor of github.com/pulumi/pulumi-dotnet/pulumi-language-dotnet/v3/codegen. This package will be removed from pulumi/pulumi soon! #21720

Bug Fixes

  • [cli] Retry yarn install when it fails (e.g. during pulumi install) #21707

  • [engine] Deal with errors in elided journal entries correctly #21576

  • [sdk/nodejs] Fix remote components with PULUMI_NODEJS_SKIP_COMPONENT_INPUTS

  • [sdk/python] Fix _LazyModule to not trigger full module load for introspection attributes #21620

  • [sdkgen/python] Remove workaround for slow typechecking with MyPy and PyCharm #21722

Miscellaneous

  • [cli] Write logfile location if verbosity is >= 1 to stderr instead of stdout #21663
Changelog

Sourced from github.com/pulumi/pulumi/sdk/v3's changelog.

3.220.0 (2026-02-10)

Features

  • [cli] Show environment variables that were set if a snapshot integrity error happens #21709

  • [cli/{install,package}] Use the Pulumi Cloud Registry by default to resolve package names

  • [engine] Pass replacement trigger through to Construct #21408

  • [engine] Add EnvVarMappings resource option for provider resources, allowing environment variables to be remapped before being passed to the provider #21572

  • [pkg] BREAKING: Deprecate github.com/pulumi/pulumi/pkg/v3/codegen/dotnet in favor of github.com/pulumi/pulumi-dotnet/pulumi-language-dotnet/v3/codegen. This package will be removed from pulumi/pulumi soon! #21720

Bug Fixes

  • [cli] Retry yarn install when it fails (e.g. during pulumi install) #21707

  • [engine] Deal with errors in elided journal entries correctly #21576

  • [sdk/nodejs] Fix remote components with PULUMI_NODEJS_SKIP_COMPONENT_INPUTS

  • [sdk/python] Fix _LazyModule to not trigger full module load for introspection attributes #21620

  • [sdkgen/python] Remove workaround for slow typechecking with MyPy and PyCharm #21722

Miscellaneous

  • [cli] Write logfile location if verbosity is >= 1 to stderr instead of stdout #21663
Commits
  • e8ecd95 Fix remote components with PULUMI_NODEJS_SKIP_COMPONENT_INPUTS (#21727)
  • 4c2cc2a upgrade pulumi-dotnet and pulumi-yaml to latest (#21764)
  • 8dc466c Always install from registry when appropriate (#21649)
  • 2ce415c Relax the Copyright banner linter (#21732)
  • 5d49339 Update module github.com/go-git/go-git/v5 to v5.16.5 [SECURITY] (#21758)
  • dbcad3b Remap environment variables as a resource option on Provider (#21572)
  • f5dc5a3 print and save environment variables on snapshot integrity errors (#21709)
  • 82d584e Fix proto build: Update Node.js installation to use modern keyring (#21729)
  • f8aaed4 Deprecate github.com/pulumi/pulumi/pkg/v3/codegen/dotnet & remove tests (#2...
  • 3392d06 Remove workaround for slow typechecking with MyPy and PyCharm (#21722)
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/pulumi/pulumi/sdk/v3&package-manager=go_modules&previous-version=3.219.0&new-version=3.220.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- deploy/go.mod | 2 +- deploy/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index 062190e..a3c16b7 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -5,7 +5,7 @@ go 1.24.11 require ( github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.25.0 - github.com/pulumi/pulumi/sdk/v3 v3.219.0 + github.com/pulumi/pulumi/sdk/v3 v3.220.0 gopkg.in/yaml.v2 v2.4.0 ) diff --git a/deploy/go.sum b/deploy/go.sum index a421101..2c72d46 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -158,8 +158,8 @@ github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 h1:w6OnO3d4j5yVf2vpm8OzXFC/xHOEGqt+9 github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1/go.mod h1:UyZyv7hz4knpFx6/Sh+SkZe6hT6sJHtDvw9A0TbvEsk= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.25.0 h1:N1qitmrGomEaCPsblqJHaw8Re0cqqox5V+kHsi4EEtk= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.25.0/go.mod h1:ACBJF6+nzUqDeRK+p2OrvykunyeHfvtbyELc6PB38fk= -github.com/pulumi/pulumi/sdk/v3 v3.219.0 h1:OwTSwk1ZuOI4hQUdSccWuIAuqs4fL/FcppesPOAKHQ8= -github.com/pulumi/pulumi/sdk/v3 v3.219.0/go.mod h1:ZOBPPC2NZOZf729AdCX+CctfNc5SN6aJh0bdqNdzQC4= +github.com/pulumi/pulumi/sdk/v3 v3.220.0 h1:TtdlW2VfvBWhFZSvaDN9lSUlSS4gGSdNWdca3RGPsBQ= +github.com/pulumi/pulumi/sdk/v3 v3.220.0/go.mod h1:UGWJOz25OiFIN0QH79UFij8mffH94TYebKUgy9Wvug0= github.com/rivo/uniseg v0.1.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc= github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc= github.com/rivo/uniseg v0.4.4 h1:8TfxU8dW6PdqD27gjM8MVNuicgxIjxpm4K7x4jp8sis= From 01e4e2b09eb003366f5a862242eb86b47fe3c8d2 Mon Sep 17 00:00:00 2001 From: Den Delimarsky <53200638+localden@users.noreply.github.com> Date: Wed, 18 Feb 2026 23:36:23 -0800 Subject: [PATCH 112/313] Update SECURITY.md to use GitHub Security Advisories (#977) Replaces Anthropic HackerOne VDP references with standard GitHub Security Advisory process. --- SECURITY.md | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..5029242 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,21 @@ +# Security Policy + +Thank you for helping keep the Model Context Protocol and its ecosystem secure. + +## Reporting Security Issues + +If you discover a security vulnerability in this repository, please report it through +the [GitHub Security Advisory process](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability) +for this repository. + +Please **do not** report security vulnerabilities through public GitHub issues, discussions, +or pull requests. + +## What to Include + +To help us triage and respond quickly, please include: + +- A description of the vulnerability +- Steps to reproduce the issue +- The potential impact +- Any suggested fixes (optional) From bb84ea69e810ad1c9a1cde6760dacfc0890f8848 Mon Sep 17 00:00:00 2001 From: Preeti Dewani Date: Fri, 27 Feb 2026 22:30:07 +0530 Subject: [PATCH 113/313] Publisher-managed "deleted" support (#893) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit (Updated auto-generated PR description from @tadasant / Claude on Feb 22, 2026) ## Motivation and Context Fixes #637 Server lifecycle management (deprecation and yanking) is a standard requirement for package registries. Use cases like rebranding, security vulnerabilities, and end-of-life servers demand the ability to mark servers as deprecated or deleted, with optional messaging to guide consumers toward alternatives. ## Changes ### New API endpoints - **`PATCH /v0/servers/{serverName}/versions/{version}/status`** — Update the lifecycle status of a single server version - **`PATCH /v0/servers/{serverName}/status`** — Update the lifecycle status of all versions of a server in a single transaction Both endpoints accept: ```json { "status": "active|deprecated|deleted", "statusMessage": "Optional message (max 500 chars) explaining the change" } ``` ### New CLI command - **`mcp-publisher status [version]`** — Update server lifecycle status from the command line - `--status` (required): `active`, `deprecated`, or `deleted` - `--message`: Optional status message - `--all-versions`: Apply to all versions of the server (replaces the `` argument) ### API response changes `RegistryExtensions` now includes two new fields: - `statusChangedAt` — Timestamp of the last status change - `statusMessage` — Optional free-form message (e.g., deprecation reason, migration guidance) ### List endpoint changes - New `include_deleted` query parameter on `GET /v0/servers` — defaults to `false`, hiding deleted servers from listings - When `updated_since` is provided, `include_deleted` is automatically set to `true` for incremental sync ### Database - Migration `013_add_status_fields.sql`: Adds `status_changed_at` (NOT NULL, initialized from `published_at`) and `status_message` columns to the `servers` table ### Design decisions (from review discussion) - **Dedicated status endpoints** rather than overloading the existing edit endpoint - **Bidirectional status transitions** — all transitions between `active`, `deprecated`, and `deleted` are allowed - **`statusMessage` as free-form text** — no structured `nextName` or `alternativeUrl` fields (per maintainer feedback, to avoid complexity around chaining, trust transfer, etc.) - **Publish permission** grants status change access (not limited to admin/edit) - **Status message auto-cleared** when transitioning back to `active` Good, now I have the full picture. Here's the addendum: ### Consumer-facing API changes The new status fields live inside `_meta["io.modelcontextprotocol.registry/official"]` on every `ServerResponse`. This is the existing `RegistryExtensions` object — two new fields are added alongside the existing ones: **Before:** ```json { "server": { "name": "com.example/my-server", "...": "..." }, "_meta": { "io.modelcontextprotocol.registry/official": { "status": "active", "publishedAt": "2025-06-01T00:00:00Z", "updatedAt": "2025-06-15T00:00:00Z", "isLatest": true } } } ``` **After:** ```json { "server": { "name": "com.example/my-server", "...": "..." }, "_meta": { "io.modelcontextprotocol.registry/official": { "status": "deprecated", "statusChangedAt": "2026-02-01T12:00:00Z", "statusMessage": "Deprecated in favor of com.example/my-server-v2", "publishedAt": "2025-06-01T00:00:00Z", "updatedAt": "2026-02-01T12:00:00Z", "isLatest": true } } } ``` | New field | Type | Present when | |-----------|------|-------------| | `statusChangedAt` | `string` (RFC3339) | Always — initialized to `publishedAt` for existing records | | `statusMessage` | `string` (max 500 chars) | Only when set — `null`/omitted for active servers (auto-cleared on transition to active) | These fields appear on **every endpoint that returns a `ServerResponse`**: `GET /v0/servers`, `GET /v0/servers/{name}`, `GET /v0/servers/{name}/versions/{version}`, and the new PATCH status endpoints. ### List endpoint filtering `GET /v0/servers` gains an `include_deleted` query parameter: | Scenario | Behavior | |----------|----------| | No `include_deleted` param | Deleted servers hidden (default `false`) | | `include_deleted=true` | Deleted servers included in results | | `updated_since` provided | `include_deleted` forced to `true` for incremental sync | ## How Has This Been Tested? - Unit tests for status handler (`status_test.go`) covering status transitions, permission checks, validation errors, and the all-versions endpoint - Unit tests for the CLI command (`status_test.go`) - Integration with existing server/edit handler tests - Database layer tests for the new status update and query methods - Tested locally with `make dev-compose` ## Types of changes - [x] New feature (non-breaking change which adds functionality) ## Checklist - [x] I have read the [MCP Documentation](https://modelcontextprotocol.io) - [x] My code follows the repository's style guidelines - [x] New and existing tests pass locally - [x] I have added appropriate error handling - [x] I have added or updated documentation as needed ## Open items from review - [ ] `include_deleted` silent override: When `updated_since` is provided and `include_deleted=false` is explicitly passed, should return a 400 error rather than silently overriding ([thread](https://github.com/modelcontextprotocol/registry/pull/893#discussion_r2100879360)) — agreed upon but may not yet be implemented --- cmd/publisher/README.md | 3 +- cmd/publisher/commands/status.go | 375 +++++++ cmd/publisher/commands/status_test.go | 311 ++++++ cmd/publisher/main.go | 36 + docs/modelcontextprotocol-io/faq.mdx | 16 +- docs/reference/api/CHANGELOG.md | 35 +- docs/reference/api/generic-registry-api.md | 2 + docs/reference/api/official-registry-api.md | 56 +- docs/reference/api/openapi.yaml | 196 ++++ docs/reference/cli/commands.md | 45 + internal/api/handlers/v0/edit.go | 33 +- internal/api/handlers/v0/edit_test.go | 247 ++--- internal/api/handlers/v0/servers.go | 68 +- internal/api/handlers/v0/servers_test.go | 250 +++++ internal/api/handlers/v0/status.go | 299 ++++++ internal/api/handlers/v0/status_test.go | 885 +++++++++++++++++ internal/api/router/v0.go | 4 + internal/auth/jwt.go | 4 +- internal/database/database.go | 24 +- .../migrations/013_add_status_fields.sql | 24 + internal/database/postgres.go | 416 +++++--- internal/database/postgres_test.go | 931 ++++++++++++++++-- internal/service/registry_service.go | 112 ++- internal/service/registry_service_test.go | 230 ++++- internal/service/service.go | 19 +- pkg/api/v0/types.go | 10 +- 26 files changed, 4155 insertions(+), 476 deletions(-) create mode 100644 cmd/publisher/commands/status.go create mode 100644 cmd/publisher/commands/status_test.go create mode 100644 internal/api/handlers/v0/status.go create mode 100644 internal/api/handlers/v0/status_test.go create mode 100644 internal/database/migrations/013_add_status_fields.sql diff --git a/cmd/publisher/README.md b/cmd/publisher/README.md index 6af0b4b..cd9b91a 100644 --- a/cmd/publisher/README.md +++ b/cmd/publisher/README.md @@ -21,8 +21,9 @@ make dev-compose # Start local registry ### Commands - **`init`** - Generate server.json templates with auto-detection -- **`login`** - Handle authentication (github, dns, http, none) +- **`login`** - Handle authentication (github, dns, http, none) - **`publish`** - Validate and upload servers to registry +- **`status`** - Update server lifecycle status (active, deprecated, deleted) - **`logout`** - Clear stored credentials ### Authentication Providers diff --git a/cmd/publisher/commands/status.go b/cmd/publisher/commands/status.go new file mode 100644 index 0000000..bcfacf5 --- /dev/null +++ b/cmd/publisher/commands/status.go @@ -0,0 +1,375 @@ +package commands + +import ( + "bufio" + "bytes" + "context" + "encoding/json" + "errors" + "flag" + "fmt" + "io" + "net/http" + "net/url" + "os" + "path/filepath" + "strings" +) + +// StatusUpdateRequest represents the request body for status update endpoints +type StatusUpdateRequest struct { + Status string `json:"status"` + StatusMessage *string `json:"statusMessage,omitempty"` +} + +// AllVersionsStatusResponse represents the response from the all-versions status endpoint +type AllVersionsStatusResponse struct { + UpdatedCount int `json:"updatedCount"` +} + +// VersionInfo holds version and status for display +type VersionInfo struct { + Version string + Status string +} + +// ServerResponseMeta represents the _meta field in API responses +type ServerResponseMeta struct { + Official *struct { + Status string `json:"status"` + } `json:"io.modelcontextprotocol.registry/official,omitempty"` +} + +// SingleServerResponse represents the response from a single server version endpoint +type SingleServerResponse struct { + Server struct { + Version string `json:"version"` + } `json:"server"` + Meta ServerResponseMeta `json:"_meta"` +} + +// ServerListResponse represents the response from the versions list endpoint +type ServerListResponse struct { + Servers []SingleServerResponse `json:"servers"` +} + +func StatusCommand(args []string) error { + // Parse command flags + fs := flag.NewFlagSet("status", flag.ExitOnError) + status := fs.String("status", "", "New status: active, deprecated, or deleted (required)") + message := fs.String("message", "", "Optional status message explaining the change") + allVersions := fs.Bool("all-versions", false, "Apply status change to all versions of the server") + yes := fs.Bool("yes", false, "Skip confirmation prompt for bulk operations") + fs.BoolVar(yes, "y", false, "Skip confirmation prompt for bulk operations (shorthand)") + + if err := fs.Parse(args); err != nil { + return err + } + + // Validate required arguments + if *status == "" { + return errors.New("--status flag is required (active, deprecated, or deleted)") + } + + // Validate status value + validStatuses := map[string]bool{"active": true, "deprecated": true, "deleted": true} + if !validStatuses[*status] { + return fmt.Errorf("invalid status '%s'. Must be one of: active, deprecated, deleted", *status) + } + + // Get server name from positional args + remainingArgs := fs.Args() + if len(remainingArgs) < 1 { + return errors.New("server name is required\n\nUsage: mcp-publisher status --status [flags] [version]") + } + + serverName := remainingArgs[0] + var version string + + // Get version if provided (required unless --all-versions is set) + if !*allVersions { + if len(remainingArgs) < 2 { + return errors.New("version is required unless --all-versions flag is set\n\nUsage: mcp-publisher status --status [flags] ") + } + version = remainingArgs[1] + } + + // Load saved token + homeDir, err := os.UserHomeDir() + if err != nil { + return fmt.Errorf("failed to get home directory: %w", err) + } + + tokenPath := filepath.Join(homeDir, TokenFileName) + tokenData, err := os.ReadFile(tokenPath) + if err != nil { + if os.IsNotExist(err) { + return errors.New("not authenticated. Run 'mcp-publisher login ' first") + } + return fmt.Errorf("failed to read token: %w", err) + } + + var tokenInfo map[string]string + if err := json.Unmarshal(tokenData, &tokenInfo); err != nil { + return fmt.Errorf("invalid token data: %w", err) + } + + token := tokenInfo["token"] + registryURL := tokenInfo["registry"] + if registryURL == "" { + registryURL = DefaultRegistryURL + } + + // Update status + if *allVersions { + return updateAllVersionsStatus(registryURL, serverName, *status, *message, token, *yes) + } + return updateVersionStatus(registryURL, serverName, version, *status, *message, token) +} + +func updateVersionStatus(registryURL, serverName, version, status, statusMessage, token string) error { + // Fetch current status to show "from → to" + currentStatus, err := fetchVersionStatus(registryURL, serverName, version, token) + if err != nil { + return fmt.Errorf("failed to fetch current status: %w", err) + } + + _, _ = fmt.Fprintf(os.Stdout, "Updating %s version %s: %s → %s\n", serverName, version, currentStatus, status) + + if err := updateServerStatus(registryURL, serverName, version, status, statusMessage, token); err != nil { + return fmt.Errorf("failed to update status: %w", err) + } + + _, _ = fmt.Fprintln(os.Stdout, "✓ Successfully updated status") + return nil +} + +func updateAllVersionsStatus(registryURL, serverName, status, statusMessage, token string, skipConfirm bool) error { + if !strings.HasSuffix(registryURL, "/") { + registryURL += "/" + } + + // Fetch all versions to show current statuses and get count for confirmation + versions, err := fetchAllVersionsStatus(registryURL, serverName, token) + if err != nil { + return fmt.Errorf("failed to fetch current versions: %w", err) + } + + if len(versions) == 0 { + return errors.New("no versions found for this server") + } + + // Show what will be updated + _, _ = fmt.Fprintf(os.Stdout, "This will update %d version(s) of %s:\n", len(versions), serverName) + for _, v := range versions { + _, _ = fmt.Fprintf(os.Stdout, " %s: %s → %s\n", v.Version, v.Status, status) + } + + // Prompt for confirmation unless -y/--yes was provided + if !skipConfirm { + _, _ = fmt.Fprint(os.Stdout, "Continue? [y/N] ") + reader := bufio.NewReader(os.Stdin) + response, err := reader.ReadString('\n') + if err != nil { + return fmt.Errorf("failed to read response: %w", err) + } + response = strings.TrimSpace(strings.ToLower(response)) + if response != "y" && response != "yes" { + return errors.New("operation cancelled") + } + } + + // Build the request body + requestBody := StatusUpdateRequest{ + Status: status, + } + if statusMessage != "" { + requestBody.StatusMessage = &statusMessage + } + + jsonData, err := json.Marshal(requestBody) + if err != nil { + return fmt.Errorf("error serializing request: %w", err) + } + + // URL encode the server name + encodedServerName := url.PathEscape(serverName) + statusURL := registryURL + "v0/servers/" + encodedServerName + "/status" + + req, err := http.NewRequestWithContext(context.Background(), http.MethodPatch, statusURL, bytes.NewBuffer(jsonData)) + if err != nil { + return fmt.Errorf("error creating request: %w", err) + } + req.Header.Set("Content-Type", "application/json") + req.Header.Set("Authorization", "Bearer "+token) + + client := &http.Client{} + resp, err := client.Do(req) + if err != nil { + return fmt.Errorf("error sending request: %w", err) + } + defer resp.Body.Close() + + body, err := io.ReadAll(resp.Body) + if err != nil { + return fmt.Errorf("error reading response: %w", err) + } + + if resp.StatusCode != http.StatusOK { + return fmt.Errorf("server returned status %d: %s", resp.StatusCode, body) + } + + // Parse response to get updated count + var response AllVersionsStatusResponse + if err := json.Unmarshal(body, &response); err != nil { + // If we can't parse the response, just report success + _, _ = fmt.Fprintln(os.Stdout, "✓ Successfully updated all versions") + return nil + } + + _, _ = fmt.Fprintf(os.Stdout, "✓ Successfully updated %d version(s)\n", response.UpdatedCount) + return nil +} + +func updateServerStatus(registryURL, serverName, version, status, statusMessage, token string) error { + if !strings.HasSuffix(registryURL, "/") { + registryURL += "/" + } + + // Build the request body + requestBody := StatusUpdateRequest{ + Status: status, + } + if statusMessage != "" { + requestBody.StatusMessage = &statusMessage + } + + jsonData, err := json.Marshal(requestBody) + if err != nil { + return fmt.Errorf("error serializing request: %w", err) + } + + // URL encode the server name and version + encodedServerName := url.PathEscape(serverName) + encodedVersion := url.PathEscape(version) + statusURL := registryURL + "v0/servers/" + encodedServerName + "/versions/" + encodedVersion + "/status" + + req, err := http.NewRequestWithContext(context.Background(), http.MethodPatch, statusURL, bytes.NewBuffer(jsonData)) + if err != nil { + return fmt.Errorf("error creating request: %w", err) + } + req.Header.Set("Content-Type", "application/json") + req.Header.Set("Authorization", "Bearer "+token) + + client := &http.Client{} + resp, err := client.Do(req) + if err != nil { + return fmt.Errorf("error sending request: %w", err) + } + defer resp.Body.Close() + + body, err := io.ReadAll(resp.Body) + if err != nil { + return fmt.Errorf("error reading response: %w", err) + } + + if resp.StatusCode != http.StatusOK { + return fmt.Errorf("server returned status %d: %s", resp.StatusCode, body) + } + + return nil +} + +func fetchVersionStatus(registryURL, serverName, version, token string) (string, error) { + if !strings.HasSuffix(registryURL, "/") { + registryURL += "/" + } + + encodedServerName := url.PathEscape(serverName) + encodedVersion := url.PathEscape(version) + fetchURL := registryURL + "v0/servers/" + encodedServerName + "/versions/" + encodedVersion + "?include_deleted=true" + + req, err := http.NewRequestWithContext(context.Background(), http.MethodGet, fetchURL, nil) + if err != nil { + return "", fmt.Errorf("error creating request: %w", err) + } + req.Header.Set("Authorization", "Bearer "+token) + + client := &http.Client{} + resp, err := client.Do(req) + if err != nil { + return "", fmt.Errorf("error sending request: %w", err) + } + defer resp.Body.Close() + + body, err := io.ReadAll(resp.Body) + if err != nil { + return "", fmt.Errorf("error reading response: %w", err) + } + + if resp.StatusCode != http.StatusOK { + return "", fmt.Errorf("server returned status %d: %s", resp.StatusCode, body) + } + + // Parse the response to extract status + var response SingleServerResponse + if err := json.Unmarshal(body, &response); err != nil { + return "", fmt.Errorf("error parsing response: %w", err) + } + + if response.Meta.Official == nil { + return "", errors.New("server response missing status information") + } + + return response.Meta.Official.Status, nil +} + +func fetchAllVersionsStatus(registryURL, serverName, token string) ([]VersionInfo, error) { + if !strings.HasSuffix(registryURL, "/") { + registryURL += "/" + } + + encodedServerName := url.PathEscape(serverName) + fetchURL := registryURL + "v0/servers/" + encodedServerName + "/versions?include_deleted=true" + + req, err := http.NewRequestWithContext(context.Background(), http.MethodGet, fetchURL, nil) + if err != nil { + return nil, fmt.Errorf("error creating request: %w", err) + } + req.Header.Set("Authorization", "Bearer "+token) + + client := &http.Client{} + resp, err := client.Do(req) + if err != nil { + return nil, fmt.Errorf("error sending request: %w", err) + } + defer resp.Body.Close() + + body, err := io.ReadAll(resp.Body) + if err != nil { + return nil, fmt.Errorf("error reading response: %w", err) + } + + if resp.StatusCode != http.StatusOK { + return nil, fmt.Errorf("server returned status %d: %s", resp.StatusCode, body) + } + + var response ServerListResponse + if err := json.Unmarshal(body, &response); err != nil { + return nil, fmt.Errorf("error parsing response: %w", err) + } + + var versions []VersionInfo + for _, s := range response.Servers { + status := "unknown" + if s.Meta.Official != nil { + status = s.Meta.Official.Status + } + versions = append(versions, VersionInfo{ + Version: s.Server.Version, + Status: status, + }) + } + + return versions, nil +} diff --git a/cmd/publisher/commands/status_test.go b/cmd/publisher/commands/status_test.go new file mode 100644 index 0000000..fa1f2d8 --- /dev/null +++ b/cmd/publisher/commands/status_test.go @@ -0,0 +1,311 @@ +package commands_test + +import ( + "strings" + "testing" + + "github.com/modelcontextprotocol/registry/cmd/publisher/commands" +) + +func TestStatusCommand_Validation(t *testing.T) { + tests := []struct { + name string + args []string + expectError bool + errorSubstr string + }{ + { + name: "missing --status flag", + args: []string{"io.github.user/my-server", "1.0.0"}, + expectError: true, + errorSubstr: "--status flag is required", + }, + { + name: "invalid status value", + args: []string{"--status", "invalid", "io.github.user/my-server", "1.0.0"}, + expectError: true, + errorSubstr: "invalid status 'invalid'", + }, + { + name: "missing server name", + args: []string{"--status", "deprecated"}, + expectError: true, + errorSubstr: "server name is required", + }, + { + name: "missing version without --all-versions", + args: []string{"--status", "deprecated", "io.github.user/my-server"}, + expectError: true, + errorSubstr: "version is required unless --all-versions", + }, + { + name: "valid args passes validation", + args: []string{"--status", "deprecated", "io.github.user/my-server", "1.0.0"}, + expectError: false, + }, + { + name: "valid args with --all-versions passes validation", + args: []string{"--status", "deprecated", "--all-versions", "io.github.user/my-server"}, + expectError: false, + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + err := commands.StatusCommand(tt.args) + + if tt.expectError { + if err == nil { + t.Errorf("Expected error but got none") + return + } + if !strings.Contains(err.Error(), tt.errorSubstr) { + t.Errorf("Expected error containing '%s', got: %v", tt.errorSubstr, err) + } + } else if err != nil { + // For valid args, we expect it to pass validation + // It may fail later at auth or API level, which is acceptable + // Just check it's not a validation error + if strings.Contains(err.Error(), "invalid status") || + strings.Contains(err.Error(), "server name is required") || + strings.Contains(err.Error(), "version is required unless") || + strings.Contains(err.Error(), "--status flag is required") { + t.Errorf("Validation failed unexpectedly: %v", err) + } + } + }) + } +} + +func TestStatusCommand_ServerNameValidation(t *testing.T) { + tests := []struct { + name string + serverName string + }{ + { + name: "valid github server name", + serverName: "io.github.user/my-server", + }, + { + name: "valid domain server name", + serverName: "com.example/my-server", + }, + { + name: "server name with dashes", + serverName: "io.github.user/my-cool-server", + }, + { + name: "server name with underscores", + serverName: "io.github.user/my_server", + }, + { + name: "server name with dots", + serverName: "io.github.user/my.server", + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + args := []string{"--status", "deprecated", tt.serverName, "1.0.0"} + err := commands.StatusCommand(args) + + // Should pass validation (server name format is not validated by CLI) + if err != nil && strings.Contains(err.Error(), "server name is required") { + t.Errorf("Server name '%s' was rejected", tt.serverName) + } + }) + } +} + +func TestStatusCommand_VersionValidation(t *testing.T) { + tests := []struct { + name string + version string + }{ + { + name: "semver version", + version: "1.0.0", + }, + { + name: "semver with patch", + version: "1.2.3", + }, + { + name: "semver with prerelease", + version: "1.0.0-alpha", + }, + { + name: "semver with build metadata", + version: "1.0.0+20130313144700", + }, + { + name: "semver with prerelease and build", + version: "1.0.0-beta.1+exp.sha.5114f85", + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + args := []string{"--status", "deprecated", "io.github.user/my-server", tt.version} + err := commands.StatusCommand(args) + + // Should pass validation (version format is not validated by CLI) + if err != nil && strings.Contains(err.Error(), "version is required") { + t.Errorf("Version '%s' was rejected", tt.version) + } + }) + } +} + +func TestStatusCommand_AllVersionsFlag(t *testing.T) { + tests := []struct { + name string + args []string + expectError bool + errorSubstr string + }{ + { + name: "all-versions without version arg passes validation", + args: []string{"--status", "deprecated", "--all-versions", "io.github.user/my-server"}, + expectError: false, + }, + { + name: "all-versions with extra version arg still works", + args: []string{"--status", "deprecated", "--all-versions", "io.github.user/my-server", "1.0.0"}, + expectError: false, + }, + { + name: "missing server name with all-versions", + args: []string{"--status", "deprecated", "--all-versions"}, + expectError: true, + errorSubstr: "server name is required", + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + err := commands.StatusCommand(tt.args) + + if tt.expectError { + if err == nil { + t.Errorf("Expected error but got none") + return + } + if !strings.Contains(err.Error(), tt.errorSubstr) { + t.Errorf("Expected error containing '%s', got: %v", tt.errorSubstr, err) + } + } else if err != nil { + // Should pass validation + // Just check it's not a validation error + if strings.Contains(err.Error(), "invalid status") || + strings.Contains(err.Error(), "server name is required") || + strings.Contains(err.Error(), "version is required unless") || + strings.Contains(err.Error(), "--status flag is required") { + t.Errorf("Validation failed unexpectedly: %v", err) + } + } + }) + } +} + +func TestStatusCommand_FlagCombinations(t *testing.T) { + tests := []struct { + name string + args []string + }{ + { + name: "status with message", + args: []string{"--status", "deprecated", "--message", "Please upgrade to v2", "io.github.user/my-server", "1.0.0"}, + }, + { + name: "all-versions with message", + args: []string{"--status", "deprecated", "--all-versions", "--message", "All versions deprecated", "io.github.user/my-server"}, + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + err := commands.StatusCommand(tt.args) + // All these should pass CLI validation + // They may fail at auth or API level which is acceptable + if err != nil { + // Just check it's not a validation error we can detect + if strings.Contains(err.Error(), "invalid status") || + strings.Contains(err.Error(), "server name is required") || + strings.Contains(err.Error(), "version is required unless") || + strings.Contains(err.Error(), "--status flag is required") { + t.Errorf("Validation failed unexpectedly: %v", err) + } + } + }) + } +} + +func TestStatusCommand_MissingStatus(t *testing.T) { + // Test various ways status flag can be missing + tests := []struct { + name string + args []string + }{ + { + name: "no status flag at all", + args: []string{"io.github.user/my-server", "1.0.0"}, + }, + { + name: "empty status value", + args: []string{"--status", "", "io.github.user/my-server", "1.0.0"}, + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + err := commands.StatusCommand(tt.args) + + if err == nil { + t.Errorf("Expected error for missing status but got none") + return + } + if !strings.Contains(err.Error(), "--status flag is required") { + t.Errorf("Expected '--status flag is required' error, got: %v", err) + } + }) + } +} + +func TestStatusCommand_YesFlag(t *testing.T) { + tests := []struct { + name string + args []string + }{ + { + name: "all-versions with --yes flag", + args: []string{"--status", "deprecated", "--all-versions", "--yes", "io.github.user/my-server"}, + }, + { + name: "all-versions with -y shorthand", + args: []string{"--status", "deprecated", "--all-versions", "-y", "io.github.user/my-server"}, + }, + { + name: "yes flag with single version (flag accepted but not used)", + args: []string{"--status", "deprecated", "--yes", "io.github.user/my-server", "1.0.0"}, + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + err := commands.StatusCommand(tt.args) + // All these should pass CLI validation + // They may fail at auth or API level which is acceptable + if err != nil { + // Just check it's not a validation error + if strings.Contains(err.Error(), "invalid status") || + strings.Contains(err.Error(), "server name is required") || + strings.Contains(err.Error(), "version is required unless") || + strings.Contains(err.Error(), "--status flag is required") || + strings.Contains(err.Error(), "flag provided but not defined") { + t.Errorf("Validation failed unexpectedly: %v", err) + } + } + }) + } +} diff --git a/cmd/publisher/main.go b/cmd/publisher/main.go index 1b265d7..20cea2b 100644 --- a/cmd/publisher/main.go +++ b/cmd/publisher/main.go @@ -43,6 +43,8 @@ func main() { err = commands.LogoutCommand() case "publish": err = commands.PublishCommand(os.Args[2:]) + case "status": + err = commands.StatusCommand(os.Args[2:]) case "validate": err = commands.ValidateCommand(os.Args[2:]) case "--version", "-v", "version": @@ -73,6 +75,7 @@ func printUsage() { _, _ = fmt.Fprintln(os.Stdout, " login Authenticate with the registry") _, _ = fmt.Fprintln(os.Stdout, " logout Clear saved authentication") _, _ = fmt.Fprintln(os.Stdout, " publish Publish server.json to the registry") + _, _ = fmt.Fprintln(os.Stdout, " status Update the status of a server version") _, _ = fmt.Fprintln(os.Stdout, " validate Validate server.json without publishing") _, _ = fmt.Fprintln(os.Stdout) _, _ = fmt.Fprintln(os.Stdout, "Use 'mcp-publisher --help' for more information about a command.") @@ -128,6 +131,39 @@ func printCommandHelp(command string) { _, _ = fmt.Fprintln(os.Stdout) _, _ = fmt.Fprintln(os.Stdout, "You must be logged in before publishing. Run 'mcp-publisher login' first.") + case "status": + _, _ = fmt.Fprintln(os.Stdout, "Update the status of a server version") + _, _ = fmt.Fprintln(os.Stdout) + _, _ = fmt.Fprintln(os.Stdout, "Usage:") + _, _ = fmt.Fprintln(os.Stdout, " mcp-publisher status --status [flags] [version]") + _, _ = fmt.Fprintln(os.Stdout) + _, _ = fmt.Fprintln(os.Stdout, "Flags (must come before positional arguments):") + _, _ = fmt.Fprintln(os.Stdout, " --status string New status: active, deprecated, or deleted (required)") + _, _ = fmt.Fprintln(os.Stdout, " --message string Optional message explaining the status change") + _, _ = fmt.Fprintln(os.Stdout, " --all-versions Apply status change to all versions of the server") + _, _ = fmt.Fprintln(os.Stdout) + _, _ = fmt.Fprintln(os.Stdout, "Arguments:") + _, _ = fmt.Fprintln(os.Stdout, " server-name Full server name (e.g., io.github.user/my-server)") + _, _ = fmt.Fprintln(os.Stdout, " version Server version to update (required unless --all-versions is set)") + _, _ = fmt.Fprintln(os.Stdout) + _, _ = fmt.Fprintln(os.Stdout, "Examples:") + _, _ = fmt.Fprintln(os.Stdout, " # Deprecate a specific version") + _, _ = fmt.Fprintln(os.Stdout, " mcp-publisher status --status deprecated --message \"Please upgrade to 2.0.0\" \\") + _, _ = fmt.Fprintln(os.Stdout, " io.github.user/my-server 1.0.0") + _, _ = fmt.Fprintln(os.Stdout) + _, _ = fmt.Fprintln(os.Stdout, " # Delete a version with security issues") + _, _ = fmt.Fprintln(os.Stdout, " mcp-publisher status --status deleted --message \"Critical security vulnerability\" \\") + _, _ = fmt.Fprintln(os.Stdout, " io.github.user/my-server 1.0.0") + _, _ = fmt.Fprintln(os.Stdout) + _, _ = fmt.Fprintln(os.Stdout, " # Restore a version to active") + _, _ = fmt.Fprintln(os.Stdout, " mcp-publisher status --status active io.github.user/my-server 1.0.0") + _, _ = fmt.Fprintln(os.Stdout) + _, _ = fmt.Fprintln(os.Stdout, " # Deprecate all versions") + _, _ = fmt.Fprintln(os.Stdout, " mcp-publisher status --status deprecated --all-versions --message \"Project archived\" \\") + _, _ = fmt.Fprintln(os.Stdout, " io.github.user/my-server") + _, _ = fmt.Fprintln(os.Stdout) + _, _ = fmt.Fprintln(os.Stdout, "You must be logged in before updating status. Run 'mcp-publisher login' first.") + default: fmt.Fprintf(os.Stderr, "Unknown command: %s\n", command) printUsage() diff --git a/docs/modelcontextprotocol-io/faq.mdx b/docs/modelcontextprotocol-io/faq.mdx index 7493d66..078ae45 100644 --- a/docs/modelcontextprotocol-io/faq.mdx +++ b/docs/modelcontextprotocol-io/faq.mdx @@ -18,7 +18,21 @@ sidebarTitle: FAQ ### Can I delete/unpublish my server? -Currently, no. At the time of writing, there is [open discussion](https://github.com/modelcontextprotocol/registry/issues/104). +Yes, you can change your server's status to `deleted` using the `mcp-publisher status` command: + +```bash +# Delete a specific version +mcp-publisher status --status deleted --message "No longer maintained" \ + io.github.my-username/my-server 1.0.0 + +# Delete all versions +mcp-publisher status --status deleted --all-versions --message "Project archived" \ + io.github.my-username/my-server +``` + +Deleted servers are hidden from default API listings but can still be retrieved with `include_deleted=true`. You can restore a deleted server by setting its status back to `active`. + +**Note**: Server metadata is never permanently removed from the registry. The `deleted` status hides the server from discovery but preserves the historical record. ### How do I update my server metadata? diff --git a/docs/reference/api/CHANGELOG.md b/docs/reference/api/CHANGELOG.md index d6b99cd..04b5935 100644 --- a/docs/reference/api/CHANGELOG.md +++ b/docs/reference/api/CHANGELOG.md @@ -2,6 +2,39 @@ Changes to the REST API endpoints and responses. +## Unreleased + +### Added + +#### Server Status Management Endpoints + +New endpoints for managing server lifecycle status: + +- `PATCH /v0/servers/{serverName}/versions/{version}/status` - Update status of a specific server version +- `PATCH /v0/servers/{serverName}/status` - Update status of all versions of a server in a single transaction + +**Status values:** +- `active` - Server is active and visible in default listings +- `deprecated` - Server is deprecated but still visible with a warning message +- `deleted` - Server is hidden from default listings + +**Authentication:** Requires `publish` or `edit` permission for the server namespace. + +#### New Response Fields + +New fields added to `_meta["io.modelcontextprotocol.registry/official"]` (RegistryExtensions): + +- `statusChangedAt` - Timestamp when the server status was last changed +- `statusMessage` - Optional message explaining status change (e.g., deprecation reason, migration guidance) + +#### Server Filtering Enhancements + +New `include_deleted` query parameter added to multiple endpoints: + +- `GET /v0/servers` - Include deleted servers in list results (default: `false`, automatically `true` when `updated_since` is provided) +- `GET /v0/servers/{serverName}/versions/{version}` - Include deleted servers in detail results (default: `false`) +- `GET /v0/servers/{serverName}/versions` - Include deleted servers in version history (default: `false`) + ## 2025-10-17 ### Added @@ -120,4 +153,4 @@ API endpoints updated for consistent server identification across versions. ## 2025-07-09 -Initial release of the Registry API. \ No newline at end of file +Initial release of the Registry API. diff --git a/docs/reference/api/generic-registry-api.md b/docs/reference/api/generic-registry-api.md index 5832e53..f351021 100644 --- a/docs/reference/api/generic-registry-api.md +++ b/docs/reference/api/generic-registry-api.md @@ -20,6 +20,8 @@ The official registry has some more endpoints and restrictions on top of this. S - **`POST /v0.1/publish`** - Publish new server (optional, registry-specific authentication) - **`PUT /v0.1/servers/{serverName}/versions/{version}`** - Update specific server version (optional, not implemented by official registry) - **`DELETE /v0.1/servers/{serverName}/versions/{version}`** - Delete specific server version (optional, not implemented by official registry) +- **`PATCH /v0.1/servers/{serverName}/versions/{version}/status`** - Update server version status (optional) +- **`PATCH /v0.1/servers/{serverName}/status`** - Update status for all versions (optional) Server names and version strings should be URL-encoded in paths. diff --git a/docs/reference/api/official-registry-api.md b/docs/reference/api/official-registry-api.md index f9e3c7d..2012885 100644 --- a/docs/reference/api/official-registry-api.md +++ b/docs/reference/api/official-registry-api.md @@ -38,14 +38,36 @@ The official registry enforces additional [package validation requirements](../s The official registry extends the `GET /v0.1/servers` endpoint with additional query parameters for improved discovery and synchronization: - `updated_since` - Filter servers updated after RFC3339 timestamp (e.g., `2025-08-07T13:15:04.280Z`) -- `search` - Case-insensitive substring search on server names (e.g., `filesystem`) +- `search` - Case-insensitive substring search on server names (e.g., `filesystem`) - This is intentionally simple. For more advanced searching and filtering, use a subregistry. - `version` - Filter by version (currently supports `latest` for latest versions only) +- `include_deleted` - Include deleted servers in results (default: `false`, but automatically `true` when `updated_since` is provided for incremental sync) These extensions enable efficient incremental synchronization for downstream registries and improved server discovery. Parameters can be combined and work with standard cursor-based pagination. Example: `GET /v0.1/servers?search=filesystem&updated_since=2025-08-01T00:00:00Z&version=latest` +### Server Detail + +The `GET /v0.1/servers/{serverName}/versions/{version}` endpoint returns detailed information about a specific server version. + +**Path parameters:** +- `serverName` - URL-encoded server name (e.g., `io.github.user%2Fmy-server`) +- `version` - Server version or `latest` for the most recent version + +**Query parameters:** +- `include_deleted` - Include deleted servers in results (default: `false`) + +### Server Version History + +The `GET /v0.1/servers/{serverName}/versions` endpoint returns all versions of a server. + +**Path parameters:** +- `serverName` - URL-encoded server name (e.g., `io.github.user%2Fmy-server`) + +**Query parameters:** +- `include_deleted` - Include deleted servers in results (default: `false`) + ### Additional endpoints #### Auth endpoints @@ -55,6 +77,38 @@ Example: `GET /v0.1/servers?search=filesystem&updated_since=2025-08-01T00:00:00Z - POST `/v0.1/auth/github-oidc` - Exchange GitHub OIDC token for auth token - POST `/v0.1/auth/oidc` - Exchange Google OIDC token for auth token (for admins) +#### Status endpoints + +##### Update Single Version Status + +`PATCH /v0.1/servers/{serverName}/versions/{version}/status` - Update status of a specific server version. + +**Path parameters:** +- `serverName` - URL-encoded server name (e.g., `io.github.user%2Fmy-server`) +- `version` - Server version to update + +**Request body:** +- `status` (required) - New status: `active`, `deprecated`, or `deleted` +- `statusMessage` (optional) - Message explaining the status change (max 500 characters, not allowed when status is `active`) + +##### Update All Versions Status + +`PATCH /v0.1/servers/{serverName}/status` - Update status of all versions of a server in a single transaction. + +**Path parameters:** +- `serverName` - URL-encoded server name (e.g., `io.github.user%2Fmy-server`) + +**Request body:** +- `status` (required) - New status: `active`, `deprecated`, or `deleted` +- `statusMessage` (optional) - Message explaining the status change (max 500 characters, not allowed when status is `active`) + +**Status values:** +- `active` - Server is active and visible in default listings +- `deprecated` - Server is deprecated but still visible with a warning message +- `deleted` - Server is hidden from default listings (use `include_deleted=true` to show) + +**Authentication:** Requires `publish` or `edit` permission for the server namespace. + #### Admin endpoints - GET `/metrics` - Prometheus metrics endpoint - GET `/v0.1/health` - Basic health check endpoint diff --git a/docs/reference/api/openapi.yaml b/docs/reference/api/openapi.yaml index 4a5ba69..12d5d81 100644 --- a/docs/reference/api/openapi.yaml +++ b/docs/reference/api/openapi.yaml @@ -61,6 +61,13 @@ paths: schema: type: string example: "1.2.3" + - name: include_deleted + in: query + description: Include deleted servers in results (default false, but always true when updated_since is provided) + required: false + schema: + type: boolean + default: false responses: '200': description: A list of MCP servers @@ -307,6 +314,156 @@ paths: error: type: string example: "Deletion is not supported by this registry" + /v0.1/servers/{serverName}/versions/{version}/status: + patch: + tags: [publish] + summary: Update server version status + description: | + Update the lifecycle status of a specific server version. + + Requires `publish` or `edit` permission for the server namespace. + security: + - bearerAuth: [] + parameters: + - name: serverName + in: path + required: true + description: URL-encoded server name (e.g., "com.example%2Fmy-server") + schema: + type: string + example: "com.example%2Fmy-server" + - name: version + in: path + required: true + description: URL-encoded version to update + schema: + type: string + example: "1.0.0" + requestBody: + required: true + content: + application/json: + schema: + $ref: '#/components/schemas/StatusUpdateRequest' + responses: + '200': + description: Successfully updated server status + content: + application/json: + schema: + $ref: '#/components/schemas/ServerResponse' + '400': + description: Bad request - Invalid status transition or no changes to apply + content: + application/json: + schema: + type: object + properties: + error: + type: string + example: "No changes to apply: status is already deprecated" + '401': + description: Unauthorized - Invalid or missing authentication token + content: + application/json: + schema: + type: object + properties: + error: + type: string + example: "Invalid or expired Registry JWT token" + '403': + description: Forbidden - Insufficient permissions + content: + application/json: + schema: + type: object + properties: + error: + type: string + example: "You do not have publish or edit permissions for this server" + '404': + description: Server version not found + content: + application/json: + schema: + type: object + properties: + error: + type: string + example: "Server version not found" + /v0.1/servers/{serverName}/status: + patch: + tags: [publish] + summary: Update status for all server versions + description: | + Update the lifecycle status of all versions of a server in a single transaction. + Either all versions are updated or none on failure. + + Requires `publish` or `edit` permission for the server namespace. + security: + - bearerAuth: [] + parameters: + - name: serverName + in: path + required: true + description: URL-encoded server name (e.g., "com.example%2Fmy-server") + schema: + type: string + example: "com.example%2Fmy-server" + requestBody: + required: true + content: + application/json: + schema: + $ref: '#/components/schemas/StatusUpdateRequest' + responses: + '200': + description: Successfully updated all versions + content: + application/json: + schema: + $ref: '#/components/schemas/AllVersionsStatusResponse' + '400': + description: Bad request - Invalid status value + content: + application/json: + schema: + type: object + properties: + error: + type: string + example: "Invalid status value" + '401': + description: Unauthorized - Invalid or missing authentication token + content: + application/json: + schema: + type: object + properties: + error: + type: string + example: "Invalid or expired Registry JWT token" + '403': + description: Forbidden - Insufficient permissions + content: + application/json: + schema: + type: object + properties: + error: + type: string + example: "You do not have publish or edit permissions for this server" + '404': + description: Server not found + content: + application/json: + schema: + type: object + properties: + error: + type: string + example: "Server not found" /v0.1/publish: post: tags: [publish] @@ -863,6 +1020,11 @@ components: enum: ["active", "deprecated", "deleted"] description: Server lifecycle status example: "active" + statusMessage: + type: string + description: Optional message explaining the status (e.g., deprecation reason) + example: "Please upgrade to version 2.0.0" + maxLength: 500 publishedAt: type: string format: date-time @@ -879,3 +1041,37 @@ components: example: true additionalProperties: false additionalProperties: true + + StatusUpdateRequest: + description: Request body for updating server status + type: object + required: + - status + properties: + status: + type: string + enum: ["active", "deprecated", "deleted"] + description: New server lifecycle status + example: "deprecated" + statusMessage: + type: string + description: Optional message explaining the status change (e.g., deprecation reason) + example: "Please upgrade to version 2.0.0" + maxLength: 500 + + AllVersionsStatusResponse: + description: Response from bulk status update for all versions + type: object + required: + - updatedCount + - servers + properties: + updatedCount: + type: integer + description: Number of versions updated + example: 3 + servers: + type: array + description: List of all updated server versions + items: + $ref: '#/components/schemas/ServerResponse' diff --git a/docs/reference/cli/commands.md b/docs/reference/cli/commands.md index d2185a4..4d7d71a 100644 --- a/docs/reference/cli/commands.md +++ b/docs/reference/cli/commands.md @@ -276,6 +276,51 @@ mcp-publisher publish mcp-publisher publish ./config/server.json ``` +### `mcp-publisher status` + +Update the lifecycle status of a published server. + +**Usage:** +```bash +mcp-publisher status --status [flags] [version] +``` + +**Flags:** +- `--status` (required) - New status: `active`, `deprecated`, or `deleted` +- `--message` - Optional message explaining the status change (not allowed when status is `active`) +- `--all-versions` - Apply status change to all versions of the server +- `--yes`, `-y` - Skip confirmation prompt (only applies when using `--all-versions`) + +**Arguments:** +- `server-name` - Full server name (e.g., `io.github.user/my-server`) +- `version` - Server version to update (required unless `--all-versions` is set) + +**Status Values:** +- `active` - Server is active and visible in default listings +- `deprecated` - Server is deprecated but still visible with a warning message +- `deleted` - Server is hidden from default listings + +**Examples:** +```bash +# Deprecate a specific version +mcp-publisher status --status deprecated --message "Please upgrade to 2.0.0" \ + io.github.user/my-server 1.0.0 + +# Delete a version with security issues +mcp-publisher status --status deleted --message "Critical security vulnerability" \ + io.github.user/my-server 1.0.0 + +# Restore a version to active +mcp-publisher status --status active io.github.user/my-server 1.0.0 + +# Deprecate all versions at once +mcp-publisher status --status deprecated --all-versions --message "Project archived" \ + io.github.user/my-server +``` + +**Requirements:** +- Must be logged in with `publish` or `edit` permission for the server namespace + ### `mcp-publisher logout` Clear stored authentication credentials. diff --git a/internal/api/handlers/v0/edit.go b/internal/api/handlers/v0/edit.go index 5c519e2..2862350 100644 --- a/internal/api/handlers/v0/edit.go +++ b/internal/api/handlers/v0/edit.go @@ -8,13 +8,13 @@ import ( "strings" "github.com/danielgtaylor/huma/v2" + "github.com/modelcontextprotocol/registry/internal/auth" "github.com/modelcontextprotocol/registry/internal/config" "github.com/modelcontextprotocol/registry/internal/database" "github.com/modelcontextprotocol/registry/internal/service" "github.com/modelcontextprotocol/registry/internal/validators" apiv0 "github.com/modelcontextprotocol/registry/pkg/api/v0" - "github.com/modelcontextprotocol/registry/pkg/model" ) // EditServerInput represents the input for editing a server @@ -22,7 +22,6 @@ type EditServerInput struct { Authorization string `header:"Authorization" doc:"Registry JWT token with edit permissions" required:"true"` ServerName string `path:"serverName" doc:"URL-encoded server name" example:"com.example%2Fmy-server"` Version string `path:"version" doc:"URL-encoded version to edit" example:"1.0.0"` - Status string `query:"status" doc:"New status for the server (active, deprecated, deleted)" required:"false" enum:"active,deprecated,deleted"` Body apiv0.ServerJSON `body:""` } @@ -36,8 +35,8 @@ func RegisterEditEndpoints(api huma.API, pathPrefix string, registry service.Reg Method: http.MethodPut, Path: pathPrefix + "/servers/{serverName}/versions/{version}", Summary: "Edit MCP server", - Description: "Update a specific version of an existing MCP server (admin only).", - Tags: []string{"admin"}, + Description: "Update the configuration of a specific version of an existing MCP server. Requires edit permission for the server. Use PATCH /servers/{serverName}/versions/{version}/status to update status metadata.", + Tags: []string{"servers"}, Security: []map[string][]string{ {"bearer": {}}, }, @@ -69,7 +68,8 @@ func RegisterEditEndpoints(api huma.API, pathPrefix string, registry service.Reg } // Get current server to check permissions against existing name - currentServer, err := registry.GetServerByNameAndVersion(ctx, serverName, version) + // Deleted servers return 404 - restore via status endpoint first + currentServer, err := registry.GetServerByNameAndVersion(ctx, serverName, version, false) if err != nil { if errors.Is(err, database.ErrNotFound) { return nil, huma.Error404NotFound("Server not found") @@ -98,28 +98,7 @@ func RegisterEditEndpoints(api huma.API, pathPrefix string, registry service.Reg return nil, huma.Error422UnprocessableEntity("Failed to edit server, invalid schema: call /validate for details") } - // Handle status changes with proper permission validation - if input.Status != "" { - newStatus := model.Status(input.Status) - - // Prevent undeleting servers - once deleted, they stay deleted - if currentServer.Meta.Official != nil && - currentServer.Meta.Official.Status == model.StatusDeleted && - newStatus != model.StatusDeleted { - return nil, huma.Error400BadRequest("Cannot change status of deleted server. Deleted servers cannot be undeleted.") - } - - // For now, only allow status changes for admins - // Future: Implement logic to allow server authors to change active <-> deprecated - // but only admins can set to deleted - } - - // Update the server using the service - var statusPtr *string - if input.Status != "" { - statusPtr = &input.Status - } - updatedServer, err := registry.UpdateServer(ctx, serverName, version, &input.Body, statusPtr) + updatedServer, err := registry.UpdateServer(ctx, serverName, version, &input.Body, nil) if err != nil { if errors.Is(err, database.ErrNotFound) { return nil, huma.Error404NotFound("Server not found") diff --git a/internal/api/handlers/v0/edit_test.go b/internal/api/handlers/v0/edit_test.go index 66089db..8575944 100644 --- a/internal/api/handlers/v0/edit_test.go +++ b/internal/api/handlers/v0/edit_test.go @@ -71,25 +71,6 @@ func TestEditServerEndpoint(t *testing.T) { require.NoError(t, err) } - // Create a deleted server for undelete testing - deletedServer := &apiv0.ServerJSON{ - Schema: model.CurrentSchemaURL, - Name: "io.github.testuser/deleted-server", - Description: "Server that was deleted", - Version: "1.0.0", - Repository: &model.Repository{ - URL: "https://github.com/testuser/deleted-server", - Source: "github", - ID: "testuser/deleted-server", - }, - } - _, err = registryService.CreateServer(context.Background(), deletedServer) - require.NoError(t, err) - - // Set the server to deleted status - _, err = registryService.UpdateServer(context.Background(), deletedServer.Name, deletedServer.Version, deletedServer, stringPtr(string(model.StatusDeleted))) - require.NoError(t, err) - // Create a server with build metadata for URL encoding test buildMetadataServer := &apiv0.ServerJSON{ Schema: model.CurrentSchemaURL, @@ -112,7 +93,6 @@ func TestEditServerEndpoint(t *testing.T) { authClaims *auth.JWTClaims authHeader string requestBody apiv0.ServerJSON - statusParam string expectedStatus int expectedError string checkResult func(*testing.T, *apiv0.ServerResponse) @@ -148,31 +128,6 @@ func TestEditServerEndpoint(t *testing.T) { assert.NotNil(t, resp.Meta.Official) }, }, - { - name: "successful edit with status change", - serverName: "io.github.testuser/editable-server", - version: "1.0.0", - authClaims: &auth.JWTClaims{ - AuthMethod: auth.MethodGitHubAT, - AuthMethodSubject: "testuser", - Permissions: []auth.Permission{ - {Action: auth.PermissionActionEdit, ResourcePattern: "io.github.testuser/*"}, - }, - }, - requestBody: apiv0.ServerJSON{ - Schema: model.CurrentSchemaURL, - Name: "io.github.testuser/editable-server", - Description: "Server with status change", - Version: "1.0.0", - }, - statusParam: "deprecated", - expectedStatus: http.StatusOK, - checkResult: func(t *testing.T, resp *apiv0.ServerResponse) { - t.Helper() - assert.Equal(t, "Server with status change", resp.Server.Description) - assert.Equal(t, model.StatusDeprecated, resp.Meta.Official.Status) - }, - }, { name: "missing authorization header", serverName: "io.github.testuser/editable-server", @@ -310,27 +265,6 @@ func TestEditServerEndpoint(t *testing.T) { expectedStatus: http.StatusBadRequest, expectedError: "Version in request body must match URL path parameter", }, - { - name: "attempt to undelete server should fail", - serverName: "io.github.testuser/deleted-server", - version: "1.0.0", - authClaims: &auth.JWTClaims{ - AuthMethod: auth.MethodGitHubAT, - AuthMethodSubject: "testuser", - Permissions: []auth.Permission{ - {Action: auth.PermissionActionEdit, ResourcePattern: "io.github.testuser/*"}, - }, - }, - requestBody: apiv0.ServerJSON{ - Schema: model.CurrentSchemaURL, - Name: "io.github.testuser/deleted-server", - Description: "Trying to undelete server", - Version: "1.0.0", - }, - statusParam: "active", // Trying to change from deleted to active - expectedStatus: http.StatusBadRequest, - expectedError: "Cannot change status of deleted server", - }, { name: "successful edit of version with build metadata (URL encoded)", serverName: "io.github.testuser/build-metadata-server", @@ -381,9 +315,6 @@ func TestEditServerEndpoint(t *testing.T) { encodedServerName := url.PathEscape(tc.serverName) encodedVersion := url.PathEscape(tc.version) requestURL := "/v0/servers/" + encodedServerName + "/versions/" + encodedVersion - if tc.statusParam != "" { - requestURL += "?status=" + tc.statusParam - } req := httptest.NewRequest(http.MethodPut, requestURL, bytes.NewReader(requestBody)) req.Header.Set("Content-Type", "application/json") @@ -404,6 +335,9 @@ func TestEditServerEndpoint(t *testing.T) { mux.ServeHTTP(w, req) // Check response + if tc.expectedStatus != w.Code { + t.Logf("Response body: %s", w.Body.String()) + } assert.Equal(t, tc.expectedStatus, w.Code) if tc.expectedError != "" { @@ -437,12 +371,10 @@ func TestEditServerEndpointEdgeCases(t *testing.T) { testServers := []struct { name string version string - status model.Status }{ - {"com.example/active-server", "1.0.0", model.StatusActive}, - {"com.example/deprecated-server", "1.0.0", model.StatusDeprecated}, - {"com.example/multi-version-server", "1.0.0", model.StatusActive}, - {"com.example/multi-version-server", "2.0.0", model.StatusActive}, + {"com.example/active-server", "1.0.0"}, + {"com.example/multi-version-server", "1.0.0"}, + {"com.example/multi-version-server", "2.0.0"}, } for _, server := range testServers { @@ -453,17 +385,6 @@ func TestEditServerEndpointEdgeCases(t *testing.T) { Version: server.version, }) require.NoError(t, err) - - // Set specific status if not active - if server.status != model.StatusActive { - _, err = registryService.UpdateServer(context.Background(), server.name, server.version, &apiv0.ServerJSON{ - Schema: model.CurrentSchemaURL, - Name: server.name, - Description: "Test server for editing", - Version: server.version, - }, stringPtr(string(server.status))) - require.NoError(t, err) - } } // Create API @@ -471,95 +392,6 @@ func TestEditServerEndpointEdgeCases(t *testing.T) { api := humago.New(mux, huma.DefaultConfig("Test API", "1.0.0")) v0.RegisterEditEndpoints(api, "/v0", registryService, cfg) - t.Run("status transitions", func(t *testing.T) { - tests := []struct { - name string - serverName string - version string - fromStatus string - toStatus string - expectedStatus int - expectedError string - }{ - { - name: "active to deprecated", - serverName: "com.example/active-server", - version: "1.0.0", - toStatus: "deprecated", - expectedStatus: http.StatusOK, - }, - { - name: "deprecated to active", - serverName: "com.example/deprecated-server", - version: "1.0.0", - toStatus: "active", - expectedStatus: http.StatusOK, - }, - { - name: "active to deleted", - serverName: "com.example/active-server", - version: "1.0.0", - toStatus: "deleted", - expectedStatus: http.StatusOK, - }, - { - name: "invalid status", - serverName: "com.example/active-server", - version: "1.0.0", - toStatus: "invalid_status", - expectedStatus: http.StatusUnprocessableEntity, - expectedError: "validation failed", - }, - } - - for _, tt := range tests { - t.Run(tt.name, func(t *testing.T) { - requestBody := apiv0.ServerJSON{ - Schema: model.CurrentSchemaURL, - Name: tt.serverName, - Description: "Status transition test", - Version: tt.version, - } - - bodyBytes, err := json.Marshal(requestBody) - require.NoError(t, err) - - encodedName := url.PathEscape(tt.serverName) - requestURL := "/v0/servers/" + encodedName + "/versions/" + tt.version + "?status=" + tt.toStatus - - req := httptest.NewRequest(http.MethodPut, requestURL, bytes.NewReader(bodyBytes)) - req.Header.Set("Content-Type", "application/json") - - // Generate admin token - jwtManager := auth.NewJWTManager(cfg) - tokenResponse, err := jwtManager.GenerateTokenResponse(context.Background(), auth.JWTClaims{ - AuthMethod: auth.MethodNone, - Permissions: []auth.Permission{ - {Action: auth.PermissionActionEdit, ResourcePattern: "*"}, - }, - }) - require.NoError(t, err) - req.Header.Set("Authorization", "Bearer "+tokenResponse.RegistryToken) - - w := httptest.NewRecorder() - mux.ServeHTTP(w, req) - - assert.Equal(t, tt.expectedStatus, w.Code) - - if tt.expectedError != "" { - assert.Contains(t, w.Body.String(), tt.expectedError) - } - - if tt.expectedStatus == http.StatusOK { - var response apiv0.ServerResponse - err := json.NewDecoder(w.Body).Decode(&response) - require.NoError(t, err) - assert.Equal(t, model.Status(tt.toStatus), response.Meta.Official.Status) - } - }) - } - }) - t.Run("URL encoding edge cases", func(t *testing.T) { // Create server with special characters specialServerName := "io.dots.and-dashes/server_with_underscores" @@ -651,13 +483,70 @@ func TestEditServerEndpointEdgeCases(t *testing.T) { assert.Equal(t, "1.0.0", response.Server.Version) // Verify the other version wasn't affected - otherVersion, err := registryService.GetServerByNameAndVersion(context.Background(), "com.example/multi-version-server", "2.0.0") + otherVersion, err := registryService.GetServerByNameAndVersion(context.Background(), "com.example/multi-version-server", "2.0.0", false) require.NoError(t, err) assert.NotEqual(t, "Updated v1.0.0 specifically", otherVersion.Server.Description) }) -} -// Helper function -func stringPtr(s string) *string { - return &s + t.Run("edit preserves status metadata", func(t *testing.T) { + // Create a server and set it to deprecated using the service directly + deprecatedServer := &apiv0.ServerJSON{ + Schema: model.CurrentSchemaURL, + Name: "com.example/deprecated-for-edit-test", + Description: "Server to test edit preserves status", + Version: "1.0.0", + } + _, err := registryService.CreateServer(context.Background(), deprecatedServer) + require.NoError(t, err) + + // Set to deprecated status using UpdateServerStatus + statusMsg := "This server is deprecated" + _, err = registryService.UpdateServerStatus(context.Background(), deprecatedServer.Name, deprecatedServer.Version, &service.StatusChangeRequest{ + NewStatus: model.StatusDeprecated, + StatusMessage: &statusMsg, + }) + require.NoError(t, err) + + // Now edit the server description + requestBody := apiv0.ServerJSON{ + Schema: model.CurrentSchemaURL, + Name: "com.example/deprecated-for-edit-test", + Description: "Updated description but status should remain deprecated", + Version: "1.0.0", + } + + bodyBytes, err := json.Marshal(requestBody) + require.NoError(t, err) + + encodedName := url.PathEscape("com.example/deprecated-for-edit-test") + requestURL := "/v0/servers/" + encodedName + "/versions/1.0.0" + + req := httptest.NewRequest(http.MethodPut, requestURL, bytes.NewReader(bodyBytes)) + req.Header.Set("Content-Type", "application/json") + + jwtManager := auth.NewJWTManager(cfg) + tokenResponse, err := jwtManager.GenerateTokenResponse(context.Background(), auth.JWTClaims{ + AuthMethod: auth.MethodNone, + Permissions: []auth.Permission{ + {Action: auth.PermissionActionEdit, ResourcePattern: "*"}, + }, + }) + require.NoError(t, err) + req.Header.Set("Authorization", "Bearer "+tokenResponse.RegistryToken) + + w := httptest.NewRecorder() + mux.ServeHTTP(w, req) + + assert.Equal(t, http.StatusOK, w.Code) + + var response apiv0.ServerResponse + err = json.NewDecoder(w.Body).Decode(&response) + require.NoError(t, err) + assert.Equal(t, "Updated description but status should remain deprecated", response.Server.Description) + // Status should still be deprecated + assert.Equal(t, model.StatusDeprecated, response.Meta.Official.Status) + // Status message should be preserved + assert.NotNil(t, response.Meta.Official.StatusMessage) + assert.Equal(t, "This server is deprecated", *response.Meta.Official.StatusMessage) + }) } diff --git a/internal/api/handlers/v0/servers.go b/internal/api/handlers/v0/servers.go index f9f7ba5..d187fc0 100644 --- a/internal/api/handlers/v0/servers.go +++ b/internal/api/handlers/v0/servers.go @@ -5,6 +5,7 @@ import ( "errors" "net/http" "net/url" + "reflect" "strings" "time" @@ -16,13 +17,49 @@ import ( const errRecordNotFound = "record not found" +// OptionalBool tracks whether a bool query parameter was explicitly set +type OptionalBool struct { + Value bool + IsSet bool +} + +// Schema implements huma.SchemaProvider - returns schema for the wrapped type +func (o OptionalBool) Schema(r huma.Registry) *huma.Schema { + return huma.SchemaFromType(r, reflect.TypeOf(o.Value)) +} + +// Receiver implements huma.ParamWrapper - exposes wrapped value to receive parsed value +func (o *OptionalBool) Receiver() reflect.Value { + return reflect.ValueOf(o).Elem().Field(0) +} + +// OnParamSet implements huma.ParamReactor - tracks whether parameter was set in request +func (o *OptionalBool) OnParamSet(isSet bool, _ any) { + o.IsSet = isSet +} + +// resolveIncludeDeleted handles the include_deleted parameter logic for list endpoints +// Returns the resolved value and an error if include_deleted=false conflicts with updated_since +func resolveIncludeDeleted(includeDeleted OptionalBool, hasUpdatedSince bool) (bool, error) { + if hasUpdatedSince { + // When updated_since is provided, include_deleted must be true for incremental sync + if includeDeleted.IsSet && !includeDeleted.Value { + return false, huma.Error400BadRequest("Cannot set include_deleted=false when using updated_since (incremental sync requires deleted servers)") + } + return true, nil + } + // Use provided value, defaults to false if not set + return includeDeleted.Value, nil +} + // ListServersInput represents the input for listing servers type ListServersInput struct { - Cursor string `query:"cursor" doc:"Pagination cursor" required:"false" example:"server-cursor-123"` - Limit int `query:"limit" doc:"Number of items per page" default:"30" minimum:"1" maximum:"100" example:"50"` - UpdatedSince string `query:"updated_since" doc:"Filter servers updated since timestamp (RFC3339 datetime)" required:"false" example:"2025-08-07T13:15:04.280Z"` - Search string `query:"search" doc:"Search servers by name (substring match)" required:"false" example:"filesystem"` - Version string `query:"version" doc:"Filter by version ('latest' for latest version, or an exact version like '1.2.3')" required:"false" example:"latest"` + Cursor string `query:"cursor" doc:"Pagination cursor" required:"false" example:"server-cursor-123"` + Limit int `query:"limit" doc:"Number of items per page" default:"30" minimum:"1" maximum:"100" example:"50"` + UpdatedSince string `query:"updated_since" doc:"Filter servers updated since timestamp (RFC3339 datetime)" required:"false" example:"2025-08-07T13:15:04.280Z"` + Search string `query:"search" doc:"Search servers by name (substring match)" required:"false" example:"filesystem"` + Version string `query:"version" doc:"Filter by version ('latest' for latest version, or an exact version like '1.2.3')" required:"false" example:"latest"` + IncludeDeleted OptionalBool `query:"include_deleted" doc:"Include deleted servers in results (default: false, but always true when updated_since is provided)" required:"false"` } // ServerDetailInput represents the input for getting server details @@ -32,13 +69,15 @@ type ServerDetailInput struct { // ServerVersionDetailInput represents the input for getting a specific version type ServerVersionDetailInput struct { - ServerName string `path:"serverName" doc:"URL-encoded server name" example:"com.example%2Fmy-server"` - Version string `path:"version" doc:"URL-encoded server version" example:"1.0.0"` + ServerName string `path:"serverName" doc:"URL-encoded server name" example:"com.example%2Fmy-server"` + Version string `path:"version" doc:"URL-encoded server version" example:"1.0.0"` + IncludeDeleted bool `query:"include_deleted" doc:"Include deleted servers in results (default: false)" required:"false" default:"false"` } // ServerVersionsInput represents the input for listing all versions of a server type ServerVersionsInput struct { - ServerName string `path:"serverName" doc:"URL-encoded server name" example:"com.example%2Fmy-server"` + ServerName string `path:"serverName" doc:"URL-encoded server name" example:"com.example%2Fmy-server"` + IncludeDeleted bool `query:"include_deleted" doc:"Include deleted servers in results (default: false)" required:"false" default:"false"` } // RegisterServersEndpoints registers all server-related endpoints with a custom path prefix @@ -82,6 +121,13 @@ func RegisterServersEndpoints(api huma.API, pathPrefix string, registry service. } } + // Handle include_deleted parameter + includeDeleted, err := resolveIncludeDeleted(input.IncludeDeleted, filter.UpdatedSince != nil) + if err != nil { + return nil, err + } + filter.IncludeDeleted = &includeDeleted + // Get paginated results with filtering servers, nextCursor, err := registry.ListServers(ctx, filter, input.Cursor, input.Limit) if err != nil { @@ -129,9 +175,9 @@ func RegisterServersEndpoints(api huma.API, pathPrefix string, registry service. var serverResponse *apiv0.ServerResponse // Handle "latest" as a special version if version == "latest" { - serverResponse, err = registry.GetServerByName(ctx, serverName) + serverResponse, err = registry.GetServerByName(ctx, serverName, input.IncludeDeleted) } else { - serverResponse, err = registry.GetServerByNameAndVersion(ctx, serverName, version) + serverResponse, err = registry.GetServerByNameAndVersion(ctx, serverName, version, input.IncludeDeleted) } if err != nil { @@ -162,7 +208,7 @@ func RegisterServersEndpoints(api huma.API, pathPrefix string, registry service. } // Get all versions for this server - servers, err := registry.GetAllVersionsByServerName(ctx, serverName) + servers, err := registry.GetAllVersionsByServerName(ctx, serverName, input.IncludeDeleted) if err != nil { if err.Error() == errRecordNotFound || errors.Is(err, database.ErrNotFound) { return nil, huma.Error404NotFound("Server not found") diff --git a/internal/api/handlers/v0/servers_test.go b/internal/api/handlers/v0/servers_test.go index e0d19a0..16c763c 100644 --- a/internal/api/handlers/v0/servers_test.go +++ b/internal/api/handlers/v0/servers_test.go @@ -392,6 +392,122 @@ func TestGetAllVersionsEndpoint(t *testing.T) { } } +func TestListServersDeletedFiltering(t *testing.T) { + ctx := context.Background() + registryService := service.NewRegistryService(database.NewTestDB(t), config.NewConfig()) + + // Setup test data: 2 active servers and 1 deleted server + _, err := registryService.CreateServer(ctx, &apiv0.ServerJSON{ + Schema: model.CurrentSchemaURL, + Name: "com.example/active-server-1", + Description: "Active server 1", + Version: "1.0.0", + }) + require.NoError(t, err) + + _, err = registryService.CreateServer(ctx, &apiv0.ServerJSON{ + Schema: model.CurrentSchemaURL, + Name: "com.example/active-server-2", + Description: "Active server 2", + Version: "1.0.0", + }) + require.NoError(t, err) + + _, err = registryService.CreateServer(ctx, &apiv0.ServerJSON{ + Schema: model.CurrentSchemaURL, + Name: "com.example/deleted-server", + Description: "Deleted server", + Version: "1.0.0", + }) + require.NoError(t, err) + + // Delete the third server + _, err = registryService.UpdateServerStatus(ctx, "com.example/deleted-server", "1.0.0", &service.StatusChangeRequest{ + NewStatus: model.StatusDeleted, + }) + require.NoError(t, err) + + // Create API + mux := http.NewServeMux() + api := humago.New(mux, huma.DefaultConfig("Test API", "1.0.0")) + v0.RegisterServersEndpoints(api, "/v0", registryService) + + tests := []struct { + name string + queryParams string + expectedStatus int + expectedCount int + checkDeleted bool // whether deleted server should be in results + }{ + { + name: "default excludes deleted servers", + queryParams: "", + expectedStatus: http.StatusOK, + expectedCount: 2, + checkDeleted: false, + }, + { + name: "include_deleted=false excludes deleted servers", + queryParams: "?include_deleted=false", + expectedStatus: http.StatusOK, + expectedCount: 2, + checkDeleted: false, + }, + { + name: "include_deleted=true includes deleted servers", + queryParams: "?include_deleted=true", + expectedStatus: http.StatusOK, + expectedCount: 3, + checkDeleted: true, + }, + { + name: "updated_since always includes deleted servers", + queryParams: "?updated_since=1990-01-01T00:00:00Z", + expectedStatus: http.StatusOK, + expectedCount: 3, + checkDeleted: true, + }, + { + name: "updated_since with include_deleted=false returns error", + queryParams: "?updated_since=1990-01-01T00:00:00Z&include_deleted=false", + expectedStatus: http.StatusBadRequest, + expectedCount: 0, + checkDeleted: false, + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + req := httptest.NewRequest(http.MethodGet, "/v0/servers"+tt.queryParams, nil) + w := httptest.NewRecorder() + + mux.ServeHTTP(w, req) + + assert.Equal(t, tt.expectedStatus, w.Code) + + // Skip response body checks for error responses + if tt.expectedStatus != http.StatusOK { + return + } + + var resp apiv0.ServerListResponse + err := json.NewDecoder(w.Body).Decode(&resp) + assert.NoError(t, err) + assert.Len(t, resp.Servers, tt.expectedCount) + + // Check if deleted server is in results + hasDeleted := false + for _, server := range resp.Servers { + if server.Server.Name == "com.example/deleted-server" { + hasDeleted = true + assert.Equal(t, model.StatusDeleted, server.Meta.Official.Status) + } + } + assert.Equal(t, tt.checkDeleted, hasDeleted, "Deleted server presence mismatch") + }) + } +} + func TestServersEndpointEdgeCases(t *testing.T) { ctx := context.Background() registryService := service.NewRegistryService(database.NewTestDB(t), config.NewConfig()) @@ -518,3 +634,137 @@ func TestServersEndpointEdgeCases(t *testing.T) { } }) } + +func TestIncludeDeletedOnDetailEndpoints(t *testing.T) { + ctx := context.Background() + registryService := service.NewRegistryService(database.NewTestDB(t), config.NewConfig()) + + serverName := "com.example/deleted-detail-test" + + // Create server with multiple versions + _, err := registryService.CreateServer(ctx, &apiv0.ServerJSON{ + Schema: model.CurrentSchemaURL, + Name: serverName, + Description: "Test server v1", + Version: "1.0.0", + }) + require.NoError(t, err) + + _, err = registryService.CreateServer(ctx, &apiv0.ServerJSON{ + Schema: model.CurrentSchemaURL, + Name: serverName, + Description: "Test server v2", + Version: "2.0.0", + }) + require.NoError(t, err) + + // Delete version 1.0.0 + _, err = registryService.UpdateServerStatus(ctx, serverName, "1.0.0", &service.StatusChangeRequest{ + NewStatus: model.StatusDeleted, + }) + require.NoError(t, err) + + // Create API + mux := http.NewServeMux() + api := humago.New(mux, huma.DefaultConfig("Test API", "1.0.0")) + v0.RegisterServersEndpoints(api, "/v0", registryService) + + encodedName := url.PathEscape(serverName) + + t.Run("detail endpoint", func(t *testing.T) { + tests := []struct { + name string + version string + queryParams string + expectedStatus int + }{ + { + name: "deleted version without include_deleted returns 404", + version: "1.0.0", + queryParams: "", + expectedStatus: http.StatusNotFound, + }, + { + name: "deleted version with include_deleted=false returns 404", + version: "1.0.0", + queryParams: "?include_deleted=false", + expectedStatus: http.StatusNotFound, + }, + { + name: "deleted version with include_deleted=true returns 200", + version: "1.0.0", + queryParams: "?include_deleted=true", + expectedStatus: http.StatusOK, + }, + { + name: "active version without include_deleted returns 200", + version: "2.0.0", + queryParams: "", + expectedStatus: http.StatusOK, + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + encodedVersion := url.PathEscape(tt.version) + req := httptest.NewRequest(http.MethodGet, "/v0/servers/"+encodedName+"/versions/"+encodedVersion+tt.queryParams, nil) + w := httptest.NewRecorder() + + mux.ServeHTTP(w, req) + + assert.Equal(t, tt.expectedStatus, w.Code) + + if tt.expectedStatus == http.StatusOK { + var resp apiv0.ServerResponse + err := json.NewDecoder(w.Body).Decode(&resp) + assert.NoError(t, err) + assert.Equal(t, tt.version, resp.Server.Version) + } + }) + } + }) + + t.Run("version history endpoint", func(t *testing.T) { + tests := []struct { + name string + queryParams string + expectedStatus int + expectedCount int + }{ + { + name: "without include_deleted excludes deleted versions", + queryParams: "", + expectedStatus: http.StatusOK, + expectedCount: 1, + }, + { + name: "include_deleted=false excludes deleted versions", + queryParams: "?include_deleted=false", + expectedStatus: http.StatusOK, + expectedCount: 1, + }, + { + name: "include_deleted=true includes deleted versions", + queryParams: "?include_deleted=true", + expectedStatus: http.StatusOK, + expectedCount: 2, + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + req := httptest.NewRequest(http.MethodGet, "/v0/servers/"+encodedName+"/versions"+tt.queryParams, nil) + w := httptest.NewRecorder() + + mux.ServeHTTP(w, req) + + assert.Equal(t, tt.expectedStatus, w.Code) + + var resp apiv0.ServerListResponse + err := json.NewDecoder(w.Body).Decode(&resp) + assert.NoError(t, err) + assert.Len(t, resp.Servers, tt.expectedCount) + }) + } + }) +} diff --git a/internal/api/handlers/v0/status.go b/internal/api/handlers/v0/status.go new file mode 100644 index 0000000..627e884 --- /dev/null +++ b/internal/api/handlers/v0/status.go @@ -0,0 +1,299 @@ +package v0 + +import ( + "context" + "errors" + "fmt" + "net/http" + "net/url" + "strings" + + "github.com/danielgtaylor/huma/v2" + + "github.com/modelcontextprotocol/registry/internal/auth" + "github.com/modelcontextprotocol/registry/internal/config" + "github.com/modelcontextprotocol/registry/internal/database" + "github.com/modelcontextprotocol/registry/internal/service" + apiv0 "github.com/modelcontextprotocol/registry/pkg/api/v0" + "github.com/modelcontextprotocol/registry/pkg/model" +) + +// UpdateServerStatusBody represents the request body for updating server status +type UpdateServerStatusBody struct { + Status string `json:"status" required:"true" enum:"active,deprecated,deleted" doc:"New server lifecycle status"` + StatusMessage *string `json:"statusMessage,omitempty" maxLength:"500" doc:"Optional message explaining the status change (e.g., reason for deprecation)"` +} + +// UpdateServerStatusInput represents the input for updating server status +type UpdateServerStatusInput struct { + Authorization string `header:"Authorization" doc:"Registry JWT token with publish or edit permissions" required:"true"` + ServerName string `path:"serverName" doc:"URL-encoded server name" example:"com.example%2Fmy-server"` + Version string `path:"version" doc:"URL-encoded version to update" example:"1.0.0"` + Body UpdateServerStatusBody `body:""` +} + +// validateStatusTransition validates if the status transition is allowed +// Returns nil if status or message differs from current (something to update) +// Returns error if nothing changes (no-op) or if status transition is invalid +func validateStatusTransition(currentServer *apiv0.ServerResponse, newStatus model.Status, body UpdateServerStatusBody) error { + // Validate newStatus is a valid value + validStatuses := map[model.Status]bool{ + model.StatusActive: true, + model.StatusDeprecated: true, + model.StatusDeleted: true, + } + if !validStatuses[newStatus] { + return huma.Error400BadRequest(fmt.Sprintf("Invalid status: %s. Must be one of: active, deprecated, deleted", newStatus)) + } + + // Reject status_message when setting status to active + if newStatus == model.StatusActive && body.StatusMessage != nil { + return huma.Error400BadRequest("status_message cannot be provided when setting status to active") + } + + if currentServer.Meta.Official == nil { + return nil + } + + currentStatus := currentServer.Meta.Official.Status + currentMessage := currentServer.Meta.Official.StatusMessage + newMessage := body.StatusMessage + + statusChanges := currentStatus != newStatus + messageChanges := (currentMessage == nil) != (newMessage == nil) || + (currentMessage != nil && newMessage != nil && *currentMessage != *newMessage) + + // Valid if either status or message changes + if statusChanges || messageChanges { + return nil + } + + return huma.Error400BadRequest("No changes to apply: status and message are already set to the provided values") +} + +// RegisterStatusEndpoints registers the status update endpoint with a custom path prefix +func RegisterStatusEndpoints(api huma.API, pathPrefix string, registry service.RegistryService, cfg *config.Config) { + jwtManager := auth.NewJWTManager(cfg) + + // Update server status endpoint + huma.Register(api, huma.Operation{ + OperationID: "update-server-status" + strings.ReplaceAll(pathPrefix, "/", "-"), + Method: http.MethodPatch, + Path: pathPrefix + "/servers/{serverName}/versions/{version}/status", + Summary: "Update MCP server status", + Description: "Update the status metadata of a specific version of an MCP server. Requires publish or edit permission for the server. This endpoint allows changing status and status message without requiring the full server configuration.", + Tags: []string{"servers"}, + Security: []map[string][]string{ + {"bearer": {}}, + }, + }, func(ctx context.Context, input *UpdateServerStatusInput) (*Response[apiv0.ServerResponse], error) { + // Extract bearer token + const bearerPrefix = "Bearer " + authHeader := input.Authorization + if len(authHeader) < len(bearerPrefix) || !strings.EqualFold(authHeader[:len(bearerPrefix)], bearerPrefix) { + return nil, huma.Error401Unauthorized("Invalid Authorization header format. Expected 'Bearer '") + } + token := authHeader[len(bearerPrefix):] + + // Validate Registry JWT token + claims, err := jwtManager.ValidateToken(ctx, token) + if err != nil { + return nil, huma.Error401Unauthorized("Invalid or expired Registry JWT token", err) + } + + // URL-decode the server name + serverName, err := url.PathUnescape(input.ServerName) + if err != nil { + return nil, huma.Error400BadRequest("Invalid server name encoding", err) + } + + // URL-decode the version + version, err := url.PathUnescape(input.Version) + if err != nil { + return nil, huma.Error400BadRequest("Invalid version encoding", err) + } + + newStatus := model.Status(input.Body.Status) + + // Get the server and verify it exists + // Include deleted servers since we need to be able to restore them + currentServer, err := registry.GetServerByNameAndVersion(ctx, serverName, version, true) + if err != nil { + if errors.Is(err, database.ErrNotFound) { + return nil, huma.Error404NotFound("Server version not found") + } + return nil, huma.Error500InternalServerError("Failed to get server", err) + } + + // Verify publish or edit permissions for this server + hasPublish := jwtManager.HasPermission(currentServer.Server.Name, auth.PermissionActionPublish, claims.Permissions) + hasEdit := jwtManager.HasPermission(currentServer.Server.Name, auth.PermissionActionEdit, claims.Permissions) + if !hasPublish && !hasEdit { + return nil, huma.Error403Forbidden("You do not have publish or edit permissions for this server") + } + + // Validate status transition is allowed + if err := validateStatusTransition(currentServer, newStatus, input.Body); err != nil { + return nil, err + } + + // Build status change request + statusChange := buildStatusChangeRequestFromBody(input.Body) + + // Update the server status using the service + updatedServer, err := registry.UpdateServerStatus(ctx, serverName, version, statusChange) + if err != nil { + if errors.Is(err, database.ErrNotFound) { + return nil, huma.Error404NotFound("Server not found") + } + return nil, huma.Error400BadRequest("Failed to update server status", err) + } + + return &Response[apiv0.ServerResponse]{ + Body: *updatedServer, + }, nil + }) +} + +// buildStatusChangeRequestFromBody constructs a StatusChangeRequest from the request body +func buildStatusChangeRequestFromBody(body UpdateServerStatusBody) *service.StatusChangeRequest { + var statusMessage *string + + newStatus := model.Status(body.Status) + + // When transitioning to active status, clear status_message + if newStatus != model.StatusActive { + statusMessage = body.StatusMessage + } + + return &service.StatusChangeRequest{ + NewStatus: newStatus, + StatusMessage: statusMessage, + } +} + +// UpdateAllVersionsStatusInput represents the input for updating all versions' status +type UpdateAllVersionsStatusInput struct { + Authorization string `header:"Authorization" doc:"Registry JWT token with publish or edit permissions" required:"true"` + ServerName string `path:"serverName" doc:"URL-encoded server name" example:"com.example%2Fmy-server"` + Body UpdateServerStatusBody `body:""` +} + +// UpdateAllVersionsStatusResponse represents the response for updating all versions' status +type UpdateAllVersionsStatusResponse struct { + UpdatedCount int `json:"updatedCount" doc:"Number of versions updated"` + Servers []apiv0.ServerResponse `json:"servers" doc:"List of all updated server versions"` +} + +// RegisterAllVersionsStatusEndpoints registers the all-versions status update endpoint +func RegisterAllVersionsStatusEndpoints(api huma.API, pathPrefix string, registry service.RegistryService, cfg *config.Config) { + jwtManager := auth.NewJWTManager(cfg) + + // Update all versions status endpoint + huma.Register(api, huma.Operation{ + OperationID: "update-server-all-versions-status" + strings.ReplaceAll(pathPrefix, "/", "-"), + Method: http.MethodPatch, + Path: pathPrefix + "/servers/{serverName}/status", + Summary: "Update status for all versions of an MCP server", + Description: "Update the status metadata of all versions of an MCP server in a single transaction. Requires publish or edit permission for the server. Either all versions are updated or none on failure.", + Tags: []string{"servers"}, + Security: []map[string][]string{ + {"bearer": {}}, + }, + }, func(ctx context.Context, input *UpdateAllVersionsStatusInput) (*Response[UpdateAllVersionsStatusResponse], error) { + // Extract bearer token + const bearerPrefix = "Bearer " + authHeader := input.Authorization + if len(authHeader) < len(bearerPrefix) || !strings.EqualFold(authHeader[:len(bearerPrefix)], bearerPrefix) { + return nil, huma.Error401Unauthorized("Invalid Authorization header format. Expected 'Bearer '") + } + token := authHeader[len(bearerPrefix):] + + // Validate Registry JWT token + claims, err := jwtManager.ValidateToken(ctx, token) + if err != nil { + return nil, huma.Error401Unauthorized("Invalid or expired Registry JWT token", err) + } + + // URL-decode the server name + serverName, err := url.PathUnescape(input.ServerName) + if err != nil { + return nil, huma.Error400BadRequest("Invalid server name encoding", err) + } + + // Get any version to verify server exists and check permissions + // Include deleted servers since we need to be able to restore them + currentServer, err := registry.GetServerByName(ctx, serverName, true) + if err != nil { + if errors.Is(err, database.ErrNotFound) { + return nil, huma.Error404NotFound("Server not found") + } + return nil, huma.Error500InternalServerError("Failed to get server", err) + } + + // Verify publish or edit permissions for this server + hasPublish := jwtManager.HasPermission(currentServer.Server.Name, auth.PermissionActionPublish, claims.Permissions) + hasEdit := jwtManager.HasPermission(currentServer.Server.Name, auth.PermissionActionEdit, claims.Permissions) + if !hasPublish && !hasEdit { + return nil, huma.Error403Forbidden("You do not have publish or edit permissions for this server") + } + + newStatus := model.Status(input.Body.Status) + + // Fetch all versions to validate the bulk status transition + allVersions, err := registry.GetAllVersionsByServerName(ctx, serverName, true) + if err != nil { + return nil, huma.Error500InternalServerError("Failed to get server versions", err) + } + + // Validate bulk status transition - reject if no changes would occur + if err := validateBulkStatusTransition(allVersions, newStatus, input.Body); err != nil { + return nil, err + } + + // Build status change request + statusChange := buildStatusChangeRequestFromBody(input.Body) + + // Update all versions' status using the service + updatedServers, err := registry.UpdateAllVersionsStatus(ctx, serverName, statusChange) + if err != nil { + if errors.Is(err, database.ErrNotFound) { + return nil, huma.Error404NotFound("Server not found") + } + return nil, huma.Error400BadRequest("Failed to update server status", err) + } + + // Convert to response format + servers := make([]apiv0.ServerResponse, len(updatedServers)) + for i, s := range updatedServers { + servers[i] = *s + } + + return &Response[UpdateAllVersionsStatusResponse]{ + Body: UpdateAllVersionsStatusResponse{ + UpdatedCount: len(servers), + Servers: servers, + }, + }, nil + }) +} + +// validateBulkStatusTransition validates if a bulk status transition would result in any changes +// Returns an error if no changes would occur (all versions already have target status and message) +func validateBulkStatusTransition(versions []*apiv0.ServerResponse, newStatus model.Status, body UpdateServerStatusBody) error { + if len(versions) == 0 { + return nil + } + + // Check if any version would have changes applied + for _, version := range versions { + err := validateStatusTransition(version, newStatus, body) + if err == nil { + // This version has changes, so the bulk operation is valid + return nil + } + } + + // No versions would have any changes + return huma.Error400BadRequest("No changes to apply: all versions already have the requested status and message") +} diff --git a/internal/api/handlers/v0/status_test.go b/internal/api/handlers/v0/status_test.go new file mode 100644 index 0000000..33f21fb --- /dev/null +++ b/internal/api/handlers/v0/status_test.go @@ -0,0 +1,885 @@ +package v0_test + +import ( + "bytes" + "context" + "crypto/ed25519" + "crypto/rand" + "encoding/hex" + "encoding/json" + "net/http" + "net/http/httptest" + "net/url" + "testing" + + "github.com/danielgtaylor/huma/v2" + "github.com/danielgtaylor/huma/v2/adapters/humago" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" + + v0 "github.com/modelcontextprotocol/registry/internal/api/handlers/v0" + "github.com/modelcontextprotocol/registry/internal/auth" + "github.com/modelcontextprotocol/registry/internal/config" + "github.com/modelcontextprotocol/registry/internal/database" + "github.com/modelcontextprotocol/registry/internal/service" + apiv0 "github.com/modelcontextprotocol/registry/pkg/api/v0" + "github.com/modelcontextprotocol/registry/pkg/model" +) + +func TestUpdateServerStatusEndpoint(t *testing.T) { + // Create test config + testSeed := make([]byte, ed25519.SeedSize) + _, err := rand.Read(testSeed) + require.NoError(t, err) + cfg := &config.Config{ + JWTPrivateKey: hex.EncodeToString(testSeed), + EnableRegistryValidation: false, + } + + // Create registry service and test data + registryService := service.NewRegistryService(database.NewTestDB(t), cfg) + + // Create test servers for different scenarios + testServers := map[string]*apiv0.ServerJSON{ + "active": { + Schema: model.CurrentSchemaURL, + Name: "io.github.testuser/active-server", + Description: "Server in active status", + Version: "1.0.0", + Repository: &model.Repository{ + URL: "https://github.com/testuser/active-server", + Source: "github", + ID: "testuser/active-server", + }, + }, + "deprecated": { + Schema: model.CurrentSchemaURL, + Name: "io.github.testuser/deprecated-server", + Description: "Server in deprecated status", + Version: "1.0.0", + Repository: &model.Repository{ + URL: "https://github.com/testuser/deprecated-server", + Source: "github", + ID: "testuser/deprecated-server", + }, + }, + "deleted": { + Schema: model.CurrentSchemaURL, + Name: "io.github.testuser/deleted-server", + Description: "Server in deleted status", + Version: "1.0.0", + Repository: &model.Repository{ + URL: "https://github.com/testuser/deleted-server", + Source: "github", + ID: "testuser/deleted-server", + }, + }, + "other": { + Schema: model.CurrentSchemaURL, + Name: "io.github.otheruser/other-server", + Description: "Server owned by another user", + Version: "1.0.0", + Repository: &model.Repository{ + URL: "https://github.com/otheruser/other-server", + Source: "github", + ID: "otheruser/other-server", + }, + }, + "multi-version": { + Schema: model.CurrentSchemaURL, + Name: "io.github.testuser/multi-version-server", + Description: "Server with multiple versions for testing", + Version: "1.0.0", + Repository: &model.Repository{ + URL: "https://github.com/testuser/multi-version-server", + Source: "github", + ID: "testuser/multi-version-server", + }, + }, + } + + // Create the test servers + for _, server := range testServers { + _, err := registryService.CreateServer(context.Background(), server) + require.NoError(t, err) + } + + // Set deprecated server to deprecated status + _, err = registryService.UpdateServerStatus(context.Background(), testServers["deprecated"].Name, testServers["deprecated"].Version, &service.StatusChangeRequest{ + NewStatus: model.StatusDeprecated, + }) + require.NoError(t, err) + + // Set deleted server to deleted status + _, err = registryService.UpdateServerStatus(context.Background(), testServers["deleted"].Name, testServers["deleted"].Version, &service.StatusChangeRequest{ + NewStatus: model.StatusDeleted, + }) + require.NoError(t, err) + + // Add a second version to multi-version server + multiVersionV2 := &apiv0.ServerJSON{ + Schema: model.CurrentSchemaURL, + Name: "io.github.testuser/multi-version-server", + Description: "Server with multiple versions for testing", + Version: "2.0.0", + Repository: &model.Repository{ + URL: "https://github.com/testuser/multi-version-server", + Source: "github", + ID: "testuser/multi-version-server", + }, + } + _, err = registryService.CreateServer(context.Background(), multiVersionV2) + require.NoError(t, err) + + testCases := []struct { + name string + serverName string + version string + authClaims *auth.JWTClaims + authHeader string + requestBody v0.UpdateServerStatusBody + expectedStatus int + expectedError string + checkResult func(*testing.T, *apiv0.ServerResponse) + }{ + { + name: "successful status change from active to deprecated", + serverName: "io.github.testuser/active-server", + version: "1.0.0", + authClaims: &auth.JWTClaims{ + AuthMethod: auth.MethodGitHubAT, + AuthMethodSubject: "testuser", + Permissions: []auth.Permission{ + {Action: auth.PermissionActionPublish, ResourcePattern: "io.github.testuser/*"}, + }, + }, + requestBody: v0.UpdateServerStatusBody{ + Status: "deprecated", + }, + expectedStatus: http.StatusOK, + checkResult: func(t *testing.T, resp *apiv0.ServerResponse) { + t.Helper() + assert.Equal(t, model.StatusDeprecated, resp.Meta.Official.Status) + }, + }, + { + name: "successful status change with message", + serverName: "io.github.testuser/active-server", + version: "1.0.0", + authClaims: &auth.JWTClaims{ + AuthMethod: auth.MethodGitHubAT, + AuthMethodSubject: "testuser", + Permissions: []auth.Permission{ + {Action: auth.PermissionActionPublish, ResourcePattern: "io.github.testuser/*"}, + }, + }, + requestBody: v0.UpdateServerStatusBody{ + Status: "deleted", + StatusMessage: strPtr("Security vulnerability discovered"), + }, + expectedStatus: http.StatusOK, + checkResult: func(t *testing.T, resp *apiv0.ServerResponse) { + t.Helper() + assert.Equal(t, model.StatusDeleted, resp.Meta.Official.Status) + assert.NotNil(t, resp.Meta.Official.StatusMessage) + assert.Equal(t, "Security vulnerability discovered", *resp.Meta.Official.StatusMessage) + }, + }, + { + name: "successful restore from deleted to active", + serverName: "io.github.testuser/deleted-server", + version: "1.0.0", + authClaims: &auth.JWTClaims{ + AuthMethod: auth.MethodGitHubAT, + AuthMethodSubject: "testuser", + Permissions: []auth.Permission{ + {Action: auth.PermissionActionPublish, ResourcePattern: "io.github.testuser/*"}, + }, + }, + requestBody: v0.UpdateServerStatusBody{ + Status: "active", + }, + expectedStatus: http.StatusOK, + checkResult: func(t *testing.T, resp *apiv0.ServerResponse) { + t.Helper() + assert.Equal(t, model.StatusActive, resp.Meta.Official.Status) + // Status message should be cleared when transitioning to active + assert.Nil(t, resp.Meta.Official.StatusMessage) + }, + }, + { + name: "successful undeprecate from deprecated to active", + serverName: "io.github.testuser/deprecated-server", + version: "1.0.0", + authClaims: &auth.JWTClaims{ + AuthMethod: auth.MethodGitHubAT, + AuthMethodSubject: "testuser", + Permissions: []auth.Permission{ + {Action: auth.PermissionActionPublish, ResourcePattern: "io.github.testuser/*"}, + }, + }, + requestBody: v0.UpdateServerStatusBody{ + Status: "active", + }, + expectedStatus: http.StatusOK, + checkResult: func(t *testing.T, resp *apiv0.ServerResponse) { + t.Helper() + assert.Equal(t, model.StatusActive, resp.Meta.Official.Status) + }, + }, + { + name: "missing authorization header", + serverName: "io.github.testuser/active-server", + version: "1.0.0", + authHeader: "", + requestBody: v0.UpdateServerStatusBody{Status: "deprecated"}, + expectedStatus: http.StatusUnprocessableEntity, + expectedError: "required header parameter is missing", + }, + { + name: "invalid authorization header format", + serverName: "io.github.testuser/active-server", + version: "1.0.0", + authHeader: "InvalidFormat token123", + requestBody: v0.UpdateServerStatusBody{ + Status: "deprecated", + }, + expectedStatus: http.StatusUnauthorized, + expectedError: "Invalid Authorization header format", + }, + { + name: "invalid token", + serverName: "io.github.testuser/active-server", + version: "1.0.0", + authHeader: "Bearer invalid-token", + requestBody: v0.UpdateServerStatusBody{ + Status: "deprecated", + }, + expectedStatus: http.StatusUnauthorized, + expectedError: "Invalid or expired Registry JWT token", + }, + { + name: "permission denied - no publish or edit permissions", + serverName: "io.github.testuser/active-server", + version: "1.0.0", + authClaims: &auth.JWTClaims{ + AuthMethod: auth.MethodGitHubAT, + AuthMethodSubject: "testuser", + Permissions: []auth.Permission{ + {Action: "read", ResourcePattern: "io.github.testuser/*"}, + }, + }, + requestBody: v0.UpdateServerStatusBody{ + Status: "deprecated", + }, + expectedStatus: http.StatusForbidden, + expectedError: "You do not have publish or edit permissions for this server", + }, + { + name: "successful status change with edit permission only", + serverName: "io.github.testuser/active-server", + version: "1.0.0", + authClaims: &auth.JWTClaims{ + AuthMethod: auth.MethodGitHubAT, + AuthMethodSubject: "testuser", + Permissions: []auth.Permission{ + {Action: auth.PermissionActionEdit, ResourcePattern: "io.github.testuser/*"}, + }, + }, + requestBody: v0.UpdateServerStatusBody{ + Status: "deprecated", + }, + expectedStatus: http.StatusOK, + checkResult: func(t *testing.T, resp *apiv0.ServerResponse) { + t.Helper() + assert.Equal(t, model.StatusDeprecated, resp.Meta.Official.Status) + }, + }, + { + name: "successful status change with both publish and edit permissions", + serverName: "io.github.testuser/active-server", + version: "1.0.0", + authClaims: &auth.JWTClaims{ + AuthMethod: auth.MethodGitHubAT, + AuthMethodSubject: "testuser", + Permissions: []auth.Permission{ + {Action: auth.PermissionActionPublish, ResourcePattern: "io.github.testuser/*"}, + {Action: auth.PermissionActionEdit, ResourcePattern: "io.github.testuser/*"}, + }, + }, + requestBody: v0.UpdateServerStatusBody{ + Status: "active", + }, + expectedStatus: http.StatusOK, + checkResult: func(t *testing.T, resp *apiv0.ServerResponse) { + t.Helper() + assert.Equal(t, model.StatusActive, resp.Meta.Official.Status) + }, + }, + { + name: "permission denied - wrong namespace", + serverName: "io.github.otheruser/other-server", + version: "1.0.0", + authClaims: &auth.JWTClaims{ + AuthMethod: auth.MethodGitHubAT, + AuthMethodSubject: "testuser", + Permissions: []auth.Permission{ + {Action: auth.PermissionActionPublish, ResourcePattern: "io.github.testuser/*"}, + }, + }, + requestBody: v0.UpdateServerStatusBody{ + Status: "deprecated", + }, + expectedStatus: http.StatusForbidden, + expectedError: "You do not have publish or edit permissions for this server", + }, + { + name: "server not found", + serverName: "io.github.testuser/non-existent", + version: "1.0.0", + authClaims: &auth.JWTClaims{ + AuthMethod: auth.MethodGitHubAT, + AuthMethodSubject: "testuser", + Permissions: []auth.Permission{ + {Action: auth.PermissionActionPublish, ResourcePattern: "io.github.testuser/*"}, + }, + }, + requestBody: v0.UpdateServerStatusBody{ + Status: "deprecated", + }, + expectedStatus: http.StatusNotFound, + expectedError: "Server version not found", + }, + { + name: "same status transition allowed when updating statusMessage", + serverName: "io.github.testuser/deprecated-server", + version: "1.0.0", + authClaims: &auth.JWTClaims{ + AuthMethod: auth.MethodGitHubAT, + AuthMethodSubject: "testuser", + Permissions: []auth.Permission{ + {Action: auth.PermissionActionPublish, ResourcePattern: "io.github.testuser/*"}, + }, + }, + requestBody: v0.UpdateServerStatusBody{ + Status: "deprecated", + StatusMessage: strPtr("Updated deprecation message"), + }, + expectedStatus: http.StatusOK, + checkResult: func(t *testing.T, resp *apiv0.ServerResponse) { + t.Helper() + assert.Equal(t, model.StatusDeprecated, resp.Meta.Official.Status) + assert.NotNil(t, resp.Meta.Official.StatusMessage) + assert.Equal(t, "Updated deprecation message", *resp.Meta.Official.StatusMessage) + }, + }, + { + name: "status_message rejected when setting status to active", + serverName: "io.github.testuser/deprecated-server", + version: "1.0.0", + authClaims: &auth.JWTClaims{ + AuthMethod: auth.MethodGitHubAT, + AuthMethodSubject: "testuser", + Permissions: []auth.Permission{ + {Action: auth.PermissionActionPublish, ResourcePattern: "io.github.testuser/*"}, + }, + }, + requestBody: v0.UpdateServerStatusBody{ + Status: "active", + StatusMessage: strPtr("This message should not be allowed"), + }, + expectedStatus: http.StatusBadRequest, + expectedError: "status_message cannot be provided when setting status to active", + }, + } + + for _, tc := range testCases { + t.Run(tc.name, func(t *testing.T) { + // Create Huma API + mux := http.NewServeMux() + api := humago.New(mux, huma.DefaultConfig("Test API", "1.0.0")) + + // Register status endpoints + v0.RegisterStatusEndpoints(api, "/v0", registryService, cfg) + + // Create request body + requestBody, err := json.Marshal(tc.requestBody) + require.NoError(t, err) + + // Create request URL with proper encoding + encodedServerName := url.PathEscape(tc.serverName) + encodedVersion := url.PathEscape(tc.version) + requestURL := "/v0/servers/" + encodedServerName + "/versions/" + encodedVersion + "/status" + + req := httptest.NewRequest(http.MethodPatch, requestURL, bytes.NewReader(requestBody)) + req.Header.Set("Content-Type", "application/json") + + // Set authorization header + if tc.authHeader != "" { + req.Header.Set("Authorization", tc.authHeader) + } else if tc.authClaims != nil { + // Generate valid JWT token + jwtManager := auth.NewJWTManager(cfg) + tokenResponse, err := jwtManager.GenerateTokenResponse(context.Background(), *tc.authClaims) + require.NoError(t, err) + req.Header.Set("Authorization", "Bearer "+tokenResponse.RegistryToken) + } + + // Create response recorder and execute request + w := httptest.NewRecorder() + mux.ServeHTTP(w, req) + + // Check response + if tc.expectedStatus != w.Code { + t.Logf("Response body: %s", w.Body.String()) + } + assert.Equal(t, tc.expectedStatus, w.Code) + + if tc.expectedError != "" { + assert.Contains(t, w.Body.String(), tc.expectedError) + } + + if tc.expectedStatus == http.StatusOK && tc.checkResult != nil { + var response apiv0.ServerResponse + err := json.NewDecoder(w.Body).Decode(&response) + require.NoError(t, err) + tc.checkResult(t, &response) + } + }) + } +} + +func TestUpdateServerStatusEndpointSameStatusTransition(t *testing.T) { + // Create test config + testSeed := make([]byte, ed25519.SeedSize) + _, err := rand.Read(testSeed) + require.NoError(t, err) + cfg := &config.Config{ + JWTPrivateKey: hex.EncodeToString(testSeed), + EnableRegistryValidation: false, + } + + // Create registry service + registryService := service.NewRegistryService(database.NewTestDB(t), cfg) + + // Create an active server + activeServer := &apiv0.ServerJSON{ + Schema: model.CurrentSchemaURL, + Name: "io.github.testuser/same-status-test", + Description: "Server for same status transition test", + Version: "1.0.0", + } + _, err = registryService.CreateServer(context.Background(), activeServer) + require.NoError(t, err) + + // Create Huma API + mux := http.NewServeMux() + api := humago.New(mux, huma.DefaultConfig("Test API", "1.0.0")) + v0.RegisterStatusEndpoints(api, "/v0", registryService, cfg) + + // Try to transition from active to active (should fail) + requestBody := v0.UpdateServerStatusBody{ + Status: "active", + } + bodyBytes, err := json.Marshal(requestBody) + require.NoError(t, err) + + encodedName := url.PathEscape(activeServer.Name) + requestURL := "/v0/servers/" + encodedName + "/versions/1.0.0/status" + + req := httptest.NewRequest(http.MethodPatch, requestURL, bytes.NewReader(bodyBytes)) + req.Header.Set("Content-Type", "application/json") + + // Generate admin token + jwtManager := auth.NewJWTManager(cfg) + tokenResponse, err := jwtManager.GenerateTokenResponse(context.Background(), auth.JWTClaims{ + AuthMethod: auth.MethodNone, + Permissions: []auth.Permission{ + {Action: auth.PermissionActionPublish, ResourcePattern: "*"}, + }, + }) + require.NoError(t, err) + req.Header.Set("Authorization", "Bearer "+tokenResponse.RegistryToken) + + w := httptest.NewRecorder() + mux.ServeHTTP(w, req) + + assert.Equal(t, http.StatusBadRequest, w.Code) + assert.Contains(t, w.Body.String(), "No changes to apply: status and message are already set to the provided values") +} + +func TestUpdateServerStatusEndpointURLEncoding(t *testing.T) { + // Create test config + testSeed := make([]byte, ed25519.SeedSize) + _, err := rand.Read(testSeed) + require.NoError(t, err) + cfg := &config.Config{ + JWTPrivateKey: hex.EncodeToString(testSeed), + EnableRegistryValidation: false, + } + + // Create registry service + registryService := service.NewRegistryService(database.NewTestDB(t), cfg) + + // Create a server with build metadata version + buildMetadataServer := &apiv0.ServerJSON{ + Schema: model.CurrentSchemaURL, + Name: "io.github.testuser/build-metadata-server", + Description: "Server with build metadata version", + Version: "1.0.0+20130313144700", + } + _, err = registryService.CreateServer(context.Background(), buildMetadataServer) + require.NoError(t, err) + + // Create Huma API + mux := http.NewServeMux() + api := humago.New(mux, huma.DefaultConfig("Test API", "1.0.0")) + v0.RegisterStatusEndpoints(api, "/v0", registryService, cfg) + + // Update status with URL-encoded version + requestBody := v0.UpdateServerStatusBody{ + Status: "deprecated", + StatusMessage: strPtr("Testing URL encoding"), + } + bodyBytes, err := json.Marshal(requestBody) + require.NoError(t, err) + + encodedName := url.PathEscape(buildMetadataServer.Name) + encodedVersion := url.PathEscape(buildMetadataServer.Version) + requestURL := "/v0/servers/" + encodedName + "/versions/" + encodedVersion + "/status" + + req := httptest.NewRequest(http.MethodPatch, requestURL, bytes.NewReader(bodyBytes)) + req.Header.Set("Content-Type", "application/json") + + // Generate admin token + jwtManager := auth.NewJWTManager(cfg) + tokenResponse, err := jwtManager.GenerateTokenResponse(context.Background(), auth.JWTClaims{ + AuthMethod: auth.MethodNone, + Permissions: []auth.Permission{ + {Action: auth.PermissionActionPublish, ResourcePattern: "*"}, + }, + }) + require.NoError(t, err) + req.Header.Set("Authorization", "Bearer "+tokenResponse.RegistryToken) + + w := httptest.NewRecorder() + mux.ServeHTTP(w, req) + + assert.Equal(t, http.StatusOK, w.Code) + + var response apiv0.ServerResponse + err = json.NewDecoder(w.Body).Decode(&response) + require.NoError(t, err) + assert.Equal(t, model.StatusDeprecated, response.Meta.Official.Status) + assert.Equal(t, "1.0.0+20130313144700", response.Server.Version) +} + +func TestUpdateAllVersionsStatusEndpoint(t *testing.T) { + // Create test config + testSeed := make([]byte, ed25519.SeedSize) + _, err := rand.Read(testSeed) + require.NoError(t, err) + cfg := &config.Config{ + JWTPrivateKey: hex.EncodeToString(testSeed), + EnableRegistryValidation: false, + } + + // Create registry service and test data + registryService := service.NewRegistryService(database.NewTestDB(t), cfg) + + // Create a server with multiple versions + multiVersionServer := &apiv0.ServerJSON{ + Schema: model.CurrentSchemaURL, + Name: "io.github.testuser/multi-version-server", + Description: "Server with multiple versions", + Version: "1.0.0", + Repository: &model.Repository{ + URL: "https://github.com/testuser/multi-version-server", + Source: "github", + ID: "testuser/multi-version-server", + }, + } + _, err = registryService.CreateServer(context.Background(), multiVersionServer) + require.NoError(t, err) + + // Add more versions + multiVersionServer.Version = "1.1.0" + _, err = registryService.CreateServer(context.Background(), multiVersionServer) + require.NoError(t, err) + + multiVersionServer.Version = "2.0.0" + _, err = registryService.CreateServer(context.Background(), multiVersionServer) + require.NoError(t, err) + + // Create other user's server + otherServer := &apiv0.ServerJSON{ + Schema: model.CurrentSchemaURL, + Name: "io.github.otheruser/other-server", + Description: "Server owned by another user", + Version: "1.0.0", + Repository: &model.Repository{ + URL: "https://github.com/otheruser/other-server", + Source: "github", + ID: "otheruser/other-server", + }, + } + _, err = registryService.CreateServer(context.Background(), otherServer) + require.NoError(t, err) + + testCases := []struct { + name string + serverName string + authClaims *auth.JWTClaims + authHeader string + requestBody v0.UpdateServerStatusBody + expectedStatus int + expectedError string + checkResult func(*testing.T, *v0.UpdateAllVersionsStatusResponse) + }{ + { + name: "successful deprecation of all versions", + serverName: "io.github.testuser/multi-version-server", + authClaims: &auth.JWTClaims{ + AuthMethod: auth.MethodGitHubAT, + AuthMethodSubject: "testuser", + Permissions: []auth.Permission{ + {Action: auth.PermissionActionPublish, ResourcePattern: "io.github.testuser/*"}, + }, + }, + requestBody: v0.UpdateServerStatusBody{ + Status: "deprecated", + StatusMessage: strPtr("This server is deprecated"), + }, + expectedStatus: http.StatusOK, + checkResult: func(t *testing.T, resp *v0.UpdateAllVersionsStatusResponse) { + t.Helper() + assert.Equal(t, 3, resp.UpdatedCount) + assert.Len(t, resp.Servers, 3) + for _, server := range resp.Servers { + assert.Equal(t, model.StatusDeprecated, server.Meta.Official.Status) + assert.NotNil(t, server.Meta.Official.StatusMessage) + assert.Equal(t, "This server is deprecated", *server.Meta.Official.StatusMessage) + } + }, + }, + { + name: "successful delete of all versions", + serverName: "io.github.testuser/multi-version-server", + authClaims: &auth.JWTClaims{ + AuthMethod: auth.MethodGitHubAT, + AuthMethodSubject: "testuser", + Permissions: []auth.Permission{ + {Action: auth.PermissionActionPublish, ResourcePattern: "io.github.testuser/*"}, + }, + }, + requestBody: v0.UpdateServerStatusBody{ + Status: "deleted", + StatusMessage: strPtr("Security issue discovered"), + }, + expectedStatus: http.StatusOK, + checkResult: func(t *testing.T, resp *v0.UpdateAllVersionsStatusResponse) { + t.Helper() + assert.Equal(t, 3, resp.UpdatedCount) + for _, server := range resp.Servers { + assert.Equal(t, model.StatusDeleted, server.Meta.Official.Status) + assert.NotNil(t, server.Meta.Official.StatusMessage) + assert.Equal(t, "Security issue discovered", *server.Meta.Official.StatusMessage) + } + }, + }, + { + name: "successful reactivation of all versions", + serverName: "io.github.testuser/multi-version-server", + authClaims: &auth.JWTClaims{ + AuthMethod: auth.MethodGitHubAT, + AuthMethodSubject: "testuser", + Permissions: []auth.Permission{ + {Action: auth.PermissionActionPublish, ResourcePattern: "io.github.testuser/*"}, + }, + }, + requestBody: v0.UpdateServerStatusBody{ + Status: "active", + }, + expectedStatus: http.StatusOK, + checkResult: func(t *testing.T, resp *v0.UpdateAllVersionsStatusResponse) { + t.Helper() + assert.Equal(t, 3, resp.UpdatedCount) + for _, server := range resp.Servers { + assert.Equal(t, model.StatusActive, server.Meta.Official.Status) + // Status message should be cleared when transitioning to active + assert.Nil(t, server.Meta.Official.StatusMessage) + } + }, + }, + { + name: "missing authorization header", + serverName: "io.github.testuser/multi-version-server", + authHeader: "", + requestBody: v0.UpdateServerStatusBody{Status: "deprecated"}, + expectedStatus: http.StatusUnprocessableEntity, + expectedError: "required header parameter is missing", + }, + { + name: "invalid authorization header format", + serverName: "io.github.testuser/multi-version-server", + authHeader: "InvalidFormat token123", + requestBody: v0.UpdateServerStatusBody{ + Status: "deprecated", + }, + expectedStatus: http.StatusUnauthorized, + expectedError: "Invalid Authorization header format", + }, + { + name: "permission denied - no publish or edit permissions", + serverName: "io.github.testuser/multi-version-server", + authClaims: &auth.JWTClaims{ + AuthMethod: auth.MethodGitHubAT, + AuthMethodSubject: "testuser", + Permissions: []auth.Permission{ + {Action: "read", ResourcePattern: "io.github.testuser/*"}, + }, + }, + requestBody: v0.UpdateServerStatusBody{ + Status: "deprecated", + }, + expectedStatus: http.StatusForbidden, + expectedError: "You do not have publish or edit permissions for this server", + }, + { + name: "successful status change with edit permission only", + serverName: "io.github.testuser/multi-version-server", + authClaims: &auth.JWTClaims{ + AuthMethod: auth.MethodGitHubAT, + AuthMethodSubject: "testuser", + Permissions: []auth.Permission{ + {Action: auth.PermissionActionEdit, ResourcePattern: "io.github.testuser/*"}, + }, + }, + requestBody: v0.UpdateServerStatusBody{ + Status: "deprecated", + }, + expectedStatus: http.StatusOK, + checkResult: func(t *testing.T, resp *v0.UpdateAllVersionsStatusResponse) { + t.Helper() + assert.Equal(t, 3, resp.UpdatedCount) + for _, server := range resp.Servers { + assert.Equal(t, model.StatusDeprecated, server.Meta.Official.Status) + } + }, + }, + { + name: "successful status change with both publish and edit permissions", + serverName: "io.github.testuser/multi-version-server", + authClaims: &auth.JWTClaims{ + AuthMethod: auth.MethodGitHubAT, + AuthMethodSubject: "testuser", + Permissions: []auth.Permission{ + {Action: auth.PermissionActionPublish, ResourcePattern: "io.github.testuser/*"}, + {Action: auth.PermissionActionEdit, ResourcePattern: "io.github.testuser/*"}, + }, + }, + requestBody: v0.UpdateServerStatusBody{ + Status: "active", + }, + expectedStatus: http.StatusOK, + checkResult: func(t *testing.T, resp *v0.UpdateAllVersionsStatusResponse) { + t.Helper() + assert.Equal(t, 3, resp.UpdatedCount) + for _, server := range resp.Servers { + assert.Equal(t, model.StatusActive, server.Meta.Official.Status) + } + }, + }, + { + name: "bulk no-op when all versions already have target status and message", + serverName: "io.github.testuser/multi-version-server", + authClaims: &auth.JWTClaims{ + AuthMethod: auth.MethodGitHubAT, + AuthMethodSubject: "testuser", + Permissions: []auth.Permission{ + {Action: auth.PermissionActionPublish, ResourcePattern: "io.github.testuser/*"}, + }, + }, + requestBody: v0.UpdateServerStatusBody{ + Status: "active", + }, + expectedStatus: http.StatusBadRequest, + expectedError: "No changes to apply: all versions already have the requested status and message", + }, + { + name: "server not found", + serverName: "io.github.testuser/non-existent", + authClaims: &auth.JWTClaims{ + AuthMethod: auth.MethodGitHubAT, + AuthMethodSubject: "testuser", + Permissions: []auth.Permission{ + {Action: auth.PermissionActionPublish, ResourcePattern: "io.github.testuser/*"}, + }, + }, + requestBody: v0.UpdateServerStatusBody{ + Status: "deprecated", + }, + expectedStatus: http.StatusNotFound, + expectedError: "Server not found", + }, + } + + for _, tc := range testCases { + t.Run(tc.name, func(t *testing.T) { + // Create Huma API + mux := http.NewServeMux() + api := humago.New(mux, huma.DefaultConfig("Test API", "1.0.0")) + + // Register all-versions status endpoints + v0.RegisterAllVersionsStatusEndpoints(api, "/v0", registryService, cfg) + + // Create request body + requestBody, err := json.Marshal(tc.requestBody) + require.NoError(t, err) + + // Create request URL with proper encoding + encodedServerName := url.PathEscape(tc.serverName) + requestURL := "/v0/servers/" + encodedServerName + "/status" + + req := httptest.NewRequest(http.MethodPatch, requestURL, bytes.NewReader(requestBody)) + req.Header.Set("Content-Type", "application/json") + + // Set authorization header + if tc.authHeader != "" { + req.Header.Set("Authorization", tc.authHeader) + } else if tc.authClaims != nil { + // Generate valid JWT token + jwtManager := auth.NewJWTManager(cfg) + tokenResponse, err := jwtManager.GenerateTokenResponse(context.Background(), *tc.authClaims) + require.NoError(t, err) + req.Header.Set("Authorization", "Bearer "+tokenResponse.RegistryToken) + } + + // Create response recorder and execute request + w := httptest.NewRecorder() + mux.ServeHTTP(w, req) + + // Check response + if tc.expectedStatus != w.Code { + t.Logf("Response body: %s", w.Body.String()) + } + assert.Equal(t, tc.expectedStatus, w.Code) + + if tc.expectedError != "" { + assert.Contains(t, w.Body.String(), tc.expectedError) + } + + if tc.expectedStatus == http.StatusOK && tc.checkResult != nil { + var response v0.UpdateAllVersionsStatusResponse + err := json.NewDecoder(w.Body).Decode(&response) + require.NoError(t, err) + tc.checkResult(t, &response) + } + }) + } +} + +// strPtr is a helper function to create a pointer to a string +func strPtr(s string) *string { + return &s +} diff --git a/internal/api/router/v0.go b/internal/api/router/v0.go index 62bc46e..3b57c67 100644 --- a/internal/api/router/v0.go +++ b/internal/api/router/v0.go @@ -19,6 +19,8 @@ func RegisterV0Routes( v0.RegisterVersionEndpoint(api, "/v0", versionInfo) v0.RegisterServersEndpoints(api, "/v0", registry) v0.RegisterEditEndpoints(api, "/v0", registry, cfg) + v0.RegisterStatusEndpoints(api, "/v0", registry, cfg) + v0.RegisterAllVersionsStatusEndpoints(api, "/v0", registry, cfg) v0auth.RegisterAuthEndpoints(api, "/v0", cfg) v0.RegisterPublishEndpoint(api, "/v0", registry, cfg) v0.RegisterValidateEndpoint(api, "/v0") @@ -32,6 +34,8 @@ func RegisterV0_1Routes( v0.RegisterVersionEndpoint(api, "/v0.1", versionInfo) v0.RegisterServersEndpoints(api, "/v0.1", registry) v0.RegisterEditEndpoints(api, "/v0.1", registry, cfg) + v0.RegisterStatusEndpoints(api, "/v0.1", registry, cfg) + v0.RegisterAllVersionsStatusEndpoints(api, "/v0.1", registry, cfg) v0auth.RegisterAuthEndpoints(api, "/v0.1", cfg) v0.RegisterPublishEndpoint(api, "/v0.1", registry, cfg) v0.RegisterValidateEndpoint(api, "/v0.1") diff --git a/internal/auth/jwt.go b/internal/auth/jwt.go index 4558666..b1935e5 100644 --- a/internal/auth/jwt.go +++ b/internal/auth/jwt.go @@ -9,6 +9,7 @@ import ( "time" "github.com/golang-jwt/jwt/v5" + "github.com/modelcontextprotocol/registry/internal/config" ) @@ -17,7 +18,7 @@ type PermissionAction string const ( PermissionActionPublish PermissionAction = "publish" - // Intended for admins taking moderation actions only, at least for now + // PermissionActionEdit allows editing server configuration. PermissionActionEdit PermissionAction = "edit" ) @@ -128,7 +129,6 @@ func (j *JWTManager) ValidateToken(_ context.Context, tokenString string) (*JWTC jwt.WithValidMethods([]string{"EdDSA"}), jwt.WithExpirationRequired(), ) - // Validate token if err != nil { return nil, fmt.Errorf("failed to parse token: %w", err) diff --git a/internal/database/database.go b/internal/database/database.go index ebae55d..c9acf07 100644 --- a/internal/database/database.go +++ b/internal/database/database.go @@ -7,6 +7,7 @@ import ( "github.com/jackc/pgx/v5" apiv0 "github.com/modelcontextprotocol/registry/pkg/api/v0" + "github.com/modelcontextprotocol/registry/pkg/model" ) // Common database errors @@ -21,12 +22,13 @@ var ( // ServerFilter defines filtering options for server queries type ServerFilter struct { - Name *string // for finding versions of same server - RemoteURL *string // for duplicate URL detection - UpdatedSince *time.Time // for incremental sync filtering - SubstringName *string // for substring search on name - Version *string // for exact version matching - IsLatest *bool // for filtering latest versions only + Name *string // for finding versions of same server + RemoteURL *string // for duplicate URL detection + UpdatedSince *time.Time // for incremental sync filtering + SubstringName *string // for substring search on name + Version *string // for exact version matching + IsLatest *bool // for filtering latest versions only + IncludeDeleted *bool // for including deleted packages in results (default: exclude) } // Database defines the interface for database operations @@ -36,15 +38,17 @@ type Database interface { // UpdateServer updates an existing server record UpdateServer(ctx context.Context, tx pgx.Tx, serverName, version string, serverJSON *apiv0.ServerJSON) (*apiv0.ServerResponse, error) // SetServerStatus updates the status of a specific server version - SetServerStatus(ctx context.Context, tx pgx.Tx, serverName, version string, status string) (*apiv0.ServerResponse, error) + SetServerStatus(ctx context.Context, tx pgx.Tx, serverName, version string, status model.Status, statusMessage *string) (*apiv0.ServerResponse, error) + // SetAllVersionsStatus updates the status of all versions of a server in a single query + SetAllVersionsStatus(ctx context.Context, tx pgx.Tx, serverName string, status model.Status, statusMessage *string) ([]*apiv0.ServerResponse, error) // ListServers retrieve server entries with optional filtering ListServers(ctx context.Context, tx pgx.Tx, filter *ServerFilter, cursor string, limit int) ([]*apiv0.ServerResponse, string, error) // GetServerByName retrieve a single server by its name - GetServerByName(ctx context.Context, tx pgx.Tx, serverName string) (*apiv0.ServerResponse, error) + GetServerByName(ctx context.Context, tx pgx.Tx, serverName string, includeDeleted bool) (*apiv0.ServerResponse, error) // GetServerByNameAndVersion retrieve specific version of a server by server name and version - GetServerByNameAndVersion(ctx context.Context, tx pgx.Tx, serverName string, version string) (*apiv0.ServerResponse, error) + GetServerByNameAndVersion(ctx context.Context, tx pgx.Tx, serverName string, version string, includeDeleted bool) (*apiv0.ServerResponse, error) // GetAllVersionsByServerName retrieve all versions of a server by server name - GetAllVersionsByServerName(ctx context.Context, tx pgx.Tx, serverName string) ([]*apiv0.ServerResponse, error) + GetAllVersionsByServerName(ctx context.Context, tx pgx.Tx, serverName string, includeDeleted bool) ([]*apiv0.ServerResponse, error) // GetCurrentLatestVersion retrieve the current latest version of a server by server name GetCurrentLatestVersion(ctx context.Context, tx pgx.Tx, serverName string) (*apiv0.ServerResponse, error) // CountServerVersions count the number of versions for a server diff --git a/internal/database/migrations/013_add_status_fields.sql b/internal/database/migrations/013_add_status_fields.sql new file mode 100644 index 0000000..5c3c448 --- /dev/null +++ b/internal/database/migrations/013_add_status_fields.sql @@ -0,0 +1,24 @@ +-- Add status management fields for deprecation features +-- Status values: active, deprecated, deleted + +BEGIN; + +-- Add new columns for status management +ALTER TABLE servers ADD COLUMN status_changed_at TIMESTAMP WITH TIME ZONE; +ALTER TABLE servers ADD COLUMN status_message TEXT; + +-- Constraint: status_message must not exceed 500 characters +ALTER TABLE servers ADD CONSTRAINT check_status_message_length + CHECK (length(status_message) <= 500); + +-- Initialize status_changed_at with published_at for existing records +UPDATE servers SET status_changed_at = published_at WHERE status_changed_at IS NULL; + +-- Make status_changed_at NOT NULL now that all records have values +ALTER TABLE servers ALTER COLUMN status_changed_at SET NOT NULL; + +-- Constraint: status_changed_at must be >= published_at +ALTER TABLE servers ADD CONSTRAINT check_status_changed_at_after_published + CHECK (status_changed_at >= published_at); + +COMMIT; diff --git a/internal/database/postgres.go b/internal/database/postgres.go index b47ef74..70bfe43 100644 --- a/internal/database/postgres.go +++ b/internal/database/postgres.go @@ -79,6 +79,75 @@ func NewPostgreSQL(ctx context.Context, connectionURI string) (*PostgreSQL, erro }, nil } +// buildFilterConditions constructs WHERE clause conditions from a ServerFilter +// +//nolint:unparam // argIndex is always 1 currently but kept for API flexibility +func buildFilterConditions(filter *ServerFilter, argIndex int) ([]string, []any, int) { + var conditions []string + var args []any + + if filter == nil { + return conditions, args, argIndex + } + + if filter.Name != nil { + conditions = append(conditions, fmt.Sprintf("server_name = $%d", argIndex)) + args = append(args, *filter.Name) + argIndex++ + } + if filter.RemoteURL != nil { + conditions = append(conditions, fmt.Sprintf("EXISTS (SELECT 1 FROM jsonb_array_elements(value->'remotes') AS remote WHERE remote->>'url' = $%d)", argIndex)) + args = append(args, *filter.RemoteURL) + argIndex++ + } + if filter.UpdatedSince != nil { + conditions = append(conditions, fmt.Sprintf("updated_at > $%d", argIndex)) + args = append(args, *filter.UpdatedSince) + argIndex++ + } + if filter.SubstringName != nil { + conditions = append(conditions, fmt.Sprintf("server_name ILIKE $%d", argIndex)) + args = append(args, "%"+*filter.SubstringName+"%") + argIndex++ + } + if filter.Version != nil { + conditions = append(conditions, fmt.Sprintf("version = $%d", argIndex)) + args = append(args, *filter.Version) + argIndex++ + } + if filter.IsLatest != nil { + conditions = append(conditions, fmt.Sprintf("is_latest = $%d", argIndex)) + args = append(args, *filter.IsLatest) + argIndex++ + } + if filter.IncludeDeleted == nil || !*filter.IncludeDeleted { + conditions = append(conditions, "status != 'deleted'") + } + + return conditions, args, argIndex +} + +// addCursorCondition adds pagination cursor condition to WHERE clause +func addCursorCondition(cursor string, argIndex int) (string, []any, int) { + if cursor == "" { + return "", nil, argIndex + } + + // Parse cursor format: "serverName:version" + parts := strings.SplitN(cursor, ":", 2) + if len(parts) == 2 { + cursorServerName := parts[0] + cursorVersion := parts[1] + // Use compound condition: (server_name > cursor_name) OR (server_name = cursor_name AND version > cursor_version) + condition := fmt.Sprintf("(server_name > $%d OR (server_name = $%d AND version > $%d))", argIndex, argIndex+1, argIndex+2) + return condition, []any{cursorServerName, cursorServerName, cursorVersion}, argIndex + 3 + } + + // Fallback for malformed cursor - treat as server name only for backwards compatibility + condition := fmt.Sprintf("server_name > $%d", argIndex) + return condition, []any{cursor}, argIndex + 1 +} + func (db *PostgreSQL) ListServers( ctx context.Context, tx pgx.Tx, @@ -94,64 +163,17 @@ func (db *PostgreSQL) ListServers( return nil, "", ctx.Err() } - // Build WHERE clause for filtering using dedicated columns - var whereConditions []string - args := []any{} + // Build WHERE clause conditions argIndex := 1 + whereConditions, args, argIndex := buildFilterConditions(filter, argIndex) - // Add filters using dedicated columns for better performance - if filter != nil { - if filter.Name != nil { - whereConditions = append(whereConditions, fmt.Sprintf("server_name = $%d", argIndex)) - args = append(args, *filter.Name) - argIndex++ - } - if filter.RemoteURL != nil { - whereConditions = append(whereConditions, fmt.Sprintf("EXISTS (SELECT 1 FROM jsonb_array_elements(value->'remotes') AS remote WHERE remote->>'url' = $%d)", argIndex)) - args = append(args, *filter.RemoteURL) - argIndex++ - } - if filter.UpdatedSince != nil { - whereConditions = append(whereConditions, fmt.Sprintf("updated_at > $%d", argIndex)) - args = append(args, *filter.UpdatedSince) - argIndex++ - } - if filter.SubstringName != nil { - whereConditions = append(whereConditions, fmt.Sprintf("server_name ILIKE $%d", argIndex)) - args = append(args, "%"+*filter.SubstringName+"%") - argIndex++ - } - if filter.Version != nil { - whereConditions = append(whereConditions, fmt.Sprintf("version = $%d", argIndex)) - args = append(args, *filter.Version) - argIndex++ - } - if filter.IsLatest != nil { - whereConditions = append(whereConditions, fmt.Sprintf("is_latest = $%d", argIndex)) - args = append(args, *filter.IsLatest) - argIndex++ - } - } - - // Add cursor pagination using compound serverName:version cursor - if cursor != "" { - // Parse cursor format: "serverName:version" - parts := strings.SplitN(cursor, ":", 2) - if len(parts) == 2 { - cursorServerName := parts[0] - cursorVersion := parts[1] - - // Use compound condition: (server_name > cursor_name) OR (server_name = cursor_name AND version > cursor_version) - whereConditions = append(whereConditions, fmt.Sprintf("(server_name > $%d OR (server_name = $%d AND version > $%d))", argIndex, argIndex+1, argIndex+2)) - args = append(args, cursorServerName, cursorServerName, cursorVersion) - argIndex += 3 - } else { - // Fallback for malformed cursor - treat as server name only for backwards compatibility - whereConditions = append(whereConditions, fmt.Sprintf("server_name > $%d", argIndex)) - args = append(args, cursor) - argIndex++ - } + // Add cursor pagination + cursorCondition, cursorArgs, argIndex := addCursorCondition(cursor, argIndex) + if cursorCondition != "" { + whereConditions = append(whereConditions, cursorCondition) + args = append(args, cursorArgs...) } + _ = argIndex // Silence unused variable warning // Build the WHERE clause whereClause := "" @@ -161,7 +183,7 @@ func (db *PostgreSQL) ListServers( // Query servers table with hybrid column/JSON data query := fmt.Sprintf(` - SELECT server_name, version, status, published_at, updated_at, is_latest, value + SELECT server_name, version, status, status_changed_at, status_message, published_at, updated_at, is_latest, value FROM servers %s ORDER BY server_name, version @@ -178,11 +200,12 @@ func (db *PostgreSQL) ListServers( var results []*apiv0.ServerResponse for rows.Next() { var serverName, version, status string - var publishedAt, updatedAt time.Time + var statusChangedAt, publishedAt, updatedAt time.Time + var statusMessage *string var isLatest bool var valueJSON []byte - err := rows.Scan(&serverName, &version, &status, &publishedAt, &updatedAt, &isLatest, &valueJSON) + err := rows.Scan(&serverName, &version, &status, &statusChangedAt, &statusMessage, &publishedAt, &updatedAt, &isLatest, &valueJSON) if err != nil { return nil, "", fmt.Errorf("failed to scan server row: %w", err) } @@ -198,10 +221,12 @@ func (db *PostgreSQL) ListServers( Server: serverJSON, Meta: apiv0.ResponseMeta{ Official: &apiv0.RegistryExtensions{ - Status: model.Status(status), - PublishedAt: publishedAt, - UpdatedAt: updatedAt, - IsLatest: isLatest, + Status: model.Status(status), + StatusChangedAt: statusChangedAt, + StatusMessage: statusMessage, + PublishedAt: publishedAt, + UpdatedAt: updatedAt, + IsLatest: isLatest, }, }, } @@ -224,25 +249,41 @@ func (db *PostgreSQL) ListServers( } // GetServerByName retrieves the latest version of a server by server name -func (db *PostgreSQL) GetServerByName(ctx context.Context, tx pgx.Tx, serverName string) (*apiv0.ServerResponse, error) { +func (db *PostgreSQL) GetServerByName(ctx context.Context, tx pgx.Tx, serverName string, includeDeleted bool) (*apiv0.ServerResponse, error) { if ctx.Err() != nil { return nil, ctx.Err() } - query := ` - SELECT server_name, version, status, published_at, updated_at, is_latest, value + // Build filter conditions + isLatest := true + filter := &ServerFilter{ + Name: &serverName, + IsLatest: &isLatest, + IncludeDeleted: &includeDeleted, + } + + argIndex := 1 + whereConditions, args, _ := buildFilterConditions(filter, argIndex) + + whereClause := "" + if len(whereConditions) > 0 { + whereClause = "WHERE " + strings.Join(whereConditions, " AND ") + } + + query := fmt.Sprintf(` + SELECT server_name, version, status, status_changed_at, status_message, published_at, updated_at, is_latest, value FROM servers - WHERE server_name = $1 AND is_latest = true + %s ORDER BY published_at DESC LIMIT 1 - ` + `, whereClause) var name, version, status string - var publishedAt, updatedAt time.Time - var isLatest bool + var statusChangedAt, publishedAt, updatedAt time.Time + var statusMessage *string var valueJSON []byte - err := db.getExecutor(tx).QueryRow(ctx, query, serverName).Scan(&name, &version, &status, &publishedAt, &updatedAt, &isLatest, &valueJSON) + err := db.getExecutor(tx).QueryRow(ctx, query, args...).Scan(&name, &version, &status, &statusChangedAt, &statusMessage, &publishedAt, &updatedAt, &isLatest, &valueJSON) if err != nil { if errors.Is(err, pgx.ErrNoRows) { return nil, ErrNotFound @@ -261,10 +302,12 @@ func (db *PostgreSQL) GetServerByName(ctx context.Context, tx pgx.Tx, serverName Server: serverJSON, Meta: apiv0.ResponseMeta{ Official: &apiv0.RegistryExtensions{ - Status: model.Status(status), - PublishedAt: publishedAt, - UpdatedAt: updatedAt, - IsLatest: isLatest, + Status: model.Status(status), + StatusChangedAt: statusChangedAt, + StatusMessage: statusMessage, + PublishedAt: publishedAt, + UpdatedAt: updatedAt, + IsLatest: isLatest, }, }, } @@ -273,24 +316,40 @@ func (db *PostgreSQL) GetServerByName(ctx context.Context, tx pgx.Tx, serverName } // GetServerByNameAndVersion retrieves a specific version of a server by server name and version -func (db *PostgreSQL) GetServerByNameAndVersion(ctx context.Context, tx pgx.Tx, serverName string, version string) (*apiv0.ServerResponse, error) { +func (db *PostgreSQL) GetServerByNameAndVersion(ctx context.Context, tx pgx.Tx, serverName string, version string, includeDeleted bool) (*apiv0.ServerResponse, error) { if ctx.Err() != nil { return nil, ctx.Err() } - query := ` - SELECT server_name, version, status, published_at, updated_at, is_latest, value + // Build filter conditions + filter := &ServerFilter{ + Name: &serverName, + Version: &version, + IncludeDeleted: &includeDeleted, + } + + argIndex := 1 + whereConditions, args, _ := buildFilterConditions(filter, argIndex) + + whereClause := "" + if len(whereConditions) > 0 { + whereClause = "WHERE " + strings.Join(whereConditions, " AND ") + } + + query := fmt.Sprintf(` + SELECT server_name, version, status, status_changed_at, status_message, published_at, updated_at, is_latest, value FROM servers - WHERE server_name = $1 AND version = $2 + %s LIMIT 1 - ` + `, whereClause) var name, vers, status string - var publishedAt, updatedAt time.Time + var statusChangedAt, publishedAt, updatedAt time.Time + var statusMessage *string var isLatest bool var valueJSON []byte - err := db.getExecutor(tx).QueryRow(ctx, query, serverName, version).Scan(&name, &vers, &status, &publishedAt, &updatedAt, &isLatest, &valueJSON) + err := db.getExecutor(tx).QueryRow(ctx, query, args...).Scan(&name, &vers, &status, &statusChangedAt, &statusMessage, &publishedAt, &updatedAt, &isLatest, &valueJSON) if err != nil { if errors.Is(err, pgx.ErrNoRows) { return nil, ErrNotFound @@ -309,10 +368,12 @@ func (db *PostgreSQL) GetServerByNameAndVersion(ctx context.Context, tx pgx.Tx, Server: serverJSON, Meta: apiv0.ResponseMeta{ Official: &apiv0.RegistryExtensions{ - Status: model.Status(status), - PublishedAt: publishedAt, - UpdatedAt: updatedAt, - IsLatest: isLatest, + Status: model.Status(status), + StatusChangedAt: statusChangedAt, + StatusMessage: statusMessage, + PublishedAt: publishedAt, + UpdatedAt: updatedAt, + IsLatest: isLatest, }, }, } @@ -321,19 +382,33 @@ func (db *PostgreSQL) GetServerByNameAndVersion(ctx context.Context, tx pgx.Tx, } // GetAllVersionsByServerName retrieves all versions of a server by server name -func (db *PostgreSQL) GetAllVersionsByServerName(ctx context.Context, tx pgx.Tx, serverName string) ([]*apiv0.ServerResponse, error) { +func (db *PostgreSQL) GetAllVersionsByServerName(ctx context.Context, tx pgx.Tx, serverName string, includeDeleted bool) ([]*apiv0.ServerResponse, error) { if ctx.Err() != nil { return nil, ctx.Err() } - query := ` - SELECT server_name, version, status, published_at, updated_at, is_latest, value - FROM servers - WHERE server_name = $1 - ORDER BY published_at DESC - ` + // Build filter conditions + filter := &ServerFilter{ + Name: &serverName, + IncludeDeleted: &includeDeleted, + } - rows, err := db.getExecutor(tx).Query(ctx, query, serverName) + argIndex := 1 + whereConditions, args, _ := buildFilterConditions(filter, argIndex) + + whereClause := "" + if len(whereConditions) > 0 { + whereClause = "WHERE " + strings.Join(whereConditions, " AND ") + } + + query := fmt.Sprintf(` + SELECT server_name, version, status, status_changed_at, status_message, published_at, updated_at, is_latest, value + FROM servers + %s + ORDER BY published_at DESC + `, whereClause) + + rows, err := db.getExecutor(tx).Query(ctx, query, args...) if err != nil { return nil, fmt.Errorf("failed to query server versions: %w", err) } @@ -342,11 +417,12 @@ func (db *PostgreSQL) GetAllVersionsByServerName(ctx context.Context, tx pgx.Tx, var results []*apiv0.ServerResponse for rows.Next() { var name, version, status string - var publishedAt, updatedAt time.Time + var statusChangedAt, publishedAt, updatedAt time.Time + var statusMessage *string var isLatest bool var valueJSON []byte - err := rows.Scan(&name, &version, &status, &publishedAt, &updatedAt, &isLatest, &valueJSON) + err := rows.Scan(&name, &version, &status, &statusChangedAt, &statusMessage, &publishedAt, &updatedAt, &isLatest, &valueJSON) if err != nil { return nil, fmt.Errorf("failed to scan server row: %w", err) } @@ -362,10 +438,12 @@ func (db *PostgreSQL) GetAllVersionsByServerName(ctx context.Context, tx pgx.Tx, Server: serverJSON, Meta: apiv0.ResponseMeta{ Official: &apiv0.RegistryExtensions{ - Status: model.Status(status), - PublishedAt: publishedAt, - UpdatedAt: updatedAt, - IsLatest: isLatest, + Status: model.Status(status), + StatusChangedAt: statusChangedAt, + StatusMessage: statusMessage, + PublishedAt: publishedAt, + UpdatedAt: updatedAt, + IsLatest: isLatest, }, }, } @@ -407,20 +485,21 @@ func (db *PostgreSQL) CreateServer(ctx context.Context, tx pgx.Tx, serverJSON *a // Insert the new server version using composite primary key insertQuery := ` - INSERT INTO servers (server_name, version, status, published_at, updated_at, is_latest, value) - VALUES ($1, $2, $3, $4, $5, $6, $7) + INSERT INTO servers (server_name, version, status, status_changed_at, status_message, published_at, updated_at, is_latest, value) + VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9) ` _, err = db.getExecutor(tx).Exec(ctx, insertQuery, serverJSON.Name, serverJSON.Version, string(officialMeta.Status), + officialMeta.StatusChangedAt, + officialMeta.StatusMessage, officialMeta.PublishedAt, officialMeta.UpdatedAt, officialMeta.IsLatest, valueJSON, ) - if err != nil { return nil, fmt.Errorf("failed to insert server: %w", err) } @@ -463,14 +542,15 @@ func (db *PostgreSQL) UpdateServer(ctx context.Context, tx pgx.Tx, serverName, v UPDATE servers SET value = $1, updated_at = NOW() WHERE server_name = $2 AND version = $3 - RETURNING server_name, version, status, published_at, updated_at, is_latest + RETURNING server_name, version, status, status_changed_at, status_message, published_at, updated_at, is_latest ` var name, vers, status string - var publishedAt, updatedAt time.Time + var statusChangedAt, publishedAt, updatedAt time.Time + var statusMessage *string var isLatest bool - err = db.getExecutor(tx).QueryRow(ctx, query, valueJSON, serverName, version).Scan(&name, &vers, &status, &publishedAt, &updatedAt, &isLatest) + err = db.getExecutor(tx).QueryRow(ctx, query, valueJSON, serverName, version).Scan(&name, &vers, &status, &statusChangedAt, &statusMessage, &publishedAt, &updatedAt, &isLatest) if err != nil { if errors.Is(err, pgx.ErrNoRows) { return nil, ErrNotFound @@ -483,10 +563,12 @@ func (db *PostgreSQL) UpdateServer(ctx context.Context, tx pgx.Tx, serverName, v Server: *serverJSON, Meta: apiv0.ResponseMeta{ Official: &apiv0.RegistryExtensions{ - Status: model.Status(status), - PublishedAt: publishedAt, - UpdatedAt: updatedAt, - IsLatest: isLatest, + Status: model.Status(status), + StatusChangedAt: statusChangedAt, + StatusMessage: statusMessage, + PublishedAt: publishedAt, + UpdatedAt: updatedAt, + IsLatest: isLatest, }, }, } @@ -495,25 +577,31 @@ func (db *PostgreSQL) UpdateServer(ctx context.Context, tx pgx.Tx, serverName, v } // SetServerStatus updates the status of a specific server version -func (db *PostgreSQL) SetServerStatus(ctx context.Context, tx pgx.Tx, serverName, version string, status string) (*apiv0.ServerResponse, error) { +func (db *PostgreSQL) SetServerStatus(ctx context.Context, tx pgx.Tx, serverName, version string, status model.Status, statusMessage *string) (*apiv0.ServerResponse, error) { if ctx.Err() != nil { return nil, ctx.Err() } - // Update the status column + // Update the status and related fields + // Only update status_changed_at when status actually changes query := ` UPDATE servers - SET status = $1, updated_at = NOW() + SET + status = $1, + status_changed_at = CASE WHEN status != $1::varchar THEN NOW() ELSE status_changed_at END, + updated_at = NOW(), + status_message = $4 WHERE server_name = $2 AND version = $3 - RETURNING server_name, version, status, value, published_at, updated_at, is_latest + RETURNING server_name, version, status, value, published_at, updated_at, is_latest, status_changed_at, status_message ` var name, vers, currentStatus string - var publishedAt, updatedAt time.Time + var publishedAt, updatedAt, statusChangedAt time.Time var isLatest bool var valueJSON []byte + var resultStatusMessage *string - err := db.getExecutor(tx).QueryRow(ctx, query, status, serverName, version).Scan(&name, &vers, ¤tStatus, &valueJSON, &publishedAt, &updatedAt, &isLatest) + err := db.getExecutor(tx).QueryRow(ctx, query, string(status), serverName, version, statusMessage).Scan(&name, &vers, ¤tStatus, &valueJSON, &publishedAt, &updatedAt, &isLatest, &statusChangedAt, &resultStatusMessage) if err != nil { if errors.Is(err, pgx.ErrNoRows) { return nil, ErrNotFound @@ -532,10 +620,12 @@ func (db *PostgreSQL) SetServerStatus(ctx context.Context, tx pgx.Tx, serverName Server: serverJSON, Meta: apiv0.ResponseMeta{ Official: &apiv0.RegistryExtensions{ - Status: model.Status(currentStatus), - PublishedAt: publishedAt, - UpdatedAt: updatedAt, - IsLatest: isLatest, + Status: model.Status(currentStatus), + StatusChangedAt: statusChangedAt, + StatusMessage: resultStatusMessage, + PublishedAt: publishedAt, + UpdatedAt: updatedAt, + IsLatest: isLatest, }, }, } @@ -543,6 +633,78 @@ func (db *PostgreSQL) SetServerStatus(ctx context.Context, tx pgx.Tx, serverName return serverResponse, nil } +// SetAllVersionsStatus updates the status of all versions of a server in a single query +func (db *PostgreSQL) SetAllVersionsStatus(ctx context.Context, tx pgx.Tx, serverName string, status model.Status, statusMessage *string) ([]*apiv0.ServerResponse, error) { + if ctx.Err() != nil { + return nil, ctx.Err() + } + + // Update the status and related fields for all versions + // Only update rows where status or status_message actually changes + // Only update status_changed_at when status actually changes + query := ` + UPDATE servers + SET + status = $1, + status_changed_at = CASE WHEN status != $1::varchar THEN NOW() ELSE status_changed_at END, + updated_at = NOW(), + status_message = $2 + WHERE server_name = $3 + AND (status != $1::varchar OR status_message IS DISTINCT FROM $2) + RETURNING server_name, version, status, value, published_at, updated_at, is_latest, status_changed_at, status_message + ` + + rows, err := db.getExecutor(tx).Query(ctx, query, string(status), statusMessage, serverName) + if err != nil { + return nil, fmt.Errorf("failed to update all server versions status: %w", err) + } + defer rows.Close() + + var results []*apiv0.ServerResponse + for rows.Next() { + var name, vers, currentStatus string + var publishedAt, updatedAt, statusChangedAt time.Time + var isLatest bool + var valueJSON []byte + var resultStatusMessage *string + + if err := rows.Scan(&name, &vers, ¤tStatus, &valueJSON, &publishedAt, &updatedAt, &isLatest, &statusChangedAt, &resultStatusMessage); err != nil { + return nil, fmt.Errorf("failed to scan server row: %w", err) + } + + // Unmarshal the JSON data + var serverJSON apiv0.ServerJSON + if err := json.Unmarshal(valueJSON, &serverJSON); err != nil { + return nil, fmt.Errorf("failed to unmarshal server JSON: %w", err) + } + + serverResponse := &apiv0.ServerResponse{ + Server: serverJSON, + Meta: apiv0.ResponseMeta{ + Official: &apiv0.RegistryExtensions{ + Status: model.Status(currentStatus), + StatusChangedAt: statusChangedAt, + StatusMessage: resultStatusMessage, + PublishedAt: publishedAt, + UpdatedAt: updatedAt, + IsLatest: isLatest, + }, + }, + } + results = append(results, serverResponse) + } + + if err := rows.Err(); err != nil { + return nil, fmt.Errorf("error iterating server rows: %w", err) + } + + if len(results) == 0 { + return nil, ErrNotFound + } + + return results, nil +} + // InTransaction executes a function within a database transaction func (db *PostgreSQL) InTransaction(ctx context.Context, fn func(ctx context.Context, tx pgx.Tx) error) error { if ctx.Err() != nil { @@ -615,7 +777,7 @@ func (db *PostgreSQL) GetCurrentLatestVersion(ctx context.Context, tx pgx.Tx, se executor := db.getExecutor(tx) query := ` - SELECT server_name, version, status, value, published_at, updated_at, is_latest + SELECT server_name, version, status, status_changed_at, status_message, published_at, updated_at, is_latest, value FROM servers WHERE server_name = $1 AND is_latest = true ` @@ -623,11 +785,12 @@ func (db *PostgreSQL) GetCurrentLatestVersion(ctx context.Context, tx pgx.Tx, se row := executor.QueryRow(ctx, query, serverName) var name, version, status string - var publishedAt, updatedAt time.Time + var statusChangedAt, publishedAt, updatedAt time.Time + var statusMessage *string var isLatest bool var jsonValue []byte - err := row.Scan(&name, &version, &status, &jsonValue, &publishedAt, &updatedAt, &isLatest) + err := row.Scan(&name, &version, &status, &statusChangedAt, &statusMessage, &publishedAt, &updatedAt, &isLatest, &jsonValue) if err != nil { if errors.Is(err, pgx.ErrNoRows) { return nil, ErrNotFound @@ -646,9 +809,12 @@ func (db *PostgreSQL) GetCurrentLatestVersion(ctx context.Context, tx pgx.Tx, se Server: serverJSON, Meta: apiv0.ResponseMeta{ Official: &apiv0.RegistryExtensions{ - PublishedAt: publishedAt, - UpdatedAt: updatedAt, - IsLatest: isLatest, + Status: model.Status(status), + StatusChangedAt: statusChangedAt, + StatusMessage: statusMessage, + PublishedAt: publishedAt, + UpdatedAt: updatedAt, + IsLatest: isLatest, }, }, } diff --git a/internal/database/postgres_test.go b/internal/database/postgres_test.go index ee90fdc..9b6a5da 100644 --- a/internal/database/postgres_test.go +++ b/internal/database/postgres_test.go @@ -14,9 +14,12 @@ import ( "github.com/stretchr/testify/require" ) +const testVersion100 = "1.0.0" + func TestPostgreSQL_CreateServer(t *testing.T) { db := database.NewTestDB(t) ctx := context.Background() + timeNow := time.Now() tests := []struct { name string @@ -36,10 +39,11 @@ func TestPostgreSQL_CreateServer(t *testing.T) { }, }, officialMeta: &apiv0.RegistryExtensions{ - Status: model.StatusActive, - PublishedAt: time.Now(), - UpdatedAt: time.Now(), - IsLatest: true, + Status: model.StatusActive, + StatusChangedAt: timeNow, + PublishedAt: timeNow, + UpdatedAt: timeNow, + IsLatest: true, }, expectError: false, }, @@ -51,10 +55,11 @@ func TestPostgreSQL_CreateServer(t *testing.T) { Version: "1.0.0", }, officialMeta: &apiv0.RegistryExtensions{ - Status: model.StatusActive, - PublishedAt: time.Now(), - UpdatedAt: time.Now(), - IsLatest: true, + Status: model.StatusActive, + StatusChangedAt: timeNow, + PublishedAt: timeNow, + UpdatedAt: timeNow, + IsLatest: true, }, expectError: true, // Note: Expecting generic database error for constraint violation @@ -94,6 +99,7 @@ func TestPostgreSQL_CreateServer(t *testing.T) { func TestPostgreSQL_GetServerByName(t *testing.T) { db := database.NewTestDB(t) ctx := context.Background() + timeNow := time.Now() // Setup test data serverJSON := &apiv0.ServerJSON{ @@ -102,10 +108,11 @@ func TestPostgreSQL_GetServerByName(t *testing.T) { Version: "1.0.0", } officialMeta := &apiv0.RegistryExtensions{ - Status: model.StatusActive, - PublishedAt: time.Now(), - UpdatedAt: time.Now(), - IsLatest: true, + Status: model.StatusActive, + StatusChangedAt: timeNow, + PublishedAt: timeNow, + UpdatedAt: timeNow, + IsLatest: true, } // Create the server @@ -132,7 +139,7 @@ func TestPostgreSQL_GetServerByName(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { - result, err := db.GetServerByName(ctx, nil, tt.serverName) + result, err := db.GetServerByName(ctx, nil, tt.serverName, false) if tt.expectError { assert.Error(t, err) @@ -153,6 +160,7 @@ func TestPostgreSQL_GetServerByName(t *testing.T) { func TestPostgreSQL_GetServerByNameAndVersion(t *testing.T) { db := database.NewTestDB(t) ctx := context.Background() + timeNow := time.Now() // Setup test data with multiple versions serverName := "com.example/version-test-server" @@ -165,10 +173,11 @@ func TestPostgreSQL_GetServerByNameAndVersion(t *testing.T) { Version: version, } officialMeta := &apiv0.RegistryExtensions{ - Status: model.StatusActive, - PublishedAt: time.Now(), - UpdatedAt: time.Now(), - IsLatest: i == len(versions)-1, // Only last version is latest + Status: model.StatusActive, + StatusChangedAt: timeNow, + PublishedAt: timeNow, + UpdatedAt: timeNow, + IsLatest: i == len(versions)-1, // Only last version is latest } _, err := db.CreateServer(ctx, nil, serverJSON, officialMeta) @@ -205,7 +214,7 @@ func TestPostgreSQL_GetServerByNameAndVersion(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { - result, err := db.GetServerByNameAndVersion(ctx, nil, tt.serverName, tt.version) + result, err := db.GetServerByNameAndVersion(ctx, nil, tt.serverName, tt.version, false) if tt.expectError { assert.Error(t, err) @@ -274,10 +283,11 @@ func TestPostgreSQL_ListServers(t *testing.T) { }, } officialMeta := &apiv0.RegistryExtensions{ - Status: server.status, - PublishedAt: server.publishedAt, - UpdatedAt: server.publishedAt, - IsLatest: server.isLatest, + Status: server.status, + StatusChangedAt: server.publishedAt, + PublishedAt: server.publishedAt, + UpdatedAt: server.publishedAt, + IsLatest: server.isLatest, } _, err := db.CreateServer(ctx, nil, serverJSON, officialMeta) @@ -398,20 +408,22 @@ func TestPostgreSQL_ListServers(t *testing.T) { func TestPostgreSQL_UpdateServer(t *testing.T) { db := database.NewTestDB(t) ctx := context.Background() + timeNow := time.Now() // Setup test data serverName := "com.example/update-test-server" - version := "1.0.0" + version := testVersion100 serverJSON := &apiv0.ServerJSON{ Name: serverName, Description: "Original description", Version: version, } officialMeta := &apiv0.RegistryExtensions{ - Status: model.StatusActive, - PublishedAt: time.Now(), - UpdatedAt: time.Now(), - IsLatest: true, + Status: model.StatusActive, + StatusChangedAt: timeNow, + PublishedAt: timeNow, + UpdatedAt: timeNow, + IsLatest: true, } _, err := db.CreateServer(ctx, nil, serverJSON, officialMeta) @@ -441,11 +453,11 @@ func TestPostgreSQL_UpdateServer(t *testing.T) { { name: "update non-existent server", serverName: "com.example/non-existent", - version: "1.0.0", + version: testVersion100, updatedServer: &apiv0.ServerJSON{ Name: "com.example/non-existent", Description: "Should fail", - Version: "1.0.0", + Version: testVersion100, }, expectError: true, errorType: database.ErrNotFound, @@ -476,20 +488,22 @@ func TestPostgreSQL_UpdateServer(t *testing.T) { func TestPostgreSQL_SetServerStatus(t *testing.T) { db := database.NewTestDB(t) ctx := context.Background() + timeNow := time.Now() // Setup test data serverName := "com.example/status-test-server" - version := "1.0.0" + version := testVersion100 serverJSON := &apiv0.ServerJSON{ Name: serverName, Description: "A server for status testing", Version: version, } officialMeta := &apiv0.RegistryExtensions{ - Status: model.StatusActive, - PublishedAt: time.Now(), - UpdatedAt: time.Now(), - IsLatest: true, + Status: model.StatusActive, + StatusChangedAt: timeNow, + PublishedAt: timeNow, + UpdatedAt: timeNow, + IsLatest: true, } _, err := db.CreateServer(ctx, nil, serverJSON, officialMeta) @@ -528,7 +542,7 @@ func TestPostgreSQL_SetServerStatus(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { - result, err := db.SetServerStatus(ctx, nil, tt.serverName, tt.version, tt.newStatus) + result, err := db.SetServerStatus(ctx, nil, tt.serverName, tt.version, model.Status(tt.newStatus), nil) if tt.expectError { assert.Error(t, err) @@ -546,11 +560,78 @@ func TestPostgreSQL_SetServerStatus(t *testing.T) { } } +func TestPostgreSQL_StatusChangedAtBehavior(t *testing.T) { + db := database.NewTestDB(t) + ctx := context.Background() + + t.Run("status_changed_at updates when status changes", func(t *testing.T) { + timeNow := time.Now() + serverJSON := &apiv0.ServerJSON{ + Name: "com.example/status-changed-at-test", + Description: "Test server", + Version: "1.0.0", + } + officialMeta := &apiv0.RegistryExtensions{ + Status: model.StatusActive, + StatusChangedAt: timeNow, + PublishedAt: timeNow, + UpdatedAt: timeNow, + IsLatest: true, + } + + _, err := db.CreateServer(ctx, nil, serverJSON, officialMeta) + require.NoError(t, err) + + // Wait a bit to ensure time difference + time.Sleep(10 * time.Millisecond) + + // Change status from active to deprecated + result, err := db.SetServerStatus(ctx, nil, serverJSON.Name, serverJSON.Version, model.StatusDeprecated, nil) + require.NoError(t, err) + + assert.Equal(t, model.StatusDeprecated, result.Meta.Official.Status) + assert.True(t, result.Meta.Official.StatusChangedAt.After(timeNow), "status_changed_at should be updated") + }) + + t.Run("status_changed_at preserved when only message changes", func(t *testing.T) { + timeNow := time.Now() + serverJSON := &apiv0.ServerJSON{ + Name: "com.example/message-only-test", + Description: "Test server", + Version: "1.0.0", + } + officialMeta := &apiv0.RegistryExtensions{ + Status: model.StatusDeprecated, + StatusChangedAt: timeNow, + PublishedAt: timeNow, + UpdatedAt: timeNow, + IsLatest: true, + } + + _, err := db.CreateServer(ctx, nil, serverJSON, officialMeta) + require.NoError(t, err) + + // Wait a bit to ensure time difference + time.Sleep(10 * time.Millisecond) + + // Update only the message, keep status the same + newMessage := "Updated message" + result, err := db.SetServerStatus(ctx, nil, serverJSON.Name, serverJSON.Version, model.StatusDeprecated, &newMessage) + require.NoError(t, err) + + assert.Equal(t, model.StatusDeprecated, result.Meta.Official.Status) + assert.Equal(t, "Updated message", *result.Meta.Official.StatusMessage) + // status_changed_at should NOT be updated since status didn't change + assert.True(t, result.Meta.Official.StatusChangedAt.Before(result.Meta.Official.UpdatedAt), "status_changed_at should be older than updated_at") + }) +} + func TestPostgreSQL_TransactionHandling(t *testing.T) { db := database.NewTestDB(t) ctx := context.Background() t.Run("successful transaction", func(t *testing.T) { + timeNow := time.Now() err := db.InTransaction(ctx, func(ctx context.Context, tx pgx.Tx) error { serverJSON := &apiv0.ServerJSON{ Name: "com.example/transaction-success", @@ -558,10 +639,11 @@ func TestPostgreSQL_TransactionHandling(t *testing.T) { Version: "1.0.0", } officialMeta := &apiv0.RegistryExtensions{ - Status: model.StatusActive, - PublishedAt: time.Now(), - UpdatedAt: time.Now(), - IsLatest: true, + Status: model.StatusActive, + StatusChangedAt: timeNow, + PublishedAt: timeNow, + UpdatedAt: timeNow, + IsLatest: true, } _, err := db.CreateServer(ctx, tx, serverJSON, officialMeta) @@ -571,12 +653,13 @@ func TestPostgreSQL_TransactionHandling(t *testing.T) { assert.NoError(t, err) // Verify server was created - result, err := db.GetServerByName(ctx, nil, "com.example/transaction-success") + result, err := db.GetServerByName(ctx, nil, "com.example/transaction-success", false) assert.NoError(t, err) assert.NotNil(t, result) }) t.Run("failed transaction rollback", func(t *testing.T) { + timeNow := time.Now() err := db.InTransaction(ctx, func(ctx context.Context, tx pgx.Tx) error { serverJSON := &apiv0.ServerJSON{ Name: "com.example/transaction-rollback", @@ -584,10 +667,11 @@ func TestPostgreSQL_TransactionHandling(t *testing.T) { Version: "1.0.0", } officialMeta := &apiv0.RegistryExtensions{ - Status: model.StatusActive, - PublishedAt: time.Now(), - UpdatedAt: time.Now(), - IsLatest: true, + Status: model.StatusActive, + StatusChangedAt: timeNow, + PublishedAt: timeNow, + UpdatedAt: timeNow, + IsLatest: true, } _, err := db.CreateServer(ctx, tx, serverJSON, officialMeta) @@ -603,7 +687,7 @@ func TestPostgreSQL_TransactionHandling(t *testing.T) { assert.Equal(t, assert.AnError, err) // Verify server was NOT created due to rollback - result, err := db.GetServerByName(ctx, nil, "com.example/transaction-rollback") + result, err := db.GetServerByName(ctx, nil, "com.example/transaction-rollback", false) assert.Error(t, err) assert.ErrorIs(t, err, database.ErrNotFound) assert.Nil(t, result) @@ -624,6 +708,7 @@ func TestPostgreSQL_ConcurrencyAndLocking(t *testing.T) { // Launch two concurrent publish operations for i := 0; i < 2; i++ { go func(version string) { + timeNow := time.Now() err := db.InTransaction(ctx, func(ctx context.Context, tx pgx.Tx) error { // Acquire lock if err := db.AcquirePublishLock(ctx, tx, serverName); err != nil { @@ -639,10 +724,11 @@ func TestPostgreSQL_ConcurrencyAndLocking(t *testing.T) { Version: version, } officialMeta := &apiv0.RegistryExtensions{ - Status: model.StatusActive, - PublishedAt: time.Now(), - UpdatedAt: time.Now(), - IsLatest: true, + Status: model.StatusActive, + StatusChangedAt: timeNow, + PublishedAt: timeNow, + UpdatedAt: timeNow, + IsLatest: true, } _, err := db.CreateServer(ctx, tx, serverJSON, officialMeta) @@ -681,6 +767,7 @@ func TestPostgreSQL_ConcurrencyAndLocking(t *testing.T) { func TestPostgreSQL_HelperMethods(t *testing.T) { db := database.NewTestDB(t) ctx := context.Background() + timeNow := time.Now() serverName := "com.example/helper-test-server" @@ -693,10 +780,11 @@ func TestPostgreSQL_HelperMethods(t *testing.T) { Version: version, } officialMeta := &apiv0.RegistryExtensions{ - Status: model.StatusActive, - PublishedAt: time.Now(), - UpdatedAt: time.Now(), - IsLatest: version == "2.0.0", + Status: model.StatusActive, + StatusChangedAt: timeNow, + PublishedAt: timeNow, + UpdatedAt: timeNow, + IsLatest: version == "2.0.0", } _, err := db.CreateServer(ctx, nil, serverJSON, officialMeta) @@ -733,7 +821,7 @@ func TestPostgreSQL_HelperMethods(t *testing.T) { }) t.Run("GetAllVersionsByServerName", func(t *testing.T) { - allVersions, err := db.GetAllVersionsByServerName(ctx, nil, serverName) + allVersions, err := db.GetAllVersionsByServerName(ctx, nil, serverName, false) assert.NoError(t, err) assert.Len(t, allVersions, 3) @@ -762,6 +850,7 @@ func TestPostgreSQL_HelperMethods(t *testing.T) { func TestPostgreSQL_EdgeCases(t *testing.T) { db := database.NewTestDB(t) ctx := context.Background() + timeNow := time.Now() t.Run("input validation", func(t *testing.T) { // Test nil inputs @@ -783,10 +872,11 @@ func TestPostgreSQL_EdgeCases(t *testing.T) { Version: "1.0.0", } officialMeta := &apiv0.RegistryExtensions{ - Status: model.StatusActive, - PublishedAt: time.Now(), - UpdatedAt: time.Now(), - IsLatest: true, + Status: model.StatusActive, + StatusChangedAt: timeNow, + PublishedAt: timeNow, + UpdatedAt: timeNow, + IsLatest: true, } _, err := db.CreateServer(ctx, nil, invalidServer, officialMeta) @@ -821,10 +911,11 @@ func TestPostgreSQL_EdgeCases(t *testing.T) { {Type: "streamable-http", URL: "https://complex.example.com/mcp"}, }, }, &apiv0.RegistryExtensions{ - Status: model.StatusActive, - PublishedAt: testTime, - UpdatedAt: testTime, - IsLatest: true, + Status: model.StatusActive, + StatusChangedAt: testTime, + PublishedAt: testTime, + UpdatedAt: testTime, + IsLatest: true, }) require.NoError(t, err) @@ -852,10 +943,11 @@ func TestPostgreSQL_EdgeCases(t *testing.T) { Description: "Status transition test", Version: version, }, &apiv0.RegistryExtensions{ - Status: model.StatusActive, - PublishedAt: time.Now(), - UpdatedAt: time.Now(), - IsLatest: true, + Status: model.StatusActive, + StatusChangedAt: timeNow, + PublishedAt: timeNow, + UpdatedAt: timeNow, + IsLatest: true, }) require.NoError(t, err) @@ -867,16 +959,118 @@ func TestPostgreSQL_EdgeCases(t *testing.T) { } for _, status := range statuses { - result, err := db.SetServerStatus(ctx, nil, serverName, version, status) + result, err := db.SetServerStatus(ctx, nil, serverName, version, model.Status(status), nil) assert.NoError(t, err, "Should allow transition to %s", status) assert.Equal(t, model.Status(status), result.Meta.Official.Status) } }) + + // Test status transitions with additional fields + t.Run("status transitions with message", func(t *testing.T) { + testServerName := "com.example/status-fields-test" + testVersion := "1.0.0" + + // Create a test server + _, err := db.CreateServer(ctx, nil, &apiv0.ServerJSON{ + Name: testServerName, + Description: "Status fields test", + Version: testVersion, + }, &apiv0.RegistryExtensions{ + Status: model.StatusActive, + StatusChangedAt: timeNow, + PublishedAt: timeNow, + UpdatedAt: timeNow, + IsLatest: true, + }) + require.NoError(t, err) + + statusMessage := "This server has been deprecated. Please use the new version." + + // Test setting status with message + result, err := db.SetServerStatus(ctx, nil, testServerName, testVersion, model.StatusDeprecated, &statusMessage) + assert.NoError(t, err) + assert.Equal(t, model.StatusDeprecated, result.Meta.Official.Status) + assert.NotNil(t, result.Meta.Official.StatusMessage) + assert.Equal(t, statusMessage, *result.Meta.Official.StatusMessage) + assert.NotZero(t, result.Meta.Official.StatusChangedAt) + + // Test clearing status message + result, err = db.SetServerStatus(ctx, nil, testServerName, testVersion, model.StatusActive, nil) + assert.NoError(t, err) + assert.Equal(t, model.StatusActive, result.Meta.Official.Status) + assert.Nil(t, result.Meta.Official.StatusMessage) + }) + + // Test comprehensive status transitions as per user requirements + t.Run("comprehensive status transitions", func(t *testing.T) { + testServerName := "com.example/comprehensive-transitions-test" + testVersion := "1.0.0" + + // Create a test server in active status + _, err := db.CreateServer(ctx, nil, &apiv0.ServerJSON{ + Name: testServerName, + Description: "Comprehensive transitions test", + Version: testVersion, + }, &apiv0.RegistryExtensions{ + Status: model.StatusActive, + StatusChangedAt: timeNow, + PublishedAt: timeNow, + UpdatedAt: timeNow, + IsLatest: true, + }) + require.NoError(t, err) + + // Define all valid transitions based on user requirements + transitionTests := []struct { + name string + fromStatus model.Status + toStatus model.Status + description string + }{ + // Active ↔ Deprecated + {"active to deprecated", model.StatusActive, model.StatusDeprecated, "Deprecating active server"}, + {"deprecated to active", model.StatusDeprecated, model.StatusActive, "Reactivating deprecated server"}, + + // Active ↔ Deleted + {"active to deleted", model.StatusActive, model.StatusDeleted, "Deleting active server"}, + {"deleted to active", model.StatusDeleted, model.StatusActive, "Restoring to active server"}, + + // Deprecated ↔ Deleted + {"deprecated to deleted", model.StatusDeprecated, model.StatusDeleted, "Deleting deprecated server"}, + {"deleted to deprecated", model.StatusDeleted, model.StatusDeprecated, "Moving deleted to deprecated"}, + } + + for _, tt := range transitionTests { + t.Run(tt.name, func(t *testing.T) { + // First ensure the server is in the expected starting status + if tt.fromStatus != model.StatusActive { + _, err := db.SetServerStatus(ctx, nil, testServerName, testVersion, tt.fromStatus, nil) + require.NoError(t, err, "failed to set initial status to %s", tt.fromStatus) + } + + // Verify the server is in the expected starting status + // Use includeDeleted=true since we test transitions involving deleted status + currentServer, err := db.GetServerByNameAndVersion(ctx, nil, testServerName, testVersion, true) + require.NoError(t, err) + assert.Equal(t, tt.fromStatus, currentServer.Meta.Official.Status, "server should be in %s status before transition", tt.fromStatus) + + // Perform the transition + result, err := db.SetServerStatus(ctx, nil, testServerName, testVersion, tt.toStatus, &tt.description) + assert.NoError(t, err, "should allow transition from %s to %s", tt.fromStatus, tt.toStatus) + assert.NotNil(t, result) + assert.Equal(t, tt.toStatus, result.Meta.Official.Status, "status should be %s after transition", tt.toStatus) + assert.NotNil(t, result.Meta.Official.StatusMessage) + assert.Equal(t, tt.description, *result.Meta.Official.StatusMessage) + assert.NotZero(t, result.Meta.Official.StatusChangedAt) + }) + } + }) } func TestPostgreSQL_PerformanceScenarios(t *testing.T) { db := database.NewTestDB(t) ctx := context.Background() + timeNow := time.Now() t.Run("many versions management", func(t *testing.T) { serverName := "com.example/many-versions-server" @@ -889,10 +1083,11 @@ func TestPostgreSQL_PerformanceScenarios(t *testing.T) { Description: fmt.Sprintf("Version %d", i), Version: fmt.Sprintf("1.0.%d", i), }, &apiv0.RegistryExtensions{ - Status: model.StatusActive, - PublishedAt: time.Now(), - UpdatedAt: time.Now(), - IsLatest: i == versionCount-1, // Only last one is latest + Status: model.StatusActive, + StatusChangedAt: timeNow, + PublishedAt: timeNow, + UpdatedAt: timeNow, + IsLatest: i == versionCount-1, // Only last one is latest }) require.NoError(t, err) } @@ -903,7 +1098,7 @@ func TestPostgreSQL_PerformanceScenarios(t *testing.T) { assert.Equal(t, versionCount, count) // Test getting all versions - allVersions, err := db.GetAllVersionsByServerName(ctx, nil, serverName) + allVersions, err := db.GetAllVersionsByServerName(ctx, nil, serverName, false) assert.NoError(t, err) assert.Len(t, allVersions, versionCount) @@ -926,10 +1121,11 @@ func TestPostgreSQL_PerformanceScenarios(t *testing.T) { Description: "Pagination test server", Version: "1.0.0", }, &apiv0.RegistryExtensions{ - Status: model.StatusActive, - PublishedAt: time.Now(), - UpdatedAt: time.Now(), - IsLatest: true, + Status: model.StatusActive, + StatusChangedAt: timeNow, + PublishedAt: timeNow, + UpdatedAt: timeNow, + IsLatest: true, }) require.NoError(t, err) } @@ -955,6 +1151,589 @@ func TestPostgreSQL_PerformanceScenarios(t *testing.T) { }) } +func TestPostgreSQL_NewStatusFields(t *testing.T) { + db := database.NewTestDB(t) + ctx := context.Background() + timeNow := time.Now() + + t.Run("status_changed_at field functionality", func(t *testing.T) { + serverJSON := &apiv0.ServerJSON{ + Name: "com.example/status-changed-at-test", + Description: "Test server for status_changed_at field", + Version: "1.0.0", + } + + // Create server with specific status_changed_at + officialMeta := &apiv0.RegistryExtensions{ + Status: model.StatusActive, + StatusChangedAt: timeNow, + PublishedAt: timeNow, + UpdatedAt: timeNow, + IsLatest: true, + } + + _, err := db.CreateServer(ctx, nil, serverJSON, officialMeta) + require.NoError(t, err) + + // Retrieve and verify status_changed_at + result, err := db.GetServerByNameAndVersion(ctx, nil, serverJSON.Name, serverJSON.Version, false) + require.NoError(t, err) + assert.NotNil(t, result.Meta.Official) + assert.Equal(t, timeNow.Unix(), result.Meta.Official.StatusChangedAt.Unix()) + }) + + t.Run("status_message field functionality", func(t *testing.T) { + serverJSON := &apiv0.ServerJSON{ + Name: "com.example/status-message-test", + Description: "Test server for status_message field", + Version: "1.0.0", + } + + statusMessage := "This server is deprecated due to security issues. Please migrate to v2.0.0" + officialMeta := &apiv0.RegistryExtensions{ + Status: model.StatusDeprecated, + StatusChangedAt: timeNow, + StatusMessage: &statusMessage, + PublishedAt: timeNow, + UpdatedAt: timeNow, + IsLatest: true, + } + + _, err := db.CreateServer(ctx, nil, serverJSON, officialMeta) + require.NoError(t, err) + + // Retrieve and verify status_message + result, err := db.GetServerByNameAndVersion(ctx, nil, serverJSON.Name, serverJSON.Version, false) + require.NoError(t, err) + assert.NotNil(t, result.Meta.Official) + assert.NotNil(t, result.Meta.Official.StatusMessage) + assert.Equal(t, statusMessage, *result.Meta.Official.StatusMessage) + }) + + t.Run("deleted status functionality", func(t *testing.T) { + serverJSON := &apiv0.ServerJSON{ + Name: "com.example/deleted-status-test", + Description: "Test server for deleted status", + Version: "1.0.0", + } + + statusMessage := "This version has critical security vulnerabilities and has been deleted" + + officialMeta := &apiv0.RegistryExtensions{ + Status: model.StatusDeleted, + StatusChangedAt: timeNow, + StatusMessage: &statusMessage, + PublishedAt: timeNow, + UpdatedAt: timeNow, + IsLatest: false, // Deleted versions should not be latest + } + + _, err := db.CreateServer(ctx, nil, serverJSON, officialMeta) + require.NoError(t, err) + + // Retrieve and verify deleted status with all fields (need includeDeleted=true) + result, err := db.GetServerByNameAndVersion(ctx, nil, serverJSON.Name, serverJSON.Version, true) + require.NoError(t, err) + assert.NotNil(t, result.Meta.Official) + assert.Equal(t, model.StatusDeleted, result.Meta.Official.Status) + assert.NotNil(t, result.Meta.Official.StatusMessage) + assert.Equal(t, statusMessage, *result.Meta.Official.StatusMessage) + assert.False(t, result.Meta.Official.IsLatest) + }) + + t.Run("nil status_message", func(t *testing.T) { + serverJSON := &apiv0.ServerJSON{ + Name: "com.example/nil-fields-test", + Description: "Test server for nil optional fields", + Version: "1.0.0", + } + + officialMeta := &apiv0.RegistryExtensions{ + Status: model.StatusActive, + StatusChangedAt: timeNow, + StatusMessage: nil, // Explicitly nil + PublishedAt: timeNow, + UpdatedAt: timeNow, + IsLatest: true, + } + + _, err := db.CreateServer(ctx, nil, serverJSON, officialMeta) + require.NoError(t, err) + + // Retrieve and verify nil fields are handled correctly + result, err := db.GetServerByNameAndVersion(ctx, nil, serverJSON.Name, serverJSON.Version, false) + require.NoError(t, err) + assert.NotNil(t, result.Meta.Official) + assert.Nil(t, result.Meta.Official.StatusMessage) + }) + + t.Run("status_changed_at constraint enforcement", func(t *testing.T) { + serverJSON := &apiv0.ServerJSON{ + Name: "com.example/constraint-test", + Description: "Test server for constraint validation", + Version: "1.0.0", + } + + // Try to create server with status_changed_at before published_at (should fail) + earlierTime := timeNow.Add(-1 * time.Hour) + officialMeta := &apiv0.RegistryExtensions{ + Status: model.StatusActive, + StatusChangedAt: earlierTime, // Before published_at + PublishedAt: timeNow, + UpdatedAt: timeNow, + IsLatest: true, + } + + _, err := db.CreateServer(ctx, nil, serverJSON, officialMeta) + assert.Error(t, err) + assert.Contains(t, err.Error(), "check_status_changed_at_after_published") + }) + + t.Run("all status transitions work", func(t *testing.T) { + // Test that we can create servers with all valid status values + statuses := []model.Status{ + model.StatusActive, + model.StatusDeprecated, + model.StatusDeleted, + } + + for i, status := range statuses { + serverJSON := &apiv0.ServerJSON{ + Name: fmt.Sprintf("com.example/status-test-%d", i), + Description: fmt.Sprintf("Test server for status %s", status), + Version: "1.0.0", + } + + officialMeta := &apiv0.RegistryExtensions{ + Status: status, + StatusChangedAt: timeNow, + PublishedAt: timeNow, + UpdatedAt: timeNow, + IsLatest: true, + } + + _, err := db.CreateServer(ctx, nil, serverJSON, officialMeta) + assert.NoError(t, err, "Should be able to create server with status: %s", status) + + // Verify the status was set correctly (use includeDeleted=true since we test all statuses including deleted) + result, err := db.GetServerByNameAndVersion(ctx, nil, serverJSON.Name, serverJSON.Version, true) + require.NoError(t, err) + assert.Equal(t, status, result.Meta.Official.Status) + } + }) +} + +func TestPostgreSQL_StatusFieldsInListOperations(t *testing.T) { + db := database.NewTestDB(t) + ctx := context.Background() + timeNow := time.Now() + + // Create test servers with different statuses and status fields + testServers := []struct { + name string + status model.Status + statusMessage *string + }{ + { + name: "com.example/active-server", + status: model.StatusActive, + statusMessage: nil, + }, + { + name: "com.example/deprecated-server", + status: model.StatusDeprecated, + statusMessage: stringPtr("Deprecated in favor of v2"), + }, + { + name: "com.example/deleted-server", + status: model.StatusDeleted, + statusMessage: stringPtr("Security vulnerability found"), + }, + } + + // Create all test servers + for _, server := range testServers { + serverJSON := &apiv0.ServerJSON{ + Name: server.name, + Description: "Test server for list operations", + Version: "1.0.0", + } + + officialMeta := &apiv0.RegistryExtensions{ + Status: server.status, + StatusChangedAt: timeNow, + StatusMessage: server.statusMessage, + PublishedAt: timeNow, + UpdatedAt: timeNow, + IsLatest: true, + } + + _, err := db.CreateServer(ctx, nil, serverJSON, officialMeta) + require.NoError(t, err) + } + + t.Run("ListServers includes new status fields", func(t *testing.T) { + results, _, err := db.ListServers(ctx, nil, nil, "", 10) + require.NoError(t, err) + + // Find our test servers in the results + foundServers := make(map[string]*apiv0.ServerResponse) + for _, result := range results { + for _, testServer := range testServers { + if result.Server.Name == testServer.name { + foundServers[testServer.name] = result + } + } + } + + // Verify all test servers were found with correct status fields + for _, testServer := range testServers { + result, found := foundServers[testServer.name] + assert.True(t, found, "Server %s should be found in list results", testServer.name) + if !found { + continue + } + + assert.NotNil(t, result.Meta.Official) + assert.Equal(t, testServer.status, result.Meta.Official.Status) + assert.Equal(t, timeNow.Unix(), result.Meta.Official.StatusChangedAt.Unix()) + + if testServer.statusMessage != nil { + assert.NotNil(t, result.Meta.Official.StatusMessage) + assert.Equal(t, *testServer.statusMessage, *result.Meta.Official.StatusMessage) + } else { + assert.Nil(t, result.Meta.Official.StatusMessage) + } + } + }) + + t.Run("GetServerByName includes new status fields", func(t *testing.T) { + for _, testServer := range testServers { + // Use includeDeleted=true since testServers includes deleted status + result, err := db.GetServerByName(ctx, nil, testServer.name, true) + require.NoError(t, err) + + assert.NotNil(t, result.Meta.Official) + assert.Equal(t, testServer.status, result.Meta.Official.Status) + assert.Equal(t, timeNow.Unix(), result.Meta.Official.StatusChangedAt.Unix()) + + if testServer.statusMessage != nil { + assert.NotNil(t, result.Meta.Official.StatusMessage) + assert.Equal(t, *testServer.statusMessage, *result.Meta.Official.StatusMessage) + } else { + assert.Nil(t, result.Meta.Official.StatusMessage) + } + } + }) +} + +func TestPostgreSQL_SetAllVersionsStatus(t *testing.T) { + db := database.NewTestDB(t) + ctx := context.Background() + timeNow := time.Now() + + t.Run("update all versions status successfully", func(t *testing.T) { + serverName := "com.example/all-versions-status-test" + versions := []string{"1.0.0", "1.1.0", "2.0.0"} + + // Create multiple versions + for i, version := range versions { + serverJSON := &apiv0.ServerJSON{ + Name: serverName, + Description: "Test server for all-versions status update", + Version: version, + } + officialMeta := &apiv0.RegistryExtensions{ + Status: model.StatusActive, + StatusChangedAt: timeNow, + PublishedAt: timeNow, + UpdatedAt: timeNow, + IsLatest: i == len(versions)-1, + } + + _, err := db.CreateServer(ctx, nil, serverJSON, officialMeta) + require.NoError(t, err) + } + + // Update all versions to deprecated + statusMessage := "All versions deprecated" + + results, err := db.SetAllVersionsStatus(ctx, nil, serverName, model.StatusDeprecated, &statusMessage) + assert.NoError(t, err) + assert.Len(t, results, 3) + + // Verify all versions were updated + for _, result := range results { + assert.Equal(t, model.StatusDeprecated, result.Meta.Official.Status) + assert.NotNil(t, result.Meta.Official.StatusMessage) + assert.Equal(t, statusMessage, *result.Meta.Official.StatusMessage) + } + + // Verify by fetching each version individually + for _, version := range versions { + server, err := db.GetServerByNameAndVersion(ctx, nil, serverName, version, false) + require.NoError(t, err) + assert.Equal(t, model.StatusDeprecated, server.Meta.Official.Status) + assert.NotNil(t, server.Meta.Official.StatusMessage) + assert.Equal(t, statusMessage, *server.Meta.Official.StatusMessage) + } + }) + + t.Run("update non-existent server returns error", func(t *testing.T) { + results, err := db.SetAllVersionsStatus(ctx, nil, "com.example/non-existent-server", model.StatusDeprecated, nil) + assert.Error(t, err) + assert.ErrorIs(t, err, database.ErrNotFound) + assert.Nil(t, results) + }) + + t.Run("update all versions to deleted", func(t *testing.T) { + serverName := "com.example/all-versions-deleted-test" + + // Create multiple versions + for i, version := range []string{"1.0.0", "1.1.0"} { + serverJSON := &apiv0.ServerJSON{ + Name: serverName, + Description: "Test server for deleting", + Version: version, + } + officialMeta := &apiv0.RegistryExtensions{ + Status: model.StatusActive, + StatusChangedAt: timeNow, + PublishedAt: timeNow, + UpdatedAt: timeNow, + IsLatest: i == 1, + } + + _, err := db.CreateServer(ctx, nil, serverJSON, officialMeta) + require.NoError(t, err) + } + + // Delete all versions + statusMessage := "Critical security vulnerability" + results, err := db.SetAllVersionsStatus(ctx, nil, serverName, model.StatusDeleted, &statusMessage) + assert.NoError(t, err) + assert.Len(t, results, 2) + + // Verify all versions are deleted + for _, result := range results { + assert.Equal(t, model.StatusDeleted, result.Meta.Official.Status) + assert.NotNil(t, result.Meta.Official.StatusMessage) + assert.Equal(t, statusMessage, *result.Meta.Official.StatusMessage) + } + }) + + t.Run("transition from deleted back to active", func(t *testing.T) { + serverName := "com.example/all-versions-reactivate-test" + + // Create server in deleted state + for i, version := range []string{"1.0.0", "2.0.0"} { + serverJSON := &apiv0.ServerJSON{ + Name: serverName, + Description: "Test server for reactivation", + Version: version, + } + officialMeta := &apiv0.RegistryExtensions{ + Status: model.StatusDeleted, + StatusChangedAt: timeNow, + PublishedAt: timeNow, + UpdatedAt: timeNow, + IsLatest: i == 1, + } + + _, err := db.CreateServer(ctx, nil, serverJSON, officialMeta) + require.NoError(t, err) + } + + // Reactivate all versions + results, err := db.SetAllVersionsStatus(ctx, nil, serverName, model.StatusActive, nil) + assert.NoError(t, err) + assert.Len(t, results, 2) + + // Verify all versions are active and metadata is cleared + for _, result := range results { + assert.Equal(t, model.StatusActive, result.Meta.Official.Status) + assert.Nil(t, result.Meta.Official.StatusMessage) + } + }) +} + +func TestPostgreSQL_IncludeDeletedFilter(t *testing.T) { + db := database.NewTestDB(t) + ctx := context.Background() + timeNow := time.Now() + + // Create test servers with different statuses + testServers := []struct { + name string + version string + status model.Status + }{ + { + name: "com.example/deleted-filter-active", + version: "1.0.0", + status: model.StatusActive, + }, + { + name: "com.example/deleted-filter-deprecated", + version: "1.0.0", + status: model.StatusDeprecated, + }, + { + name: "com.example/deleted-filter-deleted", + version: "1.0.0", + status: model.StatusDeleted, + }, + } + + // Create all test servers + for _, server := range testServers { + serverJSON := &apiv0.ServerJSON{ + Name: server.name, + Description: "Test server for include deleted filter", + Version: server.version, + } + officialMeta := &apiv0.RegistryExtensions{ + Status: server.status, + StatusChangedAt: timeNow, + PublishedAt: timeNow, + UpdatedAt: timeNow, + IsLatest: true, + } + + _, err := db.CreateServer(ctx, nil, serverJSON, officialMeta) + require.NoError(t, err) + } + + t.Run("excludes deleted by default (nil IncludeDeleted)", func(t *testing.T) { + filter := &database.ServerFilter{ + SubstringName: stringPtr("deleted-filter"), + } + + results, _, err := db.ListServers(ctx, nil, filter, "", 10) + require.NoError(t, err) + + // Should only get active and deprecated servers + assert.Len(t, results, 2) + + for _, result := range results { + assert.NotEqual(t, model.StatusDeleted, result.Meta.Official.Status, + "Deleted servers should be excluded by default") + } + + // Verify we got the expected servers + names := make([]string, len(results)) + for i, r := range results { + names[i] = r.Server.Name + } + assert.Contains(t, names, "com.example/deleted-filter-active") + assert.Contains(t, names, "com.example/deleted-filter-deprecated") + }) + + t.Run("excludes deleted when IncludeDeleted is false", func(t *testing.T) { + filter := &database.ServerFilter{ + SubstringName: stringPtr("deleted-filter"), + IncludeDeleted: boolPtr(false), + } + + results, _, err := db.ListServers(ctx, nil, filter, "", 10) + require.NoError(t, err) + + // Should only get active and deprecated servers + assert.Len(t, results, 2) + + for _, result := range results { + assert.NotEqual(t, model.StatusDeleted, result.Meta.Official.Status, + "Deleted servers should be excluded when IncludeDeleted is false") + } + }) + + t.Run("includes deleted when IncludeDeleted is true", func(t *testing.T) { + filter := &database.ServerFilter{ + SubstringName: stringPtr("deleted-filter"), + IncludeDeleted: boolPtr(true), + } + + results, _, err := db.ListServers(ctx, nil, filter, "", 10) + require.NoError(t, err) + + // Should get all servers including deleted + assert.Len(t, results, 3) + + // Verify we got all statuses + statuses := make(map[model.Status]bool) + for _, result := range results { + statuses[result.Meta.Official.Status] = true + } + + assert.True(t, statuses[model.StatusActive], "Should include active servers") + assert.True(t, statuses[model.StatusDeprecated], "Should include deprecated servers") + assert.True(t, statuses[model.StatusDeleted], "Should include deleted servers") + }) + + t.Run("combined filters with include deleted", func(t *testing.T) { + // Test that IncludeDeleted works correctly with other filters + filter := &database.ServerFilter{ + SubstringName: stringPtr("deleted-filter"), + Version: stringPtr("1.0.0"), + IsLatest: boolPtr(true), + IncludeDeleted: boolPtr(true), + } + + results, _, err := db.ListServers(ctx, nil, filter, "", 10) + require.NoError(t, err) + + // Should get all 3 servers (all match version and isLatest criteria) + assert.Len(t, results, 3) + }) + + t.Run("multiple versions with deleted filtering", func(t *testing.T) { + serverName := "com.example/multi-version-deleted-test" + + // Create server with multiple versions, one deleted + versionsData := []struct { + version string + status model.Status + }{ + {"1.0.0", model.StatusDeleted}, // Old version, deleted + {"1.1.0", model.StatusActive}, // Current stable + {"2.0.0", model.StatusActive}, // Latest + } + + for i, v := range versionsData { + serverJSON := &apiv0.ServerJSON{ + Name: serverName, + Description: "Multi-version server", + Version: v.version, + } + officialMeta := &apiv0.RegistryExtensions{ + Status: v.status, + StatusChangedAt: timeNow, + PublishedAt: timeNow, + UpdatedAt: timeNow, + IsLatest: i == len(versionsData)-1, + } + + _, err := db.CreateServer(ctx, nil, serverJSON, officialMeta) + require.NoError(t, err) + } + + // Without IncludeDeleted - should get only active versions + filter := &database.ServerFilter{ + Name: stringPtr(serverName), + IncludeDeleted: boolPtr(false), + } + results, _, err := db.ListServers(ctx, nil, filter, "", 10) + require.NoError(t, err) + assert.Len(t, results, 2, "Should only get non-deleted versions") + + // With IncludeDeleted - should get all versions + filter.IncludeDeleted = boolPtr(true) + results, _, err = db.ListServers(ctx, nil, filter, "", 10) + require.NoError(t, err) + assert.Len(t, results, 3, "Should get all versions including deleted") + }) +} + // Helper functions for creating pointers to basic types func stringPtr(s string) *string { return &s diff --git a/internal/service/registry_service.go b/internal/service/registry_service.go index 3b41cde..05c4f16 100644 --- a/internal/service/registry_service.go +++ b/internal/service/registry_service.go @@ -7,6 +7,7 @@ import ( "time" "github.com/jackc/pgx/v5" + "github.com/modelcontextprotocol/registry/internal/config" "github.com/modelcontextprotocol/registry/internal/database" "github.com/modelcontextprotocol/registry/internal/validators" @@ -47,8 +48,8 @@ func (s *registryServiceImpl) ListServers(ctx context.Context, filter *database. } // GetServerByName retrieves the latest version of a server by its server name -func (s *registryServiceImpl) GetServerByName(ctx context.Context, serverName string) (*apiv0.ServerResponse, error) { - serverRecord, err := s.db.GetServerByName(ctx, nil, serverName) +func (s *registryServiceImpl) GetServerByName(ctx context.Context, serverName string, includeDeleted bool) (*apiv0.ServerResponse, error) { + serverRecord, err := s.db.GetServerByName(ctx, nil, serverName, includeDeleted) if err != nil { return nil, err } @@ -57,8 +58,8 @@ func (s *registryServiceImpl) GetServerByName(ctx context.Context, serverName st } // GetServerByNameAndVersion retrieves a specific version of a server by server name and version -func (s *registryServiceImpl) GetServerByNameAndVersion(ctx context.Context, serverName string, version string) (*apiv0.ServerResponse, error) { - serverRecord, err := s.db.GetServerByNameAndVersion(ctx, nil, serverName, version) +func (s *registryServiceImpl) GetServerByNameAndVersion(ctx context.Context, serverName string, version string, includeDeleted bool) (*apiv0.ServerResponse, error) { + serverRecord, err := s.db.GetServerByNameAndVersion(ctx, nil, serverName, version, includeDeleted) if err != nil { return nil, err } @@ -67,8 +68,8 @@ func (s *registryServiceImpl) GetServerByNameAndVersion(ctx context.Context, ser } // GetAllVersionsByServerName retrieves all versions of a server by server name -func (s *registryServiceImpl) GetAllVersionsByServerName(ctx context.Context, serverName string) ([]*apiv0.ServerResponse, error) { - serverRecords, err := s.db.GetAllVersionsByServerName(ctx, nil, serverName) +func (s *registryServiceImpl) GetAllVersionsByServerName(ctx context.Context, serverName string, includeDeleted bool) ([]*apiv0.ServerResponse, error) { + serverRecords, err := s.db.GetAllVersionsByServerName(ctx, nil, serverName, includeDeleted) if err != nil { return nil, err } @@ -152,10 +153,11 @@ func (s *registryServiceImpl) createServerInTransaction(ctx context.Context, tx // Create metadata for the new server officialMeta := &apiv0.RegistryExtensions{ - Status: model.StatusActive, /* New versions are active by default */ - PublishedAt: publishTime, - UpdatedAt: publishTime, - IsLatest: isNewLatest, + Status: model.StatusActive, /* New versions are active by default */ + StatusChangedAt: publishTime, + PublishedAt: publishTime, + UpdatedAt: publishTime, + IsLatest: isNewLatest, } // Insert new server version @@ -186,17 +188,18 @@ func (s *registryServiceImpl) validateNoDuplicateRemoteURLs(ctx context.Context, } // UpdateServer updates an existing server with new details -func (s *registryServiceImpl) UpdateServer(ctx context.Context, serverName, version string, req *apiv0.ServerJSON, newStatus *string) (*apiv0.ServerResponse, error) { +func (s *registryServiceImpl) UpdateServer(ctx context.Context, serverName, version string, req *apiv0.ServerJSON, statusChange *StatusChangeRequest) (*apiv0.ServerResponse, error) { // Wrap the entire operation in a transaction return database.InTransactionT(ctx, s.db, func(ctx context.Context, tx pgx.Tx) (*apiv0.ServerResponse, error) { - return s.updateServerInTransaction(ctx, tx, serverName, version, req, newStatus) + return s.updateServerInTransaction(ctx, tx, serverName, version, req, statusChange) }) } // updateServerInTransaction contains the actual UpdateServer logic within a transaction -func (s *registryServiceImpl) updateServerInTransaction(ctx context.Context, tx pgx.Tx, serverName, version string, req *apiv0.ServerJSON, newStatus *string) (*apiv0.ServerResponse, error) { +func (s *registryServiceImpl) updateServerInTransaction(ctx context.Context, tx pgx.Tx, serverName, version string, req *apiv0.ServerJSON, statusChange *StatusChangeRequest) (*apiv0.ServerResponse, error) { // Get current server to check if it's deleted or being deleted - currentServer, err := s.db.GetServerByNameAndVersion(ctx, tx, serverName, version) + // Include deleted servers since we may need to update or restore them + currentServer, err := s.db.GetServerByNameAndVersion(ctx, tx, serverName, version, true) if err != nil { return nil, err } @@ -205,7 +208,7 @@ func (s *registryServiceImpl) updateServerInTransaction(ctx context.Context, tx // 1. Server is currently deleted, OR // 2. Server is being set to deleted status currentlyDeleted := currentServer.Meta.Official != nil && currentServer.Meta.Official.Status == model.StatusDeleted - beingDeleted := newStatus != nil && *newStatus == string(model.StatusDeleted) + beingDeleted := statusChange != nil && statusChange.NewStatus == model.StatusDeleted skipRegistryValidation := currentlyDeleted || beingDeleted // Validate the request, potentially skipping registry validation for deleted servers @@ -233,8 +236,8 @@ func (s *registryServiceImpl) updateServerInTransaction(ctx context.Context, tx } // Handle status change if provided - if newStatus != nil { - updatedWithStatus, err := s.db.SetServerStatus(ctx, tx, serverName, version, *newStatus) + if statusChange != nil { + updatedWithStatus, err := s.db.SetServerStatus(ctx, tx, serverName, version, statusChange.NewStatus, statusChange.StatusMessage) if err != nil { return nil, err } @@ -243,3 +246,78 @@ func (s *registryServiceImpl) updateServerInTransaction(ctx context.Context, tx return updatedServerResponse, nil } + +// UpdateServerStatus updates only the status metadata of a server version +func (s *registryServiceImpl) UpdateServerStatus(ctx context.Context, serverName, version string, statusChange *StatusChangeRequest) (*apiv0.ServerResponse, error) { + // Wrap the entire operation in a transaction + return database.InTransactionT(ctx, s.db, func(ctx context.Context, tx pgx.Tx) (*apiv0.ServerResponse, error) { + return s.updateServerStatusInTransaction(ctx, tx, serverName, version, statusChange) + }) +} + +// updateServerStatusInTransaction contains the actual UpdateServerStatus logic within a transaction +func (s *registryServiceImpl) updateServerStatusInTransaction(ctx context.Context, tx pgx.Tx, serverName, version string, statusChange *StatusChangeRequest) (*apiv0.ServerResponse, error) { + // Get current server to verify it exists and check current status + // Include deleted servers since we may need to restore them + currentServer, err := s.db.GetServerByNameAndVersion(ctx, tx, serverName, version, true) + if err != nil { + return nil, err + } + + // Acquire advisory lock to prevent concurrent edits of servers with same name + if err := s.db.AcquirePublishLock(ctx, tx, serverName); err != nil { + return nil, err + } + + // When transitioning to active from deleted, validate remote URLs don't conflict + if statusChange.NewStatus == model.StatusActive && + currentServer.Meta.Official != nil && + currentServer.Meta.Official.Status == model.StatusDeleted { + if err := s.validateNoDuplicateRemoteURLs(ctx, tx, currentServer.Server); err != nil { + return nil, err + } + } + + // Update only the status metadata + return s.db.SetServerStatus(ctx, tx, serverName, version, statusChange.NewStatus, statusChange.StatusMessage) +} + +// UpdateAllVersionsStatus updates the status metadata of all versions of a server in a single transaction +func (s *registryServiceImpl) UpdateAllVersionsStatus(ctx context.Context, serverName string, statusChange *StatusChangeRequest) ([]*apiv0.ServerResponse, error) { + // Wrap the entire operation in a transaction + return database.InTransactionT(ctx, s.db, func(ctx context.Context, tx pgx.Tx) ([]*apiv0.ServerResponse, error) { + return s.updateAllVersionsStatusInTransaction(ctx, tx, serverName, statusChange) + }) +} + +// updateAllVersionsStatusInTransaction contains the actual UpdateAllVersionsStatus logic within a transaction +func (s *registryServiceImpl) updateAllVersionsStatusInTransaction(ctx context.Context, tx pgx.Tx, serverName string, statusChange *StatusChangeRequest) ([]*apiv0.ServerResponse, error) { + // Acquire advisory lock to prevent concurrent edits of servers with same name + if err := s.db.AcquirePublishLock(ctx, tx, serverName); err != nil { + return nil, err + } + + // When transitioning to active, validate remote URLs for any versions currently deleted + if statusChange.NewStatus == model.StatusActive { + includeDeleted := true + + // When transitioning to active, it means the current status is either deprecated or deleted, so it should include deleted server also + filter := &database.ServerFilter{Name: &serverName, IncludeDeleted: &includeDeleted} + versions, _, err := s.db.ListServers(ctx, tx, filter, "", 1000) + if err != nil { + return nil, fmt.Errorf("failed to list server versions: %w", err) + } + + for _, version := range versions { + if version.Meta.Official != nil && + version.Meta.Official.Status == model.StatusDeleted { + if err := s.validateNoDuplicateRemoteURLs(ctx, tx, version.Server); err != nil { + return nil, err + } + } + } + } + + // Update all versions' status in a single database call + return s.db.SetAllVersionsStatus(ctx, tx, serverName, statusChange.NewStatus, statusChange.StatusMessage) +} diff --git a/internal/service/registry_service_test.go b/internal/service/registry_service_test.go index b091e1e..63b6521 100644 --- a/internal/service/registry_service_test.go +++ b/internal/service/registry_service_test.go @@ -8,12 +8,13 @@ import ( "testing" "time" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" + "github.com/modelcontextprotocol/registry/internal/config" "github.com/modelcontextprotocol/registry/internal/database" apiv0 "github.com/modelcontextprotocol/registry/pkg/api/v0" "github.com/modelcontextprotocol/registry/pkg/model" - "github.com/stretchr/testify/assert" - "github.com/stretchr/testify/require" ) func TestValidateNoDuplicateRemoteURLs(t *testing.T) { @@ -177,7 +178,7 @@ func TestGetServerByName(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { - result, err := service.GetServerByName(ctx, tt.serverName) + result, err := service.GetServerByName(ctx, tt.serverName, false) if tt.expectError { assert.Error(t, err) @@ -270,7 +271,7 @@ func TestGetServerByNameAndVersion(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { - result, err := service.GetServerByNameAndVersion(ctx, tt.serverName, tt.version) + result, err := service.GetServerByNameAndVersion(ctx, tt.serverName, tt.version, false) if tt.expectError { assert.Error(t, err) @@ -366,7 +367,7 @@ func TestGetAllVersionsByServerName(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { - result, err := service.GetAllVersionsByServerName(ctx, tt.serverName) + result, err := service.GetAllVersionsByServerName(ctx, tt.serverName, false) if tt.expectError { assert.Error(t, err) @@ -425,7 +426,7 @@ func TestCreateServerConcurrentVersionsNoRace(t *testing.T) { } // Query database to check the final state after all creates complete - allVersions, err := service.GetAllVersionsByServerName(ctx, serverName) + allVersions, err := service.GetAllVersionsByServerName(ctx, serverName, false) require.NoError(t, err, "failed to get all versions") latestCount := 0 @@ -466,7 +467,7 @@ func TestUpdateServer(t *testing.T) { serverName string version string updatedServer *apiv0.ServerJSON - newStatus *string + statusChange *StatusChangeRequest expectError bool errorMsg string checkResult func(*testing.T, *apiv0.ServerResponse) @@ -503,7 +504,9 @@ func TestUpdateServer(t *testing.T) { Description: "Updated with status change", Version: version, }, - newStatus: stringPtr(string(model.StatusDeprecated)), + statusChange: &StatusChangeRequest{ + NewStatus: model.StatusDeprecated, + }, expectError: false, checkResult: func(t *testing.T, result *apiv0.ServerResponse) { t.Helper() @@ -528,7 +531,7 @@ func TestUpdateServer(t *testing.T) { for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { - result, err := service.UpdateServer(ctx, tt.serverName, tt.version, tt.updatedServer, tt.newStatus) + result, err := service.UpdateServer(ctx, tt.serverName, tt.version, tt.updatedServer, tt.statusChange) if tt.expectError { assert.Error(t, err) @@ -580,12 +583,14 @@ func TestUpdateServer_SkipValidationForDeletedServers(t *testing.T) { service.(*registryServiceImpl).cfg.EnableRegistryValidation = originalConfig // First, set server to deleted status - deletedStatus := string(model.StatusDeleted) - _, err = service.UpdateServer(ctx, serverName, version, invalidServer, &deletedStatus) + deletedStatusChange := &StatusChangeRequest{ + NewStatus: model.StatusDeleted, + } + _, err = service.UpdateServer(ctx, serverName, version, invalidServer, deletedStatusChange) require.NoError(t, err, "should be able to set server to deleted (validation should be skipped)") - // Verify server is now deleted - updatedServer, err := service.GetServerByNameAndVersion(ctx, serverName, version) + // Verify server is now deleted (need includeDeleted=true to find it) + updatedServer, err := service.GetServerByNameAndVersion(ctx, serverName, version, true) require.NoError(t, err) assert.Equal(t, model.StatusDeleted, updatedServer.Meta.Official.Status) @@ -635,8 +640,10 @@ func TestUpdateServer_SkipValidationForDeletedServers(t *testing.T) { service.(*registryServiceImpl).cfg.EnableRegistryValidation = originalConfig // Update server and set to deleted in same operation - should skip validation - newDeletedStatus := string(model.StatusDeleted) - result2, err := service.UpdateServer(ctx, "com.example/being-deleted-test", "1.0.0", activeServer, &newDeletedStatus) + newDeletedStatusChange := &StatusChangeRequest{ + NewStatus: model.StatusDeleted, + } + result2, err := service.UpdateServer(ctx, "com.example/being-deleted-test", "1.0.0", activeServer, newDeletedStatusChange) assert.NoError(t, err, "updating server being set to deleted should skip registry validation") assert.NotNil(t, result2) assert.Equal(t, model.StatusDeleted, result2.Meta.Official.Status) @@ -767,14 +774,14 @@ func TestVersionComparison(t *testing.T) { } // Get the latest version - should be 2.1.0 based on semantic versioning - latest, err := service.GetServerByName(ctx, serverName) + latest, err := service.GetServerByName(ctx, serverName, false) require.NoError(t, err) assert.Equal(t, "2.1.0", latest.Server.Version, "Latest version should be 2.1.0") assert.True(t, latest.Meta.Official.IsLatest) // Verify only one version is marked as latest - allVersions, err := service.GetAllVersionsByServerName(ctx, serverName) + allVersions, err := service.GetAllVersionsByServerName(ctx, serverName, false) require.NoError(t, err) latestCount := 0 @@ -786,6 +793,195 @@ func TestVersionComparison(t *testing.T) { assert.Equal(t, 1, latestCount, "Exactly one version should be marked as latest") } +func TestUpdateServerStatus_ValidateRemoteURLsOnRestoreToActive(t *testing.T) { + ctx := context.Background() + testDB := database.NewTestDB(t) + service := NewRegistryService(testDB, &config.Config{EnableRegistryValidation: false}) + + remoteURL := "https://api.example.com/mcp" + + // Create Server A with a remote URL + serverA := &apiv0.ServerJSON{ + Schema: model.CurrentSchemaURL, + Name: "com.example/server-a", + Description: "Server A with remote URL", + Version: "1.0.0", + Remotes: []model.Transport{ + {Type: "streamable-http", URL: remoteURL}, + }, + } + _, err := service.CreateServer(ctx, serverA) + require.NoError(t, err) + + // Delete Server A + _, err = service.UpdateServerStatus(ctx, "com.example/server-a", "1.0.0", &StatusChangeRequest{ + NewStatus: model.StatusDeleted, + }) + require.NoError(t, err) + + // Create Server B with the same remote URL (should succeed since A is deleted) + serverB := &apiv0.ServerJSON{ + Schema: model.CurrentSchemaURL, + Name: "com.example/server-b", + Description: "Server B with same remote URL", + Version: "1.0.0", + Remotes: []model.Transport{ + {Type: "streamable-http", URL: remoteURL}, + }, + } + _, err = service.CreateServer(ctx, serverB) + require.NoError(t, err) + + // Try to restore Server A to active - should fail due to URL conflict + _, err = service.UpdateServerStatus(ctx, "com.example/server-a", "1.0.0", &StatusChangeRequest{ + NewStatus: model.StatusActive, + }) + assert.Error(t, err) + assert.Contains(t, err.Error(), "remote URL") + assert.Contains(t, err.Error(), "already used by server") +} + +func TestUpdateServerStatus_ValidateRemoteURLsOnRestoreFromDeleted(t *testing.T) { + ctx := context.Background() + testDB := database.NewTestDB(t) + service := NewRegistryService(testDB, &config.Config{EnableRegistryValidation: false}) + + remoteURL := "https://api.deleted.com/mcp" + + // Create Server A with a remote URL and delete it + serverA := &apiv0.ServerJSON{ + Schema: model.CurrentSchemaURL, + Name: "com.example/deleted-server", + Description: "Server to be deleted", + Version: "1.0.0", + Remotes: []model.Transport{ + {Type: "streamable-http", URL: remoteURL}, + }, + } + _, err := service.CreateServer(ctx, serverA) + require.NoError(t, err) + + // Delete Server A + _, err = service.UpdateServerStatus(ctx, "com.example/deleted-server", "1.0.0", &StatusChangeRequest{ + NewStatus: model.StatusDeleted, + }) + require.NoError(t, err) + + // Create Server B with the same remote URL (should succeed since A is deleted) + serverB := &apiv0.ServerJSON{ + Schema: model.CurrentSchemaURL, + Name: "com.example/new-server", + Description: "New server with same remote URL", + Version: "1.0.0", + Remotes: []model.Transport{ + {Type: "streamable-http", URL: remoteURL}, + }, + } + _, err = service.CreateServer(ctx, serverB) + require.NoError(t, err) + + // Try to restore deleted server to active - should fail due to URL conflict + _, err = service.UpdateServerStatus(ctx, "com.example/deleted-server", "1.0.0", &StatusChangeRequest{ + NewStatus: model.StatusActive, + }) + assert.Error(t, err) + assert.Contains(t, err.Error(), "remote URL") + assert.Contains(t, err.Error(), "already used by server") +} + +func TestUpdateAllVersionsStatus_ValidateRemoteURLsOnRestoreToActive(t *testing.T) { + ctx := context.Background() + testDB := database.NewTestDB(t) + service := NewRegistryService(testDB, &config.Config{EnableRegistryValidation: false}) + + remoteURL := "https://api.allversions.com/mcp" + + // Create Server A with multiple versions + serverAv1 := &apiv0.ServerJSON{ + Schema: model.CurrentSchemaURL, + Name: "com.example/multi-version-server", + Description: "Server A version 1", + Version: "1.0.0", + Remotes: []model.Transport{ + {Type: "streamable-http", URL: remoteURL}, + }, + } + _, err := service.CreateServer(ctx, serverAv1) + require.NoError(t, err) + + serverAv2 := &apiv0.ServerJSON{ + Schema: model.CurrentSchemaURL, + Name: "com.example/multi-version-server", + Description: "Server A version 2", + Version: "2.0.0", + Remotes: []model.Transport{ + {Type: "streamable-http", URL: remoteURL}, + }, + } + _, err = service.CreateServer(ctx, serverAv2) + require.NoError(t, err) + + // Delete all versions of Server A + _, err = service.UpdateAllVersionsStatus(ctx, "com.example/multi-version-server", &StatusChangeRequest{ + NewStatus: model.StatusDeleted, + }) + require.NoError(t, err) + + // Create Server B with the same remote URL + serverB := &apiv0.ServerJSON{ + Schema: model.CurrentSchemaURL, + Name: "com.example/conflicting-server", + Description: "Server B with same remote URL", + Version: "1.0.0", + Remotes: []model.Transport{ + {Type: "streamable-http", URL: remoteURL}, + }, + } + _, err = service.CreateServer(ctx, serverB) + require.NoError(t, err) + + // Try to restore all versions of Server A to active - should fail + _, err = service.UpdateAllVersionsStatus(ctx, "com.example/multi-version-server", &StatusChangeRequest{ + NewStatus: model.StatusActive, + }) + assert.Error(t, err) + assert.Contains(t, err.Error(), "remote URL") + assert.Contains(t, err.Error(), "already used by server") +} + +func TestUpdateServerStatus_NoConflictWhenRestoringWithUniqueURLs(t *testing.T) { + ctx := context.Background() + testDB := database.NewTestDB(t) + service := NewRegistryService(testDB, &config.Config{EnableRegistryValidation: false}) + + // Create and delete a server + server := &apiv0.ServerJSON{ + Schema: model.CurrentSchemaURL, + Name: "com.example/unique-url-server", + Description: "Server with unique URL", + Version: "1.0.0", + Remotes: []model.Transport{ + {Type: "streamable-http", URL: "https://unique.example.com/mcp"}, + }, + } + _, err := service.CreateServer(ctx, server) + require.NoError(t, err) + + // Delete the server + _, err = service.UpdateServerStatus(ctx, "com.example/unique-url-server", "1.0.0", &StatusChangeRequest{ + NewStatus: model.StatusDeleted, + }) + require.NoError(t, err) + + // Restore to active - should succeed since URL is still unique + result, err := service.UpdateServerStatus(ctx, "com.example/unique-url-server", "1.0.0", &StatusChangeRequest{ + NewStatus: model.StatusActive, + }) + assert.NoError(t, err) + assert.NotNil(t, result) + assert.Equal(t, model.StatusActive, result.Meta.Official.Status) +} + // Helper functions func stringPtr(s string) *string { return &s diff --git a/internal/service/service.go b/internal/service/service.go index 4ebd8ec..7591b7d 100644 --- a/internal/service/service.go +++ b/internal/service/service.go @@ -5,20 +5,31 @@ import ( "github.com/modelcontextprotocol/registry/internal/database" apiv0 "github.com/modelcontextprotocol/registry/pkg/api/v0" + "github.com/modelcontextprotocol/registry/pkg/model" ) +// StatusChangeRequest represents a request to change a server's status +type StatusChangeRequest struct { + NewStatus model.Status `json:"newStatus"` + StatusMessage *string `json:"statusMessage,omitempty"` +} + // RegistryService defines the interface for registry operations type RegistryService interface { // ListServers retrieve all servers with optional filtering ListServers(ctx context.Context, filter *database.ServerFilter, cursor string, limit int) ([]*apiv0.ServerResponse, string, error) // GetServerByName retrieve latest version of a server by server name - GetServerByName(ctx context.Context, serverName string) (*apiv0.ServerResponse, error) + GetServerByName(ctx context.Context, serverName string, includeDeleted bool) (*apiv0.ServerResponse, error) // GetServerByNameAndVersion retrieve specific version of a server by server name and version - GetServerByNameAndVersion(ctx context.Context, serverName string, version string) (*apiv0.ServerResponse, error) + GetServerByNameAndVersion(ctx context.Context, serverName string, version string, includeDeleted bool) (*apiv0.ServerResponse, error) // GetAllVersionsByServerName retrieve all versions of a server by server name - GetAllVersionsByServerName(ctx context.Context, serverName string) ([]*apiv0.ServerResponse, error) + GetAllVersionsByServerName(ctx context.Context, serverName string, includeDeleted bool) ([]*apiv0.ServerResponse, error) // CreateServer creates a new server version CreateServer(ctx context.Context, req *apiv0.ServerJSON) (*apiv0.ServerResponse, error) // UpdateServer updates an existing server and optionally its status - UpdateServer(ctx context.Context, serverName, version string, req *apiv0.ServerJSON, newStatus *string) (*apiv0.ServerResponse, error) + UpdateServer(ctx context.Context, serverName, version string, req *apiv0.ServerJSON, statusChange *StatusChangeRequest) (*apiv0.ServerResponse, error) + // UpdateServerStatus updates only the status metadata of a server version + UpdateServerStatus(ctx context.Context, serverName, version string, statusChange *StatusChangeRequest) (*apiv0.ServerResponse, error) + // UpdateAllVersionsStatus updates the status metadata of all versions of a server in a single transaction + UpdateAllVersionsStatus(ctx context.Context, serverName string, statusChange *StatusChangeRequest) ([]*apiv0.ServerResponse, error) } diff --git a/pkg/api/v0/types.go b/pkg/api/v0/types.go index 513e125..de78a91 100644 --- a/pkg/api/v0/types.go +++ b/pkg/api/v0/types.go @@ -7,10 +7,12 @@ import ( ) type RegistryExtensions struct { - Status model.Status `json:"status" enum:"active,deprecated,deleted" doc:"Server lifecycle status"` - PublishedAt time.Time `json:"publishedAt" format:"date-time" doc:"Timestamp when the server was first published to the registry"` - UpdatedAt time.Time `json:"updatedAt,omitempty" format:"date-time" doc:"Timestamp when the server entry was last updated"` - IsLatest bool `json:"isLatest" doc:"Whether this is the latest version of the server"` + Status model.Status `json:"status" enum:"active,deprecated,deleted" doc:"Server lifecycle status"` + StatusChangedAt time.Time `json:"statusChangedAt" format:"date-time" doc:"Timestamp when the server status was last changed"` + StatusMessage *string `json:"statusMessage,omitempty" doc:"Optional message explaining status change (e.g., deprecation reason, migration guidance)"` + PublishedAt time.Time `json:"publishedAt" format:"date-time" doc:"Timestamp when the server was first published to the registry"` + UpdatedAt time.Time `json:"updatedAt,omitempty" format:"date-time" doc:"Timestamp when the server entry was last updated"` + IsLatest bool `json:"isLatest" doc:"Whether this is the latest version of the server"` } type ResponseMeta struct { From cb4807a7fbf4ad3c67796aa727309736fe33c2d2 Mon Sep 17 00:00:00 2001 From: Preeti Dewani Date: Sun, 1 Mar 2026 20:05:50 +0530 Subject: [PATCH 114/313] add details of include_deleted in openapi spec (#1014) ## Motivation and Context Add missing spec of include_deleted parameter in openapi spec ## How Has This Been Tested? NA ## Breaking Changes No ## Types of changes - [ ] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [x] Documentation update ## Checklist - [x] I have read the [MCP Documentation](https://modelcontextprotocol.io) - [ ] My code follows the repository's style guidelines - [ ] New and existing tests pass locally - [ ] I have added appropriate error handling - [ ] I have added or updated documentation as needed --- docs/reference/api/openapi.yaml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/docs/reference/api/openapi.yaml b/docs/reference/api/openapi.yaml index 12d5d81..947ab24 100644 --- a/docs/reference/api/openapi.yaml +++ b/docs/reference/api/openapi.yaml @@ -88,6 +88,13 @@ paths: schema: type: string example: "com.example%2Fmy-server" + - name: include_deleted + in: query + description: Include deleted servers in results (default false) + required: false + schema: + type: boolean + default: false responses: '200': description: A list of all versions for the server @@ -125,6 +132,13 @@ paths: schema: type: string example: "1.0.0" + - name: include_deleted + in: query + description: Include deleted servers in results (default false) + required: false + schema: + type: boolean + default: false responses: '200': description: Detailed server information From 26564484ace4a58f0b4e9224ea8cbbc06df710b2 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 6 Mar 2026 02:10:02 +0200 Subject: [PATCH 115/313] build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.220.0 to 3.225.1 in /deploy (#1034) Bumps [github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from 3.220.0 to 3.225.1.
Release notes

Sourced from github.com/pulumi/pulumi/sdk/v3's releases.

v3.225.1

3.225.1 (2026-03-05)

Bug Fixes

  • [engine] Fix inheritence of default providers across resources of different packages #22101

  • [programgen/go] Fix panic on digit-prefixed schema properties in Go code generation #21917

  • [programgen/go] Fix plain values not always being lifted to input/output values when needed #22084

  • [programgen/python] Fix generation of entries and lookup calls #22086

v3.225.0

3.225.0 (2026-03-04)

Features

  • [engine] Automatically make invoke outputs secret when there is a secret input, and the invoke provider does not support secrets #21959

  • [engine] The engine now handles the inheritance of the provider option in resource registrations #21999

  • [engine] Enable journaling by default. It can still be turned off using the PULUMI_DISABLE_JOURNALING env variable #22041

  • [programgen] PCL can now express config values should be read as secrets #22066

  • [yaml] Update yaml to v1.30.0

  • [cli/engine] Add a flag for automatically opening a Neo task on preview/up failure #21960

  • [cli/package] Support source-based packages in pulumi schema check, not just schema files #21897

Bug Fixes

  • [cli] Fix stack import panicking when importing a service stack into a DIY backend #22076

... (truncated)

Changelog

Sourced from github.com/pulumi/pulumi/sdk/v3's changelog.

Changelog

3.225.0 (2026-03-04)

Features

  • [engine] Automatically make invoke outputs secret when there is a secret input, and the invoke provider does not support secrets #21959

  • [engine] The engine now handles the inheritance of the provider option in resource registrations #21999

  • [engine] Enable journaling by default. It can still be turned off using the PULUMI_DISABLE_JOURNALING env variable #22041

  • [programgen] PCL can now express config values should be read as secrets #22066

  • [yaml] Update yaml to v1.30.0

  • [cli/engine] Add a flag for automatically opening a Neo task on preview/up failure #21960

  • [cli/package] Support source-based packages in pulumi schema check, not just schema files #21897

Bug Fixes

  • [cli] Fix stack import panicking when importing a service stack into a DIY backend #22076

  • [engine] Fix panic when a new component resource in the program is not targeted #21957

  • [sdk/nodejs] Implement GetProgramDependencies for bun and pnpm #22065

Miscellaneous

  • [cli] Build language plugins with the grpcnotrace tag to reduce the binary size #22012

3.224.0 (2026-02-26)

Features

... (truncated)

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/pulumi/pulumi/sdk/v3&package-manager=go_modules&previous-version=3.220.0&new-version=3.225.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- deploy/go.mod | 48 ++++++++++++++------ deploy/go.sum | 122 ++++++++++++++++++++++++++++++++++---------------- 2 files changed, 119 insertions(+), 51 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index a3c16b7..a777980 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -1,11 +1,11 @@ module github.com/modelcontextprotocol/registry/deploy/infra -go 1.24.11 +go 1.25.6 require ( github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.25.0 - github.com/pulumi/pulumi/sdk/v3 v3.220.0 + github.com/pulumi/pulumi/sdk/v3 v3.225.1 gopkg.in/yaml.v2 v2.4.0 ) @@ -20,11 +20,13 @@ require ( github.com/atotto/clipboard v0.1.4 // indirect github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect github.com/blang/semver v3.5.1+incompatible // indirect + github.com/cenkalti/backoff/v5 v5.0.3 // indirect + github.com/cespare/xxhash/v2 v2.3.0 // indirect github.com/charmbracelet/bubbles v0.16.1 // indirect github.com/charmbracelet/bubbletea v0.25.0 // indirect github.com/charmbracelet/lipgloss v0.7.1 // indirect github.com/cheggaaa/pb v1.0.29 // indirect - github.com/cloudflare/circl v1.6.1 // indirect + github.com/cloudflare/circl v1.6.3 // indirect github.com/containerd/console v1.0.4-0.20230313162750-1ae8d489ac81 // indirect github.com/cyphar/filepath-securejoin v0.4.1 // indirect github.com/djherbis/times v1.5.0 // indirect @@ -32,23 +34,31 @@ require ( github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect github.com/go-git/go-billy/v5 v5.6.2 // indirect github.com/go-git/go-git/v5 v5.16.5 // indirect + github.com/go-logr/logr v1.4.3 // indirect + github.com/go-logr/stdr v1.2.2 // indirect github.com/gogo/protobuf v1.3.2 // indirect github.com/golang/glog v1.2.5 // indirect github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect github.com/google/uuid v1.6.0 // indirect + github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.7 // indirect github.com/grpc-ecosystem/grpc-opentracing v0.0.0-20180507213350-8e809c8a8645 // indirect github.com/hashicorp/errwrap v1.1.0 // indirect github.com/hashicorp/go-multierror v1.1.1 // indirect + github.com/hashicorp/go-version v1.8.0 // indirect github.com/hashicorp/hcl/v2 v2.22.0 // indirect github.com/inconshreveable/mousetrap v1.1.0 // indirect github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect + github.com/json-iterator/go v1.1.12 // indirect github.com/kevinburke/ssh_config v1.2.0 // indirect + github.com/klauspost/compress v1.18.0 // indirect github.com/lucasb-eyer/go-colorful v1.2.0 // indirect github.com/mattn/go-isatty v0.0.20 // indirect github.com/mattn/go-localereader v0.0.1 // indirect github.com/mattn/go-runewidth v0.0.15 // indirect github.com/mitchellh/go-ps v1.0.0 // indirect github.com/mitchellh/go-wordwrap v1.0.1 // indirect + github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect + github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect github.com/muesli/cancelreader v0.2.2 // indirect github.com/muesli/reflow v0.3.0 // indirect @@ -75,19 +85,31 @@ require ( github.com/uber/jaeger-lib v2.4.1+incompatible // indirect github.com/xanzy/ssh-agent v0.3.3 // indirect github.com/zclconf/go-cty v1.13.2 // indirect + go.opentelemetry.io/auto/sdk v1.2.1 // indirect + go.opentelemetry.io/collector/featuregate v1.51.0 // indirect + go.opentelemetry.io/collector/pdata v1.51.0 // indirect + go.opentelemetry.io/otel v1.40.0 // indirect + go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.40.0 // indirect + go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.40.0 // indirect + go.opentelemetry.io/otel/metric v1.40.0 // indirect + go.opentelemetry.io/otel/sdk v1.40.0 // indirect + go.opentelemetry.io/otel/trace v1.40.0 // indirect + go.opentelemetry.io/proto/otlp v1.9.0 // indirect go.uber.org/atomic v1.9.0 // indirect - golang.org/x/crypto v0.47.0 // indirect + go.uber.org/multierr v1.11.0 // indirect + golang.org/x/crypto v0.48.0 // indirect golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 // indirect - golang.org/x/mod v0.31.0 // indirect - golang.org/x/net v0.49.0 // indirect + golang.org/x/mod v0.32.0 // indirect + golang.org/x/net v0.51.0 // indirect golang.org/x/sync v0.19.0 // indirect - golang.org/x/sys v0.40.0 // indirect - golang.org/x/term v0.39.0 // indirect - golang.org/x/text v0.33.0 // indirect - golang.org/x/tools v0.40.0 // indirect - google.golang.org/genproto/googleapis/rpc v0.0.0-20250528174236-200df99c418a // indirect - google.golang.org/grpc v1.74.2 // indirect - google.golang.org/protobuf v1.36.7 // indirect + golang.org/x/sys v0.41.0 // indirect + golang.org/x/term v0.40.0 // indirect + golang.org/x/text v0.34.0 // indirect + golang.org/x/tools v0.41.0 // indirect + google.golang.org/genproto/googleapis/api v0.0.0-20260128011058-8636f8732409 // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409 // indirect + google.golang.org/grpc v1.78.0 // indirect + google.golang.org/protobuf v1.36.11 // indirect gopkg.in/warnings.v0 v0.1.2 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect lukechampine.com/frand v1.4.2 // indirect diff --git a/deploy/go.sum b/deploy/go.sum index 2c72d46..7b04a92 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -25,6 +25,10 @@ github.com/aymanbagabas/go-osc52/v2 v2.0.1 h1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiE github.com/aymanbagabas/go-osc52/v2 v2.0.1/go.mod h1:uYgXzlJ7ZpABp8OJ+exZzJJhRNQ2ASbcXHWsFqH8hp8= github.com/blang/semver v3.5.1+incompatible h1:cQNTCjp13qL8KC3Nbxr/y2Bqb63oX6wdnnjpJbkM4JQ= github.com/blang/semver v3.5.1+incompatible/go.mod h1:kRBLl5iJ+tD4TcOOxsy/0fnwebNt5EWlYSAyrTnjyyk= +github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM= +github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw= +github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs= +github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= github.com/charmbracelet/bubbles v0.16.1 h1:6uzpAAaT9ZqKssntbvZMlksWHruQLNxg49H5WdeuYSY= github.com/charmbracelet/bubbles v0.16.1/go.mod h1:2QCp9LFlEsBQMvIYERr7Ww2H2bA7xen1idUDIzm/+Xc= github.com/charmbracelet/bubbletea v0.25.0 h1:bAfwk7jRz7FKFl9RzlIULPkStffg5k6pNt5dywy4TcM= @@ -33,8 +37,8 @@ github.com/charmbracelet/lipgloss v0.7.1 h1:17WMwi7N1b1rVWOjMT+rCh7sQkvDU75B2hbZ github.com/charmbracelet/lipgloss v0.7.1/go.mod h1:yG0k3giv8Qj8edTCbbg6AlQ5e8KNWpFujkNawKNhE2c= github.com/cheggaaa/pb v1.0.29 h1:FckUN5ngEk2LpvuG0fw1GEFx6LtyY2pWI/Z2QgCnEYo= github.com/cheggaaa/pb v1.0.29/go.mod h1:W40334L7FMC5JKWldsTWbdGjLo0RxUKK73K+TuPxX30= -github.com/cloudflare/circl v1.6.1 h1:zqIqSPIndyBh1bjLVVDHMPpVKqp8Su/V+6MeDzzQBQ0= -github.com/cloudflare/circl v1.6.1/go.mod h1:uddAzsPgqdMAYatqJ0lsjX1oECcQLIlRpzZh3pJrofs= +github.com/cloudflare/circl v1.6.3 h1:9GPOhQGF9MCYUeXyMYlqTR6a5gTrgR/fBLXvUgtVcg8= +github.com/cloudflare/circl v1.6.3/go.mod h1:2eXP6Qfat4O/Yhh8BznvKnJ+uzEoTQ6jVKJRn81BiS4= github.com/containerd/console v1.0.4-0.20230313162750-1ae8d489ac81 h1:q2hJAaP1k2wIvVRd/hEHD7lacgqrCPS+k8g1MndzfWY= github.com/containerd/console v1.0.4-0.20230313162750-1ae8d489ac81/go.mod h1:YynlIjWYF8myEu6sdkwKIvGQq+cOckRm6So2avqoYAk= github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g= @@ -62,6 +66,7 @@ github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMj github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII= github.com/go-git/go-git/v5 v5.16.5 h1:mdkuqblwr57kVfXri5TTH+nMFLNUxIj9Z7F5ykFbw5s= github.com/go-git/go-git/v5 v5.16.5/go.mod h1:QOMLpNf1qxuSY4StA/ArOdfFR2TrKEjJiye2kel2m+M= +github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag= @@ -77,8 +82,11 @@ github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps= github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= +github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= +github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.7 h1:X+2YciYSxvMQK0UZ7sg45ZVabVZBeBuvMkmuI2V3Fak= +github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.7/go.mod h1:lW34nIZuQ8UDPdkon5fmfp2l3+ZkQ2me/+oecHYLOII= github.com/grpc-ecosystem/grpc-opentracing v0.0.0-20180507213350-8e809c8a8645 h1:MJG/KsmcqMwFAkh8mTnAwhyKoB+sTAnY4CACC110tbU= github.com/grpc-ecosystem/grpc-opentracing v0.0.0-20180507213350-8e809c8a8645/go.mod h1:6iZfnjpejD4L/4DwD7NryNaJyCQdzwWwH2MWhCA90Kw= github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4= @@ -86,17 +94,23 @@ github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4= github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo= github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM= +github.com/hashicorp/go-version v1.8.0 h1:KAkNb1HAiZd1ukkxDFGmokVZe1Xy9HG6NUp+bPle2i4= +github.com/hashicorp/go-version v1.8.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA= github.com/hashicorp/hcl/v2 v2.22.0 h1:hkZ3nCtqeJsDhPRFz5EA9iwcG1hNWGePOTw6oyul12M= github.com/hashicorp/hcl/v2 v2.22.0/go.mod h1:62ZYHrXgPoX8xBnzl8QzbWq4dyDsDtfCRgIq1rbJEvA= github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8= github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOlocH6Fxy8MmwDt+yVQYULKfN0RoTN8A= github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99/go.mod h1:1lJo3i6rXxKeerYnT8Nvf0QmHCRC1n8sfWVwXF2Frvo= +github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM= +github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo= github.com/kevinburke/ssh_config v1.2.0 h1:x584FjTGwHzMwvHx18PXxbBVzfnxogHaAReU4gf13a4= github.com/kevinburke/ssh_config v1.2.0/go.mod h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF4nAY/ojJ6r6mM= github.com/kisielk/errcheck v1.2.0/go.mod h1:/BMXB+zMLi60iA8Vv6Ksmxu/1UDYcXs4uQLJ+jE2L00= github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8= github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= +github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo= +github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ= github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= @@ -123,6 +137,12 @@ github.com/mitchellh/go-ps v1.0.0 h1:i6ampVEEF4wQFF+bkYfwYgY+F/uYJDktmvLPf7qIgjc github.com/mitchellh/go-ps v1.0.0/go.mod h1:J4lOc8z8yJs6vUwklHw2XEIiT4z4C40KtWVN3nvg8Pg= github.com/mitchellh/go-wordwrap v1.0.1 h1:TLuKupo69TCn6TQSyGxwI1EblZZEsQ0vMlAFQflz0v0= github.com/mitchellh/go-wordwrap v1.0.1/go.mod h1:R62XHJLzvMFRBbcrT7m7WgmE1eOyTSsCt+hzestvNj0= +github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q= +github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg= +github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q= +github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk= +github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFdJifH4BDsTlE89Zl93FEloxaWZfGcifgq8= +github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk= github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 h1:ZK8zHtRHOkbHy6Mmr5D264iyp3TiX5OmNcI5cIARiQI= github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6/go.mod h1:CJlz5H+gyd6CUWT45Oy4q24RdLyn7Md9Vj2/ldJBSIo= github.com/muesli/cancelreader v0.2.2 h1:3I4Kt4BQjOR54NavqnDogx/MIoWBFa0StPA8ELUXHmA= @@ -158,8 +178,8 @@ github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 h1:w6OnO3d4j5yVf2vpm8OzXFC/xHOEGqt+9 github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1/go.mod h1:UyZyv7hz4knpFx6/Sh+SkZe6hT6sJHtDvw9A0TbvEsk= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.25.0 h1:N1qitmrGomEaCPsblqJHaw8Re0cqqox5V+kHsi4EEtk= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.25.0/go.mod h1:ACBJF6+nzUqDeRK+p2OrvykunyeHfvtbyELc6PB38fk= -github.com/pulumi/pulumi/sdk/v3 v3.220.0 h1:TtdlW2VfvBWhFZSvaDN9lSUlSS4gGSdNWdca3RGPsBQ= -github.com/pulumi/pulumi/sdk/v3 v3.220.0/go.mod h1:UGWJOz25OiFIN0QH79UFij8mffH94TYebKUgy9Wvug0= +github.com/pulumi/pulumi/sdk/v3 v3.225.1 h1:yn64PBZocE0Ums82fc6jaWRZthZ352BFi/tVAs5jrps= +github.com/pulumi/pulumi/sdk/v3 v3.225.1/go.mod h1:kiwkjulVm9ibqTOcyrZYhaRZsDSxWpzIKPXtCFeffBE= github.com/rivo/uniseg v0.1.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc= github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc= github.com/rivo/uniseg v0.4.4 h1:8TfxU8dW6PdqD27gjM8MVNuicgxIjxpm4K7x4jp8sis= @@ -188,8 +208,8 @@ github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXf github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4= github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA= -github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA= -github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY= +github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U= +github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= github.com/texttheater/golang-levenshtein v1.0.1 h1:+cRNoVrfiwufQPhoMzB6N0Yf/Mqajr6t1lOv8GyGE2U= github.com/texttheater/golang-levenshtein v1.0.1/go.mod h1:PYAKrbF5sAiq9wd+H82hs7gNaen0CplQ9uvm6+enD/8= github.com/uber/jaeger-client-go v2.30.0+incompatible h1:D6wyKGCecFaSRUpo8lCVbaOOb6ThwMmTEbhRwtKR97o= @@ -202,42 +222,64 @@ github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9de github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= github.com/zclconf/go-cty v1.13.2 h1:4GvrUxe/QUDYuJKAav4EYqdM47/kZa672LwmXFmEKT0= github.com/zclconf/go-cty v1.13.2/go.mod h1:YKQzy/7pZ7iq2jNFzy5go57xdxdWoLLpaEp4u238AE0= -go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA= -go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A= -go.opentelemetry.io/otel v1.36.0 h1:UumtzIklRBY6cI/lllNZlALOF5nNIzJVb16APdvgTXg= -go.opentelemetry.io/otel v1.36.0/go.mod h1:/TcFMXYjyRNh8khOAO9ybYkqaDBb/70aVwkNML4pP8E= -go.opentelemetry.io/otel/metric v1.36.0 h1:MoWPKVhQvJ+eeXWHFBOPoBOi20jh6Iq2CcCREuTYufE= -go.opentelemetry.io/otel/metric v1.36.0/go.mod h1:zC7Ks+yeyJt4xig9DEw9kuUFe5C3zLbVjV2PzT6qzbs= -go.opentelemetry.io/otel/sdk v1.36.0 h1:b6SYIuLRs88ztox4EyrvRti80uXIFy+Sqzoh9kFULbs= -go.opentelemetry.io/otel/sdk v1.36.0/go.mod h1:+lC+mTgD+MUWfjJubi2vvXWcVxyr9rmlshZni72pXeY= -go.opentelemetry.io/otel/sdk/metric v1.36.0 h1:r0ntwwGosWGaa0CrSt8cuNuTcccMXERFwHX4dThiPis= -go.opentelemetry.io/otel/sdk/metric v1.36.0/go.mod h1:qTNOhFDfKRwX0yXOqJYegL5WRaW376QbB7P4Pb0qva4= -go.opentelemetry.io/otel/trace v1.36.0 h1:ahxWNuqZjpdiFAyrIoQ4GIiAIhxAunQR6MUoKrsNd4w= -go.opentelemetry.io/otel/trace v1.36.0/go.mod h1:gQ+OnDZzrybY4k4seLzPAWNwVBBVlF2szhehOBB/tGA= +go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= +go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y= +go.opentelemetry.io/collector/featuregate v1.51.0 h1:dxJuv/3T84dhNKp7fz5+8srHz1dhquGzDpLW4OZTFBw= +go.opentelemetry.io/collector/featuregate v1.51.0/go.mod h1:/1bclXgP91pISaEeNulRxzzmzMTm4I5Xih2SnI4HRSo= +go.opentelemetry.io/collector/internal/testutil v0.145.0 h1:H/KL0GH3kGqSMKxZvnQ0B0CulfO9xdTg4DZf28uV7fY= +go.opentelemetry.io/collector/internal/testutil v0.145.0/go.mod h1:YAD9EAkwh/l5asZNbEBEUCqEjoL1OKMjAMoPjPqH76c= +go.opentelemetry.io/collector/pdata v1.51.0 h1:DnDhSEuDXNdzGRB7f6oOfXpbDApwBX3tY+3K69oUrDA= +go.opentelemetry.io/collector/pdata v1.51.0/go.mod h1:GoX1bjKDR++mgFKdT7Hynv9+mdgQ1DDXbjs7/Ww209Q= +go.opentelemetry.io/otel v1.40.0 h1:oA5YeOcpRTXq6NN7frwmwFR0Cn3RhTVZvXsP4duvCms= +go.opentelemetry.io/otel v1.40.0/go.mod h1:IMb+uXZUKkMXdPddhwAHm6UfOwJyh4ct1ybIlV14J0g= +go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.40.0 h1:QKdN8ly8zEMrByybbQgv8cWBcdAarwmIPZ6FThrWXJs= +go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.40.0/go.mod h1:bTdK1nhqF76qiPoCCdyFIV+N/sRHYXYCTQc+3VCi3MI= +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.40.0 h1:DvJDOPmSWQHWywQS6lKL+pb8s3gBLOZUtw4N+mavW1I= +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.40.0/go.mod h1:EtekO9DEJb4/jRyN4v4Qjc2yA7AtfCBuz2FynRUWTXs= +go.opentelemetry.io/otel/metric v1.40.0 h1:rcZe317KPftE2rstWIBitCdVp89A2HqjkxR3c11+p9g= +go.opentelemetry.io/otel/metric v1.40.0/go.mod h1:ib/crwQH7N3r5kfiBZQbwrTge743UDc7DTFVZrrXnqc= +go.opentelemetry.io/otel/sdk v1.40.0 h1:KHW/jUzgo6wsPh9At46+h4upjtccTmuZCFAc9OJ71f8= +go.opentelemetry.io/otel/sdk v1.40.0/go.mod h1:Ph7EFdYvxq72Y8Li9q8KebuYUr2KoeyHx0DRMKrYBUE= +go.opentelemetry.io/otel/sdk/metric v1.40.0 h1:mtmdVqgQkeRxHgRv4qhyJduP3fYJRMX4AtAlbuWdCYw= +go.opentelemetry.io/otel/sdk/metric v1.40.0/go.mod h1:4Z2bGMf0KSK3uRjlczMOeMhKU2rhUqdWNoKcYrtcBPg= +go.opentelemetry.io/otel/trace v1.40.0 h1:WA4etStDttCSYuhwvEa8OP8I5EWu24lkOzp+ZYblVjw= +go.opentelemetry.io/otel/trace v1.40.0/go.mod h1:zeAhriXecNGP/s2SEG3+Y8X9ujcJOTqQ5RgdEJcawiA= +go.opentelemetry.io/proto/otlp v1.9.0 h1:l706jCMITVouPOqEnii2fIAuO3IVGBRPV5ICjceRb/A= +go.opentelemetry.io/proto/otlp v1.9.0/go.mod h1:xE+Cx5E/eEHw+ISFkwPLwCZefwVjY+pqKg1qcK03+/4= +go.opentelemetry.io/proto/slim/otlp v1.9.0 h1:fPVMv8tP3TrsqlkH1HWYUpbCY9cAIemx184VGkS6vlE= +go.opentelemetry.io/proto/slim/otlp v1.9.0/go.mod h1:xXdeJJ90Gqyll+orzUkY4bOd2HECo5JofeoLpymVqdI= +go.opentelemetry.io/proto/slim/otlp/collector/profiles/v1development v0.2.0 h1:o13nadWDNkH/quoDomDUClnQBpdQQ2Qqv0lQBjIXjE8= +go.opentelemetry.io/proto/slim/otlp/collector/profiles/v1development v0.2.0/go.mod h1:Gyb6Xe7FTi/6xBHwMmngGoHqL0w29Y4eW8TGFzpefGA= +go.opentelemetry.io/proto/slim/otlp/profiles/v1development v0.2.0 h1:EiUYvtwu6PMrMHVjcPfnsG3v+ajPkbUeH+IL93+QYyk= +go.opentelemetry.io/proto/slim/otlp/profiles/v1development v0.2.0/go.mod h1:mUUHKFiN2SST3AhJ8XhJxEoeVW12oqfXog0Bo8W3Ec4= go.uber.org/atomic v1.9.0 h1:ECmE8Bn/WFTYwEW/bpKD3M8VtR/zQVbavAoalC1PYyE= go.uber.org/atomic v1.9.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc= +go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= +go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE= +go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0= +go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y= golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4= -golang.org/x/crypto v0.47.0 h1:V6e3FRj+n4dbpw86FJ8Fv7XVOql7TEwpHapKoMJ/GO8= -golang.org/x/crypto v0.47.0/go.mod h1:ff3Y9VzzKbwSSEzWqJsJVBnWmRwRSHt/6Op5n9bQc4A= +golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts= +golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos= golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 h1:2dVuKD2vS7b0QIHQbpyTISPd0LeHDbnYEryqj5Q1ug8= golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56/go.mod h1:M4RDyNAINzryxdtnbRXRL/OHtkFuWGRjvuhBJpk2IlY= golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY= golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg= golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= -golang.org/x/mod v0.31.0 h1:HaW9xtz0+kOcWKwli0ZXy79Ix+UW/vOfmWI5QVd2tgI= -golang.org/x/mod v0.31.0/go.mod h1:43JraMp9cGx1Rx3AqioxrbrhNsLl2l/iNAvuBkrezpg= +golang.org/x/mod v0.32.0 h1:9F4d3PHLljb6x//jOyokMv3eX+YDeepZSEo3mFJy93c= +golang.org/x/mod v0.32.0/go.mod h1:SgipZ/3h2Ci89DlEtEXWUk/HteuRin+HHhN+WbNhguU= golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20200421231249-e086a090c8fd/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A= golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= -golang.org/x/net v0.49.0 h1:eeHFmOGUTtaaPSGNmjBKpbng9MulQsJURQUAfUwY++o= -golang.org/x/net v0.49.0/go.mod h1:/ysNB2EvaqvesRkuLAyjI1ycPZlQHM3q01F02UY/MV8= +golang.org/x/net v0.51.0 h1:94R/GTO7mt3/4wIKpcR5gkGmRLOuE/2hNGeWq/GBIFo= +golang.org/x/net v0.51.0/go.mod h1:aamm+2QF5ogm02fjy5Bb7CQ0WMt1/WVM7FtyaTLlA9Y= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= @@ -258,34 +300,38 @@ golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBc golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.40.0 h1:DBZZqJ2Rkml6QMQsZywtnjnnGvHza6BTfYFWY9kjEWQ= -golang.org/x/sys v0.40.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= +golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k= +golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= -golang.org/x/term v0.39.0 h1:RclSuaJf32jOqZz74CkPA9qFuVTX7vhLlpfj/IGWlqY= -golang.org/x/term v0.39.0/go.mod h1:yxzUCTP/U+FzoxfdKmLaA0RV1WgE0VY7hXBwKtY/4ww= +golang.org/x/term v0.40.0 h1:36e4zGLqU4yhjlmxEaagx2KuYbJq3EwY8K943ZsHcvg= +golang.org/x/term v0.40.0/go.mod h1:w2P8uVp06p2iyKKuvXIm7N/y0UCRt3UfJTfZ7oOpglM= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= -golang.org/x/text v0.33.0 h1:B3njUFyqtHDUI5jMn1YIr5B0IE2U0qck04r6d4KPAxE= -golang.org/x/text v0.33.0/go.mod h1:LuMebE6+rBincTi9+xWTY8TztLzKHc/9C1uBCG27+q8= +golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk= +golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20181030221726-6c7e314b6563/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28= golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE= golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA= -golang.org/x/tools v0.40.0 h1:yLkxfA+Qnul4cs9QA3KnlFu0lVmd8JJfoq+E41uSutA= -golang.org/x/tools v0.40.0/go.mod h1:Ik/tzLRlbscWpqqMRjyWYDisX8bG13FrdXp3o4Sr9lc= +golang.org/x/tools v0.41.0 h1:a9b8iMweWG+S0OBnlU36rzLp20z1Rp10w+IY2czHTQc= +golang.org/x/tools v0.41.0/go.mod h1:XSY6eDqxVNiYgezAVqqCeihT4j1U2CCsqvH3WhQpnlg= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= -google.golang.org/genproto/googleapis/rpc v0.0.0-20250528174236-200df99c418a h1:v2PbRU4K3llS09c7zodFpNePeamkAwG3mPrAery9VeE= -google.golang.org/genproto/googleapis/rpc v0.0.0-20250528174236-200df99c418a/go.mod h1:qQ0YXyHHx3XkvlzUtpXDkS29lDSafHMZBAZDc03LQ3A= -google.golang.org/grpc v1.74.2 h1:WoosgB65DlWVC9FqI82dGsZhWFNBSLjQ84bjROOpMu4= -google.golang.org/grpc v1.74.2/go.mod h1:CtQ+BGjaAIXHs/5YS3i473GqwBBa1zGQNevxdeBEXrM= -google.golang.org/protobuf v1.36.7 h1:IgrO7UwFQGJdRNXH/sQux4R1Dj1WAKcLElzeeRaXV2A= -google.golang.org/protobuf v1.36.7/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY= +gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk= +gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E= +google.golang.org/genproto/googleapis/api v0.0.0-20260128011058-8636f8732409 h1:merA0rdPeUV3YIIfHHcH4qBkiQAc1nfCKSI7lB4cV2M= +google.golang.org/genproto/googleapis/api v0.0.0-20260128011058-8636f8732409/go.mod h1:fl8J1IvUjCilwZzQowmw2b7HQB2eAuYBabMXzWurF+I= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409 h1:H86B94AW+VfJWDqFeEbBPhEtHzJwJfTbgE2lZa54ZAQ= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409/go.mod h1:j9x/tPzZkyxcgEFkiKEEGxfvyumM01BEtsW8xzOahRQ= +google.golang.org/grpc v1.78.0 h1:K1XZG/yGDJnzMdd/uZHAkVqJE+xIDOcmdSFZkBUicNc= +google.golang.org/grpc v1.78.0/go.mod h1:I47qjTo4OKbMkjA/aOOwxDIiPSBofUtQUI5EfpWvW7U= +google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE= +google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk= From a5b152f212a5954a92c5ca266576b6f612f5d4aa Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 6 Mar 2026 02:10:21 +0200 Subject: [PATCH 116/313] build(deps): bump github.com/docker/cli from 29.0.3+incompatible to 29.2.0+incompatible (#1032) Bumps [github.com/docker/cli](https://github.com/docker/cli) from 29.0.3+incompatible to 29.2.0+incompatible.
Commits
  • 0b9d198 Merge pull request #6764 from vvoland/update-docker
  • 9c9ec73 vendor: github.com/moby/moby/client v0.2.2
  • bab3e81 vendor: github.com/moby/moby/api v1.53.0
  • 2e64fc1 Merge pull request #6367 from thaJeztah/template_slicejoin
  • 1f2ba2a Merge pull request #6760 from thaJeztah/container_create_fix_error
  • e34a342 templates: make "join" work with non-string slices and map values
  • a86356d Merge pull request #6763 from thaJeztah/bump_mapstructure
  • 771660a vendor: github.com/go-viper/mapstructure/v2 v2.5.0
  • 9cff36b Merge pull request #6762 from thaJeztah/bump_x_deps
  • 08ed2bc cli/command/container: make injecting config.json failures a warning
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/docker/cli&package-manager=go_modules&previous-version=29.0.3+incompatible&new-version=29.2.0+incompatible)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/modelcontextprotocol/registry/network/alerts).
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index c4697b8..4585638 100644 --- a/go.mod +++ b/go.mod @@ -41,7 +41,7 @@ require ( github.com/cespare/xxhash/v2 v2.3.0 // indirect github.com/containerd/stargz-snapshotter/estargz v0.18.1 // indirect github.com/davecgh/go-spew v1.1.1 // indirect - github.com/docker/cli v29.0.3+incompatible // indirect + github.com/docker/cli v29.2.0+incompatible // indirect github.com/docker/distribution v2.8.3+incompatible // indirect github.com/docker/docker-credential-helpers v0.9.3 // indirect github.com/felixge/httpsnoop v1.0.4 // indirect diff --git a/go.sum b/go.sum index d6fadaf..9a0016b 100644 --- a/go.sum +++ b/go.sum @@ -45,8 +45,8 @@ github.com/danielgtaylor/huma/v2 v2.35.0/go.mod h1:3elp5brzdyyZsPlDVvf6w8RLnklKp github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= -github.com/docker/cli v29.0.3+incompatible h1:8J+PZIcF2xLd6h5sHPsp5pvvJA+Sr2wGQxHkRl53a1E= -github.com/docker/cli v29.0.3+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= +github.com/docker/cli v29.2.0+incompatible h1:9oBd9+YM7rxjZLfyMGxjraKBKE4/nVyvVfN4qNl9XRM= +github.com/docker/cli v29.2.0+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk= github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w= github.com/docker/docker-credential-helpers v0.9.3 h1:gAm/VtF9wgqJMoxzT3Gj5p4AqIjCBS4wrsOh9yRqcz8= From febc8dc6a16f74242f9a3fb91b78e31ec7d62930 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 6 Mar 2026 02:11:03 +0200 Subject: [PATCH 117/313] build(deps): bump the actions group across 1 directory with 5 updates (#1031) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps the actions group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/setup-go](https://github.com/actions/setup-go) | `6.2.0` | `6.3.0` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `6.0.0` | `7.0.0` | | [docker/login-action](https://github.com/docker/login-action) | `3.7.0` | `4.0.0` | | [anchore/sbom-action](https://github.com/anchore/sbom-action) | `0.22.2` | `0.23.0` | | [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) | `6.4.0` | `7.0.0` | Updates `actions/setup-go` from 6.2.0 to 6.3.0
Release notes

Sourced from actions/setup-go's releases.

v6.3.0

What's Changed

Full Changelog: https://github.com/actions/setup-go/compare/v6...v6.3.0

Commits

Updates `actions/upload-artifact` from 6.0.0 to 7.0.0
Release notes

Sourced from actions/upload-artifact's releases.

v7.0.0

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

New Contributors

Full Changelog: https://github.com/actions/upload-artifact/compare/v6...v7.0.0

Commits

Updates `docker/login-action` from 3.7.0 to 4.0.0
Release notes

Sourced from docker/login-action's releases.

v4.0.0

Full Changelog: https://github.com/docker/login-action/compare/v3.7.0...v4.0.0

Commits
  • b45d80f Merge pull request #929 from crazy-max/node24
  • 176cb9c node 24 as default runtime
  • cad8984 Merge pull request #920 from docker/dependabot/npm_and_yarn/aws-sdk-dependenc...
  • 92cbcb2 chore: update generated content
  • 5a2d6a7 build(deps): bump the aws-sdk-dependencies group with 2 updates
  • 44512b6 Merge pull request #928 from docker/dependabot/npm_and_yarn/docker/actions-to...
  • 28737a5 chore: update generated content
  • dac0793 build(deps): bump @​docker/actions-toolkit from 0.76.0 to 0.77.0
  • 62029f3 Merge pull request #919 from docker/dependabot/npm_and_yarn/actions/core-3.0.0
  • 08c8f06 chore: update generated content
  • Additional commits viewable in compare view

Updates `anchore/sbom-action` from 0.22.2 to 0.23.0
Release notes

Sourced from anchore/sbom-action's releases.

v0.23.0

Commits
  • 17ae174 chore(deps/test): move to es modules, node:test, single dist file (#595)
  • 6d473d3 chore(deps): update Syft to v1.42.1 (#599)
  • 60619e7 fix tests and bump fast-xml-parser (#598)
  • e2bd58a chore(deps-dev): bump the dev-dependencies group with 3 updates (#592)
  • d032d7d ci(syft auto update): npm ci, not npm install (#597)
  • 2d09430 fix(dev): switch to esbuild (#590)
  • 74c5ce9 chore(deps): update Syft to v1.42.0 (#589)
  • 77fae5a chore(deps-dev): bump the dev-dependencies group with 4 updates (#583)
  • debc3ee chore(deps): bump npm-check-updates in the non-major group (#584)
  • fff8762 chore(deps): bump zizmorcore/zizmor-action from 0.4.1 to 0.5.0 (#588)
  • See full diff in compare view

Updates `goreleaser/goreleaser-action` from 6.4.0 to 7.0.0
Release notes

Sourced from goreleaser/goreleaser-action's releases.

v7.0.0

What's Changed

Full Changelog: https://github.com/goreleaser/goreleaser-action/compare/v6...v7.0.0

Commits
  • ec59f47 fix: yargs usage
  • 752dede fix: gitignore
  • 1881ae0 ci: update dependabot settings
  • fdc5e66 chore: gitignore provenance.json
  • 51b5b35 chore(deps): bump semver from 7.7.3 to 7.7.4 in the npm group (#539)
  • 4247c53 ci(deps): bump docker/setup-buildx-action in the actions group (#538)
  • c169bfd chore(deps): bump @​actions/http-client from 3.0.2 to 4.0.0 in the npm group (...
  • 902ab4a chore(deps): bump the npm group across 1 directory with 4 updates (#536)
  • c59a691 chore: gitignore
  • 56cc8b2 ci: add job to automate dependabot pre-checkin/vendor
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/ci.yml | 6 +++--- .github/workflows/deploy-production.yml | 2 +- .github/workflows/deploy-staging.yml | 6 +++--- .github/workflows/release.yml | 10 +++++----- 4 files changed, 12 insertions(+), 12 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ac807bc..723163f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -19,7 +19,7 @@ jobs: uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 - name: Set up Go - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 + uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 with: go-version-file: 'go.mod' cache: true @@ -52,7 +52,7 @@ jobs: uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 - name: Set up Go - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 + uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 with: go-version-file: 'go.mod' cache: true @@ -64,7 +64,7 @@ jobs: run: make test-all - name: Upload coverage artifacts - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f + uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f with: name: coverage-report path: | diff --git a/.github/workflows/deploy-production.yml b/.github/workflows/deploy-production.yml index 8474b93..8b50757 100644 --- a/.github/workflows/deploy-production.yml +++ b/.github/workflows/deploy-production.yml @@ -26,7 +26,7 @@ jobs: uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 - name: Setup Go - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 + uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 with: go-version-file: 'go.mod' cache: true diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml index 044da1e..3d983ed 100644 --- a/.github/workflows/deploy-staging.yml +++ b/.github/workflows/deploy-staging.yml @@ -25,7 +25,7 @@ jobs: uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 - name: Set up Go - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 + uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 with: go-version-file: 'go.mod' cache: true @@ -34,7 +34,7 @@ jobs: uses: ko-build/setup-ko@v0.9 - name: Log in to Container Registry - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 + uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 with: registry: ghcr.io username: ${{ github.actor }} @@ -73,7 +73,7 @@ jobs: uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 - name: Setup Go - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 + uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 with: go-version-file: 'go.mod' cache: true diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 1dd5c7c..4b73601 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -19,7 +19,7 @@ jobs: fetch-depth: 0 - name: Set up Go - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 + uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 with: go-version-file: 'go.mod' cache: true @@ -28,10 +28,10 @@ jobs: uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0 - name: Install Syft - uses: anchore/sbom-action/download-syft@v0.22.2 + uses: anchore/sbom-action/download-syft@v0.23.0 - name: Run GoReleaser - uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a + uses: goreleaser/goreleaser-action@ec59f474b9834571250b370d4735c50f8e2d1e29 with: distribution: goreleaser version: v2.12.0 @@ -48,7 +48,7 @@ jobs: uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 - name: Set up Go - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 + uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 with: go-version-file: 'go.mod' cache: true @@ -57,7 +57,7 @@ jobs: uses: ko-build/setup-ko@v0.9 - name: Log in to Container Registry - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 + uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 with: registry: ghcr.io username: ${{ github.actor }} From 8575244d1fe4e6136b3cc47989bad5f1a7e445af Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 6 Mar 2026 02:14:22 +0200 Subject: [PATCH 118/313] build(deps): bump github.com/caarlos0/env/v11 from 11.3.1 to 11.4.0 (#995) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [github.com/caarlos0/env/v11](https://github.com/caarlos0/env) from 11.3.1 to 11.4.0.
Release notes

Sourced from github.com/caarlos0/env/v11's releases.

v11.4.0

Changelog

New Features

  • 2be9960e75cc5f053dcb89c64e43de19765fd154: feat: option to set defaults for zero values only (#325) (@​dnovikoff)

Bug fixes

  • d3505f14213c309f8ca3b0b1e468284749456dde: fix: all new lint issues, update golangci-lint (@​caarlos0)
  • aaa45113e5eb50e2a243959041452bbab40ae3cc: fix: lint issues (@​caarlos0)

Documentation updates

  • 8917d78b4247be8a3f555ccee03305c7763471e4: docs: clarify example a bit (@​caarlos0)

Other work

  • 7b10cf56e20fe41042b7a7148555990b64b85f95: ci(deps): bump github/codeql-action in the actions group (#400) (@​dependabot[bot])
  • c98ad844e1e479526ef6b4069e0b0f1ced5c953d: ci(deps): bump github/codeql-action in the actions group (#410) (@​dependabot[bot])
  • 2ca9b08cafe0bc271636c15fa34d156733631123: ci(deps): bump the actions group with 2 updates (#393) (@​dependabot[bot])
  • cd5c220dbceb1d1353263a5d6fe3f6816aa1217f: ci(deps): bump the actions group with 2 updates (#396) (@​dependabot[bot])
  • 4d25a4659f428119ce5eaf3ea579176b9161c6e0: ci(deps): bump the actions group with 2 updates (#402) (@​dependabot[bot])
  • c660cc91db76b02de72e8ab7e9ad348edef3f891: ci(deps): bump the actions group with 2 updates (#403) (@​dependabot[bot])
  • 3a3ea05453bd16685c807ba089b20a82033a02f1: ci(deps): bump the actions group with 2 updates (#405) (@​dependabot[bot])
  • d28373e3a047e93ad21676ea9878e5dd1ca157f7: ci(deps): bump the actions group with 2 updates (#408) (@​dependabot[bot])
  • 7b5005693b54a0014e4d3a2ee6192c7bce336af7: ci(deps): bump the actions group with 3 updates (#397) (@​dependabot[bot])
  • 6b2db30d1977183eb8a9732c01ff4e6788565a6e: ci(deps): bump the actions group with 3 updates (#399) (@​dependabot[bot])
  • f33230e8e7e0377c9cdb65d43940db1666061766: ci(deps): bump the actions group with 3 updates (#404) (@​dependabot[bot])
  • 2dc7aec137983c972c29779e951011ddb496fc8b: ci(sec): add codeql, govulncheck, grype (@​caarlos0)
  • 82412ce6900082095e9e4b66f5024c0e67ff3fb8: ci: build perms (@​caarlos0)
  • 02495c42107d77c9365aef6a031b7089f734af3b: ci: build perms (@​caarlos0)
  • e5b3c2c879e43e458e060e2a61fb525e161b7715: ci: lint workflow perms (@​caarlos0)
  • 6690dfb3d314535320f3a30365c52f6fb40c8992: ci: pin github actions versions (@​caarlos0)
  • 548a7a66c9d5504d8f9c0488ee47a05ae453c7e2: ci: update dependabot (@​caarlos0)

Released with GoReleaser Pro!

Commits
  • aaa4511 fix: lint issues
  • 4fe3f70 chore: dependabot update
  • c98ad84 ci(deps): bump github/codeql-action in the actions group (#410)
  • d28373e ci(deps): bump the actions group with 2 updates (#408)
  • 3a3ea05 ci(deps): bump the actions group with 2 updates (#405)
  • f33230e ci(deps): bump the actions group with 3 updates (#404)
  • c660cc9 ci(deps): bump the actions group with 2 updates (#403)
  • 4d25a46 ci(deps): bump the actions group with 2 updates (#402)
  • 7b10cf5 ci(deps): bump github/codeql-action in the actions group (#400)
  • 6b2db30 ci(deps): bump the actions group with 3 updates (#399)
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/caarlos0/env/v11&package-manager=go_modules&previous-version=11.3.1&new-version=11.4.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 4585638..aede38c 100644 --- a/go.mod +++ b/go.mod @@ -6,7 +6,7 @@ require ( cloud.google.com/go/kms v1.25.0 github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.4.0 - github.com/caarlos0/env/v11 v11.3.1 + github.com/caarlos0/env/v11 v11.4.0 github.com/coreos/go-oidc/v3 v3.17.0 github.com/danielgtaylor/huma/v2 v2.35.0 github.com/golang-jwt/jwt/v5 v5.3.1 diff --git a/go.sum b/go.sum index 9a0016b..16602d6 100644 --- a/go.sum +++ b/go.sum @@ -30,8 +30,8 @@ github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0 h1:XRzhVemXdgv github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0/go.mod h1:HKpQxkWaGLJ+D/5H8QRpyQXA1eKjxkFlOMwck5+33Jk= github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM= github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw= -github.com/caarlos0/env/v11 v11.3.1 h1:cArPWC15hWmEt+gWk7YBi7lEXTXCvpaSdCiZE2X5mCA= -github.com/caarlos0/env/v11 v11.3.1/go.mod h1:qupehSf/Y0TUTsxKywqRt/vJjN5nz6vauiYEUUr8P4U= +github.com/caarlos0/env/v11 v11.4.0 h1:Kcb6t5kIIr4XkoQC9AF2j+8E1Jsrl3Wz/hhm1LtoGAc= +github.com/caarlos0/env/v11 v11.4.0/go.mod h1:qupehSf/Y0TUTsxKywqRt/vJjN5nz6vauiYEUUr8P4U= github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs= github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= github.com/cncf/xds/go v0.0.0-20250501225837-2ac532fd4443 h1:aQ3y1lwWyqYPiWZThqv1aFbZMiM9vblcSArJRf2Irls= From b738501d2f56da0adf0e89af4817f929068a4f76 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 6 Mar 2026 02:16:00 +0200 Subject: [PATCH 119/313] build(deps): bump github.com/pulumi/pulumi-kubernetes/sdk/v4 from 4.25.0 to 4.27.0 in /deploy (#1024) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [github.com/pulumi/pulumi-kubernetes/sdk/v4](https://github.com/pulumi/pulumi-kubernetes) from 4.25.0 to 4.27.0.
Release notes

Sourced from github.com/pulumi/pulumi-kubernetes/sdk/v4's releases.

v4.27.0

No release notes provided.

v4.26.0

Fixed

  • #4122 Implements a new provider config option, alwaysRender, which sets Diff_Someto true when used in combination with renderYAMLtoDirectory. This allows for user-defined opt-in behavior for YAML manifests to be idempotently generated on every pulumi up, and for Update() to show these changes to a user.

  • Fixed a race condition in StatefulSet await logic where Pulumi could incorrectly report a rollout as complete before the controller had processed the update. This occurred when Pulumi checked status fields before the controller updated observedGeneration, causing stale "ready" values to be trusted.

  • Fixed a regression of #2943 which could cause Deployments to erroneously report diffs.

Changed

Changelog

Sourced from github.com/pulumi/pulumi-kubernetes/sdk/v4's changelog.

4.27.0 (March 2, 2026)

Fixed

  • #4181 Fix PVC timeout when updating to a storage class with WaitForFirstConsumer bind mode.

Added

4.26.0 (February 19, 2026)

Fixed

  • #4122 Implements a new provider config option, alwaysRender, which sets Diff_Someto true when used in combination with renderYAMLtoDirectory. This allows for user-defined opt-in behavior for YAML manifests to be idempotently generated on every pulumi up, and for Update() to show these changes to a user.

  • Fixed a race condition in StatefulSet await logic where Pulumi could incorrectly report a rollout as complete before the controller had processed the update. This occurred when Pulumi checked status fields before the controller updated observedGeneration, causing stale "ready" values to be trusted.

  • Fixed a regression of #2943 which could cause Deployments to erroneously report diffs.

Changed

4.24.0 (November 5, 2025)

Added

Changed

  • The pulumi.com/waitFor annotation now uses an RFC9535-compliant JSONPath parser. This makes it possible to wait for more complex scenarios.

    For example:

    • To wait for a Pod's status.phase to be "Running" or "Succeeded":

... (truncated)

Commits
  • 20f0c07 Prepare for v4.27.0 release (#4194)
  • c5e7ece Update module github.com/pulumi/pulumi/pkg/v3 to v3.224.0 (#4191)
  • 49c2646 helm: login to private registries (#3661)
  • b48d7a3 Fix PVC timeout on Update (#4181)
  • e3427da Automated upgrade: bump pulumi/pulumi to 3.223.0 (#4188)
  • 7af1b7e Update dependency @​pulumi/pulumi to v3.224.0 (#4189)
  • 6860aae Update module github.com/cloudflare/circl to v1.6.3 [SECURITY] (#4187)
  • 5c58fea Update GitHub Actions workflows. (#4186)
  • 1564fc1 Update module github.com/pulumi/pulumi-dotnet/pulumi-language-dotnet/v3 to v3...
  • 9ebe266 Update dependency @​pulumi/gcp to v9.13.0 (#4184)
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/pulumi/pulumi-kubernetes/sdk/v4&package-manager=go_modules&previous-version=4.25.0&new-version=4.27.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- deploy/go.mod | 37 +++++++++++++---------- deploy/go.sum | 81 ++++++++++++++++++++++++++++----------------------- 2 files changed, 65 insertions(+), 53 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index a777980..15e0dc8 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -4,7 +4,7 @@ go 1.25.6 require ( github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 - github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.25.0 + github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.27.0 github.com/pulumi/pulumi/sdk/v3 v3.225.1 gopkg.in/yaml.v2 v2.4.0 ) @@ -13,7 +13,6 @@ require ( dario.cat/mergo v1.0.0 // indirect github.com/Microsoft/go-winio v0.6.2 // indirect github.com/ProtonMail/go-crypto v1.1.6 // indirect - github.com/aead/chacha20 v0.0.0-20180709150244-8b13a72661da // indirect github.com/agext/levenshtein v1.2.3 // indirect github.com/apparentlymart/go-textseg/v13 v13.0.0 // indirect github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect @@ -22,15 +21,21 @@ require ( github.com/blang/semver v3.5.1+incompatible // indirect github.com/cenkalti/backoff/v5 v5.0.3 // indirect github.com/cespare/xxhash/v2 v2.3.0 // indirect - github.com/charmbracelet/bubbles v0.16.1 // indirect - github.com/charmbracelet/bubbletea v0.25.0 // indirect - github.com/charmbracelet/lipgloss v0.7.1 // indirect + github.com/charmbracelet/bubbles v1.0.0 // indirect + github.com/charmbracelet/bubbletea v1.3.10 // indirect + github.com/charmbracelet/colorprofile v0.4.2 // indirect + github.com/charmbracelet/lipgloss v1.1.0 // indirect + github.com/charmbracelet/x/ansi v0.11.6 // indirect + github.com/charmbracelet/x/cellbuf v0.0.15 // indirect + github.com/charmbracelet/x/term v0.2.2 // indirect github.com/cheggaaa/pb v1.0.29 // indirect + github.com/clipperhouse/displaywidth v0.10.0 // indirect + github.com/clipperhouse/uax29/v2 v2.7.0 // indirect github.com/cloudflare/circl v1.6.3 // indirect - github.com/containerd/console v1.0.4-0.20230313162750-1ae8d489ac81 // indirect github.com/cyphar/filepath-securejoin v0.4.1 // indirect github.com/djherbis/times v1.5.0 // indirect github.com/emirpasic/gods v1.18.1 // indirect + github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect github.com/go-git/go-billy/v5 v5.6.2 // indirect github.com/go-git/go-git/v5 v5.16.5 // indirect @@ -51,18 +56,17 @@ require ( github.com/json-iterator/go v1.1.12 // indirect github.com/kevinburke/ssh_config v1.2.0 // indirect github.com/klauspost/compress v1.18.0 // indirect - github.com/lucasb-eyer/go-colorful v1.2.0 // indirect + github.com/lucasb-eyer/go-colorful v1.3.0 // indirect github.com/mattn/go-isatty v0.0.20 // indirect github.com/mattn/go-localereader v0.0.1 // indirect - github.com/mattn/go-runewidth v0.0.15 // indirect + github.com/mattn/go-runewidth v0.0.20 // indirect github.com/mitchellh/go-ps v1.0.0 // indirect github.com/mitchellh/go-wordwrap v1.0.1 // indirect github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect github.com/muesli/cancelreader v0.2.2 // indirect - github.com/muesli/reflow v0.3.0 // indirect - github.com/muesli/termenv v0.15.2 // indirect + github.com/muesli/termenv v0.16.0 // indirect github.com/opentracing/basictracer-go v1.1.0 // indirect github.com/opentracing/opentracing-go v1.2.0 // indirect github.com/pgavlin/fx v0.1.6 // indirect @@ -71,19 +75,20 @@ require ( github.com/pkg/term v1.1.0 // indirect github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231 // indirect github.com/pulumi/esc v0.17.0 // indirect - github.com/rivo/uniseg v0.4.4 // indirect + github.com/rivo/uniseg v0.4.7 // indirect github.com/rogpeppe/go-internal v1.14.1 // indirect github.com/santhosh-tekuri/jsonschema/v5 v5.0.0 // indirect github.com/sergi/go-diff v1.4.0 // indirect github.com/skeema/knownhosts v1.3.1 // indirect github.com/spf13/cast v1.4.1 // indirect - github.com/spf13/cobra v1.10.1 // indirect + github.com/spf13/cobra v1.10.2 // indirect github.com/spf13/pflag v1.0.10 // indirect github.com/stretchr/objx v0.2.0 // indirect github.com/texttheater/golang-levenshtein v1.0.1 // indirect github.com/uber/jaeger-client-go v2.30.0+incompatible // indirect github.com/uber/jaeger-lib v2.4.1+incompatible // indirect github.com/xanzy/ssh-agent v0.3.3 // indirect + github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect github.com/zclconf/go-cty v1.13.2 // indirect go.opentelemetry.io/auto/sdk v1.2.1 // indirect go.opentelemetry.io/collector/featuregate v1.51.0 // indirect @@ -95,7 +100,7 @@ require ( go.opentelemetry.io/otel/sdk v1.40.0 // indirect go.opentelemetry.io/otel/trace v1.40.0 // indirect go.opentelemetry.io/proto/otlp v1.9.0 // indirect - go.uber.org/atomic v1.9.0 // indirect + go.uber.org/atomic v1.11.0 // indirect go.uber.org/multierr v1.11.0 // indirect golang.org/x/crypto v0.48.0 // indirect golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 // indirect @@ -107,10 +112,10 @@ require ( golang.org/x/text v0.34.0 // indirect golang.org/x/tools v0.41.0 // indirect google.golang.org/genproto/googleapis/api v0.0.0-20260128011058-8636f8732409 // indirect - google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409 // indirect - google.golang.org/grpc v1.78.0 // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20260217215200-42d3e9bedb6d // indirect + google.golang.org/grpc v1.79.1 // indirect google.golang.org/protobuf v1.36.11 // indirect gopkg.in/warnings.v0 v0.1.2 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect - lukechampine.com/frand v1.4.2 // indirect + lukechampine.com/frand v1.5.1 // indirect ) diff --git a/deploy/go.sum b/deploy/go.sum index 7b04a92..469e3ec 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -7,8 +7,6 @@ github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERo github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU= github.com/ProtonMail/go-crypto v1.1.6 h1:ZcV+Ropw6Qn0AX9brlQLAUXfqLBc7Bl+f/DmNxpLfdw= github.com/ProtonMail/go-crypto v1.1.6/go.mod h1:rA3QumHc/FZ8pAHreoekgiAbzpNsfQAosU5td4SnOrE= -github.com/aead/chacha20 v0.0.0-20180709150244-8b13a72661da h1:KjTM2ks9d14ZYCvmHS9iAKVt9AyzRSqNU1qabPih5BY= -github.com/aead/chacha20 v0.0.0-20180709150244-8b13a72661da/go.mod h1:eHEWzANqSiWQsof+nXEI9bUVUyV6F53Fp89EuCh2EAA= github.com/agext/levenshtein v1.2.3 h1:YB2fHEn0UJagG8T1rrWknE3ZQzWM06O8AMAatNn7lmo= github.com/agext/levenshtein v1.2.3/go.mod h1:JEDfjyjHDjOF/1e4FlBE/PkbqA9OfWu2ki2W0IB5558= github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8= @@ -29,18 +27,28 @@ github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1x github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw= github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs= github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= -github.com/charmbracelet/bubbles v0.16.1 h1:6uzpAAaT9ZqKssntbvZMlksWHruQLNxg49H5WdeuYSY= -github.com/charmbracelet/bubbles v0.16.1/go.mod h1:2QCp9LFlEsBQMvIYERr7Ww2H2bA7xen1idUDIzm/+Xc= -github.com/charmbracelet/bubbletea v0.25.0 h1:bAfwk7jRz7FKFl9RzlIULPkStffg5k6pNt5dywy4TcM= -github.com/charmbracelet/bubbletea v0.25.0/go.mod h1:EN3QDR1T5ZdWmdfDzYcqOCAps45+QIJbLOBxmVNWNNg= -github.com/charmbracelet/lipgloss v0.7.1 h1:17WMwi7N1b1rVWOjMT+rCh7sQkvDU75B2hbZpc5Kc1E= -github.com/charmbracelet/lipgloss v0.7.1/go.mod h1:yG0k3giv8Qj8edTCbbg6AlQ5e8KNWpFujkNawKNhE2c= +github.com/charmbracelet/bubbles v1.0.0 h1:12J8/ak/uCZEMQ6KU7pcfwceyjLlWsDLAxB5fXonfvc= +github.com/charmbracelet/bubbles v1.0.0/go.mod h1:9d/Zd5GdnauMI5ivUIVisuEm3ave1XwXtD1ckyV6r3E= +github.com/charmbracelet/bubbletea v1.3.10 h1:otUDHWMMzQSB0Pkc87rm691KZ3SWa4KUlvF9nRvCICw= +github.com/charmbracelet/bubbletea v1.3.10/go.mod h1:ORQfo0fk8U+po9VaNvnV95UPWA1BitP1E0N6xJPlHr4= +github.com/charmbracelet/colorprofile v0.4.2 h1:BdSNuMjRbotnxHSfxy+PCSa4xAmz7szw70ktAtWRYrY= +github.com/charmbracelet/colorprofile v0.4.2/go.mod h1:0rTi81QpwDElInthtrQ6Ni7cG0sDtwAd4C4le060fT8= +github.com/charmbracelet/lipgloss v1.1.0 h1:vYXsiLHVkK7fp74RkV7b2kq9+zDLoEU4MZoFqR/noCY= +github.com/charmbracelet/lipgloss v1.1.0/go.mod h1:/6Q8FR2o+kj8rz4Dq0zQc3vYf7X+B0binUUBwA0aL30= +github.com/charmbracelet/x/ansi v0.11.6 h1:GhV21SiDz/45W9AnV2R61xZMRri5NlLnl6CVF7ihZW8= +github.com/charmbracelet/x/ansi v0.11.6/go.mod h1:2JNYLgQUsyqaiLovhU2Rv/pb8r6ydXKS3NIttu3VGZQ= +github.com/charmbracelet/x/cellbuf v0.0.15 h1:ur3pZy0o6z/R7EylET877CBxaiE1Sp1GMxoFPAIztPI= +github.com/charmbracelet/x/cellbuf v0.0.15/go.mod h1:J1YVbR7MUuEGIFPCaaZ96KDl5NoS0DAWkskup+mOY+Q= +github.com/charmbracelet/x/term v0.2.2 h1:xVRT/S2ZcKdhhOuSP4t5cLi5o+JxklsoEObBSgfgZRk= +github.com/charmbracelet/x/term v0.2.2/go.mod h1:kF8CY5RddLWrsgVwpw4kAa6TESp6EB5y3uxGLeCqzAI= github.com/cheggaaa/pb v1.0.29 h1:FckUN5ngEk2LpvuG0fw1GEFx6LtyY2pWI/Z2QgCnEYo= github.com/cheggaaa/pb v1.0.29/go.mod h1:W40334L7FMC5JKWldsTWbdGjLo0RxUKK73K+TuPxX30= +github.com/clipperhouse/displaywidth v0.10.0 h1:GhBG8WuerxjFQQYeuZAeVTuyxuX+UraiZGD4HJQ3Y8g= +github.com/clipperhouse/displaywidth v0.10.0/go.mod h1:XqJajYsaiEwkxOj4bowCTMcT1SgvHo9flfF3jQasdbs= +github.com/clipperhouse/uax29/v2 v2.7.0 h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJv2v7Vk= +github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM= github.com/cloudflare/circl v1.6.3 h1:9GPOhQGF9MCYUeXyMYlqTR6a5gTrgR/fBLXvUgtVcg8= github.com/cloudflare/circl v1.6.3/go.mod h1:2eXP6Qfat4O/Yhh8BznvKnJ+uzEoTQ6jVKJRn81BiS4= -github.com/containerd/console v1.0.4-0.20230313162750-1ae8d489ac81 h1:q2hJAaP1k2wIvVRd/hEHD7lacgqrCPS+k8g1MndzfWY= -github.com/containerd/console v1.0.4-0.20230313162750-1ae8d489ac81/go.mod h1:YynlIjWYF8myEu6sdkwKIvGQq+cOckRm6So2avqoYAk= github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g= github.com/cyphar/filepath-securejoin v0.4.1 h1:JyxxyPEaktOD+GAnqIqTf9A8tHyAG22rowi7HkoSU1s= github.com/cyphar/filepath-securejoin v0.4.1/go.mod h1:Sdj7gXlvMcPZsbhwhQ33GguGLDGQL7h7bg04C/+u9jI= @@ -53,6 +61,8 @@ github.com/elazarl/goproxy v1.7.2 h1:Y2o6urb7Eule09PjlhQRGNsqRfPmYI3KKQLFpCAV3+o github.com/elazarl/goproxy v1.7.2/go.mod h1:82vkLNir0ALaW14Rc399OTTjyNREgmdL2cVoIbS6XaE= github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc= github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FMNAnJvWQ= +github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f h1:Y/CXytFA4m6baUTXGLOoWe4PQhGxaX0KpnayAqC48p4= +github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f/go.mod h1:vw97MGsxSvLiUE2X8qFplwetxpGLQrlU1Q9AUEIzCaM= github.com/fatih/color v1.9.0/go.mod h1:eQcE1qtQxscV5RaZvpXrrb8Drkc3/DdQ+uUYCNjL+zU= github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM= github.com/fatih/color v1.16.0/go.mod h1:fL2Sau1YI5c0pdGEVCbKQbLXB6edEj1ZgiY4NijnWvE= @@ -118,8 +128,8 @@ github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ= github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE= -github.com/lucasb-eyer/go-colorful v1.2.0 h1:1nnpGOrhyZZuNyfu1QjKiUICQ74+3FNCN69Aj6K7nkY= -github.com/lucasb-eyer/go-colorful v1.2.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0= +github.com/lucasb-eyer/go-colorful v1.3.0 h1:2/yBRLdWBZKrf7gB40FoiKfAWYQ0lqNcbuQwVHXptag= +github.com/lucasb-eyer/go-colorful v1.3.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0= github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE= github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA= github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg= @@ -130,9 +140,8 @@ github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D github.com/mattn/go-localereader v0.0.1 h1:ygSAOl7ZXTx4RdPYinUpg6W99U8jWvWi9Ye2JC/oIi4= github.com/mattn/go-localereader v0.0.1/go.mod h1:8fBrzywKY7BI3czFoHkuzRoWE9C+EiG4R1k4Cjx5p88= github.com/mattn/go-runewidth v0.0.4/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU= -github.com/mattn/go-runewidth v0.0.12/go.mod h1:RAqKPSqVFrSLVXbA8x7dzmKdmGzieGRCM46jaSJTDAk= -github.com/mattn/go-runewidth v0.0.15 h1:UNAjwbU9l54TA3KzvqLGxwWjHmMgBUVhBiTjelZgg3U= -github.com/mattn/go-runewidth v0.0.15/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w= +github.com/mattn/go-runewidth v0.0.20 h1:WcT52H91ZUAwy8+HUkdM3THM6gXqXuLJi9O3rjcQQaQ= +github.com/mattn/go-runewidth v0.0.20/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs= github.com/mitchellh/go-ps v1.0.0 h1:i6ampVEEF4wQFF+bkYfwYgY+F/uYJDktmvLPf7qIgjc= github.com/mitchellh/go-ps v1.0.0/go.mod h1:J4lOc8z8yJs6vUwklHw2XEIiT4z4C40KtWVN3nvg8Pg= github.com/mitchellh/go-wordwrap v1.0.1 h1:TLuKupo69TCn6TQSyGxwI1EblZZEsQ0vMlAFQflz0v0= @@ -147,10 +156,8 @@ github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 h1:ZK8zHtRHOkbHy6Mmr5D github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6/go.mod h1:CJlz5H+gyd6CUWT45Oy4q24RdLyn7Md9Vj2/ldJBSIo= github.com/muesli/cancelreader v0.2.2 h1:3I4Kt4BQjOR54NavqnDogx/MIoWBFa0StPA8ELUXHmA= github.com/muesli/cancelreader v0.2.2/go.mod h1:3XuTXfFS2VjM+HTLZY9Ak0l6eUKfijIfMUZ4EgX0QYo= -github.com/muesli/reflow v0.3.0 h1:IFsN6K9NfGtjeggFP+68I4chLZV2yIKsXJFNZ+eWh6s= -github.com/muesli/reflow v0.3.0/go.mod h1:pbwTDkVPibjO2kyvBQRBxTWEEGDGq0FlB1BIKtnHY/8= -github.com/muesli/termenv v0.15.2 h1:GohcuySI0QmI3wN8Ok9PtKGkgkFIk7y6Vpb5PvrY+Wo= -github.com/muesli/termenv v0.15.2/go.mod h1:Epx+iuz8sNs7mNKhxzH4fWXGNpZwUaJKRS1noLXviQ8= +github.com/muesli/termenv v0.16.0 h1:S5AlUN9dENB57rsbnkPyfdGuWIlkmzJjbFf0Tf5FWUc= +github.com/muesli/termenv v0.16.0/go.mod h1:ZRfOIKPFDYQoDFF4Olj7/QJbW60Ol/kL1pU3VfY/Cnk= github.com/onsi/gomega v1.34.1 h1:EUMJIKUjM8sKjYbtxQI9A4z2o+rruxnzNvpknOXie6k= github.com/onsi/gomega v1.34.1/go.mod h1:kU1QgUvBDLXBJq618Xvm2LUX6rSAfRaFRTcdOeDLwwY= github.com/opentracing/basictracer-go v1.1.0 h1:Oa1fTSBvAl8pa3U+IJYqrKm0NALwH9OsgwOqDv4xJW0= @@ -176,14 +183,12 @@ github.com/pulumi/esc v0.17.0 h1:oaVOIyFTENlYDuqc3pW75lQT9jb2cd6ie/4/Twxn66w= github.com/pulumi/esc v0.17.0/go.mod h1:XnSxlt5NkmuAj304l/gK4pRErFbtqq6XpfX1tYT9Jbc= github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 h1:w6OnO3d4j5yVf2vpm8OzXFC/xHOEGqt+9FjWCUBCq6U= github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1/go.mod h1:UyZyv7hz4knpFx6/Sh+SkZe6hT6sJHtDvw9A0TbvEsk= -github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.25.0 h1:N1qitmrGomEaCPsblqJHaw8Re0cqqox5V+kHsi4EEtk= -github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.25.0/go.mod h1:ACBJF6+nzUqDeRK+p2OrvykunyeHfvtbyELc6PB38fk= +github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.27.0 h1:l33vcOD62jlEIiD/POknlKrVF4JG2ZV87khzavYwkR0= +github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.27.0/go.mod h1:B998wofejDKAvvpLwsi4UMfWDFHHBnzYiM8mZ9e7OSo= github.com/pulumi/pulumi/sdk/v3 v3.225.1 h1:yn64PBZocE0Ums82fc6jaWRZthZ352BFi/tVAs5jrps= github.com/pulumi/pulumi/sdk/v3 v3.225.1/go.mod h1:kiwkjulVm9ibqTOcyrZYhaRZsDSxWpzIKPXtCFeffBE= -github.com/rivo/uniseg v0.1.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc= -github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc= -github.com/rivo/uniseg v0.4.4 h1:8TfxU8dW6PdqD27gjM8MVNuicgxIjxpm4K7x4jp8sis= -github.com/rivo/uniseg v0.4.4/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88= +github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ= +github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88= github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ= github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc= github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM= @@ -196,8 +201,8 @@ github.com/skeema/knownhosts v1.3.1 h1:X2osQ+RAjK76shCbvhHHHVl3ZlgDm8apHEHFqRjnB github.com/skeema/knownhosts v1.3.1/go.mod h1:r7KTdC8l4uxWRyK2TpQZ/1o5HaSzh06ePQNxPwTcfiY= github.com/spf13/cast v1.4.1 h1:s0hze+J0196ZfEMTs80N7UlFt0BDuQ7Q+JDnHiMWKdA= github.com/spf13/cast v1.4.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE= -github.com/spf13/cobra v1.10.1 h1:lJeBwCfmrnXthfAupyUTzJ/J4Nc1RsHC/mSRU2dll/s= -github.com/spf13/cobra v1.10.1/go.mod h1:7SmJGaTHFVBY0jW4NXGluQoLvhqFQM+6XSKD+P4XaB0= +github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU= +github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4= github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk= github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= @@ -218,6 +223,8 @@ github.com/uber/jaeger-lib v2.4.1+incompatible h1:td4jdvLcExb4cBISKIpHuGoVXh+dVK github.com/uber/jaeger-lib v2.4.1+incompatible/go.mod h1:ComeNDZlWwrWnDv8aPp0Ba6+uUTzImX/AauajbLI56U= github.com/xanzy/ssh-agent v0.3.3 h1:+/15pJfg/RsTxqYcX6fHqOXZwwMP+2VyYWJeWM2qQFM= github.com/xanzy/ssh-agent v0.3.3/go.mod h1:6dzNDKs0J9rVPHPhaGCukekBHKqfl+L3KghI1Bc68Uw= +github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no= +github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM= github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= github.com/zclconf/go-cty v1.13.2 h1:4GvrUxe/QUDYuJKAav4EYqdM47/kZa672LwmXFmEKT0= @@ -252,12 +259,13 @@ go.opentelemetry.io/proto/slim/otlp/collector/profiles/v1development v0.2.0 h1:o go.opentelemetry.io/proto/slim/otlp/collector/profiles/v1development v0.2.0/go.mod h1:Gyb6Xe7FTi/6xBHwMmngGoHqL0w29Y4eW8TGFzpefGA= go.opentelemetry.io/proto/slim/otlp/profiles/v1development v0.2.0 h1:EiUYvtwu6PMrMHVjcPfnsG3v+ajPkbUeH+IL93+QYyk= go.opentelemetry.io/proto/slim/otlp/profiles/v1development v0.2.0/go.mod h1:mUUHKFiN2SST3AhJ8XhJxEoeVW12oqfXog0Bo8W3Ec4= -go.uber.org/atomic v1.9.0 h1:ECmE8Bn/WFTYwEW/bpKD3M8VtR/zQVbavAoalC1PYyE= -go.uber.org/atomic v1.9.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc= +go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE= +go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0= go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE= go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0= go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y= +go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= @@ -288,7 +296,6 @@ golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI= golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20190626221950-04f50cda93cb/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200909081042-eff7692f9009/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= @@ -297,8 +304,8 @@ golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7w golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k= golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= @@ -326,10 +333,10 @@ gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk= gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E= google.golang.org/genproto/googleapis/api v0.0.0-20260128011058-8636f8732409 h1:merA0rdPeUV3YIIfHHcH4qBkiQAc1nfCKSI7lB4cV2M= google.golang.org/genproto/googleapis/api v0.0.0-20260128011058-8636f8732409/go.mod h1:fl8J1IvUjCilwZzQowmw2b7HQB2eAuYBabMXzWurF+I= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409 h1:H86B94AW+VfJWDqFeEbBPhEtHzJwJfTbgE2lZa54ZAQ= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409/go.mod h1:j9x/tPzZkyxcgEFkiKEEGxfvyumM01BEtsW8xzOahRQ= -google.golang.org/grpc v1.78.0 h1:K1XZG/yGDJnzMdd/uZHAkVqJE+xIDOcmdSFZkBUicNc= -google.golang.org/grpc v1.78.0/go.mod h1:I47qjTo4OKbMkjA/aOOwxDIiPSBofUtQUI5EfpWvW7U= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260217215200-42d3e9bedb6d h1:t/LOSXPJ9R0B6fnZNyALBRfZBH0Uy0gT+uR+SJ6syqQ= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260217215200-42d3e9bedb6d/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= +google.golang.org/grpc v1.79.1 h1:zGhSi45ODB9/p3VAawt9a+O/MULLl9dpizzNNpq7flY= +google.golang.org/grpc v1.79.1/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ= google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE= google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= @@ -343,7 +350,7 @@ gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY= gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= -lukechampine.com/frand v1.4.2 h1:RzFIpOvkMXuPMBb9maa4ND4wjBn71E1Jpf8BzJHMaVw= -lukechampine.com/frand v1.4.2/go.mod h1:4S/TM2ZgrKejMcKMbeLjISpJMO+/eZ1zu3vYX9dtj3s= +lukechampine.com/frand v1.5.1 h1:fg0eRtdmGFIxhP5zQJzM1lFDbD6CUfu/f+7WgAZd5/w= +lukechampine.com/frand v1.5.1/go.mod h1:4VstaWc2plN4Mjr10chUD46RAVGWhpkZ5Nja8+Azp0Q= pgregory.net/rapid v0.6.1 h1:4eyrDxyht86tT4Ztm+kvlyNBLIk071gR+ZQdhphc9dQ= pgregory.net/rapid v0.6.1/go.mod h1:PY5XlDGj0+V1FCq0o192FdRhpKHGTRIWBgqjDBTrq04= From de6e9839ec5550deb8f058c9709945344250d16b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 6 Mar 2026 02:16:23 +0200 Subject: [PATCH 120/313] build(deps): bump the opentelemetry group with 6 updates (#1025) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps the opentelemetry group with 6 updates: | Package | From | To | | --- | --- | --- | | [go.opentelemetry.io/contrib/instrumentation/runtime](https://github.com/open-telemetry/opentelemetry-go-contrib) | `0.65.0` | `0.66.0` | | [go.opentelemetry.io/otel](https://github.com/open-telemetry/opentelemetry-go) | `1.40.0` | `1.41.0` | | [go.opentelemetry.io/otel/exporters/prometheus](https://github.com/open-telemetry/opentelemetry-go) | `0.62.0` | `0.63.0` | | [go.opentelemetry.io/otel/metric](https://github.com/open-telemetry/opentelemetry-go) | `1.40.0` | `1.41.0` | | [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go) | `1.40.0` | `1.41.0` | | [go.opentelemetry.io/otel/sdk/metric](https://github.com/open-telemetry/opentelemetry-go) | `1.40.0` | `1.41.0` | Updates `go.opentelemetry.io/contrib/instrumentation/runtime` from 0.65.0 to 0.66.0
Release notes

Sourced from go.opentelemetry.io/contrib/instrumentation/runtime's releases.

v1.41.0/v2.3.0/v0.66.0/v0.35.0/v0.21.0/v0.16.0/v0.14.0/v0.13.0

This release is the last to support Go 1.24. The next release will require at least Go 1.25.

Added

  • Add WithSpanKind option in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc to override the default span kind. (#8506)
  • Add const Version in go.opentelemetry.io/contrib/bridges/otelzap. (#8544)
  • Support testing of Go 1.26. (#8549)
  • Add const Version in go.opentelemetry.io/contrib/detectors/autodetect. (#8555)
  • Add const Version in go.opentelemetry.io/contrib/detectors/azure/azurevm. (#8553)
  • Add const Version in go.opentelemetry.io/contrib/processors/baggagecopy. (#8557)
  • Add const Version in go.opentelemetry.io/contrib/detectors/aws/lambda. (#8510)
  • Add const Version in go.opentelemetry.io/contrib/propagators/autoprop. (#8488)
  • Add const Version in go.opentelemetry.io/contrib/processors/minsev. (#8590)
  • Add const Version in go.opentelemetry.io/contrib/exporters/autoexport. (#8612)

Fixed

  • Change the rpc.server.call.duration metric value from milliseconds to seconds in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc. (#8509)
  • Change the rpc.response.status_code attribute to the canonical UPPER_SNAKE_CASE format in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc. (#8565)
  • Enforce that client_certificate_file and client_key_file are provided together in go.opentelemetry.io/contrib/otelconf. (#8450)
  • Fix broken CSS and JavaScript CDN URLs in go.opentelemetry.io/contrib/zpages by replacing the inaccessible code.getmdl.io CDN with cdnjs.cloudflare.com. (#8502)
  • Use Prometheus translation strategy instead of deprecated funcs in go.opentelemetry.io/contrib/otelconf. (#8595)

Removed

  • Remove the deprecated zipkin exporter example in go.opentelemetry.io/contrib/examples/zipkin. (#8501)

Changed

  • Reduce allocations in the generated HTTP internal/semconv packages. (#8511) Updated modules include:
    • go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful
    • go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin
    • go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux
    • go.opentelemetry.io/contrib/instrumentation/github.com/labstack/echo/otelecho
    • go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
    • go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
  • Update the configuration schema used in go.opentelemetry.io/contrib/otelconf to rc.3. (#8505)

Deprecated

  • WithMetricAttributesFn in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp is deprecated and will be removed in a future release. Use Labeler instead. (#8587)

What's Changed

... (truncated)

Changelog

Sourced from go.opentelemetry.io/contrib/instrumentation/runtime's changelog.

[1.41.0/2.3.0/0.66.0/0.35.0/0.21.0/0.16.0/0.14.0/0.13.0] - 2026-03-02

This release is the last to support [Go 1.24]. The next release will require at least [Go 1.25].

Added

  • Add WithSpanKind option in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc to override the default span kind. (#8506)
  • Add const Version in go.opentelemetry.io/contrib/bridges/otelzap. (#8544)
  • Support testing of [Go 1.26]. (#8549)
  • Add const Version in go.opentelemetry.io/contrib/detectors/autodetect. (#8555)
  • Add const Version in go.opentelemetry.io/contrib/detectors/azure/azurevm. (#8553)
  • Add const Version in go.opentelemetry.io/contrib/processors/baggagecopy. (#8557)
  • Add const Version in go.opentelemetry.io/contrib/detectors/aws/lambda. (#8510)
  • Add const Version in go.opentelemetry.io/contrib/propagators/autoprop. (#8488)
  • Add const Version in go.opentelemetry.io/contrib/processors/minsev. (#8590)
  • Add const Version in go.opentelemetry.io/contrib/exporters/autoexport. (#8612)

Fixed

  • Change the rpc.server.call.duration metric value from milliseconds to seconds in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc. (#8509)
  • Change the rpc.response.status_code attribute to the canonical UPPER_SNAKE_CASE format in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc. (#8565)
  • Enforce that client_certificate_file and client_key_file are provided together in go.opentelemetry.io/contrib/otelconf. (#8450)
  • Fix broken CSS and JavaScript CDN URLs in go.opentelemetry.io/contrib/zpages by replacing the inaccessible code.getmdl.io CDN with cdnjs.cloudflare.com. (#8502)
  • Use Prometheus translation strategy instead of deprecated funcs in go.opentelemetry.io/contrib/otelconf. (#8595)

Removed

  • Remove the deprecated zipkin exporter example in go.opentelemetry.io/contrib/examples/zipkin. (#8501)

Changed

  • Reduce allocations in the generated HTTP internal/semconv packages. (#8511) Updated modules include:
    • go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful
    • go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin
    • go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux
    • go.opentelemetry.io/contrib/instrumentation/github.com/labstack/echo/otelecho
    • go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
    • go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
  • Update the configuration schema used in go.opentelemetry.io/contrib/otelconf to rc.3. (#8505)

Deprecated

  • WithMetricAttributesFn in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp is deprecated and will be removed in a future release. Use Labeler instead. (#8587)
Commits
  • 07fa424 Release 1.41.0/2.3.0/0.66.0/0.35.0/0.21.0/0.16.0/0.14.0/0.13.0 (#8617)
  • f64d6bb HTTP instrumentations cleanup (#8532)
  • 5995ae8 add version file for Autodetect detector (#8555)
  • c0aa7c9 internal/shared/semconv: Reduce allocations (#8511)
  • e81a2b4 otelgrpc: Use canonical string status codes (#8565)
  • 8096a3e otelhttp: Deprecate WithMetricAttributesFn in favor of Labeler (#8587)
  • 2dce245 otelconf: use translation strategy instead of deprecated funcs (#8595)
  • d2a5807 Add version file for autoexport module (#8612)
  • 52dd987 ci: add govulncheck job to CI workflow and update lint target (#8613)
  • c4223d5 chore(deps): update prom/prometheus docker tag to v3.10.0 (#8603)
  • Additional commits viewable in compare view

Updates `go.opentelemetry.io/otel` from 1.40.0 to 1.41.0
Changelog

Sourced from go.opentelemetry.io/otel's changelog.

[1.41.0/0.63.0/0.17.0/0.0.15] 2026-03-02

This release is the last to support [Go 1.24]. The next release will require at least [Go 1.25].

Added

  • Support testing of [Go 1.26]. (#7902)

Fixed

  • Update Baggage in go.opentelemetry.io/otel/propagation and Parse and New in go.opentelemetry.io/otel/baggage to comply with W3C Baggage specification limits. New and Parse now return partial baggage along with an error when limits are exceeded. Errors from baggage extraction are reported to the global error handler. (#7880)
  • Return an error when the endpoint is configured as insecure and with TLS configuration in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#7914)
  • Return an error when the endpoint is configured as insecure and with TLS configuration in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp. (#7914)
  • Return an error when the endpoint is configured as insecure and with TLS configuration in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#7914)
Commits
  • 4575a97 Release 1.41.0/0.63.0/0.17.0/0.0.15 (#7977)
  • 66fc10d fix: add error handling for insecure HTTP endpoints with TLS client configura...
  • 76e6eec chore(deps): update github/codeql-action action to v4.32.5 (#7980)
  • 0d50f90 Revert "Generate semconv/v1.40.0" (#7978)
  • c38a4a5 Generate semconv/v1.40.0 (#7929)
  • 0f1a224 chore(deps): update module github.com/securego/gosec/v2 to v2.23.0 (#7899)
  • c79ebf4 chore(deps): update module github.com/daixiang0/gci to v0.14.0 (#7973)
  • f758157 chore(deps): update module github.com/sonatard/noctx to v0.5.0 (#7968)
  • 92a1164 fix(deps): update github.com/opentracing-contrib/go-grpc/test digest to d566b...
  • 3cd7c27 chore(deps): update module github.com/protonmail/go-crypto to v1.4.0 (#7969)
  • Additional commits viewable in compare view

Updates `go.opentelemetry.io/otel/exporters/prometheus` from 0.62.0 to 0.63.0
Release notes

Sourced from go.opentelemetry.io/otel/exporters/prometheus's releases.

v1.41.0/v0.63.0/v0.17.0/v0.0.15

This release is the last to support Go 1.24. The next release will require at least Go 1.25.

Added

Fixed

  • Update Baggage in go.opentelemetry.io/otel/propagation and Parse and New in go.opentelemetry.io/otel/baggage to comply with W3C Baggage specification limits. New and Parse now return partial baggage along with an error when limits are exceeded. Errors from baggage extraction are reported to the global error handler. (#7880)

What's Changed

... (truncated)

Changelog

Sourced from go.opentelemetry.io/otel/exporters/prometheus's changelog.

[1.41.0/0.63.0/0.17.0/0.0.15] 2026-03-02

This release is the last to support [Go 1.24]. The next release will require at least [Go 1.25].

Added

  • Support testing of [Go 1.26]. (#7902)

Fixed

  • Update Baggage in go.opentelemetry.io/otel/propagation and Parse and New in go.opentelemetry.io/otel/baggage to comply with W3C Baggage specification limits. New and Parse now return partial baggage along with an error when limits are exceeded. Errors from baggage extraction are reported to the global error handler. (#7880)
  • Return an error when the endpoint is configured as insecure and with TLS configuration in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#7914)
  • Return an error when the endpoint is configured as insecure and with TLS configuration in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp. (#7914)
  • Return an error when the endpoint is configured as insecure and with TLS configuration in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#7914)
Commits
  • 4575a97 Release 1.41.0/0.63.0/0.17.0/0.0.15 (#7977)
  • 66fc10d fix: add error handling for insecure HTTP endpoints with TLS client configura...
  • 76e6eec chore(deps): update github/codeql-action action to v4.32.5 (#7980)
  • 0d50f90 Revert "Generate semconv/v1.40.0" (#7978)
  • c38a4a5 Generate semconv/v1.40.0 (#7929)
  • 0f1a224 chore(deps): update module github.com/securego/gosec/v2 to v2.23.0 (#7899)
  • c79ebf4 chore(deps): update module github.com/daixiang0/gci to v0.14.0 (#7973)
  • f758157 chore(deps): update module github.com/sonatard/noctx to v0.5.0 (#7968)
  • 92a1164 fix(deps): update github.com/opentracing-contrib/go-grpc/test digest to d566b...
  • 3cd7c27 chore(deps): update module github.com/protonmail/go-crypto to v1.4.0 (#7969)
  • Additional commits viewable in compare view

Updates `go.opentelemetry.io/otel/metric` from 1.40.0 to 1.41.0
Changelog

Sourced from go.opentelemetry.io/otel/metric's changelog.

[1.41.0/0.63.0/0.17.0/0.0.15] 2026-03-02

This release is the last to support [Go 1.24]. The next release will require at least [Go 1.25].

Added

  • Support testing of [Go 1.26]. (#7902)

Fixed

  • Update Baggage in go.opentelemetry.io/otel/propagation and Parse and New in go.opentelemetry.io/otel/baggage to comply with W3C Baggage specification limits. New and Parse now return partial baggage along with an error when limits are exceeded. Errors from baggage extraction are reported to the global error handler. (#7880)
  • Return an error when the endpoint is configured as insecure and with TLS configuration in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#7914)
  • Return an error when the endpoint is configured as insecure and with TLS configuration in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp. (#7914)
  • Return an error when the endpoint is configured as insecure and with TLS configuration in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#7914)
Commits
  • 4575a97 Release 1.41.0/0.63.0/0.17.0/0.0.15 (#7977)
  • 66fc10d fix: add error handling for insecure HTTP endpoints with TLS client configura...
  • 76e6eec chore(deps): update github/codeql-action action to v4.32.5 (#7980)
  • 0d50f90 Revert "Generate semconv/v1.40.0" (#7978)
  • c38a4a5 Generate semconv/v1.40.0 (#7929)
  • 0f1a224 chore(deps): update module github.com/securego/gosec/v2 to v2.23.0 (#7899)
  • c79ebf4 chore(deps): update module github.com/daixiang0/gci to v0.14.0 (#7973)
  • f758157 chore(deps): update module github.com/sonatard/noctx to v0.5.0 (#7968)
  • 92a1164 fix(deps): update github.com/opentracing-contrib/go-grpc/test digest to d566b...
  • 3cd7c27 chore(deps): update module github.com/protonmail/go-crypto to v1.4.0 (#7969)
  • Additional commits viewable in compare view

Updates `go.opentelemetry.io/otel/sdk` from 1.40.0 to 1.41.0
Changelog

Sourced from go.opentelemetry.io/otel/sdk's changelog.

[1.41.0/0.63.0/0.17.0/0.0.15] 2026-03-02

This release is the last to support [Go 1.24]. The next release will require at least [Go 1.25].

Added

  • Support testing of [Go 1.26]. (#7902)

Fixed

  • Update Baggage in go.opentelemetry.io/otel/propagation and Parse and New in go.opentelemetry.io/otel/baggage to comply with W3C Baggage specification limits. New and Parse now return partial baggage along with an error when limits are exceeded. Errors from baggage extraction are reported to the global error handler. (#7880)
  • Return an error when the endpoint is configured as insecure and with TLS configuration in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#7914)
  • Return an error when the endpoint is configured as insecure and with TLS configuration in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp. (#7914)
  • Return an error when the endpoint is configured as insecure and with TLS configuration in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#7914)
Commits
  • 4575a97 Release 1.41.0/0.63.0/0.17.0/0.0.15 (#7977)
  • 66fc10d fix: add error handling for insecure HTTP endpoints with TLS client configura...
  • 76e6eec chore(deps): update github/codeql-action action to v4.32.5 (#7980)
  • 0d50f90 Revert "Generate semconv/v1.40.0" (#7978)
  • c38a4a5 Generate semconv/v1.40.0 (#7929)
  • 0f1a224 chore(deps): update module github.com/securego/gosec/v2 to v2.23.0 (#7899)
  • c79ebf4 chore(deps): update module github.com/daixiang0/gci to v0.14.0 (#7973)
  • f758157 chore(deps): update module github.com/sonatard/noctx to v0.5.0 (#7968)
  • 92a1164 fix(deps): update github.com/opentracing-contrib/go-grpc/test digest to d566b...
  • 3cd7c27 chore(deps): update module github.com/protonmail/go-crypto to v1.4.0 (#7969)
  • Additional commits viewable in compare view

Updates `go.opentelemetry.io/otel/sdk/metric` from 1.40.0 to 1.41.0
Changelog

Sourced from go.opentelemetry.io/otel/sdk/metric's changelog.

[1.41.0/0.63.0/0.17.0/0.0.15] 2026-03-02

This release is the last to support [Go 1.24]. The next release will require at least [Go 1.25].

Added

  • Support testing of [Go 1.26]. (#7902)

Fixed

  • Update Baggage in go.opentelemetry.io/otel/propagation and Parse and New in go.opentelemetry.io/otel/baggage to comply with W3C Baggage specification limits. New and Parse now return partial baggage along with an error when limits are exceeded. Errors from baggage extraction are reported to the global error handler. (#7880)
  • Return an error when the endpoint is configured as insecure and with TLS configuration in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#7914)
  • Return an error when the endpoint is configured as insecure and with TLS configuration in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp. (#7914)
  • Return an error when the endpoint is configured as insecure and with TLS configuration in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#7914)
Commits
  • 4575a97 Release 1.41.0/0.63.0/0.17.0/0.0.15 (#7977)
  • 66fc10d fix: add error handling for insecure HTTP endpoints with TLS client configura...
  • 76e6eec chore(deps): update github/codeql-action action to v4.32.5 (#7980)
  • 0d50f90 Revert "Generate semconv/v1.40.0" (#7978)
  • c38a4a5 Generate semconv/v1.40.0 (#7929)
  • 0f1a224 chore(deps): update module github.com/securego/gosec/v2 to v2.23.0 (#7899)
  • c79ebf4 chore(deps): update module github.com/daixiang0/gci to v0.14.0 (#7973)
  • f758157 chore(deps): update module github.com/sonatard/noctx to v0.5.0 (#7968)
  • 92a1164 fix(deps): update github.com/opentracing-contrib/go-grpc/test digest to d566b...
  • 3cd7c27 chore(deps): update module github.com/protonmail/go-crypto to v1.4.0 (#7969)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 16 ++++++++-------- go.sum | 32 ++++++++++++++++---------------- 2 files changed, 24 insertions(+), 24 deletions(-) diff --git a/go.mod b/go.mod index aede38c..6073d11 100644 --- a/go.mod +++ b/go.mod @@ -16,12 +16,12 @@ require ( github.com/rs/cors v1.11.1 github.com/santhosh-tekuri/jsonschema/v5 v5.3.1 github.com/stretchr/testify v1.11.1 - go.opentelemetry.io/contrib/instrumentation/runtime v0.65.0 - go.opentelemetry.io/otel v1.40.0 - go.opentelemetry.io/otel/exporters/prometheus v0.62.0 - go.opentelemetry.io/otel/metric v1.40.0 - go.opentelemetry.io/otel/sdk v1.40.0 - go.opentelemetry.io/otel/sdk/metric v1.40.0 + go.opentelemetry.io/contrib/instrumentation/runtime v0.66.0 + go.opentelemetry.io/otel v1.41.0 + go.opentelemetry.io/otel/exporters/prometheus v0.63.0 + go.opentelemetry.io/otel/metric v1.41.0 + go.opentelemetry.io/otel/sdk v1.41.0 + go.opentelemetry.io/otel/sdk/metric v1.41.0 golang.org/x/mod v0.33.0 gopkg.in/yaml.v3 v3.0.1 ) @@ -72,13 +72,13 @@ require ( go.opentelemetry.io/auto/sdk v1.2.1 // indirect go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 // indirect go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect - go.opentelemetry.io/otel/trace v1.40.0 // indirect + go.opentelemetry.io/otel/trace v1.41.0 // indirect go.yaml.in/yaml/v2 v2.4.3 // indirect golang.org/x/crypto v0.46.0 // indirect golang.org/x/net v0.48.0 // indirect golang.org/x/oauth2 v0.34.0 // indirect golang.org/x/sync v0.19.0 // indirect - golang.org/x/sys v0.40.0 // indirect + golang.org/x/sys v0.41.0 // indirect golang.org/x/text v0.32.0 // indirect golang.org/x/time v0.14.0 // indirect google.golang.org/api v0.256.0 // indirect diff --git a/go.sum b/go.sum index 16602d6..99372b3 100644 --- a/go.sum +++ b/go.sum @@ -146,20 +146,20 @@ go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.6 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0/go.mod h1:snMWehoOh2wsEwnvvwtDyFCxVeDAODenXHtn5vzrKjo= go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 h1:F7Jx+6hwnZ41NSFTO5q4LYDtJRXBf2PD0rNBkeB/lus= go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0/go.mod h1:UHB22Z8QsdRDrnAtX4PntOl36ajSxcdUMt1sF7Y6E7Q= -go.opentelemetry.io/contrib/instrumentation/runtime v0.65.0 h1:n8qdwrebNEHF/zHpueuZ4OacdJ8CdSaP7xef9WRZXTQ= -go.opentelemetry.io/contrib/instrumentation/runtime v0.65.0/go.mod h1:Z1pjGxUL3nJ/IbDDfL6rBD0Xbz7ZOViRqrIUg4l1CYE= -go.opentelemetry.io/otel v1.40.0 h1:oA5YeOcpRTXq6NN7frwmwFR0Cn3RhTVZvXsP4duvCms= -go.opentelemetry.io/otel v1.40.0/go.mod h1:IMb+uXZUKkMXdPddhwAHm6UfOwJyh4ct1ybIlV14J0g= -go.opentelemetry.io/otel/exporters/prometheus v0.62.0 h1:krvC4JMfIOVdEuNPTtQ0ZjCiXrybhv+uOHMfHRmnvVo= -go.opentelemetry.io/otel/exporters/prometheus v0.62.0/go.mod h1:fgOE6FM/swEnsVQCqCnbOfRV4tOnWPg7bVeo4izBuhQ= -go.opentelemetry.io/otel/metric v1.40.0 h1:rcZe317KPftE2rstWIBitCdVp89A2HqjkxR3c11+p9g= -go.opentelemetry.io/otel/metric v1.40.0/go.mod h1:ib/crwQH7N3r5kfiBZQbwrTge743UDc7DTFVZrrXnqc= -go.opentelemetry.io/otel/sdk v1.40.0 h1:KHW/jUzgo6wsPh9At46+h4upjtccTmuZCFAc9OJ71f8= -go.opentelemetry.io/otel/sdk v1.40.0/go.mod h1:Ph7EFdYvxq72Y8Li9q8KebuYUr2KoeyHx0DRMKrYBUE= -go.opentelemetry.io/otel/sdk/metric v1.40.0 h1:mtmdVqgQkeRxHgRv4qhyJduP3fYJRMX4AtAlbuWdCYw= -go.opentelemetry.io/otel/sdk/metric v1.40.0/go.mod h1:4Z2bGMf0KSK3uRjlczMOeMhKU2rhUqdWNoKcYrtcBPg= -go.opentelemetry.io/otel/trace v1.40.0 h1:WA4etStDttCSYuhwvEa8OP8I5EWu24lkOzp+ZYblVjw= -go.opentelemetry.io/otel/trace v1.40.0/go.mod h1:zeAhriXecNGP/s2SEG3+Y8X9ujcJOTqQ5RgdEJcawiA= +go.opentelemetry.io/contrib/instrumentation/runtime v0.66.0 h1:JruBNmrPELWjR+PU3fsQBFQRYtsMLQ/zPfbvwDz9I/w= +go.opentelemetry.io/contrib/instrumentation/runtime v0.66.0/go.mod h1:vwNrfL6w1uAE3qX48KFii2Qoqf+NEDP5wNjus+RHz8Y= +go.opentelemetry.io/otel v1.41.0 h1:YlEwVsGAlCvczDILpUXpIpPSL/VPugt7zHThEMLce1c= +go.opentelemetry.io/otel v1.41.0/go.mod h1:Yt4UwgEKeT05QbLwbyHXEwhnjxNO6D8L5PQP51/46dE= +go.opentelemetry.io/otel/exporters/prometheus v0.63.0 h1:OLo1FNb0pBZykLqbKRZolKtGZd0Waqlr240YdMEnhhg= +go.opentelemetry.io/otel/exporters/prometheus v0.63.0/go.mod h1:8yeQAdhrK5xsWuFehO13Dk/Xb9FuhZoVpJfpoNCfJnw= +go.opentelemetry.io/otel/metric v1.41.0 h1:rFnDcs4gRzBcsO9tS8LCpgR0dxg4aaxWlJxCno7JlTQ= +go.opentelemetry.io/otel/metric v1.41.0/go.mod h1:xPvCwd9pU0VN8tPZYzDZV/BMj9CM9vs00GuBjeKhJps= +go.opentelemetry.io/otel/sdk v1.41.0 h1:YPIEXKmiAwkGl3Gu1huk1aYWwtpRLeskpV+wPisxBp8= +go.opentelemetry.io/otel/sdk v1.41.0/go.mod h1:ahFdU0G5y8IxglBf0QBJXgSe7agzjE4GiTJ6HT9ud90= +go.opentelemetry.io/otel/sdk/metric v1.41.0 h1:siZQIYBAUd1rlIWQT2uCxWJxcCO7q3TriaMlf08rXw8= +go.opentelemetry.io/otel/sdk/metric v1.41.0/go.mod h1:HNBuSvT7ROaGtGI50ArdRLUnvRTRGniSUZbxiWxSO8Y= +go.opentelemetry.io/otel/trace v1.41.0 h1:Vbk2co6bhj8L59ZJ6/xFTskY+tGAbOnCtQGVVa9TIN0= +go.opentelemetry.io/otel/trace v1.41.0/go.mod h1:U1NU4ULCoxeDKc09yCWdWe+3QoyweJcISEVa1RBzOis= go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE= go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0= @@ -176,8 +176,8 @@ golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4= golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI= golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.40.0 h1:DBZZqJ2Rkml6QMQsZywtnjnnGvHza6BTfYFWY9kjEWQ= -golang.org/x/sys v0.40.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= +golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k= +golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= golang.org/x/text v0.32.0 h1:ZD01bjUt1FQ9WJ0ClOL5vxgxOI/sVCNgX1YtKwcY0mU= golang.org/x/text v0.32.0/go.mod h1:o/rUWzghvpD5TXrTIBuJU77MTaN0ljMWE47kxGJQ7jY= golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI= From 6c500c52e3c6fa77cdd2ac17f6d6211328f7ca31 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 6 Mar 2026 02:25:23 +0200 Subject: [PATCH 121/313] build(deps): bump cloud.google.com/go/kms from 1.25.0 to 1.26.0 (#985) Bumps [cloud.google.com/go/kms](https://github.com/googleapis/google-cloud-go) from 1.25.0 to 1.26.0.
Release notes

Sourced from cloud.google.com/go/kms's releases.

retail 1.26.0

1.26.0 (2026-01-29)

Features

  • add a user_attributes field in SearchRequest that can be used for personalization (PiperOrigin-RevId: 861314205) (d8ea738a)

  • add a model_scores field in SearchResponse.results to expose model quality signals (PiperOrigin-RevId: 861314205) (d8ea738a)

kms: v1.26.0

v1.26.0 (2026-02-19)

Features

  • Introduced the RetiredResource resource to track records of deleted keys and prevent the reuse of their resource names (PiperOrigin-RevId: 868670725) (d3eb851d)

  • Added ListRetiredResources and GetRetiredResource RPCs to manage and view these records (PiperOrigin-RevId: 868670725) (d3eb851d)

  • Added DeleteCryptoKey and DeleteCryptoKeyVersion RPCs to permanently remove resources (PiperOrigin-RevId: 868670725) (d3eb851d)

  • Add KeyProjectResolutionMode to AutokeyConfig to support project-level configurations (PiperOrigin-RevId: 870858133) (d3eb851d)

  • Add support for project level key usage tracking (PiperOrigin-RevId: 871667322) (d3eb851d)

  • Add more post-quantum (PQ) signature algorithms to CryptoKeyVersion (PiperOrigin-RevId: 870858133) (d3eb851d)

Documentation

  • Clarify supported resources for the crypto_key_backend field in ImportJob (PiperOrigin-RevId: 870858133) (d3eb851d)

  • Update documentation for AutokeyAdmin service and messages to support folder and project-level configurations (PiperOrigin-RevId: 870858133) (d3eb851d)

Changelog

Sourced from cloud.google.com/go/kms's changelog.

1.26.0 (2024-02-21)

Features

  • documentai: A new field schema_override is added to message ProcessOptions (#9400) (a86aa8e)
  • documentai: A new message FoundationModelTuningOptions is added (7e6c208)
Commits
  • 8ebb896 chore: librarian release pull request: 20251010T200657Z (#13107)
  • befb302 test(internal/postprocessor): skip test that expects certain live config (#13...
  • 1930511 testing(internal/godocfx): convert equality check to a diff check (#13089)
  • e6b9d41 chore: migrate compute/metadata to Librarian (#13009)
  • 6259aee fix(storage): skip download of file outside of target dir (#12945)
  • bafd691 perf(bigtable): parallelize the exportTimeSeries function (#13004)
  • 2b75879 chore: release main (#13082)
  • 9157a71 chore: bump changed modules (#13083)
  • a93d961 fix: upgrade gRPC service registration func (#13079)
  • 75c95f3 chore: librarian generate pull request: 20251009T073841Z (#13080)
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=cloud.google.com/go/kms&package-manager=go_modules&previous-version=1.25.0&new-version=1.26.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 28 ++++++++++++------------- go.sum | 66 +++++++++++++++++++++++++++++----------------------------- 2 files changed, 47 insertions(+), 47 deletions(-) diff --git a/go.mod b/go.mod index 6073d11..8ad2338 100644 --- a/go.mod +++ b/go.mod @@ -3,7 +3,7 @@ module github.com/modelcontextprotocol/registry go 1.24.13 require ( - cloud.google.com/go/kms v1.25.0 + cloud.google.com/go/kms v1.26.0 github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.4.0 github.com/caarlos0/env/v11 v11.4.0 @@ -27,12 +27,12 @@ require ( ) require ( - cloud.google.com/go v0.121.6 // indirect - cloud.google.com/go/auth v0.17.0 // indirect + cloud.google.com/go v0.123.0 // indirect + cloud.google.com/go/auth v0.18.1 // indirect cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect cloud.google.com/go/compute/metadata v0.9.0 // indirect cloud.google.com/go/iam v1.5.3 // indirect - cloud.google.com/go/longrunning v0.7.0 // indirect + cloud.google.com/go/longrunning v0.8.0 // indirect github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0 // indirect github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 // indirect github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0 // indirect @@ -50,8 +50,8 @@ require ( github.com/go-logr/stdr v1.2.2 // indirect github.com/google/s2a-go v0.1.9 // indirect github.com/google/uuid v1.6.0 // indirect - github.com/googleapis/enterprise-certificate-proxy v0.3.7 // indirect - github.com/googleapis/gax-go/v2 v2.15.0 // indirect + github.com/googleapis/enterprise-certificate-proxy v0.3.11 // indirect + github.com/googleapis/gax-go/v2 v2.17.0 // indirect github.com/jackc/pgpassfile v1.0.0 // indirect github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect github.com/jackc/puddle/v2 v2.2.2 // indirect @@ -74,17 +74,17 @@ require ( go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect go.opentelemetry.io/otel/trace v1.41.0 // indirect go.yaml.in/yaml/v2 v2.4.3 // indirect - golang.org/x/crypto v0.46.0 // indirect - golang.org/x/net v0.48.0 // indirect + golang.org/x/crypto v0.47.0 // indirect + golang.org/x/net v0.49.0 // indirect golang.org/x/oauth2 v0.34.0 // indirect golang.org/x/sync v0.19.0 // indirect golang.org/x/sys v0.41.0 // indirect - golang.org/x/text v0.32.0 // indirect + golang.org/x/text v0.33.0 // indirect golang.org/x/time v0.14.0 // indirect - google.golang.org/api v0.256.0 // indirect - google.golang.org/genproto v0.0.0-20250603155806-513f23925822 // indirect - google.golang.org/genproto/googleapis/api v0.0.0-20251111163417-95abcf5c77ba // indirect - google.golang.org/genproto/googleapis/rpc v0.0.0-20251103181224-f26f9409b101 // indirect - google.golang.org/grpc v1.76.0 // indirect + google.golang.org/api v0.265.0 // indirect + google.golang.org/genproto v0.0.0-20260128011058-8636f8732409 // indirect + google.golang.org/genproto/googleapis/api v0.0.0-20260203192932-546029d2fa20 // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409 // indirect + google.golang.org/grpc v1.78.0 // indirect google.golang.org/protobuf v1.36.11 // indirect ) diff --git a/go.sum b/go.sum index 99372b3..8f1dbe8 100644 --- a/go.sum +++ b/go.sum @@ -1,17 +1,17 @@ -cloud.google.com/go v0.121.6 h1:waZiuajrI28iAf40cWgycWNgaXPO06dupuS+sgibK6c= -cloud.google.com/go v0.121.6/go.mod h1:coChdst4Ea5vUpiALcYKXEpR1S9ZgXbhEzzMcMR66vI= -cloud.google.com/go/auth v0.17.0 h1:74yCm7hCj2rUyyAocqnFzsAYXgJhrG26XCFimrc/Kz4= -cloud.google.com/go/auth v0.17.0/go.mod h1:6wv/t5/6rOPAX4fJiRjKkJCvswLwdet7G8+UGXt7nCQ= +cloud.google.com/go v0.123.0 h1:2NAUJwPR47q+E35uaJeYoNhuNEM9kM8SjgRgdeOJUSE= +cloud.google.com/go v0.123.0/go.mod h1:xBoMV08QcqUGuPW65Qfm1o9Y4zKZBpGS+7bImXLTAZU= +cloud.google.com/go/auth v0.18.1 h1:IwTEx92GFUo2pJ6Qea0EU3zYvKnTAeRCODxfA/G5UWs= +cloud.google.com/go/auth v0.18.1/go.mod h1:GfTYoS9G3CWpRA3Va9doKN9mjPGRS+v41jmZAhBzbrA= cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc= cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c= cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs= cloud.google.com/go/compute/metadata v0.9.0/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10= cloud.google.com/go/iam v1.5.3 h1:+vMINPiDF2ognBJ97ABAYYwRgsaqxPbQDlMnbHMjolc= cloud.google.com/go/iam v1.5.3/go.mod h1:MR3v9oLkZCTlaqljW6Eb2d3HGDGK5/bDv93jhfISFvU= -cloud.google.com/go/kms v1.25.0 h1:gVqvGGUmz0nYCmtoxWmdc1wli2L1apgP8U4fghPGSbQ= -cloud.google.com/go/kms v1.25.0/go.mod h1:XIdHkzfj0bUO3E+LvwPg+oc7s58/Ns8Nd8Sdtljihbk= -cloud.google.com/go/longrunning v0.7.0 h1:FV0+SYF1RIj59gyoWDRi45GiYUMM3K1qO51qoboQT1E= -cloud.google.com/go/longrunning v0.7.0/go.mod h1:ySn2yXmjbK9Ba0zsQqunhDkYi0+9rlXIwnoAf+h+TPY= +cloud.google.com/go/kms v1.26.0 h1:cK9mN2cf+9V63D3H1f6koxTatWy39aTI/hCjz1I+adU= +cloud.google.com/go/kms v1.26.0/go.mod h1:pHKOdFJm63hxBsiPkYtowZPltu9dW0MWvBa6IA4HM58= +cloud.google.com/go/longrunning v0.8.0 h1:LiKK77J3bx5gDLi4SMViHixjD2ohlkwBi+mKA7EhfW8= +cloud.google.com/go/longrunning v0.8.0/go.mod h1:UmErU2Onzi+fKDg2gR7dusz11Pe26aknR4kHmJJqIfk= github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0 h1:JXg2dwJUmPB9JmtVmdEB16APJ7jurfbY5jnfXpJoRMc= github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0/go.mod h1:YD5h/ldMsG0XiIw7PdyNhLxaM317eFh5yNLccNfGdyw= github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 h1:Hk5QBxZQC1jb2Fwj6mpzme37xbCDdNTxU7O9eb5+LB4= @@ -34,8 +34,8 @@ github.com/caarlos0/env/v11 v11.4.0 h1:Kcb6t5kIIr4XkoQC9AF2j+8E1Jsrl3Wz/hhm1LtoG github.com/caarlos0/env/v11 v11.4.0/go.mod h1:qupehSf/Y0TUTsxKywqRt/vJjN5nz6vauiYEUUr8P4U= github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs= github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= -github.com/cncf/xds/go v0.0.0-20250501225837-2ac532fd4443 h1:aQ3y1lwWyqYPiWZThqv1aFbZMiM9vblcSArJRf2Irls= -github.com/cncf/xds/go v0.0.0-20250501225837-2ac532fd4443/go.mod h1:W+zGtBO5Y1IgJhy4+A9GOqVhqLpfZi+vwmdNXUehLA8= +github.com/cncf/xds/go v0.0.0-20251022180443-0feb69152e9f h1:Y8xYupdHxryycyPlc9Y+bSQAYZnetRJ70VMVKm5CKI0= +github.com/cncf/xds/go v0.0.0-20251022180443-0feb69152e9f/go.mod h1:HlzOvOjVBOfTGSRXRyY0OiCS/3J1akRGQQpRO/7zyF4= github.com/containerd/stargz-snapshotter/estargz v0.18.1 h1:cy2/lpgBXDA3cDKSyEfNOFMA/c10O1axL69EU7iirO8= github.com/containerd/stargz-snapshotter/estargz v0.18.1/go.mod h1:ALIEqa7B6oVDsrF37GkGN20SuvG/pIMm7FwP7ZmRb0Q= github.com/coreos/go-oidc/v3 v3.17.0 h1:hWBGaQfbi0iVviX4ibC7bk8OKT5qNr4klBaCHVNvehc= @@ -51,9 +51,9 @@ github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBi github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w= github.com/docker/docker-credential-helpers v0.9.3 h1:gAm/VtF9wgqJMoxzT3Gj5p4AqIjCBS4wrsOh9yRqcz8= github.com/docker/docker-credential-helpers v0.9.3/go.mod h1:x+4Gbw9aGmChi3qTLZj8Dfn0TD20M/fuWy0E5+WDeCo= -github.com/envoyproxy/go-control-plane v0.13.4 h1:zEqyPVyku6IvWCFwux4x9RxkLOMUL+1vC9xUFv5l2/M= -github.com/envoyproxy/go-control-plane/envoy v1.32.4 h1:jb83lalDRZSpPWW2Z7Mck/8kXZ5CQAFYVjQcdVIr83A= -github.com/envoyproxy/go-control-plane/envoy v1.32.4/go.mod h1:Gzjc5k8JcJswLjAx1Zm+wSYE20UrLtt7JZMWiWQXQEw= +github.com/envoyproxy/go-control-plane v0.13.5-0.20251024222203-75eaa193e329 h1:K+fnvUM0VZ7ZFJf0n4L/BRlnsb9pL/GuDG6FqaH+PwM= +github.com/envoyproxy/go-control-plane/envoy v1.35.0 h1:ixjkELDE+ru6idPxcHLj8LBVc2bFP7iBytj353BoHUo= +github.com/envoyproxy/go-control-plane/envoy v1.35.0/go.mod h1:09qwbGVuSWWAyN5t/b3iyVfz5+z8QWGrzkoqm/8SbEs= github.com/envoyproxy/protoc-gen-validate v1.2.1 h1:DEo3O99U8j4hBFwbJfrz9VtgcDfUKS7KJ7spH3d86P8= github.com/envoyproxy/protoc-gen-validate v1.2.1/go.mod h1:d/C80l/jxXLdfEIhX1W2TmLfsJ31lvEjwamM4DxlWXU= github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg= @@ -77,10 +77,10 @@ github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0= github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= -github.com/googleapis/enterprise-certificate-proxy v0.3.7 h1:zrn2Ee/nWmHulBx5sAVrGgAa0f2/R35S4DJwfFaUPFQ= -github.com/googleapis/enterprise-certificate-proxy v0.3.7/go.mod h1:MkHOF77EYAE7qfSuSS9PU6g4Nt4e11cnsDUowfwewLA= -github.com/googleapis/gax-go/v2 v2.15.0 h1:SyjDc1mGgZU5LncH8gimWo9lW1DtIfPibOG81vgd/bo= -github.com/googleapis/gax-go/v2 v2.15.0/go.mod h1:zVVkkxAQHa1RQpg9z2AUCMnKhi0Qld9rcmyfL1OZhoc= +github.com/googleapis/enterprise-certificate-proxy v0.3.11 h1:vAe81Msw+8tKUxi2Dqh/NZMz7475yUvmRIkXr4oN2ao= +github.com/googleapis/enterprise-certificate-proxy v0.3.11/go.mod h1:RFV7MUdlb7AgEq2v7FmMCfeSMCllAzWxFgRdusoGks8= +github.com/googleapis/gax-go/v2 v2.17.0 h1:RksgfBpxqff0EZkDWYuz9q/uWsTVz+kf43LsZ1J6SMc= +github.com/googleapis/gax-go/v2 v2.17.0/go.mod h1:mzaqghpQp4JDh3HvADwrat+6M3MOIDp5YKHhb9PAgDY= github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM= github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg= github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo= @@ -164,12 +164,12 @@ go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE= go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0= go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8= -golang.org/x/crypto v0.46.0 h1:cKRW/pmt1pKAfetfu+RCEvjvZkA9RimPbh7bhFjGVBU= -golang.org/x/crypto v0.46.0/go.mod h1:Evb/oLKmMraqjZ2iQTwDwvCtJkczlDuTmdJXoZVzqU0= +golang.org/x/crypto v0.47.0 h1:V6e3FRj+n4dbpw86FJ8Fv7XVOql7TEwpHapKoMJ/GO8= +golang.org/x/crypto v0.47.0/go.mod h1:ff3Y9VzzKbwSSEzWqJsJVBnWmRwRSHt/6Op5n9bQc4A= golang.org/x/mod v0.33.0 h1:tHFzIWbBifEmbwtGz65eaWyGiGZatSrT9prnU8DbVL8= golang.org/x/mod v0.33.0/go.mod h1:swjeQEj+6r7fODbD2cqrnje9PnziFuw4bmLbBZFrQ5w= -golang.org/x/net v0.48.0 h1:zyQRTTrjc33Lhh0fBgT/H3oZq9WuvRR5gPC70xpDiQU= -golang.org/x/net v0.48.0/go.mod h1:+ndRgGjkh8FGtu1w1FGbEC31if4VrNVMuKTgcAAnQRY= +golang.org/x/net v0.49.0 h1:eeHFmOGUTtaaPSGNmjBKpbng9MulQsJURQUAfUwY++o= +golang.org/x/net v0.49.0/go.mod h1:/ysNB2EvaqvesRkuLAyjI1ycPZlQHM3q01F02UY/MV8= golang.org/x/oauth2 v0.34.0 h1:hqK/t4AKgbqWkdkcAeI8XLmbK+4m4G5YeQRrmiotGlw= golang.org/x/oauth2 v0.34.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA= golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4= @@ -178,22 +178,22 @@ golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBc golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k= golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= -golang.org/x/text v0.32.0 h1:ZD01bjUt1FQ9WJ0ClOL5vxgxOI/sVCNgX1YtKwcY0mU= -golang.org/x/text v0.32.0/go.mod h1:o/rUWzghvpD5TXrTIBuJU77MTaN0ljMWE47kxGJQ7jY= +golang.org/x/text v0.33.0 h1:B3njUFyqtHDUI5jMn1YIr5B0IE2U0qck04r6d4KPAxE= +golang.org/x/text v0.33.0/go.mod h1:LuMebE6+rBincTi9+xWTY8TztLzKHc/9C1uBCG27+q8= golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI= golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4= gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk= gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E= -google.golang.org/api v0.256.0 h1:u6Khm8+F9sxbCTYNoBHg6/Hwv0N/i+V94MvkOSor6oI= -google.golang.org/api v0.256.0/go.mod h1:KIgPhksXADEKJlnEoRa9qAII4rXcy40vfI8HRqcU964= -google.golang.org/genproto v0.0.0-20250603155806-513f23925822 h1:rHWScKit0gvAPuOnu87KpaYtjK5zBMLcULh7gxkCXu4= -google.golang.org/genproto v0.0.0-20250603155806-513f23925822/go.mod h1:HubltRL7rMh0LfnQPkMH4NPDFEWp0jw3vixw7jEM53s= -google.golang.org/genproto/googleapis/api v0.0.0-20251111163417-95abcf5c77ba h1:B14OtaXuMaCQsl2deSvNkyPKIzq3BjfxQp8d00QyWx4= -google.golang.org/genproto/googleapis/api v0.0.0-20251111163417-95abcf5c77ba/go.mod h1:G5IanEx8/PgI9w6CFcYQf7jMtHQhZruvfM1i3qOqk5U= -google.golang.org/genproto/googleapis/rpc v0.0.0-20251103181224-f26f9409b101 h1:tRPGkdGHuewF4UisLzzHHr1spKw92qLM98nIzxbC0wY= -google.golang.org/genproto/googleapis/rpc v0.0.0-20251103181224-f26f9409b101/go.mod h1:7i2o+ce6H/6BluujYR+kqX3GKH+dChPTQU19wjRPiGk= -google.golang.org/grpc v1.76.0 h1:UnVkv1+uMLYXoIz6o7chp59WfQUYA2ex/BXQ9rHZu7A= -google.golang.org/grpc v1.76.0/go.mod h1:Ju12QI8M6iQJtbcsV+awF5a4hfJMLi4X0JLo94ULZ6c= +google.golang.org/api v0.265.0 h1:FZvfUdI8nfmuNrE34aOWFPmLC+qRBEiNm3JdivTvAAU= +google.golang.org/api v0.265.0/go.mod h1:uAvfEl3SLUj/7n6k+lJutcswVojHPp2Sp08jWCu8hLY= +google.golang.org/genproto v0.0.0-20260128011058-8636f8732409 h1:VQZ/yAbAtjkHgH80teYd2em3xtIkkHd7ZhqfH2N9CsM= +google.golang.org/genproto v0.0.0-20260128011058-8636f8732409/go.mod h1:rxKD3IEILWEu3P44seeNOAwZN4SaoKaQ/2eTg4mM6EM= +google.golang.org/genproto/googleapis/api v0.0.0-20260203192932-546029d2fa20 h1:7ei4lp52gK1uSejlA8AZl5AJjeLUOHBQscRQZUgAcu0= +google.golang.org/genproto/googleapis/api v0.0.0-20260203192932-546029d2fa20/go.mod h1:ZdbssH/1SOVnjnDlXzxDHK2MCidiqXtbYccJNzNYPEE= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409 h1:H86B94AW+VfJWDqFeEbBPhEtHzJwJfTbgE2lZa54ZAQ= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409/go.mod h1:j9x/tPzZkyxcgEFkiKEEGxfvyumM01BEtsW8xzOahRQ= +google.golang.org/grpc v1.78.0 h1:K1XZG/yGDJnzMdd/uZHAkVqJE+xIDOcmdSFZkBUicNc= +google.golang.org/grpc v1.78.0/go.mod h1:I47qjTo4OKbMkjA/aOOwxDIiPSBofUtQUI5EfpWvW7U= google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE= google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= From 7462b3c34e5c0b304f9b75b1158d6c1b0ccf39e1 Mon Sep 17 00:00:00 2001 From: Tadas Antanavicius Date: Fri, 6 Mar 2026 14:20:44 -0800 Subject: [PATCH 122/313] fix(ci): use deploy/go.mod for deploy workflow Go version and bump root Go to 1.25.8 (#1040) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary Fixes two CI issues: ### 1. Deploy workflows broken since PR #1034 (all staging deploys failing) The deploy-staging and deploy-production workflows install Go using the **root** `go.mod`, but then build Pulumi infrastructure code from the `deploy/` directory which has its own `go.mod`. This started failing when PR #1034 (`build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.220.0 to 3.225.1 in /deploy`) bumped `deploy/go.mod` from Go 1.24.11 to **Go 1.25.6** — a version newer than the root module's Go 1.24.13. Every staging deploy since that merge (Mar 6) has failed with: ``` go: go.mod requires go >= 1.25.6 (running go 1.24.13; GOTOOLCHAIN=local) ``` The last successful deploy was commit cb4807a on Mar 1, before the Go version bump. **Fix**: point `go-version-file` in both deploy workflows at `deploy/go.mod` instead of the root `go.mod`. ### 2. `govulncheck` failing due to Go stdlib vulnerabilities Five new Go stdlib vulnerabilities (GO-2026-4599 through GO-2026-4603) were published on Mar 5-6 affecting Go 1.24.13, fixed in Go 1.25.8. These cause `govulncheck` in the CI pipeline to fail. **Fix**: bump root `go.mod` from Go 1.24.13 to Go 1.25.8. ## Test plan - [ ] CI pipeline passes (govulncheck, build, lint, tests) - [ ] Verify the deploy-staging workflow passes on the next push to main after merge 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude --- .github/workflows/deploy-production.yml | 2 +- .github/workflows/deploy-staging.yml | 2 +- go.mod | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/deploy-production.yml b/.github/workflows/deploy-production.yml index 8b50757..fc72c6d 100644 --- a/.github/workflows/deploy-production.yml +++ b/.github/workflows/deploy-production.yml @@ -28,7 +28,7 @@ jobs: - name: Setup Go uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 with: - go-version-file: 'go.mod' + go-version-file: 'deploy/go.mod' cache: true - name: Setup Pulumi diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml index 3d983ed..f2208fb 100644 --- a/.github/workflows/deploy-staging.yml +++ b/.github/workflows/deploy-staging.yml @@ -75,7 +75,7 @@ jobs: - name: Setup Go uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 with: - go-version-file: 'go.mod' + go-version-file: 'deploy/go.mod' cache: true - name: Setup Pulumi diff --git a/go.mod b/go.mod index 8ad2338..1befb06 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/modelcontextprotocol/registry -go 1.24.13 +go 1.25.8 require ( cloud.google.com/go/kms v1.26.0 From 7b0c411928fbfd122e53d19f20b8a079ec1024b2 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Sat, 7 Mar 2026 00:57:51 +0200 Subject: [PATCH 123/313] Bump go (#1041) Fixes: https://github.com/modelcontextprotocol/registry/actions/runs/22784360696/job/66097670402 ## Motivation and Context ## How Has This Been Tested? ## Breaking Changes ## Types of changes - [ ] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] Documentation update ## Checklist - [ ] I have read the [MCP Documentation](https://modelcontextprotocol.io) - [ ] My code follows the repository's style guidelines - [ ] New and existing tests pass locally - [ ] I have added appropriate error handling - [ ] I have added or updated documentation as needed ## Additional context --------- Signed-off-by: Radoslav Dimitrov --- .github/workflows/ci.yml | 5 +++-- go.mod | 3 +++ go.sum | 8 ++++++++ 3 files changed, 14 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 723163f..1863041 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -38,8 +38,9 @@ jobs: - name: Run govulncheck uses: golang/govulncheck-action@v1 with: - go-version-input: '' - go-version-file: go.mod + # Use Go 1.26.1 to pick up crypto/x509 vulnerability fixes (GO-2026-4600, GO-2026-4599). + # go.mod stays at go 1.25.8 for golangci-lint compatibility until it supports Go 1.26. + go-version-input: '1.26.1' go-package: ./... repo-checkout: false diff --git a/go.mod b/go.mod index 1befb06..91a3ba4 100644 --- a/go.mod +++ b/go.mod @@ -15,6 +15,7 @@ require ( github.com/prometheus/client_golang v1.23.2 github.com/rs/cors v1.11.1 github.com/santhosh-tekuri/jsonschema/v5 v5.3.1 + github.com/spf13/cobra v1.10.1 github.com/stretchr/testify v1.11.1 go.opentelemetry.io/contrib/instrumentation/runtime v0.66.0 go.opentelemetry.io/otel v1.41.0 @@ -52,6 +53,7 @@ require ( github.com/google/uuid v1.6.0 // indirect github.com/googleapis/enterprise-certificate-proxy v0.3.11 // indirect github.com/googleapis/gax-go/v2 v2.17.0 // indirect + github.com/inconshreveable/mousetrap v1.1.0 // indirect github.com/jackc/pgpassfile v1.0.0 // indirect github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect github.com/jackc/puddle/v2 v2.2.2 // indirect @@ -68,6 +70,7 @@ require ( github.com/prometheus/otlptranslator v1.0.0 // indirect github.com/prometheus/procfs v0.19.2 // indirect github.com/sirupsen/logrus v1.9.3 // indirect + github.com/spf13/pflag v1.0.9 // indirect github.com/vbatts/tar-split v0.12.2 // indirect go.opentelemetry.io/auto/sdk v1.2.1 // indirect go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 // indirect diff --git a/go.sum b/go.sum index 8f1dbe8..2d36728 100644 --- a/go.sum +++ b/go.sum @@ -40,6 +40,7 @@ github.com/containerd/stargz-snapshotter/estargz v0.18.1 h1:cy2/lpgBXDA3cDKSyEfN github.com/containerd/stargz-snapshotter/estargz v0.18.1/go.mod h1:ALIEqa7B6oVDsrF37GkGN20SuvG/pIMm7FwP7ZmRb0Q= github.com/coreos/go-oidc/v3 v3.17.0 h1:hWBGaQfbi0iVviX4ibC7bk8OKT5qNr4klBaCHVNvehc= github.com/coreos/go-oidc/v3 v3.17.0/go.mod h1:wqPbKFrVnE90vty060SB40FCJ8fTHTxSwyXJqZH+sI8= +github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g= github.com/danielgtaylor/huma/v2 v2.35.0 h1:FRg3FgVKcMogVhbNY7FjyTwk+p/orLBR3hQBvXXg7dw= github.com/danielgtaylor/huma/v2 v2.35.0/go.mod h1:3elp5brzdyyZsPlDVvf6w8RLnklKp3abolr+5op3fP0= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= @@ -81,6 +82,8 @@ github.com/googleapis/enterprise-certificate-proxy v0.3.11 h1:vAe81Msw+8tKUxi2Dq github.com/googleapis/enterprise-certificate-proxy v0.3.11/go.mod h1:RFV7MUdlb7AgEq2v7FmMCfeSMCllAzWxFgRdusoGks8= github.com/googleapis/gax-go/v2 v2.17.0 h1:RksgfBpxqff0EZkDWYuz9q/uWsTVz+kf43LsZ1J6SMc= github.com/googleapis/gax-go/v2 v2.17.0/go.mod h1:mzaqghpQp4JDh3HvADwrat+6M3MOIDp5YKHhb9PAgDY= +github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8= +github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM= github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg= github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo= @@ -129,10 +132,15 @@ github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0t github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc= github.com/rs/cors v1.11.1 h1:eU3gRzXLRK57F5rKMGMZURNdIG4EoAmX8k94r9wXWHA= github.com/rs/cors v1.11.1/go.mod h1:XyqrcTp5zjWr1wsJ8PIRZssZ8b/WMcMf71DJnit4EMU= +github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM= github.com/santhosh-tekuri/jsonschema/v5 v5.3.1 h1:lZUw3E0/J3roVtGQ+SCrUrg3ON6NgVqpn3+iol9aGu4= github.com/santhosh-tekuri/jsonschema/v5 v5.3.1/go.mod h1:uToXkOrWAZ6/Oc07xWQrPOhJotwFIyu2bBVN41fcDUY= github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ= github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ= +github.com/spf13/cobra v1.10.1 h1:lJeBwCfmrnXthfAupyUTzJ/J4Nc1RsHC/mSRU2dll/s= +github.com/spf13/cobra v1.10.1/go.mod h1:7SmJGaTHFVBY0jW4NXGluQoLvhqFQM+6XSKD+P4XaB0= +github.com/spf13/pflag v1.0.9 h1:9exaQaMOCwffKiiiYk6/BndUBv+iRViNW+4lEMi0PvY= +github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= From 03d551dbab7d26a5a3bd316cc0137238ff18e9f6 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 7 Mar 2026 15:22:17 +0200 Subject: [PATCH 124/313] build(deps): bump the opentelemetry group with 6 updates (#1044) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps the opentelemetry group with 6 updates: | Package | From | To | | --- | --- | --- | | [go.opentelemetry.io/contrib/instrumentation/runtime](https://github.com/open-telemetry/opentelemetry-go-contrib) | `0.66.0` | `0.67.0` | | [go.opentelemetry.io/otel](https://github.com/open-telemetry/opentelemetry-go) | `1.41.0` | `1.42.0` | | [go.opentelemetry.io/otel/exporters/prometheus](https://github.com/open-telemetry/opentelemetry-go) | `0.63.0` | `0.64.0` | | [go.opentelemetry.io/otel/metric](https://github.com/open-telemetry/opentelemetry-go) | `1.41.0` | `1.42.0` | | [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go) | `1.41.0` | `1.42.0` | | [go.opentelemetry.io/otel/sdk/metric](https://github.com/open-telemetry/opentelemetry-go) | `1.41.0` | `1.42.0` | Updates `go.opentelemetry.io/contrib/instrumentation/runtime` from 0.66.0 to 0.67.0
Release notes

Sourced from go.opentelemetry.io/contrib/instrumentation/runtime's releases.

v1.42.0/v2.4.0/v0.67.0/v0.36.0/v0.22.0/v0.17.0/v0.15.0/v0.14.0

Added

  • Add environment variables propagation carrier in go.opentelemetry.io/contrib/propagators/envcar. (#8442)

Changed

  • Upgrade go.opentelemetry.io/otel/semconv to v1.40.0, including updates across instrumentation and detector modules. (#8631)

    • The semantic conventions v1.40.0 release introduces RPC breaking changes applied in this repository:
      • RPC spans and metrics no longer include network.protocol.name, network.protocol.version, or network.transport attributes.
      • rpc.client.request.size, rpc.client.response.size, rpc.server.request.size, and rpc.server.response.size are no longer emitted in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc.
      • rpc.message span events and their message attributes are no longer emitted in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc (including when WithMessageEvents is configured).

    See semantic-conventions v1.40.0 release for complete details.

Fixed

  • Ignore informational response status codes (100-199) except 101 Switching Protocols when storing the HTTP status code in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp and go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux. (#6913)
  • Make Body handling in Transport consistent with stdlib in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp. (#8618)
  • Fix bucket boundaries for rpc.server.call.duration and rpc.client.call.duration in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc. (#8642)
  • Host resource detector in go.opentelemetry.io/contrib/otelconf now includes os. attributes. (#8578)

Removed

What's Changed

... (truncated)

Changelog

Sourced from go.opentelemetry.io/contrib/instrumentation/runtime's changelog.

[1.42.0/2.4.0/0.67.0/0.36.0/0.22.0/0.17.0/0.15.0/0.14.0] - 2026-03-06

Added

  • Add environment variables propagation carrier in go.opentelemetry.io/contrib/propagators/envcar. (#8442)

Changed

  • Upgrade go.opentelemetry.io/otel/semconv to v1.40.0, including updates across instrumentation and detector modules. (#8631)

    • The semantic conventions v1.40.0 release introduces RPC breaking changes applied in this repository:
      • RPC spans and metrics no longer include network.protocol.name, network.protocol.version, or network.transport attributes.
      • rpc.client.request.size, rpc.client.response.size, rpc.server.request.size, and rpc.server.response.size are no longer emitted in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc.
      • rpc.message span events and their message attributes are no longer emitted in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc (including when WithMessageEvents is configured).

    See semantic-conventions v1.40.0 release for complete details.

Fixed

  • Ignore informational response status codes (100-199) except 101 Switching Protocols when storing the HTTP status code in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp and go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux. (#6913)
  • Make Body handling in Transport consistent with stdlib in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp. (#8618)
  • Fix bucket boundaries for rpc.server.call.duration and rpc.client.call.duration in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc. (#8642)
  • Host resource detector in go.opentelemetry.io/contrib/otelconf now includes os. attributes. (#8578)

Removed

  • Drop support for [Go 1.24]. (#8628)
Commits
  • d8dabf6 Release v1.42.0/v2.4.0/v0.67.0/v0.36.0/v0.22.0/v0.17.0/v0.15.0/v0.14.0 (#8649)
  • b1de2c7 otelconf: host detector should include os as well (#8578)
  • b228c0f fix(deps): update module google.golang.org/grpc to v1.79.2 (#8644)
  • e70fd97 Use correct bucket boundaries for otelgrpc client and server histograms (#8642)
  • b018d98 fix(deps): update aws-sdk-go-v2 monorepo (#8643)
  • fb6a351 chore(deps): update github/codeql-action action to v4.32.6 (#8641)
  • 2c9c10e chore(deps): update dependency codespell to v2.4.2 (#8640)
  • 22248d4 chore: enable modernize linter (#8583)
  • 324662a envcar: add environment carrier (#8442)
  • 69addb4 chore(deps): update k8s.io/kube-openapi digest to 5b3e3fd (#8636)
  • Additional commits viewable in compare view

Updates `go.opentelemetry.io/otel` from 1.41.0 to 1.42.0
Changelog

Sourced from go.opentelemetry.io/otel's changelog.

[1.42.0/0.64.0/0.18.0/0.0.16] 2026-03-06

Added

  • Add go.opentelemetry.io/otel/semconv/v1.40.0 package. The package contains semantic conventions from the v1.40.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.39.0. (#7985)
  • Add Err and SetErr on Record in go.opentelemetry.io/otel/log to attach an error and set record exception attributes in go.opentelemetry.io/otel/log/sdk. (#7924)

Changed

  • TracerProvider.ForceFlush in go.opentelemetry.io/otel/sdk/trace joins errors together and continues iteration through SpanProcessors as opposed to returning the first encountered error without attempting exports on subsequent SpanProcessors. (#7856)

Fixed

  • Fix missing request.GetBody in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to correctly handle HTTP2 GOAWAY frame. (#7931)
  • Fix semconv v1.39.0 generated metric helpers skipping required attributes when extra attributes were empty. (#7964)
  • Preserve W3C TraceFlags bitmask (including the random Trace ID flag) during trace context extraction and injection in go.opentelemetry.io/otel/propagation. (#7834)

Removed

  • Drop support for [Go 1.24]. (#7984)
Commits
  • a3941ff Release v1.42.0/v0.64.0/v0.18.0/v0.0.16 (#8006)
  • 6059c47 chore(deps): update golang.org/x/telemetry digest to e526e8a (#8010)
  • 44c7edf chore(deps): update module github.com/mgechev/revive to v1.15.0 (#8009)
  • de5fb3a fix(deps): update module google.golang.org/grpc to v1.79.2 (#8007)
  • 0b82ded chore(deps): update codspeedhq/action action to v4.11.1 (#8001)
  • aa3660f chore(deps): update github/codeql-action action to v4.32.6 (#8004)
  • 9be8c92 chore(deps): update dependency codespell to v2.4.2 (#8003)
  • c9d2015 log: add error field to Record and make SDK to emit exception attributes (#7924)
  • fdd1320 TracerProvider ForceFlush() Error Fix (#7856)
  • 78f9904 chore(deps): update golang.org/x/telemetry digest to 18da590 (#8000)
  • Additional commits viewable in compare view

Updates `go.opentelemetry.io/otel/exporters/prometheus` from 0.63.0 to 0.64.0
Release notes

Sourced from go.opentelemetry.io/otel/exporters/prometheus's releases.

v1.42.0/v0.64.0/v0.18.0/v0.0.16

Added

  • Add go.opentelemetry.io/otel/semconv/v1.40.0 package. The package contains semantic conventions from the v1.40.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.39.0. (#7985)
  • Add Err and SetErr on Record in go.opentelemetry.io/otel/log to attach an error and set record exception attributes in go.opentelemetry.io/otel/log/sdk. (#7924)

Changed

  • TracerProvider.ForceFlush in go.opentelemetry.io/otel/sdk/trace joins errors together and continues iteration through SpanProcessors as opposed to returning the first encountered error without attempting exports on subsequent SpanProcessors. (#7856)

Fixed

  • Fix missing request.GetBody in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to correctly handle HTTP2 GOAWAY frame. (#7931)
  • Fix semconv v1.39.0 generated metric helpers skipping required attributes when extra attributes were empty. (#7964)
  • Preserve W3C TraceFlags bitmask (including the random Trace ID flag) during trace context extraction and injection in go.opentelemetry.io/otel/propagation. (#7834)

Removed

  • Drop support for [Go 1.24]. (#7984)

What's Changed

... (truncated)

Changelog

Sourced from go.opentelemetry.io/otel/exporters/prometheus's changelog.

[1.42.0/0.64.0/0.18.0/0.0.16] 2026-03-06

Added

  • Add go.opentelemetry.io/otel/semconv/v1.40.0 package. The package contains semantic conventions from the v1.40.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.39.0. (#7985)
  • Add Err and SetErr on Record in go.opentelemetry.io/otel/log to attach an error and set record exception attributes in go.opentelemetry.io/otel/log/sdk. (#7924)

Changed

  • TracerProvider.ForceFlush in go.opentelemetry.io/otel/sdk/trace joins errors together and continues iteration through SpanProcessors as opposed to returning the first encountered error without attempting exports on subsequent SpanProcessors. (#7856)

Fixed

  • Fix missing request.GetBody in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to correctly handle HTTP2 GOAWAY frame. (#7931)
  • Fix semconv v1.39.0 generated metric helpers skipping required attributes when extra attributes were empty. (#7964)
  • Preserve W3C TraceFlags bitmask (including the random Trace ID flag) during trace context extraction and injection in go.opentelemetry.io/otel/propagation. (#7834)

Removed

  • Drop support for [Go 1.24]. (#7984)
Commits
  • a3941ff Release v1.42.0/v0.64.0/v0.18.0/v0.0.16 (#8006)
  • 6059c47 chore(deps): update golang.org/x/telemetry digest to e526e8a (#8010)
  • 44c7edf chore(deps): update module github.com/mgechev/revive to v1.15.0 (#8009)
  • de5fb3a fix(deps): update module google.golang.org/grpc to v1.79.2 (#8007)
  • 0b82ded chore(deps): update codspeedhq/action action to v4.11.1 (#8001)
  • aa3660f chore(deps): update github/codeql-action action to v4.32.6 (#8004)
  • 9be8c92 chore(deps): update dependency codespell to v2.4.2 (#8003)
  • c9d2015 log: add error field to Record and make SDK to emit exception attributes (#7924)
  • fdd1320 TracerProvider ForceFlush() Error Fix (#7856)
  • 78f9904 chore(deps): update golang.org/x/telemetry digest to 18da590 (#8000)
  • Additional commits viewable in compare view

Updates `go.opentelemetry.io/otel/metric` from 1.41.0 to 1.42.0
Changelog

Sourced from go.opentelemetry.io/otel/metric's changelog.

[1.42.0/0.64.0/0.18.0/0.0.16] 2026-03-06

Added

  • Add go.opentelemetry.io/otel/semconv/v1.40.0 package. The package contains semantic conventions from the v1.40.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.39.0. (#7985)
  • Add Err and SetErr on Record in go.opentelemetry.io/otel/log to attach an error and set record exception attributes in go.opentelemetry.io/otel/log/sdk. (#7924)

Changed

  • TracerProvider.ForceFlush in go.opentelemetry.io/otel/sdk/trace joins errors together and continues iteration through SpanProcessors as opposed to returning the first encountered error without attempting exports on subsequent SpanProcessors. (#7856)

Fixed

  • Fix missing request.GetBody in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to correctly handle HTTP2 GOAWAY frame. (#7931)
  • Fix semconv v1.39.0 generated metric helpers skipping required attributes when extra attributes were empty. (#7964)
  • Preserve W3C TraceFlags bitmask (including the random Trace ID flag) during trace context extraction and injection in go.opentelemetry.io/otel/propagation. (#7834)

Removed

  • Drop support for [Go 1.24]. (#7984)
Commits
  • a3941ff Release v1.42.0/v0.64.0/v0.18.0/v0.0.16 (#8006)
  • 6059c47 chore(deps): update golang.org/x/telemetry digest to e526e8a (#8010)
  • 44c7edf chore(deps): update module github.com/mgechev/revive to v1.15.0 (#8009)
  • de5fb3a fix(deps): update module google.golang.org/grpc to v1.79.2 (#8007)
  • 0b82ded chore(deps): update codspeedhq/action action to v4.11.1 (#8001)
  • aa3660f chore(deps): update github/codeql-action action to v4.32.6 (#8004)
  • 9be8c92 chore(deps): update dependency codespell to v2.4.2 (#8003)
  • c9d2015 log: add error field to Record and make SDK to emit exception attributes (#7924)
  • fdd1320 TracerProvider ForceFlush() Error Fix (#7856)
  • 78f9904 chore(deps): update golang.org/x/telemetry digest to 18da590 (#8000)
  • Additional commits viewable in compare view

Updates `go.opentelemetry.io/otel/sdk` from 1.41.0 to 1.42.0
Changelog

Sourced from go.opentelemetry.io/otel/sdk's changelog.

[1.42.0/0.64.0/0.18.0/0.0.16] 2026-03-06

Added

  • Add go.opentelemetry.io/otel/semconv/v1.40.0 package. The package contains semantic conventions from the v1.40.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.39.0. (#7985)
  • Add Err and SetErr on Record in go.opentelemetry.io/otel/log to attach an error and set record exception attributes in go.opentelemetry.io/otel/log/sdk. (#7924)

Changed

  • TracerProvider.ForceFlush in go.opentelemetry.io/otel/sdk/trace joins errors together and continues iteration through SpanProcessors as opposed to returning the first encountered error without attempting exports on subsequent SpanProcessors. (#7856)

Fixed

  • Fix missing request.GetBody in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to correctly handle HTTP2 GOAWAY frame. (#7931)
  • Fix semconv v1.39.0 generated metric helpers skipping required attributes when extra attributes were empty. (#7964)
  • Preserve W3C TraceFlags bitmask (including the random Trace ID flag) during trace context extraction and injection in go.opentelemetry.io/otel/propagation. (#7834)

Removed

  • Drop support for [Go 1.24]. (#7984)
Commits
  • a3941ff Release v1.42.0/v0.64.0/v0.18.0/v0.0.16 (#8006)
  • 6059c47 chore(deps): update golang.org/x/telemetry digest to e526e8a (#8010)
  • 44c7edf chore(deps): update module github.com/mgechev/revive to v1.15.0 (#8009)
  • de5fb3a fix(deps): update module google.golang.org/grpc to v1.79.2 (#8007)
  • 0b82ded chore(deps): update codspeedhq/action action to v4.11.1 (#8001)
  • aa3660f chore(deps): update github/codeql-action action to v4.32.6 (#8004)
  • 9be8c92 chore(deps): update dependency codespell to v2.4.2 (#8003)
  • c9d2015 log: add error field to Record and make SDK to emit exception attributes (#7924)
  • fdd1320 TracerProvider ForceFlush() Error Fix (#7856)
  • 78f9904 chore(deps): update golang.org/x/telemetry digest to 18da590 (#8000)
  • Additional commits viewable in compare view

Updates `go.opentelemetry.io/otel/sdk/metric` from 1.41.0 to 1.42.0
Changelog

Sourced from go.opentelemetry.io/otel/sdk/metric's changelog.

[1.42.0/0.64.0/0.18.0/0.0.16] 2026-03-06

Added

  • Add go.opentelemetry.io/otel/semconv/v1.40.0 package. The package contains semantic conventions from the v1.40.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.39.0. (#7985)
  • Add Err and SetErr on Record in go.opentelemetry.io/otel/log to attach an error and set record exception attributes in go.opentelemetry.io/otel/log/sdk. (#7924)

Changed

  • TracerProvider.ForceFlush in go.opentelemetry.io/otel/sdk/trace joins errors together and continues iteration through SpanProcessors as opposed to returning the first encountered error without attempting exports on subsequent SpanProcessors. (#7856)

Fixed

  • Fix missing request.GetBody in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to correctly handle HTTP2 GOAWAY frame. (#7931)
  • Fix semconv v1.39.0 generated metric helpers skipping required attributes when extra attributes were empty. (#7964)
  • Preserve W3C TraceFlags bitmask (including the random Trace ID flag) during trace context extraction and injection in go.opentelemetry.io/otel/propagation. (#7834)

Removed

  • Drop support for [Go 1.24]. (#7984)
Commits
  • a3941ff Release v1.42.0/v0.64.0/v0.18.0/v0.0.16 (#8006)
  • 6059c47 chore(deps): update golang.org/x/telemetry digest to e526e8a (#8010)
  • 44c7edf chore(deps): update module github.com/mgechev/revive to v1.15.0 (#8009)
  • de5fb3a fix(deps): update module google.golang.org/grpc to v1.79.2 (#8007)
  • 0b82ded chore(deps): update codspeedhq/action action to v4.11.1 (#8001)
  • aa3660f chore(deps): update github/codeql-action action to v4.32.6 (#8004)
  • 9be8c92 chore(deps): update dependency codespell to v2.4.2 (#8003)
  • c9d2015 log: add error field to Record and make SDK to emit exception attributes (#7924)
  • fdd1320 TracerProvider ForceFlush() Error Fix (#7856)
  • 78f9904 chore(deps): update golang.org/x/telemetry digest to 18da590 (#8000)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 17 +++++++---------- go.sum | 36 ++++++++++++++---------------------- 2 files changed, 21 insertions(+), 32 deletions(-) diff --git a/go.mod b/go.mod index 91a3ba4..2ed5483 100644 --- a/go.mod +++ b/go.mod @@ -15,14 +15,13 @@ require ( github.com/prometheus/client_golang v1.23.2 github.com/rs/cors v1.11.1 github.com/santhosh-tekuri/jsonschema/v5 v5.3.1 - github.com/spf13/cobra v1.10.1 github.com/stretchr/testify v1.11.1 - go.opentelemetry.io/contrib/instrumentation/runtime v0.66.0 - go.opentelemetry.io/otel v1.41.0 - go.opentelemetry.io/otel/exporters/prometheus v0.63.0 - go.opentelemetry.io/otel/metric v1.41.0 - go.opentelemetry.io/otel/sdk v1.41.0 - go.opentelemetry.io/otel/sdk/metric v1.41.0 + go.opentelemetry.io/contrib/instrumentation/runtime v0.67.0 + go.opentelemetry.io/otel v1.42.0 + go.opentelemetry.io/otel/exporters/prometheus v0.64.0 + go.opentelemetry.io/otel/metric v1.42.0 + go.opentelemetry.io/otel/sdk v1.42.0 + go.opentelemetry.io/otel/sdk/metric v1.42.0 golang.org/x/mod v0.33.0 gopkg.in/yaml.v3 v3.0.1 ) @@ -53,7 +52,6 @@ require ( github.com/google/uuid v1.6.0 // indirect github.com/googleapis/enterprise-certificate-proxy v0.3.11 // indirect github.com/googleapis/gax-go/v2 v2.17.0 // indirect - github.com/inconshreveable/mousetrap v1.1.0 // indirect github.com/jackc/pgpassfile v1.0.0 // indirect github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect github.com/jackc/puddle/v2 v2.2.2 // indirect @@ -70,12 +68,11 @@ require ( github.com/prometheus/otlptranslator v1.0.0 // indirect github.com/prometheus/procfs v0.19.2 // indirect github.com/sirupsen/logrus v1.9.3 // indirect - github.com/spf13/pflag v1.0.9 // indirect github.com/vbatts/tar-split v0.12.2 // indirect go.opentelemetry.io/auto/sdk v1.2.1 // indirect go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 // indirect go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect - go.opentelemetry.io/otel/trace v1.41.0 // indirect + go.opentelemetry.io/otel/trace v1.42.0 // indirect go.yaml.in/yaml/v2 v2.4.3 // indirect golang.org/x/crypto v0.47.0 // indirect golang.org/x/net v0.49.0 // indirect diff --git a/go.sum b/go.sum index 2d36728..73fc2ae 100644 --- a/go.sum +++ b/go.sum @@ -40,7 +40,6 @@ github.com/containerd/stargz-snapshotter/estargz v0.18.1 h1:cy2/lpgBXDA3cDKSyEfN github.com/containerd/stargz-snapshotter/estargz v0.18.1/go.mod h1:ALIEqa7B6oVDsrF37GkGN20SuvG/pIMm7FwP7ZmRb0Q= github.com/coreos/go-oidc/v3 v3.17.0 h1:hWBGaQfbi0iVviX4ibC7bk8OKT5qNr4klBaCHVNvehc= github.com/coreos/go-oidc/v3 v3.17.0/go.mod h1:wqPbKFrVnE90vty060SB40FCJ8fTHTxSwyXJqZH+sI8= -github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g= github.com/danielgtaylor/huma/v2 v2.35.0 h1:FRg3FgVKcMogVhbNY7FjyTwk+p/orLBR3hQBvXXg7dw= github.com/danielgtaylor/huma/v2 v2.35.0/go.mod h1:3elp5brzdyyZsPlDVvf6w8RLnklKp3abolr+5op3fP0= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= @@ -82,8 +81,6 @@ github.com/googleapis/enterprise-certificate-proxy v0.3.11 h1:vAe81Msw+8tKUxi2Dq github.com/googleapis/enterprise-certificate-proxy v0.3.11/go.mod h1:RFV7MUdlb7AgEq2v7FmMCfeSMCllAzWxFgRdusoGks8= github.com/googleapis/gax-go/v2 v2.17.0 h1:RksgfBpxqff0EZkDWYuz9q/uWsTVz+kf43LsZ1J6SMc= github.com/googleapis/gax-go/v2 v2.17.0/go.mod h1:mzaqghpQp4JDh3HvADwrat+6M3MOIDp5YKHhb9PAgDY= -github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8= -github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM= github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg= github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo= @@ -132,15 +129,10 @@ github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0t github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc= github.com/rs/cors v1.11.1 h1:eU3gRzXLRK57F5rKMGMZURNdIG4EoAmX8k94r9wXWHA= github.com/rs/cors v1.11.1/go.mod h1:XyqrcTp5zjWr1wsJ8PIRZssZ8b/WMcMf71DJnit4EMU= -github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM= github.com/santhosh-tekuri/jsonschema/v5 v5.3.1 h1:lZUw3E0/J3roVtGQ+SCrUrg3ON6NgVqpn3+iol9aGu4= github.com/santhosh-tekuri/jsonschema/v5 v5.3.1/go.mod h1:uToXkOrWAZ6/Oc07xWQrPOhJotwFIyu2bBVN41fcDUY= github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ= github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ= -github.com/spf13/cobra v1.10.1 h1:lJeBwCfmrnXthfAupyUTzJ/J4Nc1RsHC/mSRU2dll/s= -github.com/spf13/cobra v1.10.1/go.mod h1:7SmJGaTHFVBY0jW4NXGluQoLvhqFQM+6XSKD+P4XaB0= -github.com/spf13/pflag v1.0.9 h1:9exaQaMOCwffKiiiYk6/BndUBv+iRViNW+4lEMi0PvY= -github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= @@ -154,20 +146,20 @@ go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.6 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0/go.mod h1:snMWehoOh2wsEwnvvwtDyFCxVeDAODenXHtn5vzrKjo= go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 h1:F7Jx+6hwnZ41NSFTO5q4LYDtJRXBf2PD0rNBkeB/lus= go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0/go.mod h1:UHB22Z8QsdRDrnAtX4PntOl36ajSxcdUMt1sF7Y6E7Q= -go.opentelemetry.io/contrib/instrumentation/runtime v0.66.0 h1:JruBNmrPELWjR+PU3fsQBFQRYtsMLQ/zPfbvwDz9I/w= -go.opentelemetry.io/contrib/instrumentation/runtime v0.66.0/go.mod h1:vwNrfL6w1uAE3qX48KFii2Qoqf+NEDP5wNjus+RHz8Y= -go.opentelemetry.io/otel v1.41.0 h1:YlEwVsGAlCvczDILpUXpIpPSL/VPugt7zHThEMLce1c= -go.opentelemetry.io/otel v1.41.0/go.mod h1:Yt4UwgEKeT05QbLwbyHXEwhnjxNO6D8L5PQP51/46dE= -go.opentelemetry.io/otel/exporters/prometheus v0.63.0 h1:OLo1FNb0pBZykLqbKRZolKtGZd0Waqlr240YdMEnhhg= -go.opentelemetry.io/otel/exporters/prometheus v0.63.0/go.mod h1:8yeQAdhrK5xsWuFehO13Dk/Xb9FuhZoVpJfpoNCfJnw= -go.opentelemetry.io/otel/metric v1.41.0 h1:rFnDcs4gRzBcsO9tS8LCpgR0dxg4aaxWlJxCno7JlTQ= -go.opentelemetry.io/otel/metric v1.41.0/go.mod h1:xPvCwd9pU0VN8tPZYzDZV/BMj9CM9vs00GuBjeKhJps= -go.opentelemetry.io/otel/sdk v1.41.0 h1:YPIEXKmiAwkGl3Gu1huk1aYWwtpRLeskpV+wPisxBp8= -go.opentelemetry.io/otel/sdk v1.41.0/go.mod h1:ahFdU0G5y8IxglBf0QBJXgSe7agzjE4GiTJ6HT9ud90= -go.opentelemetry.io/otel/sdk/metric v1.41.0 h1:siZQIYBAUd1rlIWQT2uCxWJxcCO7q3TriaMlf08rXw8= -go.opentelemetry.io/otel/sdk/metric v1.41.0/go.mod h1:HNBuSvT7ROaGtGI50ArdRLUnvRTRGniSUZbxiWxSO8Y= -go.opentelemetry.io/otel/trace v1.41.0 h1:Vbk2co6bhj8L59ZJ6/xFTskY+tGAbOnCtQGVVa9TIN0= -go.opentelemetry.io/otel/trace v1.41.0/go.mod h1:U1NU4ULCoxeDKc09yCWdWe+3QoyweJcISEVa1RBzOis= +go.opentelemetry.io/contrib/instrumentation/runtime v0.67.0 h1:fM78cKITJ2r08cl+nw5i+hI9zWAu3iak8o1Os/ca2Ck= +go.opentelemetry.io/contrib/instrumentation/runtime v0.67.0/go.mod h1:ybmlzIqGcQzwt5lAfi8TpSnHo/CI3yv1Czodmm+OJa8= +go.opentelemetry.io/otel v1.42.0 h1:lSQGzTgVR3+sgJDAU/7/ZMjN9Z+vUip7leaqBKy4sho= +go.opentelemetry.io/otel v1.42.0/go.mod h1:lJNsdRMxCUIWuMlVJWzecSMuNjE7dOYyWlqOXWkdqCc= +go.opentelemetry.io/otel/exporters/prometheus v0.64.0 h1:g0LRDXMX/G1SEZtK8zl8Chm4K6GBwRkjPKE36LxiTYs= +go.opentelemetry.io/otel/exporters/prometheus v0.64.0/go.mod h1:UrgcjnarfdlBDP3GjDIJWe6HTprwSazNjwsI+Ru6hro= +go.opentelemetry.io/otel/metric v1.42.0 h1:2jXG+3oZLNXEPfNmnpxKDeZsFI5o4J+nz6xUlaFdF/4= +go.opentelemetry.io/otel/metric v1.42.0/go.mod h1:RlUN/7vTU7Ao/diDkEpQpnz3/92J9ko05BIwxYa2SSI= +go.opentelemetry.io/otel/sdk v1.42.0 h1:LyC8+jqk6UJwdrI/8VydAq/hvkFKNHZVIWuslJXYsDo= +go.opentelemetry.io/otel/sdk v1.42.0/go.mod h1:rGHCAxd9DAph0joO4W6OPwxjNTYWghRWmkHuGbayMts= +go.opentelemetry.io/otel/sdk/metric v1.42.0 h1:D/1QR46Clz6ajyZ3G8SgNlTJKBdGp84q9RKCAZ3YGuA= +go.opentelemetry.io/otel/sdk/metric v1.42.0/go.mod h1:Ua6AAlDKdZ7tdvaQKfSmnFTdHx37+J4ba8MwVCYM5hc= +go.opentelemetry.io/otel/trace v1.42.0 h1:OUCgIPt+mzOnaUTpOQcBiM/PLQ/Op7oq6g4LenLmOYY= +go.opentelemetry.io/otel/trace v1.42.0/go.mod h1:f3K9S+IFqnumBkKhRJMeaZeNk9epyhnCmQh/EysQCdc= go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE= go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0= From c0ecfd5a650de626f84449135dc2a631903cf755 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 7 Mar 2026 15:31:08 +0200 Subject: [PATCH 125/313] build(deps): bump github.com/google/go-containerregistry from 0.20.7 to 0.21.2 (#1026) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) from 0.20.7 to 0.21.2.
Release notes

Sourced from github.com/google/go-containerregistry's releases.

v0.21.2

What's Changed

Full Changelog: https://github.com/google/go-containerregistry/compare/v0.21.1...v0.21.2

v0.21.1

This release fixes a regression in crane introduced in the previous release.

What's Changed

New Contributors

Full Changelog: https://github.com/google/go-containerregistry/compare/v0.21.0...v0.21.1

v0.21.0

This release updates the minimum Go version to 1.25.6.

What's Changed

New Contributors

Full Changelog: https://github.com/google/go-containerregistry/compare/v0.20.7...v0.21.0

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/google/go-containerregistry&package-manager=go_modules&previous-version=0.20.7&new-version=0.21.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Radoslav Dimitrov --- go.mod | 10 +++++----- go.sum | 20 ++++++++++---------- 2 files changed, 15 insertions(+), 15 deletions(-) diff --git a/go.mod b/go.mod index 2ed5483..e438a85 100644 --- a/go.mod +++ b/go.mod @@ -10,7 +10,7 @@ require ( github.com/coreos/go-oidc/v3 v3.17.0 github.com/danielgtaylor/huma/v2 v2.35.0 github.com/golang-jwt/jwt/v5 v5.3.1 - github.com/google/go-containerregistry v0.20.7 + github.com/google/go-containerregistry v0.21.2 github.com/jackc/pgx/v5 v5.8.0 github.com/prometheus/client_golang v1.23.2 github.com/rs/cors v1.11.1 @@ -39,9 +39,9 @@ require ( github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0 // indirect github.com/beorn7/perks v1.0.1 // indirect github.com/cespare/xxhash/v2 v2.3.0 // indirect - github.com/containerd/stargz-snapshotter/estargz v0.18.1 // indirect + github.com/containerd/stargz-snapshotter/estargz v0.18.2 // indirect github.com/davecgh/go-spew v1.1.1 // indirect - github.com/docker/cli v29.2.0+incompatible // indirect + github.com/docker/cli v29.2.1+incompatible // indirect github.com/docker/distribution v2.8.3+incompatible // indirect github.com/docker/docker-credential-helpers v0.9.3 // indirect github.com/felixge/httpsnoop v1.0.4 // indirect @@ -55,7 +55,7 @@ require ( github.com/jackc/pgpassfile v1.0.0 // indirect github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect github.com/jackc/puddle/v2 v2.2.2 // indirect - github.com/klauspost/compress v1.18.1 // indirect + github.com/klauspost/compress v1.18.4 // indirect github.com/kylelemons/godebug v1.1.0 // indirect github.com/mitchellh/go-homedir v1.1.0 // indirect github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect @@ -76,7 +76,7 @@ require ( go.yaml.in/yaml/v2 v2.4.3 // indirect golang.org/x/crypto v0.47.0 // indirect golang.org/x/net v0.49.0 // indirect - golang.org/x/oauth2 v0.34.0 // indirect + golang.org/x/oauth2 v0.35.0 // indirect golang.org/x/sync v0.19.0 // indirect golang.org/x/sys v0.41.0 // indirect golang.org/x/text v0.33.0 // indirect diff --git a/go.sum b/go.sum index 73fc2ae..ee31642 100644 --- a/go.sum +++ b/go.sum @@ -36,8 +36,8 @@ github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UF github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= github.com/cncf/xds/go v0.0.0-20251022180443-0feb69152e9f h1:Y8xYupdHxryycyPlc9Y+bSQAYZnetRJ70VMVKm5CKI0= github.com/cncf/xds/go v0.0.0-20251022180443-0feb69152e9f/go.mod h1:HlzOvOjVBOfTGSRXRyY0OiCS/3J1akRGQQpRO/7zyF4= -github.com/containerd/stargz-snapshotter/estargz v0.18.1 h1:cy2/lpgBXDA3cDKSyEfNOFMA/c10O1axL69EU7iirO8= -github.com/containerd/stargz-snapshotter/estargz v0.18.1/go.mod h1:ALIEqa7B6oVDsrF37GkGN20SuvG/pIMm7FwP7ZmRb0Q= +github.com/containerd/stargz-snapshotter/estargz v0.18.2 h1:yXkZFYIzz3eoLwlTUZKz2iQ4MrckBxJjkmD16ynUTrw= +github.com/containerd/stargz-snapshotter/estargz v0.18.2/go.mod h1:XyVU5tcJ3PRpkA9XS2T5us6Eg35yM0214Y+wvrZTBrY= github.com/coreos/go-oidc/v3 v3.17.0 h1:hWBGaQfbi0iVviX4ibC7bk8OKT5qNr4klBaCHVNvehc= github.com/coreos/go-oidc/v3 v3.17.0/go.mod h1:wqPbKFrVnE90vty060SB40FCJ8fTHTxSwyXJqZH+sI8= github.com/danielgtaylor/huma/v2 v2.35.0 h1:FRg3FgVKcMogVhbNY7FjyTwk+p/orLBR3hQBvXXg7dw= @@ -45,8 +45,8 @@ github.com/danielgtaylor/huma/v2 v2.35.0/go.mod h1:3elp5brzdyyZsPlDVvf6w8RLnklKp github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= -github.com/docker/cli v29.2.0+incompatible h1:9oBd9+YM7rxjZLfyMGxjraKBKE4/nVyvVfN4qNl9XRM= -github.com/docker/cli v29.2.0+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= +github.com/docker/cli v29.2.1+incompatible h1:n3Jt0QVCN65eiVBoUTZQM9mcQICCJt3akW4pKAbKdJg= +github.com/docker/cli v29.2.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk= github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w= github.com/docker/docker-credential-helpers v0.9.3 h1:gAm/VtF9wgqJMoxzT3Gj5p4AqIjCBS4wrsOh9yRqcz8= @@ -71,8 +71,8 @@ github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps= github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= -github.com/google/go-containerregistry v0.20.7 h1:24VGNpS0IwrOZ2ms2P1QE3Xa5X9p4phx0aUgzYzHW6I= -github.com/google/go-containerregistry v0.20.7/go.mod h1:Lx5LCZQjLH1QBaMPeGwsME9biPeo1lPx6lbGj/UmzgM= +github.com/google/go-containerregistry v0.21.2 h1:vYaMU4nU55JJGFC9JR/s8NZcTjbE9DBBbvusTW9NeS0= +github.com/google/go-containerregistry v0.21.2/go.mod h1:ctO5aCaewH4AK1AumSF5DPW+0+R+d2FmylMJdp5G7p0= github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0= github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= @@ -91,8 +91,8 @@ github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4= github.com/keybase/go-keychain v0.0.1 h1:way+bWYa6lDppZoZcgMbYsvC7GxljxrskdNInRtuthU= github.com/keybase/go-keychain v0.0.1/go.mod h1:PdEILRW3i9D8JcdM+FmY6RwkHGnhHxXwkPPMeUgOK1k= -github.com/klauspost/compress v1.18.1 h1:bcSGx7UbpBqMChDtsF28Lw6v/G94LPrrbMbdC3JH2co= -github.com/klauspost/compress v1.18.1/go.mod h1:ZQFFVG+MdnR0P+l6wpXgIL4NTtwiKIdBnrBd8Nrxr+0= +github.com/klauspost/compress v1.18.4 h1:RPhnKRAQ4Fh8zU2FY/6ZFDwTVTxgJ/EMydqSTzE9a2c= +github.com/klauspost/compress v1.18.4/go.mod h1:R0h/fSBs8DE4ENlcrlib3PsXS61voFxhIs2DeRhCvJ4= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= @@ -170,8 +170,8 @@ golang.org/x/mod v0.33.0 h1:tHFzIWbBifEmbwtGz65eaWyGiGZatSrT9prnU8DbVL8= golang.org/x/mod v0.33.0/go.mod h1:swjeQEj+6r7fODbD2cqrnje9PnziFuw4bmLbBZFrQ5w= golang.org/x/net v0.49.0 h1:eeHFmOGUTtaaPSGNmjBKpbng9MulQsJURQUAfUwY++o= golang.org/x/net v0.49.0/go.mod h1:/ysNB2EvaqvesRkuLAyjI1ycPZlQHM3q01F02UY/MV8= -golang.org/x/oauth2 v0.34.0 h1:hqK/t4AKgbqWkdkcAeI8XLmbK+4m4G5YeQRrmiotGlw= -golang.org/x/oauth2 v0.34.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA= +golang.org/x/oauth2 v0.35.0 h1:Mv2mzuHuZuY2+bkyWXIHMfhNdJAdwW3FuWeCPYN5GVQ= +golang.org/x/oauth2 v0.35.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA= golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4= golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI= golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= From 2575290393fd4766cfa97a75426323e3bb8b2d5e Mon Sep 17 00:00:00 2001 From: Tadas Antanavicius Date: Sat, 7 Mar 2026 06:53:30 -0800 Subject: [PATCH 126/313] chore(deploy): bump production image tag to 1.5.0 (#1043) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary - Updates the production image tag in `deploy/Pulumi.gcpProd.yaml` from `1.4.1` to `1.5.0` ## Test plan - [ ] Verify the Pulumi deployment picks up the new image tag - [ ] Confirm the v1.5.0 container image exists in the registry 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.6 --- deploy/Pulumi.gcpProd.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/deploy/Pulumi.gcpProd.yaml b/deploy/Pulumi.gcpProd.yaml index f044f2a..0aac0d7 100644 --- a/deploy/Pulumi.gcpProd.yaml +++ b/deploy/Pulumi.gcpProd.yaml @@ -1,7 +1,7 @@ config: mcp-registry:environment: prod mcp-registry:provider: gcp - mcp-registry:imageTag: 1.4.1 # Set specific image tag for production (change this to deploy different versions) + mcp-registry:imageTag: 1.5.0 # Set specific image tag for production (change this to deploy different versions) gcp:project: mcp-registry-prod mcp-registry:githubClientId: Iv23liUydBbI7Z2Q9bOZ mcp-registry:githubClientSecret: From b112ac3335bf22f6e3c379f68c8e9920048c095a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 11 Mar 2026 10:44:47 +0100 Subject: [PATCH 127/313] build(deps): bump the actions group with 2 updates (#1049) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps the actions group with 2 updates: [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) and [anchore/sbom-action](https://github.com/anchore/sbom-action). Updates `sigstore/cosign-installer` from 4.0.0 to 4.1.0
Release notes

Sourced from sigstore/cosign-installer's releases.

v4.1.0

What's Changed

We recommend updating as soon as possible as this includes bug fixes for Cosign. We also recommend removing with: cosign-release and strongly discourage using cosign-release unless you have a specific reason to use an older version of Cosign.

Full Changelog: https://github.com/sigstore/cosign-installer/compare/v4.0.0...v4.1.0

Commits

Updates `anchore/sbom-action` from 0.23.0 to 0.23.1
Release notes

Sourced from anchore/sbom-action's releases.

v0.23.1

⬆️ Dependencies

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/release.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 4b73601..35a9c75 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -25,10 +25,10 @@ jobs: cache: true - name: Install cosign - uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0 + uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0 - name: Install Syft - uses: anchore/sbom-action/download-syft@v0.23.0 + uses: anchore/sbom-action/download-syft@v0.23.1 - name: Run GoReleaser uses: goreleaser/goreleaser-action@ec59f474b9834571250b370d4735c50f8e2d1e29 From b941ee3674f5e33578dddefdeb2b928753684cf7 Mon Sep 17 00:00:00 2001 From: Jonathan Hefner Date: Thu, 12 Mar 2026 05:46:30 -0500 Subject: [PATCH 128/313] Remove `.mdx` suffixes from internal doc links for Mintlify (#1052) These docs are synced to modelcontextprotocol.io which uses Mintlify for rendering. Mintlify routes are extension-less, so links like `./package-types.mdx` produce 404s on the live site. Dropping the `.mdx` suffix fixes those broken links. The trade-off is that the links no longer resolve when browsing the raw files on GitHub. Co-authored-by: Claude Opus 4.6 (1M context) --- docs/modelcontextprotocol-io/about.mdx | 8 ++++---- docs/modelcontextprotocol-io/github-actions.mdx | 2 +- docs/modelcontextprotocol-io/quickstart.mdx | 10 +++++----- docs/modelcontextprotocol-io/registry-aggregators.mdx | 2 +- 4 files changed, 11 insertions(+), 11 deletions(-) diff --git a/docs/modelcontextprotocol-io/about.mdx b/docs/modelcontextprotocol-io/about.mdx index 3f560d0..8a6313f 100644 --- a/docs/modelcontextprotocol-io/about.mdx +++ b/docs/modelcontextprotocol-io/about.mdx @@ -37,7 +37,7 @@ The MCP Registry hosts metadata that points to those packages. For example, a `weather-mcp` package could be hosted on npm, and metadata in the MCP Registry could map the "weather v1.2.0" server to `npm:weather-mcp`. -The [Package Types guide](./package-types.mdx) lists the supported package types and registries. More package registries may be supported in the future based on community demand. If you are interested in building support for a package registry, please [open an issue](https://github.com/modelcontextprotocol/registry). +The [Package Types guide](./package-types) lists the supported package types and registries. More package registries may be supported in the future based on community demand. If you are interested in building support for a package registry, please [open an issue](https://github.com/modelcontextprotocol/registry). ### Relationship with Server Developers @@ -51,7 +51,7 @@ The MCP Registry is intended to be consumed primarily by downstream aggregators, The metadata hosted by the MCP Registry is deliberately unopinionated. Downstream aggregators can provide curation or additional metadata such as community ratings. -We expect that downstream aggregators will use the MCP Registry API to pull new metadata on a regular but infrequent basis (for example, once per hour). See the [MCP Registry Aggregators guide](./registry-aggregators.mdx) for more information. +We expect that downstream aggregators will use the MCP Registry API to pull new metadata on a regular but infrequent basis (for example, once per hour). See the [MCP Registry Aggregators guide](./registry-aggregators) for more information. ### Relationship with Other MCP Registries @@ -71,7 +71,7 @@ The MCP Registry is not intended to be directly consumed by host applications. I The MCP Registry uses namespace authentication to ensure that servers come from their claimed sources. Server names follow a reverse DNS format (like `io.github.username/server` or `com.example/server`) that ties them to verified GitHub accounts or domains. -This namespace system ensures that only the legitimate owner of a GitHub account or domain can publish servers under that namespace, providing trust and accountability in the ecosystem. For details on authentication methods, see the [Authentication guide](./authentication.mdx). +This namespace system ensures that only the legitimate owner of a GitHub account or domain can publish servers under that namespace, providing trust and accountability in the ecosystem. For details on authentication methods, see the [Authentication guide](./authentication). ### Security Scanning @@ -88,6 +88,6 @@ The MCP Registry uses multiple mechanisms to prevent spam: - **Namespace authentication requirements** — Publishers must verify ownership of their namespace through GitHub, DNS, or HTTP challenges, preventing arbitrary spam submissions. - **Character limits and validation** — Free-form fields have strict character limits and regex validation to prevent abuse. -- **Manual takedown** — The registry maintainers can manually remove spam or malicious servers. See the [Moderation Policy](./moderation-policy.mdx) for details on what content is removed. +- **Manual takedown** — The registry maintainers can manually remove spam or malicious servers. See the [Moderation Policy](./moderation-policy) for details on what content is removed. Future spam prevention measures under consideration include stricter rate limiting, AI-based spam detection, and community reporting capabilities. diff --git a/docs/modelcontextprotocol-io/github-actions.mdx b/docs/modelcontextprotocol-io/github-actions.mdx index 1ce90bc..311b28f 100644 --- a/docs/modelcontextprotocol-io/github-actions.mdx +++ b/docs/modelcontextprotocol-io/github-actions.mdx @@ -220,6 +220,6 @@ The workflow will run tests, build the package, publish the package to npm, and | Error Message | Action | | --- | --- | | "Authentication failed" | Ensure `id-token: write` permission is set for OIDC, or check secrets. | -| "Package validation failed" | Verify your package successfully published to the package registry (e.g., npm, PyPI), and that your package has the [necessary verification information](./package-types.mdx). | +| "Package validation failed" | Verify your package successfully published to the package registry (e.g., npm, PyPI), and that your package has the [necessary verification information](./package-types). | {/* prettier-ignore-end */} diff --git a/docs/modelcontextprotocol-io/quickstart.mdx b/docs/modelcontextprotocol-io/quickstart.mdx index f2ae0dd..b33fc17 100644 --- a/docs/modelcontextprotocol-io/quickstart.mdx +++ b/docs/modelcontextprotocol-io/quickstart.mdx @@ -13,7 +13,7 @@ This tutorial will show you how to publish an MCP server written in TypeScript t - **Node.js** — This tutorial assumes the MCP server is written in TypeScript. - **npm account** — The MCP Registry only hosts metadata, not artifacts. Before publishing to the MCP Registry, we will publish the MCP server's package to npm, so you will need an [npm](https://www.npmjs.com) account. -- **GitHub account** — The MCP Registry supports [multiple authentication methods](./authentication.mdx). For simplicity, this tutorial will use GitHub-based authentication, so you will need a [GitHub](https://github.com/) account. +- **GitHub account** — The MCP Registry supports [multiple authentication methods](./authentication). For simplicity, this tutorial will use GitHub-based authentication, so you will need a [GitHub](https://github.com/) account. If you do not have an MCP server written in TypeScript, you can copy the `weather-server-typescript` server from the [`modelcontextprotocol/quickstart-resources` repository](https://github.com/modelcontextprotocol/quickstart-resources) to follow along with this tutorial: @@ -287,7 +287,7 @@ You should see your server's metadata in the search results JSON: ## Next Steps -- Learn about [support for other package types](./package-types.mdx). -- Learn about [support for remote servers](./remote-servers.mdx). -- Learn how to [use other authentication methods](./authentication.mdx), such as [DNS authentication](./authentication.mdx#dns-authentication) which enables custom domains for server name prefixes. -- Learn how to [automate publishing with GitHub Actions](./github-actions.mdx). +- Learn about [support for other package types](./package-types). +- Learn about [support for remote servers](./remote-servers). +- Learn how to [use other authentication methods](./authentication), such as [DNS authentication](./authentication#dns-authentication) which enables custom domains for server name prefixes. +- Learn how to [automate publishing with GitHub Actions](./github-actions). diff --git a/docs/modelcontextprotocol-io/registry-aggregators.mdx b/docs/modelcontextprotocol-io/registry-aggregators.mdx index 93e30af..a2f76c2 100644 --- a/docs/modelcontextprotocol-io/registry-aggregators.mdx +++ b/docs/modelcontextprotocol-io/registry-aggregators.mdx @@ -69,7 +69,7 @@ curl "https://registry.modelcontextprotocol.io/v0.1/servers?updated_since=2025-1 Server metadata is generally immutable, except for the `status` field which may be updated to, e.g., `"deprecated"` or `"deleted"`. We recommend that aggregators keep their copy of each server's `status` up to date. -The `"deleted"` status typically indicates that a server has violated our permissive [moderation policy](./moderation-policy.mdx), suggesting the server might be spam, malware, or illegal. Aggregators may prefer to remove these servers from their index. +The `"deleted"` status typically indicates that a server has violated our permissive [moderation policy](./moderation-policy), suggesting the server might be spam, malware, or illegal. Aggregators may prefer to remove these servers from their index. ## Acting as a Subregistry From 00de8fac8b0c5a93aa08868be4b16b8848638e43 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 12 Mar 2026 11:46:51 +0100 Subject: [PATCH 129/313] build(deps): bump golang.org/x/mod from 0.33.0 to 0.34.0 (#1054) Bumps [golang.org/x/mod](https://github.com/golang/mod) from 0.33.0 to 0.34.0.
Commits
  • 1ac721d go.mod: update golang.org/x dependencies
  • fb1fac8 all: upgrade go directive to at least 1.25.0 [generated]
  • See full diff in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=golang.org/x/mod&package-manager=go_modules&previous-version=0.33.0&new-version=0.34.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index e438a85..8dc72a4 100644 --- a/go.mod +++ b/go.mod @@ -22,7 +22,7 @@ require ( go.opentelemetry.io/otel/metric v1.42.0 go.opentelemetry.io/otel/sdk v1.42.0 go.opentelemetry.io/otel/sdk/metric v1.42.0 - golang.org/x/mod v0.33.0 + golang.org/x/mod v0.34.0 gopkg.in/yaml.v3 v3.0.1 ) diff --git a/go.sum b/go.sum index ee31642..80fcd70 100644 --- a/go.sum +++ b/go.sum @@ -166,8 +166,8 @@ go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0= go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8= golang.org/x/crypto v0.47.0 h1:V6e3FRj+n4dbpw86FJ8Fv7XVOql7TEwpHapKoMJ/GO8= golang.org/x/crypto v0.47.0/go.mod h1:ff3Y9VzzKbwSSEzWqJsJVBnWmRwRSHt/6Op5n9bQc4A= -golang.org/x/mod v0.33.0 h1:tHFzIWbBifEmbwtGz65eaWyGiGZatSrT9prnU8DbVL8= -golang.org/x/mod v0.33.0/go.mod h1:swjeQEj+6r7fODbD2cqrnje9PnziFuw4bmLbBZFrQ5w= +golang.org/x/mod v0.34.0 h1:xIHgNUUnW6sYkcM5Jleh05DvLOtwc6RitGHbDk4akRI= +golang.org/x/mod v0.34.0/go.mod h1:ykgH52iCZe79kzLLMhyCUzhMci+nQj+0XkbXpNYtVjY= golang.org/x/net v0.49.0 h1:eeHFmOGUTtaaPSGNmjBKpbng9MulQsJURQUAfUwY++o= golang.org/x/net v0.49.0/go.mod h1:/ysNB2EvaqvesRkuLAyjI1ycPZlQHM3q01F02UY/MV8= golang.org/x/oauth2 v0.35.0 h1:Mv2mzuHuZuY2+bkyWXIHMfhNdJAdwW3FuWeCPYN5GVQ= From 01b1ae2555763c456f0f05337e85f0807a914625 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 13 Mar 2026 01:30:03 +0100 Subject: [PATCH 130/313] build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.225.1 to 3.226.0 in /deploy (#1057) Bumps [github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from 3.225.1 to 3.226.0.
Release notes

Sourced from github.com/pulumi/pulumi/sdk/v3's releases.

v3.226.0

3.226.0 (2026-03-11)

Features

  • [backend/service] Automatically repair snapshot integrity issues, while sending an error event to the backend for further diagnosis #22179

  • [cli] Add a --otel-traces flag, that allows writing otel traces to a file, or directly to a grpc interface #22129

  • [engine] Engine will use provider references from __self__ arguments to calls #22114

  • [sdk/bun] Support bun as a runtime #22177 #22049

  • [sdk/bun] Add debugger support for the bun runtime #22177

  • [sdk/bun] Add support for Bun as a plugin runtime #22189

Bug Fixes

  • [engine] Fix ReplacementTrigger firing due to dependency changes #22119

  • [engine] Correctly serialize output values to the snapshot rather than always recording them as computed even when known #22120

  • [pcl] Support resource ranges in PCL #22144

  • [cli/config] Include environments used when refreshing a stack's config #22103

  • [cli/display] Fix pulumi destroy not showing parent resource hierarchy #22148

  • [cli/package] Correctly parse package URLs with .git in them #22174

  • [cli/plugin] Fix package get-schema for binary providers at relative paths #22107

  • [sdk/python] Handle null detailedDiff in automation StepEventMetadata JSON parsing

... (truncated)

Changelog

Sourced from github.com/pulumi/pulumi/sdk/v3's changelog.

Changelog

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/pulumi/pulumi/sdk/v3&package-manager=go_modules&previous-version=3.225.1&new-version=3.226.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- deploy/go.mod | 26 +++++++++++----------- deploy/go.sum | 60 +++++++++++++++++++++++++-------------------------- 2 files changed, 43 insertions(+), 43 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index 15e0dc8..69dd231 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -5,7 +5,7 @@ go 1.25.6 require ( github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.27.0 - github.com/pulumi/pulumi/sdk/v3 v3.225.1 + github.com/pulumi/pulumi/sdk/v3 v3.226.0 gopkg.in/yaml.v2 v2.4.0 ) @@ -29,7 +29,7 @@ require ( github.com/charmbracelet/x/cellbuf v0.0.15 // indirect github.com/charmbracelet/x/term v0.2.2 // indirect github.com/cheggaaa/pb v1.0.29 // indirect - github.com/clipperhouse/displaywidth v0.10.0 // indirect + github.com/clipperhouse/displaywidth v0.11.0 // indirect github.com/clipperhouse/uax29/v2 v2.7.0 // indirect github.com/cloudflare/circl v1.6.3 // indirect github.com/cyphar/filepath-securejoin v0.4.1 // indirect @@ -45,7 +45,7 @@ require ( github.com/golang/glog v1.2.5 // indirect github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect github.com/google/uuid v1.6.0 // indirect - github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.7 // indirect + github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 // indirect github.com/grpc-ecosystem/grpc-opentracing v0.0.0-20180507213350-8e809c8a8645 // indirect github.com/hashicorp/errwrap v1.1.0 // indirect github.com/hashicorp/go-multierror v1.1.1 // indirect @@ -91,14 +91,14 @@ require ( github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect github.com/zclconf/go-cty v1.13.2 // indirect go.opentelemetry.io/auto/sdk v1.2.1 // indirect - go.opentelemetry.io/collector/featuregate v1.51.0 // indirect - go.opentelemetry.io/collector/pdata v1.51.0 // indirect - go.opentelemetry.io/otel v1.40.0 // indirect - go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.40.0 // indirect - go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.40.0 // indirect - go.opentelemetry.io/otel/metric v1.40.0 // indirect - go.opentelemetry.io/otel/sdk v1.40.0 // indirect - go.opentelemetry.io/otel/trace v1.40.0 // indirect + go.opentelemetry.io/collector/featuregate v1.53.0 // indirect + go.opentelemetry.io/collector/pdata v1.53.0 // indirect + go.opentelemetry.io/otel v1.41.0 // indirect + go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.41.0 // indirect + go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.41.0 // indirect + go.opentelemetry.io/otel/metric v1.41.0 // indirect + go.opentelemetry.io/otel/sdk v1.41.0 // indirect + go.opentelemetry.io/otel/trace v1.41.0 // indirect go.opentelemetry.io/proto/otlp v1.9.0 // indirect go.uber.org/atomic v1.11.0 // indirect go.uber.org/multierr v1.11.0 // indirect @@ -111,8 +111,8 @@ require ( golang.org/x/term v0.40.0 // indirect golang.org/x/text v0.34.0 // indirect golang.org/x/tools v0.41.0 // indirect - google.golang.org/genproto/googleapis/api v0.0.0-20260128011058-8636f8732409 // indirect - google.golang.org/genproto/googleapis/rpc v0.0.0-20260217215200-42d3e9bedb6d // indirect + google.golang.org/genproto/googleapis/api v0.0.0-20260226221140-a57be14db171 // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 // indirect google.golang.org/grpc v1.79.1 // indirect google.golang.org/protobuf v1.36.11 // indirect gopkg.in/warnings.v0 v0.1.2 // indirect diff --git a/deploy/go.sum b/deploy/go.sum index 469e3ec..d15fb31 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -43,8 +43,8 @@ github.com/charmbracelet/x/term v0.2.2 h1:xVRT/S2ZcKdhhOuSP4t5cLi5o+JxklsoEObBSg github.com/charmbracelet/x/term v0.2.2/go.mod h1:kF8CY5RddLWrsgVwpw4kAa6TESp6EB5y3uxGLeCqzAI= github.com/cheggaaa/pb v1.0.29 h1:FckUN5ngEk2LpvuG0fw1GEFx6LtyY2pWI/Z2QgCnEYo= github.com/cheggaaa/pb v1.0.29/go.mod h1:W40334L7FMC5JKWldsTWbdGjLo0RxUKK73K+TuPxX30= -github.com/clipperhouse/displaywidth v0.10.0 h1:GhBG8WuerxjFQQYeuZAeVTuyxuX+UraiZGD4HJQ3Y8g= -github.com/clipperhouse/displaywidth v0.10.0/go.mod h1:XqJajYsaiEwkxOj4bowCTMcT1SgvHo9flfF3jQasdbs= +github.com/clipperhouse/displaywidth v0.11.0 h1:lBc6kY44VFw+TDx4I8opi/EtL9m20WSEFgwIwO+UVM8= +github.com/clipperhouse/displaywidth v0.11.0/go.mod h1:bkrFNkf81G8HyVqmKGxsPufD3JhNl3dSqnGhOoSD/o0= github.com/clipperhouse/uax29/v2 v2.7.0 h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJv2v7Vk= github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM= github.com/cloudflare/circl v1.6.3 h1:9GPOhQGF9MCYUeXyMYlqTR6a5gTrgR/fBLXvUgtVcg8= @@ -95,8 +95,8 @@ github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= -github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.7 h1:X+2YciYSxvMQK0UZ7sg45ZVabVZBeBuvMkmuI2V3Fak= -github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.7/go.mod h1:lW34nIZuQ8UDPdkon5fmfp2l3+ZkQ2me/+oecHYLOII= +github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 h1:HWRh5R2+9EifMyIHV7ZV+MIZqgz+PMpZ14Jynv3O2Zs= +github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0/go.mod h1:JfhWUomR1baixubs02l85lZYYOm7LV6om4ceouMv45c= github.com/grpc-ecosystem/grpc-opentracing v0.0.0-20180507213350-8e809c8a8645 h1:MJG/KsmcqMwFAkh8mTnAwhyKoB+sTAnY4CACC110tbU= github.com/grpc-ecosystem/grpc-opentracing v0.0.0-20180507213350-8e809c8a8645/go.mod h1:6iZfnjpejD4L/4DwD7NryNaJyCQdzwWwH2MWhCA90Kw= github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4= @@ -185,8 +185,8 @@ github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 h1:w6OnO3d4j5yVf2vpm8OzXFC/xHOEGqt+9 github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1/go.mod h1:UyZyv7hz4knpFx6/Sh+SkZe6hT6sJHtDvw9A0TbvEsk= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.27.0 h1:l33vcOD62jlEIiD/POknlKrVF4JG2ZV87khzavYwkR0= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.27.0/go.mod h1:B998wofejDKAvvpLwsi4UMfWDFHHBnzYiM8mZ9e7OSo= -github.com/pulumi/pulumi/sdk/v3 v3.225.1 h1:yn64PBZocE0Ums82fc6jaWRZthZ352BFi/tVAs5jrps= -github.com/pulumi/pulumi/sdk/v3 v3.225.1/go.mod h1:kiwkjulVm9ibqTOcyrZYhaRZsDSxWpzIKPXtCFeffBE= +github.com/pulumi/pulumi/sdk/v3 v3.226.0 h1:C24HWnoJSspq/KweSkAAAqWht/5pEkDanoxHe0al/dM= +github.com/pulumi/pulumi/sdk/v3 v3.226.0/go.mod h1:l88lS+aGRt37BD/nyPMEOYw+RmjG5baSH7eLtmTKpy0= github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ= github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88= github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ= @@ -231,26 +231,26 @@ github.com/zclconf/go-cty v1.13.2 h1:4GvrUxe/QUDYuJKAav4EYqdM47/kZa672LwmXFmEKT0 github.com/zclconf/go-cty v1.13.2/go.mod h1:YKQzy/7pZ7iq2jNFzy5go57xdxdWoLLpaEp4u238AE0= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y= -go.opentelemetry.io/collector/featuregate v1.51.0 h1:dxJuv/3T84dhNKp7fz5+8srHz1dhquGzDpLW4OZTFBw= -go.opentelemetry.io/collector/featuregate v1.51.0/go.mod h1:/1bclXgP91pISaEeNulRxzzmzMTm4I5Xih2SnI4HRSo= -go.opentelemetry.io/collector/internal/testutil v0.145.0 h1:H/KL0GH3kGqSMKxZvnQ0B0CulfO9xdTg4DZf28uV7fY= -go.opentelemetry.io/collector/internal/testutil v0.145.0/go.mod h1:YAD9EAkwh/l5asZNbEBEUCqEjoL1OKMjAMoPjPqH76c= -go.opentelemetry.io/collector/pdata v1.51.0 h1:DnDhSEuDXNdzGRB7f6oOfXpbDApwBX3tY+3K69oUrDA= -go.opentelemetry.io/collector/pdata v1.51.0/go.mod h1:GoX1bjKDR++mgFKdT7Hynv9+mdgQ1DDXbjs7/Ww209Q= -go.opentelemetry.io/otel v1.40.0 h1:oA5YeOcpRTXq6NN7frwmwFR0Cn3RhTVZvXsP4duvCms= -go.opentelemetry.io/otel v1.40.0/go.mod h1:IMb+uXZUKkMXdPddhwAHm6UfOwJyh4ct1ybIlV14J0g= -go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.40.0 h1:QKdN8ly8zEMrByybbQgv8cWBcdAarwmIPZ6FThrWXJs= -go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.40.0/go.mod h1:bTdK1nhqF76qiPoCCdyFIV+N/sRHYXYCTQc+3VCi3MI= -go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.40.0 h1:DvJDOPmSWQHWywQS6lKL+pb8s3gBLOZUtw4N+mavW1I= -go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.40.0/go.mod h1:EtekO9DEJb4/jRyN4v4Qjc2yA7AtfCBuz2FynRUWTXs= -go.opentelemetry.io/otel/metric v1.40.0 h1:rcZe317KPftE2rstWIBitCdVp89A2HqjkxR3c11+p9g= -go.opentelemetry.io/otel/metric v1.40.0/go.mod h1:ib/crwQH7N3r5kfiBZQbwrTge743UDc7DTFVZrrXnqc= -go.opentelemetry.io/otel/sdk v1.40.0 h1:KHW/jUzgo6wsPh9At46+h4upjtccTmuZCFAc9OJ71f8= -go.opentelemetry.io/otel/sdk v1.40.0/go.mod h1:Ph7EFdYvxq72Y8Li9q8KebuYUr2KoeyHx0DRMKrYBUE= -go.opentelemetry.io/otel/sdk/metric v1.40.0 h1:mtmdVqgQkeRxHgRv4qhyJduP3fYJRMX4AtAlbuWdCYw= -go.opentelemetry.io/otel/sdk/metric v1.40.0/go.mod h1:4Z2bGMf0KSK3uRjlczMOeMhKU2rhUqdWNoKcYrtcBPg= -go.opentelemetry.io/otel/trace v1.40.0 h1:WA4etStDttCSYuhwvEa8OP8I5EWu24lkOzp+ZYblVjw= -go.opentelemetry.io/otel/trace v1.40.0/go.mod h1:zeAhriXecNGP/s2SEG3+Y8X9ujcJOTqQ5RgdEJcawiA= +go.opentelemetry.io/collector/featuregate v1.53.0 h1:cgjXdtl7jezWxq6V0eohe/JqjY4PBotZGb5+bTR2OJw= +go.opentelemetry.io/collector/featuregate v1.53.0/go.mod h1:PS7zY/zaCb28EqciePVwRHVhc3oKortTFXsi3I6ee4g= +go.opentelemetry.io/collector/internal/testutil v0.147.0 h1:DFlRxBRp23/sZnpTITK25yqe0d56yNvK+63IaWc6OsU= +go.opentelemetry.io/collector/internal/testutil v0.147.0/go.mod h1:Jkjs6rkqs973LqgZ0Fe3zrokQRKULYXPIf4HuqStiEE= +go.opentelemetry.io/collector/pdata v1.53.0 h1:DlYDbRwammEZaxDZHINx5v0n8SEOVNniPbi6FRTlVkA= +go.opentelemetry.io/collector/pdata v1.53.0/go.mod h1:LRSYGNjKXaUrZEwZv3Yl+8/zV2HmRGKXW62zB2bysms= +go.opentelemetry.io/otel v1.41.0 h1:YlEwVsGAlCvczDILpUXpIpPSL/VPugt7zHThEMLce1c= +go.opentelemetry.io/otel v1.41.0/go.mod h1:Yt4UwgEKeT05QbLwbyHXEwhnjxNO6D8L5PQP51/46dE= +go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.41.0 h1:ao6Oe+wSebTlQ1OEht7jlYTzQKE+pnx/iNywFvTbuuI= +go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.41.0/go.mod h1:u3T6vz0gh/NVzgDgiwkgLxpsSF6PaPmo2il0apGJbls= +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.41.0 h1:mq/Qcf28TWz719lE3/hMB4KkyDuLJIvgJnFGcd0kEUI= +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.41.0/go.mod h1:yk5LXEYhsL2htyDNJbEq7fWzNEigeEdV5xBF/Y+kAv0= +go.opentelemetry.io/otel/metric v1.41.0 h1:rFnDcs4gRzBcsO9tS8LCpgR0dxg4aaxWlJxCno7JlTQ= +go.opentelemetry.io/otel/metric v1.41.0/go.mod h1:xPvCwd9pU0VN8tPZYzDZV/BMj9CM9vs00GuBjeKhJps= +go.opentelemetry.io/otel/sdk v1.41.0 h1:YPIEXKmiAwkGl3Gu1huk1aYWwtpRLeskpV+wPisxBp8= +go.opentelemetry.io/otel/sdk v1.41.0/go.mod h1:ahFdU0G5y8IxglBf0QBJXgSe7agzjE4GiTJ6HT9ud90= +go.opentelemetry.io/otel/sdk/metric v1.41.0 h1:siZQIYBAUd1rlIWQT2uCxWJxcCO7q3TriaMlf08rXw8= +go.opentelemetry.io/otel/sdk/metric v1.41.0/go.mod h1:HNBuSvT7ROaGtGI50ArdRLUnvRTRGniSUZbxiWxSO8Y= +go.opentelemetry.io/otel/trace v1.41.0 h1:Vbk2co6bhj8L59ZJ6/xFTskY+tGAbOnCtQGVVa9TIN0= +go.opentelemetry.io/otel/trace v1.41.0/go.mod h1:U1NU4ULCoxeDKc09yCWdWe+3QoyweJcISEVa1RBzOis= go.opentelemetry.io/proto/otlp v1.9.0 h1:l706jCMITVouPOqEnii2fIAuO3IVGBRPV5ICjceRb/A= go.opentelemetry.io/proto/otlp v1.9.0/go.mod h1:xE+Cx5E/eEHw+ISFkwPLwCZefwVjY+pqKg1qcK03+/4= go.opentelemetry.io/proto/slim/otlp v1.9.0 h1:fPVMv8tP3TrsqlkH1HWYUpbCY9cAIemx184VGkS6vlE= @@ -331,10 +331,10 @@ golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8T golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk= gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E= -google.golang.org/genproto/googleapis/api v0.0.0-20260128011058-8636f8732409 h1:merA0rdPeUV3YIIfHHcH4qBkiQAc1nfCKSI7lB4cV2M= -google.golang.org/genproto/googleapis/api v0.0.0-20260128011058-8636f8732409/go.mod h1:fl8J1IvUjCilwZzQowmw2b7HQB2eAuYBabMXzWurF+I= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260217215200-42d3e9bedb6d h1:t/LOSXPJ9R0B6fnZNyALBRfZBH0Uy0gT+uR+SJ6syqQ= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260217215200-42d3e9bedb6d/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= +google.golang.org/genproto/googleapis/api v0.0.0-20260226221140-a57be14db171 h1:tu/dtnW1o3wfaxCOjSLn5IRX4YDcJrtlpzYkhHhGaC4= +google.golang.org/genproto/googleapis/api v0.0.0-20260226221140-a57be14db171/go.mod h1:M5krXqk4GhBKvB596udGL3UyjL4I1+cTbK0orROM9ng= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 h1:ggcbiqK8WWh6l1dnltU4BgWGIGo+EVYxCaAPih/zQXQ= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= google.golang.org/grpc v1.79.1 h1:zGhSi45ODB9/p3VAawt9a+O/MULLl9dpizzNNpq7flY= google.golang.org/grpc v1.79.1/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ= google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE= From a94c56a78fe39e8e0d928b498d9b866939435300 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 13 Mar 2026 11:53:31 +0100 Subject: [PATCH 131/313] build(deps): bump github.com/pulumi/pulumi-kubernetes/sdk/v4 from 4.27.0 to 4.28.0 in /deploy (#1056) Bumps [github.com/pulumi/pulumi-kubernetes/sdk/v4](https://github.com/pulumi/pulumi-kubernetes) from 4.27.0 to 4.28.0.
Release notes

Sourced from github.com/pulumi/pulumi-kubernetes/sdk/v4's releases.

v4.28.0

No release notes provided.

Changelog

Sourced from github.com/pulumi/pulumi-kubernetes/sdk/v4's changelog.

4.28.0 (March 12, 2026)

Changed

  • Upgrade Kubernetes schema and libraries to v1.35.2.
Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/pulumi/pulumi-kubernetes/sdk/v4&package-manager=go_modules&previous-version=4.27.0&new-version=4.28.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- deploy/go.mod | 2 +- deploy/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index 69dd231..5e27853 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -4,7 +4,7 @@ go 1.25.6 require ( github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 - github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.27.0 + github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.28.0 github.com/pulumi/pulumi/sdk/v3 v3.226.0 gopkg.in/yaml.v2 v2.4.0 ) diff --git a/deploy/go.sum b/deploy/go.sum index d15fb31..4927a39 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -183,8 +183,8 @@ github.com/pulumi/esc v0.17.0 h1:oaVOIyFTENlYDuqc3pW75lQT9jb2cd6ie/4/Twxn66w= github.com/pulumi/esc v0.17.0/go.mod h1:XnSxlt5NkmuAj304l/gK4pRErFbtqq6XpfX1tYT9Jbc= github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 h1:w6OnO3d4j5yVf2vpm8OzXFC/xHOEGqt+9FjWCUBCq6U= github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1/go.mod h1:UyZyv7hz4knpFx6/Sh+SkZe6hT6sJHtDvw9A0TbvEsk= -github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.27.0 h1:l33vcOD62jlEIiD/POknlKrVF4JG2ZV87khzavYwkR0= -github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.27.0/go.mod h1:B998wofejDKAvvpLwsi4UMfWDFHHBnzYiM8mZ9e7OSo= +github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.28.0 h1:muCE6cUJ4YmAaNLiOhbjEicxT+10i/EGsZrx2ZZQQ+o= +github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.28.0/go.mod h1:B998wofejDKAvvpLwsi4UMfWDFHHBnzYiM8mZ9e7OSo= github.com/pulumi/pulumi/sdk/v3 v3.226.0 h1:C24HWnoJSspq/KweSkAAAqWht/5pEkDanoxHe0al/dM= github.com/pulumi/pulumi/sdk/v3 v3.226.0/go.mod h1:l88lS+aGRt37BD/nyPMEOYw+RmjG5baSH7eLtmTKpy0= github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ= From 52178183f38ec8ff7888cce11daab35dd589b4db Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 16 Mar 2026 17:06:31 +0200 Subject: [PATCH 132/313] build(deps): bump github.com/danielgtaylor/huma/v2 from 2.35.0 to 2.37.2 (#989) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [github.com/danielgtaylor/huma/v2](https://github.com/danielgtaylor/huma) from 2.35.0 to 2.37.2.
Release notes

Sourced from github.com/danielgtaylor/huma/v2's releases.

v2.37.2

Overview

This bugfix release fixes an issue with how form data was being documented in OpenAPI.

This also fixes embedded objects with valid JSON tags being incorrectly embedded in the OpenAPI docs.

What's Changed

Full Changelog: https://github.com/danielgtaylor/huma/compare/v2.37.1...v2.37.2

v2.37.1

Overview

This bugfix release fixes an issue regarding the Swagger UI docs renderer, as well as fixes an issue preventing Groups from using the configurable options released in v2.37.1.

This also brings interface constructors to humamux.

What's Changed

Full Changelog: https://github.com/danielgtaylor/huma/compare/v2.37.0...v2.37.1

v2.37.0

Overview

Dropped Explicit IDN-Hostname Validation

This validation unintentionally imported an external library to the base Huma library. Since this was not a requested feature, it has been removed for now. The idn-hostname format value has become an alias for hostname in the meantime.

Operation ID Normalization

Spaces in operation IDs get automatically converted to hyphens now.

Optimizations & Fixed Memory Leak

Various internal operations have been optimized (~7% overall improvement): danielgtaylor/huma#973

A memory leak when using MultipartFormFiles has been resolved.

New Configurable Options

Allow Additional Properties By Default

A new config option has been added to allow additional properties by default. This can be set in the API config.

config.AllowAdditionalPropertiesByDefault = true

... (truncated)

Commits
  • 887f7d4 Fix form param doc regression (#981)
  • f02efeb Fix OpenAPI path prefix regression from $schema fix PR (#979)
  • cbf60b6 Don't embed embedded objects with valid JSON tags (#978)
  • 6d0295c fix(group): ensure "Group" satisfies the configProvider interface (#976)
  • 07ca6c5 fix(api): use proper CSP hash for inline script in Swagger doc renderer (#977)
  • 58edcf2 Export humamux constructors (#965)
  • 6c29f67 chore(api,docs): update unpkg libraries, specify SRI hash, add strict CSP (#916)
  • 3aee9bd Additional docs + normalize operation IDs (#974)
  • e31a819 Resource optimizations, Go 1.25, remove IDNA library, add benchmark CI (#973)
  • ddbb810 Implement Registry and Query Validation Options (#925)
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/danielgtaylor/huma/v2&package-manager=go_modules&previous-version=2.35.0&new-version=2.37.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
--------- Signed-off-by: dependabot[bot] Signed-off-by: Radoslav Dimitrov Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Radoslav Dimitrov --- go.mod | 11 +++++++---- go.sum | 30 ++++++++++++++++++++++-------- pkg/model/types.go | 16 ++++++++-------- 3 files changed, 37 insertions(+), 20 deletions(-) diff --git a/go.mod b/go.mod index 8dc72a4..839f617 100644 --- a/go.mod +++ b/go.mod @@ -8,13 +8,14 @@ require ( github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.4.0 github.com/caarlos0/env/v11 v11.4.0 github.com/coreos/go-oidc/v3 v3.17.0 - github.com/danielgtaylor/huma/v2 v2.35.0 + github.com/danielgtaylor/huma/v2 v2.37.2 github.com/golang-jwt/jwt/v5 v5.3.1 github.com/google/go-containerregistry v0.21.2 github.com/jackc/pgx/v5 v5.8.0 github.com/prometheus/client_golang v1.23.2 github.com/rs/cors v1.11.1 github.com/santhosh-tekuri/jsonschema/v5 v5.3.1 + github.com/spf13/cobra v1.10.2 github.com/stretchr/testify v1.11.1 go.opentelemetry.io/contrib/instrumentation/runtime v0.67.0 go.opentelemetry.io/otel v1.42.0 @@ -52,6 +53,7 @@ require ( github.com/google/uuid v1.6.0 // indirect github.com/googleapis/enterprise-certificate-proxy v0.3.11 // indirect github.com/googleapis/gax-go/v2 v2.17.0 // indirect + github.com/inconshreveable/mousetrap v1.1.0 // indirect github.com/jackc/pgpassfile v1.0.0 // indirect github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect github.com/jackc/puddle/v2 v2.2.2 // indirect @@ -68,18 +70,19 @@ require ( github.com/prometheus/otlptranslator v1.0.0 // indirect github.com/prometheus/procfs v0.19.2 // indirect github.com/sirupsen/logrus v1.9.3 // indirect + github.com/spf13/pflag v1.0.10 // indirect github.com/vbatts/tar-split v0.12.2 // indirect go.opentelemetry.io/auto/sdk v1.2.1 // indirect go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 // indirect go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect go.opentelemetry.io/otel/trace v1.42.0 // indirect go.yaml.in/yaml/v2 v2.4.3 // indirect - golang.org/x/crypto v0.47.0 // indirect - golang.org/x/net v0.49.0 // indirect + golang.org/x/crypto v0.48.0 // indirect + golang.org/x/net v0.51.0 // indirect golang.org/x/oauth2 v0.35.0 // indirect golang.org/x/sync v0.19.0 // indirect golang.org/x/sys v0.41.0 // indirect - golang.org/x/text v0.33.0 // indirect + golang.org/x/text v0.34.0 // indirect golang.org/x/time v0.14.0 // indirect google.golang.org/api v0.265.0 // indirect google.golang.org/genproto v0.0.0-20260128011058-8636f8732409 // indirect diff --git a/go.sum b/go.sum index 80fcd70..fd1a9e7 100644 --- a/go.sum +++ b/go.sum @@ -40,8 +40,9 @@ github.com/containerd/stargz-snapshotter/estargz v0.18.2 h1:yXkZFYIzz3eoLwlTUZKz github.com/containerd/stargz-snapshotter/estargz v0.18.2/go.mod h1:XyVU5tcJ3PRpkA9XS2T5us6Eg35yM0214Y+wvrZTBrY= github.com/coreos/go-oidc/v3 v3.17.0 h1:hWBGaQfbi0iVviX4ibC7bk8OKT5qNr4klBaCHVNvehc= github.com/coreos/go-oidc/v3 v3.17.0/go.mod h1:wqPbKFrVnE90vty060SB40FCJ8fTHTxSwyXJqZH+sI8= -github.com/danielgtaylor/huma/v2 v2.35.0 h1:FRg3FgVKcMogVhbNY7FjyTwk+p/orLBR3hQBvXXg7dw= -github.com/danielgtaylor/huma/v2 v2.35.0/go.mod h1:3elp5brzdyyZsPlDVvf6w8RLnklKp3abolr+5op3fP0= +github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g= +github.com/danielgtaylor/huma/v2 v2.37.2 h1:Nf9vjy2sxBJFaupPlthXL/Hy2+LurfVbaKHmCMEI7xE= +github.com/danielgtaylor/huma/v2 v2.37.2/go.mod h1:95S04G/lExFRYlBkKaBaZm9lVmxRmqX9f2CgoOZ11AM= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= @@ -58,6 +59,8 @@ github.com/envoyproxy/protoc-gen-validate v1.2.1 h1:DEo3O99U8j4hBFwbJfrz9VtgcDfU github.com/envoyproxy/protoc-gen-validate v1.2.1/go.mod h1:d/C80l/jxXLdfEIhX1W2TmLfsJ31lvEjwamM4DxlWXU= github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg= github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U= +github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM= +github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ= github.com/go-jose/go-jose/v4 v4.1.3 h1:CVLmWDhDVRa6Mi/IgCgaopNosCaHz7zrMeF9MlZRkrs= github.com/go-jose/go-jose/v4 v4.1.3/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08= github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= @@ -81,6 +84,8 @@ github.com/googleapis/enterprise-certificate-proxy v0.3.11 h1:vAe81Msw+8tKUxi2Dq github.com/googleapis/enterprise-certificate-proxy v0.3.11/go.mod h1:RFV7MUdlb7AgEq2v7FmMCfeSMCllAzWxFgRdusoGks8= github.com/googleapis/gax-go/v2 v2.17.0 h1:RksgfBpxqff0EZkDWYuz9q/uWsTVz+kf43LsZ1J6SMc= github.com/googleapis/gax-go/v2 v2.17.0/go.mod h1:mzaqghpQp4JDh3HvADwrat+6M3MOIDp5YKHhb9PAgDY= +github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8= +github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM= github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg= github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo= @@ -129,10 +134,16 @@ github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0t github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc= github.com/rs/cors v1.11.1 h1:eU3gRzXLRK57F5rKMGMZURNdIG4EoAmX8k94r9wXWHA= github.com/rs/cors v1.11.1/go.mod h1:XyqrcTp5zjWr1wsJ8PIRZssZ8b/WMcMf71DJnit4EMU= +github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM= github.com/santhosh-tekuri/jsonschema/v5 v5.3.1 h1:lZUw3E0/J3roVtGQ+SCrUrg3ON6NgVqpn3+iol9aGu4= github.com/santhosh-tekuri/jsonschema/v5 v5.3.1/go.mod h1:uToXkOrWAZ6/Oc07xWQrPOhJotwFIyu2bBVN41fcDUY= github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ= github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ= +github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU= +github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4= +github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= +github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk= +github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= @@ -140,6 +151,8 @@ github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= github.com/vbatts/tar-split v0.12.2 h1:w/Y6tjxpeiFMR47yzZPlPj/FcPLpXbTUi/9H7d3CPa4= github.com/vbatts/tar-split v0.12.2/go.mod h1:eF6B6i6ftWQcDqEn3/iGFRFRo8cBIMSJVOpnNdfTMFA= +github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM= +github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y= go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 h1:q4XOmH/0opmeuJtPsbFNivyl7bCt7yRBbeEm2sC/XtQ= @@ -164,12 +177,13 @@ go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE= go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0= go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8= -golang.org/x/crypto v0.47.0 h1:V6e3FRj+n4dbpw86FJ8Fv7XVOql7TEwpHapKoMJ/GO8= -golang.org/x/crypto v0.47.0/go.mod h1:ff3Y9VzzKbwSSEzWqJsJVBnWmRwRSHt/6Op5n9bQc4A= +go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= +golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts= +golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos= golang.org/x/mod v0.34.0 h1:xIHgNUUnW6sYkcM5Jleh05DvLOtwc6RitGHbDk4akRI= golang.org/x/mod v0.34.0/go.mod h1:ykgH52iCZe79kzLLMhyCUzhMci+nQj+0XkbXpNYtVjY= -golang.org/x/net v0.49.0 h1:eeHFmOGUTtaaPSGNmjBKpbng9MulQsJURQUAfUwY++o= -golang.org/x/net v0.49.0/go.mod h1:/ysNB2EvaqvesRkuLAyjI1ycPZlQHM3q01F02UY/MV8= +golang.org/x/net v0.51.0 h1:94R/GTO7mt3/4wIKpcR5gkGmRLOuE/2hNGeWq/GBIFo= +golang.org/x/net v0.51.0/go.mod h1:aamm+2QF5ogm02fjy5Bb7CQ0WMt1/WVM7FtyaTLlA9Y= golang.org/x/oauth2 v0.35.0 h1:Mv2mzuHuZuY2+bkyWXIHMfhNdJAdwW3FuWeCPYN5GVQ= golang.org/x/oauth2 v0.35.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA= golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4= @@ -178,8 +192,8 @@ golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBc golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k= golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= -golang.org/x/text v0.33.0 h1:B3njUFyqtHDUI5jMn1YIr5B0IE2U0qck04r6d4KPAxE= -golang.org/x/text v0.33.0/go.mod h1:LuMebE6+rBincTi9+xWTY8TztLzKHc/9C1uBCG27+q8= +golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk= +golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA= golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI= golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4= gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk= diff --git a/pkg/model/types.go b/pkg/model/types.go index 8a7443d..03d2841 100644 --- a/pkg/model/types.go +++ b/pkg/model/types.go @@ -78,13 +78,13 @@ type Input struct { } type InputWithVariables struct { - Input `json:",inline"` + Input Variables map[string]Input `json:"variables,omitempty" doc:"A map of variable names to their values. Keys in the input value that are wrapped in {curly_braces} will be replaced with the corresponding variable values."` } type KeyValueInput struct { - InputWithVariables `json:",inline"` - Name string `json:"name" doc:"Name of the header or environment variable." example:"SOME_VARIABLE"` + InputWithVariables + Name string `json:"name" doc:"Name of the header or environment variable." example:"SOME_VARIABLE"` } type ArgumentType string @@ -95,11 +95,11 @@ const ( ) type Argument struct { - InputWithVariables `json:",inline"` - Type ArgumentType `json:"type" doc:"Argument type: 'positional' or 'named'" example:"positional"` - Name string `json:"name,omitempty" doc:"The flag name (for named arguments), including any leading dashes. Empty for positional arguments." example:"--port"` - ValueHint string `json:"valueHint,omitempty" doc:"An identifier for positional arguments. Used in transport URL variable substitution." example:"file_path"` - IsRepeated bool `json:"isRepeated,omitempty" doc:"Whether the argument can be repeated multiple times."` + InputWithVariables + Type ArgumentType `json:"type" doc:"Argument type: 'positional' or 'named'" example:"positional"` + Name string `json:"name,omitempty" doc:"The flag name (for named arguments), including any leading dashes. Empty for positional arguments." example:"--port"` + ValueHint string `json:"valueHint,omitempty" doc:"An identifier for positional arguments. Used in transport URL variable substitution." example:"file_path"` + IsRepeated bool `json:"isRepeated,omitempty" doc:"Whether the argument can be repeated multiple times."` } type Icon struct { From 9c7c8805ccd79e1996dec9c21a2623c5a9bb8676 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 19 Mar 2026 23:51:32 +0200 Subject: [PATCH 133/313] build(deps): bump github.com/google/go-containerregistry from 0.21.2 to 0.21.3 (#1073) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) from 0.21.2 to 0.21.3.
Release notes

Sourced from github.com/google/go-containerregistry's releases.

v0.21.3

What's Changed

New Contributors

Full Changelog: https://github.com/google/go-containerregistry/compare/v0.21.2...v0.21.3

Commits
  • 3888fb8 bump golang to 1.25.7 (#2236)
  • f439624 tarball: detect symlink cycles in extractFileFromTar (#2232)
  • 400c263 mutate: reject path traversal and symlink escape in Extract (#2227)
  • 47eedc9 Bump goreleaser/goreleaser-action in the actions group (#2220)
  • be0a845 Bump the go-deps group across 4 directories with 7 updates (#2233)
  • e916301 migrate to github.com/moby/moby modules (#2228)
  • 8b2478e Adds local file support to the crane index subcommand (#2223)
  • See full diff in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/google/go-containerregistry&package-manager=go_modules&previous-version=0.21.2&new-version=0.21.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 16 +++++++--------- go.sum | 41 ++++++++++++++--------------------------- 2 files changed, 21 insertions(+), 36 deletions(-) diff --git a/go.mod b/go.mod index 839f617..07633b4 100644 --- a/go.mod +++ b/go.mod @@ -10,12 +10,11 @@ require ( github.com/coreos/go-oidc/v3 v3.17.0 github.com/danielgtaylor/huma/v2 v2.37.2 github.com/golang-jwt/jwt/v5 v5.3.1 - github.com/google/go-containerregistry v0.21.2 + github.com/google/go-containerregistry v0.21.3 github.com/jackc/pgx/v5 v5.8.0 github.com/prometheus/client_golang v1.23.2 github.com/rs/cors v1.11.1 github.com/santhosh-tekuri/jsonschema/v5 v5.3.1 - github.com/spf13/cobra v1.10.2 github.com/stretchr/testify v1.11.1 go.opentelemetry.io/contrib/instrumentation/runtime v0.67.0 go.opentelemetry.io/otel v1.42.0 @@ -42,7 +41,7 @@ require ( github.com/cespare/xxhash/v2 v2.3.0 // indirect github.com/containerd/stargz-snapshotter/estargz v0.18.2 // indirect github.com/davecgh/go-spew v1.1.1 // indirect - github.com/docker/cli v29.2.1+incompatible // indirect + github.com/docker/cli v29.3.0+incompatible // indirect github.com/docker/distribution v2.8.3+incompatible // indirect github.com/docker/docker-credential-helpers v0.9.3 // indirect github.com/felixge/httpsnoop v1.0.4 // indirect @@ -53,7 +52,6 @@ require ( github.com/google/uuid v1.6.0 // indirect github.com/googleapis/enterprise-certificate-proxy v0.3.11 // indirect github.com/googleapis/gax-go/v2 v2.17.0 // indirect - github.com/inconshreveable/mousetrap v1.1.0 // indirect github.com/jackc/pgpassfile v1.0.0 // indirect github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect github.com/jackc/puddle/v2 v2.2.2 // indirect @@ -69,8 +67,7 @@ require ( github.com/prometheus/common v0.67.5 // indirect github.com/prometheus/otlptranslator v1.0.0 // indirect github.com/prometheus/procfs v0.19.2 // indirect - github.com/sirupsen/logrus v1.9.3 // indirect - github.com/spf13/pflag v1.0.10 // indirect + github.com/sirupsen/logrus v1.9.4 // indirect github.com/vbatts/tar-split v0.12.2 // indirect go.opentelemetry.io/auto/sdk v1.2.1 // indirect go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 // indirect @@ -79,9 +76,9 @@ require ( go.yaml.in/yaml/v2 v2.4.3 // indirect golang.org/x/crypto v0.48.0 // indirect golang.org/x/net v0.51.0 // indirect - golang.org/x/oauth2 v0.35.0 // indirect - golang.org/x/sync v0.19.0 // indirect - golang.org/x/sys v0.41.0 // indirect + golang.org/x/oauth2 v0.36.0 // indirect + golang.org/x/sync v0.20.0 // indirect + golang.org/x/sys v0.42.0 // indirect golang.org/x/text v0.34.0 // indirect golang.org/x/time v0.14.0 // indirect google.golang.org/api v0.265.0 // indirect @@ -90,4 +87,5 @@ require ( google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409 // indirect google.golang.org/grpc v1.78.0 // indirect google.golang.org/protobuf v1.36.11 // indirect + gotest.tools/v3 v3.5.2 // indirect ) diff --git a/go.sum b/go.sum index fd1a9e7..f04d58c 100644 --- a/go.sum +++ b/go.sum @@ -40,14 +40,13 @@ github.com/containerd/stargz-snapshotter/estargz v0.18.2 h1:yXkZFYIzz3eoLwlTUZKz github.com/containerd/stargz-snapshotter/estargz v0.18.2/go.mod h1:XyVU5tcJ3PRpkA9XS2T5us6Eg35yM0214Y+wvrZTBrY= github.com/coreos/go-oidc/v3 v3.17.0 h1:hWBGaQfbi0iVviX4ibC7bk8OKT5qNr4klBaCHVNvehc= github.com/coreos/go-oidc/v3 v3.17.0/go.mod h1:wqPbKFrVnE90vty060SB40FCJ8fTHTxSwyXJqZH+sI8= -github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g= github.com/danielgtaylor/huma/v2 v2.37.2 h1:Nf9vjy2sxBJFaupPlthXL/Hy2+LurfVbaKHmCMEI7xE= github.com/danielgtaylor/huma/v2 v2.37.2/go.mod h1:95S04G/lExFRYlBkKaBaZm9lVmxRmqX9f2CgoOZ11AM= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= -github.com/docker/cli v29.2.1+incompatible h1:n3Jt0QVCN65eiVBoUTZQM9mcQICCJt3akW4pKAbKdJg= -github.com/docker/cli v29.2.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= +github.com/docker/cli v29.3.0+incompatible h1:z3iWveU7h19Pqx7alZES8j+IeFQZ1lhTwb2F+V9SVvk= +github.com/docker/cli v29.3.0+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk= github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w= github.com/docker/docker-credential-helpers v0.9.3 h1:gAm/VtF9wgqJMoxzT3Gj5p4AqIjCBS4wrsOh9yRqcz8= @@ -74,8 +73,8 @@ github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps= github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= -github.com/google/go-containerregistry v0.21.2 h1:vYaMU4nU55JJGFC9JR/s8NZcTjbE9DBBbvusTW9NeS0= -github.com/google/go-containerregistry v0.21.2/go.mod h1:ctO5aCaewH4AK1AumSF5DPW+0+R+d2FmylMJdp5G7p0= +github.com/google/go-containerregistry v0.21.3 h1:Xr+yt3VvwOOn/5nJzd7UoOhwPGiPkYW0zWDLLUXqAi4= +github.com/google/go-containerregistry v0.21.3/go.mod h1:D5ZrJF1e6dMzvInpBPuMCX0FxURz7GLq2rV3Us9aPkc= github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0= github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= @@ -84,8 +83,6 @@ github.com/googleapis/enterprise-certificate-proxy v0.3.11 h1:vAe81Msw+8tKUxi2Dq github.com/googleapis/enterprise-certificate-proxy v0.3.11/go.mod h1:RFV7MUdlb7AgEq2v7FmMCfeSMCllAzWxFgRdusoGks8= github.com/googleapis/gax-go/v2 v2.17.0 h1:RksgfBpxqff0EZkDWYuz9q/uWsTVz+kf43LsZ1J6SMc= github.com/googleapis/gax-go/v2 v2.17.0/go.mod h1:mzaqghpQp4JDh3HvADwrat+6M3MOIDp5YKHhb9PAgDY= -github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8= -github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM= github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg= github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo= @@ -114,8 +111,6 @@ github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJw github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M= github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ= github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c/go.mod h1:7rwL4CYBLnjLxUqIJNnCWiEdr3bn6IUYi15bNlnbCCU= -github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4= -github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 h1:GFCKgmp0tecUJ0sJuv4pzYCqS9+RGSn52M3FUwPs+uo= github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10/go.mod h1:t/avpk3KcrXxUnYOhZhMXJlSEyie6gQbtLq5NM3loB8= github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= @@ -134,16 +129,10 @@ github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0t github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc= github.com/rs/cors v1.11.1 h1:eU3gRzXLRK57F5rKMGMZURNdIG4EoAmX8k94r9wXWHA= github.com/rs/cors v1.11.1/go.mod h1:XyqrcTp5zjWr1wsJ8PIRZssZ8b/WMcMf71DJnit4EMU= -github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM= github.com/santhosh-tekuri/jsonschema/v5 v5.3.1 h1:lZUw3E0/J3roVtGQ+SCrUrg3ON6NgVqpn3+iol9aGu4= github.com/santhosh-tekuri/jsonschema/v5 v5.3.1/go.mod h1:uToXkOrWAZ6/Oc07xWQrPOhJotwFIyu2bBVN41fcDUY= -github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ= -github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ= -github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU= -github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiTUUS4= -github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= -github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk= -github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= +github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w= +github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= @@ -177,21 +166,19 @@ go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE= go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0= go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8= -go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts= golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos= golang.org/x/mod v0.34.0 h1:xIHgNUUnW6sYkcM5Jleh05DvLOtwc6RitGHbDk4akRI= golang.org/x/mod v0.34.0/go.mod h1:ykgH52iCZe79kzLLMhyCUzhMci+nQj+0XkbXpNYtVjY= golang.org/x/net v0.51.0 h1:94R/GTO7mt3/4wIKpcR5gkGmRLOuE/2hNGeWq/GBIFo= golang.org/x/net v0.51.0/go.mod h1:aamm+2QF5ogm02fjy5Bb7CQ0WMt1/WVM7FtyaTLlA9Y= -golang.org/x/oauth2 v0.35.0 h1:Mv2mzuHuZuY2+bkyWXIHMfhNdJAdwW3FuWeCPYN5GVQ= -golang.org/x/oauth2 v0.35.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA= -golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4= -golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI= -golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= +golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= +golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4= +golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k= -golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= +golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo= +golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk= golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA= golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI= @@ -216,5 +203,5 @@ gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EV gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= -gotest.tools/v3 v3.0.3 h1:4AuOwCGf4lLR9u3YOe2awrHygurzhO/HeQ6laiA6Sx0= -gotest.tools/v3 v3.0.3/go.mod h1:Z7Lb0S5l+klDB31fvDQX8ss/FlKDxtlFlw3Oa8Ymbl8= +gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q= +gotest.tools/v3 v3.5.2/go.mod h1:LtdLGcnqToBH83WByAAi/wiwSFCArdFIUV/xxN4pcjA= From 29ed71a8b85f940cd12ac469920c0a935cbcc848 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 19 Mar 2026 23:52:06 +0200 Subject: [PATCH 134/313] build(deps): bump google.golang.org/grpc from 1.79.1 to 1.79.3 in /deploy (#1077) Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.79.1 to 1.79.3.
Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.79.3

Security

  • server: fix an authorization bypass where malformed :path headers (missing the leading slash) could bypass path-based restricted "deny" rules in interceptors like grpc/authz. Any request with a non-canonical path is now immediately rejected with an Unimplemented error. (#8981)

Release 1.79.2

Bug Fixes

  • stats: Prevent redundant error logging in health/ORCA producers by skipping stats/tracing processing when no stats handler is configured. (grpc/grpc-go#8874)
Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google.golang.org/grpc&package-manager=go_modules&previous-version=1.79.1&new-version=1.79.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/modelcontextprotocol/registry/network/alerts).
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- deploy/go.mod | 2 +- deploy/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index 5e27853..f269188 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -113,7 +113,7 @@ require ( golang.org/x/tools v0.41.0 // indirect google.golang.org/genproto/googleapis/api v0.0.0-20260226221140-a57be14db171 // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 // indirect - google.golang.org/grpc v1.79.1 // indirect + google.golang.org/grpc v1.79.3 // indirect google.golang.org/protobuf v1.36.11 // indirect gopkg.in/warnings.v0 v0.1.2 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect diff --git a/deploy/go.sum b/deploy/go.sum index 4927a39..ef02510 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -335,8 +335,8 @@ google.golang.org/genproto/googleapis/api v0.0.0-20260226221140-a57be14db171 h1: google.golang.org/genproto/googleapis/api v0.0.0-20260226221140-a57be14db171/go.mod h1:M5krXqk4GhBKvB596udGL3UyjL4I1+cTbK0orROM9ng= google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 h1:ggcbiqK8WWh6l1dnltU4BgWGIGo+EVYxCaAPih/zQXQ= google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= -google.golang.org/grpc v1.79.1 h1:zGhSi45ODB9/p3VAawt9a+O/MULLl9dpizzNNpq7flY= -google.golang.org/grpc v1.79.1/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ= +google.golang.org/grpc v1.79.3 h1:sybAEdRIEtvcD68Gx7dmnwjZKlyfuc61Dyo9pGXXkKE= +google.golang.org/grpc v1.79.3/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ= google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE= google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= From 9c180f4d33516db92b91f4a550c4f9ebf6d84d5b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 19 Mar 2026 23:56:53 +0200 Subject: [PATCH 135/313] build(deps): bump google.golang.org/grpc from 1.78.0 to 1.79.3 (#1076) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.78.0 to 1.79.3.
Release notes

Sourced from google.golang.org/grpc's releases.

Release 1.79.3

Security

  • server: fix an authorization bypass where malformed :path headers (missing the leading slash) could bypass path-based restricted "deny" rules in interceptors like grpc/authz. Any request with a non-canonical path is now immediately rejected with an Unimplemented error. (#8981)

Release 1.79.2

Bug Fixes

  • stats: Prevent redundant error logging in health/ORCA producers by skipping stats/tracing processing when no stats handler is configured. (grpc/grpc-go#8874)

Release 1.79.1

Bug Fixes

Release 1.79.0

API Changes

  • mem: Add experimental API SetDefaultBufferPool to change the default buffer pool. (#8806)
  • experimental/stats: Update MetricsRecorder to require embedding the new UnimplementedMetricsRecorder (a no-op struct) in all implementations for forward compatibility. (#8780)

Behavior Changes

  • balancer/weightedtarget: Remove handling of Addresses and only handle Endpoints in resolver updates. (#8841)

New Features

  • experimental/stats: Add support for asynchronous gauge metrics through the new AsyncMetricReporter and RegisterAsyncReporter APIs. (#8780)
  • pickfirst: Add support for weighted random shuffling of endpoints, as described in gRFC A113.
    • This is enabled by default, and can be turned off using the environment variable GRPC_EXPERIMENTAL_PF_WEIGHTED_SHUFFLING. (#8864)
  • xds: Implement :authority rewriting, as specified in gRFC A81. (#8779)
  • balancer/randomsubsetting: Implement the random_subsetting LB policy, as specified in gRFC A68. (#8650)

Bug Fixes

  • credentials/tls: Fix a bug where the port was not stripped from the authority override before validation. (#8726)
  • xds/priority: Fix a bug causing delayed failover to lower-priority clusters when a higher-priority cluster is stuck in CONNECTING state. (#8813)
  • health: Fix a bug where health checks failed for clients using legacy compression options (WithDecompressor or RPCDecompressor). (#8765)
  • transport: Fix an issue where the HTTP/2 server could skip header size checks when terminating a stream early. (#8769)
  • server: Propagate status detail headers, if available, when terminating a stream during request header processing. (#8754)

Performance Improvements

  • credentials/alts: Optimize read buffer alignment to reduce copies. (#8791)
  • mem: Optimize pooling and creation of buffer objects. (#8784)
  • transport: Reduce slice re-allocations by reserving slice capacity. (#8797)
Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google.golang.org/grpc&package-manager=go_modules&previous-version=1.78.0&new-version=1.79.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/modelcontextprotocol/registry/network/alerts).
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 18 +++++++++--------- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/go.mod b/go.mod index 07633b4..18e86f3 100644 --- a/go.mod +++ b/go.mod @@ -85,7 +85,7 @@ require ( google.golang.org/genproto v0.0.0-20260128011058-8636f8732409 // indirect google.golang.org/genproto/googleapis/api v0.0.0-20260203192932-546029d2fa20 // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409 // indirect - google.golang.org/grpc v1.78.0 // indirect + google.golang.org/grpc v1.79.3 // indirect google.golang.org/protobuf v1.36.11 // indirect gotest.tools/v3 v3.5.2 // indirect ) diff --git a/go.sum b/go.sum index f04d58c..c6c47a1 100644 --- a/go.sum +++ b/go.sum @@ -34,8 +34,8 @@ github.com/caarlos0/env/v11 v11.4.0 h1:Kcb6t5kIIr4XkoQC9AF2j+8E1Jsrl3Wz/hhm1LtoG github.com/caarlos0/env/v11 v11.4.0/go.mod h1:qupehSf/Y0TUTsxKywqRt/vJjN5nz6vauiYEUUr8P4U= github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs= github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= -github.com/cncf/xds/go v0.0.0-20251022180443-0feb69152e9f h1:Y8xYupdHxryycyPlc9Y+bSQAYZnetRJ70VMVKm5CKI0= -github.com/cncf/xds/go v0.0.0-20251022180443-0feb69152e9f/go.mod h1:HlzOvOjVBOfTGSRXRyY0OiCS/3J1akRGQQpRO/7zyF4= +github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5 h1:6xNmx7iTtyBRev0+D/Tv1FZd4SCg8axKApyNyRsAt/w= +github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5/go.mod h1:KdCmV+x/BuvyMxRnYBlmVaq4OLiKW6iRQfvC62cvdkI= github.com/containerd/stargz-snapshotter/estargz v0.18.2 h1:yXkZFYIzz3eoLwlTUZKz2iQ4MrckBxJjkmD16ynUTrw= github.com/containerd/stargz-snapshotter/estargz v0.18.2/go.mod h1:XyVU5tcJ3PRpkA9XS2T5us6Eg35yM0214Y+wvrZTBrY= github.com/coreos/go-oidc/v3 v3.17.0 h1:hWBGaQfbi0iVviX4ibC7bk8OKT5qNr4klBaCHVNvehc= @@ -51,11 +51,11 @@ github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBi github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w= github.com/docker/docker-credential-helpers v0.9.3 h1:gAm/VtF9wgqJMoxzT3Gj5p4AqIjCBS4wrsOh9yRqcz8= github.com/docker/docker-credential-helpers v0.9.3/go.mod h1:x+4Gbw9aGmChi3qTLZj8Dfn0TD20M/fuWy0E5+WDeCo= -github.com/envoyproxy/go-control-plane v0.13.5-0.20251024222203-75eaa193e329 h1:K+fnvUM0VZ7ZFJf0n4L/BRlnsb9pL/GuDG6FqaH+PwM= -github.com/envoyproxy/go-control-plane/envoy v1.35.0 h1:ixjkELDE+ru6idPxcHLj8LBVc2bFP7iBytj353BoHUo= -github.com/envoyproxy/go-control-plane/envoy v1.35.0/go.mod h1:09qwbGVuSWWAyN5t/b3iyVfz5+z8QWGrzkoqm/8SbEs= -github.com/envoyproxy/protoc-gen-validate v1.2.1 h1:DEo3O99U8j4hBFwbJfrz9VtgcDfUKS7KJ7spH3d86P8= -github.com/envoyproxy/protoc-gen-validate v1.2.1/go.mod h1:d/C80l/jxXLdfEIhX1W2TmLfsJ31lvEjwamM4DxlWXU= +github.com/envoyproxy/go-control-plane v0.14.0 h1:hbG2kr4RuFj222B6+7T83thSPqLjwBIfQawTkC++2HA= +github.com/envoyproxy/go-control-plane/envoy v1.36.0 h1:yg/JjO5E7ubRyKX3m07GF3reDNEnfOboJ0QySbH736g= +github.com/envoyproxy/go-control-plane/envoy v1.36.0/go.mod h1:ty89S1YCCVruQAm9OtKeEkQLTb+Lkz0k8v9W0Oxsv98= +github.com/envoyproxy/protoc-gen-validate v1.3.0 h1:TvGH1wof4H33rezVKWSpqKz5NXWg5VPuZ0uONDT6eb4= +github.com/envoyproxy/protoc-gen-validate v1.3.0/go.mod h1:HvYl7zwPa5mffgyeTUHA9zHIH36nmrm7oCbo4YKoSWA= github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg= github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U= github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM= @@ -193,8 +193,8 @@ google.golang.org/genproto/googleapis/api v0.0.0-20260203192932-546029d2fa20 h1: google.golang.org/genproto/googleapis/api v0.0.0-20260203192932-546029d2fa20/go.mod h1:ZdbssH/1SOVnjnDlXzxDHK2MCidiqXtbYccJNzNYPEE= google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409 h1:H86B94AW+VfJWDqFeEbBPhEtHzJwJfTbgE2lZa54ZAQ= google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409/go.mod h1:j9x/tPzZkyxcgEFkiKEEGxfvyumM01BEtsW8xzOahRQ= -google.golang.org/grpc v1.78.0 h1:K1XZG/yGDJnzMdd/uZHAkVqJE+xIDOcmdSFZkBUicNc= -google.golang.org/grpc v1.78.0/go.mod h1:I47qjTo4OKbMkjA/aOOwxDIiPSBofUtQUI5EfpWvW7U= +google.golang.org/grpc v1.79.3 h1:sybAEdRIEtvcD68Gx7dmnwjZKlyfuc61Dyo9pGXXkKE= +google.golang.org/grpc v1.79.3/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ= google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE= google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= From ddb93bd3a8753d9cb7127bf507cc87575c85ea53 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Sun, 22 Mar 2026 16:42:18 +0200 Subject: [PATCH 136/313] Add contributing guidelines to prevent seed.json PRs (#1079) ## Motivation and Context We've been receiving numerous PRs from authors attempting to publish their MCP server by adding entries to `data/seed.json`. This is not the correct approach as servers should be published using the `mcp-publisher` CLI tool. Many of these PRs appear to be AI-generated so the existing docs aren't being surfaced effectively. This PR adds explicit guidance in the files that AI coding assistants actually read: - `CONTRIBUTING.md` - shown by GitHub when opening new PRs; widely ingested by AI tools - `.github/copilot-instructions.md` - read by GitHub Copilot - `CLAUDE.md` - read by Claude Code and Claude on github.com ## How Has This Been Tested? ## Breaking Changes ## Types of changes - [ ] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] Documentation update ## Checklist - [ ] I have read the [MCP Documentation](https://modelcontextprotocol.io) - [ ] My code follows the repository's style guidelines - [ ] New and existing tests pass locally - [ ] I have added appropriate error handling - [ ] I have added or updated documentation as needed ## Additional context Signed-off-by: Radoslav Dimitrov --- .github/copilot-instructions.md | 13 +++++++++++ CLAUDE.md | 6 +++++ CONTRIBUTING.md | 39 +++++++++++++++++++++++++++++++++ 3 files changed, 58 insertions(+) create mode 100644 .github/copilot-instructions.md create mode 100644 CONTRIBUTING.md diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md new file mode 100644 index 0000000..b37dd38 --- /dev/null +++ b/.github/copilot-instructions.md @@ -0,0 +1,13 @@ +# Copilot Instructions for MCP Registry + +## Important: Publishing MCP servers + +The `data/seed.json` file is seed data for local development only. Do NOT create pull requests that add or modify server entries in `data/seed.json` to publish a server. + +To publish an MCP server to the registry, use the `mcp-publisher` CLI tool. See `docs/modelcontextprotocol-io/quickstart.mdx` for instructions. + +## Development + +- Use `make` targets where possible (run `make help` to see available targets) +- Run `make check` to run lint, unit tests, and integration tests +- Run `make dev-compose` to start the local development environment \ No newline at end of file diff --git a/CLAUDE.md b/CLAUDE.md index 213802b..8e8969e 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -2,3 +2,9 @@ _Guidance for Claude Code (claude.ai/code) when working in this repository. If it's also useful to humans (probably most things!), put the instructions in README.md instead._ Import @README.md + +## Important: Publishing MCP servers + +The `data/seed.json` file is seed data for local development only. Do NOT create pull requests or commits that add server entries to `data/seed.json` as a way to publish a server to the registry. + +To publish an MCP server, use the `mcp-publisher` CLI tool. See `docs/modelcontextprotocol-io/quickstart.mdx` for instructions. diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..a5a42cb --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,39 @@ +# Contributing to the MCP Registry + +Thank you for your interest in contributing! + +## Want to publish an MCP server? + +**Do NOT open a pull request to add your server to `data/seed.json`.** + +The `data/seed.json` file is seed data used only for local development. Modifying it will not publish your server to the registry. + +To publish an MCP server, use the official `mcp-publisher` CLI tool. See the [publishing quickstart guide](docs/modelcontextprotocol-io/quickstart.mdx) for step-by-step instructions. + +## Contributing to the registry codebase + +We welcome contributions to the registry itself! Here's how to get started: + +### Communication channels + +We use multiple channels for collaboration - see [modelcontextprotocol.io/community/communication](https://modelcontextprotocol.io/community/communication). + +Often (but not always) ideas flow through this pipeline: + +- **[Discord](https://modelcontextprotocol.io/community/communication)** - Real-time community discussions +- **[Discussions](https://github.com/modelcontextprotocol/registry/discussions)** - Propose and discuss product/technical requirements +- **[Issues](https://github.com/modelcontextprotocol/registry/issues)** - Track well-scoped technical work +- **[Pull Requests](https://github.com/modelcontextprotocol/registry/pulls)** - Contribute work towards issues + +### Development setup + +See the [README](README.md#quick-start) for prerequisites and instructions on running the server locally. + +### Running checks + +```bash +# Run lint, unit tests and integration tests +make check +``` + +Run `make help` for more available commands. \ No newline at end of file From c5c4b9e8890dd5754bee889b2f1417f4fe3b5ce5 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sun, 22 Mar 2026 18:53:07 +0200 Subject: [PATCH 137/313] build(deps): bump anchore/sbom-action from 0.23.1 to 0.24.0 in the actions group (#1085) --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 35a9c75..9e07ba3 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -28,7 +28,7 @@ jobs: uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0 - name: Install Syft - uses: anchore/sbom-action/download-syft@v0.23.1 + uses: anchore/sbom-action/download-syft@v0.24.0 - name: Run GoReleaser uses: goreleaser/goreleaser-action@ec59f474b9834571250b370d4735c50f8e2d1e29 From f30e540117747c19ad6f2e55e3aedf3bf4efbfae Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 2 Apr 2026 00:03:02 -0400 Subject: [PATCH 138/313] build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.226.0 to 3.228.0 in /deploy (#1094) Bumps [github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from 3.226.0 to 3.228.0.
Release notes

Sourced from github.com/pulumi/pulumi/sdk/v3's releases.

v3.228.0

3.228.0 (2026-03-25)

Features

  • [cli] Don't apply the secrets filter to true and false (case-insensitive) #22269

  • [cli] Add grpcs:// support and header authentication to OTLP exporter #22320

  • [cli] Read OTEL_RESOURCE_ATTRIBUTES #22329

  • [auto/nodejs] Add low-level "cancel" command to the auto-generated interface #22156

  • [cli/state] Allow pulumi state delete to accept multiple resource URNs and delete them in a dependency-safe order

Bug Fixes

  • [cli] Allow relative file paths for --otel-traces #22300

  • [cli] Bridge opentracing spans from providers into OTel #22313

  • [cli] Correctly end spans for GRPC streams #22304

  • [cli/about] Do not include the access token in plain text #22347

  • [display] Fix detailed diff indentation so changed resources are not visually nested under unrelated visible resources when unchanged parents are hidden. #22317

  • [cli/import] Fix import codegen when generating references to non-standard names #22319

  • [engine] Update golang version #22277

  • [pcl] Typecheck component inputs in PCL programs #22292

  • [programgen/{nodejs,python}] Fix literal conversion when calling into local components #22306

... (truncated)

Changelog

Sourced from github.com/pulumi/pulumi/sdk/v3's changelog.

3.228.0 (2026-03-25)

Features

  • [cli] Don't apply the secrets filter to true and false (case-insensitive) #22269

  • [cli] Add grpcs:// support and header authentication to OTLP exporter #22320

  • [cli] Read OTEL_RESOURCE_ATTRIBUTES #22329

  • [auto/nodejs] Add low-level "cancel" command to the auto-generated interface #22156

  • [cli/state] Allow pulumi state delete to accept multiple resource URNs and delete them in a dependency-safe order

Bug Fixes

  • [cli] Allow relative file paths for --otel-traces #22300

  • [cli] Bridge opentracing spans from providers into OTel #22313

  • [cli] Correctly end spans for GRPC streams #22304

  • [cli/about] Do not include the access token in plain text #22347

  • [display] Fix detailed diff indentation so changed resources are not visually nested under unrelated visible resources when unchanged parents are hidden. #22317

  • [cli/import] Fix import codegen when generating references to non-standard names #22319

  • [engine] Update golang version #22277

  • [pcl] Typecheck component inputs in PCL programs #22292

  • [programgen/{nodejs,python}] Fix literal conversion when calling into local components #22306

... (truncated)

Commits
  • 7551b7f feat(cli/state): multiple URNs and substring match for pulumi state delete ...
  • 6a1c2d2 env: mark AccessToken as Secret (#22347)
  • 9630cec Deprecate legacy mode (#19625)
  • 3171ca6 Fix l2-component-call-simple (#22339)
  • d5bf67e Fix use of sanitised names in import codegen (#22319)
  • 6589fd4 Allow setting a GRPC endpoint for performance tests (#22330)
  • fba98e9 Unskip l2-snake-names (#22337)
  • 469eb83 [display] Fix detailed diff indentation when hidden parents are unchanged (#2...
  • fe4a635 Update golang version to fix CVEs (#22277)
  • cfb587b fix(sdk/go/pulumi-language-go/goversion): handle non-standard toolchains (#22...
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/pulumi/pulumi/sdk/v3&package-manager=go_modules&previous-version=3.226.0&new-version=3.228.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- deploy/go.mod | 4 ++-- deploy/go.sum | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index f269188..914e68e 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -1,11 +1,11 @@ module github.com/modelcontextprotocol/registry/deploy/infra -go 1.25.6 +go 1.25.8 require ( github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.28.0 - github.com/pulumi/pulumi/sdk/v3 v3.226.0 + github.com/pulumi/pulumi/sdk/v3 v3.228.0 gopkg.in/yaml.v2 v2.4.0 ) diff --git a/deploy/go.sum b/deploy/go.sum index ef02510..cc5ecba 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -185,8 +185,8 @@ github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 h1:w6OnO3d4j5yVf2vpm8OzXFC/xHOEGqt+9 github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1/go.mod h1:UyZyv7hz4knpFx6/Sh+SkZe6hT6sJHtDvw9A0TbvEsk= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.28.0 h1:muCE6cUJ4YmAaNLiOhbjEicxT+10i/EGsZrx2ZZQQ+o= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.28.0/go.mod h1:B998wofejDKAvvpLwsi4UMfWDFHHBnzYiM8mZ9e7OSo= -github.com/pulumi/pulumi/sdk/v3 v3.226.0 h1:C24HWnoJSspq/KweSkAAAqWht/5pEkDanoxHe0al/dM= -github.com/pulumi/pulumi/sdk/v3 v3.226.0/go.mod h1:l88lS+aGRt37BD/nyPMEOYw+RmjG5baSH7eLtmTKpy0= +github.com/pulumi/pulumi/sdk/v3 v3.228.0 h1:+kV5pPM52MMFQsYiZ/deDi6egVb8JZsTpQhzv+CMB3A= +github.com/pulumi/pulumi/sdk/v3 v3.228.0/go.mod h1:PAqB2+8gnxqk+QrFdXL3fSjsLIjtlBIcy5KLZ//4WSk= github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ= github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88= github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ= From bc8ff18495f748ca22a9baf9fa8fadab5c2a4e8e Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 2 Apr 2026 00:03:28 -0400 Subject: [PATCH 139/313] build(deps): bump github.com/danielgtaylor/huma/v2 from 2.37.2 to 2.37.3 (#1098) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [github.com/danielgtaylor/huma/v2](https://github.com/danielgtaylor/huma) from 2.37.2 to 2.37.3.
Release notes

Sourced from github.com/danielgtaylor/huma/v2's releases.

v2.37.3

Overview

This bugfix release fixes a few minor bugs and typos from previous releases.

This also adjusts the HTTP status code returned by Huma if marshaling a response fails, from 200 to 500.

What's Changed

New Contributors

Full Changelog: https://github.com/danielgtaylor/huma/compare/v2.37.2...v2.37.3

Commits
  • a38b536 chore(deps): bump github.com/gofiber/fiber/v2 from 2.52.11 to 2.52.12 (#984)
  • f4c5363 Handle contentEncoding and contentMediaType keys (#919)
  • 1678a04 Return HTTP 500 if marshaling fails (#997)
  • 1d5dddf Fix relative schema urls (#990)
  • 1b8766d fix typo in groups.md documentation (#995)
  • 99e60fd fix: use epsilon tolerance in multipleOf float validation (#989)
  • c6694fa fix: add allow-popups to CSP sandbox for OAuth popups (#987)
  • See full diff in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/danielgtaylor/huma/v2&package-manager=go_modules&previous-version=2.37.2&new-version=2.37.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 18e86f3..617acc6 100644 --- a/go.mod +++ b/go.mod @@ -8,7 +8,7 @@ require ( github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.4.0 github.com/caarlos0/env/v11 v11.4.0 github.com/coreos/go-oidc/v3 v3.17.0 - github.com/danielgtaylor/huma/v2 v2.37.2 + github.com/danielgtaylor/huma/v2 v2.37.3 github.com/golang-jwt/jwt/v5 v5.3.1 github.com/google/go-containerregistry v0.21.3 github.com/jackc/pgx/v5 v5.8.0 diff --git a/go.sum b/go.sum index c6c47a1..0b26855 100644 --- a/go.sum +++ b/go.sum @@ -40,8 +40,8 @@ github.com/containerd/stargz-snapshotter/estargz v0.18.2 h1:yXkZFYIzz3eoLwlTUZKz github.com/containerd/stargz-snapshotter/estargz v0.18.2/go.mod h1:XyVU5tcJ3PRpkA9XS2T5us6Eg35yM0214Y+wvrZTBrY= github.com/coreos/go-oidc/v3 v3.17.0 h1:hWBGaQfbi0iVviX4ibC7bk8OKT5qNr4klBaCHVNvehc= github.com/coreos/go-oidc/v3 v3.17.0/go.mod h1:wqPbKFrVnE90vty060SB40FCJ8fTHTxSwyXJqZH+sI8= -github.com/danielgtaylor/huma/v2 v2.37.2 h1:Nf9vjy2sxBJFaupPlthXL/Hy2+LurfVbaKHmCMEI7xE= -github.com/danielgtaylor/huma/v2 v2.37.2/go.mod h1:95S04G/lExFRYlBkKaBaZm9lVmxRmqX9f2CgoOZ11AM= +github.com/danielgtaylor/huma/v2 v2.37.3 h1:6Av0Vj45Vk5lDxRVfoO2iPlEdvCvwLc7pl5nbqGOkYM= +github.com/danielgtaylor/huma/v2 v2.37.3/go.mod h1:OeHHtCEAaNiuVbAVdYu4IQ0UOmnb4x3yMUOShNlZ53g= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= From 7be5dd23c068b5b88103d0570f77379c43635c66 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 2 Apr 2026 00:03:51 -0400 Subject: [PATCH 140/313] build(deps): bump github.com/go-git/go-git/v5 from 5.16.5 to 5.17.1 in /deploy (#1104) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.16.5 to 5.17.1.
Release notes

Sourced from github.com/go-git/go-git/v5's releases.

v5.17.1

What's Changed

Full Changelog: https://github.com/go-git/go-git/compare/v5.17.0...v5.17.1

v5.17.0

What's Changed

Full Changelog: https://github.com/go-git/go-git/compare/v5.16.5...v5.17.0

Commits
  • 5e23dfd Merge pull request #1937 from pjbgf/idx-v5
  • 6b38a32 Merge pull request #1935 from pjbgf/index-v5
  • cd757fc plumbing: format/idxfile, Fix version and fanout checks
  • 3ec0d70 plumbing: format/index, Fix tree extension invalidated entry parsing
  • dbe10b6 plumbing: format/index, Align V2/V3 long name and V4 prefix encoding with Git
  • e9b65df plumbing: format/index, Improve v4 entry name validation
  • adad18d Merge pull request #1930 from go-git/renovate/releases/v5.x-go-github.com-clo...
  • 29470bd build: Update module github.com/cloudflare/circl to v1.6.3 [SECURITY]
  • bdf0688 Merge pull request #1864 from pjbgf/v5-issue-55
  • 5290e52 storage: filesystem, Avoid overwriting loose obj files. Fixes #55
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/go-git/go-git/v5&package-manager=go_modules&previous-version=5.16.5&new-version=5.17.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/modelcontextprotocol/registry/network/alerts).
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- deploy/go.mod | 4 ++-- deploy/go.sum | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index 914e68e..0e4c7f5 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -37,8 +37,8 @@ require ( github.com/emirpasic/gods v1.18.1 // indirect github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect - github.com/go-git/go-billy/v5 v5.6.2 // indirect - github.com/go-git/go-git/v5 v5.16.5 // indirect + github.com/go-git/go-billy/v5 v5.8.0 // indirect + github.com/go-git/go-git/v5 v5.17.1 // indirect github.com/go-logr/logr v1.4.3 // indirect github.com/go-logr/stdr v1.2.2 // indirect github.com/gogo/protobuf v1.3.2 // indirect diff --git a/deploy/go.sum b/deploy/go.sum index cc5ecba..766581d 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -70,12 +70,12 @@ github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c= github.com/gliderlabs/ssh v0.3.8/go.mod h1:xYoytBv1sV0aL3CavoDuJIQNURXkkfPA/wxQ1pL1fAU= github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI= github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376/go.mod h1:an3vInlBmSxCcxctByoQdvwPiA7DTK7jaaFDBTtu0ic= -github.com/go-git/go-billy/v5 v5.6.2 h1:6Q86EsPXMa7c3YZ3aLAQsMA0VlWmy43r6FHqa/UNbRM= -github.com/go-git/go-billy/v5 v5.6.2/go.mod h1:rcFC2rAsp/erv7CMz9GczHcuD0D32fWzH+MJAU+jaUU= +github.com/go-git/go-billy/v5 v5.8.0 h1:I8hjc3LbBlXTtVuFNJuwYuMiHvQJDq1AT6u4DwDzZG0= +github.com/go-git/go-billy/v5 v5.8.0/go.mod h1:RpvI/rw4Vr5QA+Z60c6d6LXH0rYJo0uD5SqfmrrheCY= github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4= github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII= -github.com/go-git/go-git/v5 v5.16.5 h1:mdkuqblwr57kVfXri5TTH+nMFLNUxIj9Z7F5ykFbw5s= -github.com/go-git/go-git/v5 v5.16.5/go.mod h1:QOMLpNf1qxuSY4StA/ArOdfFR2TrKEjJiye2kel2m+M= +github.com/go-git/go-git/v5 v5.17.1 h1:WnljyxIzSj9BRRUlnmAU35ohDsjRK0EKmL0evDqi5Jk= +github.com/go-git/go-git/v5 v5.17.1/go.mod h1:pW/VmeqkanRFqR6AljLcs7EA7FbZaN5MQqO7oZADXpo= github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= From fff1664e3d7f75cffaf241f9d78c89306e245a5d Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 2 Apr 2026 00:04:08 -0400 Subject: [PATCH 141/313] build(deps): bump the actions group across 1 directory with 2 updates (#1105) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps the actions group with 2 updates in the / directory: [actions/setup-go](https://github.com/actions/setup-go) and [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer). Updates `actions/setup-go` from 6.3.0 to 6.4.0
Release notes

Sourced from actions/setup-go's releases.

v6.4.0

What's Changed

Enhancement

Dependency update

Documentation update

New Contributors

Full Changelog: https://github.com/actions/setup-go/compare/v6...v6.4.0

Commits

Updates `sigstore/cosign-installer` from 4.1.0 to 4.1.1
Release notes

Sourced from sigstore/cosign-installer's releases.

v4.1.1

What's Changed

Full Changelog: https://github.com/sigstore/cosign-installer/compare/v4.1.0...v4.1.1

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/ci.yml | 4 ++-- .github/workflows/deploy-production.yml | 2 +- .github/workflows/deploy-staging.yml | 4 ++-- .github/workflows/release.yml | 6 +++--- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 1863041..1bc20d0 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -19,7 +19,7 @@ jobs: uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 - name: Set up Go - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 + uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c with: go-version-file: 'go.mod' cache: true @@ -53,7 +53,7 @@ jobs: uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 - name: Set up Go - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 + uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c with: go-version-file: 'go.mod' cache: true diff --git a/.github/workflows/deploy-production.yml b/.github/workflows/deploy-production.yml index fc72c6d..0ca5224 100644 --- a/.github/workflows/deploy-production.yml +++ b/.github/workflows/deploy-production.yml @@ -26,7 +26,7 @@ jobs: uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 - name: Setup Go - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 + uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c with: go-version-file: 'deploy/go.mod' cache: true diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml index f2208fb..dd0589f 100644 --- a/.github/workflows/deploy-staging.yml +++ b/.github/workflows/deploy-staging.yml @@ -25,7 +25,7 @@ jobs: uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 - name: Set up Go - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 + uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c with: go-version-file: 'go.mod' cache: true @@ -73,7 +73,7 @@ jobs: uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 - name: Setup Go - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 + uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c with: go-version-file: 'deploy/go.mod' cache: true diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 9e07ba3..ea606b7 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -19,13 +19,13 @@ jobs: fetch-depth: 0 - name: Set up Go - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 + uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c with: go-version-file: 'go.mod' cache: true - name: Install cosign - uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0 + uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1 - name: Install Syft uses: anchore/sbom-action/download-syft@v0.24.0 @@ -48,7 +48,7 @@ jobs: uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 - name: Set up Go - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 + uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c with: go-version-file: 'go.mod' cache: true From 2a6b00dde73fe4e754c0887b2ca7f16ede7488fc Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 2 Apr 2026 00:10:21 -0400 Subject: [PATCH 142/313] build(deps): bump github.com/jackc/pgx/v5 from 5.8.0 to 5.9.1 (#1092) Bumps [github.com/jackc/pgx/v5](https://github.com/jackc/pgx) from 5.8.0 to 5.9.1.
Changelog

Sourced from github.com/jackc/pgx/v5's changelog.

5.9.1 (March 22, 2026)

  • Fix: batch result format corruption when using cached prepared statements (reported by Dirkjan Bussink)

5.9.0 (March 21, 2026)

This release includes a number of new features such as SCRAM-SHA-256-PLUS support, OAuth authentication support, and PostgreSQL protocol 3.2 support.

It significantly reduces the amount of network traffic when using prepared statements (which are used automatically by default) by avoiding unnecessary Describe Portal messages. This also reduces local memory usage.

It also includes multiple fixes for potential DoS due to panic or OOM if connected to a malicious server that sends deliberately malformed messages.

  • Require Go 1.25+
  • Add SCRAM-SHA-256-PLUS support (Adam Brightwell)
  • Add OAuth authentication support for PostgreSQL 18 (David Schneider)
  • Add PostgreSQL protocol 3.2 support (Dirkjan Bussink)
  • Add tsvector type support (Adam Brightwell)
  • Skip Describe Portal for cached prepared statements reducing network round trips
  • Make LoadTypes query easier to support on "postgres-like" servers (Jelte Fennema-Nio)
  • Default empty user to current OS user matching libpq behavior (ShivangSrivastava)
  • Optimize LRU statement cache with custom linked list and node pooling (Mathias Bogaert)
  • Optimize date scanning by replacing regex with manual parsing (Mathias Bogaert)
  • Optimize pgio append/set functions with direct byte shifts (Mathias Bogaert)
  • Make RowsAffected faster (Abhishek Chanda)
  • Fix: Pipeline.Close panic when server sends multiple FATAL errors (Varun Chawla)
  • Fix: ContextWatcher goroutine leak (Hank Donnay)
  • Fix: stdlib discard connections with open transactions in ResetSession (Jeremy Schneider)
  • Fix: pipelineBatchResults.Exec silently swallowing lastRows error
  • Fix: ColumnTypeLength using BPCharArrayOID instead of BPCharOID
  • Fix: TSVector text encoding returning nil for valid empty tsvector
  • Fix: wrong error messages for Int2 and Int4 underflow
  • Fix: Numeric nil Int pointer dereference with Valid: true
  • Fix: reversed strings.ContainsAny arguments in Numeric.ScanScientific
  • Fix: message length parsing on 32-bit platforms
  • Fix: FunctionCallResponse.Decode mishandling of signed result size
  • Fix: returning wrong error in configTLS when DecryptPEMBlock fails (Maxim Motyshen)
  • Fix: misleading ParseConfig error when default_query_exec_mode is invalid (Skarm)
  • Fix: missed Unwatch in Pipeline error paths
  • Clarify too many failed acquire attempts error message
  • Better error wrapping with context and SQL statement (Aneesh Makala)
  • Enable govet and ineffassign linters (Federico Guerinoni)
  • Guard against various malformed binary messages (arrays, hstore, multirange, protocol messages)
  • Fix various godoc comments (ferhat elmas)
  • Fix typos in comments (Oleksandr Redko)
Commits
  • 4e4eaed Release v5.9.1
  • 6273188 Fix batch result format corruption when using cached prepared statements
  • f7b90c2 Merge pull request #2524 from dbussink/pipeline-result-format-reuse
  • 3ce6d75 Add failing test: batch scan corrupted in cache_statement mode
  • b4d8e62 Release v5.9.0
  • c227cd4 Bump minimum Go version from 1.24 to 1.25
  • f492c14 Use reflect.TypeFor instead of reflect.TypeOf for static types
  • ad8fb08 Use sync.WaitGroup.Go to simplify goroutine spawning
  • 3033773 Remove go1.26 build tag from synctest test
  • 83ffb3c Validate multirange element count against source length before allocating
  • Additional commits viewable in compare view

Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 617acc6..a6bcc88 100644 --- a/go.mod +++ b/go.mod @@ -11,7 +11,7 @@ require ( github.com/danielgtaylor/huma/v2 v2.37.3 github.com/golang-jwt/jwt/v5 v5.3.1 github.com/google/go-containerregistry v0.21.3 - github.com/jackc/pgx/v5 v5.8.0 + github.com/jackc/pgx/v5 v5.9.1 github.com/prometheus/client_golang v1.23.2 github.com/rs/cors v1.11.1 github.com/santhosh-tekuri/jsonschema/v5 v5.3.1 diff --git a/go.sum b/go.sum index 0b26855..b927d57 100644 --- a/go.sum +++ b/go.sum @@ -87,8 +87,8 @@ github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsI github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg= github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo= github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM= -github.com/jackc/pgx/v5 v5.8.0 h1:TYPDoleBBme0xGSAX3/+NujXXtpZn9HBONkQC7IEZSo= -github.com/jackc/pgx/v5 v5.8.0/go.mod h1:QVeDInX2m9VyzvNeiCJVjCkNFqzsNb43204HshNSZKw= +github.com/jackc/pgx/v5 v5.9.1 h1:uwrxJXBnx76nyISkhr33kQLlUqjv7et7b9FjCen/tdc= +github.com/jackc/pgx/v5 v5.9.1/go.mod h1:mal1tBGAFfLHvZzaYh77YS/eC6IX9OWbRV1QIIM0Jn4= github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo= github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4= github.com/keybase/go-keychain v0.0.1 h1:way+bWYa6lDppZoZcgMbYsvC7GxljxrskdNInRtuthU= From 81bc5ff6533060cf4d364fb9fe0ac6e89c97063c Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 8 Apr 2026 05:33:17 -0400 Subject: [PATCH 143/313] build(deps): bump github.com/google/go-containerregistry from 0.21.3 to 0.21.4 (#1131) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) from 0.21.3 to 0.21.4.
Release notes

Sourced from github.com/google/go-containerregistry's releases.

v0.21.4

What's Changed

New Contributors

Full Changelog: https://github.com/google/go-containerregistry/compare/v0.21.3...v0.21.4

Commits
  • e8813dd goreleaser: Update goreleaser config and GH action for releases (#2253)
  • e90447d replace gcloud in binary calls in pkg/v1/google tests (#2085)
  • 0d0368c revert path traversal and symlink escape changes (#2250)
  • a2f47d4 transport: validate Bearer realm URL to prevent SSRF (#2243)
  • 19a36cd fork distribution client v3 auth-challenge as an internal package (squashed) ...
  • c612a9b Bump codecov/codecov-action from 5.5.2 to 5.5.3 in the actions group (#2240)
  • 8f92f59 Bump CI go version to 1.26.1 (#2242)
  • c99e7cf fix: update to go1.25.8, and use separate .go-version file (#2246)
  • 0794660 Bump the go-deps group across 3 directories with 5 updates (#2245)
  • 4cb93ae Undo pruning absolute links from extracted and flattened images (#2241)
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/google/go-containerregistry&package-manager=go_modules&previous-version=0.21.3&new-version=0.21.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 7 +++---- go.sum | 14 ++++++-------- 2 files changed, 9 insertions(+), 12 deletions(-) diff --git a/go.mod b/go.mod index a6bcc88..da6f67d 100644 --- a/go.mod +++ b/go.mod @@ -10,7 +10,7 @@ require ( github.com/coreos/go-oidc/v3 v3.17.0 github.com/danielgtaylor/huma/v2 v2.37.3 github.com/golang-jwt/jwt/v5 v5.3.1 - github.com/google/go-containerregistry v0.21.3 + github.com/google/go-containerregistry v0.21.4 github.com/jackc/pgx/v5 v5.9.1 github.com/prometheus/client_golang v1.23.2 github.com/rs/cors v1.11.1 @@ -41,8 +41,7 @@ require ( github.com/cespare/xxhash/v2 v2.3.0 // indirect github.com/containerd/stargz-snapshotter/estargz v0.18.2 // indirect github.com/davecgh/go-spew v1.1.1 // indirect - github.com/docker/cli v29.3.0+incompatible // indirect - github.com/docker/distribution v2.8.3+incompatible // indirect + github.com/docker/cli v29.3.1+incompatible // indirect github.com/docker/docker-credential-helpers v0.9.3 // indirect github.com/felixge/httpsnoop v1.0.4 // indirect github.com/go-jose/go-jose/v4 v4.1.3 // indirect @@ -55,7 +54,7 @@ require ( github.com/jackc/pgpassfile v1.0.0 // indirect github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect github.com/jackc/puddle/v2 v2.2.2 // indirect - github.com/klauspost/compress v1.18.4 // indirect + github.com/klauspost/compress v1.18.5 // indirect github.com/kylelemons/godebug v1.1.0 // indirect github.com/mitchellh/go-homedir v1.1.0 // indirect github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect diff --git a/go.sum b/go.sum index b927d57..3776bd8 100644 --- a/go.sum +++ b/go.sum @@ -45,10 +45,8 @@ github.com/danielgtaylor/huma/v2 v2.37.3/go.mod h1:OeHHtCEAaNiuVbAVdYu4IQ0UOmnb4 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= -github.com/docker/cli v29.3.0+incompatible h1:z3iWveU7h19Pqx7alZES8j+IeFQZ1lhTwb2F+V9SVvk= -github.com/docker/cli v29.3.0+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= -github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk= -github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w= +github.com/docker/cli v29.3.1+incompatible h1:M04FDj2TRehDacrosh7Vlkgc7AuQoWloQkf1PA5hmoI= +github.com/docker/cli v29.3.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= github.com/docker/docker-credential-helpers v0.9.3 h1:gAm/VtF9wgqJMoxzT3Gj5p4AqIjCBS4wrsOh9yRqcz8= github.com/docker/docker-credential-helpers v0.9.3/go.mod h1:x+4Gbw9aGmChi3qTLZj8Dfn0TD20M/fuWy0E5+WDeCo= github.com/envoyproxy/go-control-plane v0.14.0 h1:hbG2kr4RuFj222B6+7T83thSPqLjwBIfQawTkC++2HA= @@ -73,8 +71,8 @@ github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps= github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= -github.com/google/go-containerregistry v0.21.3 h1:Xr+yt3VvwOOn/5nJzd7UoOhwPGiPkYW0zWDLLUXqAi4= -github.com/google/go-containerregistry v0.21.3/go.mod h1:D5ZrJF1e6dMzvInpBPuMCX0FxURz7GLq2rV3Us9aPkc= +github.com/google/go-containerregistry v0.21.4 h1:VrhlIQtdhE6riZW//MjPrcJ1snAjPoCCpPHqGOygrv8= +github.com/google/go-containerregistry v0.21.4/go.mod h1:kxgc23zQ2qMY/hAKt0wCbB/7tkeovAP2mE2ienynJUw= github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0= github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= @@ -93,8 +91,8 @@ github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4= github.com/keybase/go-keychain v0.0.1 h1:way+bWYa6lDppZoZcgMbYsvC7GxljxrskdNInRtuthU= github.com/keybase/go-keychain v0.0.1/go.mod h1:PdEILRW3i9D8JcdM+FmY6RwkHGnhHxXwkPPMeUgOK1k= -github.com/klauspost/compress v1.18.4 h1:RPhnKRAQ4Fh8zU2FY/6ZFDwTVTxgJ/EMydqSTzE9a2c= -github.com/klauspost/compress v1.18.4/go.mod h1:R0h/fSBs8DE4ENlcrlib3PsXS61voFxhIs2DeRhCvJ4= +github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE= +github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= From 53af38ee38c9ac0aa798409a79f6b7fed5e02314 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 8 Apr 2026 05:33:36 -0400 Subject: [PATCH 144/313] build(deps): bump the opentelemetry group across 1 directory with 6 updates (#1134) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps the opentelemetry group with 2 updates in the / directory: [go.opentelemetry.io/contrib/instrumentation/runtime](https://github.com/open-telemetry/opentelemetry-go-contrib) and [go.opentelemetry.io/otel/exporters/prometheus](https://github.com/open-telemetry/opentelemetry-go). Updates `go.opentelemetry.io/contrib/instrumentation/runtime` from 0.67.0 to 0.68.0
Release notes

Sourced from go.opentelemetry.io/contrib/instrumentation/runtime's releases.

v1.43.0 / v2.5.0 / v0.68.0 / v0.37.0 / v0.23.0 / v0.18.0 / v0.16.0 / v0.15.0

Added

  • Add Resource method to SDK in go.opentelemetry.io/contrib/otelconf/v0.3.0 to expose the resolved SDK resource from declarative configuration. (#8660)
  • Add support to set the configuration file via OTEL_CONFIG_FILE in go.opentelemetry.io/contrib/otelconf. (#8639)
  • Add support for service resource detector in go.opentelemetry.io/contrib/otelconf. (#8674)
  • Add support for attribute_count_limit and attribute_value_length_limit in tracer provider configuration in go.opentelemetry.io/contrib/otelconf. (#8687)
  • Add support for attribute_count_limit and attribute_value_length_limit in logger provider configuration in go.opentelemetry.io/contrib/otelconf. (#8686)
  • Add support for server.address and server.port attributes in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc. (#8723)
  • Add support for OTEL_SEMCONV_STABILITY_OPT_IN in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc. Supported values are rpc (default), rpc/dup and rpc/old. (#8726)
  • Add the http.route metric attribute to go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp. (#8632)

Changed

  • Prepend _ to the normalized environment variable name when the key starts with a digit in go.opentelemetry.io/contrib/propagators/envcar, ensuring POSIX compliance. (#8678)
  • Move experimental types from go.opentelemetry.io/contrib/otelconf to go.opentelemetry.io/contrib/otelconf/x. (#8529)
  • Normalize cached environment variable names in go.opentelemetry.io/contrib/propagators/envcar, aligning Carrier.Keys output with the carrier's normalized key format. (#8761)

Fixed

  • Fix go.opentelemetry.io/contrib/otelconf Prometheus reader converting OTel dot-style label names (e.g. service.name) to underscore-style (service_name) in target_info when both without_type_suffix and without_units are set. Use NoTranslation instead of UnderscoreEscapingWithoutSuffixes to preserve dot-style label names while still suppressing metric name suffixes. (#8763)
  • Limit the request body size at 1MB in go.opentelemetry.io/contrib/zpages. (#8656)
  • Fix server spans using the client's address and port for server.address and server.port attributes in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc. (#8723)

Removed

  • Host ID resource detector has been removed when configuring the host resource detector in go.opentelemetry.io/contrib/otelconf. (#8581)

Deprecated

  • Deprecate OTEL_EXPERIMENTAL_CONFIG_FILE in favour of OTEL_CONFIG_FILE in go.opentelemetry.io/contrib/otelconf. (#8639)

What's Changed

... (truncated)

Changelog

Sourced from go.opentelemetry.io/contrib/instrumentation/runtime's changelog.

[1.43.0/2.5.0/0.68.0/0.37.0/0.23.0/0.18.0/0.16.0/0.15.0] - 2026-04-03

Added

  • Add Resource method to SDK in go.opentelemetry.io/contrib/otelconf/v0.3.0 to expose the resolved SDK resource from declarative configuration. (#8660)
  • Add support to set the configuration file via OTEL_CONFIG_FILE in go.opentelemetry.io/contrib/otelconf. (#8639)
  • Add support for service resource detector in go.opentelemetry.io/contrib/otelconf. (#8674)
  • Add support for attribute_count_limit and attribute_value_length_limit in tracer provider configuration in go.opentelemetry.io/contrib/otelconf. (#8687)
  • Add support for attribute_count_limit and attribute_value_length_limit in logger provider configuration in go.opentelemetry.io/contrib/otelconf. (#8686)
  • Add support for server.address and server.port attributes in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc. (#8723)
  • Add support for OTEL_SEMCONV_STABILITY_OPT_IN in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc. Supported values are rpc (default), rpc/dup and rpc/old. (#8726)
  • Add the http.route metric attribute to go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp. (#8632)

Changed

  • Prepend _ to the normalized environment variable name when the key starts with a digit in go.opentelemetry.io/contrib/propagators/envcar, ensuring POSIX compliance. (#8678)
  • Move experimental types from go.opentelemetry.io/contrib/otelconf to go.opentelemetry.io/contrib/otelconf/x. (#8529)
  • Normalize cached environment variable names in go.opentelemetry.io/contrib/propagators/envcar, aligning Carrier.Keys output with the carrier's normalized key format. (#8761)

Fixed

  • Fix go.opentelemetry.io/contrib/otelconf Prometheus reader converting OTel dot-style label names (e.g. service.name) to underscore-style (service_name) in target_info when both without_type_suffix and without_units are set. Use NoTranslation instead of UnderscoreEscapingWithoutSuffixes to preserve dot-style label names while still suppressing metric name suffixes. (#8763)
  • Limit the request body size at 1MB in go.opentelemetry.io/contrib/zpages. (#8656)
  • Fix server spans using the client's address and port for server.address and server.port attributes in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc. (#8723)

Removed

  • Host ID resource detector has been removed when configuring the host resource detector in go.opentelemetry.io/contrib/otelconf. (#8581)

Deprecated

  • Deprecate OTEL_EXPERIMENTAL_CONFIG_FILE in favour of OTEL_CONFIG_FILE in go.opentelemetry.io/contrib/otelconf. (#8639)
Commits
  • 45977a4 Release v1.43.0/v2.5.0/v0.68.0/v0.37.0/v0.23.0/v0.18.0/v0.16.0/v0.15.0 (#8769)
  • 0fcc152 fix(deps): update module github.com/googlecloudplatform/opentelemetry-operati...
  • eaba3cd chore(deps): update googleapis to 6f92a3b (#8776)
  • 6df430c chore(deps): update module github.com/jgautheron/goconst to v1.10.0 (#8771)
  • ae90e32 Fix otelconf prometheus label escaping (#8763)
  • f202c3f otelconf: move experimental types to otelconf/x (#8529)
  • 8ddaece fix(deps): update aws-sdk-go-v2 monorepo (#8764)
  • c7c03a4 chore(deps): update module github.com/mattn/go-runewidth to v0.0.22 (#8766)
  • 717a85a envcar: normalize cached environment variable names (#8761)
  • ad990b6 fix(deps): update module github.com/aws/smithy-go to v1.24.3 (#8765)
  • Additional commits viewable in compare view

Updates `go.opentelemetry.io/otel` from 1.42.0 to 1.43.0
Changelog

Sourced from go.opentelemetry.io/otel's changelog.

[1.43.0/0.65.0/0.19.0] 2026-04-02

Added

  • Add IsRandom and WithRandom on TraceFlags, and IsRandom on SpanContext in go.opentelemetry.io/otel/trace for W3C Trace Context Level 2 Random Trace ID Flag support. (#8012)
  • Add service detection with WithService in go.opentelemetry.io/otel/sdk/resource. (#7642)
  • Add DefaultWithContext and EnvironmentWithContext in go.opentelemetry.io/otel/sdk/resource to support plumbing context.Context through default and environment detectors. (#8051)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc. (#8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc. (#8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc. (#8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp. (#8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest. (#8038)
  • Add support for per-series start time tracking for cumulative metrics in go.opentelemetry.io/otel/sdk/metric. Set OTEL_GO_X_PER_SERIES_START_TIMESTAMPS=true to enable. (#8060)
  • Add WithCardinalityLimitSelector for metric reader for configuring cardinality limits specific to the instrument kind. (#7855)

Changed

  • Introduce the EMPTY Type in go.opentelemetry.io/otel/attribute to reflect that an empty value is now a valid value, with INVALID remaining as a deprecated alias of EMPTY. (#8038)
  • Improve slice handling in go.opentelemetry.io/otel/attribute to optimize short slice values with fixed-size fast paths. (#8039)
  • Improve performance of span metric recording in go.opentelemetry.io/otel/sdk/trace by returning early if self-observability is not enabled. (#8067)
  • Improve formatting of metric data diffs in go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest. (#8073)

Deprecated

  • Deprecate INVALID in go.opentelemetry.io/otel/attribute. Use EMPTY instead. (#8038)

Fixed

  • Return spec-compliant TraceIdRatioBased description. This is a breaking behavioral change, but it is necessary to make the implementation spec-compliant. (#8027)
  • Fix a race condition in go.opentelemetry.io/otel/sdk/metric where the lastvalue aggregation could collect the value 0 even when no zero-value measurements were recorded. (#8056)
  • Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to mitigate excessive memory usage caused by a misconfigured or malicious server. Responses exceeding the limit are treated as non-retryable errors. (#8108)
  • Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to mitigate excessive memory usage caused by a misconfigured or malicious server. Responses exceeding the limit are treated as non-retryable errors. (#8108)
  • Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to mitigate excessive memory usage caused by a misconfigured or malicious server. Responses exceeding the limit are treated as non-retryable errors. (#8108)
  • WithHostID detector in go.opentelemetry.io/otel/sdk/resource to use full path for kenv command on BSD. (#8113)
  • Fix missing request.GetBody in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to correctly handle HTTP2 GOAWAY frame. (#8096)
Commits
  • 9276201 Release v1.43.0 / v0.65.0 / v0.19.0 (#8128)
  • 61b8c94 chore(deps): update module github.com/mattn/go-runewidth to v0.0.22 (#8131)
  • 97a086e chore(deps): update github.com/golangci/dupl digest to c99c5cf (#8122)
  • 5e363de limit response body size for OTLP HTTP exporters (#8108)
  • 35214b6 Use an absolute path when calling bsd kenv (#8113)
  • 290024c fix(deps): update module google.golang.org/grpc to v1.80.0 (#8121)
  • e70658e fix: support getBody in otelploghttp (#8096)
  • 4afe468 fix(deps): update googleapis to 9d38bb4 (#8117)
  • b9ca729 chore(deps): update module github.com/go-git/go-git/v5 to v5.17.2 (#8115)
  • 69472ec chore(deps): update fossas/fossa-action action to v1.9.0 (#8118)
  • Additional commits viewable in compare view

Updates `go.opentelemetry.io/otel/exporters/prometheus` from 0.64.0 to 0.65.0
Release notes

Sourced from go.opentelemetry.io/otel/exporters/prometheus's releases.

v1.43.0/v0.65.0/v0.19.0

Added

  • Add IsRandom and WithRandom on TraceFlags, and IsRandom on SpanContext in go.opentelemetry.io/otel/trace for W3C Trace Context Level 2 Random Trace ID Flag support. (#8012)
  • Add service detection with WithService in go.opentelemetry.io/otel/sdk/resource. (#7642)
  • Add DefaultWithContext and EnvironmentWithContext in go.opentelemetry.io/otel/sdk/resource to support plumbing context.Context through default and environment detectors. (#8051)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc. (#8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc. (#8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc. (#8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp. (#8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest. (#8038)
  • Add support for per-series start time tracking for cumulative metrics in go.opentelemetry.io/otel/sdk/metric. Set OTEL_GO_X_PER_SERIES_START_TIMESTAMPS=true to enable. (#8060)
  • Add WithCardinalityLimitSelector for metric reader for configuring cardinality limits specific to the instrument kind. (#7855)

Changed

  • Introduce the EMPTY Type in go.opentelemetry.io/otel/attribute to reflect that an empty value is now a valid value, with INVALID remaining as a deprecated alias of EMPTY. (#8038)
  • Refactor slice handling in go.opentelemetry.io/otel/attribute to optimize short slice values with fixed-size fast paths. (#8039)
  • Improve performance of span metric recording in go.opentelemetry.io/otel/sdk/trace by returning early if self-observability is not enabled. (#8067)
  • Improve formatting of metric data diffs in go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest. (#8073)

Deprecated

  • Deprecate INVALID in go.opentelemetry.io/otel/attribute. Use EMPTY instead. (#8038)

Fixed

  • Return spec-compliant TraceIdRatioBased description. This is a breaking behavioral change, but it is necessary to make the implementation spec-compliant. (#8027)
  • Fix a race condition in go.opentelemetry.io/otel/sdk/metric where the lastvalue aggregation could collect the value 0 even when no zero-value measurements were recorded. (#8056)
  • Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to mitigate excessive memory usage caused by a misconfigured or malicious server. Responses exceeding the limit are treated as non-retryable errors. (#8108)
  • Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to mitigate excessive memory usage caused by a misconfigured or malicious server. Responses exceeding the limit are treated as non-retryable errors. (#8108)
  • Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to mitigate excessive memory usage caused by a misconfigured or malicious server. Responses exceeding the limit are treated as non-retryable errors. (#8108)
  • WithHostID detector in go.opentelemetry.io/otel/sdk/resource to use full path for kenv command on BSD. (#8113)
  • Fix missing request.GetBody in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to correctly handle HTTP2 GOAWAY frame. (#8096)

What's Changed

... (truncated)

Changelog

Sourced from go.opentelemetry.io/otel/exporters/prometheus's changelog.

[1.43.0/0.65.0/0.19.0] 2026-04-02

Added

  • Add IsRandom and WithRandom on TraceFlags, and IsRandom on SpanContext in go.opentelemetry.io/otel/trace for W3C Trace Context Level 2 Random Trace ID Flag support. (#8012)
  • Add service detection with WithService in go.opentelemetry.io/otel/sdk/resource. (#7642)
  • Add DefaultWithContext and EnvironmentWithContext in go.opentelemetry.io/otel/sdk/resource to support plumbing context.Context through default and environment detectors. (#8051)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc. (#8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc. (#8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc. (#8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp. (#8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest. (#8038)
  • Add support for per-series start time tracking for cumulative metrics in go.opentelemetry.io/otel/sdk/metric. Set OTEL_GO_X_PER_SERIES_START_TIMESTAMPS=true to enable. (#8060)
  • Add WithCardinalityLimitSelector for metric reader for configuring cardinality limits specific to the instrument kind. (#7855)

Changed

  • Introduce the EMPTY Type in go.opentelemetry.io/otel/attribute to reflect that an empty value is now a valid value, with INVALID remaining as a deprecated alias of EMPTY. (#8038)
  • Improve slice handling in go.opentelemetry.io/otel/attribute to optimize short slice values with fixed-size fast paths. (#8039)
  • Improve performance of span metric recording in go.opentelemetry.io/otel/sdk/trace by returning early if self-observability is not enabled. (#8067)
  • Improve formatting of metric data diffs in go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest. (#8073)

Deprecated

  • Deprecate INVALID in go.opentelemetry.io/otel/attribute. Use EMPTY instead. (#8038)

Fixed

  • Return spec-compliant TraceIdRatioBased description. This is a breaking behavioral change, but it is necessary to make the implementation spec-compliant. (#8027)
  • Fix a race condition in go.opentelemetry.io/otel/sdk/metric where the lastvalue aggregation could collect the value 0 even when no zero-value measurements were recorded. (#8056)
  • Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to mitigate excessive memory usage caused by a misconfigured or malicious server. Responses exceeding the limit are treated as non-retryable errors. (#8108)
  • Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to mitigate excessive memory usage caused by a misconfigured or malicious server. Responses exceeding the limit are treated as non-retryable errors. (#8108)
  • Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to mitigate excessive memory usage caused by a misconfigured or malicious server. Responses exceeding the limit are treated as non-retryable errors. (#8108)
  • WithHostID detector in go.opentelemetry.io/otel/sdk/resource to use full path for kenv command on BSD. (#8113)
  • Fix missing request.GetBody in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to correctly handle HTTP2 GOAWAY frame. (#8096)
Commits
  • 9276201 Release v1.43.0 / v0.65.0 / v0.19.0 (#8128)
  • 61b8c94 chore(deps): update module github.com/mattn/go-runewidth to v0.0.22 (#8131)
  • 97a086e chore(deps): update github.com/golangci/dupl digest to c99c5cf (#8122)
  • 5e363de limit response body size for OTLP HTTP exporters (#8108)
  • 35214b6 Use an absolute path when calling bsd kenv (#8113)
  • 290024c fix(deps): update module google.golang.org/grpc to v1.80.0 (#8121)
  • e70658e fix: support getBody in otelploghttp (#8096)
  • 4afe468 fix(deps): update googleapis to 9d38bb4 (#8117)
  • b9ca729 chore(deps): update module github.com/go-git/go-git/v5 to v5.17.2 (#8115)
  • 69472ec chore(deps): update fossas/fossa-action action to v1.9.0 (#8118)
  • Additional commits viewable in compare view

Updates `go.opentelemetry.io/otel/metric` from 1.42.0 to 1.43.0
Changelog

Sourced from go.opentelemetry.io/otel/metric's changelog.

[1.43.0/0.65.0/0.19.0] 2026-04-02

Added

  • Add IsRandom and WithRandom on TraceFlags, and IsRandom on SpanContext in go.opentelemetry.io/otel/trace for W3C Trace Context Level 2 Random Trace ID Flag support. (#8012)
  • Add service detection with WithService in go.opentelemetry.io/otel/sdk/resource. (#7642)
  • Add DefaultWithContext and EnvironmentWithContext in go.opentelemetry.io/otel/sdk/resource to support plumbing context.Context through default and environment detectors. (#8051)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc. (#8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc. (#8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc. (#8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp. (#8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest. (#8038)
  • Add support for per-series start time tracking for cumulative metrics in go.opentelemetry.io/otel/sdk/metric. Set OTEL_GO_X_PER_SERIES_START_TIMESTAMPS=true to enable. (#8060)
  • Add WithCardinalityLimitSelector for metric reader for configuring cardinality limits specific to the instrument kind. (#7855)

Changed

  • Introduce the EMPTY Type in go.opentelemetry.io/otel/attribute to reflect that an empty value is now a valid value, with INVALID remaining as a deprecated alias of EMPTY. (#8038)
  • Improve slice handling in go.opentelemetry.io/otel/attribute to optimize short slice values with fixed-size fast paths. (#8039)
  • Improve performance of span metric recording in go.opentelemetry.io/otel/sdk/trace by returning early if self-observability is not enabled. (#8067)
  • Improve formatting of metric data diffs in go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest. (#8073)

Deprecated

  • Deprecate INVALID in go.opentelemetry.io/otel/attribute. Use EMPTY instead. (#8038)

Fixed

  • Return spec-compliant TraceIdRatioBased description. This is a breaking behavioral change, but it is necessary to make the implementation spec-compliant. (#8027)
  • Fix a race condition in go.opentelemetry.io/otel/sdk/metric where the lastvalue aggregation could collect the value 0 even when no zero-value measurements were recorded. (#8056)
  • Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to mitigate excessive memory usage caused by a misconfigured or malicious server. Responses exceeding the limit are treated as non-retryable errors. (#8108)
  • Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to mitigate excessive memory usage caused by a misconfigured or malicious server. Responses exceeding the limit are treated as non-retryable errors. (#8108)
  • Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to mitigate excessive memory usage caused by a misconfigured or malicious server. Responses exceeding the limit are treated as non-retryable errors. (#8108)
  • WithHostID detector in go.opentelemetry.io/otel/sdk/resource to use full path for kenv command on BSD. (#8113)
  • Fix missing request.GetBody in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to correctly handle HTTP2 GOAWAY frame. (#8096)
Commits
  • 9276201 Release v1.43.0 / v0.65.0 / v0.19.0 (#8128)
  • 61b8c94 chore(deps): update module github.com/mattn/go-runewidth to v0.0.22 (#8131)
  • 97a086e chore(deps): update github.com/golangci/dupl digest to c99c5cf (#8122)
  • 5e363de limit response body size for OTLP HTTP exporters (#8108)
  • 35214b6 Use an absolute path when calling bsd kenv (#8113)
  • 290024c fix(deps): update module google.golang.org/grpc to v1.80.0 (#8121)
  • e70658e fix: support getBody in otelploghttp (#8096)
  • 4afe468 fix(deps): update googleapis to 9d38bb4 (#8117)
  • b9ca729 chore(deps): update module github.com/go-git/go-git/v5 to v5.17.2 (#8115)
  • 69472ec chore(deps): update fossas/fossa-action action to v1.9.0 (#8118)
  • Additional commits viewable in compare view

Updates `go.opentelemetry.io/otel/sdk` from 1.42.0 to 1.43.0
Changelog

Sourced from go.opentelemetry.io/otel/sdk's changelog.

[1.43.0/0.65.0/0.19.0] 2026-04-02

Added

  • Add IsRandom and WithRandom on TraceFlags, and IsRandom on SpanContext in go.opentelemetry.io/otel/trace for W3C Trace Context Level 2 Random Trace ID Flag support. (#8012)
  • Add service detection with WithService in go.opentelemetry.io/otel/sdk/resource. (#7642)
  • Add DefaultWithContext and EnvironmentWithContext in go.opentelemetry.io/otel/sdk/resource to support plumbing context.Context through default and environment detectors. (#8051)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc. (#8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc. (#8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc. (#8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp. (#8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8038)
  • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest. (#8038)
  • Add support for per-series start time tracking for cumulative metrics in go.opentelemetry.io/otel/sdk/metric. Set OTEL_GO_X_PER_SERIES_START_TIMESTAMPS=true to enable. (#8060)
  • Add WithCardinalityLimitSelector for metric reader for configuring cardinality limits specific to the instrument kind. (#7855)

Changed

  • Introduce the EMPTY Type in go.opentelemetry.io/otel/attribute to reflect that an empty value is now a valid value, with INVALID remaining as a deprecated alias of EMPTY. (#8038)
  • Improve slice handling in go.opentelemetry.io/otel/attribute to optimize short slice values with fixed-size fast paths. (#8039)
  • Improve performance of span metric recording in go.opentelemetry.io/otel/sdk/trace by returning early if self-observability is not enabled. (#8067)
  • Improve formatting of metric data diffs in go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest. (#8073)

Deprecated

  • Deprecate INVALID in go.opentelemetry.io/otel/attribute. Use EMPTY instead. (#8038)

Fixed

  • Return spec-compliant TraceIdRatioBased description. This is a breaking behavioral change, but it is necessary to make the implementation spec-compliant. (#8027)
  • Fix a race condition in go.opentelemetry.io/otel/sdk/metric where the lastvalue aggregation could collect the value 0 even when no zero-value measurements were recorded. (#8056)
  • Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to mitigate excessive memory usage caused by a misconfigured or malicious server. Responses exceeding the limit are treated as non-retryable errors. (#8108)
  • Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to mitigate excessive memory usage caused by a misconfigured or malicious server. Responses exceeding the limit are treated as non-retryable errors. (#8108)
  • Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to mitigate excessive memory usage caused by a misconfigured or malicious server. Responses exceeding the limit are treated as non-retryable errors. (#8108)
  • WithHostID detector in go.opentelemetry.io/otel/sdk/resource to use full path for kenv command on BSD. ( Date: Wed, 8 Apr 2026 05:38:52 -0400 Subject: [PATCH 145/313] build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.228.0 to 3.229.0 in /deploy (#1112) Bumps [github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from 3.228.0 to 3.229.0.
    Release notes

    Sourced from github.com/pulumi/pulumi/sdk/v3's releases.

    v3.229.0

    3.229.0 (2026-04-02)

    Features

    • [auto/python] Add org get-default and set-default commands to Automation API

    • [backend/diy] Avoid unnecessary S3 bucket HEAD calls to improve performance #22373

    • [cli] Allow TRACEPARENT to be set for CLI invocations, parenting the pulumi spans under an existing parent span #22369

    • [cli/display] Add --urns flag to display full resource URNs instead of short names in preview, up, destroy, refresh, import, and watch commands #22007

    • [pcl] Type integer literals as integers rather than numbers in PCL #22268

    • [pcl] Support parameterized providers in PCL #22251

    • [protobuf] Add RunPlugin2 bidirectional streaming RPC to LanguageRuntime proto #22389

    • [yaml] Update YAML runtime to 1.30.2 #22426

    • [sdk/go] Add org get-default and set-default commands to Automation API

    • [sdk/nodejs] Modernize generated tsconfig.json to align with TypeScript defaults #22370

    • [cli/policy] Add a new policy analyze command to run a policy pack against existing state #22250

    Bug Fixes

    • [backend/diy] Remove state lock for refresh --preview-only for diy backend #22385

    • [cli] Fix OTEL flushing on provider shutdown #22358

    • [cli/display] Fix deadlock in message renderer when cancelling an operation #22433

    • [engine] Fix --include and --exclude not working for program-based refresh (RefreshV2)

    ... (truncated)

    Changelog

    Sourced from github.com/pulumi/pulumi/sdk/v3's changelog.

    3.229.0 (2026-04-02)

    Features

    • [auto/python] Add org get-default and set-default commands to Automation API

    • [backend/diy] Avoid unnecessary S3 bucket HEAD calls to improve performance #22373

    • [cli] Allow TRACEPARENT to be set for CLI invocations, parenting the pulumi spans under an existing parent span #22369

    • [cli/display] Add --urns flag to display full resource URNs instead of short names in preview, up, destroy, refresh, import, and watch commands #22007

    • [pcl] Type integer literals as integers rather than numbers in PCL #22268

    • [pcl] Support parameterized providers in PCL #22251

    • [protobuf] Add RunPlugin2 bidirectional streaming RPC to LanguageRuntime proto #22389

    • [yaml] Update YAML runtime to 1.30.2 #22426

    • [sdk/go] Add org get-default and set-default commands to Automation API

    • [sdk/nodejs] Modernize generated tsconfig.json to align with TypeScript defaults #22370

    • [cli/policy] Add a new policy analyze command to run a policy pack against existing state #22250

    Bug Fixes

    • [backend/diy] Remove state lock for refresh --preview-only for diy backend #22385

    • [cli] Fix OTEL flushing on provider shutdown #22358

    • [cli/display] Fix deadlock in message renderer when cancelling an operation #22433

    • [engine] Fix --include and --exclude not working for program-based refresh (RefreshV2) #22404

    ... (truncated)

    Commits

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/pulumi/pulumi/sdk/v3&package-manager=go_modules&previous-version=3.228.0&new-version=3.229.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- deploy/go.mod | 2 +- deploy/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index 0e4c7f5..199188d 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -5,7 +5,7 @@ go 1.25.8 require ( github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.28.0 - github.com/pulumi/pulumi/sdk/v3 v3.228.0 + github.com/pulumi/pulumi/sdk/v3 v3.229.0 gopkg.in/yaml.v2 v2.4.0 ) diff --git a/deploy/go.sum b/deploy/go.sum index 766581d..be56fb7 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -185,8 +185,8 @@ github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 h1:w6OnO3d4j5yVf2vpm8OzXFC/xHOEGqt+9 github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1/go.mod h1:UyZyv7hz4knpFx6/Sh+SkZe6hT6sJHtDvw9A0TbvEsk= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.28.0 h1:muCE6cUJ4YmAaNLiOhbjEicxT+10i/EGsZrx2ZZQQ+o= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.28.0/go.mod h1:B998wofejDKAvvpLwsi4UMfWDFHHBnzYiM8mZ9e7OSo= -github.com/pulumi/pulumi/sdk/v3 v3.228.0 h1:+kV5pPM52MMFQsYiZ/deDi6egVb8JZsTpQhzv+CMB3A= -github.com/pulumi/pulumi/sdk/v3 v3.228.0/go.mod h1:PAqB2+8gnxqk+QrFdXL3fSjsLIjtlBIcy5KLZ//4WSk= +github.com/pulumi/pulumi/sdk/v3 v3.229.0 h1:jsAw5lXiHN22YQeo4bZHZBAG/DUlEnzsFWg5MuHnTSs= +github.com/pulumi/pulumi/sdk/v3 v3.229.0/go.mod h1:PAqB2+8gnxqk+QrFdXL3fSjsLIjtlBIcy5KLZ//4WSk= github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ= github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88= github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ= From 9b32a5c1877b7a0f9683eb6d0497bfbe75ab4c47 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 8 Apr 2026 05:39:37 -0400 Subject: [PATCH 146/313] build(deps): bump docker/login-action from 4.0.0 to 4.1.0 in the actions group (#1113) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps the actions group with 1 update: [docker/login-action](https://github.com/docker/login-action). Updates `docker/login-action` from 4.0.0 to 4.1.0
    Release notes

    Sourced from docker/login-action's releases.

    v4.1.0

    Full Changelog: https://github.com/docker/login-action/compare/v4.0.0...v4.1.0

    Commits
    • 4907a6d Merge pull request #930 from docker/dependabot/npm_and_yarn/aws-sdk-dependenc...
    • 1e233e6 chore: update generated content
    • 6c24ead build(deps): bump the aws-sdk-dependencies group with 2 updates
    • ee034d7 Merge pull request #958 from docker/dependabot/npm_and_yarn/lodash-4.18.1
    • 1527209 Merge pull request #937 from docker/dependabot/npm_and_yarn/proxy-agent-depen...
    • d39362a build(deps): bump lodash from 4.17.23 to 4.18.1
    • a6f092b chore: update generated content
    • 60953f0 build(deps): bump the proxy-agent-dependencies group with 2 updates
    • 62c6885 Merge pull request #936 from docker/dependabot/npm_and_yarn/docker/actions-to...
    • 102c0e6 chore: update generated content
    • Additional commits viewable in compare view

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=docker/login-action&package-manager=github_actions&previous-version=4.0.0&new-version=4.1.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/deploy-staging.yml | 2 +- .github/workflows/release.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml index dd0589f..85f52df 100644 --- a/.github/workflows/deploy-staging.yml +++ b/.github/workflows/deploy-staging.yml @@ -34,7 +34,7 @@ jobs: uses: ko-build/setup-ko@v0.9 - name: Log in to Container Registry - uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 + uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 with: registry: ghcr.io username: ${{ github.actor }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index ea606b7..d4c65c4 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -57,7 +57,7 @@ jobs: uses: ko-build/setup-ko@v0.9 - name: Log in to Container Registry - uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 + uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 with: registry: ghcr.io username: ${{ github.actor }} From 0fc4606be26016b4c557770fd59ceb8922c7c346 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Thu, 9 Apr 2026 11:57:21 -0400 Subject: [PATCH 147/313] Stop pinning Go to patch versions, use stable in CI (#1137) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Motivation and Context We keep bumping `go 1.26.x` across the repo every time a new Go patch drops ## How Has This Been Tested? - **`go.mod` / `deploy/go.mod`**: `go 1.25.8` → `go 1.26` (minor only — "this module needs Go 1.26") - **All CI workflows**: `go-version-file: 'go.mod'` → `go-version: 'stable'` — CI always uses the latest stable Go, no more bump PRs - **govulncheck**: removed hardcoded `go-version-input: '1.26.1'` → `go-version-input: 'stable'` ## Breaking Changes ## Types of changes - [ ] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] Documentation update ## Checklist - [ ] I have read the [MCP Documentation](https://modelcontextprotocol.io) - [ ] My code follows the repository's style guidelines - [ ] New and existing tests pass locally - [ ] I have added appropriate error handling - [ ] I have added or updated documentation as needed ## Additional context Signed-off-by: Radoslav Dimitrov --- .github/workflows/ci.yml | 10 ++++------ .github/workflows/deploy-production.yml | 2 +- .github/workflows/deploy-staging.yml | 4 ++-- .github/workflows/release.yml | 4 ++-- .golangci.yml | 5 +++++ cmd/publisher/auth/common.go | 4 ++-- cmd/publisher/auth/github-oidc.go | 4 ++-- deploy/go.mod | 2 +- go.mod | 2 +- internal/api/handlers/v0/auth/oidc_test.go | 2 +- internal/database/postgres.go | 1 - internal/database/testutil.go | 2 +- internal/validators/schema.go | 2 +- 13 files changed, 23 insertions(+), 21 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 1bc20d0..e24af7a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -21,13 +21,13 @@ jobs: - name: Set up Go uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c with: - go-version-file: 'go.mod' + go-version: 'stable' cache: true - name: Run lint uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 with: - version: v2.4.0 + version: v2.11.4 - name: Validate schemas and examples run: make validate @@ -38,9 +38,7 @@ jobs: - name: Run govulncheck uses: golang/govulncheck-action@v1 with: - # Use Go 1.26.1 to pick up crypto/x509 vulnerability fixes (GO-2026-4600, GO-2026-4599). - # go.mod stays at go 1.25.8 for golangci-lint compatibility until it supports Go 1.26. - go-version-input: '1.26.1' + go-version-input: 'stable' go-package: ./... repo-checkout: false @@ -55,7 +53,7 @@ jobs: - name: Set up Go uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c with: - go-version-file: 'go.mod' + go-version: 'stable' cache: true - name: Set up ko diff --git a/.github/workflows/deploy-production.yml b/.github/workflows/deploy-production.yml index 0ca5224..cd03772 100644 --- a/.github/workflows/deploy-production.yml +++ b/.github/workflows/deploy-production.yml @@ -28,7 +28,7 @@ jobs: - name: Setup Go uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c with: - go-version-file: 'deploy/go.mod' + go-version: 'stable' cache: true - name: Setup Pulumi diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml index 85f52df..946aaaf 100644 --- a/.github/workflows/deploy-staging.yml +++ b/.github/workflows/deploy-staging.yml @@ -27,7 +27,7 @@ jobs: - name: Set up Go uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c with: - go-version-file: 'go.mod' + go-version: 'stable' cache: true - name: Set up ko @@ -75,7 +75,7 @@ jobs: - name: Setup Go uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c with: - go-version-file: 'deploy/go.mod' + go-version: 'stable' cache: true - name: Setup Pulumi diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index d4c65c4..b1f807f 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -21,7 +21,7 @@ jobs: - name: Set up Go uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c with: - go-version-file: 'go.mod' + go-version: 'stable' cache: true - name: Install cosign @@ -50,7 +50,7 @@ jobs: - name: Set up Go uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c with: - go-version-file: 'go.mod' + go-version: 'stable' cache: true - name: Set up ko diff --git a/.golangci.yml b/.golangci.yml index dfb7587..5f3ad3c 100644 --- a/.golangci.yml +++ b/.golangci.yml @@ -66,6 +66,11 @@ linters: - common-false-positives - legacy - std-error-handling + rules: + # httptest.NewRequest is idiomatic in tests; noctx is not useful there. + - path: _test\.go + linters: + - noctx paths: - third_party$ - builtin$ diff --git a/cmd/publisher/auth/common.go b/cmd/publisher/auth/common.go index 2ffdb7d..28829e8 100644 --- a/cmd/publisher/auth/common.go +++ b/cmd/publisher/auth/common.go @@ -160,7 +160,7 @@ func parseRawPrivateKey(curve elliptic.Curve, privateKeyBytes []byte) (*ecdsa.Pr return nil, fmt.Errorf("invalid private scalar") } - x, y := curve.ScalarBaseMult(d.Bytes()) + x, y := curve.ScalarBaseMult(d.Bytes()) //nolint:staticcheck // SA1019: needs crypto/ecdh refactor return &ecdsa.PrivateKey{ PublicKey: ecdsa.PublicKey{ Curve: curve, @@ -192,7 +192,7 @@ func PrintEcdsaP384KeyInfo(pubKey ecdsa.PublicKey) { } func printEcdsaKeyInfo(k string, pubKey ecdsa.PublicKey) { - compressed := elliptic.MarshalCompressed(pubKey.Curve, pubKey.X, pubKey.Y) + compressed := elliptic.MarshalCompressed(pubKey.Curve, pubKey.X, pubKey.Y) //nolint:staticcheck // SA1019: needs crypto/ecdh refactor pubKeyString := base64.StdEncoding.EncodeToString(compressed) fmt.Fprint(os.Stdout, "Expected proof record:\n") fmt.Fprintf(os.Stdout, "v=MCPv1; k=%s; p=%s\n", k, pubKeyString) diff --git a/cmd/publisher/auth/github-oidc.go b/cmd/publisher/auth/github-oidc.go index 7caebfe..55fa350 100644 --- a/cmd/publisher/auth/github-oidc.go +++ b/cmd/publisher/auth/github-oidc.go @@ -122,7 +122,7 @@ func (o *GitHubOIDCProvider) getOIDCTokenFromGitHub(ctx context.Context) (string fullURL := requestURL + "&audience=mcp-registry" // Create the request - req, err := http.NewRequestWithContext(ctx, http.MethodGet, fullURL, nil) + req, err := http.NewRequestWithContext(ctx, http.MethodGet, fullURL, nil) //nolint:gosec // G704: URL is from GitHub Actions ACTIONS_ID_TOKEN_REQUEST_URL env var if err != nil { return "", fmt.Errorf("failed to create request: %w", err) } @@ -133,7 +133,7 @@ func (o *GitHubOIDCProvider) getOIDCTokenFromGitHub(ctx context.Context) (string // Make the request client := &http.Client{} - resp, err := client.Do(req) + resp, err := client.Do(req) //nolint:gosec // G704: URL is from GitHub Actions env var if err != nil { return "", fmt.Errorf("failed to send request: %w", err) } diff --git a/deploy/go.mod b/deploy/go.mod index 199188d..8edac31 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -1,6 +1,6 @@ module github.com/modelcontextprotocol/registry/deploy/infra -go 1.25.8 +go 1.26 require ( github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 diff --git a/go.mod b/go.mod index 5f1e76c..d08ff7b 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/modelcontextprotocol/registry -go 1.25.8 +go 1.26 require ( cloud.google.com/go/kms v1.26.0 diff --git a/internal/api/handlers/v0/auth/oidc_test.go b/internal/api/handlers/v0/auth/oidc_test.go index 4ad8acb..d4e9500 100644 --- a/internal/api/handlers/v0/auth/oidc_test.go +++ b/internal/api/handlers/v0/auth/oidc_test.go @@ -31,7 +31,7 @@ func TestOIDCHandler_ExchangeToken(t *testing.T) { token string expectedError bool }{ - { + { //nolint:gosec // G101: test data, not real credentials name: "successful token exchange with publish permissions", config: &config.Config{ OIDCEnabled: true, diff --git a/internal/database/postgres.go b/internal/database/postgres.go index 70bfe43..a86e44b 100644 --- a/internal/database/postgres.go +++ b/internal/database/postgres.go @@ -764,7 +764,6 @@ func hashServerName(name string) int64 { hash ^= uint64(name[i]) hash *= prime64 } - //nolint:gosec // Intentional conversion with masking to 63 bits return int64(hash & 0x7FFFFFFFFFFFFFFF) } diff --git a/internal/database/testutil.go b/internal/database/testutil.go index c67e3a1..8fbdb60 100644 --- a/internal/database/testutil.go +++ b/internal/database/testutil.go @@ -64,7 +64,7 @@ func NewTestDB(t *testing.T) Database { defer cancel() // Connect to postgres database - adminURI := "postgres://mcpregistry:mcpregistry@localhost:5432/postgres?sslmode=disable" + adminURI := "postgres://mcpregistry:mcpregistry@localhost:5432/postgres?sslmode=disable" //nolint:gosec // G101: test database credentials adminConn, err := pgx.Connect(ctx, adminURI) require.NoError(t, err, "Failed to connect to PostgreSQL. Make sure PostgreSQL is running via: docker-compose up -d postgres") defer adminConn.Close(ctx) diff --git a/internal/validators/schema.go b/internal/validators/schema.go index 8a64b32..37d335e 100644 --- a/internal/validators/schema.go +++ b/internal/validators/schema.go @@ -284,7 +284,7 @@ func ConvertJSONPointerToBracketNotation(jsonPointer string) string { // Check if part is a pure number (array index) if _, err := strconv.Atoi(part); err == nil { // It's a numeric index - use bracket notation - result.WriteString(fmt.Sprintf("[%s]", part)) + fmt.Fprintf(&result, "[%s]", part) // Add dot after bracket if next part exists and is a field name (not a number) if i < len(parts)-1 { nextPart := parts[i+1] From 5f81cf3336c3d945c7889a5df1aae194434cc985 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 9 Apr 2026 14:19:50 -0400 Subject: [PATCH 148/313] build(deps): bump cloud.google.com/go/kms from 1.26.0 to 1.27.0 (#1111) Bumps [cloud.google.com/go/kms](https://github.com/googleapis/google-cloud-go) from 1.26.0 to 1.27.0.
    Release notes

    Sourced from cloud.google.com/go/kms's releases.

    kms: v1.27.0

    v1.27.0 (2026-04-02)

    retail: v1.27.0

    v1.27.0 (2026-04-02)

    Changelog

    Sourced from cloud.google.com/go/kms's changelog.

    1.27.0 (2024-04-15)

    Features

    • documentai: Support a new Layout Processor in Document AI (2cdc40a)

    1.26.1 (2024-03-14)

    Bug Fixes

    • documentai: Update protobuf dep to v1.33.0 (30b038d)

    Documentation

    • documentai: A comment for field processor_version_source in message .google.cloud.documentai.v1beta3.ImportProcessorVersionRequest is changed (25c3f2d)
    Commits
    • b64e8dc chore: librarian release pull request: 20251013T184035Z (#13116)
    • ddc086c feat(aiplatform): Add JAILBREAK category to SafetySettings for prediction ser...
    • c79db96 chore: librarian generate pull request: 20251013T073656Z (#13101)
    • b041315 chore: migrate 18 modules to Librarian (#13112)
    • a75de40 chore: migrate advisorynotifications to Librarian (#13110)
    • 3cf5269 chore: undo IAM semi-migration (#13109)
    • 7663fdc fix(internal/stategen): be more conservative about removing OwlBot lines (#13...
    • 8ebb896 chore: librarian release pull request: 20251010T200657Z (#13107)
    • befb302 test(internal/postprocessor): skip test that expects certain live config (#13...
    • 1930511 testing(internal/godocfx): convert equality check to a diff check (#13089)
    • Additional commits viewable in compare view

    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Radoslav Dimitrov --- go.mod | 26 +++++++++++++------------- go.sum | 52 ++++++++++++++++++++++++++-------------------------- 2 files changed, 39 insertions(+), 39 deletions(-) diff --git a/go.mod b/go.mod index d08ff7b..49c7fd1 100644 --- a/go.mod +++ b/go.mod @@ -3,7 +3,7 @@ module github.com/modelcontextprotocol/registry go 1.26 require ( - cloud.google.com/go/kms v1.26.0 + cloud.google.com/go/kms v1.27.0 github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.4.0 github.com/caarlos0/env/v11 v11.4.0 @@ -28,10 +28,10 @@ require ( require ( cloud.google.com/go v0.123.0 // indirect - cloud.google.com/go/auth v0.18.1 // indirect + cloud.google.com/go/auth v0.18.2 // indirect cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect cloud.google.com/go/compute/metadata v0.9.0 // indirect - cloud.google.com/go/iam v1.5.3 // indirect + cloud.google.com/go/iam v1.6.0 // indirect cloud.google.com/go/longrunning v0.8.0 // indirect github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0 // indirect github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 // indirect @@ -49,8 +49,8 @@ require ( github.com/go-logr/stdr v1.2.2 // indirect github.com/google/s2a-go v0.1.9 // indirect github.com/google/uuid v1.6.0 // indirect - github.com/googleapis/enterprise-certificate-proxy v0.3.11 // indirect - github.com/googleapis/gax-go/v2 v2.17.0 // indirect + github.com/googleapis/enterprise-certificate-proxy v0.3.14 // indirect + github.com/googleapis/gax-go/v2 v2.20.0 // indirect github.com/jackc/pgpassfile v1.0.0 // indirect github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect github.com/jackc/puddle/v2 v2.2.2 // indirect @@ -73,17 +73,17 @@ require ( go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect go.opentelemetry.io/otel/trace v1.43.0 // indirect go.yaml.in/yaml/v2 v2.4.4 // indirect - golang.org/x/crypto v0.48.0 // indirect - golang.org/x/net v0.51.0 // indirect + golang.org/x/crypto v0.49.0 // indirect + golang.org/x/net v0.52.0 // indirect golang.org/x/oauth2 v0.36.0 // indirect golang.org/x/sync v0.20.0 // indirect golang.org/x/sys v0.42.0 // indirect - golang.org/x/text v0.34.0 // indirect - golang.org/x/time v0.14.0 // indirect - google.golang.org/api v0.265.0 // indirect - google.golang.org/genproto v0.0.0-20260128011058-8636f8732409 // indirect - google.golang.org/genproto/googleapis/api v0.0.0-20260203192932-546029d2fa20 // indirect - google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409 // indirect + golang.org/x/text v0.35.0 // indirect + golang.org/x/time v0.15.0 // indirect + google.golang.org/api v0.273.1 // indirect + google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 // indirect + google.golang.org/genproto/googleapis/api v0.0.0-20260401001100-f93e5f3e9f0f // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20260319201613-d00831a3d3e7 // indirect google.golang.org/grpc v1.79.3 // indirect google.golang.org/protobuf v1.36.11 // indirect gotest.tools/v3 v3.5.2 // indirect diff --git a/go.sum b/go.sum index 6c4665b..56e727c 100644 --- a/go.sum +++ b/go.sum @@ -1,15 +1,15 @@ cloud.google.com/go v0.123.0 h1:2NAUJwPR47q+E35uaJeYoNhuNEM9kM8SjgRgdeOJUSE= cloud.google.com/go v0.123.0/go.mod h1:xBoMV08QcqUGuPW65Qfm1o9Y4zKZBpGS+7bImXLTAZU= -cloud.google.com/go/auth v0.18.1 h1:IwTEx92GFUo2pJ6Qea0EU3zYvKnTAeRCODxfA/G5UWs= -cloud.google.com/go/auth v0.18.1/go.mod h1:GfTYoS9G3CWpRA3Va9doKN9mjPGRS+v41jmZAhBzbrA= +cloud.google.com/go/auth v0.18.2 h1:+Nbt5Ev0xEqxlNjd6c+yYUeosQ5TtEUaNcN/3FozlaM= +cloud.google.com/go/auth v0.18.2/go.mod h1:xD+oY7gcahcu7G2SG2DsBerfFxgPAJz17zz2joOFF3M= cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc= cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c= cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs= cloud.google.com/go/compute/metadata v0.9.0/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10= -cloud.google.com/go/iam v1.5.3 h1:+vMINPiDF2ognBJ97ABAYYwRgsaqxPbQDlMnbHMjolc= -cloud.google.com/go/iam v1.5.3/go.mod h1:MR3v9oLkZCTlaqljW6Eb2d3HGDGK5/bDv93jhfISFvU= -cloud.google.com/go/kms v1.26.0 h1:cK9mN2cf+9V63D3H1f6koxTatWy39aTI/hCjz1I+adU= -cloud.google.com/go/kms v1.26.0/go.mod h1:pHKOdFJm63hxBsiPkYtowZPltu9dW0MWvBa6IA4HM58= +cloud.google.com/go/iam v1.6.0 h1:JiSIcEi38dWBKhB3BtfKCW+dMvCZJEhBA2BsaGJgoxs= +cloud.google.com/go/iam v1.6.0/go.mod h1:ZS6zEy7QHmcNO18mjO2viYv/n+wOUkhJqGNkPPGueGU= +cloud.google.com/go/kms v1.27.0 h1:iYYgoD0HJIqz35A+He1G0dS5qTQzQsDXFsyXwzkUCXM= +cloud.google.com/go/kms v1.27.0/go.mod h1:KPxrdf61iYEOZ86uPwR86muBpSik2y4Ion6e83fVl1Q= cloud.google.com/go/longrunning v0.8.0 h1:LiKK77J3bx5gDLi4SMViHixjD2ohlkwBi+mKA7EhfW8= cloud.google.com/go/longrunning v0.8.0/go.mod h1:UmErU2Onzi+fKDg2gR7dusz11Pe26aknR4kHmJJqIfk= github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0 h1:JXg2dwJUmPB9JmtVmdEB16APJ7jurfbY5jnfXpJoRMc= @@ -77,10 +77,10 @@ github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0= github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= -github.com/googleapis/enterprise-certificate-proxy v0.3.11 h1:vAe81Msw+8tKUxi2Dqh/NZMz7475yUvmRIkXr4oN2ao= -github.com/googleapis/enterprise-certificate-proxy v0.3.11/go.mod h1:RFV7MUdlb7AgEq2v7FmMCfeSMCllAzWxFgRdusoGks8= -github.com/googleapis/gax-go/v2 v2.17.0 h1:RksgfBpxqff0EZkDWYuz9q/uWsTVz+kf43LsZ1J6SMc= -github.com/googleapis/gax-go/v2 v2.17.0/go.mod h1:mzaqghpQp4JDh3HvADwrat+6M3MOIDp5YKHhb9PAgDY= +github.com/googleapis/enterprise-certificate-proxy v0.3.14 h1:yh8ncqsbUY4shRD5dA6RlzjJaT4hi3kII+zYw8wmLb8= +github.com/googleapis/enterprise-certificate-proxy v0.3.14/go.mod h1:vqVt9yG9480NtzREnTlmGSBmFrA+bzb0yl0TxoBQXOg= +github.com/googleapis/gax-go/v2 v2.20.0 h1:NIKVuLhDlIV74muWlsMM4CcQZqN6JJ20Qcxd9YMuYcs= +github.com/googleapis/gax-go/v2 v2.20.0/go.mod h1:But/NJU6TnZsrLai/xBAQLLz+Hc7fHZJt/hsCz3Fih4= github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM= github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg= github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo= @@ -164,12 +164,12 @@ go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE= go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ= go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ= -golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts= -golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos= +golang.org/x/crypto v0.49.0 h1:+Ng2ULVvLHnJ/ZFEq4KdcDd/cfjrrjjNSXNzxg0Y4U4= +golang.org/x/crypto v0.49.0/go.mod h1:ErX4dUh2UM+CFYiXZRTcMpEcN8b/1gxEuv3nODoYtCA= golang.org/x/mod v0.34.0 h1:xIHgNUUnW6sYkcM5Jleh05DvLOtwc6RitGHbDk4akRI= golang.org/x/mod v0.34.0/go.mod h1:ykgH52iCZe79kzLLMhyCUzhMci+nQj+0XkbXpNYtVjY= -golang.org/x/net v0.51.0 h1:94R/GTO7mt3/4wIKpcR5gkGmRLOuE/2hNGeWq/GBIFo= -golang.org/x/net v0.51.0/go.mod h1:aamm+2QF5ogm02fjy5Bb7CQ0WMt1/WVM7FtyaTLlA9Y= +golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0= +golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw= golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4= @@ -177,20 +177,20 @@ golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo= golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= -golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk= -golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA= -golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI= -golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4= +golang.org/x/text v0.35.0 h1:JOVx6vVDFokkpaq1AEptVzLTpDe9KGpj5tR4/X+ybL8= +golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA= +golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U= +golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno= gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk= gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E= -google.golang.org/api v0.265.0 h1:FZvfUdI8nfmuNrE34aOWFPmLC+qRBEiNm3JdivTvAAU= -google.golang.org/api v0.265.0/go.mod h1:uAvfEl3SLUj/7n6k+lJutcswVojHPp2Sp08jWCu8hLY= -google.golang.org/genproto v0.0.0-20260128011058-8636f8732409 h1:VQZ/yAbAtjkHgH80teYd2em3xtIkkHd7ZhqfH2N9CsM= -google.golang.org/genproto v0.0.0-20260128011058-8636f8732409/go.mod h1:rxKD3IEILWEu3P44seeNOAwZN4SaoKaQ/2eTg4mM6EM= -google.golang.org/genproto/googleapis/api v0.0.0-20260203192932-546029d2fa20 h1:7ei4lp52gK1uSejlA8AZl5AJjeLUOHBQscRQZUgAcu0= -google.golang.org/genproto/googleapis/api v0.0.0-20260203192932-546029d2fa20/go.mod h1:ZdbssH/1SOVnjnDlXzxDHK2MCidiqXtbYccJNzNYPEE= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409 h1:H86B94AW+VfJWDqFeEbBPhEtHzJwJfTbgE2lZa54ZAQ= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409/go.mod h1:j9x/tPzZkyxcgEFkiKEEGxfvyumM01BEtsW8xzOahRQ= +google.golang.org/api v0.273.1 h1:L7G/TmpAMz0nKx/ciAVssVmWQiOF6+pOuXeKrWVsquY= +google.golang.org/api v0.273.1/go.mod h1:JbAt7mF+XVmWu6xNP8/+CTiGH30ofmCmk9nM8d8fHew= +google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 h1:XzmzkmB14QhVhgnawEVsOn6OFsnpyxNPRY9QV01dNB0= +google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7/go.mod h1:L43LFes82YgSonw6iTXTxXUX1OlULt4AQtkik4ULL/I= +google.golang.org/genproto/googleapis/api v0.0.0-20260401001100-f93e5f3e9f0f h1:K3zPU40OFjwD5YKADLMLoiL0L7JJpBgEdLqGuCNPfp0= +google.golang.org/genproto/googleapis/api v0.0.0-20260401001100-f93e5f3e9f0f/go.mod h1:EIQZ5bFCfRQDV4MhRle7+OgjNtZ6P1PiZBgAKuxXu/Y= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260319201613-d00831a3d3e7 h1:ndE4FoJqsIceKP2oYSnUZqhTdYufCYYkqwtFzfrhI7w= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260319201613-d00831a3d3e7/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= google.golang.org/grpc v1.79.3 h1:sybAEdRIEtvcD68Gx7dmnwjZKlyfuc61Dyo9pGXXkKE= google.golang.org/grpc v1.79.3/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ= google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE= From 607d52ff20028db1949e6d0298f59784e2294754 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 9 Apr 2026 14:20:12 -0400 Subject: [PATCH 149/313] build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 (#1114) Bumps [github.com/go-jose/go-jose/v4](https://github.com/go-jose/go-jose) from 4.1.3 to 4.1.4.
    Release notes

    Sourced from github.com/go-jose/go-jose/v4's releases.

    v4.1.4

    What's Changed

    Fixes Panic in JWE decryption. See https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8

    Full Changelog: https://github.com/go-jose/go-jose/compare/v4.1.3...v4.1.4

    Commits

    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Radoslav Dimitrov --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 49c7fd1..3271c24 100644 --- a/go.mod +++ b/go.mod @@ -44,7 +44,7 @@ require ( github.com/docker/cli v29.3.1+incompatible // indirect github.com/docker/docker-credential-helpers v0.9.3 // indirect github.com/felixge/httpsnoop v1.0.4 // indirect - github.com/go-jose/go-jose/v4 v4.1.3 // indirect + github.com/go-jose/go-jose/v4 v4.1.4 // indirect github.com/go-logr/logr v1.4.3 // indirect github.com/go-logr/stdr v1.2.2 // indirect github.com/google/s2a-go v0.1.9 // indirect diff --git a/go.sum b/go.sum index 56e727c..0d029ae 100644 --- a/go.sum +++ b/go.sum @@ -58,8 +58,8 @@ github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U= github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM= github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ= -github.com/go-jose/go-jose/v4 v4.1.3 h1:CVLmWDhDVRa6Mi/IgCgaopNosCaHz7zrMeF9MlZRkrs= -github.com/go-jose/go-jose/v4 v4.1.3/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08= +github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA= +github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08= github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= From 83f8ea7cffcf6870c1c223cce0a5c148ae6b9acc Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 9 Apr 2026 14:20:33 -0400 Subject: [PATCH 150/313] build(deps): bump go.opentelemetry.io/otel/sdk from 1.41.0 to 1.43.0 in /deploy (#1139) Bumps [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go) from 1.41.0 to 1.43.0.
    Changelog

    Sourced from go.opentelemetry.io/otel/sdk's changelog.

    [1.43.0/0.65.0/0.19.0] 2026-04-02

    Added

    • Add IsRandom and WithRandom on TraceFlags, and IsRandom on SpanContext in go.opentelemetry.io/otel/trace for W3C Trace Context Level 2 Random Trace ID Flag support. (#8012)
    • Add service detection with WithService in go.opentelemetry.io/otel/sdk/resource. (#7642)
    • Add DefaultWithContext and EnvironmentWithContext in go.opentelemetry.io/otel/sdk/resource to support plumbing context.Context through default and environment detectors. (#8051)
    • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc. (#8038)
    • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc. (#8038)
    • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc. (#8038)
    • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8038)
    • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp. (#8038)
    • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8038)
    • Support attributes with empty value (attribute.EMPTY) in go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest. (#8038)
    • Add support for per-series start time tracking for cumulative metrics in go.opentelemetry.io/otel/sdk/metric. Set OTEL_GO_X_PER_SERIES_START_TIMESTAMPS=true to enable. (#8060)
    • Add WithCardinalityLimitSelector for metric reader for configuring cardinality limits specific to the instrument kind. (#7855)

    Changed

    • Introduce the EMPTY Type in go.opentelemetry.io/otel/attribute to reflect that an empty value is now a valid value, with INVALID remaining as a deprecated alias of EMPTY. (#8038)
    • Improve slice handling in go.opentelemetry.io/otel/attribute to optimize short slice values with fixed-size fast paths. (#8039)
    • Improve performance of span metric recording in go.opentelemetry.io/otel/sdk/trace by returning early if self-observability is not enabled. (#8067)
    • Improve formatting of metric data diffs in go.opentelemetry.io/otel/sdk/metric/metricdata/metricdatatest. (#8073)

    Deprecated

    • Deprecate INVALID in go.opentelemetry.io/otel/attribute. Use EMPTY instead. (#8038)

    Fixed

    • Return spec-compliant TraceIdRatioBased description. This is a breaking behavioral change, but it is necessary to make the implementation spec-compliant. (#8027)
    • Fix a race condition in go.opentelemetry.io/otel/sdk/metric where the lastvalue aggregation could collect the value 0 even when no zero-value measurements were recorded. (#8056)
    • Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp to mitigate excessive memory usage caused by a misconfigured or malicious server. Responses exceeding the limit are treated as non-retryable errors. (#8108)
    • Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp to mitigate excessive memory usage caused by a misconfigured or malicious server. Responses exceeding the limit are treated as non-retryable errors. (#8108)
    • Limit HTTP response body to 4 MiB in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to mitigate excessive memory usage caused by a misconfigured or malicious server. Responses exceeding the limit are treated as non-retryable errors. (#8108)
    • WithHostID detector in go.opentelemetry.io/otel/sdk/resource to use full path for kenv command on BSD. (#8113)
    • Fix missing request.GetBody in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp to correctly handle HTTP2 GOAWAY frame. (#8096)

    [1.42.0/0.64.0/0.18.0/0.0.16] 2026-03-06

    Added

    • Add go.opentelemetry.io/otel/semconv/v1.40.0 package. The package contains semantic conventions from the v1.40.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.39.0. (#7985)

    ... (truncated)

    Commits
    • 9276201 Release v1.43.0 / v0.65.0 / v0.19.0 (#8128)
    • 61b8c94 chore(deps): update module github.com/mattn/go-runewidth to v0.0.22 (#8131)
    • 97a086e chore(deps): update github.com/golangci/dupl digest to c99c5cf (#8122)
    • 5e363de limit response body size for OTLP HTTP exporters (#8108)
    • 35214b6 Use an absolute path when calling bsd kenv (#8113)
    • 290024c fix(deps): update module google.golang.org/grpc to v1.80.0 (#8121)
    • e70658e fix: support getBody in otelploghttp (#8096)
    • 4afe468 fix(deps): update googleapis to 9d38bb4 (#8117)
    • b9ca729 chore(deps): update module github.com/go-git/go-git/v5 to v5.17.2 (#8115)
    • 69472ec chore(deps): update fossas/fossa-action action to v1.9.0 (#8118)
    • Additional commits viewable in compare view

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=go.opentelemetry.io/otel/sdk&package-manager=go_modules&previous-version=1.41.0&new-version=1.43.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/modelcontextprotocol/registry/network/alerts).
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Radoslav Dimitrov --- deploy/go.mod | 10 +++++----- deploy/go.sum | 24 ++++++++++++------------ 2 files changed, 17 insertions(+), 17 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index 8edac31..860894b 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -93,12 +93,12 @@ require ( go.opentelemetry.io/auto/sdk v1.2.1 // indirect go.opentelemetry.io/collector/featuregate v1.53.0 // indirect go.opentelemetry.io/collector/pdata v1.53.0 // indirect - go.opentelemetry.io/otel v1.41.0 // indirect + go.opentelemetry.io/otel v1.43.0 // indirect go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.41.0 // indirect go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.41.0 // indirect - go.opentelemetry.io/otel/metric v1.41.0 // indirect - go.opentelemetry.io/otel/sdk v1.41.0 // indirect - go.opentelemetry.io/otel/trace v1.41.0 // indirect + go.opentelemetry.io/otel/metric v1.43.0 // indirect + go.opentelemetry.io/otel/sdk v1.43.0 // indirect + go.opentelemetry.io/otel/trace v1.43.0 // indirect go.opentelemetry.io/proto/otlp v1.9.0 // indirect go.uber.org/atomic v1.11.0 // indirect go.uber.org/multierr v1.11.0 // indirect @@ -107,7 +107,7 @@ require ( golang.org/x/mod v0.32.0 // indirect golang.org/x/net v0.51.0 // indirect golang.org/x/sync v0.19.0 // indirect - golang.org/x/sys v0.41.0 // indirect + golang.org/x/sys v0.42.0 // indirect golang.org/x/term v0.40.0 // indirect golang.org/x/text v0.34.0 // indirect golang.org/x/tools v0.41.0 // indirect diff --git a/deploy/go.sum b/deploy/go.sum index be56fb7..083fbf9 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -237,20 +237,20 @@ go.opentelemetry.io/collector/internal/testutil v0.147.0 h1:DFlRxBRp23/sZnpTITK2 go.opentelemetry.io/collector/internal/testutil v0.147.0/go.mod h1:Jkjs6rkqs973LqgZ0Fe3zrokQRKULYXPIf4HuqStiEE= go.opentelemetry.io/collector/pdata v1.53.0 h1:DlYDbRwammEZaxDZHINx5v0n8SEOVNniPbi6FRTlVkA= go.opentelemetry.io/collector/pdata v1.53.0/go.mod h1:LRSYGNjKXaUrZEwZv3Yl+8/zV2HmRGKXW62zB2bysms= -go.opentelemetry.io/otel v1.41.0 h1:YlEwVsGAlCvczDILpUXpIpPSL/VPugt7zHThEMLce1c= -go.opentelemetry.io/otel v1.41.0/go.mod h1:Yt4UwgEKeT05QbLwbyHXEwhnjxNO6D8L5PQP51/46dE= +go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I= +go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0= go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.41.0 h1:ao6Oe+wSebTlQ1OEht7jlYTzQKE+pnx/iNywFvTbuuI= go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.41.0/go.mod h1:u3T6vz0gh/NVzgDgiwkgLxpsSF6PaPmo2il0apGJbls= go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.41.0 h1:mq/Qcf28TWz719lE3/hMB4KkyDuLJIvgJnFGcd0kEUI= go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.41.0/go.mod h1:yk5LXEYhsL2htyDNJbEq7fWzNEigeEdV5xBF/Y+kAv0= -go.opentelemetry.io/otel/metric v1.41.0 h1:rFnDcs4gRzBcsO9tS8LCpgR0dxg4aaxWlJxCno7JlTQ= -go.opentelemetry.io/otel/metric v1.41.0/go.mod h1:xPvCwd9pU0VN8tPZYzDZV/BMj9CM9vs00GuBjeKhJps= -go.opentelemetry.io/otel/sdk v1.41.0 h1:YPIEXKmiAwkGl3Gu1huk1aYWwtpRLeskpV+wPisxBp8= -go.opentelemetry.io/otel/sdk v1.41.0/go.mod h1:ahFdU0G5y8IxglBf0QBJXgSe7agzjE4GiTJ6HT9ud90= -go.opentelemetry.io/otel/sdk/metric v1.41.0 h1:siZQIYBAUd1rlIWQT2uCxWJxcCO7q3TriaMlf08rXw8= -go.opentelemetry.io/otel/sdk/metric v1.41.0/go.mod h1:HNBuSvT7ROaGtGI50ArdRLUnvRTRGniSUZbxiWxSO8Y= -go.opentelemetry.io/otel/trace v1.41.0 h1:Vbk2co6bhj8L59ZJ6/xFTskY+tGAbOnCtQGVVa9TIN0= -go.opentelemetry.io/otel/trace v1.41.0/go.mod h1:U1NU4ULCoxeDKc09yCWdWe+3QoyweJcISEVa1RBzOis= +go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM= +go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY= +go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg= +go.opentelemetry.io/otel/sdk v1.43.0/go.mod h1:P+IkVU3iWukmiit/Yf9AWvpyRDlUeBaRg6Y+C58QHzg= +go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw= +go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A= +go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A= +go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0= go.opentelemetry.io/proto/otlp v1.9.0 h1:l706jCMITVouPOqEnii2fIAuO3IVGBRPV5ICjceRb/A= go.opentelemetry.io/proto/otlp v1.9.0/go.mod h1:xE+Cx5E/eEHw+ISFkwPLwCZefwVjY+pqKg1qcK03+/4= go.opentelemetry.io/proto/slim/otlp v1.9.0 h1:fPVMv8tP3TrsqlkH1HWYUpbCY9cAIemx184VGkS6vlE= @@ -307,8 +307,8 @@ golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBc golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k= -golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= +golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo= +golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.40.0 h1:36e4zGLqU4yhjlmxEaagx2KuYbJq3EwY8K943ZsHcvg= golang.org/x/term v0.40.0/go.mod h1:w2P8uVp06p2iyKKuvXIm7N/y0UCRt3UfJTfZ7oOpglM= From fbea08a3480c18fd350ac2bc5c1648250dfecd78 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 9 Apr 2026 14:20:55 -0400 Subject: [PATCH 151/313] build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.229.0 to 3.230.0 in /deploy (#1141) Bumps [github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from 3.229.0 to 3.230.0.
    Release notes

    Sourced from github.com/pulumi/pulumi/sdk/v3's releases.

    v3.230.0

    3.230.0 (2026-04-08)

    Features

    • [cli] Detect AI agents and send in update metadata #22497

    • [auto/nodejs] Add "org" commands (get-default, set-default, search, search ai) to the auto-generated interface #22395

    • [auto/nodejs] Add "new" command to the auto-generated interface #22421

    • [sdk/{nodejs,python}] Add Cancel handler to Python & Node.js providers #22516

    • [cli/policy] Add ESC environment resolution for policy packs #22425

    Bug Fixes

    • [auto/go] Insert --non-interactive flag before "--" positional separator to avoid misinterpretation as a positional argument #22462

    • [ci] Add code coverage collection for Node.js automation tools tests #22412

    • [pcl] Allow key indexing into a map of resources created by range #22498

    • [programgen/go] Fix an issue with formatted index modules not importing correctly

    • [cli/state] Check for Pulumi.yaml projects and backend option in state upgrade #22483

    • [sdk/go] Fix Go program generation for ternary expressions inside apply callbacks, add Go predeclared identifiers to reserved words, handle optional list types in union type codegen, and fix unmarshalOutput for known outputs with null elements. #22460

    • [sdk/nodejs] Fix inherited input properties missing from component schema when args interface extends another interface #22446

    • [sdk/python] Fix inherited input properties missing from component schema when args class inherits from a base class #22484

    Miscellaneous

    ... (truncated)

    Changelog

    Sourced from github.com/pulumi/pulumi/sdk/v3's changelog.

    Changelog

    Commits

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/pulumi/pulumi/sdk/v3&package-manager=go_modules&previous-version=3.229.0&new-version=3.230.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Radoslav Dimitrov --- deploy/go.mod | 6 +++--- deploy/go.sum | 16 ++++++++-------- 2 files changed, 11 insertions(+), 11 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index 860894b..07de0a8 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -5,7 +5,7 @@ go 1.26 require ( github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.28.0 - github.com/pulumi/pulumi/sdk/v3 v3.229.0 + github.com/pulumi/pulumi/sdk/v3 v3.230.0 gopkg.in/yaml.v2 v2.4.0 ) @@ -38,7 +38,7 @@ require ( github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect github.com/go-git/go-billy/v5 v5.8.0 // indirect - github.com/go-git/go-git/v5 v5.17.1 // indirect + github.com/go-git/go-git/v5 v5.17.2 // indirect github.com/go-logr/logr v1.4.3 // indirect github.com/go-logr/stdr v1.2.2 // indirect github.com/gogo/protobuf v1.3.2 // indirect @@ -113,7 +113,7 @@ require ( golang.org/x/tools v0.41.0 // indirect google.golang.org/genproto/googleapis/api v0.0.0-20260226221140-a57be14db171 // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 // indirect - google.golang.org/grpc v1.79.3 // indirect + google.golang.org/grpc v1.80.0 // indirect google.golang.org/protobuf v1.36.11 // indirect gopkg.in/warnings.v0 v0.1.2 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect diff --git a/deploy/go.sum b/deploy/go.sum index 083fbf9..418aa21 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -74,8 +74,8 @@ github.com/go-git/go-billy/v5 v5.8.0 h1:I8hjc3LbBlXTtVuFNJuwYuMiHvQJDq1AT6u4DwDz github.com/go-git/go-billy/v5 v5.8.0/go.mod h1:RpvI/rw4Vr5QA+Z60c6d6LXH0rYJo0uD5SqfmrrheCY= github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4= github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII= -github.com/go-git/go-git/v5 v5.17.1 h1:WnljyxIzSj9BRRUlnmAU35ohDsjRK0EKmL0evDqi5Jk= -github.com/go-git/go-git/v5 v5.17.1/go.mod h1:pW/VmeqkanRFqR6AljLcs7EA7FbZaN5MQqO7oZADXpo= +github.com/go-git/go-git/v5 v5.17.2 h1:B+nkdlxdYrvyFK4GPXVU8w1U+YkbsgciIR7f2sZJ104= +github.com/go-git/go-git/v5 v5.17.2/go.mod h1:pW/VmeqkanRFqR6AljLcs7EA7FbZaN5MQqO7oZADXpo= github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= @@ -185,8 +185,8 @@ github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 h1:w6OnO3d4j5yVf2vpm8OzXFC/xHOEGqt+9 github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1/go.mod h1:UyZyv7hz4knpFx6/Sh+SkZe6hT6sJHtDvw9A0TbvEsk= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.28.0 h1:muCE6cUJ4YmAaNLiOhbjEicxT+10i/EGsZrx2ZZQQ+o= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.28.0/go.mod h1:B998wofejDKAvvpLwsi4UMfWDFHHBnzYiM8mZ9e7OSo= -github.com/pulumi/pulumi/sdk/v3 v3.229.0 h1:jsAw5lXiHN22YQeo4bZHZBAG/DUlEnzsFWg5MuHnTSs= -github.com/pulumi/pulumi/sdk/v3 v3.229.0/go.mod h1:PAqB2+8gnxqk+QrFdXL3fSjsLIjtlBIcy5KLZ//4WSk= +github.com/pulumi/pulumi/sdk/v3 v3.230.0 h1:0TtF82Hlor39DLU0QtM7RZPwRaOmjn5UtQKPi1Mxo9M= +github.com/pulumi/pulumi/sdk/v3 v3.230.0/go.mod h1:u0fgmmPGwV5b4rmfuNABuYfRoqckuaTivufPn4EtfTk= github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ= github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88= github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ= @@ -329,14 +329,14 @@ golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8T golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= -gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk= -gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E= +gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4= +gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E= google.golang.org/genproto/googleapis/api v0.0.0-20260226221140-a57be14db171 h1:tu/dtnW1o3wfaxCOjSLn5IRX4YDcJrtlpzYkhHhGaC4= google.golang.org/genproto/googleapis/api v0.0.0-20260226221140-a57be14db171/go.mod h1:M5krXqk4GhBKvB596udGL3UyjL4I1+cTbK0orROM9ng= google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 h1:ggcbiqK8WWh6l1dnltU4BgWGIGo+EVYxCaAPih/zQXQ= google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= -google.golang.org/grpc v1.79.3 h1:sybAEdRIEtvcD68Gx7dmnwjZKlyfuc61Dyo9pGXXkKE= -google.golang.org/grpc v1.79.3/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ= +google.golang.org/grpc v1.80.0 h1:Xr6m2WmWZLETvUNvIUmeD5OAagMw3FiKmMlTdViWsHM= +google.golang.org/grpc v1.80.0/go.mod h1:ho/dLnxwi3EDJA4Zghp7k2Ec1+c2jqup0bFkw07bwF4= google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE= google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= From 07fa85f68b4d23407e9807721ec113b87990f806 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 9 Apr 2026 18:16:23 -0400 Subject: [PATCH 152/313] build(deps): bump github.com/coreos/go-oidc/v3 from 3.17.0 to 3.18.0 (#1140) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [github.com/coreos/go-oidc/v3](https://github.com/coreos/go-oidc) from 3.17.0 to 3.18.0.
    Release notes

    Sourced from github.com/coreos/go-oidc/v3's releases.

    v3.18.0

    What's Changed

    Full Changelog: https://github.com/coreos/go-oidc/compare/v3.17.0...v3.18.0

    Commits
    • da6b3bf build(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4
    • 7f80694 build(deps): bump golang.org/x/oauth2 from 0.28.0 to 0.36.0
    • 7271de5 .github: update go versions in CI
    • 3ccf20f .github: configure dependabot
    • See full diff in compare view

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/coreos/go-oidc/v3&package-manager=go_modules&previous-version=3.17.0&new-version=3.18.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Radoslav Dimitrov --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 3271c24..8619022 100644 --- a/go.mod +++ b/go.mod @@ -7,7 +7,7 @@ require ( github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.4.0 github.com/caarlos0/env/v11 v11.4.0 - github.com/coreos/go-oidc/v3 v3.17.0 + github.com/coreos/go-oidc/v3 v3.18.0 github.com/danielgtaylor/huma/v2 v2.37.3 github.com/golang-jwt/jwt/v5 v5.3.1 github.com/google/go-containerregistry v0.21.4 diff --git a/go.sum b/go.sum index 0d029ae..71781bb 100644 --- a/go.sum +++ b/go.sum @@ -38,8 +38,8 @@ github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5 h1:6xNmx7iTtyBRev0+D/T github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5/go.mod h1:KdCmV+x/BuvyMxRnYBlmVaq4OLiKW6iRQfvC62cvdkI= github.com/containerd/stargz-snapshotter/estargz v0.18.2 h1:yXkZFYIzz3eoLwlTUZKz2iQ4MrckBxJjkmD16ynUTrw= github.com/containerd/stargz-snapshotter/estargz v0.18.2/go.mod h1:XyVU5tcJ3PRpkA9XS2T5us6Eg35yM0214Y+wvrZTBrY= -github.com/coreos/go-oidc/v3 v3.17.0 h1:hWBGaQfbi0iVviX4ibC7bk8OKT5qNr4klBaCHVNvehc= -github.com/coreos/go-oidc/v3 v3.17.0/go.mod h1:wqPbKFrVnE90vty060SB40FCJ8fTHTxSwyXJqZH+sI8= +github.com/coreos/go-oidc/v3 v3.18.0 h1:V9orjXynvu5wiC9SemFTWnG4F45v403aIcjWo0d41+A= +github.com/coreos/go-oidc/v3 v3.18.0/go.mod h1:DYCf24+ncYi+XkIH97GY1+dqoRlbaSI26KVTCI9SrY4= github.com/danielgtaylor/huma/v2 v2.37.3 h1:6Av0Vj45Vk5lDxRVfoO2iPlEdvCvwLc7pl5nbqGOkYM= github.com/danielgtaylor/huma/v2 v2.37.3/go.mod h1:OeHHtCEAaNiuVbAVdYu4IQ0UOmnb4x3yMUOShNlZ53g= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= From 1e83267610c9b6e17f8f5ecf055b060b24813207 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 14 Apr 2026 05:19:09 -0400 Subject: [PATCH 153/313] build(deps): bump cloud.google.com/go/kms from 1.27.0 to 1.29.0 (#1163) --- go.mod | 16 ++++++++-------- go.sum | 36 ++++++++++++++++++------------------ 2 files changed, 26 insertions(+), 26 deletions(-) diff --git a/go.mod b/go.mod index 8619022..21bab95 100644 --- a/go.mod +++ b/go.mod @@ -3,7 +3,7 @@ module github.com/modelcontextprotocol/registry go 1.26 require ( - cloud.google.com/go/kms v1.27.0 + cloud.google.com/go/kms v1.29.0 github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.4.0 github.com/caarlos0/env/v11 v11.4.0 @@ -31,8 +31,8 @@ require ( cloud.google.com/go/auth v0.18.2 // indirect cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect cloud.google.com/go/compute/metadata v0.9.0 // indirect - cloud.google.com/go/iam v1.6.0 // indirect - cloud.google.com/go/longrunning v0.8.0 // indirect + cloud.google.com/go/iam v1.7.0 // indirect + cloud.google.com/go/longrunning v0.9.0 // indirect github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0 // indirect github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 // indirect github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0 // indirect @@ -50,7 +50,7 @@ require ( github.com/google/s2a-go v0.1.9 // indirect github.com/google/uuid v1.6.0 // indirect github.com/googleapis/enterprise-certificate-proxy v0.3.14 // indirect - github.com/googleapis/gax-go/v2 v2.20.0 // indirect + github.com/googleapis/gax-go/v2 v2.21.0 // indirect github.com/jackc/pgpassfile v1.0.0 // indirect github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect github.com/jackc/puddle/v2 v2.2.2 // indirect @@ -80,11 +80,11 @@ require ( golang.org/x/sys v0.42.0 // indirect golang.org/x/text v0.35.0 // indirect golang.org/x/time v0.15.0 // indirect - google.golang.org/api v0.273.1 // indirect + google.golang.org/api v0.274.0 // indirect google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 // indirect - google.golang.org/genproto/googleapis/api v0.0.0-20260401001100-f93e5f3e9f0f // indirect - google.golang.org/genproto/googleapis/rpc v0.0.0-20260319201613-d00831a3d3e7 // indirect - google.golang.org/grpc v1.79.3 // indirect + google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20260401001100-f93e5f3e9f0f // indirect + google.golang.org/grpc v1.80.0 // indirect google.golang.org/protobuf v1.36.11 // indirect gotest.tools/v3 v3.5.2 // indirect ) diff --git a/go.sum b/go.sum index 71781bb..d4ce0a3 100644 --- a/go.sum +++ b/go.sum @@ -6,12 +6,12 @@ cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIi cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c= cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs= cloud.google.com/go/compute/metadata v0.9.0/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10= -cloud.google.com/go/iam v1.6.0 h1:JiSIcEi38dWBKhB3BtfKCW+dMvCZJEhBA2BsaGJgoxs= -cloud.google.com/go/iam v1.6.0/go.mod h1:ZS6zEy7QHmcNO18mjO2viYv/n+wOUkhJqGNkPPGueGU= -cloud.google.com/go/kms v1.27.0 h1:iYYgoD0HJIqz35A+He1G0dS5qTQzQsDXFsyXwzkUCXM= -cloud.google.com/go/kms v1.27.0/go.mod h1:KPxrdf61iYEOZ86uPwR86muBpSik2y4Ion6e83fVl1Q= -cloud.google.com/go/longrunning v0.8.0 h1:LiKK77J3bx5gDLi4SMViHixjD2ohlkwBi+mKA7EhfW8= -cloud.google.com/go/longrunning v0.8.0/go.mod h1:UmErU2Onzi+fKDg2gR7dusz11Pe26aknR4kHmJJqIfk= +cloud.google.com/go/iam v1.7.0 h1:JD3zh0C6LHl16aCn5Akff0+GELdp1+4hmh6ndoFLl8U= +cloud.google.com/go/iam v1.7.0/go.mod h1:tetWZW1PD/m6vcuY2Zj/aU0eCHNPuxedbnbRTyKXvdY= +cloud.google.com/go/kms v1.29.0 h1:bAW1C5FQf+6GhPkywQzPlsULALCG7c16qpXLFGV9ivY= +cloud.google.com/go/kms v1.29.0/go.mod h1:YIyXZym11R5uovJJt4oN5eUL3oPmirF3yKeIh6QAf4U= +cloud.google.com/go/longrunning v0.9.0 h1:0EzbDEGsAvOZNbqXopgniY0w0a1phvu5IdUFq8grmqY= +cloud.google.com/go/longrunning v0.9.0/go.mod h1:pkTz846W7bF4o2SzdWJ40Hu0Re+UoNT6Q5t+igIcb8E= github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0 h1:JXg2dwJUmPB9JmtVmdEB16APJ7jurfbY5jnfXpJoRMc= github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0/go.mod h1:YD5h/ldMsG0XiIw7PdyNhLxaM317eFh5yNLccNfGdyw= github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 h1:Hk5QBxZQC1jb2Fwj6mpzme37xbCDdNTxU7O9eb5+LB4= @@ -79,8 +79,8 @@ github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= github.com/googleapis/enterprise-certificate-proxy v0.3.14 h1:yh8ncqsbUY4shRD5dA6RlzjJaT4hi3kII+zYw8wmLb8= github.com/googleapis/enterprise-certificate-proxy v0.3.14/go.mod h1:vqVt9yG9480NtzREnTlmGSBmFrA+bzb0yl0TxoBQXOg= -github.com/googleapis/gax-go/v2 v2.20.0 h1:NIKVuLhDlIV74muWlsMM4CcQZqN6JJ20Qcxd9YMuYcs= -github.com/googleapis/gax-go/v2 v2.20.0/go.mod h1:But/NJU6TnZsrLai/xBAQLLz+Hc7fHZJt/hsCz3Fih4= +github.com/googleapis/gax-go/v2 v2.21.0 h1:h45NjjzEO3faG9Lg/cFrBh2PgegVVgzqKzuZl/wMbiI= +github.com/googleapis/gax-go/v2 v2.21.0/go.mod h1:But/NJU6TnZsrLai/xBAQLLz+Hc7fHZJt/hsCz3Fih4= github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM= github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg= github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo= @@ -181,18 +181,18 @@ golang.org/x/text v0.35.0 h1:JOVx6vVDFokkpaq1AEptVzLTpDe9KGpj5tR4/X+ybL8= golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA= golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U= golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno= -gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk= -gonum.org/v1/gonum v0.16.0/go.mod h1:fef3am4MQ93R2HHpKnLk4/Tbh/s0+wqD5nfa6Pnwy4E= -google.golang.org/api v0.273.1 h1:L7G/TmpAMz0nKx/ciAVssVmWQiOF6+pOuXeKrWVsquY= -google.golang.org/api v0.273.1/go.mod h1:JbAt7mF+XVmWu6xNP8/+CTiGH30ofmCmk9nM8d8fHew= +gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4= +gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E= +google.golang.org/api v0.274.0 h1:aYhycS5QQCwxHLwfEHRRLf9yNsfvp1JadKKWBE54RFA= +google.golang.org/api v0.274.0/go.mod h1:JbAt7mF+XVmWu6xNP8/+CTiGH30ofmCmk9nM8d8fHew= google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 h1:XzmzkmB14QhVhgnawEVsOn6OFsnpyxNPRY9QV01dNB0= google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7/go.mod h1:L43LFes82YgSonw6iTXTxXUX1OlULt4AQtkik4ULL/I= -google.golang.org/genproto/googleapis/api v0.0.0-20260401001100-f93e5f3e9f0f h1:K3zPU40OFjwD5YKADLMLoiL0L7JJpBgEdLqGuCNPfp0= -google.golang.org/genproto/googleapis/api v0.0.0-20260401001100-f93e5f3e9f0f/go.mod h1:EIQZ5bFCfRQDV4MhRle7+OgjNtZ6P1PiZBgAKuxXu/Y= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260319201613-d00831a3d3e7 h1:ndE4FoJqsIceKP2oYSnUZqhTdYufCYYkqwtFzfrhI7w= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260319201613-d00831a3d3e7/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= -google.golang.org/grpc v1.79.3 h1:sybAEdRIEtvcD68Gx7dmnwjZKlyfuc61Dyo9pGXXkKE= -google.golang.org/grpc v1.79.3/go.mod h1:KmT0Kjez+0dde/v2j9vzwoAScgEPx/Bw1CYChhHLrHQ= +google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 h1:VPWxll4HlMw1Vs/qXtN7BvhZqsS9cdAittCNvVENElA= +google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9/go.mod h1:7QBABkRtR8z+TEnmXTqIqwJLlzrZKVfAUm7tY3yGv0M= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260401001100-f93e5f3e9f0f h1:Rka45QInERYknkHYfJEPBQaoobXl+YpxTMjAKgWUq2A= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260401001100-f93e5f3e9f0f/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= +google.golang.org/grpc v1.80.0 h1:Xr6m2WmWZLETvUNvIUmeD5OAagMw3FiKmMlTdViWsHM= +google.golang.org/grpc v1.80.0/go.mod h1:ho/dLnxwi3EDJA4Zghp7k2Ec1+c2jqup0bFkw07bwF4= google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE= google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= From 0c5dde243bf6b780be05fb6c0bb09e1df61008a9 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 14 Apr 2026 05:19:36 -0400 Subject: [PATCH 154/313] build(deps): bump github.com/google/go-containerregistry from 0.21.4 to 0.21.5 (#1162) --- go.mod | 8 ++++---- go.sum | 16 ++++++++-------- 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/go.mod b/go.mod index 21bab95..dccf238 100644 --- a/go.mod +++ b/go.mod @@ -10,7 +10,7 @@ require ( github.com/coreos/go-oidc/v3 v3.18.0 github.com/danielgtaylor/huma/v2 v2.37.3 github.com/golang-jwt/jwt/v5 v5.3.1 - github.com/google/go-containerregistry v0.21.4 + github.com/google/go-containerregistry v0.21.5 github.com/jackc/pgx/v5 v5.9.1 github.com/prometheus/client_golang v1.23.2 github.com/rs/cors v1.11.1 @@ -22,7 +22,7 @@ require ( go.opentelemetry.io/otel/metric v1.43.0 go.opentelemetry.io/otel/sdk v1.43.0 go.opentelemetry.io/otel/sdk/metric v1.43.0 - golang.org/x/mod v0.34.0 + golang.org/x/mod v0.35.0 gopkg.in/yaml.v3 v3.0.1 ) @@ -41,7 +41,7 @@ require ( github.com/cespare/xxhash/v2 v2.3.0 // indirect github.com/containerd/stargz-snapshotter/estargz v0.18.2 // indirect github.com/davecgh/go-spew v1.1.1 // indirect - github.com/docker/cli v29.3.1+incompatible // indirect + github.com/docker/cli v29.4.0+incompatible // indirect github.com/docker/docker-credential-helpers v0.9.3 // indirect github.com/felixge/httpsnoop v1.0.4 // indirect github.com/go-jose/go-jose/v4 v4.1.4 // indirect @@ -77,7 +77,7 @@ require ( golang.org/x/net v0.52.0 // indirect golang.org/x/oauth2 v0.36.0 // indirect golang.org/x/sync v0.20.0 // indirect - golang.org/x/sys v0.42.0 // indirect + golang.org/x/sys v0.43.0 // indirect golang.org/x/text v0.35.0 // indirect golang.org/x/time v0.15.0 // indirect google.golang.org/api v0.274.0 // indirect diff --git a/go.sum b/go.sum index d4ce0a3..0a61c79 100644 --- a/go.sum +++ b/go.sum @@ -45,8 +45,8 @@ github.com/danielgtaylor/huma/v2 v2.37.3/go.mod h1:OeHHtCEAaNiuVbAVdYu4IQ0UOmnb4 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= -github.com/docker/cli v29.3.1+incompatible h1:M04FDj2TRehDacrosh7Vlkgc7AuQoWloQkf1PA5hmoI= -github.com/docker/cli v29.3.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= +github.com/docker/cli v29.4.0+incompatible h1:+IjXULMetlvWJiuSI0Nbor36lcJ5BTcVpUmB21KBoVM= +github.com/docker/cli v29.4.0+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= github.com/docker/docker-credential-helpers v0.9.3 h1:gAm/VtF9wgqJMoxzT3Gj5p4AqIjCBS4wrsOh9yRqcz8= github.com/docker/docker-credential-helpers v0.9.3/go.mod h1:x+4Gbw9aGmChi3qTLZj8Dfn0TD20M/fuWy0E5+WDeCo= github.com/envoyproxy/go-control-plane v0.14.0 h1:hbG2kr4RuFj222B6+7T83thSPqLjwBIfQawTkC++2HA= @@ -71,8 +71,8 @@ github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps= github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= -github.com/google/go-containerregistry v0.21.4 h1:VrhlIQtdhE6riZW//MjPrcJ1snAjPoCCpPHqGOygrv8= -github.com/google/go-containerregistry v0.21.4/go.mod h1:kxgc23zQ2qMY/hAKt0wCbB/7tkeovAP2mE2ienynJUw= +github.com/google/go-containerregistry v0.21.5 h1:KTJG9Pn/jC0VdZR6ctV3/jcN+q6/Iqlx0sTVz3ywZlM= +github.com/google/go-containerregistry v0.21.5/go.mod h1:ySvMuiWg+dOsRW0Hw8GYwfMwBlNRTmpYBFJPlkco5zU= github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0= github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= @@ -166,8 +166,8 @@ go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ= go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ= golang.org/x/crypto v0.49.0 h1:+Ng2ULVvLHnJ/ZFEq4KdcDd/cfjrrjjNSXNzxg0Y4U4= golang.org/x/crypto v0.49.0/go.mod h1:ErX4dUh2UM+CFYiXZRTcMpEcN8b/1gxEuv3nODoYtCA= -golang.org/x/mod v0.34.0 h1:xIHgNUUnW6sYkcM5Jleh05DvLOtwc6RitGHbDk4akRI= -golang.org/x/mod v0.34.0/go.mod h1:ykgH52iCZe79kzLLMhyCUzhMci+nQj+0XkbXpNYtVjY= +golang.org/x/mod v0.35.0 h1:Ww1D637e6Pg+Zb2KrWfHQUnH2dQRLBQyAtpr/haaJeM= +golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU= golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0= golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw= golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= @@ -175,8 +175,8 @@ golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7 golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4= golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo= -golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= +golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI= +golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= golang.org/x/text v0.35.0 h1:JOVx6vVDFokkpaq1AEptVzLTpDe9KGpj5tR4/X+ybL8= golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA= golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U= From 77bbd41fd37b824bb64a5c1bfe9cf49a3b7cd400 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 14 Apr 2026 05:20:05 -0400 Subject: [PATCH 155/313] build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 in the actions group (#1154) --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e24af7a..e0dbb93 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -63,7 +63,7 @@ jobs: run: make test-all - name: Upload coverage artifacts - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a with: name: coverage-report path: | From 90baa0528f75b01f8b5966c6cf1913484290087d Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Wed, 15 Apr 2026 03:23:07 -0400 Subject: [PATCH 156/313] fix: store tokens in ~/.config/mcp-publisher/ instead of cwd (#1166) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary Fixes #663 - **Security fix**: `mcp-publisher login` no longer writes `.mcpregistry_github_token` and `.mcpregistry_registry_token` to the current working directory. GitHub tokens are kept in memory during the login→exchange flow and cleared immediately after. - **Token location**: Unified token moved from `~/.mcp_publisher_token` to `~/.config/mcp-publisher/token.json` (dir 0700, file 0600), following the convention used by `gh`, `docker`, and `kubectl`. - **Dead code removed**: `NeedsLogin()` was on the `Provider` interface but never called — removed from interface and all 4 implementations. `forceLogin` field also removed. - **Auth tests added**: 11 new tests for `GitHubATProvider` (package previously had 0 tests). - **Test isolation**: `SetupTestToken` now uses `t.TempDir()` + `t.Setenv("HOME", ...)` instead of writing to real `$HOME`. ### Breaking change Users must re-login after upgrading (`mcp-publisher login `). Existing tokens at `~/.mcp_publisher_token` are not auto-migrated. `logout` cleans up both old and new locations. ## Test plan - [x] `make check` passes (lint, unit tests, integration tests) - [x] `mcp-publisher login none` stores token at `~/.config/mcp-publisher/token.json` - [x] No `.mcpregistry_*` files created in cwd after login (with `--token`, `MCP_GITHUB_TOKEN`, or device flow) - [x] `mcp-publisher publish` reads token from new location - [x] `mcp-publisher validate` reads registry URL from new location - [x] `mcp-publisher logout` cleans up new location, legacy `~/.mcp_publisher_token`, and cwd `.mcpregistry_*` files - [x] `mcp-publisher logout` when not logged in shows "Not logged in" - [x] File permissions: dir 0700, file 0600 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.6 (1M context) --- cmd/publisher/auth/common.go | 5 - cmd/publisher/auth/github-at.go | 129 ++------------- cmd/publisher/auth/github-oidc.go | 6 - cmd/publisher/auth/github_at_test.go | 203 ++++++++++++++++++++++++ cmd/publisher/auth/interface.go | 4 - cmd/publisher/auth/none.go | 4 - cmd/publisher/commands/login.go | 55 +++++-- cmd/publisher/commands/login_test.go | 97 +++++++++++ cmd/publisher/commands/logout.go | 48 ++++-- cmd/publisher/commands/logout_test.go | 123 ++++++++++++++ cmd/publisher/commands/publish.go | 9 +- cmd/publisher/commands/status.go | 8 +- cmd/publisher/commands/testutil_test.go | 18 +-- cmd/publisher/commands/validate.go | 19 +-- complete.md | 11 +- docs/reference/cli/commands.md | 11 +- tests/integration/main.go | 11 +- 17 files changed, 557 insertions(+), 204 deletions(-) create mode 100644 cmd/publisher/auth/github_at_test.go create mode 100644 cmd/publisher/commands/login_test.go create mode 100644 cmd/publisher/commands/logout_test.go diff --git a/cmd/publisher/auth/common.go b/cmd/publisher/auth/common.go index 28829e8..053b543 100644 --- a/cmd/publisher/auth/common.go +++ b/cmd/publisher/auth/common.go @@ -171,11 +171,6 @@ func parseRawPrivateKey(curve elliptic.Curve, privateKeyBytes []byte) (*ecdsa.Pr }, nil } -// NeedsLogin always returns false for cryptographic auth since no interactive login is needed -func (c *CryptoProvider) NeedsLogin() bool { - return false -} - // Login is not needed for cryptographic auth since authentication is cryptographic func (c *CryptoProvider) Login(_ context.Context) error { return nil diff --git a/cmd/publisher/auth/github-at.go b/cmd/publisher/auth/github-at.go index 602e116..3e53529 100644 --- a/cmd/publisher/auth/github-at.go +++ b/cmd/publisher/auth/github-at.go @@ -12,8 +12,6 @@ import ( ) const ( - gitHubTokenFilePath = ".mcpregistry_github_token" // #nosec:G101 - registryTokenFilePath = ".mcpregistry_registry_token" // #nosec:G101 // GitHub OAuth URLs GitHubDeviceCodeURL = "https://github.com/login/device/code" // #nosec:G101 GitHubAccessTokenURL = "https://github.com/login/oauth/access_token" // #nosec:G101 @@ -42,18 +40,12 @@ type RegistryTokenResponse struct { ExpiresAt int64 `json:"expires_at"` } -// StoredRegistryToken represents the registry token with expiration stored locally -type StoredRegistryToken struct { - Token string `json:"token"` - ExpiresAt int64 `json:"expires_at"` -} - // GitHubATProvider implements the Provider interface using GitHub's device flow type GitHubATProvider struct { clientID string - forceLogin bool registryURL string providedToken string // Token provided via --token flag or MCP_GITHUB_TOKEN env var + githubToken string // In-memory GitHub token set by Login() } // ServerHealthResponse represents the response from the health endpoint @@ -63,14 +55,13 @@ type ServerHealthResponse struct { } // NewGitHubATProvider creates a new GitHub OAuth provider -func NewGitHubATProvider(forceLogin bool, registryURL, token string) Provider { +func NewGitHubATProvider(registryURL, token string) Provider { // Check for token from flag or environment variable if token == "" { token = os.Getenv("MCP_GITHUB_TOKEN") } return &GitHubATProvider{ - forceLogin: forceLogin, registryURL: registryURL, providedToken: token, } @@ -78,69 +69,26 @@ func NewGitHubATProvider(forceLogin bool, registryURL, token string) Provider { // GetToken retrieves the registry JWT token (exchanges GitHub token if needed) func (g *GitHubATProvider) GetToken(ctx context.Context) (string, error) { - // Check if we have a valid registry token - registryToken, err := readRegistryToken() - if err == nil && registryToken != "" { - return registryToken, nil - } - - // If no valid registry token, exchange GitHub token for registry token - githubToken, err := readToken() - if err != nil { - return "", fmt.Errorf("failed to read GitHub token: %w", err) + if g.githubToken == "" { + return "", fmt.Errorf("no GitHub token available; run Login() first") } // Exchange GitHub token for registry token - registryToken, expiresAt, err := g.exchangeTokenForRegistry(ctx, githubToken) + registryToken, _, err := g.exchangeTokenForRegistry(ctx, g.githubToken) + // Clear the GitHub token from memory after exchange + g.githubToken = "" if err != nil { return "", fmt.Errorf("failed to exchange token: %w", err) } - // Store the registry token - err = saveRegistryToken(registryToken, expiresAt) - if err != nil { - return "", fmt.Errorf("failed to save registry token: %w", err) - } - return registryToken, nil } -// NeedsLogin checks if a new login is required -func (g *GitHubATProvider) NeedsLogin() bool { - // If a token was provided via --token or MCP_GITHUB_TOKEN, no login needed - if g.providedToken != "" { - return false - } - - if g.forceLogin { - return true - } - - // Check if GitHub token exists - _, statErr := os.Stat(gitHubTokenFilePath) - if os.IsNotExist(statErr) { - return true - } - - // Check if valid registry token exists - _, err := readRegistryToken() - if err != nil { - // No valid registry token, but we have GitHub token - // We don't need to login, just exchange tokens - return false - } - - return false -} - // Login performs the GitHub device flow authentication func (g *GitHubATProvider) Login(ctx context.Context) error { - // If a token was provided via --token or MCP_GITHUB_TOKEN, save it and skip device flow + // If a token was provided via --token or MCP_GITHUB_TOKEN, store it in memory and skip device flow if g.providedToken != "" { - err := saveToken(g.providedToken) - if err != nil { - return fmt.Errorf("error saving provided token: %w", err) - } + g.githubToken = g.providedToken return nil } @@ -173,11 +121,8 @@ func (g *GitHubATProvider) Login(ctx context.Context) error { return fmt.Errorf("error polling for token: %w", err) } - // Store the token locally - err = saveToken(token) - if err != nil { - return fmt.Errorf("error saving token: %w", err) - } + // Store the token in memory + g.githubToken = token _, _ = fmt.Fprintln(os.Stdout, "Successfully authenticated!") return nil @@ -305,20 +250,6 @@ func (g *GitHubATProvider) pollForToken(ctx context.Context, deviceCode string) return "", fmt.Errorf("device code authorization timed out") } -// saveToken saves the GitHub access token to a local file -func saveToken(token string) error { - return os.WriteFile(gitHubTokenFilePath, []byte(token), 0600) -} - -// readToken reads the GitHub access token from a local file -func readToken() (string, error) { - tokenData, err := os.ReadFile(gitHubTokenFilePath) - if err != nil { - return "", err - } - return string(tokenData), nil -} - func getClientID(ctx context.Context, registryURL string) (string, error) { // This function should retrieve the GitHub Client ID from the registry URL // For now, we will return a placeholder value @@ -407,41 +338,3 @@ func (g *GitHubATProvider) exchangeTokenForRegistry(ctx context.Context, githubT return tokenResp.RegistryToken, tokenResp.ExpiresAt, nil } - -// saveRegistryToken saves the registry JWT token to a local file with expiration -func saveRegistryToken(token string, expiresAt int64) error { - storedToken := StoredRegistryToken{ - Token: token, - ExpiresAt: expiresAt, - } - - data, err := json.Marshal(storedToken) - if err != nil { - return fmt.Errorf("failed to marshal token: %w", err) - } - - return os.WriteFile(registryTokenFilePath, data, 0600) -} - -// readRegistryToken reads the registry JWT token from a local file -func readRegistryToken() (string, error) { - data, err := os.ReadFile(registryTokenFilePath) - if err != nil { - return "", err - } - - var storedToken StoredRegistryToken - err = json.Unmarshal(data, &storedToken) - if err != nil { - return "", fmt.Errorf("failed to unmarshal token: %w", err) - } - - // Check if token has expired - if time.Now().Unix() >= storedToken.ExpiresAt { - // Token has expired, remove the file - os.Remove(registryTokenFilePath) - return "", fmt.Errorf("registry token has expired") - } - - return storedToken.Token, nil -} diff --git a/cmd/publisher/auth/github-oidc.go b/cmd/publisher/auth/github-oidc.go index 55fa350..e4b51ed 100644 --- a/cmd/publisher/auth/github-oidc.go +++ b/cmd/publisher/auth/github-oidc.go @@ -38,12 +38,6 @@ func (o *GitHubOIDCProvider) GetToken(ctx context.Context) (string, error) { return registryToken, nil } -// NeedsLogin always returns false for OIDC since the token is provided by GitHub Actions -func (o *GitHubOIDCProvider) NeedsLogin() bool { - // OIDC tokens are provided by GitHub Actions runtime, no interactive login needed - return false -} - // Login is not needed for OIDC since tokens are provided by GitHub Actions func (o *GitHubOIDCProvider) Login(_ context.Context) error { // No interactive login needed for OIDC diff --git a/cmd/publisher/auth/github_at_test.go b/cmd/publisher/auth/github_at_test.go new file mode 100644 index 0000000..06add95 --- /dev/null +++ b/cmd/publisher/auth/github_at_test.go @@ -0,0 +1,203 @@ +package auth_test + +import ( + "context" + "encoding/json" + "net/http" + "net/http/httptest" + "os" + "path/filepath" + "testing" + + "github.com/modelcontextprotocol/registry/cmd/publisher/auth" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +func TestNewGitHubATProvider_Name(t *testing.T) { + p := auth.NewGitHubATProvider("https://registry.example.com", "") + assert.Equal(t, "github", p.Name()) +} + +func TestNewGitHubATProvider_WithEnvToken(t *testing.T) { + t.Setenv("MCP_GITHUB_TOKEN", "env-token") + + registry := newMockExchangeServer(t, "env-token") + + p := auth.NewGitHubATProvider(registry.URL, "") + + // Login should use the env var token + err := p.Login(context.Background()) + require.NoError(t, err) + + // GetToken should exchange it successfully + token, err := p.GetToken(context.Background()) + require.NoError(t, err) + assert.Equal(t, "registry-jwt", token) +} + +func TestNewGitHubATProvider_ExplicitTokenTakesPrecedence(t *testing.T) { + t.Setenv("MCP_GITHUB_TOKEN", "env-token") + + registry := newMockExchangeServer(t, "explicit-token") + + p := auth.NewGitHubATProvider(registry.URL, "explicit-token") + + err := p.Login(context.Background()) + require.NoError(t, err) + + token, err := p.GetToken(context.Background()) + require.NoError(t, err) + assert.Equal(t, "registry-jwt", token) +} + +func TestGitHubATProvider_LoginWithProvidedToken(t *testing.T) { + registry := newMockExchangeServer(t, "my-token") + + p := auth.NewGitHubATProvider(registry.URL, "my-token") + + err := p.Login(context.Background()) + require.NoError(t, err) + + // Verify the token exchange works (proves Login stored the token) + token, err := p.GetToken(context.Background()) + require.NoError(t, err) + assert.Equal(t, "registry-jwt", token) +} + +func TestGitHubATProvider_LoginDoesNotWriteFiles(t *testing.T) { + cwd, err := os.Getwd() + require.NoError(t, err) + + p := auth.NewGitHubATProvider("https://registry.example.com", "my-token") + + err = p.Login(context.Background()) + require.NoError(t, err) + + // Verify no .mcpregistry_* files were created in cwd + for _, name := range []string{".mcpregistry_github_token", ".mcpregistry_registry_token"} { + _, statErr := os.Stat(filepath.Join(cwd, name)) + assert.True(t, os.IsNotExist(statErr), "Login should not create %s in cwd", name) + } +} + +func TestGitHubATProvider_GetTokenWithoutLogin(t *testing.T) { + p := auth.NewGitHubATProvider("https://registry.example.com", "my-token") + + // GetToken without Login should fail + _, err := p.GetToken(context.Background()) + require.Error(t, err) + assert.Contains(t, err.Error(), "no GitHub token available") +} + +func TestGitHubATProvider_GetTokenClearsTokenAfterExchange(t *testing.T) { + registry := newMockExchangeServer(t, "my-token") + + p := auth.NewGitHubATProvider(registry.URL, "my-token") + + err := p.Login(context.Background()) + require.NoError(t, err) + + // First GetToken should succeed + token, err := p.GetToken(context.Background()) + require.NoError(t, err) + assert.Equal(t, "registry-jwt", token) + + // Second GetToken should fail (GitHub token was cleared after exchange) + _, err = p.GetToken(context.Background()) + require.Error(t, err) + assert.Contains(t, err.Error(), "no GitHub token available") +} + +func TestGitHubATProvider_GetTokenClearsTokenOnError(t *testing.T) { + // Mock registry that always returns an error + registry := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) { + http.Error(w, "server error", http.StatusInternalServerError) + })) + t.Cleanup(registry.Close) + + p := auth.NewGitHubATProvider(registry.URL, "my-token") + + err := p.Login(context.Background()) + require.NoError(t, err) + + // GetToken should fail + _, err = p.GetToken(context.Background()) + require.Error(t, err) + + // Token should be cleared — second call also fails with "no GitHub token" + _, err = p.GetToken(context.Background()) + require.Error(t, err) + assert.Contains(t, err.Error(), "no GitHub token available") +} + +func TestGitHubATProvider_GetTokenExchangeFailure_NoURL(t *testing.T) { + p := auth.NewGitHubATProvider("", "my-token") + + err := p.Login(context.Background()) + require.NoError(t, err) + + _, err = p.GetToken(context.Background()) + require.Error(t, err) + assert.Contains(t, err.Error(), "failed to exchange token") +} + +func TestGitHubATProvider_LoginDeviceFlow_FetchesClientID(t *testing.T) { + // Mock registry health endpoint + registry := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + if r.URL.Path == "/v0/health" { + w.Header().Set("Content-Type", "application/json") + _ = json.NewEncoder(w).Encode(map[string]string{ + "status": "ok", + "github_client_id": "test-client-id", + }) + return + } + http.Error(w, "not found", http.StatusNotFound) + })) + t.Cleanup(registry.Close) + + p := auth.NewGitHubATProvider(registry.URL, "") + + // Login without a provided token triggers device flow, which calls + // the real GitHub device code URL. This will fail, but only after + // fetching the client ID from our mock health endpoint. + err := p.Login(context.Background()) + require.Error(t, err) + assert.Contains(t, err.Error(), "error requesting device code") +} + +func TestGitHubATProvider_ImplementsProviderInterface(_ *testing.T) { + // Compile-time check + var _ = auth.NewGitHubATProvider("https://example.com", "token") +} + +// newMockExchangeServer creates an httptest.Server that mocks the registry's +// token exchange endpoint. It accepts a specific GitHub token and returns +// "registry-jwt" as the registry token. +func newMockExchangeServer(t *testing.T, expectedGitHubToken string) *httptest.Server { + t.Helper() + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + if r.URL.Path == "/v0/auth/github-at" && r.Method == http.MethodPost { + var body map[string]string + if err := json.NewDecoder(r.Body).Decode(&body); err != nil { + http.Error(w, "bad request", http.StatusBadRequest) + return + } + if body["github_token"] == expectedGitHubToken { + w.Header().Set("Content-Type", "application/json") + resp := map[string]interface{}{ + "registry_token": "registry-jwt", + "expires_at": 9999999999, + } + _ = json.NewEncoder(w).Encode(resp) + return + } + http.Error(w, "unauthorized", http.StatusUnauthorized) + return + } + http.Error(w, "not found", http.StatusNotFound) + })) + t.Cleanup(server.Close) + return server +} diff --git a/cmd/publisher/auth/interface.go b/cmd/publisher/auth/interface.go index a230429..1e3561f 100644 --- a/cmd/publisher/auth/interface.go +++ b/cmd/publisher/auth/interface.go @@ -8,10 +8,6 @@ type Provider interface { // It returns the token string and any error encountered GetToken(ctx context.Context) (string, error) - // NeedsLogin checks if a new login is required - // This can check for existing tokens, expiry, etc. - NeedsLogin() bool - // Login performs the authentication flow // This might involve user interaction, device flows, etc. Login(ctx context.Context) error diff --git a/cmd/publisher/auth/none.go b/cmd/publisher/auth/none.go index a822cba..967db24 100644 --- a/cmd/publisher/auth/none.go +++ b/cmd/publisher/auth/none.go @@ -62,10 +62,6 @@ func (p *NoneProvider) GetToken(ctx context.Context) (string, error) { return p.token, nil } -func (p *NoneProvider) NeedsLogin() bool { - return false -} - func (p *NoneProvider) Login(_ context.Context) error { // No login needed for anonymous auth return nil diff --git a/cmd/publisher/commands/login.go b/cmd/publisher/commands/login.go index 091a700..3b97211 100644 --- a/cmd/publisher/commands/login.go +++ b/cmd/publisher/commands/login.go @@ -16,15 +16,45 @@ import ( ) const ( - DefaultRegistryURL = "https://registry.modelcontextprotocol.io" - TokenFileName = ".mcp_publisher_token" //nolint:gosec // Not a credential, just a filename - MethodGitHub = "github" - MethodGitHubOIDC = "github-oidc" - MethodDNS = "dns" - MethodHTTP = "http" - MethodNone = "none" + DefaultRegistryURL = "https://registry.modelcontextprotocol.io" + LegacyTokenFileName = ".mcp_publisher_token" //nolint:gosec // Not a credential, just a filename + MethodGitHub = "github" + MethodGitHubOIDC = "github-oidc" + MethodDNS = "dns" + MethodHTTP = "http" + MethodNone = "none" ) +// tokenFilePath returns the path to the token file in the user's config directory +// (~/.config/mcp-publisher/token.json). It does not create the directory. +func tokenFilePath() (string, error) { + homeDir, err := os.UserHomeDir() + if err != nil { + return "", fmt.Errorf("failed to get home directory: %w", err) + } + return filepath.Join(homeDir, ".config", "mcp-publisher", "token.json"), nil +} + +// notAuthenticatedError returns an error guiding the user to log in, +// with a hint about the token location change for users upgrading. +func notAuthenticatedError() error { + _, _ = fmt.Fprintln(os.Stderr, "hint: token storage moved to ~/.config/mcp-publisher/. If you recently upgraded, please re-login.") + return errors.New("not authenticated, run 'mcp-publisher login ' first") +} + +// ensureTokenDir creates the token directory (~/.config/mcp-publisher/) if needed. +func ensureTokenDir() error { + homeDir, err := os.UserHomeDir() + if err != nil { + return fmt.Errorf("failed to get home directory: %w", err) + } + dir := filepath.Join(homeDir, ".config", "mcp-publisher") + if err := os.MkdirAll(dir, 0700); err != nil { + return fmt.Errorf("failed to create config directory: %w", err) + } + return nil +} + type CryptoAlgorithm auth.CryptoAlgorithm type SignerType string @@ -130,7 +160,7 @@ func createSigner(flags LoginFlags) (auth.Signer, error) { func createAuthProvider(method, registryURL, domain string, token Token, signer auth.Signer) (auth.Provider, error) { switch method { case MethodGitHub: - return auth.NewGitHubATProvider(true, registryURL, string(token)), nil + return auth.NewGitHubATProvider(registryURL, string(token)), nil case MethodGitHubOIDC: return auth.NewGitHubOIDCProvider(registryURL), nil case MethodDNS: @@ -226,12 +256,15 @@ Examples: return fmt.Errorf("failed to get token: %w", err) } - homeDir, err := os.UserHomeDir() + if err := ensureTokenDir(); err != nil { + return err + } + + tokenPath, err := tokenFilePath() if err != nil { - return fmt.Errorf("failed to get home directory: %w", err) + return err } - tokenPath := filepath.Join(homeDir, TokenFileName) tokenData := map[string]string{ "token": token, "method": method, diff --git a/cmd/publisher/commands/login_test.go b/cmd/publisher/commands/login_test.go new file mode 100644 index 0000000..1f6a1b1 --- /dev/null +++ b/cmd/publisher/commands/login_test.go @@ -0,0 +1,97 @@ +package commands_test + +import ( + "encoding/json" + "net/http" + "net/http/httptest" + "os" + "path/filepath" + "testing" + + "github.com/modelcontextprotocol/registry/cmd/publisher/commands" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +func TestLoginCommand_WritesTokenToConfigDir(t *testing.T) { + tempHome := t.TempDir() + t.Setenv("HOME", tempHome) + + // Mock registry that returns a token for "none" auth + server := setupNoneAuthServer(t) + + err := commands.LoginCommand([]string{"none", "--registry", server.URL}) + require.NoError(t, err) + + // Verify token written to new location + tokenPath := filepath.Join(tempHome, ".config", "mcp-publisher", "token.json") + data, err := os.ReadFile(tokenPath) + require.NoError(t, err) + + var tokenInfo map[string]string + require.NoError(t, json.Unmarshal(data, &tokenInfo)) + + assert.Equal(t, "none", tokenInfo["method"]) + assert.Equal(t, server.URL, tokenInfo["registry"]) + assert.NotEmpty(t, tokenInfo["token"]) +} + +func TestLoginCommand_CreatesDirectoryWithCorrectPerms(t *testing.T) { + tempHome := t.TempDir() + t.Setenv("HOME", tempHome) + + server := setupNoneAuthServer(t) + + err := commands.LoginCommand([]string{"none", "--registry", server.URL}) + require.NoError(t, err) + + // Verify directory permissions + dir := filepath.Join(tempHome, ".config", "mcp-publisher") + info, err := os.Stat(dir) + require.NoError(t, err) + assert.Equal(t, os.FileMode(0700), info.Mode().Perm()) + + // Verify file permissions + tokenPath := filepath.Join(dir, "token.json") + info, err = os.Stat(tokenPath) + require.NoError(t, err) + assert.Equal(t, os.FileMode(0600), info.Mode().Perm()) +} + +func TestLoginCommand_DoesNotWriteLegacyFiles(t *testing.T) { + tempHome := t.TempDir() + t.Setenv("HOME", tempHome) + + server := setupNoneAuthServer(t) + + err := commands.LoginCommand([]string{"none", "--registry", server.URL}) + require.NoError(t, err) + + // Verify no legacy file at $HOME + _, err = os.Stat(filepath.Join(tempHome, ".mcp_publisher_token")) + assert.True(t, os.IsNotExist(err), "should not create legacy ~/.mcp_publisher_token") + + // Verify no .mcpregistry_* files in cwd + cwd, err := os.Getwd() + require.NoError(t, err) + for _, name := range []string{".mcpregistry_github_token", ".mcpregistry_registry_token"} { + _, err := os.Stat(filepath.Join(cwd, name)) + assert.True(t, os.IsNotExist(err), "should not create %s in cwd", name) + } +} + +// setupNoneAuthServer creates a mock registry that handles the "none" auth flow. +func setupNoneAuthServer(t *testing.T) *httptest.Server { + t.Helper() + mux := http.NewServeMux() + mux.HandleFunc("/v0/auth/none", func(w http.ResponseWriter, _ *http.Request) { + w.Header().Set("Content-Type", "application/json") + _ = json.NewEncoder(w).Encode(map[string]interface{}{ + "registry_token": "test-registry-jwt", + "expires_at": 9999999999, + }) + }) + server := httptest.NewServer(mux) + t.Cleanup(server.Close) + return server +} diff --git a/cmd/publisher/commands/logout.go b/cmd/publisher/commands/logout.go index 3ac9abd..25adfd8 100644 --- a/cmd/publisher/commands/logout.go +++ b/cmd/publisher/commands/logout.go @@ -7,37 +7,57 @@ import ( ) func LogoutCommand() error { - homeDir, err := os.UserHomeDir() + tokenPath, err := tokenFilePath() if err != nil { - return fmt.Errorf("failed to get home directory: %w", err) + return err } - tokenPath := filepath.Join(homeDir, TokenFileName) + // Check if token file exists at new location or legacy location + homeDir, err := os.UserHomeDir() + if err != nil { + homeDir = "" // degrade gracefully for legacy cleanup + } + legacyTokenPath := "" + if homeDir != "" { + legacyTokenPath = filepath.Join(homeDir, LegacyTokenFileName) + } - // Check if token file exists - if _, err := os.Stat(tokenPath); os.IsNotExist(err) { + newExists := fileExists(tokenPath) + legacyExists := legacyTokenPath != "" && fileExists(legacyTokenPath) + + if !newExists && !legacyExists { _, _ = fmt.Fprintln(os.Stdout, "Not logged in") return nil } - // Remove token file - if err := os.Remove(tokenPath); err != nil { - return fmt.Errorf("failed to remove token: %w", err) + // Remove token file from new location + os.Remove(tokenPath) + + // Remove from legacy location + if legacyTokenPath != "" { + os.Remove(legacyTokenPath) } - // Also clean up legacy token files if they exist - legacyFiles := []string{ + // Clean up legacy intermediate token files from $HOME and cwd + legacyIntermediateFiles := []string{ ".mcpregistry_github_token", ".mcpregistry_registry_token", } - for _, file := range legacyFiles { - path := filepath.Join(homeDir, file) - if _, err := os.Stat(path); err == nil { - os.Remove(path) // Ignore errors for legacy files + for _, file := range legacyIntermediateFiles { + // Clean from $HOME + if homeDir != "" { + os.Remove(filepath.Join(homeDir, file)) } + // Clean from cwd (the original bug location) + os.Remove(file) } _, _ = fmt.Fprintln(os.Stdout, "✓ Successfully logged out") return nil } + +func fileExists(path string) bool { + _, err := os.Stat(path) + return err == nil +} diff --git a/cmd/publisher/commands/logout_test.go b/cmd/publisher/commands/logout_test.go new file mode 100644 index 0000000..ce0439f --- /dev/null +++ b/cmd/publisher/commands/logout_test.go @@ -0,0 +1,123 @@ +package commands_test + +import ( + "os" + "path/filepath" + "testing" + + "github.com/modelcontextprotocol/registry/cmd/publisher/commands" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +func TestLogoutCommand_RemovesNewToken(t *testing.T) { + tempHome := t.TempDir() + t.Setenv("HOME", tempHome) + + // Create token at new location + dir := filepath.Join(tempHome, ".config", "mcp-publisher") + require.NoError(t, os.MkdirAll(dir, 0700)) + require.NoError(t, os.WriteFile(filepath.Join(dir, "token.json"), []byte(`{"token":"t"}`), 0600)) + + err := commands.LogoutCommand() + require.NoError(t, err) + + _, err = os.Stat(filepath.Join(dir, "token.json")) + assert.True(t, os.IsNotExist(err)) +} + +func TestLogoutCommand_RemovesLegacyToken(t *testing.T) { + tempHome := t.TempDir() + t.Setenv("HOME", tempHome) + + // Create token at legacy location only + require.NoError(t, os.WriteFile(filepath.Join(tempHome, ".mcp_publisher_token"), []byte(`{"token":"t"}`), 0600)) + + err := commands.LogoutCommand() + require.NoError(t, err) + + _, err = os.Stat(filepath.Join(tempHome, ".mcp_publisher_token")) + assert.True(t, os.IsNotExist(err)) +} + +func TestLogoutCommand_RemovesBothOldAndNew(t *testing.T) { + tempHome := t.TempDir() + t.Setenv("HOME", tempHome) + + // Create tokens at both locations + dir := filepath.Join(tempHome, ".config", "mcp-publisher") + require.NoError(t, os.MkdirAll(dir, 0700)) + require.NoError(t, os.WriteFile(filepath.Join(dir, "token.json"), []byte(`{"token":"new"}`), 0600)) + require.NoError(t, os.WriteFile(filepath.Join(tempHome, ".mcp_publisher_token"), []byte(`{"token":"old"}`), 0600)) + + err := commands.LogoutCommand() + require.NoError(t, err) + + _, err = os.Stat(filepath.Join(dir, "token.json")) + assert.True(t, os.IsNotExist(err), "new token should be removed") + + _, err = os.Stat(filepath.Join(tempHome, ".mcp_publisher_token")) + assert.True(t, os.IsNotExist(err), "legacy token should be removed") +} + +func TestLogoutCommand_CleansUpCwdLegacyFiles(t *testing.T) { + tempHome := t.TempDir() + t.Setenv("HOME", tempHome) + + // Create a token so logout doesn't say "Not logged in" + dir := filepath.Join(tempHome, ".config", "mcp-publisher") + require.NoError(t, os.MkdirAll(dir, 0700)) + require.NoError(t, os.WriteFile(filepath.Join(dir, "token.json"), []byte(`{"token":"t"}`), 0600)) + + // Create legacy intermediate files in a temp cwd + tempCwd := t.TempDir() + origDir, err := os.Getwd() + require.NoError(t, err) + t.Cleanup(func() { _ = os.Chdir(origDir) }) + require.NoError(t, os.Chdir(tempCwd)) + + require.NoError(t, os.WriteFile(".mcpregistry_github_token", []byte("gh-token"), 0600)) + require.NoError(t, os.WriteFile(".mcpregistry_registry_token", []byte("reg-token"), 0600)) + + err = commands.LogoutCommand() + require.NoError(t, err) + + _, err = os.Stat(filepath.Join(tempCwd, ".mcpregistry_github_token")) + assert.True(t, os.IsNotExist(err), ".mcpregistry_github_token should be removed from cwd") + + _, err = os.Stat(filepath.Join(tempCwd, ".mcpregistry_registry_token")) + assert.True(t, os.IsNotExist(err), ".mcpregistry_registry_token should be removed from cwd") +} + +func TestLogoutCommand_CleansUpHomeLegacyFiles(t *testing.T) { + tempHome := t.TempDir() + t.Setenv("HOME", tempHome) + + // Create a token so logout doesn't say "Not logged in" + dir := filepath.Join(tempHome, ".config", "mcp-publisher") + require.NoError(t, os.MkdirAll(dir, 0700)) + require.NoError(t, os.WriteFile(filepath.Join(dir, "token.json"), []byte(`{"token":"t"}`), 0600)) + + // Create legacy intermediate files in $HOME + require.NoError(t, os.WriteFile(filepath.Join(tempHome, ".mcpregistry_github_token"), []byte("gh-token"), 0600)) + require.NoError(t, os.WriteFile(filepath.Join(tempHome, ".mcpregistry_registry_token"), []byte("reg-token"), 0600)) + + err := commands.LogoutCommand() + require.NoError(t, err) + + _, err = os.Stat(filepath.Join(tempHome, ".mcpregistry_github_token")) + assert.True(t, os.IsNotExist(err), ".mcpregistry_github_token should be removed from $HOME") + + _, err = os.Stat(filepath.Join(tempHome, ".mcpregistry_registry_token")) + assert.True(t, os.IsNotExist(err), ".mcpregistry_registry_token should be removed from $HOME") +} + +func TestLogoutCommand_NotLoggedIn(t *testing.T) { + tempHome := t.TempDir() + t.Setenv("HOME", tempHome) + + // No token files exist anywhere + err := commands.LogoutCommand() + // Should not error, just print "Not logged in" + require.NoError(t, err) +} diff --git a/cmd/publisher/commands/publish.go b/cmd/publisher/commands/publish.go index da7de7d..c93621a 100644 --- a/cmd/publisher/commands/publish.go +++ b/cmd/publisher/commands/publish.go @@ -4,12 +4,10 @@ import ( "bytes" "context" "encoding/json" - "errors" "fmt" "io" "net/http" "os" - "path/filepath" "strings" apiv0 "github.com/modelcontextprotocol/registry/pkg/api/v0" @@ -38,16 +36,15 @@ func PublishCommand(args []string) error { } // Load saved token - homeDir, err := os.UserHomeDir() + tokenPath, err := tokenFilePath() if err != nil { - return fmt.Errorf("failed to get home directory: %w", err) + return err } - tokenPath := filepath.Join(homeDir, TokenFileName) tokenData, err := os.ReadFile(tokenPath) if err != nil { if os.IsNotExist(err) { - return errors.New("not authenticated. Run 'mcp-publisher login ' first") + return notAuthenticatedError() } return fmt.Errorf("failed to read token: %w", err) } diff --git a/cmd/publisher/commands/status.go b/cmd/publisher/commands/status.go index bcfacf5..8132fa2 100644 --- a/cmd/publisher/commands/status.go +++ b/cmd/publisher/commands/status.go @@ -12,7 +12,6 @@ import ( "net/http" "net/url" "os" - "path/filepath" "strings" ) @@ -95,16 +94,15 @@ func StatusCommand(args []string) error { } // Load saved token - homeDir, err := os.UserHomeDir() + tokenPath, err := tokenFilePath() if err != nil { - return fmt.Errorf("failed to get home directory: %w", err) + return err } - tokenPath := filepath.Join(homeDir, TokenFileName) tokenData, err := os.ReadFile(tokenPath) if err != nil { if os.IsNotExist(err) { - return errors.New("not authenticated. Run 'mcp-publisher login ' first") + return notAuthenticatedError() } return fmt.Errorf("failed to read token: %w", err) } diff --git a/cmd/publisher/commands/testutil_test.go b/cmd/publisher/commands/testutil_test.go index 51c6687..e69027b 100644 --- a/cmd/publisher/commands/testutil_test.go +++ b/cmd/publisher/commands/testutil_test.go @@ -8,7 +8,6 @@ import ( "path/filepath" "testing" - "github.com/modelcontextprotocol/registry/cmd/publisher/commands" "github.com/modelcontextprotocol/registry/internal/validators" apiv0 "github.com/modelcontextprotocol/registry/pkg/api/v0" "github.com/stretchr/testify/require" @@ -64,14 +63,19 @@ func SetupMockRegistryServer(t *testing.T, publishHandler func(w http.ResponseWr return server } -// SetupTestToken creates a token file pointing to the test server +// SetupTestToken creates a token file pointing to the test server. +// It overrides $HOME to a temp directory so tests don't touch real credentials. func SetupTestToken(t *testing.T, registryURL, token string) string { t.Helper() - homeDir, err := os.UserHomeDir() - require.NoError(t, err) + // Override $HOME so tokenFilePath() resolves to a temp directory + tempHome := t.TempDir() + t.Setenv("HOME", tempHome) - tokenPath := filepath.Join(homeDir, commands.TokenFileName) + dir := filepath.Join(tempHome, ".config", "mcp-publisher") + require.NoError(t, os.MkdirAll(dir, 0700)) + + tokenPath := filepath.Join(dir, "token.json") tokenData := map[string]string{ "token": token, "registry": registryURL, @@ -83,10 +87,6 @@ func SetupTestToken(t *testing.T, registryURL, token string) string { err = os.WriteFile(tokenPath, data, 0600) require.NoError(t, err) - t.Cleanup(func() { - _ = os.Remove(tokenPath) - }) - return tokenPath } diff --git a/cmd/publisher/commands/validate.go b/cmd/publisher/commands/validate.go index b68c2b4..1e360ae 100644 --- a/cmd/publisher/commands/validate.go +++ b/cmd/publisher/commands/validate.go @@ -8,7 +8,6 @@ import ( "io" "net/http" "os" - "path/filepath" "strings" "github.com/modelcontextprotocol/registry/internal/validators" @@ -151,19 +150,15 @@ func ValidateCommand(args []string) error { } // Get registry URL (same pattern as publish) - homeDir, err := os.UserHomeDir() - if err != nil { - return fmt.Errorf("failed to get home directory: %w", err) - } - - tokenPath := filepath.Join(homeDir, TokenFileName) registryURL := DefaultRegistryURL // Try to read registry URL from token file (if it exists) - if tokenData, err := os.ReadFile(tokenPath); err == nil { - var tokenInfo map[string]string - if err := json.Unmarshal(tokenData, &tokenInfo); err == nil { - if url := tokenInfo["registry"]; url != "" { - registryURL = url + if tokenPath, err := tokenFilePath(); err == nil { + if tokenData, err := os.ReadFile(tokenPath); err == nil { + var tokenInfo map[string]string + if err := json.Unmarshal(tokenData, &tokenInfo); err == nil { + if url := tokenInfo["registry"]; url != "" { + registryURL = url + } } } } diff --git a/complete.md b/complete.md index 045e797..2355e4b 100644 --- a/complete.md +++ b/complete.md @@ -2027,21 +2027,24 @@ mcp-publisher logout ``` **Behavior:** -- Removes `~/.mcp_publisher_token` +- Removes `~/.config/mcp-publisher/token.json` +- Also cleans up legacy token files (`~/.mcp_publisher_token`, `.mcpregistry_*`) - Does not revoke tokens on server side ## Configuration ### Token Storage -Authentication tokens stored in `~/.mcp_publisher_token` as JSON: +Authentication tokens are stored in `~/.config/mcp-publisher/token.json` as JSON: ```json { "token": "jwt-token-here", - "registry_url": "https://registry.modelcontextprotocol.io", - "expires_at": "2024-12-31T23:59:59Z" + "method": "github", + "registry": "https://registry.modelcontextprotocol.io" } ``` +> **Note:** Tokens were previously stored in `~/.mcp_publisher_token`. If you are upgrading, run `mcp-publisher logout` followed by `mcp-publisher login` to migrate to the new location. + --- ## File: docs/reference/faq.md diff --git a/docs/reference/cli/commands.md b/docs/reference/cli/commands.md index 4d7d71a..0f44b7b 100644 --- a/docs/reference/cli/commands.md +++ b/docs/reference/cli/commands.md @@ -331,17 +331,20 @@ mcp-publisher logout ``` **Behavior:** -- Removes `~/.mcp_publisher_token` +- Removes `~/.config/mcp-publisher/token.json` +- Also cleans up legacy token files (`~/.mcp_publisher_token`, `.mcpregistry_*`) - Does not revoke tokens on server side ## Configuration ### Token Storage -Authentication tokens stored in `~/.mcp_publisher_token` as JSON: +Authentication tokens are stored in `~/.config/mcp-publisher/token.json` as JSON: ```json { "token": "jwt-token-here", - "registry_url": "https://registry.modelcontextprotocol.io", - "expires_at": "2024-12-31T23:59:59Z" + "method": "github", + "registry": "https://registry.modelcontextprotocol.io" } ``` + +> **Note:** Tokens were previously stored in `~/.mcp_publisher_token`. If you are upgrading, run `mcp-publisher logout` followed by `mcp-publisher login` to migrate to the new location. diff --git a/tests/integration/main.go b/tests/integration/main.go index 889780f..4187ccf 100644 --- a/tests/integration/main.go +++ b/tests/integration/main.go @@ -70,8 +70,15 @@ func cleanupPublisherAuth() { if err != nil { return } - tokenPath := filepath.Join(homeDir, ".mcp_publisher_token") - os.Remove(tokenPath) + // Remove from new config directory location + newTokenPath := filepath.Join(homeDir, ".config", "mcp-publisher", "token.json") + os.Remove(newTokenPath) + // Also remove from legacy location + legacyTokenPath := filepath.Join(homeDir, ".mcp_publisher_token") + os.Remove(legacyTokenPath) + // Clean up legacy intermediate token files from cwd + os.Remove(".mcpregistry_github_token") + os.Remove(".mcpregistry_registry_token") } func publish(examples []example) error { From 8df5a7711d8f4cac3385601181568a1cb608d73c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Yusufhan=20Sa=C3=A7ak?= <67666222+JosephDoUrden@users.noreply.github.com> Date: Wed, 15 Apr 2026 14:16:23 +0300 Subject: [PATCH 157/313] fix(publisher): omit repository when URL cannot be detected (#1149) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary When `detectRepoURL()` cannot determine the repository (no git remote, no package.json repository field), return an empty string instead of a placeholder URL (`https://github.com/YOUR_USERNAME/YOUR_REPO`). This causes `createServerJSON()` to omit the `repository` field entirely, preventing schema validation failures on publish. Fixes #613 ## Problem `mcp-publisher init` generated a `repository` object with a placeholder URL that fails the `uri` format validation on publish. 88 published servers in the official registry had this issue. ## Change - `cmd/publisher/commands/init.go`: `detectRepoURL()` returns `""` instead of placeholder when no repo is found - The existing guard in `createServerJSON()` (`if repoURL != "" && repoSource != ""`) already handles this correctly — it omits the repository when URL is empty ## Test plan - [x] `go build ./cmd/publisher/...` compiles - [x] `go test ./cmd/publisher/commands/...` passes - [ ] Manual: `mcp-publisher init` in a directory without git remote or package.json repo — verify no `repository` field in generated server.json - [ ] Manual: `mcp-publisher init` in a git repo — verify `repository` is populated correctly ## AI Disclosure AI assistance (Claude) was used for issue research. The implementation was written and reviewed by the author. --- cmd/publisher/commands/init.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cmd/publisher/commands/init.go b/cmd/publisher/commands/init.go index 27cb664..8d0b505 100644 --- a/cmd/publisher/commands/init.go +++ b/cmd/publisher/commands/init.go @@ -246,7 +246,7 @@ func detectRepoURL() string { } } - return "https://github.com/YOUR_USERNAME/YOUR_REPO" + return "" } func detectPackageType() string { From 70b5f457c8866981e1a12a8e24acadf979e21529 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Wed, 15 Apr 2026 10:28:33 -0400 Subject: [PATCH 158/313] deploy: update prod to v1.6.0 (#1172) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary - Bumps production image tag from `1.5.0` to `1.6.0` in `deploy/Pulumi.gcpProd.yaml` - Corresponds to the [v1.6.0 release](https://github.com/modelcontextprotocol/registry/releases/tag/v1.6.0) ## Test plan - [ ] Verify Pulumi preview shows only the image tag change - [ ] Deploy and confirm the service is healthy 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.6 (1M context) --- deploy/Pulumi.gcpProd.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/deploy/Pulumi.gcpProd.yaml b/deploy/Pulumi.gcpProd.yaml index 0aac0d7..630f8a2 100644 --- a/deploy/Pulumi.gcpProd.yaml +++ b/deploy/Pulumi.gcpProd.yaml @@ -1,7 +1,7 @@ config: mcp-registry:environment: prod mcp-registry:provider: gcp - mcp-registry:imageTag: 1.5.0 # Set specific image tag for production (change this to deploy different versions) + mcp-registry:imageTag: 1.6.0 # Set specific image tag for production (change this to deploy different versions) gcp:project: mcp-registry-prod mcp-registry:githubClientId: Iv23liUydBbI7Z2Q9bOZ mcp-registry:githubClientSecret: From b6ab23cdea8e9dd918ad7486c042ce775f1464ea Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 21 Apr 2026 05:02:23 -0400 Subject: [PATCH 159/313] build(deps): bump goreleaser/goreleaser-action from 7.0.0 to 7.1.0 in the actions group (#1189) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps the actions group with 1 update: [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action). Updates `goreleaser/goreleaser-action` from 7.0.0 to 7.1.0
    Release notes

    Sourced from goreleaser/goreleaser-action's releases.

    v7.1.0

    What's Changed

    New Contributors

    Full Changelog: https://github.com/goreleaser/goreleaser-action/compare/v7...v7.1.0

    Commits
    • e24998b ci: drop pre-cosign-v3 goreleaser versions from tests (#554)
    • be2e8a3 docs: document cosign verification in README (#553)
    • 5e53f8e ci: add release-major-tag workflow (#552)
    • 4068afa build: drop docker-bake in favor of plain npm (#551)
    • 213ec80 docs: add CONTRIBUTING with pre-commit workflow
    • 4b462d3 feat: verify release checksum and cosign signature (#550)
    • 01cbe07 docs: Upgrade import GPG action version (#547)
    • 2a473d7 ci(deps): bump the actions group with 5 updates (#546)
    • fdcf0b9 clean: leftover files from node 22(?)
    • 9881cc5 fix: use new static URL
    • Additional commits viewable in compare view

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=goreleaser/goreleaser-action&package-manager=github_actions&previous-version=7.0.0&new-version=7.1.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index b1f807f..b0e6c1f 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -31,7 +31,7 @@ jobs: uses: anchore/sbom-action/download-syft@v0.24.0 - name: Run GoReleaser - uses: goreleaser/goreleaser-action@ec59f474b9834571250b370d4735c50f8e2d1e29 + uses: goreleaser/goreleaser-action@e24998b8b67b290c2fa8b7c14fcfa7de2c5c9b8c with: distribution: goreleaser version: v2.12.0 From cc48844ebc49cc4d7b2633e21f07335716ca0044 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 21 Apr 2026 05:02:43 -0400 Subject: [PATCH 160/313] build(deps): bump github.com/jackc/pgx/v5 from 5.9.1 to 5.9.2 (#1188) Bumps [github.com/jackc/pgx/v5](https://github.com/jackc/pgx) from 5.9.1 to 5.9.2.
    Changelog

    Sourced from github.com/jackc/pgx/v5's changelog.

    5.9.2 (April 18, 2026)

    Fix SQL Injection via placeholder confusion with dollar quoted string literals (GHSA-j88v-2chj-qfwx)

    SQL injection can occur when:

    1. The non-default simple protocol is used.
    2. A dollar quoted string literal is used in the SQL query.
    3. That query contains text that would be would be interpreted outside as a placeholder outside of a string literal.
    4. The value of that placeholder is controllable by the attacker.

    e.g.

    attackValue := `$tag$; drop table canary; --`
_, err = tx.Exec(ctx, `select $tag$ $1 $tag$, $1`,
pgx.QueryExecModeSimpleProtocol, attackValue)

    This is unlikely to occur outside of a contrived scenario.

    Commits
    • 0aeabbc Release v5.9.2
    • 60644f8 Fix SQL sanitizer bugs with dollar-quoted strings and placeholder overflow
    • a5680bc Merge pull request #2531 from dolmen-go/godoc-add-links
    • e34e452 doc: Add godoc links
    • 08c9bb1 Fix Stringer types encoded as text instead of numeric value in composite fields
    • 96b4dbd Remove unstable test
    • acf88e0 Merge pull request #2526 from abrightwell/abrightwell-min-proto
    • 2f81f1f Update max_protocol_version and min_protocol_version defaults
    • See full diff in compare view

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/jackc/pgx/v5&package-manager=go_modules&previous-version=5.9.1&new-version=5.9.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index dccf238..a6d5537 100644 --- a/go.mod +++ b/go.mod @@ -11,7 +11,7 @@ require ( github.com/danielgtaylor/huma/v2 v2.37.3 github.com/golang-jwt/jwt/v5 v5.3.1 github.com/google/go-containerregistry v0.21.5 - github.com/jackc/pgx/v5 v5.9.1 + github.com/jackc/pgx/v5 v5.9.2 github.com/prometheus/client_golang v1.23.2 github.com/rs/cors v1.11.1 github.com/santhosh-tekuri/jsonschema/v5 v5.3.1 diff --git a/go.sum b/go.sum index 0a61c79..18d07e2 100644 --- a/go.sum +++ b/go.sum @@ -85,8 +85,8 @@ github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsI github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg= github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo= github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM= -github.com/jackc/pgx/v5 v5.9.1 h1:uwrxJXBnx76nyISkhr33kQLlUqjv7et7b9FjCen/tdc= -github.com/jackc/pgx/v5 v5.9.1/go.mod h1:mal1tBGAFfLHvZzaYh77YS/eC6IX9OWbRV1QIIM0Jn4= +github.com/jackc/pgx/v5 v5.9.2 h1:3ZhOzMWnR4yJ+RW1XImIPsD1aNSz4T4fyP7zlQb56hw= +github.com/jackc/pgx/v5 v5.9.2/go.mod h1:mal1tBGAFfLHvZzaYh77YS/eC6IX9OWbRV1QIIM0Jn4= github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo= github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4= github.com/keybase/go-keychain v0.0.1 h1:way+bWYa6lDppZoZcgMbYsvC7GxljxrskdNInRtuthU= From 85c95569a756be3ebad6aff9df8567b6f1d2fc3f Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 21 Apr 2026 05:03:01 -0400 Subject: [PATCH 161/313] build(deps): bump github.com/go-git/go-git/v5 from 5.17.2 to 5.18.0 in /deploy (#1180) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.17.2 to 5.18.0.
    Release notes

    Sourced from github.com/go-git/go-git/v5's releases.

    v5.18.0

    What's Changed

    Full Changelog: https://github.com/go-git/go-git/compare/v5.17.2...v5.18.0

    Commits
    • ea3e7ec Merge pull request #2004 from go-git/v5-http-hardening
    • bcd20a9 plumbing: transport/http, Add support for followRedirects policy
    • See full diff in compare view

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/go-git/go-git/v5&package-manager=go_modules&previous-version=5.17.2&new-version=5.18.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/modelcontextprotocol/registry/network/alerts).
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- deploy/go.mod | 2 +- deploy/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index 07de0a8..66bfb92 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -38,7 +38,7 @@ require ( github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect github.com/go-git/go-billy/v5 v5.8.0 // indirect - github.com/go-git/go-git/v5 v5.17.2 // indirect + github.com/go-git/go-git/v5 v5.18.0 // indirect github.com/go-logr/logr v1.4.3 // indirect github.com/go-logr/stdr v1.2.2 // indirect github.com/gogo/protobuf v1.3.2 // indirect diff --git a/deploy/go.sum b/deploy/go.sum index 418aa21..f6088ef 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -74,8 +74,8 @@ github.com/go-git/go-billy/v5 v5.8.0 h1:I8hjc3LbBlXTtVuFNJuwYuMiHvQJDq1AT6u4DwDz github.com/go-git/go-billy/v5 v5.8.0/go.mod h1:RpvI/rw4Vr5QA+Z60c6d6LXH0rYJo0uD5SqfmrrheCY= github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4= github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII= -github.com/go-git/go-git/v5 v5.17.2 h1:B+nkdlxdYrvyFK4GPXVU8w1U+YkbsgciIR7f2sZJ104= -github.com/go-git/go-git/v5 v5.17.2/go.mod h1:pW/VmeqkanRFqR6AljLcs7EA7FbZaN5MQqO7oZADXpo= +github.com/go-git/go-git/v5 v5.18.0 h1:O831KI+0PR51hM2kep6T8k+w0/LIAD490gvqMCvL5hM= +github.com/go-git/go-git/v5 v5.18.0/go.mod h1:pW/VmeqkanRFqR6AljLcs7EA7FbZaN5MQqO7oZADXpo= github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= From 4be2234d3ffbb88f51c2be1d4987b64eb0405e24 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 21 Apr 2026 05:03:22 -0400 Subject: [PATCH 162/313] build(deps): bump github.com/pulumi/pulumi-kubernetes/sdk/v4 from 4.28.0 to 4.29.0 in /deploy (#1177) Bumps [github.com/pulumi/pulumi-kubernetes/sdk/v4](https://github.com/pulumi/pulumi-kubernetes) from 4.28.0 to 4.29.0.
    Release notes

    Sourced from github.com/pulumi/pulumi-kubernetes/sdk/v4's releases.

    v4.29.0

    No release notes provided.

    Changelog

    Sourced from github.com/pulumi/pulumi-kubernetes/sdk/v4's changelog.

    4.29.0 (April 15, 2026)

    Fixed

    • #2926 Use client-side create for new resources instead of server-side apply.

      Users may observe stricter errors on some Create operations. Please read carefully.

      When a resource already exists in the cluster, the API server now returns an AlreadyExists error instead of silently updating the existing object. This prevents data loss from create-then-delete scenarios (e.g. renaming a Pulumi resource or replacing an explicitly-named resource). A new provider config option upsertExistingObjects (default false) restores the previous upsert behavior for users who intentionally adopt existing cluster resources. To manage fields on existing objects without owning their lifecycle, use Patch resources (e.g. NamespacePatch).

    Added

    • #2280 Add enablePatchForce provider config option to force SSA patch conflicts on a per-stack basis.

    Changed

    • Upgrade Kubernetes schema and libraries to v1.35.3.
    Commits
    • 6a98f51 Update GitHub Actions workflows. (#4283)
    • 677360a Fix race condition in istio test (#4282)
    • f3ebf58 Prepare for v4.29.0 release (#4280)
    • 0d18fe4 Use client-side create to prevent silent upsert of existing objects (#4278)
    • 8296942 Update GitHub Actions workflows. (#4279)
    • 9d2f6f8 Update module helm.sh/helm/v3 to v3.20.2 [SECURITY] (#4277)
    • 7d8fe4d Migrate Windows code signing to Azure Trusted Signing (#4274)
    • 374a2b2 Update GitHub Actions workflows. (#4275)
    • 065ada9 Update module go.opentelemetry.io/otel/sdk to v1.43.0 [SECURITY] (#4271)
    • c2f6707 Update module github.com/go-jose/go-jose/v3 to v3.0.5 [SECURITY] (#4268)
    • Additional commits viewable in compare view

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/pulumi/pulumi-kubernetes/sdk/v4&package-manager=go_modules&previous-version=4.28.0&new-version=4.29.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- deploy/go.mod | 31 ++++++++++++------------- deploy/go.sum | 64 +++++++++++++++++++++++++-------------------------- 2 files changed, 47 insertions(+), 48 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index 66bfb92..f473ce2 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -4,7 +4,7 @@ go 1.26 require ( github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 - github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.28.0 + github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.29.0 github.com/pulumi/pulumi/sdk/v3 v3.230.0 gopkg.in/yaml.v2 v2.4.0 ) @@ -23,7 +23,7 @@ require ( github.com/cespare/xxhash/v2 v2.3.0 // indirect github.com/charmbracelet/bubbles v1.0.0 // indirect github.com/charmbracelet/bubbletea v1.3.10 // indirect - github.com/charmbracelet/colorprofile v0.4.2 // indirect + github.com/charmbracelet/colorprofile v0.4.3 // indirect github.com/charmbracelet/lipgloss v1.1.0 // indirect github.com/charmbracelet/x/ansi v0.11.6 // indirect github.com/charmbracelet/x/cellbuf v0.0.15 // indirect @@ -59,7 +59,7 @@ require ( github.com/lucasb-eyer/go-colorful v1.3.0 // indirect github.com/mattn/go-isatty v0.0.20 // indirect github.com/mattn/go-localereader v0.0.1 // indirect - github.com/mattn/go-runewidth v0.0.20 // indirect + github.com/mattn/go-runewidth v0.0.21 // indirect github.com/mitchellh/go-ps v1.0.0 // indirect github.com/mitchellh/go-wordwrap v1.0.1 // indirect github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect @@ -83,7 +83,6 @@ require ( github.com/spf13/cast v1.4.1 // indirect github.com/spf13/cobra v1.10.2 // indirect github.com/spf13/pflag v1.0.10 // indirect - github.com/stretchr/objx v0.2.0 // indirect github.com/texttheater/golang-levenshtein v1.0.1 // indirect github.com/uber/jaeger-client-go v2.30.0+incompatible // indirect github.com/uber/jaeger-lib v2.4.1+incompatible // indirect @@ -94,25 +93,25 @@ require ( go.opentelemetry.io/collector/featuregate v1.53.0 // indirect go.opentelemetry.io/collector/pdata v1.53.0 // indirect go.opentelemetry.io/otel v1.43.0 // indirect - go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.41.0 // indirect - go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.41.0 // indirect + go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.42.0 // indirect + go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.42.0 // indirect go.opentelemetry.io/otel/metric v1.43.0 // indirect go.opentelemetry.io/otel/sdk v1.43.0 // indirect go.opentelemetry.io/otel/trace v1.43.0 // indirect - go.opentelemetry.io/proto/otlp v1.9.0 // indirect + go.opentelemetry.io/proto/otlp v1.10.0 // indirect go.uber.org/atomic v1.11.0 // indirect go.uber.org/multierr v1.11.0 // indirect - golang.org/x/crypto v0.48.0 // indirect + golang.org/x/crypto v0.49.0 // indirect golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 // indirect - golang.org/x/mod v0.32.0 // indirect - golang.org/x/net v0.51.0 // indirect - golang.org/x/sync v0.19.0 // indirect + golang.org/x/mod v0.33.0 // indirect + golang.org/x/net v0.52.0 // indirect + golang.org/x/sync v0.20.0 // indirect golang.org/x/sys v0.42.0 // indirect - golang.org/x/term v0.40.0 // indirect - golang.org/x/text v0.34.0 // indirect - golang.org/x/tools v0.41.0 // indirect - google.golang.org/genproto/googleapis/api v0.0.0-20260226221140-a57be14db171 // indirect - google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 // indirect + golang.org/x/term v0.41.0 // indirect + golang.org/x/text v0.35.0 // indirect + golang.org/x/tools v0.42.0 // indirect + google.golang.org/genproto/googleapis/api v0.0.0-20260311181403-84a4fc48630c // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20260311181403-84a4fc48630c // indirect google.golang.org/grpc v1.80.0 // indirect google.golang.org/protobuf v1.36.11 // indirect gopkg.in/warnings.v0 v0.1.2 // indirect diff --git a/deploy/go.sum b/deploy/go.sum index f6088ef..341e958 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -31,8 +31,8 @@ github.com/charmbracelet/bubbles v1.0.0 h1:12J8/ak/uCZEMQ6KU7pcfwceyjLlWsDLAxB5f github.com/charmbracelet/bubbles v1.0.0/go.mod h1:9d/Zd5GdnauMI5ivUIVisuEm3ave1XwXtD1ckyV6r3E= github.com/charmbracelet/bubbletea v1.3.10 h1:otUDHWMMzQSB0Pkc87rm691KZ3SWa4KUlvF9nRvCICw= github.com/charmbracelet/bubbletea v1.3.10/go.mod h1:ORQfo0fk8U+po9VaNvnV95UPWA1BitP1E0N6xJPlHr4= -github.com/charmbracelet/colorprofile v0.4.2 h1:BdSNuMjRbotnxHSfxy+PCSa4xAmz7szw70ktAtWRYrY= -github.com/charmbracelet/colorprofile v0.4.2/go.mod h1:0rTi81QpwDElInthtrQ6Ni7cG0sDtwAd4C4le060fT8= +github.com/charmbracelet/colorprofile v0.4.3 h1:QPa1IWkYI+AOB+fE+mg/5/4HRMZcaXex9t5KX76i20Q= +github.com/charmbracelet/colorprofile v0.4.3/go.mod h1:/zT4BhpD5aGFpqQQqw7a+VtHCzu+zrQtt1zhMt9mR4Q= github.com/charmbracelet/lipgloss v1.1.0 h1:vYXsiLHVkK7fp74RkV7b2kq9+zDLoEU4MZoFqR/noCY= github.com/charmbracelet/lipgloss v1.1.0/go.mod h1:/6Q8FR2o+kj8rz4Dq0zQc3vYf7X+B0binUUBwA0aL30= github.com/charmbracelet/x/ansi v0.11.6 h1:GhV21SiDz/45W9AnV2R61xZMRri5NlLnl6CVF7ihZW8= @@ -140,8 +140,8 @@ github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D github.com/mattn/go-localereader v0.0.1 h1:ygSAOl7ZXTx4RdPYinUpg6W99U8jWvWi9Ye2JC/oIi4= github.com/mattn/go-localereader v0.0.1/go.mod h1:8fBrzywKY7BI3czFoHkuzRoWE9C+EiG4R1k4Cjx5p88= github.com/mattn/go-runewidth v0.0.4/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU= -github.com/mattn/go-runewidth v0.0.20 h1:WcT52H91ZUAwy8+HUkdM3THM6gXqXuLJi9O3rjcQQaQ= -github.com/mattn/go-runewidth v0.0.20/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs= +github.com/mattn/go-runewidth v0.0.21 h1:jJKAZiQH+2mIinzCJIaIG9Be1+0NR+5sz/lYEEjdM8w= +github.com/mattn/go-runewidth v0.0.21/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs= github.com/mitchellh/go-ps v1.0.0 h1:i6ampVEEF4wQFF+bkYfwYgY+F/uYJDktmvLPf7qIgjc= github.com/mitchellh/go-ps v1.0.0/go.mod h1:J4lOc8z8yJs6vUwklHw2XEIiT4z4C40KtWVN3nvg8Pg= github.com/mitchellh/go-wordwrap v1.0.1 h1:TLuKupo69TCn6TQSyGxwI1EblZZEsQ0vMlAFQflz0v0= @@ -183,8 +183,8 @@ github.com/pulumi/esc v0.17.0 h1:oaVOIyFTENlYDuqc3pW75lQT9jb2cd6ie/4/Twxn66w= github.com/pulumi/esc v0.17.0/go.mod h1:XnSxlt5NkmuAj304l/gK4pRErFbtqq6XpfX1tYT9Jbc= github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 h1:w6OnO3d4j5yVf2vpm8OzXFC/xHOEGqt+9FjWCUBCq6U= github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1/go.mod h1:UyZyv7hz4knpFx6/Sh+SkZe6hT6sJHtDvw9A0TbvEsk= -github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.28.0 h1:muCE6cUJ4YmAaNLiOhbjEicxT+10i/EGsZrx2ZZQQ+o= -github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.28.0/go.mod h1:B998wofejDKAvvpLwsi4UMfWDFHHBnzYiM8mZ9e7OSo= +github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.29.0 h1:NHikF7fXARV//HEwK8wW8kBq+8TGf1pzSV1O946AXDY= +github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.29.0/go.mod h1:BAWI9R3JEEGOp1JlXLPSZKwBGANSrPGUWKtMnS5w5qw= github.com/pulumi/pulumi/sdk/v3 v3.230.0 h1:0TtF82Hlor39DLU0QtM7RZPwRaOmjn5UtQKPi1Mxo9M= github.com/pulumi/pulumi/sdk/v3 v3.230.0/go.mod h1:u0fgmmPGwV5b4rmfuNABuYfRoqckuaTivufPn4EtfTk= github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ= @@ -207,8 +207,8 @@ github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk= github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= -github.com/stretchr/objx v0.2.0 h1:Hbg2NidpLE8veEBkEZTL3CvlkUIVzuU9jDplZO54c48= -github.com/stretchr/objx v0.2.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE= +github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY= +github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA= github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs= github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4= @@ -239,10 +239,10 @@ go.opentelemetry.io/collector/pdata v1.53.0 h1:DlYDbRwammEZaxDZHINx5v0n8SEOVNniP go.opentelemetry.io/collector/pdata v1.53.0/go.mod h1:LRSYGNjKXaUrZEwZv3Yl+8/zV2HmRGKXW62zB2bysms= go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I= go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0= -go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.41.0 h1:ao6Oe+wSebTlQ1OEht7jlYTzQKE+pnx/iNywFvTbuuI= -go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.41.0/go.mod h1:u3T6vz0gh/NVzgDgiwkgLxpsSF6PaPmo2il0apGJbls= -go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.41.0 h1:mq/Qcf28TWz719lE3/hMB4KkyDuLJIvgJnFGcd0kEUI= -go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.41.0/go.mod h1:yk5LXEYhsL2htyDNJbEq7fWzNEigeEdV5xBF/Y+kAv0= +go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.42.0 h1:THuZiwpQZuHPul65w4WcwEnkX2QIuMT+UFoOrygtoJw= +go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.42.0/go.mod h1:J2pvYM5NGHofZ2/Ru6zw/TNWnEQp5crgyDeSrYpXkAw= +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.42.0 h1:zWWrB1U6nqhS/k6zYB74CjRpuiitRtLLi68VcgmOEto= +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.42.0/go.mod h1:2qXPNBX1OVRC0IwOnfo1ljoid+RD0QK3443EaqVlsOU= go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM= go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY= go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg= @@ -251,8 +251,8 @@ go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfC go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A= go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A= go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0= -go.opentelemetry.io/proto/otlp v1.9.0 h1:l706jCMITVouPOqEnii2fIAuO3IVGBRPV5ICjceRb/A= -go.opentelemetry.io/proto/otlp v1.9.0/go.mod h1:xE+Cx5E/eEHw+ISFkwPLwCZefwVjY+pqKg1qcK03+/4= +go.opentelemetry.io/proto/otlp v1.10.0 h1:IQRWgT5srOCYfiWnpqUYz9CVmbO8bFmKcwYxpuCSL2g= +go.opentelemetry.io/proto/otlp v1.10.0/go.mod h1:/CV4QoCR/S9yaPj8utp3lvQPoqMtxXdzn7ozvvozVqk= go.opentelemetry.io/proto/slim/otlp v1.9.0 h1:fPVMv8tP3TrsqlkH1HWYUpbCY9cAIemx184VGkS6vlE= go.opentelemetry.io/proto/slim/otlp v1.9.0/go.mod h1:xXdeJJ90Gqyll+orzUkY4bOd2HECo5JofeoLpymVqdI= go.opentelemetry.io/proto/slim/otlp/collector/profiles/v1development v0.2.0 h1:o13nadWDNkH/quoDomDUClnQBpdQQ2Qqv0lQBjIXjE8= @@ -270,29 +270,29 @@ golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACk golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4= -golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts= -golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos= +golang.org/x/crypto v0.49.0 h1:+Ng2ULVvLHnJ/ZFEq4KdcDd/cfjrrjjNSXNzxg0Y4U4= +golang.org/x/crypto v0.49.0/go.mod h1:ErX4dUh2UM+CFYiXZRTcMpEcN8b/1gxEuv3nODoYtCA= golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 h1:2dVuKD2vS7b0QIHQbpyTISPd0LeHDbnYEryqj5Q1ug8= golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56/go.mod h1:M4RDyNAINzryxdtnbRXRL/OHtkFuWGRjvuhBJpk2IlY= golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY= golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg= golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= -golang.org/x/mod v0.32.0 h1:9F4d3PHLljb6x//jOyokMv3eX+YDeepZSEo3mFJy93c= -golang.org/x/mod v0.32.0/go.mod h1:SgipZ/3h2Ci89DlEtEXWUk/HteuRin+HHhN+WbNhguU= +golang.org/x/mod v0.33.0 h1:tHFzIWbBifEmbwtGz65eaWyGiGZatSrT9prnU8DbVL8= +golang.org/x/mod v0.33.0/go.mod h1:swjeQEj+6r7fODbD2cqrnje9PnziFuw4bmLbBZFrQ5w= golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20200421231249-e086a090c8fd/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A= golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= -golang.org/x/net v0.51.0 h1:94R/GTO7mt3/4wIKpcR5gkGmRLOuE/2hNGeWq/GBIFo= -golang.org/x/net v0.51.0/go.mod h1:aamm+2QF5ogm02fjy5Bb7CQ0WMt1/WVM7FtyaTLlA9Y= +golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0= +golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4= -golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI= +golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4= +golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= @@ -310,31 +310,31 @@ golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo= golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= -golang.org/x/term v0.40.0 h1:36e4zGLqU4yhjlmxEaagx2KuYbJq3EwY8K943ZsHcvg= -golang.org/x/term v0.40.0/go.mod h1:w2P8uVp06p2iyKKuvXIm7N/y0UCRt3UfJTfZ7oOpglM= +golang.org/x/term v0.41.0 h1:QCgPso/Q3RTJx2Th4bDLqML4W6iJiaXFq2/ftQF13YU= +golang.org/x/term v0.41.0/go.mod h1:3pfBgksrReYfZ5lvYM0kSO0LIkAl4Yl2bXOkKP7Ec2A= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= -golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk= -golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA= +golang.org/x/text v0.35.0 h1:JOVx6vVDFokkpaq1AEptVzLTpDe9KGpj5tR4/X+ybL8= +golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20181030221726-6c7e314b6563/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28= golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE= golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA= -golang.org/x/tools v0.41.0 h1:a9b8iMweWG+S0OBnlU36rzLp20z1Rp10w+IY2czHTQc= -golang.org/x/tools v0.41.0/go.mod h1:XSY6eDqxVNiYgezAVqqCeihT4j1U2CCsqvH3WhQpnlg= +golang.org/x/tools v0.42.0 h1:uNgphsn75Tdz5Ji2q36v/nsFSfR/9BRFvqhGBaJGd5k= +golang.org/x/tools v0.42.0/go.mod h1:Ma6lCIwGZvHK6XtgbswSoWroEkhugApmsXyrUmBhfr0= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4= gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E= -google.golang.org/genproto/googleapis/api v0.0.0-20260226221140-a57be14db171 h1:tu/dtnW1o3wfaxCOjSLn5IRX4YDcJrtlpzYkhHhGaC4= -google.golang.org/genproto/googleapis/api v0.0.0-20260226221140-a57be14db171/go.mod h1:M5krXqk4GhBKvB596udGL3UyjL4I1+cTbK0orROM9ng= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171 h1:ggcbiqK8WWh6l1dnltU4BgWGIGo+EVYxCaAPih/zQXQ= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260226221140-a57be14db171/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= +google.golang.org/genproto/googleapis/api v0.0.0-20260311181403-84a4fc48630c h1:OyQPd6I3pN/9gDxz6L13kYGJgqkpdrAohJRBeXyxlgI= +google.golang.org/genproto/googleapis/api v0.0.0-20260311181403-84a4fc48630c/go.mod h1:X2gu9Qwng7Nn009s/r3RUxqkzQNqOrAy79bluY7ojIg= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260311181403-84a4fc48630c h1:xgCzyF2LFIO/0X2UAoVRiXKU5Xg6VjToG4i2/ecSswk= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260311181403-84a4fc48630c/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= google.golang.org/grpc v1.80.0 h1:Xr6m2WmWZLETvUNvIUmeD5OAagMw3FiKmMlTdViWsHM= google.golang.org/grpc v1.80.0/go.mod h1:ho/dLnxwi3EDJA4Zghp7k2Ec1+c2jqup0bFkw07bwF4= google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE= From fa450110e47d2f6a1e789da6f7f87b928fbaa417 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 21 Apr 2026 09:06:55 +0000 Subject: [PATCH 163/313] build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.230.0 to 3.231.0 in /deploy (#1176) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit [//]: # (dependabot-start) ⚠️ **Dependabot is rebasing this PR** ⚠️ Rebasing might not happen immediately, so don't worry if this takes some time. Note: if you make any changes to this PR yourself, they will take precedence over the rebase. --- [//]: # (dependabot-end) Bumps [github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from 3.230.0 to 3.231.0.
    Release notes

    Sourced from github.com/pulumi/pulumi/sdk/v3's releases.

    v3.231.0

    3.231.0 (2026-04-16)

    Features

    • [cli] Auto-detect Mercurial repository metadata for pulumi up / pulumi preview updates, mirroring existing Git support #22618

    • [engine] Send Cancel RPC to plugins on host close for graceful shutdown #22569

    • [engine] Pass resource options to hooks through the engine #22582

    • [engine] Add GetDeploymentInfo to the resource monitor service

    • [auto/go] Add New command to Automation API #22439

    • [auto/{go,nodejs,python}] Add --diff to automation api for destroy #22563

    • [auto/python] Add new command to Automation API #22439

    • [pcl] Support for resource hooks in PCL #22365

    • [sdk-nodejs] Warn when a non-ComponentResource class is passed in the explicit components list to componentProviderHost #22619

    • [sdk-python] Warn when a non-ComponentResource class is passed in the explicit components list to component_provider_host #22619

    • [cli/import] Add support for providers to be defined in the same import file as their users #21671

    • [cli/policy] ESC environment support for local policy packs #22495

    • [sdk/nodejs] Support package.yaml when using pnpm #22491

    • [sdk/python] Add function decorator variants for resource and error hooks #22519

    Bug Fixes

    ... (truncated)

    Changelog

    Sourced from github.com/pulumi/pulumi/sdk/v3's changelog.

    3.231.0 (2026-04-16)

    Features

    • [cli] Auto-detect Mercurial repository metadata for pulumi up / pulumi preview updates, mirroring existing Git support #22618

    • [engine] Send Cancel RPC to plugins on host close for graceful shutdown #22569

    • [engine] Pass resource options to hooks through the engine #22582

    • [engine] Add GetDeploymentInfo to the resource monitor service

    • [auto/go] Add New command to Automation API #22439

    • [auto/{go,nodejs,python}] Add --diff to automation api for destroy #22563

    • [auto/python] Add new command to Automation API #22439

    • [pcl] Support for resource hooks in PCL #22365

    • [sdk-nodejs] Warn when a non-ComponentResource class is passed in the explicit components list to componentProviderHost #22619

    • [sdk-python] Warn when a non-ComponentResource class is passed in the explicit components list to component_provider_host #22619

    • [cli/import] Add support for providers to be defined in the same import file as their users #21671

    • [cli/policy] ESC environment support for local policy packs #22495

    • [sdk/nodejs] Support package.yaml when using pnpm #22491

    • [sdk/python] Add function decorator variants for resource and error hooks #22519

    Bug Fixes

    • [auto/{nodejs,python}] Support --run-program for inline programs with preview_refresh/destroy

    ... (truncated)

    Commits
    • 5aaa649 Add GetDeploymentInfo to resource monitor (#22595)
    • e39b399 Support --run-program with inline programs for preview_refresh/destroy (#22590)
    • bd4b5db Go Automation API Codegen #1B: Generating helpers (#22061)
    • b5bb135 Python Automation API Codegen: use TypedDict for option types (#22602)
    • 5cb5c1d sdk/python: fix 'occured' -> 'occurred' in rpc.py doc comment (#22620)
    • b7c9d87 try to stop pkg 7/7 from flaking (#22611)
    • 00f5eb9 Auto-detect Mercurial VCS metadata for updates (#22618)
    • eff41c5 Warn when non-ComponentResource passed to component provider host (#22619)
    • fdbd324 Update dependency pulumi/pulumi-java to v1.24.0 (#22615)
    • 12c06b9 Update dependency pulumi/pulumi-yaml to v1.31.1 (#22610)
    • Additional commits viewable in compare view

    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- deploy/go.mod | 2 +- deploy/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index f473ce2..59b5f95 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -5,7 +5,7 @@ go 1.26 require ( github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.29.0 - github.com/pulumi/pulumi/sdk/v3 v3.230.0 + github.com/pulumi/pulumi/sdk/v3 v3.231.0 gopkg.in/yaml.v2 v2.4.0 ) diff --git a/deploy/go.sum b/deploy/go.sum index 341e958..b656041 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -185,8 +185,8 @@ github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 h1:w6OnO3d4j5yVf2vpm8OzXFC/xHOEGqt+9 github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1/go.mod h1:UyZyv7hz4knpFx6/Sh+SkZe6hT6sJHtDvw9A0TbvEsk= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.29.0 h1:NHikF7fXARV//HEwK8wW8kBq+8TGf1pzSV1O946AXDY= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.29.0/go.mod h1:BAWI9R3JEEGOp1JlXLPSZKwBGANSrPGUWKtMnS5w5qw= -github.com/pulumi/pulumi/sdk/v3 v3.230.0 h1:0TtF82Hlor39DLU0QtM7RZPwRaOmjn5UtQKPi1Mxo9M= -github.com/pulumi/pulumi/sdk/v3 v3.230.0/go.mod h1:u0fgmmPGwV5b4rmfuNABuYfRoqckuaTivufPn4EtfTk= +github.com/pulumi/pulumi/sdk/v3 v3.231.0 h1:iAulagysgpFd3l2k3B2fsNtvcEy1ruOkyi++vwVQE2w= +github.com/pulumi/pulumi/sdk/v3 v3.231.0/go.mod h1:l5TYGBUlKrkq3z/SbmTGIUD6JrzyRtPWI3wKZA+IXeo= github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ= github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88= github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ= From d8a1ea4e58a410a4c2e0f4a9150622b8b051699e Mon Sep 17 00:00:00 2001 From: Jeff MAURY Date: Fri, 24 Apr 2026 00:15:43 +0200 Subject: [PATCH 164/313] fix: update openapi.yml to include statusChangedAt (#1187) Fixes #1169 Update the openapi.yml to add a missing field ## Motivation and Context openapi.yml was not in sync with live data ## How Has This Been Tested? Validated the openapi.yml file ## Breaking Changes No ## Types of changes - [x] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] Documentation update ## Checklist - [x] I have read the [MCP Documentation](https://modelcontextprotocol.io) - [x] My code follows the repository's style guidelines - [x] New and existing tests pass locally - [ ] I have added appropriate error handling - [ ] I have added or updated documentation as needed ## Additional context Signed-off-by: Jeff MAURY Co-authored-by: Radoslav Dimitrov --- docs/reference/api/openapi.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/docs/reference/api/openapi.yaml b/docs/reference/api/openapi.yaml index 947ab24..faf8895 100644 --- a/docs/reference/api/openapi.yaml +++ b/docs/reference/api/openapi.yaml @@ -1039,6 +1039,11 @@ components: description: Optional message explaining the status (e.g., deprecation reason) example: "Please upgrade to version 2.0.0" maxLength: 500 + statusChangedAt: + type: string + format: date-time + description: Timestamp when the server status was last updated + example: "2023-12-01T10:30:00Z" publishedAt: type: string format: date-time From dac0982f6db8f391485d22f514e348cb8b86ea5a Mon Sep 17 00:00:00 2001 From: Ashwanthram K L <71945723+AshwanthramKL@users.noreply.github.com> Date: Fri, 24 Apr 2026 03:51:21 +0530 Subject: [PATCH 165/313] docs: signpost non-npm publishers to package-types from quickstart (#1192) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## What Two targeted additions to `docs/modelcontextprotocol-io/quickstart.mdx`: 1. A `` immediately after the tutorial's intro, telling PyPI / NuGet / OCI / MCPB publishers that the Step 1 ownership-verification mechanism differs for their package type and pointing them to [Package Types](./package-types) before continuing. 2. The troubleshooting row for **"Registry validation failed for package"** previously named only npm's `mcpName` property in `package.json`. It now names all three current mechanisms (npm → `mcpName` in `package.json`; PyPI / NuGet → `mcp-name: ` line in the package README; other types → link to Package Types). +5 / -1 lines. ## Why The quickstart is the landing page for new publishers, but it's entirely TypeScript / npm-flavored — the Step 1 example shows npm's `mcpName` property and nothing else. The cross-reference to `./package-types` only appears in the "Next Steps" footer, by which point a PyPI publisher has already gone through every step and hit a `400 Bad Request` at `mcp-publisher publish`: > `registry validation failed for package 0 (): PyPI package '' ownership validation failed. The server name 'io.github./' must appear as 'mcp-name: io.github./' in the package README` That specific error has tripped at least one other publisher (#531) and was what motivated this change. The ownership mechanism is correctly documented at `./package-types` — the fix is purely to route people there before they publish, not to duplicate the content. ## What this change is **not** - It does not propose changing the validation logic. - It does not duplicate content from `package-types.mdx` into the quickstart. - It does not add a separate PyPI-specific tutorial. The existing npm-flavored tutorial remains the canonical one; the note just tells non-npm readers which step is different. ## Verification - Change is docs-only; no build or test impact. - Link target `./package-types` is the same shape as the one already used in "Next Steps" of the same file. - Anchor `#step-1-add-verification-information-to-the-package` matches the existing heading's slug. ## Related - #531 — same validation error hit by another PyPI publisher; closed with a workaround but the quickstart wasn't updated. --- docs/modelcontextprotocol-io/quickstart.mdx | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/docs/modelcontextprotocol-io/quickstart.mdx b/docs/modelcontextprotocol-io/quickstart.mdx index b33fc17..41bc8fc 100644 --- a/docs/modelcontextprotocol-io/quickstart.mdx +++ b/docs/modelcontextprotocol-io/quickstart.mdx @@ -9,6 +9,10 @@ sidebarTitle: "Quickstart: Publish a Server" This tutorial will show you how to publish an MCP server written in TypeScript to the MCP Registry using the official `mcp-publisher` CLI tool. + + If you are publishing a non-npm package (PyPI, NuGet, OCI, MCPB), the overall flow is identical, but the ownership-verification step in [Step 1](#step-1-add-verification-information-to-the-package) is different per package type. See [Package Types](./package-types) for the verification mechanism that applies to your package, then return here and follow the remaining steps. + + ## Prerequisites - **Node.js** — This tutorial assumes the MCP server is written in TypeScript. @@ -279,7 +283,7 @@ You should see your server's metadata in the search results JSON: | Error Message | Action | | --- | --- | -|"Registry validation failed for package"|Ensure your package includes the required validation information (e.g, `mcpName` property in `package.json`).| +|"Registry validation failed for package"|Ensure your package includes the required ownership-verification marker for its package type. For npm this is `mcpName` in `package.json`; for PyPI and NuGet it is an `mcp-name: ` line (or HTML comment) in the package README; for other types see [Package Types](./package-types).| |"Invalid or expired Registry JWT token"|Re-authenticate by running `mcp-publisher login github`.| |"You do not have permission to publish this server"|Your authentication method doesn't match your server's namespace format. With GitHub auth, your server name must start with `io.github.your-username/`.| From 35b124379b915a0a0d0ce6ca99019cdcbdd97e97 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 24 Apr 2026 04:54:09 -0400 Subject: [PATCH 166/313] build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.231.0 to 3.232.0 in /deploy (#1194) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from 3.231.0 to 3.232.0.
    Release notes

    Sourced from github.com/pulumi/pulumi/sdk/v3's releases.

    v3.232.0

    3.232.0 (2026-04-22)

    Features

    • [cli] Add an experimental pulumi neo command that creates a Pulumi Neo agent task in CLI tool-execution mode and runs the local tool loop. Filesystem and shell tool calls issued by the agent run on the user's machine in their working directory; the interactive chat continues to happen in the Pulumi Console at the URL the command prints. Hidden behind PULUMI_EXPERIMENTAL.

      #22473

    • [cli] Add support for handling user approval requests in the pulumi neo terminal UI. When the agent requests confirmation for a sensitive action, the TUI prompts the user and forwards their response back to the Pulumi Console. Hidden behind PULUMI_EXPERIMENTAL.

      #22589

    • [cli] Add an interactive terminal UI for pulumi neo built with bubbletea, rendering agent messages, tool calls, and streaming output in the terminal alongside the Pulumi Console session. Hidden behind PULUMI_EXPERIMENTAL.

      #22570

    • [cli] Switch logging library from glog to slog.

    BREAKING: any if logging.V(x) { need to be changed to if logging.V(x).Enabled()

    #22548

    • [cli] Add a plan-mode toggle to the pulumi neo TUI, bound to Shift+Tab. When plan mode is on, Neo explores and asks questions without writing files, running pulumi up, or opening PRs, and surfaces an approved plan via a dedicated approval gate. The toggle must be set before the first message (plan mode is task-level on the wire); approving the proposed plan exits plan mode automatically.

      #22634

    • [cli] The pulumi neo TUI now drives its "thinking" spinner off a single declarative rule (the spinner stays on until a final event — final assistant message, approval request, cancellation, or error — lands), so the indicator no longer flickers off when the agent hands off tool calls to the CLI or when streaming text arrives between tools. Press Esc during a turn to ask the agent to cancel; the label switches to "Cancelling..." until the backend acknowledges.

      #22637

    ... (truncated)

    Changelog

    Sourced from github.com/pulumi/pulumi/sdk/v3's changelog.

    3.232.0 (2026-04-22)

    Features

    • [cli] Add an experimental pulumi neo command that creates a Pulumi Neo agent task in CLI tool-execution mode and runs the local tool loop. Filesystem and shell tool calls issued by the agent run on the user's machine in their working directory; the interactive chat continues to happen in the Pulumi Console at the URL the command prints. Hidden behind PULUMI_EXPERIMENTAL.

      #22473

    • [cli] Add support for handling user approval requests in the pulumi neo terminal UI. When the agent requests confirmation for a sensitive action, the TUI prompts the user and forwards their response back to the Pulumi Console. Hidden behind PULUMI_EXPERIMENTAL.

      #22589

    • [cli] Add an interactive terminal UI for pulumi neo built with bubbletea, rendering agent messages, tool calls, and streaming output in the terminal alongside the Pulumi Console session. Hidden behind PULUMI_EXPERIMENTAL.

      #22570

    • [cli] Switch logging library from glog to slog.

    BREAKING: any if logging.V(x) { need to be changed to if logging.V(x).Enabled()

    #22548

    • [cli] Add a plan-mode toggle to the pulumi neo TUI, bound to Shift+Tab. When plan mode is on, Neo explores and asks questions without writing files, running pulumi up, or opening PRs, and surfaces an approved plan via a dedicated approval gate. The toggle must be set before the first message (plan mode is task-level on the wire); approving the proposed plan exits plan mode automatically.

      #22634

    • [cli] The pulumi neo TUI now drives its "thinking" spinner off a single declarative rule (the spinner stays on until a final event — final assistant message, approval request, cancellation, or error — lands), so the indicator no longer flickers off when the agent hands off tool calls to the CLI or when streaming text arrives between tools. Press Esc during a turn to ask the agent to cancel; the label switches to "Cancelling..." until the backend acknowledges.

      #22637

    ... (truncated)

    Commits

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/pulumi/pulumi/sdk/v3&package-manager=go_modules&previous-version=3.231.0&new-version=3.232.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- deploy/go.mod | 3 +-- deploy/go.sum | 10 ++++------ 2 files changed, 5 insertions(+), 8 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index 59b5f95..3c86c89 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -5,7 +5,7 @@ go 1.26 require ( github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.29.0 - github.com/pulumi/pulumi/sdk/v3 v3.231.0 + github.com/pulumi/pulumi/sdk/v3 v3.232.0 gopkg.in/yaml.v2 v2.4.0 ) @@ -42,7 +42,6 @@ require ( github.com/go-logr/logr v1.4.3 // indirect github.com/go-logr/stdr v1.2.2 // indirect github.com/gogo/protobuf v1.3.2 // indirect - github.com/golang/glog v1.2.5 // indirect github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect github.com/google/uuid v1.6.0 // indirect github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 // indirect diff --git a/deploy/go.sum b/deploy/go.sum index b656041..2c2628b 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -84,8 +84,6 @@ github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre github.com/gogo/protobuf v1.3.1/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o= github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q= github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q= -github.com/golang/glog v1.2.5 h1:DrW6hGnjIhtvhOIiAKT6Psh/Kd/ldepEa81DKeiRJ5I= -github.com/golang/glog v1.2.5/go.mod h1:6AhwSGph0fcJtXVM/PEHPqZlFeoLxhs7/t5UDAwmO+w= github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 h1:f+oWsMOmNPc8JmEHVZIycC7hBoQxHH9pNKQORJNozsQ= github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8/go.mod h1:wcDNUvekVysuuOpQKo3191zZyTpiI6se1N1ULghS0sw= github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek= @@ -167,8 +165,8 @@ github.com/opentracing/opentracing-go v1.2.0 h1:uEJPy/1a5RIPAJ0Ov+OIO8OxWu77jEv+ github.com/opentracing/opentracing-go v1.2.0/go.mod h1:GxEUsuufX4nBwe+T+Wl9TAgYrxe9dPLANfrWvHYVTgc= github.com/pgavlin/fx v0.1.6 h1:r9jEg69DhNoCd3Xh0+5mIbdbS3PqWrVWujkY76MFRTU= github.com/pgavlin/fx v0.1.6/go.mod h1:KWZJ6fqBBSh8GxHYqwYCf3rYE7Gp2p0N8tJp8xv9u9M= -github.com/pgavlin/fx/v2 v2.0.10 h1:ggyQ6pB+lEQEbEae48Wh/X221eLOamMD7i01ISe88u4= -github.com/pgavlin/fx/v2 v2.0.10/go.mod h1:M/nF/ooAOy+NUBooYYXl2REARzJ/giPJxfMs8fINfKc= +github.com/pgavlin/fx/v2 v2.0.12 h1:SjjaJ68Dt8Z4zHwOpY/RPijd7lShs6xYupJbF9ra00M= +github.com/pgavlin/fx/v2 v2.0.12/go.mod h1:M/nF/ooAOy+NUBooYYXl2REARzJ/giPJxfMs8fINfKc= github.com/pjbgf/sha1cd v0.3.2 h1:a9wb0bp1oC2TGwStyn0Umc/IGKQnEgF0vVaZ8QF8eo4= github.com/pjbgf/sha1cd v0.3.2/go.mod h1:zQWigSxVmsHEZow5qaLtPYxpcKMMQpa09ixqBxuCS6A= github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4= @@ -185,8 +183,8 @@ github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 h1:w6OnO3d4j5yVf2vpm8OzXFC/xHOEGqt+9 github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1/go.mod h1:UyZyv7hz4knpFx6/Sh+SkZe6hT6sJHtDvw9A0TbvEsk= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.29.0 h1:NHikF7fXARV//HEwK8wW8kBq+8TGf1pzSV1O946AXDY= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.29.0/go.mod h1:BAWI9R3JEEGOp1JlXLPSZKwBGANSrPGUWKtMnS5w5qw= -github.com/pulumi/pulumi/sdk/v3 v3.231.0 h1:iAulagysgpFd3l2k3B2fsNtvcEy1ruOkyi++vwVQE2w= -github.com/pulumi/pulumi/sdk/v3 v3.231.0/go.mod h1:l5TYGBUlKrkq3z/SbmTGIUD6JrzyRtPWI3wKZA+IXeo= +github.com/pulumi/pulumi/sdk/v3 v3.232.0 h1:pU9j5qYHYtYZGaIKha1KFuB9ggp2obcMD1U523tpEnk= +github.com/pulumi/pulumi/sdk/v3 v3.232.0/go.mod h1:33NoTpvQXlTtAuaPbompgZNA3Ye4XEvxNydELFlWza8= github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ= github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88= github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ= From a1a3303af92a666538f4525b7a3c7785aa53a37b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Yusufhan=20Sa=C3=A7ak?= <67666222+JosephDoUrden@users.noreply.github.com> Date: Fri, 24 Apr 2026 12:47:24 +0300 Subject: [PATCH 167/313] feat(publisher): copy version from package.json and prefer mcpName in init (#1145) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary Addresses two related enhancements to `mcp-publisher init`: - **Copy `version` from `package.json`** (#736): When `package.json` is present and contains a `version` field, it is now used for both the top-level `version` and `packages[].version` in the generated `server.json`. Falls back to `"1.0.0"` when unavailable. This aligns with the recommended best practice of keeping server version in sync with package version. - **Prefer `mcpName` over `name`** (#737): The init command now checks for `mcpName` in `package.json` first, falling back to `name` if `mcpName` is not defined. This ensures the generated server name matches the required `mcpName` property. Closes #736 Closes #737 ## Changes - `cmd/publisher/commands/init.go`: - Added `getVersionFromPackageJSON()` helper to read version from `package.json` - Modified `InitCommand()` to use detected version with `"1.0.0"` fallback - Modified `getNameFromPackageJSON()` to prefer `mcpName` over `name` ## Test plan - [x] `go build ./cmd/publisher/...` compiles without errors - [x] `go test ./cmd/publisher/commands/...` passes all existing tests - [ ] Manual: run `mcp-publisher init` in a directory with `package.json` containing `version` and `mcpName` — verify both are copied to `server.json` - [ ] Manual: run `mcp-publisher init` in a directory with `package.json` without `mcpName` — verify `name` is used as fallback - [ ] Manual: run `mcp-publisher init` in a directory without `package.json` — verify defaults (`"1.0.0"`, directory name) are used ## AI Disclosure AI assistance (Claude) was used for initial code exploration and issue research. The implementation was written and reviewed by the author. Co-authored-by: Radoslav Dimitrov --- cmd/publisher/commands/init.go | 32 +++++++++++++++++++++++++++++--- 1 file changed, 29 insertions(+), 3 deletions(-) diff --git a/cmd/publisher/commands/init.go b/cmd/publisher/commands/init.go index 8d0b505..8e645f5 100644 --- a/cmd/publisher/commands/init.go +++ b/cmd/publisher/commands/init.go @@ -27,7 +27,10 @@ func InitCommand() error { // Try to detect values from environment name := detectServerName(subfolder) description := detectDescription() - version := "1.0.0" + version := getVersionFromPackageJSON() + if version == "" { + version = "1.0.0" + } repoURL := detectRepoURL() repoSource := MethodGitHub if repoURL != "" && !strings.Contains(repoURL, "github.com") { @@ -140,9 +143,13 @@ func getNameFromPackageJSON() string { return "" } - name, ok := pkg["name"].(string) + // Prefer mcpName over name, as the server name must match mcpName + name, ok := pkg["mcpName"].(string) if !ok || name == "" { - return "" + name, ok = pkg["name"].(string) + if !ok || name == "" { + return "" + } } // Convert npm package name to MCP server name @@ -156,6 +163,25 @@ func getNameFromPackageJSON() string { return fmt.Sprintf("io.github./%s", name) } +func getVersionFromPackageJSON() string { + data, err := os.ReadFile("package.json") + if err != nil { + return "" + } + + var pkg map[string]any + if err := json.Unmarshal(data, &pkg); err != nil { + return "" + } + + version, ok := pkg["version"].(string) + if !ok || version == "" { + return "" + } + + return version +} + func detectServerName(subfolder string) string { // Try to get from git remote repoURL := detectRepoURL() From 7c446e75ad01b4c28746042539884e4109e4d21c Mon Sep 17 00:00:00 2001 From: Mikel Olasagasti Uranga Date: Fri, 24 Apr 2026 12:11:46 +0200 Subject: [PATCH 168/313] feat(oci): add support for Quay.io registry (#1150) Adds support for the Quay.io container registry to the OCI validator. This allows MCP servers hosted on Quay.io to be registered and validated by the official registry. ## Motivation and Context Quay.io is a major, trusted public OCI registry widely used by the cloud-native and open-source communities. Currently, attempting to publish a server using a Quay image results in an unsupported OCI registry error. This change enables developers to use Quay.io as a first-class hosting option for their MCP server images. ## How Has This Been Tested? - **Unit Tests:** Updated `internal/validators/registries/oci_test.go` to transition Quay.io from a rejected test case to an allowed one. - **Pattern Matching:** Verified that the allowlist correctly handles both specific image identifiers and general pattern matching for the `quay.io` host. - **Local Validation:** Ran `make check` to ensure no regressions in the existing OCI validation logic. ## Breaking Changes No. This is an additive change that expands the allowlist of supported registries. Existing configurations are unaffected. ## Types of changes - [ ] Bug fix (non-breaking change which fixes an issue) - [x] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [x] Documentation update ## Checklist - [x] I have read the [MCP Documentation](https://modelcontextprotocol.io) - [x] My code follows the repository's style guidelines - [x] New and existing tests pass locally - [x] I have added appropriate error handling - [x] I have added or updated documentation as needed ## Additional context The implementation follows the existing pattern for OCI registries: 1. Added a `RegistryURLQuay` constant to `pkg/model` for consistency. 2. Hardcoded `quay.io` into the `allowedOCIRegistries` map in the validator to minimize architectural complexity. 3. Updated all relevant documentation files (`package-types.mdx`, `generic-server-json.md`, and `official-registry-requirements.md`) to ensure the source of truth is updated across the project. 4. Validation remains scoped to public images; no private registry authentication was added for this host. Signed-off-by: Mikel Olasagasti Uranga Co-authored-by: Radoslav Dimitrov --- .../modelcontextprotocol-io/package-types.mdx | 3 ++- .../server-json/generic-server-json.md | 20 ++++++++++++++++ .../official-registry-requirements.md | 1 + internal/validators/registries/oci.go | 3 +++ internal/validators/registries/oci_test.go | 24 ++++++++++++------- pkg/model/constants.go | 7 +++--- tools/validate-examples/main.go | 2 +- 7 files changed, 47 insertions(+), 13 deletions(-) diff --git a/docs/modelcontextprotocol-io/package-types.mdx b/docs/modelcontextprotocol-io/package-types.mdx index 9014302..b7a31b9 100644 --- a/docs/modelcontextprotocol-io/package-types.mdx +++ b/docs/modelcontextprotocol-io/package-types.mdx @@ -131,6 +131,7 @@ For Docker/OCI images, the MCP Registry currently supports: - Docker Hub (`docker.io`) - GitHub Container Registry (`ghcr.io`) +- Quay.io (`quay.io`) - Google Artifact Registry (any `*.pkg.dev` domain) - Azure Container Registry (`*.azurecr.io`) - Microsoft Container Registry (`mcr.microsoft.com`) @@ -156,7 +157,7 @@ Docker/OCI images use `"registryType": "oci"` in `server.json`. For example: } ``` -The format of `identifier` is `registry/namespace/repository:tag`. For example, `docker.io/user/app:1.0.0` or `ghcr.io/user/app:1.0.0`. The tag can also be specified as a digest. +The format of `identifier` is `registry/namespace/repository:tag`. For example, `docker.io/user/app:1.0.0`, `ghcr.io/user/app:1.0.0`, or `quay.io/myorg/my-mcp-server:1.0.0`. The tag can also be specified as a digest. ### Ownership Verification diff --git a/docs/reference/server-json/generic-server-json.md b/docs/reference/server-json/generic-server-json.md index 1b1aff1..bb5cc44 100644 --- a/docs/reference/server-json/generic-server-json.md +++ b/docs/reference/server-json/generic-server-json.md @@ -264,6 +264,26 @@ This will essentially instruct the MCP client to execute `dnx Knapcode.SampleMcp } ``` +The same `registryType` / `identifier` pattern works for other supported OCI hosts. For example, an image on Quay.io: + +```json +{ + "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json", + "name": "io.github.example/quay-sample-mcp", + "description": "Example MCP server distributed as an OCI image on Quay.io", + "version": "1.0.0", + "packages": [ + { + "registryType": "oci", + "identifier": "quay.io/myorg/my-mcp-server:1.0.0", + "transport": { + "type": "stdio" + } + } + ] +} +``` + ### Remote Server Example ```json diff --git a/docs/reference/server-json/official-registry-requirements.md b/docs/reference/server-json/official-registry-requirements.md index 494458f..ec456cc 100644 --- a/docs/reference/server-json/official-registry-requirements.md +++ b/docs/reference/server-json/official-registry-requirements.md @@ -36,6 +36,7 @@ Only trusted public registries are supported. Private registries and alternative - **Docker/OCI**: - Docker Hub (`docker.io`) - GitHub Container Registry (`ghcr.io`) + - Quay.io (`quay.io`) - Google Artifact Registry (`*.pkg.dev`) - Azure Container Registry (`*.azurecr.io`) - Microsoft Container Registry (`mcr.microsoft.com`) diff --git a/internal/validators/registries/oci.go b/internal/validators/registries/oci.go index 6932d7f..d4ab56c 100644 --- a/internal/validators/registries/oci.go +++ b/internal/validators/registries/oci.go @@ -33,6 +33,8 @@ var allowedOCIRegistries = map[string]bool{ "index.docker.io": true, // Docker Hub index // GitHub Container Registry "ghcr.io": true, + // Red Hat Quay + "quay.io": true, // Microsoft Container Registry "mcr.microsoft.com": true, // Google Artifact Registry (*.pkg.dev pattern handled in isAllowedRegistry) @@ -49,6 +51,7 @@ var allowedOCIRegistries = map[string]bool{ // Supported registries: // - Docker Hub (docker.io) // - GitHub Container Registry (ghcr.io) +// - Quay.io (quay.io) // - Google Artifact Registry (*.pkg.dev) // - Microsoft Container Registry (mcr.microsoft.com) func ValidateOCI(ctx context.Context, pkg model.Package, serverName string) error { diff --git a/internal/validators/registries/oci_test.go b/internal/validators/registries/oci_test.go index 634e2e5..fddf446 100644 --- a/internal/validators/registries/oci_test.go +++ b/internal/validators/registries/oci_test.go @@ -66,6 +66,13 @@ func TestValidateOCI_RegistryAllowlist(t *testing.T) { errorMsg: "missing required annotation", mustNotContainMsg: "unsupported OCI registry", }, + { + name: "Quay.io should be allowed", + identifier: "quay.io/prometheus/node-exporter:v1.7.0", + expectError: true, + errorMsg: "missing required annotation", + mustNotContainMsg: "unsupported OCI registry", + }, // Removed ACR test with non-existent host - ACR support is tested elsewhere // Disallowed registries @@ -75,12 +82,6 @@ func TestValidateOCI_RegistryAllowlist(t *testing.T) { expectError: true, errorMsg: "unsupported OCI registry", }, - { - name: "Quay.io should be rejected", - identifier: "quay.io/test/image:latest", - expectError: true, - errorMsg: "unsupported OCI registry", - }, { name: "ECR Public should be rejected", identifier: "public.ecr.aws/test/image:latest", @@ -134,8 +135,9 @@ func TestValidateOCI_RegistryAllowlist(t *testing.T) { } func TestValidateOCI_RegistryPatterns(t *testing.T) { - // This test verifies registry pattern matching (wildcards like *.azurecr.io and *.pkg.dev) - // without relying on external images that may not exist + // Verifies allowlist behavior: wildcard hosts (*.azurecr.io, *.pkg.dev) and fixed hosts + // like quay.io. shouldFail=false means the error must not be "unsupported OCI registry" + // (validation may still error later, for example missing annotation or image not found). tests := []struct { name string identifier string @@ -156,6 +158,12 @@ func TestValidateOCI_RegistryPatterns(t *testing.T) { identifier: "us-west1-docker.pkg.dev/project/repo/image:tag", shouldFail: false, }, + { + name: "Quay.io host should be allowed", + identifier: "quay.io/nonexistent/mcp-registry-fake-repo:v1", + // Past allowlist; fake repo typically yields "does not exist", not unsupported registry + shouldFail: false, + }, { name: "GCR should be rejected at registry check", identifier: "gcr.io/project/image:latest", diff --git a/pkg/model/constants.go b/pkg/model/constants.go index e817f2a..ead176d 100644 --- a/pkg/model/constants.go +++ b/pkg/model/constants.go @@ -11,11 +11,12 @@ const ( // Registry Base URLs - supported package registry base URLs const ( - RegistryURLNPM = "https://registry.npmjs.org" - RegistryURLPyPI = "https://pypi.org" - RegistryURLNuGet = "https://api.nuget.org/v3/index.json" RegistryURLGitHub = "https://github.com" RegistryURLGitLab = "https://gitlab.com" + RegistryURLNPM = "https://registry.npmjs.org" + RegistryURLNuGet = "https://api.nuget.org/v3/index.json" + RegistryURLPyPI = "https://pypi.org" + RegistryURLQuay = "https://quay.io" ) // Transport Types - supported remote transport protocols diff --git a/tools/validate-examples/main.go b/tools/validate-examples/main.go index 54a7e4b..2f8be56 100644 --- a/tools/validate-examples/main.go +++ b/tools/validate-examples/main.go @@ -33,7 +33,7 @@ func main() { func runValidation() error { // Define what we validate and how - expectedServerJSONCount := 15 + expectedServerJSONCount := 16 targets := []validationTarget{ { path: filepath.Join("docs", "reference", "server-json", "generic-server-json.md"), From aaa634ebb69ffd57643dd5efec6c2aa0575b9e4f Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Sat, 25 Apr 2026 10:14:11 -0400 Subject: [PATCH 169/313] fix(publisher): honor mcpName as the authoritative server name in init (#1195) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary Follow-up to #1145. When `mcpName` is set in `package.json`, it should be the server name used by `mcp-publisher init`. Two issues addressed: ### 1. `getNameFromPackageJSON` mangled `mcpName` through npm-name transformation `mcpName` values are already in MCP server name format (e.g. `io.github.foo/bar`). The existing code ran them through the `@scope/name → io.github.scope/name` transform and its `io.github./*` fallback, producing a broken double-prefix result. Example with `"mcpName": "io.github.acme/weather"`: - Before: `io.github./io.github.acme/weather` ❌ - After: `io.github.acme/weather` ✅ ### 2. `detectServerName` consulted git before `mcpName` Even with `mcpName` set in `package.json`, a github.com git remote (or a `repository` field) silently won — the function returned `io.github./` and never looked at `mcpName`. Per the [quickstart docs](https://github.com/modelcontextprotocol/registry/blob/main/docs/modelcontextprotocol-io/quickstart.mdx), *"The value of `mcpName` will be your server's name in the MCP Registry"*, so `mcpName` should take precedence. ## Changes - `cmd/publisher/commands/init.go`: - New `getMcpNameFromPackageJSON()` helper that returns `mcpName` or `""`. - `detectServerName` checks `mcpName` first, before git remote and the `name`-based fallback. - `getNameFromPackageJSON` simplified — the now-redundant `mcpName` branch was removed; it only handles the npm `name` transformation. - `cmd/publisher/commands/init_test.go` (new): 5 cases through the public `InitCommand` API covering `mcpName` as-is, fallback to scoped `name`, fallback to placeholder, version fallback, and `mcpName` winning over a GitHub `repository` URL. This completes the fix for #737. ## Test plan - [x] `go test ./cmd/publisher/commands/` passes (5 new subtests) - [x] `golangci-lint run ./cmd/publisher/commands/` clean - [ ] Manual: `mcp-publisher init` in a git-tracked directory with `package.json` containing `mcpName` produces a `server.json` whose `name` matches `mcpName`, not the repo slug 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.7 (1M context) --- cmd/publisher/commands/init.go | 37 +++++++++--- cmd/publisher/commands/init_test.go | 92 +++++++++++++++++++++++++++++ 2 files changed, 122 insertions(+), 7 deletions(-) create mode 100644 cmd/publisher/commands/init_test.go diff --git a/cmd/publisher/commands/init.go b/cmd/publisher/commands/init.go index 8e645f5..92d6c8a 100644 --- a/cmd/publisher/commands/init.go +++ b/cmd/publisher/commands/init.go @@ -132,6 +132,26 @@ func detectSubfolder() string { return filepath.ToSlash(relPath) } +// getMcpNameFromPackageJSON returns the `mcpName` field from package.json, or +// "" if not set. mcpName is the authoritative MCP server name when present — +// see docs/modelcontextprotocol-io/quickstart.mdx. +func getMcpNameFromPackageJSON() string { + data, err := os.ReadFile("package.json") + if err != nil { + return "" + } + + var pkg map[string]any + if err := json.Unmarshal(data, &pkg); err != nil { + return "" + } + + if mcpName, ok := pkg["mcpName"].(string); ok && mcpName != "" { + return mcpName + } + return "" +} + func getNameFromPackageJSON() string { data, err := os.ReadFile("package.json") if err != nil { @@ -143,17 +163,13 @@ func getNameFromPackageJSON() string { return "" } - // Prefer mcpName over name, as the server name must match mcpName - name, ok := pkg["mcpName"].(string) + name, ok := pkg["name"].(string) if !ok || name == "" { - name, ok = pkg["name"].(string) - if !ok || name == "" { - return "" - } + return "" } // Convert npm package name to MCP server name - // @org/package -> io.npm.org/package + // @org/package -> io.github.org/package if strings.HasPrefix(name, "@") { parts := strings.Split(name[1:], "/") if len(parts) == 2 { @@ -183,6 +199,13 @@ func getVersionFromPackageJSON() string { } func detectServerName(subfolder string) string { + // mcpName in package.json is the authoritative server name when set, so it + // takes precedence over names inferred from the git remote or the npm + // `name` field. + if name := getMcpNameFromPackageJSON(); name != "" { + return name + } + // Try to get from git remote repoURL := detectRepoURL() if repoURL != "" && strings.Contains(repoURL, "github.com") { diff --git a/cmd/publisher/commands/init_test.go b/cmd/publisher/commands/init_test.go new file mode 100644 index 0000000..e7f3fdb --- /dev/null +++ b/cmd/publisher/commands/init_test.go @@ -0,0 +1,92 @@ +package commands_test + +import ( + "encoding/json" + "os" + "path/filepath" + "testing" + + "github.com/modelcontextprotocol/registry/cmd/publisher/commands" + apiv0 "github.com/modelcontextprotocol/registry/pkg/api/v0" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +func TestInitCommand_PackageJSON(t *testing.T) { + tests := []struct { + name string + pkgJSON string + expectedName string + expectedVersion string + }{ + { + name: "mcpName is returned as-is without transformation", + pkgJSON: `{"name": "@acme/weather", "mcpName": "io.github.acme/weather-mcp", "version": "2.3.4", "repository": "https://gitlab.com/acme/weather"}`, + expectedName: "io.github.acme/weather-mcp", + expectedVersion: "2.3.4", + }, + { + name: "empty mcpName falls back to scoped name transformation", + pkgJSON: `{"name": "@acme/weather", "mcpName": "", "version": "1.2.3", "repository": "https://gitlab.com/acme/weather"}`, + expectedName: "io.github.acme/weather", + expectedVersion: "1.2.3", + }, + { + name: "missing mcpName falls back to scoped name transformation", + pkgJSON: `{"name": "@acme/weather", "version": "1.2.3", "repository": "https://gitlab.com/acme/weather"}`, + expectedName: "io.github.acme/weather", + expectedVersion: "1.2.3", + }, + { + name: "missing version falls back to 1.0.0", + pkgJSON: `{"name": "@acme/weather", "mcpName": "io.github.acme/weather", "repository": "https://gitlab.com/acme/weather"}`, + expectedName: "io.github.acme/weather", + expectedVersion: "1.0.0", + }, + { + name: "mcpName takes precedence over GitHub repository URL", + pkgJSON: `{"name": "weather", "mcpName": "io.github.acme/weather-mcp", "version": "1.0.0", "repository": "https://github.com/someone-else/some-repo"}`, + expectedName: "io.github.acme/weather-mcp", + expectedVersion: "1.0.0", + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + dir := withIsolatedPackageJSON(t, tt.pkgJSON) + + require.NoError(t, commands.InitCommand()) + + data, err := os.ReadFile(filepath.Join(dir, "server.json")) + require.NoError(t, err) + + var got apiv0.ServerJSON + require.NoError(t, json.Unmarshal(data, &got)) + + assert.Equal(t, tt.expectedName, got.Name) + assert.Equal(t, tt.expectedVersion, got.Version) + require.Len(t, got.Packages, 1) + assert.Equal(t, tt.expectedVersion, got.Packages[0].Version, + "package version should match server version") + }) + } +} + +// withIsolatedPackageJSON creates a temp dir outside any git repository, +// writes package.json with the given contents, chdirs into it, and returns +// the directory path. The HOME override prevents init from detecting the +// host repo's git state. +func withIsolatedPackageJSON(t *testing.T, contents string) string { + t.Helper() + + dir := t.TempDir() + require.NoError(t, os.WriteFile(filepath.Join(dir, "package.json"), []byte(contents), 0600)) + + originalDir, err := os.Getwd() + require.NoError(t, err) + t.Cleanup(func() { _ = os.Chdir(originalDir) }) + + require.NoError(t, os.Chdir(dir)) + + return dir +} From ccb7057c3314640718b71e813594c9ec28b712f5 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Sat, 25 Apr 2026 10:15:00 -0400 Subject: [PATCH 170/313] docs: note PostgreSQL requirement for prebuilt Docker image (#1196) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary - Clarifies in the README that the prebuilt Docker image does not bundle PostgreSQL and needs an external instance reachable via \`MCP_REGISTRY_DATABASE_URL\` - Points readers to \`docker-compose.yml\` as a working multi-container example Closes #723 ## Test plan - [ ] Render the README on GitHub and verify the note appears in the "Alternative: Running a pre-built Docker image" section 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.7 (1M context) --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 3a456de..cbd9670 100644 --- a/README.md +++ b/README.md @@ -54,7 +54,7 @@ The setup can be configured with environment variables in [docker-compose.yml](.
    Alternative: Running a pre-built Docker image -Pre-built Docker images are automatically published to GitHub Container Registry: +Pre-built Docker images are automatically published to GitHub Container Registry. Note that the image does not bundle PostgreSQL, so you need to run your own and point the registry at it via `MCP_REGISTRY_DATABASE_URL` (see [docker-compose.yml](./docker-compose.yml) for a working example): ```bash # Run latest stable release From 8b893ae1f1e029273b5c70857def8858a7b9852e Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Sat, 25 Apr 2026 10:15:32 -0400 Subject: [PATCH 171/313] docs: recommend namespaced subkeys inside publisher-provided (#1197) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary - Adds a short "Recommended: Namespaced Subkeys" subsection to `official-registry-requirements.md`, documenting the reverse-DNS subkey convention for `publisher-provided` metadata with one worked example - Explicitly notes this is not enforced, to avoid churning the ~15 existing flat-key examples elsewhere in the docs Closes #477 ## Test plan - [ ] Render the file on GitHub and verify the new subsection appears right after the `Publisher-Provided Metadata` size-limit note 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.7 (1M context) --- .../official-registry-requirements.md | 22 +++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/docs/reference/server-json/official-registry-requirements.md b/docs/reference/server-json/official-registry-requirements.md index ec456cc..e03b659 100644 --- a/docs/reference/server-json/official-registry-requirements.md +++ b/docs/reference/server-json/official-registry-requirements.md @@ -69,6 +69,28 @@ When publishing to the official registry, **only data under the specific key `io **Size limit:** The publisher-provided extension is limited to 4KB (4096 bytes) of JSON. If the marshaled JSON exceeds this limit, publishing will fail with an error indicating the actual size. +#### Recommended: Namespaced Subkeys + +When your `publisher-provided` metadata gets large or comes from multiple sources (e.g. GitHub-specific hints alongside your own CI tool's metadata), grouping keys under reverse-DNS subkeys is a useful convention to avoid accidental collisions: + +```jsonc +{ + "_meta": { + "io.modelcontextprotocol.registry/publisher-provided": { + "com.github": { + "serverDisplayName": "My Server" + }, + "io.example.ci-publisher": { + "tool": "ci-publisher", + "version": "1.0.0" + } + } + } +} +``` + +This is **not enforced**; flat keys work fine for simple cases, and existing examples in this repo use the flat form. Use the namespaced form when organizing metadata from more than one source. + ### Registry API Metadata vs server.json Metadata The `_meta` field in `server.json` is **different** from the `_meta` field returned in registry API responses: From c5f50e817b3dba2da74dd30533e196938e200348 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Sat, 25 Apr 2026 11:22:06 -0400 Subject: [PATCH 172/313] fix(auth): better DNS verification errors and wrong-selector hint (#1202) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary DNS auth users have repeatedly hit two failure modes that both produce the same opaque "Ed25519 signature verification failed" error, making them indistinguishable to debug. This PR makes both diagnosable end-to-end without changing the auth protocol or any successful path. The two recurring failure modes: 1. **Wrong placement** — TXT record put under a selector (`_mcp-auth.` or `_mcp-registry.`) instead of the apex. DKIM-style intuition, but MCP DNS auth uses SPF-style apex placement. See #385 (PR #388 fixed the docs but the failure recurred), #1103, #1126. 2. **Stale apex record** — old TXT record left behind after a key rotation, silently tried first and rejected. ## Changes **`internal/api/handlers/v0/auth/dns.go`** — when the apex has no `v=MCPv1` record, probe `_mcp-auth.` and `_mcp-registry.` in parallel (2s individual timeout). If a record is found there, return a targeted error pointing the user at the apex. Costs zero extra DNS work in the success path. **`internal/api/handlers/v0/auth/common.go`** — when verification fails against records that *are* present, include short fingerprints of every key the registry tried (`ed25519:YJLsHFhu`-style 8-char prefix). A new `ErrSignatureMismatch` sentinel keeps structural errors (wrong signature size, unsupported algorithm) passing through unchanged via `errors.Is`, so existing assertions on those messages still hold. **`docs/modelcontextprotocol-io/authentication.mdx`** — anti-pattern `` callout in the DNS section explicitly warning against selector placement and stale records. **Tests** — two new tests: - `TestDNSAuthHandler_WrongSelectorProbe` — verifies the probe surfaces records found at `_mcp-auth.` / `_mcp-registry.` and falls through to the standard error when nothing is found anywhere - `TestDNSAuthHandler_StaleKeyFingerprintInError` — verifies the fingerprint hint appears in the failure message for #1126's exact scenario One existing test assertion was updated from a generic `"signature verification failed"` substring to the more specific `"invalid signature size for ECDSA P-384"` it should always have been asserting; the new sentinel-based logic surfaces structural errors verbatim. ## Test plan - [x] `make lint` — clean - [x] `make test-unit` — all auth tests pass (existing + 2 new) - [x] Verified existing single-key and multi-key paths preserve their original (more specific) error messages where they were already specific - [ ] Reviewer to sanity-check the docs callout renders well in the Mintlify theme ## Out of scope The publisher-side preflight DNS check (cross-link in #845) is intentionally **not** in this PR — that belongs in the broader CLI UX work tracked by #845. Refs #845, #385, #1103 Fixes #1126 --------- Co-authored-by: Claude Opus 4.7 (1M context) --- .../authentication.mdx | 6 ++ internal/api/handlers/v0/auth/common.go | 83 ++++++++++++++-- internal/api/handlers/v0/auth/dns.go | 59 +++++++++++ internal/api/handlers/v0/auth/dns_test.go | 99 ++++++++++++++++++- 4 files changed, 236 insertions(+), 11 deletions(-) diff --git a/docs/modelcontextprotocol-io/authentication.mdx b/docs/modelcontextprotocol-io/authentication.mdx index c18268c..f5af3ad 100644 --- a/docs/modelcontextprotocol-io/authentication.mdx +++ b/docs/modelcontextprotocol-io/authentication.mdx @@ -51,6 +51,12 @@ Successfully authenticated! DNS authentication is a domain-based authentication method that relies on a DNS TXT record. + + The TXT record must be placed on the **apex** of your domain (e.g. `example.com`), **not** under a selector like `_mcp-auth.example.com` or `_mcp-registry.example.com`. MCP DNS auth follows SPF-style placement (apex), not DKIM-style (selector). If you put the record under a selector, the registry will not see it and authentication will fail with a generic signature error. + + If you rotate keys, also remember to remove the previous TXT record from the apex — a stale record left behind will be tried first and cause verification to fail. + + To perform DNS authentication using the `mcp-publisher` CLI tool, run the following commands in your server project directory to generate a TXT record based on a public/private key pair: diff --git a/internal/api/handlers/v0/auth/common.go b/internal/api/handlers/v0/auth/common.go index 40a6ba7..2f763d6 100644 --- a/internal/api/handlers/v0/auth/common.go +++ b/internal/api/handlers/v0/auth/common.go @@ -8,6 +8,7 @@ import ( "crypto/sha512" "encoding/base64" "encoding/hex" + "errors" "fmt" "math/big" "regexp" @@ -18,6 +19,17 @@ import ( "github.com/modelcontextprotocol/registry/internal/config" ) +// ErrSignatureMismatch is returned by VerifySignature when the signature is structurally +// valid but does not verify against the public key. Distinguishing this from structural +// failures (wrong size, bad key format) lets the caller add fingerprint hints only when +// the failure is actually a "wrong key" situation. +var ErrSignatureMismatch = errors.New("signature does not match public key") + +// MCPProofRecordPattern matches a well-formed MCPv1 DNS/HTTP proof record: +// "v=MCPv1; k=; p=". Shared so callers checking for the +// presence of a valid record see exactly what the parser will accept. +var MCPProofRecordPattern = regexp.MustCompile(`v=MCPv1;\s*k=([^;]+);\s*p=([A-Za-z0-9+/=]+)`) + // CryptoAlgorithm represents the cryptographic algorithm used for a public key type CryptoAlgorithm string @@ -90,18 +102,72 @@ func DecodeAndValidateSignature(signedTimestamp string) ([]byte, error) { } func VerifySignatureWithKeys(publicKeys []PublicKeyInfo, messageBytes []byte, signature []byte) error { + var lastErr error + allMismatch := true for _, publicKeyInfo := range publicKeys { err := publicKeyInfo.VerifySignature(messageBytes, signature) if err == nil { return nil } - - if len(publicKeys) == 1 { - return err + lastErr = err + if !errors.Is(err, ErrSignatureMismatch) { + allMismatch = false } } - return fmt.Errorf("signature verification failed") + // If at least one key failed for a structural reason (wrong size, unsupported algorithm), + // surface that error directly — it's more actionable than a generic "didn't match" message. + if !allMismatch { + return lastErr + } + + // Every key was tried and produced a clean cryptographic mismatch. Include short + // fingerprints of every key that was tried so users can tell which published keys the + // registry actually saw — the most common cause of this error is a stale record left + // behind after a key rotation, which is otherwise indistinguishable from a generic + // crypto failure. + fingerprints := make([]string, 0, len(publicKeys)) + for _, publicKeyInfo := range publicKeys { + fingerprints = append(fingerprints, publicKeyInfo.Fingerprint()) + } + if len(publicKeys) == 1 { + return fmt.Errorf( + "signature verification failed (tried published key %s); "+ + "if this is not the key you are signing with, the published record may be stale", + fingerprints[0], + ) + } + return fmt.Errorf( + "signature verification failed against all %d published keys (tried: %s); "+ + "if you recently rotated keys, remove any stale records from the apex domain", + len(publicKeys), strings.Join(fingerprints, ", "), + ) +} + +// Fingerprint returns a short, human-readable identifier for the public key. +// Format: ":". Public keys are not secret, +// but truncating keeps error messages readable. +func (pki *PublicKeyInfo) Fingerprint() string { + const prefixLen = 8 + var raw []byte + switch pki.Algorithm { + case AlgorithmEd25519: + if k, ok := pki.Key.(ed25519.PublicKey); ok { + raw = k + } + case AlgorithmECDSAP384: + if k, ok := pki.Key.(ecdsa.PublicKey); ok { + raw = elliptic.MarshalCompressed(k.Curve, k.X, k.Y) //nolint:staticcheck // SA1019: matches the encoding used in DNS records + } + } + if len(raw) == 0 { + return fmt.Sprintf("%s:unknown", pki.Algorithm) + } + encoded := base64.StdEncoding.EncodeToString(raw) + if len(encoded) > prefixLen { + encoded = encoded[:prefixLen] + } + return fmt.Sprintf("%s:%s", pki.Algorithm, encoded) } // VerifySignature verifies a signature using the appropriate algorithm @@ -113,7 +179,7 @@ func (pki *PublicKeyInfo) VerifySignature(message, signature []byte) error { return fmt.Errorf("invalid signature size for Ed25519") } if !ed25519.Verify(ed25519Key, message, signature) { - return fmt.Errorf("Ed25519 signature verification failed") + return fmt.Errorf("Ed25519: %w", ErrSignatureMismatch) } return nil } @@ -126,7 +192,7 @@ func (pki *PublicKeyInfo) VerifySignature(message, signature []byte) error { s := new(big.Int).SetBytes(signature[48:]) digest := sha512.Sum384(message) if !ecdsa.Verify(&ecdsaKey, digest[:], r, s) { - return fmt.Errorf("ECDSA P-384 signature verification failed") + return fmt.Errorf("ECDSA P-384: %w", ErrSignatureMismatch) } return nil } @@ -246,11 +312,8 @@ func ParseMCPKeysFromStrings(inputs []string) []struct { error } - // proof record pattern: v=MCPv1; k=; p= - cryptoPattern := regexp.MustCompile(`v=MCPv1;\s*k=([^;]+);\s*p=([A-Za-z0-9+/=]+)`) - for _, record := range inputs { - if matches := cryptoPattern.FindStringSubmatch(record); len(matches) == 3 { + if matches := MCPProofRecordPattern.FindStringSubmatch(record); len(matches) == 3 { publicKey, err := ParsePublicKey(matches[1], matches[2]) publicKeys = append(publicKeys, struct { *PublicKeyInfo diff --git a/internal/api/handlers/v0/auth/dns.go b/internal/api/handlers/v0/auth/dns.go index 5129486..cc18082 100644 --- a/internal/api/handlers/v0/auth/dns.go +++ b/internal/api/handlers/v0/auth/dns.go @@ -75,6 +75,11 @@ func RegisterDNSEndpoint(api huma.API, pathPrefix string, cfg *config.Config) { }) } +// commonWrongSelectors lists subdomain prefixes that users frequently mistake for the +// MCP DNS auth record location (DKIM-style intuition). MCP DNS auth uses the apex, +// like SPF — see #385, #1103, #1126 for the recurring confusion. +var commonWrongSelectors = []string{"_mcp-auth", "_mcp-registry"} + // ExchangeToken exchanges DNS signature for a Registry JWT token func (h *DNSAuthHandler) ExchangeToken(ctx context.Context, domain, timestamp, signedTimestamp string) (*auth.TokenResponse, error) { keyFetcher := func(ctx context.Context, domain string) ([]string, error) { @@ -90,9 +95,63 @@ func (h *DNSAuthHandler) ExchangeToken(ctx context.Context, domain, timestamp, s if err != nil { return nil, fmt.Errorf("failed to lookup DNS TXT records: %w", err) } + + if !hasMCPRecord(txtRecords) { + if found := h.findMisplacedSelector(timeoutCtx, domain); found != "" { + return nil, fmt.Errorf( + "no MCPv1 TXT record at %q, but one was found at %q — "+ + "MCP DNS auth requires the record at the apex domain, not under a selector", + domain, found, + ) + } + } + return txtRecords, nil } allowSubdomains := true return h.CoreAuthHandler.ExchangeToken(ctx, domain, timestamp, signedTimestamp, keyFetcher, allowSubdomains, auth.MethodDNS) } + +// hasMCPRecord reports whether any of the supplied TXT records contains a well-formed +// MCPv1 proof record. Uses the same strict pattern as the parser so a malformed +// "v=MCPv1" string at the apex doesn't suppress the misplaced-selector probe. +func hasMCPRecord(records []string) bool { + for _, r := range records { + if MCPProofRecordPattern.MatchString(r) { + return true + } + } + return false +} + +// findMisplacedSelector probes a small fixed set of common wrong selectors and returns the +// first one that holds an MCPv1 record, or "" if none do. Lookups run in parallel with a +// short individual timeout so a slow/missing zone never delays the response by much. +func (h *DNSAuthHandler) findMisplacedSelector(ctx context.Context, domain string) string { + type result struct { + name string + found bool + } + results := make(chan result, len(commonWrongSelectors)) + for _, selector := range commonWrongSelectors { + name := selector + "." + domain + go func(name string) { + lookupCtx, cancel := context.WithTimeout(ctx, 2*time.Second) + defer cancel() + records, err := h.resolver.LookupTXT(lookupCtx, name) + if err != nil { + results <- result{name: name, found: false} + return + } + results <- result{name: name, found: hasMCPRecord(records)} + }(name) + } + for range commonWrongSelectors { + r := <-results + if r.found { + return r.name + } + } + return "" +} diff --git a/internal/api/handlers/v0/auth/dns_test.go b/internal/api/handlers/v0/auth/dns_test.go index f0f3a56..b4895ab 100644 --- a/internal/api/handlers/v0/auth/dns_test.go +++ b/internal/api/handlers/v0/auth/dns_test.go @@ -546,7 +546,7 @@ func TestDNSAuthHandler_ExchangeToken_ECDSAP384(t *testing.T) { timestamp: time.Now().UTC().Format(time.RFC3339), signedTimestamp: "abcdef1234", // too short for ECDSA P-384 expectError: true, - errorContains: "signature verification failed", // general error when trying all keys + errorContains: "invalid signature size for ECDSA P-384", }, { name: "wrong ECDSA P-384 key for signature", @@ -990,3 +990,100 @@ func TestDNSAuthHandler_Mixed_Algorithm_Support(t *testing.T) { assert.NotNil(t, result) }) } + +// TestDNSAuthHandler_WrongSelectorProbe covers the case where the user mistakenly placed +// the MCPv1 TXT record under a selector (e.g. _mcp-auth.) instead of the apex, +// which has been a recurring source of confusion (#385, #1103, #1126). +func TestDNSAuthHandler_WrongSelectorProbe(t *testing.T) { + cfg := &config.Config{ + JWTPrivateKey: "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef", + } + + publicKey, _, err := ed25519.GenerateKey(nil) + require.NoError(t, err) + publicKeyB64 := base64.StdEncoding.EncodeToString(publicKey) + mcpRecord := fmt.Sprintf("v=MCPv1; k=ed25519; p=%s", publicKeyB64) + + tests := []struct { + name string + txtRecords map[string][]string + expectInError string + }{ + { + name: "record placed at _mcp-auth selector", + txtRecords: map[string][]string{ + "_mcp-auth." + testDomain: {mcpRecord}, + }, + expectInError: "_mcp-auth." + testDomain, + }, + { + name: "record placed at _mcp-registry selector", + txtRecords: map[string][]string{ + "_mcp-registry." + testDomain: {mcpRecord}, + }, + expectInError: "_mcp-registry." + testDomain, + }, + { + name: "no record anywhere falls through to standard error", + txtRecords: map[string][]string{ + testDomain: {"v=spf1 ~all"}, + }, + expectInError: "no MCP public key found in DNS TXT records", + }, + { + name: "malformed MCPv1 string at apex still triggers selector probe", + txtRecords: map[string][]string{ + // Looks like an MCPv1 record but missing the public key field. + testDomain: {"v=MCPv1; k=ed25519"}, + "_mcp-auth." + testDomain: {mcpRecord}, + }, + expectInError: "_mcp-auth." + testDomain, + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + handler := auth.NewDNSAuthHandler(cfg) + handler.SetResolver(&MockDNSResolver{txtRecords: tt.txtRecords}) + + timestamp := time.Now().UTC().Format(time.RFC3339) + _, err := handler.ExchangeToken(context.Background(), testDomain, timestamp, hex.EncodeToString(make([]byte, 64))) + + require.Error(t, err) + assert.Contains(t, err.Error(), tt.expectInError) + }) + } +} + +// TestDNSAuthHandler_StaleKeyFingerprintInError covers #1126: when only one apex record is +// published and it doesn't match the key being signed with (the typical "rotated and forgot +// to update DNS" failure), the error message should include a fingerprint of the published +// key so the user can tell their CLI is signing with a different key than what's published. +func TestDNSAuthHandler_StaleKeyFingerprintInError(t *testing.T) { + cfg := &config.Config{ + JWTPrivateKey: "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef", + } + + stalePublicKey, _, err := ed25519.GenerateKey(nil) + require.NoError(t, err) + stalePublicKeyB64 := base64.StdEncoding.EncodeToString(stalePublicKey) + + _, currentPrivateKey, err := ed25519.GenerateKey(nil) + require.NoError(t, err) + + handler := auth.NewDNSAuthHandler(cfg) + handler.SetResolver(&MockDNSResolver{ + txtRecords: map[string][]string{ + testDomain: {fmt.Sprintf("v=MCPv1; k=ed25519; p=%s", stalePublicKeyB64)}, + }, + }) + + timestamp := time.Now().UTC().Format(time.RFC3339) + signature := ed25519.Sign(currentPrivateKey, []byte(timestamp)) + _, err = handler.ExchangeToken(context.Background(), testDomain, timestamp, hex.EncodeToString(signature)) + + require.Error(t, err) + expectedFingerprint := "ed25519:" + stalePublicKeyB64[:8] + assert.Contains(t, err.Error(), expectedFingerprint, "error should expose the published key's fingerprint") + assert.Contains(t, err.Error(), "stale", "error should hint at the stale-record cause") +} From 0cb1f6bf521906eeccf84cf7d3faf4e05825b084 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Sat, 25 Apr 2026 11:59:28 -0400 Subject: [PATCH 173/313] fix: recalculate isLatest after status changes (#1081) (#1201) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary Fixes #1081. When the version flagged `is_latest` was soft-deleted, no other version was promoted, and because `GetCurrentLatestVersion` didn't filter deleted rows, subsequent publishes with a lower semver never became latest — leaving `/v0/servers/{name}/versions/latest` permanently 404. This PR has two parts: ### 1. Code fix — recalculate `is_latest` on every status change - Recalculate `is_latest` after every status mutation (`UpdateServerStatus`, `UpdateAllVersionsStatus`, and the inline status change in `UpdateServer`), in the same transaction that already holds the per-server advisory lock. - Winner selection reuses the existing `CompareVersions` logic: highest non-deleted version gets the flag; if every version is deleted, the highest deleted version keeps it so admin lookups via `includeDeleted=true` still resolve the server (important for restore flows). - New `SetLatestVersion` DB primitive issues two statements (clear old, set new) — `idx_unique_latest_per_server` is a non-deferrable unique partial index, so a single `UPDATE` that flips two rows trips the constraint. ### 2. One-shot migration — heal servers already affected (no manual SQL needed) `014_heal_is_latest.sql` promotes the highest non-deleted version on every server whose `is_latest` flag is on a deleted row (or absent entirely). Picker parses `major.minor.patch` numerically and falls back to `published_at` for non-semver or as a tiebreaker. Heals `io.github.containers/kubernetes-mcp-server` to `0.0.61` automatically and catches any other servers silently affected by the original bug, without hardcoded version numbers. Picker behavior vs. `CompareVersions`: - Standard `M.m.p` semver: matches exactly, including the backport-after-delete case (e.g. published 1.0.1 then 1.0.0 hotfix after deleting 2.0.0 → picks 1.0.1, not 1.0.0). - Non-semver: falls through to `published_at DESC`. Reasonable. - Prereleases (`1.0.0-alpha` vs `1.0.0`): both parse to `(1,0,0)`, tiebreak by `published_at`. Diverges from `CompareVersions` (which always says `1.0.0 > 1.0.0-alpha`). Edge case requires (a) server hit by this bug AND (b) prereleases at the top of the version list. Acceptable; the publisher can flip it with one `mcp-publisher status` call (which now triggers proper recalc thanks to part 1). ## Verification End-to-end curl repro of the exact scenario from the issue, run against both `main` and this branch: **Before (main):** ``` publish 1.0.0 → 200 publish 0.0.59 → 200 PATCH .../1.0.0/status {deleted} → 200 GET /versions/latest → 404 ← bug publish 0.0.60 → 200 GET /versions/latest → 404 ← bug persists, 0.0.60 has isLatest=False ``` **After (this branch):** ``` publish 1.0.0 → 200 publish 0.0.59 → 200 PATCH .../1.0.0/status {deleted} → 200 GET /versions/latest → 200 (0.0.59, isLatest=true) publish 0.0.60 → 200 GET /versions/latest → 200 (0.0.60, isLatest=true) ``` ## Test plan - [x] Service tests covering: soft-delete latest → next highest active promoted; the exact #1081 repro end-to-end through the service; all-versions-deleted still keeps highest addressable for admin; restore-to-higher-version reclaims latest. - [x] Migration tests covering: kubernetes-mcp-server scenario (heals to highest semver); backport scenario (semver beats most-recent-published); no-is_latest-row defensive case; all-deleted server left untouched; healthy server left untouched; non-semver versions fall back to `published_at`. - [x] Full unit test suite (`./internal/... ./cmd/...`) passes against a real Postgres. - [x] `make lint` (0 issues) and `make validate` pass. - [x] Manual curl repro against a running registry confirms the fix resolves the failure mode and `main` still reproduces it. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.7 (1M context) --- internal/database/database.go | 4 + .../migrations/014_heal_is_latest.sql | 51 ++++++ internal/database/postgres.go | 34 ++++ internal/database/postgres_test.go | 147 +++++++++++++++++ internal/service/registry_service.go | 80 ++++++++- internal/service/registry_service_test.go | 154 ++++++++++++++++++ 6 files changed, 465 insertions(+), 5 deletions(-) create mode 100644 internal/database/migrations/014_heal_is_latest.sql diff --git a/internal/database/database.go b/internal/database/database.go index c9acf07..b4a797f 100644 --- a/internal/database/database.go +++ b/internal/database/database.go @@ -57,6 +57,10 @@ type Database interface { CheckVersionExists(ctx context.Context, tx pgx.Tx, serverName, version string) (bool, error) // UnmarkAsLatest marks the current latest version of a server as no longer latest UnmarkAsLatest(ctx context.Context, tx pgx.Tx, serverName string) error + // SetLatestVersion sets is_latest=true on the given version and false on all other + // versions of the same server. Passing an empty version clears is_latest for all rows. + // Callers must hold the per-server publish lock to avoid races. + SetLatestVersion(ctx context.Context, tx pgx.Tx, serverName, version string) error // AcquirePublishLock acquires an exclusive advisory lock for publishing a server // This prevents race conditions when multiple versions are published concurrently AcquirePublishLock(ctx context.Context, tx pgx.Tx, serverName string) error diff --git a/internal/database/migrations/014_heal_is_latest.sql b/internal/database/migrations/014_heal_is_latest.sql new file mode 100644 index 0000000..30e860c --- /dev/null +++ b/internal/database/migrations/014_heal_is_latest.sql @@ -0,0 +1,51 @@ +-- Heal servers whose is_latest flag is on a deleted version (or missing entirely) +-- by promoting the highest-semver non-deleted version. Falls back to published_at +-- for non-semver versions and as a tiebreaker for prereleases. +-- See https://github.com/modelcontextprotocol/registry/issues/1081. +-- +-- The migration framework wraps each migration in its own transaction, so no explicit +-- BEGIN/COMMIT here. + +-- Pre-compute the version to promote per affected server. A temp table is used +-- (rather than CTEs) because the two UPDATEs that follow run as separate statements: +-- the unique partial index idx_unique_latest_per_server is non-deferrable and Postgres +-- checks it row-by-row inside a single UPDATE, so the clear and the set must be split. +CREATE TEMP TABLE _heal_picks ON COMMIT DROP AS +WITH broken AS ( + -- Servers where no non-deleted version is flagged is_latest, but at least one + -- non-deleted version exists. Catches "is_latest is on a deleted row" and the + -- defensive case where no row has is_latest at all. + SELECT server_name + FROM servers + GROUP BY server_name + HAVING COUNT(*) FILTER (WHERE is_latest AND status <> 'deleted') = 0 + AND COUNT(*) FILTER (WHERE status <> 'deleted') > 0 +), +parsed AS ( + SELECT s.server_name, s.version, s.published_at, + (regexp_match(s.version, '^(\d+)\.(\d+)\.(\d+)'))[1]::int AS major, + (regexp_match(s.version, '^(\d+)\.(\d+)\.(\d+)'))[2]::int AS minor, + (regexp_match(s.version, '^(\d+)\.(\d+)\.(\d+)'))[3]::int AS patch + FROM servers s + JOIN broken b USING (server_name) + WHERE s.status <> 'deleted' +) +SELECT DISTINCT ON (server_name) server_name, version +FROM parsed +ORDER BY server_name, + major DESC NULLS LAST, + minor DESC NULLS LAST, + patch DESC NULLS LAST, + published_at DESC; + +-- Clear stale is_latest=true on rows of affected servers (typically the deleted row). +UPDATE servers s +SET is_latest = false +WHERE s.server_name IN (SELECT server_name FROM _heal_picks) + AND s.is_latest; + +-- Promote the chosen version. +UPDATE servers s +SET is_latest = true +FROM _heal_picks p +WHERE s.server_name = p.server_name AND s.version = p.version; diff --git a/internal/database/postgres.go b/internal/database/postgres.go index a86e44b..e40359a 100644 --- a/internal/database/postgres.go +++ b/internal/database/postgres.go @@ -877,6 +877,40 @@ func (db *PostgreSQL) UnmarkAsLatest(ctx context.Context, tx pgx.Tx, serverName return nil } +// SetLatestVersion sets is_latest=true on the given version and false on all other versions +// of the same server. Passing an empty version clears is_latest for all rows. +// +// The clear and set are issued as separate statements because the unique partial index +// idx_unique_latest_per_server is non-deferrable and Postgres checks it row-by-row within +// a single UPDATE, which would trip when flipping one row's flag off and another's on. +func (db *PostgreSQL) SetLatestVersion(ctx context.Context, tx pgx.Tx, serverName, version string) error { + if ctx.Err() != nil { + return ctx.Err() + } + + executor := db.getExecutor(tx) + + if _, err := executor.Exec(ctx, + `UPDATE servers SET is_latest = false WHERE server_name = $1 AND is_latest = true AND version <> $2`, + serverName, version, + ); err != nil { + return fmt.Errorf("failed to clear previous latest version: %w", err) + } + + if version == "" { + return nil + } + + if _, err := executor.Exec(ctx, + `UPDATE servers SET is_latest = true WHERE server_name = $1 AND version = $2 AND is_latest = false`, + serverName, version, + ); err != nil { + return fmt.Errorf("failed to set latest version: %w", err) + } + + return nil +} + // Close closes the database connection func (db *PostgreSQL) Close() error { db.pool.Close() diff --git a/internal/database/postgres_test.go b/internal/database/postgres_test.go index 9b6a5da..d0e4b97 100644 --- a/internal/database/postgres_test.go +++ b/internal/database/postgres_test.go @@ -3,6 +3,7 @@ package database_test import ( "context" "fmt" + "os" "testing" "time" @@ -1734,6 +1735,152 @@ func TestPostgreSQL_IncludeDeletedFilter(t *testing.T) { }) } +// TestMigration014_HealIsLatest exercises migrations/014_heal_is_latest.sql against +// synthetic broken states by re-running its SQL after seeding rows directly. The migration +// itself ran via the template DB; since it's idempotent (only matches servers with no +// non-deleted is_latest row), re-running it here only acts on the rows we just broke. +func TestMigration014_HealIsLatest(t *testing.T) { + db := database.NewTestDB(t) + ctx := context.Background() + + migrationSQL, err := os.ReadFile("migrations/014_heal_is_latest.sql") + require.NoError(t, err) + + createVersion := func(t *testing.T, name, version string, publishedAt time.Time, status model.Status, isLatest bool) { + t.Helper() + serverJSON := &apiv0.ServerJSON{ + Schema: model.CurrentSchemaURL, + Name: name, + Description: "test", + Version: version, + } + officialMeta := &apiv0.RegistryExtensions{ + Status: status, + StatusChangedAt: publishedAt, + PublishedAt: publishedAt, + UpdatedAt: publishedAt, + IsLatest: isLatest, + } + _, err := db.CreateServer(ctx, nil, serverJSON, officialMeta) + require.NoError(t, err) + } + + runHeal := func(t *testing.T) { + t.Helper() + err := db.InTransaction(ctx, func(ctx context.Context, tx pgx.Tx) error { + _, err := tx.Exec(ctx, string(migrationSQL)) + return err + }) + require.NoError(t, err) + } + + versionState := func(t *testing.T, name, version string) (model.Status, bool) { + t.Helper() + v, err := db.GetServerByNameAndVersion(ctx, nil, name, version, true) + require.NoError(t, err) + return v.Meta.Official.Status, v.Meta.Official.IsLatest + } + + t.Run("kubernetes-mcp-server scenario picks highest semver", func(t *testing.T) { + name := "io.test/k8s-scenario" + base := time.Now().Add(-10 * time.Hour) + // 1.0.0 published first, then 0.0.50, 0.0.51, 0.0.59, 0.0.60, 0.0.61. + // 1.0.0 was the original latest and got soft-deleted, leaving is_latest stranded. + createVersion(t, name, "1.0.0", base, model.StatusDeleted, true) + createVersion(t, name, "0.0.50", base.Add(1*time.Hour), model.StatusActive, false) + createVersion(t, name, "0.0.51", base.Add(2*time.Hour), model.StatusActive, false) + createVersion(t, name, "0.0.59", base.Add(3*time.Hour), model.StatusActive, false) + createVersion(t, name, "0.0.60", base.Add(4*time.Hour), model.StatusActive, false) + createVersion(t, name, "0.0.61", base.Add(5*time.Hour), model.StatusActive, false) + + runHeal(t) + + _, isLatest := versionState(t, name, "1.0.0") + assert.False(t, isLatest, "deleted 1.0.0 should no longer be latest") + _, isLatest = versionState(t, name, "0.0.61") + assert.True(t, isLatest, "highest active version should become latest") + for _, v := range []string{"0.0.50", "0.0.51", "0.0.59", "0.0.60"} { + _, isLatest := versionState(t, name, v) + assert.False(t, isLatest, "version %s should not be latest", v) + } + }) + + t.Run("backport scenario picks highest semver not most recent", func(t *testing.T) { + // Published 2.0.0 (deleted), then 1.0.1 hotfix, then 1.0.0 (older patch backported later). + // Most-recent-published would pick 1.0.0; semver-aware picks 1.0.1. + name := "io.test/backport-scenario" + base := time.Now().Add(-10 * time.Hour) + createVersion(t, name, "2.0.0", base, model.StatusDeleted, true) + createVersion(t, name, "1.0.1", base.Add(1*time.Hour), model.StatusActive, false) + createVersion(t, name, "1.0.0", base.Add(2*time.Hour), model.StatusActive, false) + + runHeal(t) + + _, isLatest := versionState(t, name, "1.0.1") + assert.True(t, isLatest, "1.0.1 should win on semver despite 1.0.0 being published more recently") + _, isLatest = versionState(t, name, "1.0.0") + assert.False(t, isLatest) + }) + + t.Run("no is_latest row at all gets healed", func(t *testing.T) { + // Defensive case: nothing flagged latest, but active versions exist. + name := "io.test/no-latest-flag" + base := time.Now().Add(-10 * time.Hour) + createVersion(t, name, "1.0.0", base, model.StatusActive, false) + createVersion(t, name, "1.1.0", base.Add(1*time.Hour), model.StatusActive, false) + + runHeal(t) + + _, isLatest := versionState(t, name, "1.1.0") + assert.True(t, isLatest) + _, isLatest = versionState(t, name, "1.0.0") + assert.False(t, isLatest) + }) + + t.Run("all-deleted server is left untouched", func(t *testing.T) { + // No non-deleted version → nothing to promote, leave existing flags alone so the + // server remains addressable via includeDeleted=true admin lookups. + name := "io.test/all-deleted" + base := time.Now().Add(-10 * time.Hour) + createVersion(t, name, "1.0.0", base, model.StatusDeleted, true) + createVersion(t, name, "2.0.0", base.Add(1*time.Hour), model.StatusDeleted, false) + + runHeal(t) + + _, isLatest := versionState(t, name, "1.0.0") + assert.True(t, isLatest, "all-deleted server should keep its existing latest flag") + _, isLatest = versionState(t, name, "2.0.0") + assert.False(t, isLatest) + }) + + t.Run("healthy server is left untouched", func(t *testing.T) { + name := "io.test/healthy" + base := time.Now().Add(-10 * time.Hour) + createVersion(t, name, "1.0.0", base, model.StatusActive, false) + createVersion(t, name, "2.0.0", base.Add(1*time.Hour), model.StatusActive, true) + + runHeal(t) + + _, isLatest := versionState(t, name, "2.0.0") + assert.True(t, isLatest) + _, isLatest = versionState(t, name, "1.0.0") + assert.False(t, isLatest) + }) + + t.Run("non-semver versions fall back to published_at", func(t *testing.T) { + name := "io.test/non-semver" + base := time.Now().Add(-10 * time.Hour) + createVersion(t, name, "rolling", base, model.StatusDeleted, true) + createVersion(t, name, "build-100", base.Add(1*time.Hour), model.StatusActive, false) + createVersion(t, name, "build-200", base.Add(2*time.Hour), model.StatusActive, false) + + runHeal(t) + + _, isLatest := versionState(t, name, "build-200") + assert.True(t, isLatest, "without semver, most recently published wins") + }) +} + // Helper functions for creating pointers to basic types func stringPtr(s string) *string { return &s diff --git a/internal/service/registry_service.go b/internal/service/registry_service.go index 05c4f16..4f4b8a0 100644 --- a/internal/service/registry_service.go +++ b/internal/service/registry_service.go @@ -164,6 +164,59 @@ func (s *registryServiceImpl) createServerInTransaction(ctx context.Context, tx return s.db.CreateServer(ctx, tx, &serverJSON, officialMeta) } +// recalculateLatest picks the highest non-deleted version of the given server and flags it +// as latest, clearing is_latest on every other row. If every version is deleted, the highest +// deleted version keeps the flag so admin lookups (GetServerByName with includeDeleted=true) +// still find the server. Caller must hold the per-server publish lock. +func (s *registryServiceImpl) recalculateLatest(ctx context.Context, tx pgx.Tx, serverName string) error { + versions, err := s.db.GetAllVersionsByServerName(ctx, tx, serverName, true) + if err != nil { + if errors.Is(err, database.ErrNotFound) { + return s.db.SetLatestVersion(ctx, tx, serverName, "") + } + return fmt.Errorf("failed to load versions for latest recalculation: %w", err) + } + + winner := pickLatestVersion(versions, false) + if winner == nil { + // No non-deleted versions — fall back to highest deleted so the server is still + // addressable via includeDeleted=true lookups. + winner = pickLatestVersion(versions, true) + } + + winnerVersion := "" + if winner != nil { + winnerVersion = winner.Server.Version + } + return s.db.SetLatestVersion(ctx, tx, serverName, winnerVersion) +} + +// pickLatestVersion returns the highest version from the given slice. If allowDeleted is +// false, deleted versions are skipped. +func pickLatestVersion(versions []*apiv0.ServerResponse, allowDeleted bool) *apiv0.ServerResponse { + var winner *apiv0.ServerResponse + for _, v := range versions { + if !allowDeleted && v.Meta.Official != nil && v.Meta.Official.Status == model.StatusDeleted { + continue + } + if winner == nil { + winner = v + continue + } + var winnerPublishedAt, candidatePublishedAt time.Time + if winner.Meta.Official != nil { + winnerPublishedAt = winner.Meta.Official.PublishedAt + } + if v.Meta.Official != nil { + candidatePublishedAt = v.Meta.Official.PublishedAt + } + if CompareVersions(v.Server.Version, winner.Server.Version, candidatePublishedAt, winnerPublishedAt) > 0 { + winner = v + } + } + return winner +} + // validateNoDuplicateRemoteURLs checks that no other server is using the same remote URLs func (s *registryServiceImpl) validateNoDuplicateRemoteURLs(ctx context.Context, tx pgx.Tx, serverDetail apiv0.ServerJSON) error { // Check each remote URL in the new server for conflicts @@ -237,11 +290,14 @@ func (s *registryServiceImpl) updateServerInTransaction(ctx context.Context, tx // Handle status change if provided if statusChange != nil { - updatedWithStatus, err := s.db.SetServerStatus(ctx, tx, serverName, version, statusChange.NewStatus, statusChange.StatusMessage) - if err != nil { + if _, err := s.db.SetServerStatus(ctx, tx, serverName, version, statusChange.NewStatus, statusChange.StatusMessage); err != nil { return nil, err } - return updatedWithStatus, nil + if err := s.recalculateLatest(ctx, tx, serverName); err != nil { + return nil, err + } + // Re-read to pick up the possibly updated is_latest flag. + return s.db.GetServerByNameAndVersion(ctx, tx, serverName, version, true) } return updatedServerResponse, nil @@ -279,7 +335,14 @@ func (s *registryServiceImpl) updateServerStatusInTransaction(ctx context.Contex } // Update only the status metadata - return s.db.SetServerStatus(ctx, tx, serverName, version, statusChange.NewStatus, statusChange.StatusMessage) + if _, err := s.db.SetServerStatus(ctx, tx, serverName, version, statusChange.NewStatus, statusChange.StatusMessage); err != nil { + return nil, err + } + if err := s.recalculateLatest(ctx, tx, serverName); err != nil { + return nil, err + } + // Re-read to pick up the possibly updated is_latest flag. + return s.db.GetServerByNameAndVersion(ctx, tx, serverName, version, true) } // UpdateAllVersionsStatus updates the status metadata of all versions of a server in a single transaction @@ -319,5 +382,12 @@ func (s *registryServiceImpl) updateAllVersionsStatusInTransaction(ctx context.C } // Update all versions' status in a single database call - return s.db.SetAllVersionsStatus(ctx, tx, serverName, statusChange.NewStatus, statusChange.StatusMessage) + if _, err := s.db.SetAllVersionsStatus(ctx, tx, serverName, statusChange.NewStatus, statusChange.StatusMessage); err != nil { + return nil, err + } + if err := s.recalculateLatest(ctx, tx, serverName); err != nil { + return nil, err + } + // Re-read to pick up the possibly updated is_latest flags. + return s.db.GetAllVersionsByServerName(ctx, tx, serverName, true) } diff --git a/internal/service/registry_service_test.go b/internal/service/registry_service_test.go index 63b6521..05ec847 100644 --- a/internal/service/registry_service_test.go +++ b/internal/service/registry_service_test.go @@ -982,6 +982,160 @@ func TestUpdateServerStatus_NoConflictWhenRestoringWithUniqueURLs(t *testing.T) assert.Equal(t, model.StatusActive, result.Meta.Official.Status) } +func TestRecalculateLatest_PromotesNextHighestWhenLatestSoftDeleted(t *testing.T) { + ctx := context.Background() + testDB := database.NewTestDB(t) + service := NewRegistryService(testDB, &config.Config{EnableRegistryValidation: false}) + + serverName := "com.example/delete-latest-server" + + // Publish 1.0.0, then 0.0.59. 1.0.0 is latest. + _, err := service.CreateServer(ctx, &apiv0.ServerJSON{ + Schema: model.CurrentSchemaURL, Name: serverName, Description: "v1", Version: "1.0.0", + }) + require.NoError(t, err) + _, err = service.CreateServer(ctx, &apiv0.ServerJSON{ + Schema: model.CurrentSchemaURL, Name: serverName, Description: "v0.0.59", Version: "0.0.59", + }) + require.NoError(t, err) + + // Soft-delete 1.0.0. + _, err = service.UpdateServerStatus(ctx, serverName, "1.0.0", &StatusChangeRequest{ + NewStatus: model.StatusDeleted, + }) + require.NoError(t, err) + + // 0.0.59 should now be latest. + latest, err := service.GetServerByName(ctx, serverName, false) + require.NoError(t, err) + assert.Equal(t, "0.0.59", latest.Server.Version) + assert.True(t, latest.Meta.Official.IsLatest) +} + +func TestRecalculateLatest_ReproFromIssue1081(t *testing.T) { + ctx := context.Background() + testDB := database.NewTestDB(t) + service := NewRegistryService(testDB, &config.Config{EnableRegistryValidation: false}) + + serverName := "com.example/issue-1081-repro" + + // 1. Publish 1.0.0. + _, err := service.CreateServer(ctx, &apiv0.ServerJSON{ + Schema: model.CurrentSchemaURL, Name: serverName, Description: "v1", Version: "1.0.0", + }) + require.NoError(t, err) + + // 2. Publish 0.0.59 — expected not latest at this point. + _, err = service.CreateServer(ctx, &apiv0.ServerJSON{ + Schema: model.CurrentSchemaURL, Name: serverName, Description: "v0.0.59", Version: "0.0.59", + }) + require.NoError(t, err) + + // 3. Delete 1.0.0. + _, err = service.UpdateServerStatus(ctx, serverName, "1.0.0", &StatusChangeRequest{ + NewStatus: model.StatusDeleted, + }) + require.NoError(t, err) + + // 4. /versions/latest must not 404. + latest, err := service.GetServerByName(ctx, serverName, false) + require.NoError(t, err) + assert.Equal(t, "0.0.59", latest.Server.Version) + + // 5. Publish 0.0.60 — should become latest because compare now excludes deleted 1.0.0. + _, err = service.CreateServer(ctx, &apiv0.ServerJSON{ + Schema: model.CurrentSchemaURL, Name: serverName, Description: "v0.0.60", Version: "0.0.60", + }) + require.NoError(t, err) + + latest, err = service.GetServerByName(ctx, serverName, false) + require.NoError(t, err) + assert.Equal(t, "0.0.60", latest.Server.Version) + assert.True(t, latest.Meta.Official.IsLatest) + + // Only one row should be flagged latest. + all, err := service.GetAllVersionsByServerName(ctx, serverName, true) + require.NoError(t, err) + latestCount := 0 + for _, v := range all { + if v.Meta.Official.IsLatest { + latestCount++ + } + } + assert.Equal(t, 1, latestCount) +} + +func TestRecalculateLatest_AllDeletedKeepsHighestAsLatest(t *testing.T) { + ctx := context.Background() + testDB := database.NewTestDB(t) + service := NewRegistryService(testDB, &config.Config{EnableRegistryValidation: false}) + + serverName := "com.example/all-deleted-server" + + _, err := service.CreateServer(ctx, &apiv0.ServerJSON{ + Schema: model.CurrentSchemaURL, Name: serverName, Description: "v1", Version: "1.0.0", + }) + require.NoError(t, err) + _, err = service.CreateServer(ctx, &apiv0.ServerJSON{ + Schema: model.CurrentSchemaURL, Name: serverName, Description: "v2", Version: "2.0.0", + }) + require.NoError(t, err) + + // Delete all versions in one call. + _, err = service.UpdateAllVersionsStatus(ctx, serverName, &StatusChangeRequest{ + NewStatus: model.StatusDeleted, + }) + require.NoError(t, err) + + // Public lookup (includeDeleted=false) must now 404. + _, err = service.GetServerByName(ctx, serverName, false) + require.ErrorIs(t, err, database.ErrNotFound) + + // Admin lookup (includeDeleted=true) must still find the server: the highest deleted + // version keeps is_latest=true so the server remains addressable for restore flows. + latest, err := service.GetServerByName(ctx, serverName, true) + require.NoError(t, err) + assert.Equal(t, "2.0.0", latest.Server.Version) + assert.True(t, latest.Meta.Official.IsLatest) +} + +func TestRecalculateLatest_RestoringHigherVersionPromotesIt(t *testing.T) { + ctx := context.Background() + testDB := database.NewTestDB(t) + service := NewRegistryService(testDB, &config.Config{EnableRegistryValidation: false}) + + serverName := "com.example/restore-server" + + // Publish 2.0.0 and 1.0.0 — 2.0.0 is latest. + _, err := service.CreateServer(ctx, &apiv0.ServerJSON{ + Schema: model.CurrentSchemaURL, Name: serverName, Description: "v2", Version: "2.0.0", + }) + require.NoError(t, err) + _, err = service.CreateServer(ctx, &apiv0.ServerJSON{ + Schema: model.CurrentSchemaURL, Name: serverName, Description: "v1", Version: "1.0.0", + }) + require.NoError(t, err) + + // Delete 2.0.0 — 1.0.0 gets promoted. + _, err = service.UpdateServerStatus(ctx, serverName, "2.0.0", &StatusChangeRequest{ + NewStatus: model.StatusDeleted, + }) + require.NoError(t, err) + latest, err := service.GetServerByName(ctx, serverName, false) + require.NoError(t, err) + require.Equal(t, "1.0.0", latest.Server.Version) + + // Restore 2.0.0 — it should reclaim latest. + _, err = service.UpdateServerStatus(ctx, serverName, "2.0.0", &StatusChangeRequest{ + NewStatus: model.StatusActive, + }) + require.NoError(t, err) + latest, err = service.GetServerByName(ctx, serverName, false) + require.NoError(t, err) + assert.Equal(t, "2.0.0", latest.Server.Version) + assert.True(t, latest.Meta.Official.IsLatest) +} + // Helper functions func stringPtr(s string) *string { return &s From 7722031739ad2d4e09ee6027dc51943888606795 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Sat, 25 Apr 2026 13:01:08 -0400 Subject: [PATCH 174/313] deploy: update prod to v1.7.0 (#1205) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary - Bumps production image tag from `1.6.0` to `1.7.0` in `deploy/Pulumi.gcpProd.yaml` - Corresponds to the [v1.7.0 release](https://github.com/modelcontextprotocol/registry/releases/tag/v1.7.0) - Notable change: includes #1201 — fixes #1081 (`isLatest` no longer stranded after soft-delete) and ships migration `014_heal_is_latest` that auto-heals affected servers (e.g. `io.github.containers/kubernetes-mcp-server`) on deploy ## Test plan - [ ] Verify Pulumi preview shows only the image tag change - [ ] After deploy, confirm migration 014 ran and `io.github.containers/kubernetes-mcp-server`'s `/versions/latest` returns `0.0.61` (or whichever is highest non-deleted) - [ ] Sample a few unaffected servers and confirm `isLatest` is unchanged - [ ] Confirm overall service health 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.7 (1M context) --- deploy/Pulumi.gcpProd.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/deploy/Pulumi.gcpProd.yaml b/deploy/Pulumi.gcpProd.yaml index 630f8a2..a1ad178 100644 --- a/deploy/Pulumi.gcpProd.yaml +++ b/deploy/Pulumi.gcpProd.yaml @@ -1,7 +1,7 @@ config: mcp-registry:environment: prod mcp-registry:provider: gcp - mcp-registry:imageTag: 1.6.0 # Set specific image tag for production (change this to deploy different versions) + mcp-registry:imageTag: 1.7.0 # Set specific image tag for production (change this to deploy different versions) gcp:project: mcp-registry-prod mcp-registry:githubClientId: Iv23liUydBbI7Z2Q9bOZ mcp-registry:githubClientSecret: From b24d6c7657786d4474f2ab0fd067deb85be1de33 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Mon, 27 Apr 2026 09:09:50 -0400 Subject: [PATCH 175/313] fix: harden registry availability and add publish phase timings (#1211) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary Daily ~17:00 UTC `Publish Endpoint Latency` and `Availability < 95%` alerts are caused by both registry pods exit-0'ing within seconds of each other and racing with the still-recovering `registry-pg-rw` endpoint on restart. Separately, the default compute SA had no project IAM roles, so `fluentbit-gke` and the GMP collector were silently dropping every log line and time series — which is why none of this was visible in Cloud Logging. All Kubernetes/IAM changes apply uniformly to staging and prod. ## Changes - **GCP IAM** (`deploy/pkg/providers/gcp/provider.go`) — grant the default compute SA `logging.logWriter`, `monitoring.metricWriter`, `monitoring.viewer`, and `stackdriver.resourceMetadata.writer`. Already applied live; this just encodes it in Pulumi. - **Pod resilience** (`deploy/pkg/k8s/registry.go`) — - `PodDisruptionBudget` (`minAvailable: 1`) prevents a synchronized voluntary disruption. - `TopologySpreadConstraints` (`ScheduleAnyway`, hostname) keeps the PDB from deadlocking node drains when both pods co-locate. - `StartupProbe` (30 × 5s = 150s) protects the DB-retry budget from the liveness probe. - Memory bump 128→256Mi request, 256→512Mi limit. - **Startup retry** (`cmd/registry/main.go`) — replace silent `return` on initial DB-ping failure with bounded retry-with-backoff (8 attempts, 1→8s capped, 10s per-attempt). A brief endpoint flap no longer cascades into a restart loop. - **Diagnostic log** (`internal/service/registry_service.go`) — emit `validate_ms` on each publish (success and failure). Validate fans out to npm/PyPI/OCI with 10s per-host timeouts and is the most likely contributor to publish latency. Total request duration is already covered by the existing `http.request.duration` histogram. ## Calibration The IAM, PDB, topology-spread, startup-probe, and DB-retry pieces are mitigations — they reduce blast radius regardless of root cause. The `validate_ms` log is the diagnostic for identifying the trigger when the alert fires next. Single-PG SPOF (`deploy/pkg/k8s/postgres.go:57`) remains a follow-up; today's evidence shows PG was a victim, not the cause. ## Test plan - [x] `go build ./...` and `go vet ./...` clean for both modules - [x] `make lint` clean (12 pre-existing issues under `deploy/` are not in `make lint`) - [x] `go test -race -count=1 ./internal/... ./cmd/...` green - [x] IAM applied live; `fluentbit-gke` and GMP no longer hitting `IAM_PERMISSION_DENIED` - [ ] After deploy, verify the next 17:00 UTC firing surfaces `validate_ms` in Cloud Logging 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.7 (1M context) --- cmd/registry/main.go | 34 +++++++++++----- deploy/pkg/k8s/registry.go | 58 +++++++++++++++++++++++++++- deploy/pkg/providers/gcp/provider.go | 53 +++++++++++++++++++++++++ internal/service/registry_service.go | 37 +++++++++++++++--- 4 files changed, 165 insertions(+), 17 deletions(-) diff --git a/cmd/registry/main.go b/cmd/registry/main.go index 3eee551..ed68abf 100644 --- a/cmd/registry/main.go +++ b/cmd/registry/main.go @@ -57,15 +57,31 @@ func main() { // Initialize configuration cfg := config.NewConfig() - // Create a context with timeout for PostgreSQL connection - ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second) - defer cancel() - - // Connect to PostgreSQL - db, err = database.NewPostgreSQL(ctx, cfg.DatabaseURL) - if err != nil { - log.Printf("Failed to connect to PostgreSQL: %v", err) - return + // Connect to PostgreSQL with bounded retry. The DB endpoint can flap briefly + // during voluntary disruptions (node drains, rollouts) and without retry the + // pod exits cleanly, restarts, then races with the still-recovering service + // — turning a transient blip into a multi-minute outage. + const ( + maxStartupAttempts = 8 + perAttemptTimeout = 10 * time.Second + initialBackoff = 1 * time.Second + maxBackoff = 8 * time.Second + ) + backoff := initialBackoff + for attempt := 1; ; attempt++ { + attemptCtx, attemptCancel := context.WithTimeout(context.Background(), perAttemptTimeout) + db, err = database.NewPostgreSQL(attemptCtx, cfg.DatabaseURL) + attemptCancel() + if err == nil { + break + } + if attempt >= maxStartupAttempts { + log.Printf("Failed to connect to PostgreSQL after %d attempts: %v", attempt, err) + return + } + log.Printf("PostgreSQL not reachable (attempt %d/%d): %v, retrying in %s", attempt, maxStartupAttempts, err, backoff) + time.Sleep(backoff) + backoff = min(backoff*2, maxBackoff) } // Store the PostgreSQL instance for later cleanup diff --git a/deploy/pkg/k8s/registry.go b/deploy/pkg/k8s/registry.go index 4655203..579f740 100644 --- a/deploy/pkg/k8s/registry.go +++ b/deploy/pkg/k8s/registry.go @@ -10,6 +10,7 @@ import ( "github.com/pulumi/pulumi-kubernetes/sdk/v4/go/kubernetes/helm/v3" metav1 "github.com/pulumi/pulumi-kubernetes/sdk/v4/go/kubernetes/meta/v1" networkingv1 "github.com/pulumi/pulumi-kubernetes/sdk/v4/go/kubernetes/networking/v1" + policyv1 "github.com/pulumi/pulumi-kubernetes/sdk/v4/go/kubernetes/policy/v1" "github.com/pulumi/pulumi/sdk/v3/go/pulumi" "github.com/pulumi/pulumi/sdk/v3/go/pulumi/config" @@ -95,6 +96,22 @@ func DeployMCPRegistry(ctx *pulumi.Context, cluster *providers.ProviderInfo, env }, }, Spec: &corev1.PodSpecArgs{ + // Soft-spread pods across nodes so the PodDisruptionBudget below can't + // deadlock a node drain when both pods happen to co-locate. + // `ScheduleAnyway` keeps single-node clusters (e.g. constrained dev + // envs) schedulable while still preferring spread under normal load. + TopologySpreadConstraints: corev1.TopologySpreadConstraintArray{ + &corev1.TopologySpreadConstraintArgs{ + MaxSkew: pulumi.Int(1), + TopologyKey: pulumi.String("kubernetes.io/hostname"), + WhenUnsatisfiable: pulumi.String("ScheduleAnyway"), + LabelSelector: &metav1.LabelSelectorArgs{ + MatchLabels: pulumi.StringMap{ + "app": pulumi.String("mcp-registry"), + }, + }, + }, + }, Containers: corev1.ContainerArray{ &corev1.ContainerArgs{ Name: pulumi.String("mcp-registry"), @@ -169,6 +186,18 @@ func DeployMCPRegistry(ctx *pulumi.Context, cluster *providers.ProviderInfo, env Value: pulumi.String("*"), }, }, + // StartupProbe protects the DB-retry budget in cmd/registry/main.go: + // 30 × 5s = 150s allowed before liveness/readiness take over, which + // covers the worst-case retry budget (8 attempts × 10s + ~40s sleep). + StartupProbe: &corev1.ProbeArgs{ + HttpGet: &corev1.HTTPGetActionArgs{ + Path: pulumi.String("/v0/health"), + Port: pulumi.Int(8080), + }, + PeriodSeconds: pulumi.Int(5), + FailureThreshold: pulumi.Int(30), + TimeoutSeconds: pulumi.Int(3), + }, LivenessProbe: &corev1.ProbeArgs{ HttpGet: &corev1.HTTPGetActionArgs{ Path: pulumi.String("/v0/health"), @@ -187,11 +216,11 @@ func DeployMCPRegistry(ctx *pulumi.Context, cluster *providers.ProviderInfo, env }, Resources: &corev1.ResourceRequirementsArgs{ Requests: pulumi.StringMap{ - "memory": pulumi.String("128Mi"), + "memory": pulumi.String("256Mi"), "cpu": pulumi.String("100m"), }, Limits: pulumi.StringMap{ - "memory": pulumi.String("256Mi"), + "memory": pulumi.String("512Mi"), }, }, }, @@ -204,6 +233,31 @@ func DeployMCPRegistry(ctx *pulumi.Context, cluster *providers.ProviderInfo, env return nil, err } + // Keep at least one registry pod available during voluntary disruptions + // (node drains, evictions, etc.) so a synchronized eviction can't take both + // pods down at once. + _, err = policyv1.NewPodDisruptionBudget(ctx, "mcp-registry", &policyv1.PodDisruptionBudgetArgs{ + Metadata: &metav1.ObjectMetaArgs{ + Name: pulumi.String("mcp-registry"), + Namespace: pulumi.String("default"), + Labels: pulumi.StringMap{ + "app": pulumi.String("mcp-registry"), + "environment": pulumi.String(environment), + }, + }, + Spec: &policyv1.PodDisruptionBudgetSpecArgs{ + MinAvailable: pulumi.Int(1), + Selector: &metav1.LabelSelectorArgs{ + MatchLabels: pulumi.StringMap{ + "app": pulumi.String("mcp-registry"), + }, + }, + }, + }, pulumi.Provider(cluster.Provider)) + if err != nil { + return nil, err + } + // Create Service service, err := corev1.NewService(ctx, "mcp-registry", &corev1.ServiceArgs{ Metadata: &metav1.ObjectMetaArgs{ diff --git a/deploy/pkg/providers/gcp/provider.go b/deploy/pkg/providers/gcp/provider.go index 108a209..6a51e27 100644 --- a/deploy/pkg/providers/gcp/provider.go +++ b/deploy/pkg/providers/gcp/provider.go @@ -3,9 +3,12 @@ package gcp import ( "encoding/base64" "fmt" + "strings" "github.com/pulumi/pulumi-gcp/sdk/v8/go/gcp" "github.com/pulumi/pulumi-gcp/sdk/v8/go/gcp/container" + "github.com/pulumi/pulumi-gcp/sdk/v8/go/gcp/organizations" + "github.com/pulumi/pulumi-gcp/sdk/v8/go/gcp/projects" "github.com/pulumi/pulumi-gcp/sdk/v8/go/gcp/storage" "github.com/pulumi/pulumi-kubernetes/sdk/v4/go/kubernetes" corev1 "github.com/pulumi/pulumi-kubernetes/sdk/v4/go/kubernetes/core/v1" @@ -58,6 +61,49 @@ func createGCPProvider(ctx *pulumi.Context, name string) (*gcp.Provider, error) return nil, nil } +// grantNodeServiceAccountRoles grants the default compute service account the standard +// GKE node roles required for log shipping (fluentbit-gke) and metrics scraping +// (managed Prometheus). New GCP projects no longer auto-grant Editor to the default +// compute SA, so these have to be set explicitly or every pod log/metric is dropped. +func grantNodeServiceAccountRoles(ctx *pulumi.Context, projectID string, gcpProvider *gcp.Provider) error { + invokeOpts := []pulumi.InvokeOption{} + resourceOpts := []pulumi.ResourceOption{} + if gcpProvider != nil { + invokeOpts = append(invokeOpts, pulumi.Provider(gcpProvider)) + resourceOpts = append(resourceOpts, pulumi.Provider(gcpProvider)) + } + + project, err := organizations.LookupProject(ctx, &organizations.LookupProjectArgs{ + ProjectId: pulumi.StringRef(projectID), + }, invokeOpts...) + if err != nil { + return fmt.Errorf("failed to look up project number for node SA bindings: %w", err) + } + + nodeSA := fmt.Sprintf("serviceAccount:%s-compute@developer.gserviceaccount.com", project.Number) + + roles := []string{ + "roles/logging.logWriter", + "roles/monitoring.metricWriter", + "roles/monitoring.viewer", + "roles/stackdriver.resourceMetadata.writer", + } + + for _, role := range roles { + name := fmt.Sprintf("node-sa-%s", strings.ReplaceAll(strings.TrimPrefix(role, "roles/"), ".", "-")) + _, err := projects.NewIAMMember(ctx, name, &projects.IAMMemberArgs{ + Project: pulumi.String(projectID), + Role: pulumi.String(role), + Member: pulumi.String(nodeSA), + }, resourceOpts...) + if err != nil { + return fmt.Errorf("failed to grant %s to node SA: %w", role, err) + } + } + + return nil +} + // CreateCluster creates a Google Kubernetes Engine cluster func (p *Provider) CreateCluster(ctx *pulumi.Context, environment string) (*providers.ProviderInfo, error) { // Get configuration @@ -152,6 +198,13 @@ func (p *Provider) CreateCluster(ctx *pulumi.Context, environment string) (*prov return nil, fmt.Errorf("failed to create node pool: %w", err) } + // Grant the default compute service account the standard GKE node roles so the + // fluentbit-gke and managed Prometheus collectors can ship logs and metrics. + // Without these, every pod log line and time series fails with IAM_PERMISSION_DENIED. + if err := grantNodeServiceAccountRoles(ctx, projectID, gcpProvider); err != nil { + return nil, err + } + // Create Kubernetes provider using the cluster directly k8sProvider, err := kubernetes.NewProvider(ctx, "k8s-provider", &kubernetes.ProviderArgs{ Kubeconfig: pulumi.All(cluster.Endpoint, cluster.MasterAuth).ApplyT(func(args []any) (string, error) { diff --git a/internal/service/registry_service.go b/internal/service/registry_service.go index 4f4b8a0..4403136 100644 --- a/internal/service/registry_service.go +++ b/internal/service/registry_service.go @@ -4,6 +4,7 @@ import ( "context" "errors" "fmt" + "log/slog" "time" "github.com/jackc/pgx/v5" @@ -85,15 +86,29 @@ func (s *registryServiceImpl) CreateServer(ctx context.Context, req *apiv0.Serve }) } -// createServerInTransaction contains the actual CreateServer logic within a transaction +// createServerInTransaction contains the actual CreateServer logic within a transaction. func (s *registryServiceImpl) createServerInTransaction(ctx context.Context, tx pgx.Tx, req *apiv0.ServerJSON) (*apiv0.ServerResponse, error) { - // Validate the request - if err := validators.ValidatePublishRequest(ctx, *req, s.cfg); err != nil { - return nil, err + serverJSON := *req + + // Validate the request. ValidatePublishRequest fans out to npm/PyPI/OCI for + // registry-ownership checks with 10s per-host timeouts, so it's the most likely + // contributor to publish latency. Log validate_ms on both success and failure + // so the next /v0/publish latency alert is diagnostic — a slow upstream that + // times out into a validation error is exactly the case we need to see. + validateStart := time.Now() + validateErr := validators.ValidatePublishRequest(ctx, serverJSON, s.cfg) + validateMs := time.Since(validateStart).Milliseconds() + if validateErr != nil { + slog.WarnContext(ctx, "publish validate failed", + "server_name", serverJSON.Name, + "version", serverJSON.Version, + "validate_ms", validateMs, + "error", validateErr.Error(), + ) + return nil, validateErr } publishTime := time.Now() - serverJSON := *req // Acquire advisory lock to prevent concurrent publishes of the same server if err := s.db.AcquirePublishLock(ctx, tx, serverJSON.Name); err != nil { @@ -161,7 +176,17 @@ func (s *registryServiceImpl) createServerInTransaction(ctx context.Context, tx } // Insert new server version - return s.db.CreateServer(ctx, tx, &serverJSON, officialMeta) + resp, err := s.db.CreateServer(ctx, tx, &serverJSON, officialMeta) + if err != nil { + return nil, err + } + + slog.InfoContext(ctx, "publish complete", + "server_name", serverJSON.Name, + "version", serverJSON.Version, + "validate_ms", validateMs, + ) + return resp, nil } // recalculateLatest picks the highest non-deleted version of the given server and flags it From c6d3096d1b029278ed03891d08a20a0029b101ed Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Mon, 27 Apr 2026 12:32:22 -0400 Subject: [PATCH 176/313] fix(deploy): manage Cloud Resource Manager API enablement in Pulumi (#1213) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary Follow-up to #1211 to encode the GCP API and IAM dependencies its node-SA bindings rely on. After #1211 merged, the staging deploy hit two undocumented prereqs in sequence — Cloud Resource Manager API not enabled (because `projects.NewIAMMember` calls SetIamPolicy through CRM), then the Pulumi service account missing `roles/resourcemanager.projectIamAdmin`. Both fixed manually to unblock; this PR makes them explicit so they don't bite again. ## Changes **`ensureRequiredAPIs` adopts five GCP APIs** as Pulumi-managed `projects.Service` resources, all with `DisableOnDestroy: false` and `DisableDependentServices: false` so a Pulumi destroy/refactor can never disable a shared API: | API | Why | |-----|-----| | `cloudresourcemanager` | `projects.NewIAMMember` → SetIamPolicy | | `compute` | `compute.GetDefaultServiceAccount` invoke + GKE | | `container` | GKE cluster | | `logging` | fluentbit-gke ships container logs | | `monitoring` | managed Prometheus collector ships metrics | CRM is created explicitly (not in the loop) so callers get a direct reference for `pulumi.DependsOn`. Storage is intentionally **not** Pulumi-managed — Pulumi state itself lives in a GCS bucket, chicken-and-egg. **`grantNodeServiceAccountRoles`** now `DependsOn` the CRM `projects.Service` for the four IAM bindings, and uses `compute.GetDefaultServiceAccount` to derive the SA email (Compute API was already required for GKE — avoids a CRM-dependent project-number lookup). **`deploy/README.md`** — adds `roles/resourcemanager.projectIamAdmin` to the Pulumi SA's required roles and clarifies which APIs must be enabled before the first `pulumi up` (storage, cloudresourcemanager, container) vs. which `ensureRequiredAPIs` adopts. ## Notes `projects.Service` is idempotent against already-enabled APIs — on existing projects (staging/prod), Pulumi adopts the live enablement into state without re-enabling. This was confirmed live: staging deploy went green after the manual unblocks above, validating the runtime model. ## Test plan - [x] `go build ./...` clean for `deploy/` - [x] `golangci-lint run` clean for `deploy/pkg/providers/gcp/...` (one pre-existing `nilnil` at line 61, unrelated) - [x] Manual unblock + green staging deploy verified the runtime behavior this PR encodes - [ ] On merge: staging deploy adopts the existing API enablements without churn, then proceeds normally - [ ] Prod deploy via #1212 (image promotion) inherits the same setup 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.7 (1M context) --- deploy/README.md | 17 +++++- deploy/pkg/providers/gcp/provider.go | 90 +++++++++++++++++++++++++--- 2 files changed, 98 insertions(+), 9 deletions(-) diff --git a/deploy/README.md b/deploy/README.md index 3125d61..392b244 100644 --- a/deploy/README.md +++ b/deploy/README.md @@ -65,8 +65,20 @@ Pre-requisites: 1. Create a project: `gcloud projects create mcp-registry-prod` 2. Set the project: `gcloud config set project mcp-registry-prod` -3. Enable required APIs: `gcloud services enable storage.googleapis.com && gcloud services enable container.googleapis.com` -4. Create a service account with necessary permissions, and get the key: +3. Enable the bootstrap APIs needed before Pulumi can run. The remaining APIs + (`cloudresourcemanager`, `compute`, `container`, `logging`, `monitoring`) are + adopted as Pulumi-managed `projects.Service` resources by `ensureRequiredAPIs` + in `pkg/providers/gcp/provider.go`, so they self-heal against drift but still + need to be reachable on the very first deploy: + ```bash + gcloud services enable storage.googleapis.com # for the Pulumi state bucket below + gcloud services enable cloudresourcemanager.googleapis.com # for the IAM bindings Pulumi creates + gcloud services enable container.googleapis.com # for the GKE cluster + ``` +4. Create the Pulumi service account and grant it the roles required to manage + the deploy. `projectIamAdmin` is needed because the deploy creates IAM bindings + on the project (for the default compute SA). The other four are general + resource management: ```bash gcloud iam service-accounts create pulumi-svc sleep 10 @@ -74,6 +86,7 @@ Pre-requisites: gcloud projects add-iam-policy-binding mcp-registry-prod --member="serviceAccount:pulumi-svc@mcp-registry-prod.iam.gserviceaccount.com" --role="roles/compute.admin" gcloud projects add-iam-policy-binding mcp-registry-prod --member="serviceAccount:pulumi-svc@mcp-registry-prod.iam.gserviceaccount.com" --role="roles/storage.admin" gcloud projects add-iam-policy-binding mcp-registry-prod --member="serviceAccount:pulumi-svc@mcp-registry-prod.iam.gserviceaccount.com" --role="roles/storage.hmacKeyAdmin" + gcloud projects add-iam-policy-binding mcp-registry-prod --member="serviceAccount:pulumi-svc@mcp-registry-prod.iam.gserviceaccount.com" --role="roles/resourcemanager.projectIamAdmin" gcloud iam service-accounts add-iam-policy-binding $(gcloud projects describe mcp-registry-prod --format="value(projectNumber)")-compute@developer.gserviceaccount.com --member="serviceAccount:pulumi-svc@mcp-registry-prod.iam.gserviceaccount.com" --role="roles/iam.serviceAccountUser" gcloud iam service-accounts keys create sa-key.json --iam-account=pulumi-svc@mcp-registry-prod.iam.gserviceaccount.com ``` diff --git a/deploy/pkg/providers/gcp/provider.go b/deploy/pkg/providers/gcp/provider.go index 6a51e27..e4f1e76 100644 --- a/deploy/pkg/providers/gcp/provider.go +++ b/deploy/pkg/providers/gcp/provider.go @@ -6,8 +6,8 @@ import ( "strings" "github.com/pulumi/pulumi-gcp/sdk/v8/go/gcp" + "github.com/pulumi/pulumi-gcp/sdk/v8/go/gcp/compute" "github.com/pulumi/pulumi-gcp/sdk/v8/go/gcp/container" - "github.com/pulumi/pulumi-gcp/sdk/v8/go/gcp/organizations" "github.com/pulumi/pulumi-gcp/sdk/v8/go/gcp/projects" "github.com/pulumi/pulumi-gcp/sdk/v8/go/gcp/storage" "github.com/pulumi/pulumi-kubernetes/sdk/v4/go/kubernetes" @@ -61,10 +61,75 @@ func createGCPProvider(ctx *pulumi.Context, name string) (*gcp.Provider, error) return nil, nil } +// ensureRequiredAPIs adopts the GCP APIs the deploy depends on as Pulumi-managed +// services. Encoding them as Pulumi resources makes the dependency explicit and +// protects against drift (an org policy reset or accidental disable). +// +// Note: bootstrap APIs (storage, cloudresourcemanager, container — see +// deploy/README.md) must already be enabled before this runs, because the +// resources that need them are created earlier in the stack. For those, this +// function adopts them into Pulumi state after the fact. For the rest (logging, +// monitoring), the adoption happens before any consumer runs. +// +// DisableOnDestroy and DisableDependentServices are both false — a Pulumi destroy +// or refactor must never disable a shared API that other resources (and humans) +// rely on. Enable-only. +// +// Returns the Cloud Resource Manager API resource specifically, since the node-SA +// IAM bindings need to DependsOn it (SetIamPolicy is gated on CRM). +func ensureRequiredAPIs(ctx *pulumi.Context, projectID string, resourceOpts []pulumi.ResourceOption) (*projects.Service, error) { + // Service Usage API (which projects.NewService itself uses) is enabled by default + // on GCP projects, so we don't need to manage it here. + + // CRM is created explicitly (not in the loop below) because callers need a + // direct reference to it for DependsOn — projects.NewIAMMember calls + // SetIamPolicy under the hood, which is gated on CRM. + crm, err := projects.NewService(ctx, "crm-api", &projects.ServiceArgs{ + Project: pulumi.String(projectID), + Service: pulumi.String("cloudresourcemanager.googleapis.com"), + DisableOnDestroy: pulumi.Bool(false), + DisableDependentServices: pulumi.Bool(false), + }, resourceOpts...) + if err != nil { + return nil, fmt.Errorf("failed to ensure cloudresourcemanager.googleapis.com is enabled: %w", err) + } + + otherAPIs := []struct { + resourceName string + serviceName string + }{ + // Required for compute.GetDefaultServiceAccount and the GKE cluster. + {"compute-api", "compute.googleapis.com"}, + // Required for the GKE cluster. + {"container-api", "container.googleapis.com"}, + // Required for fluentbit-gke to ship container logs. + {"logging-api", "logging.googleapis.com"}, + // Required for the managed Prometheus collector to ship metrics. + {"monitoring-api", "monitoring.googleapis.com"}, + } + + for _, api := range otherAPIs { + _, err := projects.NewService(ctx, api.resourceName, &projects.ServiceArgs{ + Project: pulumi.String(projectID), + Service: pulumi.String(api.serviceName), + DisableOnDestroy: pulumi.Bool(false), + DisableDependentServices: pulumi.Bool(false), + }, resourceOpts...) + if err != nil { + return nil, fmt.Errorf("failed to ensure %s is enabled: %w", api.serviceName, err) + } + } + return crm, nil +} + // grantNodeServiceAccountRoles grants the default compute service account the standard // GKE node roles required for log shipping (fluentbit-gke) and metrics scraping // (managed Prometheus). New GCP projects no longer auto-grant Editor to the default // compute SA, so these have to be set explicitly or every pod log/metric is dropped. +// +// The IAM bindings depend on Cloud Resource Manager API being enabled (managed by +// ensureRequiredAPIs above) — without it, projects.NewIAMMember fails because +// SetIamPolicy lives behind that API. func grantNodeServiceAccountRoles(ctx *pulumi.Context, projectID string, gcpProvider *gcp.Provider) error { invokeOpts := []pulumi.InvokeOption{} resourceOpts := []pulumi.ResourceOption{} @@ -73,14 +138,22 @@ func grantNodeServiceAccountRoles(ctx *pulumi.Context, projectID string, gcpProv resourceOpts = append(resourceOpts, pulumi.Provider(gcpProvider)) } - project, err := organizations.LookupProject(ctx, &organizations.LookupProjectArgs{ - ProjectId: pulumi.StringRef(projectID), - }, invokeOpts...) + crmAPI, err := ensureRequiredAPIs(ctx, projectID, resourceOpts) if err != nil { - return fmt.Errorf("failed to look up project number for node SA bindings: %w", err) + return err } - nodeSA := fmt.Sprintf("serviceAccount:%s-compute@developer.gserviceaccount.com", project.Number) + // Get the default compute SA email directly from the Compute API instead of + // constructing it from the project number — avoids needing CRM API just for + // the project lookup, and matches whatever GCP actually returns. + defaultSA, err := compute.GetDefaultServiceAccount(ctx, &compute.GetDefaultServiceAccountArgs{ + Project: pulumi.StringRef(projectID), + }, invokeOpts...) + if err != nil { + return fmt.Errorf("failed to look up default compute service account: %w", err) + } + + nodeSA := "serviceAccount:" + defaultSA.Email roles := []string{ "roles/logging.logWriter", @@ -89,13 +162,16 @@ func grantNodeServiceAccountRoles(ctx *pulumi.Context, projectID string, gcpProv "roles/stackdriver.resourceMetadata.writer", } + bindingOpts := make([]pulumi.ResourceOption, 0, len(resourceOpts)+1) + bindingOpts = append(bindingOpts, resourceOpts...) + bindingOpts = append(bindingOpts, pulumi.DependsOn([]pulumi.Resource{crmAPI})) for _, role := range roles { name := fmt.Sprintf("node-sa-%s", strings.ReplaceAll(strings.TrimPrefix(role, "roles/"), ".", "-")) _, err := projects.NewIAMMember(ctx, name, &projects.IAMMemberArgs{ Project: pulumi.String(projectID), Role: pulumi.String(role), Member: pulumi.String(nodeSA), - }, resourceOpts...) + }, bindingOpts...) if err != nil { return fmt.Errorf("failed to grant %s to node SA: %w", role, err) } From 762a4849a65557e1c0c3be2753b7fabab26d7645 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Mon, 27 Apr 2026 12:44:10 -0400 Subject: [PATCH 177/313] deploy: update prod to v1.7.1 (#1212) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary Promotes [v1.7.1](https://github.com/modelcontextprotocol/registry/releases/tag/v1.7.1) to production. Contents: the hardening + diagnostics from #1211. What's in v1.7.1 (vs v1.7.0): - Pulumi-managed IAM bindings for the default compute SA so fluentbit-gke and the GMP collector can ship logs/metrics (already applied to live cluster manually) - `PodDisruptionBudget` with `minAvailable: 1` + `TopologySpreadConstraints` to keep pods spread across nodes - `StartupProbe` (30 × 5s) covering the new DB-retry budget - Bounded retry-with-backoff on initial DB connect in `cmd/registry/main.go` - Memory request 128→256Mi, limit 256→512Mi - `slog` `validate_ms` timing on the publish path so the next slow `/v0/publish` is self-diagnostic ## Test plan - [x] v1.7.1 release workflow built and pushed image successfully (`ghcr.io/modelcontextprotocol/registry:1.7.1`) - [x] Pulumi.gcpProd.yaml diff is the single-line image bump - [ ] On merge, `deploy-production.yml` rolls out v1.7.1 — watch for clean rolling update (`maxSurge: 1`, `maxUnavailable: 0`) and confirm both pods reach Ready - [ ] After rollout, confirm `Starting MCP Registry Application v1.7.1` shows up in Cloud Logging from the new pods 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.7 (1M context) --- deploy/Pulumi.gcpProd.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/deploy/Pulumi.gcpProd.yaml b/deploy/Pulumi.gcpProd.yaml index a1ad178..1dd623b 100644 --- a/deploy/Pulumi.gcpProd.yaml +++ b/deploy/Pulumi.gcpProd.yaml @@ -1,7 +1,7 @@ config: mcp-registry:environment: prod mcp-registry:provider: gcp - mcp-registry:imageTag: 1.7.0 # Set specific image tag for production (change this to deploy different versions) + mcp-registry:imageTag: 1.7.1 # Set specific image tag for production (change this to deploy different versions) gcp:project: mcp-registry-prod mcp-registry:githubClientId: Iv23liUydBbI7Z2Q9bOZ mcp-registry:githubClientSecret: From 27af672c5ee355e88d8329f51ce20f0e4d08db39 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Mon, 27 Apr 2026 15:35:59 -0400 Subject: [PATCH 178/313] fix(list): use row-constructor cursor + restore per-phase publish timings + enable pg_stat_statements (#1215) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary Three changes from the 2026-04-27 incident: 1. **Cursor SQL fix** — `addCursorCondition` rewritten to use a row-constructor comparison `(server_name, version) > ($1, $2)` instead of the OR-decomposed form. Postgres can index-seek on the row constructor; it can't on the OR form, which scanned from the start of the index and filtered rows before the cursor. Cost grew linearly with cursor depth. 2. **Per-phase publish timings restored** — `createServerInTransaction` was simplified during #1211 review to log only `validate_ms`. The incident showed publishes spending 50+ s in `acquire_lock` / `version_checks` / `db_create` while `validate_ms` reported a few hundred ms — the diagnostic signal was hidden. Restored timings for every phase, refactored into a small `runPhase` helper. 3. **`pg_stat_statements` enabled** in the CNPG cluster spec. We had no aggregate query visibility during the incident — could only EXPLAIN queries we happened to suspect. ## Cursor fix evidence Local benchmark, 100K rows, cold cache: | Form | Rows filtered | Buffer reads | Time | |------|--------------:|-------------:|-----:| | OLD | 80,001 | 7,679 | 31.6 ms | | NEW | 2 | 1 | **0.05 ms** | Maps to prod's measured 8,911 buffer hits → 760 ms. End-to-end API: `/v0/servers?limit=100&cursor=…` returns in 4–7 ms regardless of depth. Risk check: confirmed `(server_name, version)` index exists in that column order (both `servers_pkey` and `idx_servers_name_version`), and both columns are `NOT NULL` so row-constructor comparison can't silently drop rows. ## Tests - New `TestPostgreSQL_PerformanceScenarios/compound_cursor_across_versions_of_same_server` pins multi-version pagination semantics. The existing cursor tests only exercised the fallback (single-component cursor) and degenerate (one version per server) cases. - `make lint` clean, `go test -race ./internal/... ./cmd/...` green. ## Deployment The cursor + slog changes are zero-downtime. The CNPG spec change triggers a brief PG restart (single-instance cluster). After the restart, run once on prod: ```bash kubectl exec -i registry-pg-1 -c postgres \ --context gke_mcp-registry-prod_us-central1-b_mcp-registry-prod \ -- psql -U postgres -c "CREATE EXTENSION IF NOT EXISTS pg_stat_statements" ``` Time the merge for a low-traffic UTC window. v1.7.1's DB retry-with-backoff covers the brief PG restart. ## Out of scope `MaxConns` bump, per-IP rate limiting at nginx, response caching, the pre-existing `superfluous WriteHeader` warnings — separate follow-ups. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.7 (1M context) --- deploy/pkg/k8s/postgres.go | 20 ++++ internal/database/postgres.go | 16 ++- internal/database/postgres_test.go | 98 ++++++++++++++++++ internal/service/registry_service.go | 148 ++++++++++++++++++--------- 4 files changed, 232 insertions(+), 50 deletions(-) diff --git a/deploy/pkg/k8s/postgres.go b/deploy/pkg/k8s/postgres.go index 57a28aa..7a119fd 100644 --- a/deploy/pkg/k8s/postgres.go +++ b/deploy/pkg/k8s/postgres.go @@ -59,6 +59,26 @@ func DeployPostgresDatabases(ctx *pulumi.Context, cluster *providers.ProviderInf "storage": map[string]any{ "size": "50Gi", }, + // Enable pg_stat_statements so we can attribute slow time to specific + // queries (the 2026-04-27 incident took an EXPLAIN-the-one-query-I-saw + // approach because we had no aggregate visibility). CNPG triggers a PG + // restart on shared_preload_libraries change — with instances: 1 this + // is brief downtime. CREATE EXTENSION still needs to run once as a + // superuser on existing clusters; new clusters get it via the + // postInitApplicationSQL hook below. + "postgresql": map[string]any{ + "shared_preload_libraries": []any{"pg_stat_statements"}, + "parameters": map[string]any{ + "pg_stat_statements.track": "all", + }, + }, + "bootstrap": map[string]any{ + "initdb": map[string]any{ + "postInitApplicationSQL": []any{ + "CREATE EXTENSION IF NOT EXISTS pg_stat_statements", + }, + }, + }, }, }, }, pulumi.Provider(cluster.Provider), pulumi.DependsOnInputs(cloudNativePG.Ready), pulumi.RetainOnDelete(true)) diff --git a/internal/database/postgres.go b/internal/database/postgres.go index e40359a..ff139e2 100644 --- a/internal/database/postgres.go +++ b/internal/database/postgres.go @@ -127,7 +127,16 @@ func buildFilterConditions(filter *ServerFilter, argIndex int) ([]string, []any, return conditions, args, argIndex } -// addCursorCondition adds pagination cursor condition to WHERE clause +// addCursorCondition adds pagination cursor condition to WHERE clause. +// +// The compound cursor uses a row-constructor comparison so PostgreSQL can seek +// directly into the (server_name, version) B-tree index. The OR-decomposed form +// `server_name > X OR (server_name = X AND version > Y)` is logically equivalent +// but PostgreSQL's planner cannot use it for an index seek — it scans the index +// from the start and filters everything before the cursor, making cost grow +// linearly with cursor depth (a 20K-row table at a deep cursor took ~760ms in +// prod). The row-constructor form `(server_name, version) > (X, Y)` is special- +// cased and stays constant-time regardless of cursor depth. func addCursorCondition(cursor string, argIndex int) (string, []any, int) { if cursor == "" { return "", nil, argIndex @@ -138,9 +147,8 @@ func addCursorCondition(cursor string, argIndex int) (string, []any, int) { if len(parts) == 2 { cursorServerName := parts[0] cursorVersion := parts[1] - // Use compound condition: (server_name > cursor_name) OR (server_name = cursor_name AND version > cursor_version) - condition := fmt.Sprintf("(server_name > $%d OR (server_name = $%d AND version > $%d))", argIndex, argIndex+1, argIndex+2) - return condition, []any{cursorServerName, cursorServerName, cursorVersion}, argIndex + 3 + condition := fmt.Sprintf("(server_name, version) > ($%d, $%d)", argIndex, argIndex+1) + return condition, []any{cursorServerName, cursorVersion}, argIndex + 2 } // Fallback for malformed cursor - treat as server name only for backwards compatibility diff --git a/internal/database/postgres_test.go b/internal/database/postgres_test.go index d0e4b97..6784ae5 100644 --- a/internal/database/postgres_test.go +++ b/internal/database/postgres_test.go @@ -1150,6 +1150,104 @@ func TestPostgreSQL_PerformanceScenarios(t *testing.T) { // Should have retrieved all servers including the ones we just created assert.GreaterOrEqual(t, len(allResults), serverCount) }) + + t.Run("compound cursor across versions of same server", func(t *testing.T) { + // Insert multiple versions of two servers so cursor pagination has to + // correctly seek across the (server_name, version) boundary. This is the + // case that the row-constructor cursor predicate `(server_name, version) > ($1, $2)` + // has to handle — the OR-decomposed form had the same semantics but a + // linear-scan plan; this test pins the semantic behaviour so a future + // rewrite can't silently break it. + serverA := "com.example/cursor-test-a" + serverB := "com.example/cursor-test-b" + versionsA := []string{"1.0.0", "2.0.0", "3.0.0"} + versionsB := []string{"1.0.0", "2.0.0"} + + // First mark the latest version of each as latest=true; older ones false + // so the pkey + uniqueness constraints are satisfied. + mkServer := func(name, version string, isLatest bool) { + _, err := db.CreateServer(ctx, nil, &apiv0.ServerJSON{ + Name: name, Description: "compound cursor test", Version: version, + }, &apiv0.RegistryExtensions{ + Status: model.StatusActive, + StatusChangedAt: timeNow, PublishedAt: timeNow, UpdatedAt: timeNow, + IsLatest: isLatest, + }) + require.NoError(t, err) + } + for i, v := range versionsA { + mkServer(serverA, v, i == len(versionsA)-1) + } + for i, v := range versionsB { + mkServer(serverB, v, i == len(versionsB)-1) + } + + // Filter to just the two servers we just created so unrelated rows in the + // shared test DB don't bleed in. + filterTo := func(rs []*apiv0.ServerResponse) []*apiv0.ServerResponse { + out := make([]*apiv0.ServerResponse, 0, len(rs)) + for _, r := range rs { + if r.Server.Name == serverA || r.Server.Name == serverB { + out = append(out, r) + } + } + return out + } + + // Cursor at (serverA, "1.0.0") must skip 1.0.0 and return 2.0.0, 3.0.0, + // then both versions of serverB. Specifically tests the compound predicate: + // without it, the OR form would still skip 1.0.0 correctly but the version + // boundary of (serverA, "3.0.0") → (serverB, "1.0.0") is what depends on + // the second-column comparison. + results, _, err := db.ListServers(ctx, nil, nil, serverA+":1.0.0", 100) + require.NoError(t, err) + got := filterTo(results) + require.Len(t, got, 4, "expected 4 rows after cursor at A:1.0.0") + assert.Equal(t, serverA, got[0].Server.Name) + assert.Equal(t, "2.0.0", got[0].Server.Version) + assert.Equal(t, serverA, got[1].Server.Name) + assert.Equal(t, "3.0.0", got[1].Server.Version) + assert.Equal(t, serverB, got[2].Server.Name) + assert.Equal(t, "1.0.0", got[2].Server.Version) + assert.Equal(t, serverB, got[3].Server.Name) + assert.Equal(t, "2.0.0", got[3].Server.Version) + + // Cursor at the *last* version of serverA must cross the server boundary + // and return serverB rows only. + results, _, err = db.ListServers(ctx, nil, nil, serverA+":3.0.0", 100) + require.NoError(t, err) + got = filterTo(results) + require.Len(t, got, 2, "expected 2 rows after cursor at A:3.0.0") + assert.Equal(t, serverB, got[0].Server.Name) + assert.Equal(t, "1.0.0", got[0].Server.Version) + assert.Equal(t, serverB, got[1].Server.Name) + assert.Equal(t, "2.0.0", got[1].Server.Version) + + // Page-by-page traversal with size=2 must produce the same global ordering + // (A 1.0.0, A 2.0.0, A 3.0.0, B 1.0.0, B 2.0.0). + var paged []*apiv0.ServerResponse + cursor := "" + for { + rs, next, err := db.ListServers(ctx, nil, + &database.ServerFilter{SubstringName: stringPtr("cursor-test-")}, + cursor, 2) + require.NoError(t, err) + paged = append(paged, rs...) + if next == "" || len(rs) < 2 { + break + } + cursor = next + } + require.Len(t, paged, 5) + want := []struct{ name, version string }{ + {serverA, "1.0.0"}, {serverA, "2.0.0"}, {serverA, "3.0.0"}, + {serverB, "1.0.0"}, {serverB, "2.0.0"}, + } + for i, w := range want { + assert.Equal(t, w.name, paged[i].Server.Name, "row %d name", i) + assert.Equal(t, w.version, paged[i].Server.Version, "row %d version", i) + } + }) } func TestPostgreSQL_NewStatusFields(t *testing.T) { diff --git a/internal/service/registry_service.go b/internal/service/registry_service.go index 4403136..16a9100 100644 --- a/internal/service/registry_service.go +++ b/internal/service/registry_service.go @@ -18,6 +18,18 @@ import ( const maxServerVersionsPerServer = 10000 +// Publish phase names emitted on the structured "publish complete"/"publish failed" +// log from createServerInTransaction. Constants because version_checks is reported +// from multiple branches. +const ( + phaseValidate = "validate" + phaseAcquireLock = "acquire_lock" + phaseValidateRemoteURLs = "validate_remote_urls" + phaseVersionChecks = "version_checks" + phaseUnmarkLatest = "unmark_latest" + phaseDBCreate = "db_create" +) + // registryServiceImpl implements the RegistryService interface using our Database type registryServiceImpl struct { db database.Database @@ -87,60 +99,105 @@ func (s *registryServiceImpl) CreateServer(ctx context.Context, req *apiv0.Serve } // createServerInTransaction contains the actual CreateServer logic within a transaction. -func (s *registryServiceImpl) createServerInTransaction(ctx context.Context, tx pgx.Tx, req *apiv0.ServerJSON) (*apiv0.ServerResponse, error) { +// +// Phases are individually timed and emitted as a single structured log event per call. +// During the 2026-04-27 incident the validate-only timing (the previous shape) hid +// pool-exhaustion stalls in acquire_lock / version_checks / db_create — we saw 50s+ +// total publish times even though validate_ms was a few hundred ms. With every phase +// reported the next slow publish tells us which step to blame. +func (s *registryServiceImpl) createServerInTransaction(ctx context.Context, tx pgx.Tx, req *apiv0.ServerJSON) (resp *apiv0.ServerResponse, err error) { + start := time.Now() serverJSON := *req + var ( + validateMs, lockMs, remotesMs, versionChecksMs, unmarkMs, createMs int64 + failedPhase string + ) - // Validate the request. ValidatePublishRequest fans out to npm/PyPI/OCI for - // registry-ownership checks with 10s per-host timeouts, so it's the most likely - // contributor to publish latency. Log validate_ms on both success and failure - // so the next /v0/publish latency alert is diagnostic — a slow upstream that - // times out into a validation error is exactly the case we need to see. - validateStart := time.Now() - validateErr := validators.ValidatePublishRequest(ctx, serverJSON, s.cfg) - validateMs := time.Since(validateStart).Milliseconds() - if validateErr != nil { - slog.WarnContext(ctx, "publish validate failed", + defer func() { + attrs := []any{ "server_name", serverJSON.Name, "version", serverJSON.Version, + "total_ms", time.Since(start).Milliseconds(), "validate_ms", validateMs, - "error", validateErr.Error(), - ) - return nil, validateErr + "lock_ms", lockMs, + "remotes_ms", remotesMs, + "version_checks_ms", versionChecksMs, + "unmark_ms", unmarkMs, + "create_ms", createMs, + } + if err != nil { + attrs = append(attrs, "failed_phase", failedPhase, "error", err.Error()) + slog.WarnContext(ctx, "publish failed", attrs...) + } else { + slog.InfoContext(ctx, "publish complete", attrs...) + } + }() + + // runPhase times fn into *ms and, on error, stashes the phase name + error + // onto the closed-over failedPhase / err. Returns true on success so callers + // can `if !runPhase(...) { return nil, err }`. + runPhase := func(name string, ms *int64, fn func() error) bool { + t := time.Now() + e := fn() + *ms = time.Since(t).Milliseconds() + if e != nil { + failedPhase = name + err = e + return false + } + return true + } + + // Validate the request — registry-ownership checks fan out to npm/PyPI/OCI with + // 10s per-host timeouts. Was historically the most likely slow phase; now any + // phase can be the slow one when the connection pool is starved. + if !runPhase(phaseValidate, &validateMs, func() error { + return validators.ValidatePublishRequest(ctx, serverJSON, s.cfg) + }) { + return nil, err } publishTime := time.Now() // Acquire advisory lock to prevent concurrent publishes of the same server - if err := s.db.AcquirePublishLock(ctx, tx, serverJSON.Name); err != nil { + if !runPhase(phaseAcquireLock, &lockMs, func() error { + return s.db.AcquirePublishLock(ctx, tx, serverJSON.Name) + }) { return nil, err } // Check for duplicate remote URLs - if err := s.validateNoDuplicateRemoteURLs(ctx, tx, serverJSON); err != nil { + if !runPhase(phaseValidateRemoteURLs, &remotesMs, func() error { + return s.validateNoDuplicateRemoteURLs(ctx, tx, serverJSON) + }) { return nil, err } - // Check we haven't exceeded the maximum versions allowed for a server - versionCount, err := s.db.CountServerVersions(ctx, tx, serverJSON.Name) - if err != nil && !errors.Is(err, database.ErrNotFound) { - return nil, err - } - if versionCount >= maxServerVersionsPerServer { - return nil, database.ErrMaxServersReached - } - - // Check this isn't a duplicate version - versionExists, err := s.db.CheckVersionExists(ctx, tx, serverJSON.Name, serverJSON.Version) - if err != nil { - return nil, err - } - if versionExists { - return nil, database.ErrInvalidVersion - } - - // Get current latest version to determine if new version should be latest - currentLatest, err := s.db.GetCurrentLatestVersion(ctx, tx, serverJSON.Name) - if err != nil && !errors.Is(err, database.ErrNotFound) { + // Version checks: count, exists, current-latest (small DB lookups, but on a + // starved pool any of them stalls until a connection is free). Bundled under + // one phase since they share a logical step. + var currentLatest *apiv0.ServerResponse + if !runPhase(phaseVersionChecks, &versionChecksMs, func() error { + versionCount, e := s.db.CountServerVersions(ctx, tx, serverJSON.Name) + if e != nil && !errors.Is(e, database.ErrNotFound) { + return e + } + if versionCount >= maxServerVersionsPerServer { + return database.ErrMaxServersReached + } + versionExists, e := s.db.CheckVersionExists(ctx, tx, serverJSON.Name, serverJSON.Version) + if e != nil { + return e + } + if versionExists { + return database.ErrInvalidVersion + } + currentLatest, e = s.db.GetCurrentLatestVersion(ctx, tx, serverJSON.Name) + if e != nil && !errors.Is(e, database.ErrNotFound) { + return e + } + return nil + }) { return nil, err } @@ -161,7 +218,9 @@ func (s *registryServiceImpl) createServerInTransaction(ctx context.Context, tx // Unmark old latest version if needed if isNewLatest && currentLatest != nil { - if err := s.db.UnmarkAsLatest(ctx, tx, serverJSON.Name); err != nil { + if !runPhase(phaseUnmarkLatest, &unmarkMs, func() error { + return s.db.UnmarkAsLatest(ctx, tx, serverJSON.Name) + }) { return nil, err } } @@ -176,16 +235,13 @@ func (s *registryServiceImpl) createServerInTransaction(ctx context.Context, tx } // Insert new server version - resp, err := s.db.CreateServer(ctx, tx, &serverJSON, officialMeta) - if err != nil { + if !runPhase(phaseDBCreate, &createMs, func() error { + var e error + resp, e = s.db.CreateServer(ctx, tx, &serverJSON, officialMeta) + return e + }) { return nil, err } - - slog.InfoContext(ctx, "publish complete", - "server_name", serverJSON.Name, - "version", serverJSON.Version, - "validate_ms", validateMs, - ) return resp, nil } From a4d9d829205ad1982c4bc345763e870c79643235 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Mon, 27 Apr 2026 15:58:11 -0400 Subject: [PATCH 179/313] deploy: update prod to v1.7.2 (#1216) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary Promotes [v1.7.2](https://github.com/modelcontextprotocol/registry/releases/tag/v1.7.2) (PR #1215) to production: - **Row-constructor cursor pagination** — fixes the 760ms list query that was the root cause of today's pool-exhaustion alerts. Local benchmark shows /v0/servers paginated requests dropping from ~30ms (cold cache, 100K rows) to ~0.05ms. - **Per-phase publish slog** — `publish complete` events now include validate / lock / remotes / version_checks / unmark / db_create timings so the next slow publish is self-diagnostic. - **pg_stat_statements** — aggregate query visibility we didn't have during today's incident. ## Deployment caveat The CNPG cluster spec change for `pg_stat_statements` triggers an in-pod postgres restart on the next prod Pulumi run. Staging took **~45–70s of registry unavailability** during the equivalent restart. The DB retry-with-backoff in v1.7.1 covers most of it, but registry pods may bounce once before they reconnect (one staging pod hit `Failed to connect after 8 attempts` then recovered on its next restart). **Time the merge for a low-traffic UTC window** — the alert history suggests very early UTC is quietest. ## Post-merge action Once the prod Pulumi run completes, run once on the existing cluster: ```bash PATH=/opt/homebrew/share/google-cloud-sdk/bin:$PATH kubectl exec -i registry-pg-1 -c postgres \ --context gke_mcp-registry-prod_us-central1-b_mcp-registry-prod \ -- psql -U postgres -c "CREATE EXTENSION IF NOT EXISTS pg_stat_statements" ``` Verify: ```bash kubectl exec -i registry-pg-1 -c postgres \ --context gke_mcp-registry-prod_us-central1-b_mcp-registry-prod \ -- psql -U postgres -d app -c " SELECT round(mean_exec_time::numeric, 2) AS mean_ms, calls, substring(query, 1, 80) AS q FROM pg_stat_statements ORDER BY total_exec_time DESC LIMIT 10;" ``` ## Test plan - [x] v1.7.2 release built and pushed (`ghcr.io/modelcontextprotocol/registry:1.7.2`) - [x] Staging deployed cleanly; `pg_stat_statements` is collecting on staging - [ ] Prod Pulumi run applies cleanly; brief PG restart - [ ] Run `CREATE EXTENSION` on prod - [ ] Confirm `publish complete` events contain per-phase timings on the next publish 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.7 (1M context) --- deploy/Pulumi.gcpProd.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/deploy/Pulumi.gcpProd.yaml b/deploy/Pulumi.gcpProd.yaml index 1dd623b..46c12c2 100644 --- a/deploy/Pulumi.gcpProd.yaml +++ b/deploy/Pulumi.gcpProd.yaml @@ -1,7 +1,7 @@ config: mcp-registry:environment: prod mcp-registry:provider: gcp - mcp-registry:imageTag: 1.7.1 # Set specific image tag for production (change this to deploy different versions) + mcp-registry:imageTag: 1.7.2 # Set specific image tag for production (change this to deploy different versions) gcp:project: mcp-registry-prod mcp-registry:githubClientId: Iv23liUydBbI7Z2Q9bOZ mcp-registry:githubClientSecret: From 3764acad404e3d145117c781c70d18bdc3137c60 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 28 Apr 2026 03:23:14 -0400 Subject: [PATCH 180/313] build(deps): bump github.com/pulumi/pulumi-kubernetes/sdk/v4 from 4.29.0 to 4.30.0 in /deploy (#1217) Bumps [github.com/pulumi/pulumi-kubernetes/sdk/v4](https://github.com/pulumi/pulumi-kubernetes) from 4.29.0 to 4.30.0.
    Release notes

    Sourced from github.com/pulumi/pulumi-kubernetes/sdk/v4's releases.

    v4.30.0

    No release notes provided.

    Changelog

    Sourced from github.com/pulumi/pulumi-kubernetes/sdk/v4's changelog.

    4.30.0 (April 24, 2026)

    Fixed

    • #4295Fix kustomize.v2.Directory resource output type in the schema to properly support array outputs. Previously, the resources field was incorrectly typed as a string in the schema. This fix updates the type to an array of Any, aligning the schema with the provider's Go implementation (pulumi.ArrayOutput). This resolves a regression that caused the Kustomize v2 resource to fail in the Python SDK.
    • #2997 Stop stripping null values when unmarshaling, fixing Helm chart default deletion and valueYamlFiles null handling. Deprecate allowNullValues (no longer needed).

    Changed

    • Upgrade Kubernetes schema and libraries to v1.35.4.
    • Upgrade Kubernetes schema and libraries to v1.36.0.
    Commits

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/pulumi/pulumi-kubernetes/sdk/v4&package-manager=go_modules&previous-version=4.29.0&new-version=4.30.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- deploy/go.mod | 2 +- deploy/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index 3c86c89..79fbc0e 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -4,7 +4,7 @@ go 1.26 require ( github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 - github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.29.0 + github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.30.0 github.com/pulumi/pulumi/sdk/v3 v3.232.0 gopkg.in/yaml.v2 v2.4.0 ) diff --git a/deploy/go.sum b/deploy/go.sum index 2c2628b..e3c85c8 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -181,8 +181,8 @@ github.com/pulumi/esc v0.17.0 h1:oaVOIyFTENlYDuqc3pW75lQT9jb2cd6ie/4/Twxn66w= github.com/pulumi/esc v0.17.0/go.mod h1:XnSxlt5NkmuAj304l/gK4pRErFbtqq6XpfX1tYT9Jbc= github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 h1:w6OnO3d4j5yVf2vpm8OzXFC/xHOEGqt+9FjWCUBCq6U= github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1/go.mod h1:UyZyv7hz4knpFx6/Sh+SkZe6hT6sJHtDvw9A0TbvEsk= -github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.29.0 h1:NHikF7fXARV//HEwK8wW8kBq+8TGf1pzSV1O946AXDY= -github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.29.0/go.mod h1:BAWI9R3JEEGOp1JlXLPSZKwBGANSrPGUWKtMnS5w5qw= +github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.30.0 h1:nF0Y1F7fUGL6RYD9EAtHTdDbNFmDaA3xcEiRlvCDV5E= +github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.30.0/go.mod h1:BAWI9R3JEEGOp1JlXLPSZKwBGANSrPGUWKtMnS5w5qw= github.com/pulumi/pulumi/sdk/v3 v3.232.0 h1:pU9j5qYHYtYZGaIKha1KFuB9ggp2obcMD1U523tpEnk= github.com/pulumi/pulumi/sdk/v3 v3.232.0/go.mod h1:33NoTpvQXlTtAuaPbompgZNA3Ye4XEvxNydELFlWza8= github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ= From a490b6f1ecc171ce7235bb29560cb2a56e950fa6 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 28 Apr 2026 03:23:31 -0400 Subject: [PATCH 181/313] build(deps): bump goreleaser/goreleaser-action from 7.1.0 to 7.2.1 in the actions group (#1218) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps the actions group with 1 update: [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action). Updates `goreleaser/goreleaser-action` from 7.1.0 to 7.2.1
    Release notes

    Sourced from goreleaser/goreleaser-action's releases.

    v7.2.1

    This fully removes the usage of the old nightly moving tag.

    Full Changelog: https://github.com/goreleaser/goreleaser-action/compare/v7.2.0...v7.2.1

    v7.2.0

    What's Changed

    Full Changelog: https://github.com/goreleaser/goreleaser-action/compare/v7...v7.2.0

    Commits
    • 1a80836 ci(nightly): pass GITHUB_TOKEN to nightly integration job
    • a71152e refactor: drop legacy 'nightly' tag fallback
    • 4c6ab56 feat: resolve nightly to latest vX.Y.Z-<sha>-nightly release (#558)
    • 4f96abf feat: add version-file input (#556)
    • 15fa2a9 test: cover install across release eras (#555)
    • See full diff in compare view

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=goreleaser/goreleaser-action&package-manager=github_actions&previous-version=7.1.0&new-version=7.2.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index b0e6c1f..7b248f2 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -31,7 +31,7 @@ jobs: uses: anchore/sbom-action/download-syft@v0.24.0 - name: Run GoReleaser - uses: goreleaser/goreleaser-action@e24998b8b67b290c2fa8b7c14fcfa7de2c5c9b8c + uses: goreleaser/goreleaser-action@1a80836c5c9d9e5755a25cb59ec6f45a3b5f41a8 with: distribution: goreleaser version: v2.12.0 From 54cbe2473cf37fabee22aeea56968b4448f84371 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Tue, 28 Apr 2026 15:03:21 -0400 Subject: [PATCH 182/313] fix(list): use JSONB containment for RemoteURL filter (GIN-indexable) (#1220) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary Same shape of bug as #1215's cursor fix, different filter. The RemoteURL filter built its WHERE predicate using `jsonb_array_elements` + `->>` extraction, which the planner can't translate into a GIN search. Replaced with a JSONB containment predicate `@>` that uses `idx_servers_json_remotes`. ## Diagnosis (from the per-phase publish slog #1215 added) Today's first publish-latency alert at 17:08 UTC pointed straight at this: ``` publish complete server_name=dev.storage/mcp version=1.10.1 total_ms=14822 validate_ms=0 lock_ms=238 remotes_ms=10980 version_checks_ms=535 unmark_ms=3014 create_ms=53 ``` `remotes_ms=10,980` on a server with **one** remote URL pointed at `validateNoDuplicateRemoteURLs`, which runs the RemoteURL filter against the database. EXPLAIN ANALYZE on prod confirmed: ``` Filter: (status != 'deleted') AND EXISTS(SubPlan 1) Rows Removed by Filter: 21,092 ← scans the whole table Buffers: shared hit=20,028 Execution Time: 10,005 ms ``` ## Fix `internal/database/postgres.go:99` rewritten: ```sql -- before (planner can't use GIN index for this) EXISTS (SELECT 1 FROM jsonb_array_elements(value->'remotes') AS remote WHERE remote->>'url' = $1) -- after (GIN-indexable) value -> 'remotes' @> jsonb_build_array(jsonb_build_object('url', $1::text)) ``` Semantically equivalent for our schema (`url` is always a string, NOT NULL). ## Local benchmark — 20K rows, prod-shaped JSONB (~1KB/row) | Form | Buffer hits | Index used | Time | |------|------------:|------------|-----:| | OLD | 40,398 | none — full scan | 17.0 ms | | NEW | **294** | **`idx_servers_json_remotes` GIN bitmap** | **1.6 ms** | Maps to prod's 10,005 ms cold-cache observation — same shape of speedup we got from the cursor fix. ## Scope honesty This PR addresses the **publish slowness path** (`validateNoDuplicateRemoteURLs` in the publish transaction). It directly resolves today's 17:08 UTC `Publish Endpoint Latency` alert. It does **not** address: - Today's 17:35–17:40 UTC `Availability dropped below 95%` alert. Per-investigation: only 4 publishes happened in the entire 17:00–17:50 window and zero during the burst minutes — so my initial "concurrent slow publishes starved the pool" hypothesis was wrong. The actual cause was scraper-driven concurrency (4,500+ requests in 5 min) on plain cursor pagination + ILIKE substring search, where individual queries are fast (mean 42 ms) but tail latency under concurrency reaches 10 s server-side and 20–35 s nginx-level due to pool queueing. - The 18:17 UTC `Publish Endpoint Latency` re-fire (same scraper-driven concurrency). A follow-up PR will raise pool size + PG `max_connections` + add explicit PG resource limits to absorb concurrency without queue blowup. That fix has a different shape (config) and a different risk profile (PG restart for `max_connections`); kept separate so this surgical SQL change can ship cleanly. ## Test plan - [x] `go build ./...` clean - [x] `make lint` clean - [x] `go test -race ./internal/database/... ./internal/service/...` green — existing `TestPostgreSQL_ListServers/filter by remote URL` covers semantic correctness - [x] EXPLAIN ANALYZE comparison locally on 20K rows + prod-shaped JSONB - [ ] After merge + deploy: verify on prod via `EXPLAIN ANALYZE`; confirm `remotes_ms` in `publish complete` slog drops to single-digit ms ## Out of scope (separate follow-ups) - pgxpool `MaxConns` / `MinConns` bump + PG `max_connections` raise + PG `resources` limits — addresses the cursor-tail and ILIKE-search concurrency that this PR doesn't touch - Per-IP rate limiting at nginx — defends against scraper retry storms regardless of query speed - `Cache-Control` headers on `/v0/servers` — let nginx absorb scraper repeats - Pre-existing `superfluous WriteHeader` warnings — separate Huma framework issue - ILIKE substring search on `server_name` is unindexable — could be replaced with `pg_trgm` GIN index or full-text search 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.7 (1M context) --- internal/database/postgres.go | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/internal/database/postgres.go b/internal/database/postgres.go index ff139e2..105c570 100644 --- a/internal/database/postgres.go +++ b/internal/database/postgres.go @@ -96,7 +96,15 @@ func buildFilterConditions(filter *ServerFilter, argIndex int) ([]string, []any, argIndex++ } if filter.RemoteURL != nil { - conditions = append(conditions, fmt.Sprintf("EXISTS (SELECT 1 FROM jsonb_array_elements(value->'remotes') AS remote WHERE remote->>'url' = $%d)", argIndex)) + // Use a JSONB containment predicate so the planner can use the GIN index + // idx_servers_json_remotes on (value -> 'remotes'). The previously-used + // EXISTS / jsonb_array_elements / ->> form is logically equivalent but + // the planner can't translate the per-row array unfolding into a GIN + // search — it falls back to scanning every row. validateNoDuplicateRemoteURLs + // in the publish path ran this filter and was measured at ~10s on prod's + // 21K-row table on 2026-04-28; the containment form is GIN-indexable and + // completes in low single-digit ms. + conditions = append(conditions, fmt.Sprintf("value -> 'remotes' @> jsonb_build_array(jsonb_build_object('url', $%d::text))", argIndex)) args = append(args, *filter.RemoteURL) argIndex++ } From 736d37685808225a4fed0efaf39e2049920e06bb Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Tue, 28 Apr 2026 15:21:24 -0400 Subject: [PATCH 183/313] fix(db): raise pgxpool MaxConns + PG max_connections + set PG resources (#1221) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary Follow-up to #1215 and #1220. Both of those addressed *individual* slow queries; this PR addresses *concurrency* — under today's scraper load the cursor query is fast on average (mean 42ms) but the connection pool saturates and queue depth blows up at the Go HTTP layer. ## Diagnosis `pg_stat_statements` (added in #1215) made this possible to see: ``` max_ms mean_ms calls template 10,755 41.8 94,009 plain cursor pagination, no filter 7,277 214.7 14,770 ILIKE substring filter 7,638 330.8 7,656 ILIKE substring + is_latest filter ``` Mean times are healthy. But `max_exec_time` of 7–10s on the cursor query, combined with sustained ~15 req/s from scrapers (ServiceNow's 148.139.x.x range, anonymous `node` user-agent, etc) saturates `MaxConns=30 × 2 pods = 60`. New requests queue at the Go HTTP layer; nginx-side p99 hits 35s; eventually scrapers time out at 60s, retry, and amplify the queue. Today's two ongoing alerts are both this pattern: - 17:35–17:40 UTC `Availability dropped below 95%` — 4,526 GET requests in 5 min, hundreds of 504s - 18:17 UTC `Publish Endpoint Latency` re-fire — same scraper concurrency dragging the publish path Critically, the symptoms today were also visible during yesterday's incident, but yesterday's broken cursor (#1215) was the dominant cause. After #1215 the cursor is fast individually; concurrency now becomes the next bottleneck. ## Changes ### pgxpool (`internal/database/postgres.go`) | Setting | Before | After | |---------|-------:|------:| | `MaxConns` | 30 | **60** per pod | | `MinConns` | 5 | **10** per pod | | `MaxConnIdleTime` | 30 min | (unchanged) | | `MaxConnLifetime` | 2 h | (unchanged) | 2 pods × 60 = 120 total app connections. Cuts queue depth roughly in half at current scraper load. ### PG cluster (`deploy/pkg/k8s/postgres.go`) - `max_connections: 100 → 200` — required to support the larger pool. 120 (app) + ~10 (PG internals: autovacuum, replication, admin) + 70 headroom. - Added explicit `resources:` block — previously the pod had no resource limits, making node-level OOM behaviour unpredictable. | | Request | Limit | |---|--------:|------:| | memory | 512Mi | **4Gi** | | cpu | 200m | 1500m | ## Resource budget | Node | Now | After | |------|----:|------:| | dy89 (PG node) | 39% mem (~2.4 GiB / 6 GiB) | ~65% mem worst-case (~3.9 GiB) | | 2yxm | 36% mem | unchanged | Both nodes well within capacity. CPU usage <50% on both, plenty of headroom. PG worst-case memory math: - 200 conns × ~15 MB per backend = 3 GiB - + `shared_buffers` 128 MiB - + `maintenance_work_mem`, OS overhead, etc. - ≈ 3–4 GiB total ## Deployment caveat `max_connections` is a postmaster-level setting → CNPG triggers a PG restart on the change. Same in-pod restart shape as the pg_stat_statements deploy yesterday — registry pods see ~30s of DB unavailability, covered by v1.7.1's retry-with-backoff (8 attempts, 1→8s capped). One registry pod may bounce once before recovering, like yesterday. **Time the merge for a low-traffic UTC window.** Order of operations matters within the deploy itself: 1. Pulumi applies the new CNPG spec → PG restarts with `max_connections=200` 2. Rolling deploy of registry pods picks up `MaxConns=60` config 3. New conns are accepted up to 200 limit Pulumi's standard ordering does step 1 before step 2 in this scenario (Pulumi resource graph: CNPG cluster precedes Deployment). If for any reason it doesn't, the worst case is `too many connections` errors during a small window — Self-correcting once the rollout completes. ## Test plan - [x] `go build ./...` clean for app + deploy - [x] `make lint` clean - [x] `go test -race ./internal/database/...` green - [ ] On merge: staging deploy applies the spec change cleanly; PG restarts; pool reaches 60 max - [ ] On prod deploy: same; verify no `too many connections` errors during the rollout window - [ ] After deploy: query `SHOW max_connections` returns 200; query pg_stat_statements after a scraper burst, confirm `max_exec_time` for cursor query no longer hits 10s ## Out of scope - **ILIKE substring search** (`server_name ILIKE '%foo%'`) is unindexable. Three pg_stat_statements variants run with means 141–333ms and max 4–7s. Worth replacing with a `pg_trgm` GIN index or full-text search in a separate PR. - **Per-IP nginx rate limiting** — defends against scraper retry storms regardless of pool size. - **`Cache-Control` on `/v0/servers`** — let nginx absorb scraper-repeated cursors. - **Pre-existing `superfluous WriteHeader` warnings** — separate Huma framework issue. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.7 (1M context) --- deploy/pkg/k8s/postgres.go | 21 +++++++++++++++++++++ internal/database/postgres.go | 10 +++++++--- 2 files changed, 28 insertions(+), 3 deletions(-) diff --git a/deploy/pkg/k8s/postgres.go b/deploy/pkg/k8s/postgres.go index 7a119fd..0b5e407 100644 --- a/deploy/pkg/k8s/postgres.go +++ b/deploy/pkg/k8s/postgres.go @@ -59,6 +59,21 @@ func DeployPostgresDatabases(ctx *pulumi.Context, cluster *providers.ProviderInf "storage": map[string]any{ "size": "50Gi", }, + // Explicit resource budget. PG was previously unlimited which made + // node-level OOM behaviour unpredictable. With max_connections=200 + // the worst-case per-connection memory (~10–15MB each) plus + // shared_buffers and overhead lands around 3–4GiB; 4Gi limit gives + // headroom for query workspaces (work_mem) and OS-level effects. + "resources": map[string]any{ + "requests": map[string]any{ + "memory": "512Mi", + "cpu": "200m", + }, + "limits": map[string]any{ + "memory": "4Gi", + "cpu": "1500m", + }, + }, // Enable pg_stat_statements so we can attribute slow time to specific // queries (the 2026-04-27 incident took an EXPLAIN-the-one-query-I-saw // approach because we had no aggregate visibility). CNPG triggers a PG @@ -66,10 +81,16 @@ func DeployPostgresDatabases(ctx *pulumi.Context, cluster *providers.ProviderInf // is brief downtime. CREATE EXTENSION still needs to run once as a // superuser on existing clusters; new clusters get it via the // postInitApplicationSQL hook below. + // + // max_connections raised from default 100 to 200 because the registry + // pgxpool was bumped from 30 to 60 per pod (120 total across 2 pods) + // + ~10 reserved for PG internals and ad-hoc admin = 130, with 70 + // headroom for future scale or burst. "postgresql": map[string]any{ "shared_preload_libraries": []any{"pg_stat_statements"}, "parameters": map[string]any{ "pg_stat_statements.track": "all", + "max_connections": "200", }, }, "bootstrap": map[string]any{ diff --git a/internal/database/postgres.go b/internal/database/postgres.go index 105c570..1b0abdb 100644 --- a/internal/database/postgres.go +++ b/internal/database/postgres.go @@ -45,9 +45,13 @@ func NewPostgreSQL(ctx context.Context, connectionURI string) (*PostgreSQL, erro return nil, fmt.Errorf("failed to parse PostgreSQL config: %w", err) } - // Configure pool for stability-focused defaults - config.MaxConns = 30 // Handle good concurrent load - config.MinConns = 5 // Keep connections warm for fast response + // Configure pool for stability-focused defaults. + // MaxConns was 30 per pod (60 total across 2 replicas) which saturated under + // the 2026-04-28 scraper bursts (15 req/s on /v0/servers caused queue blowup + // even though individual queries were fast). 60 per pod gives 120 total, + // leaving 80 of PG max_connections=200 for autovacuum/admin/headroom. + config.MaxConns = 60 // Handle scraper-burst concurrent load + config.MinConns = 10 // Keep connections warm for fast response config.MaxConnIdleTime = 30 * time.Minute // Keep connections available for bursts config.MaxConnLifetime = 2 * time.Hour // Refresh connections regularly for stability From 0a97e59ecb937a59b880d20a8a2f47579ba5d9ea Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Tue, 28 Apr 2026 17:50:38 -0400 Subject: [PATCH 184/313] deploy: update prod to v1.7.3 (#1223) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary Promotes [v1.7.3](https://github.com/modelcontextprotocol/registry/releases/tag/v1.7.3) to production. Contents: - **#1220** — `RemoteURL` filter SQL rewritten to use JSONB containment (`@>`) instead of `EXISTS jsonb_array_elements`. The new form is GIN-indexable; the old form forced a full table scan. Local benchmark: 40,398 → 294 buffer reads, 17 ms → 1.6 ms. Maps to prod's 10,005 ms cold-cache observation. - **#1221** — pgxpool `MaxConns 30→60`, `MinConns 5→10`. PG `max_connections 100→200`. Explicit PG `resources:` block (was unset). ## What this addresses - **#1220**: yesterday's 17:08 UTC `Publish Endpoint Latency` alert (`dev.storage/mcp` publish took 14.8s with `remotes_ms=10980` — pinpointed by the per-phase slog from #1215). - **#1221**: yesterday's 17:35–17:40 UTC `Availability dropped below 95%` alert and 18:17 UTC `Publish Endpoint Latency` re-fire. Both were scraper-driven concurrency on `/v0/servers` (~15 req/s sustained from ServiceNow + others). With the bumped pool, the queue at the Go HTTP layer should clear faster instead of blowing up to 20–35s nginx-level latencies. ## Deployment caveat The PG `max_connections` change is a postmaster-level setting → CNPG triggers a PG restart on the next prod Pulumi run. With `instances: 1` this is brief downtime — staging took **~30s** during the equivalent restart, with **one registry pod bouncing once** on its 8-attempt DB-retry budget before recovering on the next kubelet restart. **Time the merge for a low-traffic UTC window.** Alert history suggests very early UTC (02:00–04:00) is quietest. ## Resource impact PG node memory is currently 39% (~2.4 GiB / 6 GiB allocatable). Worst-case PG memory growth with `max_connections=200` lands around 3–4 GiB, putting the node at ~65% — fits with headroom. Empirically, prod PG has peaked at **413 MiB** in the last 30h of incident data, so the proposed 4 GiB limit is ~10× the historical max — guardrail not constraint. ## Post-merge CNPG handles `pg_stat_statements` extension creation automatically (no manual `CREATE EXTENSION` step needed — it was already done in v1.7.2's deploy). Verify after deploy: ```bash PATH=/opt/homebrew/share/google-cloud-sdk/bin:$PATH # max_connections actually changed kubectl exec -i registry-pg-1 -c postgres \ --context gke_mcp-registry-prod_us-central1-b_mcp-registry-prod \ -- psql -U postgres -tAc "SHOW max_connections" # expect: 200 # resources block applied kubectl get pod registry-pg-1 \ --context gke_mcp-registry-prod_us-central1-b_mcp-registry-prod \ -o jsonpath='{.spec.containers[?(@.name=="postgres")].resources}{"\n"}' # pgxpool MaxConns reflected (registry app uses 60 per pod after restart) kubectl exec -i registry-pg-1 -c postgres \ --context gke_mcp-registry-prod_us-central1-b_mcp-registry-prod \ -- psql -U postgres -tAc "SELECT count(*) FROM pg_stat_activity WHERE datname='app'" ``` ## Test plan - [x] v1.7.3 release built and pushed (`ghcr.io/modelcontextprotocol/registry:1.7.3`) - [x] Staging deployed cleanly; PG restarted and came back with `max_connections=200`; one staging pod bounced as expected - [ ] Prod Pulumi run applies cleanly; brief PG restart - [ ] Confirm `SHOW max_connections` returns 200 on prod - [ ] Confirm `publish complete` events show `remotes_ms` < 10ms - [ ] Watch for any "too many connections" errors during the rollout window (none expected — Pulumi orders CNPG cluster before Deployment, so PG accepts the new conn limit before pgxpool tries to use it) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.7 (1M context) --- deploy/Pulumi.gcpProd.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/deploy/Pulumi.gcpProd.yaml b/deploy/Pulumi.gcpProd.yaml index 46c12c2..d071b8f 100644 --- a/deploy/Pulumi.gcpProd.yaml +++ b/deploy/Pulumi.gcpProd.yaml @@ -1,7 +1,7 @@ config: mcp-registry:environment: prod mcp-registry:provider: gcp - mcp-registry:imageTag: 1.7.2 # Set specific image tag for production (change this to deploy different versions) + mcp-registry:imageTag: 1.7.3 # Set specific image tag for production (change this to deploy different versions) gcp:project: mcp-registry-prod mcp-registry:githubClientId: Iv23liUydBbI7Z2Q9bOZ mcp-registry:githubClientSecret: From 5dcae5b3cee0f5ebfcc3c65c196bc5f89c6a1a68 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Wed, 29 Apr 2026 14:05:09 -0400 Subject: [PATCH 185/313] fix(deploy): bump registry pod memory to match doubled pgxpool size (#1225) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary Follow-up to #1221. That PR doubled pgxpool `MaxConns` from 30 to 60 per pod without bumping the registry pod memory limit. pgxpool keeps per-connection state in the Go process (prepared statement cache, scratch buffers, row iteration state), so memory grew roughly proportionally — peak per-pod usage shifted from ~330 MB to ~450 MB against a 512 MiB limit. ## What surfaced it Pod `tx49f` was OOMKilled at 17:01 UTC on 2026-04-29 (`exitCode 137`, `reason: OOMKilled`). Memory history from Cloud Monitoring confirms the regression: | Pods | Peak 30-min memory | |------|-------------------:| | Pre-#1221 (`MaxConns=30`) | 178–333 MB | | **Post-#1221** (`MaxConns=60`) | **437–449 MB** | | Old limit | **512 MiB** ← right at the edge | Other pod was at 394 MB at the time of inspection — could OOM again. ## Fix `deploy/pkg/k8s/registry.go:217-225`: | | Before | After | |---|-------:|------:| | `requests.memory` | 256 MiB | **512 MiB** | | `limits.memory` | 512 MiB | **1 GiB** | 1 GiB is ~2× the current peak under load — gives room for traffic spikes without immediate OOM risk. Either node has 4–5 GiB free allocatable memory, so the new request fits comfortably. ## Test plan - [x] `go build ./...` clean - [x] `golangci-lint run` clean - [ ] After release + prod promotion: pod memory stabilises around 450 MB peak with no OOMKills - [ ] After release + prod promotion: tx49f restartCount stops climbing (currently at 5) ## Deployment Zero downtime — Deployment template change only, rolling update with `maxSurge: 1, maxUnavailable: 0`. **No PG involvement** (no `max_connections` change, no shared_preload_libraries change). Same shape as a normal v1.7.x image promotion. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.7 (1M context) --- deploy/pkg/k8s/registry.go | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/deploy/pkg/k8s/registry.go b/deploy/pkg/k8s/registry.go index 579f740..48e9124 100644 --- a/deploy/pkg/k8s/registry.go +++ b/deploy/pkg/k8s/registry.go @@ -215,12 +215,20 @@ func DeployMCPRegistry(ctx *pulumi.Context, cluster *providers.ProviderInfo, env TimeoutSeconds: pulumi.Int(3), }, Resources: &corev1.ResourceRequirementsArgs{ + // Memory was 256Mi/512Mi when pgxpool MaxConns was 30. After + // #1221 doubled MaxConns to 60 per pod, peak per-pod memory + // shifted from ~330MB to ~450MB under scraper load and one + // pod was OOMKilled at 17:01 UTC on 2026-04-29. pgxpool keeps + // per-connection state (prepared statement cache, scratch + // buffers, row iteration state) so memory scales roughly + // linearly with the connection count. Doubled both request + // and limit to match. Requests: pulumi.StringMap{ - "memory": pulumi.String("256Mi"), + "memory": pulumi.String("512Mi"), "cpu": pulumi.String("100m"), }, Limits: pulumi.StringMap{ - "memory": pulumi.String("512Mi"), + "memory": pulumi.String("1Gi"), }, }, }, From f7663fe91a2d39153a9bc262ce8055a1727ce065 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Wed, 29 Apr 2026 14:43:18 -0400 Subject: [PATCH 186/313] deploy: update prod to v1.7.4 (#1226) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary Promotes [v1.7.4](https://github.com/modelcontextprotocol/registry/releases/tag/v1.7.4) (#1225) to production: registry pod memory request `256Mi → 512Mi`, limit `512Mi → 1Gi`. ## Why #1221 doubled pgxpool `MaxConns` 30→60 per pod without bumping the registry pod memory limit. pgxpool keeps per-connection state in the Go process (prepared statement cache, scratch buffers, row iteration state) so peak per-pod memory shifted from ~330 MB to ~450 MB against the 512 MiB limit. Pod `tx49f` was OOMKilled at 17:01 UTC on 2026-04-29. ## Validation so far - Staging deployed cleanly via `deploy-staging.yml` after #1225 merged - Both staging pods running with `req=512Mi limit=1Gi` ✓ - Rolling update was clean — no failed health checks during the transition - Both pods spread across nodes (q716 + 7exo) ## Deployment **Zero downtime** — Deployment template change only, rolling update with `maxSurge: 1, maxUnavailable: 0`. No PG involvement (no `max_connections` change, no shared_preload_libraries change). ## Test plan - [x] v1.7.4 release built and pushed (`ghcr.io/modelcontextprotocol/registry:1.7.4`) - [x] Staging deployed cleanly with new limits - [ ] Prod Pulumi run applies cleanly; rolling update completes - [ ] Prod pods come up with `req=512Mi limit=1Gi` - [ ] After 24h: no OOMKills on either pod, peak memory stays under ~600 MB 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.7 (1M context) --- deploy/Pulumi.gcpProd.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/deploy/Pulumi.gcpProd.yaml b/deploy/Pulumi.gcpProd.yaml index d071b8f..3859f13 100644 --- a/deploy/Pulumi.gcpProd.yaml +++ b/deploy/Pulumi.gcpProd.yaml @@ -1,7 +1,7 @@ config: mcp-registry:environment: prod mcp-registry:provider: gcp - mcp-registry:imageTag: 1.7.3 # Set specific image tag for production (change this to deploy different versions) + mcp-registry:imageTag: 1.7.4 # Set specific image tag for production (change this to deploy different versions) gcp:project: mcp-registry-prod mcp-registry:githubClientId: Iv23liUydBbI7Z2Q9bOZ mcp-registry:githubClientSecret: From 1201cbd82b2cf6d4b56edfc05c763059a12f9fdb Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Wed, 29 Apr 2026 19:14:00 -0400 Subject: [PATCH 187/313] security: fix open redirect and add small hardening (#1227) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## What this does Fixes an open redirect plus a handful of small, mostly-invisible hardening changes around it. ## What's in it - **The fix**: trailing-slash redirects no longer let `//evil.com/` redirect off-host. - **SSRF block** on the DNS/HTTP namespace verification — refuses to dial loopback, RFC1918, link-local, multicast, CGNAT, or IP-literal/single-label \"domains\". - **Slow-client guard**: `ReadTimeout` and `IdleTimeout` on the HTTP server (no `WriteTimeout` — would risk cutting off legitimate multi-package publishes). - **Defence-in-depth headers** on the UI (`/`) and 404 responses. - **5xx responses** stop leaking raw DB error text to clients (logged server-side instead). - **Search filter** stops treating `%` and `_` as wildcards. - **Validators**: PyPI/NuGet identifiers URL-escaped before fetching; MCPB no longer follows redirects. - **Misc**: `Version` field bounded to 255 chars; logs quote user input; `BlockedNamespaces` denylist now catches subdomain claimants. Each change is its own commit so they can be reviewed (or reverted) independently. ## Test plan - [ ] CI green - [ ] Synthetic publish in staging for each package type (npm, pypi, nuget, oci, mcpb) — confirms validator changes don't regress - [ ] Quick browser check of `/` after deploy to confirm UI still loads with the new CSP - [ ] `curl https:////evil.com/` — confirm the open redirect is closed 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.7 (1M context) --- docs/reference/api/openapi.yaml | 1 + .../server-json/draft/server.schema.json | 1 + internal/api/handlers/v0/auth/common.go | 13 +++ internal/api/handlers/v0/auth/common_test.go | 49 +++++++++++ internal/api/handlers/v0/auth/dns_test.go | 11 --- internal/api/handlers/v0/auth/http.go | 86 +++++++++++++++++++ .../handlers/v0/auth/http_internal_test.go | 52 +++++++++++ internal/api/handlers/v0/auth/http_test.go | 11 --- internal/api/handlers/v0/edit.go | 4 +- internal/api/handlers/v0/servers.go | 10 ++- internal/api/handlers/v0/status.go | 10 ++- internal/api/router/router.go | 23 ++++- internal/api/server.go | 18 +++- internal/api/server_test.go | 16 ++++ internal/auth/jwt.go | 11 ++- internal/database/postgres.go | 9 +- internal/validators/registries/mcpb.go | 23 ++++- internal/validators/registries/nuget.go | 15 ++-- internal/validators/registries/pypi.go | 10 ++- internal/validators/schemas/2025-12-11.json | 1 + pkg/api/v0/types.go | 2 +- pkg/model/types.go | 2 +- 22 files changed, 330 insertions(+), 48 deletions(-) create mode 100644 internal/api/handlers/v0/auth/common_test.go create mode 100644 internal/api/handlers/v0/auth/http_internal_test.go diff --git a/docs/reference/api/openapi.yaml b/docs/reference/api/openapi.yaml index faf8895..108e2fb 100644 --- a/docs/reference/api/openapi.yaml +++ b/docs/reference/api/openapi.yaml @@ -688,6 +688,7 @@ components: description: "Package version. Must be a specific version. Version ranges are rejected (e.g., '^1.2.3', '~1.2.3', '>=1.2.3', '1.x', '1.*')." example: "1.0.2" minLength: 1 + maxLength: 255 not: const: "latest" fileSha256: diff --git a/docs/reference/server-json/draft/server.schema.json b/docs/reference/server-json/draft/server.schema.json index 5c59335..95539fe 100644 --- a/docs/reference/server-json/draft/server.schema.json +++ b/docs/reference/server-json/draft/server.schema.json @@ -282,6 +282,7 @@ "version": { "description": "Package version. Must be a specific version. Version ranges are rejected (e.g., '^1.2.3', '~1.2.3', '\u003e=1.2.3', '1.x', '1.*').", "example": "1.0.2", + "maxLength": 255, "minLength": 1, "not": { "const": "latest" diff --git a/internal/api/handlers/v0/auth/common.go b/internal/api/handlers/v0/auth/common.go index 2f763d6..c283655 100644 --- a/internal/api/handlers/v0/auth/common.go +++ b/internal/api/handlers/v0/auth/common.go @@ -11,6 +11,7 @@ import ( "errors" "fmt" "math/big" + "net" "regexp" "strings" "time" @@ -376,6 +377,18 @@ func IsValidDomain(domain string) bool { return false } + // Reject IP literals — this auth method proves domain ownership, not IP + // ownership, and IP literals are an SSRF vector into internal networks. + if net.ParseIP(domain) != nil { + return false + } + + // Require at least one dot — rejects single-label names like "localhost" + // or "kubernetes" that resolve only inside private networks. + if !strings.Contains(domain, ".") { + return false + } + // Check for valid characters and structure domainPattern := regexp.MustCompile(`^[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?)*$`) return domainPattern.MatchString(domain) diff --git a/internal/api/handlers/v0/auth/common_test.go b/internal/api/handlers/v0/auth/common_test.go new file mode 100644 index 0000000..7662116 --- /dev/null +++ b/internal/api/handlers/v0/auth/common_test.go @@ -0,0 +1,49 @@ +package auth_test + +import ( + "testing" + + "github.com/modelcontextprotocol/registry/internal/api/handlers/v0/auth" +) + +func TestIsValidDomain(t *testing.T) { + tests := []struct { + domain string + want bool + }{ + // Valid + {"example.com", true}, + {"sub.example.com", true}, + {"a.b.c.d.example.com", true}, + {"foo-bar.example.com", true}, + {"123.example.com", true}, + + // Invalid — empty / oversize + {"", false}, + + // Invalid — IP literals (SSRF vector) + {"127.0.0.1", false}, + {"10.0.0.1", false}, + {"169.254.169.254", false}, + {"::1", false}, + {"fe80::1", false}, + + // Invalid — single-label internal names (SSRF vector) + {"localhost", false}, + {"kubernetes", false}, + {"internal", false}, + + // Invalid — bad characters / structure + {"-example.com", false}, + {"example.com-", false}, + {"exa mple.com", false}, + {"example..com", false}, + } + for _, tc := range tests { + t.Run(tc.domain, func(t *testing.T) { + if got := auth.IsValidDomain(tc.domain); got != tc.want { + t.Errorf("IsValidDomain(%q) = %v, want %v", tc.domain, got, tc.want) + } + }) + } +} diff --git a/internal/api/handlers/v0/auth/dns_test.go b/internal/api/handlers/v0/auth/dns_test.go index b4895ab..7ffda75 100644 --- a/internal/api/handlers/v0/auth/dns_test.go +++ b/internal/api/handlers/v0/auth/dns_test.go @@ -280,17 +280,6 @@ func TestDNSAuthHandler_Permissions(t *testing.T) { "v1.api.example.com/*", // should be reversed }, }, - { - name: "single part domain", - domain: "localhost", - expectedPatterns: []string{ - "localhost/*", // exact pattern (no reversal needed) - "localhost.*", // subdomain pattern - }, - unexpectedPatterns: []string{ - "*.localhost", // wrong wildcard position - }, - }, { name: "hyphenated domain", domain: "my-app.example-site.com", diff --git a/internal/api/handlers/v0/auth/http.go b/internal/api/handlers/v0/auth/http.go index e917f85..7d73d52 100644 --- a/internal/api/handlers/v0/auth/http.go +++ b/internal/api/handlers/v0/auth/http.go @@ -4,6 +4,7 @@ import ( "context" "fmt" "io" + "net" "net/http" "strings" "time" @@ -34,6 +35,9 @@ type DefaultHTTPKeyFetcher struct { // NewDefaultHTTPKeyFetcher creates a new HTTP key fetcher with timeout func NewDefaultHTTPKeyFetcher() *DefaultHTTPKeyFetcher { + transport := http.DefaultTransport.(*http.Transport).Clone() + transport.DialContext = safeDialContext + return &DefaultHTTPKeyFetcher{ client: &http.Client{ Timeout: 10 * time.Second, @@ -42,10 +46,92 @@ func NewDefaultHTTPKeyFetcher() *DefaultHTTPKeyFetcher { CheckRedirect: func(_ *http.Request, _ []*http.Request) error { return http.ErrUseLastResponse }, + Transport: transport, }, } } +// safeDialContext resolves the target hostname and refuses to dial loopback, +// private (RFC1918, ULA), link-local, or unspecified addresses. Combined with +// IsValidDomain rejecting IP literals, this neutralises SSRF abuse of the +// well-known fetcher: an attacker cannot reach internal HTTPS services +// (Kubernetes API server, internal admin panels, internal DNS-resolved hosts) +// even if they control DNS for an attacker domain. +// +// The hostname is resolved once here; we then dial the resolved IP directly, +// which pins the connection against DNS rebinding (a TOCTOU where the resolver +// returns a public IP to a pre-flight check and an internal IP to the actual +// dial). TLS SNI and the Host header continue to use the original hostname +// since they are set by http.Transport from the request URL, not the dial +// address. +func safeDialContext(ctx context.Context, network, addr string) (net.Conn, error) { + host, port, err := net.SplitHostPort(addr) + if err != nil { + return nil, err + } + + var resolver net.Resolver + ips, err := resolver.LookupIPAddr(ctx, host) + if err != nil { + return nil, err + } + + // Try each non-blocked address in order, falling through on dial failure. + // Without this, a stale public AAAA record that no longer routes (or any + // individually-unreachable IP) breaks auth where the default transport + // would have recovered by trying the next answer. + // + // Each attempt is bounded by perIPDialTimeout so that a single hanging + // address can't consume the whole http.Client budget. This is a + // simpler substitute for Happy Eyeballs (parallel A/AAAA racing) — we + // fail fast and try the next answer instead of racing them. + const perIPDialTimeout = 3 * time.Second + + var lastErr error + allBlocked := true + for _, ip := range ips { + if isBlockedIP(ip.IP) { + continue + } + allBlocked = false + dialCtx, cancel := context.WithTimeout(ctx, perIPDialTimeout) + var d net.Dialer + conn, dialErr := d.DialContext(dialCtx, network, net.JoinHostPort(ip.IP.String(), port)) + cancel() + if dialErr == nil { + return conn, nil + } + lastErr = dialErr + } + if allBlocked { + return nil, fmt.Errorf("dial %s: refusing to connect to private or loopback address", host) + } + return nil, fmt.Errorf("dial %s: all resolved public addresses failed: %w", host, lastErr) +} + +// cgnatRange covers RFC 6598 Carrier-Grade NAT (100.64.0.0/10), which the +// stdlib does not classify via any Is* helper but is reachable on some +// cloud / mobile networks where it shadows internal infrastructure. +var cgnatRange = func() *net.IPNet { + _, n, _ := net.ParseCIDR("100.64.0.0/10") + return n +}() + +// isBlockedIP reports whether an IP must not be dialled by the namespace +// verification fetcher. Covers loopback (127/8, ::1), RFC1918 + ULA via +// IsPrivate, link-local (169.254/16, fe80::/10 — includes cloud metadata +// 169.254.169.254), unspecified (0.0.0.0, ::), all multicast (admin-scoped +// 239/8 and ff00::/8 in addition to link-local-multicast), and CGNAT. +func isBlockedIP(ip net.IP) bool { + if ip == nil { + return true + } + return ip.IsLoopback() || ip.IsPrivate() || + ip.IsLinkLocalUnicast() || ip.IsMulticast() || + ip.IsUnspecified() || + cgnatRange.Contains(ip) +} + // NewDefaultHTTPKeyFetcherWithClient creates a new HTTP key fetcher with a custom HTTP client. // This is primarily useful in tests to inject transports or TLS settings. func NewDefaultHTTPKeyFetcherWithClient(client *http.Client) *DefaultHTTPKeyFetcher { diff --git a/internal/api/handlers/v0/auth/http_internal_test.go b/internal/api/handlers/v0/auth/http_internal_test.go new file mode 100644 index 0000000..5b2ce37 --- /dev/null +++ b/internal/api/handlers/v0/auth/http_internal_test.go @@ -0,0 +1,52 @@ +package auth + +import ( + "net" + "testing" +) + +func TestIsBlockedIP(t *testing.T) { + tests := []struct { + ip string + blocked bool + }{ + // Blocked — loopback + {"127.0.0.1", true}, + {"::1", true}, + // Blocked — RFC1918 / ULA (IsPrivate) + {"10.0.0.1", true}, + {"172.16.0.1", true}, + {"192.168.1.1", true}, + {"fc00::1", true}, + // Blocked — link-local (includes cloud metadata 169.254.169.254) + {"169.254.169.254", true}, + {"fe80::1", true}, + // Blocked — unspecified + {"0.0.0.0", true}, + {"::", true}, + // Blocked — admin-scoped and broader multicast + {"239.0.0.1", true}, + {"ff00::1", true}, + // Blocked — Carrier-Grade NAT (RFC 6598) + {"100.64.0.1", true}, + {"100.127.255.254", true}, + // Allowed — public + {"1.1.1.1", false}, + {"8.8.8.8", false}, + {"2606:4700:4700::1111", false}, + // Allowed — outside CGNAT range + {"100.63.255.255", false}, + {"100.128.0.1", false}, + } + for _, tc := range tests { + t.Run(tc.ip, func(t *testing.T) { + ip := net.ParseIP(tc.ip) + if ip == nil { + t.Fatalf("ParseIP(%q) returned nil", tc.ip) + } + if got := isBlockedIP(ip); got != tc.blocked { + t.Errorf("isBlockedIP(%q) = %v, want %v", tc.ip, got, tc.blocked) + } + }) + } +} diff --git a/internal/api/handlers/v0/auth/http_test.go b/internal/api/handlers/v0/auth/http_test.go index d3781ba..d0aa0ed 100644 --- a/internal/api/handlers/v0/auth/http_test.go +++ b/internal/api/handlers/v0/auth/http_test.go @@ -472,17 +472,6 @@ func TestHTTPAuthHandler_Permissions(t *testing.T) { "v1.api.example.com/*", // should be reversed }, }, - { - name: "single part domain", - domain: "localhost", - expectedPatterns: []string{ - "localhost/*", // exact pattern only (no reversal needed) - }, - unexpectedPatterns: []string{ - "localhost.*", // HTTP should not grant subdomain permissions - "*.localhost", // wrong wildcard position - }, - }, { name: "hyphenated domain", domain: "my-app.example-site.com", diff --git a/internal/api/handlers/v0/edit.go b/internal/api/handlers/v0/edit.go index 2862350..a927e7b 100644 --- a/internal/api/handlers/v0/edit.go +++ b/internal/api/handlers/v0/edit.go @@ -3,6 +3,7 @@ package v0 import ( "context" "errors" + "log" "net/http" "net/url" "strings" @@ -74,7 +75,8 @@ func RegisterEditEndpoints(api huma.API, pathPrefix string, registry service.Reg if errors.Is(err, database.ErrNotFound) { return nil, huma.Error404NotFound("Server not found") } - return nil, huma.Error500InternalServerError("Failed to get current server", err) + log.Printf("edit: get current server (%q/%q) failed: %v", serverName, version, err) + return nil, huma.Error500InternalServerError("Failed to get current server") } // Verify edit permissions for this server using the existing server name diff --git a/internal/api/handlers/v0/servers.go b/internal/api/handlers/v0/servers.go index d187fc0..bc7c618 100644 --- a/internal/api/handlers/v0/servers.go +++ b/internal/api/handlers/v0/servers.go @@ -3,6 +3,7 @@ package v0 import ( "context" "errors" + "log" "net/http" "net/url" "reflect" @@ -131,7 +132,8 @@ func RegisterServersEndpoints(api huma.API, pathPrefix string, registry service. // Get paginated results with filtering servers, nextCursor, err := registry.ListServers(ctx, filter, input.Cursor, input.Limit) if err != nil { - return nil, huma.Error500InternalServerError("Failed to get registry list", err) + log.Printf("list servers failed: %v", err) + return nil, huma.Error500InternalServerError("Failed to get registry list") } // Convert []*ServerResponse to []ServerResponse @@ -184,7 +186,8 @@ func RegisterServersEndpoints(api huma.API, pathPrefix string, registry service. if err.Error() == errRecordNotFound || errors.Is(err, database.ErrNotFound) { return nil, huma.Error404NotFound("Server not found") } - return nil, huma.Error500InternalServerError("Failed to get server details", err) + log.Printf("get server details (%q/%q) failed: %v", serverName, version, err) + return nil, huma.Error500InternalServerError("Failed to get server details") } return &Response[apiv0.ServerResponse]{ @@ -213,7 +216,8 @@ func RegisterServersEndpoints(api huma.API, pathPrefix string, registry service. if err.Error() == errRecordNotFound || errors.Is(err, database.ErrNotFound) { return nil, huma.Error404NotFound("Server not found") } - return nil, huma.Error500InternalServerError("Failed to get server versions", err) + log.Printf("get server versions (%q) failed: %v", serverName, err) + return nil, huma.Error500InternalServerError("Failed to get server versions") } // Convert []*ServerResponse to []ServerResponse diff --git a/internal/api/handlers/v0/status.go b/internal/api/handlers/v0/status.go index 627e884..3f03fc2 100644 --- a/internal/api/handlers/v0/status.go +++ b/internal/api/handlers/v0/status.go @@ -4,6 +4,7 @@ import ( "context" "errors" "fmt" + "log" "net/http" "net/url" "strings" @@ -122,7 +123,8 @@ func RegisterStatusEndpoints(api huma.API, pathPrefix string, registry service.R if errors.Is(err, database.ErrNotFound) { return nil, huma.Error404NotFound("Server version not found") } - return nil, huma.Error500InternalServerError("Failed to get server", err) + log.Printf("status: get server (%q/%q) failed: %v", serverName, version, err) + return nil, huma.Error500InternalServerError("Failed to get server") } // Verify publish or edit permissions for this server @@ -228,7 +230,8 @@ func RegisterAllVersionsStatusEndpoints(api huma.API, pathPrefix string, registr if errors.Is(err, database.ErrNotFound) { return nil, huma.Error404NotFound("Server not found") } - return nil, huma.Error500InternalServerError("Failed to get server", err) + log.Printf("status: get server (%q) failed: %v", serverName, err) + return nil, huma.Error500InternalServerError("Failed to get server") } // Verify publish or edit permissions for this server @@ -243,7 +246,8 @@ func RegisterAllVersionsStatusEndpoints(api huma.API, pathPrefix string, registr // Fetch all versions to validate the bulk status transition allVersions, err := registry.GetAllVersionsByServerName(ctx, serverName, true) if err != nil { - return nil, huma.Error500InternalServerError("Failed to get server versions", err) + log.Printf("status: get all versions (%q) failed: %v", serverName, err) + return nil, huma.Error500InternalServerError("Failed to get server versions") } // Validate bulk status transition - reject if no changes would occur diff --git a/internal/api/router/router.go b/internal/api/router/router.go index d951e60..46b975b 100644 --- a/internal/api/router/router.go +++ b/internal/api/router/router.go @@ -97,6 +97,7 @@ func WithSkipPaths(paths ...string) MiddlewareOption { // handle404 returns a helpful 404 error with suggestions for common mistakes func handle404(w http.ResponseWriter, r *http.Request) { w.Header().Set("Content-Type", "application/problem+json") + w.Header().Set("X-Content-Type-Options", "nosniff") w.WriteHeader(http.StatusNotFound) path := r.URL.Path @@ -187,8 +188,28 @@ func NewHumaAPI(cfg *config.Config, registry service.RegistryService, mux *http. // Add UI and 404 handler for all other routes mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) { if r.URL.Path == "/" { - // Serve UI at root + // Serve UI at root. The page renders publisher-controlled content + // (server names, descriptions, repository URLs) — server-side + // validation plus a JS escape function are the primary XSS + // defences; these headers are defence-in-depth in case any of + // those slip. w.Header().Set("Content-Type", "text/html; charset=utf-8") + w.Header().Set("X-Content-Type-Options", "nosniff") + w.Header().Set("X-Frame-Options", "DENY") + // connect-src is unrestricted because the UI exposes a base-URL + // selector (prod / staging / custom) that issues cross-origin + // XHRs to whichever target the operator picks. Constraining + // connect-src would silently break that affordance. The other + // directives still meaningfully limit the page's attack surface. + w.Header().Set("Content-Security-Policy", + "default-src 'self'; "+ + "script-src 'self' 'unsafe-inline' https://cdn.tailwindcss.com; "+ + "style-src 'self' 'unsafe-inline' https://cdn.tailwindcss.com; "+ + "img-src 'self' data:; "+ + "connect-src *; "+ + "frame-ancestors 'none'; "+ + "base-uri 'self'; "+ + "form-action 'self'") _, err := w.Write([]byte(v0.GetUIHTML())) if err != nil { http.Error(w, "Failed to write response", http.StatusInternalServerError) diff --git a/internal/api/server.go b/internal/api/server.go index e795a1e..9114067 100644 --- a/internal/api/server.go +++ b/internal/api/server.go @@ -5,6 +5,7 @@ import ( "encoding/json" "log" "net/http" + "path" "strings" "time" @@ -71,9 +72,11 @@ func TrailingSlashMiddleware(next http.Handler) http.Handler { return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { // Only redirect if the path is not "/" and ends with a "/" if r.URL.Path != "/" && strings.HasSuffix(r.URL.Path, "/") { - // Create a copy of the URL and remove the trailing slash + // path.Clean both removes the trailing slash and collapses any + // leading "//" to "/", which prevents an open-redirect via a + // protocol-relative path like "//evil.com/" (GHSA-v8vw-gw5j-w7m6). newURL := *r.URL - newURL.Path = strings.TrimSuffix(r.URL.Path, "/") + newURL.Path = path.Clean(r.URL.Path) // Use 308 Permanent Redirect to preserve the request method http.Redirect(w, r, newURL.String(), http.StatusPermanentRedirect) @@ -127,6 +130,17 @@ func NewServer(cfg *config.Config, registryService service.RegistryService, metr Addr: cfg.ServerAddress, Handler: handler, ReadHeaderTimeout: 10 * time.Second, + ReadTimeout: 30 * time.Second, + // WriteTimeout intentionally not set: the publish path runs + // outbound package validators sequentially (npm/pypi/nuget up to + // 10s each, OCI up to 30s), so any tight cap could cut off a + // legitimate multi-package publish mid-response — surfacing as a + // truncated read to the publisher even when the DB commit + // succeeded. Slow-response-read DoS is bounded upstream by + // NGINX ingress timeouts and the per-IP rate limit. Revisit once + // validators are parallelised or per-request package counts are + // bounded. + IdleTimeout: 120 * time.Second, }, } diff --git a/internal/api/server_test.go b/internal/api/server_test.go index dc313b0..9094c36 100644 --- a/internal/api/server_test.go +++ b/internal/api/server_test.go @@ -232,6 +232,22 @@ func TestTrailingSlashMiddleware(t *testing.T) { expectedLocation: "/v0/servers?limit=10", expectRedirect: true, }, + { + // Regression test for GHSA-v8vw-gw5j-w7m6: a protocol-relative + // path like "//evil.com/" must not redirect off-host. + name: "protocol-relative path should not redirect off-host", + path: "//evil.com/", + expectedStatus: http.StatusPermanentRedirect, + expectedLocation: "/evil.com", + expectRedirect: true, + }, + { + name: "path with multiple leading slashes should be collapsed", + path: "///evil.com/foo/", + expectedStatus: http.StatusPermanentRedirect, + expectedLocation: "/evil.com/foo", + expectRedirect: true, + }, } for _, tt := range tests { diff --git a/internal/auth/jwt.go b/internal/auth/jwt.go index b1935e5..88c8f76 100644 --- a/internal/auth/jwt.go +++ b/internal/auth/jwt.go @@ -81,10 +81,17 @@ func (j *JWTManager) GenerateTokenResponse(_ context.Context, claims JWTClaims) } } - // Check permissions against denylist, provided they are not an admin + // Check permissions against denylist, provided they are not an admin. + // Probe two synthetic resources per blocked namespace so that both the + // slash-suffix patterns (e.g. com.evil/*) and the dot-wildcard patterns + // (e.g. com.evil.mailer.* — granted to a subdomain claimant) are + // detected. Probing only "/test" misses the dot-wildcard form + // because the prefix match against "com.evil.mailer." does not start + // with "com.evil/test". if !hasGlobalPermissions { for _, blockedNamespace := range BlockedNamespaces { - if j.HasPermission(blockedNamespace+"/test", PermissionActionPublish, claims.Permissions) { + if j.HasPermission(blockedNamespace+"/test", PermissionActionPublish, claims.Permissions) || + j.HasPermission(blockedNamespace+".test/x", PermissionActionPublish, claims.Permissions) { return nil, fmt.Errorf("your namespace is blocked. raise an issue at https://github.com/modelcontextprotocol/registry/ if you think this is a mistake") } } diff --git a/internal/database/postgres.go b/internal/database/postgres.go index 1b0abdb..2749ad8 100644 --- a/internal/database/postgres.go +++ b/internal/database/postgres.go @@ -118,8 +118,13 @@ func buildFilterConditions(filter *ServerFilter, argIndex int) ([]string, []any, argIndex++ } if filter.SubstringName != nil { - conditions = append(conditions, fmt.Sprintf("server_name ILIKE $%d", argIndex)) - args = append(args, "%"+*filter.SubstringName+"%") + // Escape LIKE metacharacters so that user input cannot expand into + // wildcard matches (e.g. `?search=_` matching every single-char name, + // `?search=%` matching everything). Order matters: backslashes must be + // escaped first so subsequent escape backslashes are not double-escaped. + escaped := strings.NewReplacer(`\`, `\\`, `%`, `\%`, `_`, `\_`).Replace(*filter.SubstringName) + conditions = append(conditions, fmt.Sprintf("server_name ILIKE $%d ESCAPE '\\'", argIndex)) + args = append(args, "%"+escaped+"%") argIndex++ } if filter.Version != nil { diff --git a/internal/validators/registries/mcpb.go b/internal/validators/registries/mcpb.go index d42059b..82ba4d9 100644 --- a/internal/validators/registries/mcpb.go +++ b/internal/validators/registries/mcpb.go @@ -54,8 +54,17 @@ func ValidateMCPB(ctx context.Context, pkg model.Package, _ string) error { return fmt.Errorf("MCPB package URL must contain 'mcp': %s", pkg.Identifier) } - // Verify the file exists and is publicly accessible - client := &http.Client{Timeout: 10 * time.Second} + // Verify the file exists and is publicly accessible. Refuse to follow + // redirects: the URL allowlist (github.com / gitlab.com) only constrains + // the FIRST hop, and a 30x bouncing through CDN/release-asset hosts + // could otherwise be steered toward attacker infrastructure or + // internal-only endpoints reached via DNS quirks. + client := &http.Client{ + Timeout: 10 * time.Second, + CheckRedirect: func(_ *http.Request, _ []*http.Request) error { + return http.ErrUseLastResponse + }, + } req, err := http.NewRequestWithContext(ctx, http.MethodHead, pkg.Identifier, nil) if err != nil { return fmt.Errorf("failed to create request: %w", err) @@ -69,7 +78,15 @@ func ValidateMCPB(ctx context.Context, pkg model.Package, _ string) error { } defer resp.Body.Close() - if resp.StatusCode != http.StatusOK { + // GitHub serves release assets via a 302 to a signed S3 URL; a HEAD that + // returns 200 directly OR a 302 with a Location header is acceptable. + // Any other 3xx without a usable Location is treated as inaccessible. + switch { + case resp.StatusCode == http.StatusOK: + // fine + case resp.StatusCode >= 300 && resp.StatusCode < 400 && resp.Header.Get("Location") != "": + // fine — first-hop allowlist + we don't actually need the body + default: return fmt.Errorf("MCPB package '%s' is not publicly accessible (status: %d)", pkg.Identifier, resp.StatusCode) } diff --git a/internal/validators/registries/nuget.go b/internal/validators/registries/nuget.go index c3b95a0..0c6d4c5 100644 --- a/internal/validators/registries/nuget.go +++ b/internal/validators/registries/nuget.go @@ -7,6 +7,7 @@ import ( "fmt" "io" "net/http" + "net/url" "strings" "sync" "time" @@ -209,9 +210,11 @@ func validateReadme(ctx context.Context, serverName, lowerID, lowerVersion strin return NoReadme, fmt.Errorf("failed to get README URL template: %w", err) } - // Replace placeholders in the template - readmeURL := strings.ReplaceAll(readmeURLTemplate, "{lower_id}", lowerID) - readmeURL = strings.ReplaceAll(readmeURL, "{lower_version}", lowerVersion) + // Replace placeholders in the template. PathEscape both the id and version + // so a publisher cannot smuggle "/" / ".." through the template into a + // fetch against an unrelated package's README. + readmeURL := strings.ReplaceAll(readmeURLTemplate, "{lower_id}", url.PathEscape(lowerID)) + readmeURL = strings.ReplaceAll(readmeURL, "{lower_version}", url.PathEscape(lowerVersion)) req, err := http.NewRequestWithContext(ctx, http.MethodGet, readmeURL, nil) if err != nil { return NoReadme, fmt.Errorf("failed to create NuGet README request: %w", err) @@ -266,8 +269,10 @@ func validatePackageExists(ctx context.Context, lowerID, lowerVersion string, cl return PackageIDNotFound, fmt.Errorf("failed to get Package Base URL: %w", err) } - // Fetch the package content index to check if package ID and version exist - indexURL := fmt.Sprintf("%s/%s/index.json", strings.TrimRight(packageBaseURL, "/"), lowerID) + // Fetch the package content index to check if package ID and version exist. + // PathEscape so an identifier that smuggles "/" or ".." cannot redirect + // the metadata fetch to a different package than the one being claimed. + indexURL := fmt.Sprintf("%s/%s/index.json", strings.TrimRight(packageBaseURL, "/"), url.PathEscape(lowerID)) req, err := http.NewRequestWithContext(ctx, http.MethodGet, indexURL, nil) if err != nil { diff --git a/internal/validators/registries/pypi.go b/internal/validators/registries/pypi.go index 62ce22e..2bac843 100644 --- a/internal/validators/registries/pypi.go +++ b/internal/validators/registries/pypi.go @@ -6,6 +6,7 @@ import ( "errors" "fmt" "net/http" + "net/url" "strings" "time" @@ -52,8 +53,13 @@ func ValidatePyPI(ctx context.Context, pkg model.Package, serverName string) err client := &http.Client{Timeout: 10 * time.Second} - url := fmt.Sprintf("%s/pypi/%s/%s/json", pkg.RegistryBaseURL, pkg.Identifier, pkg.Version) - req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil) + // PathEscape so an identifier that smuggles "/" or ".." cannot redirect + // the metadata fetch to a different package than the one being claimed. + fetchURL := fmt.Sprintf("%s/pypi/%s/%s/json", + pkg.RegistryBaseURL, + url.PathEscape(pkg.Identifier), + url.PathEscape(pkg.Version)) + req, err := http.NewRequestWithContext(ctx, http.MethodGet, fetchURL, nil) if err != nil { return fmt.Errorf("failed to create request: %w", err) } diff --git a/internal/validators/schemas/2025-12-11.json b/internal/validators/schemas/2025-12-11.json index 9f6469b..70902ed 100644 --- a/internal/validators/schemas/2025-12-11.json +++ b/internal/validators/schemas/2025-12-11.json @@ -283,6 +283,7 @@ "description": "Package version. Must be a specific version. Version ranges are rejected (e.g., '^1.2.3', '~1.2.3', '\u003e=1.2.3', '1.x', '1.*').", "example": "1.0.2", "minLength": 1, + "maxLength": 255, "not": { "const": "latest" }, diff --git a/pkg/api/v0/types.go b/pkg/api/v0/types.go index de78a91..67fe094 100644 --- a/pkg/api/v0/types.go +++ b/pkg/api/v0/types.go @@ -39,7 +39,7 @@ type ServerJSON struct { Description string `json:"description" minLength:"1" maxLength:"100" doc:"Clear human-readable explanation of server functionality." example:"MCP server providing weather data and forecasts via OpenWeatherMap API"` Title string `json:"title,omitempty" minLength:"1" maxLength:"100" doc:"Optional human-readable title or display name for the MCP server." example:"Weather API"` Repository *model.Repository `json:"repository,omitempty" doc:"Optional repository metadata for the MCP server source code."` - Version string `json:"version" doc:"Version string for this server. SHOULD follow semantic versioning." example:"1.0.2"` + Version string `json:"version" minLength:"1" maxLength:"255" doc:"Version string for this server. SHOULD follow semantic versioning." example:"1.0.2"` WebsiteURL string `json:"websiteUrl,omitempty" format:"uri" doc:"Optional URL to the server's homepage, documentation, or project website." example:"https://modelcontextprotocol.io/examples"` Icons []model.Icon `json:"icons,omitempty" doc:"Optional set of sized icons that the client can display in a user interface."` Packages []model.Package `json:"packages,omitempty" doc:"Array of package configurations"` diff --git a/pkg/model/types.go b/pkg/model/types.go index 03d2841..b0bf8e4 100644 --- a/pkg/model/types.go +++ b/pkg/model/types.go @@ -35,7 +35,7 @@ type Package struct { // - For MCPB: direct download URL Identifier string `json:"identifier" minLength:"1" doc:"Package identifier - either a package name (for registries) or URL (for direct downloads)" example:"@modelcontextprotocol/server-brave-search"` // Version is the package version (required for npm, pypi, nuget; optional for mcpb; not used by oci where version is in the identifier) - Version string `json:"version,omitempty" minLength:"1" doc:"Package version. Must be a specific version. Version ranges are rejected (e.g., '^1.2.3', '~1.2.3', '>=1.2.3', '1.x', '1.*')." example:"1.0.2"` + Version string `json:"version,omitempty" minLength:"1" maxLength:"255" doc:"Package version. Must be a specific version. Version ranges are rejected (e.g., '^1.2.3', '~1.2.3', '>=1.2.3', '1.x', '1.*')." example:"1.0.2"` // FileSHA256 is the SHA-256 hash for integrity verification (required for mcpb, optional for others) FileSHA256 string `json:"fileSha256,omitempty" pattern:"^[a-f0-9]{64}$" doc:"SHA-256 hash of the package file for integrity verification. Required for MCPB packages and optional for other package types. Authors are responsible for generating correct SHA-256 hashes when creating server.json. If present, MCP clients must validate the downloaded file matches the hash before running packages to ensure file integrity." example:"fe333e598595000ae021bd27117db32ec69af6987f507ba7a63c90638ff633ce"` // RunTimeHint suggests the appropriate runtime for the package From 88bbb851ad2fd7ee8ca660398fb5d9d23a337cc9 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Wed, 29 Apr 2026 19:32:54 -0400 Subject: [PATCH 188/313] deploy: update prod to v1.7.5 (#1228) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary - Bumps prod imageTag from `1.7.4` to `1.7.5`. - Promotes the security release tagged at v1.7.5 (#1227 merged at 1201cbd). ## Test plan - [ ] Smoke staging at https://staging.registry.modelcontextprotocol.io — already done, all checks green - [ ] Roll out via Pulumi - [ ] Confirm prod health post-rollout: `curl https://registry.modelcontextprotocol.io/v0/health` 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.7 (1M context) --- deploy/Pulumi.gcpProd.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/deploy/Pulumi.gcpProd.yaml b/deploy/Pulumi.gcpProd.yaml index 3859f13..25cd2fd 100644 --- a/deploy/Pulumi.gcpProd.yaml +++ b/deploy/Pulumi.gcpProd.yaml @@ -1,7 +1,7 @@ config: mcp-registry:environment: prod mcp-registry:provider: gcp - mcp-registry:imageTag: 1.7.4 # Set specific image tag for production (change this to deploy different versions) + mcp-registry:imageTag: 1.7.5 # Set specific image tag for production (change this to deploy different versions) gcp:project: mcp-registry-prod mcp-registry:githubClientId: Iv23liUydBbI7Z2Q9bOZ mcp-registry:githubClientSecret: From 3f89fc2b1fb34fd49f3c0e1b39e964a5c67b613f Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Wed, 29 Apr 2026 20:27:26 -0400 Subject: [PATCH 189/313] auth: bind GitHub OIDC token exchange to a per-deployment audience (#1229) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## What this does The publisher CLI now derives the OIDC audience to request from the `--registry` URL instead of using a fixed constant, and the server validates the token's `aud` claim against a new per-deployment env var (`MCP_REGISTRY_GITHUB_OIDC_AUDIENCE`). Production sets this env var to `https://registry.modelcontextprotocol.io` (and per-environment URL elsewhere), so the deployment only accepts tokens that were requested for it. ## Compatibility This is a breaking change for older `mcp-publisher` binaries that still request the legacy hardcoded audience. After this rolls to a deployment, users on old `mcp-publisher` will see a clear `invalid audience: expected …, got […]` error and need to upgrade. Users following the documented `releases/latest` install pattern get the new binary automatically. ## Test plan - [ ] CI green - [ ] Run a synthetic publish from a real GitHub Actions workflow against staging after deploy - [ ] Confirm an older `mcp-publisher` against the same staging deploy returns the expected `invalid audience` error 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.7 (1M context) --- cmd/publisher/auth/github-oidc.go | 31 +++++++- .../auth/github-oidc_internal_test.go | 48 ++++++++++++ deploy/pkg/k8s/registry.go | 9 +++ internal/api/handlers/v0/auth/github_oidc.go | 6 +- .../api/handlers/v0/auth/github_oidc_test.go | 78 ++++++++++++++++++- internal/config/config.go | 2 + 6 files changed, 166 insertions(+), 8 deletions(-) create mode 100644 cmd/publisher/auth/github-oidc_internal_test.go diff --git a/cmd/publisher/auth/github-oidc.go b/cmd/publisher/auth/github-oidc.go index e4b51ed..9b32e44 100644 --- a/cmd/publisher/auth/github-oidc.go +++ b/cmd/publisher/auth/github-oidc.go @@ -7,7 +7,9 @@ import ( "fmt" "io" "net/http" + "net/url" "os" + "strings" ) type GitHubOIDCProvider struct { @@ -23,8 +25,13 @@ func NewGitHubOIDCProvider(registryURL string) Provider { // GetToken retrieves the registry JWT token using GitHub Actions OIDC token func (o *GitHubOIDCProvider) GetToken(ctx context.Context) (string, error) { + audience, err := audienceFromRegistryURL(o.registryURL) + if err != nil { + return "", fmt.Errorf("invalid --registry URL: %w", err) + } + // Get OIDC token from GitHub Actions endpoint - oidcToken, err := o.getOIDCTokenFromGitHub(ctx) + oidcToken, err := o.getOIDCTokenFromGitHub(ctx, audience) if err != nil { return "", fmt.Errorf("failed to get OIDC token from GitHub: %w", err) } @@ -99,8 +106,8 @@ func (o *GitHubOIDCProvider) exchangeOIDCTokenForRegistry(ctx context.Context, o return tokenResp.RegistryToken, nil } -// getOIDCTokenFromGitHub fetches the OIDC token from GitHub Actions endpoint -func (o *GitHubOIDCProvider) getOIDCTokenFromGitHub(ctx context.Context) (string, error) { +// getOIDCTokenFromGitHub fetches the OIDC token from GitHub Actions endpoint. +func (o *GitHubOIDCProvider) getOIDCTokenFromGitHub(ctx context.Context, audience string) (string, error) { // Check for required environment variables requestToken := os.Getenv("ACTIONS_ID_TOKEN_REQUEST_TOKEN") if requestToken == "" { @@ -113,7 +120,7 @@ func (o *GitHubOIDCProvider) getOIDCTokenFromGitHub(ctx context.Context) (string } // Build the full URL with audience parameter - fullURL := requestURL + "&audience=mcp-registry" + fullURL := requestURL + "&audience=" + url.QueryEscape(audience) // Create the request req, err := http.NewRequestWithContext(ctx, http.MethodGet, fullURL, nil) //nolint:gosec // G704: URL is from GitHub Actions ACTIONS_ID_TOKEN_REQUEST_URL env var @@ -158,3 +165,19 @@ func (o *GitHubOIDCProvider) getOIDCTokenFromGitHub(ctx context.Context) (string return tokenResp.Value, nil } + +// audienceFromRegistryURL returns scheme + lowercased host for the given URL. +func audienceFromRegistryURL(registryURL string) (string, error) { + registryURL = strings.TrimSpace(registryURL) + if registryURL == "" { + return "", fmt.Errorf("registry URL is empty") + } + u, err := url.Parse(registryURL) + if err != nil { + return "", fmt.Errorf("parse %q: %w", registryURL, err) + } + if u.Scheme == "" || u.Host == "" { + return "", fmt.Errorf("registry URL must include scheme and host: %q", registryURL) + } + return u.Scheme + "://" + strings.ToLower(u.Host), nil +} diff --git a/cmd/publisher/auth/github-oidc_internal_test.go b/cmd/publisher/auth/github-oidc_internal_test.go new file mode 100644 index 0000000..e8a5068 --- /dev/null +++ b/cmd/publisher/auth/github-oidc_internal_test.go @@ -0,0 +1,48 @@ +package auth + +import "testing" + +func TestAudienceFromRegistryURL(t *testing.T) { + tests := []struct { + input string + want string + wantErr bool + }{ + // Canonical forms + {"https://registry.modelcontextprotocol.io", "https://registry.modelcontextprotocol.io", false}, + {"https://staging.registry.modelcontextprotocol.io", "https://staging.registry.modelcontextprotocol.io", false}, + + // Trailing slash and path are stripped + {"https://registry.modelcontextprotocol.io/", "https://registry.modelcontextprotocol.io", false}, + {"https://registry.modelcontextprotocol.io/api/v0", "https://registry.modelcontextprotocol.io", false}, + + // Host is lowercased + {"https://Registry.Example.COM", "https://registry.example.com", false}, + + // Whitespace is tolerated + {" https://registry.example ", "https://registry.example", false}, + + // Invalid inputs + {"", "", true}, + {"registry.example", "", true}, // missing scheme + {"https://", "", true}, // missing host + {"://nothing", "", true}, // missing scheme + } + for _, tc := range tests { + t.Run(tc.input, func(t *testing.T) { + got, err := audienceFromRegistryURL(tc.input) + if tc.wantErr { + if err == nil { + t.Fatalf("expected error for %q, got %q", tc.input, got) + } + return + } + if err != nil { + t.Fatalf("unexpected error for %q: %v", tc.input, err) + } + if got != tc.want { + t.Errorf("audienceFromRegistryURL(%q) = %q, want %q", tc.input, got, tc.want) + } + }) + } +} diff --git a/deploy/pkg/k8s/registry.go b/deploy/pkg/k8s/registry.go index 48e9124..53f2d85 100644 --- a/deploy/pkg/k8s/registry.go +++ b/deploy/pkg/k8s/registry.go @@ -185,6 +185,15 @@ func DeployMCPRegistry(ctx *pulumi.Context, cluster *providers.ProviderInfo, env Name: pulumi.String("MCP_REGISTRY_OIDC_PUBLISH_PERMISSIONS"), Value: pulumi.String("*"), }, + &corev1.EnvVarArgs{ + Name: pulumi.String("MCP_REGISTRY_GITHUB_OIDC_AUDIENCE"), + Value: pulumi.String(func() string { + if environment == "prod" { + return "https://registry.modelcontextprotocol.io" + } + return "https://" + environment + ".registry.modelcontextprotocol.io" + }()), + }, }, // StartupProbe protects the DB-retry budget in cmd/registry/main.go: // 30 × 5s = 150s allowed before liveness/readiness take over, which diff --git a/internal/api/handlers/v0/auth/github_oidc.go b/internal/api/handlers/v0/auth/github_oidc.go index e925fb5..4170640 100644 --- a/internal/api/handlers/v0/auth/github_oidc.go +++ b/internal/api/handlers/v0/auth/github_oidc.go @@ -252,8 +252,10 @@ func RegisterGitHubOIDCEndpoint(api huma.API, pathPrefix string, cfg *config.Con // ExchangeToken exchanges a GitHub OIDC token for a Registry JWT token func (h *GitHubOIDCHandler) ExchangeToken(ctx context.Context, oidcToken string) (*auth.TokenResponse, error) { - // Validate OIDC token with audience "mcp-registry" - claims, err := h.validator.ValidateToken(ctx, oidcToken, "mcp-registry") + if h.config.GitHubOIDCAudience == "" { + return nil, fmt.Errorf("GitHub OIDC exchange disabled: this deployment has no audience configured") + } + claims, err := h.validator.ValidateToken(ctx, oidcToken, h.config.GitHubOIDCAudience) if err != nil { return nil, fmt.Errorf("failed to validate OIDC token: %w", err) } diff --git a/internal/api/handlers/v0/auth/github_oidc_test.go b/internal/api/handlers/v0/auth/github_oidc_test.go index a65ab95..37d07e8 100644 --- a/internal/api/handlers/v0/auth/github_oidc_test.go +++ b/internal/api/handlers/v0/auth/github_oidc_test.go @@ -26,7 +26,8 @@ func (m *MockOIDCValidator) ValidateToken(ctx context.Context, token string, aud func TestGitHubOIDCHandler_ExchangeToken(t *testing.T) { cfg := &config.Config{ - JWTPrivateKey: "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef", // 32 bytes hex + JWTPrivateKey: "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef", // 32 bytes hex + GitHubOIDCAudience: "https://registry.test", } handler := auth.NewGitHubOIDCHandler(cfg) @@ -118,9 +119,82 @@ func TestGitHubOIDCHandler_ExchangeToken(t *testing.T) { } } +func TestGitHubOIDCHandler_AudienceBinding(t *testing.T) { + t.Run("empty audience config fails closed", func(t *testing.T) { + cfg := &config.Config{ + JWTPrivateKey: "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef", + GitHubOIDCAudience: "", + } + handler := auth.NewGitHubOIDCHandler(cfg) + // Validator should never be called — the audience precondition rejects first. + handler.SetValidator(&MockOIDCValidator{ + validateFunc: func(_ context.Context, _ string, _ string) (*auth.GitHubOIDCClaims, error) { + t.Fatal("validator must not be called when audience is unconfigured") + return nil, fmt.Errorf("unreachable") + }, + }) + + _, err := handler.ExchangeToken(context.Background(), "any-token") + require.Error(t, err) + assert.Contains(t, err.Error(), "no audience configured") + }) + + t.Run("configured audience is what the validator sees", func(t *testing.T) { + cfg := &config.Config{ + JWTPrivateKey: "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef", + GitHubOIDCAudience: "https://registry.example.com", + } + handler := auth.NewGitHubOIDCHandler(cfg) + + var seenAudience string + handler.SetValidator(&MockOIDCValidator{ + validateFunc: func(_ context.Context, _ string, audience string) (*auth.GitHubOIDCClaims, error) { + seenAudience = audience + return &auth.GitHubOIDCClaims{ + RegisteredClaims: jwt.RegisteredClaims{ + Subject: "repo:octo-org/octo-repo:environment:prod", + ExpiresAt: jwt.NewNumericDate(time.Now().Add(1 * time.Hour)), + Audience: jwt.ClaimStrings{audience}, + }, + RepositoryOwner: "octo-org", + }, nil + }, + }) + + _, err := handler.ExchangeToken(context.Background(), "any-token") + require.NoError(t, err) + assert.Equal(t, "https://registry.example.com", seenAudience) + }) + + t.Run("token issued for another deployment is rejected", func(t *testing.T) { + cfg := &config.Config{ + JWTPrivateKey: "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef", + GitHubOIDCAudience: "https://registry.modelcontextprotocol.io", + } + handler := auth.NewGitHubOIDCHandler(cfg) + + // The mock validator does what the real one does: reject if the + // expected audience is not present in the token's aud claim. + handler.SetValidator(&MockOIDCValidator{ + validateFunc: func(_ context.Context, _ string, expected string) (*auth.GitHubOIDCClaims, error) { + tokenAudience := "https://attacker-registry.example" //nolint:gosec // G101 false positive: URL string, not a credential + if expected != tokenAudience { + return nil, fmt.Errorf("invalid audience: expected %s, got [%s]", expected, tokenAudience) + } + return &auth.GitHubOIDCClaims{RepositoryOwner: "octo-org"}, nil + }, + }) + + _, err := handler.ExchangeToken(context.Background(), "captured-token") + require.Error(t, err) + assert.Contains(t, err.Error(), "invalid audience") + }) +} + func TestBuildPermissionsFromOIDC(t *testing.T) { cfg := &config.Config{ - JWTPrivateKey: "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef", + JWTPrivateKey: "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef", + GitHubOIDCAudience: "https://registry.test", } handler := auth.NewGitHubOIDCHandler(cfg) diff --git a/internal/config/config.go b/internal/config/config.go index 60e9a06..a15a67a 100644 --- a/internal/config/config.go +++ b/internal/config/config.go @@ -17,6 +17,8 @@ type Config struct { EnableAnonymousAuth bool `env:"ENABLE_ANONYMOUS_AUTH" envDefault:"false"` EnableRegistryValidation bool `env:"ENABLE_REGISTRY_VALIDATION" envDefault:"true"` + GitHubOIDCAudience string `env:"GITHUB_OIDC_AUDIENCE" envDefault:""` + // OIDC Configuration OIDCEnabled bool `env:"OIDC_ENABLED" envDefault:"false"` OIDCIssuer string `env:"OIDC_ISSUER" envDefault:""` From db438962092c444d3b734b70644bc7a2694418a5 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Wed, 29 Apr 2026 20:56:53 -0400 Subject: [PATCH 190/313] docs: document GitHub OIDC audience binding for self-hosters and CI users (#1230) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary Follow-up to #1229. Three small doc additions so the new audience requirement is discoverable without reading the source: - `.env.example` lists `MCP_REGISTRY_GITHUB_OIDC_AUDIENCE` alongside the other registry env vars, with a note that the value must match the scheme+host that publishers pass via `--registry`. - The publisher CLI reference (`docs/reference/cli/commands.md`) explains that the CLI derives the audience from `--registry` and that self-hosters must set the matching env var on the registry side. - The GitHub Actions troubleshooting table (`docs/modelcontextprotocol-io/github-actions.mdx`) maps the new `invalid audience` error to the user-facing fix (upgrade `mcp-publisher`). No code changes — docs only. ## Test plan - [ ] CI green (markdown lint / link checks if any) - [ ] Eyeball-render the troubleshooting table on the modelcontextprotocol.io preview to confirm the new row formats correctly 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.7 (1M context) --- .env.example | 8 ++++++++ docs/modelcontextprotocol-io/github-actions.mdx | 1 + docs/reference/cli/commands.md | 7 +++++++ 3 files changed, 16 insertions(+) diff --git a/.env.example b/.env.example index bfadfd4..786fc1b 100644 --- a/.env.example +++ b/.env.example @@ -27,6 +27,14 @@ MCP_REGISTRY_JWT_PRIVATE_KEY=bb2c6b424005acd5df47a9e2c87f446def86dd740c888ea3efb # This should be disabled in prod MCP_REGISTRY_ENABLE_ANONYMOUS_AUTH=false +# GitHub OIDC token exchange (for `mcp-publisher login github-oidc`) +# Expected `aud` claim on incoming GitHub Actions OIDC tokens. Must equal the +# scheme + host that publishers pass via `--registry` (e.g. `https://registry.example.com`). +# The publisher CLI derives the audience from `--registry` automatically; the server +# rejects all OIDC exchanges if this is unset, so set it on every deployment that +# accepts GitHub Actions publishes. +MCP_REGISTRY_GITHUB_OIDC_AUDIENCE= + # Google Cloud Identity OIDC configuration for admin access # Enable OIDC authentication for @modelcontextprotocol.io admin accounts MCP_REGISTRY_OIDC_ENABLED=false diff --git a/docs/modelcontextprotocol-io/github-actions.mdx b/docs/modelcontextprotocol-io/github-actions.mdx index 311b28f..0da50cd 100644 --- a/docs/modelcontextprotocol-io/github-actions.mdx +++ b/docs/modelcontextprotocol-io/github-actions.mdx @@ -220,6 +220,7 @@ The workflow will run tests, build the package, publish the package to npm, and | Error Message | Action | | --- | --- | | "Authentication failed" | Ensure `id-token: write` permission is set for OIDC, or check secrets. | +| "invalid audience" | Your `mcp-publisher` binary is too old for this registry deployment. Re-run the install step shown above so you pick up the latest release. | | "Package validation failed" | Verify your package successfully published to the package registry (e.g., npm, PyPI), and that your package has the [necessary verification information](./package-types). | {/* prettier-ignore-end */} diff --git a/docs/reference/cli/commands.md b/docs/reference/cli/commands.md index 0f44b7b..e077019 100644 --- a/docs/reference/cli/commands.md +++ b/docs/reference/cli/commands.md @@ -72,6 +72,13 @@ mcp-publisher login github-oidc [--registry=URL] - Requires `id-token: write` permission in workflow - No browser interaction needed +The CLI derives the OIDC `aud` claim from `--registry` (scheme + host, e.g. +`https://registry.modelcontextprotocol.io`) so tokens are bound to the specific +deployment they were minted for. Self-hosters must set +`MCP_REGISTRY_GITHUB_OIDC_AUDIENCE` on the registry to the matching value; +publishers running an older `mcp-publisher` will fail with `invalid audience` +and need to upgrade. + Also see [the guide to publishing from GitHub Actions](../../modelcontextprotocol-io/github-actions.mdx). #### DNS Verification From 42092742ce941af281b32a1c53b1436b7f1d34bc Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Wed, 29 Apr 2026 21:08:54 -0400 Subject: [PATCH 191/313] deploy: update prod to v1.7.6 (#1232) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary - Bumps prod imageTag from \`1.7.5\` to \`1.7.6\`. ## Test plan - [ ] Smoke staging at https://staging.registry.modelcontextprotocol.io - [ ] Roll out via Pulumi - [ ] Confirm prod health post-rollout: \`curl https://registry.modelcontextprotocol.io/v0/version\` shows \`1.7.6\` 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.7 (1M context) --- deploy/Pulumi.gcpProd.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/deploy/Pulumi.gcpProd.yaml b/deploy/Pulumi.gcpProd.yaml index 25cd2fd..034330b 100644 --- a/deploy/Pulumi.gcpProd.yaml +++ b/deploy/Pulumi.gcpProd.yaml @@ -1,7 +1,7 @@ config: mcp-registry:environment: prod mcp-registry:provider: gcp - mcp-registry:imageTag: 1.7.5 # Set specific image tag for production (change this to deploy different versions) + mcp-registry:imageTag: 1.7.6 # Set specific image tag for production (change this to deploy different versions) gcp:project: mcp-registry-prod mcp-registry:githubClientId: Iv23liUydBbI7Z2Q9bOZ mcp-registry:githubClientSecret: From 46bbe0dba3882dba42320ac311f4dbfdeea012f4 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 1 May 2026 03:19:24 -0400 Subject: [PATCH 192/313] build(deps): bump cloud.google.com/go/kms from 1.29.0 to 1.30.0 (#1233) Bumps [cloud.google.com/go/kms](https://github.com/googleapis/google-cloud-go) from 1.29.0 to 1.30.0.
    Release notes

    Sourced from cloud.google.com/go/kms's releases.

    kms: v1.30.0

    v1.30.0 (2026-04-30)

    retail: v1.30.0

    v1.30.0 (2026-04-30)

    Changelog

    Sourced from cloud.google.com/go/kms's changelog.

    1.30.0 (2024-06-05)

    Features

    • documentai: Make Layout Parser generally available in V1 (#10286) (92dc381)
    Commits

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=cloud.google.com/go/kms&package-manager=go_modules&previous-version=1.29.0&new-version=1.30.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index a6d5537..dac7d01 100644 --- a/go.mod +++ b/go.mod @@ -3,7 +3,7 @@ module github.com/modelcontextprotocol/registry go 1.26 require ( - cloud.google.com/go/kms v1.29.0 + cloud.google.com/go/kms v1.30.0 github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.4.0 github.com/caarlos0/env/v11 v11.4.0 diff --git a/go.sum b/go.sum index 18d07e2..c7cf970 100644 --- a/go.sum +++ b/go.sum @@ -8,8 +8,8 @@ cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdB cloud.google.com/go/compute/metadata v0.9.0/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10= cloud.google.com/go/iam v1.7.0 h1:JD3zh0C6LHl16aCn5Akff0+GELdp1+4hmh6ndoFLl8U= cloud.google.com/go/iam v1.7.0/go.mod h1:tetWZW1PD/m6vcuY2Zj/aU0eCHNPuxedbnbRTyKXvdY= -cloud.google.com/go/kms v1.29.0 h1:bAW1C5FQf+6GhPkywQzPlsULALCG7c16qpXLFGV9ivY= -cloud.google.com/go/kms v1.29.0/go.mod h1:YIyXZym11R5uovJJt4oN5eUL3oPmirF3yKeIh6QAf4U= +cloud.google.com/go/kms v1.30.0 h1:TSEZopy/OXojbVCQS9Rrx0jFqdKWvO31+N8ncXbxG/s= +cloud.google.com/go/kms v1.30.0/go.mod h1:YIyXZym11R5uovJJt4oN5eUL3oPmirF3yKeIh6QAf4U= cloud.google.com/go/longrunning v0.9.0 h1:0EzbDEGsAvOZNbqXopgniY0w0a1phvu5IdUFq8grmqY= cloud.google.com/go/longrunning v0.9.0/go.mod h1:pkTz846W7bF4o2SzdWJ40Hu0Re+UoNT6Q5t+igIcb8E= github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0 h1:JXg2dwJUmPB9JmtVmdEB16APJ7jurfbY5jnfXpJoRMc= From 23f4fda297cef56ee2b340c5b7d8b43a743eb695 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 1 May 2026 03:19:42 -0400 Subject: [PATCH 193/313] build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.232.0 to 3.233.0 in /deploy (#1234) Bumps [github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from 3.232.0 to 3.233.0.
    Release notes

    Sourced from github.com/pulumi/pulumi/sdk/v3's releases.

    v3.233.0

    3.233.0 (2026-04-30)

    Features

    • [auto/python] Expose the auto-generated Pulumi CLI interface as workspace.cli_api #22638

    • [cli] Add encrypted logging to ~/.pulumi/logs; use the PULUMI_ENABLE_AUTOMATIC_LOGGING feature flag to turn it on #22494

    • [cli] Implement the filesystem__grep and filesystem__content_replace local tools for pulumi neo. grep runs a regex search across files in the project root with an optional include glob filter and returns results in path:lineno: line form. content_replace performs a literal multi-file search-and-replace with a file_pattern glob and dry_run preview mode. Both tools skip binary files, hidden directories, and node_modules, and reject paths outside the project root. Their input schemas match the cloud-side tool definitions.

      #22655

    • [cli] Add pulumi_preview and pulumi_up as local tools for the experimental pulumi neo agent. The Neo TUI renders a persistent bordered block for each operation that streams changed resources and diagnostics as the engine runs and finalizes with a summary of the op counts. Hidden behind PULUMI_EXPERIMENTAL.

      #22697

    • [engine] Add List to the provider protocol and schema #22693

    Bug Fixes

    • [engine] Return a clear error when two installed plugins claim the same default provider package name (for example, a native scaleway provider alongside a terraform-provider bridge parameterized as scaleway) instead of panicking with "Should not have seen an older plugin if sorting is correct!" #22679

    • [programgen] Do not wrap a call(...) on a method whose return type is marked plain in an Output. Previously PCL bound every method call's return type as Output<T>, which caused downstream program-gen to emit broken .apply(...)/.ApplyT(...) traversals against plain struct returns (e.g. methods with liftSingleValueMethodReturns=true or ReturnTypePlain=true).

      #22696

    • [backend/diy] When using a backend url containing creds (e.g. PostgreSQL conn string), mask user:pass as in lock-related error messages #22701

    • [codegen/go] Generate unqualified Provider references for the package's own provider resource. Previously the Go codegen always emitted <pkg>.Provider even when the reference appeared inside <pkg>

    ... (truncated)

    Changelog

    Sourced from github.com/pulumi/pulumi/sdk/v3's changelog.

    3.233.0 (2026-04-30)

    Features

    • [auto/python] Expose the auto-generated Pulumi CLI interface as workspace.cli_api #22638

    • [cli] Add encrypted logging to ~/.pulumi/logs; use the PULUMI_ENABLE_AUTOMATIC_LOGGING feature flag to turn it on #22494

    • [cli] Implement the filesystem__grep and filesystem__content_replace local tools for pulumi neo. grep runs a regex search across files in the project root with an optional include glob filter and returns results in path:lineno: line form. content_replace performs a literal multi-file search-and-replace with a file_pattern glob and dry_run preview mode. Both tools skip binary files, hidden directories, and node_modules, and reject paths outside the project root. Their input schemas match the cloud-side tool definitions.

      #22655

    • [cli] Add pulumi_preview and pulumi_up as local tools for the experimental pulumi neo agent. The Neo TUI renders a persistent bordered block for each operation that streams changed resources and diagnostics as the engine runs and finalizes with a summary of the op counts. Hidden behind PULUMI_EXPERIMENTAL.

      #22697

    • [engine] Add List to the provider protocol and schema #22693

    Bug Fixes

    • [engine] Return a clear error when two installed plugins claim the same default provider package name (for example, a native scaleway provider alongside a terraform-provider bridge parameterized as scaleway) instead of panicking with "Should not have seen an older plugin if sorting is correct!" #22679

    • [programgen] Do not wrap a call(...) on a method whose return type is marked plain in an Output. Previously PCL bound every method call's return type as Output<T>, which caused downstream program-gen to emit broken .apply(...)/.ApplyT(...) traversals against plain struct returns (e.g. methods with liftSingleValueMethodReturns=true or ReturnTypePlain=true).

      #22696

    • [backend/diy] When using a backend url containing creds (e.g. PostgreSQL conn string), mask user:pass as in lock-related error messages #22701

    • [codegen/go] Generate unqualified Provider references for the package's own provider resource. Previously the Go codegen always emitted <pkg>.Provider even when the reference appeared inside <pkg> itself, producing identifiers that would not compile. Affects generated code for method return

    ... (truncated)

    Commits

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/pulumi/pulumi/sdk/v3&package-manager=go_modules&previous-version=3.232.0&new-version=3.233.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- deploy/go.mod | 2 +- deploy/go.sum | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index 79fbc0e..50d59a8 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -5,7 +5,7 @@ go 1.26 require ( github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.30.0 - github.com/pulumi/pulumi/sdk/v3 v3.232.0 + github.com/pulumi/pulumi/sdk/v3 v3.233.0 gopkg.in/yaml.v2 v2.4.0 ) diff --git a/deploy/go.sum b/deploy/go.sum index e3c85c8..8f015d6 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -183,8 +183,8 @@ github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 h1:w6OnO3d4j5yVf2vpm8OzXFC/xHOEGqt+9 github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1/go.mod h1:UyZyv7hz4knpFx6/Sh+SkZe6hT6sJHtDvw9A0TbvEsk= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.30.0 h1:nF0Y1F7fUGL6RYD9EAtHTdDbNFmDaA3xcEiRlvCDV5E= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.30.0/go.mod h1:BAWI9R3JEEGOp1JlXLPSZKwBGANSrPGUWKtMnS5w5qw= -github.com/pulumi/pulumi/sdk/v3 v3.232.0 h1:pU9j5qYHYtYZGaIKha1KFuB9ggp2obcMD1U523tpEnk= -github.com/pulumi/pulumi/sdk/v3 v3.232.0/go.mod h1:33NoTpvQXlTtAuaPbompgZNA3Ye4XEvxNydELFlWza8= +github.com/pulumi/pulumi/sdk/v3 v3.233.0 h1:r2Z1GtGZUM7olY+vF5Av2nqH1iAvSMKx5DJZxDnqrcY= +github.com/pulumi/pulumi/sdk/v3 v3.233.0/go.mod h1:Eu9QVad1cSPymhTboINPqK6WZMaW7I0NHQcWOmxLYek= github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ= github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88= github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ= @@ -350,5 +350,5 @@ gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= lukechampine.com/frand v1.5.1 h1:fg0eRtdmGFIxhP5zQJzM1lFDbD6CUfu/f+7WgAZd5/w= lukechampine.com/frand v1.5.1/go.mod h1:4VstaWc2plN4Mjr10chUD46RAVGWhpkZ5Nja8+Azp0Q= -pgregory.net/rapid v0.6.1 h1:4eyrDxyht86tT4Ztm+kvlyNBLIk071gR+ZQdhphc9dQ= -pgregory.net/rapid v0.6.1/go.mod h1:PY5XlDGj0+V1FCq0o192FdRhpKHGTRIWBgqjDBTrq04= +pgregory.net/rapid v1.2.0 h1:keKAYRcjm+e1F0oAuU5F5+YPAWcyxNNRK2wud503Gnk= +pgregory.net/rapid v1.2.0/go.mod h1:PY5XlDGj0+V1FCq0o192FdRhpKHGTRIWBgqjDBTrq04= From 648da259b02c0398e9fa6dc9432790a196885e15 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 4 May 2026 06:12:19 -0400 Subject: [PATCH 194/313] build(deps): bump github.com/caarlos0/env/v11 from 11.4.0 to 11.4.1 (#1236) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [github.com/caarlos0/env/v11](https://github.com/caarlos0/env) from 11.4.0 to 11.4.1.
    Release notes

    Sourced from github.com/caarlos0/env/v11's releases.

    v11.4.1

    Changelog

    Bug fixes

    • 6daeb06ac7e3c9532a7eaa5768d45917393b7480: fix: use Key instead of OwnKey in rawEnvVars to properly reference existing defaults in complex structs (#412) (@​AndrewChubatiuk)

    Documentation updates

    • 1ff55e6c9733833ce75d62b345916a407dbe4158: docs: adaptive starchart (#416) (@​alexandear)

    Other work

    • cf4a9682420b025e44b4773fd7ee0be48bb68b2f: ci(deps): bump the actions group with 3 updates (#411) (@​dependabot[bot])
    • 33faf6f333c2c3dacef2991825f8e03960a2c0cb: ci(deps): bump the actions group with 3 updates (#417) (@​dependabot[bot])
    • 0cb635b62488f4d310809a82a8832cedc9aa94eb: ci(deps): bump the actions group with 6 updates (#415) (@​dependabot[bot])
    • a72d89a8930fc800372a6a338a1acf33e5cc3a56: ci: update release config (@​caarlos0)

    Released with GoReleaser Pro!

    Commits
    • a72d89a ci: update release config
    • 6daeb06 fix: use Key instead of OwnKey in rawEnvVars to properly reference existing d...
    • 33faf6f ci(deps): bump the actions group with 3 updates (#417)
    • 1ff55e6 docs: adaptive starchart (#416)
    • 0cb635b ci(deps): bump the actions group with 6 updates (#415)
    • cf4a968 ci(deps): bump the actions group with 3 updates (#411)
    • See full diff in compare view

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/caarlos0/env/v11&package-manager=go_modules&previous-version=11.4.0&new-version=11.4.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index dac7d01..9294010 100644 --- a/go.mod +++ b/go.mod @@ -6,7 +6,7 @@ require ( cloud.google.com/go/kms v1.30.0 github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.4.0 - github.com/caarlos0/env/v11 v11.4.0 + github.com/caarlos0/env/v11 v11.4.1 github.com/coreos/go-oidc/v3 v3.18.0 github.com/danielgtaylor/huma/v2 v2.37.3 github.com/golang-jwt/jwt/v5 v5.3.1 diff --git a/go.sum b/go.sum index c7cf970..cb4f347 100644 --- a/go.sum +++ b/go.sum @@ -30,8 +30,8 @@ github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0 h1:XRzhVemXdgv github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0/go.mod h1:HKpQxkWaGLJ+D/5H8QRpyQXA1eKjxkFlOMwck5+33Jk= github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM= github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw= -github.com/caarlos0/env/v11 v11.4.0 h1:Kcb6t5kIIr4XkoQC9AF2j+8E1Jsrl3Wz/hhm1LtoGAc= -github.com/caarlos0/env/v11 v11.4.0/go.mod h1:qupehSf/Y0TUTsxKywqRt/vJjN5nz6vauiYEUUr8P4U= +github.com/caarlos0/env/v11 v11.4.1 h1:fYwH0sWEsBSMPG7t4e/PEfTFzrWrpjyygXyUnWiSwEw= +github.com/caarlos0/env/v11 v11.4.1/go.mod h1:qupehSf/Y0TUTsxKywqRt/vJjN5nz6vauiYEUUr8P4U= github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs= github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5 h1:6xNmx7iTtyBRev0+D/Tv1FZd4SCg8axKApyNyRsAt/w= From f3308d16f51d3a9cb3d7b2d3f05e0634095fa60c Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 4 May 2026 06:12:32 -0400 Subject: [PATCH 195/313] build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.233.0 to 3.234.0 in /deploy (#1237) Bumps [github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from 3.233.0 to 3.234.0.
    Release notes

    Sourced from github.com/pulumi/pulumi/sdk/v3's releases.

    v3.234.0

    3.234.0 (2026-05-01)

    Features

    • [cli/cloud] Add pulumi cloud api describe for inspecting the parameters, request body, and response schema of any Pulumi Cloud API operation, with text, markdown, and JSON output

      #22770

    • [cli/cloud] Add pulumi cloud api list for browsing every endpoint exposed by the Pulumi Cloud OpenAPI spec, with table and JSON output

      #22769

    Bug Fixes

    • [engine] Revert changes to property path parsing that resulted in errors for currently valid paths
    Changelog

    Sourced from github.com/pulumi/pulumi/sdk/v3's changelog.

    3.234.0 (2026-05-01)

    Features

    • [cli/cloud] Add pulumi cloud api describe for inspecting the parameters, request body, and response schema of any Pulumi Cloud API operation, with text, markdown, and JSON output

      #22770

    • [cli/cloud] Add pulumi cloud api list for browsing every endpoint exposed by the Pulumi Cloud OpenAPI spec, with table and JSON output

      #22769

    Bug Fixes

    • [engine] Revert changes to property path parsing that resulted in errors for currently valid paths
    Commits

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/pulumi/pulumi/sdk/v3&package-manager=go_modules&previous-version=3.233.0&new-version=3.234.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- deploy/go.mod | 2 +- deploy/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index 50d59a8..d64615f 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -5,7 +5,7 @@ go 1.26 require ( github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.30.0 - github.com/pulumi/pulumi/sdk/v3 v3.233.0 + github.com/pulumi/pulumi/sdk/v3 v3.234.0 gopkg.in/yaml.v2 v2.4.0 ) diff --git a/deploy/go.sum b/deploy/go.sum index 8f015d6..54c892c 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -183,8 +183,8 @@ github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 h1:w6OnO3d4j5yVf2vpm8OzXFC/xHOEGqt+9 github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1/go.mod h1:UyZyv7hz4knpFx6/Sh+SkZe6hT6sJHtDvw9A0TbvEsk= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.30.0 h1:nF0Y1F7fUGL6RYD9EAtHTdDbNFmDaA3xcEiRlvCDV5E= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.30.0/go.mod h1:BAWI9R3JEEGOp1JlXLPSZKwBGANSrPGUWKtMnS5w5qw= -github.com/pulumi/pulumi/sdk/v3 v3.233.0 h1:r2Z1GtGZUM7olY+vF5Av2nqH1iAvSMKx5DJZxDnqrcY= -github.com/pulumi/pulumi/sdk/v3 v3.233.0/go.mod h1:Eu9QVad1cSPymhTboINPqK6WZMaW7I0NHQcWOmxLYek= +github.com/pulumi/pulumi/sdk/v3 v3.234.0 h1:PoXVM2lJoyqavwPQlVQC6KzhGKNOJpz9OFxyojm8RjA= +github.com/pulumi/pulumi/sdk/v3 v3.234.0/go.mod h1:Eu9QVad1cSPymhTboINPqK6WZMaW7I0NHQcWOmxLYek= github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ= github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88= github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ= From 811046c4ce305444b9bc9b3c2e3dfb527e10f7e5 Mon Sep 17 00:00:00 2001 From: Sai Asish Y Date: Mon, 4 May 2026 03:24:34 -0700 Subject: [PATCH 196/313] auth/oidc: support slice-typed extra claims via overlap match (#1238) Closes #988. Direct `actualValue != expectedValue` fails when the token claim is an array (groups, roles, scp, aud). Switch to a slice-aware any-of overlap so OIDC list claims are validated correctly. --- internal/api/handlers/v0/auth/oidc.go | 34 ++++++++++++++++++++++++++- 1 file changed, 33 insertions(+), 1 deletion(-) diff --git a/internal/api/handlers/v0/auth/oidc.go b/internal/api/handlers/v0/auth/oidc.go index 0cef699..98526e1 100644 --- a/internal/api/handlers/v0/auth/oidc.go +++ b/internal/api/handlers/v0/auth/oidc.go @@ -224,7 +224,7 @@ func (h *OIDCHandler) validateExtraClaims(claims *OIDCClaims) error { return fmt.Errorf("claim validation failed: required claim %s not found", key) } - if actualValue != expectedValue { + if !claimMatches(actualValue, expectedValue) { return fmt.Errorf("claim validation failed: %s expected %v, got %v", key, expectedValue, actualValue) } } @@ -233,6 +233,38 @@ func (h *OIDCHandler) validateExtraClaims(claims *OIDCClaims) error { return nil } +// claimMatches reports whether a claim value satisfies the expected configuration. +// Both sides may be a scalar or a slice; for slice-typed claims (groups, roles, scp, +// aud, etc.) any single overlap is treated as a match, mirroring how OIDC consumers +// normally interpret list claims. +func claimMatches(actual, expected any) bool { + actualList := toAnySlice(actual) + expectedList := toAnySlice(expected) + for _, e := range expectedList { + for _, a := range actualList { + if a == e { + return true + } + } + } + return false +} + +func toAnySlice(v any) []any { + switch s := v.(type) { + case []any: + return s + case []string: + out := make([]any, len(s)) + for i, x := range s { + out[i] = x + } + return out + default: + return []any{v} + } +} + // buildPermissions builds permissions based on OIDC claims and configuration func (h *OIDCHandler) buildPermissions(_ *OIDCClaims) []auth.Permission { var permissions []auth.Permission From dfaa8f3b82c33e2bce0821fc968f95251be47fca Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Mon, 4 May 2026 06:52:12 -0400 Subject: [PATCH 197/313] auth/oidc: test slice-typed extra claims comparison (#1245) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary Follow-up to #1238 (closes #988). Adds direct unit-test coverage for the `claimMatches` helper, which was the actual change in #1238. `claimMatches` and `toAnySlice` are unexported, so the tests live in `oidc_internal_test.go` (`package auth`) — same pattern as `http_internal_test.go`. Cases covered: - scalar/scalar match and mismatch - scalar actual against array expected (both directions of overlap) - array actual against scalar expected - **array/array** — pre-#1238 this combination panicked with `comparing uncomparable type []interface {}` - `[]string` typed slice (exercises the typed-slice branch of `toAnySlice`, which `[]any` skips) - non-string scalars (int, bool) - empty actual array Test values use single letters (`x`, `y`, `p`, `q`) rather than role labels — only the relationships matter, and short tokens keep `goconst` quiet. ## Test plan - [x] `go test ./internal/api/handlers/v0/auth/...` — all 13 subtests pass - [x] `golangci-lint run ./internal/api/handlers/v0/auth/...` — no new issues vs main --- .../handlers/v0/auth/oidc_internal_test.go | 41 +++++++++++++++++++ 1 file changed, 41 insertions(+) create mode 100644 internal/api/handlers/v0/auth/oidc_internal_test.go diff --git a/internal/api/handlers/v0/auth/oidc_internal_test.go b/internal/api/handlers/v0/auth/oidc_internal_test.go new file mode 100644 index 0000000..cc3e472 --- /dev/null +++ b/internal/api/handlers/v0/auth/oidc_internal_test.go @@ -0,0 +1,41 @@ +package auth + +import "testing" + +func TestClaimMatches(t *testing.T) { + tests := []struct { + name string + actual any + expected any + want bool + }{ + {"scalar/scalar match", "x", "x", true}, + {"scalar/scalar mismatch", "x", "y", false}, + + {"scalar actual in array expected", "x", []any{"x", "y"}, true}, + {"scalar actual not in array expected", "z", []any{"x", "y"}, false}, + + {"array actual contains scalar expected", []any{"x", "y"}, "x", true}, + {"array actual missing scalar expected", []any{"y", "z"}, "x", false}, + + // Pre-#1238 array/array comparison panicked with "comparing uncomparable type []interface {}". + {"array/array overlap", []any{"a", "b"}, []any{"b", "c"}, true}, + {"array/array disjoint", []any{"a", "b"}, []any{"c", "d"}, false}, + + // Exercises the []string branch of toAnySlice (concrete typed slice, not []any). + {"[]string actual matches scalar", []string{"p", "q"}, "p", true}, + {"scalar matches []string expected", "p", []string{"p", "q"}, true}, + + {"non-string scalar match", 42, 42, true}, + {"bool scalar match", true, true, true}, + {"empty actual array", []any{}, "x", false}, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + if got := claimMatches(tt.actual, tt.expected); got != tt.want { + t.Errorf("claimMatches(%v, %v) = %v, want %v", tt.actual, tt.expected, got, tt.want) + } + }) + } +} From 6f9bd6661c45ee477dee15b21b57c171352473ca Mon Sep 17 00:00:00 2001 From: Mesut Oezdil <114185853+mesutoezdil@users.noreply.github.com> Date: Mon, 4 May 2026 12:57:02 +0200 Subject: [PATCH 198/313] refactor: extract readBody helper to remove duplicate io.ReadAll calls (#1241) The same pattern for reading an error response body appeared in three places across the auth handlers: - `internal/api/handlers/v0/auth/github_at.go` (twice) - `internal/api/handlers/v0/auth/github_oidc.go` (once) A shared `readBody` helper function added to `common.go` now handles this in one place. The `io` import is removed from both files since it is no longer used directly there. --------- Co-authored-by: Radoslav Dimitrov --- internal/api/handlers/v0/auth/common.go | 6 ++++++ internal/api/handlers/v0/auth/github_at.go | 7 ++----- internal/api/handlers/v0/auth/github_oidc.go | 4 +--- internal/database/postgres.go | 1 - 4 files changed, 9 insertions(+), 9 deletions(-) diff --git a/internal/api/handlers/v0/auth/common.go b/internal/api/handlers/v0/auth/common.go index c283655..2c81303 100644 --- a/internal/api/handlers/v0/auth/common.go +++ b/internal/api/handlers/v0/auth/common.go @@ -10,6 +10,7 @@ import ( "encoding/hex" "errors" "fmt" + "io" "math/big" "net" "regexp" @@ -20,6 +21,11 @@ import ( "github.com/modelcontextprotocol/registry/internal/config" ) +func readBody(r io.Reader) string { + b, _ := io.ReadAll(r) + return string(b) +} + // ErrSignatureMismatch is returned by VerifySignature when the signature is structurally // valid but does not verify against the public key. Distinguishing this from structural // failures (wrong size, bad key format) lets the caller add fingerprint hints only when diff --git a/internal/api/handlers/v0/auth/github_at.go b/internal/api/handlers/v0/auth/github_at.go index fbb950c..b495f4d 100644 --- a/internal/api/handlers/v0/auth/github_at.go +++ b/internal/api/handlers/v0/auth/github_at.go @@ -4,7 +4,6 @@ import ( "context" "encoding/json" "fmt" - "io" "net/http" "regexp" "strings" @@ -123,8 +122,7 @@ func (h *GitHubHandler) getGitHubUser(ctx context.Context, token string) (*GitHu defer resp.Body.Close() if resp.StatusCode != http.StatusOK { - body, _ := io.ReadAll(resp.Body) - return nil, fmt.Errorf("GitHub API error (status %d): %s", resp.StatusCode, body) + return nil, fmt.Errorf("GitHub API error (status %d): %s", resp.StatusCode, readBody(resp.Body)) } var user GitHubUserOrOrg @@ -152,8 +150,7 @@ func (h *GitHubHandler) getGitHubUserOrgs(ctx context.Context, username string, defer resp.Body.Close() if resp.StatusCode != http.StatusOK { - body, _ := io.ReadAll(resp.Body) - return nil, fmt.Errorf("GitHub API error (status %d): %s", resp.StatusCode, body) + return nil, fmt.Errorf("GitHub API error (status %d): %s", resp.StatusCode, readBody(resp.Body)) } var orgs []GitHubUserOrOrg diff --git a/internal/api/handlers/v0/auth/github_oidc.go b/internal/api/handlers/v0/auth/github_oidc.go index 4170640..6a6761b 100644 --- a/internal/api/handlers/v0/auth/github_oidc.go +++ b/internal/api/handlers/v0/auth/github_oidc.go @@ -6,7 +6,6 @@ import ( "encoding/base64" "encoding/json" "fmt" - "io" "math/big" "net/http" "strings" @@ -149,8 +148,7 @@ func (v *GitHubOIDCValidator) fetchJWKS(ctx context.Context) (*JWKS, error) { defer resp.Body.Close() if resp.StatusCode != http.StatusOK { - body, _ := io.ReadAll(resp.Body) - return nil, fmt.Errorf("JWKS endpoint returned status %d: %s", resp.StatusCode, body) + return nil, fmt.Errorf("JWKS endpoint returned status %d: %s", resp.StatusCode, readBody(resp.Body)) } var jwks JWKS diff --git a/internal/database/postgres.go b/internal/database/postgres.go index 2749ad8..b0b2d98 100644 --- a/internal/database/postgres.go +++ b/internal/database/postgres.go @@ -198,7 +198,6 @@ func (db *PostgreSQL) ListServers( whereConditions = append(whereConditions, cursorCondition) args = append(args, cursorArgs...) } - _ = argIndex // Silence unused variable warning // Build the WHERE clause whereClause := "" From 7a4216c52823fe1b64b40608ec84e4745684a2c7 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Mon, 4 May 2026 07:09:57 -0400 Subject: [PATCH 199/313] refactor: rename readBody to readErrorBody and cap body size (#1246) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary Follow-up to #1241. Two small tweaks to the `readBody` helper: - **Rename `readBody` → `readErrorBody`.** The helper is only ever called on the error path (after a non-2xx status check), where we want a small string for diagnostics. The generic name made it look reusable on the success path, where streaming JSON decoding is the right approach. The new name pins the intended use down. - **Cap the read with `io.LimitReader` (8 KiB).** Defense in depth — error diagnostics never need more than a few KB, and we shouldn't buffer an arbitrarily large body from an upstream just to format an error message. 8 KiB is well above any realistic GitHub API or JWKS error response. No behavior change on the happy path. On the unhappy path, error messages are now bounded. ## Test plan - [x] `go build ./...` - [x] `go test ./internal/api/handlers/v0/auth/...` 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- internal/api/handlers/v0/auth/common.go | 8 ++++++-- internal/api/handlers/v0/auth/github_at.go | 4 ++-- internal/api/handlers/v0/auth/github_oidc.go | 2 +- 3 files changed, 9 insertions(+), 5 deletions(-) diff --git a/internal/api/handlers/v0/auth/common.go b/internal/api/handlers/v0/auth/common.go index 2c81303..5d91047 100644 --- a/internal/api/handlers/v0/auth/common.go +++ b/internal/api/handlers/v0/auth/common.go @@ -21,8 +21,12 @@ import ( "github.com/modelcontextprotocol/registry/internal/config" ) -func readBody(r io.Reader) string { - b, _ := io.ReadAll(r) +// readErrorBody reads an upstream error response body for inclusion in an +// error message. The cap protects against a misbehaving upstream returning a +// huge body — error diagnostics never need more than a few KB. +func readErrorBody(r io.Reader) string { + const maxErrorBodySize = 8 * 1024 + b, _ := io.ReadAll(io.LimitReader(r, maxErrorBodySize)) return string(b) } diff --git a/internal/api/handlers/v0/auth/github_at.go b/internal/api/handlers/v0/auth/github_at.go index b495f4d..af5e793 100644 --- a/internal/api/handlers/v0/auth/github_at.go +++ b/internal/api/handlers/v0/auth/github_at.go @@ -122,7 +122,7 @@ func (h *GitHubHandler) getGitHubUser(ctx context.Context, token string) (*GitHu defer resp.Body.Close() if resp.StatusCode != http.StatusOK { - return nil, fmt.Errorf("GitHub API error (status %d): %s", resp.StatusCode, readBody(resp.Body)) + return nil, fmt.Errorf("GitHub API error (status %d): %s", resp.StatusCode, readErrorBody(resp.Body)) } var user GitHubUserOrOrg @@ -150,7 +150,7 @@ func (h *GitHubHandler) getGitHubUserOrgs(ctx context.Context, username string, defer resp.Body.Close() if resp.StatusCode != http.StatusOK { - return nil, fmt.Errorf("GitHub API error (status %d): %s", resp.StatusCode, readBody(resp.Body)) + return nil, fmt.Errorf("GitHub API error (status %d): %s", resp.StatusCode, readErrorBody(resp.Body)) } var orgs []GitHubUserOrOrg diff --git a/internal/api/handlers/v0/auth/github_oidc.go b/internal/api/handlers/v0/auth/github_oidc.go index 6a6761b..5ce38ac 100644 --- a/internal/api/handlers/v0/auth/github_oidc.go +++ b/internal/api/handlers/v0/auth/github_oidc.go @@ -148,7 +148,7 @@ func (v *GitHubOIDCValidator) fetchJWKS(ctx context.Context) (*JWKS, error) { defer resp.Body.Close() if resp.StatusCode != http.StatusOK { - return nil, fmt.Errorf("JWKS endpoint returned status %d: %s", resp.StatusCode, readBody(resp.Body)) + return nil, fmt.Errorf("JWKS endpoint returned status %d: %s", resp.StatusCode, readErrorBody(resp.Body)) } var jwks JWKS From fbfd63ced8e1f6bee9ccd0dd93f1b8fe087f9f22 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Mon, 4 May 2026 09:25:41 -0400 Subject: [PATCH 200/313] fix(ui): encode publisher-controlled URLs for href attribute context (#1248) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The catalogue page interpolates publisher-supplied URL fields (`server.repository.url`, `server.websiteUrl`) inside `href="..."` attributes via `innerHTML`, escaping them with a `textContent`→`innerHTML` helper. Per the HTML5 fragment-serialisation algorithm, that round-trip encodes only `&`, `<`, `>`, and U+00A0 inside text nodes — it does not encode `"` or `'`. The helper is therefore safe in element-text contexts (where it is used for `name`, `version`, `description`, etc.) but unsafe inside an attribute value. Add an attribute-safe `escapeAttr` helper that follows the OWASP attribute-encoding rule (also encodes `"` and `'`) and use it for the two `href` interpolations. Element-text usages keep the existing `escapeHtml` and remain unchanged. A short comment on each helper documents the contexts they cover so future fields are wired up correctly. Co-Authored-By: Claude Opus 4.7 (1M context) Co-authored-by: Claude Opus 4.7 (1M context) --- internal/api/handlers/v0/ui_index.html | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/internal/api/handlers/v0/ui_index.html b/internal/api/handlers/v0/ui_index.html index 38bac7f..dc437ff 100644 --- a/internal/api/handlers/v0/ui_index.html +++ b/internal/api/handlers/v0/ui_index.html @@ -423,13 +423,13 @@ ${server.repository?.url ? ` ` : ''} ${server.websiteUrl ? ` ` : ''}
    @@ -491,12 +491,26 @@ }); // Utility functions + // Safe for element-text contexts only: encodes `&`, `<`, `>`. Does NOT + // encode `"` or `'`, so it is unsafe inside attribute values — use + // escapeAttr there. function escapeHtml(text) { const div = document.createElement('div'); div.textContent = text; return div.innerHTML; } + // Safe for HTML attribute values per OWASP attribute-encoding rule. + function escapeAttr(text) { + if (text == null) return ''; + return String(text) + .replace(/&/g, '&') + .replace(//g, '>') + .replace(/"/g, '"') + .replace(/'/g, '''); + } + function formatDate(dateStr) { if (!dateStr) return '-'; const date = new Date(dateStr); From 78b7bbde07948049b916d76b4769faee461ff930 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Mon, 4 May 2026 09:26:50 -0400 Subject: [PATCH 201/313] fix(validators): reject HTML metacharacters and whitespace in websiteUrl (#1249) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `validateWebsiteURL` only checked that the URL parses, is absolute, and uses the `https` scheme. It accepted literal `"`, `'`, `<`, `>`, and ASCII space — none of which are valid in a URI per RFC 3986, and all of which broke rendering when the value flowed into the catalogue UI's `` template. Add a `strings.IndexAny` check after the scheme check that rejects any of these characters with a clear `website-url-invalid-characters` issue that points at the offending byte position. Control characters (`\t`, `\n`, `\r`) are also covered: they're caught one step earlier by Go's `url.Parse`, but the bytes are listed in the rejection set so the behaviour is explicit and survives any future relaxation of `url.Parse`. Already-percent-encoded URLs (e.g. `?q=hello%20world`) continue to validate cleanly. Adds table-driven cases for `"`, `'`, `<>`, space, newline, and a positive case for percent-encoded special characters. Co-Authored-By: Claude Opus 4.7 (1M context) Co-authored-by: Claude Opus 4.7 (1M context) --- internal/validators/validators.go | 14 ++++ internal/validators/validators_test.go | 94 ++++++++++++++++++++++++++ 2 files changed, 108 insertions(+) diff --git a/internal/validators/validators.go b/internal/validators/validators.go index 4da756d..114ed3c 100644 --- a/internal/validators/validators.go +++ b/internal/validators/validators.go @@ -195,6 +195,20 @@ func validateWebsiteURL(ctx *ValidationContext, websiteURL string) *ValidationRe result.AddIssue(issue) } + // Reject characters that aren't valid in a URI per RFC 3986 and that have + // caused rendering issues when websiteUrl flows into the catalogue UI's + // href attributes. Publishers should percent-encode these in the source URL. + if i := strings.IndexAny(websiteURL, "\"'<> \t\n\r"); i >= 0 { + issue := NewValidationIssue( + ValidationIssueTypeSemantic, + ctx.String(), + fmt.Sprintf("websiteUrl contains an invalid character %q at position %d: %s", websiteURL[i], i, websiteURL), + ValidationIssueSeverityError, + "website-url-invalid-characters", + ) + result.AddIssue(issue) + } + return result } diff --git a/internal/validators/validators_test.go b/internal/validators/validators_test.go index d4ff5c1..c3e5585 100644 --- a/internal/validators/validators_test.go +++ b/internal/validators/validators_test.go @@ -13,6 +13,8 @@ import ( "github.com/modelcontextprotocol/registry/pkg/model" ) +const websiteURLInvalidCharErrSubstr = "websiteUrl contains an invalid character" + func TestValidate(t *testing.T) { tests := []struct { name string @@ -486,6 +488,98 @@ func TestValidate(t *testing.T) { }, expectedError: "invalid websiteUrl:", }, + { + name: "server with websiteUrl containing double quote", + serverDetail: apiv0.ServerJSON{ + Schema: model.CurrentSchemaURL, + Name: "com.example/test-server", + Description: "A test server", + Repository: &model.Repository{ + URL: "https://github.com/owner/repo", + Source: "github", + }, + Version: "1.0.0", + WebsiteURL: `https://example.com/"oops`, + }, + expectedError: websiteURLInvalidCharErrSubstr, + }, + { + name: "server with websiteUrl containing single quote", + serverDetail: apiv0.ServerJSON{ + Schema: model.CurrentSchemaURL, + Name: "com.example/test-server", + Description: "A test server", + Repository: &model.Repository{ + URL: "https://github.com/owner/repo", + Source: "github", + }, + Version: "1.0.0", + WebsiteURL: "https://example.com/it's", + }, + expectedError: websiteURLInvalidCharErrSubstr, + }, + { + name: "server with websiteUrl containing angle brackets", + serverDetail: apiv0.ServerJSON{ + Schema: model.CurrentSchemaURL, + Name: "com.example/test-server", + Description: "A test server", + Repository: &model.Repository{ + URL: "https://github.com/owner/repo", + Source: "github", + }, + Version: "1.0.0", + WebsiteURL: "https://example.com/", + }, + expectedError: websiteURLInvalidCharErrSubstr, + }, + { + name: "server with websiteUrl containing space", + serverDetail: apiv0.ServerJSON{ + Schema: model.CurrentSchemaURL, + Name: "com.example/test-server", + Description: "A test server", + Repository: &model.Repository{ + URL: "https://github.com/owner/repo", + Source: "github", + }, + Version: "1.0.0", + WebsiteURL: "https://example.com/has space", + }, + expectedError: websiteURLInvalidCharErrSubstr, + }, + { + name: "server with websiteUrl containing newline", + serverDetail: apiv0.ServerJSON{ + Schema: model.CurrentSchemaURL, + Name: "com.example/test-server", + Description: "A test server", + Repository: &model.Repository{ + URL: "https://github.com/owner/repo", + Source: "github", + }, + Version: "1.0.0", + WebsiteURL: "https://example.com/has\nnewline", + }, + // url.Parse rejects ASCII control chars before our character-set + // check runs; either path produces a validation error. + expectedError: "invalid websiteUrl:", + }, + { + name: "server with websiteUrl with percent-encoded special chars is accepted", + serverDetail: apiv0.ServerJSON{ + Schema: model.CurrentSchemaURL, + Name: "com.example/test-server", + Description: "A test server", + Repository: &model.Repository{ + URL: "https://github.com/owner/repo", + Source: "github", + }, + Version: "1.0.0", + WebsiteURL: "https://example.com/path/?q=hello%20world&r=a%22b", + }, + expectedError: "", + }, { name: "server with websiteUrl that matches namespace domain", serverDetail: apiv0.ServerJSON{ From f5f40bd98084466eaf18fe48ea62a0d534caa774 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Mon, 4 May 2026 09:41:23 -0400 Subject: [PATCH 202/313] fix(auth/http): extend SSRF blocklist to IPv6 6to4/NAT64/site-local prefixes (#1250) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The HTTP namespace-verification fetcher's `isBlockedIP` composed its blocklist from Go stdlib's `Is*` helpers plus a manual CGNAT range. That covers IPv4 cloud metadata, RFC1918, ULA, and link-local — but Go's classification helpers don't recognise IPv6 prefix families that embed or tunnel to arbitrary IPv4: - 2002::/16 RFC 3056 6to4 — bits 16-47 are an arbitrary IPv4 - 64:ff9b::/96 RFC 6052 NAT64 well-known — low 32 bits are IPv4 - 64:ff9b:1::/48 RFC 8215 NAT64 local-use — same IPv4-embedding shape - fec0::/10 RFC 3879 site-local (deprecated, still routed by some stacks) On hosts with 6to4 routing or a NAT64 next-hop (the default on IPv6-only GKE node pools, AWS IPv6-only EC2, Azure IPv6 VMs with NAT64, and many corporate DNS64/NAT64 networks), an attacker who controls DNS for a publisher domain can cause the registry to dial `169.254.169.254`, `10.0.0.0/8`, etc. via the IPv6 wrapper. Same SSRF class as GHSA-56c3-vfp2-5qqj on n8n-mcp. Define the four prefixes via a new `mustCIDR` helper (panic on malformed CIDR at init so a typo can't fail-open silently) and iterate them in `isBlockedIP` after the stdlib gates. Refactor the existing CGNAT IIFE to use the same helper for consistency. IPv4-mapped IPv6 (::ffff:0:0/96) needs no special-casing: Go's `Is*` helpers honour the `To4()` fast-path, so e.g. `::ffff:10.0.0.1` is already classified as `IsPrivate`. Adds 17 test cases to `TestIsBlockedIP` covering each new prefix family, IPv4-mapped IPv6 sanity checks, and just-outside-the-range positive controls (`2001::1`, `2003::1`, `64:ff9c::1`). Co-Authored-By: Claude Opus 4.7 (1M context) Co-authored-by: Claude Opus 4.7 (1M context) --- internal/api/handlers/v0/auth/http.go | 52 ++++++++++++++++--- .../handlers/v0/auth/http_internal_test.go | 28 ++++++++++ 2 files changed, 73 insertions(+), 7 deletions(-) diff --git a/internal/api/handlers/v0/auth/http.go b/internal/api/handlers/v0/auth/http.go index 7d73d52..8f438b7 100644 --- a/internal/api/handlers/v0/auth/http.go +++ b/internal/api/handlers/v0/auth/http.go @@ -109,27 +109,65 @@ func safeDialContext(ctx context.Context, network, addr string) (net.Conn, error return nil, fmt.Errorf("dial %s: all resolved public addresses failed: %w", host, lastErr) } +// mustCIDR parses a CIDR literal at init; panics on malformed input so a +// typo surfaces at startup rather than letting a nil *IPNet through to the +// blocklist check (which would silently fail-open). +func mustCIDR(s string) *net.IPNet { + _, n, err := net.ParseCIDR(s) + if err != nil { + panic(fmt.Sprintf("auth: invalid CIDR %q: %v", s, err)) + } + return n +} + // cgnatRange covers RFC 6598 Carrier-Grade NAT (100.64.0.0/10), which the // stdlib does not classify via any Is* helper but is reachable on some // cloud / mobile networks where it shadows internal infrastructure. -var cgnatRange = func() *net.IPNet { - _, n, _ := net.ParseCIDR("100.64.0.0/10") - return n -}() +var cgnatRange = mustCIDR("100.64.0.0/10") + +// blockedIPv6Prefixes are IPv6 ranges that either embed an arbitrary IPv4 +// address (and therefore tunnel into RFC1918 / cloud-metadata space on +// hosts with the corresponding routing) or are routed into site-local +// internal networks. None of these are caught by Go's per-class Is* +// helpers. +// +// 2002::/16 RFC 3056 6to4 — bits 16-47 are an IPv4 address +// 64:ff9b::/96 RFC 6052 NAT64 well-known — low 32 bits are IPv4 +// 64:ff9b:1::/48 RFC 8215 NAT64 local-use — same IPv4-embedding shape +// fec0::/10 RFC 3879 site-local (deprecated, still routed by some +// stacks) +var blockedIPv6Prefixes = []*net.IPNet{ + mustCIDR("2002::/16"), + mustCIDR("64:ff9b::/96"), + mustCIDR("64:ff9b:1::/48"), + mustCIDR("fec0::/10"), +} // isBlockedIP reports whether an IP must not be dialled by the namespace // verification fetcher. Covers loopback (127/8, ::1), RFC1918 + ULA via // IsPrivate, link-local (169.254/16, fe80::/10 — includes cloud metadata // 169.254.169.254), unspecified (0.0.0.0, ::), all multicast (admin-scoped -// 239/8 and ff00::/8 in addition to link-local-multicast), and CGNAT. +// 239/8 and ff00::/8 in addition to link-local-multicast), CGNAT, and +// IPv6 prefix families that tunnel to or embed arbitrary IPv4 addresses +// (see blockedIPv6Prefixes). IPv4-mapped IPv6 (::ffff:0:0/96) is handled +// implicitly: the stdlib Is* helpers honour the To4() fast-path, so e.g. +// ::ffff:10.0.0.1 is correctly classified as IsPrivate. func isBlockedIP(ip net.IP) bool { if ip == nil { return true } - return ip.IsLoopback() || ip.IsPrivate() || + if ip.IsLoopback() || ip.IsPrivate() || ip.IsLinkLocalUnicast() || ip.IsMulticast() || ip.IsUnspecified() || - cgnatRange.Contains(ip) + cgnatRange.Contains(ip) { + return true + } + for _, p := range blockedIPv6Prefixes { + if p.Contains(ip) { + return true + } + } + return false } // NewDefaultHTTPKeyFetcherWithClient creates a new HTTP key fetcher with a custom HTTP client. diff --git a/internal/api/handlers/v0/auth/http_internal_test.go b/internal/api/handlers/v0/auth/http_internal_test.go index 5b2ce37..998c8c8 100644 --- a/internal/api/handlers/v0/auth/http_internal_test.go +++ b/internal/api/handlers/v0/auth/http_internal_test.go @@ -30,10 +30,38 @@ func TestIsBlockedIP(t *testing.T) { // Blocked — Carrier-Grade NAT (RFC 6598) {"100.64.0.1", true}, {"100.127.255.254", true}, + // Blocked — IPv6 6to4 (RFC 3056 2002::/16); bits 16-47 are an + // arbitrary IPv4 address, so 2002:a9fe:a9fe:: tunnels to + // 169.254.169.254 and 2002:0a00:0001:: tunnels to 10.0.0.1. + {"2002:a9fe:a9fe::", true}, + {"2002:0a00:0001::", true}, + {"2002::1", true}, + // Blocked — IPv6 NAT64 well-known prefix (RFC 6052 64:ff9b::/96); + // low 32 bits embed an IPv4 address. + {"64:ff9b::a9fe:a9fe", true}, + {"64:ff9b::a00:1", true}, + // Blocked — IPv6 NAT64 local-use prefix (RFC 8215 64:ff9b:1::/48). + {"64:ff9b:1::1", true}, + {"64:ff9b:1:abcd::", true}, + // Blocked — IPv6 deprecated site-local (RFC 3879 fec0::/10); + // still routed into internal networks by some stacks. + {"fec0::1", true}, + {"feff::1", true}, + // Blocked — IPv4-mapped IPv6 (::ffff:0:0/96) inherits the + // classification of the wrapped IPv4 via To4() fast-path; covered + // here as an explicit regression guard. + {"::ffff:127.0.0.1", true}, + {"::ffff:10.0.0.1", true}, + {"::ffff:169.254.169.254", true}, // Allowed — public {"1.1.1.1", false}, {"8.8.8.8", false}, {"2606:4700:4700::1111", false}, + {"2001:4860:4860::8888", false}, + // Allowed — just outside the new IPv6 blocks + {"2001::1", false}, // outside 2002::/16 + {"2003::1", false}, // outside 2002::/16 on the other side + {"64:ff9c::1", false}, // outside 64:ff9b::/96 // Allowed — outside CGNAT range {"100.63.255.255", false}, {"100.128.0.1", false}, From 1b9f69e81b27bc2e3dc73c2c986c890c3af7173a Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Mon, 4 May 2026 10:07:32 -0400 Subject: [PATCH 203/313] deploy: update prod to v1.7.7 (#1251) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary - Bump `mcp-registry:imageTag` from `1.7.6` → `1.7.7` in `deploy/Pulumi.gcpProd.yaml` - v1.7.7 is a security patch covering three findings (validator hardening, attribute-context UI escaping, IPv6 SSRF blocklist extension); see the v1.7.7 release notes - Staging is on `f5f40bd` (the v1.7.7 commit) and verified end-to-end: - `/v0.1/version` reports the new commit - `/v0.1/validate` rejects a poisoned `websiteUrl` with `website-url-invalid-characters` - `/` HTML serves the `escapeAttr` helper ## Test plan - [ ] Confirm release workflow's `ko-push` job has finished publishing `ghcr.io/modelcontextprotocol/registry:1.7.7` before merging - [ ] Watch deploy-production workflow rolls the registry pods to `1.7.7` - [ ] Hit `https://registry.modelcontextprotocol.io/v0.1/version` and confirm `git_commit` matches `f5f40bd...` - [ ] Spot-check the catalogue UI loads cleanly 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.7 (1M context) --- deploy/Pulumi.gcpProd.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/deploy/Pulumi.gcpProd.yaml b/deploy/Pulumi.gcpProd.yaml index 034330b..44e5839 100644 --- a/deploy/Pulumi.gcpProd.yaml +++ b/deploy/Pulumi.gcpProd.yaml @@ -1,7 +1,7 @@ config: mcp-registry:environment: prod mcp-registry:provider: gcp - mcp-registry:imageTag: 1.7.6 # Set specific image tag for production (change this to deploy different versions) + mcp-registry:imageTag: 1.7.7 # Set specific image tag for production (change this to deploy different versions) gcp:project: mcp-registry-prod mcp-registry:githubClientId: Iv23liUydBbI7Z2Q9bOZ mcp-registry:githubClientSecret: From 6d6a8871749abf152d8f8173c1b61ac1ace14866 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 5 May 2026 03:50:20 -0400 Subject: [PATCH 204/313] build(deps): bump pulumi/actions from 6.6.1 to 7.0.0 in the actions group (#1254) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps the actions group with 1 update: [pulumi/actions](https://github.com/pulumi/actions). Updates `pulumi/actions` from 6.6.1 to 7.0.0
    Release notes

    Sourced from pulumi/actions's releases.

    v7.0.0

    What's Changed

    New Contributors

    Full Changelog: https://github.com/pulumi/actions/compare/v6...v7.0.0

    Changelog

    Sourced from pulumi/actions's changelog.

    CHANGELOG

    HEAD (Unreleased)

    (none)

    7.0.0 (2026-05-01)

    • chore: update Action runtime to node 24 (#1404)
    • chore: bump typescript, jest, ts-jest, @types/jest, @types/node (#1405)
    • chore: update ESLint stack and migrate to flat config (#1406)

    6.6.1 (2025-11-12)

    • chore: Update pulumi/pulumi dependency (#1394)

    6.6.0 (2025-09-29)

    • feat: Strip ansi control characters from GitHub step Summary and PR comment (#1312)

    6.4.0 (2025-07-16)

    • feat: Add run-program flag support for refresh, destroy, preview, and up/update commands (#1376)

    6.3.0 (2025-05-08)

    • feat: support --exclude and --exclude-dependents flags (#1363)

    • feat: verbosity and debug inputs to enable debug options (#1046)

    • fix: update "user agent" string to pulumi/actions@v6 (#1357)

    6.2.0 (2025-03-05)

    • feat: support continue on error flag (--continue-on-error) (#1357)

    6.1.0 (2025-02-27)

    ... (truncated)

    Commits

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=pulumi/actions&package-manager=github_actions&previous-version=6.6.1&new-version=7.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/cancel-pulumi-lock.yml | 2 +- .github/workflows/deploy-production.yml | 2 +- .github/workflows/deploy-staging.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/cancel-pulumi-lock.yml b/.github/workflows/cancel-pulumi-lock.yml index 345c0be..06f1305 100644 --- a/.github/workflows/cancel-pulumi-lock.yml +++ b/.github/workflows/cancel-pulumi-lock.yml @@ -27,7 +27,7 @@ jobs: uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 - name: Setup Pulumi - uses: pulumi/actions@8582a9e8cc630786854029b4e09281acd6794b58 + uses: pulumi/actions@8e5e406f4007fca908480587cb9893c07090f58d with: pulumi-version: ${{ env.PULUMI_VERSION }} diff --git a/.github/workflows/deploy-production.yml b/.github/workflows/deploy-production.yml index cd03772..bf8f4f2 100644 --- a/.github/workflows/deploy-production.yml +++ b/.github/workflows/deploy-production.yml @@ -32,7 +32,7 @@ jobs: cache: true - name: Setup Pulumi - uses: pulumi/actions@8582a9e8cc630786854029b4e09281acd6794b58 + uses: pulumi/actions@8e5e406f4007fca908480587cb9893c07090f58d with: pulumi-version: ${{ env.PULUMI_VERSION }} diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml index 946aaaf..074bb4a 100644 --- a/.github/workflows/deploy-staging.yml +++ b/.github/workflows/deploy-staging.yml @@ -79,7 +79,7 @@ jobs: cache: true - name: Setup Pulumi - uses: pulumi/actions@8582a9e8cc630786854029b4e09281acd6794b58 + uses: pulumi/actions@8e5e406f4007fca908480587cb9893c07090f58d with: pulumi-version: ${{ env.PULUMI_VERSION }} From 4e147072f03aeacfe8456c7f24407e0ea65d92c0 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Tue, 5 May 2026 05:58:05 -0400 Subject: [PATCH 205/313] metrics: stop counting client-cancelled requests as server errors (#1255) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary - Remap recorded status to `499` (NGINX-style "client closed") when `ctx.Context().Err()` is `context.Canceled` after the handler returns - Skip the `http_errors_total` increment for `499`s so the availability metric reflects server-visible errors only ## Why Under scraper-driven load, clients with short timeouts paginate `/v0.1/servers`, give up while PG is busy, and close the TCP connection. The handler's DB iteration returns `context canceled`, the handler converts that to `huma.Error500InternalServerError`, and tries to write a response to the now-closed socket. NGINX records `499` (client closed) and never delivers anything to the client — but the registry's middleware records `status_code=500` and bumps `mcp_registry_http_errors_total`. That's what's been firing the `Availability dropped below 95%` alert during the daily 17:00 UTC bursts. Recent prod numbers from one pod (~19h uptime): ``` mcp_registry_http_errors_total{path="/v0.1/servers", status_code="500"} 7396 mcp_registry_http_errors_total{path="/v0.1/servers/{serverName}/versions", status_code="500"} 283 mcp_registry_http_errors_total{path="/v0/servers", status_code="500"} 352 ``` …against zero 5xx in NGINX ingress logs over the same window. The alert was correct *given the data it had*; the data was misclassifying client cancellations as server errors. ## What this does In `internal/api/router/router.go` (the metric middleware): after `next(ctx)`, check `ctx.Context().Err()`. If it's `context.Canceled`, override `statusCode` to `499` and skip the error counter. Requests counter and duration histogram still record so the cancellation rate stays visible. `context.DeadlineExceeded` is intentionally **not** remapped — that would indicate a server-side timeout if we ever add per-request deadlines, and should still count as a server error. ## What this does *not* do - Doesn't reduce the underlying load (ServiceNow + notion catalog scrapers driving the daily peak — separate work, see the `updated_since` outreach we're doing). - Doesn't change handler behaviour — handlers still call `huma.Error500…` on `context.Canceled`. We could short-circuit earlier (return without writing) to save the work, but that's a bigger refactor and the metric fix unblocks the alert immediately. ## Companion change (no code, just a Grafana annotation tweak) The `Availability dropped below 95%` alert (UID `bexrc60etvhmoa`) currently has the annotation: > No. of 5xx are increased from acceptable limit i.e. 5% of total throughput The query is on `mcp_registry_http_errors_total`, not 5xx specifically. After this change the count is meaningful again, but the wording is still misleading. Suggest updating to: > Internal error rate exceeded 5% of total throughput (no PromQL change required.) ## Test plan - [x] `go test ./internal/api/router/...` — new test passes - [x] `golangci-lint run ./internal/...` — clean - [ ] After merge, watch a daily 17:00 UTC burst — `mcp_registry_http_errors_total{status_code="500", path="/v0.1/servers"}` should stay flat while `mcp_registry_http_requests_total{status_code="499", path="/v0.1/servers"}` grows. Availability alert should not fire on cancellation-only bursts. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.7 (1M context) --- internal/api/router/router.go | 28 ++++++- internal/api/router/router_test.go | 119 +++++++++++++++++++++++++++++ 2 files changed, 146 insertions(+), 1 deletion(-) create mode 100644 internal/api/router/router_test.go diff --git a/internal/api/router/router.go b/internal/api/router/router.go index 46b975b..7d64258 100644 --- a/internal/api/router/router.go +++ b/internal/api/router/router.go @@ -2,7 +2,9 @@ package router import ( + "context" "encoding/json" + "errors" "fmt" "net/http" "strings" @@ -19,6 +21,12 @@ import ( "github.com/modelcontextprotocol/registry/internal/telemetry" ) +// statusClientClosed mirrors NGINX's non-standard 499 — used for requests +// where the client disconnected before we finished. Distinguishing these from +// real server errors keeps the availability metric meaningful under bursts of +// scraper traffic that time out and reconnect. +const statusClientClosed = 499 + // Middleware configuration options type middlewareConfig struct { skipPaths map[string]bool @@ -67,6 +75,22 @@ func MetricTelemetryMiddleware(metrics *telemetry.Metrics, options ...Middleware duration := time.Since(start).Seconds() statusCode := ctx.Status() + // If the client disconnected before the handler finished, the handler + // likely converted the resulting context.Canceled into a huma 5xx and + // tried to write a response to a closed socket. NGINX records that + // case as a 499 (client closed). Without this remap we count it as a + // server error: a single ServiceNow-style burst that times out a + // few thousand list-servers requests inflates http_errors_total even + // though no client ever saw a 5xx, and the availability alert fires + // on what is effectively just slow responses. + // + // Only context.Canceled is remapped — context.DeadlineExceeded would + // indicate a server-side timeout we set ourselves and should still + // count as a server error if/when we add per-request deadlines. + if reqErr := ctx.Context().Err(); reqErr != nil && errors.Is(reqErr, context.Canceled) { + statusCode = statusClientClosed + } + // Combine common and custom attributes attrs := []attribute.KeyValue{ attribute.String("method", method), @@ -77,7 +101,9 @@ func MetricTelemetryMiddleware(metrics *telemetry.Metrics, options ...Middleware // Record metrics metrics.Requests.Add(ctx.Context(), 1, metric.WithAttributes(attrs...)) - if statusCode >= 400 { + // Skip the error counter for client-closed requests so the availability + // metric reflects server-visible errors only. + if statusCode >= 400 && statusCode != statusClientClosed { metrics.ErrorCount.Add(ctx.Context(), 1, metric.WithAttributes(attrs...)) } diff --git a/internal/api/router/router_test.go b/internal/api/router/router_test.go new file mode 100644 index 0000000..f61b1de --- /dev/null +++ b/internal/api/router/router_test.go @@ -0,0 +1,119 @@ +package router_test + +import ( + "context" + "errors" + "net/http" + "net/http/httptest" + "strings" + "testing" + + "github.com/danielgtaylor/huma/v2" + "github.com/danielgtaylor/huma/v2/adapters/humago" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" + + "github.com/modelcontextprotocol/registry/internal/api/router" + "github.com/modelcontextprotocol/registry/internal/telemetry" +) + +// TestMetricMiddleware_ClientCancelledNotCountedAsError verifies that a request +// the client gave up on (request-context Canceled) is recorded as 499 in +// http_requests_total and is NOT incremented in http_errors_total — even when +// the handler returned huma.Error500InternalServerError because its DB call +// surfaced context.Canceled. +// +// Regression test for the case where a ServiceNow-style scraper burst +// generated thousands of internal 500s for cancelled requests, tripping the +// "Availability dropped below 95%" alert despite zero 5xx reaching clients. +func TestMetricMiddleware_ClientCancelledNotCountedAsError(t *testing.T) { + shutdown, metrics, err := telemetry.InitMetrics("test") + require.NoError(t, err) + defer func() { _ = shutdown(context.Background()) }() + + mux := http.NewServeMux() + api := humago.New(mux, huma.DefaultConfig("Test API", "1.0.0")) + api.UseMiddleware(router.MetricTelemetryMiddleware(metrics)) + + // Handler that simulates: DB returns context.Canceled because the client + // disconnected, handler converts to huma 500. + huma.Register(api, huma.Operation{ + OperationID: "cancelled-list", + Method: http.MethodGet, + Path: "/v0/servers", + }, func(_ context.Context, _ *struct{}) (*struct{}, error) { + return nil, huma.Error500InternalServerError("Failed to get registry list", + errors.New("error iterating rows: context canceled")) + }) + + mux.Handle("/metrics", metrics.PrometheusHandler()) + + cancelledCtx, cancel := context.WithCancel(context.Background()) + cancel() + + req := httptest.NewRequest(http.MethodGet, "/v0/servers", nil).WithContext(cancelledCtx) + rec := httptest.NewRecorder() + mux.ServeHTTP(rec, req) + + scrapeReq := httptest.NewRequest(http.MethodGet, "/metrics", nil) + scrapeRec := httptest.NewRecorder() + mux.ServeHTTP(scrapeRec, scrapeReq) + assert.Equal(t, http.StatusOK, scrapeRec.Code) + + body := scrapeRec.Body.String() + + // The request is recorded — but as 499, not 500. + assert.True(t, + containsMetric(body, `mcp_registry_http_requests_total`, `status_code="499"`, `path="/v0/servers"`), + "expected requests_total to record status_code=499 for the cancelled request; got:\n%s", + filterMetricLines(body, "mcp_registry_http_requests_total"), + ) + assert.False(t, + containsMetric(body, `mcp_registry_http_requests_total`, `status_code="500"`, `path="/v0/servers"`), + "did not expect requests_total to record status_code=500 for a client-cancelled request; got:\n%s", + filterMetricLines(body, "mcp_registry_http_requests_total"), + ) + + // The error counter is NOT bumped for 499s — that is the point of this fix. + assert.False(t, + containsMetric(body, `mcp_registry_http_errors_total`, `status_code="499"`), + "errors_total must not be incremented for client-cancelled requests; got:\n%s", + filterMetricLines(body, "mcp_registry_http_errors_total"), + ) + assert.False(t, + containsMetric(body, `mcp_registry_http_errors_total`, `status_code="500"`, `path="/v0/servers"`), + "errors_total must not record a 500 for a request the client already gave up on; got:\n%s", + filterMetricLines(body, "mcp_registry_http_errors_total"), + ) +} + +// containsMetric returns true iff some line in body starts with `metric{...}` +// and that label set contains every requested label fragment. +func containsMetric(body, metric string, labels ...string) bool { + for _, line := range strings.Split(body, "\n") { + if !strings.HasPrefix(line, metric+"{") { + continue + } + ok := true + for _, l := range labels { + if !strings.Contains(line, l) { + ok = false + break + } + } + if ok { + return true + } + } + return false +} + +func filterMetricLines(body, metric string) string { + var lines []string + for _, line := range strings.Split(body, "\n") { + if strings.HasPrefix(line, metric) { + lines = append(lines, line) + } + } + return strings.Join(lines, "\n") +} From 2b90d93712fe7bd8ce1db1c0129dcca35df2e0a2 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Tue, 5 May 2026 06:14:49 -0400 Subject: [PATCH 206/313] deploy: update prod to v1.7.8 (#1256) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary - Bump `mcp-registry:imageTag` from `1.7.7` → `1.7.8` in `deploy/Pulumi.gcpProd.yaml` - v1.7.8 ships the metrics fix that stops counting client-cancelled requests as server errors (#1255). Under scraper-driven load, clients with short timeouts close the socket while PG is still iterating; the handler converts `context.Canceled` to a 500 and the metric middleware was bumping `mcp_registry_http_errors_total` even though NGINX recorded 499 and never delivered a response. This is what's been firing the daily ~17:00 UTC `Availability dropped below 95%` alert. - Also includes a CI-only `pulumi/actions` 6.6.1 → 7.0.0 bump (#1254). No registry runtime impact. - Staging is on `4e14707` (the v1.7.8 commit) and `staging.registry.modelcontextprotocol.io/v0.1/version` reports it. ## Test plan - [ ] Confirm release workflow's `ko-push` job has published `ghcr.io/modelcontextprotocol/registry:1.7.8` before merging - [ ] Watch deploy-production roll the registry pods to `1.7.8` - [ ] Hit `https://registry.modelcontextprotocol.io/v0.1/version` and confirm `git_commit` matches `4e147072f03aeacfe8456c7f24407e0ea65d92c0` - [ ] Through the next ~17:00 UTC scraper burst, watch in Prometheus: - `mcp_registry_http_errors_total{status_code="500", path="/v0.1/servers"}` should stay flat - `mcp_registry_http_requests_total{status_code="499", path="/v0.1/servers"}` should grow during the burst - The `Availability dropped below 95%` alert should not fire on cancellation-only bursts 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.7 (1M context) --- deploy/Pulumi.gcpProd.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/deploy/Pulumi.gcpProd.yaml b/deploy/Pulumi.gcpProd.yaml index 44e5839..f4ce516 100644 --- a/deploy/Pulumi.gcpProd.yaml +++ b/deploy/Pulumi.gcpProd.yaml @@ -1,7 +1,7 @@ config: mcp-registry:environment: prod mcp-registry:provider: gcp - mcp-registry:imageTag: 1.7.7 # Set specific image tag for production (change this to deploy different versions) + mcp-registry:imageTag: 1.7.8 # Set specific image tag for production (change this to deploy different versions) gcp:project: mcp-registry-prod mcp-registry:githubClientId: Iv23liUydBbI7Z2Q9bOZ mcp-registry:githubClientSecret: From 6ae2d54e737d9c1d7d6e3e8805df96a79eada6ca Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 6 May 2026 17:34:08 -0400 Subject: [PATCH 207/313] build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.234.0 to 3.235.0 in /deploy (#1259) --- deploy/go.mod | 3 ++- deploy/go.sum | 6 ++++-- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index d64615f..9ca00fe 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -5,7 +5,7 @@ go 1.26 require ( github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.30.0 - github.com/pulumi/pulumi/sdk/v3 v3.234.0 + github.com/pulumi/pulumi/sdk/v3 v3.235.0 gopkg.in/yaml.v2 v2.4.0 ) @@ -42,6 +42,7 @@ require ( github.com/go-logr/logr v1.4.3 // indirect github.com/go-logr/stdr v1.2.2 // indirect github.com/gogo/protobuf v1.3.2 // indirect + github.com/golang/glog v1.2.5 // indirect github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect github.com/google/uuid v1.6.0 // indirect github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 // indirect diff --git a/deploy/go.sum b/deploy/go.sum index 54c892c..fe7076d 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -84,6 +84,8 @@ github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre github.com/gogo/protobuf v1.3.1/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o= github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q= github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q= +github.com/golang/glog v1.2.5 h1:DrW6hGnjIhtvhOIiAKT6Psh/Kd/ldepEa81DKeiRJ5I= +github.com/golang/glog v1.2.5/go.mod h1:6AhwSGph0fcJtXVM/PEHPqZlFeoLxhs7/t5UDAwmO+w= github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 h1:f+oWsMOmNPc8JmEHVZIycC7hBoQxHH9pNKQORJNozsQ= github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8/go.mod h1:wcDNUvekVysuuOpQKo3191zZyTpiI6se1N1ULghS0sw= github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek= @@ -183,8 +185,8 @@ github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 h1:w6OnO3d4j5yVf2vpm8OzXFC/xHOEGqt+9 github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1/go.mod h1:UyZyv7hz4knpFx6/Sh+SkZe6hT6sJHtDvw9A0TbvEsk= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.30.0 h1:nF0Y1F7fUGL6RYD9EAtHTdDbNFmDaA3xcEiRlvCDV5E= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.30.0/go.mod h1:BAWI9R3JEEGOp1JlXLPSZKwBGANSrPGUWKtMnS5w5qw= -github.com/pulumi/pulumi/sdk/v3 v3.234.0 h1:PoXVM2lJoyqavwPQlVQC6KzhGKNOJpz9OFxyojm8RjA= -github.com/pulumi/pulumi/sdk/v3 v3.234.0/go.mod h1:Eu9QVad1cSPymhTboINPqK6WZMaW7I0NHQcWOmxLYek= +github.com/pulumi/pulumi/sdk/v3 v3.235.0 h1:GoFZGHA2QHf+sX4x7Nok8ngremykvWC9sIvfQvLO/wM= +github.com/pulumi/pulumi/sdk/v3 v3.235.0/go.mod h1:ybUihqUfVF1ZXBH3JNunYsAMz2P6i+7v5gzoJ60sVp0= github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ= github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88= github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ= From 321337c8107580526da934ca46df29d1344ca6ca Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Thu, 7 May 2026 10:36:03 -0400 Subject: [PATCH 208/313] docs: add ToolHive Registry Server to community projects (#1261) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary - Add a new **Registry Implementations** section to `docs/community-projects.md` for self-hostable servers that implement the MCP Registry API spec. - Move existing **ToolSDK MCP Registry** entry from "Other" into the new section. - Add **ToolHive Registry Server** (https://github.com/stacklok/toolhive-registry-server) to the new section. ## Test plan - [x] `docs/community-projects.md` renders correctly (markdown only, no build step). 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.7 (1M context) --- docs/community-projects.md | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/docs/community-projects.md b/docs/community-projects.md index ef59bf5..b61c247 100644 --- a/docs/community-projects.md +++ b/docs/community-projects.md @@ -20,6 +20,13 @@ Browse the official MCP Registry in your browser! - [mcp-registry-spec-sdk](https://www.npmjs.com/package/mcp-registry-spec-sdk) - TypeScript client for the MCP Registry - [LangChain4j MCP Registry Java client](https://docs.langchain4j.dev/tutorials/mcp/#mcp-registry-client) - Java API +### Registry Implementations + +Self-hostable servers that implement the MCP Registry API specification. + +- [ToolSDK MCP Registry](https://github.com/toolsdk-ai/toolsdk-mcp-registry) - Extends the MCP Registry with **API-based MCP execution, private deployment**, and **secure sandbox isolation**. +- [ToolHive Registry Server](https://github.com/stacklok/toolhive-registry-server) - Enterprise-grade MCP Registry API implementation with Kubernetes-native CRD discovery, OIDC/JWT claim-based access control, multi-source aggregation (Git, K8s, upstream registries), SIEM-compliant audit logging, and OpenTelemetry observability. + ### Other - [MCP Registry Cheat Sheet](https://github.com/subbyte/mcp-registry-cheatsheet) - MCP Registry Cheat Sheet for MCP server developers, client developers, and registry admin @@ -28,7 +35,6 @@ Browse the official MCP Registry in your browser! - [mcp-insights](https://github.com/joelverhagen/mcp-insights/) - Analytics and insights for the MCP Registry - [mcp-registry-cli](https://pypi.org/project/mcp-registry-cli/) - CLI tool to navigate the MCP registry servers - [OtherVibes/mcp-publish-action](https://github.com/OtherVibes/mcp-publish-action) - GitHub Action for publishing MCP servers to the official registry -- [ToolSDK MCP Registry](https://github.com/toolsdk-ai/toolsdk-mcp-registry) - Extends the MCP Registry with **API-based MCP execution, private deployment**, and **secure sandbox isolation**. ## Adding Your Project From 718735cfbb1d9f998ce33e1a3d6e0c8a2e6dc58b Mon Sep 17 00:00:00 2001 From: Andrew Cunliffe Date: Thu, 7 May 2026 07:42:37 -0700 Subject: [PATCH 209/313] docs(authentication): note OpenSSL 3.x requirement for Ed25519 (#1253) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary The DNS and HTTP authentication guides currently run `openssl genpkey -algorithm Ed25519 -out key.pem` without caveat. macOS ships LibreSSL as the system `openssl` binary, and LibreSSL doesn't implement Ed25519 in `genpkey` — so the very first command in the Ed25519 codepath errors out with: ``` Algorithm Ed25519 not found ``` A first-time integrator on macOS hits this immediately, with no path to a fix from the docs alone. Cost me ~5 minutes earlier today before I figured out I needed `brew install openssl@3` and an explicit binary path. This PR adds a `` callout to the **DNS Authentication** section right above the Ed25519 codepath, and a shorter cross-reference Note in the **HTTP Authentication** section since the same `openssl genpkey -algorithm Ed25519` commands appear there. The ECDSA P-384 codepath works on LibreSSL, so it's untouched. ## Test plan - [x] Verified locally that `/opt/homebrew/opt/openssl@3/bin/openssl genpkey -algorithm Ed25519 -out key.pem` works on macOS Darwin 25.4.0 - [x] Verified the system `/usr/bin/openssl genpkey -algorithm Ed25519 -out key.pem` fails with `Algorithm Ed25519 not found` on the same machine (LibreSSL 3.3.6) - [x] Verified the published `ai.ravenmcp/raven-mcp` flow end-to-end with the OpenSSL 3 binary - [ ] Markdown rendering of the `` callouts — relying on the existing `` pattern in this file (line 6) to validate the syntax Co-authored-by: Radoslav Dimitrov --- docs/modelcontextprotocol-io/authentication.mdx | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/docs/modelcontextprotocol-io/authentication.mdx b/docs/modelcontextprotocol-io/authentication.mdx index f5af3ad..78bf23a 100644 --- a/docs/modelcontextprotocol-io/authentication.mdx +++ b/docs/modelcontextprotocol-io/authentication.mdx @@ -59,6 +59,10 @@ DNS authentication is a domain-based authentication method that relies on a DNS To perform DNS authentication using the `mcp-publisher` CLI tool, run the following commands in your server project directory to generate a TXT record based on a public/private key pair: + + The Ed25519 codepath requires **OpenSSL 3.0 or later**. macOS ships with LibreSSL by default (the system `openssl` binary), which does not implement Ed25519 in `genpkey` and fails with `Algorithm Ed25519 not found`. On macOS, install OpenSSL 3 (`brew install openssl@3`) and invoke it explicitly — for example, replace `openssl` with `/opt/homebrew/opt/openssl@3/bin/openssl` (Apple Silicon) or `/usr/local/opt/openssl@3/bin/openssl` (Intel) in the commands below. The ECDSA P-384 codepath works on LibreSSL. + + ```bash Ed25519 @@ -185,6 +189,10 @@ HTTP authentication is a domain-based authentication method that relies on a `/. To perform HTTP authentication using the `mcp-publisher` CLI tool, run the following commands in your server project directory to generate an `mcp-registry-auth` file based on a public/private key pair: + + As with DNS authentication, the Ed25519 codepath requires **OpenSSL 3.0 or later**. macOS's system LibreSSL does not support Ed25519 in `genpkey`. See the note in the [DNS Authentication](#dns-authentication) section for the macOS workaround. + + ```bash Ed25519 From f5fe2e97f65d5fa26997be7e567293f834f162fc Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Fri, 8 May 2026 07:33:10 -0400 Subject: [PATCH 210/313] build(deps): bump golang.org/x/net from v0.52.0 to v0.53.0 (#1269) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary Bumps `golang.org/x/net` from `v0.52.0` to `v0.53.0` to address `GO-2026-4918` (HTTP/2 transport infinite loop on bad `SETTINGS_MAX_FRAME_SIZE`). `go mod tidy` also pulls `golang.org/x/crypto` to v0.50.0 and `golang.org/x/text` to v0.36.0. ## Why now `govulncheck` is failing on `main` and every open Dependabot PR (#1263, #1264, #1265) after the 2026-05 Go security release. The findings split into: - **One we control** — `golang.org/x/net@v0.52.0` → fixed in `v0.53.0`. Addressed here. - **Six stdlib findings** (`GO-2026-4986`, `4982`, `4980`, `4977`, `4971`, and the stdlib half of `4918`) — all fixed in `go1.26.3`. We deliberately do **not** pin a Go patch in the workflow: `go-version: 'stable'` will pick up `1.26.3` automatically once the `actions/go-versions` manifest catches up, with no workflow maintenance. ## Test plan - [x] `go build ./...` - [x] `go vet ./...` - [x] `GOTOOLCHAIN=go1.26.3 govulncheck ./...` → "No vulnerabilities found." 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.7 (1M context) --- go.mod | 6 +++--- go.sum | 12 ++++++------ 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/go.mod b/go.mod index 9294010..7f97768 100644 --- a/go.mod +++ b/go.mod @@ -73,12 +73,12 @@ require ( go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect go.opentelemetry.io/otel/trace v1.43.0 // indirect go.yaml.in/yaml/v2 v2.4.4 // indirect - golang.org/x/crypto v0.49.0 // indirect - golang.org/x/net v0.52.0 // indirect + golang.org/x/crypto v0.50.0 // indirect + golang.org/x/net v0.53.0 // indirect golang.org/x/oauth2 v0.36.0 // indirect golang.org/x/sync v0.20.0 // indirect golang.org/x/sys v0.43.0 // indirect - golang.org/x/text v0.35.0 // indirect + golang.org/x/text v0.36.0 // indirect golang.org/x/time v0.15.0 // indirect google.golang.org/api v0.274.0 // indirect google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 // indirect diff --git a/go.sum b/go.sum index cb4f347..e7cb100 100644 --- a/go.sum +++ b/go.sum @@ -164,12 +164,12 @@ go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE= go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ= go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ= -golang.org/x/crypto v0.49.0 h1:+Ng2ULVvLHnJ/ZFEq4KdcDd/cfjrrjjNSXNzxg0Y4U4= -golang.org/x/crypto v0.49.0/go.mod h1:ErX4dUh2UM+CFYiXZRTcMpEcN8b/1gxEuv3nODoYtCA= +golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI= +golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q= golang.org/x/mod v0.35.0 h1:Ww1D637e6Pg+Zb2KrWfHQUnH2dQRLBQyAtpr/haaJeM= golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU= -golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0= -golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw= +golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA= +golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs= golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4= @@ -177,8 +177,8 @@ golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI= golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= -golang.org/x/text v0.35.0 h1:JOVx6vVDFokkpaq1AEptVzLTpDe9KGpj5tR4/X+ybL8= -golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA= +golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg= +golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164= golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U= golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno= gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4= From d93f8f78a0d78439ed433d1053982fa100c50632 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 8 May 2026 07:56:59 -0400 Subject: [PATCH 211/313] build(deps): bump cloud.google.com/go/kms from 1.30.0 to 1.31.0 (#1263) Bumps [cloud.google.com/go/kms](https://github.com/googleapis/google-cloud-go) from 1.30.0 to 1.31.0.
    Release notes

    Sourced from cloud.google.com/go/kms's releases.

    kms: v1.31.0

    v1.31.0 (2026-05-07)

    retail: v1.31.0

    v1.31.0 (2026-05-07)

    Changelog

    Sourced from cloud.google.com/go/kms's changelog.

    1.31.0 (2024-08-01)

    Features

    • documentai: A new field imageless_mode is added to message .google.cloud.documentai.v1.ProcessRequest (#10615) (97fa560)

    Documentation

    • documentai: Keep the API doc up-to-date with recent changes (97fa560)

    1.30.5 (2024-07-24)

    Bug Fixes

    • documentai: Update dependencies (257c40b)

    1.30.4 (2024-07-10)

    Bug Fixes

    • documentai: Bump google.golang.org/grpc@v1.64.1 (8ecc4e9)

    1.30.3 (2024-07-01)

    Bug Fixes

    • documentai: Bump google.golang.org/api@v0.187.0 (8fa9e39)

    1.30.2 (2024-06-26)

    Bug Fixes

    • documentai: Enable new auth lib (b95805f)

    1.30.1 (2024-06-20)

    Documentation

    • documentai: Update the comment to add a note about documentai.processors.create permission (4fa4308)
    Commits
    • 9a44b31 chore: librarian release pull request: 20260409T070606Z (#14406)
    • 18a3318 feat: Make AgentEngine APIs public
    • db45f2d feat(bigtable): enable bigtable conn pool by default (#14319)
    • 124ffd3 feat(vertexai): Add AgentEngine Memories Revisions module
    • e247d48 chore: onboard new library appoptimize (#14393)
    • ece84ab chore: update librarian to v0.10.1-0.20260408193841-095ea7e727aa (#14392)
    • ecf9783 chore: librarian release pull request: 20260408T191440Z (#14390)
    • 70b47d2 chore: librarian release pull request: 20260408T190447Z (#14389)
    • 95c53a6 chore(bigquery): bump api to v0.275.0 and unskip bq tracing tests (#14333)
    • df22e9e fix(storage): add retry logic for "http2: client connection lost" (#14385)
    • Additional commits viewable in compare view

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=cloud.google.com/go/kms&package-manager=go_modules&previous-version=1.30.0&new-version=1.31.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Radoslav Dimitrov --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 7f97768..558ebd8 100644 --- a/go.mod +++ b/go.mod @@ -3,7 +3,7 @@ module github.com/modelcontextprotocol/registry go 1.26 require ( - cloud.google.com/go/kms v1.30.0 + cloud.google.com/go/kms v1.31.0 github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.4.0 github.com/caarlos0/env/v11 v11.4.1 diff --git a/go.sum b/go.sum index e7cb100..cc6c8e6 100644 --- a/go.sum +++ b/go.sum @@ -8,8 +8,8 @@ cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdB cloud.google.com/go/compute/metadata v0.9.0/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10= cloud.google.com/go/iam v1.7.0 h1:JD3zh0C6LHl16aCn5Akff0+GELdp1+4hmh6ndoFLl8U= cloud.google.com/go/iam v1.7.0/go.mod h1:tetWZW1PD/m6vcuY2Zj/aU0eCHNPuxedbnbRTyKXvdY= -cloud.google.com/go/kms v1.30.0 h1:TSEZopy/OXojbVCQS9Rrx0jFqdKWvO31+N8ncXbxG/s= -cloud.google.com/go/kms v1.30.0/go.mod h1:YIyXZym11R5uovJJt4oN5eUL3oPmirF3yKeIh6QAf4U= +cloud.google.com/go/kms v1.31.0 h1:LS8N92OxFDgOLg5NCo3OmbvjtQAIVT5gUHVLKIDHaFE= +cloud.google.com/go/kms v1.31.0/go.mod h1:YIyXZym11R5uovJJt4oN5eUL3oPmirF3yKeIh6QAf4U= cloud.google.com/go/longrunning v0.9.0 h1:0EzbDEGsAvOZNbqXopgniY0w0a1phvu5IdUFq8grmqY= cloud.google.com/go/longrunning v0.9.0/go.mod h1:pkTz846W7bF4o2SzdWJ40Hu0Re+UoNT6Q5t+igIcb8E= github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0 h1:JXg2dwJUmPB9JmtVmdEB16APJ7jurfbY5jnfXpJoRMc= From 8af641cf1cc0449557769c6f7b987523fe09049d Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 8 May 2026 07:57:18 -0400 Subject: [PATCH 212/313] build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.235.0 to 3.236.0 in /deploy (#1264) Bumps [github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from 3.235.0 to 3.236.0.
    Release notes

    Sourced from github.com/pulumi/pulumi/sdk/v3's releases.

    v3.236.0

    3.236.0 (2026-05-06)

    Changelog

    Sourced from github.com/pulumi/pulumi/sdk/v3's changelog.

    3.236.0 (2026-05-06)

    Commits

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/pulumi/pulumi/sdk/v3&package-manager=go_modules&previous-version=3.235.0&new-version=3.236.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Radoslav Dimitrov --- deploy/go.mod | 2 +- deploy/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index 9ca00fe..64f31cf 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -5,7 +5,7 @@ go 1.26 require ( github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.30.0 - github.com/pulumi/pulumi/sdk/v3 v3.235.0 + github.com/pulumi/pulumi/sdk/v3 v3.236.0 gopkg.in/yaml.v2 v2.4.0 ) diff --git a/deploy/go.sum b/deploy/go.sum index fe7076d..150ed1a 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -185,8 +185,8 @@ github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 h1:w6OnO3d4j5yVf2vpm8OzXFC/xHOEGqt+9 github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1/go.mod h1:UyZyv7hz4knpFx6/Sh+SkZe6hT6sJHtDvw9A0TbvEsk= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.30.0 h1:nF0Y1F7fUGL6RYD9EAtHTdDbNFmDaA3xcEiRlvCDV5E= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.30.0/go.mod h1:BAWI9R3JEEGOp1JlXLPSZKwBGANSrPGUWKtMnS5w5qw= -github.com/pulumi/pulumi/sdk/v3 v3.235.0 h1:GoFZGHA2QHf+sX4x7Nok8ngremykvWC9sIvfQvLO/wM= -github.com/pulumi/pulumi/sdk/v3 v3.235.0/go.mod h1:ybUihqUfVF1ZXBH3JNunYsAMz2P6i+7v5gzoJ60sVp0= +github.com/pulumi/pulumi/sdk/v3 v3.236.0 h1:vX+0ZCmylokASSKRqvx8ryRnLeFl87xqh3l5cKAI4Ko= +github.com/pulumi/pulumi/sdk/v3 v3.236.0/go.mod h1:ybUihqUfVF1ZXBH3JNunYsAMz2P6i+7v5gzoJ60sVp0= github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ= github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88= github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ= From fe0cb3bfcb425d0d944a89d0f17c722ef22d922b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 8 May 2026 07:57:35 -0400 Subject: [PATCH 213/313] build(deps): bump sigstore/cosign-installer from 4.1.1 to 4.1.2 in the actions group (#1265) Bumps the actions group with 1 update: [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer). Updates `sigstore/cosign-installer` from 4.1.1 to 4.1.2
    Release notes

    Sourced from sigstore/cosign-installer's releases.

    v4.1.2

    What's Changed

    Commits

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=sigstore/cosign-installer&package-manager=github_actions&previous-version=4.1.1&new-version=4.1.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Radoslav Dimitrov --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 7b248f2..1f51d3b 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -25,7 +25,7 @@ jobs: cache: true - name: Install cosign - uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1 + uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 - name: Install Syft uses: anchore/sbom-action/download-syft@v0.24.0 From 7bc506f24598c611d566a21c2a0b77f423e5ded1 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 11 May 2026 05:10:33 -0400 Subject: [PATCH 214/313] build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.236.0 to 3.237.0 in /deploy (#1272) Bumps [github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from 3.236.0 to 3.237.0.
    Release notes

    Sourced from github.com/pulumi/pulumi/sdk/v3's releases.

    v3.237.0

    3.237.0 (2026-05-08)

    Features

    • [cli] Include the running command name and detected AI agent (when present) in the User-Agent header on Pulumi Cloud API requests #22908

    • [engine] Include result on the summary engine event #22883

    • [sdkgen] Eagerly error on schemas with unconstructable types #22890

    • [cli/cloud] Auto-fill lang and os query parameters on pulumi cloud api GET/HEAD requests when the matched OpenAPI operation declares them and the caller hasn't supplied them #22726

    • [cli/package] Add pulumi package new to bootstrap a Pulumi package from a template #22837

    Bug Fixes

    • [cli] Add blank-line gaps between pulumi neo TUI conversation blocks #22846

    • [cli/import] Preserve __-prefixed keys when generating PCL for imported resource state, so provider-defined payloads round-trip correctly #22856

    • [cli/neo] Render ux__ask_user clarifying questions as questions instead of approval prompts #22862

    • [cli/neo] Fix a panic when cancelling a pulumi neo session #22898

    • [cli/neo] Render every assistant message in the TUI scrollback so multi-turn commentary no longer disappears between tool calls

    • [cli/neo] Return the bare stack name and canonical project name from pulumi_preview and pulumi_up tool results instead of echoing the raw input #22891

    • [codegen/pcl] Stop reporting spurious circular references when an ignoreChanges, hideDiffs, replaceOnChanges, or additionalSecretOutputs entry shares a name with a top-level node #22916

    • [programgen/pcl] Fix PCL binder panic when a conditional mixes a Promise-typed branch with a try() branch #22907

    • [sdk/python] Support NotRequired, Required and total=False in TypedDicts for component resource arg types #22858

    ... (truncated)

    Changelog

    Sourced from github.com/pulumi/pulumi/sdk/v3's changelog.

    3.237.0 (2026-05-08)

    Features

    • [cli] Include the running command name and detected AI agent (when present) in the User-Agent header on Pulumi Cloud API requests #22908

    • [engine] Include result on the summary engine event #22883

    • [sdkgen] Eagerly error on schemas with unconstructable types #22890

    • [cli/cloud] Auto-fill lang and os query parameters on pulumi cloud api GET/HEAD requests when the matched OpenAPI operation declares them and the caller hasn't supplied them #22726

    • [cli/package] Add pulumi package new to bootstrap a Pulumi package from a template #22837

    Bug Fixes

    • [cli] Add blank-line gaps between pulumi neo TUI conversation blocks #22846

    • [cli/import] Preserve __-prefixed keys when generating PCL for imported resource state, so provider-defined payloads round-trip correctly #22856

    • [cli/neo] Render ux__ask_user clarifying questions as questions instead of approval prompts #22862

    • [cli/neo] Fix a panic when cancelling a pulumi neo session #22898

    • [cli/neo] Render every assistant message in the TUI scrollback so multi-turn commentary no longer disappears between tool calls

    • [cli/neo] Return the bare stack name and canonical project name from pulumi_preview and pulumi_up tool results instead of echoing the raw input #22891

    • [codegen/pcl] Stop reporting spurious circular references when an ignoreChanges, hideDiffs, replaceOnChanges, or additionalSecretOutputs entry shares a name with a top-level node #22916

    • [programgen/pcl] Fix PCL binder panic when a conditional mixes a Promise-typed branch with a try() branch #22907

    • [sdk/python] Support NotRequired, Required and total=False in TypedDicts for component resource arg types #22858

    ... (truncated)

    Commits
    • dc35aff only don't run CI if changelog/config.yaml changes (#22937)
    • a38b7dc cli/neo: keep prior streaming text when the agent emits a new turn (#22897)
    • 6d84bb5 add continue-on-error to upload code coverage and upload codecov test results...
    • 8377d12 Eagerly error on schemas with unconstructable types (#22890)
    • 9d209a0 bump java and yaml dependencies (#22932)
    • dd82f69 LocalWorkspace.nested_config: use a new stack per test (#22926)
    • c518056 Fix flaky TestFuzz: targeted update with refresh + deleted parent (#22925)
    • 46486da Thread workspace.Context to ProviderFromSource (#22880)
    • ad42ef3 increase nodejs automation API timeout (#22920)
    • 0b8a78b Test on Node.js 26 and drop 20 (#22872)
    • Additional commits viewable in compare view

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/pulumi/pulumi/sdk/v3&package-manager=go_modules&previous-version=3.236.0&new-version=3.237.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- deploy/go.mod | 2 +- deploy/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index 64f31cf..a4c3090 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -5,7 +5,7 @@ go 1.26 require ( github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.30.0 - github.com/pulumi/pulumi/sdk/v3 v3.236.0 + github.com/pulumi/pulumi/sdk/v3 v3.237.0 gopkg.in/yaml.v2 v2.4.0 ) diff --git a/deploy/go.sum b/deploy/go.sum index 150ed1a..eac6818 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -185,8 +185,8 @@ github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 h1:w6OnO3d4j5yVf2vpm8OzXFC/xHOEGqt+9 github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1/go.mod h1:UyZyv7hz4knpFx6/Sh+SkZe6hT6sJHtDvw9A0TbvEsk= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.30.0 h1:nF0Y1F7fUGL6RYD9EAtHTdDbNFmDaA3xcEiRlvCDV5E= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.30.0/go.mod h1:BAWI9R3JEEGOp1JlXLPSZKwBGANSrPGUWKtMnS5w5qw= -github.com/pulumi/pulumi/sdk/v3 v3.236.0 h1:vX+0ZCmylokASSKRqvx8ryRnLeFl87xqh3l5cKAI4Ko= -github.com/pulumi/pulumi/sdk/v3 v3.236.0/go.mod h1:ybUihqUfVF1ZXBH3JNunYsAMz2P6i+7v5gzoJ60sVp0= +github.com/pulumi/pulumi/sdk/v3 v3.237.0 h1:D0kx4fkUkiZWfreQg1ekeAifLJEC2+VRYzgboQClg9Q= +github.com/pulumi/pulumi/sdk/v3 v3.237.0/go.mod h1:ybUihqUfVF1ZXBH3JNunYsAMz2P6i+7v5gzoJ60sVp0= github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ= github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88= github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ= From 1d3680696025dc9d7dcccb464aca72a1b31d304d Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 11 May 2026 05:10:51 -0400 Subject: [PATCH 215/313] build(deps): bump golang.org/x/mod from 0.35.0 to 0.36.0 (#1271) Bumps [golang.org/x/mod](https://github.com/golang/mod) from 0.35.0 to 0.36.0.
    Commits
    • 643da9b go.mod: update golang.org/x dependencies
    • ccc3cdf zip: include 'but content has correct sum' note in TestVCS
    • ab30318 zip: update zip hashes for new flate compression
    • See full diff in compare view

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=golang.org/x/mod&package-manager=go_modules&previous-version=0.35.0&new-version=0.36.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 558ebd8..247ffc7 100644 --- a/go.mod +++ b/go.mod @@ -22,7 +22,7 @@ require ( go.opentelemetry.io/otel/metric v1.43.0 go.opentelemetry.io/otel/sdk v1.43.0 go.opentelemetry.io/otel/sdk/metric v1.43.0 - golang.org/x/mod v0.35.0 + golang.org/x/mod v0.36.0 gopkg.in/yaml.v3 v3.0.1 ) diff --git a/go.sum b/go.sum index cc6c8e6..1a65b0f 100644 --- a/go.sum +++ b/go.sum @@ -166,8 +166,8 @@ go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ= go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ= golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI= golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q= -golang.org/x/mod v0.35.0 h1:Ww1D637e6Pg+Zb2KrWfHQUnH2dQRLBQyAtpr/haaJeM= -golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU= +golang.org/x/mod v0.36.0 h1:JJjpVx6myfUsUdAzZuOSTTmRE0PfZeNWzzvKrP7amb4= +golang.org/x/mod v0.36.0/go.mod h1:moc6ELqsWcOw5Ef3xVprK5ul/MvtVvkIXLziUOICjUQ= golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA= golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs= golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= From 276037b1ad877fa2990c2aed5bafb90a737da9d6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?d=20=F0=9F=94=B9?= Date: Mon, 11 May 2026 21:01:52 +0800 Subject: [PATCH 216/313] docs(complete): align publish CLI flags with implementation (closes #767) (#1278) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary `complete.md` documents three flags for `mcp-publisher publish` that the CLI does not actually parse: - `--file=PATH` — Path to server.json - `--registry=URL` — Registry URL override - `--dry-run` — Validate without publishing Reading [`cmd/publisher/commands/publish.go`](https://github.com/modelcontextprotocol/registry/blob/main/cmd/publisher/commands/publish.go) and [`cmd/publisher/main.go`](https://github.com/modelcontextprotocol/registry/blob/main/cmd/publisher/main.go) confirms the actual interface is a single positional `PATH` argument (default `./server.json`): ```go serverFile := \"server.json\" if len(args) > 0 && !strings.HasPrefix(args[0], \"-\") { serverFile = args[0] } ``` Registry URL is bound at login time via the saved token, and \"validate without publishing\" is a separate `mcp-publisher validate` subcommand. The bug user in #767 hit \"server.json not found\" precisely because `--file .registry/server.json` is filtered out by the `HasPrefix(args[0], \"-\")` check, leaving the default lookup in place. ## Background The canonical reference at [`docs/reference/cli/commands.md`](https://github.com/modelcontextprotocol/registry/blob/main/docs/reference/cli/commands.md) was already updated to the correct positional shape. `complete.md` (the concatenated single-file mirror of `docs/` used for LLM/quickstart consumption) had drifted out of sync — these were the only remaining `--file` references in the repo outside of test fixtures. Per the discussion on the prior flag-implementation attempt in #771, maintainers preferred fixing the documentation over adding the unimplemented flags: > @domdomegg: I'd lean towards removing the options from the docs. This PR closes that loop on the last stale doc surface. ## Changes `complete.md`: the `mcp-publisher publish` block now matches `docs/reference/cli/commands.md` line-for-line (positional `PATH`, no spurious flags, no dry-run example). ```diff -mcp-publisher publish [options] +mcp-publisher publish [PATH] -- \`--file=PATH\` - Path to server.json (default: \`./server.json\`) -- \`--registry=URL\` - Registry URL override -- \`--dry-run\` - Validate without publishing +- \`PATH\` - Path to server.json (default: \`./server.json\`) -# Dry run validation -mcp-publisher publish --dry-run - # Custom file location -mcp-publisher publish --file=./config/server.json +mcp-publisher publish ./config/server.json ``` Closes #767. ## Out of scope - `cmd/publisher/README.md:17` still shows `./bin/mcp-publisher publish --registry=http://localhost:8080` in the contributor quickstart. The flag is silently ignored at runtime (caught by the same `HasPrefix(\"-\")` filter). Happy to fold that fix into this PR or send a follow-up — flagging here in case a maintainer prefers one option. - `complete.md` is missing `mcp-publisher validate` and `mcp-publisher status` sections that exist in `docs/reference/cli/commands.md`. Out of scope for this single-concern PR; if there's interest, a broader sync would be a separate PR. ## Test plan - [x] `grep -r -- '--file' .` outside test fixtures returns 0 hits after the change - [x] `grep -r 'mcp-publisher publish --' docs/ complete.md` shows only legitimate flags (`--registry` on `login`) - [x] No code changes — `make check` not exercised since this is doc-only 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: d 🔹 <258577966+voidborne-d@users.noreply.github.com> Co-authored-by: Claude Opus 4.7 (1M context) --- complete.md | 18 +++++++----------- 1 file changed, 7 insertions(+), 11 deletions(-) diff --git a/complete.md b/complete.md index 2355e4b..e9040fa 100644 --- a/complete.md +++ b/complete.md @@ -1991,30 +1991,26 @@ For detailed guidance on the publishing process, see the [publishing guide](../. **Usage:** ```bash -mcp-publisher publish [options] +mcp-publisher publish [PATH] ``` **Options:** -- `--file=PATH` - Path to server.json (default: `./server.json`) -- `--registry=URL` - Registry URL override -- `--dry-run` - Validate without publishing +- `PATH` - Path to server.json (default: `./server.json`) **Process:** 1. Validates `server.json` against schema -2. Verifies package ownership (see [Official Registry Requirements](../server-json/official-registry-requirements.md)) -3. Checks namespace authentication -4. Publishes to registry +2. Publishes the `server.json` to the registry server URL specified in the login token +3. Server: Verifies package ownership (see [Official Registry Requirements](../server-json/official-registry-requirements.md)) +4. Server: Checks namespace authentication +5. Server: Publishes to registry **Example:** ```bash # Basic publish mcp-publisher publish -# Dry run validation -mcp-publisher publish --dry-run - # Custom file location -mcp-publisher publish --file=./config/server.json +mcp-publisher publish ./config/server.json ``` ### `mcp-publisher logout` From 4e319e81ff006a4f1a06b9fb4ceb00c39f52e58b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 12 May 2026 07:21:18 -0400 Subject: [PATCH 217/313] build(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to 5.19.0 in /deploy (#1279) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.18.0 to 5.19.0.
    Release notes

    Sourced from github.com/go-git/go-git/v5's releases.

    v5.19.0

    What's Changed

    Full Changelog: https://github.com/go-git/go-git/compare/v5.18.0...v5.19.0

    Commits
    • bc930f4 Merge pull request #2065 from go-git/commit-v5
    • d315264 plumbing: object, Reset object before decode
    • 6e1d348 plumbing: object, Align Tree handling with upstream
    • e134ba3 tests: Skip double checks in Git v2.11
    • 1971422 tests: Add git conformance tests for signing verification
    • a387aa8 plumbing: object, Add ErrMalformedTag
    • f415670 plumbing: object, Decode Tag headers via a state machine
    • 5b0cd38 plumbing: object, Reject multi-signature commits at Verify
    • fe8ed62 plumbing: object, Align Tag.EncodeWithoutSignature with Commit
    • 98e337d plumbing: object, Add support for Tag.SignatureSHA256
    • Additional commits viewable in compare view

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/go-git/go-git/v5&package-manager=go_modules&previous-version=5.18.0&new-version=5.19.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/modelcontextprotocol/registry/network/alerts).
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- deploy/go.mod | 25 +++++++++++++------------ deploy/go.sum | 50 ++++++++++++++++++++++++++------------------------ 2 files changed, 39 insertions(+), 36 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index a4c3090..ecd0260 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -32,13 +32,13 @@ require ( github.com/clipperhouse/displaywidth v0.11.0 // indirect github.com/clipperhouse/uax29/v2 v2.7.0 // indirect github.com/cloudflare/circl v1.6.3 // indirect - github.com/cyphar/filepath-securejoin v0.4.1 // indirect + github.com/cyphar/filepath-securejoin v0.6.1 // indirect github.com/djherbis/times v1.5.0 // indirect github.com/emirpasic/gods v1.18.1 // indirect github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect - github.com/go-git/go-billy/v5 v5.8.0 // indirect - github.com/go-git/go-git/v5 v5.18.0 // indirect + github.com/go-git/go-billy/v5 v5.9.0 // indirect + github.com/go-git/go-git/v5 v5.19.0 // indirect github.com/go-logr/logr v1.4.3 // indirect github.com/go-logr/stdr v1.2.2 // indirect github.com/gogo/protobuf v1.3.2 // indirect @@ -56,6 +56,7 @@ require ( github.com/json-iterator/go v1.1.12 // indirect github.com/kevinburke/ssh_config v1.2.0 // indirect github.com/klauspost/compress v1.18.0 // indirect + github.com/klauspost/cpuid/v2 v2.3.0 // indirect github.com/lucasb-eyer/go-colorful v1.3.0 // indirect github.com/mattn/go-isatty v0.0.20 // indirect github.com/mattn/go-localereader v0.0.1 // indirect @@ -70,7 +71,7 @@ require ( github.com/opentracing/basictracer-go v1.1.0 // indirect github.com/opentracing/opentracing-go v1.2.0 // indirect github.com/pgavlin/fx v0.1.6 // indirect - github.com/pjbgf/sha1cd v0.3.2 // indirect + github.com/pjbgf/sha1cd v0.6.0 // indirect github.com/pkg/errors v0.9.1 // indirect github.com/pkg/term v1.1.0 // indirect github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231 // indirect @@ -101,15 +102,15 @@ require ( go.opentelemetry.io/proto/otlp v1.10.0 // indirect go.uber.org/atomic v1.11.0 // indirect go.uber.org/multierr v1.11.0 // indirect - golang.org/x/crypto v0.49.0 // indirect - golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 // indirect - golang.org/x/mod v0.33.0 // indirect - golang.org/x/net v0.52.0 // indirect + golang.org/x/crypto v0.50.0 // indirect + golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f // indirect + golang.org/x/mod v0.35.0 // indirect + golang.org/x/net v0.53.0 // indirect golang.org/x/sync v0.20.0 // indirect - golang.org/x/sys v0.42.0 // indirect - golang.org/x/term v0.41.0 // indirect - golang.org/x/text v0.35.0 // indirect - golang.org/x/tools v0.42.0 // indirect + golang.org/x/sys v0.43.0 // indirect + golang.org/x/term v0.42.0 // indirect + golang.org/x/text v0.36.0 // indirect + golang.org/x/tools v0.44.0 // indirect google.golang.org/genproto/googleapis/api v0.0.0-20260311181403-84a4fc48630c // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20260311181403-84a4fc48630c // indirect google.golang.org/grpc v1.80.0 // indirect diff --git a/deploy/go.sum b/deploy/go.sum index eac6818..8d59fda 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -50,8 +50,8 @@ github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJ github.com/cloudflare/circl v1.6.3 h1:9GPOhQGF9MCYUeXyMYlqTR6a5gTrgR/fBLXvUgtVcg8= github.com/cloudflare/circl v1.6.3/go.mod h1:2eXP6Qfat4O/Yhh8BznvKnJ+uzEoTQ6jVKJRn81BiS4= github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g= -github.com/cyphar/filepath-securejoin v0.4.1 h1:JyxxyPEaktOD+GAnqIqTf9A8tHyAG22rowi7HkoSU1s= -github.com/cyphar/filepath-securejoin v0.4.1/go.mod h1:Sdj7gXlvMcPZsbhwhQ33GguGLDGQL7h7bg04C/+u9jI= +github.com/cyphar/filepath-securejoin v0.6.1 h1:5CeZ1jPXEiYt3+Z6zqprSAgSWiggmpVyciv8syjIpVE= +github.com/cyphar/filepath-securejoin v0.6.1/go.mod h1:A8hd4EnAeyujCJRrICiOWqjS1AX0a9kM5XL+NwKoYSc= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= @@ -70,12 +70,12 @@ github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c= github.com/gliderlabs/ssh v0.3.8/go.mod h1:xYoytBv1sV0aL3CavoDuJIQNURXkkfPA/wxQ1pL1fAU= github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI= github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376/go.mod h1:an3vInlBmSxCcxctByoQdvwPiA7DTK7jaaFDBTtu0ic= -github.com/go-git/go-billy/v5 v5.8.0 h1:I8hjc3LbBlXTtVuFNJuwYuMiHvQJDq1AT6u4DwDzZG0= -github.com/go-git/go-billy/v5 v5.8.0/go.mod h1:RpvI/rw4Vr5QA+Z60c6d6LXH0rYJo0uD5SqfmrrheCY= +github.com/go-git/go-billy/v5 v5.9.0 h1:jItGXszUDRtR/AlferWPTMN4j38BQ88XnXKbilmmBPA= +github.com/go-git/go-billy/v5 v5.9.0/go.mod h1:jCnQMLj9eUgGU7+ludSTYoZL/GGmii14RxKFj7ROgHw= github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4= github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII= -github.com/go-git/go-git/v5 v5.18.0 h1:O831KI+0PR51hM2kep6T8k+w0/LIAD490gvqMCvL5hM= -github.com/go-git/go-git/v5 v5.18.0/go.mod h1:pW/VmeqkanRFqR6AljLcs7EA7FbZaN5MQqO7oZADXpo= +github.com/go-git/go-git/v5 v5.19.0 h1:+WkVUQZSy/F1Gb13udrMKjIM2PrzsNfDKFSfo5tkMtc= +github.com/go-git/go-git/v5 v5.19.0/go.mod h1:Pb1v0c7/g8aGQJwx9Us09W85yGoyvSwuhEGMH7zjDKQ= github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= @@ -121,6 +121,8 @@ github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo= github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ= +github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y= +github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0= github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= @@ -169,8 +171,8 @@ github.com/pgavlin/fx v0.1.6 h1:r9jEg69DhNoCd3Xh0+5mIbdbS3PqWrVWujkY76MFRTU= github.com/pgavlin/fx v0.1.6/go.mod h1:KWZJ6fqBBSh8GxHYqwYCf3rYE7Gp2p0N8tJp8xv9u9M= github.com/pgavlin/fx/v2 v2.0.12 h1:SjjaJ68Dt8Z4zHwOpY/RPijd7lShs6xYupJbF9ra00M= github.com/pgavlin/fx/v2 v2.0.12/go.mod h1:M/nF/ooAOy+NUBooYYXl2REARzJ/giPJxfMs8fINfKc= -github.com/pjbgf/sha1cd v0.3.2 h1:a9wb0bp1oC2TGwStyn0Umc/IGKQnEgF0vVaZ8QF8eo4= -github.com/pjbgf/sha1cd v0.3.2/go.mod h1:zQWigSxVmsHEZow5qaLtPYxpcKMMQpa09ixqBxuCS6A= +github.com/pjbgf/sha1cd v0.6.0 h1:3WJ8Wz8gvDz29quX1OcEmkAlUg9diU4GxJHqs0/XiwU= +github.com/pjbgf/sha1cd v0.6.0/go.mod h1:lhpGlyHLpQZoxMv8HcgXvZEhcGs0PG/vsZnEJ7H0iCM= github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4= github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= github.com/pkg/term v1.1.0 h1:xIAAdCMh3QIAy+5FrE8Ad8XoDhEU4ufwbaSozViP9kk= @@ -270,24 +272,24 @@ golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACk golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4= -golang.org/x/crypto v0.49.0 h1:+Ng2ULVvLHnJ/ZFEq4KdcDd/cfjrrjjNSXNzxg0Y4U4= -golang.org/x/crypto v0.49.0/go.mod h1:ErX4dUh2UM+CFYiXZRTcMpEcN8b/1gxEuv3nODoYtCA= -golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 h1:2dVuKD2vS7b0QIHQbpyTISPd0LeHDbnYEryqj5Q1ug8= -golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56/go.mod h1:M4RDyNAINzryxdtnbRXRL/OHtkFuWGRjvuhBJpk2IlY= +golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI= +golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q= +golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJkhzJCK5J6kUi1NTVXfM= +golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f/go.mod h1:J1xhfL/vlindoeF/aINzNzt2Bket5bjo9sdOYzOsU80= golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY= golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg= golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= -golang.org/x/mod v0.33.0 h1:tHFzIWbBifEmbwtGz65eaWyGiGZatSrT9prnU8DbVL8= -golang.org/x/mod v0.33.0/go.mod h1:swjeQEj+6r7fODbD2cqrnje9PnziFuw4bmLbBZFrQ5w= +golang.org/x/mod v0.35.0 h1:Ww1D637e6Pg+Zb2KrWfHQUnH2dQRLBQyAtpr/haaJeM= +golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU= golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20200421231249-e086a090c8fd/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A= golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= -golang.org/x/net v0.52.0 h1:He/TN1l0e4mmR3QqHMT2Xab3Aj3L9qjbhRm78/6jrW0= -golang.org/x/net v0.52.0/go.mod h1:R1MAz7uMZxVMualyPXb+VaqGSa3LIaUqk0eEt3w36Sw= +golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA= +golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= @@ -307,24 +309,24 @@ golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBc golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo= -golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= +golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI= +golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= -golang.org/x/term v0.41.0 h1:QCgPso/Q3RTJx2Th4bDLqML4W6iJiaXFq2/ftQF13YU= -golang.org/x/term v0.41.0/go.mod h1:3pfBgksrReYfZ5lvYM0kSO0LIkAl4Yl2bXOkKP7Ec2A= +golang.org/x/term v0.42.0 h1:UiKe+zDFmJobeJ5ggPwOshJIVt6/Ft0rcfrXZDLWAWY= +golang.org/x/term v0.42.0/go.mod h1:Dq/D+snpsbazcBG5+F9Q1n2rXV8Ma+71xEjTRufARgY= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= -golang.org/x/text v0.35.0 h1:JOVx6vVDFokkpaq1AEptVzLTpDe9KGpj5tR4/X+ybL8= -golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA= +golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg= +golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20181030221726-6c7e314b6563/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28= golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE= golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA= -golang.org/x/tools v0.42.0 h1:uNgphsn75Tdz5Ji2q36v/nsFSfR/9BRFvqhGBaJGd5k= -golang.org/x/tools v0.42.0/go.mod h1:Ma6lCIwGZvHK6XtgbswSoWroEkhugApmsXyrUmBhfr0= +golang.org/x/tools v0.44.0 h1:UP4ajHPIcuMjT1GqzDWRlalUEoY+uzoZKnhOjbIPD2c= +golang.org/x/tools v0.44.0/go.mod h1:KA0AfVErSdxRZIsOVipbv3rQhVXTnlU6UhKxHd1seDI= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= From 35b20719ee7714ad18d0f81af6798ac0a46e2b9b Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Tue, 12 May 2026 16:59:59 -0400 Subject: [PATCH 218/313] fix(validators/oci): fail closed on upstream rate limiting (#1281) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary When the OCI validator's anonymous manifest fetch returns HTTP 429, return a retryable error instead of `nil`. This aligns OCI with the fail-closed behavior of the npm / PyPI / NuGet / MCPB validators, and ensures the `io.modelcontextprotocol.server.name` label-match always runs before a publish is accepted. ## Test plan - [x] `go test ./internal/validators/registries/ -run TestValidateOCI` passes locally - [x] `gofmt` + `golangci-lint` clean on the changed file - [ ] CI green 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.7 (1M context) --- internal/validators/registries/oci.go | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/internal/validators/registries/oci.go b/internal/validators/registries/oci.go index d4ab56c..f303267 100644 --- a/internal/validators/registries/oci.go +++ b/internal/validators/registries/oci.go @@ -4,7 +4,6 @@ import ( "context" "errors" "fmt" - "log" "net/http" "strings" "time" @@ -106,10 +105,13 @@ func ValidateOCI(ctx context.Context, pkg model.Package, serverName string) erro if errors.As(err, &transportErr) { switch transportErr.StatusCode { case http.StatusTooManyRequests: - // Rate limited - skip validation to avoid blocking publishers - // This is intentional: we prioritize UX over strict validation during high traffic - log.Printf("Skipping OCI validation for %s due to rate limiting", pkg.Identifier) - return nil + // Fail closed: a 429 means we could not verify the + // `io.modelcontextprotocol.server.name` label on the image, which is + // the only ownership proof we apply to OCI packages. Returning nil + // here would let a publisher bind their server record to an arbitrary + // public image they do not control, which is the bug this branch + // used to have. Surface the rate-limit as a retryable error instead. + return fmt.Errorf("OCI registry is currently rate-limiting validations for '%s'; please retry shortly", pkg.Identifier) case http.StatusNotFound: return fmt.Errorf("OCI image '%s' does not exist in the registry", pkg.Identifier) case http.StatusUnauthorized, http.StatusForbidden: From 4f75308d176a7b7a803238388506d64b24571b00 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Tue, 12 May 2026 17:08:24 -0400 Subject: [PATCH 219/313] deploy: update prod to v1.7.9 (#1282) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Promotes [v1.7.9](https://github.com/modelcontextprotocol/registry/releases/tag/v1.7.9) to production. Includes the OCI validator fail-closed fix from #1281. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.7 (1M context) --- deploy/Pulumi.gcpProd.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/deploy/Pulumi.gcpProd.yaml b/deploy/Pulumi.gcpProd.yaml index f4ce516..f222920 100644 --- a/deploy/Pulumi.gcpProd.yaml +++ b/deploy/Pulumi.gcpProd.yaml @@ -1,7 +1,7 @@ config: mcp-registry:environment: prod mcp-registry:provider: gcp - mcp-registry:imageTag: 1.7.8 # Set specific image tag for production (change this to deploy different versions) + mcp-registry:imageTag: 1.7.9 # Set specific image tag for production (change this to deploy different versions) gcp:project: mcp-registry-prod mcp-registry:githubClientId: Iv23liUydBbI7Z2Q9bOZ mcp-registry:githubClientSecret: From 4819463aaa03e21e84b840ee2789cab7436bd76a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 14 May 2026 08:01:51 -0400 Subject: [PATCH 220/313] build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.237.0 to 3.238.0 in /deploy (#1283) Bumps [github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from 3.237.0 to 3.238.0.
    Release notes

    Sourced from github.com/pulumi/pulumi/sdk/v3's releases.

    v3.238.0

    3.238.0 (2026-05-13)

    Features

    • [cli] Add a --language flag to pulumi package add to run outside a Pulumi project or plugin #22791

    • [cli] Add --output json to pulumi up for a structured JSON summary of the operation result #22870

    • [cli] Recommend pulumi cloud api describe in pulumi cloud api --help to verify operation parameters before calling #22881

    • [cli] Add pulumi stack webhook list to list all webhooks configured for a stack #23082

    • [cli/cloud] Rename pulumi cloud api to pulumi api #22970

    • [cli/cloud] Add pulumi insights resource get to look up a single resource discovered by Pulumi Insights #23077

    • [cli/cloud] Add pulumi template list to list registry-backed templates #23074

    • [cli/cloud] Rename the --format flag to --output on pulumi api and its subcommands #23072

    • [cli/cloud] Add pulumi insights resource search to search for resources discovered by Pulumi Insights #23087

    • [cli/engine] Add --skip-plugin-pre-install to skip up-front plugin installation

    • [engine] Fail the deployment when an after hook fails #22935

    • [cli/neo] Render the agent's TODO list in the pulumi neo TUI #22864

    • [cli/neo] Add --approval-mode and --permission-mode flags to pulumi neo, with Ctrl+A and Ctrl+R hotkeys to switch modes mid-session #22950

    • [cli/package] When invoked by an AI coding agent, print pulumi api pointers after pulumi package add and pulumi package gen-sdk #22904

    • [pkg/testing] Recognize the hcl and pcl runtimes in integration.ProgramTest #23018

    ... (truncated)

    Changelog

    Sourced from github.com/pulumi/pulumi/sdk/v3's changelog.

    Changelog

    Commits
    • 71ddfb5 Allow skipping up-front provider plugin installs for engine commands (#22947)
    • f3da388 [cli/import] Strip InputType after union reduction in structural typing (#23115)
    • 11a5257 Neo auto-approve switch (#22950)
    • 3dd972c Bump language providers (#23103)
    • b88c0b2 Add l1-config-types-optional conformance test (#23108)
    • 4b708ec Add registerPackage helper to cache package references per deployment (#23014)
    • c7ddd56 cli/cloud: add pulumi insights resource search (#23087)
    • 3b02eb9 Update module github.com/go-git/go-git/v5 to v5.19.0 [SECURITY] (#22971)
    • 81026a0 [cli/package] Use --output=markdown in package-add docs hint (#23098)
    • 69d216c unflake TestConstructUnknownPython (#23086)
    • Additional commits viewable in compare view

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/pulumi/pulumi/sdk/v3&package-manager=go_modules&previous-version=3.237.0&new-version=3.238.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- deploy/go.mod | 2 +- deploy/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index ecd0260..21c9de3 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -5,7 +5,7 @@ go 1.26 require ( github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.30.0 - github.com/pulumi/pulumi/sdk/v3 v3.237.0 + github.com/pulumi/pulumi/sdk/v3 v3.238.0 gopkg.in/yaml.v2 v2.4.0 ) diff --git a/deploy/go.sum b/deploy/go.sum index 8d59fda..c5d6ff0 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -187,8 +187,8 @@ github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 h1:w6OnO3d4j5yVf2vpm8OzXFC/xHOEGqt+9 github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1/go.mod h1:UyZyv7hz4knpFx6/Sh+SkZe6hT6sJHtDvw9A0TbvEsk= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.30.0 h1:nF0Y1F7fUGL6RYD9EAtHTdDbNFmDaA3xcEiRlvCDV5E= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.30.0/go.mod h1:BAWI9R3JEEGOp1JlXLPSZKwBGANSrPGUWKtMnS5w5qw= -github.com/pulumi/pulumi/sdk/v3 v3.237.0 h1:D0kx4fkUkiZWfreQg1ekeAifLJEC2+VRYzgboQClg9Q= -github.com/pulumi/pulumi/sdk/v3 v3.237.0/go.mod h1:ybUihqUfVF1ZXBH3JNunYsAMz2P6i+7v5gzoJ60sVp0= +github.com/pulumi/pulumi/sdk/v3 v3.238.0 h1:V15ghoymebrhKsZeGRzs3rwmWD1MmuR7F2fx+2slct8= +github.com/pulumi/pulumi/sdk/v3 v3.238.0/go.mod h1:J8QFD7dwiCGSvBlcYwECmX/b3JKNXR85bv6BbjhPV3U= github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ= github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88= github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ= From deb5e7b24a8ca30fb3ffdac55fbabf99b26614e4 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Thu, 14 May 2026 08:09:05 -0400 Subject: [PATCH 221/313] chore(deps): reduce dependabot frequency from daily to weekly (#1284) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary - Dependency update PRs were arriving daily across gomod (root + `/deploy`), github-actions, and docker — creating significant review noise. - Switch all four update entries in `.github/dependabot.yml` from `interval: daily` to `interval: weekly` so they batch on a weekly cadence (Dependabot defaults to Mondays). ## Test plan - [ ] Confirm `.github/dependabot.yml` parses correctly (Dependabot will report a config error on the repo if not) - [ ] Observe that new dependency PRs stop appearing daily after merge 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.7 (1M context) --- .github/dependabot.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index ea28507..775df1b 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -7,7 +7,7 @@ updates: patterns: - "go.opentelemetry.io/*" schedule: - interval: daily + interval: weekly - package-ecosystem: gomod directory: /deploy groups: @@ -15,7 +15,7 @@ updates: patterns: - "go.opentelemetry.io/*" schedule: - interval: daily + interval: weekly - package-ecosystem: github-actions directory: / groups: @@ -23,8 +23,8 @@ updates: patterns: - "*" schedule: - interval: daily + interval: weekly - package-ecosystem: "docker" directory: "/" schedule: - interval: "daily" + interval: "weekly" From 49cea83c9d746b9fc7d4f9684deac1abdc45b815 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 25 May 2026 06:41:58 -0400 Subject: [PATCH 222/313] build(deps): bump github.com/go-git/go-git/v5 from 5.19.0 to 5.19.1 in /deploy (#1292) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.19.0 to 5.19.1.
    Release notes

    Sourced from github.com/go-git/go-git/v5's releases.

    v5.19.1

    What's Changed

    Full Changelog: https://github.com/go-git/go-git/compare/v5.19.0...v5.19.1

    Commits
    • 3c3be60 Merge pull request #2137 from go-git/validate-v5
    • 3fba897 plumbing: format/packfile, cap delta chain depth in parser
    • a97d660 Merge pull request #2125 from hiddeco/v5/format-input-bounds
    • aeaa125 plumbing: format/objfile, require Header before Read
    • 1f38e17 plumbing: format/packfile, bound inflate size
    • f7545a0 plumbing: format/idxfile, bound nr by file size
    • 170b881 Merge pull request #2116 from pjbgf/symlink-v5
    • 7b6d994 Merge pull request #2117 from hiddeco/v5/worktree-fs-mkdirall-root-noop
    • f0709b3 git: Stop validating symlink target paths
    • 776d00f git: Allow MkdirAll on worktree-root paths
    • Additional commits viewable in compare view

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/go-git/go-git/v5&package-manager=go_modules&previous-version=5.19.0&new-version=5.19.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/modelcontextprotocol/registry/network/alerts).
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- deploy/go.mod | 2 +- deploy/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index 21c9de3..8354647 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -38,7 +38,7 @@ require ( github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect github.com/go-git/go-billy/v5 v5.9.0 // indirect - github.com/go-git/go-git/v5 v5.19.0 // indirect + github.com/go-git/go-git/v5 v5.19.1 // indirect github.com/go-logr/logr v1.4.3 // indirect github.com/go-logr/stdr v1.2.2 // indirect github.com/gogo/protobuf v1.3.2 // indirect diff --git a/deploy/go.sum b/deploy/go.sum index c5d6ff0..7bc5320 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -74,8 +74,8 @@ github.com/go-git/go-billy/v5 v5.9.0 h1:jItGXszUDRtR/AlferWPTMN4j38BQ88XnXKbilmm github.com/go-git/go-billy/v5 v5.9.0/go.mod h1:jCnQMLj9eUgGU7+ludSTYoZL/GGmii14RxKFj7ROgHw= github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4= github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII= -github.com/go-git/go-git/v5 v5.19.0 h1:+WkVUQZSy/F1Gb13udrMKjIM2PrzsNfDKFSfo5tkMtc= -github.com/go-git/go-git/v5 v5.19.0/go.mod h1:Pb1v0c7/g8aGQJwx9Us09W85yGoyvSwuhEGMH7zjDKQ= +github.com/go-git/go-git/v5 v5.19.1 h1:nX27AnaU43/K5bKktKwgBmR9lawoYVe1Ckg0rgzzN00= +github.com/go-git/go-git/v5 v5.19.1/go.mod h1:Pb1v0c7/g8aGQJwx9Us09W85yGoyvSwuhEGMH7zjDKQ= github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= From b90f63f52cea2c0476b80f6b8d982b294af7aa7c Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 25 May 2026 06:42:13 -0400 Subject: [PATCH 223/313] build(deps): bump github.com/google/go-containerregistry from 0.21.5 to 0.21.6 (#1295) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) from 0.21.5 to 0.21.6.
    Release notes

    Sourced from github.com/google/go-containerregistry's releases.

    v0.21.6

    What's Changed

    New Contributors

    Full Changelog: https://github.com/google/go-containerregistry/compare/v0.21.5...v0.21.6

    Commits
    • 53f7e39 Update go version to 1.26.3 (#2300)
    • bf87c3b transport: allow bearer realm at same host:port as registry (#2302)
    • c55facd transport: retry HTTP 429 (Too Many Requests) (#2301)
    • 68a569e fix: preserve per-occurrence layer identity in Layers() (#2299)
    • 35b354b fix(mutate): preserve config blob and layers for non-Docker OCI artifacts (#2...
    • e5983f2 remote: block SSRF via private-IP Location headers in blob uploads (#2295)
    • 6dad820 remote: validate foreign layer URLs to prevent SSRF (fixes #2259) (#2293)
    • 78bdf1b validate: skip non-layer layers (#2298)
    • c29d91c pkg/v1/mutate: preserve relative symlinks that stay within rootfs in Extract ...
    • a70d75a transport: block redirects from token server to private/link-local addresses ...
    • Additional commits viewable in compare view

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/google/go-containerregistry&package-manager=go_modules&previous-version=0.21.5&new-version=0.21.6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 11 ++++------- go.sum | 22 ++++++++-------------- 2 files changed, 12 insertions(+), 21 deletions(-) diff --git a/go.mod b/go.mod index 247ffc7..6a54948 100644 --- a/go.mod +++ b/go.mod @@ -10,7 +10,7 @@ require ( github.com/coreos/go-oidc/v3 v3.18.0 github.com/danielgtaylor/huma/v2 v2.37.3 github.com/golang-jwt/jwt/v5 v5.3.1 - github.com/google/go-containerregistry v0.21.5 + github.com/google/go-containerregistry v0.21.6 github.com/jackc/pgx/v5 v5.9.2 github.com/prometheus/client_golang v1.23.2 github.com/rs/cors v1.11.1 @@ -39,9 +39,8 @@ require ( github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0 // indirect github.com/beorn7/perks v1.0.1 // indirect github.com/cespare/xxhash/v2 v2.3.0 // indirect - github.com/containerd/stargz-snapshotter/estargz v0.18.2 // indirect github.com/davecgh/go-spew v1.1.1 // indirect - github.com/docker/cli v29.4.0+incompatible // indirect + github.com/docker/cli v29.4.3+incompatible // indirect github.com/docker/docker-credential-helpers v0.9.3 // indirect github.com/felixge/httpsnoop v1.0.4 // indirect github.com/go-jose/go-jose/v4 v4.1.4 // indirect @@ -54,9 +53,8 @@ require ( github.com/jackc/pgpassfile v1.0.0 // indirect github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect github.com/jackc/puddle/v2 v2.2.2 // indirect - github.com/klauspost/compress v1.18.5 // indirect + github.com/klauspost/compress v1.18.6 // indirect github.com/kylelemons/godebug v1.1.0 // indirect - github.com/mitchellh/go-homedir v1.1.0 // indirect github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect github.com/opencontainers/go-digest v1.0.0 // indirect github.com/opencontainers/image-spec v1.1.1 // indirect @@ -67,7 +65,6 @@ require ( github.com/prometheus/otlptranslator v1.0.0 // indirect github.com/prometheus/procfs v0.20.1 // indirect github.com/sirupsen/logrus v1.9.4 // indirect - github.com/vbatts/tar-split v0.12.2 // indirect go.opentelemetry.io/auto/sdk v1.2.1 // indirect go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 // indirect go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect @@ -77,7 +74,7 @@ require ( golang.org/x/net v0.53.0 // indirect golang.org/x/oauth2 v0.36.0 // indirect golang.org/x/sync v0.20.0 // indirect - golang.org/x/sys v0.43.0 // indirect + golang.org/x/sys v0.44.0 // indirect golang.org/x/text v0.36.0 // indirect golang.org/x/time v0.15.0 // indirect google.golang.org/api v0.274.0 // indirect diff --git a/go.sum b/go.sum index 1a65b0f..ebf0ad1 100644 --- a/go.sum +++ b/go.sum @@ -36,8 +36,6 @@ github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UF github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5 h1:6xNmx7iTtyBRev0+D/Tv1FZd4SCg8axKApyNyRsAt/w= github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5/go.mod h1:KdCmV+x/BuvyMxRnYBlmVaq4OLiKW6iRQfvC62cvdkI= -github.com/containerd/stargz-snapshotter/estargz v0.18.2 h1:yXkZFYIzz3eoLwlTUZKz2iQ4MrckBxJjkmD16ynUTrw= -github.com/containerd/stargz-snapshotter/estargz v0.18.2/go.mod h1:XyVU5tcJ3PRpkA9XS2T5us6Eg35yM0214Y+wvrZTBrY= github.com/coreos/go-oidc/v3 v3.18.0 h1:V9orjXynvu5wiC9SemFTWnG4F45v403aIcjWo0d41+A= github.com/coreos/go-oidc/v3 v3.18.0/go.mod h1:DYCf24+ncYi+XkIH97GY1+dqoRlbaSI26KVTCI9SrY4= github.com/danielgtaylor/huma/v2 v2.37.3 h1:6Av0Vj45Vk5lDxRVfoO2iPlEdvCvwLc7pl5nbqGOkYM= @@ -45,8 +43,8 @@ github.com/danielgtaylor/huma/v2 v2.37.3/go.mod h1:OeHHtCEAaNiuVbAVdYu4IQ0UOmnb4 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= -github.com/docker/cli v29.4.0+incompatible h1:+IjXULMetlvWJiuSI0Nbor36lcJ5BTcVpUmB21KBoVM= -github.com/docker/cli v29.4.0+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= +github.com/docker/cli v29.4.3+incompatible h1:u+UliYm2J/rYrIh2FqHQg32neRG8GjbvNuwQRTzGspU= +github.com/docker/cli v29.4.3+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= github.com/docker/docker-credential-helpers v0.9.3 h1:gAm/VtF9wgqJMoxzT3Gj5p4AqIjCBS4wrsOh9yRqcz8= github.com/docker/docker-credential-helpers v0.9.3/go.mod h1:x+4Gbw9aGmChi3qTLZj8Dfn0TD20M/fuWy0E5+WDeCo= github.com/envoyproxy/go-control-plane v0.14.0 h1:hbG2kr4RuFj222B6+7T83thSPqLjwBIfQawTkC++2HA= @@ -71,8 +69,8 @@ github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps= github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= -github.com/google/go-containerregistry v0.21.5 h1:KTJG9Pn/jC0VdZR6ctV3/jcN+q6/Iqlx0sTVz3ywZlM= -github.com/google/go-containerregistry v0.21.5/go.mod h1:ySvMuiWg+dOsRW0Hw8GYwfMwBlNRTmpYBFJPlkco5zU= +github.com/google/go-containerregistry v0.21.6 h1:T+yqQIlJXKrM98Om4DlW3GoWQAmhZuLMwoDOvVrtiUM= +github.com/google/go-containerregistry v0.21.6/go.mod h1:U7MMSBIJynke2MVQrQk19NP9k/uQsGz/h0amIFSHMbo= github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0= github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= @@ -91,16 +89,14 @@ github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4= github.com/keybase/go-keychain v0.0.1 h1:way+bWYa6lDppZoZcgMbYsvC7GxljxrskdNInRtuthU= github.com/keybase/go-keychain v0.0.1/go.mod h1:PdEILRW3i9D8JcdM+FmY6RwkHGnhHxXwkPPMeUgOK1k= -github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE= -github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.18.6 h1:2jupLlAwFm95+YDR+NwD2MEfFO9d4z4Prjl1XXDjuao= +github.com/klauspost/compress v1.18.6/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE= github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc= github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw= -github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y= -github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0= github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA= github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ= github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U= @@ -136,8 +132,6 @@ github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UV github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U= github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= -github.com/vbatts/tar-split v0.12.2 h1:w/Y6tjxpeiFMR47yzZPlPj/FcPLpXbTUi/9H7d3CPa4= -github.com/vbatts/tar-split v0.12.2/go.mod h1:eF6B6i6ftWQcDqEn3/iGFRFRo8cBIMSJVOpnNdfTMFA= github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM= github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= @@ -175,8 +169,8 @@ golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7 golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4= golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI= -golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= +golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ= +golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg= golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164= golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U= From 3a8d268a876d1f6653df45a9c136019993bc7b0f Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 25 May 2026 06:42:29 -0400 Subject: [PATCH 224/313] build(deps): bump github.com/danielgtaylor/huma/v2 from 2.37.3 to 2.38.0 (#1296) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [github.com/danielgtaylor/huma/v2](https://github.com/danielgtaylor/huma) from 2.37.3 to 2.38.0.
    Release notes

    Sourced from github.com/danielgtaylor/huma/v2's releases.

    v2.38.0

    Overview

    Fiber v3

    This release adds support for Fiber v3. Dedicated v2 functions have been added to ensure support for both.

    What's Changed

    New Contributors

    Full Changelog: https://github.com/danielgtaylor/huma/compare/v2.37.3...v2.38.0

    Commits
    • c3f1651 chore(deps): bump github.com/gofiber/fiber/v2 from 2.52.12 to 2.52.13 (#1022)
    • 0dc6f40 Propagate underlying context to GET/PUT requests in the autopatch handler (#1...
    • ce91c48 chore(deps): bump github.com/gofiber/fiber/v3 from 3.1.0 to 3.2.0 (#1018)
    • 8fb47ee Accept empty base64 inputs (#1013)
    • e2db596 feat(humafiber): add Fiber v3 support (#962)
    • b2d8a3a Fix header regression (#1007)
    • See full diff in compare view

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/danielgtaylor/huma/v2&package-manager=go_modules&previous-version=2.37.3&new-version=2.38.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/go.mod b/go.mod index 6a54948..2d7ed4a 100644 --- a/go.mod +++ b/go.mod @@ -8,7 +8,7 @@ require ( github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.4.0 github.com/caarlos0/env/v11 v11.4.1 github.com/coreos/go-oidc/v3 v3.18.0 - github.com/danielgtaylor/huma/v2 v2.37.3 + github.com/danielgtaylor/huma/v2 v2.38.0 github.com/golang-jwt/jwt/v5 v5.3.1 github.com/google/go-containerregistry v0.21.6 github.com/jackc/pgx/v5 v5.9.2 diff --git a/go.sum b/go.sum index ebf0ad1..77dcd5a 100644 --- a/go.sum +++ b/go.sum @@ -38,8 +38,8 @@ github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5 h1:6xNmx7iTtyBRev0+D/T github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5/go.mod h1:KdCmV+x/BuvyMxRnYBlmVaq4OLiKW6iRQfvC62cvdkI= github.com/coreos/go-oidc/v3 v3.18.0 h1:V9orjXynvu5wiC9SemFTWnG4F45v403aIcjWo0d41+A= github.com/coreos/go-oidc/v3 v3.18.0/go.mod h1:DYCf24+ncYi+XkIH97GY1+dqoRlbaSI26KVTCI9SrY4= -github.com/danielgtaylor/huma/v2 v2.37.3 h1:6Av0Vj45Vk5lDxRVfoO2iPlEdvCvwLc7pl5nbqGOkYM= -github.com/danielgtaylor/huma/v2 v2.37.3/go.mod h1:OeHHtCEAaNiuVbAVdYu4IQ0UOmnb4x3yMUOShNlZ53g= +github.com/danielgtaylor/huma/v2 v2.38.0 h1:fb0WZCatnaiHLphMQDDWDjygNxfMkX/ENma3QsRl7vY= +github.com/danielgtaylor/huma/v2 v2.38.0/go.mod h1:k9hwjlgWFt1t2jsmQGlsgXAG2FBTZa4kkjV581qAtfo= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= @@ -54,8 +54,8 @@ github.com/envoyproxy/protoc-gen-validate v1.3.0 h1:TvGH1wof4H33rezVKWSpqKz5NXWg github.com/envoyproxy/protoc-gen-validate v1.3.0/go.mod h1:HvYl7zwPa5mffgyeTUHA9zHIH36nmrm7oCbo4YKoSWA= github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg= github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U= -github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM= -github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ= +github.com/fxamacker/cbor/v2 v2.9.1 h1:2rWm8B193Ll4VdjsJY28jxs70IdDsHRWgQYAI80+rMQ= +github.com/fxamacker/cbor/v2 v2.9.1/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ= github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA= github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08= github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= From a23a5185929bd17024c22b6f415fc3faf1ebafc9 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 25 May 2026 06:42:44 -0400 Subject: [PATCH 225/313] build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.238.0 to 3.242.0 in /deploy (#1297) Bumps [github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from 3.238.0 to 3.242.0.
    Release notes

    Sourced from github.com/pulumi/pulumi/sdk/v3's releases.

    v3.242.0

    3.242.0 (2026-05-19)

    Features

    • [cli] Add a pulumi package for npx support

    • [cli] Add the pulumi org member edit command #23235

    • [cli] Add the pulumi org member remove command #23237

    • [cli/cloud] Add pulumi deployment get to retrieve details for a specific deployment #23238

    • [cli/cloud] Add pulumi insights account scan get <account> <scan-id> to show the full workflow run for a single Insights scan #23255

    • [cli/cloud] Add pulumi insights account scan list <account> to discover recent scan IDs to feed into pulumi insights account scan log #23255

    • [cli/deployment] Add dedicated flags for each deployment setting #23236

    • [cli/do] Add the start of pulumi do #23176

    • [cli/neo] Add --print/-p to pulumi neo to run a single prompt non-interactively and print the agent's final response to stdout #23245

    Bug Fixes

    • [cli/cloud] Fix pulumi insights account scan log --all to follow the server's pagination cursor through the end of the log, and render --job/--step mode as structured lines instead of an empty raw-string blob #23256

    • [sdk] Close gzip.Writer in archiveTarGZIP to produce valid tar.gz output #23240

    • [sdkgen/python] Fix usage of ArgsDict types in typed dictionaries #23253

    v3.241.0

    3.241.0 (2026-05-18)

    Features

    ... (truncated)

    Changelog

    Sourced from github.com/pulumi/pulumi/sdk/v3's changelog.

    3.242.0 (2026-05-19)

    Features

    • [cli] Add a pulumi package for npx support

    • [cli] Add the pulumi org member edit command #23235

    • [cli] Add the pulumi org member remove command #23237

    • [cli/cloud] Add pulumi deployment get to retrieve details for a specific deployment #23238

    • [cli/cloud] Add pulumi insights account scan get <account> <scan-id> to show the full workflow run for a single Insights scan #23255

    • [cli/cloud] Add pulumi insights account scan list <account> to discover recent scan IDs to feed into pulumi insights account scan log #23255

    • [cli/deployment] Add dedicated flags for each deployment setting #23236

    • [cli/do] Add the start of pulumi do #23176

    • [cli/neo] Add --print/-p to pulumi neo to run a single prompt non-interactively and print the agent's final response to stdout #23245

    Bug Fixes

    • [cli/cloud] Fix pulumi insights account scan log --all to follow the server's pagination cursor through the end of the log, and render --job/--step mode as structured lines instead of an empty raw-string blob #23256

    • [sdk] Close gzip.Writer in archiveTarGZIP to produce valid tar.gz output #23240

    • [sdkgen/python] Fix usage of ArgsDict types in typed dictionaries #23253

    3.241.0 (2026-05-18)

    Features

    • [cli] Add --output json to pulumi preview for a structured JSON summary of the operation result #22927

    ... (truncated)

    Commits

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/pulumi/pulumi/sdk/v3&package-manager=go_modules&previous-version=3.238.0&new-version=3.242.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- deploy/go.mod | 5 +++-- deploy/go.sum | 8 ++++---- 2 files changed, 7 insertions(+), 6 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index 8354647..45181c9 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -5,7 +5,7 @@ go 1.26 require ( github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.30.0 - github.com/pulumi/pulumi/sdk/v3 v3.238.0 + github.com/pulumi/pulumi/sdk/v3 v3.242.0 gopkg.in/yaml.v2 v2.4.0 ) @@ -71,11 +71,12 @@ require ( github.com/opentracing/basictracer-go v1.1.0 // indirect github.com/opentracing/opentracing-go v1.2.0 // indirect github.com/pgavlin/fx v0.1.6 // indirect + github.com/pgavlin/fx/v2 v2.0.12 // indirect github.com/pjbgf/sha1cd v0.6.0 // indirect github.com/pkg/errors v0.9.1 // indirect github.com/pkg/term v1.1.0 // indirect github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231 // indirect - github.com/pulumi/esc v0.17.0 // indirect + github.com/pulumi/esc v0.24.0 // indirect github.com/rivo/uniseg v0.4.7 // indirect github.com/rogpeppe/go-internal v1.14.1 // indirect github.com/santhosh-tekuri/jsonschema/v5 v5.0.0 // indirect diff --git a/deploy/go.sum b/deploy/go.sum index 7bc5320..a72e887 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -181,14 +181,14 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231 h1:vkHw5I/plNdTr435cARxCW6q9gc0S/Yxz7Mkd38pOb0= github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231/go.mod h1:murToZ2N9hNJzewjHBgfFdXhZKjY3z5cYC1VXk+lbFE= -github.com/pulumi/esc v0.17.0 h1:oaVOIyFTENlYDuqc3pW75lQT9jb2cd6ie/4/Twxn66w= -github.com/pulumi/esc v0.17.0/go.mod h1:XnSxlt5NkmuAj304l/gK4pRErFbtqq6XpfX1tYT9Jbc= +github.com/pulumi/esc v0.24.0 h1:sCtiB0qbyrlU1ZNzJn4dTLYiChl8xeCBFbHWl1YoXJg= +github.com/pulumi/esc v0.24.0/go.mod h1:eCOOkcDJS6eooGwdE4/E0+pOsvUWG254+KBmPCFwJpA= github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 h1:w6OnO3d4j5yVf2vpm8OzXFC/xHOEGqt+9FjWCUBCq6U= github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1/go.mod h1:UyZyv7hz4knpFx6/Sh+SkZe6hT6sJHtDvw9A0TbvEsk= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.30.0 h1:nF0Y1F7fUGL6RYD9EAtHTdDbNFmDaA3xcEiRlvCDV5E= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.30.0/go.mod h1:BAWI9R3JEEGOp1JlXLPSZKwBGANSrPGUWKtMnS5w5qw= -github.com/pulumi/pulumi/sdk/v3 v3.238.0 h1:V15ghoymebrhKsZeGRzs3rwmWD1MmuR7F2fx+2slct8= -github.com/pulumi/pulumi/sdk/v3 v3.238.0/go.mod h1:J8QFD7dwiCGSvBlcYwECmX/b3JKNXR85bv6BbjhPV3U= +github.com/pulumi/pulumi/sdk/v3 v3.242.0 h1:gQIZ1ALbT5gCMuRoBscGzk7Rdbx9mbOc+YwDFxvRyss= +github.com/pulumi/pulumi/sdk/v3 v3.242.0/go.mod h1:P9VS6pQws3YBu67uszFRHn24n5AwzeMlyC2hIiHGWHg= github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ= github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88= github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ= From 5fe2c79e5c55632a3891177ba3288b8f9cd59dcf Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 25 May 2026 06:43:29 -0400 Subject: [PATCH 226/313] build(deps): bump goreleaser/goreleaser-action from 7.2.1 to 7.2.2 in the actions group (#1299) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps the actions group with 1 update: [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action). Updates `goreleaser/goreleaser-action` from 7.2.1 to 7.2.2
    Release notes

    Sourced from goreleaser/goreleaser-action's releases.

    v7.2.2

    What's Changed

    New Contributors

    Full Changelog: https://github.com/goreleaser/goreleaser-action/compare/v7...v7.2.2

    Commits

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=goreleaser/goreleaser-action&package-manager=github_actions&previous-version=7.2.1&new-version=7.2.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 1f51d3b..63805ab 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -31,7 +31,7 @@ jobs: uses: anchore/sbom-action/download-syft@v0.24.0 - name: Run GoReleaser - uses: goreleaser/goreleaser-action@1a80836c5c9d9e5755a25cb59ec6f45a3b5f41a8 + uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 with: distribution: goreleaser version: v2.12.0 From 66cc039facdd8cdba7deca56389f8114f2703620 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Mon, 25 May 2026 07:02:10 -0400 Subject: [PATCH 227/313] build(deps): bump golang.org/x/net to v0.55.0 (#1308) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary - Bumps `golang.org/x/net` from v0.53.0 to v0.55.0 to fix [GO-2026-5026](https://pkg.go.dev/vuln/GO-2026-5026) (failure to reject ASCII-only Punycode-encoded labels in `golang.org/x/net/idna`). - govulncheck flagged the vuln via `auth.DefaultHTTPKeyFetcher.FetchKey` → `http.Client.Do` → `idna.ToASCII` at `internal/api/handlers/v0/auth/http.go:191`. - Also brings in associated `x/crypto`, `x/sys`, `x/text` bumps via `go mod tidy`. This unblocks open dependabot PRs (e.g. #1298) that are failing CI on the same govulncheck finding despite not touching the root module. ## Test plan - [x] `go build ./...` - [x] `govulncheck` no longer reports GO-2026-5026 locally - [ ] CI passes 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.7 (1M context) --- go.mod | 8 ++++---- go.sum | 16 ++++++++-------- 2 files changed, 12 insertions(+), 12 deletions(-) diff --git a/go.mod b/go.mod index 2d7ed4a..c4dcb1d 100644 --- a/go.mod +++ b/go.mod @@ -70,12 +70,12 @@ require ( go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect go.opentelemetry.io/otel/trace v1.43.0 // indirect go.yaml.in/yaml/v2 v2.4.4 // indirect - golang.org/x/crypto v0.50.0 // indirect - golang.org/x/net v0.53.0 // indirect + golang.org/x/crypto v0.51.0 // indirect + golang.org/x/net v0.55.0 // indirect golang.org/x/oauth2 v0.36.0 // indirect golang.org/x/sync v0.20.0 // indirect - golang.org/x/sys v0.44.0 // indirect - golang.org/x/text v0.36.0 // indirect + golang.org/x/sys v0.45.0 // indirect + golang.org/x/text v0.37.0 // indirect golang.org/x/time v0.15.0 // indirect google.golang.org/api v0.274.0 // indirect google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 // indirect diff --git a/go.sum b/go.sum index 77dcd5a..5231bde 100644 --- a/go.sum +++ b/go.sum @@ -158,21 +158,21 @@ go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE= go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ= go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ= -golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI= -golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q= +golang.org/x/crypto v0.51.0 h1:IBPXwPfKxY7cWQZ38ZCIRPI50YLeevDLlLnyC5wRGTI= +golang.org/x/crypto v0.51.0/go.mod h1:8AdwkbraGNABw2kOX6YFPs3WM22XqI4EXEd8g+x7Oc8= golang.org/x/mod v0.36.0 h1:JJjpVx6myfUsUdAzZuOSTTmRE0PfZeNWzzvKrP7amb4= golang.org/x/mod v0.36.0/go.mod h1:moc6ELqsWcOw5Ef3xVprK5ul/MvtVvkIXLziUOICjUQ= -golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA= -golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs= +golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8= +golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww= golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4= golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ= -golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= -golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg= -golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164= +golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY= +golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= +golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc= +golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38= golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U= golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno= gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4= From f0f03c01270285df05f41a51acad8c20c8576706 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 25 May 2026 07:09:26 -0400 Subject: [PATCH 228/313] build(deps): bump github.com/pulumi/pulumi-kubernetes/sdk/v4 from 4.30.0 to 4.31.1 in /deploy (#1298) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [github.com/pulumi/pulumi-kubernetes/sdk/v4](https://github.com/pulumi/pulumi-kubernetes) from 4.30.0 to 4.31.1.
    Release notes

    Sourced from github.com/pulumi/pulumi-kubernetes/sdk/v4's releases.

    v4.31.1

    Changed

    v4.31.0

    Added

    • #2744 Advertise a helm mapping for terraform conversion so pulumi import --from terraform and pulumi convert --from terraform recognize helm_release and emit kubernetes:helm.sh/v3:Release.
    • #4332 Implement the List provider RPC and advertise listInputs (namespace, name, labelSelector, fieldSelector) on every non-nested resource. namespace is omitted from listInputs on cluster-scoped kinds. See https://github.com/pulumi/pulumi-kubernetes/blob/HEAD/docs/list-rpc-semantics.md for design notes.

    Fixed

    • #4261 Fix CRD parameterization: implement Parameterize(Value) so subsequent runs can reconstruct the CRD schema from saved state, and flatten array-of-objects in OpenAPI specs so nested fields like spec.listeners generate typed args.

    Changed

    • Upgrade Kubernetes schema and libraries to v1.36.1.
    Changelog

    Sourced from github.com/pulumi/pulumi-kubernetes/sdk/v4's changelog.

    4.31.1 (May 19, 2026)

    Changed

    • #4364 Update github.com/go-git/go-git/v5 to v5.19.1 (SECURITY).
    • Update first-party Pulumi dependencies to v3.242.0.

    4.31.0 (May 14, 2026)

    Added

    • #2744 Advertise a helm mapping for terraform conversion so pulumi import --from terraform and pulumi convert --from terraform recognize helm_release and emit kubernetes:helm.sh/v3:Release.
    • #4332 Implement the List provider RPC and advertise listInputs (namespace, name, labelSelector, fieldSelector) on every non-nested resource. namespace is omitted from listInputs on cluster-scoped kinds. See https://github.com/pulumi/pulumi-kubernetes/blob/master/docs/list-rpc-semantics.md for design notes.

    Fixed

    • #4261 Fix CRD parameterization: implement Parameterize(Value) so subsequent runs can reconstruct the CRD schema from saved state, and flatten array-of-objects in OpenAPI specs so nested fields like spec.listeners generate typed args.

    Changed

    • Upgrade Kubernetes schema and libraries to v1.36.1.
    Commits

    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Radoslav Dimitrov --- deploy/go.mod | 2 +- deploy/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index 45181c9..ec61bb7 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -4,7 +4,7 @@ go 1.26 require ( github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 - github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.30.0 + github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.31.1 github.com/pulumi/pulumi/sdk/v3 v3.242.0 gopkg.in/yaml.v2 v2.4.0 ) diff --git a/deploy/go.sum b/deploy/go.sum index a72e887..e5837f4 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -185,8 +185,8 @@ github.com/pulumi/esc v0.24.0 h1:sCtiB0qbyrlU1ZNzJn4dTLYiChl8xeCBFbHWl1YoXJg= github.com/pulumi/esc v0.24.0/go.mod h1:eCOOkcDJS6eooGwdE4/E0+pOsvUWG254+KBmPCFwJpA= github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 h1:w6OnO3d4j5yVf2vpm8OzXFC/xHOEGqt+9FjWCUBCq6U= github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1/go.mod h1:UyZyv7hz4knpFx6/Sh+SkZe6hT6sJHtDvw9A0TbvEsk= -github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.30.0 h1:nF0Y1F7fUGL6RYD9EAtHTdDbNFmDaA3xcEiRlvCDV5E= -github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.30.0/go.mod h1:BAWI9R3JEEGOp1JlXLPSZKwBGANSrPGUWKtMnS5w5qw= +github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.31.1 h1:Hg9RK9zqIU9kFbD5KeiON06gPP7cLgS68jvsgMBmPgw= +github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.31.1/go.mod h1:BAWI9R3JEEGOp1JlXLPSZKwBGANSrPGUWKtMnS5w5qw= github.com/pulumi/pulumi/sdk/v3 v3.242.0 h1:gQIZ1ALbT5gCMuRoBscGzk7Rdbx9mbOc+YwDFxvRyss= github.com/pulumi/pulumi/sdk/v3 v3.242.0/go.mod h1:P9VS6pQws3YBu67uszFRHn24n5AwzeMlyC2hIiHGWHg= github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ= From b97cc9fbd62eeb92ad352a8de2a60a341e6b8fa8 Mon Sep 17 00:00:00 2001 From: Tadas Antanavicius Date: Sun, 31 May 2026 00:20:31 -0700 Subject: [PATCH 229/313] docs: update maintainer/collaborator matrix in README (#1324) --- README.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index cbd9670..33ce337 100644 --- a/README.md +++ b/README.md @@ -10,11 +10,11 @@ The MCP registry provides MCP clients with a list of MCP servers, like an app st **2025-09-08 update**: The registry has launched in preview 🎉 ([announcement blog post](https://blog.modelcontextprotocol.io/posts/2025-09-08-mcp-registry-preview/)). While the system is now more stable, this is still a preview release and breaking changes or data resets may occur. A general availability (GA) release will follow later. We'd love your feedback in [GitHub discussions](https://github.com/modelcontextprotocol/registry/discussions/new?category=ideas) or in the [#registry-dev Discord](https://discord.com/channels/1358869848138059966/1369487942862504016) ([joining details here](https://modelcontextprotocol.io/community/communication)). -Current key maintainers: -- **Adam Jones** (Anthropic) [@domdomegg](https://github.com/domdomegg) +Registry Working Group: - **Tadas Antanavicius** (PulseMCP) [@tadasant](https://github.com/tadasant) -- **Toby Padilla** (GitHub) [@toby](https://github.com/toby) - **Radoslav (Rado) Dimitrov** (Stacklok) [@rdimitrov](https://github.com/rdimitrov) +- **Bob Dickinson** (TeamSpark) [@BobDickinson](https://github.com/BobDickinson) +- **Preeti (Pree) Dewani** (Ravenmail) [@pree-dew](https://github.com/pree-dew) ## Contributing From 224f50288d2c040a7502017c8b5cbda03522c797 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sun, 31 May 2026 03:21:50 -0400 Subject: [PATCH 230/313] build(deps): bump the actions group with 2 updates (#1314) --- .github/workflows/ci.yml | 2 +- .github/workflows/deploy-staging.yml | 2 +- .github/workflows/release.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e0dbb93..ce8f267 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -25,7 +25,7 @@ jobs: cache: true - name: Run lint - uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 + uses: golangci/golangci-lint-action@82606bf257cbaff209d206a39f5134f0cfbfd2ee with: version: v2.11.4 diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml index 074bb4a..c461511 100644 --- a/.github/workflows/deploy-staging.yml +++ b/.github/workflows/deploy-staging.yml @@ -34,7 +34,7 @@ jobs: uses: ko-build/setup-ko@v0.9 - name: Log in to Container Registry - uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 + uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee with: registry: ghcr.io username: ${{ github.actor }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 63805ab..f41dcaa 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -57,7 +57,7 @@ jobs: uses: ko-build/setup-ko@v0.9 - name: Log in to Container Registry - uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 + uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee with: registry: ghcr.io username: ${{ github.actor }} From 51f37e8de587126c2d8f4ce3fc3d5a860bc6bf79 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sun, 31 May 2026 03:22:20 -0400 Subject: [PATCH 231/313] build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.242.0 to 3.243.0 in /deploy (#1313) --- deploy/go.mod | 3 ++- deploy/go.sum | 6 ++++-- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index ec61bb7..f2e8b8b 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -5,12 +5,13 @@ go 1.26 require ( github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.31.1 - github.com/pulumi/pulumi/sdk/v3 v3.242.0 + github.com/pulumi/pulumi/sdk/v3 v3.243.0 gopkg.in/yaml.v2 v2.4.0 ) require ( dario.cat/mergo v1.0.0 // indirect + github.com/BurntSushi/toml v1.6.0 // indirect github.com/Microsoft/go-winio v0.6.2 // indirect github.com/ProtonMail/go-crypto v1.1.6 // indirect github.com/agext/levenshtein v1.2.3 // indirect diff --git a/deploy/go.sum b/deploy/go.sum index e5837f4..8b29f96 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -1,5 +1,7 @@ dario.cat/mergo v1.0.0 h1:AGCNq9Evsj31mOgNPcLyXc+4PNABt905YmuqPYYpBWk= dario.cat/mergo v1.0.0/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk= +github.com/BurntSushi/toml v1.6.0 h1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk= +github.com/BurntSushi/toml v1.6.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho= github.com/HdrHistogram/hdrhistogram-go v1.1.2 h1:5IcZpTvzydCQeHzK4Ef/D5rrSqwxob0t8PQPMybUNFM= github.com/HdrHistogram/hdrhistogram-go v1.1.2/go.mod h1:yDgFjdqOqDEKOvasDdhWNXYg9BVp4O+o5f6V/ehm6Oo= github.com/Microsoft/go-winio v0.5.2/go.mod h1:WpS1mjBmmwHBEWmogvA2mj8546UReBk4v8QkMxJ6pZY= @@ -187,8 +189,8 @@ github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 h1:w6OnO3d4j5yVf2vpm8OzXFC/xHOEGqt+9 github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1/go.mod h1:UyZyv7hz4knpFx6/Sh+SkZe6hT6sJHtDvw9A0TbvEsk= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.31.1 h1:Hg9RK9zqIU9kFbD5KeiON06gPP7cLgS68jvsgMBmPgw= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.31.1/go.mod h1:BAWI9R3JEEGOp1JlXLPSZKwBGANSrPGUWKtMnS5w5qw= -github.com/pulumi/pulumi/sdk/v3 v3.242.0 h1:gQIZ1ALbT5gCMuRoBscGzk7Rdbx9mbOc+YwDFxvRyss= -github.com/pulumi/pulumi/sdk/v3 v3.242.0/go.mod h1:P9VS6pQws3YBu67uszFRHn24n5AwzeMlyC2hIiHGWHg= +github.com/pulumi/pulumi/sdk/v3 v3.243.0 h1:pZaMx58nXrdh4XB0cgTlHnL3EMy3/JQwuin3aDuWyRM= +github.com/pulumi/pulumi/sdk/v3 v3.243.0/go.mod h1:BPWWuYPXcPH5YbXGoyy9Rrfa+evrh6IdM51AjDhcDpM= github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ= github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88= github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ= From 3a8e5428db14fb5821cf0fc0b1ade2e2e4534ea5 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sun, 31 May 2026 03:22:40 -0400 Subject: [PATCH 232/313] build(deps): bump github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys from 1.4.0 to 1.5.0 (#1312) --- go.mod | 6 +++--- go.sum | 12 ++++++------ 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/go.mod b/go.mod index c4dcb1d..bf8826a 100644 --- a/go.mod +++ b/go.mod @@ -5,7 +5,7 @@ go 1.26 require ( cloud.google.com/go/kms v1.31.0 github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 - github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.4.0 + github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.5.0 github.com/caarlos0/env/v11 v11.4.1 github.com/coreos/go-oidc/v3 v3.18.0 github.com/danielgtaylor/huma/v2 v2.38.0 @@ -33,10 +33,10 @@ require ( cloud.google.com/go/compute/metadata v0.9.0 // indirect cloud.google.com/go/iam v1.7.0 // indirect cloud.google.com/go/longrunning v0.9.0 // indirect - github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0 // indirect + github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0 // indirect github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 // indirect github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0 // indirect - github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0 // indirect + github.com/AzureAD/microsoft-authentication-library-for-go v1.7.0 // indirect github.com/beorn7/perks v1.0.1 // indirect github.com/cespare/xxhash/v2 v2.3.0 // indirect github.com/davecgh/go-spew v1.1.1 // indirect diff --git a/go.sum b/go.sum index 5231bde..cd14952 100644 --- a/go.sum +++ b/go.sum @@ -12,22 +12,22 @@ cloud.google.com/go/kms v1.31.0 h1:LS8N92OxFDgOLg5NCo3OmbvjtQAIVT5gUHVLKIDHaFE= cloud.google.com/go/kms v1.31.0/go.mod h1:YIyXZym11R5uovJJt4oN5eUL3oPmirF3yKeIh6QAf4U= cloud.google.com/go/longrunning v0.9.0 h1:0EzbDEGsAvOZNbqXopgniY0w0a1phvu5IdUFq8grmqY= cloud.google.com/go/longrunning v0.9.0/go.mod h1:pkTz846W7bF4o2SzdWJ40Hu0Re+UoNT6Q5t+igIcb8E= -github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0 h1:JXg2dwJUmPB9JmtVmdEB16APJ7jurfbY5jnfXpJoRMc= -github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0/go.mod h1:YD5h/ldMsG0XiIw7PdyNhLxaM317eFh5yNLccNfGdyw= +github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0 h1:fou+2+WFTib47nS+nz/ozhEBnvU96bKHy6LjRsY4E28= +github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0/go.mod h1:t76Ruy8AHvUAC8GfMWJMa0ElSbuIcO03NLpynfbgsPA= github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 h1:Hk5QBxZQC1jb2Fwj6mpzme37xbCDdNTxU7O9eb5+LB4= github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1/go.mod h1:IYus9qsFobWIc2YVwe/WPjcnyCkPKtnHAqUYeebc8z0= github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.2 h1:yz1bePFlP5Vws5+8ez6T3HWXPmwOK7Yvq8QxDBD3SKY= github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.2/go.mod h1:Pa9ZNPuoNu/GztvBSKk9J1cDJW6vk/n0zLtV4mgd8N8= github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 h1:9iefClla7iYpfYWdzPCRDozdmndjTm8DXdpCzPajMgA= github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2/go.mod h1:XtLgD3ZD34DAaVIIAyG3objl5DynM3CQ/vMcbBNJZGI= -github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.4.0 h1:E4MgwLBGeVB5f2MdcIVD3ELVAWpr+WD6MUe1i+tM/PA= -github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.4.0/go.mod h1:Y2b/1clN4zsAoUd/pgNAQHjLDnTis/6ROkUfyob6psM= +github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.5.0 h1:MaKvxE6D0KkjOg6Wd9M00iqP5PR0kUxCfiezes4JweM= +github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.5.0/go.mod h1:i2h9fsTFKZorh8RdV2IcSUf/Qj98GlTkrTvUbX/s8as= github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0 h1:nCYfgcSyHZXJI8J0IWE5MsCGlb2xp9fJiXyxWgmOFg4= github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0/go.mod h1:ucUjca2JtSZboY8IoUqyQyuuXvwbMBVwFOm0vdQPNhA= github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1 h1:WJTmL004Abzc5wDB5VtZG2PJk5ndYDgVacGqfirKxjM= github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1/go.mod h1:tCcJZ0uHAmvjsVYzEFivsRTN00oz5BEsRgQHu5JZ9WE= -github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0 h1:XRzhVemXdgvJqCH0sFfrBUTnUJSBrBf7++ypk+twtRs= -github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0/go.mod h1:HKpQxkWaGLJ+D/5H8QRpyQXA1eKjxkFlOMwck5+33Jk= +github.com/AzureAD/microsoft-authentication-library-for-go v1.7.0 h1:4iB+IesclUXdP0ICgAabvq2FYLXrJWKx1fJQ+GxSo3Y= +github.com/AzureAD/microsoft-authentication-library-for-go v1.7.0/go.mod h1:HKpQxkWaGLJ+D/5H8QRpyQXA1eKjxkFlOMwck5+33Jk= github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM= github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw= github.com/caarlos0/env/v11 v11.4.1 h1:fYwH0sWEsBSMPG7t4e/PEfTFzrWrpjyygXyUnWiSwEw= From 5d91ce7c2e83942435db8df818aa6ae924ed5d3c Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sun, 31 May 2026 03:23:00 -0400 Subject: [PATCH 233/313] build(deps): bump the opentelemetry group with 5 updates (#1311) --- go.mod | 12 ++++++------ go.sum | 26 ++++++++++++++------------ 2 files changed, 20 insertions(+), 18 deletions(-) diff --git a/go.mod b/go.mod index bf8826a..fd152fc 100644 --- a/go.mod +++ b/go.mod @@ -17,11 +17,11 @@ require ( github.com/santhosh-tekuri/jsonschema/v5 v5.3.1 github.com/stretchr/testify v1.11.1 go.opentelemetry.io/contrib/instrumentation/runtime v0.68.0 - go.opentelemetry.io/otel v1.43.0 - go.opentelemetry.io/otel/exporters/prometheus v0.65.0 - go.opentelemetry.io/otel/metric v1.43.0 - go.opentelemetry.io/otel/sdk v1.43.0 - go.opentelemetry.io/otel/sdk/metric v1.43.0 + go.opentelemetry.io/otel v1.44.0 + go.opentelemetry.io/otel/exporters/prometheus v0.66.0 + go.opentelemetry.io/otel/metric v1.44.0 + go.opentelemetry.io/otel/sdk v1.44.0 + go.opentelemetry.io/otel/sdk/metric v1.44.0 golang.org/x/mod v0.36.0 gopkg.in/yaml.v3 v3.0.1 ) @@ -68,7 +68,7 @@ require ( go.opentelemetry.io/auto/sdk v1.2.1 // indirect go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 // indirect go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect - go.opentelemetry.io/otel/trace v1.43.0 // indirect + go.opentelemetry.io/otel/trace v1.44.0 // indirect go.yaml.in/yaml/v2 v2.4.4 // indirect golang.org/x/crypto v0.51.0 // indirect golang.org/x/net v0.55.0 // indirect diff --git a/go.sum b/go.sum index cd14952..d738e87 100644 --- a/go.sum +++ b/go.sum @@ -142,18 +142,20 @@ go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 h1:F7Jx+6h go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0/go.mod h1:UHB22Z8QsdRDrnAtX4PntOl36ajSxcdUMt1sF7Y6E7Q= go.opentelemetry.io/contrib/instrumentation/runtime v0.68.0 h1:jhVIQEprwUTV+KfzzliLidclhoTOoHTgdz96kAyR8mU= go.opentelemetry.io/contrib/instrumentation/runtime v0.68.0/go.mod h1:4HsdbLUbernaTnA8CNaNE+1g026SciXb3juRYe3l8EY= -go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I= -go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0= -go.opentelemetry.io/otel/exporters/prometheus v0.65.0 h1:jOveH/b4lU9HT7y+Gfamf18BqlOuz2PWEvs8yM7Q6XE= -go.opentelemetry.io/otel/exporters/prometheus v0.65.0/go.mod h1:i1P8pcumauPtUI4YNopea1dhzEMuEqWP1xoUZDylLHo= -go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM= -go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY= -go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg= -go.opentelemetry.io/otel/sdk v1.43.0/go.mod h1:P+IkVU3iWukmiit/Yf9AWvpyRDlUeBaRg6Y+C58QHzg= -go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw= -go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A= -go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A= -go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0= +go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU= +go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc= +go.opentelemetry.io/otel/exporters/prometheus v0.66.0 h1:vkrK8PAznv2NKt2r+kdu252ccGzkEqLc2aSXbQIALYQ= +go.opentelemetry.io/otel/exporters/prometheus v0.66.0/go.mod h1:V/UB6D3vMF/UBOL5igAsAYnk1nG/bzYYTzvsB16cy7o= +go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc= +go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo= +go.opentelemetry.io/otel/metric/x v0.66.0 h1:YkCrx1zLOChi9ZcZ6euupOcsgzbVlec7D/xoEU1+cTA= +go.opentelemetry.io/otel/metric/x v0.66.0/go.mod h1:d1+BDj9t96do0/1LoU1ayfCv79ZgNE41qbhBvnMOBZk= +go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58= +go.opentelemetry.io/otel/sdk v1.44.0/go.mod h1:Osuydd3Se74nqjAKxid74N5eC+jfEqfTegHRnq58oK0= +go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI= +go.opentelemetry.io/otel/sdk/metric v1.44.0/go.mod h1:5B5pMARnXxKhltooO4xUuCBorl65a4EpnTalObqOigA= +go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk= +go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE= go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE= go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ= From 685e354b2fa37e5fe6d70dab0edb26a84e7ddf64 Mon Sep 17 00:00:00 2001 From: Wolfe-James Date: Wed, 3 Jun 2026 10:56:43 -0400 Subject: [PATCH 234/313] feat: add cargo (crates.io) as a package registry type (#1207) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit > **Update — 2026-06-01 (commit 1f3be53)** > > - **All @P4ST4S review feedback addressed** — positive-path hermetic mock + live anchor against `rust-faf-mcp v0.3.1`; 5xx routed as transient; doc comment qualified. See the [close-out comment](https://github.com/modelcontextprotocol/registry/pull/1207#issuecomment-4589711057) for the per-item breakdown. > - **Runtime-model question RESOLVED** — `package-types.mdx` documents cargo and MCPB as both first-class Rust MCP distribution paths (cargo for source-distributed, MCPB for prebuilt-binary). The "Open question" section below was the original draft framing; the doc now ships the resolution. > - **Cargo-specific gotcha discovered and documented** — crates.io strips HTML comments during README rendering, unlike PyPI/NuGet. `package-types.mdx` now spells this out so cargo authors don't ship invisible mcp-name tokens (which is exactly what happened to `rust-faf-mcp v0.3.0`; fixed in v0.3.1). > - **Stale reference removed in this update** — the "Out of scope" line mentioning `docs/guides/publishing/publish-cargo.md` pointed at a path that doesn't exist. The canonical per-type doc is `docs/modelcontextprotocol-io/package-types.mdx`; the Cargo section has been added there directly. > - **Two real-world Rust MCP servers queued for day-one register**: `rust-faf-mcp v0.3.1` (live, end-to-end validated by the new live test) and `perfetto-mcp-rs` ([@0xZOne](https://github.com/0xZOne) in #1055). > - **Tests:** 19/19 cargo tests pass (16 existing + 2 hermetic + 1 live anchor). `make validate` clean. `golangci-lint` 0 issues. --- Adds support for `registryType: cargo` so Rust MCP servers published to crates.io can be registered through the documented validation flow rather than the MCPB binary-packaging workaround. Closes #1055. ## Motivation and Context #1055 noted that crates.io has ~1,800 MCP-related packages with no direct path into the registry — only the MCPB binary-packaging workaround. This PR adds first-class support for cargo as a package registry type: schema + API surface, validator, integration tests, and a documented example. The publishing guide (`docs/guides/publishing/publish-cargo.md`) follows on this branch once the runtime-model direction in **Additional context** is settled. ## How Has This Been Tested? - **`make validate`** — clean. Schema-vs-openapi sync verified; 17/17 examples in `generic-server-json.md` validate against the schema; `expectedServerJSONCount` bumped 16 → 17 to match the new Cargo example. - **`go test ./internal/validators/...`** — passes. 16 cargo validator sub-cases across 4 test functions, run against real crates.io (~2.5s wall): - Input validation rejection paths - Registry-baseURL rejection (4 variants: different host, trailing slash, http-not-https, subdomain typo) - Ownership validation against real crates (`serde`, `tokio`, `rand`) — all correctly rejected for missing `mcp-name` token - Server-name format variations (canonical `io.github.OWNER/REPO`, multi-hyphen, underscore, numeric suffix) - **Positive-path test** — gated on `rust-faf-mcp` v0.2.3+ being published with `mcp-name: io.github.Wolfe-Jam/rust-faf-mcp` in its README. Reserved as a TODO in `cargo_test.go`; uncomments to become the live anchor once that publish lands. - **Local `make test-unit`** — not run due to a Go toolchain version quirk on my workstation (project auto-downloads 1.26.0; my local `go` is 1.25.6, causing compile mismatch). CI will exercise the full PostgreSQL-backed suite. ## Breaking Changes None. This is an additive change — `cargo` joins the supported `registryType` enum alongside `npm`/`pypi`/`nuget`/`oci`/`mcpb`. Existing publishes continue to work unchanged. ## Types of changes - [x] New feature (non-breaking change which adds functionality) - [x] Documentation update (new Cargo example in `generic-server-json.md`) ## Checklist - [x] I have read the [MCP Documentation](https://modelcontextprotocol.io) - [x] My code follows the repository's style guidelines - [x] New and existing tests pass locally - [x] I have added appropriate error handling - [x] I have added or updated documentation as needed ## Additional context ### Validator design — two-call retrieval on the documented API `internal/validators/registries/cargo.go` mirrors the PyPI validator's README-token approach (substring-match `mcp-name: `), with a two-call retrieval pattern to stay on the documented public crates.io API: 1. `GET /api/v1/crates/{name}/{version}/readme` returns 200 OK with a JSON pointer (`{"url": "https://static.crates.io/readmes/.../...html"}`) — crates.io hands us the URL rather than emitting a 302. 2. Follow the pointer to the rendered HTML; substring-match for the token. The two-call pattern stays on the documented public surface. The CDN URL layout is observed-stable, but treating it as the entry point would mean depending on an undocumented path. With two calls, crates.io controls where the README lives — if they move it, the metadata endpoint hands us the new URL. Missing crates and missing versions surface as **403** from the CDN (S3's default for missing keys), not 404. The validator treats any non-200 as "not found" and surfaces the actual status code in the error message. ### Open question — runtime model Cargo's runtime model is genuinely different from npm/PyPI/NuGet. `cargo install` is one-time (binary lands on PATH at `~/.cargo/bin`), not per-invocation like `npx`, `uvx`, or `dnx` (the new one in .NET 10 SDK Preview 6+). The new Cargo example in `generic-server-json.md` annotates this honestly and omits `runtimeHint`. If a different framing is preferred — e.g. recommending **MCPB** (prebuilt binary distribution via GitHub Releases) as the primary path for Rust MCP servers instead of cargo — happy to adjust the documentation accordingly. The schema + validator code in this PR is **additive** and doesn't force a recommendation either way; a Rust author who chooses cargo can use it, and one who prefers MCPB still can. ### Out of scope (deferred) - **`docs/guides/publishing/publish-cargo.md`** — follows on this branch once the runtime-model direction above is settled. - **Publisher CLI `Cargo.toml` autodetect** in `cmd/publisher/commands/init.go` — separate concern, separate PR. - **Positive-path validator test** — gated on `rust-faf-mcp` v0.2.3+ publishing as noted in *How Has This Been Tested?*. --------- Co-authored-by: Claude Co-authored-by: Radoslav Dimitrov --- .../modelcontextprotocol-io/package-types.mdx | 51 +++ docs/reference/api/openapi.yaml | 4 +- .../server-json/draft/server.schema.json | 4 +- .../server-json/generic-server-json.md | 29 ++ internal/validators/package.go | 2 + internal/validators/registries/cargo.go | 160 +++++++ internal/validators/registries/cargo_test.go | 411 ++++++++++++++++++ internal/validators/registries/export_test.go | 9 + pkg/model/constants.go | 2 + tools/validate-examples/main.go | 2 +- 10 files changed, 671 insertions(+), 3 deletions(-) create mode 100644 internal/validators/registries/cargo.go create mode 100644 internal/validators/registries/cargo_test.go create mode 100644 internal/validators/registries/export_test.go diff --git a/docs/modelcontextprotocol-io/package-types.mdx b/docs/modelcontextprotocol-io/package-types.mdx index b7a31b9..6cac890 100644 --- a/docs/modelcontextprotocol-io/package-types.mdx +++ b/docs/modelcontextprotocol-io/package-types.mdx @@ -125,6 +125,57 @@ This MCP server manages Azure DevOps work items and pipelines. ``` +## Cargo (Rust) Packages + +For Cargo packages, the MCP Registry currently supports the official crates.io registry (`https://crates.io`) only. + +Cargo packages use `"registryType": "cargo"` in `server.json`. For example: + +```json server.json highlight={9} +{ + "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json", + "name": "io.github.username/widget-mcp", + "title": "Widget", + "description": "Rust-native MCP server", + "version": "0.3.0", + "packages": [ + { + "registryType": "cargo", + "identifier": "widget-mcp", + "version": "0.3.0", + "transport": { + "type": "stdio" + } + } + ] +} +``` + +### Runtime Model + +Cargo's runtime model differs from npm/PyPI/NuGet. `cargo install ` places the compiled binary on PATH at `~/.cargo/bin`, after which MCP clients invoke it directly by name. There is no per-invocation runner equivalent to `npx` (npm), `uvx` (PyPI), or `dnx` (NuGet, .NET 10 SDK Preview 6+) — install is one-time, execution is by binary name. The Cargo example above intentionally omits `runtimeHint` for this reason. + +Rust MCP authors have two first-class distribution paths: + +- **Cargo (`registryType: cargo`)** — source-distributed via crates.io. End users need the Rust toolchain (`rustup`) to run `cargo install`. Idiomatic for the Rust ecosystem and consistent with how Rust CLIs are typically published. +- **MCPB (`registryType: mcpb`)** — prebuilt binary distributed via GitHub or GitLab Releases. End users need no toolchain. Right choice if the priority is "no Rust toolchain required." + +Both paths are supported; the choice is the author's. Cargo native support exists so Rust authors who prefer source distribution are not forced into the MCPB binary-packaging workaround. + +### Ownership Verification + +The MCP Registry verifies ownership of Cargo packages by checking for the existence of an `mcp-name: $SERVER_NAME` string in the package README (which is rendered to HTML and served by crates.io's static CDN). The `$SERVER_NAME` portion **MUST** match the server name from `server.json`. For example: + +```markdown README.md highlight={5} +# Widget MCP Server + +A Rust-native MCP server for widget operations. + +- MCP Registry name: `mcp-name: io.github.username/widget-mcp` +``` + +**Cargo-specific gotcha:** Unlike PyPI and NuGet (which preserve HTML comments in their README rendering), **crates.io strips HTML comments during markdown→HTML conversion**. The `` hidden-comment form that works for PyPI/NuGet **does not work for cargo** — the token will not appear in the rendered HTML the validator inspects. Cargo authors must include the `mcp-name:` token as visible markdown text. A simple bullet in the Links section is the recommended pattern. + ## Docker/OCI Images For Docker/OCI images, the MCP Registry currently supports: diff --git a/docs/reference/api/openapi.yaml b/docs/reference/api/openapi.yaml index 108e2fb..61cae2d 100644 --- a/docs/reference/api/openapi.yaml +++ b/docs/reference/api/openapi.yaml @@ -659,10 +659,11 @@ components: properties: registryType: type: string - description: Registry type indicating how to download packages (e.g., 'npm', 'pypi', 'oci', 'nuget', 'mcpb') + description: Registry type indicating how to download packages (e.g., 'npm', 'pypi', 'cargo', 'oci', 'nuget', 'mcpb') examples: - "npm" - "pypi" + - "cargo" - "oci" - "nuget" - "mcpb" @@ -673,6 +674,7 @@ components: examples: - "https://registry.npmjs.org" - "https://pypi.org" + - "https://crates.io" - "https://docker.io" - "https://api.nuget.org/v3/index.json" - "https://github.com" diff --git a/docs/reference/server-json/draft/server.schema.json b/docs/reference/server-json/draft/server.schema.json index 95539fe..e3aeab6 100644 --- a/docs/reference/server-json/draft/server.schema.json +++ b/docs/reference/server-json/draft/server.schema.json @@ -239,6 +239,7 @@ "examples": [ "https://registry.npmjs.org", "https://pypi.org", + "https://crates.io", "https://docker.io", "https://api.nuget.org/v3/index.json", "https://github.com", @@ -248,10 +249,11 @@ "type": "string" }, "registryType": { - "description": "Registry type indicating how to download packages (e.g., 'npm', 'pypi', 'oci', 'nuget', 'mcpb')", + "description": "Registry type indicating how to download packages (e.g., 'npm', 'pypi', 'cargo', 'oci', 'nuget', 'mcpb')", "examples": [ "npm", "pypi", + "cargo", "oci", "nuget", "mcpb" diff --git a/docs/reference/server-json/generic-server-json.md b/docs/reference/server-json/generic-server-json.md index bb5cc44..7415988 100644 --- a/docs/reference/server-json/generic-server-json.md +++ b/docs/reference/server-json/generic-server-json.md @@ -372,6 +372,35 @@ The same `registryType` / `identifier` pattern works for other supported OCI hos } ``` +### Cargo (Rust) Package Example + +`cargo install ` places the binary on PATH (via `~/.cargo/bin`); MCP clients invoke it directly by name. There is no single-shot equivalent of `npx` (npm), `uvx` (PyPI), or `dnx` (NuGet, .NET 10 SDK) for cargo — install once, run by name. + +```json +{ + "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json", + "name": "io.github.example/widget-mcp", + "description": "Rust-native MCP server", + "title": "Widget", + "repository": { + "url": "https://github.com/example/widget-mcp", + "source": "github" + }, + "version": "0.3.0", + "packages": [ + { + "registryType": "cargo", + "registryBaseUrl": "https://crates.io", + "identifier": "widget-mcp", + "version": "0.3.0", + "transport": { + "type": "stdio" + } + } + ] +} +``` + ### NuGet (.NET) Package Example The `dnx` tool ships with the .NET 10 SDK, starting with Preview 6. diff --git a/internal/validators/package.go b/internal/validators/package.go index 7104f73..b458244 100644 --- a/internal/validators/package.go +++ b/internal/validators/package.go @@ -23,6 +23,8 @@ func ValidatePackage(ctx context.Context, pkg model.Package, serverName string) return registries.ValidateOCI(ctx, pkg, serverName) case model.RegistryTypeMCPB: return registries.ValidateMCPB(ctx, pkg, serverName) + case model.RegistryTypeCargo: + return registries.ValidateCargo(ctx, pkg, serverName) default: return fmt.Errorf("unsupported registry type: %s", pkg.RegistryType) } diff --git a/internal/validators/registries/cargo.go b/internal/validators/registries/cargo.go new file mode 100644 index 0000000..18f7c0f --- /dev/null +++ b/internal/validators/registries/cargo.go @@ -0,0 +1,160 @@ +package registries + +import ( + "context" + "encoding/json" + "errors" + "fmt" + "io" + "net/http" + "net/url" + "strings" + "time" + + "github.com/modelcontextprotocol/registry/pkg/model" +) + +var ( + ErrMissingIdentifierForCargo = errors.New("package identifier is required for Cargo packages") + ErrMissingVersionForCargo = errors.New("package version is required for Cargo packages") +) + +// CargoReadmeMetaResponse is the structure returned by the crates.io readme metadata endpoint. +// +// With `Accept: application/json`, crates.io's /api/v1/crates/{name}/{version}/readme +// endpoint returns 200 OK with a JSON body containing a `url` field that points to the +// rendered README on the static CDN. (Without the Accept header, or via HEAD, the same +// endpoint emits a 302 redirect to the CDN URL — the validator uses the JSON path so +// that crates.io controls where the README lives.) Validators must follow the pointer +// to retrieve the actual README content. +type CargoReadmeMetaResponse struct { + URL string `json:"url"` +} + +// ValidateCargo validates that a Cargo (crates.io) package contains the correct MCP server name. +// +// Verification mechanism: the `mcp-name: ` token is searched for in the package's +// rendered README. This mirrors the PyPI validator's README-token approach (see ValidatePyPI), +// requiring no Cargo.toml parsing on the registry side. Crate authors add a single line +// `mcp-name: io.github.OWNER/REPO` to their README before publishing. +// +// Two-call retrieval pattern: +// 1. GET https://crates.io/api/v1/crates/{name}/{version}/readme +// → 200 OK with JSON: {"url": "https://static.crates.io/readmes/.../...html"} +// 2. GET +// → 200 OK with rendered README HTML, or 403 if the crate/version is missing +// +// The two-call pattern stays on the documented crates.io API surface rather than relying +// on the CDN URL layout being stable. +func ValidateCargo(ctx context.Context, pkg model.Package, serverName string) error { + // Set default registry base URL if empty + if pkg.RegistryBaseURL == "" { + pkg.RegistryBaseURL = model.RegistryURLCrates + } + + if pkg.Identifier == "" { + return ErrMissingIdentifierForCargo + } + + if pkg.Version == "" { + return ErrMissingVersionForCargo + } + + // Validate that MCPB-specific fields are not present + if pkg.FileSHA256 != "" { + return fmt.Errorf("cargo packages must not have 'fileSha256' field - this is only for MCPB packages") + } + + // Validate that the registry base URL matches crates.io exactly + if pkg.RegistryBaseURL != model.RegistryURLCrates { + return fmt.Errorf("registry type and base URL do not match: '%s' is not valid for registry type '%s'. Expected: %s", + pkg.RegistryBaseURL, model.RegistryTypeCargo, model.RegistryURLCrates) + } + + return validateCargoREADME(ctx, pkg, serverName) +} + +// validateCargoREADME performs the two-call README fetch and the mcp-name token +// check. It is split out from ValidateCargo so that httptest-based tests can +// drive the HTTP pipeline against a mock server (exposed via export_test.go), +// bypassing the exact-baseURL guard that ValidateCargo enforces for callers. +func validateCargoREADME(ctx context.Context, pkg model.Package, serverName string) error { + client := &http.Client{Timeout: 10 * time.Second} + // crates.io's crawler policy expects a non-generic User-Agent identifying the source. + userAgent := "MCP-Registry-Validator/1.0 (https://registry.modelcontextprotocol.io)" + + // Step 1: fetch the README pointer from the documented API endpoint. + metaURL := fmt.Sprintf("%s/api/v1/crates/%s/%s/readme", + pkg.RegistryBaseURL, + url.PathEscape(pkg.Identifier), + url.PathEscape(pkg.Version)) + + metaReq, err := http.NewRequestWithContext(ctx, http.MethodGet, metaURL, nil) + if err != nil { + return fmt.Errorf("failed to create crates.io metadata request: %w", err) + } + metaReq.Header.Set("User-Agent", userAgent) + metaReq.Header.Set("Accept", "application/json") + + metaResp, err := client.Do(metaReq) + if err != nil { + return fmt.Errorf("failed to fetch package metadata from crates.io: %w", err) + } + defer metaResp.Body.Close() + + if metaResp.StatusCode != http.StatusOK { + // 5xx from the metadata endpoint is upstream availability, not a missing crate. + if metaResp.StatusCode >= 500 && metaResp.StatusCode < 600 { + return fmt.Errorf("crates.io upstream error fetching metadata for cargo package '%s' (status: %d) — likely transient, retry later", pkg.Identifier, metaResp.StatusCode) + } + return fmt.Errorf("cargo package '%s' metadata fetch failed (status: %d)", pkg.Identifier, metaResp.StatusCode) + } + + var meta CargoReadmeMetaResponse + if err := json.NewDecoder(metaResp.Body).Decode(&meta); err != nil { + return fmt.Errorf("failed to parse crates.io readme metadata: %w", err) + } + if meta.URL == "" { + return fmt.Errorf("cargo package '%s' metadata response missing 'url' field", pkg.Identifier) + } + + // Step 2: fetch the rendered README from the URL the API gave us. + readmeReq, err := http.NewRequestWithContext(ctx, http.MethodGet, meta.URL, nil) + if err != nil { + return fmt.Errorf("failed to create crates.io readme request: %w", err) + } + readmeReq.Header.Set("User-Agent", userAgent) + readmeReq.Header.Set("Accept", "text/html") + + readmeResp, err := client.Do(readmeReq) + if err != nil { + return fmt.Errorf("failed to fetch rendered README from crates.io: %w", err) + } + defer readmeResp.Body.Close() + + // Missing crates and missing versions surface as 403 from static.crates.io + // (S3's default for missing keys), not 404. 5xx from the CDN is upstream + // availability — surface it as transient so callers can distinguish retryable + // failures from genuinely missing crates. + if readmeResp.StatusCode != http.StatusOK { + if readmeResp.StatusCode >= 500 && readmeResp.StatusCode < 600 { + return fmt.Errorf("crates.io upstream error fetching README for cargo package '%s' version '%s' (status: %d) — likely transient, retry later", pkg.Identifier, pkg.Version, readmeResp.StatusCode) + } + return fmt.Errorf("cargo package '%s' version '%s' not found on crates.io (status: %d)", pkg.Identifier, pkg.Version, readmeResp.StatusCode) + } + + body, err := io.ReadAll(readmeResp.Body) + if err != nil { + return fmt.Errorf("failed to read rendered README: %w", err) + } + + // Search for the mcp-name: token. The token contains no characters + // that get HTML-escaped during README rendering (no <, >, &, ", '), so a direct + // substring match against the rendered HTML is reliable. + mcpNamePattern := "mcp-name: " + serverName + if strings.Contains(string(body), mcpNamePattern) { + return nil + } + + return fmt.Errorf("cargo package '%s' ownership validation failed. The server name '%s' must appear as 'mcp-name: %s' in the package README", pkg.Identifier, serverName, serverName) +} diff --git a/internal/validators/registries/cargo_test.go b/internal/validators/registries/cargo_test.go new file mode 100644 index 0000000..e06d099 --- /dev/null +++ b/internal/validators/registries/cargo_test.go @@ -0,0 +1,411 @@ +package registries_test + +import ( + "context" + "encoding/json" + "fmt" + "net/http" + "net/http/httptest" + "net/url" + "strings" + "sync/atomic" + "testing" + + "github.com/modelcontextprotocol/registry/internal/validators/registries" + "github.com/modelcontextprotocol/registry/pkg/model" + "github.com/stretchr/testify/assert" +) + +func TestValidateCargo_RealPackages(t *testing.T) { + ctx := context.Background() + + tests := []struct { + name string + packageName string + version string + serverName string + expectError bool + errorMessage string + }{ + { + name: "empty package identifier should fail", + packageName: "", + version: "0.1.0", + serverName: "io.github.example/test", + expectError: true, + errorMessage: "package identifier is required for Cargo packages", + }, + { + name: "empty package version should fail", + packageName: "rust-faf-mcp", + version: "", + serverName: "io.github.example/test", + expectError: true, + errorMessage: "package version is required for Cargo packages", + }, + { + name: "non-existent crate should fail", + packageName: generateRandomPackageName(), + version: "0.1.0", + serverName: "io.github.example/test", + expectError: true, + errorMessage: "not found", + }, + { + name: "non-existent version of real crate should fail", + packageName: "serde", + version: "99.99.99-not-real", + serverName: "io.github.example/test", + expectError: true, + errorMessage: "not found", + }, + { + name: "real crate without mcp-name token should fail", + packageName: "serde", // most-downloaded crate; no MCP server claim + version: "1.0.219", + serverName: "io.github.example/test", + expectError: true, + errorMessage: "ownership validation failed", + }, + { + name: "real crate with mismatched mcp-name should fail", + packageName: "tokio", + version: "1.40.0", + serverName: "io.github.example/completely-different-name", + expectError: true, + errorMessage: "ownership validation failed", + }, + { + name: "additional real crate without mcp-name (rand)", + packageName: "rand", + version: "0.9.0", + serverName: "io.github.example/test", + expectError: true, + errorMessage: "ownership validation failed", + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + pkg := model.Package{ + RegistryType: model.RegistryTypeCargo, + Identifier: tt.packageName, + Version: tt.version, + } + + err := registries.ValidateCargo(ctx, pkg, tt.serverName) + + if tt.expectError { + assert.Error(t, err) + assert.Contains(t, err.Error(), tt.errorMessage) + } else { + assert.NoError(t, err) + } + }) + } +} + +func TestValidateCargo_RegistryBaseURLMismatch(t *testing.T) { + ctx := context.Background() + + tests := []struct { + name string + baseURL string + }{ + {name: "different host", baseURL: "https://example.com"}, + {name: "trailing slash", baseURL: "https://crates.io/"}, + {name: "http (not https)", baseURL: "http://crates.io"}, + {name: "subdomain", baseURL: "https://www.crates.io"}, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + pkg := model.Package{ + RegistryType: model.RegistryTypeCargo, + RegistryBaseURL: tt.baseURL, + Identifier: "rust-faf-mcp", + Version: "0.2.2", + } + + err := registries.ValidateCargo(ctx, pkg, "io.github.Wolfe-Jam/rust-faf-mcp") + assert.Error(t, err) + assert.Contains(t, err.Error(), "registry type and base URL do not match") + }) + } +} + +func TestValidateCargo_RejectsMCPBOnlyFields(t *testing.T) { + ctx := context.Background() + + pkg := model.Package{ + RegistryType: model.RegistryTypeCargo, + Identifier: "rust-faf-mcp", + Version: "0.2.2", + FileSHA256: "0000000000000000000000000000000000000000000000000000000000000000", + } + + err := registries.ValidateCargo(ctx, pkg, "io.github.Wolfe-Jam/rust-faf-mcp") + assert.Error(t, err) + assert.Contains(t, err.Error(), "cargo packages must not have 'fileSha256' field") +} + +// Server names follow io.github.OWNER/REPO and may contain dots, slashes, +// hyphens, underscores, and digits. None of these get HTML-escaped during +// README rendering, so substring match against the rendered HTML is reliable. +// These tests exercise format variations against a real crate that doesn't +// declare any mcp-name (serde) — every case fails ownership, but we verify +// the failure error preserves the exact server name unchanged. +func TestValidateCargo_ServerNameFormats(t *testing.T) { + ctx := context.Background() + + tests := []struct { + name string + serverName string + }{ + {name: "canonical io.github format", serverName: "io.github.Wolfe-Jam/rust-faf-mcp"}, + {name: "multiple hyphens", serverName: "io.github.example/multi-hyphen-test-name"}, + {name: "underscore", serverName: "io.github.example/snake_case_name"}, + {name: "numeric suffix", serverName: "io.github.example/server-v2"}, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + pkg := model.Package{ + RegistryType: model.RegistryTypeCargo, + Identifier: "serde", + Version: "1.0.219", + } + + err := registries.ValidateCargo(ctx, pkg, tt.serverName) + assert.Error(t, err) + assert.Contains(t, err.Error(), tt.serverName) + }) + } +} + +// TestValidateCargo_PositivePathMock exercises the success branch: a README +// that contains the exact mcp-name token must return no error. Uses httptest +// to stand in for crates.io, so the test is hermetic — it doesn't depend on +// any live crate publishing a specific mcp-name line or on network reachability. +// Calls the test-only ValidateCargoREADME shim so the mock URL can take the +// place of https://crates.io without tripping the exact-baseURL guard. +func TestValidateCargo_PositivePathMock(t *testing.T) { + ctx := context.Background() + const serverName = "io.github.test/positive-path" + + var mock *httptest.Server + mock = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + if strings.HasSuffix(r.URL.Path, "/readme") { + w.Header().Set("Content-Type", "application/json") + if err := json.NewEncoder(w).Encode(map[string]string{ + "url": mock.URL + "/static-readme", + }); err != nil { + t.Fatalf("encode meta response: %v", err) + } + return + } + // Rendered README HTML containing the mcp-name token. + fmt.Fprintf(w, "

    some content

    mcp-name: %s

    ", serverName) + })) + defer mock.Close() + + pkg := model.Package{ + RegistryType: model.RegistryTypeCargo, + RegistryBaseURL: mock.URL, + Identifier: "test-crate", + Version: "0.1.0", + } + + err := registries.ValidateCargoREADME(ctx, pkg, serverName) + assert.NoError(t, err, "validator should accept a README containing the exact mcp-name token") +} + +// TestValidateCargo_LivePositivePath is the live anchor — it validates against +// rust-faf-mcp v0.3.1 on real crates.io, the first crate published with the +// mcp-name token as visible markdown (v0.3.0 used a hidden HTML comment, which +// crates.io strips during README rendering — see package-types.mdx for the +// cargo-specific gotcha). Complements TestValidateCargo_PositivePathMock: +// the mock proves the validator works in principle (hermetic, fast); the live +// anchor proves it works against the real crates.io API + static CDN pipeline. +// +// If this test ever starts failing, check (in order): +// 1. Has rust-faf-mcp v0.3.1 been yanked or replaced? +// 2. Did crates.io change its README rendering pipeline (e.g., start +// stripping markdown lines that look like email-like tokens)? +// 3. Is the test machine network-blocked from crates.io or static.crates.io? +func TestValidateCargo_LivePositivePath(t *testing.T) { + ctx := context.Background() + + pkg := model.Package{ + RegistryType: model.RegistryTypeCargo, + Identifier: "rust-faf-mcp", + Version: "0.3.1", + } + + err := registries.ValidateCargo(ctx, pkg, "io.github.Wolfe-Jam/rust-faf-mcp") + assert.NoError(t, err, "validator should accept the live rust-faf-mcp v0.3.1 crate (the canonical live anchor for cargo positive-path)") +} + +// TestValidateCargo_TransientUpstreamError exercises the 5xx-as-transient branch: +// a 502/503 from static.crates.io is upstream availability, not "crate missing", +// and the error message must signal a retryable failure rather than imply the +// crate doesn't exist (the previous behavior, flagged in PR #1207 review). +func TestValidateCargo_TransientUpstreamError(t *testing.T) { + ctx := context.Background() + + var mock *httptest.Server + mock = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + if strings.HasSuffix(r.URL.Path, "/readme") { + w.Header().Set("Content-Type", "application/json") + _ = json.NewEncoder(w).Encode(map[string]string{ + "url": mock.URL + "/static-readme", + }) + return + } + // Simulate static.crates.io 502 — upstream blip, not a missing crate. + http.Error(w, "bad gateway", http.StatusBadGateway) + })) + defer mock.Close() + + pkg := model.Package{ + RegistryType: model.RegistryTypeCargo, + RegistryBaseURL: mock.URL, + Identifier: "test-crate", + Version: "0.1.0", + } + + err := registries.ValidateCargoREADME(ctx, pkg, "io.github.test/transient") + assert.Error(t, err) + assert.Contains(t, err.Error(), "transient") + assert.NotContains(t, err.Error(), "not found", "transient upstream errors should not be reported as 'not found'") +} + +// TestValidateCargoCombinedFixture exercises path-encoding and the full status +// matrix in one httptest fixture — the same pattern praised by @P4ST4S on +// PR #1321 for Go modules. One server dispatches on the crate identifier +// embedded in the URL path; wrong encoding routes to the fallback 500, which +// breaks the appropriate assertion. The explicit path assertion (assert.Equal +// on lastMetaPath) also catches encoding regressions directly. +func TestValidateCargoCombinedFixture(t *testing.T) { + ctx := context.Background() + const serverName = "io.github.test/combined" + + tests := []struct { + name string + crateName string + version string + metaStatus int + readmeStatus int + readmeBody string + wantErr bool + wantContains []string + wantNotContains []string + }{ + { + name: "happy_path_visible_token", + crateName: "combined-happy", + version: "0.1.0", + metaStatus: http.StatusOK, + readmeStatus: http.StatusOK, + readmeBody: fmt.Sprintf("

    mcp-name: %s

    ", serverName), + }, + { + name: "metadata_404", + crateName: "combined-meta404", + version: "0.1.0", + metaStatus: http.StatusNotFound, + wantErr: true, + wantContains: []string{"metadata fetch failed", "status: 404"}, + }, + { + name: "readme_403_s3_not_found", + crateName: "combined-readme403", + version: "0.1.0", + metaStatus: http.StatusOK, + readmeStatus: http.StatusForbidden, + wantErr: true, + wantContains: []string{"not found", "status: 403"}, + }, + { + name: "readme_502_transient", + crateName: "combined-readme502", + version: "0.1.0", + metaStatus: http.StatusOK, + readmeStatus: http.StatusBadGateway, + wantErr: true, + wantContains: []string{"transient"}, + wantNotContains: []string{"not found"}, + }, + } + + // lastMetaPath captures the metadata request path seen by the handler so + // each sub-test can assert the exact url.PathEscape-encoded form. + var lastMetaPath atomic.Value + lastMetaPath.Store("") + + var srv *httptest.Server + srv = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + for i := range tests { + tt := &tests[i] + metaPath := fmt.Sprintf("/api/v1/crates/%s/%s/readme", + url.PathEscape(tt.crateName), url.PathEscape(tt.version)) + staticPath := "/readme-static/" + url.PathEscape(tt.crateName) + + if r.URL.Path == metaPath { + lastMetaPath.Store(r.URL.Path) + if tt.metaStatus != http.StatusOK { + http.Error(w, "simulated non-200", tt.metaStatus) + return + } + w.Header().Set("Content-Type", "application/json") + _ = json.NewEncoder(w).Encode(map[string]string{"url": srv.URL + staticPath}) + return + } + if r.URL.Path == staticPath { + if tt.readmeStatus != http.StatusOK { + http.Error(w, "simulated non-200", tt.readmeStatus) + return + } + fmt.Fprint(w, tt.readmeBody) + return + } + } + http.Error(w, "unexpected path: "+r.URL.Path, http.StatusInternalServerError) + })) + defer srv.Close() + + for i := range tests { + tt := tests[i] + lastMetaPath.Store("") + t.Run(tt.name, func(t *testing.T) { + wantMetaPath := fmt.Sprintf("/api/v1/crates/%s/%s/readme", + url.PathEscape(tt.crateName), url.PathEscape(tt.version)) + + pkg := model.Package{ + RegistryType: model.RegistryTypeCargo, + RegistryBaseURL: srv.URL, + Identifier: tt.crateName, + Version: tt.version, + } + + err := registries.ValidateCargoREADME(ctx, pkg, serverName) + + // Assert encode step: the validator must have requested exactly the + // url.PathEscape-encoded path; wrong encoding hits the fallback 500. + assert.Equal(t, wantMetaPath, lastMetaPath.Load().(string), + "meta request path must be exactly the url.PathEscape-encoded form") + + if tt.wantErr { + assert.Error(t, err) + for _, want := range tt.wantContains { + assert.Contains(t, err.Error(), want) + } + for _, notWant := range tt.wantNotContains { + assert.NotContains(t, err.Error(), notWant) + } + } else { + assert.NoError(t, err) + } + }) + } +} diff --git a/internal/validators/registries/export_test.go b/internal/validators/registries/export_test.go new file mode 100644 index 0000000..89878de --- /dev/null +++ b/internal/validators/registries/export_test.go @@ -0,0 +1,9 @@ +package registries + +// ValidateCargoREADME exposes the package-private validateCargoREADME to the +// external _test package so httptest-driven tests can exercise the README-fetch +// and mcp-name token-match pipeline against a mock server, bypassing the +// exact-baseURL guard that the public ValidateCargo enforces. +// +// Intended for cargo_test.go's positive-path and transient-error tests only. +var ValidateCargoREADME = validateCargoREADME diff --git a/pkg/model/constants.go b/pkg/model/constants.go index ead176d..98a3ba1 100644 --- a/pkg/model/constants.go +++ b/pkg/model/constants.go @@ -7,10 +7,12 @@ const ( RegistryTypeOCI = "oci" RegistryTypeNuGet = "nuget" RegistryTypeMCPB = "mcpb" + RegistryTypeCargo = "cargo" ) // Registry Base URLs - supported package registry base URLs const ( + RegistryURLCrates = "https://crates.io" RegistryURLGitHub = "https://github.com" RegistryURLGitLab = "https://gitlab.com" RegistryURLNPM = "https://registry.npmjs.org" diff --git a/tools/validate-examples/main.go b/tools/validate-examples/main.go index 2f8be56..4c48ae6 100644 --- a/tools/validate-examples/main.go +++ b/tools/validate-examples/main.go @@ -33,7 +33,7 @@ func main() { func runValidation() error { // Define what we validate and how - expectedServerJSONCount := 16 + expectedServerJSONCount := 17 targets := []validationTarget{ { path: filepath.Join("docs", "reference", "server-json", "generic-server-json.md"), From 78bc7006b04bf621db69613ef52129c4c026924a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 4 Jun 2026 16:02:25 -0400 Subject: [PATCH 235/313] build(deps): bump go.opentelemetry.io/contrib/instrumentation/runtime from 0.68.0 to 0.69.0 in the opentelemetry group (#1332) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps the opentelemetry group with 1 update: [go.opentelemetry.io/contrib/instrumentation/runtime](https://github.com/open-telemetry/opentelemetry-go-contrib). Updates `go.opentelemetry.io/contrib/instrumentation/runtime` from 0.68.0 to 0.69.0
    Release notes

    Sourced from go.opentelemetry.io/contrib/instrumentation/runtime's releases.

    v1.44.0/v2.5.1/v0.69.0/v0.37.1/v0.24.0/v0.19.0/v0.16.1/v0.16.0

    Added

    • Add error.type attribute to http.client.request.duration for transport failures in otelhttp. (#8801)
    • Add examples for prometheus compatibility document. (#8716)
    • Add support for cardinality_limits in PeriodicMetricReader in otelconf. (#8885)
    • Add Resource method to SDK in go.opentelemetry.io/contrib/otelconf/x to expose the resolved SDK resource from declarative configuration. (#8913)
    • Add go.opentelemetry.io/contrib/detectors/hetzner, a new resource detector for Hetzner Cloud servers, ported from github.com/open-telemetry/opentelemetry-collector-contrib/processor/resourcedetectionprocessor/internal/hetzner. Detects cloud.provider, cloud.platform, cloud.region, cloud.availability_zone, host.id, and host.name. (#8979)

    Changed

    • Set error field as record.SetErr instead of a plain attribute in go.opentelemetry.io/contrib/bridges/otellogrus. (#8776)
    • Set the "error" field (e.g. created via zap.Error) as record.SetErr instead of a plain attribute in go.opentelemetry.io/contrib/bridges/otelzap. (#8719)
    • Set fields implementing error interface from slog records as record.SetErr instead of plain attributes in go.opentelemetry.io/contrib/bridges/otelslog. (#8774)
    • Set emitted errors in go.opentelemetry.io/contrib/bridges/otellogr as record errors (Record.SetErr) instead of exception.message attributes. (#8775)

    Fixed

    • Fix header attributes lost when using sub-spans in go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace. (#8797)
    • Validate encoding configuration for OTLP HTTP exporters in go.opentelemetry.io/contrib/otelconf. (#8772)
    • Remove the custom body wrapper from the request's body after the request is processed to allow body type comparisons with the original type in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp and go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux. (#6914)
    • Unknown or empty HTTP methods now report "_OTHER" instead of "GET" across all HTTP instrumentations to align with OpenTelemetry semantic conventions. (#8868)
    • The default span name formatter in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp now conforms to the OpenTelemetry HTTP semantic conventions for server span names. (#8871)
      • The default span name is now {method} {route} (e.g. GET /foo/{id}) when a route pattern is available, or {method} (e.g. GET) otherwise.

    Removed

    • Remove the deprecated WithSpanOptions option in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc. (#8991)

    What's Changed

    ... (truncated)

    Changelog

    Sourced from go.opentelemetry.io/contrib/instrumentation/runtime's changelog.

    [1.44.0/2.5.1/0.69.0/0.37.1/0.24.0/0.19.0/0.16.1/0.16.0] - 2026-05-28

    Added

    • Add error.type attribute to http.client.request.duration for transport failures in otelhttp. (#8801)
    • Add examples for prometheus compatibility document. (#8716)
    • Add support for cardinality_limits in PeriodicMetricReader in otelconf. (#8885)
    • Add Resource method to SDK in go.opentelemetry.io/contrib/otelconf/x to expose the resolved SDK resource from declarative configuration. (#8913)
    • Add go.opentelemetry.io/contrib/detectors/hetzner, a new resource detector for Hetzner Cloud servers, ported from github.com/open-telemetry/opentelemetry-collector-contrib/processor/resourcedetectionprocessor/internal/hetzner. Detects cloud.provider, cloud.platform, cloud.region, cloud.availability_zone, host.id, and host.name. (#8979)

    Changed

    • Set error field as record.SetErr instead of a plain attribute in go.opentelemetry.io/contrib/bridges/otellogrus. (#8776)
    • Set the "error" field (e.g. created via zap.Error) as record.SetErr instead of a plain attribute in go.opentelemetry.io/contrib/bridges/otelzap. (#8719)
    • Set fields implementing error interface from slog records as record.SetErr instead of plain attributes in go.opentelemetry.io/contrib/bridges/otelslog. (#8774)
    • Set emitted errors in go.opentelemetry.io/contrib/bridges/otellogr as record errors (Record.SetErr) instead of exception.message attributes. (#8775)

    Fixed

    • Fix header attributes lost when using sub-spans in go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace. (#8797)
    • Validate encoding configuration for OTLP HTTP exporters in go.opentelemetry.io/contrib/otelconf. (#8772)
    • Remove the custom body wrapper from the request's body after the request is processed to allow body type comparisons with the original type in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp and go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux. (#6914)
    • Unknown or empty HTTP methods now report "_OTHER" instead of "GET" across all HTTP instrumentations to align with OpenTelemetry semantic conventions. (#8868)
    • The default span name formatter in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp now conforms to the OpenTelemetry HTTP semantic conventions for server span names. (#8871)
      • The default span name is now {method} {route} (e.g. GET /foo/{id}) when a route pattern is available, or {method} (e.g. GET) otherwise.

    Removed

    • Remove the deprecated WithSpanOptions option in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc. (#8991)
    Commits
    • 03b2bcd Release v1.44.0/v2.5.1/v0.69.0/v0.37.1/v0.24.0/v0.19.0/v0.16.1/v0.16.0 (#9033)
    • 80c46d4 chore(deps): update module github.com/alecthomas/chroma/v2 to v2.26.0 (#9034)
    • 51f2921 fix(deps): update module github.com/hetznercloud/hcloud-go/v2 to v2.41.2 (#9026)
    • db82162 fix(deps): update aws-sdk-go-v2 monorepo (#9031)
    • 5a3e533 fix(deps): update module github.com/aws/smithy-go to v1.26.0 (#9032)
    • c67843c otelhttp: Remove custom wrapper after handling request (#6914)
    • c0a4135 docs(otelhttptrace): add performance guidance for WithoutSubSpans (#8785)
    • a51a867 otelconf: implement cardinality_limits support in PeriodicMetricReader (#8885)
    • dead6e5 chore(deps): update module go.yaml.in/yaml/v2 to v2.4.4 (#8994)
    • 979ce18 chore(deps): update module github.com/jgautheron/goconst to v1.10.2 (#9030)
    • Additional commits viewable in compare view

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=go.opentelemetry.io/contrib/instrumentation/runtime&package-manager=go_modules&previous-version=0.68.0&new-version=0.69.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index fd152fc..82afd5b 100644 --- a/go.mod +++ b/go.mod @@ -16,7 +16,7 @@ require ( github.com/rs/cors v1.11.1 github.com/santhosh-tekuri/jsonschema/v5 v5.3.1 github.com/stretchr/testify v1.11.1 - go.opentelemetry.io/contrib/instrumentation/runtime v0.68.0 + go.opentelemetry.io/contrib/instrumentation/runtime v0.69.0 go.opentelemetry.io/otel v1.44.0 go.opentelemetry.io/otel/exporters/prometheus v0.66.0 go.opentelemetry.io/otel/metric v1.44.0 diff --git a/go.sum b/go.sum index d738e87..1898d3a 100644 --- a/go.sum +++ b/go.sum @@ -140,8 +140,8 @@ go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.6 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0/go.mod h1:snMWehoOh2wsEwnvvwtDyFCxVeDAODenXHtn5vzrKjo= go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 h1:F7Jx+6hwnZ41NSFTO5q4LYDtJRXBf2PD0rNBkeB/lus= go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0/go.mod h1:UHB22Z8QsdRDrnAtX4PntOl36ajSxcdUMt1sF7Y6E7Q= -go.opentelemetry.io/contrib/instrumentation/runtime v0.68.0 h1:jhVIQEprwUTV+KfzzliLidclhoTOoHTgdz96kAyR8mU= -go.opentelemetry.io/contrib/instrumentation/runtime v0.68.0/go.mod h1:4HsdbLUbernaTnA8CNaNE+1g026SciXb3juRYe3l8EY= +go.opentelemetry.io/contrib/instrumentation/runtime v0.69.0 h1:MtkMsuRo3zEXTTMALfyrszwCDZTkB6wolyPjbwFAdq0= +go.opentelemetry.io/contrib/instrumentation/runtime v0.69.0/go.mod h1:FYTxnpsm+UPD0erZNq20GvnM8T2YQHiHtT2vokdpoac= go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU= go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc= go.opentelemetry.io/otel/exporters/prometheus v0.66.0 h1:vkrK8PAznv2NKt2r+kdu252ccGzkEqLc2aSXbQIALYQ= From a1ffe33fba05835bb20375c3f1b439b68459bb1c Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 4 Jun 2026 16:02:45 -0400 Subject: [PATCH 236/313] build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.243.0 to 3.244.0 in /deploy (#1333) Bumps [github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from 3.243.0 to 3.244.0.
    Release notes

    Sourced from github.com/pulumi/pulumi/sdk/v3's releases.

    v3.244.0

    3.244.0 (2026-05-28)

    Bug Fixes

    • [cli/do] Fix top level flags like --logtostderr being recognized when using pulumi do #23355
    • [cli/install] Distinguish multiple packages with the same plugin
    • [engine] Fix snapshot integrity issue with up --refresh
    • [engine] Forward all provider errors to error hooks for retry #23347
    • [engine] Trace cancel RPCs sent to plugins during shutdown as children of the active operation instead of emitting separate root spans #23362
    • [sdk/python] Merge requirements.txt into pyproject.toml when using uv without a project section #23340
    Changelog

    Sourced from github.com/pulumi/pulumi/sdk/v3's changelog.

    3.244.0 (2026-05-28)

    Bug Fixes

    • [cli/do] Fix top level flags like --logtostderr being recognized when using pulumi do #23355
    • [cli/install] Distinguish multiple packages with the same plugin
    • [engine] Fix snapshot integrity issue with up --refresh
    • [engine] Forward all provider errors to error hooks for retry #23347
    • [engine] Trace cancel RPCs sent to plugins during shutdown as children of the active operation instead of emitting separate root spans #23362
    • [sdk/python] Merge requirements.txt into pyproject.toml when using uv without a project section #23340
    Commits

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/pulumi/pulumi/sdk/v3&package-manager=go_modules&previous-version=3.243.0&new-version=3.244.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- deploy/go.mod | 2 +- deploy/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index f2e8b8b..6fc92d3 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -5,7 +5,7 @@ go 1.26 require ( github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.31.1 - github.com/pulumi/pulumi/sdk/v3 v3.243.0 + github.com/pulumi/pulumi/sdk/v3 v3.244.0 gopkg.in/yaml.v2 v2.4.0 ) diff --git a/deploy/go.sum b/deploy/go.sum index 8b29f96..dc36d65 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -189,8 +189,8 @@ github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 h1:w6OnO3d4j5yVf2vpm8OzXFC/xHOEGqt+9 github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1/go.mod h1:UyZyv7hz4knpFx6/Sh+SkZe6hT6sJHtDvw9A0TbvEsk= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.31.1 h1:Hg9RK9zqIU9kFbD5KeiON06gPP7cLgS68jvsgMBmPgw= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.31.1/go.mod h1:BAWI9R3JEEGOp1JlXLPSZKwBGANSrPGUWKtMnS5w5qw= -github.com/pulumi/pulumi/sdk/v3 v3.243.0 h1:pZaMx58nXrdh4XB0cgTlHnL3EMy3/JQwuin3aDuWyRM= -github.com/pulumi/pulumi/sdk/v3 v3.243.0/go.mod h1:BPWWuYPXcPH5YbXGoyy9Rrfa+evrh6IdM51AjDhcDpM= +github.com/pulumi/pulumi/sdk/v3 v3.244.0 h1:oyQ9bwDE58wrQOqS70JrojJSlNoLcVhVcQgK4yusgcg= +github.com/pulumi/pulumi/sdk/v3 v3.244.0/go.mod h1:BPWWuYPXcPH5YbXGoyy9Rrfa+evrh6IdM51AjDhcDpM= github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ= github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88= github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ= From 227621f1d0e36db0acd90a89fd77ad4d469a4bf6 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 4 Jun 2026 16:03:35 -0400 Subject: [PATCH 237/313] build(deps): bump github.com/jackc/pgx/v5 from 5.9.2 to 5.10.0 (#1334) Bumps [github.com/jackc/pgx/v5](https://github.com/jackc/pgx) from 5.9.2 to 5.10.0.
    Changelog

    Sourced from github.com/jackc/pgx/v5's changelog.

    5.10.0 (June 3, 2026)

    This release includes a significant amount of hardening against malicious or compromised PostgreSQL servers, contributed by Sean Chittenden at CrowdStrike, Inc. This work bounds binary decoders against attacker-controlled message sizes, caps server-supplied SCRAM iteration counts, adds require_auth to restrict which authentication methods a server may use (mitigating downgrade attacks under sslmode=prefer), and ensures cancellation requests are sent over TLS when the original connection used TLS.

    Features

    • Add require_auth to restrict accepted server authentication methods (Sean Chittenden at CrowdStrike, Inc.)
    • Add ParseConfigOptions.ConnStringAllowedKeys to restrict allowed connection string keys (Sean Chittenden at CrowdStrike, Inc.)
    • Add StructArgs and StrictStructArgs for @-named queries (Tubelight30)
    • Add ErrConnClosed sentinel error and unwrap it from connLockError (Charlie Tonneslan)
    • pgxpool: check if connection is expired before acquire (arthurdotwork)

    Security Hardening

    • Encrypt CancelRequest connection when the primary connection used TLS (Sean Chittenden at CrowdStrike, Inc.)
    • Cap server-supplied SCRAM iteration count (Sean Chittenden at CrowdStrike, Inc.)
    • Default Frontend max message body length to ~1 GiB (Sean Chittenden at CrowdStrike, Inc.)
    • Bound hstore binary decode against malicious server input (Sean Chittenden at CrowdStrike, Inc.)
    • Bound array binary decode element length against remaining message bytes (Sean Chittenden at CrowdStrike, Inc.)
    • Bound array element count against remaining message bytes (Sean Chittenden at CrowdStrike, Inc.)
    • Bound range, multirange, and tsvector binary decoders (Sean Chittenden at CrowdStrike, Inc.)
    • Document secure connection configuration (Sean Chittenden at CrowdStrike, Inc.)
    • Fix panic on malformed geometric text; return an error instead (MaIII)

    Fixes

    • Fix scanning "char" (OID 18) into *string in binary format (luongs3)
    • Fix handling of typed-nil driver.Valuer in array and composite codecs (Donncha Fahy)
    • Fix CopyData.Data hex decoding in UnmarshalJSON (Charlie Tonneslan)
    • Fix data race when context is cancelled during connect
    • Fix parseKeywordValueSettings rejecting trailing whitespace (alliasgher)
    • pgconn: preserve full error chain in normalizeTimeoutError (Charlie Tonneslan)
    • pgconn: use a fresh context for the fallback connection in connectPreferred (Charlie Tonneslan)
    • pgxpool: fix MaxLifetimeDestroyCount and ping order for acquire-time expiry check
    • Add missing error check of rows.Err to load types (Jen Altavilla)
    Commits
    • 7293fb1 Update changelog for v5.10.0
    • 1ade285 pgconn: document secure connection configuration
    • b4d6d4d pgtype: bound range, multirange, and tsvector binary decoders
    • 0639b37 pgconn: add ParseConfigOptions.ConnStringAllowedKeys
    • b28e65b pgtype: bound array element count against remaining message bytes
    • cd1f389 pgtype: bound array binary decode element length against remaining bytes
    • ff27b5b pgtype: bound hstore binary decode against malicious server input
    • a6002e1 pgproto3: default Frontend max message body length to ~1 GiB
    • 44f6173 pgconn: cap server-supplied SCRAM iteration count
    • 1a976f7 pgconn: add require_auth to restrict accepted server auth methods
    • Additional commits viewable in compare view

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/jackc/pgx/v5&package-manager=go_modules&previous-version=5.9.2&new-version=5.10.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 82afd5b..1dbf670 100644 --- a/go.mod +++ b/go.mod @@ -11,7 +11,7 @@ require ( github.com/danielgtaylor/huma/v2 v2.38.0 github.com/golang-jwt/jwt/v5 v5.3.1 github.com/google/go-containerregistry v0.21.6 - github.com/jackc/pgx/v5 v5.9.2 + github.com/jackc/pgx/v5 v5.10.0 github.com/prometheus/client_golang v1.23.2 github.com/rs/cors v1.11.1 github.com/santhosh-tekuri/jsonschema/v5 v5.3.1 diff --git a/go.sum b/go.sum index 1898d3a..af66f73 100644 --- a/go.sum +++ b/go.sum @@ -83,8 +83,8 @@ github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsI github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg= github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo= github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM= -github.com/jackc/pgx/v5 v5.9.2 h1:3ZhOzMWnR4yJ+RW1XImIPsD1aNSz4T4fyP7zlQb56hw= -github.com/jackc/pgx/v5 v5.9.2/go.mod h1:mal1tBGAFfLHvZzaYh77YS/eC6IX9OWbRV1QIIM0Jn4= +github.com/jackc/pgx/v5 v5.10.0 h1:VhSvgU2jSli8o3AqIEOTJr7rZwAEUVo4E4XhR94Zfr0= +github.com/jackc/pgx/v5 v5.10.0/go.mod h1:mal1tBGAFfLHvZzaYh77YS/eC6IX9OWbRV1QIIM0Jn4= github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo= github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4= github.com/keybase/go-keychain v0.0.1 h1:way+bWYa6lDppZoZcgMbYsvC7GxljxrskdNInRtuthU= From 7a6d1bc30a538a4a792e1ccab25680a247acf472 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Thu, 4 Jun 2026 17:34:54 -0400 Subject: [PATCH 238/313] fix(cargo): harden README fetch, clarify status handling, strengthen tests (#1330) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Follow-up to #1207, addressing items from the cargo validator review. **Scoped to cargo + shared helpers — no behavior change for existing npm/pypi/nuget/oci/mcpb publishers.** Safe to merge and promote. ### Changes **SSRF hardening of the two-call README retrieval** - Pin the step-2 README URL to an allowed host (`static.crates.io` in prod; the base host under test) *before* fetching, so a metadata response can't steer the validator at an internal/attacker host. - `CheckRedirect` policy pins every redirect hop to the same allowlist (the initial URL being pinned isn't enough if an upstream 3xx is followed). - Cap the README body with `io.LimitReader` (5 MiB). > Not publisher-exploitable today (the URL comes from crates.io), so this is defense-in-depth — but it makes the "host is pinned" guarantee hold in code rather than rely on crates.io's behavior. **Clearer status handling** (previously any non-5xx/non-200 collapsed to "not found") - **429** → reported as transient/retryable, at both the metadata and README steps. - **403** → disambiguated via the crate-version endpoint: genuinely-missing stays "not found"; *exists-but-no-README* gets an actionable "add a README with `mcp-name` and republish" message (mirrors the NuGet validator). This continues the 5xx-vs-403 diagnostic split @P4ST4S started in the #1207 review — thanks! **Shared `containsMCPNameToken` helper** Boundary-anchored ownership-token match (prevents prefix confusion, e.g. a README declaring `io.github.acme/widget-pro` satisfying a claim for `io.github.acme/widget`), used here **by the cargo validator only**. Adopting it in PyPI/NuGet is a separate follow-up because it's a behavior change for those already-live registries. **Tests & docs** Hermetic positive `ServerNameFormats`; combined fixture gains a version-existence endpoint + cases for 403-missing vs 403-no-README, 429, and prefix-confusion rejection; new foreign-README-host (SSRF) test; internal test for the helper. Docs: list `crates.io` in the registry-requirements list + the `Package` model doc. ### Testing `go build`, `go vet`, full `./internal/validators/...` suite (incl. live cargo positive), `make check-schema`, `validate-examples` all pass. No new `golangci-lint` findings. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.8 (1M context) --- .../official-registry-requirements.md | 1 + internal/validators/registries/cargo.go | 183 +++++++++++++++--- internal/validators/registries/cargo_test.go | 143 +++++++++++--- internal/validators/registries/mcpname.go | 53 +++++ .../registries/mcpname_internal_test.go | 35 ++++ pkg/model/types.go | 7 +- 6 files changed, 370 insertions(+), 52 deletions(-) create mode 100644 internal/validators/registries/mcpname.go create mode 100644 internal/validators/registries/mcpname_internal_test.go diff --git a/docs/reference/server-json/official-registry-requirements.md b/docs/reference/server-json/official-registry-requirements.md index e03b659..886aee0 100644 --- a/docs/reference/server-json/official-registry-requirements.md +++ b/docs/reference/server-json/official-registry-requirements.md @@ -33,6 +33,7 @@ Only trusted public registries are supported. Private registries and alternative - **NPM**: `https://registry.npmjs.org` only - **PyPI**: `https://pypi.org` only - **NuGet**: `https://api.nuget.org/v3/index.json` only +- **Cargo**: `https://crates.io` only - **Docker/OCI**: - Docker Hub (`docker.io`) - GitHub Container Registry (`ghcr.io`) diff --git a/internal/validators/registries/cargo.go b/internal/validators/registries/cargo.go index 18f7c0f..d90af77 100644 --- a/internal/validators/registries/cargo.go +++ b/internal/validators/registries/cargo.go @@ -8,7 +8,6 @@ import ( "io" "net/http" "net/url" - "strings" "time" "github.com/modelcontextprotocol/registry/pkg/model" @@ -19,6 +18,19 @@ var ( ErrMissingVersionForCargo = errors.New("package version is required for Cargo packages") ) +// cargoUserAgent identifies the validator to crates.io. crates.io's crawler +// policy expects a non-generic User-Agent with a contact URL; a bare UA may be +// rate-limited or blocked. (Distinct from the package-level userAgent constant +// used by the NuGet validator, which has no contact URL.) +const cargoUserAgent = "MCP-Registry-Validator/1.0 (https://registry.modelcontextprotocol.io)" + +// cargoStaticHost is the CDN host crates.io serves rendered READMEs from. +const cargoStaticHost = "static.crates.io" + +// maxCargoReadmeBytes caps how much of a rendered README we buffer, so a hostile +// or oversized response cannot exhaust validator memory. +const maxCargoReadmeBytes = 5 << 20 // 5 MiB + // CargoReadmeMetaResponse is the structure returned by the crates.io readme metadata endpoint. // // With `Accept: application/json`, crates.io's /api/v1/crates/{name}/{version}/readme @@ -74,14 +86,134 @@ func ValidateCargo(ctx context.Context, pkg model.Package, serverName string) er return validateCargoREADME(ctx, pkg, serverName) } +// cargoAllowedHosts returns the set of hosts the validator is permitted to talk +// to for a given base URL. For the real crates.io base this is crates.io (the API) +// plus static.crates.io (the rendered-README CDN). For any other base — only the +// httptest-driven tests, since the public ValidateCargo pins the base to +// crates.io — it is the base host itself, so mock servers keep working. +// +// This is the allowlist enforced both on the README pointer (step 2 URL) and on +// every redirect hop, so a metadata response or redirect cannot steer the +// validator at an internal or attacker-chosen host (SSRF). +func cargoAllowedHosts(baseURL string) map[string]struct{} { + hosts := map[string]struct{}{} + if u, err := url.Parse(baseURL); err == nil && u.Hostname() != "" { + hosts[u.Hostname()] = struct{}{} + } + if baseURL == model.RegistryURLCrates { + hosts[cargoStaticHost] = struct{}{} + } + return hosts +} + +// newCargoHTTPClient builds the client used for all crates.io calls. The +// CheckRedirect policy pins every redirect hop to allowedHosts, so even though +// the initial URL is host-pinned, an upstream 3xx cannot redirect the validator +// to an unexpected host. +func newCargoHTTPClient(allowedHosts map[string]struct{}) *http.Client { + return &http.Client{ + Timeout: 10 * time.Second, + CheckRedirect: func(req *http.Request, via []*http.Request) error { + if _, ok := allowedHosts[req.URL.Hostname()]; !ok { + return fmt.Errorf("refusing redirect to unexpected host %q", req.URL.Hostname()) + } + if len(via) >= 10 { + return errors.New("stopped after 10 redirects") + } + return nil + }, + } +} + +// cargoVersionExists checks whether a specific crate version exists on crates.io, +// used to disambiguate a 403 from the README CDN. static.crates.io (S3) returns +// 403 both for a genuinely-missing crate/version AND for a crate that exists but +// has no rendered README, so a 403 alone cannot tell a publisher which it is. +// +// Returns (exists, determined): determined is false if the existence endpoint +// itself was unreachable or returned an unexpected status, in which case the +// caller should fall back to a generic message rather than assert existence. +func cargoVersionExists(ctx context.Context, client *http.Client, baseURL, identifier, version string) (exists, determined bool) { + versionURL := fmt.Sprintf("%s/api/v1/crates/%s/%s", + baseURL, url.PathEscape(identifier), url.PathEscape(version)) + req, err := http.NewRequestWithContext(ctx, http.MethodGet, versionURL, nil) + if err != nil { + return false, false + } + req.Header.Set("User-Agent", cargoUserAgent) + req.Header.Set("Accept", "application/json") + + resp, err := client.Do(req) + if err != nil { + return false, false + } + defer resp.Body.Close() + + switch resp.StatusCode { + case http.StatusOK: + return true, true + case http.StatusNotFound: + return false, true + default: + return false, false + } +} + +// cargoMetadataStatusError maps a non-200 status from the metadata endpoint to a +// caller-actionable error, distinguishing transient upstream conditions (429, +// 5xx) from a genuine fetch failure. +func cargoMetadataStatusError(identifier string, status int) error { + switch { + case status == http.StatusTooManyRequests: + return fmt.Errorf("crates.io rate-limited the metadata request for cargo package '%s' (status: 429) — likely transient, retry later", identifier) + case status >= 500 && status < 600: + return fmt.Errorf("crates.io upstream error fetching metadata for cargo package '%s' (status: %d) — likely transient, retry later", identifier, status) + default: + return fmt.Errorf("cargo package '%s' metadata fetch failed (status: %d)", identifier, status) + } +} + +// cargoReadmeStatusError maps a non-200 status from the README CDN to a +// caller-actionable error. 429/5xx are transient; 403 is disambiguated (see +// cargoReadme403Error) because static.crates.io returns it both for a missing +// crate/version and for a crate that has no rendered README. +func cargoReadmeStatusError(ctx context.Context, client *http.Client, pkg model.Package, serverName string, status int) error { + switch { + case status == http.StatusTooManyRequests: + return fmt.Errorf("crates.io rate-limited the README fetch for cargo package '%s' version '%s' (status: 429) — likely transient, retry later", pkg.Identifier, pkg.Version) + case status >= 500 && status < 600: + return fmt.Errorf("crates.io upstream error fetching README for cargo package '%s' version '%s' (status: %d) — likely transient, retry later", pkg.Identifier, pkg.Version, status) + case status == http.StatusForbidden: + return cargoReadme403Error(ctx, client, pkg, serverName) + default: + return fmt.Errorf("cargo package '%s' version '%s' README fetch failed (status: %d)", pkg.Identifier, pkg.Version, status) + } +} + +// cargoReadme403Error disambiguates a 403 from static.crates.io (S3's default +// for a missing key): a genuinely-missing crate/version versus a crate that +// exists but has no rendered README. It probes the crate-version metadata +// endpoint so the publisher gets an actionable message rather than a blanket +// "not found". +func cargoReadme403Error(ctx context.Context, client *http.Client, pkg model.Package, serverName string) error { + exists, determined := cargoVersionExists(ctx, client, pkg.RegistryBaseURL, pkg.Identifier, pkg.Version) + switch { + case determined && exists: + return fmt.Errorf("cargo package '%s' version '%s' exists on crates.io but has no rendered README. Add a README containing 'mcp-name: %s' and publish a new version", pkg.Identifier, pkg.Version, serverName) + case determined && !exists: + return fmt.Errorf("cargo package '%s' version '%s' not found on crates.io", pkg.Identifier, pkg.Version) + default: + return fmt.Errorf("cargo package '%s' version '%s' not found on crates.io (status: 403)", pkg.Identifier, pkg.Version) + } +} + // validateCargoREADME performs the two-call README fetch and the mcp-name token // check. It is split out from ValidateCargo so that httptest-based tests can // drive the HTTP pipeline against a mock server (exposed via export_test.go), // bypassing the exact-baseURL guard that ValidateCargo enforces for callers. func validateCargoREADME(ctx context.Context, pkg model.Package, serverName string) error { - client := &http.Client{Timeout: 10 * time.Second} - // crates.io's crawler policy expects a non-generic User-Agent identifying the source. - userAgent := "MCP-Registry-Validator/1.0 (https://registry.modelcontextprotocol.io)" + allowedHosts := cargoAllowedHosts(pkg.RegistryBaseURL) + client := newCargoHTTPClient(allowedHosts) // Step 1: fetch the README pointer from the documented API endpoint. metaURL := fmt.Sprintf("%s/api/v1/crates/%s/%s/readme", @@ -93,7 +225,7 @@ func validateCargoREADME(ctx context.Context, pkg model.Package, serverName stri if err != nil { return fmt.Errorf("failed to create crates.io metadata request: %w", err) } - metaReq.Header.Set("User-Agent", userAgent) + metaReq.Header.Set("User-Agent", cargoUserAgent) metaReq.Header.Set("Accept", "application/json") metaResp, err := client.Do(metaReq) @@ -103,11 +235,7 @@ func validateCargoREADME(ctx context.Context, pkg model.Package, serverName stri defer metaResp.Body.Close() if metaResp.StatusCode != http.StatusOK { - // 5xx from the metadata endpoint is upstream availability, not a missing crate. - if metaResp.StatusCode >= 500 && metaResp.StatusCode < 600 { - return fmt.Errorf("crates.io upstream error fetching metadata for cargo package '%s' (status: %d) — likely transient, retry later", pkg.Identifier, metaResp.StatusCode) - } - return fmt.Errorf("cargo package '%s' metadata fetch failed (status: %d)", pkg.Identifier, metaResp.StatusCode) + return cargoMetadataStatusError(pkg.Identifier, metaResp.StatusCode) } var meta CargoReadmeMetaResponse @@ -118,12 +246,22 @@ func validateCargoREADME(ctx context.Context, pkg model.Package, serverName stri return fmt.Errorf("cargo package '%s' metadata response missing 'url' field", pkg.Identifier) } - // Step 2: fetch the rendered README from the URL the API gave us. + // Pin the README pointer to an allowed host before fetching it, so a metadata + // response cannot steer the validator at an internal or attacker-chosen host. + readmeParsed, err := url.Parse(meta.URL) + if err != nil || readmeParsed.Hostname() == "" { + return fmt.Errorf("cargo package '%s': crates.io returned an unparseable README URL", pkg.Identifier) + } + if _, ok := allowedHosts[readmeParsed.Hostname()]; !ok { + return fmt.Errorf("cargo package '%s': crates.io returned a README URL on unexpected host %q — refusing to fetch", pkg.Identifier, readmeParsed.Hostname()) + } + + // Step 2: fetch the rendered README from the (now host-validated) URL. readmeReq, err := http.NewRequestWithContext(ctx, http.MethodGet, meta.URL, nil) if err != nil { return fmt.Errorf("failed to create crates.io readme request: %w", err) } - readmeReq.Header.Set("User-Agent", userAgent) + readmeReq.Header.Set("User-Agent", cargoUserAgent) readmeReq.Header.Set("Accept", "text/html") readmeResp, err := client.Do(readmeReq) @@ -132,27 +270,20 @@ func validateCargoREADME(ctx context.Context, pkg model.Package, serverName stri } defer readmeResp.Body.Close() - // Missing crates and missing versions surface as 403 from static.crates.io - // (S3's default for missing keys), not 404. 5xx from the CDN is upstream - // availability — surface it as transient so callers can distinguish retryable - // failures from genuinely missing crates. if readmeResp.StatusCode != http.StatusOK { - if readmeResp.StatusCode >= 500 && readmeResp.StatusCode < 600 { - return fmt.Errorf("crates.io upstream error fetching README for cargo package '%s' version '%s' (status: %d) — likely transient, retry later", pkg.Identifier, pkg.Version, readmeResp.StatusCode) - } - return fmt.Errorf("cargo package '%s' version '%s' not found on crates.io (status: %d)", pkg.Identifier, pkg.Version, readmeResp.StatusCode) + return cargoReadmeStatusError(ctx, client, pkg, serverName, readmeResp.StatusCode) } - body, err := io.ReadAll(readmeResp.Body) + body, err := io.ReadAll(io.LimitReader(readmeResp.Body, maxCargoReadmeBytes)) if err != nil { return fmt.Errorf("failed to read rendered README: %w", err) } - // Search for the mcp-name: token. The token contains no characters - // that get HTML-escaped during README rendering (no <, >, &, ", '), so a direct - // substring match against the rendered HTML is reliable. - mcpNamePattern := "mcp-name: " + serverName - if strings.Contains(string(body), mcpNamePattern) { + // Search for the mcp-name: ownership token. The token contains no + // characters that get HTML-escaped during README rendering (no <, >, &, ", '), + // so matching against the rendered HTML is reliable; containsMCPNameToken + // additionally requires a trailing boundary to avoid prefix confusion. + if containsMCPNameToken(string(body), serverName) { return nil } diff --git a/internal/validators/registries/cargo_test.go b/internal/validators/registries/cargo_test.go index e06d099..d2c8128 100644 --- a/internal/validators/registries/cargo_test.go +++ b/internal/validators/registries/cargo_test.go @@ -151,10 +151,11 @@ func TestValidateCargo_RejectsMCPBOnlyFields(t *testing.T) { // Server names follow io.github.OWNER/REPO and may contain dots, slashes, // hyphens, underscores, and digits. None of these get HTML-escaped during -// README rendering, so substring match against the rendered HTML is reliable. -// These tests exercise format variations against a real crate that doesn't -// declare any mcp-name (serde) — every case fails ownership, but we verify -// the failure error preserves the exact server name unchanged. +// README rendering, so a boundary-anchored match against the rendered HTML is +// reliable. This is a hermetic POSITIVE test: each format variation is placed in +// a mock README as the exact mcp-name token and must validate successfully, so +// it actually exercises the match (the earlier version used a token-less live +// crate, where every case failed and the assertion was satisfied trivially). func TestValidateCargo_ServerNameFormats(t *testing.T) { ctx := context.Background() @@ -166,19 +167,33 @@ func TestValidateCargo_ServerNameFormats(t *testing.T) { {name: "multiple hyphens", serverName: "io.github.example/multi-hyphen-test-name"}, {name: "underscore", serverName: "io.github.example/snake_case_name"}, {name: "numeric suffix", serverName: "io.github.example/server-v2"}, + {name: "dotted name segment", serverName: "io.github.example/group.tool"}, } for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { + serverName := tt.serverName + var mock *httptest.Server + mock = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + if strings.HasSuffix(r.URL.Path, "/readme") { + w.Header().Set("Content-Type", "application/json") + _ = json.NewEncoder(w).Encode(map[string]string{"url": mock.URL + "/static-readme"}) + return + } + // Token on its own line; the trailing newline is the boundary. + fmt.Fprintf(w, "\nmcp-name: %s\n", serverName) + })) + defer mock.Close() + pkg := model.Package{ - RegistryType: model.RegistryTypeCargo, - Identifier: "serde", - Version: "1.0.219", + RegistryType: model.RegistryTypeCargo, + RegistryBaseURL: mock.URL, + Identifier: "fmt-crate", + Version: "0.1.0", } - err := registries.ValidateCargo(ctx, pkg, tt.serverName) - assert.Error(t, err) - assert.Contains(t, err.Error(), tt.serverName) + err := registries.ValidateCargoREADME(ctx, pkg, serverName) + assert.NoError(t, err, "server name %q should validate when present as an exact mcp-name token", serverName) }) } } @@ -197,11 +212,10 @@ func TestValidateCargo_PositivePathMock(t *testing.T) { mock = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { if strings.HasSuffix(r.URL.Path, "/readme") { w.Header().Set("Content-Type", "application/json") - if err := json.NewEncoder(w).Encode(map[string]string{ - "url": mock.URL + "/static-readme", - }); err != nil { - t.Fatalf("encode meta response: %v", err) - } + // Encode of a static map cannot fail; ignore the error rather than + // calling t.Fatalf from this (server) goroutine, which is not the test + // goroutine and would truncate the response instead of failing cleanly. + _ = json.NewEncoder(w).Encode(map[string]string{"url": mock.URL + "/static-readme"}) return } // Rendered README HTML containing the mcp-name token. @@ -280,6 +294,34 @@ func TestValidateCargo_TransientUpstreamError(t *testing.T) { assert.NotContains(t, err.Error(), "not found", "transient upstream errors should not be reported as 'not found'") } +// TestValidateCargo_RejectsForeignReadmeHost is the SSRF guard: the README +// pointer returned by the metadata endpoint must be on an allowed host. Here the +// (mock) metadata endpoint points the README at an unrelated host; the validator +// must refuse to fetch it rather than follow the pointer anywhere crates.io names. +// The ".invalid" host never resolves, so a regression that dropped the host check +// would fail to connect rather than silently pass — but the assertion targets the +// explicit "unexpected host" refusal, which happens before any fetch. +func TestValidateCargo_RejectsForeignReadmeHost(t *testing.T) { + ctx := context.Background() + + mock := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) { + w.Header().Set("Content-Type", "application/json") + _ = json.NewEncoder(w).Encode(map[string]string{"url": "http://internal.invalid/secret-readme"}) + })) + defer mock.Close() + + pkg := model.Package{ + RegistryType: model.RegistryTypeCargo, + RegistryBaseURL: mock.URL, + Identifier: "evil-crate", + Version: "0.1.0", + } + + err := registries.ValidateCargoREADME(ctx, pkg, "io.github.test/evil") + assert.Error(t, err) + assert.Contains(t, err.Error(), "unexpected host", "a README URL on a foreign host must be refused (SSRF guard)") +} + // TestValidateCargoCombinedFixture exercises path-encoding and the full status // matrix in one httptest fixture — the same pattern praised by @P4ST4S on // PR #1321 for Go modules. One server dispatches on the crate identifier @@ -297,6 +339,7 @@ func TestValidateCargoCombinedFixture(t *testing.T) { metaStatus int readmeStatus int readmeBody string + versionExists bool // response for the /api/v1/crates/{n}/{v} existence probe (403 disambiguation) wantErr bool wantContains []string wantNotContains []string @@ -310,7 +353,11 @@ func TestValidateCargoCombinedFixture(t *testing.T) { readmeBody: fmt.Sprintf("

    mcp-name: %s

    ", serverName), }, { - name: "metadata_404", + // Defensive branch: crates.io's metadata endpoint returns 200 (with a + // CDN url) even for missing crates, so it does NOT 404 in practice for a + // missing crate — the real missing-crate path is readme_403_missing below. + // This case only covers what we'd report if the API ever did 404. + name: "metadata_404_defensive", crateName: "combined-meta404", version: "0.1.0", metaStatus: http.StatusNotFound, @@ -318,13 +365,39 @@ func TestValidateCargoCombinedFixture(t *testing.T) { wantContains: []string{"metadata fetch failed", "status: 404"}, }, { - name: "readme_403_s3_not_found", - crateName: "combined-readme403", - version: "0.1.0", - metaStatus: http.StatusOK, - readmeStatus: http.StatusForbidden, - wantErr: true, - wantContains: []string{"not found", "status: 403"}, + // Real missing-crate/version path: CDN 403 + existence probe 404. + name: "readme_403_missing", + crateName: "combined-readme403-missing", + version: "0.1.0", + metaStatus: http.StatusOK, + readmeStatus: http.StatusForbidden, + versionExists: false, + wantErr: true, + wantContains: []string{"not found"}, + wantNotContains: []string{"has no rendered README"}, + }, + { + // Crate/version exists but has no rendered README: CDN 403 + existence + // probe 200. Must NOT be reported as "not found". + name: "readme_403_no_readme", + crateName: "combined-readme403-noreadme", + version: "0.1.0", + metaStatus: http.StatusOK, + readmeStatus: http.StatusForbidden, + versionExists: true, + wantErr: true, + wantContains: []string{"has no rendered README"}, + wantNotContains: []string{"not found"}, + }, + { + name: "readme_429_transient", + crateName: "combined-readme429", + version: "0.1.0", + metaStatus: http.StatusOK, + readmeStatus: http.StatusTooManyRequests, + wantErr: true, + wantContains: []string{"transient"}, + wantNotContains: []string{"not found"}, }, { name: "readme_502_transient", @@ -336,6 +409,18 @@ func TestValidateCargoCombinedFixture(t *testing.T) { wantContains: []string{"transient"}, wantNotContains: []string{"not found"}, }, + { + // Prefix confusion: README declares a LONGER name; a claim for the + // shorter serverName must be rejected by the boundary-anchored match. + name: "prefix_confusion_rejected", + crateName: "combined-prefix", + version: "0.1.0", + metaStatus: http.StatusOK, + readmeStatus: http.StatusOK, + readmeBody: fmt.Sprintf("

    mcp-name: %s-extended

    ", serverName), + wantErr: true, + wantContains: []string{"ownership validation failed"}, + }, } // lastMetaPath captures the metadata request path seen by the handler so @@ -349,6 +434,8 @@ func TestValidateCargoCombinedFixture(t *testing.T) { tt := &tests[i] metaPath := fmt.Sprintf("/api/v1/crates/%s/%s/readme", url.PathEscape(tt.crateName), url.PathEscape(tt.version)) + versionPath := fmt.Sprintf("/api/v1/crates/%s/%s", + url.PathEscape(tt.crateName), url.PathEscape(tt.version)) staticPath := "/readme-static/" + url.PathEscape(tt.crateName) if r.URL.Path == metaPath { @@ -361,6 +448,16 @@ func TestValidateCargoCombinedFixture(t *testing.T) { _ = json.NewEncoder(w).Encode(map[string]string{"url": srv.URL + staticPath}) return } + // Existence probe used to disambiguate a README 403. + if r.URL.Path == versionPath { + if tt.versionExists { + w.Header().Set("Content-Type", "application/json") + _ = json.NewEncoder(w).Encode(map[string]any{"version": map[string]string{"num": tt.version}}) + } else { + http.Error(w, "not found", http.StatusNotFound) + } + return + } if r.URL.Path == staticPath { if tt.readmeStatus != http.StatusOK { http.Error(w, "simulated non-200", tt.readmeStatus) diff --git a/internal/validators/registries/mcpname.go b/internal/validators/registries/mcpname.go new file mode 100644 index 0000000..a757db3 --- /dev/null +++ b/internal/validators/registries/mcpname.go @@ -0,0 +1,53 @@ +package registries + +import "strings" + +// isServerNameChar reports whether c can appear in an MCP server name. +// +// Server names follow the schema pattern ^[a-zA-Z0-9.-]+/[a-zA-Z0-9._-]+$ +// (reverse-DNS namespace + "/" + name), so the full set of characters that may +// continue a server name is [A-Za-z0-9._/-]. +func isServerNameChar(c byte) bool { + switch { + case c >= 'a' && c <= 'z', c >= 'A' && c <= 'Z', c >= '0' && c <= '9': + return true + case c == '.', c == '-', c == '_', c == '/': + return true + default: + return false + } +} + +// containsMCPNameToken reports whether the package README/description contains +// the ownership token "mcp-name: " as a complete token — i.e. the +// matched server name is not merely a prefix of a longer declared name. +// +// A bare strings.Contains check is vulnerable to prefix confusion: a README that +// legitimately declares `mcp-name: io.github.acme/widget-pro` would otherwise +// satisfy an ownership claim for the shorter `io.github.acme/widget`, because the +// shorter string is a substring of the longer one. This is contained by namespace +// authorization (a publisher can only claim names within a namespace they own), +// but it still weakens the crate↔server-name binding the token is meant to prove, +// so we require a trailing boundary: the character following the server name must +// be the end of the content or any non-server-name character (whitespace, a +// newline, or an HTML tag delimiter from a rendered README such as `<`). +// +// Shared by the README-token validators (PyPI, NuGet, Cargo). NPM is unaffected +// because it compares an exact metadata field rather than scanning README text. +func containsMCPNameToken(content, serverName string) bool { + token := "mcp-name: " + serverName + searchFrom := 0 + for { + idx := strings.Index(content[searchFrom:], token) + if idx < 0 { + return false + } + tokenEnd := searchFrom + idx + len(token) + if tokenEnd >= len(content) || !isServerNameChar(content[tokenEnd]) { + return true + } + // This occurrence is a prefix of a longer name; keep scanning in case a + // properly-terminated occurrence appears later in the content. + searchFrom = searchFrom + idx + 1 + } +} diff --git a/internal/validators/registries/mcpname_internal_test.go b/internal/validators/registries/mcpname_internal_test.go new file mode 100644 index 0000000..0d69352 --- /dev/null +++ b/internal/validators/registries/mcpname_internal_test.go @@ -0,0 +1,35 @@ +package registries + +import "testing" + +// TestContainsMCPNameToken covers the boundary-anchored ownership-token match +// shared by the PyPI, NuGet, and Cargo validators — in particular that a server +// name which is a prefix of a longer declared name does not satisfy the match. +func TestContainsMCPNameToken(t *testing.T) { + const name = "io.github.acme/widget" + + cases := []struct { + desc string + content string + want bool + }{ + {"exact on its own line", "intro text\nmcp-name: io.github.acme/widget\nmore text", true}, + {"exact at end of content", "mcp-name: io.github.acme/widget", true}, + {"followed by HTML tag", "

    mcp-name: io.github.acme/widget

    ", true}, + {"followed by space", "mcp-name: io.github.acme/widget is the name", true}, + {"longer hyphenated name not a match", "mcp-name: io.github.acme/widget-pro\n", false}, + {"longer dotted name not a match", "mcp-name: io.github.acme/widget.core\n", false}, + {"longer slashed name not a match", "mcp-name: io.github.acme/widget/sub\n", false}, + {"absent", "nothing to see here", false}, + {"different name", "mcp-name: io.github.other/thing\n", false}, + {"prefix occurrence before a real one still matches", "mcp-name: io.github.acme/widget-pro then mcp-name: io.github.acme/widget\n", true}, + } + + for _, tc := range cases { + t.Run(tc.desc, func(t *testing.T) { + if got := containsMCPNameToken(tc.content, name); got != tc.want { + t.Fatalf("containsMCPNameToken(%q, %q) = %v, want %v", tc.content, name, got, tc.want) + } + }) + } +} diff --git a/pkg/model/types.go b/pkg/model/types.go index b0bf8e4..e9ade02 100644 --- a/pkg/model/types.go +++ b/pkg/model/types.go @@ -22,12 +22,13 @@ type Transport struct { // - NPM: RegistryType, Identifier (package name), Version, RegistryBaseURL (optional) // - PyPI: RegistryType, Identifier (package name), Version, RegistryBaseURL (optional) // - NuGet: RegistryType, Identifier (package ID), Version, RegistryBaseURL (optional) +// - Cargo: RegistryType, Identifier (crate name), Version, RegistryBaseURL (optional) // - OCI: RegistryType, Identifier (full image reference like "ghcr.io/owner/repo:tag") // - MCPB: RegistryType, Identifier (download URL), Version (optional), FileSHA256 (required) type Package struct { - // RegistryType indicates how to download packages (e.g., "npm", "pypi", "oci", "nuget", "mcpb") - RegistryType string `json:"registryType" minLength:"1" doc:"Registry type indicating how to download packages (e.g., 'npm', 'pypi', 'oci', 'nuget', 'mcpb')" example:"npm"` - // RegistryBaseURL is the base URL of the package registry (used by npm, pypi, nuget; not used by oci, mcpb) + // RegistryType indicates how to download packages (e.g., "npm", "pypi", "cargo", "oci", "nuget", "mcpb") + RegistryType string `json:"registryType" minLength:"1" doc:"Registry type indicating how to download packages (e.g., 'npm', 'pypi', 'cargo', 'oci', 'nuget', 'mcpb')" example:"npm"` + // RegistryBaseURL is the base URL of the package registry (used by npm, pypi, nuget, cargo; not used by oci, mcpb) RegistryBaseURL string `json:"registryBaseUrl,omitempty" format:"uri" doc:"Base URL of the package registry" example:"https://registry.npmjs.org"` // Identifier is the package identifier: // - For NPM/PyPI/NuGet: package name or ID From 04623ed9250f633a9bf80f60e8ad2b6a46d049d6 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Fri, 5 Jun 2026 02:28:41 -0400 Subject: [PATCH 239/313] fix(validators): harden mcp-name matching (PyPI/NuGet anchoring, comment-form safe) + cargo follow-ups (#1331) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Registry-wide hardening of the `mcp-name:` ownership-token match, plus the cargo follow-up fixes from the #1330 review — consolidated here per maintainer request. Rebased onto current `main` (the merged #1330 cargo commit drops out), so the diff is just the net-new work. ### Changes - **PyPI/NuGet: boundary-anchored token match.** Replace `strings.Contains(readme, "mcp-name: "+name)` with the shared `containsMCPNameToken`, so a README declaring a longer name (`…/widget-pro`) no longer satisfies an ownership claim for a shorter prefix (`…/widget`). (Cargo already got this in #1330; NPM is unaffected — it compares an exact metadata field.) - **Matcher: treat the HTML comment close as a boundary.** `` / `` (any spacing) validate again — the documented hidden-comment form for PyPI/NuGet — while a genuine longer name (`…/widget--pro`) still does not. - **Cargo hardening (review of #1330):** pin scheme+port (not just host) on the README fetch and redirects; a rate-limited/failed crate-version existence probe now reports *transient* instead of "not found"; a 403 with the crate present no longer flatly asserts "no README". - **Docs:** note the token must be followed by a boundary. ### ⚠️ Behavior change for PyPI/NuGet — read before merging The match is **strictly stricter** (verified by fuzz, 2.3M execs: it can only flip pass→fail, never fail→pass). After the comment-close fix, the **only** forms that newly fail are unusual *inline* ones: the token ending a sentence (`…/my-mcp.`) or glued to a trailing `/`. The documented forms (own line, in ``) are unaffected. **Correcting an earlier claim:** this re-validates on **edits too**, not just new versions — `edit.go → UpdateServer → ValidateUpdateRequest → validateRegistryOwnership` runs the token check on any edit of a live server (only delete-transitions skip it). So an existing PyPI/NuGet server whose README uses one of the breaking inline forms would fail on its next publish *or* edit. Given the v0.1 API-freeze posture, this should land as a deliberate, noted change. ### Testing `go build`, `vet`, `gofmt`, `golangci-lint` (prod files), `check-schema`, `validate-examples` all clean. Hermetic + **live** PyPI/NuGet/cargo suite passes. New: `TestCargoURLAllowed`, a combined-fixture probe-429→transient case, comment-form matcher cases, and `FuzzContainsMCPNameToken` (the strictly-stricter property, 2.3M execs). 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.8 (1M context) --- .../modelcontextprotocol-io/package-types.mdx | 4 + internal/validators/registries/cargo.go | 120 +++++++++++++----- .../registries/cargo_internal_test.go | 47 +++++++ internal/validators/registries/cargo_test.go | 40 +++++- internal/validators/registries/mcpname.go | 54 +++++++- .../registries/mcpname_internal_test.go | 71 ++++++++++- internal/validators/registries/nuget.go | 16 ++- internal/validators/registries/pypi.go | 15 ++- 8 files changed, 312 insertions(+), 55 deletions(-) create mode 100644 internal/validators/registries/cargo_internal_test.go diff --git a/docs/modelcontextprotocol-io/package-types.mdx b/docs/modelcontextprotocol-io/package-types.mdx index 6cac890..0367fac 100644 --- a/docs/modelcontextprotocol-io/package-types.mdx +++ b/docs/modelcontextprotocol-io/package-types.mdx @@ -87,6 +87,8 @@ This MCP server executes SQL queries and manages database connections. ``` +The `mcp-name:` token must be followed by a boundary — a newline, whitespace, an HTML tag, or the comment close `-->`. Keep it on its own line or inside ``; do not glue it directly to trailing characters such as a sentence-ending period (`…/database-query-mcp.`), which prevents the match. + ## NuGet Packages For NuGet packages, the MCP Registry currently supports the official NuGet registry (`https://api.nuget.org/v3/index.json`) only. @@ -125,6 +127,8 @@ This MCP server manages Azure DevOps work items and pipelines. ``` +The `mcp-name:` token must be followed by a boundary — a newline, whitespace, an HTML tag, or the comment close `-->`. Keep it on its own line or inside ``; do not glue it directly to trailing characters such as a sentence-ending period (`…/azure-devops-mcp.`), which prevents the match. + ## Cargo (Rust) Packages For Cargo packages, the MCP Registry currently supports the official crates.io registry (`https://crates.io`) only. diff --git a/internal/validators/registries/cargo.go b/internal/validators/registries/cargo.go index d90af77..5aa72b1 100644 --- a/internal/validators/registries/cargo.go +++ b/internal/validators/registries/cargo.go @@ -106,16 +106,37 @@ func cargoAllowedHosts(baseURL string) map[string]struct{} { return hosts } +// cargoURLAllowed reports whether u is a URL the validator may fetch for the +// given base. The host must be in allowedHosts; additionally, for the real +// crates.io base, the scheme must be https and the port must be the default — +// so a metadata response or redirect cannot downgrade to http or steer the +// validator at a non-standard port on an otherwise-trusted host. For test bases +// (httptest servers) only the host is checked, so mocks keep working. +func cargoURLAllowed(u *url.URL, baseURL string, allowedHosts map[string]struct{}) bool { + if _, ok := allowedHosts[u.Hostname()]; !ok { + return false + } + if baseURL == model.RegistryURLCrates { + if u.Scheme != "https" { + return false + } + if p := u.Port(); p != "" && p != "443" { + return false + } + } + return true +} + // newCargoHTTPClient builds the client used for all crates.io calls. The -// CheckRedirect policy pins every redirect hop to allowedHosts, so even though -// the initial URL is host-pinned, an upstream 3xx cannot redirect the validator -// to an unexpected host. -func newCargoHTTPClient(allowedHosts map[string]struct{}) *http.Client { +// CheckRedirect policy pins every redirect hop via cargoURLAllowed, so even +// though the initial URL is checked, an upstream 3xx cannot redirect the +// validator to an unexpected host, scheme, or port. +func newCargoHTTPClient(baseURL string, allowedHosts map[string]struct{}) *http.Client { return &http.Client{ Timeout: 10 * time.Second, CheckRedirect: func(req *http.Request, via []*http.Request) error { - if _, ok := allowedHosts[req.URL.Hostname()]; !ok { - return fmt.Errorf("refusing redirect to unexpected host %q", req.URL.Hostname()) + if !cargoURLAllowed(req.URL, baseURL, allowedHosts) { + return fmt.Errorf("refusing redirect to unexpected URL %q", req.URL.Redacted()) } if len(via) >= 10 { return errors.New("stopped after 10 redirects") @@ -125,37 +146,53 @@ func newCargoHTTPClient(allowedHosts map[string]struct{}) *http.Client { } } -// cargoVersionExists checks whether a specific crate version exists on crates.io, -// used to disambiguate a 403 from the README CDN. static.crates.io (S3) returns -// 403 both for a genuinely-missing crate/version AND for a crate that exists but -// has no rendered README, so a 403 alone cannot tell a publisher which it is. -// -// Returns (exists, determined): determined is false if the existence endpoint -// itself was unreachable or returned an unexpected status, in which case the -// caller should fall back to a generic message rather than assert existence. -func cargoVersionExists(ctx context.Context, client *http.Client, baseURL, identifier, version string) (exists, determined bool) { +// cargoVersionState is the outcome of probing the crate-version metadata +// endpoint, used to disambiguate a 403 from the README CDN. +type cargoVersionState int + +const ( + // cargoVersionUnknown: the probe returned an unexpected status we can't classify. + cargoVersionUnknown cargoVersionState = iota + // cargoVersionExists: the crate version exists (200). + cargoVersionExists + // cargoVersionMissing: the crate version does not exist (404). + cargoVersionMissing + // cargoVersionTransient: the probe failed for a retryable reason (network + // error, 429, or 5xx) — existence is undetermined and the caller should not + // report "not found". + cargoVersionTransient +) + +// probeCargoVersion checks whether a specific crate version exists on crates.io. +// static.crates.io (S3) returns 403 both for a genuinely-missing crate/version +// AND for a crate that exists but has no rendered README, so a 403 from the CDN +// alone cannot tell a publisher which it is; this probe disambiguates, while +// distinguishing a transient failure from a definitive missing/exists answer. +func probeCargoVersion(ctx context.Context, client *http.Client, baseURL, identifier, version string) cargoVersionState { versionURL := fmt.Sprintf("%s/api/v1/crates/%s/%s", baseURL, url.PathEscape(identifier), url.PathEscape(version)) req, err := http.NewRequestWithContext(ctx, http.MethodGet, versionURL, nil) if err != nil { - return false, false + return cargoVersionUnknown } req.Header.Set("User-Agent", cargoUserAgent) req.Header.Set("Accept", "application/json") resp, err := client.Do(req) if err != nil { - return false, false + return cargoVersionTransient } defer resp.Body.Close() - switch resp.StatusCode { - case http.StatusOK: - return true, true - case http.StatusNotFound: - return false, true + switch { + case resp.StatusCode == http.StatusOK: + return cargoVersionExists + case resp.StatusCode == http.StatusNotFound: + return cargoVersionMissing + case resp.StatusCode == http.StatusTooManyRequests, resp.StatusCode >= 500 && resp.StatusCode < 600: + return cargoVersionTransient default: - return false, false + return cargoVersionUnknown } } @@ -196,15 +233,21 @@ func cargoReadmeStatusError(ctx context.Context, client *http.Client, pkg model. // endpoint so the publisher gets an actionable message rather than a blanket // "not found". func cargoReadme403Error(ctx context.Context, client *http.Client, pkg model.Package, serverName string) error { - exists, determined := cargoVersionExists(ctx, client, pkg.RegistryBaseURL, pkg.Identifier, pkg.Version) - switch { - case determined && exists: - return fmt.Errorf("cargo package '%s' version '%s' exists on crates.io but has no rendered README. Add a README containing 'mcp-name: %s' and publish a new version", pkg.Identifier, pkg.Version, serverName) - case determined && !exists: + switch probeCargoVersion(ctx, client, pkg.RegistryBaseURL, pkg.Identifier, pkg.Version) { + case cargoVersionExists: + // The crate/version exists but the README CDN returned 403. The likely + // cause is a missing README, but a 403 is not definitive proof (e.g. a + // transient CDN/WAF block), so don't flatly assert "no README". + return fmt.Errorf("cargo package '%s' version '%s' exists on crates.io, but its rendered README could not be retrieved (status: 403). If it has no README, add one containing 'mcp-name: %s' and publish a new version", pkg.Identifier, pkg.Version, serverName) + case cargoVersionMissing: return fmt.Errorf("cargo package '%s' version '%s' not found on crates.io", pkg.Identifier, pkg.Version) - default: - return fmt.Errorf("cargo package '%s' version '%s' not found on crates.io (status: 403)", pkg.Identifier, pkg.Version) + case cargoVersionTransient: + return fmt.Errorf("crates.io could not confirm cargo package '%s' version '%s' (README status: 403, version check inconclusive) — likely transient, retry later", pkg.Identifier, pkg.Version) + case cargoVersionUnknown: + // Probe returned an unclassifiable status — fall through to the + // best-effort message below. } + return fmt.Errorf("cargo package '%s' version '%s' not found on crates.io (status: 403)", pkg.Identifier, pkg.Version) } // validateCargoREADME performs the two-call README fetch and the mcp-name token @@ -213,7 +256,7 @@ func cargoReadme403Error(ctx context.Context, client *http.Client, pkg model.Pac // bypassing the exact-baseURL guard that ValidateCargo enforces for callers. func validateCargoREADME(ctx context.Context, pkg model.Package, serverName string) error { allowedHosts := cargoAllowedHosts(pkg.RegistryBaseURL) - client := newCargoHTTPClient(allowedHosts) + client := newCargoHTTPClient(pkg.RegistryBaseURL, allowedHosts) // Step 1: fetch the README pointer from the documented API endpoint. metaURL := fmt.Sprintf("%s/api/v1/crates/%s/%s/readme", @@ -246,14 +289,15 @@ func validateCargoREADME(ctx context.Context, pkg model.Package, serverName stri return fmt.Errorf("cargo package '%s' metadata response missing 'url' field", pkg.Identifier) } - // Pin the README pointer to an allowed host before fetching it, so a metadata - // response cannot steer the validator at an internal or attacker-chosen host. + // Pin the README pointer to an allowed host/scheme/port before fetching it, so + // a metadata response cannot steer the validator at an internal or + // attacker-chosen URL. readmeParsed, err := url.Parse(meta.URL) if err != nil || readmeParsed.Hostname() == "" { return fmt.Errorf("cargo package '%s': crates.io returned an unparseable README URL", pkg.Identifier) } - if _, ok := allowedHosts[readmeParsed.Hostname()]; !ok { - return fmt.Errorf("cargo package '%s': crates.io returned a README URL on unexpected host %q — refusing to fetch", pkg.Identifier, readmeParsed.Hostname()) + if !cargoURLAllowed(readmeParsed, pkg.RegistryBaseURL, allowedHosts) { + return fmt.Errorf("cargo package '%s': crates.io returned a README URL on an unexpected host/scheme %q — refusing to fetch", pkg.Identifier, readmeParsed.Redacted()) } // Step 2: fetch the rendered README from the (now host-validated) URL. @@ -287,5 +331,11 @@ func validateCargoREADME(ctx context.Context, pkg model.Package, serverName stri return nil } + // If the token IS present but glued to a trailing character, explain that + // rather than telling the publisher to add a token they can already see. + if trailing, glued := mcpNameTokenGluedTrailing(string(body), serverName); glued { + return fmt.Errorf("cargo package '%s' ownership validation failed: found 'mcp-name: %s' in the README, but it is immediately followed by %q rather than a boundary. The token must be followed by a space, newline, or an HTML tag — put it on its own line and publish a new version", pkg.Identifier, serverName, trailing) + } + return fmt.Errorf("cargo package '%s' ownership validation failed. The server name '%s' must appear as 'mcp-name: %s' in the package README", pkg.Identifier, serverName, serverName) } diff --git a/internal/validators/registries/cargo_internal_test.go b/internal/validators/registries/cargo_internal_test.go new file mode 100644 index 0000000..44273b5 --- /dev/null +++ b/internal/validators/registries/cargo_internal_test.go @@ -0,0 +1,47 @@ +package registries + +import ( + "net/url" + "testing" + + "github.com/modelcontextprotocol/registry/pkg/model" +) + +// TestCargoURLAllowed covers the SSRF allow-check: for the real crates.io base, +// the host must be allow-listed AND the scheme/port must be https/default; for a +// test (httptest) base only the host is checked so mocks keep working. +func TestCargoURLAllowed(t *testing.T) { + prodHosts := cargoAllowedHosts(model.RegistryURLCrates) // {crates.io, static.crates.io} + mockBase := "http://127.0.0.1:54321" + mockHosts := cargoAllowedHosts(mockBase) // {127.0.0.1} + + cases := []struct { + desc string + raw string + baseURL string + hosts map[string]struct{} + want bool + }{ + {"prod: https static.crates.io", "https://static.crates.io/readmes/x/x.html", model.RegistryURLCrates, prodHosts, true}, + {"prod: https crates.io", "https://crates.io/api/v1/crates/x/1.0.0", model.RegistryURLCrates, prodHosts, true}, + {"prod: http downgrade rejected", "http://static.crates.io/x", model.RegistryURLCrates, prodHosts, false}, + {"prod: non-default port rejected", "https://static.crates.io:8443/x", model.RegistryURLCrates, prodHosts, false}, + {"prod: explicit 443 ok", "https://static.crates.io:443/x", model.RegistryURLCrates, prodHosts, true}, + {"prod: foreign host rejected", "https://evil.example/x", model.RegistryURLCrates, prodHosts, false}, + {"prod: userinfo host is evil rejected", "https://static.crates.io@evil.example/x", model.RegistryURLCrates, prodHosts, false}, + {"test base: mock host any scheme/port ok", "http://127.0.0.1:54321/readme-static/x", mockBase, mockHosts, true}, + {"test base: foreign host rejected", "http://127.0.0.2:54321/x", mockBase, mockHosts, false}, + } + + for _, tc := range cases { + t.Run(tc.desc, func(t *testing.T) { + u, err := url.Parse(tc.raw) + if err != nil { + t.Fatalf("parse %q: %v", tc.raw, err) + } + if got := cargoURLAllowed(u, tc.baseURL, tc.hosts); got != tc.want { + t.Fatalf("cargoURLAllowed(%q, base=%q) = %v, want %v", tc.raw, tc.baseURL, got, tc.want) + } + }) + } +} diff --git a/internal/validators/registries/cargo_test.go b/internal/validators/registries/cargo_test.go index d2c8128..5328f45 100644 --- a/internal/validators/registries/cargo_test.go +++ b/internal/validators/registries/cargo_test.go @@ -340,6 +340,7 @@ func TestValidateCargoCombinedFixture(t *testing.T) { readmeStatus int readmeBody string versionExists bool // response for the /api/v1/crates/{n}/{v} existence probe (403 disambiguation) + versionProbe int // if non-zero, the existence probe returns this status (overrides versionExists) wantErr bool wantContains []string wantNotContains []string @@ -377,8 +378,9 @@ func TestValidateCargoCombinedFixture(t *testing.T) { wantNotContains: []string{"has no rendered README"}, }, { - // Crate/version exists but has no rendered README: CDN 403 + existence - // probe 200. Must NOT be reported as "not found". + // Crate/version exists but the README CDN 403s: existence probe 200. + // Must NOT be reported as "not found", and must not flatly assert the + // README is absent (a 403 isn't definitive proof of that). name: "readme_403_no_readme", crateName: "combined-readme403-noreadme", version: "0.1.0", @@ -386,7 +388,20 @@ func TestValidateCargoCombinedFixture(t *testing.T) { readmeStatus: http.StatusForbidden, versionExists: true, wantErr: true, - wantContains: []string{"has no rendered README"}, + wantContains: []string{"exists on crates.io", "could not be retrieved"}, + wantNotContains: []string{"not found"}, + }, + { + // CDN 403 + the existence probe itself is rate-limited (429): existence + // is undetermined, so report transient/retryable, NOT "not found". + name: "readme_403_probe_transient", + crateName: "combined-readme403-probe429", + version: "0.1.0", + metaStatus: http.StatusOK, + readmeStatus: http.StatusForbidden, + versionProbe: http.StatusTooManyRequests, + wantErr: true, + wantContains: []string{"transient"}, wantNotContains: []string{"not found"}, }, { @@ -421,6 +436,18 @@ func TestValidateCargoCombinedFixture(t *testing.T) { wantErr: true, wantContains: []string{"ownership validation failed"}, }, + { + // Token present but glued to a trailing period — the error must explain + // the boundary cause, not tell the publisher to add a token they can see. + name: "glued_trailing_period_explained", + crateName: "combined-glued", + version: "0.1.0", + metaStatus: http.StatusOK, + readmeStatus: http.StatusOK, + readmeBody: fmt.Sprintf("

    mcp-name: %s.

    ", serverName), + wantErr: true, + wantContains: []string{"immediately followed by", `"."`}, + }, } // lastMetaPath captures the metadata request path seen by the handler so @@ -450,10 +477,13 @@ func TestValidateCargoCombinedFixture(t *testing.T) { } // Existence probe used to disambiguate a README 403. if r.URL.Path == versionPath { - if tt.versionExists { + switch { + case tt.versionProbe != 0: + http.Error(w, "simulated probe status", tt.versionProbe) + case tt.versionExists: w.Header().Set("Content-Type", "application/json") _ = json.NewEncoder(w).Encode(map[string]any{"version": map[string]string{"num": tt.version}}) - } else { + default: http.Error(w, "not found", http.StatusNotFound) } return diff --git a/internal/validators/registries/mcpname.go b/internal/validators/registries/mcpname.go index a757db3..527aefb 100644 --- a/internal/validators/registries/mcpname.go +++ b/internal/validators/registries/mcpname.go @@ -18,6 +18,28 @@ func isServerNameChar(c byte) bool { } } +// isMCPNameBoundary reports whether the content immediately following a matched +// server name terminates the token, so that the matched name is not merely a +// prefix of a longer declared name. +// +// A boundary is the end of content, any non-server-name character (whitespace, a +// newline, or an HTML tag delimiter such as `<`), or the start of an HTML comment +// close (`-->` / `--!>`). The comment-close case matters because PyPI and NuGet +// publishers commonly hide the token in ``, and authors +// (or minifiers) frequently omit the space before `-->`, producing +// ``. There the byte after NAME is `-`, which is a +// server-name character, so without this case the documented hidden-comment form +// would fail to validate. +func isMCPNameBoundary(rest string) bool { + if rest == "" { + return true + } + if !isServerNameChar(rest[0]) { + return true + } + return strings.HasPrefix(rest, "-->") || strings.HasPrefix(rest, "--!>") +} + // containsMCPNameToken reports whether the package README/description contains // the ownership token "mcp-name: " as a complete token — i.e. the // matched server name is not merely a prefix of a longer declared name. @@ -27,10 +49,9 @@ func isServerNameChar(c byte) bool { // satisfy an ownership claim for the shorter `io.github.acme/widget`, because the // shorter string is a substring of the longer one. This is contained by namespace // authorization (a publisher can only claim names within a namespace they own), -// but it still weakens the crate↔server-name binding the token is meant to prove, -// so we require a trailing boundary: the character following the server name must -// be the end of the content or any non-server-name character (whitespace, a -// newline, or an HTML tag delimiter from a rendered README such as `<`). +// but it still weakens the package↔server-name binding the token is meant to +// prove, so we require a trailing boundary after the server name (see +// isMCPNameBoundary). // // Shared by the README-token validators (PyPI, NuGet, Cargo). NPM is unaffected // because it compares an exact metadata field rather than scanning README text. @@ -43,7 +64,7 @@ func containsMCPNameToken(content, serverName string) bool { return false } tokenEnd := searchFrom + idx + len(token) - if tokenEnd >= len(content) || !isServerNameChar(content[tokenEnd]) { + if isMCPNameBoundary(content[tokenEnd:]) { return true } // This occurrence is a prefix of a longer name; keep scanning in case a @@ -51,3 +72,26 @@ func containsMCPNameToken(content, serverName string) bool { searchFrom = searchFrom + idx + 1 } } + +// mcpNameTokenGluedTrailing explains why a visibly-present token failed to match. +// When containsMCPNameToken has already returned false, it reports whether the +// literal "mcp-name: " string is nonetheless present and, if so, the +// character immediately following it — i.e. the trailing character that made the +// occurrence look like a prefix of a longer name rather than a complete token. +// Validators use it to turn an unhelpful "token must appear" message into an +// actionable "found it, but it's glued to %q — put it on its own line" message. +// Returns ("", false) when the literal token is absent (a genuinely missing token). +func mcpNameTokenGluedTrailing(content, serverName string) (trailing string, glued bool) { + token := "mcp-name: " + serverName + idx := strings.Index(content, token) + if idx < 0 { + return "", false + } + end := idx + len(token) + if end >= len(content) { + // A token at end-of-content is a valid boundary, so containsMCPNameToken + // would not have failed; be defensive and treat it as not-glued. + return "", false + } + return string(content[end]), true +} diff --git a/internal/validators/registries/mcpname_internal_test.go b/internal/validators/registries/mcpname_internal_test.go index 0d69352..cd0bc38 100644 --- a/internal/validators/registries/mcpname_internal_test.go +++ b/internal/validators/registries/mcpname_internal_test.go @@ -1,6 +1,9 @@ package registries -import "testing" +import ( + "strings" + "testing" +) // TestContainsMCPNameToken covers the boundary-anchored ownership-token match // shared by the PyPI, NuGet, and Cargo validators — in particular that a server @@ -23,6 +26,17 @@ func TestContainsMCPNameToken(t *testing.T) { {"absent", "nothing to see here", false}, {"different name", "mcp-name: io.github.other/thing\n", false}, {"prefix occurrence before a real one still matches", "mcp-name: io.github.acme/widget-pro then mcp-name: io.github.acme/widget\n", true}, + + // HTML hidden-comment form (documented for PyPI/NuGet). The canonical + // spaced form has always passed; the no-space variants must pass too, + // since the byte after the name is the `-` of the comment close. + {"comment, spaced (canonical)", "", true}, + {"comment, no trailing space", "", true}, + {"comment, no spaces at all", "", true}, + {"legacy comment close --!>", "", true}, + // A genuine longer name with a double hyphen is still NOT a match for the + // shorter claim (it is not an HTML comment close). + {"double-hyphen longer name not a match", "mcp-name: io.github.acme/widget--pro\n", false}, } for _, tc := range cases { @@ -33,3 +47,58 @@ func TestContainsMCPNameToken(t *testing.T) { }) } } + +// TestMCPNameTokenGluedTrailing covers the diagnostic helper that explains why a +// visibly-present token failed: it reports the trailing character gluing the +// token to a longer name, or ("", false) when the token is genuinely absent. +func TestMCPNameTokenGluedTrailing(t *testing.T) { + const name = "io.github.acme/widget" + cases := []struct { + desc string + content string + wantTrailing string + wantGlued bool + }{ + {"absent", "no token here", "", false}, + {"glued period", "mcp-name: io.github.acme/widget.", ".", true}, + {"glued hyphen (longer name)", "mcp-name: io.github.acme/widget-pro", "-", true}, + {"glued slash", "mcp-name: io.github.acme/widget/x", "/", true}, + {"at end of content (boundary, not glued)", "mcp-name: io.github.acme/widget", "", false}, + } + for _, tc := range cases { + t.Run(tc.desc, func(t *testing.T) { + gotTrailing, gotGlued := mcpNameTokenGluedTrailing(tc.content, name) + if gotGlued != tc.wantGlued || gotTrailing != tc.wantTrailing { + t.Fatalf("mcpNameTokenGluedTrailing(%q) = (%q, %v), want (%q, %v)", + tc.content, gotTrailing, gotGlued, tc.wantTrailing, tc.wantGlued) + } + }) + } +} + +// FuzzContainsMCPNameToken pins the core safety property of the boundary-anchored +// matcher: it is strictly stricter than a bare substring check. A true result +// must imply the literal token is present (strings.Contains). This guards against +// a future edit to isServerNameChar/isMCPNameBoundary accidentally accepting +// something the old behavior rejected — i.e. it can only ever flip pass→fail, +// never fail→pass. Runs the seed corpus under `go test`; exhaustively under +// `go test -fuzz`. +func FuzzContainsMCPNameToken(f *testing.F) { + seeds := []struct{ content, name string }{ + {"mcp-name: io.github.acme/widget", "io.github.acme/widget"}, + {"mcp-name: io.github.acme/widget-pro", "io.github.acme/widget"}, + {"", "io.github.acme/widget"}, + {"prefix mcp-name: a/b then mcp-name: a/b-c", "a/b"}, + {"", ""}, + {"mcp-name: ", ""}, + {"random text with no token", "io.github.x/y"}, + } + for _, s := range seeds { + f.Add(s.content, s.name) + } + f.Fuzz(func(t *testing.T, content, name string) { + if containsMCPNameToken(content, name) && !strings.Contains(content, "mcp-name: "+name) { + t.Fatalf("matcher accepted but literal token absent: content=%q name=%q", content, name) + } + }) +} diff --git a/internal/validators/registries/nuget.go b/internal/validators/registries/nuget.go index 0c6d4c5..c229ba0 100644 --- a/internal/validators/registries/nuget.go +++ b/internal/validators/registries/nuget.go @@ -51,6 +51,9 @@ type ReadmeState int const ( ValidReadme ReadmeState = iota InvalidReadme + // GluedReadme: the literal token is present but glued to a trailing character + // (so the boundary-anchored match rejected it as a prefix of a longer name). + GluedReadme NoReadme ) @@ -99,6 +102,8 @@ func ValidateNuGet(ctx context.Context, pkg model.Package, serverName string) er return nil case InvalidReadme: return fmt.Errorf("NuGet package '%s' ownership validation for version %s failed. The server name '%s' must appear as 'mcp-name: %s' in the package README. Add it to your README and publish a new package version", pkg.Identifier, pkg.Version, serverName, serverName) + case GluedReadme: + return fmt.Errorf("NuGet package '%s' ownership validation for version %s failed: found 'mcp-name: %s' in the README, but it is immediately followed by another character rather than a boundary. The token must be followed by a space, newline, an HTML tag, or a comment close ('-->') — put it on its own line and publish a new package version", pkg.Identifier, pkg.Version, serverName) case NoReadme: // Continue to check if package exists default: @@ -237,10 +242,13 @@ func validateReadme(ctx context.Context, serverName, lowerID, lowerVersion strin readmeContent := string(readmeBytes) - // Check for mcp-name: format (more specific) - mcpNamePattern := "mcp-name: " + serverName - if strings.Contains(readmeContent, mcpNamePattern) { - return ValidReadme, nil // Found as mcp-name: format + // Check for the mcp-name: ownership token (boundary-anchored + // to avoid prefix confusion — see containsMCPNameToken). + if containsMCPNameToken(readmeContent, serverName) { + return ValidReadme, nil + } + if _, glued := mcpNameTokenGluedTrailing(readmeContent, serverName); glued { + return GluedReadme, nil } return InvalidReadme, nil diff --git a/internal/validators/registries/pypi.go b/internal/validators/registries/pypi.go index 2bac843..ec160bd 100644 --- a/internal/validators/registries/pypi.go +++ b/internal/validators/registries/pypi.go @@ -7,7 +7,6 @@ import ( "fmt" "net/http" "net/url" - "strings" "time" "github.com/modelcontextprotocol/registry/pkg/model" @@ -85,10 +84,16 @@ func ValidatePyPI(ctx context.Context, pkg model.Package, serverName string) err // Check description (README) content description := pypiResp.Info.Description - // Check for mcp-name: format (more specific) - mcpNamePattern := "mcp-name: " + serverName - if strings.Contains(description, mcpNamePattern) { - return nil // Found as mcp-name: format + // Check for the mcp-name: ownership token (boundary-anchored to + // avoid prefix confusion — see containsMCPNameToken). + if containsMCPNameToken(description, serverName) { + return nil + } + + // If the token IS present but glued to a trailing character, say so — otherwise + // the publisher sees "must appear as mcp-name: X" while looking at exactly that. + if trailing, glued := mcpNameTokenGluedTrailing(description, serverName); glued { + return fmt.Errorf("PyPI package '%s' ownership validation failed: found 'mcp-name: %s' in the README, but it is immediately followed by %q rather than a boundary. The token must be followed by a space, newline, an HTML tag, or a comment close ('-->') — put it on its own line and republish", pkg.Identifier, serverName, trailing) } return fmt.Errorf("PyPI package '%s' ownership validation failed. The server name '%s' must appear as 'mcp-name: %s' in the package README", pkg.Identifier, serverName, serverName) From ef29673221f34fb3b949c343b2279040b29cc203 Mon Sep 17 00:00:00 2001 From: CK Date: Fri, 5 Jun 2026 01:59:47 -0500 Subject: [PATCH 240/313] fix: client-cancelled GET /v0/servers returns 499 without error log (#1335) Maps context.Canceled from ListServers to 499 and skips the error-level log on client disconnect. Merged as-is per maintainer decision; known follow-up tracked in #1337 (500-path error-detail leak + WriteHeader claim correction + nits). --- internal/api/handlers/v0/list_errors.go | 21 +++++++++++++ internal/api/handlers/v0/list_errors_test.go | 31 ++++++++++++++++++++ internal/api/handlers/v0/servers.go | 3 +- 3 files changed, 53 insertions(+), 2 deletions(-) create mode 100644 internal/api/handlers/v0/list_errors.go create mode 100644 internal/api/handlers/v0/list_errors_test.go diff --git a/internal/api/handlers/v0/list_errors.go b/internal/api/handlers/v0/list_errors.go new file mode 100644 index 0000000..8ef89a1 --- /dev/null +++ b/internal/api/handlers/v0/list_errors.go @@ -0,0 +1,21 @@ +package v0 + +import ( + "context" + "errors" + "log" + + "github.com/danielgtaylor/huma/v2" +) + +// ListServersError maps ListServers failures; client disconnects must not log as 500s. +func ListServersError(ctx context.Context, err error) error { + if err == nil { + return nil + } + if errors.Is(err, context.Canceled) || errors.Is(ctx.Err(), context.Canceled) { + return huma.NewError(499, "Client closed request", err) + } + log.Printf("list servers failed: %v", err) + return huma.Error500InternalServerError("Failed to get registry list", err) +} diff --git a/internal/api/handlers/v0/list_errors_test.go b/internal/api/handlers/v0/list_errors_test.go new file mode 100644 index 0000000..9baca41 --- /dev/null +++ b/internal/api/handlers/v0/list_errors_test.go @@ -0,0 +1,31 @@ +package v0_test + +import ( + "context" + "errors" + "testing" + + "github.com/danielgtaylor/huma/v2" + v0 "github.com/modelcontextprotocol/registry/internal/api/handlers/v0" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +func TestListServersError_clientCanceled(t *testing.T) { + ctx, cancel := context.WithCancel(context.Background()) + cancel() + + err := v0.ListServersError(ctx, errors.New("error iterating rows: context canceled")) + require.Error(t, err) + var se huma.StatusError + require.True(t, errors.As(err, &se)) + assert.Equal(t, 499, se.GetStatus()) +} + +func TestListServersError_realFailure(t *testing.T) { + err := v0.ListServersError(context.Background(), errors.New("database unavailable")) + require.Error(t, err) + var se huma.StatusError + require.True(t, errors.As(err, &se)) + assert.Equal(t, 500, se.GetStatus()) +} diff --git a/internal/api/handlers/v0/servers.go b/internal/api/handlers/v0/servers.go index bc7c618..059095d 100644 --- a/internal/api/handlers/v0/servers.go +++ b/internal/api/handlers/v0/servers.go @@ -132,8 +132,7 @@ func RegisterServersEndpoints(api huma.API, pathPrefix string, registry service. // Get paginated results with filtering servers, nextCursor, err := registry.ListServers(ctx, filter, input.Cursor, input.Limit) if err != nil { - log.Printf("list servers failed: %v", err) - return nil, huma.Error500InternalServerError("Failed to get registry list") + return nil, ListServersError(ctx, err) } // Convert []*ServerResponse to []ServerResponse From fecef4f9ed5ad063b8c726dc7fca4eb69dba69a3 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Fri, 5 Jun 2026 03:08:33 -0400 Subject: [PATCH 241/313] fix: don't leak internal error detail in GET /v0/servers 500 response (#1338) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary Fixes the information-disclosure regression introduced by #1335 (item 1 of #1337). `ListServersError` passed the raw `err` into `huma.Error500InternalServerError(...)`. huma serializes extra error args into the response body's `errors` array (`ErrorModel.Errors`, `json:"errors,omitempty"`), so on the **public, unauthenticated** `GET /v0/servers` endpoint a genuine DB failure echoed the internal wrapped error from `internal/database/postgres.go` (`error iterating rows: `) back to the client. pgx/pgconn errors can carry SQLSTATE codes, constraint/table/column names, and internal messages (CWE-209). ## Change - Drop `err` from the 500 call so only the generic message is returned; keep `log.Printf` for the server-side detail — matching the sibling handlers (`servers.go:190/220`, `edit.go`, `status.go`). - Add a regression test (`TestListServersError_realFailureDoesNotLeakDetail`) that marshals the 500 error and asserts the internal detail is absent from the client-visible body. Existing tests only asserted status codes, which is why the leak slipped through. The 499 client-cancelled path is unchanged (the client has already disconnected, so nothing is leaked there). ## Test plan - [x] `go test ./internal/api/handlers/v0/... -run ListServersError` (3/3 pass) - [x] `go build ./...`, `go vet`, `golangci-lint` (no new findings in changed files) ## Note This leaves the non-security items in #1337 (correcting the `superfluous WriteHeader` claim, `statusClientClosed` const reuse, broader cancellation-guard scope) for separate follow-up. Closing #1337 here since the only security-impacting item is addressed; reopen/split if you'd prefer to track the nits independently. Closes #1337 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.8 (1M context) --- internal/api/handlers/v0/list_errors.go | 5 ++++- internal/api/handlers/v0/list_errors_test.go | 14 ++++++++++++++ 2 files changed, 18 insertions(+), 1 deletion(-) diff --git a/internal/api/handlers/v0/list_errors.go b/internal/api/handlers/v0/list_errors.go index 8ef89a1..b83f04e 100644 --- a/internal/api/handlers/v0/list_errors.go +++ b/internal/api/handlers/v0/list_errors.go @@ -17,5 +17,8 @@ func ListServersError(ctx context.Context, err error) error { return huma.NewError(499, "Client closed request", err) } log.Printf("list servers failed: %v", err) - return huma.Error500InternalServerError("Failed to get registry list", err) + // Do not pass err here: huma serializes extra error args into the response + // body, which would leak internal (e.g. pgx) error detail to clients. Log it + // server-side only, like the sibling handlers in servers.go. + return huma.Error500InternalServerError("Failed to get registry list") } diff --git a/internal/api/handlers/v0/list_errors_test.go b/internal/api/handlers/v0/list_errors_test.go index 9baca41..7c50d38 100644 --- a/internal/api/handlers/v0/list_errors_test.go +++ b/internal/api/handlers/v0/list_errors_test.go @@ -2,6 +2,7 @@ package v0_test import ( "context" + "encoding/json" "errors" "testing" @@ -29,3 +30,16 @@ func TestListServersError_realFailure(t *testing.T) { require.True(t, errors.As(err, &se)) assert.Equal(t, 500, se.GetStatus()) } + +// The 500 response body must not echo the internal error back to the client, +// since it can carry DB/driver detail (CWE-209). +func TestListServersError_realFailureDoesNotLeakDetail(t *testing.T) { + const internal = "database unavailable: dsn=postgres://user:pw@internal-host/db" + err := v0.ListServersError(context.Background(), errors.New(internal)) + require.Error(t, err) + + body, marshalErr := json.Marshal(err) + require.NoError(t, marshalErr) + assert.NotContains(t, string(body), "database unavailable") + assert.NotContains(t, string(body), "internal-host") +} From f54f3b831c1c94501161e7592c97122eb349c4fe Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 25 Jun 2026 02:41:46 -0400 Subject: [PATCH 242/313] build(deps): bump the actions group with 2 updates (#1392) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps the actions group with 2 updates: [actions/checkout](https://github.com/actions/checkout) and [actions/setup-go](https://github.com/actions/setup-go). Updates `actions/checkout` from 6 to 7
    Release notes

    Sourced from actions/checkout's releases.

    v7.0.0

    What's Changed

    New Contributors

    Full Changelog: https://github.com/actions/checkout/compare/v6.0.3...v7.0.0

    v6.0.3

    What's Changed

    New Contributors

    Full Changelog: https://github.com/actions/checkout/compare/v6...v6.0.3

    v6.0.2

    What's Changed

    Full Changelog: https://github.com/actions/checkout/compare/v6.0.1...v6.0.2

    v6.0.1

    What's Changed

    Full Changelog: https://github.com/actions/checkout/compare/v6...v6.0.1

    Commits

    Updates `actions/setup-go` from 6.4.0 to 6.5.0
    Release notes

    Sourced from actions/setup-go's releases.

    v6.5.0

    What's Changed

    Dependency update

    New Contributors

    Full Changelog: https://github.com/actions/setup-go/compare/v6...v6.5.0

    Commits

    Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/cancel-pulumi-lock.yml | 2 +- .github/workflows/ci.yml | 8 ++++---- .github/workflows/claude.yml | 2 +- .github/workflows/deploy-production.yml | 4 ++-- .github/workflows/deploy-staging.yml | 8 ++++---- .github/workflows/release.yml | 8 ++++---- .github/workflows/sync-schema.yml | 4 ++-- 7 files changed, 18 insertions(+), 18 deletions(-) diff --git a/.github/workflows/cancel-pulumi-lock.yml b/.github/workflows/cancel-pulumi-lock.yml index 06f1305..a42911f 100644 --- a/.github/workflows/cancel-pulumi-lock.yml +++ b/.github/workflows/cancel-pulumi-lock.yml @@ -24,7 +24,7 @@ jobs: environment: ${{ inputs.environment }} steps: - name: Checkout code - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 - name: Setup Pulumi uses: pulumi/actions@8e5e406f4007fca908480587cb9893c07090f58d diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ce8f267..5c5edb0 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -16,10 +16,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 - name: Set up Go - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c + uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 with: go-version: 'stable' cache: true @@ -48,10 +48,10 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 - name: Set up Go - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c + uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 with: go-version: 'stable' cache: true diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index 36a9fc2..01e2b06 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -26,7 +26,7 @@ jobs: actions: read steps: - name: Checkout repository - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 with: fetch-depth: 1 diff --git a/.github/workflows/deploy-production.yml b/.github/workflows/deploy-production.yml index bf8f4f2..443ec9a 100644 --- a/.github/workflows/deploy-production.yml +++ b/.github/workflows/deploy-production.yml @@ -23,10 +23,10 @@ jobs: cancel-in-progress: false steps: - name: Checkout code - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 - name: Setup Go - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c + uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 with: go-version: 'stable' cache: true diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml index c461511..7ef30b9 100644 --- a/.github/workflows/deploy-staging.yml +++ b/.github/workflows/deploy-staging.yml @@ -22,10 +22,10 @@ jobs: packages: write steps: - name: Checkout repository - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 - name: Set up Go - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c + uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 with: go-version: 'stable' cache: true @@ -70,10 +70,10 @@ jobs: cancel-in-progress: false steps: - name: Checkout code - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 - name: Setup Go - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c + uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 with: go-version: 'stable' cache: true diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index f41dcaa..13fb866 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -14,12 +14,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 with: fetch-depth: 0 - name: Set up Go - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c + uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 with: go-version: 'stable' cache: true @@ -45,10 +45,10 @@ jobs: needs: goreleaser steps: - name: Checkout - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 - name: Set up Go - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c + uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 with: go-version: 'stable' cache: true diff --git a/.github/workflows/sync-schema.yml b/.github/workflows/sync-schema.yml index a59583b..7fbe6a7 100644 --- a/.github/workflows/sync-schema.yml +++ b/.github/workflows/sync-schema.yml @@ -15,10 +15,10 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Checkout static repo - uses: actions/checkout@v6 + uses: actions/checkout@v7 with: repository: modelcontextprotocol/static path: static-repo From cefa07dfe81225161208b38ddc9be4a1e8afd643 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 25 Jun 2026 02:42:05 -0400 Subject: [PATCH 243/313] build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.244.0 to 3.248.0 in /deploy (#1391) Bumps [github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from 3.244.0 to 3.248.0.
    Release notes

    Sourced from github.com/pulumi/pulumi/sdk/v3's releases.

    v3.248.0

    3.248.0 (2026-06-24)

    Bug Fixes

    • [cli] Fix a panic in pulumi package get-schema when binding a schema that references an uninstalled plugin #23647

    Improvements

    • [cli] Add options to pulumi stack get for parity with bare pulumi stack #23623
    • [cli] Add --output flag to about and whoami commands #23651

    Features

    • [engine] Add support for 'snippets', blocks of PCL kept in state to track ad-hoc resources #23286
    • [engine] Send the address of a schema loader service to resource providers as part of the provider handshake #23645
    • [engine] Send the address of a package resolver service to resource providers as part of the provider handshake #23654

    Bug Fixes

    • [programgen] Guard references to conditionally-created (boolean range) resources in generated Python and NodeJS programs so they type-check #23634
    • [programgen] Generate map range resource collections as key-indexed maps in Python and NodeJS so they can be indexed by key #23639

    Features

    • [sdk/nodejs] Add Output.recover to catch and recover from exceptions in outputs #23642

    Bug Fixes

    • [sdkgen] Fix extra trailing new lines in comments #23619

    Improvements

    • [sdkgen] Require callers to pass an explicit schema loader when binding PCL programs and package schemas #23672

    v3.247.0

    3.247.0 (2026-06-18)

    Features

    • [cli/config] Add --raw flag to pulumi config set to avoid stripping newlines when input is piped through stdin #23593
    • [cli/do] Add --provider flag to pull provider config to use from existing provider state #23560
    • [cli/engine] Resource providers now receive the active login's API address and access token through PULUMI_API and PULUMI_ACCESS_TOKEN #23589
    • [cli/neo] Add a --disable-integrations flag to pulumi neo that runs the task with no integration credentials #23531
    • [engine] Send the address of a mapper service to resource providers as part of the provider handshake
    • [programgen/go] Support functions with multiArgumentInputs #23554
    • [programgen/python] Support functions with multiArgumentInputs #23574
    • [sdk/nodejs] Registered resources can now be retrieved from the mock monitor for test assertions #20539
    • [sdk/python] Add Output.recover to catch and recover from exceptions in outputs #23591
    • [sdkgen] Adds support for language agnostic cross references in schemas. Use the form {{% ref <target> %}} to reference other schema components in markdown descriptions. Such as `{{% ref #21369

    ... (truncated)

    Changelog

    Sourced from github.com/pulumi/pulumi/sdk/v3's changelog.

    3.248.0 (2026-06-24)

    Bug Fixes

    • [cli] Fix a panic in pulumi package get-schema when binding a schema that references an uninstalled plugin #23647

    Improvements

    • [cli] Add options to pulumi stack get for parity with bare pulumi stack #23623
    • [cli] Add --output flag to about and whoami commands #23651

    Features

    • [engine] Add support for 'snippets', blocks of PCL kept in state to track ad-hoc resources #23286
    • [engine] Send the address of a schema loader service to resource providers as part of the provider handshake #23645
    • [engine] Send the address of a package resolver service to resource providers as part of the provider handshake #23654

    Bug Fixes

    • [programgen] Guard references to conditionally-created (boolean range) resources in generated Python and NodeJS programs so they type-check #23634
    • [programgen] Generate map range resource collections as key-indexed maps in Python and NodeJS so they can be indexed by key #23639

    Features

    • [sdk/nodejs] Add Output.recover to catch and recover from exceptions in outputs #23642

    Bug Fixes

    • [sdkgen] Fix extra trailing new lines in comments #23619

    Improvements

    • [sdkgen] Require callers to pass an explicit schema loader when binding PCL programs and package schemas #23672

    3.247.0 (2026-06-18)

    Bug Fixes

    • [cli] Ensure pulumi logout clears the current tokenless backend in coding agent environments #23540
    • [cli] Read Git metadata correctly in repositories that enable the worktreeConfig extension, such as those hosted on Azure DevOps #23535

    Improvements

    • [cli] Respect PULUMI_SKIP_CONFIRMATIONS whenever we ask for confirmation #23607
    • [cli] Use list and remove as the canonical names for list/remove commands, with ls and rm as aliases #23608

    Features

    • [cli/config] Add --raw flag to pulumi config set to avoid stripping newlines when input is piped through stdin #23593

    Bug Fixes

    ... (truncated)

    Commits
    • a88168d [programgen] Generate map ranges as key-indexed collections (Python & NodeJS)...
    • 3263e4a Bump language versions (#23685)
    • a95f24c Bump the Pulumi HCL version to 0.8.0 (#23679)
    • 91f59dd Require an explicit schema loader when binding programs and specs (#23672)
    • 35eb973 Actually set an input in TestRefreshBeforeUpdateDeletedResource (#23681)
    • 9fd06c1 Send a resolver target to providers during handshake (#23654)
    • 1091491 Start changing PolicyRemediationEvent to property.Map (#23667)
    • e2cca27 [programgen] Guard references to conditionally-created resources (Python & No...
    • 109f27f NodeJS recover method (#23642)
    • facc18e Send a loader target to providers during handshake (#23645)
    • Additional commits viewable in compare view

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/pulumi/pulumi/sdk/v3&package-manager=go_modules&previous-version=3.244.0&new-version=3.248.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- deploy/go.mod | 37 +++++++++----------- deploy/go.sum | 95 +++++++++++++++++++++------------------------------ 2 files changed, 55 insertions(+), 77 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index 6fc92d3..53463fe 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -5,15 +5,14 @@ go 1.26 require ( github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.31.1 - github.com/pulumi/pulumi/sdk/v3 v3.244.0 + github.com/pulumi/pulumi/sdk/v3 v3.248.0 gopkg.in/yaml.v2 v2.4.0 ) require ( - dario.cat/mergo v1.0.0 // indirect github.com/BurntSushi/toml v1.6.0 // indirect github.com/Microsoft/go-winio v0.6.2 // indirect - github.com/ProtonMail/go-crypto v1.1.6 // indirect + github.com/ProtonMail/go-crypto v1.4.1 // indirect github.com/agext/levenshtein v1.2.3 // indirect github.com/apparentlymart/go-textseg/v13 v13.0.0 // indirect github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect @@ -33,18 +32,16 @@ require ( github.com/clipperhouse/displaywidth v0.11.0 // indirect github.com/clipperhouse/uax29/v2 v2.7.0 // indirect github.com/cloudflare/circl v1.6.3 // indirect - github.com/cyphar/filepath-securejoin v0.6.1 // indirect github.com/djherbis/times v1.5.0 // indirect github.com/emirpasic/gods v1.18.1 // indirect github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect - github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect - github.com/go-git/go-billy/v5 v5.9.0 // indirect - github.com/go-git/go-git/v5 v5.19.1 // indirect + github.com/go-git/gcfg/v2 v2.0.2 // indirect + github.com/go-git/go-billy/v6 v6.0.0-alpha.1 // indirect + github.com/go-git/go-git/v6 v6.0.0-alpha.4 // indirect github.com/go-logr/logr v1.4.3 // indirect github.com/go-logr/stdr v1.2.2 // indirect github.com/gogo/protobuf v1.3.2 // indirect github.com/golang/glog v1.2.5 // indirect - github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect github.com/google/uuid v1.6.0 // indirect github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 // indirect github.com/grpc-ecosystem/grpc-opentracing v0.0.0-20180507213350-8e809c8a8645 // indirect @@ -53,9 +50,8 @@ require ( github.com/hashicorp/go-version v1.8.0 // indirect github.com/hashicorp/hcl/v2 v2.22.0 // indirect github.com/inconshreveable/mousetrap v1.1.0 // indirect - github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect github.com/json-iterator/go v1.1.12 // indirect - github.com/kevinburke/ssh_config v1.2.0 // indirect + github.com/kevinburke/ssh_config v1.6.0 // indirect github.com/klauspost/compress v1.18.0 // indirect github.com/klauspost/cpuid/v2 v2.3.0 // indirect github.com/lucasb-eyer/go-colorful v1.3.0 // indirect @@ -82,42 +78,43 @@ require ( github.com/rogpeppe/go-internal v1.14.1 // indirect github.com/santhosh-tekuri/jsonschema/v5 v5.0.0 // indirect github.com/sergi/go-diff v1.4.0 // indirect - github.com/skeema/knownhosts v1.3.1 // indirect github.com/spf13/cast v1.4.1 // indirect github.com/spf13/cobra v1.10.2 // indirect github.com/spf13/pflag v1.0.10 // indirect github.com/texttheater/golang-levenshtein v1.0.1 // indirect github.com/uber/jaeger-client-go v2.30.0+incompatible // indirect github.com/uber/jaeger-lib v2.4.1+incompatible // indirect - github.com/xanzy/ssh-agent v0.3.3 // indirect github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect github.com/zclconf/go-cty v1.13.2 // indirect go.opentelemetry.io/auto/sdk v1.2.1 // indirect go.opentelemetry.io/collector/featuregate v1.53.0 // indirect go.opentelemetry.io/collector/pdata v1.53.0 // indirect + go.opentelemetry.io/contrib/bridges/otelslog v0.18.0 // indirect go.opentelemetry.io/otel v1.43.0 // indirect + go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.19.0 // indirect go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.42.0 // indirect go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.42.0 // indirect + go.opentelemetry.io/otel/log v0.19.0 // indirect go.opentelemetry.io/otel/metric v1.43.0 // indirect go.opentelemetry.io/otel/sdk v1.43.0 // indirect + go.opentelemetry.io/otel/sdk/log v0.19.0 // indirect go.opentelemetry.io/otel/trace v1.43.0 // indirect go.opentelemetry.io/proto/otlp v1.10.0 // indirect go.uber.org/atomic v1.11.0 // indirect go.uber.org/multierr v1.11.0 // indirect - golang.org/x/crypto v0.50.0 // indirect + golang.org/x/crypto v0.52.0 // indirect golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f // indirect golang.org/x/mod v0.35.0 // indirect - golang.org/x/net v0.53.0 // indirect + golang.org/x/net v0.55.0 // indirect golang.org/x/sync v0.20.0 // indirect - golang.org/x/sys v0.43.0 // indirect - golang.org/x/term v0.42.0 // indirect - golang.org/x/text v0.36.0 // indirect + golang.org/x/sys v0.45.0 // indirect + golang.org/x/term v0.43.0 // indirect + golang.org/x/text v0.37.0 // indirect golang.org/x/tools v0.44.0 // indirect - google.golang.org/genproto/googleapis/api v0.0.0-20260311181403-84a4fc48630c // indirect - google.golang.org/genproto/googleapis/rpc v0.0.0-20260311181403-84a4fc48630c // indirect + google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9 // indirect google.golang.org/grpc v1.80.0 // indirect google.golang.org/protobuf v1.36.11 // indirect - gopkg.in/warnings.v0 v0.1.2 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect lukechampine.com/frand v1.5.1 // indirect ) diff --git a/deploy/go.sum b/deploy/go.sum index dc36d65..995e9c1 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -1,14 +1,11 @@ -dario.cat/mergo v1.0.0 h1:AGCNq9Evsj31mOgNPcLyXc+4PNABt905YmuqPYYpBWk= -dario.cat/mergo v1.0.0/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk= github.com/BurntSushi/toml v1.6.0 h1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk= github.com/BurntSushi/toml v1.6.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho= github.com/HdrHistogram/hdrhistogram-go v1.1.2 h1:5IcZpTvzydCQeHzK4Ef/D5rrSqwxob0t8PQPMybUNFM= github.com/HdrHistogram/hdrhistogram-go v1.1.2/go.mod h1:yDgFjdqOqDEKOvasDdhWNXYg9BVp4O+o5f6V/ehm6Oo= -github.com/Microsoft/go-winio v0.5.2/go.mod h1:WpS1mjBmmwHBEWmogvA2mj8546UReBk4v8QkMxJ6pZY= github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY= github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU= -github.com/ProtonMail/go-crypto v1.1.6 h1:ZcV+Ropw6Qn0AX9brlQLAUXfqLBc7Bl+f/DmNxpLfdw= -github.com/ProtonMail/go-crypto v1.1.6/go.mod h1:rA3QumHc/FZ8pAHreoekgiAbzpNsfQAosU5td4SnOrE= +github.com/ProtonMail/go-crypto v1.4.1 h1:9RfcZHqEQUvP8RzecWEUafnZVtEvrBVL9BiF67IQOfM= +github.com/ProtonMail/go-crypto v1.4.1/go.mod h1:e1OaTyu5SYVrO9gKOEhTc+5UcXtTUa+P3uLudwcgPqo= github.com/agext/levenshtein v1.2.3 h1:YB2fHEn0UJagG8T1rrWknE3ZQzWM06O8AMAatNn7lmo= github.com/agext/levenshtein v1.2.3/go.mod h1:JEDfjyjHDjOF/1e4FlBE/PkbqA9OfWu2ki2W0IB5558= github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8= @@ -52,15 +49,11 @@ github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJ github.com/cloudflare/circl v1.6.3 h1:9GPOhQGF9MCYUeXyMYlqTR6a5gTrgR/fBLXvUgtVcg8= github.com/cloudflare/circl v1.6.3/go.mod h1:2eXP6Qfat4O/Yhh8BznvKnJ+uzEoTQ6jVKJRn81BiS4= github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g= -github.com/cyphar/filepath-securejoin v0.6.1 h1:5CeZ1jPXEiYt3+Z6zqprSAgSWiggmpVyciv8syjIpVE= -github.com/cyphar/filepath-securejoin v0.6.1/go.mod h1:A8hd4EnAeyujCJRrICiOWqjS1AX0a9kM5XL+NwKoYSc= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/djherbis/times v1.5.0 h1:79myA211VwPhFTqUk8xehWrsEO+zcIZj0zT8mXPVARU= github.com/djherbis/times v1.5.0/go.mod h1:5q7FDLvbNg1L/KaBmPcWlVR9NmoKo3+ucqUA3ijQhA0= -github.com/elazarl/goproxy v1.7.2 h1:Y2o6urb7Eule09PjlhQRGNsqRfPmYI3KKQLFpCAV3+o= -github.com/elazarl/goproxy v1.7.2/go.mod h1:82vkLNir0ALaW14Rc399OTTjyNREgmdL2cVoIbS6XaE= github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc= github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FMNAnJvWQ= github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f h1:Y/CXytFA4m6baUTXGLOoWe4PQhGxaX0KpnayAqC48p4= @@ -70,14 +63,14 @@ github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM= github.com/fatih/color v1.16.0/go.mod h1:fL2Sau1YI5c0pdGEVCbKQbLXB6edEj1ZgiY4NijnWvE= github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c= github.com/gliderlabs/ssh v0.3.8/go.mod h1:xYoytBv1sV0aL3CavoDuJIQNURXkkfPA/wxQ1pL1fAU= -github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI= -github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376/go.mod h1:an3vInlBmSxCcxctByoQdvwPiA7DTK7jaaFDBTtu0ic= -github.com/go-git/go-billy/v5 v5.9.0 h1:jItGXszUDRtR/AlferWPTMN4j38BQ88XnXKbilmmBPA= -github.com/go-git/go-billy/v5 v5.9.0/go.mod h1:jCnQMLj9eUgGU7+ludSTYoZL/GGmii14RxKFj7ROgHw= -github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4= -github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII= -github.com/go-git/go-git/v5 v5.19.1 h1:nX27AnaU43/K5bKktKwgBmR9lawoYVe1Ckg0rgzzN00= -github.com/go-git/go-git/v5 v5.19.1/go.mod h1:Pb1v0c7/g8aGQJwx9Us09W85yGoyvSwuhEGMH7zjDKQ= +github.com/go-git/gcfg/v2 v2.0.2 h1:MY5SIIfTGGEMhdA7d7JePuVVxtKL7Hp+ApGDJAJ7dpo= +github.com/go-git/gcfg/v2 v2.0.2/go.mod h1:/lv2NsxvhepuMrldsFilrgct6pxzpGdSRC13ydTLSLs= +github.com/go-git/go-billy/v6 v6.0.0-alpha.1 h1:xVjAR4oUvrKy7/Xuw/lLlV3gkxR3KO2H8W+MamuVVsQ= +github.com/go-git/go-billy/v6 v6.0.0-alpha.1/go.mod h1:eaCUpHbedW7//EwcYmUDfJe2N6sJC9O12AT0OTqJR1E= +github.com/go-git/go-git-fixtures/v6 v6.0.0-alpha.1 h1:gmqi2jvsreu0s8JMLylYDFq4sbjHwwlhktMw0DUg3mA= +github.com/go-git/go-git-fixtures/v6 v6.0.0-alpha.1/go.mod h1:ECf1MqJlBdYpKggBrOXjo/0EnvRZx6D++I86UYjPgAQ= +github.com/go-git/go-git/v6 v6.0.0-alpha.4 h1:aDTc2UGanmaE7FkGLSlBEB9nohMnQ+RKXcfq/D+esDQ= +github.com/go-git/go-git/v6 v6.0.0-alpha.4/go.mod h1:4ODa/G7hPWrh4Y+7lmt59Ij3zW38IEfvRoAZxLYYBhc= github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= @@ -88,8 +81,6 @@ github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q= github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q= github.com/golang/glog v1.2.5 h1:DrW6hGnjIhtvhOIiAKT6Psh/Kd/ldepEa81DKeiRJ5I= github.com/golang/glog v1.2.5/go.mod h1:6AhwSGph0fcJtXVM/PEHPqZlFeoLxhs7/t5UDAwmO+w= -github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 h1:f+oWsMOmNPc8JmEHVZIycC7hBoQxHH9pNKQORJNozsQ= -github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8/go.mod h1:wcDNUvekVysuuOpQKo3191zZyTpiI6se1N1ULghS0sw= github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek= github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps= github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= @@ -112,12 +103,10 @@ github.com/hashicorp/hcl/v2 v2.22.0 h1:hkZ3nCtqeJsDhPRFz5EA9iwcG1hNWGePOTw6oyul1 github.com/hashicorp/hcl/v2 v2.22.0/go.mod h1:62ZYHrXgPoX8xBnzl8QzbWq4dyDsDtfCRgIq1rbJEvA= github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8= github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= -github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOlocH6Fxy8MmwDt+yVQYULKfN0RoTN8A= -github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99/go.mod h1:1lJo3i6rXxKeerYnT8Nvf0QmHCRC1n8sfWVwXF2Frvo= github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM= github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo= -github.com/kevinburke/ssh_config v1.2.0 h1:x584FjTGwHzMwvHx18PXxbBVzfnxogHaAReU4gf13a4= -github.com/kevinburke/ssh_config v1.2.0/go.mod h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF4nAY/ojJ6r6mM= +github.com/kevinburke/ssh_config v1.6.0 h1:J1FBfmuVosPHf5GRdltRLhPJtJpTlMdKTBjRgTaQBFY= +github.com/kevinburke/ssh_config v1.6.0/go.mod h1:q2RIzfka+BXARoNexmF9gkxEX7DmvbW9P4hIVx2Kg4M= github.com/kisielk/errcheck v1.2.0/go.mod h1:/BMXB+zMLi60iA8Vv6Ksmxu/1UDYcXs4uQLJ+jE2L00= github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8= github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= @@ -162,8 +151,6 @@ github.com/muesli/cancelreader v0.2.2 h1:3I4Kt4BQjOR54NavqnDogx/MIoWBFa0StPA8ELU github.com/muesli/cancelreader v0.2.2/go.mod h1:3XuTXfFS2VjM+HTLZY9Ak0l6eUKfijIfMUZ4EgX0QYo= github.com/muesli/termenv v0.16.0 h1:S5AlUN9dENB57rsbnkPyfdGuWIlkmzJjbFf0Tf5FWUc= github.com/muesli/termenv v0.16.0/go.mod h1:ZRfOIKPFDYQoDFF4Olj7/QJbW60Ol/kL1pU3VfY/Cnk= -github.com/onsi/gomega v1.34.1 h1:EUMJIKUjM8sKjYbtxQI9A4z2o+rruxnzNvpknOXie6k= -github.com/onsi/gomega v1.34.1/go.mod h1:kU1QgUvBDLXBJq618Xvm2LUX6rSAfRaFRTcdOeDLwwY= github.com/opentracing/basictracer-go v1.1.0 h1:Oa1fTSBvAl8pa3U+IJYqrKm0NALwH9OsgwOqDv4xJW0= github.com/opentracing/basictracer-go v1.1.0/go.mod h1:V2HZueSJEp879yv285Aap1BS69fQMD+MNP1mRs6mBQc= github.com/opentracing/opentracing-go v1.1.0/go.mod h1:UkNAQd3GIcIGf0SeVgPpRdFStlNbqXla1AfSYxPUl2o= @@ -189,8 +176,8 @@ github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 h1:w6OnO3d4j5yVf2vpm8OzXFC/xHOEGqt+9 github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1/go.mod h1:UyZyv7hz4knpFx6/Sh+SkZe6hT6sJHtDvw9A0TbvEsk= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.31.1 h1:Hg9RK9zqIU9kFbD5KeiON06gPP7cLgS68jvsgMBmPgw= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.31.1/go.mod h1:BAWI9R3JEEGOp1JlXLPSZKwBGANSrPGUWKtMnS5w5qw= -github.com/pulumi/pulumi/sdk/v3 v3.244.0 h1:oyQ9bwDE58wrQOqS70JrojJSlNoLcVhVcQgK4yusgcg= -github.com/pulumi/pulumi/sdk/v3 v3.244.0/go.mod h1:BPWWuYPXcPH5YbXGoyy9Rrfa+evrh6IdM51AjDhcDpM= +github.com/pulumi/pulumi/sdk/v3 v3.248.0 h1:TwY9uuToQO8xIey4a7awRzNX7iJ/doDmZkl1MzxULCE= +github.com/pulumi/pulumi/sdk/v3 v3.248.0/go.mod h1:67RnWlA0uRHJKjbOkk1Hqz8BNefYv8csNLgln1EmmII= github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ= github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88= github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ= @@ -200,9 +187,6 @@ github.com/santhosh-tekuri/jsonschema/v5 v5.0.0 h1:TToq11gyfNlrMFZiYujSekIsPd9Am github.com/santhosh-tekuri/jsonschema/v5 v5.0.0/go.mod h1:FKdcjfQW6rpZSnxxUvEA5H/cDPdvJ/SZJQLWWXWGrZ0= github.com/sergi/go-diff v1.4.0 h1:n/SP9D5ad1fORl+llWyN+D6qoUETXNZARKjyY2/KVCw= github.com/sergi/go-diff v1.4.0/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4= -github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0= -github.com/skeema/knownhosts v1.3.1 h1:X2osQ+RAjK76shCbvhHHHVl3ZlgDm8apHEHFqRjnBY8= -github.com/skeema/knownhosts v1.3.1/go.mod h1:r7KTdC8l4uxWRyK2TpQZ/1o5HaSzh06ePQNxPwTcfiY= github.com/spf13/cast v1.4.1 h1:s0hze+J0196ZfEMTs80N7UlFt0BDuQ7Q+JDnHiMWKdA= github.com/spf13/cast v1.4.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE= github.com/spf13/cobra v1.10.2 h1:DMTTonx5m65Ic0GOoRY2c16WCbHxOOw6xxezuLaBpcU= @@ -225,8 +209,6 @@ github.com/uber/jaeger-client-go v2.30.0+incompatible h1:D6wyKGCecFaSRUpo8lCVbaO github.com/uber/jaeger-client-go v2.30.0+incompatible/go.mod h1:WVhlPFC8FDjOFMMWRy2pZqQJSXxYSwNYOkTr/Z6d3Kk= github.com/uber/jaeger-lib v2.4.1+incompatible h1:td4jdvLcExb4cBISKIpHuGoVXh+dVKhn2Um6rjCsSsg= github.com/uber/jaeger-lib v2.4.1+incompatible/go.mod h1:ComeNDZlWwrWnDv8aPp0Ba6+uUTzImX/AauajbLI56U= -github.com/xanzy/ssh-agent v0.3.3 h1:+/15pJfg/RsTxqYcX6fHqOXZwwMP+2VyYWJeWM2qQFM= -github.com/xanzy/ssh-agent v0.3.3/go.mod h1:6dzNDKs0J9rVPHPhaGCukekBHKqfl+L3KghI1Bc68Uw= github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no= github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM= github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= @@ -241,16 +223,26 @@ go.opentelemetry.io/collector/internal/testutil v0.147.0 h1:DFlRxBRp23/sZnpTITK2 go.opentelemetry.io/collector/internal/testutil v0.147.0/go.mod h1:Jkjs6rkqs973LqgZ0Fe3zrokQRKULYXPIf4HuqStiEE= go.opentelemetry.io/collector/pdata v1.53.0 h1:DlYDbRwammEZaxDZHINx5v0n8SEOVNniPbi6FRTlVkA= go.opentelemetry.io/collector/pdata v1.53.0/go.mod h1:LRSYGNjKXaUrZEwZv3Yl+8/zV2HmRGKXW62zB2bysms= +go.opentelemetry.io/contrib/bridges/otelslog v0.18.0 h1:hhPGP3zvvy1xWT9RTy970wlniSxFttBIsAK1gvMguJM= +go.opentelemetry.io/contrib/bridges/otelslog v0.18.0/go.mod h1:twJF7inoMza6kxMcF8JOdL3mPmtOZu7GEr34CUNE6Dg= go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I= go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0= +go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.19.0 h1:Dn8rkudDzY6KV9dr/D/bTUuWgqDf9xe0rr4G2elrn0Y= +go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.19.0/go.mod h1:gMk9F0xDgyN9M/3Ed5Y1wKcx/9mlU91NXY2SNq7RQuU= go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.42.0 h1:THuZiwpQZuHPul65w4WcwEnkX2QIuMT+UFoOrygtoJw= go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.42.0/go.mod h1:J2pvYM5NGHofZ2/Ru6zw/TNWnEQp5crgyDeSrYpXkAw= go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.42.0 h1:zWWrB1U6nqhS/k6zYB74CjRpuiitRtLLi68VcgmOEto= go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.42.0/go.mod h1:2qXPNBX1OVRC0IwOnfo1ljoid+RD0QK3443EaqVlsOU= +go.opentelemetry.io/otel/log v0.19.0 h1:KUZs/GOsw79TBBMfDWsXS+KZ4g2Ckzksd1ymzsIEbo4= +go.opentelemetry.io/otel/log v0.19.0/go.mod h1:5DQYeGmxVIr4n0/BcJvF4upsraHjg6vudJJpnkL6Ipk= go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM= go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY= go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg= go.opentelemetry.io/otel/sdk v1.43.0/go.mod h1:P+IkVU3iWukmiit/Yf9AWvpyRDlUeBaRg6Y+C58QHzg= +go.opentelemetry.io/otel/sdk/log v0.19.0 h1:scYVLqT22D2gqXItnWiocLUKGH9yvkkeql5dBDiXyko= +go.opentelemetry.io/otel/sdk/log v0.19.0/go.mod h1:vFBowwXGLlW9AvpuF7bMgnNI95LiW10szrOdvzBHlAg= +go.opentelemetry.io/otel/sdk/log/logtest v0.19.0 h1:BEbF7ZBB6qQloV/Ub1+3NQoOUnVtcGkU3XX4Ws3GQfk= +go.opentelemetry.io/otel/sdk/log/logtest v0.19.0/go.mod h1:Lua81/3yM0wOmoHTokLj9y9ADeA02v1naRrVrkAZuKk= go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw= go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A= go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A= @@ -273,9 +265,8 @@ go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= -golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4= -golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI= -golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q= +golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988= +golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc= golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJkhzJCK5J6kUi1NTVXfM= golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f/go.mod h1:J1xhfL/vlindoeF/aINzNzt2Bket5bjo9sdOYzOsU80= golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY= @@ -289,9 +280,8 @@ golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLL golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20200421231249-e086a090c8fd/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A= golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= -golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= -golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA= -golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs= +golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8= +golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= @@ -304,23 +294,16 @@ golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7w golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200909081042-eff7692f9009/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI= -golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= -golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= -golang.org/x/term v0.42.0 h1:UiKe+zDFmJobeJ5ggPwOshJIVt6/Ft0rcfrXZDLWAWY= -golang.org/x/term v0.42.0/go.mod h1:Dq/D+snpsbazcBG5+F9Q1n2rXV8Ma+71xEjTRufARgY= +golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY= +golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= +golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4= +golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= -golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= -golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg= -golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164= +golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc= +golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20181030221726-6c7e314b6563/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= @@ -335,10 +318,10 @@ golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8T golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4= gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E= -google.golang.org/genproto/googleapis/api v0.0.0-20260311181403-84a4fc48630c h1:OyQPd6I3pN/9gDxz6L13kYGJgqkpdrAohJRBeXyxlgI= -google.golang.org/genproto/googleapis/api v0.0.0-20260311181403-84a4fc48630c/go.mod h1:X2gu9Qwng7Nn009s/r3RUxqkzQNqOrAy79bluY7ojIg= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260311181403-84a4fc48630c h1:xgCzyF2LFIO/0X2UAoVRiXKU5Xg6VjToG4i2/ecSswk= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260311181403-84a4fc48630c/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= +google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 h1:VPWxll4HlMw1Vs/qXtN7BvhZqsS9cdAittCNvVENElA= +google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9/go.mod h1:7QBABkRtR8z+TEnmXTqIqwJLlzrZKVfAUm7tY3yGv0M= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9 h1:m8qni9SQFH0tJc1X0vmnpw/0t+AImlSvp30sEupozUg= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= google.golang.org/grpc v1.80.0 h1:Xr6m2WmWZLETvUNvIUmeD5OAagMw3FiKmMlTdViWsHM= google.golang.org/grpc v1.80.0/go.mod h1:ho/dLnxwi3EDJA4Zghp7k2Ec1+c2jqup0bFkw07bwF4= google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE= @@ -347,8 +330,6 @@ gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q= -gopkg.in/warnings.v0 v0.1.2 h1:wFXVbFY8DY5/xOe1ECiWdKCzZlxgshcYVNkBHstARME= -gopkg.in/warnings.v0 v0.1.2/go.mod h1:jksf8JmL6Qr/oQM2OXTHunEvvTAsrWBLb6OOjuVWRNI= gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY= gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ= From 39e33b5d168de50c238cd7432d5fc411f8fc68ed Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 25 Jun 2026 02:42:30 -0400 Subject: [PATCH 244/313] build(deps): bump github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.13.1 to 1.14.0 (#1375) Bumps [github.com/Azure/azure-sdk-for-go/sdk/azidentity](https://github.com/Azure/azure-sdk-for-go) from 1.13.1 to 1.14.0.
    Release notes

    Sourced from github.com/Azure/azure-sdk-for-go/sdk/azidentity's releases.

    sdk/azidentity/v1.14.0

    1.14.0 (2026-06-15)

    Breaking Changes

    These changes affect only code written against a beta version such as v1.14.0-beta.3

    • Removed WorkloadIdentityCredentialOptions.EnableAzureProxy. It will return in v1.15.0-beta.1

    Bugs Fixed

    • AzureDeveloperCLICredential improved reporting of error messages returned from azd

    Other Changes

    • Returned azidentity errors include links to the troubleshooting guide when appropriate
    • This module now requires a minimum Go version of 1.25
    • Upgraded dependencies
    Commits

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/Azure/azure-sdk-for-go/sdk/azidentity&package-manager=go_modules&previous-version=1.13.1&new-version=1.14.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 8 ++++---- go.sum | 20 ++++++++++---------- 2 files changed, 14 insertions(+), 14 deletions(-) diff --git a/go.mod b/go.mod index 1dbf670..07af7a0 100644 --- a/go.mod +++ b/go.mod @@ -4,7 +4,7 @@ go 1.26 require ( cloud.google.com/go/kms v1.31.0 - github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 + github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.0 github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.5.0 github.com/caarlos0/env/v11 v11.4.1 github.com/coreos/go-oidc/v3 v3.18.0 @@ -33,10 +33,10 @@ require ( cloud.google.com/go/compute/metadata v0.9.0 // indirect cloud.google.com/go/iam v1.7.0 // indirect cloud.google.com/go/longrunning v0.9.0 // indirect - github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0 // indirect - github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 // indirect + github.com/Azure/azure-sdk-for-go/sdk/azcore v1.22.0 // indirect + github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0 // indirect github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0 // indirect - github.com/AzureAD/microsoft-authentication-library-for-go v1.7.0 // indirect + github.com/AzureAD/microsoft-authentication-library-for-go v1.7.2 // indirect github.com/beorn7/perks v1.0.1 // indirect github.com/cespare/xxhash/v2 v2.3.0 // indirect github.com/davecgh/go-spew v1.1.1 // indirect diff --git a/go.sum b/go.sum index af66f73..6f5f000 100644 --- a/go.sum +++ b/go.sum @@ -12,22 +12,22 @@ cloud.google.com/go/kms v1.31.0 h1:LS8N92OxFDgOLg5NCo3OmbvjtQAIVT5gUHVLKIDHaFE= cloud.google.com/go/kms v1.31.0/go.mod h1:YIyXZym11R5uovJJt4oN5eUL3oPmirF3yKeIh6QAf4U= cloud.google.com/go/longrunning v0.9.0 h1:0EzbDEGsAvOZNbqXopgniY0w0a1phvu5IdUFq8grmqY= cloud.google.com/go/longrunning v0.9.0/go.mod h1:pkTz846W7bF4o2SzdWJ40Hu0Re+UoNT6Q5t+igIcb8E= -github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0 h1:fou+2+WFTib47nS+nz/ozhEBnvU96bKHy6LjRsY4E28= -github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0/go.mod h1:t76Ruy8AHvUAC8GfMWJMa0ElSbuIcO03NLpynfbgsPA= -github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 h1:Hk5QBxZQC1jb2Fwj6mpzme37xbCDdNTxU7O9eb5+LB4= -github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1/go.mod h1:IYus9qsFobWIc2YVwe/WPjcnyCkPKtnHAqUYeebc8z0= -github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.2 h1:yz1bePFlP5Vws5+8ez6T3HWXPmwOK7Yvq8QxDBD3SKY= -github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.3.2/go.mod h1:Pa9ZNPuoNu/GztvBSKk9J1cDJW6vk/n0zLtV4mgd8N8= -github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 h1:9iefClla7iYpfYWdzPCRDozdmndjTm8DXdpCzPajMgA= -github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2/go.mod h1:XtLgD3ZD34DAaVIIAyG3objl5DynM3CQ/vMcbBNJZGI= +github.com/Azure/azure-sdk-for-go/sdk/azcore v1.22.0 h1:aokoqcHvaGjiM3VpjKDfMMnF/8epJ+Q1HLJ7CudztqE= +github.com/Azure/azure-sdk-for-go/sdk/azcore v1.22.0/go.mod h1:/WYEx9pcM9Y+Dd/APJaNlSvVSvzl54rrMdZT5+Oi2LM= +github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.0 h1:CU4+EJeJi3TKYWEcYuSdWsjzw0nVsK/H0MSQOiPcymU= +github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.0/go.mod h1:q0+UTSRvShwUCrR/s5HtyInYphN7Wvxb7snFM3u+SLA= +github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.4.0 h1:xFaZZ+IubdftrDHnGGwZ6QvQ3KHTtWl2MCK+GMt2vxs= +github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.4.0/go.mod h1:mCBhUhlMjLLJKr5aqw2TNS/VqJOie8MzWq3DAMJeKso= +github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0 h1:fhqpLE3UEXi9lPaBRpQ6XuRW0nU7hgg4zlmZZa+a9q4= +github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0/go.mod h1:7dCRMLwisfRH3dBupKeNCioWYUZ4SS09Z14H+7i8ZoY= github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.5.0 h1:MaKvxE6D0KkjOg6Wd9M00iqP5PR0kUxCfiezes4JweM= github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.5.0/go.mod h1:i2h9fsTFKZorh8RdV2IcSUf/Qj98GlTkrTvUbX/s8as= github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0 h1:nCYfgcSyHZXJI8J0IWE5MsCGlb2xp9fJiXyxWgmOFg4= github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0/go.mod h1:ucUjca2JtSZboY8IoUqyQyuuXvwbMBVwFOm0vdQPNhA= github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1 h1:WJTmL004Abzc5wDB5VtZG2PJk5ndYDgVacGqfirKxjM= github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1/go.mod h1:tCcJZ0uHAmvjsVYzEFivsRTN00oz5BEsRgQHu5JZ9WE= -github.com/AzureAD/microsoft-authentication-library-for-go v1.7.0 h1:4iB+IesclUXdP0ICgAabvq2FYLXrJWKx1fJQ+GxSo3Y= -github.com/AzureAD/microsoft-authentication-library-for-go v1.7.0/go.mod h1:HKpQxkWaGLJ+D/5H8QRpyQXA1eKjxkFlOMwck5+33Jk= +github.com/AzureAD/microsoft-authentication-library-for-go v1.7.2 h1:RHK7bS+HQMslb1sZpAokUt+zTVmue0hKSs2C791hhzU= +github.com/AzureAD/microsoft-authentication-library-for-go v1.7.2/go.mod h1:HKpQxkWaGLJ+D/5H8QRpyQXA1eKjxkFlOMwck5+33Jk= github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM= github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw= github.com/caarlos0/env/v11 v11.4.1 h1:fYwH0sWEsBSMPG7t4e/PEfTFzrWrpjyygXyUnWiSwEw= From 12b31e9d0934ae014189faeb27b91eaa0963ef64 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 25 Jun 2026 02:42:46 -0400 Subject: [PATCH 245/313] build(deps): bump github.com/coreos/go-oidc/v3 from 3.18.0 to 3.19.0 (#1374) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [github.com/coreos/go-oidc/v3](https://github.com/coreos/go-oidc) from 3.18.0 to 3.19.0.
    Release notes

    Sourced from github.com/coreos/go-oidc/v3's releases.

    v3.19.0

    What's Changed

    New Contributors

    Full Changelog: https://github.com/coreos/go-oidc/compare/v3.18.0...v3.19.0

    Commits
    • 4204f0b oidc: add support for validating back-channel logout tokens
    • f77e01c fix: Key refresh should set no-cache to get most up to date keys
    • See full diff in compare view

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/coreos/go-oidc/v3&package-manager=go_modules&previous-version=3.18.0&new-version=3.19.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 07af7a0..ec720a0 100644 --- a/go.mod +++ b/go.mod @@ -7,7 +7,7 @@ require ( github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.0 github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.5.0 github.com/caarlos0/env/v11 v11.4.1 - github.com/coreos/go-oidc/v3 v3.18.0 + github.com/coreos/go-oidc/v3 v3.19.0 github.com/danielgtaylor/huma/v2 v2.38.0 github.com/golang-jwt/jwt/v5 v5.3.1 github.com/google/go-containerregistry v0.21.6 diff --git a/go.sum b/go.sum index 6f5f000..fb9aa28 100644 --- a/go.sum +++ b/go.sum @@ -36,8 +36,8 @@ github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UF github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5 h1:6xNmx7iTtyBRev0+D/Tv1FZd4SCg8axKApyNyRsAt/w= github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5/go.mod h1:KdCmV+x/BuvyMxRnYBlmVaq4OLiKW6iRQfvC62cvdkI= -github.com/coreos/go-oidc/v3 v3.18.0 h1:V9orjXynvu5wiC9SemFTWnG4F45v403aIcjWo0d41+A= -github.com/coreos/go-oidc/v3 v3.18.0/go.mod h1:DYCf24+ncYi+XkIH97GY1+dqoRlbaSI26KVTCI9SrY4= +github.com/coreos/go-oidc/v3 v3.19.0 h1:F/xyOi3x1UnG1U27YVnM1N6bHiL1K2upi6U/0qr8r+I= +github.com/coreos/go-oidc/v3 v3.19.0/go.mod h1:DYCf24+ncYi+XkIH97GY1+dqoRlbaSI26KVTCI9SrY4= github.com/danielgtaylor/huma/v2 v2.38.0 h1:fb0WZCatnaiHLphMQDDWDjygNxfMkX/ENma3QsRl7vY= github.com/danielgtaylor/huma/v2 v2.38.0/go.mod h1:k9hwjlgWFt1t2jsmQGlsgXAG2FBTZa4kkjV581qAtfo= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= From dda760f0a9105d6dfe7b05e7e2c202ce1059f28b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 25 Jun 2026 02:43:06 -0400 Subject: [PATCH 246/313] build(deps): bump github.com/google/go-containerregistry from 0.21.6 to 0.21.7 (#1373) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) from 0.21.6 to 0.21.7.
    Release notes

    Sourced from github.com/google/go-containerregistry's releases.

    v0.21.7

    What's Changed

    New Contributors

    Full Changelog: https://github.com/google/go-containerregistry/compare/v0.21.6...v0.21.7

    Commits
    • c68d899 Bump go version to 1.26.4 (#2350)
    • da61d86 transport: do not re-attach bearer token after cross-host redirect (#2349)
    • 09fe1e5 fix(tarball): normalize paths when matching files (#2334)
    • 5baa399 build(deps): bump the go-deps group across 3 directories with 4 updates (#2348)
    • 97a8a17 fix(transport): apply refreshed bearer token after cross-host redirect (#2337)
    • e963497 internal/gzip: fix goroutine leak in ReadCloserLevel (#2347)
    • 02649ea fix: prevent SSRF in google.List() pagination (#2332)
    • 7204b40 build(deps): bump the actions group across 1 directory with 2 updates (#2344)
    • 4cfaa93 build(deps): bump the go-deps group across 1 directory with 2 updates (#2343)
    • 6849394 pkg/registry: export RedirectError (#2177)
    • Additional commits viewable in compare view

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/google/go-containerregistry&package-manager=go_modules&previous-version=0.21.6&new-version=0.21.7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 10 +++++----- go.sum | 20 ++++++++++---------- 2 files changed, 15 insertions(+), 15 deletions(-) diff --git a/go.mod b/go.mod index ec720a0..c0a9a45 100644 --- a/go.mod +++ b/go.mod @@ -10,7 +10,7 @@ require ( github.com/coreos/go-oidc/v3 v3.19.0 github.com/danielgtaylor/huma/v2 v2.38.0 github.com/golang-jwt/jwt/v5 v5.3.1 - github.com/google/go-containerregistry v0.21.6 + github.com/google/go-containerregistry v0.21.7 github.com/jackc/pgx/v5 v5.10.0 github.com/prometheus/client_golang v1.23.2 github.com/rs/cors v1.11.1 @@ -22,7 +22,7 @@ require ( go.opentelemetry.io/otel/metric v1.44.0 go.opentelemetry.io/otel/sdk v1.44.0 go.opentelemetry.io/otel/sdk/metric v1.44.0 - golang.org/x/mod v0.36.0 + golang.org/x/mod v0.37.0 gopkg.in/yaml.v3 v3.0.1 ) @@ -40,7 +40,7 @@ require ( github.com/beorn7/perks v1.0.1 // indirect github.com/cespare/xxhash/v2 v2.3.0 // indirect github.com/davecgh/go-spew v1.1.1 // indirect - github.com/docker/cli v29.4.3+incompatible // indirect + github.com/docker/cli v29.5.3+incompatible // indirect github.com/docker/docker-credential-helpers v0.9.3 // indirect github.com/felixge/httpsnoop v1.0.4 // indirect github.com/go-jose/go-jose/v4 v4.1.4 // indirect @@ -73,8 +73,8 @@ require ( golang.org/x/crypto v0.51.0 // indirect golang.org/x/net v0.55.0 // indirect golang.org/x/oauth2 v0.36.0 // indirect - golang.org/x/sync v0.20.0 // indirect - golang.org/x/sys v0.45.0 // indirect + golang.org/x/sync v0.21.0 // indirect + golang.org/x/sys v0.46.0 // indirect golang.org/x/text v0.37.0 // indirect golang.org/x/time v0.15.0 // indirect google.golang.org/api v0.274.0 // indirect diff --git a/go.sum b/go.sum index fb9aa28..f7a0590 100644 --- a/go.sum +++ b/go.sum @@ -43,8 +43,8 @@ github.com/danielgtaylor/huma/v2 v2.38.0/go.mod h1:k9hwjlgWFt1t2jsmQGlsgXAG2FBTZ github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= -github.com/docker/cli v29.4.3+incompatible h1:u+UliYm2J/rYrIh2FqHQg32neRG8GjbvNuwQRTzGspU= -github.com/docker/cli v29.4.3+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= +github.com/docker/cli v29.5.3+incompatible h1:nbEFfz774vBwQ5KRYv7c/AghjReqnGISvrRhzjV0evs= +github.com/docker/cli v29.5.3+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= github.com/docker/docker-credential-helpers v0.9.3 h1:gAm/VtF9wgqJMoxzT3Gj5p4AqIjCBS4wrsOh9yRqcz8= github.com/docker/docker-credential-helpers v0.9.3/go.mod h1:x+4Gbw9aGmChi3qTLZj8Dfn0TD20M/fuWy0E5+WDeCo= github.com/envoyproxy/go-control-plane v0.14.0 h1:hbG2kr4RuFj222B6+7T83thSPqLjwBIfQawTkC++2HA= @@ -69,8 +69,8 @@ github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps= github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= -github.com/google/go-containerregistry v0.21.6 h1:T+yqQIlJXKrM98Om4DlW3GoWQAmhZuLMwoDOvVrtiUM= -github.com/google/go-containerregistry v0.21.6/go.mod h1:U7MMSBIJynke2MVQrQk19NP9k/uQsGz/h0amIFSHMbo= +github.com/google/go-containerregistry v0.21.7 h1:/vPFuVXDjtFREsVArW+0h1CIl5urnOhzei4X2DMW9IU= +github.com/google/go-containerregistry v0.21.7/go.mod h1:kjSbt7/zMsKLWfnHrIvKvhXHUw91jbe9DNjPPJ32gXE= github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0= github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= @@ -162,17 +162,17 @@ go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ= go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ= golang.org/x/crypto v0.51.0 h1:IBPXwPfKxY7cWQZ38ZCIRPI50YLeevDLlLnyC5wRGTI= golang.org/x/crypto v0.51.0/go.mod h1:8AdwkbraGNABw2kOX6YFPs3WM22XqI4EXEd8g+x7Oc8= -golang.org/x/mod v0.36.0 h1:JJjpVx6myfUsUdAzZuOSTTmRE0PfZeNWzzvKrP7amb4= -golang.org/x/mod v0.36.0/go.mod h1:moc6ELqsWcOw5Ef3xVprK5ul/MvtVvkIXLziUOICjUQ= +golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ= +golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0= golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8= golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww= golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= -golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4= -golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= +golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM= +golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY= -golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= +golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw= +golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc= golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38= golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U= From 44397cbe1d796a351ae6645c8332e2311e2ba2f4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Burak=20Bay=C4=B1r?= Date: Thu, 25 Jun 2026 13:44:48 +0300 Subject: [PATCH 247/313] Fix broken reference documentation links (#1387) Summary: - Fix the reference index FAQ link to point at the existing docs FAQ. - Correct package registry guide links from docs/contributing into docs/reference. Validation: - Focused markdown-link-check on the changed docs passed. - Git whitespace check passed. Co-authored-by: kriptoburak --- docs/contributing/add-package-registry.md | 10 +++++----- docs/reference/README.md | 2 +- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/docs/contributing/add-package-registry.md b/docs/contributing/add-package-registry.md index be0a6ea..170c2d2 100644 --- a/docs/contributing/add-package-registry.md +++ b/docs/contributing/add-package-registry.md @@ -2,9 +2,9 @@ The MCP Registry project is a **metaregistry**, meaning that it hosts metadata for MCP servers but does not host the code for the servers directly. -For local MCP servers, the MCP Registry has pointers in the `packages` node of the [`server.json`](../../reference/server-json/generic-server-json.md) schema that refer to packages in supported package managers. +For local MCP servers, the MCP Registry has pointers in the `packages` node of the [`server.json`](../reference/server-json/generic-server-json.md) schema that refer to packages in supported package managers. -The list of supported package managers for hosting MCP servers is defined by the `properties.packages[N].properties.registryType` string enum in the [`server.json` schema](../../reference/server-json/draft/server.schema.json). For example, this could be "npm" (for npmjs.com packages) or "pypi" (for PyPI packages). +The list of supported package managers for hosting MCP servers is defined by the `properties.packages[N].properties.registryType` string enum in the [`server.json` schema](../reference/server-json/draft/server.schema.json). For example, this could be "npm" (for npmjs.com packages) or "pypi" (for PyPI packages). For remote MCP servers, the package registry is not relevant. The MCP client consumes the server via a URL instead of by downloading and running a package. In other words, this document only applies to local MCP servers. @@ -33,15 +33,15 @@ These steps may evolve as additional validations or details are discovered and m 1. [Create a feature request issue](https://github.com/modelcontextprotocol/registry/issues/new?template=feature_request.md) on the MCP Registry repository to begin the discussion about adding the package registry. - Example for NuGet: https://github.com/modelcontextprotocol/registry/issues/126 1. Open a PR with the following changes: - - Update the [`server.json` schema](../../reference/server-json/draft/server.schema.json) + - Update the [`server.json` schema](../reference/server-json/draft/server.schema.json) - Add your package registry name to the `registryType` example array. - Add your package registry base url to the `registryBaseUrl` example array. - Add the single-shot CLI command name to the `runtimeHint` example value array. - - Update the [`openapi.yaml`](../../reference/api/openapi.yaml) + - Update the [`openapi.yaml`](../reference/api/openapi.yaml) - Add your package registry name to the `registryType` enum value array. - Add your package registry base url to the `registryBaseUrl` enum value array. - Add the single-shot CLI command name to the `runtimeHint` example value array. - - Add a sample, minimal `server.json` to the [`server.json` examples](../../reference/server-json/generic-server-json.md). + - Add a sample, minimal `server.json` to the [`server.json` examples](../reference/server-json/generic-server-json.md). - Implement a registry validator: - Create a new validator file: `internal/validators/registries/yourregistry.go`, following the pattern of existing validators. Examples: - **npm**: Checks for an `mcpName` field in `package.json` that matches the server name diff --git a/docs/reference/README.md b/docs/reference/README.md index 73f3518..ea77b30 100644 --- a/docs/reference/README.md +++ b/docs/reference/README.md @@ -19,4 +19,4 @@ Technical specifications and quick lookups for the MCP Registry. ## Quick Reference -- [FAQ](./faq.md) \ No newline at end of file +- [FAQ](../modelcontextprotocol-io/faq.mdx) From 535941a30e92c88b5bc83ef4e951d4183ccf19db Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 25 Jun 2026 06:46:17 -0400 Subject: [PATCH 248/313] build(deps): bump github.com/pulumi/pulumi-kubernetes/sdk/v4 from 4.31.1 to 4.32.0 in /deploy (#1353) Bumps [github.com/pulumi/pulumi-kubernetes/sdk/v4](https://github.com/pulumi/pulumi-kubernetes) from 4.31.1 to 4.32.0.
    Release notes

    Sourced from github.com/pulumi/pulumi-kubernetes/sdk/v4's releases.

    v4.32.0

    No release notes provided.

    Changelog

    Sourced from github.com/pulumi/pulumi-kubernetes/sdk/v4's changelog.

    4.32.0 (June 5, 2026)

    Fixed

    • #3176 ensure Helm-installed CRDs can be resolved during preview
    • #4396 Fix panic when creating a kubernetes.io/service-account-token Secret with a non-existent ServiceAccount.
    • #4394 Don't fail YAML render when a custom resource's namespace scope can't be determined offline. The resource is rendered without a namespace and a warning is logged, rather than erroring.

    Changed

    • Align the documented minimum supported Kubernetes version and local SDK install instructions with current provider behavior.
    Commits

    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- deploy/go.mod | 33 ++++++++++---------- deploy/go.sum | 83 +++++++++++++++++++++++++-------------------------- 2 files changed, 56 insertions(+), 60 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index 53463fe..14d4db7 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -4,7 +4,7 @@ go 1.26 require ( github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 - github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.31.1 + github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.32.0 github.com/pulumi/pulumi/sdk/v3 v3.248.0 gopkg.in/yaml.v2 v2.4.0 ) @@ -14,7 +14,6 @@ require ( github.com/Microsoft/go-winio v0.6.2 // indirect github.com/ProtonMail/go-crypto v1.4.1 // indirect github.com/agext/levenshtein v1.2.3 // indirect - github.com/apparentlymart/go-textseg/v13 v13.0.0 // indirect github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect github.com/atotto/clipboard v0.1.4 // indirect github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect @@ -25,7 +24,7 @@ require ( github.com/charmbracelet/bubbletea v1.3.10 // indirect github.com/charmbracelet/colorprofile v0.4.3 // indirect github.com/charmbracelet/lipgloss v1.1.0 // indirect - github.com/charmbracelet/x/ansi v0.11.6 // indirect + github.com/charmbracelet/x/ansi v0.11.7 // indirect github.com/charmbracelet/x/cellbuf v0.0.15 // indirect github.com/charmbracelet/x/term v0.2.2 // indirect github.com/cheggaaa/pb v1.0.29 // indirect @@ -43,21 +42,21 @@ require ( github.com/gogo/protobuf v1.3.2 // indirect github.com/golang/glog v1.2.5 // indirect github.com/google/uuid v1.6.0 // indirect - github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 // indirect + github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 // indirect github.com/grpc-ecosystem/grpc-opentracing v0.0.0-20180507213350-8e809c8a8645 // indirect github.com/hashicorp/errwrap v1.1.0 // indirect github.com/hashicorp/go-multierror v1.1.1 // indirect - github.com/hashicorp/go-version v1.8.0 // indirect - github.com/hashicorp/hcl/v2 v2.22.0 // indirect + github.com/hashicorp/go-version v1.9.0 // indirect + github.com/hashicorp/hcl/v2 v2.24.0 // indirect github.com/inconshreveable/mousetrap v1.1.0 // indirect github.com/json-iterator/go v1.1.12 // indirect github.com/kevinburke/ssh_config v1.6.0 // indirect github.com/klauspost/compress v1.18.0 // indirect github.com/klauspost/cpuid/v2 v2.3.0 // indirect - github.com/lucasb-eyer/go-colorful v1.3.0 // indirect - github.com/mattn/go-isatty v0.0.20 // indirect + github.com/lucasb-eyer/go-colorful v1.4.0 // indirect + github.com/mattn/go-isatty v0.0.22 // indirect github.com/mattn/go-localereader v0.0.1 // indirect - github.com/mattn/go-runewidth v0.0.21 // indirect + github.com/mattn/go-runewidth v0.0.23 // indirect github.com/mitchellh/go-ps v1.0.0 // indirect github.com/mitchellh/go-wordwrap v1.0.1 // indirect github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect @@ -85,15 +84,15 @@ require ( github.com/uber/jaeger-client-go v2.30.0+incompatible // indirect github.com/uber/jaeger-lib v2.4.1+incompatible // indirect github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect - github.com/zclconf/go-cty v1.13.2 // indirect + github.com/zclconf/go-cty v1.16.3 // indirect go.opentelemetry.io/auto/sdk v1.2.1 // indirect - go.opentelemetry.io/collector/featuregate v1.53.0 // indirect - go.opentelemetry.io/collector/pdata v1.53.0 // indirect + go.opentelemetry.io/collector/featuregate v1.58.0 // indirect + go.opentelemetry.io/collector/pdata v1.58.0 // indirect go.opentelemetry.io/contrib/bridges/otelslog v0.18.0 // indirect go.opentelemetry.io/otel v1.43.0 // indirect go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.19.0 // indirect - go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.42.0 // indirect - go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.42.0 // indirect + go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 // indirect + go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0 // indirect go.opentelemetry.io/otel/log v0.19.0 // indirect go.opentelemetry.io/otel/metric v1.43.0 // indirect go.opentelemetry.io/otel/sdk v1.43.0 // indirect @@ -111,9 +110,9 @@ require ( golang.org/x/term v0.43.0 // indirect golang.org/x/text v0.37.0 // indirect golang.org/x/tools v0.44.0 // indirect - google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 // indirect - google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9 // indirect - google.golang.org/grpc v1.80.0 // indirect + google.golang.org/genproto/googleapis/api v0.0.0-20260522204824-7f3bc5b78da9 // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20260522204824-7f3bc5b78da9 // indirect + google.golang.org/grpc v1.81.1 // indirect google.golang.org/protobuf v1.36.11 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect lukechampine.com/frand v1.5.1 // indirect diff --git a/deploy/go.sum b/deploy/go.sum index 995e9c1..9eb3acd 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -10,8 +10,6 @@ github.com/agext/levenshtein v1.2.3 h1:YB2fHEn0UJagG8T1rrWknE3ZQzWM06O8AMAatNn7l github.com/agext/levenshtein v1.2.3/go.mod h1:JEDfjyjHDjOF/1e4FlBE/PkbqA9OfWu2ki2W0IB5558= github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8= github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be/go.mod h1:ySMOLuWl6zY27l47sB3qLNK6tF2fkHG55UZxx8oIVo4= -github.com/apparentlymart/go-textseg/v13 v13.0.0 h1:Y+KvPE1NYz0xl601PVImeQfFyEy6iT90AvPUL1NNfNw= -github.com/apparentlymart/go-textseg/v13 v13.0.0/go.mod h1:ZK2fH7c4NqDTLtiYLvIkEghdlcqw7yxLeM89kiTRPUo= github.com/apparentlymart/go-textseg/v15 v15.0.0 h1:uYvfpb3DyLSCGWnctWKGj857c6ew1u1fNQOlOtuGxQY= github.com/apparentlymart/go-textseg/v15 v15.0.0/go.mod h1:K8XmNZdhEBkdlyDdvbmmsvpAG721bKi0joRfFdHIWJ4= github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio= @@ -34,8 +32,8 @@ github.com/charmbracelet/colorprofile v0.4.3 h1:QPa1IWkYI+AOB+fE+mg/5/4HRMZcaXex github.com/charmbracelet/colorprofile v0.4.3/go.mod h1:/zT4BhpD5aGFpqQQqw7a+VtHCzu+zrQtt1zhMt9mR4Q= github.com/charmbracelet/lipgloss v1.1.0 h1:vYXsiLHVkK7fp74RkV7b2kq9+zDLoEU4MZoFqR/noCY= github.com/charmbracelet/lipgloss v1.1.0/go.mod h1:/6Q8FR2o+kj8rz4Dq0zQc3vYf7X+B0binUUBwA0aL30= -github.com/charmbracelet/x/ansi v0.11.6 h1:GhV21SiDz/45W9AnV2R61xZMRri5NlLnl6CVF7ihZW8= -github.com/charmbracelet/x/ansi v0.11.6/go.mod h1:2JNYLgQUsyqaiLovhU2Rv/pb8r6ydXKS3NIttu3VGZQ= +github.com/charmbracelet/x/ansi v0.11.7 h1:kzv1kJvjg2S3r9KHo8hDdHFQLEqn4RBCb39dAYC84jI= +github.com/charmbracelet/x/ansi v0.11.7/go.mod h1:9qGpnAVYz+8ACONkZBUWPtL7lulP9No6p1epAihUZwQ= github.com/charmbracelet/x/cellbuf v0.0.15 h1:ur3pZy0o6z/R7EylET877CBxaiE1Sp1GMxoFPAIztPI= github.com/charmbracelet/x/cellbuf v0.0.15/go.mod h1:J1YVbR7MUuEGIFPCaaZ96KDl5NoS0DAWkskup+mOY+Q= github.com/charmbracelet/x/term v0.2.2 h1:xVRT/S2ZcKdhhOuSP4t5cLi5o+JxklsoEObBSgfgZRk= @@ -88,8 +86,8 @@ github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= -github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 h1:HWRh5R2+9EifMyIHV7ZV+MIZqgz+PMpZ14Jynv3O2Zs= -github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0/go.mod h1:JfhWUomR1baixubs02l85lZYYOm7LV6om4ceouMv45c= +github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 h1:5VipnvEpbqr2gA2VbM+nYVbkIF28c5ZQfqCBQ5g2xfk= +github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0/go.mod h1:Hyl3n6Twe1hvtd9XUXDec4pTvgMSEixRuQKPTMH2bNs= github.com/grpc-ecosystem/grpc-opentracing v0.0.0-20180507213350-8e809c8a8645 h1:MJG/KsmcqMwFAkh8mTnAwhyKoB+sTAnY4CACC110tbU= github.com/grpc-ecosystem/grpc-opentracing v0.0.0-20180507213350-8e809c8a8645/go.mod h1:6iZfnjpejD4L/4DwD7NryNaJyCQdzwWwH2MWhCA90Kw= github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4= @@ -97,10 +95,10 @@ github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4= github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo= github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM= -github.com/hashicorp/go-version v1.8.0 h1:KAkNb1HAiZd1ukkxDFGmokVZe1Xy9HG6NUp+bPle2i4= -github.com/hashicorp/go-version v1.8.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA= -github.com/hashicorp/hcl/v2 v2.22.0 h1:hkZ3nCtqeJsDhPRFz5EA9iwcG1hNWGePOTw6oyul12M= -github.com/hashicorp/hcl/v2 v2.22.0/go.mod h1:62ZYHrXgPoX8xBnzl8QzbWq4dyDsDtfCRgIq1rbJEvA= +github.com/hashicorp/go-version v1.9.0 h1:CeOIz6k+LoN3qX9Z0tyQrPtiB1DFYRPfCIBtaXPSCnA= +github.com/hashicorp/go-version v1.9.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA= +github.com/hashicorp/hcl/v2 v2.24.0 h1:2QJdZ454DSsYGoaE6QheQZjtKZSUs9Nh2izTWiwQxvE= +github.com/hashicorp/hcl/v2 v2.24.0/go.mod h1:oGoO1FIQYfn/AgyOhlg9qLC6/nOJPX3qGbkZpYAcqfM= github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8= github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM= @@ -121,20 +119,20 @@ github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ= github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE= -github.com/lucasb-eyer/go-colorful v1.3.0 h1:2/yBRLdWBZKrf7gB40FoiKfAWYQ0lqNcbuQwVHXptag= -github.com/lucasb-eyer/go-colorful v1.3.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0= +github.com/lucasb-eyer/go-colorful v1.4.0 h1:UtrWVfLdarDgc44HcS7pYloGHJUjHV/4FwW4TvVgFr4= +github.com/lucasb-eyer/go-colorful v1.4.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0= github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE= github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA= github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg= github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s= github.com/mattn/go-isatty v0.0.11/go.mod h1:PhnuNfih5lzO57/f3n+odYbM4JtupLOxQOAqxQCu2WE= -github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY= -github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y= +github.com/mattn/go-isatty v0.0.22 h1:j8l17JJ9i6VGPUFUYoTUKPSgKe/83EYU2zBC7YNKMw4= +github.com/mattn/go-isatty v0.0.22/go.mod h1:ZXfXG4SQHsB/w3ZeOYbR0PrPwLy+n6xiMrJlRFqopa4= github.com/mattn/go-localereader v0.0.1 h1:ygSAOl7ZXTx4RdPYinUpg6W99U8jWvWi9Ye2JC/oIi4= github.com/mattn/go-localereader v0.0.1/go.mod h1:8fBrzywKY7BI3czFoHkuzRoWE9C+EiG4R1k4Cjx5p88= github.com/mattn/go-runewidth v0.0.4/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU= -github.com/mattn/go-runewidth v0.0.21 h1:jJKAZiQH+2mIinzCJIaIG9Be1+0NR+5sz/lYEEjdM8w= -github.com/mattn/go-runewidth v0.0.21/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs= +github.com/mattn/go-runewidth v0.0.23 h1:7ykA0T0jkPpzSvMS5i9uoNn2Xy3R383f9HDx3RybWcw= +github.com/mattn/go-runewidth v0.0.23/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs= github.com/mitchellh/go-ps v1.0.0 h1:i6ampVEEF4wQFF+bkYfwYgY+F/uYJDktmvLPf7qIgjc= github.com/mitchellh/go-ps v1.0.0/go.mod h1:J4lOc8z8yJs6vUwklHw2XEIiT4z4C40KtWVN3nvg8Pg= github.com/mitchellh/go-wordwrap v1.0.1 h1:TLuKupo69TCn6TQSyGxwI1EblZZEsQ0vMlAFQflz0v0= @@ -174,8 +172,8 @@ github.com/pulumi/esc v0.24.0 h1:sCtiB0qbyrlU1ZNzJn4dTLYiChl8xeCBFbHWl1YoXJg= github.com/pulumi/esc v0.24.0/go.mod h1:eCOOkcDJS6eooGwdE4/E0+pOsvUWG254+KBmPCFwJpA= github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 h1:w6OnO3d4j5yVf2vpm8OzXFC/xHOEGqt+9FjWCUBCq6U= github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1/go.mod h1:UyZyv7hz4knpFx6/Sh+SkZe6hT6sJHtDvw9A0TbvEsk= -github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.31.1 h1:Hg9RK9zqIU9kFbD5KeiON06gPP7cLgS68jvsgMBmPgw= -github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.31.1/go.mod h1:BAWI9R3JEEGOp1JlXLPSZKwBGANSrPGUWKtMnS5w5qw= +github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.32.0 h1:QwJzM3PseaorfASUlDXxsyntVGac7ZSYjqjxa038uoU= +github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.32.0/go.mod h1:MtckkCd6mzQQ3AYw+qjdt6ROfdBB3dr8dI/dE5/jxrM= github.com/pulumi/pulumi/sdk/v3 v3.248.0 h1:TwY9uuToQO8xIey4a7awRzNX7iJ/doDmZkl1MzxULCE= github.com/pulumi/pulumi/sdk/v3 v3.248.0/go.mod h1:67RnWlA0uRHJKjbOkk1Hqz8BNefYv8csNLgln1EmmII= github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ= @@ -213,26 +211,26 @@ github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavM github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM= github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= -github.com/zclconf/go-cty v1.13.2 h1:4GvrUxe/QUDYuJKAav4EYqdM47/kZa672LwmXFmEKT0= -github.com/zclconf/go-cty v1.13.2/go.mod h1:YKQzy/7pZ7iq2jNFzy5go57xdxdWoLLpaEp4u238AE0= +github.com/zclconf/go-cty v1.16.3 h1:osr++gw2T61A8KVYHoQiFbFd1Lh3JOCXc/jFLJXKTxk= +github.com/zclconf/go-cty v1.16.3/go.mod h1:VvMs5i0vgZdhYawQNq5kePSpLAoz8u1xvZgrPIxfnZE= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y= -go.opentelemetry.io/collector/featuregate v1.53.0 h1:cgjXdtl7jezWxq6V0eohe/JqjY4PBotZGb5+bTR2OJw= -go.opentelemetry.io/collector/featuregate v1.53.0/go.mod h1:PS7zY/zaCb28EqciePVwRHVhc3oKortTFXsi3I6ee4g= -go.opentelemetry.io/collector/internal/testutil v0.147.0 h1:DFlRxBRp23/sZnpTITK25yqe0d56yNvK+63IaWc6OsU= -go.opentelemetry.io/collector/internal/testutil v0.147.0/go.mod h1:Jkjs6rkqs973LqgZ0Fe3zrokQRKULYXPIf4HuqStiEE= -go.opentelemetry.io/collector/pdata v1.53.0 h1:DlYDbRwammEZaxDZHINx5v0n8SEOVNniPbi6FRTlVkA= -go.opentelemetry.io/collector/pdata v1.53.0/go.mod h1:LRSYGNjKXaUrZEwZv3Yl+8/zV2HmRGKXW62zB2bysms= +go.opentelemetry.io/collector/featuregate v1.58.0 h1:Kh6Dpgbxywv/Q3D6qPehaSxNCxvr/U/ki7CL4y3udCo= +go.opentelemetry.io/collector/featuregate v1.58.0/go.mod h1:4ga1QBMPEejXXmpyJS8lmaRpknJ3Lb9Bvk6e420bUFU= +go.opentelemetry.io/collector/internal/testutil v0.152.0 h1:8LGwekR7mLcUDhT1ofLmdnrHRFuUa3U7PBd95ZvJEjQ= +go.opentelemetry.io/collector/internal/testutil v0.152.0/go.mod h1:Jkjs6rkqs973LqgZ0Fe3zrokQRKULYXPIf4HuqStiEE= +go.opentelemetry.io/collector/pdata v1.58.0 h1:5Lxut3NxKp87066Pzt+3q7+JUuFI5B3teCyLZIF8wIs= +go.opentelemetry.io/collector/pdata v1.58.0/go.mod h1:4vZtODINbC/JF3eGocnatdImzbRHseOywIcr+aULjCg= go.opentelemetry.io/contrib/bridges/otelslog v0.18.0 h1:hhPGP3zvvy1xWT9RTy970wlniSxFttBIsAK1gvMguJM= go.opentelemetry.io/contrib/bridges/otelslog v0.18.0/go.mod h1:twJF7inoMza6kxMcF8JOdL3mPmtOZu7GEr34CUNE6Dg= go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I= go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0= go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.19.0 h1:Dn8rkudDzY6KV9dr/D/bTUuWgqDf9xe0rr4G2elrn0Y= go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.19.0/go.mod h1:gMk9F0xDgyN9M/3Ed5Y1wKcx/9mlU91NXY2SNq7RQuU= -go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.42.0 h1:THuZiwpQZuHPul65w4WcwEnkX2QIuMT+UFoOrygtoJw= -go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.42.0/go.mod h1:J2pvYM5NGHofZ2/Ru6zw/TNWnEQp5crgyDeSrYpXkAw= -go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.42.0 h1:zWWrB1U6nqhS/k6zYB74CjRpuiitRtLLi68VcgmOEto= -go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.42.0/go.mod h1:2qXPNBX1OVRC0IwOnfo1ljoid+RD0QK3443EaqVlsOU= +go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 h1:88Y4s2C8oTui1LGM6bTWkw0ICGcOLCAI5l6zsD1j20k= +go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0/go.mod h1:Vl1/iaggsuRlrHf/hfPJPvVag77kKyvrLeD10kpMl+A= +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0 h1:RAE+JPfvEmvy+0LzyUA25/SGawPwIUbZ6u0Wug54sLc= +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0/go.mod h1:AGmbycVGEsRx9mXMZ75CsOyhSP6MFIcj/6dnG+vhVjk= go.opentelemetry.io/otel/log v0.19.0 h1:KUZs/GOsw79TBBMfDWsXS+KZ4g2Ckzksd1ymzsIEbo4= go.opentelemetry.io/otel/log v0.19.0/go.mod h1:5DQYeGmxVIr4n0/BcJvF4upsraHjg6vudJJpnkL6Ipk= go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM= @@ -249,12 +247,12 @@ go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09 go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0= go.opentelemetry.io/proto/otlp v1.10.0 h1:IQRWgT5srOCYfiWnpqUYz9CVmbO8bFmKcwYxpuCSL2g= go.opentelemetry.io/proto/otlp v1.10.0/go.mod h1:/CV4QoCR/S9yaPj8utp3lvQPoqMtxXdzn7ozvvozVqk= -go.opentelemetry.io/proto/slim/otlp v1.9.0 h1:fPVMv8tP3TrsqlkH1HWYUpbCY9cAIemx184VGkS6vlE= -go.opentelemetry.io/proto/slim/otlp v1.9.0/go.mod h1:xXdeJJ90Gqyll+orzUkY4bOd2HECo5JofeoLpymVqdI= -go.opentelemetry.io/proto/slim/otlp/collector/profiles/v1development v0.2.0 h1:o13nadWDNkH/quoDomDUClnQBpdQQ2Qqv0lQBjIXjE8= -go.opentelemetry.io/proto/slim/otlp/collector/profiles/v1development v0.2.0/go.mod h1:Gyb6Xe7FTi/6xBHwMmngGoHqL0w29Y4eW8TGFzpefGA= -go.opentelemetry.io/proto/slim/otlp/profiles/v1development v0.2.0 h1:EiUYvtwu6PMrMHVjcPfnsG3v+ajPkbUeH+IL93+QYyk= -go.opentelemetry.io/proto/slim/otlp/profiles/v1development v0.2.0/go.mod h1:mUUHKFiN2SST3AhJ8XhJxEoeVW12oqfXog0Bo8W3Ec4= +go.opentelemetry.io/proto/slim/otlp v1.10.0 h1:iR97Vs/ZDR+y9TfuP9b1XBtdPWeC+OMslIBmhcLU7jM= +go.opentelemetry.io/proto/slim/otlp v1.10.0/go.mod h1:lV9250stpjYLPNA5viFabIgP2QlUGRT1GdTgAf8SIUk= +go.opentelemetry.io/proto/slim/otlp/collector/profiles/v1development v0.3.0 h1:RUF5rO0hAlgiJt1fzQVzcVs3vZVNHIcMLgOgG4rWNcQ= +go.opentelemetry.io/proto/slim/otlp/collector/profiles/v1development v0.3.0/go.mod h1:I89cynRj8y+383o7tEQVg2SVA6SRgDVIouWPUVXjx0U= +go.opentelemetry.io/proto/slim/otlp/profiles/v1development v0.3.0 h1:CQvJSldHRUN6Z8jsUeYv8J0lXRvygALXIzsmAeCcZE0= +go.opentelemetry.io/proto/slim/otlp/profiles/v1development v0.3.0/go.mod h1:xSQ+mEfJe/GjK1LXEyVOoSI1N9JV9ZI923X5kup43W4= go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE= go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0= go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= @@ -295,7 +293,6 @@ golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7w golang.org/x/sys v0.0.0-20200909081042-eff7692f9009/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY= golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4= @@ -318,12 +315,12 @@ golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8T golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4= gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E= -google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 h1:VPWxll4HlMw1Vs/qXtN7BvhZqsS9cdAittCNvVENElA= -google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9/go.mod h1:7QBABkRtR8z+TEnmXTqIqwJLlzrZKVfAUm7tY3yGv0M= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9 h1:m8qni9SQFH0tJc1X0vmnpw/0t+AImlSvp30sEupozUg= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= -google.golang.org/grpc v1.80.0 h1:Xr6m2WmWZLETvUNvIUmeD5OAagMw3FiKmMlTdViWsHM= -google.golang.org/grpc v1.80.0/go.mod h1:ho/dLnxwi3EDJA4Zghp7k2Ec1+c2jqup0bFkw07bwF4= +google.golang.org/genproto/googleapis/api v0.0.0-20260522204824-7f3bc5b78da9 h1:dlKupvNsf7YXJYxduemxBzqGX8zjzedsttskfjgLIO8= +google.golang.org/genproto/googleapis/api v0.0.0-20260522204824-7f3bc5b78da9/go.mod h1:1dCETSCY2YKZNXQE3h4fun3TYwF5p8jejRKZgfWAgAY= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260522204824-7f3bc5b78da9 h1:UScUq4IhqF8ll85bMGS/l0D+iGzwQXpX5RBYQEwjahU= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260522204824-7f3bc5b78da9/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= +google.golang.org/grpc v1.81.1 h1:VnnIIZ88UzOOKLukQi+ImGz8O1Wdp8nAGGnvOfEIWQQ= +google.golang.org/grpc v1.81.1/go.mod h1:xGH9GfzOyMTGIOXBJmXt+BX/V0kcdQbdcuwQ/zNw42I= google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE= google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= From 65aab7999707e1d3a76955e6b65d02fa43b5cea6 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Thu, 9 Jul 2026 22:43:23 +0300 Subject: [PATCH 249/313] ci: auto-close PRs that try to publish servers via the repo (#1393) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary We keep getting PRs (e.g. #1385, #1368, #1367, #1363, #1354) that try to "publish" an MCP server by adding files under `servers/` or editing `data/seed.json`. That isn't how publishing works — servers are published with the `mcp-publisher` CLI against the live registry API. This adds automation that detects those PRs, comments with a pointer to the publishing quickstart, labels them `invalid`, and closes them. ## How it works (two stages, no `pull_request_target`) `pull_request_target` is intentionally avoided. Instead: - **Stage 1 — `detect-invalid-publish-prs.yml`** runs on `pull_request` (opened/reopened) with a **read-only** token. It only reads the changed file paths and, if the PR *exclusively* touches `servers/**` and/or `data/seed.json` (and the author isn't a MEMBER/OWNER/COLLABORATOR), records just the PR number as a short-lived artifact. It can't comment or close anything. - **Stage 2 — `close-invalid-publish-prs.yml`** runs via `workflow_run` in the trusted base-repo context (write token). It picks up the flagged PR number, **independently re-validates** the PR from the API (still open, external author, files still match, not already labeled), then comments, labels `invalid`, and closes. ### Trust boundary The only thing crossing from the untrusted stage to the privileged stage is the **PR number**, sanitized to digits only. Stage 2 never trusts stage 1's verdict — it re-derives every decision. Neither stage ever checks out or runs PR code. ### Safety against false positives - Fires only when a PR touches *exclusively* `servers/**` and/or `data/seed.json` — a real code PR that also happens to touch seed data is left alone. - Skips `MEMBER`/`OWNER`/`COLLABORATOR` authors, so maintainers editing dev seed data aren't auto-closed. - Idempotent: skips PRs already labeled `invalid` (e.g. if a maintainer reopens one). ## Notes - Like any `pull_request`/`workflow_run` automation, this only takes effect **once merged to `main`** — it is not retroactive and won't run on this PR. The currently-open offending PRs should be closed manually. - Pinned action SHAs match the repo's existing convention (`upload-artifact` reuses the SHA already in `ci.yml`). 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.8 --- .../workflows/close-invalid-publish-prs.yml | 141 ++++++++++++++++++ .../workflows/detect-invalid-publish-prs.yml | 82 ++++++++++ 2 files changed, 223 insertions(+) create mode 100644 .github/workflows/close-invalid-publish-prs.yml create mode 100644 .github/workflows/detect-invalid-publish-prs.yml diff --git a/.github/workflows/close-invalid-publish-prs.yml b/.github/workflows/close-invalid-publish-prs.yml new file mode 100644 index 0000000..27f69a8 --- /dev/null +++ b/.github/workflows/close-invalid-publish-prs.yml @@ -0,0 +1,141 @@ +name: Close invalid publish PRs + +# Stage 2 of 2 (see detect-invalid-publish-prs.yml for stage 1). +# +# Runs in the trusted base-repo context (triggered by workflow_run, not by the +# PR itself), so it has a write token. It picks up the PR number flagged by +# stage 1 and, after independently re-validating the PR from the API, posts a +# comment pointing at the publishing docs, labels it `invalid`, and closes it. +# +# Trust boundary: the ONLY thing crossing from the untrusted stage is the PR +# number (sanitized to digits below). We re-derive every decision (state, +# author, changed files) here, so a wrong/stale artifact can never cause us to +# close a PR that doesn't actually match. + +on: + workflow_run: + workflows: ["Detect invalid publish PRs"] + types: [completed] + +permissions: + contents: read + pull-requests: write + issues: write # labels on PRs go through the issues API + actions: read # needed to list/download the stage-1 artifact + +jobs: + close: + if: github.event.workflow_run.conclusion == 'success' + runs-on: ubuntu-latest + env: + GH_TOKEN: ${{ github.token }} + GH_REPO: ${{ github.repository }} + RUN_ID: ${{ github.event.workflow_run.id }} + COMMENT_BODY: | + Hi @__AUTHOR__ 👋 — thanks for your interest in the MCP Registry! + + It looks like this PR is trying to publish an MCP server by adding or editing files in this repository (under `servers/` or in `data/seed.json`). That isn't how servers get published, so I'm closing this PR automatically. + + **Servers are published with the [`mcp-publisher`](https://github.com/modelcontextprotocol/registry/blob/main/docs/modelcontextprotocol-io/quickstart.mdx) CLI**, not by opening a pull request against this repo. The CLI verifies that you own your namespace and submits your `server.json` directly to the live registry API. + + To publish your server, follow the **[Publishing Quickstart](https://github.com/modelcontextprotocol/registry/blob/main/docs/modelcontextprotocol-io/quickstart.mdx)**. In short: + + ```bash + # Build the publisher CLI + make publisher + + # Authenticate (e.g. via GitHub) and publish your server.json + ./bin/mcp-publisher login github + ./bin/mcp-publisher publish + ``` + + Note: `data/seed.json` is seed data for **local development only** — adding entries there does not publish anything to the registry. + + If you believe this was closed in error, please leave a comment and a maintainer will take a look. 🙇 + + _This is an automated message._ + + steps: + - name: Check for flagged-pr artifact + id: check + run: | + set -euo pipefail + names="$(gh api "repos/$GH_REPO/actions/runs/$RUN_ID/artifacts" --jq '.artifacts[].name' || true)" + if printf '%s\n' "$names" | grep -qx "flagged-pr"; then + echo "found=true" >> "$GITHUB_OUTPUT" + else + echo "No flagged-pr artifact on run $RUN_ID; nothing to do." + echo "found=false" >> "$GITHUB_OUTPUT" + fi + + - name: Download flagged PR number + if: steps.check.outputs.found == 'true' + uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + with: + name: flagged-pr + run-id: ${{ github.event.workflow_run.id }} + github-token: ${{ github.token }} + + - name: Re-validate and close + if: steps.check.outputs.found == 'true' + run: | + set -euo pipefail + + # Sanitize: the only cross-boundary input. Keep digits only. + PR_NUMBER="$(tr -dc '0-9' < pr-number.txt)" + if [ -z "$PR_NUMBER" ]; then + echo "No valid PR number in artifact; skipping." + exit 0 + fi + echo "Re-validating PR #$PR_NUMBER" + + state="$(gh pr view "$PR_NUMBER" --json state --jq '.state')" + if [ "$state" != "OPEN" ]; then + echo "PR #$PR_NUMBER is $state, not OPEN; skipping." + exit 0 + fi + + assoc="$(gh pr view "$PR_NUMBER" --json authorAssociation --jq '.authorAssociation')" + case "$assoc" in + MEMBER|OWNER|COLLABORATOR) + echo "Author association '$assoc' is trusted; skipping." + exit 0 + ;; + esac + + # Idempotency: if a maintainer reopens after we labeled it, leave it be. + # Capture into a var first so a transient gh failure can't fail open + # (an errored fetch piped to grep would otherwise look "not labeled"). + labels="$(gh pr view "$PR_NUMBER" --json labels --jq '.labels[].name' || true)" + if printf '%s\n' "$labels" | grep -qx "invalid"; then + echo "PR #$PR_NUMBER already labeled 'invalid'; skipping." + exit 0 + fi + + # Paginated REST endpoint (gh pr view --json files caps at 100, no pagination). + mapfile -t FILES < <(gh api --paginate "repos/$GH_REPO/pulls/$PR_NUMBER/files" --jq '.[].filename') + if [ "${#FILES[@]}" -eq 0 ]; then + echo "No files for PR #$PR_NUMBER; skipping." + exit 0 + fi + publish_attempt=0 + other=0 + for f in "${FILES[@]}"; do + if [[ "$f" == servers/* || "$f" == "data/seed.json" ]]; then + publish_attempt=1 + else + other=1 + fi + done + if [ "$publish_attempt" -ne 1 ] || [ "$other" -ne 0 ]; then + echo "PR #$PR_NUMBER no longer matches the publish-attempt pattern; skipping." + exit 0 + fi + + author="$(gh pr view "$PR_NUMBER" --json author --jq '.author.login')" + body="${COMMENT_BODY//__AUTHOR__/$author}" + + echo "Commenting on, labeling, and closing PR #$PR_NUMBER" + gh pr comment "$PR_NUMBER" --body "$body" + gh pr edit "$PR_NUMBER" --add-label "invalid" || echo "Could not add label; continuing." + gh pr close "$PR_NUMBER" diff --git a/.github/workflows/detect-invalid-publish-prs.yml b/.github/workflows/detect-invalid-publish-prs.yml new file mode 100644 index 0000000..355521b --- /dev/null +++ b/.github/workflows/detect-invalid-publish-prs.yml @@ -0,0 +1,82 @@ +name: Detect invalid publish PRs + +# Stage 1 of 2 (see close-invalid-publish-prs.yml for stage 2). +# +# Some contributors try to "publish" a server by opening a PR that adds files +# under servers/ or edits data/seed.json. That is not how publishing works - +# servers are published with the mcp-publisher CLI against the live registry +# API. This job only DETECTS such PRs. It runs from the (untrusted) PR context +# with a read-only token, so it cannot comment on or close anything. When it +# finds a match it records just the PR number as an artifact; the privileged +# stage-2 workflow picks that up via workflow_run and acts on it. +# +# We never check out or run the PR's code - we only read changed file paths. + +on: + pull_request: + types: [opened, reopened] + +permissions: + contents: read + pull-requests: read + +jobs: + detect: + runs-on: ubuntu-latest + env: + GH_TOKEN: ${{ github.token }} + GH_REPO: ${{ github.repository }} + PR_NUMBER: ${{ github.event.pull_request.number }} + AUTHOR_ASSOCIATION: ${{ github.event.pull_request.author_association }} + steps: + - name: Classify PR + id: classify + run: | + set -euo pipefail + match=false + + # Maintainers may legitimately touch these files (e.g. dev seed data), + # so never flag their PRs. + case "$AUTHOR_ASSOCIATION" in + MEMBER|OWNER|COLLABORATOR) + echo "Author association '$AUTHOR_ASSOCIATION' is trusted; not flagging." + ;; + *) + # Use the paginated REST endpoint: `gh pr view --json files` caps + # at 100 files with no pagination, which could truncate a large PR + # and cause a false match. + mapfile -t FILES < <(gh api --paginate "repos/$GH_REPO/pulls/$PR_NUMBER/files" --jq '.[].filename') + if [ "${#FILES[@]}" -gt 0 ]; then + # Flag only if the PR touches *exclusively* publish-attempt files + # (servers/** and/or data/seed.json) and nothing else, so that + # legit PRs touching seed data alongside real code are left alone. + publish_attempt=0 + other=0 + for f in "${FILES[@]}"; do + if [[ "$f" == servers/* || "$f" == "data/seed.json" ]]; then + publish_attempt=1 + else + echo "Non-publish file changed: $f" + other=1 + fi + done + if [ "$publish_attempt" -eq 1 ] && [ "$other" -eq 0 ]; then + match=true + fi + fi + ;; + esac + + echo "PR #$PR_NUMBER match=$match" + echo "match=$match" >> "$GITHUB_OUTPUT" + if [ "$match" = "true" ]; then + echo "$PR_NUMBER" > pr-number.txt + fi + + - name: Record flagged PR number + if: steps.classify.outputs.match == 'true' + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v4 + with: + name: flagged-pr + path: pr-number.txt + retention-days: 1 From f3162dbc1ecf54d27b5778bed62842078c7ece09 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 9 Jul 2026 15:52:31 -0400 Subject: [PATCH 250/313] build(deps): bump golang.org/x/mod from 0.37.0 to 0.38.0 (#1428) Bumps [golang.org/x/mod](https://github.com/golang/mod) from 0.37.0 to 0.38.0.
    Commits
    • 792ac16 go.mod: update golang.org/x dependencies
    • fe2ec04 all: fix some comments to improve readability
    • See full diff in compare view

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=golang.org/x/mod&package-manager=go_modules&previous-version=0.37.0&new-version=0.38.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index c0a9a45..75e750d 100644 --- a/go.mod +++ b/go.mod @@ -22,7 +22,7 @@ require ( go.opentelemetry.io/otel/metric v1.44.0 go.opentelemetry.io/otel/sdk v1.44.0 go.opentelemetry.io/otel/sdk/metric v1.44.0 - golang.org/x/mod v0.37.0 + golang.org/x/mod v0.38.0 gopkg.in/yaml.v3 v3.0.1 ) diff --git a/go.sum b/go.sum index f7a0590..f3500a1 100644 --- a/go.sum +++ b/go.sum @@ -162,8 +162,8 @@ go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ= go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ= golang.org/x/crypto v0.51.0 h1:IBPXwPfKxY7cWQZ38ZCIRPI50YLeevDLlLnyC5wRGTI= golang.org/x/crypto v0.51.0/go.mod h1:8AdwkbraGNABw2kOX6YFPs3WM22XqI4EXEd8g+x7Oc8= -golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ= -golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0= +golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk= +golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40= golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8= golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww= golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= From 5cc44d091c4e76b1daaf127f0ac62ddbdb590f7c Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 9 Jul 2026 15:52:55 -0400 Subject: [PATCH 251/313] build(deps): bump github.com/coreos/go-oidc/v3 from 3.19.0 to 3.20.0 (#1429) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [github.com/coreos/go-oidc/v3](https://github.com/coreos/go-oidc) from 3.19.0 to 3.20.0.
    Release notes

    Sourced from github.com/coreos/go-oidc/v3's releases.

    v3.20.0

    What's Changed

    Full Changelog: https://github.com/coreos/go-oidc/compare/v3.19.0...v3.20.0

    Commits
    • 75dfa5c oidc: add constants for "email" and "profile" scopes
    • a89f046 oidc: add API for determining when issuer URLs mismatch
    • 6a69b6d readme: update README and docs
    • f9049c9 oidc: ignore JWKs with unknown signing algorithms rather than failing
    • 2f178e0 SECURITY.md: add a security policy and point to project-level reporting
    • b3bc7da oidc: improve documentation for APIs
    • 0db9053 oidc: modernize with new Go APIs
    • See full diff in compare view

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/coreos/go-oidc/v3&package-manager=go_modules&previous-version=3.19.0&new-version=3.20.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 75e750d..6e3d61f 100644 --- a/go.mod +++ b/go.mod @@ -7,7 +7,7 @@ require ( github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.0 github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.5.0 github.com/caarlos0/env/v11 v11.4.1 - github.com/coreos/go-oidc/v3 v3.19.0 + github.com/coreos/go-oidc/v3 v3.20.0 github.com/danielgtaylor/huma/v2 v2.38.0 github.com/golang-jwt/jwt/v5 v5.3.1 github.com/google/go-containerregistry v0.21.7 diff --git a/go.sum b/go.sum index f3500a1..d6507fd 100644 --- a/go.sum +++ b/go.sum @@ -36,8 +36,8 @@ github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UF github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5 h1:6xNmx7iTtyBRev0+D/Tv1FZd4SCg8axKApyNyRsAt/w= github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5/go.mod h1:KdCmV+x/BuvyMxRnYBlmVaq4OLiKW6iRQfvC62cvdkI= -github.com/coreos/go-oidc/v3 v3.19.0 h1:F/xyOi3x1UnG1U27YVnM1N6bHiL1K2upi6U/0qr8r+I= -github.com/coreos/go-oidc/v3 v3.19.0/go.mod h1:DYCf24+ncYi+XkIH97GY1+dqoRlbaSI26KVTCI9SrY4= +github.com/coreos/go-oidc/v3 v3.20.0 h1:EtE0WIBHk03N+DqGkY4+UONzzZHk7amKt6IyNd7OsZE= +github.com/coreos/go-oidc/v3 v3.20.0/go.mod h1:DYCf24+ncYi+XkIH97GY1+dqoRlbaSI26KVTCI9SrY4= github.com/danielgtaylor/huma/v2 v2.38.0 h1:fb0WZCatnaiHLphMQDDWDjygNxfMkX/ENma3QsRl7vY= github.com/danielgtaylor/huma/v2 v2.38.0/go.mod h1:k9hwjlgWFt1t2jsmQGlsgXAG2FBTZa4kkjV581qAtfo= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= From 7f647ef44fafa91be0cb549880a1440cb17e0daf Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 9 Jul 2026 15:53:11 -0400 Subject: [PATCH 252/313] build(deps): bump the actions group across 1 directory with 4 updates (#1430) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps the actions group with 4 updates in the / directory: [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action), [ko-build/setup-ko](https://github.com/ko-build/setup-ko), [docker/login-action](https://github.com/docker/login-action) and [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action). Updates `golangci/golangci-lint-action` from 9.2.1 to 9.3.0
    Release notes

    Sourced from golangci/golangci-lint-action's releases.

    v9.3.0

    What's Changed

    Changes

    Dependencies

    Full Changelog: https://github.com/golangci/golangci-lint-action/compare/v9.2.1...v9.3.0

    Commits
    • ba0d7d2 chore: prepare release v9.3.0
    • efd0857 feat: add no-run-logs-group as experimental option (#1403)
    • ed485de build(deps): bump undici from 6.24.0 to 6.27.0
    • 8872e8d build(deps-dev): bump js-yaml from 4.1.1 to 4.2.0 (#1400)
    • b163415 build(deps): bump tmp from 0.2.6 to 0.2.7 (#1399)
    • e52a9f8 build(deps): bump github/codeql-action from 4.35.5 to 4.36.0 in the github-ac...
    • 8182aa3 build(deps): bump tmp from 0.2.5 to 0.2.6 (#1397)
    • 5403a41 build(deps): bump github/codeql-action from 4.35.4 to 4.35.5 in the github-ac...
    • See full diff in compare view

    Updates `ko-build/setup-ko` from 0.9 to 0.10
    Release notes

    Sourced from ko-build/setup-ko's releases.

    v0.10

    What's Changed

    New Contributors

    Full Changelog: https://github.com/ko-build/setup-ko/compare/v0.9...v0.10

    Commits
    • 61b4d1d Merge pull request #66 from ko-build/copilot/address-findings-report
    • 92951cd Harden composite action shell input handling
    • 369dc1f Merge pull request #64 from ko-build/dependabot/github_actions/actions/checko...
    • aa4f2f2 Bump actions/checkout from 6.0.3 to 7.0.0
    • 2e5f3a9 Merge pull request #62 from ko-build/dependabot/github_actions/all-22d6a8b472
    • fefb89f Update use-action.yaml
    • 074c423 Update Go version from 1.25 to 1.26 in CI workflow
    • d43b839 Bump the all group across 1 directory with 2 updates
    • 8719e8e Merge pull request #60 from ko-build/dependabot/github_actions/all-2c6e677ddc
    • 9beb6ab Bump actions/setup-go from 6.2.0 to 6.3.0 in the all group
    • Additional commits viewable in compare view

    Updates `docker/login-action` from 4.2.0 to 4.4.0
    Release notes

    Sourced from docker/login-action's releases.

    v4.4.0

    Full Changelog: https://github.com/docker/login-action/compare/v4.3.0...v4.4.0

    v4.3.0

    Full Changelog: https://github.com/docker/login-action/compare/v4.2.0...v4.3.0

    Commits
    • af1e73f Merge pull request #1034 from docker/dependabot/npm_and_yarn/aws-sdk-dependen...
    • da722bd [dependabot skip] chore: update generated content
    • 2916ad6 build(deps): bump the aws-sdk-dependencies group across 1 directory with 2 up...
    • ca0a662 Merge pull request #1035 from crazy-max/fix-registry-auth-empty-mask
    • c455755 chore: update generated content
    • 4835190 skip empty registry-auth secret mask
    • 992421c Merge pull request #1033 from docker/dependabot/github_actions/docker/bake-ac...
    • b249b43 Merge pull request #1032 from docker/dependabot/github_actions/docker/bake-ac...
    • 1b67977 build(deps): bump docker/bake-action from 7.2.0 to 7.3.0
    • 9d49d6a build(deps): bump docker/bake-action/subaction/matrix
    • Additional commits viewable in compare view

    Updates `goreleaser/goreleaser-action` from 7.2.2 to 7.2.3
    Release notes

    Sourced from goreleaser/goreleaser-action's releases.

    v7.2.3

    What's Changed

    Full Changelog: https://github.com/goreleaser/goreleaser-action/compare/v7.2.2...v7.2.3

    Commits
    • f06c13b chore: update dist
    • d393459 ci: fix job
    • ee731b1 chore: workflow dispatch
    • 55de448 chore(deps): bump js-yaml from 4.1.1 to 4.2.0
    • a4f614e ci: use a GitHub App token to rebuild dist on dependabot PRs (#569)
    • d2d17a6 ci: auto-rebuild dist on dependabot PRs (#568)
    • d13def3 build: regenerate dist after undici 6.27.0 bump (#567)
    • 21549b6 chore(deps): bump undici from 6.24.1 to 6.27.0 (#565)
    • 47c416d ci(deps): bump the actions group with 3 updates (#563)
    • See full diff in compare view

    Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/ci.yml | 4 ++-- .github/workflows/deploy-staging.yml | 4 ++-- .github/workflows/release.yml | 6 +++--- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 5c5edb0..54a4942 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -25,7 +25,7 @@ jobs: cache: true - name: Run lint - uses: golangci/golangci-lint-action@82606bf257cbaff209d206a39f5134f0cfbfd2ee + uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a with: version: v2.11.4 @@ -57,7 +57,7 @@ jobs: cache: true - name: Set up ko - uses: ko-build/setup-ko@v0.9 + uses: ko-build/setup-ko@v0.10 - name: Run all tests run: make test-all diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml index 7ef30b9..7093f4d 100644 --- a/.github/workflows/deploy-staging.yml +++ b/.github/workflows/deploy-staging.yml @@ -31,10 +31,10 @@ jobs: cache: true - name: Set up ko - uses: ko-build/setup-ko@v0.9 + uses: ko-build/setup-ko@v0.10 - name: Log in to Container Registry - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 with: registry: ghcr.io username: ${{ github.actor }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 13fb866..2e2df6a 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -31,7 +31,7 @@ jobs: uses: anchore/sbom-action/download-syft@v0.24.0 - name: Run GoReleaser - uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 + uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 with: distribution: goreleaser version: v2.12.0 @@ -54,10 +54,10 @@ jobs: cache: true - name: Set up ko - uses: ko-build/setup-ko@v0.9 + uses: ko-build/setup-ko@v0.10 - name: Log in to Container Registry - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 with: registry: ghcr.io username: ${{ github.actor }} From 224e23dc2c9fc68ed054e335defd6ca8b64235b7 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 9 Jul 2026 15:53:31 -0400 Subject: [PATCH 253/313] build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.248.0 to 3.251.0 in /deploy (#1431) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from 3.248.0 to 3.251.0.
    Release notes

    Sourced from github.com/pulumi/pulumi/sdk/v3's releases.

    v3.251.0

    3.251.0 (2026-07-08)

    Bug Fixes

    • [cli] Show a retain marker for retain-on-delete resources in --diff output #23754
    • [cli] Don't miscopy out archives #23798

    Miscellaneous

    • [cli] Add pulumi neo --debug-update and pulumi neo --debug-preview flags to investigate a failed update or preview, suggested in the failure output #23499

    Improvements

    • [cli/convert] Add an ecosystem field to converter mapping requests so a converter can request mappings for the ecosystem it consumes rather than its own name #23804
    • [cli/deployment] pulumi deployment settings no longer writes the local Pulumi.<stack>.deploy.yaml file: the experimental init, pull, configure, and env subcommands have been removed, and the CLI no longer calls the deployment-settings encrypt endpoint. get/edit/destroy continue to manage settings directly in Pulumi Cloud #23480
    • [cli/deployment] The deployment settings file (Pulumi.<stack>.deploy.yaml) has been removed entirely. The experimental pulumi deployment settings push (update/up) command, the --config-file flag, and the SDK helpers that read the file have been removed. Manage deployment settings directly in Pulumi Cloud with pulumi deployment settings get, edit, and destroy #23480

    Bug Fixes

    • [cli/display] Prevent plugin debug logs from appearing as raw JSON in the CLI's output when logging with --logtostderr #23633

    Improvements

    • [cli/env] Report the new revision number when an environment definition is updated (e.g. pulumi env edit, pulumi env provider, pulumi env version rollback) #23799

    Miscellaneous

    • [cli/env] Fold the Pulumi ESC engine and CLI into the pulumi/pulumi monorepo, removing the sdk↔esc Go module cycle. Internal refactor with no user-facing behavior change; pulumi env/pulumi esc are unaffected. #23746

    Improvements

    • [cli/import] Support importing resources under parameterized providers from a converter or import file #23763
    • [cli/import] Support importing resources under extension-parameterized providers #23779

    Features

    • [engine] Add TargetSnippets to deployment options to target snippets by UUID. #23745

    Improvements

    • [engine] Add OpenTelemetry spans to the StackReference read path so performance traces can pinpoint slow snapshot fetches, deserialization, or secret decryption #23787

    Features

    • [programgen/pcl] Invoke functions declared with multi-argument inputs using positional arguments in PCL #23571

    Bug Fixes

    • [sdk/nodejs] Don't include the version in module paths when serializing functions when using pnpm #23767

    ... (truncated)

    Changelog

    Sourced from github.com/pulumi/pulumi/sdk/v3's changelog.

    3.251.0 (2026-07-08)

    Bug Fixes

    • [cli] Show a retain marker for retain-on-delete resources in --diff output #23754
    • [cli] Don't miscopy out archives #23798

    Miscellaneous

    • [cli] Add pulumi neo --debug-update and pulumi neo --debug-preview flags to investigate a failed update or preview, suggested in the failure output #23499

    Improvements

    • [cli/convert] Add an ecosystem field to converter mapping requests so a converter can request mappings for the ecosystem it consumes rather than its own name #23804
    • [cli/deployment] pulumi deployment settings no longer writes the local Pulumi.<stack>.deploy.yaml file: the experimental init, pull, configure, and env subcommands have been removed, and the CLI no longer calls the deployment-settings encrypt endpoint. get/edit/destroy continue to manage settings directly in Pulumi Cloud #23480
    • [cli/deployment] The deployment settings file (Pulumi.<stack>.deploy.yaml) has been removed entirely. The experimental pulumi deployment settings push (update/up) command, the --config-file flag, and the SDK helpers that read the file have been removed. Manage deployment settings directly in Pulumi Cloud with pulumi deployment settings get, edit, and destroy #23480

    Bug Fixes

    • [cli/display] Prevent plugin debug logs from appearing as raw JSON in the CLI's output when logging with --logtostderr #23633

    Improvements

    • [cli/env] Report the new revision number when an environment definition is updated (e.g. pulumi env edit, pulumi env provider, pulumi env version rollback) #23799

    Miscellaneous

    • [cli/env] Fold the Pulumi ESC engine and CLI into the pulumi/pulumi monorepo, removing the sdk↔esc Go module cycle. Internal refactor with no user-facing behavior change; pulumi env/pulumi esc are unaffected. #23746

    Improvements

    • [cli/import] Support importing resources under parameterized providers from a converter or import file #23763
    • [cli/import] Support importing resources under extension-parameterized providers #23779

    Features

    • [engine] Add TargetSnippets to deployment options to target snippets by UUID. #23745

    Improvements

    • [engine] Add OpenTelemetry spans to the StackReference read path so performance traces can pinpoint slow snapshot fetches, deserialization, or secret decryption #23787

    Features

    • [programgen/pcl] Invoke functions declared with multi-argument inputs using positional arguments in PCL #23571

    Bug Fixes

    • [sdk/nodejs] Don't include the version in module paths when serializing functions when using pnpm #23767
    • [sdk/nodejs] Support pnpm 11 #23815

    ... (truncated)

    Commits

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/pulumi/pulumi/sdk/v3&package-manager=go_modules&previous-version=3.248.0&new-version=3.251.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- deploy/go.mod | 3 +-- deploy/go.sum | 6 ++---- 2 files changed, 3 insertions(+), 6 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index 14d4db7..10d9778 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -5,7 +5,7 @@ go 1.26 require ( github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.32.0 - github.com/pulumi/pulumi/sdk/v3 v3.248.0 + github.com/pulumi/pulumi/sdk/v3 v3.251.0 gopkg.in/yaml.v2 v2.4.0 ) @@ -72,7 +72,6 @@ require ( github.com/pkg/errors v0.9.1 // indirect github.com/pkg/term v1.1.0 // indirect github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231 // indirect - github.com/pulumi/esc v0.24.0 // indirect github.com/rivo/uniseg v0.4.7 // indirect github.com/rogpeppe/go-internal v1.14.1 // indirect github.com/santhosh-tekuri/jsonschema/v5 v5.0.0 // indirect diff --git a/deploy/go.sum b/deploy/go.sum index 9eb3acd..86abe20 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -168,14 +168,12 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231 h1:vkHw5I/plNdTr435cARxCW6q9gc0S/Yxz7Mkd38pOb0= github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231/go.mod h1:murToZ2N9hNJzewjHBgfFdXhZKjY3z5cYC1VXk+lbFE= -github.com/pulumi/esc v0.24.0 h1:sCtiB0qbyrlU1ZNzJn4dTLYiChl8xeCBFbHWl1YoXJg= -github.com/pulumi/esc v0.24.0/go.mod h1:eCOOkcDJS6eooGwdE4/E0+pOsvUWG254+KBmPCFwJpA= github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 h1:w6OnO3d4j5yVf2vpm8OzXFC/xHOEGqt+9FjWCUBCq6U= github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1/go.mod h1:UyZyv7hz4knpFx6/Sh+SkZe6hT6sJHtDvw9A0TbvEsk= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.32.0 h1:QwJzM3PseaorfASUlDXxsyntVGac7ZSYjqjxa038uoU= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.32.0/go.mod h1:MtckkCd6mzQQ3AYw+qjdt6ROfdBB3dr8dI/dE5/jxrM= -github.com/pulumi/pulumi/sdk/v3 v3.248.0 h1:TwY9uuToQO8xIey4a7awRzNX7iJ/doDmZkl1MzxULCE= -github.com/pulumi/pulumi/sdk/v3 v3.248.0/go.mod h1:67RnWlA0uRHJKjbOkk1Hqz8BNefYv8csNLgln1EmmII= +github.com/pulumi/pulumi/sdk/v3 v3.251.0 h1:H1D42Jra2jvnEij0M0dZcNGz3Q9DyANsvzQqalncsXU= +github.com/pulumi/pulumi/sdk/v3 v3.251.0/go.mod h1:ZXd0WRd89VLX2juP+HEXMZ+J2AFPfcJTXhdmmv9cMgY= github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ= github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88= github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ= From 2bc37b199917aee2eb225f39fbb2474bbc26405c Mon Sep 17 00:00:00 2001 From: Tadas Antanavicius Date: Fri, 10 Jul 2026 14:05:47 -0700 Subject: [PATCH 254/313] fix(auth): grant org namespace only to org Owners, not all members (#1383) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## The bug (scoped to `github-at`) When you exchange a GitHub OAuth/PAT token for a registry JWT, the handler granted `io.github./*` publish permission for **every** organization you belong to. It derived that list from [`GET /users/{username}/orgs`](https://docs.github.com/en/rest/orgs/orgs#list-organizations-for-a-user), which: 1. returns only **public** org memberships, and 2. carries **no role** — an org Owner and a brand-new member look identical. So membership was silently treated as publishing authority. Anyone who is (or whose public membership lists them as) a member of `acme` could publish — and, because publish is a pure namespace-glob with no per-server ownership check, **overwrite** — any server under `io.github.acme/*`. ## The fix Switch to [`GET /user/memberships/orgs`](https://docs.github.com/en/rest/orgs/members#list-organization-memberships-for-the-authenticated-user), which returns the **authenticated caller's role** per org (and includes private memberships), and grant the org namespace only when the role is `admin` (org Owner). - **Personal namespaces are unchanged** — you always get `io.github./*`. - **Org namespaces now require Owner.** GitHub has no org-level "maintainer" role; org membership is either `admin` (Owner) or `member`. We grant only on `admin`. - **`read:org` is the only scope needed.** A minimal token without it still authenticates and still publishes to your personal namespace; a genuine missing-scope `403` from the memberships call is treated as "no admin orgs" rather than a hard failure, so we don't push anyone to over-scope a token. A `403`/`429` that is actually a rate limit (`X-RateLimit-Remaining: 0` / `Retry-After`) fails closed instead, so a throttle can't silently strip a real Owner's org grant. Critically, the token needs **no repository scopes** — the registry never reads or writes code, so an org Owner can hand CI a near-powerless `read:org` token. The authorization decision stays stateless and delegated to GitHub — no new storage, no new endpoints, no schema changes — consistent with [design principle #2](docs/design/design-principles.md) (minimal operational burden). ### Containing the CI token The registry-side change makes the org Owner the only one who can mint org-namespace authority. But if that Owner drops the resulting PAT into a plain repo secret, **every repository writer** can reach it (via branch/tag pushes that run repo-controlled build/test code in the privileged job) — quietly re-widening publish access beyond Owners. External fork contributors still cannot reach it by default (no secrets on fork PRs, no branch push), barring misconfigurations like `pull_request_target`-with-checkout or self-hosted runners on public repos. `docs/modelcontextprotocol-io/github-actions.mdx` documents how to contain that blast radius: - store the token as a **GitHub Actions Environment secret** (the PAT example uses `environment:`), - restrict that environment to the default branch / release tags and require PR reviews on it, so only reviewed, maintainer-approved code can reach the token, - optionally add a **required environment reviewer** for explicit per-publish approval, - and avoid the two footguns (`pull_request_target` checkout, self-hosted runners on public repos). This shrinks *who holds* the org credential; it does not change the fact that an authorized publish can still overwrite a different server in the same namespace until per-server publisher ownership exists (the follow-up noted below). ## Why this shape, given the alternatives [Pree's writeup](https://github.com/modelcontextprotocol/registry/issues/982#issuecomment-3982959559) ([Notion analysis doc](https://www.notion.so/MCP-Registry-Authorization-Model-Analysis-Issue-982-31736f79f74980bc90c6e53de1c564c5)) is the clearest framing of the problem and the option space, laying out three broad solutions: - **Approach A — GitHub App as the authority layer.** Strong model, but its natural unit of authority is a *repo*, so it needs a repo→server mapping to authorize a namespace. The safe, flexible version of that mapping is registry-managed state — which collapses into Approach B. It's also GitHub-only. - **Approach B — a registry-managed grants table** (OIDC bootstrap, or device-flow admin check). The most capable and provider-agnostic option, and probably where v1 wants to go. But it introduces exactly the "registry manages an authorization database" layer we wanted to avoid taking on right now: revocation, sync, audit, migration. - **Approach C — scoped bearer tokens (npm-style).** Good ergonomics, but again implies issuance/storage the registry would own. The two-property test (does the registry control the decision? is it granted through an act requiring real authority?) is the right lens. This change satisfies it **without** new state: the registry makes the decision (it filters on role), and the authority is real (live GitHub Owner role, re-checked on every short-lived token exchange). **What this deliberately gives up**, so reviewers can weigh it honestly: - **Owners are always in the loop.** Only org Owners can publish org servers; there's no delegated "this team can publish this server" — that needs Approach B's state. Reduced flexibility in exchange for zero new infrastructure. - **Blast radius within an org is unchanged.** An Owner (or Owner-scoped CI token) can still overwrite *any* server under the org namespace, because there's still no per-server publisher ownership. That hijack-an-existing-server problem is real but **orthogonal** to this fix and belongs in its own change (record publisher identity per server; enforce it on update) — a follow-up to take alongside the OIDC hardening below. - **OIDC is untouched and remains coarser.** The `github-oidc` path still grants the whole `io.github./*` namespace to any workflow with `id-token: write`, i.e. effectively anyone with write access to any repo in the org, and it excludes non-Actions CI (Jenkins/GitLab can't mint GitHub Actions OIDC). The admin-PAT path here is the higher-assurance option for org publishing; OIDC stays as a lower-assurance Actions convenience to be tightened separately. ## Revocation The registry JWT is **5-minute, no-refresh** (per #264/#273), so loss of Owner status propagates within minutes on the next token exchange, with no revocation list to maintain. ## Tests `go test ./internal/api/handlers/v0/auth/...` passes, including: - member-role org is **not** granted; only admin orgs are - a missing-scope `403` (no `read:org`) still yields the personal namespace and no error - an admin org on a **later page** of memberships is still granted (pagination correctness) - a `5xx` from the memberships call **fails closed** (no token issued) rather than degrading to personal-only - a rate-limit `403` (`X-RateLimit-Remaining: 0` / `Retry-After`) **fails closed** — not mistaken for a missing-scope `403` - existing org/name-validation tests updated to the new endpoint + role shape `gofmt`/`go vet`/`golangci-lint` (CI-pinned v2.11.4) clean; CI green on all checks. ## Live verification Confirmed end-to-end against real `api.github.com` (not just mocks) by exercising this branch's `ExchangeToken` and decoding the `permissions` claim of the returned JWT. A dedicated org, **Tadasant Test Org** (login `Tadasant-Test-Org`), is Owned by one account and has a second account joined as a plain **member**. Both memberships are `active`, verified via the same endpoint the fix uses (`GET /user/memberships/orgs/{org}`): | Token (role) | `io.github.Tadasant-Test-Org/*` granted? | Other patterns granted | |---|---|---| | Owner (`admin`) | ✅ yes | personal `io.github./*` | | member | ❌ no | personal `io.github./*` + the orgs that account actually Owns | The member case is the meaningful one: that membership is **active and returned** by `GET /user/memberships/orgs`, and is excluded purely because its role is `member`, not `admin`. Under the previous `GET /users/{username}/orgs` behavior (membership = authority, no role), the same active membership **would have granted** the org namespace. The role filter is also selective rather than blanket-deny — the member account still receives the namespaces of the orgs where it genuinely holds Owner. --------- Co-authored-by: Claude Opus 4.8 Co-authored-by: Radoslav Dimitrov --- .../authentication.mdx | 8 + .../github-actions.mdx | 25 +- internal/api/handlers/v0/auth/github_at.go | 159 +++++++- .../v0/auth/github_at_internal_test.go | 33 ++ .../api/handlers/v0/auth/github_at_test.go | 385 +++++++++++++++++- 5 files changed, 573 insertions(+), 37 deletions(-) create mode 100644 internal/api/handlers/v0/auth/github_at_internal_test.go diff --git a/docs/modelcontextprotocol-io/authentication.mdx b/docs/modelcontextprotocol-io/authentication.mdx index 78bf23a..98131d5 100644 --- a/docs/modelcontextprotocol-io/authentication.mdx +++ b/docs/modelcontextprotocol-io/authentication.mdx @@ -47,6 +47,14 @@ Successfully authenticated! ✓ Successfully logged in ``` +### Personal vs. organization namespaces + +GitHub authentication always grants your personal namespace, `io.github./*`. + +To publish under an **organization** namespace (`io.github./*`), you must be an **Owner** of that organization. Ordinary org membership is no longer sufficient: the registry checks your membership role and only grants the org namespace to admins. This prevents anyone who merely belongs to an org from publishing — or overwriting — servers under the org's name. + +If you authenticate with a Personal Access Token (for example in CI), the token must include the `read:org` scope for the registry to see your organization role. A token without `read:org` can still publish to your personal namespace, but org publishing will be silently unavailable. The token needs **no** repository scopes — the registry never reads or writes your code. + ## DNS Authentication DNS authentication is a domain-based authentication method that relies on a DNS TXT record. diff --git a/docs/modelcontextprotocol-io/github-actions.mdx b/docs/modelcontextprotocol-io/github-actions.mdx index 0da50cd..dc02ca5 100644 --- a/docs/modelcontextprotocol-io/github-actions.mdx +++ b/docs/modelcontextprotocol-io/github-actions.mdx @@ -81,6 +81,10 @@ on: jobs: publish: runs-on: ubuntu-latest + # Source MCP_GITHUB_TOKEN from a protected Environment, not a plain repo + # secret, and restrict that environment to your default branch / release + # tags. See "Securing your registry token in CI" below for why this matters. + environment: mcp-registry-publish permissions: contents: read @@ -192,16 +196,33 @@ jobs: ## Step 2: Add Secrets -You may need to add a secret to the repository depending on which authentication method you choose: +You may need to add a secret depending on which authentication method you choose: - **GitHub OIDC Authentication**: No dedicated secret necessary. -- **GitHub PAT Authentication**: Add a `MCP_GITHUB_TOKEN` secret with a GitHub Personal Access Token (PAT) that has `read:org` and `read:user` scopes. +- **GitHub PAT Authentication**: Add a `MCP_GITHUB_TOKEN` secret with a GitHub Personal Access Token (PAT) that has the `read:org` scope. `read:org` is what lets the registry confirm you are an **Owner** of the organization before granting its namespace; the token needs **no** repository scopes (the registry never reads or writes your code), and no other scopes are required — `read:user` is not needed, and a bare token still authenticates and publishes to your personal namespace. For an **organization** token, store it as an **Environment secret** on the `mcp-registry-publish` environment rather than a plain repository secret — see "Securing your registry token in CI" below for why this matters and how to configure the environment. - **DNS Authentication**: Add a `MCP_PRIVATE_KEY` secret with your Ed25519 private key. You may also need to add secrets for your package registry. For example, the workflow above needs an `NPM_TOKEN` secret with your npm token. For information about how to add secrets to a repository, see [Using secrets in GitHub Actions](https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/use-secrets). +### Securing your registry token in CI + +Whichever token you use to authenticate, treat it as a high-value credential. When you authenticate to an **organization** namespace, the resulting registry token can publish — and overwrite — **any** server under `io.github./*`, not just the one in this repository. The relevant question for your threat model is therefore: *who can cause code to run in a job where this secret is exposed?* By default that is **every repository writer** (via branch or tag pushes), not only org Owners — so a plain repo secret quietly widens publish access to everyone with write access. + +GitHub gives you the tools to close that gap. We recommend, in increasing order of strength: + +1. **Store the token as an [Environment secret](https://docs.github.com/en/actions/how-tos/deploy/configure-and-manage-deployments/manage-environments), not a repository or organization secret.** A job can only read an environment secret when it declares `environment:` (as the PAT example above does). Note that the `environment:` key alone protects nothing: if the environment does not exist yet, GitHub **auto-creates it with no protection rules** on first run, and a job that declares `environment:` still also receives ordinary repository and organization secrets. The protection comes from storing the token *as a secret on that environment* and configuring the environment (steps 2–3 below) — not from the `environment:` key by itself. +2. **Restrict that environment to your default branch and/or release tags** with a [deployment branch rule](https://docs.github.com/en/actions/how-tos/deploy/configure-and-manage-deployments/manage-environments#deployment-branches-and-tags), and protect that branch with [required pull request reviews](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches). Now only reviewed, maintainer-approved code can ever reach the token. +3. **(Strongest) Add a [required reviewer](https://docs.github.com/en/actions/how-tos/deploy/configure-and-manage-deployments/manage-environments#required-reviewers) to the environment** so each publish pauses for an explicit human approval. + +Two pitfalls to avoid regardless of the above: + +- **Never publish from a `pull_request_target` workflow that checks out PR-head code.** That trigger runs with your secrets in the base-repo context, so an untrusted fork PR could exfiltrate the token. Environment branch rules do **not** protect you here (the ref is still your base branch) — only required reviewers do. +- **Avoid self-hosted runners for the publish job on public repositories**, where fork PRs may be able to schedule jobs onto them. + +By default, pull requests **from forks** receive no secrets and cannot push branches, so external contributors cannot reach the token without one of the misconfigurations above. + ## Step 3: Tag and Release Create and push a version tag to trigger the workflow: diff --git a/internal/api/handlers/v0/auth/github_at.go b/internal/api/handlers/v0/auth/github_at.go index af5e793..cbfe8dd 100644 --- a/internal/api/handlers/v0/auth/github_at.go +++ b/internal/api/handlers/v0/auth/github_at.go @@ -4,6 +4,7 @@ import ( "context" "encoding/json" "fmt" + "log" "net/http" "regexp" "strings" @@ -57,7 +58,7 @@ func RegisterGitHubATEndpoint(api huma.API, pathPrefix string, cfg *config.Confi }, func(ctx context.Context, input *GitHubTokenExchangeInput) (*v0.Response[auth.TokenResponse], error) { response, err := handler.ExchangeToken(ctx, input.Body.GitHubToken) if err != nil { - return nil, huma.Error401Unauthorized("Token exchange failed", err) + return nil, tokenExchangeError(err) } return &v0.Response[auth.TokenResponse]{ @@ -66,6 +67,17 @@ func RegisterGitHubATEndpoint(api huma.API, pathPrefix string, cfg *config.Confi }) } +// tokenExchangeError maps an internal ExchangeToken failure to a client-facing +// 401 without leaking internal detail. huma serializes extra error args into the +// response body, and the wrapped err here can include the raw upstream GitHub +// response body captured by readErrorBody — so passing it to huma would echo that +// detail back to the caller (CWE-209). We log it server-side (like the sibling +// handlers in servers.go) and return only a generic message. +func tokenExchangeError(err error) error { + log.Printf("github-at token exchange failed: %v", err) + return huma.Error401Unauthorized("Token exchange failed") +} + // ExchangeToken exchanges a GitHub OAuth token for a Registry JWT token func (h *GitHubHandler) ExchangeToken(ctx context.Context, githubToken string) (*auth.TokenResponse, error) { // Get GitHub user information @@ -74,8 +86,9 @@ func (h *GitHubHandler) ExchangeToken(ctx context.Context, githubToken string) ( return nil, fmt.Errorf("failed to get GitHub user: %w", err) } - // Get user's organizations - orgs, err := h.getGitHubUserOrgs(ctx, user.Login, githubToken) + // Get the organizations the user administers. Org namespaces are only granted + // to org Owners (membership role "admin"), not to ordinary members. + orgs, err := h.getGitHubAdminOrgs(ctx, githubToken) if err != nil { return nil, fmt.Errorf("failed to get GitHub organizations: %w", err) } @@ -133,8 +146,87 @@ func (h *GitHubHandler) getGitHubUser(ctx context.Context, token string) (*GitHu return &user, nil } -func (h *GitHubHandler) getGitHubUserOrgs(ctx context.Context, username string, token string) ([]GitHubUserOrOrg, error) { - req, err := http.NewRequestWithContext(ctx, http.MethodGet, h.baseURL+"/users/"+username+"/orgs", nil) +// githubOrgRoleAdmin is the membership role GitHub returns for an organization +// Owner. It is the only role we treat as carrying publish authority for the org +// namespace. GET /user/memberships/orgs reports the caller's role as either +// "admin" (Owner) or "member" (GitHub has no org-level "maintainer" role); only +// "admin" carries publish authority, so a "member" is intentionally not granted. +const githubOrgRoleAdmin = "admin" + +// githubMembershipStateActive is the membership state for an accepted (as opposed +// to merely invited/pending) org membership. We only honor active memberships so a +// not-yet-accepted owner invitation never grants the org namespace. +const githubMembershipStateActive = "active" + +// orgMembershipsPageSize is the page size we request when listing the user's org +// memberships. 100 is GitHub's maximum. +const orgMembershipsPageSize = 100 + +// maxOrgMembershipPages bounds the pagination loop. At orgMembershipsPageSize=100 +// this covers 10,000 org memberships — far beyond any real user — and exists only +// as a backstop so a misbehaving or redirected upstream cannot drive an unbounded +// number of requests. +const maxOrgMembershipPages = 100 + +// githubOrgMembership is one entry from GET /user/memberships/orgs: the +// authenticated user's membership in a single organization, including their role. +type githubOrgMembership struct { + State string `json:"state"` + Role string `json:"role"` + Organization GitHubUserOrOrg `json:"organization"` +} + +// getGitHubAdminOrgs returns the organizations in which the authenticated user is +// an Owner (membership role "admin"). +// +// This deliberately uses GET /user/memberships/orgs rather than +// GET /users/{username}/orgs. The latter only returns *public* memberships and +// carries no role, so it cannot distinguish an Owner from an ordinary member — +// historically every org a user belonged to was granted publish access to its +// namespace regardless of the user's role. The memberships endpoint returns the +// caller's role per org (and includes private memberships), letting us grant the +// org namespace only to people who actually administer the org. +// +// The endpoint requires the read:org scope. A minimal token used only for +// personal-namespace publishing won't have it and will get a 403 here; that is +// treated as "no admin orgs" (see fetchOrgMembershipsPage) so personal publishing +// keeps working without asking users to over-scope their token. +func (h *GitHubHandler) getGitHubAdminOrgs(ctx context.Context, token string) ([]GitHubUserOrOrg, error) { + var adminOrgs []GitHubUserOrOrg + + for page := 1; page <= maxOrgMembershipPages; page++ { + memberships, err := h.fetchOrgMembershipsPage(ctx, token, page) + if err != nil { + return nil, err + } + + for _, m := range memberships { + // state=active is already requested in the query string, but re-check it + // here as defense in depth: if that param is ever dropped or changed, this + // keeps a pending (not-yet-accepted) owner invitation from being granted + // the org namespace. + if m.State == githubMembershipStateActive && m.Role == githubOrgRoleAdmin { + adminOrgs = append(adminOrgs, m.Organization) + } + } + + // A short page is the last page: return the complete result. + if len(memberships) < orgMembershipsPageSize { + return adminOrgs, nil + } + } + + // Every page up to the cap was full. A real user never has this many org + // memberships, so rather than return a possibly-truncated set (which would + // silently strip a legitimate Owner's grant), fail closed. + return nil, fmt.Errorf("org memberships exceeded %d pages; refusing to issue a possibly-truncated grant", maxOrgMembershipPages) +} + +// fetchOrgMembershipsPage fetches a single page of the authenticated user's +// active organization memberships. +func (h *GitHubHandler) fetchOrgMembershipsPage(ctx context.Context, token string, page int) ([]githubOrgMembership, error) { + url := fmt.Sprintf("%s/user/memberships/orgs?state=active&per_page=%d&page=%d", h.baseURL, orgMembershipsPageSize, page) + req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil) if err != nil { return nil, fmt.Errorf("failed to create request: %w", err) } @@ -145,44 +237,69 @@ func (h *GitHubHandler) getGitHubUserOrgs(ctx context.Context, username string, resp, err := http.DefaultClient.Do(req) if err != nil { - return nil, fmt.Errorf("failed to get user organizations: %w", err) + return nil, fmt.Errorf("failed to get user organization memberships: %w", err) } defer resp.Body.Close() + // GitHub returns 403 here for two very different reasons, which we must not + // conflate: + // 1. The token lacks the read:org scope. This is the common, benign case for a + // minimal personal-publishing token: GET /user still works, but org + // memberships are forbidden. We degrade gracefully to "no admin orgs" so + // personal-namespace publishing keeps working without over-scoping. + // 2. Rate limiting. GitHub signals primary/secondary rate limits with 403 (or + // 429), setting X-RateLimit-Remaining: 0 and/or Retry-After. Degrading here + // would silently strip a legitimate Owner's org grant, so we fail closed + // (return an error) rather than mistake a throttle for "not an admin". + if resp.StatusCode == http.StatusForbidden { + if resp.Header.Get("X-RateLimit-Remaining") == "0" || resp.Header.Get("Retry-After") != "" { + return nil, fmt.Errorf("GitHub API rate limit exceeded while listing org memberships (status 403): %s", readErrorBody(resp.Body)) + } + // A SAML/SSO-enforced org returns 403 with an X-GitHub-SSO header when the + // token has not been SSO-authorized. That is an Owner being blocked, not a + // missing scope, so fail closed rather than silently dropping the org grant + // (which would degrade a legitimate Owner to personal-only with no signal). + if resp.Header.Get("X-GitHub-SSO") != "" { + return nil, fmt.Errorf("GitHub org memberships require SSO authorization for this token (status 403): %s", readErrorBody(resp.Body)) + } + return nil, nil + } + if resp.StatusCode != http.StatusOK { return nil, fmt.Errorf("GitHub API error (status %d): %s", resp.StatusCode, readErrorBody(resp.Body)) } - var orgs []GitHubUserOrOrg - if err := json.NewDecoder(resp.Body).Decode(&orgs); err != nil { - return nil, fmt.Errorf("failed to decode organizations response: %w", err) + var memberships []githubOrgMembership + if err := json.NewDecoder(resp.Body).Decode(&memberships); err != nil { + return nil, fmt.Errorf("failed to decode organization memberships response: %w", err) } - return orgs, nil + return memberships, nil } // buildPermissions builds permissions based on GitHub user and their organizations func (h *GitHubHandler) buildPermissions(username string, orgs []GitHubUserOrOrg) []auth.Permission { - permissions := []auth.Permission{} - - // Assert user and org names match expected regex, to harden against people doing weird things in names + // Assert the username matches the expected regex, to harden against people doing + // weird things in names. The username is the caller's own identity, so if it is + // invalid we grant nothing. if !isValidGitHubName(username) { return nil } - for _, org := range orgs { - if !isValidGitHubName(org.Login) { - return nil - } - } // Add permission for user's own namespace - permissions = append(permissions, auth.Permission{ + permissions := []auth.Permission{{ Action: auth.PermissionActionPublish, ResourcePattern: fmt.Sprintf("io.github.%s/*", username), - }) + }} - // Add permissions for each organization + // Add permissions for each organization the user administers (Owner role). Skip + // any org whose name fails validation rather than rejecting the whole set, so one + // unexpected org name can't strip the caller's personal namespace or their other + // (valid) org grants. for _, org := range orgs { + if !isValidGitHubName(org.Login) { + continue + } permissions = append(permissions, auth.Permission{ Action: auth.PermissionActionPublish, ResourcePattern: fmt.Sprintf("io.github.%s/*", org.Login), diff --git a/internal/api/handlers/v0/auth/github_at_internal_test.go b/internal/api/handlers/v0/auth/github_at_internal_test.go new file mode 100644 index 0000000..f2668bf --- /dev/null +++ b/internal/api/handlers/v0/auth/github_at_internal_test.go @@ -0,0 +1,33 @@ +package auth + +import ( + "encoding/json" + "errors" + "testing" + + "github.com/danielgtaylor/huma/v2" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +// The 401 returned to the client must not echo the internal error, which can +// include the raw upstream GitHub response body captured by readErrorBody +// (CWE-209). huma serializes extra error args into the response body, so the fix +// is to log server-side and return only a generic message. This mirrors the +// regression test added for the GET /v0/servers 500 leak (#1338). +func TestTokenExchangeError_doesNotLeakDetail(t *testing.T) { + const internal = `failed to get GitHub organizations: GitHub API error (status 500): {"message":"internal-host db detail"}` + + err := tokenExchangeError(errors.New(internal)) + require.Error(t, err) + + var se huma.StatusError + require.True(t, errors.As(err, &se)) + assert.Equal(t, 401, se.GetStatus()) + + body, marshalErr := json.Marshal(err) + require.NoError(t, marshalErr) + assert.NotContains(t, string(body), "internal-host db detail") + assert.NotContains(t, string(body), "status 500") + assert.Contains(t, string(body), "Token exchange failed") +} diff --git a/internal/api/handlers/v0/auth/github_at_test.go b/internal/api/handlers/v0/auth/github_at_test.go index c0fa4ac..663248b 100644 --- a/internal/api/handlers/v0/auth/github_at_test.go +++ b/internal/api/handlers/v0/auth/github_at_test.go @@ -22,9 +22,82 @@ import ( const ( githubUserEndpoint = "/user" - githubOrgsEndpoint = "/users/testuser/orgs" + // githubOrgsEndpoint is the endpoint used to list the authenticated user's org + // memberships (with role). It replaces the old public-only /users/{user}/orgs. + githubOrgsEndpoint = "/user/memberships/orgs" ) +// orgMembership mirrors a single entry of GET /user/memberships/orgs for use in +// mock GitHub API responses. Role is "admin" (Owner) or "member". +type orgMembership struct { + State string `json:"state"` + Role string `json:"role"` + Organization v0auth.GitHubUserOrOrg `json:"organization"` +} + +// adminMemberships wraps orgs as active "admin"-role memberships, the shape the +// memberships endpoint returns for an org Owner. +func adminMemberships(orgs []v0auth.GitHubUserOrOrg) []orgMembership { + memberships := make([]orgMembership, 0, len(orgs)) + for _, org := range orgs { + memberships = append(memberships, orgMembership{State: "active", Role: "admin", Organization: org}) + } + return memberships +} + +// newMockGitHubServer returns a mock GitHub API server that serves a fixed +// "testuser" on /user and delegates the org-memberships endpoint to orgsHandler. +// It keeps individual test cases small (only the memberships behavior varies), +// which also keeps their cyclomatic complexity down. +func newMockGitHubServer(orgsHandler http.HandlerFunc) *httptest.Server { + return httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + switch r.URL.Path { + case githubUserEndpoint: + user := v0auth.GitHubUserOrOrg{Login: "testuser", ID: 12345} + w.Header().Set("Content-Type", "application/json") + json.NewEncoder(w).Encode(user) //nolint:errcheck + case githubOrgsEndpoint: + orgsHandler(w, r) + default: + w.WriteHeader(http.StatusNotFound) + } + })) +} + +// grantedPatterns exchanges the token and returns the resource patterns granted +// in the resulting JWT. +func grantedPatterns(t *testing.T, cfg *config.Config, server *httptest.Server) []string { + t.Helper() + handler := v0auth.NewGitHubHandler(cfg) + handler.SetBaseURL(server.URL) + + ctx := context.Background() + response, err := handler.ExchangeToken(ctx, "valid-github-token") + require.NoError(t, err) + require.NotNil(t, response) + + claims, err := auth.NewJWTManager(cfg).ValidateToken(ctx, response.RegistryToken) + require.NoError(t, err) + + patterns := make([]string, 0, len(claims.Permissions)) + for _, perm := range claims.Permissions { + patterns = append(patterns, perm.ResourcePattern) + } + return patterns +} + +// assertExchangeFailsClosed asserts that a token exchange against server returns +// an error and no token (used for the fail-closed 403 variants). +func assertExchangeFailsClosed(t *testing.T, cfg *config.Config, server *httptest.Server) { + t.Helper() + handler := v0auth.NewGitHubHandler(cfg) + handler.SetBaseURL(server.URL) + + response, err := handler.ExchangeToken(context.Background(), "valid-github-token") + require.Error(t, err) + assert.Nil(t, response) +} + func TestGitHubHandler_ExchangeToken(t *testing.T) { // Create test handler with mock config testSeed := make([]byte, ed25519.SeedSize) @@ -96,12 +169,12 @@ func TestGitHubHandler_ExchangeToken(t *testing.T) { w.Header().Set("Content-Type", "application/json") json.NewEncoder(w).Encode(user) //nolint:errcheck case githubOrgsEndpoint: - orgs := []v0auth.GitHubUserOrOrg{ + memberships := adminMemberships([]v0auth.GitHubUserOrOrg{ {Login: "test-org-1", ID: 1}, {Login: "test-org-2", ID: 2}, - } + }) w.Header().Set("Content-Type", "application/json") - json.NewEncoder(w).Encode(orgs) //nolint:errcheck + json.NewEncoder(w).Encode(memberships) //nolint:errcheck default: w.WriteHeader(http.StatusNotFound) } @@ -225,10 +298,9 @@ func TestGitHubHandler_ExchangeToken(t *testing.T) { } w.Header().Set("Content-Type", "application/json") json.NewEncoder(w).Encode(user) //nolint:errcheck - case "/users/user with spaces/orgs": - orgs := []v0auth.GitHubUserOrOrg{} + case githubOrgsEndpoint: w.Header().Set("Content-Type", "application/json") - json.NewEncoder(w).Encode(orgs) //nolint:errcheck + json.NewEncoder(w).Encode([]orgMembership{}) //nolint:errcheck } })) defer mockServer.Close() @@ -264,12 +336,12 @@ func TestGitHubHandler_ExchangeToken(t *testing.T) { w.Header().Set("Content-Type", "application/json") json.NewEncoder(w).Encode(user) //nolint:errcheck case githubOrgsEndpoint: - orgs := []v0auth.GitHubUserOrOrg{ + memberships := adminMemberships([]v0auth.GitHubUserOrOrg{ {Login: "valid-org", ID: 1}, {Login: "org with spaces", ID: 2}, // Invalid name - } + }) w.Header().Set("Content-Type", "application/json") - json.NewEncoder(w).Encode(orgs) //nolint:errcheck + json.NewEncoder(w).Encode(memberships) //nolint:errcheck } })) defer mockServer.Close() @@ -290,7 +362,15 @@ func TestGitHubHandler_ExchangeToken(t *testing.T) { claims, err := jwtManager.ValidateToken(ctx, response.RegistryToken) require.NoError(t, err) assert.Equal(t, "testuser", claims.AuthMethodSubject) - assert.Empty(t, claims.Permissions) // No permissions because one org has invalid name + + // The invalid org is skipped, but the personal namespace and the valid org + // are still granted — one weird org name must not strip everything else. + patterns := make([]string, 0, len(claims.Permissions)) + for _, perm := range claims.Permissions { + patterns = append(patterns, perm.ResourcePattern) + } + assert.ElementsMatch(t, []string{"io.github.testuser/*", "io.github.valid-org/*"}, patterns) + assert.NotContains(t, patterns, "io.github.org with spaces/*") }) t.Run("malformed JSON response", func(t *testing.T) { @@ -317,6 +397,274 @@ func TestGitHubHandler_ExchangeToken(t *testing.T) { }) } +func TestGitHubHandler_ExchangeToken_OrgRoles(t *testing.T) { + testSeed := make([]byte, ed25519.SeedSize) + _, err := rand.Read(testSeed) + require.NoError(t, err) + + cfg := &config.Config{ + JWTPrivateKey: hex.EncodeToString(testSeed), + } + + t.Run("member-role org is not granted, only admin orgs", func(t *testing.T) { + // The user is an Owner (admin) of one org and an ordinary member of another. + // Only the org they administer should yield a publish permission. + mockServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + switch r.URL.Path { + case githubUserEndpoint: + user := v0auth.GitHubUserOrOrg{Login: "testuser", ID: 12345} + w.Header().Set("Content-Type", "application/json") + json.NewEncoder(w).Encode(user) //nolint:errcheck + case githubOrgsEndpoint: + memberships := []orgMembership{ + {State: "active", Role: "admin", Organization: v0auth.GitHubUserOrOrg{Login: "admin-org", ID: 1}}, + {State: "active", Role: "member", Organization: v0auth.GitHubUserOrOrg{Login: "member-org", ID: 2}}, + } + w.Header().Set("Content-Type", "application/json") + json.NewEncoder(w).Encode(memberships) //nolint:errcheck + default: + w.WriteHeader(http.StatusNotFound) + } + })) + defer mockServer.Close() + + handler := v0auth.NewGitHubHandler(cfg) + handler.SetBaseURL(mockServer.URL) + + ctx := context.Background() + response, err := handler.ExchangeToken(ctx, "valid-github-token") + require.NoError(t, err) + require.NotNil(t, response) + + jwtManager := auth.NewJWTManager(cfg) + claims, err := jwtManager.ValidateToken(ctx, response.RegistryToken) + require.NoError(t, err) + + patterns := make([]string, 0, len(claims.Permissions)) + for _, perm := range claims.Permissions { + patterns = append(patterns, perm.ResourcePattern) + } + assert.ElementsMatch(t, []string{"io.github.testuser/*", "io.github.admin-org/*"}, patterns) + assert.NotContains(t, patterns, "io.github.member-org/*") + }) + + t.Run("missing read:org scope (403) still grants personal namespace", func(t *testing.T) { + // A minimal token without read:org authenticates fine but is forbidden from + // reading org memberships. Personal-namespace publishing must still work. + mockServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + switch r.URL.Path { + case githubUserEndpoint: + user := v0auth.GitHubUserOrOrg{Login: "testuser", ID: 12345} + w.Header().Set("Content-Type", "application/json") + json.NewEncoder(w).Encode(user) //nolint:errcheck + case githubOrgsEndpoint: + w.WriteHeader(http.StatusForbidden) + w.Write([]byte(`{"message": "Token does not have the required scope"}`)) //nolint:errcheck + default: + w.WriteHeader(http.StatusNotFound) + } + })) + defer mockServer.Close() + + handler := v0auth.NewGitHubHandler(cfg) + handler.SetBaseURL(mockServer.URL) + + ctx := context.Background() + response, err := handler.ExchangeToken(ctx, "valid-github-token") + require.NoError(t, err) + require.NotNil(t, response) + + jwtManager := auth.NewJWTManager(cfg) + claims, err := jwtManager.ValidateToken(ctx, response.RegistryToken) + require.NoError(t, err) + assert.Len(t, claims.Permissions, 1) + assert.Equal(t, "io.github.testuser/*", claims.Permissions[0].ResourcePattern) + }) + + t.Run("admin org on a later page is still granted (pagination)", func(t *testing.T) { + // Page 1 is a full page (100) of member-role orgs; the only admin org is on + // page 2. The pagination loop must not stop at the first page, or the Owner's + // org grant would be silently dropped. + mockServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + switch r.URL.Path { + case githubUserEndpoint: + user := v0auth.GitHubUserOrOrg{Login: "testuser", ID: 12345} + w.Header().Set("Content-Type", "application/json") + json.NewEncoder(w).Encode(user) //nolint:errcheck + case githubOrgsEndpoint: + w.Header().Set("Content-Type", "application/json") + if r.URL.Query().Get("page") == "1" { + page1 := make([]orgMembership, 0, 100) + for i := 0; i < 100; i++ { + page1 = append(page1, orgMembership{ + State: "active", Role: "member", + Organization: v0auth.GitHubUserOrOrg{Login: fmt.Sprintf("member-org-%d", i), ID: 1000 + i}, + }) + } + json.NewEncoder(w).Encode(page1) //nolint:errcheck + return + } + // page 2: a single admin org, signalling the last (short) page. + page2 := []orgMembership{ + {State: "active", Role: "admin", Organization: v0auth.GitHubUserOrOrg{Login: "late-admin-org", ID: 2}}, + } + json.NewEncoder(w).Encode(page2) //nolint:errcheck + default: + w.WriteHeader(http.StatusNotFound) + } + })) + defer mockServer.Close() + + handler := v0auth.NewGitHubHandler(cfg) + handler.SetBaseURL(mockServer.URL) + + ctx := context.Background() + response, err := handler.ExchangeToken(ctx, "valid-github-token") + require.NoError(t, err) + require.NotNil(t, response) + + jwtManager := auth.NewJWTManager(cfg) + claims, err := jwtManager.ValidateToken(ctx, response.RegistryToken) + require.NoError(t, err) + + patterns := make([]string, 0, len(claims.Permissions)) + for _, perm := range claims.Permissions { + patterns = append(patterns, perm.ResourcePattern) + } + assert.ElementsMatch(t, []string{"io.github.testuser/*", "io.github.late-admin-org/*"}, patterns) + }) + + t.Run("memberships server error fails closed (no token issued)", func(t *testing.T) { + // A 5xx (or any non-200, non-scope-403) from the memberships endpoint must + // abort the exchange rather than silently degrade to personal-only perms. + mockServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + switch r.URL.Path { + case githubUserEndpoint: + user := v0auth.GitHubUserOrOrg{Login: "testuser", ID: 12345} + w.Header().Set("Content-Type", "application/json") + json.NewEncoder(w).Encode(user) //nolint:errcheck + case githubOrgsEndpoint: + w.WriteHeader(http.StatusInternalServerError) + default: + w.WriteHeader(http.StatusNotFound) + } + })) + defer mockServer.Close() + + handler := v0auth.NewGitHubHandler(cfg) + handler.SetBaseURL(mockServer.URL) + + ctx := context.Background() + response, err := handler.ExchangeToken(ctx, "valid-github-token") + require.Error(t, err) + assert.Nil(t, response) + }) + + t.Run("rate-limit 403 fails closed (not treated as missing scope)", func(t *testing.T) { + // A 403 with X-RateLimit-Remaining: 0 is a throttle, not a missing-scope + // signal. Degrading would strip a real Owner's org grant, so it must error. + mockServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + switch r.URL.Path { + case githubUserEndpoint: + user := v0auth.GitHubUserOrOrg{Login: "testuser", ID: 12345} + w.Header().Set("Content-Type", "application/json") + json.NewEncoder(w).Encode(user) //nolint:errcheck + case githubOrgsEndpoint: + w.Header().Set("X-RateLimit-Remaining", "0") + w.WriteHeader(http.StatusForbidden) + w.Write([]byte(`{"message": "API rate limit exceeded"}`)) //nolint:errcheck + default: + w.WriteHeader(http.StatusNotFound) + } + })) + defer mockServer.Close() + + handler := v0auth.NewGitHubHandler(cfg) + handler.SetBaseURL(mockServer.URL) + + ctx := context.Background() + response, err := handler.ExchangeToken(ctx, "valid-github-token") + require.Error(t, err) + assert.Nil(t, response) + }) +} + +func TestGitHubHandler_ExchangeToken_MembershipFiltering(t *testing.T) { + testSeed := make([]byte, ed25519.SeedSize) + _, err := rand.Read(testSeed) + require.NoError(t, err) + + cfg := &config.Config{JWTPrivateKey: hex.EncodeToString(testSeed)} + + t.Run("pending admin membership is not granted (state filter)", func(t *testing.T) { + // A user invited as an Owner but who has not accepted has role "admin" with + // state "pending". They are not an Owner yet, so the org must not be granted + // even if the state=active query filter is somehow bypassed. + server := newMockGitHubServer(func(w http.ResponseWriter, _ *http.Request) { + memberships := []orgMembership{ + {State: "pending", Role: "admin", Organization: v0auth.GitHubUserOrOrg{Login: "pending-org", ID: 1}}, + {State: "active", Role: "admin", Organization: v0auth.GitHubUserOrOrg{Login: "active-org", ID: 2}}, + } + w.Header().Set("Content-Type", "application/json") + json.NewEncoder(w).Encode(memberships) //nolint:errcheck + }) + defer server.Close() + + patterns := grantedPatterns(t, cfg, server) + assert.ElementsMatch(t, []string{"io.github.testuser/*", "io.github.active-org/*"}, patterns) + assert.NotContains(t, patterns, "io.github.pending-org/*") + }) + + t.Run("billing_manager role is not granted", func(t *testing.T) { + server := newMockGitHubServer(func(w http.ResponseWriter, _ *http.Request) { + memberships := []orgMembership{ + {State: "active", Role: "billing_manager", Organization: v0auth.GitHubUserOrOrg{Login: "billing-org", ID: 1}}, + } + w.Header().Set("Content-Type", "application/json") + json.NewEncoder(w).Encode(memberships) //nolint:errcheck + }) + defer server.Close() + + patterns := grantedPatterns(t, cfg, server) + assert.Equal(t, []string{"io.github.testuser/*"}, patterns) + }) +} + +func TestGitHubHandler_ExchangeToken_403FailClosed(t *testing.T) { + testSeed := make([]byte, ed25519.SeedSize) + _, err := rand.Read(testSeed) + require.NoError(t, err) + + cfg := &config.Config{JWTPrivateKey: hex.EncodeToString(testSeed)} + + t.Run("Retry-After 403 fails closed (secondary rate limit)", func(t *testing.T) { + // A 403 carrying only Retry-After (no X-RateLimit-Remaining: 0) is a secondary + // rate limit, not a missing scope. Degrading would strip a real Owner's grant. + server := newMockGitHubServer(func(w http.ResponseWriter, _ *http.Request) { + w.Header().Set("Retry-After", "60") + w.WriteHeader(http.StatusForbidden) + w.Write([]byte(`{"message": "You have exceeded a secondary rate limit"}`)) //nolint:errcheck + }) + defer server.Close() + + assertExchangeFailsClosed(t, cfg, server) + }) + + t.Run("SSO-enforced 403 fails closed (not treated as missing scope)", func(t *testing.T) { + // A SAML/SSO-enforced org returns 403 with X-GitHub-SSO when the token is not + // SSO-authorized. That is an Owner being blocked, so it must fail closed rather + // than silently degrade to personal-only. + server := newMockGitHubServer(func(w http.ResponseWriter, _ *http.Request) { + w.Header().Set("X-GitHub-SSO", "required; two_factor_authentication=false") + w.WriteHeader(http.StatusForbidden) + w.Write([]byte(`{"message": "Resource protected by organization SAML enforcement."}`)) //nolint:errcheck + }) + defer server.Close() + + assertExchangeFailsClosed(t, cfg, server) + }) +} + func TestJWTTokenValidation(t *testing.T) { testSeed := make([]byte, ed25519.SeedSize) _, err := rand.Read(testSeed) @@ -521,7 +869,16 @@ func TestValidGitHubNames(t *testing.T) { orgs: []v0auth.GitHubUserOrOrg{ {Login: "invalid org", ID: 1}, }, - wantPerms: 0, // Should return nil if any name is invalid + wantPerms: 1, // Personal namespace kept; the invalid org is skipped + }, + { + name: "valid username with one valid and one invalid org", + username: "valid-user", + orgs: []v0auth.GitHubUserOrOrg{ + {Login: "valid-org", ID: 1}, + {Login: "invalid org", ID: 2}, + }, + wantPerms: 2, // Personal + valid org; the invalid org is skipped }, } @@ -537,9 +894,9 @@ func TestValidGitHubNames(t *testing.T) { } w.Header().Set("Content-Type", "application/json") json.NewEncoder(w).Encode(user) //nolint:errcheck - case "/users/" + tc.username + "/orgs": + case githubOrgsEndpoint: w.Header().Set("Content-Type", "application/json") - json.NewEncoder(w).Encode(tc.orgs) //nolint:errcheck + json.NewEncoder(w).Encode(adminMemberships(tc.orgs)) //nolint:errcheck } })) defer mockServer.Close() From 5da9b4c8bf14556e69bf5076f0266d2ccf17bb0c Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 10 Jul 2026 17:06:10 -0400 Subject: [PATCH 255/313] build(deps): bump golang.org/x/crypto from 0.51.0 to 0.52.0 (#1433) Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.51.0 to 0.52.0.
    Commits
    • a1c0d99 go.mod: update golang.org/x dependencies
    • 3c7c869 ssh: fix deadlock on unexpected channel responses
    • 533fb3f ssh: fix source-address critical option bypass
    • abbc44d ssh: fix incorrect operator order
    • e052873 ssh: fix infinite loop on large channel writes due to integer overflow
    • b61cf85 ssh: enforce user presence verification for security keys
    • 9c2cd33 ssh: enforce strict limits on DSA key parameters
    • 8907318 ssh: reject RSA keys with excessively large moduli
    • ffd87b4 ssh: fix panic when authority callbacks are nil
    • 4e7a738 ssh: fix deadlock on unexpected global responses
    • Additional commits viewable in compare view

    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 6e3d61f..1a76501 100644 --- a/go.mod +++ b/go.mod @@ -70,7 +70,7 @@ require ( go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect go.opentelemetry.io/otel/trace v1.44.0 // indirect go.yaml.in/yaml/v2 v2.4.4 // indirect - golang.org/x/crypto v0.51.0 // indirect + golang.org/x/crypto v0.52.0 // indirect golang.org/x/net v0.55.0 // indirect golang.org/x/oauth2 v0.36.0 // indirect golang.org/x/sync v0.21.0 // indirect diff --git a/go.sum b/go.sum index d6507fd..da5fd16 100644 --- a/go.sum +++ b/go.sum @@ -160,8 +160,8 @@ go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE= go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ= go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ= -golang.org/x/crypto v0.51.0 h1:IBPXwPfKxY7cWQZ38ZCIRPI50YLeevDLlLnyC5wRGTI= -golang.org/x/crypto v0.51.0/go.mod h1:8AdwkbraGNABw2kOX6YFPs3WM22XqI4EXEd8g+x7Oc8= +golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988= +golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc= golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk= golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40= golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8= From 9e762b03c7f8a40a15580dbba3e9accca976d5ee Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Sat, 11 Jul 2026 01:48:56 +0300 Subject: [PATCH 256/313] docs(auth): document fine-grained PAT permission for org publishing (+ pagination-cap test) (#1435) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Follow-up to #1383, surfaced while validating that change end-to-end against staging. ## Why #1383 hardened org-namespace publishing to require Owner (`admin`) role, read via `GET /user/memberships/orgs`. Validating on staging revealed a gap: the docs only mention the classic `read:org` scope, but a **fine-grained PAT** (GitHub's recommended token type) needs a *different* permission to expose org membership. Without it, GitHub returns no org memberships for the token, so the exchange silently grants only the personal namespace — with no hint why org publishing "doesn't work." This is **not** a code bug (the behavior is fail-closed and correct given GitHub's response); it's a documentation/UX gap. ## What - **Docs** (`authentication.mdx`, `github-actions.mdx`): spell out both token types — - Classic PAT → `read:org` scope - Fine-grained PAT → **Organization permissions → Members → Read-only** (the equivalent), noting a fine-grained PAT is bound to a single resource owner. - Also clarified `read:user` is not required. - **Test** (`github_at_test.go`): cover the `maxOrgMembershipPages` pagination cap — when every page is full, the exchange **fails closed** (no token) rather than returning a possibly-truncated org grant. This path was previously untested. - **Comment** (`github_at.go`): qualify the `X-GitHub-SSO` 403 check as best-effort — we have not confirmed the memberships *list* endpoint emits that header on SSO enforcement (it may just omit the org). The check is safe either way, but the comment no longer overstates it as a guarantee. ## Verification (live, against staging) Confirmed by exchanging real tokens for `rdimitrov` on `staging.registry.modelcontextprotocol.io`: - **Classic `read:org` PAT** across 16 real org memberships → the JWT granted exactly the 8 **admin** orgs + personal namespace, and **zero** of the 8 **member** orgs (incl. `stacklok`, `modelcontextprotocol`) — the core #1383 behavior, working. - **Fine-grained PAT**: without Members:read → personal namespace only (fail-closed); after adding Members:read → the org (Owner) namespace is granted. This is what the new docs describe. No runtime behavior change here beyond the added test; the docs and comment are the substance. --------- Co-authored-by: Claude Opus 4.8 --- .../authentication.mdx | 7 ++++- .../github-actions.mdx | 6 +++- internal/api/handlers/v0/auth/github_at.go | 13 ++++++--- .../api/handlers/v0/auth/github_at_test.go | 28 +++++++++++++++++++ 4 files changed, 48 insertions(+), 6 deletions(-) diff --git a/docs/modelcontextprotocol-io/authentication.mdx b/docs/modelcontextprotocol-io/authentication.mdx index 98131d5..9812fcc 100644 --- a/docs/modelcontextprotocol-io/authentication.mdx +++ b/docs/modelcontextprotocol-io/authentication.mdx @@ -53,7 +53,12 @@ GitHub authentication always grants your personal namespace, `io.github./*`), you must be an **Owner** of that organization. Ordinary org membership is no longer sufficient: the registry checks your membership role and only grants the org namespace to admins. This prevents anyone who merely belongs to an org from publishing — or overwriting — servers under the org's name. -If you authenticate with a Personal Access Token (for example in CI), the token must include the `read:org` scope for the registry to see your organization role. A token without `read:org` can still publish to your personal namespace, but org publishing will be silently unavailable. The token needs **no** repository scopes — the registry never reads or writes your code. +If you authenticate with a Personal Access Token (for example in CI), the token must let the registry read your organization role. A token that can't will still publish to your personal namespace, but org publishing will be silently unavailable. The exact requirement depends on the token type: + +- **Classic PAT**: grant the `read:org` scope. +- **Fine-grained PAT**: grant the **Organization permissions → Members → Read-only** permission (the fine-grained equivalent of `read:org`). Without it, GitHub returns no organization membership for the token and you'll get your personal namespace only. Note that a fine-grained PAT is bound to a single resource owner, so it can only see the organization it was created for. + +Either way the token needs **no** repository scopes — the registry never reads or writes your code. ## DNS Authentication diff --git a/docs/modelcontextprotocol-io/github-actions.mdx b/docs/modelcontextprotocol-io/github-actions.mdx index dc02ca5..7fcf275 100644 --- a/docs/modelcontextprotocol-io/github-actions.mdx +++ b/docs/modelcontextprotocol-io/github-actions.mdx @@ -199,7 +199,11 @@ jobs: You may need to add a secret depending on which authentication method you choose: - **GitHub OIDC Authentication**: No dedicated secret necessary. -- **GitHub PAT Authentication**: Add a `MCP_GITHUB_TOKEN` secret with a GitHub Personal Access Token (PAT) that has the `read:org` scope. `read:org` is what lets the registry confirm you are an **Owner** of the organization before granting its namespace; the token needs **no** repository scopes (the registry never reads or writes your code), and no other scopes are required — `read:user` is not needed, and a bare token still authenticates and publishes to your personal namespace. For an **organization** token, store it as an **Environment secret** on the `mcp-registry-publish` environment rather than a plain repository secret — see "Securing your registry token in CI" below for why this matters and how to configure the environment. +- **GitHub PAT Authentication**: Add a `MCP_GITHUB_TOKEN` secret with a GitHub Personal Access Token. The registry only needs to read your organization role to confirm you are an **Owner** before granting its namespace, so grant the minimum for that and **no** repository scopes (the registry never reads or writes your code): + - **Classic PAT**: the `read:org` scope (`read:user` is *not* needed; a bare token still authenticates and publishes to your personal namespace). + - **Fine-grained PAT**: the **Organization permissions → Members → Read-only** permission (the equivalent of `read:org`). Without it you'll get your personal namespace only. A fine-grained PAT is scoped to one resource owner, so create it for the organization you're publishing to. + + For an **organization** token, store it as an **Environment secret** on the `mcp-registry-publish` environment rather than a plain repository secret — see "Securing your registry token in CI" below for why this matters and how to configure the environment. - **DNS Authentication**: Add a `MCP_PRIVATE_KEY` secret with your Ed25519 private key. You may also need to add secrets for your package registry. For example, the workflow above needs an `NPM_TOKEN` secret with your npm token. diff --git a/internal/api/handlers/v0/auth/github_at.go b/internal/api/handlers/v0/auth/github_at.go index cbfe8dd..868ea8e 100644 --- a/internal/api/handlers/v0/auth/github_at.go +++ b/internal/api/handlers/v0/auth/github_at.go @@ -255,10 +255,15 @@ func (h *GitHubHandler) fetchOrgMembershipsPage(ctx context.Context, token strin if resp.Header.Get("X-RateLimit-Remaining") == "0" || resp.Header.Get("Retry-After") != "" { return nil, fmt.Errorf("GitHub API rate limit exceeded while listing org memberships (status 403): %s", readErrorBody(resp.Body)) } - // A SAML/SSO-enforced org returns 403 with an X-GitHub-SSO header when the - // token has not been SSO-authorized. That is an Owner being blocked, not a - // missing scope, so fail closed rather than silently dropping the org grant - // (which would degrade a legitimate Owner to personal-only with no signal). + // Best-effort defense: GitHub uses the X-GitHub-SSO header to signal that a + // resource is behind SAML/SSO the token hasn't been authorized for. If we see + // it, treat that as an Owner being blocked (not a missing scope) and fail + // closed rather than silently degrading them to personal-only. NOTE: we have + // not confirmed that the memberships *list* endpoint emits this header on SSO + // enforcement (it may instead just omit the SSO-protected org); this check is + // safe either way — if the header is absent we fall through to the same + // graceful degrade as before — but it is not a proven guarantee that every + // SSO-blocked Owner is caught here. if resp.Header.Get("X-GitHub-SSO") != "" { return nil, fmt.Errorf("GitHub org memberships require SSO authorization for this token (status 403): %s", readErrorBody(resp.Body)) } diff --git a/internal/api/handlers/v0/auth/github_at_test.go b/internal/api/handlers/v0/auth/github_at_test.go index 663248b..148566d 100644 --- a/internal/api/handlers/v0/auth/github_at_test.go +++ b/internal/api/handlers/v0/auth/github_at_test.go @@ -665,6 +665,34 @@ func TestGitHubHandler_ExchangeToken_403FailClosed(t *testing.T) { }) } +func TestGitHubHandler_ExchangeToken_PaginationCap(t *testing.T) { + testSeed := make([]byte, ed25519.SeedSize) + _, err := rand.Read(testSeed) + require.NoError(t, err) + + cfg := &config.Config{JWTPrivateKey: hex.EncodeToString(testSeed)} + + t.Run("all-full pages past the cap fails closed", func(t *testing.T) { + // Every page comes back full (100), so the loop never sees a short final page + // and runs to maxOrgMembershipPages. Rather than return a possibly-truncated + // org set, the exchange must fail closed (error, no token). + server := newMockGitHubServer(func(w http.ResponseWriter, _ *http.Request) { + page := make([]orgMembership, 0, 100) + for i := 0; i < 100; i++ { + page = append(page, orgMembership{ + State: "active", Role: "member", + Organization: v0auth.GitHubUserOrOrg{Login: fmt.Sprintf("org-%d", i), ID: i}, + }) + } + w.Header().Set("Content-Type", "application/json") + json.NewEncoder(w).Encode(page) //nolint:errcheck + }) + defer server.Close() + + assertExchangeFailsClosed(t, cfg, server) + }) +} + func TestJWTTokenValidation(t *testing.T) { testSeed := make([]byte, ed25519.SeedSize) _, err := rand.Read(testSeed) From 3fe10fc4c663b2353d1fc4e05b289d0379562932 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?R=C3=BAben=20Sousa=20Dinis?= Date: Fri, 10 Jul 2026 23:55:54 +0100 Subject: [PATCH 257/313] docs: add polygraph to community projects (#1421) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adds polygraph (https://polygraph.so) to the **Other** section of `docs/community-projects.md`, per the *Adding Your Project* instructions (one-line entry). polygraph publishes independent behavioral security grades (A–F) for MCP servers from an open, reproducible harness (https://github.com/polygraphso/litmus) — it exercises a server's live tool surface and grades what it does (tool-output injection, undeclared egress, sensitive-data handling, adversarial-input robustness), then publishes the results as an adoption-ranked index with per-server reports. It reads the official registry to discover and version servers, and adds the independent ratings layer this project's docs note downstream aggregators can provide. One-line entry only; no code or schema changes. --- docs/community-projects.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/community-projects.md b/docs/community-projects.md index b61c247..a177ad0 100644 --- a/docs/community-projects.md +++ b/docs/community-projects.md @@ -35,6 +35,7 @@ Self-hostable servers that implement the MCP Registry API specification. - [mcp-insights](https://github.com/joelverhagen/mcp-insights/) - Analytics and insights for the MCP Registry - [mcp-registry-cli](https://pypi.org/project/mcp-registry-cli/) - CLI tool to navigate the MCP registry servers - [OtherVibes/mcp-publish-action](https://github.com/OtherVibes/mcp-publish-action) - GitHub Action for publishing MCP servers to the official registry +- [polygraph](https://polygraph.so) - Independent behavioral security grades (A–F) for MCP servers from an open, reproducible harness, published as an adoption-ranked index with per-server reports ## Adding Your Project From 2d3262c8aa34bae8e1a6060c958b207e26e72ff7 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Sun, 12 Jul 2026 19:11:04 +0300 Subject: [PATCH 258/313] fix(ci): re-validate author association via REST in close-invalid-publish-prs (#1440) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## What Stage 2 of the auto-close automation (`close-invalid-publish-prs.yml`) re-derived the PR author association with: ```bash gh pr view "$PR_NUMBER" --json authorAssociation --jq '.authorAssociation' ``` But `gh pr view --json` has **no** `authorAssociation` field. `gh` exits non-zero with `Unknown JSON field: "authorAssociation"`, and because the step runs under `set -euo pipefail`, the whole job aborts **before** it comments, labels, or closes. Flagged PRs therefore stayed open. ## Why it went unnoticed - **Stage 1 (detect) was fine** — it reads `author_association` from the event payload (`github.event.pull_request.author_association`), which is valid. - Only the **stage-2 re-derivation** was broken. - Every prior stage-2 run showed "success" because those PRs weren't flagged: with no artifact, stage 2 exits early at the artifact check and never reaches the broken line. - **[PR #1438](https://github.com/modelcontextprotocol/registry/pull/1438) was the first genuine publish-attempt PR** since the automation landed (#1393), so it was the first to exercise the bug — [run `29178568034`](https://github.com/modelcontextprotocol/registry/actions/runs/29178568034) failed on exactly this line. ## Fix Fetch `author_association` from the REST pulls endpoint, which does expose it (verified: returns `FIRST_TIME_CONTRIBUTOR` for #1438): ```bash gh api "repos/$GH_REPO/pulls/$PR_NUMBER" --jq '.author_association' ``` Both `$GH_REPO` and `$PR_NUMBER` are already-sanitized env vars, so no new injection surface. ## Follow-up Stage 2 is idempotent (guarded by the `invalid` label), so once merged a maintainer can re-run it — or simply re-open/re-close — to clean up #1438. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.8 --- .github/workflows/close-invalid-publish-prs.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/close-invalid-publish-prs.yml b/.github/workflows/close-invalid-publish-prs.yml index 27f69a8..4ef84b9 100644 --- a/.github/workflows/close-invalid-publish-prs.yml +++ b/.github/workflows/close-invalid-publish-prs.yml @@ -95,7 +95,10 @@ jobs: exit 0 fi - assoc="$(gh pr view "$PR_NUMBER" --json authorAssociation --jq '.authorAssociation')" + # Use the REST endpoint: `gh pr view --json` does not expose an + # authorAssociation field, so calling it there exits non-zero and, + # under `set -euo pipefail`, aborts the job before we ever close. + assoc="$(gh api "repos/$GH_REPO/pulls/$PR_NUMBER" --jq '.author_association')" case "$assoc" in MEMBER|OWNER|COLLABORATOR) echo "Author association '$assoc' is trusted; skipping." From c36b521bf11f2a569c223743445fa0f629cc9332 Mon Sep 17 00:00:00 2001 From: Yufeng He <40085740+he-yufeng@users.noreply.github.com> Date: Mon, 13 Jul 2026 00:57:45 +0800 Subject: [PATCH 259/313] fix: reject mangled publisher metadata (#1310) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary - add a publisher preflight that rejects non-UTF-8 `server.json` bytes before parsing - reject unpaired UTF-16 surrogate escapes inside JSON string fields before publish/validate requests are sent - keep valid non-ASCII descriptions, including em dashes, round-tripping through the publish path - make the publisher test token helper set `USERPROFILE` as well as `HOME` so Windows tests use the temp home directory Closes #1306. ## To verify - `go test ./cmd/publisher/commands -run "TestPublishCommand_(Success|PreservesNonASCIIDescription|RejectsInvalidUTF8ServerJSON|RejectsUnpairedSurrogateEscape)$" -count=1` - `go test ./cmd/publisher/commands -run TestPublishCommand -count=1` - `go test ./cmd/publisher/commands -run TestValidateCommand -count=1` - `git diff --check` Co-authored-by: Radoslav Dimitrov --- cmd/publisher/commands/publish.go | 7 ++ cmd/publisher/commands/publish_test.go | 67 +++++++++++++++ cmd/publisher/commands/testutil_test.go | 3 +- cmd/publisher/commands/unicode.go | 107 ++++++++++++++++++++++++ cmd/publisher/commands/validate.go | 7 ++ 5 files changed, 190 insertions(+), 1 deletion(-) create mode 100644 cmd/publisher/commands/unicode.go diff --git a/cmd/publisher/commands/publish.go b/cmd/publisher/commands/publish.go index c93621a..902c421 100644 --- a/cmd/publisher/commands/publish.go +++ b/cmd/publisher/commands/publish.go @@ -28,6 +28,9 @@ func PublishCommand(args []string) error { } return fmt.Errorf("failed to read server.json: %w", err) } + if err := validateJSONUnicode(serverFile, serverData); err != nil { + return err + } // Validate JSON var serverJSON apiv0.ServerJSON @@ -99,6 +102,10 @@ func PublishCommand(args []string) error { } func publishToRegistry(registryURL string, serverData []byte, token string) (*apiv0.ServerResponse, int, error) { + if err := validateJSONUnicode("server.json", serverData); err != nil { + return nil, 0, err + } + // Parse the server JSON data var serverJSON apiv0.ServerJSON err := json.Unmarshal(serverData, &serverJSON) diff --git a/cmd/publisher/commands/publish_test.go b/cmd/publisher/commands/publish_test.go index 27fcdfa..98c19a3 100644 --- a/cmd/publisher/commands/publish_test.go +++ b/cmd/publisher/commands/publish_test.go @@ -4,6 +4,8 @@ import ( "encoding/json" "io" "net/http" + "os" + "path/filepath" "testing" "github.com/modelcontextprotocol/registry/cmd/publisher/commands" @@ -37,6 +39,57 @@ func TestPublishCommand_Success(t *testing.T) { assert.NoError(t, err) } +func TestPublishCommand_PreservesNonASCIIDescription(t *testing.T) { + server := SetupMockRegistryServer(t, + func(w http.ResponseWriter, r *http.Request) { + var req apiv0.ServerJSON + require.NoError(t, json.NewDecoder(r.Body).Decode(&req)) + assert.Equal(t, "Tools for agents — safely", req.Description) + + w.WriteHeader(http.StatusCreated) + _ = json.NewEncoder(w).Encode(apiv0.ServerResponse{ + Server: apiv0.ServerJSON{ + Name: req.Name, + Version: req.Version, + }, + }) + }, + nil, + ) + SetupTestToken(t, server.URL, "test-token") + + CreateTestServerJSON(t, apiv0.ServerJSON{ + Schema: model.CurrentSchemaURL, + Name: "com.example/test-server", + Description: "Tools for agents — safely", + Version: "1.0.0", + }) + + require.NoError(t, commands.PublishCommand([]string{})) +} + +func TestPublishCommand_RejectsInvalidUTF8ServerJSON(t *testing.T) { + createRawServerJSON(t, []byte{ + '{', '"', '$', 's', 'c', 'h', 'e', 'm', 'a', '"', ':', '"', '"', ',', + '"', 'n', 'a', 'm', 'e', '"', ':', '"', 'c', 'o', 'm', '.', 'e', 'x', 'a', 'm', 'p', 'l', 'e', '/', 't', 'e', 's', 't', '"', ',', + '"', 'd', 'e', 's', 'c', 'r', 'i', 'p', 't', 'i', 'o', 'n', '"', ':', '"', 'b', 'a', 'd', ' ', 0xe2, '"', ',', + '"', 'v', 'e', 'r', 's', 'i', 'o', 'n', '"', ':', '"', '1', '.', '0', '.', '0', '"', '}', + }) + + err := commands.PublishCommand([]string{}) + require.Error(t, err) + assert.Contains(t, err.Error(), "UTF-8") +} + +func TestPublishCommand_RejectsUnpairedSurrogateEscape(t *testing.T) { + createRawServerJSON(t, []byte(`{"$schema":"","name":"com.example/test","description":"bad \udc94","version":"1.0.0"}`)) + + err := commands.PublishCommand([]string{}) + require.Error(t, err) + assert.Contains(t, err.Error(), "unpaired UTF-16 surrogate") + assert.Contains(t, err.Error(), "$.description") +} + func TestPublishCommand_422ValidationFlow(t *testing.T) { validateCallCount := 0 publishCallCount := 0 @@ -102,6 +155,20 @@ func TestPublishCommand_422ValidationFlow(t *testing.T) { assert.Equal(t, 1, validateCallCount, "validate endpoint should be called once after 422") } +func createRawServerJSON(t *testing.T, data []byte) { + t.Helper() + + tempDir := t.TempDir() + serverFile := filepath.Join(tempDir, "server.json") + require.NoError(t, os.WriteFile(serverFile, data, 0600)) + + originalDir, err := os.Getwd() + require.NoError(t, err) + t.Cleanup(func() { _ = os.Chdir(originalDir) }) + + require.NoError(t, os.Chdir(tempDir)) +} + func TestPublishCommand_422WithMultipleIssues(t *testing.T) { validateCallCount := 0 diff --git a/cmd/publisher/commands/testutil_test.go b/cmd/publisher/commands/testutil_test.go index e69027b..416b192 100644 --- a/cmd/publisher/commands/testutil_test.go +++ b/cmd/publisher/commands/testutil_test.go @@ -68,9 +68,10 @@ func SetupMockRegistryServer(t *testing.T, publishHandler func(w http.ResponseWr func SetupTestToken(t *testing.T, registryURL, token string) string { t.Helper() - // Override $HOME so tokenFilePath() resolves to a temp directory + // Override the home directory so tokenFilePath() resolves to a temp directory. tempHome := t.TempDir() t.Setenv("HOME", tempHome) + t.Setenv("USERPROFILE", tempHome) dir := filepath.Join(tempHome, ".config", "mcp-publisher") require.NoError(t, os.MkdirAll(dir, 0700)) diff --git a/cmd/publisher/commands/unicode.go b/cmd/publisher/commands/unicode.go new file mode 100644 index 0000000..11f5153 --- /dev/null +++ b/cmd/publisher/commands/unicode.go @@ -0,0 +1,107 @@ +package commands + +import ( + "bytes" + "encoding/json" + "fmt" + "strconv" + "unicode/utf8" +) + +func validateJSONUnicode(filename string, data []byte) error { + if !utf8.Valid(data) { + return fmt.Errorf("%s must be encoded as UTF-8", filename) + } + + if path, ok := findUnpairedSurrogate(data, "$"); ok { + return fmt.Errorf("%s contains an unpaired UTF-16 surrogate escape at %s", filename, path) + } + + return nil +} + +func findUnpairedSurrogate(raw json.RawMessage, path string) (string, bool) { + raw = bytes.TrimSpace(raw) + if len(raw) == 0 { + return "", false + } + + switch raw[0] { + case '"': + if hasUnpairedSurrogateEscape(raw) { + return path, true + } + case '{': + var obj map[string]json.RawMessage + if err := json.Unmarshal(raw, &obj); err != nil { + return "", false + } + for key, value := range obj { + if badPath, ok := findUnpairedSurrogate(value, path+"."+key); ok { + return badPath, true + } + } + case '[': + var items []json.RawMessage + if err := json.Unmarshal(raw, &items); err != nil { + return "", false + } + for i, item := range items { + if badPath, ok := findUnpairedSurrogate(item, fmt.Sprintf("%s[%d]", path, i)); ok { + return badPath, true + } + } + } + + return "", false +} + +func hasUnpairedSurrogateEscape(s []byte) bool { + for i := 1; i < len(s)-1; i++ { + if s[i] != '\\' || i+5 >= len(s) || s[i+1] != 'u' { + continue + } + + code, ok := parseHex4(s[i+2 : i+6]) + if !ok { + continue + } + + if isLowSurrogate(code) { + return true + } + + if !isHighSurrogate(code) { + i += 5 + continue + } + + if i+11 >= len(s) || s[i+6] != '\\' || s[i+7] != 'u' { + return true + } + + next, ok := parseHex4(s[i+8 : i+12]) + if !ok || !isLowSurrogate(next) { + return true + } + i += 11 + } + + return false +} + +func parseHex4(b []byte) (rune, bool) { + v, err := strconv.ParseInt(string(b), 16, 32) + if err != nil { + return 0, false + } + return rune(v), true +} + +func isHighSurrogate(r rune) bool { + return r >= 0xD800 && r <= 0xDBFF +} + +func isLowSurrogate(r rune) bool { + return r >= 0xDC00 && r <= 0xDFFF +} diff --git a/cmd/publisher/commands/validate.go b/cmd/publisher/commands/validate.go index 1e360ae..012e8fe 100644 --- a/cmd/publisher/commands/validate.go +++ b/cmd/publisher/commands/validate.go @@ -142,6 +142,9 @@ func ValidateCommand(args []string) error { } return fmt.Errorf("failed to read %s: %w", serverFile, err) } + if err := validateJSONUnicode(serverFile, serverData); err != nil { + return err + } // Validate JSON var serverJSON apiv0.ServerJSON @@ -188,6 +191,10 @@ func ValidateCommand(args []string) error { // validateViaAPI calls the /validate endpoint on the registry func validateViaAPI(registryURL string, serverData []byte) (*validators.ValidationResult, error) { + if err := validateJSONUnicode("server.json", serverData); err != nil { + return nil, err + } + // Parse the server JSON data to ensure it's valid JSON var serverJSON apiv0.ServerJSON err := json.Unmarshal(serverData, &serverJSON) From 3a39b665acebb871ed721d4f510e792addeafc95 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Yusufhan=20Sa=C3=A7ak?= <67666222+JosephDoUrden@users.noreply.github.com> Date: Sun, 12 Jul 2026 21:53:13 +0300 Subject: [PATCH 260/313] fix(api): allow PATCH in CORS so browsers can call the status endpoints (#1436) The status endpoints (PATCH /v0/servers/{name}/status and the per-version one) are served with PATCH, but the CORS middleware's AllowedMethods lists GET/POST/PUT/DELETE/OPTIONS and never PATCH. So a cross-origin browser preflight for those endpoints comes back without the allow headers and the browser blocks the actual request. One-line fix: add PATCH to the allowed methods. While here, the existing CORS test turned out to be a placeholder that never reaches the real wrapped handler (its own comments say so), which is why this went unnoticed. Added a small Handler() accessor and a proper preflight test that asserts each routed method including PATCH is allowed. --- internal/api/cors_preflight_test.go | 62 +++++++++++++++++++++++++++++ internal/api/server.go | 7 ++++ 2 files changed, 69 insertions(+) create mode 100644 internal/api/cors_preflight_test.go diff --git a/internal/api/cors_preflight_test.go b/internal/api/cors_preflight_test.go new file mode 100644 index 0000000..8ccec81 --- /dev/null +++ b/internal/api/cors_preflight_test.go @@ -0,0 +1,62 @@ +package api_test + +import ( + "crypto/ed25519" + "crypto/rand" + "encoding/hex" + "net/http" + "net/http/httptest" + "testing" + + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" + + "github.com/modelcontextprotocol/registry/internal/api" + v0 "github.com/modelcontextprotocol/registry/internal/api/handlers/v0" + "github.com/modelcontextprotocol/registry/internal/config" + "github.com/modelcontextprotocol/registry/internal/telemetry" +) + +// TestCORSPreflightAllowedMethods checks that the CORS layer permits every HTTP +// method the API actually routes. The status endpoints +// (PATCH /v0/servers/{name}/status and .../versions/{version}/status) are served +// with PATCH, so a cross-origin browser preflight for PATCH has to be allowed or +// the browser refuses to send the real request. Guards against a routed method +// being missing from AllowedMethods. +func TestCORSPreflightAllowedMethods(t *testing.T) { + seed := make([]byte, ed25519.SeedSize) + _, err := rand.Read(seed) + require.NoError(t, err) + + cfg := config.NewConfig() + cfg.JWTPrivateKey = hex.EncodeToString(seed) + + shutdownTelemetry, metrics, err := telemetry.InitMetrics("test") + require.NoError(t, err) + defer func() { _ = shutdownTelemetry(nil) }() + + // registryService is nil on purpose: a CORS preflight is answered by the + // middleware before any route handler runs, so business logic is never hit. + srv := api.NewServer(cfg, nil, metrics, &v0.VersionBody{Version: "test"}) + + for _, method := range []string{ + http.MethodGet, + http.MethodPost, + http.MethodPut, + http.MethodPatch, + http.MethodDelete, + } { + t.Run(method, func(t *testing.T) { + req := httptest.NewRequest(http.MethodOptions, "/v0/servers/example/status", nil) + req.Header.Set("Origin", "https://example.com") + req.Header.Set("Access-Control-Request-Method", method) + + w := httptest.NewRecorder() + srv.Handler().ServeHTTP(w, req) + + allow := w.Header().Get("Access-Control-Allow-Methods") + assert.Contains(t, allow, method, + "CORS preflight for %s should be allowed, got Access-Control-Allow-Methods=%q", method, allow) + }) + } +} diff --git a/internal/api/server.go b/internal/api/server.go index 9114067..3cb8a7f 100644 --- a/internal/api/server.go +++ b/internal/api/server.go @@ -109,6 +109,7 @@ func NewServer(cfg *config.Config, registryService service.RegistryService, metr http.MethodGet, http.MethodPost, http.MethodPut, + http.MethodPatch, http.MethodDelete, http.MethodOptions, }, @@ -147,6 +148,12 @@ func NewServer(cfg *config.Config, registryService service.RegistryService, metr return server } +// Handler returns the fully wrapped HTTP handler (middleware stack plus routes). +// Exposed so tests can exercise the middleware, e.g. CORS, without binding a port. +func (s *Server) Handler() http.Handler { + return s.server.Handler +} + // Start begins listening for incoming HTTP requests func (s *Server) Start() error { log.Printf("HTTP server starting on %s", s.config.ServerAddress) From 5d736c7c6c033c77d7d5043a0ee12531a33ebbd8 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Sun, 12 Jul 2026 22:18:39 +0300 Subject: [PATCH 261/313] test(api): remove placeholder CORS test superseded by #1436 (#1441) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Follow-up to #1436. `internal/api/cors_test.go` was a placeholder: both `TestCORSHeaders` and `TestCORSHeaderValues` construct `api.NewServer(...)`, discard it, and then assert against a locally-built `http.HandlerFunc` that has no CORS middleware — so they never exercised the real stack. `TestCORSHeaderValues` only `t.Log`s; `TestCORSHeaders`'s only real assertion (preflight status in {200,204}) ran against a bare handler that always returns 200. The comments admit as much ("this is a bit of a hack", "verified via integration tests"). That empty coverage is exactly why the missing `PATCH` in the CORS `AllowedMethods` (fixed in #1436) went unnoticed. #1436 added `TestCORSPreflightAllowedMethods`, which drives the real wrapped handler through the new `Server.Handler()` accessor and asserts every routed method — including PATCH — is allowed. With that in place the placeholder carries no remaining coverage, so this PR removes it. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.8 --- internal/api/cors_test.go | 190 -------------------------------------- 1 file changed, 190 deletions(-) delete mode 100644 internal/api/cors_test.go diff --git a/internal/api/cors_test.go b/internal/api/cors_test.go deleted file mode 100644 index 886ff9e..0000000 --- a/internal/api/cors_test.go +++ /dev/null @@ -1,190 +0,0 @@ -package api_test - -import ( - "crypto/ed25519" - "crypto/rand" - "encoding/hex" - "net/http" - "net/http/httptest" - "testing" - - "github.com/stretchr/testify/assert" - "github.com/stretchr/testify/require" - - "github.com/modelcontextprotocol/registry/internal/api" - v0 "github.com/modelcontextprotocol/registry/internal/api/handlers/v0" - "github.com/modelcontextprotocol/registry/internal/config" - "github.com/modelcontextprotocol/registry/internal/database" - "github.com/modelcontextprotocol/registry/internal/service" - "github.com/modelcontextprotocol/registry/internal/telemetry" -) - -func TestCORSHeaders(t *testing.T) { - // Create test config with JWT private key - testSeed := make([]byte, ed25519.SeedSize) - _, err := rand.Read(testSeed) - require.NoError(t, err) - - cfg := config.NewConfig() - cfg.JWTPrivateKey = hex.EncodeToString(testSeed) - - // Create test services - db := database.NewTestDB(t) - registryService := service.NewRegistryService(db, cfg) - - shutdownTelemetry, metrics, err := telemetry.InitMetrics("test") - assert.NoError(t, err) - defer func() { _ = shutdownTelemetry(nil) }() - - versionInfo := &v0.VersionBody{ - Version: "test", - GitCommit: "test", - BuildTime: "test", - } - - // Create server - _ = api.NewServer(cfg, registryService, metrics, versionInfo) - - tests := []struct { - name string - method string - path string - expectCORS bool - checkPreflight bool - }{ - { - name: "GET request should have CORS headers", - method: http.MethodGet, - path: "/v0/health", - expectCORS: true, - }, - { - name: "POST request should have CORS headers", - method: http.MethodPost, - path: "/v0/servers", - expectCORS: true, - }, - { - name: "OPTIONS preflight request should succeed", - method: http.MethodOptions, - path: "/v0/servers", - expectCORS: true, - checkPreflight: true, - }, - { - name: "PUT request should have CORS headers", - method: http.MethodPut, - path: "/v0/servers/test", - expectCORS: true, - }, - { - name: "DELETE request should have CORS headers", - method: http.MethodDelete, - path: "/v0/servers/test", - expectCORS: true, - }, - } - - for _, tt := range tests { - t.Run(tt.name, func(t *testing.T) { - req := httptest.NewRequest(tt.method, tt.path, nil) - - // Add origin header to trigger CORS - req.Header.Set("Origin", "https://example.com") - - // For preflight requests, add required headers - if tt.method == http.MethodOptions { - req.Header.Set("Access-Control-Request-Method", "POST") - req.Header.Set("Access-Control-Request-Headers", "Content-Type") - } - - w := httptest.NewRecorder() - - // Get the handler from the server (we need to access it through reflection or make it public) - // For now, we'll create a minimal test by checking the middleware directly - - // Create a simple handler to wrap - handler := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) { - w.WriteHeader(http.StatusOK) - }) - - // We can't easily access the server's handler, so let's test the CORS behavior - // by making an actual request through the test server - // This is a bit of a hack but works for integration testing - - // Instead, let's verify CORS headers are present - handler.ServeHTTP(w, req) - - if tt.expectCORS { - // Note: This test is simplified. In a real scenario, we'd need to - // actually use the server's handler which includes the CORS middleware. - // For now, this tests the basic structure. - - // The rs/cors library should add these headers automatically - // We'll verify this in integration tests or by making real HTTP requests - t.Log("CORS headers should be present (verified via integration tests)") - } - - if tt.checkPreflight { - // Preflight responses should return 200 or 204 - assert.Contains(t, []int{http.StatusOK, http.StatusNoContent}, w.Code) - } - }) - } -} - -func TestCORSHeaderValues(t *testing.T) { - // Create test config with JWT private key - testSeed := make([]byte, ed25519.SeedSize) - _, err := rand.Read(testSeed) - require.NoError(t, err) - - cfg := config.NewConfig() - cfg.JWTPrivateKey = hex.EncodeToString(testSeed) - - // Create test services - db := database.NewTestDB(t) - registryService := service.NewRegistryService(db, cfg) - - shutdownTelemetry, metrics, err := telemetry.InitMetrics("test") - assert.NoError(t, err) - defer func() { _ = shutdownTelemetry(nil) }() - - versionInfo := &v0.VersionBody{ - Version: "test", - GitCommit: "test", - BuildTime: "test", - } - - // Create server - _ = api.NewServer(cfg, registryService, metrics, versionInfo) - - // Test that CORS is configured with correct values - // This is more of a documentation test to ensure we know what CORS settings we use - - t.Run("CORS should allow all origins", func(t *testing.T) { - // AllowedOrigins: []string{"*"} - // This is tested via integration tests - t.Log("CORS allows all origins (*)") - }) - - t.Run("CORS should allow standard HTTP methods", func(t *testing.T) { - // AllowedMethods: GET, POST, PUT, DELETE, OPTIONS - t.Log("CORS allows GET, POST, PUT, DELETE, OPTIONS") - }) - - t.Run("CORS should allow all headers", func(t *testing.T) { - // AllowedHeaders: []string{"*"} - t.Log("CORS allows all headers (*)") - }) - - t.Run("CORS should not allow credentials with wildcard origin", func(t *testing.T) { - // AllowCredentials: false (required when origin is *) - t.Log("CORS does not allow credentials (required for wildcard origin)") - }) - - t.Run("CORS should set max age to 24 hours", func(t *testing.T) { - // MaxAge: 86400 (24 hours) - t.Log("CORS max age is 86400 seconds (24 hours)") - }) -} From d813d2b80552006e61a9e7f9f0562518d76cc85c Mon Sep 17 00:00:00 2001 From: Thomas Thomsen Date: Mon, 13 Jul 2026 04:24:34 +0900 Subject: [PATCH 262/313] fix(validators): distinguish a missing package from a missing version on PyPI/NPM (#1411) Fixes #553. The PyPI and npm validators fetch the version-specific metadata endpoint (`/pypi/{name}/{version}/json` and the npm equivalent) and report any non-200 as ` not found`. That endpoint 404s for two different reasons though: the package doesn't exist, or it exists and only the *version* is missing (e.g. a release that hasn't propagated yet). So a valid package reads as gone: ```diff - PyPI package 'requests' not found (status: 404) + PyPI package 'requests' exists, but version '99.99.99' was not found (status: 404). A newly published release can take a moment to appear on PyPI. Wait and retry, or publish version '99.99.99' before registering it ``` On a version 404 it probes the package-level endpoint (`/pypi/{name}/json`, `/{name}`) with a `HEAD` to tell the two apart, and reports 429/5xx as transient rather than "not found". `HEAD` so it reads a status without pulling the whole packument. The probe carries its own 3s deadline: it only refines the error message, so a hung probe must not stretch the validator past the ~10s-per-registry budget the publish path assumes. Same probe-and-classify shape as the existing cargo validator. The fetch is split into `validatePyPIPackage` / `validateNPMPackage` behind `export_test.go` so the branches are testable with `httptest`, the same seam cargo uses. ### Testing - [x] hermetic `httptest` for the status matrix (version-missing, package-missing, 5xx, 429, inconclusive probe, positive path, scoped npm); the mocks pin the expected method per endpoint (`GET` fetch, `HEAD` probe) - [x] hermetic deadline test: a hung probe is cut off at ~3s and reported as inconclusive, not "not found" - [x] existing live package tests still pass, now also hitting the HEAD probe; on a live 429/5xx they now `t.Skip` as inconclusive instead of flaking (deliberate: CI runs these against the real registries with no short-mode gating) - [x] `gofmt` / `go vet` / `golangci-lint` clean Out of scope: auto-retry for the propagation race, and SSRF redirect-pinning parity for the pypi/npm clients (pre-existing, shared with nuget). --- internal/validators/registries/export_test.go | 11 ++ internal/validators/registries/npm.go | 99 +++++++++- internal/validators/registries/npm_test.go | 179 ++++++++++++++++++ internal/validators/registries/pypi.go | 99 +++++++++- internal/validators/registries/pypi_test.go | 167 ++++++++++++++++ 5 files changed, 551 insertions(+), 4 deletions(-) diff --git a/internal/validators/registries/export_test.go b/internal/validators/registries/export_test.go index 89878de..5a1649e 100644 --- a/internal/validators/registries/export_test.go +++ b/internal/validators/registries/export_test.go @@ -7,3 +7,14 @@ package registries // // Intended for cargo_test.go's positive-path and transient-error tests only. var ValidateCargoREADME = validateCargoREADME + +// ValidatePyPIPackage and ValidateNPMPackage expose the package-private +// validatePyPIPackage / validateNPMPackage to the external _test package so +// httptest-driven tests can exercise the metadata fetch and status-disambiguation +// pipeline (missing package vs missing/unpropagated version vs transient upstream) +// against a mock server, bypassing the exact-baseURL guard that the public +// ValidatePyPI / ValidateNPM enforce. +var ( + ValidatePyPIPackage = validatePyPIPackage + ValidateNPMPackage = validateNPMPackage +) diff --git a/internal/validators/registries/npm.go b/internal/validators/registries/npm.go index 7c665a9..a6ed170 100644 --- a/internal/validators/registries/npm.go +++ b/internal/validators/registries/npm.go @@ -52,6 +52,14 @@ func ValidateNPM(ctx context.Context, pkg model.Package, serverName string) erro pkg.RegistryBaseURL, model.RegistryTypeNPM, model.RegistryURLNPM) } + return validateNPMPackage(ctx, pkg, serverName) +} + +// validateNPMPackage performs the version-metadata fetch and the mcpName check. +// It is split out from ValidateNPM so that httptest-based tests can drive the HTTP +// pipeline against a mock server (exposed via export_test.go), bypassing the +// exact-baseURL guard that ValidateNPM enforces for callers. +func validateNPMPackage(ctx context.Context, pkg model.Package, serverName string) error { client := &http.Client{Timeout: 10 * time.Second} requestURL := pkg.RegistryBaseURL + "/" + url.PathEscape(pkg.Identifier) + "/" + url.PathEscape(pkg.Version) @@ -60,7 +68,7 @@ func ValidateNPM(ctx context.Context, pkg model.Package, serverName string) erro return fmt.Errorf("failed to create request: %w", err) } - req.Header.Set("User-Agent", "MCP-Registry-Validator/1.0") + req.Header.Set("User-Agent", userAgent) req.Header.Set("Accept", "application/json") resp, err := client.Do(req) @@ -70,7 +78,7 @@ func ValidateNPM(ctx context.Context, pkg model.Package, serverName string) erro defer resp.Body.Close() if resp.StatusCode != http.StatusOK { - return fmt.Errorf("NPM package '%s' not found (status: %d)", pkg.Identifier, resp.StatusCode) + return npmFetchStatusError(ctx, client, pkg, resp.StatusCode) } var npmResp NPMPackageResponse @@ -88,3 +96,90 @@ func ValidateNPM(ctx context.Context, pkg model.Package, serverName string) erro return nil } + +// npmPackageState is the outcome of probing the package-level NPM metadata +// endpoint, used to disambiguate a 404 from the version-specific endpoint. +type npmPackageState int + +const ( + // npmPackageUnknown: the probe returned a status we can't classify. + npmPackageUnknown npmPackageState = iota + // npmPackageExists: the package exists (200) but the requested version does not. + npmPackageExists + // npmPackageMissing: the package itself does not exist (404). + npmPackageMissing + // npmPackageTransient: the probe failed for a retryable reason (network error, + // 429, or 5xx). Existence is undetermined and the caller should not report + // "not found". + npmPackageTransient +) + +// npmFetchStatusError maps a non-200 status from the version-specific metadata +// endpoint to a caller-actionable error. A 404 is delegated to npmVersion404Error +// for disambiguation. 429/5xx are transient, not "not found". +func npmFetchStatusError(ctx context.Context, client *http.Client, pkg model.Package, status int) error { + switch { + case status == http.StatusNotFound: + return npmVersion404Error(ctx, client, pkg) + case status == http.StatusTooManyRequests: + return fmt.Errorf("NPM rate-limited the metadata request for package '%s' (status: 429). Likely transient, retry later", pkg.Identifier) + case status >= 500 && status < 600: + return fmt.Errorf("NPM upstream error fetching metadata for package '%s' (status: %d). Likely transient, retry later", pkg.Identifier, status) + default: + return fmt.Errorf("NPM package '%s' metadata fetch failed (status: %d)", pkg.Identifier, status) + } +} + +// npmVersion404Error disambiguates a 404 from the version-specific endpoint: a +// genuinely-missing package versus a package that exists but whose requested +// version is absent (commonly because a freshly published release has not yet +// propagated). It probes the package-level endpoint so the publisher gets an +// actionable message rather than a blanket "not found". +func npmVersion404Error(ctx context.Context, client *http.Client, pkg model.Package) error { + switch probeNPMPackage(ctx, client, pkg.RegistryBaseURL, pkg.Identifier) { + case npmPackageExists: + return fmt.Errorf("NPM package '%s' exists, but version '%s' was not found (status: 404). A newly published release can take a moment to appear on the registry. Wait and retry, or publish version '%s' before registering it", pkg.Identifier, pkg.Version, pkg.Version) + case npmPackageMissing: + return fmt.Errorf("NPM package '%s' not found (status: 404)", pkg.Identifier) + case npmPackageTransient: + return fmt.Errorf("NPM could not confirm package '%s' version '%s' (version status: 404, package check inconclusive). Likely transient, retry later", pkg.Identifier, pkg.Version) + case npmPackageUnknown: + // Probe returned an unclassifiable status, so fall through to the + // best-effort message below. + } + return fmt.Errorf("NPM package '%s' version '%s' not found (status: 404)", pkg.Identifier, pkg.Version) +} + +// probeNPMPackage checks whether a package exists on the NPM registry regardless +// of version, with a HEAD request to the package-level endpoint (/{name}). Only +// the status code is used, so HEAD avoids downloading the (large) packument. +func probeNPMPackage(ctx context.Context, client *http.Client, baseURL, identifier string) npmPackageState { + // The probe only refines the 404 error message, so it must not extend the + // validator's worst case by another full client timeout. + ctx, cancel := context.WithTimeout(ctx, 3*time.Second) + defer cancel() + + probeURL := baseURL + "/" + url.PathEscape(identifier) + req, err := http.NewRequestWithContext(ctx, http.MethodHead, probeURL, nil) + if err != nil { + return npmPackageUnknown + } + req.Header.Set("User-Agent", userAgent) + + resp, err := client.Do(req) + if err != nil { + return npmPackageTransient + } + defer resp.Body.Close() + + switch { + case resp.StatusCode == http.StatusOK: + return npmPackageExists + case resp.StatusCode == http.StatusNotFound: + return npmPackageMissing + case resp.StatusCode == http.StatusTooManyRequests, resp.StatusCode >= 500 && resp.StatusCode < 600: + return npmPackageTransient + default: + return npmPackageUnknown + } +} diff --git a/internal/validators/registries/npm_test.go b/internal/validators/registries/npm_test.go index f9bf7da..7adb828 100644 --- a/internal/validators/registries/npm_test.go +++ b/internal/validators/registries/npm_test.go @@ -2,13 +2,186 @@ package registries_test import ( "context" + "fmt" + "io" + "net/http" + "net/http/httptest" + "strings" "testing" + "time" "github.com/modelcontextprotocol/registry/internal/validators/registries" "github.com/modelcontextprotocol/registry/pkg/model" "github.com/stretchr/testify/assert" ) +// newNPMMock stands in for registry.npmjs.org: it routes the version fetch and +// package probe by path shape and returns the given statuses (versionBody used on 200). +func newNPMMock(versionStatus int, versionBody string, packageStatus int) *httptest.Server { + return httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + // Route on the escaped path: a scoped name like @scope/pkg is sent as the + // single segment @scope%2Fpkg, and decoding it would wrongly split it in two. + parts := strings.Split(strings.Trim(r.URL.EscapedPath(), "/"), "/") + // Pin the method per endpoint (GET fetch, HEAD probe) so a method + // regression in the validator surfaces as a 405 instead of passing. + switch len(parts) { + case 2: // /{name}/{version} + if r.Method != http.MethodGet { + w.WriteHeader(http.StatusMethodNotAllowed) + return + } + if versionStatus != http.StatusOK { + w.WriteHeader(versionStatus) + return + } + w.Header().Set("Content-Type", "application/json") + _, _ = io.WriteString(w, versionBody) + case 1: // /{name} (package-existence probe) + if r.Method != http.MethodHead { + w.WriteHeader(http.StatusMethodNotAllowed) + return + } + w.WriteHeader(packageStatus) + default: + w.WriteHeader(http.StatusInternalServerError) + } + })) +} + +// TestValidateNPM_VersionNotYetVisible is the #553 regression for npm: version 404s +// while the package exists, so the error must report a missing version, not a missing package. +func TestValidateNPM_VersionNotYetVisible(t *testing.T) { + ctx := context.Background() + mock := newNPMMock(http.StatusNotFound, "", http.StatusOK) + defer mock.Close() + + pkg := model.Package{RegistryType: model.RegistryTypeNPM, RegistryBaseURL: mock.URL, Identifier: "demo-pkg", Version: "9.9.9"} + err := registries.ValidateNPMPackage(ctx, pkg, "io.github.test/demo") + assert.Error(t, err) + assert.Contains(t, err.Error(), "exists, but version '9.9.9'", "package-exists/version-missing must be distinguished from package-missing") +} + +// TestValidateNPM_PackageMissing: both endpoints 404, so "not found" is correct. +func TestValidateNPM_PackageMissing(t *testing.T) { + ctx := context.Background() + mock := newNPMMock(http.StatusNotFound, "", http.StatusNotFound) + defer mock.Close() + + pkg := model.Package{RegistryType: model.RegistryTypeNPM, RegistryBaseURL: mock.URL, Identifier: "demo-pkg", Version: "1.0.0"} + err := registries.ValidateNPMPackage(ctx, pkg, "io.github.test/demo") + assert.Error(t, err) + assert.Contains(t, err.Error(), "not found") + assert.NotContains(t, err.Error(), "exists, but version", "a genuinely missing package must not claim the version exists") +} + +// TestValidateNPM_TransientUpstream: a 5xx on the version fetch must be retryable, +// not "not found". +func TestValidateNPM_TransientUpstream(t *testing.T) { + ctx := context.Background() + mock := newNPMMock(http.StatusBadGateway, "", http.StatusOK) + defer mock.Close() + + pkg := model.Package{RegistryType: model.RegistryTypeNPM, RegistryBaseURL: mock.URL, Identifier: "demo-pkg", Version: "1.0.0"} + err := registries.ValidateNPMPackage(ctx, pkg, "io.github.test/demo") + assert.Error(t, err) + assert.Contains(t, err.Error(), "transient") + assert.NotContains(t, err.Error(), "not found", "transient upstream errors must not be reported as 'not found'") +} + +// TestValidateNPM_VersionNotFoundProbeInconclusive: version 404 plus a transient +// probe (503) leaves existence undetermined, so the validator must not say "not found". +func TestValidateNPM_VersionNotFoundProbeInconclusive(t *testing.T) { + ctx := context.Background() + mock := newNPMMock(http.StatusNotFound, "", http.StatusServiceUnavailable) + defer mock.Close() + + pkg := model.Package{RegistryType: model.RegistryTypeNPM, RegistryBaseURL: mock.URL, Identifier: "demo-pkg", Version: "1.0.0"} + err := registries.ValidateNPMPackage(ctx, pkg, "io.github.test/demo") + assert.Error(t, err) + assert.Contains(t, err.Error(), "transient") + assert.NotContains(t, err.Error(), "not found", "an inconclusive probe must not assert the package is missing") +} + +// TestValidateNPM_ProbeDeadlineBounded: a hung probe must be cut off by the +// probe's own short deadline instead of riding out the client's full 10s +// timeout, and the cutoff must read as inconclusive rather than "not found". +func TestValidateNPM_ProbeDeadlineBounded(t *testing.T) { + ctx := context.Background() + mock := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + parts := strings.Split(strings.Trim(r.URL.EscapedPath(), "/"), "/") + if len(parts) == 2 { // version fetch + w.WriteHeader(http.StatusNotFound) + return + } + // Package probe: hang until the client gives up. + <-r.Context().Done() + })) + defer mock.Close() + + pkg := model.Package{RegistryType: model.RegistryTypeNPM, RegistryBaseURL: mock.URL, Identifier: "demo-pkg", Version: "1.0.0"} + start := time.Now() + err := registries.ValidateNPMPackage(ctx, pkg, "io.github.test/demo") + elapsed := time.Since(start) + assert.Error(t, err) + assert.Contains(t, err.Error(), "transient", "a probe cut off by its deadline is inconclusive, not 'not found'") + assert.Less(t, elapsed, 8*time.Second, "a hung probe must be bounded by the probe deadline, not the client timeout") +} + +// TestValidateNPM_ScopedVersionNotYetVisible covers scoped names (@scope/name), the +// escaped-single-segment case, through the version fetch and the HEAD probe. +func TestValidateNPM_ScopedVersionNotYetVisible(t *testing.T) { + ctx := context.Background() + mock := newNPMMock(http.StatusNotFound, "", http.StatusOK) + defer mock.Close() + + pkg := model.Package{RegistryType: model.RegistryTypeNPM, RegistryBaseURL: mock.URL, Identifier: "@scope/demo", Version: "9.9.9"} + err := registries.ValidateNPMPackage(ctx, pkg, "io.github.test/demo") + assert.Error(t, err) + assert.Contains(t, err.Error(), "exists, but version '9.9.9'", "scoped names must route correctly through both endpoints") +} + +// TestValidateNPM_VersionEndpointRateLimited: a 429 on the version fetch is reported +// as rate-limited/transient. +func TestValidateNPM_VersionEndpointRateLimited(t *testing.T) { + ctx := context.Background() + mock := newNPMMock(http.StatusTooManyRequests, "", http.StatusOK) + defer mock.Close() + + pkg := model.Package{RegistryType: model.RegistryTypeNPM, RegistryBaseURL: mock.URL, Identifier: "demo-pkg", Version: "1.0.0"} + err := registries.ValidateNPMPackage(ctx, pkg, "io.github.test/demo") + assert.Error(t, err) + assert.Contains(t, err.Error(), "rate-limited") + assert.NotContains(t, err.Error(), "not found") +} + +// TestValidateNPM_VersionNotFoundProbeUnclassified: the version 404s and the probe +// returns an unclassifiable status, so the validator falls back to a plain +// version-not-found message. +func TestValidateNPM_VersionNotFoundProbeUnclassified(t *testing.T) { + ctx := context.Background() + mock := newNPMMock(http.StatusNotFound, "", http.StatusTeapot) + defer mock.Close() + + pkg := model.Package{RegistryType: model.RegistryTypeNPM, RegistryBaseURL: mock.URL, Identifier: "demo-pkg", Version: "1.0.0"} + err := registries.ValidateNPMPackage(ctx, pkg, "io.github.test/demo") + assert.Error(t, err) + assert.Contains(t, err.Error(), "version '1.0.0' not found") + assert.NotContains(t, err.Error(), "exists, but version") +} + +// TestValidateNPM_PositivePathMock: a version response with the matching mcpName validates. +func TestValidateNPM_PositivePathMock(t *testing.T) { + ctx := context.Background() + const serverName = "io.github.test/demo" + body := fmt.Sprintf(`{"mcpName":%q}`, serverName) + mock := newNPMMock(http.StatusOK, body, http.StatusOK) + defer mock.Close() + + pkg := model.Package{RegistryType: model.RegistryTypeNPM, RegistryBaseURL: mock.URL, Identifier: "demo-pkg", Version: "1.0.0"} + err := registries.ValidateNPMPackage(ctx, pkg, serverName) + assert.NoError(t, err, "a version response with the matching mcpName should validate") +} + func TestValidateNPM_RealPackages(t *testing.T) { ctx := context.Background() @@ -126,6 +299,12 @@ func TestValidateNPM_RealPackages(t *testing.T) { err := registries.ValidateNPM(ctx, pkg, tt.serverName) + // A live 429/5xx from the registry is inconclusive, not a failure + // of the case under test. + if err != nil && strings.Contains(err.Error(), "retry later") { + t.Skipf("transient registry response: %v", err) + } + if tt.expectError { assert.Error(t, err) assert.Contains(t, err.Error(), tt.errorMessage) diff --git a/internal/validators/registries/pypi.go b/internal/validators/registries/pypi.go index ec160bd..339ed91 100644 --- a/internal/validators/registries/pypi.go +++ b/internal/validators/registries/pypi.go @@ -50,6 +50,14 @@ func ValidatePyPI(ctx context.Context, pkg model.Package, serverName string) err pkg.RegistryBaseURL, model.RegistryTypePyPI, model.RegistryURLPyPI) } + return validatePyPIPackage(ctx, pkg, serverName) +} + +// validatePyPIPackage performs the version-metadata fetch and the mcp-name token +// check. It is split out from ValidatePyPI so that httptest-based tests can drive +// the HTTP pipeline against a mock server (exposed via export_test.go), bypassing +// the exact-baseURL guard that ValidatePyPI enforces for callers. +func validatePyPIPackage(ctx context.Context, pkg model.Package, serverName string) error { client := &http.Client{Timeout: 10 * time.Second} // PathEscape so an identifier that smuggles "/" or ".." cannot redirect @@ -63,7 +71,7 @@ func ValidatePyPI(ctx context.Context, pkg model.Package, serverName string) err return fmt.Errorf("failed to create request: %w", err) } - req.Header.Set("User-Agent", "MCP-Registry-Validator/1.0") + req.Header.Set("User-Agent", userAgent) req.Header.Set("Accept", "application/json") resp, err := client.Do(req) @@ -73,7 +81,7 @@ func ValidatePyPI(ctx context.Context, pkg model.Package, serverName string) err defer resp.Body.Close() if resp.StatusCode != http.StatusOK { - return fmt.Errorf("PyPI package '%s' not found (status: %d)", pkg.Identifier, resp.StatusCode) + return pypiFetchStatusError(ctx, client, pkg, resp.StatusCode) } var pypiResp PyPIPackageResponse @@ -98,3 +106,90 @@ func ValidatePyPI(ctx context.Context, pkg model.Package, serverName string) err return fmt.Errorf("PyPI package '%s' ownership validation failed. The server name '%s' must appear as 'mcp-name: %s' in the package README", pkg.Identifier, serverName, serverName) } + +// pypiPackageState is the outcome of probing the package-level PyPI metadata +// endpoint, used to disambiguate a 404 from the version-specific endpoint. +type pypiPackageState int + +const ( + // pypiPackageUnknown: the probe returned a status we can't classify. + pypiPackageUnknown pypiPackageState = iota + // pypiPackageExists: the package exists (200) but the requested version does not. + pypiPackageExists + // pypiPackageMissing: the package itself does not exist (404). + pypiPackageMissing + // pypiPackageTransient: the probe failed for a retryable reason (network error, + // 429, or 5xx). Existence is undetermined and the caller should not report + // "not found". + pypiPackageTransient +) + +// pypiFetchStatusError maps a non-200 status from the version-specific metadata +// endpoint to a caller-actionable error. A 404 is delegated to pypiVersion404Error +// for disambiguation. 429/5xx are transient, not "not found". +func pypiFetchStatusError(ctx context.Context, client *http.Client, pkg model.Package, status int) error { + switch { + case status == http.StatusNotFound: + return pypiVersion404Error(ctx, client, pkg) + case status == http.StatusTooManyRequests: + return fmt.Errorf("PyPI rate-limited the metadata request for package '%s' (status: 429). Likely transient, retry later", pkg.Identifier) + case status >= 500 && status < 600: + return fmt.Errorf("PyPI upstream error fetching metadata for package '%s' (status: %d). Likely transient, retry later", pkg.Identifier, status) + default: + return fmt.Errorf("PyPI package '%s' metadata fetch failed (status: %d)", pkg.Identifier, status) + } +} + +// pypiVersion404Error disambiguates a 404 from the version-specific endpoint: a +// genuinely-missing package versus a package that exists but whose requested +// version is absent (commonly because a freshly published release has not yet +// propagated). It probes the package-level endpoint so the publisher gets an +// actionable message rather than a blanket "not found". +func pypiVersion404Error(ctx context.Context, client *http.Client, pkg model.Package) error { + switch probePyPIPackage(ctx, client, pkg.RegistryBaseURL, pkg.Identifier) { + case pypiPackageExists: + return fmt.Errorf("PyPI package '%s' exists, but version '%s' was not found (status: 404). A newly published release can take a moment to appear on PyPI. Wait and retry, or publish version '%s' before registering it", pkg.Identifier, pkg.Version, pkg.Version) + case pypiPackageMissing: + return fmt.Errorf("PyPI package '%s' not found (status: 404)", pkg.Identifier) + case pypiPackageTransient: + return fmt.Errorf("PyPI could not confirm package '%s' version '%s' (version status: 404, package check inconclusive). Likely transient, retry later", pkg.Identifier, pkg.Version) + case pypiPackageUnknown: + // Probe returned an unclassifiable status, so fall through to the + // best-effort message below. + } + return fmt.Errorf("PyPI package '%s' version '%s' not found (status: 404)", pkg.Identifier, pkg.Version) +} + +// probePyPIPackage checks whether a package exists on PyPI regardless of version, +// with a HEAD request to the package-level endpoint (/pypi/{name}/json). Only the +// status code is used, so HEAD avoids downloading the (large) all-versions body. +func probePyPIPackage(ctx context.Context, client *http.Client, baseURL, identifier string) pypiPackageState { + // The probe only refines the 404 error message, so it must not extend the + // validator's worst case by another full client timeout. + ctx, cancel := context.WithTimeout(ctx, 3*time.Second) + defer cancel() + + probeURL := fmt.Sprintf("%s/pypi/%s/json", baseURL, url.PathEscape(identifier)) + req, err := http.NewRequestWithContext(ctx, http.MethodHead, probeURL, nil) + if err != nil { + return pypiPackageUnknown + } + req.Header.Set("User-Agent", userAgent) + + resp, err := client.Do(req) + if err != nil { + return pypiPackageTransient + } + defer resp.Body.Close() + + switch { + case resp.StatusCode == http.StatusOK: + return pypiPackageExists + case resp.StatusCode == http.StatusNotFound: + return pypiPackageMissing + case resp.StatusCode == http.StatusTooManyRequests, resp.StatusCode >= 500 && resp.StatusCode < 600: + return pypiPackageTransient + default: + return pypiPackageUnknown + } +} diff --git a/internal/validators/registries/pypi_test.go b/internal/validators/registries/pypi_test.go index aadb05f..e240082 100644 --- a/internal/validators/registries/pypi_test.go +++ b/internal/validators/registries/pypi_test.go @@ -2,13 +2,174 @@ package registries_test import ( "context" + "fmt" + "io" + "net/http" + "net/http/httptest" + "strings" "testing" + "time" "github.com/modelcontextprotocol/registry/internal/validators/registries" "github.com/modelcontextprotocol/registry/pkg/model" "github.com/stretchr/testify/assert" ) +// newPyPIMock stands in for pypi.org: it routes the version fetch and package +// probe by path shape and returns the given statuses (versionBody is used on 200). +func newPyPIMock(versionStatus int, versionBody string, packageStatus int) *httptest.Server { + return httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + // Route on the escaped path so an identifier containing an encoded + // separator is not silently re-split into extra segments. + parts := strings.Split(strings.Trim(r.URL.EscapedPath(), "/"), "/") + // Pin the method per endpoint (GET fetch, HEAD probe) so a method + // regression in the validator surfaces as a 405 instead of passing. + switch len(parts) { + case 4: // /pypi/{name}/{version}/json + if r.Method != http.MethodGet { + w.WriteHeader(http.StatusMethodNotAllowed) + return + } + if versionStatus != http.StatusOK { + w.WriteHeader(versionStatus) + return + } + w.Header().Set("Content-Type", "application/json") + _, _ = io.WriteString(w, versionBody) + case 3: // /pypi/{name}/json (package-existence probe) + if r.Method != http.MethodHead { + w.WriteHeader(http.StatusMethodNotAllowed) + return + } + w.WriteHeader(packageStatus) + default: + w.WriteHeader(http.StatusInternalServerError) + } + })) +} + +// TestValidatePyPI_VersionNotYetVisible is the #553 regression: version 404s while +// the package exists, so the error must report a missing version, not a missing package. +func TestValidatePyPI_VersionNotYetVisible(t *testing.T) { + ctx := context.Background() + mock := newPyPIMock(http.StatusNotFound, "", http.StatusOK) + defer mock.Close() + + pkg := model.Package{RegistryType: model.RegistryTypePyPI, RegistryBaseURL: mock.URL, Identifier: "demo-pkg", Version: "9.9.9"} + err := registries.ValidatePyPIPackage(ctx, pkg, "io.github.test/demo") + assert.Error(t, err) + assert.Contains(t, err.Error(), "exists, but version '9.9.9'", "package-exists/version-missing must be distinguished from package-missing") +} + +// TestValidatePyPI_PackageMissing: both the version and the package endpoints 404, +// so the package genuinely does not exist and "not found" is correct. +func TestValidatePyPI_PackageMissing(t *testing.T) { + ctx := context.Background() + mock := newPyPIMock(http.StatusNotFound, "", http.StatusNotFound) + defer mock.Close() + + pkg := model.Package{RegistryType: model.RegistryTypePyPI, RegistryBaseURL: mock.URL, Identifier: "demo-pkg", Version: "1.0.0"} + err := registries.ValidatePyPIPackage(ctx, pkg, "io.github.test/demo") + assert.Error(t, err) + assert.Contains(t, err.Error(), "not found") + assert.NotContains(t, err.Error(), "exists, but version", "a genuinely missing package must not claim the version exists") +} + +// TestValidatePyPI_TransientUpstream: a 5xx on the version fetch is upstream +// availability, not "package missing", and must be reported as retryable. +func TestValidatePyPI_TransientUpstream(t *testing.T) { + ctx := context.Background() + mock := newPyPIMock(http.StatusServiceUnavailable, "", http.StatusOK) + defer mock.Close() + + pkg := model.Package{RegistryType: model.RegistryTypePyPI, RegistryBaseURL: mock.URL, Identifier: "demo-pkg", Version: "1.0.0"} + err := registries.ValidatePyPIPackage(ctx, pkg, "io.github.test/demo") + assert.Error(t, err) + assert.Contains(t, err.Error(), "transient") + assert.NotContains(t, err.Error(), "not found", "transient upstream errors must not be reported as 'not found'") +} + +// TestValidatePyPI_VersionNotFoundProbeInconclusive: version 404 plus a transient +// probe (429) leaves existence undetermined, so the validator must not say "not found". +func TestValidatePyPI_VersionNotFoundProbeInconclusive(t *testing.T) { + ctx := context.Background() + mock := newPyPIMock(http.StatusNotFound, "", http.StatusTooManyRequests) + defer mock.Close() + + pkg := model.Package{RegistryType: model.RegistryTypePyPI, RegistryBaseURL: mock.URL, Identifier: "demo-pkg", Version: "1.0.0"} + err := registries.ValidatePyPIPackage(ctx, pkg, "io.github.test/demo") + assert.Error(t, err) + assert.Contains(t, err.Error(), "transient") + assert.NotContains(t, err.Error(), "not found", "an inconclusive probe must not assert the package is missing") +} + +// TestValidatePyPI_ProbeDeadlineBounded: a hung probe must be cut off by the +// probe's own short deadline instead of riding out the client's full 10s +// timeout, and the cutoff must read as inconclusive rather than "not found". +func TestValidatePyPI_ProbeDeadlineBounded(t *testing.T) { + ctx := context.Background() + mock := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + parts := strings.Split(strings.Trim(r.URL.EscapedPath(), "/"), "/") + if len(parts) == 4 { // version fetch + w.WriteHeader(http.StatusNotFound) + return + } + // Package probe: hang until the client gives up. + <-r.Context().Done() + })) + defer mock.Close() + + pkg := model.Package{RegistryType: model.RegistryTypePyPI, RegistryBaseURL: mock.URL, Identifier: "demo-pkg", Version: "1.0.0"} + start := time.Now() + err := registries.ValidatePyPIPackage(ctx, pkg, "io.github.test/demo") + elapsed := time.Since(start) + assert.Error(t, err) + assert.Contains(t, err.Error(), "transient", "a probe cut off by its deadline is inconclusive, not 'not found'") + assert.Less(t, elapsed, 8*time.Second, "a hung probe must be bounded by the probe deadline, not the client timeout") +} + +// TestValidatePyPI_VersionEndpointRateLimited: a 429 on the version fetch is reported +// as rate-limited/transient. +func TestValidatePyPI_VersionEndpointRateLimited(t *testing.T) { + ctx := context.Background() + mock := newPyPIMock(http.StatusTooManyRequests, "", http.StatusOK) + defer mock.Close() + + pkg := model.Package{RegistryType: model.RegistryTypePyPI, RegistryBaseURL: mock.URL, Identifier: "demo-pkg", Version: "1.0.0"} + err := registries.ValidatePyPIPackage(ctx, pkg, "io.github.test/demo") + assert.Error(t, err) + assert.Contains(t, err.Error(), "rate-limited") + assert.NotContains(t, err.Error(), "not found") +} + +// TestValidatePyPI_VersionNotFoundProbeUnclassified: the version 404s and the probe +// returns an unclassifiable status, so the validator falls back to a plain +// version-not-found message without claiming the package is present or absent. +func TestValidatePyPI_VersionNotFoundProbeUnclassified(t *testing.T) { + ctx := context.Background() + mock := newPyPIMock(http.StatusNotFound, "", http.StatusTeapot) + defer mock.Close() + + pkg := model.Package{RegistryType: model.RegistryTypePyPI, RegistryBaseURL: mock.URL, Identifier: "demo-pkg", Version: "1.0.0"} + err := registries.ValidatePyPIPackage(ctx, pkg, "io.github.test/demo") + assert.Error(t, err) + assert.Contains(t, err.Error(), "version '1.0.0' not found") + assert.NotContains(t, err.Error(), "exists, but version") +} + +// TestValidatePyPI_PositivePathMock: a version README carrying the exact mcp-name token validates. +func TestValidatePyPI_PositivePathMock(t *testing.T) { + ctx := context.Background() + const serverName = "io.github.test/demo" + body := fmt.Sprintf(`{"info":{"description":"# Demo\n\nmcp-name: %s\n"}}`, serverName) + mock := newPyPIMock(http.StatusOK, body, http.StatusOK) + defer mock.Close() + + pkg := model.Package{RegistryType: model.RegistryTypePyPI, RegistryBaseURL: mock.URL, Identifier: "demo-pkg", Version: "1.0.0"} + err := registries.ValidatePyPIPackage(ctx, pkg, serverName) + assert.NoError(t, err, "a version README containing the exact mcp-name token should validate") +} + func TestValidatePyPI_RealPackages(t *testing.T) { ctx := context.Background() @@ -79,6 +240,12 @@ func TestValidatePyPI_RealPackages(t *testing.T) { err := registries.ValidatePyPI(ctx, pkg, tt.serverName) + // A live 429/5xx from the registry is inconclusive, not a failure + // of the case under test. + if err != nil && strings.Contains(err.Error(), "retry later") { + t.Skipf("transient registry response: %v", err) + } + if tt.expectError { assert.Error(t, err) assert.Contains(t, err.Error(), tt.errorMessage) From 29e32c39dcb5e0e2b43974089d959fcc4794eb6d Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Mon, 13 Jul 2026 12:03:10 +0300 Subject: [PATCH 263/313] deploy: update prod to v1.8.0 (#1443) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Promotes production to the [`v1.8.0`](https://github.com/modelcontextprotocol/registry/releases/tag/v1.8.0) release. - `deploy/Pulumi.gcpProd.yaml` → `imageTag: 1.8.0` (one line). - The release build for `v1.8.0` completed successfully, so the image is present in ghcr. - **Merging this triggers `deploy-production.yml`** (it's path-filtered to `deploy/Pulumi.gcpProd.yaml`); the PR itself doesn't deploy. ### Notable behavior changes in v1.8.0 - **Org-namespace publishing now requires org Owner** (via GitHub login / PAT). Member-level publishers lose org publish — intended tightening. - Stricter validation may reject some previously-accepted package metadata / names (#1310, #1331, #1411). - New: cargo (crates.io) package registry support (#1207). ### After merge - Confirm prod `/v0/version` reports `1.8.0` before treating the rollout as done. Co-authored-by: Claude Opus 4.8 --- deploy/Pulumi.gcpProd.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/deploy/Pulumi.gcpProd.yaml b/deploy/Pulumi.gcpProd.yaml index f222920..d4eaaee 100644 --- a/deploy/Pulumi.gcpProd.yaml +++ b/deploy/Pulumi.gcpProd.yaml @@ -1,7 +1,7 @@ config: mcp-registry:environment: prod mcp-registry:provider: gcp - mcp-registry:imageTag: 1.7.9 # Set specific image tag for production (change this to deploy different versions) + mcp-registry:imageTag: 1.8.0 # Set specific image tag for production (change this to deploy different versions) gcp:project: mcp-registry-prod mcp-registry:githubClientId: Iv23liUydBbI7Z2Q9bOZ mcp-registry:githubClientSecret: From 2271214bd8ef620ca16fd59cfe0caacd432bad59 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 27 Jul 2026 05:53:48 -0400 Subject: [PATCH 264/313] build(deps): bump cloud.google.com/go/kms from 1.31.0 to 1.32.0 (#1447) Bumps [cloud.google.com/go/kms](https://github.com/googleapis/google-cloud-go) from 1.31.0 to 1.32.0.
    Release notes

    Sourced from cloud.google.com/go/kms's releases.

    kms: v1.32.0

    1.32.0 (2026-07-13)

    Features

    retail: v1.32.0

    1.32.0 (2026-07-13)

    Features

    Changelog

    Sourced from cloud.google.com/go/kms's changelog.

    1.32.0 (2024-08-08)

    Features

    • documentai: A new field gen_ai_model_info is added to message .google.cloud.documentai.v1.ProcessorVersion (649c075)
    • documentai: A new field imageless_mode is added to message .google.cloud.documentai.v1.ProcessRequest (649c075)

    Bug Fixes

    • documentai: Update google.golang.org/api to v0.191.0 (5b32644)
    Commits
    • 06584bf chore: librarian release pull request: 20260413T221959Z (#14427)
    • 74eab64 feat: enable open telemetry attrs (#14426)
    • ec20708 fix(pubsub/v2): fix span linking and add missing attributes (#14326)
    • 5b553fe chore(all): add telemetry features to GAPIC libraries (#14380)
    • f4b10ee chore: librarian release pull request: 20260413T041034Z (#14421)
    • dc245af feat(storage): add client feature tracking support (#14320)
    • cfdd7ba chore(.github/CODEOWNERS): Add AION SDK as code owners for the auth library (...
    • e2d578c test(datastore): skip flaky tests due to datastore contention (#14416)
    • 56e1a62 chore: librarian release pull request: 20260409T222456Z (#14413)
    • 5ca653a chore: regenerate libraries using protobuf 31, and update generation check wo...
    • Additional commits viewable in compare view

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=cloud.google.com/go/kms&package-manager=go_modules&previous-version=1.31.0&new-version=1.32.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 34 ++++++++++++------------- go.sum | 79 +++++++++++++++++++++++++++++----------------------------- 2 files changed, 57 insertions(+), 56 deletions(-) diff --git a/go.mod b/go.mod index 1a76501..deca776 100644 --- a/go.mod +++ b/go.mod @@ -3,7 +3,7 @@ module github.com/modelcontextprotocol/registry go 1.26 require ( - cloud.google.com/go/kms v1.31.0 + cloud.google.com/go/kms v1.32.0 github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.0 github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.5.0 github.com/caarlos0/env/v11 v11.4.1 @@ -28,18 +28,18 @@ require ( require ( cloud.google.com/go v0.123.0 // indirect - cloud.google.com/go/auth v0.18.2 // indirect + cloud.google.com/go/auth v0.20.0 // indirect cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect cloud.google.com/go/compute/metadata v0.9.0 // indirect - cloud.google.com/go/iam v1.7.0 // indirect - cloud.google.com/go/longrunning v0.9.0 // indirect + cloud.google.com/go/iam v1.11.0 // indirect + cloud.google.com/go/longrunning v1.2.0 // indirect github.com/Azure/azure-sdk-for-go/sdk/azcore v1.22.0 // indirect github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0 // indirect github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0 // indirect github.com/AzureAD/microsoft-authentication-library-for-go v1.7.2 // indirect github.com/beorn7/perks v1.0.1 // indirect github.com/cespare/xxhash/v2 v2.3.0 // indirect - github.com/davecgh/go-spew v1.1.1 // indirect + github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect github.com/docker/cli v29.5.3+incompatible // indirect github.com/docker/docker-credential-helpers v0.9.3 // indirect github.com/felixge/httpsnoop v1.0.4 // indirect @@ -48,8 +48,8 @@ require ( github.com/go-logr/stdr v1.2.2 // indirect github.com/google/s2a-go v0.1.9 // indirect github.com/google/uuid v1.6.0 // indirect - github.com/googleapis/enterprise-certificate-proxy v0.3.14 // indirect - github.com/googleapis/gax-go/v2 v2.21.0 // indirect + github.com/googleapis/enterprise-certificate-proxy v0.3.17 // indirect + github.com/googleapis/gax-go/v2 v2.23.0 // indirect github.com/jackc/pgpassfile v1.0.0 // indirect github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect github.com/jackc/puddle/v2 v2.2.2 // indirect @@ -59,29 +59,29 @@ require ( github.com/opencontainers/go-digest v1.0.0 // indirect github.com/opencontainers/image-spec v1.1.1 // indirect github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect - github.com/pmezard/go-difflib v1.0.0 // indirect + github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect github.com/prometheus/client_model v0.6.2 // indirect github.com/prometheus/common v0.67.5 // indirect github.com/prometheus/otlptranslator v1.0.0 // indirect github.com/prometheus/procfs v0.20.1 // indirect github.com/sirupsen/logrus v1.9.4 // indirect go.opentelemetry.io/auto/sdk v1.2.1 // indirect - go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 // indirect - go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect + go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0 // indirect + go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 // indirect go.opentelemetry.io/otel/trace v1.44.0 // indirect go.yaml.in/yaml/v2 v2.4.4 // indirect - golang.org/x/crypto v0.52.0 // indirect - golang.org/x/net v0.55.0 // indirect + golang.org/x/crypto v0.53.0 // indirect + golang.org/x/net v0.56.0 // indirect golang.org/x/oauth2 v0.36.0 // indirect golang.org/x/sync v0.21.0 // indirect golang.org/x/sys v0.46.0 // indirect - golang.org/x/text v0.37.0 // indirect + golang.org/x/text v0.38.0 // indirect golang.org/x/time v0.15.0 // indirect - google.golang.org/api v0.274.0 // indirect + google.golang.org/api v0.287.1 // indirect google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 // indirect - google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 // indirect - google.golang.org/genproto/googleapis/rpc v0.0.0-20260401001100-f93e5f3e9f0f // indirect - google.golang.org/grpc v1.80.0 // indirect + google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7 // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20260630182238-925bb5da69e7 // indirect + google.golang.org/grpc v1.82.0 // indirect google.golang.org/protobuf v1.36.11 // indirect gotest.tools/v3 v3.5.2 // indirect ) diff --git a/go.sum b/go.sum index da5fd16..82ba632 100644 --- a/go.sum +++ b/go.sum @@ -1,17 +1,17 @@ cloud.google.com/go v0.123.0 h1:2NAUJwPR47q+E35uaJeYoNhuNEM9kM8SjgRgdeOJUSE= cloud.google.com/go v0.123.0/go.mod h1:xBoMV08QcqUGuPW65Qfm1o9Y4zKZBpGS+7bImXLTAZU= -cloud.google.com/go/auth v0.18.2 h1:+Nbt5Ev0xEqxlNjd6c+yYUeosQ5TtEUaNcN/3FozlaM= -cloud.google.com/go/auth v0.18.2/go.mod h1:xD+oY7gcahcu7G2SG2DsBerfFxgPAJz17zz2joOFF3M= +cloud.google.com/go/auth v0.20.0 h1:kXTssoVb4azsVDoUiF8KvxAqrsQcQtB53DcSgta74CA= +cloud.google.com/go/auth v0.20.0/go.mod h1:942/yi/itH1SsmpyrbnTMDgGfdy2BUqIKyd0cyYLc5Q= cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc= cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c= cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs= cloud.google.com/go/compute/metadata v0.9.0/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10= -cloud.google.com/go/iam v1.7.0 h1:JD3zh0C6LHl16aCn5Akff0+GELdp1+4hmh6ndoFLl8U= -cloud.google.com/go/iam v1.7.0/go.mod h1:tetWZW1PD/m6vcuY2Zj/aU0eCHNPuxedbnbRTyKXvdY= -cloud.google.com/go/kms v1.31.0 h1:LS8N92OxFDgOLg5NCo3OmbvjtQAIVT5gUHVLKIDHaFE= -cloud.google.com/go/kms v1.31.0/go.mod h1:YIyXZym11R5uovJJt4oN5eUL3oPmirF3yKeIh6QAf4U= -cloud.google.com/go/longrunning v0.9.0 h1:0EzbDEGsAvOZNbqXopgniY0w0a1phvu5IdUFq8grmqY= -cloud.google.com/go/longrunning v0.9.0/go.mod h1:pkTz846W7bF4o2SzdWJ40Hu0Re+UoNT6Q5t+igIcb8E= +cloud.google.com/go/iam v1.11.0 h1:KieQ9Pb+LLPak1O3Rv3GgCxhnmkYf7Xyh0P5HfF1jFM= +cloud.google.com/go/iam v1.11.0/go.mod h1:KP+nKGugNJW4LcLx1uEZcq1ok5sQHFaQehQNl4QDgV4= +cloud.google.com/go/kms v1.32.0 h1:s+rEluaaZKhLVjrIWG7uNBsnWbiitElzNzFGyp6+nIg= +cloud.google.com/go/kms v1.32.0/go.mod h1:CSGvW6GnMQbY+1nOHcIzhMtHSbExXlOmCKjWtYVjcpA= +cloud.google.com/go/longrunning v1.2.0 h1:WjYH3YHBGCxGJP9M4dWGHBfXr/cFIjMkNgWcJj7/iMM= +cloud.google.com/go/longrunning v1.2.0/go.mod h1:5KMQALFGOCtFoi2xSOA1u3H7WKlhmckgiyFw7+LGQp0= github.com/Azure/azure-sdk-for-go/sdk/azcore v1.22.0 h1:aokoqcHvaGjiM3VpjKDfMMnF/8epJ+Q1HLJ7CudztqE= github.com/Azure/azure-sdk-for-go/sdk/azcore v1.22.0/go.mod h1:/WYEx9pcM9Y+Dd/APJaNlSvVSvzl54rrMdZT5+Oi2LM= github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.0 h1:CU4+EJeJi3TKYWEcYuSdWsjzw0nVsK/H0MSQOiPcymU= @@ -34,24 +34,24 @@ github.com/caarlos0/env/v11 v11.4.1 h1:fYwH0sWEsBSMPG7t4e/PEfTFzrWrpjyygXyUnWiSw github.com/caarlos0/env/v11 v11.4.1/go.mod h1:qupehSf/Y0TUTsxKywqRt/vJjN5nz6vauiYEUUr8P4U= github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs= github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= -github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5 h1:6xNmx7iTtyBRev0+D/Tv1FZd4SCg8axKApyNyRsAt/w= -github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5/go.mod h1:KdCmV+x/BuvyMxRnYBlmVaq4OLiKW6iRQfvC62cvdkI= +github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2 h1:aBangftG7EVZoUb69Os8IaYg++6uMOdKK83QtkkvJik= +github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2/go.mod h1:qwXFYgsP6T7XnJtbKlf1HP8AjxZZyzxMmc+Lq5GjlU4= github.com/coreos/go-oidc/v3 v3.20.0 h1:EtE0WIBHk03N+DqGkY4+UONzzZHk7amKt6IyNd7OsZE= github.com/coreos/go-oidc/v3 v3.20.0/go.mod h1:DYCf24+ncYi+XkIH97GY1+dqoRlbaSI26KVTCI9SrY4= github.com/danielgtaylor/huma/v2 v2.38.0 h1:fb0WZCatnaiHLphMQDDWDjygNxfMkX/ENma3QsRl7vY= github.com/danielgtaylor/huma/v2 v2.38.0/go.mod h1:k9hwjlgWFt1t2jsmQGlsgXAG2FBTZa4kkjV581qAtfo= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= -github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= -github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= +github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM= +github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/docker/cli v29.5.3+incompatible h1:nbEFfz774vBwQ5KRYv7c/AghjReqnGISvrRhzjV0evs= github.com/docker/cli v29.5.3+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= github.com/docker/docker-credential-helpers v0.9.3 h1:gAm/VtF9wgqJMoxzT3Gj5p4AqIjCBS4wrsOh9yRqcz8= github.com/docker/docker-credential-helpers v0.9.3/go.mod h1:x+4Gbw9aGmChi3qTLZj8Dfn0TD20M/fuWy0E5+WDeCo= github.com/envoyproxy/go-control-plane v0.14.0 h1:hbG2kr4RuFj222B6+7T83thSPqLjwBIfQawTkC++2HA= -github.com/envoyproxy/go-control-plane/envoy v1.36.0 h1:yg/JjO5E7ubRyKX3m07GF3reDNEnfOboJ0QySbH736g= -github.com/envoyproxy/go-control-plane/envoy v1.36.0/go.mod h1:ty89S1YCCVruQAm9OtKeEkQLTb+Lkz0k8v9W0Oxsv98= -github.com/envoyproxy/protoc-gen-validate v1.3.0 h1:TvGH1wof4H33rezVKWSpqKz5NXWg5VPuZ0uONDT6eb4= -github.com/envoyproxy/protoc-gen-validate v1.3.0/go.mod h1:HvYl7zwPa5mffgyeTUHA9zHIH36nmrm7oCbo4YKoSWA= +github.com/envoyproxy/go-control-plane/envoy v1.37.0 h1:u3riX6BoYRfF4Dr7dwSOroNfdSbEPe9Yyl09/B6wBrQ= +github.com/envoyproxy/go-control-plane/envoy v1.37.0/go.mod h1:DReE9MMrmecPy+YvQOAOHNYMALuowAnbjjEMkkWOi6A= +github.com/envoyproxy/protoc-gen-validate v1.3.3 h1:MVQghNeW+LZcmXe7SY1V36Z+WFMDjpqGAGacLe2T0ds= +github.com/envoyproxy/protoc-gen-validate v1.3.3/go.mod h1:TsndJ/ngyIdQRhMcVVGDDHINPLWB7C82oDArY51KfB0= github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg= github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U= github.com/fxamacker/cbor/v2 v2.9.1 h1:2rWm8B193Ll4VdjsJY28jxs70IdDsHRWgQYAI80+rMQ= @@ -75,10 +75,10 @@ github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0= github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= -github.com/googleapis/enterprise-certificate-proxy v0.3.14 h1:yh8ncqsbUY4shRD5dA6RlzjJaT4hi3kII+zYw8wmLb8= -github.com/googleapis/enterprise-certificate-proxy v0.3.14/go.mod h1:vqVt9yG9480NtzREnTlmGSBmFrA+bzb0yl0TxoBQXOg= -github.com/googleapis/gax-go/v2 v2.21.0 h1:h45NjjzEO3faG9Lg/cFrBh2PgegVVgzqKzuZl/wMbiI= -github.com/googleapis/gax-go/v2 v2.21.0/go.mod h1:But/NJU6TnZsrLai/xBAQLLz+Hc7fHZJt/hsCz3Fih4= +github.com/googleapis/enterprise-certificate-proxy v0.3.17 h1:73NfMHdiqo9JFU9+7a5ExpVa10/R29pXfZIaW559nrg= +github.com/googleapis/enterprise-certificate-proxy v0.3.17/go.mod h1:rSEsBUemEBZEexP2y6jPp16LUmUbjmSbcPMQizR0o4k= +github.com/googleapis/gax-go/v2 v2.23.0 h1:Tchl7qkvE7Ip3y+ztvNufYFvkfqTe7NfLTYGIdJRLuE= +github.com/googleapis/gax-go/v2 v2.23.0/go.mod h1:rBQKOVJCdb8IFEzg+FCwlt1LP/xMDGuqUXhUG+XMXEg= github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM= github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg= github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo= @@ -107,8 +107,9 @@ github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmd github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c/go.mod h1:7rwL4CYBLnjLxUqIJNnCWiEdr3bn6IUYi15bNlnbCCU= github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 h1:GFCKgmp0tecUJ0sJuv4pzYCqS9+RGSn52M3FUwPs+uo= github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10/go.mod h1:t/avpk3KcrXxUnYOhZhMXJlSEyie6gQbtLq5NM3loB8= -github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= +github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U= +github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o= github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg= github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk= @@ -136,10 +137,10 @@ github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM= github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y= -go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 h1:q4XOmH/0opmeuJtPsbFNivyl7bCt7yRBbeEm2sC/XtQ= -go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0/go.mod h1:snMWehoOh2wsEwnvvwtDyFCxVeDAODenXHtn5vzrKjo= -go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 h1:F7Jx+6hwnZ41NSFTO5q4LYDtJRXBf2PD0rNBkeB/lus= -go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0/go.mod h1:UHB22Z8QsdRDrnAtX4PntOl36ajSxcdUMt1sF7Y6E7Q= +go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0 h1:yI1/OhfEPy7J9eoa6Sj051C7n5dvpj0QX8g4sRchg04= +go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0/go.mod h1:NoUCKYWK+3ecatC4HjkRktREheMeEtrXoQxrqYFeHSc= +go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 h1:OyrsyzuttWTSur2qN/Lm0m2a8yqyIjUVBZcxFPuXq2o= +go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0/go.mod h1:C2NGBr+kAB4bk3xtMXfZ94gqFDtg/GkI7e9zqGh5Beg= go.opentelemetry.io/contrib/instrumentation/runtime v0.69.0 h1:MtkMsuRo3zEXTTMALfyrszwCDZTkB6wolyPjbwFAdq0= go.opentelemetry.io/contrib/instrumentation/runtime v0.69.0/go.mod h1:FYTxnpsm+UPD0erZNq20GvnM8T2YQHiHtT2vokdpoac= go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU= @@ -160,12 +161,12 @@ go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE= go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ= go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ= -golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988= -golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc= +golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto= +golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio= golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk= golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40= -golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8= -golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww= +golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o= +golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec= golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM= @@ -173,22 +174,22 @@ golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw= golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= -golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc= -golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38= +golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE= +golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4= golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U= golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno= gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4= gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E= -google.golang.org/api v0.274.0 h1:aYhycS5QQCwxHLwfEHRRLf9yNsfvp1JadKKWBE54RFA= -google.golang.org/api v0.274.0/go.mod h1:JbAt7mF+XVmWu6xNP8/+CTiGH30ofmCmk9nM8d8fHew= +google.golang.org/api v0.287.1 h1:LiyJx32VU3cwQfLchn/513qKhc25hq0pEANYJoWNnnI= +google.golang.org/api v0.287.1/go.mod h1:lM2kYRzYUCBY91P9h6VF1PYmvhxii3O5hji37qRvIcY= google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 h1:XzmzkmB14QhVhgnawEVsOn6OFsnpyxNPRY9QV01dNB0= google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7/go.mod h1:L43LFes82YgSonw6iTXTxXUX1OlULt4AQtkik4ULL/I= -google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 h1:VPWxll4HlMw1Vs/qXtN7BvhZqsS9cdAittCNvVENElA= -google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9/go.mod h1:7QBABkRtR8z+TEnmXTqIqwJLlzrZKVfAUm7tY3yGv0M= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260401001100-f93e5f3e9f0f h1:Rka45QInERYknkHYfJEPBQaoobXl+YpxTMjAKgWUq2A= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260401001100-f93e5f3e9f0f/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= -google.golang.org/grpc v1.80.0 h1:Xr6m2WmWZLETvUNvIUmeD5OAagMw3FiKmMlTdViWsHM= -google.golang.org/grpc v1.80.0/go.mod h1:ho/dLnxwi3EDJA4Zghp7k2Ec1+c2jqup0bFkw07bwF4= +google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7 h1:jQ9p21COKWjP3VwuFrNRiiOTMh3mPpN45R7SLrH/HUU= +google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7/go.mod h1:KqHwBx2upmfa1XSi1WuRvC+2VGCLtooKkfmyvRbUmqA= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260630182238-925bb5da69e7 h1:eM/YSd5bBFagF51o1E745Ta7RwzpW0h+z+QDNZOgmQ8= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260630182238-925bb5da69e7/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= +google.golang.org/grpc v1.82.0 h1:vguDnZUPjE26w09A63VoxZPnvPjB5Riyc0mkXPFmAIU= +google.golang.org/grpc v1.82.0/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA= google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE= google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= From 5cbf3320e8b85e42185196f7a5ad687ce216b710 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 27 Jul 2026 05:54:07 -0400 Subject: [PATCH 265/313] build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.251.0 to 3.253.0 in /deploy (#1448) Bumps [github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from 3.251.0 to 3.253.0.
    Release notes

    Sourced from github.com/pulumi/pulumi/sdk/v3's releases.

    v3.253.0

    3.253.0 (2026-07-14)

    Features

    • [auto/go] Support --import-pending-creates for refresh command in Go Automation API for preview refresh and refresh operations #23833

    Bug Fixes

    • [sdk] Precompose filenames to NFC on macOS when matching ignore patterns during archive creation, mirroring git's core.precomposeunicode so composed patterns match decomposed filenames #23566
    • [cli] Respect the -v log level again so that without -v only warnings and errors are written to stderr #23910
    • [codegen] Correctly generate provider resources declared inside PCL components for Node.js, Python and Go #23904

    Improvements

    • [cli] Add a --version flag to the pulumi command that prints the version, same as pulumi version #23898
    • [cli] Align env commands with the CLI naming guidelines, making list, remove and move the canonical names with ls, rm, delete and mv kept as aliases #23901

    v3.252.0

    3.252.0 (2026-07-13)

    Features

    • [auto] Add import to the generated automation APIs for NodeJS, Python and Go #23876
    • [cli] Improve the error message when using Pulumi ESC with a DIY backend to suggest logging into Pulumi Cloud #23811
    • [cli] Show command name for cli commands when running any command that lists logs #23889
    • [cli/display] Render strings containing non-UTF8 bytes as b"" in diffs and JSON output #23870
    • [cli/env] Add a --reason flag to pulumi env open-request to explain the request to approvers #23802
    • [cli/state] Improve the error message when a resource URN is not found in the state for pulumi state commands, suggesting close-matching URNs and how to list the URNs in the stack #23812
    • [pcl] Allow binding hooks to a resource's onError option #23838
    • [sdk/nodejs] Add a production runtime option for Node.js projects. When set to true in Pulumi.yaml, pulumi install skips devDependencies (npm --production, pnpm --production, yarn --production). #23849

    Bug Fixes

    • [cli] Exit with a non-zero code when a command group such as pulumi env is given an unknown subcommand or no subcommand at all #23814
    • [cli] Fix a panic when displaying a stack-level policy violation #23692
    • [cli] Make reading non-secret stack outputs and running pulumi about no longer require the passphrase for passphrase-encrypted stacks #23820
    • [cli] Avoid pulumi logs <command> showing the log for the currently running command #23887
    • [cli/do] Fix calling delete on PF resources that need read called first #23837
    • [cli/env] Submit the change request created by pulumi env open-request so it is pending approval instead of being left as an unsubmitted draft #23802
    • [cli/neo] Fix the initial prompt sometimes rendering above the welcome banner in pulumi neo #23831
    • [engine] Fix importing a resource whose import identifier differs from its canonical ID causes the resource to be deleted on a subsequent update #23834
    • [programgen] Deduplicate identical apply arguments to avoid unnecessary Promise.all/pulumi.all/Output.All in generated code #22293
    • [sdk] Failed resource registrations will return faulted outputs, not unknown outputs #23844
    • [sdk/nodejs] Fix empty node_modules folders in serialized function archives when using pnpm or symlinked workspace packages #23866

    Miscellaneous

    • [sdk/nodejs] Report the TypeScript version in pulumi about #23850
    • [sdk/nodejs] Update OpenTelemetry dependencies #23855
    Changelog

    Sourced from github.com/pulumi/pulumi/sdk/v3's changelog.

    3.253.0 (2026-07-14)

    Features

    • [auto/go] Support --import-pending-creates for refresh command in Go Automation API for preview refresh and refresh operations #23833

    Bug Fixes

    • [sdk] Precompose filenames to NFC on macOS when matching ignore patterns during archive creation, mirroring git's core.precomposeunicode so composed patterns match decomposed filenames #23566
    • [cli] Respect the -v log level again so that without -v only warnings and errors are written to stderr #23910
    • [codegen] Correctly generate provider resources declared inside PCL components for Node.js, Python and Go #23904

    Improvements

    • [cli] Add a --version flag to the pulumi command that prints the version, same as pulumi version #23898
    • [cli] Align env commands with the CLI naming guidelines, making list, remove and move the canonical names with ls, rm, delete and mv kept as aliases #23901

    3.252.0 (2026-07-13)

    Features

    • [auto] Add import to the generated automation APIs for NodeJS, Python and Go #23876

    Bug Fixes

    • [cli] Exit with a non-zero code when a command group such as pulumi env is given an unknown subcommand or no subcommand at all #23814
    • [cli] Fix a panic when displaying a stack-level policy violation #23692
    • [cli] Make reading non-secret stack outputs and running pulumi about no longer require the passphrase for passphrase-encrypted stacks #23820
    • [cli] Avoid pulumi logs <command> showing the log for the currently running command #23887

    Improvements

    • [cli] Improve the error message when using Pulumi ESC with a DIY backend to suggest logging into Pulumi Cloud #23811
    • [cli] Show command name for cli commands when running any command that lists logs #23889
    • [cli/display] Render strings containing non-UTF8 bytes as b"" in diffs and JSON output #23870

    Bug Fixes

    • [cli/do] Fix calling delete on PF resources that need read called first #23837
    • [cli/env] Submit the change request created by pulumi env open-request so it is pending approval instead of being left as an unsubmitted draft #23802

    Improvements

    • [cli/env] Add a --reason flag to pulumi env open-request to explain the request to approvers #23802

    Bug Fixes

    • [cli/neo] Fix the initial prompt sometimes rendering above the welcome banner in pulumi neo #23831

    Improvements

    ... (truncated)

    Commits

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/pulumi/pulumi/sdk/v3&package-manager=go_modules&previous-version=3.251.0&new-version=3.253.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- deploy/go.mod | 2 +- deploy/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index 10d9778..89ebfa7 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -5,7 +5,7 @@ go 1.26 require ( github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.32.0 - github.com/pulumi/pulumi/sdk/v3 v3.251.0 + github.com/pulumi/pulumi/sdk/v3 v3.253.0 gopkg.in/yaml.v2 v2.4.0 ) diff --git a/deploy/go.sum b/deploy/go.sum index 86abe20..56b39c1 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -172,8 +172,8 @@ github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 h1:w6OnO3d4j5yVf2vpm8OzXFC/xHOEGqt+9 github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1/go.mod h1:UyZyv7hz4knpFx6/Sh+SkZe6hT6sJHtDvw9A0TbvEsk= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.32.0 h1:QwJzM3PseaorfASUlDXxsyntVGac7ZSYjqjxa038uoU= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.32.0/go.mod h1:MtckkCd6mzQQ3AYw+qjdt6ROfdBB3dr8dI/dE5/jxrM= -github.com/pulumi/pulumi/sdk/v3 v3.251.0 h1:H1D42Jra2jvnEij0M0dZcNGz3Q9DyANsvzQqalncsXU= -github.com/pulumi/pulumi/sdk/v3 v3.251.0/go.mod h1:ZXd0WRd89VLX2juP+HEXMZ+J2AFPfcJTXhdmmv9cMgY= +github.com/pulumi/pulumi/sdk/v3 v3.253.0 h1:YWdKcZMZC7DtYSqNBn1Yv2UXmFMcgx7RqG3lhhBNZyE= +github.com/pulumi/pulumi/sdk/v3 v3.253.0/go.mod h1:iTb2Yb9mn0kfUfMjwHgSuI5sxVUOcXRy0JcV7DLWsrc= github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ= github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88= github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ= From 8d3517519fd5cfa24228f794c33c4351c4e17d0a Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Mon, 27 Jul 2026 13:03:12 +0300 Subject: [PATCH 266/313] fix(deps): bump golang.org/x/text to v0.39.0 (GO-2026-5970) (#1481) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Problem The **Build, Lint, and Validate** CI job is failing on every open PR (#1480, #1474, #1449) and on `main`. The failing step is `govulncheck`: ``` Vulnerability #1: GO-2026-5970 Infinite loop on invalid input in golang.org/x/text Found in: golang.org/x/text@v0.38.0 Fixed in: golang.org/x/text@v0.39.0 ``` This is **not** caused by any of those PRs' changes — `govulncheck-action` fetches the live vulnerability database at runtime, so when GO-2026-5970 was published, every branch based on the current `main` started failing. The vulnerable symbol is reachable via: - `auth.DefaultHTTPKeyFetcher.FetchKey` → `http.Client.Do` - `database.NewTestDB` → `pgx.Connect` so the scan exits with code 3. ## Fix Bump the (indirect) `golang.org/x/text` dependency from `v0.38.0` to the fixed `v0.39.0` and `go mod tidy`. ## Verification - `govulncheck ./...` no longer reports GO-2026-5970 (confirmed locally). - `go build ./...` passes. ## Note The `deploy/` module pins `golang.org/x/text@v0.37.0`, which is also < v0.39.0. It is a separate module and is **not** scanned by this CI job (govulncheck runs `./...` in the root module only), so it does not block CI. Worth a follow-up bump for hygiene, but out of scope here. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.8 --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index deca776..20927f2 100644 --- a/go.mod +++ b/go.mod @@ -75,7 +75,7 @@ require ( golang.org/x/oauth2 v0.36.0 // indirect golang.org/x/sync v0.21.0 // indirect golang.org/x/sys v0.46.0 // indirect - golang.org/x/text v0.38.0 // indirect + golang.org/x/text v0.39.0 // indirect golang.org/x/time v0.15.0 // indirect google.golang.org/api v0.287.1 // indirect google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 // indirect diff --git a/go.sum b/go.sum index 82ba632..91d94ad 100644 --- a/go.sum +++ b/go.sum @@ -174,8 +174,8 @@ golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw= golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= -golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE= -golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4= +golang.org/x/text v0.39.0 h1:UbZz4pLOvn600D6Oh6GGEI6VAmndrEBLv8/6BEXzyus= +golang.org/x/text v0.39.0/go.mod h1:3UwRclnC2g0TU9x8PZiyfOajCd1zaUNHF9cvqcQZ+ZM= golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U= golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno= gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4= From b25ab9b93ad1af93d1b8f9b6d70722e5447406c0 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 27 Jul 2026 06:03:48 -0400 Subject: [PATCH 267/313] build(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.1 in /deploy (#1480) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.81.1 to 1.82.1.
    Release notes

    Sourced from google.golang.org/grpc's releases.

    Release 1.82.1

    Security

    • server: Stop reading from the connection when flooded by HTTP/2 frames. The default value for this limit is 100 frames, excluding DATA and HEADERS, and may be changed by setting environment variable GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT.
    • xds/rbac: Support Metadata and RequestedServerName permissions matcher fields. If present in a DENY rule, previously these would be ignored and fail-open.
    • xds/rbac: Fix panic when parsing unsupported fields in NotRule/NotId permissions.
    • xds/rbac: Support the deprecated source_ip principal identifier by treating it as equivalent to direct_remote_ip.

    Release 1.82.0

    Behavior Changes

    • server: Remove support for GRPC_GO_EXPERIMENTAL_DISABLE_STRICT_PATH_CHECKING environment varibale. Strict incoming RPC path validation (which has been the default since v1.79.3) can no longer be disabled. (#9112)
    • transport: Add environment variable to change the default max header list size from 16MB to 8KB. This may be enabled by setting GRPC_GO_EXPERIMENTAL_ENABLE_8KB_DEFAULT_HEADER_LIST_SIZE=true. This will be enabled by default in a subsequent release. (#9019)
    • balancer: Load Balancing policy registry is now case-sensitive. Set GRPC_GO_EXPERIMENTAL_CASE_SENSITIVE_BALANCER_REGISTRIES=false (and file an issue) to revert to case-insensitive behavior. (#9017)

    New Features

    • experimental/stats: Expose a new API, NewContextWithLabelCallback, to register a callback that is invoked when telemetry labels are added. (#8877)
    • client: Return a portion of the response body in the error message, when the client receives an unexpected non-gRPC HTTP response, to make debugging easier. (#8929)
    • server: Add environment variable GRPC_GO_SERVER_GOROUTINE_LABELS that controls setting runtime/pprof.Labels on goroutines spawned by the server. Set GRPC_GO_SERVER_GOROUTINE_LABELS=grpc.method=true to add the grpc.method label on goroutines spawned to handle incoming requests. (#9082)

    Bug Fixes

    • xds/server: Fix a memory leak of HTTP filter instances occurring when route configurations are updated in-place during a Route Discovery Service (RDS) update. (#9138)
    • grpc: In the deprecated gzip Compressor (used via the deprecated WithCompressor dial option), enforce the MaxRecvMsgSize limit on the decompressed message buffer, preventing excessive memory allocation from highly compressed payloads. (#9114)
    • stats/opentelemetry: Record retry attempts, grpc.previous-rpc-attempts, at the call level and not the attempt level. (#8923)
    • encoding: Ensure Close() is always called on readers returned from Compressor.Decompress if possible. (#9135)
    • channelz: Fix the LastMessageSentTimestamp and LastMessageReceivedTimestamp fields in SocketMetrics to ensure they contain correct timestamp values. (#9109)
    Commits

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google.golang.org/grpc&package-manager=go_modules&previous-version=1.81.1&new-version=1.82.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/modelcontextprotocol/registry/network/alerts).
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- deploy/go.mod | 2 +- deploy/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index 89ebfa7..21888ef 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -111,7 +111,7 @@ require ( golang.org/x/tools v0.44.0 // indirect google.golang.org/genproto/googleapis/api v0.0.0-20260522204824-7f3bc5b78da9 // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20260522204824-7f3bc5b78da9 // indirect - google.golang.org/grpc v1.81.1 // indirect + google.golang.org/grpc v1.82.1 // indirect google.golang.org/protobuf v1.36.11 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect lukechampine.com/frand v1.5.1 // indirect diff --git a/deploy/go.sum b/deploy/go.sum index 56b39c1..13e8e21 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -317,8 +317,8 @@ google.golang.org/genproto/googleapis/api v0.0.0-20260522204824-7f3bc5b78da9 h1: google.golang.org/genproto/googleapis/api v0.0.0-20260522204824-7f3bc5b78da9/go.mod h1:1dCETSCY2YKZNXQE3h4fun3TYwF5p8jejRKZgfWAgAY= google.golang.org/genproto/googleapis/rpc v0.0.0-20260522204824-7f3bc5b78da9 h1:UScUq4IhqF8ll85bMGS/l0D+iGzwQXpX5RBYQEwjahU= google.golang.org/genproto/googleapis/rpc v0.0.0-20260522204824-7f3bc5b78da9/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= -google.golang.org/grpc v1.81.1 h1:VnnIIZ88UzOOKLukQi+ImGz8O1Wdp8nAGGnvOfEIWQQ= -google.golang.org/grpc v1.81.1/go.mod h1:xGH9GfzOyMTGIOXBJmXt+BX/V0kcdQbdcuwQ/zNw42I= +google.golang.org/grpc v1.82.1 h1:NnAxzGRA0677vCa4BUkOAnO5+FfQqVl9iUXeD0IqcGE= +google.golang.org/grpc v1.82.1/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA= google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE= google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= From 0b5cc0f6a9ba326d7982b4f03ea7da83bf7817a2 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Mon, 27 Jul 2026 13:13:53 +0300 Subject: [PATCH 268/313] build(deps): consolidate open dependabot updates (#1482) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Consolidates the five open dependabot PRs into a single change so they can be reviewed and merged together. Each bump was reproduced against current `main` (`go get` + `go mod tidy` for Go modules; the exact SHA pins applied for the actions group), rather than merging the individual branches, to avoid stale `go.sum` conflicts. ## Root module (`go.mod`) | Dependency | From | To | Supersedes | |---|---|---|---| | `google.golang.org/grpc` | 1.82.0 | 1.82.1 | #1479 | | `github.com/prometheus/client_golang` | 1.23.2 | 1.24.1 | #1475 | | `github.com/danielgtaylor/huma/v2` | 2.38.0 | 2.39.0 | #1474 | ## Deploy module (`deploy/go.mod`) | Dependency | From | To | Supersedes | |---|---|---|---| | `github.com/pulumi/pulumi-kubernetes/sdk/v4` | 4.32.0 | 4.33.0 | #1449 | ## GitHub Actions (#1476) - `actions/setup-go` SHA bumped across `ci.yml`, `release.yml`, `deploy-production.yml`, `deploy-staging.yml` - `actions/download-artifact` v4 → v8.0.1 in `close-invalid-publish-prs.yml` `go mod tidy` re-resolved transitive dependencies in both modules accordingly. ## Verification - `go build ./...` passes (root + deploy) - `go vet ./...` passes - `govulncheck ./...` reports no `golang.org/x/text` finding (the GO-2026-5970 fix from #1481 is preserved; tidy pulled x/text to v0.40.0) ## Follow-up Once this merges, the five superseded PRs (#1479, #1475, #1474, #1449, #1476) can be closed. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.8 --- .github/workflows/ci.yml | 4 +- .../workflows/close-invalid-publish-prs.yml | 2 +- .github/workflows/deploy-production.yml | 2 +- .github/workflows/deploy-staging.yml | 4 +- .github/workflows/release.yml | 4 +- deploy/go.mod | 24 +++---- deploy/go.sum | 70 ++++++++++--------- go.mod | 23 +++--- go.sum | 50 ++++++------- 9 files changed, 93 insertions(+), 90 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 54a4942..87a36bd 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -19,7 +19,7 @@ jobs: uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 - name: Set up Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e with: go-version: 'stable' cache: true @@ -51,7 +51,7 @@ jobs: uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 - name: Set up Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e with: go-version: 'stable' cache: true diff --git a/.github/workflows/close-invalid-publish-prs.yml b/.github/workflows/close-invalid-publish-prs.yml index 4ef84b9..934421b 100644 --- a/.github/workflows/close-invalid-publish-prs.yml +++ b/.github/workflows/close-invalid-publish-prs.yml @@ -70,7 +70,7 @@ jobs: - name: Download flagged PR number if: steps.check.outputs.found == 'true' - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: flagged-pr run-id: ${{ github.event.workflow_run.id }} diff --git a/.github/workflows/deploy-production.yml b/.github/workflows/deploy-production.yml index 443ec9a..bd21054 100644 --- a/.github/workflows/deploy-production.yml +++ b/.github/workflows/deploy-production.yml @@ -26,7 +26,7 @@ jobs: uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 - name: Setup Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e with: go-version: 'stable' cache: true diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml index 7093f4d..31d6408 100644 --- a/.github/workflows/deploy-staging.yml +++ b/.github/workflows/deploy-staging.yml @@ -25,7 +25,7 @@ jobs: uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 - name: Set up Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e with: go-version: 'stable' cache: true @@ -73,7 +73,7 @@ jobs: uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 - name: Setup Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e with: go-version: 'stable' cache: true diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 2e2df6a..427d219 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -19,7 +19,7 @@ jobs: fetch-depth: 0 - name: Set up Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e with: go-version: 'stable' cache: true @@ -48,7 +48,7 @@ jobs: uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 - name: Set up Go - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 + uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e with: go-version: 'stable' cache: true diff --git a/deploy/go.mod b/deploy/go.mod index 21888ef..85a2e7d 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -4,7 +4,7 @@ go 1.26 require ( github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 - github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.32.0 + github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.33.0 github.com/pulumi/pulumi/sdk/v3 v3.253.0 gopkg.in/yaml.v2 v2.4.0 ) @@ -56,7 +56,7 @@ require ( github.com/lucasb-eyer/go-colorful v1.4.0 // indirect github.com/mattn/go-isatty v0.0.22 // indirect github.com/mattn/go-localereader v0.0.1 // indirect - github.com/mattn/go-runewidth v0.0.23 // indirect + github.com/mattn/go-runewidth v0.0.24 // indirect github.com/mitchellh/go-ps v1.0.0 // indirect github.com/mitchellh/go-wordwrap v1.0.1 // indirect github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect @@ -85,18 +85,18 @@ require ( github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect github.com/zclconf/go-cty v1.16.3 // indirect go.opentelemetry.io/auto/sdk v1.2.1 // indirect - go.opentelemetry.io/collector/featuregate v1.58.0 // indirect - go.opentelemetry.io/collector/pdata v1.58.0 // indirect + go.opentelemetry.io/collector/featuregate v1.59.0 // indirect + go.opentelemetry.io/collector/pdata v1.59.0 // indirect go.opentelemetry.io/contrib/bridges/otelslog v0.18.0 // indirect - go.opentelemetry.io/otel v1.43.0 // indirect + go.opentelemetry.io/otel v1.44.0 // indirect go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.19.0 // indirect - go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 // indirect - go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0 // indirect + go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.44.0 // indirect + go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.44.0 // indirect go.opentelemetry.io/otel/log v0.19.0 // indirect - go.opentelemetry.io/otel/metric v1.43.0 // indirect - go.opentelemetry.io/otel/sdk v1.43.0 // indirect + go.opentelemetry.io/otel/metric v1.44.0 // indirect + go.opentelemetry.io/otel/sdk v1.44.0 // indirect go.opentelemetry.io/otel/sdk/log v0.19.0 // indirect - go.opentelemetry.io/otel/trace v1.43.0 // indirect + go.opentelemetry.io/otel/trace v1.44.0 // indirect go.opentelemetry.io/proto/otlp v1.10.0 // indirect go.uber.org/atomic v1.11.0 // indirect go.uber.org/multierr v1.11.0 // indirect @@ -109,8 +109,8 @@ require ( golang.org/x/term v0.43.0 // indirect golang.org/x/text v0.37.0 // indirect golang.org/x/tools v0.44.0 // indirect - google.golang.org/genproto/googleapis/api v0.0.0-20260522204824-7f3bc5b78da9 // indirect - google.golang.org/genproto/googleapis/rpc v0.0.0-20260522204824-7f3bc5b78da9 // indirect + google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect google.golang.org/grpc v1.82.1 // indirect google.golang.org/protobuf v1.36.11 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect diff --git a/deploy/go.sum b/deploy/go.sum index 13e8e21..e0594bc 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -48,8 +48,9 @@ github.com/cloudflare/circl v1.6.3 h1:9GPOhQGF9MCYUeXyMYlqTR6a5gTrgR/fBLXvUgtVcg github.com/cloudflare/circl v1.6.3/go.mod h1:2eXP6Qfat4O/Yhh8BznvKnJ+uzEoTQ6jVKJRn81BiS4= github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= -github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= +github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM= +github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/djherbis/times v1.5.0 h1:79myA211VwPhFTqUk8xehWrsEO+zcIZj0zT8mXPVARU= github.com/djherbis/times v1.5.0/go.mod h1:5q7FDLvbNg1L/KaBmPcWlVR9NmoKo3+ucqUA3ijQhA0= github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc= @@ -57,8 +58,8 @@ github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FM github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f h1:Y/CXytFA4m6baUTXGLOoWe4PQhGxaX0KpnayAqC48p4= github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f/go.mod h1:vw97MGsxSvLiUE2X8qFplwetxpGLQrlU1Q9AUEIzCaM= github.com/fatih/color v1.9.0/go.mod h1:eQcE1qtQxscV5RaZvpXrrb8Drkc3/DdQ+uUYCNjL+zU= -github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM= -github.com/fatih/color v1.16.0/go.mod h1:fL2Sau1YI5c0pdGEVCbKQbLXB6edEj1ZgiY4NijnWvE= +github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM= +github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU= github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c= github.com/gliderlabs/ssh v0.3.8/go.mod h1:xYoytBv1sV0aL3CavoDuJIQNURXkkfPA/wxQ1pL1fAU= github.com/go-git/gcfg/v2 v2.0.2 h1:MY5SIIfTGGEMhdA7d7JePuVVxtKL7Hp+ApGDJAJ7dpo= @@ -122,8 +123,8 @@ github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE= github.com/lucasb-eyer/go-colorful v1.4.0 h1:UtrWVfLdarDgc44HcS7pYloGHJUjHV/4FwW4TvVgFr4= github.com/lucasb-eyer/go-colorful v1.4.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0= github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE= -github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA= -github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg= +github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE= +github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8= github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s= github.com/mattn/go-isatty v0.0.11/go.mod h1:PhnuNfih5lzO57/f3n+odYbM4JtupLOxQOAqxQCu2WE= github.com/mattn/go-isatty v0.0.22 h1:j8l17JJ9i6VGPUFUYoTUKPSgKe/83EYU2zBC7YNKMw4= @@ -131,8 +132,8 @@ github.com/mattn/go-isatty v0.0.22/go.mod h1:ZXfXG4SQHsB/w3ZeOYbR0PrPwLy+n6xiMrJ github.com/mattn/go-localereader v0.0.1 h1:ygSAOl7ZXTx4RdPYinUpg6W99U8jWvWi9Ye2JC/oIi4= github.com/mattn/go-localereader v0.0.1/go.mod h1:8fBrzywKY7BI3czFoHkuzRoWE9C+EiG4R1k4Cjx5p88= github.com/mattn/go-runewidth v0.0.4/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU= -github.com/mattn/go-runewidth v0.0.23 h1:7ykA0T0jkPpzSvMS5i9uoNn2Xy3R383f9HDx3RybWcw= -github.com/mattn/go-runewidth v0.0.23/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs= +github.com/mattn/go-runewidth v0.0.24 h1:cpokDiIn0MGnhdHwuWnJBITySJ20QyNGnY2kR/ay2DU= +github.com/mattn/go-runewidth v0.0.24/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs= github.com/mitchellh/go-ps v1.0.0 h1:i6ampVEEF4wQFF+bkYfwYgY+F/uYJDktmvLPf7qIgjc= github.com/mitchellh/go-ps v1.0.0/go.mod h1:J4lOc8z8yJs6vUwklHw2XEIiT4z4C40KtWVN3nvg8Pg= github.com/mitchellh/go-wordwrap v1.0.1 h1:TLuKupo69TCn6TQSyGxwI1EblZZEsQ0vMlAFQflz0v0= @@ -164,14 +165,15 @@ github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4= github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= github.com/pkg/term v1.1.0 h1:xIAAdCMh3QIAy+5FrE8Ad8XoDhEU4ufwbaSozViP9kk= github.com/pkg/term v1.1.0/go.mod h1:E25nymQcrSllhX42Ok8MRm1+hyBdHY0dCeiKZ9jpNGw= -github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= +github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U= +github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231 h1:vkHw5I/plNdTr435cARxCW6q9gc0S/Yxz7Mkd38pOb0= github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231/go.mod h1:murToZ2N9hNJzewjHBgfFdXhZKjY3z5cYC1VXk+lbFE= github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 h1:w6OnO3d4j5yVf2vpm8OzXFC/xHOEGqt+9FjWCUBCq6U= github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1/go.mod h1:UyZyv7hz4knpFx6/Sh+SkZe6hT6sJHtDvw9A0TbvEsk= -github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.32.0 h1:QwJzM3PseaorfASUlDXxsyntVGac7ZSYjqjxa038uoU= -github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.32.0/go.mod h1:MtckkCd6mzQQ3AYw+qjdt6ROfdBB3dr8dI/dE5/jxrM= +github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.33.0 h1:fFP72Q6/GfyI7BII3hUS7vn45Eg16zKIIS3I3R9bNEY= +github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.33.0/go.mod h1:sIZVlvi6oFQMEgTa+XkYfr/sAXRfrprPo3Ja6UYpGEU= github.com/pulumi/pulumi/sdk/v3 v3.253.0 h1:YWdKcZMZC7DtYSqNBn1Yv2UXmFMcgx7RqG3lhhBNZyE= github.com/pulumi/pulumi/sdk/v3 v3.253.0/go.mod h1:iTb2Yb9mn0kfUfMjwHgSuI5sxVUOcXRy0JcV7DLWsrc= github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ= @@ -213,36 +215,36 @@ github.com/zclconf/go-cty v1.16.3 h1:osr++gw2T61A8KVYHoQiFbFd1Lh3JOCXc/jFLJXKTxk github.com/zclconf/go-cty v1.16.3/go.mod h1:VvMs5i0vgZdhYawQNq5kePSpLAoz8u1xvZgrPIxfnZE= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y= -go.opentelemetry.io/collector/featuregate v1.58.0 h1:Kh6Dpgbxywv/Q3D6qPehaSxNCxvr/U/ki7CL4y3udCo= -go.opentelemetry.io/collector/featuregate v1.58.0/go.mod h1:4ga1QBMPEejXXmpyJS8lmaRpknJ3Lb9Bvk6e420bUFU= -go.opentelemetry.io/collector/internal/testutil v0.152.0 h1:8LGwekR7mLcUDhT1ofLmdnrHRFuUa3U7PBd95ZvJEjQ= -go.opentelemetry.io/collector/internal/testutil v0.152.0/go.mod h1:Jkjs6rkqs973LqgZ0Fe3zrokQRKULYXPIf4HuqStiEE= -go.opentelemetry.io/collector/pdata v1.58.0 h1:5Lxut3NxKp87066Pzt+3q7+JUuFI5B3teCyLZIF8wIs= -go.opentelemetry.io/collector/pdata v1.58.0/go.mod h1:4vZtODINbC/JF3eGocnatdImzbRHseOywIcr+aULjCg= +go.opentelemetry.io/collector/featuregate v1.59.0 h1:pu70/9eWRjAjzGnr3VmqwY+k6fmU3esLp15AqxfBBz0= +go.opentelemetry.io/collector/featuregate v1.59.0/go.mod h1:4ga1QBMPEejXXmpyJS8lmaRpknJ3Lb9Bvk6e420bUFU= +go.opentelemetry.io/collector/internal/testutil v0.153.0 h1:GJEaPLohao+7wtm08yGf73RGi1rpIHvqzxOb7Xn8sP0= +go.opentelemetry.io/collector/internal/testutil v0.153.0/go.mod h1:Jkjs6rkqs973LqgZ0Fe3zrokQRKULYXPIf4HuqStiEE= +go.opentelemetry.io/collector/pdata v1.59.0 h1:lO1IcaO9+HUVdFh+RATCUG3oTP+uCZzsE7HJ0MjmzRc= +go.opentelemetry.io/collector/pdata v1.59.0/go.mod h1:AH6M14C6qhesnUpcvigkvFMiX9KtdSWQENMBNyNhe7I= go.opentelemetry.io/contrib/bridges/otelslog v0.18.0 h1:hhPGP3zvvy1xWT9RTy970wlniSxFttBIsAK1gvMguJM= go.opentelemetry.io/contrib/bridges/otelslog v0.18.0/go.mod h1:twJF7inoMza6kxMcF8JOdL3mPmtOZu7GEr34CUNE6Dg= -go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I= -go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0= +go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU= +go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc= go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.19.0 h1:Dn8rkudDzY6KV9dr/D/bTUuWgqDf9xe0rr4G2elrn0Y= go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.19.0/go.mod h1:gMk9F0xDgyN9M/3Ed5Y1wKcx/9mlU91NXY2SNq7RQuU= -go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 h1:88Y4s2C8oTui1LGM6bTWkw0ICGcOLCAI5l6zsD1j20k= -go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0/go.mod h1:Vl1/iaggsuRlrHf/hfPJPvVag77kKyvrLeD10kpMl+A= -go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0 h1:RAE+JPfvEmvy+0LzyUA25/SGawPwIUbZ6u0Wug54sLc= -go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0/go.mod h1:AGmbycVGEsRx9mXMZ75CsOyhSP6MFIcj/6dnG+vhVjk= +go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.44.0 h1:4YsVu3B8+3qtWYYrsUYgn0OG78pN0rnNPRGX4SbokQI= +go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.44.0/go.mod h1:+wnlSn0mD1ADVMe3v9Z/WIaiz6q6gL2J/ejaAmdmv80= +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.44.0 h1:qazEJlUOQzhCpzQpFETGby7EdqjI1wsd0W+6Gg1SCTU= +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.44.0/go.mod h1:fOD2Yefuxixkx3ahVNf0O/PERb6r4OlbxfATVnYvzCo= go.opentelemetry.io/otel/log v0.19.0 h1:KUZs/GOsw79TBBMfDWsXS+KZ4g2Ckzksd1ymzsIEbo4= go.opentelemetry.io/otel/log v0.19.0/go.mod h1:5DQYeGmxVIr4n0/BcJvF4upsraHjg6vudJJpnkL6Ipk= -go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM= -go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY= -go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg= -go.opentelemetry.io/otel/sdk v1.43.0/go.mod h1:P+IkVU3iWukmiit/Yf9AWvpyRDlUeBaRg6Y+C58QHzg= +go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc= +go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo= +go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58= +go.opentelemetry.io/otel/sdk v1.44.0/go.mod h1:Osuydd3Se74nqjAKxid74N5eC+jfEqfTegHRnq58oK0= go.opentelemetry.io/otel/sdk/log v0.19.0 h1:scYVLqT22D2gqXItnWiocLUKGH9yvkkeql5dBDiXyko= go.opentelemetry.io/otel/sdk/log v0.19.0/go.mod h1:vFBowwXGLlW9AvpuF7bMgnNI95LiW10szrOdvzBHlAg= go.opentelemetry.io/otel/sdk/log/logtest v0.19.0 h1:BEbF7ZBB6qQloV/Ub1+3NQoOUnVtcGkU3XX4Ws3GQfk= go.opentelemetry.io/otel/sdk/log/logtest v0.19.0/go.mod h1:Lua81/3yM0wOmoHTokLj9y9ADeA02v1naRrVrkAZuKk= -go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw= -go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A= -go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A= -go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0= +go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI= +go.opentelemetry.io/otel/sdk/metric v1.44.0/go.mod h1:5B5pMARnXxKhltooO4xUuCBorl65a4EpnTalObqOigA= +go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk= +go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE= go.opentelemetry.io/proto/otlp v1.10.0 h1:IQRWgT5srOCYfiWnpqUYz9CVmbO8bFmKcwYxpuCSL2g= go.opentelemetry.io/proto/otlp v1.10.0/go.mod h1:/CV4QoCR/S9yaPj8utp3lvQPoqMtxXdzn7ozvvozVqk= go.opentelemetry.io/proto/slim/otlp v1.10.0 h1:iR97Vs/ZDR+y9TfuP9b1XBtdPWeC+OMslIBmhcLU7jM= @@ -313,10 +315,10 @@ golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8T golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4= gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E= -google.golang.org/genproto/googleapis/api v0.0.0-20260522204824-7f3bc5b78da9 h1:dlKupvNsf7YXJYxduemxBzqGX8zjzedsttskfjgLIO8= -google.golang.org/genproto/googleapis/api v0.0.0-20260522204824-7f3bc5b78da9/go.mod h1:1dCETSCY2YKZNXQE3h4fun3TYwF5p8jejRKZgfWAgAY= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260522204824-7f3bc5b78da9 h1:UScUq4IhqF8ll85bMGS/l0D+iGzwQXpX5RBYQEwjahU= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260522204824-7f3bc5b78da9/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= +google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa h1:Kjn0N0tCrDgiAFW+lGO4JZ3ck44CehvJQMAwj9QF0G8= +google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa/go.mod h1:q4lMZS6kskjT5HvCPrnnypcDPVJqT/f4nfxmkE7gryY= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa h1:mZHHdPZl0dbGHCflZgAq/Q468DWVFcU2whhB2KAo8fk= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= google.golang.org/grpc v1.82.1 h1:NnAxzGRA0677vCa4BUkOAnO5+FfQqVl9iUXeD0IqcGE= google.golang.org/grpc v1.82.1/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA= google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE= diff --git a/go.mod b/go.mod index 20927f2..2fae36e 100644 --- a/go.mod +++ b/go.mod @@ -8,11 +8,11 @@ require ( github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.5.0 github.com/caarlos0/env/v11 v11.4.1 github.com/coreos/go-oidc/v3 v3.20.0 - github.com/danielgtaylor/huma/v2 v2.38.0 + github.com/danielgtaylor/huma/v2 v2.39.0 github.com/golang-jwt/jwt/v5 v5.3.1 github.com/google/go-containerregistry v0.21.7 github.com/jackc/pgx/v5 v5.10.0 - github.com/prometheus/client_golang v1.23.2 + github.com/prometheus/client_golang v1.24.1 github.com/rs/cors v1.11.1 github.com/santhosh-tekuri/jsonschema/v5 v5.3.1 github.com/stretchr/testify v1.11.1 @@ -53,7 +53,7 @@ require ( github.com/jackc/pgpassfile v1.0.0 // indirect github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect github.com/jackc/puddle/v2 v2.2.2 // indirect - github.com/klauspost/compress v1.18.6 // indirect + github.com/klauspost/compress v1.19.1 // indirect github.com/kylelemons/godebug v1.1.0 // indirect github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect github.com/opencontainers/go-digest v1.0.0 // indirect @@ -61,27 +61,26 @@ require ( github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect github.com/prometheus/client_model v0.6.2 // indirect - github.com/prometheus/common v0.67.5 // indirect + github.com/prometheus/common v0.70.1 // indirect github.com/prometheus/otlptranslator v1.0.0 // indirect - github.com/prometheus/procfs v0.20.1 // indirect + github.com/prometheus/procfs v0.21.1 // indirect github.com/sirupsen/logrus v1.9.4 // indirect go.opentelemetry.io/auto/sdk v1.2.1 // indirect go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0 // indirect go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 // indirect go.opentelemetry.io/otel/trace v1.44.0 // indirect - go.yaml.in/yaml/v2 v2.4.4 // indirect - golang.org/x/crypto v0.53.0 // indirect - golang.org/x/net v0.56.0 // indirect + golang.org/x/crypto v0.54.0 // indirect + golang.org/x/net v0.57.0 // indirect golang.org/x/oauth2 v0.36.0 // indirect - golang.org/x/sync v0.21.0 // indirect - golang.org/x/sys v0.46.0 // indirect - golang.org/x/text v0.39.0 // indirect + golang.org/x/sync v0.22.0 // indirect + golang.org/x/sys v0.47.0 // indirect + golang.org/x/text v0.40.0 // indirect golang.org/x/time v0.15.0 // indirect google.golang.org/api v0.287.1 // indirect google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 // indirect google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7 // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20260630182238-925bb5da69e7 // indirect - google.golang.org/grpc v1.82.0 // indirect + google.golang.org/grpc v1.82.1 // indirect google.golang.org/protobuf v1.36.11 // indirect gotest.tools/v3 v3.5.2 // indirect ) diff --git a/go.sum b/go.sum index 91d94ad..0d35438 100644 --- a/go.sum +++ b/go.sum @@ -38,8 +38,8 @@ github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2 h1:aBangftG7EVZoUb69Os github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2/go.mod h1:qwXFYgsP6T7XnJtbKlf1HP8AjxZZyzxMmc+Lq5GjlU4= github.com/coreos/go-oidc/v3 v3.20.0 h1:EtE0WIBHk03N+DqGkY4+UONzzZHk7amKt6IyNd7OsZE= github.com/coreos/go-oidc/v3 v3.20.0/go.mod h1:DYCf24+ncYi+XkIH97GY1+dqoRlbaSI26KVTCI9SrY4= -github.com/danielgtaylor/huma/v2 v2.38.0 h1:fb0WZCatnaiHLphMQDDWDjygNxfMkX/ENma3QsRl7vY= -github.com/danielgtaylor/huma/v2 v2.38.0/go.mod h1:k9hwjlgWFt1t2jsmQGlsgXAG2FBTZa4kkjV581qAtfo= +github.com/danielgtaylor/huma/v2 v2.39.0 h1:YiXbzhJBSeQVkKbhn8adZR48Ei4XFx/K6jShQ3O92qU= +github.com/danielgtaylor/huma/v2 v2.39.0/go.mod h1:pGstQdMhQnP9ZBnrqPRb9goqOWs1HU1uQewKWmkJOAY= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM= github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= @@ -54,8 +54,10 @@ github.com/envoyproxy/protoc-gen-validate v1.3.3 h1:MVQghNeW+LZcmXe7SY1V36Z+WFMD github.com/envoyproxy/protoc-gen-validate v1.3.3/go.mod h1:TsndJ/ngyIdQRhMcVVGDDHINPLWB7C82oDArY51KfB0= github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg= github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U= -github.com/fxamacker/cbor/v2 v2.9.1 h1:2rWm8B193Ll4VdjsJY28jxs70IdDsHRWgQYAI80+rMQ= -github.com/fxamacker/cbor/v2 v2.9.1/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ= +github.com/fxamacker/cbor/v2 v2.9.2 h1:X4Ksno9+x3cz0TZv69ec1hxP/+tymuR8PXQJyDwfh78= +github.com/fxamacker/cbor/v2 v2.9.2/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ= +github.com/go-chi/chi/v5 v5.3.0 h1:halUjDxhshgXHMrao5bB8eNBXo/rnzwr8m5m36glehM= +github.com/go-chi/chi/v5 v5.3.0/go.mod h1:R+tYY2hNuVUUjxoPtqUdgBqevM9s9njzkTLutVsOCto= github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA= github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08= github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= @@ -89,8 +91,8 @@ github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4= github.com/keybase/go-keychain v0.0.1 h1:way+bWYa6lDppZoZcgMbYsvC7GxljxrskdNInRtuthU= github.com/keybase/go-keychain v0.0.1/go.mod h1:PdEILRW3i9D8JcdM+FmY6RwkHGnhHxXwkPPMeUgOK1k= -github.com/klauspost/compress v1.18.6 h1:2jupLlAwFm95+YDR+NwD2MEfFO9d4z4Prjl1XXDjuao= -github.com/klauspost/compress v1.18.6/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.19.1 h1:VsB4HPswih7mmZ8WleSFQ75c/Ui1M4trX5oAsJnhSlk= +github.com/klauspost/compress v1.19.1/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= @@ -110,16 +112,16 @@ github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10/go.mod h1 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U= github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= -github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o= -github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg= +github.com/prometheus/client_golang v1.24.1 h1:JnJkREXzWxUdCuPFpIWZiPispT9xVV59uiuyR2bPlnU= +github.com/prometheus/client_golang v1.24.1/go.mod h1:F+oSRECHg4sse5ucfYpYDeIv/hu68Zo0uoHKetWnzcE= github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk= github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE= -github.com/prometheus/common v0.67.5 h1:pIgK94WWlQt1WLwAC5j2ynLaBRDiinoAb86HZHTUGI4= -github.com/prometheus/common v0.67.5/go.mod h1:SjE/0MzDEEAyrdr5Gqc6G+sXI67maCxzaT3A2+HqjUw= +github.com/prometheus/common v0.70.1 h1:1HvjP4D5oL3t8RsPlwxA9onvvStjtIHYE5XuuwOi/PY= +github.com/prometheus/common v0.70.1/go.mod h1:VdFUQDMZK3VLkurFUVhia6uys/0suUp86TJz5qbJRhc= github.com/prometheus/otlptranslator v1.0.0 h1:s0LJW/iN9dkIH+EnhiD3BlkkP5QVIUVEoIwkU+A6qos= github.com/prometheus/otlptranslator v1.0.0/go.mod h1:vRYWnXvI6aWGpsdY/mOT/cbeVRBlPWtBNDb7kGR3uKM= -github.com/prometheus/procfs v0.20.1 h1:XwbrGOIplXW/AU3YhIhLODXMJYyC1isLFfYCsTEycfc= -github.com/prometheus/procfs v0.20.1/go.mod h1:o9EMBZGRyvDrSPH1RqdxhojkuXstoe4UlK79eF5TGGo= +github.com/prometheus/procfs v0.21.1 h1:GljZCt+zSTS+NZq88cyQ1LjZ+RCHp3uVuabBWA5+OJI= +github.com/prometheus/procfs v0.21.1/go.mod h1:aB55Cww9pdSJVHk0hUf0inxWyyjPogFIjmHKYgMKmtY= github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ= github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc= github.com/rs/cors v1.11.1 h1:eU3gRzXLRK57F5rKMGMZURNdIG4EoAmX8k94r9wXWHA= @@ -161,21 +163,21 @@ go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE= go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ= go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ= -golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto= -golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio= +golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw= +golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk= golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk= golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40= -golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o= -golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec= +golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE= +golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU= golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= -golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM= -golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= +golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek= +golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw= -golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= -golang.org/x/text v0.39.0 h1:UbZz4pLOvn600D6Oh6GGEI6VAmndrEBLv8/6BEXzyus= -golang.org/x/text v0.39.0/go.mod h1:3UwRclnC2g0TU9x8PZiyfOajCd1zaUNHF9cvqcQZ+ZM= +golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs= +golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= +golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs= +golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY= golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U= golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno= gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4= @@ -188,8 +190,8 @@ google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7 h1: google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7/go.mod h1:KqHwBx2upmfa1XSi1WuRvC+2VGCLtooKkfmyvRbUmqA= google.golang.org/genproto/googleapis/rpc v0.0.0-20260630182238-925bb5da69e7 h1:eM/YSd5bBFagF51o1E745Ta7RwzpW0h+z+QDNZOgmQ8= google.golang.org/genproto/googleapis/rpc v0.0.0-20260630182238-925bb5da69e7/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= -google.golang.org/grpc v1.82.0 h1:vguDnZUPjE26w09A63VoxZPnvPjB5Riyc0mkXPFmAIU= -google.golang.org/grpc v1.82.0/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA= +google.golang.org/grpc v1.82.1 h1:NnAxzGRA0677vCa4BUkOAnO5+FfQqVl9iUXeD0IqcGE= +google.golang.org/grpc v1.82.1/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA= google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE= google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= From 4000b0995304ba7774201810be4a24c0071b9725 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 7 Aug 2026 01:28:11 +0300 Subject: [PATCH 269/313] build(deps): bump github.com/google/go-containerregistry from 0.21.7 to 0.21.8 (#1507) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) from 0.21.7 to 0.21.8.
    Release notes

    Sourced from github.com/google/go-containerregistry's releases.

    v0.21.8

    The artifacts attached to this release are missing SLSA provenance, see #2390.

    What's Changed

    New Contributors

    Full Changelog: https://github.com/google/go-containerregistry/compare/v0.21.7...v0.21.8

    Commits
    • 2ea098f Bump go version to 1.26.5 (#2388)
    • ec2e586 actions: reformat ALL actions (#2386)
    • ab819b6 actions: fix unformatted action (#2385)
    • eed9a20 actions: update actions to be pinned by hash (#2384)
    • 8a97709 build(deps): bump github.com/moby/moby/client (#2380)
    • d04bf7d tarball: use correct file extension for zstd/uncompressed (#2382)
    • 4d13d53 mutate: apply opaque-directory whiteouts (.wh..wh..opq) in Extract (#2372)
    • af2603f feat(remote): add WithReferrersTagFallback option (#2366)
    • fb19695 fix(daemon): copy ExposedPorts from source config in computeImageConfig (#2356)
    • 0c9d911 mutate: bounds-check layer index when building rebase addendums (#2371)
    • Additional commits viewable in compare view

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/google/go-containerregistry&package-manager=go_modules&previous-version=0.21.7&new-version=0.21.8)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 4 ++-- go.sum | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/go.mod b/go.mod index 2fae36e..74c327a 100644 --- a/go.mod +++ b/go.mod @@ -10,7 +10,7 @@ require ( github.com/coreos/go-oidc/v3 v3.20.0 github.com/danielgtaylor/huma/v2 v2.39.0 github.com/golang-jwt/jwt/v5 v5.3.1 - github.com/google/go-containerregistry v0.21.7 + github.com/google/go-containerregistry v0.21.8 github.com/jackc/pgx/v5 v5.10.0 github.com/prometheus/client_golang v1.24.1 github.com/rs/cors v1.11.1 @@ -40,7 +40,7 @@ require ( github.com/beorn7/perks v1.0.1 // indirect github.com/cespare/xxhash/v2 v2.3.0 // indirect github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect - github.com/docker/cli v29.5.3+incompatible // indirect + github.com/docker/cli v29.6.2+incompatible // indirect github.com/docker/docker-credential-helpers v0.9.3 // indirect github.com/felixge/httpsnoop v1.0.4 // indirect github.com/go-jose/go-jose/v4 v4.1.4 // indirect diff --git a/go.sum b/go.sum index 0d35438..8bb4c79 100644 --- a/go.sum +++ b/go.sum @@ -43,8 +43,8 @@ github.com/danielgtaylor/huma/v2 v2.39.0/go.mod h1:pGstQdMhQnP9ZBnrqPRb9goqOWs1H github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM= github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= -github.com/docker/cli v29.5.3+incompatible h1:nbEFfz774vBwQ5KRYv7c/AghjReqnGISvrRhzjV0evs= -github.com/docker/cli v29.5.3+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= +github.com/docker/cli v29.6.2+incompatible h1:/bjePvcbbFTnRrMfWJBY7AjfICdsiLVgHn6LwTVOcqw= +github.com/docker/cli v29.6.2+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= github.com/docker/docker-credential-helpers v0.9.3 h1:gAm/VtF9wgqJMoxzT3Gj5p4AqIjCBS4wrsOh9yRqcz8= github.com/docker/docker-credential-helpers v0.9.3/go.mod h1:x+4Gbw9aGmChi3qTLZj8Dfn0TD20M/fuWy0E5+WDeCo= github.com/envoyproxy/go-control-plane v0.14.0 h1:hbG2kr4RuFj222B6+7T83thSPqLjwBIfQawTkC++2HA= @@ -71,8 +71,8 @@ github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps= github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= -github.com/google/go-containerregistry v0.21.7 h1:/vPFuVXDjtFREsVArW+0h1CIl5urnOhzei4X2DMW9IU= -github.com/google/go-containerregistry v0.21.7/go.mod h1:kjSbt7/zMsKLWfnHrIvKvhXHUw91jbe9DNjPPJ32gXE= +github.com/google/go-containerregistry v0.21.8 h1:Ig/zIsnztdCUNaiNNczE+MoP5xcyUMfvpvfOr1xyMLE= +github.com/google/go-containerregistry v0.21.8/go.mod h1:dP5XNKcL7kMFF/TB3LfvWmVhAcv7iqkHb3oDK8aauTo= github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0= github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= From 2a288301563a2ccada0d8278ba5812e7bbb8baf0 Mon Sep 17 00:00:00 2001 From: Tadas Antanavicius Date: Fri, 7 Aug 2026 04:29:25 +0600 Subject: [PATCH 270/313] docs: remove Tadas as WG Lead (#1493) Per discussion with @rdimitrov, removing my listing as WG Lead of Registry so I can free up some time to work on [AI Catalog](https://github.com/Agent-Card/ai-catalog) and [Server Cards](https://github.com/modelcontextprotocol/experimental-ext-server-card). FYI @BobDickinson @pree-dew Co-authored-by: Tadas Antanavicius Co-authored-by: Claude Opus 5 --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 33ce337..5424e0d 100644 --- a/README.md +++ b/README.md @@ -11,8 +11,8 @@ The MCP registry provides MCP clients with a list of MCP servers, like an app st **2025-09-08 update**: The registry has launched in preview 🎉 ([announcement blog post](https://blog.modelcontextprotocol.io/posts/2025-09-08-mcp-registry-preview/)). While the system is now more stable, this is still a preview release and breaking changes or data resets may occur. A general availability (GA) release will follow later. We'd love your feedback in [GitHub discussions](https://github.com/modelcontextprotocol/registry/discussions/new?category=ideas) or in the [#registry-dev Discord](https://discord.com/channels/1358869848138059966/1369487942862504016) ([joining details here](https://modelcontextprotocol.io/community/communication)). Registry Working Group: +- **Radoslav (Rado) Dimitrov** (Stacklok) [@rdimitrov](https://github.com/rdimitrov) - WG Lead - **Tadas Antanavicius** (PulseMCP) [@tadasant](https://github.com/tadasant) -- **Radoslav (Rado) Dimitrov** (Stacklok) [@rdimitrov](https://github.com/rdimitrov) - **Bob Dickinson** (TeamSpark) [@BobDickinson](https://github.com/BobDickinson) - **Preeti (Pree) Dewani** (Ravenmail) [@pree-dew](https://github.com/pree-dew) From 4e1f96a7165eff645fdcc924d9a3d738c6a3b6c6 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 7 Aug 2026 01:29:42 +0300 Subject: [PATCH 271/313] build(deps): bump github.com/danielgtaylor/huma/v2 from 2.39.0 to 2.39.1 (#1489) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [github.com/danielgtaylor/huma/v2](https://github.com/danielgtaylor/huma) from 2.39.0 to 2.39.1.
    Release notes

    Sourced from github.com/danielgtaylor/huma/v2's releases.

    v2.39.1

    Overview

    A patch release: correctness fixes for resolvers, validation, and response handling, plus a dependency refresh.

    Response Status Visible to Middleware Again

    WithContext context propagation in v2.39.0 copied the response status by value, so middleware that called WithContext and then read Status() after next() always saw 0 instead of the status the handler set, breaking access logging and telemetry. The status is now shared by every context copy across all adapters, restoring the pre-2.39 invariant while keeping context propagation intact. (#1081)

    Resolvers & Defaults in Arrays and Maps

    • Nested resolvers now run for fixed-size arrays ([2]Item), not just slices (#1076)
    • A resolver on a named collection type (e.g. type Coords [2]float64) no longer panics, and is no longer conflated with a resolver on its element type, which previously ran the element's resolver twice and the collection's never (#1082)
    • Values reached through a map are now written back after being walked, so applying a default no longer panics with reflect: reflect.Value.Set using unaddressable value and resolver mutations are no longer silently discarded (#1082)

    Stricter email and uri Formats

    Validation for two string formats is tighter, so payloads that previously passed may now return 422:

    • email / idn-email accept an addr-spec only; full mailbox forms with a display name (Name <user@example.com>) are rejected
    • uri / iri require an absolute URI with a non-empty scheme, while relative references remain valid under uri-reference / iri-reference (#1068)

    Validation Robustness

    • An unresolvable schema $ref during Validate now reports expected schema $ref to resolve: ... instead of panicking on a nil dereference, covering discriminators and map[string]any / map[any]any values (#1065)
    • Named numeric slice parameters (e.g. type IDs []int64) are built with their declared element type and validated with item, length, and uniqueness constraints intact (#1074)

    Other Fixes

    • Resolver errors that wrap a HeadersError now contribute their headers to the response, matching the handler error path (#1070)
    • A nil interface response body no longer panics in the schema link transformer (#1072)
    • Dependencies updated (#1066)

    What's Changed

    New Contributors

    Full Changelog: https://github.com/danielgtaylor/huma/compare/v2.39.0...v2.39.1

    Commits

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/danielgtaylor/huma/v2&package-manager=go_modules&previous-version=2.39.0&new-version=2.39.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/go.mod b/go.mod index 74c327a..1fc7e8a 100644 --- a/go.mod +++ b/go.mod @@ -8,7 +8,7 @@ require ( github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.5.0 github.com/caarlos0/env/v11 v11.4.1 github.com/coreos/go-oidc/v3 v3.20.0 - github.com/danielgtaylor/huma/v2 v2.39.0 + github.com/danielgtaylor/huma/v2 v2.39.1 github.com/golang-jwt/jwt/v5 v5.3.1 github.com/google/go-containerregistry v0.21.8 github.com/jackc/pgx/v5 v5.10.0 diff --git a/go.sum b/go.sum index 8bb4c79..4b4ab93 100644 --- a/go.sum +++ b/go.sum @@ -38,8 +38,8 @@ github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2 h1:aBangftG7EVZoUb69Os github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2/go.mod h1:qwXFYgsP6T7XnJtbKlf1HP8AjxZZyzxMmc+Lq5GjlU4= github.com/coreos/go-oidc/v3 v3.20.0 h1:EtE0WIBHk03N+DqGkY4+UONzzZHk7amKt6IyNd7OsZE= github.com/coreos/go-oidc/v3 v3.20.0/go.mod h1:DYCf24+ncYi+XkIH97GY1+dqoRlbaSI26KVTCI9SrY4= -github.com/danielgtaylor/huma/v2 v2.39.0 h1:YiXbzhJBSeQVkKbhn8adZR48Ei4XFx/K6jShQ3O92qU= -github.com/danielgtaylor/huma/v2 v2.39.0/go.mod h1:pGstQdMhQnP9ZBnrqPRb9goqOWs1HU1uQewKWmkJOAY= +github.com/danielgtaylor/huma/v2 v2.39.1 h1:0kwF4ltQoYZ+IU55VPy+BcGekzgF44R64daTGde1H+g= +github.com/danielgtaylor/huma/v2 v2.39.1/go.mod h1:zcnQ38duIJ3VUHwFaBoZ6x8T+KN/mr33oyqxcj0HTug= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM= github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= @@ -56,8 +56,8 @@ github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U= github.com/fxamacker/cbor/v2 v2.9.2 h1:X4Ksno9+x3cz0TZv69ec1hxP/+tymuR8PXQJyDwfh78= github.com/fxamacker/cbor/v2 v2.9.2/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ= -github.com/go-chi/chi/v5 v5.3.0 h1:halUjDxhshgXHMrao5bB8eNBXo/rnzwr8m5m36glehM= -github.com/go-chi/chi/v5 v5.3.0/go.mod h1:R+tYY2hNuVUUjxoPtqUdgBqevM9s9njzkTLutVsOCto= +github.com/go-chi/chi/v5 v5.3.1 h1:3j4HZLGZQ3JpMCrPJF/Jl3mYJfWLKBfNJ6quurUGCf8= +github.com/go-chi/chi/v5 v5.3.1/go.mod h1:R+tYY2hNuVUUjxoPtqUdgBqevM9s9njzkTLutVsOCto= github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA= github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08= github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= From ac340e0b88038481ff22e19e36c4bb00acc78d35 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 7 Aug 2026 01:30:05 +0300 Subject: [PATCH 272/313] build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.253.0 to 3.255.0 in /deploy (#1490) Bumps [github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from 3.253.0 to 3.255.0.
    Release notes

    Sourced from github.com/pulumi/pulumi/sdk/v3's releases.

    v3.255.0

    3.255.0 (2026-07-28)

    Features

    • [cli] Add an --extension flag to package commands for extension-parameterized packages, reinstalled from Pulumi.yaml on pulumi install
    • [cli] Project files to disk and surface their paths as environment variables for all output formats when opening an ESC environment #23993
    • [engine] Resolve an invoke's provider from the providers option of the parent named on the request, matching the resolution applied to resource registrations #24016
    • [cli/do] Add --resources to refer to existing resources in state in do input expressions #24037

    Bug Fixes

    • [programgen/nodejs] Parent an invoke written inside a component to that component, so it resolves the component's providers #24017
    • [pcl] Apply the providers option of a component block to the resources and invokes it declares #24016
    • [cli/import] Fix import file generation when parent resources share names #24069
    • [cli] Fix parallel pulumi install processes sharing a PULUMI_HOME intermittently failing with a missing provider executable error #24080
    • [sdk/python] Allow Construct and Call methods to run concurrently in provider servers #24081

    Improvements

    • [engine] Support strings containing non-UTF8 bytes flowing between providers, the engine, state, and languages that opt in (Go and PCL initially) #23856
    • [cli] Add a --summary flag to pulumi stack history events that reduces a past update's events to the same summary shape as a live pulumi up --output json, extended with error diagnostics and failed-resource markers #23960
    • [protobuf] Allow state converters to supply resource inputs and outputs in ConvertState responses #23987
    • [engine] Allow policy packs to point to executable binaries, not just script folders #24052
    • [cli/display] The Neo diagnostics link now suggests pulumi neo --debug-update or pulumi neo --debug-preview to investigate the failed operation #24075
    • [sdk/python] Allow UV_PROJECT_ENVIRONMENT to override the virtualenv path if uv is used #24077
    • [cli] Allow otel traces to be sent over https #24078

    v3.254.0

    3.254.0 (2026-07-23)

    Features

    • [cli] Add pulumi logs share command for sharing logs with Pulumi #22546
    • [cli] Add pulumi stack migrate to migrate a stack from another backend to the currently logged-in backend, including re-encrypting config secrets and stack state under the target secrets provider #22902
    • [cli/config] Add an --override-env flag to up, preview, destroy, and refresh to substitute imported environments for a single run without editing the stack config #23562
    • [cli] Add pulumi neo acp to run Neo as an Agent Client Protocol agent over stdio for ACP-capable editors, with read-only and plan mode exposed as session config options #23886
    • [cli/neo] Retry transient pulumi neo stream and message-send failures, and add pulumi neo resume with chat history #23835
    • [cli/neo] Make Ctrl+C clear typed text and preserve Ctrl+A/Ctrl+E line navigation in pulumi neo #23932
    • [cli/do] Add upsert to do, allowing resources to be statefully created or updated in a stack #23813
    • [sdk/python] Add pulumi.run for natively awaited Python program entrypoints that can return stack outputs #23945
    • [cli/do] Allow expressions for number inputs #23954
    • [cli/do] Allow expressions for boolean inputs #23967
    • [cli/policy] Add --runtime-options to pulumi policy new #23992
    • [cli/do] Add support for stateful create #23996
    • [cli/do] Add support for stateful delete #24000

    Bug Fixes

    • [sdkgen/go] Fix Go codegen for plain properties nested inside non-plain objects #22524

    ... (truncated)

    Changelog

    Sourced from github.com/pulumi/pulumi/sdk/v3's changelog.

    3.255.0 (2026-07-28)

    Features

    • [cli] Add an --extension flag to package commands for extension-parameterized packages, reinstalled from Pulumi.yaml on pulumi install
    • [cli] Project files to disk and surface their paths as environment variables for all output formats when opening an ESC environment #23993
    • [engine] Resolve an invoke's provider from the providers option of the parent named on the request, matching the resolution applied to resource registrations #24016
    • [cli/do] Add --resources to refer to existing resources in state in do input expressions #24037

    Bug Fixes

    • [programgen/nodejs] Parent an invoke written inside a component to that component, so it resolves the component's providers #24017
    • [pcl] Apply the providers option of a component block to the resources and invokes it declares #24016
    • [cli/import] Fix import file generation when parent resources share names #24069
    • [cli] Fix parallel pulumi install processes sharing a PULUMI_HOME intermittently failing with a missing provider executable error #24080
    • [sdk/python] Allow Construct and Call methods to run concurrently in provider servers #24081

    Improvements

    • [engine] Support strings containing non-UTF8 bytes flowing between providers, the engine, state, and languages that opt in (Go and PCL initially) #23856
    • [cli] Add a --summary flag to pulumi stack history events that reduces a past update's events to the same summary shape as a live pulumi up --output json, extended with error diagnostics and failed-resource markers #23960
    • [protobuf] Allow state converters to supply resource inputs and outputs in ConvertState responses #23987
    • [engine] Allow policy packs to point to executable binaries, not just script folders #24052
    • [cli/display] The Neo diagnostics link now suggests pulumi neo --debug-update or pulumi neo --debug-preview to investigate the failed operation #24075
    • [sdk/python] Allow UV_PROJECT_ENVIRONMENT to override the virtualenv path if uv is used #24077
    • [cli] Allow otel traces to be sent over https #24078

    3.254.0 (2026-07-23)

    Features

    • [cli] Add pulumi logs share command for sharing logs with Pulumi #22546
    • [cli] Add pulumi stack migrate to migrate a stack from another backend to the currently logged-in backend, including re-encrypting config secrets and stack state under the target secrets provider #22902
    • [cli/config] Add an --override-env flag to up, preview, destroy, and refresh to substitute imported environments for a single run without editing the stack config #23562
    • [cli] Add pulumi neo acp to run Neo as an Agent Client Protocol agent over stdio for ACP-capable editors, with read-only and plan mode exposed as session config options #23886
    • [cli/neo] Retry transient pulumi neo stream and message-send failures, and add pulumi neo resume with chat history #23835
    • [cli/neo] Make Ctrl+C clear typed text and preserve Ctrl+A/Ctrl+E line navigation in pulumi neo #23932
    • [cli/do] Add upsert to do, allowing resources to be statefully created or updated in a stack #23813
    • [sdk/python] Add pulumi.run for natively awaited Python program entrypoints that can return stack outputs #23945
    • [cli/do] Allow expressions for number inputs #23954
    • [cli/do] Allow expressions for boolean inputs #23967
    • [cli/policy] Add --runtime-options to pulumi policy new #23992
    • [cli/do] Add support for stateful create #23996
    • [cli/do] Add support for stateful delete #24000

    Bug Fixes

    • [sdkgen/go] Fix Go codegen for plain properties nested inside non-plain objects #22524
    • [cli/neo] Keep pulumi neo connected during quiet periods when the event stream only receives keep-alive heartbeats #23935
    • [engine] Validate snippets before persisting them #23920
    • [backend] Fix dangling ReplaceWith references in the journal replayer #23927

    ... (truncated)

    Commits

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/pulumi/pulumi/sdk/v3&package-manager=go_modules&previous-version=3.253.0&new-version=3.255.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- deploy/go.mod | 4 +--- deploy/go.sum | 6 ++---- 2 files changed, 3 insertions(+), 7 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index 85a2e7d..b2365a5 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -5,7 +5,7 @@ go 1.26 require ( github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.33.0 - github.com/pulumi/pulumi/sdk/v3 v3.253.0 + github.com/pulumi/pulumi/sdk/v3 v3.255.0 gopkg.in/yaml.v2 v2.4.0 ) @@ -15,7 +15,6 @@ require ( github.com/ProtonMail/go-crypto v1.4.1 // indirect github.com/agext/levenshtein v1.2.3 // indirect github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect - github.com/atotto/clipboard v0.1.4 // indirect github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect github.com/blang/semver v3.5.1+incompatible // indirect github.com/cenkalti/backoff/v5 v5.0.3 // indirect @@ -101,7 +100,6 @@ require ( go.uber.org/atomic v1.11.0 // indirect go.uber.org/multierr v1.11.0 // indirect golang.org/x/crypto v0.52.0 // indirect - golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f // indirect golang.org/x/mod v0.35.0 // indirect golang.org/x/net v0.55.0 // indirect golang.org/x/sync v0.20.0 // indirect diff --git a/deploy/go.sum b/deploy/go.sum index e0594bc..f55881a 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -14,8 +14,6 @@ github.com/apparentlymart/go-textseg/v15 v15.0.0 h1:uYvfpb3DyLSCGWnctWKGj857c6ew github.com/apparentlymart/go-textseg/v15 v15.0.0/go.mod h1:K8XmNZdhEBkdlyDdvbmmsvpAG721bKi0joRfFdHIWJ4= github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio= github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs= -github.com/atotto/clipboard v0.1.4 h1:EH0zSVneZPSuFR11BlR9YppQTVDbh5+16AmcJi4g1z4= -github.com/atotto/clipboard v0.1.4/go.mod h1:ZY9tmq7sm5xIbd9bOK4onWV4S6X0u6GY7Vn0Yu86PYI= github.com/aymanbagabas/go-osc52/v2 v2.0.1 h1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiErDT4WkJ2k= github.com/aymanbagabas/go-osc52/v2 v2.0.1/go.mod h1:uYgXzlJ7ZpABp8OJ+exZzJJhRNQ2ASbcXHWsFqH8hp8= github.com/blang/semver v3.5.1+incompatible h1:cQNTCjp13qL8KC3Nbxr/y2Bqb63oX6wdnnjpJbkM4JQ= @@ -174,8 +172,8 @@ github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 h1:w6OnO3d4j5yVf2vpm8OzXFC/xHOEGqt+9 github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1/go.mod h1:UyZyv7hz4knpFx6/Sh+SkZe6hT6sJHtDvw9A0TbvEsk= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.33.0 h1:fFP72Q6/GfyI7BII3hUS7vn45Eg16zKIIS3I3R9bNEY= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.33.0/go.mod h1:sIZVlvi6oFQMEgTa+XkYfr/sAXRfrprPo3Ja6UYpGEU= -github.com/pulumi/pulumi/sdk/v3 v3.253.0 h1:YWdKcZMZC7DtYSqNBn1Yv2UXmFMcgx7RqG3lhhBNZyE= -github.com/pulumi/pulumi/sdk/v3 v3.253.0/go.mod h1:iTb2Yb9mn0kfUfMjwHgSuI5sxVUOcXRy0JcV7DLWsrc= +github.com/pulumi/pulumi/sdk/v3 v3.255.0 h1:G872L4M1EPW3l60yEc52GgLpFRdXAVf0rn96q3MwDVQ= +github.com/pulumi/pulumi/sdk/v3 v3.255.0/go.mod h1:b99ZkmEGjVyW55blOwL94IfPLcaajhOfV8OTePZrRJM= github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ= github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88= github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ= From 34f0bb99f366ea292767409fbe6a189c079016b7 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 7 Aug 2026 01:30:21 +0300 Subject: [PATCH 273/313] build(deps): bump cloud.google.com/go/kms from 1.32.0 to 1.33.0 (#1491) Bumps [cloud.google.com/go/kms](https://github.com/googleapis/google-cloud-go) from 1.32.0 to 1.33.0.
    Release notes

    Sourced from cloud.google.com/go/kms's releases.

    video: v1.33.0

    1.33.0 (2026-07-13)

    Features

    kms: v1.33.0

    1.33.0 (2026-07-23)

    Features

    Changelog

    Sourced from cloud.google.com/go/kms's changelog.

    1.33.0 (2024-08-20)

    Features

    • documentai: Add support for Go 1.23 iterators (84461c0)
    Commits
    • 4f63392 chore: release main (#20195)
    • 09acbb3 feat(bigtable): add Session struct + state machine (#20117)
    • 0b4eb72 chore(cloud/sql): onboarding a new API (#20206)
    • bcbf714 feat(bigtable): add AFE picker (Simple / LeastInFlight / LeastLatency) (#20204)
    • 6e776eb ci: revert "ci: librarian to use Go 1.25.8 toolchain" (#20205)
    • f0c7260 chore(main): release bigtable 1.51.0 (#20014)
    • a466345 feat(bigtable): add sessionTracer for per-Session lifecycle + vRPC metrics (#...
    • a9990b4 chore(bigtable): remove toolchain directive (#20203)
    • 104e0de feat: update API sources and regenerate (#20188)
    • 8dfb2b4 ci: librarian to use Go 1.25.8 toolchain (#20200)
    • Additional commits viewable in compare view

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=cloud.google.com/go/kms&package-manager=go_modules&previous-version=1.32.0&new-version=1.33.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 1fc7e8a..ce6ad8a 100644 --- a/go.mod +++ b/go.mod @@ -3,7 +3,7 @@ module github.com/modelcontextprotocol/registry go 1.26 require ( - cloud.google.com/go/kms v1.32.0 + cloud.google.com/go/kms v1.33.0 github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.0 github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.5.0 github.com/caarlos0/env/v11 v11.4.1 diff --git a/go.sum b/go.sum index 4b4ab93..3c731e5 100644 --- a/go.sum +++ b/go.sum @@ -8,8 +8,8 @@ cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdB cloud.google.com/go/compute/metadata v0.9.0/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10= cloud.google.com/go/iam v1.11.0 h1:KieQ9Pb+LLPak1O3Rv3GgCxhnmkYf7Xyh0P5HfF1jFM= cloud.google.com/go/iam v1.11.0/go.mod h1:KP+nKGugNJW4LcLx1uEZcq1ok5sQHFaQehQNl4QDgV4= -cloud.google.com/go/kms v1.32.0 h1:s+rEluaaZKhLVjrIWG7uNBsnWbiitElzNzFGyp6+nIg= -cloud.google.com/go/kms v1.32.0/go.mod h1:CSGvW6GnMQbY+1nOHcIzhMtHSbExXlOmCKjWtYVjcpA= +cloud.google.com/go/kms v1.33.0 h1:pG0X78m212b2pv9N4fdMoUO69LuZGQ9kSvn8sHBOFAo= +cloud.google.com/go/kms v1.33.0/go.mod h1:CSGvW6GnMQbY+1nOHcIzhMtHSbExXlOmCKjWtYVjcpA= cloud.google.com/go/longrunning v1.2.0 h1:WjYH3YHBGCxGJP9M4dWGHBfXr/cFIjMkNgWcJj7/iMM= cloud.google.com/go/longrunning v1.2.0/go.mod h1:5KMQALFGOCtFoi2xSOA1u3H7WKlhmckgiyFw7+LGQp0= github.com/Azure/azure-sdk-for-go/sdk/azcore v1.22.0 h1:aokoqcHvaGjiM3VpjKDfMMnF/8epJ+Q1HLJ7CudztqE= From 0f78916eee940531dee2dbfb0e6842f746b9a9a6 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 7 Aug 2026 01:30:37 +0300 Subject: [PATCH 274/313] build(deps): bump docker/login-action from 4.4.0 to 4.6.0 in the actions group (#1492) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps the actions group with 1 update: [docker/login-action](https://github.com/docker/login-action). Updates `docker/login-action` from 4.4.0 to 4.6.0
    Release notes

    Sourced from docker/login-action's releases.

    v4.6.0

    Full Changelog: https://github.com/docker/login-action/compare/v4.5.2...v4.6.0

    v4.5.2

    Full Changelog: https://github.com/docker/login-action/compare/v4.5.1...v4.5.2

    v4.5.1

    Full Changelog: https://github.com/docker/login-action/compare/v4.5.0...v4.5.1

    v4.5.0

    Full Changelog: https://github.com/docker/login-action/compare/v4.4.0...v4.5.0

    Commits
    • dbcb813 Merge pull request #1051 from docker/dependabot/npm_and_yarn/aws-sdk-dependen...
    • 5bcb015 [dependabot skip] chore: update generated content
    • b30b2f2 build(deps): bump the aws-sdk-dependencies group across 1 directory with 2 up...
    • 9087f1e Merge pull request #1057 from docker/dependabot/npm_and_yarn/js-yaml-5.2.2
    • 0009830 [dependabot skip] chore: update generated content
    • 2325523 build(deps): bump js-yaml from 5.2.1 to 5.2.2
    • 4ec1d4a Merge pull request #1056 from docker/dependabot/npm_and_yarn/postcss-8.5.22
    • 5fc99ba Merge pull request #1053 from docker/dependabot/github_actions/aws-actions/co...
    • e512bd5 Merge pull request #1052 from docker/dependabot/github_actions/codeql-actions...
    • a146c91 Merge pull request #1059 from crazy-max/harden-buildx-scope-paths
    • Additional commits viewable in compare view

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=docker/login-action&package-manager=github_actions&previous-version=4.4.0&new-version=4.6.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/deploy-staging.yml | 2 +- .github/workflows/release.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml index 31d6408..eb68cfb 100644 --- a/.github/workflows/deploy-staging.yml +++ b/.github/workflows/deploy-staging.yml @@ -34,7 +34,7 @@ jobs: uses: ko-build/setup-ko@v0.10 - name: Log in to Container Registry - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f with: registry: ghcr.io username: ${{ github.actor }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 427d219..4405b31 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -57,7 +57,7 @@ jobs: uses: ko-build/setup-ko@v0.10 - name: Log in to Container Registry - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f with: registry: ghcr.io username: ${{ github.actor }} From 5c19656cb97ff40d72a622b3bb768050d3a2a045 Mon Sep 17 00:00:00 2001 From: Sash Date: Fri, 7 Aug 2026 05:38:34 +0700 Subject: [PATCH 275/313] fix(auth): reject github.io domains in DNS/HTTP token exchange (org namespace takeover) (#1506) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary - The GitHub token method grants `io.github./*` publish rights **only to org Owners** (active `admin` membership — `github_at.go`). - The DNS/HTTP token methods grant `reversed(domain)/*` for any proven domain, with no `github.io` special-casing and an empty `BlockedNamespaces` list. - `.github.io` is served by GitHub Pages from the `/.github.io` repository. **Push access to that one repository** — routinely held by ordinary org members, a much weaker bar than Owner — is enough to serve a key at `/.well-known/mcp-registry-auth`, exchange it for a JWT, and publish under the org's entire `io.github./*` namespace. - Reject `github.io` (and subdomains) at the shared `ValidateDomainAndTimestamp` seam used by both DNS and HTTP exchange; `io.github.*` publishers already have the GitHub method. ## Impact if unsolved Any org member with write access to the org's GitHub Pages repo (or an attacker compromising such a member) can mint MCP packages under the org's trusted namespace — supply-chain poisoning of every downstream user who installs ``'s servers from the registry, bypassing the deliberate Owner-only gate. ## Test plan - New `TestValidateDomainAndTimestampRejectsGitHubPages`: rejects `my-org.github.io` (incl. mixed case and subdomains), still allows lookalikes (`github.io.evil-example.com`, `my-org.github.io.example.com`) and ordinary domains. - Full `internal/api/handlers/v0/auth` package passes. Made with [Cursor](https://cursor.com) Signed-off-by: SashaMIT Co-authored-by: Cursor --- internal/api/handlers/v0/auth/common.go | 18 ++++++++++++ internal/api/handlers/v0/auth/common_test.go | 31 ++++++++++++++++++++ 2 files changed, 49 insertions(+) diff --git a/internal/api/handlers/v0/auth/common.go b/internal/api/handlers/v0/auth/common.go index 5d91047..4c79bfc 100644 --- a/internal/api/handlers/v0/auth/common.go +++ b/internal/api/handlers/v0/auth/common.go @@ -89,6 +89,12 @@ func ValidateDomainAndTimestamp(domain, timestamp string) (*time.Time, error) { return nil, fmt.Errorf("invalid domain format") } + if isGitHubPagesDomain(domain) { + return nil, fmt.Errorf( + "github.io domains cannot be used with DNS/HTTP authentication; " + + "use GitHub authentication for io.github.* namespaces") + } + ts, err := time.Parse(time.RFC3339, timestamp) if err != nil { return nil, fmt.Errorf("invalid timestamp format: %w", err) @@ -382,6 +388,18 @@ func ReverseString(domain string) string { return strings.Join(parts, ".") } +// isGitHubPagesDomain reports whether domain is github.io or a subdomain of it. +// GitHub Pages serves .github.io from the /.github.io repository, +// so the HTTP proof only demonstrates push access to that one repository. For an +// organization that is a far weaker bar than the org-Owner ("admin") check the +// GitHub authentication method enforces for io.github./* namespaces — accepting +// the proof here would let any member with write access to the Pages repo mint the +// whole org namespace. Users of io.github.* namespaces authenticate via GitHub. +func isGitHubPagesDomain(domain string) bool { + d := strings.ToLower(domain) + return d == "github.io" || strings.HasSuffix(d, ".github.io") +} + func IsValidDomain(domain string) bool { if len(domain) == 0 || len(domain) > 253 { return false diff --git a/internal/api/handlers/v0/auth/common_test.go b/internal/api/handlers/v0/auth/common_test.go index 7662116..3570646 100644 --- a/internal/api/handlers/v0/auth/common_test.go +++ b/internal/api/handlers/v0/auth/common_test.go @@ -2,6 +2,7 @@ package auth_test import ( "testing" + "time" "github.com/modelcontextprotocol/registry/internal/api/handlers/v0/auth" ) @@ -47,3 +48,33 @@ func TestIsValidDomain(t *testing.T) { }) } } + +func TestValidateDomainAndTimestampRejectsGitHubPages(t *testing.T) { + timestamp := time.Now().UTC().Format(time.RFC3339) + tests := []struct { + domain string + wantError bool + }{ + // GitHub Pages domains must not mint io.github.* namespaces via DNS/HTTP + {"my-org.github.io", true}, + {"my-org.GitHub.IO", true}, + {"github.io", true}, + {"sub.my-org.github.io", true}, + + // Lookalikes and ordinary domains stay allowed + {"github.io.evil-example.com", false}, + {"example.com", false}, + {"my-org.github.io.example.com", false}, + } + for _, tc := range tests { + t.Run(tc.domain, func(t *testing.T) { + _, err := auth.ValidateDomainAndTimestamp(tc.domain, timestamp) + if tc.wantError && err == nil { + t.Errorf("ValidateDomainAndTimestamp(%q) succeeded, want github.io rejection", tc.domain) + } + if !tc.wantError && err != nil { + t.Errorf("ValidateDomainAndTimestamp(%q) failed: %v", tc.domain, err) + } + }) + } +} From 2b09bde534d0c70ded1b0bb7ec5d112ad8646bc0 Mon Sep 17 00:00:00 2001 From: Recoordinate Date: Fri, 7 Aug 2026 10:39:30 +1200 Subject: [PATCH 276/313] docs: remove stale build.sh reference from publisher Key Files (#1504) The Key Files list in `cmd/publisher/README.md` includes a bullet for `build.sh`, but there is no `build.sh` anywhere in the repo. The publisher is built with `make publisher`, which runs `go build -o bin/mcp-publisher ./cmd/publisher` (Makefile), so there is no separate cross-platform build script. The other three entries in the same list (`main.go`, `commands/`, `auth/`) all exist. This removes the stale bullet so the list matches the actual files in the directory. --- cmd/publisher/README.md | 1 - 1 file changed, 1 deletion(-) diff --git a/cmd/publisher/README.md b/cmd/publisher/README.md index cd9b91a..235d189 100644 --- a/cmd/publisher/README.md +++ b/cmd/publisher/README.md @@ -44,4 +44,3 @@ Optional: enables `dns` and `http` methods to sign out-of-process without direct - **`main.go`** - CLI setup and command routing - **`commands/`** - Command implementations with auto-detection logic - **`auth/`** - Authentication provider implementations -- **`build.sh`** - Cross-platform build script From f52dc8525a441a3abf5fedc9912152d95af5aab1 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Fri, 7 Aug 2026 02:16:52 +0300 Subject: [PATCH 277/313] fix(deploy): cache bulk registry reads (#1509) ## Summary - cache successful public list responses for `/v0/servers` and `/v0.1/servers` at ingress-nginx for 30 seconds - give only those exact cached paths a 600 RPM per-controller budget - preserve the existing 180 RPM limit for publish, auth, mutation, detail, and other routes - expose `X-Registry-Cache` to make cache MISS/HIT behavior directly observable ## Why Production ingress logs show that the current 180 RPM per-controller limit rejects legitimate bulk pagination before it reaches the application. The affected traffic is overwhelmingly registry-list reads, not publishing. A ten-minute production sample contained 17,836 successful list responses but only 3,188 unique URLs: 82.1% were repeated requests, representing roughly 1 GB of duplicate response bodies. Raising the list limit without caching would increase pressure on the application and its shared PostgreSQL pool. The short ingress cache absorbs repeated cursor-page reads before raising their scoped client budget. Publish latency is a separate concern. Reducing read pressure may help indirectly, but slow external package validation is intentionally out of scope for this PR. Relates to #826. ## Safety - caching is limited to exact public GET list paths and keyed by host plus full request URI - only 200 responses are cached - cache lifetime is 30 seconds; newly published entries can therefore take up to 30 seconds to appear on a cached page - cache locking coalesces simultaneous misses - stale cached responses may be served while refreshing or during transient upstream 5xx/timeouts - each ingress replica uses at most 1 GB of ephemeral on-disk cache ## Validation - `go test ./...` in `deploy/` - `go vet ./...` in `deploy/` - `git diff --check` - ingress-nginx chart 4.13.0 in a disposable kind cluster - generated NGINX configuration passed `nginx -t` - repeated list request verified `X-Registry-Cache: MISS` followed by `HIT` - non-list route verified uncached - exact list locations verified with the higher rate zone while the catch-all retained 180 RPM Nothing was applied to production during investigation or validation. --- deploy/pkg/k8s/ingress.go | 25 +++++++++++ deploy/pkg/k8s/registry.go | 92 +++++++++++++++++++++++++++++++++++--- 2 files changed, 112 insertions(+), 5 deletions(-) diff --git a/deploy/pkg/k8s/ingress.go b/deploy/pkg/k8s/ingress.go index 4a24961..175cb17 100644 --- a/deploy/pkg/k8s/ingress.go +++ b/deploy/pkg/k8s/ingress.go @@ -65,6 +65,31 @@ func SetupIngressController(ctx *pulumi.Context, cluster *providers.ProviderInfo "annotations": pulumi.Map{}, }, "config": pulumi.Map{ + // Cache the public list endpoints at the ingress. Registry consumers + // repeatedly walk the same cursor pages, so sending every walk to the + // application needlessly consumes application CPU and database pool + // connections. The cache is intentionally short-lived so newly + // published servers become visible quickly. + // + // Use a variable cache zone so this global location snippet remains a + // no-op for publish, auth, mutation, and individual-server routes. + "http-snippet": pulumi.String(` +proxy_cache_path /tmp/registry-read-cache levels=1:2 keys_zone=registry_read_cache:20m max_size=1g inactive=5m use_temp_path=off; +map "$request_method:$uri" $registry_read_cache_zone { + default off; + ~^GET:/v0(?:\.1)?/servers$ registry_read_cache; +} +`), + "location-snippet": pulumi.String(` +proxy_cache $registry_read_cache_zone; +proxy_cache_key "$scheme$request_method$host$request_uri"; +proxy_cache_valid 200 30s; +proxy_cache_lock on; +proxy_cache_lock_timeout 5s; +proxy_cache_background_update on; +proxy_cache_use_stale updating error timeout http_500 http_502 http_503 http_504; +add_header X-Registry-Cache $upstream_cache_status always; +`), // Disable strict path validation, to work around a bug in ingress-nginx // https://cert-manager.io/docs/releases/release-notes/release-notes-1.18/#acme-http01-challenge-paths-now-use-pathtype-exact-in-ingress-routes // https://github.com/kubernetes/ingress-nginx/issues/11176 diff --git a/deploy/pkg/k8s/registry.go b/deploy/pkg/k8s/registry.go index 53f2d85..09ebea4 100644 --- a/deploy/pkg/k8s/registry.go +++ b/deploy/pkg/k8s/registry.go @@ -324,11 +324,12 @@ func DeployMCPRegistry(ctx *pulumi.Context, cluster *providers.ProviderInfo, env Annotations: pulumi.StringMap{ "cert-manager.io/cluster-issuer": pulumi.String("letsencrypt-prod"), "kubernetes.io/ingress.class": pulumi.String("nginx"), - // Rate limiting to protect against abuse - // Allows 180 requests/minute (3 req/sec avg), with bursts up to 540 requests - // Status code 429 is set globally via NGINX ConfigMap (per-Ingress annotation doesn't work) - "nginx.ingress.kubernetes.io/limit-rpm": pulumi.String("180"), - "nginx.ingress.kubernetes.io/limit-burst-multiplier": pulumi.String("3"), + // Rate limiting to protect against abuse. The exact bulk-list paths get a + // separate, higher budget below; all other routes retain this limit. + // Allows 180 requests/minute (3 req/sec avg), with bursts up to 540 requests. + // Status code 429 is set globally via NGINX ConfigMap (per-Ingress annotation doesn't work). + "nginx.ingress.kubernetes.io/limit-rpm": pulumi.String("180"), + "nginx.ingress.kubernetes.io/limit-burst-multiplier": pulumi.String("3"), }, }, Spec: &networkingv1.IngressSpecArgs{ @@ -369,6 +370,87 @@ func DeployMCPRegistry(ctx *pulumi.Context, cluster *providers.ProviderInfo, env return nil, err } + // Bulk registry consumers paginate the complete server list. Production + // traffic analysis on 2026-08-06 showed legitimate consumers sustaining + // roughly 10 requests/second per source IP while the catch-all Ingress only + // allowed 3 requests/second per controller replica. That caused NGINX to + // reject healthy pagination requests before they reached the application. + // The ingress controller caches these exact public paths for 30 seconds, so + // the higher client budget does not translate into the same increase in + // application and database load. + // + // ingress-nginx merges different paths for the same host across Ingress + // resources and applies each resource's annotations only to its own paths. + // Keep the canonical list endpoints on exact paths so publish, auth, edit, + // status, and individual-server reads remain protected by the lower limit. + _, err = networkingv1.NewIngress(ctx, "mcp-registry-bulk-read", &networkingv1.IngressArgs{ + Metadata: &metav1.ObjectMetaArgs{ + Name: pulumi.String("mcp-registry-bulk-read"), + Namespace: pulumi.String("default"), + Labels: pulumi.StringMap{ + "app": pulumi.String("mcp-registry"), + "environment": pulumi.String(environment), + }, + Annotations: pulumi.StringMap{ + // ingress-nginx disables response buffering by default, but NGINX + // needs it to populate the on-disk proxy cache for these paths. + "nginx.ingress.kubernetes.io/proxy-buffering": pulumi.String("on"), + // Limits are maintained independently by each ingress-nginx replica. + // At two production replicas this permits up to 1,200 requests/minute + // per source IP, while a single replica still accommodates the observed + // 10 requests/second pagination rate. + "nginx.ingress.kubernetes.io/limit-rpm": pulumi.String("600"), + "nginx.ingress.kubernetes.io/limit-burst-multiplier": pulumi.String("3"), + }, + }, + Spec: &networkingv1.IngressSpecArgs{ + IngressClassName: pulumi.String("nginx"), + Rules: pulumi.ToStringArray(hosts).ToStringArrayOutput().ApplyT(func(hosts []string) networkingv1.IngressRuleArray { + rules := make(networkingv1.IngressRuleArray, 0, len(hosts)) + for _, host := range hosts { + rules = append(rules, &networkingv1.IngressRuleArgs{ + Host: pulumi.String(host), + Http: &networkingv1.HTTPIngressRuleValueArgs{ + Paths: networkingv1.HTTPIngressPathArray{ + // Exact prevents the higher budget from applying to edit/status + // subpaths. The v0.1 dot is accepted because ingress.go disables + // strict path validation for this controller. + &networkingv1.HTTPIngressPathArgs{ + Path: pulumi.String("/v0/servers"), + PathType: pulumi.String("Exact"), + Backend: &networkingv1.IngressBackendArgs{ + Service: &networkingv1.IngressServiceBackendArgs{ + Name: service.Metadata.Name().Elem(), + Port: &networkingv1.ServiceBackendPortArgs{ + Number: pulumi.Int(80), + }, + }, + }, + }, + &networkingv1.HTTPIngressPathArgs{ + Path: pulumi.String("/v0.1/servers"), + PathType: pulumi.String("Exact"), + Backend: &networkingv1.IngressBackendArgs{ + Service: &networkingv1.IngressServiceBackendArgs{ + Name: service.Metadata.Name().Elem(), + Port: &networkingv1.ServiceBackendPortArgs{ + Number: pulumi.Int(80), + }, + }, + }, + }, + }, + }, + }) + } + return rules + }).(networkingv1.IngressRuleArrayOutput), + }, + }, pulumi.Provider(cluster.Provider), pulumi.DependsOnInputs(ingressNginx.Ready)) + if err != nil { + return nil, err + } + ctx.Export("ingressHosts", ingress.Spec.Rules().ApplyT(func(rules []networkingv1.IngressRule) []string { hosts := make([]string, 0, len(rules)) for _, rule := range rules { From f36b7dd4afe2d540a4ceb9b64d3627085bf5db03 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Fri, 7 Aug 2026 02:43:14 +0300 Subject: [PATCH 278/313] chore(deploy): promote production to 1.8.1 (#1510) ## Summary Promote the production registry image from `1.8.0` to [`1.8.1`](https://github.com/modelcontextprotocol/registry/releases/tag/v1.8.1). This release includes #1509, which adds a short ingress cache and a scoped rate-limit increase for the exact public registry-list endpoints. ## Staging verification - release tag points to `f52dc8525a441a3abf5fedc9912152d95af5aab1`, the commit deployed to staging - staging deployment and CI workflows completed successfully - both registry replicas became ready with zero restarts - rendered NGINX configuration kept the root route at 180 RPM with buffering off - exact `/v0/servers` and `/v0.1/servers` routes rendered at 600 RPM with buffering on - live cache probe returned `MISS`, then `HIT` - health and unrelated routes remained uncached - no application 5xx, serious NGINX errors, or application error logs were observed after rollout ## Release artifact - release workflow completed successfully - `ghcr.io/modelcontextprotocol/registry:1.8.1` is available for `linux/amd64` and `linux/arm64` ## Deployment and rollback Merging this PR triggers the production Pulumi deployment automatically. Monitor registry pod readiness, NGINX reloads, cache behavior, origin request volume, 429/499/5xx responses, and publish requests exceeding 10 seconds. Rollback by restoring `mcp-registry:imageTag` to `1.8.0`. --- deploy/Pulumi.gcpProd.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/deploy/Pulumi.gcpProd.yaml b/deploy/Pulumi.gcpProd.yaml index d4eaaee..6645551 100644 --- a/deploy/Pulumi.gcpProd.yaml +++ b/deploy/Pulumi.gcpProd.yaml @@ -1,7 +1,7 @@ config: mcp-registry:environment: prod mcp-registry:provider: gcp - mcp-registry:imageTag: 1.8.0 # Set specific image tag for production (change this to deploy different versions) + mcp-registry:imageTag: 1.8.1 # Set specific image tag for production (change this to deploy different versions) gcp:project: mcp-registry-prod mcp-registry:githubClientId: Iv23liUydBbI7Z2Q9bOZ mcp-registry:githubClientSecret: From 4508c48f801189648879fd0cdf7989910b437ee3 Mon Sep 17 00:00:00 2001 From: Recoordinate <296084221+latent-9@users.noreply.github.com> Date: Tue, 11 Aug 2026 00:18:22 +1200 Subject: [PATCH 279/313] Fix broken relative links in releasing docs (#1517) The three deployment links in `docs/contributing/releasing.md` use `../../../`, which resolves above the repository root and 404s on GitHub. The file lives in `docs/contributing/`, so the repo root is two levels up and `../../` is correct. This fixes the links to `deploy-production.yml`, `deploy-staging.yml`, and `deploy/README.md` (all three targets exist at the repo root). No content change. --- docs/contributing/releasing.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/contributing/releasing.md b/docs/contributing/releasing.md index bbf9345..d7b625f 100644 --- a/docs/contributing/releasing.md +++ b/docs/contributing/releasing.md @@ -27,13 +27,13 @@ Releases do not automatically deploy to production. To deploy a release: 1. Update `mcp-registry:imageTag` in `deploy/Pulumi.gcpProd.yaml` to the desired version (e.g., `1.2.3` - note: no 'v' prefix) 2. Commit and push the change to the `main` branch (either through a PR or by pushing directly to main) -3. The [deploy-production.yml](../../../.github/workflows/deploy-production.yml) workflow will automatically trigger and deploy the specified version +3. The [deploy-production.yml](../../.github/workflows/deploy-production.yml) workflow will automatically trigger and deploy the specified version -See the [deployment documentation](../../../deploy/README.md) for more details. +See the [deployment documentation](../../deploy/README.md) for more details. ## Staging -Staging auto-deploys from `main` via [deploy-staging.yml](../../../.github/workflows/deploy-staging.yml). It always runs the latest `main` branch code. +Staging auto-deploys from `main` via [deploy-staging.yml](../../.github/workflows/deploy-staging.yml). It always runs the latest `main` branch code. ## Rollback From 03aeca562f72cf1444cde2d0afd5b0a77f03911a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 10 Aug 2026 15:18:42 +0300 Subject: [PATCH 280/313] build(deps): bump github.com/go-git/go-git/v6 from 6.0.0-alpha.4 to 6.0.0-alpha.5 in /deploy (#1514) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [github.com/go-git/go-git/v6](https://github.com/go-git/go-git) from 6.0.0-alpha.4 to 6.0.0-alpha.5.
    Release notes

    Sourced from github.com/go-git/go-git/v6's releases.

    v6.0.0-alpha.5

    What's Changed

    ... (truncated)

    Commits
    • fc18716 Merge pull request #2276 from go-git/checkout
    • 9b81545 Merge pull request #2280 from go-git/renovate/main-github-actions
    • 8ec84d1 build: Update github-actions
    • 8bff611 Merge pull request #2279 from glitch-ux/fix/gitignore-trailing-doublestar-ove...
    • 3189ee9 plumbing: format/gitignore, fix trailing ** matching unrelated paths. Fixes #...
    • ffa616a Merge pull request #2274 from go-git/renovate/main-major-github-actions
    • e6df965 build: Update github-actions to v7
    • 661d1c7 git: worktree, make the filesystem wrapper a symlink-safe boundary
    • b092a7b Merge pull request #2273 from go-git/renovate/main-github-actions
    • d4b7d93 build: Update github-actions
    • Additional commits viewable in compare view

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/go-git/go-git/v6&package-manager=go_modules&previous-version=6.0.0-alpha.4&new-version=6.0.0-alpha.5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/modelcontextprotocol/registry/network/alerts).
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- deploy/go.mod | 20 ++++++++++---------- deploy/go.sum | 40 ++++++++++++++++++++-------------------- 2 files changed, 30 insertions(+), 30 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index b2365a5..d0c5488 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -34,8 +34,8 @@ require ( github.com/emirpasic/gods v1.18.1 // indirect github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect github.com/go-git/gcfg/v2 v2.0.2 // indirect - github.com/go-git/go-billy/v6 v6.0.0-alpha.1 // indirect - github.com/go-git/go-git/v6 v6.0.0-alpha.4 // indirect + github.com/go-git/go-billy/v6 v6.0.0-alpha.2 // indirect + github.com/go-git/go-git/v6 v6.0.0-alpha.5 // indirect github.com/go-logr/logr v1.4.3 // indirect github.com/go-logr/stdr v1.2.2 // indirect github.com/gogo/protobuf v1.3.2 // indirect @@ -99,14 +99,14 @@ require ( go.opentelemetry.io/proto/otlp v1.10.0 // indirect go.uber.org/atomic v1.11.0 // indirect go.uber.org/multierr v1.11.0 // indirect - golang.org/x/crypto v0.52.0 // indirect - golang.org/x/mod v0.35.0 // indirect - golang.org/x/net v0.55.0 // indirect - golang.org/x/sync v0.20.0 // indirect - golang.org/x/sys v0.45.0 // indirect - golang.org/x/term v0.43.0 // indirect - golang.org/x/text v0.37.0 // indirect - golang.org/x/tools v0.44.0 // indirect + golang.org/x/crypto v0.54.0 // indirect + golang.org/x/mod v0.37.0 // indirect + golang.org/x/net v0.57.0 // indirect + golang.org/x/sync v0.22.0 // indirect + golang.org/x/sys v0.47.0 // indirect + golang.org/x/term v0.45.0 // indirect + golang.org/x/text v0.40.0 // indirect + golang.org/x/tools v0.47.0 // indirect google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect google.golang.org/grpc v1.82.1 // indirect diff --git a/deploy/go.sum b/deploy/go.sum index f55881a..a5e4f9a 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -62,12 +62,12 @@ github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c= github.com/gliderlabs/ssh v0.3.8/go.mod h1:xYoytBv1sV0aL3CavoDuJIQNURXkkfPA/wxQ1pL1fAU= github.com/go-git/gcfg/v2 v2.0.2 h1:MY5SIIfTGGEMhdA7d7JePuVVxtKL7Hp+ApGDJAJ7dpo= github.com/go-git/gcfg/v2 v2.0.2/go.mod h1:/lv2NsxvhepuMrldsFilrgct6pxzpGdSRC13ydTLSLs= -github.com/go-git/go-billy/v6 v6.0.0-alpha.1 h1:xVjAR4oUvrKy7/Xuw/lLlV3gkxR3KO2H8W+MamuVVsQ= -github.com/go-git/go-billy/v6 v6.0.0-alpha.1/go.mod h1:eaCUpHbedW7//EwcYmUDfJe2N6sJC9O12AT0OTqJR1E= +github.com/go-git/go-billy/v6 v6.0.0-alpha.2 h1:1Sv5WemXL8CxKrAx1gioJ+uHNb2bZJhiQLfwSZ4Et8c= +github.com/go-git/go-billy/v6 v6.0.0-alpha.2/go.mod h1:r/bsv9i/iDyyEU8/Z6mjC+YraOVwie1ddfUqBCElKXQ= github.com/go-git/go-git-fixtures/v6 v6.0.0-alpha.1 h1:gmqi2jvsreu0s8JMLylYDFq4sbjHwwlhktMw0DUg3mA= github.com/go-git/go-git-fixtures/v6 v6.0.0-alpha.1/go.mod h1:ECf1MqJlBdYpKggBrOXjo/0EnvRZx6D++I86UYjPgAQ= -github.com/go-git/go-git/v6 v6.0.0-alpha.4 h1:aDTc2UGanmaE7FkGLSlBEB9nohMnQ+RKXcfq/D+esDQ= -github.com/go-git/go-git/v6 v6.0.0-alpha.4/go.mod h1:4ODa/G7hPWrh4Y+7lmt59Ij3zW38IEfvRoAZxLYYBhc= +github.com/go-git/go-git/v6 v6.0.0-alpha.5 h1:sE+OlkHgYWNMVmN1s9sR7uyFgsWLtxcNWse/vBYKxRE= +github.com/go-git/go-git/v6 v6.0.0-alpha.5/go.mod h1:3IjhiZnM+uBmUrOGSeqrJpsmi4Vd0H2NZO/uK2a7d0s= github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= @@ -261,28 +261,28 @@ go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= -golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988= -golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc= +golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw= +golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk= golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJkhzJCK5J6kUi1NTVXfM= golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f/go.mod h1:J1xhfL/vlindoeF/aINzNzt2Bket5bjo9sdOYzOsU80= golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY= golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg= golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= -golang.org/x/mod v0.35.0 h1:Ww1D637e6Pg+Zb2KrWfHQUnH2dQRLBQyAtpr/haaJeM= -golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU= +golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ= +golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0= golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20200421231249-e086a090c8fd/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A= golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= -golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8= -golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww= +golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE= +golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4= -golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= +golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek= +golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= @@ -291,22 +291,22 @@ golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7w golang.org/x/sys v0.0.0-20200909081042-eff7692f9009/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY= -golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= -golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4= -golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk= +golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs= +golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= +golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0= +golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= -golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc= -golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38= +golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs= +golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20181030221726-6c7e314b6563/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28= golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE= golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA= -golang.org/x/tools v0.44.0 h1:UP4ajHPIcuMjT1GqzDWRlalUEoY+uzoZKnhOjbIPD2c= -golang.org/x/tools v0.44.0/go.mod h1:KA0AfVErSdxRZIsOVipbv3rQhVXTnlU6UhKxHd1seDI= +golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q= +golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= From 69374b08deb479d65028236405683c94d67280fc Mon Sep 17 00:00:00 2001 From: Wolfe-James Date: Mon, 10 Aug 2026 08:19:06 -0400 Subject: [PATCH 281/313] docs: add cargo and crates.io to schema examples (#1511) The cargo registry type has been live since v1.8.0 (#1207). This PR only updates the schema examples so they match reality. - Add "cargo" to registryType.examples - Add "https://crates.io" to registryBaseUrl.examples No behaviour change. Note: versioned schemas are synced from modelcontextprotocol/static. A follow-up there keeps this durable across schema sync. Co-authored-by: Wolfe-Jam --- internal/validators/schemas/2025-12-11.json | 2 ++ 1 file changed, 2 insertions(+) diff --git a/internal/validators/schemas/2025-12-11.json b/internal/validators/schemas/2025-12-11.json index 70902ed..718aaca 100644 --- a/internal/validators/schemas/2025-12-11.json +++ b/internal/validators/schemas/2025-12-11.json @@ -239,6 +239,7 @@ "examples": [ "https://registry.npmjs.org", "https://pypi.org", + "https://crates.io", "https://docker.io", "https://api.nuget.org/v3/index.json", "https://github.com", @@ -252,6 +253,7 @@ "examples": [ "npm", "pypi", + "cargo", "oci", "nuget", "mcpb" From 43fbc1dcbd86f4df447c64e7bd6e08a6cff44cc6 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Mon, 10 Aug 2026 16:24:06 +0300 Subject: [PATCH 282/313] fix(admin): use PATCH status endpoints in takedown script and runbook (#1518) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The admin takedown script cannot work as written, and the runbook that documents it has the same problem. ## The bug `tools/admin/takedown.sh` sent `PUT` with a `?status=deleted` query parameter to two routes: | What the script sent | Reality | |---|---| | `PUT /v0/servers/{name}/versions/{version}?status=deleted` | Route exists, but requires a full `ServerJSON` body and has no `status` query parameter | | `PUT /v0/servers/{name}?status=deleted` | **Not registered at all** — the whole-server takedown path 404s | The real endpoints are `PATCH /v0/servers/{name}/versions/{version}/status` and `PATCH /v0/servers/{name}/status` ([status.go:83](https://github.com/modelcontextprotocol/registry/blob/main/internal/api/handlers/v0/status.go#L83), [:198](https://github.com/modelcontextprotocol/registry/blob/main/internal/api/handlers/v0/status.go#L198)), both taking `{"status": ..., "statusMessage": ...}`. `edit.go` even says so in its own description: use the status endpoint for status changes. ## Script changes - Send `PATCH` with a JSON body built via `jq` - **Require `VERSION` or `ALL_VERSIONS=true` explicitly.** Previously a missing `VERSION` meant "entire server". Since `PATCH .../status` updates *every* version, an operator who simply forgot `VERSION` would have taken down the whole server. Now that needs saying out loud. - Support `STATUS` (default `deleted`) and `STATUS_MESSAGE`, so a takedown can record its reason - `set -euo pipefail`, non-zero exit on HTTP errors, and print the response body so huma error detail is visible instead of being swallowed ## Runbook changes - `GET /v0/servers/{name}` is not a route — use `GET .../versions/latest` (which is supported, see [servers.go:155-178](https://github.com/modelcontextprotocol/registry/blob/main/internal/api/handlers/v0/servers.go#L155)) - Replace the per-version `?status=deleted` loop with the single all-versions `PATCH .../status` call, which reports `updatedCount` - Keep the per-version `PUT` loop for *content* edits, which genuinely has no bulk endpoint, and show that it needs the full body - Correct the closing note claiming server-wide changes must be applied per version — true for content, not for status - Fix the broken `moderation-guidelines.md` link (dead since the docs restructuring; the file is now `modelcontextprotocol-io/moderation-policy.mdx`) ## Verification `shellcheck` clean, `bash -n` clean, and all three guard paths exercised (no args / neither VERSION nor ALL_VERSIONS / both set). Both `PATCH` paths confirmed present in `docs/reference/api/openapi.yaml`. I did not run a live takedown against production. Kept on `/v0` rather than `/v0.1` to match the existing admin/deploy convention — happy to switch if you would rather admin tooling target the frozen version. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5 --- docs/administration/admin-operations.md | 91 +++++++++++++++++------- tools/admin/takedown.sh | 93 +++++++++++++++++++------ 2 files changed, 138 insertions(+), 46 deletions(-) diff --git a/docs/administration/admin-operations.md b/docs/administration/admin-operations.md index 6b3a04d..f3131bf 100644 --- a/docs/administration/admin-operations.md +++ b/docs/administration/admin-operations.md @@ -1,6 +1,6 @@ # Admin Operations -This is a brief guide for admins and moderators managing content on the registry. All actions should be taken in line with the [moderation guidelines](moderation-guidelines.md). +This is a brief guide for admins and moderators managing content on the registry. All actions should be taken in line with the [moderation policy](../modelcontextprotocol-io/moderation-policy.mdx). ## Prerequisites @@ -33,8 +33,8 @@ ENCODED_SERVER_NAME=$(echo "$SERVER_NAME" | sed 's|/|%2F|g') # Get specific version curl -s "https://registry.modelcontextprotocol.io/v0/servers/${ENCODED_SERVER_NAME}/versions/${VERSION}" > server.json -# Or get latest version (omit /versions/VERSION) -curl -s "https://registry.modelcontextprotocol.io/v0/servers/${ENCODED_SERVER_NAME}" > server.json +# Or get the latest version (use the special version "latest") +curl -s "https://registry.modelcontextprotocol.io/v0/servers/${ENCODED_SERVER_NAME}/versions/latest" > server.json ``` ### Step 2: Make Changes @@ -44,19 +44,46 @@ Open `server.json` and edit the specific version details. You cannot change the ### Step 3: Update Version ```bash -# Update specific version +# Update specific version (requires the full server.json body) curl -X PUT "https://registry.modelcontextprotocol.io/v0/servers/${ENCODED_SERVER_NAME}/versions/${VERSION}" \ -H "Authorization: Bearer ${REGISTRY_TOKEN}" \ -H "Content-Type: application/json" \ -d "$(cat server.json)" +``` +To change **only** the status of a version, use the status endpoint instead — it does not require +the full server configuration: + +```bash +curl -X PATCH "https://registry.modelcontextprotocol.io/v0/servers/${ENCODED_SERVER_NAME}/versions/${VERSION}/status" \ + -H "Authorization: Bearer ${REGISTRY_TOKEN}" \ + -H "Content-Type: application/json" \ + -d '{"status": "deprecated", "statusMessage": "Superseded by v2"}' ``` ## Edit an Entire Server (All Versions) -Use this when you need to apply changes across all versions of a server (e.g., mark entire server as deleted, apply content scrubbing). +### Status Changes Across All Versions -### Step 1: List All Versions +A status change applies to every version of a server in a single request. The response reports +how many versions were updated in `updatedCount`. + +```bash +export SERVER_NAME="" # e.g., "com.example/my-server" +ENCODED_SERVER_NAME=$(echo "$SERVER_NAME" | sed 's|/|%2F|g') + +curl -X PATCH "https://registry.modelcontextprotocol.io/v0/servers/${ENCODED_SERVER_NAME}/status" \ + -H "Authorization: Bearer ${REGISTRY_TOKEN}" \ + -H "Content-Type: application/json" \ + -d '{"status": "deleted", "statusMessage": "Removed per moderation policy"}' +``` + +### Content Changes Across All Versions + +Content edits (e.g. scrubbing sensitive text from descriptions) have no bulk endpoint and must be +applied per version using the edit endpoint, which takes the full server configuration. + +#### Step 1: List All Versions ```bash export SERVER_NAME="" # e.g., "com.example/my-server" @@ -65,29 +92,32 @@ ENCODED_SERVER_NAME=$(echo "$SERVER_NAME" | sed 's|/|%2F|g') curl -s "https://registry.modelcontextprotocol.io/v0/servers/${ENCODED_SERVER_NAME}/versions" > all_versions.json ``` -### Step 2: Extract Versions +#### Step 2: Extract Versions ```bash # Extract all versions from the server jq -r '.servers[].server.version' all_versions.json > versions.txt ``` -### Step 3: Apply Changes to All Versions +#### Step 3: Apply Changes to Each Version ```bash -# For each version, apply changes using the edit endpoint while read VERSION; do echo "Processing version: $VERSION" - # Apply your changes here (e.g., set status to "deleted") - curl -X PUT "https://registry.modelcontextprotocol.io/v0/servers/${ENCODED_SERVER_NAME}/versions/${VERSION}?status=deleted" \ + # Download the version, edit it, then send the full body back + curl -s "https://registry.modelcontextprotocol.io/v0/servers/${ENCODED_SERVER_NAME}/versions/${VERSION}" > version.json + + # Apply your changes to version.json here, then: + curl -X PUT "https://registry.modelcontextprotocol.io/v0/servers/${ENCODED_SERVER_NAME}/versions/${VERSION}" \ -H "Authorization: Bearer ${REGISTRY_TOKEN}" \ - -H "Content-Type: application/json" + -H "Content-Type: application/json" \ + -d "$(cat version.json)" done < versions.txt # Clean up temporary files -rm versions.txt all_versions.json +rm -f versions.txt all_versions.json version.json ``` ## Quick Operations @@ -98,7 +128,7 @@ rm versions.txt all_versions.json export SERVER_NAME="" # e.g., "com.example/my-server" ENCODED_SERVER_NAME=$(echo "$SERVER_NAME" | sed 's|/|%2F|g') -curl -s "https://registry.modelcontextprotocol.io/v0/servers/${ENCODED_SERVER_NAME}" > latest_version.json +curl -s "https://registry.modelcontextprotocol.io/v0/servers/${ENCODED_SERVER_NAME}/versions/latest" > latest_version.json export VERSION=$(jq -r '.server.version' latest_version.json) echo "Latest version: $VERSION" ``` @@ -113,30 +143,37 @@ export REGISTRY_TOKEN="" REGISTRY_TOKEN="$REGISTRY_TOKEN" SERVER_NAME="$SERVER_NAME" VERSION="$VERSION" ./tools/admin/takedown.sh ``` -### Takedown Latest Version (Entire Server) +### Takedown All Versions of a Server + +`ALL_VERSIONS=true` marks every version as deleted in a single request. The script requires either +`VERSION` or `ALL_VERSIONS` to be set explicitly, so a forgotten `VERSION` cannot take down a whole +server by accident. ```bash export SERVER_NAME="" # e.g., "com.example/my-server" export REGISTRY_TOKEN="" -# This marks the latest version as deleted -REGISTRY_TOKEN="$REGISTRY_TOKEN" SERVER_NAME="$SERVER_NAME" ./tools/admin/takedown.sh +REGISTRY_TOKEN="$REGISTRY_TOKEN" SERVER_NAME="$SERVER_NAME" ALL_VERSIONS=true ./tools/admin/takedown.sh ``` -### Takedown All Versions of a Server +### Takedown the Latest Version Only ```bash export SERVER_NAME="" # e.g., "com.example/my-server" export REGISTRY_TOKEN="" ENCODED_SERVER_NAME=$(echo "$SERVER_NAME" | sed 's|/|%2F|g') -# Get all versions and takedown each one -curl -s "https://registry.modelcontextprotocol.io/v0/servers/${ENCODED_SERVER_NAME}/versions" | \ - jq -r '.servers[].server.version' | \ - while read VERSION; do - echo "Taking down version: $VERSION" - REGISTRY_TOKEN="$REGISTRY_TOKEN" SERVER_NAME="$SERVER_NAME" VERSION="$VERSION" ./tools/admin/takedown.sh - done +# Resolve the latest version, then take down that specific version +VERSION=$(curl -s "https://registry.modelcontextprotocol.io/v0/servers/${ENCODED_SERVER_NAME}/versions/latest" | jq -r '.server.version') + +REGISTRY_TOKEN="$REGISTRY_TOKEN" SERVER_NAME="$SERVER_NAME" VERSION="$VERSION" ./tools/admin/takedown.sh +``` + +### Record a Reason with a Takedown + +```bash +REGISTRY_TOKEN="$REGISTRY_TOKEN" SERVER_NAME="$SERVER_NAME" ALL_VERSIONS=true \ + STATUS_MESSAGE="Removed per moderation policy" ./tools/admin/takedown.sh ``` ## Connecting to the Production Database @@ -179,6 +216,8 @@ Any write attempts will fail with an error until you disconnect. ## Notes - **Version-specific changes**: Only affect that particular version -- **Server-wide changes**: Must be applied to each version individually +- **Server-wide status changes**: `PATCH /v0/servers/{serverName}/status` updates every version in one request +- **Server-wide content changes**: Have no bulk endpoint and must be applied to each version individually +- **Status vs. edit**: Use `PATCH .../status` to change status alone; the `PUT` edit endpoint requires the full server configuration - **Content scrubbing**: Use the version-specific edit workflow to scrub sensitive content - **Server name**: Cannot be changed in any version (it's the immutable identifier) diff --git a/tools/admin/takedown.sh b/tools/admin/takedown.sh index d53babf..d6b7dff 100755 --- a/tools/admin/takedown.sh +++ b/tools/admin/takedown.sh @@ -1,30 +1,83 @@ #!/bin/bash -# Simple takedown script +# Set the lifecycle status of an MCP server, either for one version or for every version. + +set -euo pipefail REGISTRY_URL="${REGISTRY_URL:-https://registry.modelcontextprotocol.io}" +STATUS="${STATUS:-deleted}" +SERVER_NAME="${SERVER_NAME:-}" +VERSION="${VERSION:-}" +ALL_VERSIONS="${ALL_VERSIONS:-}" +STATUS_MESSAGE="${STATUS_MESSAGE:-}" -if [ -z "$SERVER_NAME" ] || [ -z "$REGISTRY_TOKEN" ]; then - echo "Usage: REGISTRY_TOKEN= SERVER_NAME= [VERSION=] $0" - echo "Example: REGISTRY_TOKEN=token SERVER_NAME=com.example/my-server ./takedown.sh" - echo "Example: REGISTRY_TOKEN=token SERVER_NAME=com.example/my-server VERSION=1.0.0 ./takedown.sh" +usage() { + cat <<'EOF' +Usage: + REGISTRY_TOKEN= SERVER_NAME= VERSION= ./takedown.sh + REGISTRY_TOKEN= SERVER_NAME= ALL_VERSIONS=true ./takedown.sh + +Examples: + REGISTRY_TOKEN=token SERVER_NAME=com.example/my-server VERSION=1.0.0 ./takedown.sh + REGISTRY_TOKEN=token SERVER_NAME=com.example/my-server ALL_VERSIONS=true ./takedown.sh + +Optional environment variables: + STATUS active | deprecated | deleted (default: deleted) + STATUS_MESSAGE reason recorded alongside the status change (max 500 characters) + REGISTRY_URL registry base URL (default: https://registry.modelcontextprotocol.io) +EOF +} + +if [ -z "$SERVER_NAME" ] || [ -z "${REGISTRY_TOKEN:-}" ]; then + usage exit 1 fi -# URL encode the server name (replace / with %2F) -ENCODED_SERVER_NAME=$(echo "$SERVER_NAME" | sed 's|/|%2F|g') - -# Determine the endpoint based on whether VERSION is provided -if [ -n "$VERSION" ]; then - # Mark specific version as deleted - ENDPOINT="${REGISTRY_URL}/v0/servers/${ENCODED_SERVER_NAME}/versions/${VERSION}?status=deleted" - echo "Marking version $VERSION of server $SERVER_NAME as deleted..." -else - # Mark entire server as deleted (latest version) - ENDPOINT="${REGISTRY_URL}/v0/servers/${ENCODED_SERVER_NAME}?status=deleted" - echo "Marking server $SERVER_NAME as deleted..." +# Require an explicit choice, so that a forgotten VERSION cannot silently take +# down every version of a server. +if [ -n "$VERSION" ] && [ -n "$ALL_VERSIONS" ]; then + echo "Error: set either VERSION or ALL_VERSIONS, not both." >&2 + exit 1 +fi +if [ -z "$VERSION" ] && [ -z "$ALL_VERSIONS" ]; then + echo "Error: set VERSION= for a single version, or ALL_VERSIONS=true for every version." >&2 + echo >&2 + usage + exit 1 fi -# Update server status to deleted -curl -X PUT "$ENDPOINT" \ +# URL encode the server name and version (replace / with %2F) +ENCODED_SERVER_NAME="${SERVER_NAME//\//%2F}" + +if [ -n "$VERSION" ]; then + ENCODED_VERSION="${VERSION//\//%2F}" + ENDPOINT="${REGISTRY_URL}/v0/servers/${ENCODED_SERVER_NAME}/versions/${ENCODED_VERSION}/status" + echo "Setting version ${VERSION} of ${SERVER_NAME} to '${STATUS}'..." +else + ENDPOINT="${REGISTRY_URL}/v0/servers/${ENCODED_SERVER_NAME}/status" + echo "Setting ALL versions of ${SERVER_NAME} to '${STATUS}'..." +fi + +if [ -n "$STATUS_MESSAGE" ]; then + BODY=$(jq -n --arg status "$STATUS" --arg message "$STATUS_MESSAGE" \ + '{status: $status, statusMessage: $message}') +else + BODY=$(jq -n --arg status "$STATUS" '{status: $status}') +fi + +RESPONSE_BODY=$(mktemp) +trap 'rm -f "$RESPONSE_BODY"' EXIT + +HTTP_CODE=$(curl -sS -X PATCH "$ENDPOINT" \ -H "Authorization: Bearer ${REGISTRY_TOKEN}" \ - -H "Content-Type: application/json" \ No newline at end of file + -H "Content-Type: application/json" \ + -d "$BODY" \ + -o "$RESPONSE_BODY" \ + -w '%{http_code}') + +cat "$RESPONSE_BODY" +echo + +if [ "$HTTP_CODE" -lt 200 ] || [ "$HTTP_CODE" -ge 300 ]; then + echo "Request failed with HTTP ${HTTP_CODE}" >&2 + exit 1 +fi From 43402d8f6fc728dc027be96b7218fcb2495517dc Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Mon, 10 Aug 2026 16:25:00 +0300 Subject: [PATCH 283/313] fix(publisher): document --algorithm for ECDSA login and fix validate --help (#1519) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two real defects, plus the CLI reference claims that go with them. ## 1. ECDSA P-384 login instructions cannot work Every "ECDSA P-384" tab ran the *identical* command to the Ed25519 tab. Since `--algorithm` defaults to ed25519 ([login.go:100](https://github.com/modelcontextprotocol/registry/blob/main/cmd/publisher/commands/login.go#L100)), a 96-hex key is rejected outright. Verified against a freshly generated P-384 key: ``` $ mcp-publisher login dns --domain=example.com --private-key=$KEY Signing in process using key algorithm ed25519 Error: failed to get token: failed to sign timestamp: invalid seed length: expected 32 bytes, got 48 $ mcp-publisher login dns --algorithm ecdsap384 --domain=example.com --private-key=$KEY Signing in process using key algorithm ecdsap384 Expected proof record: # works ``` `--algorithm` is registered at [login.go:129](https://github.com/modelcontextprotocol/registry/blob/main/cmd/publisher/commands/login.go#L129) and described correctly by the CLI's own help, but `grep -rn algorithm docs/` had **zero** hits for it. Anyone following the ECDSA path in the docs hit that error with nothing to tell them why. Fixed at all four in-process ECDSA sites (2 in `authentication.mdx`, 2 in `cli/commands.md`), with a note that cloud signing providers derive the algorithm from the key itself so the flag does not apply to them. ## 2. `mcp-publisher validate --help` was broken ``` $ mcp-publisher validate --help Unknown command: validate ... Use 'mcp-publisher --help' for more information about a command. ``` It printed the very instruction that had just failed. `main.go` intercepted `--help` for all subcommands and called `printCommandHelp`, whose switch had no `validate` case — making `ValidateCommand`'s own help block ([validate.go:120-129](https://github.com/modelcontextprotocol/registry/blob/main/cmd/publisher/commands/validate.go#L120)) unreachable. Rather than paste a third copy of the help text, `printCommandHelp` now returns whether it handled the command, and the caller falls through to normal dispatch when it did not. Commands own their own `--help`, and any future command with this shape works automatically. | Command | Before | After | |---|---|---| | `validate --help` | `Unknown command`, exit 0 | prints its help, exit 0 | | `publish --help` | works | works | | `init -h` | works | works | | `bogus --help` | `Unknown command`, exit 0 | `Unknown command`, **exit 1** | ## 3. CLI reference corrections - **`--registry` is not global.** It exists only on `login`; other commands read the URL from the stored token. `publish --registry=URL` silently treats the flag as the `server.json` path. `cmd/publisher/README.md` had exactly this broken example. - **`--token` was undocumented** despite `github-actions.mdx:123` depending on it. Now documented, noting it is `login github` only. - **`init` takes no flags** and does not prompt; it writes `TODO:` placeholders. The reference said `init [options]` and "Prompts for missing required fields". - **Refreshed the `--help` transcript** in `quickstart.mdx`, which listed only 4 of 6 commands. Now byte-for-byte identical to real output (diffed). - **Added `validate`** to the command list in `cmd/publisher/README.md`. ## Verification `go build` and `go test ./cmd/...` pass. All four help paths exercised with exit codes checked. The 23 `goconst` findings in `validate_test.go` are pre-existing — identical count on pristine `main`, none in `main.go`. Quickstart transcript diffed against real output. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5 --- cmd/publisher/README.md | 6 +++- cmd/publisher/main.go | 18 +++++++---- .../authentication.mdx | 4 +-- docs/modelcontextprotocol-io/quickstart.mdx | 4 +++ docs/reference/cli/commands.md | 30 ++++++++++++++----- 5 files changed, 45 insertions(+), 17 deletions(-) diff --git a/cmd/publisher/README.md b/cmd/publisher/README.md index 235d189..3a5a792 100644 --- a/cmd/publisher/README.md +++ b/cmd/publisher/README.md @@ -14,9 +14,12 @@ make publisher make dev-compose # Start local registry ./bin/mcp-publisher init ./bin/mcp-publisher login none --registry=http://localhost:8080 -./bin/mcp-publisher publish --registry=http://localhost:8080 +./bin/mcp-publisher publish ``` +`publish` takes the registry URL from the token saved by `login`, so it accepts no `--registry` +flag — passing one would be read as the `server.json` path. + ## Architecture ### Commands @@ -24,6 +27,7 @@ make dev-compose # Start local registry - **`login`** - Handle authentication (github, dns, http, none) - **`publish`** - Validate and upload servers to registry - **`status`** - Update server lifecycle status (active, deprecated, deleted) +- **`validate`** - Validate server.json without publishing - **`logout`** - Clear stored credentials ### Authentication Providers diff --git a/cmd/publisher/main.go b/cmd/publisher/main.go index 20cea2b..8f7de09 100644 --- a/cmd/publisher/main.go +++ b/cmd/publisher/main.go @@ -27,10 +27,12 @@ func main() { os.Exit(1) } - // Check for help flag for subcommands + // Check for help flag for subcommands. Commands without an entry in + // printCommandHelp handle --help themselves, so fall through to dispatch. if len(os.Args) >= 3 && (os.Args[2] == "--help" || os.Args[2] == "-h") { - printCommandHelp(os.Args[1]) - return + if printCommandHelp(os.Args[1]) { + return + } } var err error @@ -81,7 +83,10 @@ func printUsage() { _, _ = fmt.Fprintln(os.Stdout, "Use 'mcp-publisher --help' for more information about a command.") } -func printCommandHelp(command string) { +// printCommandHelp prints help for a specific command and reports whether it had +// an entry here. Commands without one parse --help themselves, so the caller +// should fall through to normal dispatch when this returns false. +func printCommandHelp(command string) bool { switch command { case "init": _, _ = fmt.Fprintln(os.Stdout, "Create a server.json file template") @@ -165,7 +170,8 @@ func printCommandHelp(command string) { _, _ = fmt.Fprintln(os.Stdout, "You must be logged in before updating status. Run 'mcp-publisher login' first.") default: - fmt.Fprintf(os.Stderr, "Unknown command: %s\n", command) - printUsage() + return false } + + return true } diff --git a/docs/modelcontextprotocol-io/authentication.mdx b/docs/modelcontextprotocol-io/authentication.mdx index 9812fcc..59d7218 100644 --- a/docs/modelcontextprotocol-io/authentication.mdx +++ b/docs/modelcontextprotocol-io/authentication.mdx @@ -174,7 +174,7 @@ mcp-publisher login dns --domain "${MY_DOMAIN}" --private-key "${PRIVATE_KEY}" MY_DOMAIN="example.com" PRIVATE_KEY="$(openssl ec -in key.pem -noout -text | grep -A4 "priv:" | tail -n +2 | tr -d ' :\n')" -mcp-publisher login dns --domain "${MY_DOMAIN}" --private-key "${PRIVATE_KEY}" +mcp-publisher login dns --algorithm ecdsap384 --domain "${MY_DOMAIN}" --private-key "${PRIVATE_KEY}" ``` ```bash Google KMS @@ -298,7 +298,7 @@ mcp-publisher login http --domain "${MY_DOMAIN}" --private-key "${PRIVATE_KEY}" ```bash ECDSA P-384 MY_DOMAIN="example.com" PRIVATE_KEY="$(openssl ec -in key.pem -noout -text | grep -A4 "priv:" | tail -n +2 | tr -d ' :\n')" -mcp-publisher login http --domain "${MY_DOMAIN}" --private-key "${PRIVATE_KEY}" +mcp-publisher login http --algorithm ecdsap384 --domain "${MY_DOMAIN}" --private-key "${PRIVATE_KEY}" ``` ```bash Google KMS diff --git a/docs/modelcontextprotocol-io/quickstart.mdx b/docs/modelcontextprotocol-io/quickstart.mdx index 41bc8fc..6988689 100644 --- a/docs/modelcontextprotocol-io/quickstart.mdx +++ b/docs/modelcontextprotocol-io/quickstart.mdx @@ -135,6 +135,10 @@ Commands: login Authenticate with the registry logout Clear saved authentication publish Publish server.json to the registry + status Update the status of a server version + validate Validate server.json without publishing + +Use 'mcp-publisher --help' for more information about a command. ``` ## Step 4: Create `server.json` diff --git a/docs/reference/cli/commands.md b/docs/reference/cli/commands.md index e077019..c8d7615 100644 --- a/docs/reference/cli/commands.md +++ b/docs/reference/cli/commands.md @@ -16,7 +16,10 @@ $ brew install mcp-publisher All commands support: - `--help`, `-h` - Show command help -- `--registry` - Registry URL (default: `https://registry.modelcontextprotocol.io`) + +`--registry` is a flag on `login` only (default: `https://registry.modelcontextprotocol.io`). The +other commands read the registry URL from the stored login token, so passing `--registry` to +`publish` would be interpreted as the `server.json` path. ## Commands @@ -26,14 +29,14 @@ Generate a `server.json` template with automatic detection. **Usage:** ```bash -mcp-publisher init [options] +mcp-publisher init ``` **Behavior:** - Creates `server.json` in current directory - Auto-detects package managers (`package.json`, `setup.py`, etc.) - Pre-fills fields where possible -- Prompts for missing required fields +- Writes `TODO:` placeholders for fields it cannot detect — it is non-interactive and takes no flags **Example output:** ```json @@ -59,10 +62,13 @@ Authenticate with the registry. #### GitHub Interactive ```bash -mcp-publisher login github [--registry=URL] +mcp-publisher login github [--token=PAT] [--registry=URL] ``` - Opens browser for GitHub OAuth flow - Grants access to `io.github.{username}/*` and `io.github.{org}/*` namespaces +- `--token` supplies a GitHub Personal Access Token instead of the interactive flow, which is how + [publishing from GitHub Actions](../../modelcontextprotocol-io/github-actions.mdx) authenticates + without a browser. This flag is accepted by `login github` only. #### GitHub OIDC (CI/CD) ```bash @@ -83,12 +89,13 @@ Also see [the guide to publishing from GitHub Actions](../../modelcontextprotoco #### DNS Verification ```bash -mcp-publisher login dns --domain=example.com --private-key=HEX_KEY [--registry=URL] +mcp-publisher login dns --domain=example.com --private-key=HEX_KEY [--algorithm=ed25519|ecdsap384] [--registry=URL] ``` - Verifies domain ownership via DNS TXT record - Grants access to `com.example.*` namespaces - Requires Ed25519 private key (64-character hex) or ECDSA P-384 private key (96-character hex) - - The private key can be stored in a cloud signing provider like Google KMS or Azure Key Vault. + - `--algorithm` defaults to `ed25519`. **For an ECDSA P-384 key you must pass `--algorithm ecdsap384`**, otherwise the key is rejected with `invalid seed length: expected 32 bytes, got 48`. + - The private key can be stored in a cloud signing provider like Google KMS or Azure Key Vault. Cloud providers derive the algorithm from the key itself, so `--algorithm` does not apply to them. **Setup:** (for Ed25519, recommended) ```bash @@ -118,6 +125,9 @@ openssl ec -in key.pem -text -noout -conv_form compressed | grep -A4 "pub:" | ta # Extract private key for login openssl ec -in -noout -text | grep -A4 "priv:" | tail -n +2 | tr -d ' :\n' + +# Log in, selecting the ECDSA P-384 algorithm explicitly +mcp-publisher login dns --algorithm ecdsap384 --domain=example.com --private-key=HEX_KEY ``` **Setup:** (for Google KMS signing) @@ -178,12 +188,13 @@ mcp-publisher login dns azure-key-vault --domain=example.com --vault MyKeyVault #### HTTP Verification ```bash -mcp-publisher login http --domain=example.com --private-key=HEX_KEY [--registry=URL] +mcp-publisher login http --domain=example.com --private-key=HEX_KEY [--algorithm=ed25519|ecdsap384] [--registry=URL] ``` - Verifies domain ownership via HTTPS endpoint - Grants access to `com.example.*` namespaces - Requires Ed25519 private key (64-character hex) or ECDSA P-384 private key (96-character hex) - - The private key can be stored in a cloud signing provider like Google KMS or Azure Key Vault. + - `--algorithm` defaults to `ed25519`. **For an ECDSA P-384 key you must pass `--algorithm ecdsap384`**. + - The private key can be stored in a cloud signing provider like Google KMS or Azure Key Vault. Cloud providers derive the algorithm from the key itself, so `--algorithm` does not apply to them. **Setup:** (for Ed25519, recommended) ```bash @@ -203,6 +214,9 @@ openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:secp384r1 -out key.pem # Host public key at: # https://example.com/.well-known/mcp-registry-auth # Content: v=MCPv1; k=ecdsap384; p=PUBLIC_KEY + +# Log in, selecting the ECDSA P-384 algorithm explicitly +mcp-publisher login http --algorithm ecdsap384 --domain=example.com --private-key=HEX_KEY ``` Cloud signing is also supported for HTTP authentication, similar to the DNS examples above. Just swap out the `dns` positional argument for `http`. From 988b078e0241ae04b20922c01659a8224b11b92a Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Mon, 10 Aug 2026 16:25:56 +0300 Subject: [PATCH 284/313] docs(deploy): correct config parameter names in deploy README (#1521) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The deploy configuration table named two parameters that **no code reads**, and omitted two that a deploy cannot succeed without. ## Wrong names | Documented | Actual | Evidence | |---|---|---| | `gcpProjectId` | `gcp:project` | [provider.go:30](https://github.com/modelcontextprotocol/registry/blob/main/deploy/pkg/providers/gcp/provider.go#L30) — its error text literally says `Set gcp:project` | | `gcpRegion` | `gcp:region` | [provider.go:36](https://github.com/modelcontextprotocol/registry/blob/main/deploy/pkg/providers/gcp/provider.go#L36), default `us-central1` | `gcpProjectId` and `gcpRegion` appear **nowhere** in `deploy/` outside this table. All three stack files (`Pulumi.gcpProd.yaml`, `Pulumi.gcpStaging.yaml`, `Pulumi.local.yaml`) already use `gcp:project`. ## Missing required secrets Both are `RequireSecret`, so a deploy fails outright without them — yet neither was in the table: - `mcp-registry:jwtPrivateKey` — [registry.go:56](https://github.com/modelcontextprotocol/registry/blob/main/deploy/pkg/k8s/registry.go#L56) - `mcp-registry:googleOauthClientSecret` — [monitoring.go:463](https://github.com/modelcontextprotocol/registry/blob/main/deploy/pkg/k8s/monitoring.go#L463) ## Also - Documents `gcp:credentials` (read at [provider.go:42](https://github.com/modelcontextprotocol/registry/blob/main/deploy/pkg/providers/gcp/provider.go#L42), set in the staging and prod stacks) - Marks which values are secrets - **Adds the namespace prefixes.** The table listed bare names, which is part of why the two wrong ones survived: `gcpProjectId` reads as plausible right up until you notice the real key lives in a different config namespace altogether. ## Verification Checked both directions: - every key now in the table is read by code in `deploy/` (reference counts confirmed per key) - every `conf.*("...")` key found anywhere in `deploy/` now appears in the table 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5 --- deploy/README.md | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) diff --git a/deploy/README.md b/deploy/README.md index 392b244..7b407e7 100644 --- a/deploy/README.md +++ b/deploy/README.md @@ -147,15 +147,20 @@ Pre-requisites: ## Configuration +Configuration keys are namespaced. Set them with `pulumi config set [--secret]`. + | Parameter | Description | Required | |-----------|-------------|----------| -| `environment` | Deployment environment (local/staging/prod) | Yes | -| `provider` | Kubernetes provider (local/gcp) | No (default: local) | -| `githubClientId` | GitHub OAuth Client ID | Yes | -| `githubClientSecret` | GitHub OAuth Client Secret | Yes | -| `imageTag` | Docker image tag for production environment | Yes (prod only) | -| `gcpProjectId` | GCP Project ID (required when provider=gcp) | No | -| `gcpRegion` | GCP Region (default: us-central1) | No | +| `mcp-registry:environment` | Deployment environment (local/staging/prod) | Yes | +| `mcp-registry:provider` | Kubernetes provider (local/gcp) | No (default: local) | +| `mcp-registry:githubClientId` | GitHub OAuth Client ID | Yes | +| `mcp-registry:githubClientSecret` | GitHub OAuth Client Secret | Yes (secret) | +| `mcp-registry:jwtPrivateKey` | Ed25519 seed used to sign registry JWTs | Yes (secret) | +| `mcp-registry:googleOauthClientSecret` | Google OAuth client secret for Grafana login | Yes (secret) | +| `mcp-registry:imageTag` | Docker image tag for production environment | Yes (prod only) | +| `gcp:project` | GCP Project ID | Yes when `provider=gcp` | +| `gcp:region` | GCP Region | No (default: us-central1) | +| `gcp:credentials` | GCP service account credentials JSON | No (secret; set in staging/prod) | ## Database Backups From 3e463e52bbd17167f1b5bff1ba49c3259bd7ed0f Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Mon, 10 Aug 2026 16:32:25 +0300 Subject: [PATCH 285/313] docs: correct contributor prerequisites and stale dev-env references (#1520) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The README prerequisites were both stale, and the docs restated the Go version in three places. ## Prerequisites: name the source, do not restate the version | README said | Reality | |---|---| | `Go 1.24.x` | `go 1.26` in [go.mod](https://github.com/modelcontextprotocol/registry/blob/main/go.mod) | | `golangci-lint v2.4.0` | `v2.11.4` pinned in [ci.yml:30](https://github.com/modelcontextprotocol/registry/blob/main/.github/workflows/ci.yml#L30) | Rather than swap in fresher numbers — which only resets the clock on the same drift — this **removes the numbers** and names the authoritative file: ``` - **Go** - version per the `go` directive in go.mod; the Go toolchain fetches it for you - **golangci-lint** - version per the `golangci-lint-action` pin in ci.yml, so local lint matches CI ``` The Go version was stated in **three** places, which is exactly why all three drifted together. All three now point at a single source, so the prerequisites list cannot go stale. Two notes on why the numbers earn so little in prose: - **Go corrects itself.** `go.mod` has no `toolchain` directive, so under the default `GOTOOLCHAIN=auto` the toolchain downloads the required version automatically. A contributor on an older Go gets an upgrade, not a failure — it only hard-errors under `GOTOOLCHAIN=local`. (An earlier version of this description said such a contributor "cannot build"; that was too strong.) - **golangci-lint does not.** Version skew here genuinely changes what you see: running CI's config under a newer golangci-lint (2.12.2) surfaces 23 `goconst` findings in `cmd/publisher/commands/validate_test.go` that CI's pinned 2.11.4 does not report. That is why the README now points at the pin rather than a number someone has to keep in sync. ## `make check` does more than documented Documented in three files as "lint, unit tests and integration tests". Actually [`check: dev-down lint validate test-all`](https://github.com/modelcontextprotocol/registry/blob/main/Makefile#L85) — it also runs schema validation and **stops your running `dev-compose` environment**. Worth knowing before running it mid-session. The Makefile's own `##` help string already said this correctly; only the prose was stale. ## Other verified corrections - **README project structure** omitted `cmd/registry/` — the server entry point and ko/goreleaser build target — and `internal/importer/`. - **`tests/integration/README.md`** said the suite launches **MongoDB**. It launches PostgreSQL (`postgres-integration-test`), as the same file admits nine lines later. It also cited `/v0/servers/{server_id}`, a path removed a while ago; the test actually calls `GET /v0/servers` and `GET /v0/servers/{serverName}/versions/latest` ([main.go:210,255](https://github.com/modelcontextprotocol/registry/blob/main/tests/integration/main.go#L210)). - **`scripts/mirror_data/README.md`** pointed at `internal/database/migrations/008_separate_official_metadata.sql`, which does not exist — that migration is `009_`, while `008_` is `clean_invalid_data.sql`. (Migration 008's own header still calls itself "007a", which is how the numbering slipped.) Also swapped two "edit line NN" pointers for identifier names, since both had already drifted (`maxMigration` is at :30 not :24; the connection string at :23 not :17), and corrected the fetch URL from `/v0.1/servers` to the `/v0/servers` the script actually requests. - **`.env.example`** was missing `MCP_REGISTRY_ENABLE_REGISTRY_VALIDATION`, even though the config reads it ([config.go:18](https://github.com/modelcontextprotocol/registry/blob/main/internal/config/config.go#L18)) and README:50 tells contributors to set it while pointing at `.env.example` as *the* reference. - **`docker-compose.yml`** set `MCP_REGISTRY_ENVIRONMENT`, which nothing reads — no `ENVIRONMENT` env tag in `internal/config`, and no other occurrence in the repo. Removed. (The Pulumi-side `mcp-registry:environment` key is a separate, real thing and is untouched.) - **Deleted `CHANGES.md`** — 0 bytes, untouched since the squashed history base, zero references anywhere. ## Verification `docker compose config` validates. `grep` for `Go 1.x` / `golangci-lint vX` across all `.md`/`.mdx` now returns nothing outside `complete.md` (which #1522 deletes). Both `../../README.md#pre-requisites` links resolve and the anchor matches the real `#### Pre-requisites` heading. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5 --- .env.example | 5 +++++ .github/copilot-instructions.md | 2 +- CHANGES.md | 0 CONTRIBUTING.md | 3 ++- README.md | 11 +++++++---- docker-compose.yml | 1 - scripts/mirror_data/README.md | 20 ++++++++++---------- tests/integration/README.md | 6 +++--- 8 files changed, 28 insertions(+), 20 deletions(-) delete mode 100644 CHANGES.md diff --git a/.env.example b/.env.example index 786fc1b..6deabd0 100644 --- a/.env.example +++ b/.env.example @@ -11,6 +11,11 @@ MCP_REGISTRY_DATABASE_URL=postgres://username:password@localhost:5432/mcp-regist # For offline development, use: data/seed.json MCP_REGISTRY_SEED_FROM=https://registry.modelcontextprotocol.io/v0/servers +# Validate seed data against the registry rules on import (default: true) +# Set to false for offline development when seeding from a local file, since +# data/seed.json is not guaranteed to pass validation +MCP_REGISTRY_ENABLE_REGISTRY_VALIDATION=true + # GitHub OAuth configuration # These creds are for local development with the 'MCP Registry Login (Local)' GitHub App # They don't provide any real privileged access, hence why it's okay that they're here diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md index b37dd38..e373661 100644 --- a/.github/copilot-instructions.md +++ b/.github/copilot-instructions.md @@ -9,5 +9,5 @@ To publish an MCP server to the registry, use the `mcp-publisher` CLI tool. See ## Development - Use `make` targets where possible (run `make help` to see available targets) -- Run `make check` to run lint, unit tests, and integration tests +- Run `make check` to run lint, schema validation, and all tests (this also stops any running dev-compose environment) - Run `make dev-compose` to start the local development environment \ No newline at end of file diff --git a/CHANGES.md b/CHANGES.md deleted file mode 100644 index e69de29..0000000 diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index a5a42cb..7a1e1b5 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -32,7 +32,8 @@ See the [README](README.md#quick-start) for prerequisites and instructions on ru ### Running checks ```bash -# Run lint, unit tests and integration tests +# Run lint, schema validation, and all tests +# Note: this also runs `make dev-down`, stopping any running dev-compose environment make check ``` diff --git a/README.md b/README.md index 5424e0d..8178365 100644 --- a/README.md +++ b/README.md @@ -32,9 +32,9 @@ Often (but not always) ideas flow through this pipeline: #### Pre-requisites - **Docker** -- **Go 1.24.x** +- **Go** - version per the `go` directive in [go.mod](./go.mod); the Go toolchain fetches it for you - **ko** - Container image builder for Go ([installation instructions](https://ko.build/install/)) -- **golangci-lint v2.4.0** +- **golangci-lint** - version per the `golangci-lint-action` pin in [ci.yml](./.github/workflows/ci.yml), so local lint matches CI #### Running the server @@ -94,7 +94,8 @@ See [the publisher guide](./docs/modelcontextprotocol-io/quickstart.mdx) for mor #### Other commands ```bash -# Run lint, unit tests and integration tests +# Run lint, schema validation, and all tests +# Note: this also runs `make dev-down`, stopping any running dev-compose environment make check ``` @@ -110,7 +111,8 @@ For Claude and other AI tools: Always prefer make targets over custom commands w ``` ├── cmd/ # Application entry points -│ └── publisher/ # Server publishing tool +│ ├── publisher/ # Server publishing tool +│ └── registry/ # Registry API server ├── data/ # Seed data ├── deploy/ # Deployment configuration (Pulumi) ├── docs/ # Documentation @@ -119,6 +121,7 @@ For Claude and other AI tools: Always prefer make targets over custom commands w │ ├── auth/ # Authentication (GitHub OAuth, JWT, namespace blocking) │ ├── config/ # Configuration management │ ├── database/ # Data persistence (PostgreSQL) +│ ├── importer/ # Seed data import │ ├── service/ # Business logic │ ├── telemetry/ # Metrics and monitoring │ └── validators/ # Input validation diff --git a/docker-compose.yml b/docker-compose.yml index 7eb71c2..3fff7bc 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -10,7 +10,6 @@ services: # See .env.example for more documentation environment: - MCP_REGISTRY_DATABASE_URL=${MCP_REGISTRY_DATABASE_URL:-postgres://mcpregistry:mcpregistry@postgres:5432/mcp-registry} - - MCP_REGISTRY_ENVIRONMENT=${MCP_REGISTRY_ENVIRONMENT:-test} - MCP_REGISTRY_GITHUB_CLIENT_ID=${MCP_REGISTRY_GITHUB_CLIENT_ID:-Iv23licy3GSiM9Km5jtd} - MCP_REGISTRY_GITHUB_CLIENT_SECRET=${MCP_REGISTRY_GITHUB_CLIENT_SECRET:-0e8db54879b02c29adef51795586f3c510a9341d} - MCP_REGISTRY_JWT_PRIVATE_KEY=${MCP_REGISTRY_JWT_PRIVATE_KEY:-8103179d8ef955f6d3de6d6217224a909ec4060529dfeb1d4ca5a994537658cd} diff --git a/scripts/mirror_data/README.md b/scripts/mirror_data/README.md index 3237211..2cc3a87 100644 --- a/scripts/mirror_data/README.md +++ b/scripts/mirror_data/README.md @@ -14,7 +14,7 @@ These scripts help you: ## Prerequisites -- Go 1.24.x +- Go — see the [prerequisites in the root README](../../README.md#pre-requisites) for the required version - PostgreSQL (via Docker or local installation) - Required Go packages: ```bash @@ -31,7 +31,7 @@ go run scripts/mirror_data/fetch_production_data.go ``` This will: -- Fetch all servers from https://registry.modelcontextprotocol.io/v0.1/servers +- Fetch all servers from https://registry.modelcontextprotocol.io/v0/servers - Handle pagination automatically - Save data to `scripts/mirror_data/production_servers.json` - Be respectful to the API with rate limiting @@ -71,7 +71,7 @@ This will: 4. Analyze the data and report statistics 5. Show sample servers with NULL status values -To test a different migration, edit `maxMigration` in the script (line 24) +To test a different migration, edit `maxMigration` in `load_production_data.go` ### 4. Test Migrations @@ -80,8 +80,8 @@ After loading the data, you can test migrations against real production data. #### Testing a Single Migration ```bash -# Test migration 008 -cat internal/database/migrations/008_separate_official_metadata.sql | \ +# Test the separate_official_metadata migration +cat internal/database/migrations/009_separate_official_metadata.sql | \ docker exec -i test-postgres psql -U postgres -d registry_test ``` @@ -90,7 +90,7 @@ cat internal/database/migrations/008_separate_official_metadata.sql | \ 1. **Check the error output:** ```bash # Run migration and capture all output -cat internal/database/migrations/008_separate_official_metadata.sql | \ +cat internal/database/migrations/009_separate_official_metadata.sql | \ docker exec -i test-postgres psql -U postgres -d registry_test 2>&1 | \ grep -E "(ERROR|NOTICE|WARNING)" ``` @@ -126,7 +126,7 @@ EOF # Start a transaction to test and rollback docker exec test-postgres psql -U postgres -d registry_test < Date: Mon, 10 Aug 2026 16:32:37 +0300 Subject: [PATCH 286/313] docs: remove stale complete.md and fix remaining stale references (#1522) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Deletes `complete.md` and cleans up the last references to the pre-restructuring docs layout. ## Why `complete.md` goes It is 2,944 lines (31% of all documentation lines in the repo) self-described as *"all documentation from the docs/ directory compiled into a single markdown file"*. But: - **No generator exists.** No make target, no workflow, no script. `grep -rn "complete\.md"` finds **zero** references anywhere in the repo. - **It mirrors a docs tree that no longer exists** — `docs/guides/`, `docs/explanations/`, `docs/concepts/`. - **All 72 of its relative links are broken**, and six of the basenames it references exist nowhere in the repo. - **~14 current docs are missing from it entirely** (`about.mdx`, `authentication.mdx`, `package-types.mdx`, both CHANGELOGs, ...). - **Its `server.json` examples pin the superseded `2025-07-09` schema** (current is `2025-12-11`). The strongest argument is its own last commit. [PR #1278](https://github.com/modelcontextprotocol/registry/pull/1278) closed [issue #767](https://github.com/modelcontextprotocol/registry/issues/767) — a real user-reported CLI flag bug — by editing **only `complete.md`**. A genuine fix landed in a file nobody reads, while the docs a reader would actually find stayed wrong. A generated file with no generator degrades into a trap: authoritative enough that people edit it, with nothing validating it. If the LLM-consumption use case is worth keeping, the right shape is a `make docs-bundle` target plus a `check-docs-bundle` CI job mirroring the existing `check-schema` pattern — happy to do that instead if you would rather keep it. ## Remaining stale references | File | Was | Now | |---|---|---| | `contributing/add-package-registry.md` | Add `docs/guides/publishing/publish-[yourregistry].md`, update `docs/guides/publishing/README.md` | Add a section to `package-types.mdx`. These were the **last live references** to the obsolete `docs/guides/` layout outside `complete.md` | | `administration/maintainer-onboarding.md` | Add them to "Current key maintainers" in README | "Registry Working Group" — the section that actually exists | | `reference/README.md` | Omitted 6 reference docs | Adds `api/extensions.md`, `api/openapi.yaml`, `api/CHANGELOG.md`, `server-json/CHANGELOG.md`, `server-json/CONTRIBUTING.md`, `server-json/draft/` | | `docs/README.md` | Index omitted `community-projects.md` | Listed | | `reference/api/generic-registry-api.md` | `PUT .../versions/{version}` "not implemented by official registry" | It **is** implemented ([edit.go:36](https://github.com/modelcontextprotocol/registry/blob/main/internal/api/handlers/v0/edit.go#L36)), and `official-registry-api.md` already lists it as an admin endpoint | | `reference/api/official-registry-api.md` | Omitted 3 registered routes | Adds `POST /v0.1/validate` (which `mcp-publisher validate` calls), `GET /v0.1/ping`, `GET /v0.1/version`, and notes these plus `/health` are absent from `openapi.yaml` | | `server-json/official-registry-requirements.md` | Per-registry verification → `quickstart.mdx` | → `package-types.mdx`, which has an Ownership Verification section per registry | | `design/design-principles.md` | Sections 1,2,3,4,**6**,7 | Renumbered 1–6 | | `contributing/releasing.md` | Steps 1,2,3,**5**,6 | Renumbered 1–5 | I left the sibling `DELETE` claim in `generic-registry-api.md` alone — it is accurate, no DELETE route is registered (the `http.MethodDelete` hit in `server.go` is CORS config, not a route). ## Staleness banners rather than rewrites **`design/tech-architecture.md`** is substantially fictional. Rather than a vague "may be outdated", the banner lists what I verified is wrong: - Describes Helm-chart deployment; the registry is a plain `Deployment` ([registry.go:65](https://github.com/modelcontextprotocol/registry/blob/main/deploy/pkg/k8s/registry.go#L65)). Helm is used only for third-party components. - Diagram shows a `StatefulSet` on port **27017** — MongoDB's port. The DB is PostgreSQL on 5432 via the CloudNativePG operator. - Documents a `verify-domain` challenge flow (`POST /verify-domain`, `/verify-domain/check`, server-issued tokens) that **was never built**. - Documents `/admin/*` routes that are not registered. - Says the DB stores user auth state and DNS verification records; only `servers` and `server_extensions` tables exist. **`design/roadmap.md`** still says "Phase 1: MVP/Go-Live (Current Focus)" ~11 months after launch. I added a dated note rather than inventing a current phase — that is a working-group call. ## Verification All **101** remaining relative links across every `.md`/`.mdx` in the repo resolve. The only two non-resolving matches are the intentional `[project-name](link)` template placeholder and the moderation link fixed in #1518. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5 --- complete.md | 2945 ----------------- docs/README.md | 1 + docs/administration/maintainer-onboarding.md | 2 +- docs/contributing/add-package-registry.md | 5 +- docs/contributing/releasing.md | 4 +- docs/design/design-principles.md | 4 +- docs/design/roadmap.md | 8 +- docs/design/tech-architecture.md | 21 + docs/reference/README.md | 6 + docs/reference/api/generic-registry-api.md | 2 +- docs/reference/api/official-registry-api.md | 10 + .../official-registry-requirements.md | 2 +- 12 files changed, 54 insertions(+), 2956 deletions(-) delete mode 100644 complete.md diff --git a/complete.md b/complete.md deleted file mode 100644 index e9040fa..0000000 --- a/complete.md +++ /dev/null @@ -1,2945 +0,0 @@ -# Complete Documentation - -This file contains all documentation from the docs/ directory compiled into a single markdown file. - ---- - -## File: docs/README.md - -# MCP Registry Documentation - -The MCP registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. - -## I want to... - -- **📤 Publish my MCP server** → [Publishing Guide](guides/publishing/publish-server.md) -- **📥 Consume registry data** → [API Usage Guide](guides/consuming/use-rest-api.md) -- **🔌 Understand the registry's purpose** → [Ecosystem vision](explanations/ecosystem-vision.md) -- **📋 Look up specific information** → [server.json spec](reference/server-json/generic-server-json.md) | [API spec](reference/api/generic-registry-api.md) | [CLI reference](reference/cli/commands.md) - -## Documentation Index - -- 🛠️ [How-To Guides: Task-focused instructions](./guides/) -- 💡 [Explanations: Understanding-oriented content](./explanations/) -- 📖 [Reference: Technical specifications and lookup material](./reference/) - ---- - -## File: docs/explanations/README.md - -# Explanations - -Understanding-oriented documentation that clarifies and illuminates the MCP Registry. - -- [Design principles](design-principles.md) -- [Ecosystem vision](ecosystem-vision.md) -- [Roadmap](roadmap.md) -- [Tech architecture](tech-architecture.md) -- [Namespacing](namespacing.md) -- [Versioning](versioning.md) - ---- - -## File: docs/explanations/design-principles.md - -# MCP Registry Design Principles - -These are the core constraints that guide the design of the MCP Registry. They are not exhaustive, but they are the most important principles that we will use to evaluate design decisions. - -## 1. Single Source of Truth - -The registry serves as the authoritative metadata repository for publicly-available MCP servers, both locally-run and remote, open source and closed source. Server creators publish once, and all consumers (MCP clients, aggregators, etc.) reference the same canonical data. - -## 2. Minimal Operational Burden - -- Design for low maintenance and operational overhead -- Delegate complexity to existing services where possible (GitHub for auth, npm/PyPI/NuGet for packages) -- Avoid features that require constant human intervention or moderation -- Build for reasonable downtime tolerance (24h acceptable) by having consumers cache data for their end-users - -## 3. Vendor Neutrality - -- No preferential treatment for specific servers or organizations -- No built-in ranking, curation, or quality judgments -- Let consumers (MCP clients, aggregators) make their own curation decisions - -## 4. Meets Industry Security Standards - -- Leverage existing package registries (npm, PyPI, NuGet, Docker Hub, etc.) for source code distribution, obviating the need to reinvent source code security -- Use mechanisms like DNS verification, OAuth to provide base layer of authentication and trust -- Implement rate limiting, field validation, and blacklisting to prevent abuse - -## 6. Reusable, Extensible Shapes; Not Infrastructure - -- API shapes (OpenAPI, server.json) designed for reuse -- Enable private/internal registries using same formats -- Don't mandate infrastructure reuse - focus on interface compatibility - -## 7. Progressive Enhancement - -- Start with MVP that provides immediate value -- Build foundation that supports future features -- Don't over-engineer for hypothetical needs -- Each milestone should be independently valuable - ---- - -## File: docs/explanations/ecosystem-vision.md - -# Ecosystem Vision - -How the MCP Registry fits into the broader ecosystem and our vision for the future. - -## The Registry Ecosystem - -The MCP registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. (In the future it might do more, like also hosting a list of clients). - -There are two parts to the registry project: - -1. 🟦 **The MCP registry spec**: An [API specification](../reference/api/) that allows anyone to implement a registry. -2. 🟥 **The Official MCP registry**: A hosted registry following the MCP registry spec at [`registry.modelcontextprotocol.io`](https://registry.modelcontextprotocol.io). This serves as the **authoritative repository** for publicly-available MCP servers. Server creators publish once, and all consumers (MCP clients, aggregators, marketplaces) reference the same canonical data. This is owned by the MCP open-source community, backed by major trusted contributors to the MCP ecosystem such as Anthropic, GitHub, PulseMCP and Microsoft. - -The registry is built around the [`server.json`](../reference/server-json/) format - a standardized way to describe MCP servers that works across discovery, initialization, and packaging scenarios. - -In time, we expect the ecosystem to look a bit like this: - -![](./ecosystem-diagram.excalidraw.svg) - -Note that MCP registries are _metaregistries_. They host metadata about packages, but not the package code or binaries. Instead, they reference other package registries (like NPM, PyPi or Docker) for this. - -Additionally, we expect clients pull from _subregistries_. These subregistries add value to the registry ecosystem by providing curation, or extending it with additional metadata. The Official MCP registry expects a lot of API requests from ETL jobs from these subregistries. - -## Registry vs Package Registry - -Key distinction: MCP Registries are **metaregistries**. - -- **Package registries** (npm, PyPI, Docker Hub) host actual code/binaries -- **The MCP Registry** hosts metadata pointing to those packages - -``` -MCP Registry: "weather-server v1.2.0 is at npm:weather-mcp" -NPM Registry: [actual weather-mcp package code] -``` - -## Official vs Community Registries - -**Official MCP Registry** (`registry.modelcontextprotocol.io`): -- Canonical source for publicly-available servers -- Community-owned, backed by trusted contributors -- Focuses on discoverability and basic metadata - -**Subregistries** (Smithery, PulseMCP, etc.): -- Add value through curation, ratings, enhanced metadata -- ETL from official registry + additional annotations -- Serve specific communities or use cases - -## How Servers Are Represented - -Each server entry contains: -- **Identity**: Unique name (`io.github.user/server-name`) -- **Packages**: Where to download it (`npm`, `pypi`, `docker`, etc.) -- **Runtime**: How to execute it (args, env vars) -- **Metadata**: Description, capabilities, version - -This is stored in a standardized `server.json` format that works across discovery, installation, and execution. - ---- - -## File: docs/explanations/roadmap.md - -# MCP Registry Roadmap - -This is a high-level roadmap for the MCP Registry. It is subject to change and not exhaustive, but it outlines the general thinking of the sequencing and scope of our work in this repository. - -This roadmap may occasionally drift out of date. Please review [Issues](https://github.com/modelcontextprotocol/registry/issues) (and corresponding Labels) for the most current work in progress. - -## Current Status - -The initial version of the MCP Registry is actively being developed. The initial focus is on delivering a REST API to which server creators can publish, and aggregator/marketplace consumers can ETL. - -## Phase 1: MVP/Go-Live (Current Focus) - -See the [go-live blocker issues](https://github.com/modelcontextprotocol/registry/issues?q=is%3Aissue%20state%3Aopen%20label%3A%22go-live%20blocker%22). - -## Backlog (Future Work, may be moved to out of scope) - -- [ ] UI implementation -- [ ] Store and surface other data besides servers (e.g. [clients](https://modelcontextprotocol.io/clients), resources) -- [ ] Download count tracking -- [ ] Internationalization (i18n) - -## Out of Scope (Not Planned) - -- **Source code hosting**: The registry will never host actual server code -- **Quality rankings**: No built-in server quality assessments or rankings -- **Curation**: No editorial decisions about which servers are "better" -- **Unified runtime**: Not solving how servers are executed -- **Server hosting**: The registry does not provide hosting for servers -- **Search engine**: The registry will not provide a commercial grade search engine for servers -- **Server tags or categories**: Not supported, to reduce moderation burden -- **Server rankings**: The registry will not rank servers by subjective measures of quality - ---- - -## File: docs/explanations/tech-architecture.md - -# MCP Registry Technical Architecture - -This document describes the technical architecture of the MCP Registry, including system components, deployment strategies, and data flows. - -## System Overview - -The MCP Registry is designed as a lightweight metadata service that bridges MCP server creators with consumers (MCP clients and aggregators). - -## Core Components - -### REST API (Go) - -The main application server implemented in Go, providing: -- Public read endpoints for server discovery -- Authenticated write endpoints for server publication -- GitHub OAuth integration (extensible to other providers) -- DNS verification system (optional for custom namespaces) - -### Database (PostgreSQL) - -Primary data store for: -- Versioned server metadata (server.json contents) -- User authentication state -- DNS verification records - -### CDN Layer - -Critical for scalability: -- Caches all public read endpoints -- Reduces load on origin servers -- Enables global distribution -- Designed for daily consumer polling patterns - -### CLI Tool - -Developer interface for: -- Server publication workflow -- GitHub OAuth flow -- DNS verification - -## Deployment Architecture - -### Kubernetes Deployment (Helm) - -The registry is designed to run on Kubernetes using Helm charts: - -```mermaid -graph TB - subgraph "Kubernetes Cluster" - subgraph "Namespace: mcp-registry" - subgraph "Registry Service" - LB[Load Balancer
    :80] - RS[Registry Service
    :8080] - RP1[Registry Pod 1] - RP2[Registry Pod 2] - RP3[Registry Pod N] - end - - subgraph "Database Service" - DBS[DB Service
    :27017] - SS[StatefulSet] - PV[Persistent Volume] - end - - subgraph "Secrets" - GHS[GitHub OAuth Secret] - end - end - end - - LB --> RS - RS --> RP1 - RS --> RP2 - RS --> RP3 - RP1 --> DBS - RP2 --> DBS - RP3 --> DBS - DBS --> SS - SS --> PV - RP1 -.-> GHS - RP2 -.-> GHS - RP3 -.-> GHS -``` - -## Data Flow Patterns - -### 1. Server Publication Flow - -```mermaid -sequenceDiagram - participant Dev as Developer - participant CLI as CLI Tool - participant API as Registry API - participant DB as Database - participant GH as GitHub - participant DNS as DNS Provider - - Dev->>CLI: mcp publish server.json - CLI->>CLI: Validate server.json - CLI->>GH: OAuth flow - GH-->>CLI: Access token - CLI->>API: POST /servers - API->>GH: Verify token - API->>DNS: Verify domain (if applicable) - API->>DB: Store metadata - API-->>CLI: Success - CLI-->>Dev: Published! -``` - -### 2. Consumer Discovery Flow - -```mermaid -sequenceDiagram - participant Client as MCP Client Host App - participant INT as Intermediary
    (Marketplace/Aggregator) - participant CDN as CDN Cache - participant API as Registry API - participant DB as Database - - Note over INT,CDN: Daily ETL Process - INT->>CDN: GET /servers - alt Cache Hit - CDN-->>INT: Cached response - else Cache Miss - CDN->>API: GET /servers - API->>DB: Query servers - DB-->>API: Server list - API-->>CDN: Response + cache headers - CDN-->>INT: Response - end - INT->>INT: Process & enhance data - INT->>INT: Store in local cache - - Note over Client,INT: Real-time Client Access - Client->>INT: Request server list - INT-->>Client: Curated/enhanced data -``` - -### 3. DNS Verification Flow - -```mermaid -sequenceDiagram - participant User as User - participant CLI as CLI Tool - participant API as Registry API - participant DNS as DNS Provider - participant DB as Database - - User->>CLI: mcp verify-domain example.com - CLI->>API: POST /verify-domain - API->>API: Generate verification token - API->>DB: Store pending verification - API-->>CLI: TXT record: mcp-verify=abc123 - CLI-->>User: Add TXT record to DNS - User->>DNS: Configure TXT record - User->>CLI: Confirm added - CLI->>API: POST /verify-domain/check - API->>DNS: Query TXT records - DNS-->>API: TXT records - API->>API: Validate token - API->>DB: Store verification - API-->>CLI: Domain verified - CLI-->>User: Success! -``` - -### 4. Admin OIDC Authentication Flow - -For registry administration, users with @modelcontextprotocol.io Google Cloud Identity accounts can authenticate using OIDC: - -```mermaid -sequenceDiagram - participant Admin as Admin User - participant CLI as Admin CLI - participant GCP as Google Cloud Identity - participant API as Registry API - - Admin->>CLI: Request admin token - CLI->>GCP: gcloud auth print-identity-token --audiences=mcp-registry - GCP-->>CLI: ID Token (with hd: "modelcontextprotocol.io") - CLI->>API: POST /v0/auth/oidc {"oidc_token": "eyJ..."} - API->>GCP: Verify token signature (JWKS) - API->>API: Validate claims (issuer, audience, hd) - API->>API: Grant admin permissions (edit: *, publish: *) - API-->>CLI: Registry JWT Token - CLI->>API: POST /admin/* (with Registry JWT) - API->>API: Validate JWT + permissions - API-->>CLI: Admin operation success -``` - -**Usage:** -```bash -# Get Google Cloud Identity token -ID_TOKEN=$(gcloud auth print-identity-token) - -# Exchange for Registry JWT token -REGISTRY_TOKEN=$(curl -X POST /v0/auth/oidc \ - -H "Content-Type: application/json" \ - -d '{"oidc_token": "'$ID_TOKEN'"}' | jq -r .registry_token) - -# Use for admin operations -curl -H "Authorization: Bearer $REGISTRY_TOKEN" /v0/... -``` - ---- - -## File: docs/guides/README.md - -# How-To Guides - -Problem-oriented guides for specific tasks with the MCP Registry. - -## Publishing Servers - -- [Publish a server](publishing/publish-server.md) -- [GitHub Actions](publishing/github-actions.md) - -## Consuming Registry Data - -- [Use the REST API](consuming/use-rest-api.md) - -## Contributing - -- [Add package registry](contributing/add-package-registry.md) - -## Administration - -- [Admin operations](administration/admin-operations.md) -- [Moderation guidelines](administration/moderation-guidelines.md) - ---- - -## File: docs/guides/administration/admin-operations.md - -# Admin Operations - -This is a brief guide for admins and moderators managing content on the registry. All actions should be taken in line with the [moderation guidelines](moderation-guidelines.md). - -## Prerequisites - -- Admin account with @modelcontextprotocol.io email - - If you are a maintainer and would like an account, ask in the Discord -- `gcloud` CLI installed and configured -- `curl` and `jq` installed - -## Authentication - -```bash -# Run this, then run the export command it outputs -./tools/admin/auth.sh -``` - -## Edit a Server - -Step 1: Download Server - -```bash -export SERVER_ID="" -curl -s "https://registry.modelcontextprotocol.io/v0/servers/${SERVER_ID}" > server.json -``` - -Step 2: Open `server.json` and make changes. You cannot change the server name. - -Step 3: Push Changes - -```bash -curl -X PUT "https://registry.modelcontextprotocol.io/v0/servers/${SERVER_ID}" \ - -H "Authorization: Bearer ${REGISTRY_TOKEN}" \ - -H "Content-Type: application/json" \ - -d "{\"server\": $(cat server.json)}" -``` - -## Takedown a Server - -```bash -export SERVER_ID="" -./tools/admin/takedown.sh -``` - -This soft deletes the server. If you need to delete the content of a server (usually only where legally necessary), use the edit workflow above to scrub it all. - ---- - -## File: docs/guides/administration/moderation-guidelines.md - -# Moderation Guidelines - -Guidelines for server publishers on the Official MCP Registry. - -## TL;DR - -We're quite permissive! We only remove illegal content, malware, spam and completely broken servers. - -We don't make guarantees about our moderation, and subregistries should take our data "as is", assuming minimal to no moderation. - -## Scope - -These guidelines apply to the **Official MCP Registry** at `registry.modelcontextprotocol.io`. - -Subregistries may have their own moderation policies. If you have questions about content on a specific subregistry, please contact them directly. - -## Disclaimer - -We have limited active moderation capabilities, and this is a community supported projects. We largely rely on upstream package registries (like NPM, PyPi, and Docker) or downstream subregistries (like the GitHub MCP Registry) to do more in-depth moderation. - -This means there may be content in the registry that should be removed under these guidelines, which we haven't yet removed. You should treat registry data accordingly. - -## What We Remove - -We'll remove servers that contain: - -- Illegal content, which includes obscene content, copyright violations, and hacking tools -- Malware, regardless of intentions -- Spam, especially mass-created servers that disrupt the registry. Examples: - - The same server being submitted multiple times under different names. - - The server doesn't do anything but provide a fixed response with some marketing copy. - - The server description is stuffed with marketing copy, and its implementation is unrelated to its name or description. -- Non-functioning servers - -## What We Don't Remove - -Generally, we believe in keeping the registry open and pushing moderation to subregistries. We therefore **won't** remove servers that are: - -- Low quality or buggy servers -- Servers with security vulnerabilities -- Do the same thing as other servers -- Provide or contain adult content - -## How Removal Works - -When we remove a server: - -- It's set to "deleted" status but remains accessible via the API -- This allows subregistries to remove it from their indexes -- In extreme cases, we may overwrite or erase details of a server, e.g. where the metadata itself is unlawful - -## Appeals - -Think we made a mistake? Open an issue on our [GitHub repository](https://github.com/modelcontextprotocol/registry) with: -- The ID and name of your server -- Why you believe it doesn't meet the criteria for removal above - -## Changes to this policy - -We're still learning how to best run the MCP registry! As such, we might end up changing this policy in the future. - ---- - -## File: docs/guides/contributing/add-package-registry.md - -# Adding a new package registry - -The MCP Registry project is a **metaregistry**, meaning that it hosts metadata for MCP servers but does not host the code for the servers directly. - -For local MCP servers, the MCP Registry has pointers in the `packages` node of the [`server.json`](../../reference/server-json/generic-server-json.md) schema that refer to packages in supported package managers. - -The list of supported package managers for hosting MCP servers is defined by the `properties.packages[N].properties.registry_type` string enum in the [`server.json` schema](../../reference/server-json/draft/server.schema.json). For example, this could be "npm" (for npmjs.com packages) or "pypi" (for PyPI packages). - -For remote MCP servers, the package registry is not relevant. The MCP client consumes the server via a URL instead of by downloading and running a package. In other words, this document only applies to local MCP servers. - -For the sake of illustration, this document will use npm (the Node.js package manager) as an example at each step. - -## Prerequisites - -The package registry must meet the following requirements: - -1. The package registry supports packaging and executing CLI apps. Local MCP servers use the [stdio transport](https://modelcontextprotocol.io/docs/concepts/transports#standard-input%2Foutput-stdio). - - npm CLI tools typically express their CLI commands in the [`bin` property of the package.json](https://docs.npmjs.com/cli/v11/configuring-npm/package-json#bin) -1. The package registry (or associated client tooling) has a widely accepted **single-shot** CLI command. - - npm's `npx` tool executes CLI commands using a [documented execution heuristic](https://docs.npmjs.com/cli/v11/commands/npx#description) - - For example, the MCP client can map the `server.json` metadata to an `npx` CLI execution, with args and environment variables populated via user input. -1. The package registry supports anonymous package downloads. This allows the MCP client software to use the metadata found in the MCP registry to discover, download, and execute package-based local MCP servers with minimal user intervention. - - `npx` by default connects to the public npmjs.com registry, allowing simple consumption of public npm packages. -1. The package registry should support a validation mechanism to verify ownership of the server name. This prevents misattribution and ensures that only the actual package owner can reference their packages in server registrations. For example: - - npm requires an `mcpName` field in `package.json` that matches the server name being registered - - PyPI requires a `mcp-name:` line in the package README/description - - Each registry type must implement a validation mechanism accessible via public API - -## Steps - -These steps may evolve as additional validations or details are discovered and mandated. - -1. [Create a feature request issue](https://github.com/modelcontextprotocol/registry/issues/new?template=feature_request.md) on the MCP Registry repository to begin the discussion about adding the package registry. - - Example for NuGet: https://github.com/modelcontextprotocol/registry/issues/126 -1. Open a PR with the following changes: - - Update the [`server.json` schema](../../reference/server-json/draft/server.schema.json) - - Add your package registry name to the `registry_type` example array. - - Add your package registry base url to the `registry_base_url` example array. - - Add the single-shot CLI command name to the `runtime_hint` example value array. - - Update the [`openapi.yaml`](../../reference/api/openapi.yaml) - - Add your package registry name to the `registry_type` enum value array. - - Add your package registry base url to the `registry_base_url` enum value array. - - Add the single-shot CLI command name to the `runtime_hint` example value array. - - Add a sample, minimal `server.json` to the [`server.json` examples](../../reference/server-json/generic-server-json.md). - - Implement a registry validator: - - Create a new validator file: `internal/validators/registries/yourregistry.go`, following the pattern of existing validators. Examples: - - **npm**: Checks for an `mcpName` field in `package.json` that matches the server name - - **PyPI**: Searches for `mcp-name: server-name` format in the package README content - - **NuGet**: Looks for `mcp-name: server-name` format in the package README file - - **Docker/OCI**: Validates a Docker image label `io.modelcontextprotocol.server.name` in the image manifest - - Add corresponding unit tests: `internal/validators/registries/yourregistry_test.go` - - Register your validator in `internal/validators/validators.go` - - Update the publishing documentation: - - Add a new publishing guide: `docs/guides/publishing/publish-[yourregistry].md`, following the pattern of existing publishing guides (e.g., `publish-npm.md`, `publish-pypi.md`) - - Include instructions on how to prepare packages for your registry, including any specific validation requirements - - Update `docs/guides/publishing/README.md` to reference your new publishing guide - ---- - -## File: docs/reference/README.md - -# Reference Documentation - -Technical specifications and quick lookups for the MCP Registry. - -## API Reference - -- [Generic Registry API](./api/generic-registry-api.md) -- [Official Registry API](./api/official-registry-api.md) - -## server.json Reference - -- [Generic server.json Format](./server-json/generic-server-json.md) -- [Official Registry Requirements](./server-json/official-registry-requirements.md) - -## CLI Reference - -- [Commands](./cli/commands.md) - -## Quick Reference - -- [FAQ](./faq.md) - ---- - -## File: docs/reference/server-json/official-registry-requirements.md - -# Official Registry Server.json Requirements - -This document describes the additional requirements and validation rules that apply when publishing to the official MCP Registry at `registry.modelcontextprotocol.io`. - -For step-by-step publishing instructions, see the [publishing guide](../../guides/publishing/publish-server.md). - -## Overview - -While the [generic server.json format](./generic-server-json.md) defines the base specification, the official registry enforces additional validation to ensure: - -- **Namespace authentication** - Servers are published under appropriate namespaces -- **Package ownership verification** - Publishers actually control referenced packages -- **Remote server URL match** - Remote server base urls match namespaces -- **Restricted registry base urls** - Packages are from trusted public registries -- **`_meta` namespace restrictions** - Restricted to `publisher` key only - -## Namespace Authentication - -Publishers must prove ownership of their namespace. For example to publish to `com.example/server`, the publisher must prove they own the `example.com` domain. - -See the [publishing guide](../../guides/publishing/publish-server.md) for authentication details for GitHub and domain namespaces. - -## Package Ownership Verification - -All packages must include metadata proving the publisher owns them. This prevents impersonation and ensures authenticity (see more reasoning in [#96](https://github.com/modelcontextprotocol/registry/issues/96)). - -For detailed verification requirements for each registry type, see the [publishing guide](../../guides/publishing/publish-server.md). - -## Remote Server URL Match - -Remote servers must use URLs that match the publisher's domain from their namespace. For example, `com.example/server` can only use remote URLs on `example.com` or its subdomains. - -## Restricted Registry Base URLs - -Only trusted public registries are supported. Private registries and alternative mirrors are not allowed. - -**Supported registries:** -- **NPM**: `https://registry.npmjs.org` only -- **PyPI**: `https://pypi.org` only -- **NuGet**: `https://api.nuget.org/v3/index.json` -- **Docker/OCI**: `https://docker.io` only -- **MCPB**: `https://github.com` releases and `https://gitlab.com` releases only - -## `_meta` Namespace Restrictions - -The `_meta` field is restricted to the `publisher` key only during publishing. This `_meta.publisher` extension is currently limited to 4KB. - -Registry metadata is added automatically and cannot be overridden. - ---- - -## File: docs/terms.md - -# Official MCP Registry Terms - -Effective date: 2025-09-02 - -## Overview - -These terms ("Terms") govern your access to and use of the official MCP Registry (the service hosted at [https://registry.modelcontextprotocol.io/](https://registry.modelcontextprotocol.io/) or a successor location) ("Registry"), including submissions or publications of MCP servers, references to MCP servers or to data about such servers and/or their developers ("Registry Data"), and related conduct. The Registry is intended to be a centralized repository of MCP servers developed by community members to facilitate easy access by AI applications. - -These terms are governed by the laws of the State of California. - -## For All Users - -1. No Warranties. The Registry is provided "as is" with no warranties of any kind. That means we don't guarantee the accuracy, completeness, safety, durability, or availability of the Registry, servers included in the registry, or Registry Data. In short, we're also not responsible for any MCP servers or Registry Data, and we highly recommend that you evaluate each MCP server and its suitability for your intended use case(s) before deciding whether to use it. - -2. Access and Use Requirements. To access or use the Registry, you must: - 1. Be at least 18 years old. - 2. Use the Registry, MCP servers in the Registry, and Registry Data only in ways that are legal under the applicable laws of the United States or other countries including the country in which you are a resident or from which you access and use the Registry, and not be barred from accessing or using the Registry under such laws. You will comply with all applicable law, regulation, and third party rights (including, without limitation, laws regarding the import or export of data or software, privacy, intellectual property, and local laws). You will not use the Registry, MCP servers, or Registry Data to encourage or promote illegal activity or the violation of third party rights or terms of service. - 3. Log in via method(s) approved by the Registry maintainers, which may involve using applications or other software owned by third parties. - -3. Entity Use. If you are accessing or using the Registry on behalf of an entity, you represent and warrant that you have authority to bind that entity to these Terms. By accepting these Terms, you are doing so on behalf of that entity (and all references to "you" in these Terms refer to that entity). - -4. Account Information. In order to access or use the Registry, you may be required to provide certain information (such as identification or contact details) as part of a registration process or in connection with your access or use of the Registry or MCP servers therein. Any information you give must be accurate and up-to-date, and you agree to inform us promptly of any updates. You understand that your use of the Registry may be monitored to ensure quality and verify your compliance with these Terms. - -5. Feedback. You are under no obligation to provide feedback or suggestions. If you provide feedback or suggestions about the Registry or the Model Context Protocol, then we (and those we allow) may use such information without obligation to you. - -6. Branding. Only use the term "Official MCP Registry" where it is clear it refers to the Registry, and does not imply affiliation, endorsement, or sponsorship. For example, you can permissibly say "Acme Inc. keeps its data up to date by automatically pulling data from the Official MCP Registry" or "This data comes from the Official MCP Registry," but cannot say "This is the website for the Official MCP Registry," "We're the premier destination to view Official MCP Registry data," or "We've partnered with the Official MCP Registry to provide this data." - -7. Modification. We may modify the Terms or any portion to, for example, reflect changes to the law or changes to the Model Context Protocol. We'll post notice of modifications to the Terms to this website or a successor location. If you do not agree to the modified Terms, you should discontinue your access to and/or use of the Registry. Your continued access to and/or use of the Registry constitutes your acceptance of any modified Terms. - -8. Additional Terms. Depending on your intended use case(s), you must also abide by applicable terms below. - -## For MCP Developers - -9. Prohibitions. By accessing and using the Registry, including by submitting MCP servers and/or Registry Data, you agree not to: - 1. Share malicious or harmful content, such as malware, even in good faith or for research purposes, or perform any action with the intent of introducing any viruses, worms, defects, Trojan horses, malware, or any items of a destructive nature; - 2. Defame, abuse, harass, stalk, or threaten others; - 3. Interfere with or disrupt the Registry or any associated servers or networks; - 4. Submit data with the intent of confusing or misleading others, including but not limited to via spam, posting off-topic marketing content, posting MCP servers in a way that falsely implies affiliation with or endorsement by a third party, or repeatedly posting the same or similar MCP servers under different names; - 5. Promote or facilitate unlawful online gambling or disruptive commercial messages or advertisements; - 6. Use the Registry for any activities where the use or failure of the Registry could lead to death, personal injury, or environmental damage; - 7. Use the Registry to process or store any data that is subject to the International Traffic in Arms Regulations maintained by the U.S. Department of State. - -10. License. You agree that metadata about MCP servers you submit (e.g., schema name and description, URLs, identifiers) and other Registry Data is intended to be public, and will be dedicated to the public domain under [CC0 1.0 Universal](https://creativecommons.org/publicdomain/zero/1.0/). By submitting such data, you agree that you have the legal right to make this dedication (i.e., you own the copyright to these submissions or have permission from the copyright owner(s) to do so) and intend to do so. You understand that this dedication is perpetual, irrevocable, and worldwide, and you waive any moral rights you may have in your contributions to the fullest extent permitted by law. This dedication applies only to Registry Data and not to packages in third party registries that you might point to. - -11. Privacy and Publicity. You understand that any MCP server metadata you publish may be made public. This includes personal data such as your GitHub username, domain name, or details from your server description. Moreover, you understand that others may process personal information included in your MCP server metadata. For example, subregistries might enrich this data by adding how many stars your GitHub repository has, or perform automated security scanning on your code. By publishing a server, you agree that others may engage in this sort of processing, and you waive rights you might have in some jurisdictions to access, rectify, erase, restrict, or object to such processing. - ---- - -## File: docs/guides/contributing/releasing.md - -# Release Guide - -## Creating a Release - -1. **Go to GitHub**: Navigate to https://github.com/modelcontextprotocol/registry/releases -2. **Click "Draft a new release"** -3. **Choose a tag**: Click "Choose a tag" and type a new semantic version that follows the last one available (e.g., `v1.0.0`) -5. **Generate notes**: Click "Generate release notes" to auto-populate the name and description -6. **Publish**: Click "Publish release" - -The release workflow will automatically: -- Build binaries for 6 platforms (Linux, macOS, Windows × amd64, arm64) -- Create and push Docker images with `:latest` and `:vX.Y.Z` tags -- Attach all artifacts to the GitHub release -- Generate checksums and signatures - -## After Release - -- Docker images will be available at: - - `ghcr.io/modelcontextprotocol/registry:latest` - Latest stable release - - `ghcr.io/modelcontextprotocol/registry:vX.Y.Z` - Specific release version -- Binaries can be downloaded from the GitHub release page - -## Docker Image Tags - -The registry publishes different Docker image tags for different use cases: - -- **`:latest`** - Latest stable release (updated only on releases) -- **`:vX.Y.Z`** - Specific release versions (e.g., `:v1.0.0`) -- **`:main`** - Rolling tag updated on every push to main branch (continuous deployment) -- **`:main-YYYYMMDD-sha`** - Specific development builds from main branch - -## Versioning - -We use semantic versioning (SemVer): -- `v1.0.0` - Major release with breaking changes -- `v1.1.0` - Minor release with new features -- `v1.0.1` - Patch release with bug fixes - ---- - -## File: docs/reference/api/official-registry-api.md - -# Official MCP Registry API - -This document describes the API for the official MCP Registry hosted at `registry.modelcontextprotocol.io`. - -This API is based on the [generic registry API](./generic-registry-api.md) with additional endpoints and authentication. For practical examples of consuming the API, see the [API usage guide](../../guides/consuming/use-rest-api.md). For publishing servers using the API, see the [publishing guide](../../guides/publishing/publish-server.md). - -## Base URLs - -- **Production**: `https://registry.modelcontextprotocol.io` -- **Staging**: `https://staging.registry.modelcontextprotocol.io` - -## Interactive Documentation - -- **[Live API Docs](https://registry.modelcontextprotocol.io/docs)** - Stoplight elements with try-it-now functionality -- **[OpenAPI Spec](https://registry.modelcontextprotocol.io/openapi.yaml)** - Complete machine-readable specification - -## Extensions - -The official registry implements the [Generic Registry API](./generic-registry-api.md) with the following specific configurations and extensions: - -### Authentication - -Publishing requires namespace-based authentication: - -- **GitHub OAuth** - For `io.github.*` namespaces -- **GitHub OIDC** - For publishing from GitHub Actions -- **DNS verification** - For domain-based namespaces (`com.example.*`) -- **HTTP verification** - For domain-based namespaces (`com.example.*`) - -See [Publisher Commands](../cli/commands.md) for authentication setup. - -### Package Validation - -The official registry enforces additional [package validation requirements](../server-json/official-registry-requirements.md) when publishing. - -### Server List Filtering - -The official registry extends the `GET /v0/servers` endpoint with additional query parameters for improved discovery and synchronization: - -- `updated_since` - Filter servers updated after RFC3339 timestamp (e.g., `2025-08-07T13:15:04.280Z`) -- `search` - Case-insensitive substring search on server names (e.g., `filesystem`) - - This is intentionally simple. For more advanced searching and filtering, use a subregistry. -- `version` - Filter by version (currently supports `latest` for latest versions only) - -These extensions enable efficient incremental synchronization for downstream registries and improved server discovery. Parameters can be combined and work with standard cursor-based pagination. - -Example: `GET /v0/servers?search=filesystem&updated_since=2025-08-01T00:00:00Z&version=latest` - -### Additional endpoints -- POST `/v0/auth/dns` - Exchange signed DNS challenge for auth token -- POST `/v0/auth/http` - Exchange signed HTTP challenge for auth token -- POST `/v0/auth/github-at` - Exchange GitHub access token for auth token -- POST `/v0/auth/github-oidc` - Exchange GitHub OIDC token for auth token -- POST `/v0/auth/oidc` - Exchange Google OIDC token for auth token (for admins) - -#### Admin endpoints -- GET `/metrics` - Prometheus metrics endpoint -- GET `/v0/health` - Basic health check endpoint -- PUT `/v0/servers/{id}` - Edit existing server - ---- - -## File: docs/explanations/namespacing.md - -# Namespacing and Security - -Namespacing prevents name squatting, makes impersonation and typo squatting much harder, and provides attribution through domain-based identity. - -For practical steps on how to authenticate for different namespaces, see the [publishing guide](../guides/publishing/publish-server.md#authenticate). - -## Namespace Format - -All server names follow reverse-DNS format. Examples: -- `io.github.alice/weather-server` - GitHub user `alice` -- `com.acme/internal-tool` - Company domain `acme.com` -- `org.nonprofit.research/data-analyzer` - Subdomain `research.nonprofit.org` - -## Security Model - -### Ownership Verification - -Publishing to a namespace requires proving you control the corresponding identity: - -**GitHub namespaces** (`io.github.*`): -- OAuth login to GitHub account/organization -- OIDC tokens in GitHub Actions workflows - -**Domain namespaces** (`com.company.*`): -- DNS verification: TXT record at `company.com` -- HTTP verification: File at `https://company.com/.well-known/mcp-registry-auth` - -## Namespace Scoping - -Different authentication methods grant different namespace access: - -**GitHub OAuth/OIDC**: -- `io.github.username/*` (for personal accounts) -- `io.github.orgname/*` (for organizations) - -**DNS verification**: -- `com.domain/*` and `com.domain.*/*` (domain + all subdomains) - -**HTTP verification**: -- `com.domain/*` only (exact domain, no subdomains) - -## Limitations - -**Domain ownership changes**: If someone loses/sells a domain, they lose publishing rights. Similarly if someone gains a domain, they gain publishing rights. -**Package validation**: Registry validates namespace ownership, but actual packages may still be malicious etc. - ---- - -## File: docs/explanations/versioning.md - -# Server Versioning Guide - -This document describes the versioning approach for MCP servers published to the registry. - -## Overview - -The MCP Registry supports flexible versioning while encouraging semantic versioning best practices. The registry attempts to parse versions as semantic versions for ordering and comparison, but falls back gracefully for non-semantic versions. - -## Version Requirements - -1. **Version String**: `version` MUST be a string up to 255 characters -2. **Uniqueness**: Each version for a given server name must be unique -3. **Immutability**: Once published, version metadata cannot be changed - -## Best Practices - -### 1. Use Semantic Versioning -Server authors SHOULD use [semantic versions](https://semver.org/) following the `MAJOR.MINOR.PATCH` format: - -```json -{ - "version": "1.2.3" -} -``` - -### 2. Align with Package Versions -Server authors SHOULD use versions aligned with their underlying packages to reduce confusion: - -```json -{ - "version": "1.2.3", - "packages": [{ - "registry_name": "npm", - "name": "@myorg/my-server", - "version": "1.2.3" - }] -} -``` - -### 3. Multiple Registry Versions -If server authors expect to have multiple registry versions for the same package version, they SHOULD follow the semantic version spec using the prerelease label: - -```json -{ - "version": "1.2.3-1", - "packages": [{ - "registry_name": "npm", - "name": "@myorg/my-server", - "version": "1.2.3" - }] -} -``` - -**Note**: According to semantic versioning, `1.2.3-1` is considered lower than `1.2.3`, so if you expect to need a `1.2.3-1`, you should publish that before `1.2.3`. - -## Version Ordering and "Latest" Determination - -### For Semantic Versions -The registry attempts to parse versions as semantic versions. If successful, it uses semantic version comparison rules to determine: -- Version ordering in lists -- Which version is marked as `is_latest` - -### For Non-Semantic Versions -If version parsing as semantic version fails: -- The registry will always mark the version as latest (overriding any previous version) -- Clients should fall back to using publish timestamp for ordering - -**Important Note**: This behavior means that for servers with mixed semantic and non-semantic versions, the `is_latest` flag may not align with the total ordering. A non-semantic version published after semantic versions will be marked as latest, even if semantic versions are considered "higher" in the ordering. - -## Implementation Details - -### Registry Behavior -1. **Validation**: Versions are validated for uniqueness within a server name -2. **Parsing**: The registry attempts to parse each version as semantic version -3. **Comparison**: Uses semantic version rules when possible, falls back to timestamp -4. **Latest Flag**: The `is_latest` field is set based on the comparison results - -### Client Recommendations -Registry clients SHOULD: -1. Attempt to interpret versions as semantic versions when possible -2. Use the following ordering rules: - - If one version is marked as is_latest: it is later - - If both versions are valid semver: use semver comparison - - If neither are valid semver: use publish timestamp - - If one is semver and one is not: semver version is considered higher - -## Examples - -### Valid Semantic Versions -```javascript -"1.0.0" // Basic semantic version -"2.1.3-alpha" // Prerelease version -"1.0.0-beta.1" // Prerelease with numeric suffix -"3.0.0-rc.2" // Release candidate -``` - -### Non-Semantic Versions (Allowed) -```javascript -"v1.0" // Version with prefix -"2021.03.15" // Date-based versioning -``` - -### Not Allowed: Version Ranges -The registry requires specific versions for both the top-level `version` and any `packages[].version`. Version ranges or wildcard versions are rejected during publish, including but not limited to: - -```javascript -"^1.2.3" -"~1.2.3" -">=1.2.3" -"<=1.2.3" -">1.2.3" -"<1.2.3" -"1.x" -"1.2.*" -"1 - 2" -"1.2 || 1.3" -``` - -### Alignment Examples -```json -{ - "version": "1.2.3-1", - "packages": [{ - "registry_name": "npm", - "name": "@myorg/k8s-server", - "version": "1.2.3" - }] -} -``` - -## Migration Path - -Existing servers with non-semantic versions will continue to work without changes. However, to benefit from proper version ordering, server maintainers are encouraged to: - -1. Adopt semantic versioning for new releases -2. Consider the ordering implications when transitioning from non-semantic to semantic versions -3. Use prerelease labels for registry-specific versioning needs - -## Common Scenarios - -### Standard Releases -**Package and server versions aligned**: -```json -{ - "version": "1.2.3", - "packages": [ - { - "registry_type": "npm", - "identifier": "@myorg/server", - "version": "1.2.3" - } - ] -} -``` - -### Registry-Only Updates -**Server metadata changes without package updates**: -```json -{ - "version": "1.2.3-1", - "packages": [ - { - "registry_type": "npm", - "identifier": "@myorg/server", - "version": "1.2.3" - } - ] -} -``` - -Note: `1.2.3-1` is considered lower than `1.2.3` in semver ordering. Publish prerelease versions first. - -### Remote Server Versioning -**Remote servers without package dependencies**: -```json -{ - "version": "2.1.0", - "remotes": [ - { - "transport_type": "sse", - "url": "https://api.myservice.com/mcp/v2.1" - } - ] -} -``` - -Version strategy options: -- **API versioning**: Match your service API version -- **Semantic versioning**: Standard semver for feature changes -- **Date-based**: `2024.03.15` for regular releases - -### Multi-Package Versioning -**Different package versions**: -```json -{ - "version": "1.3.0", - "packages": [ - { - "registry_type": "npm", - "identifier": "@myorg/server", - "version": "1.3.0" - }, - { - "registry_type": "oci", - "identifier": "myorg/server", - "version": "1.2.5" - } - ] -} -``` - -Use server version to indicate the overall release. - -## Decision Guide - -**Which version strategy should I use?** - -``` -Do you have underlying packages? -├─ Yes: Align with package version -│ ├─ Same package version → Use package version -│ └─ Different package versions → Use highest + indicate relationship -└─ No (remote server): Choose versioning scheme - ├─ API versioning → Match service API version - ├─ Feature-based → Use semantic versioning - └─ Regular releases → Consider date-based versioning -``` - -## Future Considerations - -This versioning approach is designed to be compatible with potential future changes to the MCP specification's `Implementation.version` field. Any SHOULD requirements introduced here may be proposed as updates to the specification through the SEP (Specification Enhancement Proposal) process. - ---- - -## File: docs/guides/consuming/use-rest-api.md - -# Consuming Registry Data via REST API - -Integration patterns and best practices for building applications that consume MCP registry data. - -## Key details - -**Base URL**: `https://registry.modelcontextprotocol.io` - -**Authentication**: Not required for read-only access - -- **`GET /v0/servers`** - List all servers with pagination -- **`GET /v0/servers/{id}`** - Get server details by UUID - -See the [interactive API documentation](https://registry.modelcontextprotocol.io/docs) for complete request/response schemas. - -**Disclaimer**: The official registry provides no uptime or data durability guarantees. You should design your applications to handle service downtime via caching. - -## Building a subregistry -**Create enhanced registries** - ETL official registry data and add your own metadata like ratings, security scans, or compatibility info. - -For now we recommend scraping the `GET /v0/servers` endpoint on some regular basis. In the future we might provide a filter for updated_at ([#291](https://github.com/modelcontextprotocol/registry/issues/291)) to get only recently changed servers. - -Servers are generally immutable, except for the `status` field which can be updated to `deleted` (among other states). For these packages, we recommend you also update the status field to `deleted` or remove the package from your registry quickly. This is because this status generally indicates it has violated our permissive [moderation guidelines](../administration/moderation-guidelines.md), suggesting it is illegal, malware or spam. - -### Filtering & Enhancement - -The official registry has a [permissive moderation policy](../administration/moderation-guidelines.md), so you may want to implement your own filtering on top of registry data. - -You can also add custom metadata to servers using the `_meta` field. For example, user ratings, download counts, or security scan results. If you do this, we recommend you put this under a key that is namespaced to your organization, for example: - -```json -{ - "$schema": "https://static.modelcontextprotocol.io/schemas/2025-07-09/server.schema.json", - "name": "io.github.yourname/weather-server", - "description": "MCP server for weather data access", - "status": "active", - "version": "1.0.0", - "packages": [ - { - "registry_type": "npm", - "identifier": "weather-mcp-server", - "version": "1.0.0" - } - ], - "_meta": { - "com.example.subregistry/custom": { - "user_rating": 4.5, - "download_count": 12345, - "security_scan": { - "last_scanned": "2024-06-01T12:00:00Z", - "vulnerabilities_found": 0 - } - } - } -} -``` - -### Providing an API - -We recommend that your subregistry provides an API meeting the registry API specification, so it's easy for clients to switch between registries. See the [registry API documentation](../../reference/api/) for details. - -## MCP Client Integration -**Convert registry data to client configuration** - Fetch servers and transform package information into your MCP client's config format. - -We highly recommend using a subregistry rather than fetching data from the official registry directly. You might want to make this configurable so that users of your client can choose their preferred registry, for example we expect that some enterprise users may have their own registry. - -Your client should gracefully handle registries that meet the minimum spec, i.e. avoid hard dependencies on `_meta` fields. - -### Filtering - -You likely should filter out servers that are not `active` in the `status` field. - -### Running servers - -You can use the `packages` or `remotes` field to determine how to run a server. More details of these fields are in the [server.json documentation](../../reference/server-json/generic-server-json.md). - ---- - -## File: docs/guides/publishing/github-actions.md - -# Automate Publishing with GitHub Actions - -Set up automated MCP server publishing using GitHub Actions. - -## What You'll Learn - -By the end of this tutorial, you'll have: - -- A GitHub Actions workflow that automatically publishes your server -- Understanding of GitHub OIDC authentication -- Knowledge of best practices for automated publishing -- Working examples for Node.js, Python, and Docker projects - -## Prerequisites - -- Understand general publishing requirements like package verification (see the [publishing guide](publish-server.md)) -- GitHub repository with your MCP server code - -## GitHub Actions Setup - -### Step 1: Create Workflow File - -Create `.github/workflows/publish-mcp.yml`. Here's an example for NPM-based packages, but the MCP registry publishing steps are the same for all package types: - -```yaml -name: Publish to MCP Registry - -on: - push: - tags: ["v*"] # Triggers on version tags like v1.0.0 - -jobs: - publish: - runs-on: ubuntu-latest - permissions: - id-token: write # Required for OIDC authentication - contents: read - - steps: - - name: Checkout code - uses: actions/checkout@v5 - - - name: Setup Node.js # Adjust for your language - uses: actions/setup-node@v5 - with: - node-version: "lts/*" - - - name: Install dependencies - run: npm ci - - - name: Run tests - run: npm run test --if-present - - - name: Build package - run: npm run build --if-present - - - name: Publish to npm - run: npm publish - env: - NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} - - - name: Install MCP Publisher - run: | - curl -L "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_$(uname -s | tr '[:upper:]' '[:lower:]')_$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/').tar.gz" | tar xz mcp-publisher - - - name: Login to MCP Registry - run: ./mcp-publisher login github-oidc - - - name: Publish to MCP Registry - run: ./mcp-publisher publish -``` - -### Step 2: Configure Secrets - -You don't need any secrets for publishing to the MCP Registry using GitHub OIDC. - -However you might need to add secrets for your package registry. For example the workflow above needs a `NPM_TOKEN` (which you can add in Settings → Secrets and variables → Actions). - -### Step 3: Tag and Release - -Create a version tag to trigger the workflow: - -```bash -git tag v1.0.0 -git push origin v1.0.0 -``` - -The workflow runs tests, builds your package, publishes to npm, and publishes to the MCP Registry. - -## Authentication Methods - -### GitHub Actions OIDC (Recommended) - -```yaml -- name: Login to MCP Registry - run: mcp-publisher login github-oidc -``` - -### GitHub Personal Access Token - -```yaml -- name: Login to MCP Registry - run: mcp-publisher login github --token ${{ secrets.GITHUB_TOKEN }} - env: - GITHUB_TOKEN: ${{ secrets.MCP_GITHUB_TOKEN }} -``` - -Add `MCP_GITHUB_TOKEN` secret with a GitHub PAT that has repo access. - -### DNS Authentication - -For custom domain namespaces (`com.yourcompany/*`): - -```yaml -- name: Login to MCP Registry - run: | - echo "${{ secrets.MCP_PRIVATE_KEY }}" > key.pem - mcp-publisher login dns --domain yourcompany.com --private-key-file key.pem -``` - -Add your Ed25519 private key as `MCP_PRIVATE_KEY` secret. - -## Examples - -See these real-world examples of automated publishing workflows: -- [NPM, Docker and MCPB](https://github.com/domdomegg/airtable-mcp-server) -- [NuGet](https://github.com/domdomegg/time-mcp-nuget) -- [PyPI](https://github.com/domdomegg/time-mcp-pypi) - -## Tips - -You can keep your package version and server.json version in sync automatically with something like: -```yaml -- run: | - VERSION=${GITHUB_REF#refs/tags/v} - jq --arg v "$VERSION" '.version = $v' server.json > tmp && mv tmp server.json -``` - -## Troubleshooting -- **"Authentication failed"**: Ensure `id-token: write` permission is set for OIDC, or check secrets -- **"Package validation failed"**: Verify your package published to your registry (NPM, PyPi etc.) successfully first, and that you have done the necessary validation steps in the [Publishing Tutorial](publish-server.md) - ---- - -## File: docs/guides/publishing/publish-server.md - -# Publish Your MCP Server - -Complete guide to publishing an MCP server to the registry. - -> [!TIP] -> Using an agentic AI coding assistant? Just use this prompt: -> ``` -> Read https://raw.githubusercontent.com/modelcontextprotocol/registry/refs/heads/main/docs/guides/publishing/publish-server.md and https://raw.githubusercontent.com/modelcontextprotocol/registry/refs/heads/main/docs/guides/publishing/github-actions.md. Evaluate the best way to publish this server to the registry (prefer automated CI flows over manual flows where possible), and implement that. If possible, validate the server.json against the $schema before telling the user you are done, using a proper json schema library or tool available on the user's machine. If you get stuck, guide the user through the parts of the publishing process they need to do (e.g. logging into the publisher CLI if doing manual pubishing). -> ``` - -## What You'll Learn - -By the end of this tutorial, you'll have: -- Created a server.json file for your MCP server -- Authenticated with the registry -- Successfully published your server -- Verified your server appears in the registry - -## Prerequisites - -- An MCP server you've already built ([follow this guide if you don't have one already](https://modelcontextprotocol.io/quickstart/server)) - -## Deployment Options - -You can make your MCP server available in multiple ways: - -- **📦 Package deployment**: Published to registries (npm, PyPI, Docker Hub, etc.) and run locally by clients -- **🌐 Remote deployment**: Hosted as a web service that clients connect to directly -- **🔄 Hybrid deployment**: Offer both package and remote options for maximum flexibility - -Learn more about [MCP server architecture](https://modelcontextprotocol.io/docs/concepts/servers) in the official docs. - -## Step 1: Install the Publisher CLI - -
    -🍺 macOS/Linux/WSL: With Homebrew (recommended) - -Requires [Homebrew](https://brew.sh): - -```bash -brew install mcp-publisher -``` - -
    - -
    -⬇️ macOS/Linux/WSL: Pre-built binaries - -```bash -curl -L "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_$(uname -s | tr '[:upper:]' '[:lower:]')_$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/').tar.gz" | tar xz mcp-publisher && sudo mv mcp-publisher /usr/local/bin/ -``` - -
    - -
    -🏗️ macOS/Linux/WSL: From source - -Requires Git, Make and Go 1.24+: - -```bash -# Clone the registry repository -git clone https://github.com/modelcontextprotocol/registry -cd registry -make publisher - -# The binary will be at bin/mcp-publisher -export PATH=$PATH:$(pwd)/bin -``` - -
    - -
    -🪟 Windows PowerShell: Pre-built binaries - -```powershell -$arch = if ([System.Runtime.InteropServices.RuntimeInformation]::ProcessArchitecture -eq "Arm64") { "arm64" } else { "amd64" }; Invoke-WebRequest -Uri "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_windows_$arch.tar.gz" -OutFile "mcp-publisher.tar.gz"; tar xf mcp-publisher.tar.gz mcp-publisher.exe; rm mcp-publisher.tar.gz -# Move mcp-publisher.exe to a directory in your PATH -``` - -
    - -## Step 2: Initialize Your server.json - -Navigate to your server's directory and create a template: - -```bash -cd /path/to/your/mcp-server -mcp-publisher init -``` - -This creates a `server.json` with auto-detected values. You'll see something like: - -```json -{ - "$schema": "https://static.modelcontextprotocol.io/schemas/2025-07-09/server.schema.json", - "name": "io.github.yourname/your-server", - "description": "A description of your MCP server", - "version": "1.0.0", - "packages": [ - { - "registry_type": "npm", - "identifier": "your-package-name", - "version": "1.0.0" - } - ] -} -``` - -## Step 3: Configure Your Server Details - -Edit the generated `server.json`: - -### Choose Your Namespace - -The `name` field determines authentication requirements: - -- **`io.github.yourname/*`** - Requires GitHub authentication -- **`com.yourcompany/*`** - Requires DNS or HTTP domain verification - -### Configure Deployment Methods - -Configure your server to support packages, remotes, or both: - -#### Package Deployment - -Add package validation metadata to prove ownership of your packages. - - -
    -📦 NPM Packages - -### Requirements -Add an `mcpName` field to your `package.json`: - -```json -{ - "name": "your-npm-package", - "version": "1.0.0", - "mcpName": "io.github.username/server-name" -} -``` - -### How It Works -- Registry fetches `https://registry.npmjs.org/your-npm-package` -- Checks that `mcpName` field matches your server name -- Fails if field is missing or doesn't match - -### Example server.json -```json -{ - "name": "io.github.username/server-name", - "packages": [ - { - "registry_type": "npm", - "identifier": "your-npm-package", - "version": "1.0.0" - } - ] -} -``` - -The official MCP registry currently only supports the NPM public registry (`https://registry.npmjs.org`). - -
    - -
    -🐍 PyPI Packages - -### Requirements -Include your server name in your package README file using this format: - -**MCP name format**: `mcp-name: io.github.username/server-name` - -Add it to your README.md file (which becomes the package description on PyPI). This can be in a comment if you want to hide it from display elsewhere. - -### How It Works -- Registry fetches `https://pypi.org/pypi/your-package/json` -- Passes if `mcp-name: server-name` is in the README content - -### Example server.json -```json -{ - "name": "io.github.username/server-name", - "packages": [ - { - "registry_type": "pypi", - "identifier": "your-pypi-package", - "version": "1.0.0" - } - ] -} -``` - -The official MCP registry currently only supports the official PyPI registry (`https://pypi.org`). - -
    - -
    -📋 NuGet Packages - -### Requirements -Include your server name in your package's README using this format: - -**MCP name format**: `mcp-name: io.github.username/server-name` - -Add a README file to your NuGet package that includes the server name. This can be in a comment if you want to hide it from display elsewhere. - -### How It Works -- Registry fetches and cached service index `https://api.nuget.org/v3/index.json` -- Registry uses `ReadmeUriTemplate/6.13.0` URL template in service index to fetch README -- Passes if `mcp-name: server-name` is found in the README content - -### Example server.json -```json -{ - "name": "io.github.username/server-name", - "packages": [ - { - "registry_type": "nuget", - "identifier": "Your.NuGet.Package", - "version": "1.0.0" - } - ] -} -``` - -The official MCP registry currently only supports the official NuGet registry (`https://api.nuget.org/v3/index.json`). - -
    - -
    -🐳 Docker/OCI Images - -### Requirements -Add an annotation to your Docker image: - -```dockerfile -LABEL io.modelcontextprotocol.server.name="io.github.username/server-name" -``` - -### How It Works -- Registry authenticates with Docker Hub using public token -- Fetches image manifest using Docker Registry v2 API -- Checks that `io.modelcontextprotocol.server.name` annotation matches your server name -- Fails if annotation is missing or doesn't match - -### Example server.json -```json -{ - "name": "io.github.username/server-name", - "packages": [ - { - "registry_type": "oci", - "identifier": "yourusername/your-mcp-server", - "version": "1.0.0" - } - ] -} -``` - -The identifier is `namespace/repository`, and version is the tag and optionally digest. - -The official MCP registry currently only supports the official Docker registry (`https://docker.io`). - -
    - -
    -📁 MCPB Packages - -### Requirements -**MCP reference** - MCPB package URLs must contain "mcp" somewhere within them, to ensure the correct artifact has been uploaded. This may be with the `.mcpb` extension or in the name of your repository. - -**File integrity** - MCPB packages must include a SHA-256 hash for file integrity verification. This is required at publish time and MCP clients will validate this hash before installation. - -### How to Generate File Hashes -Calculate the SHA-256 hash of your MCPB file: - -```bash -openssl dgst -sha256 server.mcpb -``` - -### Example server.json -```json -{ - "name": "io.github.username/server-name", - "packages": [ - { - "registry_type": "mcpb", - "identifier": "https://github.com/you/your-repo/releases/download/v1.0.0/server.mcpb", - "file_sha256": "fe333e598595000ae021bd27117db32ec69af6987f507ba7a63c90638ff633ce" - } - ] -} -``` - -### File Hash Validation -- **Authors** are responsible for generating correct SHA-256 hashes when creating server.json -- **MCP clients** validate the hash before installing packages to ensure file integrity -- **The official registry** stores hashes but does not validate them -- **Subregistries** may choose to implement their own validation. This enables them to perform security scanning on MCPB files, and ensure clients get the same security scanned content. - -The official MCP registry currently only supports artifacts hosted on GitHub or GitLab releases. - -
    - -#### Remote Deployment - -Add the `remotes` field to your `server.json` (can coexist with `packages`): - -
    -🌐 Remote Server Configuration - -### Requirements - -- **Service endpoint**: Your MCP server must be accessible at the specified URL -- **Transport protocol**: Choose from `sse` (Server-Sent Events) or `streamable-http` -- **URL validation**: For domain namespaces only (see URL requirements below) - -### Example server.json - -```json -{ - "$schema": "https://static.modelcontextprotocol.io/schemas/2025-07-09/server.schema.json", - "name": "com.yourcompany/api-server", - "description": "Cloud-hosted MCP server for API operations", - "version": "2.0.0", - "remotes": [ - { - "type": "sse", - "url": "https://mcp.yourcompany.com/sse" - } - ] -} -``` - -### Multiple Transport Options - -You can offer multiple connection methods: - -```json -{ - "remotes": [ - { - "type": "sse", - "url": "https://mcp.yourcompany.com/sse" - }, - { - "type": "streamable-http", - "url": "https://mcp.yourcompany.com/http" - } - ] -} -``` - -### URL Validation Requirements - -- For `com.yourcompany/*` namespaces: URLs must be on `yourcompany.com` or its subdomains -- For `io.github.username/*` namespaces: No URL restrictions (but you must authenticate via GitHub) - -### Authentication Headers (Optional) - -Configure headers that clients should send when connecting: - -```json -{ - "remotes": [ - { - "type": "sse", - "url": "https://mcp.yourcompany.com/sse", - "headers": [ - { - "name": "X-API-Key", - "description": "API key for authentication", - "is_required": true, - "is_secret": true - } - ] - } - ] -} -``` - -
    - -## Step 4: Authenticate - -Choose your authentication method based on your namespace: - -### GitHub Authentication (for io.github.* namespaces) - -```bash -mcp-publisher login github -``` - -This opens your browser for OAuth authentication. - -### DNS Authentication (for custom domains) - -```bash -# Generate keypair -openssl genpkey -algorithm Ed25519 -out key.pem - -# Get public key for DNS record -echo "yourcompany.com. IN TXT \"v=MCPv1; k=ed25519; p=$(openssl pkey -in key.pem -pubout -outform DER | tail -c 32 | base64)\"" - -# Add the TXT record to your DNS, then login -mcp-publisher login dns --domain yourcompany.com --private-key $(openssl pkey -in key.pem -noout -text | grep -A3 "priv:" | tail -n +2 | tr -d ' :\n') -``` - -## Step 5: Publish Your Server - -With authentication complete, publish your server: - -```bash -mcp-publisher publish -``` - -You'll see output like: -``` -✓ Successfully published -``` - -## Step 6: Verify Publication - -Check that your server appears in the registry by searching for it: - -```bash -curl "https://registry.modelcontextprotocol.io/v0/servers?search=io.github.yourname/weather-server" -``` - -You should see your server metadata returned in the JSON response. - -## Troubleshooting - -**"Package validation failed"** - Ensure your package includes the required validation metadata (mcpName field, README mention, or Docker label). - -**"Authentication failed"** - Verify you've correctly set up DNS records or are logged into the right GitHub account. - -**"Namespace not authorized"** - Your authentication method doesn't match your chosen namespace format. - -## Examples - -See these real-world examples of published servers: -- [NPM, Docker and MCPB example](https://github.com/domdomegg/airtable-mcp-server) -- [NuGet example](https://github.com/domdomegg/time-mcp-nuget) -- [PyPI example](https://github.com/domdomegg/time-mcp-pypi) - -## Next Steps - -- **Update your server**: Publish new versions with updated server.json files -- **Set up CI/CD**: Automate publishing with [GitHub Actions](github-actions.md) -- **Learn more**: Understand [server.json format](../../reference/server-json/generic-server-json.md) in depth -- **More examples**: See [remote server configurations](../../reference/server-json/generic-server-json.md#remote-server-example) and [hybrid deployments](../../reference/server-json/generic-server-json.md#server-with-remote-and-package-options) in the schema documentation - -## What You've Accomplished - -You've successfully published your first MCP server to the registry! Your server is now discoverable by MCP clients and can be installed by users worldwide. - ---- - -## File: docs/reference/api/generic-registry-api.md - -# Generic Registry API Specification - -A standardized RESTful HTTP API for MCP registries to provide consistent endpoints for discovering and retrieving MCP servers. - -Also see: -- For guidance consuming the API, see the [consuming guide](../../guides/consuming/use-rest-api.md). - -## Browse the Complete API Specification - -**📋 View the full API specification interactively**: Open [openapi.yaml](./openapi.yaml) in an OpenAPI viewer like [Stoplight Elements](https://elements-demo.stoplight.io/?spec=https://raw.githubusercontent.com/modelcontextprotocol/registry/refs/heads/main/docs/reference/api/openapi.yaml). - -The official registry has some more endpoints and restrictions on top of this. See the [official registry API spec](./official-registry-api.md) for details. - -## Quick Reference - -### Core Endpoints -- **`GET /v0/servers`** - List all servers with pagination -- **`GET /v0/servers/{id}`** - Get server details by UUID -- **`POST /v0/publish`** - Publish new server (optional, registry-specific authentication) - -### Authentication -- **Read operations**: No authentication required -- **Write operations**: Registry-specific authentication (if supported) - -### Content Type -All requests and responses use `application/json` - -### Basic Example: List Servers - -```bash -curl https://registry.example.com/v0/servers?limit=10 -``` - -```json -{ - "servers": [ - { - "name": "io.modelcontextprotocol/filesystem", - "description": "Filesystem operations server", - "status": "active", - "version": "1.0.2" - } - ], - "metadata": { - "count": 10, - "next_cursor": "eyJ..." - } -} -``` - -For complete endpoint documentation, view the OpenAPI specification in a schema viewer. - ---- - -## File: docs/reference/cli/commands.md - -# Publisher CLI Commands Reference - -Complete command reference for the `mcp-publisher` CLI tool. - -See the [publishing guide](../../guides/publishing/publish-server.md) for a walkthrough of using the CLI to publish a server. - -## Installation - -Install via Homebrew (macOS/Linux): - -```bash -$ brew install mcp-publisher -``` - -## Global Options - -All commands support: -- `--help`, `-h` - Show command help -- `--registry` - Registry URL (default: `https://registry.modelcontextprotocol.io`) - -## Commands - -### `mcp-publisher init` - -Generate a `server.json` template with automatic detection. - -**Usage:** -```bash -mcp-publisher init [options] -``` - -**Behavior:** -- Creates `server.json` in current directory -- Auto-detects package managers (`package.json`, `setup.py`, etc.) -- Pre-fills fields where possible -- Prompts for missing required fields - -**Example output:** -```json -{ - "name": "io.github.username/server-name", - "description": "TODO: Add server description", - "version": "1.0.0", - "packages": [ - { - "registry_type": "npm", - "identifier": "detected-package-name", - "version": "1.0.0" - } - ] -} -``` - -### `mcp-publisher login ` - -Authenticate with the registry. - -**Authentication Methods:** - -#### GitHub Interactive -```bash -mcp-publisher login github [--registry=URL] -``` -- Opens browser for GitHub OAuth flow -- Grants access to `io.github.{username}/*` and `io.github.{org}/*` namespaces - -#### GitHub OIDC (CI/CD) -```bash -mcp-publisher login github-oidc [--registry=URL] -``` -- Uses GitHub Actions OIDC tokens automatically -- Requires `id-token: write` permission in workflow -- No browser interaction needed - -Also see [the guide to publishing from GitHub Actions](../../guides/publishing/github-actions.md). - -#### DNS Verification -```bash -mcp-publisher login dns --domain=example.com --private-key=HEX_KEY [--registry=URL] -``` -- Verifies domain ownership via DNS TXT record -- Grants access to `com.example.*` namespaces -- Requires Ed25519 private key (64-character hex) - -**Setup:** -```bash -# Generate keypair -openssl genpkey -algorithm Ed25519 -out key.pem - -# Get public key for DNS record -openssl pkey -in key.pem -pubout -outform DER | tail -c 32 | base64 - -# Add DNS TXT record: -# example.com. IN TXT "v=MCPv1; k=ed25519; p=PUBLIC_KEY" - -# Extract private key for login -openssl pkey -in key.pem -noout -text | grep -A3 "priv:" | tail -n +2 | tr -d ' :\n' -``` - -#### HTTP Verification -```bash -mcp-publisher login http --domain=example.com --private-key=HEX_KEY [--registry=URL] -``` -- Verifies domain ownership via HTTPS endpoint -- Grants access to `com.example.*` namespaces -- Requires Ed25519 private key (64-character hex) - -**Setup:** -```bash -# Generate keypair (same as DNS) -openssl genpkey -algorithm Ed25519 -out key.pem - -# Host public key at: -# https://example.com/.well-known/mcp-registry-auth -# Content: v=MCPv1; k=ed25519; p=PUBLIC_KEY -``` - -#### Anonymous (Testing) -```bash -mcp-publisher login none [--registry=URL] -``` -- No authentication - for local testing only -- Only works with local registry instances - -### `mcp-publisher publish` - -Publish server to the registry. - -For detailed guidance on the publishing process, see the [publishing guide](../../guides/publishing/publish-server.md). - -**Usage:** -```bash -mcp-publisher publish [PATH] -``` - -**Options:** -- `PATH` - Path to server.json (default: `./server.json`) - -**Process:** -1. Validates `server.json` against schema -2. Publishes the `server.json` to the registry server URL specified in the login token -3. Server: Verifies package ownership (see [Official Registry Requirements](../server-json/official-registry-requirements.md)) -4. Server: Checks namespace authentication -5. Server: Publishes to registry - -**Example:** -```bash -# Basic publish -mcp-publisher publish - -# Custom file location -mcp-publisher publish ./config/server.json -``` - -### `mcp-publisher logout` - -Clear stored authentication credentials. - -**Usage:** -```bash -mcp-publisher logout -``` - -**Behavior:** -- Removes `~/.config/mcp-publisher/token.json` -- Also cleans up legacy token files (`~/.mcp_publisher_token`, `.mcpregistry_*`) -- Does not revoke tokens on server side - -## Configuration - -### Token Storage -Authentication tokens are stored in `~/.config/mcp-publisher/token.json` as JSON: -```json -{ - "token": "jwt-token-here", - "method": "github", - "registry": "https://registry.modelcontextprotocol.io" -} -``` - -> **Note:** Tokens were previously stored in `~/.mcp_publisher_token`. If you are upgrading, run `mcp-publisher logout` followed by `mcp-publisher login` to migrate to the new location. - ---- - -## File: docs/reference/faq.md - -# MCP Registry FAQ - -These questions come up often in discussions about the MCP Registry. If you have a question that isn't answered here, please start a discussion on the [MCP Registry Discussions page](https://github.com/modelcontextprotocol/registry/discussions). - -## General Questions - -### What is the MCP Registry? - -The MCP Registry is the official centralized metadata repository for publicly-accessible MCP servers. It provides: - -- A single place for server creators to publish metadata about their servers -- A REST API for MCP clients and aggregators to discover available servers -- Standardized installation and configuration information -- Namespace management through DNS verification - -### What is the difference between "Official MCP Registry", "MCP Registry", "MCP registry", "MCP Registry API", etc? - -There are four underlying concepts: -- "MCP Server Registry API" (or "MCP Registry API"): The OpenAPI specification defined in [openapi.yaml](./api/openapi.yaml). This is a reusable API specification that anyone building any sort of "MCP server registry" should consider adopting / aligning with. -- "Official MCP Registry" (or "MCP Registry"): The application that lives at `https://registry.modelcontextprotocol.io`. This registry currently only catalogs MCP servers, but may be extended in the future to also catalog MCP client/host apps and frameworks. -- "Official MCP Registry API": The REST API served at `https://registry.modelcontextprotocol.io`, which is a superset of the MCP Registry API. Its OpenAPI specification can be downloaded from [https://registry.modelcontextprotocol.io/openapi.yaml](https://registry.modelcontextprotocol.io/openapi.yaml) -- "MCP server registry" (or "MCP registry"): A third party, likely commercial, implementation of the MCP Server Registry API or derivative specification. - -### Is the MCP Registry a package registry? - -No. The MCP Registry stores metadata about MCP servers and references to where they're hosted (npm, PyPI, NuGet, Docker Hub, etc.), but does not host the actual source code or packages. - -### Who should use the MCP Registry directly? - -The registry is primarily designed for programmatic consumption by subregistries (Smithery, PulseMCP, Docker Hub, Anthropic, GitHub, etc.). It is NOT currently intended for individual clients or end-users (they should use subregistries). - -### Will there be feature X? - -See [roadmap.md](../explanations/roadmap.md). - -## Publishing Servers - -### How do I publish my MCP server? - -See the [publisher README](../../cmd/publisher/README.md) - -### What namespaces are available? - -- **With GitHub verification**: `io.github.yourusername/server-name`, `io.github.yourorg/server-name` -- **With DNS verification**: `com.yourcompany.*`, `com.yourcompany.*/*` -- **With HTTP verification**: `com.yourcompany/*` - -### Is open source required? - -No. While open source code is encouraged, it is not required for either locally or remotely run servers. - -### What package registries are supported? - -- npm (Node.js packages) -- PyPI (Python packages) -- NuGet.org (.NET packages) -- GitHub Container Registry (GHCR) -- Docker Hub - -More can be added as the community desires; feel free to open an issue if you are interested in building support for another registry. - -### Can I publish multiple versions? - -Yes, versioning is supported: - -- Each version gets its own immutable metadata -- Version strings must be unique for each server -- Old versions remain accessible for compatibility -- The registry tracks which version is "latest" based on semantic version ordering when possible - -### How do I update my server metadata? - -Submit a new `server.json` with a unique version string. Once published, version metadata is immutable (similar to npm). - -### What version format should I use? - -The registry accepts any version string up to 255 characters, but we recommend: - -- **SHOULD use semantic versioning** (e.g., "1.0.2", "2.1.0-alpha") for predictable ordering -- **SHOULD align with package versions** to reduce confusion -- **MAY use prerelease labels** (e.g., "1.0.0-1") for registry-specific versions - -The registry attempts to parse versions as semantic versions for proper ordering. Non-semantic versions are allowed but will be ordered by publication timestamp. Version ranges (e.g., `^1.2.3`, `~1.2.3`, `>=1.2.3`, `1.x`, `1.*`) are rejected; publish a specific version instead. See the [versioning guide](../explanations/versioning.md) for detailed guidance. - -### Can I add custom metadata when publishing? - -Yes, extensions under the `x-publisher` property are preserved when publishing to the registry. This allows you to include custom metadata specific to your publishing process. - -### Can I delete/unpublish my server? - -At time of last update, this was open for discussion in [#104](https://github.com/modelcontextprotocol/registry/issues/104). - -### Can I publish a private server? - -Private servers are those that are only accessible to a narrow set of users. For example, servers published on a private network (like `mcp.acme-corp.internal`) or on private package registries (e.g. `npx -y @acme/mcp --registry https://artifactory.acme-corp.internal/npm`). - -These are generally not supported on the official MCP registry, which is designed for publicly accessible MCP servers. - -If you want to publish private servers we recommend you host your own MCP subregistry, and add them there. - -## Security & Trust - -### How do I know a server is from the claimed organization? - -DNS verification ensures namespace ownership. For example: - -- `com.microsoft/server` requires DNS verification of microsoft.com -- `io.github.name/server` is tied to a GitHub account or GitHub organization `name` - -### Is there security scanning? - -The MVP delegates security scanning to: -- underlying package registries; and -- subregistries - -### How is spam prevented? - -- Namespace authentication requirements -- Character limits and regex validation on free-form fields -- Manual takedown of spam or malicious servers - -In future we might explore: -- Stricter rate limiting (e.g., 10 new servers per user per day) -- Potential AI-based spam detection -- Community reporting and admin blacklisting capabilities - -## API & Integration - -### How often should I poll the registry? - -Recommended polling frequency: - -- `/servers` endpoint: once per hour -- `/servers/:id` endpoint: once per version (results are immutable) -- Design assumes CDN caching between registry and consumers - -Also see [#291](https://github.com/modelcontextprotocol/registry/issues/291), which might mean the above can be more regular. - -### Will there be webhooks? - -Not in the initial MVP, but the architecture supports adding webhooks for update notifications in the future. - -### Can I run my own registry instance? - -Yes! The API shapes and data formats are intentionally designed for reuse by subregistries. Organizations needing private registries should: - -- Implement the same API shape -- Use the same `server.json` format -- Potentially mirror/filter the official registry data - -### Can I extend the registry API? - -Yes, we support `x-com.example` style extensions in a bunch of places - see the official MCP registry API spec. This can be used to add annotations to many objects, e.g. add security scanning details, enrich package metadata, etc. - -If you have a use case that can't be addressed here, raise a GitHub issue! - -### Can I use the code here to run my own registry instance? - -The registry implementation here is not designed for self-hosting, but you're welcome to try to use it/fork it as necessary. Note that this is not an intended use, and the registry maintainers cannot provide any support for this at this time. - -## Operations & Maintenance - -### What's the expected reliability? - -- This is a community maintained project without full time staffing. You should therefore expect downtime periods of up to 1 business day. No strict guarantees are provided. (Also see discussion in [#150](https://github.com/modelcontextprotocol/registry/issues/150)) -- Ideally clients should use subregistries with higher availability guarantees, to avoid direct end-user impact (as subregistries can cache data). - -### What if I need to report a spam or malicious server? - -1. Report it as abuse to the underlying package registry (e.g. NPM, PyPi, DockerHub, etc.); and -2. Raise a GitHub issue on the registry repo with a title beginning `Abuse report: ` - -### What if I need to report a security vulnerability in the registry itself? - -Follow [the MCP community SECURITY.md](https://github.com/modelcontextprotocol/.github/blob/main/SECURITY.md). - ---- - -## File: docs/reference/server-json/generic-server-json.md - -# server.json Format Specification - -A `server.json` file is a standardized way to describe MCP servers for registry publishing, client discovery, and package management. - -Also see: -- For step-by-step instructions on creating and using server.json files, see the [publishing guide](../../guides/publishing/publish-server.md). -- For understanding the validation requirements when publishing to the official registry, see [official registry requirements](./official-registry-requirements.md). - -## Browse the Complete Schema - -**📋 View the full specification interactively**: Open [server.schema.json](./server.schema.json) in a schema viewer like [json-schema.app](https://json-schema.app/view/%23?url=https%3A%2F%2Fstatic.modelcontextprotocol.io%2Fschemas%2F2025-07-09%2Fserver.schema.json). - -The schema contains all field definitions, validation rules, examples, and detailed descriptions. - -The official registry has some more restrictions on top of this. See the [official registry requirements](./official-registry-requirements.md) for details. - -## Examples - - - -### Basic Server with NPM Package - -```json -{ - "$schema": "https://static.modelcontextprotocol.io/schemas/2025-07-09/server.schema.json", - "name": "io.modelcontextprotocol.anonymous/brave-search", - "description": "MCP server for Brave Search API integration", - "status": "active", - "website_url": "https://anonymous.modelcontextprotocol.io/examples", - "repository": { - "url": "https://github.com/modelcontextprotocol/servers", - "source": "github" - }, - "version": "1.0.2", - "packages": [ - { - "registry_type": "npm", - "registry_base_url": "https://registry.npmjs.org", - "identifier": "@modelcontextprotocol/server-brave-search", - "version": "1.0.2", - "transport": { - "type": "stdio" - }, - "environment_variables": [ - { - "name": "BRAVE_API_KEY", - "description": "Brave Search API Key", - "is_required": true, - "is_secret": true - } - ] - } - ], - "_meta": { - "io.modelcontextprotocol.registry/publisher-provided": { - "tool": "npm-publisher", - "version": "1.0.1", - "build_info": { - "timestamp": "2023-12-01T10:30:00Z" - } - } - } -} -``` - -### Server in a Monorepo with Subfolder - -For MCP servers located within a subdirectory of a larger repository (monorepo structure), use the `subfolder` field to specify the relative path: - -```json -{ - "$schema": "https://static.modelcontextprotocol.io/schemas/2025-07-09/server.schema.json", - "name": "io.modelcontextprotocol/everything", - "description": "MCP server that exercises all the features of the MCP protocol", - "status": "active", - "repository": { - "url": "https://github.com/modelcontextprotocol/servers", - "source": "github", - "subfolder": "src/everything" - }, - "version": "0.6.2", - "packages": [ - { - "registry_type": "npm", - "registry_base_url": "https://registry.npmjs.org", - "identifier": "@modelcontextprotocol/everything", - "version": "0.6.2", - "transport": { - "type": "stdio" - } - } - ], - "_meta": { - "io.modelcontextprotocol.registry/publisher-provided": { - "tool": "npm-publisher", - "version": "1.0.1", - "build_info": { - "timestamp": "2023-12-01T10:30:00Z" - } - } - } -} -``` - -### Constant (fixed) arguments needed to start the MCP server - -Suppose your MCP server application requires a `mcp start` CLI arguments to start in MCP server mode. Express these as positional arguments like this: - -```json -{ - "name": "io.github.joelverhagen/knapcode-samplemcpserver", - "description": "Sample NuGet MCP server for a random number and random weather", - "version": "0.4.0-beta", - "packages": [ - { - "registry_type": "nuget", - "registry_base_url": "https://api.nuget.org/v3/index.json", - "identifier": "Knapcode.SampleMcpServer", - "version": "0.4.0-beta", - "transport": { - "type": "stdio" - }, - "package_arguments": [ - { - "type": "positional", - "value": "mcp" - }, - { - "type": "positional", - "value": "start" - } - ] - } - ], - "_meta": { - "io.modelcontextprotocol.registry/publisher-provided": { - "tool": "nuget-publisher", - "version": "2.1.0", - "build_info": { - "timestamp": "2023-11-15T14:22:00Z", - "pipeline_id": "nuget-build-456" - } - } - } -} -``` - -This will essentially instruct the MCP client to execute `dnx Knapcode.SampleMcpServer@0.4.0-beta -- mcp start` instead of the default `dnx Knapcode.SampleMcpServer@0.4.0-beta` (when no `package_arguments` are provided). - -### Filesystem Server with Multiple Packages - -```json -{ - "$schema": "https://static.modelcontextprotocol.io/schemas/2025-07-09/server.schema.json", - "name": "io.github.modelcontextprotocol/filesystem", - "description": "Node.js server implementing Model Context Protocol (MCP) for filesystem operations.", - "status": "active", - "repository": { - "url": "https://github.com/modelcontextprotocol/servers", - "source": "github", - "id": "b94b5f7e-c7c6-d760-2c78-a5e9b8a5b8c9" - }, - "version": "1.0.2", - "packages": [ - { - "registry_type": "npm", - "registry_base_url": "https://registry.npmjs.org", - "identifier": "@modelcontextprotocol/server-filesystem", - "version": "1.0.2", - "transport": { - "type": "stdio" - }, - "package_arguments": [ - { - "type": "positional", - "value_hint": "target_dir", - "description": "Path to access", - "default": "/Users/username/Desktop", - "is_required": true, - "is_repeated": true - } - ], - "environment_variables": [ - { - "name": "LOG_LEVEL", - "description": "Logging level (debug, info, warn, error)", - "default": "info" - } - ] - }, - { - "registry_type": "oci", - "registry_base_url": "https://docker.io", - "identifier": "mcp/filesystem", - "version": "1.0.2", - "transport": { - "type": "stdio" - }, - "runtime_arguments": [ - { - "type": "named", - "description": "Mount a volume into the container", - "name": "--mount", - "value": "type=bind,src={source_path},dst={target_path}", - "is_required": true, - "is_repeated": true, - "variables": { - "source_path": { - "description": "Source path on host", - "format": "filepath", - "is_required": true - }, - "target_path": { - "description": "Path to mount in the container. It should be rooted in `/project` directory.", - "is_required": true, - "default": "/project" - } - } - } - ], - "package_arguments": [ - { - "type": "positional", - "value_hint": "target_dir", - "value": "/project" - } - ], - "environment_variables": [ - { - "name": "LOG_LEVEL", - "description": "Logging level (debug, info, warn, error)", - "default": "info" - } - ] - } - ], - "_meta": { - "io.modelcontextprotocol.registry/publisher-provided": { - "tool": "ci-publisher", - "version": "3.2.1", - "build_info": { - "commit": "a1b2c3d4e5f6789", - "timestamp": "2023-12-01T10:30:00Z", - "pipeline_id": "filesystem-build-789", - "environment": "production" - } - } - } -} -``` - -### Remote Server Example - -```json -{ - "name": "io.modelcontextprotocol.anonymous/mcp-fs", - "description": "Cloud-hosted MCP filesystem server", - "repository": { - "url": "https://github.com/example/remote-fs", - "source": "github", - "id": "xyz789ab-cdef-0123-4567-890ghijklmno" - }, - "version": "2.0.0", - "remotes": [ - { - "type": "sse", - "url": "http://mcp-fs.anonymous.modelcontextprotocol.io/sse" - } - ], - "_meta": { - "io.modelcontextprotocol.registry/publisher-provided": { - "tool": "cloud-deployer", - "version": "2.4.0", - "build_info": { - "commit": "f7e8d9c2b1a0", - "timestamp": "2023-12-05T08:45:00Z", - "deployment_id": "remote-fs-deploy-456", - "region": "us-west-2" - } - } - } -} -``` - -### Python Package Example - -```json -{ - "name": "io.github.example/weather-mcp", - "description": "Python MCP server for weather data access", - "repository": { - "url": "https://github.com/example/weather-mcp", - "source": "github", - "id": "def456gh-ijkl-7890-mnop-qrstuvwxyz12" - }, - "version": "0.5.0", - "packages": [ - { - "registry_type": "pypi", - "registry_base_url": "https://pypi.org", - "identifier": "weather-mcp-server", - "version": "0.5.0", - "runtime_hint": "uvx", - "transport": { - "type": "stdio" - }, - "environment_variables": [ - { - "name": "WEATHER_API_KEY", - "description": "API key for weather service", - "is_required": true, - "is_secret": true - }, - { - "name": "WEATHER_UNITS", - "description": "Temperature units (celsius, fahrenheit)", - "default": "celsius" - } - ] - } - ], - "_meta": { - "io.modelcontextprotocol.registry/publisher-provided": { - "tool": "poetry-publisher", - "version": "1.8.3", - "build_info": { - "python_version": "3.11.5", - "timestamp": "2023-11-28T16:20:00Z", - "build_id": "pypi-weather-123", - "dependencies_hash": "sha256:a9b8c7d6e5f4" - } - } - } -} -``` - -### NuGet (.NET) Package Example - -The `dnx` tool ships with the .NET 10 SDK, starting with Preview 6. - -```json -{ - "name": "io.github.joelverhagen/knapcode-samplemcpserver", - "description": "Sample NuGet MCP server for a random number and random weather", - "repository": { - "url": "https://github.com/joelverhagen/Knapcode.SampleMcpServer", - "source": "github", - "id": "example-nuget-id-0000-1111-222222222222" - }, - "version": "0.5.0", - "packages": [ - { - "registry_type": "nuget", - "registry_base_url": "https://api.nuget.org/v3/index.json", - "identifier": "Knapcode.SampleMcpServer", - "version": "0.5.0", - "runtime_hint": "dnx", - "transport": { - "type": "stdio" - }, - "environment_variables": [ - { - "name": "WEATHER_CHOICES", - "description": "Comma separated list of weather descriptions to randomly select.", - "is_required": true, - "is_secret": false - } - ] - } - ], - "_meta": { - "io.modelcontextprotocol.registry/publisher-provided": { - "tool": "dotnet-publisher", - "version": "8.0.100", - "build_info": { - "dotnet_version": "8.0.0", - "timestamp": "2023-12-10T12:15:00Z", - "configuration": "Release", - "target_framework": "net8.0", - "build_number": "20231210.1" - } - } - } -} -``` - -### Complex Docker Server with Multiple Arguments - -```json -{ - "name": "io.github.example/database-manager", - "description": "MCP server for database operations with support for multiple database types", - "repository": { - "url": "https://github.com/example/database-manager-mcp", - "source": "github", - "id": "ghi789jk-lmno-1234-pqrs-tuvwxyz56789" - }, - "version": "3.1.0", - "packages": [ - { - "registry_type": "oci", - "registry_base_url": "https://docker.io", - "identifier": "example/database-manager-mcp", - "version": "3.1.0", - "transport": { - "type": "stdio" - }, - "runtime_arguments": [ - { - "type": "named", - "name": "--network", - "value": "host", - "description": "Use host network mode" - }, - { - "type": "named", - "name": "-e", - "value": "DB_TYPE={db_type}", - "description": "Database type to connect to", - "is_repeated": true, - "variables": { - "db_type": { - "description": "Type of database", - "choices": [ - "postgres", - "mysql", - "mongodb", - "redis" - ], - "is_required": true - } - } - } - ], - "package_arguments": [ - { - "type": "named", - "name": "--host", - "description": "Database host", - "default": "localhost", - "is_required": true - }, - { - "type": "named", - "name": "--port", - "description": "Database port", - "format": "number" - }, - { - "type": "positional", - "value_hint": "database_name", - "description": "Name of the database to connect to", - "is_required": true - } - ], - "environment_variables": [ - { - "name": "DB_USERNAME", - "description": "Database username", - "is_required": true - }, - { - "name": "DB_PASSWORD", - "description": "Database password", - "is_required": true, - "is_secret": true - }, - { - "name": "SSL_MODE", - "description": "SSL connection mode", - "default": "prefer", - "choices": [ - "disable", - "prefer", - "require" - ] - } - ] - } - ], - "_meta": { - "io.modelcontextprotocol.registry/publisher-provided": { - "tool": "docker-buildx", - "version": "0.12.1", - "build_info": { - "docker_version": "24.0.7", - "timestamp": "2023-12-08T14:30:00Z", - "platform": "linux/amd64,linux/arm64", - "registry": "docker.io", - "image_digest": "sha256:1a2b3c4d5e6f7890" - } - } - } -} -``` - -### Server with Remote and Package Options - -```json -{ - "$schema": "https://static.modelcontextprotocol.io/schemas/2025-07-09/server.schema.json", - "name": "io.modelcontextprotocol.anonymous/hybrid-mcp", - "description": "MCP server available as both local package and remote service", - "repository": { - "url": "https://github.com/example/hybrid-mcp", - "source": "github", - "id": "klm012no-pqrs-3456-tuvw-xyz789abcdef" - }, - "version": "1.5.0", - "packages": [ - { - "registry_type": "npm", - "registry_base_url": "https://registry.npmjs.org", - "identifier": "@example/hybrid-mcp-server", - "version": "1.5.0", - "runtime_hint": "npx", - "transport": { - "type": "stdio" - }, - "package_arguments": [ - { - "type": "named", - "name": "--mode", - "description": "Operation mode", - "default": "local", - "choices": [ - "local", - "cached", - "proxy" - ] - } - ] - } - ], - "remotes": [ - { - "type": "sse", - "url": "https://mcp.anonymous.modelcontextprotocol.io/sse", - "headers": [ - { - "name": "X-API-Key", - "description": "API key for authentication", - "is_required": true, - "is_secret": true - }, - { - "name": "X-Region", - "description": "Service region", - "default": "us-east-1", - "choices": [ - "us-east-1", - "eu-west-1", - "ap-southeast-1" - ] - } - ] - }, - { - "type": "streamable-http", - "url": "https://mcp.anonymous.modelcontextprotocol.io/http" - } - ], - "_meta": { - "io.modelcontextprotocol.registry/publisher-provided": { - "tool": "hybrid-deployer", - "version": "1.7.2", - "build_info": { - "timestamp": "2023-12-03T11:00:00Z", - "deployment_strategy": "blue-green", - "npm_version": "10.2.4", - "node_version": "20.10.0", - "service_endpoints": { - "sse": "deployed", - "streamable": "deployed" - } - } - } - } -} -``` - -### MCP Bundle (MCPB) Package Example - -```json -{ - "name": "io.modelcontextprotocol/text-editor", - "description": "MCP Bundle server for advanced text editing capabilities", - "repository": { - "url": "https://github.com/modelcontextprotocol/text-editor-mcpb", - "source": "github" - }, - "version": "1.0.2", - "packages": [ - { - "registry_type": "mcpb", - "registry_base_url": "https://github.com", - "identifier": "https://github.com/modelcontextprotocol/text-editor-mcpb/releases/download/v1.0.2/text-editor.mcpb", - "version": "1.0.2", - "file_sha256": "fe333e598595000ae021bd27117db32ec69af6987f507ba7a63c90638ff633ce", - "transport": { - "type": "stdio" - } - } - ], - "_meta": { - "io.modelcontextprotocol.registry/publisher-provided": { - "tool": "mcpb-publisher", - "version": "1.0.0", - "build_info": { - "timestamp": "2023-12-02T09:15:00Z", - "bundle_format": "mcpb-v1" - } - } - } -} -``` - -This example shows an MCPB (MCP Bundle) package that: -- Is hosted on GitHub Releases (an allowlisted provider) -- Includes a SHA-256 hash for integrity verification -- Can be downloaded and executed directly by MCP clients that support MCPB - -### Embedded MCP inside a CLI tool - -Some CLI tools bundle an MCP server, without a standalone MCP package or a public repository. In these cases, reuse the existing `packages` shape by pointing at the host CLI package and supplying the `package_arguments` and `runtime_hint` if needed to start the MCP server. - -```json -{ - "$schema": "https://static.modelcontextprotocol.io/schemas/2025-07-09/server.schema.json", - "name": "io.snyk/cli-mcp", - "description": "MCP server provided by the Snyk CLI", - "status": "active", - "version": "1.1298.0", - "packages": [ - { - "registry_type": "npm", - "registry_base_url": "https://registry.npmjs.org", - "identifier": "snyk", - "version": "1.1298.0", - "transport": { - "type": "stdio" - }, - "package_arguments": [ - { "type": "positional", "value": "mcp" }, - { - "type": "named", - "name": "-t", - "description": "Transport type for MCP server", - "default": "stdio", - "choices": ["stdio", "sse"] - } - ] - } - ] -} -``` - -### Server with Custom Installation Path - -For MCP servers that follow a custom installation path or are embedded in applications without standalone packages, use the `website_url` field to direct users to setup documentation: - -```json -{ - "$schema": "https://static.modelcontextprotocol.io/schemas/2025-07-09/server.schema.json", - "name": "io.modelcontextprotocol.anonymous/embedded-mcp", - "description": "MCP server embedded in a Desktop app", - "status": "active", - "website_url": "https://anonymous.modelcontextprotocol.io/embedded-mcp-guide", - "version": "0.1.0" -} -``` - -### Deprecated Server Example - -```json -{ - "name": "io.github.example/old-weather", - "description": "Legacy weather server - DEPRECATED: Use weather-v2 instead for new projects", - "status": "deprecated", - "repository": { - "url": "https://github.com/example/old-weather", - "source": "github", - "id": "legacy-abc123-def456-789012-345678-901234567890" - }, - "version": "0.9.5", - "packages": [ - { - "registry_type": "npm", - "registry_base_url": "https://registry.npmjs.org", - "identifier": "@legacy/old-weather-server", - "version": "0.9.5", - "transport": { - "type": "stdio" - }, - "environment_variables": [ - { - "name": "WEATHER_API_KEY", - "description": "Weather API key", - "is_required": true, - "is_secret": true - } - ] - } - ], - "_meta": { - "io.modelcontextprotocol.registry/publisher-provided": { - "tool": "legacy-publisher", - "version": "0.8.1", - "build_info": { - "timestamp": "2023-06-15T09:30:00Z", - "deprecation_notice": "This publisher is deprecated. Use npm-publisher v2.0+ for new projects.", - "maintenance_mode": true, - "final_version": true - } - } - } -} -``` \ No newline at end of file diff --git a/docs/README.md b/docs/README.md index cb06d3e..d276482 100644 --- a/docs/README.md +++ b/docs/README.md @@ -17,3 +17,4 @@ The MCP registry provides MCP clients with a list of MCP servers, like an app st - 📖 [Reference](./reference/) - Technical specifications - 🔧 [Contributing guides](./contributing/) - How to contribute - 🔒 [Administration](./administration/) - Admin operations +- 🤝 [Community projects](./community-projects.md) - Notable registry-related work from the community diff --git a/docs/administration/maintainer-onboarding.md b/docs/administration/maintainer-onboarding.md index f6e3871..aab0bea 100644 --- a/docs/administration/maintainer-onboarding.md +++ b/docs/administration/maintainer-onboarding.md @@ -16,7 +16,7 @@ When onboarding a new maintainer, complete the following steps: ### 3. README.md -- [ ] Add them to the "Current key maintainers" section in [README.md](../../README.md) +- [ ] Add them to the "Registry Working Group" section in [README.md](../../README.md) ### 4. Discord diff --git a/docs/contributing/add-package-registry.md b/docs/contributing/add-package-registry.md index 170c2d2..f6e07c8 100644 --- a/docs/contributing/add-package-registry.md +++ b/docs/contributing/add-package-registry.md @@ -51,6 +51,5 @@ These steps may evolve as additional validations or details are discovered and m - Add corresponding unit tests: `internal/validators/registries/yourregistry_test.go` - Register your validator in `internal/validators/validators.go` - Update the publishing documentation: - - Add a new publishing guide: `docs/guides/publishing/publish-[yourregistry].md`, following the pattern of existing publishing guides (e.g., `publish-npm.md`, `publish-pypi.md`) - - Include instructions on how to prepare packages for your registry, including any specific validation requirements - - Update `docs/guides/publishing/README.md` to reference your new publishing guide + - Add a section for your registry to `docs/modelcontextprotocol-io/package-types.mdx`, following the pattern of the existing registries (npm, PyPI, NuGet, ...) + - Include instructions on how to prepare packages for your registry, and an `### Ownership Verification` subsection describing the validation your registry requires diff --git a/docs/contributing/releasing.md b/docs/contributing/releasing.md index d7b625f..56f205b 100644 --- a/docs/contributing/releasing.md +++ b/docs/contributing/releasing.md @@ -5,8 +5,8 @@ 1. **Go to GitHub**: Navigate to https://github.com/modelcontextprotocol/registry/releases 2. **Click "Draft a new release"** 3. **Choose a tag**: Click "Choose a tag" and type a new semantic version that follows the last one available (e.g., `v1.0.0`) -5. **Generate notes**: Click "Generate release notes" to auto-populate the name and description -6. **Publish**: Click "Publish release" +4. **Generate notes**: Click "Generate release notes" to auto-populate the name and description +5. **Publish**: Click "Publish release" The release workflow will automatically: - Build binaries for 6 platforms (Linux, macOS, Windows × amd64, arm64) diff --git a/docs/design/design-principles.md b/docs/design/design-principles.md index d76627a..7d805be 100644 --- a/docs/design/design-principles.md +++ b/docs/design/design-principles.md @@ -25,13 +25,13 @@ The registry serves as the authoritative metadata repository for publicly-availa - Use mechanisms like DNS verification, OAuth to provide base layer of authentication and trust - Implement rate limiting, field validation, and blacklisting to prevent abuse -## 6. Reusable, Extensible Shapes; Not Infrastructure +## 5. Reusable, Extensible Shapes; Not Infrastructure - API shapes (OpenAPI, server.json) designed for reuse - Enable private/internal registries using same formats - Don't mandate infrastructure reuse - focus on interface compatibility -## 7. Progressive Enhancement +## 6. Progressive Enhancement - Start with MVP that provides immediate value - Build foundation that supports future features diff --git a/docs/design/roadmap.md b/docs/design/roadmap.md index 93b552b..8a14ca1 100644 --- a/docs/design/roadmap.md +++ b/docs/design/roadmap.md @@ -6,9 +6,15 @@ This roadmap may occasionally drift out of date. Please review [Issues](https:// ## Current Status +> [!NOTE] +> **The phase labelling below is out of date as of 2026-08-10.** The registry launched in preview on +> 2025-09-08 and the v0.1 API entered a freeze on 2025-10-24, so "Go-Live" has already happened. The +> phases are retained for historical context. See +> [Issues](https://github.com/modelcontextprotocol/registry/issues) for current work. + The initial version of the MCP Registry is actively being developed. The initial focus is on delivering a REST API to which server creators can publish, and aggregator/marketplace consumers can ETL. -## Phase 1: MVP/Go-Live (Current Focus) +## Phase 1: MVP/Go-Live See the [go-live blocker issues](https://github.com/modelcontextprotocol/registry/issues?q=is%3Aissue%20state%3Aopen%20label%3A%22go-live%20blocker%22). diff --git a/docs/design/tech-architecture.md b/docs/design/tech-architecture.md index 03097f7..f7fab72 100644 --- a/docs/design/tech-architecture.md +++ b/docs/design/tech-architecture.md @@ -1,5 +1,26 @@ # MCP Registry Technical Architecture +> [!WARNING] +> **This document has drifted from the shipped system and is kept as a design record.** +> For the architecture as deployed, see [deploy/README.md](../../deploy/README.md); for the API as +> implemented, see the [API reference](../reference/api/official-registry-api.md). +> +> Known inaccuracies below, as of 2026-08-10: +> - The registry is not deployed via a Helm chart. It is a plain Kubernetes `Deployment` created by +> Pulumi; Helm is used only for third-party components (ingress-nginx, cert-manager, +> cloudnative-pg, k8up, monitoring). +> - The database diagram shows a `StatefulSet` on port `27017` (MongoDB). The database is PostgreSQL +> on `5432`, provisioned by the CloudNativePG operator. +> - The DNS verification sequence (`mcp verify-domain`, `POST /verify-domain`, +> `POST /verify-domain/check`, server-issued challenge tokens) describes a design that was never +> built. The shipped flow signs a timestamp with the operator's key and posts it to +> `POST /v0/auth/dns`, with the public key published in a `v=MCPv1; k=...; p=...` TXT record. +> - No `/admin/*` routes exist. Admin actions use the regular server endpoints with an +> admin-permissioned token. +> - The CLI is `mcp-publisher`, not `mcp`, and publishing posts to `/v0/publish`. +> - The database stores servers and server extensions only; it holds no user authentication state +> and no DNS verification records. + This document describes the technical architecture of the MCP Registry, including system components, deployment strategies, and data flows. ## System Overview diff --git a/docs/reference/README.md b/docs/reference/README.md index ea77b30..5e5b0b0 100644 --- a/docs/reference/README.md +++ b/docs/reference/README.md @@ -7,11 +7,17 @@ Technical specifications and quick lookups for the MCP Registry. - [Generic Registry API](./api/generic-registry-api.md) - [Registry Authorization](./api/registry-authorization.md) - [Official Registry API](./api/official-registry-api.md) +- [API Extensions](./api/extensions.md) - The `_meta` extension namespaces +- [OpenAPI Specification](./api/openapi.yaml) +- [API Changelog](./api/CHANGELOG.md) ## server.json Reference - [Generic server.json Format](./server-json/generic-server-json.md) - [Official Registry Requirements](./server-json/official-registry-requirements.md) +- [Schema Changelog](./server-json/CHANGELOG.md) +- [Schema Change Process](./server-json/CONTRIBUTING.md) - How to propose a schema change +- [Draft Schema](./server-json/draft/) - The in-progress next schema version ## CLI Reference diff --git a/docs/reference/api/generic-registry-api.md b/docs/reference/api/generic-registry-api.md index f351021..a4476bd 100644 --- a/docs/reference/api/generic-registry-api.md +++ b/docs/reference/api/generic-registry-api.md @@ -18,7 +18,7 @@ The official registry has some more endpoints and restrictions on top of this. S - **`GET /v0.1/servers/{serverName}/versions`** - List all versions of a server - **`GET /v0.1/servers/{serverName}/versions/{version}`** - Get specific version of server. Use the special version `latest` to get the latest version. - **`POST /v0.1/publish`** - Publish new server (optional, registry-specific authentication) -- **`PUT /v0.1/servers/{serverName}/versions/{version}`** - Update specific server version (optional, not implemented by official registry) +- **`PUT /v0.1/servers/{serverName}/versions/{version}`** - Update specific server version (optional; the official registry implements this as an admin endpoint) - **`DELETE /v0.1/servers/{serverName}/versions/{version}`** - Delete specific server version (optional, not implemented by official registry) - **`PATCH /v0.1/servers/{serverName}/versions/{version}/status`** - Update server version status (optional) - **`PATCH /v0.1/servers/{serverName}/status`** - Update status for all versions (optional) diff --git a/docs/reference/api/official-registry-api.md b/docs/reference/api/official-registry-api.md index 2012885..47e461d 100644 --- a/docs/reference/api/official-registry-api.md +++ b/docs/reference/api/official-registry-api.md @@ -109,7 +109,17 @@ The `GET /v0.1/servers/{serverName}/versions` endpoint returns all versions of a **Authentication:** Requires `publish` or `edit` permission for the server namespace. +#### Validation endpoint +- POST `/v0.1/validate` - Validate a `server.json` without publishing it. Used by `mcp-publisher validate`. + +#### Service endpoints +- GET `/v0.1/ping` - Liveness check +- GET `/v0.1/version` - Registry version information + #### Admin endpoints - GET `/metrics` - Prometheus metrics endpoint - GET `/v0.1/health` - Basic health check endpoint - PUT `/v0.1/servers/{serverName}/versions/{version}` - Edit specific server version + +Note that `/v0.1/validate`, `/v0.1/ping`, `/v0.1/version` and `/v0.1/health` are not described in +[openapi.yaml](./openapi.yaml), which covers the server and publish endpoints only. diff --git a/docs/reference/server-json/official-registry-requirements.md b/docs/reference/server-json/official-registry-requirements.md index 886aee0..ac87d85 100644 --- a/docs/reference/server-json/official-registry-requirements.md +++ b/docs/reference/server-json/official-registry-requirements.md @@ -23,7 +23,7 @@ See the [publishing guide](../../modelcontextprotocol-io/quickstart.mdx) for aut All packages must include metadata proving the publisher owns them. This prevents impersonation and ensures authenticity (see more reasoning in [#96](https://github.com/modelcontextprotocol/registry/issues/96)). -For detailed verification requirements for each registry type, see the [publishing guide](../../modelcontextprotocol-io/quickstart.mdx). +For detailed verification requirements for each registry type, see [package types](../../modelcontextprotocol-io/package-types.mdx), which has an "Ownership Verification" section per registry. ## Restricted Registry Base URLs From 91cc4aed20aac1ab8da25b5830d4e78f8c98a878 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 20 Aug 2026 22:47:02 +0300 Subject: [PATCH 287/313] build(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0 (#1554) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [github.com/stretchr/testify](https://github.com/stretchr/testify) from 1.11.1 to 1.12.0.
    Release notes

    Sourced from github.com/stretchr/testify's releases.

    v1.12.0

    What's Changed

    Functional Changes

    Fixes

    Documentation, Build & CI

    New Contributors

    ... (truncated)

    Commits
    • 001eb79 Merge pull request #1905 from Kentzo/patch-1
    • ad40f38 Merge pull request #1906 from stretchr/dependabot/github_actions/actions/chec...
    • 3bae017 build(deps): bump actions/checkout from 6.0.2 to 6.0.3
    • f8c01f3 mock: Mock.Return does not exist anymore
    • 12f8b56 Merge pull request #1563 from stretchr/make-AssertionFunc-types-aliases
    • a11649e assert: make *AssertionFunc type just aliases
    • dc20f41 Merge pull request #1890 from stretchr/dolmen/codegen-modernize
    • 098f8d7 _codegen: use strings.Builder
    • d2699be _codegen: modernize
    • a463c8c Merge pull request #1885 from stretchr/dolmen/ci-check-ghactions-hashes
    • Additional commits viewable in compare view

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/stretchr/testify&package-manager=go_modules&previous-version=1.11.1&new-version=1.12.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 4 +--- go.sum | 8 ++------ 2 files changed, 3 insertions(+), 9 deletions(-) diff --git a/go.mod b/go.mod index ce6ad8a..42dda3a 100644 --- a/go.mod +++ b/go.mod @@ -15,7 +15,7 @@ require ( github.com/prometheus/client_golang v1.24.1 github.com/rs/cors v1.11.1 github.com/santhosh-tekuri/jsonschema/v5 v5.3.1 - github.com/stretchr/testify v1.11.1 + github.com/stretchr/testify v1.12.0 go.opentelemetry.io/contrib/instrumentation/runtime v0.69.0 go.opentelemetry.io/otel v1.44.0 go.opentelemetry.io/otel/exporters/prometheus v0.66.0 @@ -39,7 +39,6 @@ require ( github.com/AzureAD/microsoft-authentication-library-for-go v1.7.2 // indirect github.com/beorn7/perks v1.0.1 // indirect github.com/cespare/xxhash/v2 v2.3.0 // indirect - github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect github.com/docker/cli v29.6.2+incompatible // indirect github.com/docker/docker-credential-helpers v0.9.3 // indirect github.com/felixge/httpsnoop v1.0.4 // indirect @@ -59,7 +58,6 @@ require ( github.com/opencontainers/go-digest v1.0.0 // indirect github.com/opencontainers/image-spec v1.1.1 // indirect github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect - github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect github.com/prometheus/client_model v0.6.2 // indirect github.com/prometheus/common v0.70.1 // indirect github.com/prometheus/otlptranslator v1.0.0 // indirect diff --git a/go.sum b/go.sum index 3c731e5..efb5d96 100644 --- a/go.sum +++ b/go.sum @@ -41,8 +41,6 @@ github.com/coreos/go-oidc/v3 v3.20.0/go.mod h1:DYCf24+ncYi+XkIH97GY1+dqoRlbaSI26 github.com/danielgtaylor/huma/v2 v2.39.1 h1:0kwF4ltQoYZ+IU55VPy+BcGekzgF44R64daTGde1H+g= github.com/danielgtaylor/huma/v2 v2.39.1/go.mod h1:zcnQ38duIJ3VUHwFaBoZ6x8T+KN/mr33oyqxcj0HTug= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= -github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM= -github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/docker/cli v29.6.2+incompatible h1:/bjePvcbbFTnRrMfWJBY7AjfICdsiLVgHn6LwTVOcqw= github.com/docker/cli v29.6.2+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= github.com/docker/docker-credential-helpers v0.9.3 h1:gAm/VtF9wgqJMoxzT3Gj5p4AqIjCBS4wrsOh9yRqcz8= @@ -110,8 +108,6 @@ github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c/go.mod h1:7rwL4CYBLnjL github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 h1:GFCKgmp0tecUJ0sJuv4pzYCqS9+RGSn52M3FUwPs+uo= github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10/go.mod h1:t/avpk3KcrXxUnYOhZhMXJlSEyie6gQbtLq5NM3loB8= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= -github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U= -github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/prometheus/client_golang v1.24.1 h1:JnJkREXzWxUdCuPFpIWZiPispT9xVV59uiuyR2bPlnU= github.com/prometheus/client_golang v1.24.1/go.mod h1:F+oSRECHg4sse5ucfYpYDeIv/hu68Zo0uoHKetWnzcE= github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk= @@ -133,8 +129,8 @@ github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC4 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= -github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U= -github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= +github.com/stretchr/testify v1.12.0 h1:K6Mr6jO9JICuend/5xzTM03ydSV3vdNRYAdPSukj8uI= +github.com/stretchr/testify v1.12.0/go.mod h1:bOYBZb5qJ00vPzWfIqBUZPaxK8jWiXc6d3ErP4Ca9Gw= github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM= github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= From 17dec17a41f547b438195eff3e7e90bb7eb1530e Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 20 Aug 2026 22:47:18 +0300 Subject: [PATCH 288/313] build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.255.0 to 3.257.0 in /deploy (#1553) Bumps [github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from 3.255.0 to 3.257.0.
    Release notes

    Sourced from github.com/pulumi/pulumi/sdk/v3's releases.

    v3.257.0

    3.257.0 (2026-08-13)

    Features

    • [cli] Offer to create a first project after logging in to an account with no stacks #24133
    • [cli/do] Auto-assign identifiers to existing stack resources in pulumi do input expressions, and add pulumi do show-resources to list them #24184
    • [cli/do] Make "pulumi do <pkg> <resource> patch <name> work in stateful mode, overlaying the supplied inputs onto the existing snippet" #24295
    • [cli/state] Implement pulumi state get to show individual resources #24191
    • [cli/do] Fall back to an auto-created project and stack under PULUMI_HOME when pulumi do is invoked outside of a Pulumi project #24231

    Bug Fixes

    • [sdkgen/go] Generated output-form invokes pass their arguments to the core SDK without resolving them first, so invoke dependencies can be inferred from arguments; generated SDKs now require pulumi SDK v3.255.0 or later #24060
    • [cli] Make 'pulumi stack history events --summary report the program errors from the language host #24111
    • [cli/cloud] pulumi api: repeated -H/--header values for the same header name now all reach the wire, instead of each one silently overwriting the last #24180
    • [cli/package] Maintain --server when adding to the packages section of Pulumi.yaml #24189
    • [sdk/go] Fix panics in hooks to not crash the entire process #24218
    • [programgen/go] for expressions are now generated as Go loops #24228
    • [programgen/go] Fix invalid _ := index statement emitted for resources with a numeric range whose value variable is unused #24227
    • [sdk/python] Report an error instead of hanging when a Python resource depends on its own parent #24230
    • [sdkgen/go] Generate the missing Go input types for resource input properties that are deeply nested collections of object types #24236
    • [programgen/go] Rename properties that collide with reserved names (e.g. elementType) the same way SDK codegen does, instead of emitting uncompilable code #24235
    • [cli/display] Show the value being added when a refresh or provider diff reports an added property #24245
    • [cli/plugin] Track when a plugin was last run so pulumi plugin ls reports an accurate last-used time on all platforms #24251
    • [engine] Show secrets in diff display when --show-secrets is passed #24253
    • [cli] Exit promptly when a command is cancelled while an HTTP request is being retried #24276

    Improvements

    • [sdk/nodejs] Improve error message when resource registrations are still pending when pulumi exits #24082
    • [cli] Pass the invoked command (e.g. pulumi new) to the browser-based login/signup flow so Pulumi Cloud can attribute signups to the command that triggered them #24192

    Miscellaneous

    • [sdkgen] Extension-parameterized packages now namespace their resource and function tokens under their own package name rather than the base provider's #24143
    • [java] Upgrade java to v1.35.0 #24202
    • [backend/diy] The deprecation warning is now an error. PULUMI_DIY_BACKEND_IGNORE_DEPRECATION_WARNING is now PULUMI_DIY_BACKEND_IGNORE_DEPRECATION_ERROR. #24216
    • [java] Upgrade java to v1.36.0 #24243
    • [sdk/dotnet] Upgrade dotnet to v3.111.1 #24249

    v3.256.0

    3.256.0 (2026-08-04)

    Features

    • [cli] Add --ignore-protect flag to pulumi up, pulumi preview and pulumi destroy to allow deleting protected resources without unprotecting them in the state first #24053
    • [cli/env] Add an optional --export-env-vars flag to the env provider {aws,azure,gcp}-login commands to also set the standard SDK environment variables referencing the login outputs #24055
    • [cli] Add a --server flag to pulumi package add, publish, get-schema, get-mapping, gen-sdk, info and pulumi schema check that skips package resolution and uses the given URL as the plugin download URL #24107

    ... (truncated)

    Changelog

    Sourced from github.com/pulumi/pulumi/sdk/v3's changelog.

    3.257.0 (2026-08-13)

    Features

    • [cli] Offer to create a first project after logging in to an account with no stacks #24133
    • [cli/do] Auto-assign identifiers to existing stack resources in pulumi do input expressions, and add pulumi do show-resources to list them #24184
    • [cli/do] Make "pulumi do <pkg> <resource> patch <name> work in stateful mode, overlaying the supplied inputs onto the existing snippet" #24295
    • [cli/state] Implement pulumi state get to show individual resources #24191
    • [cli/do] Fall back to an auto-created project and stack under PULUMI_HOME when pulumi do is invoked outside of a Pulumi project #24231

    Bug Fixes

    • [sdkgen/go] Generated output-form invokes pass their arguments to the core SDK without resolving them first, so invoke dependencies can be inferred from arguments; generated SDKs now require pulumi SDK v3.255.0 or later #24060
    • [cli] Make 'pulumi stack history events --summary report the program errors from the language host #24111
    • [cli/cloud] pulumi api: repeated -H/--header values for the same header name now all reach the wire, instead of each one silently overwriting the last #24180
    • [cli/package] Maintain --server when adding to the packages section of Pulumi.yaml #24189
    • [sdk/go] Fix panics in hooks to not crash the entire process #24218
    • [programgen/go] for expressions are now generated as Go loops #24228
    • [programgen/go] Fix invalid _ := index statement emitted for resources with a numeric range whose value variable is unused #24227
    • [sdk/python] Report an error instead of hanging when a Python resource depends on its own parent #24230
    • [sdkgen/go] Generate the missing Go input types for resource input properties that are deeply nested collections of object types #24236
    • [programgen/go] Rename properties that collide with reserved names (e.g. elementType) the same way SDK codegen does, instead of emitting uncompilable code #24235
    • [cli/display] Show the value being added when a refresh or provider diff reports an added property #24245
    • [cli/plugin] Track when a plugin was last run so pulumi plugin ls reports an accurate last-used time on all platforms #24251
    • [engine] Show secrets in diff display when --show-secrets is passed #24253
    • [cli] Exit promptly when a command is cancelled while an HTTP request is being retried #24276

    Improvements

    • [sdk/nodejs] Improve error message when resource registrations are still pending when pulumi exits #24082
    • [cli] Pass the invoked command (e.g. pulumi new) to the browser-based login/signup flow so Pulumi Cloud can attribute signups to the command that triggered them #24192

    Miscellaneous

    • [sdkgen] Extension-parameterized packages now namespace their resource and function tokens under their own package name rather than the base provider's #24143
    • [java] Upgrade java to v1.35.0 #24202
    • [backend/diy] The deprecation warning is now an error. PULUMI_DIY_BACKEND_IGNORE_DEPRECATION_WARNING is now PULUMI_DIY_BACKEND_IGNORE_DEPRECATION_ERROR. #24216
    • [java] Upgrade java to v1.36.0 #24243
    • [sdk/dotnet] Upgrade dotnet to v3.111.1 #24249

    3.256.0 (2026-08-04)

    Features

    • [cli] Add --ignore-protect flag to pulumi up, pulumi preview and pulumi destroy to allow deleting protected resources without unprotecting them in the state first #24053
    • [cli/env] Add an optional --export-env-vars flag to the env provider {aws,azure,gcp}-login commands to also set the standard SDK environment variables referencing the login outputs #24055
    • [cli] Add a --server flag to pulumi package add, publish, get-schema, get-mapping, gen-sdk, info and pulumi schema check that skips package resolution and uses the given URL as the plugin download URL #24107

    Bug Fixes

    • [backend/service] Fix pulumi login --insecure not being reflected in the stack's service secrets manager state, which caused TLS verification failures against self-hosted backends using self-signed certificates #24134

    ... (truncated)

    Commits

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/pulumi/pulumi/sdk/v3&package-manager=go_modules&previous-version=3.255.0&new-version=3.257.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- deploy/go.mod | 6 +++--- deploy/go.sum | 12 ++++++------ 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index d0c5488..48df63a 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -5,7 +5,7 @@ go 1.26 require ( github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.33.0 - github.com/pulumi/pulumi/sdk/v3 v3.255.0 + github.com/pulumi/pulumi/sdk/v3 v3.257.0 gopkg.in/yaml.v2 v2.4.0 ) @@ -50,7 +50,7 @@ require ( github.com/inconshreveable/mousetrap v1.1.0 // indirect github.com/json-iterator/go v1.1.12 // indirect github.com/kevinburke/ssh_config v1.6.0 // indirect - github.com/klauspost/compress v1.18.0 // indirect + github.com/klauspost/compress v1.18.7 // indirect github.com/klauspost/cpuid/v2 v2.3.0 // indirect github.com/lucasb-eyer/go-colorful v1.4.0 // indirect github.com/mattn/go-isatty v0.0.22 // indirect @@ -100,7 +100,7 @@ require ( go.uber.org/atomic v1.11.0 // indirect go.uber.org/multierr v1.11.0 // indirect golang.org/x/crypto v0.54.0 // indirect - golang.org/x/mod v0.37.0 // indirect + golang.org/x/mod v0.38.0 // indirect golang.org/x/net v0.57.0 // indirect golang.org/x/sync v0.22.0 // indirect golang.org/x/sys v0.47.0 // indirect diff --git a/deploy/go.sum b/deploy/go.sum index a5e4f9a..3a1ce8f 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -107,8 +107,8 @@ github.com/kevinburke/ssh_config v1.6.0/go.mod h1:q2RIzfka+BXARoNexmF9gkxEX7Dmvb github.com/kisielk/errcheck v1.2.0/go.mod h1:/BMXB+zMLi60iA8Vv6Ksmxu/1UDYcXs4uQLJ+jE2L00= github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8= github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= -github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo= -github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ= +github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw= +github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y= github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0= github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo= @@ -172,8 +172,8 @@ github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 h1:w6OnO3d4j5yVf2vpm8OzXFC/xHOEGqt+9 github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1/go.mod h1:UyZyv7hz4knpFx6/Sh+SkZe6hT6sJHtDvw9A0TbvEsk= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.33.0 h1:fFP72Q6/GfyI7BII3hUS7vn45Eg16zKIIS3I3R9bNEY= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.33.0/go.mod h1:sIZVlvi6oFQMEgTa+XkYfr/sAXRfrprPo3Ja6UYpGEU= -github.com/pulumi/pulumi/sdk/v3 v3.255.0 h1:G872L4M1EPW3l60yEc52GgLpFRdXAVf0rn96q3MwDVQ= -github.com/pulumi/pulumi/sdk/v3 v3.255.0/go.mod h1:b99ZkmEGjVyW55blOwL94IfPLcaajhOfV8OTePZrRJM= +github.com/pulumi/pulumi/sdk/v3 v3.257.0 h1:75TpjUHz7rA8azrEOpTAD1Ox2f6Aj1pkxwzq+ufKQXM= +github.com/pulumi/pulumi/sdk/v3 v3.257.0/go.mod h1:pyYSaOHxk1R0bYiSzpcbYzeN3MBtlyckup9tvImBjjo= github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ= github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88= github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ= @@ -269,8 +269,8 @@ golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPI golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg= golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= -golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ= -golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0= +golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk= +golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40= golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= From 4ec2ed3f9fe691fb42174a3bebfa1df59694b7a3 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 20 Aug 2026 22:47:32 +0300 Subject: [PATCH 289/313] build(deps): bump golang.org/x/mod from 0.38.0 to 0.40.0 (#1552) Bumps [golang.org/x/mod](https://github.com/golang/mod) from 0.38.0 to 0.40.0.
    Commits
    • d3398d0 go.mod: update golang.org/x dependencies
    • 57549bf sumdb: ignore unrelated hashes in Lookup
    • 96f62ae sumdb/tlog: fix TileHashReader authentication bypass
    • 13be902 go.mod: update golang.org/x dependencies
    • See full diff in compare view

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=golang.org/x/mod&package-manager=go_modules&previous-version=0.38.0&new-version=0.40.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 42dda3a..457ba7a 100644 --- a/go.mod +++ b/go.mod @@ -22,7 +22,7 @@ require ( go.opentelemetry.io/otel/metric v1.44.0 go.opentelemetry.io/otel/sdk v1.44.0 go.opentelemetry.io/otel/sdk/metric v1.44.0 - golang.org/x/mod v0.38.0 + golang.org/x/mod v0.40.0 gopkg.in/yaml.v3 v3.0.1 ) diff --git a/go.sum b/go.sum index efb5d96..e4cd0cf 100644 --- a/go.sum +++ b/go.sum @@ -161,8 +161,8 @@ go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ= go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ= golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw= golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk= -golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk= -golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40= +golang.org/x/mod v0.40.0 h1:hUv+3cXcdRHz08UmSiOob7sadHig73uo5bkXxQ/tvUs= +golang.org/x/mod v0.40.0/go.mod h1:0/weTWkPWGBikyTWAX3dkjVztMmBA5hM0DH6BElSupE= golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE= golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU= golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= From 8759d9d8c05993cc18663ec7d4b9f81136c29ae6 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Fri, 21 Aug 2026 00:14:13 +0300 Subject: [PATCH 290/313] ci: bump golangci-lint to v2.13.1 to fix panic on Go 1.27 (#1561) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CI is red on `main` and on every open PR (including the Dependabot PRs #1531, #1552–#1554) with: ``` panic: file requires newer Go version go1.27 (application built with go1.26) golangci-lint exit with code 2 ``` ## Cause `actions/setup-go` with `go-version: 'stable'` started resolving to **go1.27.0**. The pinned golangci-lint **v2.11.4** release binary is built with **go1.26**, and its `go/types` refuses to typecheck source files declaring a newer language version. Nothing in the failing PRs is at fault. ## Fix Bump to **golangci-lint v2.13.1**, whose release binaries are built with go1.27, so linting works under `stable` again. That bump also pulls in newer linter versions, which surface 57 findings this tree did not have before. Handled as follows: | Linter | Count | Resolution | |---|---|---| | `goconst` | 50 | 39 were repeated literals in `_test.go` files — goconst started counting those in v2.12.0 (golangci-lint#6480 exposed `ignore-tests`). Fixture data like `"1.0.0"` (89 occurrences) is not a missing constant, so `goconst.ignore-tests: true`. The other 11 were real duplication in production code (OpenAPI tags, the `bearer` security scheme name, `$ref`, `http`/`https`) and became named constants. | | `gosec` G710 | 1 | **True positive, fixed.** See below. | | `staticcheck` SA1019 | 6 | Go 1.26 deprecated `ecdsa.PublicKey.X/Y` and `PrivateKey.D`. Annotated with the same targeted `nolint` + rationale already used for `ScalarBaseMult` in `cmd/publisher/auth/common.go`. | ### The open redirect is real `TrailingSlashMiddleware` copied the entire `*url.URL` before rewriting the path. For an absolute-form request URI — legal for a Go HTTP server to parse, e.g. `GET http://evil.com/foo/ HTTP/1.1` — `r.URL.Scheme` and `r.URL.Host` are populated, and they were echoed straight back in the `Location` header. The redirect target is now built from the cleaned path and query alone. The existing `path.Clean` hardening for GHSA-v8vw-gw5j-w7m6 (protocol-relative `//evil.com/`) is unchanged. ### Also Switched `gomodguard` → `gomodguard_v2`; the former is deprecated as of v2.12.0 and was emitting a warning on every run. ## Verification - `golangci-lint v2.13.1` against this tree: **0 issues**, no deprecation warnings - `make validate`: all validations passed - `go build ./...` and tests for every touched package pass (DB-backed tests need Postgres; left to CI) ## Note on migrating the ecdsa key paths Moving those six sites to `PublicKey.Bytes` / `ParseUncompressedPublicKey` / `crypto/ecdh` touches key parsing and signature verification. It should be its own reviewed PR rather than riding along on a CI unblock. Happy to open one. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5 (1M context) --- .github/workflows/ci.yml | 2 +- .golangci.yml | 6 +++++- cmd/publisher/auth/azurekeyvault/common.go | 4 ++-- cmd/publisher/auth/common.go | 6 +++--- internal/api/handlers/v0/auth/common.go | 2 +- internal/api/handlers/v0/auth/dns.go | 2 +- internal/api/handlers/v0/auth/github_at.go | 2 +- internal/api/handlers/v0/auth/github_oidc.go | 2 +- internal/api/handlers/v0/auth/http.go | 2 +- internal/api/handlers/v0/auth/main.go | 3 +++ internal/api/handlers/v0/auth/none.go | 2 +- internal/api/handlers/v0/auth/oidc.go | 2 +- internal/api/handlers/v0/edit.go | 4 ++-- internal/api/handlers/v0/openapi.go | 12 ++++++++++++ internal/api/handlers/v0/publish.go | 2 +- internal/api/handlers/v0/servers.go | 6 +++--- internal/api/handlers/v0/status.go | 8 ++++---- internal/api/server.go | 12 ++++++++++-- internal/validators/utils.go | 13 +++++++++---- tools/extract-server-schema/main.go | 9 ++++++--- 20 files changed, 68 insertions(+), 33 deletions(-) create mode 100644 internal/api/handlers/v0/openapi.go diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 87a36bd..4e42207 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -27,7 +27,7 @@ jobs: - name: Run lint uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a with: - version: v2.11.4 + version: v2.13.1 - name: Validate schemas and examples run: make validate diff --git a/.golangci.yml b/.golangci.yml index 5f3ad3c..571ead5 100644 --- a/.golangci.yml +++ b/.golangci.yml @@ -22,7 +22,7 @@ linters: - gocyclo - godox - gomoddirectives - - gomodguard + - gomodguard_v2 - goprintffuncname - gosec - grouper @@ -55,6 +55,10 @@ linters: max-complexity: 20 dupl: threshold: 300 + goconst: + # Repeated literals in tests are fixture data ("1.0.0", "Test server", ...); + # hoisting them into constants hurts readability more than it helps. + ignore-tests: true gocognit: min-complexity: 51 nestif: diff --git a/cmd/publisher/auth/azurekeyvault/common.go b/cmd/publisher/auth/azurekeyvault/common.go index d1e9501..776ed14 100644 --- a/cmd/publisher/auth/azurekeyvault/common.go +++ b/cmd/publisher/auth/azurekeyvault/common.go @@ -64,8 +64,8 @@ func (d Signer) GetSignedTimestamp(ctx context.Context) (*string, []byte, error) fmt.Fprintln(os.Stdout, "Successfully read the public key from Key Vault.") auth.PrintEcdsaP384KeyInfo(ecdsa.PublicKey{ Curve: elliptic.P384(), - X: new(big.Int).SetBytes(keyResp.Key.X), - Y: new(big.Int).SetBytes(keyResp.Key.Y), + X: new(big.Int).SetBytes(keyResp.Key.X), //nolint:staticcheck // SA1019: needs crypto/ecdh refactor + Y: new(big.Int).SetBytes(keyResp.Key.Y), //nolint:staticcheck // SA1019: needs crypto/ecdh refactor }) timestamp := auth.GetTimestamp() diff --git a/cmd/publisher/auth/common.go b/cmd/publisher/auth/common.go index 053b543..c12386a 100644 --- a/cmd/publisher/auth/common.go +++ b/cmd/publisher/auth/common.go @@ -164,10 +164,10 @@ func parseRawPrivateKey(curve elliptic.Curve, privateKeyBytes []byte) (*ecdsa.Pr return &ecdsa.PrivateKey{ PublicKey: ecdsa.PublicKey{ Curve: curve, - X: x, - Y: y, + X: x, //nolint:staticcheck // SA1019: needs crypto/ecdh refactor + Y: y, //nolint:staticcheck // SA1019: needs crypto/ecdh refactor }, - D: d, + D: d, //nolint:staticcheck // SA1019: needs crypto/ecdh refactor }, nil } diff --git a/internal/api/handlers/v0/auth/common.go b/internal/api/handlers/v0/auth/common.go index 4c79bfc..f1665e4 100644 --- a/internal/api/handlers/v0/auth/common.go +++ b/internal/api/handlers/v0/auth/common.go @@ -372,7 +372,7 @@ func ParsePublicKey(algorithm, publicKey string) (*PublicKeyInfo, error) { } return &PublicKeyInfo{ Algorithm: AlgorithmECDSAP384, - Key: ecdsa.PublicKey{Curve: curve, X: x, Y: y}, + Key: ecdsa.PublicKey{Curve: curve, X: x, Y: y}, //nolint:staticcheck // SA1019: needs crypto/ecdh refactor }, nil } diff --git a/internal/api/handlers/v0/auth/dns.go b/internal/api/handlers/v0/auth/dns.go index cc18082..73508c9 100644 --- a/internal/api/handlers/v0/auth/dns.go +++ b/internal/api/handlers/v0/auth/dns.go @@ -62,7 +62,7 @@ func RegisterDNSEndpoint(api huma.API, pathPrefix string, cfg *config.Config) { Path: pathPrefix + "/auth/dns", Summary: "Exchange DNS signature for Registry JWT", Description: "Authenticate using DNS TXT record public key and signed timestamp", - Tags: []string{"auth"}, + Tags: []string{tagAuth}, }, func(ctx context.Context, input *DNSTokenExchangeInput) (*v0.Response[auth.TokenResponse], error) { response, err := handler.ExchangeToken(ctx, input.Body.Domain, input.Body.Timestamp, input.Body.SignedTimestamp) if err != nil { diff --git a/internal/api/handlers/v0/auth/github_at.go b/internal/api/handlers/v0/auth/github_at.go index 868ea8e..e11d4f0 100644 --- a/internal/api/handlers/v0/auth/github_at.go +++ b/internal/api/handlers/v0/auth/github_at.go @@ -54,7 +54,7 @@ func RegisterGitHubATEndpoint(api huma.API, pathPrefix string, cfg *config.Confi Path: pathPrefix + "/auth/github-at", Summary: "Exchange GitHub OAuth access token for Registry JWT", Description: "Exchange a GitHub OAuth access token for a short-lived Registry JWT token", - Tags: []string{"auth"}, + Tags: []string{tagAuth}, }, func(ctx context.Context, input *GitHubTokenExchangeInput) (*v0.Response[auth.TokenResponse], error) { response, err := handler.ExchangeToken(ctx, input.Body.GitHubToken) if err != nil { diff --git a/internal/api/handlers/v0/auth/github_oidc.go b/internal/api/handlers/v0/auth/github_oidc.go index 5ce38ac..de95c67 100644 --- a/internal/api/handlers/v0/auth/github_oidc.go +++ b/internal/api/handlers/v0/auth/github_oidc.go @@ -235,7 +235,7 @@ func RegisterGitHubOIDCEndpoint(api huma.API, pathPrefix string, cfg *config.Con Path: pathPrefix + "/auth/github-oidc", Summary: "Exchange GitHub OIDC token for Registry JWT", Description: "Exchange a GitHub Actions OIDC token for a short-lived Registry JWT token", - Tags: []string{"auth"}, + Tags: []string{tagAuth}, }, func(ctx context.Context, input *GitHubOIDCTokenExchangeInput) (*v0.Response[auth.TokenResponse], error) { response, err := handler.ExchangeToken(ctx, input.Body.OIDCToken) if err != nil { diff --git a/internal/api/handlers/v0/auth/http.go b/internal/api/handlers/v0/auth/http.go index 8f438b7..5392762 100644 --- a/internal/api/handlers/v0/auth/http.go +++ b/internal/api/handlers/v0/auth/http.go @@ -242,7 +242,7 @@ func RegisterHTTPEndpoint(api huma.API, pathPrefix string, cfg *config.Config) { Path: pathPrefix + "/auth/http", Summary: "Exchange HTTP signature for Registry JWT", Description: "Authenticate using HTTP-hosted public key and signed timestamp", - Tags: []string{"auth"}, + Tags: []string{tagAuth}, }, func(ctx context.Context, input *HTTPTokenExchangeInput) (*v0.Response[auth.TokenResponse], error) { response, err := handler.ExchangeToken(ctx, input.Body.Domain, input.Body.Timestamp, input.Body.SignedTimestamp) if err != nil { diff --git a/internal/api/handlers/v0/auth/main.go b/internal/api/handlers/v0/auth/main.go index 26a566b..62d9883 100644 --- a/internal/api/handlers/v0/auth/main.go +++ b/internal/api/handlers/v0/auth/main.go @@ -5,6 +5,9 @@ import ( "github.com/modelcontextprotocol/registry/internal/config" ) +// tagAuth is the OpenAPI tag grouping all token exchange operations. +const tagAuth = "auth" + // RegisterAuthEndpoints registers all authentication endpoints with a custom path prefix func RegisterAuthEndpoints(api huma.API, pathPrefix string, cfg *config.Config) { // Register GitHub access token authentication endpoint diff --git a/internal/api/handlers/v0/auth/none.go b/internal/api/handlers/v0/auth/none.go index 9f373c1..2549208 100644 --- a/internal/api/handlers/v0/auth/none.go +++ b/internal/api/handlers/v0/auth/none.go @@ -43,7 +43,7 @@ func RegisterNoneEndpoint(api huma.API, pathPrefix string, cfg *config.Config) { Path: pathPrefix + "/auth/none", Summary: "Get anonymous Registry JWT (Development/Testing Only)", Description: "Get a short-lived Registry JWT token for publishing and editing servers in the io.modelcontextprotocol.anonymous/* namespace. This endpoint is intended for local development and automated testing only.", - Tags: []string{"auth"}, + Tags: []string{tagAuth}, }, func(ctx context.Context, _ *struct{}) (*v0.Response[auth.TokenResponse], error) { response, err := handler.GetAnonymousToken(ctx) if err != nil { diff --git a/internal/api/handlers/v0/auth/oidc.go b/internal/api/handlers/v0/auth/oidc.go index 98526e1..1b63daf 100644 --- a/internal/api/handlers/v0/auth/oidc.go +++ b/internal/api/handlers/v0/auth/oidc.go @@ -159,7 +159,7 @@ func RegisterOIDCEndpoints(api huma.API, pathPrefix string, cfg *config.Config) Path: pathPrefix + "/auth/oidc", Summary: "Exchange OIDC ID token for Registry JWT", Description: "Exchange an OIDC ID token from any configured provider for a short-lived Registry JWT token", - Tags: []string{"auth"}, + Tags: []string{tagAuth}, }, func(ctx context.Context, input *OIDCTokenExchangeInput) (*v0.Response[auth.TokenResponse], error) { response, err := handler.ExchangeToken(ctx, input.Body.OIDCToken) if err != nil { diff --git a/internal/api/handlers/v0/edit.go b/internal/api/handlers/v0/edit.go index a927e7b..e552bbe 100644 --- a/internal/api/handlers/v0/edit.go +++ b/internal/api/handlers/v0/edit.go @@ -37,9 +37,9 @@ func RegisterEditEndpoints(api huma.API, pathPrefix string, registry service.Reg Path: pathPrefix + "/servers/{serverName}/versions/{version}", Summary: "Edit MCP server", Description: "Update the configuration of a specific version of an existing MCP server. Requires edit permission for the server. Use PATCH /servers/{serverName}/versions/{version}/status to update status metadata.", - Tags: []string{"servers"}, + Tags: []string{tagServers}, Security: []map[string][]string{ - {"bearer": {}}, + {securitySchemeBearer: {}}, }, }, func(ctx context.Context, input *EditServerInput) (*Response[apiv0.ServerResponse], error) { // Extract bearer token diff --git a/internal/api/handlers/v0/openapi.go b/internal/api/handlers/v0/openapi.go new file mode 100644 index 0000000..2dee9fd --- /dev/null +++ b/internal/api/handlers/v0/openapi.go @@ -0,0 +1,12 @@ +package v0 + +// Shared OpenAPI operation metadata, kept in one place so the generated spec +// groups operations consistently. +const ( + // tagServers groups the server CRUD and status operations. + tagServers = "servers" + + // securitySchemeBearer is the name of the Registry JWT bearer security + // scheme declared in the OpenAPI spec. + securitySchemeBearer = "bearer" +) diff --git a/internal/api/handlers/v0/publish.go b/internal/api/handlers/v0/publish.go index 5bd371e..bc01591 100644 --- a/internal/api/handlers/v0/publish.go +++ b/internal/api/handlers/v0/publish.go @@ -32,7 +32,7 @@ func RegisterPublishEndpoint(api huma.API, pathPrefix string, registry service.R Description: "Publish a new MCP server to the registry or update an existing one", Tags: []string{"publish"}, Security: []map[string][]string{ - {"bearer": {}}, + {securitySchemeBearer: {}}, }, }, func(ctx context.Context, input *PublishServerInput) (*Response[apiv0.ServerResponse], error) { // Extract bearer token diff --git a/internal/api/handlers/v0/servers.go b/internal/api/handlers/v0/servers.go index 059095d..7b14452 100644 --- a/internal/api/handlers/v0/servers.go +++ b/internal/api/handlers/v0/servers.go @@ -90,7 +90,7 @@ func RegisterServersEndpoints(api huma.API, pathPrefix string, registry service. Path: pathPrefix + "/servers", Summary: "List MCP servers", Description: "Get a paginated list of MCP servers from the registry", - Tags: []string{"servers"}, + Tags: []string{tagServers}, }, func(ctx context.Context, input *ListServersInput) (*Response[apiv0.ServerListResponse], error) { // Build filter from input parameters filter := &database.ServerFilter{} @@ -159,7 +159,7 @@ func RegisterServersEndpoints(api huma.API, pathPrefix string, registry service. Path: pathPrefix + "/servers/{serverName}/versions/{version}", Summary: "Get specific MCP server version", Description: "Get detailed information about a specific version of an MCP server. Use the special version 'latest' to get the latest version.", - Tags: []string{"servers"}, + Tags: []string{tagServers}, }, func(ctx context.Context, input *ServerVersionDetailInput) (*Response[apiv0.ServerResponse], error) { // URL-decode the server name serverName, err := url.PathUnescape(input.ServerName) @@ -201,7 +201,7 @@ func RegisterServersEndpoints(api huma.API, pathPrefix string, registry service. Path: pathPrefix + "/servers/{serverName}/versions", Summary: "Get all versions of an MCP server", Description: "Get all available versions for a specific MCP server", - Tags: []string{"servers"}, + Tags: []string{tagServers}, }, func(ctx context.Context, input *ServerVersionsInput) (*Response[apiv0.ServerListResponse], error) { // URL-decode the server name serverName, err := url.PathUnescape(input.ServerName) diff --git a/internal/api/handlers/v0/status.go b/internal/api/handlers/v0/status.go index 3f03fc2..f3cca85 100644 --- a/internal/api/handlers/v0/status.go +++ b/internal/api/handlers/v0/status.go @@ -83,9 +83,9 @@ func RegisterStatusEndpoints(api huma.API, pathPrefix string, registry service.R Path: pathPrefix + "/servers/{serverName}/versions/{version}/status", Summary: "Update MCP server status", Description: "Update the status metadata of a specific version of an MCP server. Requires publish or edit permission for the server. This endpoint allows changing status and status message without requiring the full server configuration.", - Tags: []string{"servers"}, + Tags: []string{tagServers}, Security: []map[string][]string{ - {"bearer": {}}, + {securitySchemeBearer: {}}, }, }, func(ctx context.Context, input *UpdateServerStatusInput) (*Response[apiv0.ServerResponse], error) { // Extract bearer token @@ -198,9 +198,9 @@ func RegisterAllVersionsStatusEndpoints(api huma.API, pathPrefix string, registr Path: pathPrefix + "/servers/{serverName}/status", Summary: "Update status for all versions of an MCP server", Description: "Update the status metadata of all versions of an MCP server in a single transaction. Requires publish or edit permission for the server. Either all versions are updated or none on failure.", - Tags: []string{"servers"}, + Tags: []string{tagServers}, Security: []map[string][]string{ - {"bearer": {}}, + {securitySchemeBearer: {}}, }, }, func(ctx context.Context, input *UpdateAllVersionsStatusInput) (*Response[UpdateAllVersionsStatusResponse], error) { // Extract bearer token diff --git a/internal/api/server.go b/internal/api/server.go index 3cb8a7f..c8ce97c 100644 --- a/internal/api/server.go +++ b/internal/api/server.go @@ -5,6 +5,7 @@ import ( "encoding/json" "log" "net/http" + "net/url" "path" "strings" "time" @@ -72,11 +73,18 @@ func TrailingSlashMiddleware(next http.Handler) http.Handler { return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { // Only redirect if the path is not "/" and ends with a "/" if r.URL.Path != "/" && strings.HasSuffix(r.URL.Path, "/") { + // Build the target from the path and query alone, dropping any + // scheme/host the client may have supplied in an absolute-form + // request URI ("GET http://evil.com/foo/ HTTP/1.1"), which would + // otherwise be echoed back as an off-site redirect. + // // path.Clean both removes the trailing slash and collapses any // leading "//" to "/", which prevents an open-redirect via a // protocol-relative path like "//evil.com/" (GHSA-v8vw-gw5j-w7m6). - newURL := *r.URL - newURL.Path = path.Clean(r.URL.Path) + newURL := url.URL{ + Path: path.Clean(r.URL.Path), + RawQuery: r.URL.RawQuery, + } // Use 308 Permanent Redirect to preserve the request method http.Redirect(w, r, newURL.String(), http.StatusPermanentRedirect) diff --git a/internal/validators/utils.go b/internal/validators/utils.go index 035132d..2e1aea7 100644 --- a/internal/validators/utils.go +++ b/internal/validators/utils.go @@ -6,6 +6,11 @@ import ( "strings" ) +const ( + schemeHTTP = "http" + schemeHTTPS = "https" +) + var ( // Regular expressions for validating repository URLs // These regex patterns ensure the URL is in the format of a valid GitHub or GitLab repository @@ -52,8 +57,8 @@ func replaceTemplateVariables(rawURL string) string { "{host}": "example.com", "{port}": "8080", "{path}": "api", - "{protocol}": "http", - "{scheme}": "http", + "{protocol}": schemeHTTP, + "{scheme}": schemeHTTP, } result := rawURL @@ -86,7 +91,7 @@ func IsValidURL(rawURL string) bool { } // Check if scheme is present (http or https) - if u.Scheme != "http" && u.Scheme != "https" { + if u.Scheme != schemeHTTP && u.Scheme != schemeHTTPS { return false } @@ -153,7 +158,7 @@ func IsValidRemoteURL(rawURL string) bool { return false } - if u.Scheme != "https" { + if u.Scheme != schemeHTTPS { return false } diff --git a/tools/extract-server-schema/main.go b/tools/extract-server-schema/main.go index a90aa2d..e7e5bd1 100644 --- a/tools/extract-server-schema/main.go +++ b/tools/extract-server-schema/main.go @@ -14,6 +14,9 @@ import ( const ( openAPIPath = "docs/reference/api/openapi.yaml" schemaOutputDir = "docs/reference/server-json/draft" + + // refKey is the JSON Schema reference key. + refKey = "$ref" ) func main() { @@ -99,7 +102,7 @@ func main() { "$schema": "http://json-schema.org/draft-07/schema#", "$id": schemaID, "title": "server.json defining a Model Context Protocol (MCP) server", - "$ref": "#/definitions/ServerDetail", + refKey: "#/definitions/ServerDetail", "definitions": definitions, } @@ -148,7 +151,7 @@ func findReferencedSchemas(obj interface{}, found map[string]bool) { switch v := obj.(type) { case map[string]interface{}: for key, value := range v { - if key == "$ref" { + if key == refKey { if ref, ok := value.(string); ok { // Extract schema name from #/components/schemas/SchemaName if strings.HasPrefix(ref, "#/components/schemas/") { @@ -173,7 +176,7 @@ func replaceComponentRefs(obj interface{}) interface{} { case map[string]interface{}: result := make(map[string]interface{}) for key, value := range v { - if key == "$ref" { + if key == refKey { if ref, ok := value.(string); ok { // Replace the reference path result[key] = strings.ReplaceAll(ref, "#/components/schemas/", "#/definitions/") From 5022e04399793e40f678ce003e22f1a4b623ba41 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Fri, 21 Aug 2026 01:43:05 +0300 Subject: [PATCH 291/313] ci: widen the publish-attempt path list (#1560) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit #1524 tried to publish by adding `data/servers/io.decisionrules/server.json`. The detector ran fine and logged: ``` Non-publish file changed: data/servers/io.decisionrules/server.json PR #1524 match=false ``` The path list only knew `servers/**` at the repo root and exactly `data/seed.json`. Putting the file under `data/servers/` is a natural guess given `data/seed.json` exists, and it fell straight through. Adds `data/servers/**` plus root-level `server.json` / `servers.json`. `find` confirms nothing legitimate lives at any of those paths today. The list stays explicit rather than becoming a broad `**/server.json` glob. The classifier only flags a PR when *every* changed file matches, which makes widening asymmetric: too narrow silently misses spam, too broad auto-closes a legitimate single-file PR. Both copies of the list (stage 1 and stage 2) are updated identically, with a comment on each pointing at the other. ## Testing `actionlint` clean. macOS ships bash 3.2, so I extracted the literal `if [[ ... ]]` condition from each workflow file and ran it under bash 5 in Docker — testing the shipped text rather than a retyped copy. Both copies are byte-identical and agree: ``` MATCH data/servers/io.decisionrules/server.json # PR 1524 MATCH servers/com.aradia/x.json # PR 1549 MATCH data/seed.json MATCH server.json MATCH servers.json keep internal/api/handler.go keep internal/servers/service.go keep data/servers.md keep docs/README.md ``` Also dry-ran the full classifier against all 35 currently-open PRs from untrusted authors: **0 would be closed**. No legitimate open PR is affected. ## Known remaining gap (deliberately not fixed here) The detector does not run at all for authors new to GitHub. This repo's Actions approval policy is `first_time_contributors_new_to_github`, so their fork PRs sit in `action_required` until a maintainer approves the run. That is why #1549 was never flagged. I'm leaving that alone for now because the numbers don't justify the fix. Since the automation landed on 2026-07-09 it has had **71 detect runs: 70 ran, 1 was gated**. It has correctly closed 3 publish attempts (SAGE, Diagram Generation API, Kairos Signal) and missed 2 — one to the path bug this PR fixes, one to the gate. So the gate costs roughly one missed PR every six weeks, and those get closed manually within a day. The only ways around it are `pull_request_target` (runs untrusted PRs in a privileged context — one future `actions/checkout` from being a privilege-escalation hole) or a scheduled sweep (works, but trades the two-stage design for cron semantics and a ~15 min delay). Neither seems worth it at that rate. Happy to open a follow-up if you'd rather close the gap. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5 (1M context) --- .../workflows/close-invalid-publish-prs.yml | 9 +++++++-- .../workflows/detect-invalid-publish-prs.yml | 18 +++++++++++++++--- 2 files changed, 22 insertions(+), 5 deletions(-) diff --git a/.github/workflows/close-invalid-publish-prs.yml b/.github/workflows/close-invalid-publish-prs.yml index 934421b..8666c3b 100644 --- a/.github/workflows/close-invalid-publish-prs.yml +++ b/.github/workflows/close-invalid-publish-prs.yml @@ -34,7 +34,7 @@ jobs: COMMENT_BODY: | Hi @__AUTHOR__ 👋 — thanks for your interest in the MCP Registry! - It looks like this PR is trying to publish an MCP server by adding or editing files in this repository (under `servers/` or in `data/seed.json`). That isn't how servers get published, so I'm closing this PR automatically. + It looks like this PR is trying to publish an MCP server by adding or editing server files in this repository (under `servers/`, `data/servers/`, or in `data/seed.json`). That isn't how servers get published, so I'm closing this PR automatically. **Servers are published with the [`mcp-publisher`](https://github.com/modelcontextprotocol/registry/blob/main/docs/modelcontextprotocol-io/quickstart.mdx) CLI**, not by opening a pull request against this repo. The CLI verifies that you own your namespace and submits your `server.json` directly to the live registry API. @@ -121,10 +121,15 @@ jobs: echo "No files for PR #$PR_NUMBER; skipping." exit 0 fi + # Keep this list in sync with the copy in stage 1. publish_attempt=0 other=0 for f in "${FILES[@]}"; do - if [[ "$f" == servers/* || "$f" == "data/seed.json" ]]; then + if [[ "$f" == servers/* \ + || "$f" == data/servers/* \ + || "$f" == "data/seed.json" \ + || "$f" == "server.json" \ + || "$f" == "servers.json" ]]; then publish_attempt=1 else other=1 diff --git a/.github/workflows/detect-invalid-publish-prs.yml b/.github/workflows/detect-invalid-publish-prs.yml index 355521b..c200f86 100644 --- a/.github/workflows/detect-invalid-publish-prs.yml +++ b/.github/workflows/detect-invalid-publish-prs.yml @@ -48,12 +48,24 @@ jobs: mapfile -t FILES < <(gh api --paginate "repos/$GH_REPO/pulls/$PR_NUMBER/files" --jq '.[].filename') if [ "${#FILES[@]}" -gt 0 ]; then # Flag only if the PR touches *exclusively* publish-attempt files - # (servers/** and/or data/seed.json) and nothing else, so that - # legit PRs touching seed data alongside real code are left alone. + # and nothing else, so that legit PRs touching seed data + # alongside real code are left alone. + # + # Keep this list in sync with the copy in stage 2. It stays an + # explicit list rather than a broad `**/server.json` glob: + # because we require *every* file to match, an over-broad + # pattern would auto-close a legitimate single-file PR. + # data/servers/** is here because #1524 put its server.json + # there - a natural guess next to data/seed.json - and slipped + # through the original servers/**-only list. publish_attempt=0 other=0 for f in "${FILES[@]}"; do - if [[ "$f" == servers/* || "$f" == "data/seed.json" ]]; then + if [[ "$f" == servers/* \ + || "$f" == data/servers/* \ + || "$f" == "data/seed.json" \ + || "$f" == "server.json" \ + || "$f" == "servers.json" ]]; then publish_attempt=1 else echo "Non-publish file changed: $f" From 3c1ee7d27227a30d40dffa7ab2bc558a907462d3 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 21 Aug 2026 01:48:09 +0300 Subject: [PATCH 292/313] build(deps): bump github.com/google/go-containerregistry from 0.21.8 to 0.21.9 (#1531) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) from 0.21.8 to 0.21.9.
    Release notes

    Sourced from github.com/google/go-containerregistry's releases.

    v0.21.9

    What's Changed

    Full Changelog: https://github.com/google/go-containerregistry/compare/v0.21.8...v0.21.9

    Commits
    • 7b32099 build(deps): bump the actions group with 3 updates (#2398)
    • 2a4447d fix: remove '.' from unsafe path prefixes (#2400)
    • 43cc3e8 fix: prevent data race on scope refreshes within remote.writer (#2396)
    • 7775aab actions: pin slsa generator version following linter exception (#2395)
    • See full diff in compare view

    [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/google/go-containerregistry&package-manager=go_modules&previous-version=0.21.8&new-version=0.21.9)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
    Dependabot commands and options
    You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Radoslav Dimitrov --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 457ba7a..bb46065 100644 --- a/go.mod +++ b/go.mod @@ -10,7 +10,7 @@ require ( github.com/coreos/go-oidc/v3 v3.20.0 github.com/danielgtaylor/huma/v2 v2.39.1 github.com/golang-jwt/jwt/v5 v5.3.1 - github.com/google/go-containerregistry v0.21.8 + github.com/google/go-containerregistry v0.21.9 github.com/jackc/pgx/v5 v5.10.0 github.com/prometheus/client_golang v1.24.1 github.com/rs/cors v1.11.1 diff --git a/go.sum b/go.sum index e4cd0cf..904ff2b 100644 --- a/go.sum +++ b/go.sum @@ -69,8 +69,8 @@ github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps= github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= -github.com/google/go-containerregistry v0.21.8 h1:Ig/zIsnztdCUNaiNNczE+MoP5xcyUMfvpvfOr1xyMLE= -github.com/google/go-containerregistry v0.21.8/go.mod h1:dP5XNKcL7kMFF/TB3LfvWmVhAcv7iqkHb3oDK8aauTo= +github.com/google/go-containerregistry v0.21.9 h1:F+D4uZ3iA3DLMJLfhaqMdHJbzeqm/216WGQq2dokuLs= +github.com/google/go-containerregistry v0.21.9/go.mod h1:dP5XNKcL7kMFF/TB3LfvWmVhAcv7iqkHb3oDK8aauTo= github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0= github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= From 6036804f1c62633b5e7d2927f411a6f4127f148a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 21 Aug 2026 01:48:19 +0300 Subject: [PATCH 293/313] build(deps): bump the opentelemetry group across 1 directory with 6 updates (#1530) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps the opentelemetry group with 2 updates in the / directory: [go.opentelemetry.io/contrib/instrumentation/runtime](https://github.com/open-telemetry/opentelemetry-go-contrib) and [go.opentelemetry.io/otel/exporters/prometheus](https://github.com/open-telemetry/opentelemetry-go). Updates `go.opentelemetry.io/contrib/instrumentation/runtime` from 0.69.0 to 0.70.0
    Changelog

    Sourced from go.opentelemetry.io/contrib/instrumentation/runtime's changelog.

    [1.45.0/2.5.2/0.70.0/0.37.2/0.25.0/0.20.0/0.16.2/0.17.0] - 2026-08-03

    Added

    • Add go.opentelemetry.io/contrib/detectors/ibmcloud/vpc, a new resource detector for IBM Cloud VPC virtual server instances, ported from github.com/open-telemetry/opentelemetry-collector-contrib/processor/resourcedetectionprocessor/internal/ibmcloud/vpc. Detects cloud.provider, cloud.platform, cloud.region, cloud.availability_zone, cloud.account.id, cloud.resource_id, host.id, host.image.id, host.image.name, host.name, and host.type. (#9011)
    • Add go.opentelemetry.io/contrib/detectors/k8sapi, a new resource detector that queries the Kubernetes API. Detects k8s.node.name and k8s.node.uid when K8S_NODE_NAME is set via the downward API, and k8s.cluster.uid derived from the kube-system namespace UID (works on any Kubernetes distribution). (#9108)
    • Add new elasticbeanstalk resource detector for AWS Elastic Beanstalk, ported from processor/resourcedetectionprocessor/internal/aws/elasticbeanstalk in opentelemetry-collector-contrib. (#8993)
    • The resource created by go.opentelemetry.io/contrib/otelconf now includes default SDK attributes. (#8990)
    • Add support for the aws.ecs resource detector in go.opentelemetry.io/contrib/otelconf/x. (#8915)
    • Add support for the aws.eks resource detector in go.opentelemetry.io/contrib/otelconf/x. (#9138)
    • Add support for the azure.vm resource detector in go.opentelemetry.io/contrib/otelconf/x. (#9074)
    • Add support for the gcp resource detector in go.opentelemetry.io/contrib/otelconf/x. (#9137)
    • Add go.opentelemetry.io/contrib/detectors/azure/azureappservice, a new resource detector for Azure App Service. Detects cloud.*, service.name, azure.resource_group.name, azure.app_service.instance.id, and deployment.environment.name from the WEBSITE_* and REGION_NAME environment variables. (#9289)
    • Add azurecontainerapps resource detector for Azure Container Apps. (#8939)
    • Add go.opentelemetry.io/contrib/detectors/azure/azurefunctions, a new resource detector for Azure Functions. Detects cloud.*, service.name, azure.resource_group.name, faas.instance, and deployment.environment.name from the FUNCTIONS_*, WEBSITE_*, CONTAINER_NAME, and REGION_NAME environment variables. (#9290)
    • Add NewResourceDetector along with the WithAttributeFilter and WithTagKeyFilter options in go.opentelemetry.io/contrib/detectors/azure/azurevm. WithAttributeFilter restricts the returned resource to the attributes the filter accepts. WithTagKeyFilter opts in to azure.tag.<name> attributes for the VM tags whose keys satisfy the provided predicate; no VM tags are emitted without it. (#9162)
    • Add go.opentelemetry.io/contrib/detectors/vultr — a new resource detector for Vultr Cloud Compute instances, ported from processor/resourcedetectionprocessor/internal/vultr in opentelemetry-collector-contrib. Detects cloud.provider, cloud.platform, cloud.region, host.id, and host.name. (#8995)

    Changed

    • Upgrade go.opentelemetry.io/otel/semconv to v1.43.0, including updates across instrumentation and detector modules. See semantic-conventions v1.43.0 release for complete details. (#9337)
    • Upgrade go.opentelemetry.io/otel/semconv to v1.42.0, including updates across instrumentation and detector modules. See semantic-conventions v1.42.0 release for complete details. (#9196)
    • Use direct normalized-key lookups in Carrier.Get and Carrier.Keys in go.opentelemetry.io/contrib/propagators/envcar. (#9112)
    • Update log bridge conversions to use attribute key-values instead of the removed log key-values in go.opentelemetry.io/contrib/bridges/otellogr, go.opentelemetry.io/contrib/bridges/otellogrus, go.opentelemetry.io/contrib/bridges/otelslog, and go.opentelemetry.io/contrib/bridges/otelzap. (#9180)
    • The Version() function in go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux has been replaced by const Version. (#9076)
    • Set error.type attribute instead of adding exception span events in go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin. (#8977)
    • Prefer the gRPC dial target over the resolved peer IP for the server.address and server.port attributes in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc. (#8904)
    • The detector in go.opentelemetry.io/contrib/detectors/azure/azurevm now also detects cloud.account.id, cloud.availability_zone, azure.vm.name, azure.vm.size, azure.vm.scaleset.name, and azure.resource_group.name, and prefers osProfile.computerName for host.name (falling back to the VM name), reconciling it with the collector-contrib Azure resource detector. (#9162)

    Fixed

    • Fix Prometheus reader resource label filter configuration in go.opentelemetry.io/contrib/otelconf/v0.2.0. (#9062)
    • Apply resource.detection/development.attributes.included and excluded filtering to resource detector attributes in go.opentelemetry.io/contrib/otelconf/x. (#9131)
    • Honor the context configured with WithContext when constructing resources in go.opentelemetry.io/contrib/otelconf and go.opentelemetry.io/contrib/otelconf/x. (#9160)
    • Handle nil response bodies from custom RoundTripper implementations in go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp without panicking. (#9184)
    • Fix incorrect (overestimated) sum calculation for runtime histograms in go.opentelemetry.io/contrib/instrumentation/runtime. (#9063)
    • Fix Severity.UnmarshalText round trip for positive FATAL offsets above the named range in go.opentelemetry.io/contrib/processors/minsev. (#9197)
    • Reduce binary size by fetching ConfigMaps via rest.HTTPClientFor instead of the Kubernetes clientset in go.opentelemetry.io/contrib/detectors/aws/eks. (#9284)
    • TextMapPropagator in go.opentelemetry.io/contrib/propagators/autoprop returns the no-op propagator for empty input, matching the behavior of none. An unknown OTEL_PROPAGATORS value still returns an error with a nil propagator so NewTextMapPropagator falls back to the default TraceContext and Baggage propagators instead of disabling propagation. (#9163)
    • Preserve error-valued attributes nested in a group as grouped attributes instead of silently dropping them in go.opentelemetry.io/contrib/bridges/otelslog. (#9238)
    • Fix a data race in go.opentelemetry.io/contrib/bridges/otelslog where concurrent Handle calls could corrupt each other's log attributes because kvBuffer.KeyValues returned a slice aliasing a shared buffer. (#9229)
    • Avoid a panic in go.opentelemetry.io/contrib/bridges/otelzap when a malformed error field contains a nil or non-error value. (#9068)
    • Use azure.container_app.instance.id instead of service.instance.id for the replica name detected by go.opentelemetry.io/contrib/detectors/azure/azurecontainerapps. (#9208)
    • Preserve the underlying metadata errors returned with partial resources from go.opentelemetry.io/contrib/detectors/gcp. (#9069)
    • Copy MultipartForm back to the request otelmux.Middleware was given after the wrapped handler returns, so net/http can find and remove the temp files ParseMultipartForm created on the context-derived request copy, when otelmux.Middleware wraps a handler directly, in go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux. This does not cover a handler panic, nor the common router.Use(...) integration, where gorilla/mux's own routing step makes an additional request copy the middleware cannot write back through; see gorilla/mux#777. (#9361)
    • Report the b3 header from Fields() for the default B3Unspecified single-header injection encoding, matching what Inject writes, in go.opentelemetry.io/contrib/propagators/b3. (#9273)
    • Fix go.opentelemetry.io/contrib/propagators/aws/xray producing deterministic trace and span IDs when the seed read from crypto/rand silently failed, by switching to math/rand/v2's concurrency-safe top-level generator. (#9359)
    • Strip connection number suffix from connection ID in go.opentelemetry.io/contrib/instrumentation/go.mongodb.org/mongo-driver/v2/mongo/otelmongo to prevent unbounded metric cardinality. (#9352)

    ... (truncated)

    Commits
    • c8a87a6 Release v1.45.0/v2.5.2/v0.70.0/v0.37.2/v0.25.0/v0.20.0/v0.16.2/v0.17.0 (#9413)
    • cde125c fix(deps): update aws-sdk-go-v2 monorepo (#9384)
    • 88572a7 chore(deps): update googleapis to 6ac0973 (#9409)
    • e4f511a chore(deps): update github/codeql-action action to v4.37.5 (#9410)
    • 265eb0b fix(deps): update go.opentelemetry.io/otel digest to 48db2c6 (#9317)
    • 941ba46 chore(deps): update github.com/charmbracelet/ultraviolet digest to 8b69304 (#...
    • ededd3b chore(deps): update module github.com/lucasb-eyer/go-colorful to v1.4.1 (#9406)
    • 7c6e819 fix(deps): update module github.com/atombender/go-jsonschema to v0.24.1 (#9405)
    • ec1e544 chore(deps): update github.com/lufia/plan9stats digest to 341c2f0 (#9403)
    • 5d7e16a chore(deps): update github.com/golangci/rowserrcheck digest to d2031e3 (#9402)
    • Additional commits viewable in compare view

    Updates `go.opentelemetry.io/otel` from 1.44.0 to 1.45.0
    Release notes

    Sourced from go.opentelemetry.io/otel's releases.

    Release v1.45.0/v0.67.0/v0.21.0/v0.0.18

    Overview

    Added

    • Add experimental observability metrics to BatchProcessor in go.opentelemetry.io/otel/sdk/log. (#7124)
    • Add the experimental WithUnsafeAttributes no-copy attribute option to go.opentelemetry.io/otel/metric/x for future performance improvements. This API is a work in progress. (#8251)
    • Add Map and MapValue functions for the new MAP attribute type in go.opentelemetry.io/otel/attribute. (#8445)
    • Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlptrace. (#8453)
    • Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlplog. (#8453)
    • Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlpmetric. (#8453)
    • Support MAP attributes in go.opentelemetry.io/otel/exporters/zipkin. (#8453)
    • Apply AttributeValueLengthLimit recursively to values contained in attribute.MAP attributes in go.opentelemetry.io/otel/sdk/trace. (#8454)
    • Remove duplicate keys from attribute.MAP values in go.opentelemetry.io/otel/sdk/resource using last-value-wins semantics. (#8471)
    • Remove duplicate keys by default from attribute.MAP values in instrumentation scope attributes in go.opentelemetry.io/otel/sdk/log using last-value-wins semantics. (#8471)
    • Remove duplicate keys by default from attribute.MAP values in span, event, link, and instrumentation scope attributes in go.opentelemetry.io/otel/sdk/trace using last-value-wins semantics. (#8471)
    • Remove duplicate keys by default from attribute.MAP values in measurement and instrumentation scope attributes in go.opentelemetry.io/otel/sdk/metric using last-value-wins semantics. (#8471)
    • Extend WithAllowKeyDuplication in go.opentelemetry.io/otel/sdk/log to disable duplicate-key removal in attribute.MAP values for instrumentation scope attributes. (#8471)
    • Add the go.opentelemetry.io/otel/semconv/v1.42.0 package. The package contains semantic conventions from the v1.42.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.41.0. (#8484)
    • Add WithoutPanicRecording as a TracerProviderOption in go.opentelemetry.io/otel/sdk/trace to disable exception event recording for panics. (#8532)
    • Add the go.opentelemetry.io/otel/semconv/v1.43.0 package. The package contains semantic conventions from the v1.43.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.42.0. (#8628)

    Changed

    • HistogramReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar now uses a time-unbiased sampling algorithm for exemplars. (#8306)
    • ⚠️ Breaking Change: Use go.opentelemetry.io/otel/attribute.Value and go.opentelemetry.io/otel/attribute.KeyValue for log bodies and attributes in go.opentelemetry.io/otel/log, go.opentelemetry.io/otel/log/logtest, go.opentelemetry.io/otel/sdk/log, and go.opentelemetry.io/otel/sdk/log/logtest. (#8490)
    • Encode log bodies and attributes as go.opentelemetry.io/otel/attribute.Value JSON in go.opentelemetry.io/otel/exporters/stdout/stdoutlog. (#8490)
    • Improve the performance of hashing BOOLSLICE, INT64SLICE, FLOAT64SLICE, and STRINGSLICE attribute values by avoiding reflection for short slices in go.opentelemetry.io/otel/attribute. (#8511)
    • ⚠️ Breaking Change: WithEndpointURL in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp no longer appends the default signal path when an endpoint URL has no path, making the behavior consistent with go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp and with setting the endpoint through OTEL_EXPORTER_OTLP_METRICS_ENDPOINT. If the URL has no path component, the root path (/) is used. Use WithEndpointURL(url.JoinPath(endpoint, "/v1/metrics")) to preserve the previous behavior. (#8538)
    • ⚠️ Breaking Change: WithEndpointURL in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp no longer appends the default signal path when an endpoint URL has no path, making the behavior consistent with go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp and with setting the endpoint through OTEL_EXPORTER_OTLP_TRACES_ENDPOINT. If the URL has no path component, the root path (/) is used. Use WithEndpointURL(url.JoinPath(endpoint, "/v1/traces")) to preserve the previous behavior. (#8538)

    Deprecated

    • Deprecate WithExportBufferSize in go.opentelemetry.io/otel/sdk/log. The option remains available for source compatibility but no longer affects behavior; BatchProcessor no longer maintains a separate export-request buffer. (#8620)

    Removed

    • ⚠️ Breaking Change: Remove Kind, Value, KeyValue, their constructors, and attribute conversion helpers from go.opentelemetry.io/otel/log. (#8490)
    • ⚠️ Breaking Change: Remove the AttributeValueLengthLimit and AttributeCountLimit fields from RecordFactory in go.opentelemetry.io/otel/sdk/log/logtest; records produced by the factory now keep attribute limits disabled so test code can append exact attributes. (#8556)

    Fixed

    • Apply TLS certificates configured through environment variables to gRPC connections in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc.
    • Prevent panics in go.opentelemetry.io/otel/bridge/opentracing when OpenTracing baggage is propagated concurrently with Span.SetBaggageItem.
    • Fix an off-by-one error in FixedSizeReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar that prevented the first exemplar from being sampled after the reservoir was filled. (#8309)
    • Interpret HTTP Retry-After header values as seconds instead of nanoseconds when retrying OTLP HTTP exports in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp, go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8383)

    ... (truncated)

    Changelog

    Sourced from go.opentelemetry.io/otel's changelog.

    [1.45.0/0.67.0/0.21.0/0.0.18] - 2026-08-03

    Added

    • Add experimental observability metrics to BatchProcessor in go.opentelemetry.io/otel/sdk/log. (#7124)
    • Add the experimental WithUnsafeAttributes no-copy attribute option to go.opentelemetry.io/otel/metric/x for future performance improvements. This API is a work in progress. (#8251)
    • Add Map and MapValue functions for the new MAP attribute type in go.opentelemetry.io/otel/attribute. (#8445)
    • Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlptrace. (#8453)
    • Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlplog. (#8453)
    • Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlpmetric. (#8453)
    • Support MAP attributes in go.opentelemetry.io/otel/exporters/zipkin. (#8453)
    • Apply AttributeValueLengthLimit recursively to values contained in attribute.MAP attributes in go.opentelemetry.io/otel/sdk/trace. (#8454)
    • Remove duplicate keys from attribute.MAP values in go.opentelemetry.io/otel/sdk/resource using last-value-wins semantics. (#8471)
    • Remove duplicate keys by default from attribute.MAP values in instrumentation scope attributes in go.opentelemetry.io/otel/sdk/log using last-value-wins semantics. (#8471)
    • Remove duplicate keys by default from attribute.MAP values in span, event, link, and instrumentation scope attributes in go.opentelemetry.io/otel/sdk/trace using last-value-wins semantics. (#8471)
    • Remove duplicate keys by default from attribute.MAP values in measurement and instrumentation scope attributes in go.opentelemetry.io/otel/sdk/metric using last-value-wins semantics. (#8471)
    • Extend WithAllowKeyDuplication in go.opentelemetry.io/otel/sdk/log to disable duplicate-key removal in attribute.MAP values for instrumentation scope attributes. (#8471)
    • Add the go.opentelemetry.io/otel/semconv/v1.42.0 package. The package contains semantic conventions from the v1.42.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.41.0. (#8484)
    • Add WithoutPanicRecording as a TracerProviderOption in go.opentelemetry.io/otel/sdk/trace to disable exception event recording for panics. (#8532)
    • Add the go.opentelemetry.io/otel/semconv/v1.43.0 package. The package contains semantic conventions from the v1.43.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.42.0. (#8628)

    Changed

    • HistogramReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar now uses a time-unbiased sampling algorithm for exemplars. (#8306)
    • ⚠️ Breaking Change: Use go.opentelemetry.io/otel/attribute.Value and go.opentelemetry.io/otel/attribute.KeyValue for log bodies and attributes in go.opentelemetry.io/otel/log, go.opentelemetry.io/otel/log/logtest, go.opentelemetry.io/otel/sdk/log, and go.opentelemetry.io/otel/sdk/log/logtest. (#8490)
    • Encode log bodies and attributes as go.opentelemetry.io/otel/attribute.Value JSON in go.opentelemetry.io/otel/exporters/stdout/stdoutlog. (#8490)
    • Improve the performance of hashing BOOLSLICE, INT64SLICE, FLOAT64SLICE, and STRINGSLICE attribute values by avoiding reflection for short slices in go.opentelemetry.io/otel/attribute. (#8511)
    • ⚠️ Breaking Change: WithEndpointURL in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp no longer appends the default signal path when an endpoint URL has no path, making the behavior consistent with go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp and with setting the endpoint through OTEL_EXPORTER_OTLP_METRICS_ENDPOINT. If the URL has no path component, the root path (/) is used. Use WithEndpointURL(url.JoinPath(endpoint, "/v1/metrics")) to preserve the previous behavior. (#8538)
    • ⚠️ Breaking Change: WithEndpointURL in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp no longer appends the default signal path when an endpoint URL has no path, making the behavior consistent with go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp and with setting the endpoint through OTEL_EXPORTER_OTLP_TRACES_ENDPOINT. If the URL has no path component, the root path (/) is used. Use WithEndpointURL(url.JoinPath(endpoint, "/v1/traces")) to preserve the previous behavior. (#8538)

    Deprecated

    • Deprecate WithExportBufferSize in go.opentelemetry.io/otel/sdk/log. The option remains available for source compatibility but no longer affects behavior; BatchProcessor no longer maintains a separate export-request buffer. (#8620)

    Removed

    • ⚠️ Breaking Change: Remove Kind, Value, KeyValue, their constructors, and attribute conversion helpers from go.opentelemetry.io/otel/log. (#8490)
    • ⚠️ Breaking Change: Remove the AttributeValueLengthLimit and AttributeCountLimit fields from RecordFactory in go.opentelemetry.io/otel/sdk/log/logtest; records produced by the factory now keep attribute limits disabled so test code can append exact attributes. (#8556)

    Fixed

    • Apply TLS certificates configured through environment variables to gRPC connections in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc.
    • Prevent panics in go.opentelemetry.io/otel/bridge/opentracing when OpenTracing baggage is propagated concurrently with Span.SetBaggageItem.
    • Fix an off-by-one error in FixedSizeReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar that prevented the first exemplar from being sampled after the reservoir was filled. (#8309)
    • Interpret HTTP Retry-After header values as seconds instead of nanoseconds when retrying OTLP HTTP exports in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp, go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8383)
    • Fix a memory leak in the Reservoir implementation in go.opentelemetry.io/otel/sdk/metric/exemplar, where storing the full context.Context pinned large objects such as gRPC transport buffers. (#8389)

    ... (truncated)

    Commits
    • 93a693e Release v1.45.0 (#8693)
    • c65d435 Merge commit from fork
    • 223f9fd sdk/metric: remove obsolete randomFloat64 TODO (#8685)
    • 06272bc fix(deps): update googleapis to 6ac0973 (#8694)
    • a4f238f chore(deps): update github.com/charmbracelet/ultraviolet digest to 8b69304 (#...
    • 37140e7 chore(deps): update codspeedhq/action action to v5.0.2 (#8690)
    • cef0855 chore(deps): update module github.com/lucasb-eyer/go-colorful to v1.4.1 (#8689)
    • e814a72 Merge commit from fork
    • bfd8eb7 chore(deps): update github.com/golangci/rowserrcheck digest to d2031e3 (#8687)
    • 48db2c6 chore(deps): update github/codeql-action action to v4.37.5 (#8692)
    • Additional commits viewable in compare view

    Updates `go.opentelemetry.io/otel/exporters/prometheus` from 0.66.0 to 0.67.0
    Changelog

    Sourced from go.opentelemetry.io/otel/exporters/prometheus's changelog.

    [1.45.0/0.67.0/0.21.0/0.0.18] - 2026-08-03

    Added

    • Add experimental observability metrics to BatchProcessor in go.opentelemetry.io/otel/sdk/log. (#7124)
    • Add the experimental WithUnsafeAttributes no-copy attribute option to go.opentelemetry.io/otel/metric/x for future performance improvements. This API is a work in progress. (#8251)
    • Add Map and MapValue functions for the new MAP attribute type in go.opentelemetry.io/otel/attribute. (#8445)
    • Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlptrace. (#8453)
    • Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlplog. (#8453)
    • Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlpmetric. (#8453)
    • Support MAP attributes in go.opentelemetry.io/otel/exporters/zipkin. (#8453)
    • Apply AttributeValueLengthLimit recursively to values contained in attribute.MAP attributes in go.opentelemetry.io/otel/sdk/trace. (#8454)
    • Remove duplicate keys from attribute.MAP values in go.opentelemetry.io/otel/sdk/resource using last-value-wins semantics. (#8471)
    • Remove duplicate keys by default from attribute.MAP values in instrumentation scope attributes in go.opentelemetry.io/otel/sdk/log using last-value-wins semantics. (#8471)
    • Remove duplicate keys by default from attribute.MAP values in span, event, link, and instrumentation scope attributes in go.opentelemetry.io/otel/sdk/trace using last-value-wins semantics. (#8471)
    • Remove duplicate keys by default from attribute.MAP values in measurement and instrumentation scope attributes in go.opentelemetry.io/otel/sdk/metric using last-value-wins semantics. (#8471)
    • Extend WithAllowKeyDuplication in go.opentelemetry.io/otel/sdk/log to disable duplicate-key removal in attribute.MAP values for instrumentation scope attributes. (#8471)
    • Add the go.opentelemetry.io/otel/semconv/v1.42.0 package. The package contains semantic conventions from the v1.42.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.41.0. (#8484)
    • Add WithoutPanicRecording as a TracerProviderOption in go.opentelemetry.io/otel/sdk/trace to disable exception event recording for panics. (#8532)
    • Add the go.opentelemetry.io/otel/semconv/v1.43.0 package. The package contains semantic conventions from the v1.43.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.42.0. (#8628)

    Changed

    • HistogramReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar now uses a time-unbiased sampling algorithm for exemplars. (#8306)
    • ⚠️ Breaking Change: Use go.opentelemetry.io/otel/attribute.Value and go.opentelemetry.io/otel/attribute.KeyValue for log bodies and attributes in go.opentelemetry.io/otel/log, go.opentelemetry.io/otel/log/logtest, go.opentelemetry.io/otel/sdk/log, and go.opentelemetry.io/otel/sdk/log/logtest. (#8490)
    • Encode log bodies and attributes as go.opentelemetry.io/otel/attribute.Value JSON in go.opentelemetry.io/otel/exporters/stdout/stdoutlog. (#8490)
    • Improve the performance of hashing BOOLSLICE, INT64SLICE, FLOAT64SLICE, and STRINGSLICE attribute values by avoiding reflection for short slices in go.opentelemetry.io/otel/attribute. (#8511)
    • ⚠️ Breaking Change: WithEndpointURL in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp no longer appends the default signal path when an endpoint URL has no path, making the behavior consistent with go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp and with setting the endpoint through OTEL_EXPORTER_OTLP_METRICS_ENDPOINT. If the URL has no path component, the root path (/) is used. Use WithEndpointURL(url.JoinPath(endpoint, "/v1/metrics")) to preserve the previous behavior. (#8538)
    • ⚠️ Breaking Change: WithEndpointURL in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp no longer appends the default signal path when an endpoint URL has no path, making the behavior consistent with go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp and with setting the endpoint through OTEL_EXPORTER_OTLP_TRACES_ENDPOINT. If the URL has no path component, the root path (/) is used. Use WithEndpointURL(url.JoinPath(endpoint, "/v1/traces")) to preserve the previous behavior. (#8538)

    Deprecated

    • Deprecate WithExportBufferSize in go.opentelemetry.io/otel/sdk/log. The option remains available for source compatibility but no longer affects behavior; BatchProcessor no longer maintains a separate export-request buffer. (#8620)

    Removed

    • ⚠️ Breaking Change: Remove Kind, Value, KeyValue, their constructors, and attribute conversion helpers from go.opentelemetry.io/otel/log. (#8490)
    • ⚠️ Breaking Change: Remove the AttributeValueLengthLimit and AttributeCountLimit fields from RecordFactory in go.opentelemetry.io/otel/sdk/log/logtest; records produced by the factory now keep attribute limits disabled so test code can append exact attributes. (#8556)

    Fixed

    • Apply TLS certificates configured through environment variables to gRPC connections in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc.
    • Prevent panics in go.opentelemetry.io/otel/bridge/opentracing when OpenTracing baggage is propagated concurrently with Span.SetBaggageItem.
    • Fix an off-by-one error in FixedSizeReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar that prevented the first exemplar from being sampled after the reservoir was filled. (#8309)
    • Interpret HTTP Retry-After header values as seconds instead of nanoseconds when retrying OTLP HTTP exports in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp, go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8383)
    • Fix a memory leak in the Reservoir implementation in go.opentelemetry.io/otel/sdk/metric/exemplar, where storing the full context.Context pinned large objects such as gRPC transport buffers. (#8389)

    ... (truncated)

    Commits
    • 93a693e Release v1.45.0 (#8693)
    • c65d435 Merge commit from fork
    • 223f9fd sdk/metric: remove obsolete randomFloat64 TODO (#8685)
    • 06272bc fix(deps): update googleapis to 6ac0973 (#8694)
    • a4f238f chore(deps): update github.com/charmbracelet/ultraviolet digest to 8b69304 (#...
    • 37140e7 chore(deps): update codspeedhq/action action to v5.0.2 (#8690)
    • cef0855 chore(deps): update module github.com/lucasb-eyer/go-colorful to v1.4.1 (#8689)
    • e814a72 Merge commit from fork
    • bfd8eb7 chore(deps): update github.com/golangci/rowserrcheck digest to d2031e3 (#8687)
    • 48db2c6 chore(deps): update github/codeql-action action to v4.37.5 (#8692)
    • Additional commits viewable in compare view

    Updates `go.opentelemetry.io/otel/metric` from 1.44.0 to 1.45.0
    Release notes

    Sourced from go.opentelemetry.io/otel/metric's releases.

    Release v1.45.0/v0.67.0/v0.21.0/v0.0.18

    Overview

    Added

    • Add experimental observability metrics to BatchProcessor in go.opentelemetry.io/otel/sdk/log. (#7124)
    • Add the experimental WithUnsafeAttributes no-copy attribute option to go.opentelemetry.io/otel/metric/x for future performance improvements. This API is a work in progress. (#8251)
    • Add Map and MapValue functions for the new MAP attribute type in go.opentelemetry.io/otel/attribute. (#8445)
    • Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlptrace. (#8453)
    • Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlplog. (#8453)
    • Support MAP attributes in go.opentelemetry.io/otel/exporters/otlp/otlpmetric. (#8453)
    • Support MAP attributes in go.opentelemetry.io/otel/exporters/zipkin. (#8453)
    • Apply AttributeValueLengthLimit recursively to values contained in attribute.MAP attributes in go.opentelemetry.io/otel/sdk/trace. (#8454)
    • Remove duplicate keys from attribute.MAP values in go.opentelemetry.io/otel/sdk/resource using last-value-wins semantics. (#8471)
    • Remove duplicate keys by default from attribute.MAP values in instrumentation scope attributes in go.opentelemetry.io/otel/sdk/log using last-value-wins semantics. (#8471)
    • Remove duplicate keys by default from attribute.MAP values in span, event, link, and instrumentation scope attributes in go.opentelemetry.io/otel/sdk/trace using last-value-wins semantics. (#8471)
    • Remove duplicate keys by default from attribute.MAP values in measurement and instrumentation scope attributes in go.opentelemetry.io/otel/sdk/metric using last-value-wins semantics. (#8471)
    • Extend WithAllowKeyDuplication in go.opentelemetry.io/otel/sdk/log to disable duplicate-key removal in attribute.MAP values for instrumentation scope attributes. (#8471)
    • Add the go.opentelemetry.io/otel/semconv/v1.42.0 package. The package contains semantic conventions from the v1.42.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.41.0. (#8484)
    • Add WithoutPanicRecording as a TracerProviderOption in go.opentelemetry.io/otel/sdk/trace to disable exception event recording for panics. (#8532)
    • Add the go.opentelemetry.io/otel/semconv/v1.43.0 package. The package contains semantic conventions from the v1.43.0 version of the OpenTelemetry Semantic Conventions. See the migration documentation for information on how to upgrade from go.opentelemetry.io/otel/semconv/v1.42.0. (#8628)

    Changed

    • HistogramReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar now uses a time-unbiased sampling algorithm for exemplars. (#8306)
    • ⚠️ Breaking Change: Use go.opentelemetry.io/otel/attribute.Value and go.opentelemetry.io/otel/attribute.KeyValue for log bodies and attributes in go.opentelemetry.io/otel/log, go.opentelemetry.io/otel/log/logtest, go.opentelemetry.io/otel/sdk/log, and go.opentelemetry.io/otel/sdk/log/logtest. (#8490)
    • Encode log bodies and attributes as go.opentelemetry.io/otel/attribute.Value JSON in go.opentelemetry.io/otel/exporters/stdout/stdoutlog. (#8490)
    • Improve the performance of hashing BOOLSLICE, INT64SLICE, FLOAT64SLICE, and STRINGSLICE attribute values by avoiding reflection for short slices in go.opentelemetry.io/otel/attribute. (#8511)
    • ⚠️ Breaking Change: WithEndpointURL in go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp no longer appends the default signal path when an endpoint URL has no path, making the behavior consistent with go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp and with setting the endpoint through OTEL_EXPORTER_OTLP_METRICS_ENDPOINT. If the URL has no path component, the root path (/) is used. Use WithEndpointURL(url.JoinPath(endpoint, "/v1/metrics")) to preserve the previous behavior. (#8538)
    • ⚠️ Breaking Change: WithEndpointURL in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp no longer appends the default signal path when an endpoint URL has no path, making the behavior consistent with go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp and with setting the endpoint through OTEL_EXPORTER_OTLP_TRACES_ENDPOINT. If the URL has no path component, the root path (/) is used. Use WithEndpointURL(url.JoinPath(endpoint, "/v1/traces")) to preserve the previous behavior. (#8538)

    Deprecated

    • Deprecate WithExportBufferSize in go.opentelemetry.io/otel/sdk/log. The option remains available for source compatibility but no longer affects behavior; BatchProcessor no longer maintains a separate export-request buffer. (#8620)

    Removed

    • ⚠️ Breaking Change: Remove Kind, Value, KeyValue, their constructors, and attribute conversion helpers from go.opentelemetry.io/otel/log. (#8490)
    • ⚠️ Breaking Change: Remove the AttributeValueLengthLimit and AttributeCountLimit fields from RecordFactory in go.opentelemetry.io/otel/sdk/log/logtest; records produced by the factory now keep attribute limits disabled so test code can append exact attributes. (#8556)

    Fixed

    • Apply TLS certificates configured through environment variables to gRPC connections in go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc.
    • Prevent panics in go.opentelemetry.io/otel/bridge/opentracing when OpenTracing baggage is propagated concurrently with Span.SetBaggageItem.
    • Fix an off-by-one error in FixedSizeReservoir in go.opentelemetry.io/otel/sdk/metric/exemplar that prevented the first exemplar from being sampled after the reservoir was filled. (#8309)
    • Interpret HTTP Retry-After header values as seconds instead of nanoseconds when retrying OTLP HTTP exports in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp, go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8383)

    ... (truncated)

    Changelog

    Sourced from go.opentelemetry.io/otel/metric's changelog.

    [1.45.0/0.67.0/0.21.0/0.0.18] - 2026-08-03

    Added

    • Add experimental observability me... _Description has been truncated_ Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Radoslav Dimitrov --- go.mod | 16 ++++++++-------- go.sum | 36 ++++++++++++++++++------------------ 2 files changed, 26 insertions(+), 26 deletions(-) diff --git a/go.mod b/go.mod index bb46065..aba4b8e 100644 --- a/go.mod +++ b/go.mod @@ -16,12 +16,12 @@ require ( github.com/rs/cors v1.11.1 github.com/santhosh-tekuri/jsonschema/v5 v5.3.1 github.com/stretchr/testify v1.12.0 - go.opentelemetry.io/contrib/instrumentation/runtime v0.69.0 - go.opentelemetry.io/otel v1.44.0 - go.opentelemetry.io/otel/exporters/prometheus v0.66.0 - go.opentelemetry.io/otel/metric v1.44.0 - go.opentelemetry.io/otel/sdk v1.44.0 - go.opentelemetry.io/otel/sdk/metric v1.44.0 + go.opentelemetry.io/contrib/instrumentation/runtime v0.70.0 + go.opentelemetry.io/otel v1.45.0 + go.opentelemetry.io/otel/exporters/prometheus v0.67.0 + go.opentelemetry.io/otel/metric v1.45.0 + go.opentelemetry.io/otel/sdk v1.45.0 + go.opentelemetry.io/otel/sdk/metric v1.45.0 golang.org/x/mod v0.40.0 gopkg.in/yaml.v3 v3.0.1 ) @@ -43,7 +43,7 @@ require ( github.com/docker/docker-credential-helpers v0.9.3 // indirect github.com/felixge/httpsnoop v1.0.4 // indirect github.com/go-jose/go-jose/v4 v4.1.4 // indirect - github.com/go-logr/logr v1.4.3 // indirect + github.com/go-logr/logr v1.4.4 // indirect github.com/go-logr/stdr v1.2.2 // indirect github.com/google/s2a-go v0.1.9 // indirect github.com/google/uuid v1.6.0 // indirect @@ -66,7 +66,7 @@ require ( go.opentelemetry.io/auto/sdk v1.2.1 // indirect go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0 // indirect go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 // indirect - go.opentelemetry.io/otel/trace v1.44.0 // indirect + go.opentelemetry.io/otel/trace v1.45.0 // indirect golang.org/x/crypto v0.54.0 // indirect golang.org/x/net v0.57.0 // indirect golang.org/x/oauth2 v0.36.0 // indirect diff --git a/go.sum b/go.sum index 904ff2b..d906141 100644 --- a/go.sum +++ b/go.sum @@ -59,8 +59,8 @@ github.com/go-chi/chi/v5 v5.3.1/go.mod h1:R+tYY2hNuVUUjxoPtqUdgBqevM9s9njzkTLutV github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA= github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08= github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= -github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= -github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= +github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8= +github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag= github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE= github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY= @@ -139,22 +139,22 @@ go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.6 go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0/go.mod h1:NoUCKYWK+3ecatC4HjkRktREheMeEtrXoQxrqYFeHSc= go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 h1:OyrsyzuttWTSur2qN/Lm0m2a8yqyIjUVBZcxFPuXq2o= go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0/go.mod h1:C2NGBr+kAB4bk3xtMXfZ94gqFDtg/GkI7e9zqGh5Beg= -go.opentelemetry.io/contrib/instrumentation/runtime v0.69.0 h1:MtkMsuRo3zEXTTMALfyrszwCDZTkB6wolyPjbwFAdq0= -go.opentelemetry.io/contrib/instrumentation/runtime v0.69.0/go.mod h1:FYTxnpsm+UPD0erZNq20GvnM8T2YQHiHtT2vokdpoac= -go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU= -go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc= -go.opentelemetry.io/otel/exporters/prometheus v0.66.0 h1:vkrK8PAznv2NKt2r+kdu252ccGzkEqLc2aSXbQIALYQ= -go.opentelemetry.io/otel/exporters/prometheus v0.66.0/go.mod h1:V/UB6D3vMF/UBOL5igAsAYnk1nG/bzYYTzvsB16cy7o= -go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc= -go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo= -go.opentelemetry.io/otel/metric/x v0.66.0 h1:YkCrx1zLOChi9ZcZ6euupOcsgzbVlec7D/xoEU1+cTA= -go.opentelemetry.io/otel/metric/x v0.66.0/go.mod h1:d1+BDj9t96do0/1LoU1ayfCv79ZgNE41qbhBvnMOBZk= -go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58= -go.opentelemetry.io/otel/sdk v1.44.0/go.mod h1:Osuydd3Se74nqjAKxid74N5eC+jfEqfTegHRnq58oK0= -go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI= -go.opentelemetry.io/otel/sdk/metric v1.44.0/go.mod h1:5B5pMARnXxKhltooO4xUuCBorl65a4EpnTalObqOigA= -go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk= -go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE= +go.opentelemetry.io/contrib/instrumentation/runtime v0.70.0 h1:1+WLVYezXA9tkuVzKQri8zgB1cEIVYKUSoYIRjsBiMU= +go.opentelemetry.io/contrib/instrumentation/runtime v0.70.0/go.mod h1:rbAXUUXqQDMxpSnmof4VtcZ+7YpZQEtjXSCIfdvR0Go= +go.opentelemetry.io/otel v1.45.0 h1:pdrWmLHofpubmArBv1LgFSv1Z0Ie/ppdZzu+kUN5EeU= +go.opentelemetry.io/otel v1.45.0/go.mod h1:XZxIqPapzEYnhNSScF5DIqXhm/rYi0FzCe2XddAwZfQ= +go.opentelemetry.io/otel/exporters/prometheus v0.67.0 h1:7IefDa35e6V3NoiqIeLDMDxMFyZDk5qcoC0Ax4cC16E= +go.opentelemetry.io/otel/exporters/prometheus v0.67.0/go.mod h1:nsPI1awTg5Vmg1YrommL2mVarVGlqc4yXOoKAkPRD0c= +go.opentelemetry.io/otel/metric v1.45.0 h1:7Eg1uH7CJ5cXv9is6tnBe1FI6rj1nwUdbFypRm3br/M= +go.opentelemetry.io/otel/metric v1.45.0/go.mod h1:HAPbm1nd3p1PmFH7v2dR+6BjXxw+Lq4a2+pndMAm08s= +go.opentelemetry.io/otel/metric/x v0.67.0 h1:PcicCNZFkZ4bXfSooXdo3WN7RBOVOtjVdo1wD358Uns= +go.opentelemetry.io/otel/metric/x v0.67.0/go.mod h1:FBjCWZe6wgcqxcMtjdGiClDKXb2YxxXii0CXftE4QtI= +go.opentelemetry.io/otel/sdk v1.45.0 h1:4VVSMgQ83dUgW2aoX5f6JgLvHwIvzcuLnF9lUdCSpCw= +go.opentelemetry.io/otel/sdk v1.45.0/go.mod h1:Sr40LgXV7DsKMMJMKOhUWOgMWTfAaqvm2kF0g7ilwuA= +go.opentelemetry.io/otel/sdk/metric v1.45.0 h1:oVFszMfyj1Am6s24Vtc7wBb8BKLcwepJjNEYILuiE3o= +go.opentelemetry.io/otel/sdk/metric v1.45.0/go.mod h1:vUWUxDZvu1WVRj8JA8S0AdhsPrZoDpA2DdZauIh4mDA= +go.opentelemetry.io/otel/trace v1.45.0 h1:l/mP6Uv7oNO7/TblbhpbgMidxhq1uO/rPsikOyVhxag= +go.opentelemetry.io/otel/trace v1.45.0/go.mod h1:qoJJA2xNMnxRrdISU/kLtfUH2wNeQbiv+jhs/CxI8bc= go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE= go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ= From 71f3a1b62e3819774ae0ba7b267a7a1fd6c32d20 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 5 Sep 2026 20:30:25 +0300 Subject: [PATCH 294/313] build(deps): bump anchore/sbom-action from 0.24.0 to 0.24.2 in the actions group (#1610) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps the actions group with 1 update: [anchore/sbom-action](https://github.com/anchore/sbom-action). Updates `anchore/sbom-action` from 0.24.0 to 0.24.2
      Release notes

      Sourced from anchore/sbom-action's releases.

      v0.24.2

      Added Features

      Additional Changes

      (Full Changelog)

      Commits
      • 3ad7283 ops: update write permissions for release (#723)
      • 31f5287 chore(deps-dev): bump eslint from 10.8.1 to 10.9.0 (#724)
      • aa80c8c chore(deps): update Syft to latest release (#722)
      • 74b54e9 chore(deps): bump lodash from 4.17.23 to 4.18.1 (#623)
      • 6b92ff5 chore(deps-dev): bump tsx from 4.23.11 to 4.23.12 (#721)
      • 4f8983b chore(deps-dev): bump typescript-eslint from 8.65.0 to 8.67.0 (#719)
      • 10f27f4 chore(deps-dev): bump eslint from 10.5.0 to 10.8.1 (#720)
      • 249403a chore(deps-dev): bump @​types/node from 26.1.0 to 26.2.0 (#718)
      • cbf8daa chore(deps): bump anchore/workflows/.github/workflows/check-gate.yaml (#693)
      • 6afc793 fix: pin syft install.sh to the release tag being installed (#716)
      • Additional commits viewable in compare view

      [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=anchore/sbom-action&package-manager=github_actions&previous-version=0.24.0&new-version=0.24.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
      Dependabot commands and options
      You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
      Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 4405b31..8285c08 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -28,7 +28,7 @@ jobs: uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 - name: Install Syft - uses: anchore/sbom-action/download-syft@v0.24.0 + uses: anchore/sbom-action/download-syft@v0.24.2 - name: Run GoReleaser uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 From da98ceced30a32172a968406286ca8689fdbf0cf Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 5 Sep 2026 20:52:50 +0300 Subject: [PATCH 295/313] build(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.1 in /deploy (#1617) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.82.1 to 1.83.1.
      Release notes

      Sourced from google.golang.org/grpc's releases.

      Release 1.83.1

      Security

      • xds/rbac: Fix a bug where nested Principal or Permission rules with :scheme or grpc- prefixed header matchers were not rejected, which could cause DENY rules to fail open. (#9258)
      • xds/rbac: Fix a bug where the host header matcher was not being replaced with :authority in nested Principal or Permission rules. (#9258)
      • xds/rbac: Fix a bug where a header matcher whose name was not lowercase, such as X-Role, matched no header, which could cause DENY rules to fail open. (#9332)
      • xds/rbac: Fix a bug where a :scheme or grpc- prefixed header matcher was accepted when its name was not lowercase. (#9332)
      • xds/rbac: Fix a bug where a Host header matcher was not replaced with :authority. (#9332)

      Performance

      • transport: Restrict memory overhead of buffering small data frames. (#9331)

      Release 1.83.0

      Security

      • server: Stop reading from connections when flooded by HTTP/2 frames to mitigate resource exhaustion. The default value for this limit is 100 frames, excluding DATA and HEADERS, and may be changed by setting environment variable GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT.
      • xds/rbac: Support Metadata and RequestedServerName permissions matcher fields. If present in a DENY rule, previously these would be ignored and fail-open.
      • xds/rbac: Fix panic when parsing unsupported fields in NotRule/NotId permissions.
      • xds/rbac: Support the deprecated source_ip principal identifier by treating it as equivalent to direct_remote_ip.
      • xds: Fix panic when parsing route header matchers configured with empty exact_match, prefix_match, or suffix_match strings. (#9223)

      New Features

      • xds/googlec2p: Enable DirectPath over Interconnect support for on-premises clients via the force-xds target URI query parameter. (#9133)
      • xds: Enable xDS configuration to control which fields get propagated from ORCA backend metric reports to LRS load reports. (#9145)
      • authz: Add OnPolicyUpdate callback to FileWatcherOptions to notify when an authz policy is loaded or updated. (#9142)
      • xds: Add support for the GCP Authentication HTTP Filter, which automatically fetches and attaches GCP Service Account Identity JWT tokens to outgoing RPCs.
        • This feature can be enabled by setting environment variable GRPC_EXPERIMENTAL_XDS_GCP_AUTHENTICATION_FILTER=true. (#9119)
      • xds: Add support for xDS-based HTTP CONNECT proxies.
        • This feature can be enabled by setting environment variable GRPC_EXPERIMENTAL_XDS_HTTP_CONNECT=true. (#9151)
      • xds: Add support for contains_match in route header matchers. (#9223)

      Bug Fixes

      • credentials/alts: Fix panic when processing malformed frames by validating that the message frame length exceeds the message type field size. (#9197)
      • grpc: Fix compilation on Plan 9 targets (GOOS=plan9), broken since v1.81.0. (#9255)

      Release 1.82.2

      Security

      • server: Reject requests missing both :authority and Host headers with HTTP 400 and status Internal. (grpc/grpc-go#9365)

      ... (truncated)

      Commits

      [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google.golang.org/grpc&package-manager=go_modules&previous-version=1.82.1&new-version=1.83.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
      Dependabot commands and options
      You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/modelcontextprotocol/registry/network/alerts).
      Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- deploy/go.mod | 2 +- deploy/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index 48df63a..ae44ac5 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -109,7 +109,7 @@ require ( golang.org/x/tools v0.47.0 // indirect google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect - google.golang.org/grpc v1.82.1 // indirect + google.golang.org/grpc v1.83.1 // indirect google.golang.org/protobuf v1.36.11 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect lukechampine.com/frand v1.5.1 // indirect diff --git a/deploy/go.sum b/deploy/go.sum index 3a1ce8f..cd58b14 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -317,8 +317,8 @@ google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa h1: google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa/go.mod h1:q4lMZS6kskjT5HvCPrnnypcDPVJqT/f4nfxmkE7gryY= google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa h1:mZHHdPZl0dbGHCflZgAq/Q468DWVFcU2whhB2KAo8fk= google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= -google.golang.org/grpc v1.82.1 h1:NnAxzGRA0677vCa4BUkOAnO5+FfQqVl9iUXeD0IqcGE= -google.golang.org/grpc v1.82.1/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA= +google.golang.org/grpc v1.83.1 h1:HIO0+BEtBP6soyqvqC8sNUjZ7bTs+0hFQuFF+RAy++Y= +google.golang.org/grpc v1.83.1/go.mod h1:kDyl6SKsiHKt0uylY5gtn5cEjkrIOhQOGDgIc4JGwzQ= google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE= google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= From 57b19e27d220d2d426bd609d45abd1a5ebe03756 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 5 Sep 2026 21:03:44 +0300 Subject: [PATCH 296/313] build(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.1 (#1616) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.82.1 to 1.83.1.
      Release notes

      Sourced from google.golang.org/grpc's releases.

      Release 1.83.1

      Security

      • xds/rbac: Fix a bug where nested Principal or Permission rules with :scheme or grpc- prefixed header matchers were not rejected, which could cause DENY rules to fail open. (#9258)
      • xds/rbac: Fix a bug where the host header matcher was not being replaced with :authority in nested Principal or Permission rules. (#9258)
      • xds/rbac: Fix a bug where a header matcher whose name was not lowercase, such as X-Role, matched no header, which could cause DENY rules to fail open. (#9332)
      • xds/rbac: Fix a bug where a :scheme or grpc- prefixed header matcher was accepted when its name was not lowercase. (#9332)
      • xds/rbac: Fix a bug where a Host header matcher was not replaced with :authority. (#9332)

      Performance

      • transport: Restrict memory overhead of buffering small data frames. (#9331)

      Release 1.83.0

      Security

      • server: Stop reading from connections when flooded by HTTP/2 frames to mitigate resource exhaustion. The default value for this limit is 100 frames, excluding DATA and HEADERS, and may be changed by setting environment variable GRPC_GO_EXPERIMENTAL_CONTROL_BUFFER_THROTTLE_LIMIT.
      • xds/rbac: Support Metadata and RequestedServerName permissions matcher fields. If present in a DENY rule, previously these would be ignored and fail-open.
      • xds/rbac: Fix panic when parsing unsupported fields in NotRule/NotId permissions.
      • xds/rbac: Support the deprecated source_ip principal identifier by treating it as equivalent to direct_remote_ip.
      • xds: Fix panic when parsing route header matchers configured with empty exact_match, prefix_match, or suffix_match strings. (#9223)

      New Features

      • xds/googlec2p: Enable DirectPath over Interconnect support for on-premises clients via the force-xds target URI query parameter. (#9133)
      • xds: Enable xDS configuration to control which fields get propagated from ORCA backend metric reports to LRS load reports. (#9145)
      • authz: Add OnPolicyUpdate callback to FileWatcherOptions to notify when an authz policy is loaded or updated. (#9142)
      • xds: Add support for the GCP Authentication HTTP Filter, which automatically fetches and attaches GCP Service Account Identity JWT tokens to outgoing RPCs.
        • This feature can be enabled by setting environment variable GRPC_EXPERIMENTAL_XDS_GCP_AUTHENTICATION_FILTER=true. (#9119)
      • xds: Add support for xDS-based HTTP CONNECT proxies.
        • This feature can be enabled by setting environment variable GRPC_EXPERIMENTAL_XDS_HTTP_CONNECT=true. (#9151)
      • xds: Add support for contains_match in route header matchers. (#9223)

      Bug Fixes

      • credentials/alts: Fix panic when processing malformed frames by validating that the message frame length exceeds the message type field size. (#9197)
      • grpc: Fix compilation on Plan 9 targets (GOOS=plan9), broken since v1.81.0. (#9255)

      Release 1.82.2

      Security

      • server: Reject requests missing both :authority and Host headers with HTTP 400 and status Internal. (grpc/grpc-go#9365)

      ... (truncated)

      Commits

      [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google.golang.org/grpc&package-manager=go_modules&previous-version=1.82.1&new-version=1.83.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
      Dependabot commands and options
      You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/modelcontextprotocol/registry/network/alerts).
      Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Radoslav Dimitrov --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index aba4b8e..daeff49 100644 --- a/go.mod +++ b/go.mod @@ -78,7 +78,7 @@ require ( google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 // indirect google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7 // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20260630182238-925bb5da69e7 // indirect - google.golang.org/grpc v1.82.1 // indirect + google.golang.org/grpc v1.83.1 // indirect google.golang.org/protobuf v1.36.11 // indirect gotest.tools/v3 v3.5.2 // indirect ) diff --git a/go.sum b/go.sum index d906141..029e79d 100644 --- a/go.sum +++ b/go.sum @@ -186,8 +186,8 @@ google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7 h1: google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7/go.mod h1:KqHwBx2upmfa1XSi1WuRvC+2VGCLtooKkfmyvRbUmqA= google.golang.org/genproto/googleapis/rpc v0.0.0-20260630182238-925bb5da69e7 h1:eM/YSd5bBFagF51o1E745Ta7RwzpW0h+z+QDNZOgmQ8= google.golang.org/genproto/googleapis/rpc v0.0.0-20260630182238-925bb5da69e7/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= -google.golang.org/grpc v1.82.1 h1:NnAxzGRA0677vCa4BUkOAnO5+FfQqVl9iUXeD0IqcGE= -google.golang.org/grpc v1.82.1/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA= +google.golang.org/grpc v1.83.1 h1:HIO0+BEtBP6soyqvqC8sNUjZ7bTs+0hFQuFF+RAy++Y= +google.golang.org/grpc v1.83.1/go.mod h1:kDyl6SKsiHKt0uylY5gtn5cEjkrIOhQOGDgIc4JGwzQ= google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE= google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= From 00d5aaad7905648e493ed9b86bf7074d4561d947 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 5 Sep 2026 21:13:09 +0300 Subject: [PATCH 297/313] build(deps): bump github.com/pulumi/pulumi-kubernetes/sdk/v4 from 4.33.0 to 4.34.0 in /deploy (#1609) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [github.com/pulumi/pulumi-kubernetes/sdk/v4](https://github.com/pulumi/pulumi-kubernetes) from 4.33.0 to 4.34.0.
      Release notes

      Sourced from github.com/pulumi/pulumi-kubernetes/sdk/v4's releases.

      v4.34.0

      What's Changed

      New Contributors

      Full Changelog: https://github.com/pulumi/pulumi-kubernetes/compare/v4.33.0...v4.34.0

      Changelog

      Sourced from github.com/pulumi/pulumi-kubernetes/sdk/v4's changelog.

      4.34.0 (August 27, 2026)

      Added

      • Support adding CustomResourceDefinitions as an extension of the base kubernetes provider via pulumi package add <provider> --extension. Extension-served resources alias their kubernetes:-namespaced token, so state written by a crd2pulumi-generated SDK is adopted rather than replaced.

      Changed

      • Upgrade Kubernetes schema and libraries to v1.36.3.
      • Upgrade Kubernetes schema and libraries to v1.36.4.
      • Upgrade Kubernetes schema and libraries to v1.37.0. See the Kubernetes 1.37 release notes for upstream API changes.

      Fixed

      • Restore scheduling.k8s.io/v1alpha1 Workload, which the Kubernetes 1.36 upgrade dropped from the SDKs, and retain scheduling.k8s.io/v1alpha2 PodGroup and Workload, which Kubernetes 1.37 removes from its OpenAPI specification. Both remain available to clusters that still serve them, and scheduling.k8s.io/v1beta1 now aliases the older versions so that existing resources migrate in place rather than being replaced.

      • #4524 Fix pulumi.com/waitFor rejecting JSONPath filters that use !=, >= or <=. The expression was split on every = that was not part of ==, so jsonpath={.status.conditions[?(@.type!="Failed")].status}=True failed to parse. The path and value are now separated structurally, which also allows braces inside string literals. Comparing one path against another (jsonpath={.status.readyReplicas}={.spec.replicas}) is still unsupported, but now reports an error instead of silently never matching.

      Commits

      Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Radoslav Dimitrov --- deploy/go.mod | 64 +++++++++++--------- deploy/go.sum | 165 +++++++++++++++++++++++++------------------------- 2 files changed, 116 insertions(+), 113 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index ae44ac5..8f054ab 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -4,8 +4,8 @@ go 1.26 require ( github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 - github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.33.0 - github.com/pulumi/pulumi/sdk/v3 v3.257.0 + github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.34.0 + github.com/pulumi/pulumi/sdk/v3 v3.259.0 gopkg.in/yaml.v2 v2.4.0 ) @@ -23,25 +23,28 @@ require ( github.com/charmbracelet/bubbletea v1.3.10 // indirect github.com/charmbracelet/colorprofile v0.4.3 // indirect github.com/charmbracelet/lipgloss v1.1.0 // indirect - github.com/charmbracelet/x/ansi v0.11.7 // indirect + github.com/charmbracelet/x/ansi v0.11.8 // indirect github.com/charmbracelet/x/cellbuf v0.0.15 // indirect github.com/charmbracelet/x/term v0.2.2 // indirect - github.com/cheggaaa/pb v1.0.29 // indirect github.com/clipperhouse/displaywidth v0.11.0 // indirect github.com/clipperhouse/uax29/v2 v2.7.0 // indirect github.com/cloudflare/circl v1.6.3 // indirect + github.com/danieljoos/wincred v1.2.3 // indirect github.com/djherbis/times v1.5.0 // indirect + github.com/ebitengine/purego v0.10.2 // indirect github.com/emirpasic/gods v1.18.1 // indirect github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect github.com/go-git/gcfg/v2 v2.0.2 // indirect github.com/go-git/go-billy/v6 v6.0.0-alpha.2 // indirect github.com/go-git/go-git/v6 v6.0.0-alpha.5 // indirect - github.com/go-logr/logr v1.4.3 // indirect + github.com/go-logr/logr v1.4.4 // indirect github.com/go-logr/stdr v1.2.2 // indirect + github.com/godbus/dbus/v5 v5.2.2 // indirect github.com/gogo/protobuf v1.3.2 // indirect github.com/golang/glog v1.2.5 // indirect + github.com/google/go-tpm v0.9.8 // indirect github.com/google/uuid v1.6.0 // indirect - github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 // indirect + github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0 // indirect github.com/grpc-ecosystem/grpc-opentracing v0.0.0-20180507213350-8e809c8a8645 // indirect github.com/hashicorp/errwrap v1.1.0 // indirect github.com/hashicorp/go-multierror v1.1.1 // indirect @@ -52,10 +55,10 @@ require ( github.com/kevinburke/ssh_config v1.6.0 // indirect github.com/klauspost/compress v1.18.7 // indirect github.com/klauspost/cpuid/v2 v2.3.0 // indirect - github.com/lucasb-eyer/go-colorful v1.4.0 // indirect - github.com/mattn/go-isatty v0.0.22 // indirect + github.com/lucasb-eyer/go-colorful v1.4.1 // indirect + github.com/mattn/go-isatty v0.0.24 // indirect github.com/mattn/go-localereader v0.0.1 // indirect - github.com/mattn/go-runewidth v0.0.24 // indirect + github.com/mattn/go-runewidth v0.0.28 // indirect github.com/mitchellh/go-ps v1.0.0 // indirect github.com/mitchellh/go-wordwrap v1.0.1 // indirect github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect @@ -81,36 +84,37 @@ require ( github.com/texttheater/golang-levenshtein v1.0.1 // indirect github.com/uber/jaeger-client-go v2.30.0+incompatible // indirect github.com/uber/jaeger-lib v2.4.1+incompatible // indirect - github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect + github.com/xo/terminfo v1.0.0 // indirect + github.com/zalando/go-keyring v0.2.8 // indirect github.com/zclconf/go-cty v1.16.3 // indirect go.opentelemetry.io/auto/sdk v1.2.1 // indirect - go.opentelemetry.io/collector/featuregate v1.59.0 // indirect - go.opentelemetry.io/collector/pdata v1.59.0 // indirect - go.opentelemetry.io/contrib/bridges/otelslog v0.18.0 // indirect - go.opentelemetry.io/otel v1.44.0 // indirect - go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.19.0 // indirect - go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.44.0 // indirect - go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.44.0 // indirect - go.opentelemetry.io/otel/log v0.19.0 // indirect - go.opentelemetry.io/otel/metric v1.44.0 // indirect - go.opentelemetry.io/otel/sdk v1.44.0 // indirect - go.opentelemetry.io/otel/sdk/log v0.19.0 // indirect - go.opentelemetry.io/otel/trace v1.44.0 // indirect - go.opentelemetry.io/proto/otlp v1.10.0 // indirect + go.opentelemetry.io/collector/featuregate v1.65.0 // indirect + go.opentelemetry.io/collector/pdata v1.65.0 // indirect + go.opentelemetry.io/contrib/bridges/otelslog v0.20.0 // indirect + go.opentelemetry.io/otel v1.45.0 // indirect + go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.21.0 // indirect + go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.45.0 // indirect + go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.45.0 // indirect + go.opentelemetry.io/otel/log v0.21.0 // indirect + go.opentelemetry.io/otel/metric v1.45.0 // indirect + go.opentelemetry.io/otel/sdk v1.45.0 // indirect + go.opentelemetry.io/otel/sdk/log v0.21.0 // indirect + go.opentelemetry.io/otel/trace v1.45.0 // indirect + go.opentelemetry.io/proto/otlp v1.11.0 // indirect go.uber.org/atomic v1.11.0 // indirect go.uber.org/multierr v1.11.0 // indirect - golang.org/x/crypto v0.54.0 // indirect + golang.org/x/crypto v0.55.0 // indirect golang.org/x/mod v0.38.0 // indirect - golang.org/x/net v0.57.0 // indirect + golang.org/x/net v0.58.0 // indirect golang.org/x/sync v0.22.0 // indirect golang.org/x/sys v0.47.0 // indirect golang.org/x/term v0.45.0 // indirect - golang.org/x/text v0.40.0 // indirect - golang.org/x/tools v0.47.0 // indirect - google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa // indirect - google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect + golang.org/x/text v0.41.0 // indirect + golang.org/x/tools v0.48.0 // indirect + google.golang.org/genproto/googleapis/api v0.0.0-20260819154853-08b0e4226688 // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688 // indirect google.golang.org/grpc v1.83.1 // indirect - google.golang.org/protobuf v1.36.11 // indirect + google.golang.org/protobuf v1.36.12 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect lukechampine.com/frand v1.5.1 // indirect ) diff --git a/deploy/go.sum b/deploy/go.sum index cd58b14..3e7be55 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -30,14 +30,12 @@ github.com/charmbracelet/colorprofile v0.4.3 h1:QPa1IWkYI+AOB+fE+mg/5/4HRMZcaXex github.com/charmbracelet/colorprofile v0.4.3/go.mod h1:/zT4BhpD5aGFpqQQqw7a+VtHCzu+zrQtt1zhMt9mR4Q= github.com/charmbracelet/lipgloss v1.1.0 h1:vYXsiLHVkK7fp74RkV7b2kq9+zDLoEU4MZoFqR/noCY= github.com/charmbracelet/lipgloss v1.1.0/go.mod h1:/6Q8FR2o+kj8rz4Dq0zQc3vYf7X+B0binUUBwA0aL30= -github.com/charmbracelet/x/ansi v0.11.7 h1:kzv1kJvjg2S3r9KHo8hDdHFQLEqn4RBCb39dAYC84jI= -github.com/charmbracelet/x/ansi v0.11.7/go.mod h1:9qGpnAVYz+8ACONkZBUWPtL7lulP9No6p1epAihUZwQ= +github.com/charmbracelet/x/ansi v0.11.8 h1:JMFwp0CgDC2+jcOB162HH5k7I3FVbgFSMMYg7dSPBQQ= +github.com/charmbracelet/x/ansi v0.11.8/go.mod h1:ZNN+3mXny/516oTQPLMPIBeSINvNJJQ8uQXDgbeJxY0= github.com/charmbracelet/x/cellbuf v0.0.15 h1:ur3pZy0o6z/R7EylET877CBxaiE1Sp1GMxoFPAIztPI= github.com/charmbracelet/x/cellbuf v0.0.15/go.mod h1:J1YVbR7MUuEGIFPCaaZ96KDl5NoS0DAWkskup+mOY+Q= github.com/charmbracelet/x/term v0.2.2 h1:xVRT/S2ZcKdhhOuSP4t5cLi5o+JxklsoEObBSgfgZRk= github.com/charmbracelet/x/term v0.2.2/go.mod h1:kF8CY5RddLWrsgVwpw4kAa6TESp6EB5y3uxGLeCqzAI= -github.com/cheggaaa/pb v1.0.29 h1:FckUN5ngEk2LpvuG0fw1GEFx6LtyY2pWI/Z2QgCnEYo= -github.com/cheggaaa/pb v1.0.29/go.mod h1:W40334L7FMC5JKWldsTWbdGjLo0RxUKK73K+TuPxX30= github.com/clipperhouse/displaywidth v0.11.0 h1:lBc6kY44VFw+TDx4I8opi/EtL9m20WSEFgwIwO+UVM8= github.com/clipperhouse/displaywidth v0.11.0/go.mod h1:bkrFNkf81G8HyVqmKGxsPufD3JhNl3dSqnGhOoSD/o0= github.com/clipperhouse/uax29/v2 v2.7.0 h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJv2v7Vk= @@ -45,19 +43,20 @@ github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJ github.com/cloudflare/circl v1.6.3 h1:9GPOhQGF9MCYUeXyMYlqTR6a5gTrgR/fBLXvUgtVcg8= github.com/cloudflare/circl v1.6.3/go.mod h1:2eXP6Qfat4O/Yhh8BznvKnJ+uzEoTQ6jVKJRn81BiS4= github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g= +github.com/danieljoos/wincred v1.2.3 h1:v7dZC2x32Ut3nEfRH+vhoZGvN72+dQ/snVXo/vMFLdQ= +github.com/danieljoos/wincred v1.2.3/go.mod h1:6qqX0WNrS4RzPZ1tnroDzq9kY3fu1KwE7MRLQK4X0bs= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM= github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/djherbis/times v1.5.0 h1:79myA211VwPhFTqUk8xehWrsEO+zcIZj0zT8mXPVARU= github.com/djherbis/times v1.5.0/go.mod h1:5q7FDLvbNg1L/KaBmPcWlVR9NmoKo3+ucqUA3ijQhA0= +github.com/ebitengine/purego v0.10.2 h1:W809HbnvzAxgdm+aOvlSekrM16wGCdT/e76+9tS7gzE= +github.com/ebitengine/purego v0.10.2/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ= github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc= github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FMNAnJvWQ= github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f h1:Y/CXytFA4m6baUTXGLOoWe4PQhGxaX0KpnayAqC48p4= github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f/go.mod h1:vw97MGsxSvLiUE2X8qFplwetxpGLQrlU1Q9AUEIzCaM= -github.com/fatih/color v1.9.0/go.mod h1:eQcE1qtQxscV5RaZvpXrrb8Drkc3/DdQ+uUYCNjL+zU= -github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM= -github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU= github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c= github.com/gliderlabs/ssh v0.3.8/go.mod h1:xYoytBv1sV0aL3CavoDuJIQNURXkkfPA/wxQ1pL1fAU= github.com/go-git/gcfg/v2 v2.0.2 h1:MY5SIIfTGGEMhdA7d7JePuVVxtKL7Hp+ApGDJAJ7dpo= @@ -69,10 +68,12 @@ github.com/go-git/go-git-fixtures/v6 v6.0.0-alpha.1/go.mod h1:ECf1MqJlBdYpKggBrO github.com/go-git/go-git/v6 v6.0.0-alpha.5 h1:sE+OlkHgYWNMVmN1s9sR7uyFgsWLtxcNWse/vBYKxRE= github.com/go-git/go-git/v6 v6.0.0-alpha.5/go.mod h1:3IjhiZnM+uBmUrOGSeqrJpsmi4Vd0H2NZO/uK2a7d0s= github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A= -github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= -github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= +github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8= +github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag= github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE= +github.com/godbus/dbus/v5 v5.2.2 h1:TUR3TgtSVDmjiXOgAAyaZbYmIeP3DPkld3jgKGV8mXQ= +github.com/godbus/dbus/v5 v5.2.2/go.mod h1:3AAv2+hPq5rdnr5txxxRwiGjPXamgoIHgz9FPBfOp3c= github.com/gogo/protobuf v1.3.1/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o= github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q= github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q= @@ -82,11 +83,15 @@ github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps= github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= +github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo= +github.com/google/go-tpm v0.9.8/go.mod h1:h9jEsEECg7gtLis0upRBQU+GhYVH6jMjrFxI8u6bVUY= +github.com/google/go-tpm-tools v0.3.13-0.20230620182252-4639ecce2aba h1:qJEJcuLzH5KDR0gKc0zcktin6KSAwL7+jWKBYceddTc= +github.com/google/go-tpm-tools v0.3.13-0.20230620182252-4639ecce2aba/go.mod h1:EFYHy8/1y2KfgTAsx7Luu7NGhoxtuVHnNo8jE7FikKc= github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= -github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 h1:5VipnvEpbqr2gA2VbM+nYVbkIF28c5ZQfqCBQ5g2xfk= -github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0/go.mod h1:Hyl3n6Twe1hvtd9XUXDec4pTvgMSEixRuQKPTMH2bNs= +github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0 h1:/Tnpcb2E0Pz/tN9s3bfEY2Q8ePCEX9iuS+cneUwncnw= +github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0/go.mod h1:zOBXOsUaBSjKgmH4OGzV1esUpR3oUSCPYVd2cUBjKYY= github.com/grpc-ecosystem/grpc-opentracing v0.0.0-20180507213350-8e809c8a8645 h1:MJG/KsmcqMwFAkh8mTnAwhyKoB+sTAnY4CACC110tbU= github.com/grpc-ecosystem/grpc-opentracing v0.0.0-20180507213350-8e809c8a8645/go.mod h1:6iZfnjpejD4L/4DwD7NryNaJyCQdzwWwH2MWhCA90Kw= github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4= @@ -118,20 +123,14 @@ github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ= github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE= -github.com/lucasb-eyer/go-colorful v1.4.0 h1:UtrWVfLdarDgc44HcS7pYloGHJUjHV/4FwW4TvVgFr4= -github.com/lucasb-eyer/go-colorful v1.4.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0= -github.com/mattn/go-colorable v0.1.4/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE= -github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE= -github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8= -github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s= -github.com/mattn/go-isatty v0.0.11/go.mod h1:PhnuNfih5lzO57/f3n+odYbM4JtupLOxQOAqxQCu2WE= -github.com/mattn/go-isatty v0.0.22 h1:j8l17JJ9i6VGPUFUYoTUKPSgKe/83EYU2zBC7YNKMw4= -github.com/mattn/go-isatty v0.0.22/go.mod h1:ZXfXG4SQHsB/w3ZeOYbR0PrPwLy+n6xiMrJlRFqopa4= +github.com/lucasb-eyer/go-colorful v1.4.1 h1:1EO+WB73+EH8EVbzlrG3KLAfEypQWVHIBqlTf+2hNss= +github.com/lucasb-eyer/go-colorful v1.4.1/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0= +github.com/mattn/go-isatty v0.0.24 h1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI= +github.com/mattn/go-isatty v0.0.24/go.mod h1:nMCL3Zebbrt45jsMDgnfIwz6ydEQApk5oEI3HqDio6A= github.com/mattn/go-localereader v0.0.1 h1:ygSAOl7ZXTx4RdPYinUpg6W99U8jWvWi9Ye2JC/oIi4= github.com/mattn/go-localereader v0.0.1/go.mod h1:8fBrzywKY7BI3czFoHkuzRoWE9C+EiG4R1k4Cjx5p88= -github.com/mattn/go-runewidth v0.0.4/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU= -github.com/mattn/go-runewidth v0.0.24 h1:cpokDiIn0MGnhdHwuWnJBITySJ20QyNGnY2kR/ay2DU= -github.com/mattn/go-runewidth v0.0.24/go.mod h1:XBkDxAl56ILZc9knddidhrOlY5R/pDhgLpndooCuJAs= +github.com/mattn/go-runewidth v0.0.28 h1:rPyg2ybwEKPebvpzVWe1gKBkH8EQFkxO4Y0hjBeLaBU= +github.com/mattn/go-runewidth v0.0.28/go.mod h1:3qAiGCV4Koz/yuveO58qUefmUTRm8r0IGEXZ9jeHp/8= github.com/mitchellh/go-ps v1.0.0 h1:i6ampVEEF4wQFF+bkYfwYgY+F/uYJDktmvLPf7qIgjc= github.com/mitchellh/go-ps v1.0.0/go.mod h1:J4lOc8z8yJs6vUwklHw2XEIiT4z4C40KtWVN3nvg8Pg= github.com/mitchellh/go-wordwrap v1.0.1 h1:TLuKupo69TCn6TQSyGxwI1EblZZEsQ0vMlAFQflz0v0= @@ -170,10 +169,10 @@ github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231 h1:vkHw5I/plNdTr435 github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231/go.mod h1:murToZ2N9hNJzewjHBgfFdXhZKjY3z5cYC1VXk+lbFE= github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 h1:w6OnO3d4j5yVf2vpm8OzXFC/xHOEGqt+9FjWCUBCq6U= github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1/go.mod h1:UyZyv7hz4knpFx6/Sh+SkZe6hT6sJHtDvw9A0TbvEsk= -github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.33.0 h1:fFP72Q6/GfyI7BII3hUS7vn45Eg16zKIIS3I3R9bNEY= -github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.33.0/go.mod h1:sIZVlvi6oFQMEgTa+XkYfr/sAXRfrprPo3Ja6UYpGEU= -github.com/pulumi/pulumi/sdk/v3 v3.257.0 h1:75TpjUHz7rA8azrEOpTAD1Ox2f6Aj1pkxwzq+ufKQXM= -github.com/pulumi/pulumi/sdk/v3 v3.257.0/go.mod h1:pyYSaOHxk1R0bYiSzpcbYzeN3MBtlyckup9tvImBjjo= +github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.34.0 h1:r00p17ecoDVWqBg38/Is/9jU/JsWLPxnWzhfYqKitx0= +github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.34.0/go.mod h1:/klrd3ib4AMRlFMjrxkv5r76x3Bdr68wIMEKfRkRzHU= +github.com/pulumi/pulumi/sdk/v3 v3.259.0 h1:mJP9tXF9oxcfwidBgteXkUUchIz2L59SbGS5byZBo1w= +github.com/pulumi/pulumi/sdk/v3 v3.259.0/go.mod h1:DPK83ZiPYy55hY0MoaFAbl95Yee/dCGc6cQAqI7/ctw= github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ= github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88= github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ= @@ -205,52 +204,54 @@ github.com/uber/jaeger-client-go v2.30.0+incompatible h1:D6wyKGCecFaSRUpo8lCVbaO github.com/uber/jaeger-client-go v2.30.0+incompatible/go.mod h1:WVhlPFC8FDjOFMMWRy2pZqQJSXxYSwNYOkTr/Z6d3Kk= github.com/uber/jaeger-lib v2.4.1+incompatible h1:td4jdvLcExb4cBISKIpHuGoVXh+dVKhn2Um6rjCsSsg= github.com/uber/jaeger-lib v2.4.1+incompatible/go.mod h1:ComeNDZlWwrWnDv8aPp0Ba6+uUTzImX/AauajbLI56U= -github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e h1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no= -github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM= +github.com/xo/terminfo v1.0.0 h1:2ZpYzqWzyyytjk3TP6aJVDhkMAkc99/1xKQdA3TDTBY= +github.com/xo/terminfo v1.0.0/go.mod h1:RbqR21r5mrJuqunuUZ/Dhy/avygyECGrLceyNeo4LiM= github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= +github.com/zalando/go-keyring v0.2.8 h1:6sD/Ucpl7jNq10rM2pgqTs0sZ9V3qMrqfIIy5YPccHs= +github.com/zalando/go-keyring v0.2.8/go.mod h1:tsMo+VpRq5NGyKfxoBVjCuMrG47yj8cmakZDO5QGii0= github.com/zclconf/go-cty v1.16.3 h1:osr++gw2T61A8KVYHoQiFbFd1Lh3JOCXc/jFLJXKTxk= github.com/zclconf/go-cty v1.16.3/go.mod h1:VvMs5i0vgZdhYawQNq5kePSpLAoz8u1xvZgrPIxfnZE= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y= -go.opentelemetry.io/collector/featuregate v1.59.0 h1:pu70/9eWRjAjzGnr3VmqwY+k6fmU3esLp15AqxfBBz0= -go.opentelemetry.io/collector/featuregate v1.59.0/go.mod h1:4ga1QBMPEejXXmpyJS8lmaRpknJ3Lb9Bvk6e420bUFU= -go.opentelemetry.io/collector/internal/testutil v0.153.0 h1:GJEaPLohao+7wtm08yGf73RGi1rpIHvqzxOb7Xn8sP0= -go.opentelemetry.io/collector/internal/testutil v0.153.0/go.mod h1:Jkjs6rkqs973LqgZ0Fe3zrokQRKULYXPIf4HuqStiEE= -go.opentelemetry.io/collector/pdata v1.59.0 h1:lO1IcaO9+HUVdFh+RATCUG3oTP+uCZzsE7HJ0MjmzRc= -go.opentelemetry.io/collector/pdata v1.59.0/go.mod h1:AH6M14C6qhesnUpcvigkvFMiX9KtdSWQENMBNyNhe7I= -go.opentelemetry.io/contrib/bridges/otelslog v0.18.0 h1:hhPGP3zvvy1xWT9RTy970wlniSxFttBIsAK1gvMguJM= -go.opentelemetry.io/contrib/bridges/otelslog v0.18.0/go.mod h1:twJF7inoMza6kxMcF8JOdL3mPmtOZu7GEr34CUNE6Dg= -go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU= -go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc= -go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.19.0 h1:Dn8rkudDzY6KV9dr/D/bTUuWgqDf9xe0rr4G2elrn0Y= -go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.19.0/go.mod h1:gMk9F0xDgyN9M/3Ed5Y1wKcx/9mlU91NXY2SNq7RQuU= -go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.44.0 h1:4YsVu3B8+3qtWYYrsUYgn0OG78pN0rnNPRGX4SbokQI= -go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.44.0/go.mod h1:+wnlSn0mD1ADVMe3v9Z/WIaiz6q6gL2J/ejaAmdmv80= -go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.44.0 h1:qazEJlUOQzhCpzQpFETGby7EdqjI1wsd0W+6Gg1SCTU= -go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.44.0/go.mod h1:fOD2Yefuxixkx3ahVNf0O/PERb6r4OlbxfATVnYvzCo= -go.opentelemetry.io/otel/log v0.19.0 h1:KUZs/GOsw79TBBMfDWsXS+KZ4g2Ckzksd1ymzsIEbo4= -go.opentelemetry.io/otel/log v0.19.0/go.mod h1:5DQYeGmxVIr4n0/BcJvF4upsraHjg6vudJJpnkL6Ipk= -go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc= -go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo= -go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58= -go.opentelemetry.io/otel/sdk v1.44.0/go.mod h1:Osuydd3Se74nqjAKxid74N5eC+jfEqfTegHRnq58oK0= -go.opentelemetry.io/otel/sdk/log v0.19.0 h1:scYVLqT22D2gqXItnWiocLUKGH9yvkkeql5dBDiXyko= -go.opentelemetry.io/otel/sdk/log v0.19.0/go.mod h1:vFBowwXGLlW9AvpuF7bMgnNI95LiW10szrOdvzBHlAg= -go.opentelemetry.io/otel/sdk/log/logtest v0.19.0 h1:BEbF7ZBB6qQloV/Ub1+3NQoOUnVtcGkU3XX4Ws3GQfk= -go.opentelemetry.io/otel/sdk/log/logtest v0.19.0/go.mod h1:Lua81/3yM0wOmoHTokLj9y9ADeA02v1naRrVrkAZuKk= -go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI= -go.opentelemetry.io/otel/sdk/metric v1.44.0/go.mod h1:5B5pMARnXxKhltooO4xUuCBorl65a4EpnTalObqOigA= -go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk= -go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE= -go.opentelemetry.io/proto/otlp v1.10.0 h1:IQRWgT5srOCYfiWnpqUYz9CVmbO8bFmKcwYxpuCSL2g= -go.opentelemetry.io/proto/otlp v1.10.0/go.mod h1:/CV4QoCR/S9yaPj8utp3lvQPoqMtxXdzn7ozvvozVqk= -go.opentelemetry.io/proto/slim/otlp v1.10.0 h1:iR97Vs/ZDR+y9TfuP9b1XBtdPWeC+OMslIBmhcLU7jM= -go.opentelemetry.io/proto/slim/otlp v1.10.0/go.mod h1:lV9250stpjYLPNA5viFabIgP2QlUGRT1GdTgAf8SIUk= -go.opentelemetry.io/proto/slim/otlp/collector/profiles/v1development v0.3.0 h1:RUF5rO0hAlgiJt1fzQVzcVs3vZVNHIcMLgOgG4rWNcQ= -go.opentelemetry.io/proto/slim/otlp/collector/profiles/v1development v0.3.0/go.mod h1:I89cynRj8y+383o7tEQVg2SVA6SRgDVIouWPUVXjx0U= -go.opentelemetry.io/proto/slim/otlp/profiles/v1development v0.3.0 h1:CQvJSldHRUN6Z8jsUeYv8J0lXRvygALXIzsmAeCcZE0= -go.opentelemetry.io/proto/slim/otlp/profiles/v1development v0.3.0/go.mod h1:xSQ+mEfJe/GjK1LXEyVOoSI1N9JV9ZI923X5kup43W4= +go.opentelemetry.io/collector/featuregate v1.65.0 h1:Dh+uYVB+POc5DTebZRWjtKJolGhevkiIpbHn+zhkq2o= +go.opentelemetry.io/collector/featuregate v1.65.0/go.mod h1:4ga1QBMPEejXXmpyJS8lmaRpknJ3Lb9Bvk6e420bUFU= +go.opentelemetry.io/collector/internal/testutil v0.159.0 h1:/OfAv3ZRIc3eVFFq4bFc+Ju5HQBebiWywgvAcysIX4M= +go.opentelemetry.io/collector/internal/testutil v0.159.0/go.mod h1:Jkjs6rkqs973LqgZ0Fe3zrokQRKULYXPIf4HuqStiEE= +go.opentelemetry.io/collector/pdata v1.65.0 h1:6bQ3sIrEzOdapetxYFjdCns90kKXg1qCoIZ3la1aR5E= +go.opentelemetry.io/collector/pdata v1.65.0/go.mod h1:r5vRY0p7nZcEif06twUW09Sf6vaNsyPzij+EpwI/xeI= +go.opentelemetry.io/contrib/bridges/otelslog v0.20.0 h1:oEl2Pw/i4OQwhAuda2pAHFAcOMivA+Xa+iTccBfab/g= +go.opentelemetry.io/contrib/bridges/otelslog v0.20.0/go.mod h1:yMSQaiiq5dpfrSJCYLBcqFeJkFFI67seT4ngvx6jfVo= +go.opentelemetry.io/otel v1.45.0 h1:pdrWmLHofpubmArBv1LgFSv1Z0Ie/ppdZzu+kUN5EeU= +go.opentelemetry.io/otel v1.45.0/go.mod h1:XZxIqPapzEYnhNSScF5DIqXhm/rYi0FzCe2XddAwZfQ= +go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.21.0 h1:WseeVYf5dJZTsyPiyW5L14k5qsSibqXAMTSiFEDiWr0= +go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.21.0/go.mod h1:SiLZnQS6Qk2eCpvr2CH/XMAOa64TWGXxEZJZCpD2Lmc= +go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.45.0 h1:QRefszxJmfPdjXUUm3j6iDzY03mTPXMjqErFqQ67vUg= +go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.45.0/go.mod h1:Tiz03lTBVBrm7eWZBOidzEaYaJa8tjwGUGv6d8mlTyk= +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.45.0 h1:fG5MCxGz8+2VtrN/WgqSpJFctVz24gpxj8CxkKmc8Ww= +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.45.0/go.mod h1:BmAYTn+3ysbRe+IU2msxmf5Rx3g6DHvex+tWI3LdhYI= +go.opentelemetry.io/otel/log v0.21.0 h1:SLsVDGmtyBrdw8/a2Z0bOIxou/+bN4z56GebH7T0LvA= +go.opentelemetry.io/otel/log v0.21.0/go.mod h1:iReetQrZL9Wyg84cCkOoCmqDHS5RCFfyxC7J+r8fn8g= +go.opentelemetry.io/otel/metric v1.45.0 h1:7Eg1uH7CJ5cXv9is6tnBe1FI6rj1nwUdbFypRm3br/M= +go.opentelemetry.io/otel/metric v1.45.0/go.mod h1:HAPbm1nd3p1PmFH7v2dR+6BjXxw+Lq4a2+pndMAm08s= +go.opentelemetry.io/otel/sdk v1.45.0 h1:4VVSMgQ83dUgW2aoX5f6JgLvHwIvzcuLnF9lUdCSpCw= +go.opentelemetry.io/otel/sdk v1.45.0/go.mod h1:Sr40LgXV7DsKMMJMKOhUWOgMWTfAaqvm2kF0g7ilwuA= +go.opentelemetry.io/otel/sdk/log v0.21.0 h1:QsE7XSR0ktQdKmRKGnR+f1ObGF32WG+7MER/P9KgmYc= +go.opentelemetry.io/otel/sdk/log v0.21.0/go.mod h1:m9mApjCoD2/1QuKCAptjv+BrG9WKOvQLVdNx+iBldTo= +go.opentelemetry.io/otel/sdk/log/logtest v0.21.0 h1:X+JBBgKlswCGYsmgL0CnoUUtlE//VB345c84jYAYkdQ= +go.opentelemetry.io/otel/sdk/log/logtest v0.21.0/go.mod h1:HD1575K8e6sIFBBDd5tZB3t9DlMytWXq9FuR+Y4rfjE= +go.opentelemetry.io/otel/sdk/metric v1.45.0 h1:oVFszMfyj1Am6s24Vtc7wBb8BKLcwepJjNEYILuiE3o= +go.opentelemetry.io/otel/sdk/metric v1.45.0/go.mod h1:vUWUxDZvu1WVRj8JA8S0AdhsPrZoDpA2DdZauIh4mDA= +go.opentelemetry.io/otel/trace v1.45.0 h1:l/mP6Uv7oNO7/TblbhpbgMidxhq1uO/rPsikOyVhxag= +go.opentelemetry.io/otel/trace v1.45.0/go.mod h1:qoJJA2xNMnxRrdISU/kLtfUH2wNeQbiv+jhs/CxI8bc= +go.opentelemetry.io/proto/otlp v1.11.0 h1:5rrYs0Ykyj50sdU/JU0x8etU+LubXWb+gED6TbEdMIk= +go.opentelemetry.io/proto/otlp v1.11.0/go.mod h1:SmVizdCOAm3XBtG1g1NnOdhW6jtddT72hLMhv8VwA8E= +go.opentelemetry.io/proto/slim/otlp v1.11.0 h1:zB37f+f99+y6UIZR4h7UpwbXd5kFNyip35U7GaJ/Jik= +go.opentelemetry.io/proto/slim/otlp v1.11.0/go.mod h1:mI3DeND+VXZuA4keqFPKDJ3BklwveYm1JqBcEWKDEOM= +go.opentelemetry.io/proto/slim/otlp/collector/profiles/v1development v0.4.0 h1:mt+DWtks0biKnz0jXMpDbxWN0CHJi6OJDKe4GcREkcs= +go.opentelemetry.io/proto/slim/otlp/collector/profiles/v1development v0.4.0/go.mod h1:7UXaX/7uT+kumUHd3LIWyjMlklEp0mPlrE9xmtbG6/8= +go.opentelemetry.io/proto/slim/otlp/profiles/v1development v0.4.0 h1:rLHkdB6eHDiRSIoz0cvNuTJsVJBxaL6IyS1e9BSaXLY= +go.opentelemetry.io/proto/slim/otlp/profiles/v1development v0.4.0/go.mod h1:BrX0dmOGsMuWNXXbFafTD7Gb6F3yK+2czVQ6+c24Cnk= go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE= go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0= go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= @@ -261,8 +262,8 @@ go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= -golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw= -golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk= +golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M= +golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis= golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJkhzJCK5J6kUi1NTVXfM= golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f/go.mod h1:J1xhfL/vlindoeF/aINzNzt2Bket5bjo9sdOYzOsU80= golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY= @@ -276,17 +277,15 @@ golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLL golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20200421231249-e086a090c8fd/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A= golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= -golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE= -golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU= +golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To= +golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek= golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= -golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200909081042-eff7692f9009/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= @@ -297,30 +296,30 @@ golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0= golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= -golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs= -golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY= +golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8= +golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20181030221726-6c7e314b6563/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28= golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE= golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA= -golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q= -golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA= +golang.org/x/tools v0.48.0 h1:3+hClM1aLL5mjMKm5ovokw9epgRXPuu2tILgismM6RE= +golang.org/x/tools v0.48.0/go.mod h1:08xX0orndb/F7jJxGDicx061tyd5pcMto75YMAXr6lk= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4= gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E= -google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa h1:Kjn0N0tCrDgiAFW+lGO4JZ3ck44CehvJQMAwj9QF0G8= -google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa/go.mod h1:q4lMZS6kskjT5HvCPrnnypcDPVJqT/f4nfxmkE7gryY= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa h1:mZHHdPZl0dbGHCflZgAq/Q468DWVFcU2whhB2KAo8fk= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= +google.golang.org/genproto/googleapis/api v0.0.0-20260819154853-08b0e4226688 h1:ax2KzoSRIZU/M0cIxri3pKxy99vniH1PVxWC6si/eZI= +google.golang.org/genproto/googleapis/api v0.0.0-20260819154853-08b0e4226688/go.mod h1:1RJ9BQGyNdZwkGc1eTqkErfRZ6RJyYPHZo73BZ1vQqI= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688 h1:cYNAzI2sUwhmCcoj9TxvihSrqsxt6uIkj3rDRhSDmW4= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688/go.mod h1:DjtHYE8FKJLivXcBEjGwndXfIC23G0VpXiXKqG179uA= google.golang.org/grpc v1.83.1 h1:HIO0+BEtBP6soyqvqC8sNUjZ7bTs+0hFQuFF+RAy++Y= google.golang.org/grpc v1.83.1/go.mod h1:kDyl6SKsiHKt0uylY5gtn5cEjkrIOhQOGDgIc4JGwzQ= -google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE= -google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= +google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc= +google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk= From d08e70b32a40bae010399b6ee53e30a20f1d7e8d Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 5 Sep 2026 21:14:11 +0300 Subject: [PATCH 298/313] build(deps): bump github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.14.0 to 1.14.1 (#1608) Bumps [github.com/Azure/azure-sdk-for-go/sdk/azidentity](https://github.com/Azure/azure-sdk-for-go) from 1.14.0 to 1.14.1.
      Release notes

      Sourced from github.com/Azure/azure-sdk-for-go/sdk/azidentity's releases.

      sdk/azidentity/v1.14.1

      1.14.1 (2026-08-27)

      Other Changes

      • Upgraded dependencies
      Commits
      • 920e79a Prep azidentity for release (#27473)
      • d86ae78 Prep azcore for release (#27471)
      • 33dd768 [azwebpubsub] Fix GenerateClientAccessURL on the TokenCredential path (#27422)
      • a27ca57 Upgrade TypeSpec Go emitter dependencies (#27466)
      • af75eb0 [AutoPR sdk-resourcemanager/purestorageblock/armpurestorageblock]-generated-f...
      • 8dcff8c [AutoPR sdk-resourcemanager/redisenterprise/armredisenterprise]-generated-fro...
      • e4569f1 [AutoPR sdk-resourcemanager/chaos/armchaos]-generated-from-SDK Generation - G...
      • 7069bf8 [AutoPR sdk-resourcemanager/horizondb/armhorizondb]-generated-from-SDK Genera...
      • 5ceffce Bump gh-aw to v0.86.2 for mgmt review workflow (#27460)
      • 663b6ce Enhance azblob perf tests with OAuth, parallel setup, and profiling (#27324)
      • Additional commits viewable in compare view

      [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/Azure/azure-sdk-for-go/sdk/azidentity&package-manager=go_modules&previous-version=1.14.0&new-version=1.14.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
      Dependabot commands and options
      You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
      Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 15 ++++++++------- go.sum | 30 ++++++++++++++++-------------- 2 files changed, 24 insertions(+), 21 deletions(-) diff --git a/go.mod b/go.mod index daeff49..e06be91 100644 --- a/go.mod +++ b/go.mod @@ -4,7 +4,7 @@ go 1.26 require ( cloud.google.com/go/kms v1.33.0 - github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.0 + github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.1 github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.5.0 github.com/caarlos0/env/v11 v11.4.1 github.com/coreos/go-oidc/v3 v3.20.0 @@ -15,7 +15,7 @@ require ( github.com/prometheus/client_golang v1.24.1 github.com/rs/cors v1.11.1 github.com/santhosh-tekuri/jsonschema/v5 v5.3.1 - github.com/stretchr/testify v1.12.0 + github.com/stretchr/testify v1.12.1 go.opentelemetry.io/contrib/instrumentation/runtime v0.70.0 go.opentelemetry.io/otel v1.45.0 go.opentelemetry.io/otel/exporters/prometheus v0.67.0 @@ -33,10 +33,10 @@ require ( cloud.google.com/go/compute/metadata v0.9.0 // indirect cloud.google.com/go/iam v1.11.0 // indirect cloud.google.com/go/longrunning v1.2.0 // indirect - github.com/Azure/azure-sdk-for-go/sdk/azcore v1.22.0 // indirect + github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.1 // indirect github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0 // indirect github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0 // indirect - github.com/AzureAD/microsoft-authentication-library-for-go v1.7.2 // indirect + github.com/AzureAD/microsoft-authentication-library-for-go v1.8.0 // indirect github.com/beorn7/perks v1.0.1 // indirect github.com/cespare/xxhash/v2 v2.3.0 // indirect github.com/docker/cli v29.6.2+incompatible // indirect @@ -67,12 +67,13 @@ require ( go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0 // indirect go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 // indirect go.opentelemetry.io/otel/trace v1.45.0 // indirect - golang.org/x/crypto v0.54.0 // indirect - golang.org/x/net v0.57.0 // indirect + go.yaml.in/yaml/v3 v3.0.5 // indirect + golang.org/x/crypto v0.55.0 // indirect + golang.org/x/net v0.58.0 // indirect golang.org/x/oauth2 v0.36.0 // indirect golang.org/x/sync v0.22.0 // indirect golang.org/x/sys v0.47.0 // indirect - golang.org/x/text v0.40.0 // indirect + golang.org/x/text v0.41.0 // indirect golang.org/x/time v0.15.0 // indirect google.golang.org/api v0.287.1 // indirect google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 // indirect diff --git a/go.sum b/go.sum index 029e79d..fde75f5 100644 --- a/go.sum +++ b/go.sum @@ -12,10 +12,10 @@ cloud.google.com/go/kms v1.33.0 h1:pG0X78m212b2pv9N4fdMoUO69LuZGQ9kSvn8sHBOFAo= cloud.google.com/go/kms v1.33.0/go.mod h1:CSGvW6GnMQbY+1nOHcIzhMtHSbExXlOmCKjWtYVjcpA= cloud.google.com/go/longrunning v1.2.0 h1:WjYH3YHBGCxGJP9M4dWGHBfXr/cFIjMkNgWcJj7/iMM= cloud.google.com/go/longrunning v1.2.0/go.mod h1:5KMQALFGOCtFoi2xSOA1u3H7WKlhmckgiyFw7+LGQp0= -github.com/Azure/azure-sdk-for-go/sdk/azcore v1.22.0 h1:aokoqcHvaGjiM3VpjKDfMMnF/8epJ+Q1HLJ7CudztqE= -github.com/Azure/azure-sdk-for-go/sdk/azcore v1.22.0/go.mod h1:/WYEx9pcM9Y+Dd/APJaNlSvVSvzl54rrMdZT5+Oi2LM= -github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.0 h1:CU4+EJeJi3TKYWEcYuSdWsjzw0nVsK/H0MSQOiPcymU= -github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.0/go.mod h1:q0+UTSRvShwUCrR/s5HtyInYphN7Wvxb7snFM3u+SLA= +github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.1 h1:zvXfGJCWvywnCA814d8ZiVyt+fm9nnTE8xSb99zRyfo= +github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.1/go.mod h1:iptorS+VYKFL2N6PnebpS91dubG35eAOEERnT4PJbQU= +github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.1 h1:u93s+zU2JD62im61Bm5CZIc1ZrOJaIAWEg0WOrMVkEo= +github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.1/go.mod h1:oXtinPO4OLj9d1DOTrqrL1oRwGhcqadvAmrl6wTeGlk= github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.4.0 h1:xFaZZ+IubdftrDHnGGwZ6QvQ3KHTtWl2MCK+GMt2vxs= github.com/Azure/azure-sdk-for-go/sdk/azidentity/cache v0.4.0/go.mod h1:mCBhUhlMjLLJKr5aqw2TNS/VqJOie8MzWq3DAMJeKso= github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0 h1:fhqpLE3UEXi9lPaBRpQ6XuRW0nU7hgg4zlmZZa+a9q4= @@ -26,8 +26,8 @@ github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0 h1:nCYfg github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.2.0/go.mod h1:ucUjca2JtSZboY8IoUqyQyuuXvwbMBVwFOm0vdQPNhA= github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1 h1:WJTmL004Abzc5wDB5VtZG2PJk5ndYDgVacGqfirKxjM= github.com/AzureAD/microsoft-authentication-extensions-for-go/cache v0.1.1/go.mod h1:tCcJZ0uHAmvjsVYzEFivsRTN00oz5BEsRgQHu5JZ9WE= -github.com/AzureAD/microsoft-authentication-library-for-go v1.7.2 h1:RHK7bS+HQMslb1sZpAokUt+zTVmue0hKSs2C791hhzU= -github.com/AzureAD/microsoft-authentication-library-for-go v1.7.2/go.mod h1:HKpQxkWaGLJ+D/5H8QRpyQXA1eKjxkFlOMwck5+33Jk= +github.com/AzureAD/microsoft-authentication-library-for-go v1.8.0 h1:Nljr4q1GRA/5vCrMONS+g4u4LRHNgOXVSh3O43J2CnI= +github.com/AzureAD/microsoft-authentication-library-for-go v1.8.0/go.mod h1:Y33QHnf0FfdVewFFISOGe20mkZbxX4H839o955/PoeI= github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM= github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw= github.com/caarlos0/env/v11 v11.4.1 h1:fYwH0sWEsBSMPG7t4e/PEfTFzrWrpjyygXyUnWiSwEw= @@ -129,8 +129,8 @@ github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC4 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= -github.com/stretchr/testify v1.12.0 h1:K6Mr6jO9JICuend/5xzTM03ydSV3vdNRYAdPSukj8uI= -github.com/stretchr/testify v1.12.0/go.mod h1:bOYBZb5qJ00vPzWfIqBUZPaxK8jWiXc6d3ErP4Ca9Gw= +github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE= +github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg= github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM= github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= @@ -159,12 +159,14 @@ go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE= go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ= go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ= -golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw= -golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk= +go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw= +go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg= +golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M= +golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis= golang.org/x/mod v0.40.0 h1:hUv+3cXcdRHz08UmSiOob7sadHig73uo5bkXxQ/tvUs= golang.org/x/mod v0.40.0/go.mod h1:0/weTWkPWGBikyTWAX3dkjVztMmBA5hM0DH6BElSupE= -golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE= -golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU= +golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To= +golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU= golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek= @@ -172,8 +174,8 @@ golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs= golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= -golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs= -golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY= +golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8= +golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M= golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U= golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno= gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4= From e166f76f06c0ba2e9ab6958e511ab43dd1e9ec29 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 5 Sep 2026 21:39:42 +0300 Subject: [PATCH 299/313] build(deps): bump the opentelemetry group across 1 directory with 6 updates (#1607) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps the opentelemetry group with 2 updates in the / directory: [go.opentelemetry.io/contrib/instrumentation/runtime](https://github.com/open-telemetry/opentelemetry-go-contrib) and [go.opentelemetry.io/otel/exporters/prometheus](https://github.com/open-telemetry/opentelemetry-go). Updates `go.opentelemetry.io/contrib/instrumentation/runtime` from 0.70.0 to 0.71.0
      Changelog

      Sourced from go.opentelemetry.io/contrib/instrumentation/runtime's changelog.

      [1.46.0/2.5.3/0.71.0/0.37.3/0.26.0/0.20.1/0.16.3/0.18.0] - 2026-08-25

      This release is the last to support [Go 1.25]. The next release will require at least [Go 1.26].

      Added

      • Add support for the aws.ec2 resource detector in go.opentelemetry.io/contrib/otelconf/x. (#9139)
      • Support testing of [Go 1.27]. (#9524)
      • Add go.opentelemetry.io/contrib/detectors/docker, a resource detector for Docker, ported from processor/resourcedetectionprocessor/internal/docker in opentelemetry-collector-contrib. (#9001)
      • Add S3AttributeBuilder to go.opentelemetry.io/contrib/instrumentation/github.com/aws/aws-sdk-go-v2/otelaws that sets S3-specific span attributes following the OpenTelemetry S3 semantic conventions. (#9292)

      Deprecated

      • Deprecate go.opentelemetry.io/contrib/instrumentation/github.com/labstack/echo/otelecho. Use github.com/labstack/echo-opentelemetry instead. (#9136)

      Fixed

      • Record error.type attribute on server spans in go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful when a request is cancelled or ends in a 5xx error. (#9387)
      • Report ot-baggage-* extraction errors from go.opentelemetry.io/contrib/propagators/ot to otel.Handle instead of silently discarding them, while still attaching the successfully parsed baggage members to the context. (#9395)
      • Set error.type on the rpc.client.call.duration and rpc.server.call.duration metrics in go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc when the RPC fails with a non-OK status, per the RPC semantic conventions. (#9429)
      • Reject OTLP exporter headers with an empty name in go.opentelemetry.io/contrib/otelconf, go.opentelemetry.io/contrib/otelconf/x, and go.opentelemetry.io/contrib/otelconf/v0.3.0, instead of forwarding invalid header names to OTLP exporters. (#9102)
      • go.opentelemetry.io/contrib/detectors/aws/lambda no longer returns an error when run outside of an AWS Lambda environment, matching the no-op behavior of other resource detectors. (#9464)
      • Convert Prometheus untyped metrics to OTLP Gauges in go.opentelemetry.io/contrib/bridges/prometheus. (#9099)
      Commits
      • c4c6248 Release v1.46.0/v2.5.3/v0.71.0/v0.37.3/v0.26.0/v0.20.1/v0.16.3/v0.18.0 (#9563)
      • 11c8a13 fix(deps): update aws-sdk-go-v2 monorepo
      • 0458b9d chore(deps): update module go.opentelemetry.io/contrib/instrumentation/net/ht...
      • 638a0d5 fix(deps): update module github.com/moby/moby/api to v1.55.0
      • 5089aa5 chore(deps): update googleapis to da73d73
      • a50857b chore(deps): update jaegertracing/jaeger docker tag to v2.20.0
      • aa4f4a5 chore(deps): update open-telemetry/shared-workflows action to v0.11.0
      • ccbbc14 fix(deps): update module github.com/aws/smithy-go to v1.28.0
      • 9312464 chore(deps): update module github.com/docker/go-connections to v0.8.1
      • 36c3b00 chore(deps): update module github.com/felixge/httpsnoop to v1.1.0
      • Additional commits viewable in compare view

      Updates `go.opentelemetry.io/otel` from 1.45.0 to 1.46.0
      Release notes

      Sourced from go.opentelemetry.io/otel's releases.

      v1.46.0/v0.68.0/v0.22.0/v0.0.19

      This release is the last to support Go 1.25. The next release will require at least Go 1.26.

      Added

      • Support testing of Go 1.27. (#8811)
      • Support http/json protocol in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8273, #8775, #8831)
      • Add Hasher struct and methods in go.opentelemetry.io/otel/attribute to compute authoritative Distinct hashes incrementally for attribute filtering and deduplication. (#8598)

      Changed

      • Lazily evaluate filtered and dropped attributes on measurement hot paths in go.opentelemetry.io/otel/sdk/metric to avoid unnecessary attribute set allocations. (#8598)
      • Add ErrExporterShutdown to go.opentelemetry.io/otel/sdk/log and return it from the go.opentelemetry.io/otel/exporters/stdout/stdoutlog, go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp exporters when Export is called after Shutdown. (#8773)
      • Clarify in go.opentelemetry.io/otel/log that calling Logger.Enabled is optional and that cached results can become stale. (#8764)

      Fixed

      • Export dropped attribute counts in OTLP log records from go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8829)
      • Name span events created from OpenTracing logs after the event log field, falling back to log, instead of always using an empty name in go.opentelemetry.io/otel/bridge/opentracing. (#8648)
      • Count exception attributes omitted due to the attribute count limit as dropped in go.opentelemetry.io/otel/sdk/log. (#8796)
      • Prevent log record and instrumentation scope attributes with empty keys from reaching processors and exporters in go.opentelemetry.io/otel/sdk/log. (#8797)
      • Fix a data race when span attributes are read concurrently in go.opentelemetry.io/otel/sdk/trace. (#8706)
      • Prevent a panic in (*Set).Filter when called on a nil receiver in go.opentelemetry.io/otel/attribute. (#8792)
      • The simple span and log processors record otel.sdk.processor.{span,log}.processed when the record is submitted to the exporter instead of after the export completes, and no longer set error.type from the export outcome, in go.opentelemetry.io/otel/sdk/trace and go.opentelemetry.io/otel/sdk/log. (#8705)
      • Prevent Resource.MarshalLog from panicking on nil resources in go.opentelemetry.io/otel/sdk/resource. (#8758)

      What's Changed

      ... (truncated)

      Changelog

      Sourced from go.opentelemetry.io/otel's changelog.

      [1.46.0/0.68.0/0.22.0/0.0.19] - 2026-08-25

      This release is the last to support [Go 1.25]. The next release will require at least [Go 1.26].

      Added

      • Support testing of [Go 1.27]. (#8811)
      • Support http/json protocol in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8273, #8775, #8831)
      • Add Hasher struct and methods in go.opentelemetry.io/otel/attribute to compute authoritative Distinct hashes incrementally for attribute filtering and deduplication. (#8598)

      Changed

      • Lazily evaluate filtered and dropped attributes on measurement hot paths in go.opentelemetry.io/otel/sdk/metric to avoid unnecessary attribute set allocations. (#8598)
      • Add ErrExporterShutdown to go.opentelemetry.io/otel/sdk/log and return it from the go.opentelemetry.io/otel/exporters/stdout/stdoutlog, go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp exporters when Export is called after Shutdown. (#8773)
      • Clarify in go.opentelemetry.io/otel/log that calling Logger.Enabled is optional and that cached results can become stale. (#8764)

      Fixed

      • Export dropped attribute counts in OTLP log records from go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8829)
      • Name span events created from OpenTracing logs after the event log field, falling back to log, instead of always using an empty name in go.opentelemetry.io/otel/bridge/opentracing. (#8648)
      • Count exception attributes omitted due to the attribute count limit as dropped in go.opentelemetry.io/otel/sdk/log. (#8796)
      • Prevent log record and instrumentation scope attributes with empty keys from reaching processors and exporters in go.opentelemetry.io/otel/sdk/log. (#8797)
      • Fix a data race when span attributes are read concurrently in go.opentelemetry.io/otel/sdk/trace. (#8706)
      • Prevent a panic in (*Set).Filter when called on a nil receiver in go.opentelemetry.io/otel/attribute. (#8792)
      • The simple span and log processors record otel.sdk.processor.{span,log}.processed when the record is submitted to the exporter instead of after the export completes, and no longer set error.type from the export outcome, in go.opentelemetry.io/otel/sdk/trace and go.opentelemetry.io/otel/sdk/log. (#8705)
      • Prevent Resource.MarshalLog from panicking on nil resources in go.opentelemetry.io/otel/sdk/resource. (#8758)
      Commits
      • 58db4c8 Release v1.46.0 (#8858)
      • 524fc3c chore(deps): update golang.org/x/telemetry digest to 1f5465a (#8853)
      • 3b8ef6f chore(deps): update codspeedhq/action action to v5.2.1 (#8854)
      • cfbeab5 attribute: clarify xxhash test purpose (#8753)
      • 3599b59 sdk/log: Add interface stability markers (#8855)
      • 08d52dc otlptracehttp: Accept quoted finite doubles in OTLP JSON (#8831)
      • d720f5a otlplog: export dropped attribute count (#8829)
      • 80fe23b chore(deps): update module honnef.co/go/tools to v0.8.1 (#8816)
      • 5337812 chore(deps): update codspeedhq/action action to v5.2.0 (#8851)
      • 2f73a3e chore(deps): update module github.com/uudashr/iface to v1.5.1 (#8841)
      • Additional commits viewable in compare view

      Updates `go.opentelemetry.io/otel/exporters/prometheus` from 0.67.0 to 0.68.0
      Changelog

      Sourced from go.opentelemetry.io/otel/exporters/prometheus's changelog.

      [1.46.0/0.68.0/0.22.0/0.0.19] - 2026-08-25

      This release is the last to support [Go 1.25]. The next release will require at least [Go 1.26].

      Added

      • Support testing of [Go 1.27]. (#8811)
      • Support http/json protocol in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8273, #8775, #8831)
      • Add Hasher struct and methods in go.opentelemetry.io/otel/attribute to compute authoritative Distinct hashes incrementally for attribute filtering and deduplication. (#8598)

      Changed

      • Lazily evaluate filtered and dropped attributes on measurement hot paths in go.opentelemetry.io/otel/sdk/metric to avoid unnecessary attribute set allocations. (#8598)
      • Add ErrExporterShutdown to go.opentelemetry.io/otel/sdk/log and return it from the go.opentelemetry.io/otel/exporters/stdout/stdoutlog, go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp exporters when Export is called after Shutdown. (#8773)
      • Clarify in go.opentelemetry.io/otel/log that calling Logger.Enabled is optional and that cached results can become stale. (#8764)

      Fixed

      • Export dropped attribute counts in OTLP log records from go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8829)
      • Name span events created from OpenTracing logs after the event log field, falling back to log, instead of always using an empty name in go.opentelemetry.io/otel/bridge/opentracing. (#8648)
      • Count exception attributes omitted due to the attribute count limit as dropped in go.opentelemetry.io/otel/sdk/log. (#8796)
      • Prevent log record and instrumentation scope attributes with empty keys from reaching processors and exporters in go.opentelemetry.io/otel/sdk/log. (#8797)
      • Fix a data race when span attributes are read concurrently in go.opentelemetry.io/otel/sdk/trace. (#8706)
      • Prevent a panic in (*Set).Filter when called on a nil receiver in go.opentelemetry.io/otel/attribute. (#8792)
      • The simple span and log processors record otel.sdk.processor.{span,log}.processed when the record is submitted to the exporter instead of after the export completes, and no longer set error.type from the export outcome, in go.opentelemetry.io/otel/sdk/trace and go.opentelemetry.io/otel/sdk/log. (#8705)
      • Prevent Resource.MarshalLog from panicking on nil resources in go.opentelemetry.io/otel/sdk/resource. (#8758)
      Commits
      • 58db4c8 Release v1.46.0 (#8858)
      • 524fc3c chore(deps): update golang.org/x/telemetry digest to 1f5465a (#8853)
      • 3b8ef6f chore(deps): update codspeedhq/action action to v5.2.1 (#8854)
      • cfbeab5 attribute: clarify xxhash test purpose (#8753)
      • 3599b59 sdk/log: Add interface stability markers (#8855)
      • 08d52dc otlptracehttp: Accept quoted finite doubles in OTLP JSON (#8831)
      • d720f5a otlplog: export dropped attribute count (#8829)
      • 80fe23b chore(deps): update module honnef.co/go/tools to v0.8.1 (#8816)
      • 5337812 chore(deps): update codspeedhq/action action to v5.2.0 (#8851)
      • 2f73a3e chore(deps): update module github.com/uudashr/iface to v1.5.1 (#8841)
      • Additional commits viewable in compare view

      Updates `go.opentelemetry.io/otel/metric` from 1.45.0 to 1.46.0
      Release notes

      Sourced from go.opentelemetry.io/otel/metric's releases.

      v1.46.0/v0.68.0/v0.22.0/v0.0.19

      This release is the last to support Go 1.25. The next release will require at least Go 1.26.

      Added

      • Support testing of Go 1.27. (#8811)
      • Support http/json protocol in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8273, #8775, #8831)
      • Add Hasher struct and methods in go.opentelemetry.io/otel/attribute to compute authoritative Distinct hashes incrementally for attribute filtering and deduplication. (#8598)

      Changed

      • Lazily evaluate filtered and dropped attributes on measurement hot paths in go.opentelemetry.io/otel/sdk/metric to avoid unnecessary attribute set allocations. (#8598)
      • Add ErrExporterShutdown to go.opentelemetry.io/otel/sdk/log and return it from the go.opentelemetry.io/otel/exporters/stdout/stdoutlog, go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp exporters when Export is called after Shutdown. (#8773)
      • Clarify in go.opentelemetry.io/otel/log that calling Logger.Enabled is optional and that cached results can become stale. (#8764)

      Fixed

      • Export dropped attribute counts in OTLP log records from go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8829)
      • Name span events created from OpenTracing logs after the event log field, falling back to log, instead of always using an empty name in go.opentelemetry.io/otel/bridge/opentracing. (#8648)
      • Count exception attributes omitted due to the attribute count limit as dropped in go.opentelemetry.io/otel/sdk/log. (#8796)
      • Prevent log record and instrumentation scope attributes with empty keys from reaching processors and exporters in go.opentelemetry.io/otel/sdk/log. (#8797)
      • Fix a data race when span attributes are read concurrently in go.opentelemetry.io/otel/sdk/trace. (#8706)
      • Prevent a panic in (*Set).Filter when called on a nil receiver in go.opentelemetry.io/otel/attribute. (#8792)
      • The simple span and log processors record otel.sdk.processor.{span,log}.processed when the record is submitted to the exporter instead of after the export completes, and no longer set error.type from the export outcome, in go.opentelemetry.io/otel/sdk/trace and go.opentelemetry.io/otel/sdk/log. (#8705)
      • Prevent Resource.MarshalLog from panicking on nil resources in go.opentelemetry.io/otel/sdk/resource. (#8758)

      What's Changed

      ... (truncated)

      Changelog

      Sourced from go.opentelemetry.io/otel/metric's changelog.

      [1.46.0/0.68.0/0.22.0/0.0.19] - 2026-08-25

      This release is the last to support [Go 1.25]. The next release will require at least [Go 1.26].

      Added

      • Support testing of [Go 1.27]. (#8811)
      • Support http/json protocol in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8273, #8775, #8831)
      • Add Hasher struct and methods in go.opentelemetry.io/otel/attribute to compute authoritative Distinct hashes incrementally for attribute filtering and deduplication. (#8598)

      Changed

      • Lazily evaluate filtered and dropped attributes on measurement hot paths in go.opentelemetry.io/otel/sdk/metric to avoid unnecessary attribute set allocations. (#8598)
      • Add ErrExporterShutdown to go.opentelemetry.io/otel/sdk/log and return it from the go.opentelemetry.io/otel/exporters/stdout/stdoutlog, go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp exporters when Export is called after Shutdown. (#8773)
      • Clarify in go.opentelemetry.io/otel/log that calling Logger.Enabled is optional and that cached results can become stale. (#8764)

      Fixed

      • Export dropped attribute counts in OTLP log records from go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8829)
      • Name span events created from OpenTracing logs after the event log field, falling back to log, instead of always using an empty name in go.opentelemetry.io/otel/bridge/opentracing. (#8648)
      • Count exception attributes omitted due to the attribute count limit as dropped in go.opentelemetry.io/otel/sdk/log. (#8796)
      • Prevent log record and instrumentation scope attributes with empty keys from reaching processors and exporters in go.opentelemetry.io/otel/sdk/log. (#8797)
      • Fix a data race when span attributes are read concurrently in go.opentelemetry.io/otel/sdk/trace. (#8706)
      • Prevent a panic in (*Set).Filter when called on a nil receiver in go.opentelemetry.io/otel/attribute. (#8792)
      • The simple span and log processors record otel.sdk.processor.{span,log}.processed when the record is submitted to the exporter instead of after the export completes, and no longer set error.type from the export outcome, in go.opentelemetry.io/otel/sdk/trace and go.opentelemetry.io/otel/sdk/log. (#8705)
      • Prevent Resource.MarshalLog from panicking on nil resources in go.opentelemetry.io/otel/sdk/resource. (#8758)
      Commits
      • 58db4c8 Release v1.46.0 (#8858)
      • 524fc3c chore(deps): update golang.org/x/telemetry digest to 1f5465a (#8853)
      • 3b8ef6f chore(deps): update codspeedhq/action action to v5.2.1 (#8854)
      • cfbeab5 attribute: clarify xxhash test purpose (#8753)
      • 3599b59 sdk/log: Add interface stability markers (#8855)
      • 08d52dc otlptracehttp: Accept quoted finite doubles in OTLP JSON (#8831)
      • d720f5a otlplog: export dropped attribute count (#8829)
      • 80fe23b chore(deps): update module honnef.co/go/tools to v0.8.1 (#8816)
      • 5337812 chore(deps): update codspeedhq/action action to v5.2.0 (#8851)
      • 2f73a3e chore(deps): update module github.com/uudashr/iface to v1.5.1 (#8841)
      • Additional commits viewable in compare view

      Updates `go.opentelemetry.io/otel/sdk` from 1.45.0 to 1.46.0
      Release notes

      Sourced from go.opentelemetry.io/otel/sdk's releases.

      v1.46.0/v0.68.0/v0.22.0/v0.0.19

      This release is the last to support Go 1.25. The next release will require at least Go 1.26.

      Added

      • Support testing of Go 1.27. (#8811)
      • Support http/json protocol in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8273, #8775, #8831)
      • Add Hasher struct and methods in go.opentelemetry.io/otel/attribute to compute authoritative Distinct hashes incrementally for attribute filtering and deduplication. (#8598)

      Changed

      • Lazily evaluate filtered and dropped attributes on measurement hot paths in go.opentelemetry.io/otel/sdk/metric to avoid unnecessary attribute set allocations. (#8598)
      • Add ErrExporterShutdown to go.opentelemetry.io/otel/sdk/log and return it from the go.opentelemetry.io/otel/exporters/stdout/stdoutlog, go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp exporters when Export is called after Shutdown. (#8773)
      • Clarify in go.opentelemetry.io/otel/log that calling Logger.Enabled is optional and that cached results can become stale. (#8764)

      Fixed

      • Export dropped attribute counts in OTLP log records from go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8829)
      • Name span events created from OpenTracing logs after the event log field, falling back to log, instead of always using an empty name in go.opentelemetry.io/otel/bridge/opentracing. (#8648)
      • Count exception attributes omitted due to the attribute count limit as dropped in go.opentelemetry.io/otel/sdk/log. (#8796)
      • Prevent log record and instrumentation scope attributes with empty keys from reaching processors and exporters in go.opentelemetry.io/otel/sdk/log. (#8797)
      • Fix a data race when span attributes are read concurrently in go.opentelemetry.io/otel/sdk/trace. (#8706)
      • Prevent a panic in (*Set).Filter when called on a nil receiver in go.opentelemetry.io/otel/attribute. (#8792)
      • The simple span and log processors record otel.sdk.processor.{span,log}.processed when the record is submitted to the exporter instead of after the export completes, and no longer set error.type from the export outcome, in go.opentelemetry.io/otel/sdk/trace and go.opentelemetry.io/otel/sdk/log. (#8705)
      • Prevent Resource.MarshalLog from panicking on nil resources in go.opentelemetry.io/otel/sdk/resource. (#8758)

      What's Changed

      ... (truncated)

      Changelog

      Sourced from go.opentelemetry.io/otel/sdk's changelog.

      [1.46.0/0.68.0/0.22.0/0.0.19] - 2026-08-25

      This release is the last to support [Go 1.25]. The next release will require at least [Go 1.26].

      Added

      • Support testing of [Go 1.27]. (#8811)
      • Support http/json protocol in go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp. (#8273, #8775, #8831)
      • Add Hasher struct and methods in go.opentelemetry.io/otel/attribute to compute authoritative Distinct hashes incrementally for attribute filtering and deduplication. (#8598)

      Changed

      • Lazily evaluate filtered and dropped attributes on measurement hot paths in go.opentelemetry.io/otel/sdk/metric to avoid unnecessary attribute set allocations. (#8598)
      • Add ErrExporterShutdown to go.opentelemetry.io/otel/sdk/log and return it from the go.opentelemetry.io/otel/exporters/stdout/stdoutlog, go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc, and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp exporters when Export is called after Shutdown. (#8773)
      • Clarify in go.opentelemetry.io/otel/log that calling Logger.Enabled is optional and that cached results can become stale. (#8764)

      Fixed

      • Export dropped attribute counts in OTLP log records from go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc and go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp. (#8829)
      • Name span events created from OpenTracing logs after the event log field, falling back to log, instead of always using an empty name in go.opentelemetry.io/otel/bridge/opentracing. (#8648)
      • Count exception attributes omitted due to the attribute count limit as dropped in go.opentelemetry.io/otel/sdk/log. (#8796)
      • Prevent log record and instrumentation scope attributes with empty keys from reaching processors and exporters in go.opentelemetry.io/otel/sdk/log. (#8797)
      • Fix a data race when span attributes are read concurrently in go.opentelemetry.io/otel/sdk/trace. (#8706)
      • Prevent a panic in (*Set).Filter when called on a nil receiver in go.opentelemetry.io/otel/attribute. (#8792)
      • The simple span and log processors record otel.sdk.processor.{span,log}.processed when the record is submitted to the exporter instead of after the export completes, and no longer set error.type from the export outcome, in go.opentelemetry.io/otel/sdk/trace and go.opentelemetry.io/otel/sdk/log. (#8705)
      • Prevent Resource.MarshalLog from panicking on nil resources in go.opentelemetry.io/otel/sdk/resource. (#8758)
      Commits
      • 58db4c8 Release v1.46.0 (#8858)
      • 524fc3c chore(deps): update golang.org/x/telemetry digest to 1f5465a (#8853)
      • 3b8ef6f chore(deps): update codspeedhq/action action to v5.2.1 (#8854)
      • cfbeab5 attribute: clarify xxhash test purpose (#8753)
      • 3599b59 sdk/log: Add interface stability markers (#8855)
      • 08d52dc otlptracehttp: Accept quoted finite doubles in OTLP JSON ( Date: Sat, 5 Sep 2026 21:40:40 +0300 Subject: [PATCH 300/313] build(deps): bump github.com/pulumi/pulumi/sdk/v3 from 3.259.0 to 3.261.0 in /deploy (#1606) Bumps [github.com/pulumi/pulumi/sdk/v3](https://github.com/pulumi/pulumi) from 3.259.0 to 3.261.0.
        Release notes

        Sourced from github.com/pulumi/pulumi/sdk/v3's releases.

        v3.261.0

        3.261.0 (2026-09-02)

        Features

        • [engine] Support state migration callbacks on resource registrations #24328
        • [cli/env] Add pulumi env setup {aws,azure,gcp} to configure cloud OIDC trust and create the ESC environments that use it #23911

        Bug Fixes

        • [engine] Report a clear error instead of panicking when the stack's state contains a custom resource with no ID #24438
        • [cli] Show the agent account's claim URL instead of an inaccessible View Live link when running on ephemeral agent credentials #24476
        • [pcl] Fix a crash when binding a schema property with an integer constant value #24480
        • [cli/policy] Avoid hanging when policy pack fails to start up #24492
        • [pkg/testing] Fix ProgramTest for providers whose Go module or NuGet package has a double-digit major version #24499
        • [sdk] Fix serialization of secret unknowns in NodeJS, Python and PCL #24500
        • [engine] Ignore internal property keys (those starting with an underscore) when generating and checking update plans #24532

        Improvements

        • [sdkgen] Generate precise Python output types for discriminated unions. An array of a union was typed Sequence[Any] and a scalar union Any, while the matching getters on the generated Args classes were already typed #24485
        • [sdk/python] Resolve a union value to its member by matching the value's wire shape, so unions whose members carry no constant properties serialize and translate with the right member's property names #24484
        • [sdkgen/python] Accept a generated output type wherever the classes-and-dicts input types accept its Args class or TypedDict, so a resource's output can be passed to another resource's input without a type error #24507
        • [engine] Send previously persisted outputs to a provider's Check on update, gated by a new sends_old_outputs_to_check handshake capability #24524
        • [sdk/python] Add helper methods to transform ResourceOptions to InvokeOptions #24533

        Miscellaneous

        • [java] Upgrade java to v1.36.3 #24509
        • [yaml] Upgrade yaml to v1.38.5 #24509
        • [sdk/dotnet] Upgrade dotnet to v3.113.1 #24512

        v3.260.0

        3.260.0 (2026-08-28)

        Features

        • [cli/deployment] Make pulumi deployment settings get render every source kind and show environment variable values, changing the --output=json shape of environmentVariables from a list of names to a list of objects #24284
        • [sdk/go] Support Go 1.27 #24401
        • [cli/state] Add pulumi state promote to turn stateful snippets into Pulumi program code #24453

        Bug Fixes

        • [engine] Replace resources whose deletedWith target is being replaced, instead of leaving them orphaned in state #23818
        • [sdk/python] Serialize typed object stack outputs with their wire-format (camelCase) property names, matching other language SDKs #24246
        • [cli/neo] Cancelling a task now interrupts a running local tool call instead of waiting for it to finish #24268
        • [programgen/python] Access schema properties whose names contain hyphens as attributes under their Python names instead of subscripting #24300
        • [programgen/go] Generate valid struct field names for properties whose names contain hyphens #24300
        • [sdkgen/nodejs] Quote property names that are not legal identifiers (e.g. kebab-case) in generated declarations and use bracket access for them #24300
        • [cli/neo] Cancelling a local tool call no longer leaves the TUI stuck on "Thinking..." with input blocked #24318

        ... (truncated)

        Changelog

        Sourced from github.com/pulumi/pulumi/sdk/v3's changelog.

        3.261.0 (2026-09-02)

        Features

        • [engine] Support state migration callbacks on resource registrations #24328
        • [cli/env] Add pulumi env setup {aws,azure,gcp} to configure cloud OIDC trust and create the ESC environments that use it #23911

        Bug Fixes

        • [engine] Report a clear error instead of panicking when the stack's state contains a custom resource with no ID #24438
        • [cli] Show the agent account's claim URL instead of an inaccessible View Live link when running on ephemeral agent credentials #24476
        • [pcl] Fix a crash when binding a schema property with an integer constant value #24480
        • [cli/policy] Avoid hanging when policy pack fails to start up #24492
        • [pkg/testing] Fix ProgramTest for providers whose Go module or NuGet package has a double-digit major version #24499
        • [sdk] Fix serialization of secret unknowns in NodeJS, Python and PCL #24500
        • [engine] Ignore internal property keys (those starting with an underscore) when generating and checking update plans #24532

        Improvements

        • [sdkgen] Generate precise Python output types for discriminated unions. An array of a union was typed Sequence[Any] and a scalar union Any, while the matching getters on the generated Args classes were already typed #24485
        • [sdk/python] Resolve a union value to its member by matching the value's wire shape, so unions whose members carry no constant properties serialize and translate with the right member's property names #24484
        • [sdkgen/python] Accept a generated output type wherever the classes-and-dicts input types accept its Args class or TypedDict, so a resource's output can be passed to another resource's input without a type error #24507
        • [engine] Send previously persisted outputs to a provider's Check on update, gated by a new sends_old_outputs_to_check handshake capability #24524
        • [sdk/python] Add helper methods to transform ResourceOptions to InvokeOptions #24533

        Miscellaneous

        • [java] Upgrade java to v1.36.3 #24509
        • [yaml] Upgrade yaml to v1.38.5 #24509
        • [sdk/dotnet] Upgrade dotnet to v3.113.1 #24512

        3.260.0 (2026-08-28)

        Features

        • [cli/deployment] Make pulumi deployment settings get render every source kind and show environment variable values, changing the --output=json shape of environmentVariables from a list of names to a list of objects #24284
        • [sdk/go] Support Go 1.27 #24401
        • [cli/state] Add pulumi state promote to turn stateful snippets into Pulumi program code #24453

        Bug Fixes

        • [engine] Replace resources whose deletedWith target is being replaced, instead of leaving them orphaned in state #23818
        • [sdk/python] Serialize typed object stack outputs with their wire-format (camelCase) property names, matching other language SDKs #24246
        • [cli/neo] Cancelling a task now interrupts a running local tool call instead of waiting for it to finish #24268
        • [programgen/python] Access schema properties whose names contain hyphens as attributes under their Python names instead of subscripting #24300
        • [programgen/go] Generate valid struct field names for properties whose names contain hyphens #24300
        • [sdkgen/nodejs] Quote property names that are not legal identifiers (e.g. kebab-case) in generated declarations and use bracket access for them #24300
        • [cli/neo] Cancelling a local tool call no longer leaves the TUI stuck on "Thinking..." with input blocked #24318
        • [sdk/go] Use resolved environment names when evaluating ESC imports #24375
        • [codegen/pcl] Allow output-typed values for the id attribute of a read resource #24386
        • [sdkgen/nodejs] Register resolvers for output-only properties in generated Resource.get so they resolve as unknown during preview when the id is unknown #24386

        ... (truncated)

        Commits
        • de0633d Fix ProgramTest for double-digit major versions (#24499)
        • 1e5b60a Migrate ConstructResult to property.Map (#24463)
        • a2b96b4 Ignore internal property keys in update plans (#24532)
        • 4d41278 python: add helper methods to transform ResourceOptions to InvokeOptions (#24...
        • 3081504 Execute component state migrations (#24328)
        • 710f0f8 [Python] Use codegen.IsWireDiscriminatableUnionType in outputs (#24485)
        • f05eae6 Send OldOutputs to provider Check (#24524)
        • ecabf85 Preserve secret marker when serializing unknown Outputs (#24500)
        • f0535f9 [sdkgen/python] Accept output types in resource and function inputs (#24507)
        • 7dc7023 ESC OIDC Onboarding in the CLI (#23911)
        • Additional commits viewable in compare view

        Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- deploy/go.mod | 5 +++-- deploy/go.sum | 6 ++++-- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index 8f054ab..c989c83 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -1,11 +1,11 @@ module github.com/modelcontextprotocol/registry/deploy/infra -go 1.26 +go 1.26.6 require ( github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.34.0 - github.com/pulumi/pulumi/sdk/v3 v3.259.0 + github.com/pulumi/pulumi/sdk/v3 v3.261.0 gopkg.in/yaml.v2 v2.4.0 ) @@ -30,6 +30,7 @@ require ( github.com/clipperhouse/uax29/v2 v2.7.0 // indirect github.com/cloudflare/circl v1.6.3 // indirect github.com/danieljoos/wincred v1.2.3 // indirect + github.com/deckarep/golang-set/v2 v2.5.0 // indirect github.com/djherbis/times v1.5.0 // indirect github.com/ebitengine/purego v0.10.2 // indirect github.com/emirpasic/gods v1.18.1 // indirect diff --git a/deploy/go.sum b/deploy/go.sum index 3e7be55..032a0f1 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -49,6 +49,8 @@ github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSs github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM= github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= +github.com/deckarep/golang-set/v2 v2.5.0 h1:hn6cEZtQ0h3J8kFrHR/NrzyOoTnjgW1+FmNJzQ7y/sA= +github.com/deckarep/golang-set/v2 v2.5.0/go.mod h1:VAky9rY/yGXJOLEDv3OMci+7wtDpOF4IN+y82NBOac4= github.com/djherbis/times v1.5.0 h1:79myA211VwPhFTqUk8xehWrsEO+zcIZj0zT8mXPVARU= github.com/djherbis/times v1.5.0/go.mod h1:5q7FDLvbNg1L/KaBmPcWlVR9NmoKo3+ucqUA3ijQhA0= github.com/ebitengine/purego v0.10.2 h1:W809HbnvzAxgdm+aOvlSekrM16wGCdT/e76+9tS7gzE= @@ -171,8 +173,8 @@ github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1 h1:w6OnO3d4j5yVf2vpm8OzXFC/xHOEGqt+9 github.com/pulumi/pulumi-gcp/sdk/v8 v8.41.1/go.mod h1:UyZyv7hz4knpFx6/Sh+SkZe6hT6sJHtDvw9A0TbvEsk= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.34.0 h1:r00p17ecoDVWqBg38/Is/9jU/JsWLPxnWzhfYqKitx0= github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.34.0/go.mod h1:/klrd3ib4AMRlFMjrxkv5r76x3Bdr68wIMEKfRkRzHU= -github.com/pulumi/pulumi/sdk/v3 v3.259.0 h1:mJP9tXF9oxcfwidBgteXkUUchIz2L59SbGS5byZBo1w= -github.com/pulumi/pulumi/sdk/v3 v3.259.0/go.mod h1:DPK83ZiPYy55hY0MoaFAbl95Yee/dCGc6cQAqI7/ctw= +github.com/pulumi/pulumi/sdk/v3 v3.261.0 h1:1C2V6bxzO9UBe91PRebO/zeiUIQ2C05eRNkVFvJuuqc= +github.com/pulumi/pulumi/sdk/v3 v3.261.0/go.mod h1:xlOo55i2hj5tDyMY8diTS5LfFAn2sFew+50d67sVNdg= github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ= github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88= github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ= From 30ca36e42e39ff8d1527cf501442590920308d9b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 5 Sep 2026 21:46:07 +0300 Subject: [PATCH 301/313] build(deps): bump github.com/google/go-containerregistry from 0.21.9 to 0.22.0 (#1576) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) from 0.21.9 to 0.22.0.
        Release notes

        Sourced from github.com/google/go-containerregistry's releases.

        v0.22.0

        What's Changed

        New Contributors

        Full Changelog: https://github.com/google/go-containerregistry/compare/v0.21.9...v0.21.10

        Commits
        • 3f4ff3c fix(build): unify new build flow into cloudbuild_v2.yaml (#2419)
        • c6b5acd fix(build): correct Cloud Build schema options and source provenance hash (#2...
        • 8f4a85d go.mod: bump Go version + add toolchain directive to replace .go-version file...
        • 5481560 build(deps): bump the go-deps group across 1 directory with 3 updates (#2415)
        • 5b5c272 build(deps): bump the actions group across 1 directory with 8 updates (#2405)
        • 66dd454 remote: retry failed Puller and Pusher initialization (#2406)
        • 3f47f91 fix: add missing substitutions and workspace cleanup to new build files (#2413)
        • 4cb3583 Allow single-character repository paths (#2407)
        • 82cc428 remote: resolve push-check credentials against the repository (#2411)
        • 97815aa build: add multi-architecture Cloud Build configurations for crane, gcrane, a...
        • Additional commits viewable in compare view

        Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 6 +++--- go.sum | 12 ++++++------ 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/go.mod b/go.mod index c336644..9d7f5ce 100644 --- a/go.mod +++ b/go.mod @@ -10,7 +10,7 @@ require ( github.com/coreos/go-oidc/v3 v3.20.0 github.com/danielgtaylor/huma/v2 v2.39.1 github.com/golang-jwt/jwt/v5 v5.3.1 - github.com/google/go-containerregistry v0.21.9 + github.com/google/go-containerregistry v0.22.0 github.com/jackc/pgx/v5 v5.10.0 github.com/prometheus/client_golang v1.24.1 github.com/rs/cors v1.11.1 @@ -39,7 +39,7 @@ require ( github.com/AzureAD/microsoft-authentication-library-for-go v1.8.0 // indirect github.com/beorn7/perks v1.0.1 // indirect github.com/cespare/xxhash/v2 v2.3.0 // indirect - github.com/docker/cli v29.6.2+incompatible // indirect + github.com/docker/cli v29.7.2+incompatible // indirect github.com/docker/docker-credential-helpers v0.9.3 // indirect github.com/felixge/httpsnoop v1.0.4 // indirect github.com/go-jose/go-jose/v4 v4.1.4 // indirect @@ -52,7 +52,7 @@ require ( github.com/jackc/pgpassfile v1.0.0 // indirect github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect github.com/jackc/puddle/v2 v2.2.2 // indirect - github.com/klauspost/compress v1.19.1 // indirect + github.com/klauspost/compress v1.19.2 // indirect github.com/kr/text v0.2.0 // indirect github.com/kylelemons/godebug v1.1.0 // indirect github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect diff --git a/go.sum b/go.sum index 31930d5..76173d7 100644 --- a/go.sum +++ b/go.sum @@ -42,8 +42,8 @@ github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ3 github.com/danielgtaylor/huma/v2 v2.39.1 h1:0kwF4ltQoYZ+IU55VPy+BcGekzgF44R64daTGde1H+g= github.com/danielgtaylor/huma/v2 v2.39.1/go.mod h1:zcnQ38duIJ3VUHwFaBoZ6x8T+KN/mr33oyqxcj0HTug= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= -github.com/docker/cli v29.6.2+incompatible h1:/bjePvcbbFTnRrMfWJBY7AjfICdsiLVgHn6LwTVOcqw= -github.com/docker/cli v29.6.2+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= +github.com/docker/cli v29.7.2+incompatible h1:dlkwallR8XqfeVnA2ELEhdwvb4lsSwuB4IgsG8Q9cLY= +github.com/docker/cli v29.7.2+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= github.com/docker/docker-credential-helpers v0.9.3 h1:gAm/VtF9wgqJMoxzT3Gj5p4AqIjCBS4wrsOh9yRqcz8= github.com/docker/docker-credential-helpers v0.9.3/go.mod h1:x+4Gbw9aGmChi3qTLZj8Dfn0TD20M/fuWy0E5+WDeCo= github.com/envoyproxy/go-control-plane v0.14.0 h1:hbG2kr4RuFj222B6+7T83thSPqLjwBIfQawTkC++2HA= @@ -70,8 +70,8 @@ github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps= github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= -github.com/google/go-containerregistry v0.21.9 h1:F+D4uZ3iA3DLMJLfhaqMdHJbzeqm/216WGQq2dokuLs= -github.com/google/go-containerregistry v0.21.9/go.mod h1:dP5XNKcL7kMFF/TB3LfvWmVhAcv7iqkHb3oDK8aauTo= +github.com/google/go-containerregistry v0.22.0 h1:eGbCiPeYxAH/7WLLq6zTBALP0tUIFsoyRauhxXDJ53I= +github.com/google/go-containerregistry v0.22.0/go.mod h1:bJR35SK8XgisYmhg/FMQ/5RK0S/XrOAqLBV5/LR2XE0= github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0= github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= @@ -90,8 +90,8 @@ github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4= github.com/keybase/go-keychain v0.0.1 h1:way+bWYa6lDppZoZcgMbYsvC7GxljxrskdNInRtuthU= github.com/keybase/go-keychain v0.0.1/go.mod h1:PdEILRW3i9D8JcdM+FmY6RwkHGnhHxXwkPPMeUgOK1k= -github.com/klauspost/compress v1.19.1 h1:VsB4HPswih7mmZ8WleSFQ75c/Ui1M4trX5oAsJnhSlk= -github.com/klauspost/compress v1.19.1/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.19.2 h1:hMRETovs/pu/dVWN7zIT1PGG8t509MwT6bO7XSi26R8= +github.com/klauspost/compress v1.19.2/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= From 99c9439d6ffcc38adf14505e70c41f77ac738246 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Sat, 5 Sep 2026 22:33:43 +0300 Subject: [PATCH 302/313] chore: group Dependabot updates (#1618) ## Summary - group all root Go module updates into one weekly PR - group all deployment Go module updates into a separate weekly PR - keep GitHub Actions updates in their own weekly group - leave Docker updates independent ## Validation - parsed `.github/dependabot.yml` successfully as YAML - `git diff --check` passes Co-authored-by: Radoslav Dimitrov --- .github/dependabot.yml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 775df1b..ee01027 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -3,28 +3,28 @@ updates: - package-ecosystem: gomod directory: / groups: - opentelemetry: + go-dependencies: patterns: - - "go.opentelemetry.io/*" + - "*" schedule: interval: weekly - package-ecosystem: gomod directory: /deploy groups: - opentelemetry: + deploy-go-dependencies: patterns: - - "go.opentelemetry.io/*" + - "*" schedule: interval: weekly - package-ecosystem: github-actions directory: / groups: - actions: + github-actions: patterns: - "*" schedule: interval: weekly - - package-ecosystem: "docker" - directory: "/" + - package-ecosystem: docker + directory: / schedule: - interval: "weekly" + interval: weekly From 1d1eb91e51e1f4ae2e5c7d9f11b9d009884ecc91 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat, 5 Sep 2026 22:44:08 +0300 Subject: [PATCH 303/313] build(deps): bump github.com/coreos/go-oidc/v3 from 3.20.0 to 3.21.0 in the go-dependencies group (#1619) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps the go-dependencies group with 1 update: [github.com/coreos/go-oidc/v3](https://github.com/coreos/go-oidc). Updates `github.com/coreos/go-oidc/v3` from 3.20.0 to 3.21.0
        Release notes

        Sourced from github.com/coreos/go-oidc/v3's releases.

        v3.21.0

        What's Changed

        New Contributors

        Full Changelog: https://github.com/coreos/go-oidc/compare/v3.20.0...v3.21.0

        Commits
        • c914bd3 oidc: ignore JWKs with unsupported key types rather than failing
        • See full diff in compare view

        [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/coreos/go-oidc/v3&package-manager=go_modules&previous-version=3.20.0&new-version=3.21.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
        Dependabot commands and options
        You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
        Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 9d7f5ce..3c08ceb 100644 --- a/go.mod +++ b/go.mod @@ -7,7 +7,7 @@ require ( github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.1 github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.5.0 github.com/caarlos0/env/v11 v11.4.1 - github.com/coreos/go-oidc/v3 v3.20.0 + github.com/coreos/go-oidc/v3 v3.21.0 github.com/danielgtaylor/huma/v2 v2.39.1 github.com/golang-jwt/jwt/v5 v5.3.1 github.com/google/go-containerregistry v0.22.0 diff --git a/go.sum b/go.sum index 76173d7..0ca4b4d 100644 --- a/go.sum +++ b/go.sum @@ -36,8 +36,8 @@ github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UF github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2 h1:aBangftG7EVZoUb69Os8IaYg++6uMOdKK83QtkkvJik= github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2/go.mod h1:qwXFYgsP6T7XnJtbKlf1HP8AjxZZyzxMmc+Lq5GjlU4= -github.com/coreos/go-oidc/v3 v3.20.0 h1:EtE0WIBHk03N+DqGkY4+UONzzZHk7amKt6IyNd7OsZE= -github.com/coreos/go-oidc/v3 v3.20.0/go.mod h1:DYCf24+ncYi+XkIH97GY1+dqoRlbaSI26KVTCI9SrY4= +github.com/coreos/go-oidc/v3 v3.21.0 h1:wZo4Q9Pum8dYEj0eMUPrqR+kvuGkeUplbLpNCkBqoWM= +github.com/coreos/go-oidc/v3 v3.21.0/go.mod h1:DYCf24+ncYi+XkIH97GY1+dqoRlbaSI26KVTCI9SrY4= github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E= github.com/danielgtaylor/huma/v2 v2.39.1 h1:0kwF4ltQoYZ+IU55VPy+BcGekzgF44R64daTGde1H+g= github.com/danielgtaylor/huma/v2 v2.39.1/go.mod h1:zcnQ38duIJ3VUHwFaBoZ6x8T+KN/mr33oyqxcj0HTug= From 974a523857c497d81b4eed1ef77592eef3c6a3da Mon Sep 17 00:00:00 2001 From: Koichi ITO Date: Sun, 6 Sep 2026 04:45:05 +0900 Subject: [PATCH 304/313] docs: carry two modelcontextprotocol.io fixes back upstream (#1590) Both were already fixed on https://modelcontextprotocol.io; this copy is behind. - `faq.mdx`: capitalize PyPI correctly in the abuse reporting steps. https://github.com/modelcontextprotocol/modelcontextprotocol/pull/3153 - `remote-servers.mdx`: recommend Streamable HTTP and link the deprecated features page. The 2026-07-28 draft reclassifies the HTTP+SSE transport as deprecated under the feature lifecycle policy, so SSE should no longer be presented as an equal option. https://github.com/modelcontextprotocol/modelcontextprotocol/pull/3064 ## Types of changes - [ ] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [x] Documentation update ## Checklist - [x] I have read the [MCP Documentation](https://modelcontextprotocol.io) - [x] My code follows the repository's style guidelines - [x] New and existing tests pass locally - [x] I have added appropriate error handling - [x] I have added or updated documentation as needed --- docs/modelcontextprotocol-io/faq.mdx | 2 +- docs/modelcontextprotocol-io/remote-servers.mdx | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/modelcontextprotocol-io/faq.mdx b/docs/modelcontextprotocol-io/faq.mdx index 078ae45..d6c8aab 100644 --- a/docs/modelcontextprotocol-io/faq.mdx +++ b/docs/modelcontextprotocol-io/faq.mdx @@ -52,7 +52,7 @@ There is a 4KB size limit (4096 bytes of JSON). Publishing will fail if this lim ### What if I need to report a spam or malicious server? -1. Report it as abuse to the underlying package registry (e.g. NPM, PyPi, DockerHub, etc.); and +1. Report it as abuse to the underlying package registry (e.g. NPM, PyPI, DockerHub, etc.); and 2. Raise a GitHub issue on the registry repo with a title beginning `Abuse report: ` ### What if I need to report a security vulnerability in the registry itself? diff --git a/docs/modelcontextprotocol-io/remote-servers.mdx b/docs/modelcontextprotocol-io/remote-servers.mdx index be2bdc5..eecad51 100644 --- a/docs/modelcontextprotocol-io/remote-servers.mdx +++ b/docs/modelcontextprotocol-io/remote-servers.mdx @@ -29,7 +29,7 @@ A remote server **MUST** be publicly accessible at its specified URL. ## Transport Type -Remote servers can use the Streamable HTTP transport (recommended) or the SSE transport. Remote servers can also support both transports simultaneously at different URLs. +Remote servers should use the Streamable HTTP transport. The SSE transport is [deprecated](/specification/draft/deprecated), so publish an `"sse"` remote only to support existing clients. Remote servers can also support both transports simultaneously at different URLs. Specify the transport by setting the `type` property of the `remotes` entry to either `"streamable-http"` or `"sse"`: From 5271ba507514a82c1b136077ed9e78fb8b37596a Mon Sep 17 00:00:00 2001 From: Nikolife2016 <139212778+Nikolife2016@users.noreply.github.com> Date: Sun, 6 Sep 2026 02:47:31 +0700 Subject: [PATCH 305/313] docs: add PulseFeed MCP Drift Watch to community projects (#1581) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit One line in `docs/community-projects.md` under **Other**, following the format in *Adding Your Project*. **What it is.** A daily external diff of the whole registry population — 25,122 entries as of today — recording what changed in a server *after* it was listed rather than whether it is safe right now: package ownership transferred, an install script added in a later version, repository link removed, package unpublished, a removed name republished by someone else. **Why the distinction matters.** A rug pull is clean at review time by construction: the package collects installs for weeks, then ships the patch. Detecting that needs yesterday's snapshot to exist, which is why the series starts on 2026-07-30 and cannot be reconstructed after the fact. The registry's own moderation policy notes it relies on downstream consumers for this kind of check. **Free, no key, no account:** JSON and RSS feeds filterable to your own package list, a README badge, and webhook alerts. Every day's manifest of dataset digests is timestamped into Bitcoin via OpenTimestamps, so the series can be shown to have existed on a given date by anyone, without trusting us. Placed next to `polygraph` as the nearest precedent for an independent security project in this list. All links in the entry were checked before opening this PR. Nothing else in the file is touched. --- docs/community-projects.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/community-projects.md b/docs/community-projects.md index a177ad0..2708839 100644 --- a/docs/community-projects.md +++ b/docs/community-projects.md @@ -36,6 +36,7 @@ Self-hostable servers that implement the MCP Registry API specification. - [mcp-registry-cli](https://pypi.org/project/mcp-registry-cli/) - CLI tool to navigate the MCP registry servers - [OtherVibes/mcp-publish-action](https://github.com/OtherVibes/mcp-publish-action) - GitHub Action for publishing MCP servers to the official registry - [polygraph](https://polygraph.so) - Independent behavioral security grades (A–F) for MCP servers from an open, reproducible harness, published as an adoption-ranked index with per-server reports +- [PulseFeed MCP Drift Watch](https://pulsefeed.dev/mcp/drift) - Daily external diff of the whole registry population, recording what changed in a server *after* it was listed: package ownership transferred, install script added in a later version, repository removed, package unpublished, a removed name republished by someone else. Free JSON/RSS feed filterable to your own packages, a README badge, and webhook alerts; series runs from 2026-07-30 and each day's manifest is timestamped into Bitcoin. ## Adding Your Project From d3fbdc61ce48bae51c6014ffdd442522cef72a7c Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Sat, 5 Sep 2026 22:48:16 +0300 Subject: [PATCH 306/313] ci: detect more invalid server publish paths (#1620) ## Summary - detect publish attempts under `data/data/servers/` - detect server-looking JSON files directly under `data/` - keep the stage-one and privileged stage-two classifiers in sync ## Testing - verified both new patterns against PRs #1600 and #1589 - verified ordinary files such as `data/example.json` remain unmatched - ran `git diff --check` --- .github/workflows/close-invalid-publish-prs.yml | 2 ++ .github/workflows/detect-invalid-publish-prs.yml | 2 ++ 2 files changed, 4 insertions(+) diff --git a/.github/workflows/close-invalid-publish-prs.yml b/.github/workflows/close-invalid-publish-prs.yml index 8666c3b..53ce498 100644 --- a/.github/workflows/close-invalid-publish-prs.yml +++ b/.github/workflows/close-invalid-publish-prs.yml @@ -127,6 +127,8 @@ jobs: for f in "${FILES[@]}"; do if [[ "$f" == servers/* \ || "$f" == data/servers/* \ + || "$f" == data/data/servers/* \ + || "$f" =~ ^data/[^/]*server\.json$ \ || "$f" == "data/seed.json" \ || "$f" == "server.json" \ || "$f" == "servers.json" ]]; then diff --git a/.github/workflows/detect-invalid-publish-prs.yml b/.github/workflows/detect-invalid-publish-prs.yml index c200f86..816e169 100644 --- a/.github/workflows/detect-invalid-publish-prs.yml +++ b/.github/workflows/detect-invalid-publish-prs.yml @@ -63,6 +63,8 @@ jobs: for f in "${FILES[@]}"; do if [[ "$f" == servers/* \ || "$f" == data/servers/* \ + || "$f" == data/data/servers/* \ + || "$f" =~ ^data/[^/]*server\.json$ \ || "$f" == "data/seed.json" \ || "$f" == "server.json" \ || "$f" == "servers.json" ]]; then From 068a97a2f8b60d24dc62886bbe92f4257666cd35 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Sun, 6 Sep 2026 00:18:27 +0300 Subject: [PATCH 307/313] fix: identify submitted server version in publish diagnostics (#1621) Publishing a manifest with a stale version currently produces a duplicate-version error without identifying the version that was submitted. This made a request containing `0.4.5` look like a rejected publication of `0.4.6` in #1615. Include the submitted `name@version` in the CLI output before sending the request and in the API duplicate-version error. HTTP 400, the response structure, and duplicate-rejection behavior remain unchanged. The service wraps the existing error sentinel so `errors.Is` continues to work. Adds a CLI regression test for a failed publication and updates the API duplicate-error assertion. Validation: - Publish command tests passed (`go test ./cmd/publisher/commands -run TestPublishCommand -count=1`). - `git diff --check` passed. - API endpoint tests were attempted but could not run because PostgreSQL was unavailable on localhost:5432; Docker was also unavailable locally. Related to #1615. --- cmd/publisher/commands/publish.go | 2 +- cmd/publisher/commands/publish_test.go | 30 ++++++++++++++++++++++++ internal/api/handlers/v0/publish_test.go | 4 ++-- internal/service/registry_service.go | 2 +- 4 files changed, 34 insertions(+), 4 deletions(-) diff --git a/cmd/publisher/commands/publish.go b/cmd/publisher/commands/publish.go index 902c421..cccf2c8 100644 --- a/cmd/publisher/commands/publish.go +++ b/cmd/publisher/commands/publish.go @@ -64,7 +64,7 @@ func PublishCommand(args []string) error { } // Publish to registry - _, _ = fmt.Fprintf(os.Stdout, "Publishing to %s...\n", registryURL) + _, _ = fmt.Fprintf(os.Stdout, "Publishing %s@%s to %s...\n", serverJSON.Name, serverJSON.Version, registryURL) response, statusCode, err := publishToRegistry(registryURL, serverData, token) if err != nil { // If publish failed with 422, call validate endpoint to show detailed errors diff --git a/cmd/publisher/commands/publish_test.go b/cmd/publisher/commands/publish_test.go index 98c19a3..745198d 100644 --- a/cmd/publisher/commands/publish_test.go +++ b/cmd/publisher/commands/publish_test.go @@ -39,6 +39,36 @@ func TestPublishCommand_Success(t *testing.T) { assert.NoError(t, err) } +func TestPublishCommand_PrintsSubmittedIdentityOnFailure(t *testing.T) { + server := SetupMockRegistryServer(t, func(w http.ResponseWriter, _ *http.Request) { + http.Error(w, "duplicate version", http.StatusBadRequest) + }, nil) + SetupTestToken(t, server.URL, "test-token") + CreateTestServerJSON(t, apiv0.ServerJSON{ + Schema: model.CurrentSchemaURL, + Name: "io.github.BargLabs/cejel", + Description: "A test server", + Version: "0.4.5", + }) + + output, err := os.CreateTemp(t.TempDir(), "stdout") + require.NoError(t, err) + originalStdout := os.Stdout + os.Stdout = output + t.Cleanup(func() { + os.Stdout = originalStdout + _ = output.Close() + }) + + err = commands.PublishCommand(nil) + require.ErrorContains(t, err, "duplicate version") + _, err = output.Seek(0, io.SeekStart) + require.NoError(t, err) + data, err := io.ReadAll(output) + require.NoError(t, err) + assert.Equal(t, "Publishing io.github.BargLabs/cejel@0.4.5 to "+server.URL+"...\n", string(data)) +} + func TestPublishCommand_PreservesNonASCIIDescription(t *testing.T) { server := SetupMockRegistryServer(t, func(w http.ResponseWriter, r *http.Request) { diff --git a/internal/api/handlers/v0/publish_test.go b/internal/api/handlers/v0/publish_test.go index 94502be..6b5c68c 100644 --- a/internal/api/handlers/v0/publish_test.go +++ b/internal/api/handlers/v0/publish_test.go @@ -168,7 +168,7 @@ func TestPublishEndpoint(t *testing.T) { expectedError: "You do not have permission to publish this server", }, { - name: "registry service error", + name: "duplicate version includes submitted server identity", requestBody: apiv0.ServerJSON{ Schema: model.CurrentSchemaURL, Name: "example/test-server", @@ -202,7 +202,7 @@ func TestPublishEndpoint(t *testing.T) { _, _ = registry.CreateServer(context.Background(), &existingServer) }, expectedStatus: http.StatusBadRequest, - expectedError: "invalid version: cannot publish duplicate version", + expectedError: "invalid version: cannot publish duplicate version: example/test-server@1.0.0 already exists", }, { name: "package validation success - MCPB package", diff --git a/internal/service/registry_service.go b/internal/service/registry_service.go index 16a9100..4bf6e19 100644 --- a/internal/service/registry_service.go +++ b/internal/service/registry_service.go @@ -190,7 +190,7 @@ func (s *registryServiceImpl) createServerInTransaction(ctx context.Context, tx return e } if versionExists { - return database.ErrInvalidVersion + return fmt.Errorf("%w: %s@%s already exists", database.ErrInvalidVersion, serverJSON.Name, serverJSON.Version) } currentLatest, e = s.db.GetCurrentLatestVersion(ctx, tx, serverJSON.Name) if e != nil && !errors.Is(e, database.ErrNotFound) { From dd4b2939e3e946ba0e5c42cdd1f5a9eb96e7628b Mon Sep 17 00:00:00 2001 From: Jeff Wainwright <1074042+yowainwright@users.noreply.github.com> Date: Sat, 5 Sep 2026 14:31:12 -0700 Subject: [PATCH 308/313] test: isolates temp test fixtures (#1569) ## Motivation and Context Replace shared temp paths with `t.TempDir()`` so each test gets its own cleanup-scoped directory. - This avoids leftover files and cross-test interference. No production code changed. ## How Has This Been Tested? GitHub CI passed. - https://github.com/yowainwright/registry/pull/1 ## Breaking Changes No breaking changes; just tests. ## Types of changes - [x] chore ## Checklist - [x] I have read the [MCP Documentation](https://modelcontextprotocol.io) - [x] My code follows the repository's style guidelines - [x] New and existing tests pass locally - [x] I have added appropriate error handling - [x] I have added or updated documentation as needed ## Additional context Small test-only cleanup. No production code paths are changed. Co-authored-by: Radoslav Dimitrov --- cmd/publisher/commands/testutil_test.go | 4 +--- cmd/publisher/commands/validate_test.go | 13 ++++------ internal/importer/importer_test.go | 32 +++++++++---------------- 3 files changed, 16 insertions(+), 33 deletions(-) diff --git a/cmd/publisher/commands/testutil_test.go b/cmd/publisher/commands/testutil_test.go index 416b192..c103f82 100644 --- a/cmd/publisher/commands/testutil_test.go +++ b/cmd/publisher/commands/testutil_test.go @@ -95,9 +95,7 @@ func SetupTestToken(t *testing.T, registryURL, token string) string { func CreateTestServerJSON(t *testing.T, serverJSON apiv0.ServerJSON) (string, string) { t.Helper() - tempDir, err := os.MkdirTemp("", "mcp-publisher-test") - require.NoError(t, err) - t.Cleanup(func() { os.RemoveAll(tempDir) }) + tempDir := t.TempDir() jsonData, err := json.MarshalIndent(serverJSON, "", " ") require.NoError(t, err) diff --git a/cmd/publisher/commands/validate_test.go b/cmd/publisher/commands/validate_test.go index b56b22d..1827ffe 100644 --- a/cmd/publisher/commands/validate_test.go +++ b/cmd/publisher/commands/validate_test.go @@ -140,16 +140,13 @@ func TestValidateCommand_NoServerFile(t *testing.T) { server := SetupMockRegistryServer(t, nil, nil) SetupTestToken(t, server.URL, "test-token") - // Don't create server.json - tempDir, err := os.MkdirTemp("", "mcp-publisher-test") - require.NoError(t, err) - defer os.RemoveAll(tempDir) + tempDir := t.TempDir() originalDir, err := os.Getwd() require.NoError(t, err) defer func() { _ = os.Chdir(originalDir) }() - _ = os.Chdir(tempDir) + require.NoError(t, os.Chdir(tempDir)) err = commands.ValidateCommand([]string{}) @@ -161,15 +158,13 @@ func TestValidateCommand_InvalidJSON(t *testing.T) { server := SetupMockRegistryServer(t, nil, nil) SetupTestToken(t, server.URL, "test-token") - tempDir, err := os.MkdirTemp("", "mcp-publisher-test") - require.NoError(t, err) - defer os.RemoveAll(tempDir) + tempDir := t.TempDir() originalDir, err := os.Getwd() require.NoError(t, err) defer func() { _ = os.Chdir(originalDir) }() - _ = os.Chdir(tempDir) + require.NoError(t, os.Chdir(tempDir)) // Create invalid JSON file err = os.WriteFile("server.json", []byte("{ invalid json }"), 0600) diff --git a/internal/importer/importer_test.go b/internal/importer/importer_test.go index db0cc2a..ed5ed05 100644 --- a/internal/importer/importer_test.go +++ b/internal/importer/importer_test.go @@ -20,8 +20,7 @@ import ( ) func TestImportService_LocalFile(t *testing.T) { - // Create a temporary seed file - tempFile := filepath.Join(os.TempDir(), "test_import_seed.json") + tempFile := filepath.Join(t.TempDir(), "test_import_seed.json") seedData := []*apiv0.ServerJSON{ { Schema: model.CurrentSchemaURL, @@ -41,7 +40,6 @@ func TestImportService_LocalFile(t *testing.T) { err = os.WriteFile(tempFile, jsonData, 0600) require.NoError(t, err) - defer os.Remove(tempFile) // Create registry service testDB := database.NewTestDB(t) @@ -187,6 +185,14 @@ func TestImportService_ErrorHandling(t *testing.T) { registryService := service.NewRegistryService(testDB, &config.Config{EnableRegistryValidation: false}) importerService := importer.NewService(registryService) + errorDir := t.TempDir() + missingFile := filepath.Join(errorDir, "non-existent-file.json") + invalidFile := filepath.Join(errorDir, "invalid.json") + + invalidJSON := []byte("{invalid json}") + err := os.WriteFile(invalidFile, invalidJSON, 0600) + require.NoError(t, err) + tests := []struct { name string path string @@ -195,13 +201,13 @@ func TestImportService_ErrorHandling(t *testing.T) { }{ { name: "non-existent local file", - path: "/tmp/non-existent-file.json", + path: missingFile, expectError: true, errorMsg: "failed to read seed data", }, { name: "invalid JSON file", - path: "/tmp/invalid.json", + path: invalidFile, expectError: true, errorMsg: "failed to read seed data", }, @@ -213,22 +219,6 @@ func TestImportService_ErrorHandling(t *testing.T) { }, } - // Create invalid JSON file for testing - invalidJSON := []byte("{invalid json}") - tempFile, err := os.CreateTemp("", "invalid-*.json") - require.NoError(t, err) - defer os.Remove(tempFile.Name()) - err = os.WriteFile(tempFile.Name(), invalidJSON, 0600) - require.NoError(t, err) - - // Update test case to use temp file - for i := range tests { - if tests[i].path == "/tmp/invalid.json" { - tests[i].path = tempFile.Name() - break - } - } - for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { err := importerService.ImportFromPath(context.Background(), tt.path) From 739b70e8bc1bea203c5a35ab699f1df51d091568 Mon Sep 17 00:00:00 2001 From: Radoslav Dimitrov Date: Sun, 6 Sep 2026 01:13:09 +0300 Subject: [PATCH 309/313] fix: fail safely in registry admin scripts (#1622) The takedown script previously treated any nonempty `ALL_VERSIONS` value, including `false`, as permission to delete every version. Require exactly `true` when the variable is set, and reject other values before sending a request. Enable strict shell error handling in the auth helper so a failed identity-token command stops execution before exchanging an empty token. Validation: `bash -n` and `git diff --check` passed. Mocked command checks confirmed that `false`, `1`, and `TRUE` are rejected before network access, and that identity-token retrieval failure stops before the token exchange. The updated scripts also completed the authorized takedown associated with #1563; public API reads confirmed the deleted record and removal from default results. --- tools/admin/auth.sh | 14 ++++++++++---- tools/admin/takedown.sh | 4 ++++ 2 files changed, 14 insertions(+), 4 deletions(-) diff --git a/tools/admin/auth.sh b/tools/admin/auth.sh index 1d4324b..8062e44 100755 --- a/tools/admin/auth.sh +++ b/tools/admin/auth.sh @@ -1,6 +1,8 @@ #!/bin/bash # Simple OIDC authentication helper using gcloud +set -euo pipefail + REGISTRY_URL="${REGISTRY_URL:-https://registry.modelcontextprotocol.io}" if ! gcloud projects list &> /dev/null; then @@ -11,19 +13,23 @@ fi OIDC_TOKEN=$(gcloud auth print-identity-token) # Exchange for registry token -RESPONSE=$(curl -s -X POST "${REGISTRY_URL}/v0/auth/oidc" \ +RESPONSE=$(curl -sS -X POST "${REGISTRY_URL}/v0/auth/oidc" \ -H "Content-Type: application/json" \ -d "{\"oidc_token\": \"${OIDC_TOKEN}\"}") # Check if successful -REGISTRY_TOKEN=$(echo "$RESPONSE" | jq -r '.registry_token // empty') +if ! REGISTRY_TOKEN=$(printf '%s\n' "$RESPONSE" | jq -r '.registry_token // empty' 2>/dev/null); then + REGISTRY_TOKEN="" +fi if [ -z "$REGISTRY_TOKEN" ]; then echo "Error: Authentication failed" >&2 - echo "$RESPONSE" | jq '.' >&2 + if ! printf '%s\n' "$RESPONSE" | jq '.' >&2 2>/dev/null; then + printf '%s\n' "$RESPONSE" >&2 + fi exit 1 fi # Output the export command echo "# Successfully authenticated! Now run this to use your token:" >&2 -echo "export REGISTRY_TOKEN='${REGISTRY_TOKEN}'" \ No newline at end of file +echo "export REGISTRY_TOKEN='${REGISTRY_TOKEN}'" diff --git a/tools/admin/takedown.sh b/tools/admin/takedown.sh index d6b7dff..f9fceed 100755 --- a/tools/admin/takedown.sh +++ b/tools/admin/takedown.sh @@ -34,6 +34,10 @@ fi # Require an explicit choice, so that a forgotten VERSION cannot silently take # down every version of a server. +if [ -n "$ALL_VERSIONS" ] && [ "$ALL_VERSIONS" != "true" ]; then + echo "Error: ALL_VERSIONS must be exactly true when set." >&2 + exit 1 +fi if [ -n "$VERSION" ] && [ -n "$ALL_VERSIONS" ]; then echo "Error: set either VERSION or ALL_VERSIONS, not both." >&2 exit 1 From c7411aeababbc05d733b6dc6cb24c61a4213d08e Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 16 Sep 2026 18:01:34 +0300 Subject: [PATCH 310/313] build(deps): bump the go-dependencies group with 2 updates (#1634) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps the go-dependencies group with 2 updates: [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) and [golang.org/x/mod](https://github.com/golang/mod). Updates `github.com/google/go-containerregistry` from 0.22.0 to 0.22.1
        Release notes

        Sourced from github.com/google/go-containerregistry's releases.

        v0.22.1

        What's Changed

        New Contributors

        Full Changelog: https://github.com/google/go-containerregistry/compare/v0.22.0...v0.22.1

        Commits
        • 8a72a42 remote: copy manifest annotations to referrers fallback tag descriptors (#2441)
        • 5765c35 build(deps): bump the go-deps group across 2 directories with 3 updates (#2439)
        • 969402f fix(mutate): make Time layer updates lazy (#2429)
        • 25c682e flatten: preserve config and layer media types when flattening (#2438)
        • 79af990 remote: add SSRF redirect protection to writer-side HTTP clients (#2432)
        • 4b9b3c7 fix(release): honor declared Go toolchain (#2435)
        • e033b9c fix(build): install binaries to /ko-app and add to PATH (#2424) (#2436)
        • 8bd7902 name: return a helpful error when a reference contains a URL scheme (#2431)
        • 163134d validate: support index attestation manifests and empty configs (#2414)
        • 44f7ea3 fix(build): Use dependencies.gitSource in cloudbuild_v2.yaml (#2434)
        • Additional commits viewable in compare view

        Updates `golang.org/x/mod` from 0.40.0 to 0.41.0
        Commits
        • d0a27b2 modfile: fix Cleanup and DropTool documentation
        • d12008c all: upgrade go directive to at least 1.26.0 [generated]
        • See full diff in compare view

        Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
        Dependabot commands and options
        You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
        Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- go.mod | 6 +++--- go.sum | 8 ++++---- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/go.mod b/go.mod index 3c08ceb..b482a15 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/modelcontextprotocol/registry -go 1.26 +go 1.26.0 require ( cloud.google.com/go/kms v1.33.0 @@ -10,7 +10,7 @@ require ( github.com/coreos/go-oidc/v3 v3.21.0 github.com/danielgtaylor/huma/v2 v2.39.1 github.com/golang-jwt/jwt/v5 v5.3.1 - github.com/google/go-containerregistry v0.22.0 + github.com/google/go-containerregistry v0.22.1 github.com/jackc/pgx/v5 v5.10.0 github.com/prometheus/client_golang v1.24.1 github.com/rs/cors v1.11.1 @@ -22,7 +22,7 @@ require ( go.opentelemetry.io/otel/metric v1.46.0 go.opentelemetry.io/otel/sdk v1.46.0 go.opentelemetry.io/otel/sdk/metric v1.46.0 - golang.org/x/mod v0.40.0 + golang.org/x/mod v0.41.0 gopkg.in/yaml.v3 v3.0.1 ) diff --git a/go.sum b/go.sum index 0ca4b4d..2a677e7 100644 --- a/go.sum +++ b/go.sum @@ -70,8 +70,8 @@ github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps= github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= -github.com/google/go-containerregistry v0.22.0 h1:eGbCiPeYxAH/7WLLq6zTBALP0tUIFsoyRauhxXDJ53I= -github.com/google/go-containerregistry v0.22.0/go.mod h1:bJR35SK8XgisYmhg/FMQ/5RK0S/XrOAqLBV5/LR2XE0= +github.com/google/go-containerregistry v0.22.1 h1:RZuuSYhTvlDvtsK+NkutoCZ//C0X2ebLK8X8l3ULs84= +github.com/google/go-containerregistry v0.22.1/go.mod h1:bJR35SK8XgisYmhg/FMQ/5RK0S/XrOAqLBV5/LR2XE0= github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0= github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= @@ -164,8 +164,8 @@ go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw= go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg= golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M= golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis= -golang.org/x/mod v0.40.0 h1:hUv+3cXcdRHz08UmSiOob7sadHig73uo5bkXxQ/tvUs= -golang.org/x/mod v0.40.0/go.mod h1:0/weTWkPWGBikyTWAX3dkjVztMmBA5hM0DH6BElSupE= +golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c= +golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o= golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To= golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU= golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= From cabf0607b61a37c5be163dce3309dd7a5b9928ce Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 16 Sep 2026 18:02:08 +0300 Subject: [PATCH 311/313] build(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 in /deploy (#1630) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.83.1 to 1.83.2.
        Release notes

        Sourced from google.golang.org/grpc's releases.

        Release 1.83.2

        Security

        • server: Reject requests missing both :authority and Host headers with HTTP 400 and status Internal. (grpc/grpc-go#9365)
        Commits

        [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google.golang.org/grpc&package-manager=go_modules&previous-version=1.83.1&new-version=1.83.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
        Dependabot commands and options
        You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/modelcontextprotocol/registry/network/alerts).
        Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- deploy/go.mod | 2 +- deploy/go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/deploy/go.mod b/deploy/go.mod index c989c83..031069c 100644 --- a/deploy/go.mod +++ b/deploy/go.mod @@ -114,7 +114,7 @@ require ( golang.org/x/tools v0.48.0 // indirect google.golang.org/genproto/googleapis/api v0.0.0-20260819154853-08b0e4226688 // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688 // indirect - google.golang.org/grpc v1.83.1 // indirect + google.golang.org/grpc v1.83.2 // indirect google.golang.org/protobuf v1.36.12 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect lukechampine.com/frand v1.5.1 // indirect diff --git a/deploy/go.sum b/deploy/go.sum index 032a0f1..14ce36c 100644 --- a/deploy/go.sum +++ b/deploy/go.sum @@ -318,8 +318,8 @@ google.golang.org/genproto/googleapis/api v0.0.0-20260819154853-08b0e4226688 h1: google.golang.org/genproto/googleapis/api v0.0.0-20260819154853-08b0e4226688/go.mod h1:1RJ9BQGyNdZwkGc1eTqkErfRZ6RJyYPHZo73BZ1vQqI= google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688 h1:cYNAzI2sUwhmCcoj9TxvihSrqsxt6uIkj3rDRhSDmW4= google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688/go.mod h1:DjtHYE8FKJLivXcBEjGwndXfIC23G0VpXiXKqG179uA= -google.golang.org/grpc v1.83.1 h1:HIO0+BEtBP6soyqvqC8sNUjZ7bTs+0hFQuFF+RAy++Y= -google.golang.org/grpc v1.83.1/go.mod h1:kDyl6SKsiHKt0uylY5gtn5cEjkrIOhQOGDgIc4JGwzQ= +google.golang.org/grpc v1.83.2 h1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU= +google.golang.org/grpc v1.83.2/go.mod h1:YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8= google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc= google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= From 73aebc1526a3dc165e9492233e16a5de838abc95 Mon Sep 17 00:00:00 2001 From: Ishan Gupta <62565307+developer-ishan@users.noreply.github.com> Date: Wed, 16 Sep 2026 20:44:51 +0530 Subject: [PATCH 312/313] fix(publisher): treat GitHub device-flow `slow_down` as retriable (#1290) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## Summary - Handle GitHub's OAuth device-flow `slow_down` response per [RFC 8628 §3.5](https://datatracker.ietf.org/doc/html/rfc8628#section-3.5) — treat it as retriable and bump the polling interval by 5 seconds, instead of bailing with a fatal error. Fixes #1289. ## Why `pollForToken` in `cmd/publisher/auth/github-at.go` only treats `authorization_pending` as retriable. Every other response from GitHub's token endpoint — including the non-terminal `slow_down` signal — falls through to: ```go return "", fmt.Errorf("token request failed: %s", tokenResp.Error) ``` So users hitting GitHub's polling rate-limit get: ``` Error: login failed: error polling for token: token request failed: slow_down ``` …and have to re-run `mcp-publisher login github` from scratch, which is especially painful because `slow_down` is more likely when the user takes more than a few seconds to enter and authorize the device code. Per RFC 8628 §3.5, `slow_down` is defined as: > A variant of "authorization_pending", the authorization request is still pending and polling should continue, but the interval MUST be increased by 5 seconds for this and all subsequent requests. ## Change Treat `slow_down` the same as `authorization_pending` but increase `interval` by 5 seconds before sleeping, matching the RFC exactly. A possible follow-up (not in this PR, to keep the diff minimal): seed the initial `interval` from `DeviceCodeResponse.Interval` (already parsed but currently unused) instead of hardcoding `5`. Happy to do that here or as a separate PR if preferred. ## Test plan - [x] `go build ./cmd/publisher/...` — clean - [x] `go test ./cmd/publisher/auth/...` — passes - [x] `gofmt -d` and `go vet ./cmd/publisher/auth/...` — clean - [ ] CI `make check` (lint + integration tests) I could not exercise `pollForToken` from a unit test without refactoring `GitHubAccessTokenURL` to be injectable, which felt out of scope for a bug-fix PR. Glad to add that refactor + a table-driven test for `authorization_pending` / `slow_down` / fatal errors in a follow-up if maintainers want it. --------- Co-authored-by: developer-ishan Co-authored-by: Claude Opus 4.8 (1M context) --- cmd/publisher/auth/github-at.go | 46 +++++- .../auth/github_at_poll_internal_test.go | 131 ++++++++++++++++++ 2 files changed, 170 insertions(+), 7 deletions(-) create mode 100644 cmd/publisher/auth/github_at_poll_internal_test.go diff --git a/cmd/publisher/auth/github-at.go b/cmd/publisher/auth/github-at.go index 3e53529..0da68a4 100644 --- a/cmd/publisher/auth/github-at.go +++ b/cmd/publisher/auth/github-at.go @@ -17,6 +17,17 @@ const ( GitHubAccessTokenURL = "https://github.com/login/oauth/access_token" // #nosec:G101 ) +const ( + // defaultPollInterval is the initial device-flow polling interval in + // seconds, per RFC 8628 §3.5. + defaultPollInterval = 5 + // maxPollInterval caps how large the polling interval may grow. RFC 8628 + // §3.5 mandates a 5-second increase on each slow_down but leaves the + // maximum to the implementation; this prevents a misbehaving auth server + // from growing the interval unboundedly. + maxPollInterval = 60 +) + // DeviceCodeResponse represents the response from GitHub's device code endpoint type DeviceCodeResponse struct { DeviceCode string `json:"device_code"` @@ -46,6 +57,16 @@ type GitHubATProvider struct { registryURL string providedToken string // Token provided via --token flag or MCP_GITHUB_TOKEN env var githubToken string // In-memory GitHub token set by Login() + + // accessTokenURL is the GitHub access-token polling endpoint. It is a field + // (rather than the package constant) so tests can point it at a mock server. + accessTokenURL string + // pollInterval is the initial polling interval in seconds. Defaults to + // defaultPollInterval; overridable in tests to avoid real delays. + pollInterval int + // sleep abstracts time.Sleep so tests can run without real delays and + // assert the back-off sequence. Defaults to time.Sleep. + sleep func(time.Duration) } // ServerHealthResponse represents the response from the health endpoint @@ -62,8 +83,11 @@ func NewGitHubATProvider(registryURL, token string) Provider { } return &GitHubATProvider{ - registryURL: registryURL, - providedToken: token, + registryURL: registryURL, + providedToken: token, + accessTokenURL: GitHubAccessTokenURL, + pollInterval: defaultPollInterval, + sleep: time.Sleep, } } @@ -199,12 +223,12 @@ func (g *GitHubATProvider) pollForToken(ctx context.Context, deviceCode string) } // Default polling interval and expiration time - interval := 5 // seconds + interval := g.pollInterval expiresIn := 900 // 15 minutes deadline := time.Now().Add(time.Duration(expiresIn) * time.Second) for time.Now().Before(deadline) { - req, err := http.NewRequestWithContext(ctx, http.MethodPost, GitHubAccessTokenURL, bytes.NewBuffer(jsonData)) + req, err := http.NewRequestWithContext(ctx, http.MethodPost, g.accessTokenURL, bytes.NewBuffer(jsonData)) if err != nil { return "", err } @@ -229,9 +253,17 @@ func (g *GitHubATProvider) pollForToken(ctx context.Context, deviceCode string) return "", err } - if tokenResp.Error == "authorization_pending" { - // User hasn't authorized yet, wait and retry - time.Sleep(time.Duration(interval) * time.Second) + // Per RFC 8628 §3.5, both authorization_pending and slow_down indicate + // the client should keep polling. slow_down additionally requires that + // the polling interval be increased by 5 seconds. + if tokenResp.Error == "authorization_pending" || tokenResp.Error == "slow_down" { + if tokenResp.Error == "slow_down" { + interval += 5 + if interval > maxPollInterval { + interval = maxPollInterval + } + } + g.sleep(time.Duration(interval) * time.Second) continue } diff --git a/cmd/publisher/auth/github_at_poll_internal_test.go b/cmd/publisher/auth/github_at_poll_internal_test.go new file mode 100644 index 0000000..41de749 --- /dev/null +++ b/cmd/publisher/auth/github_at_poll_internal_test.go @@ -0,0 +1,131 @@ +package auth + +import ( + "context" + "encoding/json" + "net/http" + "net/http/httptest" + "testing" + "time" + + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +// newMockTokenServer returns an httptest.Server that serves the given sequence +// of AccessTokenResponse values, one per request. Once the sequence is +// exhausted the final response is reused for any extra requests. +func newMockTokenServer(t *testing.T, responses []AccessTokenResponse) *httptest.Server { + t.Helper() + var i int + srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) { + resp := responses[len(responses)-1] + if i < len(responses) { + resp = responses[i] + } + i++ + w.Header().Set("Content-Type", "application/json") + _ = json.NewEncoder(w).Encode(resp) // #nosec G117 -- test fixture token, not a real secret + })) + t.Cleanup(srv.Close) + return srv +} + +// newPollTestProvider builds a provider wired to a mock token endpoint. The +// initial poll interval is 0 (so the back-off starts from a known base) and +// sleeps are captured rather than performed, making the tests deterministic and +// instant. The returned slice records every interval passed to sleep. +func newPollTestProvider(tokenURL string) (*GitHubATProvider, *[]time.Duration) { + slept := &[]time.Duration{} + p := &GitHubATProvider{ + clientID: "test-client-id", + accessTokenURL: tokenURL, + pollInterval: 0, + sleep: func(d time.Duration) { *slept = append(*slept, d) }, + } + return p, slept +} + +// TestPollForToken_SlowDownThenSuccess confirms that a slow_down response is +// treated as retriable: polling continues and the success path is reached. +func TestPollForToken_SlowDownThenSuccess(t *testing.T) { + srv := newMockTokenServer(t, []AccessTokenResponse{ + {Error: "slow_down"}, + {AccessToken: "gh-token"}, + }) + p, slept := newPollTestProvider(srv.URL) + + token, err := p.pollForToken(context.Background(), "device-code") + require.NoError(t, err) + assert.Equal(t, "gh-token", token) + + // One slow_down => one back-off, interval bumped 0 -> 5. + require.Len(t, *slept, 1) + assert.Equal(t, 5*time.Second, (*slept)[0]) +} + +// TestPollForToken_MixedRetryableErrorsCompoundInterval confirms the interval +// increment compounds correctly across mixed retryable errors. Per RFC 8628 +// §3.5 the interval is increased by 5 seconds on each slow_down and is NOT +// reset between slow_down instances, while authorization_pending leaves it +// unchanged. +func TestPollForToken_MixedRetryableErrorsCompoundInterval(t *testing.T) { + srv := newMockTokenServer(t, []AccessTokenResponse{ + {Error: "slow_down"}, // 0 -> 5 + {Error: "authorization_pending"}, // stays 5 + {Error: "slow_down"}, // 5 -> 10 + {AccessToken: "gh-token"}, + }) + p, slept := newPollTestProvider(srv.URL) + + token, err := p.pollForToken(context.Background(), "device-code") + require.NoError(t, err) + assert.Equal(t, "gh-token", token) + + require.Len(t, *slept, 3) + assert.Equal(t, 5*time.Second, (*slept)[0]) // after first slow_down + assert.Equal(t, 5*time.Second, (*slept)[1]) // authorization_pending: unchanged + assert.Equal(t, 10*time.Second, (*slept)[2]) // second slow_down: compounded +} + +// TestPollForToken_IntervalCappedAtMax confirms the polling interval is capped +// so a misbehaving auth server returning slow_down repeatedly cannot grow it +// without bound. +func TestPollForToken_IntervalCappedAtMax(t *testing.T) { + // 13 slow_downs starting from interval 0 would otherwise reach 65s + // (5, 10, ..., 60, 65); the cap holds it at 60. + responses := make([]AccessTokenResponse, 0, 14) + for range [13]struct{}{} { + responses = append(responses, AccessTokenResponse{Error: "slow_down"}) + } + responses = append(responses, AccessTokenResponse{AccessToken: "gh-token"}) + + srv := newMockTokenServer(t, responses) + p, slept := newPollTestProvider(srv.URL) + + token, err := p.pollForToken(context.Background(), "device-code") + require.NoError(t, err) + assert.Equal(t, "gh-token", token) + + require.Len(t, *slept, 13) + for _, d := range *slept { + assert.LessOrEqual(t, d, time.Duration(maxPollInterval)*time.Second) + } + // The last two back-offs are both pinned at the cap. + assert.Equal(t, time.Duration(maxPollInterval)*time.Second, (*slept)[11]) + assert.Equal(t, time.Duration(maxPollInterval)*time.Second, (*slept)[12]) +} + +// TestPollForToken_FatalErrorStopsPolling confirms a non-retryable error ends +// polling immediately with an error. +func TestPollForToken_FatalErrorStopsPolling(t *testing.T) { + srv := newMockTokenServer(t, []AccessTokenResponse{ + {Error: "access_denied"}, + }) + p, slept := newPollTestProvider(srv.URL) + + _, err := p.pollForToken(context.Background(), "device-code") + require.Error(t, err) + assert.Contains(t, err.Error(), "access_denied") + assert.Empty(t, *slept, "fatal error should not trigger a back-off sleep") +} From d1dcaf3fb36338d45ccdba98b5b8aea915e7d50d Mon Sep 17 00:00:00 2001 From: Yusufhan Sacak <67666222+JosephDoUrden@users.noreply.github.com> Date: Wed, 16 Sep 2026 16:42:30 +0100 Subject: [PATCH 313/313] fix(publisher): tolerate transient device-flow failures during login polling (#1588) Follow-up to my analysis on #1543. Heads up on the shape first: this builds on #1290's poll-loop seams and github wont let me target a fork branch, so the diff shows its two commits too. Review only the last commit, the first two are #1290 unchanged, credit to @developer-ishan. Happy to rebase whichever way #1290 goes, or split differently if that's easier to review. What it does. pollForToken treats every non-pending answer as terminal, so one flaky response kills a login the user may already have approved in the browser. This spends a small grace budget (2 polls) on incorrect_device_code before giving up, retries 5xx with a growing backoff, and returns status plus body on other non-200s instead of dying inside json.Unmarshal on an html error page. Terminal errors now carry error_description and error_uri, and a timeout that happens after polling recovered reports a plain timeout, not a stale error from minutes earlier. Also honours the interval and expires_in GitHub returns with the device code (RFC 8628 3.2) instead of hardcoding 5/900, clamped (60s / 3600s) so a misbehaving response can't stall the CLI or overflow the duration math. One thing I changed my mind on from the issue comment: I wrote there that the client should wait one interval before the first poll. Dropped that. My own repro test showed 40s of clean polling before authorize, so the propagation theory doesn't hold, and the grace retry covers the same window without taxing every fast login. First poll stays immediate, pinned by a test. Root cause note: I can't prove the GitHub-side race (cli/cli#9302 is the same error class but was closed on an unconfirmed "platform race"). So this isn't claimed as a root-cause fix, it makes the login recoverable if the condition is transient and diagnosable if it isn't. Btw incorrect_device_code is a GitHub extension, not an RFC 8628 3.5 code, so there's no spec retry semantic being violated by the grace polls. ## Test 12 new tests in github_at_device_flow_internal_test.go, all green with -race (33 in the package). #1290's four tests pass unmodified. golangci-lint clean in the touched files under both v2.11.4 (this branch's CI pin) and v2.13.1 (what main pins now). ## AI Disclosure AI assistance (Claude) was used for issue research and during development. All changes were reviewed and tested by the author. Fixes #1543 --------- Co-authored-by: developer-ishan Co-authored-by: Ishan Gupta <62565307+developer-ishan@users.noreply.github.com> Co-authored-by: developer-ishan Co-authored-by: Claude Opus 4.8 (1M context) Co-authored-by: Radoslav Dimitrov Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- cmd/publisher/auth/github-at.go | 129 ++++- .../github_at_device_flow_internal_test.go | 532 ++++++++++++++++++ docs/reference/cli/commands.md | 4 + 3 files changed, 658 insertions(+), 7 deletions(-) create mode 100644 cmd/publisher/auth/github_at_device_flow_internal_test.go diff --git a/cmd/publisher/auth/github-at.go b/cmd/publisher/auth/github-at.go index 0da68a4..fef3774 100644 --- a/cmd/publisher/auth/github-at.go +++ b/cmd/publisher/auth/github-at.go @@ -26,6 +26,20 @@ const ( // maximum to the implementation; this prevents a misbehaving auth server // from growing the interval unboundedly. maxPollInterval = 60 + // defaultExpiresIn is the device-code lifetime in seconds used when the + // device-code response omits expires_in. + defaultExpiresIn = 900 + // maxExpiresIn caps the device-code lifetime a response may claim. It sits + // well past GitHub's documented 15 minutes; the cap stops a misbehaving or + // hostile response from pushing the deadline (and the polling loop) far + // into the future. + maxExpiresIn = 3600 + // incorrectDeviceCodeGraceRetries is the total number of extra polls a + // single login may spend on incorrect_device_code before giving up — a + // budget for the whole login, not per occurrence. cli/cli#9302 reports the + // same error for a code that had just been issued; a genuinely invalid code + // still fails, only a few seconds later. + incorrectDeviceCodeGraceRetries = 2 ) // DeviceCodeResponse represents the response from GitHub's device code endpoint @@ -43,6 +57,38 @@ type AccessTokenResponse struct { TokenType string `json:"token_type"` Scope string `json:"scope"` Error string `json:"error,omitempty"` + // ErrorDescription and ErrorURI accompany Error in GitHub's responses; + // surfacing them turns opaque failures like "incorrect_device_code" into + // diagnosable reports. + ErrorDescription string `json:"error_description,omitempty"` + ErrorURI string `json:"error_uri,omitempty"` +} + +// errorDetail renders Error together with any error_description and error_uri +// GitHub returned, so failures reach the user diagnosable rather than opaque. +func (r AccessTokenResponse) errorDetail() string { + detail := r.Error + if r.ErrorDescription != "" { + detail += ": " + r.ErrorDescription + } + if r.ErrorURI != "" { + detail += " (" + r.ErrorURI + ")" + } + return detail +} + +func decodeAccessTokenResponse(statusCode int, body []byte) (AccessTokenResponse, error) { + var tokenResp AccessTokenResponse + // OAuth errors may use HTTP 400 (RFC 6749 §5.2), not just HTTP 200. + if statusCode != http.StatusOK && statusCode != http.StatusBadRequest { + return tokenResp, fmt.Errorf("token endpoint returned %d: %s", statusCode, body) + } + + err := json.Unmarshal(body, &tokenResp) + if statusCode == http.StatusBadRequest && (err != nil || tokenResp.Error == "") { + return tokenResp, fmt.Errorf("token endpoint returned %d: %s", statusCode, body) + } + return tokenResp, err } // RegistryTokenResponse represents the response from registry's token exchange endpoint @@ -61,9 +107,17 @@ type GitHubATProvider struct { // accessTokenURL is the GitHub access-token polling endpoint. It is a field // (rather than the package constant) so tests can point it at a mock server. accessTokenURL string + // deviceCodeURL is the GitHub device-code endpoint, a field for the same + // reason as accessTokenURL. + deviceCodeURL string // pollInterval is the initial polling interval in seconds. Defaults to - // defaultPollInterval; overridable in tests to avoid real delays. + // defaultPollInterval; overridable in tests to avoid real delays. Updated + // from the device-code response's interval when GitHub returns one. pollInterval int + // expiresIn is the device-code lifetime in seconds. Defaults to + // defaultExpiresIn; updated from the device-code response's expires_in + // when GitHub returns one. + expiresIn int // sleep abstracts time.Sleep so tests can run without real delays and // assert the back-off sequence. Defaults to time.Sleep. sleep func(time.Duration) @@ -86,7 +140,9 @@ func NewGitHubATProvider(registryURL, token string) Provider { registryURL: registryURL, providedToken: token, accessTokenURL: GitHubAccessTokenURL, + deviceCodeURL: GitHubDeviceCodeURL, pollInterval: defaultPollInterval, + expiresIn: defaultExpiresIn, sleep: time.Sleep, } } @@ -173,7 +229,7 @@ func (g *GitHubATProvider) requestDeviceCode(ctx context.Context) (string, strin return "", "", "", err } - req, err := http.NewRequestWithContext(ctx, http.MethodPost, GitHubDeviceCodeURL, bytes.NewBuffer(jsonData)) + req, err := http.NewRequestWithContext(ctx, http.MethodPost, g.deviceCodeURL, bytes.NewBuffer(jsonData)) if err != nil { return "", "", "", err } @@ -202,6 +258,21 @@ func (g *GitHubATProvider) requestDeviceCode(ctx context.Context) (string, strin return "", "", "", err } + // Per RFC 8628 §3.2 interval and expires_in are bound to this device code, + // so reset any pacing left over from a previous code before adopting them. + // Clamp both: a hostile or buggy response must not grow the interval past + // maxPollInterval (the invariant maxPollInterval exists for) nor push the + // deadline unboundedly into the future, and clamping also keeps the + // derived time.Duration well clear of int64 overflow. + g.pollInterval = defaultPollInterval + g.expiresIn = defaultExpiresIn + if deviceCodeResp.Interval > 0 { + g.pollInterval = min(deviceCodeResp.Interval, maxPollInterval) + } + if deviceCodeResp.ExpiresIn > 0 { + g.expiresIn = min(deviceCodeResp.ExpiresIn, maxExpiresIn) + } + return deviceCodeResp.DeviceCode, deviceCodeResp.UserCode, deviceCodeResp.VerificationURI, nil } @@ -222,11 +293,26 @@ func (g *GitHubATProvider) pollForToken(ctx context.Context, deviceCode string) return "", err } - // Default polling interval and expiration time + // Pacing comes from the device-code response (via requestDeviceCode), + // falling back to GitHub's documented defaults. interval := g.pollInterval - expiresIn := 900 // 15 minutes + expiresIn := g.expiresIn + // Zero-value fallback: providers built directly rather than through + // requestDeviceCode (the test seam) carry no lifetime. Keep this guard. + if expiresIn <= 0 { + expiresIn = defaultExpiresIn + } deadline := time.Now().Add(time.Duration(expiresIn) * time.Second) + graceRetries := 0 + // serverErrorInterval grows the wait between consecutive 5xx retries and is + // reset by any other response. + serverErrorInterval := interval + // lastErr holds the most recent retryable failure so a deadline reached + // mid-retry reports that diagnostic instead of a bare "timed out". It is + // cleared whenever polling recovers, so a genuine user timeout after a + // recovered blip still reports plainly. + var lastErr error for time.Now().Before(deadline) { req, err := http.NewRequestWithContext(ctx, http.MethodPost, g.accessTokenURL, bytes.NewBuffer(jsonData)) if err != nil { @@ -247,8 +333,20 @@ func (g *GitHubATProvider) pollForToken(ctx context.Context, deviceCode string) return "", err } - var tokenResp AccessTokenResponse - err = json.Unmarshal(body, &tokenResp) + // A transient 5xx must not abandon a login the user may already have + // approved in the browser. Each consecutive 5xx grows the wait by 5s up + // to maxPollInterval, so a sustained outage costs a couple of dozen + // requests rather than hundreds; the deadline bounds the number of + // these retries. + if resp.StatusCode >= http.StatusInternalServerError { + lastErr = fmt.Errorf("token endpoint returned %d", resp.StatusCode) + serverErrorInterval = min(serverErrorInterval+5, maxPollInterval) + g.sleep(time.Duration(serverErrorInterval) * time.Second) + continue + } + serverErrorInterval = interval + + tokenResp, err := decodeAccessTokenResponse(resp.StatusCode, body) if err != nil { return "", err } @@ -263,12 +361,26 @@ func (g *GitHubATProvider) pollForToken(ctx context.Context, deviceCode string) interval = maxPollInterval } } + lastErr = nil g.sleep(time.Duration(interval) * time.Second) continue } if tokenResp.Error != "" { - return "", fmt.Errorf("token request failed: %s", tokenResp.Error) + failure := fmt.Errorf("token request failed: %s", tokenResp.errorDetail()) + + // incorrect_device_code has been reported for codes that were in + // fact valid (cli/cli#9302; cause never confirmed), so spend a + // couple of grace polls before abandoning a login the user may + // have approved. + if tokenResp.Error == "incorrect_device_code" && graceRetries < incorrectDeviceCodeGraceRetries { + graceRetries++ + lastErr = failure + g.sleep(time.Duration(interval) * time.Second) + continue + } + + return "", failure } if tokenResp.AccessToken != "" { @@ -279,6 +391,9 @@ func (g *GitHubATProvider) pollForToken(ctx context.Context, deviceCode string) return "", fmt.Errorf("failed to obtain access token") } + if lastErr != nil { + return "", fmt.Errorf("device code authorization timed out; last response: %w", lastErr) + } return "", fmt.Errorf("device code authorization timed out") } diff --git a/cmd/publisher/auth/github_at_device_flow_internal_test.go b/cmd/publisher/auth/github_at_device_flow_internal_test.go new file mode 100644 index 0000000..b1e13ac --- /dev/null +++ b/cmd/publisher/auth/github_at_device_flow_internal_test.go @@ -0,0 +1,532 @@ +package auth + +import ( + "context" + "encoding/json" + "fmt" + "net/http" + "net/http/httptest" + "sync" + "testing" + "time" + + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +// seqTokenServer serves a fixed sequence of (status, body) responses, one per +// request, reusing the last one once the sequence is exhausted. Unlike +// newMockTokenServer it can serve non-200 statuses and non-JSON bodies, which +// the transient-5xx path needs. +type seqTokenServer struct { + srv *httptest.Server + mu sync.Mutex + seen int + items []seqResp +} + +type seqResp struct { + status int + body string +} + +func newSeqTokenServer(t *testing.T, items ...seqResp) *seqTokenServer { + t.Helper() + s := &seqTokenServer{items: items} + s.srv = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) { + s.mu.Lock() + item := s.items[len(s.items)-1] + if s.seen < len(s.items) { + item = s.items[s.seen] + } + s.seen++ + s.mu.Unlock() + w.Header().Set("Content-Type", "application/json") + w.WriteHeader(item.status) + _, _ = w.Write([]byte(item.body)) + })) + t.Cleanup(s.srv.Close) + return s +} + +func (s *seqTokenServer) requests() int { + s.mu.Lock() + defer s.mu.Unlock() + return s.seen +} + +func okResp(body string) seqResp { return seqResp{status: http.StatusOK, body: body} } + +// serverErrorResp is a 502 carrying an HTML body rather than JSON, the shape a +// transient edge failure takes. +func serverErrorResp() seqResp { + return seqResp{status: http.StatusBadGateway, body: `Server Error`} +} + +const ( + testClientID = "test-client-id" + + pendingBody = `{"error":"authorization_pending"}` + incorrectBody = `{"error":"incorrect_device_code"}` + // The full shape GitHub sends for this error, description and URI included. + incorrectVerboseBody = `{"error":"incorrect_device_code","error_description":"The device_code provided is not valid.","error_uri":"https://docs.github.com/developers/apps/authorizing-oauth-apps#error-codes-for-the-device-flow"}` + tokenBody = `{"access_token":"gho_test_token","token_type":"bearer","scope":"read:org,read:user"}` // #nosec G101 -- test fixture, not a real secret +) + +// TestPollForToken_IncorrectDeviceCodeIsTerminalAfterGrace confirms a code that +// stays invalid past the grace polls still fails, and fails with the error +// GitHub reported rather than a rewritten one. +func TestPollForToken_IncorrectDeviceCodeIsTerminalAfterGrace(t *testing.T) { + gh := newSeqTokenServer(t, okResp(pendingBody), okResp(pendingBody), okResp(incorrectBody)) + p, _ := newPollTestProvider(gh.srv.URL) + + _, err := p.pollForToken(context.Background(), "issued-device-code") + require.Error(t, err) + assert.Equal(t, "token request failed: incorrect_device_code", err.Error()) + // 2 pending + 1 incorrect + 2 grace polls that also answer incorrect. + assert.Equal(t, 5, gh.requests()) +} + +// TestPollForToken_TransientIncorrectDeviceCodeRecovered covers the case the +// grace retries exist for: one incorrect_device_code between a pending poll and +// a successful one must not discard a token the user already authorised. +func TestPollForToken_TransientIncorrectDeviceCodeRecovered(t *testing.T) { + gh := newSeqTokenServer(t, okResp(pendingBody), okResp(incorrectBody), okResp(tokenBody)) + p, _ := newPollTestProvider(gh.srv.URL) + + token, err := p.pollForToken(context.Background(), "issued-device-code") + require.NoError(t, err, "one transient incorrect_device_code must not be fatal") + assert.Equal(t, "gho_test_token", token) + assert.Equal(t, 3, gh.requests()) +} + +func TestPollForToken_OAuthErrorsRetryOnBadRequest(t *testing.T) { + for _, status := range []int{http.StatusOK, http.StatusBadRequest} { + for _, code := range []string{"authorization_pending", "slow_down", "incorrect_device_code"} { + t.Run(fmt.Sprintf("%d/%s", status, code), func(t *testing.T) { + gh := newSeqTokenServer(t, + seqResp{status: status, body: fmt.Sprintf(`{"error":%q}`, code)}, + okResp(tokenBody), + ) + p, slept := newPollTestProvider(gh.srv.URL) + p.pollInterval = defaultPollInterval + + token, err := p.pollForToken(context.Background(), "issued-device-code") + require.NoError(t, err) + assert.Equal(t, "gho_test_token", token) + assert.Equal(t, 2, gh.requests()) + wait := time.Duration(defaultPollInterval) * time.Second + if code == "slow_down" { + wait += 5 * time.Second + } + assert.Equal(t, []time.Duration{wait}, *slept) + }) + } + } +} + +func TestPollForToken_BadRequestOAuthErrorsRemainTerminal(t *testing.T) { + for _, code := range []string{"access_denied", "expired_token", "unknown_error", "incorrect_device_code"} { + t.Run(code, func(t *testing.T) { + gh := newSeqTokenServer(t, seqResp{ + status: http.StatusBadRequest, + body: fmt.Sprintf(`{"error":%q,"error_description":"Request rejected","error_uri":"https://github.com/error"}`, code), + }) + p, slept := newPollTestProvider(gh.srv.URL) + + token, err := p.pollForToken(context.Background(), "issued-device-code") + require.EqualError(t, err, "token request failed: "+code+": Request rejected (https://github.com/error)") + assert.Empty(t, token) + retries := 0 + if code == "incorrect_device_code" { + retries = incorrectDeviceCodeGraceRetries + } + assert.Equal(t, 1+retries, gh.requests()) + assert.Len(t, *slept, retries) + }) + } +} + +// TestPollForToken_ErrorDescriptionAndURISurfaced confirms the grace budget is +// spent in full against a persistently invalid code, and that GitHub's +// error_description and error_uri reach the user instead of being discarded. +func TestPollForToken_ErrorDescriptionAndURISurfaced(t *testing.T) { + gh := newSeqTokenServer(t, okResp(incorrectVerboseBody)) + p, _ := newPollTestProvider(gh.srv.URL) + + _, err := p.pollForToken(context.Background(), "issued-device-code") + require.Error(t, err) + assert.Contains(t, err.Error(), "incorrect_device_code") + assert.Contains(t, err.Error(), "The device_code provided is not valid.") + assert.Contains(t, err.Error(), "error-codes-for-the-device-flow") + assert.Equal(t, 1+incorrectDeviceCodeGraceRetries, gh.requests()) +} + +// TestPollForToken_TransientServerErrorRetried confirms a 5xx (which carries an +// HTML body, not JSON) is retried rather than ending the login. +func TestPollForToken_TransientServerErrorRetried(t *testing.T) { + gh := newSeqTokenServer(t, + serverErrorResp(), + okResp(tokenBody), + ) + p, slept := newPollTestProvider(gh.srv.URL) + + token, err := p.pollForToken(context.Background(), "issued-device-code") + require.NoError(t, err) + assert.Equal(t, "gho_test_token", token) + assert.Equal(t, 2, gh.requests()) + assert.Len(t, *slept, 1, "the 5xx must be followed by one back-off") +} + +// TestPollForToken_FirstPollIsImmediate pins the polling schedule: the first +// request goes out without a preceding sleep, so a user who authorises quickly +// is not made to wait an interval for nothing. +func TestPollForToken_FirstPollIsImmediate(t *testing.T) { + gh := newSeqTokenServer(t, okResp(tokenBody)) + p, slept := newPollTestProvider(gh.srv.URL) + + _, err := p.pollForToken(context.Background(), "issued-device-code") + require.NoError(t, err) + assert.Equal(t, 1, gh.requests()) + assert.Empty(t, *slept, "an immediately successful poll must not sleep") +} + +// TestRequestDeviceCode_HonoursServerIntervalAndExpiry confirms the interval and +// expires_in in the device-code response are adopted rather than dropped. +func TestRequestDeviceCode_HonoursServerIntervalAndExpiry(t *testing.T) { + device := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) { + w.Header().Set("Content-Type", "application/json") + _, _ = w.Write([]byte(`{"device_code":"dc-1","user_code":"AAAA-BBBB","verification_uri":"https://github.com/login/device","expires_in":60,"interval":7}`)) + })) + t.Cleanup(device.Close) + + p := &GitHubATProvider{ + clientID: testClientID, + deviceCodeURL: device.URL, + pollInterval: defaultPollInterval, + expiresIn: defaultExpiresIn, + } + + deviceCode, userCode, uri, err := p.requestDeviceCode(context.Background()) + require.NoError(t, err) + assert.Equal(t, "dc-1", deviceCode) + assert.Equal(t, "AAAA-BBBB", userCode) + assert.Equal(t, "https://github.com/login/device", uri) + assert.Equal(t, 7, p.pollInterval, "interval from the response must be adopted") + assert.Equal(t, 60, p.expiresIn, "expires_in from the response must be adopted") +} + +// TestRequestDeviceCode_KeepsDefaultsWhenOmitted confirms a response without +// interval or expires_in leaves the documented defaults in place. +func TestRequestDeviceCode_KeepsDefaultsWhenOmitted(t *testing.T) { + device := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) { + w.Header().Set("Content-Type", "application/json") + _, _ = w.Write([]byte(`{"device_code":"dc-2","user_code":"EEEE-FFFF","verification_uri":"https://github.com/login/device"}`)) + })) + t.Cleanup(device.Close) + + p := &GitHubATProvider{ + clientID: testClientID, + deviceCodeURL: device.URL, + pollInterval: defaultPollInterval, + expiresIn: defaultExpiresIn, + } + + _, _, _, err := p.requestDeviceCode(context.Background()) + require.NoError(t, err) + assert.Equal(t, defaultPollInterval, p.pollInterval) + assert.Equal(t, defaultExpiresIn, p.expiresIn) +} + +// deviceCodeServerReturning serves a single device-code response with the given +// raw JSON body, for exercising interval/expires_in handling. +func deviceCodeServerReturning(t *testing.T, body string) string { + t.Helper() + srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) { + w.Header().Set("Content-Type", "application/json") + _, _ = w.Write([]byte(body)) + })) + t.Cleanup(srv.Close) + return srv.URL +} + +// TestRequestDeviceCode_ClampsExcessiveInterval confirms an interval far above +// maxPollInterval is clamped, protecting the same invariant maxPollInterval +// enforces on the slow_down path. +func TestRequestDeviceCode_ClampsExcessiveInterval(t *testing.T) { + url := deviceCodeServerReturning(t, + `{"device_code":"dc","user_code":"AAAA-BBBB","verification_uri":"https://github.com/login/device","expires_in":900,"interval":86400}`) + + p := &GitHubATProvider{clientID: testClientID, deviceCodeURL: url, pollInterval: defaultPollInterval, expiresIn: defaultExpiresIn} + _, _, _, err := p.requestDeviceCode(context.Background()) + require.NoError(t, err) + assert.Equal(t, maxPollInterval, p.pollInterval, "interval above the cap must be clamped") +} + +// TestRequestDeviceCode_ClampsOverflowValues covers the overflow pair: values +// large enough that time.Duration(n)*time.Second wraps negative would make +// sleep return instantly (spinning the loop) and put the deadline in the past +// (yielding zero polls). Clamping keeps both within safe bounds. +func TestRequestDeviceCode_ClampsOverflowValues(t *testing.T) { + url := deviceCodeServerReturning(t, + `{"device_code":"dc","user_code":"AAAA-BBBB","verification_uri":"https://github.com/login/device","expires_in":10000000000,"interval":10000000000}`) + + p := &GitHubATProvider{clientID: testClientID, deviceCodeURL: url, pollInterval: defaultPollInterval, expiresIn: defaultExpiresIn} + _, _, _, err := p.requestDeviceCode(context.Background()) + require.NoError(t, err) + + assert.Equal(t, maxPollInterval, p.pollInterval) + assert.Equal(t, maxExpiresIn, p.expiresIn) +} + +// TestRequestDeviceCode_IgnoresNegativeValues confirms negative interval and +// expires_in are rejected in favour of the defaults, so neither can produce a +// negative sleep or a deadline already in the past. +func TestRequestDeviceCode_IgnoresNegativeValues(t *testing.T) { + url := deviceCodeServerReturning(t, + `{"device_code":"dc","user_code":"AAAA-BBBB","verification_uri":"https://github.com/login/device","expires_in":-1,"interval":-1}`) + + p := &GitHubATProvider{clientID: testClientID, deviceCodeURL: url, pollInterval: defaultPollInterval, expiresIn: defaultExpiresIn} + _, _, _, err := p.requestDeviceCode(context.Background()) + require.NoError(t, err) + + assert.Equal(t, defaultPollInterval, p.pollInterval, "negative interval must fall back to the default") + assert.Equal(t, defaultExpiresIn, p.expiresIn, "negative expires_in must fall back to the default") +} + +// TestPollForToken_TimeoutSurfacesLastError covers F2: when the deadline lands +// mid-retry, the timeout must carry the last retryable diagnostic instead of a +// bare "timed out". The grace poll records the full-shape incorrect_device_code +// and its following sleep crosses the (1-second) deadline. +func TestPollForToken_TimeoutSurfacesLastError(t *testing.T) { + gh := newSeqTokenServer(t, okResp(incorrectVerboseBody)) + p := &GitHubATProvider{ + clientID: testClientID, + accessTokenURL: gh.srv.URL, + pollInterval: 1, + expiresIn: 1, // deadline ~1s out + sleep: func(time.Duration) { time.Sleep(1100 * time.Millisecond) }, + } + + _, err := p.pollForToken(context.Background(), "issued-device-code") + require.Error(t, err) + assert.Contains(t, err.Error(), "timed out") + assert.Contains(t, err.Error(), "The device_code provided is not valid.", + "the last retryable diagnostic must survive the timeout") +} + +// TestPollForToken_TimeoutAfterRecoveryIsBare confirms lastErr is cleared when +// polling recovers: one transient 502 followed by healthy pending polls and +// then a genuine user timeout must report plainly, not blame the stale 502. +func TestPollForToken_TimeoutAfterRecoveryIsBare(t *testing.T) { + gh := newSeqTokenServer(t, + serverErrorResp(), + okResp(pendingBody), + ) + p := &GitHubATProvider{ + clientID: testClientID, + accessTokenURL: gh.srv.URL, + pollInterval: 1, + expiresIn: 1, // deadline ~1s out + sleep: func(time.Duration) { time.Sleep(400 * time.Millisecond) }, + } + + _, err := p.pollForToken(context.Background(), "issued-device-code") + require.Error(t, err) + assert.Equal(t, "device code authorization timed out", err.Error(), + "a recovered 502 must not be reported as the cause of a user timeout") +} + +// Non-OAuth failures retain HTTP diagnostics rather than JSON parsing errors. +func TestPollForToken_NonOKStatusSurfacesStatusAndBody(t *testing.T) { + for _, tt := range []struct { + name string + resp seqResp + }{ + {"rate_limited", seqResp{status: http.StatusTooManyRequests, body: "rate limited"}}, + {"bad_request_html", seqResp{status: http.StatusBadRequest, body: "bad request"}}, + {"bad_request_invalid_json", seqResp{status: http.StatusBadRequest, body: `{"error":`}}, + {"bad_request_empty_error", seqResp{status: http.StatusBadRequest, body: `{"error":""}`}}, + {"bad_request_token", seqResp{status: http.StatusBadRequest, body: tokenBody}}, + {"pending_on_other_status", seqResp{status: http.StatusForbidden, body: pendingBody}}, + } { + t.Run(tt.name, func(t *testing.T) { + gh := newSeqTokenServer(t, tt.resp) + p, slept := newPollTestProvider(gh.srv.URL) + + token, err := p.pollForToken(context.Background(), "issued-device-code") + require.EqualError(t, err, fmt.Sprintf("token endpoint returned %d: %s", tt.resp.status, tt.resp.body)) + assert.Empty(t, token) + assert.Equal(t, 1, gh.requests(), "a non-retryable status must stop polling") + assert.Empty(t, *slept) + }) + } +} + +// TestPollForToken_ConsecutiveServerErrorsBackOff confirms the 5xx wait grows by +// 5s per consecutive failure and is capped, so a sustained outage costs a +// bounded number of requests rather than hammering the endpoint. +func TestPollForToken_ConsecutiveServerErrorsBackOff(t *testing.T) { + responses := make([]seqResp, 0, 4) + for range [3]struct{}{} { + responses = append(responses, serverErrorResp()) + } + responses = append(responses, okResp(tokenBody)) + + gh := newSeqTokenServer(t, responses...) + p, slept := newPollTestProvider(gh.srv.URL) + + token, err := p.pollForToken(context.Background(), "issued-device-code") + require.NoError(t, err) + assert.Equal(t, "gho_test_token", token) + + // Base interval is 0 in the test provider, so the waits are 5, 10, 15. + require.Len(t, *slept, 3) + assert.Equal(t, 5*time.Second, (*slept)[0]) + assert.Equal(t, 10*time.Second, (*slept)[1]) + assert.Equal(t, 15*time.Second, (*slept)[2]) +} + +// TestPollForToken_ServerErrorBackOffResetsOnRecovery confirms the 5xx growth is +// reset by any non-5xx response, so an intermittent endpoint does not +// accumulate an ever-longer wait across separate blips. +func TestPollForToken_ServerErrorBackOffResetsOnRecovery(t *testing.T) { + serverError := serverErrorResp() + gh := newSeqTokenServer(t, + serverError, + okResp(pendingBody), + serverError, + okResp(tokenBody), + ) + p, slept := newPollTestProvider(gh.srv.URL) + + token, err := p.pollForToken(context.Background(), "issued-device-code") + require.NoError(t, err) + assert.Equal(t, "gho_test_token", token) + + // 5s for the first 5xx, 0s for the pending poll (base interval), then 5s + // again — not 10s — because the pending response reset the growth. + require.Len(t, *slept, 3) + assert.Equal(t, 5*time.Second, (*slept)[0]) + assert.Equal(t, 0*time.Second, (*slept)[1]) + assert.Equal(t, 5*time.Second, (*slept)[2]) +} + +// TestRequestDeviceCode_PacingDoesNotLeakAcrossCodes covers F4: interval and +// expires_in are bound to the code they were issued with, so a second request +// that omits them must fall back to defaults rather than inherit the first. +func TestRequestDeviceCode_PacingDoesNotLeakAcrossCodes(t *testing.T) { + var call int + srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) { + w.Header().Set("Content-Type", "application/json") + if call == 0 { + _, _ = w.Write([]byte(`{"device_code":"dc1","user_code":"AAAA-BBBB","verification_uri":"https://github.com/login/device","expires_in":120,"interval":55}`)) + } else { + _, _ = w.Write([]byte(`{"device_code":"dc2","user_code":"CCCC-DDDD","verification_uri":"https://github.com/login/device"}`)) + } + call++ + })) + t.Cleanup(srv.Close) + + p := &GitHubATProvider{clientID: testClientID, deviceCodeURL: srv.URL, pollInterval: defaultPollInterval, expiresIn: defaultExpiresIn} + + _, _, _, err := p.requestDeviceCode(context.Background()) + require.NoError(t, err) + assert.Equal(t, 55, p.pollInterval) + assert.Equal(t, 120, p.expiresIn) + + _, _, _, err = p.requestDeviceCode(context.Background()) + require.NoError(t, err) + assert.Equal(t, defaultPollInterval, p.pollInterval, "second code must not inherit the first's interval") + assert.Equal(t, defaultExpiresIn, p.expiresIn, "second code must not inherit the first's expires_in") +} + +// TestLogin_ClientIDStableAcrossDeviceCodeAndPolls covers the whole device flow +// end to end and pins the one invariant that makes incorrect_device_code +// meaningful: the health endpoint is read once, and the client_id the device +// code was issued under is the one every poll carries. The mock token endpoint +// answers incorrect_device_code for any other pairing. +func TestLogin_ClientIDStableAcrossDeviceCodeAndPolls(t *testing.T) { + var mu sync.Mutex + healthCalls := 0 + deviceClientID := "" + pollClientIDs := []string{} + pollCount := 0 + const issued = "dc-login" + + registry := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + if r.URL.Path != "/v0/health" { + http.NotFound(w, r) + return + } + mu.Lock() + healthCalls++ + id := fmt.Sprintf("Iv23liCLIENT%04d", healthCalls) + mu.Unlock() + w.Header().Set("Content-Type", "application/json") + _, _ = fmt.Fprintf(w, `{"status":"ok","github_client_id":"%s"}`, id) + })) + t.Cleanup(registry.Close) + + device := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + var req map[string]string + // assert, not require: t.FailNow from a handler goroutine is unsupported. + if !assert.NoError(t, json.NewDecoder(r.Body).Decode(&req)) { + http.Error(w, "bad request body", http.StatusBadRequest) + return + } + mu.Lock() + deviceClientID = req["client_id"] + mu.Unlock() + w.Header().Set("Content-Type", "application/json") + _, _ = fmt.Fprintf(w, `{"device_code":"%s","user_code":"CCCC-DDDD","verification_uri":"https://github.com/login/device","expires_in":900,"interval":5}`, issued) + })) + t.Cleanup(device.Close) + + tokenSrv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + var req map[string]string + // assert, not require: t.FailNow from a handler goroutine is unsupported. + if !assert.NoError(t, json.NewDecoder(r.Body).Decode(&req)) { + http.Error(w, "bad request body", http.StatusBadRequest) + return + } + mu.Lock() + pollClientIDs = append(pollClientIDs, req["client_id"]) + bound := req["client_id"] == deviceClientID && req["device_code"] == issued + pollCount++ + first := pollCount == 1 + mu.Unlock() + + w.Header().Set("Content-Type", "application/json") + switch { + case !bound: + _, _ = w.Write([]byte(incorrectBody)) + case first: + _, _ = w.Write([]byte(pendingBody)) + default: + _, _ = w.Write([]byte(tokenBody)) + } + })) + t.Cleanup(tokenSrv.Close) + + p := &GitHubATProvider{ + registryURL: registry.URL, + deviceCodeURL: device.URL, + accessTokenURL: tokenSrv.URL, + pollInterval: defaultPollInterval, + expiresIn: defaultExpiresIn, + sleep: func(time.Duration) {}, + } + + require.NoError(t, p.Login(context.Background())) + assert.Equal(t, "gho_test_token", p.githubToken) + + mu.Lock() + defer mu.Unlock() + assert.Equal(t, 1, healthCalls, "Login must read the health endpoint exactly once") + assert.Equal(t, "Iv23liCLIENT0001", deviceClientID) + for _, id := range pollClientIDs { + assert.Equal(t, deviceClientID, id, + "every poll must carry the client_id the device code was issued under") + } +} diff --git a/docs/reference/cli/commands.md b/docs/reference/cli/commands.md index c8d7615..690a7f4 100644 --- a/docs/reference/cli/commands.md +++ b/docs/reference/cli/commands.md @@ -70,6 +70,10 @@ mcp-publisher login github [--token=PAT] [--registry=URL] [publishing from GitHub Actions](../../modelcontextprotocol-io/github-actions.mdx) authenticates without a browser. This flag is accepted by `login github` only. +Interactive login handles retryable OAuth errors in both HTTP 200 and HTTP 400 responses. +Access denial, expired codes, and unrecognized OAuth errors still stop polling; an +`incorrect_device_code` error receives at most two additional attempts per login. + #### GitHub OIDC (CI/CD) ```bash mcp-publisher login github-oidc [--registry=URL]